@skyf0xx/hedgehog 5.2.0 → 5.3.1

package/bin/cli.mjs

@@ -37,6 +37,7 @@ import {
   releaseTask,
   renewLease,
   retryTask,
+  reopenTask,
   reapExpiredLeases,
 } from '../src/db/claim.mjs';
 import { readyTasks, formatReady } from '../src/db/ready.mjs';
@@ -499,7 +500,9 @@ ${bold('Usage')}
   npx @skyf0xx/hedgehog update                    refresh the installed agents + skills
   npx @skyf0xx/hedgehog update --check            report whether a newer release is published
   npx @skyf0xx/hedgehog db init                   create .hedgehog/hedgehog.db if absent
-  npx @skyf0xx/hedgehog db rebuild                re-derive the build graph from committed intents + git history
+  npx @skyf0xx/hedgehog db rebuild                re-derive the build graph from committed intents + git history;
+                                                   also reconciles graph state after a hand-committed fix landed
+                                                   outside 'hedgehog verify' — run it to mark that work complete
   npx @skyf0xx/hedgehog plan                      compile pending intents into tasks + dependencies
                                                    (starts no graph server; --no-open says so explicitly)
   npx @skyf0xx/hedgehog plan --open               also start the graph server and open it, if anything compiled
@@ -515,6 +518,8 @@ ${bold('Usage')}
   npx @skyf0xx/hedgehog claim --owner <owner> [--count <n>]   atomically claim up to n ready tasks
   npx @skyf0xx/hedgehog claim <task-id> --owner <owner>   claim one specific task (breaks a starvation tie)
   npx @skyf0xx/hedgehog retry <task-id>           return a blocked task to planned, so it can be rebuilt
+  npx @skyf0xx/hedgehog reopen <task-id> --confirm   return a complete task (and its complete dependents) to
+                                                   planned, for a Correction Protocol fix to an already-shipped layer
   npx @skyf0xx/hedgehog release <task-id> --owner <owner>   hand a claimed task back to ready
   npx @skyf0xx/hedgehog renew <task-id> --owner <owner> [--minutes <n>]   extend a held lease
   npx @skyf0xx/hedgehog verify <task-id> --owner <owner>   run scope + verify checks, commit on pass
@@ -1297,9 +1302,10 @@ async function warnSingularModuleId(intent) {
 
   console.log(
     `\n${yellow(bold('Module id looks singular.'))} On this core the intent id is ${bold('{module}')} in\n` +
-      `every layer's scope, and the generators take it plural — so ${bold(intent.id)} compiles\n` +
-      `scope for ${bold(`${intent.id}/`)} while the scaffold command writes ${bold(`${intent.id}s/`)}.\n` +
-      `If ${bold(`${intent.id}s`)} is the name you meant, fix it now, before ${bold('hedgehog plan')}:\n` +
+      `every layer's scope. On some cores the generator pluralizes it, so ${bold(intent.id)} would\n` +
+      `compile scope for ${bold(`${intent.id}/`)} while the scaffold command writes ${bold(`${intent.id}s/`)} — worth\n` +
+      `checking this core's own generator before ${bold('hedgehog plan')}. If ${bold(`${intent.id}s`)} is the name you\n` +
+      `meant, it's still cheap to fix now:\n` +
       `  ${dim(`git mv ${INTENTS_DIR}/${intent.id}.json ${INTENTS_DIR}/${intent.id}s.json`)}\n` +
       `  ${dim(`# edit "id" and every ${intent.id.toUpperCase()}-* requirement id, then:`)}\n` +
       `  ${dim('hedgehog db rebuild')}\n`,
@@ -1347,11 +1353,12 @@ function warnSingularModuleIdsAtPlan(core, db) {
   console.log(
     `${yellow(bold(many ? `${singular.length} module ids look singular.` : 'Module id looks singular.'))} ` +
       `On this core an intent id is ${bold('{module}')} in\n` +
-      `every layer's scope, and the generators take it plural — so ${many ? 'each of these compiles' : 'this compiles'}\n` +
-      `scope for a directory the scaffold command will never write:\n` +
-      singular.map((id) => `  ${bold(id)} ${dim(`— scope ${id}/, scaffold writes ${id}s/`)}`).join('\n') +
+      `every layer's scope. On some cores the generator pluralizes it, so ${many ? 'each of these would compile' : 'this would compile'}\n` +
+      `scope for a directory the scaffold command might never write:\n` +
+      singular.map((id) => `  ${bold(id)} ${dim(`— scope ${id}/, generator may instead write ${id}s/`)}`).join('\n') +
       `\n\nThis is a naming convention, not a rule — ${bold('billing')} and ${bold('search')} are ` +
-      `legitimately\nsingular. If the plural is what you meant, it is still cheap to fix:\n` +
+      `legitimately\nsingular, and not every core's generator pluralizes at all — check this core's own\n` +
+      `generator before assuming it does. If the plural is what you meant, it is still cheap to fix:\n` +
       singular
         .map(
           (id) =>
@@ -1927,6 +1934,84 @@ async function retryCommand(args) {
   console.log(`  ${dim('claim it with')}  hedgehog claim ${taskId} --owner <owner>`);
 }
 
+// `hedgehog reopen <task-id> --confirm` — the transition out of
+// `complete`, for a Correction Protocol fix: a downstream layer reveals
+// an upstream one (already verified, committed, and possibly built upon)
+// was wrong. `retry` only returns a `blocked` task to `planned`; nothing
+// else in the CLI moves a `complete` task backward, which left a
+// Correction Protocol fix with no path but a hand-authored commit
+// outside `hedgehog verify` entirely (see the issue this command closes).
+//
+// `--confirm` is required and is the whole difference from `retry`'s
+// UX: retrying a blocked task undoes nothing that shipped, but reopening
+// a complete task does, transitively, for everything built on top of it
+// — that's consequential enough to need the caller to say so explicitly
+// rather than default to it.
+async function reopenCommand(args) {
+  await ensureDb();
+
+  const taskId = args[0] && !args[0].startsWith('--') ? args[0] : undefined;
+  const confirmed = args.includes('--confirm');
+  if (!taskId) {
+    console.error(`${red('Usage:')} hedgehog reopen <task-id> --confirm\n`);
+    process.exitCode = 1;
+    return;
+  }
+  if (!confirmed) {
+    console.error(
+      `${red('Refused.')} Reopening ${bold(taskId)} undoes a completed, committed layer and\n` +
+        `every completed layer built on top of it. Re-run with ${bold('--confirm')} to proceed:\n\n` +
+        `  hedgehog reopen ${taskId} --confirm\n`,
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  if (!(await exists(DB_PATH))) {
+    console.error(`${red('No build graph found.')} Run ${bold('hedgehog db init')} first.\n`);
+    process.exitCode = 1;
+    return;
+  }
+
+  printDbTarget();
+
+  const db = openDb();
+  let result;
+  try {
+    result = reopenTask(db, taskId);
+  } finally {
+    db.close();
+  }
+
+  if (!result.reopened) {
+    process.exitCode = 1;
+    if (result.reason === 'no_such_task') {
+      console.error(`${red('No such task:')} ${bold(taskId)}${dim(` (in ${dbAbsPath()})`)}\n`);
+      return;
+    }
+    console.error(
+      `${red('Not reopened.')} Task ${bold(taskId)} is ${bold(result.task.status)}, not ${bold('complete')}.\n`,
+    );
+    return;
+  }
+
+  console.log(
+    `${green(bold('Reopened.'))} ${bold(result.reopenedIds.length)} task(s) back to ${bold('planned')}: ${result.reopenedIds.join(', ')}`,
+  );
+  console.log(`  ${dim('claim the fix with')}  hedgehog claim ${taskId} --owner <owner>`);
+  if (result.stillInFlight.length > 0) {
+    console.log(
+      `\n${yellow(bold('Downstream, not reopened'))} (not complete — nothing shipped yet to invalidate):`,
+    );
+    for (const t of result.stillInFlight) {
+      console.log(`  ${bold(t.id)}   ${t.status}`);
+    }
+  }
+  console.log(
+    `\n${dim('Hand-committing the fix instead of running it through')} ${bold('hedgehog verify')}${dim('? Reconcile graph state afterward with')} ${bold('hedgehog db rebuild')}${dim('.')}`,
+  );
+}
+
 // `hedgehog show <task-id>` — the same packet `next` prints, for a task
 // named by id whatever its status. Read-only: claims nothing, changes
 // nothing.
@@ -2922,6 +3007,11 @@ async function main() {
     return;
   }
 
+  if (cmd === 'reopen') {
+    await reopenCommand(args.slice(1));
+    return;
+  }
+
   if (cmd === 'release') {
     await releaseCommand(args.slice(1));
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyf0xx/hedgehog",
-  "version": "5.2.0",
+  "version": "5.3.1",
   "description": "Install the Hedgehog build discipline (agents + skills) into a repo, for Claude Code, Cursor, or Gemini CLI.",
   "type": "module",
   "repository": {

package/src/agents/planner.md

@@ -256,11 +256,20 @@ the first-run shape; on re-entry, run `hedgehog-planning-intake`'s
   owns `.hedgehog/chain/00-brief.md` and this core's own Confirm & Lock
   stage; `.hedgehog/BMAD/` is written by the shared Phase 0 in
   `hedgehog-planning-intake`.
+- **`deepseek-harness`** → no BMAD shelf runs on this core, and none of
+  `hedgehog-planning-intake` applies. Intake is mechanical, owned
+  entirely by `hedgehog-dsh-loop`'s own Planning intake section: confirm
+  the plugin name and goal with the user, one intent per plugin named
+  directly, `hedgehog intent add`, `hedgehog plan`, commit, hand off to
+  `bootstrap`. There is no subject/audience/job to mine and no brief to
+  lock — open that skill's section rather than looking for the shape
+  above here.
 
 Either way, this is the mechanical procedure; the judgment — what's
 actually in scope, where a table becomes a module (full-stack-app,
 pwa-app) or what the page's single job actually is (landing-page) —
-stays yours throughout.
+stays yours throughout, except on deepseek-harness, where the procedure
+itself is the judgment call: which plugin, named directly with the user.
 
 ## The Add-ons decision (full-stack-app only)
 

package/src/db/claim.mjs

@@ -401,6 +401,94 @@ export function retryTask(db, taskId) {
   });
 }
 
+// The full transitive closure of tasks that depend on `taskId`, directly
+// or through another dependent — the same walk verify.mjs's
+// loadDirectDependents feeds one layer at a time, extended to every
+// layer downstream. A Correction Protocol reopen has to see this whole
+// chain: an upstream task built on wrong output can have several
+// already-complete layers stacked on it, and every one of them was
+// built against the thing that's about to change.
+function loadTransitiveDependents(db, taskId) {
+  const directDependents = db.prepare(
+    'SELECT task_id AS id FROM dependencies WHERE depends_on_task_id = ?',
+  );
+  const seen = new Set([taskId]);
+  const downstream = [];
+  let frontier = [taskId];
+  while (frontier.length > 0) {
+    const next = [];
+    for (const id of frontier) {
+      for (const row of directDependents.all(id)) {
+        if (seen.has(row.id)) continue;
+        seen.add(row.id);
+        downstream.push(row.id);
+        next.push(row.id);
+      }
+    }
+    frontier = next;
+  }
+  return downstream;
+}
+
+// Reopens `taskId` for a Correction Protocol fix: moves a `complete` task
+// (and every `complete` task downstream of it, transitively) back to
+// `planned`, so the fix and every layer built on top of it are rebuilt
+// and re-verified in dependency order, the same as any other `planned`
+// task.
+//
+// This is deliberately not folded into `retryTask` as an automatic extra
+// case: `retry` returns a task the loop itself put into `blocked` —
+// expected, low-stakes, no confirmation needed. Reopening a `complete`
+// task undoes a task the loop already verified and committed, and can
+// invalidate everything built against it since, which is why the CLI
+// requires an explicit `--confirm` before calling this — see
+// `reopenCommand`.
+//
+// A downstream task not yet `complete` (still `planned`, `ready`,
+// `building`, `blocked`) is left exactly where it is: it hasn't shipped
+// anything for the fix to invalidate, and its own lease (if any) is not
+// this command's to touch. Only `complete` tasks — upstream's own status
+// plus every `complete` descendant — move; anything else downstream is
+// reported back so the caller can decide what to do about in-flight
+// work sitting on top of a reopened dependency.
+export function reopenTask(db, taskId) {
+  return inTransaction(db, () => {
+    reapExpiredLeases(db);
+    const task = loadTask(db, taskId);
+    if (task === undefined) return { reopened: false, reason: 'no_such_task' };
+    if (task.status !== 'complete') {
+      return { reopened: false, reason: 'not_complete', task };
+    }
+
+    const downstreamIds = loadTransitiveDependents(db, taskId);
+    const downstreamTasks = downstreamIds.map((id) => loadTask(db, id));
+    const toReopen = [task, ...downstreamTasks.filter((t) => t.status === 'complete')];
+    const stillInFlight = downstreamTasks.filter((t) => t.status !== 'complete');
+
+    const reopenOne = db.prepare(
+      `
+      UPDATE tasks SET status = 'planned', blocked_reason = NULL,
+        lease_owner = NULL, lease_expires_at = NULL, leased_at = NULL,
+        claim_snapshot = NULL
+      WHERE id = ? AND status = 'complete'
+      RETURNING id
+    `,
+    );
+    const reopenedIds = [];
+    for (const t of toReopen) {
+      const result = reopenOne.get(t.id);
+      if (result !== undefined) reopenedIds.push(result.id);
+    }
+
+    return {
+      reopened: true,
+      reopenedIds,
+      stillInFlight,
+      task: loadTask(db, taskId),
+    };
+  });
+}
+
 // Releases `taskId` back to `ready` if `owner` currently holds its lease.
 // Scoped to `status = 'building'` — `verifying` is the engine's own
 // transient lease during verifyTask, not something an external release

package/src/db/next.mjs

@@ -394,14 +394,29 @@ export function scopePackageRoot(glob, module) {
 // `exists` is injected so this module keeps no filesystem dependency of
 // its own; the CLI passes a real one and the packet degrades to no
 // section when a caller supplies none.
+//
+// A layer can carry more than one glob into the same real package — e.g.
+// `plugins/{module}/package.json` and `plugins/{module}/lib/**` both
+// belong to one package, but the second glob's own literal prefix ends
+// at `lib`, a build-output directory that never holds a `package.json`
+// of its own. Naively treating every such root as first-arrival would
+// flag `lib/` as a second package needing its own scaffold. A root
+// nested under another of this task's own roots is never a package
+// boundary — only the shallowest root in each chain is.
 export function firstArrivalPackages(task, exists) {
   if (!exists) return [];
-  const roots = new Set();
+  const allRoots = new Set();
+  const missing = new Set();
   for (const glob of JSON.parse(task.scope_globs)) {
     const root = scopePackageRoot(glob, task.module);
-    if (root && !exists(`${root}/package.json`)) roots.add(root);
+    if (!root) continue;
+    allRoots.add(root);
+    if (!exists(`${root}/package.json`)) missing.add(root);
   }
-  return [...roots].sort();
+  const outermost = [...missing].filter(
+    (root) => ![...allRoots].some((other) => other !== root && root.startsWith(`${other}/`)),
+  );
+  return outermost.sort();
 }
 
 function firstArrivalLines(task, roots) {

package/src/hosts/gemini/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "hedgehog",
-  "version": "5.2.0",
+  "version": "5.3.1",
   "description": "Hedgehog build discipline: ordered, tested, verified build steps.",
   "contextFileName": "GEMINI.md"
 }