@skyf0xx/hedgehog 6.2.2 → 6.2.3

package/README.md

@@ -12,6 +12,7 @@ English | [简体中文](README.zh-CN.md)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 [![CodeQL](https://img.shields.io/github/actions/workflow/status/skyf0xx/hedgehog/codeql.yml?branch=master&label=CodeQL)](https://github.com/skyf0xx/hedgehog/actions/workflows/codeql.yml)
 [![Check](https://img.shields.io/github/actions/workflow/status/skyf0xx/hedgehog/check.yml?branch=master&label=Check)](https://github.com/skyf0xx/hedgehog/actions/workflows/check.yml)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14399/badge)](https://www.bestpractices.dev/projects/14399)
 
 AI can write code in seconds.
 

package/README.zh-CN.md

@@ -12,6 +12,7 @@
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 [![CodeQL](https://img.shields.io/github/actions/workflow/status/skyf0xx/hedgehog/codeql.yml?branch=master&label=CodeQL)](https://github.com/skyf0xx/hedgehog/actions/workflows/codeql.yml)
 [![Check](https://img.shields.io/github/actions/workflow/status/skyf0xx/hedgehog/check.yml?branch=master&label=Check)](https://github.com/skyf0xx/hedgehog/actions/workflows/check.yml)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14399/badge)](https://www.bestpractices.dev/projects/14399)
 
 AI 能在几秒钟内写出代码。
 

package/bin/cli.mjs

@@ -78,17 +78,13 @@ import {
   createWorktree,
   hedgehogWorktrees,
   branchName,
-  worktreePath,
   intentReadyToMerge,
-  intentTaskStatuses,
   mergeBranch,
   removeWorktree,
   intentFileCommitted,
   onHedgehogBranch,
-  loadAbandoned,
   writeAbandonedFile,
   applyAbandonment,
-  replayAbandonments,
   ABANDONED_DIR,
 } from '../src/db/worktree.mjs';
 import { loadOverrides, addOverride, orphanedOverrides, OVERRIDES_DIR } from '../src/db/overrides.mjs';
@@ -126,7 +122,6 @@ const BLOCKED_REASON_LABELS = {
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PKG_ROOT = resolve(__dirname, '..');
 const DEST_ROOT = process.cwd();
-const DEFAULT_CORE = 'full-stack-app';
 
 // The version of the payload this CLI carries — what `init` and
 // `update` stamp into the project they write to.
@@ -3342,7 +3337,7 @@ async function reconcileCommand(args) {
   if (sub === 'list') {
     const reconciliations = await loadReconciliations();
     const db = openDb({ readOnly: true });
-    let orphaned = [];
+    let orphaned;
     try {
       orphaned = orphanedReconciliations(db, reconciliations);
     } finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyf0xx/hedgehog",
-  "version": "6.2.2",
+  "version": "6.2.3",
   "description": "Install the Hedgehog build discipline (agents + skills) into a repo, for Claude Code, Cursor, or Gemini CLI.",
   "type": "module",
   "repository": {
@@ -14,7 +14,8 @@
     "hedgehog": "bin/cli.mjs"
   },
   "scripts": {
-    "check": "node scripts/check.mjs",
+    "lint": "eslint .",
+    "check": "npm run lint && node scripts/check.mjs",
     "repro": "node --experimental-sqlite repro/run-all.mjs",
     "release": "node scripts/bump-package-version.mjs",
     "release:plugin": "node scripts/bump-plugin-version.mjs"
@@ -43,5 +44,9 @@
     "scaffold",
     "hedgehog"
   ],
-  "license": "MIT"
+  "license": "MIT",
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.9.1"
+  }
 }

package/src/db/drift.mjs

@@ -32,7 +32,6 @@ import {
   CORE_MODULE,
   loadIntentDependencies,
 } from './plan.mjs';
-import { loadOverrides } from './overrides.mjs';
 
 // Statuses a field rewrite is safe on: nothing has been built, leased,
 // committed, or failed against these rows yet, so moving their ALLOWED

package/src/db/gate.mjs

@@ -97,7 +97,7 @@ export async function commitGateStatus(projectRoot) {
     };
   }
 
-  let script = '';
+  let script;
   try {
     script = await readFile(hook, 'utf8');
   } catch {

package/src/db/notes.mjs

@@ -79,7 +79,7 @@ export async function loadNotes(notesDir = NOTES_DIR) {
     try {
       parsed = JSON.parse(await readFile(path, 'utf8'));
     } catch (err) {
-      throw new Error(`could not read notes file ${path}: ${err.message}`);
+      throw new Error(`could not read notes file ${path}: ${err.message}`, { cause: err });
     }
     const { task, notes } = validateNotesFile(parsed, path);
     byTask.set(task, notes);

package/src/db/overrides.mjs

@@ -122,7 +122,7 @@ export async function loadOverrides(overridesDir = OVERRIDES_DIR) {
     try {
       parsed = JSON.parse(await readFile(path, 'utf8'));
     } catch (err) {
-      throw new Error(`could not read override file ${path}: ${err.message}`);
+      throw new Error(`could not read override file ${path}: ${err.message}`, { cause: err });
     }
     const record = validateOverride(parsed, path);
     if (!byTask.has(record.task)) byTask.set(record.task, []);

package/src/db/plan.mjs

@@ -19,7 +19,7 @@
 // graph holds. Without it such a layer compiles once per intent and
 // every copy but the first is a replay of the same command.
 
-import { composeScope, loadOverrides } from './overrides.mjs';
+import { composeScope } from './overrides.mjs';
 
 export function fillModule(template, module) {
   return template.replaceAll('{module}', module);
@@ -535,7 +535,7 @@ export function planTasks(db, core, overrides = new Map(), { excludeIntentIds =
   const compiledOnceTaskIds = [];
   // Once-tasks that a newly compiled intent hangs a prerequisite on.
   const onceTasksGainingPrereqs = [];
-  let reopenedOnceTaskIds = [];
+  let reopenedOnceTaskIds;
 
   db.exec('BEGIN IMMEDIATE');
   try {

package/src/db/rebuild.mjs

@@ -198,12 +198,12 @@ async function replayIntents(db, intentsDir) {
     try {
       parsed = JSON.parse(await readFile(path, 'utf8'));
     } catch (err) {
-      throw new Error(`could not read intent file ${path}: ${err.message}`);
+      throw new Error(`could not read intent file ${path}: ${err.message}`, { cause: err });
     }
     try {
       records.push({ file, intent: normalizeIntent(parsed) });
     } catch (err) {
-      throw new Error(`invalid intent file ${path}: ${err.message}`);
+      throw new Error(`invalid intent file ${path}: ${err.message}`, { cause: err });
     }
   }
 

package/src/db/reconcile.mjs

@@ -148,7 +148,7 @@ export async function loadReconciliations(reconciledDir = RECONCILED_DIR) {
     try {
       parsed = JSON.parse(await readFile(path, 'utf8'));
     } catch (err) {
-      throw new Error(`could not read reconciliation file ${path}: ${err.message}`);
+      throw new Error(`could not read reconciliation file ${path}: ${err.message}`, { cause: err });
     }
     const record = validateReconciled(parsed, path);
     byTask.set(record.task, record);

package/src/db/verify.mjs

@@ -562,6 +562,7 @@ export function verifyTask(db, taskId, owner) {
         `the cause (a rejecting git hook, commit signing, or git identity), then ` +
         `re-run \`hedgehog verify ${task.id} --owner ${owner}\`, or hand it back ` +
         `with \`hedgehog release ${task.id} --owner ${owner}\`.\n\n${err.message}`,
+      { cause: err },
     );
   }
 

package/src/db/worktree.mjs

@@ -376,7 +376,7 @@ export async function loadAbandoned(abandonedDir = ABANDONED_DIR) {
     try {
       parsed = JSON.parse(await readFile(path, 'utf8'));
     } catch (err) {
-      throw new Error(`could not read abandonment file ${path}: ${err.message}`);
+      throw new Error(`could not read abandonment file ${path}: ${err.message}`, { cause: err });
     }
     const record = validateAbandoned(parsed, path);
     byIntent.set(record.intent, record);

package/src/hosts/gemini/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "hedgehog",
-  "version": "6.2.2",
+  "version": "6.2.3",
   "description": "Hedgehog build discipline: ordered, tested, verified build steps.",
   "contextFileName": "GEMINI.md"
 }

package/src/registry/fetch.mjs

@@ -122,14 +122,14 @@ async function packAndExtract(entry) {
     tarball = join(tmp, JSON.parse(stdout)[0].filename);
   } catch (err) {
     await rm(tmp, { recursive: true, force: true });
-    throw new Error(unresolvableMessage(entry, spec, err));
+    throw new Error(unresolvableMessage(entry, spec, err), { cause: err });
   }
 
   try {
     await execFileAsync('tar', ['-xzf', tarball, '-C', tmp]);
   } catch (err) {
     await rm(tmp, { recursive: true, force: true });
-    throw new Error(`Could not extract ${entry.package} from ${tarball}: ${err.message}`);
+    throw new Error(`Could not extract ${entry.package} from ${tarball}: ${err.message}`, { cause: err });
   }
 
   const root = join(tmp, TARBALL_ROOT);

package/src/skills/hedgehog-daily/SKILL.md

@@ -29,22 +29,31 @@ with a real cost, taken on stated conditions — not the safe default.
 ## The three exits
 
 Decide by the conditions, in order. The first one that holds is the exit.
+Re-plan is checked first, and its check is a read to make, not a
+suspicion to already hold — do not reach Change-work or Tweak without
+having made it.
 
 ### Re-plan
 
-The locked planning artifact that governs this project no longer
-describes what is being asked for. The core's own loop skill names which
-artifact governs — the brief and layer sequence for a shipped core,
-`.hedgehog/core-design.md` for an authored one, `.hedgehog/adoption.md`
-for an adopted one.
+The core's own loop skill names which artifact governs this project —
+the brief and layer sequence for a shipped core, `.hedgehog/core-design.md`
+for an authored one, `.hedgehog/adoption.md` for an adopted one. Read
+that artifact, then check:
 
-Route to `planner`'s re-entry pass, which adds intents for new work
-without re-running planning from scratch and without disturbing anything
-already built.
+- Does anything the request needs contradict a statement locked there —
+  an interface, a stack choice, a scope boundary?
 
-Where the artifact's failure means the request is a different project
-rather than an extension of this one, say so plainly instead of routing.
-That artifact is never rewritten to accommodate new scope.
+If it holds, this is Re-plan — regardless of how many layers the request
+reaches or whether every file it touches already exists. Route to
+`planner`'s re-entry pass, which adds intents for new work without
+re-running planning from scratch and without disturbing anything already
+built.
+
+Where the contradiction means the request is a different project rather
+than an extension of this one, say so plainly instead of routing. That
+artifact is never rewritten to accommodate new scope.
+
+If it does not hold, move on to Change-work.
 
 ### Change-work