@skyf0xx/hedgehog 6.2.2 → 6.2.4

package/README.md

@@ -12,6 +12,7 @@ English | [简体中文](README.zh-CN.md)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 [![CodeQL](https://img.shields.io/github/actions/workflow/status/skyf0xx/hedgehog/codeql.yml?branch=master&label=CodeQL)](https://github.com/skyf0xx/hedgehog/actions/workflows/codeql.yml)
 [![Check](https://img.shields.io/github/actions/workflow/status/skyf0xx/hedgehog/check.yml?branch=master&label=Check)](https://github.com/skyf0xx/hedgehog/actions/workflows/check.yml)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14399/badge)](https://www.bestpractices.dev/projects/14399)
 
 AI can write code in seconds.
 

package/README.zh-CN.md

@@ -12,6 +12,7 @@
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 [![CodeQL](https://img.shields.io/github/actions/workflow/status/skyf0xx/hedgehog/codeql.yml?branch=master&label=CodeQL)](https://github.com/skyf0xx/hedgehog/actions/workflows/codeql.yml)
 [![Check](https://img.shields.io/github/actions/workflow/status/skyf0xx/hedgehog/check.yml?branch=master&label=Check)](https://github.com/skyf0xx/hedgehog/actions/workflows/check.yml)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14399/badge)](https://www.bestpractices.dev/projects/14399)
 
 AI 能在几秒钟内写出代码。
 

package/bin/cli.mjs

@@ -78,17 +78,13 @@ import {
   createWorktree,
   hedgehogWorktrees,
   branchName,
-  worktreePath,
   intentReadyToMerge,
-  intentTaskStatuses,
   mergeBranch,
   removeWorktree,
   intentFileCommitted,
   onHedgehogBranch,
-  loadAbandoned,
   writeAbandonedFile,
   applyAbandonment,
-  replayAbandonments,
   ABANDONED_DIR,
 } from '../src/db/worktree.mjs';
 import { loadOverrides, addOverride, orphanedOverrides, OVERRIDES_DIR } from '../src/db/overrides.mjs';
@@ -126,7 +122,6 @@ const BLOCKED_REASON_LABELS = {
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PKG_ROOT = resolve(__dirname, '..');
 const DEST_ROOT = process.cwd();
-const DEFAULT_CORE = 'full-stack-app';
 
 // The version of the payload this CLI carries — what `init` and
 // `update` stamp into the project they write to.
@@ -3342,7 +3337,7 @@ async function reconcileCommand(args) {
   if (sub === 'list') {
     const reconciliations = await loadReconciliations();
     const db = openDb({ readOnly: true });
-    let orphaned = [];
+    let orphaned;
     try {
       orphaned = orphanedReconciliations(db, reconciliations);
     } finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyf0xx/hedgehog",
-  "version": "6.2.2",
+  "version": "6.2.4",
   "description": "Install the Hedgehog build discipline (agents + skills) into a repo, for Claude Code, Cursor, or Gemini CLI.",
   "type": "module",
   "repository": {
@@ -14,7 +14,8 @@
     "hedgehog": "bin/cli.mjs"
   },
   "scripts": {
-    "check": "node scripts/check.mjs",
+    "lint": "eslint .",
+    "check": "npm run lint && node scripts/check.mjs",
     "repro": "node --experimental-sqlite repro/run-all.mjs",
     "release": "node scripts/bump-package-version.mjs",
     "release:plugin": "node scripts/bump-plugin-version.mjs"
@@ -43,5 +44,9 @@
     "scaffold",
     "hedgehog"
   ],
-  "license": "MIT"
+  "license": "MIT",
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.9.1"
+  }
 }

package/src/db/drift.mjs

@@ -32,7 +32,6 @@ import {
   CORE_MODULE,
   loadIntentDependencies,
 } from './plan.mjs';
-import { loadOverrides } from './overrides.mjs';
 
 // Statuses a field rewrite is safe on: nothing has been built, leased,
 // committed, or failed against these rows yet, so moving their ALLOWED

package/src/db/gate.mjs

@@ -97,7 +97,7 @@ export async function commitGateStatus(projectRoot) {
     };
   }
 
-  let script = '';
+  let script;
   try {
     script = await readFile(hook, 'utf8');
   } catch {

package/src/db/notes.mjs

@@ -79,7 +79,7 @@ export async function loadNotes(notesDir = NOTES_DIR) {
     try {
       parsed = JSON.parse(await readFile(path, 'utf8'));
     } catch (err) {
-      throw new Error(`could not read notes file ${path}: ${err.message}`);
+      throw new Error(`could not read notes file ${path}: ${err.message}`, { cause: err });
     }
     const { task, notes } = validateNotesFile(parsed, path);
     byTask.set(task, notes);

package/src/db/overrides.mjs

@@ -122,7 +122,7 @@ export async function loadOverrides(overridesDir = OVERRIDES_DIR) {
     try {
       parsed = JSON.parse(await readFile(path, 'utf8'));
     } catch (err) {
-      throw new Error(`could not read override file ${path}: ${err.message}`);
+      throw new Error(`could not read override file ${path}: ${err.message}`, { cause: err });
     }
     const record = validateOverride(parsed, path);
     if (!byTask.has(record.task)) byTask.set(record.task, []);

package/src/db/plan.mjs

@@ -19,7 +19,7 @@
 // graph holds. Without it such a layer compiles once per intent and
 // every copy but the first is a replay of the same command.
 
-import { composeScope, loadOverrides } from './overrides.mjs';
+import { composeScope } from './overrides.mjs';
 
 export function fillModule(template, module) {
   return template.replaceAll('{module}', module);
@@ -535,7 +535,7 @@ export function planTasks(db, core, overrides = new Map(), { excludeIntentIds =
   const compiledOnceTaskIds = [];
   // Once-tasks that a newly compiled intent hangs a prerequisite on.
   const onceTasksGainingPrereqs = [];
-  let reopenedOnceTaskIds = [];
+  let reopenedOnceTaskIds;
 
   db.exec('BEGIN IMMEDIATE');
   try {

package/src/db/rebuild.mjs

@@ -198,12 +198,12 @@ async function replayIntents(db, intentsDir) {
     try {
       parsed = JSON.parse(await readFile(path, 'utf8'));
     } catch (err) {
-      throw new Error(`could not read intent file ${path}: ${err.message}`);
+      throw new Error(`could not read intent file ${path}: ${err.message}`, { cause: err });
     }
     try {
       records.push({ file, intent: normalizeIntent(parsed) });
     } catch (err) {
-      throw new Error(`invalid intent file ${path}: ${err.message}`);
+      throw new Error(`invalid intent file ${path}: ${err.message}`, { cause: err });
     }
   }
 
@@ -218,26 +218,32 @@ async function replayIntents(db, intentsDir) {
   return count;
 }
 
-// Every commit subject in history mapped to its position, newest first —
-// one `git log` call rather than one per task. Membership alone answers
-// "did this task ever run"; position also answers "did it run *after*
-// the thing it depends on", which is what a `once: true` task needs,
-// since its commit subject is a constant that one historical occurrence
-// would otherwise satisfy forever. `--topo-order` so the position is a
+// Every commit subject in history mapped to EVERY position it occurs at,
+// newest first — one `git log` call rather than one per task. Membership
+// alone answers "did this task ever run"; position also answers "did it
+// run *after* the thing it depends on", which is what a `once: true`
+// task needs, since its commit subject is a constant that one historical
+// occurrence would otherwise satisfy forever. Keeping every occurrence
+// (not just the newest) is what lets markCompletedTasks tell two tasks
+// that share a constant commit_message apart on a linear-chain core: one
+// real commit per intent that actually ran the layer, each position
+// claimable by at most one task. `--topo-order` so position is a
 // property of the history's shape rather than of commit timestamps.
 function loadCommitSubjects() {
   const output = execSync('git log --topo-order --format=%H%x00%s', { encoding: 'utf8' });
-  const newestPosition = new Map();
+  const positions = new Map();
   let position = 0;
   for (const line of output.split('\n')) {
     if (!line) continue;
     const [, subject] = line.split('\0');
     if (subject === undefined) continue;
-    // Newest first, so the first occurrence seen is the most recent one.
-    if (!newestPosition.has(subject)) newestPosition.set(subject, position);
+    // Newest first, so pushing in read order keeps each subject's array
+    // newest-to-oldest.
+    if (!positions.has(subject)) positions.set(subject, []);
+    positions.get(subject).push(position);
     position++;
   }
-  return newestPosition;
+  return positions;
 }
 
 // A task is complete iff some commit's subject exactly matches its
@@ -246,25 +252,65 @@ function loadCommitSubjects() {
 // there's no verify_command to re-run and no working tree diff to check,
 // only the historical fact that the commit already happened.
 //
-// A `once: true` task carries two extra conditions: every prerequisite
-// must be complete, and its own commit must be *newer* than all of them.
-// Its prerequisite set is the only one that grows after the task has
-// already run — `planner`'s Re-entry pass adds a new intent whose work a
-// tail once-layer then depends on (plan.mjs reopens it for exactly that
-// reason). Its commit subject carries no {module}, so it is a constant:
-// the single `chore(infra): deploy` from the first run would otherwise
-// make the layer look done forever, re-closing it here on the next fresh
-// clone and quietly undoing the reopen. Requiring it to sit above its
-// prerequisites in history is what encodes "the deploy ran *after* that
-// module landed". Walked to a fixpoint, since a once-layer may sit
-// behind another one.
+// A task's `commit_message` is unique to it exactly when the layer's
+// `commit` template interpolates `{module}` — the module-axis case,
+// where each intent's copy of the layer produces a distinct string. A
+// `once: true` layer has no module to substitute (core.mjs's
+// validateCore rejects one that names {module}), so its single task's
+// commit subject is a constant by construction — and, since a core
+// compiles at most one once-task per once-layer, that task is the only
+// one carrying its subject. A linear-chain core (authored, adopted) has
+// no module axis at all: every layer's `commit` is a fixed string in
+// core.yaml with no `{module}` token, so every intent that walks the
+// chain compiles a per-layer task carrying that same constant — one task
+// per intent, all sharing one subject.
 //
-// This condition is deliberately not applied to per-module tasks. A task
-// that completed without touching any file leaves no commit at all
-// (verifyTask writes none), and cascading that gap through the whole
-// chain would reset already-built modules. Scoping it to once-layers
-// keeps the change to cores that use the feature, and errs toward
-// re-running an idempotent infrastructure step rather than skipping it.
+// A commit_message shared by more than one task (grouped below into
+// `ambiguousTasks`) means membership in commitSubjects can't tell those
+// tasks apart: every commit ever made with that subject is a candidate
+// match for every one of them. Two conditions resolve it:
+//
+//   1. Ordering — a task's own matching commit must sit *above* (be
+//      newer than) every one of its own prerequisites' matching
+//      commits, the same way a once-task has always required its commit
+//      to postdate the module it deploys. Without this, the first
+//      intent's commit for a layer would satisfy every later intent's
+//      task of that same layer forever, re-closing the layer on a fresh
+//      clone regardless of what that later intent's own chain has
+//      actually done.
+//   2. Consumption — a group of N tasks sharing a subject can credit at
+//      most as many of them complete as there are actual commits with
+//      that subject in history, each commit backing at most one task.
+//      Ordering alone doesn't catch a head-of-chain task: with no
+//      prerequisite of its own, "ran after its prerequisites" is
+//      vacuously true regardless of which commit it points at, which is
+//      exactly the shape of the bug — a fresh intent's first layer,
+//      sharing a constant commit_message with an already-built intent's
+//      completed first layer, has nothing to check position against.
+//      Consumption is what a head-of-chain task actually needs: once
+//      every real commit for that subject is claimed by other tasks,
+//      none is left for it to point at.
+//
+// Both are walked together, per group, in a single deterministic pass
+// ordered by task id: earlier-sorted tasks get first claim on the
+// oldest still-unclaimed matching commit that satisfies the ordering
+// condition against whatever their own prerequisites already claimed.
+// A task that finds no claimable commit is left incomplete — the safe
+// direction, matching every other cross-cutting-layer default in this
+// engine (re-running an idempotent step beats silently skipping one).
+// The whole thing is walked to a fixpoint, since one ambiguous task's
+// claim can be the prerequisite another ambiguous task needs before it
+// can claim its own (a once-layer behind another once-layer, or one
+// linear-chain layer behind the one before it in the same intent).
+//
+// A task with a commit_message unique to it (the ordinary module-axis
+// case) skips all of this: it is marked complete directly from
+// commitSubjects membership, with no ordering or consumption check.
+// That's necessary, not just cheaper — a task that completed without
+// touching any file leaves no commit at all (verifyTask writes none),
+// and applying either check there would cascade that gap through the
+// whole chain and reset already-built modules that have no ambiguity to
+// resolve in the first place.
 function markCompletedTasks(db, commitSubjects) {
   const tasks = db.prepare('SELECT id, module, commit_message FROM tasks').all();
   const prerequisites = new Map(tasks.map((t) => [t.id, []]));
@@ -272,39 +318,64 @@ function markCompletedTasks(db, commitSubjects) {
     prerequisites.get(d.task_id)?.push(d.depends_on_task_id);
   }
 
-  // Position of each task's most recent matching commit; undefined means
-  // the task never committed.
-  const positionOf = new Map(
-    tasks.map((t) => [t.id, commitSubjects.get(t.commit_message)]),
-  );
+  const messageCounts = new Map();
+  for (const task of tasks) {
+    messageCounts.set(task.commit_message, (messageCounts.get(task.commit_message) ?? 0) + 1);
+  }
+  const isAmbiguous = (task) => messageCounts.get(task.commit_message) > 1;
 
+  // Position of each unambiguous task's one matching commit; undefined
+  // means the task never committed. An ambiguous task's position is
+  // resolved separately below, since "the" matching commit for its
+  // subject isn't decided until a claim succeeds.
+  const positionOf = new Map();
   const complete = new Set();
-  const onceTasks = [];
+  const ambiguousTasks = [];
   for (const task of tasks) {
-    if (task.module === CORE_MODULE) {
-      onceTasks.push(task);
+    if (task.module === CORE_MODULE || isAmbiguous(task)) {
+      ambiguousTasks.push(task);
       continue;
     }
-    if (positionOf.get(task.id) !== undefined) complete.add(task.id);
+    const position = (commitSubjects.get(task.commit_message) ?? [])[0];
+    positionOf.set(task.id, position);
+    if (position !== undefined) complete.add(task.id);
   }
+  // Deterministic claim order within a shared subject: sorted by task id.
+  ambiguousTasks.sort((a, b) => a.id.localeCompare(b.id));
+
+  // Every commit position still unclaimed, per subject — shrinks as
+  // ambiguous tasks below claim one each.
+  const available = new Map(
+    [...commitSubjects].map(([subject, positions]) => [subject, [...positions]]),
+  );
 
-  // Lower position is newer, so a once-task ran after a prerequisite when
-  // its own position is strictly smaller.
-  const ranAfterPrerequisites = (task) => {
-    const own = positionOf.get(task.id);
-    return prerequisites.get(task.id).every((id) => {
+  // A task ran after a prerequisite when its own claimed position is
+  // strictly smaller (newer) than the prerequisite's.
+  const ranAfterPrerequisites = (task, position) =>
+    prerequisites.get(task.id).every((id) => {
       const prereq = positionOf.get(id);
-      return prereq === undefined || own < prereq;
+      return prereq === undefined || position < prereq;
     });
-  };
 
   let changed = true;
   while (changed) {
     changed = false;
-    for (const task of onceTasks) {
-      if (complete.has(task.id) || positionOf.get(task.id) === undefined) continue;
+    for (const task of ambiguousTasks) {
+      if (complete.has(task.id) || positionOf.has(task.id)) continue;
       if (!prerequisites.get(task.id).every((id) => complete.has(id))) continue;
-      if (!ranAfterPrerequisites(task)) continue;
+
+      const slots = available.get(task.commit_message) ?? [];
+      // Oldest-first, so a task claims the least-recent commit that
+      // still satisfies its ordering condition — leaving newer slots
+      // free for whichever task in the group depends on this one.
+      const slotIndex = [...slots]
+        .map((position, i) => [position, i])
+        .sort((a, b) => b[0] - a[0])
+        .find(([position]) => ranAfterPrerequisites(task, position))?.[1];
+      if (slotIndex === undefined) continue;
+
+      const [position] = slots.splice(slotIndex, 1);
+      positionOf.set(task.id, position);
       complete.add(task.id);
       changed = true;
     }
@@ -313,13 +384,14 @@ function markCompletedTasks(db, commitSubjects) {
   const setComplete = db.prepare("UPDATE tasks SET status = 'complete' WHERE id = ?");
   for (const id of complete) setComplete.run(id);
 
-  // A once-task can be marked complete by the loop above and then fail
-  // one of the extra conditions on a later pass of the fixpoint walk.
-  // Reconcile it back rather than leaving the stale status untouched.
+  // A task on the ambiguous path can be marked complete by the loop
+  // above and then fail to claim a slot on a later pass of the fixpoint
+  // walk. Reconcile it back rather than leaving the stale status
+  // untouched.
   const reopen = db.prepare(
     "UPDATE tasks SET status = 'planned' WHERE id = ? AND status = 'complete'",
   );
-  for (const task of onceTasks) {
+  for (const task of ambiguousTasks) {
     if (!complete.has(task.id)) reopen.run(task.id);
   }
 

package/src/db/reconcile.mjs

@@ -148,7 +148,7 @@ export async function loadReconciliations(reconciledDir = RECONCILED_DIR) {
     try {
       parsed = JSON.parse(await readFile(path, 'utf8'));
     } catch (err) {
-      throw new Error(`could not read reconciliation file ${path}: ${err.message}`);
+      throw new Error(`could not read reconciliation file ${path}: ${err.message}`, { cause: err });
     }
     const record = validateReconciled(parsed, path);
     byTask.set(record.task, record);

package/src/db/verify.mjs

@@ -562,6 +562,7 @@ export function verifyTask(db, taskId, owner) {
         `the cause (a rejecting git hook, commit signing, or git identity), then ` +
         `re-run \`hedgehog verify ${task.id} --owner ${owner}\`, or hand it back ` +
         `with \`hedgehog release ${task.id} --owner ${owner}\`.\n\n${err.message}`,
+      { cause: err },
     );
   }
 

package/src/db/worktree.mjs

@@ -376,7 +376,7 @@ export async function loadAbandoned(abandonedDir = ABANDONED_DIR) {
     try {
       parsed = JSON.parse(await readFile(path, 'utf8'));
     } catch (err) {
-      throw new Error(`could not read abandonment file ${path}: ${err.message}`);
+      throw new Error(`could not read abandonment file ${path}: ${err.message}`, { cause: err });
     }
     const record = validateAbandoned(parsed, path);
     byIntent.set(record.intent, record);

package/src/hosts/gemini/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "hedgehog",
-  "version": "6.2.2",
+  "version": "6.2.4",
   "description": "Hedgehog build discipline: ordered, tested, verified build steps.",
   "contextFileName": "GEMINI.md"
 }

package/src/registry/fetch.mjs

@@ -122,14 +122,14 @@ async function packAndExtract(entry) {
     tarball = join(tmp, JSON.parse(stdout)[0].filename);
   } catch (err) {
     await rm(tmp, { recursive: true, force: true });
-    throw new Error(unresolvableMessage(entry, spec, err));
+    throw new Error(unresolvableMessage(entry, spec, err), { cause: err });
   }
 
   try {
     await execFileAsync('tar', ['-xzf', tarball, '-C', tmp]);
   } catch (err) {
     await rm(tmp, { recursive: true, force: true });
-    throw new Error(`Could not extract ${entry.package} from ${tarball}: ${err.message}`);
+    throw new Error(`Could not extract ${entry.package} from ${tarball}: ${err.message}`, { cause: err });
   }
 
   const root = join(tmp, TARBALL_ROOT);

package/src/skills/hedgehog-daily/SKILL.md

@@ -29,22 +29,31 @@ with a real cost, taken on stated conditions — not the safe default.
 ## The three exits
 
 Decide by the conditions, in order. The first one that holds is the exit.
+Re-plan is checked first, and its check is a read to make, not a
+suspicion to already hold — do not reach Change-work or Tweak without
+having made it.
 
 ### Re-plan
 
-The locked planning artifact that governs this project no longer
-describes what is being asked for. The core's own loop skill names which
-artifact governs — the brief and layer sequence for a shipped core,
-`.hedgehog/core-design.md` for an authored one, `.hedgehog/adoption.md`
-for an adopted one.
+The core's own loop skill names which artifact governs this project —
+the brief and layer sequence for a shipped core, `.hedgehog/core-design.md`
+for an authored one, `.hedgehog/adoption.md` for an adopted one. Read
+that artifact, then check:
 
-Route to `planner`'s re-entry pass, which adds intents for new work
-without re-running planning from scratch and without disturbing anything
-already built.
+- Does anything the request needs contradict a statement locked there —
+  an interface, a stack choice, a scope boundary?
 
-Where the artifact's failure means the request is a different project
-rather than an extension of this one, say so plainly instead of routing.
-That artifact is never rewritten to accommodate new scope.
+If it holds, this is Re-plan — regardless of how many layers the request
+reaches or whether every file it touches already exists. Route to
+`planner`'s re-entry pass, which adds intents for new work without
+re-running planning from scratch and without disturbing anything already
+built.
+
+Where the contradiction means the request is a different project rather
+than an extension of this one, say so plainly instead of routing. That
+artifact is never rewritten to accommodate new scope.
+
+If it does not hold, move on to Change-work.
 
 ### Change-work