auxilo-mcp 0.9.6 → 0.9.7

package/README.md

@@ -33,7 +33,7 @@ Enable extraction and a session-end hook runs when your agent finishes a session
 1. The hook hands the runner the path to the session transcript.
 2. The runner reads the transcript on your machine and scrubs it with a fail-closed secret filter: 24 patterns covering API keys, tokens, private keys, JWTs, connection strings, cookies, email addresses, phone numbers, and internal IPs. If a rescan still finds a match, the run stops and nothing is sent.
 3. Your own model client (your claude CLI, on your subscription) drafts learnings from the scrubbed text and screens them again.
-4. Clean drafts publish to the marketplace with a 7-day retraction window. Anything a screen flags waits in your private pending queue instead.
+4. Drafts held for review appear in three server-defined lanes: **Ready to publish**, **Needs a score**, and **Needs your eyes**. The last lane includes the server's reason so you can inspect the exception directly.
 
 ### What never leaves your machine
 
@@ -41,15 +41,17 @@ Your raw transcripts. They are read and scrubbed on your machine, and they are n
 
 ### How publishing works
 
-Extraction defaults to seamless: a draft that passes every screen (secrets, sensitivity, injection, near-duplicate, quality) publishes right away, and you can retract it for 7 days. A draft that any screen flags waits in a pending queue only you can see.
+Extraction defaults to seamless: a draft that passes every screen (secrets, sensitivity, injection, near-duplicate, quality) publishes right away, and you can retract it for 7 days. A draft held for review waits in a pending queue only you can see, grouped by the server's Ready to publish / Needs a score / Needs your eyes verdict.
 
 ```bash
-npx auxilo review     # approve, reject, or skip each queued draft
-npx auxilo status     # clients, hooks, queue depth, consent state
-npx auxilo disable    # kill switch: extraction stops immediately
+npx auxilo review --list           # show all three lanes and each exception reason
+npx auxilo review --approve-ready  # select exactly the server's ready_to_publish lane
+npx auxilo review                  # approve, reject, view, or skip one draft at a time
+npx auxilo status                  # clients, hooks, queue depth, consent state
+npx auxilo disable                 # kill switch: extraction stops immediately
 ```
 
-Approve a queued draft and it goes live in the marketplace. Reject it and it stays private. Prefer approve-first for everything? Switch your account to manual mode in account settings and every draft waits for you.
+Every bulk approval prints the exact selection and requires you to type its count. `--min-quality 16` narrows the ready lane; values below 14 explicitly reach into Needs a score and print a warning before the same counted confirmation. Approve a queued draft and it goes live in the marketplace. Reject it and it stays private. Prefer approve-first for everything? Switch your account to manual mode in account settings and every draft waits for you.
 
 Extraction off? Your agent can still contribute in-session: tell it to submit a learning with the `auxilo_contribute` tool.
 

package/bin/auxilo-cli.js

@@ -32,19 +32,45 @@ const HOME = os.homedir();
 // question N+1 arrives with question N's buffer and the next prompt hangs
 // on EOF (the 0.8.1 consent step silently never completed).
 let sharedRl = null;
+let bufferedLines = [];
+let lineWaiters = [];
+let readlineEnded = false;
 function getRl() {
   if (!sharedRl) {
-    sharedRl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    readlineEnded = false;
+    sharedRl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+      terminal: !!process.stdin.isTTY,
+    });
+    sharedRl.on('line', (line) => {
+      const answer = line.trim();
+      const waiter = lineWaiters.shift();
+      if (waiter) waiter(answer);
+      else bufferedLines.push(answer);
+    });
+    sharedRl.on('close', () => {
+      readlineEnded = true;
+      while (lineWaiters.length) lineWaiters.shift()('');
+    });
   }
   return sharedRl;
 }
 function closeRl() {
-  if (sharedRl) { sharedRl.close(); sharedRl = null; }
+  if (sharedRl) sharedRl.close();
+  sharedRl = null;
+  bufferedLines = [];
+  lineWaiters = [];
+  readlineEnded = false;
 }
 
 function ask(question) {
+  getRl();
+  process.stdout.write(question);
+  if (bufferedLines.length > 0) return Promise.resolve(bufferedLines.shift());
+  if (readlineEnded) return Promise.resolve('');
   return new Promise((resolve) => {
-    getRl().question(question, (answer) => resolve(answer.trim()));
+    lineWaiters.push(resolve);
   });
 }
 
@@ -509,7 +535,7 @@ async function cmdDisable(flags) {
 // Operates ONLY on the caller's own pending learnings (account-scoped API key).
 //
 // Review-seamless (2026-07-18): the default view is now a triage summary table
-// (quality desc, clean before flagged), with bulk modes that batch through
+// (quality-desc rows grouped into the server's three lanes), with bulk modes that batch through
 // POST /account/pending/bulk. HARD RULE for every bulk APPROVE path: print the
 // exact list and count first, then require the operator to TYPE THE COUNT.
 // There is no --yes bypass on any approve path; publishing always costs one
@@ -522,10 +548,18 @@ function fit(s, width) {
   return str.padEnd(width);
 }
 
-/** Short flag codes for a summary row: 'clean' or e.g. 'inj+sens'. */
+/** Short lane/flag codes for a summary row, e.g. 'ready' or 'inj+sens'. */
 function shortFlags(row) {
-  if (row.screens_passed) return 'clean';
-  const map = { injection: 'inj', content_sensitivity: 'sens', near_duplicate: 'dup' };
+  const resolved = review.reviewLane(row);
+  if (resolved.lane === 'ready_to_publish') return 'ready';
+  if (resolved.lane === 'needs_score') return 'score';
+  const map = {
+    injection: 'inj',
+    content_sensitivity: 'sens',
+    near_duplicate: 'dup',
+    process_advice: 'advice',
+    account_vocab: 'vocab',
+  };
   return (row.flags || []).map((f) => map[f] || f).join('+') || 'flagged';
 }
 
@@ -535,13 +569,41 @@ function triageLine(row, n, total) {
   return `  ${String(n).padStart(String(total).length)}. q=${q}  ${fit(shortFlags(row), 9)} ${fit(row.category || '', 20)} ${fit(row.title || '(no title)', 52)}`;
 }
 
-/** Print the triage summary: counts, then clean rows, then flagged rows. */
+function groupSummaryRows(summary) {
+  const groups = {
+    ready_to_publish: [],
+    needs_score: [],
+    needs_your_eyes: [],
+  };
+  let versionSkew = false;
+  for (const row of summary.items || []) {
+    const resolved = review.reviewLane(row);
+    versionSkew = versionSkew || resolved.version_skew;
+    groups[resolved.lane].push(row);
+  }
+  const serverCounts = summary.counts && summary.counts.by_lane;
+  const counts = !versionSkew && serverCounts
+    ? {
+        ready_to_publish: serverCounts.ready_to_publish || 0,
+        needs_score: serverCounts.needs_score || 0,
+        needs_your_eyes: serverCounts.needs_your_eyes || 0,
+      }
+    : {
+        ready_to_publish: groups.ready_to_publish.length,
+        needs_score: groups.needs_score.length,
+        needs_your_eyes: groups.needs_your_eyes.length,
+      };
+  return { groups, counts, versionSkew };
+}
+
+/** Print the triage summary in the server's three-lane order. */
 function printSummaryTable(summary) {
-  const items = summary.items || [];
-  const clean = items.filter((r) => r.screens_passed);
-  const flagged = items.filter((r) => !r.screens_passed);
+  const { groups, counts, versionSkew } = groupSummaryRows(summary);
 
-  console.log(`\n${summary.pending_count} learning(s) pending your review: ${clean.length} passed every platform screen, ${flagged.length} flagged.`);
+  console.log(`\n${summary.pending_count} learning(s) pending your review: ${counts.ready_to_publish} ready to publish, ${counts.needs_score} need a score, ${counts.needs_your_eyes} need your eyes.`);
+  if (versionSkew) {
+    console.log('VERSION SKEW: this server did not return lane on every row; using the legacy screens-and-quality fallback.');
+  }
   const bands = summary.counts && summary.counts.by_quality_band;
   if (bands) {
     console.log(`Quality bands: 18-20: ${bands['18-20'] || 0} · 14-17: ${bands['14-17'] || 0} · 10-13: ${bands['10-13'] || 0} · below 10: ${bands.below_10 || 0} · unscored: ${bands.unscored || 0}`);
@@ -550,13 +612,20 @@ function printSummaryTable(summary) {
     console.log(`Near-duplicate clusters among your pending items: ${summary.near_dup_clusters.length} (review these together)`);
   }
 
-  if (clean.length > 0) {
-    console.log(`\nCLEAN (passed every screen) - sorted by quality:`);
-    clean.forEach((r, i) => console.log(triageLine(r, i + 1, clean.length)));
+  if (groups.ready_to_publish.length > 0) {
+    console.log(`\nREADY TO PUBLISH (${counts.ready_to_publish}) - sorted by quality:`);
+    groups.ready_to_publish.forEach((r, i) => console.log(triageLine(r, i + 1, groups.ready_to_publish.length)));
   }
-  if (flagged.length > 0) {
-    console.log(`\nFLAGGED (a platform screen raised a signal) - review individually:`);
-    flagged.forEach((r, i) => console.log(triageLine(r, i + 1, flagged.length)));
+  if (groups.needs_score.length > 0) {
+    console.log(`\nNEEDS A SCORE (${counts.needs_score}) - score or review individually:`);
+    groups.needs_score.forEach((r, i) => console.log(triageLine(r, i + 1, groups.needs_score.length)));
+  }
+  if (groups.needs_your_eyes.length > 0) {
+    console.log(`\nNEEDS YOUR EYES (${counts.needs_your_eyes}) - review individually:`);
+    groups.needs_your_eyes.forEach((r, i) => {
+      console.log(triageLine(r, i + 1, groups.needs_your_eyes.length));
+      if (r.why) console.log(`     why: ${r.why}`);
+    });
   }
   console.log('');
 }
@@ -640,32 +709,43 @@ async function cmdReview(flags) {
   // ── --list: summary only, no mutations ────────────────────────────────────
   if (flags.list) return;
 
-  // ── --approve-clean: bulk-approve items that passed EVERY platform screen
-  //    AND clear the quality threshold. Typed-count confirmation, no bypass. ──
-  if (flags['approve-clean']) {
+  // ── --approve-ready: consume the server's ready_to_publish verdict.
+  //    --approve-clean remains a hidden compatibility alias. A stricter
+  //    threshold narrows the ready lane; a lower one explicitly reaches into
+  //    needs_score. Typed-count confirmation, no bypass. ─────────────────────
+  if (flags['approve-ready'] || flags['approve-clean']) {
+    if (flags['approve-clean']) {
+      console.log('Note: --approve-clean was renamed to --approve-ready; the old flag remains a compatibility alias.');
+    }
     const minQuality = parseMinQuality(flags);
-    const sel = review.selectForBulkApprove(rows, { mode: 'clean', minQuality });
-    console.log(`approve-clean selection: ${sel.selected.length} of ${rows.length} pending (threshold: quality >= ${minQuality}).`);
-    if (sel.excluded_flagged.length) console.log(`  excluded ${sel.excluded_flagged.length} screen-flagged item(s) (review those individually).`);
+    const sel = review.selectForBulkApprove(rows, { mode: 'ready', minQuality });
+    console.log(`approve-ready selection: ${sel.selected.length} of ${rows.length} pending (threshold: quality >= ${minQuality}).`);
+    if (minQuality < review.DEFAULT_QUALITY_THRESHOLD) {
+      const approvableCount = Number.isFinite(summary.approvable_count)
+        ? summary.approvable_count
+        : review.selectForBulkApprove(rows, { mode: 'ready' }).selected.length;
+      console.log(`WARNING: selection goes beyond the server's approvable verdict (approvable_count=${approvableCount}); including ${sel.included_beyond_verdict.length} items from needs_score.`);
+    }
+    if (sel.excluded_flagged.length) console.log(`  excluded ${sel.excluded_flagged.length} needs_your_eyes item(s) (review those individually).`);
     if (sel.excluded_low_quality.length) console.log(`  excluded ${sel.excluded_low_quality.length} below the quality threshold.`);
     if (sel.excluded_unscored.length) console.log(`  excluded ${sel.excluded_unscored.length} with no quality score (pass --min-quality 0 to include).`);
     if (sel.selected.length === 0) { console.log('Nothing qualifies. No changes made.'); return; }
 
     if (!await confirmByTypedCount(sel.selected, 'APPROVE and PUBLISH')) return;
     const totals = await runBulk({ apiKey, baseUrl, rows: sel.selected, decision: 'approve' });
-    console.log(`\nDone. Approved ${totals.approved} (already approved earlier: ${totals.idempotent}, failed: ${totals.failed}). Flagged and below-threshold items stay pending.`);
+    console.log(`\nDone. Approved ${totals.approved} (already approved earlier: ${totals.idempotent}, failed: ${totals.failed}). Items outside the selection stay pending.`);
     return;
   }
 
-  // ── --all: bulk-approve everything EXCEPT screen-flagged items unless
+  // ── --all: bulk-approve everything EXCEPT needs_your_eyes items unless
   //    --include-flagged. Typed-count confirmation, no bypass. ───────────────
   if (flags.all) {
     const includeFlagged = flags['include-flagged'] === true;
     const sel = review.selectForBulkApprove(rows, { mode: 'all', includeFlagged });
-    if (includeFlagged && sel.selected.some((r) => !r.screens_passed)) {
-      console.log('WARNING: --include-flagged is set. This selection INCLUDES items a platform screen flagged (possible injection, sensitive content, or near-duplicates). Approving publishes them publicly.');
+    if (includeFlagged && sel.selected.some((r) => review.reviewLane(r).lane === 'needs_your_eyes')) {
+      console.log('WARNING: --include-flagged is set. This selection INCLUDES needs_your_eyes items (possible injection, sensitive content, process advice, account vocabulary, or near-duplicates). Approving publishes them publicly.');
     } else if (sel.excluded_flagged.length) {
-      console.log(`Excluding ${sel.excluded_flagged.length} screen-flagged item(s) (pass --include-flagged to include them; safer to review those individually).`);
+      console.log(`Excluding ${sel.excluded_flagged.length} needs_your_eyes item(s) (pass --include-flagged to include them; safer to review those individually).`);
     }
     if (sel.selected.length === 0) { console.log('Nothing qualifies. No changes made.'); return; }
 
@@ -707,13 +787,14 @@ async function cmdReview(flags) {
   console.log('Rapid review. Per item: [y] approve (goes live) · [n] reject (stays private) · [v] view full body · [s] skip · [q] quit\n');
 
   let approved = 0, rejected = 0, skipped = 0;
-  const ordered = rows; // clean-first, quality desc (server order preserved by printSummaryTable groups)
+  const ordered = rows; // quality-desc server order; the summary above groups lanes
   for (let i = 0; i < ordered.length; i++) {
     const row = ordered[i];
     console.log(triageLine(row, i + 1, ordered.length));
     let choice = '';
     for (;;) {
       choice = (await ask('    [y/n/v/s/q]? ')).toLowerCase().slice(0, 1);
+      if (!choice && readlineEnded) choice = 'q';
       if (choice === 'v') {
         const full = bodies.get(row.id);
         console.log('    ------------------------------------------------------------');
@@ -747,7 +828,46 @@ async function cmdReview(flags) {
 
 // ─── Entry point ────────────────────────────────────────────────────────────
 
-function usage() {
+function usage(command) {
+  const blocks = {
+    setup: `Usage: auxilo setup [--re-auth] [--base-url <url>]
+
+Interactively detect clients, register Auxilo, sign in, install the optional
+extraction runner and SessionEnd hook, and record the extraction choice.`,
+    init: `Usage: auxilo init [--scope <read|earnings-read|contribute>] [--label <name>]
+                   [--env-file <path>] [--save] [--json] [--no-browser]
+                   [--base-url <url>]
+
+Mint a scoped API key for CI or a second machine without running full setup.`,
+    status: `Usage: auxilo status
+
+Show detected clients, auth, extraction mode, kill switch, SessionEnd hook,
+last sweep, and pending queue depth.`,
+    review: `Usage: auxilo review [flags]
+
+Render YOUR pending-review learnings in three server-defined lanes:
+Ready to publish, Needs a score, and Needs your eyes.
+
+Flags:
+  --list            show the three-lane summary only; make no changes
+  --approve-ready   select the server's ready_to_publish lane (default quality
+                    floor 14; a higher --min-quality narrows it, while a lower
+                    value explicitly reaches into needs_score)
+  --min-quality N   quality threshold for --approve-ready (0-20)
+  --all             approve everything except needs_your_eyes items
+  --include-flagged include needs_your_eyes with --all
+  --all-reject      reject the whole batch [--yes for scripted incident use]
+  --base-url <url>
+
+Every approval path prints the exact list and requires typing its count.`,
+    disable: `Usage: auxilo disable [--base-url <url>]
+
+Disable background extraction locally and optionally revoke server consent.`,
+  };
+  if (command && blocks[command]) {
+    console.log(`\n${blocks[command]}\n`);
+    return;
+  }
   console.log(`
 Usage: auxilo <command>
 
@@ -771,18 +891,17 @@ Commands:
   status    Show install/auth/extraction status.
   review    Review YOUR pending-review learnings (from background extraction)
             and approve/reject before anything goes public. Default: triage
-            summary table first (quality desc, clean vs flagged), then rapid
-            y/n/s review.
+            summary first in the server's Ready to publish / Needs a score /
+            Needs your eyes lanes, then rapid y/n/s review.
             Flags:
               --list            summary table only, no changes
-              --approve-clean   bulk-approve items that passed EVERY platform
-                                screen AND quality >= threshold (default 14;
-                                tune with --min-quality N). Prints the exact
-                                list, then requires typing the count.
-              --all             bulk-approve everything EXCEPT screen-flagged
-                                items (add --include-flagged to include them).
+              --approve-ready   select the server's ready_to_publish lane
+                                (default floor 14; tune with --min-quality N).
+                                Prints the exact list, then requires its count.
+              --all             bulk-approve everything EXCEPT needs_your_eyes
+                                (add --include-flagged to include that lane).
                                 Same typed-count confirmation.
-              --min-quality N   quality threshold for --approve-clean (0-20)
+              --min-quality N   quality threshold for --approve-ready (0-20)
               --all-reject      reject the whole batch [--yes for scripted
                                 incident response; rejects stay private]
               --base-url <url>
@@ -797,6 +916,10 @@ Docs: https://auxilo.io · API: ${installer.DEFAULT_BASE_URL}
 
 async function main() {
   const cmd = process.argv[2];
+  const subcommandHelp = ['help', '--help', '-h'].includes(process.argv[3]);
+  if (['setup', 'init', 'status', 'review', 'disable'].includes(cmd) && subcommandHelp) {
+    return usage(cmd);
+  }
   const flags = parseFlags(process.argv);
   switch (cmd) {
     case 'setup': return cmdSetup(flags);
@@ -829,4 +952,12 @@ if (require.main === module) {
   run();
 }
 
-module.exports = { parseFlags, resolveBaseUrl, run };
+module.exports = {
+  parseFlags,
+  resolveBaseUrl,
+  shortFlags,
+  groupSummaryRows,
+  printSummaryTable,
+  usage,
+  run,
+};

package/lib/hook-status.js

@@ -0,0 +1,24 @@
+'use strict';
+
+/**
+ * True when a Claude Code SessionEnd collection contains an Auxilo extraction
+ * hook. Accepts both the legacy bare-command string and the current matcher
+ * group shape ({ hooks: [{ type: 'command', command }] }).
+ *
+ * @param {unknown} sessionEnd
+ * @returns {boolean}
+ */
+function hasAuxiloSessionEndHook(sessionEnd) {
+  if (!Array.isArray(sessionEnd)) return false;
+
+  return sessionEnd.some((entry) => {
+    if (typeof entry === 'string') return entry.includes('auxilo-extract');
+    if (!entry || typeof entry !== 'object' || !Array.isArray(entry.hooks)) return false;
+    return entry.hooks.some((hook) =>
+      hook && typeof hook === 'object' &&
+      typeof hook.command === 'string' &&
+      hook.command.includes('auxilo-extract'));
+  });
+}
+
+module.exports = { hasAuxiloSessionEndHook };

package/lib/installer.js

@@ -24,6 +24,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { hasAuxiloSessionEndHook } = require('./hook-status.js');
 
 // ─── Constants ──────────────────────────────────────────────────────────────
 
@@ -75,6 +76,7 @@ const RUNNER_STACK = Object.freeze([
   ['lib/sensitivity-filter.js', 'lib/sensitivity-filter.js', 0o644],
   ['lib/extraction-index.js', 'lib/extraction-index.js', 0o644],
   ['lib/similarity.js', 'lib/similarity.js', 0o644],
+  ['lib/hook-status.js', 'lib/hook-status.js', 0o644],
   ['config/near-duplicate.json', 'config/near-duplicate.json', 0o644],
 ]);
 
@@ -1559,16 +1561,21 @@ async function getStatus(homeDir, opts = {}) {
   // 4. Sentinel + runner + hook install state
   const hookPath = hookScriptPathFor(homeDir);
   const runnerInstalled = fs.existsSync(path.join(binRootFor(homeDir), 'scripts', 'runner.js'));
+  let hookInstalled = false;
   let hookRegistered = false;
   try {
     const settings = JSON.parse(
       fs.readFileSync(path.join(homeDir, '.claude', 'settings.json'), 'utf-8')
     );
+    const sessionEnd = settings.hooks && settings.hooks.SessionEnd;
+    // SPEC3-A3: installation detection accepts both the legacy string and the
+    // current object shape through the same helper runner --status uses.
+    hookInstalled = hasAuxiloSessionEndHook(sessionEnd);
     // LW-17: only STRUCTURED entries count — Claude Code silently ignores
     // bare-string entries (the 0.8.1 dead-hook bug), so reporting one as
     // "registered" would mask exactly the failure this status exists to catch.
-    hookRegistered = Array.isArray(settings.hooks && settings.hooks.SessionEnd) &&
-      settings.hooks.SessionEnd.some((h) =>
+    hookRegistered = Array.isArray(sessionEnd) &&
+      sessionEnd.some((h) =>
         h && typeof h === 'object' && Array.isArray(h.hooks) && h.hooks.some(isAuxiloCommandHook));
   } catch { /* no settings */ }
 
@@ -1592,7 +1599,8 @@ async function getStatus(homeDir, opts = {}) {
     accountMode,
     sentinel: sentinelPresent(homeDir),
     runnerInstalled,
-    hookInstalled: fs.existsSync(hookPath),
+    hookInstalled,
+    hookScriptInstalled: fs.existsSync(hookPath),
     hookRegistered,
     // LW-18 layer 1b: SessionStart held-count notice
     noticeRegistered: sessionStartNoticeRegistered(homeDir),

package/lib/review.js

@@ -121,7 +121,7 @@ function formatFlags(l) {
 
 // ── Review-seamless additions (2026-07-18) ──────────────────────────────────
 //
-// Summary + bulk network calls, plus the pure approve-clean selection logic
+// Summary + bulk network calls, plus the pure approve-ready selection logic
 // shared by the CLI, the MCP auxilo_review tool, and the triage report script.
 // One selection implementation everywhere, so what a dry run PRINTS is exactly
 // what a confirmed run DOES.
@@ -129,8 +129,12 @@ function formatFlags(l) {
 /** Server-enforced max decisions per bulk call; clients chunk at this size. */
 const BULK_CHUNK = 100;
 
-/** Default approve-clean quality threshold (repo quality gate: total >= 14/20). */
+/** Default ready-to-publish quality threshold (repo quality gate: total >= 14/20). */
 const DEFAULT_QUALITY_THRESHOLD = 14;
+const LANE_READY = 'ready_to_publish';
+const LANE_NEEDS_SCORE = 'needs_score';
+const LANE_NEEDS_EYES = 'needs_your_eyes';
+const REVIEW_LANES = new Set([LANE_READY, LANE_NEEDS_SCORE, LANE_NEEDS_EYES]);
 
 /**
  * GET /account/pending/summary: compact triage rows + counts (no bodies).
@@ -233,46 +237,95 @@ function qualityClears(row, minQuality) {
 }
 
 /**
- * THE approve-clean selection. Operates on summary rows (screens_passed,
- * flags, quality) from GET /account/pending/summary.
+ * Resolve the server lane on a summary row. Old servers did not return lane;
+ * those rows fall back to the legacy screens+quality split and are marked as
+ * version-skewed so the caller can tell the operator.
  *
- * mode 'clean' (approve-clean): screens_passed AND quality >= minQuality.
- * mode 'all': every row EXCEPT screens-flagged ones unless includeFlagged
- * is set; no quality gate.
+ * @param {object} row
+ * @returns {{lane:string, version_skew:boolean}}
+ */
+function reviewLane(row) {
+  if (row && REVIEW_LANES.has(row.lane)) {
+    return { lane: row.lane, version_skew: false };
+  }
+  if (!row || !row.screens_passed) {
+    return { lane: LANE_NEEDS_EYES, version_skew: true };
+  }
+  return {
+    lane: qualityClears(row, DEFAULT_QUALITY_THRESHOLD) ? LANE_READY : LANE_NEEDS_SCORE,
+    version_skew: true,
+  };
+}
+
+/**
+ * THE approve-ready selection. The server's lane is authoritative:
+ *
+ * - threshold 14 (default): exactly rows in ready_to_publish
+ * - threshold >14: narrows within ready_to_publish
+ * - threshold <14: includes qualifying needs_score rows too
+ * - needs_your_eyes is excluded unless mode=all + includeFlagged
  *
  * Returns the selection plus what was excluded and why, so every confirmation
  * surface can show the operator the exact consequences before anything runs.
  *
  * @param {Array<object>} rows
- * @param {object} [opts]  { mode: 'clean'|'all', minQuality, includeFlagged }
- * @returns {{selected:Array<object>, excluded_flagged:Array<object>, excluded_low_quality:Array<object>, excluded_unscored:Array<object>, min_quality:number|null}}
+ * @param {object} [opts]  { mode: 'ready'|'clean'|'all', minQuality, includeFlagged }
+ * @returns {{selected:Array<object>, included_beyond_verdict:Array<object>, excluded_flagged:Array<object>, excluded_low_quality:Array<object>, excluded_unscored:Array<object>, min_quality:number|null, version_skew:boolean}}
  */
 function selectForBulkApprove(rows, opts = {}) {
-  const mode = opts.mode === 'all' ? 'all' : 'clean';
-  const minQuality = mode === 'clean'
+  const mode = opts.mode === 'all' ? 'all' : 'ready';
+  const minQuality = mode === 'ready'
     ? (Number.isFinite(opts.minQuality) ? opts.minQuality : DEFAULT_QUALITY_THRESHOLD)
     : null;
   const includeFlagged = mode === 'all' && opts.includeFlagged === true;
 
   const selected = [];
+  const included_beyond_verdict = [];
   const excluded_flagged = [];
   const excluded_low_quality = [];
   const excluded_unscored = [];
+  let version_skew = false;
 
   for (const row of rows || []) {
     if (!row || !row.id) continue;
-    if (!row.screens_passed && !includeFlagged) {
+    const resolved = reviewLane(row);
+    version_skew = version_skew || resolved.version_skew;
+
+    if (resolved.lane === LANE_NEEDS_EYES && !includeFlagged) {
       excluded_flagged.push(row);
       continue;
     }
-    if (mode === 'clean' && !qualityClears(row, minQuality)) {
-      (row.quality == null ? excluded_unscored : excluded_low_quality).push(row);
-      continue;
+
+    if (mode === 'ready') {
+      if (resolved.lane === LANE_READY) {
+        // At the server floor, consume the verdict verbatim. A stricter
+        // operator threshold may narrow it, but never broaden it.
+        if (minQuality > DEFAULT_QUALITY_THRESHOLD && !qualityClears(row, minQuality)) {
+          (row.quality == null ? excluded_unscored : excluded_low_quality).push(row);
+          continue;
+        }
+      } else if (resolved.lane === LANE_NEEDS_SCORE) {
+        if (minQuality < DEFAULT_QUALITY_THRESHOLD && qualityClears(row, minQuality)) {
+          included_beyond_verdict.push(row);
+        } else {
+          (row.quality == null ? excluded_unscored : excluded_low_quality).push(row);
+          continue;
+        }
+      }
     }
+
     selected.push(row);
   }
 
-  return { selected, excluded_flagged, excluded_low_quality, excluded_unscored, min_quality: minQuality };
+  return {
+    selected,
+    included_beyond_verdict,
+    excluded_flagged,
+    excluded_low_quality,
+    excluded_unscored,
+    min_quality: minQuality,
+    version_skew,
+  };
 }
 
 module.exports = {
@@ -287,5 +340,6 @@ module.exports = {
   chunkDecisions,
   submitBulkChunked,
   qualityClears,
+  reviewLane,
   selectForBulkApprove,
 };

package/mcp-server.js

@@ -160,7 +160,7 @@ async function postBulkChunks(headers, decisions) {
 }
 
 const server = new Server(
-  { name: 'auxilo', version: '0.9.4' },
+  { name: 'auxilo', version: '0.9.7' },
   {
     capabilities: { tools: {} },
     instructions: `You are connected to Auxilo, a knowledge marketplace where AI agents buy and sell operational learnings.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auxilo-mcp",
-  "version": "0.9.6",
+  "version": "0.9.7",
   "mcpName": "io.github.silent-architects/auxilo",
   "description": "MCP server for Auxilo. Your agent stops solving the same problem twice: auto-extracted learnings, free self-unlocks, and earnings when other agents unlock yours.",
   "main": "mcp-server.js",
@@ -13,6 +13,7 @@
     "bin/",
     "lib/installer.js",
     "lib/review.js",
+    "lib/hook-status.js",
     "lib/sensitivity-filter.js",
     "lib/extraction-index.js",
     "lib/similarity.js",

package/scripts/runner.js

@@ -39,6 +39,7 @@ const crypto = require('crypto');
 const { spawn } = require('child_process');
 const { scanText, SENSITIVITY_FILTER_VERSION } = require('../lib/sensitivity-filter.js');
 const { appendSubmittedLearning } = require('../lib/extraction-index.js');
+const { hasAuxiloSessionEndHook } = require('../lib/hook-status.js');
 const { TranscriptSource } = require('./sources/source.interface.js');
 const { GenericJsonlSource } = require('./sources/generic-jsonl.js');
 
@@ -516,6 +517,7 @@ function sweeperManifest(repoRoot = path.resolve(__dirname, '..')) {
     ['lib/sensitivity-filter.js', 'lib/sensitivity-filter.js', 0o644],
     ['lib/extraction-index.js', 'lib/extraction-index.js', 0o644],
     ['lib/similarity.js', 'lib/similarity.js', 0o644],
+    ['lib/hook-status.js', 'lib/hook-status.js', 0o644],
     ['config/near-duplicate.json', 'config/near-duplicate.json', 0o644],
     // Client-side extraction (2026-07-02) — required by the sweep path since /extract went 410.
     // Missing from this manifest until 2026-07-19: installed sweepers crashed with
@@ -711,10 +713,10 @@ async function printStatus() {
   let hookInstalled = false;
   try {
     const settings = JSON.parse(fs.readFileSync(claudeSettingsPath, 'utf-8'));
-    hookInstalled = Array.isArray(settings.hooks?.SessionEnd) &&
-      settings.hooks.SessionEnd.some(h => h.includes('auxilo-extract'));
+    hookInstalled = hasAuxiloSessionEndHook(settings.hooks?.SessionEnd);
   } catch { /* no settings file */ }
   console.log(`Hook installed: ${hookInstalled ? 'yes' : 'no'}`);
+  console.log(`Settings inspected: ${claudeSettingsPath}`);
 
   // 5. Last sweep ran at
   console.log(`Last sweep: ${ledger.lastSweep || 'never'}`);