changebook 0.4.7 → 0.4.8

package/README.md

@@ -2,10 +2,10 @@
 
 MCP (Model Context Protocol) server that lets coding agents — Claude Code,
 Codex, Cursor — query the **ChangeBook product memory** (the module map and the
-analyzed change history stored in Supabase) instead of re-reading the
-codebase, plus a CLI that feeds that memory from any terminal: sign in,
+analyzed change history from your ChangeBook account) instead of re-reading
+the codebase, plus a CLI that feeds that memory from any terminal: sign in,
 analyze uncommitted changes, sync the product map. All MCP tools are
-read-only, and Row Level Security scopes every query to the signed-in user.
+read-only, and every query is scoped to the signed-in user.
 
 ## Two ways to run it
 
@@ -96,11 +96,6 @@ env vars below override them for CI/headless setups.
 | `CHANGEBOOK_ACCESS_TOKEN` | — | Short-lived JWT; refreshed automatically when it expires. |
 | `CHANGEBOOK_PROJECT` | — | Scope every query to one project (matched by slug, then exact name — usually the workspace folder name). Unset = all projects. |
 | `CHANGEBOOK_WEB_URL` | `https://changebook.app` | Web app used by `login`/`open` and printed after `analyze`. |
-| `CHANGEBOOK_SUPABASE_URL` | production project | Override for other environments. |
-| `CHANGEBOOK_SUPABASE_ANON_KEY` | production public key | Override for other environments. |
-
-The embedded anon key is the same public key the web app ships — it grants
-nothing by itself; your session token plus RLS decide what you can read.
 
 ## `sync`: product map inside CLAUDE.md / AGENTS.md
 
@@ -119,7 +114,7 @@ touched. Re-run after analyzing changes (or wire it to a git hook).
 ## Security notes
 
 - MCP tools are read-only; only `analyze` writes (through the same audited
-  Edge Function as the extension, with the same quotas).
+  server endpoint as the extension, with the same quotas).
 - `login` uses a loopback-only handoff: the web app asks for an explicit
   Authorize click and redirects the tokens to `http://127.0.0.1:<port>` in
   the URL fragment — they never leave your machine, and a `state` nonce ties

package/dist/context.js

@@ -8,14 +8,22 @@
  * file that can go stale between commits: it is generated on the spot, per
  * session.
  *
- * FAIL-OPEN, ABSOLUTE. This runs on the critical path of opening a session.
- * Every failure mode — logged out, offline, no project, or merely slow — must
- * print NOTHING and exit 0. A broken or slow atlas can never block or delay a
- * user's session start. The whole body races a short timeout; on timeout or
- * any throw, we emit nothing.
+ * FAIL-OPEN, ABSOLUTE, in the sense that matters: this runs on the critical
+ * path of opening a session, so nothing here may ever block it, slow it, or
+ * exit non-zero. The whole body races a short timeout; on timeout or any
+ * throw, we emit nothing and exit 0.
+ *
+ * What is NO LONGER absolute is the silence. Failing quietly used to mean the
+ * agent opened a session with no atlas AND no idea why — and the commonest
+ * cause, a dead CLI session, is precisely when it most needs to know, because
+ * everything the atlas told it about recent work is stale. So the feed pulse
+ * (feed.ts) is emitted even when the brief itself cannot be built. Quiet
+ * failure and invisible failure are different things; only the first one was
+ * ever the goal.
  */
 import * as fs from "node:fs";
 import path from "node:path";
+import { feedWarningFor } from "./feed.js";
 import { fetchBriefSection } from "./sync.js";
 import { commitAliasesShort, derivaContraHead } from "./tools.js";
 /** Hard ceiling on the critical path: past this, emit nothing and move on. */
@@ -136,11 +144,35 @@ export function uninstallContextHook(dir) {
     fs.writeFileSync(file, JSON.stringify(settings, null, 2) + "\n");
     return "removed";
 }
+/**
+ * The pulse and the brief, composed. Separate from printContext so the WHOLE
+ * thing — including the pulse — stays inside the single timeout race: adding
+ * work outside it would erode the "never delays a session" guarantee.
+ *
+ * The two are gathered independently on purpose. Before this, a throw inside
+ * buildPayload took the whole payload down, and the most common cause of that
+ * throw is a dead session — which is exactly when the agent most needs to be
+ * told something. Now a broken brief still lets the pulse through.
+ */
+async function buildSessionContext(db, dir) {
+    // Local and offline: one small file plus a git rev-parse. It cannot fail
+    // because of the network or the session, which is the point.
+    const pulse = await feedWarningFor(dir, { audience: "agent" }).catch(() => "");
+    let brief = null;
+    try {
+        brief = await buildPayload(db, dir);
+    }
+    catch {
+        brief = null;
+    }
+    const parts = [pulse, brief].filter(Boolean);
+    return parts.length > 0 ? parts.join("\n\n") : null;
+}
 export async function printContext(db, dir) {
     try {
         const timeout = new Promise((resolve) => setTimeout(() => resolve(null), CONTEXT_TIMEOUT_MS));
         const additionalContext = await Promise.race([
-            buildPayload(db, dir),
+            buildSessionContext(db, dir),
             timeout,
         ]);
         if (!additionalContext)

package/dist/feed.js

@@ -0,0 +1,147 @@
+/**
+ * The atlas' feed pulse: did the automatic ingestion actually land?
+ *
+ * The post-commit hook runs detached and never blocks the commit (see hook.ts),
+ * which is the right call — but it means that when it fails (expired session,
+ * offline, out of credits) NOTHING surfaces. The atlas just stops learning, and
+ * the only symptom is data that looks slightly old, which is indistinguishable
+ * from "nothing has happened". A tool whose whole job is to notice silent
+ * decay must not decay silently itself.
+ *
+ * Real case that motivated this (2026-07-25): the stored session died, two
+ * commits in a row fed nothing, and the failure was only found by reading a log
+ * nobody had a reason to open — by which point the first failure's evidence had
+ * already been overwritten by the second.
+ *
+ * The contract is deliberately one-directional and cheap:
+ *   `analyze --commit` (the hook path) records the outcome here.
+ *   `guard` (pre-commit, FOREGROUND, a human is watching) reads it and says it
+ *   out loud at the next commit.
+ *
+ * Everything here is best-effort: a read-only .git, a corrupt file or a missing
+ * git must never turn into a failed commit. Losing the pulse is bad; breaking
+ * someone's commit to report it would be worse.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { gitPath } from "./git.js";
+const FEED_FILE = "changebook-feed.json";
+/** Where the post-commit hook keeps the full output; cited in the warning. */
+export const HOOK_LOG_FILE = "changebook-hook.log";
+const MAX_REASON_CHARS = 200;
+/**
+ * The first paragraph of an error, which is the part that says what went wrong.
+ * Several of our errors append a blank line and then the multi-line AUTH_HELP;
+ * collapsing all of that into one line produced a warning whose "Last error:"
+ * trailed off mid-sentence into the help text ("… Run: changebook login It
+ * opens https:"). The remedy line already tells the user what to do.
+ */
+function firstParagraph(reason) {
+    return reason.split(/\n\s*\n/)[0].replace(/\s+/g, " ").trim();
+}
+export async function feedStatusPath(dir) {
+    return gitPath(dir, FEED_FILE).catch(() => null);
+}
+export async function readFeedStatus(dir) {
+    try {
+        const file = await feedStatusPath(dir);
+        if (!file)
+            return null;
+        const data = JSON.parse(fs.readFileSync(file, "utf8"));
+        // A hand-edited or half-written file must not crash a commit: accept it
+        // only if the two fields the warning depends on are the right shape.
+        if (typeof data.ok !== "boolean" || typeof data.failures !== "number") {
+            return null;
+        }
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Record how the automatic feed went. Failures accumulate a streak so the
+ * warning can say "the last 4 commits" instead of only ever "the last one" —
+ * the difference between a blip you can ignore and a week of silence you can't.
+ */
+export async function recordFeed(dir, result, now = new Date()) {
+    try {
+        const file = await feedStatusPath(dir);
+        if (!file)
+            return;
+        const previous = await readFeedStatus(dir);
+        const at = now.toISOString();
+        const status = result.ok
+            ? { ok: true, at, failures: 0 }
+            : {
+                ok: false,
+                at,
+                failures: (previous?.ok === false ? previous.failures : 0) + 1,
+                since: previous?.ok === false ? (previous.since ?? at) : at,
+                reason: result.reason
+                    ? firstParagraph(result.reason).slice(0, MAX_REASON_CHARS)
+                    : undefined,
+            };
+        fs.writeFileSync(file, JSON.stringify(status));
+    }
+    catch {
+        // Best-effort: never let bookkeeping break a commit.
+    }
+}
+/** A session problem is the one failure the user can fix in one command. */
+function needsLogin(reason) {
+    return /session|refresh[_ ]token|logged out|no stored session|\b40[13]\b/i.test(reason ?? "");
+}
+function remedyFor(reason) {
+    return needsLogin(reason)
+        ? "changebook login"
+        : "changebook analyze --commit HEAD   (to see the error in full)";
+}
+/**
+ * The warning a human sees, as text. Built separately from printing it so it
+ * can be tested, same shape as guard.ts' findingsMessage. Empty string when
+ * there is nothing to say — a healthy feed must stay completely silent, or the
+ * warning becomes noise people learn to skip.
+ */
+export function feedWarning(status, opts = {}) {
+    const { logPath = `.git/${HOOK_LOG_FILE}`, audience = "human" } = opts;
+    if (!status || status.ok || status.failures < 1)
+        return "";
+    const commits = status.failures === 1
+        ? "The last commit was not analyzed"
+        : `The last ${status.failures} commits were not analyzed`;
+    const since = status.since ? ` (since ${status.since.slice(0, 16).replace("T", " ")} UTC)` : "";
+    if (audience === "agent") {
+        const lines = [
+            "⚠ ChangeBook: this project's atlas is NOT being fed.",
+            `${commits}${since}, so anything it tells you about recent work is out of date — say so before you rely on it.`,
+        ];
+        if (status.reason)
+            lines.push(`Last error: ${status.reason}`);
+        lines.push(needsLogin(status.reason)
+            ? "Tell the user to run `changebook login` in their terminal. It opens a browser to authorize, so you cannot complete it yourself."
+            : `Tell the user their atlas stopped updating; the full error is in ${logPath}.`);
+        return lines.join("\n");
+    }
+    const lines = [
+        "\n⚠ ChangeBook: your atlas has stopped being fed.",
+        `  ${commits}${since}, so what it tells you is going stale.`,
+    ];
+    if (status.reason)
+        lines.push(`  Last error: ${status.reason}`);
+    lines.push(`  Fix: ${remedyFor(status.reason)}`);
+    lines.push(`  Full output: ${logPath}\n`);
+    return lines.join("\n");
+}
+/** Convenience for callers that only want the text for a directory. */
+export async function feedWarningFor(dir, opts = {}) {
+    const status = await readFeedStatus(dir);
+    if (!status || status.ok)
+        return "";
+    const file = await feedStatusPath(dir);
+    const logPath = file
+        ? path.join(path.dirname(file), HOOK_LOG_FILE)
+        : `.git/${HOOK_LOG_FILE}`;
+    return feedWarning(status, { ...opts, logPath });
+}
+//# sourceMappingURL=feed.js.map

package/dist/git.js

@@ -5,8 +5,22 @@
  * compress differently across subcommands and break the server-side dedup.
  */
 import { execFile } from "node:child_process";
+import * as path from "node:path";
 import { promisify } from "node:util";
 export const execFileAsync = promisify(execFile);
+/**
+ * Absolute path to a file inside this repo's git dir (the guard's cache, the
+ * feed pulse, the hook log). `--git-path` rather than building
+ * `<git-dir>/<name>` by hand: it resolves a linked worktree's common dir, so
+ * every process that shares the repo agrees on where these files live.
+ */
+export async function gitPath(dir, name) {
+    const { stdout } = await execFileAsync("git", ["rev-parse", "--git-path", name], {
+        cwd: dir,
+        encoding: "utf8",
+    });
+    return path.resolve(dir, stdout.trim());
+}
 export const GIT_MAX_BUFFER_BYTES = 10 * 1024 * 1024;
 // Mirror of the extension's default changebook.maxDiffCharacters (the server
 // rejects anything above 60k anyway).

package/dist/guard.js

@@ -15,7 +15,8 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { execFileSync } from "node:child_process";
-import { execFileAsync } from "./git.js";
+import { execFileAsync, gitPath } from "./git.js";
+import { feedWarningFor } from "./feed.js";
 /** Exit code that asks the pre-commit hook to abort the commit. */
 export const EXIT_BLOCK = 3;
 // A commit should never feel slow because of us: whatever the network hasn't
@@ -200,10 +201,6 @@ export function contarEnRepo(dir, simbolo) {
         return code === 1 ? 0 : null;
     }
 }
-async function gitPath(dir, name) {
-    const { stdout } = await execFileAsync("git", ["rev-parse", "--git-path", name], { cwd: dir, encoding: "utf8" });
-    return path.resolve(dir, stdout.trim());
-}
 export async function stagedFiles(dir) {
     // -z: NUL-separated, and crucially git does NOT octal-quote non-ASCII paths
     // (default quotepath would emit "m\303\263dulo.ts", which never matches the
@@ -273,11 +270,29 @@ async function fetchSignals(db, dir, env) {
     }
     return { alerts, filesByModule, projectId, fromCache: false };
 }
-/** One-line last-run trace so "why didn't it warn?" is answerable. */
+// Un fallo intermitente no se diagnostica con la última foto: hace falta la
+// racha. Este log guardaba SOLO la última corrida, y el 2026-07-25 eso costó un
+// diagnóstico — la corrida que gastó la sesión ya había sido pisada por la
+// siguiente cuando fui a mirar. Acotado por tamaño, no por olvido.
+const GUARD_LOG_MAX_BYTES = 65_536;
+const GUARD_LOG_KEEP_BYTES = 32_768;
+/** Traza por corrida, en append acotado, para que "¿por qué no avisó?" tenga respuesta. */
 async function logRun(dir, message) {
     try {
         const file = await gitPath(dir, "changebook-guard.log");
-        fs.writeFileSync(file, `${new Date().toISOString()} ${message}\n`);
+        // Recortar ANTES de anexar: con appendFileSync no hay descriptor abierto de
+        // por medio, pero el orden mantiene el fichero por debajo del techo aunque
+        // esta corrida escriba una línea larga.
+        try {
+            if (fs.statSync(file).size > GUARD_LOG_MAX_BYTES) {
+                const keep = fs.readFileSync(file).subarray(-GUARD_LOG_KEEP_BYTES);
+                fs.writeFileSync(file, keep);
+            }
+        }
+        catch {
+            // El fichero aún no existe: nada que recortar.
+        }
+        fs.appendFileSync(file, `${new Date().toISOString()} ${message}\n`);
     }
     catch {
         // Best-effort only.
@@ -314,6 +329,14 @@ export async function runGuard(db, dir, env = process.env) {
     const mode = (env.CHANGEBOOK_GUARD ?? "").trim().toLowerCase();
     if (mode === "off")
         return 0;
+    // The atlas' feed pulse, FIRST and offline. This is the one warning that has
+    // to survive a dead session — a dead session is its most common cause, and
+    // every check below this point either needs credentials or the network. It
+    // reads one small file, so it cannot slow a commit down, and like everything
+    // else here it only informs: the exit code is untouched.
+    const pulse = await feedWarningFor(dir);
+    if (pulse)
+        console.error(pulse);
     if (!db.hasCredentials())
         return 0;
     let staged;

package/dist/hook.js

@@ -22,16 +22,34 @@ function cliEntry() {
 }
 const POST_COMMIT_MARKER = "# changebook post-commit hook";
 const PRE_COMMIT_MARKER = "# changebook pre-commit guard";
+// The hook log grows by one run per commit, so it needs a ceiling — but one
+// that keeps enough history to diagnose a streak of failures, which is the
+// whole reason it is worth keeping at all.
+const LOG_MAX_BYTES = 262_144;
+const LOG_TRIM_KEEP_BYTES = 131_072;
 /** Exported for tests: the contract between this script and guard.ts. */
 export function postCommitScript() {
     // Background subshell + `|| true`: a broken analyze (offline, out of
     // credits, logged out) must never make `git commit` fail or feel slow.
-    // The log keeps only the last run so it can't grow unbounded.
+    //
+    // The log APPENDS, with a UTC header per run. It used to keep only the last
+    // run to stay bounded, which cost us a real diagnosis on 2026-07-25: two
+    // commits failed in a row and the second overwrote the evidence of the first,
+    // so which process broke the session was no longer answerable. Bounded is
+    // still right, but by trimming — not by forgetting everything but the last
+    // line. The trim runs BEFORE the redirection opens on purpose: replacing the
+    // file while the append fd is already open would leave that fd pointing at
+    // the unlinked inode and silently throw the run's output away.
+    const trimmed = `${LOG_TRIM_KEEP_BYTES}`;
     return `#!/bin/sh
 ${POST_COMMIT_MARKER} — analyzes each commit into your ChangeBook atlas.
 # Runs in the background and never blocks the commit. Remove with:
 #   changebook hook uninstall
-( ${JSON.stringify(process.execPath)} ${JSON.stringify(cliEntry())} analyze --commit HEAD > "$(git rev-parse --git-dir)/changebook-hook.log" 2>&1 & ) || true
+LOG="$(git rev-parse --git-path changebook-hook.log)"
+if [ -f "$LOG" ] && [ "$(wc -c < "$LOG")" -gt ${LOG_MAX_BYTES} ]; then
+  tail -c ${trimmed} "$LOG" > "$LOG.tmp" 2>/dev/null && mv -f "$LOG.tmp" "$LOG"
+fi
+( { date -u +'=== %Y-%m-%dT%H:%M:%SZ'; ${JSON.stringify(process.execPath)} ${JSON.stringify(cliEntry())} analyze --commit HEAD; } >> "$LOG" 2>&1 & ) || true
 `;
 }
 /** Exported for tests: the contract between this script and guard.ts. */

package/dist/index.js

@@ -16,6 +16,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { analyze } from "./analyze.js";
 import { atlasWebUrl, openInBrowser } from "./browser.js";
 import { clearCredentials, credentialsPath } from "./credentials.js";
+import { recordFeed } from "./feed.js";
 import { runGuard } from "./guard.js";
 import { hookStatus, installHook, uninstallHook } from "./hook.js";
 import { importHistory } from "./import.js";
@@ -136,9 +137,36 @@ async function main() {
         }
         case "analyze": {
             const db = new Supabase();
-            requireCredentials(db);
             const options = parseAnalyzeArgs(process.argv.slice(3));
-            await analyze(db, options);
+            const dir = options.dir ?? process.cwd();
+            // --commit IS the post-commit hook's path: the automatic feed, running
+            // detached where nobody reads its output. Record whether it landed so the
+            // next pre-commit can say it out loud (feed.ts). A manual `changebook
+            // analyze` is someone watching the terminal — no pulse needed, and
+            // recording one would let a hand-run failure warn about the hook.
+            const feeding = Boolean(options.commit);
+            if (!db.hasCredentials()) {
+                // Not requireCredentials(): it exits, and being logged out is exactly
+                // the failure the pulse exists to surface.
+                if (feeding)
+                    await recordFeed(dir, { ok: false, reason: "No stored session." });
+                console.error(AUTH_HELP);
+                process.exit(1);
+            }
+            try {
+                await analyze(db, options);
+            }
+            catch (error) {
+                if (feeding) {
+                    await recordFeed(dir, {
+                        ok: false,
+                        reason: error instanceof Error ? error.message : String(error),
+                    });
+                }
+                throw error;
+            }
+            if (feeding)
+                await recordFeed(dir, { ok: true });
             // El mapa de CLAUDE.md/AGENTS.md se regeneraba solo en `init`/`sync`,
             // así que se congelaba el día que lo instalabas (estudio 2026-07-20: la
             // causa nº 1 de que el agente desconfíe del atlas). analyze es el camino
@@ -147,9 +175,7 @@ async function main() {
             // archivos ni resucita un bloque borrado. Best-effort: un sync caído no
             // puede tumbar un análisis ya cobrado y registrado.
             try {
-                await syncContextFiles(db, options.dir ?? process.cwd(), {
-                    refreshOnly: true,
-                });
+                await syncContextFiles(db, dir, { refreshOnly: true });
             }
             catch (error) {
                 console.error(`Map refresh failed (analysis itself succeeded): ${error instanceof Error ? error.message : String(error)}`);
@@ -167,7 +193,14 @@ async function main() {
             // repo must commit exactly as before — runGuard resolves every failure
             // to exit 0 itself. The explicit exit also drops any fetch still racing
             // the timeout, so the commit never waits on a dangling socket.
-            return process.exit(await runGuard(new Supabase(), arg ?? process.cwd()));
+            //
+            // allowRefresh: false — and it is that same exit that makes it necessary.
+            // A dropped fetch is harmless unless it happens to be the token refresh:
+            // Supabase rotates on receipt, so dying mid-flight burns the stored token
+            // without saving its replacement and logs the user out of everything.
+            // The guard is an optional warning with a 3.5s budget; it must never be
+            // able to cost a session. Expired access token → no warning this time.
+            return process.exit(await runGuard(new Supabase(process.env, { allowRefresh: false }), arg ?? process.cwd()));
         }
         case "hook": {
             const dir = process.argv[4] ?? process.cwd();

package/dist/supabase.js

@@ -64,7 +64,21 @@ export class Supabase {
     // True when the tokens came from ~/.changebook/credentials.json: rotated
     // refresh tokens must be written back there or the stored one goes stale.
     persistRotation = false;
-    constructor(env = process.env) {
+    /**
+     * Whether this process is allowed to SPEND the rotating refresh token.
+     *
+     * False for callers that run under a hard deadline and end in process.exit()
+     * — today, the pre-commit guard. Supabase rotates the refresh token the
+     * moment it RECEIVES the request, not when we read the reply, so a process
+     * that is killed mid-refresh burns the stored token without ever persisting
+     * the new one. The next process replays a spent token, Supabase's reuse
+     * detection fires, and the whole session dies. That is a silent logout
+     * caused by an optional warning — a terrible trade (diagnosed 2026-07-25:
+     * the session died ~30 min after every login, always on a commit).
+     */
+    allowRefresh = true;
+    constructor(env = process.env, opts = {}) {
+        this.allowRefresh = opts.allowRefresh ?? true;
         this.url = (env.CHANGEBOOK_SUPABASE_URL ?? DEFAULT_URL).replace(/\/+$/, '');
         this.anonKey = env.CHANGEBOOK_SUPABASE_ANON_KEY ?? DEFAULT_ANON_KEY;
         this.accessToken = env.CHANGEBOOK_ACCESS_TOKEN?.trim() || undefined;
@@ -288,6 +302,12 @@ export class Supabase {
         return this.refreshing;
     }
     doRefresh() {
+        // Refusing BEFORE the request is the whole point: once it leaves, the token
+        // is spent whether or not we survive to store the replacement. Callers that
+        // opt out get a plain 401 they can treat as "no atlas this time".
+        if (!this.allowRefresh) {
+            return Promise.reject(new SupabaseError("The stored session needs renewing and this process is not allowed to spend it (it runs under a deadline). Skipping.", 401));
+        }
         // Env-var sessions aren't shared through the credentials file, so there is
         // nothing to coordinate between processes: refresh in place.
         if (!this.persistRotation)

package/dist/sync.js

@@ -50,6 +50,27 @@ const SYNC_BUDGET_CHARS = 2_000;
 // shared analyses and a ≥60% rate before we call it a dependency.
 const MIN_PAIR_COUNT = 3;
 const MIN_PAIR_RATE = 0.6;
+/**
+ * Espejo de supabase/functions/mcp/scope.ts::summarizeHealth — el paquete npm
+ * es autocontenido. Paridad fijada en test/saludEnBrief.
+ */
+export function summarizeHealth(rows) {
+    let passed = 0;
+    const at_risk = [];
+    for (const r of rows) {
+        if (r.status === 'passed') {
+            passed += 1;
+        }
+        else if (r.status === 'at_risk') {
+            at_risk.push({
+                check: r.check_id,
+                evidence: (r.evidence ?? '').trim(),
+                since: r.updated_at ? r.updated_at.slice(0, 10) : null,
+            });
+        }
+    }
+    return { passed, at_risk };
+}
 // Same window/limit the web uses for the signals strip.
 const ALERT_WINDOW_DAYS = 14;
 const MAX_ALERTS = 3;
@@ -76,7 +97,7 @@ export async function fetchBriefSection(db, targetDir) {
     }
     const projectId = /project_id=eq\.([0-9a-f-]+)/.exec(projectFilter)?.[1] ?? null;
     const since = new Date(Date.now() - ALERT_WINDOW_DAYS * 24 * 3600 * 1000).toISOString();
-    const [moduleRows, changes, alerts, pendingTasks] = await Promise.all([
+    const [moduleRows, changes, alerts, pendingTasks, healthRows] = await Promise.all([
         db.rest('change_module?select=changelog_id,module,domain,risk,files,note,created_at&order=created_at.desc&limit=500' +
             projectFilter),
         db.rest(`changelog?select=business_impact,created_at&order=created_at.desc&limit=${MAX_CHANGES}` +
@@ -93,8 +114,14 @@ export async function fetchBriefSection(db, targetDir) {
                 .then((rows) => rows.filter((r) => r.status === 'pending'))
                 .catch(() => [])
             : Promise.resolve([]),
+        // Salud (project_checks): tabla diminuta (≤8 filas/proyecto), en paralelo.
+        db
+            .rest('project_checks?select=check_id,status,evidence,updated_at&order=updated_at.desc&limit=8' +
+            projectFilter)
+            .catch(() => []),
     ]);
-    const section = buildSection(moduleRows, changes, alerts, projectName, pendingTasks);
+    const health = summarizeHealth(healthRows);
+    const section = buildSection(moduleRows, changes, alerts, projectName, pendingTasks, health.at_risk);
     return { section, projectId, projectResolved };
 }
 export async function syncContextFiles(db, targetDir, opts = {}) {
@@ -119,7 +146,7 @@ export async function syncContextFiles(db, targetDir, opts = {}) {
     }
 }
 /** Exported for tests. */
-export function buildSection(rows, changes, alerts = [], projectName, pendingTasks = []) {
+export function buildSection(rows, changes, alerts = [], projectName, pendingTasks = [], atRiskHealth = []) {
     // Newest-first rows: the first occurrence of a module is its latest state.
     const seen = new Map();
     for (const row of rows) {
@@ -225,6 +252,11 @@ export function buildSection(rows, changes, alerts = [], projectName, pendingTas
         return `- **${m.module}** está marcado crítico${note ? ` — ${note}` : ''}`;
     });
     const changeLines = changes.map((c) => `- ${c.created_at.slice(0, 10)} — ${sanitizeCell((c.business_impact ?? '').slice(0, 140))}`);
+    // Salud en riesgo: los controles (auth, secretos, validación, límites…) que
+    // el análisis ya marcó rotos con evidencia. Alta prioridad de presupuesto —
+    // es seguridad. Solo los at_risk (lo accionable); el texto entero va a
+    // `atlas_project_brief`. Cap a 130 chars como las alertas.
+    const healthLines = atRiskHealth.map((h) => `- ⚠ **${h.check}**${h.since ? ` (desde ${h.since})` : ''} — ${sanitizeCell(h.evidence.slice(0, 130))}`);
     // Auto-remediación fase 2: la cola entra en cada sesión para que el agente
     // se OFREZCA a atacarla — proponer con plan y esperar el OK del humano,
     // nunca ejecutar por su cuenta. Títulos deduplicados (la cola real puede
@@ -261,6 +293,12 @@ export function buildSection(rows, changes, alerts = [], projectName, pendingTas
             title: '### Regresiones detectadas (resolver o verificar YA)',
             lines: alertLines,
         },
+        {
+            key: 'health',
+            priority: 1,
+            title: '### Salud en riesgo (verifica antes de tocar)',
+            lines: healthLines,
+        },
         {
             key: 'hotspots',
             priority: 4,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "changebook",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "mcpName": "io.github.raulbr90/changebook",
   "description": "ChangeBook for coding agents: MCP server (product memory for Claude Code/Codex) + CLI to sign in, analyze changes and sync the product map.",
   "type": "module",

package/server.json

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.raulbr90/changebook",
   "description": "Query your product's living memory: module map + analyzed change history. Read-only MCP tools.",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "websiteUrl": "https://changebook.dev",
   "remotes": [
     {
@@ -15,7 +15,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "changebook",
-      "version": "0.4.7",
+      "version": "0.4.8",
       "transport": {
         "type": "stdio"
       }