eagle-mem 4.6.1 → 4.7.0

package/lib/common.sh

@@ -12,6 +12,11 @@ EAGLE_SKILLS_DIR="$HOME/.claude/skills"
 EAGLE_CLAUDE_PROJECTS_DIR="$HOME/.claude/projects"
 EAGLE_CLAUDE_PLANS_DIR="$HOME/.claude/plans"
 EAGLE_CLAUDE_TASKS_DIR="$HOME/.claude/tasks"
+EAGLE_CODEX_DIR="${EAGLE_CODEX_DIR:-$HOME/.codex}"
+EAGLE_CODEX_CONFIG="${EAGLE_CODEX_CONFIG:-$EAGLE_CODEX_DIR/config.toml}"
+EAGLE_CODEX_HOOKS="${EAGLE_CODEX_HOOKS:-$EAGLE_CODEX_DIR/hooks.json}"
+EAGLE_CODEX_AGENTS_MD="${EAGLE_CODEX_AGENTS_MD:-$EAGLE_CODEX_DIR/AGENTS.md}"
+EAGLE_RAW_BASH_UNLOCK="${EAGLE_RAW_BASH_UNLOCK:-/tmp/eagle-mem-raw-bash-unlock}"
 
 eagle_log() {
     local level="$1"
@@ -63,6 +68,289 @@ eagle_project_from_cwd() {
     fi
 }
 
+eagle_project_file_path() {
+    local cwd="${1:-$(pwd)}"
+    local file_path="${2:-}"
+
+    [ -z "$file_path" ] && return 0
+
+    case "$file_path" in
+        ./*) file_path="${file_path#./}" ;;
+    esac
+
+    case "$file_path" in
+        /*)
+            local git_root
+            git_root=$(git -C "$cwd" rev-parse --show-toplevel 2>/dev/null)
+            if [ -n "$git_root" ]; then
+                case "$file_path" in
+                    "$git_root"/*)
+                        printf '%s\n' "${file_path#$git_root/}"
+                        return 0
+                        ;;
+                esac
+            fi
+            case "$file_path" in
+                "$cwd"/*)
+                    printf '%s\n' "${file_path#$cwd/}"
+                    return 0
+                    ;;
+            esac
+            ;;
+    esac
+
+    printf '%s\n' "$file_path"
+}
+
+eagle_extract_apply_patch_files() {
+    sed -n -E 's/^\*\*\* (Add|Update|Delete) File: //p'
+}
+
+eagle_agent_source() {
+    local agent="${EAGLE_AGENT_SOURCE:-${EAGLE_AGENT:-}}"
+    case "$agent" in
+        codex|openai-codex) echo "codex" ;;
+        claude|claude-code|cloud-code) echo "claude-code" ;;
+        *) echo "claude-code" ;;
+    esac
+}
+
+eagle_agent_source_from_json() {
+    local input="${1:-}"
+    local configured="${EAGLE_AGENT_SOURCE:-${EAGLE_AGENT:-}}"
+    if [ -n "$configured" ]; then
+        eagle_agent_source
+        return
+    fi
+
+    local transcript_path turn_id tool_name
+    transcript_path=$(printf '%s' "$input" | jq -r '.transcript_path // empty' 2>/dev/null)
+    turn_id=$(printf '%s' "$input" | jq -r '.turn_id // empty' 2>/dev/null)
+    tool_name=$(printf '%s' "$input" | jq -r '.tool_name // empty' 2>/dev/null)
+
+    case "$transcript_path" in
+        "$HOME/.codex/"*|*/.codex/*) echo "codex"; return ;;
+        "$HOME/.claude/"*|*/.claude/*) echo "claude-code"; return ;;
+    esac
+    [ -n "$turn_id" ] && { echo "codex"; return; }
+    [ "$tool_name" = "apply_patch" ] && { echo "codex"; return; }
+
+    echo "claude-code"
+}
+
+eagle_agent_label() {
+    case "${1:-$(eagle_agent_source)}" in
+        codex) echo "Codex" ;;
+        *) echo "Claude Code" ;;
+    esac
+}
+
+eagle_is_shell_tool() {
+    case "${1:-}" in
+        Bash|exec_command|shell_command|unified_exec) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+eagle_tool_command_from_json() {
+    local input="${1:-}"
+    printf '%s' "$input" | jq -r '
+        .tool_input.command
+        // .tool_input.cmd
+        // .tool_input.shell_command
+        // .tool_input.command_line
+        // .tool_input.cmdline
+        // (if (.tool_input.argv? | type) == "array" then (.tool_input.argv | join(" ")) else empty end)
+        // empty
+    ' 2>/dev/null
+}
+
+eagle_emit_context_for_agent() {
+    local agent="${1:-$(eagle_agent_source)}"
+    local hook_event="${2:-}"
+    local context="${3:-}"
+
+    [ -z "$context" ] && return 0
+
+    if [ "$agent" = "codex" ]; then
+        jq -cn \
+            --arg event "$hook_event" \
+            --arg context "$context" \
+            '{
+                hookSpecificOutput: {
+                    hookEventName: $event,
+                    additionalContext: $context
+                }
+            }'
+        return 0
+    fi
+
+    printf '%s\n' "$context"
+}
+
+eagle_rtk_rewrite_command() {
+    local cmd="$1"
+    command -v rtk >/dev/null 2>&1 || return 1
+
+    case "$cmd" in
+        ""|rtk\ *|*" rtk "*|*"eagle-mem "*|*"git push"*|*"gh pr create"*|*"npm publish"*|*"pnpm publish"*|*"yarn npm publish"*|*"bun publish"*)
+            return 1
+            ;;
+    esac
+
+    local rewritten
+    rewritten=$(rtk rewrite "$cmd" 2>/dev/null | head -1)
+    [ -z "$rewritten" ] && return 1
+    [ "$rewritten" = "$cmd" ] && return 1
+    printf '%s\n' "$rewritten"
+}
+
+eagle_raw_bash_unlock_active() {
+    [ -f "$EAGLE_RAW_BASH_UNLOCK" ] || return 1
+    local now mtime age
+    now=$(date +%s)
+    mtime=$(stat -f %m "$EAGLE_RAW_BASH_UNLOCK" 2>/dev/null || stat -c %Y "$EAGLE_RAW_BASH_UNLOCK" 2>/dev/null || echo 0)
+    age=$((now - mtime))
+    [ "$age" -lt 600 ]
+}
+
+eagle_sha256_stream() {
+    if command -v shasum >/dev/null 2>&1; then
+        shasum -a 256 | awk '{print $1}'
+    else
+        sha256sum | awk '{print $1}'
+    fi
+}
+
+eagle_is_release_boundary_command() {
+    local cmd="$1"
+
+    if printf '%s\n' "$cmd" \
+        | tr '\n' ';' \
+        | sed -E 's/(&&|[|][|]|;)/\
+/g' \
+        | awk '
+            function has_dry_run_flag(line) {
+                return line ~ /(^|[[:space:]])--dry-run([[:space:]]|$|=([Tt][Rr][Uu][Ee]|1|[Yy][Ee][Ss])([[:space:]]|$))/
+            }
+            /(^|[[:space:]])gh[[:space:]]+pr[[:space:]]+create([[:space:]]|$)/ ||
+            /(^|[[:space:]])npm[[:space:]]+publish([[:space:]]|$)/ ||
+            /(^|[[:space:]])pnpm[[:space:]]+publish([[:space:]]|$)/ ||
+            /(^|[[:space:]])yarn[[:space:]]+npm[[:space:]]+publish([[:space:]]|$)/ ||
+            /(^|[[:space:]])bun[[:space:]]+publish([[:space:]]|$)/ {
+                if (!has_dry_run_flag($0)) found = 1
+            }
+            END { exit(found ? 0 : 1) }
+        '
+    then
+        return 0
+    fi
+
+    if printf '%s\n' "$cmd" \
+        | tr '\n' ';' \
+        | sed -E 's/(&&|[|][|]|;)/\
+/g' \
+        | awk '
+            function has_dry_run_flag(line) {
+                return line ~ /(^|[[:space:]])--dry-run([[:space:]]|$|=([Tt][Rr][Uu][Ee]|1|[Yy][Ee][Ss])([[:space:]]|$))/
+            }
+            /(^|[[:space:]])git[[:space:]]+push([[:space:]]|$)/ {
+                if (!has_dry_run_flag($0)) found = 1
+            }
+            END { exit(found ? 0 : 1) }
+        '
+    then
+        return 0
+    fi
+
+    return 1
+}
+
+eagle_changed_files_for_release() {
+    local cwd="${1:-$(pwd)}"
+    [ -d "$cwd" ] || return 0
+
+    {
+        git -C "$cwd" diff --name-only HEAD 2>/dev/null
+        git -C "$cwd" diff --cached --name-only 2>/dev/null
+        local default_branch
+        default_branch=$(git -C "$cwd" symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null | sed 's|^origin/||')
+        if [ -n "$default_branch" ] && git -C "$cwd" rev-parse --verify "origin/$default_branch" >/dev/null 2>&1; then
+            git -C "$cwd" diff --name-only "origin/$default_branch...HEAD" 2>/dev/null
+        fi
+        if git -C "$cwd" rev-parse --abbrev-ref --symbolic-full-name '@{upstream}' >/dev/null 2>&1; then
+            git -C "$cwd" diff --name-only '@{upstream}...HEAD' 2>/dev/null
+        fi
+        if ! git -C "$cwd" rev-parse --abbrev-ref --symbolic-full-name '@{upstream}' >/dev/null 2>&1; then
+            if ! git -C "$cwd" symbolic-ref --quiet --short refs/remotes/origin/HEAD >/dev/null 2>&1; then
+                if git -C "$cwd" rev-parse --verify HEAD~1 >/dev/null 2>&1; then
+                    git -C "$cwd" diff --name-only HEAD~1..HEAD 2>/dev/null
+                fi
+            fi
+        fi
+    } | sed '/^[[:space:]]*$/d' | sort -u
+}
+
+eagle_change_fingerprint_for_file() {
+    local cwd="${1:-$(pwd)}"
+    local file_path="${2:-}"
+    [ -z "$file_path" ] && return 0
+    [ -d "$cwd" ] || return 0
+
+    local git_root
+    git_root=$(git -C "$cwd" rev-parse --show-toplevel 2>/dev/null)
+    [ -z "$git_root" ] && return 0
+
+    local rel_path="$file_path"
+    case "$rel_path" in
+        ./*) rel_path="${rel_path#./}" ;;
+        /*)
+            case "$rel_path" in
+                "$git_root"/*) rel_path="${rel_path#$git_root/}" ;;
+                "$cwd"/*) rel_path="${rel_path#$cwd/}" ;;
+            esac
+            ;;
+    esac
+
+    local base_ref=""
+    local default_branch
+    default_branch=$(git -C "$git_root" symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null | sed 's|^origin/||')
+    if [ -n "$default_branch" ] && git -C "$git_root" rev-parse --verify "origin/$default_branch" >/dev/null 2>&1; then
+        base_ref=$(git -C "$git_root" merge-base HEAD "origin/$default_branch" 2>/dev/null)
+    fi
+
+    if [ -z "$base_ref" ] && git -C "$git_root" rev-parse --abbrev-ref --symbolic-full-name '@{upstream}' >/dev/null 2>&1; then
+        base_ref=$(git -C "$git_root" merge-base HEAD '@{upstream}' 2>/dev/null)
+    fi
+
+    if [ -z "$base_ref" ]; then
+        if ! git -C "$git_root" diff --quiet HEAD -- "$rel_path" 2>/dev/null \
+            || ! git -C "$git_root" diff --cached --quiet HEAD -- "$rel_path" 2>/dev/null \
+            || git -C "$git_root" ls-files --others --exclude-standard -- "$rel_path" 2>/dev/null | grep -qxF "$rel_path"
+        then
+            base_ref="HEAD"
+        elif git -C "$git_root" rev-parse --verify HEAD~1 >/dev/null 2>&1; then
+            base_ref="HEAD~1"
+        else
+            base_ref="HEAD"
+        fi
+    fi
+
+    local base_blob="missing"
+    if [ -n "$base_ref" ] && git -C "$git_root" cat-file -e "$base_ref:$rel_path" 2>/dev/null; then
+        base_blob=$(git -C "$git_root" rev-parse "$base_ref:$rel_path" 2>/dev/null)
+    fi
+
+    local final_blob="missing"
+    if [ -f "$git_root/$rel_path" ]; then
+        final_blob=$(git -C "$git_root" hash-object -- "$rel_path" 2>/dev/null)
+    elif git -C "$git_root" cat-file -e "HEAD:$rel_path" 2>/dev/null; then
+        final_blob=$(git -C "$git_root" rev-parse "HEAD:$rel_path" 2>/dev/null)
+    fi
+
+    printf 'file:%s\nbase:%s\nfinal:%s\n' "$rel_path" "$base_blob" "$final_blob" | eagle_sha256_stream
+}
+
 eagle_sql_escape() {
     printf '%s' "$1" | sed "s/'/''/g"
 }
@@ -189,6 +477,9 @@ next_steps: [concrete actions]
 key_files: [path — role]
 files_read: [path, ...]
 files_modified: [path, ...]
+affected_features: [feature, ...]
+verified_features: [feature, ...]
+regression_risks: [risk, ...]
 </eagle-summary>
 ```
 
@@ -198,6 +489,7 @@ files_modified: [path, ...]
 - Emit `<eagle-summary>` before your final text response, every session
 - When Eagle Mem injects context at SessionStart, attribute it: "Eagle Mem recalls:"
 - Do not revert decisions surfaced by PostToolUse without asking the user
+- If Eagle Mem reports pending feature verification, verify or waive it before push/PR/publish
 - Never put raw secrets in the summary — Eagle Mem redacts but defense in depth
 - If you contradict a loaded memory, update the memory file
 EAGLE_MD
@@ -233,3 +525,52 @@ eagle_patch_claude_md() {
 
     _eagle_claude_md_section >> "$claude_md"
 }
+
+_eagle_codex_agents_section() {
+    cat << 'EAGLE_AGENTS'
+
+---
+
+## Eagle Mem — Persistent Memory
+
+Eagle Mem hooks are active for Codex in this project. SessionStart and UserPromptSubmit inject project recall from the shared Eagle Mem database at `~/.eagle-mem/memory.db`. PostToolUse records observations and marks affected features for verification.
+
+**Rule:** Before your final response in every session, emit an `<eagle-summary>` block so the Stop hook can capture a rich summary.
+
+```
+<eagle-summary>
+request: [what user asked]
+completed: [what shipped]
+learned: [non-obvious discoveries]
+decisions: [choice — why]
+gotchas: [what surprised]
+next_steps: [concrete actions]
+key_files: [path — role]
+files_read: [path, ...]
+files_modified: [path, ...]
+affected_features: [feature, ...]
+verified_features: [feature, ...]
+regression_risks: [risk, ...]
+</eagle-summary>
+```
+
+**How to apply:**
+- Attribute recalled context as "Eagle Mem recalls:" when it is injected
+- Do not revert Eagle Mem-surfaced decisions without asking the user
+- If Eagle Mem reports pending feature verification, verify or waive it before push/PR/publish
+- Never put raw secrets in summaries
+EAGLE_AGENTS
+}
+
+eagle_patch_codex_agents_md() {
+    local agents_md="$EAGLE_CODEX_AGENTS_MD"
+    local marker="## Eagle Mem — Persistent Memory"
+
+    mkdir -p "$(dirname "$agents_md")"
+
+    if [ -f "$agents_md" ] && grep -qF "$marker" "$agents_md" 2>/dev/null; then
+        return 1
+    fi
+
+    _eagle_codex_agents_section >> "$agents_md"
+}

package/lib/db-features.sh

@@ -58,6 +58,228 @@ eagle_verify_feature() {
         WHERE project = '$project' AND name = '$name';"
 }
 
+eagle_find_feature_impacts_for_file() {
+    local project; project=$(eagle_sql_escape "$1")
+    local file_path="$2"
+    local fname; fname=$(basename "$file_path")
+    local file_esc; file_esc=$(eagle_sql_escape "$file_path")
+    local fname_esc; fname_esc=$(eagle_sql_escape "$fname")
+    local file_like; file_like=$(eagle_like_escape "$file_esc")
+    local fname_like; fname_like=$(eagle_like_escape "$fname_esc")
+
+    eagle_db "SELECT DISTINCT f.id, f.name, f.description, f.last_verified_at,
+        ff.file_path,
+        (SELECT GROUP_CONCAT(fst.command, '; ')
+         FROM feature_smoke_tests fst WHERE fst.feature_id = f.id) as smoke_tests
+        FROM features f
+        JOIN feature_files ff ON ff.feature_id = f.id
+        WHERE f.project = '$project'
+        AND f.status = 'active'
+        AND (
+            ff.file_path = '$file_esc'
+            OR ff.file_path LIKE '%/$file_like' ESCAPE '\\'
+            OR '$file_esc' LIKE '%' || ff.file_path ESCAPE '\\'
+            OR ff.file_path LIKE '%$fname_like' ESCAPE '\\'
+            OR ff.file_path LIKE '%$fname_like%' ESCAPE '\\'
+        )
+        ORDER BY f.updated_at DESC
+        LIMIT 10;"
+}
+
+eagle_record_pending_feature_verifications() {
+    local project="$1"
+    local file_path="$2"
+    local session_id="${3:-}"
+    local trigger_tool="${4:-}"
+    local reason="${5:-File changed}"
+    local change_fingerprint="${6:-}"
+
+    local impacts
+    impacts=$(eagle_find_feature_impacts_for_file "$project" "$file_path")
+    [ -z "$impacts" ] && return 0
+
+    local p_esc; p_esc=$(eagle_sql_escape "$project")
+    local fp_esc; fp_esc=$(eagle_sql_escape "$file_path")
+    local sid_esc; sid_esc=$(eagle_sql_escape "$session_id")
+    local tool_esc; tool_esc=$(eagle_sql_escape "$trigger_tool")
+    local reason_esc; reason_esc=$(eagle_sql_escape "$reason")
+    local fp_hash_esc; fp_hash_esc=$(eagle_sql_escape "$change_fingerprint")
+
+    while IFS='|' read -r feature_id feature_name _desc _verified _matched_file _smoke; do
+        [ -z "$feature_id" ] && continue
+        local fid; fid=$(eagle_sql_int "$feature_id")
+        local name_esc; name_esc=$(eagle_sql_escape "$feature_name")
+
+        if [ -n "$change_fingerprint" ]; then
+            already_resolved=$(eagle_db "SELECT 1 FROM pending_feature_verifications
+                WHERE project = '$p_esc'
+                  AND feature_id = $fid
+                  AND file_path = '$fp_esc'
+                  AND change_fingerprint = '$fp_hash_esc'
+                  AND status IN ('verified', 'waived')
+                LIMIT 1;")
+            [ -n "$already_resolved" ] && continue
+        fi
+
+        eagle_db "INSERT INTO pending_feature_verifications
+            (project, feature_id, feature_name, file_path, reason, source_session_id, trigger_tool, change_fingerprint)
+            VALUES ('$p_esc', $fid, '$name_esc', '$fp_esc', '$reason_esc', '$sid_esc', '$tool_esc', '$fp_hash_esc')
+            ON CONFLICT(project, feature_id, file_path) WHERE status = 'pending' DO UPDATE SET
+                feature_name = excluded.feature_name,
+                reason = excluded.reason,
+                source_session_id = excluded.source_session_id,
+                trigger_tool = excluded.trigger_tool,
+                change_fingerprint = excluded.change_fingerprint,
+                updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now');" >/dev/null
+    done <<< "$impacts"
+
+    printf '%s\n' "$impacts"
+}
+
+eagle_record_current_feature_verifications_for_file() {
+    local project="$1"
+    local cwd="$2"
+    local file_path="$3"
+    local session_id="${4:-}"
+    local trigger_tool="${5:-}"
+    local reason="${6:-File changed}"
+
+    local norm_file
+    norm_file=$(eagle_project_file_path "$cwd" "$file_path")
+    [ -z "$norm_file" ] && return 0
+
+    local fingerprint
+    fingerprint=$(eagle_change_fingerprint_for_file "$cwd" "$norm_file")
+    eagle_record_pending_feature_verifications "$project" "$norm_file" "$session_id" "$trigger_tool" "$reason" "$fingerprint"
+}
+
+eagle_reconcile_current_feature_verifications() {
+    local project="$1"
+    local cwd="$2"
+    local session_id="${3:-}"
+    local trigger_tool="${4:-}"
+    local reason="${5:-Repository change detected}"
+    local changed_files="${6:-}"
+
+    [ -z "$changed_files" ] && return 0
+    while IFS= read -r changed_file; do
+        [ -z "$changed_file" ] && continue
+        eagle_record_current_feature_verifications_for_file "$project" "$cwd" "$changed_file" "$session_id" "$trigger_tool" "$reason" >/dev/null
+    done <<< "$changed_files"
+}
+
+eagle_list_current_pending_feature_verifications() {
+    local project="$1"
+    local cwd="$2"
+    local changed_files="${3:-}"
+    local limit; limit=$(eagle_sql_int "${4:-20}")
+    [ "$limit" -eq 0 ] && limit=20
+
+    [ -z "$changed_files" ] && return 0
+
+    local p_esc; p_esc=$(eagle_sql_escape "$project")
+    local emitted=0
+    local seen="|"
+
+    while IFS= read -r changed_file; do
+        [ -z "$changed_file" ] && continue
+        [ "$emitted" -ge "$limit" ] && break
+
+        local norm_file fingerprint impacts fp_esc fp_hash_esc
+        norm_file=$(eagle_project_file_path "$cwd" "$changed_file")
+        [ -z "$norm_file" ] && continue
+        fingerprint=$(eagle_change_fingerprint_for_file "$cwd" "$norm_file")
+        impacts=$(eagle_find_feature_impacts_for_file "$project" "$norm_file")
+        [ -z "$impacts" ] && continue
+
+        fp_esc=$(eagle_sql_escape "$norm_file")
+        fp_hash_esc=$(eagle_sql_escape "$fingerprint")
+
+        while IFS='|' read -r feature_id _feature_name _desc _verified _matched_file _smoke; do
+            [ -z "$feature_id" ] && continue
+            [ "$emitted" -ge "$limit" ] && break
+
+            local fid row row_id
+            fid=$(eagle_sql_int "$feature_id")
+            row=$(eagle_db "SELECT p.id, p.feature_name, p.file_path, p.reason, p.trigger_tool, p.created_at,
+                COALESCE((SELECT GROUP_CONCAT(fst.command, '; ')
+                 FROM feature_smoke_tests fst WHERE fst.feature_id = p.feature_id), '') as smoke_tests,
+                substr(p.change_fingerprint, 1, 12) as fingerprint
+                FROM pending_feature_verifications p
+                WHERE p.project = '$p_esc'
+                  AND p.feature_id = $fid
+                  AND p.file_path = '$fp_esc'
+                  AND p.change_fingerprint = '$fp_hash_esc'
+                  AND p.status = 'pending'
+                ORDER BY p.updated_at DESC, p.id DESC
+                LIMIT 1;")
+            [ -z "$row" ] && continue
+            row_id=${row%%|*}
+            case "$seen" in *"|$row_id|"*) continue ;; esac
+            seen+="$row_id|"
+            printf '%s\n' "$row"
+            emitted=$((emitted + 1))
+        done <<< "$impacts"
+    done <<< "$changed_files"
+}
+
+eagle_count_pending_feature_verifications() {
+    local project; project=$(eagle_sql_escape "$1")
+    eagle_db "SELECT COUNT(*) FROM pending_feature_verifications
+        WHERE project = '$project' AND status = 'pending';"
+}
+
+eagle_list_pending_feature_verifications() {
+    local project; project=$(eagle_sql_escape "$1")
+    local limit; limit=$(eagle_sql_int "${2:-20}")
+
+    eagle_db "SELECT p.id, p.feature_name, p.file_path, p.reason, p.trigger_tool, p.created_at,
+        COALESCE((SELECT GROUP_CONCAT(fst.command, '; ')
+         FROM feature_smoke_tests fst WHERE fst.feature_id = p.feature_id), '') as smoke_tests,
+        substr(p.change_fingerprint, 1, 12) as fingerprint
+        FROM pending_feature_verifications p
+        WHERE p.project = '$project' AND p.status = 'pending'
+        ORDER BY p.updated_at DESC, p.id DESC
+        LIMIT $limit;"
+}
+
+eagle_resolve_pending_feature_verifications() {
+    local project; project=$(eagle_sql_escape "$1")
+    local name; name=$(eagle_sql_escape "$2")
+    local status; status=$(eagle_sql_escape "${3:-verified}")
+    local notes; notes=$(eagle_sql_escape "${4:-}")
+
+    eagle_db_pipe <<SQL
+UPDATE pending_feature_verifications
+SET status = '$status',
+    notes = '$notes',
+    resolved_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+    updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+WHERE project = '$project'
+  AND feature_name = '$name'
+  AND status = 'pending';
+SELECT changes();
+SQL
+}
+
+eagle_waive_pending_feature_verification() {
+    local project; project=$(eagle_sql_escape "$1")
+    local id; id=$(eagle_sql_int "$2")
+    local notes; notes=$(eagle_sql_escape "${3:-}")
+
+    eagle_db_pipe <<SQL
+UPDATE pending_feature_verifications
+SET status = 'waived',
+    notes = '$notes',
+    resolved_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+    updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+WHERE project = '$project'
+  AND id = $id
+  AND status = 'pending';
+SELECT changes();
+SQL
+}
+
 eagle_get_feature_id() {
     local project; project=$(eagle_sql_escape "$1")
     local name; name=$(eagle_sql_escape "$2")

package/lib/db-guardrails.sh

@@ -21,7 +21,8 @@ eagle_add_guardrail() {
     file_pattern=$(eagle_sql_escape "$file_pattern")
     eagle_db "INSERT INTO guardrails (project, file_pattern, rule, source)
         VALUES ('$project', '$file_pattern', '$rule', '$source')
-        ON CONFLICT(project, source, file_pattern, rule) DO UPDATE SET
+        ON CONFLICT DO UPDATE SET
+            source = excluded.source,
             updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now');"
 }