halfcycle 0.3.40 → 0.4.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "halfcycle",
-  "version": "0.3.40",
+  "version": "0.4.0",
   "description": "Halfcycle Method bundle — resolution-stub slash commands, remote method-delivery registration, and governance-hook wiring for a Halfcycle engagement repo. It ships NO worker role files: a project's roles are authored from that project's own recorded decisions at orchestration kickoff (FX-2, W3-F-27).",
   "commands": [
     {

package/README.md

@@ -42,7 +42,7 @@ A method document cannot fix that, because a document cannot interrupt you. This
 
 Credit where it is due, and it is due. GStack, Matt Pocock's skills, GitHub Spec Kit, BMAD, OpenSpec and claude-flow are genuinely good, and between them they taught this whole category that the bottleneck is discipline rather than model intelligence. We took two things from them deliberately and say so: the one-question-at-a-time interrogation shape, and an install that is one command and then stays out of your way.
 
-The objection this usually meets is that it must be too much for a small project. It would be, if there were one setting. A folder you download has exactly one, so whoever wrote it had to choose who to disappoint, and it is usually the small project that gets buried and quietly drops the process in week three. This reads the work instead and sizes itself to it, which is the section further down.
+The objection this usually meets is that it must be too much for a small project. It would be, if there were one setting. A folder you download has exactly one, so whoever wrote it had to choose who to disappoint, and it is usually the small project that gets buried and quietly drops the process in week three. Halfcycle sizes each piece of work with a diagnostic before it starts instead, and records which design documents it includes and which it skips, which is the section further down.
 
 Writing the process down was never the hard part. What a folder you download structurally cannot have is these three things.
 
@@ -148,14 +148,12 @@ This matters enough to be specific about.
 
 **Your own Halfcycle credential lives outside this repository, in a file named `env` under your home directory — never in anything you'd commit.** Installing writes it. Opening or closing a phase rewrites it, to record which phase is open, and the credential in it is also renewed there automatically to keep your connection current. Uninstalling with `--remove-credential` deletes it. Nothing else changes it.
 
-**What the checks receive is the shape of a change, not its contents.** File paths, structural shapes, environment variable names and how they are used, the tables a write touches, route signatures, outbound host names. There is no file body and no diff in the request.
+**What the checks receive is the shape of a change and short excerpts of the code being edited — never a whole file and never a diff.** File paths, structural shapes, environment variable names and how they are used, the tables a write touches, route signatures, outbound host names. There is no file body and no diff in the request.
 
-**Source excerpts are off, at both ends, for every engagement today.** The wire format does have a field for them, so the honest version of this is a conditional statement rather than a flat one, and it rests on three things rather than on our good intentions: your runner does not attach an excerpt unless you turn a flag on, and that flag is off by default; anything that does arrive for an engagement that has not opted in is stripped on our side before the checks or any model see it; and there is no way to opt in today, because nothing in the product can set that flag. If that ever changes, our privacy policy changes with it, and it is the policy — not this paragraph — that states the guarantee.
+**Short excerpts of the code being edited are sent to Halfcycle to run its checks, under the terms you accepted at sign-in.** Our privacy policy, not this paragraph, states how we handle what you send.
 
 **What the readiness audit submits, and what it never carries.** `halfcycle_submit_findings` is how your session sends the audit's answers: a probe's status, a count, a repo-relative path, a short name. Never a file body, a diff or a source excerpt — the wire carries no field for prose, so a path or a name is the most it can carry. What Halfcycle keeps is what your session submitted, the judgement it reached, and which account and machine sign-in the submission came from; the documents themselves never reach it.
 
-**A promise, for the day a check does need to read something you wrote:** what you send it will be read and not kept: the finding and its evidence persist, the source does not, and training or benchmarking on it is foreclosed. It is written here now, labelled as a commitment rather than a feature, so the promise is public before the mechanism is.
-
 **Nothing method-shaped is left behind.** The runbooks, templates and question sets reach the session that asks for them, scoped to the step you are on, and are never at rest in your repository.
 
 ## What you keep

package/bin/bin.bundle.mjs

@@ -14820,7 +14820,7 @@ function readMcpServerUrl() {
 }
 function readExcerptConfig() {
   const raw = process.env["HALFCYCLE_SOURCE_EXCERPTS"];
-  const enabled = (raw ?? "").trim().toLowerCase() === "true";
+  const enabled = (raw ?? "").trim().toLowerCase() !== "false";
   const readCap = (name, fallback) => {
     const v = process.env[name];
     if (v === void 0)
@@ -15701,8 +15701,10 @@ async function attempt(url2, token, request, fetchFn, retry) {
 import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { relative } from "node:path";
+var COLOR_AWARE_SUBCOMMANDS = /* @__PURE__ */ new Set(["diff", "show", "log"]);
 function git(args2, cwd, timeoutMs) {
-  const result = spawnSync("git", args2, {
+  const argv = COLOR_AWARE_SUBCOMMANDS.has(args2[0] ?? "") ? [args2[0], "--no-color", ...args2.slice(1)] : args2;
+  const result = spawnSync("git", argv, {
     cwd,
     encoding: "utf-8",
     ...timeoutMs === void 0 ? {} : { timeout: timeoutMs }
@@ -16816,13 +16818,21 @@ function produceExcerpts(diffContent, descriptors, caps) {
   const excerpts = [];
   const seen = /* @__PURE__ */ new Set();
   const lines = diffContent.split("\n");
-  let lineNo = 0;
+  let newLineNo;
   for (const raw of lines) {
-    if (raw.startsWith("-") && !raw.startsWith("---"))
+    const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(raw);
+    if (hunk) {
+      newLineNo = Number.parseInt(hunk[1], 10);
+      continue;
+    }
+    if (newLineNo === void 0)
+      continue;
+    if (raw.startsWith("\\"))
       continue;
-    if (raw.startsWith("+++") || raw.startsWith("---"))
+    if (raw.startsWith("-"))
       continue;
-    lineNo += 1;
+    const lineNo = newLineNo;
+    newLineNo += 1;
     if (!raw.startsWith("+"))
       continue;
     const text = raw.slice(1).trim();
@@ -17092,7 +17102,10 @@ async function runCi() {
     };
   });
   const context = loadChangeSetContext(repoRoot);
-  const changeSet = buildChangeSet(fileDiffEntries, { ...context, excerpts: readExcerptConfig() });
+  const changeSet = buildChangeSet(fileDiffEntries, {
+    ...context,
+    excerpts: { enabled: false, ...EXCERPT_DEFAULTS }
+  });
   const configResult = readConfig();
   if (!configResult.config) {
     const oidc = readActionsOidcEnv();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "halfcycle",
-  "version": "0.3.40",
+  "version": "0.4.0",
   "description": "Your coding agents are the engineers. Halfcycle is the rest of the team: product owner, architect, planner and independent reviewer for Claude Code.",
   "keywords": [
     "claude",
@@ -44,7 +44,8 @@
   "scripts": {
     "build": "tsc -p tsconfig.json && node scripts/bundle-entries.mjs && node scripts/vendor-runner-bin.mjs",
     "typecheck": "tsc --noEmit -p tsconfig.test.json",
-    "test": "tsc -p tsconfig.test.json && node --test \"dist-test/test/\"*.test.js"
+    "build:test": "tsc -p tsconfig.test.json",
+    "test": "node -e \"const{existsSync,readdirSync}=require('fs');const d='dist-test/test';if(!existsSync(d)||!readdirSync(d).some(f=>f.endsWith('.test.js'))){console.error('dist-test/test has no compiled *.test.js files — run pnpm run build:test first');process.exit(1)}\" && node --test \"dist-test/test/\"*.test.js"
   },
   "dependencies": {
     "zod": "^4.4.3"