hypomnema 1.8.0 → 1.8.2

package/hooks/hypo-web-fetch-ingest.mjs

@@ -15,11 +15,11 @@
  *     graph before adding a new source.
  *
  * Output contract — Claude Code docs, "Add context for Claude":
- *   PostToolUse uses **nested** hookSpecificOutput.additionalContext, NOT
- *   the top-level additionalContext that UserPromptSubmit hooks use.
- *   buildOutput() in hypo-shared.mjs is the top-level helper used by
- *   hypo-first-prompt / hypo-lookup; intentionally not reused here. See
- *   commit 515458f for the per-event matrix this codebase follows.
+ *   PostToolUse uses **nested** hookSpecificOutput.additionalContext, the
+ *   same shape every other injecting event in this codebase now uses.
+ *   buildOutput() in hypo-shared.mjs emits that nested shape given the
+ *   hookEventName, so this hook calls it too instead of building the
+ *   object by hand.
  *
  * URL redaction:
  *   additionalContext lands in the transcript. Query strings and
@@ -41,7 +41,7 @@
  * in-hook failure branch is needed.
  */
 
-import { isGateSkipped } from './hypo-shared.mjs';
+import { isGateSkipped, buildOutput } from './hypo-shared.mjs';
 
 let input = {};
 try {
@@ -58,13 +58,9 @@ try {
 }
 
 const context = buildContext(input);
-const output = { continue: true, suppressOutput: true };
-if (context) {
-  output.hookSpecificOutput = {
-    hookEventName: 'PostToolUse',
-    additionalContext: context,
-  };
-}
+const output = context
+  ? buildOutput('PostToolUse', context, { continue: true, suppressOutput: true })
+  : { continue: true, suppressOutput: true };
 console.log(JSON.stringify(output));
 
 function buildContext(data) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hypomnema",
-  "version": "1.8.0",
+  "version": "1.8.2",
   "description": "LLM-native personal wiki system for Claude Code",
   "type": "module",
   "license": "MIT",
@@ -87,6 +87,7 @@
     "fix:verify": "node scripts/fix-status-verify.mjs",
     "graph": "node scripts/graph.mjs",
     "smoke-pack": "node scripts/smoke-pack.mjs",
+    "check:release-vehicle": "node scripts/check-release-vehicle.mjs",
     "check:versions": "node scripts/check-versions.mjs",
     "smoke:plugin": "node scripts/smoke-plugin.mjs",
     "check:bilingual": "node scripts/check-bilingual.mjs --changelog",

package/scripts/doctor.mjs

@@ -34,6 +34,7 @@ import {
   collectProjectWorkingDirs,
   detectSessionCloseArtifact,
   localAndUtcDates,
+  normalizeVerifiedScope,
   SESSION_CLOSED_MARKER_STALE_MS,
   isUsablePkgRootLocal,
   selfLocationPkgRootFrom,
@@ -916,14 +917,32 @@ function deriveCommitProjects(hypoDir, hash) {
 //     an artifact with no verifiable scope, so this never matches, ever.
 //   • 'projects' — a project file, or a commit that touched one or more
 //     identifiable projects/<slug>/ paths. EVERY named project must appear
-//     in the marker's own `projects` list.
+//     in the marker's own `projects` list, AND, when the marker carries a
+//     `verified_scope` (session-close-scope-boundary spec §3), in that
+//     scope's own `projects` too — an AND, never an OR. `projects` is
+//     evidence-based attribution; `verified_scope` is what the gate that
+//     wrote this marker actually checked, and the two can diverge (an
+//     unnarrowed gate run can attribute to more projects than it verified).
+//     A `verified_scope` of kind 'log-only' verified no project at all, so it
+//     can never cover a 'projects'-scoped artifact. A marker with NO
+//     `verified_scope` (every marker before this field existed) skips this
+//     extra check entirely — it neither tightens nor loosens the membership
+//     check above, so old markers read back byte-for-byte as before.
 function markerCoversArtifact(marker, artifact) {
   if (!marker.dates.includes(artifact.date)) return false;
   switch (artifact.scope.kind) {
     case 'root-universal':
       return true;
     case 'projects':
-      return artifact.scope.projects.every((p) => marker.projects.includes(p));
+      if (!artifact.scope.projects.every((p) => marker.projects.includes(p))) return false;
+      if (!marker.verifiedScope) return true;
+      // Unreachable for a 'projects' artifact today: a log-only close writes
+      // `projects: []`, so the membership check above already returned false.
+      // Kept deliberately, not by oversight — it states the kind's meaning
+      // (log-only verified no project at all) so this stays correct if
+      // `projects` ever carries something for a log-only close.
+      if (marker.verifiedScope.kind === 'log-only') return false;
+      return artifact.scope.projects.every((p) => marker.verifiedScope.projects.includes(p));
     default:
       return false; // 'unscoped'
   }
@@ -1035,7 +1054,17 @@ function checkSessionCloseArtifacts(hypoDir) {
       // and doctor has no corroborating signal of its own to add, so it
       // must refuse it too rather than re-opening the same hole standalone.
       const projects = Array.isArray(data?.projects) ? data.projects.filter(Boolean) : [];
-      markers.push({ projects: [...new Set(projects)], dates: localAndUtcDates(new Date(ts)) });
+      // verified_scope (session-close-scope-boundary spec §3): the SAME
+      // collapse the writer runs (hooks/hypo-shared.mjs), not a hand-rolled
+      // copy — a shape this reader doesn't recognize, or a 'project'/'global'
+      // scope with an empty `projects`, reads back as "field absent" (`null`),
+      // never as a false claim.
+      const verifiedScope = normalizeVerifiedScope(data?.verified_scope);
+      markers.push({
+        projects: [...new Set(projects)],
+        dates: localAndUtcDates(new Date(ts)),
+        verifiedScope,
+      });
     } catch {
       // corrupt marker — not this check's job to clean up
     }

package/scripts/graph.mjs

@@ -22,12 +22,32 @@ import { collectPagesGraph, extractWikilinks } from './lib/wikilink.mjs';
 
 // ── arg parsing ───────────────────────────────────────────────────────────────
 
+const ALLOWED_FLAGS = ['--hypo-dir=<path>', '--format=<fmt>', '--min-edges=<n>'];
+
 function parseArgs(argv) {
   const args = { hypoDir: null, format: 'json', minEdges: 0 };
   for (const arg of argv.slice(2)) {
-    if (arg.startsWith('--hypo-dir=')) args.hypoDir = expandHome(arg.slice(11));
-    else if (arg.startsWith('--format=')) args.format = arg.slice(9);
+    if (arg.startsWith('--hypo-dir=')) {
+      // See lint.mjs's parseArgs for why an empty raw value (--hypo-dir=,
+      // or --hypo-dir="$VAULT" with VAULT unset) is rejected instead of
+      // falling through to the default-resolution branch below.
+      const raw = arg.slice(11);
+      if (!raw) {
+        console.error(`graph.mjs: --hypo-dir requires a non-empty value (got '${arg}')`);
+        console.error(`graph.mjs accepts: ${ALLOWED_FLAGS.join(', ')}`);
+        process.exit(2);
+      }
+      args.hypoDir = expandHome(raw);
+    } else if (arg.startsWith('--format=')) args.format = arg.slice(9);
     else if (arg.startsWith('--min-edges=')) args.minEdges = parseInt(arg.slice(12), 10) || 0;
+    else {
+      // No positional arguments here either, so an unmatched arg is rejected
+      // rather than dropped. See lint.mjs's parseArgs for the background
+      // this closes.
+      console.error(`graph.mjs: unrecognized argument '${arg}'`);
+      console.error(`graph.mjs accepts: ${ALLOWED_FLAGS.join(', ')}`);
+      process.exit(2);
+    }
   }
   if (!args.hypoDir) {
     const info = resolveHypoRootInfo();

package/scripts/init.mjs

@@ -173,7 +173,11 @@ Init options:
   --lint-strict          Opt-in: also gate the wiki pre-commit hook on
                          \`lint --strict\` (promotes STRICT_PROMOTE_IDS warnings
                          to a blocking error), sequenced after the .hypoignore
-                         guard. Off by default; re-run init to add or drop it.
+                         guard. Exception: root hot.md/log.md's own
+                         no-frontmatter warning stays a warn even under this
+                         flag, so a legacy vault predating the frontmatter
+                         convention still commits. Off by default; re-run init
+                         to add or drop it.
   --dry-run              Show what would be done without making changes
   --version              Print the installed package version and exit
   --help, -h             Show this help message

package/scripts/lib/crystallize-args.mjs

@@ -3,6 +3,22 @@ import { isValidProjectName } from './project-create.mjs';
 
 // ── arg parsing ──────────────────────────────────────────────────────────────
 
+const ALLOWED_FLAGS = [
+  '--hypo-dir=<path>',
+  '--min-group=<n>',
+  '--check-session-close',
+  '--apply-session-close',
+  '--mark-session-closed',
+  '--log-only',
+  '--session-id=<id>',
+  '--payload=<path|->',
+  '--transcript-path=<path>',
+  '--session-cwd=<path>',
+  '--project=<slug>',
+  '--force',
+  '--json',
+];
+
 export function parseArgs(argv) {
   const args = {
     hypoDir: null,
@@ -19,8 +35,20 @@ export function parseArgs(argv) {
     project: null,
   };
   for (const arg of argv.slice(2)) {
-    if (arg.startsWith('--hypo-dir=')) args.hypoDir = expandHome(arg.slice(11));
-    else if (arg.startsWith('--min-group=')) args.minGroup = parseInt(arg.slice(12), 10) || 2;
+    if (arg.startsWith('--hypo-dir=')) {
+      // See scripts/lint.mjs's parseArgs for why an empty raw value
+      // (--hypo-dir=, or --hypo-dir="$VAULT" with VAULT unset) is rejected
+      // instead of falling through to resolveHypoRoot() below. For this
+      // script specifically, a silent fallback here means a session-close
+      // apply writes to the wrong vault.
+      const raw = arg.slice(11);
+      if (!raw) {
+        console.error(`crystallize.mjs: --hypo-dir requires a non-empty value (got '${arg}')`);
+        console.error(`crystallize.mjs accepts: ${ALLOWED_FLAGS.join(', ')}`);
+        process.exit(2);
+      }
+      args.hypoDir = expandHome(raw);
+    } else if (arg.startsWith('--min-group=')) args.minGroup = parseInt(arg.slice(12), 10) || 2;
     else if (arg === '--check-session-close') args.checkSessionClose = true;
     else if (arg === '--apply-session-close') args.applySessionClose = true;
     else if (arg === '--mark-session-closed') args.markSessionClosed = true;
@@ -32,6 +60,14 @@ export function parseArgs(argv) {
     else if (arg.startsWith('--project=')) args.project = arg.slice(10);
     else if (arg === '--force') args.force = true;
     else if (arg === '--json') args.json = true;
+    else {
+      // No positional arguments here either, so an unmatched arg is rejected
+      // rather than dropped. See scripts/lint.mjs's parseArgs for the
+      // background this closes.
+      console.error(`crystallize.mjs: unrecognized argument '${arg}'`);
+      console.error(`crystallize.mjs accepts: ${ALLOWED_FLAGS.join(', ')}`);
+      process.exit(2);
+    }
   }
   if (!args.hypoDir) args.hypoDir = resolveHypoRoot();
   // --project=<slug> override (check/mark only). Validate the SYNTAX here so a