mainflow 0.43.0 → 0.44.0-alpha.2

package/dist/hooks.js

@@ -1,8 +1,9 @@
-import { I as configSchema, Y as parseRef, ft as describeRequest, rt as taskSchema, tt as repoPaths } from "./dist-D5rZ0MQH.js";
-import { C as turnReminder, Dt as hubFormatVersion, Et as formatMismatch, F as headerLine, Ft as inRepositoryHubAt, Gt as nodeStorage, Ht as resolveHub, I as mayDecorate, Jt as hubPath, Kt as currentBranch, Lt as notRegisteredMessage, M as matchGrants, N as decorateReply, O as loadSessions, P as endsWithMarker, Pt as hubHoldingFile, Q as HubError, Qt as DATA_DIR, S as sessionBriefing, Xt as worktreesOf, Yt as realPath, dt as readFrontMatter, et as loadHub, ft as readYaml, i as hostName, j as grantScope, k as readSession, lt as taskFile, qt as dataFile } from "./host-BJvqZy-i.js";
-import { n as hubWriter, r as writtenLines } from "./operation-BhBbGauo.js";
+import { I as configSchema, Y as parseRef, ft as describeRequest, rt as taskSchema, tt as repoPaths } from "./dist-CXrUfRQp.js";
+import { $ as isOpenMainline, $t as realPath, Bt as notRegisteredMessage, C as turnReminder, F as headerLine, Gt as resolveHub, I as mayDecorate, Jt as nodeStorage, Lt as hubHoldingFile, M as matchGrants, N as decorateReply, Nt as SESSIONS_DIR, O as loadSessions, Ot as formatMismatch, P as endsWithMarker, Q as HubError, Qt as hubPath, Rt as inRepositoryHubAt, S as sessionBriefing, Xt as dataFile, Yt as currentBranch, dt as taskFile, en as worktreesOf, i as hostName, j as grantScope, k as readSession, kt as hubFormatVersion, mt as readYaml, nn as DATA_DIR, nt as loadMainlines, pt as readFrontMatter, tt as loadHub } from "./host-C74j2Qox.js";
+import { n as hubWriter, r as writtenLines } from "./operation-CUeOFEaf.js";
 import { SCENARIO_LINES, SCENARIO_SKIP_KINDS } from "./facts.js";
 import { resolveFixed, scanCommand, scopedCwd } from "./grant-commands.js";
+import { createHash } from "node:crypto";
 import { appendFileSync, existsSync, readFileSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
 //#region src/hooks.ts
@@ -124,11 +125,11 @@ const displayReply = (dirs, { payload }) => {
 };
 /** Mainline ids a reply mentions, e.g. m001 in `m001/t003`; not inside a longer word or path. */
 const MAINLINE_MENTION = /(?<![\w/#.[-])(m\d{3})(?![\w\]])/g;
-/** The open mainlines the text mentions; loads the hub only when the text mentions one. */
+/** The open mainlines the text mentions; reads the mainlines' mainline.md only when the text mentions one. */
 function openMainlinesIn(dirs, text) {
 	const mentioned = new Set([...text.matchAll(MAINLINE_MENTION)].map((m) => m[1]));
 	if (mentioned.size === 0) return [];
-	return loadHub(dirs, { remotes: false }).mainlines.filter((m) => mentioned.has(m.id) && !m.archivedAt && (m.status === "active" || m.status === "planning")).map((m) => m.id);
+	return loadMainlines(dirs).filter((m) => mentioned.has(m.id) && isOpenMainline(m)).map((m) => m.id);
 }
 /** Tools whose `file_path` input writes a file. */
 const WRITE_TOOLS = /* @__PURE__ */ new Set([
@@ -219,6 +220,10 @@ const CLAUDE_CODE_EVENTS = {
 			id,
 			digest: null
 		});
+		if (session.checkReported?.length) await write("session.checked", {
+			id,
+			reported: null
+		});
 		if (envFile) appendFileSync(envFile, `export MAINFLOW_SESSION=${id}\n`);
 		startUi?.(dirs);
 		return sessionBriefing(dirs, session, {
@@ -423,10 +428,50 @@ function decideStartGate(dirs, { payload, cli, env }) {
 		permissionDecisionReason: `[mainflow] ${reason}`
 	} });
 }
-/** How many problems outside the written file the reminder lists before it only gives the count. */
-const OTHER_PROBLEMS_SHOWN = 5;
+/** How many problems the reminder lists when the session is unknown, before it only gives the count. */
+const UNSCOPED_PROBLEMS_SHOWN = 5;
 /** A problem as the reminder lists it, its file as the absolute path the model opens. */
 const problemLine = (dirs, p) => `- ${dataFile(dirs, p.file)}${p.field ? ` › ${p.field}` : ""}：${p.message}`;
+/** What a reported problem is remembered by: the same file, field and message is the same problem. */
+const problemKey = (p) => createHash("sha1").update(`${p.file}\0${p.field}\0${p.message}`).digest("hex").slice(0, 16);
+/** The mainlines the session's unfinished actions serve, as the ids their refs start with. */
+function servedMainlines(session) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const a of session.actions) {
+		if (a.status === "done" || a.status === "dropped") continue;
+		for (const ref of a.serves) {
+			const id = /^m\d+/.exec(ref)?.[0];
+			if (id) ids.add(id);
+		}
+	}
+	return ids;
+}
+/**
+* Whether a problem's file is the session's to fix: a mainline its unfinished actions serve, the session's own file,
+* or a file of the hub itself (issues, findings, groups, config.yaml and the like), which no mainline owns.
+*/
+function inSessionScope(file, session) {
+	const mainlines = `${DATA_DIR}/mainlines/`;
+	const sessions = `${DATA_DIR}/${SESSIONS_DIR}/`;
+	if (file.startsWith(mainlines)) return [...servedMainlines(session)].some((m) => file.startsWith(`${mainlines}${m}-`));
+	if (file.startsWith(sessions)) return file === `${sessions}${session.id}.yaml`;
+	return true;
+}
+/**
+* What a list of in-scope problems lies in, for the line that heads it: only the kinds it holds, so a problem of the
+* session's own file alone is not called one of a mainline or of the hub's own files.
+*/
+function scopeLabel(problems) {
+	const kindOf = (file) => file.startsWith(`.mainflow/mainlines/`) ? 0 : file.startsWith(`.mainflow/local/sessions/`) ? 2 : 1;
+	const kinds = new Set(problems.map((p) => kindOf(p.file)));
+	const parts = [
+		"目前行動服務的主脈絡",
+		"hub 層的檔",
+		"這場會話的會話檔"
+	].filter((_, i) => kinds.has(i));
+	const last = parts.at(-1) ?? "";
+	return parts.length > 1 ? `${parts.slice(0, -1).join("、")}與${/^[A-Za-z0-9]/.test(last) ? " " : ""}${last}` : last;
+}
 /**
 * After a tool writes into a hub's data directory, run the same checks as `mainflow check` and hand the problems
 * to the model in the same turn. Edit, Write and MultiEdit name the file; Bash only counts when its command mentions
@@ -434,8 +479,16 @@ const problemLine = (dirs, p) => `- ${dataFile(dirs, p.file)}${p.field ? ` › $
 * write elsewhere, adds nothing. The hub a written file belongs to is the registered hub whose data directory
 * holds it, found from the file itself rather than from the session's directory, because a session may write
 * into another registered hub.
+*
+* With the session known, only the problems of the written file, of the mainlines its unfinished actions serve, of the
+* hub's own files (everything outside `mainlines/` and `local/sessions/`) and of the session's own file are listed, the
+* rest counted in one line, and a problem handed over once is not handed over again while it is still there: other
+* sessions' mainlines and session files are theirs to fix, and the model still holds what an earlier write reported.
+* SessionStart forgets what was reported, since a resume, clear or compaction drops it. A subagent's write (the
+* payload has agent_id) is scoped by the main session's actions but neither skips nor records what was reported,
+* because the subagent has not seen what the main session was told.
 */
-function checkAfterWrite(dirs, { payload, cli, env }) {
+async function checkAfterWrite(dirs, { payload, cli, env, write }) {
 	const input = payload.tool_input ?? {};
 	let hub = dirs;
 	let written = null;
@@ -463,15 +516,50 @@ function checkAfterWrite(dirs, { payload, cli, env }) {
 			message: error.message
 		}];
 	}
-	if (problems.length === 0) return null;
-	const own = written ? problems.filter((p) => p.file === written) : [];
-	const others = problems.filter((p) => !own.includes(p));
+	const sessionId = payload.session_id ? claudeCodeSessionId(payload.session_id) : null;
+	let session = null;
+	try {
+		session = sessionId ? readSession(hub, sessionId) : null;
+	} catch {}
 	const line = (p) => problemLine(hub, p);
+	const own = written ? problems.filter((p) => p.file === written) : [];
+	if (!session) {
+		if (problems.length === 0) return null;
+		const others = problems.filter((p) => !own.includes(p));
+		const lines = [
+			written && own.length ? `[mainflow] 剛寫入的 ${dataFile(hub, written)} 有 ${own.length} 個問題，改好再繼續：` : `[mainflow] 寫入 hub 的資料目錄 ${hub.data} 後，check 找到 ${problems.length} 個問題：`,
+			...own.map(line),
+			...others.length ? [...own.length ? [`其他檔案還有 ${others.length} 個問題：`] : [], ...others.slice(0, UNSCOPED_PROBLEMS_SHOWN).map(line)] : [],
+			...others.length > UNSCOPED_PROBLEMS_SHOWN ? [`還有 ${others.length - UNSCOPED_PROBLEMS_SHOWN} 個沒列出，跑 ${cli} check 看全部。`] : []
+		];
+		return JSON.stringify({ hookSpecificOutput: {
+			hookEventName: "PostToolUse",
+			additionalContext: lines.join("\n")
+		} });
+	}
+	const ofScope = problems.filter((p) => !own.includes(p) && inSessionScope(p.file, session));
+	const relevant = [...own, ...ofScope];
+	const subagent = Boolean(payload.agent_id);
+	const reported = new Set(subagent ? [] : session.checkReported ?? []);
+	const fresh = (list) => list.filter((p) => !reported.has(problemKey(p)));
+	const newOwn = fresh(own);
+	const newScope = fresh(ofScope);
+	if (!subagent) {
+		const present = new Set(problems.map(problemKey));
+		const keys = [.../* @__PURE__ */ new Set([...[...reported].filter((k) => present.has(k)), ...[...newOwn, ...newScope].map(problemKey)])].sort();
+		if (keys.length !== reported.size || keys.some((k) => !reported.has(k))) await write("session.checked", {
+			id: session.id,
+			reported: keys.length ? keys : null
+		}).catch(() => void 0);
+	}
+	if (newOwn.length + newScope.length === 0) return null;
+	const elsewhere = problems.length - relevant.length;
 	const lines = [
-		written && own.length ? `[mainflow] 剛寫入的 ${dataFile(hub, written)} 有 ${own.length} 個問題，改好再繼續：` : `[mainflow] 寫入 hub 的資料目錄 ${hub.data} 後，check 找到 ${problems.length} 個問題：`,
-		...own.map(line),
-		...others.length ? [...own.length ? [`其他檔案還有 ${others.length} 個問題：`] : [], ...others.slice(0, OTHER_PROBLEMS_SHOWN).map(line)] : [],
-		...others.length > OTHER_PROBLEMS_SHOWN ? [`還有 ${others.length - OTHER_PROBLEMS_SHOWN} 個沒列出，跑 ${cli} check 看全部。`] : []
+		newOwn.length ? `[mainflow] 剛寫入的 ${dataFile(hub, written)} 有 ${newOwn.length} 個問題，改好再繼續：` : `[mainflow] 寫入 hub 的資料目錄 ${hub.data} 後，${scopeLabel(newScope)}有 ${newScope.length} 個問題：`,
+		...newOwn.map(line),
+		...newOwn.length && newScope.length ? [`${scopeLabel(newScope)}還有 ${newScope.length} 個問題：`] : [],
+		...newScope.map(line),
+		...elsewhere > 0 ? [`其他還有 ${elsewhere} 條，屬於別的主脈絡或別的會話的會話檔，跑 ${cli} check 看全部。`] : []
 	];
 	return JSON.stringify({ hookSpecificOutput: {
 		hookEventName: "PostToolUse",

package/dist/{host-BJvqZy-i.js → host-C74j2Qox.js}

@@ -1,4 +1,4 @@
-import { $ as removedUntil, A as SURVEY_LINES, B as groupSchema, C as PRIORITIES, D as SESSION_ID, E as SERVES_REF, F as WORK_STATUS, G as mainlineSchema, H as isMainflowRange, I as configSchema, J as parseOpsLine, K as opsEntrySchema, L as decisionSchema, M as TASK_REQUIRED_SECTIONS, N as TASK_SECTIONS, O as SESSION_STATUS, P as UNTIL_FORMS, Q as refMainline, R as findingSchema, S as MERGE_STATES, T as RESERVED_HUB_NAMES, U as issueSchema, V as hubRegistrySchema, W as listedRepos, X as parseUntil, Y as parseRef, Z as refExample, a as DECISION_SECTIONS, at as waitingForAction, b as MAINLINE_SECTIONS, c as FINDING_SECTIONS, ct as stampMs, d as GROUP_SECTIONS, et as repoPath, f as GROUP_STATUS, ft as describeRequest, g as ISSUE_SECTIONS, gt as parseGrantTarget, ht as grantRepo, i as DECISION_BASES, j as SURVEY_SECTION, k as SLUG, l as FINDING_STATUS, m as HUB_NAME, mt as grantForm, n as CLOSED_STATUS, nt as sessionSchema, ot as waitingForRef, pt as grantCovers, q as parseActionRef, r as DECIDERS, rt as taskSchema, s as DEFAULT_CATEGORIES, st as OFFSET, w as REF_EXAMPLES, x as MAINLINE_STATUS, y as MAINFLOW_RANGE, z as formatOpsEntry } from "./dist-D5rZ0MQH.js";
+import { $ as removedUntil, A as SURVEY_LINES, B as groupSchema, C as PRIORITIES, D as SESSION_ID, E as SERVES_REF, F as WORK_STATUS, G as mainlineSchema, H as isMainflowRange, I as configSchema, J as parseOpsLine, K as opsEntrySchema, L as decisionSchema, M as TASK_REQUIRED_SECTIONS, N as TASK_SECTIONS, O as SESSION_STATUS, P as UNTIL_FORMS, Q as refMainline, R as findingSchema, S as MERGE_STATES, T as RESERVED_HUB_NAMES, U as issueSchema, V as hubRegistrySchema, W as listedRepos, X as parseUntil, Y as parseRef, Z as refExample, _t as parseGrantTarget, a as DECISION_SECTIONS, at as waitingForAction, b as MAINLINE_SECTIONS, c as FINDING_SECTIONS, ct as stampMs, d as GROUP_SECTIONS, et as repoPath, f as GROUP_STATUS, ft as describeRequest, g as ISSUE_SECTIONS, ht as grantRepo, i as DECISION_BASES, j as SURVEY_SECTION, k as SLUG, l as FINDING_STATUS, m as HUB_NAME, mt as grantForm, n as CLOSED_STATUS, nt as sessionSchema, ot as waitingForRef, pt as grantCovers, q as parseActionRef, r as DECIDERS, rt as taskSchema, s as DEFAULT_CATEGORIES, st as OFFSET, vt as pathInPatterns, w as REF_EXAMPLES, x as MAINLINE_STATUS, y as MAINFLOW_RANGE, z as formatOpsEntry } from "./dist-CXrUfRQp.js";
 import { a as LABEL_ROLES, i as FINDING_SEVERITIES, n as FINDING_CLASSES, r as FINDING_FIELDS, t as FINDINGS_FENCE } from "./retro-formats-ECy0gGOL.js";
 import { createHash } from "node:crypto";
 import { appendFileSync, closeSync, cpSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, symlinkSync, writeFileSync, writeSync } from "node:fs";
@@ -1566,10 +1566,15 @@ function mainlineOf(ref) {
 	const m = parsed ? refMainline(parsed) : void 0;
 	return m && (parsed.hub ? `${parsed.hub}:${m}` : m);
 }
-/** Dependencies lifted to mainlines, for a map of how mainlines wait for one another. */
+/**
+* The order mainlines are pushed forward in, for a map of how mainlines wait for one another. Only a mainline's
+* own `depends-on` counts: a task waiting on another mainline's task is a detail of that task, and lifting it
+* would bury the order under every file two tasks happen to share. The target may still be a task or criterion.
+*/
 function mainlineEdges(graph) {
 	const out = /* @__PURE__ */ new Map();
 	for (const e of graph.edges) {
+		if (parseRef(e.from)?.kind !== "mainline") continue;
 		const from = mainlineOf(e.from);
 		const to = mainlineOf(e.to);
 		if (!from || !to || from === to) continue;
@@ -1753,6 +1758,30 @@ function loadConfig(dirs) {
 	if (mismatch) throw new HubError(mismatch, []);
 	return config;
 }
+/**
+* The mainlines loadHub lists, in the same order, with only what each mainline.md's front matter holds: no tasks,
+* decisions, artifacts or checks. For the callers that only need ids, titles and statuses, such as the hooks that run
+* on every turn, since loadHub reads and parses every document of the hub. Like loadHub it throws when config.yaml
+* cannot be used, and it leaves out a mainline whose mainline.md is missing, has front matter that does not parse, or
+* does not fit the schema. Every call reads the files again, so a status written in between is what it returns.
+*/
+function loadMainlines(dirs) {
+	loadConfig(dirs);
+	return subdirs$1(join(dirs.data, "mainlines")).flatMap((dir) => {
+		const text = readText$1(join(dir, MAINLINE_FILE));
+		if (text === null) return [];
+		let data;
+		try {
+			data = splitFrontMatter(text).data;
+		} catch {
+			return [];
+		}
+		const result = mainlineSchema.safeParse(data);
+		return result.success ? [result.data] : [];
+	});
+}
+/** Whether a session could be pushing the mainline forward: it is active or planning, and not archived. */
+const isOpenMainline = (m) => !m.archivedAt && (m.status === "active" || m.status === "planning");
 function loadHub(dirs, options = {}) {
 	const problems = [];
 	const warnings = [];
@@ -1877,6 +1906,14 @@ function loadHub(dirs, options = {}) {
 		const taskIds = new Set(tasks.map((t) => t.id));
 		const criterionIds = new Set(mainline.criteria.map((c) => c.id));
 		const itemRefs = new Set(tasks.flatMap((t) => t.checklist.map((c) => `${mainline.id}/${t.id}#${c.id}`)));
+		mainline.grants?.forEach((grant, i) => {
+			const task = grant.scope?.task;
+			if (task && !taskIds.has(task) && !unreadable.has(`${mainline.id}/${task}`)) problems.push({
+				file: mainline.file,
+				field: `grants.${i}.scope.task`,
+				message: `task ${mainline.id}/${task} does not exist; a grant's scope.task names a task of its own mainline`
+			});
+		});
 		for (const task of tasks) {
 			if (task.parent && !taskIds.has(task.parent)) problems.push({
 				file: task.file,
@@ -1944,7 +1981,16 @@ function loadHub(dirs, options = {}) {
 	const findings = hubDocs(join(dataDir, "findings"), findingSchema);
 	const groups = hubDocs(join(dataDir, "groups"), groupSchema);
 	problems.push(...groupProblems(config.hub, groups, mainlines, hubIssues, unreadable));
-	for (const g of groups) problems.push(...grantProblems(g, config), ...listGaps(g.file, "criteria", g.criteria ?? [], g.status === "open"));
+	for (const g of groups) {
+		problems.push(...grantProblems(g, config), ...listGaps(g.file, "criteria", g.criteria ?? [], g.status === "open"));
+		g.grants?.forEach((grant, i) => {
+			if (grant.scope?.task) problems.push({
+				file: g.file,
+				field: `grants.${i}.scope.task`,
+				message: `a group has no tasks, so ${g.id}#${grant.id} would never apply; limit it with session or paths, or move it to the mainline that holds ${grant.scope.task}`
+			});
+		});
+	}
 	const ops = [];
 	const opsPath = join(dataDir, "ops");
 	for (const name of existsSync(opsPath) ? readdirSync(opsPath).filter((n) => n.endsWith(".log")).sort() : []) readFileSync(join(opsPath, name), "utf8").split("\n").forEach((line, index) => {
@@ -3462,7 +3508,7 @@ function setSessionInfo(hub, input) {
 		for (const [key, value] of Object.entries(input.info)) if (value !== void 0 && value !== null && value !== "") s[key] = value;
 	}));
 }
-/** Remember the digest of what the last turn reminder listed in full; null forgets it, so the next reminder lists everything again. */
+/** Remember the digest of the whole turn reminder last sent; null forgets it, so the next reminder is sent again. */
 function setReminderDigest$1(hub, input) {
 	const draft = new Draft(hub);
 	return draft.result(editYaml(draft, requireSession(draft, input.id), sessionSchema, (s) => {
@@ -3470,6 +3516,14 @@ function setReminderDigest$1(hub, input) {
 		else s.reminderDigest = input.digest;
 	}));
 }
+/** Remember the digests of the check problems last handed over after a write; null or an empty list forgets them, so every problem is reported again. */
+function setCheckReported(hub, input) {
+	const draft = new Draft(hub);
+	return draft.result(editYaml(draft, requireSession(draft, input.id), sessionSchema, (s) => {
+		if (!input.reported?.length) delete s.checkReported;
+		else s.checkReported = input.reported;
+	}));
+}
 function setSessionStatus(hub, input) {
 	const value = requireOneOf(input.status, SESSION_STATUS, "session status");
 	const draft = new Draft(hub);
@@ -3919,6 +3973,7 @@ const OPERATIONS = {
 	"session.handoff": handoffSession,
 	"session.info": setSessionInfo,
 	"session.reminder": setReminderDigest$1,
+	"session.checked": setCheckReported,
 	"session.set": setSessionStatus,
 	"session.settle": settleSession,
 	"session.archive": setSessionArchived,
@@ -4506,7 +4561,7 @@ function grantScope(dirs, session) {
 		ok: false,
 		reason: `${action.id} 沒有服務任何 checklist 項目或解決條件`
 	};
-	const grants = [];
+	const all = [];
 	const served = {};
 	const closed = [];
 	const hubName = readConfig(dirs).hub;
@@ -4519,7 +4574,7 @@ function grantScope(dirs, session) {
 			continue;
 		}
 		served[id] = action.serves.find((ref) => mainlineOf(ref) === id);
-		for (const grant of mainline.grants ?? []) grants.push({
+		for (const grant of mainline.grants ?? []) all.push({
 			owner: id,
 			grant,
 			ref: `${id}#${grant.id}`
@@ -4543,7 +4598,7 @@ function grantScope(dirs, session) {
 			continue;
 		}
 		served[id] = via;
-		for (const grant of group.grants ?? []) grants.push({
+		for (const grant of group.grants ?? []) all.push({
 			owner: id,
 			grant,
 			ref: `${id}#${grant.id}`
@@ -4556,27 +4611,74 @@ function grantScope(dirs, session) {
 			reason: `${action.id} 服務的${what}已不在進行中（${closed.join("、")}），授權不再生效`
 		};
 	}
+	const grants = [];
+	const outOfScope = [];
+	for (const g of all) {
+		const why = limitMiss(g, session.id, action);
+		if (why) outOfScope.push({
+			grant: g,
+			why
+		});
+		else grants.push(g);
+	}
 	return {
 		ok: true,
 		scope: {
 			action,
 			grants,
-			served
+			outOfScope,
+			served,
+			root: realPath(dirs.root) ?? dirs.root
 		}
 	};
 }
-/** Every request must be covered by some grant in scope; the first one that is not is named in the reason. */
+/** Why a grant's scope leaves out this session or action, or null when its task and session hold. */
+function limitMiss({ owner, grant }, sessionId, action) {
+	const limits = grant.scope;
+	if (!limits) return null;
+	if (limits.session !== void 0 && limits.session !== sessionId) return `限定會話 ${limits.session}，這次是 ${sessionId}`;
+	if (limits.task !== void 0) {
+		if (!action.serves.some((ref) => {
+			const parsed = parseRef(ref);
+			return parsed?.kind === "checklistItem" && parsed.mainline === owner && parsed.task === limits.task;
+		})) return `限定行動服務 ${owner}/${limits.task} 的項目，${action.id} 沒有服務它`;
+	}
+	return null;
+}
+/** Why a grant's paths leave out the request's directory, or null when it has none or the directory lies in them. */
+function pathsMiss(grant, request, root) {
+	const paths = grant.scope?.paths;
+	if (!paths) return null;
+	if (request.dir === void 0) return `限定路徑 ${paths.join("、")}，這次沒有可比對的目錄`;
+	const rel = relative(root, request.dir).split(sep).join("/");
+	return pathInPatterns(paths, rel) ? null : `限定路徑 ${paths.join("、")}，這次的目錄是 ${request.dir}`;
+}
+/**
+* Every request must be covered by some grant in scope whose paths, if it has any, hold the request's directory; the
+* first request that is not covered is named in the reason, with the grants whose scope left it out.
+*/
 function matchGrants(scope, requests) {
 	const matches = [];
+	const covers = (g, request) => {
+		const parsed = parseGrantTarget(g.grant.action, g.grant.target);
+		return parsed.ok && grantCovers(parsed.target, request);
+	};
 	for (const request of requests) {
+		const misses = [];
 		const grant = scope.grants.find((g) => {
-			const parsed = parseGrantTarget(g.grant.action, g.grant.target);
-			return parsed.ok && grantCovers(parsed.target, request);
+			if (!covers(g, request)) return false;
+			const why = pathsMiss(g.grant, request, scope.root);
+			if (why) misses.push(`${g.ref} ${why}`);
+			return why === null;
 		});
-		if (!grant) return {
-			ok: false,
-			reason: `${Object.keys(scope.served).join("、")} 沒有涵蓋 ${describeRequest(request)} 的授權`
-		};
+		if (!grant) {
+			const owners = Object.keys(scope.served).join("、");
+			misses.push(...scope.outOfScope.filter((o) => covers(o.grant, request)).map((o) => `${o.grant.ref} ${o.why}`));
+			return {
+				ok: false,
+				reason: `${owners} 沒有涵蓋 ${describeRequest(request)} 的授權${misses.length ? `（${misses.join("；")}）` : ""}`
+			};
+		}
 		matches.push({
 			request,
 			grant
@@ -4599,7 +4701,13 @@ function grantLines(dirs, session) {
 		return result.scope.grants.map((g) => {
 			const parsed = parseGrantTarget(g.grant.action, g.grant.target);
 			const form = parsed.ok ? grantForm(parsed.target) : void 0;
-			return `- ${g.ref} ${g.grant.action} ${g.grant.target}${form ? `：${form}` : ""}`;
+			const limits = g.grant.scope;
+			const limited = limits ? [
+				limits.task && `任務 ${g.owner}/${limits.task}`,
+				limits.session && `會話 ${limits.session}`,
+				limits.paths && `路徑 ${limits.paths.join("、")}`
+			].filter(Boolean).join("、") : "";
+			return `- ${g.ref} ${g.grant.action} ${g.grant.target}${limited ? `（限${limited}）` : ""}${form ? `：${form}` : ""}`;
 		});
 	} catch {
 		return [];
@@ -4625,7 +4733,7 @@ function resolveAction(dirs, ref) {
 function transcriptPath(dirs, transcript) {
 	return isAbsolute(transcript) ? transcript : join(dirs.root, transcript);
 }
-/** Remember the digest of what the last turn reminder listed in full; null forgets it, so the next reminder lists everything again. */
+/** Remember the digest of the whole turn reminder last sent; null forgets it, so the next reminder is sent again. */
 function setReminderDigest(dirs, id, digest) {
 	runOp(dirs, (hub) => setReminderDigest$1(hub, {
 		id,
@@ -4878,8 +4986,8 @@ function waitingLine(a) {
 	] : [];
 	return `${a.id} ${a.do}${parts.length > 0 ? `（${parts.join("；")}）` : ""}`;
 }
-/** Mainlines a session could be pushing forward. */
-const openMainlines = (dirs) => loadHub(dirs).mainlines.filter((m) => !m.archivedAt && (m.status === "active" || m.status === "planning"));
+/** Mainlines a session could be pushing forward; only their mainline.md is read, as the turn hooks need nothing else. */
+const openMainlines = (dirs) => loadMainlines(dirs).filter(isOpenMainline);
 /** How recently a session's transcript must have been written for the session to count as possibly still running. */
 const RUNNING_WINDOW_MS = 9e5;
 /** Whether the session's transcript was written within the running window; false when no transcript is recorded or readable. */
@@ -5025,7 +5133,7 @@ function sessionBriefing(dirs, session, options) {
 	}
 	lines.push(...waiterLines(dirs, session));
 	const overlaps = overlapLines(dirs, session);
-	if (overlaps.length > 0) lines.push("目前行動服務的主脈絡和其他進行中的主脈絡預計動到同樣的路徑，開始改之前先和對方協調，或加 depends-on：", ...overlaps);
+	if (overlaps.length > 0) lines.push("目前行動服務的主脈絡和其他進行中的主脈絡預計動到同樣的路徑，開始改之前先和對方協調先後：", ...overlaps);
 	if (!session.actions.some(isOpen)) lines.push(...handoffLines(dirs, session, cli));
 	const warnings = queueWarnings(dirs, session, cli);
 	if (warnings.length > 0) lines.push("需要處理：", ...warnings.map((w) => `- ${w}`));
@@ -5034,36 +5142,33 @@ function sessionBriefing(dirs, session, options) {
 	return lines.join("\n");
 }
 /**
-* One or two lines for every user turn; null when the session has no actions and the hub has no open mainline.
-* Records a digest of the grants, waits and warnings it lists in the session file, only when the digest changes;
+* The reminder for every user turn; null when there is nothing to say, or when it would be the same text as the
+* reminder the model was last given. Records a digest of the whole text in the session file, only when it changes;
 * `saveDigest` records it instead of writing the file here, as a host hook in remote mode sends it to the sync server.
 */
 function turnReminder(dirs, session, options) {
-	if (session.actions.length === 0) return openMainlines(dirs).length > 0 ? `[mainflow] ${session.id} 還沒有行動。這一輪要推進主脈絡時，先用 ${options.cli} action add 列出行動並標為 doing，或用 ${options.cli} session handoff <會話> 接手上一場沒做完的行動，再開始做。回覆結尾的標頭只看這場會話進行中的行動。` : null;
+	const text = reminderText(dirs, session, options.cli);
+	if (text === null) return null;
+	const digest = contentHash(text);
+	if (session.reminderDigest === digest) return null;
+	if (readSession(dirs, session.id)) try {
+		if (options.saveDigest) options.saveDigest(digest);
+		else setReminderDigest(dirs, session.id, digest);
+	} catch {}
+	return text;
+}
+function reminderText(dirs, session, cli) {
+	if (session.actions.length === 0) return openMainlines(dirs).length > 0 ? `[mainflow] ${session.id} 還沒有行動。這一輪要推進主脈絡時，先用 ${cli} action add 列出行動並標為 doing，或用 ${cli} session handoff <會話> 接手上一場沒做完的行動，再開始做。回覆結尾的標頭只看這場會話進行中的行動。` : null;
 	const doing = current(session);
 	const open = session.actions.filter(isOpen);
 	const blocked = session.actions.filter((a) => a.status === "blocked");
-	const head = doing ? `[mainflow] 目前行動 ${doing.id} ${doing.do}，服務 ${doing.serves.join("、") || "（未指定）"}。這一輪的工作若不屬於它，先調整佇列再做。` : open.length > 0 ? `[mainflow] ${session.id} 目前沒有進行中的行動。` : blocked.length > 0 ? `[mainflow] ${session.id} 的行動在等外部條件：${blocked.map(waitingLine).join("；")}。有條件（until）的可以在背景執行 ${options.cli} wait <a編號> 等它成立。條件出現後用 ${options.cli} action set <a編號> --status doing 繼續；要先做別的事，用 ${options.cli} action add 列出行動。` : `[mainflow] ${session.id} 的行動都已結束。繼續工作前先用 ${options.cli} action add 列出下一個行動。`;
+	const head = doing ? `[mainflow] 目前行動 ${doing.id} ${doing.do}，服務 ${doing.serves.join("、") || "（未指定）"}。這一輪的工作若不屬於它，先調整佇列再做。` : open.length > 0 ? `[mainflow] ${session.id} 目前沒有進行中的行動。` : blocked.length > 0 ? `[mainflow] ${session.id} 的行動在等外部條件：${blocked.map(waitingLine).join("；")}。有條件（until）的可以在背景執行 ${cli} wait <a編號> 等它成立。條件出現後用 ${cli} action set <a編號> --status doing 繼續；要先做別的事，用 ${cli} action add 列出行動。` : `[mainflow] ${session.id} 的行動都已結束。繼續工作前先用 ${cli} action add 列出下一個行動。`;
 	const header = headerLine(session);
 	const marker = header ? [`- 這一輪最後一則回覆的最後一行寫「${header}」，回覆範例等其他內容都放在它前面。有顯示 hook 時，它會換成標題與連結。`] : [];
 	const grants = grantLines(dirs, session);
-	const waiters = waiterLines(dirs, session);
-	const warnings = queueWarnings(dirs, session, options.cli);
-	const digest = contentHash(JSON.stringify([
-		doing?.id ?? null,
-		grants,
-		waiters,
-		warnings
-	]));
-	const repeated = session.reminderDigest === digest;
-	if (!repeated && (session.reminderDigest !== void 0 || grants.length + waiters.length + warnings.length > 0) && readSession(dirs, session.id)) try {
-		if (options.saveDigest) options.saveDigest(digest);
-		else setReminderDigest(dirs, session.id, digest);
-	} catch {}
-	const once = (lines, summary, full) => lines.length === 0 ? [] : repeated ? [summary] : full;
-	const granted = once(grants, `- 預先授權同上一輪，共 ${grants.length} 條。`, ["- 目前行動服務的主脈絡與所屬的組預先授權了這些動作：", ...grants.map((g) => `  ${g}`)]);
-	const waiting = once(waiters, `- 等待行同上一輪，共 ${waiters.length} 條。`, waiters.map((w) => `- ${w}`));
-	const warned = once(warnings, `- 佇列提醒同上一輪，共 ${warnings.length} 條。`, warnings.map((w) => `- ${w}`));
+	const granted = grants.length > 0 ? ["- 目前行動服務的主脈絡與所屬的組預先授權了這些動作：", ...grants.map((g) => `  ${g}`)] : [];
+	const waiting = waiterLines(dirs, session).map((w) => `- ${w}`);
+	const warned = queueWarnings(dirs, session, cli).map((w) => `- ${w}`);
 	return [
 		head,
 		...waiting,
@@ -8404,6 +8509,7 @@ function resolveTurns(session, t) {
 	};
 	const first = t.turns.findIndex((x) => x.head !== void 0);
 	const out = [];
+	let latest;
 	t.turns.forEach((turn, i) => {
 		const span = {
 			from: turn.at,
@@ -8421,39 +8527,50 @@ function resolveTurns(session, t) {
 			});
 			return;
 		}
-		const head = turn.head;
-		if (head && "action" in head) {
+		if (turn.head) latest = turn.head;
+		const head = latest;
+		const started = turn.started.find((id) => byId.has(id));
+		const next = turn.handoff ? nextNamed(i) : void 0;
+		const call = turn.head || turn.reportsOn === void 0 ? void 0 : t.agentCalls.get(turn.reportsOn);
+		const spawner = call === void 0 ? void 0 : [...out].reverse().find((r) => r.from <= call);
+		const switchedFrom = (mainline) => mainline !== null && turn.started.some((id) => {
+			const a = byId.get(id);
+			return a !== void 0 && primaryMainline(a.serves) !== mainline;
+		});
+		if (spawner && ("action" in head || !(started || next))) {
+			out.push({
+				...span,
+				mainline: spawner.mainline,
+				source: "report",
+				shared: spawner.shared,
+				switched: switchedFrom(spawner.mainline)
+			});
+			return;
+		}
+		if ("action" in head) {
 			serves = servesOf(head);
-			source = "head";
-		} else if (head) {
-			const started = turn.started.find((id) => byId.has(id));
-			const next = turn.handoff ? nextNamed(i) : void 0;
+			source = turn.head ? "head" : "previous";
+		} else if (turn.head || started || next) {
 			serves = started ? byId.get(started).serves : next ? servesOf(next) : void 0;
 			source = started ? "started" : next ? "handoff" : "none";
 		} else {
-			const call = turn.reportsOn ? t.agentCalls.get(turn.reportsOn) : void 0;
-			const spawner = call === void 0 ? void 0 : [...out].reverse().find((r) => r.from <= call);
-			const from = spawner ?? out.at(-1);
+			const from = out.at(-1);
 			out.push({
 				...span,
 				mainline: from.mainline,
-				source: spawner ? "report" : "previous",
+				source: "previous",
 				shared: from.shared,
 				switched: false
 			});
 			return;
 		}
 		const mainline = serves ? primaryMainline(serves) ?? null : null;
-		const switched = mainline !== null && turn.started.some((id) => {
-			const a = byId.get(id);
-			return a !== void 0 && primaryMainline(a.serves) !== mainline;
-		});
 		out.push({
 			...span,
 			mainline,
 			source,
 			shared: serves !== void 0 && mainlinesOf(serves).length > 1,
-			switched
+			switched: switchedFrom(mainline)
 		});
 	});
 	return out;
@@ -9482,4 +9599,4 @@ function openInApp(hub, target, closeAfterMs = 150) {
 	return true;
 }
 //#endregion
-export { loadConfig as $, WriteError as $t, transcriptPath as A, MAINLINE_FILE as At, applyOffline as B, registeredName as Bt, turnReminder as C, readsAsText as Ct, readNotices as D, hubFormatVersion as Dt, parseWarn as E, formatMismatch as Et, headerLine as F, inRepositoryHubAt as Ft, scopeOfPath as G, nodeStorage as Gt, renumberFiles as H, resolveHub as Ht, mayDecorate as I, listHubs as It, syncedDir as J, hubPath as Jt, hubDigest as K, currentBranch as Kt, attributeTrace as L, notRegisteredMessage as Lt, matchGrants as M, requireSlug as Mt, decorateReply as N, hubAtRoot as Nt, loadSessions as O, hubRequirements as Ot, endsWithMarker as P, hubHoldingFile as Pt, HubError as Q, DATA_DIR as Qt, traceTranscript as R, readRegistry as Rt, sessionBriefing as S, exceedsFileLimit as St, markNoticesHandled as T, textBytes as Tt, renumberPath as U, unregisterHub as Ut, renumberRequest as V, registryFile as Vt, renumberText as W, userDataDir as Wt, applyOperation as X, worktreesOf as Xt, syncedPath as Y, realPath as Yt, checkHubName as Z, ConflictError as Zt, ARCHIVE_KINDS as _, MAX_FILE_BYTES as _t, openInApp as a, memberOfGroup as at, untilState as b, VERSION_HEADER as bt, siteBlock as c, unavailableHubs as ct, migrateHubData as d, readFrontMatter as dt, contentHash as en, loadHub as et, migrateHub as f, readYaml as ft, RETRY_RULES as g, MAX_CHANGE_PAGE as gt, receiverFromEnv as h, MAX_BLOB_BYTES as ht, hostName as i, linksInto as it, grantScope as j, TASK_FILE as jt, readSession as k, versionMismatch as kt, syncHost as l, taskFile as lt, retroReportFromReceiver as m, BLOB_HASH as mt, DEFAULT_UI_PORT as n, dependencyGraph as nt, removeDanglingLinks as o, refIndex as ot, retroReport as p, ACCESS_HEADERS as pt, mayHoldSynced as q, dataFile as qt, caddySites as r, mainlineEdges as rt, removeHostLink as s, remoteMembers as st, APP_BUNDLE_ID as t, splitFrontMatter as tn, sectionText as tt, groupPlan as u, nowMinute as ut, setArchivedMany as v, ROUTES as vt, HANDLED_FILE as w, requestTime as wt, duplicateClaimLines as x, comparePaths as xt, initHub as y, SOCKET_MAX_AGE_CLOSE as yt, transcriptTitle as z, registerHub as zt };
+export { isOpenMainline as $, realPath as $t, transcriptPath as A, hubRequirements as At, applyOffline as B, notRegisteredMessage as Bt, turnReminder as C, comparePaths as Ct, readNotices as D, textBytes as Dt, parseWarn as E, requestTime as Et, headerLine as F, requireSlug as Ft, scopeOfPath as G, resolveHub as Gt, renumberFiles as H, registerHub as Ht, mayDecorate as I, hubAtRoot as It, syncedDir as J, nodeStorage as Jt, hubDigest as K, unregisterHub as Kt, attributeTrace as L, hubHoldingFile as Lt, matchGrants as M, MAINLINE_FILE as Mt, decorateReply as N, SESSIONS_DIR as Nt, loadSessions as O, formatMismatch as Ot, endsWithMarker as P, TASK_FILE as Pt, HubError as Q, hubPath as Qt, traceTranscript as R, inRepositoryHubAt as Rt, sessionBriefing as S, VERSION_HEADER as St, markNoticesHandled as T, readsAsText as Tt, renumberPath as U, registeredName as Ut, renumberRequest as V, readRegistry as Vt, renumberText as W, registryFile as Wt, applyOperation as X, dataFile as Xt, syncedPath as Y, currentBranch as Yt, checkHubName as Z, gitCheckout as Zt, ARCHIVE_KINDS as _, MAX_BLOB_BYTES as _t, openInApp as a, splitFrontMatter as an, mainlineEdges as at, untilState as b, ROUTES as bt, siteBlock as c, refIndex as ct, migrateHubData as d, taskFile as dt, worktreesOf as en, loadConfig as et, migrateHub as f, nowMinute as ft, RETRY_RULES as g, BLOB_HASH as gt, receiverFromEnv as h, ACCESS_HEADERS as ht, hostName as i, contentHash as in, dependencyGraph as it, grantScope as j, versionMismatch as jt, readSession as k, hubFormatVersion as kt, syncHost as l, remoteMembers as lt, retroReportFromReceiver as m, readYaml as mt, DEFAULT_UI_PORT as n, DATA_DIR as nn, loadMainlines as nt, removeDanglingLinks as o, linksInto as ot, retroReport as p, readFrontMatter as pt, mayHoldSynced as q, userDataDir as qt, caddySites as r, WriteError as rn, sectionText as rt, removeHostLink as s, memberOfGroup as st, APP_BUNDLE_ID as t, ConflictError as tn, loadHub as tt, groupPlan as u, unavailableHubs as ut, setArchivedMany as v, MAX_CHANGE_PAGE as vt, HANDLED_FILE as w, exceedsFileLimit as wt, duplicateClaimLines as x, SOCKET_MAX_AGE_CLOSE as xt, initHub as y, MAX_FILE_BYTES as yt, transcriptTitle as z, listHubs as zt };

package/dist/host.d.ts

@@ -1,4 +1,4 @@
-import { o as HubDirs } from "./index-DRpamPge.js";
+import { o as HubDirs } from "./index-jq7lN8V8.js";
 //#region src/host.d.ts
 export declare const DEFAULT_UI_PORT = 4320;
 export declare const hostName: (hub: string) => string;

package/dist/host.js

@@ -1,2 +1,2 @@
-import { a as openInApp, c as siteBlock, i as hostName, l as syncHost, n as DEFAULT_UI_PORT, o as removeDanglingLinks, r as caddySites, s as removeHostLink, t as APP_BUNDLE_ID } from "./host-BJvqZy-i.js";
+import { a as openInApp, c as siteBlock, i as hostName, l as syncHost, n as DEFAULT_UI_PORT, o as removeDanglingLinks, r as caddySites, s as removeHostLink, t as APP_BUNDLE_ID } from "./host-C74j2Qox.js";
 export { APP_BUNDLE_ID, DEFAULT_UI_PORT, caddySites, hostName, openInApp, removeDanglingLinks, removeHostLink, siteBlock, syncHost };

package/dist/{index-DRpamPge.d.ts → index-jq7lN8V8.d.ts}

@@ -1,4 +1,4 @@
-import { _ as Task, a as Decision, c as Group, d as Mainline, f as OpsEntry, h as Session, i as ChecklistItem, n as ActionBlock, s as Finding, t as Action, u as Issue } from "./index-BqPQp6TF.js";
+import { _ as Task, a as Decision, c as Group, d as Mainline, f as OpsEntry, h as Session, i as ChecklistItem, n as ActionBlock, s as Finding, t as Action, u as Issue } from "./index-l8QUG80k.js";
 import { z } from "zod";
 //#region ../core/dist/ids/allocators.d.ts
 /** The letters ids start with. */
@@ -437,11 +437,16 @@ declare function setSessionInfo(hub: HubReader, input: {
   id: string;
   info: SessionInfo;
 }): OpResult<Session>;
-/** Remember the digest of what the last turn reminder listed in full; null forgets it, so the next reminder lists everything again. */
+/** Remember the digest of the whole turn reminder last sent; null forgets it, so the next reminder is sent again. */
 declare function setReminderDigest(hub: HubReader, input: {
   id: string;
   digest: string | null;
 }): OpResult<Session>;
+/** Remember the digests of the check problems last handed over after a write; null or an empty list forgets them, so every problem is reported again. */
+declare function setCheckReported(hub: HubReader, input: {
+  id: string;
+  reported: string[] | null;
+}): OpResult<Session>;
 declare function setSessionStatus(hub: HubReader, input: {
   id: string;
   status: string;
@@ -490,7 +495,7 @@ declare function updateAction(hub: HubReader, input: {
  * (`item check` and `item uncheck` send `item.check`, with done true or false). The operations no command sends
  * are listed in COMMANDLESS_OPERATIONS with who sends them.
  */
-declare const OPERATION_NAMES: readonly ['repo.add', 'hub.add', 'mainline.new', 'mainline.set', 'mainline.title', 'mainline.archive', 'criterion.add', 'criterion.check', 'criterion.set', 'task.new', 'task.set', 'item.add', 'item.check', 'item.drop', 'item.undrop', 'decision.new', 'decision.accept', 'decision.supersede', 'issue.new', 'issue.set', 'issue.plan', 'issue.close', 'issue.reopen', 'issue.archive', 'finding.new', 'finding.set', 'finding.archive', 'group.new', 'group.set', 'ops.add', 'section.append', 'session.start', 'session.ensure', 'session.handoff', 'session.info', 'session.reminder', 'session.set', 'session.settle', 'session.archive', 'action.add', 'action.set', 'file.remove'];
+declare const OPERATION_NAMES: readonly ['repo.add', 'hub.add', 'mainline.new', 'mainline.set', 'mainline.title', 'mainline.archive', 'criterion.add', 'criterion.check', 'criterion.set', 'task.new', 'task.set', 'item.add', 'item.check', 'item.drop', 'item.undrop', 'decision.new', 'decision.accept', 'decision.supersede', 'issue.new', 'issue.set', 'issue.plan', 'issue.close', 'issue.reopen', 'issue.archive', 'finding.new', 'finding.set', 'finding.archive', 'group.new', 'group.set', 'ops.add', 'section.append', 'session.start', 'session.ensure', 'session.handoff', 'session.info', 'session.reminder', 'session.checked', 'session.set', 'session.settle', 'session.archive', 'action.add', 'action.set', 'file.remove'];
 type OperationName = (typeof OPERATION_NAMES)[number];
 //#endregion
 //#region ../core/dist/ops/operations.d.ts
@@ -537,6 +542,7 @@ declare const OPERATIONS: {
   readonly 'session.handoff': typeof handoffSession;
   readonly 'session.info': typeof setSessionInfo;
   readonly 'session.reminder': typeof setReminderDigest;
+  readonly 'session.checked': typeof setCheckReported;
   readonly 'session.set': typeof setSessionStatus;
   readonly 'session.settle': typeof settleSession;
   readonly 'session.archive': typeof setSessionArchived;