navori 0.11.0 → 0.11.1

package/README.md

@@ -41,7 +41,7 @@ npx navori init
 cd ~/tu-repo
 navori init --recommended
 
-# + proveedores externos (tgrep, codegraph, semgrep, jscpd, acli) + pre-commit hook +
+# + proveedores externos (tgrep, semgrep, jscpd, acli) + pre-commit hook +
 # scan-monorepo + project block estricto — requiere instalar los binarios de esos proveedores.
 # También avisa si falta algún binario y cómo instalarlo, sin instalarlo nunca.
 navori init --full
@@ -63,6 +63,24 @@ Y genera:
 - `CLAUDE.md` con managed blocks que el CLI mantiene sincronizados
 - `.claude/` con agentes, skills, hooks y settings
 
+### Aviso opcional de actualización
+
+En comandos interactivos, navori puede avisar si detecta una versión más nueva. La
+consulta al registro de npm se ejecuta en segundo plano y no bloquea el comando;
+por eso, la primera ejecución solo inicia la actualización de la caché y el aviso
+puede aparecer en una ejecución posterior. Se limita a una consulta y un aviso
+cada 24 horas. No se muestra en CI, en modo JSON ni en comandos de ayuda o versión.
+
+Para desactivarlo, define `NAVORI_NO_UPDATE_NOTIFIER=1`. El aviso recomienda el
+comando de actualización según el instalador detectado, con `npx` como alternativa.
+No instala ni actualiza automáticamente y tampoco ejecuta `render`: después de
+actualizar navori, corre `navori render --apply` para aplicar los cambios a tu
+harness.
+
+Si un cierre abrupto deja bloqueado el aviso, detén primero todos los procesos
+`navori`. Después elimina únicamente `~/.navori/update-notice/lock`; conserva los
+archivos de caché y reserva de ese directorio.
+
 ## Comandos
 
 | Comando | Qué hace |
@@ -110,6 +128,7 @@ Un preset aporta skills y reglas específicas del stack además del core. El `in
 | `nestjs` | NestJS (backend) |
 | `express` | Express (backend, agnóstico de DB) |
 | `express-mongoose` | Express + Mongoose (backend) |
+| `fastapi-python` | FastAPI (backend, Python) |
 | `bun-keystone` | Keystone 6 + Prisma (backend, Bun) |
 | `background-worker` | Worker de fondo (jobs + colas: agenda / bullmq / amqplib) |
 | `medusa` | Medusa.js v2 (backend) |
@@ -135,7 +154,7 @@ La resolución es **local → bundled**: si tienes un preset local con el mismo
 | Plugin | Para qué | External tool |
 |---|---|---|
 | `engram` | Memoria persistente entre sesiones | `engram` binary |
-| `codegraph` | Descubrimiento estructural de código vía MCP | `codegraph` binary |
+| `codegraph` | Descubrimiento estructural de código vía MCP; opt-in explícito (no incluido en `--full`) | `codegraph` binary |
 | `tgrep` | Descubrimiento textual de código vía CLI indexado | `tgrep` binary |
 | `acli` | Leer tickets de Jira desde la terminal | `acli` |
 | `gh` | GitHub Issues, PRs y workflow runs | `gh` |

package/dist/assets/core/core-assets/agents/architect.md

@@ -1,7 +1,7 @@
 ---
 name: architect
 description: Proposes what to build and why for a task with an architectural signal (shared abstraction, ownership, contract, migration, hard-to-reverse decision), a level-2 workplan, or a spec's design.md. Not for verdicts, decomposition, or user questions. Use when the architectural row fires, `classify` returns level 2, or a spec is scaffolded.
-tools: Read, Glob, Grep, Bash, Write, WebFetch, WebSearch
+tools: Read, Glob, Grep, Bash, Write, WebFetch, WebSearch, Agent(scout, scribe)
 model: {{models.architect}}
 effort: {{effort.architect}}
 # spec 0032 R26/R28: the method and the level-3 output live here
@@ -23,17 +23,19 @@ For a **master-plan** task, write the requested `<etapa>/plans/plan<n>.md` and p
 - "Derive the decision drivers from the project's own rules (DIRECTION, CLAUDE.md, EXTENDING, `quality-attributes`) before you list any option."
 - "Explore at least three rungs — the existing pattern, an extension, a new abstraction. A discarded rung gets one line with its evidence; a surviving one is developed in full."
 - "Recommend the option that best fits the drivers, not the cheapest by default."
-- "Only verify empirically what would change the recommendation if false — documentation before a probe, never a full stack install; a probe like `npx <tool>@<version> --help` for a deciding flag still qualifies. Verify every 'already exists' claim against `origin/{{branchBase}}` after `git fetch origin {{branchBase}}`; if the fetch fails or the ref doesn't exist, name the ref you actually used — or mark the claim *unverified* with the cause."
+- "Only verify empirically what would change the recommendation if false — documentation before a probe, never a full stack install. Verify every 'already exists' claim against `origin/{{branchBase}}` after `git fetch origin {{branchBase}}`; if the fetch fails or the ref doesn't exist, name the ref you actually used — or mark the claim *unverified* with the cause."
 
 ### Sources
 
 Use URLs de documentación oficial for expiring facts and include the fecha de consulta. If a source is unavailable, label the claim `[SIN VERIFICAR]` and list the sources consulted or unavailable.
 
+Via `Agent` you may dispatch `scout`/`scribe`; plan-gate and Agent hooks fire inside you with `agent_id`, expected.
+
 ## Protocol
 
 1. `CLAUDE.md` is already in your context when your host injects it — read it from disk only if it wasn't.
 2. Apply `.claude/skills/solution-design/SKILL.md` and the Method above: what already exists (evidence), the real problem, genuine approaches only, the chosen solution and why not the others, only the dimensions the signal raises.
-3. Follow Code discovery routing (project instructions): the structural provider first for relationships or impact, `Grep`/`Glob` for literals — find what already solves this before proposing anything new.
+3. Follow Code discovery routing (project instructions): the structural provider first for relationships or impact, `Grep`/`Glob` for literals.
 4. Write the first full draft of `.navori/state/handoffs/solution_<scope>.md` — the skill's template, plus `Decision drivers`, `Options` (survivors developed in full, discarded ones in one line each), `Recommendation`, and `Durable knowledge` naming the proposed destination (Dominio / CLAUDE.md / user-section / skill); mark whatever only a probe would confirm `UNVERIFIED — <why it would change the recommendation>`. "You propose the destination; you never write it." A human decision goes under "Open questions" for the orchestrator to raise — never guessed, never asked directly. Then verify each `UNVERIFIED` item per the Method, updating the artifact after each.
 5. **Level 3 only**: instead of step 4, write `specs/<feature>/design.md` using `spec-bootstrap`'s template.
 6. You do NOT run the challenge — the orchestrator hands the artifact to a fresh-context `auditor` (or the skill's fallback). You do NOT issue READY/CONCERNS/BLOCKED — the orchestrator's, post-challenge.
@@ -45,7 +47,7 @@ Use URLs de documentación oficial for expiring facts and include the fecha de c
 - ❌ Never decompose into implementer tasks — the orchestrator's, after the verdict.
 - ❌ Never ask the user — record it as an open question for the orchestrator.
 - ✅ Every "already exists" claim carries `file:line`. No cite, no claim.
-- ✅ ≥2 approaches only when genuinely viable, never a straw alternative.
+- ✅ ≥2 approaches only when genuinely viable.
 
 ## Communication with the orchestrator
 

package/dist/assets/core/core-assets/agents/implementer.md

@@ -4,7 +4,8 @@ description: Implements ONE scoped task with its tests, respects CLAUDE.md conve
 tools: Read, Write, Edit, Glob, Grep, Bash
 model: {{models.implementer}}
 effort: {{effort.implementer}}
-maxWords: 2350
+maxTurns: 160
+maxWords: 2433
 ---
 
 # Implementer Agent
@@ -44,7 +45,7 @@ You execute **a single** task from start to verification. You don't orchestrate,
 5. **UI**: for screen changes, the default evidence is the repo's tests plus a correct diff — **do NOT spin up a browser or dev server automatically**. Visual/browser validation is **optional and strictly on-request**: run it only when the user explicitly asks to check the UI in this prompt, and then drive the repo's browser-automation tool if one is set up (e.g. `playwright-cli`, whose installer ships its own skill).
 6. **No commits** without the `reviewer`'s approval. When you finish, <!-- navori:if-not scribeOwnsMarkdown -->write the report<!-- /navori:if-not --><!-- navori:if scribeOwnsMarkdown -->write your JSON evidence<!-- /navori:if --> and return the reference.
 <!-- navori:if planTiers -->
-When the encargo opens with `workplan: <feature>`, read `.navori/state/handoffs/workplan_<feature>.json`, run each assigned `A<n>` command and report it in `impl_<feature>.json` under `acceptance` (`id`, `command`, `exitCode`, `excerpt`). A file outside the workplan's files is a blocker to report, not a change to make.
+When the encargo opens with `workplan: <feature>`, read `.navori/state/handoffs/workplan_<feature>.json`, run each assigned `A<n>` `command` exactly as written (same string, foreground, no rewrites), then mark progress and report it in `impl_<feature>.json` under `acceptance` (`id`, `command`, `exitCode`, `excerpt`). The routing-watch hook records acceptance evidence only when the host itself ran that exact command; `navori plan update <feature> --progress A<n>=cumplido` is rejected without it and never runs the command for you. A file outside the workplan's files is a blocker to report, not a change to make.
 <!-- /navori:if -->
 
 ## Hard rules (generic, always apply)
@@ -155,10 +156,13 @@ Write `.navori/state/handoffs/impl_<feature>.json` — the only artifact you pro
   "markdownRequests": [
     { "path": "<repo-relative .md/.mdx path>", "intent": "<what to change and why>", "evidence": "<file:line or commit that backs it>" }
   ],
+  "doubts": [],
   "blockers": []
 }
 ```
 
+`doubts` is optional: declare one `{ "file": "<path>", "reason": "<why you are unsure>" }` entry per spot where you are unsure the change is right, so the reviewer answers it.
+
 `markdownRequests` carries every piece of prose your task needs — your own non-obvious decisions, a CONTRIBUTING/README update, a spec task checkbox, a skill or agent tweak. State the `intent` and the `evidence`; never the finished sentence — drafting the prose from that intent is the `scribe`'s job, not yours. Empty array when the task touches no Markdown at all.
 
 ## Communication with the orchestrator

package/dist/assets/core/core-assets/agents/reviewer.md

@@ -4,7 +4,7 @@ description: Strict reviewer — approves or rejects a diff against CLAUDE.md an
 tools: Read, Glob, Grep, Bash, Write
 model: {{models.reviewer}}
 effort: {{effort.reviewer}}
-maxWords: 2200
+maxWords: 2372
 ---
 
 # Reviewer Agent
@@ -15,7 +15,7 @@ You are a strict reviewer. Your only function is to **approve or reject**. You d
 
 ### Setup (common to both passes)
 
-1. Ground yourself in `CLAUDE.md` — already in your context when your host injects it; read it from disk ONLY if your host did not inject it. Then read `.navori/state/handoffs/impl_<feature>.md`, `.navori/state/handoffs/audit_ticket_<ID>.md` and `.navori/state/handoffs/solution_<scope>.md` (whichever exist). When there IS a solution artifact, the diff is judged against the approach it records — an implementation that quietly took a different path is a `SPEC_MISS`, even if the code is good. You do NOT re-open the design itself: whether that approach was the right one was settled in its own phase; your question is whether the code did what was agreed.
+1. Ground yourself in `CLAUDE.md` — already in your context when your host injects it; read it from disk ONLY if your host did not inject it. Then read `.navori/state/handoffs/impl_<feature>.md` (when `impl_<feature>` carries `doubts`, read them too: each is a `{file, reason}`), `.navori/state/handoffs/audit_ticket_<ID>.md` and `.navori/state/handoffs/solution_<scope>.md` (whichever exist). When there IS a solution artifact, the diff is judged against the approach it records — an implementation that quietly took a different path is a `SPEC_MISS`, even if the code is good. You do NOT re-open the design itself: whether that approach was the right one was settled in its own phase; your question is whether the code did what was agreed.
 2. Identify modified files. Diff against `{{prTarget}}` (the PR's target
    branch), **not** against the fork point: it's the EXACT diff GitHub will show and
    the one publisher reviews. In most repos the branch you forked from and
@@ -59,6 +59,7 @@ Does the diff do EXACTLY what was asked? You don't review style yet.
 - **SDD traceability** (only if `{{sdd.specsDir}}/<feature>/tasks.md` exists): each `R<n>` in the batch is covered by ≥1 test that references it with `// Covers: R<n>`. An `R<n>` in the batch without a traceable test → `SPEC_MISS`.
 <!-- navori:if planTiers -->
 - With a workplan: an assigned `A<n>` without evidence in `acceptance`, a file outside the workplan's files without a covering decision, or `navori plan classify <feature> --diff` returning a higher level than declared → `CHANGES_REQUESTED`.
+- With a workplan: run `navori plan check <feature> --json`; every `A<n>` marked `cumplido` without recorded evidence (the routing-watch hook records it only when the host ran the exact `command`) is a finding → `CHANGES_REQUESTED`.
 <!-- /navori:if -->
 - Screen changes are reviewed on the **diff + the repo's tests** — browser/visual validation is **not a default gate**. Only when the user explicitly requested a visual check in this task do you confirm it happened; if it was requested and skipped, flag it. Never escalate a screen change to a human just because no browser check ran.
 
@@ -142,6 +143,12 @@ Write `.navori/state/handoffs/review_<feature>.md`:
 **Spec gaps (if SPEC_MISS):**
 1. <file>:<line> — <what's missing vs what was asked>
 
+### Implementer doubts
+(only when `impl_<feature>` declares `doubts`; reviewed in addition to the diff, not instead of it)
+- <file>:<line> — resolved | issue — <conclusion, with file:line evidence>
+
+An unanswered doubt, or one concluded `issue`, follows the normal severity and score rules.
+
 ## Pass 2 — Code quality (only if SPEC_OK)
 **Partial verdict:** QUALITY_OK | QUALITY_MISS
 
@@ -160,6 +167,21 @@ Write `.navori/state/handoffs/review_<feature>.md`:
 
 ### Informational observations (50-79, don't block)
 1. [score:65] <file>:<line> — <nitpick or suggestion>
+
+### Coverage
+Required when `APPROVED` with no issue ≥80 (a bare approval with no Coverage is not allowed): one row per `review-diff` section 1-9.
+
+| Section | Reviewed (what) / n/a + reason |
+|---|---|
+| Types and contracts | <what you checked> / n/a + <reason> |
+| Data layer | |
+| Error handling | |
+| Security | |
+| No hardcode | |
+| Naming and structure | |
+| Over-engineering | |
+| Dead code | |
+| Quality gate | |
 ```
 
 ## Chat reply

package/dist/assets/core/core-assets/agents/scout.md

@@ -1,7 +1,7 @@
 ---
 name: scout
 description: Read-only reconnaissance — maps a broad area or answers one scoped question, with cited evidence. Does not modify code. Use when a sub-question is worth running in parallel, or a lookup is worth isolating from the coordinator's own context — not a proxy for a Code discovery routing call the coordinator can make itself this turn.
-tools: Read, Glob, Grep, Bash, Write, mcp__engram__mem_search, mcp__engram__mem_get_observation, mcp__codegraph__codegraph_explore
+tools: Read, Glob, Grep, Bash, Write, WebFetch, WebSearch, mcp__engram__mem_search, mcp__engram__mem_get_observation, mcp__codegraph__codegraph_explore
 model: {{models.scout}}
 effort: {{effort.scout}}
 maxWords: 1050

package/dist/assets/core/core-assets/hooks/_partials/bash-outcome.sh

@@ -0,0 +1,245 @@
+# Shared Bash-outcome helpers (spec 0039 R6/R7, carry-over 0038 D1) — inlined at
+# render time. Defines functions only: nothing runs on include, so a hook that
+# carries this partial pays parse time and no process.
+#
+# Depends on `payload`/`payload_field` (`extract-cmd`) and `nv_project_dir` /
+# `nv_progress_dir` (`hook-input`); include both in the same script.
+#
+# THE SUCCESS LANE. The host runs a criterion's `command` in its own Bash tool;
+# `PostToolUse` fires only on success, so this lane's very firing is the success
+# signal. It appends ONE line per matching pending criterion to
+# `<state dir>/workplan_<feature>.evidence.jsonl`, which `plan update` compares
+# against the criterion and the current tree (`lib/plan/evidence.ts`). It never
+# runs the criterion's command and never writes anything but that line.
+#
+# FAIL-OPEN, NO PARTIAL LINE. Every path returns 0. The line is built entirely in
+# memory and written by a single `printf >>` as the LAST step, so a kill at any
+# earlier point (the tree fingerprint is the slow part) leaves no line at all and
+# `plan update` rejects with "no run recorded".
+#
+# FAST PATH, BUILTINS ONLY. `acceptance-index` (rewritten by the CLI) holds
+# `<command JSON-escaped>\t<feature>\t<A<n>>\t<state dir>` per pending
+# criterion. The command is matched as the EXACT JSON string value of
+# `"command"` in the raw payload — no decoding, no normalization, no process.
+# A `tool_response` cannot forge a match: inside it every quote is `\"`.
+
+# Git with the repo-controlled code paths neutralized (invariant 9): fsmonitor is
+# a command git runs on index refresh, hooksPath redirects hooks. Same flags as
+# `GIT_HARDENING` in `lib/plan/evidence.ts`.
+navori_git() {
+  git -c core.fsmonitor=false -c core.hooksPath=/dev/null "$@"
+}
+
+# Content hash of the whole working tree — the SAME procedure as
+# `fingerprintTree` in `lib/plan/evidence.ts`, which `plan update` re-runs to
+# compare (change one, change both): no `git add` (filters/fsmonitor), blobs by
+# `hash-object --no-filters`, a scratch index, `write-tree`. Prints the tree hash
+# or returns 1. Exec bit is `[ -x ]` where the TypeScript side tests
+# `mode & 0o111`; they differ only for a file executable by group/other but not
+# by its owner, which then fails safe (plan update asks for a rerun).
+navori_tree_fingerprint() {
+  (
+    cd "$1" 2>/dev/null || exit 1
+    scratch=$(navori_git rev-parse --path-format=absolute --git-path navori-fp-index 2>/dev/null) || exit 1
+    [ -n "$scratch" ] || exit 1
+    [ ! -e "$scratch.lock" ] || exit 1
+    work=$(mktemp -d "${TMPDIR:-/tmp}/navori-fp.XXXXXX" 2>/dev/null) || exit 1
+    trap 'rm -f "$work"/list "$work"/files "$work"/links "$work"/paths "$work"/shas; rmdir "$work" 2>/dev/null' EXIT
+    navori_git ls-files -z --cached --others --exclude-standard --deduplicate -- . \
+      ':(exclude).navori/state' ':(exclude).claude/progress' ':(exclude).codex/progress' \
+      ':(exclude).claude/worktrees' > "$work/list" 2>/dev/null || exit 1
+    : > "$work/links"
+    while IFS= read -r -d '' p; do
+      case "$p" in *$'\n'*) exit 1 ;; esac
+      if [ -L "$p" ]; then
+        target=$(readlink "./$p") || exit 1
+        sha=$(printf '%s' "$target" | navori_git hash-object -w --no-filters --stdin 2>/dev/null) || exit 1
+        [ -n "$sha" ] || exit 1
+        printf '120000 %s\t%s\n' "$sha" "$p" >&3
+      elif [ -f "$p" ]; then
+        if [ -x "$p" ]; then mode=100755; else mode=100644; fi
+        printf '%s\t%s\n' "$mode" "$p"
+      fi
+    done < "$work/list" > "$work/files" 3>> "$work/links"
+    if [ -s "$work/files" ]; then
+      cut -f2- "$work/files" > "$work/paths"
+      navori_git hash-object -w --no-filters --stdin-paths < "$work/paths" > "$work/shas" 2>/dev/null || exit 1
+      [ "$(wc -l < "$work/paths" | tr -d ' ')" = "$(wc -l < "$work/shas" | tr -d ' ')" ] || exit 1
+      awk -F'\t' 'NR==FNR { m[FNR]=$1; p[FNR]=substr($0, index($0, "\t")+1); next } { printf "%s %s\t%s\n", m[FNR], $0, p[FNR] }' \
+        "$work/files" "$work/shas" >> "$work/links" || exit 1
+    fi
+    export GIT_INDEX_FILE=$scratch
+    navori_git read-tree --empty >/dev/null 2>&1 || exit 1
+    if [ -s "$work/links" ]; then
+      tr '\n' '\0' < "$work/links" | navori_git update-index --add -z --index-info >/dev/null 2>&1 || exit 1
+    fi
+    navori_git write-tree 2>/dev/null
+  )
+}
+
+# Escapes backslash and double quote for a JSON string value; prints it.
+navori_json_str() {
+  local s=$1
+  s=${s//\\/\\\\}
+  s=${s//\"/\\\"}
+  printf '%s' "$s"
+}
+
+# Repeat-failure state is shared by the PostToolUseFailure watcher and the
+# existing success lane. A successful Bash call only pays for Node when its
+# session already has a failure-state file; ordinary calls use builtins only.
+navori_bash_failure_state() {
+  local action=$1 sid=${CLAUDE_CODE_SESSION_ID:-} dir file
+  case "$sid" in "" | *[!A-Za-z0-9._-]*) return 0 ;; esac
+  [ -n "${nv_project_dir:-}" ] || return 0
+  dir=$nv_project_dir/.navori/state/hooks/bash-outcome-watch
+  file=$dir/$sid
+  if [ "$action" = reset ]; then
+    [ -f "$file" ] && [ ! -L "$file" ] || return 0
+  fi
+  command -v node >/dev/null 2>&1 || return 0
+  NV_BASH_OUTCOME_ACTION=$action NV_BASH_OUTCOME_DIR=$dir NV_BASH_OUTCOME_FILE=$file \
+    NV_BASH_OUTCOME_ROOT=$nv_project_dir node -e '
+const fs = require("node:fs");
+const path = require("node:path");
+const crypto = require("node:crypto");
+const digest = (value) => crypto.createHash("sha256").update(value).digest("hex");
+const env = process.env;
+let input = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => { input += chunk; });
+process.stdin.on("end", () => {
+  try {
+    const payload = JSON.parse(input);
+    if (payload.tool_name !== "Bash" || payload.session_id !== env.CLAUDE_CODE_SESSION_ID) return;
+    if (payload.is_interrupt === true || payload.tool_response?.is_interrupt === true) return;
+    const command = payload.tool_input?.command;
+    const cwd = payload.cwd;
+    if (typeof command !== "string" || !command.trim() || typeof cwd !== "string" || !cwd) return;
+    const agent = typeof payload.agent_id === "string" ? payload.agent_id : "";
+    const key = digest(JSON.stringify([command.trim().replace(/\s+/g, " "), cwd, agent]));
+    const root = path.resolve(env.NV_BASH_OUTCOME_ROOT);
+    const dir = env.NV_BASH_OUTCOME_DIR;
+    const file = env.NV_BASH_OUTCOME_FILE;
+    if (dir !== path.join(root, ".navori/state/hooks/bash-outcome-watch")) return;
+    for (const component of [root, path.join(root, ".navori"), path.join(root, ".navori/state"), path.join(root, ".navori/state/hooks"), dir]) {
+      if (fs.existsSync(component)) {
+        if (!fs.lstatSync(component).isDirectory() || fs.lstatSync(component).isSymbolicLink()) return;
+      } else if (env.NV_BASH_OUTCOME_ACTION === "failure") {
+        fs.mkdirSync(component);
+      } else return;
+    }
+    if (fs.existsSync(file) && (!fs.lstatSync(file).isFile() || fs.lstatSync(file).isSymbolicLink())) return;
+    let rows = fs.existsSync(file) ? fs.readFileSync(file, "utf8").split("\n").filter(Boolean).map((line) => JSON.parse(line)) : [];
+    if (!Array.isArray(rows) || rows.some((row) => typeof row.key !== "string" || typeof row.sig !== "string" || typeof row.count !== "number" || typeof row.epoch !== "number")) return;
+    if (env.NV_BASH_OUTCOME_ACTION === "reset") {
+      const next = rows.filter((row) => row.key !== key);
+      if (next.length === rows.length) return;
+      rows = next;
+    } else {
+      const error = payload.error;
+      if (typeof error !== "string") return;
+      const match = /exit code\s+(\d+)/i.exec(error);
+      if (!match) return;
+      const code = match[1];
+      const escapedRoot = root.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const home = env.HOME ? env.HOME.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") : null;
+      const body = error.replace(/^.*exit code\s+\d+.*\r?\n?/im, "")
+        .replace(/\x1b\[[0-9;]*m/g, "")
+        .replace(new RegExp(escapedRoot, "g"), "<root>")
+        .replace(home ? new RegExp(home, "g") : /\b(?!x)x\b/g, "~")
+        .replace(/(?:\/tmp|\/private\/tmp|\/var\/folders)\/[^\s:]+/g, "<tmp>")
+        .replace(/\b\d{4}-\d\d-\d\d[T ]\d\d:\d\d:\d\d(?:\.\d+)?Z?\b/g, "<t>")
+        .replace(/\b\d\d:\d\d:\d\d(?:\.\d+)?\b/g, "<t>")
+        .replace(/\b\d+(?:\.\d+)?\s?(?:ms|seconds?|minutes?)\b/gi, "<d>")
+        .replace(/\b[0-9a-f]{8,}\b/gi, "<h>")
+        .split("\n").map((line) => line.trim()).filter(Boolean).slice(0, 20).join("\n");
+      if (!body) return;
+      const sig = digest(code + "\n" + body);
+      const previous = rows.find((row) => row.key === key);
+      const count = previous?.sig === sig ? Math.min(previous.count + 1, 3) : 1;
+      const notified = previous?.sig === sig && previous.notified === true;
+      rows = rows.filter((row) => row.key !== key);
+      rows.push({ key, sig, count, notified: notified || count === 3, epoch: Date.now() });
+      if (count === 3 && !notified) {
+        const first = body.split("\n")[0].slice(0, 100);
+        const note = `navori: el comando ${command.trim().slice(0, 100)} falló 3 veces con la misma firma (exit ${code}: ${first}). Cambia de enfoque con debug-failure o escala al usuario. Si el rojo es intencional, ignora esta nota.`;
+        var output = note.slice(0, 400);
+      }
+    }
+    rows.sort((a, b) => b.epoch - a.epoch);
+    rows = rows.slice(0, 50);
+    const temp = file + "." + process.pid + ".tmp";
+    fs.writeFileSync(temp, rows.map((row) => JSON.stringify(row)).join("\n") + (rows.length ? "\n" : ""), { flag: "wx", mode: 0o600 });
+    fs.renameSync(temp, file);
+    if (output) process.stdout.write(output + "\n");
+  } catch { /* advisory: never change the tool result */ }
+});
+' <<< "$payload" 2>/dev/null || true
+  return 0
+}
+
+# Called by `routing-watch.sh` once it knows the tool is `Bash`, and only under
+# `claude-post-tool-use` (Codex fires PostToolUse on failure too, so no signal).
+navori_bash_success_lane() {
+  local idx=$nv_project_dir/$nv_progress_dir/acceptance-index
+  [ -s "$idx" ] || return 0
+  # A backgrounded call "succeeds" when it LAUNCHES, not when it finishes; an
+  # interrupted one did not complete.
+  case "$payload" in
+    *'"run_in_background":true'* | *'"interrupted":true'*) return 0 ;;
+  esac
+  local c f i d hits=
+  while IFS=$'\t' read -r c f i d; do
+    [ -n "$c" ] || continue
+    case "$payload" in
+      *'"command":"'"$c"'"'[,}]*) hits="$hits$c"$'\t'"$f"$'\t'"$i"$'\t'"$d"$'\n' ;;
+    esac
+  done < "$idx"
+  [ -n "$hits" ] || return 0
+
+  # Slow path: exactly one criterion command ran. Everything is computed first,
+  # the write is last.
+  local cwd tree head wt htree dirty sid agent ts root
+  cwd=$(payload_field cwd)
+  [ -n "$cwd" ] || return 0
+  tree=$(navori_git -C "$cwd" rev-parse --show-toplevel 2>/dev/null) || return 0
+  case "$cwd$tree" in *[[:cntrl:]]*) return 0 ;; esac
+  head=$(navori_git -C "$tree" rev-parse HEAD 2>/dev/null) || head=
+  wt=$(navori_tree_fingerprint "$tree") || return 0
+  [ -n "$wt" ] || return 0
+  htree=$(navori_git -C "$tree" rev-parse 'HEAD^{tree}' 2>/dev/null) || htree=
+  dirty=true
+  [ "$wt" = "$htree" ] && dirty=false
+  sid=$(payload_field session_id | tr -cd 'A-Za-z0-9._-')
+  agent=$(payload_field agent_id | tr -cd 'A-Za-z0-9._-')
+  ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+  root=$(pwd -P 2>/dev/null) || root=$nv_project_dir
+
+  local line extra file
+  while IFS=$'\t' read -r c f i d; do
+    [ -n "$f" ] || continue
+    # The index is CLI-written state, but the hook is the one that opens a path
+    # taken from it: slug and id shapes, an absolute directory inside this
+    # project, no symlinks.
+    case "$f" in *[!a-z0-9._-]* | [!a-z0-9]*) continue ;; esac
+    case "$i" in
+      A[0-9]*) case "${i#A}" in *[!0-9]*) continue ;; esac ;;
+      *) continue ;;
+    esac
+    case "$d" in "$root"/* | "$nv_project_dir"/*) ;; *) continue ;; esac
+    case "$d" in *[[:cntrl:]]* | */../* | */..) continue ;; esac
+    [ -d "$d" ] && [ ! -L "$d" ] || continue
+    file=$d/workplan_$f.evidence.jsonl
+    [ ! -L "$file" ] || continue
+    # `$c` is already JSON-escaped: it is the index's own field.
+    extra=
+    [ -z "$sid" ] || extra=$extra',"sessionId":"'$sid'"'
+    [ -z "$agent" ] || extra=$extra',"agentId":"'$agent'"'
+    line='{"ts":"'$ts'","feature":"'$f'","id":"'$i'","command":"'$c'","tree":"'$(navori_json_str "$tree")'","cwd":"'$(navori_json_str "$cwd")'","head":"'$head'","worktreeTree":"'$wt'","dirty":'$dirty$extra'}'
+    printf '%s\n' "$line" >> "$file" 2>/dev/null || true
+  done <<NAVORI_HITS
+$hits
+NAVORI_HITS
+  return 0
+}

package/dist/assets/core/core-assets/hooks/_partials/gate-ask.sh

@@ -0,0 +1,25 @@
+# Can this gate hand a no-verdict outcome to the user instead of blocking?
+# Inlined at render time (see lib/render/hook-includes.ts). Decides only; the
+# JSON that speaks to the host stays in each script (partials never carry host
+# output vocabulary — hook-output-contract.test.ts).
+#
+# WHY (#1117): when the TOOL failed (scanner missing a flag, declared runner not
+# on PATH) the gate has no verdict, and "run it yourself outside the agent" is a
+# dead end. Claude Code's PreToolUse can ask the human; that is the right exit.
+#
+# Returns 0 only when ALL hold; any doubt is "no", and "no" is today's block:
+#   - the script is not a Codex copy (Codex drops `permissionDecision`, so an
+#     ask there would let the call PROCEED unasked). Decided by WHERE THE SCRIPT
+#     LIVES, the same rule as the hook-input partial; hooks live in `.codex/hooks/`,
+#     plugin scripts in `.codex/scripts/`.
+#   - the payload is a real PreToolUse hook call. A git hook or the CLI
+#     (`</dev/null`) has no payload, so there is nobody to ask.
+#   - jq exists to build the reason JSON safely; without it, block.
+# Needs `payload`/`payload_field` from the extract-cmd partial.
+navori_can_ask() {
+  case "$0" in
+    *".codex/hooks/"* | *".codex/scripts/"*) return 1 ;;
+  esac
+  command -v jq >/dev/null 2>&1 || return 1
+  [ "$(payload_field hook_event_name)" = "PreToolUse" ]
+}