navori 0.6.3 → 0.6.5

package/dist/assets/core/core-assets/hooks/_partials/audit-log.sh

@@ -0,0 +1,170 @@
+# Shared audit-mode event recorder — inlined into each managed hook at render
+# time (see the include directive in the source scripts + lib/hook-includes.ts).
+#
+# WHY (spec 0013): a hook is only visible to the transcript when it BLOCKS or
+# INJECTS context. Every hook that runs and lets the action through is invisible,
+# so `navori audit` could never answer "did the gate run, and what did it cost?".
+# The transcript cannot be fixed — it is the host's format — so the harness
+# records its own execution instead, and the session log becomes the source of
+# truth for what the harness did.
+#
+# Expects `$payload` (the raw hook payload on stdin) to be in scope, and reads
+# `$navori_audit_t0` for the start instant. Both are set by `navori_audit_begin`.
+#
+# Every variable read here carries a `:-` default ON PURPOSE: most managed hooks
+# run under `set -euo pipefail`, where an unset variable ABORTS the hook. A
+# recorder that can abort the thing it observes is worse than no recorder, so the
+# partial must be safe to inline into `set -u` and `set +e` alike.
+#
+# FAIL-OPEN ABSOLUTE, and this matters more here than anywhere else: this code is
+# inlined into hooks whose own contract is to never break a session. Observation
+# must never become the reason an action fails, so every path returns 0 and
+# nothing is ever written to stdout — a stray byte there would be interpreted by
+# the host as hook output (context injection, or a block reason).
+
+# Start the clock — but only after establishing that anything will be recorded.
+#
+# THE COST OF BEING OFF is the number that matters here: this code is inlined
+# into hooks that fire on EVERY Bash call, and audit-mode is off for virtually
+# every session of every user. An earlier version ran `perl` plus two `jq`
+# invocations before it ever checked whether a log existed — three processes per
+# hook, four hooks per command, ~48 ms on every single shell call for a feature
+# nobody had turned on.
+#
+# So the gate is a pure-builtin one first: the per-repo audit directory only
+# exists once audit-mode has been activated in this repo at least once. No
+# subprocess, no parsing. Everything expensive lives behind it.
+navori_audit_begin() {
+  navori_audit_on=0
+
+  navori_audit_root=${NAVORI_AUDITS_ROOT:-}
+  if [ -z "$navori_audit_root" ]; then
+    [ -n "${HOME:-}" ] || return 0
+    navori_audit_root=$HOME/.navori/audits
+  fi
+
+  # The gate tests the audit ROOT, not the per-repo directory.
+  #
+  # Deriving the repo cheaply would mean `${CLAUDE_PROJECT_DIR##*/}` — and that
+  # is WRONG: the authoritative repo comes from the payload's `cwd`, and the two
+  # differ whenever a hook fires inside an agent worktree, since the hook process
+  # starts in the main repo (#454). A gate built on the wrong name would silently
+  # record nothing exactly where the harness runs its parallel work.
+  #
+  # The root alone is enough for what this gate is for: a user who has never
+  # activated audit-mode anywhere has no `~/.navori/audits`, so the common case
+  # costs one stat and zero processes. Someone who does use audit-mode pays the
+  # parsing — which is the cost of the feature they turned on.
+  [ -d "$navori_audit_root" ] || return 0
+
+  navori_audit_on=1
+  navori_audit_t0=$(navori_audit_now)
+}
+
+# Milliseconds since epoch, spending a process only when it has to.
+#
+# `$EPOCHREALTIME` is a BUILTIN in bash 5 and in zsh (with zsh/datetime, which
+# the harness's zsh path already has): no fork at all. Only a shell without it
+# pays for `perl`, and only a machine without perl degrades to whole seconds —
+# `date` has no portable millisecond format (GNU has %s%3N, BSD does not).
+navori_audit_now() {
+  if [ -n "${EPOCHREALTIME:-}" ]; then
+    # `1756... .123456` → milliseconds, with pure parameter expansion.
+    navori_audit_epoch=${EPOCHREALTIME/,/.}
+    printf '%s%s' "${navori_audit_epoch%%.*}" "$(printf '%.3s' "${navori_audit_epoch#*.}")"
+    return 0
+  fi
+  perl -MTime::HiRes=time -e 'printf "%.0f", time*1000' 2>/dev/null \
+    || printf '%s' $(( $(date +%s 2>/dev/null || echo 0) * 1000 ))
+}
+
+# navori_audit_log <verdict> [reason]
+#
+# `name`, `phase`, `tool` and `source` come from the caller's own variables,
+# which the render sets per hook — the partial never guesses which hook it is
+# inlined into.
+navori_audit_log() {
+  # The builtin-only gate from `navori_audit_begin`: when audit-mode was never
+  # activated in this repo, nothing below runs and no process is spawned.
+  [ "${navori_audit_on:-0}" = "1" ] || return 0
+  # No payload, no jq, no clock → nothing to record. Each of these is a normal
+  # state for a hook that bailed early, not an error worth surfacing.
+  [ -n "${payload:-}" ] || return 0
+  command -v jq >/dev/null 2>&1 || return 0
+
+  # ONE jq for every field, not one per field: this runs on each hook of each
+  # Bash call, and a fork is the most expensive thing in it. Newline-separated,
+  # read back positionally.
+  navori_audit_fields=$(printf '%s' "${payload:-}" | jq -r '[.session_id // "", .cwd // "", .agent_id // .subagent_id // ""] | .[]' 2>/dev/null) || return 0
+  navori_audit_session=${navori_audit_fields%%
+*}
+  navori_audit_rest=${navori_audit_fields#*
+}
+  navori_audit_cwd=${navori_audit_rest%%
+*}
+  navori_audit_agent=${navori_audit_rest#*
+}
+  [ -n "$navori_audit_session" ] || return 0
+  # Same character class the CLI enforces (#503): the id composes a path, so
+  # anything path-shaped means the payload is not what we think it is.
+  case "$navori_audit_session" in
+    *[!A-Za-z0-9_-]*) return 0 ;;
+  esac
+
+  [ -n "$navori_audit_cwd" ] || navori_audit_cwd=$PWD
+  navori_audit_repo=$(basename "$navori_audit_cwd" 2>/dev/null) || return 0
+  [ -n "$navori_audit_repo" ] || return 0
+
+  navori_audit_file=$navori_audit_root/$navori_audit_repo/session-$navori_audit_session.log
+
+  # The session may not be the marked one even in a repo that has been audited
+  # before. Also the writability check — a log that cannot be appended to is not
+  # an error, it is simply not recording.
+  [ -f "$navori_audit_file" ] || return 0
+  [ -w "$navori_audit_file" ] || return 0
+
+  # Volume valve, OFF by default.
+  #
+  # `PreToolUse(Bash)` chains four hooks, so every shell command leaves four
+  # lines and most are `skip` — a long session runs to thousands. Set
+  # NAVORI_AUDIT_SKIP_NOOPS=1 to drop the ones that did nothing.
+  #
+  # Default off on purpose: a `skip` is the ONLY evidence that a hook ran and
+  # decided it had no business acting, which is exactly what distinguishes it
+  # from a hook that never executed — the question that motivated recording
+  # hooks at all. The valve trades that away knowingly; it must not be the
+  # silent default.
+  if [ "${NAVORI_AUDIT_SKIP_NOOPS:-0}" = "1" ]; then
+    case "$1" in
+      skip|noop) return 0 ;;
+    esac
+  fi
+
+  navori_audit_end=$(navori_audit_now)
+  navori_audit_ms=$(( navori_audit_end - ${navori_audit_t0:-$navori_audit_end} ))
+  [ "$navori_audit_ms" -ge 0 ] 2>/dev/null || navori_audit_ms=0
+
+  navori_audit_ts=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null) || navori_audit_ts=""
+  # `navori_audit_agent` came out of the same single jq above. It is what lets
+  # the report attribute a hook to a subagent WITHOUT guessing: with agents
+  # running in parallel their time windows overlap, so attribution by timestamp
+  # is the fallback, not the primary route.
+
+  printf '%s\n' "$(jq -cn \
+    --arg ts "$navori_audit_ts" \
+    --arg name "${navori_audit_name:-unknown}" \
+    --arg phase "${navori_audit_phase:-unknown}" \
+    --arg verdict "${1:-unknown}" \
+    --arg reason "${2:-}" \
+    --arg tool "${navori_audit_tool:-}" \
+    --arg src "${navori_audit_source:-core}" \
+    --arg agent "${navori_audit_agent:-}" \
+    --argjson ms "$navori_audit_ms" \
+    '{ts:$ts,event:"hook",name:$name,phase:$phase,verdict:$verdict,ms:$ms,source:$src}
+     + (if $tool   == "" then {} else {tool:$tool}       end)
+     + (if $reason == "" then {} else {reason:$reason}   end)
+     + (if $agent  == "" then {} else {agentId:$agent}   end)' 2>/dev/null)" \
+    >> "$navori_audit_file" 2>/dev/null
+
+  return 0
+}

package/dist/assets/core/core-assets/hooks/audit-mode-trigger.sh

@@ -1,15 +1,20 @@
 #!/usr/bin/env bash
-# navori — audit-mode trigger (UserPromptSubmit)
+# navori — audit-mode prompt recorder (UserPromptSubmit)
 #
-# Detects an audit-mode invocation in the user's prompt and asks Claude to
-# CONFIRM with the user before anything is recorded. It never activates the
-# mode by itself: a false positive must die in the question, leaving no state
-# on disk.
+# While audit-mode is active, appends the typed prompt to the session's
+# append-only log. That is its ONLY job.
 #
-# While the mode is active it appends the typed prompt to the session's
-# append-only log. Writes are O_APPEND only; the log is never re-read to be
-# rewritten, so parallel subagents cannot corrupt it and a crashed session
-# still leaves a valid (merely shorter) file.
+# It used to also detect an audit-mode invocation in the prompt text and ask
+# Claude to confirm activation. That was removed (spec 0013, R3): matching
+# `audit mode` as a substring cannot separate INVOKING the mode from TALKING
+# ABOUT it, and talking about it is what you do all day while working on the
+# feature. The asymmetry made it worse — turning it ON matched loosely, while
+# turning it OFF required the literal phrase, so sessions stayed open forever.
+# Activation is now exclusively `navori audit --start <id>`.
+#
+# Writes are O_APPEND only; the log is never re-read to be rewritten, so
+# parallel subagents cannot corrupt it and a crashed session still leaves a
+# valid (merely shorter) file.
 #
 # FAIL-OPEN ABSOLUTE: this hook runs on every prompt. Any error, any missing
 # dependency, any odd path exits 0 silently. It must never be the reason a
@@ -17,34 +22,6 @@
 
 set +e
 
-emit_and_exit() { printf '%s\n' "$1"; exit 0; }
-
-# Is `audit` actually available in the CLI on PATH?
-#
-# The hook orders the agent to run `navori audit --start`, and that resolves the
-# PUBLISHED binary, never a working tree's build. When the installed version
-# predates the subcommand, citty prints the help and exits 0 — so an agent that
-# checks the exit code reads a silent no-op as success and reports a recording
-# that never started. Match the subcommand inside the CLI's own USAGE line
-# instead of trusting the status.
-#
-# Returns 1 when the subcommand is absent AND when the check itself cannot run
-# (no binary on PATH, no USAGE line). Both collapse into "could not confirm",
-# which is what the caller's message must say: claiming "your version is old"
-# would be wrong for a machine with no navori installed at all.
-audit_subcommand_available() {
-  command -v navori >/dev/null 2>&1 || return 1
-  usage=$(navori --help 2>/dev/null | grep -m1 '^USAGE' 2>/dev/null) || return 1
-  [ -n "$usage" ] || return 1
-  # Normalize separators so the token matches at any position: `USAGE navori
-  # init|add|audit` -> `|USAGE|navori|init|add|audit|`.
-  tokens=$(printf '%s' "$usage" | tr ' ' '|' 2>/dev/null) || return 1
-  case "|$tokens|" in
-    *"|audit|"*) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
 payload=$(cat 2>/dev/null) || exit 0
 [ -n "$payload" ] || exit 0
 command -v jq >/dev/null 2>&1 || exit 0
@@ -84,49 +61,20 @@ else
 fi
 log_file=$audits_root/$repo/session-$session_id.log
 
-lower=$(printf '%s' "$prompt" | tr '[:upper:]' '[:lower:]' 2>/dev/null) || exit 0
-
-# Deliberately tolerant: a spurious match costs one question, while a missed
-# one costs the whole recording.
-case "$lower" in
-  *"audit mode"*|*"audit-mode"*|*"modo audit"*|*"modo auditoría"*|*"modo auditoria"*) matched=1 ;;
-  *) matched=0 ;;
-esac
-
-case "$lower" in
-  *apaga*|*apagar*|*desactiva*|*"salir de"*|*detén*|*deten*|*stop*|*"turn off"*|*disable*) off_intent=1 ;;
-  *) off_intent=0 ;;
-esac
-
-if [ -f "$log_file" ]; then
-  # Active: record the human's own words — they entered the model's context,
-  # so they cost tokens and belong in the audit.
-  #
-  # `transcript_path` rides along because the payload is the ONLY place it is
-  # stated. Without it the reader has to guess the transcript's location by
-  # re-deriving Claude Code's undocumented directory encoding (see paths.ts),
-  # and a guess that misses costs the whole report.
-  ts=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null) || ts=""
-  transcript=$(printf '%s' "$payload" | jq -r '.transcript_path // ""' 2>/dev/null) || transcript=""
-  printf '%s\n' "$(jq -cn --arg ts "$ts" --arg ev "prompt" --arg p "$prompt" --arg tr "$transcript" \
-    '{ts:$ts,event:$ev,prompt:$p} + (if $tr == "" then {} else {transcript:$tr} end)' 2>/dev/null)" >> "$log_file" 2>/dev/null
+# Not marked → not recording. This is also what makes the hook free outside
+# audit-mode: one stat and out.
+[ -f "$log_file" ] || exit 0
 
-  if [ "$matched" = "1" ] && [ "$off_intent" = "1" ]; then
-    if audit_subcommand_available; then
-      emit_and_exit "[navori audit-mode] The user asked to turn audit-mode OFF. Before doing anything, ask them explicitly: \"audit mode will be turned off, continue?\". Only if they confirm, run: navori audit --stop $session_id (that seals the log and generates the report). Then check the output: it must name the report it wrote. If it prints the command list (USAGE) instead, the installed CLI has no such subcommand — tell the user and do NOT assume the session was closed. If they decline, leave the mode active and carry on with the task."
-    else
-      emit_and_exit "[navori audit-mode] The user asked to turn audit-mode OFF, but the available 'navori' could not be confirmed to ship the 'audit' subcommand: it may not be installed at all, or it may predate that command. Do NOT run 'navori audit --stop' blindly: if the binary exists but is old, it prints its help and exits 0, which looks like success without being one. Tell the user what happened and that the session log stays intact on disk, so the report can still be generated once the CLI is up to date. Then carry on with the task."
-    fi
-  fi
-  exit 0
-fi
-
-if [ "$matched" = "1" ] && [ "$off_intent" = "0" ]; then
-  if audit_subcommand_available; then
-    emit_and_exit "[navori audit-mode] An audit-mode invocation was detected in the prompt. Before activating anything, ask the user explicitly: \"an audit mode invocation was detected, continue?\". Only if they confirm, run: navori audit --start $session_id (that creates the session log). Then check the output: it must name the log file it created. If it prints the command list (USAGE) instead, the installed CLI has no such subcommand — tell the user and do NOT assume the mode is active. If they decline, run nothing and carry on with the task."
-  else
-    emit_and_exit "[navori audit-mode] An audit-mode invocation was detected, but the available 'navori' could not be confirmed to ship the 'audit' subcommand: it may not be installed at all, or it may predate that command. Do NOT run 'navori audit --start' blindly: if the binary exists but is old, it prints its help and exits 0, which looks like success without being one. Tell the user that nothing was activated, and why. Then carry on with the task."
-  fi
-fi
+# Record the human's own words — they entered the model's context, so they cost
+# tokens and belong in the audit.
+#
+# `transcript_path` rides along because the payload is the ONLY place it is
+# stated. Without it the reader has to guess the transcript's location by
+# re-deriving Claude Code's undocumented directory encoding (see paths.ts),
+# and a guess that misses costs the whole report.
+ts=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null) || ts=""
+transcript=$(printf '%s' "$payload" | jq -r '.transcript_path // ""' 2>/dev/null) || transcript=""
+printf '%s\n' "$(jq -cn --arg ts "$ts" --arg ev "prompt" --arg p "$prompt" --arg tr "$transcript" \
+  '{ts:$ts,event:$ev,prompt:$p} + (if $tr == "" then {} else {transcript:$tr} end)' 2>/dev/null)" >> "$log_file" 2>/dev/null
 
 exit 0

package/dist/assets/core/core-assets/hooks/guard-destructive.sh

@@ -30,7 +30,43 @@ set -euo pipefail
 # A missing JSON parser used to make this guard wave every command through; the
 # shared extractor falls back to sed so it still inspects the command.
 # navori:include extract-cmd
-[ -z "$cmd" ] && exit 0
+
+navori_audit_name="guard-destructive"
+navori_audit_phase="PreToolUse"
+navori_audit_tool="Bash"
+# Fallback no-ops, overwritten by the real definitions the include brings in.
+# They exist because this hook is FAIL-OPEN: if the file ever runs WITHOUT its
+# includes expanded — a raw copy of the asset, a render that half-finished — an
+# undefined function would be exit 127, and under `set -e` that KILLS the hook.
+# A recorder that can kill the thing it observes is the one bug this partial may
+# never have.
+navori_audit_begin() { :; }
+navori_audit_log() { :; }
+# navori:include audit-log
+navori_audit_begin
+
+# The verdict is resolved in a trap, NOT by a call at the end of the file.
+#
+# This hook's managed block ends before its `navori:user-section`, and the render
+# only syncs what is INSIDE the block — so a call placed after it lives in the
+# user's own territory and never reaches the mirror. That is exactly how the most
+# critical hook in the harness ended up being the only one not recording.
+#
+# The trap also covers the extra guards a user writes in that section: whatever
+# they add, the exit code still tells the truth about what happened.
+navori_audit_verdict="allow"
+navori_audit_reason=""
+navori_audit_on_exit() {
+  navori_audit_log "$navori_audit_verdict" "$navori_audit_reason" || true
+  return 0
+}
+trap navori_audit_on_exit EXIT
+
+if [ -z "$cmd" ]; then
+  navori_audit_verdict="skip"
+  navori_audit_reason="sin comando que inspeccionar"
+  exit 0
+fi
 
 # branchBase is shell-quoted at render time via the shq: marker (#197): a
 # hostile branchBase in navori.config.json lands here as an inert literal,
@@ -43,6 +79,11 @@ block() {
   # should carry, and the reason line already says which rule fired.
   echo "[navori] command: ${cmd:0:2000}" >&2
   echo "[navori] if intentional, run the command yourself outside the agent." >&2
+  # Only ASSIGNMENTS here: this is the one place the guard says no, and nothing
+  # may come between the decision and `exit 2`. The recording happens in the
+  # trap, after the exit is already committed.
+  navori_audit_verdict="block"
+  navori_audit_reason="$1"
   exit 2
 }
 
@@ -633,6 +674,66 @@ if printf '%s' "$live" | grep -qE '(of=/dev/(sd|nvme|disk|hd)|>[[:space:]]*/dev/
   block "direct write to a block device"
 fi
 
+# 6. Shell rewrites of a file navori MAINTAINS (#530). In auto mode every edit
+#    arrives as a shell command — `sed -i`, a heredoc, a `>` redirect — instead
+#    of the `Edit` tool, and the two fail very differently: `Edit` aborts when
+#    the old text doesn't match (a check that the agent understood the file),
+#    while `sed -i` with a pattern that matches nothing exits 0 and a `>` with
+#    the wrong path truncates the file. On a managed file the damage is the #523
+#    shape: the body changes, its `hash=` no longer matches, navori marks the
+#    block `user-modified` and STOPS UPDATING IT. Nothing announces that.
+#
+#    These files are a MIRROR, and the harness already says so in prose ("los
+#    conflictos en `.claude/` y CLAUDE.md no se resuelven a mano: son espejo").
+#    This rule is that policy made executable. The way to change them is to edit
+#    the source asset and run `navori render --apply`, or `navori sync` to
+#    reconcile — neither of which matches here, because neither redirects.
+#
+#    COVERED (blocked), by FORM of the write:
+#      > path  ·  >| path        truncating redirect (`>>` append is NOT: it adds
+#                                after the blocks and invalidates no hash)
+#      sed -i … path             in-place rewrite
+#      tee path                  overwrite (`tee -a` is an append, so it is not)
+#    …and by TARGET, the marker-carrying outputs of `ENGINE_OUTPUTS`
+#    (lib/health.ts), which is what "managed" means anywhere else in navori:
+#      CLAUDE.md · AGENTS.md · .claude/settings.json
+#      .claude/agents · .claude/skills · .claude/hooks
+#      .agents/skills · .codex/config.toml · .codex/agents · .codex/hooks
+#      .cursor/rules
+#
+#    NOT COVERED, and each exclusion is load-bearing:
+#      .claude/progress/… and .codex/progress/…   the agent handoff files, for
+#        BOTH engines. Every subagent ends by writing one, usually with a
+#        heredoc; blocking that breaks the harness's own protocol with the
+#        harness's own guard. They carry no markers, so nothing there can be
+#        invalidated. Naming `.codex/` wholesale was exactly that bug: it
+#        swallowed `.codex/progress/` and would have silenced every Codex
+#        subagent's handoff (#389's rule caught it).
+#      .claude/settings.local.json · .claude/worktrees/   machine-local, never
+#        rendered, never marker-managed.
+#      cp/mv INTO a managed path, `python -c` writes, `awk > file`, `perl -i`.
+#        Enumerating write verbs is the losing half of this fight — the same
+#        "describe the danger by its textual form" pattern the blind audit found
+#        eight times. The PostToolUse watcher is the half that doesn't care about
+#        form: it re-checks the hashes AFTER the fact, so anything that gets past
+#        this rule still surfaces. This rule is the seatbelt; that one is the net.
+managed_dir='\.claude/(agents|skills|hooks)|\.agents/skills|\.codex/(agents|hooks)|\.cursor/rules'
+managed_path="(CLAUDE\.md|AGENTS\.md|\.claude/settings\.json|\.codex/config\.toml|(${managed_dir})/[^[:space:];&|]+)"
+# The redirect check reads `scan`, NOT `segments`: the split rewrites every `|`
+# into a newline, so `>| CLAUDE.md` (forced clobber) would be torn in half and
+# the target would land in a segment of its own. Reading the unsplit copy is
+# safe HERE and nowhere else in this file, because the pattern is local — only
+# whitespace may sit between the `>` and its target, so it cannot reach across a
+# `&&` into another command the way rules 1-3 could.
+# `-[a-zA-Z]*i[a-zA-Z]*[^[:space:]]*` accepts the backup-suffix spellings that
+# are the everyday form on both platforms: GNU `sed -i.bak`, BSD `sed -i ''`.
+# Missing them would have left the rule covering the tutorial spelling only.
+if printf '%s' "$scan" | grep -qE "(^|[^>])>\|?[[:space:]]*(\./)?${managed_path}([[:space:]]|\$)" \
+  || printf '%s' "$segments" | grep -qE "(^|[[:space:]])sed[[:space:]]+(-[a-zA-Z]*i[a-zA-Z]*[^[:space:]]*|--in-place)([[:space:]]|=).*${managed_path}" \
+  || printf '%s' "$segments" | grep -qE "(^|[[:space:]])tee[[:space:]]+([^-][^[:space:]]*[[:space:]]+)*(\./)?${managed_path}([[:space:]]|\$)"; then
+  block "shell rewrite of a navori-managed file — edit the source asset and run 'navori render --apply' (or 'navori sync'); a direct write invalidates the block hash and freezes it"
+fi
+
 # navori:user-section
 # user: add extra guards here. `$cmd` already holds the full command (compound
 # commands included) and `block "<reason>"` aborts with exit 2.

package/dist/assets/core/core-assets/hooks/managed-drift-watch.sh

@@ -0,0 +1,180 @@
+#!/usr/bin/env bash
+#
+# PostToolUse(Bash) watcher for managed-block drift (#530).
+#
+# THIS HOOK NEVER READS THE COMMAND. That is the whole design. Its sibling
+# `guard-destructive.sh` decides by the SHAPE of what you typed, so it only ever
+# covers the write verbs someone enumerated — `>`, `sed -i`, `tee` — and misses
+# `python -c`, `perl -i`, `awk > file`, a formatter, or a script the agent
+# didn't write. The blind audit found that "describe the danger by its textual
+# form" pattern eight times, four of them with a test pinning the hole shut.
+#
+# So this one asks the only question that has no form: AFTER the command ran,
+# do navori's managed blocks still hash to what their markers claim? A block
+# whose body changed is a block navori will refuse to update from now on
+# (`user-modified-skipped`) — the #523 freeze, arriving in silence. Whatever
+# rewrote it, legitimately or not, this notices.
+#
+# The managed block below is regenerated by `navori render` and must NOT be
+# edited by hand.
+#
+# SCOPE. settings.json invokes hooks as `bash "$CLAUDE_PROJECT_DIR/.claude/…"`,
+# so this process starts in the MAIN repo even when the command ran inside an
+# agent worktree (#454). Checking the main mirror is the right default — that is
+# the copy every session shares and the one a stray write actually freezes — but
+# a block broken INSIDE a worktree is not seen here. It surfaces when that branch
+# is rendered or reviewed.
+#
+# COST, and why this compares CONTENT rather than mtimes. The obvious cheap
+# check is `find -newer <stamp>`, and it is wrong here: `find` compares mtimes at
+# whatever resolution the filesystem stores, which on several (ext4 under the CI
+# runner among them) is ONE SECOND. Two writes inside the same second as the
+# stamp are invisible — the watcher would report the first and silently miss the
+# second, which is precisely the failure it exists to prevent. It passed on APFS
+# and failed in CI, so the clock was never a sound basis.
+#
+# So the common case costs one `shasum` pass over the managed files (~25ms
+# measured over 60 files) and compares that list against the previous one. It is
+# exact, it depends on no clock, and per-block hashing — the expensive part, ~3.5s
+# for 53 blocks — runs ONLY for the files whose content actually changed, which
+# in a normal session is none and in a bad one is one.
+set -uo pipefail
+
+# PostToolUse delivers its payload on stdin; this hook never needed it and the
+# audit recorder does (session_id/cwd), so it is captured rather than ignored.
+payload=$(cat 2>/dev/null) || payload=""
+
+navori_audit_name="managed-drift-watch"
+navori_audit_phase="PostToolUse"
+navori_audit_tool="Bash"
+# Fallback no-ops, overwritten by the real definitions the include brings in.
+# They exist because this hook is FAIL-OPEN: if the file ever runs WITHOUT its
+# includes expanded — a raw copy of the asset, a render that half-finished — an
+# undefined function would be exit 127, and under `set -e` that KILLS the hook.
+# A recorder that can kill the thing it observes is the one bug this partial may
+# never have.
+navori_audit_begin() { :; }
+navori_audit_log() { :; }
+# navori:include audit-log
+navori_audit_begin
+
+# This hook has SEVEN early exits (no sha, no roots, no changes, …). Wiring a
+# call into each is how the set drifts the next time one is added, so the verdict
+# is derived once, from the exit code, in a trap.
+#
+# `navori_audit_reached_check` is what separates "ran and found nothing" from
+# "bailed before checking anything" — the distinction the whole exercise exists
+# for. Without it every early exit would report `clean`, i.e. would claim a
+# verification that never happened.
+navori_audit_reached_check=0
+navori_audit_on_exit() {
+  navori_audit_code=$?
+  if [ "$navori_audit_code" -eq 2 ]; then
+    navori_audit_log "dirty" "bloque managed con hash desalineado"
+  elif [ "$navori_audit_reached_check" -eq 1 ]; then
+    navori_audit_log "clean"
+  else
+    navori_audit_log "skip" "sin nada que verificar"
+  fi
+  return 0
+}
+trap navori_audit_on_exit EXIT
+
+cd "${CLAUDE_PROJECT_DIR:-.}" 2>/dev/null || exit 0
+
+stamp=".claude/.managed-drift-stamp"
+
+# sha1 tool, resolved once. `shasum` on macOS, `sha1sum` on most Linuxes; both
+# print `<hash>  <path>` for a file list, which is the format the stamp stores.
+sha=""
+command -v shasum >/dev/null 2>&1 && sha="shasum -a 1"
+[ -z "$sha" ] && command -v sha1sum >/dev/null 2>&1 && sha="sha1sum"
+# No sha tool: stay silent. This is a detector, not a gate — the guard still
+# sits in front, and a noisy failure here would fire on every single command.
+[ -z "$sha" ] && exit 0
+
+# The marker-carrying outputs of `ENGINE_OUTPUTS` (lib/health.ts) — the same
+# list the guard's rule 6 protects, and for the same reason.
+#
+# `.claude/progress/` and `.codex/progress/` are deliberately absent for BOTH
+# engines: those are agent handoff files, they carry no markers, and every
+# subagent writes one — including them would re-hash a fresh report on every
+# command and find nothing. `.claude/worktrees/` too: each is a full checkout,
+# so walking it would make this hook cost more than the command it follows. That
+# is why `.codex` is NOT listed wholesale.
+roots=""
+for r in CLAUDE.md AGENTS.md .claude/settings.json .claude/agents .claude/skills .claude/hooks .agents/skills .codex/config.toml .codex/agents .codex/hooks .cursor/rules; do
+  [ -e "$r" ] && roots="$roots $r"
+done
+[ -z "$roots" ] && exit 0
+
+# shellcheck disable=SC2086 — word splitting is how the root list is passed.
+current=$(find $roots -type f -exec $sha {} + 2>/dev/null | sort || true)
+[ -z "$current" ] && exit 0
+
+# First run in a session (or after the ephemeral dir was wiped): adopt the
+# current state as the baseline and say nothing. Reporting every block on the
+# first command would train the reader to ignore this hook by lunchtime.
+if [ ! -f "$stamp" ]; then
+  mkdir -p .claude 2>/dev/null || exit 0
+  printf '%s\n' "$current" > "$stamp" 2>/dev/null || true
+  exit 0
+fi
+
+# Lines present now but not in the baseline: a file whose CONTENT changed, or a
+# new one. A deleted file appears only in the baseline and is ignored — there is
+# no block left to verify.
+changed=$(printf '%s\n' "$current" | grep -F -x -v -f "$stamp" 2>/dev/null | sed -E 's/^[a-f0-9]+[[:space:]]+//' || true)
+# Re-baseline BEFORE reporting, so one write is reported once instead of on
+# every command for the rest of the session. A second write does change the
+# content again, and does get its own report.
+printf '%s\n' "$current" > "$stamp" 2>/dev/null || true
+[ -z "$changed" ] && exit 0
+
+# From here on the work is per-CHANGED-file only. `$(…)` strips the trailing
+# newline, which is what makes these hashes agree with `computeManagedHash`
+# (lib/marker.ts: sha1 over the body with trailing whitespace removed, first 8
+# hex); without it every hash differs and the hook cries wolf on healthy files.
+drift=""
+while IFS= read -r file; do
+  [ -n "$file" ] || continue
+  # Both marker syntaxes (lib/marker.ts): HTML for markdown, `#` for scripts and
+  # TOML. Anchored at the start of the line so a block QUOTED inside prose —
+  # this file's own header, a skill that documents the format — is not read as a
+  # real marker.
+  while IFS='|' read -r id declared; do
+    [ -n "$id" ] || continue
+    body=$(awk -v id="$id" '
+      $0 ~ ("^<!-- navori:managed id=\"" id "\"") { f=1; next }
+      $0 ~ ("^# navori:managed start id=\"" id "\"") { f=1; next }
+      $0 ~ ("^<!-- /navori:managed id=\"" id "\"") { f=0 }
+      $0 ~ ("^# navori:managed end id=\"" id "\"") { f=0 }
+      f' "$file")
+    actual=$(printf '%s' "$body" | $sha | cut -c1-8)
+    [ "$actual" = "$declared" ] || drift="${drift}
+  ${file}  block '${id}'  (marker says ${declared}, content hashes ${actual})"
+  done <<EOF
+$(grep -oE '^(<!-- navori:managed|# navori:managed start) id="[^"]+" hash="[a-f0-9]+"' "$file" 2>/dev/null \
+  | sed -E 's/.*id="([^"]+)" hash="([a-f0-9]+)".*/\1|\2/')
+EOF
+done <<EOF
+$changed
+EOF
+
+navori_audit_reached_check=1
+[ -z "$drift" ] && exit 0
+
+# Exit 2 so the text reaches the model rather than scrolling past in a log: the
+# whole failure mode being cured is that this goes unnoticed. The command has
+# already run — nothing is being reverted or retried.
+cat >&2 <<MSG
+navori: a managed block no longer matches its marker hash.${drift}
+
+navori will now treat those blocks as hand-edited and STOP updating them (the
+#523 freeze). Nothing reverted this for you.
+
+Recover with 'navori sync' (reconciles, shows the conflict diff) or
+'navori render --apply' if the block should simply be regenerated. If the edit
+was intentional, it belongs in the source asset, not in the rendered mirror.
+MSG
+exit 2

package/dist/assets/core/core-assets/hooks/precompact-session-summary.sh

@@ -21,14 +21,53 @@
 # The managed block is regenerated by `navori render`; do NOT edit by hand.
 set -euo pipefail
 
-cat >/dev/null 2>&1 || true   # drain the PreCompact JSON on stdin (unused)
+# The PreCompact JSON was drained and discarded here; it is kept now because the
+# audit recorder reads `session_id`/`cwd` out of it. Draining is still the point:
+# an undrained stdin can leave the host writing into a closed pipe.
+payload=$(cat 2>/dev/null) || payload=""
+
+navori_audit_name="precompact-session-summary"
+navori_audit_phase="PreCompact"
+# Fallback no-ops, overwritten by the real definitions the include brings in.
+# They exist because this hook is FAIL-OPEN: if the file ever runs WITHOUT its
+# includes expanded — a raw copy of the asset, a render that half-finished — an
+# undefined function would be exit 127, and under `set -e` that KILLS the hook.
+# A recorder that can kill the thing it observes is the one bug this partial may
+# never have.
+navori_audit_begin() { :; }
+navori_audit_log() { :; }
+# navori:include audit-log
+navori_audit_begin
+
+# The verdict is a VARIABLE resolved in a trap, not a call per branch. These
+# hooks have several early exits each (no git, no worktrees, nothing to inject),
+# and wiring a call into every one is how the set drifts the next time somebody
+# adds an exit. Defaulting to `skip` makes a new early exit semantically correct
+# for free: it means "ran, decided it had nothing to do", which is exactly what
+# an unhandled early return is.
+navori_audit_verdict="skip"
+navori_audit_reason=""
+navori_audit_on_exit() {
+  navori_audit_log "$navori_audit_verdict" "$navori_audit_reason" || true
+  return 0
+}
+trap navori_audit_on_exit EXIT
+
 
 ctx="A punto de compactar el contexto: el detalle turno-a-turno se resumirá. Antes de perderlo, persiste un resumen de sesión con tu herramienta de memoria (engram: guarda el resumen de sesión) y/o anota las decisiones y los bugs con causa raíz de esta sesión en progress/current.md."
 
 # Emit additionalContext safely: node (best escaping) → jq → give up (exit 0).
 if command -v node >/dev/null 2>&1; then
   CTX="$ctx" node -e 'process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreCompact",additionalContext:process.env.CTX}}))'
+  navori_audit_verdict="inject"
 elif command -v jq >/dev/null 2>&1; then
   jq -n --arg ctx "$ctx" '{hookSpecificOutput:{hookEventName:"PreCompact",additionalContext:$ctx}}'
+  navori_audit_verdict="inject"
+else
+  # Neither serializer available: the reminder never reached the model. Recorded
+  # as `noop` rather than `inject`, because the audit must not claim a context
+  # injection that did not happen.
+  navori_audit_verdict="noop"
+  navori_audit_reason="sin node ni jq: el recordatorio no se emitio"
 fi
 exit 0