navori 0.7.4 → 0.7.5

package/dist/assets/core/core-assets/agents/researcher.md

@@ -37,7 +37,7 @@ hypothetical future abstractions or optional edge cases as BLOCKER.
 1. `CLAUDE.md` carries the repo's context — it is already in your context when your host injects it; read it from disk ONLY if your host did not inject it.
 2. Work on ONE scoped question (the orchestrator already handed you the scope). If you discover it's actually >2 independent questions, return them as a list so the orchestrator distributes them across parallel researchers — don't chain them in series yourself.
 3. Run the search:
-   - Primary method: the native `Grep` (content) and `Glob` (files by name/pattern) tools. They're read-only, fast (ripgrep), and don't ask for permission.
+   - Primary method: the native `Grep` (content) and `Glob` (files by name/pattern) tools. They're read-only, fast (ripgrep), and don't ask for permission. In auto mode the shell additionally pays a classifier round-trip per command — measured, a native search answers in ~0.08s against ~0.20s (p75 1.83s) for the same search through the shell — so the native lane is cheaper in every mode and much cheaper there.
    - Fallback only for what the tools don't cover (git history with `git grep`, FS metadata with `find`): shell commands. Chained with pipes/redirects they ask for confirmation, so reserve the shell for when `Grep`/`Glob` fall short.
    - For semantic questions (not just string match), apply `.claude/skills/structural-search/SKILL.md`: locate the right region and open only the confirmed span; don't read whole files by reflex.
 4. Validate each finding: open the file, confirm the match means what it seems (sometimes a `grep` matches comments or strings unrelated to the concept).

package/dist/assets/core/core-assets/hooks/session-start-context.sh

@@ -58,6 +58,48 @@ trap navori_audit_on_exit EXIT
 ctx=""
 add() { ctx="${ctx}${1}"$'\n'; }
 
+# ─── Armed audit-mode (#597): consume the flag `navori audit --arm` left ─────
+#
+# Activation used to depend on the MODEL's attention: "do it in audit mode"
+# inside a task prompt loses to the task, and the natural-language detection
+# was removed on purpose (spec 0013 R3 — invoking the mode is indistinguishable
+# from talking about it). This is the mechanical path: the user arms from the
+# terminal BEFORE opening the session, and this hook — the only party that
+# knows the new session's id — runs `--start` itself.
+#
+# Consumption comes FIRST: the flag arms exactly ONE session. If `--start`
+# then fails, the arm is lost rather than latched — a flag that survives a
+# failure would fire on some later unrelated session, which is worse than
+# asking the user to arm again. Fail-open throughout: this hook's contract is
+# to never break a session, so every step tolerates absence and moves on.
+_armed_root=${NAVORI_AUDITS_ROOT:-${HOME:-}/.navori/audits}
+# The authoritative repo comes from the payload's `cwd`, same as the recorder
+# partial (#454): the hook process can start somewhere other than the session's
+# repo, and `--arm` wrote the flag under the name `basename(cwd)` resolves to.
+_armed_cwd=""
+if command -v jq >/dev/null 2>&1; then
+  _armed_cwd=$(printf '%s' "$payload" | jq -r '.cwd // ""' 2>/dev/null || true)
+fi
+[ -n "$_armed_cwd" ] || _armed_cwd=${CLAUDE_PROJECT_DIR:-$PWD}
+_armed_repo=$(basename "$_armed_cwd" 2>/dev/null || true)
+if [ -n "$_armed_repo" ] && [ -f "$_armed_root/$_armed_repo/.armed" ] \
+  && command -v jq >/dev/null 2>&1 && command -v navori >/dev/null 2>&1; then
+  _armed_sid=$(printf '%s' "$payload" | jq -r '.session_id // ""' 2>/dev/null || true)
+  # Same charset guard the CLI and the recorder apply (#503): a path-shaped id
+  # means the payload is not what we think it is — do nothing rather than guess.
+  case "$_armed_sid" in
+    "" | *[!A-Za-z0-9_-]*) : ;;
+    *)
+      rm -f "$_armed_root/$_armed_repo/.armed" 2>/dev/null || true
+      if navori audit --start "$_armed_sid" --cwd "$_armed_cwd" >/dev/null 2>&1; then
+        # Tell the MODEL, not just the log: the session should know it is being
+        # recorded, and the user should see the activation in the first turn.
+        add "navori: audit-mode ACTIVO para esta sesión (armado con 'navori audit --arm'; el hook corrió --start ${_armed_sid})."
+      fi
+      ;;
+  esac
+fi
+
 # UNTRUSTED-DATA FENCE (#511). Two of the three things this hook injects are
 # repository CONTENT, not harness instruction: commit subjects and the body of
 # `progress/current.md`. Anyone who can push can write either, and both land at

package/dist/assets/core/core-assets/managed/arranque-sesion.md

@@ -4,3 +4,5 @@ On Claude, a `SessionStart` hook injects the live context — branch, recent com
 
 1. **Healthy config**: run `navori doctor` if `navori.config.json` / `.claude/` look inconsistent, or to confirm the declared quality gates can actually run.
 2. **Scoped task**: one **user** task at a time; decompose and parallelize per your orchestrator role.
+
+**Audit mode on request**: if the user asks for it in any wording ("audit mode", "con auditoría", "navori audit"), run `navori audit --start <this session's id>` as the FIRST action of that turn — before loading skills or starting any pipeline — and confirm the log path it prints. The phrase never activates anything by itself (by design); the command is the only switch. If the injected context already says audit-mode is ACTIVE (armed via `navori audit --arm`), it is running — do not start it again.

package/dist/assets/core/core-assets/skills/structural-search.md

@@ -20,8 +20,10 @@ Confirm every pointer with a cheap search. If the code contradicts memory, corre
 
 Use it when you know a literal token: name, import, config key, error string.
 
+Native `Grep` first — it IS ripgrep, pre-approved, ~0.08s vs ~0.20s (p75 1.83s) by shell, which in auto mode also pays a classifier round-trip. Shell `rg` is the fallback (git history, context flags), not the default.
+
 1. Start narrow: file, directory or type obtained in Rung 0.
-2. Ask first for files (`rg -l`) or `file:line` with at most two lines of context.
+2. Ask first for files (`Grep` files mode; `rg -l` via shell) or `file:line` with at most two lines of context.
 3. Dedup before reading.
 4. Open only the span that confirms the hit.