navori 0.7.4 → 0.7.7

package/dist/assets/core/core-assets/agents/researcher.md

@@ -37,7 +37,7 @@ hypothetical future abstractions or optional edge cases as BLOCKER.
 1. `CLAUDE.md` carries the repo's context — it is already in your context when your host injects it; read it from disk ONLY if your host did not inject it.
 2. Work on ONE scoped question (the orchestrator already handed you the scope). If you discover it's actually >2 independent questions, return them as a list so the orchestrator distributes them across parallel researchers — don't chain them in series yourself.
 3. Run the search:
-   - Primary method: the native `Grep` (content) and `Glob` (files by name/pattern) tools. They're read-only, fast (ripgrep), and don't ask for permission.
+   - Primary method: the native `Grep` (content) and `Glob` (files by name/pattern) tools. They're read-only, fast (ripgrep), and don't ask for permission. In auto mode the shell additionally pays a classifier round-trip per command — measured, a native search answers in ~0.08s against ~0.20s (p75 1.83s) for the same search through the shell — so the native lane is cheaper in every mode and much cheaper there.
    - Fallback only for what the tools don't cover (git history with `git grep`, FS metadata with `find`): shell commands. Chained with pipes/redirects they ask for confirmation, so reserve the shell for when `Grep`/`Glob` fall short.
    - For semantic questions (not just string match), apply `.claude/skills/structural-search/SKILL.md`: locate the right region and open only the confirmed span; don't read whole files by reflex.
 4. Validate each finding: open the file, confirm the match means what it seems (sometimes a `grep` matches comments or strings unrelated to the concept).

package/dist/assets/core/core-assets/hooks/_partials/audit-arm.sh

@@ -0,0 +1,38 @@
+# Shared armed-audit consumption (#597, #599) — inlined into each consuming hook
+# at render time (see lib/hook-includes.ts). Single source of truth for the flag
+# protocol so the two consumers cannot drift apart:
+#
+#   · SessionStart  — arm BEFORE opening the session (original #597 flow).
+#   · UserPromptSubmit — arm the RUNNING session: `navori audit --arm` (from
+#     another terminal, or in-session via `! navori audit --arm`) and the NEXT
+#     message activates recording (#599). No restart, no lost context.
+#
+# The flag is `<audits-root>/<repo>/.armed`, written by `navori audit --arm`.
+# Consumption comes FIRST: the flag arms exactly ONE session. If `--start` then
+# fails, the arm is lost rather than latched — a flag that survives a failure
+# would fire on some later unrelated session, which is worse than asking the
+# user to arm again.
+#
+# CALLER CONTRACT: $1 is a session id ALREADY validated against the shared
+# charset (#503) — this function trusts it into a command line, so an unvalidated
+# id must never reach here. $2 is the payload's cwd (#454: never
+# CLAUDE_PROJECT_DIR — they differ in worktrees, and --arm wrote the flag under
+# the name basename(cwd) resolves to). $3 is the audits root.
+#
+# Fail-open and silent: returns 0 ONLY when audit-mode was actually started, so
+# the caller can announce it; every other path returns 1 and changes nothing.
+# Safe under `set -euo pipefail` and `set +e` alike.
+navori_audit_consume_armed() {
+  narm_sid=$1
+  narm_cwd=$2
+  narm_root=$3
+  [ -n "$narm_sid" ] && [ -n "$narm_cwd" ] && [ -n "$narm_root" ] || return 1
+  narm_repo=$(basename "$narm_cwd" 2>/dev/null) || return 1
+  [ -n "$narm_repo" ] || return 1
+  narm_file=$narm_root/$narm_repo/.armed
+  [ -f "$narm_file" ] || return 1
+  command -v navori >/dev/null 2>&1 || return 1
+  rm -f "$narm_file" 2>/dev/null || true
+  navori audit --start "$narm_sid" --cwd "$narm_cwd" >/dev/null 2>&1 || return 1
+  return 0
+}

package/dist/assets/core/core-assets/hooks/audit-mode-trigger.sh

@@ -61,6 +61,20 @@ else
 fi
 log_file=$audits_root/$repo/session-$session_id.log
 
+# ─── Armed audit-mode for the RUNNING session (#599) ─────────────────────────
+# `navori audit --arm` (another terminal, or `! navori audit --arm` in-session)
+# → the NEXT prompt lands here, consumes the flag and starts recording. This is
+# the UX the SessionStart-only flow lacked: no closing and reopening a session
+# that is already warm. Costs one stat per prompt when not armed. The stdout
+# line is deliberate — a UserPromptSubmit hook's stdout is injected as context,
+# so the model learns it is being recorded the moment it starts to be.
+# Mid-session coverage is already modeled by the report (recorder horizon), so a
+# log that starts at prompt N is a smaller log, never a broken one.
+# navori:include audit-arm
+if navori_audit_consume_armed "$session_id" "$cwd" "$audits_root"; then
+  printf 'navori: audit-mode ACTIVE from this message on (armed via navori audit --arm; the hook ran --start %s).\n' "$session_id"
+fi
+
 # Not marked → not recording. This is also what makes the hook free outside
 # audit-mode: one stat and out.
 [ -f "$log_file" ] || exit 0

package/dist/assets/core/core-assets/hooks/session-start-context.sh

@@ -58,6 +58,37 @@ trap navori_audit_on_exit EXIT
 ctx=""
 add() { ctx="${ctx}${1}"$'\n'; }
 
+# ─── Armed audit-mode (#597/#599): consume the flag `navori audit --arm` left.
+# The consumption protocol lives in the shared partial (also inlined into the
+# UserPromptSubmit recorder, which covers the RUNNING session); this hook covers
+# "armed before the session opened".
+# navori:include audit-arm
+_armed_root=${NAVORI_AUDITS_ROOT:-${HOME:-}/.navori/audits}
+# The authoritative repo comes from the payload's `cwd`, same as the recorder
+# partial (#454): the hook process can start somewhere other than the session's
+# repo, and `--arm` wrote the flag under the name `basename(cwd)` resolves to.
+_armed_cwd=""
+if command -v jq >/dev/null 2>&1; then
+  _armed_cwd=$(printf '%s' "$payload" | jq -r '.cwd // ""' 2>/dev/null || true)
+fi
+[ -n "$_armed_cwd" ] || _armed_cwd=${CLAUDE_PROJECT_DIR:-$PWD}
+_armed_sid=""
+if command -v jq >/dev/null 2>&1; then
+  _armed_sid=$(printf '%s' "$payload" | jq -r '.session_id // ""' 2>/dev/null || true)
+fi
+# Same charset guard the CLI and the recorder apply (#503): a path-shaped id
+# means the payload is not what we think it is — do nothing rather than guess.
+case "$_armed_sid" in
+  "" | *[!A-Za-z0-9_-]*) : ;;
+  *)
+    if navori_audit_consume_armed "$_armed_sid" "$_armed_cwd" "$_armed_root"; then
+      # Tell the MODEL, not just the log: the session should know it is being
+      # recorded, and the user should see the activation in the first turn.
+      add "navori: audit-mode ACTIVE for this session (armed via 'navori audit --arm'; the hook ran --start ${_armed_sid})."
+    fi
+    ;;
+esac
+
 # UNTRUSTED-DATA FENCE (#511). Two of the three things this hook injects are
 # repository CONTENT, not harness instruction: commit subjects and the body of
 # `progress/current.md`. Anyone who can push can write either, and both land at

package/dist/assets/core/core-assets/hooks/subagent-stop-handoff.sh

@@ -115,28 +115,54 @@ is_blank() { ! grep -q '[^[:space:]]' "$1" 2>/dev/null; }
 problems=""
 note() { problems="${problems}${problems:+; }$1"; }
 
-# nullglob, so an absent report class yields zero iterations instead of a
-# literal pattern (bash) or a hard "no matches found" abort (zsh, which also
-# has no `shopt` — under `set -e` that unknown command killed the whole hook
-# there, #391). Each shell spells the option its own way.
-if [ -n "${ZSH_VERSION:-}" ]; then setopt NULL_GLOB; else shopt -s nullglob; fi
+# Only handoffs touched inside this window are checked (48h in minutes).
+#
+# The hook fires on SubagentStop, so the handoff it exists to police is the one
+# just written. It used to check the WHOLE directory, which nothing prunes, and
+# that broke it three ways on every repo measured (#606):
+#
+#   1. Handoffs written under an older format failed forever — 44 files in one
+#      repo, 19 in another. The `clean` verdict this script calls "the whole
+#      value of recording this hook" was unreachable in all four.
+#   2. The stamp compares the full problem string, so a genuinely broken new
+#      handoff injected N+1 paths (44 of them from August in one repo) and
+#      fixing it re-injected the N old ones. The real warning arrived buried.
+#   3. Two greps per file, unbounded: the median run tracked the file count
+#      almost linearly — 46 files/165ms, 57/197ms, 80/333ms, 138/419ms — making
+#      this the most expensive hook of the six, the other five sitting at
+#      16-59ms.
+#
+# 48h and not less because a session can be long (10h41m measured) and a handoff
+# written early in one must still be checked when it ends. Everything older is
+# closed work: PRs in the repo this was measured on merge in under 10 hours,
+# p90 8.5h.
+HANDOFF_WINDOW_MIN=2880
+
+# `find` replaces the globs rather than filtering inside them: it does the
+# selection in ONE fork per directory instead of two greps per stale file, which
+# is the cost above. Read through `while read` (not `$(...)` word-splitting) so
+# a path with spaces survives, and via process substitution so `note` writes to
+# the real `problems` and not to a subshell's copy.
+#
 # Reports are named by their PATH, not their basename: with more than one
 # progress dir in play, `impl_x.md` alone wouldn't say which one to open.
 for dir in "${dirs[@]}"; do
-  for f in "$dir"/impl_*.md; do
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
     if is_blank "$f"; then
       note "$f vacío"
     elif ! grep -qiE '^\*{0,2}status:?\*{0,2}' "$f" 2>/dev/null; then
       note "$f sin línea 'Status:'"
     fi
-  done
-  for f in "$dir"/review_*.md; do
+  done < <(find "$dir" -maxdepth 1 -name 'impl_*.md' -mmin -"$HANDOFF_WINDOW_MIN" 2>/dev/null)
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
     if is_blank "$f"; then
       note "$f vacío"
     elif ! grep -qE 'APPROVED|CHANGES_REQUESTED' "$f" 2>/dev/null; then
       note "$f sin veredicto (APPROVED/CHANGES_REQUESTED)"
     fi
-  done
+  done < <(find "$dir" -maxdepth 1 -name 'review_*.md' -mmin -"$HANDOFF_WINDOW_MIN" 2>/dev/null)
 done
 
 # `clean` vs `dirty` is the whole value of recording this hook: it is the only

package/dist/assets/core/core-assets/managed/arranque-sesion.md

@@ -4,3 +4,5 @@ On Claude, a `SessionStart` hook injects the live context — branch, recent com
 
 1. **Healthy config**: run `navori doctor` if `navori.config.json` / `.claude/` look inconsistent, or to confirm the declared quality gates can actually run.
 2. **Scoped task**: one **user** task at a time; decompose and parallelize per your orchestrator role.
+
+**Audit mode on request**: if the user asks for it in any wording ("audit mode", "con auditoría", "navori audit"), run `navori audit --start <this session's id>` as the FIRST action of that turn — before loading skills or starting any pipeline — and confirm the log path it prints. The phrase never activates anything by itself (by design); the command is the only switch. If the injected context already says audit-mode is ACTIVE (armed via `navori audit --arm` — which also applies to a RUNNING session on its next message), it is running — do not start it again, and never tell the user to close and reopen the session for this.

package/dist/assets/core/core-assets/managed/cierre-sesion.md

@@ -7,5 +7,10 @@ Before closing the session:
 3. **Clear current**: leave `progress/current.md` at `idle` or with the explicit next step.
 4. **No temporaries**: delete scratch files; don't leave `console.log`, `debugger`, or commented-out code.
 5. **Conventional commit**: `feat|fix|chore|docs(scope): message`, atomic, in the language defined by the config's `commits`.
+6. **Park on base**: once the cycle's work is committed and its branch pushed (PR opened when the flow calls for one), leave the repo standing on the base branch, synced: `git switch {{branchBase}}` then `git pull --ff-only`. The point is where the NEXT session starts from — a repo parked on last week's feature branch breeds branches cut from stale bases. Rules that make it safe:
+   - **Never delete the feature branch.** This is position hygiene, not history hygiene; the branch stays for its pending merge and for `babysit-prs`.
+   - Only with a **clean working tree** and the cycle's commits pushed. Anything unpushed or uncommitted → do NOT switch; say what was left and leave parking to the user.
+   - `--ff-only`, always: the base must never receive a surprise merge from a parking step. If it doesn't fast-forward, report it instead of resolving it here.
+   - If another session may be alive on this same working tree (a second terminal on this repo), switching yanks the branch out from under it — when in doubt, skip and say so.
 
 **R1 lean close** — the three conditions are verifiable, so this is not a judgment call: the session ran the **R1** route, it covered **one** user task, and its diff touches no critical area (`{{project.criticalAreas}}`). All three hold → skip step 2 when nothing was committed, and whatever ceremony another block exempts under this same name. It never exempts the quality gate, nor the `history.md` entry whenever there WAS a commit: a change that shipped leaves a trace, however trivial.

package/dist/assets/core/core-assets/settings/settings-base.json

@@ -35,6 +35,7 @@
       "Bash(git commit:*)",
       "Bash(git restore --staged:*)",
       "Bash(git switch:*)",
+      "Bash(git pull --ff-only*)",
       "Bash(git checkout -b:*)",
       "Bash(git push -u origin HEAD)",
       "Read",

package/dist/assets/core/core-assets/skills/structural-search.md

@@ -20,8 +20,10 @@ Confirm every pointer with a cheap search. If the code contradicts memory, corre
 
 Use it when you know a literal token: name, import, config key, error string.
 
+Native `Grep` first — it IS ripgrep, pre-approved, ~0.08s vs ~0.20s (p75 1.83s) by shell, which in auto mode also pays a classifier round-trip. Shell `rg` is the fallback (git history, context flags), not the default.
+
 1. Start narrow: file, directory or type obtained in Rung 0.
-2. Ask first for files (`rg -l`) or `file:line` with at most two lines of context.
+2. Ask first for files (`Grep` files mode; `rg -l` via shell) or `file:line` with at most two lines of context.
 3. Dedup before reading.
 4. Open only the span that confirms the hit.