navori 0.8.6 → 0.8.7

package/README.md

@@ -67,6 +67,7 @@ Y genera:
 | `add <plugin>` | Activa un plugin y opcionalmente instala la tool externa |
 | `remove <plugin>` | Desactiva un plugin y limpia sus bloques managed, sub-bloques y scripts |
 | `configure <section>` | Ajusta una sección del config sin re-correr el wizard |
+| `adopt <path>` | Toma un archivo de `.claude/` que escribiste a mano bajo gestión de navori: lo envuelve en un bloque managed sin reescribir su contenido (preview por default) |
 | `update` | Re-detecta el repo, refresca config y corre sync en un paso |
 | `render` | Genera los archivos nativos de cada engine configurado (preview por default; `--apply` escribe). `--all` renderea todos los repos del registro global; `--prune` limpia los que ya no existen |
 | `registry <sub>` | Registro global de tus repos con navori, para `render --all` (`ls`, `scan <dir>`, `add`, `remove`, `prune`) |
@@ -75,6 +76,7 @@ Y genera:
 | `scan` | Detecta workspaces nuevos en monorepos (`pnpm-workspace.yaml` / `package.json#workspaces`) |
 | `doctor` | Audita el config + drift de cada managed block (CLAUDE.md **y AGENTS.md**), orden canónico, markers malformados, desincronización de monorepo y tools externas faltantes (`--strict` para CI) |
 | `status` | Snapshot rápido: config, plugins activos, conteo de drift y próximos pasos |
+| `audit` | Reporta cómo corrió el harness de verdad: atribución de tokens y huecos de adherencia en tus sesiones |
 | `bench` | Corre `render` en dry-run N veces y reporta latencias (detecta regresiones locales) |
 | `workspace <sub>` | Gestiona workspaces cross-repo (`init`, `ls`, `show`, `rm`) |
 | `ticket <sub>` | Gestiona tickets-as-files en un workspace (`new`, `list`, `show`, `archive`, `delete`) |
@@ -125,6 +127,7 @@ La resolución es **local → bundled**: si tienes un preset local con el mismo
 |---|---|---|
 | `engram` | Memoria persistente entre sesiones | `engram` binary |
 | `codegraph` | Grafo AST del repo vía MCP: símbolos, call paths y blast-radius en una llamada | `codegraph` |
+| `tgrep` | Búsqueda de contenido indexada por trigramas (flags de ripgrep), con fallback automático si falta el binario | `tgrep` |
 | `acli` | Leer tickets de Jira desde la terminal | `acli` |
 | `gh` | GitHub Issues, PRs y workflow runs | `gh` |
 | `jscpd` | Detección de duplicación en el diff | `jscpd` (opt-in) |
@@ -245,7 +248,7 @@ del baseline y de los prompts.
 Qué escribe el `init --apply`, y nada más:
 
 - `~/.navori/global.json` — el manifest: idioma, bloques del baseline y tus permisos globales.
-- `~/.claude/skills/navori/` — el plugin `navori@skills-dir` con los 8 agentes, las 12 skills y el
+- `~/.claude/skills/navori/` — el plugin `navori@skills-dir` con los 8 agentes, las 11 skills y el
   hook del baseline. Claude Code lo carga sin marketplace ni paso de instalación; las skills globales
   se invocan `/navori:<nombre>` (tras un render, `/reload-plugins` o sesión nueva).
 - `~/.claude/settings.json` — **solo** la clave `permissions`, y solo si declaraste permisos globales
@@ -301,6 +304,47 @@ navori configure pr-target develop    # rama destino del PR (gh pr create --base
 navori configure workspace bonum      # asociar a un workspace
 ```
 
+## Extender el harness en tu repo
+
+navori instala un baseline; lo que lo vuelve valioso en **tu** repo es el conocimiento que sólo
+tú tienes. Hay cuatro destinos, ordenados de más barato a más caro en archivos, revisión y tokens
+por sesión. Empieza arriba de la tabla: el escalón más barato suele ser además el más efectivo.
+
+| Lo que tienes | Dónde va |
+|---|---|
+| Una regla de tu repo (un patrón propio, la convención de tu data layer) | la **user-section** de la skill que ya cubre el tema |
+| Conocimiento que ninguna skill instalada cubre | **skill project-local** |
+| Conocimiento de un stack, reusable entre repos | **preset local** (`navori preset init <id>`) |
+| Envoltura de un binario o servidor MCP | **plugin** (va a navori, no a tu repo) |
+
+**La user-section es el default.** Cada skill que navori renderiza trae un sentinel
+`<!-- navori:user-section -->`; todo lo que escribas después es tuyo y `render`/`sync` no lo tocan
+nunca. Cero archivos nuevos, cero config, y la regla queda donde el agente ya iba a mirar.
+
+**Una skill project-local** son dos pasos:
+
+```bash
+# 1. la forma DIRECTORIO es la única que el host descubre.
+#    Un `<id>.md` suelto en .claude/skills/ no se carga nunca.
+mkdir -p .claude/skills/mi-skill && $EDITOR .claude/skills/mi-skill/SKILL.md
+
+# 2. declara el id en navori.config.json:
+#    "project": { "localSkills": ["mi-skill"] }
+navori doctor   # valida que el archivo exista y que su description diga CUÁNDO usarla
+```
+
+Su frontmatter necesita `name`, `type` (`behavior` \| `reference` \| `tool`) y una `description`
+con **trigger de activación**. El host carga las skills on-demand leyendo esa línea, así que un
+*"Usar cuando…"* es lo que la pone a trabajar sola en el momento justo. `navori doctor` te avisa
+cuando a una le falta, que suele ser el arreglo de mayor retorno: el contenido ya está escrito.
+
+navori **nunca escribe dentro** de una skill project-local: no lleva bloque managed ni
+user-section, es tuya entera.
+
+→ Guía completa (con las cuatro preguntas que hacen fuerte a una propuesta):
+[`docs/EXTENDING.md`](https://github.com/UlisesCm/navori-harness/blob/main/docs/EXTENDING.md).
+Contrato del `SKILL.md`: [`docs/recipes/skill-authoring.md`](https://github.com/UlisesCm/navori-harness/blob/main/docs/recipes/skill-authoring.md).
+
 ## Filosofía
 
 - **Cero opinión sobre tu proceso**. El CLI detecta y propone; tú decides.

package/dist/assets/core/core-assets/agents/auditor.md

@@ -109,7 +109,7 @@ If the finding depends on a dependency's behavior, **verify its docs with `WebFe
 
 2. **Prioritized plan** — `.claude/progress/plan_<scope>.md`: blockers (CRITICAL) → quick wins (low-effort HIGH/MEDIUM) → SDD features → cleanup (LOW). Each item with severity, files to touch, effort, and originating finding.
 
-3. **SDD drafts (optional)** — for CRITICAL/HIGH findings that are SDD-scope (see the **Spec Driven Development** block in `CLAUDE.md`), write `{{sdd.specsDir}}/<feature>/{requirements,tasks}.md.draft`. The `leader` refines them and drops the `.draft`.
+3. **SDD drafts (optional)** — only when SDD is enabled for this repo, for CRITICAL/HIGH findings that are SDD-scope write `{{sdd.specsDir}}/<feature>/{requirements,tasks}.md.draft`. The main agent refines them and drops the `.draft`.
 
 ## Hard rules
 

package/dist/assets/core/core-assets/agents/commit-pr-pilot.md

@@ -1,6 +1,6 @@
 ---
 name: commit-pr-pilot
-description: Drafts Conventional commits and opens the PR with the repo's title + body format, after a git/gh pre-flight. Does not edit project code. Use after the reviewer approves, when the cycle ends in a commit, a push or a PR.
+description: Drafts commits in the configured style and opens the PR with the repo's title + body format, after a git/gh pre-flight. Does not edit project code. Use after the reviewer approves, when the cycle ends in a commit, a push or a PR.
 tools: Read, Glob, Grep, Bash
 model: {{models.commitPrPilot}}
 effort: {{effort.commitPrPilot}}
@@ -8,7 +8,7 @@ effort: {{effort.commitPrPilot}}
 
 # Commit & PR Pilot Agent
 
-You own the **end of the cycle**: well-structured Conventional commits and PRs with a title + body that match the repo's format. You run pre-flight, validate, and fire `git`/`gh`. You don't edit project code.
+You own the **end of the cycle**: well-structured commits in the configured style and PRs with a title + body that match the repo's format. You run pre-flight, validate, and fire `git`/`gh`. You don't edit project code.
 
 ## When to trigger
 
@@ -33,11 +33,20 @@ Run these checks before drafting anything. If something fails, you stop and repo
 git status --porcelain                                # what's left to commit
 git rev-parse --abbrev-ref HEAD                       # cannot be {{prTarget}}, the fork point, or any protected branch
 git fetch origin {{prTarget}} --quiet
+behind=$(git rev-list --count HEAD..origin/{{prTarget}})
+if [ "$behind" -ne 0 ]; then
+  printf 'ABORT: branch is %s commit(s) behind origin/{{prTarget}}; integrate the target before committing or creating a PR.\n' "$behind" >&2
+  exit 1
+fi
 git log origin/{{prTarget}}..HEAD --oneline           # must have ≥1 commit (or changes to commit)
 git diff origin/{{prTarget}} --stat                   # REAL scope so far (two-dot: see below)
 gh auth status                                        # gh authenticated
 ```
 
+A nonzero `behind` count is a hard stop: do not construct a shipping diff,
+consume a receipt, commit, push, or create a PR. The reviewer would otherwise
+have signed target-only files as phantom deletions from this stale worktree.
+
 ### The shipping diff — the one set every count in this pre-flight comes from
 
 Coverage of the review and the receipt's fingerprints are two questions about the SAME set of files. Write it once, read it everywhere:
@@ -135,10 +144,9 @@ Never open the PR with the gate red.
 
 1. Read `.claude/progress/impl_<feature>.md` to understand what changed and why.
 2. Look at `git diff --stat` to confirm the scope.
-3. Draft a Conventional commit message:
-   - Type: `feat | fix | docs | refactor | perf | test | chore | style | build | ci | revert`.
-   - Scope: lowercase, derived from the touched area (module/domain).
-   - Description: imperative, ≤70 chars, no trailing period, language defined by `{{commits}}`.
+3. Draft an atomic commit message in the configured style (`{{commits}}`).
+   - When the configured style is Conventional, use a lowercase type and scope derived from the touched area.
+   - Keep the description imperative, ≤70 chars and without a trailing period.
    - Optional body with the WHY if the decision isn't obvious.
 4. If you touch potentially sensitive files (`.env*`, credentials, odd lockfiles), **flag the user before staging**.
 5. `git add <files>` (prefer explicit over `git add -A`).
@@ -167,7 +175,7 @@ Never open the PR with the gate red.
    - `.claude/progress/impl_<feature>.md` if it exists — non-obvious decisions.
 
 2. **Draft title and body**:
-   - **Title**: Conventional Commits `type(scope): description`. ≤70 chars. Imperative. No trailing period.
+   - **Title**: follows the configured commit style (`{{commits}}`), ≤70 chars, imperative and without a trailing period.
    - **Body**: the repo's exact template (below). No empty sections.
 
 3. **Validate** before firing `gh`:
@@ -262,7 +270,7 @@ wc -c CLAUDE.md                                  # after
 - ❌ Never skip hooks (`--no-verify`) unless the user explicitly asks.
 - ❌ Never ask for a merge / approve the PR yourself. Your job ends with the URL.
 - ❌ Never `gh pr checks --watch`: it takes no timeout and would hang the turn before the URL reaches the user.
-- ✅ Commit and PR message in the language defined by `{{commits}}` (`conventional-es` = Spanish MX, `conventional` = English) — except the `Closes #<N>` keyword, which GitHub parses and which stays in English in any language (see the body template).
+- ✅ Commit and PR message follow the configured style (`{{commits}}`; `conventional-es` = Spanish MX, `conventional` = English). The `Closes #<N>` keyword is the exception: GitHub parses it and it stays in English (see the body template).
 - ✅ If you introduce a new pattern or non-obvious decision that wasn't already in `impl_<feature>.md`, leave a note in the PR body ("Decisions" section).
 
 ## Anti-patterns

package/dist/assets/core/core-assets/agents/explorer.md

@@ -1,7 +1,7 @@
 ---
 name: explorer
 description: Maps a broad area or module — structure, key files, entry points, dependencies. Does not modify code. Use when you don't know where something lives and would otherwise open 4+ files to find out.
-tools: Read, Glob, Grep, Bash, Write
+tools: Read, Glob, Grep, Bash, Write, mcp__engram__mem_search, mcp__engram__mem_get_observation
 model: {{models.explorer}}
 effort: {{effort.explorer}}
 ---

package/dist/assets/core/core-assets/agents/implementer.md

@@ -100,7 +100,7 @@ Write `.claude/progress/impl_<feature>.md`:
 - ...
 
 ## Suggested commit
-`feat(<scope>): ...` (Conventional, atomic, language per `{{commits}}`)
+`<configured commit style>` (atomic, language/style per `{{commits}}`)
 ```
 
 ## Communication with the leader

package/dist/assets/core/core-assets/agents/researcher.md

@@ -1,7 +1,7 @@
 ---
 name: researcher
 description: Answers ONE scoped question about the repo with cited evidence, written to a file. Does not modify code. Use when answering would take reading 4+ files, or to challenge a design decision with fresh context.
-tools: Read, Glob, Grep, Bash, Write
+tools: Read, Glob, Grep, Bash, Write, mcp__engram__mem_search, mcp__engram__mem_get_observation
 model: {{models.researcher}}
 effort: {{effort.researcher}}
 ---

package/dist/assets/core/core-assets/agents/reviewer.md

@@ -25,6 +25,11 @@ You are a strict reviewer. Your only function is to **approve or reject**. You d
    ```bash
    git status --short
    git fetch origin {{prTarget}} --quiet
+   behind=$(git rev-list --count HEAD..origin/{{prTarget}})
+   if [ "$behind" -ne 0 ]; then
+     printf 'ABORT: branch is %s commit(s) behind origin/{{prTarget}}; integrate the target before reviewing.\n' "$behind" >&2
+     exit 1
+   fi
    git diff --stat
    # two-dot: the FULL working tree vs the target (committed AND uncommitted),
    # the exact set the receipt fingerprints below. Three-dot (`...HEAD`) would show
@@ -34,6 +39,10 @@ You are a strict reviewer. Your only function is to **approve or reject**. You d
    git ls-files --others --exclude-standard   # untracked files (new, not yet staged)
    ```
 
+   A nonzero `behind` count is a hard stop: do not review, approve, or write a
+   receipt. A target-only file would otherwise look like a deletion in this
+   worktree and the receipt would sign that phantom deletion.
+
 3. **Re-review** (if there's already a `.claude/progress/review_<feature>.md` from a previous cycle): focus the *reading* on (a) that the issues listed there are resolved and (b) the files the `implementer` reports having touched in this cycle (`impl_<feature>.md`). Don't re-review from scratch the already-approved code that didn't change; the full quality gate is still run anyway — a change can break something outside the delta. If the previous verdict was already `APPROVED` and the diff only moved because of an edit made after it, that's the **delta re-sign** mode below, not this one.
 4. Apply `.claude/skills/verify-before-done/SKILL.md` to every `[x]` that depends on evidence. The quality gate is run **this turn, in Pass 2** (not before: a `SPEC_MISS` in Pass 1 doesn't need it — don't spend the gate on a diff you're going to reject on spec). Don't assume from the implementer's cached report.
 

package/dist/assets/core/core-assets/hooks/_partials/audit-arm.sh

@@ -17,7 +17,7 @@
 # charset (#503) — this function trusts it into a command line, so an unvalidated
 # id must never reach here. $2 is the payload's cwd (#454: never
 # CLAUDE_PROJECT_DIR — they differ in worktrees, and --arm wrote the flag under
-# the name basename(cwd) resolves to). $3 is the audits root.
+# the repo name resolved from the cwd). $3 is the audits root.
 #
 # Fail-open and silent: returns 0 ONLY when audit-mode was actually started, so
 # the caller can announce it; every other path returns 1 and changes nothing.
@@ -27,7 +27,7 @@ navori_audit_consume_armed() {
   narm_cwd=$2
   narm_root=$3
   [ -n "$narm_sid" ] && [ -n "$narm_cwd" ] && [ -n "$narm_root" ] || return 1
-  narm_repo=$(basename "$narm_cwd" 2>/dev/null) || return 1
+  narm_repo=$(navori_audit_repo_from_cwd "$narm_cwd") || return 1
   [ -n "$narm_repo" ] || return 1
   narm_file=$narm_root/$narm_repo/.armed
   [ -f "$narm_file" ] || return 1

package/dist/assets/core/core-assets/hooks/_partials/audit-log.sh

@@ -122,7 +122,7 @@ navori_audit_log() {
   # and the chain yields `""` — the field then disappears from the record and
   # `ownerOf` falls back to the time window, which is the guess this field
   # exists to avoid. Caught by a test, not by review.
-  navori_audit_fields=$(printf '%s' "${payload:-}" | jq -r '[.session_id // "", .cwd // "", ([.agent_id, .subagent_id] | map(select(type == "string" and . != "")) | first) // "orchestrator", "."] | .[]' 2>/dev/null) || return 0
+  navori_audit_fields=$(printf '%s' "${payload:-}" | jq -r '[.session_id // "", .cwd // "", ([.agent_id, .subagent_id] | map(select(type == "string" and . != "")) | first) // "orchestrator", .tool_use_id // "", "."] | .[]' 2>/dev/null) || return 0
   navori_audit_session=${navori_audit_fields%%
 *}
   navori_audit_rest=${navori_audit_fields#*
@@ -132,6 +132,10 @@ navori_audit_log() {
   navori_audit_rest=${navori_audit_rest#*
 }
   navori_audit_agent=${navori_audit_rest%%
+*}
+  navori_audit_rest=${navori_audit_rest#*
+}
+  navori_audit_tool_use_id=${navori_audit_rest%%
 *}
   [ -n "$navori_audit_session" ] || return 0
   # Same character class the CLI enforces (#503): the id composes a path, so
@@ -141,7 +145,7 @@ navori_audit_log() {
   esac
 
   [ -n "$navori_audit_cwd" ] || navori_audit_cwd=$PWD
-  navori_audit_repo=$(basename "$navori_audit_cwd" 2>/dev/null) || return 0
+  navori_audit_repo=$(navori_audit_repo_from_cwd "$navori_audit_cwd") || return 0
   [ -n "$navori_audit_repo" ] || return 0
 
   navori_audit_file=$navori_audit_root/$navori_audit_repo/session-$navori_audit_session.log
@@ -149,7 +153,42 @@ navori_audit_log() {
   # The session may not be the marked one even in a repo that has been audited
   # before. Also the writability check — a log that cannot be appended to is not
   # an error, it is simply not recording.
-  [ -f "$navori_audit_file" ] || return 0
+  if [ ! -f "$navori_audit_file" ]; then
+    # SPOOL for the phase that CANNOT have a log yet (#778).
+    #
+    # `navori audit --start` is what creates the session log, and it runs from
+    # the UserPromptSubmit hook — i.e. after the first prompt. Every SessionStart
+    # hook therefore fires BEFORE the file exists, and the check above threw its
+    # record away every single time: measured, `session-start-context` recorded 1
+    # of ~20 startups in this repo, and the only survivor was a resume onto an
+    # already-open log. "Did the session load the harness?" had no witness at all,
+    # which is exactly the question the recorder exists to answer.
+    #
+    # So those records go to a side file that `--start` absorbs. Two deliberate
+    # limits keep this from becoming a leak:
+    #
+    #   1. SessionStart ONLY. Every other phase runs after a prompt, so a missing
+    #      log there means the session is genuinely not marked — and spooling
+    #      those would write four lines per Bash call, for every session of every
+    #      repo, forever. That is thousands of writes to buy nothing.
+    #   2. Only where the repo's audit directory ALREADY exists, which means the
+    #      repo has been audited (or armed) at least once. `mkdir` is never run
+    #      from here: a repo that has never used audit-mode must stay at zero
+    #      files and zero forks, the same contract as the root gate above. The
+    #      cost is that the FIRST audited session of a repo still loses its
+    #      SessionStart records; every one after it has them.
+    #
+    # FAIL-OPEN, and here more than anywhere: this runs while a session is
+    # opening. Every failure path below returns 0 and writes nothing to stdout —
+    # a spool that could abort a hook would make observation the reason a session
+    # does not start, which is the one bug this partial may never have.
+    [ "${navori_audit_phase:-}" = "SessionStart" ] || return 0
+    [ -d "$navori_audit_root/$navori_audit_repo" ] || return 0
+    navori_audit_file=$navori_audit_root/$navori_audit_repo/pending-$navori_audit_session.jsonl
+    if [ ! -e "$navori_audit_file" ]; then
+      : >> "$navori_audit_file" 2>/dev/null || return 0
+    fi
+  fi
   [ -w "$navori_audit_file" ] || return 0
 
   # Volume valve, OFF by default.
@@ -218,12 +257,14 @@ navori_audit_log() {
     --arg tool "${navori_audit_tool:-}" \
     --arg src "${navori_audit_source:-core}" \
     --arg agent "${navori_audit_agent:-}" \
+    --arg toolUseId "${navori_audit_tool_use_id:-}" \
     --argjson ms "$navori_audit_ms" \
     --argjson tsMs "$navori_audit_end" \
     '{tsMs:$tsMs,event:"hook",name:$name,phase:$phase,verdict:$verdict,ms:$ms,source:$src}
      + (if $tool   == "" then {} else {tool:$tool}       end)
      + (if $reason == "" then {} else {reason:$reason}   end)
-     + (if $agent  == "" then {} else {agentId:$agent}   end)' 2>/dev/null)" \
+     + (if $agent  == "" then {} else {agentId:$agent}   end)
+     + (if $toolUseId == "" then {} else {toolUseId:$toolUseId} end)' 2>/dev/null)" \
     >> "$navori_audit_file" 2>/dev/null
 
   return 0

package/dist/assets/core/core-assets/hooks/_partials/audit-repo.sh

@@ -0,0 +1,17 @@
+# Shared audit repository resolver (#764) — inlined into every audit hook at
+# render time. A nested agent worktree lives below the repository's
+# `.claude/worktrees/` directory, but its basename is an ephemeral agent id.
+#
+# navori_audit_repo_from_cwd <cwd> — prints the stable parent repo name.
+# This only uses shell builtins before the existing `basename` call: audit hooks
+# run often, so discovering the Git common directory would add an avoidable fork
+# per invocation.
+navori_audit_repo_from_cwd() {
+  navori_audit_repo_cwd=$1
+  case "$navori_audit_repo_cwd" in
+    */.claude/worktrees | */.claude/worktrees/*)
+      navori_audit_repo_cwd=${navori_audit_repo_cwd%%/.claude/worktrees*}
+      ;;
+  esac
+  basename "$navori_audit_repo_cwd" 2>/dev/null
+}

package/dist/assets/core/core-assets/hooks/_partials/extract-cmd.sh

@@ -13,10 +13,10 @@
 # Generic on purpose: `.cwd` feeds the worktree resolver of #454 through the
 # SAME hardened cascade instead of a second copy of it.
 #
-# $2 overrides the sed fallback's capture. `.*` (greedy, to the last quote on the
-# line) is right for `command`, whose value can itself contain escaped quotes and
-# which Claude Code sends LAST. Every other field takes the default `[^"]*` run,
-# so a value with more JSON after it is not swallowed whole.
+# The sed fallback reads a JSON string through its first unescaped quote. JSON
+# object member order is not a host contract: `command` can precede `cwd`, so a
+# greedy capture to the last quote would swallow the rest of the payload when
+# neither jq nor node is available.
 payload=$(cat)
 payload_field() {
   if command -v jq >/dev/null 2>&1; then
@@ -25,10 +25,10 @@ payload_field() {
   if command -v node >/dev/null 2>&1; then
     printf '%s' "$payload" | node -e 'let s="";const p=process.argv[1].split(".");process.stdin.on("data",c=>s+=c).on("end",()=>{try{let v=JSON.parse(s);for(const k of p)v=v?.[k];process.stdout.write(String(v??""))}catch{}})' "$1" 2>/dev/null && return 0
   fi
-  printf '%s' "$payload" | sed -n "s/.*\"${1##*.}\"[[:space:]]*:[[:space:]]*\"\(${2:-[^\"]*}\)\".*/\1/p"
+  printf '%s' "$payload" | sed -nE "s/.*\"${1##*.}\"[[:space:]]*:[[:space:]]*\"(([^\"\\]|\\.)*)\".*/\\1/p"
 }
 extract_cmd() {
-  payload_field tool_input.command '.*'
+  payload_field tool_input.command
 }
 # NOT called here on purpose. `payload_field` may spawn a process, and
 # `routing-watch.sh` — which includes this partial and runs after EVERY tool call

package/dist/assets/core/core-assets/hooks/_partials/scan-scope.sh

@@ -0,0 +1,113 @@
+# Shared scan scope — inlined into the diff-scanning gate hooks at render time
+# (see the include directive in the source scripts + lib/hook-includes.ts).
+# DO NOT copy this body back into a hook by hand: hand-synced copies are how the
+# two scanners drifted apart in the first place (#225/#261, and #777 below).
+#
+# Single source of truth for the two questions every diff scanner answers before
+# it runs: WHAT is the baseline, and WHICH files are in scope. `check-semgrep`
+# and `check-jscpd` used to answer both with copies that had already diverged —
+# jscpd never resolved its base to a sha, so its cache and its scan could name
+# different commits.
+#
+# Requires, from the caller: `$base` (the configured base branch, shell-quoted
+# at render time via the `shq:` marker) and a cwd already inside the working
+# tree being scanned. `$navori_scan_label` names the caller in every message.
+
+# --- Baseline (#777) ---------------------------------------------------------
+# `origin/<base>` FIRST, the local ref only as a fallback.
+#
+# The local ref carries NO freshness guarantee. An agent worktree is cut from
+# whatever `main` pointed at that moment and never moves again, and a main
+# checkout nobody pulls is the same shape. A baseline taken from it drifts
+# behind every change that lands meanwhile, and the scan then compares against
+# a tree that no longer exists anywhere: the diff includes files OTHER changes
+# merged, so the gate can BLOCK on findings that are not this diff's — or
+# accept, as "already at the baseline", a finding this diff introduces. Both
+# happened.
+#
+# NO network here, on purpose. This runs as a `PreToolUse` hook on every
+# `git commit`, so a `fetch` would put a remote round-trip — and its timeouts,
+# its auth prompts, its outages — in front of every commit in the repo.
+# `origin/<base>` is kept fresh by the pre-flight of the reviewer and the
+# commit-pr-pilot, which both fetch before they work; in that cycle the ref is
+# already current when the hook reads it. Outside it (an offline clone, a repo
+# with no remote) the fallback keeps the previous behaviour exactly.
+#
+# Sets `$base_ref` (the ref actually used, for messages) and `$base_sha` (its
+# commit — resolved to a sha because it is BOTH the scan's baseline and part of
+# the content cache's fingerprint, so it has to name one immutable commit).
+# Returns 1 when neither ref resolves; the caller skips.
+navori_resolve_base() {
+  local local_sha="" local_short="" origin_short=""
+  base_ref="$base"
+  base_sha=$(git rev-parse --verify --quiet "origin/$base^{commit}" 2>/dev/null || true)
+  if [ -n "$base_sha" ]; then
+    base_ref="origin/$base"
+    local_sha=$(git rev-parse --verify --quiet "$base^{commit}" 2>/dev/null || true)
+    # The lag itself is normal; the lag being SILENT is what cost a day. One
+    # line, only when the two refs actually disagree, so "why was that file
+    # scanned" has an answer in the transcript instead of a reconstruction.
+    if [ -n "$local_sha" ] && [ "$local_sha" != "$base_sha" ]; then
+      local_short=$(git rev-parse --short "$local_sha" 2>/dev/null || printf '%s' "$local_sha")
+      origin_short=$(git rev-parse --short "$base_sha" 2>/dev/null || printf '%s' "$base_sha")
+      echo "ℹ $navori_scan_label: local '$base' ($local_short) ≠ origin/$base ($origin_short) — baseline is origin/$base" >&2
+    fi
+    return 0
+  fi
+  base_sha=$(git rev-parse --verify --quiet "$base^{commit}" 2>/dev/null || true)
+  [ -n "$base_sha" ] || return 1
+  return 0
+}
+
+# --- Files in scope (#777) ---------------------------------------------------
+# `git diff` for tracked changes PLUS `git ls-files --others` for untracked
+# ones.
+#
+# The untracked half is not an edge case. These hooks are `PreToolUse`: they run
+# BEFORE the command they gate. With `git add new.ts && git commit -m x` in ONE
+# Bash call — the batching the harness itself recommends in auto mode — the file
+# is still untracked when the scan runs, so a list built from `git diff` alone
+# reported `0 files to scan` and the gate went green over a file nobody read.
+# Agent work is mostly new files, which made that the common case rather than
+# the rare one. `--exclude-standard` keeps ignored build output out: generated
+# artifacts are not new code.
+#
+# The two lists are disjoint by construction (`--others` is precisely what the
+# index does not track), so there is nothing to de-duplicate.
+#
+# Both listings carry a sentinel with their exit status: they run inside a
+# process substitution, whose status the shell never reports, so a FAILED
+# listing (exit 128: unborn HEAD, a corrupt index, a base that vanished
+# mid-run) would otherwise be indistinguishable from "nothing changed" — the
+# gate printing `0 files to scan` and exiting 0 over a tree it never read
+# (#511). The sentinel can never collide with a real record: the pathspec
+# restricts both lists to `*.ts`/`*.tsx`.
+#
+# Sets `$files` (array) and, on failure, `$scan_files_status`. Returns 1 when
+# either listing failed, so the caller can report it as "nothing was scanned"
+# rather than as a verdict.
+navori_collect_scan_files() {
+  local sentinel='@navori-scan-status:' f=""
+  scan_files_status=""
+  files=()
+  while IFS= read -r -d '' f; do
+    case "$f" in
+      "${sentinel}"*)
+        scan_files_status="${f#"${sentinel}"}"
+        continue
+        ;;
+    esac
+    files+=("$f")
+  done < <(
+    # `|| rc=$?` and not a bare `$?`: the subshell inherits `set -e`, which
+    # would kill it on a failing git call before the sentinel is ever written.
+    rc=0
+    git diff --name-only -z --diff-filter=ACMRT "$base_sha" -- '*.ts' '*.tsx' || rc=$?
+    if [ "$rc" -eq 0 ]; then
+      git ls-files --others --exclude-standard -z -- '*.ts' '*.tsx' || rc=$?
+    fi
+    printf '%s%s\0' "$sentinel" "$rc"
+  )
+  [ "$scan_files_status" = "0" ] || return 1
+  return 0
+}

package/dist/assets/core/core-assets/hooks/audit-mode-close.sh

@@ -10,6 +10,8 @@
 
 set +e
 
+# navori:include audit-repo
+
 payload=$(cat 2>/dev/null) || exit 0
 [ -n "$payload" ] || exit 0
 command -v jq >/dev/null 2>&1 || exit 0
@@ -20,7 +22,7 @@ reason=$(printf '%s' "$payload" | jq -r '.reason // .matcher // "other"' 2>/dev/
 [ -n "$session_id" ] || exit 0
 [ -n "$cwd" ] || cwd=$PWD
 
-repo=$(basename "$cwd" 2>/dev/null) || exit 0
+repo=$(navori_audit_repo_from_cwd "$cwd") || exit 0
 [ -n "$repo" ] || exit 0
 
 if [ -n "$NAVORI_AUDITS_ROOT" ]; then

package/dist/assets/core/core-assets/hooks/audit-mode-trigger.sh

@@ -22,6 +22,8 @@
 
 set +e
 
+# navori:include audit-repo
+
 payload=$(cat 2>/dev/null) || exit 0
 [ -n "$payload" ] || exit 0
 command -v jq >/dev/null 2>&1 || exit 0
@@ -50,7 +52,7 @@ case "$session_id" in
 esac
 [ -n "$cwd" ] || cwd=$PWD
 
-repo=$(basename "$cwd" 2>/dev/null) || exit 0
+repo=$(navori_audit_repo_from_cwd "$cwd") || exit 0
 [ -n "$repo" ] || exit 0
 
 if [ -n "$NAVORI_AUDITS_ROOT" ]; then

package/dist/assets/core/core-assets/hooks/guard-destructive.sh

@@ -43,6 +43,7 @@ navori_audit_tool="Bash"
 # never have.
 navori_audit_begin() { :; }
 navori_audit_log() { :; }
+# navori:include audit-repo
 # navori:include audit-log
 navori_audit_begin
 

package/dist/assets/core/core-assets/hooks/managed-drift-watch.sh

@@ -1,6 +1,37 @@
 #!/usr/bin/env bash
 #
-# PostToolUse(Bash) watcher for managed-block drift (#530).
+# PostToolUse watcher for managed-block drift (#530), on every tool that can
+# write a file: `Bash|Edit|Write|NotebookEdit`.
+#
+# WHY THE MATCHER IS THE WHOLE DECISION, and why it took #775 to widen it. This
+# script audits STATE, never the command, so it has no `case "$tool_name"` to
+# contradict its registration — the matcher alone decides when it runs, which
+# makes a narrow one indistinguishable from a hook that works. It was `Bash`
+# only, and the host's own PostToolUse doc spells out the consequence from the
+# other direction: a hook matching `Edit|Write` does not run when a `Bash`
+# command rewrites the same file. The inverse is the hole this had — in
+# `default`/`acceptEdits`, where the host does NOT push everything through the
+# shell, an `Edit` over `CLAUDE.md` broke a managed block's hash and this stayed
+# quiet until the next Bash call, if one ever came. A session of pure native
+# editing put the #523 freeze back into silence, which is the one thing this
+# hook exists to prevent.
+#
+# WHY NOT `FileChanged`, which the same doc section recommends for exactly this
+# ("to run a hook when a specific file changes on disk, whatever wrote it").
+# Because it would need the watchlist IN the settings, and the managed file set
+# is derived per repo at render time (engine outputs plus every rendered asset,
+# ~60 files here) — so settings.json would carry a second copy of a list this
+# script already derives, and the two would drift. A watchlist that drifts from
+# the managed set is a detector with holes in it, i.e. this hook's own defect
+# class. It is also outside navori's neutral hook vocabulary (`lib/plugins.ts`
+# admits four events, and every engine adapter maps those), so adopting it is a
+# contract change rather than a matcher change.
+#
+# What the widening does NOT buy, stated plainly: a write from outside the
+# session — a formatter in a watch process, another terminal — still surfaces
+# only on the next tool call navori sees. `FileChanged` would catch that one.
+# The cost of what it does buy is one shasum pass (~25ms, quoted below) per
+# native edit.
 #
 # THIS HOOK NEVER READS THE COMMAND. That is the whole design. Its sibling
 # `guard-destructive.sh` decides by the SHAPE of what you typed, so it only ever
@@ -46,7 +77,23 @@ payload=$(cat 2>/dev/null) || payload=""
 
 navori_audit_name="managed-drift-watch"
 navori_audit_phase="PostToolUse"
-navori_audit_tool="Bash"
+# The recorded tool used to be the literal "Bash", which was true while the
+# matcher was. Now that four tools reach here it has to be read — and read
+# without a fork, because this runs after every tool call: `#` and `%%` are
+# builtins, and a tool name carries no quote to escape. Anything the parse does
+# not recognise leaves the field EMPTY (the partial then omits it) rather than
+# guessing, since a wrong label in the audit log is how a lane gets measured as
+# working when it is not — this issue, one level up.
+navori_audit_tool=""
+case "$payload" in
+  *'"tool_name":"'*)
+    navori_audit_tool=${payload#*'"tool_name":"'}
+    navori_audit_tool=${navori_audit_tool%%'"'*}
+    case "$navori_audit_tool" in
+      "" | *[!A-Za-z_]*) navori_audit_tool="" ;;
+    esac
+    ;;
+esac
 # Fallback no-ops, overwritten by the real definitions the include brings in.
 # They exist because this hook is FAIL-OPEN: if the file ever runs WITHOUT its
 # includes expanded — a raw copy of the asset, a render that half-finished — an
@@ -55,6 +102,7 @@ navori_audit_tool="Bash"
 # never have.
 navori_audit_begin() { :; }
 navori_audit_log() { :; }
+# navori:include audit-repo
 # navori:include audit-log
 navori_audit_begin
 

package/dist/assets/core/core-assets/hooks/pr-pilot-confirm.sh

@@ -63,6 +63,7 @@ navori_audit_tool="Bash"
 # Same contract as the sibling gates: a recorder may never kill what it observes.
 navori_audit_begin() { :; }
 navori_audit_log() { :; }
+# navori:include audit-repo
 # navori:include audit-log
 navori_audit_begin
 

package/dist/assets/core/core-assets/hooks/precompact-session-summary.sh

@@ -36,6 +36,7 @@ navori_audit_phase="PreCompact"
 # never have.
 navori_audit_begin() { :; }
 navori_audit_log() { :; }
+# navori:include audit-repo
 # navori:include audit-log
 navori_audit_begin
 

package/dist/assets/core/core-assets/hooks/quality-gate-pre-commit.sh

@@ -32,6 +32,7 @@ navori_audit_tool="Bash"
 # never have.
 navori_audit_begin() { :; }
 navori_audit_log() { :; }
+# navori:include audit-repo
 # navori:include audit-log
 navori_audit_begin
 
@@ -83,6 +84,10 @@ is_pm() {
 
 run_gate() {
   navori_audit_ran_gate=1
+  # The host can kill this process at its hook timeout, before our EXIT trap
+  # records allow/block. Persist a start marker first; audit correlates it with
+  # the terminal record by tool_use_id and reports an unfinished gate.
+  navori_audit_log "gate-started" "inicio del quality gate" || true
   echo "[navori] running quality-gate fast: $1" >&2
   eval "$1" || {
     echo "[navori] quality-gate fast failed. Commit aborted." >&2