novahiz 0.2.5 → 0.3.2

package/src/commands/task.ts

@@ -4,6 +4,8 @@ import { loadSpec, NovahizHome } from "../spec.ts";
 import { openDb } from "../db.ts";
 import { activeTask, addTodos, amendTodo, blockTodo, completeTodo, createTask, dropTask, dropTodo, getTask, getTodo, insertTodo, ledgerSummary, recordTodoDone, reorderTodos, resume, reviewDue, reviewTask, revisionSignals, startTodo, type ReviewDiff, type TodoAmendment, type TodoInput, type TodoKind } from "../ledger.ts";
 
+const TODO_KINDS: readonly string[] = ["read", "edit", "verify", "delegate"];
+
 export function normalizeTodoInput(item: unknown): TodoInput {
   const record = (item ?? {}) as Record<string, unknown>;
   const owners = Array.isArray(record.owner)
@@ -14,9 +16,13 @@ export function normalizeTodoInput(item: unknown): TodoInput {
   const dependsRaw = record.dependsOn ?? record.depends_on;
   const dependsOn = Array.isArray(dependsRaw) ? dependsRaw.map(String) : [];
   const maxIterations = Number(record.maxIterations ?? record.max_iterations);
+  const kind = record.kind ? String(record.kind) : "edit";
+  if (!TODO_KINDS.includes(kind)) {
+    throw new Error(`invalid todo kind: ${kind} (expected one of ${TODO_KINDS.join(", ")})`);
+  }
   return {
     label: String(record.label ?? record.title ?? "").trim(),
-    kind: (record.kind ? String(record.kind) : "edit") as TodoKind,
+    kind: kind as TodoKind,
     acceptance: record.acceptance ? String(record.acceptance) : undefined,
     owner: owners.length > 0 ? owners.join(",") : undefined,
     dependsOn,
@@ -62,6 +68,8 @@ export function commandTask(parsed: Parsed): void {
 
     if (action === "read") return taskRead(parsed, db, session, spec);
     if (action === "status") return taskRead(parsed, db, session, spec);
+    if (action === "resume") return taskResume(db, session);
+    if (action === "current") return taskCurrent(db, session);
 
     print({ error: `unknown task action: ${action}`, actions: ["new", "plan", "todo", "start", "done", "block", "review", "amend", "insert", "drop", "reorder", "signals", "status", "resume", "current"] });
     process.exitCode = 1;
@@ -90,6 +98,22 @@ function taskRead(parsed: Parsed, db: ReturnType<typeof openDb>, session: string
   print({ ...state, summary, review, signals });
 }
 
+function taskResume(db: ReturnType<typeof openDb>, session: string): void {
+  const state = resume(db, session || undefined);
+  const summary = ledgerSummary(state);
+  const next = state.todos.find((todo) => todo.status === "pending");
+  print({
+    ...state,
+    summary,
+    next: next ? { id: next.id, seq: next.seq, label: next.label, kind: next.kind } : null
+  });
+}
+
+function taskCurrent(db: ReturnType<typeof openDb>, session: string): void {
+  const state = resume(db, session || undefined);
+  print({ task: state.task, current: state.current, todos: state.todos.length });
+}
+
 function taskReorder(parsed: Parsed, db: ReturnType<typeof openDb>, session: string, spec: ReturnType<typeof loadSpec>): void {
   const taskId = asString(parsed.flags.task) || activeTask(db, session || undefined)?.id;
   if (!taskId) {
@@ -166,6 +190,11 @@ function taskAmend(parsed: Parsed, db: ReturnType<typeof openDb>, session: strin
   const label = asString(parsed.flags.label);
   if (label) patch.label = label;
   const kind = asString(parsed.flags.kind);
+  if (kind && !TODO_KINDS.includes(kind)) {
+    print({ error: `invalid todo kind: ${kind} (expected one of ${TODO_KINDS.join(", ")})` });
+    process.exitCode = 1;
+    return;
+  }
   if (kind) patch.kind = kind as TodoKind;
   if (parsed.flags.acceptance !== undefined) patch.acceptance = asString(parsed.flags.acceptance);
   const owners = splitList(parsed.flags.owner);

package/src/exec.ts

@@ -47,11 +47,12 @@ function resolveSpawn(bin: string, args: string[]): [string, string[]] {
   return [shell, ["/d", "/s", "/c", [bin, ...args].join(" ")]];
 }
 
-// Bootstrap may only start a known interpreter or packager. Arguments stay
-// unvalidated on purpose (a legitimate argument is sometimes a whole shell
-// command line), so the binary itself is what gets bounded here.
+// Bootstrap may only start a known interpreter or packager. Shell binaries
+// (sh, bash, pwsh, powershell, cmd) are deliberately absent: arguments are
+// parsed by the executable itself, so a shell would turn this allowlist into
+// a formality by reinterpreting anything it is handed.
 const SAFE_BOOTSTRAP_BINS = new Set([
-  "node", "npm", "npx", "uv", "uvx", "sh", "bash", "pwsh", "powershell", "cmd", "cmd.exe", "python", "py"
+  "node", "npm", "npx", "uv", "uvx", "python", "py"
 ]);
 
 function normalizeBin(bin: string): string {
@@ -69,17 +70,44 @@ function refusedBootstrap(bin: string): CommandResult {
   return { ok: false, status: null, stdout: "", stderr: "", error: `refused disallowed bootstrap binary: ${bin}` };
 }
 
-// Bootstrap argv is trusted: it comes from catalog/providers.json, which ships
-// inside the repository. Arguments stay unvalidated on purpose, because a
-// legitimate argument can be a whole shell command line (for example
-// `sh -c "curl ... | sh"`) that must reach its interpreter as one unparsed
-// token. The binary itself is bounded to SAFE_BOOTSTRAP_BINS, so editing the
-// registry to point `bin` at an arbitrary executable is refused.
+// Bootstrap argv comes from catalog/providers.json. Every token is bounded:
+// the bin must be in SAFE_BOOTSTRAP_BINS, each argument must pass SAFE_TOKEN
+// (no whitespace, no shell metacharacter), and interpreters that execute an
+// inline string must not receive one — `python -c` and `node -e` are the
+// shell -c equivalents that would otherwise nullify the allowlist.
+const CODE_RUNNER_FLAGS: Record<string, string[]> = {
+  python: ["-c", "--command"],
+  py: ["-c", "--command"],
+  node: ["-e", "--eval", "-p", "--print", "--repl"]
+};
+
+export function isCodeRunnerFlag(bin: string, token: string): boolean {
+  const name = normalizeBin(bin).replace(/\.(exe|cmd|bat)$/i, "");
+  const flags = CODE_RUNNER_FLAGS[name];
+  if (!flags) return false;
+  if (token.startsWith("--")) {
+    const eq = token.indexOf("=");
+    return flags.includes(eq > 0 ? token.slice(0, eq) : token);
+  }
+  // A short option may carry its value attached: -ccode, -ecode.
+  if (token.startsWith("-") && token.length > 2) return flags.includes(token.slice(0, 2));
+  return flags.includes(token);
+}
+
+function refusedCodeRunner(token: string): CommandResult {
+  return { ok: false, status: null, stdout: "", stderr: "", error: `refused code-runner flag: ${token}` };
+}
+
 export function runScript(argv: string[]): CommandResult {
   if (argv.length === 0) return refused("");
   const [bin, ...args] = argv;
   if (!SAFE_TOKEN.test(bin)) return refused(bin);
   if (!bootstrapBinAllowed(bin)) return refusedBootstrap(bin);
+  for (const arg of args) {
+    if (arg.length === 0) return refused("");
+    if (isCodeRunnerFlag(bin, arg)) return refusedCodeRunner(arg);
+    if (!SAFE_TOKEN.test(arg)) return refused(arg);
+  }
   const result = spawnSync(bin, args, { encoding: "utf8", windowsHide: true, shell: false });
   return resultFrom(result.status, result.stdout ?? "", result.stderr ?? "", result.error?.message);
 }

package/src/gate-repair.ts

@@ -0,0 +1,87 @@
+// Auto-repair for gate FAIL results.
+//
+// When the gate denies a tool call because required skills are not loaded,
+// the denial must be actionable: parse the structured FAIL payload and build
+// a directive the agent executes immediately (load the named skills, retry
+// the exact same call, resume the user's task) without asking the user and
+// without bypassing the gate.
+//
+// Design guardrails:
+// - Fail-closed: this only rewrites the denial message. It never grants the
+//   call. The retry passes only when the gate CLI itself sees the skills.
+// - Attempt tracking: repeating the identical failure means the skill()
+//   loads did not register (skill not installed, index stale) — the message
+//   escalates to a diagnosis instead of looping forever.
+// - No bypass: the directive never mentions NOVAHIZ_GATE or an alternate
+//   tool as a remedy.
+
+export type GateFailure = {
+  tool: string;
+  missingSkills: string[];
+  reasons: string[];
+  error: string | null;
+};
+
+/**
+ * Parse the JSON printed by `novahiz gate` on exit 2. Returns null when the
+ * payload is not readable — the caller then falls back to the raw stdout.
+ */
+export function parseGateFailure(stdout: string): GateFailure | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const record = parsed as Record<string, unknown>;
+  const asStringArray = (value: unknown): string[] =>
+    Array.isArray(value)
+      ? value.filter((entry): entry is string => typeof entry === "string")
+      : [];
+  const tool = typeof record.tool === "string" && record.tool.length > 0 ? record.tool : "tool";
+  return {
+    tool,
+    missingSkills: asStringArray(record.missingSkills),
+    reasons: asStringArray(record.reasons),
+    error: typeof record.error === "string" ? record.error : null
+  };
+}
+
+/**
+ * Build the actionable denial for a gate failure.
+ *
+ * attempt 1  — missing skills: the repair protocol (load, retry, resume).
+ * attempt 2+ — the same skills are still missing: the loads did not take
+ *              effect, so the directive escalates to diagnosis and stops
+ *              the loop instead of repeating itself.
+ */
+export function buildRepairDirective(failure: GateFailure, attempt: number): string {
+  const head = `Novahiz gate blocked ${failure.tool}.`;
+  const missing = failure.missingSkills;
+
+  if (missing.length === 0) {
+    // Nothing the agent can repair by loading — state the reasons and stop.
+    const detail = failure.error ?? failure.reasons.join("; ") ?? "no reason reported";
+    return `${head}\nBlocked by rule, not by a missing skill: ${detail}\nResolve the listed rule, then retry once. Never bypass the gate.`;
+  }
+
+  if (attempt <= 1) {
+    const steps = missing.map((skill, index) => `  ${index + 1}. skill({name:"${skill}"})`).join("\n");
+    return [
+      `${head} Missing skills: ${missing.join(", ")}.`,
+      "AUTO-REPAIR — execute now, do not ask the user, do not stop:",
+      steps,
+      `  ${missing.length + 1}. Retry this exact ${failure.tool} call once, then continue the user's task where it left off.`,
+      "Never bypass the gate: no NOVAHIZ_GATE, no alternate tool, no shell write, no editing around the block."
+    ].join("\n");
+  }
+
+  return [
+    `${head} AUTO-REPAIR FAILED on attempt ${attempt}: still missing ${missing.join(", ")} after skill() loads.`,
+    "The loads did not register — diagnose instead of retrying:",
+    "  1. Confirm the skill is installed and the index matches (`novahiz doctor`).",
+    "  2. Realign the index (`novahiz sync`), then load the named skills again.",
+    "If the skill genuinely does not exist, report that honestly to the user and stop. Never bypass the gate."
+  ].join("\n");
+}

package/src/gate.ts

@@ -1,6 +1,13 @@
 import type { Rule, Spec } from "./spec.ts";
 import { hasPlaceholder, hasProse, hasStyle, isTrivial } from "./content.ts";
 import { determineTier, type ComplexityTier } from "./complexity.ts";
+// Shared ledger enforcement (audit P1-D/M1): the CLI command and the MCP
+// novahiz_gate tool both run these checks so their verdicts cannot diverge.
+import { activeTask, recordEdit, reviewBlockReason, reviewDue, traceCheck } from "./ledger.ts";
+import { autoCommit } from "./graft.ts";
+import type { openDb } from "./db.ts";
+
+type GateDb = ReturnType<typeof openDb>;
 
 type FileClass = "code" | "text" | "design" | "data" | "config" | "other";
 
@@ -204,34 +211,57 @@ export function contentSatisfies(content: string, patterns: string[]): boolean {
   });
 }
 
-function selectorMatches(rule: Rule, classification: FileClass, path: string, categories: string[]): boolean {
+function selectorMatches(rule: Rule, classification: FileClass, path: string, categories: string[], pathless = false): boolean {
   const when = rule.when;
   const checks: boolean[] = [];
-  if (when.fileClasses && when.fileClasses.length > 0) checks.push(when.fileClasses.includes(classification));
-  if (when.pathGlobs && when.pathGlobs.length > 0) checks.push(when.pathGlobs.some((glob) => globToRegExp(glob).test(path)));
-  if (when.promptCategories && when.promptCategories.length > 0) {
+  if (pathless) {
+    // MAJEUR l.135: with no target path, only prompt-scoped selectors can
+    // apply. Path/file rules are skipped silently — there is no path to test
+    // and the absence is not the misconfiguration M1 warns about.
+    if (!when.promptCategories || when.promptCategories.length === 0) return false;
     checks.push(when.promptCategories.some((category) => categories.includes(category)));
-  }
-  // M1: a rule with no selectors must match nothing, not everything.
-  // An empty `when` is a misconfiguration — fail closed, not open.
-  if (checks.length === 0) {
-    console.error(`[Novahiz] rule "${rule.id}" has empty selectors — it will never match`);
-    return false;
+  } else {
+    if (when.fileClasses && when.fileClasses.length > 0) checks.push(when.fileClasses.includes(classification));
+    if (when.pathGlobs && when.pathGlobs.length > 0) checks.push(when.pathGlobs.some((glob) => globToRegExp(glob).test(path)));
+    if (when.promptCategories && when.promptCategories.length > 0) {
+      checks.push(when.promptCategories.some((category) => categories.includes(category)));
+    }
+    // M1: a rule with no selectors must match nothing, not everything.
+    // An empty `when` is a misconfiguration — fail closed, not open.
+    if (checks.length === 0) {
+      console.error(`[Novahiz] rule "${rule.id}" has empty selectors — it will never match`);
+      return false;
+    }
   }
   // Default to "all" — all selectors must match. This is the safe default:
   // a rule with fileClasses + promptCategories requires BOTH to match.
   return when.match === "any" ? checks.some(Boolean) : checks.every(Boolean);
 }
 
+// C3: files whose content defines what the gate requires. They live under
+// build/ but must never be treated as ignored build output.
+const PROTECTED_INDEX_SUFFIXES = ["/build/installed-skills.json", "/build/catalog.json"];
+
+function isProtectedIndexPath(path: string): boolean {
+  return PROTECTED_INDEX_SUFFIXES.some((suffix) => path === suffix.slice(1) || path.endsWith(suffix));
+}
 type GateInput = {
   tool: string;
   filePath: string;
   content?: string;
+  /** C1: user prompt that triggered the edit. The complexity tier is
+   * computed from it when present — the edited content alone under-reports
+   * how much pipeline a short edit of a complex request needs. */
+  prompt?: string;
   categories?: string[];
   loadedSkills?: string[];
   installedSkills?: ReadonlySet<string> | null;
   installedIndexAvailable?: boolean;
   tier?: ComplexityTier;
+  /** MAJEUR l.135: true when the caller has no target path (bash/shell/cron
+   * with no detectable file). Only prompt-scoped selectors are evaluated;
+   * path/file rules cannot match and are skipped without the M1 warning. */
+  pathless?: boolean;
   spec: Spec;
 };
 
@@ -255,9 +285,18 @@ export function evaluateGate(input: GateInput): GateResult {
   const categories = input.categories ?? [];
   const path = input.filePath.replace(/\\/g, "/");
   const content = input.content ?? "";
+  // MAJEUR l.135: a pathless call (bash/shell/cron without a target) evaluates
+  // prompt-scoped rules only and never consults path-based ignore globs.
+  const pathless = input.pathless === true;
 
   try {
-    const ignored = input.spec.config.gate.ignoreFiles.some((glob) => globToRegExp(glob).test(path));
+    // C3: the skill index lives under build/ (matched by the default
+    // **/build/** ignore glob). Editing it must never bypass the gate —
+    // dropping a skill from the index would silently un-require it.
+    const ignored =
+      !pathless &&
+      !isProtectedIndexPath(path) &&
+      input.spec.config.gate.ignoreFiles.some((glob) => globToRegExp(glob).test(path));
     if (ignored) {
       return {
         allow: true,
@@ -277,13 +316,16 @@ export function evaluateGate(input: GateInput): GateResult {
 
     // H3: Determine complexity tier BEFORE rule evaluation so that trivial
     // prompts can skip Novahiz-specific rules entirely.
-    const tier = input.tier ?? determineTier(content);
+    // C1: compute the tier from the user prompt when available; content is
+    // only a fallback for callers that do not carry a prompt (probes).
+    const prompt = (input.prompt ?? "").trim();
+    const tier = input.tier ?? determineTier(prompt.length > 0 ? prompt : content);
 
     const requiredSkills: string[] = [];
     const matchedRules: string[] = [];
 
     for (const rule of input.spec.rules) {
-      if (!selectorMatches(rule, classification, path, categories)) continue;
+      if (!selectorMatches(rule, classification, path, categories, pathless)) continue;
       // Tier gating for R6-Novahiz: trivial = skip entirely, lite = only implement+converge
       if (rule.id === "R6-Novahiz") {
         if (tier === "trivial") continue;
@@ -303,7 +345,14 @@ export function evaluateGate(input: GateInput): GateResult {
       // For contentExcludes: regex error → treat as "exclude matched" → skip rule.
       // For contentMatches: regex error → treat as "match succeeded" → apply rule.
       if (rule.when.contentExcludes) {
-        try { if (contentSatisfies(content, rule.when.contentExcludes)) continue; } catch { continue; }
+        try {
+          if (contentSatisfies(content, rule.when.contentExcludes)) continue;
+        } catch {
+          // MINEUR#1: an invalid exclude pattern must never disable the rule
+          // (the old `continue` was a silent fail-open). Fail closed instead:
+          // apply the rule and surface the catalogue bug on stderr.
+          console.error(`[Novahiz] rule "${rule.id}": invalid contentExcludes pattern — applying the rule anyway`);
+        }
       }
       if (rule.when.contentMatches) {
         try { if (!contentSatisfies(content, rule.when.contentMatches)) continue; } catch { /* fail-closed: apply rule */ }
@@ -366,6 +415,11 @@ export function evaluateGate(input: GateInput): GateResult {
 
     const reasons: string[] = [];
     for (const skill of missingSkills) reasons.push(`missing skill: ${skill}`);
+    // C3: an index gap must be visible, not silent. The skill is not enforced
+    // (kept out of requiredSkills) — say so loudly so a sync gets triggered.
+    for (const skill of unmatchedRequired) {
+      reasons.push(`required skill not in index, not enforced: ${skill} — run "novahiz" sync to realign`);
+    }
     if (placeholder) reasons.push("placeholder marker found in content");
 
     return {
@@ -399,3 +453,91 @@ export function evaluateGate(input: GateInput): GateResult {
     };
   }
 }
+
+// Ledger + trace enforcement shared by the CLI gate command and the MCP
+// novahiz_gate tool (audit P1-D/M1): same checks and the same log rows, so the
+// two entry points cannot drift apart. Mutates results[].allow exactly like
+// the original CLI block; returns aggregate reasons and the review warning.
+export function enforceLedgerChecks(
+  db: GateDb,
+  input: {
+    session: string;
+    tool: string;
+    paths: string[];
+    categories: string[];
+    results: (GateResult & { path: string })[];
+    spec: Spec;
+    gateConfig: Spec["config"]["gate"];
+  }
+): { reasons: string[]; reviewWarning: string } {
+  const { session, tool, paths, categories, results, spec, gateConfig } = input;
+  const reasons: string[] = [];
+  let reviewWarning = "";
+
+  const traceConfig = gateConfig.trace;
+  const traceRequired =
+    traceConfig?.enabled === true &&
+    session.length > 0 &&
+    categories.some((category) => traceConfig.categories.includes(category));
+  if (traceRequired) {
+    for (const entry of results) {
+      // MAJEUR l.135: a pathless entry (bash/shell/cron with no target) has
+      // no file to trace — skip the per-path check, keep the log row below.
+      if (entry.path.length === 0) continue;
+      const trace = traceCheck(db, { sessionId: session, filePath: entry.path, required: true });
+      if (!trace.ok) {
+        entry.allow = false;
+        reasons.push(trace.reason);
+      }
+    }
+  }
+
+  const ledgerConfig = spec.config.ledger;
+  if (ledgerConfig?.enabled !== false) {
+    const task = activeTask(db, session || undefined);
+    if (task) {
+      if (["edit", "write", "patch", "apply_patch"].includes(tool)) recordEdit(db, task.id);
+      // Targeted review: block only paths owned by an open todo with an owner
+      // pattern. A due review no longer freezes every target.
+      for (const entry of results) {
+        // MAJEUR l.135: no path means no todo owner can claim it — a
+        // pathless command must not be blocked by a file-ownership check.
+        if (entry.path.length === 0) continue;
+        const reason = reviewBlockReason(db, task.id, entry.path, ledgerConfig.review);
+        if (reason && !entry.ignored) {
+          entry.allow = false;
+          entry.reasons.push(reason);
+        }
+      }
+      if (results.some((entry) => entry.reasons.some((reason) => reason.startsWith("plan review due")))) {
+        reasons.push(reviewDue(db, task.id, ledgerConfig.review).reason);
+      } else if (reviewDue(db, task.id, ledgerConfig.review).due) {
+        reviewWarning = reviewDue(db, task.id, ledgerConfig.review).reason;
+      }
+    }
+  }
+
+  const currentAllow = results.every((entry) => entry.allow);
+  if (session.length > 0) {
+    const missing = [...new Set(results.flatMap((entry) => entry.missingSkills))];
+    db.prepare(
+      "INSERT INTO enforcement_log (session_id, tool, file_path, file_class, decision, missing, matched_rules, logged_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)"
+    ).run(
+      session,
+      tool,
+      paths.join(","),
+      results[0]?.fileClass ?? "other",
+      currentAllow ? "allow" : gateConfig.mode === "block" ? "block" : gateConfig.mode,
+      JSON.stringify(missing),
+      JSON.stringify(results.flatMap((entry) => entry.matchedRules)),
+      new Date().toISOString()
+    );
+    try {
+      autoCommit("enforcement", `${currentAllow ? "allow" : "block"} ${tool}`);
+    } catch {
+      // autoCommit failures are non-critical; the enforcement is logged regardless
+    }
+  }
+
+  return { reasons, reviewWarning };
+}

package/src/graft.ts

@@ -5,30 +5,41 @@
  * Auto-commit is handled by calling `commitGraft()` from ledger operations.
  */
 import { execFileSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { resolve } from "node:path";
+import { copyFileSync, existsSync } from "node:fs";
+import { isAbsolute, resolve, sep } from "node:path";
 import { NovahizHome } from "./spec.ts";
 
 // ── Graft binary resolution ──────────────────────────────────────────────────
 // Graft is expected on PATH. If not found, we degrade gracefully (no-op).
 
-let _graftBinary: string | null = null;
+let _graftBinary: string | null = null; // null = not resolved yet, "" = resolved but absent
 
-function graftBinary(): string {
-  if (_graftBinary !== null) return _graftBinary;
-  // Try common locations on Windows where npm global bin lives
-  const candidates = ["graft", "graft.exe"];
-  for (const c of candidates) {
-    try {
-      execFileSync(c, ["--version"], { stdio: "pipe", timeout: 5000 });
-      _graftBinary = c;
-      return _graftBinary;
-    } catch {
-      // not found, try next
+function graftBinary(): string | null {
+  if (_graftBinary !== null) return _graftBinary || null;
+  const override = process.env.NOVAHIZ_GRAFT_BIN;
+  if (override) {
+    const abs = resolve(override);
+    if (existsSync(abs)) {
+      _graftBinary = abs;
+      return abs;
+    }
+  }
+  const isWin = process.platform === "win32";
+  const names = isWin ? ["graft.cmd", "graft.exe", "graft"] : ["graft"];
+  const delimiter = isWin ? ";" : ":";
+  for (const raw of (process.env.PATH ?? "").split(delimiter)) {
+    const dir = raw.trim();
+    if (dir === "" || !isAbsolute(dir)) continue;
+    for (const name of names) {
+      const candidate = resolve(dir, name);
+      if (existsSync(candidate)) {
+        _graftBinary = candidate;
+        return candidate;
+      }
     }
   }
-  _graftBinary = "graft"; // fallback — will fail with clear error
-  return _graftBinary;
+  _graftBinary = "";
+  return null;
 }
 
 // ── Helpers ──────────────────────────────────────────────────────────────────
@@ -46,6 +57,7 @@ function ledgerPath(): string {
 
 function runGraft(args: string[], opts?: { timeout?: number }): string {
   const bin = graftBinary();
+  if (!bin) throw new Error("graft not found on PATH (install @eidos.space/graft or set NOVAHIZ_GRAFT_BIN)");
   const db = ledgerPath();
   const fullArgs = ["--db", db, ...args];
   try {
@@ -67,8 +79,10 @@ function runGraft(args: string[], opts?: { timeout?: number }): string {
 
 /** Check if graft CLI is available on PATH. */
 export function isGraftAvailable(): boolean {
+  const bin = graftBinary();
+  if (!bin) return false;
   try {
-    execFileSync(graftBinary(), ["--version"], { stdio: "pipe", timeout: 5000 });
+    execFileSync(bin, ["--version"], { stdio: "pipe", timeout: 5000 });
     return true;
   } catch {
     return false;
@@ -90,7 +104,9 @@ export function initGraft(): { success: boolean; message: string } {
   }
   try {
     // graft init creates .graft/ in cwd
-    execFileSync(graftBinary(), ["init"], {
+    const bin = graftBinary();
+    if (!bin) return { success: false, message: "graft CLI not found on PATH" };
+    execFileSync(bin, ["init"], {
       stdio: "pipe",
       timeout: 10_000,
       cwd: NovahizHome(),
@@ -177,13 +193,22 @@ export function getGraftStatus(): string {
 }
 
 /** Restore the ledger to a specific revision. */
-export function restoreGraft(revision: string): { success: boolean; message: string } {
+export function restoreGraft(revision: string, opts?: { force?: boolean }): { success: boolean; message: string } {
   if (!isGraftAvailable() || !isGraftInitialized()) {
     return { success: false, message: "graft not initialized" };
   }
+  if (!opts?.force) {
+    return {
+      success: false,
+      message:
+        "refuses to overwrite the ledger without --force; re-run as `novahiz graft restore <hash> --force` (a backup is written first)",
+    };
+  }
   try {
+    const db = ledgerPath();
+    if (existsSync(db)) copyFileSync(db, `${db}.backup-${Date.now()}`);
     runGraft(["checkout", revision]);
-    return { success: true, message: `restored to ${revision}` };
+    return { success: true, message: `restored to ${revision} (backup kept next to the ledger)` };
   } catch (err: unknown) {
     const message = err instanceof Error ? err.message : String(err);
     return { success: false, message: `restore failed: ${message}` };
@@ -191,13 +216,21 @@ export function restoreGraft(revision: string): { success: boolean; message: str
 }
 
 /** Export a snapshot of the ledger as a physical .sqlite file. */
-export function exportGraft(revision: string, outputPath: string): { success: boolean; message: string } {
+export function exportGraft(revision: string, outputPath: string, opts?: { force?: boolean }): { success: boolean; message: string } {
   if (!isGraftAvailable() || !isGraftInitialized()) {
     return { success: false, message: "graft not initialized" };
   }
+  const target = resolve(outputPath);
+  const allowed = [resolve(NovahizHome()), resolve(process.cwd())];
+  if (!allowed.some((r) => target === r || target.startsWith(r + sep))) {
+    return { success: false, message: `export path outside the workspace refused: ${outputPath}` };
+  }
+  if (existsSync(target) && !opts?.force) {
+    return { success: false, message: `export path already exists: ${target} (pass --force to overwrite)` };
+  }
   try {
-    runGraft(["export", revision, "--output", outputPath]);
-    return { success: true, message: `exported to ${outputPath}` };
+    runGraft(["export", revision, "--output", target]);
+    return { success: true, message: `exported to ${target}` };
   } catch (err: unknown) {
     const message = err instanceof Error ? err.message : String(err);
     return { success: false, message: `export failed: ${message}` };

package/src/ledger.ts

@@ -1,5 +1,5 @@
 import type { DatabaseSync } from "node:sqlite";
-import { globToRegExp } from "./gate.ts";
+import { globToRegExp, isSafeRegexPattern } from "./gate.ts";
 import { autoCommit } from "./graft.ts";
 
 export type TodoKind = "read" | "edit" | "verify" | "delegate";
@@ -311,7 +311,9 @@ export function ownedBy(todo: TodoRow, filePath: string): boolean {
     .split(",")
     .map((part) => part.trim())
     .filter(Boolean)
-    .some((pattern) => globToRegExp(pattern).test(normalized));
+    // P2-C (LOW): owner globs come from todo labels; reject nested-quantifier
+    // shapes before compiling so a crafted owner cannot ReDoS every edit check.
+    .some((pattern) => isSafeRegexPattern(pattern) && globToRegExp(pattern).test(normalized));
 }
 
 export function traceCheck(db: DatabaseSync, options: { sessionId?: string; filePath: string; required: boolean }): TraceResult {
@@ -531,10 +533,18 @@ export function reviewTask(db: DatabaseSync, options: { taskId: string } & Revie
     for (const item of removals) {
       const id = typeof item === "string" ? item : item.id;
       const reason = typeof item === "string" ? "" : item.reason ?? "";
+      const target = getTodo(db, id);
+      if (!target || target.task_id !== options.taskId) {
+        throw new Error(`review removal targets a todo outside this task: ${id}`);
+      }
       dropTodo(db, id, reason);
     }
     for (const change of amendments) {
       const { id, ...patch } = change;
+      const target = getTodo(db, id);
+      if (!target || target.task_id !== options.taskId) {
+        throw new Error(`review amendment targets a todo outside this task: ${id}`);
+      }
       amendTodo(db, id, patch);
     }
     for (const item of additions) insertTodo(db, options.taskId, item, "end");