pi-aia-asf 0.17.11 → 0.17.12

package/CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.17.12] - 2026-11-10
+
+### Fixed — the health gate measured the wrong project
+
+`runRoot()` is the git root of the session's cwd. That is right for where run state
+lives and wrong for what to measure, and a session launched from a home directory that
+is itself a git repo (common: `pi` started from $HOME with checkouts underneath) had
+every health gate measure the parent. It did: `asf_health` reported 363 model findings
+from an unrelated project checked out under $HOME, and eslint, madge and jscpd each
+timed out at 120s scanning a tree nobody was working in — a verdict of NOT healthy on a
+repository that is, in fact, healthy.
+
+A gate that measures the wrong directory is worse than no gate: it blocks on findings
+in code the run must not touch, or waves through the one project that is actually
+unhealthy. `measureRoot()` now answers from what the run already knows — the git root of
+the most recently touched file — and is used by the three paths that measure
+(`asf_health`, `/asf health`, `/asf verify` Gate 8). It is deliberately **not** used to
+locate state: a root that moved mid-run would orphan the run's own ledger, so
+`runRoot()` still follows the session for that.
+
+A touched path outside the workspace (a scratch dir, an unrelated checkout) does not
+move the measurement either — the session root is the safe answer. `test/test-measure-root.mjs`
+pins both on throwaway repos rather than this machine's $HOME, and both guards are
+mutation-caught.
+
 ## [0.17.11] - 2026-11-10
 
 ### Added — the coverage invariant is checkable from the installed package

package/lib/extension/commands/inspect.ts

@@ -7,7 +7,7 @@ import { projectName, runRoot } from "../paths.ts";
 import { loadState } from "../state.ts";
 import { ledger, authority, gateStats } from "../gate-state.ts";
 import { runtime } from "../runtime.ts";
-import { cardFor, collectMeasurements, extensionDir } from "../run.ts";
+import { cardFor, collectMeasurements, extensionDir, measureRoot } from "../run.ts";
 import { renderLedger } from "../../gates/ledger.mjs";
 import { renderAuthority } from "../../gates/authority.mjs";
 import { renderCompletionGate } from "../../gates/settle.mjs";
@@ -41,7 +41,7 @@ export async function cmdStatus(): Promise<string> {
 export async function cmdHealth(args: string[]): Promise<string> {
   const { runHealth } = await import("../../code-health/index.mjs");
   const { recordHealthVerdict, recordLine } = await import("../health-record.ts");
-  const res = await runHealth(runRoot(), args.slice(1));
+  const res = await runHealth(await measureRoot(), args.slice(1));
   // The command records what it measured. Before this, only the asf_health TOOL
   // recorded: a human could run /asf health, read HEALTHY, and leave the
   // completion gate's health gap open with no trace that anything was measured.

package/lib/extension/commands/verify.ts

@@ -6,6 +6,7 @@
  */
 
 import { projectName, runRoot } from "../paths.ts";
+import { measureRoot } from "../run.ts";
 import { loadState } from "../state.ts";
 import { loadProjectSpecs, validateTrace } from "../specs.ts";
 import { QA_CHECKLIST, type SpecItem } from "../types.ts";
@@ -56,7 +57,7 @@ async function traceabilitySection(): Promise<string[]> {
 async function healthSection(): Promise<string[]> {
   const { runHealth } = await import("../../code-health/index.mjs");
   const { recordHealthVerdict, recordLine } = await import("../health-record.ts");
-  const health = await runHealth(runRoot(), []);
+  const health = await runHealth(await measureRoot(), []);
   // Same rule as the tool and the slash command: a measurement that is produced
   // is a measurement that is recorded.
   const rec = recordHealthVerdict(health, { by: "verify" });

package/lib/extension/run.ts

@@ -4,16 +4,16 @@
  */
 
 import { execFileSync } from "node:child_process";
+import { runRoot, projectName } from "./paths.ts";
 import { fileURLToPath } from "node:url";
 import { dirname } from "node:path";
-import { runRoot } from "./paths.ts";
+import { projectRoot as projectRootOf } from "../project.mjs";
 import { ensureHome } from "../home.mjs";
 import { cpus, loadavg } from "node:os";
 import { renderRunCard, cardSummary, CARD_CEILING_BYTES } from "../run-card.mjs";
 import { ledger, suiteRuns, gateStats } from "./gate-state.ts";
 import { appendEvidence } from "./evidence.ts";
 import { loadState, saveState } from "./state.ts";
-import { projectName } from "./paths.ts";
 import { runtime } from "./runtime.ts";
 import { __resetRefusals } from "../gates/refusals.mjs";
 import { cardIndex, registerAt } from "../decisions/consult.mjs";
@@ -118,6 +118,43 @@ export async function openAutoRun(trigger: string, path: string | null): Promise
   return state;
 }
 
+/**
+ * The project the gates should MEASURE.
+ *
+ * `runRoot()` is the git root of the session's cwd, which is right for where state
+ * lives and wrong for what to measure: a session started in a parent repository
+ * (a home directory that is itself a git repo is the common case) would have every
+ * gate measure that parent. It did — `asf_health` reported 363 model findings from an
+ * unrelated project checked out underneath $HOME, and every measurement tool then
+ * timed out scanning a tree nobody was working in. A gate that measures the wrong
+ * directory is worse than no gate: it blocks on findings in code the run must not
+ * touch, or waves through the one project that is actually unhealthy.
+ *
+ * The run already knows what it changed, so the answer is taken from there: the git
+ * root of the most recently touched file wins. It is deliberately NOT used to locate
+ * state — a root that moved mid-run would orphan the run's own ledger — only to
+ * decide what a measurement looks at.
+ */
+export async function measureRoot(): Promise<string> {
+  const fallback = runRoot();
+  try {
+    const state = await loadState(projectName());
+    const touched = (state?.current?.filesTouched || []) as string[];
+    for (let i = touched.length - 1; i >= 0; i--) {
+      const f = touched[i];
+      if (!f || !f.includes("/")) continue;
+      const root = projectRootOf(dirname(f));
+      // Only a root that CONTAINS the session root counts as a better answer: a
+      // stray touched path outside the workspace must not drag the measurement to
+      // someone's scratch directory.
+      if (root && (root === fallback || root.startsWith(fallback + "/"))) return root;
+    }
+  } catch {
+    /* measurement falls back to the session root; a broken guess is worse than none */
+  }
+  return fallback;
+}
+
 /** Where this extension is installed — the declaration file ships beside it. */
 
 export function extensionDir(): string {

package/lib/extension/tools/health.ts

@@ -27,12 +27,12 @@ interface HealthResult {
 
 async function runHealthGate(scope: string): Promise<HealthResult> {
   const { runHealth } = await import("../../code-health/index.mjs");
-  const { runRoot } = await import("../paths.ts");
+  const { measureRoot } = await import("../run.ts");
   const args = scope ? [`--scope=${scope}`] : [];
-  // Measure the RUN's project, not process.cwd(): a session started in $HOME
-  // (or any parent) would otherwise measure everything under it — 960 phantom
-  // findings from site-packages, on a repo that is actually healthy.
-  return (await runHealth(runRoot(), args)) as HealthResult;
+  // Measure the project the RUN is about, not process.cwd() and not the session
+  // cwd's git root: a session started in $HOME (which is itself a repo here) would
+  // otherwise measure every checkout underneath it.
+  return (await runHealth(await measureRoot(), args)) as HealthResult;
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-aia-asf",
-  "version": "0.17.11",
+  "version": "0.17.12",
   "description": "Ai Applied Agentic Software Factory — codifies the full software development flow: intake, research, spec capture, adversarial analysis, planning with approval gates, test-first implementation, and release. Requires pi-vigilant, pi-smart-web-search, pi-smart-fetch, and pi-aia-browser.",
   "keywords": [
     "pi-package",