plumbbob 0.9.5 → 0.10.0

package/dist/verbs/turn.js

@@ -1,16 +1,16 @@
-// `plumbbob turn` — the turn-ledger hook. Wired to the harness's
+// `plumbbob turn`: the turn-ledger hook. Wired to the harness's
 // UserPromptSubmit event, it runs once per human prompt and maintains two of the
 // sidecar's git-excluded control files (flat files under `.plumbbob/`): it ticks
 // `TURN`, the monotonic count of human turns the checkpoint latch compares
 // against a step's entry stamp to know a human turn intervened since the step
-// began, and it rewrites `GRANT` from the literal prompt — minting a one-turn
+// began, and it rewrites `GRANT` from the literal prompt, minting a one-turn
 // self-approval only when the human typed `/build --auto` or an `N-M` step
 // range, clearing it otherwise (those strings can only come from a human
-// keystroke, because `build` is disable-model-invocation — a grant the model
+// keystroke, because `build` is disable-model-invocation: a grant the model
 // could forge would be no grant). When a step is in flight it also emits ONE
 // `UserPromptSubmit` additionalContext line so a fresh session (post-compaction,
 // or a scripted `-p` turn where no skill prose is in context) still knows the
-// beat — a tangent is parked, not chased. Guidance only: it blocks nothing. It
+// beat: a tangent is parked, not chased. Guidance only: it blocks nothing. It
 // ALWAYS exits 0 and any failure degrades to no output, so neither the tick nor
 // the emit can ever wedge prompting.
 import { readFileSync, writeFileSync } from 'node:fs';
@@ -18,7 +18,7 @@ import { findSessionRoot, setGrant, stepPath, turnPath } from "../lib/sidecar.js
 /**
  * The hook entry point: apply the tick, then emit the in-flight-step nudge.
  *
- * Always returns 0 — a broken turn must never wedge a prompt, so any failure is
+ * Always returns 0: a broken turn must never wedge a prompt, so any failure is
  * swallowed and degrades to no output.
  */
 export function turn(cwd, _args) {
@@ -29,7 +29,7 @@ export function turn(cwd, _args) {
             process.stdout.write(context);
     }
     catch {
-        // A broken turn must never wedge a prompt — swallow and exit 0.
+        // A broken turn must never wedge a prompt: swallow and exit 0.
     }
     return 0;
 }
@@ -59,7 +59,7 @@ export function stepInFlightContext(cwd) {
  * The in-flight step number, or null when no STEP marker is present.
  *
  * Absent means no step entered, or it already checkpointed. A garbled marker
- * reads as null — never an error, because the hook must not wedge a prompt.
+ * reads as null (never an error), because the hook must not wedge a prompt.
  */
 function inFlightStep(root) {
     try {
@@ -73,14 +73,14 @@ function inFlightStep(root) {
 /**
  * The testable core: apply one tick given the raw hook stdin.
  *
- * Split from the fd-0 read so the unit tests can drive it directly — an
+ * Split from the fd-0 read so the unit tests can drive it directly: an
  * in-process test cannot feed fd 0 (the same constraint checkpoint's `--body`
  * lives under).
  */
 export function applyTurn(cwd, raw) {
     const root = findSessionRoot(cwd);
     if (root === null)
-        return 0; // no active session above cwd — silent no-op.
+        return 0; // no active session above cwd: silent no-op.
     writeFileSync(turnPath(root), `${readTurn(root) + 1}\n`);
     setGrant(root, grantFromPrompt(extractPrompt(raw)));
     return 0;
@@ -90,7 +90,7 @@ export function applyTurn(cwd, raw) {
  *
  * A grant is minted only from a literal `build` invocation the human typed:
  * `build` is disable-model-invocation, so this string can only come from a
- * human keystroke, never model-authored pressure — a grant the model can forge
+ * human keystroke, never model-authored pressure: a grant the model can forge
  * is no grant. A bounded range beats `--auto` (bounded wins); a bare
  * `/build`, or any non-invocation prompt, mints nothing. The namespaced
  * `/plumbbob:build` form is honored alongside the bare one.
@@ -101,10 +101,10 @@ export function applyTurn(cwd, raw) {
  *
  * Only the invocation's own arguments can mint: the tokens that follow it on
  * its line, up to the first token that isn't a sanctioned argument (`--auto`, a
- * step number, or a range — the argument-hint sanctions nothing else). An
+ * step number, or a range; the argument-hint sanctions nothing else). An
  * unrecognized flag ends the scan, so `/build --wip 2020-2024` mints
- * nothing — the `2020-2024` is never reached. An incidental range elsewhere in
- * the prompt — an issue number, a pasted `2020-2024` — is prose, not a grant.
+ * nothing: the `2020-2024` is never reached. An incidental range elsewhere in
+ * the prompt (an issue number, a pasted `2020-2024`) is prose, not a grant.
  * Trailing sentence punctuation on an argument (`/build 1-3.`) is still the
  * argument the human typed.
  */
@@ -129,8 +129,8 @@ export function grantFromPrompt(prompt) {
             continue;
         }
         if (/^\d+$/.test(word))
-            continue; // a bare step number — keep scanning for a range/--auto
-        break; // an unrecognized flag or free text — the arguments have ended
+            continue; // a bare step number: keep scanning for a range/--auto
+        break; // an unrecognized flag or free text: the arguments have ended
     }
     if (ceiling !== undefined)
         return `range ${ceiling}`;
@@ -170,7 +170,7 @@ function readTurn(root) {
  * Read the hook JSON from fd 0, degrading to '' on any failure.
  *
  * An interactive TTY never sends EOF, so skip the read there rather than hang
- * (mirrors checkpoint's `--body`); a read error degrades to '' — extractPrompt
+ * (mirrors checkpoint's `--body`); a read error degrades to '': extractPrompt
  * then clears the grant and the tick still lands.
  */
 function readStdin() {

package/dist/verbs/use.js

@@ -1,10 +1,10 @@
-// `plumbbob use <slug>` — re-point the active-build cursor at an existing build
+// `plumbbob use <slug>`: re-point the active-build cursor at an existing build
 // and resume it, `nvm use`-shaped: switching and resuming are the same one word.
 // The cursor is the single-line content of `.plumbbob/STATE`, the untracked
 // per-worktree file whose existence means a session is live and whose one line
-// names the build that session is on — so pointing it elsewhere IS the switch,
+// names the build that session is on, so pointing it elsewhere IS the switch,
 // and one-active-per-worktree holds by construction (one line cannot name two
-// builds). It validates the target folder exists, and warns — but allows —
+// builds). It validates the target folder exists, and warns (but allows)
 // leaving a build with a step in flight: the in-flight markers live per build,
 // so that state survives the switch and resumes the next time you `use` the
 // build.
@@ -15,7 +15,7 @@ import { activeBuild, hasSession, intentPath, listBuilds, setActiveBuild, stepPa
  * Switch the active-build cursor to the named build.
  *
  * Refuses without a session, without a slug, or when the target folder has no
- * intent.md; notes — but allows — a step left in flight on the build being left.
+ * intent.md; notes (but allows) a step left in flight on the build being left.
  */
 export function use(cwd, args) {
     const root = findRepoRoot(cwd);

package/node_modules/checkride/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "checkride",
   "displayName": "checkride",
-  "version": "0.10.2",
+  "version": "0.12.2",
   "description": "Bounded, contract-aware readers for what checkride already writes: triage a red gate and read quality signal without loading megabytes of raw artifacts.",
   "author": { "name": "Rob McLarty", "email": "hello@robmclarty.com", "url": "https://robmclarty.com" },
   "homepage": "https://robmclarty.github.io/checkride/",

package/node_modules/checkride/CHANGELOG.md

@@ -4,6 +4,400 @@ All notable changes to this project are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.12.2] - 2026-08-12
+
+### Added
+
+- **A `prose-voice` example** under `examples/`: the `prose` slot end to end —
+  a legacy doc grandfathered at eight findings, violations that trip
+  `Repo.Drift` in fresh markdown and `Repo.ThereIs`/`Repo.Latin` inside a
+  TypeScript doc comment, a ratchet scenario pruning the baseline, and the
+  `docs/voice` exemplars the AGENTS.md stanza points writing sessions at. The
+  e2e harness grows a `proseRules` violation field so an example asserts
+  *which* vale rule fired, not merely that `prose` went red.
+
+### Fixed
+
+- The `prose` exemplars pre-flight now says `is a file, not a directory` when
+  a file sits at the configured path, instead of the false `does not exist`.
+- Re-resolved `nanoid` to 3.3.18 for GHSA-2v37-7h3g-55p8 (high severity;
+  dev-only, via vitest → vite → postcss). No override entry — postcss's own
+  range already permits the patched line.
+
+### Internal
+
+- New tests pin the default runner's exemplars pre-flight wiring, and the rule
+  that a run whose vale output is unreadable masks nothing and prunes nothing
+  while the slots the run did observe still ratchet.
+
+## [0.12.1] - 2026-08-07
+
+### Added
+
+- **A `prose` slot for writing-style linting**, powered by `vale`. Opt-in like
+  `format`, it checks markdown and TypeScript doc comments (via a JS format
+  mapping, so code and string literals stay untouched) for doubled words,
+  Latin abbreviations (`e.g.`/`i.e.`/`etc.`), hyphenated `-ly` adverbs,
+  sentence-initial "There is", weasel words (off by default — the one
+  subjective rule), and the lexical fingerprints of AI-generated prose:
+  overused vocabulary like `delve`/`tapestry`/`meticulous`, stock frames like
+  "it's not just X — it's Y", and the minted corporate dialect (`the ask`,
+  `learnings`, `leverage`/`utilize` as verbs). `init --add prose` scaffolds a
+  hermetic, repo-owned vale config and six house-style rule files under
+  `.vale/styles/Repo/` — no upstream package, no `vale sync` needed on the
+  default path. Findings ratchet through the shared baseline the same way
+  `lint`/`struct`/`spell` already do. `spell` keeps sole ownership of
+  spelling; the scaffold disables vale's own dictionary and vocabulary
+  checks to avoid a second, conflicting wordlist.
+- **An `exemplars` config key on the `prose` slot**, for anchoring voice
+  rather than just policing vocabulary. Point it at a directory of
+  hand-written prose and the generated AGENTS.md stanza tells writing
+  sessions to read and imitate it before touching markdown or doc comments —
+  and never to edit or add to it, since a generated "improvement" would
+  replace the human original with a copy of the model's own register. The
+  check itself fails if the named directory is missing or empty, so a stale
+  config can't stay green; checkride never scores prose against the
+  exemplars, since judging voice deliberately stays a human call.
+
+### Fixed
+
+- The README's slot table, its opt-in-slots sentence, the cheat sheet's
+  pipeline table, and the config schema's `checks` description had all
+  drifted out of sync with the slot registry over several releases (missing
+  the publish-ready bundle, missing `dupes`/`health`, undercounting opt-in
+  slots). Brought current and pinned by a new test that fails whenever a
+  slot is added without updating all four surfaces.
+
+### Internal
+
+- checkride now dogfoods its own `prose` slot: 112 initial findings fixed by
+  hand (11 subject-first rewrites, 28 Latin substitutions, 21 `-ly`-hyphen
+  drops), landing at zero findings with no baseline grandfathering needed.
+
+## [0.12.0] - 2026-08-07
+
+### Added
+
+- **`checkride recover` — restore a clobbered baseline from git history.** The
+  motivating incident: checkride landed in a large monorepo, other open PRs
+  merged the trunk back, and `checkride.baseline.json` came out of the merges
+  with many entries silently deleted (an agent resolving a conflict by removing
+  the "problem" lines, most likely). Missing entries fail closed, so the team
+  hit a wall of red with no tooling to diagnose or undo it — the remedy was
+  manual git archaeology, and the tempting wrong move, re-running
+  `checkride baseline`, would have grandfathered every genuinely-new finding
+  introduced since the damage.
+
+  `checkride recover` does the dig instead: it walks the baseline file's recent
+  commits (`--depth`, default 25), dedupes them into at most five distinct
+  snapshots plus one synthesized union, and lists them with `+restored/−absent`
+  deltas against the current file. `--pick <n|sha|union>` applies one by writing
+  the file directly — never `git checkout` — so the restore is an ordinary
+  working-tree edit to review and commit. The default write is the union of the
+  candidate and the current file: nothing is removed, and a stale resurrected
+  key is pruned by the ratchet on the next full green run. `--exact` writes the
+  snapshot verbatim (refused while the file has uncommitted changes), `--dry-run`
+  previews the per-slot delta, `--json` emits the machine shape. Shallow clones
+  list with a truncation note; a repo with no committed baseline history says so
+  at exit 0.
+
+- **A mangled or plundered baseline now explains itself.** A committed
+  `checkride.baseline.json` that no longer parses (a botched merge, usually)
+  used to be indistinguishable from having no baseline: every grandfathered
+  finding reported red with no hint why. A run now prints one stderr line under
+  the summary naming the file as present-but-unparseable and pointing at
+  `checkride recover`; `checkride doctor` grows an advisory workspace row with
+  the same diagnosis (and the key count when the file is healthy). And when the
+  file parses but a merge silently dropped entries, a red run probes git history
+  (best-effort, bounded at 750 ms, silent on any failure) and prints one hint —
+  `N of M new finding(s) were grandfathered until <sha>` — naming
+  `checkride recover` as the remedy, so a wall of red arrives with its diagnosis
+  attached.
+
+### Changed
+
+- **The baseline file is canonical on disk.** `writeBaseline` now sorts the
+  top-level slots (keys within a slot were already sorted), so two branches that
+  grandfather the same debt produce byte-identical files instead of
+  insertion-order diff churn — the README's "the file is canonical" claim is now
+  true on disk, not just in comparisons.
+
+- **`DoctorEnv` gained a required `readText` probe** (it feeds doctor's new
+  baseline row). The type sits outside the promised programmatic surface, but a
+  TypeScript consumer injecting a custom `env` into `runDoctor` adds one field
+  on upgrade.
+
+### Contract
+
+- New command `checkride recover` with `--pick <n|sha|union>`, `--exact`,
+  `--dry-run`, `--depth <n>`, and `--json` (docs/contract.md §CLI). List mode is
+  a reader: Markdown on stdout, exit 0. Apply mode writes
+  `checkride.baseline.json` atomically and never mutates git state. Exit codes
+  are 0 and 2 only — never 1. Additive; every existing command and flag is
+  unchanged.
+
+### Internal
+
+- The website caught up with the product and can no longer drift: a new
+  `agents.html` covers the bundled plugin, the Claude Code / Cursor
+  asymmetries, and the "could not run" verdict; the command reference gained
+  `recover`, `hooks`, `gate`, `triage`, and `qa`; and `test/site.test.ts` +
+  cspell now hold `site/` under `pnpm check` (inline scripts must parse, the
+  command and slot tables must track `CLI_COMMANDS` and `SLOTS`, internal links
+  must resolve). Every baseline-adjacent doc (README, getting-started, CI,
+  cheatsheet, plugin skill) now routes a clobbered baseline to `recover`.
+
+## [0.11.2] - 2026-08-04
+
+### Changed
+
+- **A Cursor stand-down now reaches the user, exactly once.** The promise since
+  0.11.0 was that a stand-down is never silent: Claude Code gets a
+  `systemMessage`, Cursor gets stderr. Those were never equivalent, and the
+  Cursor half does not hold — Cursor documents no channel that shows hook stderr
+  to a user, mentioning only a Hooks output panel under **Customize** that
+  someone has to go and open. So on the one verdict whose entire purpose is to
+  name a fix only a human can apply (`pnpm install`, an `engines` pin), the human
+  saw nothing.
+
+  `followup_message` is the field that reaches the chat, and the reason it was
+  avoided is real: it *submits a new turn*, so a stand-down spending it every
+  turn rebuilds the unbounded loop 0.11.0 removed. It is therefore rationed to
+  one. The generated hook script already reads `loop_count` to bound `block`, and
+  that same guard now bounds `stand_down` — one nudge naming the fix, silence
+  after. The guard errs toward quiet: Cursor's `loop_count` counts every
+  auto-follow-up in a conversation rather than the consecutive ones, so an
+  over-count costs a silent stand-down and never a loop.
+
+- **`CHECKRIDE_GATE_RETRY`, a new environment variable the generated gate script
+  sets.** checkride's own stand-down — a refusal it detects from inside, such as
+  an `engines` pin the hook's Node fails — needs the same one-shot bound and
+  cannot compute it, because the stop payload reaches the hook script and never
+  the child process. The script now exports `0` when the one message is unspent
+  and `1` when it is not, and `checkride gate --harness cursor` emits a followup
+  only on an explicit `0`.
+
+  **Absence is not `0`.** A hook script generated before this release exports
+  neither value and keeps the older stderr-only behavior. That asymmetry is the
+  point: it is what stops a refreshed checkride from looping under an
+  unrefreshed script, given the `loop_limit: null` the gate's own hook entry
+  asks for. Run `checkride agent-setup` to pick up the new script.
+
+  The variable is an internal contract between the two halves checkride
+  generates, not a knob — setting it by hand only suppresses or unlocks one
+  message.
+
+## [0.11.1] - 2026-08-04
+
+### Fixed
+
+- **The Cursor stop gate no longer writes package-manager noise to the channel
+  Cursor parses as protocol.** The two generated gate scripts were asymmetric,
+  and accidentally so: the Claude Code script captured the run, so a failed
+  launch wrote into a variable it could then decline to print, while the Cursor
+  script ran the launcher uncaptured in order to let checkride's own JSON pass
+  straight through. A *failed* launch writes to that same stdout, and nothing
+  filtered it — so in a repo whose dependencies were never installed, two lines
+  of pnpm resolution error landed on stdout while the correct stand-down
+  explanation went to stderr.
+
+  The turn still ended as intended, because Cursor does not parse that text as a
+  hook body. The reason to fix it anyway is what happens if it ever does: a
+  bare-text followup would submit a new turn on every stand-down, rebuilding the
+  unbounded loop 0.11.0 removed, and doing it on the one cause an agent can do
+  nothing about. It also muddies the gate's own diagnostic — a maintainer
+  reading a Cursor transcript sees a dependency-resolution error on the protocol
+  channel and a different, correct explanation beside it on stderr.
+
+  Both scripts now capture, and each re-prints that body only on the two exit
+  statuses checkride answers with by design. Anything else is the launcher's
+  error rather than a verdict, and `block`/`stand_down` own stdout there alone.
+
+### Internal
+
+- The marketing site under `site/` picks up Fathom analytics and Open Graph plus
+  Twitter Card metadata across all three pages. The published package is
+  unchanged.
+
+## [0.11.0] - 2026-08-04
+
+### Added
+
+- **`gate.preflight` — a supported seam for wrapping the stop gate.** checkride
+  owns the generated hook scripts and overwrites them on every refresh, so a repo
+  with something to say before the gate had nowhere to say it: editing the script
+  lost the edit, and re-pointing the harness config lost it to the next
+  `hooks add`. A `"preflight"` under `gate` in checkride.config.json names a
+  repo-relative script the generated gate runs, from the repo root, before
+  checkride is started — which is what lets it answer for a repo where checkride
+  *cannot* start.
+
+  Its exit code is read in the gate's own vocabulary rather than a second
+  convention: `0` runs the gate, `2` blocks the turn, anything else stands the
+  gate down. Both non-zero branches use the script's output as the message and
+  never start checkride. A configured path that does not exist **blocks**, so a
+  typo cannot quietly disarm the gate.
+
+  It is a config key rather than a `hooks add --preflight` flag for one reason:
+  the path is re-read on every write, so a teammate running the bare command
+  restores the wiring instead of silently dropping it. A preflight narrows
+  nothing, so it never adds the "NOT the full check" clause to a verdict.
+
+### Contract
+
+- **A could-not-run gate now blocks only when blocking could lead to a fix.**
+  Previously every could-not-run verdict blocked, in both harnesses, on the
+  reasoning that a gate which stops gating is a vacuous green. That reasoning
+  holds only while the block can *cause* the fix, and for a whole class of causes
+  it cannot: the harness re-prompts the same agent, which has no lever to pull.
+  The observed end of that road is an unbounded retry against an impossible
+  remedy, and then a contributor removing the gate.
+
+  Launch refusals are now classified by who can clear them. A **repo** refusal —
+  no `check` script, no package.json — blocks exactly as before, because an agent
+  holding the edit tools can fix it. (A missing `check` script stays blocking for
+  a second reason: it is the one refusal an agent could otherwise *create* to
+  escape the gate.) An **environment** refusal — an `engines` pin the hook's Node
+  fails, a corepack that will not verify the package manager, a package manager
+  absent from `PATH` — stands down: exit 0, no `decision`, `green: false`.
+
+  Two properties are promised about the stand-down and neither may be weakened:
+  it is never silent (Claude Code gets a `systemMessage`, Cursor gets stderr,
+  both stating that nothing was verified), and it is never reported as green.
+  `docs/contract.md` and `test/contract/gate-verdict.contract.test.ts` are
+  updated deliberately; a hook script that reads only the exit status will now
+  let a turn end on an environment refusal, which is the intended change.
+
+### Changed
+
+- **`init` now pins markdownlint-cli2 0.23.2 for the `docs` slot**, up from
+  0.23.1 — the version that resolves a vulnerable `js-yaml`
+  (GHSA-pm4m-ph32-ghv5) transitively into every repo it sets up. An existing
+  repo keeps whatever it installed; re-run `checkride init` or bump it yourself.
+
+### Fixed
+
+- **An uninstalled repo no longer traps the agent in an unbreakable loop.** A
+  developer who pulled a branch that newly added checkride — or cloned fresh —
+  and started a session before `<pm> install` got a gate that blocked every turn
+  with `checkride gate is not resolvable in this repo. Install checkride (or
+  re-run checkride agent-setup)`. Every part of that was a dead end: the
+  suggested remedy needs the missing binary, and in a repo with a customized
+  AGENTS.md stanza `agent-setup` would refuse and exit 2 even if it could run.
+  The actual fix, `<pm> install`, was never named. Nothing bounded the retry.
+
+  The generated gate now distinguishes the two ways checkride can fail to answer.
+  Dependencies never installed → it names `<pm> install`, says checkride is a
+  devDependency, and stands down. Installed but not answering → it blocks, as
+  before, since there is no remedy to name. Yarn PnP is recognized, so a healthy
+  PnP repo is not misread as uninstalled.
+
+- **Both generated gates bound every could-not-run cause.** The scripts now read
+  the Stop payload from stdin and consult Claude Code's `stop_hook_active` and
+  Cursor's `loop_count`. On the second consecutive could-not-run, whatever the
+  cause, the gate stands down instead of blocking again — the previous script
+  read no stdin at all, so `stop_hook_active` was discarded and
+  `"loop_limit": null` left the Cursor gate unbounded by design. A **red**
+  pipeline is deliberately still unbounded: that loop is the gate working.
+
+- **The claude gate no longer forwards the launcher's error as a hook body.** On
+  a missing install pnpm writes `ERR_PNPM_RECURSIVE_EXEC_FIRST_FAIL` to *stdout*
+  — ahead of a stray `undefined` on pnpm 11 — which the script captured into
+  `$body` and printed where Claude Code expects JSON. The status is now checked
+  before the body is forwarded, so a body travels only when checkride wrote it.
+
+- **A refusal the repo can fix is no longer explained by the hook's Node.** The
+  `nodeClause` paragraph rode on every refusal, so "this repo has no `check`
+  script" was followed by an account of non-login shells and interpreter
+  alignment. It is now attached to environment refusals only.
+
+- **A red run could be reported as "could not run" on Linux.** `isFresh` judged
+  the summary this run wrote by comparing its mtime against a `Date.now()`
+  reading taken just before the check spawned — and those are not the same
+  clock. Linux mtimes come from the kernel's coarse timer-tick clock, so a
+  summary written *after* `startedAt` routinely landed a few milliseconds behind
+  it: 934 of 2000 writes in a container, and 0 of 2000 on APFS. When it misfired
+  the gate read its own summary as a previous run's, believed an `engines`-pin
+  marker the check had merely printed, and blamed the environment for broken
+  code. `MTIME_TOLERANCE_MS` already guarded the same comparison in `triage/`;
+  the gate's own copy had dropped it. This is what turned the Linux CI legs red
+  on v0.10.2 and v0.10.3 while both macOS legs stayed green.
+
+- **A green run that skipped most of its slots says so.** `✔ all checks passed`
+  is a true sentence about the checks that ran and a misleading one about the
+  repo, and the gap was invisible exactly where it matters: a repo configuring
+  almost nothing reported the same confident green as one configuring
+  everything. The line now reads `✔ all checks passed in 13ms — only 1 of 8
+  checks ran, 7 skipped` whenever any slot sat out. `--strict` is unchanged; its
+  floor is *zero* checks, which an always-available slot like `links` keeps a
+  repo off by itself.
+
+### Internal
+
+- CI dumps a failing slot's captured streams into collapsible log groups and
+  keeps `.check/` as an artifact. A red run logged `✘ test` and nothing else,
+  and on a hosted runner the directory holding the reason died with the
+  workspace — so the Linux-only gate failure above had to be reproduced in a
+  container before it could be read at all.
+
+- Dependency audit cleared and mostly retired. Two high advisories were open
+  (`fast-uri` GHSA-7p8r-x3mc-p8w7, `brace-expansion` GHSA-rgw5-rvv9-x895), both
+  already carrying an override whose range the advisory had since outgrown.
+  Re-resolving showed four of the five overrides were dead weight — the parents'
+  own ranges reach patched versions — so they were removed rather than widened,
+  leaving one. No runtime `dependencies` are declared, so none of this ever
+  reached the tarball.
+
+## [0.10.3] - 2026-08-01
+
+### Added
+
+- **Both Cursor guards now cover the shell.** `protect` and `dirty` each take a
+  second `.cursor/hooks.json` entry — on `beforeShellExecution` and
+  `afterShellExecution` — whose matchers run against the command string rather
+  than a tool name. This closes the older of the two documented Cursor gaps:
+  `echo … > checkride.baseline.json` is a shell call, not a `Write`, so no
+  file-tool matcher could ever see it, and a turn that wrote only through the
+  shell used to skip the gate entirely.
+
+  The standing objection was that matching the shell means parsing arbitrary
+  command lines, and a guard that fires on a wrong parse is worse than one with
+  a known hole. That objection is answered rather than dropped. `protect`'s
+  matcher admits only commands already naming an accounting path — reads
+  included — and the script then denies solely on demonstrated write intent: a
+  `>`/`>>` redirect target, or a positional argument of `rm`, `mv`, `tee`,
+  `sed -i`, `dd of=` and kin. Anything it cannot read that way is allowed, so
+  `cat`, `jq`, `grep` and `cp .check/summary.json /tmp/x` keep working, as
+  triage requires. `dirty` decides from its matcher alone and biases the other
+  way, toward marking a turn dirty, because there the recoverable error is one
+  extra pipeline run.
+
+  Both entries share their sibling's name and script: one guard, one
+  `--remove-hook protect`, one `.cjs` branching on `hook_event_name`. The gate
+  takes no shell entry — it is not per-call. Claude Code's half of the gap stays
+  open; `permissions.deny` is a file-path list, and a `Bash` matcher there would
+  mean shipping a generated script that harness does not currently need.
+
+### Changed
+
+- **The AGENTS.md stanza no longer promises the gate ran everything.** It said
+  the stop-gate hook "runs the full `pnpm check`" and told the agent to "let the
+  hook run the authoritative pipeline once at the end" — written before gate
+  profiles existed, and false in any repo that declares one. The cost of that is
+  specific: the stanza is what an agent reads *first*, so it pre-authorized
+  reading a profiled `✔ green` as done, and the `NOT the full check` clause
+  arrived after the agent had already been told the hook was the last word. The
+  disclosure and the contract disagreed, and the contract was the one being read
+  in advance.
+
+  The paragraph now sends the reader to the gate's own verdict — "read the
+  gate's verdict rather than assuming it covered everything" — and says plainly
+  that a narrowed green is not the "done" defined above. It names no profile
+  deliberately: a repo can add `gate` to `checkride.config.json` without
+  re-running `agent-setup`, so any stanza that spelled out a specific profile
+  would drift back into over-promising, while the verdict is generated per run
+  and cannot.
+
 ## [0.10.2] - 2026-07-31
 
 ### Added
@@ -1453,6 +1847,13 @@ The first real release. (`0.0.0` was a name-claim placeholder.)
 - Flags: `--only`, `--skip`, `--bail`, `--json`, `--changed`, `--all`,
   `--include`.
 
+[0.12.2]: https://www.npmjs.com/package/checkride/v/0.12.2
+[0.12.1]: https://www.npmjs.com/package/checkride/v/0.12.1
+[0.12.0]: https://www.npmjs.com/package/checkride/v/0.12.0
+[0.11.2]: https://www.npmjs.com/package/checkride/v/0.11.2
+[0.11.1]: https://www.npmjs.com/package/checkride/v/0.11.1
+[0.11.0]: https://www.npmjs.com/package/checkride/v/0.11.0
+[0.10.3]: https://www.npmjs.com/package/checkride/v/0.10.3
 [0.10.2]: https://www.npmjs.com/package/checkride/v/0.10.2
 [0.10.1]: https://www.npmjs.com/package/checkride/v/0.10.1
 [0.10.0]: https://www.npmjs.com/package/checkride/v/0.10.0

package/node_modules/checkride/README.md

@@ -155,6 +155,12 @@ checkride init         Set up a project (new or existing — auto-detected).
 checkride doctor       Verify environment + every slot's status (read-only, exit 0/1).
 checkride fix          Run every active adapter's fix command (oxlint --fix, ...).
 checkride baseline     Record current diagnostics as a committed baseline.
+checkride recover      Rebuild checkride.baseline.json candidates from git history
+                       and restore one (bare `recover` lists them with deltas).
+  --pick <n|sha|union> apply a candidate — additive union with the current file
+  --exact      write the picked snapshot verbatim instead of the union
+  --dry-run    preview the per-slot delta; write nothing
+  --depth <n>  commits of file history to walk (default 25)
 checkride agent-setup  Add the "check" alias, AGENTS.md stanza + agent hooks to a repo.
   --hook <a,b> write only these hooks (gate | dirty | protect)
   --no-hook    skip the hooks (write only the stanza)
@@ -178,8 +184,8 @@ default run leaves stdout empty.
 ## The pipeline: slots and adapters
 
 A **slot** is a role in the pipeline (order matters — cheapest first). An
-**adapter** is a concrete tool that fills a slot. There is one blessed default
-per slot; alternates are wired so checkride can run them, but `init` only
+**adapter** is a concrete tool that fills a slot. Each slot has one blessed
+default; alternates are wired so checkride can run them, but `init` only
 generates config for the blessed default.
 
 | Slot       | Role                                   | Blessed default     | Alternates       |
@@ -195,10 +201,15 @@ generates config for the blessed default.
 | `docs`     | Markdown lint                          | `markdownlint-cli2` | —                |
 | `links`    | Relative markdown links resolve        | built-in            | —                |
 | `spell`    | Spelling                               | `cspell`            | —                |
+| `prose`    | Writing style (opt-in)                 | `vale`              | —                |
 | `mutation` | Mutation testing (opt-in)              | `stryker`           | —                |
 | `security` | Dependency audit (opt-in)              | `pnpm audit`        | —                |
+| `build`    | Runs the consumer's build script (opt-in) | `<pm> run build` | —                |
 | `publint`  | Package publishing lint (opt-in)       | `publint`           | —                |
 | `attw`     | Type resolution across module systems (opt-in) | `attw --pack`| —                |
+| `pack`     | Tarball ships the right files (opt-in) | built-in            | —                |
+| `smoke`    | Built package imports cleanly (opt-in) | built-in            | —                |
+| `snippets` | Tagged doc fences type-check (opt-in)  | built-in (`tsc`)    | —                |
 
 Most of these tools you already know. The one unfamiliar name, `fallow`, is a
 Rust-native codebase-analysis tool covering dead code, duplication, and
@@ -210,16 +221,17 @@ exists, and skips slots with no detected tool. The core has **no runtime
 dependency** on any checked tool — it spawns `<pm> exec <tool>`; the project
 owns the pinned tool versions.
 
-**Opt-in slots** (`format`, `mutation`, `security`, `publint`, `attw`) stay out of the
+**Opt-in slots** (`format`, `dupes`, `health`, `prose`, `mutation`, `security`, `build`,
+`publint`, `attw`, `pack`, `smoke`, `snippets`) stay out of the
 default run so adopting checkride — or bumping its version — never turns a repo red on a
 check it didn't ask for. Turn one on with `--include <slot>` (or `--all`), or by **naming
 it in `checks`**: an explicit entry like `"format": "prettier"` opts the slot into every
-run. `checkride fix` then runs its write form (e.g. `prettier --write`) alongside the
+run. `checkride fix` then runs its write form (for example `prettier --write`) alongside the
 other fixers. `format` sits before `lint` so the tree is tidy before the linters look.
 
 To **configure a slot without opting it in** — say, give `attw` a `--profile` but keep it
 in the full sweep only — add `"optIn": true` to its entry: it stays out of the default run
-and runs solely under `--all`/`--include <slot>`. The same field demotes a normally-default
+and runs solely under `--all`/`--include <slot>`. The same field demotes a normally default
 slot (or a heavy custom check like `test:integration`) to full-sweep-only; `"optIn": false`
 does the opposite, forcing a slot into the default run.
 
@@ -475,7 +487,13 @@ keys are sorted), so parallel branches usually merge cleanly; when they do
 conflict, resolve by keeping both sides' entries and running a full
 `checkride` — the ratchet prunes anything already fixed, so an over-generous
 union self-heals, while a dropped entry that still fails simply resurfaces as
-a red check. **Deliberate re-baseline:** `checkride baseline` re-records
+a red check. When a merge went badly anyway — entries deleted wholesale, or a
+file so mangled it no longer parses (a run says so on stderr and treats it as
+no baseline at all) — the run diagnoses what it can: a red run whose "new"
+findings were grandfathered until a recent commit prints a `hint:` line naming
+that commit. `checkride recover` then rebuilds candidate states from the
+file's git history and restores one additively; see `checkride recover --help`.
+**Deliberate re-baseline:** `checkride baseline` re-records
 *everything* currently failing — including brand-new debt you might rather
 fix — so treat re-running it as a reviewed change: do it deliberately (say,
 after adopting a stricter rule set) and read the `checkride.baseline.json`
@@ -508,9 +526,9 @@ At runtime, checkride itself is workspace-agnostic: whatever the shape, it runs
 each tool **once, from the repo root** — one pipeline, one `.check/`. Workspace
 awareness comes from the tools' own configs, which is what the monorepo scaffold
 sets up: `tsc --build` follows the root tsconfig's project references, and
-vitest, oxlint, ast-grep, and the rest walk the whole tree. There is no
-per-package orchestration and no way to check a single package — narrow a run
-with `--only`/`--changed`, not per-directory.
+vitest, oxlint, ast-grep, and the rest walk the whole tree. checkride itself
+does no per-package orchestration and offers no way to check a single package —
+narrow a run with `--only`/`--changed`, not per-directory.
 
 ## Conventions