sawbuck 0.1.31 → 0.1.32

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CONTRACT.md CHANGED
@@ -77,7 +77,7 @@ This is the part that makes "moving the goalposts" objective rather than a judgm
77
77
 
78
78
  A win is **`gamed`** when it does not survive a **source-only re-run**: revert every non-source change the agent made, re-measure, and see how much of the gain remains (`retained`). If `retained` falls below `gamingThreshold` (default `0.5`), the verdict is `gamed`.
79
79
 
80
- - **Non-source** (reverted before the re-run): tests, specs, fixtures, snapshots and golden files, graders, config, lockfiles, CI definitions, build gates, and any path the repo opts into via `evaluatorPaths`.
80
+ - **Non-source** (reverted before the re-run): tests, specs, fixtures, snapshots and golden files, graders, config, plus any path declared in `evaluatorPaths`.
81
81
  - **Source**: everything else, the code the change was supposed to be about.
82
82
  - **`evaluatorPaths`**: an opt-in allowlist a repo declares for its own gate files (a threshold file, a budget, a ruleset), because a generic name is a classifier risk and only the repo owner knows which files are the goalposts.
83
83
 
package/README.md CHANGED
@@ -34,16 +34,16 @@ $ sawbuck check # after fixing the source and restoring the test
34
34
  🐴 ✓ verified: your working change earned it. "tests_pass" held, and the source carried the win.
35
35
  ```
36
36
 
37
- Exit codes: `0` verified · `1` regression · `2` gamed · `3` inconclusive · `64` could not run (not a git repo, no commit, no test command).
37
+ Exit codes: `0` verified · `1` regression · `2` gamed · `3` inconclusive · `64` could not run (not a git repo, no commit); no detectable test command reads `3` inconclusive.
38
38
 
39
39
  ## What it does
40
40
 
41
- - **Verifies the win.** `check` re-runs your metric from the source diff alone. A faked green (a deleted, weakened, or skipped test; a mocked grader; an edited golden file; a loosened config) reads `gamed`. Deterministic, zero-LLM, $0, and it cannot be argued with because it never reads the trajectory. Red-teamed across 9 language ecosystems and 26 adversarial scenarios ([promptwheel/bench/REDTEAM.md](https://github.com/promptwheel-ai/promptwheel/blob/main/bench/REDTEAM.md)).
41
+ - **Verifies the win.** `check` re-runs your metric from the source diff alone. A faked green (a deleted, weakened, or skipped test; a mocked grader; an edited golden file; a loosened config) reads `gamed`. Deterministic, zero-LLM, $0, and it cannot be argued with because it never reads the trajectory. Red-teamed across 9 ecosystems and 26 adversarial scenarios ([promptwheel/bench/REDTEAM.md](https://github.com/promptwheel-ai/promptwheel/blob/main/bench/REDTEAM.md)).
42
42
  - **Says what it cannot see.** A cheat that lives inside the source itself (a value hardcoded to the one visible case, logic keyed to the test environment) is invisible to a source-only re-run, by construction. That limit is in [the contract](CONTRACT.md#3-the-integrity-boundary-what-counts-as-gaming), not hidden.
43
43
  - **Remembers what broke.** `context` surfaces the relevant history (reverts, fragile areas, test-weakening) for the files you are touching: a ranked trail guide, before you act.
44
44
  - **Shows you everything.** `status` is the inventory: what it has caught for you over time, the debt accruing now, and whether it is armed here, in one view. On-demand, so it is quiet until you go looking.
45
45
  - **Rides on, does not replace.** Sawbuck is the verify + memory layer. Your agent and your loop stay yours.
46
- - **Clean on and off.** `attach` touches nothing in your worktree (the hook lives in `.git/`, the record is excluded locally); `detach` is a true inverse. `trace` shows every byte it placed, and `detach --verify` proves the repo came back unchanged.
46
+ - **Clean on and off.** the default `attach` touches nothing in your worktree (the hook lives in `.git/`, the record is excluded locally); `--claude` writes one git-excluded settings file; `detach` is a true inverse. `trace` shows every byte it placed, and `detach --verify` proves the repo came back unchanged.
47
47
 
48
48
  ## Commands
49
49
 
package/contract.mjs CHANGED
@@ -59,24 +59,32 @@ export function protectedAmong(repo, paths) {
59
59
  return paths.filter((f) => res.some((re) => re.test(f)));
60
60
  }
61
61
 
62
- // a working-tree file's content hash as git would store it; 'deleted' when it is gone
63
- export function hashOf(repo, file) {
64
- try { return gitOut(repo, ['hash-object', '--', file]).trim(); } catch { return 'deleted'; }
62
+ // a working-tree file's content hash as git would store it; 'deleted' when it is gone. With `store`,
63
+ // the content is also written into the object database (`hash-object -w`), so a person's edit that
64
+ // the baseline recorded can be restored by hash later even after the agent overwrote the file.
65
+ export function hashOf(repo, file, { store = false } = {}) {
66
+ try { return gitOut(repo, ['hash-object', ...(store ? ['-w'] : []), '--', file]).trim(); } catch { return 'deleted'; }
65
67
  }
66
68
 
67
69
  // the protected paths that are dirty right now, each with its content hash: the baseline `turn`
68
70
  // records when a prompt begins, so the Stop hook counts only what the turn itself changed and leaves
69
71
  // a person's own pre-existing edits alone. {} when nothing protected is dirty (or not a git repo).
70
- export function protectedDirty(repo) {
72
+ // `store` keeps each file's content in the object database (see hashOf), which the baseline does.
73
+ export function protectedDirty(repo, { store = false } = {}) {
71
74
  let changed = [];
72
75
  try { changed = [...new Set([...gitOut(repo, ['diff', '--name-only', 'HEAD']).split('\n'), ...gitOut(repo, ['ls-files', '--others', '--exclude-standard']).split('\n')].filter(Boolean))]; }
73
76
  catch { return {}; }
74
77
  const res = mandatesInForce(repo).flatMap((m) => pathsOf(m).map(globToRe));
75
78
  const out = {};
76
- for (const f of changed) if (res.some((re) => re.test(f))) out[f] = hashOf(repo, f);
79
+ for (const f of changed) if (res.some((re) => re.test(f))) out[f] = hashOf(repo, f, { store });
77
80
  return out;
78
81
  }
79
82
 
83
+ // the blob hash a tracked path has at `ref` ('' when the path is not there)
84
+ export function blobAt(repo, ref, file) {
85
+ try { return gitOut(repo, ['rev-parse', `${ref}:${file}`]).trim(); } catch { return ''; }
86
+ }
87
+
80
88
  // the same glob dialect as promptwheel's evaluatorPaths / mandates (ported verbatim): a bare name
81
89
  // matches that basename at any depth; a pattern with "/" is anchored at the repo root; "*" stops at
82
90
  // "/", "**" crosses it, "?" is one char; a leading "/" anchors to the root explicitly.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "sawbuck",
3
- "version": "0.1.31",
3
+ "version": "0.1.32",
4
4
  "description": "Sign your agent to a contract: a deterministic, zero-LLM check re-proves every win from the agent's source edits alone, so a green that came from editing the test, grader, or config is caught and sent back. Works in Claude Code, Codex, git hooks, and CI.",
5
5
  "type": "module",
6
6
  "license": "Apache-2.0",
package/reflect.mjs CHANGED
@@ -52,7 +52,6 @@ function check() {
52
52
  const report = check();
53
53
  if (!report || !report.verdict) process.exit(0); // couldn't measure → nothing to learn
54
54
  const verdict = report.verdict; // engine contract: 'gamed' | 'fail' | ...
55
- appendActivity(verdict, report); // the event feed logs EVERY measurable check, so you can watch it work (verified too, not only catches)
56
55
  // the results record, and the base this run measured from (a full sha), so a gamed verdict can be
57
56
  // held against the SAME span until it re-proves: the hook re-runs base..HEAD, not last-commit..HEAD
58
57
  const recDir = join(repo, '.sawbuck');
@@ -62,10 +61,23 @@ try { if (existsSync(recPath)) rec = JSON.parse(readFileSync(recPath, 'utf8'));
62
61
  let baseSha = ''; try { baseSha = git('rev-parse', `${base}^{commit}`); } catch {}
63
62
  const standing = !!(rec.latest && rec.latest.kind === 'gamed' && rec.latest.base && rec.latest.base === baseSha);
64
63
  const writeRec = () => { try { mkdirSync(recDir, { recursive: true }); writeFileSync(recPath, JSON.stringify(rec, null, 2) + '\n'); } catch {} };
65
- if (verdict === 'pass' && standing) {
66
- // the span the gamed verdict was measured over now passes from the source: the wall comes down
67
- rec.latest = { sha: git('rev-parse', head).slice(0, 8), kind: 'verified', base: baseSha, file: rec.latest.file, reason: 'the source earned the green over the span the gamed verdict was measured on', at: new Date().toISOString(), by: by || null };
64
+ appendActivity(verdict, report, standing); // the event feed logs EVERY measurable check, so you can watch it work (verified too, not only catches)
65
+ if (standing) {
66
+ let headSha = ''; try { headSha = git('rev-parse', head); } catch {}
67
+ if (verdict === 'pass') {
68
+ // the span the gamed verdict was measured over now passes from the source: the wall comes down
69
+ rec.latest = { sha: headSha.slice(0, 8), kind: 'verified', base: baseSha, file: rec.latest.file, reason: 'the source earned the green over the span the gamed verdict was measured on', at: new Date().toISOString(), by: by || null };
70
+ writeRec();
71
+ process.exit(0);
72
+ }
73
+ // gamed again, a regression on top, or a span that cannot be certified: the source has still not
74
+ // earned the green over the span the verdict was measured on, so the gamed record holds, advanced
75
+ // to this head (the Stop hook keeps the wall up), its file and attribution untouched (a commit
76
+ // the person made in between is not the catch), and nothing is counted or noted a second time
77
+ rec.latest = { ...rec.latest, sha: headSha.slice(0, 8), at: new Date().toISOString(), standingVerdict: verdict };
68
78
  writeRec();
79
+ process.stderr.write(`sawbuck: the gamed verdict on ${rec.latest.file} still stands (${verdict} over the same span)\n`);
80
+ process.exit(0);
69
81
  }
70
82
  if (verdict !== 'gamed' && verdict !== 'fail') process.exit(0); // only breakage is worth recording
71
83
 
@@ -104,7 +116,7 @@ process.stderr.write(`sawbuck: ${kind} recorded on ${evidenceFile}\n`);
104
116
  // --- the activity feed: one line per check so you can watch it work, verified
105
117
  // included, not only catches. Capped, lives in the git-excluded .sawbuck/, opt
106
118
  // out with SAWBUCK_NO_LOG=1. `sawbuck log` reads it.
107
- function appendActivity(v, rep) {
119
+ function appendActivity(v, rep, standing = false) {
108
120
  if (process.env.SAWBUCK_NO_LOG) return;
109
121
  const map = { pass: 'verified', gamed: 'gamed', fail: 'regression', inconclusive: 'inconclusive' };
110
122
  const k = (v === 'pass' && rep.allowed) ? 'allowed' : map[v]; // a declared override is logged distinctly, for the audit trail
@@ -118,7 +130,8 @@ function appendActivity(v, rep) {
118
130
  : k === 'allowed' ? ('declared intentional: ' + (rep.allowed?.reason || ''))
119
131
  : k === 'verified' ? 'the source earned the green'
120
132
  : 'could not certify a pass';
121
- const ev = { at: new Date().toISOString(), kind: k, sha, file, reason: String(why).slice(0, 160), by: by || null };
133
+ // `standing`: this check re-proved the span of a gamed verdict that is still up, not a new catch
134
+ const ev = { at: new Date().toISOString(), kind: k, sha, file, reason: String(why).slice(0, 160), by: by || null, ...(standing ? { standing: true } : {}) };
122
135
  const dir = join(repo, '.sawbuck');
123
136
  const p = join(dir, 'activity.jsonl');
124
137
  try {
package/sawbuck-hook.mjs CHANGED
@@ -46,9 +46,21 @@ try { if (existsSync(stPath)) st = JSON.parse(readFileSync(stPath, 'utf8')); } c
46
46
  // a contract exists (--no-auto): nobody's whole test suite runs three times in a repo they never set up.
47
47
  const head = git('rev-parse', 'HEAD');
48
48
  const readRec = () => { try { return JSON.parse(readFileSync(join(stDir, 'results.json'), 'utf8')); } catch { return null; } };
49
+ const writeRec = (r) => { try { mkdirSync(stDir, { recursive: true }); writeFileSync(join(stDir, 'results.json'), JSON.stringify(r, null, 2) + '\n'); } catch {} };
50
+ const logActivity = (ev) => { try { mkdirSync(stDir, { recursive: true }); appendFileSync(join(stDir, 'activity.jsonl'), JSON.stringify({ at: new Date().toISOString(), ...ev }) + '\n'); } catch {} };
51
+ const hasCommit = (ref) => { try { execFileSync('git', ['-C', repo, 'cat-file', '-e', `${ref}^{commit}`], { stdio: 'ignore' }); return true; } catch { return false; } };
49
52
  let rec = readRec();
50
53
  if (head && st.lastSha && head !== st.lastSha) {
51
- const standing = !!(rec && rec.latest && rec.latest.kind === 'gamed' && rec.latest.base && rec.latest.sha !== head.slice(0, 8));
54
+ let standing = !!(rec && rec.latest && rec.latest.kind === 'gamed' && rec.latest.base && rec.latest.sha !== head.slice(0, 8));
55
+ if (standing && !hasCommit(rec.latest.base)) {
56
+ // the span can no longer be re-proved (a rebase, a squash, a pruned branch took its base away):
57
+ // say so in the feed, drop the record to unverified (never blocked on), and keep checking new
58
+ // commits from the last one seen, so the wall's loss is visible instead of a silent stop
59
+ logActivity({ kind: 'note', sha: head.slice(0, 8), file: rec.latest.file || '', reason: 'the base of the standing gamed verdict is gone from this clone (rebased or pruned); the record is cleared and new commits are checked from the last one seen', by: by || 'hook' });
60
+ rec.latest = { ...rec.latest, kind: 'unverified', at: new Date().toISOString(), reason: 'the base of the gamed verdict left the clone before the span re-proved from the source' };
61
+ writeRec(rec);
62
+ standing = false;
63
+ }
52
64
  node(join(HERE, 'reflect.mjs'), ['--repo', repo, '--base', standing ? rec.latest.base : st.lastSha, '--head', head, ...(by ? ['--by', by] : []), ...(userMode ? ['--no-auto'] : [])]);
53
65
  rec = readRec();
54
66
  }
@@ -87,7 +99,12 @@ if (stop && !process.env.SAWBUCK_NO_ENFORCE) {
87
99
  // spared, or the next clean turn would be blocked over work that was never the agent's.
88
100
  const files = {};
89
101
  for (const f of protectedAmong(repo, changed)) files[f] = hashOf(repo, f);
90
- st.lastViolation = { at: now, sha: (base && base.sha) || null, files };
102
+ // a flagged file the person had dirty before the prompt: keep the hash of THEIR content (the
103
+ // baseline stored it in the object database), so the block can name the exact restore and the
104
+ // next baseline can recognise the restored file as theirs
105
+ const before = {};
106
+ for (const f of Object.keys(files)) if (Object.prototype.hasOwnProperty.call(baseline, f) && baseline[f] && baseline[f] !== 'deleted') before[f] = baseline[f];
107
+ st.lastViolation = { at: now, sha: (base && base.sha) || null, files, ...(Object.keys(before).length ? { before } : {}) };
91
108
  } else if (st.lastViolation) { delete st.lastViolation; }
92
109
  saveState();
93
110
  if (hits.length) {
@@ -98,12 +115,16 @@ if (stop && !process.env.SAWBUCK_NO_ENFORCE) {
98
115
  if (st.mandatePromptId !== promptId) { st.mandatePromptId = promptId; st.mandateBlocks = 0; }
99
116
  const desc = hits.map((h) => `"${h.name}"${h.reason ? ' (' + h.reason + ')' : ''}: ${h.files.join(', ')}${h.committed ? ' [this rule is in the committed contract; editing promptwheel.config.json in the working tree does not lift it]' : ''}`).join('; ');
100
117
  const spared = leftAlone.length ? ` Edits that were already there before this prompt were left out of this check and must stay as they are: ${leftAlone.join(', ')}.` : '';
118
+ const before = (st.lastViolation && st.lastViolation.before) || {};
119
+ const restore = Object.keys(before).length ? ' To put back what you overwrote: ' + Object.entries(before).map(([f, h]) => `restore ${f} to the content it had when the prompt began: git cat-file -p ${h} > ${f}`).join('; ') + '.' : '';
120
+ const committedHit = hits.some((h) => h.files.some((f) => committedSince.includes(f)));
121
+ const accept = committedHit ? ' To accept this change on purpose, change the mandate in the contract or revert the path.' : '';
101
122
  const upgrade = base ? '' : ' (No prompt baseline is recorded in this repo, so edits a person made before the prompt cannot be told apart from yours: ask them to run sawbuck attach --claude again, which upgrades the hooks.)';
102
- try { mkdirSync(stDir, { recursive: true }); appendFileSync(join(stDir, 'activity.jsonl'), JSON.stringify({ at: new Date().toISOString(), kind: 'mandate', file: hits[0].files[0], reason: `mandate ${hits[0].name} violated in the working tree`, by: by || 'hook' }) + '\n'); } catch {}
123
+ logActivity({ kind: 'mandate', file: hits[0].files[0], reason: `mandate ${hits[0].name} violated in the working tree`, by: by || 'hook' });
103
124
  if ((st.mandateBlocks || 0) < MAX_BLOCKS) {
104
125
  st.mandateBlocks = (st.mandateBlocks || 0) + 1;
105
126
  saveState();
106
- process.stdout.write(JSON.stringify({ decision: 'block', reason: `Sawbuck: a mandate in the contract was violated, the turn is not done. Protected paths changed in this turn: ${desc}. Undo the changes YOU made under the protected paths and make the fix elsewhere; do not revert anything you did not change (the rule is a wall, not a reminder; the gate fails any change that touches them).${spared}${upgrade}` }));
127
+ process.stdout.write(JSON.stringify({ decision: 'block', reason: `Sawbuck: a mandate in the contract was violated, the turn is not done. Protected paths changed in this turn: ${desc}. Undo the changes YOU made under the protected paths and make the fix elsewhere; do not revert anything you did not change (the rule is a wall, not a reminder; the gate fails any change that touches them).${spared}${restore}${accept}${upgrade}` }));
107
128
  process.exit(0);
108
129
  }
109
130
  saveState();
package/sawbuck.mjs CHANGED
@@ -19,7 +19,7 @@ import { fileURLToPath } from 'node:url';
19
19
  import { homedir } from 'node:os';
20
20
  import { recall as memRecall, conform as memConform } from './memory.mjs';
21
21
  import { PW } from './bins.mjs';
22
- import { frameBlock, mandatesInForce, protectedDirty } from './contract.mjs';
22
+ import { frameBlock, mandatesInForce, protectedDirty, blobAt } from './contract.mjs';
23
23
 
24
24
  const SELF = fileURLToPath(import.meta.url);
25
25
  const HERE = dirname(SELF);
@@ -200,12 +200,12 @@ switch (cmd) {
200
200
  catch (e) { process.exit(e.status || 1); }
201
201
  break;
202
202
  }
203
- case 'context': { const o = contextBlock(repoArg(), flags.has('--speak')); if (o) out(o); break; }
203
+ case 'context': { const o = contextBlock(repoRoot(), flags.has('--speak')); if (o) out(o); break; }
204
204
  case 'frame': {
205
205
  // the prompt face of the contract: re-impress the hard rules (mandates, resolved through `extends`)
206
206
  // as one compact block at the live end of the context, so a deep or freshly compacted session
207
207
  // cannot forget them. Silent without a contract; --speak explains instead.
208
- const o = frameBlock(repoArg());
208
+ const o = frameBlock(repoRoot());
209
209
  if (o) out(o);
210
210
  else if (flags.has('--speak')) out('🐴 sawbuck frame: no mandates in promptwheel.config.json yet. Add one (a protected path) and this re-asserts it every turn and after every compaction, so a deep context cannot forget it.');
211
211
  break;
@@ -214,7 +214,10 @@ switch (cmd) {
214
214
  // the ONE per-prompt hook: the contract frame (forward: what must hold) and the relevant history
215
215
  // (backward: what broke here before) in a single block, one process per prompt. Silent when
216
216
  // there is nothing to say. Wired by `attach --claude` on UserPromptSubmit and after a compaction.
217
- const repo = repoArg();
217
+ // the repository the way the Stop hook sees it: the root of the cwd under user-level wiring (a
218
+ // subdirectory belongs to its repo), the pinned path under project wiring; '' outside a repo
219
+ const top = gitTop(repoArg());
220
+ const repo = top || repoArg();
218
221
  // When a PROMPT begins (the UserPromptSubmit hook, never the SessionStart[compact] one, which
219
222
  // fires mid-turn), remember which protected paths were already dirty and what they held, so the
220
223
  // Stop hook's wall counts only what this turn changes and leaves a person's own edits alone.
@@ -224,33 +227,40 @@ switch (cmd) {
224
227
  // this command mid-turn leaves the last one standing, so nothing the agent left behind is adopted);
225
228
  // a file still carrying the content the last violation flagged is never baselined; and the
226
229
  // baseline's commit does not advance past a flagged commit until a clean stop or a commit the
227
- // person made between turns.
230
+ // person made between turns that no longer carries the flagged content.
228
231
  let hookEvent = '';
229
232
  if (flags.has('--hook') && !process.stdin.isTTY) { try { hookEvent = String(JSON.parse(readFileSync(0, 'utf8') || '{}').hook_event_name || ''); } catch {} }
230
- if (hookEvent === 'UserPromptSubmit') {
233
+ if (hookEvent === 'UserPromptSubmit' && top) {
231
234
  try {
235
+ const stDir = join(repo, '.sawbuck'); const stPath = join(stDir, 'state.json');
236
+ let st = {}; try { st = JSON.parse(readFileSync(stPath, 'utf8')); } catch {}
237
+ const now = new Date().toISOString();
232
238
  if (mandatesInForce(repo).length) {
233
- const stDir = join(repo, '.sawbuck'); const stPath = join(stDir, 'state.json');
234
- let st = {}; try { st = JSON.parse(readFileSync(stPath, 'utf8')); } catch {}
235
- const now = new Date().toISOString();
236
239
  const prev = st.turnBaseline && typeof st.turnBaseline === 'object' ? st.turnBaseline : null;
237
240
  const stoppedSince = st.lastStopAt && st.lastPromptAt && Date.parse(st.lastStopAt) >= Date.parse(st.lastPromptAt);
238
241
  const unfinished = !!prev && !!st.lastPromptAt && !stoppedSince;
239
242
  if (!unfinished) {
240
243
  const flagged = (st.lastViolation && st.lastViolation.files && typeof st.lastViolation.files === 'object') ? st.lastViolation.files : {};
241
- const files = protectedDirty(repo);
242
- for (const f of Object.keys(files)) if (flagged[f] === files[f]) delete files[f]; // the agent's un-reverted edit stays on the wall
244
+ const before = (st.lastViolation && st.lastViolation.before && typeof st.lastViolation.before === 'object') ? st.lastViolation.before : {};
245
+ // the content is stored (hash-object -w), so a person's edit the agent later overwrites can
246
+ // be restored by hash; a file still carrying the flagged content is baselined at the content
247
+ // the person had before the agent touched it, or not at all
248
+ const files = protectedDirty(repo, { store: true });
249
+ for (const f of Object.keys(files)) if (flagged[f] === files[f]) { if (before[f] && before[f] !== 'deleted') files[f] = before[f]; else delete files[f]; }
243
250
  let sha = ''; try { sha = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: repo, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim(); } catch {}
244
251
  // HEAD moved since the last Stop: the agent was not running, so the commits between turns
245
252
  // are the person's (accepting a change, a pull, a branch switch) and the baseline starts
246
- // there. Otherwise the baseline's commit does not advance past a flagged commit.
253
+ // there, UNLESS HEAD still carries a flagged file's content: then the pin holds (a commit
254
+ // a background process landed after the Stop does not walk the agent's change through).
247
255
  const moved = !!(sha && st.lastStopHead && sha !== st.lastStopHead);
248
- if (moved && st.lastViolation) delete st.lastViolation.sha;
249
- st.turnBaseline = { at: now, sha: (!moved && st.lastViolation && st.lastViolation.sha) || sha, files };
256
+ const stillInHead = moved && Object.entries(flagged).some(([f, h]) => { const b = blobAt(repo, sha, f); return h === 'deleted' ? b === '' : (!!h && b === h); });
257
+ const pin = !!(st.lastViolation && st.lastViolation.sha);
258
+ if (moved && !stillInHead && st.lastViolation) delete st.lastViolation.sha;
259
+ st.turnBaseline = { at: now, sha: ((!moved || stillInHead) && pin && st.lastViolation.sha) || sha, files };
250
260
  }
251
- st.lastPromptAt = now;
252
- mkdirSync(stDir, { recursive: true }); writeFileSync(stPath, JSON.stringify(st, null, 2) + '\n');
253
261
  }
262
+ st.lastPromptAt = now; // every prompt, mandates or not: the walls key their block budgets on it when the harness sends no prompt_id
263
+ mkdirSync(stDir, { recursive: true }); writeFileSync(stPath, JSON.stringify(st, null, 2) + '\n');
254
264
  } catch { /* the frame never fails a prompt */ }
255
265
  }
256
266
  const o = [frameBlock(repo), contextBlock(repo, false)].filter(Boolean).join('\n');
@@ -260,8 +270,8 @@ switch (cmd) {
260
270
  case 'recall': {
261
271
  // the notes face: supplementary relevant notes for your current changes, from any non-git memory
262
272
  // provider (e.g. an Obsidian vault). On-demand. Git history + live debt come from context / debt.
263
- const repo = repoArg();
264
- const g = (...a) => { try { return execFileSync('git', ['-C', repo, ...a], { encoding: 'utf8' }).trim(); } catch { return ''; } };
273
+ const repo = repoRoot();
274
+ const g = (...a) => { try { return execFileSync('git', ['-C', repo, ...a], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim(); } catch { return ''; } };
265
275
  let changed = g('diff', '--name-only', 'HEAD').split('\n').filter(Boolean);
266
276
  if (!changed.length) changed = g('diff', '--name-only', 'HEAD~1', 'HEAD').split('\n').filter(Boolean);
267
277
  if (!changed.length) { out('🐴 sawbuck: nothing changed to look up.'); break; }