snipara-companion 3.2.29 → 3.2.30

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 Release notes for `snipara-companion`, newest first.
 
+## New In 3.2.30
+
+- Persists an explicit `--ack-review-only` as a 15-minute, one-use
+  acknowledgement bound to the exact guard profile, action, and finding
+  fingerprint, so the immediately following Git hook can consume it safely.
+- Invalidates that acknowledgement when findings change and never applies it
+  to required acknowledgements, active conflicts, or hard blocks.
+- Resolves collaboration state from `SNIPARA_WORKSPACE_DIR` or the Git
+  top-level directory, preventing filtered package commands from writing a
+  nested `packages/cli/.snipara/` session.
+
 ## New In 3.2.29
 
 - Extends `workflow producer-report` with attributed gated-execution samples

package/dist/index.d.ts

@@ -2831,6 +2831,7 @@ declare function buildCodingIntelligenceLedger(options?: CodingLedgerBuildOption
 declare function codingLedgerExportCommand(options: CodingLedgerExportCommandOptions): Promise<void>;
 
 declare const COLLABORATION_STATE_RELATIVE_PATH: string;
+type CollaborationGuardProfile = "edit" | "pre-commit" | "pre-push" | "pre-deploy" | "migration" | "schema" | "release-package";
 type CollaborationGuardActionKind = "safe_to_ack" | "needs_handoff" | "needs_test" | "needs_package_review" | "blocking_conflict" | "guard_unavailable";
 interface CollaborationGuardActionCard {
     kind: CollaborationGuardActionKind;
@@ -2910,6 +2911,13 @@ interface CollaborationLocalLeaseRecord {
     expiresAt?: string | null;
     workSessionId?: string;
 }
+interface CollaborationReviewOnlyAcknowledgement {
+    profile: CollaborationGuardProfile;
+    action: string;
+    findingFingerprint: string;
+    acknowledgedAt: string;
+    expiresAt: string;
+}
 interface CollaborationLocalState {
     schemaVersion: "snipara.collaboration.v1";
     updatedAt: string;
@@ -2926,6 +2934,7 @@ interface CollaborationLocalState {
     files: string[];
     resources: CollaborationResource[];
     leases: CollaborationLocalLeaseRecord[];
+    reviewOnlyAcknowledgements: CollaborationReviewOnlyAcknowledgement[];
     lastGuard?: {
         decision: CollaborationGuardDecision;
         severity: string;

package/dist/index.js

@@ -15400,6 +15400,7 @@ var DEFAULT_LOCAL_CODE_MAX_FILES = 2e3;
 var HOSTED_GUARD_MAX_FILES = 450;
 var HOSTED_GUARD_MAX_RESOURCES = 850;
 var HOSTED_GUARD_MAX_SYMBOL_RESOURCES = 160;
+var REVIEW_ONLY_ACK_TTL_MS = 15 * 60 * 1e3;
 var HOOK_BLOCK_PREFIX2 = "snipara:collaboration-guard";
 var CHECKOUT_GIT_WRITE_RESOURCE = {
   kind: "SURFACE",
@@ -15460,7 +15461,8 @@ function createEmptyCollaborationState(now = /* @__PURE__ */ new Date()) {
     updatedAt: now.toISOString(),
     files: [],
     resources: [],
-    leases: []
+    leases: [],
+    reviewOnlyAcknowledgements: []
   };
 }
 function getCollaborationStatePath(rootDir = process.cwd()) {
@@ -15493,13 +15495,18 @@ function loadCollaborationState(rootDir = process.cwd()) {
     files: normalizeFiles(parsed.files),
     resources: normalizeResources(parsed.resources),
     leases: normalizeLocalLeases(parsed.leases),
+    reviewOnlyAcknowledgements: normalizeReviewOnlyAcknowledgements(
+      parsed.reviewOnlyAcknowledgements
+    ),
     lastGuard: normalizeLastGuard(parsed.lastGuard)
   };
   expireLocalLeases(state);
+  expireReviewOnlyAcknowledgements(state);
   return state;
 }
 function saveCollaborationState(state, rootDir = process.cwd()) {
   expireLocalLeases(state);
+  expireReviewOnlyAcknowledgements(state);
   const statePath = getCollaborationStatePath(rootDir);
   fs20.mkdirSync(path19.dirname(statePath), { recursive: true });
   const tempPath = `${statePath}.${process.pid}.${Date.now()}.tmp`;
@@ -15814,13 +15821,14 @@ async function collaborationGuardCommand(options) {
   const context = resolveCollaborationContext(options);
   const state = loadCollaborationState(context.rootDir);
   const profile = normalizeGuardProfile(options.profile) ?? "edit";
+  const action = normalizeOptionalString3(options.action) ?? profile;
   const files = resolveGuardFiles(context, options, profile);
   const resources = resolveCommandResources(context, files, options, profile);
   ensureFilesOrResources(files, resources, "guard");
   const hostedPayload = buildHostedGuardPayload(files, resources);
   const hosted = await maybeEvaluateHostedGuard(context, {
     workSessionId: options.workSessionId ?? state.workSessionId,
-    action: normalizeOptionalString3(options.action) ?? profile,
+    action,
     files: hostedPayload.files,
     resources: hostedPayload.resources,
     persist: options.persist !== false
@@ -15832,26 +15840,39 @@ async function collaborationGuardCommand(options) {
       decision: evaluation.decision,
       severity: evaluation.severity,
       checkedAt: evaluation.evaluatedAt,
-      action: normalizeOptionalString3(options.action) ?? profile,
+      action,
       resources: evaluation.resources,
       conflictCount: evaluation.conflicts.length
     };
     state.files = mergeStrings(state.files, files);
     state.resources = mergeResources(state.resources, evaluation.resources);
+  }
+  const explicitReviewOnlyAck = Boolean(options.enforce) && Boolean(options.ackReviewOnly) && isReviewOnlyGuardEvaluation(evaluation);
+  const findingFingerprint = evaluation && isReviewOnlyGuardEvaluation(evaluation) ? fingerprintReviewOnlyGuardEvaluation(evaluation) : void 0;
+  const persistedReviewOnlyAck = Boolean(options.enforce) && !options.ackReviewOnly && Boolean(
+    findingFingerprint && consumeReviewOnlyAcknowledgement(state, profile, action, findingFingerprint)
+  );
+  if (explicitReviewOnlyAck && findingFingerprint) {
+    persistReviewOnlyAcknowledgement(state, profile, action, findingFingerprint);
+  } else if (evaluation && !persistedReviewOnlyAck) {
+    invalidateReviewOnlyAcknowledgements(state, profile, action);
+  }
+  const reviewOnlyAcknowledged = explicitReviewOnlyAck || persistedReviewOnlyAck;
+  const ackSource = explicitReviewOnlyAck ? "explicit" : persistedReviewOnlyAck ? "persisted" : "none";
+  if (evaluation) {
     saveCollaborationState(state, context.rootDir);
   }
-  const reviewOnlyAcknowledged = Boolean(options.enforce) && Boolean(options.ackReviewOnly) && isReviewOnlyGuardEvaluation(evaluation);
   const actionCards = buildCollaborationGuardActionCards(evaluation, {
     profile,
     enforced: Boolean(options.enforce),
-    ackReviewOnly: Boolean(options.ackReviewOnly),
+    ackReviewOnly: reviewOnlyAcknowledged,
     reviewOnlyAcknowledged
   });
   const guardFailed = shouldFailCollaborationGuard({
     hostedStatus: hosted.status,
     evaluation,
     enforce: Boolean(options.enforce),
-    ackReviewOnly: Boolean(options.ackReviewOnly)
+    ackReviewOnly: reviewOnlyAcknowledged
   });
   if (guardFailed) {
     process.exitCode = 2;
@@ -15867,6 +15888,7 @@ async function collaborationGuardCommand(options) {
         enforced: Boolean(options.enforce),
         ackReviewOnly: Boolean(options.ackReviewOnly),
         reviewOnlyAcknowledged,
+        ackSource,
         failed: guardFailed
       }
     },
@@ -16036,7 +16058,8 @@ async function collaborationIdeStatusCommand(options) {
   console.log(`Active leases: ${payload.hosted.activeLeases.length}`);
 }
 function resolveCollaborationContext(options) {
-  const rootDir = path19.resolve(options.dir ?? process.cwd());
+  const requestedDir = normalizeOptionalString3(options.dir) ?? normalizeOptionalString3(process.env.SNIPARA_WORKSPACE_DIR) ?? process.cwd();
+  const rootDir = resolveRepoRoot3(requestedDir);
   const config = loadConfig({ cwd: rootDir });
   const actor = buildCollaborationActor(options, config);
   return {
@@ -17138,6 +17161,68 @@ function normalizeLocalLeases(value) {
     return lease;
   }).filter((item) => Boolean(item));
 }
+function normalizeReviewOnlyAcknowledgements(value, now = /* @__PURE__ */ new Date()) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  const nowMs = now.getTime();
+  return value.map((item) => {
+    const parsed = item;
+    const profile = normalizeGuardProfile(parsed.profile);
+    const action = normalizeOptionalString3(parsed.action);
+    const findingFingerprint = normalizeOptionalString3(parsed.findingFingerprint);
+    const acknowledgedAt = normalizeOptionalString3(parsed.acknowledgedAt);
+    const expiresAt = normalizeOptionalString3(parsed.expiresAt);
+    if (!profile || !action || !findingFingerprint || !acknowledgedAt || !expiresAt || !Number.isFinite(Date.parse(expiresAt)) || Date.parse(expiresAt) <= nowMs) {
+      return null;
+    }
+    return { profile, action, findingFingerprint, acknowledgedAt, expiresAt };
+  }).filter((item) => Boolean(item));
+}
+function expireReviewOnlyAcknowledgements(state, now = /* @__PURE__ */ new Date()) {
+  state.reviewOnlyAcknowledgements = normalizeReviewOnlyAcknowledgements(
+    state.reviewOnlyAcknowledgements,
+    now
+  );
+}
+function fingerprintReviewOnlyGuardEvaluation(evaluation) {
+  const findings = evaluation.conflicts.map((conflict) => ({
+    code: conflict.code,
+    decision: conflict.decision,
+    severity: conflict.severity,
+    resource: `${conflict.resource.kind}:${conflict.resource.id}`,
+    actor: conflict.conflictingActor ? `${conflict.conflictingActor.actorType}:${conflict.conflictingActor.actorId}` : null,
+    workSessionId: conflict.workSessionId ?? null,
+    reason: conflict.reason
+  })).sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)));
+  return (0, import_node_crypto6.createHash)("sha256").update(JSON.stringify(findings)).digest("hex");
+}
+function persistReviewOnlyAcknowledgement(state, profile, action, findingFingerprint, now = /* @__PURE__ */ new Date()) {
+  invalidateReviewOnlyAcknowledgements(state, profile, action);
+  state.reviewOnlyAcknowledgements.push({
+    profile,
+    action,
+    findingFingerprint,
+    acknowledgedAt: now.toISOString(),
+    expiresAt: new Date(now.getTime() + REVIEW_ONLY_ACK_TTL_MS).toISOString()
+  });
+}
+function consumeReviewOnlyAcknowledgement(state, profile, action, findingFingerprint) {
+  expireReviewOnlyAcknowledgements(state);
+  const index = state.reviewOnlyAcknowledgements.findIndex(
+    (ack) => ack.profile === profile && ack.action === action && ack.findingFingerprint === findingFingerprint
+  );
+  if (index < 0) {
+    return false;
+  }
+  state.reviewOnlyAcknowledgements.splice(index, 1);
+  return true;
+}
+function invalidateReviewOnlyAcknowledgements(state, profile, action) {
+  state.reviewOnlyAcknowledgements = state.reviewOnlyAcknowledgements.filter(
+    (ack) => ack.profile !== profile || ack.action !== action
+  );
+}
 function normalizeLastGuard(value) {
   const parsed = value;
   if (!parsed || !parsed.decision || !parsed.checkedAt) {
@@ -37497,7 +37582,7 @@ collaboration.command("guard").description("Check files or resources against act
   "edit"
 ).option("-a, --action <action>", "Guarded action label", "edit").option("--actor <actor>", "Developer or agent display name").option("--actor-id <actorId>", "Stable developer or agent id").option("--actor-type <actorType>", "HUMAN|AGENT|SYSTEM", "AGENT").option("--session-id <sessionId>", "Automation/session id").option("--work-session-id <workSessionId>", "Existing hosted work session id").option("--client <client>", "Client label", "snipara-companion").option("--repository <repository>", "Repository id").option("-b, --branch <branch>", "Current branch name").option("--worktree <worktree>", "Worktree path").option("--max-files <number>", "Maximum files for local code resource expansion", "2000").option("--no-persist", "Evaluate without storing a guard event").option("--enforce", "Exit non-zero for REVIEW_REQUIRED or REQUIRES_ACK, not only BLOCKED").option(
   "--ack-review-only",
-  "Under --enforce, acknowledge review-only stale-state and decision-consistency warnings"
+  "Under --enforce, persist one exact review-only acknowledgement for the next hook rerun"
 ).option("-d, --dir <directory>", "Repository directory (default: current)").option("--json", "Print raw JSON").option("--verbose", "Print the full guard report even when the guard passes").action(async (options) => {
   await collaborationGuardCommand({
     files: options.files,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "snipara-companion",
-  "version": "3.2.29",
+  "version": "3.2.30",
   "description": "Local-first CLI that asks your repo what breaks before an AI coding agent edits it.",
   "main": "dist/index.js",
   "bin": {