snipara-companion 3.6.3 → 3.6.4

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 Release notes for `snipara-companion`, newest first.
 
+## New In 3.6.4
+
+- Correlates hosted Judgment responses with their immutable snapshot, append-only
+  exposure, run, and served-Judgment identities.
+- Sends those canonical identities back with advisor influence receipts so the
+  backend can reject mismatched client correlation data.
+- Keeps hosted Judgment failures best-effort for local runs while reporting the
+  failure boundary explicitly.
+
 ## New In 3.6.3
 
 - Labels every semantic `confidence` value as an uncalibrated

package/dist/index.d.ts

@@ -688,6 +688,9 @@ interface AdvisorInfluenceRecommendationInput {
 }
 interface RecordAdvisorInfluenceReceiptInput {
     servedJudgmentId: string;
+    judgmentSnapshotId?: string;
+    judgmentExposureId?: string;
+    runId?: string;
     recommendation: AdvisorInfluenceRecommendationInput;
     agentDecision: AdvisorInfluenceAgentDecision;
     behaviorChange: string;
@@ -725,6 +728,16 @@ interface ProjectIntelligenceBriefRequest {
     changedFiles?: string[];
     symbols?: string[];
     routes?: string[];
+    codeContext?: {
+        localHeadSha?: string;
+        branch?: string;
+        workingTreeDirty?: boolean;
+    };
+    correlation?: {
+        surface?: "companion";
+        runId?: string;
+        sessionId?: string;
+    };
 }
 interface HostedProjectIntelligenceBriefResult {
     project: {
@@ -733,6 +746,8 @@ interface HostedProjectIntelligenceBriefResult {
         slug: string;
     };
     servedJudgmentId: string | null;
+    judgmentSnapshotId: string | null;
+    judgmentExposureId: string | null;
     persistedShadowSignalCount: number;
     brief: {
         version: string;
@@ -2933,6 +2948,8 @@ interface ProjectRunHostedJudgmentLink {
     status: "linked" | "unlinked" | "unavailable";
     timeoutMs: number;
     servedJudgmentId?: string;
+    judgmentSnapshotId?: string;
+    judgmentExposureId?: string;
     error?: string;
 }
 interface ProjectIntelligenceRunResult {

package/dist/index.js

@@ -13878,6 +13878,9 @@ var why_capture_confidence_v1_default = {
 var WHY_CAPTURE_CONFIDENCE_VERSION = why_capture_confidence_v1_default.version;
 var WHY_CAPTURE_CONFIDENCE_TEST_VECTORS = why_capture_confidence_v1_default.vectors;
 
+// ../project-intelligence-contracts/src/judgment-integrity.ts
+var import_node_crypto4 = require("crypto");
+
 // src/commands/decision-requests.ts
 var fs12 = __toESM(require("fs"));
 var path11 = __toESM(require("path"));
@@ -15828,7 +15831,7 @@ var import_chalk10 = __toESM(require("chalk"));
 var fs27 = __toESM(require("fs"));
 var path26 = __toESM(require("path"));
 var import_node_child_process13 = require("child_process");
-var import_node_crypto10 = require("crypto");
+var import_node_crypto11 = require("crypto");
 var import_chalk9 = __toESM(require("chalk"));
 
 // src/runtime/orchestrator-handoff.ts
@@ -16306,7 +16309,7 @@ function normalizeStringList2(values) {
 // src/commands/activity.ts
 var fs17 = __toESM(require("fs"));
 var path16 = __toESM(require("path"));
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var ACTIVITY_TIMELINE_VERSION = "snipara.activity_timeline.v0";
 var SESSION_SNAPSHOT_VERSION = "snipara.session_snapshot.v0";
 var ACTIVITY_RELATIVE_DIR = path16.join(".snipara", "activity");
@@ -16330,7 +16333,7 @@ function sortJsonValue3(value) {
   return value;
 }
 function hashEvent(input) {
-  return (0, import_node_crypto4.createHash)("sha256").update(stableJson(input)).digest("hex").slice(0, 16);
+  return (0, import_node_crypto5.createHash)("sha256").update(stableJson(input)).digest("hex").slice(0, 16);
 }
 function safeReadJson(filePath) {
   try {
@@ -16637,7 +16640,7 @@ async function appendJournalCheckpoint(payload) {
 // src/commands/coding-ledger.ts
 var fs18 = __toESM(require("fs"));
 var path17 = __toESM(require("path"));
-var import_node_crypto5 = require("crypto");
+var import_node_crypto6 = require("crypto");
 var import_node_child_process5 = require("child_process");
 var CODING_INTELLIGENCE_LEDGER_VERSION = "snipara.coding_intelligence_ledger.v0";
 var MAX_SECTION_ITEMS = 24;
@@ -17093,7 +17096,7 @@ function itemId(section, index, value) {
   return `${section}:${stableHash([section, String(index), value]).slice(0, 16)}`;
 }
 function stableHash(parts) {
-  return (0, import_node_crypto5.createHash)("sha256").update(parts.join("\0")).digest("hex");
+  return (0, import_node_crypto6.createHash)("sha256").update(parts.join("\0")).digest("hex");
 }
 function stringValue5(value) {
   if (typeof value === "string") {
@@ -17424,7 +17427,7 @@ function toProjectRelativePath2(absolutePath, cwd) {
 
 // src/commands/collaboration.ts
 var import_node_child_process6 = require("child_process");
-var import_node_crypto6 = require("crypto");
+var import_node_crypto7 = require("crypto");
 var fs20 = __toESM(require("fs"));
 var os6 = __toESM(require("os"));
 var path19 = __toESM(require("path"));
@@ -19153,7 +19156,7 @@ function printGuardActionCards(cards) {
   }
 }
 function buildLocalSessionId(context, task, files) {
-  const hash = (0, import_node_crypto6.createHash)("sha1").update([context.actor.actorId, context.branch ?? "", task ?? "", files.join(",")].join("\n")).digest("hex").slice(0, 12);
+  const hash = (0, import_node_crypto7.createHash)("sha1").update([context.actor.actorId, context.branch ?? "", task ?? "", files.join(",")].join("\n")).digest("hex").slice(0, 12);
   return `local_${hash}`;
 }
 function normalizeFiles(files) {
@@ -19258,7 +19261,7 @@ function fingerprintReviewOnlyGuardEvaluation(evaluation) {
     workSessionId: conflict.workSessionId ?? null,
     reason: conflict.reason
   })).sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)));
-  return (0, import_node_crypto6.createHash)("sha256").update(JSON.stringify(findings)).digest("hex");
+  return (0, import_node_crypto7.createHash)("sha256").update(JSON.stringify(findings)).digest("hex");
 }
 function persistReviewOnlyAcknowledgement(state, profile, action, findingFingerprint, now = /* @__PURE__ */ new Date()) {
   invalidateReviewOnlyAcknowledgements(state, profile, action);
@@ -19391,7 +19394,7 @@ function sleep2(ms) {
 var fs22 = __toESM(require("fs"));
 var path21 = __toESM(require("path"));
 var import_node_child_process8 = require("child_process");
-var import_node_crypto7 = require("crypto");
+var import_node_crypto8 = require("crypto");
 
 // src/commands/why-capture.ts
 var import_node_child_process7 = require("child_process");
@@ -21359,7 +21362,7 @@ function formatError2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 function buildRecordId(prefix, createdAt, summary, files) {
-  const hash = (0, import_node_crypto7.createHash)("sha1").update([createdAt, summary, files.join(",")].join("\n")).digest("hex").slice(0, 10);
+  const hash = (0, import_node_crypto8.createHash)("sha1").update([createdAt, summary, files.join(",")].join("\n")).digest("hex").slice(0, 10);
   return `${prefix}_${hash}`;
 }
 
@@ -22264,7 +22267,7 @@ function printKeyValue(label, value) {
 }
 
 // src/commands/final-commit-report.ts
-var import_node_crypto8 = require("crypto");
+var import_node_crypto9 = require("crypto");
 var import_node_child_process10 = require("child_process");
 var fs24 = __toESM(require("fs"));
 var path23 = __toESM(require("path"));
@@ -22545,7 +22548,7 @@ function writeFinalCommitReport(report, cwd = process.cwd()) {
       version: FINAL_COMMIT_REPORT_VERSION,
       path: outputPath,
       relativePath: FINAL_COMMIT_REPORT_RELATIVE_PATH,
-      hash: `sha256:${(0, import_node_crypto8.createHash)("sha256").update(content).digest("hex")}`
+      hash: `sha256:${(0, import_node_crypto9.createHash)("sha256").update(content).digest("hex")}`
     };
   } catch (error) {
     return {
@@ -22617,7 +22620,7 @@ function formatFinalCommitReport(report) {
 
 // src/commands/run.ts
 var import_node_child_process12 = require("child_process");
-var import_node_crypto9 = require("crypto");
+var import_node_crypto10 = require("crypto");
 var fs26 = __toESM(require("fs"));
 var path25 = __toESM(require("path"));
 var import_chalk8 = __toESM(require("chalk"));
@@ -24717,7 +24720,7 @@ function buildProjectIntelligenceRunEnvelope(startedAt = /* @__PURE__ */ new Dat
   const codexSessionId = stringValue10(process.env.CODEX_SESSION_ID)?.slice(0, 200);
   return {
     version: "project-intelligence.judgment-run-envelope.v1",
-    runId: sniparaSessionId ?? codexSessionId ?? `judgment-run:${(0, import_node_crypto9.randomUUID)()}`,
+    runId: sniparaSessionId ?? codexSessionId ?? `judgment-run:${(0, import_node_crypto10.randomUUID)()}`,
     identitySource: sniparaSessionId ? "snipara_session" : codexSessionId ? "codex_session" : "generated",
     startedAt: startedAt.toISOString()
   };
@@ -24725,6 +24728,24 @@ function buildProjectIntelligenceRunEnvelope(startedAt = /* @__PURE__ */ new Dat
 function normalizeStringList5(values) {
   return [...new Set((values ?? []).map((value) => value.trim()).filter(Boolean))];
 }
+function localCodeContext(branch) {
+  const context = {};
+  if (branch?.trim()) context.branch = branch.trim();
+  try {
+    const localHeadSha = (0, import_node_child_process12.execFileSync)("git", ["rev-parse", "--verify", "HEAD"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (localHeadSha) context.localHeadSha = localHeadSha;
+    const status = (0, import_node_child_process12.execFileSync)("git", ["status", "--porcelain"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    context.workingTreeDirty = status.length > 0;
+  } catch {
+  }
+  return context;
+}
 function uniqueStrings20(values) {
   return [...new Set(values.map((value) => value.trim()).filter(Boolean))];
 }
@@ -24958,6 +24979,9 @@ function advisorReceiptMetadata(args) {
     firstParty: true,
     runVersion: "project-intelligence.production-run.v1",
     runId: args.runEnvelope.runId,
+    servedJudgmentId: args.hostedJudgment?.servedJudgmentId ?? null,
+    judgmentSnapshotId: args.hostedJudgment?.judgmentSnapshotId ?? null,
+    judgmentExposureId: args.hostedJudgment?.judgmentExposureId ?? null,
     runEnvelope: args.runEnvelope,
     generatedAt: args.judgmentCard.generatedAt,
     release: Boolean(args.options.release),
@@ -25219,6 +25243,9 @@ async function recordFirstPartyAdvisorReceipts(args) {
             });
             const result = await client.recordAdvisorInfluenceReceipt({
               servedJudgmentId,
+              ...args.hostedJudgment?.judgmentSnapshotId ? { judgmentSnapshotId: args.hostedJudgment.judgmentSnapshotId } : {},
+              ...args.hostedJudgment?.judgmentExposureId ? { judgmentExposureId: args.hostedJudgment.judgmentExposureId } : {},
+              ...args.hostedJudgment?.status === "linked" ? { runId: args.runEnvelope.runId } : {},
               recommendation: advisorReceiptRecommendation(recommendation),
               agentDecision,
               behaviorChange,
@@ -25237,7 +25264,8 @@ async function recordFirstPartyAdvisorReceipts(args) {
                 lifecycle,
                 planScope,
                 measurementState,
-                runEnvelope: args.runEnvelope
+                runEnvelope: args.runEnvelope,
+                hostedJudgment: args.hostedJudgment
               })
             });
             return {
@@ -25387,7 +25415,12 @@ async function buildProjectIntelligenceRun(options) {
     ).createProjectIntelligenceBrief({
       ...options.task ? { task: options.task } : {},
       ...options.diffSummary ? { diffSummary: options.diffSummary } : {},
-      ...changedFiles.length > 0 ? { changedFiles: changedFiles.slice(0, 120) } : {}
+      ...changedFiles.length > 0 ? { changedFiles: changedFiles.slice(0, 120) } : {},
+      codeContext: localCodeContext(options.branch),
+      correlation: {
+        surface: "companion",
+        runId: runEnvelope.runId
+      }
     });
     if (hostedProjectIntelligenceBrief.servedJudgmentId) {
       brief.servedJudgmentId = hostedProjectIntelligenceBrief.servedJudgmentId;
@@ -25395,7 +25428,9 @@ async function buildProjectIntelligenceRun(options) {
         version: "project-intelligence.hosted-judgment-link.v1",
         status: "linked",
         timeoutMs: HOSTED_PROJECT_INTELLIGENCE_BRIEF_TIMEOUT_MS,
-        servedJudgmentId: hostedProjectIntelligenceBrief.servedJudgmentId
+        servedJudgmentId: hostedProjectIntelligenceBrief.servedJudgmentId,
+        ...hostedProjectIntelligenceBrief.judgmentSnapshotId ? { judgmentSnapshotId: hostedProjectIntelligenceBrief.judgmentSnapshotId } : {},
+        ...hostedProjectIntelligenceBrief.judgmentExposureId ? { judgmentExposureId: hostedProjectIntelligenceBrief.judgmentExposureId } : {}
       };
     } else {
       hostedJudgment = {
@@ -25485,7 +25520,8 @@ async function buildProjectIntelligenceRun(options) {
     judgmentCard,
     verificationEvidence: verificationEvidence2,
     outcomeReceipts,
-    runEnvelope
+    runEnvelope,
+    hostedJudgment
   });
   const suggestedCommands3 = [
     ...brief.suggestedCommands,
@@ -25886,7 +25922,7 @@ function contentBufferForHash(content) {
   return Buffer.from(content, "utf8");
 }
 function hashContent(content) {
-  return (0, import_node_crypto10.createHash)("sha256").update(contentBufferForHash(content)).digest("hex");
+  return (0, import_node_crypto11.createHash)("sha256").update(contentBufferForHash(content)).digest("hex");
 }
 function toPreview(value, maxLength = 160) {
   if (typeof value === "string") {
@@ -28557,7 +28593,7 @@ function findSandboxRuntimeBinding(state, phaseId) {
 function defaultSandboxSessionId(state, phase) {
   const workflowSlug = sanitizeWorkflowId(state.workflowId, "workflow").slice(0, 24);
   const phaseSlug = sanitizeWorkflowId(phase.id, "phase").slice(0, 24);
-  const digest = (0, import_node_crypto10.createHash)("sha1").update(`${state.workflowId}:${phase.id}`).digest("hex").slice(0, 10);
+  const digest = (0, import_node_crypto11.createHash)("sha1").update(`${state.workflowId}:${phase.id}`).digest("hex").slice(0, 10);
   return `sandbox-${workflowSlug}-${phaseSlug}-${digest}`.slice(0, 96);
 }
 function ensureSandboxRuntimeBinding(state, phase, now) {
@@ -35262,7 +35298,7 @@ async function sourceWatchCommand(options = {}) {
 var import_fs5 = __toESM(require("fs"));
 var import_path5 = __toESM(require("path"));
 var import_node_child_process14 = require("child_process");
-var import_node_crypto11 = require("crypto");
+var import_node_crypto12 = require("crypto");
 var import_chalk11 = __toESM(require("chalk"));
 var CONTROLLED_WORKER_EXECUTIONS_DIR = import_path5.default.join(".snipara", "worker-executions");
 var UNIFIED_RECEIPTS_DIR = import_path5.default.join(".snipara", "unified-receipts");
@@ -35530,7 +35566,7 @@ function pathFingerprint(workspaceRoot2, relativePath2) {
     const stat = import_fs5.default.lstatSync(candidate);
     if (stat.isSymbolicLink()) return `symlink:${import_fs5.default.readlinkSync(candidate)}`;
     if (!stat.isFile()) return `mode:${stat.mode}:size:${stat.size}`;
-    return `file:${stat.mode}:${(0, import_node_crypto11.createHash)("sha256").update(import_fs5.default.readFileSync(candidate)).digest("hex")}`;
+    return `file:${stat.mode}:${(0, import_node_crypto12.createHash)("sha256").update(import_fs5.default.readFileSync(candidate)).digest("hex")}`;
   } catch {
     return "missing";
   }
@@ -37829,7 +37865,7 @@ async function leadPlanCommand(options) {
 // src/commands/outcome-capture.ts
 var fs33 = __toESM(require("fs"));
 var path32 = __toESM(require("path"));
-var import_node_crypto12 = require("crypto");
+var import_node_crypto13 = require("crypto");
 var WHY_OUTCOME_CAPTURE_VERSION = "snipara.why_outcome_capture.v1";
 var DEFAULT_MAX_CANDIDATES = 20;
 var MAX_EVENTS = 50;
@@ -38358,7 +38394,7 @@ function readEventsFromFile(filePath) {
   return [];
 }
 function stableHash2(parts) {
-  return (0, import_node_crypto12.createHash)("sha256").update(parts.join("\0")).digest("hex");
+  return (0, import_node_crypto13.createHash)("sha256").update(parts.join("\0")).digest("hex");
 }
 function uniqueStrings22(values) {
   return Array.from(new Set(values.filter(Boolean)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "snipara-companion",
-  "version": "3.6.3",
+  "version": "3.6.4",
   "description": "Local-first CLI that asks your repo what breaks before an AI coding agent edits it.",
   "main": "dist/index.js",
   "bin": {