@agfpd/iapeer-memory 0.3.0 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer-memory",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "iapeer-memory — peer memory for the iapeer ecosystem: vault, memoryd (index/search/MCP-http), layer-5 context fragments, role doctrines. The package IS the system; the claude/codex plugins are thin session sockets (docs/10-distribution.md, ADR-009).",
   "license": "MIT",
   "type": "module",
@@ -27,7 +27,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@agfpd/iapeer-memory-core": "0.3.0"
+    "@agfpd/iapeer-memory-core": "0.3.2"
   },
   "devDependencies": {
     "@types/bun": "^1.2.0",

package/src/cli.ts

@@ -19,6 +19,7 @@ import { liveEgress } from "./egress.js";
 import { memoryPaths } from "./paths.js";
 import { packageVersion } from "./version.js";
 import { cmdFmUpdate } from "./commands/fm-update.js";
+import { cmdBake } from "./commands/bake.js";
 import { cmdHook } from "./commands/hook.js";
 import { cmdInit } from "./commands/init.js";
 import { cmdInstallBinary } from "./commands/install-binary.js";
@@ -60,6 +61,8 @@ Commands:
   unprovision-peer --cwd P --runtime claude|codex [--occasion O]
                             strip OUR surfaces from one peer's cwd (mirror)
   fm-update [ops] FILE...   structural frontmatter edits + attribution stamp
+  bake FILE...              re-stamp YOUR authorship on notes you wrote via
+                            bash/shell (which bypasses the post-write hook)
   migrate --source DIR      move harness auto-memory into the vault
                             (dry-run by default; --apply to execute)
   dream-collect [--gate]    deterministic weekly-tick pre-filter (zero LLM):
@@ -147,6 +150,8 @@ export async function main(argv: string[]): Promise<number> {
       return cmdUnprovisionPeer(rest);
     case "fm-update":
       return cmdFmUpdate(rest);
+    case "bake":
+      return cmdBake(rest);
     case "migrate":
       return cmdMigrate(rest);
     case "render":

package/src/commands/bake.ts

@@ -0,0 +1,78 @@
+/**
+ * `iapeer-memory bake <files>` — re-stamp `last_edited_by = <agent>` (+ `updated`)
+ * on the given notes. THE PROBLEM: a shell/bash write to the vault (`echo >`,
+ * `sed -i`, `tee`, `cp`/`mv` …) bypasses the PostToolUse hook, so memoryd sees
+ * only the fs-change with no identity and humanEditPass mis-attributes it to the
+ * human. `bake` fixes the attribution: it makes the note a settled AGENT edit
+ * (humanEditPass then echo-agent-skips it; it also OVERWRITES a stamp memoryd may
+ * have raced in). It is `fm-update` with NO field ops — a pure attribution stamp.
+ * The just-in-time post-Bash hook reminds the agent to run it (no standing rule —
+ * Артур's design: the reminder fires only on a detected bash-vault-write).
+ *
+ *     iapeer-memory bake [--agent NAME] [--vault PATH] FILE [FILE ...]
+ *
+ * identity: `--agent` → PEER_PERSONALITY → IAPEER_MEMORY_AGENT_NAME
+ * (resolveAgentName, нюанс 10 — never guessed from cwd). No identity → error
+ * (a stamp with no author would be meaningless).
+ */
+
+import {
+  collectOps,
+  DEFAULT_CURATOR_SET,
+  fmUpdate,
+  getTaxonomy,
+  isLocaleId,
+  resolveAgentName,
+} from "@agfpd/iapeer-memory-core";
+
+export function cmdBake(argv: string[]): number {
+  let agent: string | null = null;
+  let vault = "";
+  const files: string[] = [];
+
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--agent") {
+      agent = argv[++i] ?? null;
+    } else if (a === "--vault") {
+      vault = argv[++i] ?? "";
+    } else if (a.startsWith("--")) {
+      console.error(`iapeer-memory bake: unknown flag: ${a}`);
+      return 2;
+    } else {
+      files.push(a);
+    }
+  }
+  if (!files.length) {
+    console.error("iapeer-memory bake: no files given");
+    return 2;
+  }
+
+  const localeRaw = process.env.IAPEER_MEMORY_LOCALE || "en";
+  if (!isLocaleId(localeRaw)) {
+    console.error(`iapeer-memory bake: unknown locale "${localeRaw}"`);
+    return 2;
+  }
+  const resolved = resolveAgentName(agent);
+  if (!resolved) {
+    console.error(
+      "iapeer-memory bake: no agent identity (set PEER_PERSONALITY or pass --agent NAME)",
+    );
+    return 2;
+  }
+  const curatorSet = (process.env.IAPEER_MEMORY_CURATOR_SET || "")
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+
+  fmUpdate({
+    files,
+    ops: collectOps({ set: [], unset: [], listAdd: [], listRemove: [] }),
+    agent: resolved,
+    vault: vault || process.env.IAPEER_MEMORY_VAULT_PATH || "",
+    taxonomy: getTaxonomy(localeRaw),
+    curatorSet: curatorSet.length ? curatorSet : DEFAULT_CURATOR_SET,
+    stamp: true,
+  });
+  return 0;
+}

package/src/commands/hook.ts

@@ -492,15 +492,119 @@ function logHookError(err: unknown): void {
   }
 }
 
+// ── bash-write attribution reminder (Артур's just-in-time design) ────────────
+// A shell/bash write to the vault bypasses this hook's Write/Edit path, so
+// memoryd sees only the fs-change with no identity and mis-attributes it to the
+// human. When a Bash command WRITES to a vault `.md`, remind the agent to
+// re-stamp its authorship via `iapeer-memory bake`. There is NO standing rule
+// (Артур): the reminder is the ONLY carrier, emitted just-in-time. Detection is
+// best-effort — obscure forms are missed; the one false positive we must avoid
+// is read-then-redirect-elsewhere (`cat note.md > /tmp/x`), so we capture the
+// write-TARGET of each operator, never every vault path mentioned.
+
+// One path token: "double-quoted" | 'single-quoted' | bare (no shell metachars).
+// Quotes are REQUIRED to carry spaces — the real vault path has them
+// ("…/Mobile Documents/…"), so a space-blind matcher would miss every write.
+const PATH_TOKEN = String.raw`(?:"([^"]*)"|'([^']*)'|([^\s'"|&;<>()]+))`;
+/** The matched path value from a PATH_TOKEN match starting at group `i`. */
+function pathVal(m: RegExpMatchArray, i: number): string {
+  return m[i] ?? m[i + 1] ?? m[i + 2] ?? "";
+}
+
+/** Write-TARGET paths of a bash command (best-effort): the path each write
+ *  operator writes TO (never a read arg). Covers `>`/`>>`, `tee`, `sed -i`,
+ *  `cp`/`mv`; handles quoted paths with spaces. */
+export function bashWriteTargets(cmd: string): string[] {
+  const targets: string[] = [];
+  // redirection `>`/`>>` TARGET — excludes `2>` (fd), `>&` and `>(...)`.
+  for (const m of cmd.matchAll(new RegExp(String.raw`(?<![0-9&])>>?\s*(?![&(])` + PATH_TOKEN, "g"))) {
+    const t = pathVal(m, 1);
+    if (t) targets.push(t);
+  }
+  // `tee [-a] FILE...` — path tokens until a pipe / terminator.
+  for (const seg of cmd.matchAll(/\btee\b([^|&;]*)/g)) {
+    for (const m of seg[1].matchAll(new RegExp(PATH_TOKEN, "g"))) {
+      const t = pathVal(m, 1);
+      if (t && !t.startsWith("-")) targets.push(t);
+    }
+  }
+  // `sed -i…` / `--in-place` edits its file args in place → any `.md` token.
+  if (/\bsed\b\s+(?:-\S*i\S*|--in-place)/.test(cmd)) {
+    for (const m of cmd.matchAll(new RegExp(PATH_TOKEN, "g"))) {
+      const t = pathVal(m, 1);
+      if (t.endsWith(".md")) targets.push(t);
+    }
+  }
+  // `cp`/`mv SRC… DEST` — the last path token of the segment is the destination.
+  for (const seg of cmd.matchAll(/\b(?:cp|mv)\b([^|&;]*)/g)) {
+    const toks: string[] = [];
+    for (const m of seg[1].matchAll(new RegExp(PATH_TOKEN, "g"))) {
+      const t = pathVal(m, 1);
+      if (t && !t.startsWith("-")) toks.push(t);
+    }
+    if (toks.length >= 2) targets.push(toks[toks.length - 1]);
+  }
+  return targets;
+}
+
+/** A bake-reminder additionalContext when a Bash event wrote to a vault `.md`,
+ *  else null. */
+export function bashVaultWriteReminder(
+  text: string,
+  env: Record<string, string | undefined> = process.env,
+): string | null {
+  let event: { tool_name?: string; tool_input?: { command?: string }; cwd?: string };
+  try {
+    event = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (event.tool_name !== "Bash") return null;
+  const cmd = event.tool_input?.command ?? "";
+  const vault = env.IAPEER_MEMORY_VAULT_PATH ?? "";
+  if (!cmd || !vault) return null;
+  const vaultRoot = path.resolve(vault);
+  const cwd = event.cwd && path.isAbsolute(event.cwd) ? event.cwd : null;
+  const hits: string[] = [];
+  for (const raw of bashWriteTargets(cmd)) {
+    if (!raw.endsWith(".md")) continue;
+    let abs: string;
+    if (path.isAbsolute(raw)) abs = path.resolve(raw);
+    else if (cwd) abs = path.resolve(cwd, raw);
+    else continue; // relative + unknown cwd → best-effort skip
+    if (abs === vaultRoot || abs.startsWith(vaultRoot + path.sep)) hits.push(raw);
+  }
+  if (!hits.length) return null;
+  const list = hits
+    .map((h) => (/[\s'"]/.test(h) ? `'${h.replace(/'/g, "'\\''")}'` : h))
+    .join(" ");
+  return (
+    "[iapeer-memory] you wrote a vault note via bash — the post-write hook didn't see it, " +
+    "so memoryd would mis-attribute it to the human. Re-stamp your authorship:\n" +
+    `  iapeer-memory bake ${list}`
+  );
+}
+
 export async function cmdHook(argv: string[], egress: Egress): Promise<number> {
   const [event] = argv;
   try {
     switch (event) {
       case "post-write": {
         const text = await Bun.stdin.text();
-        const result = runPostWrite(text); // sync: stamp + tag gate
+        const result = runPostWrite(text); // sync: stamp + tag gate (Write/Edit)
         const hints = await collectDedupAndLinkHints(text, egress); // async, fail-open §3a/§3b
-        const output = mergeHookOutput(result.output, hints);
+        let output = mergeHookOutput(result.output, hints);
+        // Bash events have no stamp/dedup output — instead, a just-in-time bake
+        // reminder when the command wrote to a vault note (mutually exclusive
+        // with the Write/Edit path above; both never fire for one event).
+        if (!output) {
+          const bake = bashVaultWriteReminder(text);
+          if (bake) {
+            output = JSON.stringify({
+              hookSpecificOutput: { hookEventName: "PostToolUse", additionalContext: bake },
+            });
+          }
+        }
         if (output) console.log(output);
         return 0;
       }

package/src/commands/init.ts

@@ -358,16 +358,19 @@ export async function cmdInit(argv: string[], egress: Egress): Promise<number> {
       roleEntries.push({ role, peerCwd, template });
     }
     writeRolesManifest({ rolesManifestPath: paths.rolesManifestPath, roles: roleEntries });
-    // The scriber is the inverted pipeline's first receiver — an
-    // EPHEMERAL worker (clean window per delivery, ADR-015): patch one key
-    // into its core-owned profile, no-clobber.
-    const cwEntry = roleEntries.find((r) => r.role === "scriber");
-    const wakePolicy = cwEntry ? patchWakePolicyEphemeral(cwEntry.peerCwd) : "missing-profile";
+    // ALL curators (Index/Scriber/DreamWeaver) are TICK-STATELESS — each wakes
+    // for a discrete pass (CURATOR_TICK / dream-tick / on-demand) and carries
+    // no state between wakes. They run EPHEMERAL (a clean session per wake): a
+    // PERSISTENT session would accumulate a STALE model after a deploy — exactly
+    // the migration class an ephemeral flip structurally kills. Patch the one
+    // key into each core-owned profile, no-clobber.
+    const wakePolicies = roleEntries.map((r) => `${r.role}:${patchWakePolicyEphemeral(r.peerCwd)}`);
+    const wakeOk = wakePolicies.every((w) => !w.endsWith("missing-profile"));
     step(
       "roles",
       `${roleEntries.map((r) => rolePersonality(r.role as (typeof ROLE_NAMES)[number])).join(", ")} ` +
-        `(doctrines v${version}, scriber wake_policy: ${wakePolicy}, manifest ${paths.rolesManifestPath})`,
-      rolesOk && roleEntries.length === ROLE_NAMES.length && wakePolicy !== "missing-profile",
+        `(doctrines v${version}, wake_policy ${wakePolicies.join(" ")}, manifest ${paths.rolesManifestPath})`,
+      rolesOk && roleEntries.length === ROLE_NAMES.length && wakeOk,
     );
   }
 

package/src/commands/update.ts

@@ -57,6 +57,7 @@ import {
   DREAM_TRIGGER_ID,
   LEGACY_SWEEP_TRIGGER_ID,
   dreamTimerMessage,
+  patchWakePolicyEphemeral,
   registerTimer,
   registerWatcher,
   unregisterTimer,
@@ -139,6 +140,18 @@ export function cmdUpdate(argv: string[], egress: Egress): number {
         .join(", ") + ` (v${version}; roles pick it up on next cold wake)`,
       missing.length === 0,
     );
+    // wake_policy: all curators are tick-stateless ephemeral workers — a
+    // PERSISTENT session accumulates a stale model after a deploy (the migration
+    // class an ephemeral flip kills). Re-assert ephemeral on every update
+    // (no-clobber, idempotent — "identical" when already set).
+    const wp = manifest.roles.map((r) => `${r.role}:${patchWakePolicyEphemeral(r.peerCwd)}`);
+    const wpMissing = wp.filter((w) => w.endsWith("missing-profile")).length;
+    step(
+      "wake_policy",
+      `${wp.join(" ")} (ephemeral — fresh session per wake)` +
+        (wpMissing ? ` — ${wpMissing} profile(s) not yet born (peer birth creates them)` : ""),
+      true, // best-effort reconciliation; a missing peer profile is a birth concern, never an update failure
+    );
   }
 
   // 4. fleet map — personality → cwd × runtimes (the joint of the surfaces

package/src/surfaces/claude.ts

@@ -162,7 +162,11 @@ export function expectedHookEntries(
 ): Record<"PostToolUse" | "SessionStart", HookEntry> {
   return {
     PostToolUse: {
-      matcher: "Write|Edit|MultiEdit",
+      // Bash is included so a shell write to the vault (which bypasses the
+      // Write/Edit path) triggers the just-in-time bake-attribution reminder.
+      // The bin fast-exits for the (vast majority of) bash commands that touch
+      // no vault note.
+      matcher: "Write|Edit|MultiEdit|Bash",
       hooks: [{ type: "command", command: shimPath(hooksDir, "post-write") }],
     },
     SessionStart: {