@bunshin-cc/bunshin 0.1.2 → 0.1.4

package/README.md

@@ -16,6 +16,8 @@ In Bunshin, open **Agent keys** and create a key for this computer. Paste it int
 
 Run `codex` interactively in the same project. Review and accept its project trust prompt, then run `/hooks` and review and trust the four Bunshin hooks. Project trust and hook trust are separate steps. If `/hooks` does not list Bunshin, check that you opened the connected project and trusted its configuration. This guide tests interactive sessions; `codex exec` is not a substitute for this setup check.
 
+For a linked Git worktree, setup puts Codex hooks in the primary checkout, where Codex reads them. The printed path identifies that shared hook file. Each connected worktree keeps its own `.bunshin` store and private connection. Worktrees created from a bare repository are not supported yet; use a full checkout.
+
 For Claude Code, use `bunshin setup --harness claude-code`, then start a new session in the project.
 
 For Pi, use Node.js 22.19 or later and run `bunshin setup --harness pi`. It installs a project extension in `.pi/extensions/bunshin.js`. Start Pi in the project (or run `/reload` in an existing session), review its project resources, and check `/bunshin status`. The extension ships in this npm package; you do not need a second package or a repository checkout.
@@ -43,4 +45,6 @@ npm uninstall -g @bunshin-cc/bunshin
 
 Use `--harness claude-code` to remove Claude Code hooks or `--harness pi` to remove the Pi extension. Revoke this computer’s key in Bunshin when disconnecting it. Removing hooks keeps local lessons.
 
+Codex hooks are shared across a repository's linked worktrees. Removing them from one removes the repository's Bunshin hooks for all its worktrees. Other tools' hooks are preserved.
+
 Full setup guide: [bunshin.cc/docs](https://bunshin.cc/docs/).

package/dist/bin.js

@@ -391,6 +391,10 @@ var init_store = __esm({
       saveConflict(conflict) {
         writeJsonAtomic(path2.join(this.conflictsDir, `${conflict.id}.json`), conflict);
       }
+      removeCachedConflict(id) {
+        if (!/^c_[a-f0-9]{8}$/.test(id)) throw new Error("Invalid cached conflict ID");
+        fs2.rmSync(path2.join(this.conflictsDir, `${id}.json`), { force: true });
+      }
       readMetrics(fallback) {
         return readJson(this.metricsFile, fallback);
       }
@@ -405,6 +409,7 @@ var init_store = __esm({
 var sync_exports = {};
 __export(sync_exports, {
   canSync: () => canSync,
+  mothershipLookup: () => mothershipLookup,
   mothershipRecall: () => mothershipRecall,
   pendingConflictQuestion: () => pendingConflictQuestion,
   resolveConflict: () => resolveConflict,
@@ -440,6 +445,14 @@ async function mothershipRecall(config, req, timeoutMs = 8e3) {
     return null;
   }
 }
+async function mothershipLookup(config, ids, timeoutMs = 8e3) {
+  if (!canSync(config) || !ids.length) return null;
+  try {
+    return await api(config, "POST", "/lessons/lookup", { ids }, timeoutMs);
+  } catch {
+    return null;
+  }
+}
 async function runSync(store) {
   const config = store.config();
   const result = { pushedLessons: 0, pushedTraces: 0, pulledConflicts: 0, errors: [] };
@@ -482,6 +495,13 @@ async function runSync(store) {
       store.saveConflict(c);
       result.pulledConflicts++;
     }
+    const pending = store.listConflicts().filter((c) => c.status === "open").map((c) => c.id);
+    for (let start = 0; start < pending.length; start += 60) {
+      const ids = pending.slice(start, start + 60);
+      const refreshed = await api(config, "POST", "/conflicts/lookup", { ids });
+      for (const c of refreshed.conflicts) if (ids.includes(c.id)) store.saveConflict(c);
+      for (const id of refreshed.unavailableIds) if (ids.includes(id)) store.removeCachedConflict(id);
+    }
   } catch (e) {
     result.errors.push(String(e instanceof Error ? e.message : e));
   }
@@ -494,8 +514,7 @@ async function resolveConflict(store, id, answer, note) {
   const local = store.listConflicts().find((c) => c.id === id);
   if (!local) throw new Error(`no pending conflict ${id}`);
   const resolution = { chosen: answer, by: config.userId, at: nowIso(), note };
-  if (canSync(config)) await api(config, "POST", `/conflicts/${encodeURIComponent(id)}/resolve`, resolution);
-  const resolved = { ...local, status: "resolved", resolution };
+  const resolved = canSync(config) ? (await api(config, "POST", `/conflicts/${encodeURIComponent(id)}/resolve`, resolution)).conflict : { ...local, status: "resolved", resolution };
   store.saveConflict(resolved);
   store.log("conflict-resolve", { id, answer });
   return resolved;
@@ -508,7 +527,7 @@ function pendingConflictQuestion(store, asked) {
   const options = c.options?.length ? `
 Options: ${c.options.map((o, i) => `(${i + 1}) ${o}`).join("  ")}` : "";
   const text = `## Knowledge conflict to resolve (Bunshin)
-The organisation's knowledge base has an unresolved ${c.kind} that only a human can settle. When it fits naturally (not before doing the user's request), ask the user this one question and record their answer by running \`bunshin conflict resolve ${c.id} "<answer>"\`:
+The organisation's knowledge base has an unresolved ${c.kind} that only a human can settle. When it fits naturally (not before doing the user's request), ask the user this question. They can compare the documents and save an explicit keep/retire decision in the Bunshin workspace's Conflicts page. Do not treat a free-text answer as permission to reactivate every document.
 
 > ${c.question}${options}
 
@@ -650,6 +669,7 @@ async function askCodexCli(opts) {
   const outFile = path4.join(os.tmpdir(), `bunshin-codex-${process.pid}-${Date.now()}.txt`);
   const args = ["exec", "--skip-git-repo-check", "--ephemeral", "-s", "read-only", "-o", outFile];
   if (opts.model) args.push("-m", opts.model);
+  if (opts.effort) args.push("-c", `model_reasoning_effort="${opts.effort}"`);
   args.push("-");
   const prompt = `${opts.system}${jsonOnlyInstruction(opts.schema)}
 
@@ -706,6 +726,41 @@ var init_llm = __esm({
   }
 });
 
+// src/project-hooks.ts
+import fs4 from "node:fs";
+import path5 from "node:path";
+import { execFileSync } from "node:child_process";
+function codexProjectHooks(cwd) {
+  const legacyFile = path5.join(cwd, ".codex", "hooks.json");
+  const git = (...args) => execFileSync("git", ["-C", cwd, "rev-parse", ...args], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 2e3
+  }).trim();
+  let root, common, directory;
+  try {
+    root = git("--show-toplevel");
+    common = git("--path-format=absolute", "--git-common-dir");
+    directory = git("--absolute-git-dir");
+  } catch {
+    return { file: legacyFile, shared: false, legacyFile };
+  }
+  const linked = fs4.realpathSync(common) !== fs4.realpathSync(directory);
+  if (linked) {
+    if (path5.basename(common) !== ".git" || !fs4.statSync(common).isDirectory()) {
+      throw new Error("Codex hooks in a worktree of a bare repository are not supported yet. Use a full checkout for Bunshin setup.");
+    }
+    root = path5.dirname(common);
+  }
+  const file = fs4.realpathSync(root) === fs4.realpathSync(cwd) ? legacyFile : path5.join(root, ".codex", "hooks.json");
+  return { file, shared: linked, legacyFile };
+}
+var init_project_hooks = __esm({
+  "src/project-hooks.ts"() {
+    "use strict";
+  }
+});
+
 // src/init.ts
 var init_exports = {};
 __export(init_exports, {
@@ -721,8 +776,8 @@ __export(init_exports, {
   removeBunshinHooks: () => removeBunshinHooks,
   runInit: () => runInit
 });
-import fs4 from "node:fs";
-import path5 from "node:path";
+import fs5 from "node:fs";
+import path6 from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 function isBunshinEntry(entry) {
   return entry?._bunshin === true || typeof entry?.command === "string" && /\bbunshin\b.*\bhook\b/.test(entry.command);
@@ -775,16 +830,16 @@ function countBunshinHooks(settings) {
   );
 }
 function claudeSettingsPath() {
-  return path5.join(homeDir(), ".claude", "settings.json");
+  return path6.join(homeDir(), ".claude", "settings.json");
 }
 function installPiExtension(cwd, remove = false, scope = "repo") {
-  const file = scope === "global" ? path5.join(homeDir(), ".pi/agent/extensions/bunshin.js") : path5.join(cwd, ".pi/extensions/bunshin.js");
+  const file = scope === "global" ? path6.join(homeDir(), ".pi/agent/extensions/bunshin.js") : path6.join(cwd, ".pi/extensions/bunshin.js");
   const marker = "// Managed by Bunshin setup.";
   try {
-    const previous = fileExists(file) ? fs4.readFileSync(file, "utf8") : "";
+    const previous = fileExists(file) ? fs5.readFileSync(file, "utf8") : "";
     if (previous && !previous.startsWith(marker)) throw new Error("An existing Bunshin extension file is not managed by setup; preserve or move it before continuing.");
     if (remove) {
-      if (previous) fs4.unlinkSync(file);
+      if (previous) fs5.unlinkSync(file);
       return { file, installed: 0, changed: !!previous };
     }
     const extension = fileURLToPath(new URL("./pi-extension.js", import.meta.url));
@@ -793,8 +848,8 @@ function installPiExtension(cwd, remove = false, scope = "repo") {
 export { default } from ${JSON.stringify(pathToFileURL(extension).href)};
 `;
     if (text !== previous) {
-      ensureDir(path5.dirname(file));
-      fs4.writeFileSync(file, text);
+      ensureDir(path6.dirname(file));
+      fs5.writeFileSync(file, text);
     }
     return { file, installed: 1, changed: text !== previous };
   } catch (error) {
@@ -803,14 +858,14 @@ export { default } from ${JSON.stringify(pathToFileURL(extension).href)};
 }
 function installClaudeHooks({ file = claudeSettingsPath(), bin = "bunshin", remove = false, harness = "claude-code" } = {}) {
   try {
-    const before = fileExists(file) ? JSON.parse(fs4.readFileSync(file, "utf8")) : {};
+    const before = fileExists(file) ? JSON.parse(fs5.readFileSync(file, "utf8")) : {};
     const after = remove ? removeBunshinHooks(before) : mergeClaudeSettings(before, { bin, harness });
     const changed = JSON.stringify(before) !== JSON.stringify(after);
     if (changed) {
-      ensureDir(path5.dirname(file));
+      ensureDir(path6.dirname(file));
       if (fileExists(file)) {
         try {
-          fs4.copyFileSync(file, `${file}.bunshin-backup`);
+          fs5.copyFileSync(file, `${file}.bunshin-backup`);
         } catch {
         }
       }
@@ -825,16 +880,16 @@ function runInit(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
   const warnings = [];
   const scope = opts.scope ?? "repo";
-  const root = scope === "global" ? path5.join(homeDir(), ".bunshin") : path5.join(cwd, ".bunshin");
-  const existed = fileExists(path5.join(root, "config.json"));
+  const root = scope === "global" ? path6.join(homeDir(), ".bunshin") : path6.join(cwd, ".bunshin");
+  const existed = fileExists(path6.join(root, "config.json"));
   const store = new Store(root);
   store.ensureLayout();
-  fs4.chmodSync(root, 448);
+  fs5.chmodSync(root, 448);
   if (scope === "repo") {
-    const ignore = path5.join(cwd, ".gitignore");
-    const current = fileExists(ignore) ? fs4.readFileSync(ignore, "utf8") : "";
+    const ignore = path6.join(cwd, ".gitignore");
+    const current = fileExists(ignore) ? fs5.readFileSync(ignore, "utf8") : "";
     if (!current.split(/\r?\n/).some((line) => /^\/?\.bunshin\/?$/.test(line.trim()))) {
-      fs4.appendFileSync(ignore, `${current && !current.endsWith("\n") ? "\n" : ""}.bunshin/
+      fs5.appendFileSync(ignore, `${current && !current.endsWith("\n") ? "\n" : ""}.bunshin/
 `);
     }
   }
@@ -861,8 +916,14 @@ function runInit(opts = {}) {
     if (hooks.error) warnings.push(hooks.error);
   }
   if ((opts.removeHooks || !opts.noHooks) && (config.harness === "codex" || config.harness === "claude-code")) {
-    const file = opts.settingsFile ?? (config.harness === "codex" ? path5.join(scope === "repo" ? path5.join(cwd, ".codex") : process.env.CODEX_HOME ?? path5.join(homeDir(), ".codex"), "hooks.json") : scope === "repo" ? path5.join(cwd, ".claude", "settings.local.json") : claudeSettingsPath());
+    const projectHooks = config.harness === "codex" && scope === "repo" && !opts.settingsFile ? codexProjectHooks(cwd) : void 0;
+    const file = opts.settingsFile ?? (config.harness === "codex" ? projectHooks?.file ?? path6.join(process.env.CODEX_HOME ?? path6.join(homeDir(), ".codex"), "hooks.json") : scope === "repo" ? path6.join(cwd, ".claude", "settings.local.json") : claudeSettingsPath());
     hooks = installClaudeHooks({ file, bin: opts.bin, remove: opts.removeHooks, harness: config.harness });
+    if (projectHooks?.shared) hooks.sharedWithWorktrees = true;
+    if (!hooks.error && projectHooks && projectHooks.file !== projectHooks.legacyFile && fileExists(projectHooks.legacyFile) && fs5.realpathSync(projectHooks.file) !== fs5.realpathSync(projectHooks.legacyFile)) {
+      const old = installClaudeHooks({ file: projectHooks.legacyFile, remove: true, harness: "codex" });
+      if (old.error) hooks.error = `Could not remove old Bunshin hooks from ${old.file}: ${old.error}`;
+    }
     if (hooks.error) warnings.push(`could not update ${hooks.file}: ${hooks.error}`);
   }
   if (!resolveBackend(config)) {
@@ -892,6 +953,7 @@ var init_init = __esm({
     init_store();
     init_util();
     init_llm();
+    init_project_hooks();
     HOOK_EVENTS = [
       { event: "UserPromptSubmit", arg: "user-prompt-submit", timeout: 10 },
       { event: "Stop", arg: "stop", timeout: 15 },
@@ -913,16 +975,16 @@ __export(setup_exports, {
   setupProject: () => setupProject,
   shellQuote: () => shellQuote
 });
-import fs5 from "node:fs";
-import path6 from "node:path";
+import fs6 from "node:fs";
+import path7 from "node:path";
 import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
 function executable(name) {
-  const directories = [...(process.env.PATH ?? "").split(path6.delimiter), path6.join(homeDir(), ".local/bin")];
+  const directories = [...(process.env.PATH ?? "").split(path7.delimiter), path7.join(homeDir(), ".local/bin")];
   for (const directory of directories) {
-    const file = path6.resolve(directory, name);
+    const file = path7.resolve(directory, name);
     try {
-      fs5.accessSync(file, fs5.constants.X_OK);
-      if (fs5.statSync(file).isFile()) return file;
+      fs6.accessSync(file, fs6.constants.X_OK);
+      if (fs6.statSync(file).isFile()) return file;
     } catch {
     }
   }
@@ -930,8 +992,8 @@ function executable(name) {
 }
 function hookBinary(harness) {
   const agent = executable(harness === "claude-code" ? "claude" : harness);
-  const directories = [.../* @__PURE__ */ new Set([path6.dirname(process.execPath), path6.join(homeDir(), ".local/bin"), ...agent ? [path6.dirname(agent)] : []])];
-  return `PATH=${shellQuote(directories.join(path6.delimiter))}:"$PATH" ${shellQuote(process.execPath)} ${shellQuote(fs5.realpathSync(process.argv[1]))}`;
+  const directories = [.../* @__PURE__ */ new Set([path7.dirname(process.execPath), path7.join(homeDir(), ".local/bin"), ...agent ? [path7.dirname(agent)] : []])];
+  return `PATH=${shellQuote(directories.join(path7.delimiter))}:"$PATH" ${shellQuote(process.execPath)} ${shellQuote(fs6.realpathSync(process.argv[1]))}`;
 }
 function apiAddress(raw) {
   const url = new URL(raw);
@@ -1000,23 +1062,23 @@ async function setupProject(opts) {
   const apiKey = opts.apiKey.trim();
   if (!apiKey || /\s/.test(apiKey)) throw new Error("Paste the complete agent key from your Bunshin workspace.");
   const profile = await connectionProfile(apiUrl, apiKey);
-  const root = path6.join(opts.cwd, ".bunshin");
+  const root = path7.join(opts.cwd, ".bunshin");
   const store = new Store(root);
   const previous = store.config();
   if ((previous.orgId !== profile.orgId || previous.userId !== profile.userId) && (store.listLessons().length || store.allTraces().length || store.listRecallLessons().length)) {
     throw new Error("This project has lessons or activity from another profile. Use a fresh project to connect this workspace.");
   }
-  const credentialDirectory = path6.join(homeDir(), ".config/bunshin/credentials");
-  fs5.mkdirSync(credentialDirectory, { recursive: true, mode: 448 });
-  fs5.chmodSync(credentialDirectory, 448);
+  const credentialDirectory = path7.join(homeDir(), ".config/bunshin/credentials");
+  fs6.mkdirSync(credentialDirectory, { recursive: true, mode: 448 });
+  fs6.chmodSync(credentialDirectory, 448);
   const name = createHash2("sha256").update(`${root}
 ${apiUrl}
 ${profile.orgId}
 ${profile.userId}`).digest("hex");
-  const credentialFile = path6.join(credentialDirectory, `${name}.json`);
+  const credentialFile = path7.join(credentialDirectory, `${name}.json`);
   const temporary = `${credentialFile}.${randomBytes2(4).toString("hex")}.tmp`;
-  fs5.writeFileSync(temporary, JSON.stringify({ apiUrl, apiKey }) + "\n", { mode: 384, flag: "wx" });
-  fs5.renameSync(temporary, credentialFile);
+  fs6.writeFileSync(temporary, JSON.stringify({ apiUrl, apiKey }) + "\n", { mode: 384, flag: "wx" });
+  fs6.renameSync(temporary, credentialFile);
   const result = runInit({
     cwd: opts.cwd,
     harness: opts.harness,
@@ -1977,10 +2039,11 @@ function redact(text) {
       if (name === "email") {
         return /^(?:no[._-]?reply|do[._-]?not[._-]?reply)@|@example\./i.test(match) ? match : "[REDACTED:email]";
       }
-      if (name === "bearer" || name === "assigned-secret") {
+      if (name === "bearer" || name === "assigned-secret" || name === "json-secret") {
         const key = String(groups[0] ?? "");
         const value = String(groups[1] ?? "");
         if (PLACEHOLDER_RE.test(value)) return match;
+        if (name === "json-secret") return `${JSON.stringify(key)}:"[REDACTED:json-secret]"`;
         return `${key}=[REDACTED:${name}]`;
       }
       return `[REDACTED:${name}]`;
@@ -1993,6 +2056,7 @@ var init_redact2 = __esm({
   "src/redact.ts"() {
     "use strict";
     PATTERNS = [
+      ["bunshin-key", /\bbsk_[A-Za-z0-9]{8}_[A-Za-z0-9]{32}\b/g],
       ["aws-key", /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA)[0-9A-Z]{16}\b/g],
       ["github-pat", /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g],
       ["anthropic-key", /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g],
@@ -2007,6 +2071,7 @@ var init_redact2 = __esm({
         "assigned-secret",
         /\b([A-Za-z0-9_.-]*(?:secret|passwd|password|api[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|session[_-]?token)[A-Za-z0-9_.-]*)\s*[:=]\s*['"]?([^\s'"#,;]{6,})['"]?/gi
       ],
+      ["json-secret", /"([A-Za-z0-9_.-]*(?:secret|passwd|password|api[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|session[_-]?token)[A-Za-z0-9_.-]*)"\s*:\s*"([^"\r\n]{6,})"/gi],
       ["card", /\b(?:\d[ -]?){13,19}\b/g],
       ["email", /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g]
     ];
@@ -2015,11 +2080,11 @@ var init_redact2 = __esm({
 });
 
 // src/transcript.ts
-import fs6 from "node:fs";
+import fs7 from "node:fs";
 function parseTranscript(file) {
   let raw = "";
   try {
-    raw = fs6.readFileSync(file, "utf8");
+    raw = fs7.readFileSync(file, "utf8");
   } catch {
     return { turns: [], userMessages: 0, toolCalls: 0, toolFailures: 0 };
   }
@@ -2055,10 +2120,13 @@ function parseTranscript(file) {
         turns.push({ role: "tool", tool: item.name || "tool", text: summarizeInput(input) });
         toolCalls++;
       } else if (item.type === "function_call_output" || item.type === "custom_tool_call_output") {
-        const text = blockText(item.output);
-        const isError = /(?:Process exited with code|exit_code["']?\s*:)\s*[1-9]\d*\b/i.test(text);
-        turns.push({ role: "tool", tool: "result", text, isError });
-        if (isError) toolFailures++;
+        const outputs = Array.isArray(item.output) ? item.output.filter((part) => part && typeof part === "object" && typeof part.text === "string").map((part) => part.text) : [item.output];
+        for (const output of outputs) {
+          const result = codexToolResult(output);
+          if (!result.text) continue;
+          turns.push({ role: "tool", tool: "result", ...result });
+          if (result.isError) toolFailures++;
+        }
       }
       continue;
     }
@@ -2110,6 +2178,31 @@ function blockText(content) {
   }
   return content == null ? "" : JSON.stringify(content);
 }
+function codexToolResult(output) {
+  const raw = blockText(output);
+  let envelope;
+  try {
+    envelope = JSON.parse(raw);
+  } catch {
+  }
+  if (envelope && typeof envelope === "object" && !Array.isArray(envelope)) {
+    const result = envelope;
+    if (typeof result.output === "string" && (Number.isInteger(result.exit_code) || result.exit_code === null || Number.isInteger(result.session_id))) {
+      const pending = !Number.isInteger(result.exit_code);
+      return {
+        text: `${pending ? "Command still running" : `Process exited with code ${result.exit_code}`}
+${result.output}`,
+        isError: !pending && result.exit_code !== 0,
+        pending
+      };
+    }
+  }
+  return {
+    text: raw,
+    isError: /(?:Process exited with code|exit_code["']?\s*:)\s*[1-9]\d*\b/i.test(raw),
+    pending: /(?:Process running with session ID|Script running with cell ID)/i.test(raw)
+  };
+}
 function summarizeInput(input) {
   if (input == null) return "";
   if (typeof input !== "object") return String(input);
@@ -2119,18 +2212,26 @@ function summarizeInput(input) {
   }
   return JSON.stringify(obj);
 }
-function digest(facts, { from = 0, maxChars = 6e4, toolResultChars = 600 } = {}) {
+function bounded(text, maxChars) {
+  if (text.length <= maxChars) return text;
+  const marker = "\n[... middle omitted ...]\n";
+  if (maxChars <= marker.length) return text.slice(0, Math.max(0, maxChars));
+  const head = Math.floor((maxChars - marker.length) / 2);
+  return text.slice(0, head) + marker + text.slice(-(maxChars - marker.length - head));
+}
+function digest(facts, { from = 0, maxChars = 6e4, toolResultChars = 6e3 } = {}) {
   const parts = [];
   for (const t of facts.turns.slice(from)) {
+    const text = redact(t.text);
     if (t.role === "user") parts.push(`[USER]
-${truncate(t.text, maxChars)}`);
+${bounded(text, maxChars)}`);
     else if (t.role === "assistant") parts.push(`[ASSISTANT]
-${truncate(t.text, maxChars)}`);
-    else if (t.tool === "result") parts.push(`[TOOL RESULT${t.isError ? " \u2014 ERROR" : ""}]
-${truncate(t.text, toolResultChars)}`);
-    else parts.push(`[TOOL ${t.tool}] ${truncate(t.text, 400)}`);
+${bounded(text, maxChars)}`);
+    else if (t.tool === "result") parts.push(`[TOOL RESULT${t.isError ? " \u2014 ERROR" : t.pending ? " \u2014 RUNNING" : ""}]
+${bounded(text, toolResultChars)}`);
+    else parts.push(`[TOOL ${t.tool}] ${truncate(text, 400)}`);
   }
-  return redact(truncate(parts.join("\n\n"), maxChars));
+  return bounded(parts.join("\n\n"), maxChars);
 }
 function recentContext(file, { turns = 2, maxChars = 6e3 } = {}) {
   const facts = parseTranscript(file);
@@ -2176,27 +2277,53 @@ async function runRecall(store, opts) {
   const rules = new Map(store.listRecallLessons().map((r) => [r.id, r]));
   let degraded;
   if (connected && !opts.offline) {
-    const remote = await mothershipRecall(config, {
-      task,
-      userId: config.userId,
-      role: config.role,
-      orgUnit: config.orgUnit,
-      limit: 8,
-      recentContext: history,
-      dryRun: opts.dryRun
-    }, remaining(8e3));
-    if (remote && (!remote.profile || remote.profile.orgId === config.orgId && remote.profile.userId === config.userId)) {
-      if (remote.profile) profile = remote.profile;
-      for (const lesson of remote.lessons) {
+    const cached = prepareRecall(local.map((lesson) => ({ lesson })), { task, ...profile }, profile).candidates.slice(0, 60).map((candidate) => candidate.lesson);
+    const cachedIds = new Set(cached.map((lesson) => lesson.id));
+    const [remote, lookup] = await Promise.all([
+      mothershipRecall(config, {
+        task,
+        userId: config.userId,
+        role: config.role,
+        orgUnit: config.orgUnit,
+        limit: 8,
+        recentContext: history,
+        dryRun: opts.dryRun
+      }, remaining(8e3)),
+      cached.length ? mothershipLookup(config, [...cachedIds], remaining(8e3)) : null
+    ]);
+    const sameIdentity = (p) => p?.orgId === config.orgId && p.userId === config.userId;
+    const remoteOK = remote && (!remote.profile || sameIdentity(remote.profile));
+    const lookupOK = lookup && sameIdentity(lookup.profile);
+    if (remoteOK || lookupOK) {
+      profile = (remoteOK ? remote.profile : void 0) ?? (lookupOK ? lookup.profile : void 0) ?? profile;
+      byId.clear();
+      const refreshed = /* @__PURE__ */ new Map();
+      if (lookupOK) {
+        const unavailable = new Set(lookup.unavailableIds);
+        for (const lesson of cached) {
+          if (unavailable.has(lesson.id) && lesson.version === 1 && (!config.lastSyncAt || lesson.provenance.createdAt > config.lastSyncAt)) byId.set(lesson.id, lesson);
+        }
+        for (const lesson of lookup.lessons) {
+          if (cachedIds.has(lesson.id) && lesson.provenance.orgId === profile.orgId) refreshed.set(lesson.id, lesson);
+        }
+      } else if (cached.length) {
+        degraded = "local cache refresh unavailable; using current hosted knowledge";
+      }
+      for (const lesson of remoteOK ? remote.lessons : []) {
         if (lesson.provenance.orgId !== profile.orgId) continue;
+        const checked = refreshed.get(lesson.id);
+        if (!checked || lesson.version > checked.version) refreshed.set(lesson.id, lesson);
+      }
+      for (const lesson of refreshed.values()) {
         byId.set(lesson.id, lesson);
         if (!opts.dryRun) store.saveLesson(lesson, { reindex: false });
       }
-      for (const rule of remote.recallLessons) rules.set(rule.id, rule);
+      for (const rule of remoteOK ? remote.recallLessons : []) rules.set(rule.id, rule);
       if (!opts.dryRun) {
-        for (const conflict of remote.pendingConflicts) store.saveConflict(conflict);
-        if (remote.lessons.length) store.rebuildIndex();
+        for (const conflict of remoteOK ? remote.pendingConflicts : []) store.saveConflict(conflict);
+        if (refreshed.size) store.rebuildIndex();
       }
+      if (!remoteOK) degraded = "hosted search unavailable; using refreshed locally authored knowledge";
     } else {
       degraded = "mothership unavailable or identity mismatch; using locally authored knowledge";
     }
@@ -2307,11 +2434,11 @@ __export(demo_exports, {
   runDemo: () => runDemo
 });
 import assert from "node:assert/strict";
-import fs7 from "node:fs";
+import fs8 from "node:fs";
 import os2 from "node:os";
-import path7 from "node:path";
+import path8 from "node:path";
 async function runDemo(write) {
-  const root = fs7.mkdtempSync(path7.join(os2.tmpdir(), "bunshin-demo-"));
+  const root = fs8.mkdtempSync(path8.join(os2.tmpdir(), "bunshin-demo-"));
   try {
     const store = Store.init(root, { ...APR_ENGINEER, apiUrl: "" });
     const { lessons, constraint, workflow } = aprScenario();
@@ -2328,7 +2455,7 @@ Task: ${APR_TASK}
     write(result.text);
     write("\nPASS: Collections constraint and workflow recalled; C-suite, other-company, and superseded lessons excluded.\n");
   } finally {
-    fs7.rmSync(root, { recursive: true, force: true });
+    fs8.rmSync(root, { recursive: true, force: true });
   }
 }
 var init_demo = __esm({
@@ -2347,27 +2474,27 @@ __export(reflect_exports, {
   buildLesson: () => buildLesson,
   runReflection: () => runReflection
 });
-import fs8 from "node:fs";
-import path8 from "node:path";
+import fs9 from "node:fs";
+import path9 from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 async function runReflection(store, opts) {
   const empty = { lessonIds: [], used: [], missed: [], attribution: [] };
-  const lock = path8.join(store.root, `reflect-${createHash3("sha256").update(opts.sessionId).digest("hex")}.lock`);
+  const lock = path9.join(store.root, `reflect-${createHash3("sha256").update(opts.sessionId).digest("hex")}.lock`);
   const deadline = Date.now() + 66e4;
   for (; ; ) {
     try {
-      fs8.writeFileSync(lock, String(process.pid), { flag: "wx", mode: 384 });
+      fs9.writeFileSync(lock, String(process.pid), { flag: "wx", mode: 384 });
       break;
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
       try {
-        const owner = Number(fs8.readFileSync(lock, "utf8"));
+        const owner = Number(fs9.readFileSync(lock, "utf8"));
         if (Number.isInteger(owner) && owner > 0) {
           try {
             process.kill(owner, 0);
           } catch (error2) {
             if (error2.code === "ESRCH") {
-              fs8.unlinkSync(lock);
+              fs9.unlinkSync(lock);
               continue;
             }
           }
@@ -2382,7 +2509,7 @@ async function runReflection(store, opts) {
     return await reflectSession(store, opts);
   } finally {
     try {
-      fs8.unlinkSync(lock);
+      fs9.unlinkSync(lock);
     } catch {
     }
   }
@@ -2440,7 +2567,12 @@ async function reflectSession(store, opts) {
   for (const raw of out.lessons) {
     const rejection = workflowRejection(raw, facts, excerpt);
     if (rejection) {
-      store.log("reflect-workflow-rejected", { session: opts.sessionId, title: redact(raw.title), reason: rejection });
+      store.log("reflect-workflow-rejected", {
+        session: opts.sessionId,
+        title: redact(raw.title),
+        reason: rejection,
+        evidence: Array.isArray(raw.verificationEvidence) ? raw.verificationEvidence.filter((quote) => typeof quote === "string").map((quote) => redact(quote).slice(0, 1e3)) : []
+      });
       continue;
     }
     const lesson = store.saveLesson(buildLesson(raw, store, opts), { reindex: false });
@@ -2464,13 +2596,15 @@ function workflowRejection(raw, facts, excerpt) {
   }
   const normalize = (text) => redact(text).replace(/\s+/g, " ").trim();
   const visible = normalize(excerpt);
-  const results = facts.turns.filter((turn) => turn.role === "tool" && turn.tool === "result" && !turn.isError).map((turn) => normalize(turn.text));
+  const results = facts.turns.filter((turn) => turn.role === "tool" && turn.tool === "result" && !turn.isError && !turn.pending).map((turn) => normalize(turn.text));
   const evidence = raw.verificationEvidence;
-  if (!Array.isArray(evidence) || !evidence.length || evidence.some((quote) => {
-    if (typeof quote !== "string") return true;
+  if (!Array.isArray(evidence) || !evidence.length) return "workflow requires verification quotes from successful tool results";
+  for (const [index, quote] of evidence.entries()) {
+    if (typeof quote !== "string") return `workflow verification quote ${index + 1} is not text`;
     const text = normalize(quote);
-    return !text || !visible.includes(text) || !results.some((result) => result.includes(text));
-  })) return "workflow requires matching verification evidence from successful tool results";
+    if (!text || !results.some((result) => result.includes(text))) return `workflow verification quote ${index + 1} does not match a successful tool result`;
+    if (!visible.includes(text)) return `workflow verification quote ${index + 1} is outside the visible excerpt`;
+  }
 }
 function countFacts(turns) {
   return {
@@ -2710,8 +2844,8 @@ var init_meta_reflect = __esm({
 });
 
 // src/cli.ts
-import fs9 from "node:fs";
-import path9 from "node:path";
+import fs10 from "node:fs";
+import path10 from "node:path";
 
 // src/detach.ts
 import { spawn } from "node:child_process";
@@ -2932,6 +3066,7 @@ async function hookCommand(rawEvent, opts = {}) {
 init_llm();
 init_store();
 init_util();
+init_project_hooks();
 function parseArgs(argv) {
   const out = { _: [], flags: {} };
   const valueless = /* @__PURE__ */ new Set(["json", "quiet", "force", "global", "help", "version", "dry-run", "offline", "apply", "no-hooks", "remove-hooks", "key-stdin", "debug", "verbose"]);
@@ -2979,7 +3114,7 @@ function version() {
   for (const rel of ["../package.json", "../../package.json"]) {
     try {
       const file = new URL(rel, import.meta.url);
-      const pkg = JSON.parse(fs9.readFileSync(file, "utf8"));
+      const pkg = JSON.parse(fs10.readFileSync(file, "utf8"));
       if (pkg.name === "@bunshin-cc/bunshin" && pkg.version) return pkg.version;
     } catch {
     }
@@ -3045,7 +3180,7 @@ async function main(argv, opts = {}) {
       if (harness !== "codex" && harness !== "claude-code" && harness !== "pi") throw new Error("Choose your agent: bunshin setup --harness codex, claude-code, or pi.");
       const agent = harness === "claude-code" ? "claude" : harness;
       if (!executable2(agent)) throw new Error(`${agent} was not found. Install and sign in to your agent, then run setup again.`);
-      const existing = new Store(path9.join(cwd, ".bunshin")).config();
+      const existing = new Store(path10.join(cwd, ".bunshin")).config();
       const apiUrl = str2(args.flags["api-url"]);
       const key = bool(args.flags["key-stdin"]) ? await new Promise((resolve, reject) => {
         let value = "";
@@ -3066,6 +3201,7 @@ Key saved privately outside the project.
       if (result.hooks?.error) throw new Error(`Connected, but hooks could not be configured: ${result.hooks.error}. Fix the file and run setup again.`);
       if (result.hooks) out(`${result.hooks.installed} ${harness === "pi" ? "extension" : "hooks"} configured in ${result.hooks.file}
 `);
+      if (result.hooks?.sharedWithWorktrees) out("Codex shares these hooks with the repository\u2019s linked worktrees. Each connected worktree keeps its own Bunshin store.\n");
       if (harness === "codex" && result.hooks) out("Run codex interactively in this project. Review and accept project trust, then run /hooks and review and trust the four Bunshin hooks.\n");
       else if (harness === "pi" && result.hooks) out("Open Pi in this project and approve its project extension. Check it with /bunshin status.\n");
       else if (result.hooks) out("Open a new Claude Code session in this project to load the hooks.\n");
@@ -3128,7 +3264,7 @@ ${HELP}`);
 function openStore(args, cwd) {
   const root = str2(args.flags.root);
   if (root) {
-    const store = new Store(path9.resolve(root));
+    const store = new Store(path10.resolve(root));
     store.ensureLayout();
     return store;
   }
@@ -3167,6 +3303,7 @@ async function cmdInit(args, cwd, out, err) {
   if (result.hooks) {
     out(`  hooks:    ${result.hooks.installed} Bunshin entries in ${result.hooks.file}${result.hooks.changed ? "" : " (already up to date)"}
 `);
+    if (result.hooks.sharedWithWorktrees) out("  Codex repository hooks are shared by its linked worktrees; each connected worktree uses its own Bunshin store.\n");
     if (result.hooks.error) err(`  hooks:    ${result.hooks.error}
 `);
   }
@@ -3184,10 +3321,10 @@ function cmdStatus(store, args, out) {
   const conflicts = store.listConflicts().filter((c) => c.status === "open");
   const metrics = store.readMetrics(void 0);
   const last50 = metrics?.windows?.find((w) => w.name === "last50");
-  const hookFiles = config.harness === "codex" ? [.../* @__PURE__ */ new Set([path9.join(process.env.CODEX_HOME ?? path9.join(homeDir(), ".codex"), "hooks.json"), path9.join(path9.dirname(store.root), ".codex", "hooks.json")])] : config.harness === "claude-code" ? [path9.join(homeDir(), ".claude", "settings.json"), path9.join(path9.dirname(store.root), ".claude", "settings.local.json")] : config.harness === "pi" ? [path9.join(homeDir(), ".pi/agent/extensions/bunshin.js"), path9.join(path9.dirname(store.root), ".pi/extensions/bunshin.js")] : [];
+  const hookFiles = config.harness === "codex" ? [.../* @__PURE__ */ new Set([path10.join(process.env.CODEX_HOME ?? path10.join(homeDir(), ".codex"), "hooks.json"), codexProjectHooks(path10.dirname(store.root)).file])] : config.harness === "claude-code" ? [path10.join(homeDir(), ".claude", "settings.json"), path10.join(path10.dirname(store.root), ".claude", "settings.local.json")] : config.harness === "pi" ? [path10.join(homeDir(), ".pi/agent/extensions/bunshin.js"), path10.join(path10.dirname(store.root), ".pi/extensions/bunshin.js")] : [];
   const hooks = config.harness === "pi" ? hookFiles.filter((file) => {
     try {
-      return fs9.readFileSync(file, "utf8").startsWith("// Managed by Bunshin setup.");
+      return fs10.readFileSync(file, "utf8").startsWith("// Managed by Bunshin setup.");
     } catch {
       return false;
     }
@@ -3204,7 +3341,7 @@ function cmdStatus(store, args, out) {
     mothership: config.apiUrl ? { apiUrl: config.apiUrl, key: config.apiKey ? "set" : "missing", lastSyncAt: config.lastSyncAt ?? null } : null,
     llmBackend: resolveBackend(config) ?? "none (set ANTHROPIC_API_KEY or install the claude/codex CLI)",
     hooks: { [config.harness]: hooks },
-    hookFiles: hookFiles.filter((file) => fs9.existsSync(file)),
+    hookFiles: hookFiles.filter((file) => fs10.existsSync(file)),
     recallQuality: last50 ? { precision: last50.precision, recall: last50.recall, f1: last50.f1, traces: last50.traces } : null
   };
   if (bool(args.flags.json)) {
@@ -3236,7 +3373,7 @@ function cmdStatus(store, args, out) {
 }
 function hookCount(file) {
   try {
-    const raw = JSON.parse(fs9.readFileSync(file, "utf8"));
+    const raw = JSON.parse(fs10.readFileSync(file, "utf8"));
     let n = 0;
     for (const groups of Object.values(raw.hooks ?? {})) {
       for (const g of groups ?? []) {
@@ -3356,7 +3493,7 @@ function cmdLessonAdd(store, args, out, err) {
   let content = str2(args.flags.content) ?? "";
   if (!content || content === "-" || args._.includes("-")) {
     try {
-      content = fs9.readFileSync(0, "utf8");
+      content = fs10.readFileSync(0, "utf8");
     } catch {
     }
   }
@@ -3422,7 +3559,7 @@ async function cmdReflect(store, args, cwd, out, err) {
   }
   const { runReflection: runReflection2 } = await Promise.resolve().then(() => (init_reflect2(), reflect_exports));
   const result = await runReflection2(store, {
-    sessionId: str2(args.flags.session) ?? path9.basename(transcript).replace(/\.jsonl?$/, ""),
+    sessionId: str2(args.flags.session) ?? path10.basename(transcript).replace(/\.jsonl?$/, ""),
     transcriptPath: transcript,
     cwd,
     force: bool(args.flags.force)
@@ -3525,7 +3662,7 @@ async function cmdSessionEnd(store, args, cwd, out) {
   const transcript = str2(args.flags.transcript);
   const quiet = bool(args.flags.quiet);
   const summary = { session: sessionId };
-  if (transcript && fs9.existsSync(transcript)) {
+  if (transcript && fs10.existsSync(transcript)) {
     const { runReflection: runReflection2 } = await Promise.resolve().then(() => (init_reflect2(), reflect_exports));
     summary.reflect = await runReflection2(store, { sessionId, transcriptPath: transcript, cwd, force: true });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bunshin-cc/bunshin",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Shared memory for company AI agents. Connect Codex, Claude Code, or Pi to Bunshin.",
   "type": "module",
   "bin": {