@cairnkeep/cli 2.3.1 → 2.5.0

package/scripts/test-trajectory-cli.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# Public CLI contract for `cairn trajectory list|show|prune`.
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+fail() { echo "FAIL: $1" >&2; exit 1; }
+
+cairn="$ROOT/bin/cairn"
+fixture="$ROOT/mcp-memory-server/scripts/fixtures/trajectory-opencode.json"
+cli="$ROOT/mcp-memory-server/dist/trajectory-cli.js"
+repo="$tmp/project"
+mkdir -p "$repo/.agentfs"
+
+"$cairn" help | grep -q "cairn trajectory" || fail "help missing trajectory"
+
+for shell in bash zsh fish; do
+  "$cairn" completion "$shell" > "$tmp/completion-$shell"
+  grep -q "trajectory" "$tmp/completion-$shell" || fail "$shell completion missing trajectory"
+  grep -q "list.*show.*prune\|list show prune" "$tmp/completion-$shell" \
+    || fail "$shell completion missing trajectory subcommands"
+done
+
+bootstrap_repo="$tmp/bootstrap"
+mkdir -p "$bootstrap_repo"
+"$cairn" bootstrap "$bootstrap_repo" >/dev/null
+[[ -f "$bootstrap_repo/.ai/trajectory-redaction.json" ]] \
+  || fail "bootstrap missing optional trajectory redaction template"
+if grep -R -E -q '^[[:space:]]*CAIRN_TRAJECTORY_CAPTURE[[:space:]]*=[[:space:]]*1' "$bootstrap_repo"; then
+  fail "bootstrap enabled trajectory capture"
+fi
+printf '{"version":1,"patterns":[]}\n' > "$bootstrap_repo/.ai/trajectory-redaction.json"
+"$cairn" bootstrap "$bootstrap_repo" >/dev/null
+grep -q '"patterns":\[\]' "$bootstrap_repo/.ai/trajectory-redaction.json" \
+  || fail "bootstrap overwrote an existing redaction configuration"
+
+printf '%s' "$(cat "$fixture")" | node "$cli" capture-opencode "$repo" >/dev/null
+
+(cd "$repo" && "$cairn" trajectory list --json) > "$tmp/list.json"
+node -e 'const j=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));if(j.sessions?.[0]?.session_id!=="opencode-session-001")process.exit(1)' "$tmp/list.json" \
+  || fail "trajectory list JSON missing captured session"
+
+(cd "$repo" && "$cairn" trajectory show opencode-session-001 --json) > "$tmp/show.json"
+node -e 'const j=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));if(j.schema_version!==1||!Array.isArray(j.events))process.exit(1)' "$tmp/show.json" \
+  || fail "trajectory show JSON is not a v1 session"
+
+if ! (set -o pipefail; cd "$repo" && "$cairn" trajectory show opencode-session-001 --json | head -c 0 >/dev/null); then
+  fail "trajectory CLI did not treat a closed output pipe as a normal consumer exit"
+fi
+
+(cd "$repo" && "$cairn" trajectory prune --dry-run --json) > "$tmp/prune.json"
+node -e 'const j=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));if(!Array.isArray(j.removed)||j.dry_run!==true)process.exit(1)' "$tmp/prune.json" \
+  || fail "trajectory prune dry-run JSON invalid"
+
+if (cd "$repo" && "$cairn" trajectory show does-not-exist --json) >"$tmp/missing.out" 2>"$tmp/missing.err"; then
+  fail "show of missing session should fail"
+fi
+grep -q "not found" "$tmp/missing.err" || fail "missing-session error is not actionable"
+
+# Doctor detects missing trajectory metadata and repairs indexes explicitly,
+# preserving the valid full session record.
+(cd "$ROOT/mcp-memory-server" && node --input-type=module -e '
+import { AgentFS } from "agentfs-sdk"
+const agent = await AgentFS.open({ id: "trajectory", path: process.argv[1] })
+for (const row of await agent.kv.list("trajectory/index/")) await agent.kv.delete(row.key)
+await agent.kv.delete("trajectory/meta/schema-version")
+await agent.close()
+' "$repo/.agentfs/trajectory.db")
+
+mkdir -p "$tmp/home"
+if (cd "$repo" && env -u CAIRN_LLM_API_URL -u CAIRN_MEMORY_EMBEDDING_URL \
+  -u CAIRN_GIT_PROVIDER HOME="$tmp/home" "$cairn" doctor) >"$tmp/doctor-bad.out" 2>&1; then
+  fail "doctor accepted missing trajectory metadata"
+fi
+grep -q 'cairn doctor --repair' "$tmp/doctor-bad.out" \
+  || fail "doctor did not offer an actionable trajectory repair"
+
+(cd "$repo" && env -u CAIRN_LLM_API_URL -u CAIRN_MEMORY_EMBEDDING_URL \
+  -u CAIRN_GIT_PROVIDER HOME="$tmp/home" "$cairn" doctor --repair) >"$tmp/doctor-repair.out" 2>&1 \
+  || fail "doctor failed to repair trajectory metadata/indexes"
+grep -q '\[PASS\] trajectory store repaired' "$tmp/doctor-repair.out" \
+  || fail "doctor did not report trajectory repair"
+(cd "$repo" && "$cairn" trajectory show opencode-session-001 --json) >/dev/null \
+  || fail "trajectory record was lost during doctor repair"
+
+echo "PASS: cairn trajectory CLI dispatch and JSON contract"

package/scripts/test-trajectory-hooks.sh

@@ -0,0 +1,142 @@
+#!/usr/bin/env bash
+# Cross-harness trajectory capture and disabled-path regression test.
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+fail() { echo "FAIL: $1" >&2; exit 1; }
+
+claude_fixture="$ROOT/mcp-memory-server/scripts/fixtures/trajectory-claude.jsonl"
+opencode_fixture="$ROOT/mcp-memory-server/scripts/fixtures/trajectory-opencode.json"
+pi_fixture="$ROOT/mcp-memory-server/scripts/fixtures/trajectory-pi.json"
+
+render() {
+  sed "s|@@INFRA_ROOT@@|$ROOT|g" "$1" > "$2"
+}
+
+# Claude: flag off must not read stdin, create a store, or perturb the existing
+# no-model/no-project-db path.
+claude_repo="$tmp/claude-off"
+mkdir -p "$claude_repo/.agentfs"
+render "$ROOT/claude/hooks/memory-capture.sh" "$tmp/memory-capture.sh"
+chmod +x "$tmp/memory-capture.sh"
+before=$(find "$claude_repo" -type f -print | sort)
+(cd "$claude_repo" && printf '%s\n' '{"transcript_path":"/does/not/exist"}' | "$tmp/memory-capture.sh") >"$tmp/claude-off.out" 2>"$tmp/claude-off.err"
+after=$(find "$claude_repo" -type f -print | sort)
+[[ "$before" == "$after" ]] || fail "Claude flag-off path changed files"
+[[ ! -s "$tmp/claude-off.out" && ! -s "$tmp/claude-off.err" ]] || fail "Claude flag-off path emitted output"
+
+# In a bootstrapped project, the original no-model path also exits before
+# parsing stdin. A python spy makes that no-process guarantee observable.
+claude_bootstrapped_off="$tmp/claude-bootstrapped-off"
+mkdir -p "$claude_bootstrapped_off/.agentfs" "$tmp/spy-bin"
+touch "$claude_bootstrapped_off/.agentfs/project.db"
+cat > "$tmp/spy-bin/python3" <<EOF
+#!/usr/bin/env bash
+touch "$tmp/python-was-called"
+exit 1
+EOF
+chmod +x "$tmp/spy-bin/python3"
+(cd "$claude_bootstrapped_off" && printf '%s\n' '{"transcript_path":"/does/not/exist"}' \
+  | PATH="$tmp/spy-bin:$PATH" "$tmp/memory-capture.sh") >/dev/null 2>&1
+[[ ! -e "$tmp/python-was-called" ]] || fail "Claude flag-off no-model path parsed stdin"
+
+# Claude: enabled capture works without project.db, API key, extraction model,
+# or network service.
+claude_repo="$tmp/claude-on"
+mkdir -p "$claude_repo/.agentfs"
+hook_input=$(node -e 'console.log(JSON.stringify({transcript_path:process.argv[1],hook_event_name:"SessionEnd"}))' "$claude_fixture")
+(cd "$claude_repo" && CAIRN_TRAJECTORY_CAPTURE=1 printf '%s\n' "$hook_input" | CAIRN_TRAJECTORY_CAPTURE=1 "$tmp/memory-capture.sh") >"$tmp/claude-on.out" 2>"$tmp/claude-on.err"
+[[ -f "$claude_repo/.agentfs/trajectory.db" ]] || fail "Claude enabled hook did not create trajectory store"
+(cd "$claude_repo" && node "$ROOT/mcp-memory-server/dist/trajectory-cli.js" show claude-session-001 --json) >/dev/null \
+  || fail "Claude hook trajectory not readable"
+
+# OpenCode: render the installed plugin shape and drive a real session.idle
+# callback with the SDK fixture. Type-only imports are stripped by Node 22+.
+render "$ROOT/opencode/plugins/memory-capture.ts" "$tmp/memory-capture.ts"
+opencode_off="$tmp/opencode-off"
+mkdir -p "$opencode_off/.agentfs"
+node --experimental-strip-types "$ROOT/scripts/lib/trajectory-opencode-plugin-harness.mjs" \
+  "$tmp/memory-capture.ts" "$opencode_off" "$opencode_fixture" >/dev/null 2>"$tmp/opencode-off.err"
+[[ ! -f "$opencode_off/.agentfs/trajectory.db" ]] || fail "OpenCode flag-off path created trajectory store"
+
+opencode_on="$tmp/opencode-on"
+mkdir -p "$opencode_on/.agentfs"
+CAIRN_TRAJECTORY_CAPTURE=1 node --experimental-strip-types \
+  "$ROOT/scripts/lib/trajectory-opencode-plugin-harness.mjs" \
+  "$tmp/memory-capture.ts" "$opencode_on" "$opencode_fixture" >/dev/null 2>"$tmp/opencode-on.err"
+[[ -f "$opencode_on/.agentfs/trajectory.db" ]] || fail "OpenCode enabled plugin did not create trajectory store"
+(cd "$opencode_on" && node "$ROOT/mcp-memory-server/dist/trajectory-cli.js" show opencode-session-001 --json) >/dev/null \
+  || fail "OpenCode plugin trajectory not readable"
+
+# Exercise the real backup-first sync paths twice and compare their rendered
+# installed assets, rather than relying only on the source-level render above.
+claude_live="$tmp/claude-live"
+"$ROOT/scripts/sync-claude-assets.sh" --apply --live-root "$claude_live" >/dev/null
+"$ROOT/scripts/sync-claude-assets.sh" --apply --live-root "$claude_live" >/dev/null
+render "$ROOT/claude/hooks/memory-capture.sh" "$tmp/expected-claude-capture.sh"
+cmp -s "$tmp/expected-claude-capture.sh" "$claude_live/hooks/memory-capture.sh" \
+  || fail "installed Claude trajectory hook differs from rendered source"
+claude_capture_registrations=$(node -e '
+const fs = require("fs")
+const settings = JSON.parse(fs.readFileSync(process.argv[1], "utf8"))
+let count = 0
+for (const entry of settings.hooks?.SessionEnd ?? []) {
+  for (const hook of entry.hooks ?? []) {
+    if (String(hook.command ?? "").includes("memory-capture.sh")) count += 1
+  }
+}
+process.stdout.write(String(count))
+' "$claude_live/settings.json")
+[[ "$claude_capture_registrations" -eq 1 ]] \
+  || fail "Claude SessionEnd memory-capture registration is missing or duplicated"
+
+opencode_live="$tmp/opencode-live"
+"$ROOT/scripts/sync-opencode-plugin-assets.sh" --apply --live-root "$opencode_live" >/dev/null
+"$ROOT/scripts/sync-opencode-plugin-assets.sh" --apply --live-root "$opencode_live" >/dev/null
+render "$ROOT/opencode/plugins/memory-capture.ts" "$tmp/expected-opencode-capture.ts"
+cmp -s "$tmp/expected-opencode-capture.ts" "$opencode_live/plugins/memory-capture.ts" \
+  || fail "installed OpenCode trajectory plugin differs from rendered source"
+[[ $(find "$opencode_live" -type f -name 'memory-capture.ts' | wc -l) -eq 1 ]] \
+  || fail "OpenCode memory-capture plugin is duplicated"
+
+# Pi: the native extension must not touch SessionManager when disabled and
+# must send the active branch to the same local capture CLI when enabled.
+render "$ROOT/pi/extensions/cairnkeep-trajectory.ts" "$tmp/cairnkeep-trajectory.ts"
+pi_off="$tmp/pi-off"
+mkdir -p "$pi_off/.agentfs"
+node --experimental-strip-types "$ROOT/scripts/lib/trajectory-pi-extension-harness.mjs" \
+  "$tmp/cairnkeep-trajectory.ts" "$pi_off" "$pi_fixture" >"$tmp/pi-off.out" 2>"$tmp/pi-off.err"
+[[ ! -f "$pi_off/.agentfs/trajectory.db" ]] || fail "Pi flag-off path created trajectory store"
+[[ ! -s "$tmp/pi-off.out" && ! -s "$tmp/pi-off.err" ]] || fail "Pi flag-off path emitted output"
+
+pi_on="$tmp/pi-on"
+mkdir -p "$pi_on/.agentfs"
+CAIRN_TRAJECTORY_CAPTURE=1 node --experimental-strip-types \
+  "$ROOT/scripts/lib/trajectory-pi-extension-harness.mjs" \
+  "$tmp/cairnkeep-trajectory.ts" "$pi_on" "$pi_fixture" >"$tmp/pi-on.out" 2>"$tmp/pi-on.err"
+[[ -f "$pi_on/.agentfs/trajectory.db" ]] || fail "Pi enabled extension did not create trajectory store"
+pi_json=$(cd "$pi_on" && node "$ROOT/mcp-memory-server/dist/trajectory-cli.js" show pi-session-001 --json)
+[[ "$pi_json" != *"sk-live-pi-141414"* ]] || fail "Pi sentinel survived redaction"
+[[ "$pi_json" != *"private pi reasoning"* ]] || fail "Pi reasoning survived omission"
+
+pi_live="$tmp/pi-live"
+"$ROOT/scripts/sync-pi-assets.sh" --apply --live-root "$pi_live" >/dev/null
+"$ROOT/scripts/sync-pi-assets.sh" --apply --live-root "$pi_live" >/dev/null
+render "$ROOT/pi/extensions/cairnkeep-trajectory.ts" "$tmp/expected-pi-capture.ts"
+cmp -s "$tmp/expected-pi-capture.ts" "$pi_live/extensions/cairnkeep-trajectory.ts" \
+  || fail "installed Pi trajectory extension differs from rendered source"
+[[ $(find "$pi_live" -type f -name 'cairnkeep-trajectory.ts' | wc -l) -eq 1 ]] \
+  || fail "Pi trajectory extension is duplicated"
+
+# Integration must reuse the existing capture registration rather than add a
+# second SessionEnd hook or plugin asset.
+[[ $(grep -c 'memory-capture.sh)' "$ROOT/scripts/sync-claude-assets.sh") -eq 1 ]] \
+  || fail "Claude memory-capture hook registration is missing or duplicated"
+[[ $(grep -c 'plugins/memory-capture.ts' "$ROOT/scripts/sync-opencode-plugin-assets.sh") -eq 1 ]] \
+  || fail "OpenCode memory-capture plugin asset is missing or duplicated"
+[[ $(grep -c 'extensions/cairnkeep-trajectory.ts' "$ROOT/scripts/sync-pi-assets.sh") -eq 1 ]] \
+  || fail "Pi trajectory extension asset is missing or duplicated"
+
+echo "PASS: Claude/OpenCode/Pi trajectory hooks and flag-off regression"

package/scripts/test-uninstall.sh

@@ -16,6 +16,63 @@ fails=0
 ok()   { printf '  [PASS] %s\n' "$1"; }
 bad()  { printf '  [FAIL] %s\n' "$1"; fails=$((fails + 1)); }
 check() { if [[ "$2" == "$3" ]]; then ok "$1 ($2)"; else bad "$1 (got '$2', want '$3')"; fi; }
+tree_hash() { find "$1" -type f -print0 | sort -z | xargs -0 sha256sum | sha256sum | cut -d' ' -f1; }
+tree_identity() {
+  node - "$1" <<'NODE'
+const { createHash } = require("crypto")
+const { lstatSync, readdirSync, readFileSync } = require("fs")
+const { join, relative } = require("path")
+
+const root = process.argv[2]
+const entries = []
+const visit = (path) => {
+  const stat = lstatSync(path)
+  const label = relative(root, path) || "."
+  const mode = (stat.mode & 0o777).toString(8).padStart(3, "0")
+  if (stat.isDirectory()) {
+    entries.push(`d\t${mode}\t${label}`)
+    for (const name of readdirSync(path).sort()) visit(join(path, name))
+    return
+  }
+  const digest = createHash("sha256").update(readFileSync(path)).digest("hex")
+  entries.push(`f\t${mode}\t${label}\t${digest}`)
+}
+visit(root)
+process.stdout.write(createHash("sha256").update(`${entries.join("\n")}\n`).digest("hex"))
+NODE
+}
+managed_hook_count() {
+  node -e '
+const fs = require("fs")
+const settings = JSON.parse(fs.readFileSync(process.argv[1], "utf8"))
+const names = process.argv.slice(2)
+let count = 0
+for (const entries of Object.values(settings.hooks ?? {})) {
+  for (const entry of Array.isArray(entries) ? entries : []) {
+    for (const hook of Array.isArray(entry.hooks) ? entry.hooks : []) {
+      if (typeof hook.command === "string" && names.some((name) => hook.command.includes(name))) count += 1
+    }
+  }
+}
+process.stdout.write(String(count))
+' "$1" memory-wakeup.sh memory-capture.sh compaction-capture.sh memory-recall.sh context-explore-pretask.sh
+}
+
+capability_hook_count() {
+  node -e '
+const fs = require("fs")
+const settings = JSON.parse(fs.readFileSync(process.argv[1], "utf8"))
+let count = 0
+for (const entries of Object.values(settings.hooks ?? {})) {
+  for (const entry of Array.isArray(entries) ? entries : []) {
+    for (const hook of Array.isArray(entry.hooks) ? entry.hooks : []) {
+      if (typeof hook.command === "string" && /capability-command-(start|finish)\.sh/.test(hook.command)) count += 1
+    }
+  }
+}
+process.stdout.write(String(count))
+' "$1"
+}
 
 # Isolated environment: fake HOME + stubbed system commands.
 mkdir -p "$SB/home" "$SB/bin"
@@ -24,38 +81,205 @@ printf '#!/usr/bin/env bash\ntrue\n' >"$SB/bin/systemctl"
 chmod +x "$SB/bin/"*
 export HOME="$SB/home" XDG_CONFIG_HOME="$SB/home/.config" PATH="$SB/bin:$PATH"
 LIVE="$SB/live"
+PI_LIVE="$SB/pi-live"
 
 echo "test-uninstall"
 
 # --- install the operating layer -------------------------------------------
 "$ROOT_DIR/scripts/sync-claude-assets.sh" --apply --live-root "$LIVE" >/dev/null 2>&1
+"$ROOT_DIR/scripts/sync-pi-assets.sh" --apply --live-root "$PI_LIVE" >/dev/null 2>&1
 md_installed=$(find "$LIVE" -type f -name '*.md' | wc -l | tr -d ' ')
 check "assets installed" "$([[ $md_installed -gt 0 ]] && echo yes || echo no)" "yes"
-check "hooks registered" "$(grep -c 'hooks/' "$LIVE/settings.json")" "4"
+check "managed hooks registered" "$(managed_hook_count "$LIVE/settings.json")" "5"
+node - "$LIVE/settings.json" <<'NODE'
+const fs = require("fs")
+const path = process.argv[2]
+const settings = JSON.parse(fs.readFileSync(path, "utf8"))
+settings.hooks ??= {}
+settings.hooks.PostToolUse ??= []
+settings.hooks.PostToolUse.push({
+  matcher: "Read",
+  hooks: [{ type: "command", command: "bash /external/hooks/keep-me.sh" }],
+})
+fs.writeFileSync(path, JSON.stringify(settings, null, 2) + "\n")
+NODE
 cp "$LIVE/settings.json" "$SB/settings.before.json"
+cp "$PI_LIVE/extensions/cairnkeep-trajectory.ts" "$SB/pi.before.ts"
+mkdir -p "$SB/home/.cairnkeep/notes/projects/example/hindsight"
+printf 'durable note bytes\n' >"$SB/home/.cairnkeep/notes/projects/example/hindsight/failure.md"
+mkdir -p "$SB/home/.cairnkeep/notes/.cairnkeep/history/project-notes/knowledge/example" \
+  "$SB/home/.cairnkeep/notes/.cairnkeep/transactions/prepared/backups"
+printf 'typed sqlite bytes\n' >"$SB/home/.cairnkeep/identity.db"
+printf 'typed history bytes\n' >"$SB/home/.cairnkeep/notes/.cairnkeep/history/project-notes/knowledge/example/1.json"
+printf 'prepared journal bytes\n' >"$SB/home/.cairnkeep/notes/.cairnkeep/transactions/prepared/journal-v1.json"
+printf 'backup bytes\n' >"$SB/home/.cairnkeep/notes/.cairnkeep/transactions/prepared/backups/0.bin"
+note_before=$(sha256sum "$SB/home/.cairnkeep/notes/projects/example/hindsight/failure.md" | cut -d' ' -f1)
+store_before=$(tree_hash "$SB/home/.cairnkeep")
+PROJECT_DATA="$SB/project-data"
+ADJACENT_PROJECT="$SB/adjacent-project"
+mkdir -p "$PROJECT_DATA/.ai" \
+  "$PROJECT_DATA/.agentfs/eval/experiments/complete/snapshots/task-one" \
+  "$PROJECT_DATA/.agentfs/eval/experiments/partial" \
+  "$ADJACENT_PROJECT/.agentfs/eval/experiments/adjacent"
+printf '%s\n' '{"schema_version":1,"capabilities":{"wiki":false},"logging":{"callbacks":true}}' >"$PROJECT_DATA/.ai/capabilities.json"
+chmod 600 "$PROJECT_DATA/.ai/capabilities.json"
+printf 'operator-owned ai bytes\000must-survive\377\n' >"$PROJECT_DATA/.ai/operator-state.bin"
+printf 'artifact-v1\000durable\377bytes\n' >"$PROJECT_DATA/.agentfs/artifacts.db"
+printf 'session-and-callback-v1\000durable\377bytes\n' >"$PROJECT_DATA/.agentfs/trajectory.db"
+printf 'callback-wal-v1\000durable\377bytes\n' >"$PROJECT_DATA/.agentfs/trajectory.db-wal"
+printf 'unrelated-memory-v1\000durable\377bytes\n' >"$PROJECT_DATA/.agentfs/project.db"
+printf 'complete-report-v1\000private\377bytes\n' >"$PROJECT_DATA/.agentfs/eval/experiments/complete/report.json"
+printf 'partial-report-v1\000private\377bytes\n' >"$PROJECT_DATA/.agentfs/eval/experiments/partial/report.json"
+printf 'note-snapshot-v1\000private\377bytes\n' >"$PROJECT_DATA/.agentfs/eval/experiments/complete/snapshots/task-one/note.md"
+printf 'adjacent-eval-v1\000must-survive\377bytes\n' >"$ADJACENT_PROJECT/.agentfs/eval/experiments/adjacent/report.json"
+chmod 700 "$PROJECT_DATA/.agentfs" "$PROJECT_DATA/.agentfs/eval" \
+  "$PROJECT_DATA/.agentfs/eval/experiments" \
+  "$PROJECT_DATA/.agentfs/eval/experiments/complete" \
+  "$PROJECT_DATA/.agentfs/eval/experiments/complete/snapshots" \
+  "$PROJECT_DATA/.agentfs/eval/experiments/complete/snapshots/task-one" \
+  "$PROJECT_DATA/.agentfs/eval/experiments/partial"
+chmod 600 "$PROJECT_DATA/.agentfs/project.db" \
+  "$PROJECT_DATA/.agentfs/eval/experiments/complete/report.json" \
+  "$PROJECT_DATA/.agentfs/eval/experiments/partial/report.json"
+chmod 400 "$PROJECT_DATA/.agentfs/eval/experiments/complete/snapshots/task-one/note.md"
+chmod 700 "$ADJACENT_PROJECT/.agentfs" "$ADJACENT_PROJECT/.agentfs/eval" \
+  "$ADJACENT_PROJECT/.agentfs/eval/experiments" \
+  "$ADJACENT_PROJECT/.agentfs/eval/experiments/adjacent"
+chmod 600 "$ADJACENT_PROJECT/.agentfs/eval/experiments/adjacent/report.json"
+cp "$PROJECT_DATA/.ai/capabilities.json" "$SB/capabilities.before.json"
+cp "$PROJECT_DATA/.ai/operator-state.bin" "$SB/operator-state.before.bin"
+cp "$PROJECT_DATA/.agentfs/artifacts.db" "$SB/artifacts.before.db"
+cp "$PROJECT_DATA/.agentfs/trajectory.db" "$SB/trajectory.before.db"
+cp "$PROJECT_DATA/.agentfs/trajectory.db-wal" "$SB/trajectory.before.db-wal"
+agentfs_before=$(tree_identity "$PROJECT_DATA/.agentfs")
+eval_before=$(tree_identity "$PROJECT_DATA/.agentfs/eval")
+adjacent_before=$(tree_identity "$ADJACENT_PROJECT/.agentfs")
+
+# Normal and master-off sync are the same inert installation. Replaying an
+# explicit overlay request with the master off must not change any legacy byte,
+# registration, process state, block state, or measurement state.
+CLAUDE_INERT="$SB/claude-inert"
+OPENCODE_INERT="$SB/opencode-inert"
+env -u CAIRN_CAPABILITY_CONTRACT \
+  "$ROOT_DIR/scripts/sync-claude-assets.sh" --apply --live-root "$CLAUDE_INERT" >/dev/null
+env -u CAIRN_CAPABILITY_CONTRACT \
+  "$ROOT_DIR/scripts/sync-opencode-wiki-assets.sh" --apply --live-root "$OPENCODE_INERT" >/dev/null
+env -u CAIRN_CAPABILITY_CONTRACT \
+  "$ROOT_DIR/scripts/sync-opencode-graphify-assets.sh" --apply --live-root "$OPENCODE_INERT" >/dev/null
+env -u CAIRN_CAPABILITY_CONTRACT \
+  "$ROOT_DIR/scripts/sync-opencode-security-assets.sh" --apply --live-root "$OPENCODE_INERT" >/dev/null
+cp -a "$CLAUDE_INERT" "$SB/claude-inert.before"
+cp -a "$OPENCODE_INERT" "$SB/opencode-inert.before"
+CAIRN_CAPABILITY_CONTRACT=0 \
+  "$ROOT_DIR/scripts/sync-claude-assets.sh" --apply --capability-overlay --live-root "$CLAUDE_INERT" >/dev/null
+CAIRN_CAPABILITY_CONTRACT=0 \
+  "$ROOT_DIR/scripts/sync-opencode-wiki-assets.sh" --apply --capability-overlay --live-root "$OPENCODE_INERT" >/dev/null
+CAIRN_CAPABILITY_CONTRACT=0 \
+  "$ROOT_DIR/scripts/sync-opencode-graphify-assets.sh" --apply --capability-overlay --live-root "$OPENCODE_INERT" >/dev/null
+CAIRN_CAPABILITY_CONTRACT=0 \
+  "$ROOT_DIR/scripts/sync-opencode-security-assets.sh" --apply --capability-overlay --live-root "$OPENCODE_INERT" >/dev/null
+check "master-off Claude sync is exact normal identity" "$(diff -qr "$SB/claude-inert.before" "$CLAUDE_INERT" >/dev/null && echo yes || echo no)" "yes"
+check "master-off OpenCode sync is exact normal identity" "$(diff -qr "$SB/opencode-inert.before" "$OPENCODE_INERT" >/dev/null && echo yes || echo no)" "yes"
+check "inert Claude sync has no native hooks" "$([[ -e "$CLAUDE_INERT/hooks/capability-command-start.sh" || -e "$CLAUDE_INERT/hooks/capability-command-finish.sh" ]] && echo no || echo yes)" "yes"
+check "inert OpenCode sync has no native plugin" "$([[ -e "$OPENCODE_INERT/plugins/capability-command.ts" ]] && echo no || echo yes)" "yes"
+check "inert sync creates no measurement state" "$([[ -e "$SB/inert-state" ]] && echo no || echo yes)" "yes"
+
+# Enabled sync owns one isolated project overlay containing legacy operating
+# assets plus the native hook/plugin registrations. The whole overlay is a
+# reversible managed unit; normal roots above are never cleanup targets.
+CLAUDE_OVERLAY="$PROJECT_DATA/.ai/capability-contract/claude"
+OPENCODE_OVERLAY="$PROJECT_DATA/.ai/capability-contract/opencode"
+CAIRN_CAPABILITY_CONTRACT=1 \
+  "$ROOT_DIR/scripts/sync-claude-assets.sh" --apply --capability-overlay --live-root "$CLAUDE_OVERLAY" >/dev/null
+CAIRN_CAPABILITY_CONTRACT=1 \
+  "$ROOT_DIR/scripts/sync-opencode-wiki-assets.sh" --apply --capability-overlay --live-root "$OPENCODE_OVERLAY" >/dev/null
+CAIRN_CAPABILITY_CONTRACT=1 \
+  "$ROOT_DIR/scripts/sync-opencode-graphify-assets.sh" --apply --capability-overlay --live-root "$OPENCODE_OVERLAY" >/dev/null
+CAIRN_CAPABILITY_CONTRACT=1 \
+  "$ROOT_DIR/scripts/sync-opencode-security-assets.sh" --apply --capability-overlay --live-root "$OPENCODE_OVERLAY" >/dev/null
+check "enabled overlay registers five Claude hook events" "$(capability_hook_count "$CLAUDE_OVERLAY/settings.json")" "5"
+check "enabled overlay registers one OpenCode plugin" "$([[ -f "$OPENCODE_OVERLAY/plugins/capability-command.ts" ]] && echo yes || echo no)" "yes"
+check "enabled overlay contains no retired prompt owner" "$([[ -d "$CLAUDE_OVERLAY/capability-contract/commands" || -d "$OPENCODE_OVERLAY/capability-contract/command" || -d "$OPENCODE_OVERLAY/capability-contract/workflows" ]] && echo no || echo yes)" "yes"
+overlay_before=$(tree_hash "$PROJECT_DATA/.ai/capability-contract")
+project_before=$(tree_hash "$PROJECT_DATA")
 
 # --- dry-run must change nothing -------------------------------------------
-"$ROOT_DIR/scripts/uninstall.sh" --dry-run --live-root "$LIVE" >/dev/null 2>&1
+"$ROOT_DIR/scripts/uninstall.sh" --dry-run --live-root "$LIVE" --pi-live-root "$PI_LIVE" "$PROJECT_DATA" >/dev/null 2>&1
 check "dry-run leaves assets" "$(find "$LIVE" -type f -name '*.md' | wc -l | tr -d ' ')" "$md_installed"
 check "dry-run makes no bundle" "$(ls -d "$SB/home/.cairnkeep-uninstall-"* 2>/dev/null | wc -l | tr -d ' ')" "0"
+check "dry-run leaves Pi extension" "$([[ -f "$PI_LIVE/extensions/cairnkeep-trajectory.ts" ]] && echo yes || echo no)" "yes"
+check "dry-run leaves settings identical" "$(cmp -s "$SB/settings.before.json" "$LIVE/settings.json" && echo yes || echo no)" "yes"
+check "dry-run leaves artifact bytes exact" "$(cmp -s "$SB/artifacts.before.db" "$PROJECT_DATA/.agentfs/artifacts.db" && echo yes || echo no)" "yes"
+check "dry-run leaves eval tree, bytes, and modes exact" "$(tree_identity "$PROJECT_DATA/.agentfs/eval")" "$eval_before"
+check "dry-run leaves unrelated project memory exact" "$(tree_identity "$PROJECT_DATA/.agentfs")" "$agentfs_before"
+check "dry-run leaves adjacent project exact" "$(tree_identity "$ADJACENT_PROJECT/.agentfs")" "$adjacent_before"
+check "dry-run leaves project state byte-identical" "$(tree_hash "$PROJECT_DATA")" "$project_before"
 
 # --- real uninstall ---------------------------------------------------------
-"$ROOT_DIR/scripts/uninstall.sh" --yes --live-root "$LIVE" >/dev/null 2>&1
+"$ROOT_DIR/scripts/uninstall.sh" --yes --live-root "$LIVE" --pi-live-root "$PI_LIVE" "$PROJECT_DATA" >/dev/null 2>&1
 check "assets removed" "$(find "$LIVE" -type f -name '*.md' | wc -l | tr -d ' ')" "0"
-check "hooks de-registered" "$(grep -c 'hooks/' "$LIVE/settings.json" 2>/dev/null || true)" "0"
+check "managed hooks de-registered" "$(managed_hook_count "$LIVE/settings.json")" "0"
+check "unrelated hook preserved" "$(grep -cF 'keep-me.sh' "$LIVE/settings.json" 2>/dev/null || true)" "1"
+check "Pi extension removed" "$([[ -e "$PI_LIVE/extensions/cairnkeep-trajectory.ts" ]] && echo no || echo yes)" "yes"
+check "default uninstall keeps notes" "$(sha256sum "$SB/home/.cairnkeep/notes/projects/example/hindsight/failure.md" | cut -d' ' -f1)" "$note_before"
+check "default uninstall keeps all typed and journal bytes" "$(tree_hash "$SB/home/.cairnkeep")" "$store_before"
+check "default uninstall keeps artifact bytes exact" "$(cmp -s "$SB/artifacts.before.db" "$PROJECT_DATA/.agentfs/artifacts.db" && echo yes || echo no)" "yes"
+check "default uninstall removes managed capability config" "$([[ -e "$PROJECT_DATA/.ai/capabilities.json" ]] && echo no || echo yes)" "yes"
+check "default uninstall removes managed capability overlay" "$([[ -e "$PROJECT_DATA/.ai/capability-contract" ]] && echo no || echo yes)" "yes"
+check "default uninstall leaves normal Claude installation exact" "$(diff -qr "$SB/claude-inert.before" "$CLAUDE_INERT" >/dev/null && echo yes || echo no)" "yes"
+check "default uninstall leaves normal OpenCode installation exact" "$(diff -qr "$SB/opencode-inert.before" "$OPENCODE_INERT" >/dev/null && echo yes || echo no)" "yes"
+check "default uninstall keeps unrelated .ai bytes exact" "$(cmp -s "$SB/operator-state.before.bin" "$PROJECT_DATA/.ai/operator-state.bin" && echo yes || echo no)" "yes"
+check "default uninstall keeps callback DB exact" "$(cmp -s "$SB/trajectory.before.db" "$PROJECT_DATA/.agentfs/trajectory.db" && echo yes || echo no)" "yes"
+check "default uninstall keeps callback WAL exact" "$(cmp -s "$SB/trajectory.before.db-wal" "$PROJECT_DATA/.agentfs/trajectory.db-wal" && echo yes || echo no)" "yes"
+check "default uninstall keeps complete and partial eval reports, snapshots, modes, and layout exact" "$(tree_identity "$PROJECT_DATA/.agentfs/eval")" "$eval_before"
+check "default uninstall keeps unrelated project memory exact" "$(tree_identity "$PROJECT_DATA/.agentfs")" "$agentfs_before"
+check "default uninstall leaves adjacent project exact" "$(tree_identity "$ADJACENT_PROJECT/.agentfs")" "$adjacent_before"
 BK=$(ls -d "$SB/home/.cairnkeep-uninstall-"* 2>/dev/null | head -1)
 check "revert.sh generated" "$([[ -n "$BK" && -f "$BK/revert.sh" ]] && echo yes || echo no)" "yes"
+check "capability config backup is exact" "$(cmp -s "$SB/capabilities.before.json" "$BK/files/${PROJECT_DATA#/}/.ai/capabilities.json" && echo yes || echo no)" "yes"
 
 # --- revert restores everything --------------------------------------------
 bash "$BK/revert.sh" >/dev/null 2>&1
 check "assets restored" "$(find "$LIVE" -type f -name '*.md' | wc -l | tr -d ' ')" "$md_installed"
 check "settings.json identical" "$(cmp -s "$SB/settings.before.json" "$LIVE/settings.json" && echo yes || echo no)" "yes"
+check "Pi extension restored" "$(cmp -s "$SB/pi.before.ts" "$PI_LIVE/extensions/cairnkeep-trajectory.ts" && echo yes || echo no)" "yes"
+check "capability config bytes restored" "$(cmp -s "$SB/capabilities.before.json" "$PROJECT_DATA/.ai/capabilities.json" && echo yes || echo no)" "yes"
+check "capability overlay bytes restored" "$(tree_hash "$PROJECT_DATA/.ai/capability-contract")" "$overlay_before"
+check "capability hook registrations restored" "$(capability_hook_count "$CLAUDE_OVERLAY/settings.json")" "5"
+check "capability plugin restored" "$([[ -f "$OPENCODE_OVERLAY/plugins/capability-command.ts" ]] && echo yes || echo no)" "yes"
+check "capability config mode restored" "$(stat -c '%a' "$PROJECT_DATA/.ai/capabilities.json" 2>/dev/null || stat -f '%Lp' "$PROJECT_DATA/.ai/capabilities.json")" "600"
+check "unrelated .ai bytes remain exact after revert" "$(cmp -s "$SB/operator-state.before.bin" "$PROJECT_DATA/.ai/operator-state.bin" && echo yes || echo no)" "yes"
+check "default-uninstall revert leaves retained eval exact" "$(tree_identity "$PROJECT_DATA/.agentfs/eval")" "$eval_before"
+
+# --- project artifact purge is backup-first and exactly reversible ---------
+ARTIFACT_HOME="$SB/artifact-home"
+mkdir -p "$ARTIFACT_HOME"
+HOME="$ARTIFACT_HOME" XDG_CONFIG_HOME="$ARTIFACT_HOME/.config" \
+  "$ROOT_DIR/scripts/uninstall.sh" --yes --purge-memory --live-root "$SB/unused-live" --pi-live-root "$SB/unused-pi" "$PROJECT_DATA" >/dev/null 2>&1
+check "artifact purge removes project store" "$([[ -e "$PROJECT_DATA/.agentfs" ]] && echo no || echo yes)" "yes"
+ARTIFACT_BK=$(ls -dt "$ARTIFACT_HOME/.cairnkeep-uninstall-"* 2>/dev/null | head -1)
+check "artifact purge backup is exact" "$(cmp -s "$SB/artifacts.before.db" "$ARTIFACT_BK/files/${PROJECT_DATA#/}/.agentfs/artifacts.db" && echo yes || echo no)" "yes"
+check "callback purge backup is exact" "$(cmp -s "$SB/trajectory.before.db" "$ARTIFACT_BK/files/${PROJECT_DATA#/}/.agentfs/trajectory.db" && echo yes || echo no)" "yes"
+check "callback WAL purge backup is exact" "$(cmp -s "$SB/trajectory.before.db-wal" "$ARTIFACT_BK/files/${PROJECT_DATA#/}/.agentfs/trajectory.db-wal" && echo yes || echo no)" "yes"
+check "purge backup contains exact eval tree, bytes, and modes" "$(tree_identity "$ARTIFACT_BK/files/${PROJECT_DATA#/}/.agentfs/eval")" "$eval_before"
+check "purge backup contains exact unrelated project memory" "$(tree_identity "$ARTIFACT_BK/files/${PROJECT_DATA#/}/.agentfs")" "$agentfs_before"
+check "selected-project purge leaves adjacent project exact" "$(tree_identity "$ADJACENT_PROJECT/.agentfs")" "$adjacent_before"
+HOME="$ARTIFACT_HOME" XDG_CONFIG_HOME="$ARTIFACT_HOME/.config" bash "$ARTIFACT_BK/revert.sh" >/dev/null 2>&1
+check "artifact revert restores exact bytes" "$(cmp -s "$SB/artifacts.before.db" "$PROJECT_DATA/.agentfs/artifacts.db" && echo yes || echo no)" "yes"
+check "callback revert restores exact bytes" "$(cmp -s "$SB/trajectory.before.db" "$PROJECT_DATA/.agentfs/trajectory.db" && echo yes || echo no)" "yes"
+check "callback WAL revert restores exact bytes" "$(cmp -s "$SB/trajectory.before.db-wal" "$PROJECT_DATA/.agentfs/trajectory.db-wal" && echo yes || echo no)" "yes"
+check "purge revert restores exact eval tree, bytes, and modes" "$(tree_identity "$PROJECT_DATA/.agentfs/eval")" "$eval_before"
+check "purge revert restores exact unrelated project memory" "$(tree_identity "$PROJECT_DATA/.agentfs")" "$agentfs_before"
+check "purge revert leaves adjacent project exact" "$(tree_identity "$ADJACENT_PROJECT/.agentfs")" "$adjacent_before"
 
 # --- project scaffold + memory purge round-trip ----------------------------
 PROJ="$SB/proj"; mkdir -p "$PROJ"; git -C "$PROJ" init -q
 "$ROOT_DIR/scripts/bootstrap.sh" --untracked "$PROJ" >/dev/null 2>&1
 EXCL="$PROJ/.git/info/exclude"
-mkdir -p "$SB/home/.cairnkeep"; echo data >"$SB/home/.cairnkeep/db"
+mkdir -p "$SB/home/.cairnkeep/notes/projects/example/hindsight"; echo data >"$SB/home/.cairnkeep/db"
+printf 'purge and restore exact note bytes\n' >"$SB/home/.cairnkeep/notes/projects/example/hindsight/failure.md"
+purge_note_before=$(sha256sum "$SB/home/.cairnkeep/notes/projects/example/hindsight/failure.md" | cut -d' ' -f1)
+purge_store_before=$(tree_hash "$SB/home/.cairnkeep")
 "$ROOT_DIR/scripts/uninstall.sh" --yes --purge-memory --live-root "$SB/home/.claude" "$PROJ" >/dev/null 2>&1
 check "project .ai removed"      "$([[ -e "$PROJ/.ai" ]] && echo no || echo yes)" "yes"
 check "project .agentfs removed" "$([[ -e "$PROJ/.agentfs" ]] && echo no || echo yes)" "yes"
@@ -66,6 +290,8 @@ bash "$BK2/revert.sh" >/dev/null 2>&1
 check "project scaffold restored" "$([[ -d "$PROJ/.ai" ]] && echo yes || echo no)" "yes"
 check "project ignore restored"   "$([[ -f "$PROJ/.agentfs/.gitignore" ]] && echo yes || echo no)" "yes"
 check "memory store restored"     "$(cat "$SB/home/.cairnkeep/db" 2>/dev/null)" "data"
+check "note store restored exactly" "$(sha256sum "$SB/home/.cairnkeep/notes/projects/example/hindsight/failure.md" | cut -d' ' -f1)" "$purge_note_before"
+check "typed and journal state restored exactly" "$(tree_hash "$SB/home/.cairnkeep")" "$purge_store_before"
 
 echo
 if [[ "$fails" -gt 0 ]]; then echo "test-uninstall: $fails check(s) failed."; exit 1; fi

package/scripts/uninstall.sh

@@ -21,6 +21,7 @@ CLAUDE_SOURCE="$CAIRN_ROOT/claude"
 TPL="$CAIRN_ROOT/templates"
 
 LIVE_ROOT="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
+PI_LIVE_ROOT="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
 STORE_DIR="${CAIRN_AGENTFS_BASE_DIR:-$HOME/.cairnkeep}"
 STORE_DIR="${STORE_DIR/#\~/$HOME}"
 DRY_RUN=0
@@ -29,20 +30,35 @@ PURGE_MEMORY=0
 PROJECTS=()
 
 # The hooks cairnkeep registers (basename is the settings.json match token).
-HOOK_NAMES=(memory-wakeup.sh memory-capture.sh memory-recall.sh context-explore-pretask.sh)
+HOOK_NAMES=(memory-wakeup.sh memory-capture.sh compaction-capture.sh memory-recall.sh context-explore-pretask.sh)
+
+# Exact project-local files installed by bootstrap. Remove these individually so
+# operator-owned files under .ai (notably .env and local state) are never swept
+# up with Cairnkeep's managed scaffold.
+PROJECT_AI_FILES=(
+  start-claude.sh
+  start-opencode.sh
+  start-pi.sh
+  start-kimi.sh
+  env.example
+  trajectory-redaction.json
+  capabilities.json
+)
 
 usage() {
   cat <<'EOF'
-Usage: uninstall.sh [--dry-run] [--yes] [--purge-memory] [--live-root PATH] [PROJECT ...]
+Usage: uninstall.sh [--dry-run] [--yes] [--purge-memory] [--live-root PATH]
+                    [--pi-live-root PATH] [PROJECT ...]
 
 Reverse cairnkeep's install. Everything removed/edited is backed up into
 $HOME/.cairnkeep-uninstall-<ts>/ with a revert.sh before any change.
 
   --dry-run        Print what would happen; touch nothing.
   --yes            Do not prompt for confirmation.
-  --purge-memory   Also remove the global memory store and .agentfs/ memory in
-                   each PROJECT. Backed up first; off by default.
+  --purge-memory   Also remove the global memory store and .agentfs/ memory and
+                   trajectories in each PROJECT. Backed up first; off by default.
   --live-root PATH Claude root to clean (default: $CLAUDE_CONFIG_DIR or ~/.claude).
+  --pi-live-root PATH Pi agent root to clean (default: $PI_CODING_AGENT_DIR or ~/.pi/agent).
   PROJECT ...      Also revert `cairn bootstrap` in these project dirs
                    (.ai/, .planning/, and any .git/info/exclude entries).
   -h, --help       Show this help.
@@ -55,6 +71,7 @@ while [[ $# -gt 0 ]]; do
     --yes) ASSUME_YES=1; shift ;;
     --purge-memory) PURGE_MEMORY=1; shift ;;
     --live-root) LIVE_ROOT="$2"; shift 2 ;;
+    --pi-live-root) PI_LIVE_ROOT="$2"; shift 2 ;;
     -h|--help) usage; exit 0 ;;
     -*) echo "Unknown option: $1" >&2; usage >&2; exit 2 ;;
     *) PROJECTS+=("$1"); shift ;;
@@ -118,6 +135,7 @@ asset_dests() {
 echo "cairn uninstall"
 [[ $DRY_RUN -eq 1 ]] && echo "(dry run — nothing will change)"
 echo "  live root:    $LIVE_ROOT"
+echo "  Pi live root: $PI_LIVE_ROOT"
 echo "  memory store: $STORE_DIR ($([[ $PURGE_MEMORY -eq 1 ]] && echo 'WILL be purged' || echo 'kept'))"
 [[ ${#PROJECTS[@]} -gt 0 ]] && echo "  projects:     ${PROJECTS[*]}"
 
@@ -131,6 +149,11 @@ fi
 echo "Operating layer (assets):"
 while IFS= read -r dst; do remove_path "$dst"; done < <(asset_dests)
 
+# The Pi adapter is one precisely owned extension; do not touch any other Pi
+# configuration or extensions in the same user root.
+echo "Pi extension:"
+remove_path "$PI_LIVE_ROOT/extensions/cairnkeep-trajectory.ts"
+
 # 2. settings.json hook registrations (back up whole file, then de-register).
 SETTINGS="$LIVE_ROOT/settings.json"
 if [[ -f "$SETTINGS" ]]; then
@@ -207,7 +230,17 @@ for proj in "${PROJECTS[@]:-}"; do
   [[ -n "$proj" && -d "$proj" ]] || continue
   proj=$(cd "$proj" && pwd)
   echo "Project scaffold: $proj"
-  remove_path "$proj/.ai"
+  # Truthy launchers create this project-local root only for the explicit
+  # capability overlay. Back up the complete managed unit so its native Claude
+  # hook registrations and OpenCode plugin bytes restore together exactly.
+  # Normal and master-off installations never create it, so absence is inert.
+  remove_path "$proj/.ai/capability-contract"
+  for rel in "${PROJECT_AI_FILES[@]}"; do
+    remove_path "$proj/.ai/$rel"
+  done
+  if [[ $DRY_RUN -eq 0 && -d "$proj/.ai" ]]; then
+    rmdir "$proj/.ai" 2>/dev/null || true
+  fi
   remove_path "$proj/.planning"
   if [[ $PURGE_MEMORY -eq 1 ]]; then
     remove_path "$proj/.agentfs"