@gcunharodrigues/wrxn 0.16.0 → 0.17.0

package/lib/install.cjs

@@ -99,6 +99,9 @@ function init(opts) {
   // the memory-synth writes one outcome line per synth run to `.wrxn/continuity/.synth.log` (synth-handoff-fix-01)
   // — install runtime state (never shipped in the payload), so keep it out of version control.
   ensureGitignoreLine(target, '.wrxn/continuity/.synth.log');
+  // memory-synth-spawn claims each session with a persistent `.wrxn/continuity/.spawned-<id>` marker (#45) —
+  // install runtime state (never shipped), so keep the family out of version control like the synth log.
+  ensureGitignoreLine(target, '.wrxn/continuity/.spawned-*');
   // the memory-synth gemini fallback reads GEMINI_API_KEY from `.env` — ignore it so the secret is
   // never committed (the synth's doc-comment calls it the install's gitignored `.env`).
   ensureGitignoreLine(target, '.env');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gcunharodrigues/wrxn",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "WRXN Kernel — installable AI operating system. Two profiles (project | workspace), pull-based updates, managed/seeded/state file classes.",
   "bin": {
     "wrxn": "bin/wrxn.cjs"

package/payload/.claude/hooks/memory-synth-spawn.cjs

@@ -25,6 +25,19 @@ const { spawn } = require('child_process');
 
 const SENTINEL = 'WRXN_MEMORY_SYNTH'; // recursion guard (mirrors memory-synth.cjs's SENTINEL).
 
+// safeId — canonicalize a session id used as a FILESYSTEM PATH component (#45): lowercase, collapse every
+// non-alnum run to '-', trim, cap length. A raw session id concatenated into a path is a traversal surface;
+// this keeps the once-per-session marker INSIDE .wrxn/continuity. REPLICATED byte-identically from
+// session-start.cjs (and code-intel-push / the reward shell) — each install-only hook is self-contained
+// (node stdlib only, no shared import).
+function safeId(sid) {
+  return String(sid || 'session')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 48) || 'session';
+}
+
 function findInstallRoot(startDir) {
   let dir = startDir || process.env.CLAUDE_PROJECT_DIR || process.cwd();
   for (let i = 0; i < 12; i++) {
@@ -52,6 +65,19 @@ function run({ payload, root, env = process.env, spawn: spawnFn = spawn }) {
     const dir = path.join(root, '.wrxn', 'continuity');
     fs.mkdirSync(dir, { recursive: true });
 
+    // Once-per-session claim (#45): the harness fires SessionEnd more than once per session, so an
+    // unguarded hook launches N synths that race on one shared `.pending`. CLAIM the session ATOMICALLY
+    // with an exclusive create (`wx` throws EEXIST if the marker exists) BEFORE staging markers / spawning:
+    // the FIRST fire creates the marker and proceeds; every later fire for the same session throws → the
+    // outer catch returns {} (spawns nothing, writes no markers). Race-safe across the separate hook
+    // processes (no TOCTOU). The marker is a PERSISTENT per-session file — it must OUTLIVE the synth, so it
+    // is NOT `.pending`/`.pending-handoff` (which the synth clears on exit). A missing/empty session_id
+    // cannot be deduped → preserve today's spawn-every-time behavior for that path.
+    const sid = payload && payload.session_id;
+    if (sid) {
+      fs.closeSync(fs.openSync(path.join(dir, `.spawned-${safeId(sid)}`), 'wx'));
+    }
+
     // Stash the payload as .pending (the synth reads it for transcript_path) and raise the handoff gate.
     fs.writeFileSync(path.join(dir, '.pending'), JSON.stringify(payload || {}));
     fs.writeFileSync(path.join(dir, '.pending-handoff'), String(Date.now()));

package/payload/.claude/hooks/session-start.cjs

@@ -212,6 +212,33 @@ function holdForHandoff({ root, capMs = HOLD_CAP_MS, now = Date.now, sleep } = {
 
 const SYNTH_LOG_REL = ['.wrxn', 'continuity', '.synth.log'];
 
+// sec-F2 (#52): cap the .synth.log read at its TAIL. The staleness decision needs only the NEWEST rows (+ the
+// latest `wrote`), which live at the END of this append-only log — so reading the last SYNTH_LOG_TAIL_BYTES
+// bounds memory against a pathologically large log without losing the signal. A partial first line (a row
+// sliced mid-way by the byte window) is dropped so parseSynthLog only ever sees complete rows. FAIL-OPEN +
+// total: a sub-cap log is read whole (unchanged); any stat/open/read fault → "" (no rows → no warning, no throw).
+const SYNTH_LOG_TAIL_BYTES = 64 * 1024;
+
+function readSynthLogTail(p) {
+  let fd;
+  try {
+    const size = fs.statSync(p).size;
+    if (size <= SYNTH_LOG_TAIL_BYTES) return readFileOr(p, '');
+    fd = fs.openSync(p, 'r');
+    const buf = Buffer.allocUnsafe(SYNTH_LOG_TAIL_BYTES);
+    const read = fs.readSync(fd, buf, 0, SYNTH_LOG_TAIL_BYTES, size - SYNTH_LOG_TAIL_BYTES);
+    const text = buf.toString('utf8', 0, read);
+    const nl = text.indexOf('\n');
+    return nl === -1 ? text : text.slice(nl + 1); // drop the partial first line sliced by the byte window
+  } catch {
+    return ''; // fail-open: any stat/open/read fault → no rows → no warning
+  } finally {
+    if (fd !== undefined) {
+      try { fs.closeSync(fd); } catch { /* fd already gone — never throw out of the cleanup */ }
+    }
+  }
+}
+
 // A synth row is a FAILURE iff its outcome is `no-engine` or an `error…` string (`wrote`/`trivial` = healthy).
 function isFailure(outcome) {
   const o = String(outcome || '');
@@ -338,7 +365,7 @@ function main() {
     // — a frozen baton must not be surfaced as current silently. Fail-open: any read/stat/parse fault → no
     // warning, never a throw. Pure file reads + a stat only (no polling/sleeping beyond the hold cap above).
     try {
-      const rows = parseSynthLog(readFileOr(path.join(root, ...SYNTH_LOG_REL), ''));
+      const rows = parseSynthLog(readSynthLogTail(path.join(root, ...SYNTH_LOG_REL)));
       const batonMtimeMs = fs.statSync(path.join(root, '.wrxn', 'continuity', 'latest.md')).mtimeMs;
       const failing = batonStaleness({ batonMtimeMs, rows });
       if (failing) {
@@ -372,4 +399,4 @@ if (require.main === module) {
   }
 }
 
-module.exports = { holdDecision, holdForHandoff, HOLD_CAP_MS, stampStartHead, resolveGitHead, BASELINE_DIR_REL, batonStaleness };
+module.exports = { holdDecision, holdForHandoff, HOLD_CAP_MS, stampStartHead, resolveGitHead, BASELINE_DIR_REL, batonStaleness, parseSynthLog, readSynthLogTail, SYNTH_LOG_TAIL_BYTES };

package/payload/.wrxn/memory-synth.cjs

@@ -242,9 +242,10 @@ function readTranscriptBlob(transcriptPath) {
 const CLAUDE_TIMEOUT_MS = 120000; // headless sonnet handoff/dream — generous but bounded.
 const GEMINI_TIMEOUT_MS = 30000; // mirrors the proven aimem `curl -m 30` fallback.
 const SENTINEL = 'WRXN_MEMORY_SYNTH'; // recursion guard: set on every engine spawn (the spawn hook no-ops when it sees it).
-// 1200 (vs the aimem reference's 900): the handoff prompt self-caps at ~400 words, so the extra
-// headroom is for the denser `dream` consolidation that shares this engine (lands in slice 04).
-const GEMINI_MAX_OUTPUT_TOKENS = 1200;
+// 4096 (vs the aimem reference's 900, and the prior 1200): a thinking-default model spends part of the
+// output budget on reasoning BEFORE the answer, and a rich `dream` consolidation runs ~4.3k chars — 1200
+// truncated even a non-thinking model on a dense session. 4096 fits the observed clean dream JSON (#30).
+const GEMINI_MAX_OUTPUT_TOKENS = 4096;
 
 /** Assemble the model input: the task system prompt, then the transcript blob (mirrors the reference). */
 function assemblePrompt(prompt, blob) {
@@ -270,8 +271,16 @@ function buildClaudeSpec({ model, prompt, blob }) {
  * Build the `gemini` engine spec: a POST to `…/v1beta/models/<model>:generateContent` with the
  * `x-goog-api-key` header, the task prompt as `system_instruction` and the blob as user content
  * (mirrors the proven aimem-handoff-synth call). PURE.
+ *
+ * `thinking` controls the `generationConfig.thinkingConfig` directive (#30): when true (default) the spec
+ * carries `{ thinkingBudget: 0 }`, which DISABLES model-side thinking on thinking-default models (a verified
+ * HTTP-200 no-op on non-thinking models) so reasoning tokens never consume the output budget and the answer
+ * is never split into a dropped `thought` part. Pass `false` to OMIT the directive — the AC3 retry path for
+ * forced-thinking models (gemma-class) that reject thinkingConfig with an HTTP 400.
  */
-function buildGeminiSpec({ model, prompt, blob, apiKey }) {
+function buildGeminiSpec({ model, prompt, blob, apiKey, thinking = true }) {
+  const generationConfig = { temperature: 0.2, maxOutputTokens: GEMINI_MAX_OUTPUT_TOKENS };
+  if (thinking) generationConfig.thinkingConfig = { thinkingBudget: 0 };
   return {
     engine: 'gemini',
     method: 'POST',
@@ -280,30 +289,59 @@ function buildGeminiSpec({ model, prompt, blob, apiKey }) {
     body: {
       system_instruction: { parts: [{ text: prompt || '' }] },
       contents: [{ role: 'user', parts: [{ text: `TRANSCRIPT:\n${blob || ''}` }] }],
-      generationConfig: { temperature: 0.2, maxOutputTokens: GEMINI_MAX_OUTPUT_TOKENS },
+      generationConfig,
     },
     timeoutMs: GEMINI_TIMEOUT_MS,
   };
 }
 
 /**
- * Extract the model text from a Gemini `generateContent` response body
- * (`candidates[0].content.parts[0].text`). An error payload, unexpected shape, or unparseable body →
- * null, so the engine fails cleanly (→ fallback / null). PURE — pins the response contract with no
- * network round-trip.
+ * Extract the model text from a Gemini `generateContent` response body. Concatenates the `.text` of every
+ * content part EXCEPT parts flagged `thought: true` — a thinking-default / forced-thinking model emits its
+ * reasoning as a separate `thought` part (often parts[0]), which must be dropped, not returned, and the
+ * answer may itself span several parts (#30). An error payload, unexpected shape, no answer text, or an
+ * unparseable body → null, so the engine fails cleanly (→ fallback / null). PURE + total — pins the response
+ * contract with no network round-trip, never throws.
  */
 function parseGeminiResponse(bodyString) {
   try {
     const d = JSON.parse(bodyString);
-    const t = d && d.candidates && d.candidates[0] && d.candidates[0].content
-      && d.candidates[0].content.parts && d.candidates[0].content.parts[0]
-      && d.candidates[0].content.parts[0].text;
-    return typeof t === 'string' && t.trim() ? t : null;
+    const parts = d && d.candidates && d.candidates[0] && d.candidates[0].content
+      && d.candidates[0].content.parts;
+    if (!Array.isArray(parts)) return null;
+    const text = parts
+      .filter((p) => p && p.thought !== true && typeof p.text === 'string')
+      .map((p) => p.text)
+      .join('');
+    return text.trim() ? text : null;
   } catch {
     return null;
   }
 }
 
+// A forced-thinking model (gemma-class) rejects the thinkingConfig directive with an HTTP 400 whose body
+// mentions "thinking" (e.g. "Thinking budget is not supported"). That single discriminating token gates the
+// retry-without path (#30) — narrow enough that an unrelated 400 is NOT mis-flagged (it degrades as a plain
+// failure → fallback / null). A false positive would only cost one harmless retry-without-thinkingConfig.
+const THINKING_UNSUPPORTED_RE = /thinking/i;
+
+/**
+ * Classify a Gemini HTTP response into the invoke-result the orchestration consumes (#30). PURE + total:
+ *   - a parseable answer → `{ ok:true, text }`;
+ *   - HTTP 400 whose body mentions thinking → `{ ok:false, thinkingUnsupported:true, detail }` (the signal
+ *     runEngine uses to rebuild the spec WITHOUT thinkingConfig and retry once);
+ *   - anything else → `{ ok:false, detail }` (a plain failure, exactly as before).
+ * Kept pure (statusCode + body in, result out) so invokeGemini's 400-detection is unit-tested with no network.
+ */
+function parseGeminiResult(statusCode, bodyString) {
+  const text = parseGeminiResponse(bodyString);
+  if (text) return { ok: true, text };
+  if (statusCode === 400 && THINKING_UNSUPPORTED_RE.test(String(bodyString || ''))) {
+    return { ok: false, text: '', thinkingUnsupported: true, detail: 'gemini http 400 thinking-unsupported' };
+  }
+  return { ok: false, text: '', detail: `gemini http ${statusCode}` };
+}
+
 // ── defaultInvoke: the REAL engine invoker (the production path behind the seam) ──
 // Mirrors lib/protect.cjs's defaultInvoke: the single real-call site. The suite NEVER reaches here — it
 // injects a fake. `claude` → spawnSync `claude -p`; `gemini` → an HTTPS POST. Both judge success by the
@@ -341,8 +379,9 @@ function invokeGemini(spec) {
         let data = '';
         res.on('data', (c) => { data += c; });
         res.on('end', () => {
-          const text = parseGeminiResponse(data);
-          resolve(text ? { ok: true, text } : { ok: false, text: '', detail: `gemini http ${res.statusCode}` });
+          // parseGeminiResult is status-aware: a 400 thinking-unsupported body becomes a `thinkingUnsupported`
+          // signal so runEngine retries WITHOUT thinkingConfig; any other failure stays a plain ok:false (#30).
+          resolve(parseGeminiResult(res.statusCode, data));
         });
       },
     );
@@ -398,12 +437,27 @@ function defaultSleep(ms) {
  */
 async function runEngine(engine, { prompt, blob, apiKey, invoke, sleep = defaultSleep, validate }) {
   if (!engine || !engine.engine) return { text: null, attempts: 0 };
-  let spec;
+
+  // `callOnce()` is ONE engine call — the unit the transient-spawn retry loop below repeats. For gemini it
+  // also encapsulates the thinking-unsupported fallback (#30): issue the spec carrying thinkingConfig; if the
+  // model REJECTS that directive (HTTP 400 → `thinkingUnsupported`), rebuild the SAME request WITHOUT
+  // thinkingConfig and issue it once more, using that result. This lives ABOVE the invoke seam, so a fake
+  // invoke simulates both halves with no network; it composes with the transient retries (the whole callOnce
+  // is the retried unit) and preserves the gemini-no-key early-out (no key → no request, below).
+  let callOnce;
   if (engine.engine === 'claude') {
-    spec = buildClaudeSpec({ model: engine.model, prompt, blob });
+    const spec = buildClaudeSpec({ model: engine.model, prompt, blob });
+    callOnce = () => invoke(spec);
   } else if (engine.engine === 'gemini') {
     if (!apiKey) return { text: null, attempts: 0 }; // missing key fails this engine (→ fallback / null), no request, no retry.
-    spec = buildGeminiSpec({ model: engine.model, prompt, blob, apiKey });
+    callOnce = async () => {
+      const r = await invoke(buildGeminiSpec({ model: engine.model, prompt, blob, apiKey, thinking: true }));
+      if (r && r.thinkingUnsupported) {
+        // this model rejects the thinkingConfig directive (forced-thinking / gemma-class) — retry once without it.
+        return invoke(buildGeminiSpec({ model: engine.model, prompt, blob, apiKey, thinking: false }));
+      }
+      return r;
+    };
   } else {
     return { text: null, attempts: 0 }; // unknown engine name → skip.
   }
@@ -412,7 +466,7 @@ async function runEngine(engine, { prompt, blob, apiKey, invoke, sleep = default
     attempts += 1;
     let text = null;
     try {
-      const r = await invoke(spec);
+      const r = await callOnce();
       const t = r && r.ok && typeof r.text === 'string' ? r.text.trim() : '';
       text = t || null;
     } catch {
@@ -432,9 +486,11 @@ async function runEngine(engine, { prompt, blob, apiKey, invoke, sleep = default
 // writes nothing. A task with NO registered validator is permissive (any non-empty text wins, exactly as
 // before), so every existing caller is preserved.
 const TASK_VALIDATORS = {
-  // dream output is usable only if the gate (parseProposals) reads ≥1 proposal from it, OR it is an explicit
-  // abstain — a deliberate "nothing to record" is a valid answer, NOT a reason to churn through the fallback.
-  dream: (text) => parseProposals(text).length > 0 || /abstain/i.test(text),
+  // dream output is usable only if the gate (parseProposals) reads ≥1 proposal from it, OR it is a STRUCTURED
+  // abstain (isAbstain — the text carries an actual {abstain:true}, NOT merely the word in prose). A deliberate
+  // "nothing to record" is a valid answer, NOT a reason to churn through the fallback (#52: the old /abstain/i
+  // substring let a model that just wrote the word pass as an abstain).
+  dream: (text) => parseProposals(text).length > 0 || isAbstain(text),
 };
 
 // Resolve a task's engine-success validator; an unregistered task is permissive (any non-empty text wins).
@@ -631,6 +687,18 @@ function writeBatonAtomic(root, body) {
  * @returns {Promise<{ wrote:boolean, blob:string, reason?:string }>}
  */
 async function runHandoff({ root, invoke = defaultInvoke, sleep }) {
+  // Stash-presence gate (#45): a synth with NO `.pending` stash has no session to process — no-op cleanly
+  // and write NO synth-log row. This is the secondary defense behind the spawn hook's once-per-session
+  // guard: a 2nd synth whose sibling already consumed+cleared the stash (or a manual --from-spawn with
+  // none) must not log a spurious `trivial`/`no-engine` row that pollutes the log + the baton-staleness
+  // signal. SPECIFIC to the ABSENT-file case — a present-but-trivial stash still logs `trivial` below.
+  // existsSync is total (never throws). NB-1: a stranded `.pending-handoff` can linger here (a concurrent /
+  // no-session-id race cleared `.pending` after a sibling re-raised both) — release session-start's hold
+  // before returning, or its holdForHandoff waits the full cap. rmQuiet is best-effort/total.
+  if (!fs.existsSync(continuityPath(root, PENDING))) {
+    rmQuiet(continuityPath(root, PENDING_HANDOFF));
+    return { wrote: false, blob: '', reason: 'no-stash' };
+  }
   let wrote = false;
   let reason;
   let safeBlob = ''; // the redacted blob, returned so dream can reuse it in memory (auto-memory-04).
@@ -693,37 +761,61 @@ function dreamAdapter() {
 }
 
 /**
- * Parse the engine's dream output into a proposals array. The model is asked for STRICT JSON, but a real
- * model may wrap it in prose or ```json fences — so we extract the first balanced {...} / [...] span and
- * parse it. An `{ abstain:true }` or anything unparseable / shapeless yields [] (write nothing). PURE.
+ * Extract the first JSON value from model output. The model is asked for STRICT JSON, but a real model may
+ * wrap it in prose or ```json fences — so on a direct-parse miss we grab the first balanced {…} / […] span and
+ * parse that. Returns the parsed value, or null when nothing parses. PURE + total — never throws. This is the
+ * SINGLE tolerant parse shared by both parseProposals and isAbstain so the two can never diverge (#52).
  * @param {string} text the engine output
- * @returns {Array} the proposals (possibly empty)
+ * @returns {object|Array|null}
  */
-function parseProposals(text) {
+function firstJsonValue(text) {
   const s = String(text || '');
-  let parsed = null;
   try {
-    parsed = JSON.parse(s);
+    return JSON.parse(s);
   } catch {
     // tolerate prose/fences around the JSON: grab the first { … } or [ … ] span and try that.
     const start = s.search(/[[{]/);
-    if (start === -1) return [];
+    if (start === -1) return null;
     const open = s[start];
     const close = open === '{' ? '}' : ']';
     const end = s.lastIndexOf(close);
-    if (end <= start) return [];
+    if (end <= start) return null;
     try {
-      parsed = JSON.parse(s.slice(start, end + 1));
+      return JSON.parse(s.slice(start, end + 1));
     } catch {
-      return [];
+      return null;
     }
   }
+}
+
+/**
+ * Parse the engine's dream output into a proposals array (via firstJsonValue's tolerant extraction). An
+ * `{ abstain:true }` or anything unparseable / shapeless yields [] (write nothing). PURE.
+ * @param {string} text the engine output
+ * @returns {Array} the proposals (possibly empty)
+ */
+function parseProposals(text) {
+  const parsed = firstJsonValue(text);
   if (parsed && typeof parsed === 'object' && parsed.abstain === true) return [];
   if (Array.isArray(parsed)) return parsed;
   if (parsed && typeof parsed === 'object' && Array.isArray(parsed.proposals)) return parsed.proposals;
   return [];
 }
 
+/**
+ * A STRUCTURED dream abstain (#52): the output carries an actual `{ abstain:true }` — not merely the word
+ * "abstain" somewhere in prose. Reuses firstJsonValue's extraction (clean / fenced / prose-wrapped JSON all
+ * resolve) and returns true only when the parsed object literally has `abstain === true`. PURE + total — never
+ * throws. The dream engine-success validator uses it so a model that just writes the word does NOT pass as a
+ * deliberate "nothing to record" (the old broad /abstain/i substring did).
+ * @param {string} text the engine output
+ * @returns {boolean}
+ */
+function isAbstain(text) {
+  const parsed = firstJsonValue(text);
+  return !!(parsed && typeof parsed === 'object' && !Array.isArray(parsed) && parsed.abstain === true);
+}
+
 /** Run a dream.cjs subcommand in-process-but-separate (spawnSync node), rooted at the install. Parses its
  * JSON stdout; a non-zero exit / unparseable output → null (the caller treats it as "no result"). */
 function runDreamCli(root, args) {
@@ -750,17 +842,19 @@ function writeTemp(root, tag, content) {
  * the dream.cjs gate (check → stage accepted → commit, all `--source`-verified against the blob), and
  * returns the committed slugs. Writes nothing on a trivial blob / abstain / empty-or-rejected set. Cleans
  * up its temp files. Never throws (a fault degrades to "wrote nothing").
- * @param {{ root:string, blob:string, invoke?:Function }} opts
+ * @param {{ root:string, blob:string, invoke?:Function, sleep?:Function }} opts
  * @returns {Promise<{ written:string[], reason?:string }>}
  */
-async function runDream({ root, blob, invoke = defaultInvoke }) {
+async function runDream({ root, blob, invoke = defaultInvoke, sleep }) {
   const temps = [];
   try {
     if (!blob || blob.trim().length < TRIVIAL_BLOB_MIN) return { written: [], reason: 'trivial' };
     const config = loadConfig(root);
     const apiKey = loadEnv(root).GEMINI_API_KEY;
     const safeBlob = redactSecrets(blob); // scrub BEFORE the blob egresses to the external model.
-    const text = await synthesize({ task: 'dream', prompt: PROMPTS.dream, blob: safeBlob, config, apiKey, invoke });
+    // `sleep` is threaded to the engine retry loop (default real backoff in production; tests inject a no-op so
+    // a validate-fail dream — which exhausts ENGINE_ATTEMPTS × ENGINE_BACKOFF_MS — runs instantly, #52).
+    const text = await synthesize({ task: 'dream', prompt: PROMPTS.dream, blob: safeBlob, config, apiKey, invoke, sleep });
     const proposals = parseProposals(text);
     if (proposals.length === 0) return { written: [], reason: 'abstain' };
 
@@ -900,7 +994,9 @@ module.exports = {
   buildClaudeSpec,
   buildGeminiSpec,
   parseGeminiResponse,
+  parseGeminiResult,
   parseProposals,
+  isAbstain,
   defaultInvoke,
   synthesize,
   runHandoff,