@hybridlabor-api/aos 4.4.0 → 4.4.1

package/.claude/hooks/memb-inject.mjs

@@ -1,7 +1,13 @@
 #!/usr/bin/env node
+// aos-hook-version: 2
 /**
  * memB ambient memory hook for Claude Code (UserPromptSubmit).
  *
+ * The version line above is what /aos-setup's doctor reads to tell a current
+ * hook from a stale one left behind by an older install. Bump it whenever this
+ * file changes in a way a machine must actually pick up, and bump the expected
+ * value in aos-doctor.mjs in the same commit.
+ *
  * Reads ~/.MemBDB/memb.db directly through node:sqlite and injects the most
  * relevant memories as ephemeral additionalContext — nothing is written to
  * disk and nothing lands in git. Fails open: any error exits 0 silently, so a

package/installer.js

@@ -508,10 +508,30 @@ function resolveFileConflict(sourcePath, targetPath, manifest, knownSourceHashes
 
     const diskHash = computeFileHash(targetPath);
 
-    // Case: foreign – no manifest entry AND disk hash unknown to this payload.
+    // Case: unrecognised content at a path this payload owns.
+    //
+    // This used to skip, on the reading that unknown content means a file the
+    // installer did not place. But resolveFileConflict only ever sees paths the
+    // payload is actively writing, so the path IS ours -- and the commonest
+    // cause of unknown content is simply an older release of our own file,
+    // installed before manifest tracking existed and therefore never adopted.
+    // Skipping froze those permanently: v4.4.0 still found skills on disk
+    // carrying pre-reorg ~/bdb-dev paths and a stale `category:`, untouched
+    // across every update since, because bootstrap adoption only catches a file
+    // that is byte-identical to the current payload.
+    //
+    // So update it, and keep the protection where it belongs -- in the backup,
+    // not in refusing to write. A genuine local edit is recoverable from .bak
+    // rather than silently outvoting the shipped version forever.
     if (!manifestEntry && !knownSourceHashes.has(diskHash)) {
-        log.warn(`[manifest] Foreign file at ${targetPath} — left untouched.`);
-        return 'skipped';
+        const bakPath = `${targetPath}.bak`;
+        try { fs.copyFileSync(targetPath, bakPath); } catch (e) {
+            log.warn(`[manifest] Could not create backup ${bakPath}: ${e.message}`);
+        }
+        fs.copyFileSync(sourcePath, targetPath);
+        manifest[targetPath] = { path: targetPath, sha256: sourceHash, version: pkg.version, installedAt: new Date().toISOString() };
+        log.warn(`[manifest] Unrecognised ${path.basename(targetPath)} backed up to ${bakPath}, shipped version written.`);
+        return 'bak';
     }
 
     // Case: first-run bootstrap – disk hash matches source hash but no manifest entry.
@@ -2717,7 +2737,7 @@ function injectHarnessRules() {
                     log.step(`Copied ${dir} to ${targetPath}`);
                 }
             });
-            mergeBdbSettingsHooks(path.join(homeDir, '.claude', 'settings.json'));
+            installGlobalHooks();
         }, '');
 
         installStep('sync global .agents/', () => {
@@ -2731,6 +2751,22 @@ function injectHarnessRules() {
     }
 }
 
+// Deliver the hook scripts to ~/.claude/hooks/ and wire them in settings.json.
+// Both the full install and Quick Update funnel through here. Quick Update used
+// to do neither: it refreshes skills and submodules, but hooks are harness
+// plumbing rather than skills, so an existing install updating to a version
+// that adds or changes a hook silently never received it -- which is exactly
+// what happened to memb-inject.mjs in v4.4.0, on the machines that needed it
+// most (a fresh install got it; every machine that already had AOS did not).
+function installGlobalHooks() {
+    const hooksSrc = path.join(srcDir, '.claude', 'hooks');
+    if (fs.existsSync(hooksSrc)) {
+        copyDirRecursiveSync(hooksSrc, path.join(homeDir, '.claude', 'hooks'));
+        log.step(`Installed hooks to ${path.join(homeDir, '.claude', 'hooks')}`);
+    }
+    mergeBdbSettingsHooks(path.join(homeDir, '.claude', 'settings.json'));
+}
+
 // Merge the BDB hooks -- the two gates plus the memB ambient-memory hook --
 // into a Claude Code settings.json without clobbering
 // user-owned keys (v3.13 audit BLOCKER-3: the harness-dir copy used to
@@ -3298,6 +3334,10 @@ async function runQuickUpdate(installState) {
     syncSkillsToGlobalHarnesses(excludeSkills);
     s.stop('Skills refreshed');
 
+    installStep('refresh gate + memory hooks', () => {
+        installGlobalHooks();
+    }, 'Hooks keep whatever version this machine already had.');
+
     // OpenWiki setup only ever ran on a brand-new install (main()'s fresh-install
     // branch below) -- an existing install running Quick Update never got offered
     // it and never had its daemon schedule refreshed. promptCredentials() already
@@ -3728,6 +3768,7 @@ if (require.main === module) {
 // Exported for tests -- requiring installer.js must not launch the TUI.
 module.exports = {
     mergeBdbSettingsHooks,
+    installGlobalHooks,
     installProjectHarness,
     mirrorMcpServersTo,
     // Manifest store (exported for verification tests)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hybridlabor-api/aos",
-  "version": "4.4.0",
+  "version": "4.4.1",
   "description": "AOS — A Curated AI AGENT OS. Optimized agent skills and add-ons like memB, OpenWiki, Heimdall Token Saver, and Godmode architectures.",
   "main": "installer.js",
   "bin": {

package/skills/global_config/aos-setup/SKILL.md

@@ -123,9 +123,11 @@ injects the relevant memories as context. It fails open: any error exits `0`
 and the prompt proceeds untouched.
 
 Since v4.4.0 the installer ships `memb-inject.mjs` into `~/.claude/hooks/` and
-wires it as a `UserPromptSubmit` hook, so on a current install both doctor rows
-pass on their own. A machine where they fail is running an older AOS — the fix
-is the installer, not a manual copy:
+wires it as a `UserPromptSubmit` hook. **v4.4.0's Quick Update did not** — it
+refreshes skills and submodules, and hooks are harness plumbing rather than
+skills, so a machine that already had AOS updated to 4.4.0 without ever
+receiving the hook. Fixed in v4.4.1; a machine that took that update needs one
+more run:
 
 ```bash
 npx -y @hybridlabor-api/aos@latest
@@ -135,6 +137,13 @@ The wiring is merged into `~/.claude/settings.json`, never written over it:
 user keys and foreign hook entries survive, and a re-run replaces the BDB entry
 rather than adding a second copy.
 
+The hook carries an `aos-hook-version:` line on its second line, and the doctor
+compares it against what the installed release expects. That is why the row can
+read *stale* rather than simply passing: a hook file that exists and is wired
+can still be an old copy carrying a bug this version fixed. When you change the
+hook in a way machines must pick up, bump that line and the expected value in
+`aos-doctor.mjs` in the same commit — the test suite fails if the two disagree.
+
 Unlike the two gate hooks, this one stays `$HOME`-anchored even in a project
 harness — the memB store is machine-global, and pointing it at
 `$CLAUDE_PROJECT_DIR` would make it fail on every prompt in any project the

package/skills/global_config/aos-setup/scripts/aos-doctor.mjs

@@ -139,10 +139,35 @@ function checkAos() {
 // ---------------------------------------------------------------- hooks
 function checkHooks() {
   const hooksDir = h('.claude', 'hooks');
+
+  // Existence is not enough: an older install leaves a stale copy behind, and
+  // the row would go green over a hook carrying a bug this version fixed.
+  // Hooks that carry an `aos-hook-version:` line are checked against what this
+  // release expects; the ones that do not are existence-only.
+  const EXPECTED_VERSION = { 'memb-inject.mjs': 2 };
+  const versionOf = (text) => {
+    const m = /^\/\/\s*aos-hook-version:\s*(\d+)/m.exec(text);
+    return m ? Number(m[1]) : null;
+  };
+
   for (const file of ['go-gate.mjs', 'graph-gate.mjs', 'memb-inject.mjs']) {
     const p = path.join(hooksDir, file);
-    add('hooks', file, existsSync(p), existsSync(p) ? p.replace(HOME, '~') : 'missing',
-      'npx -y @hybridlabor-api/aos@latest (the installer ships and wires all three).');
+    if (!existsSync(p)) {
+      add('hooks', file, false, 'missing',
+        'npx -y @hybridlabor-api/aos@latest (the installer ships and wires all three).');
+      continue;
+    }
+    const want = EXPECTED_VERSION[file];
+    if (!want) {
+      add('hooks', file, true, tilde(p), '');
+      continue;
+    }
+    const got = versionOf(readFileSync(p, 'utf8'));
+    add('hooks', file, got === want,
+      got === want ? `${tilde(p)} (v${got})`
+        : got === null ? `${tilde(p)} — predates version stamping, so it is older than v${want}`
+        : `${tilde(p)} — v${got}, this release ships v${want}`,
+      'npx -y @hybridlabor-api/aos@latest — Quick Update refreshes hooks from v4.4.1 on; an older installer never replaced them.');
   }
 
   const settings = readJson(h('.claude', 'settings.json'));