@inetafrica/open-claudia 2.9.0 → 2.9.1

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v2.9.1
+- **Post-turn reviewer no longer rewrites pack sections blind — context starvation fixed.** The reviewer prompt showed only the pack *index* (name + description), so a State rewrite was regenerated from the turn text alone and silently destroyed durable facts the turn didn't restate; worse, with no project name in the turn text it could attribute the work to the wrong pack entirely (observed live: an AQUELLE product-shot turn filed under Alpha Protein, wiping a promoted root-cause fact). The runner now passes the turn's **active packs** (recall-surfaced ∪ explicitly opened) into `reviewTurn`; the prompt includes their **full current Stance/Procedure/State + recent journal**, with two new rules: attribute updates to an active pack unless the turn clearly names another, and treat section rewrites as **merges** — carry forward every still-true fact, drop only what the turn contradicted or completed.
+- **Structural enforcement, not just prompt guidance.** `applyAction` drops section rewrites (State/Stance/Procedure) targeting any pack whose current content the reviewer did not see — journal lines still land; the announce line notes the drop. Applies to the update path, the exists-on-create path, and the versioned-duplicate fold.
+- **Provenance guard extended.** A user-authored Procedure now gets the same intent-wins protection as Stance (an automated writer never silently replaces it). State stays rewritable by design, but replacing a user-authored State is now flagged in the reviewer's announcement (⚠️) so the overwrite is visible instead of silent.
+
 ## v2.9.0
 - **Hybrid async approvals — a destructive run no longer burns the turn or dead-ends on a late press.** v2.8.0's chat approval blocked the CLI for 5 minutes and treated timeout as denial, which had two UX failures: an undecided window wasted minutes of live turn, and a button pressed after the window hit a dead-end (terse auto-ack, no agent reaction — the record was already denied). The flow is now two-phase. **Fast path**: the CLI waits ~90s; an inline Approve runs immediately, Deny refuses — unchanged semantics, just a tighter window. **Async path**: if undecided at 90s, the CLI marks the record `detached` and exits code 5 with instructions to end the turn ("pending your Approve/Deny — do NOT retry"); the record stays open for 24h. When the button is eventually pressed, the `apr:` handler sees the detached record and **schedules an immediate wakeup** in the originating channel carrying the decision and the exact command, so the agent reacts either way (runs it, or acknowledges the denial).
 - **One-shot approval tokens, fail-closed on every branch.** The woken agent redeems the decision with `tool run <name> <args> --approval <apr_id>`. `approvals.consume()` requires ALL of: status `approved`, never consumed before (single use — a replay is refused), within 24h of request, and a command line **byte-identical** to what the user saw on the buttons (a mismatch refuses without burning the token). `--approval` is honored on top-level runs only — a nested/composed tool can't smuggle a token — and redemption stamps `approvedVia: "chat-approval"` + exports `OPEN_CLAUDIA_APPROVED_TIER=destructive` exactly like an inline approve, so composition inheritance is unchanged. Undecided, denied, expired, unknown, or mismatched never runs.

package/core/pack-review.js

@@ -58,7 +58,34 @@ function formatAnnouncement(lines) {
   return [header, ...lines].join("\n\n");
 }
 
-function buildReviewPrompt(userText, assistantText) {
+// Full current content of the packs a turn actually worked with, rendered
+// into the review prompt so section rewrites are merges (old content visible)
+// instead of blind regenerations from the turn text — a blind State rewrite
+// silently destroys durable facts the turn didn't restate.
+const ACTIVE_PACK_MAX = 4;
+const ACTIVE_SECTION_CHARS = 1500;
+
+function renderActivePacks(activePacks) {
+  const dirs = (Array.isArray(activePacks) ? activePacks : []).slice(0, ACTIVE_PACK_MAX);
+  const blocks = [];
+  for (const dir of dirs) {
+    let p = null;
+    try { p = packs.readPack(dir); } catch (e) {}
+    if (!p) continue;
+    const sec = p.sections || {};
+    const journal = String(sec.Journal || "").split("\n").filter((l) => l.trim()).slice(-3).join("\n");
+    const parts = [`### ${p.dir}: ${p.name} — ${p.description || ""}`];
+    if (String(sec.Stance || "").trim()) parts.push(`Stance:\n${clip(sec.Stance.trim(), ACTIVE_SECTION_CHARS)}`);
+    if (String(sec.Procedure || "").trim()) parts.push(`Procedure:\n${clip(sec.Procedure.trim(), ACTIVE_SECTION_CHARS)}`);
+    if (String(sec.State || "").trim()) parts.push(`State (current):\n${clip(sec.State.trim(), ACTIVE_SECTION_CHARS)}`);
+    if (journal) parts.push(`Journal (recent):\n${journal}`);
+    blocks.push(parts.join("\n"));
+  }
+  return blocks.join("\n\n");
+}
+
+function buildReviewPrompt(userText, assistantText, activePacks) {
+  const activeBlock = renderActivePacks(activePacks);
   const index = packs.listPacks().map((p) => {
     const ab = p.kind === "ability" ? " ◆ability" : "";
     const prov = p.kind === "ability" && p.learned_on
@@ -93,7 +120,11 @@ A LESSON is a single always-loaded rule (NOT topic-gated like packs/entities —
 
 Existing packs:
 ${index}
+${activeBlock ? `
+Packs ACTIVE during this turn — their FULL CURRENT content. The turn's work almost certainly belongs to one of these:
 
+${activeBlock}
+` : ""}
 Known entities:
 ${entityIndex}
 
@@ -112,6 +143,8 @@ ${clip(assistantText)}
 
 Decide. Rules:
 - Bias toward action: if the turn did real work on an identifiable topic (a named system, project, server, app, person, or domain), record it — at minimum a journal line. Most working turns deserve one. Reserve empty actions for small talk, pure status checks, and turns that contain nothing new.
+- ATTRIBUTION: prefer updating one of the ACTIVE packs above. The turn text often does not name its project (pronouns, follow-ups, pasted URLs) — never attribute the work to a different pack from the index on thematic similarity alone when an active pack fits the work.
+- State/Stance/Procedure rewrites are MERGES, never regenerations: start from the pack's CURRENT content shown in the ACTIVE block above, carry forward every fact that is still true, drop only what this turn contradicted or completed, then fold in what changed. Never drop a durable fact merely because this turn did not mention it. If a pack's current content is NOT shown above, do not rewrite its sections — record a journal line only (section rewrites there are discarded).
 - UPDATE an existing pack when the turn touched that topic: append a journal line, and rewrite State if where-things-stand changed. Update Stance when the user expressed a lasting preference or rule; Procedure when a verified working method emerged.
 - PROMOTE durable conclusions out of the Journal. A confirmed root-cause diagnosis, an established fact, or a settled design decision must go into Stance/Procedure/State (the parts always injected in full), NOT only a Journal line — Journal is truncated to the last few lines on injection, so a conclusion left only there will silently fall out of recall over time.
 - CREATE a pack ONLY when the turn worked on a durable topic that NO existing pack covers. Before creating, scan the existing packs above for one already about this project/system/domain — if one exists, UPDATE it instead. A new pack must be a genuinely DISTINCT topic, never a narrower facet, version, release, sub-feature, phase, or component of a topic an existing pack already owns. In particular: a release or version of a project (e.g. a pack named after "<project> v2.6.39") is a Journal line + State update on that project's EXISTING pack — NEVER its own pack. Likewise sub-features of one system belong in that system's pack, not in siblings. When unsure whether something is a new topic or a facet of an existing one, treat it as a facet and UPDATE. Do not create packs for one-off trivia.
@@ -189,7 +222,7 @@ function findDuplicatePack({ dir, name, description, tags }) {
   return null;
 }
 
-function applyAction(a) {
+function applyAction(a, activeSet = null) {
   if (!a || typeof a !== "object") return null;
   const guard = guardCheck(a);
   if (guard.flagged) {
@@ -198,11 +231,17 @@ function applyAction(a) {
   if (a.action === "update" && a.pack) {
     const existing = packs.readPack(a.pack);
     if (!existing) return null;
+    // Structural enforcement of merge-not-regenerate: the reviewer only saw
+    // the full current sections of the turn's ACTIVE packs, so a section
+    // rewrite on any other pack is blind (generated from the turn text alone)
+    // and would destroy durable facts. Journal lines always land; section
+    // rewrites are dropped for packs outside the active set.
+    const blind = activeSet instanceof Set && !activeSet.has(a.pack);
     const r = packs.updatePack(a.pack, {
       journal: a.journal || "",
-      state: typeof a.state === "string" ? a.state : "",
-      stance: typeof a.stance === "string" ? a.stance : "",
-      procedure: typeof a.procedure === "string" ? a.procedure : "",
+      state: !blind && typeof a.state === "string" ? a.state : "",
+      stance: !blind && typeof a.stance === "string" ? a.stance : "",
+      procedure: !blind && typeof a.procedure === "string" ? a.procedure : "",
     }, "reviewer");
     // Cross-project reuse: only abilities carry applied_on, so ignore the field
     // on context packs (keeps project trackers churn-free).
@@ -212,7 +251,15 @@ function applyAction(a) {
         if (packs.recordApplied(a.pack, proj)) appliedTo = proj;
       }
     }
-    return { kind: "update", dir: a.pack, name: existing.name, note: a.journal || (appliedTo ? `reused on ${appliedTo}` : "state updated"), protectedStance: !!r.protectedStance, appliedTo };
+    return {
+      kind: "update", dir: a.pack, name: existing.name,
+      note: a.journal || (appliedTo ? `reused on ${appliedTo}` : "state updated"),
+      protectedStance: !!r.protectedStance,
+      protectedProcedure: !!r.protectedProcedure,
+      overwroteUserState: !!r.overwroteUserState,
+      blindSkipped: blind && [a.state, a.stance, a.procedure].some((s) => typeof s === "string" && s.trim()),
+      appliedTo,
+    };
   }
   if (a.action === "create" && (a.dir || a.name)) {
     const dir = packs.slugify(a.dir || a.name);
@@ -223,7 +270,8 @@ function applyAction(a) {
       : [];
     const projects = applied_on.length ? applied_on : (learned_on ? [learned_on] : []);
     if (packs.readPack(dir)) {
-      packs.updatePack(dir, { journal: a.journal || "", state: a.state || "" }, "reviewer");
+      const blind = activeSet instanceof Set && !activeSet.has(dir);
+      packs.updatePack(dir, { journal: a.journal || "", state: blind ? "" : (a.state || "") }, "reviewer");
       if (kind === "ability") for (const proj of projects) packs.recordApplied(dir, proj);
       return { kind: "update", dir, name: a.name || dir, note: a.journal || "state updated" };
     }
@@ -232,7 +280,8 @@ function applyAction(a) {
     // they are activity-named and cross-project by design).
     const dupeDir = kind === "context" ? findDuplicatePack({ dir, name: a.name, description: a.description, tags: a.tags }) : null;
     if (dupeDir && packs.readPack(dupeDir)) {
-      packs.updatePack(dupeDir, { journal: a.journal || "", state: a.state || "" }, "reviewer");
+      const blind = activeSet instanceof Set && !activeSet.has(dupeDir);
+      packs.updatePack(dupeDir, { journal: a.journal || "", state: blind ? "" : (a.state || "") }, "reviewer");
       const ex = packs.readPack(dupeDir);
       return { kind: "update", dir: dupeDir, name: (ex && ex.name) || dupeDir, note: a.journal || "folded a new-pack proposal into the existing pack" };
     }
@@ -319,7 +368,7 @@ function shouldSkipReview({ userText, assistantText, signals = {} }) {
 
 // Fire-and-forget. `announce` is an async (text) => void bound to the
 // originating channel; failures are logged, never thrown into the turn.
-function reviewTurn({ userText, assistantText, channelId, announce, signals }) {
+function reviewTurn({ userText, assistantText, channelId, announce, signals, activePacks }) {
   if (!enabled()) return;
   const skip = shouldSkipReview({ userText, assistantText, signals });
   if (skip) {
@@ -329,7 +378,8 @@ function reviewTurn({ userText, assistantText, channelId, announce, signals }) {
     return;
   }
 
-  const prompt = buildReviewPrompt(redactSensitive(String(userText || "")), redactSensitive(String(assistantText || "")));
+  const activeSet = Array.isArray(activePacks) && activePacks.length ? new Set(activePacks) : null;
+  const prompt = buildReviewPrompt(redactSensitive(String(userText || "")), redactSensitive(String(assistantText || "")), activePacks);
 
   spawnSubagent(prompt, {
     model: REVIEW_MODEL,
@@ -343,7 +393,7 @@ function reviewTurn({ userText, assistantText, channelId, announce, signals }) {
     const usedIds = []; // nodes this turn's work demonstrably touched
     for (const a of decision.actions) {
       try {
-        const r = applyAction(a);
+        const r = applyAction(a, activeSet);
         if (r && (r.kind === "update" || r.kind === "create") && r.dir) usedIds.push(`pack:${r.dir}`);
         if (r && r.kind === "skipped") {
           lines.push(`🛡️ Skipped a memory write that looked like an injected instruction (${r.reason}).`);
@@ -352,7 +402,11 @@ function reviewTurn({ userText, assistantText, channelId, announce, signals }) {
         } else if (r && r.kind === "create") {
           lines.push(`📦 New pack: ${r.name}${r.parent ? ` (filed under ${r.parent})` : ""}\n${clipWords(r.note, 180)}\n↳ open-claudia pack show ${r.dir}`);
         } else if (r) {
-          lines.push(`✏️ ${r.name} — ${clipWords(r.note, 180)}${r.appliedTo ? ` 🧩 (now also applies to ${r.appliedTo})` : ""}\n↳ open-claudia pack show ${r.dir}`);
+          const marks = [];
+          if (r.appliedTo) marks.push(` 🧩 (now also applies to ${r.appliedTo})`);
+          if (r.overwroteUserState) marks.push(" ⚠️ replaced a user-written State — check it kept your facts");
+          if (r.blindSkipped) marks.push(" (section rewrite dropped: pack wasn't active this turn — journal only)");
+          lines.push(`✏️ ${r.name} — ${clipWords(r.note, 180)}${marks.join("")}\n↳ open-claudia pack show ${r.dir}`);
         }
       } catch (e) {
         console.warn(`[pack-review] apply failed: ${e.message}`);

package/core/packs.js

@@ -393,8 +393,26 @@ function updatePack(dir, { description, tags, stance, procedure, state, journal,
       applied.push("Stance");
     }
   }
-  if (typeof procedure === "string" && procedure.trim()) { pack.sections.Procedure = procedure.trim(); applied.push("Procedure"); }
-  if (typeof state === "string" && state.trim()) { pack.sections.State = state.trim(); applied.push("State"); }
+  let protectedProcedure = false;
+  if (typeof procedure === "string" && procedure.trim()) {
+    // Same intent-wins rule as Stance: a user-authored Procedure is a verified
+    // how-to — an automated writer never silently replaces it.
+    if (origin !== "user" && provenanceOf(dir, "Procedure") === "user") {
+      protectedProcedure = true;
+    } else {
+      pack.sections.Procedure = procedure.trim();
+      applied.push("Procedure");
+    }
+  }
+  // State stays rewritable by design (it tracks "now"), but replacing a
+  // user-authored State is flagged so the caller can announce the overwrite
+  // instead of it happening silently.
+  let overwroteUserState = false;
+  if (typeof state === "string" && state.trim()) {
+    if (origin !== "user" && provenanceOf(dir, "State") === "user") overwroteUserState = true;
+    pack.sections.State = state.trim();
+    applied.push("State");
+  }
   if (typeof journal === "string" && journal.trim()) {
     const entries = pack.sections.Journal.split("\n").filter((l) => l.trim());
     const line = journal.trim().replace(/\n+/g, " ");
@@ -409,6 +427,8 @@ function updatePack(dir, { description, tags, stance, procedure, state, journal,
   writePack(pack);
   if (applied.length) setProvenance(dir, applied, origin);
   pack.protectedStance = protectedStance;
+  pack.protectedProcedure = protectedProcedure;
+  pack.overwroteUserState = overwroteUserState;
   return pack;
 }
 

package/core/runner.js

@@ -1041,8 +1041,13 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
   // reflects what was read, not what was pushed. (consumeLastInjected is
   // drained here to keep the per-turn buffer from leaking into the next turn.)
   let turnRecallTier = "";
+  // Pack dirs surfaced (recall-matched) for this turn — joined with
+  // openedThisTurn at end-of-turn to tell the post-turn reviewer which packs
+  // this turn's work belongs to (attribution + safe State rewrites).
+  let surfacedPackDirs = [];
   try {
     const injected = require("./system-prompt").consumeLastInjected();
+    if (injected && Array.isArray(injected.packDirs)) surfacedPackDirs = injected.packDirs;
     if (injected && injected.recall) {
       const r = injected.recall;
       turnRecallTier = String(r.tier || "");
@@ -1537,6 +1542,14 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
         userText: prompt,
         assistantText,
         channelId,
+        // Packs this turn demonstrably worked with: surfaced by recall for the
+        // incoming message, or explicitly opened by the agent. The reviewer
+        // sees their full current sections and must attribute updates here —
+        // prevents cross-project misattribution and blind State rewrites.
+        activePacks: [...new Set([
+          ...surfacedPackDirs,
+          ...[...openedThisTurn].filter((n) => n.startsWith("pack:")).map((n) => n.slice(5)),
+        ])],
         signals: { tier: turnRecallTier, wrote: toolUses.some((t) => WRITE_TOOLS.has(t)) },
         announce: (text) => chatContext.run(store, () => send(text)),
       });

package/core/system-prompt.js

@@ -442,10 +442,10 @@ function tryUseRecallBudget(budget, text) {
 // What the last promptWithDynamicContext call freshly injected (not the
 // deduped repeats) — consumed by the runner to announce recalls in chat,
 // mirroring the write-side announcements.
-let lastInjected = { packs: [], entities: [], recall: null };
+let lastInjected = { packs: [], packDirs: [], entities: [], recall: null };
 function consumeLastInjected() {
   const out = lastInjected;
-  lastInjected = { packs: [], entities: [], recall: null };
+  lastInjected = { packs: [], packDirs: [], entities: [], recall: null };
   return out;
 }
 
@@ -743,7 +743,7 @@ function voiceReplyGuidance() {
 }
 
 async function promptWithDynamicContext(prompt, opts = {}) {
-  lastInjected = { packs: [], entities: [], recall: null };
+  lastInjected = { packs: [], packDirs: [], entities: [], recall: null };
   try {
     const { userText, contextText } = recallMatchParts(prompt);
     let historyText = "";
@@ -770,6 +770,10 @@ async function promptWithDynamicContext(prompt, opts = {}) {
     const toolBlock = result.toolBlock || "";
     const episodeBlock = result.episodeBlock || "";
     const why = result.why || {};
+    // Pack DIRS surfaced for this turn (matched, whether or not the body was
+    // freshly injected or deduped) — consumed by the post-turn reviewer so it
+    // knows which packs the turn's work belongs to and can see their content.
+    lastInjected.packDirs = (result.packMatches || []).map((m) => m.dir).filter(Boolean);
     lastInjected.recall = {
       engine: engine.name || recall.activeEngineName(settings),
       gated: !!result.gated,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.9.0",
+  "version": "2.9.1",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {