@massa-ai/codex-plugin 1.52.0 → 1.54.1

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "massa-ai",
-  "version": "1.52.0",
+  "version": "1.54.1",
   "description": "massa-ai — semantic code search, memory, and context compression for Codex",
   "author": {
     "name": "Luiz Massa",

package/install.sh

@@ -184,8 +184,28 @@ if (typeof cfg.hooks !== "object" || cfg.hooks === null) {
   cfg.hooks = {};
 }
 
+// Ownership test — marker first, command shape as the fallback. The marker is
+// precise but not the only way our entries reach this file: an entry written by
+// a release before the marker existed, or copied by hand from documentation,
+// carries none, and was invisible to BOTH directions here — never deduped on
+// install, never removed on uninstall. Claude's copy of this merge had exactly
+// that gap and it double-fired every lifecycle event (measured live
+// 2026-08-17). Referencing the massa-ai-hook binary is unambiguous; a user hook
+// that merely mentions massa-ai elsewhere does not match.
+//
+// isOwned covers both shapes this file has ever held: the flat pre-fix entry
+// (command at the top level) and the matcher group (commands inside hooks[]).
+const OWNED_COMMAND = /massa-ai-hook/;
+
+function commandIsOwned(h) {
+  return Boolean(h) && typeof h.command === "string" && OWNED_COMMAND.test(h.command);
+}
+
 function isOwned(e) {
-  return Boolean(e) && e._massaAiOwned === true;
+  if (!e || typeof e !== "object") return false;
+  if (e._massaAiOwned === true) return true;
+  if (commandIsOwned(e)) return true;
+  return Array.isArray(e.hooks) && e.hooks.length > 0 && e.hooks.every(commandIsOwned);
 }
 
 // A correctly-shaped owned entry is a matcher group: its "hooks" is an array.
@@ -202,10 +222,18 @@ if (mode === "uninstall") {
   // Remove owned entries from nested location + perform flat→nested migration
   const hooks = cfg.hooks;
 
-  // First, remove owned entries from the correct nested location
-  for (const [evt] of EVENTS) {
+  // Back up before removing: this now deletes unmarked entries it did not
+  // necessarily write, so the install path's backup discipline applies here too.
+  if (existed) {
+    fs.copyFileSync(file, `${file}.massa-ai.bak-${ts}`);
+  }
+
+  // Remove owned entries from the correct nested location. Every event, not
+  // just the ones this release writes — the predicate identifies our commands
+  // rather than a location.
+  for (const evt of Object.keys(hooks)) {
     if (Array.isArray(hooks[evt])) {
-      hooks[evt] = hooks[evt].filter((e) => !(e && e._massaAiOwned === true));
+      hooks[evt] = hooks[evt].filter((e) => !isOwned(e));
       if (hooks[evt].length === 0) delete hooks[evt];
     }
   }
@@ -307,7 +335,7 @@ install_bundled_skills() {
   fi
 
   local installed=0 name src dest
-  for name in massa-ai persona-router; do
+  for name in massa-ai persona-router profile; do
     src="$SCRIPT_DIR/skills/$name"
     [[ -d "$src" ]] || continue
     dest="$HARNESS_SKILLS_DIR/$name"
@@ -336,7 +364,7 @@ if (typeof data.platforms !== "object" || data.platforms === null || Array.isArr
 }
 data.version = 2;
 const prev = data.platforms[host];
-data.platforms[host] = { root, skillsOwner: "plugin", skills: ["massa-ai", "persona-router"] };
+data.platforms[host] = { root, skillsOwner: "plugin", skills: ["massa-ai", "persona-router", "profile"] };
 // The whole-record replace must not drop fields a previous successful install
 // wrote (R2) — re-attach them. modelProfile (T10, MPS-03 round-trip
 // obligation) is engine-owned; installRoute is installer-owned but written by
@@ -381,7 +409,7 @@ NODE
   )"
   [[ "$raw_owner" == "plugin" ]] && {
     local name
-    for name in massa-ai persona-router; do
+    for name in massa-ai persona-router profile; do
       rm -rf "$HARNESS_SKILLS_DIR/$name"
     done
     rmdir "$HARNESS_SKILLS_DIR" 2>/dev/null || true
@@ -687,6 +715,35 @@ for src in "$ACTIVE_AGENTS_SRC/"massa-ai-*.toml; do
 done
 vecho "  + ${specialist_count} subagent specialists (generated from skills/agents/*/SKILL.md)"
 
+# Shed retired specialists — IPT-02 site 3 (D1 copy-then-prune, D2/AC-02.1a).
+# The copy loop above writes the current set FIRST; only then do we remove
+# owned destination entries the bundle no longer ships. Never the reverse —
+# an interrupted run must never leave the user with fewer agents than before
+# (D1). The removal POPULATION is the destination directory ($AGENTS_DIR,
+# every *.toml, not just files matching the massa-ai- prefix — mirrors the
+# --uninstall loop's population above); the current bundle
+# ($ACTIVE_AGENTS_SRC) supplies only the keep-predicate. Never loop over the
+# bundle to decide removals (D2, AC-02.1a).
+#
+# Ownership test is per-host (D3/AC-02.2), taken verbatim from this file's own
+# --uninstall above: the first line must be exactly "# massa-ai-owned". This
+# is NOT a name-prefix test — $AGENTS_DIR is a directory shared with
+# user-authored agents, and a blind `rm -f massa-ai-*.toml` would delete a
+# user's own file that happens to share the name prefix but carries no marker
+# (AC-02.3, AC-02.5).
+pruned=0
+for f in "$AGENTS_DIR/"*.toml; do
+  [[ -f "$f" ]] || continue
+  head -n1 "$f" | grep -q "^# massa-ai-owned$" || continue   # ownership test (D3)
+  base="$(basename "$f")"
+  [[ -f "$ACTIVE_AGENTS_SRC/$base" ]] && continue             # keep-list: still shipped
+  rm -f "$f"
+  pruned=$((pruned + 1))
+done
+if [[ "$pruned" -gt 0 ]]; then
+  vecho "  - pruned ${pruned} retired massa-ai-owned agent TOML files from $AGENTS_DIR/"
+fi
+
 install_variant_tree
 
 # Skills bundling (PDO-08, 09): install massa-ai/persona-router into the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@massa-ai/codex-plugin",
-  "version": "1.52.0",
+  "version": "1.54.1",
   "description": "massa-ai plugin for Codex — semantic code search, memory, and context compression",
   "files": [
     "agents",

package/skills/massa-ai/SKILL.md

@@ -46,7 +46,7 @@ Before reading any massa-ai file:
   Never pass `workflowSessionId` in that field. Use `synapse_task_begin`/`synapse_task_end`
   for task envelopes and `synapse_prefetch` to warm the buffer on file open.
 - Prefer the shared v2 retrieval order; fall back gracefully if the massa-ai
-  server or Synapse is unavailable. The full tool surface includes 54 tools
+  server or Synapse is unavailable. The full tool surface includes 59 tools
   (see `references/mcp-tools.md`): indexing, search, symbol graph
   (`trace_path`, `impact_analysis`, `get_architecture`), memory CRUD
   (`remember`, `recall`, `memory_update`, `memory_delete`), checkpoints

package/skills/massa-ai/references/mcp-tools.md

@@ -1,4 +1,4 @@
-# massa-ai Tool Contracts (54 Tools)
+# massa-ai Tool Contracts (59 Tools)
 
 Load when exact MCP schemas, REST fallbacks, response modes, or
 polling rules are needed. Prefer the active tool declaration over copied
@@ -103,6 +103,8 @@ depends on exact content.
 | `handoff_accept` | Accept an open handoff (open→accepted) | Req: `id`. Opt: `projectId`. |
 | `handoff_cancel` | Cancel/expire an open handoff | Req: `id`. Opt: `projectId`. |
 | `handoff_list_pending` | List open handoffs, oldest-first | Req: `projectId`. Opt: `targetAgent`. |
+| `handoff_update` | Edit targetAgent/summary/openQuestions/nextSteps/files by id | Req: `id`. Opt: `projectId`, `targetAgent`, `summary`, `openQuestions`, `nextSteps`, `files` — at least one editable field required. Unknown/restricted fields (`status`, `acceptedAt`, etc.) are rejected by name. |
+| `handoff_delete` | Hard-delete a handoff, any status | Req: `id`. Opt: `projectId`. |
 
 ## MCP Capability Matrix — Auto-improvement (Proposals)
 
@@ -111,6 +113,9 @@ depends on exact content.
 | `list_proposals` | List pending auto-improvement proposals, newest-first | Req: `projectId`. |
 | `approve_proposal` | Approve a proposal; applies the memory edit | Req: `id`. Opt: `projectId`, `source`. |
 | `reject_proposal` | Reject a proposal (no edit applied) | Req: `id`. Opt: `projectId`, `reason`. |
+| `create_proposal` | Create a pending proposal by hand | Req: `projectId`, `kind` (`memory.create`\|`memory.update`\|`memory.tag`), `payload`. Opt: `rationale`, `targetMemoryId`. `payload` is validated against the same per-kind rules the store enforces on read. |
+| `update_proposal` | Edit rationale/payload by id, any status | Req: `id`. Opt: `projectId`, `rationale`, `payload` — at least one editable field required. `kind`/`targetMemoryId`/`status`/`decidedAt` are immutable. A `payload` edit re-validates against the row's existing `kind`. |
+| `delete_proposal` | Hard-delete a proposal, any status | Req: `id`. Opt: `projectId`. Deleting an approved proposal does not reverse its applied memory edit. |
 
 ## MCP Capability Matrix — Passive Capture