@memnexus-ai/mx-agent-cli 0.1.165 → 0.1.167

package/dist/agent-config/hooks/deploy-verification-reminder.sh

@@ -0,0 +1,179 @@
+#!/bin/bash
+# deploy-verification-reminder.sh — PostToolUse hook (Bash tool)
+# Enforces deploy verification after PR merges.
+#
+# Fires on: PostToolUse (Bash matcher)
+# Input: JSON on stdin with tool_name, tool_input, and tool_response
+# Output: reminder message to stdout when deploy pending and not verified
+# Exit: 2 when reminder is emitted, 0 otherwise
+
+# Fail-open: any error → exit 0 silently
+trap 'exit 0' ERR
+set -u
+
+# ── v2.30 leader-lock heartbeat (#3946) ──────────────────────────────────────
+# Refresh the leader lock's mtime from the child side so a dead-wrapper /
+# live-orphan-child is still evidenced by lock freshness. Piggybacks on this
+# already-firing PostToolUse(Bash) hook — one `touch`, guarded by lock existence,
+# fail-open. The authoritative duplicate-start check remains the both-PID probe
+# (see leader-lock.ts); this only strengthens the stale-lock warning.
+if [ -n "${CLAUDE_WORKTREE_PATH:-}" ] && [ -f "${CLAUDE_WORKTREE_PATH}/.mx-leader.lock" ]; then
+  touch "${CLAUDE_WORKTREE_PATH}/.mx-leader.lock" 2>/dev/null || true
+fi
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+WORKTREE_NAME="${CLAUDE_WORKTREE_NAME:-default}"
+# Sanitize: alphanumeric, hyphens, underscores only — prevent path traversal
+WORKTREE_NAME="${WORKTREE_NAME//[^a-zA-Z0-9_-]/}"
+WORKTREE_NAME="${WORKTREE_NAME:-default}"
+STATE_FILE="/tmp/.mx-deploy-pending-${WORKTREE_NAME}"
+LOCK_FILE="${STATE_FILE}.lock"
+# v2.11 telemetry sentinels — one-shot-per-cycle flood prevention.
+# Each path (merge, verify, reminder) fires telemetry at most once per merge-verify cycle.
+# Cleared on stale cleanup so a fresh cycle re-arms them.
+MERGE_SENT="${STATE_FILE}.merge-telemetry-sent"
+VERIFY_SENT="${STATE_FILE}.verify-telemetry-sent"
+REMIND_SENT="${STATE_FILE}.reminder-telemetry-sent"
+
+# v2.11 telemetry — sanitized team name for content field (no secrets; booleans only).
+TEAM_FOR_TELEMETRY="${CLAUDE_TEAM_NAME:-}"
+# v2.25 fallback: derive team name from worktree name by stripping -YYYYMMDD suffix.
+# Covers 5/8 consumer teams that lack CLAUDE_TEAM_NAME but have CLAUDE_WORKTREE_NAME.
+if [ -z "$TEAM_FOR_TELEMETRY" ] && [ -n "${CLAUDE_WORKTREE_NAME:-}" ]; then
+  TEAM_FOR_TELEMETRY=$(echo "$CLAUDE_WORKTREE_NAME" | sed 's/-[0-9]\{8\}$//')
+fi
+TEAM_FOR_TELEMETRY="${TEAM_FOR_TELEMETRY//[^a-zA-Z0-9-]/}"
+TEAM_FOR_TELEMETRY="$(echo "$TEAM_FOR_TELEMETRY" | tr '[:upper:]' '[:lower:]')"
+TEAM_FOR_TELEMETRY="${TEAM_FOR_TELEMETRY:-unknown}"
+
+# emit_telemetry <pr_merged> <deploy_verified> <warned>
+# Fail-open: any error here must never break the hook. Time-boxed to 5s.
+emit_telemetry() {
+  # Operator kill-switch: set MX_HOOK_TELEMETRY=0 to suppress all telemetry emission.
+  if [ "${MX_HOOK_TELEMETRY:-1}" = "0" ]; then return 0; fi
+  command -v mx >/dev/null 2>&1 || return 0
+  local pr_merged="$1" deploy_verified="$2" warned="$3"
+  local ts
+  ts=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo "")
+  timeout 5 mx memories create \
+    --content "hook-fired: deploy-verification-reminder team=${TEAM_FOR_TELEMETRY} pr_merged=${pr_merged} deploy_verified=${deploy_verified} warned=${warned} ts=${ts}" \
+    --topics "hook-telemetry,platform" \
+    --code-context '{"product":"memnexus","team":"platform","role":"hook-telemetry"}' \
+    >/dev/null 2>&1 || true
+}
+
+# ── 1. Detect verification signal (clears pending state) ─────────────────────
+# Anchored match: only clear on actual gh run list/view/watch commands, not substrings
+# in echo/comments/unrelated commands. Must be at command start or after && ; |.
+if printf '%s\n' "$COMMAND" | grep -qE '(^|[;&|]\s*)gh\s+run\s+(list|view|watch)\b'; then
+  # Gate to one-shot per cycle: emit only if verify sentinel doesn't exist yet.
+  if [ ! -f "$VERIFY_SENT" ]; then
+    emit_telemetry "false" "true" "false"
+    touch "$VERIFY_SENT" 2>/dev/null || true
+  fi
+  # Clear state and merge/reminder sentinels so the next merge re-arms them.
+  rm -f "$STATE_FILE" "$MERGE_SENT" "$REMIND_SENT" 2>/dev/null || true
+  exit 0
+fi
+
+# ── 2. Detect merge signal (sets pending state) ───────────────────────────────
+IS_MERGE=0
+if printf '%s\n' "$COMMAND" | grep -qE '(^|[;&|]\s*)gh\s+pr\s+merge\b'; then
+  IS_MERGE=1
+fi
+if printf '%s\n' "$COMMAND" | grep -qE '(^|[;&|]\s*)gh\s+pr\s+create\b' && printf '%s\n' "$COMMAND" | grep -qE '\s--merge\b'; then
+  IS_MERGE=1
+fi
+
+if [[ "$IS_MERGE" -eq 1 ]]; then
+  # Extract PR number if possible
+  PR_NUMBER=""
+  if [[ "$COMMAND" =~ gh[[:space:]]+pr[[:space:]]+merge[[:space:]]+([0-9]+) ]]; then
+    PR_NUMBER="${BASH_REMATCH[1]}"
+  fi
+  TIMESTAMP=$(date +%s)
+
+  if command -v flock >/dev/null 2>&1; then
+    exec 200>"$LOCK_FILE" 2>/dev/null
+    flock -x 200 2>/dev/null || true
+  fi
+
+  printf 'PR_NUMBER=%s\nTIMESTAMP=%s\n' "$PR_NUMBER" "$TIMESTAMP" > "$STATE_FILE" 2>/dev/null || true
+  # A new merge starts a new cycle — clear verify sentinel so the next verify re-arms.
+  rm -f "$VERIFY_SENT" 2>/dev/null || true
+  # Don't fire reminder on the merge call itself — agent hasn't had a chance to verify yet.
+  # Gate to one-shot per cycle: emit only if merge sentinel doesn't exist yet.
+  if [ ! -f "$MERGE_SENT" ]; then
+    emit_telemetry "true" "false" "false"
+    touch "$MERGE_SENT" 2>/dev/null || true
+  fi
+  exit 0
+fi
+
+# ── 3. Check if pending state exists and emit reminder ───────────────────────
+if [[ ! -f "$STATE_FILE" ]]; then
+  exit 0
+fi
+
+MTIME=$(stat -c %Y "$STATE_FILE" 2>/dev/null || stat -f %m "$STATE_FILE" 2>/dev/null || echo "0")
+NOW=$(date +%s)
+AGE=$((NOW - MTIME))
+
+# Stale cleanup: older than 30 minutes → delete and move on.
+# Also clear telemetry sentinels so the next merge-verify cycle re-arms them.
+if [[ "$AGE" -gt 1800 ]]; then
+  rm -f "$STATE_FILE" "$MERGE_SENT" "$VERIFY_SENT" "$REMIND_SENT" 2>/dev/null || true
+  exit 0
+fi
+
+# Read stored PR number for message
+STORED_PR=""
+if [[ -f "$STATE_FILE" ]]; then
+  STORED_PR=$(grep '^PR_NUMBER=' "$STATE_FILE" 2>/dev/null | cut -d= -f2 || true)
+fi
+PR_REF="${STORED_PR:-<PR>}"
+
+# Resolve the published CLI package name shown in the "confirm artifact live"
+# hint. Precedence: MX_CLI_PACKAGE env → cliPackage in mx-agent.config.json (jq)
+# → '@memnexus-ai/mx-agent-cli' fallback. For THIS repo none of the first two are
+# set, so the hint is byte-identical to the previous hardcoded string — zero
+# behaviour change. Only runs on the reminder path, never the hot Bash path.
+CLI_PACKAGE="${MX_CLI_PACKAGE:-}"
+if [ -z "$CLI_PACKAGE" ]; then
+  DVR_ROOT="${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || true)}"
+  DVR_CFG="${DVR_ROOT}/mx-agent.config.json"
+  if [ -n "$DVR_ROOT" ] && [ -f "$DVR_CFG" ] && command -v jq >/dev/null 2>&1; then
+    CLI_PACKAGE="$(jq -r '.cliPackage // empty' "$DVR_CFG" 2>/dev/null || true)"
+  fi
+fi
+# Sanitize: npm package names use only [A-Za-z0-9@/._-]. Strip everything else so
+# a less-trusted portable-project mx-agent.config.json cannot inject shell/escape
+# text into the agent-read reminder. An emptied value falls back to the default.
+CLI_PACKAGE="${CLI_PACKAGE//[^A-Za-z0-9@\/._-]/}"
+CLI_PACKAGE="${CLI_PACKAGE:-@memnexus-ai/mx-agent-cli}"
+
+# Route the reminder to stderr. This hook fires exit 2 on every Bash PostToolUse
+# while a merge is unverified (intended nag — see test 21). The harness surfaces
+# a non-zero hook's STDERR only; emitting on stdout made every post-merge Bash
+# call report "No stderr output" with no visible reason (block-report 2026-07-06,
+# KI-HOOKS-STDERR-SYSTEMIC). The exit-2-per-call contract is unchanged.
+{
+  echo ""
+  echo "⚠️  Deploy verification required: PR was merged but pipeline not verified."
+  echo "1. Get merge commit SHA: gh pr view ${PR_REF} --json mergeCommit --jq '.mergeCommit.oid'"
+  echo "2. Poll pipeline: gh run list --commit <sha> --json status,conclusion,name --jq '.[]'"
+  echo "3. Confirm artifact live: npm view ${CLI_PACKAGE} version"
+  echo "After verifying, retry your command."
+  echo ""
+} >&2
+# Flood prevention: the reminder path fires on every Bash PostToolUse until the
+# state is cleared (up to 30 min). Emit telemetry at most once per cycle via
+# the sentinel file. Subsequent reminder fires still emit the user-facing
+# message and exit 2 — only the telemetry side-effect is one-shot.
+if [ ! -f "$REMIND_SENT" ]; then
+  emit_telemetry "true" "false" "true"
+  touch "$REMIND_SENT" 2>/dev/null || true
+fi
+exit 2

package/dist/agent-config/hooks/git-mutation-guard.sh

@@ -0,0 +1,219 @@
+#!/bin/bash
+# git-mutation-guard — PreToolUse(Bash) guard against destructive git operations
+# that discard uncommitted work in a worktree shared with background agents.
+#
+# Contract: reads the tool-call JSON on stdin, extracts .tool_input.command.
+#   exit 0 = allow, exit 2 = block (non-zero exit blocks the Bash command).
+# Fails OPEN (exit 0) on any parse ambiguity so it never wedges legitimate work.
+#
+# OUTPUT ROUTING (KI-HOOKS-STDERR-SYSTEMIC): the harness surfaces a blocking
+# hook's STDERR, not its stdout. All refuse() output goes to stderr (>&2) so the
+# agent actually sees WHY a command was blocked. The allow paths stay silent.
+#
+# WHY (KI-SHARED-WORKTREE-GIT-MUTATION): impl agents and the leader share one
+# worktree. `git stash`, `git reset --hard`, `git checkout -- <path>`, and
+# `git restore` (worktree) silently delete another agent's uncommitted edits —
+# three real work-loss incidents on 2026-07-03. Commit at gate points; never
+# discard. This guard gates v3.84 Step 0.
+#
+# ESCAPE HATCH: prefix the command with `GIT_EXPERT=1` to run a genuinely-needed
+# destructive git op deliberately (e.g. GIT_EXPERT=1 git reset --hard <sha>).
+# The escape is intentional friction, not a lock.
+# LAYERING CAVEAT: GIT_EXPERT=1 only clears THIS hook's blocks (bare-SHA/branch
+# reset forms, stash, checkout-file, restore-worktree). It does NOT clear the two
+# patterns `git reset --hard HEAD~*` and `git reset --hard HEAD^*` — those are
+# hard-denied at the Claude Code permission layer (.claude/settings.json deny
+# list), which fires BEFORE this hook runs. If an override appears to "fail" on a
+# HEAD~/HEAD^ reset, debug the settings.json deny list, not this script.
+#
+# This guard ONLY inspects git mutation patterns; all non-git and read-only git
+# commands (status, log, diff, stash list, stash show, restore --staged) pass.
+#
+# SCOPE (SF-2, QA probe audit 2026-07-06 — this is a guardrail, not a security
+# boundary). INERT-CONSUMER HEREDOC BODIES ARE EXCLUDED FROM MATCHING: a git verb
+# inside a heredoc whose consuming command does NOT execute the body (e.g. a
+# status report written via `cat <<EOF ... git reset --hard ... EOF`, or a body
+# fed to tee / a redirect-to-file / a non-shell interpreter) is data, not a
+# command, so it is stripped before matching. This removes the reported false-
+# positive class that blocked report/heredoc writes (RT-3 / block-report
+# 2026-07-06). GUARANTEE (corrected after security re-review): the strip is
+# consumer-aware — a heredoc whose operator line names a SHELL interpreter
+# (bash/sh/zsh/dash/ksh/eval/source/`.`) or pipes the body into one (`| ...sh`)
+# is KEPT and still scanned, because those bodies ARE executed and a destructive
+# git verb in them is real (e.g. `bash <<EOF ... git reset --hard ... EOF`).
+# KNOWN FALSE-POSITIVE CLASS (accepted friction, fails safe, GIT_EXPERT=1 clears
+# it): a blocked git verb quoted on a command line — e.g. `echo "run git reset
+# --hard"`, or a `gh issue create --body "... git reset --hard && git stash drop
+# ..."` filing whose body mentions destructive git after a separator — still
+# matches and still blocks. Quoted content is scanned as-is: fixing this without
+# opening a bypass proved harder than the fix was worth. A quote-stripping pass
+# (item 4, #3934) was built and CUT after two adversarial security reviews found
+# fail-open regressions (executor-payload blanking; per-line sink scoping that
+# allowed `echo "hi" && ssh h 'git reset --hard'`); the redesign is tracked
+# separately. WORKAROUND for the issue/PR-body case: pass the prose via
+# `--body-file <path>` instead of an inline `--body "..."`. Known bypass classes
+# (out of scope, NOT defended): indirection via a script file, shell
+# variable/`eval` assembly, or an alias can run a blocked op without a literal
+# match. The guard deters accidental discards; it does not stop a determined
+# caller.
+
+set -euo pipefail
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // .command // empty' 2>/dev/null || true)
+
+# Can't parse — fail open.
+if [[ -z "$COMMAND" ]]; then
+  exit 0
+fi
+
+# Deliberate override.
+if echo "$COMMAND" | grep -qE '(^|[^A-Za-z_])GIT_EXPERT=1(\s|$)'; then
+  exit 0
+fi
+
+# --- heredoc-body stripping (consumer-aware) --------------------------------
+# Produce a "scannable" copy of the command. A heredoc body is dropped ONLY when
+# its consuming command is inert (cat/tee/redirect-to-file/non-shell language) —
+# such a body is data, never executed. When the operator line names a SHELL
+# interpreter (bash/sh/zsh/dash/ksh/eval/source/`.`) or pipes the body into one
+# (`| ...sh`), the body IS executed, so it is KEPT and still scanned (a
+# destructive git verb in it is a real command, not prose). The operator line
+# itself is always preserved (it may hold a real git verb before the `<<`).
+# Covers the common forms: `<<EOF`, `<<-EOF`, `<<"EOF"`, `<<'EOF'`, `<< EOF`.
+strip_heredocs() {
+  awk '
+    !inbody {
+      line = $0
+      if (match(line, /<<[-]?[[:space:]]*["'"'"']?[A-Za-z_][A-Za-z0-9_]*["'"'"']?/)) {
+        d = substr(line, RSTART, RLENGTH)
+        gsub(/<<[-]?[[:space:]]*["'"'"']?/, "", d)
+        gsub(/["'"'"'].*/, "", d)
+        delim = d
+        inbody = 1
+        # keepbody: does a SHELL execute this body? If so, still scan it.
+        keepbody = 0
+        if (line ~ /(^|[^[:alnum:]_])(bash|sh|zsh|dash|ksh|eval|source)([^[:alnum:]_]|$)/) keepbody = 1
+        if (line ~ /(^|[[:space:]])\.[[:space:]]/) keepbody = 1
+        if (line ~ /\|[^|]*(bash|sh|zsh|dash|ksh|eval)([^[:alnum:]_]|$)/) keepbody = 1
+      }
+      print line
+      next
+    }
+    {
+      t = $0
+      gsub(/^[[:space:]]+/, "", t)
+      if (t == delim) { inbody = 0; keepbody = 0; next }
+      if (keepbody) print $0
+      # else: inert-consumer body — data, not a command; drop it from the scan
+    }
+  '
+}
+
+SCAN=$(printf '%s' "$COMMAND" | strip_heredocs)
+
+refuse() {
+  local what="$1"
+  {
+    echo ""
+    echo "BLOCKED: destructive git operation ($what)"
+    echo "  Command: $COMMAND"
+    echo ""
+    echo "This discards uncommitted work in a worktree shared with background"
+    echo "agents (KI-SHARED-WORKTREE-GIT-MUTATION — three work-loss incidents"
+    echo "2026-07-03). Commit at gate points instead of discarding."
+    echo ""
+    echo "If you truly must run this, prefix it with GIT_EXPERT=1 to override,"
+    echo "e.g.  GIT_EXPERT=1 $what ..."
+    echo ""
+  } >&2
+  exit 2
+}
+
+# --- command-segment anchoring (M3, KI-HOOKS-PROSE-FALSE-POSITIVE) ----------
+# A `git` verb only counts as a real invocation when it STARTS a command
+# segment. Matching the bare substring `git reset --hard` anywhere in the
+# command blocked legitimate commit messages and prose, e.g.
+#   git commit -m "reverted the git reset --hard"
+#   echo "run git reset --hard to undo"
+# GITSEG requires `git` at a segment boundary — start-of-line (grep is
+# line-oriented, so embedded newlines are segment starts too), after a
+# separator (`;` `&` `|` `(` `{`), or after a shell keyword (then/do/else) —
+# optionally preceded by any run of: leading redirections (`>out `,
+# `2>/dev/null `), env-var assignments (`VAR=1 `), and known launcher/wrapper
+# words that exec their argv (sudo/env/nice/nohup/time/timeout/ionice/stdbuf/
+# command/xargs/setsid, with an optional numeric arg like `timeout 5`). Without
+# the wrapper/redirection tolerance, `nice git reset --hard`,
+# `2>/dev/null git reset --hard`, etc. slipped past the anchor (security
+# re-review, #3912).
+#
+# GIT GLOBAL OPTIONS between `git` and the verb are consumed (High, #3934). git
+# accepts global options before the subcommand — `-C <path>`, `-c <key>=<val>`,
+# `--git-dir[=| ]<p>`, `--work-tree[=| ]<p>`, `--namespace[=| ]<p>`,
+# `--no-pager`, and other single/double-dash forms with or without values. Only
+# consuming `-C` (the pre-#3934 behavior) let `git --no-pager reset --hard`,
+# `git -c safe.directory=* reset --hard`, `git --git-dir=... reset --hard`
+# bypass the guard entirely. The repeated GOPT group below consumes the whole
+# global-option run so the blocked verb is still anchored. `-C`/`-c`/the
+# enumerated value-taking long options consume their following value; a generic
+# `--long`/`--long=val`/`-x` handles the no-value forms (like --no-pager). This
+# mirrors the PUSH_RE global-option handling in ci-validate-hook.sh /
+# mx-guard-hook.sh. Applied per-segment to the heredoc- and quote-stripped SCAN.
+# GIT_EXPERT=1 clears any accepted false positive. `echo` is deliberately NOT a
+# wrapper word, so `echo "use timeout 5 git reset --hard"` stays allowed.
+GITSEG='(^|[;&|({]|\s(then|do|else)\s)\s*([0-9]*[<>][^[:space:]]*\s+|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*\s+|(sudo|env|nice|nohup|time|timeout|ionice|stdbuf|command|xargs|setsid)\s+([0-9]+\s+)?)*git(\s+(-C\s+[^[:space:];&|]+|-c\s+[^[:space:];&|]+|--(git-dir|work-tree|namespace|super-prefix)(=[^[:space:];&|]*|\s+[^[:space:];&|]+)|--[A-Za-z][A-Za-z0-9-]*=[^[:space:];&|]*|--[A-Za-z][A-Za-z0-9-]*|-[A-Za-z]))*\s+'
+
+# --- per-segment evaluation (item 3, #3934) ---------------------------------
+# Each allow-check (stash list|show; restore --staged-without-worktree) must be
+# scoped to the SAME command segment as the mutating verb it whitelists.
+# Whole-command allow-checks let a read-only first segment green-light a
+# destructive second one: `git stash list && git stash drop` or
+# `git restore --staged f && git restore f` slipped through because the
+# allow-form matched elsewhere on the line. Split SCAN on the shell separators
+# `;` `&` `|` and newlines (heredoc bodies were already emitted line-per-line by
+# strip_heredocs) and run the full verb logic on each segment independently.
+# `&&`/`||` collapse to empty segments (skipped). refuse() exits, so the first
+# offending segment blocks. NOTE: a separator inside a quoted string still
+# splits here (quoted content is scanned as-is — see the KNOWN FALSE-POSITIVE
+# CLASS note in the header); that fails safe (blocks), which is intentional.
+check_segment() {
+  local seg="$1"
+
+  # git stash (mutating forms). Allow read-only `stash list` / `stash show`;
+  # block bare stash, push, pop, apply, drop, clear, save, branch, create, store.
+  if printf '%s' "$seg" | grep -qE "${GITSEG}stash\b"; then
+    if ! printf '%s' "$seg" | grep -qE "${GITSEG}stash\s+(list|show)\b"; then
+      refuse "git stash"
+    fi
+  fi
+
+  # git reset --hard
+  if printf '%s' "$seg" | grep -qE "${GITSEG}reset\s+([^&|;]*\s)?--hard\b"; then
+    refuse "git reset --hard"
+  fi
+
+  # git checkout <ref?> -- <path> (pathspec form discards working changes).
+  # The trailing `(\s|$)` after `--` means `--help`/`--force`/branch switches do
+  # NOT match (only the bare `--` pathspec separator does).
+  if printf '%s' "$seg" | grep -qE "${GITSEG}checkout\s+([^&|;]*\s)?--(\s|$)"; then
+    refuse "git checkout -- <path>"
+  fi
+
+  # git restore (worktree). `git restore` defaults to --worktree (destructive).
+  # Safe ONLY when --staged is present AND --worktree is absent (a pure unstage).
+  # Block if --worktree is explicit, or if --staged is missing.
+  if printf '%s' "$seg" | grep -qE "${GITSEG}restore\b"; then
+    if printf '%s' "$seg" | grep -qE "${GITSEG}restore\b[^&|;]*--worktree\b"; then
+      refuse "git restore --worktree"
+    elif ! printf '%s' "$seg" | grep -qE "${GITSEG}restore\b[^&|;]*--staged\b"; then
+      refuse "git restore <path> (defaults to --worktree)"
+    fi
+  fi
+}
+
+while IFS= read -r _seg; do
+  [[ -n "$_seg" ]] || continue
+  check_segment "$_seg"
+done < <(printf '%s\n' "$SCAN" | tr ';&|' '\n')
+
+exit 0

package/dist/agent-config/hooks/iteration-log-check.sh

@@ -0,0 +1,212 @@
+#!/bin/bash
+# iteration-log-check.sh — Stop hook
+# Warns when a session merged a PR but did not update its team's iteration log.
+#
+# Phase 1 behaviour: WARNING ONLY. Always exits 0 — never blocks session stop.
+#
+# Fires on: Stop
+# Input: JSON on stdin with transcript_path, session_id, stop_hook_active
+# Output: warning line to stderr when stale iteration log is detected
+# Exit: always 0 (fail-open, warning-only per Phase 1 scope)
+#
+# Precedent: mirrors the structure of deploy-verification-reminder.sh (v1.76,
+# commit bf10cac87). Detects PR-merge activity via the transcript (same
+# mechanism used by auto-capture-session-end.sh), reads the iteration log via
+# the mx CLI, and compares timestamps.
+
+# Fail-open: any unexpected error → exit 0 silently
+trap 'exit 0' ERR
+set -u
+
+INPUT=$(cat)
+
+# ── 1. Parse hook input ──────────────────────────────────────────────────────
+TRANSCRIPT_PATH=$(echo "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+STOP_HOOK_ACTIVE=$(echo "$INPUT" | jq -r '.stop_hook_active // false' 2>/dev/null)
+
+# Allow tests to inject a team name directly; otherwise use CLAUDE_TEAM_NAME
+TEAM_NAME="${CLAUDE_TEAM_NAME:-}"
+# v2.25 fallback: derive team name from worktree name by stripping -YYYYMMDD suffix.
+# Covers 5/8 consumer teams that lack CLAUDE_TEAM_NAME but have CLAUDE_WORKTREE_NAME.
+if [ -z "$TEAM_NAME" ] && [ -n "${CLAUDE_WORKTREE_NAME:-}" ]; then
+  TEAM_NAME=$(echo "$CLAUDE_WORKTREE_NAME" | sed 's/-[0-9]\{8\}$//')
+fi
+
+# Skip if already in a hook loop (prevents recursion on stop events)
+if [[ "$STOP_HOOK_ACTIVE" == "true" ]]; then
+  exit 0
+fi
+
+# Skip silently if we have no transcript to analyse
+if [[ -z "$TRANSCRIPT_PATH" || ! -f "$TRANSCRIPT_PATH" ]]; then
+  exit 0
+fi
+
+# Skip silently if jq is absent — can't parse transcript without it
+command -v jq >/dev/null 2>&1 || exit 0
+
+# Sanitize team name early; empty → "unknown" (used only for telemetry labelling).
+# Note: we intentionally do NOT short-circuit when TEAM_NAME is empty here.
+# Per v2.11 Part 2 finding, CLAUDE_TEAM_NAME is not propagated to consumer Claude
+# processes, so nearly all real invocations arrive with it unset. Exiting early
+# on the unset path would make the hook emit zero telemetry from consumer
+# sessions — defeating v2.11's purpose. Instead, we always emit telemetry on the
+# PR-merge path and use team=unknown to distinguish that signal.
+SAFE_TEAM="${TEAM_NAME//[^a-zA-Z0-9-]/}"
+SAFE_TEAM="$(echo "$SAFE_TEAM" | tr '[:upper:]' '[:lower:]')"
+SAFE_TEAM="${SAFE_TEAM:-unknown}"
+
+# emit_telemetry <pr_merged> <log_stale> <warned>
+# Fail-open: any error here must never break the hook. Time-boxed to 5s.
+# Gracefully returns when mx CLI isn't on PATH (e.g. ad-hoc test environments).
+emit_telemetry() {
+  # Operator kill-switch: set MX_HOOK_TELEMETRY=0 to suppress all telemetry emission.
+  if [ "${MX_HOOK_TELEMETRY:-1}" = "0" ]; then return 0; fi
+  command -v mx >/dev/null 2>&1 || return 0
+  local pr_merged="$1" log_stale="$2" warned="$3"
+  local ts
+  ts=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo "")
+  # Telemetry codeContext.product uses the resolved product slug so external
+  # projects tag their own product; for THIS repo it resolves to 'memnexus', so
+  # platform's product=memnexus telemetry queries are unchanged. The `:-memnexus`
+  # default keeps this safe under `set -u` even if resolution were skipped.
+  timeout 5 mx memories create \
+    --content "hook-fired: iteration-log-check team=${SAFE_TEAM} pr_merged=${pr_merged} log_stale=${log_stale} warned=${warned} ts=${ts}" \
+    --topics "hook-telemetry,platform" \
+    --code-context "{\"product\":\"${PRODUCT_SLUG:-memnexus}\",\"team\":\"platform\",\"role\":\"hook-telemetry\"}" \
+    >/dev/null 2>&1 || true
+}
+
+# ── 2. Detect PR merge in this session via the transcript ────────────────────
+# Scan tool_use Bash commands for `gh pr merge` (anchored) or `gh pr create --merge`.
+MERGE_DETECTED=$(jq -r '
+  select(.type == "assistant") |
+  .message.content[]? |
+  select(.type == "tool_use" and .name == "Bash") |
+  .input.command // empty
+' "$TRANSCRIPT_PATH" 2>/dev/null |
+  grep -cE '(^|[;&|]\s*)gh\s+pr\s+(merge\b|create\b.*--merge\b)' || true)
+
+if [[ "${MERGE_DETECTED:-0}" -lt 1 ]]; then
+  # No PR merged this session → nothing to enforce and no telemetry.
+  # Keeps the "no merge" noise bounded; we only care about post-merge state.
+  exit 0
+fi
+
+# ── Resolve product slug (used by BOTH telemetry codeContext and LOG_NAME) ────
+# Named memories are keyed <product-slug>-<team>-<type> and telemetry is tagged
+# with the same product. Resolution precedence (first non-empty wins):
+#   1. MX_PRODUCT_SLUG env var (explicit override / test injection)
+#   2. projectSlug from mx-agent.config.json at the repo root (jq)
+#   3. 'memnexus' fallback default
+# For THIS monorepo neither (1) nor (2) is set, so this resolves to 'memnexus' —
+# LOG_NAME and telemetry product are byte-identical to the previous literals
+# (zero behaviour change). Resolved here, before the first emit_telemetry call,
+# so the unknown-team and mx-missing telemetry paths also carry the slug. jq is
+# guaranteed present (checked above). Sanitized to [a-z0-9-] so it cannot inject
+# into the key, the JSON codeContext, or a downstream shell.
+resolve_product_slug() {
+  local slug="${MX_PRODUCT_SLUG:-}"
+  if [ -z "$slug" ]; then
+    local root cfg
+    root="${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || true)}"
+    cfg="${root}/mx-agent.config.json"
+    if [ -n "$root" ] && [ -f "$cfg" ]; then
+      slug="$(jq -r '.projectSlug // empty' "$cfg" 2>/dev/null || true)"
+    fi
+  fi
+  slug="${slug//[^a-zA-Z0-9-]/}"
+  slug="$(echo "$slug" | tr '[:upper:]' '[:lower:]')"
+  echo "${slug:-memnexus}"
+}
+PRODUCT_SLUG="$(resolve_product_slug)"
+
+# ── 2a. At this point: a PR merged this session. Telemetry always fires. ─────
+# If the team is unknown (consumer session with CLAUDE_TEAM_NAME unset) or mx
+# is missing, we still report the PR-merge signal so platform can see it.
+if [[ "$SAFE_TEAM" == "unknown" ]]; then
+  # No team → no iteration log to check. Fire PR-merge telemetry and exit.
+  # log_stale=unknown (we never fetched a log), warned=false (nothing emitted).
+  emit_telemetry "true" "unknown" "false"
+  exit 0
+fi
+
+# mx required for the log-freshness check below. If absent, still emit
+# telemetry for the PR-merge signal itself (no-op if mx isn't on PATH).
+if ! command -v mx >/dev/null 2>&1; then
+  emit_telemetry "true" "unknown" "false"
+  exit 0
+fi
+
+# Product slug resolved above (before the first telemetry emission).
+LOG_NAME="${PRODUCT_SLUG}-${SAFE_TEAM}-iteration-log"
+
+# ── 3. Determine session start time ──────────────────────────────────────────
+# Earliest ISO timestamp in the transcript; fall back to file mtime if absent.
+SESSION_START=$(jq -r 'select(.timestamp) | .timestamp' "$TRANSCRIPT_PATH" 2>/dev/null |
+  sort | head -1)
+
+if [[ -z "$SESSION_START" ]]; then
+  # Fallback: transcript file creation time
+  if SESSION_START=$(date -u -r "$TRANSCRIPT_PATH" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null); then
+    :
+  else
+    emit_telemetry "true" "unknown" "false"
+    exit 0
+  fi
+fi
+
+SESSION_START_EPOCH=$(date -u -d "$SESSION_START" +%s 2>/dev/null || echo "")
+if [[ -z "$SESSION_START_EPOCH" ]]; then
+  emit_telemetry "true" "unknown" "false"
+  exit 0
+fi
+
+# ── 4. Fetch iteration-log memory and read updatedAt ─────────────────────────
+# Time-box the mx call so a slow API never stalls the Stop hook.
+LOG_JSON=$(timeout 5 mx memories get --name "$LOG_NAME" --format json 2>/dev/null || true)
+
+if [[ -z "$LOG_JSON" ]]; then
+  # Memory missing or fetch failed — one-line note, never block
+  echo "iteration-log-check: could not fetch ${LOG_NAME} (skipping check)" >&2
+  emit_telemetry "true" "unknown" "false"
+  exit 0
+fi
+
+UPDATED_AT=$(echo "$LOG_JSON" | jq -r '.updatedAt // empty' 2>/dev/null)
+if [[ -z "$UPDATED_AT" ]]; then
+  echo "iteration-log-check: ${LOG_NAME} has no updatedAt field (skipping check)" >&2
+  emit_telemetry "true" "unknown" "false"
+  exit 0
+fi
+
+UPDATED_EPOCH=$(date -u -d "$UPDATED_AT" +%s 2>/dev/null || echo "")
+if [[ -z "$UPDATED_EPOCH" ]]; then
+  emit_telemetry "true" "unknown" "false"
+  exit 0
+fi
+
+# ── 5. Compare — warn if log was not updated after session start ─────────────
+WARNED="false"
+LOG_STALE="false"
+if [[ "$UPDATED_EPOCH" -lt "$SESSION_START_EPOCH" ]]; then
+  LOG_STALE="true"
+  WARNED="true"
+  {
+    echo ""
+    echo "⚠️  Iteration log ${LOG_NAME} was not updated this session."
+    echo "   Session started: ${SESSION_START}"
+    echo "   Log last updated: ${UPDATED_AT}"
+    echo "   A PR was merged but the iteration log is stale."
+    echo "   Run /mx-iteration-close before ending this session."
+    echo ""
+  } >&2
+fi
+
+# ── 6. Emit telemetry (fail-open, best-effort) ───────────────────────────────
+# One memory per invocation — no --name. Platform team queries topic
+# "hook-telemetry" to count hook firings (warned + silent-fire).
+# Strictly additive: any failure here must never break the hook.
+emit_telemetry "true" "$LOG_STALE" "$WARNED"
+
+exit 0