@pcircle/memesh 4.10.1 → 4.10.2

package/scripts/hooks/session-start.js

@@ -7,6 +7,7 @@ import { pathToFileURL } from 'url';
 import { existsSync, readFileSync, unlinkSync, mkdirSync, accessSync, constants as fsConstants } from 'fs';
 import {
   buildReferenceContext,
+  hasBriefingContent,
   ensurePrivateDir,
   getDbPath,
   getMemeshDirFromDbPath,
@@ -50,7 +51,15 @@ import {
   repoStateLines,
   resolvePluginRoot,
   resolveSessionLimit,
-  taskStateLines,
+  briefingTaskStateLines,
+  resolveBriefingLevel,
+  resolveMessageRecipient,
+  waitingMessageLines,
+  briefingLevelPolicy,
+  sessionStartAppendsWorkPackageNotice,
+  WORK_PACKAGE_NOTICE,
+  readHookConfigResult,
+  HOOK_CONFIG_UNREADABLE_REASON,
   homeDir,
   taskStateName,
   writeCitationRule,
@@ -58,7 +67,6 @@ import {
   writePrivateJson,
 } from './_shared.js';
 import { MemeshDatabase } from './_generated/sqlite.js';
-import { unreadDeliveryCount, unreadInboxLines } from './_generated/agent-message-inbox.js';
 import {
   buildBriefingIndex,
   INDEX_CANDIDATE_CAP,
@@ -68,13 +76,12 @@ import {
 
 const require = createRequire(import.meta.url);
 
-// Codex round 37: dist/core/install-channel.js is emitted as ESM
-// (the project's tsconfig produces NodeNext modules). On Node 20.x
-// `require()` against an ESM file throws ERR_REQUIRE_ESM, which
-// silently downgraded all install-channel detection to 'unknown' on
-// the supported floor. Pre-load the module via dynamic `import()`
-// at hook startup using a top-level await — once at process init,
-// not on every call. Falls back to null if the dist file is
+// dist/core/install-channel.js is emitted as ESM (the project's tsconfig
+// produces NodeNext modules). On Node 20.x `require()` against an ESM file
+// throws ERR_REQUIRE_ESM, which would silently downgrade all install-channel
+// detection to 'unknown' on the supported floor. So the module is pre-loaded
+// via dynamic `import()` at hook startup using a top-level await — once at
+// process init, not on every call. Falls back to null if the dist file is
 // missing (source checkout pre-build) or fails to load.
 let _installChannelMod = null;
 try {
@@ -124,32 +131,26 @@ function buildDeprecationBanner(currentVersion, cache) {
     `⚠️  MeMesh ${currentVersion} is DEPRECATED by maintainers.`,
     `    ${msg}`,
   ];
-  // Codex round 36: emit a remediation line for EVERY deprecation
-  // banner — including the cases where the cached `latestVersion`
-  // is null, equal to current, or stale. The previous gate omitted
-  // the action line whenever the cache didn't yet show a strictly-
-  // newer version, leaving users with a security warning and no
-  // follow-up step. doctor / CLI status / dashboard already point
-  // at `memesh update` (or channel equivalents) in those uncertain
-  // cases, and the session-start banner should match — `npm`
-  // resolves @latest at install time, so the command works even
-  // when our local cache is uncertain.
+  // A remediation line is emitted for EVERY deprecation banner — including
+  // when the cached `latestVersion` is null, equal to current, or stale — so
+  // a security warning always carries a follow-up step. doctor / CLI status /
+  // dashboard point at `memesh update` (or channel equivalents) in those
+  // uncertain cases too, and the session-start banner matches: `npm`
+  // resolves @latest at install time, so the command works even when our
+  // local cache is uncertain.
   const knownUpgradeTarget = Boolean(
     cache.latestVersion && cache.latestVersion !== currentVersion,
   );
-  // Codex round 39: the SessionStart hook reads ONLY cached cache
-  // data — there's no fresh lookup happening on this code path.
-  // That means `freshness === 'fresh'` (the strict rule the
-  // dashboard / `memesh status` use to authoritatively say
-  // "no upgrade target yet") can never apply here. Round 38 used a
-  // 24h-window heuristic to fire the no-target message anyway, but
-  // codex correctly flagged that as suppressing the upgrade hint
-  // exactly when a security-advisory fix could ship within the
-  // window. Conservative remediation: always recommend
-  // `memesh update` (which is a harmless no-op when there's truly
-  // no target, and immediately applies a freshly-published fix
-  // when there is one). The "no target yet" message remains
-  // available in `memesh status` (fresh lookup) and the dashboard
+  // The SessionStart hook reads ONLY cached update data — no fresh lookup
+  // happens on this code path. That means `freshness === 'fresh'` (the strict
+  // rule the dashboard / `memesh status` use to authoritatively say "no
+  // upgrade target yet") can never apply here. A 24h-window heuristic that
+  // fired the no-target message anyway would suppress the upgrade hint
+  // exactly when a security-advisory fix could ship within the window, so
+  // the remediation is conservative: always recommend `memesh update` (a
+  // harmless no-op when there's truly no target, and it immediately applies
+  // a freshly-published fix when there is one). The "no target yet" message
+  // remains available in `memesh status` (fresh lookup) and the dashboard
   // (after a Check now click).
   // Tailor the remediation hint to the install channel. `memesh
   // update` and `autoUpdate` only work for npm-global installs;
@@ -177,9 +178,8 @@ function buildDeprecationBanner(currentVersion, cache) {
   } else if (channel === 'source-checkout') {
     lines.push(`    Source checkout: pull and rebuild (\`git pull && npm install && npm run build\`).`);
   } else if (channel === 'npm-local') {
-    // Codex round 30: the cached `latestVersion` may itself be
-    // stale (cache TTL is 24h and we're already showing a stale
-    // banner). Pinning a specific version risks installing an
+    // The cached `latestVersion` may itself be stale (cache TTL is 24h
+    // and we're already showing a stale banner). Pinning a specific version risks installing an
     // already-superseded build that's part of the same security
     // advisory. `@latest` always resolves to the registry's
     // current dist-tag at install time, which is the right
@@ -497,14 +497,13 @@ function spawnFreshUpdateCheck(installedVersion) {
     // the banner marker above: marker and cache must share a directory.
     const dir = memeshHomeDir();
     try { ensurePrivateDir(dir); } catch { /* best-effort */ }
-    // Codex round 37: scope the throttle marker to the installed
-    // version. The marker was machine-global, so a refresh started
-    // by a global 4.1.3 install would suppress refreshes for a
-    // sibling project-local 4.1.1 for the next 5 minutes — and the
-    // shared cache it wrote would carry version 4.1.3, so the
-    // 4.1.1 session would skip its banner because
-    // `cache.currentVersion !== currentVersion`. Per-version
-    // markers ensure each install gets its own refresh window.
+    // The throttle marker is scoped to the installed version. A
+    // machine-global marker would let a refresh started by a global 4.1.3
+    // install suppress refreshes for a sibling project-local 4.1.1 for the
+    // next 5 minutes — and the shared cache it wrote would carry version
+    // 4.1.3, so the 4.1.1 session would skip its banner because
+    // `cache.currentVersion !== currentVersion`. Per-version markers give
+    // each install its own refresh window.
     // Sanitize version for filesystem (semver chars only, no path
     // separators); fall back to 'unknown' if missing.
     const versionTag = typeof installedVersion === 'string'
@@ -512,13 +511,12 @@ function spawnFreshUpdateCheck(installedVersion) {
       ? installedVersion
       : 'unknown';
     const markerPath = join(dir, `last-fresh-refresh.${versionTag}.lock`);
-    // Single-owner claim: O_EXCL atomic create. Codex round 27
-    // caught that the previous temp+rename+readback pattern was
-    // racy — both peers' renames are destructive, so each could
-    // read its own token back and both would spawn a refresh.
-    // O_EXCL is the standard POSIX/libuv primitive that lets at
-    // most one process succeed. The updater runner uses the same O_EXCL
-    // ownership primitive for its separate update lock.
+    // Single-owner claim: O_EXCL atomic create. A temp+rename+readback
+    // pattern is racy — both peers' renames are destructive, so each could
+    // read its own token back and both would spawn a refresh. O_EXCL is the
+    // standard POSIX/libuv primitive that lets at most one process succeed.
+    // The updater runner uses the same O_EXCL ownership primitive for its
+    // separate update lock.
     const token = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
     const claim = () => {
       try {
@@ -799,6 +797,18 @@ function combineWithBanner(baseMessage, { skipUpdateBanner = false } = {}) {
   return [...lines.filter((l) => l.length > 0), '', baseMessage].join('\n');
 }
 
+// #360: the ONE reason string for "this session's memory injection resolved
+// to nothing" — every exit path that ends up with a falsy `memoryContext`
+// passes this through `output()`'s `recorded` argument, so a genuinely silent
+// session (`minimal` on an empty project, the no-database and
+// no-entities-table early exits) always leaves a trace of WHY nothing was
+// injected, instead of the generic `session-start-banner` outcome marker that
+// carries no `reason`. One helper, not three copies of the template string,
+// so the wording cannot drift between call sites.
+function nothingToInjectReason(level, detail) {
+  return `briefing-level: nothing to inject at "${level}" — ${detail}`;
+}
+
 let input = '';
 process.stdin.setEncoding('utf8');
 process.stdin.on('data', (chunk) => { input += chunk; });
@@ -809,13 +819,70 @@ process.stdin.on('end', async () => {
   let captureWarning = null;
   const withCaptureWarning = (msg) => {
     if (!captureWarning) return msg;
-    return `${captureWarning}\n${msg.replace(/^◉ MeMesh ready · /, '◉ MeMesh · ')}`;
+    // The populated-database path prepends an update banner ahead of the
+    // "◉ MeMesh ready · ..." summary line (`finalMessage = [...bannerLines,
+    // '', summary].join('\n')`), so that line is not at the START of `msg`
+    // whenever a banner is present — an un-flagged `^` only anchors to the
+    // whole string's start, so the demotion below would silently do nothing
+    // and "MeMesh ready" would leak through even while a write failure was
+    // being reported in the very same message. `m` anchors `^` to the start
+    // of ANY line instead.
+    return `${captureWarning}\n${msg.replace(/^◉ MeMesh ready · /m, '◉ MeMesh · ')}`;
   };
   try {
     try {
     const data = JSON.parse(input);
     const projectName = getProjectName(data.cwd);
 
+    // #360 — resolve the briefing level ONCE, before any exit path, so every
+    // emit below (including the no-database and empty-database early
+    // returns) agrees on what to include. env > config > default; an
+    // unknown value on either source is not a silent fallback — it is
+    // traced AND recorded on the hook's outcome channel, the same
+    // discipline every other silent-skip path in this file follows.
+    const configRead = readHookConfigResult(process.env);
+    const briefingResolution = resolveBriefingLevel(process.env, configRead.config);
+    const briefingLevel = briefingResolution.level;
+    const briefingPolicy = briefingLevelPolicy(briefingLevel);
+    if (briefingResolution.invalid) {
+      const { source, value } = briefingResolution.invalid;
+      try {
+        process.stderr.write(
+          `[memesh session-start] invalid ${source} briefing level ${value} — using "${briefingLevel}"\n`,
+        );
+      } catch { /* stderr gone */ }
+      recordHookOutcome(process.env, {
+        hook: 'session-start',
+        outcome: 'notified',
+        reason: `briefing-level: invalid ${source} value ${value}, using ${briefingLevel}`,
+      });
+    }
+    // The check above only catches an unusable VALUE for one known key
+    // (`briefing`) inside an otherwise-parseable config object. A config.json
+    // that is not even that — truncated JSON, a bare array/string/number/null
+    // at the top level — is swallowed by `readHookConfig()` into an empty
+    // `{}`, so every setting in it (not just `briefing`) reads as "not set"
+    // with no trace anywhere, while the CLI/MCP side (`core/config.ts`'s
+    // `warnUnreadable()`) reports this exact state. `readHookConfigResult()`'s
+    // `state` is what makes it visible here too — recorded once, regardless
+    // of which settings would have been affected, since the whole document
+    // was unusable, not one field.
+    if (configRead.state === 'unreadable') {
+      recordHookOutcome(process.env, {
+        hook: 'session-start',
+        outcome: 'notified',
+        reason: HOOK_CONFIG_UNREADABLE_REASON,
+      });
+    }
+    // The work-package notice is identical boilerplate every session (#360)
+    // — only `full` still carries it. `undefined`, not a conditional string
+    // literal at each call site: output()'s memoryContext parameter treats
+    // undefined as "nothing to add" the same way it always has.
+    // Read through the named predicate, not `.workPackageNotice` off the
+    // policy object directly — this file is the ONLY caller that should ever
+    // decide this (see the field comment in briefing-level.ts).
+    const workPackageNotice = sessionStartAppendsWorkPackageNotice(briefingLevel) ? WORK_PACKAGE_NOTICE : undefined;
+
     // Self-heal the citation contract.
     //
     // `install-hooks` writes it too, but a PLUGIN install never runs that
@@ -911,8 +978,22 @@ process.stdin.on('end', async () => {
         captureWarning ?? '◉ MeMesh ready · no database yet, memories will be created as you work',
         { skipUpdateBanner: alreadyNoticed },
       );
-      output(consent ? `${consent.system}\n${emptySummary}` : emptySummary,
-        consent ? `${consent.context}\n\n${workPackageGuidance}` : workPackageGuidance);
+      const noDbContext = consent
+        ? [consent.context, workPackageNotice].filter(Boolean).join('\n\n')
+        : workPackageNotice;
+      output(
+        consent ? `${consent.system}\n${emptySummary}` : emptySummary,
+        noDbContext,
+        // Nothing was injected (no notice at this level, no database to read
+        // from) — record why, the same as the schema-present empty path
+        // further down. `standard`/`full` reach this exact same branch: at
+        // `full` `noDbContext` is always truthy (the notice), so this never
+        // overrides anything for that level; at `standard` it can also be
+        // falsy here, which correctly gets the same reason (the record is
+        // level-agnostic, matching the schema-present path's own
+        // `!memoryContext` predicate, not a `minimal`-only check).
+        !noDbContext ? { outcome: 'notified', reason: nothingToInjectReason(briefingLevel, 'no database yet') } : null,
+      );
       if (consent) finalizeUpdatePromptClaim(data.session_id, consentVersion, consentCache?.latestVersion);
       return;
     }
@@ -939,7 +1020,14 @@ process.stdin.on('end', async () => {
         "SELECT name FROM sqlite_master WHERE type='table' AND name='entities'"
       ).get();
       if (!tableCheck) {
-        output(combineWithBanner(captureWarning ?? '◉ MeMesh ready · database initialised but no memories stored yet'));
+        output(
+          combineWithBanner(captureWarning ?? '◉ MeMesh ready · database initialised but no memories stored yet'),
+          workPackageNotice,
+          // Same reason mechanism as the no-database exit above and the
+          // schema-present exit below — see `nothingToInjectReason`'s own
+          // comment for why this is not `minimal`-gated explicitly.
+          !workPackageNotice ? { outcome: 'notified', reason: nothingToInjectReason(briefingLevel, 'database has no entities table yet') } : null,
+        );
         return;
       }
 
@@ -1074,8 +1162,11 @@ process.stdin.on('end', async () => {
       // gives them a separate render budget. The project keeps `sessionLimit`
       // slots and its full character budget. The column is absent on
       // pre-namespace schemas; then this branch is simply empty.
+      // #360: minimal/standard skip these two queries outright rather than
+      // fetch-then-not-render — the whole point of the level is to stop
+      // paying for what is not the current project.
       let globalEntities = [];
-      if (colNames.has('namespace')) {
+      if (briefingPolicy.global && colNames.has('namespace')) {
         const globalQuery = buildScoringQuery('', `WHERE e.namespace = 'global' ${statusFilter}`);
         globalEntities = db.prepare(globalQuery).all(CANDIDATE_CAP)
           .filter(entity => isTrustedForAutoContext(entity.metadata))
@@ -1086,15 +1177,18 @@ process.stdin.on('end', async () => {
       // recentStatusFilter is "WHERE status = 'active'" or "" — the bare-column
       // form is fine when there's no JOIN, but we now alias the table as `e`,
       // so rewrite to e.status for consistency.
-      const recentConditions = [
-        hasStatus ? "e.status = 'active'" : '',
-        colNames.has('namespace') ? "(e.namespace IS NULL OR e.namespace <> 'global')" : '',
-      ].filter(Boolean);
-      const recentWhere = recentConditions.length > 0 ? `WHERE ${recentConditions.join(' AND ')}` : '';
-      const recentQuery = buildScoringQuery('', recentWhere);
-      const recentEntities = db.prepare(recentQuery).all(CANDIDATE_CAP)
-        .filter(entity => isTrustedForAutoContext(entity.metadata))
-        .slice(0, 5);
+      let recentEntities = [];
+      if (briefingPolicy.foreign) {
+        const recentConditions = [
+          hasStatus ? "e.status = 'active'" : '',
+          colNames.has('namespace') ? "(e.namespace IS NULL OR e.namespace <> 'global')" : '',
+        ].filter(Boolean);
+        const recentWhere = recentConditions.length > 0 ? `WHERE ${recentConditions.join(' AND ')}` : '';
+        const recentQuery = buildScoringQuery('', recentWhere);
+        recentEntities = db.prepare(recentQuery).all(CANDIDATE_CAP)
+          .filter(entity => isTrustedForAutoContext(entity.metadata))
+          .slice(0, 5);
+      }
 
       // Lesson count (queried for summary, not listed individually).
       // Status-column gate matches the project/recent queries above —
@@ -1174,6 +1268,7 @@ process.stdin.on('end', async () => {
       const topLessons = lessonEntities.slice(0, 5);
 
       const memoryLines = [];
+      let memoryAssemblyFailed = false;
       try {
         const rankedIds = [
           ...topLessons.map(e => e.id),
@@ -1219,14 +1314,31 @@ process.stdin.on('end', async () => {
         const taskRow = db
           .prepare('SELECT metadata FROM entities WHERE name = ?')
           .get(taskStateName(projectName));
-        // SessionStart has no exact recipient identity. The shared leaf fails
-        // closed before querying, so hook and briefing cannot diverge here.
+        // Who this session is comes from `MEMESH_RECIPIENT` (see
+        // resolveMessageRecipient). Without it there is no exact recipient
+        // and the shared leaf returns no lines, so a session never sees a
+        // message addressed to anyone else.
+        // #360: briefingTaskStateLines downgrades a stale record to one line
+        // at EVERY level, and only consults `briefingPolicy.taskState` for a
+        // fresh one — `minimal` omits a fresh state entirely, never a stale
+        // flag. The unread-inbox line below is unconditional at every level:
+        // a message waiting for this agent is not "another project's
+        // memory", it is addressed to it. An inbox that cannot be read is
+        // recorded as its own `error` (a label, like the two below), and is
+        // not a failed memory assembly: the rest of the context still ships.
         const stateLines = [
-          ...taskStateLines(
+          ...briefingTaskStateLines(
             parseTaskState(parseEntityMetadata(taskRow?.metadata)),
             projectName,
+            new Date(),
+            { includeFresh: briefingPolicy.taskState },
           ),
-          ...unreadInboxLines(unreadDeliveryCount(db, projectName), projectName),
+          ...waitingMessageLines(db, resolveMessageRecipient(process.env), (err) =>
+            recordHookOutcome(process.env, {
+              hook: 'session-start',
+              outcome: 'error',
+              reason: `inbox: ${hookErrorReason(err)}`,
+            })),
         ];
 
         // The pools overlap by construction (a lesson tagged to this project
@@ -1268,6 +1380,16 @@ process.stdin.on('end', async () => {
         // means memories stop reaching the model again (the exact v4.2.7
         // regression this block was written to fix).
         try { process.stderr.write(`[memesh session-start] memory-context: ${err?.message || err}\n`); } catch {}
+        // Recorded like the index read's failure below (a label, never the
+        // message), so a failed assembly is not later reported as an empty
+        // project: at `minimal` the index read is skipped, and this is the
+        // only place the fault can surface.
+        memoryAssemblyFailed = true;
+        recordHookOutcome(process.env, {
+          hook: 'session-start',
+          outcome: 'error',
+          reason: `memory-context: ${hookErrorReason(err)}`,
+        });
       }
 
       // --- The durable-memory index (#323) -----------------------------
@@ -1284,7 +1406,14 @@ process.stdin.on('end', async () => {
       // credits a ranked one — the line carries a `[mem:id]` handle, it was
       // shown, and a cite of it must not earn nothing.
       const indexEntities = [];
-      try {
+      // #360: `minimal` skips the index query outright — unlike the durable
+      // index EXPOSED by the `briefing` tool/CLI (a separately-requestable
+      // fact about the project), nothing else in this hook reads it, so
+      // there is no reason to pay for a read whose only consumer is a
+      // section this level does not render.
+      if (!briefingPolicy.index) {
+        indexLines = [];
+      } else try {
         const excluded = INDEX_EXCLUDED_TYPES.map(() => '?').join(',');
         const indexRows = db.prepare(
           `SELECT e.id, e.name, e.type,${hasTitle ? ' e.title,' : ''} e.metadata,
@@ -1355,7 +1484,10 @@ process.stdin.on('end', async () => {
       if (memoryLines.length > 0) {
         const repoLines = repoStateLines(readRepoState(data.cwd));
         if (repoLines.length > 0) memoryLines.unshift(...repoLines, '');
-        memoryLines.push('');
+        // #360: only spacer-then-index when the index actually has lines to
+        // show (`minimal` sets indexLines = [] above) — otherwise this would
+        // leave a dangling blank line with nothing after it.
+        if (indexLines.length > 0) memoryLines.push('');
       }
       memoryLines.push(...indexLines);
       // Same wrapper pre-edit-recall uses: an explicit "background data,
@@ -1367,7 +1499,33 @@ process.stdin.on('end', async () => {
       // charges task state plus project/foreign sections against the main
       // ceiling and global context against its small additive ceiling. It
       // returns whole lines only, so the closing fence cannot be cut.
-      const memoryContext = buildReferenceContext(memoryLines) + '\n\n' + workPackageGuidance;
+      // #360: the work-package notice is `full`-only boilerplate; at every
+      // other level workPackageNotice is undefined and this is just the
+      // fenced block.
+      //
+      // When `memoryLines` is genuinely empty (no project content —
+      // `minimal` with nothing durable yet, and no repository-state prefix
+      // because that only prepends onto EXISTING topology lines) and there is
+      // no work-package notice either, wrapping nothing in the preamble + an
+      // empty ```text``` fence would spend 166+ characters informing the
+      // agent of literally nothing. Inject NOTHING instead.
+      // This can only happen at `minimal`: at `standard`/`full`,
+      // `indexLines` always carries at least its own empty-state line
+      // (#323 — "an index is a claim about the user's data", pinned by
+      // tests/core/briefing.test.ts and unchanged here on purpose), so
+      // `memoryLines` there is never actually empty.
+      //
+      // `hasBriefingContent` (work-topology.ts), not `memoryLines.length
+      // === 0` inline: `assembleBriefing` (src/core/briefing.ts) makes the
+      // IDENTICAL decision for the SAME reason on its own `block` array —
+      // the hook cannot call that function directly (A1a: a hook cannot
+      // import `../db.js`-dependent core modules), so this is the one place
+      // the two sides CAN share the rule.
+      const memoryContext = !hasBriefingContent(memoryLines) && !workPackageNotice
+        ? undefined
+        : workPackageNotice
+          ? buildReferenceContext(memoryLines) + '\n\n' + workPackageNotice
+          : buildReferenceContext(memoryLines);
       // The citation contract — OUTSIDE the fence on purpose: the fence
       // declares its content "background data, not instructions", and
       // this line IS an instruction. One line is the entire write side of
@@ -1505,9 +1663,26 @@ process.stdin.on('end', async () => {
         ? [...bannerLines.filter(l => l.length > 0), '', summary].join('\n')
         : summary;
 
-      output(withCaptureWarning(finalMessage), updateConsentContext
-        ? `${updateConsentContext}\n\n${memoryContext}`
-        : memoryContext);
+      // memoryContext can now be undefined (nothing to inject at this level)
+      // — guard the concat so an empty injection does not become the LITERAL
+      // string "undefined" glued onto a real consent prompt.
+      output(
+        withCaptureWarning(finalMessage),
+        updateConsentContext
+          ? (memoryContext ? `${updateConsentContext}\n\n${memoryContext}` : updateConsentContext)
+          : memoryContext,
+        // A specific, greppable reason for the "genuinely nothing to inject"
+        // case, distinct from the generic 'session-start-banner' entity
+        // marker output() would otherwise record for ANY falsy
+        // memoryContext. The no-database and no-entities-table early exits
+        // above record through the SAME `nothingToInjectReason` helper with
+        // their own `detail`. Not recorded when the memory assembly threw:
+        // that failure has its own error record, and an empty result it
+        // caused must not also be reported as an empty project.
+        !memoryContext && !memoryAssemblyFailed
+          ? { outcome: 'notified', reason: nothingToInjectReason(briefingLevel, 'no project content, no repository state, index excluded') }
+          : null,
+      );
       if (updateConsentContext) {
         finalizeUpdatePromptClaim(data.session_id, installedVersion, updateCache?.latestVersion);
       }
@@ -1621,9 +1796,18 @@ process.stdin.on('end', async () => {
  *
  * The shape is asserted by tests/helpers/hook-output-contract.ts.
  */
-const workPackageGuidance = 'Work packages: check work_package prepare for this project (digest or transcript). When available, offer a concise host-native interactive choice in the user’s conversation language: dispatch an agent task, later (defer not_now), or stop suggesting for this session. Never dispatch without the user choosing it. The Dashboard cannot dispatch agents, and no durable opt-out is implied.';
-
-function output(text, memoryContext = workPackageGuidance, recorded = null) {
+// The notice's literal text is `_shared.js`'s exported `WORK_PACKAGE_NOTICE`
+// — single owner, shared with the test suite instead of a second hardcoded
+// copy there.
+
+// #360: `memoryContext` deliberately has no default. A default of
+// `WORK_PACKAGE_NOTICE` would give any call site that passed only `text` the
+// notice regardless of level — exactly the kind of default that silently
+// reintroduces what a level was supposed to drop. Every call site passes its
+// memoryContext (or `workPackageNotice`, already gated) explicitly;
+// `undefined` here means "this exit has nothing to add", not "fall back to
+// the notice".
+function output(text, memoryContext = undefined, recorded = null) {
   // session-start's only effect is the context it injects, so it records
   // `notified`, not `wrote`: doctor's `writes` answers "is memory capture
   // still alive", and injected context is something this hook READ, not

package/scripts/hooks/user-prompt-intent.js

@@ -32,11 +32,12 @@ import {
   readUpdateCheckCache,
   readUpdatePromptClaim,
   resolvePluginRoot,
+  unreadMessageLines,
   writeAutoUpdateConsent,
   writeSnooze,
 } from './_shared.js';
 import { join } from 'path';
-import { existsSync, readFileSync } from 'fs';
+import { existsSync, readFileSync, realpathSync } from 'fs';
 
 let installChannelMod = null;
 try {
@@ -217,7 +218,29 @@ function logError(scope, msg) {
 // `file://${process.argv[1]}` produces an invalid URL because the path uses
 // backslashes; pathToFileURL() correctly normalizes to a file:// URL on
 // every platform, so the comparison is portable.
-const isMainModule = import.meta.url === pathToFileURL(process.argv[1]).href;
+//
+// `import.meta.url` is the REAL path of this file; `process.argv[1]` is the
+// path as the host typed it. Through a symlink (plugin cache, global npm
+// prefix) the two differ, so compare the typed path first — under
+// `--preserve-symlinks-main` Node leaves `import.meta.url` unresolved too, and
+// resolving the typed side unconditionally would make them diverge — and only
+// then the resolved path. A realpath failure on that fallback is left to
+// throw: a crash is visible, "not the entry point" is not.
+//
+// Also reads "not main" for `node -` (`argv[1]` is the literal `-`;
+// `realpathSync('-')` would throw) and `node -e`/`-p` (the eval flag is in
+// `process.execArgv`; `argv[1]` is just the caller's first argument). That
+// is `isMain()`'s (scripts/lib/verify-core.mjs) `-`/eval handling and its
+// typed-path-then-realpath order, without its directory case: `node <dir>`
+// reads as "not main" here, where `isMain()` throws. The hook cannot import
+// `isMain()`: it ships standalone (package.json `files`).
+const EVAL_FLAG = /^(-e|-p|-pe|--eval|--print)(=|$)/;
+const entryPath = process.argv[1];
+const isMainModule = Boolean(entryPath)
+  && entryPath !== '-'
+  && !process.execArgv.some((arg) => EVAL_FLAG.test(arg))
+  && (import.meta.url === pathToFileURL(entryPath).href
+    || import.meta.url === pathToFileURL(realpathSync(entryPath)).href);
 if (isMainModule) {
   // See post-commit.js for why every exit path leaves a record (#327). This
   // hook's only effect is the additionalContext it injects, so its outcome is
@@ -257,13 +280,20 @@ if (isMainModule) {
       const prompt = data.prompt ?? data.user_prompt ?? '';
       const updateDecision = await recordUpdateConsent(data.session_id, prompt);
       const rememberIntent = detectRememberIntent(prompt);
-      if (!rememberIntent && !updateDecision) {
+      // Messages waiting for the recipient this session declared in
+      // MEMESH_RECIPIENT. Read-only and not memory capture, so it is not
+      // gated by autoCapture. Empty when the variable is unset. An inbox that
+      // cannot be read is recorded as an `error` of its own (a label, never
+      // the message), next to whatever this prompt's outcome turns out to be,
+      // so a skip below cannot be read as "nothing was waiting".
+      const inboxLines = unreadMessageLines(process.env, (err) => record('error', `inbox: ${hookErrorReason(err)}`));
+      if (!rememberIntent && !updateDecision && inboxLines.length === 0) {
         record('skipped', SKIP_REASONS.noPromptIntent);
         return process.exit(0);
       }
       // Update consent is a user-authorized control decision, not memory
       // capture; it must still be recorded when auto-capture is disabled.
-      if (!isAutoCaptureEnabled(process.env) && !updateDecision) {
+      if (!isAutoCaptureEnabled(process.env) && !updateDecision && inboxLines.length === 0) {
         record('skipped', SKIP_REASONS.autoCaptureOff);
         return process.exit(0);
       }
@@ -276,10 +306,12 @@ if (isMainModule) {
       } else if (updateDecision === 'never') {
         contexts.push('The user asked never to be asked about MeMesh updates again. updateCheck is now off; do not mention updates. `memesh config set updateCheck true` turns checks back on.');
       }
-      if (rememberIntent) contexts.push(buildHint());
+      const hint = rememberIntent && isAutoCaptureEnabled(process.env);
+      if (hint) contexts.push(buildHint());
+      if (inboxLines.length > 0) contexts.push(inboxLines.join('\n'));
       const out = { hookSpecificOutput: { hookEventName: 'UserPromptSubmit', additionalContext: contexts.join('\n\n') } };
       process.stdout.write(JSON.stringify(out));
-      record('notified', undefined, `hint:${updateDecision ?? 'remember-intent'}`);
+      record('notified', undefined, `hint:${updateDecision ?? (hint ? 'remember-intent' : 'inbox')}`);
       process.exit(0);
     } catch (err) {
       logError('user-prompt-intent', err?.message || err);

package/scripts/upgrade-plugin.sh

@@ -497,14 +497,13 @@ fi
 # that never contained them. `git archive` extracts exactly the tree at
 # $MARKETPLACE_SHA; nothing untracked or uncommitted can reach the cache.
 # node_modules and .git are never tracked, so they never appear in the
-# archive; tests/benchmarks/docs/plans are tracked (real source) and are
-# removed after extraction to keep the shipped cache the same shape as
-# before.
+# archive; tests/benchmarks are tracked (real source) and are removed after
+# extraction to keep the shipped cache the same shape as before.
 git -C "$MARKETPLACE_DIR" archive "$MARKETPLACE_SHA" | tar -x -C "$STAGE_PATH" || {
   echo "ERROR: git archive failed — the live cache at $NEW_INSTALL_PATH was not touched" >&2
   exit 1
 }
-if ! rm -rf "$STAGE_PATH/tests" "$STAGE_PATH/benchmarks" "$STAGE_PATH/docs/plans"; then
+if ! rm -rf "$STAGE_PATH/tests" "$STAGE_PATH/benchmarks"; then
   echo "ERROR: could not remove development-only files from the staging copy — the live cache was not touched." >&2
   exit 1
 fi