@pcircle/memesh 4.9.0 → 4.9.3

package/scripts/hooks/session-start.js

@@ -26,6 +26,10 @@ import {
   memeshDir as memeshHomeDir,
   parseTaskState,
   readRepoState,
+  readAutoUpdateConsent,
+  claimUpdatePrompt,
+  finalizeUpdatePromptClaim,
+  readUpdatePromptClaim,
   readUpdateCheckCache,
   repoStateLines,
   resolvePluginRoot,
@@ -34,6 +38,7 @@ import {
   homeDir,
   taskStateName,
   writeCitationRule,
+  writeAutoUpdateConsent,
   writePrivateJson,
 } from './_shared.js';
 import { MemeshDatabase } from './_generated/sqlite.js';
@@ -326,6 +331,43 @@ function detectInstallChannelHook(pluginRoot) {
   }
 }
 
+function buildUpdateConsentPrompt(sessionId, currentVersion, cache, channel) {
+  if (!sessionId || sessionId === 'unknown' || !cache || cache.currentVersion !== currentVersion) return null;
+  if (!cache.latestVersion || !isStrictlyOlder(currentVersion, cache.latestVersion)) return null;
+  const existing = readAutoUpdateConsent(sessionId, currentVersion, cache.latestVersion, channel);
+  if (existing?.decision) return null;
+  // Claim the session-level notice before emitting it. A resumed hook or a
+  // concurrent host process (including a second host channel) sees the
+  // atomic claim and does not duplicate the ask.
+  if (readUpdatePromptClaim(sessionId, currentVersion, cache.latestVersion)
+    || !claimUpdatePrompt(sessionId, currentVersion, cache.latestVersion, channel)) return null;
+  const target = channel === 'plugin-marketplace'
+    ? 'the installed marketplace plugin'
+    : channel === 'npm-global' ? 'the global memesh installation' : 'this MeMesh installation';
+  if (channel !== 'npm-global') {
+    const pluginRoot = resolvePluginRoot(import.meta.url);
+    const action = channel === 'plugin-marketplace'
+      ? pluginUpgradeLine(pluginRoot)
+      : channel === 'source-checkout'
+        ? '    Source checkout: pull and rebuild (`git pull && npm install && npm run build`).'
+        : channel === 'npm-local'
+          ? '    Project-local install: run `npm install @pcircle/memesh@latest` in the project that installed it.'
+          : '    Update it through the tool or package manager that installed MeMesh.';
+    return {
+      system: `\nℹ️  MeMesh ${cache.latestVersion} is available (you're on ${currentVersion}) for ${target}. This installation cannot be upgraded automatically from this session.\n${action}`,
+      context: `MeMesh ${cache.latestVersion} is available for ${target}, but this channel has no safe in-session installer. Show the user the channel-specific update action and do not claim that an Upgrade reply will install it.`,
+    };
+  }
+  // The npm-global channel is the only hook-owned installer. Record a
+  // channel-specific pending consent for the Stop hook after the global
+  // session notice has been claimed.
+  if (!writeAutoUpdateConsent(sessionId, currentVersion, cache.latestVersion, channel, 'pending')) return null;
+  return {
+    system: `\nℹ️  MeMesh ${cache.latestVersion} is available (you're on ${currentVersion}) for ${target}. Reply “Upgrade” to install it, or “Not now” to skip for this session.`,
+    context: `MeMesh update consent is pending for this session. Ask the user whether to upgrade from ${currentVersion} to ${cache.latestVersion} for the ${target}. Wait for an explicit Upgrade or Not now response; do not install without affirmative consent.`,
+  };
+}
+
 /**
  * Which plugin runtime owns this copy: 'claude-code', 'codex', or null.
  *
@@ -503,6 +545,15 @@ function runPostBannerUpdateTasks() {
   if (__postBannerRan) return;
   __postBannerRan = true;
   try {
+    // A first-use session has no database yet. Starting the detached
+    // `memesh status` refresh in that state makes status create/migrate the
+    // database while the next SessionStart may already be opening it
+    // read-only. SQLite can expose that window as a partially-created schema
+    // (for example, `entities` exists while `tags` does not), turning a
+    // harmless update notice into "memories not loaded". The next session
+    // after the first capture will refresh the cache once the database is
+    // fully established; consent itself was already emitted above.
+    if (!existsSync(dbPath)) return;
     let installedVersion = null;
     try {
       const pluginRoot = resolvePluginRoot(import.meta.url);
@@ -679,7 +730,21 @@ process.stdin.on('end', async () => {
       // With no database there is nothing to recall either — the warning IS
       // the whole truth, and "memories will be created as you work" would
       // contradict it one line later.
-      output(combineWithBanner(captureWarning ?? '◉ MeMesh ready · no database yet, memories will be created as you work'));
+      const emptySummary = combineWithBanner(captureWarning ?? '◉ MeMesh ready · no database yet, memories will be created as you work');
+      let consent = null;
+      let consentVersion = null;
+      let consentCache = null;
+      try {
+        const pluginRoot = resolvePluginRoot(import.meta.url);
+        const pkg = JSON.parse(readFileSync(join(pluginRoot, 'package.json'), 'utf8'));
+        consentVersion = typeof pkg.version === 'string' ? pkg.version : null;
+        consentCache = readUpdateCheckCache(consentVersion);
+        const channel = detectInstallChannelHook(pluginRoot);
+        consent = buildUpdateConsentPrompt(data.session_id, consentVersion, consentCache, channel);
+      } catch { /* best-effort */ }
+      output(consent ? `${consent.system}\n${emptySummary}` : emptySummary,
+        consent ? `${consent.context}\n\n${workPackageGuidance}` : workPackageGuidance);
+      if (consent) finalizeUpdatePromptClaim(data.session_id, consentVersion, consentCache?.latestVersion);
       return;
     }
 
@@ -1150,20 +1215,41 @@ process.stdin.on('end', async () => {
       }
       const updateCache = readUpdateCheckCache(installedVersion);
       let bannerLines = [];
+      let updateConsentContext = null;
       if (installedVersion) {
         const deprecation = buildDeprecationBanner(installedVersion, updateCache);
         if (deprecation.length > 0) {
           bannerLines = deprecation;
         } else {
-          bannerLines = buildUpdateAvailableBanner(installedVersion, updateCache,
-            () => detectInstallChannelHook(resolvePluginRoot(import.meta.url)));
+          const channel = detectInstallChannelHook(resolvePluginRoot(import.meta.url));
+          const consent = buildUpdateConsentPrompt(data.session_id, installedVersion, updateCache, channel);
+          if (consent) {
+            // The first-use notice is the authoritative update message for
+            // this session. Do not append the softer 24h banner as well; a
+            // source/plugin user would otherwise see two contradictory
+            // update instructions in one SessionStart payload.
+            bannerLines = [consent.system];
+            updateConsentContext = consent.context;
+          } else if (readUpdatePromptClaim(data.session_id, installedVersion, updateCache?.latestVersion)) {
+            // A first-use notice was already shown (and may have been
+            // answered by UserPromptSubmit). Suppress the routine banner for
+            // the rest of this session as well.
+            bannerLines = [];
+          } else {
+            bannerLines = buildUpdateAvailableBanner(installedVersion, updateCache, () => channel);
+          }
         }
       }
       const finalMessage = bannerLines.length > 0
         ? [...bannerLines.filter(l => l.length > 0), '', summary].join('\n')
         : summary;
 
-      output(withCaptureWarning(finalMessage), memoryContext);
+      output(withCaptureWarning(finalMessage), updateConsentContext
+        ? `${updateConsentContext}\n\n${memoryContext}`
+        : memoryContext);
+      if (updateConsentContext) {
+        finalizeUpdatePromptClaim(data.session_id, installedVersion, updateCache?.latestVersion);
+      }
 
       // Pre-read the noise-compression throttle on the handle we already
       // hold. compressWeeklyNoise() re-checks under its own connection, but

package/scripts/hooks/session-summary.js

@@ -15,6 +15,7 @@ import {
   extractCitedMemoryIds,
   getMemeshDirFromDbPath,
   getProjectName,
+  findAutoUpdateConsent,
   isAutoCaptureEnabled,
   openHookDb,
   readUpdateCheckCache,
@@ -40,7 +41,7 @@ try {
   // Best-effort: source checkouts may not have built dist output yet.
 }
 
-async function runAutoUpdateAtStop() {
+async function runAutoUpdateAtStop(sessionId) {
   try {
     const pluginRoot = resolvePluginRoot(import.meta.url);
     const pkg = JSON.parse(readFileSync(join(pluginRoot, 'package.json'), 'utf8'));
@@ -50,7 +51,14 @@ async function runAutoUpdateAtStop() {
     const cache = readUpdateCheckCache(installedVersion);
     const policy = resolveAutoUpdatePolicy(process.env);
     const decision = decideAutoUpdateHook(installedVersion, cache, policy);
-    if (decision.run) await spawnAutoUpdate(decision.latest, installChannel);
+    let channel = 'unknown';
+    try { channel = installChannel?.getCurrentInstallChannel({ packageRoot: pluginRoot }) ?? 'unknown'; } catch { /* best-effort */ }
+    const consent = decision.run
+      ? findAutoUpdateConsent(sessionId, installedVersion, decision.latest, channel)
+      : null;
+    if (decision.run && consent?.decision === 'approved') {
+      await spawnAutoUpdate(decision.latest, installChannel);
+    }
   } catch {
     // Best-effort: update failures must never break session capture.
   }
@@ -204,6 +212,7 @@ let input = '';
 process.stdin.setEncoding('utf8');
 process.stdin.on('data', (chunk) => { input += chunk; });
 process.stdin.on('end', async () => {
+  let sessionId = 'unknown';
   try {
     if (!input.trim()) return exit0();
 
@@ -224,7 +233,7 @@ process.stdin.on('end', async () => {
       return exit0();
     }
 
-    const sessionId = inputData.session_id || 'unknown';
+    sessionId = inputData.session_id || 'unknown';
     const transcriptPath = inputData.transcript_path;
 
     // `cwd` decides the project tag, and the project tag decides which
@@ -337,6 +346,10 @@ process.stdin.on('end', async () => {
       ).get(`session-${sessionId}-files`, `session-${sessionId}-fixes`, `session-${sessionId}-summary`);
       if (alreadyCaptured) {
         recordHookRun(db, 'session-summary');
+        // A duplicate capture is still a completed Stop lifecycle. Update
+        // consent is session-scoped and must not be skipped merely because
+        // the same transcript was observed twice (a common host retry).
+        await runAutoUpdateAtStop(sessionId);
         return exit0();
       }
 
@@ -587,7 +600,7 @@ process.stdin.on('end', async () => {
 
   // Update only after all session work so installed files cannot change while
   // this hook is still reading them.
-  await runAutoUpdateAtStop();
+  await runAutoUpdateAtStop(sessionId);
 
   // Emit NOTHING on success — not `{"suppressOutput": true}`.
   //

package/scripts/hooks/user-prompt-intent.js

@@ -19,7 +19,62 @@
 // Gated by `autoCapture` flag (same as other memesh write hooks).
 
 import { pathToFileURL } from 'url';
-import { isAutoCaptureEnabled } from './_shared.js';
+import {
+  findAutoUpdateConsent,
+  isAutoCaptureEnabled,
+  parseAutoUpdateConsent,
+  readUpdateCheckCache,
+  resolvePluginRoot,
+  writeAutoUpdateConsent,
+} from './_shared.js';
+import { join } from 'path';
+import { existsSync, readFileSync } from 'fs';
+
+let installChannelMod = null;
+try {
+  const pluginRoot = resolvePluginRoot(import.meta.url);
+  const modulePath = join(pluginRoot, 'dist/core/install-channel.js');
+  if (existsSync(modulePath)) installChannelMod = await import(pathToFileURL(modulePath).href);
+} catch {
+  // Source checkouts without a build remain non-blocking and cannot self-update.
+}
+
+function currentInstallChannel() {
+  try {
+    return installChannelMod?.getCurrentInstallChannel({
+      packageRoot: resolvePluginRoot(import.meta.url),
+    }) ?? 'unknown';
+  } catch {
+    return 'unknown';
+  }
+}
+
+function currentInstalledVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync(join(resolvePluginRoot(import.meta.url), 'package.json'), 'utf8'));
+    return typeof pkg.version === 'string' ? pkg.version : null;
+  } catch { return null; }
+}
+
+function recordUpdateConsent(sessionId, prompt) {
+  const current = currentInstalledVersion();
+  if (!current || !sessionId) return null;
+  const channel = currentInstallChannel();
+  // Only npm-global has a hook-owned installer. Other channels receive an
+  // actionable notice at SessionStart and must not turn an "Upgrade" word
+  // into a misleading approval marker for a different installation path.
+  if (channel !== 'npm-global') return null;
+  const cache = readUpdateCheckCache(current);
+  const latest = cache?.latestVersion;
+  if (typeof latest !== 'string' || !latest) return null;
+  const pending = findAutoUpdateConsent(sessionId, current, latest, channel);
+  if (!pending || !['pending'].includes(pending.decision)) return null;
+  const decision = parseAutoUpdateConsent(prompt);
+  if (!decision) return null;
+  return writeAutoUpdateConsent(
+    sessionId, current, latest, pending.channel ?? 'unknown', decision,
+  ) ? decision : null;
+}
 
 // Patterns compiled at module load — invalid regex MUST fail loudly. Do
 // NOT move into a try block "for safety": a regex compile error is a
@@ -121,8 +176,6 @@ if (isMainModule) {
   process.stdin.on('data', (chunk) => { input += chunk; });
   process.stdin.on('end', () => {
     try {
-      if (!isAutoCaptureEnabled(process.env)) return process.exit(0);
-
       // Distinguish empty stdin (legitimate degenerate event) from malformed
       // input (protocol drift). Both stay non-blocking, but only malformed
       // input is logged — empty is normal, garbage indicates a real bug.
@@ -142,14 +195,21 @@ if (isMainModule) {
       // we accept either name to survive a similar rename. If both are absent
       // or non-string, detectRememberIntent's type guard returns false safely.
       const prompt = data.prompt ?? data.user_prompt ?? '';
-      if (!detectRememberIntent(prompt)) return process.exit(0);
-
-      const out = {
-        hookSpecificOutput: {
-          hookEventName: 'UserPromptSubmit',
-          additionalContext: buildHint(),
-        },
-      };
+      const updateDecision = recordUpdateConsent(data.session_id, prompt);
+      const rememberIntent = detectRememberIntent(prompt);
+      if (!rememberIntent && !updateDecision) return process.exit(0);
+      // Update consent is a user-authorized control decision, not memory
+      // capture; it must still be recorded when auto-capture is disabled.
+      if (!isAutoCaptureEnabled(process.env) && !updateDecision) return process.exit(0);
+
+      const contexts = [];
+      if (updateDecision) {
+        contexts.push(updateDecision === 'approved'
+          ? 'The user explicitly approved the MeMesh upgrade. The Stop hook may now update the consented installation.'
+          : 'The user declined the MeMesh upgrade for this session. Do not install it or ask again in this session.');
+      }
+      if (rememberIntent) contexts.push(buildHint());
+      const out = { hookSpecificOutput: { hookEventName: 'UserPromptSubmit', additionalContext: contexts.join('\n\n') } };
       process.stdout.write(JSON.stringify(out));
       process.exit(0);
     } catch (err) {