@pcircle/memesh 4.9.0 → 4.9.4

package/scripts/check-plugin-hook-artifact.mjs

@@ -0,0 +1,212 @@
+#!/usr/bin/env node
+/** Verify plugin hooks and host entrypoints before a cache/artifact swap. */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { npmSync, envWithNpmCache } from './lib/npm-bin.mjs';
+
+export const CLAUDE_PLUGIN_ROOT_PREFIX = '${CLAUDE_PLUGIN_ROOT}/';
+
+function isSubpath(parent, child) {
+  const relative = path.relative(parent, child);
+  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+
+export function hookTargetsFromManifest(manifest) {
+  const targets = [];
+  for (const [event, entries] of Object.entries(manifest?.hooks ?? {})) {
+    if (!Array.isArray(entries)) throw new Error(`${event} is not an array in hooks/hooks.json`);
+    for (const entry of entries) {
+      for (const hook of entry?.hooks ?? []) {
+        if (hook?.type !== 'command') continue;
+        if (typeof hook.command !== 'string' || !hook.command.startsWith(CLAUDE_PLUGIN_ROOT_PREFIX)) {
+          throw new Error(`${event} command must start with ${CLAUDE_PLUGIN_ROOT_PREFIX}`);
+        }
+        const relative = hook.command.slice(CLAUDE_PLUGIN_ROOT_PREFIX.length);
+        if (!relative || /\s/.test(relative) || path.posix.normalize(relative) !== relative || relative.startsWith('../')) {
+          throw new Error(`${event} command is not a single safe plugin-relative path: ${hook.command}`);
+        }
+        targets.push({ event, relative });
+      }
+    }
+  }
+  if (targets.length === 0) throw new Error('hooks/hooks.json declares no command hooks');
+  return targets;
+}
+
+export function readHookManifest(root) {
+  return JSON.parse(fs.readFileSync(path.join(root, 'hooks', 'hooks.json'), 'utf8'));
+}
+
+export function validateHookTargets(root, manifest = readHookManifest(root)) {
+  const rootPath = path.resolve(root);
+  const targets = hookTargetsFromManifest(manifest);
+  const missing = [];
+  for (const target of targets) {
+    const resolved = path.resolve(rootPath, target.relative);
+    try {
+      if (isContainedRegularFile(rootPath, resolved)) continue;
+    } catch {
+      // Report the same bounded finding for missing and unreadable targets.
+    }
+    missing.push({ ...target, resolved });
+  }
+  return { targets, missing, ok: missing.length === 0 };
+}
+
+/**
+ * True only for a regular file whose every path component lives inside root.
+ * `lstat` rejects a symlink as the last component; `realpathSync` on both
+ * sides rejects a symlinked directory ABOVE it — `scripts/hooks -> /elsewhere`
+ * passed the lstat-only check and would have let a staged cache execute
+ * ambient bytes. Throws on a missing path, like the fs calls it wraps.
+ */
+function isContainedRegularFile(rootPath, resolved) {
+  if (!isSubpath(rootPath, resolved) || !fs.lstatSync(resolved).isFile()) return false;
+  return isSubpath(fs.realpathSync(rootPath), fs.realpathSync(resolved));
+}
+
+function safeRelativePath(value, label) {
+  if (typeof value !== 'string' || !value.startsWith('./')) {
+    throw new Error(`${label} must be a ./ relative path`);
+  }
+  const relative = value.slice(2);
+  if (!relative || path.posix.normalize(relative) !== relative || relative.startsWith('../') || path.isAbsolute(relative)) {
+    throw new Error(`${label} is not a safe plugin-relative path: ${value}`);
+  }
+  return relative;
+}
+
+function regularFile(root, relative, label) {
+  const rootPath = path.resolve(root);
+  const resolved = path.resolve(rootPath, relative);
+  if (!isSubpath(rootPath, resolved)) throw new Error(`${label} escapes plugin root: ${relative}`);
+  try {
+    if (isContainedRegularFile(rootPath, resolved)) return relative;
+  } catch {
+    // Fall through to one bounded diagnostic.
+  }
+  throw new Error(`${label} is missing or not a regular file: ${relative}`);
+}
+
+export function validatePluginEntrypoints(root) {
+  const packageJson = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+  const targets = [];
+  for (const [relativeManifest, expectedPrefix] of [
+    ['.claude-plugin/plugin.json', '${CLAUDE_PLUGIN_ROOT}/'],
+    ['.codex-plugin/plugin.json', './'],
+  ]) {
+    regularFile(root, relativeManifest, relativeManifest);
+    const plugin = JSON.parse(fs.readFileSync(path.join(root, relativeManifest), 'utf8'));
+    if (plugin.name !== 'memesh') throw new Error(`${relativeManifest} has unexpected plugin name`);
+    if (plugin.version !== packageJson.version) throw new Error(`${relativeManifest} version does not match package.json`);
+    const mcpManifest = safeRelativePath(plugin.mcpServers, `${relativeManifest} mcpServers`);
+    regularFile(root, mcpManifest, `${relativeManifest} mcpServers`);
+    targets.push({ kind: 'manifest', relative: relativeManifest });
+    targets.push({ kind: 'manifest', relative: mcpManifest });
+    const manifest = JSON.parse(fs.readFileSync(path.join(root, mcpManifest), 'utf8'));
+    const entry = manifest.mcpServers?.memesh;
+    if (!entry || entry.command !== 'node' || !Array.isArray(entry.args) || typeof entry.args[0] !== 'string') {
+      throw new Error(`${mcpManifest} has no valid mcpServers.memesh node entry`);
+    }
+    const rawTarget = entry.args[0];
+    if (!rawTarget.startsWith(expectedPrefix)) {
+      throw new Error(`${mcpManifest} entry must start with ${expectedPrefix}`);
+    }
+    const target = rawTarget.slice(expectedPrefix.length);
+    if (path.posix.normalize(target) !== target || target.startsWith('../') || path.isAbsolute(target)) {
+      throw new Error(`${mcpManifest} entry is not a safe plugin-relative path: ${rawTarget}`);
+    }
+    regularFile(root, target, `${mcpManifest} entrypoint`);
+    targets.push({ kind: 'entrypoint', relative: target });
+  }
+  return { targets };
+}
+
+export function validateArtifactPaths(targets, files) {
+  const shipped = new Set(files.map((file) => typeof file === 'string' ? file : file.path));
+  const missing = targets.filter((target) => !shipped.has(target.relative));
+  return { missing, ok: missing.length === 0 };
+}
+
+function packFiles(root) {
+  const npmCache = fs.mkdtempSync(path.join(os.tmpdir(), 'memesh-pack-cache-'));
+  try {
+    const stdout = npmSync(['pack', '--dry-run', '--json', '--ignore-scripts'], {
+      cwd: root,
+      encoding: 'utf8',
+      env: envWithNpmCache(npmCache),
+    });
+    let report;
+    try { report = JSON.parse(String(stdout)); } catch { throw new Error('npm pack --dry-run did not return valid JSON'); }
+    const entry = Array.isArray(report) ? report[0] : report;
+    if (!entry || !Array.isArray(entry.files)) throw new Error('npm pack --dry-run returned no file list');
+    return entry.files;
+  } catch (error) {
+    if (error instanceof Error && /npm pack --dry-run (?:did not return|returned no)/.test(error.message)) throw error;
+    const record = error && typeof error === 'object' ? /** @type {Record<string, unknown>} */ (error) : {};
+    const status = typeof record.status === 'number' ? record.status : 'unknown';
+    const stderr = typeof record.stderr === 'string' ? record.stderr.trim() : '';
+    throw new Error(
+      `npm pack --dry-run failed (exit ${status}): ${stderr || (error instanceof Error ? error.message : String(error))}`,
+      { cause: error },
+    );
+  } finally {
+    fs.rmSync(npmCache, { recursive: true, force: true });
+  }
+}
+
+export function checkPluginHookArtifact(root, { checkPack = true } = {}) {
+  const source = validateHookTargets(root);
+  const plugin = validatePluginEntrypoints(root);
+  const allTargets = [...source.targets, ...plugin.targets];
+  if (!checkPack) return { ...source, plugin, artifact: null };
+  return { ...source, plugin, artifact: validateArtifactPaths(allTargets, packFiles(root)) };
+}
+
+function main(argv) {
+  const rootIndex = argv.indexOf('--root');
+  if (rootIndex !== -1 && (!argv[rootIndex + 1] || argv[rootIndex + 1].startsWith('--'))) {
+    console.error('plugin hook integrity: --root requires a directory argument');
+    process.exit(2);
+  }
+  const root = path.resolve(rootIndex === -1 ? process.cwd() : argv[rootIndex + 1]);
+  const checkPack = !argv.includes('--skip-pack');
+  try {
+    const result = checkPluginHookArtifact(root, { checkPack });
+    if (!result.ok) {
+      for (const item of result.missing) console.error(`Missing hook target: ${item.event} -> ${item.resolved}`);
+      process.exit(1);
+    }
+    if (result.artifact && !result.artifact.ok) {
+      for (const item of result.artifact.missing) console.error(`Target omitted from npm artifact: ${item.event ?? item.kind} -> ${item.relative}`);
+      process.exit(1);
+    }
+    console.log(`plugin artifact integrity: PASS (${result.targets.length} hook targets, ${result.plugin.targets.length} plugin/MCP targets${checkPack ? ', npm artifact checked' : ''})`);
+  } catch (error) {
+    console.error(`plugin hook integrity: ${error instanceof Error ? error.message : String(error)}`);
+    process.exit(1);
+  }
+}
+
+/**
+ * Run `main` only when this file is the entrypoint. Both sides go through
+ * realpath: Node resolves symlinks in `import.meta.url` but not in argv[1],
+ * so `node /var/folders/.../check-plugin-hook-artifact.mjs` (macOS tmp is a
+ * symlink) compared unequal, skipped `main`, and exited 0 with no output — a
+ * silent PASS from a checker that had checked nothing. Pinned by the tarball
+ * test in tests/plugin-hook-artifact.test.ts, which asserts on the output.
+ */
+function isEntrypoint(argv1) {
+  if (!argv1) return false;
+  const self = fileURLToPath(import.meta.url);
+  const given = path.resolve(argv1);
+  if (self === given) return true;
+  // A realpath failure must not become "not the entrypoint": that is exit 0
+  // with nothing checked, the fail-closed guard's caller only reads the exit
+  // code, and a staged plugin would swap in unverified. Let it throw.
+  return fs.realpathSync(self) === fs.realpathSync(given);
+}
+
+if (isEntrypoint(process.argv[1])) main(process.argv.slice(2));

package/scripts/hooks/_shared.js

@@ -1,4 +1,5 @@
-import { appendFileSync, chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, writeFileSync } from 'fs';
+import { appendFileSync, chmodSync, closeSync, constants as fsConstants, existsSync, mkdirSync, openSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from 'fs';
+import { createHash } from 'crypto';
 import { spawn } from 'child_process';
 import { MemeshDatabase } from './_generated/sqlite.js';
 import { dirname, join } from 'path';
@@ -827,6 +828,154 @@ const POLICY_RANK = { off: 0, patch: 1, minor: 2, major: 3 };
 const BUMP_RANK = { patch: 1, minor: 2, major: 3 };
 const AUTO_UPDATE_CACHE_FRESHNESS_MS = 24 * 60 * 60 * 1000;
 
+function autoUpdateConsentPath(sessionId, currentVersion, latestVersion, channel = 'unknown') {
+  if (typeof sessionId !== 'string' || sessionId.length === 0 || sessionId === 'unknown') return null;
+  const key = createHash('sha256')
+    .update(`${sessionId}\0${currentVersion}\0${latestVersion}\0${channel}`)
+    .digest('hex');
+  return join(memeshDir(), 'update-consent', `${key}.json`);
+}
+
+function updatePromptClaimPath(sessionId, currentVersion, latestVersion) {
+  if (typeof sessionId !== 'string' || sessionId.length === 0 || sessionId === 'unknown') return null;
+  const key = createHash('sha256')
+    .update(`${sessionId}\0${currentVersion}\0${latestVersion}`)
+    .digest('hex');
+  return join(memeshDir(), 'update-prompt-claims', `${key}.json`);
+}
+
+/**
+ * Atomically claim the one first-use update notice for a session/version.
+ * Separate host hooks can start at the same time; a read-then-write pending
+ * marker lets both print the prompt. O_EXCL makes the claim the decision.
+ */
+export function claimUpdatePrompt(sessionId, currentVersion, latestVersion, channel) {
+  const path = updatePromptClaimPath(sessionId, currentVersion, latestVersion);
+  if (!path || typeof channel !== 'string' || channel.length === 0) return false;
+  try {
+    ensurePrivateDir(join(memeshDir(), 'update-prompt-claims'));
+    // A crash can leave a pending claim before the hook emits its output.
+    // Reclaim only when that owner process is definitely gone; emitted
+    // claims remain session-scoped and continue suppressing duplicates.
+    try {
+      const existing = JSON.parse(readFileSync(path, 'utf8'));
+      const ownerPid = Number(existing?.ownerPid);
+      if (existing?.decision === 'pending' && Number.isInteger(ownerPid) && ownerPid > 0) {
+        try {
+          process.kill(ownerPid, 0);
+        } catch (err) {
+          if (err?.code === 'ESRCH') unlinkSync(path);
+        }
+      }
+    } catch {
+      // A corrupt claim fails closed at the O_EXCL step below.
+    }
+    const fd = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 0o600);
+    try {
+      writeFileSync(fd, JSON.stringify({
+        sessionId,
+        currentVersion,
+        latestVersion,
+        channel,
+        decision: 'pending',
+        ownerPid: process.pid,
+        recordedAt: new Date().toISOString(),
+      }));
+    } finally {
+      closeSync(fd);
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function finalizeUpdatePromptClaim(sessionId, currentVersion, latestVersion) {
+  const path = updatePromptClaimPath(sessionId, currentVersion, latestVersion);
+  if (!path || !existsSync(path)) return false;
+  try {
+    const value = JSON.parse(readFileSync(path, 'utf8'));
+    if (value?.decision !== 'pending' || Number(value.ownerPid) !== process.pid) return false;
+    writePrivateJson(path, { ...value, decision: 'emitted', emittedAt: new Date().toISOString() });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function readUpdatePromptClaim(sessionId, currentVersion, latestVersion) {
+  const path = updatePromptClaimPath(sessionId, currentVersion, latestVersion);
+  if (!path || !existsSync(path)) return null;
+  try {
+    const value = JSON.parse(readFileSync(path, 'utf8'));
+    return value && typeof value === 'object' ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+export function readAutoUpdateConsent(sessionId, currentVersion, latestVersion, channel = 'unknown') {
+  const path = autoUpdateConsentPath(sessionId, currentVersion, latestVersion, channel);
+  if (!path || !existsSync(path)) return null;
+  try {
+    const value = JSON.parse(readFileSync(path, 'utf8'));
+    return value && typeof value === 'object' ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {string} sessionId
+ * @param {string} currentVersion
+ * @param {string} latestVersion
+ * @param {string|null} [channel=null]
+ */
+export function findAutoUpdateConsent(sessionId, currentVersion, latestVersion, channel = null) {
+  if (typeof sessionId !== 'string' || !sessionId || sessionId === 'unknown') return null;
+  try {
+    const dir = join(memeshDir(), 'update-consent');
+    for (const file of readdirSync(dir)) {
+      if (!file.endsWith('.json')) continue;
+      try {
+        const value = JSON.parse(readFileSync(join(dir, file), 'utf8'));
+        if (value?.sessionId === sessionId
+          && value?.currentVersion === currentVersion
+          && value?.latestVersion === latestVersion
+          && (channel === null || value?.channel === channel)) return value;
+      } catch { /* ignore one corrupt marker */ }
+    }
+  } catch { /* missing/unreadable consent dir */ }
+  return null;
+}
+
+export function writeAutoUpdateConsent(sessionId, currentVersion, latestVersion, channel, decision) {
+  const path = autoUpdateConsentPath(sessionId, currentVersion, latestVersion, channel);
+  if (!path || !['pending', 'approved', 'declined'].includes(decision)) return false;
+  try {
+    ensurePrivateDir(join(memeshDir(), 'update-consent'));
+    writePrivateJson(path, {
+      sessionId,
+      currentVersion,
+      latestVersion,
+      channel,
+      decision,
+      recordedAt: new Date().toISOString(),
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function parseAutoUpdateConsent(prompt) {
+  if (typeof prompt !== 'string') return null;
+  const value = prompt.trim().toLowerCase().replace(/[.!?。！？]+$/u, '');
+  if (/^(?:yes|y|upgrade|update|install(?: it)?|go ahead|是|好|升級|更新|安裝)$/.test(value)) return 'approved';
+  if (/^(?:no|n|not now|later|不要|不用|稍後|暫時不要)$/.test(value)) return 'declined';
+  return null;
+}
+
 export function decideAutoUpdateHook(currentVersion, cache, policy) {
   if (!cache || cache.currentVersion !== currentVersion) return { run: false };
   const latest = cache.latestVersion;

package/scripts/hooks/session-start.js

@@ -26,6 +26,10 @@ import {
   memeshDir as memeshHomeDir,
   parseTaskState,
   readRepoState,
+  readAutoUpdateConsent,
+  claimUpdatePrompt,
+  finalizeUpdatePromptClaim,
+  readUpdatePromptClaim,
   readUpdateCheckCache,
   repoStateLines,
   resolvePluginRoot,
@@ -34,6 +38,7 @@ import {
   homeDir,
   taskStateName,
   writeCitationRule,
+  writeAutoUpdateConsent,
   writePrivateJson,
 } from './_shared.js';
 import { MemeshDatabase } from './_generated/sqlite.js';
@@ -326,6 +331,43 @@ function detectInstallChannelHook(pluginRoot) {
   }
 }
 
+function buildUpdateConsentPrompt(sessionId, currentVersion, cache, channel) {
+  if (!sessionId || sessionId === 'unknown' || !cache || cache.currentVersion !== currentVersion) return null;
+  if (!cache.latestVersion || !isStrictlyOlder(currentVersion, cache.latestVersion)) return null;
+  const existing = readAutoUpdateConsent(sessionId, currentVersion, cache.latestVersion, channel);
+  if (existing?.decision) return null;
+  // Claim the session-level notice before emitting it. A resumed hook or a
+  // concurrent host process (including a second host channel) sees the
+  // atomic claim and does not duplicate the ask.
+  if (readUpdatePromptClaim(sessionId, currentVersion, cache.latestVersion)
+    || !claimUpdatePrompt(sessionId, currentVersion, cache.latestVersion, channel)) return null;
+  const target = channel === 'plugin-marketplace'
+    ? 'the installed marketplace plugin'
+    : channel === 'npm-global' ? 'the global memesh installation' : 'this MeMesh installation';
+  if (channel !== 'npm-global') {
+    const pluginRoot = resolvePluginRoot(import.meta.url);
+    const action = channel === 'plugin-marketplace'
+      ? pluginUpgradeLine(pluginRoot)
+      : channel === 'source-checkout'
+        ? '    Source checkout: pull and rebuild (`git pull && npm install && npm run build`).'
+        : channel === 'npm-local'
+          ? '    Project-local install: run `npm install @pcircle/memesh@latest` in the project that installed it.'
+          : '    Update it through the tool or package manager that installed MeMesh.';
+    return {
+      system: `\nℹ️  MeMesh ${cache.latestVersion} is available (you're on ${currentVersion}) for ${target}. This installation cannot be upgraded automatically from this session.\n${action}`,
+      context: `MeMesh ${cache.latestVersion} is available for ${target}, but this channel has no safe in-session installer. Show the user the channel-specific update action and do not claim that an Upgrade reply will install it.`,
+    };
+  }
+  // The npm-global channel is the only hook-owned installer. Record a
+  // channel-specific pending consent for the Stop hook after the global
+  // session notice has been claimed.
+  if (!writeAutoUpdateConsent(sessionId, currentVersion, cache.latestVersion, channel, 'pending')) return null;
+  return {
+    system: `\nℹ️  MeMesh ${cache.latestVersion} is available (you're on ${currentVersion}) for ${target}. Reply “Upgrade” to install it, or “Not now” to skip for this session.`,
+    context: `MeMesh update consent is pending for this session. Ask the user whether to upgrade from ${currentVersion} to ${cache.latestVersion} for the ${target}. Wait for an explicit Upgrade or Not now response; do not install without affirmative consent.`,
+  };
+}
+
 /**
  * Which plugin runtime owns this copy: 'claude-code', 'codex', or null.
  *
@@ -503,6 +545,15 @@ function runPostBannerUpdateTasks() {
   if (__postBannerRan) return;
   __postBannerRan = true;
   try {
+    // A first-use session has no database yet. Starting the detached
+    // `memesh status` refresh in that state makes status create/migrate the
+    // database while the next SessionStart may already be opening it
+    // read-only. SQLite can expose that window as a partially-created schema
+    // (for example, `entities` exists while `tags` does not), turning a
+    // harmless update notice into "memories not loaded". The next session
+    // after the first capture will refresh the cache once the database is
+    // fully established; consent itself was already emitted above.
+    if (!existsSync(dbPath)) return;
     let installedVersion = null;
     try {
       const pluginRoot = resolvePluginRoot(import.meta.url);
@@ -679,7 +730,21 @@ process.stdin.on('end', async () => {
       // With no database there is nothing to recall either — the warning IS
       // the whole truth, and "memories will be created as you work" would
       // contradict it one line later.
-      output(combineWithBanner(captureWarning ?? '◉ MeMesh ready · no database yet, memories will be created as you work'));
+      const emptySummary = combineWithBanner(captureWarning ?? '◉ MeMesh ready · no database yet, memories will be created as you work');
+      let consent = null;
+      let consentVersion = null;
+      let consentCache = null;
+      try {
+        const pluginRoot = resolvePluginRoot(import.meta.url);
+        const pkg = JSON.parse(readFileSync(join(pluginRoot, 'package.json'), 'utf8'));
+        consentVersion = typeof pkg.version === 'string' ? pkg.version : null;
+        consentCache = readUpdateCheckCache(consentVersion);
+        const channel = detectInstallChannelHook(pluginRoot);
+        consent = buildUpdateConsentPrompt(data.session_id, consentVersion, consentCache, channel);
+      } catch { /* best-effort */ }
+      output(consent ? `${consent.system}\n${emptySummary}` : emptySummary,
+        consent ? `${consent.context}\n\n${workPackageGuidance}` : workPackageGuidance);
+      if (consent) finalizeUpdatePromptClaim(data.session_id, consentVersion, consentCache?.latestVersion);
       return;
     }
 
@@ -1150,20 +1215,41 @@ process.stdin.on('end', async () => {
       }
       const updateCache = readUpdateCheckCache(installedVersion);
       let bannerLines = [];
+      let updateConsentContext = null;
       if (installedVersion) {
         const deprecation = buildDeprecationBanner(installedVersion, updateCache);
         if (deprecation.length > 0) {
           bannerLines = deprecation;
         } else {
-          bannerLines = buildUpdateAvailableBanner(installedVersion, updateCache,
-            () => detectInstallChannelHook(resolvePluginRoot(import.meta.url)));
+          const channel = detectInstallChannelHook(resolvePluginRoot(import.meta.url));
+          const consent = buildUpdateConsentPrompt(data.session_id, installedVersion, updateCache, channel);
+          if (consent) {
+            // The first-use notice is the authoritative update message for
+            // this session. Do not append the softer 24h banner as well; a
+            // source/plugin user would otherwise see two contradictory
+            // update instructions in one SessionStart payload.
+            bannerLines = [consent.system];
+            updateConsentContext = consent.context;
+          } else if (readUpdatePromptClaim(data.session_id, installedVersion, updateCache?.latestVersion)) {
+            // A first-use notice was already shown (and may have been
+            // answered by UserPromptSubmit). Suppress the routine banner for
+            // the rest of this session as well.
+            bannerLines = [];
+          } else {
+            bannerLines = buildUpdateAvailableBanner(installedVersion, updateCache, () => channel);
+          }
         }
       }
       const finalMessage = bannerLines.length > 0
         ? [...bannerLines.filter(l => l.length > 0), '', summary].join('\n')
         : summary;
 
-      output(withCaptureWarning(finalMessage), memoryContext);
+      output(withCaptureWarning(finalMessage), updateConsentContext
+        ? `${updateConsentContext}\n\n${memoryContext}`
+        : memoryContext);
+      if (updateConsentContext) {
+        finalizeUpdatePromptClaim(data.session_id, installedVersion, updateCache?.latestVersion);
+      }
 
       // Pre-read the noise-compression throttle on the handle we already
       // hold. compressWeeklyNoise() re-checks under its own connection, but

package/scripts/hooks/session-summary.js

@@ -15,6 +15,7 @@ import {
   extractCitedMemoryIds,
   getMemeshDirFromDbPath,
   getProjectName,
+  findAutoUpdateConsent,
   isAutoCaptureEnabled,
   openHookDb,
   readUpdateCheckCache,
@@ -40,7 +41,7 @@ try {
   // Best-effort: source checkouts may not have built dist output yet.
 }
 
-async function runAutoUpdateAtStop() {
+async function runAutoUpdateAtStop(sessionId) {
   try {
     const pluginRoot = resolvePluginRoot(import.meta.url);
     const pkg = JSON.parse(readFileSync(join(pluginRoot, 'package.json'), 'utf8'));
@@ -50,7 +51,14 @@ async function runAutoUpdateAtStop() {
     const cache = readUpdateCheckCache(installedVersion);
     const policy = resolveAutoUpdatePolicy(process.env);
     const decision = decideAutoUpdateHook(installedVersion, cache, policy);
-    if (decision.run) await spawnAutoUpdate(decision.latest, installChannel);
+    let channel = 'unknown';
+    try { channel = installChannel?.getCurrentInstallChannel({ packageRoot: pluginRoot }) ?? 'unknown'; } catch { /* best-effort */ }
+    const consent = decision.run
+      ? findAutoUpdateConsent(sessionId, installedVersion, decision.latest, channel)
+      : null;
+    if (decision.run && consent?.decision === 'approved') {
+      await spawnAutoUpdate(decision.latest, installChannel);
+    }
   } catch {
     // Best-effort: update failures must never break session capture.
   }
@@ -204,6 +212,7 @@ let input = '';
 process.stdin.setEncoding('utf8');
 process.stdin.on('data', (chunk) => { input += chunk; });
 process.stdin.on('end', async () => {
+  let sessionId = 'unknown';
   try {
     if (!input.trim()) return exit0();
 
@@ -224,7 +233,7 @@ process.stdin.on('end', async () => {
       return exit0();
     }
 
-    const sessionId = inputData.session_id || 'unknown';
+    sessionId = inputData.session_id || 'unknown';
     const transcriptPath = inputData.transcript_path;
 
     // `cwd` decides the project tag, and the project tag decides which
@@ -337,6 +346,10 @@ process.stdin.on('end', async () => {
       ).get(`session-${sessionId}-files`, `session-${sessionId}-fixes`, `session-${sessionId}-summary`);
       if (alreadyCaptured) {
         recordHookRun(db, 'session-summary');
+        // A duplicate capture is still a completed Stop lifecycle. Update
+        // consent is session-scoped and must not be skipped merely because
+        // the same transcript was observed twice (a common host retry).
+        await runAutoUpdateAtStop(sessionId);
         return exit0();
       }
 
@@ -587,7 +600,7 @@ process.stdin.on('end', async () => {
 
   // Update only after all session work so installed files cannot change while
   // this hook is still reading them.
-  await runAutoUpdateAtStop();
+  await runAutoUpdateAtStop(sessionId);
 
   // Emit NOTHING on success — not `{"suppressOutput": true}`.
   //