@plur-ai/cli 0.9.10 → 0.9.12

package/README.md

@@ -21,7 +21,7 @@ npx @plur-ai/cli@0.9.4 status
 ## Quick Start
 
 ```bash
-# Install Claude Code hooks (automatic memory injection)
+# Install Claude Code hooks + local hook binary (automatic memory injection)
 plur init
 
 # Store a learning
@@ -59,7 +59,8 @@ plur forget ENG-2026-0329-001
 | `plur sync` | Cross-device sync via git |
 | `plur packs list` | List installed engram packs |
 | `plur packs install <source>` | Install an engram pack |
-| `plur init` | Install Claude Code hooks for automatic injection |
+| `plur init` | Install Claude Code hooks + local hook binary for automatic injection |
+| `plur doctor` | Diagnose installation health (hooks, MCP, shim, embedder) |
 
 ## Global Flags
 

package/dist/commands/{chunk-57GFJSEE.js → chunk-OAIEWP3Q.js}

@@ -2,7 +2,16 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
 import { join, dirname } from "path";
 import { homedir, platform } from "os";
+function findMcpShim() {
+  const name = platform() === "win32" ? "plur-mcp.cmd" : "plur-mcp";
+  const path = join(homedir(), ".plur", "bin", name);
+  return existsSync(path) ? path : null;
+}
 function buildMcpServerEntry() {
+  const shim = findMcpShim();
+  if (shim) {
+    return { command: shim, args: [] };
+  }
   if (platform() === "win32") {
     return {
       command: "cmd.exe",

package/dist/commands/doctor.js

@@ -4,29 +4,80 @@ import {
   hasPlurMcp,
   knownConfigFiles,
   readConfig
-} from "./chunk-57GFJSEE.js";
+} from "./chunk-OAIEWP3Q.js";
 import {
   outputJson,
   outputText,
   shouldOutputJson
 } from "./chunk-7U4W4J3G.js";
-import {
-  createPlur
-} from "./chunk-O6WTH7H7.js";
 
 // src/commands/doctor.ts
 import { spawn } from "child_process";
+import { existsSync, readFileSync, realpathSync } from "fs";
+import { join, extname } from "path";
+import { homedir, platform } from "os";
 function hasAnyPlurHook(config) {
   const hooks = config.hooks ?? {};
   for (const entries of Object.values(hooks)) {
     for (const entry of entries) {
       for (const h of entry.hooks ?? []) {
-        if (h.command && h.command.includes("@plur-ai/cli")) return true;
+        if (h.command && (h.command.includes("@plur-ai/cli") || h.command.includes(".plur/bin/plur-hook"))) return true;
+      }
+    }
+  }
+  return false;
+}
+function hasStaleNpxHooks(config) {
+  const hooks = config.hooks ?? {};
+  for (const entries of Object.values(hooks)) {
+    for (const entry of entries) {
+      for (const h of entry.hooks ?? []) {
+        if (h.command && h.command.includes("npx") && h.command.includes("@plur-ai/cli")) return true;
       }
     }
   }
   return false;
 }
+function hasStaleNpxMcp(config) {
+  const servers = config.mcpServers ?? {};
+  const plur = servers.plur;
+  if (!plur) return false;
+  if (plur.command && plur.command.includes("npx")) return true;
+  const argsBlob = (plur.args ?? []).join(" ");
+  return argsBlob.includes("npx") && argsBlob.includes("@plur-ai/mcp");
+}
+function validateMcpShim() {
+  const name = platform() === "win32" ? "plur-mcp.cmd" : "plur-mcp";
+  const path = join(homedir(), ".plur", "bin", name);
+  if (!existsSync(path)) {
+    return { valid: false, shimPath: path, error: "shim not found \u2014 run `plur init` to create it (requires @plur-ai/mcp installed alongside CLI)" };
+  }
+  const content = readFileSync(path, "utf-8");
+  const match = content.match(/"([^"]+index\.js)"/);
+  if (!match) {
+    return { valid: false, shimPath: path, error: "shim has unexpected format" };
+  }
+  if (!existsSync(match[1])) {
+    return { valid: false, shimPath: path, error: `entrypoint missing: ${match[1]} \u2014 run \`plur init\` to fix` };
+  }
+  return { valid: true, shimPath: path };
+}
+function validateHookShim() {
+  const name = platform() === "win32" ? "plur-hook.cmd" : "plur-hook";
+  const path = join(homedir(), ".plur", "bin", name);
+  if (!existsSync(path)) {
+    return { valid: false, shimPath: path, error: "shim not found \u2014 run `plur init` to create it" };
+  }
+  const content = readFileSync(path, "utf-8");
+  const match = content.match(/"([^"]+index\.js)"/);
+  if (!match) {
+    return { valid: false, shimPath: path, error: "shim has unexpected format" };
+  }
+  if (!existsSync(match[1])) {
+    return { valid: false, shimPath: path, error: `entrypoint missing: ${match[1]} \u2014 run \`plur init\` to fix` };
+  }
+  return { valid: true, shimPath: path };
+}
 function inspectConfigs() {
   return knownConfigFiles().map((cf) => {
     if (!cf.exists) {
@@ -121,46 +172,117 @@ async function mcpHandshake(timeoutMs = 2e4) {
     proc.stdin?.write(JSON.stringify(initRequest) + "\n");
   });
 }
-async function checkEmbedder(flags) {
+function resolveCliJsEntry() {
+  const argv1 = process.argv[1];
+  if (!argv1) return null;
+  let resolved;
   try {
-    const plur = createPlur(flags);
-    const preStatus = plur.embedderStatus();
-    if (!preStatus.disabled) {
-      plur.resetEmbedder();
-      try {
-        await plur.recallSemantic("plur doctor probe", { limit: 1 });
-      } catch {
-      }
-    }
-    const status = plur.embedderStatus();
-    return {
-      available: status.available,
-      loaded: status.loaded,
-      lastError: status.lastError,
-      modelLoaded: status.available && status.loaded,
-      disabled: status.disabled,
-      disabledReason: status.disabledReason
-    };
-  } catch (err) {
-    return {
+    resolved = realpathSync(argv1);
+  } catch {
+    return null;
+  }
+  const ext = extname(resolved).toLowerCase();
+  if (ext !== ".js" && ext !== ".mjs" && ext !== ".cjs") return null;
+  return resolved;
+}
+async function checkEmbedder(_flags, timeoutMs = 1e4) {
+  return new Promise((resolve) => {
+    const fallback = (lastError) => ({
       available: false,
       loaded: false,
-      lastError: err instanceof Error ? err.message : String(err),
+      lastError,
       modelLoaded: false,
       disabled: false,
       disabledReason: null
+    });
+    const cliEntry = resolveCliJsEntry();
+    if (!cliEntry) {
+      resolve(fallback("embedder probe skipped: CLI entry is not a JS file (compiled binary?)"));
+      return;
+    }
+    let resolved = false;
+    const finish = (result) => {
+      if (resolved) return;
+      resolved = true;
+      try {
+        proc.kill();
+      } catch {
+      }
+      resolve(result);
     };
-  }
+    let proc;
+    try {
+      proc = spawn(process.execPath, [cliEntry, "_embedder-probe"], {
+        stdio: ["ignore", "pipe", "pipe"],
+        // Mark the subprocess as the parent-spawned probe — the probe checks
+        // this and refuses to run if invoked directly by a curious user.
+        env: { ...process.env, PLUR_INTERNAL_PROBE: "1" }
+      });
+    } catch (err) {
+      finish(fallback(`spawn failed: ${err.message}`));
+      return;
+    }
+    const timeout = setTimeout(() => {
+      finish(fallback(`probe timeout after ${timeoutMs}ms`));
+    }, timeoutMs);
+    let stdoutBuf = "";
+    let stderrBuf = "";
+    proc.stdout?.on("data", (chunk) => {
+      stdoutBuf += chunk.toString("utf8");
+    });
+    proc.stderr?.on("data", (chunk) => {
+      stderrBuf += chunk.toString("utf8");
+    });
+    proc.on("error", (err) => {
+      clearTimeout(timeout);
+      finish(fallback(`probe spawn error: ${err.message}`));
+    });
+    proc.on("exit", (code, signal) => {
+      clearTimeout(timeout);
+      const lines = stdoutBuf.split("\n").map((l) => l.trim()).filter((l) => l.startsWith("{"));
+      const resultLine = lines[lines.length - 1];
+      if (resultLine) {
+        try {
+          const parsed = JSON.parse(resultLine);
+          finish({
+            available: !!parsed.available,
+            loaded: !!parsed.loaded,
+            lastError: parsed.lastError ?? null,
+            modelLoaded: !!parsed.modelLoaded,
+            disabled: !!parsed.disabled,
+            disabledReason: parsed.disabledReason ?? null
+          });
+          return;
+        } catch {
+        }
+      }
+      const detail = signal ? `signal ${signal}` : `exit ${code}`;
+      const stderrTrim = stderrBuf.trim().slice(0, 200);
+      finish(fallback(`embedder probe failed (${detail})${stderrTrim ? `: ${stderrTrim}` : ""}`));
+    });
+  });
 }
 function buildReport(skipHandshake, flags) {
   const configs = inspectConfigs();
   const hooksInstalled = configs.some((c) => c.hasPlurHooks);
   const mcpRegistered = configs.some((c) => c.hasPlurMcp);
   const datacoreCollision = configs.some((c) => c.hasDatacoreMcp);
+  const staleNpxHooks = configs.some((c) => {
+    if (!c.exists) return false;
+    const config = readConfig(c.path);
+    return hasStaleNpxHooks(config);
+  });
+  const staleNpxMcp = configs.some((c) => {
+    if (!c.exists) return false;
+    const config = readConfig(c.path);
+    return hasStaleNpxMcp(config);
+  });
+  const hookShim = validateHookShim();
+  const mcpShim = validateMcpShim();
   const handshakePromise = skipHandshake ? Promise.resolve({ ok: false, error: "skipped (--no-handshake)" }) : mcpHandshake();
   return Promise.all([handshakePromise, checkEmbedder(flags)]).then(([handshake, embedder]) => {
     const overall = hooksInstalled && mcpRegistered && (skipHandshake || handshake.ok) ? "ok" : "fail";
-    return { configs, hooksInstalled, mcpRegistered, datacoreCollision, handshake, embedder, overall };
+    return { configs, hooksInstalled, mcpRegistered, datacoreCollision, staleNpxHooks, staleNpxMcp, hookShim, mcpShim, handshake, embedder, overall };
   });
 }
 function printText(report) {
@@ -192,6 +314,29 @@ function printText(report) {
     outputText("   If your agent confuses them, this is the cause.");
   }
   outputText("");
+  if (report.hookShim.valid) {
+    outputText(`\u2713 Hook shim: ${report.hookShim.shimPath}`);
+  } else {
+    outputText(`\u2717 Hook shim: ${report.hookShim.error}`);
+  }
+  if (report.staleNpxHooks) {
+    outputText("");
+    outputText("\u26A0  Hooks still use npx \u2014 slow (200-2000ms per hook) and vulnerable to cache corruption.");
+    outputText("   Fix: run `plur init` to migrate to the local hook binary (<5ms per hook).");
+  }
+  if (report.mcpShim.valid) {
+    outputText(`\u2713 MCP shim:  ${report.mcpShim.shimPath}`);
+  } else {
+    outputText(`\u2717 MCP shim:  ${report.mcpShim.error}`);
+  }
+  if (report.staleNpxMcp) {
+    outputText("");
+    outputText("\u26A0  plur MCP still launched via npx \u2014 vulnerable to ENOTEMPTY cache corruption on version bumps (#234).");
+    outputText("   This is the same bug class as #178 (which fixed hooks). Symptom: Claude Code");
+    outputText("   sessions silently lose PLUR memory after a new @plur-ai/mcp publish.");
+    outputText("   Fix: run `plur init` to migrate to the local MCP binary (no npx, no race).");
+  }
+  outputText("");
   if (report.handshake.ok) {
     outputText(`\u2713 MCP handshake: ${report.handshake.serverName} v${report.handshake.serverVersion}`);
   } else {

package/dist/commands/embedder-probe.js

@@ -0,0 +1,47 @@
+import {
+  createPlur
+} from "./chunk-O6WTH7H7.js";
+
+// src/commands/embedder-probe.ts
+async function run(_args, flags) {
+  if (process.env.PLUR_INTERNAL_PROBE !== "1") {
+    process.stderr.write(
+      "_embedder-probe is an internal subcommand spawned by `plur doctor`. Run `plur doctor` instead.\n"
+    );
+    process.exit(1);
+  }
+  try {
+    const plur = createPlur(flags);
+    const preStatus = plur.embedderStatus();
+    if (!preStatus.disabled) {
+      plur.resetEmbedder();
+      try {
+        await plur.recallSemantic("plur doctor probe", { limit: 1 });
+      } catch {
+      }
+    }
+    const status = plur.embedderStatus();
+    process.stdout.write(JSON.stringify({
+      available: status.available,
+      loaded: status.loaded,
+      lastError: status.lastError,
+      modelLoaded: status.available && status.loaded,
+      disabled: status.disabled,
+      disabledReason: status.disabledReason
+    }) + "\n");
+    process.exit(0);
+  } catch (err) {
+    process.stdout.write(JSON.stringify({
+      available: false,
+      loaded: false,
+      lastError: err instanceof Error ? err.message : String(err),
+      modelLoaded: false,
+      disabled: false,
+      disabledReason: null
+    }) + "\n");
+    process.exit(0);
+  }
+}
+export {
+  run
+};

package/dist/commands/hook-inject.js

@@ -3,10 +3,11 @@ import {
 } from "./chunk-O6WTH7H7.js";
 
 // src/commands/hook-inject.ts
-import { existsSync, writeFileSync, readFileSync, appendFileSync, mkdirSync, readSync, statSync } from "fs";
-import { dirname, join, resolve } from "path";
+import { existsSync, writeFileSync, readFileSync, appendFileSync, mkdirSync, readSync, statSync, readdirSync, unlinkSync } from "fs";
+import { join } from "path";
 import { tmpdir, homedir } from "os";
 import { randomUUID } from "crypto";
+import { readProjectConfig } from "@plur-ai/core";
 var MAX_REMOTE_TASK_CHARS = 1e3;
 var MAX_REMOTE_RESPONSE_BYTES = 128 * 1024;
 var REMOTE_TIMEOUT_MS = 1500;
@@ -22,83 +23,6 @@ function logRemoteAttempt(entry) {
   }
 }
 var REMINDER_INTERVAL_MS = 10 * 60 * 1e3;
-function findProjectConfigPath(startDir = process.cwd()) {
-  const home = resolve(homedir());
-  let dir = resolve(startDir);
-  const MAX_DEPTH = 12;
-  for (let depth = 0; depth < MAX_DEPTH; depth++) {
-    if (dir !== home) {
-      const candidate = join(dir, ".plur.yaml");
-      if (existsSync(candidate)) return candidate;
-    }
-    if (existsSync(join(dir, ".git"))) return null;
-    if (dir === home || dir === "/" || dir === ".") return null;
-    const parent = dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-  return null;
-}
-function unquoteYamlValue(v) {
-  return v.replace(/^(['"])(.*)\1$/, "$2");
-}
-function readProjectConfig() {
-  const configPath = findProjectConfigPath();
-  if (!configPath) return {};
-  try {
-    const content = readFileSync(configPath, "utf8").replace(/^/, "");
-    const config = {};
-    let inListKey = null;
-    let listAcc = [];
-    const finishList = () => {
-      if (inListKey === "remote_scopes") {
-        config.remote_scopes = listAcc;
-      }
-      inListKey = null;
-      listAcc = [];
-    };
-    for (const rawLine of content.split("\n")) {
-      const line = rawLine.replace(/\r$/, "");
-      const trimmed = line.trim();
-      if (trimmed.startsWith("#") || !trimmed) continue;
-      if (inListKey === "remote_scopes" && trimmed.startsWith("-")) {
-        listAcc.push(unquoteYamlValue(trimmed.slice(1).trim()));
-        continue;
-      }
-      if (inListKey) finishList();
-      const colonIdx = trimmed.indexOf(":");
-      if (colonIdx < 0) continue;
-      const key = trimmed.slice(0, colonIdx).trim();
-      const value = unquoteYamlValue(trimmed.slice(colonIdx + 1).trim());
-      switch (key) {
-        case "domain":
-          config.domain = value;
-          break;
-        case "scope":
-          config.scope = value;
-          break;
-        case "remote_url":
-          config.remote_url = value;
-          break;
-        case "remote_token":
-          config.remote_token = value;
-          break;
-        case "remote_scopes":
-          if (value === "" || value === "|" || value === ">") {
-            inListKey = "remote_scopes";
-            listAcc = [];
-          } else {
-            config.remote_scopes = value.split(",").map((s) => unquoteYamlValue(s.trim())).filter(Boolean);
-          }
-          break;
-      }
-    }
-    finishList();
-    return config;
-  } catch {
-    return {};
-  }
-}
 async function tryRemoteInject(config, task) {
   if (!config.remote_url || !config.remote_token) return null;
   const startTs = Date.now();
@@ -228,6 +152,44 @@ function extractEventTask(input, event) {
       return "";
   }
 }
+function processDeferredWrapups() {
+  const plurDir = process.env.PLUR_PATH ?? join(homedir(), ".plur");
+  const sessionsDir = join(plurDir, "sessions");
+  if (!existsSync(sessionsDir)) return null;
+  const notices = [];
+  try {
+    const files = readdirSync(sessionsDir).filter((f) => f.endsWith(".checkpoint.json"));
+    const now = Date.now();
+    const staleMin = parseInt(process.env.PLUR_CHECKPOINT_STALE_MIN ?? "5", 10);
+    const STALE_THRESHOLD_MS = Math.max(1, staleMin) * 60 * 1e3;
+    for (const file of files) {
+      const path = join(sessionsDir, file);
+      try {
+        const checkpoint = JSON.parse(readFileSync(path, "utf8"));
+        const lastCheckpoint = new Date(checkpoint.last_checkpoint).getTime();
+        if (now - lastCheckpoint < STALE_THRESHOLD_MS) continue;
+        const started = new Date(checkpoint.started_at);
+        const ended = new Date(checkpoint.last_checkpoint);
+        const durationMin = Math.round((ended.getTime() - started.getTime()) / 6e4);
+        const durationStr = durationMin >= 60 ? `${Math.floor(durationMin / 60)}h ${durationMin % 60}m` : `${durationMin}m`;
+        notices.push(
+          `Previous session (${durationStr}, ${checkpoint.stop_count} responses${checkpoint.cwd ? ", " + checkpoint.cwd.split("/").slice(-2).join("/") : ""}) ended without wrap-up.`
+        );
+        unlinkSync(path);
+      } catch {
+        try {
+          unlinkSync(path);
+        } catch {
+        }
+      }
+    }
+  } catch {
+    return null;
+  }
+  if (notices.length === 0) return null;
+  return `[PLUR] ${notices.join(" ")}
+Consider running plur_session_end with engram_suggestions when this session ends.`;
+}
 async function run(args, flags) {
   const isRehydrate = args.includes("--rehydrate");
   const eventIdx = args.indexOf("--event");
@@ -359,6 +321,8 @@ ${parts2.join("\n")}` };
     if (sessionId) parts.push(`Session ID: ${sessionId}`);
     if (projectConfig.domain) parts.push(`Project domain: ${projectConfig.domain}`);
     if (projectConfig.scope) parts.push(`Project scope: ${projectConfig.scope} \u2014 use this scope for plur_learn calls`);
+    const deferredNotice = processDeferredWrapups();
+    if (deferredNotice) parts.push("", deferredNotice);
   }
   if (context) {
     parts.push("");

package/dist/commands/hook-learn-check.js

@@ -1,14 +1,47 @@
 // src/commands/hook-learn-check.ts
 import { readSync, readFileSync, writeFileSync, mkdirSync } from "fs";
 import { join } from "path";
-import { tmpdir } from "os";
-var INTERVAL = 3;
+import { tmpdir, homedir } from "os";
+var LEARN_INTERVAL = 3;
+var CHECKPOINT_INTERVAL = parseInt(process.env.PLUR_CHECKPOINT_INTERVAL || "10", 10);
+function sessionKey() {
+  const raw = process.env.CLAUDE_SESSION_ID || String(process.ppid || "unknown");
+  return raw.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64) || "default";
+}
 function counterPath() {
   const dir = join(tmpdir(), "plur-sessions");
   mkdirSync(dir, { recursive: true });
-  const sessionKey = process.env.CLAUDE_SESSION_ID || String(process.ppid || "unknown");
-  const safeKey = sessionKey.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64) || "default";
-  return join(dir, `${safeKey}.stop-count`);
+  return join(dir, `${sessionKey()}.stop-count`);
+}
+function plurPath() {
+  return process.env.PLUR_PATH ?? join(homedir(), ".plur");
+}
+function checkpointDir() {
+  const dir = join(plurPath(), "sessions");
+  mkdirSync(dir, { recursive: true });
+  return dir;
+}
+function writeCheckpoint(count, cwd) {
+  const id = sessionKey();
+  const dir = checkpointDir();
+  const path = join(dir, `${id}.checkpoint.json`);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const dateStr = now.slice(0, 10);
+  let startedAt = now;
+  try {
+    const existing = JSON.parse(readFileSync(path, "utf8"));
+    if (existing.started_at) startedAt = existing.started_at;
+  } catch {
+  }
+  const checkpoint = {
+    session_id: id,
+    started_at: startedAt,
+    last_checkpoint: now,
+    stop_count: count,
+    cwd,
+    observation_file: `${dateStr}.jsonl`
+  };
+  writeFileSync(path, JSON.stringify(checkpoint, null, 2) + "\n");
 }
 function readStdinRaw() {
   try {
@@ -31,6 +64,12 @@ function readStdinRaw() {
 var LEARN_PROMPT = `[PLUR] Did you discover, learn, or get corrected on something in your last response? If yes \u2014 call plur_learn now before moving on. If no \u2014 continue.`;
 async function run(_args, _flags) {
   const raw = readStdinRaw();
+  let cwd = process.cwd();
+  try {
+    const data = JSON.parse(raw);
+    if (data.cwd) cwd = data.cwd;
+  } catch {
+  }
   const cPath = counterPath();
   let count = 1;
   try {
@@ -42,7 +81,13 @@ async function run(_args, _flags) {
     writeFileSync(cPath, String(count));
   } catch {
   }
-  if (count % INTERVAL !== 0) {
+  if (count % CHECKPOINT_INTERVAL === 0) {
+    try {
+      writeCheckpoint(count, cwd);
+    } catch {
+    }
+  }
+  if (count % LEARN_INTERVAL !== 0) {
     process.stdout.write(raw);
     return;
   }

package/dist/commands/hook-session-guard.js

@@ -3,13 +3,14 @@ import {
 } from "./chunk-6RANUJMM.js";
 
 // src/commands/hook-session-guard.ts
-import { readSync, existsSync } from "fs";
+import { readSync, existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
 import { join } from "path";
 import { tmpdir } from "os";
 var EXEMPT_TOOLS = /* @__PURE__ */ new Set([
   "mcp__plur__plur_session_start",
   "ToolSearch"
 ]);
+var MAX_BLOCKS_BEFORE_FALLBACK = 5;
 function readStdinRaw() {
   try {
     const chunks = [];
@@ -31,6 +32,22 @@ function readStdinRaw() {
 function sentinelPath(sessionId) {
   return join(tmpdir(), `plur-session-${sessionId}`);
 }
+function blockCountPath(sessionId) {
+  const dir = join(tmpdir(), "plur-sessions");
+  mkdirSync(dir, { recursive: true });
+  return join(dir, `${sessionId}.guard-count`);
+}
+function incrementBlockCount(sessionId) {
+  const path = blockCountPath(sessionId);
+  let count = 0;
+  try {
+    count = parseInt(readFileSync(path, "utf8"), 10) || 0;
+  } catch {
+  }
+  count++;
+  writeFileSync(path, String(count));
+  return count;
+}
 async function run(_args, _flags) {
   if (!isPlurConfigured()) return;
   const raw = readStdinRaw();
@@ -45,6 +62,14 @@ async function run(_args, _flags) {
   if (EXEMPT_TOOLS.has(toolName)) return;
   if (!sessionId) return;
   if (existsSync(sentinelPath(sessionId))) return;
+  const blockCount = incrementBlockCount(sessionId);
+  if (blockCount > MAX_BLOCKS_BEFORE_FALLBACK) {
+    process.stderr.write(
+      `[plur] WARNING: session guard gave up after ${MAX_BLOCKS_BEFORE_FALLBACK} blocked calls. The plur MCP server may not be running. Run \`plur doctor\` to diagnose.
+`
+    );
+    return;
+  }
   const output = {
     hookSpecificOutput: {
       hookEventName: "PreToolUse",

package/dist/commands/init.js

@@ -5,121 +5,204 @@ import {
   mergePlurMcp,
   readConfig,
   writeConfig
-} from "./chunk-57GFJSEE.js";
+} from "./chunk-OAIEWP3Q.js";
 import {
   outputText
 } from "./chunk-7U4W4J3G.js";
 
 // src/commands/init.ts
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
-import { join } from "path";
-import { homedir } from "os";
-var CLI = "npx @plur-ai/cli";
-var PLUR_HOOKS_ENFORCEMENT = {
-  SessionStart: [
-    {
-      hooks: [
-        { type: "command", command: `${CLI} hook-session-remind`, timeout: 3 }
-      ]
-    }
-  ],
-  PreToolUse: [
-    // Session guard — blocks all tools until plur_session_start is called.
-    // Must be first so it runs before any other PreToolUse hook.
-    {
-      matcher: "*",
-      hooks: [
-        { type: "command", command: `${CLI} hook-session-guard`, timeout: 3 }
-      ]
-    }
-  ],
-  PostToolUse: [
-    // Session sentinel — creates marker file after plur_session_start succeeds
-    {
-      matcher: "mcp__plur__plur_session_start",
-      hooks: [
-        { type: "command", command: `${CLI} hook-session-mark`, timeout: 3 }
-      ]
-    }
-  ]
-};
-var PLUR_HOOKS_INJECTION = {
-  // First message: inject engrams based on the prompt.
-  // Subsequent messages: periodic reminder to call plur_learn (~1ms skip).
-  UserPromptSubmit: [
-    {
-      hooks: [
-        { type: "command", command: `${CLI} hook-inject`, timeout: 15 }
-      ]
-    }
-  ],
-  // Re-inject after context compaction so engrams survive long conversations.
-  PostCompact: [
-    {
-      matcher: "auto|manual",
-      hooks: [
-        { type: "command", command: `${CLI} hook-inject --rehydrate`, timeout: 15 }
-      ]
-    }
-  ],
-  PreToolUse: [
-    // Full injection when entering plan mode — planning needs broad context
-    {
-      matcher: "EnterPlanMode",
-      hooks: [
-        { type: "command", command: `${CLI} hook-inject --event plan_mode`, timeout: 10 }
-      ]
-    },
-    // Domain-specific engrams when a skill is invoked
-    {
-      matcher: "Skill",
-      hooks: [
-        { type: "command", command: `${CLI} hook-inject --event skill`, timeout: 10 }
-      ]
-    },
-    // Agent-scoped engrams when spawning an agent
-    {
-      matcher: "Agent",
-      hooks: [
-        { type: "command", command: `${CLI} hook-inject --event agent`, timeout: 10 }
-      ]
-    },
-    // Observation capture — log tool calls for offline pattern extraction
-    {
-      matcher: "Bash|Edit|Write|Agent",
-      hooks: [
-        { type: "command", command: `${CLI} hook-observe`, timeout: 3 }
-      ]
-    }
-  ],
-  PostToolUse: [
-    {
-      matcher: "Bash|Edit|Write|Agent",
-      hooks: [
-        { type: "command", command: `${CLI} hook-observe --post`, timeout: 3 }
-      ]
-    }
-  ],
-  // Inject agent-scoped engrams into subagent context
-  SubagentStart: [
-    {
-      matcher: ".*",
-      hooks: [
-        { type: "command", command: `${CLI} hook-inject --event subagent`, timeout: 10 }
-      ]
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from "fs";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+import { homedir, platform } from "os";
+function resolveCliEntrypoint() {
+  const thisFile = fileURLToPath(import.meta.url);
+  return join(dirname(thisFile), "..", "index.js");
+}
+function shimPath() {
+  const name = platform() === "win32" ? "plur-hook.cmd" : "plur-hook";
+  return join(homedir(), ".plur", "bin", name);
+}
+function installHookBinary() {
+  const binDir = join(homedir(), ".plur", "bin");
+  mkdirSync(binDir, { recursive: true });
+  const entrypoint = resolveCliEntrypoint();
+  const nodeBin = process.execPath;
+  if (!existsSync(entrypoint)) {
+    return { shimPath: "", status: `error: CLI entrypoint not found at ${entrypoint}` };
+  }
+  const target = shimPath();
+  if (platform() === "win32") {
+    writeFileSync(target, `@echo off\r
+"${nodeBin}" "${entrypoint}" %*\r
+`);
+  } else {
+    writeFileSync(target, `#!/bin/sh
+exec "${nodeBin}" "${entrypoint}" "$@"
+`, { mode: 493 });
+    try {
+      chmodSync(target, 493);
+    } catch {
     }
-  ],
-  // Learning reflection — nudge the LLM to call plur_learn after responses
-  // where it discovered or learned something. Fires every 3rd Stop to avoid fatigue.
-  Stop: [
-    {
-      matcher: "*",
-      hooks: [
-        { type: "command", command: `${CLI} hook-learn-check`, timeout: 2 }
-      ]
+  }
+  const meta = { entrypoint, node: nodeBin, installed: (/* @__PURE__ */ new Date()).toISOString() };
+  writeFileSync(join(binDir, "plur-hook.meta.json"), JSON.stringify(meta, null, 2) + "\n");
+  return { shimPath: target, status: "installed" };
+}
+function resolveMcpEntrypoint() {
+  const cliEntry = resolveCliEntrypoint();
+  let dir = dirname(cliEntry);
+  const MAX_DEPTH = 12;
+  for (let depth = 0; depth < MAX_DEPTH; depth++) {
+    const candidate = join(dir, "node_modules", "@plur-ai", "mcp", "dist", "index.js");
+    if (existsSync(candidate)) return candidate;
+    const adjacent = join(dir, "..", "@plur-ai", "mcp", "dist", "index.js");
+    if (existsSync(adjacent)) return adjacent;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function mcpShimPath() {
+  const name = platform() === "win32" ? "plur-mcp.cmd" : "plur-mcp";
+  return join(homedir(), ".plur", "bin", name);
+}
+function installMcpBinary() {
+  const binDir = join(homedir(), ".plur", "bin");
+  mkdirSync(binDir, { recursive: true });
+  const entrypoint = resolveMcpEntrypoint();
+  const nodeBin = process.execPath;
+  if (!entrypoint) {
+    return { shimPath: "", status: "skipped: @plur-ai/mcp not installed alongside CLI" };
+  }
+  const target = mcpShimPath();
+  if (platform() === "win32") {
+    writeFileSync(target, `@echo off\r
+"${nodeBin}" "${entrypoint}" %*\r
+`);
+  } else {
+    writeFileSync(target, `#!/bin/sh
+exec "${nodeBin}" "${entrypoint}" "$@"
+`, { mode: 493 });
+    try {
+      chmodSync(target, 493);
+    } catch {
     }
-  ]
-};
+  }
+  const meta = { entrypoint, node: nodeBin, installed: (/* @__PURE__ */ new Date()).toISOString() };
+  writeFileSync(join(binDir, "plur-mcp.meta.json"), JSON.stringify(meta, null, 2) + "\n");
+  return { shimPath: target, status: "installed" };
+}
+function buildEnforcementHooks(cmd) {
+  return {
+    SessionStart: [
+      {
+        hooks: [
+          { type: "command", command: `${cmd} hook-session-remind`, timeout: 3 }
+        ]
+      }
+    ],
+    PreToolUse: [
+      // Session guard — blocks all tools until plur_session_start is called.
+      // Must be first so it runs before any other PreToolUse hook.
+      {
+        matcher: "*",
+        hooks: [
+          { type: "command", command: `${cmd} hook-session-guard`, timeout: 3 }
+        ]
+      }
+    ],
+    PostToolUse: [
+      // Session sentinel — creates marker file after plur_session_start succeeds
+      {
+        matcher: "mcp__plur__plur_session_start",
+        hooks: [
+          { type: "command", command: `${cmd} hook-session-mark`, timeout: 3 }
+        ]
+      }
+    ]
+  };
+}
+function buildInjectionHooks(cmd) {
+  return {
+    // First message: inject engrams based on the prompt.
+    // Subsequent messages: periodic reminder to call plur_learn (~1ms skip).
+    UserPromptSubmit: [
+      {
+        hooks: [
+          { type: "command", command: `${cmd} hook-inject`, timeout: 15 }
+        ]
+      }
+    ],
+    // Re-inject after context compaction so engrams survive long conversations.
+    PostCompact: [
+      {
+        matcher: "auto|manual",
+        hooks: [
+          { type: "command", command: `${cmd} hook-inject --rehydrate`, timeout: 15 }
+        ]
+      }
+    ],
+    PreToolUse: [
+      // Full injection when entering plan mode — planning needs broad context
+      {
+        matcher: "EnterPlanMode",
+        hooks: [
+          { type: "command", command: `${cmd} hook-inject --event plan_mode`, timeout: 10 }
+        ]
+      },
+      // Domain-specific engrams when a skill is invoked
+      {
+        matcher: "Skill",
+        hooks: [
+          { type: "command", command: `${cmd} hook-inject --event skill`, timeout: 10 }
+        ]
+      },
+      // Agent-scoped engrams when spawning an agent
+      {
+        matcher: "Agent",
+        hooks: [
+          { type: "command", command: `${cmd} hook-inject --event agent`, timeout: 10 }
+        ]
+      },
+      // Observation capture — log tool calls for offline pattern extraction
+      {
+        matcher: "Bash|Edit|Write|Agent",
+        hooks: [
+          { type: "command", command: `${cmd} hook-observe`, timeout: 3 }
+        ]
+      }
+    ],
+    PostToolUse: [
+      {
+        matcher: "Bash|Edit|Write|Agent",
+        hooks: [
+          { type: "command", command: `${cmd} hook-observe --post`, timeout: 3 }
+        ]
+      }
+    ],
+    // Inject agent-scoped engrams into subagent context
+    SubagentStart: [
+      {
+        matcher: ".*",
+        hooks: [
+          { type: "command", command: `${cmd} hook-inject --event subagent`, timeout: 10 }
+        ]
+      }
+    ],
+    // Learning reflection — nudge the LLM to call plur_learn after responses
+    // where it discovered or learned something. Fires every 3rd Stop to avoid fatigue.
+    Stop: [
+      {
+        matcher: "*",
+        hooks: [
+          { type: "command", command: `${cmd} hook-learn-check`, timeout: 2 }
+        ]
+      }
+    ]
+  };
+}
 function mergeHookMaps(a, b) {
   const out = {};
   for (const [event, entries] of Object.entries(a)) out[event] = [...entries];
@@ -224,7 +307,9 @@ function loadSettings(path) {
   }
 }
 function isPlurHook(entry) {
-  return (entry.hooks ?? []).some((h) => h.command.includes("@plur-ai/cli"));
+  return (entry.hooks ?? []).some(
+    (h) => h.command.includes("@plur-ai/cli") || h.command.includes(".plur/bin/plur-hook")
+  );
 }
 function hasPlurHooks(settings) {
   const hooks = settings.hooks ?? {};
@@ -278,6 +363,11 @@ function hooksStatusFor(before, after, hadHooks) {
   return before === after ? "already up to date" : "upgraded";
 }
 async function run(args, flags) {
+  const shim = installHookBinary();
+  const cmd = shim.shimPath || "npx @plur-ai/cli";
+  const mcpShim = installMcpBinary();
+  const PLUR_HOOKS_ENFORCEMENT = buildEnforcementHooks(cmd);
+  const PLUR_HOOKS_INJECTION = buildInjectionHooks(cmd);
   const injectionPath = findSettingsPath(flags, args);
   const enforcementPath = join(homedir(), ".claude", "settings.json");
   const samePath = injectionPath === enforcementPath;
@@ -330,6 +420,9 @@ async function run(args, flags) {
   const entry = buildMcpServerEntry();
   outputText("PLUR installed for Claude Code.");
   outputText("");
+  outputText(`Hook binary: ${shim.status}${shim.shimPath ? ` (${shim.shimPath})` : ""}`);
+  outputText(`MCP binary:  ${mcpShim.status}${mcpShim.shimPath ? ` (${mcpShim.shimPath})` : ""}`);
+  outputText("");
   outputText("Architecture: One global engram store (~/.plur/), enforcement hooks global, injection hooks project-scoped.");
   outputText("Multi-project scoping via domain/scope fields on engrams, not separate installs.");
   outputText("");

package/dist/commands/stores.js

@@ -29,7 +29,7 @@ async function run(args, flags) {
     return;
   }
   if (!subcommand || subcommand === "list") {
-    const storeList = plur.listStores();
+    const storeList = await plur.listStoresAsync();
     if (shouldOutputJson(flags)) {
       outputJson({ stores: storeList, count: storeList.length });
     } else {

package/dist/commands/tensions.js

@@ -0,0 +1,168 @@
+import {
+  exit,
+  outputJson,
+  outputText,
+  shouldOutputJson
+} from "./chunk-7U4W4J3G.js";
+import {
+  createPlur
+} from "./chunk-O6WTH7H7.js";
+
+// src/commands/tensions.ts
+function makeHttpLlm(baseUrl, apiKey, model = "gpt-4o-mini") {
+  return async (prompt) => {
+    const response = await fetch(`${baseUrl.replace(/\/$/, "")}/chat/completions`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${apiKey}`
+      },
+      body: JSON.stringify({
+        model,
+        messages: [{ role: "user", content: prompt }],
+        temperature: 0.1
+      })
+    });
+    if (!response.ok) {
+      throw new Error(`LLM API error: ${response.status} ${response.statusText}`);
+    }
+    const data = await response.json();
+    return data.choices?.[0]?.message?.content ?? "";
+  };
+}
+function getLlmFunction() {
+  const openrouterKey = process.env.OPENROUTER_API_KEY;
+  const openaiKey = process.env.OPENAI_API_KEY;
+  if (openrouterKey) return makeHttpLlm("https://openrouter.ai/api/v1", openrouterKey, "openai/gpt-4o-mini");
+  if (openaiKey) return makeHttpLlm("https://api.openai.com/v1", openaiKey, "gpt-4o-mini");
+  return void 0;
+}
+async function run(args, flags) {
+  let scan = false;
+  let scope;
+  let domain;
+  let minConfidence = 0.7;
+  let maxPairs = 50;
+  let llmBaseUrl;
+  let llmApiKey;
+  let llmModel;
+  let i = 0;
+  while (i < args.length) {
+    const arg = args[i];
+    if (arg === "--scan") {
+      scan = true;
+      i++;
+    } else if (arg === "--scope" && i + 1 < args.length) {
+      scope = args[++i];
+      i++;
+    } else if (arg === "--domain" && i + 1 < args.length) {
+      domain = args[++i];
+      i++;
+    } else if (arg === "--min-confidence" && i + 1 < args.length) {
+      minConfidence = parseFloat(args[++i]);
+      i++;
+    } else if (arg === "--max-pairs" && i + 1 < args.length) {
+      maxPairs = parseInt(args[++i], 10);
+      i++;
+    } else if (arg === "--llm-base-url" && i + 1 < args.length) {
+      llmBaseUrl = args[++i];
+      i++;
+    } else if (arg === "--llm-api-key" && i + 1 < args.length) {
+      llmApiKey = args[++i];
+      i++;
+    } else if (arg === "--model" && i + 1 < args.length) {
+      llmModel = args[++i];
+      i++;
+    } else {
+      i++;
+    }
+  }
+  const plur = createPlur(flags, { readonly: true });
+  const engrams = plur.list({ scope, domain });
+  if (scan) {
+    const llm = llmBaseUrl ? makeHttpLlm(llmBaseUrl, llmApiKey ?? "", llmModel) : getLlmFunction();
+    if (!llm) {
+      exit(
+        1,
+        "tensions --scan requires an LLM.\nSet OPENROUTER_API_KEY or OPENAI_API_KEY, or pass --llm-base-url + --llm-api-key."
+      );
+      return;
+    }
+    if (!shouldOutputJson(flags)) {
+      outputText(`Scanning ${engrams.length} engrams for contradictions\u2026`);
+      if (scope) outputText(`  scope: ${scope}`);
+      if (domain) outputText(`  domain: ${domain}`);
+      outputText(`  min-confidence: ${minConfidence}  max-pairs: ${maxPairs}`);
+      outputText("");
+    }
+    const { scanForTensions } = await import("@plur-ai/core");
+    const result = await scanForTensions(engrams, llm, { min_confidence: minConfidence, max_pairs: maxPairs });
+    if (shouldOutputJson(flags)) {
+      outputJson({
+        pairs_checked: result.pairs_checked,
+        count: result.new_tensions,
+        tensions: result.tensions.map((t) => ({
+          engram_a: { id: t.id_a, statement: t.statement_a },
+          engram_b: { id: t.id_b, statement: t.statement_b },
+          confidence: t.confidence,
+          reason: t.reason
+        }))
+      });
+      return;
+    }
+    outputText(`Checked: ${result.pairs_checked} candidate pairs`);
+    outputText(`Found:   ${result.new_tensions} tension${result.new_tensions === 1 ? "" : "s"} (confidence >= ${minConfidence})`);
+    outputText("");
+    if (result.tensions.length === 0) {
+      outputText("No contradictions detected.");
+      return;
+    }
+    for (const t of result.tensions) {
+      outputText(`\u2500\u2500 TENSION (confidence: ${t.confidence.toFixed(2)}) \u2500\u2500`);
+      outputText(`  A [${t.id_a}]: ${t.statement_a}`);
+      outputText(`  B [${t.id_b}]: ${t.statement_b}`);
+      outputText(`  Reason: ${t.reason}`);
+      outputText("");
+    }
+    outputText("Next steps:");
+    outputText("  Resolve: determine which statement is correct, retire the other via plur forget <id>");
+    outputText("  Dismiss: if not a real conflict, both statements can coexist");
+    return;
+  }
+  const tensions = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const engram of engrams) {
+    if (!engram.relations?.conflicts?.length) continue;
+    for (const conflictId of engram.relations.conflicts) {
+      const pairKey = [engram.id, conflictId].sort().join(":");
+      if (seen.has(pairKey)) continue;
+      seen.add(pairKey);
+      const other = engrams.find((e) => e.id === conflictId);
+      if (!other) continue;
+      tensions.push({
+        engram_a: { id: engram.id, statement: engram.statement },
+        engram_b: { id: other.id, statement: other.statement },
+        detected_at: engram.activation.last_accessed
+      });
+    }
+  }
+  if (shouldOutputJson(flags)) {
+    outputJson({ tensions, count: tensions.length });
+    return;
+  }
+  if (tensions.length === 0) {
+    outputText("No stored tensions. Run `plur tensions --scan` to detect live contradictions.");
+    return;
+  }
+  outputText(`Stored tensions: ${tensions.length}`);
+  outputText("");
+  for (const t of tensions) {
+    outputText(`  A [${t.engram_a.id}]: ${t.engram_a.statement}`);
+    outputText(`  B [${t.engram_b.id}]: ${t.engram_b.statement}`);
+    outputText(`  Detected: ${t.detected_at}`);
+    outputText("");
+  }
+}
+export {
+  run
+};

package/dist/index.js

@@ -49,7 +49,7 @@ function createPlur(flags2) {
 }
 
 // src/index.ts
-var VERSION = "0.9.10";
+var VERSION = "0.9.12";
 var argv = process.argv.slice(2);
 if (argv.includes("--version") || argv.includes("-v")) {
   console.log(VERSION);
@@ -84,6 +84,7 @@ Commands:
   init                    Install Claude Code hooks + register plur MCP server
   init-remote             Opt this project into recall from a PLUR Enterprise server
   doctor                  Diagnose Claude Code / Claude Desktop integration
+  tensions [--scan]       List or scan for engram contradictions
   audit [--source X]      Audit working memory (claude-code|claw|hermes) for conflicts vs engrams
   hook-inject             (internal) Hook handler for engram injection
   hook-observe            (internal) Hook handler for observation capture
@@ -127,6 +128,7 @@ var COMMANDS = {
   init: "./commands/init.js",
   "init-remote": "./commands/init-remote.js",
   doctor: "./commands/doctor.js",
+  tensions: "./commands/tensions.js",
   audit: "./commands/audit.js",
   "hook-inject": "./commands/hook-inject.js",
   "hook-observe": "./commands/hook-observe.js",
@@ -135,7 +137,11 @@ var COMMANDS = {
   "hook-session-mark": "./commands/hook-session-mark.js",
   "hook-session-remind": "./commands/hook-session-remind.js",
   "hook-correction-detect": "./commands/hook-correction-detect.js",
-  "hook-revert-detect": "./commands/hook-revert-detect.js"
+  "hook-revert-detect": "./commands/hook-revert-detect.js",
+  // Hidden internal subcommand — spawned by `plur doctor` to isolate the
+  // ONNX embedder probe (issue #197). If the probe crashes with SIGABRT
+  // on libc++ thread pool cleanup, only the subprocess dies; doctor stays alive.
+  "_embedder-probe": "./commands/embedder-probe.js"
 };
 if (!command || !COMMANDS[command]) {
   exit(1, `Unknown command: ${command}. Run 'plur --help' for usage.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plur-ai/cli",
-  "version": "0.9.10",
+  "version": "0.9.12",
   "type": "module",
   "bin": {
     "plur": "dist/index.js"
@@ -10,7 +10,7 @@
     "dist"
   ],
   "dependencies": {
-    "@plur-ai/core": "0.9.9"
+    "@plur-ai/core": "0.9.12"
   },
   "devDependencies": {
     "@types/node": "^25.5.0"