@plur-ai/cli 0.9.9 → 0.9.11

package/README.md

@@ -21,7 +21,7 @@ npx @plur-ai/cli@0.9.4 status
 ## Quick Start
 
 ```bash
-# Install Claude Code hooks (automatic memory injection)
+# Install Claude Code hooks + local hook binary (automatic memory injection)
 plur init
 
 # Store a learning
@@ -59,7 +59,8 @@ plur forget ENG-2026-0329-001
 | `plur sync` | Cross-device sync via git |
 | `plur packs list` | List installed engram packs |
 | `plur packs install <source>` | Install an engram pack |
-| `plur init` | Install Claude Code hooks for automatic injection |
+| `plur init` | Install Claude Code hooks + local hook binary for automatic injection |
+| `plur doctor` | Diagnose installation health (hooks, MCP, shim, embedder) |
 
 ## Global Flags
 

package/dist/commands/doctor.js

@@ -10,23 +10,50 @@ import {
   outputText,
   shouldOutputJson
 } from "./chunk-7U4W4J3G.js";
-import {
-  createPlur
-} from "./chunk-O6WTH7H7.js";
 
 // src/commands/doctor.ts
 import { spawn } from "child_process";
+import { existsSync, readFileSync, realpathSync } from "fs";
+import { join, extname } from "path";
+import { homedir, platform } from "os";
 function hasAnyPlurHook(config) {
   const hooks = config.hooks ?? {};
   for (const entries of Object.values(hooks)) {
     for (const entry of entries) {
       for (const h of entry.hooks ?? []) {
-        if (h.command && h.command.includes("@plur-ai/cli")) return true;
+        if (h.command && (h.command.includes("@plur-ai/cli") || h.command.includes(".plur/bin/plur-hook"))) return true;
+      }
+    }
+  }
+  return false;
+}
+function hasStaleNpxHooks(config) {
+  const hooks = config.hooks ?? {};
+  for (const entries of Object.values(hooks)) {
+    for (const entry of entries) {
+      for (const h of entry.hooks ?? []) {
+        if (h.command && h.command.includes("npx") && h.command.includes("@plur-ai/cli")) return true;
       }
     }
   }
   return false;
 }
+function validateHookShim() {
+  const name = platform() === "win32" ? "plur-hook.cmd" : "plur-hook";
+  const path = join(homedir(), ".plur", "bin", name);
+  if (!existsSync(path)) {
+    return { valid: false, shimPath: path, error: "shim not found \u2014 run `plur init` to create it" };
+  }
+  const content = readFileSync(path, "utf-8");
+  const match = content.match(/"([^"]+index\.js)"/);
+  if (!match) {
+    return { valid: false, shimPath: path, error: "shim has unexpected format" };
+  }
+  if (!existsSync(match[1])) {
+    return { valid: false, shimPath: path, error: `entrypoint missing: ${match[1]} \u2014 run \`plur init\` to fix` };
+  }
+  return { valid: true, shimPath: path };
+}
 function inspectConfigs() {
   return knownConfigFiles().map((cf) => {
     if (!cf.exists) {
@@ -121,46 +148,111 @@ async function mcpHandshake(timeoutMs = 2e4) {
     proc.stdin?.write(JSON.stringify(initRequest) + "\n");
   });
 }
-async function checkEmbedder(flags) {
+function resolveCliJsEntry() {
+  const argv1 = process.argv[1];
+  if (!argv1) return null;
+  let resolved;
   try {
-    const plur = createPlur(flags);
-    const preStatus = plur.embedderStatus();
-    if (!preStatus.disabled) {
-      plur.resetEmbedder();
-      try {
-        await plur.recallSemantic("plur doctor probe", { limit: 1 });
-      } catch {
-      }
-    }
-    const status = plur.embedderStatus();
-    return {
-      available: status.available,
-      loaded: status.loaded,
-      lastError: status.lastError,
-      modelLoaded: status.available && status.loaded,
-      disabled: status.disabled,
-      disabledReason: status.disabledReason
-    };
-  } catch (err) {
-    return {
+    resolved = realpathSync(argv1);
+  } catch {
+    return null;
+  }
+  const ext = extname(resolved).toLowerCase();
+  if (ext !== ".js" && ext !== ".mjs" && ext !== ".cjs") return null;
+  return resolved;
+}
+async function checkEmbedder(_flags, timeoutMs = 1e4) {
+  return new Promise((resolve) => {
+    const fallback = (lastError) => ({
       available: false,
       loaded: false,
-      lastError: err instanceof Error ? err.message : String(err),
+      lastError,
       modelLoaded: false,
       disabled: false,
       disabledReason: null
+    });
+    const cliEntry = resolveCliJsEntry();
+    if (!cliEntry) {
+      resolve(fallback("embedder probe skipped: CLI entry is not a JS file (compiled binary?)"));
+      return;
+    }
+    let resolved = false;
+    const finish = (result) => {
+      if (resolved) return;
+      resolved = true;
+      try {
+        proc.kill();
+      } catch {
+      }
+      resolve(result);
     };
-  }
+    let proc;
+    try {
+      proc = spawn(process.execPath, [cliEntry, "_embedder-probe"], {
+        stdio: ["ignore", "pipe", "pipe"],
+        // Mark the subprocess as the parent-spawned probe — the probe checks
+        // this and refuses to run if invoked directly by a curious user.
+        env: { ...process.env, PLUR_INTERNAL_PROBE: "1" }
+      });
+    } catch (err) {
+      finish(fallback(`spawn failed: ${err.message}`));
+      return;
+    }
+    const timeout = setTimeout(() => {
+      finish(fallback(`probe timeout after ${timeoutMs}ms`));
+    }, timeoutMs);
+    let stdoutBuf = "";
+    let stderrBuf = "";
+    proc.stdout?.on("data", (chunk) => {
+      stdoutBuf += chunk.toString("utf8");
+    });
+    proc.stderr?.on("data", (chunk) => {
+      stderrBuf += chunk.toString("utf8");
+    });
+    proc.on("error", (err) => {
+      clearTimeout(timeout);
+      finish(fallback(`probe spawn error: ${err.message}`));
+    });
+    proc.on("exit", (code, signal) => {
+      clearTimeout(timeout);
+      const lines = stdoutBuf.split("\n").map((l) => l.trim()).filter((l) => l.startsWith("{"));
+      const resultLine = lines[lines.length - 1];
+      if (resultLine) {
+        try {
+          const parsed = JSON.parse(resultLine);
+          finish({
+            available: !!parsed.available,
+            loaded: !!parsed.loaded,
+            lastError: parsed.lastError ?? null,
+            modelLoaded: !!parsed.modelLoaded,
+            disabled: !!parsed.disabled,
+            disabledReason: parsed.disabledReason ?? null
+          });
+          return;
+        } catch {
+        }
+      }
+      const detail = signal ? `signal ${signal}` : `exit ${code}`;
+      const stderrTrim = stderrBuf.trim().slice(0, 200);
+      finish(fallback(`embedder probe failed (${detail})${stderrTrim ? `: ${stderrTrim}` : ""}`));
+    });
+  });
 }
 function buildReport(skipHandshake, flags) {
   const configs = inspectConfigs();
   const hooksInstalled = configs.some((c) => c.hasPlurHooks);
   const mcpRegistered = configs.some((c) => c.hasPlurMcp);
   const datacoreCollision = configs.some((c) => c.hasDatacoreMcp);
+  const staleNpxHooks = configs.some((c) => {
+    if (!c.exists) return false;
+    const config = readConfig(c.path);
+    return hasStaleNpxHooks(config);
+  });
+  const hookShim = validateHookShim();
   const handshakePromise = skipHandshake ? Promise.resolve({ ok: false, error: "skipped (--no-handshake)" }) : mcpHandshake();
   return Promise.all([handshakePromise, checkEmbedder(flags)]).then(([handshake, embedder]) => {
     const overall = hooksInstalled && mcpRegistered && (skipHandshake || handshake.ok) ? "ok" : "fail";
-    return { configs, hooksInstalled, mcpRegistered, datacoreCollision, handshake, embedder, overall };
+    return { configs, hooksInstalled, mcpRegistered, datacoreCollision, staleNpxHooks, hookShim, handshake, embedder, overall };
   });
 }
 function printText(report) {
@@ -192,6 +284,17 @@ function printText(report) {
     outputText("   If your agent confuses them, this is the cause.");
   }
   outputText("");
+  if (report.hookShim.valid) {
+    outputText(`\u2713 Hook shim: ${report.hookShim.shimPath}`);
+  } else {
+    outputText(`\u2717 Hook shim: ${report.hookShim.error}`);
+  }
+  if (report.staleNpxHooks) {
+    outputText("");
+    outputText("\u26A0  Hooks still use npx \u2014 slow (200-2000ms per hook) and vulnerable to cache corruption.");
+    outputText("   Fix: run `plur init` to migrate to the local hook binary (<5ms per hook).");
+  }
+  outputText("");
   if (report.handshake.ok) {
     outputText(`\u2713 MCP handshake: ${report.handshake.serverName} v${report.handshake.serverVersion}`);
   } else {

package/dist/commands/embedder-probe.js

@@ -0,0 +1,47 @@
+import {
+  createPlur
+} from "./chunk-O6WTH7H7.js";
+
+// src/commands/embedder-probe.ts
+async function run(_args, flags) {
+  if (process.env.PLUR_INTERNAL_PROBE !== "1") {
+    process.stderr.write(
+      "_embedder-probe is an internal subcommand spawned by `plur doctor`. Run `plur doctor` instead.\n"
+    );
+    process.exit(1);
+  }
+  try {
+    const plur = createPlur(flags);
+    const preStatus = plur.embedderStatus();
+    if (!preStatus.disabled) {
+      plur.resetEmbedder();
+      try {
+        await plur.recallSemantic("plur doctor probe", { limit: 1 });
+      } catch {
+      }
+    }
+    const status = plur.embedderStatus();
+    process.stdout.write(JSON.stringify({
+      available: status.available,
+      loaded: status.loaded,
+      lastError: status.lastError,
+      modelLoaded: status.available && status.loaded,
+      disabled: status.disabled,
+      disabledReason: status.disabledReason
+    }) + "\n");
+    process.exit(0);
+  } catch (err) {
+    process.stdout.write(JSON.stringify({
+      available: false,
+      loaded: false,
+      lastError: err instanceof Error ? err.message : String(err),
+      modelLoaded: false,
+      disabled: false,
+      disabledReason: null
+    }) + "\n");
+    process.exit(0);
+  }
+}
+export {
+  run
+};

package/dist/commands/hook-inject.js

@@ -3,30 +3,165 @@ import {
 } from "./chunk-O6WTH7H7.js";
 
 // src/commands/hook-inject.ts
-import { existsSync, writeFileSync, readFileSync, mkdirSync, readSync, statSync } from "fs";
-import { join } from "path";
-import { tmpdir } from "os";
+import { existsSync, writeFileSync, readFileSync, appendFileSync, mkdirSync, readSync, statSync } from "fs";
+import { dirname, join, resolve } from "path";
+import { tmpdir, homedir } from "os";
 import { randomUUID } from "crypto";
+var MAX_REMOTE_TASK_CHARS = 1e3;
+var MAX_REMOTE_RESPONSE_BYTES = 128 * 1024;
+var REMOTE_TIMEOUT_MS = 1500;
+var REMOTE_INJECT_LOG_DIR = join(homedir(), ".plur", "logs");
+function remoteInjectLogPath() {
+  return join(REMOTE_INJECT_LOG_DIR, `remote-inject-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}.jsonl`);
+}
+function logRemoteAttempt(entry) {
+  try {
+    mkdirSync(REMOTE_INJECT_LOG_DIR, { recursive: true });
+    appendFileSync(remoteInjectLogPath(), JSON.stringify(entry) + "\n");
+  } catch {
+  }
+}
 var REMINDER_INTERVAL_MS = 10 * 60 * 1e3;
+function findProjectConfigPath(startDir = process.cwd()) {
+  const home = resolve(homedir());
+  let dir = resolve(startDir);
+  const MAX_DEPTH = 12;
+  for (let depth = 0; depth < MAX_DEPTH; depth++) {
+    if (dir !== home) {
+      const candidate = join(dir, ".plur.yaml");
+      if (existsSync(candidate)) return candidate;
+    }
+    if (existsSync(join(dir, ".git"))) return null;
+    if (dir === home || dir === "/" || dir === ".") return null;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+function unquoteYamlValue(v) {
+  return v.replace(/^(['"])(.*)\1$/, "$2");
+}
 function readProjectConfig() {
-  const configPath = join(process.cwd(), ".plur.yaml");
-  if (!existsSync(configPath)) return {};
+  const configPath = findProjectConfigPath();
+  if (!configPath) return {};
   try {
-    const content = readFileSync(configPath, "utf8");
+    const content = readFileSync(configPath, "utf8").replace(/^/, "");
     const config = {};
-    for (const line of content.split("\n")) {
+    let inListKey = null;
+    let listAcc = [];
+    const finishList = () => {
+      if (inListKey === "remote_scopes") {
+        config.remote_scopes = listAcc;
+      }
+      inListKey = null;
+      listAcc = [];
+    };
+    for (const rawLine of content.split("\n")) {
+      const line = rawLine.replace(/\r$/, "");
       const trimmed = line.trim();
       if (trimmed.startsWith("#") || !trimmed) continue;
-      const [key, ...rest] = trimmed.split(":");
-      const value = rest.join(":").trim();
-      if (key === "domain") config.domain = value;
-      if (key === "scope") config.scope = value;
+      if (inListKey === "remote_scopes" && trimmed.startsWith("-")) {
+        listAcc.push(unquoteYamlValue(trimmed.slice(1).trim()));
+        continue;
+      }
+      if (inListKey) finishList();
+      const colonIdx = trimmed.indexOf(":");
+      if (colonIdx < 0) continue;
+      const key = trimmed.slice(0, colonIdx).trim();
+      const value = unquoteYamlValue(trimmed.slice(colonIdx + 1).trim());
+      switch (key) {
+        case "domain":
+          config.domain = value;
+          break;
+        case "scope":
+          config.scope = value;
+          break;
+        case "remote_url":
+          config.remote_url = value;
+          break;
+        case "remote_token":
+          config.remote_token = value;
+          break;
+        case "remote_scopes":
+          if (value === "" || value === "|" || value === ">") {
+            inListKey = "remote_scopes";
+            listAcc = [];
+          } else {
+            config.remote_scopes = value.split(",").map((s) => unquoteYamlValue(s.trim())).filter(Boolean);
+          }
+          break;
+      }
     }
+    finishList();
     return config;
   } catch {
     return {};
   }
 }
+async function tryRemoteInject(config, task) {
+  if (!config.remote_url || !config.remote_token) return null;
+  const startTs = Date.now();
+  let base;
+  try {
+    base = new URL(config.remote_url).origin;
+  } catch {
+    logRemoteAttempt({ ts: (/* @__PURE__ */ new Date()).toISOString(), url: config.remote_url ?? "?", outcome: "bad_response", ms: 0, detail: "invalid URL" });
+    return null;
+  }
+  const url = `${base}/api/v1/inject`;
+  const truncatedTask = task.length > MAX_REMOTE_TASK_CHARS ? task.slice(0, MAX_REMOTE_TASK_CHARS) : task;
+  const body = { task: truncatedTask };
+  if (config.remote_scopes && config.remote_scopes.length > 0) {
+    body.scopes = config.remote_scopes;
+  }
+  const ctrl = new AbortController();
+  const t = setTimeout(() => ctrl.abort(), REMOTE_TIMEOUT_MS);
+  try {
+    const r = await fetch(url, {
+      method: "POST",
+      signal: ctrl.signal,
+      headers: {
+        "authorization": `Bearer ${config.remote_token}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+    if (!r.ok) {
+      logRemoteAttempt({ ts: (/* @__PURE__ */ new Date()).toISOString(), url, outcome: "http_error", ms: Date.now() - startTs, http: r.status });
+      return null;
+    }
+    const contentLength = r.headers.get("content-length");
+    if (contentLength && parseInt(contentLength, 10) > MAX_REMOTE_RESPONSE_BYTES) {
+      logRemoteAttempt({ ts: (/* @__PURE__ */ new Date()).toISOString(), url, outcome: "oversize", ms: Date.now() - startTs, http: r.status, detail: `content-length=${contentLength}` });
+      return null;
+    }
+    const data = await r.json();
+    if (typeof data.text !== "string" || !data.text.trim()) {
+      logRemoteAttempt({ ts: (/* @__PURE__ */ new Date()).toISOString(), url, outcome: "bad_response", ms: Date.now() - startTs, http: r.status, detail: "empty or non-string text field" });
+      return null;
+    }
+    const count = typeof data.count === "number" ? data.count : 0;
+    logRemoteAttempt({ ts: (/* @__PURE__ */ new Date()).toISOString(), url, outcome: "ok", ms: Date.now() - startTs, http: r.status, engrams: count });
+    return {
+      text: data.text,
+      count,
+      injectedIds: Array.isArray(data.injected_ids) ? data.injected_ids : []
+    };
+  } catch (err) {
+    const isAbort = err instanceof Error && err.name === "AbortError";
+    logRemoteAttempt({
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      url,
+      outcome: isAbort ? "timeout" : "network_error",
+      ms: Date.now() - startTs,
+      detail: err instanceof Error ? err.message.slice(0, 120) : void 0
+    });
+    return null;
+  } finally {
+    clearTimeout(t);
+  }
+}
 function sessionDir() {
   const dir = join(tmpdir(), "plur-sessions");
   mkdirSync(dir, { recursive: true });
@@ -177,25 +312,36 @@ ${parts2.join("\n")}` };
   const injectOpts = projectConfig.scope ? { scope: projectConfig.scope } : void 0;
   let context = null;
   let count = 0;
-  try {
-    const result = await plur.injectHybrid(task, injectOpts);
-    if (result.count > 0) {
-      const parts2 = [];
-      if (result.directives) parts2.push(result.directives);
-      if (result.constraints) parts2.push(result.constraints);
-      if (result.consider) parts2.push(result.consider);
-      context = parts2.join("\n");
-      count = result.count;
+  let remoteUsed = false;
+  if (projectConfig.remote_url && projectConfig.remote_token) {
+    const remote = await tryRemoteInject(projectConfig, task);
+    if (remote && remote.count > 0) {
+      context = remote.text;
+      count = remote.count;
+      remoteUsed = true;
     }
-  } catch {
-    const result = plur.inject(task, injectOpts);
-    if (result.count > 0) {
-      const parts2 = [];
-      if (result.directives) parts2.push(result.directives);
-      if (result.constraints) parts2.push(result.constraints);
-      if (result.consider) parts2.push(result.consider);
-      context = parts2.join("\n");
-      count = result.count;
+  }
+  if (!remoteUsed) {
+    try {
+      const result = await plur.injectHybrid(task, injectOpts);
+      if (result.count > 0) {
+        const parts2 = [];
+        if (result.directives) parts2.push(result.directives);
+        if (result.constraints) parts2.push(result.constraints);
+        if (result.consider) parts2.push(result.consider);
+        context = parts2.join("\n");
+        count = result.count;
+      }
+    } catch {
+      const result = plur.inject(task, injectOpts);
+      if (result.count > 0) {
+        const parts2 = [];
+        if (result.directives) parts2.push(result.directives);
+        if (result.constraints) parts2.push(result.constraints);
+        if (result.consider) parts2.push(result.consider);
+        context = parts2.join("\n");
+        count = result.count;
+      }
     }
   }
   const parts = [];
@@ -205,10 +351,11 @@ ${parts2.join("\n")}` };
     sessionId = markerData.sessionId;
   } catch {
   }
+  const sourceLabel = remoteUsed ? " (Enterprise)" : "";
   if (isRehydrate) {
-    parts.push(`[PLUR Memory \u2014 rehydrated after compaction, ${count} engrams]`);
+    parts.push(`[PLUR Memory${sourceLabel} \u2014 rehydrated after compaction, ${count} engrams]`);
   } else {
-    parts.push(`[PLUR Memory \u2014 session started, ${count} engrams injected]`);
+    parts.push(`[PLUR Memory${sourceLabel} \u2014 session started, ${count} engrams injected]`);
     if (sessionId) parts.push(`Session ID: ${sessionId}`);
     if (projectConfig.domain) parts.push(`Project domain: ${projectConfig.domain}`);
     if (projectConfig.scope) parts.push(`Project scope: ${projectConfig.scope} \u2014 use this scope for plur_learn calls`);

package/dist/commands/hook-session-guard.js

@@ -3,13 +3,14 @@ import {
 } from "./chunk-6RANUJMM.js";
 
 // src/commands/hook-session-guard.ts
-import { readSync, existsSync } from "fs";
+import { readSync, existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
 import { join } from "path";
 import { tmpdir } from "os";
 var EXEMPT_TOOLS = /* @__PURE__ */ new Set([
   "mcp__plur__plur_session_start",
   "ToolSearch"
 ]);
+var MAX_BLOCKS_BEFORE_FALLBACK = 5;
 function readStdinRaw() {
   try {
     const chunks = [];
@@ -31,6 +32,22 @@ function readStdinRaw() {
 function sentinelPath(sessionId) {
   return join(tmpdir(), `plur-session-${sessionId}`);
 }
+function blockCountPath(sessionId) {
+  const dir = join(tmpdir(), "plur-sessions");
+  mkdirSync(dir, { recursive: true });
+  return join(dir, `${sessionId}.guard-count`);
+}
+function incrementBlockCount(sessionId) {
+  const path = blockCountPath(sessionId);
+  let count = 0;
+  try {
+    count = parseInt(readFileSync(path, "utf8"), 10) || 0;
+  } catch {
+  }
+  count++;
+  writeFileSync(path, String(count));
+  return count;
+}
 async function run(_args, _flags) {
   if (!isPlurConfigured()) return;
   const raw = readStdinRaw();
@@ -45,6 +62,14 @@ async function run(_args, _flags) {
   if (EXEMPT_TOOLS.has(toolName)) return;
   if (!sessionId) return;
   if (existsSync(sentinelPath(sessionId))) return;
+  const blockCount = incrementBlockCount(sessionId);
+  if (blockCount > MAX_BLOCKS_BEFORE_FALLBACK) {
+    process.stderr.write(
+      `[plur] WARNING: session guard gave up after ${MAX_BLOCKS_BEFORE_FALLBACK} blocked calls. The plur MCP server may not be running. Run \`plur doctor\` to diagnose.
+`
+    );
+    return;
+  }
   const output = {
     hookSpecificOutput: {
       hookEventName: "PreToolUse",