@vainplex/openclaw-leuko 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,25 @@
+# Changelog
+
+## [0.1.0] — 2026-02-23
+
+### Added
+- Initial release of `@vainplex/openclaw-leuko` — Cognitive Immune System Plugin
+- 6 Cognitive Checks (CK-01 through CK-06):
+  - CK-01: Goal Quality Assessment (LLM) — with pre-filter for expired/stale goals
+  - CK-02: Thread Health Assessment (LLM) — with pre-filter for stale threads
+  - CK-03: Pipeline Correlation (deterministic) — NATS/thread/cron cross-referencing
+  - CK-04: Anomaly Detection (deterministic) — directory size and metric trend analysis
+  - CK-05: Bootstrap Integrity (LLM) — BOOTSTRAP.md factual verification
+  - CK-06: Recommendations (LLM) — proactive housekeeping suggestions
+- `leuko_status` tool for agent health queries (sections: summary, daemon, cognitive, recommendations, all)
+- `/leuko` command (subcommands: refresh, detail, config)
+- `before_agent_start` hook for health context injection
+- External config pattern (`~/.openclaw/plugins/openclaw-leuko/config.json`)
+- LLM client with primary (Ollama) + fallback (LiteLLM) support
+- Atomic write protocol for `leuko-status.json` (preserves daemon fields)
+- Consecutive-critical tracking with `escalation_needed` flag
+- Fail-open behavior: LLM failures default to `severity: "ok"`
+- Adopted Sitrep `errors` and `custom` collector config (implementation deferred to v0.2.0)
+
+### Replaces
+- `@vainplex/openclaw-sitrep` (deprecated) — absorbed goals/threads pre-filtering, dropped redundant collectors

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Albert Hild / Vainplex
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,160 @@
+# @vainplex/openclaw-leuko
+
+**Cognitive immune system for OpenClaw** — L2 semantic health checks with LLM analysis, tool exposure for agent queries, and Sitrep replacement.
+
+Part of the [Vainplex OpenClaw Plugin Suite](https://github.com/alberthild/vainplex-openclaw).
+
+## Architecture
+
+Leuko operates as a **two-tier hybrid system**:
+
+- **Level 1 (Python daemon):** Heuristic checks — file freshness, JSON validity, service connectivity, cron health. Runs every 15min, zero API cost.
+- **Level 2 (This plugin):** Cognitive checks — semantic analysis via LLM + deterministic correlation. Runs every 2h or on-demand.
+
+```
+                  Plugin (L2)                    Agents
+                       │                           │
+  ┌─ Read daemon_checks[] from leuko-status.json   │
+  ├─ Run CK-01..CK-06 (4 LLM + 2 deterministic)   │
+  ├─ Write cognitive_checks[] to leuko-status.json  │
+  │                                                 │
+  ├── leuko_status tool ────────────────────────────┤
+  ├── before_agent_start hook ──────────────────────┤
+  └── /leuko command ──────────────────────────────→│
+```
+
+## Quick Start
+
+```bash
+npm install @vainplex/openclaw-leuko
+```
+
+Add to `openclaw.json`:
+```json
+{
+  "plugins": {
+    "entries": {
+      "openclaw-leuko": { "enabled": true }
+    }
+  }
+}
+```
+
+The plugin will auto-create a default config at `~/.openclaw/plugins/openclaw-leuko/config.json` on first run.
+
+## Cognitive Checks
+
+| Check | ID | Type | Purpose |
+|-------|-----|------|---------|
+| Goal Quality | CK-01 | LLM | Are pending goals specific, actionable, non-redundant? |
+| Thread Health | CK-02 | LLM | Are threads stale, duplicate, or accumulating? |
+| Pipeline Correlation | CK-03 | Deterministic | Are inputs flowing to outputs? (NATS → threads) |
+| Anomaly Detection | CK-04 | Deterministic | Statistical deviations in metrics and directory sizes |
+| Bootstrap Integrity | CK-05 | LLM | Is BOOTSTRAP.md factually current? |
+| Recommendations | CK-06 | LLM | Proactive housekeeping suggestions |
+
+### Severity Levels
+
+- **`ok`** — All checks pass, no issues detected
+- **`warn`** — Issues found that should be reviewed
+- **`critical`** — Significant problems requiring attention
+
+## Tool: `leuko_status`
+
+Agents can query system health:
+
+```
+leuko_status({ section: "summary" })
+leuko_status({ section: "cognitive", severity_filter: "warn" })
+leuko_status({ section: "recommendations" })
+```
+
+Sections: `summary` | `daemon` | `cognitive` | `recommendations` | `all`
+
+## Command: `/leuko`
+
+```
+/leuko              — Health summary
+/leuko refresh      — Trigger immediate L2 check cycle
+/leuko detail       — All checks with findings
+/leuko config       — Active configuration
+```
+
+## Hook: `before_agent_start`
+
+When system health is degraded, injects a one-liner into the agent's context:
+
+```
+⚕️ Leuko Health: WARN — 2 issues: goal_quality (3/9 vague goals), facts (stale 48h)
+```
+
+Configurable: only injected when issues exist, respects maxLength.
+
+## Configuration
+
+Full config lives at `~/.openclaw/plugins/openclaw-leuko/config.json`:
+
+```json
+{
+  "enabled": true,
+  "statusPath": "~/clawd/memory/leuko-status.json",
+  "intervalMinutes": 120,
+  "llm": {
+    "primary": {
+      "provider": "ollama",
+      "model": "qwen3:14b",
+      "baseUrl": "http://localhost:11434",
+      "timeoutSec": 30
+    },
+    "fallback": {
+      "provider": "litellm",
+      "model": "gemini/gemini-2.0-flash-lite",
+      "baseUrl": "http://localhost:4000",
+      "timeoutSec": 30
+    }
+  },
+  "checks": {
+    "goal_quality": { "enabled": true, "usesLlm": true },
+    "thread_health": { "enabled": true, "staleDays": 5 },
+    "pipeline_correlation": { "enabled": true },
+    "anomaly_detection": { "enabled": true },
+    "bootstrap_integrity": { "enabled": true },
+    "recommendations": { "enabled": true, "maxRecommendations": 5 }
+  }
+}
+```
+
+## LLM Integration
+
+- **Primary:** `ollama/qwen3:14b` (local, $0.00/run)
+- **Fallback:** `gemini/gemini-2.0-flash-lite` via LiteLLM (~$0.002/run)
+- **Budget:** ≤ $0.05 per run (30x margin)
+- **Max 4 LLM calls per run** (CK-01, CK-02, CK-05, CK-06)
+- **Fail-open:** If LLM unavailable, severity defaults to `ok` with explanatory detail
+
+## Sitrep Deprecation
+
+This plugin replaces `@vainplex/openclaw-sitrep`. Sitrep's `errors` and `custom` collectors are adopted; `systemd_timers`, `nats`, `goals`, `threads`, and `calendar` collectors are either absorbed into cognitive checks or dropped (covered by L1).
+
+## Development
+
+```bash
+npm install
+npm run build          # TypeScript compilation
+npm run test           # Run all tests
+npm run test:coverage  # Coverage report (>80% lines)
+npm run typecheck      # Type checking only
+```
+
+## Standards
+
+- TypeScript strict mode, `noUncheckedIndexedAccess`
+- 0 `any` types
+- ESM (`type: module`)
+- 0 runtime dependencies (only `node:*` builtins)
+- vitest for tests
+- kebab-case filenames
+
+## License
+
+MIT

package/dist/src/check-runner.d.ts

@@ -0,0 +1,65 @@
+import type { CognitiveCheckResult, LlmClient, PluginLogger, Severity } from "./types.js";
+/**
+ * Options for the generic LLM check runner.
+ *
+ * TInput: the shape read from disk (goals, threads, bootstrap text, etc.)
+ * TResponse: the expected LLM JSON response shape
+ */
+export interface LlmCheckOpts<TInput, TResponse> {
+    /** Check name (e.g. "cognitive:goal_quality") */
+    name: string;
+    /** LLM system prompt */
+    systemPrompt: string;
+    /** LLM client instance */
+    llm: LlmClient;
+    /** Logger */
+    logger: PluginLogger;
+    /** Read input data; return null to skip with a given result */
+    readInput(timestamp: string, startMs: number): ReadInputResult<TInput>;
+    /** Run deterministic pre-filter; returns pre-severity and partial data */
+    preFilter(input: TInput): PreFilterResult;
+    /** Build the LLM user prompt from input */
+    buildPrompt(input: TInput): string;
+    /** Build fail-open result when LLM fails */
+    buildFailOpen(opts: FailOpenOpts): CognitiveCheckResult;
+    /** Parse and merge LLM response + pre-filter into final result */
+    mergeResults(opts: MergeOpts<TResponse>): CognitiveCheckResult;
+}
+export type ReadInputResult<T> = {
+    ok: true;
+    input: T;
+} | {
+    ok: false;
+    skip: CognitiveCheckResult;
+};
+export interface PreFilterResult {
+    severity: Severity;
+    findingCount: number;
+    /** Arbitrary data passed through to mergeResults / buildFailOpen */
+    data: Record<string, unknown>;
+}
+export interface FailOpenOpts {
+    name: string;
+    pre: PreFilterResult;
+    message: string;
+    llmModel: string;
+    llmTokens: number;
+    timestamp: string;
+    startMs: number;
+}
+export interface MergeOpts<TResponse> {
+    parsed: TResponse;
+    pre: PreFilterResult;
+    llmModel: string;
+    llmTokens: number;
+    timestamp: string;
+    startMs: number;
+}
+/**
+ * Generic runner for all LLM-based cognitive checks.
+ *
+ * Flow: readInput → preFilter → LLM call → parse → mergeResults
+ * On LLM failure: fail-open via buildFailOpen.
+ */
+export declare function runLlmCheck<TInput, TResponse>(opts: LlmCheckOpts<TInput, TResponse>): Promise<CognitiveCheckResult>;
+//# sourceMappingURL=check-runner.d.ts.map

package/dist/src/check-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-runner.d.ts","sourceRoot":"","sources":["../../src/check-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,SAAS,EACT,YAAY,EACZ,QAAQ,EACT,MAAM,YAAY,CAAC;AAGpB;;;;;GAKG;AACH,MAAM,WAAW,YAAY,CAAC,MAAM,EAAE,SAAS;IAC7C,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,0BAA0B;IAC1B,GAAG,EAAE,SAAS,CAAC;IACf,aAAa;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,+DAA+D;IAC/D,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvE,0EAA0E;IAC1E,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,2CAA2C;IAC3C,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,4CAA4C;IAC5C,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,oBAAoB,CAAC;IACxD,kEAAkE;IAClE,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,GAAG,oBAAoB,CAAC;CAChE;AAED,MAAM,MAAM,eAAe,CAAC,CAAC,IACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACtB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAE9C,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,eAAe,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS,CAAC,SAAS;IAClC,MAAM,EAAE,SAAS,CAAC;IAClB,GAAG,EAAE,eAAe,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,SAAS,EACjD,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,GACpC,OAAO,CAAC,oBAAoB,CAAC,CAmC/B"}

package/dist/src/check-runner.js

@@ -0,0 +1,40 @@
+import { parseLlmJson } from "./check-utils.js";
+/**
+ * Generic runner for all LLM-based cognitive checks.
+ *
+ * Flow: readInput → preFilter → LLM call → parse → mergeResults
+ * On LLM failure: fail-open via buildFailOpen.
+ */
+export async function runLlmCheck(opts) {
+    const startMs = Date.now();
+    const timestamp = new Date().toISOString();
+    const readResult = opts.readInput(timestamp, startMs);
+    if (!readResult.ok)
+        return readResult.skip;
+    const pre = opts.preFilter(readResult.input);
+    const userPrompt = opts.buildPrompt(readResult.input);
+    const llmResult = await opts.llm.generate(opts.systemPrompt, userPrompt, 30000);
+    if (llmResult.content === null) {
+        const msg = llmResult.error
+            ? `LLM unavailable (${llmResult.error})`
+            : "LLM timeout";
+        return opts.buildFailOpen({
+            name: opts.name, pre, message: msg,
+            llmModel: llmResult.model, llmTokens: 0, timestamp, startMs,
+        });
+    }
+    const parsed = parseLlmJson(llmResult.content);
+    if (!parsed) {
+        return opts.buildFailOpen({
+            name: opts.name, pre, message: "LLM response parsing failed",
+            llmModel: llmResult.model, llmTokens: llmResult.tokens,
+            timestamp, startMs,
+        });
+    }
+    return opts.mergeResults({
+        parsed, pre,
+        llmModel: llmResult.model, llmTokens: llmResult.tokens,
+        timestamp, startMs,
+    });
+}
+//# sourceMappingURL=check-runner.js.map

package/dist/src/check-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-runner.js","sourceRoot":"","sources":["../../src/check-runner.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA2DhD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAqC;IAErC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC;IAE3C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IAEhF,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK;YACzB,CAAC,CAAC,oBAAoB,SAAS,CAAC,KAAK,GAAG;YACxC,CAAC,CAAC,aAAa,CAAC;QAClB,OAAO,IAAI,CAAC,aAAa,CAAC;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG;YAClC,QAAQ,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAY,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,aAAa,CAAC;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,6BAA6B;YAC5D,QAAQ,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM;YACtD,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC,YAAY,CAAC;QACvB,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM;QACtD,SAAS,EAAE,OAAO;KACnB,CAAC,CAAC;AACL,CAAC"}

package/dist/src/check-utils.d.ts

@@ -0,0 +1,21 @@
+import type { Severity } from "./types.js";
+/**
+ * Parse a string (typically from LLM response) into a valid Severity.
+ * Returns "ok" for unrecognized values.
+ */
+export declare function parseSeverityString(v: unknown): Severity;
+/**
+ * Return the most severe of the given severities.
+ * Order: ok < warn < critical.
+ */
+export declare function worstSeverity(...severities: Severity[]): Severity;
+/**
+ * Type guard: is value a plain object (non-null, non-array)?
+ */
+export declare function isRecord(v: unknown): v is Record<string, unknown>;
+/**
+ * Parse a JSON string (typically raw LLM output) into a typed object.
+ * Returns null on parse failure.
+ */
+export declare function parseLlmJson<T>(raw: string): T | null;
+//# sourceMappingURL=check-utils.d.ts.map

package/dist/src/check-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-utils.d.ts","sourceRoot":"","sources":["../../src/check-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAGxD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,UAAU,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAIjE;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEjE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAMrD"}

package/dist/src/check-utils.js

@@ -0,0 +1,39 @@
+/**
+ * Parse a string (typically from LLM response) into a valid Severity.
+ * Returns "ok" for unrecognized values.
+ */
+export function parseSeverityString(v) {
+    if (v === "ok" || v === "warn" || v === "critical")
+        return v;
+    return "ok";
+}
+/**
+ * Return the most severe of the given severities.
+ * Order: ok < warn < critical.
+ */
+export function worstSeverity(...severities) {
+    if (severities.includes("critical"))
+        return "critical";
+    if (severities.includes("warn"))
+        return "warn";
+    return "ok";
+}
+/**
+ * Type guard: is value a plain object (non-null, non-array)?
+ */
+export function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/**
+ * Parse a JSON string (typically raw LLM output) into a typed object.
+ * Returns null on parse failure.
+ */
+export function parseLlmJson(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=check-utils.js.map

package/dist/src/check-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-utils.js","sourceRoot":"","sources":["../../src/check-utils.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAG,UAAsB;IACrD,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IACvD,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAU;IACjC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAI,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/src/checks/anomaly-detection.d.ts

@@ -0,0 +1,3 @@
+import type { CognitiveCheckResult, AnomalyDetectionCheckConfig, LeukoHistory, PluginLogger } from "../types.js";
+export declare function runAnomalyDetectionCheck(config: AnomalyDetectionCheckConfig, history: LeukoHistory | null, logger: PluginLogger): CognitiveCheckResult;
+//# sourceMappingURL=anomaly-detection.d.ts.map

package/dist/src/checks/anomaly-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anomaly-detection.d.ts","sourceRoot":"","sources":["../../../src/checks/anomaly-detection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,oBAAoB,EAEpB,2BAA2B,EAC3B,YAAY,EACZ,YAAY,EAEb,MAAM,aAAa,CAAC;AAqGrB,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,2BAA2B,EACnC,OAAO,EAAE,YAAY,GAAG,IAAI,EAC5B,MAAM,EAAE,YAAY,GACnB,oBAAoB,CAsBtB"}

package/dist/src/checks/anomaly-detection.js

@@ -0,0 +1,127 @@
+import { statSync, existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+const CHECK_NAME = "cognitive:anomaly_detection";
+function getDirSizeMb(dirPath) {
+    try {
+        if (!existsSync(dirPath))
+            return null;
+        let totalBytes = 0;
+        const entries = readdirSync(dirPath, { withFileTypes: true });
+        for (const entry of entries) {
+            try {
+                if (entry.isFile())
+                    totalBytes += statSync(join(dirPath, entry.name)).size;
+            }
+            catch { /* skip inaccessible */ }
+        }
+        return Math.round((totalBytes / (1024 * 1024)) * 100) / 100;
+    }
+    catch {
+        return null;
+    }
+}
+function detectTrends(history, metricName) {
+    if (!history || history.snapshots.length < 3)
+        return { consecutive: 0, direction: "stable" };
+    const values = history.snapshots
+        .filter((s) => typeof s.metrics[metricName] === "number")
+        .map((s) => s.metrics[metricName]);
+    if (values.length < 3)
+        return { consecutive: 0, direction: "stable" };
+    return computeConsecutiveTrend(values);
+}
+function computeConsecutiveTrend(values) {
+    let up = 0;
+    let down = 0;
+    for (let i = values.length - 1; i > 0; i--) {
+        const prev = values[i - 1];
+        const curr = values[i];
+        if (curr > prev) {
+            up++;
+            down = 0;
+        }
+        else if (curr < prev) {
+            down++;
+            up = 0;
+        }
+        else
+            break;
+    }
+    if (down >= 3)
+        return { consecutive: down, direction: "shrinking" };
+    if (up >= 3)
+        return { consecutive: up, direction: "growing" };
+    return { consecutive: 0, direction: "stable" };
+}
+function checkDirSizes(config, history, baselines, anomalies) {
+    for (const dir of config.monitoredDirs) {
+        const resolved = dir.path.replace(/^~/, process.env["HOME"] ?? "/tmp");
+        const currentMb = getDirSizeMb(resolved);
+        if (currentMb === null)
+            continue;
+        baselines[`${dir.label}_dir_mb`] = currentMb;
+        checkGrowthAnomaly(dir.label, currentMb, history, anomalies);
+    }
+}
+function checkGrowthAnomaly(label, currentMb, history, anomalies) {
+    if (!history || history.snapshots.length === 0)
+        return;
+    const weekAgo = Date.now() - 7 * 24 * 60 * 60 * 1000;
+    const snap = history.snapshots.find((s) => {
+        const ts = new Date(s.timestamp).getTime();
+        return !isNaN(ts) && ts < weekAgo;
+    });
+    if (!snap)
+        return;
+    const baselineMb = snap.metrics[`${label}_dir_mb`];
+    if (typeof baselineMb !== "number" || baselineMb <= 0)
+        return;
+    const ratio = currentMb / baselineMb;
+    if (ratio > 5) {
+        anomalies.push({ metric: `${label}_dir_mb`, current: currentMb, baseline: baselineMb, deviation: `${ratio.toFixed(1)}x growth in 7 days`, severity: "critical" });
+    }
+    else if (ratio > 2) {
+        anomalies.push({ metric: `${label}_dir_mb`, current: currentMb, baseline: baselineMb, deviation: `${ratio.toFixed(1)}x growth in 7 days`, severity: "warn" });
+    }
+}
+function checkMetricTrends(history, anomalies) {
+    const tracked = ["fact_count", "goal_count", "thread_count"];
+    for (const metric of tracked) {
+        const trend = detectTrends(history, metric);
+        if (trend.direction !== "shrinking" || trend.consecutive < 3)
+            continue;
+        const severity = trend.consecutive >= 5 ? "critical" : "warn";
+        const deviation = trend.consecutive >= 5
+            ? `${trend.consecutive} consecutive decreases — possible data loss`
+            : `${trend.consecutive} consecutive decreases`;
+        anomalies.push({ metric, current: trend.consecutive, baseline: 0, deviation, severity });
+    }
+}
+function overallSeverity(anomalies) {
+    if (anomalies.some((a) => a.severity === "critical"))
+        return "critical";
+    if (anomalies.some((a) => a.severity === "warn"))
+        return "warn";
+    return "ok";
+}
+export function runAnomalyDetectionCheck(config, history, logger) {
+    const startMs = Date.now();
+    const timestamp = new Date().toISOString();
+    const anomalies = [];
+    const baselines = {};
+    checkDirSizes(config, history, baselines, anomalies);
+    checkMetricTrends(history, anomalies);
+    const detail = anomalies.length === 0
+        ? "All metrics within normal range"
+        : `${anomalies.length} anomaly(s) detected`;
+    return {
+        check_name: CHECK_NAME,
+        severity: overallSeverity(anomalies),
+        detail,
+        anomalies,
+        baselines,
+        timestamp,
+        duration_ms: Date.now() - startMs,
+    };
+}
+//# sourceMappingURL=anomaly-detection.js.map

package/dist/src/checks/anomaly-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anomaly-detection.js","sourceRoot":"","sources":["../../../src/checks/anomaly-detection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAUjC,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAEjD,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,MAAM,EAAE;oBAAE,UAAU,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAID,SAAS,YAAY,CAAC,OAA4B,EAAE,UAAkB;IACpE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS;SAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAE,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtE,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAgB;IAC/C,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACxB,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;YAAC,EAAE,EAAE,CAAC;YAAC,IAAI,GAAG,CAAC,CAAC;QAAC,CAAC;aAC/B,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;YAAC,IAAI,EAAE,CAAC;YAAC,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;;YACpC,MAAM;IACb,CAAC;IACD,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACpE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAC9D,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CACpB,MAAmC,EACnC,OAA4B,EAC5B,SAAiC,EACjC,SAAyB;IAEzB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,SAAS,KAAK,IAAI;YAAE,SAAS;QACjC,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,SAAS,CAAC,GAAG,SAAS,CAAC;QAC7C,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAa,EAAE,SAAiB,EAChC,OAA4B,EAAE,SAAyB;IAEvD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACxC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IACnD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO;IAC9D,MAAM,KAAK,GAAG,SAAS,GAAG,UAAU,CAAC;IACrC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACpK,CAAC;SAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChK,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA4B,EAAE,SAAyB;IAChF,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAC7D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,SAAS,KAAK,WAAW,IAAI,KAAK,CAAC,WAAW,GAAG,CAAC;YAAE,SAAS;QACvE,MAAM,QAAQ,GAAa,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;QACxE,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,IAAI,CAAC;YACtC,CAAC,CAAC,GAAG,KAAK,CAAC,WAAW,6CAA6C;YACnE,CAAC,CAAC,GAAG,KAAK,CAAC,WAAW,wBAAwB,CAAC;QACjD,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,SAAyB;IAChD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IACxE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAmC,EACnC,OAA4B,EAC5B,MAAoB;IAEpB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAmB,EAAE,CAAC;IACrC,MAAM,SAAS,GAA2B,EAAE,CAAC;IAE7C,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACrD,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC;QACnC,CAAC,CAAC,iCAAiC;QACnC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,sBAAsB,CAAC;IAE9C,OAAO;QACL,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC;QACpC,MAAM;QACN,SAAS;QACT,SAAS;QACT,SAAS;QACT,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;KAClC,CAAC;AACJ,CAAC"}

package/dist/src/checks/bootstrap-integrity.d.ts

@@ -0,0 +1,3 @@
+import type { CognitiveCheckResult, BootstrapIntegrityCheckConfig, LlmClient, LeukoStatus, PluginLogger } from "../types.js";
+export declare function runBootstrapIntegrityCheck(config: BootstrapIntegrityCheckConfig, llm: LlmClient, status: LeukoStatus | null, logger: PluginLogger): Promise<CognitiveCheckResult>;
+//# sourceMappingURL=bootstrap-integrity.d.ts.map

package/dist/src/checks/bootstrap-integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-integrity.d.ts","sourceRoot":"","sources":["../../../src/checks/bootstrap-integrity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EAEpB,6BAA6B,EAC7B,SAAS,EACT,WAAW,EACX,YAAY,EACb,MAAM,aAAa,CAAC;AAqErB,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,6BAA6B,EACrC,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,WAAW,GAAG,IAAI,EAC1B,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,oBAAoB,CAAC,CA2D/B"}

package/dist/src/checks/bootstrap-integrity.js

@@ -0,0 +1,107 @@
+import { readTextInput } from "../status-reader.js";
+import { parseSeverityString } from "../check-utils.js";
+import { runLlmCheck } from "../check-runner.js";
+const CHECK_NAME = "cognitive:bootstrap_integrity";
+const SYSTEM_PROMPT = `You are a system health evaluator. Verify that the BOOTSTRAP.md file is factually current and complete.
+Respond ONLY with valid JSON matching this schema:
+{
+  "severity": "ok" | "warn" | "critical",
+  "detail": "single line summary",
+  "findings": [
+    {
+      "issue": "stale_reference" | "missing_subsystem" | "factual_error" | "outdated_state",
+      "line": "the problematic text from BOOTSTRAP.md",
+      "detail": "explanation of what's wrong",
+      "recommendation": "what to fix"
+    }
+  ]
+}
+
+Evaluation rules:
+- Does it reference services/crons that no longer exist?
+- Are file paths correct?
+- Is "current state" aligned with actual system status?
+- Are key subsystems mentioned (NATS, Membrane, Cortex, Leuko, Governance)?
+- Content aligns with system state → "ok"
+- Minor omissions or stale references → "warn"
+- Major factual errors or missing critical subsystems → "critical"`;
+function buildSystemContext(status) {
+    if (!status)
+        return "System status: unavailable";
+    const daemonSummary = status.daemon_checks
+        .filter((c) => c.severity !== "ok")
+        .map((c) => `${c.check_name}: ${c.severity} — ${c.detail}`)
+        .join("\n");
+    return [
+        `Last check: ${status.last_check}`,
+        `Overall severity: ${status.overall_severity}`,
+        `Daemon checks: ${status.daemon_checks.length} total`,
+        daemonSummary ? `Issues:\n${daemonSummary}` : "All daemon checks OK",
+    ].join("\n");
+}
+function parseFindings(parsed) {
+    if (!Array.isArray(parsed.findings))
+        return [];
+    return parsed.findings.map((f) => ({
+        issue: typeof f.issue === "string" ? f.issue : "unknown",
+        line: typeof f.line === "string" ? f.line : undefined,
+        detail: typeof f.detail === "string" ? f.detail : "",
+        recommendation: typeof f.recommendation === "string" ? f.recommendation : undefined,
+    }));
+}
+export async function runBootstrapIntegrityCheck(config, llm, status, logger) {
+    return runLlmCheck({
+        name: CHECK_NAME,
+        systemPrompt: SYSTEM_PROMPT,
+        llm,
+        logger,
+        readInput(timestamp, startMs) {
+            const content = readTextInput(config.inputPath, 4000, logger);
+            if (content === null) {
+                return { ok: false, skip: { check_name: CHECK_NAME, severity: "warn", detail: "BOOTSTRAP.md not found — cannot verify integrity", timestamp, duration_ms: Date.now() - startMs } };
+            }
+            return { ok: true, input: { content, systemContext: buildSystemContext(status) } };
+        },
+        preFilter() {
+            return { severity: "ok", findingCount: 0, data: {} };
+        },
+        buildPrompt(input) {
+            return [
+                `Current date: ${new Date().toISOString().split("T")[0]}`,
+                "",
+                "=== System State ===",
+                input.systemContext,
+                "",
+                "=== BOOTSTRAP.md Content ===",
+                input.content,
+            ].join("\n");
+        },
+        buildFailOpen({ message, llmModel, llmTokens, timestamp, startMs }) {
+            return {
+                check_name: CHECK_NAME,
+                severity: "ok",
+                detail: `${message} — check skipped`,
+                timestamp,
+                model_used: llmModel,
+                tokens_used: llmTokens,
+                duration_ms: Date.now() - startMs,
+            };
+        },
+        mergeResults(opts) {
+            const findings = parseFindings(opts.parsed);
+            return {
+                check_name: CHECK_NAME,
+                severity: parseSeverityString(opts.parsed.severity),
+                detail: typeof opts.parsed.detail === "string"
+                    ? opts.parsed.detail
+                    : `${findings.length} findings`,
+                findings,
+                timestamp: opts.timestamp,
+                model_used: opts.llmModel,
+                tokens_used: opts.llmTokens,
+                duration_ms: Date.now() - opts.startMs,
+            };
+        },
+    });
+}
+//# sourceMappingURL=bootstrap-integrity.js.map