@xmarts/genius-setup 1.17.0 → 1.18.1-canary.0

package/bin/genius-setup.js

@@ -37,6 +37,13 @@ function log(msg) { process.stdout.write(msg + '\n'); }
 const BASE = (arg('base-url', 'https://beesmart.digital')).replace(/\/+$/, '');
 const CLIENT = arg('client', '');
 
+// W-04: single source of the running version — package.json is always present in
+// the published tarball. UA + telemetry report THIS, never a hardcoded literal
+// (the fleet ran with 'XmartsGenius-Setup/1.6.0' frozen across 11 releases).
+let PKG_VERSION = 'unknown';
+try { PKG_VERSION = require('../package.json').version || 'unknown'; } catch (_) {}
+const UA = 'XmartsGenius-Setup/' + PKG_VERSION;
+
 // -----------------------------------------------------------------------------
 // Token resolution (priority order):
 //   1. GENIUS_TOKEN env       — an already-resolved consultant Bearer (back-compat
@@ -78,7 +85,7 @@ function exchangeSetupToken(setupToken, cb) {
       'Content-Type': 'application/json',
       'Content-Length': Buffer.byteLength(payload),
       // Cloudflare in front of beesmart.digital 403s the default Node UA.
-      'User-Agent': 'XmartsGenius-Setup/1.6.0',
+      'User-Agent': UA,
     },
     timeout: 15000,
   }, (res) => {
@@ -152,6 +159,24 @@ function runSetup(token) {
   const guardDst = copyHook('plan_committee_guard.py');
   const presenceDst = copyHook('genius_presence.py');
 
+  // W-04 telemetry stamp: the inject hook reads installed_version + hooks_hash
+  // from config.json and reports them on every /inject, so the server-side
+  // fleet-skew view reflects what each device ACTUALLY runs (0/16 reported
+  // anything before this). Hash = sha256 over the exact hook bytes installed,
+  // in a fixed filename order — drift in any hook file changes it.
+  try {
+    const crypto = require('crypto');
+    const h = crypto.createHash('sha256');
+    ['genius_capture.py', 'genius_inject.py', 'plan_committee_guard.py', 'genius_presence.py']
+      .forEach((f) => {
+        try { h.update(fs.readFileSync(path.join(HOOKS_DIR, f))); } catch (_) {}
+      });
+    const c2 = readJson(cfgPath0);
+    c2.installed_version = PKG_VERSION;
+    c2.hooks_hash = h.digest('hex').slice(0, 64);
+    writeJson(cfgPath0, c2, true);
+  } catch (_) {}
+
   // 2) ~/.claude.json mcpServers (merge, no clobber)
   const claudeJsonPath = path.join(HOME, '.claude.json');
   const claudeJson = readJson(claudeJsonPath);
@@ -309,13 +334,18 @@ function runSetup(token) {
     let url;
     try { url = new URL(BASE + '/xma/genius/v1/mcp/secrets'); } catch (_) { return; }
     const mod = url.protocol === 'http:' ? require('http') : require('https');
-    const payload = JSON.stringify({ jsonrpc: '2.0', method: 'call', id: 1, params: {} });
+    let hooksHash = '';
+    try { hooksHash = readJson(path.join(GENIUS_DIR, 'config.json')).hooks_hash || ''; } catch (_) {}
+    const payload = JSON.stringify({ jsonrpc: '2.0', method: 'call', id: 1, params: {
+      running_version: JSON.stringify({ 'genius-setup': PKG_VERSION }),
+      hooks_hash: hooksHash,
+    } });
     const req = mod.request({
       hostname: url.hostname, port: url.port || (url.protocol === 'http:' ? 80 : 443),
       path: url.pathname, method: 'POST',
       headers: {
         'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload),
-        'Authorization': 'Bearer ' + token, 'User-Agent': 'XmartsGenius-Setup/1.6.0',
+        'Authorization': 'Bearer ' + token, 'User-Agent': UA,
       },
       timeout: 15000,
     }, (res) => {

package/hooks/genius_inject.py

@@ -9,7 +9,7 @@ prior knowledge WITHOUT asking. Editor-agnostic (terminal / VSCode / headless).
 
 Hard rules:
 - ALWAYS exit 0 (never block a turn).
-- Time-box the network call (<=2.5s) so injection adds no perceptible latency.
+- Time-box the network call (<=3.5s, TIMEOUT below) so injection stays cheap.
 - Relevance-floored: nothing relevant -> inject nothing (zero noise).
 - Reads endpoint + bearer from ~/.genius/config.json (written by the installer);
   no secret is embedded here.
@@ -61,18 +61,41 @@ def _emit(event_name, context):
     sys.exit(0)
 
 
-def _inject(cfg, prompt):
+def _inject(cfg, prompt, session_id=None):
     base = (cfg.get("base_url") or "https://beesmart.digital").rstrip("/")
     token = cfg.get("token")
     if not token or not prompt.strip():
-        return "", None, None
+        # MUST stay a 4-tuple: main() unpacks 4 values. The historical 3-tuple
+        # here made every empty-prompt turn raise ValueError inside main(),
+        # silently losing BOTH injection and the self-update check for that turn.
+        return "", None, None, None
+    params = {"prompt": prompt[:4000], "limit": 4}
+    # W-04 telemetry: real Claude Code session id (server persists it as the
+    # hint-event session_key, enabling same-session implicit correlation) plus
+    # the installed package version + hooks hash (stamped into config.json by
+    # the installer) so the fleet-skew view knows what each device ACTUALLY runs.
+    if session_id:
+        params["session_id"] = str(session_id)[:128]
+    if cfg.get("installed_version"):
+        params["running_version"] = json.dumps(
+            {"genius-setup": str(cfg["installed_version"])[:32]})
+    else:
+        # G6 (1.18.1-canary): a legacy config without installed_version used to
+        # keep the device SILENT on the skew view — silence is exactly how 0/16
+        # hid for a month (V17). Report a sentinel instead: visible skew makes
+        # the fleet converge; the next installer run stamps the real version.
+        params["running_version"] = json.dumps({"genius-setup": "pre-1.18.1"})
+    if cfg.get("hooks_hash"):
+        params["hooks_hash"] = str(cfg["hooks_hash"])[:64]
     body = json.dumps({"jsonrpc": "2.0", "method": "call", "id": 1,
-                       "params": {"prompt": prompt[:4000], "limit": 4}}).encode()
+                       "params": params}).encode()
     req = urllib.request.Request(base + "/xma/genius/v1/inject", data=body)
     req.add_header("Content-Type", "application/json")
     req.add_header("Authorization", "Bearer %s" % token)
     # Cloudflare in front of beesmart.digital 403s the default Python-urllib UA.
-    req.add_header("User-Agent", "XmartsGenius-Inject/1.0")
+    # Dynamic UA (W-04): report the installed version, not a hardcoded 1.0.
+    req.add_header("User-Agent", "XmartsGenius-Inject/%s"
+                   % (cfg.get("installed_version") or "unknown"))
     try:
         resp = urllib.request.urlopen(req, timeout=TIMEOUT)
         data = json.loads(resp.read())
@@ -90,7 +113,7 @@ def _inject(cfg, prompt):
 # version dictated by the server (xma_genius.hook_pin_version, returned in the
 # inject response) and otherwise fall back to this bundled known-good pin — the
 # client never resolves the mutable `@latest` tag.
-PINNED_FALLBACK = "1.17.0"
+PINNED_FALLBACK = "1.18.0"
 
 
 def _pkg_spec(pin_version):
@@ -260,7 +283,8 @@ def main():
         _maybe_self_update(cfg)   # TTL-only on priming
         _emit("SessionStart", SESSION_PRIMER)
     else:
-        context, force_epoch, pin_version, mcp_epoch = _inject(cfg, event.get("prompt") or "")
+        context, force_epoch, pin_version, mcp_epoch = _inject(
+            cfg, event.get("prompt") or "", session_id=event.get("session_id"))
         # The inject call already round-tripped the server, so honour any
         # admin-pushed force-update epoch here (bypasses the daily TTL) and install
         # the exact server-pinned version (never @latest). A newer MCP manifest

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xmarts/genius-setup",
-  "version": "1.17.0",
+  "version": "1.18.1-canary.0",
   "description": "One-command, self-updating onboarding for Xmarts Genius (Brain MCP + per-turn injection + automatic session/time capture + presence heartbeat for honest time-tracking 'amarre' + plan/committee→Brain enforcement + CLAUDE.md protocol + MCP fan-out: provisions the consultant's granted MCP servers into Claude Code & Claude Desktop). Secret-free onboarding via single-use setup-token exchange. Installs once; self-updates daily so new tools/skills/features arrive with zero action.",
   "bin": {
     "genius-setup": "bin/genius-setup.js"