@xmarts/genius-setup 1.7.0 → 1.7.2

package/hooks/genius_inject.py

@@ -24,6 +24,7 @@ CFG_PATH = os.path.join(HOME, ".genius", "config.json")
 TIMEOUT = 3.5
 SELF_UPDATE_TTL = 86400  # at most once/day
 SELF_UPDATE_STAMP = os.path.join(HOME, ".genius", ".last_selfupdate")
+FORCE_STAMP = os.path.join(HOME, ".genius", ".last_forced_epoch")
 
 SESSION_PRIMER = (
     "[Xmarts Genius — Brain connected]\n"
@@ -62,7 +63,7 @@ def _inject(cfg, prompt):
     base = (cfg.get("base_url") or "https://beesmart.digital").rstrip("/")
     token = cfg.get("token")
     if not token or not prompt.strip():
-        return ""
+        return "", None, None
     body = json.dumps({"jsonrpc": "2.0", "method": "call", "id": 1,
                        "params": {"prompt": prompt[:4000], "limit": 4}}).encode()
     req = urllib.request.Request(base + "/xma/genius/v1/inject", data=body)
@@ -73,17 +74,43 @@ def _inject(cfg, prompt):
     try:
         resp = urllib.request.urlopen(req, timeout=TIMEOUT)
         data = json.loads(resp.read())
-        result = data.get("result", data)
-        return (result or {}).get("context", "") or ""
+        result = data.get("result", data) or {}
+        return ((result.get("context", "") or ""),
+                result.get("hook_force_epoch"),
+                result.get("hook_pin_version"))
     except Exception:
-        return ""
+        return "", None, None
 
 
-def _maybe_self_update(cfg):
-    """Keep the consultant on the LATEST Genius package with ZERO action: at most
+# M6 (Phase-0 integrity gate): NEVER resolve `@latest`. An unsigned `npx @latest`
+# self-update is a standing fleet-wide RCE channel. We install an EXACT pinned
+# version dictated by the server (xma_genius.hook_pin_version, returned in the
+# inject response) and otherwise fall back to this bundled known-good pin — the
+# client never resolves the mutable `@latest` tag.
+PINNED_FALLBACK = "1.7.2"
+
+
+def _pkg_spec(pin_version):
+    """Resolve the exact package spec to install. Accepts only a plain semver pin
+    from the server; anything else falls back to the bundled PINNED_FALLBACK.
+    Never returns an `@latest` spec."""
+    import re
+    v = (pin_version or "").strip()
+    if v and re.match(r"^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.]+)?$", v):
+        return "@xmarts/genius-setup@%s" % v
+    return "@xmarts/genius-setup@%s" % PINNED_FALLBACK
+
+
+def _maybe_self_update(cfg, force_epoch=None, pin_version=None):
+    """Keep the consultant on the SERVER-PINNED Genius package with ZERO action: at most
     once/day, silently re-run the installer in the background. New hooks, MCP
     tools, settings and the CLAUDE.md protocol then flow automatically — the
     consultant never re-onboards. Detached + fully guarded; never blocks a turn.
+
+    force_epoch (from the server's inject response) is the admin "push now" lever:
+    when the server epoch is newer than the one we last acted on, we upgrade
+    IMMEDIATELY, bypassing the daily TTL — and record the epoch so we force at most
+    once per bump (never a loop).
     """
     import time
     import subprocess
@@ -91,7 +118,18 @@ def _maybe_self_update(cfg):
         token = cfg.get("token")
         if not token:
             return
-        if os.path.exists(SELF_UPDATE_STAMP) and (
+        forced = False
+        if force_epoch:
+            try:
+                fe = int(force_epoch)
+                last = 0
+                if os.path.exists(FORCE_STAMP):
+                    with open(FORCE_STAMP) as fh:
+                        last = int((fh.read() or "0").strip() or 0)
+                forced = fe > last
+            except Exception:
+                forced = False
+        if not forced and os.path.exists(SELF_UPDATE_STAMP) and (
                 time.time() - os.path.getmtime(SELF_UPDATE_STAMP)) < SELF_UPDATE_TTL:
             return
         # Stamp FIRST so a failing/slow npx never causes a retry storm.
@@ -99,20 +137,24 @@ def _maybe_self_update(cfg):
             os.makedirs(os.path.dirname(SELF_UPDATE_STAMP), exist_ok=True)
             with open(SELF_UPDATE_STAMP, "w") as fh:
                 fh.write(str(int(time.time())))
+            if force_epoch:
+                with open(FORCE_STAMP, "w") as fh:
+                    fh.write(str(int(force_epoch)))
         except Exception:
             return
         env = dict(os.environ)
         env["GENIUS_TOKEN"] = token
         base = cfg.get("base_url")
+        spec = _pkg_spec(pin_version)  # exact pinned version — never @latest
         devnull = open(os.devnull, "w")
         if os.name == "nt":
-            cmd = "npx -y @xmarts/genius-setup@latest"
+            cmd = "npx -y %s" % spec
             if base:
                 cmd += ' --base-url "%s"' % base
             subprocess.Popen(cmd, shell=True, env=env, stdout=devnull, stderr=devnull,
                              stdin=subprocess.DEVNULL, creationflags=0x00000008)  # DETACHED_PROCESS
         else:
-            args = ["npx", "-y", "@xmarts/genius-setup@latest"]
+            args = ["npx", "-y", spec]
             if base:
                 args += ["--base-url", base]
             subprocess.Popen(args, env=env, stdout=devnull, stderr=devnull,
@@ -125,14 +167,19 @@ def main():
     cfg = _cfg()
     if not cfg.get("token"):
         return  # not configured -> silent no-op
-    _maybe_self_update(cfg)   # background, daily, zero-action upgrades
     event = _event()
     name = event.get("hook_event_name") or (
         "UserPromptSubmit" if event.get("prompt") else "SessionStart")
     if name == "SessionStart":
+        _maybe_self_update(cfg)   # TTL-only on priming
         _emit("SessionStart", SESSION_PRIMER)
     else:
-        _emit("UserPromptSubmit", _inject(cfg, event.get("prompt") or ""))
+        context, force_epoch, pin_version = _inject(cfg, event.get("prompt") or "")
+        # The inject call already round-tripped the server, so honour any
+        # admin-pushed force-update epoch here (bypasses the daily TTL) and install
+        # the exact server-pinned version (never @latest).
+        _maybe_self_update(cfg, force_epoch, pin_version)
+        _emit("UserPromptSubmit", context)
 
 
 if __name__ == "__main__":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xmarts/genius-setup",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "One-command, self-updating onboarding for Xmarts Genius (Brain MCP + per-turn injection + automatic session/time capture + CLAUDE.md protocol). Secret-free onboarding via single-use setup-token exchange (no Bearer in the GET-able bootstrap). Installs once; self-updates daily so new tools/skills/features arrive with zero action.",
   "bin": {
     "genius-setup": "bin/genius-setup.js"