agent-bios 0.11.0 → 0.12.0

package/learn/collect-learning.py

@@ -61,6 +61,34 @@ HOSTS = {
 CLAUDE_IMPORT_LINE = "@personal/learnings.md"
 CLAUDE_CENTRAL_IMPORT = "@central/bundle.md"
 
+
+def import_line_index(body, directive):
+    """Index of the line where `directive` is an ACTIVE import, or None.
+
+    Raw containment is not this question. `@personal/learnings.md` inside a fenced
+    example, or named in a sentence, loads nothing — and reading it as an import made
+    two different files claim a file was wired when it was not: capture reported the
+    entry `present` and wrote nothing, and migrate-learnings read a fenced central
+    import as evidence the corpus was loaded, which is half of what authorizes deleting
+    a user's personal copy. An import is a line whose whole content is the directive.
+
+    Fences are tracked rather than stripped so the index is an index into `body`'s own
+    lines, which is what the insertion point needs. Both ``` and ~~~ open and close.
+    """
+    fenced = False
+    for index, line in enumerate(body.splitlines()):
+        stripped = line.strip()
+        if stripped.startswith("```") or stripped.startswith("~~~"):
+            fenced = not fenced
+            continue
+        if not fenced and stripped == directive:
+            return index
+    return None
+
+
+def has_active_import(body, directive):
+    return import_line_index(body, directive) is not None
+
 # Codex AGENTS.md markers. The central pair is owned by compose/assemble.py
 # (kept in sync here); the personal-learnings pair is this tool's own region,
 # placed outside the central pair so re-assembly preserves it.
@@ -220,13 +248,16 @@ def ensure_claude_import(home, dry):
         entry.write_text(f"# CLAUDE.md\n\n{CLAUDE_IMPORT_LINE}\n", encoding="utf-8")
         return "created"
     body = entry.read_text(encoding="utf-8")
-    if CLAUDE_IMPORT_LINE in body:
+    if has_active_import(body, CLAUDE_IMPORT_LINE):
         return "present"
     if dry:
         print(f"  [dry] insert '{CLAUDE_IMPORT_LINE}' into {entry}")
         return "inserted"
     lines = body.splitlines(keepends=True)
-    idx = next((i for i, ln in enumerate(lines) if CLAUDE_CENTRAL_IMPORT in ln), 0)
+    # Anchored to the ACTIVE central import for the same reason: matching a fenced one
+    # would insert this import inside that fence, where it loads nothing either.
+    central = import_line_index(body, CLAUDE_CENTRAL_IMPORT)
+    idx = central if central is not None else 0
     backup(entry)
     lines.insert(idx + 1, CLAUDE_IMPORT_LINE + "\n")
     entry.write_text("".join(lines), encoding="utf-8")
@@ -543,6 +574,30 @@ def _self_test():
                    "\n" not in nl["lesson"] and "\r" not in nl["lesson"]
                    and "line one line two line three" == nl["lesson"]))
 
+    # 10) An import is a LINE, not a substring. Reading a fenced example or a sentence as
+    #     an active import made capture report the entry `present` and write nothing, so
+    #     the learning it had just saved would never load. Each negative is paired with the
+    #     positive that separates it: a guard that answered False to everything would
+    #     satisfy the first three rows and fail the fourth.
+    real = f"# CLAUDE.md\n{CLAUDE_CENTRAL_IMPORT}\n{CLAUDE_IMPORT_LINE}\n"
+    for name, body, want in (
+        ("fenced ``` example is not an import", f"# e\n```\n{CLAUDE_IMPORT_LINE}\n```\n", False),
+        ("fenced ~~~ example is not an import", f"# e\n~~~md\n{CLAUDE_IMPORT_LINE}\n~~~\n", False),
+        ("a sentence naming the path is not an import",
+         f"# e\nWe import {CLAUDE_IMPORT_LINE} from here.\n", False),
+        ("a standalone directive line IS an import", real, True),
+        ("indentation and trailing space still import",
+         f"# e\n  {CLAUDE_IMPORT_LINE}  \n", True),
+    ):
+        checks.append((f"import detection: {name}",
+                       has_active_import(body, CLAUDE_IMPORT_LINE) is want))
+    # The insertion point follows the same rule, or the new import lands inside the fence.
+    checks.append(("insertion anchors on an ACTIVE central import",
+                   import_line_index(real, CLAUDE_CENTRAL_IMPORT) == 1))
+    checks.append(("a fenced central import anchors nothing",
+                   import_line_index(f"# e\n```\n{CLAUDE_CENTRAL_IMPORT}\n```\n",
+                                     CLAUDE_CENTRAL_IMPORT) is None))
+
     failed = [name for name, ok in checks if not ok]
     if failed:
         for name in failed:

package/learn/migrate-learnings.py

@@ -42,6 +42,7 @@ import time
 
 sys.path.insert(0, str(pathlib.Path(__file__).resolve().parents[1] / "compose"))
 import pkgid  # noqa: E402  (package-identity primitive owned by compose/)
+import assemble  # noqa: E402  (owns the atomic-replace primitive both packages write with)
 
 REPO = pathlib.Path(__file__).resolve().parent.parent
 # Same home compose/corpus-state.py uses; the canary writes its activation proof here.
@@ -75,9 +76,21 @@ def load_collect():
 
 
 def load_manifest(path=MANIFEST):
+    # "Manifest absent/empty -> no-op" is this module's stated contract, and an existing
+    # zero-byte file is the empty case it was missing: json.loads("") raised out of the
+    # update path as a traceback. Whitespace-only reads as empty; anything else that
+    # will not parse is a REAL manifest that is broken, and says so through die().
     if not path.is_file():
         return []
-    data = json.loads(path.read_text(encoding="utf-8"))
+    raw = path.read_text(encoding="utf-8")
+    if not raw.strip():
+        return []
+    try:
+        data = json.loads(raw)
+    except json.JSONDecodeError as exc:
+        die(f"manifest is not valid JSON: {path} ({exc})")
+    if not isinstance(data, dict):
+        die(f"manifest is not an object: {path}")
     return [p for p in data.get("promotions", [])
             if isinstance(p, dict) and isinstance(p.get("learning_id"), str)]
 
@@ -134,6 +147,18 @@ def corpus_text(path, collect=None):
     return body
 
 
+# A placement is one of two kinds and they are verified differently, so the kind has to
+# be readable. It is derived from the anchor rather than carried as a new manifest field
+# because the two shapes do not overlap: a whole-file anchor is a bare filename, and a
+# bullet anchor is a phrase lifted from the rule, which always has spaces in it.
+FILE_ANCHOR_SUFFIXES = (".md", ".py", ".toml", ".json", ".sh")
+
+
+def anchor_names_a_file(anchor):
+    return (not any(ch.isspace() for ch in anchor)
+            and anchor.endswith(FILE_ANCHOR_SUFFIXES))
+
+
 def placed_here(home, anchor, collect=None):
     """Is the promoted item REALLY in this user's deployed corpus?
 
@@ -146,9 +171,13 @@ def placed_here(home, anchor, collect=None):
     if not isinstance(anchor, str) or not anchor:
         return False
     texts, dirs = corpus_surfaces(home)
-    for d in dirs:
-        if (d / anchor).is_file():
-            return True
+    if anchor_names_a_file(anchor):
+        # A whole-file placement is proven by the deployed FILE and by nothing else. It
+        # used to fall through to the text scan below, where any corpus document that
+        # merely NAMES the guide counted as proof the guide was installed — and the
+        # corpus names its guides constantly. This is the reachable case rather than the
+        # hypothetical one: the live manifest's only anchor is `tooling-gotchas.md`.
+        return any((d / anchor).is_file() for d in dirs)
     for f in texts:
         if f.is_file() and anchor in corpus_text(f, collect):
             return True
@@ -160,13 +189,17 @@ def backup(path):
 
 
 def atomic_write(path, text):
-    """Back up, then replace via a temp file + os.replace so a crash mid-write
-    can never truncate the durable personal file (reuses collect-learning's
-    write discipline)."""
+    """Back up, then replace atomically so a crash mid-write can never truncate the
+    durable personal file.
+
+    The replace itself is compose/assemble.py's — that module needed the same discipline
+    for the user's settings.json and AGENTS.md, and a four-line primitive written twice is
+    two places for the next `os.replace` subtlety to be got right in only one of them. The
+    BACKUP stays here: its `.bak-migrate-<ts>` name is what prune-backups.py matches to
+    know the copy is ours, and assemble's writes carry a different one.
+    """
     backup(path)
-    tmp = path.with_suffix(path.suffix + ".tmp")
-    tmp.write_text(text, encoding="utf-8")
-    os.replace(tmp, path)
+    assemble.replace_atomically(path, text)
 
 
 def prune_jsonl(jsonl, remove_ids, dry):
@@ -215,16 +248,23 @@ def prune_claude_prose(home, remove_ids, dry):
 
 
 def prune_codex_prose(home, remove_ids, collect, dry):
+    """Bullets removed, or None when the personal region is MALFORMED.
+
+    None rather than 0, because the caller has to tell "nothing matched" from "this file
+    cannot be pruned at all". Both used to read as 0, and the jsonl prune ran anyway —
+    deleting the durable record out from under a bullet still on screen, which is the
+    opposite of the no-op the malformed case promises.
+    """
     agents = home / "AGENTS.md"
     if not agents.is_file():
-        return 0
+        return 0     # no personal prose here at all — nothing to strand
     body = agents.read_text(encoding="utf-8")
     start, end = collect.PERSONAL_START, collect.PERSONAL_END
     if start not in body:
-        return 0
+        return 0     # region never opened — same as above
     pre, rest = body.split(start, 1)
     if end not in rest:   # malformed (missing, or END before START) → touch nothing
-        return 0
+        return None
     region, post = rest.split(end, 1)
     new_region, removed = prune_bullets(region, remove_ids)
     if removed and not dry:
@@ -249,7 +289,15 @@ def claude_corpus_loaded(home, state_dir=None):
     redundant, a wrong removal is data loss.
     """
     entry = home / "CLAUDE.md"
-    if not (entry.is_file() and collect_central_import() in entry.read_text(encoding="utf-8")):
+    if not entry.is_file():
+        return False
+    # ACTIVE import, not raw containment. The paragraph above already says a fenced or
+    # prose occurrence loads nothing; the test did not implement that, so the necessary
+    # half of the authorization passed on text that imports nothing. The proof below is
+    # bound to the bundle's rev and not to this file, so an entry edited after a passing
+    # canary keeps a matching proof — which is exactly when the weak half decides.
+    if not load_collect().has_active_import(
+            entry.read_text(encoding="utf-8"), collect_central_import()):
         return False
     bundle = home / "central" / "bundle.md"
     proof = (state_dir or STATE_DIR) / "activation.txt"
@@ -316,6 +364,15 @@ def migrate(home, host, promotions, in_bundle, collect, dry=False, corpus_loaded
     # would strand the prose bullet forever after a jsonl-only success (Review F4).
     if host == "codex":
         prose_removed = prune_codex_prose(home, remove_ids, collect, dry)
+        if prose_removed is None:
+            # The malformed-marker contract is "touch nothing", and it used to hold for
+            # exactly one of the two representations. A record and the bullet keyed by it
+            # move together or not at all.
+            return {"removed": 0, "jsonl_removed": 0, "prose_removed": 0,
+                    "kept_not_in_bundle": kept_not_in_bundle,
+                    "kept_not_placed": kept_not_placed,
+                    "kept_foreign_package": kept_foreign_pkg,
+                    "skipped": "personal-region-malformed"}
     else:
         prose_removed = prune_claude_prose(home, remove_ids, dry)
     jsonl_removed = prune_jsonl(jsonl, remove_ids, dry)
@@ -545,6 +602,37 @@ def _self_test():
     (fenced / "CLAUDE.md").write_text("# CLAUDE.md\n```\n@central/bundle.md\n```\n", encoding="utf-8")
     checks.append(("F2: import string with no activation proof -> KEEP",
                    claude_corpus_loaded(fenced, state_dir=fenced) is False))
+    # …and the same file WITH a matching proof, which is the case the line above cannot
+    # separate: it passes whether the import test is honest or not, because the missing
+    # proof decides it either way. The proof is bound to the bundle's rev and not to this
+    # file, so an entry edited after a passing canary keeps one — and then the import test
+    # is the only thing left standing between a fenced example and a delete.
+    (fenced / "central").mkdir(parents=True, exist_ok=True)
+    (fenced / "central" / "bundle.md").write_text(
+        "# bundle\nagent-bios-bundle-rev: deadbeef\n", encoding="utf-8")
+    (fenced / "activation.txt").write_text("agent-bios-bundle-rev: deadbeef\n", encoding="utf-8")
+    checks.append(("F2: FENCED import + matching proof -> still KEEP",
+                   claude_corpus_loaded(fenced, state_dir=fenced) is False))
+    (fenced / "CLAUDE.md").write_text("# CLAUDE.md\n@central/bundle.md\n", encoding="utf-8")
+    checks.append(("F2: the same proof with a REAL import -> loaded",
+                   claude_corpus_loaded(fenced, state_dir=fenced) is True))
+
+    # placed_here verifies a whole-file placement as a FILE and a bullet anchor as TEXT.
+    # They used to be OR'd, so any corpus document that merely NAMED a guide authorized
+    # deleting the personal copy of a learning placed in it — and the live manifest's one
+    # anchor is `tooling-gotchas.md`, which the entry file names in prose.
+    mention = pathlib.Path(tempfile.mkdtemp(prefix="migrate-anchor-"))
+    (mention / "guides").mkdir(parents=True)
+    (mention / "CLAUDE.md").write_text(
+        "# CLAUDE.md\nsee guides/tooling-gotchas.md for the traps\nthe bullet text itself\n",
+        encoding="utf-8")
+    checks.append(("anchor: a named-but-absent guide is NOT placed",
+                   placed_here(mention, "tooling-gotchas.md") is False))
+    checks.append(("anchor: a phrase anchor still matches corpus TEXT",
+                   placed_here(mention, "the bullet text itself") is True))
+    (mention / "guides" / "tooling-gotchas.md").write_text("# guide\n", encoding="utf-8")
+    checks.append(("anchor: the deployed guide file IS placed",
+                   placed_here(mention, "tooling-gotchas.md") is True))
     # (The old "full install is always loaded" case is gone with full mode: there is no shape
     # whose corpus loads without the entry import, so nothing is exempt from the proof.)
 
@@ -557,14 +645,50 @@ def _self_test():
     _, r_quoted = prune_bullets(twin, {"aaaa0000-0000-0000-0000-000000000000"})
     checks.append(("F5: trailing id removed, quoted id ignored", r_real == 1 and r_quoted == 0))
 
-    # 7) malformed codex markers (END before START) -> no-op, no corruption.
+    # 7) malformed codex markers (END before START) -> no-op, no corruption. "No-op" is a
+    #    claim about BOTH representations: reporting 0 removed said the same thing as
+    #    "nothing matched", so migrate() went on to delete the durable jsonl record while
+    #    the visible bullet stayed on screen. None is the signal that distinguishes them.
     bad = pathlib.Path(tempfile.mkdtemp(prefix="migrate-badcodex-"))
+    (bad / "personal").mkdir(parents=True)
     agents = bad / "AGENTS.md"
     agents.write_text(f"x {collect.PERSONAL_END} y {collect.PERSONAL_START} z", encoding="utf-8")
     before = agents.read_text(encoding="utf-8")
     rem = prune_codex_prose(bad, {"anything"}, collect, dry=False)
     checks.append(("malformed codex markers -> no-op",
-                   rem == 0 and agents.read_text(encoding="utf-8") == before))
+                   rem is None and agents.read_text(encoding="utf-8") == before))
+    bad_rec = rec(L["bb"], "builder-base")
+    (bad / "personal" / "learnings.jsonl").write_text(
+        json.dumps(bad_rec, ensure_ascii=False) + "\n", encoding="utf-8")
+    s = migrate(bad, "codex", promos, make_in_bundle(ALL_DOMAINS), collect)
+    checks.append(("malformed markers -> the jsonl record survives too",
+                   s.get("skipped") == "personal-region-malformed"
+                   and s["removed"] == 0 and local_ids(bad) == {L["bb"]}))
+    # The control for that: a WELL-FORMED region under the same call really does delete,
+    # so the assertion above is not passing because migrate() stopped working.
+    ok_home = pathlib.Path(tempfile.mkdtemp(prefix="migrate-okcodex-"))
+    (ok_home / "personal").mkdir(parents=True)
+    (ok_home / "AGENTS.md").write_text(f"# AGENTS.md\n- {A['bb']}\n", encoding="utf-8")
+    with open(ok_home / "personal" / "learnings.jsonl", "w", encoding="utf-8") as f:
+        r = rec(L["bb"], "builder-base")
+        f.write(json.dumps(r, ensure_ascii=False) + "\n")
+        collect.apply_codex(ok_home, collect.prose_bullet(r), dry=False)
+    s = migrate(ok_home, "codex", promos, make_in_bundle(ALL_DOMAINS), collect)
+    checks.append(("well-formed markers -> both representations go",
+                   s.get("skipped") is None and s["removed"] == 1 and not local_ids(ok_home)))
+
+    # 8) "Manifest absent/empty -> no-op" covers an existing zero-byte file, which used to
+    #    reach json.loads("") and raise out of the update path.
+    empty_dir = pathlib.Path(tempfile.mkdtemp(prefix="migrate-manifest-"))
+    empty = empty_dir / "promotions.json"
+    empty.write_text("", encoding="utf-8")
+    checks.append(("empty manifest file -> no-op", load_manifest(empty) == []))
+    (empty_dir / "whitespace.json").write_text("  \n\t\n", encoding="utf-8")
+    checks.append(("whitespace-only manifest -> no-op",
+                   load_manifest(empty_dir / "whitespace.json") == []))
+    valid = empty_dir / "valid.json"
+    valid.write_text('{"version": 2, "promotions": [{"learning_id": "x"}]}', encoding="utf-8")
+    checks.append(("a real manifest still loads", len(load_manifest(valid)) == 1))
 
     failed = [n for n, ok in checks if not ok]
     if failed:

package/learn/redact.py

@@ -23,7 +23,14 @@ import sys
 
 # Conservative: kill obvious secrets/identifiers, keep prose.
 SECRET_RE = [
-    re.compile(r'(?i)(api[_-]?key|secret|token|password|authorization|bearer)\s*[:=]\s*\S+'),
+    # The optional scheme word is what makes the HEADER form work. `\S+` alone stopped at
+    # `Bearer` and published the credential after it: `Authorization: Bearer <token>`
+    # redacted to `<REDACTED> <token>`, which is the single most common way a secret
+    # appears in a developer's terminal, and this floor is what stands between a captured
+    # learning and an upload. The `=` form was always fully covered — the two spellings
+    # of one header disagreeing is the defect, not the strictness.
+    re.compile(r'(?i)(api[_-]?key|secret|token|password|authorization|bearer)\s*[:=]\s*'
+               r'(?:(?:bearer|basic|digest|token)\s+)?\S+'),
     re.compile(r'sk-[A-Za-z0-9_-]{16,}'),
     re.compile(r'gh[pousr]_[A-Za-z0-9]{20,}'),
     re.compile(r'eyJ[A-Za-z0-9_-]{20,}\.'),                       # JWT-ish
@@ -48,11 +55,13 @@ def _self_test():
     any miss so the umbrella gate catches a regression in the floor."""
     must_redact = [
         ("api_key value", "my api_key=sk_live_ABCDEF0123456789 leaked", "sk_live_"),
-        # key[:=]value form. NB the "Authorization: Bearer <token>" space/scheme
-        # form is only partially caught here (up to the scheme word) unless the
-        # token itself matches a shape below (JWT/sk-/ghp_/…) — a known floor
-        # boundary carried over from the heavy flow, not tightened in Phase 3.
         ("authorization value", "set authorization=topsecretvalue123 here", "topsecretvalue123"),
+        # Both spellings of the SAME header, because only one of them used to work: the
+        # `=` form was fully redacted while the wire form published its credential.
+        ("authorization header form", "Authorization: Bearer opaque0123456789abcdef", "opaque0123456789abcdef"),
+        ("authorization header lowercase", "authorization: bearer abcdef0123456789xyz", "abcdef0123456789xyz"),
+        ("authorization header inside a command",
+         "curl -H 'Authorization: Bearer wire9876543210value'", "wire9876543210value"),
         ("openai key", "used sk-abcdefghij0123456789 here", "sk-abcdefghij"),
         ("github token", "token ghp_abcdefghij0123456789klmn committed", "ghp_"),
         ("aws key id", "key AKIA0123456789ABCD in env", "AKIA0123456789"),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-bios",
-  "version": "0.11.0",
-  "releaseDate": "2026-08-10",
+  "version": "0.12.0",
+  "releaseDate": "2026-08-18",
   "description": "A thin, low-level instruction layer for LLM CLI agents: one set of principles and behavior whichever model you run. Deploys into $HOME by copy via an explicit `agent-bios install`.",
   "bin": {
     "agent-bios": "install.sh"
@@ -12,6 +12,7 @@
     "claude/guides/",
     "claude/hooks/",
     "claude/agents/",
+    "claude/skills/",
     "codex/AGENTS.md",
     "codex/guides/",
     "codex/agents/",

package/provenance.json

@@ -1 +1 @@
-{"commit":"7726933922b63dc7d3749e6aa971fb395a26cfad","committedAt":"2026-08-10T16:38:38+09:00","dirty":false}
+{"commit":"bfcc56715fb031564e370ce236739e4208b7c513","committedAt":"2026-08-18T17:23:41+09:00","dirty":false}