auxilo-mcp 0.9.2 → 0.9.3

package/scripts/extract-local.js

@@ -19,7 +19,24 @@ const os = require('os');
 
 const CATEGORIES = ['data-processing', 'web-interaction', 'code-execution', 'communication', 'storage-state', 'content-generation', 'payment-financial', 'monitoring'];
 
-const EXTRACTION_PROMPT = `You are extracting reusable OPERATIONAL LEARNINGS from an AI agent's session transcript, to publish to a PUBLIC knowledge marketplace read by other AI agents.
+/**
+ * SPEC3 slice A1 gate — score-at-extraction, BUILT BUT DARK by default.
+ *
+ * ┌─ CRITICAL SEQUENCING CONSTRAINT (SPEC3-BUILDER-REVIEW-LOOP §3.1/§8) ──────┐
+ * │ Under a server WITHOUT the B1 extraction-channel hold, a clean /learn     │
+ * │ submission carrying a floor-passing quality_self_assessment publishes    │
+ * │ IMMEDIATELY (seamlessEligible). Turning this gate on against such a      │
+ * │ server silently flips hook extraction from "everything held" to "clean   │
+ * │ items auto-publish" — an unrecorded consent change (2026-06-10 class).   │
+ * │ Do NOT set AUXILO_SCORE_EXTRACTION=1 until the server holds              │
+ * │ submission_channel:'extraction' items behind standing consent (B1).      │
+ * └───────────────────────────────────────────────────────────────────────────┘
+ */
+function scoreExtractionEnabled(env = process.env) {
+  return env.AUXILO_SCORE_EXTRACTION === '1';
+}
+
+const EXTRACTION_PROMPT_BASE = `You are extracting reusable OPERATIONAL LEARNINGS from an AI agent's session transcript, to publish to a PUBLIC knowledge marketplace read by other AI agents.
 
 Extract 0 to 5 GENUINE learnings: non-obvious solutions, workarounds, API quirks, error root-causes, integration gotchas — the kind of thing that cost real debugging or combined multiple sources. SKIP trivial lookups, well-documented standard approaches, opinions, and conversation.
 
@@ -31,12 +48,36 @@ Output STRICT JSON ONLY — an array (possibly empty []) of objects with these k
   "category": one of ${JSON.stringify(CATEGORIES)}
   "tags": array of lowercase keyword strings
   "task_context": one sentence describing the task
-  "outcome": one of "success","partial","failure","workaround"
+  "outcome": one of "success","partial","failure","workaround"`;
+
+/** A1: rubric addendum — appended ONLY when scoreExtractionEnabled(). */
+const QUALITY_RUBRIC_ADDENDUM = `
+  "quality_self_assessment": an object scoring the learning honestly on four
+  dimensions, each an INTEGER 1-5: "specificity" (precise and detailed, not
+  vague), "actionability" (another agent can directly use it), "novelty"
+  (non-obvious; an LLM would likely get it wrong), "completeness" (context,
+  reproduction steps, caveats), plus "total" (the exact sum of the four).
+  A learning worth publishing scores at least 14/20 with no dimension below 3.
+  If a learning honestly scores below that bar, DROP it from the array rather
+  than inflating the numbers.`;
+
+const PROMPT_SUFFIX = `
 No prose, no explanation, no markdown code fences — just the raw JSON array.
 
 TRANSCRIPT:
 `;
 
+/** Build the extraction prompt for the current (or injected) gate state. */
+function buildExtractionPrompt(opts = {}) {
+  const withScore = opts.scoreExtraction !== undefined
+    ? Boolean(opts.scoreExtraction)
+    : scoreExtractionEnabled();
+  return EXTRACTION_PROMPT_BASE + (withScore ? QUALITY_RUBRIC_ADDENDUM : '') + PROMPT_SUFFIX;
+}
+
+/** Back-compat export: the default (gate-evaluated-at-call) prompt. */
+const EXTRACTION_PROMPT = buildExtractionPrompt({ scoreExtraction: false });
+
 /** Resolve the `claude` binary — hook/launchd env may have a minimal PATH. */
 function resolveClaudeBin() {
   const candidates = [
@@ -63,7 +104,7 @@ function resolveClaudeBin() {
  */
 function extractWithClaudeCode(transcript) {
   const bin = resolveClaudeBin();
-  const input = EXTRACTION_PROMPT + String(transcript).slice(0, 200000);
+  const input = buildExtractionPrompt() + String(transcript).slice(0, 200000);
   // Do NOT pass ANTHROPIC_API_KEY through — we want the user's logged-in Claude
   // subscription (OAuth), not an API key (which would bill someone). Delete it.
   const childEnv = { ...process.env, AUXILO_EXTRACTING: '1' };
@@ -79,8 +120,41 @@ function extractWithClaudeCode(transcript) {
   return { ok: true, out, reason: null };
 }
 
-/** Defensively parse a JSON array of learnings out of model output. */
-function parseLearnings(raw) {
+/**
+ * A1: validate a model-emitted quality_self_assessment. Returns the normalized
+ * object, or null when malformed/missing — the caller then OMITS the field
+ * entirely (never fabricate; the server's `awaiting_quality` hold is the
+ * correct fallback and is deliberately not a 400 — AUD19-6 quarantines rather
+ * than bounces).
+ */
+const QUALITY_DIMENSIONS = ['specificity', 'actionability', 'novelty', 'completeness'];
+function validateQualityAssessment(qa) {
+  if (!qa || typeof qa !== 'object' || Array.isArray(qa)) return null;
+  const out = {};
+  let sum = 0;
+  for (const dim of QUALITY_DIMENSIONS) {
+    const v = qa[dim];
+    if (!Number.isInteger(v) || v < 1 || v > 5) return null;
+    out[dim] = v;
+    sum += v;
+  }
+  if (!Number.isInteger(qa.total) || qa.total !== sum) return null;
+  out.total = sum;
+  return out;
+}
+
+/**
+ * Defensively parse a JSON array of learnings out of model output.
+ * A1: `quality_self_assessment` is attached ONLY when (a) the score gate is on
+ * (opts.scoreExtraction, default = env AUXILO_SCORE_EXTRACTION) AND (b) the
+ * assessment validates. Gate OFF strips the field even if the model emits one,
+ * so a dark 0.9.3 client can never arm seamless publish (see the sequencing
+ * constraint at scoreExtractionEnabled).
+ */
+function parseLearnings(raw, opts = {}) {
+  const withScore = opts.scoreExtraction !== undefined
+    ? Boolean(opts.scoreExtraction)
+    : scoreExtractionEnabled();
   let s = String(raw || '').trim();
   const fence = s.match(/```(?:json)?\s*([\s\S]*?)```/i);
   if (fence) s = fence[1].trim();
@@ -92,14 +166,21 @@ function parseLearnings(raw) {
   if (!Array.isArray(arr)) return [];
   return arr
     .filter(l => l && typeof l.title === 'string' && typeof l.body === 'string' && l.title.length >= 10 && l.body.length >= 50)
-    .map(l => ({
-      title: l.title,
-      body: l.body,
-      category: CATEGORIES.includes(l.category) ? l.category : 'code-execution',
-      tags: Array.isArray(l.tags) ? l.tags.slice(0, 8).map(String) : [],
-      task_context: typeof l.task_context === 'string' ? l.task_context : '',
-      outcome: ['success', 'partial', 'failure', 'workaround'].includes(l.outcome) ? l.outcome : 'success',
-    }));
+    .map(l => {
+      const out = {
+        title: l.title,
+        body: l.body,
+        category: CATEGORIES.includes(l.category) ? l.category : 'code-execution',
+        tags: Array.isArray(l.tags) ? l.tags.slice(0, 8).map(String) : [],
+        task_context: typeof l.task_context === 'string' ? l.task_context : '',
+        outcome: ['success', 'partial', 'failure', 'workaround'].includes(l.outcome) ? l.outcome : 'success',
+      };
+      if (withScore) {
+        const qa = validateQualityAssessment(l.quality_self_assessment);
+        if (qa) out.quality_self_assessment = qa;
+      }
+      return out;
+    });
 }
 
 /**
@@ -116,4 +197,8 @@ async function extractLocally(transcript, sourceType) {
   return { learnings: parseLearnings(out) };
 }
 
-module.exports = { extractLocally, parseLearnings, resolveClaudeBin, EXTRACTION_PROMPT, CATEGORIES };
+module.exports = {
+  extractLocally, parseLearnings, resolveClaudeBin, CATEGORIES,
+  EXTRACTION_PROMPT, buildExtractionPrompt, scoreExtractionEnabled,
+  validateQualityAssessment, QUALITY_DIMENSIONS,
+};

package/scripts/review-notice.js

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+
+/**
+ * scripts/review-notice.js — SessionStart held-count notice (LW-18 layer 1b)
+ *
+ * Invoked by the Claude Code SessionStart hook (structured entry written by
+ * `auxilo setup` → lib/installer.js registerClaudeCodeSessionStartNotice via
+ * the ~/.auxilo/bin/auxilo-review-notice.sh shim). Whatever this prints to
+ * stdout is added to the session's context — so the contract is strict:
+ *
+ *   COUNT ONLY. Never titles, never bodies, never flags. Pending bodies are
+ *   adversarial by assumption (some are held BECAUSE injection-flagged —
+ *   LW-18 threat model); surfacing content to a live agent at session start
+ *   would be a confused-deputy channel. One count + two command names, that
+ *   is all.
+ *
+ * Behavior:
+ *   - FAIL-SILENT: every non-happy path exits 0 with NO output. A broken
+ *     notice must never break (or noise up) a session.
+ *   - Recursion guard: AUXILO_EXTRACTING=1 (the headless `claude -p`
+ *     extraction child fires SessionStart too) → silent exit.
+ *   - Suppression: at most ONE notice per 4 hours, tracked in
+ *     ~/.auxilo/review-notice-state.json (LW-18 spec).
+ *   - Count source: GET /account/pending/summary with the credentials from
+ *     ~/.auxilo/credentials.json; 3.5s abort so session start is never held
+ *     hostage by a slow network.
+ *
+ * Self-contained (fs/path/os + global fetch) — ships in RUNNER_STACK to
+ * ~/.auxilo/bin/scripts/ and must not require anything outside that layout
+ * except node builtins.
+ *
+ * @module review-notice
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+/** ≤ 1 notice per 4h (LW-18 spec). */
+const NOTICE_SUPPRESSION_MS = 4 * 60 * 60 * 1000;
+
+/** Network budget: SessionStart hooks block session start. */
+const FETCH_TIMEOUT_MS = 3500;
+
+function auxiloDir(homeDir) {
+  return path.join(homeDir || os.homedir(), '.auxilo');
+}
+
+function statePath(homeDir) {
+  return path.join(auxiloDir(homeDir), 'review-notice-state.json');
+}
+
+/** Read suppression state; malformed/absent → {} (fail-open to notifying). */
+function readState(homeDir) {
+  try {
+    const s = JSON.parse(fs.readFileSync(statePath(homeDir), 'utf-8'));
+    return s && typeof s === 'object' ? s : {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Pure suppression decision: notify iff no prior notice, or the last one is
+ * older than the suppression window (bad timestamps read as "no prior").
+ */
+function shouldNotify(state, now = Date.now(), suppressionMs = NOTICE_SUPPRESSION_MS) {
+  const last = state && state.last_notice_at ? Date.parse(state.last_notice_at) : NaN;
+  if (!Number.isFinite(last)) return true;
+  return now - last >= suppressionMs;
+}
+
+/** Persist the suppression stamp (best-effort — failure must not throw). */
+function writeState(homeDir, now = Date.now()) {
+  try {
+    const p = statePath(homeDir);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, JSON.stringify({ last_notice_at: new Date(now).toISOString() }, null, 2) + '\n');
+  } catch { /* fail-silent */ }
+}
+
+/** The one line. Count only — see the header contract. */
+function renderNotice(count) {
+  return `Auxilo: ${count} learning(s) held for your review — run auxilo_review (MCP) or \`npx auxilo review\`.`;
+}
+
+/** Load credentials; null when absent/malformed/keyless. */
+function readCredentials(homeDir) {
+  try {
+    const creds = JSON.parse(fs.readFileSync(path.join(auxiloDir(homeDir), 'credentials.json'), 'utf-8'));
+    return creds && typeof creds === 'object' && creds.api_key ? creds : null;
+  } catch {
+    return null;
+  }
+}
+
+async function fetchPendingCount(creds, fetchImpl = fetch) {
+  const baseUrl = String(creds.base_url || 'https://auxilo.io').replace(/\/+$/, '');
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetchImpl(`${baseUrl}/account/pending/summary`, {
+      headers: { 'X-API-Key': creds.api_key },
+      signal: controller.signal,
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    const n = body && body.pending_count;
+    return Number.isFinite(n) ? n : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+async function main() {
+  // Recursion guard: extraction children must never notice (or burn the
+  // suppression window).
+  if (process.env.AUXILO_EXTRACTING === '1') return;
+
+  const homeDir = os.homedir();
+  const creds = readCredentials(homeDir);
+  if (!creds) return;
+
+  if (!shouldNotify(readState(homeDir))) return;
+
+  const count = await fetchPendingCount(creds);
+  if (count == null || count <= 0) return;
+
+  process.stdout.write(renderNotice(count) + '\n');
+  writeState(homeDir);
+}
+
+module.exports = {
+  shouldNotify, renderNotice, readState, writeState, readCredentials,
+  fetchPendingCount, NOTICE_SUPPRESSION_MS, FETCH_TIMEOUT_MS,
+};
+
+if (require.main === module) {
+  // FAIL-SILENT: exit 0 on every path, including internal errors.
+  main().then(() => process.exit(0)).catch(() => process.exit(0));
+}

package/scripts/runner.js

@@ -36,11 +36,9 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const crypto = require('crypto');
+const { spawn } = require('child_process');
 const { scanText, SENSITIVITY_FILTER_VERSION } = require('../lib/sensitivity-filter.js');
-const { ClaudeCodeSource } = require('./sources/claude-code.js');
-const { OpenClawSource } = require('./sources/openclaw.js');
-const { GeminiCliSource } = require('./sources/gemini-cli.js');
-const { AntigravitySource } = require('./sources/antigravity.js');
+const { TranscriptSource } = require('./sources/source.interface.js');
 const { GenericJsonlSource } = require('./sources/generic-jsonl.js');
 
 // ─── Constants ──────────────────────────────────────────────────────────────
@@ -87,14 +85,42 @@ const PENDING_DIR = path.join(AUXILO_DIR, 'pending-learnings');
 const LEDGER_PATH = path.join(AUXILO_DIR, 'ledger.json');
 const LOG_PATH = path.join(AUXILO_DIR, 'extract.log');
 
-// ─── Source Registry (§4.4) ─────────────────────────────────────────────────
+// ─── Source Registry (§4.4 / UC-3 dynamic) ──────────────────────────────────
+//
+// UC-3: the registry is built by enumerating scripts/sources/*.js — a new
+// adapter self-registers by dropping a file in that exports a TranscriptSource
+// subclass with a static `id`. Excluded by name: the abstract interface, and
+// generic-jsonl (the config-instantiated single-file FALLBACK, not a
+// discoverable source — its detect() is deliberately inert).
+//
+// Per-file try/catch: one broken adapter must never kill the runner
+// (fail-silent degradation, UC §5). Duplicate ids: first file wins
+// (alphabetical), so a rogue copy can't shadow an established adapter.
 
-const SOURCES = [
-  ClaudeCodeSource,
-  OpenClawSource,
-  GeminiCliSource,
-  AntigravitySource,
-];
+const SOURCE_REGISTRY_EXCLUDE = new Set(['source.interface.js', 'generic-jsonl.js']);
+
+function loadSources() {
+  const dir = path.join(__dirname, 'sources');
+  const classes = [];
+  let files = [];
+  try {
+    files = fs.readdirSync(dir).filter(f => f.endsWith('.js') && !SOURCE_REGISTRY_EXCLUDE.has(f)).sort();
+  } catch { return classes; }
+  for (const f of files) {
+    let mod;
+    try { mod = require(`./sources/${f}`); } catch { continue; } // broken adapter — skip silently
+    for (const exported of Object.values(mod || {})) {
+      if (typeof exported !== 'function') continue;
+      if (!(exported.prototype instanceof TranscriptSource)) continue;
+      if (!exported.id || exported.id === 'abstract') continue;
+      if (classes.some(c => c.id === exported.id)) continue;
+      classes.push(exported);
+    }
+  }
+  return classes;
+}
+
+const SOURCES = loadSources();
 
 async function enumerateActiveSources(filter) {
   const active = [];
@@ -233,32 +259,43 @@ function listPendingFiles() {
 
 // ─── Upload ─────────────────────────────────────────────────────────────────
 
-async function postExtract(transcript, sessionId, sourceType, _scrubReport) {
-  // CLIENT-SIDE extraction (2026-07-02). Server /extract is deprecated (410) — Auxilo
-  // does not pay to extract. The local model (via `claude -p`) extracts + self-screens
-  // the already-client-scrubbed transcript, and we submit finished learnings to /learn.
-  const { extractLocally } = require('./extract-local.js');
-  let learnings;
-  let skipped;
-  try {
-    ({ learnings, skipped } = await extractLocally(transcript, sourceType));
-  } catch (err) {
-    throw new Error(`Local extraction failed: ${err.message}`);
-  }
-  if (skipped) {
-    log(`[runner] ${skipped}`);
-    return { learnings_published: 0, learnings_rejected: 0, extraction_id: 'client-skip' };
-  }
+/**
+ * Submit finished learnings to POST /learn, classifying each response
+ * truthfully (P1-13b / SPEC3 A2):
+ *   2xx + status 'approved'        → published (seamless)
+ *   2xx + status 'pending_review'  → held (the contributor review queue)
+ *   anything else / network error  → rejected
+ *
+ * Every submission carries `submission_channel: 'extraction'` UNCONDITIONALLY.
+ * SPEC3 §3.2 trust analysis: the marker is a BRAKE, never a gas pedal — a
+ * pre-B1 server destructures known fields only and ignores it; a post-B1
+ * server uses it to HOLD extraction-channel items behind standing consent.
+ * Shipping it dark means the brake is in the field before scoring ever arms
+ * (see the AUXILO_SCORE_EXTRACTION sequencing constraint in extract-local.js).
+ *
+ * `quality_self_assessment` passes through spread-if-present — extract-local
+ * only attaches it when the A1 score gate is on.
+ *
+ * @param {Array<object>} learnings
+ * @param {string} sourceType
+ * @param {object} [opts]  { fetchImpl, baseUrl, apiKey } — injectable for tests
+ * @returns {Promise<{published:number, held:number, rejected:number}>}
+ */
+async function submitLearnings(learnings, sourceType, opts = {}) {
+  const fetchImpl = opts.fetchImpl || fetch;
+  const baseUrl = opts.baseUrl || BASE_URL;
+  const apiKey = opts.apiKey !== undefined ? opts.apiKey : API_KEY;
 
   let published = 0;
+  let held = 0;
   let rejected = 0;
   for (const l of learnings) {
     try {
-      const res = await fetch(`${BASE_URL}/learn`, {
+      const res = await fetchImpl(`${baseUrl}/learn`, {
         method: 'POST',
         headers: {
           'Content-Type': 'application/json',
-          'X-API-Key': API_KEY,
+          'X-API-Key': apiKey,
           'Idempotency-Key': crypto.randomUUID(),
         },
         body: JSON.stringify({
@@ -269,16 +306,69 @@ async function postExtract(transcript, sessionId, sourceType, _scrubReport) {
           task_context: l.task_context,
           outcome: l.outcome,
           contributor_agent: `auxilo-hook/${sourceType}`,
+          submission_channel: 'extraction',
+          ...(l.quality_self_assessment && { quality_self_assessment: l.quality_self_assessment }),
         }),
       });
-      if (res.ok) published += 1;
-      else rejected += 1;
+      if (!res.ok) { rejected += 1; continue; }
+      let body = {};
+      try { body = await res.json(); } catch { /* tolerate non-JSON 2xx */ }
+      if (body && body.status === 'pending_review') held += 1;
+      else published += 1;
     } catch (_) {
       rejected += 1;
     }
   }
-  log(`[runner] client-side extraction: ${learnings.length} candidate(s), published=${published} rejected=${rejected}`);
-  return { learnings_published: published, learnings_rejected: rejected, extraction_id: `client-${sessionId}` };
+  return { published, held, rejected };
+}
+
+async function postExtract(transcript, sessionId, sourceType, _scrubReport) {
+  // CLIENT-SIDE extraction (2026-07-02). Server /extract is deprecated (410) — Auxilo
+  // does not pay to extract. The local model (via `claude -p`) extracts + self-screens
+  // the already-client-scrubbed transcript, and we submit finished learnings to /learn.
+  const { extractLocally } = require('./extract-local.js');
+  let learnings;
+  let skipped;
+  try {
+    ({ learnings, skipped } = await extractLocally(transcript, sourceType));
+  } catch (err) {
+    throw new Error(`Local extraction failed: ${err.message}`);
+  }
+  if (skipped) {
+    log(`[runner] ${skipped}`);
+    return { learnings_published: 0, learnings_held: 0, learnings_rejected: 0, extraction_id: 'client-skip' };
+  }
+
+  const { published, held, rejected } = await submitLearnings(learnings, sourceType);
+  // NOTE: token-free prose — the digest-parsed `published=`/`held=`/`rejected=`
+  // tokens live ONLY on the per-run caller log lines. This line previously
+  // carried `published=` too and the digest double-counted every extraction
+  // (its dedup only drops byte-identical lines). P1-13b.
+  log(`[runner] client-side extraction: ${learnings.length} candidate(s) → ${published} live, ${held} held for review, ${rejected} rejected`);
+  return { learnings_published: published, learnings_held: held, learnings_rejected: rejected, extraction_id: `client-${sessionId}` };
+}
+
+// ─── Held-items local notification (LW-18 layer 2) ──────────────────────────
+
+/**
+ * macOS notification when a run holds items for review: COUNT ONLY, no titles,
+ * no content (pending bodies are adversarial by assumption — LW-18 threat
+ * model). Fail-silent: darwin-only, detached osascript spawn, every error
+ * swallowed; a broken notifier must never fail the run. AUXILO_NO_NOTIFY=1
+ * disables (tests, headless CI).
+ */
+function notifyHeld(count) {
+  try {
+    if (!count || count <= 0) return;
+    if (process.platform !== 'darwin') return;
+    if (process.env.AUXILO_NO_NOTIFY === '1') return;
+    const msg = `${count} learning(s) held for your review — run npx auxilo review`;
+    const child = spawn('/usr/bin/osascript', [
+      '-e', `display notification ${JSON.stringify(msg)} with title "Auxilo"`,
+    ], { stdio: 'ignore', detached: true });
+    child.unref();
+    child.on('error', () => { /* fail-silent */ });
+  } catch { /* fail-silent */ }
 }
 
 // ─── Install Hooks (B15) ────────────────────────────────────────────────────
@@ -362,19 +452,38 @@ function installHooks() {
 // Renamed 2026-07-15: the original label carried a dead pre-Fly host prefix (legacy-label purge).
 const SWEEPER_LABEL = 'io.auxilo.sweeper';
 
+/**
+ * The sweeper copy manifest. Sources rows are DERIVED by enumerating
+ * scripts/sources/*.js (UC-3): a new adapter file is automatically installed —
+ * the d8c7099 bug class (adapter added, manifest not, installed sweepers crash
+ * with MODULE_NOT_FOUND) is now structurally impossible. Exported for the
+ * manifest-closure test in test/wave3-client-funnel.test.js.
+ */
+function sweeperManifest(repoRoot = path.resolve(__dirname, '..')) {
+  const sourceRows = [];
+  try {
+    for (const f of fs.readdirSync(path.join(repoRoot, 'scripts', 'sources')).filter(f => f.endsWith('.js')).sort()) {
+      sourceRows.push([`scripts/sources/${f}`, `scripts/sources/${f}`, 0o644]);
+    }
+  } catch { /* missing dir surfaces as missing-file errors below */ }
+  return [
+    ['scripts/auxilo-sweeper-wrapper.sh', 'auxilo-sweeper-wrapper.sh', 0o755],
+    ['scripts/runner.js', 'scripts/runner.js', 0o755],
+    ...sourceRows,
+    ['lib/sensitivity-filter.js', 'lib/sensitivity-filter.js', 0o644],
+    // Client-side extraction (2026-07-02) — required by the sweep path since /extract went 410.
+    // Missing from this manifest until 2026-07-19: installed sweepers crashed with
+    // "Cannot find module './extract-local.js'" while queue files were retained.
+    ['scripts/extract-local.js', 'scripts/extract-local.js', 0o644],
+  ];
+}
+
 function installSweeper() {
   const repoRoot = path.resolve(__dirname, '..');
   const binRoot = path.join(AUXILO_DIR, 'bin');
 
   // 1. Copy executable surface, preserving relative layout so requires resolve.
-  const filesToCopy = [
-    ['scripts/auxilo-sweeper-wrapper.sh', 'auxilo-sweeper-wrapper.sh', 0o755],
-    ['scripts/runner.js', 'scripts/runner.js', 0o755],
-    ['scripts/sources/source.interface.js', 'scripts/sources/source.interface.js', 0o644],
-    ['scripts/sources/claude-code.js', 'scripts/sources/claude-code.js', 0o644],
-    ['scripts/sources/openclaw.js', 'scripts/sources/openclaw.js', 0o644],
-    ['lib/sensitivity-filter.js', 'lib/sensitivity-filter.js', 0o644],
-  ];
+  const filesToCopy = sweeperManifest(repoRoot);
   for (const [src, dest, mode] of filesToCopy) {
     const srcPath = path.join(repoRoot, src);
     const destPath = path.join(binRoot, dest);
@@ -734,7 +843,8 @@ async function main() {
 
     try {
       const result = await postExtract(cleaned, sessionId, sourceType, report);
-      log(`[runner] ✓ published=${result.learnings_published || 0} rejected=${result.learnings_rejected || 0} ${DIGEST_ACCOUNT} (extraction: ${result.extraction_id})`);
+      log(`[runner] ✓ published=${result.learnings_published || 0} held=${result.learnings_held || 0} rejected=${result.learnings_rejected || 0} ${DIGEST_ACCOUNT} (extraction: ${result.extraction_id})`);
+      notifyHeld(result.learnings_held || 0); // LW-18 layer 2: count-only, fail-silent
       // Mark only after a successful upload so a failed POST can be retried.
       const ledger = loadLedger();
       ledgerMark(ledger, sourceType, sessionId, contentSha, sessionRef.mtime);
@@ -751,13 +861,15 @@ async function main() {
     const pending = listPendingFiles();
     log(`[runner] Flushing ${pending.length} pending queue file(s)...`);
     let flushed = 0;
+    let flushHeld = 0;
     for (const qf of pending) {
       try {
         const payload = JSON.parse(fs.readFileSync(qf, 'utf-8'));
         const result = await postExtract(
           payload.transcript, payload.sessionId, payload.source, payload.scrubReport
         );
-        log(`[runner] ✓ Flushed ${path.basename(qf)}: published=${result.learnings_published || 0} rejected=${result.learnings_rejected || 0} ${DIGEST_ACCOUNT}`);
+        log(`[runner] ✓ Flushed ${path.basename(qf)}: published=${result.learnings_published || 0} held=${result.learnings_held || 0} rejected=${result.learnings_rejected || 0} ${DIGEST_ACCOUNT}`);
+        flushHeld += result.learnings_held || 0;
         deleteQueueFile(qf);
         flushed++;
       } catch (err) {
@@ -765,6 +877,7 @@ async function main() {
       }
     }
     log(`[runner] Flush complete: ${flushed}/${pending.length} succeeded`);
+    notifyHeld(flushHeld); // LW-18 layer 2: count-only, fail-silent
     process.exit(0);
   }
 
@@ -780,6 +893,7 @@ async function main() {
   let totalProcessed = 0;
   let totalSkipped = 0;
   let totalFailed = 0;
+  let totalHeld = 0;
 
   for (const source of sources) {
     log(`[runner] Discovering sessions from ${source.label} (${source.type})...`);
@@ -878,7 +992,8 @@ async function main() {
 
       try {
         const result = await postExtract(cleaned, sessionRef.sessionId, source.type, report);
-        log(`[runner]   ✓ published=${result.learnings_published || 0} rejected=${result.learnings_rejected || 0} ${DIGEST_ACCOUNT} (extraction: ${result.extraction_id})`);
+        log(`[runner]   ✓ published=${result.learnings_published || 0} held=${result.learnings_held || 0} rejected=${result.learnings_rejected || 0} ${DIGEST_ACCOUNT} (extraction: ${result.extraction_id})`);
+        totalHeld += result.learnings_held || 0;
         ledgerMark(ledger, source.type, sessionRef.sessionId, sha, sessionRef.mtime);
         deleteQueueFile(queueFile);
         saveLedger(ledger);
@@ -893,6 +1008,7 @@ async function main() {
 
   saveLedger(ledger);
   log(`[runner] Summary: ${totalDiscovered} discovered, ${totalProcessed} processed, ${totalSkipped} skipped, ${totalFailed} failed`);
+  notifyHeld(totalHeld); // LW-18 layer 2: one notification per sweep, count-only
   process.exit(totalFailed > 0 ? 1 : 0);
 }
 
@@ -902,6 +1018,7 @@ module.exports = {
   parseArgs, writeQueueFile, deleteQueueFile, listPendingFiles,
   loadLedger, saveLedger, ledgerHighWater, ledgerHas, ledgerMark,
   installHooks, installSweeper, installDigest, printStatus, scrubAndVerify, enumerateActiveSources,
+  loadSources, SOURCES, sweeperManifest, submitLearnings, notifyHeld,
   KILL_SWITCH_PATH, PENDING_DIR, LEDGER_PATH,
 };