claude-code-pilot 2.0.0

package/ecc/skills/continuous-learning-v2/agents/observer.md

@@ -0,0 +1,198 @@
+---
+name: observer
+description: Background agent that analyzes session observations to detect patterns and create instincts. Uses Haiku for cost-efficiency. v2.1 adds project-scoped instincts.
+model: haiku
+---
+
+# Observer Agent
+
+A background agent that analyzes observations from Claude Code sessions to detect patterns and create instincts.
+
+## When to Run
+
+- After enough observations accumulate (configurable, default 20)
+- On a scheduled interval (configurable, default 5 minutes)
+- When triggered on demand via SIGUSR1 to the observer process
+
+## Input
+
+Reads observations from the **project-scoped** observations file:
+- Project: `~/.claude/homunculus/projects/<project-hash>/observations.jsonl`
+- Global fallback: `~/.claude/homunculus/observations.jsonl`
+
+```jsonl
+{"timestamp":"2025-01-22T10:30:00Z","event":"tool_start","session":"abc123","tool":"Edit","input":"...","project_id":"a1b2c3d4e5f6","project_name":"my-react-app"}
+{"timestamp":"2025-01-22T10:30:01Z","event":"tool_complete","session":"abc123","tool":"Edit","output":"...","project_id":"a1b2c3d4e5f6","project_name":"my-react-app"}
+{"timestamp":"2025-01-22T10:30:05Z","event":"tool_start","session":"abc123","tool":"Bash","input":"npm test","project_id":"a1b2c3d4e5f6","project_name":"my-react-app"}
+{"timestamp":"2025-01-22T10:30:10Z","event":"tool_complete","session":"abc123","tool":"Bash","output":"All tests pass","project_id":"a1b2c3d4e5f6","project_name":"my-react-app"}
+```
+
+## Pattern Detection
+
+Look for these patterns in observations:
+
+### 1. User Corrections
+When a user's follow-up message corrects Claude's previous action:
+- "No, use X instead of Y"
+- "Actually, I meant..."
+- Immediate undo/redo patterns
+
+→ Create instinct: "When doing X, prefer Y"
+
+### 2. Error Resolutions
+When an error is followed by a fix:
+- Tool output contains error
+- Next few tool calls fix it
+- Same error type resolved similarly multiple times
+
+→ Create instinct: "When encountering error X, try Y"
+
+### 3. Repeated Workflows
+When the same sequence of tools is used multiple times:
+- Same tool sequence with similar inputs
+- File patterns that change together
+- Time-clustered operations
+
+→ Create workflow instinct: "When doing X, follow steps Y, Z, W"
+
+### 4. Tool Preferences
+When certain tools are consistently preferred:
+- Always uses Grep before Edit
+- Prefers Read over Bash cat
+- Uses specific Bash commands for certain tasks
+
+→ Create instinct: "When needing X, use tool Y"
+
+## Output
+
+Creates/updates instincts in the **project-scoped** instincts directory:
+- Project: `~/.claude/homunculus/projects/<project-hash>/instincts/personal/`
+- Global: `~/.claude/homunculus/instincts/personal/` (for universal patterns)
+
+### Project-Scoped Instinct (default)
+
+```yaml
+---
+id: use-react-hooks-pattern
+trigger: "when creating React components"
+confidence: 0.65
+domain: "code-style"
+source: "session-observation"
+scope: project
+project_id: "a1b2c3d4e5f6"
+project_name: "my-react-app"
+---
+
+# Use React Hooks Pattern
+
+## Action
+Always use functional components with hooks instead of class components.
+
+## Evidence
+- Observed 8 times in session abc123
+- Pattern: All new components use useState/useEffect
+- Last observed: 2025-01-22
+```
+
+### Global Instinct (universal patterns)
+
+```yaml
+---
+id: always-validate-user-input
+trigger: "when handling user input"
+confidence: 0.75
+domain: "security"
+source: "session-observation"
+scope: global
+---
+
+# Always Validate User Input
+
+## Action
+Validate and sanitize all user input before processing.
+
+## Evidence
+- Observed across 3 different projects
+- Pattern: User consistently adds input validation
+- Last observed: 2025-01-22
+```
+
+## Scope Decision Guide
+
+When creating instincts, determine scope based on these heuristics:
+
+| Pattern Type | Scope | Examples |
+|-------------|-------|---------|
+| Language/framework conventions | **project** | "Use React hooks", "Follow Django REST patterns" |
+| File structure preferences | **project** | "Tests in `__tests__`/", "Components in src/components/" |
+| Code style | **project** | "Use functional style", "Prefer dataclasses" |
+| Error handling strategies | **project** (usually) | "Use Result type for errors" |
+| Security practices | **global** | "Validate user input", "Sanitize SQL" |
+| General best practices | **global** | "Write tests first", "Always handle errors" |
+| Tool workflow preferences | **global** | "Grep before Edit", "Read before Write" |
+| Git practices | **global** | "Conventional commits", "Small focused commits" |
+
+**When in doubt, default to `scope: project`** — it's safer to be project-specific and promote later than to contaminate the global space.
+
+## Confidence Calculation
+
+Initial confidence based on observation frequency:
+- 1-2 observations: 0.3 (tentative)
+- 3-5 observations: 0.5 (moderate)
+- 6-10 observations: 0.7 (strong)
+- 11+ observations: 0.85 (very strong)
+
+Confidence adjusts over time:
+- +0.05 for each confirming observation
+- -0.1 for each contradicting observation
+- -0.02 per week without observation (decay)
+
+## Instinct Promotion (Project → Global)
+
+An instinct should be promoted from project-scoped to global when:
+1. The **same pattern** (by id or similar trigger) exists in **2+ different projects**
+2. Each instance has confidence **>= 0.8**
+3. The domain is in the global-friendly list (security, general-best-practices, workflow)
+
+Promotion is handled by the `instinct-cli.py promote` command or the `/evolve` analysis.
+
+## Important Guidelines
+
+1. **Be Conservative**: Only create instincts for clear patterns (3+ observations)
+2. **Be Specific**: Narrow triggers are better than broad ones
+3. **Track Evidence**: Always include what observations led to the instinct
+4. **Respect Privacy**: Never include actual code snippets, only patterns
+5. **Merge Similar**: If a new instinct is similar to existing, update rather than duplicate
+6. **Default to Project Scope**: Unless the pattern is clearly universal, make it project-scoped
+7. **Include Project Context**: Always set `project_id` and `project_name` for project-scoped instincts
+
+## Example Analysis Session
+
+Given observations:
+```jsonl
+{"event":"tool_start","tool":"Grep","input":"pattern: useState","project_id":"a1b2c3","project_name":"my-app"}
+{"event":"tool_complete","tool":"Grep","output":"Found in 3 files","project_id":"a1b2c3","project_name":"my-app"}
+{"event":"tool_start","tool":"Read","input":"src/hooks/useAuth.ts","project_id":"a1b2c3","project_name":"my-app"}
+{"event":"tool_complete","tool":"Read","output":"[file content]","project_id":"a1b2c3","project_name":"my-app"}
+{"event":"tool_start","tool":"Edit","input":"src/hooks/useAuth.ts...","project_id":"a1b2c3","project_name":"my-app"}
+```
+
+Analysis:
+- Detected workflow: Grep → Read → Edit
+- Frequency: Seen 5 times this session
+- **Scope decision**: This is a general workflow pattern (not project-specific) → **global**
+- Create instinct:
+  - trigger: "when modifying code"
+  - action: "Search with Grep, confirm with Read, then Edit"
+  - confidence: 0.6
+  - domain: "workflow"
+  - scope: "global"
+
+## Integration with Skill Creator
+
+When instincts are imported from Skill Creator (repo analysis), they have:
+- `source: "repo-analysis"`
+- `source_repo: "https://github.com/..."`
+- `scope: "project"` (since they come from a specific repo)
+
+These should be treated as team/project conventions with higher initial confidence (0.7+).

package/ecc/skills/continuous-learning-v2/agents/start-observer.sh

@@ -0,0 +1,194 @@
+#!/bin/bash
+# Continuous Learning v2 - Observer Agent Launcher
+#
+# Starts the background observer agent that analyzes observations
+# and creates instincts. Uses Haiku model for cost efficiency.
+#
+# v2.1: Project-scoped — detects current project and analyzes
+#       project-specific observations into project-scoped instincts.
+#
+# Usage:
+#   start-observer.sh        # Start observer for current project (or global)
+#   start-observer.sh stop   # Stop running observer
+#   start-observer.sh status # Check if observer is running
+
+set -e
+
+# NOTE: set -e is disabled inside the background subshell below
+# to prevent claude CLI failures from killing the observer loop.
+
+# ─────────────────────────────────────────────
+# Project detection
+# ─────────────────────────────────────────────
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+SKILL_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+OBSERVER_LOOP_SCRIPT="${SCRIPT_DIR}/observer-loop.sh"
+
+# Source shared project detection helper
+# This sets: PROJECT_ID, PROJECT_NAME, PROJECT_ROOT, PROJECT_DIR
+source "${SKILL_ROOT}/scripts/detect-project.sh"
+PYTHON_CMD="${CLV2_PYTHON_CMD:-}"
+
+# ─────────────────────────────────────────────
+# Configuration
+# ─────────────────────────────────────────────
+
+CONFIG_DIR="${HOME}/.claude/homunculus"
+CONFIG_FILE="${SKILL_ROOT}/config.json"
+# PID file is project-scoped so each project can have its own observer
+PID_FILE="${PROJECT_DIR}/.observer.pid"
+LOG_FILE="${PROJECT_DIR}/observer.log"
+OBSERVATIONS_FILE="${PROJECT_DIR}/observations.jsonl"
+INSTINCTS_DIR="${PROJECT_DIR}/instincts/personal"
+
+# Read config values from config.json
+OBSERVER_INTERVAL_MINUTES=5
+MIN_OBSERVATIONS=20
+OBSERVER_ENABLED=false
+if [ -f "$CONFIG_FILE" ]; then
+  if [ -z "$PYTHON_CMD" ]; then
+    echo "No python interpreter found; using built-in observer defaults." >&2
+  else
+    _config=$(CLV2_CONFIG="$CONFIG_FILE" "$PYTHON_CMD" -c "
+import json, os
+with open(os.environ['CLV2_CONFIG']) as f:
+    cfg = json.load(f)
+obs = cfg.get('observer', {})
+print(obs.get('run_interval_minutes', 5))
+print(obs.get('min_observations_to_analyze', 20))
+print(str(obs.get('enabled', False)).lower())
+" 2>/dev/null || echo "5
+20
+false")
+    _interval=$(echo "$_config" | sed -n '1p')
+    _min_obs=$(echo "$_config" | sed -n '2p')
+    _enabled=$(echo "$_config" | sed -n '3p')
+    if [ "$_interval" -gt 0 ] 2>/dev/null; then
+      OBSERVER_INTERVAL_MINUTES="$_interval"
+    fi
+    if [ "$_min_obs" -gt 0 ] 2>/dev/null; then
+      MIN_OBSERVATIONS="$_min_obs"
+    fi
+    if [ "$_enabled" = "true" ]; then
+      OBSERVER_ENABLED=true
+    fi
+  fi
+fi
+OBSERVER_INTERVAL_SECONDS=$((OBSERVER_INTERVAL_MINUTES * 60))
+
+echo "Project: ${PROJECT_NAME} (${PROJECT_ID})"
+echo "Storage: ${PROJECT_DIR}"
+
+# Windows/Git-Bash detection (Issue #295)
+UNAME_LOWER="$(uname -s 2>/dev/null | tr '[:upper:]' '[:lower:]')"
+IS_WINDOWS=false
+case "$UNAME_LOWER" in
+  *mingw*|*msys*|*cygwin*) IS_WINDOWS=true ;;
+esac
+
+case "${1:-start}" in
+  stop)
+    if [ -f "$PID_FILE" ]; then
+      pid=$(cat "$PID_FILE")
+      if kill -0 "$pid" 2>/dev/null; then
+        echo "Stopping observer for ${PROJECT_NAME} (PID: $pid)..."
+        kill "$pid"
+        rm -f "$PID_FILE"
+        echo "Observer stopped."
+      else
+        echo "Observer not running (stale PID file)."
+        rm -f "$PID_FILE"
+      fi
+    else
+      echo "Observer not running."
+    fi
+    exit 0
+    ;;
+
+  status)
+    if [ -f "$PID_FILE" ]; then
+      pid=$(cat "$PID_FILE")
+      if kill -0 "$pid" 2>/dev/null; then
+        echo "Observer is running (PID: $pid)"
+        echo "Log: $LOG_FILE"
+        echo "Observations: $(wc -l < "$OBSERVATIONS_FILE" 2>/dev/null || echo 0) lines"
+        # Also show instinct count
+        instinct_count=$(find "$INSTINCTS_DIR" -name "*.yaml" 2>/dev/null | wc -l)
+        echo "Instincts: $instinct_count"
+        exit 0
+      else
+        echo "Observer not running (stale PID file)"
+        rm -f "$PID_FILE"
+        exit 1
+      fi
+    else
+      echo "Observer not running"
+      exit 1
+    fi
+    ;;
+
+  start)
+    # Check if observer is disabled in config
+    if [ "$OBSERVER_ENABLED" != "true" ]; then
+      echo "Observer is disabled in config.json (observer.enabled: false)."
+      echo "Set observer.enabled to true in config.json to enable."
+      exit 1
+    fi
+
+    # Check if already running
+    if [ -f "$PID_FILE" ]; then
+      pid=$(cat "$PID_FILE")
+      if kill -0 "$pid" 2>/dev/null; then
+        echo "Observer already running for ${PROJECT_NAME} (PID: $pid)"
+        exit 0
+      fi
+      rm -f "$PID_FILE"
+    fi
+
+    echo "Starting observer agent for ${PROJECT_NAME}..."
+
+    if [ ! -x "$OBSERVER_LOOP_SCRIPT" ]; then
+      echo "Observer loop script not found or not executable: $OBSERVER_LOOP_SCRIPT"
+      exit 1
+    fi
+
+    # The observer loop — fully detached with nohup, IO redirected to log.
+    # Variables are passed via env; observer-loop.sh handles analysis/retry flow.
+    nohup env \
+      CONFIG_DIR="$CONFIG_DIR" \
+      PID_FILE="$PID_FILE" \
+      LOG_FILE="$LOG_FILE" \
+      OBSERVATIONS_FILE="$OBSERVATIONS_FILE" \
+      INSTINCTS_DIR="$INSTINCTS_DIR" \
+      PROJECT_DIR="$PROJECT_DIR" \
+      PROJECT_NAME="$PROJECT_NAME" \
+      PROJECT_ID="$PROJECT_ID" \
+      MIN_OBSERVATIONS="$MIN_OBSERVATIONS" \
+      OBSERVER_INTERVAL_SECONDS="$OBSERVER_INTERVAL_SECONDS" \
+      CLV2_IS_WINDOWS="$IS_WINDOWS" \
+      "$OBSERVER_LOOP_SCRIPT" >> "$LOG_FILE" 2>&1 &
+
+    # Wait for PID file
+    sleep 2
+
+    if [ -f "$PID_FILE" ]; then
+      pid=$(cat "$PID_FILE")
+      if kill -0 "$pid" 2>/dev/null; then
+        echo "Observer started (PID: $pid)"
+        echo "Log: $LOG_FILE"
+      else
+        echo "Failed to start observer (process died immediately, check $LOG_FILE)"
+        exit 1
+      fi
+    else
+      echo "Failed to start observer"
+      exit 1
+    fi
+    ;;
+
+  *)
+    echo "Usage: $0 {start|stop|status}"
+    exit 1
+    ;;
+esac

package/ecc/skills/continuous-learning-v2/config.json

@@ -0,0 +1,8 @@
+{
+  "version": "2.1",
+  "observer": {
+    "enabled": false,
+    "run_interval_minutes": 5,
+    "min_observations_to_analyze": 20
+  }
+}

package/ecc/skills/continuous-learning-v2/hooks/observe.sh

@@ -0,0 +1,246 @@
+#!/bin/bash
+# Continuous Learning v2 - Observation Hook
+#
+# Captures tool use events for pattern analysis.
+# Claude Code passes hook data via stdin as JSON.
+#
+# v2.1: Project-scoped observations — detects current project context
+#       and writes observations to project-specific directory.
+#
+# Registered via plugin hooks/hooks.json (auto-loaded when plugin is enabled).
+# Can also be registered manually in ~/.claude/settings.json.
+
+set -e
+
+# Hook phase from CLI argument: "pre" (PreToolUse) or "post" (PostToolUse)
+HOOK_PHASE="${1:-post}"
+
+# ─────────────────────────────────────────────
+# Read stdin first (before project detection)
+# ─────────────────────────────────────────────
+
+# Read JSON from stdin (Claude Code hook format)
+INPUT_JSON=$(cat)
+
+# Exit if no input
+if [ -z "$INPUT_JSON" ]; then
+  exit 0
+fi
+
+resolve_python_cmd() {
+  if [ -n "${CLV2_PYTHON_CMD:-}" ] && command -v "$CLV2_PYTHON_CMD" >/dev/null 2>&1; then
+    printf '%s\n' "$CLV2_PYTHON_CMD"
+    return 0
+  fi
+
+  if command -v python3 >/dev/null 2>&1; then
+    printf '%s\n' python3
+    return 0
+  fi
+
+  if command -v python >/dev/null 2>&1; then
+    printf '%s\n' python
+    return 0
+  fi
+
+  return 1
+}
+
+PYTHON_CMD="$(resolve_python_cmd 2>/dev/null || true)"
+if [ -z "$PYTHON_CMD" ]; then
+  echo "[observe] No python interpreter found, skipping observation" >&2
+  exit 0
+fi
+
+# ─────────────────────────────────────────────
+# Extract cwd from stdin for project detection
+# ─────────────────────────────────────────────
+
+# Extract cwd from the hook JSON to use for project detection.
+# This avoids spawning a separate git subprocess when cwd is available.
+STDIN_CWD=$(echo "$INPUT_JSON" | "$PYTHON_CMD" -c '
+import json, sys
+try:
+    data = json.load(sys.stdin)
+    cwd = data.get("cwd", "")
+    print(cwd)
+except(KeyError, TypeError, ValueError):
+    print("")
+' 2>/dev/null || echo "")
+
+# If cwd was provided in stdin, use it for project detection
+if [ -n "$STDIN_CWD" ] && [ -d "$STDIN_CWD" ]; then
+  export CLAUDE_PROJECT_DIR="$STDIN_CWD"
+fi
+
+# ─────────────────────────────────────────────
+# Project detection
+# ─────────────────────────────────────────────
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+SKILL_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# Source shared project detection helper
+# This sets: PROJECT_ID, PROJECT_NAME, PROJECT_ROOT, PROJECT_DIR
+source "${SKILL_ROOT}/scripts/detect-project.sh"
+PYTHON_CMD="${CLV2_PYTHON_CMD:-$PYTHON_CMD}"
+
+# ─────────────────────────────────────────────
+# Configuration
+# ─────────────────────────────────────────────
+
+CONFIG_DIR="${HOME}/.claude/homunculus"
+OBSERVATIONS_FILE="${PROJECT_DIR}/observations.jsonl"
+MAX_FILE_SIZE_MB=10
+
+# Skip if disabled
+if [ -f "$CONFIG_DIR/disabled" ]; then
+  exit 0
+fi
+
+# Auto-purge observation files older than 30 days (runs once per session)
+PURGE_MARKER="${PROJECT_DIR}/.last-purge"
+if [ ! -f "$PURGE_MARKER" ] || [ "$(find "$PURGE_MARKER" -mtime +1 2>/dev/null)" ]; then
+  find "${PROJECT_DIR}" -name "observations-*.jsonl" -mtime +30 -delete 2>/dev/null || true
+  touch "$PURGE_MARKER" 2>/dev/null || true
+fi
+
+# Parse using Python via stdin pipe (safe for all JSON payloads)
+# Pass HOOK_PHASE via env var since Claude Code does not include hook type in stdin JSON
+PARSED=$(echo "$INPUT_JSON" | HOOK_PHASE="$HOOK_PHASE" "$PYTHON_CMD" -c '
+import json
+import sys
+import os
+
+try:
+    data = json.load(sys.stdin)
+
+    # Determine event type from CLI argument passed via env var.
+    # Claude Code does NOT include a "hook_type" field in the stdin JSON,
+    # so we rely on the shell argument ("pre" or "post") instead.
+    hook_phase = os.environ.get("HOOK_PHASE", "post")
+    event = "tool_start" if hook_phase == "pre" else "tool_complete"
+
+    # Extract fields - Claude Code hook format
+    tool_name = data.get("tool_name", data.get("tool", "unknown"))
+    tool_input = data.get("tool_input", data.get("input", {}))
+    tool_output = data.get("tool_response")
+    if tool_output is None:
+        tool_output = data.get("tool_output", data.get("output", ""))
+    session_id = data.get("session_id", "unknown")
+    tool_use_id = data.get("tool_use_id", "")
+    cwd = data.get("cwd", "")
+
+    # Truncate large inputs/outputs
+    if isinstance(tool_input, dict):
+        tool_input_str = json.dumps(tool_input)[:5000]
+    else:
+        tool_input_str = str(tool_input)[:5000]
+
+    if isinstance(tool_output, dict):
+        tool_response_str = json.dumps(tool_output)[:5000]
+    else:
+        tool_response_str = str(tool_output)[:5000]
+
+    print(json.dumps({
+        "parsed": True,
+        "event": event,
+        "tool": tool_name,
+        "input": tool_input_str if event == "tool_start" else None,
+        "output": tool_response_str if event == "tool_complete" else None,
+        "session": session_id,
+        "tool_use_id": tool_use_id,
+        "cwd": cwd
+    }))
+except Exception as e:
+    print(json.dumps({"parsed": False, "error": str(e)}))
+')
+
+# Check if parsing succeeded
+PARSED_OK=$(echo "$PARSED" | "$PYTHON_CMD" -c "import json,sys; print(json.load(sys.stdin).get('parsed', False))" 2>/dev/null || echo "False")
+
+if [ "$PARSED_OK" != "True" ]; then
+  # Fallback: log raw input for debugging (scrub secrets before persisting)
+  timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+  export TIMESTAMP="$timestamp"
+  echo "$INPUT_JSON" | "$PYTHON_CMD" -c '
+import json, sys, os, re
+
+_SECRET_RE = re.compile(
+    r"(?i)(api[_-]?key|token|secret|password|authorization|credentials?|auth)"
+    r"""(["'"'"'\s:=]+)"""
+    r"([A-Za-z]+\s+)?"
+    r"([A-Za-z0-9_\-/.+=]{8,})"
+)
+
+raw = sys.stdin.read()[:2000]
+raw = _SECRET_RE.sub(lambda m: m.group(1) + m.group(2) + (m.group(3) or "") + "[REDACTED]", raw)
+print(json.dumps({"timestamp": os.environ["TIMESTAMP"], "event": "parse_error", "raw": raw}))
+' >> "$OBSERVATIONS_FILE"
+  exit 0
+fi
+
+# Archive if file too large (atomic: rename with unique suffix to avoid race)
+if [ -f "$OBSERVATIONS_FILE" ]; then
+  file_size_mb=$(du -m "$OBSERVATIONS_FILE" 2>/dev/null | cut -f1)
+  if [ "${file_size_mb:-0}" -ge "$MAX_FILE_SIZE_MB" ]; then
+    archive_dir="${PROJECT_DIR}/observations.archive"
+    mkdir -p "$archive_dir"
+    mv "$OBSERVATIONS_FILE" "$archive_dir/observations-$(date +%Y%m%d-%H%M%S)-$$.jsonl" 2>/dev/null || true
+  fi
+fi
+
+# Build and write observation (now includes project context)
+# Scrub common secret patterns from tool I/O before persisting
+timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+export PROJECT_ID_ENV="$PROJECT_ID"
+export PROJECT_NAME_ENV="$PROJECT_NAME"
+export TIMESTAMP="$timestamp"
+
+echo "$PARSED" | "$PYTHON_CMD" -c '
+import json, sys, os, re
+
+parsed = json.load(sys.stdin)
+observation = {
+    "timestamp": os.environ["TIMESTAMP"],
+    "event": parsed["event"],
+    "tool": parsed["tool"],
+    "session": parsed["session"],
+    "project_id": os.environ.get("PROJECT_ID_ENV", "global"),
+    "project_name": os.environ.get("PROJECT_NAME_ENV", "global")
+}
+
+# Scrub secrets: match common key=value, key: value, and key"value patterns
+# Includes optional auth scheme (e.g., "Bearer", "Basic") before token
+_SECRET_RE = re.compile(
+    r"(?i)(api[_-]?key|token|secret|password|authorization|credentials?|auth)"
+    r"""(["'"'"'\s:=]+)"""
+    r"([A-Za-z]+\s+)?"
+    r"([A-Za-z0-9_\-/.+=]{8,})"
+)
+
+def scrub(val):
+    if val is None:
+        return None
+    return _SECRET_RE.sub(lambda m: m.group(1) + m.group(2) + (m.group(3) or "") + "[REDACTED]", str(val))
+
+if parsed["input"]:
+    observation["input"] = scrub(parsed["input"])
+if parsed["output"] is not None:
+    observation["output"] = scrub(parsed["output"])
+
+print(json.dumps(observation))
+' >> "$OBSERVATIONS_FILE"
+
+# Signal observer if running (check both project-scoped and global observer)
+for pid_file in "${PROJECT_DIR}/.observer.pid" "${CONFIG_DIR}/.observer.pid"; do
+  if [ -f "$pid_file" ]; then
+    observer_pid=$(cat "$pid_file")
+    if kill -0 "$observer_pid" 2>/dev/null; then
+      kill -USR1 "$observer_pid" 2>/dev/null || true
+    fi
+  fi
+done
+
+exit 0