claude-self-reflect 9.3.0 → 9.4.0

package/README.md

@@ -27,7 +27,7 @@ Single 44MB binary. No databases. No containers. No API keys required.
 - [The Problem](#the-forgetting-problem) — Why Claude needs memory
 - [The Architecture](#one-binary-44mb) — How CSR solves it
 - [The Pipeline](#the-pipeline) — Progressive enrichment (9.3x improvement)
-- [Install](#install) — One command setup
+- [Install](#install) — One-command install, consent-first activation
 - [What You'll Ask](#what-youll-ask) — Natural language, no syntax
 - [Performance](#performance) | [MCP Tools](#mcp-tools) | [Hooks](#hooks) | [CLI](#cli-reference)
 - [AI Narratives](#ai-narratives-optional) | [Upgrading](#upgrading-from-v7x) | [Troubleshooting](#troubleshooting)
@@ -71,7 +71,7 @@ Everything runs locally in a single process. No Docker, no database server, no A
 - **FastEmbed** — 384-dim local embeddings
 - **AST** — code-aware search across 6 languages
 
-**6 hooks** fire across the session lifecycle. **13 MCP tools** for explicit search — including `csr_code_graph`, linking code symbols to the conversations that shaped them.
+**6 hooks** fire across the session lifecycle. **15 MCP tools** for explicit search — including `csr_code_graph`, linking code symbols to the conversations that shaped them.
 
 <br clear="both" />
 
@@ -104,7 +104,9 @@ Higher quality context. Better decisions. Fewer tokens.
 curl -fsSL https://raw.githubusercontent.com/ramakay/claude-self-reflect/main/scripts/install.sh | sh
 ```
 
-One command. Downloads the binary, runs setup, registers MCP server, installs 6 hooks. Restart Claude Code.
+Downloads the binary (SHA256-verified), then asks before activating. Setup — which registers the MCP server, installs 6 hooks, and imports your conversations — only runs with your consent. Restart Claude Code after.
+
+Non-interactive installs never activate on their own: set `CSR_AUTO_SETUP=1` to opt in, or run `csr-engine setup` yourself.
 
 | Platform | Support |
 |----------|---------|
@@ -118,8 +120,11 @@ One command. Downloads the binary, runs setup, registers MCP server, installs 6
 
 ```bash
 npm install -g claude-self-reflect
+csr-engine setup   # activation is a separate, explicit step
 ```
 
+By default `npm install` only downloads the checksummed binary — it does not touch `~/.claude` or index conversations. Activation happens when you run `csr-engine setup`, or set `CSR_AUTO_SETUP=1` during install to opt in.
+
 </details>
 
 <details>

package/installer/postinstall.js

@@ -2,11 +2,16 @@
 
 /**
  * Post-install hook for npm.
- * Downloads the csr-engine binary from GitHub Releases.
+ * Downloads the csr-engine binary from GitHub Releases and verifies its
+ * checksum. By default nothing else: activation (hook registration, MCP
+ * registration, conversation import) happens when the user explicitly runs
+ * `csr-engine setup` — postinstall does not touch ~/.claude or index data
+ * unless the user opts in with CSR_AUTO_SETUP=1.
  * Detects existing Python CSR installations and guides upgrade.
  *
  * Environment variables:
  *   CSR_SKIP_BINARY_DOWNLOAD=1  — Skip binary download (CI, offline, custom builds)
+ *   CSR_AUTO_SETUP=1            — Opt in to running `csr-engine setup` after download
  */
 
 import {
@@ -186,6 +191,30 @@ function findExpectedChecksum(checksumData, filename) {
   throw new Error(`No checksum entry found for ${filename}`);
 }
 
+// --- Activation ---
+
+// Activation is a separate consent event: setup writes hooks into
+// ~/.claude/settings.json, registers the MCP server, and imports
+// conversation transcripts. Never do that from a package manager
+// lifecycle script unless the user explicitly opted in.
+function runOrExplainActivation(binaryPath) {
+  if (process.env.CSR_AUTO_SETUP === '1') {
+    console.log('  CSR_AUTO_SETUP=1 — running setup...');
+    try {
+      execFileSync(binaryPath, ['setup'], { stdio: 'inherit', timeout: 60000 });
+      console.log('\n  \x1b[32mDone. Restart Claude Code to activate.\x1b[0m\n');
+    } catch {
+      console.log('\n  Setup failed. Run manually: csr-engine setup\n');
+      process.exitCode = 1;
+    }
+  } else {
+    console.log('\n  \x1b[1mTo activate\x1b[0m (registers the MCP server, installs hooks,');
+    console.log('  and imports your conversations), run:');
+    console.log('\n    \x1b[1;32mcsr-engine setup\x1b[0m\n');
+    console.log('  Then restart Claude Code.\n');
+  }
+}
+
 // --- Existing installation detection ---
 
 function findExistingBinary() {
@@ -251,7 +280,8 @@ async function main() {
         stdio: ['ignore', 'pipe', 'ignore'],
       }).trim();
       if (version === pkgVersion || version === tag || version.includes(` ${pkgVersion}`)) {
-        console.log(`\n  \x1b[1;32mcsr-engine ${pkgVersion} already installed.\x1b[0m\n`);
+        console.log(`\n  \x1b[1;32mcsr-engine ${pkgVersion} already installed.\x1b[0m`);
+        runOrExplainActivation(existingBinary);
         return;
       }
       console.log(`  Updating ${existingBinary} to ${tag}...`);
@@ -301,14 +331,7 @@ async function main() {
 
     console.log(`  \x1b[1;32mInstalled:\x1b[0m ${destPath}`);
 
-    // Auto-run setup
-    console.log('  Running setup...');
-    try {
-      execFileSync(destPath, ['setup'], { stdio: 'inherit', timeout: 60000 });
-      console.log('\n  \x1b[32mDone. Restart Claude Code to activate.\x1b[0m\n');
-    } catch {
-      console.log('\n  Setup encountered errors. Run manually: csr-engine setup\n');
-    }
+    runOrExplainActivation(destPath);
 
     if (pythonSignals.length > 0) {
       console.log('  Old Python stack can be cleaned up:');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-self-reflect",
-  "version": "9.3.0",
+  "version": "9.4.0",
   "description": "Give Claude perfect memory of all your conversations. Single binary, zero dependencies.",
   "keywords": [
     "claude",