create-claude-cabinet 0.46.0 → 0.47.0

package/templates/hooks/watchtower-session-start.sh

@@ -40,8 +40,18 @@ PROJECT_PATH="$(pwd)"
 #     and silence the watchdog while appearing configured)
 FRONTIER_WARNING=""
 SESSION_MODEL=""
+SESSION_ID=""
 if [ -n "${PAYLOAD}" ]; then
   SESSION_MODEL=$(printf '%s' "${PAYLOAD}" | jq -r '.model // empty' 2>/dev/null)
+  # Session id from the stdin payload — the documented CC hook contract used by
+  # every other watchtower hook (session-end, telemetry). NOT $CLAUDE_SESSION_ID
+  # (which CC does not set here). Keys the mid-session baseline snapshot below.
+  SESSION_ID=$(printf '%s' "${PAYLOAD}" | jq -r '.session_id // empty' 2>/dev/null)
+  # Defense-in-depth: the id is used as a filename component below. CC emits a
+  # UUID, but reject anything carrying a path separator or dot-dir so a
+  # malformed id can never escape state/session-snapshots/ (then it's treated
+  # as "no session id" and capture is skipped, never written under a bad path).
+  case "${SESSION_ID}" in */*|..|.) SESSION_ID="" ;; esac
 fi
 REGISTRY="${HOME}/.claude/cc-registry.json"
 FRONTIER_KEY=""
@@ -87,6 +97,20 @@ CONTEXT=""
 if [ -f "${WATCHTOWER_DIR}/config.json" ]; then
   # Build context. Suppress stderr to avoid noise on missing files.
   CONTEXT=$(node "${WATCHTOWER_DIR}/scripts/watchtower-build-context.mjs" --project-path "${PROJECT_PATH}" 2>/dev/null)
+
+  # Capture this session's mid-session-polling baseline (for /catch-up). A
+  # SEPARATE, guarded best-effort invocation — it can never alter or block the
+  # injection above (the additive contract: the injected context is unchanged).
+  # Skipped entirely when no session id is available, so we never write a
+  # shared/keyless snapshot that a later session would mistake for its own
+  # baseline. The module prunes snapshots >7d on each write, so the dir stays
+  # bounded.
+  if [ -n "${SESSION_ID}" ] && [ -f "${WATCHTOWER_DIR}/scripts/watchtower-snapshot.mjs" ]; then
+    node "${WATCHTOWER_DIR}/scripts/watchtower-snapshot.mjs" \
+      --emit-snapshot "${WATCHTOWER_DIR}/state/session-snapshots/${SESSION_ID}.json" \
+      --project-path "${PROJECT_PATH}" \
+      --session-id "${SESSION_ID}" >/dev/null 2>&1 || true
+  fi
 fi
 
 if [ -n "${FRONTIER_WARNING}" ]; then
@@ -104,8 +128,6 @@ if [ -z "${CONTEXT}" ]; then
   exit 0
 fi
 
-SESSION_ID="${CLAUDE_SESSION_ID:-unknown}"
-
 cat <<HOOKEOF
 {
   "hookSpecificOutput": {

package/templates/mcp/pib-db.json

@@ -2,10 +2,7 @@
   "mcpServers": {
     "pib-db": {
       "command": "node",
-      "args": ["scripts/pib-db-mcp-server.mjs"],
-      "env": {
-        "PIB_DB_PATH": "./pib.db"
-      }
+      "args": ["scripts/pib-db-mcp-server.mjs"]
     }
   }
 }

package/templates/mux/bin/mux

@@ -1664,6 +1664,13 @@ cmd_handoff() {
   [[ -n "$prompt" ]] || die "mux handoff: descriptor missing 'seed_prompt'"
   [[ -n "$name" ]]   || name="next-session"
 
+  # The worktree path and git branch are built from this name; spaces or
+  # other non-slug chars in the descriptor's 'name' break `git branch` /
+  # `git worktree add` and abort the handoff. Slugify for branch/path use;
+  # keep $name as the human-readable window label. (act:573f38e1)
+  local name_slug; name_slug=$(slugify "$name")
+  [[ -n "$name_slug" ]] || name_slug="next-session"
+
   # `project` should be the mux DESK (tmux session). Desk short-names often
   # differ from the repo dir name, so if it isn't a live session but the
   # descriptor's project_path matches a desk's MUX_PROJECT_PATH, remap to that
@@ -1696,7 +1703,7 @@ cmd_handoff() {
   # window 1, consistent with "QA drains belong to window 1".
   local win_path where skip_reason
   if skip_reason=$(worktree_isolation_capable "$project"); then
-    win_path=$(create_worktree "$project" "$name") \
+    win_path=$(create_worktree "$project" "$name_slug") \
       || die "mux handoff: couldn't create a worktree for '${name}' — refusing to seed a second session onto the main checkout. Seed is saved; try: mux worktree ls"
     where="a fresh worktree of ${project}"
   else

package/templates/mux/config/help.txt

@@ -41,6 +41,7 @@
 │  Ctrl-r / Ctrl-s   search back / fwd   │
 │  drag = copy    Y = copy w/o wraps     │
 │  F3 popup: Shift-drag to select        │
+│  Shift-Cmd-click = open a link         │
 │                                        │
 │  Typing a message (Claude prompt):     │
 │  Opt-B / Opt-F     word back / fwd     │

package/templates/rules/acknowledge-when-corrected.md

@@ -0,0 +1,33 @@
+# Acknowledge When Corrected
+
+When the user points out that something is wrong — a precondition you
+skipped, a fact you got wrong, a step you missed — acknowledge it
+plainly and ask what they want, before anything else. Do not reach for a
+rationalization that explains why the mistake was reasonable.
+
+The instinct under correction is to defend: to narrate the chain of
+reasoning that made the error understandable. That instinct is almost
+always wrong here. The user already knows something is off — that is why
+they spoke up. A defense makes them litigate your reasoning before they
+can redirect you, which is slower and more frustrating than a clean
+"you're right, I missed X — do you want me to do Y or Z?"
+
+## What this looks like
+
+- **Lead with the acknowledgment.** "You're right, I didn't check the
+  worktree first." Name the actual error, not a softened version of it.
+- **Then ask, don't assume the fix.** A correction is a fork: surface
+  the options and let the user choose, rather than charging ahead on the
+  repair you guessed at.
+- **Save the explanation for when it's asked for.** If the user wants to
+  know how it happened, they will ask. An unprompted post-mortem in the
+  moment of correction reads as defensiveness, not transparency.
+
+## Why this is a rule
+
+The rationalize-instead-of-acknowledge reflex recurs across sessions and
+erodes trust fastest exactly when trust is already wobbling — right after
+a mistake. It is a judgment habit, so it lives here as eager guidance:
+the discipline is to make "you're right, here is the error, what do you
+want" the reflex that fires before any defense of how the error made
+sense.

package/templates/rules/maintainability.md

@@ -39,6 +39,17 @@ the root cause is buried under layers of consequences.
   or validation script. If it should happen, put it in a rule. If it's
   nice to have, document it. See `enforcement-pipeline.md` for the
   compliance stack.
+- **Check the exit, not just the output.** A command that fails — `git
+  show` on a bad ref, a glob that matched nothing — can still produce an
+  empty-but-zero-looking stream that the next step consumes as if valid,
+  yielding a confident wrong result with no error signal. Verify exit
+  status or a non-empty result before piping a command's output into a
+  decision or a diff.
+- **Resolve merge conflicts by inspection, not preference.** Clearing a
+  conflict with a blind `git checkout HEAD -- <file>` (or "keep ours")
+  silently discards whatever the other side changed. Read the diff and
+  merge intentionally; an unexamined "keep ours" is data loss disguised
+  as conflict resolution.
 
 ## Fix Upstream, Not Downstream
 

package/templates/rules/memory-capture.md

@@ -67,16 +67,38 @@ Over-capturing degrades retrieval quality. The test:
 
 If yes, capture it. If it's just noise or ephemera, skip it.
 
+## The index is a bounded working set, not a full catalogue
+
+`MEMORY.md` loads in full at every session start, so it is a bounded
+**working set** — a pinned tier (load-bearing constraints/identity kept
+eagerly present regardless of age), a recency block (recent entries), and
+**region pointers** that cover whole classes of cooled files with one
+line each. Total memory grows without bound; only the eager working set
+is capped. New memories enter the recency block; mark a load-bearing
+constraint `pinned: true` so it never decays out. Full rules:
+`cabinet/memory-lifecycle-contract.md`.
+
 ## Validation
 
 `scripts/validate-memory.mjs` checks structural integrity:
 - MEMORY.md within Claude Code's 200-line / 25KB session-start budget
-- Every memory file is indexed (no orphans)
-- Every indexed file exists (no broken references)
-- Topic-style files (migrated from omega) stay under 50KB
+- Every memory file is **reachable** from MEMORY.md — a direct index line
+  OR a region pointer whose glob matches it (reachability replaces the old
+  enumerate-every-file rule; "present on disk" alone is NOT reachable)
+- Every directly-referenced file exists (no broken references), and every
+  region pointer's glob matches ≥1 file on disk (no stale region cues)
+- Topic-style files (migrated from omega) and `MEMORY-archive.md` (the
+  on-demand cold tier) stay under 50KB
+
+It also samples working-set pressure to `.memory-pressure.jsonl` (≥90% of
+budget, once/day) — the data that gates the Stage 2 lifecycle verbs.
 
 Wired into `/validate`. Also runs PostToolUse on memory writes via
-`memory-index-guard.sh`.
+`memory-index-guard.sh`, which fires when a just-written file is not
+reachable from MEMORY.md. The index files themselves (MEMORY.md,
+MEMORY-archive.md, edges.json) are exempt from the per-write
+reachability check — they are the index, not memory entries — so
+editing the index never trips the guard on itself (NON_MEMORY_FILES).
 
 ## Migrated topic files (read-only legacy)
 

package/templates/rules/plan-before-bulk-or-irreversible-actions.md

@@ -0,0 +1,48 @@
+# Show the Plan Before Bulk or Irreversible Actions
+
+Before an action that is expensive to run, hard to undo, or applied to
+many items at once, surface a complete, reviewable plan and confirm
+scope first. The plan is the checkpoint — once the action is running,
+the cheap moment to catch a mistake has passed.
+
+## Front-load the disposition map
+
+For bulk work — dispositioning a queue, migrating N files, mass edits —
+produce one structured "here is exactly what I will do to each group,
+before I touch anything" and show it. Do not start applying changes
+while still discovering what the changes should be. A per-item or
+per-group plan the user can scan and correct is worth more than progress
+they can't see.
+
+## Interleave analysis and execution; don't bank it all
+
+The failure mode is front-loading every bit of analysis, then running out
+of runway before a single change lands — lots of work, nothing done. For
+large jobs, prefer: plan the batch, execute the batch, checkpoint, repeat.
+Interleaving also gives the user intermediate progress to course-correct
+against, instead of an all-or-nothing dump at the end.
+
+## Checkpoint scope before it expands
+
+When a focused request starts pulling in adjacent work — "while I'm here
+I'll also touch X, Y, Z" — stop and name the expansion before doing it,
+with a rough cost. A small question that grew into a seven-file,
+five-repo pass without a checkpoint is scope creep even when each step
+felt reasonable. Offer the bigger scope as a choice; don't assume it.
+
+## Review an expensive or irreversible launch before pulling the trigger
+
+Before launching a costly or hard-to-stop operation — a multi-agent
+workflow, a mass mutation, a deploy — pause for a self-imposed review:
+what could make this wrong, what's the blast radius, what's the rollback.
+The review costs seconds; the launch can cost a lot. Don't rely on the
+user happening to interrupt at the right moment to catch a flaw.
+
+## Why this is a rule
+
+The "huge analysis, zero execution" and "bulk action applied before the
+plan was shown" failures recur across queue triage, migrations, and
+multi-agent runs. The discipline is judgment, not a mechanical gate, so
+it lives here as eager guidance: when an action is bulk or irreversible,
+the plan goes in front of the user *before* the action goes to the
+system.

package/templates/rules/verify-before-asserting.md

@@ -0,0 +1,79 @@
+# Verify Before Asserting
+
+State a conclusion as fact only after you have checked it. Until then,
+hedge ("I think", "likely") or — better — go check, then state it. The
+order matters: verification must precede the assertion, not follow the
+recommendation it supported.
+
+This is cheap insurance against the most expensive class of mistake —
+the confident wrong answer that the user has to catch and that you then
+have to walk back, unwinding whatever was built on top of it.
+
+## The three cases where it costs the most
+
+1. **Claims about code, system, or tool behavior.** "This function
+   already handles X", "that dedup checks the dismissed pile", "the
+   installer touches settings.json" — read the code or run it before
+   asserting. A plausible mental model of how something *probably* works
+   is not knowledge of how it *does* work.
+
+2. **External or time-sensitive facts.** Prices, availability, hours,
+   addresses, version numbers, API shapes. Memory goes stale and was
+   never authoritative for these. Look them up before you build a
+   recommendation on them.
+
+3. **Anything that gates a decision.** If a claim is a decision input —
+   "we should do A because B is true" — then confirming B is part of
+   doing the job, not a follow-up. Name your decision criteria, then
+   check the candidates against them *before* recommending, not after.
+
+## Sub-disciplines
+
+- **Instrument before interpreting.** When a behavioral test could fail
+  for more than one reason, make it observable first. Before concluding
+  "the feature didn't work", log whether it even fired — an ambiguous
+  negative ("wrong output") often means "ran, wrong shape", not "absent".
+
+- **A third party's confidence is not your verification.** A subagent's
+  or document's assertion about platform behavior (an API shape, a
+  binary's contents, a version-gated feature) requires independent,
+  first-hand confirmation before it gates a build decision. Default to
+  skeptical when the source can't show its work.
+
+- **A citation is a claim that you fetched it.** Never format a URL or
+  outlet name as a source unless you retrieved it this session, and
+  never state specifics — prices, dimensions, addresses, capacities —
+  from pattern-memory in a fact-shaped sentence. A plausible fabricated
+  citation is worse than "I haven't verified this": it launders a guess
+  into evidence. And when your recommendation shifts across a
+  conversation, name what changed and why — ten drifting answers with
+  no closed loop is the same failure, serialized.
+
+- **Verify your own writes, not just your claims.** After you write a
+  value — a DB update, an action-note edit, a recorded decision, and
+  especially a number — read it back or quote the stored content before
+  announcing it done. A write announced from the call's success is not a
+  confirmed write; a silent gap between what was decided in conversation
+  and what actually landed is invisible until someone queries it.
+
+- **Findings are not a coverage map.** When a search, query, or subagent
+  sweep returns results, "what it found" is not "all there is". Acting on
+  a sweep as if it were exhaustive — as if the territory it didn't
+  surface doesn't exist — is a verification gap in the *completeness*
+  dimension. Before treating returned findings as the whole picture, ask
+  what could be missing: a scope too narrow, a dimension not searched, a
+  source not read.
+
+## The tell
+
+If you're about to write "X is true / X already does Y" and you have not
+looked this session — that sentence is a prompt to go look, not to send.
+Catch yourself at the verb: "is", "does", "already handles", "won't".
+
+## Why this is a rule
+
+The confident-wrong-answer failure recurs across domains — code
+behavior, external facts, and self-assessment alike (asserting how your
+own tooling behaves before reading it). It is a judgment habit, so it
+lives here as eager guidance rather than a hook; the discipline is to
+make the check a reflex that fires *before* the claim leaves your hands.