eagle-mem 4.10.11 → 4.10.12

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to the **Eagle Mem** project are documented here.
 
 ---
 
+## v4.10.12 Spectral Review Closure
+
+This patch closes the multi-CLI Spectral review findings on v4.10.11:
+
+- **Run Log Containment**: `eagle-mem logs show|tail` now resolves only run-log IDs, filenames, or absolute paths under `~/.eagle-mem/runs`, preventing arbitrary file reads through the logs subcommand.
+- **Run Log Retention**: Added `eagle-mem logs prune --days N --keep N` plus automatic pruning when command-scoped run logs start, defaulting to logs older than 14 days and retaining the latest 50.
+- **Run Log Diagnostics**: `eagle_log` messages now mirror into the active command run log, so failure log paths include provider and internal diagnostic messages instead of only command stdout/stderr.
+- **PostToolUse Tracker Locking**: Modification tracking now writes every modified file through the same lock path, retries lock acquisition, avoids unlocked appends to the trimmed tracker, and records all files from multi-file `apply_patch` operations.
+- **Curator JSON Robustness**: Dream Cycle consolidation parsing now tolerates provider text wrapped around the JSON payload while preserving strict `jq` validation.
+- **Regression Coverage**: Expanded reliability tests for log path rejection, log pruning, mirrored run diagnostics, unsupported agent target logging, and multi-file modification tracking.
+
+---
+
 ## v4.10.11 Reliability Guards and Provider Fallback
 
 This patch closes the active reliability items that remained after the Dream Cycle hotfix:

package/README.md

@@ -146,7 +146,7 @@ Eagle Mem prevents Claude from repeating past mistakes:
 | `eagle-mem search` | Search past sessions, memories, and code |
 | `eagle-mem health` | Diagnose pipeline health and background automation |
 | `eagle-mem doctor` | Verify installed runtime files, hooks, SQLite/FTS5, statusline, manifest, and drift |
-| `eagle-mem logs` | Inspect command-scoped `scan`, `index`, and `curate` run logs |
+| `eagle-mem logs` | Inspect and prune command-scoped `scan`, `index`, and `curate` run logs |
 | `eagle-mem config` | View or change LLM provider and token-guard settings |
 | `eagle-mem updates` | View or change auto-update policy |
 | `eagle-mem guard` | Manage regression guardrails for files |
@@ -349,6 +349,8 @@ Provider preference is local-first: Ollama is auto-detected when running, then E
 
 Provider calls use an explicit fallback chain by default. For example, `agent_cli` can try the preferred/current agent first and then fall through to another supported local CLI when available. `eagle-mem config`, `eagle-mem health`, and `eagle-mem curate` display the resolved provider path so failed or unavailable agent CLIs are visible instead of appearing as `unknown`.
 
+Command-scoped run logs live under `~/.eagle-mem/runs`. Use `eagle-mem logs list`, `eagle-mem logs show <run-id>`, `eagle-mem logs tail <run-id>`, and `eagle-mem logs prune --days 14 --keep 50` to inspect or trim them. Log reads are constrained to the run-log directory.
+
 RTK is configured separately from the LLM provider:
 
 ```bash

package/hooks/post-tool-use.sh

@@ -17,6 +17,50 @@ LIB_DIR="$SCRIPT_DIR/../lib"
 input=$(eagle_read_stdin)
 [ -z "$input" ] && exit 0
 
+eagle_track_modified_path() {
+    local path="$1" sid="$2"
+    [ -n "$path" ] || return 0
+    [ -n "$sid" ] && eagle_validate_session_id "$sid" || return 0
+
+    local mod_dir mod_file mod_lock mod_tmp attempt
+    mod_dir="$EAGLE_MEM_DIR/mod-tracker"
+    mkdir -p "$mod_dir" 2>/dev/null || return 0
+    mod_file="$mod_dir/${sid}"
+    mod_lock="${mod_file}.lock"
+
+    for attempt in 1 2 3 4 5 6 7 8 9 10; do
+        if mkdir "$mod_lock" 2>/dev/null; then
+            mod_tmp=$(mktemp "${mod_file}.XXXXXX" 2>/dev/null) || mod_tmp="${mod_file}.$$"
+            (
+                cat "$mod_file" 2>/dev/null
+                for pending_file in "${mod_file}".pending.*; do
+                    [ -f "$pending_file" ] && cat "$pending_file" 2>/dev/null
+                done
+                printf '%s\n' "$path"
+            ) | tail -3 > "$mod_tmp"
+            mv "$mod_tmp" "$mod_file" 2>/dev/null || rm -f "$mod_tmp"
+            rm -f "${mod_file}".pending.* 2>/dev/null || true
+            rmdir "$mod_lock" 2>/dev/null || true
+            return 0
+        fi
+        sleep 0.05
+    done
+
+    printf '%s\n' "$path" >> "${mod_file}.pending.$$" 2>/dev/null || true
+    eagle_log "WARN" "PostToolUse: mod-tracker lock busy; queued pending modified file for session=$sid"
+}
+
+eagle_track_edit_history_path() {
+    local path="$1" sid="$2"
+    [ -n "$path" ] || return 0
+    [ -n "$sid" ] && eagle_validate_session_id "$sid" || return 0
+
+    local edit_dir
+    edit_dir="$EAGLE_MEM_DIR/edit-tracker"
+    mkdir -p "$edit_dir" 2>/dev/null || return 0
+    printf '%s\n' "$path" >> "$edit_dir/${sid}" 2>/dev/null || true
+}
+
 IFS=$'\x1f' read -r session_id cwd tool_name hook_event <<< \
     "$(echo "$input" | jq -r '[.session_id, .cwd, .tool_name, .hook_event_name] | map(. // "") | join("\u001f")')"
 agent=$(eagle_agent_source_from_json "$input")
@@ -167,27 +211,16 @@ esac
 
 # ─── Track recent Edit/Write targets for Read-after-modify detection ──
 
-if [ -n "$fp" ] && [ -n "$session_id" ] && eagle_validate_session_id "$session_id"; then
+if [ -n "$session_id" ] && eagle_validate_session_id "$session_id"; then
     case "$tool_name" in
         Edit|Write|apply_patch)
-            mod_dir="$EAGLE_MEM_DIR/mod-tracker"
-            mkdir -p "$mod_dir" 2>/dev/null
-            mod_file="$mod_dir/${session_id}"
-            mod_lock="${mod_file}.lock"
-            if mkdir "$mod_lock" 2>/dev/null; then
-                _mod_tmp=$(mktemp "${mod_file}.XXXXXX" 2>/dev/null) || _mod_tmp="${mod_file}.$$"
-                (cat "$mod_file" 2>/dev/null; printf '%s\n' "$fp") | tail -3 > "$_mod_tmp"
-                mv "$_mod_tmp" "$mod_file" 2>/dev/null || rm -f "$_mod_tmp"
-                rmdir "$mod_lock" 2>/dev/null || true
-            else
-                # If another hook is trimming, append is still safer than losing the edit.
-                printf '%s\n' "$fp" >> "$mod_file"
-            fi
-
-            # Full edit history for stuck loop detection (not truncated)
-            edit_dir="$EAGLE_MEM_DIR/edit-tracker"
-            mkdir -p "$edit_dir" 2>/dev/null
-            echo "$fp" >> "$edit_dir/${session_id}"
+            modified_paths=$(printf '%s' "$files_modified" | jq -r '.[]?' 2>/dev/null)
+            [ -n "$modified_paths" ] || modified_paths="$fp"
+            while IFS= read -r modified_path; do
+                [ -z "$modified_path" ] && continue
+                eagle_track_modified_path "$modified_path" "$session_id"
+                eagle_track_edit_history_path "$modified_path" "$session_id"
+            done <<< "$modified_paths"
             ;;
     esac
 fi

package/lib/common.sh

@@ -106,11 +106,17 @@ eagle_require_sqlite_fts5() {
 eagle_log() {
     local level="$1"
     shift
+    local ts msg
+    ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    msg="[$ts] [$level] $*"
     # Ensure log file is owner-only (may contain debug data)
     if [ ! -f "$EAGLE_MEM_LOG" ]; then
         touch "$EAGLE_MEM_LOG" 2>/dev/null && chmod 600 "$EAGLE_MEM_LOG" 2>/dev/null
     fi
-    echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] [$level] $*" >> "$EAGLE_MEM_LOG" 2>/dev/null || true
+    echo "$msg" >> "$EAGLE_MEM_LOG" 2>/dev/null || true
+    if [ "${EAGLE_RUN_ACTIVE:-0}" = "1" ] && [ -n "${EAGLE_RUN_LOG:-}" ] && [ "$EAGLE_RUN_LOG" != "$EAGLE_MEM_LOG" ]; then
+        echo "$msg" >> "$EAGLE_RUN_LOG" 2>/dev/null || true
+    fi
 }
 
 eagle_run_slug() {
@@ -120,6 +126,39 @@ eagle_run_slug() {
         | cut -c1-48
 }
 
+eagle_run_prune_logs() {
+    local days="${1:-${EAGLE_RUN_LOG_RETENTION_DAYS:-14}}"
+    local keep="${2:-${EAGLE_RUN_LOG_MAX_COUNT:-50}}"
+    local rel_log
+
+    [ -d "$EAGLE_RUNS_DIR" ] || return 0
+    case "$days" in ""|*[!0-9]*) days=14 ;; esac
+    case "$keep" in ""|*[!0-9]*) keep=50 ;; esac
+
+    find "$EAGLE_RUNS_DIR" -type f -name '*.log' -print 2>/dev/null \
+        | while IFS= read -r stale_log; do
+            rel_log="${stale_log#"$EAGLE_RUNS_DIR"/}"
+            case "$rel_log" in
+                */*) rm -f -- "$stale_log" 2>/dev/null || true ;;
+            esac
+        done
+
+    if [ "$days" -gt 0 ]; then
+        find "$EAGLE_RUNS_DIR" -type f -name '*.log' -mtime +"$days" -print 2>/dev/null \
+            | while IFS= read -r stale_log; do
+                rm -f -- "$stale_log" 2>/dev/null || true
+            done
+    fi
+
+    if [ "$keep" -gt 0 ]; then
+        ls -t "$EAGLE_RUNS_DIR"/*.log 2>/dev/null \
+            | awk -v keep="$keep" 'NR > keep' \
+            | while IFS= read -r stale_log; do
+                rm -f -- "$stale_log" 2>/dev/null || true
+            done
+    fi
+}
+
 eagle_run_start() {
     [ "${EAGLE_RUN_ACTIVE:-0}" = "1" ] && return 0
 
@@ -129,6 +168,7 @@ eagle_run_start() {
     [ -n "$slug" ] || slug="command"
 
     mkdir -p "$EAGLE_RUNS_DIR" "$EAGLE_MEM_DIR" 2>/dev/null || true
+    eagle_run_prune_logs >/dev/null 2>&1 || true
     EAGLE_RUN_ID="$(date -u +%Y%m%dT%H%M%SZ)-${slug}-$$"
     EAGLE_RUN_LOG="$EAGLE_RUNS_DIR/${EAGLE_RUN_ID}.log"
     EAGLE_RUN_COMMAND="$command_name"
@@ -818,7 +858,9 @@ eagle_project_file_path() {
 }
 
 eagle_extract_apply_patch_files() {
-    sed -n -E 's/^\*\*\* (Add|Update|Delete) File: //p'
+    sed -n -E \
+        -e 's/^\*\*\* (Add|Update|Delete) File: //p' \
+        -e 's/^\*\*\* Move to: //p'
 }
 
 eagle_agent_source() {

package/lib/provider.sh

@@ -409,7 +409,10 @@ _eagle_agent_cli_target_chain() {
         claude|claude-code|cloud-code) preferred_target="claude-code" ;;
         current) preferred_target="$current" ;;
         auto|"") preferred_target="" ;;
-        *) preferred_target="$preferred" ;;
+        *)
+            eagle_log "WARN" "agent_cli unsupported preferred target: $preferred"
+            preferred_target=""
+            ;;
     esac
 
     for candidate in "$preferred_target" "$current" codex claude-code; do
@@ -469,7 +472,11 @@ _eagle_call_agent_cli() {
         case "$target" in
             codex) result=$(_eagle_call_codex_cli "$prompt" "$system" "$max_tokens"); rc=$? ;;
             claude-code) result=$(_eagle_call_claude_cli "$prompt" "$system" "$max_tokens"); rc=$? ;;
-            *) rc=1; result="" ;;
+            *)
+                eagle_log "WARN" "agent_cli unsupported target: $target"
+                rc=1
+                result=""
+                ;;
         esac
         if [ "$rc" -eq 0 ] && [ -n "$result" ]; then
             [ "$tried" -gt 1 ] && eagle_log "INFO" "agent_cli fallback succeeded with $target"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eagle-mem",
-  "version": "4.10.11",
+  "version": "4.10.12",
   "description": "Shared memory, release guardrails, RTK token protection, and worker lanes for Claude Code, Codex, Grok, and Google Antigravity",
   "bin": {
     "eagle-mem": "bin/eagle-mem"

package/scripts/curate.sh

@@ -39,22 +39,20 @@ EOF
 
 parse_consolidations_json() {
     local result="$1"
-    local trimmed json_payload
-
-    trimmed=$(printf '%s' "$result" | tr -d '\r' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
-    case "$trimmed" in
-        ""|NONE|none|null)
-            printf '[]\n'
-            return 0
-            ;;
-    esac
-
-    json_payload=$(printf '%s' "$result" \
-        | sed -e '1s/^[[:space:]]*```json[[:space:]]*$//' \
-              -e '1s/^[[:space:]]*```[[:space:]]*$//' \
-              -e '$s/^[[:space:]]*```[[:space:]]*$//')
-
-    printf '%s' "$json_payload" | jq -c '
+    printf '%s' "$result" | jq -Rrs -c '
+        def text_trim: gsub("^\\s+|\\s+$"; "");
+        def parse_payload:
+            gsub("\r"; "")
+            | gsub("^\\s*```json\\s*\\n"; "")
+            | gsub("^\\s*```\\s*\\n"; "")
+            | gsub("\\n\\s*```\\s*$"; "")
+            | text_trim
+            | if . == "" or . == "NONE" or . == "none" or . == "null" then []
+              else
+                  try fromjson catch (
+                      ([match("(?s)(\\{.*\\}|\\[.*\\])")? | .string][0] // "[]") | fromjson
+                  )
+              end;
         def trim: gsub("^\\s+|\\s+$"; "");
         def names:
             if type == "array" then map(tostring | trim) | map(select(length > 0))
@@ -66,7 +64,8 @@ parse_consolidations_json() {
             elif type == "object" then (.consolidations // .items // .instructions // [])
             else []
             end;
-        root
+        parse_payload
+        | root
         | map({
             source_names: ((.source_names // .sourceNames // .source_memories // .sourceMemories // .original_names // .originalNames // .originals // .names) | names),
             new_name: ((.new_name // .newName // .name // .title // "") | tostring | trim),

package/scripts/help.sh

@@ -23,7 +23,7 @@ echo -e "    ${CYAN}uninstall${RESET}   Remove hooks and optionally delete data"
 echo -e "    ${CYAN}search${RESET}      Search past sessions, memories, and code"
 echo -e "    ${CYAN}health${RESET}      Diagnose pipeline health and background automation"
 echo -e "    ${CYAN}doctor${RESET}      Show install footprint, hooks, SQLite, manifest, and runtime drift"
-echo -e "    ${CYAN}logs${RESET}        Inspect command-scoped scan/index/curate logs"
+echo -e "    ${CYAN}logs${RESET}        Inspect/prune command-scoped scan/index/curate logs"
 echo -e "    ${CYAN}updates${RESET}     Auto-update status and policy"
 echo -e "    ${CYAN}overview${RESET}    Build or view project overview"
 echo -e "    ${CYAN}session${RESET}     Save a manual session summary"

package/scripts/logs.sh

@@ -15,36 +15,60 @@ cmd="${1:-list}"
 
 show_help() {
     cat <<EOF
-Usage: eagle-mem logs [list|tail|show] [run-id-or-path]
+Usage: eagle-mem logs [list|tail|show|prune] [run-id-or-filename]
 
 Commands:
-  list              Show recent command-scoped run logs
-  tail [id|path]    Tail a run log, or the latest run log when omitted
-  show <id|path>    Print a run log
+  list                    Show recent command-scoped run logs
+  tail [id|filename]      Tail a run log, or the latest run log when omitted
+  show <id|filename>      Print a run log
+  prune [--days N] [--keep N]
+                          Delete old run logs (defaults: 14 days, latest 50)
 EOF
 }
 
 resolve_log_path() {
     local ref="${1:-}"
+    local runs_root="${EAGLE_RUNS_DIR%/}" rel_ref
     if [ -z "$ref" ]; then
-        ls -t "$EAGLE_RUNS_DIR"/*.log 2>/dev/null | sed -n '1p'
-        return 0
-    fi
-    if [ -f "$ref" ]; then
-        printf '%s\n' "$ref"
+        ls -t "$runs_root"/*.log 2>/dev/null | while IFS= read -r candidate; do
+            [ -L "$candidate" ] && continue
+            [ -f "$candidate" ] && printf '%s\n' "$candidate" && break
+        done
         return 0
     fi
-    if [ -f "$EAGLE_RUNS_DIR/$ref" ]; then
-        printf '%s\n' "$EAGLE_RUNS_DIR/$ref"
+
+    case "$ref" in
+        *$'\n'*|*..*) return 1 ;;
+        /*)
+            rel_ref="${ref#"$runs_root"/}"
+            [ "$rel_ref" != "$ref" ] || return 1
+            case "$rel_ref" in ""|*/*) return 1 ;; esac
+            [ -L "$runs_root/$rel_ref" ] && return 1
+            [ -f "$runs_root/$rel_ref" ] && printf '%s\n' "$runs_root/$rel_ref" && return 0
+            return 1
+            ;;
+        */*) return 1 ;;
+    esac
+
+    if [ ! -L "$runs_root/$ref" ] && [ -f "$runs_root/$ref" ]; then
+        printf '%s\n' "$runs_root/$ref"
         return 0
     fi
-    if [ -f "$EAGLE_RUNS_DIR/$ref.log" ]; then
-        printf '%s\n' "$EAGLE_RUNS_DIR/$ref.log"
+    if [ ! -L "$runs_root/$ref.log" ] && [ -f "$runs_root/$ref.log" ]; then
+        printf '%s\n' "$runs_root/$ref.log"
         return 0
     fi
     return 1
 }
 
+run_log_count() {
+    [ -d "$EAGLE_RUNS_DIR" ] || {
+        printf '0\n'
+        return 0
+    }
+    find "$EAGLE_RUNS_DIR" -type f -name '*.log' -print 2>/dev/null | wc -l | tr -d ' '
+}
+
 case "$cmd" in
     -h|--help|help)
         show_help
@@ -57,6 +81,7 @@ case "$cmd" in
             exit 0
         fi
         ls -t "$EAGLE_RUNS_DIR"/*.log 2>/dev/null | head -20 | while IFS= read -r log_path; do
+            [ -L "$log_path" ] && continue
             first_line=$(sed -n '1p' "$log_path" 2>/dev/null)
             run_id=$(basename "$log_path" .log)
             printf '  %s  %s\n' "$run_id" "$first_line"
@@ -76,6 +101,41 @@ case "$cmd" in
         }
         cat "$log_path"
         ;;
+    prune)
+        days="${EAGLE_RUN_LOG_RETENTION_DAYS:-14}"
+        keep="${EAGLE_RUN_LOG_MAX_COUNT:-50}"
+        while [ $# -gt 0 ]; do
+            case "$1" in
+                --days)
+                    days="${2:-}"
+                    shift 2
+                    ;;
+                --keep)
+                    keep="${2:-}"
+                    shift 2
+                    ;;
+                *)
+                    eagle_err "Unknown prune option: $1"
+                    show_help
+                    exit 1
+                    ;;
+            esac
+        done
+        case "$days" in ""|*[!0-9]*)
+            eagle_err "Invalid --days value: $days"
+            exit 1
+            ;;
+        esac
+        case "$keep" in ""|*[!0-9]*)
+            eagle_err "Invalid --keep value: $keep"
+            exit 1
+            ;;
+        esac
+        before=$(run_log_count)
+        eagle_run_prune_logs "$days" "$keep"
+        after=$(run_log_count)
+        eagle_ok "Pruned run logs: before=$before after=$after days=$days keep=$keep"
+        ;;
     *)
         eagle_err "Unknown logs command: $cmd"
         show_help

package/tests/test_curate_graph_memories.sh

@@ -104,6 +104,14 @@ assert_eq "2" "$(supersedes_edges project-json "Compiled AB JSON")" "consolidate
 assert_eq "3" "$(memory_graph_nodes project-json)" "curate should keep memory graph nodes idempotent"
 assert_eq "2" "$(supersedes_edges project-json "Compiled AB JSON")" "curate should keep supersedes edge count idempotent"
 
+# Wrapped provider output: conversational text around JSON should still parse.
+export EAGLE_CURATE_FAKE_RESPONSE=$'Here is the JSON you requested:\n{"consolidations":[{"source_names":["Wrapped A","Wrapped B"],"new_name":"Wrapped AB","description":"wrapped","value":"--- Compiled Truth ---\\nwrapped truth\\n\\n--- Evidence Trail ---\\n- Wrapped A\\n- Wrapped B"}]}\nDone.'
+insert_memory "project-wrapped" "memory://wrapped-a" "Wrapped A" "First wrapped memory" "Content A"
+insert_memory "project-wrapped" "memory://wrapped-b" "Wrapped B" "Second wrapped memory" "Content B"
+"$EAGLE_BIN" curate -p project-wrapped >/dev/null
+assert_eq "3" "$(memory_graph_nodes project-wrapped)" "wrapped JSON output should still create consolidated memory nodes"
+assert_eq "2" "$(supersedes_edges project-wrapped "Wrapped AB")" "wrapped JSON output should still wire supersedes edges"
+
 # No consolidation: source nodes are still wired, but no supersedes edges are created.
 export EAGLE_CURATE_FAKE_RESPONSE='{"consolidations":[]}'
 insert_memory "project-none" "memory://none-a" "Memory None A" "First none memory" "Content A"

package/tests/test_reliability_guards.sh

@@ -47,6 +47,25 @@ provider_result=$(EAGLE_MEM_DIR="$provider_home" PATH="$fake_bin:$PATH" bash -c
     eagle_llm_call 'say ok' 'system' 20
 ")
 assert_contains "$provider_result" "claude fallback ok" "agent_cli fallback did not use Claude after Codex failed"
+cat > "$provider_home/config.toml" <<'TOML'
+[provider]
+type = "agent_cli"
+fallback = "auto"
+
+[agent_cli]
+preferred = "grok"
+codex_model = ""
+claude_model = ""
+TOML
+EAGLE_MEM_DIR="$provider_home" PATH="$fake_bin:$PATH" bash -c "
+    . '$ROOT_DIR/lib/common.sh'
+    . '$ROOT_DIR/lib/provider.sh'
+    _eagle_agent_cli_target_chain >/dev/null
+"
+grep -q "agent_cli unsupported preferred target: grok" "$provider_home/eagle-mem.log" || {
+    echo "unsupported agent_cli target should be logged" >&2
+    exit 1
+}
 
 # PreToolUse parsing + read scoring: repeated large read after modification should emit scored context.
 hook_home="$tmp_dir/hook-home"
@@ -67,6 +86,10 @@ grep -q 'mod_file}.lock' "$ROOT_DIR/hooks/post-tool-use.sh" || {
     echo "post-tool-use modification tracker should use a lock directory" >&2
     exit 1
 }
+if grep -q '>> "$mod_file"' "$ROOT_DIR/hooks/post-tool-use.sh"; then
+    echo "post-tool-use modification tracker should not append to mod_file outside the lock" >&2
+    exit 1
+fi
 
 # Auto-scan state race: failed background scan must clear the freshness marker.
 state_home="$tmp_dir/state-home"
@@ -103,5 +126,70 @@ printf '# demo\n' > "$log_repo/README.md"
 EAGLE_MEM_DIR="$log_home" bash "$ROOT_DIR/scripts/scan.sh" "$log_repo" >/dev/null
 log_list=$(EAGLE_MEM_DIR="$log_home" bash "$ROOT_DIR/bin/eagle-mem" logs list)
 assert_contains "$log_list" "command=scan" "logs list did not show the scan command run"
+run_path=$(ls -t "$log_home/runs"/*.log 2>/dev/null | sed -n '1p')
+run_id=$(basename "$run_path" .log)
+run_show=$(EAGLE_MEM_DIR="$log_home" bash "$ROOT_DIR/bin/eagle-mem" logs show "$run_id")
+assert_contains "$run_show" "run_start" "logs show by run id did not print the run log"
+if EAGLE_MEM_DIR="$log_home" bash "$ROOT_DIR/bin/eagle-mem" logs show /etc/hosts >/dev/null 2>&1; then
+    echo "logs show should reject absolute paths outside the run log directory" >&2
+    exit 1
+fi
+if EAGLE_MEM_DIR="$log_home" bash "$ROOT_DIR/bin/eagle-mem" logs tail ../memory.db >/dev/null 2>&1; then
+    echo "logs tail should reject traversal outside the run log directory" >&2
+    exit 1
+fi
+mkdir -p "$log_home/runs/nested"
+printf '[nested] [INFO] nested run\n' > "$log_home/runs/nested/nested.log"
+if EAGLE_MEM_DIR="$log_home" bash "$ROOT_DIR/bin/eagle-mem" logs show "$log_home/runs/nested/nested.log" >/dev/null 2>&1; then
+    echo "logs show should reject nested absolute paths inside the run log directory" >&2
+    exit 1
+fi
+ln -s /etc/hosts "$log_home/runs/symlink.log"
+if EAGLE_MEM_DIR="$log_home" bash "$ROOT_DIR/bin/eagle-mem" logs show symlink >/dev/null 2>&1; then
+    echo "logs show should reject symlinked run logs" >&2
+    exit 1
+fi
+list_with_symlink=$(EAGLE_MEM_DIR="$log_home" bash "$ROOT_DIR/bin/eagle-mem" logs list)
+case "$list_with_symlink" in
+    *symlink*)
+        echo "logs list should skip symlinked run logs" >&2
+        exit 1
+        ;;
+esac
+printf '[old] [INFO] old run\n' > "$log_home/runs/20000101T000000Z-scan-1.log"
+printf '[old] [INFO] old run\n' > "$log_home/runs/20000101T000001Z-scan-2.log"
+EAGLE_MEM_DIR="$log_home" bash "$ROOT_DIR/bin/eagle-mem" logs prune --days 0 --keep 1 >/dev/null
+remaining_logs=$(find "$log_home/runs" -type f -name '*.log' -print | wc -l | tr -d ' ')
+if [ "$remaining_logs" != "1" ]; then
+    echo "logs prune --keep 1 should leave exactly one run log" >&2
+    exit 1
+fi
+
+mirror_home="$tmp_dir/mirror-home"
+mkdir -p "$mirror_home"
+EAGLE_MEM_DIR="$mirror_home" EAGLE_MEM_LOG="$mirror_home/eagle-mem.log" bash -c "
+    . '$ROOT_DIR/lib/common.sh'
+    eagle_run_start 'mirror-test' 'project-mirror' '$tmp_dir'
+    eagle_log 'WARN' 'mirrored run log detail'
+    eagle_run_finish 0 0
+" >/dev/null
+mirror_log=$(ls "$mirror_home/runs"/*.log | sed -n '1p')
+grep -q "mirrored run log detail" "$mirror_log" || {
+    echo "eagle_log messages should be mirrored into active run logs" >&2
+    exit 1
+}
+
+post_home="$tmp_dir/post-home"
+post_repo="$tmp_dir/post-repo"
+mkdir -p "$post_home" "$post_repo"
+EAGLE_MEM_DIR="$post_home" "$ROOT_DIR/db/migrate.sh" >/dev/null
+post_session="session_posttool_123"
+patch_cmd=$'*** Begin Patch\n*** Update File: alpha.txt\n@@\n-old\n+new\n*** Update File: beta.txt\n@@\n-old\n+new\n*** Update File: old-name.txt\n*** Move to: gamma.txt\n@@\n-old\n+new\n*** End Patch'
+post_input=$(jq -nc --arg sid "$post_session" --arg cwd "$post_repo" --arg cmd "$patch_cmd" \
+    '{tool_name:"apply_patch",session_id:$sid,cwd:$cwd,tool_input:{command:$cmd},tool_response:{}}')
+EAGLE_MEM_DIR="$post_home" EAGLE_MEM_PROJECT="project-post" bash "$ROOT_DIR/hooks/post-tool-use.sh" <<< "$post_input"
+mod_contents=$(cat "$post_home/mod-tracker/$post_session")
+assert_contains "$mod_contents" "beta.txt" "multi-file apply_patch should track later modified files"
+assert_contains "$mod_contents" "gamma.txt" "apply_patch move destinations should be tracked"
 
 echo "reliability guard regressions passed"