immune-brain 3.6.1 → 3.6.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.6.1",
+  "version": "3.6.3",
   "description": "Immune-Brain agent skill system",
   "publishConfig": {
     "access": "public",

package/plugins/immune-brain/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.6.1",
+  "version": "3.6.3",
   "description": "Immune-Brain Claude Code Host: native Enrollment, QA, Review, and Kernel settlement.",
   "author": {
     "name": "Immune-Brain Team"

package/plugins/immune-brain/dist/claude/mcp-server.mjs

@@ -42,7 +42,7 @@ function probeHost(env = process.env, platform = process.platform, hostVersion)
 }
 
 // plugins/immune-brain/runtime/plugin_version.ts
-var PLUGIN_VERSION = "3.6.1";
+var PLUGIN_VERSION = "3.6.3";
 
 // plugins/immune-brain/runtime/claude/interaction.ts
 import { createHash, randomUUID } from "node:crypto";
@@ -99,7 +99,7 @@ function enrollmentNonce() {
 
 // plugins/immune-brain/runtime/claude/review_host.ts
 import { createHash as createHash2 } from "node:crypto";
-import { constants, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, rmSync, writeSync, closeSync } from "node:fs";
+import { constants, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, realpathSync, rmSync, writeSync, closeSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { tmpdir } from "node:os";
 var REVIEWER_AGENT = "immune-brain-reviewer";
@@ -183,7 +183,7 @@ function appendPrivate(path, dir, line) {
     closeSync(fd);
   }
 }
-function readPrivate(path) {
+function readPrivate(path, maxBytes = Number.POSITIVE_INFINITY) {
   let fd;
   try {
     fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
@@ -194,6 +194,8 @@ function readPrivate(path) {
     const stat = fstatSync(fd);
     if (!stat.isFile() || !ownedByUs(stat) || (stat.mode & 511) !== 384)
       return;
+    if (stat.size > maxBytes)
+      return;
     const buf = Buffer.alloc(stat.size);
     readSync(fd, buf, 0, stat.size, 0);
     return buf.toString("utf8");
@@ -201,6 +203,67 @@ function readPrivate(path) {
     closeSync(fd);
   }
 }
+var MAX_TRANSCRIPT_BYTES = 32 * 1024 * 1024;
+function parseAsyncAgentLaunch(result) {
+  let payload;
+  try {
+    payload = JSON.parse(result);
+  } catch {
+    return null;
+  }
+  if (!payload || typeof payload !== "object")
+    return null;
+  const obj = payload;
+  if (obj.isAsync !== true && obj.status !== "async_launched")
+    return null;
+  const agentId = typeof obj.agentId === "string" ? obj.agentId : "";
+  const outputFile = typeof obj.outputFile === "string" ? obj.outputFile : "";
+  if (!agentId || !outputFile)
+    return null;
+  return { agentId, outputFile };
+}
+function readAgentTranscriptResult(transcript, agentId) {
+  let last = null;
+  for (const line of transcript.split(`
+`)) {
+    if (!line.trim())
+      continue;
+    let row;
+    try {
+      row = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (row.type !== "assistant" || row.agentId !== agentId)
+      continue;
+    const message = row.message;
+    if (!message || typeof message !== "object")
+      continue;
+    const content = message.content;
+    if (!Array.isArray(content))
+      continue;
+    let text = "";
+    for (const block of content) {
+      if (!block || typeof block !== "object")
+        continue;
+      const part = block;
+      if (part.type === "text" && typeof part.text === "string")
+        text += part.text;
+    }
+    if (text.trim())
+      last = text;
+  }
+  return last;
+}
+function readAgentTranscript(path) {
+  let resolved;
+  try {
+    resolved = realpathSync(path);
+  } catch {
+    return;
+  }
+  return readPrivate(resolved, MAX_TRANSCRIPT_BYTES);
+}
 function hookEventPath(sessionId, root = tmpdir()) {
   return join(cacheDir(root), `${sessionHash(sessionId)}.jsonl`);
 }
@@ -288,6 +351,7 @@ class ClaudeReviewHost {
     this.log = log;
   }
   prepareReview(request) {
+    this.drain();
     const initialCursors = new Map;
     const sessionCursors = new Map;
     for (const sessionId of this.log.sessions()) {
@@ -325,15 +389,23 @@ ${request.prompt}`,
       for (let i = start;i < events.length; i++) {
         const event = events[i];
         if (event.type === "SessionEnd") {
-          this.log.clear(event.sessionId);
-          ended = true;
-          this.appliedBySession.delete(event.sessionId);
           for (const [id, state] of this.pending) {
             if (state.startEvent?.sessionId === event.sessionId || state.postEvent?.sessionId === event.sessionId || state.stopEvent?.sessionId === event.sessionId) {
               this.pending.delete(id);
             }
           }
-          break;
+          for (const state of this.pending.values()) {
+            const current = state.initialCursors.get(sessionId) ?? 0;
+            if (i + 1 > current)
+              state.initialCursors.set(sessionId, i + 1);
+          }
+          if (i === events.length - 1) {
+            this.log.clear(event.sessionId);
+            ended = true;
+            this.appliedBySession.delete(event.sessionId);
+            break;
+          }
+          continue;
         }
         for (const state of this.pending.values()) {
           if (state.consumed || state.error || i < (state.initialCursors.get(sessionId) ?? 0))
@@ -460,13 +532,23 @@ ${request.prompt}`,
     if (state.startEvent.sessionId !== state.postEvent.sessionId || state.startEvent.sessionId !== state.stopEvent.sessionId || state.startEvent.agentId !== state.postEvent.agentId || state.startEvent.agentId !== state.stopEvent.agentId) {
       return { ok: false, reason: "foreground Agent terminal event correlation mismatch", release: true };
     }
-    return {
-      ok: true,
-      receipt: {
-        actorId: `claude:${state.startEvent.agentId ?? reservation.id}`,
-        result: state.postEvent.result
-      }
-    };
+    const actorId = `claude:${state.startEvent.agentId ?? reservation.id}`;
+    const launch = parseAsyncAgentLaunch(state.postEvent.result);
+    if (!launch) {
+      return { ok: true, receipt: { actorId, result: state.postEvent.result } };
+    }
+    if (launch.agentId !== state.postEvent.agentId) {
+      return { ok: false, reason: "async Agent launch envelope names a different agent", release: true };
+    }
+    const transcript = readAgentTranscript(launch.outputFile);
+    if (transcript === undefined) {
+      return { ok: false, reason: "async Agent transcript is not readable", release: false };
+    }
+    const verdict = readAgentTranscriptResult(transcript, launch.agentId);
+    if (!verdict?.trim()) {
+      return { ok: false, reason: "async Agent transcript carries no reviewer result", release: false };
+    }
+    return { ok: true, receipt: { actorId, result: verdict } };
   }
   consumeReview(reservation) {
     const result = this.inspectReview(reservation);
@@ -514,6 +596,11 @@ function parseHookStdin(raw) {
     if (typeof toolInputObj.prompt === "string")
       prompt = toolInputObj.prompt;
   }
+  if (!prompt && typeof payload.tool_response === "object" && payload.tool_response !== null) {
+    const toolResponseObj = payload.tool_response;
+    if (typeof toolResponseObj.prompt === "string")
+      prompt = toolResponseObj.prompt;
+  }
   let extractedOpId = operationId;
   let extractedTaskId = taskId;
   for (const candidate of [payload.input, payload.tool_input, payload.tool_response, payload.toolResponse, payload.response, payload.result]) {
@@ -602,7 +689,7 @@ import { createHash as createHash5, randomUUID as randomUUID2 } from "node:crypt
 // plugins/immune-brain/runtime/assurance/verification.ts
 import { createHash as createHash3 } from "node:crypto";
 import { execFileSync, spawn } from "node:child_process";
-import { realpathSync, statSync } from "node:fs";
+import { realpathSync as realpathSync2, statSync } from "node:fs";
 import { isAbsolute as isAbsolute2, resolve, sep as sep2, relative } from "node:path";
 
 // plugins/immune-brain/runtime/verification_descriptor.ts
@@ -705,7 +792,7 @@ function resolveBunRunner() {
   }
   let real;
   try {
-    real = realpathSync(executable);
+    real = realpathSync2(executable);
   } catch {
     throw new VerificationDescriptorError("bun runner realpath is unresolvable");
   }
@@ -1001,13 +1088,20 @@ function roleSpec(role) {
     throw new Error(`unknown internal role: ${String(role)}`);
   return spec;
 }
+function rolePromptSearchDirs(moduleDir) {
+  return [
+    join3(moduleDir, "..", "dist", "role-prompts"),
+    join3(moduleDir, "..", "role-prompts")
+  ];
+}
 function loadRolePrompt(role) {
   const spec = roleSpec(role);
-  const path = join3(RUNTIME_DIR, "..", "dist", "role-prompts", spec.file);
-  if (!existsSync(path)) {
-    throw new Error(`internal role prompt is not packaged: ${role}`);
+  for (const dir of rolePromptSearchDirs(RUNTIME_DIR)) {
+    const path = join3(dir, spec.file);
+    if (existsSync(path))
+      return readFileSync(path, "utf8");
   }
-  return readFileSync(path, "utf8");
+  throw new Error(`internal role prompt is not packaged: ${role}`);
 }
 function buildRoleDelegationPacket(input) {
   const spec = roleSpec(input.role);
@@ -1703,7 +1797,7 @@ import {
   writeFileSync,
   statSync as statSync2,
   readFileSync as readFileSync3,
-  realpathSync as realpathSync3,
+  realpathSync as realpathSync4,
   chmodSync
 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
@@ -1717,7 +1811,7 @@ import {
   lstatSync as lstatSync2,
   readFileSync as readFileSync2,
   readlinkSync,
-  realpathSync as realpathSync2
+  realpathSync as realpathSync3
 } from "node:fs";
 import { resolve as resolve2 } from "node:path";
 function git(root, args) {
@@ -1884,7 +1978,7 @@ function taskSnapshotOnce(root, scope) {
   const head = git(root, ["rev-parse", "--verify", "HEAD^{commit}"])?.trim();
   if (!repositoryRoot || !head || !GIT_OBJECT_ID.test(head))
     throw new Error("cannot derive task snapshot outside a committed Git workspace");
-  if (realpathSync2(resolve2(repositoryRoot)) !== root)
+  if (realpathSync3(resolve2(repositoryRoot)) !== root)
     throw new Error("task snapshot repository root does not match the project root");
   const sparseCheckout = git(root, ["config", "--bool", "core.sparseCheckout"])?.trim();
   const sparseIndex = git(root, ["config", "--bool", "index.sparse"])?.trim();
@@ -1928,7 +2022,7 @@ function captureGitTaskSnapshot(projectRoot, scopeHint) {
   const requestedStat = lstatSync2(requestedRoot);
   if (requestedStat.isSymbolicLink() || !requestedStat.isDirectory())
     throw new Error("task snapshot root must be a real directory");
-  const root = realpathSync2(requestedRoot);
+  const root = realpathSync3(requestedRoot);
   const scope = assertCanonicalTaskScope(scopeHint);
   const before = taskSnapshotOnce(root, scope);
   gitTaskSnapshotTestHook?.();
@@ -1961,7 +2055,7 @@ function taskRevisionSnapshotOnce(root, scope, baseHead) {
   const head = git(root, ["rev-parse", "--verify", "HEAD^{commit}"])?.trim();
   if (!repositoryRoot || !head || !GIT_OBJECT_ID.test(head))
     throw new Error("cannot derive a task revision outside a committed Git workspace");
-  if (realpathSync2(resolve2(repositoryRoot)) !== root)
+  if (realpathSync3(resolve2(repositoryRoot)) !== root)
     throw new Error("task revision repository root does not match the project root");
   if (gitRequired(root, ["cat-file", "-t", baseHead], `task revision base is unreadable: ${baseHead}`) !== "commit")
     throw new Error(`task revision base is not a commit: ${baseHead}`);
@@ -2018,7 +2112,7 @@ function captureGitTaskRevisionSnapshot(projectRoot, scopeHint, baseHead) {
   const requestedStat = lstatSync2(requestedRoot);
   if (requestedStat.isSymbolicLink() || !requestedStat.isDirectory())
     throw new Error("task revision root must be a real directory");
-  const root = realpathSync2(requestedRoot);
+  const root = realpathSync3(requestedRoot);
   if (typeof baseHead !== "string" || !GIT_OBJECT_ID.test(baseHead.toLowerCase()))
     throw new Error("task revision base must be a Git commit id");
   const scope = assertCanonicalTaskScope(scopeHint);
@@ -2396,7 +2490,7 @@ function ensureReviewRevision(root, input) {
 function writeNativeReviewEvidence(payload) {
   const rawDirectory = mkdtempSync(join4(tmpdir2(), "imm-canary-native-review-"));
   try {
-    const directory = realpathSync3(rawDirectory);
+    const directory = realpathSync4(rawDirectory);
     chmodSync(directory, 493);
     const path = join4(directory, "evidence.json");
     writeFileSync(path, JSON.stringify(payload), { encoding: "utf8", mode: 420, flag: "wx" });
@@ -2411,7 +2505,7 @@ function writeNativeReviewEvidence(payload) {
   }
 }
 function assertReviewArtifact(path) {
-  const targetPath = realpathSync3(path);
+  const targetPath = realpathSync4(path);
   let stat;
   try {
     stat = statSync2(targetPath);
@@ -2605,7 +2699,7 @@ import {
   mkdirSync as mkdirSync2,
   openSync as openSync3,
   readFileSync as readFileSync6,
-  realpathSync as realpathSync5,
+  realpathSync as realpathSync6,
   renameSync,
   rmSync as rmSync3,
   writeFileSync as writeFileSync2
@@ -2634,7 +2728,7 @@ import {
   lstatSync as lstatSync4,
   openSync as openSync2,
   readFileSync as readFileSync5,
-  realpathSync as realpathSync4
+  realpathSync as realpathSync5
 } from "node:fs";
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { join as join6, resolve as resolve4, sep as sep3 } from "node:path";
@@ -2932,7 +3026,7 @@ function resolveCanonicalRoot(root) {
   const rootStat = lstatSync4(resolved);
   if (rootStat.isSymbolicLink() || !rootStat.isDirectory())
     throw new Error("project root must be a real directory, not a symlink");
-  return realpathSync4(resolved);
+  return realpathSync5(resolved);
 }
 function resolveSidecarPath(canonicalRoot, activePath, archivedPath) {
   if (sidecarPresent(canonicalRoot, activePath))
@@ -3009,7 +3103,7 @@ function readTaskIntent(root, taskId, requestedPath) {
   const after = lstatSync4(target);
   assertSameIdentity(statIdentity(before), after, "intent sidecar");
   assertIdentitiesUnchanged(pathIdentities, canonicalRoot, sidecarPath);
-  const canonicalAgain = realpathSync4(root);
+  const canonicalAgain = realpathSync5(root);
   if (canonicalAgain !== canonicalRoot)
     throw new Error("canonical project root drifted while being read");
   if (lstatSync4(canonicalAgain).isSymbolicLink())
@@ -3752,7 +3846,7 @@ function revisionFor(content) {
 }
 function canonicalRoot(root) {
   try {
-    return realpathSync5(root);
+    return realpathSync6(root);
   } catch {
     throw new KernelStoreSecurityError("project root is unavailable");
   }

package/plugins/immune-brain/runtime/claude/review_host.ts

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { constants, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, rmSync, writeSync, closeSync } from "node:fs";
+import { constants, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, realpathSync, rmSync, writeSync, closeSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { tmpdir } from "node:os";
 import type {
@@ -122,12 +122,13 @@ function appendPrivate(path: string, dir: string, line: string): boolean {
 	}
 }
 
-function readPrivate(path: string): string | undefined {
+function readPrivate(path: string, maxBytes = Number.POSITIVE_INFINITY): string | undefined {
 	let fd: number;
 	try { fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); } catch { return; }
 	try {
 		const stat = fstatSync(fd);
 		if (!stat.isFile() || !ownedByUs(stat) || (stat.mode & 0o777) !== 0o600) return;
+		if (stat.size > maxBytes) return;
 		const buf = Buffer.alloc(stat.size);
 		readSync(fd, buf, 0, stat.size, 0);
 		return buf.toString("utf8");
@@ -136,6 +137,78 @@ function readPrivate(path: string): string | undefined {
 	}
 }
 
+/**
+ * Upper bound on a reviewer transcript we are willing to load. A reviewer that
+ * produced more than this did not produce a verdict; refusing to allocate for it
+ * is safer than trusting whatever the tail happens to contain.
+ */
+const MAX_TRANSCRIPT_BYTES = 32 * 1024 * 1024;
+
+export type AsyncAgentLaunch = { agentId: string; outputFile: string };
+
+/**
+ * Recognise the launch receipt this Claude Code build returns for `Agent`.
+ *
+ * Every `Agent` call here runs asynchronously — `run_in_background: false` in
+ * the dispatch envelope is not honoured, and there is no synchronous mode. The
+ * tool result is therefore
+ * `{"isAsync":true,"status":"async_launched","agentId":…,"outputFile":…}`:
+ * proof that a subagent started, never its answer. Treating it as the verdict
+ * would settle Review on a receipt for starting the reviewer, so the launch
+ * envelope is read only as a pointer to where the real bytes live.
+ */
+export function parseAsyncAgentLaunch(result: string): AsyncAgentLaunch | null {
+	let payload: unknown;
+	try { payload = JSON.parse(result); } catch { return null; }
+	if (!payload || typeof payload !== "object") return null;
+	const obj = payload as Record<string, unknown>;
+	if (obj.isAsync !== true && obj.status !== "async_launched") return null;
+	const agentId = typeof obj.agentId === "string" ? obj.agentId : "";
+	const outputFile = typeof obj.outputFile === "string" ? obj.outputFile : "";
+	if (!agentId || !outputFile) return null;
+	return { agentId, outputFile };
+}
+
+/**
+ * Extract the reviewer's terminal message from its own transcript.
+ *
+ * Each record carries the `agentId` that wrote it, so the caller's independently
+ * observed id is matched per record rather than trusted for the file as a whole;
+ * a transcript that interleaves another agent cannot contribute its text.
+ */
+export function readAgentTranscriptResult(transcript: string, agentId: string): string | null {
+	let last: string | null = null;
+	for (const line of transcript.split("\n")) {
+		if (!line.trim()) continue;
+		let row: Record<string, unknown>;
+		try { row = JSON.parse(line) as Record<string, unknown>; } catch { continue; }
+		if (row.type !== "assistant" || row.agentId !== agentId) continue;
+		const message = row.message;
+		if (!message || typeof message !== "object") continue;
+		const content = (message as Record<string, unknown>).content;
+		if (!Array.isArray(content)) continue;
+		let text = "";
+		for (const block of content) {
+			if (!block || typeof block !== "object") continue;
+			const part = block as Record<string, unknown>;
+			if (part.type === "text" && typeof part.text === "string") text += part.text;
+		}
+		if (text.trim()) last = text;
+	}
+	return last;
+}
+
+/**
+ * Read the transcript the launch envelope names. The path is a symlink into the
+ * session store, so it is resolved once and then opened `O_NOFOLLOW` with the
+ * same ownership and mode checks the hook log gets.
+ */
+function readAgentTranscript(path: string): string | undefined {
+	let resolved: string;
+	try { resolved = realpathSync(path); } catch { return; }
+	return readPrivate(resolved, MAX_TRANSCRIPT_BYTES);
+}
+
 export function hookEventPath(sessionId: string, root = tmpdir()): string {
 	return join(cacheDir(root), `${sessionHash(sessionId)}.jsonl`);
 }
@@ -229,6 +302,11 @@ export class ClaudeReviewHost implements AssuranceHostPort {
 	constructor(private readonly log: HookEventLog = new MemoryHookEventLog()) {}
 
 	prepareReview(request: ReviewRequest): HostReviewReservation {
+		// Retire whatever the log already holds before the cursors are taken. A
+		// resumed session inherits its predecessor's file, and an unprocessed
+		// `SessionEnd` sitting in it used to survive until the first inspection —
+		// long after this reservation's own events had been appended behind it.
+		this.drain();
 		const initialCursors = new Map<string, number>();
 		const sessionCursors = new Map<string, number>();
 		for (const sessionId of this.log.sessions()) {
@@ -266,17 +344,31 @@ export class ClaudeReviewHost implements AssuranceHostPort {
 			for (let i = start; i < events.length; i++) {
 				const event = events[i];
 				if (event.type === "SessionEnd") {
-					this.log.clear(event.sessionId);
-					ended = true;
-					this.appliedBySession.delete(event.sessionId);
+					// Any reservation that already bound evidence from the finished
+					// session loses it outright; that evidence can never be revived.
 					for (const [id, state] of this.pending) {
 						if (state.startEvent?.sessionId === event.sessionId || state.postEvent?.sessionId === event.sessionId || state.stopEvent?.sessionId === event.sessionId) {
 							this.pending.delete(id);
 						}
 					}
-					// The session ended: stop processing this captured batch so a
-					// later event cannot repopulate confirmations after cleanup.
-					break;
+					// A resumed session reuses its id, so the same log can hold events
+					// appended after an earlier end. Advancing every surviving cursor
+					// past this point keeps the pre-end events unusable — the property
+					// the old whole-log clear was protecting — while still letting the
+					// events that follow reach their reservation. Clearing and stopping
+					// here instead silently discarded a live Review receipt.
+					for (const state of this.pending.values()) {
+						const current = state.initialCursors.get(sessionId) ?? 0;
+						if (i + 1 > current) state.initialCursors.set(sessionId, i + 1);
+					}
+					if (i === events.length - 1) {
+						// Nothing followed the end, so the log is safe to reclaim.
+						this.log.clear(event.sessionId);
+						ended = true;
+						this.appliedBySession.delete(event.sessionId);
+						break;
+					}
+					continue;
 				}
 				for (const state of this.pending.values()) {
 					if (state.consumed || state.error || i < (state.initialCursors.get(sessionId) ?? 0)) continue;
@@ -387,13 +479,29 @@ export class ClaudeReviewHost implements AssuranceHostPort {
 		) {
 			return { ok: false, reason: "foreground Agent terminal event correlation mismatch", release: true };
 		}
-		return {
-			ok: true,
-			receipt: {
-				actorId: `claude:${state.startEvent.agentId ?? reservation.id}`,
-				result: state.postEvent.result,
-			},
-		};
+		const actorId = `claude:${state.startEvent.agentId ?? reservation.id}`;
+		const launch = parseAsyncAgentLaunch(state.postEvent.result);
+		if (!launch) {
+			return { ok: true, receipt: { actorId, result: state.postEvent.result } };
+		}
+		// Invariant guard. Correlation already binds the PostToolUse through the
+		// same `agentId` this envelope carries, so a foreign id normally never
+		// reaches here; assert it anyway rather than read a transcript the three
+		// observed events did not agree on.
+		if (launch.agentId !== state.postEvent.agentId) {
+			return { ok: false, reason: "async Agent launch envelope names a different agent", release: true };
+		}
+		const transcript = readAgentTranscript(launch.outputFile);
+		if (transcript === undefined) {
+			// Fail closed rather than falling back to bytes the Parent supplied:
+			// an optional weaker path is a path the Parent can choose to force.
+			return { ok: false, reason: "async Agent transcript is not readable", release: false };
+		}
+		const verdict = readAgentTranscriptResult(transcript, launch.agentId);
+		if (!verdict?.trim()) {
+			return { ok: false, reason: "async Agent transcript carries no reviewer result", release: false };
+		}
+		return { ok: true, receipt: { actorId, result: verdict } };
 	}
 
 	consumeReview(reservation: HostReviewReservation): ConsumeReviewResult {
@@ -437,6 +545,14 @@ export function parseHookStdin(raw: string): ClaudeHookEvent | null {
 		const toolInputObj = payload.tool_input as Record<string, unknown>;
 		if (typeof toolInputObj.prompt === "string") prompt = toolInputObj.prompt;
 	}
+	// The async launch envelope echoes the dispatched prompt. It is the only
+	// place the reservation marker appears when a payload omits `tool_input`,
+	// and it is written by the Host, not by the Parent, like every other field
+	// read here.
+	if (!prompt && typeof payload.tool_response === "object" && payload.tool_response !== null) {
+		const toolResponseObj = payload.tool_response as Record<string, unknown>;
+		if (typeof toolResponseObj.prompt === "string") prompt = toolResponseObj.prompt;
+	}
 	let extractedOpId = operationId;
 	let extractedTaskId = taskId;
 	// Extract nested operation_id/task_id from tool_input or tool_response (e.g. { tool_input: { operation_id, task_id } })

package/plugins/immune-brain/runtime/plugin_version.ts

@@ -1,2 +1,2 @@
 // Generated by scripts/plugin_versioning.ts from the root package.json.
-export const PLUGIN_VERSION = "3.6.1" as const;
+export const PLUGIN_VERSION = "3.6.3" as const;

package/plugins/immune-brain/runtime/role_prompt_bridge.ts

@@ -108,17 +108,33 @@ function roleSpec(role: InternalRole): RolePromptSpec {
 	return spec;
 }
 
+/**
+ * Directories that can hold the packaged role prompts, most specific first.
+ *
+ * From source this module sits in `runtime/`, a sibling of `dist/`. The Claude
+ * Code Host instead ships a bundle at `dist/claude/mcp-server.mjs`, where the
+ * same relative walk lands on a `dist/dist/` that never exists while the prompts
+ * sit one level up. Every test runs from source, so the shipped Host could not
+ * load a single internal role prompt and no test noticed.
+ */
+export function rolePromptSearchDirs(moduleDir: string): string[] {
+	return [
+		join(moduleDir, "..", "dist", "role-prompts"),
+		join(moduleDir, "..", "role-prompts"),
+	];
+}
+
 /**
  * Read the packaged prompt so the runtime follows the bytes shipped to a
  * consumer. The canonical source is synced into this dist-local directory.
  */
 export function loadRolePrompt(role: InternalRole): string {
 	const spec = roleSpec(role);
-	const path = join(RUNTIME_DIR, "..", "dist", "role-prompts", spec.file);
-	if (!existsSync(path)) {
-		throw new Error(`internal role prompt is not packaged: ${role}`);
+	for (const dir of rolePromptSearchDirs(RUNTIME_DIR)) {
+		const path = join(dir, spec.file);
+		if (existsSync(path)) return readFileSync(path, "utf8");
 	}
-	return readFileSync(path, "utf8");
+	throw new Error(`internal role prompt is not packaged: ${role}`);
 }
 
 export function buildRoleDelegationPacket(input: {