kijito-tools 0.2.0

package/providers/claude/scripts/self-clear.sh

@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+# AGENT-INVOKED self-/clear — the agent's FINAL action, only after /kijito-qa-memory passed.
+# Hard gates (all must hold): kill-switch off · armed · not-a-subagent · in tmux · pane alive ·
+# FRESH qa-pass token. Never auto-fired. (Cycle cap + every-5 checkpoint REMOVED 2026-07-29 — see C2.)
+set -u
+# Resolve the shared lib NEXT TO THIS SCRIPT so the repo copy is runnable/testable in place, and
+# fall back to the installed location for a stray single-file copy. KIJITO_LC_LIB overrides both.
+_kjt_lib="${KIJITO_LC_LIB:-$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lifecycle-lib.sh}"
+[ -f "$_kjt_lib" ] || _kjt_lib="$HOME/.claude/lifecycle-lib.sh"
+. "$_kjt_lib"
+refuse(){ echo "self-clear REFUSED: $1" >&2; lc_log SELFCLEAR_REFUSED "$1"; exit "${2:-3}"; }
+
+lc_stopped && refuse "kill switch present ($KIJITO_LC_STOP) — rm it to re-enable" 9
+lc_is_child && refuse "subagent marker set — would clear the PARENT pane" 6
+# ⚠️ THE TMUX CHECK MUST PRECEDE THE ARMED CHECK, AND THE ORDER USED TO BE REVERSED (argus, 2026-08-01).
+# Outside tmux there is no TMUX_PANE, so lc_is_armed falls back to a placeholder and refuses with
+# "not an armed pane — launch via claude-armed.sh". But arming is PANE-KEYED and arm-session.sh
+# itself exits 1 outside tmux, so that refusal pointed at a remedy which cannot work. It is the
+# familiar shape: COULD-NOT-MEASURE wearing the costume of THE-CLAIM-IS-FALSE. Ask the question
+# that can actually be answered first.
+{ [ -n "${TMUX:-}" ] && [ -n "${TMUX_PANE:-}" ]; } || refuse "not in tmux (TMUX/TMUX_PANE unset)" 4
+lc_pane_alive "$TMUX_PANE" || refuse "target pane $TMUX_PANE no longer exists" 4
+lc_is_armed "${TMUX_PANE:-}" || refuse "not an armed pane — self-clear only runs in autonomous sessions (launch via ~/.claude/claude-armed.sh, or ~/.claude/arm-session.sh on); plain 'claude' is human-managed" 3
+# (no pane_current_command gate — unreliable label; send-keys reaches the TTY regardless)
+
+# C1 — require a FRESH /kijito-qa-memory pass for THIS session
+tok="$(lc_qa_token)"; ttl="${KIJITO_QA_TTL:-1800}"
+[ -f "$tok" ] || refuse "no kijito-qa-memory pass — run /kijito-qa-memory first (it cold-boot-verifies, then records the token)" 5
+age=$(( $(lc_now) - $(cat "$tok" 2>/dev/null || echo 0) ))
+[ "$age" -le "$ttl" ] || refuse "kijito-qa-memory pass is stale (${age}s > ${ttl}s) — re-run /kijito-qa-memory" 5
+
+# C2 — cycle COUNTER, telemetry only. NOT a gate.
+#
+# ⛔ REMOVED 2026-07-29 ON JASON'S EXPLICIT INSTRUCTION: the cycle cap (default 12)
+# and the every-5 human checkpoint. Both were COUNT-based, and a count cannot
+# distinguish a runaway loop from a productive day — it measures UPTIME.
+#
+# MEASURED over the whole log before removing (88 successful cycles, 24 refusals):
+#     15  checkpoint at cycle N (every 5)   <- count-based, never caught a loop
+#      4  cycle cap hit                     <- count-based, never caught a loop
+#      3  kijito-qa-memory pass is stale    <- PROPERTY-based, genuinely useful
+#      1  not an armed pane                 <- PROPERTY-based, genuinely useful
+#      1  no kijito-qa-memory pass          <- PROPERTY-based, genuinely useful
+# 19 of 24 refusals were the two count gates. Jason: "it's never once been useful,
+# it's just gotten you to high context usage and blocked on something that isn't
+# useful." Correct: they fired hardest on the most productive days, and the cost
+# was a degraded session sitting at ~70% context waiting for a human to type rm.
+#
+# ★ THE REAL GATES ARE ALL STILL ABOVE and none of them is a counter: kill-switch,
+# armed pane, not-a-subagent, in-tmux, pane alive, and a FRESH cold-boot-verified
+# qa-pass token. Those check a PROPERTY of this clear ("is the handoff good enough
+# to survive it?") rather than how many times it has happened before. A thin
+# handoff still cannot self-clear, which is the protection that ever mattered.
+#
+# ⚠️ If a genuine runaway ever needs catching, detect the LOOP, not the count:
+# consecutive cycles that land no commits and no memories. Do not reintroduce a
+# counter — it is the same defect class as a stranded-mail check that measures
+# broadcast cadence instead of neglect.
+cf="$(lc_cycle_file)"; cyc=$(( $(cat "$cf" 2>/dev/null || echo 0) + 1 )); echo "$cyc" > "$cf"
+
+# C5 — consume the token (one clear per QA pass) and fire as the LAST action
+rm -f "$tok"
+delay="${KIJITO_SELFCLEAR_DELAY:-3.0}"
+
+# C6 — RECORD THE CONTEXT LEVEL WE RECYCLED AT. OBSERVABILITY, NOT A GATE.
+# ⛔ THE RULE IS NUMERIC AND WE WERE RECORDING NO INSTANCE OF THE NUMBER. `lifecycle.log` could
+# say THAT a seat recycled and WHEN, but not whether it went at 20% or 78% — so "does the fleet
+# actually recycle near the target?" was unanswerable, including retrospectively. You could not
+# spot a seat looping at 15%, nor one running to 80% and doing its worst work in the tail.
+# (Found by ladybug 2026-08-01 while auditing the myctx residual; this also gives myctx's
+# non-zero exit its first real consumer — until now its only "consumer" was a sentence of prose
+# telling an agent to run it.)
+#
+# ⛔ AND IT IS DELIBERATELY NOT A GATE, which is the more important half. The obvious version —
+# "refuse to self-clear when context is UNMEASURABLE" — makes jq, $CLAUDE_CODE_SESSION_ID and a
+# readable transcript into three new fleet-wide halt conditions for the autonomous loop. That is
+# a STRICTLY LARGER outage than the risk it removes. ★ The blast radius a new gate on this path
+# may have is "can stop ONE cycle"; that one is "can stop EVERY cycle on EVERY seat". ladybug
+# proposed it against their own instinct for exactly this reason, hours after nearly shipping
+# `lc_is_child` — a real defect with an invented fix that would have refused forever.
+#
+# ✅ THE CAVEAT THEY FLAGGED IS RESOLVED BY MEASUREMENT, NOT BY ARGUMENT: myctx inside a SUBAGENT
+# reports the PARENT's context (a real number about the wrong subject), so this would be worse
+# than useless if this script ran in a different session context than the pane's agent. Verified
+# 2026-08-01 on the VM: the shell this script runs in resolves the same CLAUDE_CODE_SESSION_ID as
+# the pane's agent, and myctx there returned 32.2% / ~677557 free against the agent's own live
+# counter of 677261 remaining — agreement to ~300 tokens, which is just the tokens spent between
+# the two reads. ⚠️ A WRONG number in an audit log is worse than an absent one, so if this ever
+# moves to a different execution context, RE-MEASURE that agreement before trusting the field.
+ctx="UNMEASURABLE"
+# KIJITO_MYCTX exists so the SUCCESS branch is testable. Without it a test can only ever exercise
+# the failure path (a fixture session has no transcript), and a branch that is only ever tested in
+# the direction it fails is not tested — the exact defect that let lc_pane_alive return TRUE for
+# every input for months.
+_myctx="${KIJITO_MYCTX:-$HOME/.claude/myctx.sh}"
+if [ -x "$_myctx" ]; then
+  _m=$("$_myctx" 2>/dev/null) && case "$_m" in
+    *%*) ctx=$(printf '%s' "$_m" | sed -n 's/.*= *\([0-9.]*%\).*/\1/p'); [ -n "$ctx" ] || ctx="UNPARSED" ;;
+  esac
+fi
+lc_log SELFCLEAR_FIRE "cycle=$cyc delay=$delay ctx=$ctx"
+( sleep "$delay"
+  lc_stopped               && { lc_log SELFCLEAR_ABORT "stop during delay"; exit 0; }
+  lc_pane_alive "$TMUX_PANE" || { lc_log SELFCLEAR_ABORT "pane gone during delay"; exit 0; }
+  # ⛔ BRANCH ON DELIVERY. `SELFCLEAR_DONE` used to be logged UNCONDITIONALLY, with both send-keys
+  # calls discarding stderr and nothing reading their status — so a REFUSED delivery still wrote
+  # DONE (argus, 2026-08-01). An audit log asserting an action that did not occur is the one thing
+  # an audit log must never do, and it chained with the decorative lc_pane_alive: gate passes,
+  # delivery fails, log says DONE, token is consumed — the loop believes it recycled and did not.
+  #
+  # ★ THE TWO FAILURES ARE LOGGED SEPARATELY ON PURPOSE: "not typed" and "typed but not submitted"
+  # are different states with different causes, and the second is exactly what Jason observed for
+  # session-autosend. Collapsing them would hide the one the settle-sleep below addresses.
+  if tmux send-keys -t "$TMUX_PANE" -l -- "/clear" 2>/dev/null; then
+    # Same paste-buffer race that broke session-autosend — an Enter arriving inside the TUI's ingest
+    # burst is taken as a newline rather than as submit. "/clear" is short and has fired ~88 times
+    # successfully, so this gap is hardening rather than a repair; the cost of failing here is the
+    # same dead loop.
+    # ⛔ NO RETRY LOOP, DELIBERATELY — THE OPPOSITE CHOICE FROM session-autosend. There a second
+    # Enter is free. Here a second "/clear" would land in the session the first already cleared,
+    # wiping the auto-resume prompt the SessionStart hook had just injected — stopping the loop by
+    # way of the very mechanism meant to protect it. Fire once.
+    sleep "${KIJITO_SEND_SETTLE:-1.2}"
+    if tmux send-keys -t "$TMUX_PANE" Enter 2>/dev/null; then
+      lc_log SELFCLEAR_DONE "cycle=$cyc"
+    else
+      lc_log SELFCLEAR_FAILED "cycle=$cyc Enter refused pane=$TMUX_PANE — /clear typed, NOT submitted"
+    fi
+  else
+    lc_log SELFCLEAR_FAILED "cycle=$cyc send-keys refused pane=$TMUX_PANE — NOT cleared"
+  fi
+) >/dev/null 2>&1 &
+echo "self-clear scheduled (cycle $cyc, uncapped): /clear → $TMUX_PANE in ${delay}s. This MUST be your FINAL action — stop now; SessionStart re-catches-up and resumes the preloaded work."
+exit 0

package/providers/claude/scripts/session-autosend.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# Delayed self-send of the catch-up prompt INTO a tmux pane → instigates the first turn.
+# Called (detached, via nohup &) by the SessionStart hook ONLY when the pane is armed + in tmux.
+# Args: $1 = target tmux pane (normally "$TMUX_PANE"). Fixed-delay approach — proven reliable.
+# Needs Kijito: OPTIONAL — set KIJITO_AUTOCATCHUP_PROMPT for your own text, or KIJITO_MODE=off for a
+#   generic (non-Kijito) default prompt.
+set -u
+# Resolve the shared lib NEXT TO THIS SCRIPT so the repo copy is runnable/testable in place, and
+# fall back to the installed location for a stray single-file copy. KIJITO_LC_LIB overrides both.
+_kjt_lib="${KIJITO_LC_LIB:-$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lifecycle-lib.sh}"
+[ -f "$_kjt_lib" ] || _kjt_lib="$HOME/.claude/lifecycle-lib.sh"
+. "$_kjt_lib"
+pane="${1:?target pane required}"
+command -v tmux >/dev/null 2>&1 || exit 0
+lc_stopped && { lc_log AUTOSEND_SKIP "kill switch"; exit 0; }
+
+if [ -n "${KIJITO_AUTOCATCHUP_PROMPT:-}" ]; then
+  prompt="$KIJITO_AUTOCATCHUP_PROMPT"
+elif [ "${KIJITO_MODE:-on}" = "off" ]; then
+  # standalone (no Kijito): catch up against whatever notes/handoff you keep
+  prompt="Catch up on this project's context and any handoff / next-steps notes from the prior session, then CONTINUE the active work to its DONE-WHEN without waiting for further instruction. If there's no active work, report ready."
+else
+  # Invoke the packaged catch-up routine (~/.claude/skills/kijito-start) by name — prose-invoked
+  # rather than send-keys'ing a literal "/kijito-start" (the TUI slash-autocomplete menu is an
+  # extra failure mode this path doesn't need). The skill covers catch-up + inbox-arm + new-persona
+  # setup; the trailing directive carries the autonomous-resume mandate. (This prompt predated the
+  # skill — updated 2026-07-10 per Jason.)
+  prompt="Run the kijito-start skill (Skill: kijito-start) and follow it fully — catch up deeply on memory, arm the inbox, and if this is a brand-new project with no persona yet, set that up per CLAUDE.md. Then, if the current-state / next-steps pointer shows ACTIVE WORK in progress, CONTINUE it autonomously without waiting for further instruction — work to its DONE-WHEN criteria, stopping only for a genuine gate. If there is no active work to resume, report ready."
+fi
+
+delay="${KIJITO_AUTOCATCHUP_DELAY:-4.0}"     # seconds for the TUI to become input-ready
+sleep "$delay"
+lc_stopped             && { lc_log AUTOSEND_ABORT "stop appeared"; exit 0; }
+lc_pane_alive "$pane"  || { lc_log AUTOSEND_ABORT "pane gone"; exit 0; }
+# NOTE: do NOT gate on pane_current_command — it's unreliable (reports "bash" for a wrapped
+# claude, the version for an exec'd one). send-keys reaches the pane's TTY (claude) regardless.
+tmux send-keys -t "$pane" -l -- "$prompt" 2>/dev/null
+
+# ⛔ THE ENTER NEEDS A GAP AFTER THE TEXT, AND WITHOUT ONE THE WHOLE AUTONOMOUS LOOP SILENTLY DIES.
+# Observed 2026-08-01 (Jason, live): "the injected start prompt was just entered into the input but
+# remained unsent." The two send-keys calls used to be back-to-back. The TUI is an Ink app that
+# buffers a fast burst of characters as a PASTE, and an Enter arriving inside that burst is taken as
+# a NEWLINE IN THE BUFFER rather than as submit. The prompt then sits in the input box, complete and
+# unsent, forever.
+#
+# ★ WHY THIS IS THE WORST POSSIBLE PLACE FOR A SILENT FAILURE: this send is the ONLY thing that
+# restarts work after a /clear. A self-clear with a broken re-send does not degrade the loop, it
+# ENDS it — and it ends it in the state that looks most like success, because /clear ran, the pane
+# is alive, and the prompt is visibly right there on screen.
+settle="${KIJITO_SEND_SETTLE:-1.2}"          # let the TUI finish ingesting the paste
+sleep "$settle"
+
+# ⚠️ AND SENDING ENTER IS NOT THE SAME AS HAVING SENT THE PROMPT, so verify rather than hope.
+# After a successful submit the input box is empty and the text has moved up into the transcript, so
+# the prompt's TAIL disappears from the BOTTOM few lines. If it is still down there, the Enter did
+# not take — retry a bounded number of times rather than leaving the loop dead.
+#
+# The probe is the prompt's LAST 40 characters: the tail is what remains visible in a wrapped input
+# box, and matching a fixed string with -F avoids any regex metacharacter in the prompt.
+probe=$(printf '%s' "$prompt" | tail -c 40)
+sent=0
+for _try in 1 2 3; do
+  tmux send-keys -t "$pane" Enter 2>/dev/null
+  sleep 1.5
+  if ! tmux capture-pane -p -t "$pane" 2>/dev/null | tail -6 | grep -qF -- "$probe"; then
+    sent=1; break
+  fi
+  lc_log AUTOSEND_RETRY "enter did not submit (attempt $_try)"
+done
+
+if [ "$sent" = 1 ]; then
+  lc_log AUTOSEND_FIRE "delay=$delay settle=$settle"
+else
+  # ⚠️ UNCONFIRMED, NOT FAILED — and the distinction is the same one the gate runner enforces
+  # between BLOCKED and FAIL. The probe reads the BOTTOM of the pane, so it can only observe that
+  # the prompt's tail is still down there. That is strong evidence in the real TUI (a submitted
+  # message scrolls up and the input box empties) but it is not proof: any host whose display keeps
+  # the text visible at the bottom — a plain shell echoing input, a narrow pane, an unusual theme —
+  # produces a false negative on a delivery that actually worked.
+  # ⇒ Say what was observed, never more. Claiming "the loop is NOT running" when the loop may be
+  # perfectly fine is exactly the wrong-diagnosis-costs-more failure argus and I have both been
+  # chasing tonight; a confident wrong log entry sends the next reader hunting the wrong thing.
+  lc_log AUTOSEND_UNCONFIRMED "sent 3 Enters; prompt tail still visible at the bottom of the pane — delivery NOT confirmed (it may still have worked; check the pane before acting)"
+fi
+exit 0

package/providers/claude/scripts/session-catchup-hint.sh

@@ -0,0 +1,330 @@
+#!/usr/bin/env bash
+# SessionStart hook → (1) ALWAYS print a passive catch-up reminder + an EXPLICIT, per-persona
+# WAKE-CAPABLE inbox-arming instruction, (2) ARMED auto-send if this pane is armed.
+#
+# Why the explicit arming block (Jason fleet-directive, "an unmonitored mailbox is useless"):
+# agents fail two ways — they forget to arm, or they arm WRONG. A bare background `tail -F` is
+# CAPTURE-ONLY: it writes matching lines to a file and never exits, so the harness never
+# re-invokes the agent and mail is silently missed (argus's exact failure, 2026-06-29). The
+# wake-capable consumer in Claude Code is the Monitor TOOL (persistent), which streams each event
+# as a live notification that interrupts the agent. This hook injects the EXACT Monitor call so
+# there is one unambiguous first action.
+#
+# Resolve the shared lib and sibling scripts NEXT TO THIS SCRIPT so the repo copy is runnable and
+# testable in place, falling back to the installed location for a stray single-file copy.
+# KIJITO_LC_LIB overrides the lib path.
+_kjt_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+_kjt_lib="${KIJITO_LC_LIB:-$_kjt_dir/lifecycle-lib.sh}"
+[ -f "$_kjt_lib" ] || _kjt_lib="$HOME/.claude/lifecycle-lib.sh"
+. "$_kjt_lib" 2>/dev/null
+
+# Read the hook stdin ONCE (both .source and .cwd come from it).
+_in=$(cat 2>/dev/null)
+src=$(printf '%s' "$_in" | jq -r '.source // "startup"' 2>/dev/null); [ -z "$src" ] && src=startup
+hook_cwd=$(printf '%s' "$_in" | jq -r '.cwd // empty' 2>/dev/null)
+
+case "$src" in
+  clear)   pre="You just /clear'd — context was intentionally reset to a clean slate." ;;
+  compact) pre="Context was just compacted — detail was summarized away; memory is now the source of truth." ;;
+  *)       pre="New session." ;;
+esac
+
+# ── Resolve THIS project's persona from a .kijito_persona marker (self-describing, travels with
+# the project, survives a rename — preferred over parsing CLAUDE.md prose or a central dir->persona
+# map that rots). Search order: $CLAUDE_PROJECT_DIR, the hook-reported cwd, $PWD.
+#
+# ── ASK THE PRODUCER FOR THE FILENAME RULE; NEVER RE-IMPLEMENT IT (row M290) ──────────────────────
+# This line used to read `sed 's/[^A-Za-z0-9._-]/_/g'`, described as matching the producer's rule. It
+# did not, in two ways that matter: the producer CASEFOLDS (the local filesystem is case-insensitive,
+# so it must) and it accepts any UNICODE alphanumeric. So a persona named `Loom` got `Loom.jsonl` here
+# and `loom.jsonl` from the producer; `Ωmega` got `_mega` here and `ωmega` there. The hook then told
+# the user their mail was "not being collected" and pointed a Monitor at a file that will never exist
+# — silence forever, no error (beta feedback #14/#16).
+# ⚠️ AND IT WAS INVISIBLE TO EVERYONE WHO TESTED IT ON A MAC: APFS is case-INSENSITIVE, so the `-e`
+# probe below SUCCEEDS on the producer's differently-cased file. The bug only exists on Linux, which
+# is why it reached a user rather than a reviewer.
+# ⇒ The producer publishes the rule as `--safe-persona NAME` (a pure string transform: no token, no
+# network, no state file). We ask it. If we CANNOT ask it — no producer installed, or one too old to
+# answer — we do NOT fall back to guessing, because a guess is what produced this defect; we say so
+# and name the fix. A wrong path here is unfalsifiable by construction: it fails as silence.
+# The marker read lives in kijito-persona-lib.sh so the status line (row M309) and anything added
+# later cannot drift from it the way the filename rule did. Falling back to the inline loop keeps a
+# partially-installed ~/.claude working rather than silently resolving no persona at all.
+_persona=""
+_lib="$(dirname -- "${BASH_SOURCE[0]:-$0}")/kijito-persona-lib.sh"
+if [ -r "$_lib" ]; then
+  # shellcheck source=/dev/null
+  . "$_lib"
+  _persona=$(kijito_persona_from_marker "${CLAUDE_PROJECT_DIR:-}" "$hook_cwd" "$PWD" || true)
+fi
+for d in "${CLAUDE_PROJECT_DIR:-}" "$hook_cwd" "$PWD"; do
+  if [ -z "$_persona" ] && [ -n "$d" ] && [ -f "$d/.kijito_persona" ]; then
+    # ⛔ TRIM THE ENDS, NEVER THE MIDDLE (row M290). This read was `tr -d '[:space:]'`, which deletes
+    # EVERY space in the name: a persona written `name (purpose)` in the marker became `name(purpose)`
+    # here and `name_purpose_` as a filename, while the producer — which receives the name with its
+    # space intact from the API — wrote `name__purpose_`. THAT is the exact pair of filenames beta
+    # feedback #14/#16 reported, and it is a different defect from the sanitizer mismatch beside it:
+    # the name was already corrupted BEFORE any sanitizer ran, so fixing only the sanitizer would have
+    # left this case broken while looking fixed. A marker file's payload is its first line with the
+    # ends trimmed; anything stricter silently renames the user's persona.
+    _persona=$(head -n1 "$d/.kijito_persona" | tr -d '\r\n')
+    _persona="${_persona#"${_persona%%[![:space:]]*}"}"   # strip leading blanks
+    _persona="${_persona%"${_persona##*[![:space:]]}"}"   # strip trailing blanks
+    [ -n "$_persona" ] && break
+  fi
+done
+_km_bin=""
+for _c in "${KIJITOMON_BIN:-}" "$(command -v kijito-inbox-monitor 2>/dev/null)" \
+          "$HOME/.local/bin/kijito-inbox-monitor" "/usr/local/bin/kijito-inbox-monitor"; do
+  if [ -n "$_c" ] && [ -x "$_c" ]; then _km_bin=$_c; break; fi
+done
+_safe=""; _rule=no-producer
+if [ -n "$_persona" ]; then
+  if [ -n "$_km_bin" ] && _safe=$("$_km_bin" --safe-persona "$_persona" 2>/dev/null) && [ -n "$_safe" ]; then
+    _rule=ok
+  else
+    # ── SECOND NON-GUESSING ROUTE: ASK THE STREAM WHO IT BELONGS TO ─────────────────────────────────
+    # No producer on PATH, or one from before --safe-persona existed. The tempting fallback is to
+    # re-implement the rule "just for this case" — that is precisely how the three drifted copies got
+    # written, so it is the one thing we will not do. Instead we read the producer's OWN OUTPUT: every
+    # event line it writes carries the persona it was written for, so the file itself can say whose
+    # mail it collects. That is evidence, not inference, and it stays correct no matter how the rule
+    # changes. (A brand-new persona with no stream yet simply has no answer here — correctly so: the
+    # honest report is then "nothing is collecting your mail", which is the truth.)
+    _safe=""; _rule=too-old
+    [ -z "$_km_bin" ] && _rule=no-producer
+    if command -v python3 >/dev/null 2>&1; then
+      _found=$(KJ_PERSONA="$_persona" python3 - <<'PYSCAN' 2>/dev/null
+import glob, json, os, sys
+want = os.environ["KJ_PERSONA"].casefold()
+home = os.path.expanduser("~")
+hits = []
+for pat in (os.path.join(home, ".kijito-monitor", "*.jsonl"),
+            os.path.join(home, ".cache", "kijito-inbox-monitor", "events.*.ndjson")):
+    for path in glob.glob(pat):
+        try:
+            with open(path, "rb") as fh:
+                # the FIRST line is enough and is O(1): the producer stamps every event with its
+                # persona, and a stream never mixes personas (one owned sink per persona).
+                line = fh.readline(65536)
+            who = json.loads(line).get("persona")
+        except Exception:
+            continue
+        if isinstance(who, str) and who.casefold() == want:
+            hits.append(path)
+if len(hits) == 1:
+    sys.stdout.write(hits[0])
+PYSCAN
+)
+      # ⛔ A FILE EXISTING IS NOT A PRODUCER RUNNING (assay cert finding F1, 2026-09-21). The first
+      # version of this route stopped here and reported "producer: UP for '<persona>'" on the
+      # strength of a glob hit. A STALE stream file — a persona whose producer died, or one that
+      # moved seats — then manufactured a confident UP, and because the path was found BY GLOBBING
+      # EXISTING FILES it could never reach the "a producer is running but NOT for you" branch
+      # below: that message was unreachable on this route by construction. The agent would arm a
+      # Monitor on a dead file AND be told everything was fine, so nothing would ever contradict it.
+      # That is worse than the silence this whole row is about, and it is reachable exactly in the
+      # population the row exists for (seats whose producer predates --safe-persona).
+      # ⇒ Require EVIDENCE THAT A LIVE PRODUCER COVERS THIS PERSONA, from a running process's own
+      # argv. Any one of three suffices, because the supervisors spell it differently:
+      #   · the resolved path appears verbatim   (systemd's --events-file <path>)
+      #   · --persona <this persona> appears     (a per-persona unit, whatever path spelling)
+      #   · --all-personas appears               (one producer covering every persona, incl. ours)
+      # A launchd producer passes --events-file-template, so its argv holds the TEMPLATE and not the
+      # resolved path — which is precisely why the second and third forms are needed and why
+      # matching the path alone would have been a new false-negative to replace the false positive.
+      if [ -n "${_found:-}" ]; then
+        _live=""
+        if command -v pgrep >/dev/null 2>&1; then
+          # ⛔ A PROCESS THAT MERELY MENTIONS THE PRODUCER IS NOT THE PRODUCER (assay observation, 2026-09-21:
+          # their verification SHELL matched this three times, because its command line contained both the
+          # product name and `--persona <p>` — and it then reported UP for a persona with no producer, which
+          # is F1's exact symptom arriving through the CHECKER instead of through a stale file). The
+          # sibling tool producer-health.sh already guards this by requiring the match to be a PYTHON
+          # process; the same rule belongs here, and a checker that can satisfy its own check is worth
+          # more caution than its low reachability suggests.
+          _live=$(pgrep -af "kijito[-_]inbox[-_]monitor" 2>/dev/null \
+                  | grep -E "[Pp]ython|/kijito-inbox-monitor( |$)" \
+                  | grep -v -e "[[:space:]]grep[[:space:]]" -e "session-catchup-hint" \
+                  | grep -F -e "$_found" -e "--persona $_persona" -e "--all-personas" | head -n1)
+        fi
+        if [ -n "$_live" ]; then
+          _rule=by-content
+        else
+          _rule=stale-stream
+        fi
+      fi
+    fi
+  fi
+fi
+
+# ── Producer topology. THE PRODUCER WRITES A DIFFERENT PATH ON EACH SUPERVISOR, and this script
+# used to hardcode the macOS one in all five places it appears. On a Linux seat that meant: a pgrep
+# for "kijito_inbox_monitor.py" that can never match the `kijito-inbox-monitor` console script, a
+# `launchctl` restart hint that means nothing under systemd, and Monitor templates pointing at
+# ~/.cache/kijito-inbox-monitor/events.<p>.ndjson while the producer writes ~/.kijito-monitor/<p>.jsonl.
+#
+# ⚠️ EVERY ONE OF THOSE FAILS TOWARD FALSE CALM. An agent that obeys the hint tails a file that will
+# never exist, and "no events" is indistinguishable from "no mail" — forever, with no error. Measured
+# 2026-07-31: three personas hit this on one Linux seat in one evening; one hand-built a REST poller
+# instead, and one was told "producer: DOWN" while the producer was up.
+#
+# DETECT, DON'T FORK ON `uname`. The question is not "what OS is this" but "where does the producer
+# on THIS box actually write", so ask the filesystem: an events file that exists is proof, and a
+# supervisor definition is the next-best evidence. uname is the last resort, not the first test.
+_mac_events="$HOME/.cache/kijito-inbox-monitor/events.${_safe}.ndjson"
+_lnx_events="$HOME/.kijito-monitor/${_safe}.jsonl"
+if   [ "$_rule" = by-content ] || [ "$_rule" = stale-stream ]; then
+  # The producer's own output named this file. It outranks every derivation below, because it is the
+  # only one of them that was written by the process we are asking about.
+  # ⚠️ A STALE stream still resolves to THIS path deliberately: it is genuinely this persona's file,
+  # it is simply not being written any more. Falling through to the derivations below would be worse
+  # than useless here — with no --safe-persona answer they would produce `~/.kijito-monitor/.jsonl`,
+  # an empty component that looks like a path and names nothing. The producer line says it is stale;
+  # the arming block should still point at the file that will come back when it restarts.
+  _events="$_found"
+  case "$_events" in *.jsonl) _sup="systemd" ;; *) _sup="launchd" ;; esac
+elif [ -n "$_safe" ] && [ -e "$_lnx_events" ]; then _events="$_lnx_events"; _sup="systemd"
+elif [ -n "$_safe" ] && [ -e "$_mac_events" ]; then _events="$_mac_events"; _sup="launchd"
+elif [ -d "$HOME/.kijito-monitor" ]; then          _events="$_lnx_events"; _sup="systemd"
+elif [ -d "$HOME/.cache/kijito-inbox-monitor" ]; then _events="$_mac_events"; _sup="launchd"
+elif [ -f "$HOME/Library/LaunchAgents/com.kijito.inbox-monitor.plist" ]; then _events="$_mac_events"; _sup="launchd"
+elif [ "$(uname -s 2>/dev/null)" = "Darwin" ]; then _events="$_mac_events"; _sup="launchd"
+else _events="$_lnx_events"; _sup="systemd"; fi
+# The generic (no-marker) branch cannot name a file, so it shows the directory shape instead.
+case "$_sup" in
+  launchd) _events_tmpl="\$HOME/.cache/kijito-inbox-monitor/events.<persona>.ndjson" ;;
+  *)       _events_tmpl="\$HOME/.kijito-monitor/<persona>.jsonl" ;;
+esac
+
+# Producer health, PER PERSONA — because "a producer is running" and "YOUR mail is being collected"
+# are different facts, and on a multi-persona seat they come apart routinely. The old check asked
+# the host-global question and printed a per-persona answer.
+#
+# ⚠️ The pgrep pattern must not match the CONSUMER. On the macOS layout the tail's own path contains
+# the string "kijito-inbox-monitor", so a loose pattern reports the producer UP whenever any agent is
+# merely tailing — a false green in the one direction that matters. Anchor on how the executable
+# appears in a command line, never on the bare product name.
+if pgrep -f "kijito_inbox_monitor\.py|bin/kijito-inbox-monitor" >/dev/null 2>&1 \
+   || pgrep -f "kijito-inbox-monitor .*--persona" >/dev/null 2>&1; then
+  if [ -z "$_persona" ]; then
+    _prod="inbox-monitor producer: a producer process is running (persona unknown here — no .kijito_persona marker, so this hook cannot tell whether it covers YOUR inbox)."
+  elif [ "$_rule" = by-content ]; then
+    _prod="inbox-monitor producer: UP for '$_persona' ($_sup; events → $_events — identified from the stream's own persona stamp and confirmed against a running producer's own arguments, because the installed producer could not be asked for the filename rule)."
+  elif [ "$_rule" = stale-stream ]; then
+    # The most diagnosable state of the lot, and it used to read as UP: the file is there, nothing is
+    # writing it. Say that, rather than the generic "not being collected" — a stale file and a missing
+    # file need different fixes and a reader cannot tell them apart from the generic wording.
+    _prod="inbox-monitor producer: NOT running for '$_persona' — a stream file exists ($_found) but NO running producer names that path, this persona, or --all-personas, so it is STALE and your mail is not being collected. Anything tailing it will wait forever without an error. Start one: $(
+      [ "$_sup" = launchd ] \
+        && printf 'launchctl kickstart -k gui/$(id -u)/com.kijito.inbox-monitor' \
+        || printf 'systemctl --user enable --now kijito-inbox-monitor@%s' "$_persona" )"
+  elif [ "$_rule" = too-old ]; then
+    # We know the persona and a producer is running, but the installed producer cannot tell us how it
+    # spells that persona as a filename. Naming a path here would be a guess, and a guessed path fails
+    # as SILENCE. Say what is unknown and how to make it knowable.
+    _prod="inbox-monitor producer: RUNNING, but this hook cannot name the event stream for '$_persona' — the installed kijito-inbox-monitor ($_km_bin) does not answer --safe-persona, so the persona→filename rule is unresolved and any path printed here would be a guess. Upgrade the producer (that flag is how the rule is published), then re-open this session."
+  elif [ "$_rule" = no-producer ]; then
+    _prod="inbox-monitor producer: a producer process is running, but no kijito-inbox-monitor executable is on this PATH, so this hook cannot resolve where '$_persona''s events are written (set \$KIJITOMON_BIN if it lives somewhere unusual)."
+  elif [ -e "$_events" ]; then
+    _prod="inbox-monitor producer: UP for '$_persona' ($_sup; events → $_events)."
+  else
+    # The case that actually bit river on 2026-07-31: assay's producer was up, river's was not, and
+    # a host-global check would have called that UP and sent the agent off to tail a missing file.
+    # The path below came from the PRODUCER's own rule, so "does not exist" now means the stream is
+    # genuinely absent rather than that we spelled the name differently than the writer did.
+    _prod="inbox-monitor producer: a producer is running but NOT for '$_persona' — $_events does not exist, so YOUR mail is not being collected. Start one: $(
+      [ "$_sup" = launchd ] \
+        && printf 'launchctl kickstart -k gui/$(id -u)/com.kijito.inbox-monitor' \
+        || printf 'systemctl --user enable --now kijito-inbox-monitor@%s' "$_persona" )"
+  fi
+else
+  _prod="inbox-monitor producer: DOWN — no events will arrive until restarted: $(
+    [ "$_sup" = launchd ] \
+      && printf 'launchctl kickstart -k gui/$(id -u)/com.kijito.inbox-monitor' \
+      || printf 'systemctl --user enable --now kijito-inbox-monitor@%s' "${_persona:-<persona>}" )"
+fi
+
+# Catch-up reminder.
+cat <<EOF
+[SESSION CATCH-UP — do this BEFORE the user's task] $pre Start continuous, not cold:
+1) kijito_startup(persona, project) → read the current-state pointer it names (kijito_get) → skim recent lessons.
+2) ARM A WAKE-CAPABLE INBOX CONSUMER as your first action (see the INBOX WAKE block below) — do NOT skip it, do NOT use a bare tail.
+3) If this is a BRAND-NEW project with NO persona yet: read ./CLAUDE.md + ~/.claude/CLAUDE.md and set your persona/project before writing any memory.
+Never pause on a *feeling* of full context — run ~/.claude/myctx.sh for hard data.
+EOF
+
+# Inbox-wake arming block — exact, per-persona when the marker resolves, generic otherwise.
+# ── Idempotency (fixes the duplicate-monitor bug, river+argus 2026-07-02). The wake consumer is a
+# real `tail -n 0 -F …events.<persona>.ndjson` process that SURVIVES /clear + /compact (the session
+# continues), so a naive re-arm stacks duplicates that each fire every event. Detect an existing
+# consumer and INFORM — the hook can't know ownership (own-pre-clear vs a concurrent same-persona
+# sibling vs a leaked orphan; the stream is shared per-persona), so it defers the keep-vs-arm
+# decision to the agent's own task list and NEVER recommends a pattern-kill (a broad pkill on the
+# stream can kill a live sibling's or your own consumer — proven during argus's testing).
+#
+# ⚠️ The duplicate-detection pattern has to follow the LAYOUT too. Hardcoding `events\.<p>\.ndjson`
+# made this branch dead on every Linux seat: it could never match, so the hook always took the
+# "nothing is armed" path and told a returning session to arm again — re-introducing the very
+# duplicate-monitor bug this block was written to fix, on exactly the hosts where nobody was
+# looking for it. Match on the resolved events file's basename instead.
+_armed=""
+if [ -n "$_safe" ]; then
+  _evbase=$(basename "$_events")
+  # basename is a literal filename; escape the regex metacharacter it can contain (.) so a dot
+  # cannot match an arbitrary character and over-report.
+  _evpat=$(printf '%s' "$_evbase" | sed 's/\./\\./g')
+  _armed=$(pgrep -f "tail -n 0 -F.*${_evpat}" 2>/dev/null | tr '\n' ' ')
+fi
+
+if [ -n "$_safe" ] && [ -n "$_armed" ]; then
+cat <<EOF
+
+[INBOX WAKE — a consumer already tails your stream; do NOT blindly add another] One or more processes
+are already tailing $_events (pid(s): $_armed). This is EXPECTED after a /clear or /compact
+(your own persistent Monitor survives the reset). The hook can't tell whose it is, so decide from YOUR
+task list:
+  • You ALREADY have a live persistent inbox Monitor in your task list → keep it, do NOT arm another (a
+    2nd double-fires every event — the duplicate bug). If your task list shows MORE than one, TaskStop
+    all but one.
+  • You have NO inbox Monitor (brand-new session; the tail is a sibling's or a leaked orphan that will
+    NOT wake YOU) → arm exactly one for yourself:
+      Monitor(command="tail -n 0 -F $_events | grep --line-buffered -E '\"event\": ?\"(new|alert|recovered|state_corrupt|baseline_skipped|seed_ahead|replay_capped|persona_added)\"'", persistent=true)
+Dedupe with TaskStop (agent-scoped), NOT \`pkill -f …events…\` (that can kill a sibling's or your own live consumer). $_prod
+EOF
+elif [ -n "$_safe" ]; then
+cat <<EOF
+
+[INBOX WAKE — ARM AS YOUR FIRST ACTION, do not skip] An unmonitored mailbox is useless, and a bare
+background \`tail\` is CAPTURE-ONLY (it writes to a file and never re-invokes you, so you are NOT
+woken). Arm the wake-capable consumer with the Monitor TOOL (persistent) — it streams each event
+as a live notification. Your persona for this project is "$_persona":
+
+  Monitor(command="tail -n 0 -F $_events | grep --line-buffered -E '\"event\": ?\"(new|alert|recovered|state_corrupt|baseline_skipped|seed_ahead|replay_capped|persona_added)\"'", persistent=true)
+
+First confirm nothing is already monitoring that stream this session (avoid double-arming). $_prod
+EOF
+else
+cat <<EOF
+
+[INBOX WAKE — ARM AS YOUR FIRST ACTION, do not skip] An unmonitored mailbox is useless, and a bare
+background \`tail\` is CAPTURE-ONLY (it writes to a file and never re-invokes you, so you are NOT
+woken). Arm the wake-capable consumer for YOUR persona with the Monitor TOOL (persistent) — it
+streams each event as a live notification. Substitute your persona name for <persona>:
+
+  Monitor(command="tail -n 0 -F $_events_tmpl | grep --line-buffered -E '\"event\": ?\"(new|alert|recovered|state_corrupt|baseline_skipped|seed_ahead|replay_capped|persona_added)\"'", persistent=true)
+
+(No .kijito_persona marker found in this project — add a one-line \`.kijito_persona\` file with your
+persona name in the project root so this resolves automatically next session.) $_prod
+EOF
+fi
+
+# Armed auto-send (detached so it never blocks startup or pollutes the additionalContext above).
+if command -v lc_is_armed >/dev/null 2>&1 && [ -n "${TMUX:-}" ] && [ -n "${TMUX_PANE:-}" ] && lc_is_armed "$TMUX_PANE"; then
+  lc_log HOOK "src=$src autosend=ARMED pane=$TMUX_PANE"
+  _autosend="$_kjt_dir/session-autosend.sh"
+  [ -f "$_autosend" ] || _autosend="$HOME/.claude/session-autosend.sh"
+  nohup bash "$_autosend" "$TMUX_PANE" >/dev/null 2>&1 &
+else
+  command -v lc_log >/dev/null 2>&1 && lc_log HOOK "src=$src autosend=skip(not-armed-or-no-tmux) tmux=${TMUX:+y} pane=${TMUX_PANE:-none}"
+fi

package/providers/claude/scripts/statusline-context.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# Claude Code statusline — model name + accurate context-window usage.
+# Source of truth, in order:
+#   1) harness-provided context_window.* fields (if this CC version supplies them)
+#   2) fallback: compute from the transcript's API usage ledger — the same data
+#      /context is built on (sum input+cache_read+cache_creation of last asst turn).
+# Reads the statusline JSON on stdin; prints one line. ~tens of ms; never enters the model's context.
+input=$(cat)
+
+model=$(printf '%s' "$input" | jq -r '.model.display_name // "Claude"')
+
+# ── WHICH PANE AM I? (row M309) ──────────────────────────────────────────────────────────────────
+# On the first external onboarding call a test message "looked lost" for several minutes because two
+# people were watching the wrong terminal — "Wait, no, it's on the other one … it would be here
+# because this is the fable". A human running eight agent panes has NOTHING on screen saying which
+# persona each one is; the status line was the call's instant hit, so it is where that belongs.
+#
+# ⛔ THE MARKER IS READ THROUGH THE SHARED HELPER, NEVER RE-PARSED HERE. Re-implementing it is exactly
+# how row M290 happened: the hook's own copy deleted interior spaces, so `name (purpose)` silently
+# became a different persona. A third copy in the status line would drift the same way, and here it
+# would be worse — a status line that says the WRONG persona is a confident label on the wrong pane,
+# which is the very confusion this row exists to end.
+_sl_dir="$(dirname -- "${BASH_SOURCE[0]:-$0}")"
+persona=""
+if [ -r "$_sl_dir/kijito-persona-lib.sh" ]; then
+  # shellcheck source=/dev/null
+  . "$_sl_dir/kijito-persona-lib.sh"
+  # The statusline JSON carries the pane's cwd; prefer it over $PWD, which is this script's.
+  _sl_cwd=$(printf '%s' "$input" | jq -r '.workspace.current_dir // .cwd // empty')
+  persona=$(kijito_persona_from_marker "${CLAUDE_PROJECT_DIR:-}" "$_sl_cwd" "$PWD" || true)
+fi
+
+# 1) Prefer harness-computed context window if present
+used=$(printf '%s' "$input" | jq -r '.context_window.used_tokens // empty')
+win=$(printf '%s'  "$input" | jq -r '.context_window.total_tokens // empty')
+
+# 2) Fallback: ground-truth from the transcript usage ledger
+if [ -z "$used" ]; then
+  tp=$(printf '%s' "$input" | jq -r '.transcript_path // empty')
+  if [ -n "$tp" ] && [ -f "$tp" ]; then
+    used=$(jq -s 'map(select(.type=="assistant" and .message.usage != null) | .message.usage) | last // {}
+                  | (.input_tokens // 0) + (.cache_read_input_tokens // 0) + (.cache_creation_input_tokens // 0)' \
+          "$tp" 2>/dev/null)
+  fi
+fi
+[ -z "$used" ] && used=0
+[ -z "$win"  ] && win=1000000
+
+pct=$(awk -v u="$used" -v w="$win" 'BEGIN { if (w>0) printf "%.0f", (u/w)*100; else print 0 }')
+uk=$(awk  -v u="$used" 'BEGIN { if (u>=1000) printf "%.0fk", u/1000; else printf "%d", u }')
+wk=$(awk  -v w="$win"  'BEGIN { if (w>=1000000) printf "%gm", w/1000000; else printf "%.0fk", w/1000 }')
+
+# refresh-before-70 discipline: green <60, yellow 60-79, red >=80
+col=$(awk -v p="$pct" 'BEGIN { if (p>=80) printf "\033[31m"; else if (p>=60) printf "\033[33m"; else printf "\033[32m" }')
+# ⚠️ THE PERSONA GOES FIRST AND IS TRUNCATED, NOT THE CONTEXT FIGURE. The figure is what people were
+# already watching; a long persona must never push it off a narrow terminal. 18 chars fits
+# "name (purpose)"-shaped names, which is what real users type.
+if [ -n "$persona" ]; then
+  printf '\033[36m%s\033[0m · ' "$(kijito_truncate "$persona" 18)"
+fi
+# ROW M291: the heartbeat watchdog raises this flag when this pane's persona has unread wake events
+# in its stream and NO consumer reading it (typically after a usage-limit outage ended the loop). It
+# is the one place a human watching the pane will see it; the watchdog removes it on re-arm.
+if [ -n "${TMUX_PANE:-}" ] && [ -f "${KIJITO_LC_DIR:-$HOME/.claude/.lifecycle}/unconsumed.$TMUX_PANE" ]; then
+  printf '\033[31m⚠ inbox deaf\033[0m · '
+fi
+printf '%s · ctx %b%s/%s (%s%%)\033[0m' "$model" "$col" "$uk" "$wk" "$pct"