liteagents 2.8.2 → 2.9.0

package/CHANGELOG.md

@@ -17,6 +17,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [2.9.0] - 2026-05-26
+
+Redesign of the `/friction` → `/remember` memory pipeline so friction stops poisoning hot memory and antigens come from what the user actually said. Applied identically across all four tool packages (claude, opencode, ampcode, droid).
+
+### Changed
+- **`/friction` now seeds antigens from observed user reactions, not machine proxies.** Antigen candidates are anchored only on real user reactions (corrections, curses, interrupts); inferred signals survive only as corroborating severity. Clustering is by what the user *said* (content/phrase overlap) instead of `(signal, tool_pattern)`, and recurrence × severity drives a `suggested_artifact` — only patterns recurring across 5+ sessions are meant to load into hot memory. On a 253-session corpus this took false hot preferences from 15 → 0.
+- **`/remember` rewritten to consolidate from friction's short quotes, never raw logs.** It classifies each reaction's target (agent vs. self), drops self-corrections, semantically merges paraphrases that lexical clustering left split, and tiers antigens by recurrence. The generated `MEMORY.md` section is renamed `Preferences` → `Antigens` (High loads hot / Medium recorded / Low = episode).
+
+### Fixed
+- **Terminal pastes are no longer mistaken for friction.** Pasted SSH/shell dumps (prompt lines like `> sudo …` and `root@host:~#`, command output) were captured as user reactions, polluting antigen keywords with shell vocabulary (`postconf`, `qemu`). They are now detected and excluded from both signal detection and keyword extraction, while genuine short corrections that merely mention a command are preserved.
+- **Profanity only counts when it's aimed at the agent.** Narrative/rhetorical curses ("does anyone search any shit?", a pasted reddit story) no longer raise a `user_curse` signal; a curse is kept only in a short reaction turn or when an agent-directed word sits next to it.
+- **Self-corrections are now surfaced to the consolidation step.** The `self_suspect` hint ("wrong project", "nevermind") is propagated from candidate to cluster and rendered in `antigen_review.md`, so `/remember` is told to confirm agent-vs-self target before treating a cluster as an antigen.
+
+### Removed
+- Dead scaffolding left over from the redesign in `friction.js`: the unused `overlap()` helper, the `MIN_KW`/`MIN_INTER` constants, the unread `selfCount` counter (superseded by the `anySelf` flag), and the always-empty `top_files` field with its unreachable renderer block.
+
+---
+
+## [2.8.3] - 2026-05-24
+
+### Security
+- **Path containment uses a boundary match.** `installer/path-manager.js` confined installs to the home directory via `startsWith(homeDir)`, which would also accept a sibling like `${homeDir}-evil`. Now matches on a path separator (`=== homeDir || startsWith(homeDir + path.sep)`), and likewise for the temp dir. Defense-in-depth for a local installer; verified install/backup/uninstall still work.
+
+### Changed
+- **`docs/INSTALLER_GUIDE.md` custom-path docs now match the installer.** It advertised `/opt/...`, `/mnt/...`, and team/external locations, but the installer confines paths to the home directory (or temp dir). Documented the real rule and corrected the examples.
+- Removed decorative emoji from `README.md` headings (kept the friction traffic-light indicators).
+- CI: bumped `actions/checkout` and `actions/setup-node` to v6 (Node 24) ahead of the June 2026 Node 20 deprecation.
+
+---
+
 ## [2.8.2] - 2026-05-24
 
 Maintenance release: removes the last of the legacy 3-variant system, fixes the broken `liteag` alias and post-install message, and trims the shipped documentation down to the README plus an accurate installer guide. No changes to the installed agents/commands/skills.

package/README.md

@@ -28,7 +28,7 @@ Specialized AI agents and workflow commands for product management, agile develo
 
 ---
 
-## 🚀 Quick Start
+## Quick Start
 
 ```bash
 # Option 1: NPX (recommended)
@@ -71,7 +71,7 @@ liteagents
 
 ---
 
-## 🧠 Hot Memory — project-local learning from your own sessions
+## Hot Memory — project-local learning from your own sessions
 
 Liteagents ships a three-command pipeline that turns Claude Code's session logs into project-local memory. No databases, no external services, just markdown files the assistant reads via `@MEMORY.md`.
 
@@ -95,7 +95,7 @@ Per-Project:
 WORST: my-app/0203-1630-11eb903a  peak=225  turns=127
 BEST:  web-client/0202-2121-8d8608e1  peak=0  turns=4
 
-Verdict: ✓ USEFUL    Intervention predictability: 93%
+Verdict: USEFUL    Intervention predictability: 93%
 ```
 
 Results land in `.claude/friction/antigen_review.md` with projects, error patterns, and offending tool sequences called out per cluster — so `/remember` can pick them up and encode them as rules the next session sees.
@@ -104,7 +104,7 @@ Results land in `.claude/friction/antigen_review.md` with projects, error patter
 
 ---
 
-## 🤖 What's Included
+## What's Included
 
 ### 11 Agents
 
@@ -132,7 +132,7 @@ Results land in `.claude/friction/antigen_review.md` with projects, error patter
 
 **Manual Skills/Commands (20):**
 
-*Hot Memory Pipeline (3)* — see the [🧠 Hot Memory](#-hot-memory--project-local-learning-from-your-own-sessions) section above for the full walkthrough:
+*Hot Memory Pipeline (3)* — see the [Hot Memory](#hot-memory--project-local-learning-from-your-own-sessions) section above for the full walkthrough:
 - **stash** - Snapshot session context to `.claude/stash/` before compaction, handoff, or ending complex work
 - **friction** - Analyze all JSONL sessions for frustration signals, cluster failures per project, surface antigens
 - **remember** - Consolidate stashes + friction antigens into `.claude/memory/MEMORY.md`; auto-injected via `@MEMORY.md`
@@ -162,7 +162,7 @@ Results land in `.claude/friction/antigen_review.md` with projects, error patter
 
 ---
 
-## 📖 Documentation
+## Documentation
 
 | Document | Description |
 |----------|-------------|
@@ -171,7 +171,7 @@ Results land in `.claude/friction/antigen_review.md` with projects, error patter
 
 ---
 
-## 💡 Example Workflows
+## Example Workflows
 
 **Feature Development:**
 ```
@@ -198,7 +198,7 @@ Results land in `.claude/friction/antigen_review.md` with projects, error patter
 
 ---
 
-## 📊 Stats
+## Stats
 
 - **11** Specialized Agents
 - **22** Workflow Commands & Skills
@@ -207,7 +207,7 @@ Results land in `.claude/friction/antigen_review.md` with projects, error patter
 
 ---
 
-## 🔗 Links
+## Links
 
 - **npm:** https://www.npmjs.com/package/liteagents
 - **GitHub:** https://github.com/hamr0/liteagents
@@ -215,7 +215,7 @@ Results land in `.claude/friction/antigen_review.md` with projects, error patter
 
 ---
 
-## 📄 License
+## License
 
 Apache-2.0 © 2026 hamr0 — see [LICENSE](LICENSE).
 

package/installer/path-manager.js

@@ -58,8 +58,9 @@ class PathManager {
       const homeDir = this.homeDir;
       const tmpDir = os.tmpdir();
 
-      const isInHome = sanitized.startsWith(homeDir);
-      const isInTmp = sanitized.startsWith(tmpDir);
+      // Match on a path boundary so a sibling like `${homeDir}-evil` can't pass.
+      const isInHome = sanitized === homeDir || sanitized.startsWith(homeDir + path.sep);
+      const isInTmp = sanitized === tmpDir || sanitized.startsWith(tmpDir + path.sep);
 
       if (!isInHome && !isInTmp) {
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "liteagents",
-  "version": "2.8.2",
+  "version": "2.9.0",
   "description": "AI development toolkit with 11 specialized agents and 23 commands including live-canvas UI design with click-to-annotate feedback. Simple one-question installer for Claude, Opencode, Ampcode, and Droid.",
   "main": "index.js",
   "bin": {