muonroi-cli 1.8.4 → 1.9.0

package/dist/src/ee/extract-style.js

@@ -0,0 +1,270 @@
+// src/ee/extract-style.ts
+//
+// Personality / working-style extraction — the WRITE arm that CLOSES the who-am-i loop.
+//
+// The READ arm (who-am-i-brain.ts) derives a WhoAmIProfile from the `experience-behavioral`
+// brain: it searches the user's accumulated style rules and classifies them into dims that
+// the PIL layers read. But on a thin-client NOTHING was feeding that collection with style
+// signals mined from the user's OWN muonroi-cli sessions — the general server extract
+// (`extractFromSession`) only mines TECHNICAL mistakes/lessons (detectExperience → extractQA),
+// never "the user prefers concise answers / rejects hand-holding / decides fast". So the loop
+// was open: who-am-i could only read rules the user hand-authored or the Claude Code Stop hook
+// happened to capture.
+//
+// This module runs at session-end (alongside extractSession) and mines the transcript for the
+// USER's working-style, writing each high-confidence signal as a natural-language behavioral
+// rule into `experience-behavioral` via writeExperienceEE. Next session, who-am-i-brain reads
+// those rules back and classifies them into dims → the loop is closed.
+//
+// Design guarantees:
+//   • Agent-first (no keyword regex): the transcript→style mapping is decided by the brain LLM
+//     (classifyViaBrain), honouring the repo rule that classification is never regex. The only
+//     regex here is tolerant JSON extraction from the LLM reply.
+//   • Natural-language interface (NOT a shared enum): the WRITE side emits plain style
+//     sentences; the READ side (who-am-i-brain) re-classifies them with its own DIM_VOCAB.
+//     Neither side imports the other's vocabulary — so there is no cross-module enum coupling
+//     to drift (contrast the EE-side DIM_VOCAB lockstep this deliberately avoids).
+//   • Anti-pollution: experience-behavioral also drives passive hint injection, so a wrong or
+//     low-confidence guess is actively harmful (it feeds who-am-i AND every passive hint). We
+//     gate HARD — high confidence floor, length bounds, a small per-session cap, and a stable
+//     per-signal title so repeated sessions MERGE instead of accreting near-duplicates.
+//   • Fail-open: any gap (classifier null, unparseable output, dep throws, EE down) writes
+//     nothing and never throws. Style converges over many sessions; missing one is harmless.
+/** The collection who-am-i-brain reads back — keep in lockstep with BEHAVIORAL_COLLECTION there. */
+const BEHAVIORAL_COLLECTION = "experience-behavioral";
+/**
+ * Only signals at/above this confidence are written. High on purpose: a style rule that lands
+ * in experience-behavioral influences who-am-i AND passive hints, so a confident-but-wrong
+ * guess is worse than silence. The brain self-reports confidence per the prompt contract.
+ */
+const STYLE_WRITE_MIN_CONFIDENCE = 0.7;
+/** At most this many style rules per session — style is slow-moving; a burst is almost always noise. */
+const MAX_STYLE_RULES_PER_SESSION = 3;
+/** A style rule shorter than this is too vague to guide anything; longer than this is task prose leaking in. */
+const MIN_RULE_CHARS = 15;
+const MAX_RULE_CHARS = 240;
+/**
+ * Off the hot path (fire-and-forget at session-end), so a wide budget. The server's strong
+ * brainExtractModel is a reasoning model (deepseek-v4-flash) whose think+emit cycle runs
+ * ~4-10s on this transcript-sized prompt (verified live). 20s clears the tail; it never blocks
+ * anything (background). Mirrors who-am-i-brain's budget.
+ */
+const STYLE_CLASSIFY_TIMEOUT_MS = 20000;
+/**
+ * The rules JSON itself is tiny (~150 tokens), but the server's extract model
+ * (deepseek-v4-flash) is a REASONING model — its thinking tokens count against this same
+ * budget and land in a separate reasoning_content field, NOT the JSON. A tight cap (500) let
+ * the reasoning consume the whole budget and truncate the actual JSON to empty → intermittent
+ * zero-rule results (verified live: identical input gave 3 rules then 0). Give thinking ample
+ * headroom so the JSON always survives; the extra tokens are only spent when the model
+ * actually reasons, and this is an off-hot-path background call.
+ */
+const STYLE_CLASSIFY_MAX_TOKENS = 3000;
+/**
+ * System-prompt override — REQUIRED, same reason as who-am-i-brain: the EE brain proxy's
+ * default system prompt is a tier-classifier ("output ONE word … ignore content") that
+ * hijacks structured output into garbage. Verified on the live VPS (2026-07-05).
+ */
+const STYLE_SYSTEM_PROMPT = "You mine a developer's WORKING STYLE from a session transcript — how they prefer to " +
+    "communicate, decide, delegate, receive feedback, and handle risk. Follow the user " +
+    "message instructions EXACTLY and output ONLY the requested JSON object. Do not classify " +
+    "task complexity, do not output single words, do not add prose before or after the JSON.";
+/** Feature flag — default ON, opt out with MUONROI_STYLE_EXTRACT=0. */
+export function isStyleExtractEnabled() {
+    return process.env.MUONROI_STYLE_EXTRACT !== "0";
+}
+/**
+ * PURE: build the style-mining prompt. Asks the brain to emit 0..N natural-language style
+ * rules about the USER (never the task), each standalone and reusable as future guidance,
+ * with a self-reported confidence. Emitting NOTHING when the transcript shows no clear style
+ * is explicitly the right answer — we would rather miss a session than pollute the brain.
+ */
+export function buildStyleExtractPrompt(transcript) {
+    return [
+        "From the session transcript below, extract DURABLE signals about the DEVELOPER's working",
+        "style — not the task, not the code. Look for how they prefer to communicate (concise vs",
+        "detailed), decide (fast/intuitive vs deliberate), delegate (autonomous vs collaborative),",
+        "receive feedback (blunt correction vs gentle), and tolerate risk.",
+        "",
+        "Output ONLY a JSON object of the form:",
+        '{"rules": [{"rule": "<one imperative sentence of durable style guidance>", "confidence": 0.0-1.0}]}',
+        "",
+        "Rules:",
+        '- Each `rule` must be a standalone, reusable instruction (e.g. "The user prefers concise',
+        '  answers — skip preamble and lead with the recommendation."). NOT a fact about this task.',
+        "- Emit a signal ONLY when the transcript gives clear, repeated evidence. When in doubt, omit it.",
+        "- An EMPTY array is the correct answer for a task-only session with no style signal.",
+        "- Never invent a preference the transcript does not actually demonstrate.",
+        "- confidence reflects how strongly the transcript supports the rule.",
+        "",
+        "Transcript:",
+        transcript,
+    ].join("\n");
+}
+/**
+ * PURE: coerce a brain reply (JSON string, fenced block, or already-parsed object) into a
+ * gated list of style rules. Applies the confidence floor, length bounds, dedup by normalized
+ * text, and the per-session cap. Returns [] when nothing usable survives (fail-open).
+ */
+export function parseStyleRules(raw) {
+    let obj = raw;
+    if (typeof raw === "string") {
+        const json = extractJsonObject(raw);
+        if (!json)
+            return [];
+        try {
+            obj = JSON.parse(json);
+        }
+        catch {
+            return [];
+        }
+    }
+    if (!obj || typeof obj !== "object")
+        return [];
+    const arr = obj.rules;
+    if (!Array.isArray(arr))
+        return [];
+    const seen = new Set();
+    const out = [];
+    for (const item of arr) {
+        if (!item || typeof item !== "object")
+            continue;
+        const rule = typeof item.rule === "string" ? item.rule.trim() : "";
+        const confidence = Number(item.confidence);
+        if (!rule || !Number.isFinite(confidence))
+            continue;
+        if (confidence < STYLE_WRITE_MIN_CONFIDENCE)
+            continue;
+        if (rule.length < MIN_RULE_CHARS || rule.length > MAX_RULE_CHARS)
+            continue;
+        const norm = rule.toLowerCase().replace(/\s+/g, " ");
+        if (seen.has(norm))
+            continue;
+        seen.add(norm);
+        out.push({ rule, confidence });
+        if (out.length >= MAX_STYLE_RULES_PER_SESSION)
+            break;
+    }
+    return out;
+}
+/** Tolerantly extract the first balanced JSON object from an LLM reply. */
+function extractJsonObject(text) {
+    const start = text.indexOf("{");
+    if (start === -1)
+        return null;
+    let depth = 0;
+    let inStr = false;
+    let esc = false;
+    for (let i = start; i < text.length; i++) {
+        const ch = text[i];
+        if (inStr) {
+            if (esc)
+                esc = false;
+            else if (ch === "\\")
+                esc = true;
+            else if (ch === '"')
+                inStr = false;
+            continue;
+        }
+        if (ch === '"')
+            inStr = true;
+        else if (ch === "{")
+            depth++;
+        else if (ch === "}") {
+            depth--;
+            if (depth === 0)
+                return text.slice(start, i + 1);
+        }
+    }
+    return null;
+}
+/**
+ * PURE: a stable title for a style rule so repeated sessions MERGE server-side instead of
+ * accreting near-duplicates. Derived deterministically from the rule text (lowercased, first
+ * few significant words) — same recurring preference → same title → storeImportedExperience
+ * can collapse them. Marked with a "user-style:" prefix so the entries are identifiable and
+ * prunable as a class.
+ */
+export function styleRuleTitle(rule) {
+    const words = rule
+        .toLowerCase()
+        .replace(/[^a-z0-9\s]/g, " ")
+        .split(/\s+/)
+        .filter((w) => w.length > 3 && !STOPWORDS.has(w))
+        .slice(0, 5)
+        .join("-");
+    return `user-style:${words || "general"}`;
+}
+const STOPWORDS = new Set([
+    "the",
+    "user",
+    "prefers",
+    "wants",
+    "with",
+    "that",
+    "this",
+    "they",
+    "them",
+    "their",
+    "when",
+    "into",
+    "over",
+    "from",
+    "answers",
+    "answer",
+    "reply",
+    "replies",
+]);
+/**
+ * Classify the transcript into gated style rules. Fail-open []: a degraded brain must never
+ * break session teardown.
+ */
+export async function extractStyleSignals(deps, transcript) {
+    try {
+        if (!transcript || transcript.trim().length < 100)
+            return [];
+        const reply = await deps.classifyViaBrain(buildStyleExtractPrompt(transcript), STYLE_CLASSIFY_TIMEOUT_MS, {
+            systemPrompt: STYLE_SYSTEM_PROMPT,
+            responseFormat: { type: "json_object" },
+            maxTokens: STYLE_CLASSIFY_MAX_TOKENS,
+            // Structured multi-signal extraction needs the server's stronger brainExtractModel;
+            // the hot-path model is too weak (verified on the live VPS for the READ side too).
+            useExtractModel: true,
+        });
+        if (!reply)
+            return [];
+        return parseStyleRules(reply);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * End-to-end WRITE arm: mine style rules from the transcript and persist each to
+ * experience-behavioral. Returns the number written. Fire-and-forget from extractSession —
+ * fail-open, never throws. `projectSlug` scopes the rule; confidence carries through so the
+ * brain can weight it.
+ */
+export async function writeStyleSignals(deps, transcript, opts = {}) {
+    if (!isStyleExtractEnabled())
+        return 0;
+    const rules = await extractStyleSignals(deps, transcript);
+    let written = 0;
+    for (const r of rules) {
+        try {
+            const res = await deps.writeExperience(r.rule, {
+                collection: BEHAVIORAL_COLLECTION,
+                title: styleRuleTitle(r.rule),
+                projectSlug: opts.projectSlug,
+                confidence: r.confidence,
+            });
+            if (res.ok)
+                written++;
+        }
+        catch {
+            // fail-open per rule — one bad write must not abort the rest
+        }
+    }
+    return written;
+}
+//# sourceMappingURL=extract-style.js.map

package/dist/src/ee/recall-ledger.d.ts

@@ -24,6 +24,15 @@ export interface RecallLedger {
     clear(id: string): boolean;
     /** Check if an id was ever cleared (fed back) in this session. Used by PIL Layer 3 to suppress re-injection. */
     wasCleared(id: string): boolean;
+    /**
+     * Check if an id is currently PENDING (recorded as unrated debt, not yet fed
+     * back). PIL Layer 3 uses this to suppress re-injecting the FULL content of a
+     * hint it already surfaced earlier this session — the hit is already in the
+     * conversation history and still listed in the feedback nudge, so repeating
+     * its body every turn is pure token waste (the "hint lặp" repetition). First
+     * sighting is injected + recorded; subsequent turns skip the body.
+     */
+    isPending(id: string): boolean;
     /** Oldest-first list of still-unrated recalls. */
     pending(): PendingRecall[];
     pendingCount(): number;

package/dist/src/ee/recall-ledger.js

@@ -45,6 +45,9 @@ export function createRecallLedger() {
         wasCleared(id) {
             return cleared.has(String(id ?? "").trim());
         },
+        isPending(id) {
+            return map.has(String(id ?? "").trim());
+        },
         pending() {
             return [...map.values()].sort((a, b) => a.ts - b.ts);
         },

package/dist/src/ee/scope.d.ts

@@ -1,4 +1,5 @@
 import type { Scope } from "./types.js";
+export declare function sanitizeRemoteUrl(remoteUrl: string): string;
 export declare function buildScope(opts: {
     cwd: string;
 }): Promise<Scope>;

package/dist/src/ee/scope.js

@@ -42,6 +42,30 @@ async function findGitRoot(start) {
     }
     return null;
 }
+export function sanitizeRemoteUrl(remoteUrl) {
+    const trimmed = remoteUrl.trim();
+    // If it starts with a scheme like http://, https://, ssh://, git:// etc.
+    if (/^[a-zA-Z0-9+-.]+:\/\//.test(trimmed)) {
+        try {
+            const parsed = new URL(trimmed);
+            if (parsed.protocol === "http:" ||
+                parsed.protocol === "https:" ||
+                parsed.protocol === "git+http:" ||
+                parsed.protocol === "git+https:") {
+                parsed.username = "";
+                parsed.password = "";
+            }
+            return parsed.toString();
+        }
+        catch {
+            // Fallback for valid scheme prefix but invalid URL syntax
+            return trimmed.replace(/^([^:]+:\/\/)[^@]+@/, "$1");
+        }
+    }
+    // Prevent parsing exceptions on SSH remotes (e.g. git@github.com:...)
+    // SCP-like SSH remotes do not start with a scheme + "://"
+    return trimmed;
+}
 export async function buildScope(opts) {
     if (cached && cachedFor === opts.cwd)
         return cached;
@@ -53,7 +77,8 @@ export async function buildScope(opts) {
     }
     const head = await fs.readFile(path.join(root, ".git", "HEAD"), "utf8").catch(() => "");
     const cfg = await fs.readFile(path.join(root, ".git", "config"), "utf8").catch(() => "");
-    const { remote } = parseGitConfig(cfg);
+    const { remote: rawRemote } = parseGitConfig(cfg);
+    const remote = rawRemote ? sanitizeRemoteUrl(rawRemote) : undefined;
     const { branch } = parseHEAD(head);
     // Ecosystem detection — check if remote matches any configured pattern
     if (remote) {

package/dist/src/ee/search.d.ts

@@ -76,6 +76,13 @@ export interface FeedbackResult {
     verdict?: string;
     reason?: string;
     error?: string;
+    /**
+     * True when the brain was unreachable/transient and the verdict was durably
+     * enqueued for later delivery instead of lost. Callers treat this as success
+     * (the agent discharged its rating) and clear their recall ledger so the
+     * mandatory-rating gate cannot loop while the brain is down.
+     */
+    queued?: boolean;
 }
 /**
  * Record an agent verdict on a recalled `[id col]` entry, byte-for-byte matching

package/dist/src/ee/search.js

@@ -173,6 +173,13 @@ export async function feedbackEE(pointId, collection, verdict, reason) {
             /* non-JSON error body — fall through to status-based handling */
         }
         if (!res.ok) {
+            // Transient server-side failures (5xx / rate limit / timeout) must not lose
+            // the verdict OR block the agent: queue it for later delivery. Hard client
+            // errors (bad collection, unknown id) are the caller's fault — surface them.
+            const transient = res.status >= 500 || res.status === 429 || res.status === 408;
+            if (transient && (await tryEnqueueFeedback(body))) {
+                return { ok: true, resolvedId: pointId, verdict: wire, reason, queued: true };
+            }
             return { ok: false, error: json?.error || text || `HTTP ${res.status}` };
         }
         const resolvedId = json?.resolvedId || pointId;
@@ -182,9 +189,26 @@ export async function feedbackEE(pointId, collection, verdict, reason) {
     catch (err) {
         const { logEeFailure, classifyEeError } = await import("../utils/ee-logger.js");
         logEeFailure("search.feedbackEE", classifyEeError(err), err);
+        // Network-level failure (brain down, socket drop) — durably queue so the
+        // verdict survives and the agent's rating gate does not loop. Only report a
+        // hard failure if even the enqueue fails.
+        if (await tryEnqueueFeedback(body)) {
+            return { ok: true, resolvedId: pointId, verdict: wire, reason, queued: true };
+        }
         return { ok: false, error: err instanceof Error ? err.message : String(err) };
     }
 }
+/** Enqueue a /api/feedback body to the offline queue; false if enqueue itself fails. */
+async function tryEnqueueFeedback(body) {
+    try {
+        const { enqueue } = await import("./offline-queue.js");
+        await enqueue({ endpoint: "/api/feedback", body, enqueuedAt: Date.now() });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Mirror a feedback verdict as a LOCAL `op:'feedback'` activity row (parity with
  * mirrorRecallLocally's `op:'recall'`). Lets the session-end nudge + forensics

package/dist/src/ee/transcript-emit.js

@@ -23,6 +23,8 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 function experienceRoot() {
+    if (process.env.MUONROI_EXPERIENCE_ROOT_OVERRIDE)
+        return process.env.MUONROI_EXPERIENCE_ROOT_OVERRIDE;
     return path.join(os.homedir(), ".experience");
 }
 function emitRoot() {

package/dist/src/ee/types.d.ts

@@ -125,6 +125,11 @@ export interface RouteModelRequest {
         projectSize?: "small" | "medium" | "large";
         filesTouched?: number;
         mode?: string;
+        turnIndex?: number;
+        messageCount?: number;
+        compactionCount?: number;
+        totalSavedTokens?: number;
+        compactionSummary?: string;
     };
     runtime?: "claude" | "gemini" | "codex" | "opencode";
 }
@@ -357,6 +362,15 @@ export interface EERecallOptions {
     /** Override per-call timeout. Defaults to 15000ms — server bounds recall at ~8s internally; allow margin for embed + 3-leg search + network. */
     timeoutMs?: number;
     signal?: AbortSignal;
+    /**
+     * Council stance/role for per-stance recall weighting (Sprint-2 item 3). The
+     * server weights the recall collections toward the knowledge this stance cares
+     * about (researcher → principles, implementer → behavioral, verifier →
+     * self-QA). Unknown/absent stance is a no-op server-side.
+     */
+    stance?: string;
+    /** Alias for stance; forwarded as body.role. Either resolves the same weights. */
+    role?: string;
 }
 export interface EEUserResponse {
     user: string;
@@ -374,6 +388,14 @@ export interface BrainProxyOptions {
     maxTokens?: number;
     /** Override the brain provider (siliconflow | ollama | openai | ...). */
     provider?: string;
+    /**
+     * Ask the server to use its stronger `brainExtractModel` (structured-extraction
+     * model) instead of the hot-path `brainModel`. Zero-hardcode by design: the client
+     * sends only this flag, the server resolves the model id from its own config + key.
+     * Used by the thin-client WhoAmI brain fallback, where the weak default model
+     * mis-spells the dim vocabulary. Ignored by servers that don't recognise it.
+     */
+    useExtractModel?: boolean;
 }
 export interface EEClient {
     health(): Promise<{

package/dist/src/ee/who-am-i-brain.d.ts

@@ -0,0 +1,35 @@
+import { type PrivacyLevel, type WhoAmIProfile } from "./who-am-i.js";
+/** Feature flag — default ON, opt out with MUONROI_WHOAMI_BRAIN=0. */
+export declare function isBrainWhoAmIEnabled(): boolean;
+/**
+ * PURE: build the classify prompt. Asks the brain to distil the retrieved rules into
+ * a strict dims JSON using only the allowed names + vocabulary. Emitting fewer dims
+ * (only the confident ones) is explicitly encouraged — downstream drops the rest.
+ */
+export declare function buildStyleClassifyPrompt(rules: string[]): string;
+/**
+ * PURE: coerce a brain reply (JSON string, fenced block, or already-parsed object)
+ * into a privacy-gated WhoAmIProfile. Reuses selectWhoAmIDims for the allowlist +
+ * confidence floor. Returns null when nothing usable survives.
+ */
+export declare function parseBrainProfile(raw: unknown, level?: PrivacyLevel): WhoAmIProfile | null;
+export interface BrainWhoAmIDeps {
+    searchByText: (text: string, collections: string[], topK: number) => Promise<Array<{
+        payload?: {
+            text?: string;
+        };
+    }>>;
+    classifyViaBrain: (prompt: string, timeoutMs?: number, options?: {
+        systemPrompt?: string;
+        responseFormat?: {
+            type: string;
+        };
+        maxTokens?: number;
+        useExtractModel?: boolean;
+    }) => Promise<string | null>;
+}
+/**
+ * Derive a WhoAmIProfile from the behavioral brain. Search the user's style rules →
+ * classify them into dims via the brain LLM → privacy-gate locally. Fail-open null.
+ */
+export declare function deriveWhoAmIFromBrain(deps: BrainWhoAmIDeps, level?: PrivacyLevel): Promise<WhoAmIProfile | null>;