neurastream 0.1.4 → 0.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neurastream",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Harness-agnostic agent orchestration: queue, guards, blockers, scoring, ledger.",
   "type": "module",
   "license": "MIT",

package/src/adapters/omp/doctor.ts

@@ -36,9 +36,13 @@ export function adapterLiveFiles(home: string, root: string = PACKAGE_ROOT): Liv
 	for (const bin of packageBins(root)) {
 		files.push({ live: join(home, ".local/bin", bin.name), source: bin.source });
 	}
+	// P9: the extension symlink is gone (ONE load route — the plugin below);
+	// what the adapter installs under the agent dir is the omp plugin link,
+	// whose realpath is an installed neurastream package root. `omp plugin
+	// link` owns this file; install must never ensureLink it.
 	files.push({
-		live: join(home, ".omp/agent/extensions/neurastream.ts"),
-		source: join(root, "src/adapters/omp/index.ts"),
+		live: join(home, ".omp/plugins/node_modules/neurastream"),
+		source: root,
 	});
 	files.push({
 		live: join(home, ".omp/agent/queue/lib.ts"),
@@ -68,8 +72,10 @@ function bunLiveFiles(home: string, root: string): LiveFile[] {
 }
 
 function packageRootOf(file: string): string | null {
-	let dir = dirname(file);
-	for (let i = 0; i < 8; i++) {
+	// `file` itself may be the package root (the omp plugin link's realpath is
+	// an installed neurastream root), so the self dir is checked first.
+	let dir = file;
+	for (let i = 0; i < 9; i++) {
 		const manifest = join(dir, "package.json");
 		if (existsSync(manifest)) {
 			try {

package/src/adapters/omp/index.ts

@@ -20,11 +20,13 @@ import { appendFileSync, mkdirSync, openSync, readFileSync, rmSync, statSync, wr
 import { join } from "node:path";
 import type { Decision } from "../../core/adapter.ts";
 import { loadConfig, type Config } from "../../core/config.ts";
-import { checkInject, checkPlanEdit, checkStop, checkTool, recordMainResult } from "../../core/guards.ts";
+import { checkInject, checkPlanEdit, checkStop, checkTool, MAIN_PLAN_FILE, recordMainResult } from "../../core/guards.ts";
 import { applyQueueEnv } from "../../core/queue/env.ts";
 import { mainStartText } from "../../core/main-start.ts";
 import { buildHandoff, holdsBlock, notePath, noteRequest, type RolloverState, rolloverState } from "../../core/rollover.ts";
 import * as q from "../../core/queue/lib.ts";
+// Registers the plugin-command matcher into core's writeTargets (side effect).
+import "./package-ops.ts";
 
 /** Subset of the harness extension host the adapter needs (pi.on; herdr also uses pi.events). */
 export interface ExtensionHost {
@@ -86,11 +88,14 @@ function adapterLog(cfg: Config, line: string): void {
 // Background queue-close for every plan Main marked complete (owner 2026-10-15). Ported from the
 // original autoClose: same filter, same "--- auto-close attempt" log line, detached child with
 // stdio on the per-plan close log. QUEUE_CLOSE_BIN overrides the binary (tests); without it the
-// package's own CLI runs via the current bun binary, so no PATH lookup is needed.
+// package's own executable bin/queue-close runs (its `#!/usr/bin/env bun` shebang picks bun).
+// Never process.execPath: inside the harness that is the harness binary itself, so the child was
+// a new agent session that loaded this plugin and auto-closed again — a process fork bomb
+// (2026-10-21 OOMs, ~175 processes).
 function closeChildArgs(plan: string): [string, string[]] {
 	const bin = process.env.QUEUE_CLOSE_BIN;
 	if (bin) return [bin, [plan]];
-	return [process.execPath, [join(import.meta.dir, "..", "..", "cli", "main.ts"), "queue-close", plan]];
+	return [join(import.meta.dir, "..", "..", "..", "bin", "queue-close"), [plan]];
 }
 
 export function autoClose(cfg: Config): string[] {
@@ -134,7 +139,6 @@ function ledgerText(cfg: Config): string {
 
 // Plan files a subagent write/edit may touch: snapshot before the call so tool_result can verify
 // and restore (the original snapshotted inside checkCall; core returns pure decisions now).
-const MAIN_PLAN = /\/docs\/plans\/(?!archive\/)[^/]+\.md$/;
 function snapshotPlans(tool: string, input: Record<string, unknown>, cwd: string, snap: Map<string, string>, main: boolean): void {
 	if (tool !== "write" && tool !== "edit") return;
 	const plans = q.activePlans();
@@ -142,7 +146,7 @@ function snapshotPlans(tool: string, input: Record<string, unknown>, cwd: string
 		if (snap.has(p)) continue;
 		if (main) {
 			// Main's own plan text is checked too; a plan that did not exist yet snapshots as "".
-			if (!MAIN_PLAN.test(p)) continue;
+			if (!MAIN_PLAN_FILE.test(p)) continue;
 			try {
 				snap.set(p, readFileSync(p, "utf8"));
 			} catch {

package/src/adapters/omp/install.ts

@@ -2,13 +2,15 @@
 // Does not read or write the real user's agent directory: every path is under `home`.
 
 import { spawnSync } from "node:child_process";
-import { copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, readlinkSync, symlinkSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, readlinkSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { configFile } from "../../core/config.ts";
 
 import { adapterLiveFiles } from "./doctor.ts";
+// Registers the plugin-command matcher into core's writeTargets (side effect).
+import "./package-ops.ts";
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");
 
 const OVERLAY = `adapter:
@@ -18,11 +20,14 @@ const OVERLAY = `adapter:
   extensions: "~/.omp/agent/extensions"
 `;
 
-const PROTECTED = ["~/.omp/agent/agents/", "~/.omp/agent/extensions/"];
+// P8: the plugin dir is adapter surface and lands in the config's
+// guards.protected, so core's protected check covers it without naming a
+// harness path. installOmp writes it via the same overlay pass.
+const PROTECTED = ["~/.omp/agent/agents/", "~/.omp/agent/extensions/", "~/.omp/plugins/"];
 
 export interface InstallResult {
-	extension: string;
 	plugin: string;
+	removedStaleLink: string | null;
 	pinsCopied: string[];
 	pinsKept: string[];
 	overlay: "written" | "unchanged";
@@ -46,7 +51,9 @@ function ensureLink(link: string, target: string): void {
 
 function linkInstalled(home: string): void {
 	for (const file of adapterLiveFiles(home)) {
-		if (file.live.includes("/.omp/agent/agents/")) continue;
+		// agents/ are copied, not linked; the plugin link is `omp plugin link`'s
+		// own output (linkPlugin below), never ours to ensureLink.
+		if (file.live.includes("/.omp/agent/agents/") || file.live.includes("/.omp/plugins/")) continue;
 		ensureLink(file.live, file.source);
 	}
 }
@@ -109,24 +116,37 @@ function linkPlugin(home: string): string {
 	return join(home, ".omp/plugins/node_modules/neurastream");
 }
 
-/** Link the extension, copy missing pins, write the overlay. HOME is the sandbox or the caller's home. */
+/** Link the plugin, copy missing pins, write the overlay. HOME is the sandbox or the caller's home. */
 export function installOmp(home: string): InstallResult {
 	const file = configFile(home);
 	if (!existsSync(file)) throw new Error(`no config at ${file}; run neurastream init first`);
+	// P9: ONE load route. omp loads extensions-dir files AND a plugin package's
+	// package.json#omp.extensions, so an extensions/neurastream.ts link beside
+	// `omp plugin link` runs every hook twice. Only the plugin route remains —
+	// the one guard parity locks (~/.omp/plugins/ + the package root). A stale
+	// link an older install made is removed, but only when it is a symlink: a
+	// real file there is never ours to delete.
 	const extension = join(home, ".omp/agent/extensions/neurastream.ts");
-	const target = join(PACKAGE_ROOT, "src/adapters/omp/index.ts");
-	ensureLink(extension, target);
+	let removedStaleLink: string | null = null;
+	try {
+		if (lstatSync(extension).isSymbolicLink()) {
+			unlinkSync(extension);
+			removedStaleLink = extension;
+		}
+	} catch {
+		// absent: nothing stale to remove
+	}
 	mkdirSync(join(home, ".omp/agent/sessions"), { recursive: true });
 	const pins = copyPins(join(home, ".omp/agent/agents"));
 	linkInstalled(home);
 	const plugin = linkPlugin(home);
 	const overlay = writeOverlay(file);
-	return { extension, plugin, pinsCopied: pins.copied, pinsKept: pins.kept, overlay };
+	return { plugin, removedStaleLink, pinsCopied: pins.copied, pinsKept: pins.kept, overlay };
 }
 
 export function printInstall(result: InstallResult): void {
-	console.log(`neurastream adapter install omp: linked ${result.extension}`);
 	console.log(`neurastream adapter install omp: plugin ${result.plugin}`);
+	if (result.removedStaleLink) console.log(`neurastream adapter install omp: removed stale extension link ${result.removedStaleLink}`);
 	console.log(
 		`neurastream adapter install omp: pins copied ${result.pinsCopied.length}, kept ${result.pinsKept.length}; overlay ${result.overlay}`,
 	);

package/src/adapters/omp/package-ops.ts

@@ -0,0 +1,28 @@
+// Adapter-owned package-operation shapes for the P8 guard parity: core's
+// writeTargets never names a harness, so the plugin-command matcher lives here
+// and registers itself into core at module load. Every plugin command writes
+// under the plugin directory, which src/adapters/omp/install.ts lists in the
+// config's guards.protected — so mapping the commands onto that directory puts
+// them behind the owner's unlock like every other guard file.
+
+import { homedir } from "node:os";
+import { registerPackageOpTarget, type PackageOpMatcher } from "../../core/queue/lib.ts";
+
+const PLUGIN_ACTIONS = ["install", "uninstall", "link", "unlink", "update"];
+
+/** Target for `<harness> plugin <action>` segments; null when none matches. */
+export const pluginCommandTarget: PackageOpMatcher = (code: string): string | null => {
+	for (const seg of code.split(/&&|\|\||;|\n|\|/)) {
+		const toks = seg.trim().split(/\s+/).filter(Boolean);
+		let i = 0;
+		while (i < toks.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(toks[i] ?? "")) i++;
+		const cmd = (toks[i] ?? "").replace(/^["']|["']$/g, "").replace(/^.*\//, "");
+		if (cmd !== "omp") continue;
+		const sub = (toks[i + 1] ?? "").replace(/^["']+|["']+$/g, "");
+		if (sub === "plugin" && PLUGIN_ACTIONS.includes((toks[i + 2] ?? "").replace(/^["']+|["']+$/g, "")))
+			return `${homedir()}/.omp/plugins/`;
+	}
+	return null;
+};
+
+registerPackageOpTarget(pluginCommandTarget);

package/src/core/guards.ts

@@ -338,6 +338,9 @@ function mainTool(e: ToolEvent, input: Record<string, unknown>, cfg: Config): De
 	return editWindow(e, input, cfg);
 }
 
+/** A live plan file (archived plans excluded); Main's plan-text checks run on these. */
+export const MAIN_PLAN_FILE = /\/docs\/plans\/(?!archive\/)[^/]+\.md$/;
+
 /**
  * pre-tool: plan-guard checkCall for subs (protected files, budget, plan-edit rules, blockers)
  * plus, for Main, the spawn gates and the project-file edit window.
@@ -358,6 +361,13 @@ export function checkTool(e: ToolEvent, cfg: Config): Decision {
 		);
 	}
 	if (e.agent === "main") {
+		// The plan-text checks (checkPlanEdit) see only edit/write results; a shell redirect,
+		// sed -i or heredoc into a plan would skip them, so plans change through edit/write only.
+		const shellPlan = e.tool !== "write" && e.tool !== "edit" ? writes.find(p => MAIN_PLAN_FILE.test(p)) : undefined;
+		if (shellPlan) {
+			log(cfg.paths.plan_guard_log, `BLOCK main tool=${e.tool} shell write to plan ${shellPlan}`);
+			return deny(`plan-guard: ${shellPlan} is a plan file: change it with the edit or write tool (close or cancel it with queue-close / queue-cancel).`);
+		}
 		const d = mainTool(e, input, cfg);
 		// A task brief names paths it does not read; only the other tools' paths count as reads.
 		if (d.allow && e.tool !== "task") recordMainReads(paths.filter(p => !writes.includes(p)));
@@ -462,23 +472,28 @@ export function flagCancel(text: string, cfg: Config): string {
 
 /**
  * prompt/owner message: inject the queue summary, flag cancel wording, reset Main's edit window
- * and the stop counters (the original resets them at every user message).
+ * and the stop counters (the original resets them at every user message). A turn the harness
+ * starts from this guard's own stop continuation ("main-guard: …") is not an owner message: it
+ * keeps the counters and the edit window, else every continuation reset the idle streak and a
+ * model that only answers text was nudged again forever (2026-10-21 OOM: ~205 agent starts in one
+ * non-interactive session).
  */
 export function checkInject(e: InjectEvent, cfg: Config): Decision {
 	if (e.agent !== "main") return ALLOW;
-	writeWindow({ used: [], windowStart: 0 });
+	const continuation = e.inject.trimStart().startsWith("main-guard:");
+	if (!continuation) writeWindow({ used: [], windowStart: 0 });
 	let summary: string;
 	try {
 		summary = q.queueSummary();
 	} catch (err) {
 		summary = `Queue unreadable (${q.INDEX}): ${err}`;
 	}
-	const cancel = flagCancel(e.inject, cfg);
+	const cancel = continuation ? "" : flagCancel(e.inject, cfg);
 	return {
 		allow: true,
 		reason: "",
 		inject: `${summary}\n(main-guard: read ${q.INDEX} and the listed repo INDEX.md files are summarised above; work the open plans, close finished ones with queue-close.)${cancel}`,
-		state: { callsSinceStop: 0, idleStops: 0 },
+		...(continuation ? {} : { state: { callsSinceStop: 0, idleStops: 0 } }),
 	};
 }
 

package/src/core/main-start.ts

@@ -49,8 +49,10 @@ export function mainStartText(args: string[], cfg: Config): string {
 		if (lines.length) say(lines.join("\n"));
 	} catch {}
 	say("=== doctor");
+	// The CLI file itself (shebang `#!/usr/bin/env bun`), never process.execPath: inside a host
+	// harness that is the harness binary, which would start a new agent session instead.
 	const cli = join(dirname(fileURLToPath(import.meta.url)), "../cli/main.ts");
-	const doctor = spawnSync(process.execPath, [cli, "doctor"], { encoding: "utf8", env: process.env });
+	const doctor = spawnSync(cli, ["doctor"], { encoding: "utf8", env: process.env });
 	const text = `${doctor.stdout ?? ""}${doctor.stderr ?? ""}`;
 	out.push(text.endsWith("\n") || text === "" ? text : `${text}\n`);
 	if (doctor.error) say(doctor.error.message);

package/src/core/queue/lib.ts

@@ -1,7 +1,7 @@
 // Queue model: main index, repo INDEX.md, plan shape (templates/queue/TEMPLATE.md).
 
 import { createHash } from "node:crypto";
-import { accessSync, constants, existsSync, readFileSync, statSync } from "node:fs";
+import { accessSync, constants, existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
@@ -306,6 +306,60 @@ export function changesFiles(toolName: string, input: Record<string, unknown>):
 	return SHELL_TOOLS.has(toolName) && MUTATING.test(String(input?.command ?? input?.code ?? ""));
 }
 
+// P8: package-manager and cutover commands change the running guard package.
+// Their write target is the protected root they touch, so the ordinary
+// protected-path check refuses them without the owner's unlock. Matched per
+// shell segment, with leading KEY=VALUE assignments stripped; the cutover
+// scripts stay free when the same segment pins HOME to /tmp (how every sandbox
+// test and the P9 session test run them). Harness-owned command shapes are NOT
+// matched here: the adapter registers them through registerPackageOpTarget,
+// because core never names a harness.
+function isNeurastreamSpec(t: string): boolean {
+	const base = t.replace(/^["']|["']$/g, "").replace(/^\.?\//, "").replace(/^.*\//, "");
+	return base === "neurastream" || base.startsWith("neurastream@") || /^neurastream-[^/]*\.tgz$/.test(base);
+}
+
+// Adapter-registered matcher for harness package operations (plugin install,
+// link, ...). Returns the protected root the command writes, or null.
+export type PackageOpMatcher = (code: string) => string | null;
+export let packageOpMatcher: PackageOpMatcher | null = null;
+
+export function registerPackageOpTarget(fn: PackageOpMatcher): void {
+	packageOpMatcher = fn;
+}
+
+function packageOpTarget(code: string): string | null {
+	for (const seg of code.split(/&&|\|\||;|\n|\|/)) {
+		const toks = seg.trim().split(/\s+/).filter(Boolean);
+		let i = 0;
+		while (i < toks.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(toks[i] ?? "")) i++;
+		const cmd = (toks[i] ?? "").replace(/^["']|["']$/g, "").replace(/^.*\//, "");
+		const rest = toks.slice(i + 1).map(t => t.replace(/^["']+|["']+$/g, ""));
+		const sub = rest[0] ?? "";
+		const hasGlobal = rest.some(t => t === "-g" || t === "--global");
+		const names = rest.slice(1).filter(t => !t.startsWith("-"));
+		if (cmd === "bun" && ["add", "install", "remove", "rm", "update", "link", "unlink"].includes(sub) && hasGlobal) {
+			if (!names.length || names.some(isNeurastreamSpec)) return `${bunGlobalRoot()}/install/global/node_modules/neurastream`;
+			continue;
+		}
+		if (cmd === "npm" && ["install", "i", "uninstall", "update", "link"].includes(sub) && hasGlobal) {
+			if (!names.length || names.some(isNeurastreamSpec)) return `${bunGlobalRoot()}/install/global/node_modules/neurastream`;
+			continue;
+		}
+		if (cmd === "neurastream" && sub === "adapter" && ["install", "uninstall"].includes(rest[1] ?? ""))
+			return `${bunGlobalRoot()}/install/global/node_modules/neurastream`;
+		if ((cmd === "bash" || cmd === "sh") && rest.some(t => {
+			const base = t.replace(/^.*\//, "");
+			return base === "cutover.sh" || base === "rollback.sh";
+		})) {
+			const envHome = toks.slice(0, i).find(t => t.startsWith("HOME="));
+			if (envHome && envHome.slice("HOME=".length).replace(/^["']|["']$/g, "").startsWith("/tmp/")) continue;
+			return `${agentDir()}/extensions/`;
+		}
+	}
+	return packageOpMatcher?.(code) ?? null;
+}
+
 export function writeTargets(toolName: string, input: Record<string, unknown>, cwd: string): string[] {
 	const out = new Set<string>();
 	const add = (raw: string, from: string) => {
@@ -334,7 +388,10 @@ export function writeTargets(toolName: string, input: Record<string, unknown>, c
 	}
 	if (!SHELL_TOOLS.has(toolName)) return [];
 	const code = String(input?.command ?? input?.code ?? "");
-	if (!MUTATING.test(code)) return [];
+	// A package/plugin/cutover command is a write even though none of the
+	// generic mutating heuristics fire on its text.
+	const pkgOp = packageOpTarget(code);
+	if (!MUTATING.test(code) && !pkgOp) return [];
 	let dir = typeof input?.cwd === "string" ? path.resolve(cwd, expandHome(input.cwd)) : cwd;
 	for (const seg of code.split(/&&|\|\||;|\n|\|/)) {
 		const s = seg.trim();
@@ -364,6 +421,7 @@ export function writeTargets(toolName: string, input: Record<string, unknown>, c
 		/\bshutil\.\w+\(\s*["'][^"']+["']\s*,\s*(["'][^"']+["'])/g,
 	])
 		for (const m of code.matchAll(re)) add((m[1] ?? "").replace(/`/g, ""), dir);
+	if (pkgOp) out.add(pkgOp);
 	return [...out];
 }
 
@@ -372,9 +430,29 @@ export function unlockPath(): string {
 }
 export let UNLOCK = unlockPath();
 export const UNLOCK_MINUTES = 30;
+// P8 (2026-10-21): after the npm cutover the running guards load from the
+// installed package, so the package itself is guard surface. The package root
+// is only claimed when this file really is part of a published neurastream
+// package (package.json name check): the pre-cutover standalone copy under
+// <agent>/queue/ has no package.json above it and must not protect the home.
+function packageManifest(): { root: string; bins: string[] } | null {
+	try {
+		const root = realpathSync(path.resolve(path.dirname(import.meta.path), "..", "..", ".."));
+		const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")) as { name?: string; bin?: Record<string, string> };
+		if (pkg.name !== "neurastream") return null;
+		return { root, bins: Object.keys(pkg.bin ?? {}) };
+	} catch {
+		return null;
+	}
+}
+
+function bunGlobalRoot(): string {
+	return process.env.BUN_INSTALL ? path.resolve(expandHome(process.env.BUN_INSTALL)) : `${HOME}/.bun`;
+}
+
 function protectedPaths(): string[] {
 	const agent = agentDir();
-	return [
+	const paths = [
 		`${agent}/extensions/`,
 		`${agent}/queue/`,
 		`${agent}/blockers/`,
@@ -395,7 +473,18 @@ function protectedPaths(): string[] {
 		`${HOME}/.local/bin/git`,
 		`${HOME}/.local/bin/git-secret-gate`,
 		`${HOME}/.config/git-secret-gate/`,
+		// Where `bun add -g neurastream` lands; writeTargets points package
+		// operations here so they need the owner's unlock like any guard edit.
+		// The plugin dir is adapter surface: the installer lists it in the
+		// config's guards.protected (core never names a harness path).
+		`${bunGlobalRoot()}/install/global/node_modules/neurastream/`,
 	];
+	const pkg = packageManifest();
+	if (pkg) {
+		paths.push(`${pkg.root}/`);
+		for (const name of pkg.bins) paths.push(`${HOME}/.bun/bin/${name}`);
+	}
+	return paths;
 }
 export let PROTECTED = protectedPaths();