portable-agent-layer 0.78.2 → 0.78.3

package/src/hooks/lib/retrieval-index.ts

@@ -8,7 +8,7 @@
  */
 
 import { spawn } from "node:child_process";
-import { existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { SIMILARITY_THRESHOLD } from "./graduation";
 import { readFailures, readReflections } from "./learning-store";
@@ -197,14 +197,21 @@ export function readIndex(): RetrievalIndex | null {
 }
 
 /** True if any source directory was modified after the index was built. */
+function newestFileMtime(dir: string): number {
+  let newest = 0;
+  for (const entry of readdirSync(dir, { recursive: true, withFileTypes: true })) {
+    if (!entry.isFile()) continue;
+    newest = Math.max(newest, statSync(resolve(entry.parentPath, entry.name)).mtimeMs);
+  }
+  return newest;
+}
+
 export function isStale(index: RetrievalIndex): boolean {
   try {
     const builtMs = new Date(index.builtAt).getTime();
-    for (const dir of [paths.failures(), paths.wisdom(), paths.reflections()]) {
-      if (!existsSync(dir)) continue;
-      if (statSync(dir).mtimeMs > builtMs) return true;
-    }
-    return false;
+    return [paths.failures(), paths.wisdom(), paths.reflections()].some(
+      (dir) => newestFileMtime(dir) > builtMs
+    );
   } catch {
     return false;
   }

package/src/hooks/lib/security.ts

@@ -79,9 +79,14 @@ const WIN_ELEVATED_THREATS: [RegExp, string][] = [
   [/\bdiskpart\b/i, "Disk partitioning"],
 ];
 
+const POSIX_ROOT_TARGET = String.raw`["']?(?:(?:~|\$HOME|\$\{HOME\})/?|/)\*?["']?(?=\s|[;&|]|$)`;
+
 /** Dangerous command patterns — always blocked */
 const BLOCKED_COMMANDS: [RegExp, string][] = [
-  [/rm\s+-rf\s+[/~]/, "Recursive delete of root or home"],
+  [
+    new RegExp(String.raw`rm\s+-rf\s+${POSIX_ROOT_TARGET}`),
+    "Recursive delete of root or home",
+  ],
   [/mkfs\./, "Filesystem format"],
   [/dd\s+if=.*of=\/dev\//, "Raw disk write"],
   [/>\s*\/dev\/sd/, "Direct device write"],
@@ -232,6 +237,28 @@ function managedReasonInSegment(segment: string): string | null {
 const READ_ONLY_COMMANDS =
   /^\s*(?:cat|head|tail|less|more|grep|rg|wc|diff|stat|file|ls|dir|find|git\s+(?:log|diff|blame|show|status)|bat)\b/;
 
+const COMMAND_SEPARATORS = new Set(["|", ";", "&"]);
+
+function unquotedSegments(cmd: string): string[] {
+  const segments: string[] = [];
+  let current = "";
+  let quote: string | null = null;
+  for (const char of cmd) {
+    if (quote) {
+      if (char === quote) quote = null;
+    } else if (char === "'" || char === '"') {
+      quote = char;
+    } else if (COMMAND_SEPARATORS.has(char)) {
+      segments.push(current.trim());
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  segments.push(current.trim());
+  return segments;
+}
+
 /** Check a bash command against blocked patterns. Returns reason string or null. */
 export function checkBashCommand(cmd: string): string | null {
   for (const [pattern, reason] of BLOCKED_COMMANDS) {
@@ -242,8 +269,7 @@ export function checkBashCommand(cmd: string): string | null {
       if (pattern.test(cmd)) return reason;
     }
   }
-  const segments = cmd.split(/[|;&]/).map((s) => s.trim());
-  for (const segment of segments) {
+  for (const segment of unquotedSegments(cmd)) {
     const reason = managedReasonInSegment(segment);
     if (reason && !READ_ONLY_COMMANDS.test(segment)) return reason;
   }

package/src/hooks/lib/semi-static.ts

@@ -7,10 +7,11 @@
  */
 
 import { existsSync, readFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { basename, resolve } from "node:path";
 import { type FailureEntry, readFailures } from "./learning-store";
 import { loadOpinionContext } from "./opinions";
 import { palHome, paths } from "./paths";
+import { type ProjectProgress, readAllProjects, resolveProjectFromCwd } from "./projects";
 import { readFramePrinciples } from "./wisdom";
 
 /** A single semi-static context source — built at session stop, loaded natively at session start. */
@@ -67,6 +68,12 @@ export function rankFailures(
     .slice(0, limit);
 }
 
+function projectTag(cwd: string, projects: ProjectProgress[]): string {
+  if (!cwd) return "";
+  const name = resolveProjectFromCwd(cwd, projects)?.name ?? basename(cwd);
+  return `[${name}]`;
+}
+
 /** Build the failure avoid-list, prioritized by relevance to the current project. */
 export function loadFailurePatterns(): string {
   try {
@@ -74,11 +81,11 @@ export function loadFailurePatterns(): string {
     const all = readFailures(paths.failures());
     if (all.length === 0) return "";
 
+    const projects = readAllProjects();
     const lines = rankFailures(all, cwd).map((e) => {
       const label = e.rating ? `[${e.rating}/10]` : "";
-      const tag = e.cwd === cwd ? "[project]" : "[other]";
       const text = e.principle || e.context;
-      return `- ${label} ${tag} ${text}`.trim();
+      return ["-", label, projectTag(e.cwd, projects), text].filter(Boolean).join(" ");
     });
 
     return ["## Lessons from Recent Failures — Apply These Now", ...lines].join("\n");

package/src/hooks/lib/settings.ts

@@ -54,28 +54,27 @@ const IDENTITY_DEFAULTS: Identity = {
 
 // ── Singleton ──
 
-let cached: PalSettingsData | null = null;
+let cached: { path: string; data: PalSettingsData } | null = null;
 
 function settingsPath(): string {
   return resolve(paths.memory(), "pal-settings.json");
 }
 
-function load(): PalSettingsData {
-  if (cached) return cached;
-  const p = settingsPath();
-  if (!existsSync(p)) {
-    cached = {};
-    return cached;
-  }
+function readSettingsFile(p: string): PalSettingsData {
+  if (!existsSync(p)) return {};
   try {
-    cached = JSON.parse(readFileSync(p, "utf-8")) as PalSettingsData;
-    return cached;
+    return JSON.parse(readFileSync(p, "utf-8")) as PalSettingsData;
   } catch {
-    cached = {};
-    return cached;
+    return {};
   }
 }
 
+function load(): PalSettingsData {
+  const p = settingsPath();
+  if (cached?.path !== p) cached = { path: p, data: readSettingsFile(p) };
+  return cached.data;
+}
+
 /** Force re-read from disk (useful after writes) */
 export function reload(): PalSettingsData {
   cached = null;

package/src/tools/{relationship-reflect.ts → agent/relationship-reflect.ts}

@@ -8,17 +8,17 @@
  * - Generate a summary report
  *
  * Usage:
- *   bun run tool:reflect              # Reflect on last 7 days
- *   bun run tool:reflect -- --month   # Reflect on last 30 days
- *   bun run tool:reflect -- --dry-run # Preview without writing
+ *   pal cli relationship-reflect             # Reflect on last 7 days
+ *   pal cli relationship-reflect --month     # Reflect on last 30 days
+ *   pal cli relationship-reflect --dry-run   # Preview without writing
  */
 
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { parseArgs } from "node:util";
-import { readOpinions, saveOpinion, setLastReflectDate } from "../hooks/lib/opinions";
-import { palHome } from "../hooks/lib/paths";
-import { emit } from "./lib/emit";
+import { readOpinions, saveOpinion, setLastReflectDate } from "../../hooks/lib/opinions";
+import { palHome } from "../../hooks/lib/paths";
+import { emit } from "../lib/emit";
 import {
   consoleLines,
   formatReport,
@@ -27,7 +27,8 @@ import {
   loadRatings,
   planPromotions,
   reportPath,
-} from "./lib/relationship-reflect";
+} from "../lib/relationship-reflect";
+import { scriptArgs } from "../lib/script-args";
 
 const HELP = `
 RelationshipReflect — Periodic reflection + opinion promotion
@@ -36,9 +37,9 @@ Reads recent relationship notes and ratings. Promotes recurring
 observations (O type) into tracked opinions with confidence scoring.
 
 Usage:
-  bun run tool:reflect              Reflect on last 7 days (default)
-  bun run tool:reflect -- --month   Reflect on last 30 days
-  bun run tool:reflect -- --dry-run Preview without writing
+  pal cli relationship-reflect             Reflect on last 7 days (default)
+  pal cli relationship-reflect --month     Reflect on last 30 days
+  pal cli relationship-reflect --dry-run   Preview without writing
 
 Output:
   - Updates memory/relationship/opinions.json (confidence tracking)
@@ -56,9 +57,9 @@ function saveReport(report: string, period: string): string {
   return filepath;
 }
 
-function run() {
+export function run(argv: string[] = scriptArgs()) {
   const { values } = parseArgs({
-    args: Bun.argv.slice(2),
+    args: argv,
     options: {
       month: { type: "boolean" },
       "dry-run": { type: "boolean" },