qualia-framework 6.8.0 → 6.8.1

package/CHANGELOG.md

@@ -8,6 +8,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 > Note: git tags for historical versions were not retained; commit references are approximate
 > and dates reflect commit history rather than npm publish timestamps.
 
+## [6.8.1] - 2026-06-10 (installer hygiene — global hook sweep, bin purge, bak routing)
+
+Found via a live audit of an installed `~/.claude`: the retired brain experiment's `brain-inject.js` was still wired under `UserPromptSubmit`, firing a failing node process on every user prompt, and had survived four releases because the settings merge never looked at that event.
+
+### Fixed — installer
+- **Settings hook sweep is now global.** The merge previously only cleaned events present in `qualiaHooks`, so deprecated entries under other events (`UserPromptSubmit`, etc.) were never pruned. The installer now sweeps every hook event for (a) retired Qualia hook commands and (b) `node "<CLAUDE_DIR>/..."` commands whose target file no longer exists, dropping empty blocks/events. User hooks (non-node or outside `CLAUDE_DIR`) are untouched.
+- **`brain-inject.js` added to `DEPRECATED_HOOKS`** — the UserPromptSubmit half of the brain experiment was missing from the v6.8.0 prune list.
+- **`bin/` orphan purge** — `DEPRECATED_BIN` removes the retired `build-brain-index.js`; bin/ previously had no deprecation pass at all.
+- **`.bak` files routed to `backups/`** — `settings.json.bak.*` / `CLAUDE.md.bak.*` no longer accumulate in the `~/.claude` root across reinstalls; all three backup sites now write into a `backups/` subdir via a shared `bakPath()` helper.
+
 ## [6.8.0] - 2026-06-06 (audit remediation — installer, guards, trust-score, polish)
 
 Closes the verified findings from the 2026-06-06 framework audit (4 CRITICAL · 7 HIGH · 33 MEDIUM, adversarially verified). Root cause of most CRITICALs was a stale/incomplete install, not source rot — fixed in the installer so a clean reinstall is complete and correct.

package/bin/install.js

@@ -210,13 +210,22 @@ function ensureCodexStatusLineConfig(existing) {
   return `${next.slice(0, tuiMatch.index)}${tuiBlock}${next.slice(tuiMatch.index + tuiMatch[0].length)}`;
 }
 
+// v6.8.1: .bak files go into a backups/ subdir next to the target instead of
+// littering the target's directory (a dozen settings.json.bak.* files were
+// accumulating in ~/.claude root across reinstalls).
+function bakPath(dest) {
+  const dir = path.join(path.dirname(dest), "backups");
+  try { fs.mkdirSync(dir, { recursive: true }); } catch {}
+  const ts = new Date().toISOString().replace(/[:.]/g, "-");
+  return path.join(dir, `${path.basename(dest)}.bak.${ts}`);
+}
+
 function backupIfDifferent(dest, nextContent, label) {
   if (!fs.existsSync(dest)) return false;
   try {
     const existing = fs.readFileSync(dest, "utf8");
     if (existing === nextContent) return false;
-    const ts = new Date().toISOString().replace(/[:.]/g, "-");
-    const bak = `${dest}.bak.${ts}`;
+    const bak = bakPath(dest);
     fs.copyFileSync(dest, bak);
     ok(`Backed up existing ${label} -> ${path.basename(bak)}`);
     return true;
@@ -683,6 +692,8 @@ async function main() {
     "brain-pre-compact.js",
     "brain-session-end.js",
     "brain-session-start.js",
+    // v6.8.1: the UserPromptSubmit half of the brain experiment was missed.
+    "brain-inject.js",
   ];
   for (const f of DEPRECATED_HOOKS) {
     const p = path.join(hooksDest, f);
@@ -820,9 +831,8 @@ async function main() {
     if (fs.existsSync(claudeDest)) {
       const existing = fs.readFileSync(claudeDest, "utf8");
       if (existing !== claudeMd) {
-        const ts = new Date().toISOString().replace(/[:.]/g, "-");
-        const bak = `${claudeDest}.bak.${ts}`;
-        try { fs.copyFileSync(claudeDest, bak); ok(`Backed up existing CLAUDE.md → ${path.basename(bak)}`); } catch {}
+        const bak = bakPath(claudeDest);
+        try { fs.copyFileSync(claudeDest, bak); ok(`Backed up existing CLAUDE.md → backups/${path.basename(bak)}`); } catch {}
       }
     }
     fs.writeFileSync(claudeDest, claudeText(claudeMd), "utf8");
@@ -842,6 +852,14 @@ async function main() {
       try { fs.chmodSync(out, 0o755); } catch {}
       ok(script.label);
     }
+    // v6.8.1: purge retired bin scripts (same belt-and-suspenders as
+    // DEPRECATED_HOOKS — bin/ never had an orphan pass, so the brain
+    // experiment's indexer survived reinstalls).
+    const DEPRECATED_BIN = ["build-brain-index.js"];
+    for (const f of DEPRECATED_BIN) {
+      const p = path.join(binDest, f);
+      try { if (fs.existsSync(p)) fs.unlinkSync(p); } catch {}
+    }
     // Write a minimal root package.json so the installed CLI's `require("../package.json")`
     // resolves post-install (bin/ lives at CLAUDE_DIR/bin, so the parent is CLAUDE_DIR).
     fs.writeFileSync(
@@ -1204,6 +1222,35 @@ Client-specific preferences, design choices, and requirements. Loaded by \`/qual
     }
   }
 
+  // v6.8.1: sweep ALL hook events for retired Qualia hooks and dead node
+  // paths. The merge above only visits events present in qualiaHooks, so
+  // entries under other events (e.g. the retired brain-inject.js under
+  // UserPromptSubmit) survived every reinstall — firing a failing node
+  // process on each user prompt. Runs after the hooks/ install, so an
+  // existsSync miss means the file is truly gone, not not-yet-copied.
+  const DEPRECATED_HOOK_CMDS = [
+    "brain-inject.js", "build-brain-index.js", "block-env-edit.js",
+    "brain-pre-compact.js", "brain-session-end.js", "brain-session-start.js",
+  ];
+  const isDeadHookCmd = (cmd) => {
+    if (typeof cmd !== "string") return false;
+    if (DEPRECATED_HOOK_CMDS.some((f) => cmd.includes(f))) return true;
+    const m = cmd.match(/^node "([^"]+)"$/);
+    if (m && m[1].startsWith(CLAUDE_DIR + path.sep) && !fs.existsSync(m[1])) return true;
+    return false;
+  };
+  for (const event of Object.keys(settings.hooks)) {
+    const blocks = Array.isArray(settings.hooks[event]) ? settings.hooks[event] : [];
+    const cleaned = [];
+    for (const block of blocks) {
+      if (!block || !Array.isArray(block.hooks)) continue;
+      const kept = block.hooks.filter((h) => !isDeadHookCmd(h && h.command));
+      if (kept.length > 0) cleaned.push({ ...block, hooks: kept });
+    }
+    if (cleaned.length > 0) settings.hooks[event] = cleaned;
+    else delete settings.hooks[event];
+  }
+
   // Permissions stay permissive; Qualia policy enforcement happens in hooks so
   // OWNER overrides and EMPLOYEE blocks can share one source of truth. We still
   // seed a scoped baseline allow-list (union-merged, never clobbering user
@@ -1238,9 +1285,7 @@ Client-specific preferences, design choices, and requirements. Loaded by \`/qual
   // configs / custom permissions. Atomic write (tmp + rename) avoids partial
   // writes; the .bak file is the recovery point if the merger ever misbehaves.
   if (fs.existsSync(settingsPath)) {
-    const ts = new Date().toISOString().replace(/[:.]/g, "-");
-    const bak = `${settingsPath}.bak.${ts}`;
-    try { fs.copyFileSync(settingsPath, bak); } catch {}
+    try { fs.copyFileSync(settingsPath, bakPath(settingsPath)); } catch {}
   }
   const settingsTmp = `${settingsPath}.tmp.${process.pid}`;
   fs.writeFileSync(settingsTmp, JSON.stringify(settings, null, 2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qualia-framework",
-  "version": "6.8.0",
+  "version": "6.8.1",
   "description": "Claude Code and Codex workflow framework by Qualia Solutions. Plan, build, verify, ship.",
   "bin": {
     "qualia-framework": "./bin/cli.js"