ruvnet-brain 4.0.12 → 4.0.28

package/plugin/scripts/nightly-controller.mjs

@@ -0,0 +1,98 @@
+// nightly-controller.mjs — a thin adapter around the installer's one scheduler implementation.
+//
+// It does not write a plist, call launchctl, or invent platform behavior. Both the installer and the
+// console reach the same `bin/install.mjs --enable-nightly/--disable-nightly` door; this adapter only
+// supplies structured status and captures its exit result for the console.
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+// ROOT is the tree that holds `bin/install.mjs`, and it is resolved by an EXACT layout test rather
+// than by `..` — because `..` means two different things since this file moved into the payload
+// (ADR-065). From `<root>/scripts/` it was the root; from `<root>/plugin/scripts/` it is
+// `<root>/plugin`, and `<root>/plugin/bin/install.mjs` does not exist. Caught live by
+// console-apply-timings.test.mjs, which drove a real /api/apply through the console and got
+// `Error: Cannot find module '<root>/plugin/bin/install.mjs'` back inside a 200 response — a remedy
+// that reported failure honestly, but failed for a packaging reason nobody would have guessed.
+//
+// The test is exact, not a heuristic: this file's directory IS `<candidate>/plugin/scripts` if and
+// only if `<candidate>` is a non-flattened root. A flattened install (the Spine's versions/<gen>/,
+// the plugin cache's <ver>/) has no `plugin/` level, so `../..` is some unrelated parent and the
+// answer falls back to `..` — where `bin/` also does not exist, and applyNightlyChoice() then
+// reports that honestly instead of silently spawning nothing. nightlyStatus() only reads a plist and
+// needs no installer at all, so status stays correct in every layout.
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(HERE, '..', '..', 'plugin', 'scripts') === HERE
+  ? path.resolve(HERE, '..', '..')
+  : path.resolve(HERE, '..');
+const INSTALLER = path.join(ROOT, 'bin', 'install.mjs');
+
+/**
+ * THE NIGHTLY JOB'S NAME, stated once for everything that has to recognise it.
+ *
+ * Exported because issue #113 was two files disagreeing about this exact string with nothing to
+ * notice: bin/install.mjs writes a LaunchAgent labelled `com.ruvnet.brain-update`, while
+ * capability-registry.mjs looked for launchd jobs matching `/(nightly|refresh)/` — so the console
+ * reported "not installed" about the very job the installer had loaded, scheduled and run. A label
+ * is an interface between the writer and everyone who looks for it; spelling it out per reader is
+ * how the two drift apart silently.
+ *
+ * bin/install.mjs still holds its own literal (installer-owned code, changed under its own review);
+ * tests/unit/nightly-job-identity.test.mjs asserts the two are the same string, so a drift is a red
+ * test rather than a capability that quietly disappears from the console.
+ */
+export const NIGHTLY_LABEL = 'com.ruvnet.brain-update';
+
+export function nightlyArtifact({ env = process.env, platform = process.platform } = {}) {
+  const home = env.HOME || os.homedir();
+  return {
+    supported: platform === 'darwin',
+    platform,
+    path: path.join(home, 'Library', 'LaunchAgents', `${NIGHTLY_LABEL}.plist`),
+    label: NIGHTLY_LABEL,
+  };
+}
+
+export function nightlyStatus(options = {}) {
+  const artifact = nightlyArtifact(options);
+  if (!artifact.supported) {
+    return { state: 'unsupported', evidence: `No reversible scheduler adapter is implemented for ${artifact.platform}.`, artifact };
+  }
+  const present = fs.existsSync(artifact.path);
+  return {
+    state: present ? 'on' : 'off',
+    evidence: present ? `LaunchAgent plist exists at ${artifact.path}` : `No LaunchAgent plist at ${artifact.path}`,
+    artifact,
+  };
+}
+
+export function applyNightlyChoice(enabled, options = {}) {
+  if (typeof enabled !== 'boolean') return { ok: false, log: 'nightly must be true or false' };
+  const env = options.env || process.env;
+  const before = nightlyStatus({ ...options, env });
+  if (!before.artifact.supported) return { ok: false, state: before, log: before.evidence };
+  const run = spawnSync(process.execPath, [
+    options.installer || INSTALLER,
+    enabled ? '--enable-nightly' : '--disable-nightly',
+  ], {
+    env: { ...env, RUVNET_BRAIN_IMPORT_ONLY: '0' },
+    cwd: options.cwd || ROOT,
+    encoding: 'utf8',
+    shell: false,
+    timeout: options.timeout || 30_000,
+  });
+  const after = nightlyStatus({ ...options, env });
+  const desired = enabled ? 'on' : 'off';
+  const ok = !run.error && run.status === 0 && after.state === desired;
+  return {
+    ok,
+    before,
+    after,
+    log: ok
+      ? `Nightly refresh is ${desired}; verified from ${after.artifact.path}.`
+      : `Nightly refresh did not reach ${desired}: ${run.error?.message || run.stderr?.trim() || run.stdout?.trim() || `exit ${run.status}`}`,
+  };
+}

package/plugin/scripts/runtime-preferences.mjs

@@ -66,6 +66,18 @@ function validSettings(raw = {}) {
     newProjectDefaults: source.newProjectDefaults === true,
     advocacy: Number.isInteger(source.advocacy) && source.advocacy >= 1 && source.advocacy <= 5
       ? source.advocacy : 3,
+    // ADR-063 / issue #103. Unknown keys are DROPPED by this function, so a setting absent here is
+    // silently unreadable no matter what the Console writes — which is how the first cut of the
+    // managed-memory boundary read `advise` even when the file said `block`.
+    //
+    // NOTE THE DUPLICATION, deliberately not "fixed" here: scripts/user-settings.mjs SETTINGS_SCHEMA
+    // is the authority for these keys and this is a second enumeration of it. Deriving one from the
+    // other is the obvious move and it is the WRONG one — this file ships inside plugin/, that one
+    // does not, so the import would resolve in the checkout and throw ERR_MODULE_NOT_FOUND on a real
+    // install. Same trap as kb/forge-update.mjs reaching for ../scripts. The honest fix is a drift
+    // test that reads both files, not a bridge that breaks installs.
+    managedMemoryBoundary: ['advise', 'read-only', 'block'].includes(source.managedMemoryBoundary)
+      ? source.managedMemoryBoundary : 'advise',
   };
 }
 
@@ -263,6 +275,12 @@ export function seedProjectDefaults(options = {}) {
 
 if (process.argv.includes('--learning-scope')) {
   process.stdout.write(`${loadRuntimePreferences().values.learningScope}\n`);
+} else if (process.argv.includes('--managed-memory-boundary')) {
+  // ADR-063 / issue #103. hijack-ruvnet.sh is POSIX sh and must not parse JSON, so it asks here —
+  // the same idiom learn-capture.sh already uses for --learning-scope. Falls back to the shipped
+  // default rather than erroring: a hook that cannot read a preference must never refuse a command
+  // because of it, so an unreadable settings file degrades to `advise`, which blocks nothing.
+  process.stdout.write(`${loadRuntimePreferences().values.managedMemoryBoundary || 'advise'}\n`);
 } else if (process.argv.includes('--seed-project')) {
   const result = seedProjectDefaults();
   if (!result.ok) process.exitCode = 1;

package/plugin/scripts/session-start-core.mjs

@@ -492,14 +492,14 @@ export async function runSessionStart({
         }
         let confidenceInstruction;
         if (readiness.state === 'ready') {
-          emit('USER-LEVEL: one brain (~/.cache/ruvnet-brain/kb) shared by every project and window here — nothing to reinstall per project. search_ruvnet is ready and live; the grounding hooks are active.');
+          emit('USER-LEVEL: one brain ON DISK (~/.cache/ruvnet-brain/kb) shared by every project and window here — nothing to reinstall per project (each window still runs its own worker process, which now exits when idle). search_ruvnet is ready and live; the grounding hooks are active.');
           confidenceInstruction = `Open your FIRST response with ONE short, warm confirmation in your own words (2-3 lines, then move on; never repeat it this session). It must say "🧠 RuvNet Brain active (v${bannerVersion})" — ONE version, in parentheses, always; never a second number, never a bundle tag beside it — and convey: it grounds rUv's stack (RVF, Ruflo, AgentDB, SPARC, agentic-flow…) in his real source rather than guessing; npx github:stuinfla/ruvnet-brain --doctor checks it; ${consoleInvoke} opens a visual settings page.`;
         } else if (readiness.state === 'degraded') {
           const receipt = readiness.receipt || {};
-          emit(`USER-LEVEL: one brain (~/.cache/ruvnet-brain/kb) shared by every project and window here — nothing to reinstall per project. search_ruvnet is registered but degraded (${receipt.phase || 'startup'}: ${receipt.error || 'readiness failed'}); the grounding hooks remain active.`);
+          emit(`USER-LEVEL: one brain ON DISK (~/.cache/ruvnet-brain/kb) shared by every project and window here — nothing to reinstall per project (each window still runs its own worker process, which now exits when idle). search_ruvnet is registered but degraded (${receipt.phase || 'startup'}: ${receipt.error || 'readiness failed'}); the grounding hooks remain active.`);
           confidenceInstruction = `Open your FIRST response with ONE short line: "🧠 RuvNet Brain active (v${bannerVersion}) — search is degraded right now." Do not claim source grounding until a real search succeeds. npx github:stuinfla/ruvnet-brain --doctor shows the current verdict; ${consoleInvoke} opens the Console.`;
         } else {
-          emit('USER-LEVEL: one brain (~/.cache/ruvnet-brain/kb) shared by every project and window here — nothing to reinstall per project. search_ruvnet is registered; live readiness is not yet proven. The grounding hooks are active.');
+          emit('USER-LEVEL: one brain ON DISK (~/.cache/ruvnet-brain/kb) shared by every project and window here — nothing to reinstall per project (each window still runs its own worker process, which now exits when idle). search_ruvnet is registered; live readiness is not yet proven. The grounding hooks are active.');
           confidenceInstruction = `Open your FIRST response with ONE short line: "🧠 RuvNet Brain active (v${bannerVersion}) — search is registered and will prove readiness on first use." Do not claim source grounding until a real search returns a citation. npx github:stuinfla/ruvnet-brain --doctor shows the current verdict; ${consoleInvoke} opens the Console.`;
         }
         emit(confidenceInstruction);

package/plugin/scripts/unprompted-runtime.mjs

@@ -77,12 +77,25 @@ import { spawnSync } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { readStdinBounded } from './hook-input.mjs';
 
-// <codeRoot>/plugin/scripts/unprompted-runtime.mjs → <codeRoot>. Resolved from THIS file's own
-// location so it is correct under the Stable Spine (an immutable versions/<gen> tree) and in a dev
-// checkout alike — hook-shim.mjs has already chosen the tree by the time it dispatches this body.
+// WHERE THIS FILE'S SIBLINGS LIVE. Resolved from THIS file's own location so it is correct under the
+// Stable Spine (an immutable versions/<gen> tree) and in a dev checkout alike — hook-shim.mjs has
+// already chosen the tree by the time it dispatches this body.
+//
+// THIS USED TO ALSO COMPUTE `CODE_ROOT = SCRIPTS_DIR/../..`, and that line was WRONG in exactly the
+// way anticipate.sh's was (PR #114): it assumed `scripts/` is a sibling of `plugin/`, which holds
+// ONLY in a git checkout. Both shipped layouts flatten the `plugin/` level —
+//
+//   ~/.cache/ruvnet-brain/versions/<gen>/scripts/…        → ../.. = …/versions
+//   ~/.claude/plugins/cache/…/<ver>/scripts/…             → ../.. = …/ruvnet-brain
+//   <src>/plugin/scripts/…                                → ../.. = <src>            ← only this one
+//
+// — so `$CODE_ROOT/scripts/user-settings.mjs` pointed at nothing on every real install. Both consumers
+// (the 1–5 advocacy dial and the DismissalLedger, wired at SETTINGS_MODULE/ADVOCACY_MODULE below)
+// `catch` an import failure and fall back to defaults, so the dial was silently UNREAD for every user
+// while the code read as if it were honoured. Same defect class, same fix: the modules are SIBLINGS of
+// this file inside the payload, so name them from SCRIPTS_DIR and never reach outside it.
 const SELF = fileURLToPath(import.meta.url);
-const SCRIPTS_DIR = path.dirname(SELF);                     // <codeRoot>/plugin/scripts
-const CODE_ROOT = path.resolve(SCRIPTS_DIR, '..', '..');    // <codeRoot>
+const SCRIPTS_DIR = path.dirname(SELF);                     // the payload's scripts/ dir, whatever its parent
 
 // The CC event name the shim forwarded. No event → nothing to run; stay silent.
 const EVENT = process.argv[2] || '';
@@ -235,8 +248,10 @@ if (!candidates.length) silent();
 // RUVNET_SETTINGS_FILE); suppression comes from advocacy-outcomes.shouldStillOffer()/record(). Both
 // are loaded only if an advocacy/promotion candidate is actually present, so a lesson- or alarm-only
 // event pays nothing for them.
-const SETTINGS_MODULE = process.env.RUVNET_USER_SETTINGS_MODULE || path.join(CODE_ROOT, 'scripts', 'user-settings.mjs');
-const ADVOCACY_MODULE = process.env.RUVNET_ADVOCACY_OUTCOMES_MODULE || path.join(CODE_ROOT, 'scripts', 'advocacy-outcomes.mjs');
+// SIBLINGS, not `$CODE_ROOT/scripts/…` — see the SCRIPTS_DIR note at the top of this file for the
+// measured layouts that made the old path resolve to nothing on every shipped install.
+const SETTINGS_MODULE = process.env.RUVNET_USER_SETTINGS_MODULE || path.join(SCRIPTS_DIR, 'user-settings.mjs');
+const ADVOCACY_MODULE = process.env.RUVNET_ADVOCACY_OUTCOMES_MODULE || path.join(SCRIPTS_DIR, 'advocacy-outcomes.mjs');
 
 // THE 1–5 DIAL (ADR-052). This runtime is the SINGLE enforcement chokepoint (DDD-0004): the level maps
 // to exactly what each channel is allowed to deliver, and no producer decides. LEVEL_POLICY is the one