ruvnet-brain 4.0.12 → 4.0.28

package/plugin/scripts/codex-hook-wrapper.mjs

@@ -10,6 +10,7 @@ const brainHome = process.env.RUVNET_BRAIN_HOME
 const versions = path.join(brainHome, 'versions');
 const blockingHooks = new Set([
   'route-dispatch',
+  'hijack-ruvnet',   // ADR-063: opt-in managed-memory refusal; exits 0 at the default
   'ground-before-write',
   'protect-state',
   'design-wall',

package/plugin/scripts/continuation-gate.mjs

@@ -200,7 +200,135 @@ function artifactOpenWork() {
   } catch { return []; }
 }
 
-const open = [...led.items.filter((i) => !i.done), ...artifactOpenWork()];
+/**
+ * RED CI IS OUTSTANDING WORK. Added 2026-08-06, after the owner asked "is it working? I'm still
+ * getting GitHub errors" while `ci` was red on main and this gate said nothing.
+ *
+ * The SLA source above only knows about ISSUES. A broken build on the branch users install from is
+ * the most urgent kind of unfinished work there is, and it was the one kind the gate could not see —
+ * so the model could finish a turn, report progress, and leave main red, which is exactly the
+ * "stopping in the middle of the work" the owner is describing.
+ *
+ * Read from scripts/signal-watch.mjs's ci-status.json, whose header names it the SINGLE WRITER of
+ * that file. Same discipline as the issues source: only a FRESH observation counts, and only a
+ * RESOLVED-and-failed verdict — a run still in flight is not yet evidence of anything, and treating
+ * it as such would nag through every normal build.
+ */
+function redCiOpenWork() {
+  try {
+    const file = process.env.RUVNET_CI_STATUS_FILE
+      || path.join(HOME, '.cache', 'ruvnet-brain', 'external-signals', 'ci-status.json');
+    const status = JSON.parse(fs.readFileSync(file, 'utf8'));
+    const seen = new Set();
+    return Object.values(status || {})
+      .filter((d) => d?.state === 'resolved' && d.conclusion && d.conclusion !== 'success')
+      .filter((d) => {
+        const at = Date.parse(d.checkedAt || '');
+        return Number.isFinite(at) && nowMs - at <= 6 * 3600_000;
+      })
+      // one item per workflow, not per run — the same red build observed twice is one job to do
+      .filter((d) => (seen.has(d.workflowName) ? false : seen.add(d.workflowName)))
+      .map((d) => ({
+        text: `CI is RED on ${d.repo}: ${d.workflowName} concluded ${d.conclusion} at ${String(d.ref || '').slice(0, 7)}`,
+        done: false,
+        at: d.checkedAt,
+        derived: true,
+      }));
+  } catch { return []; }
+}
+
+/**
+ * AN OPEN PR IS UNFINISHED WORK — the third source, added 2026-08-06.
+ *
+ * WHY, precisely. The two sources above cover an issue past its SLA and a red build. Neither covers
+ * the most common shape of half-finished work there is: a pull request sitting open and green, one
+ * `gh pr merge` from done. Measured that day — #117, #118 and #119 were opened, every required check
+ * passed, and this gate stayed silent at the Stop boundary. It was not malfunctioning: `open` was
+ * genuinely empty, because a PR is neither an issue nor a CI failure and nothing had been written to
+ * the ledger. The owner asked "why the hell have you stopped?" and the honest answer was that the
+ * gate could not see the work. A rule in a memory file cannot fix that; a source can.
+ *
+ * Read from open-issues.json's `prs` array, produced by scripts/issue-watch.mjs — the same file, the
+ * same single producer, the same freshness window as the issues source. No `gh` call happens here:
+ * a Stop hook must not depend on the network, and an artifact that cannot be read is not evidence.
+ *
+ * NARROW ON PURPOSE, so this can never become a permanent nag:
+ *   - `passing` → actionable: merge it. `failing` → actionable: fix it.
+ *   - `pending` → NOT actionable, and deliberately silent. A run in flight is not yet evidence,
+ *     exactly as redCiOpenWork treats an unresolved run. Waiting for CI is not stopping early.
+ *   - `none` (no checks at all) → treated as actionable, because nothing will ever arrive to
+ *     resolve it; leaving it open is a decision someone has to make, not a wait.
+ *   - drafts are already excluded by the producer.
+ * The item self-clears the moment the PR merges or closes, so unlike a ledger entry there is nothing
+ * to remember to mark done — which is the failure that produced this gap in the first place.
+ */
+function openPrWork() {
+  try {
+    const file = process.env.RUVNET_OPEN_ISSUES_FILE
+      || path.join(HOME, '.cache', 'ruvnet-brain', 'open-issues.json');
+    const status = JSON.parse(fs.readFileSync(file, 'utf8'));
+    const observedAt = Date.parse(status?.at || '');
+    if (!Number.isFinite(observedAt) || nowMs - observedAt > 6 * 3600_000) return [];
+    return (Array.isArray(status.prs) ? status.prs : [])
+      .filter((pr) => pr && pr.checksState !== 'pending')
+      .map((pr) => ({
+        text: pr.checksState === 'failing'
+          ? `PR #${pr.number} on ${status.repo} is RED (${pr.failing} failing check(s)) — fix it, do not leave it open: ${pr.title}`
+          : `PR #${pr.number} on ${status.repo} is open and its checks are ${pr.checksState === 'none' ? 'not configured' : 'GREEN'} — merge it or say why not: ${pr.title}`,
+        done: false,
+        at: new Date(observedAt).toISOString(),
+        derived: true,
+      }));
+  } catch { return []; }
+}
+
+/**
+ * WHAT GITHUB EMAILS THE OWNER, HE SHOULD NOT HAVE TO RELAY. Fourth source, 2026-08-06.
+ *
+ * GitHub PUSHES Dependabot, secret-scanning and code-scanning findings to his inbox. Nothing pulled
+ * them into the session, so the only path from "GitHub found a vulnerability" to "the agent knows"
+ * was the owner reading an email and typing it out. His words: "that stuff that keeps coming to me
+ * as an email that I seem to have to tell you and you don't know."
+ *
+ * A published npm package and a signed bundle make this the highest-consequence blind spot of the
+ * four — an unpatched advisory ships to every user of the plugin.
+ *
+ * NARROW, so it stays a signal rather than a backlog:
+ *   - only HIGH and CRITICAL. A permanently non-empty low-severity list is a nag, and this gate is
+ *     worthless the moment it is ignored. Lower severities still reach the Console and the inbox.
+ *   - secret-scanning is ALWAYS included regardless of severity: a live credential in a public repo
+ *     is never "medium", and it is the one finding where minutes matter.
+ *   - collapsed to ONE item per kind, with a count. Twelve advisories is one job — "patch the
+ *     advisories" — not twelve reasons to refuse to stop.
+ */
+function securityAlertWork() {
+  try {
+    const file = process.env.RUVNET_OPEN_ISSUES_FILE
+      || path.join(HOME, '.cache', 'ruvnet-brain', 'open-issues.json');
+    const status = JSON.parse(fs.readFileSync(file, 'utf8'));
+    const observedAt = Date.parse(status?.at || '');
+    if (!Number.isFinite(observedAt) || nowMs - observedAt > 6 * 3600_000) return [];
+    const alerts = (Array.isArray(status.securityAlerts) ? status.securityAlerts : [])
+      .filter((a) => a && (a.kind === 'secret-scanning' || a.severity === 'high' || a.severity === 'critical'));
+    if (!alerts.length) return [];
+    const byKind = new Map();
+    for (const a of alerts) {
+      if (!byKind.has(a.kind)) byKind.set(a.kind, []);
+      byKind.get(a.kind).push(a);
+    }
+    return [...byKind.entries()].map(([kind, list]) => ({
+      text: `${list.length} open ${kind} alert(s) on ${status.repo} — GitHub has already emailed these; highest: ${list[0].title}`,
+      done: false,
+      at: new Date(observedAt).toISOString(),
+      derived: true,
+    }));
+  } catch { return []; }
+}
+
+const open = [
+  ...led.items.filter((i) => !i.done),
+  ...artifactOpenWork(), ...redCiOpenWork(), ...openPrWork(), ...securityAlertWork(),
+];
 if (!open.length) process.exit(EXIT_ALLOW);   // nothing outstanding: silence is correct
 
 /**

package/plugin/scripts/gates.mjs

@@ -0,0 +1,146 @@
+// gates.mjs — what stands between the model and your machine, and what it has caught.
+//
+// ─────────────────────────────────────────────────────────────────────────────────────────────────
+// WHY (2026-07-17). Stuart, looking at the console's wiring card: "I have no idea what message it's
+// supposed to tell me… it seems to be facts without purpose." The card counted launch sites. Nobody
+// wants a census. The question worth answering is the one the harness exists for: WHAT STOPS CLAUDE
+// FROM BEING WRONG, AND HAS IT EVER ACTUALLY STOPPED IT?
+//
+// Two things had to be true before that card could be honest, and neither was:
+//
+//   1. The console never read the gates. wiringSurvey() walks ~/Code project settings only, so the
+//      12 machine-wide hooks in ~/.claude/settings.json and the 9 in the plugin's own hooks.json —
+//      including the design wall that blocks commits — were invisible to the page bragging about them.
+//
+//   2. The gates never recorded a block. Only successes were logged, so "the harness caught Claude"
+//      had no receipt. gate-receipt.sh now writes one at the moment of refusal.
+//
+// THE HONEST DISTINCTION this module exists to draw: a hook wired with `|| true` CANNOT block —
+// it injects context and the tool call proceeds regardless. Only a gate that can exit non-zero
+// stops anything. Counting all hooks as "protection" would be the same inflation as counting
+// cloned upstream repos as your own wiring. Advisory and blocking are different claims.
+//
+// Reads only. Never asserts a count it cannot source from a file on this machine.
+// ─────────────────────────────────────────────────────────────────────────────────────────────────
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const HOME = os.homedir();
+const BLOCKS = path.join(HOME, '.cache/ruvnet-brain/gate-blocks.jsonl');
+
+function readJSON(f) { try { return JSON.parse(fs.readFileSync(f, 'utf8')); } catch { return null; } }
+
+// Two independent things must BOTH be true for a hook to stop anything, and conflating them is how
+// a census gets sold as protection:
+//   1. The EVENT must be one that runs before the thing it would stop. PreToolUse gates a tool call;
+//      UserPromptSubmit gates a prompt. SessionStart has nothing to refuse yet, and PostToolUse /
+//      PreCompact / SessionEnd arrive after the fact — those inject or record, they never block.
+//   2. The COMMAND must not end in `|| true`, which swallows the exit code the gate would refuse with.
+const BLOCKING_EVENTS = new Set(['PreToolUse', 'UserPromptSubmit']);
+const swallowsExit = (cmd) => /\|\|\s*true\s*$/.test(String(cmd || '').trim());
+const canBlock = (event, cmd) => BLOCKING_EVENTS.has(event) && !swallowsExit(cmd);
+
+const NAME = (cmd) => {
+  const m = String(cmd || '').match(/([\w-]+)\.(sh|mjs|js)/);
+  return m ? m[1] : String(cmd || '').split(/\s+/).filter((t) => !t.startsWith('-')).pop()?.slice(0, 28) || 'hook';
+};
+
+function collect(hooksObj, source) {
+  const out = [];
+  for (const [event, groups] of Object.entries(hooksObj || {})) {
+    const list = Array.isArray(groups) ? groups : [groups];
+    for (const g of list) {
+      const hooks = Array.isArray(g?.hooks) ? g.hooks : (g?.command ? [g] : []);
+      for (const h of hooks) {
+        if (!h?.command) continue;
+        out.push({ event, matcher: g?.matcher ?? '*', name: NAME(h.command), blocking: canBlock(event, h.command), source });
+      }
+    }
+  }
+  return out;
+}
+
+// Every catch the gates have recorded. This file only exists once a gate has actually refused
+// something — an empty ledger is an honest "nothing caught yet", never a failure.
+export function gateBlocks() {
+  try {
+    return fs.readFileSync(BLOCKS, 'utf8').trim().split('\n')
+      .map((l) => { try { return JSON.parse(l); } catch { return null; } })
+      .filter(Boolean);
+  } catch { return []; }
+}
+
+export function gatesSurvey({ repo } = {}) {
+  const machine = collect(readJSON(path.join(HOME, '.claude/settings.json'))?.hooks, 'machine');
+  const pluginCfg = repo ? readJSON(path.join(repo, 'plugin/hooks/hooks.json')) : null;
+  const plugin = collect(pluginCfg?.hooks || pluginCfg, 'plugin');
+
+  const all = [...machine, ...plugin];
+  const blocking = all.filter((g) => g.blocking);
+
+  // THE LEDGER IS MACHINE-WIDE; THIS SURVEY IS ABOUT ONE PROJECT. Every catch ever recorded on the
+  // machine used to be counted here, so standing in an empty folder produced "203 refusals have been
+  // recorded" — this repo's history, attributed to a project that has never run a gate. Each record
+  // carries the `cwd` it was caught in, so when a project is named, only its own catches count.
+  //
+  // KNOWN LIMIT, stated rather than hidden: `cwd` is a basename, so two projects sharing a folder
+  // name share a count. That is a real ambiguity and it is narrow; attributing the whole machine's
+  // history to whichever directory you happen to be standing in was neither.
+  const here = repo ? path.basename(path.resolve(repo)) : null;
+  const allBlocks = gateBlocks();
+  const blocks = here ? allBlocks.filter((b) => b.cwd === here) : allBlocks;
+
+  // Same gate, same event, wired both machine-wide AND by the plugin — it runs twice on every
+  // matching call. Harmless to correctness (these gates are idempotent) but it is real duplicated
+  // work, and counting it as two protections would inflate the only number on the card that matters.
+  const seen = new Map();
+  const duplicated = [];
+  for (const g of all) {
+    const k = `${g.event}:${g.name}`;
+    if (seen.has(k) && seen.get(k) !== g.source) { if (!duplicated.includes(g.name)) duplicated.push(g.name); }
+    seen.set(k, g.source);
+  }
+  const uniqueBlocking = new Set(blocking.map((g) => `${g.event}:${g.name}`)).size;
+
+  // Group the catches by gate so the card can say WHAT was caught, not just how many times.
+  const byGate = {};
+  for (const b of blocks) (byGate[b.gate] ||= []).push(b);
+
+  const weekAgo = Date.now() - 7 * 864e5;
+  const recent = blocks.filter((b) => Date.parse(b.at || 0) >= weekAgo);
+
+  // THREE NUMBERS, ONE UNIT. This block used to mix two: `blocking` was DEDUPLICATED
+  // (distinct event:name) while `advisory` was `all.length - blocking.length`, computed from the
+  // RAW array. So `blocking + advisory` fell short of `armed` by exactly the number of duplicated
+  // blocking wirings, and the console printed "N gates armed — B can stop a call. The other A add
+  // context" where B + A ≠ N. On a machine with 4 duplicate blocking gates the sentence silently
+  // lost four of them — in the one sentence whose entire job is to account for all of them.
+  //
+  // It summed correctly on any machine with no duplicates, which is why it survived: the defect was
+  // invisible exactly where it was most often looked at. Found by Fable 5, 2026-07-24, by adding up
+  // the numbers on the owner's own console.
+  //
+  // Fixed by reporting all three in WIRED-ENTRY units, so armed = blocking + advisory holds by
+  // construction. The distinct-gate count is still exported — it is genuinely the more meaningful
+  // number for "how many different things can refuse" — but under its own name, where it cannot be
+  // mistaken for a term in that sum.
+  const blockingWired = blocking.length;
+  return {
+    summary: {
+      armed: all.length,
+      blocking: blockingWired,           // wired entries that can refuse — same unit as `armed`
+      advisory: all.length - blockingWired,
+      blockingDistinct: uniqueBlocking,  // distinct gates that can refuse; ≤ blocking when wired twice
+      duplicated,                        // wired twice; runs twice
+      caughtTotal: blocks.length,
+      caughtThisWeek: recent.length,
+      everRecorded: blocks.length > 0,
+    },
+    gates: all.sort((a, b) => Number(b.blocking) - Number(a.blocking)),
+    // Newest first — the most recent catch is the one worth reading.
+    catches: blocks.slice(-12).reverse(),
+    byGate: Object.fromEntries(Object.entries(byGate).map(([k, v]) => [k, v.length])),
+  };
+}