ruvnet-brain 4.0.7 → 4.0.12

package/scripts/selfcheck.mjs

@@ -159,17 +159,31 @@ export function resolveInstalledSurface({ home = os.homedir(), repo = null } = {
     for (const v of fs.readdirSync(cache)) {
       const root = path.join(cache, v);
       if (fs.existsSync(path.join(root, 'hooks', 'hooks.json'))) {
-        candidates.push({ root, source: `installed:${v}`, mtime: fs.statSync(path.join(root, 'hooks', 'hooks.json')).mtimeMs });
+        candidates.push({ root, source: `installed:${v}`, hooksFile: path.join(root, 'hooks', 'hooks.json'), mtime: fs.statSync(path.join(root, 'hooks', 'hooks.json')).mtimeMs });
       }
     }
   } catch { /* no packed install on this machine */ }
   candidates.sort((a, b) => b.mtime - a.mtime); // newest generation wins; several can coexist
   const clone = path.join(home, '.claude', 'plugins', 'marketplaces', 'ruvnet-brain', 'plugin');
   if (fs.existsSync(path.join(clone, 'hooks', 'hooks.json'))) {
-    candidates.push({ root: clone, source: 'marketplace-clone', mtime: 0 });
+    candidates.push({ root: clone, source: 'marketplace-clone', hooksFile: path.join(clone, 'hooks', 'hooks.json'), mtime: 0 });
   }
+  // Codex installs the same immutable payload under its own cache. A Codex-only machine has no
+  // Claude marketplace clone, so treating that layout as "no plugin" made the real installed
+  // Codex hooks impossible to self-check (the release host matrix caught this). Keep the same
+  // newest-generation rule and read the Codex hook registry from the installed payload itself.
+  const codexCache = path.join(home, '.codex', 'plugins', 'cache', 'ruvnet-brain', 'ruvnet-brain');
+  try {
+    for (const v of fs.readdirSync(codexCache)) {
+      const root = path.join(codexCache, v);
+      if (fs.existsSync(path.join(root, 'hooks', 'codex-hooks.json'))) {
+        candidates.push({ root, source: `codex-installed:${v}`, hooksFile: path.join(root, 'hooks', 'codex-hooks.json'), mtime: fs.statSync(path.join(root, 'hooks', 'codex-hooks.json')).mtimeMs, codex: true });
+      }
+    }
+  } catch { /* no Codex plugin cache on this machine */ }
   if (repo && fs.existsSync(path.join(repo, 'plugin', 'hooks', 'hooks.json'))) {
-    candidates.push({ root: path.join(repo, 'plugin'), source: 'checkout', mtime: 0 });
+    const root = path.join(repo, 'plugin');
+    candidates.push({ root, source: 'checkout', hooksFile: path.join(root, 'hooks', 'hooks.json'), mtime: 0 });
   }
   const chosen = candidates[0];
   if (!chosen) return { ok: false, reason: 'no installed ruvnet-brain plugin payload found on this machine' };
@@ -177,8 +191,9 @@ export function resolveInstalledSurface({ home = os.homedir(), repo = null } = {
     ok: true,
     root: chosen.root,
     source: chosen.source,
-    hooksFile: path.join(chosen.root, 'hooks', 'hooks.json'),
+    hooksFile: chosen.hooksFile,
     shimFile: path.join(chosen.root, 'scripts', 'hook-shim.mjs'),
+    codex: Boolean(chosen.codex),
     alternates: candidates.slice(1).map((c) => c.source),
   };
 }
@@ -480,7 +495,7 @@ export async function runBattery({ home = os.homedir(), repo = null, cwd = os.tm
     const shimId = reg.shimIdIn(r.command);
     const entry = shimId ? table[shimId] : null;
     const contract = entry ? null : contracts.find((c) => reg.contractMatches(c, { layer: 'plugin', event: r.event, matcher: r.matcher, command: r.command }));
-    const mode = entry?.mode ?? contract?.mode ?? null;
+    const mode = entry?.mode ?? contract?.mode ?? (s.codex ? 'advisory' : null);
     const handler = entry?.file ?? reg.basenamesIn(r.command).filter((b) => b !== 'hook-shim.mjs').pop() ?? null;
     const rec = { ...r, handler, shimId, mode };
 

package/scripts/staged-host-verifier.mjs

@@ -3,6 +3,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { runHostMatrix } from './host-install-matrix.mjs';
 
 const sha256 = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
 const locate = (name) => {
@@ -18,15 +19,9 @@ const run = (name, args, options) => {
   return result;
 };
 
-export function classifyDoctorResult(result) {
-  const output = `${result.stdout || ''}\n${result.stderr || ''}`;
-  if (!result.error && result.status === 0) return { accepted: true, status: 'PASS', output };
-  const pendingReview = result.status === 1
-    && /Codex installed the Brain, but \d+ lifecycle hooks await review/i.test(output)
-    && /Grounding PROVEN/i.test(output)
-    && !/reader MISSING|search_ruvnet MISSING|host convergence incomplete|receipt is invalid/i.test(output);
-  return { accepted: pendingReview, status: pendingReview ? 'PENDING_REVIEW' : 'FAIL', output };
-}
+// The doctor verdict has ONE rule, in host-install-matrix.mjs. This name is kept because
+// tests/unit/staged-host-verifier.test.mjs pins it, but it is now an alias, not a second copy.
+export { classifyDoctor as classifyDoctorResult } from './host-install-matrix.mjs';
 
 const preparePackage = ({ packagePath, bundlePath }) => {
   const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-staged-host-'));
@@ -43,61 +38,36 @@ const preparePackage = ({ packagePath, bundlePath }) => {
   return { temp, packageRoot };
 };
 
-const fixturePath = (mode, temp) => {
-  const bin = path.join(temp, `bin-${mode}`);
-  fs.mkdirSync(bin);
-  const hosts = mode === 'claude' ? ['claude'] : mode === 'codex' ? ['codex'] : ['claude', 'codex'];
-  const desired = ['node', 'npm', ...hosts];
-  for (const name of desired) {
-    const target = locate(name);
-    if (!target) throw new Error(`${name} CLI unavailable for ${mode} host fixture`);
-    fs.symlinkSync(target, path.join(bin, name));
-  }
-  return `${bin}:/usr/bin:/bin`;
-};
-
 export function stagedHostVerifier({ assets, identity }) {
   return {
     async verify({ source, assets: observedAssets = assets }) {
       const prepared = preparePackage(observedAssets);
-      const results = {};
       try {
-        for (const mode of ['claude', 'codex', 'dual']) {
-          const home = path.join(prepared.temp, `home-${mode}`);
-          const brainHome = path.join(home, '.cache', 'ruvnet-brain');
-          fs.mkdirSync(path.join(home, '.claude'), { recursive: true });
-          if (mode !== 'claude') fs.mkdirSync(path.join(home, '.codex'), { recursive: true });
-          const env = {
-            ...process.env,
-            HOME: home,
-            CODEX_HOME: path.join(home, '.codex'),
-            RUVNET_BRAIN_HOME: brainHome,
-            RUVNET_BRAIN_KB: path.join(brainHome, 'kb'),
-            RUVNET_CLAUDE_MARKETPLACE_SOURCE: prepared.packageRoot,
-            CI: 'true',
-            PATH: fixturePath(mode, prepared.temp),
-          };
-          const installer = path.join(prepared.packageRoot, 'bin', 'install.mjs');
-          run(process.execPath, [installer, '--local', '--yes', '--force', '--no-nightly-prompt',
-            '--no-telemetry', '--no-stack', '--no-enhance', '--no-statusline', '--no-selfcheck'], {
-            cwd: prepared.packageRoot, env, timeout: 1_200_000,
-          });
-          const doctor = spawnSync(process.execPath, [installer, '--doctor'], {
-            cwd: prepared.packageRoot, env, timeout: 180_000,
-          });
-          const classified = classifyDoctorResult(doctor);
-          if (!classified.accepted) {
-            throw new Error(`doctor failed for ${mode}: ${classified.output.slice(-5000) || doctor.error?.message}`);
-          }
-          results[mode] = {
-            status: classified.status,
-            doctorExit: doctor.status,
-            version: identity.version,
-          };
+        // The loop, the mode names, the env and the doctor verdict all live in
+        // scripts/host-install-matrix.mjs, shared with the published-side check in
+        // publication-receipt.mjs. This file used to carry its own copy, which had drifted to
+        // different mode names (claude/codex/dual vs claudeOnly/codexOnly/dual) and a different
+        // install shape than the one that runs after publication — so the two halves of a release
+        // were judging different things and could not be compared. Only the STAGED-vs-PUBLISHED
+        // difference is real, and it is now a named variant rather than a second implementation.
+        const matrix = runHostMatrix({
+          packageRoot: prepared.packageRoot,
+          version: identity.version,
+          variant: 'staged',
+          locate,
+          temp: prepared.temp,
+        });
+        if (matrix.verdict !== 'PASS') {
+          return { verdict: 'FAIL', source, error: matrix.error, fixtures: matrix.fixtures };
         }
-        return { verdict: 'PASS', source, artifactSha256: sha256(observedAssets.packagePath), fixtures: results };
+        return {
+          verdict: 'PASS',
+          source,
+          artifactSha256: sha256(observedAssets.packagePath),
+          fixtures: matrix.fixtures,
+        };
       } catch (error) {
-        return { verdict: 'FAIL', error: error.message, fixtures: results };
+        return { verdict: 'FAIL', source, error: error.message, fixtures: {} };
       } finally {
         fs.rmSync(prepared.temp, { recursive: true, force: true });
       }

package/scripts/sync-version.mjs

@@ -113,16 +113,16 @@ for (const rel of ['kb/RVF-GENERATIONS.json']) {
 
 if (CHECK && fs.existsSync(path.join(ROOT, 'kb/RVF-GENERATIONS.json'))) {
   const kbDir = path.join(ROOT, 'kb');
-  const requiredStores = fs.readdirSync(kbDir)
-    .filter((file) => file.endsWith('.big.rvf'))
-    .map((file) => file.slice(0, -'.big.rvf'.length));
-  // CI/source-only clones intentionally omit the gitignored RVF binaries. In that shape, validate
-  // the committed ledger's version fields but defer byte checks to bundle assembly, where the RVFs
-  // are present. A checkout containing any canonical RVF remains fail-closed for every ledger row.
-  const { failures } = verifyRvfGenerations(kbDir, {
-    requiredStores,
-    allowMissingFiles: requiredStores.length === 0,
-  });
+  // Validate the committed ledger's version fields ONLY. The previous form scanned the working
+  // directory for `*.big.rvf` and byte-compared every ledger row against whatever this machine
+  // happened to have — but those binaries are gitignored, so the verdict described the machine, not
+  // the commit. It was unsatisfiable in practice (ledger: 72 stores; a real checkout: 71, because
+  // the nightly rebuilds RVFs and regenerates the ledger as one step) and it blocked every push,
+  // tags included, while pointing at a remedy that cannot clear it. Byte verification now happens
+  // where the bytes are genuinely present and genuinely shipped: scripts/build-bundle.mjs:204-214.
+  // This is the same rule release.mjs:100 already applies — a verdict is only about the committed
+  // candidate.
+  const { failures } = verifyRvfGenerations(kbDir, { verifyBytes: false });
   for (const failure of failures) {
     console.error(`[version] RVF GENERATION DRIFT: ${failure}`);
     drift++;