ruvnet-brain 4.3.33 → 4.3.34

package/README.md

@@ -7,7 +7,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 # 🧠 RuvNet Brain
 
-### 🧠 RuvNet Brain — [![RuvNet Brain version 4.3.33 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.3.33-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
+### 🧠 RuvNet Brain — [![RuvNet Brain version 4.3.34 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.3.34-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
 
 **A portable, source-grounded brain over Reuven Cohen's (rUv's) RuvNet stack — delivered as a Claude Code plugin that makes Claude _use_ the stack instead of fighting it.**
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.3.33",
+  "version": "4.3.34",
   "description": "One-command installer for RuvNet Brain \u2014 a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.3.33",
+  "version": "4.3.34",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.3.33",
+  "version": "4.3.34",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/scripts/agentdb-fleet-doctor.mjs

@@ -49,9 +49,13 @@ async function doctor(proj) {
   const hasSchema = sql(db, 'SELECT count(*) FROM episodes;') !== null;
   if (!hasSchema) row.notes.push('OLD SCHEMA — needs export/init/import migration (see migrate-agentdb-schema.sh)');
 
-  // What can the session-start hook actually see?
-  row.visible = Number(sql(db, `SELECT count(*) FROM memory_entries WHERE namespace='${name}';`) ?? 0);
-  row.checkpoint = Number(sql(db, `SELECT count(*) FROM memory_entries WHERE namespace='${name}' AND key LIKE 'project-state-current%';`) ?? 0) > 0;
+  // What can the session-start hook actually see? `name` is a directory basename the operator
+  // chose on the CLI, not adversarial input -- but a project folder with an apostrophe in its name
+  // would otherwise break this query's syntax, so it gets the same escaping every other SQL
+  // interpolation in this codebase already uses.
+  const escapedName = name.replace(/'/g, "''");
+  row.visible = Number(sql(db, `SELECT count(*) FROM memory_entries WHERE namespace='${escapedName}';`) ?? 0);
+  row.checkpoint = Number(sql(db, `SELECT count(*) FROM memory_entries WHERE namespace='${escapedName}' AND key LIKE 'project-state-current%';`) ?? 0) > 0;
 
   // Foreign-project namespaces: REPORT, never migrate.
   const nsRows = (sql(db, 'SELECT namespace, count(*) FROM memory_entries GROUP BY namespace;') || '')