ruvnet-brain 4.4.0 → 4.5.0

package/plugin/scripts/hook-input.mjs

@@ -29,11 +29,85 @@
 import fs from 'node:fs';
 import { fileURLToPath } from 'node:url';
 
-/** Parse the raw stdin payload into the hook event object, or null if it isn't valid JSON. */
+// ── GROK CLI PAYLOADS (4.5) ──────────────────────────────────────────────────────────────────────
+//
+// Grok CLI runs Claude-format hooks (its docs: ~/.grok/docs/user-guide/10-hooks.md, "Hook Locations"
+// and "Tool Name Aliases"), but its payload is not Claude's. Captured from grok 1.0.13
+// (tests/fixtures/hook-payloads/grok/):
+//   · event names are snake_case: hook_event_name "pre_tool_use", "stop", "user_prompt_submit";
+//   · tool names are Grok's own: the measured file tool is `write` (docs also name `search_replace`,
+//     and `run_terminal_command` / `run_terminal_cmd` for the shell);
+//   · camelCase fields (hookEventName, toolName, toolInput, toolResult, stopHookActive,
+//     lastAssistantMessage) with snake_case duplicates for SOME of them only — the Stop payload has no
+//     `stop_hook_active` and no `last_assistant_message` at all.
+// A Grok matcher written with Claude names still fires (Grok aliases Write→its tool in the MATCHER), but
+// the payload keeps the native name — so every policy that compared tool_name to "Write" saw "write" and
+// silently allowed. Normalising HERE, in the one parser, means every consumer reads Claude's shape.
+// Only a payload that is recognisably Grok's is rewritten; a Claude or Codex payload comes back untouched.
+export const GROK_TOOL_ALIASES = Object.freeze({
+  write: 'Write', search_replace: 'Edit', edit: 'Edit', multi_edit: 'MultiEdit',
+  run_terminal_command: 'Bash', run_terminal_cmd: 'Bash', read_file: 'Read', grep: 'Grep',
+  list_dir: 'Glob', web_search: 'WebSearch', web_fetch: 'WebFetch', spawn_subagent: 'Task', task: 'Task',
+});
+
+/** True for a payload in Grok's shape (camelCase envelope, or a snake_case lowercase event name). */
+export function isGrokEvent(ev) {
+  if (!ev || typeof ev !== 'object') return false;
+  if (typeof ev.hookEventName === 'string') return true;
+  return typeof ev.hook_event_name === 'string' && /^[a-z]+(?:_[a-z]+)+$|^stop$/.test(ev.hook_event_name);
+}
+
+const pascalEvent = (e) => String(e).split('_').filter(Boolean).map((x) => x[0].toUpperCase() + x.slice(1)).join('');
+
+/** Claude's tool name for a host tool name (Grok's `write` → `Write`); unknown names pass through. */
+export function canonicalToolName(name) {
+  const s = typeof name === 'string' ? name : '';
+  return Object.prototype.hasOwnProperty.call(GROK_TOOL_ALIASES, s) ? GROK_TOOL_ALIASES[s] : s;
+}
+
+/**
+ * Is this a FILE-WRITE tool, on any host? Case-insensitive, so a host that spells Write in another case
+ * (Grok's `write`) can never walk past a write guard again. apply_patch is Codex's raw name.
+ */
+const WRITE_TOOLS = new Set(['write', 'edit', 'multiedit', 'multi_edit', 'notebookedit', 'search_replace', 'apply_patch']);
+export function isWriteTool(name) {
+  return typeof name === 'string' && WRITE_TOOLS.has(name.toLowerCase());
+}
+
+/** A Claude-shaped copy of a Grok payload; any other payload is returned as-is (same object). */
+export function normalizeHostEvent(ev) {
+  if (!isGrokEvent(ev)) return ev;
+  const out = { ...ev };
+  const set = (snake, camel) => { if (out[snake] === undefined && ev[camel] !== undefined) out[snake] = ev[camel]; };
+  out.hook_event_name = pascalEvent(ev.hook_event_name || ev.hookEventName || '');
+  set('session_id', 'sessionId');
+  set('transcript_path', 'transcriptPath');
+  set('permission_mode', 'permissionMode');
+  set('tool_input', 'toolInput');
+  set('tool_response', 'toolResult');
+  set('tool_use_id', 'toolUseId');
+  set('stop_hook_active', 'stopHookActive');
+  set('last_assistant_message', 'lastAssistantMessage');
+  const native = typeof ev.tool_name === 'string' ? ev.tool_name : (typeof ev.toolName === 'string' ? ev.toolName : undefined);
+  if (native !== undefined) {
+    out.tool_name = canonicalToolName(native);
+    if (out.tool_name !== native) out.host_tool_name = native;
+  }
+  out.host = 'grok';
+  return out;
+}
+
+/** The raw payload TEXT, rewritten to Claude's shape only when it is a Grok payload (else unchanged bytes). */
+export function normalizePayloadText(raw) {
+  const ev = (() => { try { const j = JSON.parse(raw); return j && typeof j === 'object' ? j : null; } catch { return null; } })();
+  return ev && isGrokEvent(ev) ? JSON.stringify(normalizeHostEvent(ev)) : raw;
+}
+
+/** Parse the raw stdin payload into the hook event object (Claude-shaped), or null if it isn't valid JSON. */
 export function parseHookEvent(raw) {
   try {
     const j = JSON.parse(raw);
-    return j && typeof j === 'object' ? j : null;
+    return j && typeof j === 'object' ? normalizeHostEvent(j) : null;
   } catch {
     return null;
   }
@@ -107,13 +181,13 @@ export async function readStopHookInput() {
   if (process.stdin.isTTY) return { __source: 'tty' };
   try {
     const raw = (await readStdinBounded()).toString('utf8');
-    return { ...JSON.parse(raw || '{}'), __source: 'stdin' };
+    return { ...normalizeHostEvent(JSON.parse(raw || '{}')), __source: 'stdin' };
   } catch { return { __source: 'unreadable' }; }
 }
 
 /** The tool being invoked ("Bash", "Write", …), or "" if absent. */
 export function toolName(ev) {
-  return ev && typeof ev.tool_name === 'string' ? ev.tool_name : '';
+  return ev && typeof ev.tool_name === 'string' ? canonicalToolName(ev.tool_name) : '';
 }
 
 /**

package/plugin/scripts/kb-copy-proof.mjs

@@ -0,0 +1,148 @@
+// DISTINCT-FROM: kb/forge-update.mjs reclaimBackups/assertRedundantBackup — that proof requires every byte of a copy to survive in live, which no older generation satisfies; this one requires byte-identity only for private-store files and public provenance for stores the live brain lacks (ADR-0098).
+//
+// kb-copy-proof.mjs — may a full copy of the knowledge base be deleted? The ONE proof used by the
+// footprint sweep (plugin/scripts/brain-footprint.mjs) and by the installer right after it activates a
+// new generation (bin/install.mjs unzipInto). Pure read; never follows a link; never writes.
+//
+// A copy is DISPOSABLE only when nothing in it is unique. Every file must be one of:
+//   * a PRIVATE-store file (names from the PRIVATE-STORES.json fence of the live brain AND of the copy, plus
+//     every updateManaged:false store in either SOURCE.json; membership rule = kb/forge-update.mjs
+//     capturePrivateOverlayState) that exists BYTE-IDENTICAL at the same path in the live brain — nothing
+//     else excuses a private file;
+//   * a public release file: listed with these exact bytes in the copy's own ARCHIVE-MANIFEST.json, or a
+//     name the live generation ships, or a member of a public store family (named by either COVERAGE.json
+//     or the live SOURCE.json) that a newer release replaced or retired;
+//   * installer-written or reinstallable (node_modules/, the updater/validator files the installer places);
+//   * a symbolic link identical in the live brain (links are compared, never followed).
+// Anything else — a user's own file, an unfenced store, a link the live brain lacks — KEEPS the copy, and
+// is named. The live brain itself must be present, so a copy is never removed while it may be the only one.
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { isVolumeMetadata } from './footprint-io.mjs';
+
+const readJson = (file) => { try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; } };
+const lstat = (file) => { try { return fs.lstatSync(file); } catch { return null; } };
+const names = (dir) => { try { return fs.readdirSync(dir).sort(); } catch { return []; } };
+const sha256File = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+
+/** Every regular file and link under `root`, relative, without following links. macOS volume metadata
+ * (AppleDouble `._*` shadows on an exFAT disk, .DS_Store, …) is the volume's, never a copy's unique data. */
+function walk(root, prefix = '', out = []) {
+  for (const name of names(path.join(root, prefix)).filter((n) => !isVolumeMetadata(n))) {
+    const relative = prefix ? path.join(prefix, name) : name;
+    const st = lstat(path.join(root, relative));
+    if (!st) continue;
+    if (st.isSymbolicLink()) out.push({ relative, link: true });
+    else if (st.isDirectory()) walk(root, relative, out);
+    else if (st.isFile()) out.push({ relative, link: false, size: st.size });
+  }
+  return out;
+}
+
+const storeList = (source) => {
+  const stores = source?.stores;
+  if (Array.isArray(stores)) return stores;
+  return stores && typeof stores === 'object' ? Object.entries(stores).map(([kbName, value]) => ({ kbName, ...value })) : [];
+};
+const stemOf = (file) => path.basename(String(file)).replace(/(?:\.big)?\.rvf$/i, '').toLowerCase();
+// The store a sidecar belongs to: <store>.big.rvf[.embed|.idmap].json, <store>.meta.json, <store>.passages.jsonl,
+// <store>.symbols.json, <store>-primer.md.
+const storeStem = (file) => path.basename(String(file)).toLowerCase()
+  .replace(/-primer\.md$/, '').replace(/(?:\.big)?\.rvf(?:\.[a-z]+\.json)?$/, '').replace(/\.(?:meta|symbols)\.json$|\.passages\.jsonl$/, '');
+// Files the installer/updater writes into a KB that no bundle ships (bin/install.mjs placeUpdater,
+// placeTrustedCoverageValidator, ensureVerifier; the updater's snapshot receipt). Re-created on every install.
+const INSTALLER_WRITTEN = new Set(['coverage-integrity.mjs', 'RUNTIME-IDENTITY.json', '.refresh-snapshot.json',
+  'forge-update.mjs', 'zip-extract.mjs', 'brain-profile.mjs', 'refresh-run.mjs', 'update-storage-transaction.mjs',
+  'lifecycle-evidence-retention.mjs', 'corpus-release-identity.mjs', 'verify-citation.mjs', 'package-lock.json', '.DS_Store']);
+
+/** A directory that is a knowledge-base tree (SOURCE.json plus a store or the search entry point). */
+export const isKbTree = (dir) => Boolean(lstat(path.join(dir, 'SOURCE.json')))
+  && names(dir).some((n) => /\.rvf$/i.test(n) || n === 'forge-mcp-all.mjs');
+
+/** Private store names the given trees declare: PRIVATE-STORES.json fences and updateManaged:false stores. */
+export function privateStoreNames(dirs) {
+  const out = new Set();
+  for (const dir of dirs) {
+    const fence = readJson(path.join(dir, 'PRIVATE-STORES.json'))?.privateStores;
+    for (const name of Array.isArray(fence) ? fence : []) out.add(String(name).toLowerCase());
+    for (const store of storeList(readJson(path.join(dir, 'SOURCE.json')))) {
+      if (store?.updateManaged === false && store.kbName) out.add(String(store.kbName).toLowerCase());
+    }
+  }
+  return out;
+}
+
+/** The capturePrivateOverlayState membership rule (kb/forge-update.mjs), applied to one relative path. */
+function belongsToPrivate(relative, privateNames, privateArtifacts) {
+  const base = path.basename(relative).toLowerCase();
+  for (const name of privateNames) if (base === name || base.startsWith(`${name}.`) || base.startsWith(`${name}-`)) return true;
+  return privateArtifacts.some(({ directory, basename, stem }) => path.dirname(relative) === directory
+    && (base === basename || base.startsWith(`${basename}.`) || base.startsWith(`${stem}.`) || base.startsWith(`${stem}-`)));
+}
+
+const sameBytes = (left, right) => {
+  const a = lstat(left); const b = lstat(right);
+  if (!a || !b || !a.isFile() || !b.isFile() || a.isSymbolicLink() || b.isSymbolicLink() || a.size !== b.size) return false;
+  try { return sha256File(left) === sha256File(right); } catch { return false; }
+};
+
+/**
+ * @returns {{disposable: boolean, unique: {file: string, why: string}[], reason: string}} — a kept copy
+ * always names the files that keep it.
+ */
+export function kbCopyProof({ copyDir, liveDir }) {
+  const copy = lstat(copyDir);
+  if (!copy || copy.isSymbolicLink() || !copy.isDirectory()) return { disposable: false, unique: [], reason: 'not a real directory (a link is never entered)' };
+  const live = lstat(liveDir);
+  if (!live || !live.isDirectory() || !readJson(path.join(liveDir, 'SOURCE.json'))
+    || !names(liveDir).some((name) => /\.rvf$/i.test(name))) {
+    return { disposable: false, unique: [], reason: 'the live brain is missing or incomplete, so this copy may be the only good one' };
+  }
+  const privateNames = privateStoreNames([liveDir, copyDir]);
+  const generations = readJson(path.join(copyDir, 'RVF-GENERATIONS.json'))?.stores || {};
+  const privateArtifacts = Object.entries(generations).filter(([name]) => privateNames.has(name.toLowerCase()))
+    .map(([, g]) => String(g?.file || '')).filter(Boolean).map((file) => ({ directory: path.dirname(path.normalize(file)),
+      basename: path.basename(file).toLowerCase(), stem: stemOf(file) }));
+  const coverageNames = (dir) => (readJson(path.join(dir, 'COVERAGE.json'))?.rows || [])
+    .flatMap((row) => [row?.artifact?.store, row?.name]).filter(Boolean).map((n) => String(n).toLowerCase());
+  const publicNames = new Set([...coverageNames(liveDir), ...coverageNames(copyDir),
+    ...storeList(readJson(path.join(liveDir, 'SOURCE.json'))).filter((s) => s?.updateManaged !== false)
+      .map((s) => String(s.kbName || '').toLowerCase())]);
+  for (const name of privateNames) publicNames.delete(name); // a fenced name is never "public provenance"
+  // The copy's own signed release manifest (scripts/build-bundle.mjs, every bundle since 2026-08-23): a file
+  // it lists with these exact bytes is a public, re-downloadable release file.
+  const shipped = new Map((readJson(path.join(copyDir, 'ARCHIVE-MANIFEST.json'))?.files || [])
+    .filter((f) => typeof f?.path === 'string').map((f) => [path.normalize(f.path), f]));
+  const unique = [];
+  let files;
+  try { files = walk(copyDir); } catch (error) { return { disposable: false, unique, reason: `unreadable copy: ${error.message}` }; }
+  for (const { relative, link, size } of files) {
+    // node_modules (npm reinstalls it) and .console-runtime (bin/install.mjs installConsoleRuntime re-places it)
+    if (['node_modules', '.console-runtime'].includes(relative.split(path.sep)[0])
+      || (!relative.includes(path.sep) && INSTALLER_WRITTEN.has(relative))) continue;
+    const isPrivate = belongsToPrivate(relative, privateNames, privateArtifacts);
+    const inLive = path.join(liveDir, relative);
+    if (link) {
+      const liveLink = lstat(inLive);
+      const same = liveLink?.isSymbolicLink() && fs.readlinkSync(inLive) === fs.readlinkSync(path.join(copyDir, relative));
+      if (!same) unique.push({ file: relative, why: 'a symbolic link the live brain does not have (never followed)' });
+      continue;
+    }
+    if (isPrivate) {
+      if (!sameBytes(path.join(copyDir, relative), inLive)) {
+        unique.push({ file: relative, why: lstat(inLive) ? 'private file differs from the live brain' : 'private file absent from the live brain' });
+      }
+      continue;
+    }
+    if (relative === 'ARCHIVE-MANIFEST.json' && shipped.size) continue; // the release manifest itself
+    const listed = shipped.get(relative);
+    if (listed && listed.bytes === size && listed.sha256 === sha256File(path.join(copyDir, relative))) continue;
+    if (lstat(inLive)) continue; // a release-owned name the live generation ships (same or newer bytes)
+    if (publicNames.has(storeStem(relative))) continue; // a public store family a newer release replaced or retired
+    unique.push({ file: relative, why: 'not in the live brain, not in this copy\'s release manifest, not a public store' });
+  }
+  return unique.length
+    ? { disposable: false, unique, reason: `holds ${unique.length} file(s) the live brain does not: ${unique.slice(0, 4).map((u) => u.file).join(', ')}${unique.length > 4 ? ', …' : ''}` }
+    : { disposable: true, unique, reason: 'every private file is byte-identical in the live brain; public bytes are re-downloadable' };
+}

package/plugin/scripts/lesson-bridge.mjs

@@ -23,6 +23,7 @@ import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { makeLesson, updateLessons, loadLessons, ENFORCEMENT, ORIGIN, STATUS, TRIGGERS } from './lesson-store.mjs';
+import { loadNodeSqlite } from './node-sqlite.mjs';
 
 /** Every bridged lesson id starts with this. It is how a merge knows which rows it owns. */
 export const BRIDGE_PREFIX = 'G-';
@@ -108,8 +109,11 @@ export function readProjectRows(dbPath = PROJECT_DB) {
   } catch { return []; }
 }
 
-/** Indirection so a missing node:sqlite is a caught throw rather than a module-load crash. */
-function require$(id) { return process.getBuiltinModule ? process.getBuiltinModule(id) : null; }
+/**
+ * Indirection so a missing node:sqlite is a caught throw rather than a module-load crash, loaded
+ * through node-sqlite.mjs so Node 22's SQLite ExperimentalWarning never reaches hook output.
+ */
+function require$(id) { return id === 'node:sqlite' ? loadNodeSqlite() : (process.getBuiltinModule ? process.getBuiltinModule(id) : null); }
 
 // ── Row → lesson ─────────────────────────────────────────────────────────────────────────────────
 

package/plugin/scripts/nightly-controller.mjs

@@ -73,6 +73,11 @@ export function nightlyStatus(options = {}) {
     testMode: options.testMode ?? env.RUVNET_BRAIN_SCHEDULER_TEST === '1' });
 }
 
+export function stripAnsi(text) {
+  // eslint-disable-next-line no-control-regex
+  return String(text).replace(/\u001b\[[0-9;]*[A-Za-z]/g, '');
+}
+
 export function applyNightlyChoice(enabled, options = {}) {
   if (typeof enabled !== 'boolean') return { ok: false, log: 'nightly must be true or false' };
   const env = schedulerEnvironment(options.env || process.env);
@@ -97,6 +102,8 @@ export function applyNightlyChoice(enabled, options = {}) {
     after,
     log: ok
       ? `Nightly refresh is ${desired}; ${after.evidence}.`
-      : `Nightly refresh did not reach ${desired}: ${run.error?.message || run.stderr?.trim() || run.stdout?.trim() || `exit ${run.status}`}`,
+      // The installer colours its terminal output; this string is shown in the console page, where
+      // raw ANSI escapes render as "[31m✗" noise (RNBC QA 2026-10-01). Strip them here, once.
+      : `Nightly refresh did not reach ${desired}: ${stripAnsi(run.error?.message || run.stderr?.trim() || run.stdout?.trim() || `exit ${run.status}`)}`,
   };
 }

package/plugin/scripts/node-sqlite.mjs

@@ -0,0 +1,41 @@
+/**
+ * node-sqlite.mjs — the ONE way plugin code loads `node:sqlite`, lazily and without hook noise.
+ *
+ * WHY (measured 2026-10-01, Node 22.13.1 locally and Node 22 on the Linux CI full suite, run 36894944735):
+ * on Node 22 the first load of `node:sqlite` prints
+ *   (node:PID) ExperimentalWarning: SQLite is an experimental feature and might change at any time
+ * to stderr. SessionStart reads the store through project-progression-reader.mjs, so every SessionStart
+ * in an adopted git project on Node 22 carried that line — hook noise a customer sees on every session.
+ * Node 24 does not warn, which is why the owner's machine never showed it.
+ *
+ * WHAT: the module is required only when a caller actually needs it (never at import time), and during
+ * that one synchronous require `process.emitWarning` drops exactly ONE warning shape — type
+ * ExperimentalWarning whose message names SQLite — and passes every other warning through untouched.
+ * The original `process.emitWarning` is restored before returning, whether the require worked or not.
+ * Node's emitExperimentalWarning calls the public process.emitWarning synchronously while the builtin
+ * is being compiled (node:internal/util emitExperimentalWarning), which is what makes the scope exact.
+ */
+import { createRequire } from 'node:module';
+
+const requireBuiltin = createRequire(import.meta.url);
+let loaded;
+
+/** True for the one warning this module exists to keep out of hook output. */
+export function isSqliteExperimentalWarning(warning, typeOrOptions) {
+  const type = typeof typeOrOptions === 'string' ? typeOrOptions : typeOrOptions?.type;
+  const name = warning && typeof warning === 'object' ? warning.name : undefined;
+  const message = typeof warning === 'string' ? warning : warning?.message;
+  return (type === 'ExperimentalWarning' || name === 'ExperimentalWarning') && /\bSQLite\b/.test(String(message ?? ''));
+}
+
+/** The `node:sqlite` module, or null where this Node has none. Loaded once; never warns about SQLite. */
+export function loadNodeSqlite({ load = (id) => requireBuiltin(id) } = {}) {
+  if (loaded !== undefined) return loaded;
+  const original = process.emitWarning;
+  process.emitWarning = function emitWarningExceptSqlite(warning, ...rest) {
+    if (isSqliteExperimentalWarning(warning, rest[0])) return undefined;
+    return original.call(this, warning, ...rest);
+  };
+  try { loaded = load('node:sqlite'); } catch { loaded = null; } finally { process.emitWarning = original; }
+  return loaded;
+}