ruvnet-brain 4.5.7 → 4.5.9

package/plugin/scripts/grounding-code-projection.mjs

@@ -0,0 +1,85 @@
+// Optional conservative #373 projection. Uncertainty keeps the original raw bash gate.
+// Keep executable strings and paths: mentioning a product in code still requires grounding.
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+export function codeWithoutInertText(source, python = false) {
+  if (/\r(?!\n)|[\u2028\u2029]/.test(source)) throw new Error('Unsupported line boundary');
+  // Template interpolation and Python f-string expressions need a parser, not a guessed lexer.
+  if ((!python && source.includes('`')) || (python && /(?:^|[^\w])(?:fr|rf|f)["']/i.test(source))) throw new Error('Interpolation requires original scan');
+  if (python) {
+    // A different source decoder can turn apparent comments into executable statements.
+    for (const line of source.split(/\r?\n/).slice(0, 2)) {
+      const cookie = line.match(/^[ \t\f]*#.*?coding[=:][ \t]*([^ \t\r\n]+)/i);
+      if (cookie && !/^utf[-_]?8$/i.test(cookie[1])) throw new Error('Unsupported source encoding');
+    }
+    if (/\\\r?\n/.test(source)) throw new Error('Continuation requires original scan');
+  }
+  let out = ''; let i = 0;
+  while (i < source.length) {
+    const c = source[i]; const pair = source.slice(i, i + 2);
+    if ((python && c === '#') || (!python && pair === '//')) {
+      const end = source.indexOf('\n', i); i = end < 0 ? source.length : end; continue;
+    }
+    if (!python && pair === '/*') {
+      const end = source.indexOf('*/', i + 2); if (end < 0) throw new Error('Incomplete comment');
+      out += ' '; i = end + 2; continue;
+    }
+    if (c === '"' || c === "'" || (!python && c === '`')) {
+      const start = i; const triple = python && source.slice(i, i + 3) === c.repeat(3);
+      const delimiter = triple ? c.repeat(3) : c;
+      i += delimiter.length;
+      let closed = false;
+      while (i < source.length) {
+        if (source[i] === '\\') { i += 2; continue; }
+        if (source.slice(i, i + delimiter.length) === delimiter) { i += delimiter.length; closed = true; break; }
+        if (!triple && c !== '`' && /[\r\n]/.test(source[i])) throw new Error('Incomplete string');
+        i++;
+      }
+      if (!closed) throw new Error('Incomplete string');
+      // Exempt only a leading module docstring before any executable text. Standalone-looking
+      // literals inside functions, open expressions or control flow retain the original scan.
+      const before = source.slice(source.lastIndexOf('\n', start - 1) + 1, start);
+      const endOfLine = source.indexOf('\n', i); const after = source.slice(i, endOfLine < 0 ? source.length : endOfLine);
+      const inert = triple && out.trim() === '' && !/\b(?:exec|eval|compile|__doc__)\b/.test(source) && /^[ \t]*$/.test(before) && /^[ \t\r]*(?:#.*)?$/.test(after);
+      out += inert ? ' ' : source.slice(start, i); continue;
+    }
+    // Regex literals, heredocs, language-specific nested comments etc. are not guessed.
+    if (!python && c === '/') throw new Error('Ambiguous slash');
+    if (!python && pair === '<' + '<') throw new Error('Unsupported heredoc');
+    out += c; i++;
+  }
+  return out;
+}
+
+export function projectGroundingInput(raw) {
+  const event = JSON.parse(raw); const input = event.tool_input ?? event.toolInput;
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('Unknown write input');
+  const file = input.file_path; if (typeof file !== 'string') throw new Error('Unknown path');
+  // Limited lexical scope; other languages retain their existing strict gate.
+  if (!/\.(?:py|[cm]?js|jsx|ts|tsx)$/.test(file)) throw new Error('Unsupported language');
+  // Partial edits have no enclosing lexical context. Only complete Write or a verified
+  // single Add File patch may receive an exemption; never reconstruct user files here.
+  const tool = event.tool_name ?? event.toolName;
+  let code;
+  if (tool === 'Write' && typeof input.content === 'string' && !Object.hasOwn(input, 'edits')) {
+    code = input.content;
+  } else if (tool === 'Edit' && typeof input.new_string === 'string' && input.new_string.startsWith('*** Begin Patch')) {
+    const lines = input.new_string.trimEnd().split(/\r?\n/);
+    if (lines[0] !== '*** Begin Patch' || lines[1] !== `*** Add File: ${file}`
+      || lines.at(-1) !== '*** End Patch' || !lines.slice(2, -1).every((line) => line.startsWith('+'))) {
+      throw new Error('Ambiguous patch');
+    }
+    code = lines.slice(2, -1).map((line) => line.slice(1)).join('\n');
+  } else throw new Error('Partial or unknown write context');
+  const projectedCode = codeWithoutInertText(code, file.endsWith('.py'));
+  // Never exempt a product-owned path. Preserve managed-store paths even without a product name.
+  const projection = `${file}\n${projectedCode}`;
+  if (/\.swarm|(?:agentdb-)?memory\.db|memory_entries/i.test(projection)) throw new Error('Managed memory indicators need original scan');
+  return projection;
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  try { process.stdout.write(projectGroundingInput(fs.readFileSync(0, 'utf8'))); }
+  catch { process.exitCode = 1; } // A failed exemption leaves the original guard in force.
+}

package/plugin/scripts/hook-shim.mjs

@@ -119,7 +119,7 @@ const TABLE = {
   // own header already says: "remains reachable through hook-shim's dispatch table by explicit
   // invocation". Restored. wired-check.mjs's H6 fix does not depend on these keys existing either
   // way — it stopped trusting hook-shim.mjs as a blind generic spawner, not their presence here.
-  'learn-capture':    { file: 'learn-capture.sh',    interpreter: 'bash', mode: 'advisory', offBehavior: 'silence' },
+  'learn-capture':    { file: 'learn-capture.mjs',   interpreter: 'node', mode: 'advisory', offBehavior: 'silence', stdinBytes: 65536 },
   'learn-flush':      { file: 'learn-flush.mjs',     interpreter: 'node', mode: 'advisory', offBehavior: 'silence' },
   // 1 MiB, not 64 KiB: the Stop payload now carries `last_assistant_message`, and a long closing
   // message truncated mid-JSON would parse as `{}` and silently drop the whole capture.

package/plugin/scripts/kb-copy-proof.mjs

@@ -2,20 +2,23 @@
 //
 // kb-copy-proof.mjs — may a full copy of the knowledge base be deleted? The ONE proof used by the
 // footprint sweep (plugin/scripts/brain-footprint.mjs) and by the installer right after it activates a
-// new generation (bin/install.mjs unzipInto). Pure read; never follows a link; never writes.
+// new generation (bin/install.mjs unzipInto). Pure read; checks KB-root ancestors and file/link types
+// before comparing content; never writes.
 //
 // A copy is DISPOSABLE only when nothing in it is unique. Every file must be one of:
 //   * a PRIVATE-store file (names from the PRIVATE-STORES.json fence of the live brain AND of the copy, plus
 //     every updateManaged:false store in either SOURCE.json; membership rule = kb/forge-update.mjs
 //     capturePrivateOverlayState) that exists BYTE-IDENTICAL at the same path in the live brain — nothing
 //     else excuses a private file;
-//   * a public release file: listed with these exact bytes in the copy's own ARCHIVE-MANIFEST.json, or a
-//     name the live generation ships, or a member of a public store family (named by either COVERAGE.json
+//   * a file whose regular-file bytes survive exactly at the same path in live, or a public release file
+//     listed with these exact bytes in the copy's own ARCHIVE-MANIFEST.json, or a public store family (named by either COVERAGE.json
 //     or the live SOURCE.json) that a newer release replaced or retired;
 //   * installer-written or reinstallable (node_modules/, the updater/validator files the installer places);
 //   * a symbolic link identical in the live brain (links are compared, never followed).
 // Anything else — a user's own file, an unfenced store, a link the live brain lacks — KEEPS the copy, and
-// is named. The live brain itself must be present, so a copy is never removed while it may be the only one.
+// is named. Paths are checked for symlink ancestors within both KB roots before any exemption; host
+// aliases above those roots (such as macOS /tmp) are not traversed as part of this check. Invalid metadata,
+// unreadable inventory and special file types keep the copy. The live brain itself must be present.
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
@@ -29,13 +32,13 @@ const sha256File = (file) => crypto.createHash('sha256').update(fs.readFileSync(
 /** Every regular file and link under `root`, relative, without following links. macOS volume metadata
  * (AppleDouble `._*` shadows on an exFAT disk, .DS_Store, …) is the volume's, never a copy's unique data. */
 function walk(root, prefix = '', out = []) {
-  for (const name of names(path.join(root, prefix)).filter((n) => !isVolumeMetadata(n))) {
+  for (const name of fs.readdirSync(path.join(root, prefix)).sort().filter((n) => !isVolumeMetadata(n))) {
     const relative = prefix ? path.join(prefix, name) : name;
-    const st = lstat(path.join(root, relative));
-    if (!st) continue;
+    const st = fs.lstatSync(path.join(root, relative));
     if (st.isSymbolicLink()) out.push({ relative, link: true });
     else if (st.isDirectory()) walk(root, relative, out);
     else if (st.isFile()) out.push({ relative, link: false, size: st.size });
+    else throw new Error(`unsupported file type: ${relative}`);
   }
   return out;
 }
@@ -88,6 +91,54 @@ const sameBytes = (left, right) => {
   try { return sha256File(left) === sha256File(right); } catch { return false; }
 };
 
+function safeAncestors(root, relative) {
+  let dir = root;
+  for (const part of ['', ...relative.split(path.sep).slice(0, -1)]) {
+    if (part) dir = path.join(dir, part);
+    let stat;
+    try { stat = fs.lstatSync(dir); }
+    catch (error) { return error.code === 'ENOENT'; } // a retired public path may be absent in live
+    if (!stat.isDirectory() || stat.isSymbolicLink()) return false;
+  }
+  return true;
+}
+
+function metadataFailure(root) {
+  for (const file of ['SOURCE.json', 'PRIVATE-STORES.json', 'RVF-GENERATIONS.json',
+    'COVERAGE.json', 'ARCHIVE-MANIFEST.json', 'repo-aliases.json']) {
+    const full = path.join(root, file);
+    let stat;
+    try { stat = fs.lstatSync(full); }
+    catch (error) { if (error.code === 'ENOENT' && file !== 'SOURCE.json') continue; return `${file}: ${error.message}`; }
+    try {
+      if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('not a regular metadata file');
+      const value = JSON.parse(fs.readFileSync(full, 'utf8'));
+      if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('not a metadata object');
+      if (file === 'PRIVATE-STORES.json' && Object.hasOwn(value, 'privateStores')
+        && (!Array.isArray(value.privateStores) || value.privateStores.some((name) => typeof name !== 'string' || !name.trim()))) {
+        throw new Error('private store fence is malformed');
+      }
+      if (file === 'SOURCE.json' && Object.hasOwn(value, 'stores')) {
+        if (!value.stores || typeof value.stores !== 'object'
+          || Object.values(value.stores).some((store) => !store || typeof store !== 'object' || Array.isArray(store))) {
+          throw new Error('store metadata is malformed');
+        }
+        if (storeList(value).some((store) => !store || typeof store !== 'object'
+          || (store.updateManaged === false && (typeof store.kbName !== 'string' || !store.kbName.trim())))) {
+          throw new Error('private store metadata is malformed');
+        }
+      }
+      if (file === 'RVF-GENERATIONS.json' && Object.hasOwn(value, 'stores')
+        && (!value.stores || typeof value.stores !== 'object' || Array.isArray(value.stores)
+          || Object.values(value.stores).some((generation) => !generation || typeof generation !== 'object'
+            || typeof generation.file !== 'string' || !generation.file.trim()))) throw new Error('generation metadata is malformed');
+      if (file === 'COVERAGE.json' && value.rows != null && !Array.isArray(value.rows)) throw new Error('coverage rows are malformed');
+      if (file === 'ARCHIVE-MANIFEST.json' && value.files != null && !Array.isArray(value.files)) throw new Error('archive inventory is malformed');
+    } catch (error) { return `${file}: ${error.message}`; }
+  }
+  return null;
+}
+
 /**
  * @returns {{disposable: boolean, unique: {file: string, why: string}[], reason: string}} — a kept copy
  * always names the files that keep it.
@@ -96,13 +147,19 @@ export function kbCopyProof({ copyDir, liveDir }) {
   const copy = lstat(copyDir);
   if (!copy || copy.isSymbolicLink() || !copy.isDirectory()) return { disposable: false, unique: [], reason: 'not a real directory (a link is never entered)' };
   const live = lstat(liveDir);
-  if (!live || !live.isDirectory() || !readJson(path.join(liveDir, 'SOURCE.json'))
-    || !names(liveDir).some((name) => /\.rvf$/i.test(name))) {
+  if (!live || !live.isDirectory()) {
+    return { disposable: false, unique: [], reason: 'the live brain is missing or incomplete, so this copy may be the only good one' };
+  }
+  for (const root of [copyDir, liveDir]) {
+    const failure = metadataFailure(root);
+    if (failure) return { disposable: false, unique: [], reason: `unreadable or malformed metadata in ${root}: ${failure}` };
+  }
+  if (!names(liveDir).some((name) => /\.rvf$/i.test(name) && lstat(path.join(liveDir, name))?.isFile())) {
     return { disposable: false, unique: [], reason: 'the live brain is missing or incomplete, so this copy may be the only good one' };
   }
   const privateNames = privateStoreNames([liveDir, copyDir]);
-  const generations = readJson(path.join(copyDir, 'RVF-GENERATIONS.json'))?.stores || {};
-  const privateArtifacts = Object.entries(generations).filter(([name]) => privateNames.has(name.toLowerCase()))
+  const generations = [copyDir, liveDir].flatMap((dir) => Object.entries(readJson(path.join(dir, 'RVF-GENERATIONS.json'))?.stores || {}));
+  const privateArtifacts = generations.filter(([name]) => privateNames.has(name.toLowerCase()))
     .map(([, g]) => String(g?.file || '')).filter(Boolean).map((file) => ({ directory: path.dirname(path.normalize(file)),
       basename: path.basename(file).toLowerCase(), stem: stemOf(file) }));
   const coverageNames = (dir) => (readJson(path.join(dir, 'COVERAGE.json'))?.rows || [])
@@ -119,15 +176,10 @@ export function kbCopyProof({ copyDir, liveDir }) {
   let files;
   try { files = walk(copyDir); } catch (error) { return { disposable: false, unique, reason: `unreadable copy: ${error.message}` }; }
   for (const { relative, link, size } of files) {
-    // node_modules (npm reinstalls it) and .console-runtime (bin/install.mjs installConsoleRuntime re-places it)
-    if (['node_modules', '.console-runtime'].includes(relative.split(path.sep)[0])
-      || (!relative.includes(path.sep) && INSTALLER_WRITTEN.has(relative))) continue;
     const isPrivate = belongsToPrivate(relative, privateNames, privateArtifacts);
     const inLive = path.join(liveDir, relative);
-    if (link) {
-      const liveLink = lstat(inLive);
-      const same = liveLink?.isSymbolicLink() && fs.readlinkSync(inLive) === fs.readlinkSync(path.join(copyDir, relative));
-      if (!same) unique.push({ file: relative, why: 'a symbolic link the live brain does not have (never followed)' });
+    if (!safeAncestors(copyDir, relative) || !safeAncestors(liveDir, relative)) {
+      unique.push({ file: relative, why: 'unsafe path ancestor inside a KB root (never followed)' });
       continue;
     }
     if (isPrivate) {
@@ -136,10 +188,19 @@ export function kbCopyProof({ copyDir, liveDir }) {
       }
       continue;
     }
+    // Private membership above takes precedence over reinstallable runtime and release exemptions.
+    if (['node_modules', '.console-runtime'].includes(relative.split(path.sep)[0])
+      || (!relative.includes(path.sep) && INSTALLER_WRITTEN.has(relative))) continue;
+    if (link) {
+      const liveLink = lstat(inLive);
+      const same = liveLink?.isSymbolicLink() && fs.readlinkSync(inLive) === fs.readlinkSync(path.join(copyDir, relative));
+      if (!same) unique.push({ file: relative, why: 'a symbolic link the live brain does not have (never followed)' });
+      continue;
+    }
     if (relative === 'ARCHIVE-MANIFEST.json' && shipped.size) continue; // the release manifest itself
     const listed = shipped.get(relative);
     if (listed && listed.bytes === size && listed.sha256 === sha256File(path.join(copyDir, relative))) continue;
-    if (lstat(inLive)) continue; // a release-owned name the live generation ships (same or newer bytes)
+    if (sameBytes(path.join(copyDir, relative), inLive)) continue; // existence alone proves no ownership or redundancy
     if (publicNames.has(storeStem(relative))) continue; // a public store family a newer release replaced or retired
     unique.push({ file: relative, why: 'not in the live brain, not in this copy\'s release manifest, not a public store' });
   }

package/plugin/scripts/learn-capture.mjs

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+// PostToolUse captures only a fixed workflow vocabulary, then schedules bounded orphan recovery.
+import path from 'node:path';
+import { randomUUID, createHash } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { readStdinBounded } from './hook-input.mjs';
+import { learningContext } from './runtime-preferences.mjs';
+import { learningTarget } from './learning-store.mjs';
+import { safeQueue, safeAction, writeExclusive, takeQueueLock, releaseQueueLock } from './learning-queue.mjs';
+
+try {
+  const context = learningContext();
+  if (!context.enabled) process.exit(0);
+  const raw = await readStdinBounded({ maxBytes: 65536, emptyMs: 150 });
+  const input = JSON.parse(raw.toString());
+  if (input.hook_event_name && input.hook_event_name !== 'PostToolUse') process.exit(0);
+  const response = input.tool_response;
+  if (typeof response === 'string') {
+    const exit = /^Process exited with code (-?\d+)\s*$/m.exec(response);
+    if ((exit && Number(exit[1]) !== 0) || /Process running with session ID/.test(response)) process.exit(0);
+  }
+  if (input.error || input.is_error === true || response?.error || response?.interrupted === true || response?.signal
+    || response?.success === false || response?.is_error === true || response?.isError === true
+    || [response?.exit_code, response?.exitCode, response?.status].some(value => Number.isInteger(value) && value !== 0)) process.exit(0);
+  const tool = input.tool_name;
+  if (!['Bash', 'Write', 'Edit', 'MultiEdit'].includes(tool)) process.exit(0);
+  const action = safeAction(tool, tool === 'Bash' ? input.tool_input?.command : 'edit file');
+  if (!action) process.exit(0);
+  const fresh = learningContext();
+  if (!fresh.enabled || fresh.queueDir !== context.queueDir) process.exit(0);
+  learningTarget(fresh); // Existing authorized user store is required before creating any user queue bytes.
+  const dir = safeQueue(fresh, true);
+  const sid = createHash('sha256').update(String(input.session_id || process.env.CLAUDE_SESSION_ID || 'default')).digest('hex').slice(0, 24);
+  writeExclusive(path.join(dir, `session-${sid}-${randomUUID()}.jsonl`), JSON.stringify({ tool, action }) + '\n');
+  // Per-scope lock in the flusher suppresses duplicate workers; capture never waits on the learner.
+  const token = takeQueueLock(fresh);
+  if (!token) process.exit(0);
+  const child = spawn(process.execPath, [fileURLToPath(new URL('./learn-flush.mjs', import.meta.url)), '--supervisor'], {
+    cwd: fresh.projectDir, detached: true, stdio: 'ignore', windowsHide: true, env: { ...process.env, RUVNET_LEARN_WORKER_TOKEN: token },
+  });
+  child.on('error', () => releaseQueueLock(fresh, token)); child.unref();
+} catch { /* advisory transport; unsafe/malformed input produces no persisted payload */ }
+process.exit(0);

package/plugin/scripts/learn-capture.sh

@@ -1,242 +1,3 @@
 #!/bin/bash
-# learn-capture.sh — PostToolUse (Write|Edit|Bash). Appends ONE compact step to this session's learning
-# queue. A session is a trajectory (task -> steps -> outcome); learn-flush.mjs feeds the queue to the
-# GLOBAL SONA learner at SessionEnd, so "how you work" accumulates per-user across ALL projects — while
-# project FACTS stay in each project's .swarm/memory.db, never here. We record the workflow ACTION (a
-# command verb, a file's basename), never file CONTENT or secrets. ADR-0017.
-#
-# CONTRACT: PostToolUse is non-blocking — always exit 0, swallow every failure, no process spawn (fast).
-
-set -uo pipefail
-
-# One policy source for both capture and flush. `off` means zero bytes written. `project` keeps the
-# trajectory queue under this project's .swarm directory; `user` preserves the cross-project learner
-# introduced by ADR-0017. Tests and managed hosts may pass an already-resolved snapshot in
-# RUVNET_LEARNING_SCOPE so the two halves cannot disagree during one hook invocation.
-HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
-SCOPE="${RUVNET_LEARNING_SCOPE:-}"
-# CONFIGURED vs DEFAULTED, and this must be captured BEFORE the preferences fallback below.
-#
-# `project` is the DEFAULT scope, and `runtime-preferences.mjs --learning-scope` RESOLVES it —
-# measured 2026-08-19 against an empty config root, it returns "project", not "". So after the
-# fallback runs, an explicit opt-in and a bare default are indistinguishable. The first version of
-# this guard read SCOPE afterwards and was therefore always "configured", which let the
-# stranger-project mutation straight back in.
-#
-# The env var is the one signal that is unambiguously explicit: nothing sets it by default. A
-# project that opted in through the console instead is still covered by the `.swarm` clause below,
-# because adopting Ruflo's convention is itself the opt-in.
-SCOPE_CONFIGURED=0
-[ -n "$SCOPE" ] && SCOPE_CONFIGURED=1
-if [ -z "$SCOPE" ] && [ -f "$HERE/runtime-preferences.mjs" ] && command -v node >/dev/null 2>&1; then
-  SCOPE=$(node "$HERE/runtime-preferences.mjs" --learning-scope 2>/dev/null) || SCOPE=""
-fi
-case "$SCOPE" in
-  off) exit 0 ;;
-  user|project) ;;
-  *) SCOPE="project" ;;
-esac
-
-# BOUNDED READ. An unqualified `read` waits forever on a stdin that is opened and never closed, and
-# an unbounded accumulator turns a large payload into an unbounded regex scan. Claude Code always
-# writes the payload and closes, so neither costs a normal turn — which is exactly why a hook that
-# CAN hang survives: the only thing ending it is a timeout owned by someone else. -t 2 is ~40x a real
-# payload's delivery time; the size cap is ~30x the largest real payload. The trailing `[ -n "$_l" ]`
-# keeps the final unterminated line, which is what the original `||` clause was for.
-INPUT=""
-_l=""   # set -u: a read that times out before any byte leaves _l unset ("unbound variable" on stderr)
-while IFS= read -r -t 2 _l; do
-  INPUT+="$_l"
-  [ ${#INPUT} -ge 65536 ] && break
-done
-# Truncate the ASSEMBLED string, not just each iteration: a hook payload is one line with no trailing
-# newline, so `read` hands back the whole thing at once in $_l and the in-loop cap never fires.
-[ -n "$_l" ] && INPUT+="$_l"
-INPUT="${INPUT:0:65536}"
-[ -n "$INPUT" ] || exit 0
-
-TOOL=""
-re_t='"tool_name"[[:space:]]*:[[:space:]]*"([^"]*)"'
-[[ $INPUT =~ $re_t ]] && TOOL="${BASH_REMATCH[1]}"
-[ -n "$TOOL" ] || exit 0
-
-ACTION=""
-case "$TOOL" in
-  Bash)
-    # Capture the VERB CHAIN ONLY — "git push", "npm test", "npx vercel" — never the arguments.
-    #
-    # This previously took the first 120 chars up to an embedded quote and called that "verb, not
-    # facts". It wasn't. Unquoted inline secrets were captured in full and written to disk, proven
-    # by test: `export AWS_SECRET_ACCESS_KEY=wJalr... && psql postgres://admin:Hunter2Pass@db/prod`
-    # landed verbatim in session-*.jsonl, and from there fed the global learner. Real command lines
-    # routinely carry API keys, DB URLs with inline passwords, and internal hostnames — on a
-    # corporate laptop the hostnames alone are a DLP finding.
-    #
-    # Now: keep at most the first two tokens, and stop at the first token that carries DATA rather
-    # than INTENT (contains = / @ : , is a flag, or is improbably long). "export FOO=secret" records
-    # "export"; "cd /Users/me/ClientProject" records "cd". The learner only ever needed the verb.
-    # THE CAPTURE WAS MANGLED, and the mangling was invisible (fixed 2026-07-27).
-    #
-    # `"command"…"([^"]*)"` cannot cross a JSON-escaped quote — the exact bug hook-input.mjs exists to
-    # end — so `cd "/tmp/some dir"` captured the two bytes `cd \`, and that trailing backslash then
-    # broke the JSON line it was printed into. Measured on the owner's live queue:
-    #
-    #     {"tool":"Bash","action":"cd \"}      ← JSON.parse: Unterminated string at position 31
-    #
-    # learn-flush drops every unparseable line with a bare `continue`, so the capture reported success,
-    # the queue grew, and the learner received nothing. A pipe severed in the middle while both ends
-    # report health is this project's signature failure mode.
-    #
-    # The fix is to stop at the first quote OR backslash and take a PREFIX — no closing-quote anchor,
-    # because the first two tokens are all this hook ever wanted. A command that opens with a quoted
-    # path yields an empty prefix and is simply not captured, which is strictly better than writing a
-    # line that cannot be read back.
-    re_c='"command"[[:space:]]*:[[:space:]]*"([^"\]*)'
-    if [[ $INPUT =~ $re_c ]]; then
-      set -f                      # no globbing while we word-split untrusted text
-      _n=0
-      for _tok in ${BASH_REMATCH[1]}; do
-        case "$_tok" in
-          *=*|*/*|*@*|*:*|-*) break ;;
-        esac
-        [ ${#_tok} -gt 24 ] && break
-        ACTION="${ACTION:+$ACTION }$_tok"
-        _n=$((_n + 1))
-        [ "$_n" -ge 2 ] && break
-      done
-      set +f
-    fi
-    ;;
-  Write|Edit|MultiEdit)
-    re_f='"file_path"[[:space:]]*:[[:space:]]*"([^"]*)"'
-    [[ $INPUT =~ $re_f ]] && ACTION="edit ${BASH_REMATCH[1]##*/}"   # basename only — no full path
-    ;;
-esac
-[ -n "$ACTION" ] || exit 0
-
-# THE SESSION ID IS IN THE PAYLOAD WE ALREADY READ — and it was being thrown away.
-#
-# This read `${CLAUDE_SESSION_ID:-default}`, an env var Claude Code does not set, so EVERY session on
-# a machine appended to one shared `session-default.jsonl`. Measured on the owner's machine
-# 2026-07-27: one file, 147 lines deep, written concurrently by several live sessions — the same
-# many-writers-one-path shape as ADR-050, and it makes "this session's trajectory" a fiction, because
-# the queue is a blend of every session that happened to be open.
-#
-# `session_id` is a field on the very payload this hook already parsed. Prefer it; fall back to the
-# env var; then to 'default'. SANITISED before it becomes a filename component: the payload is
-# untrusted input, and `session_id` reaching an unfiltered path join is a traversal waiting to happen.
-SID=""
-re_s='"session_id"[[:space:]]*:[[:space:]]*"([^"\]*)"'
-[[ $INPUT =~ $re_s ]] && SID="${BASH_REMATCH[1]}"
-[ -n "$SID" ] || SID="${CLAUDE_SESSION_ID:-}"
-# Dots are dropped along with everything else outside this set: real session ids are uuids, and
-# keeping `.` would let a crafted id survive as `..`-shaped debris in a filename for no benefit.
-SID="${SID//[^A-Za-z0-9_-]/}"           # a filename COMPONENT, never a path
-[ -n "$SID" ] || SID="default"
-if [ "$SCOPE" = "user" ]; then
-  DIR="$HOME/.cache/ruvnet-brain/learn"
-else
-  # ISSUE #134 — THE SAME PROJECT ROOT THE READER COMPUTES, BY THE SAME RULE.
-  #
-  # This was bare `$PWD` while learn-flush.mjs:26 and health-repair.mjs:32 both resolve
-  # `RUVNET_BRAIN_PROJECT_DIR || cwd`. This hook is wired on PostToolUse, so it runs after EVERY tool
-  # call — and any command that leaves the shell below the project root (a test run, a build, any
-  # tooling that cd's) made the WRITER create a queue in a directory the READER never looks in. Those
-  # events are not misfiled, they are orphaned: nothing ever drains them.
-  #
-  # This is issue #104's residual. #104 fixed the two halves of the FLUSH to agree about which project
-  # they mean; the component that actually creates the queue was not brought along, so the invariant
-  # held for two of three participants and was violated by the one doing the writing. Same shape as
-  # ADR-066: a writer and a reader that disagree about the store make the recording theatre.
-  # RESIDUAL of #134/#104: RUVNET_BRAIN_PROJECT_DIR is never set by real hook dispatch on either
-  # host (neither hook-shim.mjs nor codex-hook-adapter.mjs seeds it), so it degraded back to bare
-  # $PWD in production. CLAUDE_PROJECT_DIR is the one project-root signal both hosts DO provide on
-  # every invocation. Trusted only when $PWD actually lies inside it — the SAME containment rule
-  # project-identity.mjs's projectDirectory() applies for the identical reason (#85/#107: an
-  # unrelated declared root must never overrule a cwd it does not contain). A plain string-prefix
-  # check, not a realpath/inode compare, to honour this hook's own no-process-spawn contract.
-  ROOT_DIR="$PWD"
-  if [ -n "${CLAUDE_PROJECT_DIR:-}" ]; then
-    CPD="${CLAUDE_PROJECT_DIR%/}"
-    # Git Bash presents PWD as /c/... while Node supplies CLAUDE_PROJECT_DIR as C:\\... on
-    # Windows. Compare normalized, case-folded spellings so the real project-root signal works
-    # on both hosts without spawning a platform-specific path converter.
-    _pwd_for_compare="$PWD"
-    if [ -n "$(pwd -W 2>/dev/null || true)" ]; then _pwd_for_compare="$(pwd -W)"; fi
-    _pwd_cmp=$(printf '%s' "$_pwd_for_compare" | tr '\\\\' '/' | tr '[:upper:]' '[:lower:]')
-    _cpd_cmp=$(printf '%s' "$CPD" | tr '\\\\' '/' | tr '[:upper:]' '[:lower:]')
-    case "$_pwd_cmp/" in "$_cpd_cmp"/*) ROOT_DIR="$CPD" ;; esac
-  fi
-  DIR="${RUVNET_BRAIN_PROJECT_DIR:-$ROOT_DIR}/.swarm/ruvnet-brain-learn"
-fi
-# PROJECT SCOPE MEANS THE PROJECT MUST HAVE OPTED IN. In project scope $DIR sits under `.swarm`,
-# which is Ruflo's own convention and is created by `ruflo init` — so its PRESENCE is the project's
-# opt-in and its ABSENCE is a project that has not adopted the brain. This hook runs machine-wide on
-# every PostToolUse, so an unconditional mkdir planted `.swarm/` in EVERY repository the user opened.
-# Measured 2026-08-14 by the both-hosts conformance gate in a temp project with no git and no brain
-# artifacts; ADR-058 D5 — never touch what we do not own. User scope is unaffected: that queue lives
-# under the brain's OWN cache directory, which we do own and may create.
-# CREATE THE QUEUE ONLY WHERE THE PROJECT ACTUALLY OPTED IN.
-#
-# First attempt required an existing `.swarm`, which stopped the stranger-project mutation but ALSO
-# broke a legitimate first run: a project that explicitly sets RUVNET_LEARNING_SCOPE=project before
-# it has ever captured anything got nothing, and `learning-scope-policy` went red. Presence of
-# `.swarm` was the wrong discriminator — it answers "has Ruflo run here", not "did this project ask
-# for learning".
-#
-# The right one is whether the scope was CONFIGURED (env or runtime-preferences) rather than
-# inherited from the default. A stranger's repo sets neither, so nothing is created there; a project
-# that opted in gets its queue on the very first capture, `.swarm` or not. An existing `.swarm` is
-# still honoured on its own, because a repo already carrying Ruflo's convention has plainly adopted it.
-case "$DIR" in
-  */.swarm/*)
-    if [ "$SCOPE_CONFIGURED" != "1" ] && [ ! -d "$(dirname "$DIR")" ]; then exit 0; fi
-    ;;
-esac
-# Owner-only (0700 dir / 0600 file). This queue was 0644 inside a 0755 dir: on macOS every local
-# account is normally in `staff`, so any other user on a shared or corporate machine could read it.
-( umask 077 && mkdir -p "$DIR" ) 2>/dev/null || exit 0
-QUEUE="$DIR/session-$SID.jsonl"
-[ -e "$QUEUE" ] || { : > "$QUEUE" 2>/dev/null && chmod 600 "$QUEUE" 2>/dev/null; } || true
-printf '{"tool":"%s","action":"%s"}\n' "$TOOL" "${ACTION//\"/\\\"}" >> "$QUEUE" 2>/dev/null || true
-
-# ── HEARTBEAT FLUSH (ADR-027) ────────────────────────────────────────────────────────────────────
-# The flush used to fire ONLY on a clean SessionEnd. Sessions compact, crash, get resumed, or are
-# killed — none of those reach SessionEnd — so the queue silently grew to 1,884 undelivered events
-# over days while the learner sat at 5 trajectories, last trained six days earlier. Draining it took
-# the learner to 412/412 in one command. A queue that only empties on a graceful exit will always
-# leak; activity itself must be the trigger.
-#
-# So: every HEARTBEAT_EVERY captures, drain in the BACKGROUND. Detached and fully silent — this runs
-# inside a PostToolUse hook and must never add latency to the user's turn or fail one. Cheap check
-# (a line count) on the common path; real work only at the threshold.
-# LEVEL-TRIGGERED, NOT EDGE-TRIGGERED. This is the whole fix, and the bug it replaces was severe.
-#
-# The condition used to be `LINES >= 200 && LINES % 200 == 0` — it fired ONLY when the count landed
-# exactly on a multiple of 200. Two captures arriving between checks, or any concurrent write,
-# steps the counter over the window and the flush NEVER fires again. Measured on the owner's machine
-# 2026-07-22: the queue was at 491. It had sailed past both 200 and 400 without draining once, and
-# would have grown forever.
-#
-# The failure mode is the nastiest kind: capture works, the learner works, and the PIPE BETWEEN THEM
-# is severed — while every surface honestly reports both ends as healthy. "Is learning on?" had no
-# true answer, because learning is not a switch; it is a chain, and one link was open.
-#
-# `-ge` cannot skip a window. It fires on every capture past the threshold until the queue is
-# actually drained, which is the definition of level-triggered: the condition is the QUEUE'S DEPTH,
-# not the instant it crossed a line.
-HEARTBEAT_EVERY=200
-LINES=$(wc -l < "$DIR/session-$SID.jsonl" 2>/dev/null || echo 0)
-if [ "$LINES" -ge "$HEARTBEAT_EVERY" ]; then
-  # Debounce so a deep queue doesn't spawn a flush on EVERY subsequent capture: at most one drain
-  # per minute. Without this, level-triggering trades a stuck queue for a fork storm.
-  STAMP="$DIR/.last-flush"
-  NOW=$(date +%s)
-  LAST=$(cat "$STAMP" 2>/dev/null || echo 0)
-  if [ $((NOW - LAST)) -ge 60 ]; then
-    echo "$NOW" > "$STAMP" 2>/dev/null || true
-    FLUSH="$HERE/learn-flush.mjs"
-    [ -f "$FLUSH" ] && (RUVNET_LEARNING_SCOPE="$SCOPE" nohup node "$FLUSH" >/dev/null 2>&1 &) || true
-  fi
-fi
-exit 0
+# Compatibility entry; native registrations use the bounded Node body on both hosts.
+exec node "$(dirname "$0")/learn-capture.mjs"