ruvnet-brain 4.5.9 → 4.5.11

package/scripts/claude-controlled-terminal.mjs

@@ -0,0 +1,265 @@
+#!/usr/bin/env node
+// A controlled prompt boundary using native print/SDK controls, not the native terminal UI.
+import path from 'node:path';
+import fs from 'node:fs';
+import os from 'node:os';
+import crypto from 'node:crypto';
+import { spawn, execFileSync } from 'node:child_process';
+import { createInterface } from 'node:readline/promises';
+import { pathToFileURL } from 'node:url';
+import { StringDecoder } from 'node:string_decoder';
+import { decideNativeTurn, appendGatewayReceipt } from './model-routing-gateway.mjs';
+import { subscriptionEnvironment, assertSubscriptionAuth, validateDispatchDecision } from './model-router-dispatch.mjs';
+import { validateClaudeTerminalSettings } from './model-terminal-launchers.mjs';
+
+const REFUSED = 'Controlled Claude turn refused; no fallback.';
+const uuid = value => /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/i.test(value || '');
+const cleanText = value => String(value).replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f]/g, '');
+const allocationEnv = /^(CLAUDE_CODE_EXTRA_BODY|CLAUDE_CODE_EFFORT_LEVEL|ANTHROPIC_DEFAULT_.*_MODEL|ANTHROPIC_MODEL|ANTHROPIC_SMALL_FAST_MODEL|CLAUDE_CODE_SUBAGENT_MODEL|CLAUDE_CODE_PLUGIN_(DIRS|CACHE_DIR|SEED_DIR)|CLAUDE_CODE_USE_COWORK_PLUGINS)$/;
+
+/** Classic Brain hooks/MCP/skills remain loaded; native request-rewriting modules are refused. */
+export function assertClaudeModuleBoundary(settings, { env = process.env, sessionId, read = fs.readFileSync } = {}) {
+  if (!settings || typeof settings !== 'object' || Object.keys(settings.env || {}).some(key => allocationEnv.test(key))) throw new Error(REFUSED);
+  const modules = value => value && typeof value === 'object' && Object.entries(value).some(([key, entry]) =>
+    key === 'modules' && (Array.isArray(entry) ? entry.length > 0 : Boolean(entry)) || modules(entry));
+  if (modules(settings.hooks)) throw new Error(REFUSED);
+  const config = env.CLAUDE_CONFIG_DIR || path.join(env.HOME || os.homedir(), '.claude');
+  const json = file => JSON.parse(read(file, 'utf8'));
+  const enabled = Object.entries(settings.enabledPlugins || {}).filter(([, value]) => value !== false).map(([key]) => key);
+  let registry;
+  if (enabled.length) registry = json(path.join(config, 'plugins', 'installed_plugins.json'));
+  for (const id of enabled) {
+    const installations = registry.plugins?.[id];
+    if (!Array.isArray(installations) || !installations.length) throw new Error(REFUSED);
+    const at = id.lastIndexOf('@'), name = id.slice(0, at), marketplace = id.slice(at + 1);
+    if (at < 1) throw new Error(REFUSED);
+    const known = json(path.join(config, 'plugins', 'known_marketplaces.json'));
+    const marketplaceRoot = known[marketplace]?.installLocation;
+    if (!path.isAbsolute(marketplaceRoot || '')) throw new Error(REFUSED);
+    const entry = json(path.join(marketplaceRoot, '.claude-plugin', 'marketplace.json')).plugins?.find(plugin => plugin.name === name);
+    if (!entry || modules(entry)) throw new Error(REFUSED);
+    // Refuse any registered module-bearing installation of an enabled ID; never guess scope precedence.
+    for (const installation of installations) {
+      const root = installation.installPath;
+      if (!path.isAbsolute(root || '')) throw new Error(REFUSED);
+      const manifestFiles = [path.join(root, '.claude-plugin', 'plugin.json'), path.join(root, 'plugin.json')];
+      // Native strict:false marketplace entries may supply the entire manifest (e.g. LSP plugins).
+      const manifests = manifestFiles.filter(file => fs.existsSync(file)).map(json);
+      if (!manifests.length && entry.strict === false) manifests.push(entry);
+      if (!manifests.length || manifests.some(modules)) throw new Error(REFUSED);
+      const hooks = [path.join(root, 'hooks', 'hooks.json')];
+      for (const relative of [...manifests.map(manifest => manifest.hooks), entry.hooks].flat().filter(value => typeof value === 'string')) {
+        const resolved = path.resolve(root, relative);
+        if (!resolved.startsWith(root + path.sep)) throw new Error(REFUSED);
+        hooks.push(resolved);
+      }
+      for (const file of hooks) if (fs.existsSync(file) && modules(json(file))) throw new Error(REFUSED);
+    }
+  }
+  const nonempty = folder => fs.existsSync(folder) && fs.readdirSync(folder).length > 0;
+  // Native 2.1.289 rft()/b(sessionId): <config-dir>/dev-mods/<session-id>.
+  if (nonempty(path.join(config, 'dev-mods', sessionId))) throw new Error(REFUSED);
+  const projects = path.join(config, 'projects');
+  if (fs.existsSync(projects)) for (const directory of fs.readdirSync(projects)) {
+    const transcript = path.join(projects, directory, `${sessionId}.jsonl`);
+    if (!fs.existsSync(transcript)) continue;
+    // A resumed transcript may restore a different dev-mods folder (native last-wins record).
+    for (const line of read(transcript, 'utf8').split('\n').filter(Boolean)) {
+      const record = JSON.parse(line);
+      if (record.type === 'dev-mods' && record.folder && nonempty(record.folder)) throw new Error(REFUSED);
+    }
+  }
+}
+
+/** Retire only the directly owned process; never infer descendant cleanup from its exit. */
+export function retireControlledClaudeChild(child, { graceMs = 200, killMs = 200 } = {}) {
+  return new Promise(resolve => {
+    let finished = false, escalation, deadline;
+    const finish = () => {
+      if (finished) return;
+      finished = true; clearTimeout(escalation); clearTimeout(deadline);
+      child.removeListener('close', finish);
+      for (const stream of [child.stdin, child.stdout, child.stderr]) { stream?.removeAllListeners('data'); stream?.destroy(); }
+      child.unref?.(); resolve();
+    };
+    child.once('close', finish);
+    const kill = signal => { try { child.kill(signal); } catch { /* bounded cleanup still proceeds */ } };
+    escalation = setTimeout(() => kill('SIGKILL'), graceMs);
+    deadline = setTimeout(finish, graceMs + killMs);
+    kill('SIGTERM');
+    if (child.exitCode != null || child.signalCode != null) finish();
+  });
+}
+
+export function controlledClaudeArguments(decision, sessionId, resume = false) {
+  if (decision?.harness !== 'claude-code' || decision.provider !== 'anthropic' || decision.subscriptionCovered !== true ||
+      !/^claude-[a-z0-9][a-z0-9.-]*$/.test(decision.model || '') ||
+      !['low', 'medium', 'high', 'xhigh', 'max'].includes(decision.effort) || !uuid(sessionId)) throw new Error(REFUSED);
+  return ['--print', '--input-format', 'stream-json', '--output-format', 'stream-json', '--verbose',
+    '--model', decision.model, '--effort', decision.effort, '--permission-mode', 'manual', '--permission-prompts', 'host',
+    '--permission-prompt-tool', 'stdio',
+    '--disallowedTools', 'Agent,Task',
+    resume ? '--resume' : '--session-id', sessionId];
+}
+
+/** One native process per routed turn. Permission requests require an explicit host answer. */
+export async function runControlledClaudeTurn({ binary, prompt, sessionId = crypto.randomUUID(), resume = false,
+  cwd = process.cwd(), env = process.env, decide = decideNativeTurn, verifyDecision = validateDispatchDecision,
+  checkSettings = validateClaudeTerminalSettings, checkAuth = assertSubscriptionAuth, spawnNative = spawn,
+  probe = execFileSync, approve = async () => false, output = () => {}, receipt = appendGatewayReceipt,
+  checkModules = assertClaudeModuleBoundary, signal, timeoutMs = 900000, handshakeMs = 10000 } = {}) {
+  if (!path.isAbsolute(binary || '') || typeof prompt !== 'string' || !prompt.trim() || prompt.length > 200000 ||
+      /^\s*\//.test(prompt) || !Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 900000 ||
+      !Number.isSafeInteger(handshakeMs) || handshakeMs <= 0 || handshakeMs > 30000 || signal?.aborted) throw new Error(REFUSED);
+  // Extra body / effort env overrides can bypass the native CLI's requested allocation.
+  if (Object.keys(env).some(key => allocationEnv.test(key))) throw new Error(REFUSED);
+  const clean = subscriptionEnvironment(env);
+  const managed = process.platform === 'darwin' ? '/Library/Application Support/ClaudeCode/managed-settings.json' : '/etc/claude-code/managed-settings.json';
+  if (fs.existsSync(managed)) throw new Error('Managed Claude settings require separate module-boundary qualification.');
+  checkSettings({ env: clean, cwd, home: env.HOME || os.homedir() });
+  checkAuth('claude-code', { env: clean, probe: (_name, args, options) => probe(binary, args, options) });
+  const decision = await decide(prompt, 'claude-code', { env: clean });
+  verifyDecision(decision);
+  const args = controlledClaudeArguments(decision, sessionId, resume);
+  if (signal?.aborted) throw new Error(REFUSED);
+  const child = spawnNative(binary, args, { cwd, env: clean, shell: false, stdio: ['pipe', 'pipe', 'pipe'] });
+  return new Promise((resolve, reject) => {
+    let done = false, phase = 'initialize', buffer = '', bytes = 0, result, observed = false, permissions = false;
+    const decoder = new StringDecoder('utf8');
+    const ids = { initialize: crypto.randomUUID(), before: crypto.randomUUID(), after: crypto.randomUUID() };
+    let handshake;
+    const timer = setTimeout(() => fail(), timeoutMs);
+    const abort = () => fail();
+    signal?.addEventListener('abort', abort, { once: true });
+    const clear = () => { clearTimeout(timer); clearTimeout(handshake); signal?.removeEventListener('abort', abort); };
+    const fail = () => {
+      if (done) return;
+      done = true; clear();
+      void retireControlledClaudeChild(child).then(() => reject(new Error(REFUSED)));
+    };
+    const send = message => { if (!done) child.stdin.write(JSON.stringify(message) + '\n'); };
+    const control = which => {
+      phase = which; clearTimeout(handshake); handshake = setTimeout(fail, handshakeMs);
+      send({ type: 'control_request', request_id: ids[which], request: { subtype: which === 'initialize' ? 'initialize' : 'get_settings' } });
+    };
+    const settingsMatch = value => value?.applied?.model === decision.model && value.applied.effort === decision.effort && !value.errors?.length &&
+      Array.isArray(value.sources) && !value.sources.some(source => source.source === 'policySettings' && Object.keys(source.settings || {}).length);
+    const onMessage = async message => {
+      if (done) return;
+      if (message.type === 'control_response') {
+        const response = message.response;
+        if (response?.request_id !== ids[phase] || response.subtype !== 'success') return fail();
+        if (phase === 'initialize') return control('before');
+        if (!settingsMatch(response.response)) return fail();
+        if (phase === 'before') {
+          clearTimeout(handshake); phase = 'turn';
+          checkModules(response.response.effective, { env: clean, sessionId });
+          verifyDecision(decision); // Allocation may have changed while native startup was running.
+          receipt({ ts: new Date().toISOString(), harness: 'claude-code', status: 'native-settings-observed',
+            model: decision.model, effort: decision.effort, taskClass: decision.taskClass, modelObserved: false,
+            evidence: 'get_settings applied model and effort before prompt; execution identity pending' }, { env: clean });
+          send({ type: 'user', session_id: sessionId, message: { role: 'user', content: prompt } });
+        } else if (phase === 'after') { checkModules(response.response.effective, { env: clean, sessionId }); phase = 'exit'; clearTimeout(handshake); child.stdin.end(); }
+        else fail();
+        return;
+      }
+      if (message.type === 'control_request') {
+        if (phase !== 'turn' || permissions || message.request?.subtype !== 'can_use_tool' || typeof message.request_id !== 'string') return fail();
+        if (['Agent', 'Task'].includes(message.request.tool_name)) return fail();
+        permissions = true;
+        let allowed = false;
+        try { allowed = await approve(message.request) === true; } catch { allowed = false; }
+        permissions = false;
+        send({ type: 'control_response', response: { subtype: 'success', request_id: message.request_id,
+          response: allowed ? { behavior: 'allow', updatedInput: message.request.input } :
+            { behavior: 'deny', message: 'The host did not approve this tool request.' } } });
+        return;
+      }
+      if (message.session_id && message.session_id !== sessionId) return fail();
+      if (message.type === 'assistant' && !message.parent_tool_use_id) {
+        if (phase !== 'turn' || message.message?.model !== decision.model) return fail();
+        observed = true;
+        for (const block of message.message.content || []) if (block.type === 'text') output(cleanText(block.text));
+      }
+      if (message.type === 'result') {
+        if (phase !== 'turn' || permissions || !observed || message.session_id !== sessionId || message.subtype !== 'success' ||
+            message.is_error || message.permission_denials?.length || message.errors?.length) return fail();
+        result = message; control('after');
+      }
+    };
+    child.stdout.on('data', chunk => {
+      if (done) return;
+      bytes += chunk.length; if (bytes > 16 * 1024 * 1024) return fail();
+      buffer += decoder.write(chunk);
+      let newline;
+      while ((newline = buffer.indexOf('\n')) !== -1 && !done) {
+        const line = buffer.slice(0, newline); buffer = buffer.slice(newline + 1);
+        try { void onMessage(JSON.parse(line)).catch(fail); } catch { fail(); }
+      }
+    });
+    child.stderr.on('data', () => {}); // Native diagnostics may contain credentials or prompt text.
+    child.stdin.on('error', fail); child.once('error', fail);
+    child.once('close', code => {
+      if (done) return;
+      if (code !== 0 || phase !== 'exit' || !result || buffer.trim() || decoder.end()) return fail();
+      try {
+        receipt({ ts: new Date().toISOString(), harness: 'claude-code', status: 'completed', model: decision.model,
+          effort: decision.effort, taskClass: decision.taskClass, modelObserved: true,
+          evidence: 'assistant model observed; get_settings applied effort matched before and after turn; per-request effort not exposed' }, { env: clean });
+        done = true; clear(); resolve({ sessionId, decision, modelObserved: true, effortSettingsObserved: true, perRequestEffortObserved: false });
+      } catch { fail(); }
+    });
+    control('initialize');
+  });
+}
+
+/** Native tool approvals are presented by this host; --print supplies no terminal dialogs. */
+export async function launchControlledClaudeTerminal({ binary, args = [], input = process.stdin, output = process.stdout,
+  diagnostics = process.stderr, env = process.env, cwd = process.cwd(), runTurn = runControlledClaudeTurn } = {}) {
+  let sessionId, resume = false, initialPrompt, ownerBypass = false;
+  const remaining = [...args];
+  const invalid = () => new Error('Controlled Claude accepts only --resume <session UUID>, --permission-mode bypassPermissions, and a literal initial prompt.');
+  while (remaining[0]?.startsWith('-')) {
+    if (remaining[0] === '--resume' && !resume && uuid(remaining[1])) {
+      sessionId = remaining[1]; resume = true;
+    } else if (remaining[0] === '--permission-mode' && !ownerBypass && remaining[1] === 'bypassPermissions') {
+      ownerBypass = true;
+    } else throw invalid();
+    remaining.splice(0, 2);
+  }
+  if (remaining.some(arg => typeof arg !== 'string' || arg.startsWith('-'))) throw invalid();
+  if (remaining.length) initialPrompt = remaining.join(' ');
+  if (!input.isTTY || !output.isTTY) throw new Error('Controlled Claude requires a person at a terminal for prompts and approvals.');
+  const terminal = createInterface({ input, output });
+  const controller = new AbortController();
+  const cancel = () => controller.abort();
+  terminal.on('SIGINT', cancel);
+  diagnostics.write('Controlled Claude: one reviewed native allocation per prompt; tool approvals are answered here. Native Agent/Task workers are disabled; use the managed dispatcher for independent child work. /exit closes.\n');
+  if (ownerBypass) diagnostics.write('Owner permission bypass is active: native tool requests are approved by this host automatically. Agent/Task remain refused; routing and subscription guards remain active.\n');
+  try {
+    while (!controller.signal.aborted) {
+      const prompt = initialPrompt ?? await terminal.question('Claude> '); initialPrompt = undefined;
+      if (prompt.trim() === '/exit') break;
+      if (!prompt.trim()) continue;
+      const turn = await runTurn({ binary, prompt, sessionId, resume, cwd, env, signal: controller.signal,
+        output: text => output.write(text + '\n'), approve: async request => {
+          if (['Agent', 'Task'].includes(request.tool_name)) return false;
+          const details = cleanText(JSON.stringify({ tool: request.tool_name, input: request.input, reason: request.decision_reason }));
+          output.write(`Native permission request (untrusted tool text):\n${details}\n`);
+          if (ownerBypass) return true;
+          return (await terminal.question('Approve this tool request? Type yes: ')).trim() === 'yes';
+        } });
+      sessionId = turn.sessionId; resume = true;
+      diagnostics.write(`Native session: ${sessionId} (resume with --resume ${sessionId})\n`);
+    }
+  } finally { terminal.close(); }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const args = process.argv.slice(2);
+  if (args[0] !== '--real-binary' || !args[1] || args[2] !== '--') {
+    process.stderr.write('Expected --real-binary /absolute/native/claude -- [--resume UUID]\n'); process.exitCode = 1;
+  } else launchControlledClaudeTerminal({ binary: args[1], args: args.slice(3) }).catch(() => {
+    process.stderr.write(REFUSED + '\n'); process.exitCode = 1;
+  });
+}

package/scripts/issue-watch.mjs

@@ -150,16 +150,19 @@ export async function run({ dryRun = false, now = Date.now(), repo = REPO } = {}
     // lastAlertAt: state is only written when the push actually went out, so a failed push
     // retries next run instead of burying the sighting.
     const firstSighting = !state[key];
+    // Acknowledgment delivery is not page delivery. Retry each missing channel independently.
+    const needsNewPage = !state[key]?.newAlertAt;
+    const needsAck = !state[key]?.ackAt;
 
     results.push({ number: issue.number, title: issue.title, ageHours, ownerComment, breach, dueForAlert, firstSighting, url });
 
-    if (firstSighting) {
+    if (needsNewPage || needsAck) {
       if (dryRun) {
         alertsSent.push({ number: issue.number, sent: false, kind: 'new-issue', reason: 'dry-run' });
       } else {
-        const topic = resolveTopic();
-        let sent = false;
-        if (topic) sent = await pushNtfy(topic, {
+        const topic = needsNewPage ? resolveTopic() : null;
+        let sent = !needsNewPage;
+        if (needsNewPage && topic) sent = await pushNtfy(topic, {
           title: `New issue #${issue.number} (open ${fmtAge(ageHours)})`,
           body: `${issue.title}\n${url}`,
           priority: 'high', tags: 'new,eyes',
@@ -171,12 +174,20 @@ export async function run({ dryRun = false, now = Date.now(), repo = REPO } = {}
         // not caring — the opposite of the point). Carries BOT_MARKER so judgeIssue() can never
         // mistake it for the owner responding. Best-effort like ntfy: a comment failure must not
         // break the watch; unacked issues simply retry next run (ackAt is delivery-derived).
-        let ackAt = null;
-        const ackBody = `🤖 Automated acknowledgment — received and opened. The maintainer has been paged and this is being worked. The next update here will be a fix, findings, or the maintainer in person.`;
-        const ack = spawnSync(GH_BIN, ['issue', 'comment', String(issue.number), '--repo', repo, '--body', ackBody], { encoding: 'utf8' });
-        if (ack.status === 0) ackAt = new Date(now).toISOString();
-        if (sent || ackAt) state[key] = { firstSeenAt: new Date(now).toISOString(), ...(sent ? { newAlertAt: new Date(now).toISOString() } : {}), ...(ackAt ? { ackAt } : {}), title: issue.title, url };
-        alertsSent.push({ number: issue.number, sent, acked: Boolean(ackAt), kind: 'new-issue', reason: topic ? null : 'no ntfy topic configured' });
+        let acked = !needsAck;
+        if (needsAck) {
+          const ackBody = `${BOT_MARKER} acknowledgment — received and opened. The next update here will be a fix, findings, or the maintainer in person.`;
+          const ack = spawnSync(GH_BIN, ['issue', 'comment', String(issue.number), '--repo', repo, '--body', ackBody], { encoding: 'utf8' });
+          acked = ack.status === 0;
+        }
+        if (sent || acked) state[key] = {
+          ...(state[key] || {}), firstSeenAt: state[key]?.firstSeenAt || new Date(now).toISOString(),
+          ...(needsNewPage && sent ? { newAlertAt: new Date(now).toISOString() } : {}),
+          ...(needsAck && acked ? { ackAt: new Date(now).toISOString() } : {}), title: issue.title, url,
+        };
+        alertsSent.push({ number: issue.number, sent, acked, kind: 'new-issue',
+          pageAttempted: needsNewPage, ackAttempted: needsAck,
+          reason: needsNewPage && !topic ? 'no ntfy topic configured' : null });
       }
     }
 

package/scripts/model-terminal-launchers.mjs

@@ -111,7 +111,7 @@ export function installTerminalLaunchers({ home = os.homedir(), nodeBinary = pro
     if ([runner, ...Object.keys(contents)].includes(binary)) throw new Error('Native terminal launcher recursion refused');
   }
   const receipt = { apply, launchers, configPath, config, shellSource, shellConflicts: shell.conflicts, backups: [],
-    claudeEnforcementScope: realClaude ? 'Startup hook activation guard; continuing native worker enforcement requires separate proof' : null };
+    claudeEnforcementScope: realClaude ? 'Controlled native prompt boundary; model observations and effective effort settings checked for each completed turn' : null };
   if (!apply) return receipt;
   for (const file of [configPath, ...Object.keys(contents), ...(manageZsh ? [shellSource, zshrc] : [])]) {
     const original = backup(file); if (original) receipt.backups.push(original);
@@ -226,18 +226,22 @@ export function validateClaudeTerminalArguments(args) {
   return { options, prompts };
 }
 
+function claudeAdministrativeArguments(args) {
+  const administrativeArgs = args[0] === '--permission-mode' && args[1] === 'bypassPermissions' ? args.slice(2) : args;
+  const information = new Set(['--help', '-h', '--version', '-v']);
+  const ownerPermissionFlags = new Set(['--dangerously-skip-permissions', '--allow-dangerously-skip-permissions']);
+  return administrativeArgs.some(arg => information.has(arg)) &&
+    administrativeArgs.every(arg => information.has(arg) || ownerPermissionFlags.has(arg)) ||
+    ['auth', 'mcp', 'plugin', 'plugins', 'update', 'upgrade', 'doctor', 'install'].includes(administrativeArgs[0]);
+}
+
 /** Native plugin startup only: an unloaded/crashed native worker may skip subsequent hooks. */
 export async function runClaudeTerminal({ config, args = [], env = process.env, startupMs = 10000,
   tempRoot = os.tmpdir(), cwd = process.cwd(), signalSource = process, diagnostics = process.stderr } = {}) {
   if (env.RNB_TERMINAL_LAUNCH_ACTIVE) throw new Error('Native terminal launcher recursion refused');
   if (!Number.isFinite(startupMs) || startupMs <= 0 || startupMs > 60000) throw new Error('Bounded native hook startup deadline required');
   const binary = executable(config.realClaude), clean = subscriptionEnvironment(env);
-  const information = new Set(['--help', '-h', '--version', '-v']);
-  const ownerPermissionFlags = new Set(['--dangerously-skip-permissions', '--allow-dangerously-skip-permissions']);
-  const administrative = args.some((arg) => information.has(arg)) &&
-    args.every((arg) => information.has(arg) || ownerPermissionFlags.has(arg)) ||
-    ['auth', 'mcp', 'plugin', 'plugins', 'update', 'upgrade', 'doctor', 'install'].includes(args[0]);
-  if (administrative) {
+  if (claudeAdministrativeArguments(args)) {
     const child = spawn(binary, args, { env: clean, cwd, stdio: 'inherit', shell: false });
     const unforward = forwardSignals(child, signalSource);
     try { return await exitOf(child); } finally { unforward(); }
@@ -280,8 +284,14 @@ export async function runClaudeTerminal({ config, args = [], env = process.env,
   }
 }
 
-export async function runTerminalLauncher({ host, args, config, env = process.env, signalSource = process } = {}) {
-  if (host === 'claude') return runClaudeTerminal({ config, args, env, signalSource });
+export async function runTerminalLauncher({ host, args = [], config, env = process.env, signalSource = process } = {}) {
+  if (host === 'claude') {
+    if (claudeAdministrativeArguments(args)) return runClaudeTerminal({ config, args, env, signalSource });
+    if (env.RNB_TERMINAL_LAUNCH_ACTIVE) throw new Error('Native terminal launcher recursion refused');
+    const { launchControlledClaudeTerminal } = await import('./claude-controlled-terminal.mjs');
+    await launchControlledClaudeTerminal({ binary: executable(config.realClaude), args, env, cwd: process.cwd() });
+    return { code: 0, signal: null };
+  }
   if (host !== 'codex') throw new Error('Unsupported terminal host');
   const invocation = terminalInvocation({ host, args, config, env });
   const child = spawn(invocation.command, invocation.args, { env: { ...subscriptionEnvironment(env), RNB_TERMINAL_LAUNCH_ACTIVE: '1' }, stdio: 'inherit', shell: false });

package/scripts/model-weekly-cycle.mjs

@@ -36,16 +36,50 @@ function writeOwned(dir, token, file, value) { const committed = transaction(dir
 function release(dir, token) { transaction(dir, () => { if (json(dir, ownerFile, 4096)?.token === token) fs.unlinkSync(path.join(dir, ownerFile)); }); }
 export function runCycleStage({ script, args, timeoutMs, env, spawnHost = spawn }) {
   return new Promise((resolve, reject) => {
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 900000) throw new Error('Invalid weekly stage deadline');
+    const deadline = performance.now() + timeoutMs, retirementMs = Math.min(1000, timeoutMs / 10);
+    const workDeadline = deadline - retirementMs;
     const child = spawnHost(process.execPath, [path.join(DIR, script), ...args], { env, shell: false, stdio: ['ignore', 'pipe', 'pipe'] });
-    let stdout = '', timedOut = false, killTimer;
-    const timer = setTimeout(() => { timedOut = true; child.kill('SIGTERM'); killTimer = setTimeout(() => child.kill('SIGKILL'), 1000); }, timeoutMs);
-    child.stderr.on('data', () => {}); child.stdout.on('data', (d) => { stdout += d; if (stdout.length > 262144) { timedOut = true; child.kill('SIGKILL'); } });
-    child.once('error', () => { clearTimeout(timer); clearTimeout(killTimer); reject(new Error('Weekly cycle child host unavailable')); });
-    child.once('exit', (code) => { clearTimeout(timer); clearTimeout(killTimer);
-      if (timedOut) return reject(new Error('Weekly cycle child exceeded bounded deadline or output limit'));
-      let result; try { result = JSON.parse(stdout.trim().split('\n').at(-1)); } catch { return reject(new Error('Weekly cycle child receipt missing')); }
-      resolve({ code, result });
+    let stdout = '', outputBytes = 0, failure, settled = false, exitObserved = false;
+    let timer, killTimer, retirementTimer;
+    const kill = (signal) => { try { child.kill(signal); } catch { /* owned child retirement remains unverified */ } };
+    const finish = (error, value) => {
+      if (settled) return; settled = true;
+      clearTimeout(timer); clearTimeout(killTimer); clearTimeout(retirementTimer);
+      // Drop only our child's referenced handles, including pipes held open after its exit.
+      // Signals/exit cannot prove detached descendants retired.
+      for (const stream of [child.stdin, child.stdout, child.stderr]) { try { stream?.destroy?.(); } catch { /* best effort */ } }
+      try { child.unref?.(); } catch { /* best effort */ }
+      if (error) {
+        error.stageCleanup = { ownedChildPid: child.pid ?? null, childExitObserved: exitObserved,
+          ownedChildRetirement: exitObserved ? 'exit-observed' : 'unverified', descendantRetirement: 'unproven' };
+        reject(error);
+      } else resolve(value);
+    };
+    const fail = (reason) => {
+      if (settled || failure) return; failure = new Error(reason);
+      // Reserve retirement inside the caller's budget; do not wait indefinitely for exit/close.
+      const remaining = Math.max(0, Math.min(retirementMs, deadline - performance.now()));
+      killTimer = setTimeout(() => kill('SIGKILL'), remaining / 2);
+      retirementTimer = setTimeout(() => finish(failure), remaining);
+      kill('SIGTERM');
+    };
+    const consume = (chunk, capture) => {
+      if (settled || failure) return;
+      if (performance.now() >= workDeadline) return fail('Weekly cycle child exceeded bounded deadline or output limit');
+      outputBytes += Buffer.isBuffer(chunk) ? chunk.length : Buffer.byteLength(String(chunk));
+      if (outputBytes > 262144) return fail('Weekly cycle child exceeded bounded deadline or output limit');
+      if (capture) stdout += chunk;
+    };
+    child.stderr.on('data', (chunk) => consume(chunk, false)); child.stdout.on('data', (chunk) => consume(chunk, true));
+    child.on('error', () => fail('Weekly cycle child host unavailable'));
+    child.once('exit', (code) => {
+      exitObserved = true; if (failure) return finish(failure); if (settled) return;
+      if (performance.now() >= workDeadline) { fail('Weekly cycle child exceeded bounded deadline or output limit'); return finish(failure); }
+      let result; try { result = JSON.parse(stdout.trim().split('\n').at(-1)); } catch { return finish(new Error('Weekly cycle child receipt missing')); }
+      finish(null, { code, result });
     });
+    timer = setTimeout(() => fail('Weekly cycle child exceeded bounded deadline or output limit'), Math.max(0, workDeadline - performance.now()));
   });
 }
 const INVENTORY_URL = 'https://openrouter.ai/api/v1/models';
@@ -172,7 +206,9 @@ export async function runWeeklyCycle({ routerDir = path.join(os.homedir(), '.cla
     delete state.pendingSemanticReceipt; delete state.pendingSemanticReleaseIds;
     state.lastQualification = qualified.result; save(STATE_FILE, state); record.status = 'complete';
     save('weekly-cycle-last-attempt.json', record); return record;
-  } catch (error) { record.status = 'failed'; record.releaseStatus = 'unknown-or-pending'; record.reason = error.message.slice(0, 240); try { save('weekly-cycle-last-attempt.json', record); } catch { /* superseded cannot write */ } return record;
+  } catch (error) { record.status = 'failed'; record.releaseStatus = 'unknown-or-pending'; record.reason = error.message.slice(0, 240);
+    if (error.stageCleanup) record.stageCleanup = error.stageCleanup;
+    try { save('weekly-cycle-last-attempt.json', record); } catch { /* superseded cannot write */ } return record;
   } finally { release(routerDir, token); }
 }
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {

package/scripts/record-lesson.mjs

@@ -19,7 +19,8 @@
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
-import { resolveRuflo, RUFLO_MISSING } from '../plugin/scripts/ruflo-bin.mjs';
+import { randomUUID } from 'node:crypto';
+import { resolveRuflo, rufloInvocation, RUFLO_MISSING } from '../plugin/scripts/ruflo-bin.mjs';
 
 const arg = (name, def = '') => {
   const i = process.argv.indexOf(`--${name}`);
@@ -60,21 +61,26 @@ const value = [
   worked ? `WORKED: ${worked}` : null,
   critique ? `CRITIQUE: ${critique}` : null,
   `OUTCOME: ${outcome}`,
+  `RECORDING: ${randomUUID()}`, // binds the read-back to THIS canonical lesson write
 ].filter(Boolean).join(' ');
 
 // Every `ruflo` invocation auto-starts a project background daemon unless this is set (verified
 // live: ~/.npm-global/lib/node_modules/ruflo/node_modules/@claude-flow/cli/dist/src/services/
 // daemon-autostart.js:85) — recording a lesson has no business leaving one running.
-const ruflo = (args) =>
-  execFileSync(RUFLO, args, { cwd: dir, encoding: 'utf8', timeout: 60000,
-    shell: process.platform === 'win32', env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' } });
+const ruflo = (args) => {
+  const invocation = rufloInvocation(RUFLO, args);
+  return execFileSync(invocation.executable, invocation.args, {
+    cwd: dir, encoding: 'utf8', timeout: 60000, shell: false,
+    env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' },
+  });
+};
 
 console.log(`\nRecording lesson into ${path.basename(dir)}/.swarm/memory.db  (namespace: ${ns})`);
 console.log(`  key: ${key}`);
 
 // 1a. STORE (native, signal namespace) — L1 content + L2 embedding
 try {
-  ruflo(['memory', 'store', '-k', key, '-n', ns, '--value', value]);
+  ruflo(['memory', 'store', '-k', key, '-n', ns, '--value', value, '--path', db]);
 } catch (e) {
   console.error('  store FAILED:', String(e.stdout || e.message).split('\n')[0]);
   process.exit(1);
@@ -91,7 +97,7 @@ try {
 let stored = false;
 try {
   const back = ruflo(['memory', 'retrieve', '-k', key, '-n', ns, '--value-only', '--path', db]);
-  stored = String(back).includes(value);
+  stored = String(back) === value;
 } catch (e) {
   console.error('  round-trip FAILED:', String(e.stdout || e.message).split('\n')[0]);
 }
@@ -133,6 +139,6 @@ console.log(
 // DERIVED, not asserted (F15): the closing line reports exactly what was verified, never more. The
 // old line claimed "captured, refined, and recall-verified" even when distill failed and recall
 // didn't return the key — asserted prose over an honest exit code.
-const parts = ['captured', distillOk ? 'refined' : 'NOT refined (distill failed)', recalled ? 'recall-verified' : 'recall NOT verified'];
+const parts = [stored ? 'captured' : 'capture NOT verified', distillOk ? 'refined' : 'NOT refined (distill failed)', recalled ? 'recall-verified' : 'recall NOT verified'];
 console.log(`\nDone. Lesson is ${parts.join(', ')}.\n`);
 process.exit(stored ? 0 : 1);

package/scripts/release-qualification-contract.mjs

@@ -1,6 +1,34 @@
 // Reviewed stabilization release boundaries. Legacy tests remain developer diagnostics.
 export const RELEASE_REQUIREMENTS = Object.freeze({
   "source": [
+    {
+      "id": "installer-release-argument-safety",
+      "reason": "Incomplete named releases refuse before network or settings writes; valid named releases and installer help retain their contracts",
+      "files": ["tests/unit/install-release-fallback.test.mjs"]
+    },
+    {
+      "id": "honest-currency-lesson-and-metrics-evidence",
+      "reason": "Foreign KB roots remain isolated; panel currency derives from measured completion rather than checkout time; exact lesson readback binds this shell-free write; public metrics never fabricate performance or a competing product score",
+      "files": ["tests/unit/forge-currency-selected-root.test.mjs", "tests/unit/brain-score-producer.test.mjs", "tests/unit/brain-grade-groundtruth-timestamp.test.mjs", "tests/unit/record-lesson.test.mjs", "tests/unit/lesson-presentation-budget.test.mjs", "tests/unit/metrics-truth.test.mjs", "tests/unit/issue-watch-retry.test.mjs"]
+    },
+    {
+      "id": "automatic-update-source-and-transport",
+      "reason": "Captured owner policy never falls back on read failures; installed-only automation avoids npx; transient GET and body failures retry without weakening trust; POSIX executable aliases retain interpreter identity",
+      "files": ["tests/unit/automatic-update.test.mjs", "tests/unit/download-retry.test.mjs"],
+      "platformFiles": {
+        "linux": ["tests/unit/automatic-update-node-alias.test.mjs"],
+        "macos": ["tests/unit/automatic-update-node-alias.test.mjs"]
+      }
+    },
+    {
+      "id": "customer-scope-and-session-ownership",
+      "reason": "Captured assistant commitments retain their actual session owner and honest noncompleted states; scoped grounding retains strict conservative evidence under contention; legacy guidance never suppresses a tool call",
+      "files": ["tests/unit/continuation-commitment-ownership.test.mjs"],
+      "platformFiles": {
+        "linux": ["tests/unit/grounding-scope.test.mjs", "tests/unit/hijack-no-defer.test.mjs"],
+        "macos": ["tests/unit/grounding-scope.test.mjs", "tests/unit/hijack-no-defer.test.mjs"]
+      }
+    },
     {
       "id": "bounded-advocacy-and-write-grounding",
       "reason": "Explicit document meaning requests retain corroboration; literal searches stay silent; POSIX complete-write exemptions preserve executable and managed-store grounding",
@@ -83,7 +111,8 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
         "tests/unit/forge-update-apply-rollback.test.mjs",
         "tests/unit/forge-update-archive-digest.test.mjs",
         "tests/unit/kb-copy-proof-legacy-sidecars.test.mjs",
-        "tests/unit/kb-copy-proof-unknown-content.test.mjs"
+        "tests/unit/kb-copy-proof-unknown-content.test.mjs",
+        "tests/unit/user-model-hook-install.test.mjs"
       ]
     },
     {
@@ -106,8 +135,8 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
         "tests/unit/model-routing-launchers.test.mjs"
       ],
       "platformFiles": {
-        "linux": ["tests/unit/model-terminal-gateway.test.mjs", "tests/unit/model-terminal-launchers.test.mjs"],
-        "macos": ["tests/unit/model-terminal-gateway.test.mjs", "tests/unit/model-terminal-launchers.test.mjs"],
+        "linux": ["tests/unit/model-terminal-gateway.test.mjs", "tests/unit/model-terminal-launchers.test.mjs", "tests/unit/claude-controlled-terminal.test.mjs"],
+        "macos": ["tests/unit/model-terminal-gateway.test.mjs", "tests/unit/model-terminal-launchers.test.mjs", "tests/unit/claude-controlled-terminal.test.mjs"],
         "windows": ["tests/unit/windows-terminal-boundary.test.mjs"]
       }
     },
@@ -145,9 +174,11 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
     },
     {
       "id": "canonical-memory-privacy",
-      "reason": "Canonical project isolation, persisted consent and truthful capture status",
+      "reason": "Canonical project isolation, persisted consent, excluded-resource privacy before recording, immutable delivery refusal and truthful terminal failure status",
       "files": [
         "tests/unit/turn-outcome-capture.test.mjs",
+        "tests/unit/turn-capture-content-privacy.test.mjs",
+        "tests/integration/project-progression-hook.test.mjs",
         "tests/unit/turn-journal-platform.test.mjs",
         "tests/unit/project-store-resolver.test.mjs"
       ]