ruvnet-brain 4.7.20 → 4.7.22

package/scripts/stamp-sweep.mjs

@@ -39,6 +39,7 @@ import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { ensureStamp, hasStamp, stampInsertionPoint } from '../plugin/scripts/md-stamp.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 export const REPO_ROOT = path.resolve(HERE, '..');
@@ -137,7 +138,7 @@ function main() {
 }
 
 function isMain() {
-  try { return process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url); }
+  try { return isDirectInvocation(import.meta.url); }
   catch { return false; }
 }
 

package/scripts/status-honesty.mjs

@@ -28,6 +28,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -115,7 +116,7 @@ export function scanRepo(root = ROOT) {
   return out;
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isDirectInvocation(import.meta.url)) {
   const bad = scanRepo();
   if (bad.length) {
     console.error('status-honesty: ASSERTED (underived) terminal success literals found:\n');

package/scripts/sync-commands.mjs

@@ -34,6 +34,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const DIR = path.join(ROOT, 'plugin', 'commands');
@@ -76,8 +77,7 @@ function rebuild(aliasText, canonicalFrontmatter, canonicalBody) {
 // able to crash the caller that merely imported this module: not-resolvable means not-main.
 function resolvedIsMain() {
   try {
-    return Boolean(process.argv[1])
-      && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
+    return isDirectInvocation(import.meta.url);
   } catch { return false; }
 }
 if (!resolvedIsMain()) { /* imported for its exports — do nothing else */ } else {

package/scripts/top100-benchmark.mjs

@@ -10,6 +10,7 @@ import { performance } from 'node:perf_hooks';
 import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { pathToFileURL, fileURLToPath } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const CORPUS = path.join(ROOT, 'evals', 'top-100.json');
@@ -476,4 +477,4 @@ Use --out when a durable evidence artifact is intentional; release checks are pu
   });
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) await main();
+if (isDirectInvocation(import.meta.url)) await main();

package/scripts/top100-corpus.mjs

@@ -5,6 +5,7 @@ import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { semanticAssertionsFor } from './top100-semantic-assertions.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HELD_OUT = path.join(ROOT, 'evals', 'held-out.json');
@@ -105,7 +106,7 @@ export function corpusHash(corpus) {
   return createHash('sha256').update(JSON.stringify(corpus.questions)).digest('hex');
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isDirectInvocation(import.meta.url)) {
   const corpus = buildTop100();
   fs.writeFileSync(OUT, JSON.stringify({ ...corpus, sha256: corpusHash(corpus) }, null, 2) + '\n');
   console.log(`${OUT}: ${corpus.questions.length} questions, sha256=${corpusHash(corpus)}`);

package/scripts/user-model-hook-install.mjs

@@ -5,6 +5,7 @@ import path from 'node:path';
 import os from 'node:os';
 import crypto from 'node:crypto';
 import { pathToFileURL } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 export function shellQuote(value) { return `'${value.replaceAll("'", "'\\''")}'`; }
 
@@ -134,7 +135,7 @@ export function applyUserModelHooks(plan) {
   return { applied: true, written };
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+if (isDirectInvocation(import.meta.url)) {
   try {
     const args = process.argv.slice(2);
     if (args.some(arg => !['--apply', '--dry-run', '--plan'].includes(arg))) throw new Error('Usage: user-model-hook-install.mjs [--apply|--dry-run|--plan]');

package/scripts/user-model-prompt-hook.mjs

@@ -8,6 +8,7 @@ import os from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { pathToFileURL } from 'node:url';
 import { weeklyCycleStatus } from './model-weekly-cycle.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 export const PRESENTATION = 'For terminal briefings: give concise executive status; use narrow padded ASCII tables with borders, plain cell text, aligned columns and short rows. Never send pipe-delimited Markdown tables to this terminal. Use short lists when a table would wrap. Do not flood the response with commands or technical logs.';
 
@@ -65,6 +66,6 @@ async function main() {
   process.stdout.write(JSON.stringify(envelope(promptContext(payload))) + '\n');
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+if (isDirectInvocation(import.meta.url)) {
   main().catch(() => process.stdout.write(JSON.stringify(envelope(PRESENTATION)) + '\n'));
 }

package/scripts/verify-bundle.mjs

@@ -42,7 +42,9 @@ export function verifyBundle(bundlePath, sigPath = `${bundlePath}.sig`, pubPath
 }
 
 // CLI
-if (import.meta.url === `file://${process.argv[1]}`) {
+// Copied ALONE into every brain bundle (scripts/build-bundle.mjs), so it cannot import
+// plugin/scripts/entrypoint.mjs; this is that helper's comparison, inline: real paths on both sides.
+if ((() => { try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; } })()) {
   const [bundle, sig] = process.argv.slice(2);
   if (!bundle) { console.error('Usage: node scripts/verify-bundle.mjs <bundle.zip> [<bundle.zip.sig>]'); process.exit(2); }
   const r = verifyBundle(bundle, sig);

package/scripts/verify-model-catalog.mjs

@@ -15,6 +15,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(__dirname, '..');
@@ -99,6 +100,6 @@ export async function main(argv = process.argv) {
   console.log(`✓ model-catalog VERIFIED: ${r.checked} model facts match the ${live ? 'LIVE OpenRouter' : 'committed snapshot'} catalog (pulled ${source.pulledAt}, ${r.ageDays.toFixed(1)}d old ≤ 14d).`);
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isDirectInvocation(import.meta.url)) {
   main().catch((e) => { console.error('verify-model-catalog error:', e.message); process.exit(1); });
 }

package/scripts/version.mjs

@@ -6,6 +6,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 export const PLUGIN_JSON = path.join(ROOT, 'plugin', '.claude-plugin', 'plugin.json');
@@ -35,6 +36,6 @@ export function getVersionTag() {
 export const stripTag = (v) => String(v).replace(/^v/, '');
 
 // CLI: `node scripts/version.mjs` prints the version (handy for shell scripts).
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isDirectInvocation(import.meta.url)) {
   process.stdout.write(getVersion() + '\n');
 }

package/scripts/wired-check.mjs

@@ -172,8 +172,8 @@ const STANDALONE = [
   // plist's own ProgramArguments on 2026-07-23, not assumed from the header comment alone:
   ['clear-claude-tmp', 'launchd, every 3h (out-of-repo scheduler) — confirmed live: '
     + 'com.stuartkerr.clear-claude-tmp.plist is loaded and its ProgramArguments invoke this exact file'],
-  ['nightly-gists', 'launchd nightly 21:47 (out-of-repo scheduler) — confirmed live: '
-    + 'com.ruvnet.brain-gists.plist is loaded and its ProgramArguments invoke this exact file'],
+  ['nightly-gists', 'manual re-embed of the developer checkout gists store (the launchd job '
+    + 'com.ruvnet.brain-gists was retired 2026-10-26: no installed brain reads that store)'],
   ['nightly-wrapper', 'author-run maintenance harness, deliberately unscheduled; refuses primary, nested, and dirty worktrees'],
   ['routing-flywheel', 'launchd nightly 04:45 --dry-run (out-of-repo scheduler) — confirmed live: '
     + 'com.ruvnet.routing-flywheel.plist is loaded and its ProgramArguments invoke this exact file'],
@@ -226,6 +226,8 @@ const STANDALONE = [
     + 'starts themselves (--url http://127.0.0.1:.../page.html, via Playwright) — needs a live '
     + 'rendered page, not a static diff, so it is a dev-loop tool like gen-console-images.mjs, not a '
     + 'CI step'],
+  ['recall-latency-probe', 'human-run measurement (#429): times prompt recall and SessionStart restore against a real '
+    + 'project store and exits 1 outside the budgets; it reads the owner\'s live store and loads the machine, so no scheduler runs it'],
   ['dev-plugin-link', 'developer convenience CLI — its own header: "Users never run it." Hot-links '
     + 'the cached plugin install to the working tree so hook edits apply without a CC restart'],
 
@@ -409,13 +411,13 @@ export const REQUIRED_OPERATIONAL_EXPORTS = [
 const isTestFile = (f) => /\.(test|spec)\.(mjs|js)$/.test(path.basename(f))
   || f.includes(`${path.sep}tests${path.sep}`) || f.startsWith(`tests${path.sep}`);
 
-function walk(abs, recurse, out = []) {
+function walk(abs, recurse, out = [], prune = () => false) {
   let entries = [];
   try { entries = fs.readdirSync(abs, { withFileTypes: true }); } catch { return out; }
   for (const e of entries) {
     const full = path.join(abs, e.name);
     if (e.isDirectory()) {
-      if (recurse && e.name !== 'node_modules' && !e.name.startsWith('.')) walk(full, recurse, out);
+      if (recurse && e.name !== 'node_modules' && !e.name.startsWith('.') && !prune(full)) walk(full, recurse, out, prune);
     } else out.push(full);
   }
   return out;
@@ -451,7 +453,10 @@ function callerFiles(repo = REPO) {
     // wired into pre-push and `wired-check` went on reporting it `manual`. This file's own note names
     // the remedy: "an invoker outside the roots proves the ROOTS are incomplete — the fix is to add
     // the root, never to" special-case the module. Same rule, applied to the extension filter.
-    for (const f of walk(abs, true)) {
+    // Pruned BEFORE descending (see the worktrees note below): 100+ agent worktrees under .claude/ are full
+    // repository copies, and walking them only to drop every file afterwards dominated this audit's run time.
+    const worktrees = path.join(repo, '.claude', 'worktrees');
+    for (const f of walk(abs, true, [], (dir) => dir === worktrees)) {
       // `.claude/` is a caller root because `.claude/settings.json` genuinely invokes hooks. But
       // `.claude/worktrees/<agent>/` holds FULL COPIES of this repository (Claude Code agent
       // worktrees), and a copy of the repo is not a caller of the repo. Measured 2026-09-11: with any
@@ -634,6 +639,9 @@ export function callersOf(mod, files, repo = REPO, sourceCache = createInvocatio
     const rel = path.relative(repo, f).split(path.sep).join('/');
     if (rel === mod.rel) continue;              // self
     if (isTestFile(rel)) continue;              // a test is not a caller
+    // Cheap substring pre-filter: callerPattern() only ever matches text that contains the literal file
+    // name, so skipping the regex when the name is absent cannot change the result, only its cost.
+    if (!sourceCache.read(f)?.includes(mod.file)) continue;
     const src = sourceCache.commentFree(f);
     if (src !== null && re.test(src)) hits.push(rel);
   }

package/scripts/worktree-integrity.mjs

@@ -12,6 +12,7 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 function git(cwd, args) {
   const result = spawnSync('git', ['-C', cwd, ...args], { encoding: 'utf8' });
@@ -101,8 +102,7 @@ export function assertPrimaryCheckoutUnchanged(root, before) {
   return after;
 }
 
-const invokedDirectly = process.argv[1]
-  && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
+const invokedDirectly = isDirectInvocation(import.meta.url);
 if (invokedDirectly) {
   try {
     const command = process.argv[2];