shieldcortex 4.13.0 → 4.14.0

package/dist/worker/brain-worker.js

@@ -9,7 +9,7 @@
  *
  * This transforms the memory system from reactive to continuously organic.
  */
-import { DEFAULT_WORKER_CONFIG, } from './types.js';
+import { DEFAULT_WORKER_CONFIG, MCP_LIGHT_TICK_INTERVAL_MS, } from './types.js';
 import { getDatabase } from '../database/init.js';
 import { pruneActivationCache } from '../memory/activation.js';
 import { getMemoryStats } from '../memory/store.js';
@@ -22,6 +22,21 @@ import { processRetryQueue, purgeOldEntries } from '../cloud/sync-queue.js';
 import { sendHeartbeat } from '../cloud/sync.js';
 import { refreshCloudIronDome, applyCachedCloudPatterns } from '../cloud/iron-dome-sync.js';
 import { isFeatureEnabled } from '../license/gate.js';
+import { existsSync, mkdirSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+const WORKER_STATE_DIR = join(homedir(), '.shieldcortex', 'state');
+const WORKER_STATE_FILE = join(WORKER_STATE_DIR, 'worker.json');
+function persistWorkerState(profile, lastLightTick) {
+    try {
+        if (!existsSync(WORKER_STATE_DIR))
+            mkdirSync(WORKER_STATE_DIR, { recursive: true });
+        writeFileSync(WORKER_STATE_FILE, JSON.stringify({ pid: process.pid, profile, lastLightTick: lastLightTick.toISOString() }, null, 2), 'utf-8');
+    }
+    catch {
+        // Best-effort: doctor will warn if the file is stale or missing
+    }
+}
 /**
  * Brain Worker Class
  *
@@ -47,10 +62,17 @@ export class BrainWorker {
     /**
      * Create a new BrainWorker
      *
-     * @param config - Partial configuration to override defaults
+     * @param config - Partial configuration to override defaults. When `profile`
+     *                is 'mcp' and no explicit `lightTickIntervalMs` is provided,
+     *                the lite 15-minute cadence is applied so MCP-server-mode
+     *                workers don't run as often as dashboard-mode ones.
      */
     constructor(config = {}) {
-        this.config = { ...DEFAULT_WORKER_CONFIG, ...config };
+        const merged = { ...DEFAULT_WORKER_CONFIG, ...config };
+        if (merged.profile === 'mcp' && config.lightTickIntervalMs === undefined) {
+            merged.lightTickIntervalMs = MCP_LIGHT_TICK_INTERVAL_MS;
+        }
+        this.config = merged;
     }
     /**
      * Start the background worker
@@ -62,17 +84,26 @@ export class BrainWorker {
             return;
         }
         this.isRunning = true;
-        console.log('[BrainWorker] Starting background worker');
+        console.log(`[BrainWorker] Starting background worker (profile=${this.config.profile} pid=${process.pid})`);
         console.log(`[BrainWorker] Light tick interval: ${this.config.lightTickIntervalMs / 1000}s`);
-        console.log(`[BrainWorker] Medium tick interval: ${this.config.mediumTickIntervalMs / 1000}s`);
-        // Light tick every 5 minutes (by default)
+        if (this.config.profile === 'full') {
+            console.log(`[BrainWorker] Medium tick interval: ${this.config.mediumTickIntervalMs / 1000}s`);
+        }
+        else {
+            console.log('[BrainWorker] MCP profile — medium tick + cloud sync disabled');
+        }
+        // Light tick — every 5 min (full) or every 15 min (mcp)
         this.lightTimer = setInterval(() => this.lightTick(), this.config.lightTickIntervalMs);
         this.lightTimer.unref();
-        // Medium tick every 30 minutes (by default)
-        this.mediumTimer = setInterval(() => this.mediumTick(), this.config.mediumTickIntervalMs);
-        this.mediumTimer.unref();
-        // Apply cached cloud Iron Dome patterns immediately on start (requires Pro+)
-        if (isFeatureEnabled('custom_injection_patterns')) {
+        // Medium tick — full profile only. mcp-mode skips link discovery,
+        // contradiction scans, graph maintenance, and sync-queue purging — those
+        // are dashboard concerns and shouldn't multiply across N MCP windows.
+        if (this.config.profile === 'full') {
+            this.mediumTimer = setInterval(() => this.mediumTick(), this.config.mediumTickIntervalMs);
+            this.mediumTimer.unref();
+        }
+        // Apply cached cloud Iron Dome patterns immediately on start (Pro+, full only)
+        if (this.config.profile === 'full' && isFeatureEnabled('custom_injection_patterns')) {
             try {
                 applyCachedCloudPatterns();
             }
@@ -150,38 +181,42 @@ export class BrainWorker {
                     result: result.predictiveConsolidation,
                 });
             }
-            // 3. Process cloud sync retry queue
-            try {
-                const retryResult = await processRetryQueue();
-                if (retryResult.processed > 0) {
-                    console.log(`[BrainWorker] Sync retry queue: processed ${retryResult.processed} ` +
-                        `(${retryResult.succeeded} ok, ${retryResult.failed} retry, ${retryResult.permanentlyFailed} failed)`);
-                }
-            }
-            catch (retryError) {
-                console.error('[BrainWorker] Sync retry queue failed:', retryError);
-            }
-            // 4. Send cloud heartbeat (keeps device status "Online") — Team+ only
-            if (isFeatureEnabled('cloud_sync')) {
+            // 3-5: cloud sync (retry queue, heartbeat, Iron Dome) — full profile only.
+            // Skipped under MCP profile so we don't fan out N concurrent network calls
+            // from N open Claude Code windows.
+            if (this.config.profile === 'full') {
                 try {
-                    sendHeartbeat();
+                    const retryResult = await processRetryQueue();
+                    if (retryResult.processed > 0) {
+                        console.log(`[BrainWorker] Sync retry queue: processed ${retryResult.processed} ` +
+                            `(${retryResult.succeeded} ok, ${retryResult.failed} retry, ${retryResult.permanentlyFailed} failed)`);
+                    }
                 }
-                catch {
-                    // Truly silent — heartbeat is best-effort
+                catch (retryError) {
+                    console.error('[BrainWorker] Sync retry queue failed:', retryError);
                 }
-            }
-            // 5. Refresh Iron Dome cloud patterns + policy — Pro+ only
-            if (isFeatureEnabled('custom_injection_patterns')) {
-                try {
-                    await refreshCloudIronDome();
+                if (isFeatureEnabled('cloud_sync')) {
+                    try {
+                        sendHeartbeat();
+                    }
+                    catch {
+                        // Truly silent — heartbeat is best-effort
+                    }
                 }
-                catch {
-                    // Non-critical — cloud Iron Dome sync is best-effort
+                if (isFeatureEnabled('custom_injection_patterns')) {
+                    try {
+                        await refreshCloudIronDome();
+                    }
+                    catch {
+                        // Non-critical — cloud Iron Dome sync is best-effort
+                    }
                 }
             }
             // Update stats
             this.lastLightTick = result.timestamp;
             this.stats.lightTicks++;
+            // Persist worker freshness for `shieldcortex doctor` to detect stalls.
+            persistWorkerState(this.config.profile, result.timestamp);
             // Emit light tick event
             emitWorkerLightTick(result);
             // Log summary
@@ -314,19 +349,24 @@ export class BrainWorker {
 // Default singleton instance (optional - server can create its own)
 let defaultWorker = null;
 /**
- * Get or create the default worker instance
+ * Get or create the default worker instance.
+ * The first call wins — subsequent calls return the existing singleton even
+ * if a different config is passed. That's intentional: it prevents accidental
+ * re-instantiation from creating two competing timer sets within one process.
  */
-export function getDefaultWorker() {
+export function getDefaultWorker(config) {
     if (!defaultWorker) {
-        defaultWorker = new BrainWorker();
+        defaultWorker = new BrainWorker(config);
     }
     return defaultWorker;
 }
 /**
- * Start the default worker if not already running
+ * Start the default worker if not already running. Forwards config to the
+ * underlying constructor on first call (used by MCP-server mode to start
+ * with `profile: 'mcp'`).
  */
-export function startDefaultWorker() {
-    const worker = getDefaultWorker();
+export function startDefaultWorker(config) {
+    const worker = getDefaultWorker(config);
     if (!worker.isActive()) {
         worker.start();
     }

package/dist/worker/types.d.ts

@@ -7,6 +7,17 @@
  * for the background brain worker.
  */
 import { ConsolidationResult } from '../memory/types.js';
+/**
+ * Worker profile.
+ *   - 'full': dashboard / api / worker modes — runs medium tick, cloud sync,
+ *     link discovery, the works.
+ *   - 'mcp':  default MCP-server mode (one process per Claude Code window) —
+ *     keeps consolidation alive but skips heavy/networked work so we don't
+ *     multiply background load by the number of open windows. Without this,
+ *     hooks-only installs never run consolidation and STM never graduates
+ *     to LTM (#45).
+ */
+export type WorkerProfile = 'full' | 'mcp';
 /**
  * Configuration for the brain worker
  */
@@ -27,11 +38,19 @@ export interface WorkerConfig {
     contradictionScanLimit: number;
     /** High activity threshold - memories created in 30 min (default: 5) */
     highActivityThreshold: number;
+    /** Worker profile - 'full' (default) or 'mcp' (lite, see WorkerProfile docs) */
+    profile: WorkerProfile;
 }
 /**
  * Default worker configuration
  */
 export declare const DEFAULT_WORKER_CONFIG: WorkerConfig;
+/**
+ * MCP-profile interval override. 15 min vs full's 5 min — one MCP server runs
+ * per Claude Code window, so we want lower per-window cadence to keep total
+ * background work in check across many windows.
+ */
+export declare const MCP_LIGHT_TICK_INTERVAL_MS: number;
 /**
  * Result of a light tick operation
  */

package/dist/worker/types.js

@@ -18,4 +18,11 @@ export const DEFAULT_WORKER_CONFIG = {
     maxLinksPerCycle: 10,
     contradictionScanLimit: 50,
     highActivityThreshold: 5,
+    profile: 'full',
 };
+/**
+ * MCP-profile interval override. 15 min vs full's 5 min — one MCP server runs
+ * per Claude Code window, so we want lower per-window cadence to keep total
+ * background work in check across many windows.
+ */
+export const MCP_LIGHT_TICK_INTERVAL_MS = 15 * 60 * 1000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shieldcortex",
-  "version": "4.13.0",
+  "version": "4.14.0",
   "description": "Trustworthy memory and security for AI agents. Recall debugging, review queue, OpenClaw session capture, and memory poisoning defence for Claude Code, Codex, OpenClaw, LangChain, and MCP agents.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/plugins/openclaw/dist/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "4.13.0",
+  "version": "4.14.0",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,

package/scripts/lib/auto-memory-config.mjs

@@ -2,13 +2,27 @@ import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
 
-const CONFIG_PATH = join(homedir(), '.shieldcortex', 'config.json');
+function getConfigPath() {
+  // Honour the same SHIELDCORTEX_CONFIG_DIR override that src/cloud/config.ts
+  // uses, so the runtime gate and the rest of the system always resolve to the
+  // same config file (and so tests can isolate via a temp dir).
+  const override = process.env.SHIELDCORTEX_CONFIG_DIR?.trim();
+  const dir = override || join(homedir(), '.shieldcortex');
+  return join(dir, 'config.json');
+}
 
 const DEFAULTS = Object.freeze({
   maxTranscriptBytes: 1024 * 1024,
   maxTranscriptLines: 5000,
   keepSlashCommandProse: true,
-  stopHookSamplingTurns: 10,
+  // Lowered 10 → 5 in v4.14.0. At 1-in-10 the realistic capture rate over
+  // typical sessions was ~7%, which left LTM near-empty (#44). Salience
+  // bypass below catches high-signal turns at any cadence.
+  stopHookSamplingTurns: 5,
+  // Bypass the modulo gate when the last assistant turn carries a fenced
+  // code block or hits multiple keyword categories — those turns are
+  // disproportionately what we want to remember.
+  stopHookSalienceBypass: true,
   stopHookWindowBytes: 256 * 1024,
   enableSessionEnd: false,
   enableStop: false,
@@ -17,8 +31,9 @@ const DEFAULTS = Object.freeze({
 export function getAutoMemoryConfig() {
   let raw = {};
   try {
-    if (existsSync(CONFIG_PATH)) {
-      raw = JSON.parse(readFileSync(CONFIG_PATH, 'utf-8'));
+    const configPath = getConfigPath();
+    if (existsSync(configPath)) {
+      raw = JSON.parse(readFileSync(configPath, 'utf-8'));
     }
   } catch {
     // fall through to defaults
@@ -31,6 +46,9 @@ export function getAutoMemoryConfig() {
       ? overrides.keepSlashCommandProse
       : DEFAULTS.keepSlashCommandProse,
     stopHookSamplingTurns: pickPositiveInt(overrides.stopHookSamplingTurns, DEFAULTS.stopHookSamplingTurns),
+    stopHookSalienceBypass: typeof overrides.stopHookSalienceBypass === 'boolean'
+      ? overrides.stopHookSalienceBypass
+      : DEFAULTS.stopHookSalienceBypass,
     stopHookWindowBytes: pickPositiveInt(overrides.stopHookWindowBytes, DEFAULTS.stopHookWindowBytes),
     enableSessionEnd: overrides.enableSessionEnd === true,
     enableStop: overrides.enableStop === true,

package/scripts/lib/project-key.mjs

@@ -143,6 +143,12 @@ export function deriveProjectKey(cwd) {
     }
   }
 
+  // Hot path post-#42 fix: this branch should only fire outside any git repo
+  // or when origin parsing fails. If users see this often after upgrading,
+  // the helper itself needs another look.
+  if (process.env.SHIELDCORTEX_DEBUG) {
+    process.stderr.write(`[shieldcortex deriveProjectKey] basename fallback for cwd=${cwd}\n`);
+  }
   return basename;
 }
 

package/scripts/pre-compact-hook.mjs

@@ -20,6 +20,7 @@ import { saveAutoExtractedMemory } from './lib/save-memory.mjs';
 import { readTranscriptText } from './lib/transcript-reader.mjs';
 import { getAutoMemoryConfig } from './lib/auto-memory-config.mjs';
 import { recordHookInvocation } from './lib/telemetry.mjs';
+import { deriveProjectKey } from './lib/project-key.mjs';
 
 // Database paths (with legacy fallback)
 const NEW_DB_DIR = join(homedir(), '.shieldcortex');
@@ -62,39 +63,6 @@ const CATEGORY_EXTRACTION_THRESHOLDS = {
   custom: 0.45,
 };
 
-// ==================== PROJECT DETECTION (Mirrors src/context/project-context.ts) ====================
-
-/** Directories to skip when extracting project name from path */
-const SKIP_DIRECTORIES = [
-  'src', 'lib', 'dist', 'build', 'out',
-  'node_modules', '.git', '.next', '.cache',
-  'test', 'tests', '__tests__', 'spec',
-  'bin', 'scripts', 'config', 'public', 'static',
-];
-
-/**
- * Extract project name from a file path.
- * Skips common directory names that don't represent projects.
- */
-function extractProjectFromPath(path) {
-  if (!path) return null;
-
-  const segments = path.split(/[/\\]/).filter(Boolean);
-  if (segments.length === 0) return null;
-
-  // Start from the end and find first non-skipped segment
-  for (let i = segments.length - 1; i >= 0; i--) {
-    const segment = segments[i];
-    if (!SKIP_DIRECTORIES.includes(segment.toLowerCase())) {
-      // Skip hidden directories (starting with .)
-      if (segment.startsWith('.')) continue;
-      return segment;
-    }
-  }
-
-  return null;
-}
-
 // Maximum memories to auto-create per compaction.
 // Dropped 5 → 2 in v4.11.0 for the same reason thresholds were raised.
 const MAX_AUTO_MEMORIES = 2;
@@ -520,7 +488,7 @@ process.stdin.on('end', () => {
     const hookData = JSON.parse(input || '{}');
 
     const trigger = hookData.trigger || 'unknown';
-    const project = extractProjectFromPath(hookData.cwd);
+    const project = deriveProjectKey(hookData.cwd);
     const autoMemConfig = getAutoMemoryConfig();
 
     // Extract conversation text from hook data

package/scripts/session-end-hook.mjs

@@ -29,6 +29,7 @@ import { saveAutoExtractedMemory } from './lib/save-memory.mjs';
 import { readTranscriptText } from './lib/transcript-reader.mjs';
 import { getAutoMemoryConfig } from './lib/auto-memory-config.mjs';
 import { recordHookInvocation } from './lib/telemetry.mjs';
+import { deriveProjectKey } from './lib/project-key.mjs';
 
 // Database paths (with legacy fallback)
 const NEW_DB_DIR = join(homedir(), '.shieldcortex');
@@ -64,29 +65,6 @@ const CATEGORY_EXTRACTION_THRESHOLDS = {
   custom: 0.35,
 };
 
-// ==================== PROJECT DETECTION ====================
-
-const SKIP_DIRECTORIES = [
-  'src', 'lib', 'dist', 'build', 'out',
-  'node_modules', '.git', '.next', '.cache',
-  'test', 'tests', '__tests__', 'spec',
-  'bin', 'scripts', 'config', 'public', 'static',
-];
-
-function extractProjectFromPath(path) {
-  if (!path) return null;
-  const segments = path.split(/[/\\]/).filter(Boolean);
-  if (segments.length === 0) return null;
-  for (let i = segments.length - 1; i >= 0; i--) {
-    const segment = segments[i];
-    if (!SKIP_DIRECTORIES.includes(segment.toLowerCase())) {
-      if (segment.startsWith('.')) continue;
-      return segment;
-    }
-  }
-  return null;
-}
-
 // ==================== DYNAMIC THRESHOLD ====================
 
 function getMemoryStats(db) {
@@ -442,7 +420,7 @@ process.stdin.on('end', () => {
     const hookData = JSON.parse(input || '{}');
 
     const reason = hookData.reason || 'unknown';
-    const project = extractProjectFromPath(hookData.cwd);
+    const project = deriveProjectKey(hookData.cwd);
     const autoMemConfig = getAutoMemoryConfig();
 
     // Config gate: opt-in (default off). Preserves the historical default

package/scripts/stop-hook.mjs

@@ -17,13 +17,43 @@
  */
 
 import Database from 'better-sqlite3';
-import { existsSync, mkdirSync, openSync, readSync, closeSync, statSync } from 'fs';
+import { existsSync, mkdirSync, openSync, readSync, closeSync, statSync, writeFileSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
 import { saveAutoExtractedMemory } from './lib/save-memory.mjs';
 import { readTranscriptText } from './lib/transcript-reader.mjs';
 import { getAutoMemoryConfig } from './lib/auto-memory-config.mjs';
 import { recordHookInvocation } from './lib/telemetry.mjs';
+import { deriveProjectKey } from './lib/project-key.mjs';
+
+// Sentinel directory for once-per-session "disabled" log lines. Without this
+// the stop hook bails silently on every turn when autoMemory.enableStop is
+// false — the user-visible symptom is "ShieldCortex never captured anything"
+// with zero feedback (filed in #41 as silent-amnesia). One sentinel file
+// per session keeps the log to a single line for the lifetime of the session.
+const SC_LOG_DIR = join(homedir(), '.shieldcortex', 'logs');
+const STOP_DISABLED_SENTINEL_DIR = join(SC_LOG_DIR, 'stop-hook-disabled-sessions');
+
+function logDisabledOnceForSession(sessionId, reason) {
+  // Always print the line — stderr is the existing channel for hook diagnostics
+  // (mirrors session-end-hook). Then plant a sentinel so subsequent fires in
+  // the same session stay quiet.
+  if (!sessionId) {
+    console.error(`[shieldcortex stop-hook] ${reason}`);
+    return;
+  }
+  try {
+    mkdirSync(STOP_DISABLED_SENTINEL_DIR, { recursive: true });
+    const sentinel = join(STOP_DISABLED_SENTINEL_DIR, sessionId.replace(/[^a-zA-Z0-9_.-]/g, '_'));
+    if (existsSync(sentinel)) return;
+    writeFileSync(sentinel, new Date().toISOString(), { mode: 0o600 });
+    console.error(`[shieldcortex stop-hook] ${reason}`);
+  } catch {
+    // Sentinel write failed — fall back to printing once per fire rather than
+    // staying silent. Better noisy-but-discoverable than silent-amnesia.
+    console.error(`[shieldcortex stop-hook] ${reason}`);
+  }
+}
 
 // ==================== DB ====================
 
@@ -60,28 +90,6 @@ const CATEGORY_EXTRACTION_THRESHOLDS = {
   custom: 0.45,
 };
 
-// ==================== PROJECT DETECTION ====================
-
-const SKIP_DIRECTORIES = [
-  'src', 'lib', 'dist', 'build', 'out',
-  'node_modules', '.git', '.next', '.cache',
-  'test', 'tests', '__tests__', 'spec',
-  'bin', 'scripts', 'config', 'public', 'static',
-];
-
-function extractProjectFromPath(p) {
-  if (!p) return null;
-  const segments = p.split(/[/\\]/).filter(Boolean);
-  for (let i = segments.length - 1; i >= 0; i--) {
-    const segment = segments[i];
-    if (!SKIP_DIRECTORIES.includes(segment.toLowerCase())) {
-      if (segment.startsWith('.')) continue;
-      return segment;
-    }
-  }
-  return null;
-}
-
 // ==================== SALIENCE (mirrors pre-compact) ====================
 
 const ARCHITECTURE_KEYWORDS = ['architecture','design','pattern','structure','system','database','api','schema','model','framework','stack','microservice','monolith','serverless','infrastructure'];
@@ -244,18 +252,17 @@ function getDynamicThreshold(count, max) {
   return 0.25;
 }
 
-// ==================== TURN COUNT (cheap, partial-read) ====================
+// ==================== TRANSCRIPT PEEK (cheap, partial-read) ====================
 
 /**
- * Count assistant turns in the last `windowBytes` of the transcript.
- * Doesn't parse — just counts occurrences of the assistant role marker.
- * That's a very rough approximation but it's enough for sample-every-N
- * decisions and an order of magnitude cheaper than full JSON parse.
+ * Read the last `windowBytes` of the transcript as raw text and count
+ * assistant-role markers. Used for both the modulo sampling gate and the
+ * salience-bypass probe — one disk read serves both decisions.
  */
-function countAssistantTurns(transcriptPath, windowBytes) {
-  if (!transcriptPath) return 0;
+function peekRecentTranscript(transcriptPath, windowBytes) {
+  if (!transcriptPath) return { turnCount: 0, raw: '' };
   const resolved = transcriptPath.replace(/^~/, homedir());
-  if (!existsSync(resolved)) return 0;
+  if (!existsSync(resolved)) return { turnCount: 0, raw: '' };
   try {
     const stat = statSync(resolved);
     const bytes = Math.min(stat.size, windowBytes);
@@ -268,14 +275,33 @@ function countAssistantTurns(transcriptPath, windowBytes) {
     } finally {
       closeSync(fd);
     }
-    // Each assistant message line carries `"role":"assistant"` (or `"type":"assistant"`).
-    // Count occurrences of either marker — close enough for sampling decisions.
-    return (raw.match(/"role":"assistant"|"type":"assistant"/g) || []).length;
+    const turnCount = (raw.match(/"role":"assistant"|"type":"assistant"/g) || []).length;
+    return { turnCount, raw };
   } catch {
-    return 0;
+    return { turnCount: 0, raw: '' };
   }
 }
 
+/**
+ * Cheap salience probe over the recent transcript window. A turn is "salient"
+ * (and worth bypassing the modulo gate for) when:
+ *   - it carries a fenced code block — strong signal of code work / errors / diffs
+ *   - or ≥2 keyword categories hit (architecture, error, decision, learning,
+ *     pattern, code-reference)
+ */
+function isSalientWindow(rawText) {
+  if (!rawText) return false;
+  if (/```/.test(rawText)) return true;
+  let hits = 0;
+  if (detectKeywords(rawText, ARCHITECTURE_KEYWORDS)) hits++;
+  if (detectKeywords(rawText, ERROR_KEYWORDS)) hits++;
+  if (detectKeywords(rawText, DECISION_KEYWORDS)) hits++;
+  if (detectKeywords(rawText, LEARNING_KEYWORDS)) hits++;
+  if (detectKeywords(rawText, PATTERN_KEYWORDS)) hits++;
+  if (detectCodeReferences(rawText)) hits++;
+  return hits >= 2;
+}
+
 // ==================== MAIN ====================
 
 let input = '';
@@ -303,18 +329,35 @@ process.stdin.on('end', () => {
 
     const autoMemConfig = getAutoMemoryConfig();
     if (!autoMemConfig.enableStop) {
-      // Opt-in by config (or by `--with-stop-hook` install flag, which only
-      // wires the hook in settings.json — config still gates execution).
+      // Opt-in by config. As of v4.13.1 the install flag (`--with-stop-hook`)
+      // flips this gate at install time so wiring the hook and enabling it are
+      // a single user action. If the gate is still false here, the user wired
+      // the hook by hand without setting autoMemory.enableStop=true. Log once
+      // per session so the failure is visible (was silent-amnesia in #41).
+      logDisabledOnceForSession(
+        hookData.session_id,
+        `disabled — set autoMemory.enableStop=true in ~/.shieldcortex/config.json (or re-run \`shieldcortex setup --with-stop-hook\`)`,
+      );
       process.exit(0);
     }
 
     const samplingTurns = autoMemConfig.stopHookSamplingTurns;
     const windowBytes = autoMemConfig.stopHookWindowBytes;
-
-    const turnCount = countAssistantTurns(hookData.transcript_path, windowBytes);
-    if (turnCount === 0 || turnCount % samplingTurns !== 0) {
-      // Off-sample. Exit silently — but record the firing so telemetry shows
-      // the hook is actually wired and active.
+    const salienceBypassEnabled = autoMemConfig.stopHookSalienceBypass;
+
+    // Use a smaller window for the cheap peek so off-sample turns stay fast.
+    // The full extraction below still uses the configured windowBytes.
+    const peekBytes = Math.min(32 * 1024, windowBytes);
+    const peek = peekRecentTranscript(hookData.transcript_path, peekBytes);
+    const turnCount = peek.turnCount;
+    const onSample = turnCount > 0 && turnCount % samplingTurns === 0;
+    const salientBypass = salienceBypassEnabled && !onSample && isSalientWindow(peek.raw);
+
+    if (!onSample && !salientBypass) {
+      // Off-sample, no salience bypass. Surface the sampling decision to stderr
+      // so the "1-in-N turns" behaviour stops being invisible (#41), and still
+      // record telemetry so the dashboard shows the hook is wired and active.
+      console.error(`[shieldcortex stop-hook] telemetry-only turn=${turnCount}/${samplingTurns}`);
       if (existsSync(DB_PATH)) {
         try {
           const tdb = new Database(DB_PATH, { timeout: 1500 });
@@ -332,7 +375,7 @@ process.stdin.on('end', () => {
       process.exit(0);
     }
 
-    const project = extractProjectFromPath(hookData.cwd);
+    const project = deriveProjectKey(hookData.cwd);
     const transcriptOut = readTranscriptText(hookData.transcript_path, {
       maxBytes: windowBytes,
       maxLines: autoMemConfig.maxTranscriptLines,
@@ -370,7 +413,8 @@ process.stdin.on('end', () => {
             console.error(`[stop] Failed to save "${memory.title}": ${err.message}`);
           }
         }
-        console.error(`[stop] Sampled turn=${turnCount}: ${extractedCount} memories extracted`);
+        const sampleReason = salientBypass ? `bypass=salience turn=${turnCount}` : `turn=${turnCount}`;
+        console.error(`[stop] Sampled ${sampleReason}: ${extractedCount} memories extracted`);
       }
     }
   } catch (err) {