shieldcortex 4.14.1 → 4.14.3

package/dist/index.js

@@ -646,13 +646,27 @@ ${bold}DOCS${reset}
         // own release cadences; skipping them when main is current caused v4.9 → v4.10
         // users to be stuck on v4.9 of the plugin until they manually removed the
         // extension dir and re-ran `openclaw plugins install`.
+        //
+        // OpenClaw 2026.5.5 added a guard that refuses `plugins install` when the
+        // plugin is already present at ~/.openclaw/npm/node_modules/<scope>/<name>
+        // and tells the caller to use `update` or `--force`. Our reconcile always
+        // *wants* to overwrite — that's the entire point of the step — so we pass
+        // --force unconditionally. Works for fresh installs too (no-op when no
+        // existing plugin to replace).
         try {
             const extDir = path.join(home, '.openclaw', 'extensions', 'shieldcortex-realtime');
-            if (fs.existsSync(extDir)) {
+            const npmDir = path.join(home, '.openclaw', 'npm', 'node_modules', '@drakon-systems', 'shieldcortex-realtime');
+            if (fs.existsSync(extDir) || fs.existsSync(npmDir)) {
                 console.log('Reconciling OpenClaw plugin...');
-                fs.rmSync(extDir, { recursive: true, force: true });
+                // Best-effort cleanup of the legacy extensions/ path so 2026.5.x doesn't
+                // see two install records. The npm/node_modules/ path is owned by the
+                // OpenClaw installer and `--force` will replace it.
                 try {
-                    execSync('openclaw plugins install @drakon-systems/shieldcortex-realtime@latest', {
+                    fs.rmSync(extDir, { recursive: true, force: true });
+                }
+                catch { /* ignore */ }
+                try {
+                    execSync('openclaw plugins install --force @drakon-systems/shieldcortex-realtime@latest', {
                         stdio: 'inherit',
                         timeout: 60000,
                         env: { ...process.env, HOME: home },
@@ -661,7 +675,7 @@ ${bold}DOCS${reset}
                 }
                 catch {
                     console.warn('⚠ OpenClaw plugin reinstall failed — run manually:');
-                    console.warn('  openclaw plugins install @drakon-systems/shieldcortex-realtime');
+                    console.warn('  openclaw plugins install --force @drakon-systems/shieldcortex-realtime');
                 }
             }
         }

package/dist/setup/settings-hooks.js

@@ -93,6 +93,42 @@ function migrateNpxHooks(settings) {
     }
     return migrated;
 }
+/**
+ * Reconcile timeouts on existing ShieldCortex hook entries. Doctor warns
+ * users when an existing settings.json has a timeout below canonical (e.g.
+ * pre-#43 hand-edited 2 s UserPromptSubmit) and tells them to re-run
+ * `shieldcortex install` to fix it. Without this reconciliation the install
+ * step was a lie — it only added missing hooks. Now it also bumps timeouts
+ * on existing shieldcortex entries to match the canonical values declared
+ * alongside CORTEX_HOOKS.
+ */
+function reconcileHookTimeouts(settings) {
+    let updated = 0;
+    if (!settings.hooks)
+        return 0;
+    for (const [eventName, expectedTimeout] of Object.entries(CANONICAL_HOOK_TIMEOUTS)) {
+        if (!expectedTimeout)
+            continue;
+        const entries = settings.hooks[eventName];
+        if (!Array.isArray(entries))
+            continue;
+        for (const entry of entries) {
+            if (!entry.hooks || !Array.isArray(entry.hooks))
+                continue;
+            for (const hook of entry.hooks) {
+                if (typeof hook.command !== 'string' || !hook.command.includes('shieldcortex'))
+                    continue;
+                if (typeof hook.timeout === 'number' && hook.timeout < expectedTimeout) {
+                    const previous = hook.timeout;
+                    hook.timeout = expectedTimeout;
+                    updated++;
+                    console.log(`  ↑ Hook: ${eventName} (timeout ${previous}s → ${expectedTimeout}s)`);
+                }
+            }
+        }
+    }
+    return updated;
+}
 export function setupHooks(options) {
     const settings = readSettings();
     if (!settings.hooks) {
@@ -100,6 +136,9 @@ export function setupHooks(options) {
     }
     // First: migrate any stale npx commands to direct binary
     const migrated = migrateNpxHooks(settings);
+    // Second: reconcile timeouts on existing shieldcortex entries so doctor's
+    // "re-run install to restore canonical timeouts" suggestion actually works.
+    const timeoutsUpdated = reconcileHookTimeouts(settings);
     // SessionEnd handling is now bidirectional:
     //   - if --with-session-end was passed, install it (the .mjs gates execution
     //     by config + OpenClaw env so it's safe to wire here);
@@ -157,10 +196,13 @@ export function setupHooks(options) {
             console.log(`  = Hook: Stop (already configured)`);
         }
     }
-    const changed = added + migrated;
+    const changed = added + migrated + timeoutsUpdated;
     if (changed > 0) {
         writeSettings(settings);
-        console.log(`Hooks: ${added} added, ${migrated} migrated in ~/.claude/settings.json`);
+        const parts = [`${added} added`, `${migrated} migrated`];
+        if (timeoutsUpdated > 0)
+            parts.push(`${timeoutsUpdated} timeout${timeoutsUpdated === 1 ? '' : 's'} updated`);
+        console.log(`Hooks: ${parts.join(', ')} in ~/.claude/settings.json`);
     }
     else {
         console.log('Hooks: all hooks already configured in ~/.claude/settings.json');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shieldcortex",
-  "version": "4.14.1",
+  "version": "4.14.3",
   "description": "Trustworthy memory and security for AI agents. Recall debugging, review queue, OpenClaw session capture, and memory poisoning defence for Claude Code, Codex, OpenClaw, LangChain, and MCP agents.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/plugins/openclaw/dist/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "4.14.1",
+  "version": "4.14.3",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,