shieldcortex 4.14.4 → 4.14.6

package/dist/cli/update.js

@@ -0,0 +1,282 @@
+/**
+ * `shieldcortex update` — animated, captured-output release flow.
+ *
+ * Replaces the v4.14.x wall-of-text update output with:
+ *   - a header banner showing the version delta
+ *   - one stage per concern (npm package, plugin, hooks, skill)
+ *   - per-stage spinner + ✓/⚠/✗ + duration + condensed summary
+ *   - npm and openclaw stdout/stderr captured; printed only on error
+ *   - graceful fallback to plain text when not on a TTY (CI, piped output)
+ *
+ * Behaviour-preserving — every step does what the old inline flow did.
+ */
+import { spawnSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+import { homedir } from 'os';
+import { fileURLToPath } from 'url';
+// ── ANSI ────────────────────────────────────────────────────
+const ANSI = {
+    reset: '\x1b[0m',
+    bold: '\x1b[1m',
+    dim: '\x1b[2m',
+    red: '\x1b[31m',
+    green: '\x1b[32m',
+    yellow: '\x1b[33m',
+    cyan: '\x1b[36m',
+    magenta: '\x1b[35m',
+    gray: '\x1b[90m',
+};
+const isTTY = Boolean(process.stdout.isTTY);
+function paint(color, s) {
+    return isTTY ? `${ANSI[color]}${s}${ANSI.reset}` : s;
+}
+// ── Progress runner ─────────────────────────────────────────
+const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+const LABEL_WIDTH = 24;
+async function step(label, fn) {
+    const start = Date.now();
+    const padded = label.padEnd(LABEL_WIDTH);
+    let frame = 0;
+    let timer = null;
+    if (isTTY) {
+        process.stdout.write(`  ${paint('cyan', SPINNER_FRAMES[0])}  ${padded}`);
+        timer = setInterval(() => {
+            frame = (frame + 1) % SPINNER_FRAMES.length;
+            process.stdout.write(`\r  ${paint('cyan', SPINNER_FRAMES[frame])}  ${padded}`);
+        }, 80);
+        timer.unref();
+    }
+    else {
+        process.stdout.write(`  ◦  ${label}…\n`);
+    }
+    try {
+        const raw = await fn();
+        if (timer)
+            clearInterval(timer);
+        const result = typeof raw === 'string' ? { status: 'ok', summary: raw } :
+            raw && typeof raw === 'object' ? raw :
+                { status: 'ok' };
+        const elapsed = ((Date.now() - start) / 1000).toFixed(1) + 's';
+        const icon = result.status === 'ok' ? paint('green', '✓') :
+            result.status === 'warn' ? paint('yellow', '⚠') :
+                paint('gray', '·');
+        const summary = result.summary
+            ? paint('gray', result.summary).padEnd(LABEL_WIDTH + 9)
+            : ''.padEnd(LABEL_WIDTH);
+        if (isTTY) {
+            process.stdout.write(`\r  ${icon}  ${padded}  ${summary}  ${paint('gray', elapsed)}\n`);
+        }
+        else {
+            process.stdout.write(`  ${result.status === 'ok' ? '✓' : result.status === 'warn' ? '⚠' : '·'}  ${label}: ${result.summary ?? 'done'} (${elapsed})\n`);
+        }
+        return result;
+    }
+    catch (err) {
+        if (timer)
+            clearInterval(timer);
+        const elapsed = ((Date.now() - start) / 1000).toFixed(1) + 's';
+        const icon = paint('red', '✗');
+        if (isTTY) {
+            process.stdout.write(`\r  ${icon}  ${padded}  ${paint('red', 'failed')}                          ${paint('gray', elapsed)}\n`);
+        }
+        else {
+            process.stdout.write(`  ✗  ${label}: failed (${elapsed})\n`);
+        }
+        const e = err;
+        const captured = (e.stderr || '') + (e.stdout || '');
+        if (captured.trim()) {
+            process.stderr.write('\n' + paint('gray', '── output ─────────────────────────────────────────') + '\n');
+            process.stderr.write(captured.trim() + '\n');
+            process.stderr.write(paint('gray', '───────────────────────────────────────────────────') + '\n');
+        }
+        throw err;
+    }
+}
+function runQuiet(cmd, args, opts = {}) {
+    const result = spawnSync(cmd, args, {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        encoding: 'utf-8',
+        timeout: opts.timeout,
+        env: opts.env ?? process.env,
+        shell: false,
+    });
+    if (result.error)
+        throw result.error;
+    if (typeof result.status === 'number' && result.status !== 0) {
+        const err = new Error(`exit ${result.status}: ${cmd} ${args.join(' ')}`);
+        err.stdout = result.stdout;
+        err.stderr = result.stderr;
+        throw err;
+    }
+    return { stdout: result.stdout || '', stderr: result.stderr || '' };
+}
+// ── Header / footer ─────────────────────────────────────────
+function header(currentVersion, latestVersion) {
+    process.stdout.write('\n');
+    process.stdout.write(`  ${paint('magenta', '◆')} ${paint('bold', 'ShieldCortex')}\n`);
+    if (latestVersion && latestVersion !== currentVersion) {
+        process.stdout.write(`    ${paint('gray', `v${currentVersion}`)}  ${paint('cyan', '→')}  ${paint('green', `v${latestVersion}`)}\n\n`);
+    }
+    else if (latestVersion) {
+        process.stdout.write(`    ${paint('green', `v${currentVersion}`)} ${paint('gray', '· already on latest')}\n\n`);
+    }
+    else {
+        process.stdout.write(`    ${paint('green', `v${currentVersion}`)}\n\n`);
+    }
+}
+function footer(totalMs, mainUpdated) {
+    const elapsed = (totalMs / 1000).toFixed(1) + 's';
+    process.stdout.write(`\n  ${paint('gray', '──────────────────────────────────────────────────────────────')}\n`);
+    if (mainUpdated) {
+        process.stdout.write(`  ${paint('green', '✓')}  ${paint('bold', 'done')}  ${paint('gray', `in ${elapsed}`)}  ${paint('cyan', '·')}  ${paint('yellow', 'restart Claude Code / OpenClaw gateway')}\n\n`);
+    }
+    else {
+        process.stdout.write(`  ${paint('green', '✓')}  ${paint('bold', 'done')}  ${paint('gray', `in ${elapsed} · already on latest`)}\n\n`);
+    }
+}
+// ── Steps ───────────────────────────────────────────────────
+function readPackageVersion() {
+    const __filename = fileURLToPath(import.meta.url);
+    const pkgPath = path.resolve(path.dirname(__filename), '..', '..', 'package.json');
+    return JSON.parse(fs.readFileSync(pkgPath, 'utf-8')).version ?? 'unknown';
+}
+async function fetchLatestVersion() {
+    try {
+        const { stdout } = runQuiet('npm', ['view', 'shieldcortex', 'version'], { timeout: 10000 });
+        return stdout.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+async function stepNpmPackage(currentVersion, latestVersion) {
+    if (!latestVersion) {
+        const result = await step('npm package', async () => ({ status: 'warn', summary: 'registry unreachable' }));
+        return { updated: false, result };
+    }
+    if (latestVersion === currentVersion) {
+        const result = await step('npm package', async () => `v${currentVersion} (current)`);
+        return { updated: false, result };
+    }
+    const result = await step('npm package', async () => {
+        runQuiet('npm', ['install', '-g', 'shieldcortex@latest', '--silent', '--no-audit', '--no-fund'], { timeout: 180000 });
+        return `v${currentVersion} → v${latestVersion}`;
+    });
+    return { updated: true, result };
+}
+async function stepOpenClawPlugin(home) {
+    const extDir = path.join(home, '.openclaw', 'extensions', 'shieldcortex-realtime');
+    const npmDir = path.join(home, '.openclaw', 'npm', 'node_modules', '@drakon-systems', 'shieldcortex-realtime');
+    if (!fs.existsSync(extDir) && !fs.existsSync(npmDir)) {
+        return await step('OpenClaw plugin', async () => ({ status: 'skip', summary: 'not installed' }));
+    }
+    return await step('OpenClaw plugin', async () => {
+        try {
+            fs.rmSync(extDir, { recursive: true, force: true });
+        }
+        catch { /* ignore */ }
+        try {
+            runQuiet('openclaw', ['plugins', 'install', '--force', '@drakon-systems/shieldcortex-realtime@latest'], { timeout: 60000, env: { ...process.env, HOME: home } });
+            return '@latest installed';
+        }
+        catch {
+            // Don't propagate — surface as warn instead of failing the whole flow.
+            return { status: 'warn', summary: 'reinstall failed (run manually)' };
+        }
+    });
+}
+async function stepOpenClawSkill(home) {
+    const skillDirs = [
+        path.join(home, '.openclaw', 'workspace', 'skills', 'shieldcortex'),
+        path.join(home, '.openclaw', 'skills', 'shieldcortex'),
+        path.join(home, 'clawd', 'skills', 'shieldcortex'),
+        path.join(home, 'friday', 'skills', 'shieldcortex'),
+    ];
+    if (!skillDirs.find((d) => fs.existsSync(d))) {
+        return await step('OpenClaw skill', async () => ({ status: 'skip', summary: 'not installed' }));
+    }
+    return await step('OpenClaw skill', async () => {
+        try {
+            runQuiet('openclaw', ['skills', 'install', 'shieldcortex', '--force'], {
+                timeout: 60000,
+                env: { ...process.env, HOME: home },
+            });
+            return '@latest installed';
+        }
+        catch {
+            return { status: 'warn', summary: 'reinstall failed (run manually)' };
+        }
+    });
+}
+async function stepClaudeHooks() {
+    return await step('Claude Code hooks', async () => {
+        // setupHooks logs its own progress; capture it so we can summarise.
+        const logBuffer = [];
+        const origLog = console.log;
+        const origWarn = console.warn;
+        console.log = (...args) => { logBuffer.push(args.map(String).join(' ')); };
+        console.warn = (...args) => { logBuffer.push(args.map(String).join(' ')); };
+        try {
+            const { setupHooks } = await import('../setup/settings-hooks.js');
+            setupHooks();
+        }
+        finally {
+            console.log = origLog;
+            console.warn = origWarn;
+        }
+        const added = logBuffer.filter((l) => l.includes('+ Hook:')).length;
+        const migrated = logBuffer.filter((l) => l.includes('migrated from npx')).length;
+        const timeoutsUpdated = logBuffer.filter((l) => l.includes('timeout')).length;
+        if (added === 0 && migrated === 0 && timeoutsUpdated === 0) {
+            return 'all canonical';
+        }
+        const parts = [];
+        if (added > 0)
+            parts.push(`${added} added`);
+        if (migrated > 0)
+            parts.push(`${migrated} migrated`);
+        if (timeoutsUpdated > 0)
+            parts.push(`${timeoutsUpdated} timeout fix`);
+        return parts.join(', ');
+    });
+}
+// ── 4.11.0 boundary notice (preserved from old flow) ────────
+function maybePrint411Notice(currentVersion, mainUpdated) {
+    if (!mainUpdated || !/^\d+\.\d+\.\d+/.test(currentVersion))
+        return;
+    const [maj, min] = currentVersion.split('.').map(Number);
+    if (!(maj < 4 || (maj === 4 && min < 11)))
+        return;
+    process.stdout.write('\n');
+    process.stdout.write(`  ${paint('yellow', '!')}  ${paint('bold', 'v4.11.0 default behaviour changes')}\n`);
+    process.stdout.write('     • Proactive recall on prompt submit is now OFF by default.\n');
+    process.stdout.write('     • Tool-call interceptor no longer blocks critical/high writes with approval prompts.\n');
+    process.stdout.write('     • SessionStart preamble OFF; memory cap reduced 15 → 5.\n');
+    process.stdout.write('     • PreCompact thresholds raised; auto-memories cap 5 → 2.\n');
+    process.stdout.write(`     ${paint('gray', 'restore pre-4.11 with: ')}${paint('cyan', 'shieldcortex config --restore-4.10-defaults')}\n`);
+    process.stdout.write(`     ${paint('gray', 'changelog: ')}${paint('cyan', 'https://github.com/Drakon-Systems-Ltd/ShieldCortex/blob/main/CHANGELOG.md')}\n\n`);
+}
+// ── Public entry ────────────────────────────────────────────
+export async function runUpdate() {
+    const home = homedir();
+    const currentVersion = readPackageVersion();
+    const flowStart = Date.now();
+    // Header — show current version immediately, then update with latest once we know it.
+    // (We resolve `latest` before drawing the arrow so the banner is correct.)
+    const latestVersion = await fetchLatestVersion();
+    header(currentVersion, latestVersion);
+    let mainUpdated = false;
+    try {
+        const npmStep = await stepNpmPackage(currentVersion, latestVersion);
+        mainUpdated = npmStep.updated;
+    }
+    catch {
+        // npm failure already surfaced by step(); continue with reconcile.
+    }
+    await stepOpenClawPlugin(home);
+    await stepOpenClawSkill(home);
+    await stepClaudeHooks();
+    footer(Date.now() - flowStart, mainUpdated);
+    maybePrint411Notice(currentVersion, mainUpdated);
+}

package/dist/index.d.ts

@@ -23,6 +23,9 @@
  *   shieldcortex quickstart --yes        # Install across all detected integrations
  *   shieldcortex setup                   # Configure Claude for proactive memory use
  *   shieldcortex install                 # Alias for setup
+ *   shieldcortex install --with-stop-hook        # Opt in to the Stop hook (sampled per-turn extraction)
+ *   shieldcortex install --with-session-end      # Opt in to the SessionEnd hook (final extraction on session exit)
+ *   shieldcortex install --with-stop-hook --with-session-end   # Both at once
  *   shieldcortex hook pre-compact        # Run pre-compact hook (for settings.json)
  *   shieldcortex hook session-start      # Run session-start hook (for settings.json)
  *   shieldcortex hook session-end        # Run session-end hook (for settings.json)

package/dist/index.js

@@ -23,6 +23,9 @@
  *   shieldcortex quickstart --yes        # Install across all detected integrations
  *   shieldcortex setup                   # Configure Claude for proactive memory use
  *   shieldcortex install                 # Alias for setup
+ *   shieldcortex install --with-stop-hook        # Opt in to the Stop hook (sampled per-turn extraction)
+ *   shieldcortex install --with-session-end      # Opt in to the SessionEnd hook (final extraction on session exit)
+ *   shieldcortex install --with-stop-hook --with-session-end   # Both at once
  *   shieldcortex hook pre-compact        # Run pre-compact hook (for settings.json)
  *   shieldcortex hook session-start      # Run session-start hook (for settings.json)
  *   shieldcortex hook session-end        # Run session-end hook (for settings.json)
@@ -475,6 +478,9 @@ ${bold}COMMANDS${reset}
   ${cyan}iron-dome${reset} <action>    Manage behaviour protection layer
   ${cyan}audit${reset} [options]       Run a full security audit
   ${cyan}setup${reset}                 Install ShieldCortex into your project
+                        Flags: --with-stop-hook (sampled per-turn extraction)
+                               --with-session-end (extraction on session exit)
+                               Pass either to opt in; re-run without to opt out.
   ${cyan}uninstall${reset}             Remove ShieldCortex from your project
   ${cyan}openclaw${reset} <action>     Manage OpenClaw hook integration
   ${cyan}copilot${reset} <action>      Set up VS Code / Cursor MCP integration
@@ -493,6 +499,7 @@ ${bold}EXAMPLES${reset}
   shieldcortex scan-skill ~/.claude/skills/my-skill/SKILL.md
   shieldcortex dashboard
   shieldcortex worker
+  shieldcortex install --with-stop-hook --with-session-end
   shieldcortex cortex preflight --task "deploy site"
   shieldcortex license activate sc_pro_...
   shieldcortex config --cloud-enable --cloud-api-key <key>
@@ -612,149 +619,13 @@ ${bold}DOCS${reset}
         await handleStatusCommand();
         return;
     }
-    // Handle "update" subcommand
+    // Handle "update" subcommand — delegated to ./cli/update.ts which renders
+    // a progress-style flow (animated spinners on TTY, captured npm/openclaw
+    // output, per-step timings, version-delta header). Same underlying steps
+    // as the previous inline implementation.
     if (process.argv[2] === 'update') {
-        const { execSync } = await import('child_process');
-        const fs = await import('fs');
-        const { homedir } = await import('os');
-        const home = homedir();
-        const pkgPath = new URL('../package.json', import.meta.url);
-        const currentVersion = JSON.parse(fs.readFileSync(pkgPath, 'utf-8')).version ?? 'unknown';
-        console.log(`Current version: v${currentVersion}`);
-        console.log('Checking for updates...');
-        // Step 1 — update the npm package if a newer version exists.
-        let mainUpdated = false;
-        try {
-            const latest = execSync('npm view shieldcortex version', { encoding: 'utf-8', timeout: 10000 }).trim();
-            if (latest === currentVersion) {
-                console.log(`✓ Main package already on v${latest}`);
-            }
-            else {
-                console.log(`New version available: v${latest}`);
-                console.log('Updating npm package...');
-                execSync('npm install -g shieldcortex@latest', { stdio: 'inherit', timeout: 120000 });
-                console.log(`✓ Updated to v${latest}`);
-                mainUpdated = true;
-            }
-        }
-        catch (error) {
-            console.error(`npm update failed: ${error.message}`);
-            console.error('Try manually: npm install -g shieldcortex@latest');
-            // Continue — plugin + skill may still have their own updates available.
-        }
-        // Step 2 — always reconcile the OpenClaw plugin. Plugin and skill have their
-        // own release cadences; skipping them when main is current caused v4.9 → v4.10
-        // users to be stuck on v4.9 of the plugin until they manually removed the
-        // extension dir and re-ran `openclaw plugins install`.
-        //
-        // OpenClaw 2026.5.5 added a guard that refuses `plugins install` when the
-        // plugin is already present at ~/.openclaw/npm/node_modules/<scope>/<name>
-        // and tells the caller to use `update` or `--force`. Our reconcile always
-        // *wants* to overwrite — that's the entire point of the step — so we pass
-        // --force unconditionally. Works for fresh installs too (no-op when no
-        // existing plugin to replace).
-        try {
-            const extDir = path.join(home, '.openclaw', 'extensions', 'shieldcortex-realtime');
-            const npmDir = path.join(home, '.openclaw', 'npm', 'node_modules', '@drakon-systems', 'shieldcortex-realtime');
-            if (fs.existsSync(extDir) || fs.existsSync(npmDir)) {
-                console.log('Reconciling OpenClaw plugin...');
-                // Best-effort cleanup of the legacy extensions/ path so 2026.5.x doesn't
-                // see two install records. The npm/node_modules/ path is owned by the
-                // OpenClaw installer and `--force` will replace it.
-                try {
-                    fs.rmSync(extDir, { recursive: true, force: true });
-                }
-                catch { /* ignore */ }
-                try {
-                    execSync('openclaw plugins install --force @drakon-systems/shieldcortex-realtime@latest', {
-                        stdio: 'inherit',
-                        timeout: 60000,
-                        env: { ...process.env, HOME: home },
-                    });
-                    console.log('✓ OpenClaw plugin reconciled');
-                }
-                catch {
-                    console.warn('⚠ OpenClaw plugin reinstall failed — run manually:');
-                    console.warn('  openclaw plugins install --force @drakon-systems/shieldcortex-realtime');
-                }
-            }
-        }
-        catch {
-            // OpenClaw not installed — skip silently
-        }
-        // Step 3 — always reconcile the OpenClaw / ClawHub skill.
-        try {
-            const skillDirs = [
-                path.join(home, '.openclaw', 'workspace', 'skills', 'shieldcortex'),
-                path.join(home, '.openclaw', 'skills', 'shieldcortex'),
-                path.join(home, 'clawd', 'skills', 'shieldcortex'),
-                path.join(home, 'friday', 'skills', 'shieldcortex'),
-            ];
-            const existingSkill = skillDirs.find(d => fs.existsSync(d));
-            if (existingSkill) {
-                console.log('Reconciling OpenClaw skill...');
-                try {
-                    execSync('openclaw skills install shieldcortex --force', {
-                        stdio: 'inherit',
-                        timeout: 60000,
-                        env: { ...process.env, HOME: home },
-                    });
-                    console.log('✓ OpenClaw skill reconciled');
-                }
-                catch {
-                    console.warn('⚠ OpenClaw skill update failed — run manually:');
-                    console.warn('  openclaw skills install shieldcortex --force');
-                }
-            }
-        }
-        catch {
-            // Skill update is best-effort
-        }
-        // Step 4 — migrate Claude Code hooks if needed.
-        try {
-            const { setupHooks } = await import('./setup/settings-hooks.js');
-            setupHooks();
-        }
-        catch {
-            // Hook migration is best-effort
-        }
-        if (mainUpdated) {
-            console.log('Restart Claude Code / OpenClaw gateway to use the new version.');
-        }
-        // One-time notice for users crossing the v4.11.0 default-changes boundary.
-        // `currentVersion` was captured pre-update, so any main-updated run that
-        // came from <4.11.0 has the migration message shown once.
-        try {
-            const crossed4_11 = mainUpdated && /^\d+\.\d+\.\d+/.test(currentVersion) && (() => {
-                const [maj, min] = currentVersion.split('.').map(Number);
-                return maj < 4 || (maj === 4 && min < 11);
-            })();
-            if (crossed4_11) {
-                console.log('');
-                console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-                console.log(' ShieldCortex v4.11.0 — default behaviour changes');
-                console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-                console.log('');
-                console.log(' • Proactive recall on prompt submit is now OFF by default.');
-                console.log(' • Tool-call interceptor no longer blocks critical/high');
-                console.log('   severity writes with an approval prompt (defence still');
-                console.log('   denies on failurePolicy).');
-                console.log(' • SessionStart preamble instruction block is now OFF.');
-                console.log(' • SessionStart memory cap reduced 15 → 5.');
-                console.log(' • PreCompact thresholds raised; auto-memories cap 5 → 2.');
-                console.log('');
-                console.log(' Why: fleet evidence showed per-turn memory-injection tax');
-                console.log(' was net-negative on fast agent loops. The defence pipeline');
-                console.log(' stays on; only the memory-injection side is now opt-in.');
-                console.log('');
-                console.log(' To restore pre-v4.11.0 behaviour:');
-                console.log('   shieldcortex config --restore-4.10-defaults');
-                console.log('');
-                console.log(' See CHANGELOG: https://github.com/Drakon-Systems-Ltd/ShieldCortex/blob/main/CHANGELOG.md');
-                console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-            }
-        }
-        catch { /* notice is best-effort */ }
+        const { runUpdate } = await import('./cli/update.js');
+        await runUpdate();
         return;
     }
     // Handle "graph" subcommand

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shieldcortex",
-  "version": "4.14.4",
+  "version": "4.14.6",
   "description": "Trustworthy memory and security for AI agents. Recall debugging, review queue, OpenClaw session capture, and memory poisoning defence for Claude Code, Codex, OpenClaw, LangChain, and MCP agents.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/plugins/openclaw/dist/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "4.14.4",
+  "version": "4.14.6",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,