shieldcortex 4.32.7 → 4.33.0

package/dist/setup/settings-hooks.js

@@ -3,7 +3,7 @@
  */
 import path from 'path';
 import os from 'os';
-import { setAutoMemoryEnableConfig } from '../cloud/config.js';
+import { getAutoMemoryEnableConfig, setAutoMemoryEnableConfig } from '../cloud/config.js';
 import { readJsonConfigOrAbort, writeJsonConfigWithBackup } from './json-config.js';
 const SETTINGS_PATH = path.join(os.homedir(), '.claude', 'settings.json');
 const CORTEX_HOOKS = {
@@ -124,6 +124,27 @@ function reconcileHookTimeouts(settings) {
     }
     return updated;
 }
+/**
+ * CLI flag → opt-in option mapping. An absent flag MUST map to undefined
+ * ("leave as-is"), never false: `process.argv.includes()` returning false for
+ * an absent flag is exactly how `setup --with-session-end` used to silently
+ * flip enableStop off (and vice versa). Disabling is its own explicit flag.
+ */
+export function parseHookOptInFlags(argv) {
+    const opts = {};
+    if (argv.includes('--with-stop-hook'))
+        opts.stopHook = true;
+    else if (argv.includes('--without-stop-hook'))
+        opts.stopHook = false;
+    if (argv.includes('--with-session-end'))
+        opts.sessionEnd = true;
+    else if (argv.includes('--without-session-end'))
+        opts.sessionEnd = false;
+    return opts;
+}
+function removeCortexEntries(entries) {
+    return entries.filter((e) => !e.hooks?.some((h) => typeof h.command === 'string' && h.command.includes('shieldcortex')));
+}
 export function setupHooks(options) {
     const settings = readSettings();
     if (!settings.hooks) {
@@ -134,22 +155,43 @@ export function setupHooks(options) {
     // Second: reconcile timeouts on existing shieldcortex entries so doctor's
     // "re-run install to restore canonical timeouts" suggestion actually works.
     const timeoutsUpdated = reconcileHookTimeouts(settings);
-    // SessionEnd handling is now bidirectional:
-    //   - if --with-session-end was passed, install it (the .mjs gates execution
-    //     by config + OpenClaw env so it's safe to wire here);
-    //   - otherwise, remove any existing ShieldCortex SessionEnd entry to keep
-    //     the OpenClaw-safe default for users who don't explicitly opt in.
+    // SessionEnd handling:
+    //   - sessionEnd === true  → install below (the .mjs gates execution by
+    //     config + OpenClaw env so it's safe to wire);
+    //   - sessionEnd === false → explicit opt-out (--without-session-end):
+    //     remove the wiring; the gate sync below turns the gate off too;
+    //   - undefined            → PRESERVE an opted-in hook (runtime gate on).
+    //     Residue with the gate off is still cleaned up — that keeps the
+    //     OpenClaw-safe default for users who never opted in, without letting
+    //     an unrelated run (update.ts calls setupHooks() bare; `setup
+    //     --with-stop-hook` passes no sessionEnd) silently drop an opt-in.
     let removed = 0;
-    if (!options?.sessionEnd && settings.hooks.SessionEnd) {
-        const hadCortex = hasCortexHook(settings.hooks.SessionEnd);
-        if (hadCortex) {
-            settings.hooks.SessionEnd = settings.hooks.SessionEnd.filter((e) => !e.hooks?.some((h) => typeof h.command === 'string' && h.command.includes('shieldcortex')));
-            if (settings.hooks.SessionEnd.length === 0)
-                delete settings.hooks.SessionEnd;
-            removed++;
-            console.log('  - Hook: SessionEnd (removed — opt in with `--with-session-end`)');
+    let dropSessionEnd = options?.sessionEnd === false;
+    if (options?.sessionEnd === undefined && settings.hooks.SessionEnd) {
+        try {
+            dropSessionEnd = getAutoMemoryEnableConfig().enableSessionEnd !== true;
+        }
+        catch {
+            // Unreadable config — don't destroy wiring on a guess.
         }
     }
+    if (dropSessionEnd && settings.hooks.SessionEnd && hasCortexHook(settings.hooks.SessionEnd)) {
+        settings.hooks.SessionEnd = removeCortexEntries(settings.hooks.SessionEnd);
+        if (settings.hooks.SessionEnd.length === 0)
+            delete settings.hooks.SessionEnd;
+        removed++;
+        console.log('  - Hook: SessionEnd (removed — opt in with `--with-session-end`)');
+    }
+    // Explicit Stop opt-out (--without-stop-hook) removes the wiring too —
+    // gating off while leaving the hook wired is the "wired but runtime gate
+    // is off" warn state doctor exists to catch.
+    if (options?.stopHook === false && Array.isArray(settings.hooks.Stop) && hasCortexHook(settings.hooks.Stop)) {
+        settings.hooks.Stop = removeCortexEntries(settings.hooks.Stop);
+        if (settings.hooks.Stop.length === 0)
+            delete settings.hooks.Stop;
+        removed++;
+        console.log('  - Hook: Stop (removed — opt in with `--with-stop-hook`)');
+    }
     let added = 0;
     // Install command hooks (PreCompact, SessionStart, UserPromptSubmit)
     for (const [name, entry] of Object.entries(CORTEX_HOOKS)) {
@@ -215,8 +257,8 @@ export function setupHooks(options) {
     // hook in settings.json without flipping autoMemory.enable* was the
     // silent-amnesia failure mode in #41 — passing --with-stop-hook wrote the
     // hook but the runtime gate (default false) made it bail on every fire.
-    // Always sync gate to install flag — including the false case, so removing
-    // a hook by re-running install without the flag also disables the gate.
+    // Explicit true/false syncs the gate; undefined leaves it alone — callers
+    // must never coerce an absent CLI flag to false (use parseHookOptInFlags).
     if (options?.stopHook !== undefined || options?.sessionEnd !== undefined) {
         const updates = {};
         if (options.stopHook !== undefined)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shieldcortex",
-  "version": "4.32.7",
+  "version": "4.33.0",
   "description": "Trustworthy memory and security for AI agents. Recall debugging, review queue, OpenClaw session capture, and memory poisoning defence for Claude Code, Codex, OpenClaw, LangChain, and MCP agents.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",