Verify Hook child interpreter RED

.github/workflows/tests.yml

@@ -1,142 +1,41 @@
 name: Tests
-
-# Builds, type-checks and runs every test suite on a clean GitHub runner, and records the file
-# list each published package would contain. Each suite is its own job so one failure does not
-# hide the others. No provider credentials or operator configuration are supplied.
-# Package suites deny external networking; scenario runtime has no external route.
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
+on: workflow_dispatch
 permissions:
   contents: read
-
-concurrency:
-  group: tests-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
-  build-and-package:
+  notice-recovery:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: b892f2a703aa06b8d3e814c59506f3a644e80761
           persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: 22
           cache: npm
+      - run: command -v tmux || (sudo apt-get update && sudo apt-get install -y tmux)
       - run: npm ci
       - run: npm run build
-      - name: Record the published file list of each package
+      - name: Hook child interpreter regression
+        shell: bash
         run: |
-          set -euo pipefail
-          mkdir -p pack-lists
-          for p in cli daemon tui; do
-            (cd packages/$p && npm pack --dry-run --json --ignore-scripts) \
-              | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{for(const f of JSON.parse(s)[0].files)console.log(f.path)})' \
-              | sort > pack-lists/$p.txt
-            echo "$p: $(wc -l < pack-lists/$p.txt) files"
-          done
-      - uses: actions/upload-artifact@v4
-        with:
-          name: pack-lists
-          path: pack-lists/
-
-  typecheck:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run lint
-
-  repo-checks:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run test:repo
-
-  package-tests:
-    if: ${{ github.event_name != 'push' }}
-    # macOS, the platform OpenRig runs on: several daemon and cli tests read macOS ps columns,
-    # file-inode behaviour and release tags.
-    runs-on: macos-latest
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        package: [daemon, cli, tui, ui]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: brew install tmux
-      - run: npm ci
-      - name: Build the packages the tests import
-        run: npm run build
-      - name: Run the suite without ambient credentials or external network
-        run: |
-          suite_root=$(mktemp -d "$RUNNER_TEMP/opr-test.XXXXXX")
-          suite_root=$(cd "$suite_root" && pwd -P)
-          mkdir -p "$suite_root/home" "$suite_root/bin"
-          # Same system bytes, nonprivileged mode; no system file is changed.
-          /usr/bin/install -m 0755 /bin/ps "$suite_root/bin/ps"
-          # Only this job's temporary sockets (including tmux) are reachable.
-          env -i HOME="$suite_root/home" PATH="$PATH" TMPDIR="$suite_root" TMUX_TMPDIR="$suite_root" \
-            CI=true TERM=xterm-256color \
-            sandbox-exec -D IPC_ROOT="$suite_root" -p '(version 1)(allow default)(deny network-outbound)(allow network-outbound (remote ip "localhost:*"))(allow network-outbound (subpath (param "IPC_ROOT")))' \
-            /bin/bash -s "${{ matrix.package }}" <<'SUITE'
-          set -euo pipefail
-          node scripts/ci-macos-process-probe.mjs
-          # The production readers use bare ps. Select real system bytes only after
-          # self/owned-child observation and network/IPC confinement are proved.
-          export PATH="$TMPDIR/bin:$PATH"
-          test "$(command -v ps)" = "$TMPDIR/bin/ps"
-          exec npm run test -w "packages/$1"
-          SUITE
-
-  installed-scenario:
-    runs-on: ubuntu-latest
-    timeout-minutes: 35
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - name: Installed package, daemon restart, and seeded durability failure
-        run: bash scripts/run-pr-scenarios.sh
+          set +e
+          set -uo pipefail
+          mkdir -p proof
+          git rev-parse HEAD HEAD^{tree} > proof/source.txt
+          node --version > proof/node-version.txt
+          npm --workspace @openrig/daemon test -- test/refocus-continuation.test.ts test/refocus-managed-result.test.ts --reporter=verbose 2>&1 | tee proof/daemon.log
+          result=${PIPESTATUS[0]}
+          npm run lint 2>&1 | tee proof/typecheck.log
+          lint_result=${PIPESTATUS[0]}
+          git diff --exit-code > proof/source-unchanged.txt
+          printf 'daemon=%s\ntypecheck=%s\n' "$result" "$lint_result" > proof/exits.txt
+          test "$result" -eq 0 && test "$lint_result" -eq 0
       - uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: installed-scenario-evidence
-          path: dist/pr-scenarios/
+          name: refocus-health-node-red
+          path: proof/
           if-no-files-found: error

packages/daemon/assets/plugins/openrig-core/hooks/scripts/refocus.cjs

@@ -13,6 +13,9 @@ const crypto = require("node:crypto");
 const { spawnSync } = require("node:child_process");
 const { recordRefocusResult } = require("./refocus-health.cjs");
 
+// Keep the operator's command lookup order; env-node CLI scripts can also use this hook's Node.
+const childEnv = { ...process.env, PATH: [process.env.PATH, path.dirname(process.execPath)].filter(Boolean).join(path.delimiter) };
+
 const DEFAULT_THRESHOLD = 2_600_000;
 const FALSE_VALUES = new Set(["0", "false", "off", "no"]);
 // The issue report after a failed attempt gets this long once the attempt's lookups are done.
@@ -73,7 +76,7 @@ function readConfiguredContent(home) {
     if (timeout <= MIN_LOOKUP_MS) return { content: null, contentRef, failure: "no time left in the refocus budget" };
     const result = spawnSync("rig", ["context", "get", contentRef], {
       encoding: "utf8",
-      env: process.env,
+      env: childEnv,
       timeout,
       maxBuffer: 16 * 1024 * 1024,
     });
@@ -141,7 +144,7 @@ function readQueueWhoami(timeout = lookupTimeout()) {
   if (timeout <= MIN_LOOKUP_MS) return { unknown: "no time left in the refocus budget" };
   const args = ["queue", "whoami", "--json", ...(workPacketEnabled() ? ["--work-candidates"] : [])];
   let result = spawnSync("rig", args, {
-    encoding: "utf8", env: process.env, timeout, maxBuffer: 16 * 1024 * 1024,
+    encoding: "utf8", env: childEnv, timeout, maxBuffer: 16 * 1024 * 1024,
   });
   // A rig CLI older than this hook rejects the flag. Ask again without it, inside what is left of
   // the budget, so the role and the strict answer still arrive (just without candidates).
@@ -150,7 +153,7 @@ function readQueueWhoami(timeout = lookupTimeout()) {
     const remaining = remainingLookupBudget();
     if (remaining > 250) {
       result = spawnSync("rig", ["queue", "whoami", "--json"], {
-        encoding: "utf8", env: process.env, timeout: remaining, maxBuffer: 16 * 1024 * 1024,
+        encoding: "utf8", env: childEnv, timeout: remaining, maxBuffer: 16 * 1024 * 1024,
       });
     }
   }
@@ -208,7 +211,7 @@ function renderRole(result) {
 // start, after reserving python's cap and, when a content ref is configured, the content lookup
 // that runs after python; with 250 ms or less left it is skipped.
 function traceEnv(trees) {
-  const env = { ...process.env };
+  const env = { ...childEnv };
   const missing = [
     ["OPENRIG_TOPOLOGY_ROOT", "topology", "topology"],
     ["OPENRIG_WORKSPACE_ROOT", "workspace", "work"],
@@ -218,7 +221,7 @@ function traceEnv(trees) {
   if (timeout <= 250) return env;
   const result = spawnSync("rig", ["config", "--json"], {
     encoding: "utf8",
-    env: process.env,
+    env: childEnv,
     timeout,
     maxBuffer: 16 * 1024 * 1024,
   });

packages/daemon/assets/plugins/openrig-core/skills/claude-compaction-restore/scripts/precompact-hook.mjs

@@ -265,7 +265,7 @@ try {
 
   const customMessage = readClaudeCompactionMessage();
 
-  const result = spawnSync("node", args, { encoding: "utf8" });
+  const result = spawnSync(process.execPath, args, { encoding: "utf8" });
   if (result.status !== 0) {
     const baseFailure = `Claude compaction restore packet generation failed: ${(result.stderr || result.stdout || "unknown error").trim()}. After compaction, load the claude-compaction-restore skill and run restore-from-jsonl manually.`;
     emit({

packages/daemon/test/precompact-hook.test.ts

@@ -44,7 +44,7 @@ const BRIDGE_SCRIPT = resolve(
 );
 const APPEND_MARKER = "Operator-configured post-compaction restore instruction";
 
-function runHook(openrigHome: string, withTranscript = true): { stdout: string; stderr: string; status: number | null } {
+function runHook(openrigHome: string, withTranscript = true, extraEnv: NodeJS.ProcessEnv = {}): { stdout: string; stderr: string; status: number | null } {
   const fixtureRoot = dirname(openrigHome);
   const transcript = join(fixtureRoot, "transcript.jsonl");
   if (withTranscript) writeFileSync(transcript, `${JSON.stringify({
@@ -64,6 +64,7 @@ function runHook(openrigHome: string, withTranscript = true): { stdout: string;
       OPENRIG_COMPACTION_OUT_ROOT: join(fixtureRoot, "packets"),
       // Ensure RIGGED_HOME doesn't pre-empt OPENRIG_HOME selection.
       RIGGED_HOME: undefined,
+      ...extraEnv,
     } as NodeJS.ProcessEnv,
   });
   return {
@@ -145,6 +146,14 @@ describe("precompact-hook.mjs (slice 27 custom message append)", () => {
     rmSync(tmpDir, { recursive: true, force: true });
   });
 
+  it("prepares the restore packet and pending marker with no Node on PATH", () => {
+    const { stdout, status } = runHook(openrigHome, true, { PATH: "" });
+    expect(status).toBe(0);
+    expect(JSON.parse(stdout).systemMessage).toContain("Pre-compaction restore seed packet prepared");
+    const marker = JSON.parse(readFileSync(join(openrigHome, "compaction/restore-pending/[email protected]"), "utf8"));
+    expect(existsSync(join(marker.outputDir, "restore-instructions.md"))).toBe(true);
+  });
+
   it("HG-6: inline message is appended to systemMessage", () => {
     writePolicyConfig(openrigHome, {
       messageInline: "Operator says hi — remember the migration step.",

packages/daemon/test/refocus-context-ref.test.ts

@@ -41,6 +41,7 @@ function runHook(options: {
   whoamiStdout?: string;
   whoamiStatus?: number;
   capturePython?: boolean;
+  nodeRig?: boolean;
 }) {
   if (root) rmSync(root, { recursive: true, force: true });
   root = mkdtempSync(join(tmpdir(), "refocus-context-ref-"));
@@ -65,7 +66,15 @@ function runHook(options: {
   // The fake answers two verbs. `queue whoami` is dispatched first and returns its own
   // stdout/status, so a whoami failure can be exercised without disturbing the context-get
   // contract below, which stays byte-identical to keep the existing suites unaffected.
-  writeFileSync(rig, `#!/bin/sh
+  writeFileSync(rig, options.nodeRig ? `#!/usr/bin/env node
+const fs = require("node:fs");
+const args = process.argv.slice(2);
+fs.appendFileSync(process.env.RIG_VERB_LOG, args.join(" ") + "\\n");
+if (args.includes("--work-candidates")) { process.stderr.write("unknown option --work-candidates"); process.exit(1); }
+if (args[0] === "queue") process.stdout.write(process.env.RIG_WHOAMI_STDOUT);
+else if (args[0] === "config") process.stdout.write(JSON.stringify({ workspace: { root: process.env.OPENRIG_HOME } }));
+else process.stdout.write(process.env.RIG_STDOUT);
+` : `#!/bin/sh
 printf '%s %s %s\\n' "$1" "$2" "$3" >> "$RIG_VERB_LOG"
 if [ "$1" = "queue" ] && [ "$2" = "whoami" ]; then
   printf '%s' "$RIG_WHOAMI_STDOUT"
@@ -96,7 +105,7 @@ exit 0
 
   const env = {
     ...process.env,
-    PATH: `${bin}:${process.env.PATH || ""}`,
+    PATH: options.nodeRig ? bin : `${bin}:${process.env.PATH || ""}`,
     OPENRIG_HOME: home,
     OPENRIG_SESSION_NAME: "seat@test",
     OPENRIG_REFOCUS_CONTENT_REF: options.ref,
@@ -141,6 +150,18 @@ exit 0
 }
 
 describe("openrig-core refocus hook — context library refs", () => {
+  it("reads work, legacy CLI fallback, roots and content through an env-node rig with no Node on PATH", () => {
+    const bundle = "# Minimal-PATH context\n";
+    const result = runHook({ nodeRig: true, ref: REF, capturePython: true, rigStdout: bundle,
+      whoamiStdout: JSON.stringify({ currentWorkBasis: "fixture has no current work" }),
+      extraEnv: { OPENRIG_REFOCUS_WORK_NODE: undefined, OPENRIG_WORKSPACE_ROOT: undefined, OPENRIG_REFOCUS_WORK_PACKET: "1" } });
+    expect(result.status).toBe(0);
+    expect(result.payload?.hookSpecificOutput.additionalContext.endsWith(bundle)).toBe(true);
+    expect(result.rigVerbs().trim().split("\n")).toEqual([
+      "queue whoami --json --work-candidates", "queue whoami --json", "config --json", `context get ${REF}`,
+    ]);
+  });
+
   it("REF wins over FILE and delivers the exact rig context get bytes", () => {
     const bundle = "# OpenRig Context Pack: proof v1\n\nassembled bytes\n";
     const result = runHook({ ref: REF, fileContent: "FILE MUST NOT WIN", rigStdout: bundle });

packages/daemon/test/refocus-continuation.test.ts

@@ -9,7 +9,7 @@ const boundary = "OpenRig post-compaction turn boundary. Please acknowledge this
 const roots: string[] = [];
 afterEach(() => { for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true }); });
 
-function fixture() {
+function fixture(nodeRig = false) {
   const root = mkdtempSync(join(tmpdir(), "refocus-continuation-"));
   roots.push(root);
   const bin = join(root, "bin");
@@ -20,14 +20,21 @@ function fixture() {
   const transcript = join(root, "transcript.jsonl");
   writeFileSync(transcript, "x".repeat(100));
   writeFileSync(trace, '#!/bin/sh\nprintf "%s" "$TRACE_RESULT"\nprintf "%s" "$TRACE_STDERR" >&2\nexit "${TRACE_STATUS:-0}"\n');
-  writeFileSync(rig, '#!/bin/sh\nif [ "$1 $2" = "stream emit" ]; then\n printf "%s\\n" "$*" >> "$CALLS"\n exit "${STREAM_EXIT:-0}"\nfi\nprintf "{}"\n');
+  writeFileSync(rig, nodeRig ? `#!/usr/bin/env node
+const args = process.argv.slice(2);
+if (args[0] === "stream" && args[1] === "emit") {
+  require("node:fs").appendFileSync(process.env.CALLS, args.join(" ") + "\\n");
+  process.exit(Number(process.env.STREAM_EXIT || 0));
+}
+process.stdout.write("{}");
+` : '#!/bin/sh\nif [ "$1 $2" = "stream emit" ]; then\n printf "%s\\n" "$*" >> "$CALLS"\n exit "${STREAM_EXIT:-0}"\nfi\nprintf "{}"\n');
   chmodSync(trace, 0o755);
   chmodSync(rig, 0o755);
   const run = (event: string, prompt = "continue", good = true, extra: NodeJS.ProcessEnv = {}, identity = "occupant", timeout = 10_000) => {
     const result = spawnSync(process.execPath, [hook, "--runtime", "claude"], {
       input: JSON.stringify({ hook_event_name: event, session_id: identity, prompt, transcript_path: transcript }),
       encoding: "utf8", timeout, killSignal: "SIGKILL",
-      env: { ...process.env, PATH: `${bin}:${process.env.PATH}`, OPENRIG_HOME: root,
+      env: { ...process.env, PATH: nodeRig ? bin : `${bin}:${process.env.PATH}`, OPENRIG_HOME: root,
         OPENRIG_SESSION_NAME: "seat@test", OPENRIG_REFOCUS_ENABLED: "1", OPENRIG_REFOCUS_NOW: "",
         OPENRIG_REFOCUS_CONTENT_REF: "", OPENRIG_REFOCUS_CONTENT_FILE: "", OPENRIG_REFOCUS_TREES: "work",
         OPENRIG_REFOCUS_WORK_NODE: root, OPENRIG_WORKSPACE_ROOT: root,
@@ -74,8 +81,8 @@ describe("refocus continuation", () => {
     expect(f.state().pendingOn).toBeUndefined();
   });
 
-  it("reports only the third failed attempt, retains due state, and resets on a successful delivery", () => {
-    const f = fixture();
+  it.each([false, true])("reports the third failure and resets after delivery (env-node CLI without Node on PATH=%s)", nodeRig => {
+    const f = fixture(nodeRig);
     f.run("PostCompact");
     for (let i = 0; i < 2; i++) f.run("UserPromptSubmit", "continue", false);
     expect(f.calls()).toEqual([]);

scripts/skill-edge-digests.generated.json

@@ -62,7 +62,7 @@
       "applying-a-permission-policy/SKILL.md": "f7bba8d50b10fc8715f40a57bf82677ca9388c6718c8a162833d9c6daf2afdca",
       "claude-compaction-restore/SKILL.md": "623b00143111a1ad695c72c86bcf0792bbccd1b4a6d250a1cde27145513960ae",
       "claude-compaction-restore/reference/SKILL-v1.md": "6af2a889c9c38227fb186897c6e29185f81b215822070b469a6ceeb47734e133",
-      "claude-compaction-restore/scripts/precompact-hook.mjs": "478599ce28f4bdcd1f1e091c687726b598271d834288dcfd80bb2f9adfa2e37a",
+      "claude-compaction-restore/scripts/precompact-hook.mjs": "712e97c8beb02eb6c2815884a960778a225d8f6238dfe04a9b0547c34eaa131d",
       "claude-compaction-restore/scripts/restore-from-jsonl.mjs": "5584cff4ab36cd843e14c81bd201e4a2f8e498e995abacc4f81ec6c1fc556b10",
       "claude-compaction-restore/templates/compact-instruction.md": "682c778464517b831902ddc2678c055545899b4751a1d32391ce965d5eb7061d",
       "claude-compaction-restore/templates/post-compact-restore-instruction.md": "10a5a7e5e052f3aa000a4209f386dc4eb90a3c2bba449ca685f124714f59e47a",