5 Commits

Author SHA1 Message Date
xsser 991fdb9123 fix: update comments and help text to match v3.2 state file naming
Hook comment block still referenced v3.1 single-file design; setup help
text pointed to obsolete .claude/pua-loop.local.md for monitoring.
2026-04-19 22:23:47 +08:00
xsser 08e70525ed fix: pua-loop state file isolation — prevent cross-directory task bleed
State file was written to a single global path (~/.claude/pua/loop-active.md),
causing two Claude Code instances in different directories to overwrite each
other's loop state. Now uses cwd hash in filename (loop-<hash>.md) so each
project directory has an independent loop instance.

Fixes: multiple users reporting task A executing task B's commands when
running pua-loop in two directories simultaneously.
2026-04-19 22:20:25 +08:00
xsser 1be1c478b6 release: v3.2.0 — teardown protocol (agent lifecycle accounting)
PUA v3.1 之前覆盖 agent 生命周期的前 4 阶段(Define → Spawn → Monitor →
Accept),缺后 3 阶段(Release → Cleanup → Orphan handling),导致验收通过的
agent 堆在上下文、worktree 变孤儿、tmux pane 常驻、后台 agent 永久吃 token。
v3.2 补齐会计层:SubagentStop hook + 3 个新 slash 命令 + teardown 协议文档。

Why (Netflix Keeper Test): 职业球队里打完比赛的球员必须下场,继续站场上只会
拖垮全队节奏。agent 也一样。

What:
- NEW hooks/subagent-teardown.sh — SubagentStop 会计,写 teardown.jsonl +
  从 active-agents.json 移除(单行 compact jsonl)
- NEW commands/team-status.md — 列在场阵容(活跃 agent / PID / TTL / age)
- NEW commands/reap-orphans.md — 扫 stale agent(mtime > 30min)批量回收
- NEW commands/teardown-all.md — 级联释放 P10 → P9 → P8 → P7 全员下场
- NEW skills/pua/references/teardown-protocol.md — 生命周期 7 阶段协议 +
  6 条 Release 规则 + Cleanup checklist + Orphan 三层防御

Bugfix:
- hooks/pua-loop-hook.sh: 新增 Gate 0(SubagentStop isolation),state file
  路径改为绝对路径 $HOME/.claude/pua/loop-active.md(SESSION_ID 在 setup
  时不可用,固定名)+ legacy fallback
- scripts/setup-pua-loop.sh: ABS + legacy 双写 state
- hooks/hooks.json: 注册 SubagentStop → subagent-teardown.sh
- commands/on.md: 修复 feedback_frequency=0 tombstone 不恢复的不对称 bug
- commands/cancel-pua-loop.md + team-status.md: 移除不支持的
  Read(~/...) tilde 权限语法

E2E 验证 (10/10 全绿):
T1 hooks.json syntax | T2 teardown jsonl compact | T3 active-agents 选择性清除
T4 setup 双写 MD5 identical | T5 Gate 0 真拦截 SubagentStop
T6 主会话 Stop 注入 decision:block valid JSON | T7 Gate 0 对带 transcript
的 sub 仍拦截 | T8 无 tilde | T9 feedback_frequency 恢复 | T10 SubagentStop 注册
2026-04-18 02:40:57 +08:00
xxnbyy 7c217b80b0 fix(security): address issues #97-100 — hooks consent, sanitize, loop escape, privacy disclosure
## Issue #97 — Hooks fire without user consent
- PreCompact hook now checks for PUA activation markers before writing files
- Stop feedback hook skips if PUA was never triggered this session

## Issue #98 — Session sanitization incomplete
- Sanitize script upgraded; rate limiting migration added (0003_feedback_rate_limiting.sql)

## Issue #99 — PUA Loop no in-session escape
- Default max iterations changed from unlimited to 30
- Added <loop-abort> (terminate) and <loop-pause> (pause for manual intervention) signals
- Loop hook supports active:false for pause state; session self-binding on resume
- Added /cancel-pua-loop command; guide.html and README updated
- PUA pressure escalation injected per iteration via system message

## Issue #100 — Upload endpoint undisclosed PII
- Privacy/data-usage disclosure added to contribute.html (ZH+EN bilingual)
- Contribute.tsx updated with same disclosure

## Additional fixes
- Rename commands/loop.md → commands/pua-loop.md; add cancel-pua-loop.md
- Replace "Ralph Loop × PUA" with "PUA Loop" across all user-facing docs
- Fix nav active-state highlighting on all sub-pages
- Fix logout button (GET method); redirect to /contribute.html
- Add JA language support to leaderboard.html
- Add "how to find session file" guide to contribute.html
- Unify nav-r gap (1rem) across all pages

Closes #97
Closes #98
Closes #99
Closes #100
2026-03-22 18:54:58 +08:00
xsser d59a31ff85 feat(loop): self-contained PUA Loop — Ralph Loop stop-hook built-in, no external dependency 2026-03-20 16:31:27 +08:00