chore(fork): rebuild develop_base with latest upstream and full #1720

.claude/hooks/f24-compaction.mjs

@@ -2,11 +2,15 @@
 // Managed Claude compaction carrier (Node canonical, #1542 successor of #1456).
 // No shell utilities, no persistent local state, no project writes.
 // Credit: ported from #1456 (.claude/hooks/f24-compaction.mjs by @amazing-fish).
+let productName = '';
 async function main() {
   const invocationId = process.env.CAT_CAFE_INVOCATION_ID;
   const callbackToken = process.env.CAT_CAFE_CALLBACK_TOKEN;
   // Project settings also apply to ordinary Claude CLI sessions.
   if (!invocationId || !callbackToken) return;
+  // Installed carrier dependencies are rooted at the trusted install, never cwd.
+  const { deploymentDefaults } = await import('../../packages/api/dist/agent-hooks/deployment-defaults.js');
+  productName = deploymentDefaults.brand.name;
   let raw = '';
   for await (const chunk of process.stdin) {
     raw += chunk;
@@ -16,7 +20,7 @@ async function main() {
   if (typeof input.session_id !== 'string' || !input.session_id || input.session_id.length > 500) {
     throw new Error('hook_session_id_invalid');
   }
-  const port = process.env.API_SERVER_PORT ?? '3004';
+  const port = process.env.API_SERVER_PORT ?? String(deploymentDefaults.apiPort);
   if (!/^\d+$/.test(port) || Number(port) < 1 || Number(port) > 65535) throw new Error('hook_api_port_invalid');
   const headers = {
     'X-Invocation-Id': invocationId,
@@ -52,7 +56,7 @@ async function main() {
   const result = await response.json();
   if (phase === 'pre') {
     if (result.contextEpoch?.status !== 'observed') throw new Error('hook_compaction_not_observed');
-    console.log(JSON.stringify({ systemMessage: 'Clowder AI recorded this invocation context compaction.' }));
+    console.log(JSON.stringify({ systemMessage: `${productName} recorded this invocation context compaction.` }));
   } else {
     if (result.postCompact?.status !== 'projected' || typeof result.postCompact.contextPacket !== 'string') {
       throw new Error('hook_cold_projection_unavailable');
@@ -71,6 +75,6 @@ async function main() {
 main().catch((error) => {
   // Never print response bodies, callback credentials, or user payloads.
   const reason = /^hook_[a-z_0-9]+$/.test(error.message) ? error.message : 'hook_request_failed';
-  console.error(`Clowder AI compaction hook: ${reason}`);
+  console.error(`${productName ? `${productName} ` : ''}compaction hook: ${reason}`);
   process.exitCode = 1;
 });

.claude/hooks/f24-post-compact-bootstrap.sh

@@ -15,7 +15,6 @@
 INPUT=$(cat)
 SESSION_ID=$(echo "$INPUT" | jq -r '.session_id')
 
-API_PORT="${API_SERVER_PORT:-3004}"
 INVOCATION_ID="${CAT_CAFE_INVOCATION_ID:-}"
 CALLBACK_TOKEN="${CAT_CAFE_CALLBACK_TOKEN:-}"
 
@@ -48,14 +47,18 @@ if [ "$AGE" -gt 1800 ]; then
 fi
 
 # Fetch latest sealed session digest (best-effort)
+SCRIPT_ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd) || exit 1
+API_PORT="${API_SERVER_PORT:-$(node "$SCRIPT_ROOT/scripts/read-deployment-default.mjs" apiPort)}"
+if [ -z "$API_PORT" ]; then exit 1; fi
 DIGEST=$(curl -sf --max-time 5 \
   -H "X-Invocation-Id: ${INVOCATION_ID}" \
   -H "X-Callback-Token: ${CALLBACK_TOKEN}" \
   "http://localhost:${API_PORT}/api/sessions/latest-digest?cliSessionId=$SESSION_ID" 2>/dev/null)
 DIGEST_STATUS=$?
 
 if [ "$DIGEST_STATUS" -ne 0 ] || [ -z "$DIGEST" ]; then
-  CONTEXT_PACKET="[F296 post-compact unsupported: Clowder AI projection unavailable]"
+  PRODUCT_NAME=$(node "$SCRIPT_ROOT/scripts/read-deployment-default.mjs" brand.name) || exit 1
+  CONTEXT_PACKET="[F296 post-compact unsupported: ${PRODUCT_NAME} projection unavailable]"
 else
   PROJECTION_STATUS=$(echo "$DIGEST" | jq -r '.postCompact.status // "unsupported"')
   if [ "$PROJECTION_STATUS" = "projected" ]; then

.claude/hooks/f24-pre-compact.sh

@@ -17,7 +17,9 @@ TRIGGER=$(echo "$INPUT" | jq -r '.trigger')
 LOG_FILE="/tmp/cat-cafe-hook-diagnostic.log"
 echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] pre-compact fired, session=$SESSION_ID, trigger=$TRIGGER" >> "$LOG_FILE"
 
-API_PORT="${API_SERVER_PORT:-3004}"
+SCRIPT_ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd) || exit 1
+API_PORT="${API_SERVER_PORT:-$(node "$SCRIPT_ROOT/scripts/read-deployment-default.mjs" apiPort)}"
+if [ -z "$API_PORT" ]; then exit 1; fi
 INVOCATION_ID="${CAT_CAFE_INVOCATION_ID:-}"
 CALLBACK_TOKEN="${CAT_CAFE_CALLBACK_TOKEN:-}"
 

.claude/hooks/user-level/README.md

@@ -1,18 +1,18 @@
 # 用户级 Hooks（跟着人走，所有项目生效）
 
 这些 hook 放在 `~/.claude/hooks/`（用户级），不是项目级。
-项目里这份是**参考副本**，方便其他猫或新环境部署。
+项目里这份是安装模板。安装器从当前部署档案绑定称谓；安装后的脚本不依赖当前项目、API 或配置文件。
 
 ## 部署方式
 
 ### Claude Code
 ```bash
-cp .claude/hooks/user-level/session-*.sh ~/.claude/hooks/
-chmod +x ~/.claude/hooks/session-*.sh   # macOS/Linux; Windows Git Bash 可跳过
+pnpm --filter @cat-cafe/api build
+node desktop/scripts/sync-agent-hooks-offline.mjs --project-root "$PWD" --target-root "$HOME"
 ```
-然后在 `~/.claude/settings.json` 的 `hooks` 里加 SessionStart 和 Stop 条目。
+此入口与 Hub 的 Sync hooks 共用 producer，会写入 SessionStart 和 Stop 条目。
 可参考同目录的 `claude-settings.template.json`；模板只使用 `$HOME`，不携带维护者机器上的绝对路径。
-建议优先用 Hub 的 Sync hooks 一键修复；手动复制 template 后，Hub 可能因路径规范化差异继续提示 stale，此时按提示再 sync 一次即可。
+也可以用 Hub 的 Sync hooks 一键修复。不要直接复制 `.sh` 模板；称谓变量必须由安装器作为数据绑定，不能在 shell 中求值执行。
 
 > **Windows 用户**：需要安装 [Git for Windows](https://gitforwindows.org/)（提供 Git Bash）。
 > Hook 命令通过 `bash` 显式调用，确保跨平台执行。如果不装 Git Bash，

.claude/hooks/user-level/session-start-recall.sh

@@ -121,7 +121,7 @@ if [ -n "$UNTRACKED_DOCS" ]; then
   WARNINGS="${WARNINGS}
 ⚠️ docs/ 下有未跟踪的 .md 文件（可能是你写的，也可能是别的猫正在写）：
 ${UNTRACKED_DOCS}
-→ 是你写的就 commit push；不是你写的别动，也别拿去问co-creator或跨线程催（写它的猫可能正在提交）
+→ 是你写的就 commit push；不是你写的别动，也别拿去问${CO_CREATOR_ROLE}或跨线程催（写它的猫可能正在提交）
 "
 fi
 
@@ -131,7 +131,7 @@ if [ -n "$ROOT_IMAGES" ]; then
   WARNINGS="${WARNINGS}
 ⚠️ 根目录有图片文件（截图应放 assets/screenshots/，设计稿放 designs/）：
 ${ROOT_IMAGES}
-→ 首个发现者直接处置，不等 owner、不跨线程协调、不问 operator：截图 → mv assets/screenshots/（gitignored，本体不 commit）；明显设计稿 → designs/；未知文件不删。FYI 仅在零成本定位来源时事后发一行
+→ 首个发现者直接处置，不等 owner、不跨线程协调、不问 ${DECISION_ROLE}：截图 → mv assets/screenshots/（gitignored，本体不 commit）；明显设计稿 → designs/；未知文件不删。FYI 仅在零成本定位来源时事后发一行
 "
 fi
 
@@ -143,7 +143,7 @@ if [ -n "$ROOT_CLUTTER" ]; then
   WARNINGS="${WARNINGS}
 ⚠️ 根目录有不该在这里的文件：
 ${ROOT_CLUTTER}
-→ 是你放的就收走（截图 → assets/screenshots/，设计稿 → designs/）；不是你放的别动，也别拿去问co-creator；未知文件不删
+→ 是你放的就收走（截图 → assets/screenshots/，设计稿 → designs/）；不是你放的别动，也别拿去问${CO_CREATOR_ROLE}；未知文件不删
 "
 fi
 

.claude/hooks/user-level/session-stop-check.sh

@@ -57,7 +57,7 @@ if [ -n "$UNTRACKED_DOCS" ]; then
   WARNINGS="${WARNINGS}
 ⚠️ 收尾检查：docs/ 下有未跟踪的 .md 文件（可能是你写的，也可能是别的猫正在写）：
 ${UNTRACKED_DOCS}
-→ 是你写的，先 commit push 再收工；不是你写的别动，也别拿去问co-creator
+→ 是你写的，先 commit push 再收工；不是你写的别动，也别拿去问${CO_CREATOR_ROLE}
 "
 fi
 
@@ -67,7 +67,7 @@ if [ -n "$ROOT_IMAGES" ]; then
   WARNINGS="${WARNINGS}
 ⚠️ 收尾检查：根目录有图片文件（截图应放 assets/screenshots/）：
 ${ROOT_IMAGES}
-→ 别走！首个发现者直接收拾，不跨线程协调、不问 operator：截图 mv assets/screenshots/（不 commit）；设计稿 → designs/；未知文件不删
+→ 别走！首个发现者直接收拾，不跨线程协调、不问 ${DECISION_ROLE}：截图 mv assets/screenshots/（不 commit）；设计稿 → designs/；未知文件不删
 "
 fi
 
@@ -79,7 +79,7 @@ if [ -n "$ROOT_CLUTTER" ]; then
   WARNINGS="${WARNINGS}
 ⚠️ 收尾检查：根目录有杂物文件：
 ${ROOT_CLUTTER}
-→ 是你放的就收走再收工；不是你放的别动，也别拿去问co-creator；未知文件不删
+→ 是你放的就收走再收工；不是你放的别动，也别拿去问${CO_CREATOR_ROLE}；未知文件不删
 "
 fi
 

.dir-exceptions.json

@@ -1,5 +1,26 @@
 {
   "exceptions": [
+    {
+      "path": "packages/api/src/domains/collaborative-content/artifact-review",
+      "owner": "codex-astra",
+      "reason": "2026-10-21 daily sync: reviewed #5799 adds response-judgment and response-judgment-return, taking this directory from 24 to 26 files. They share the review reducer, return intent, sealed audience and owner revision checks. Keep those reviewed boundaries intact for this export; reassess a response/return subgroup with its store imports before expiry.",
+      "expiresAt": "2026-10-31",
+      "ticket": "F326 / cat-cafe#5799 / clowder-ai#1649"
+    },
+    {
+      "path": "packages/api/src/domains/workspace",
+      "owner": "codex-astra",
+      "reason": "2026-10-21 daily sync: reviewed #5799 adds workspace-video-snapshot, taking this directory from 24 to 25 files. The request-scoped immutable copy shares the existing workspace source revision, stream lifetime and security errors. Reassess the content-source/video snapshot subgroup together before expiry rather than move one authority-sensitive adapter only to reduce this count.",
+      "expiresAt": "2026-10-31",
+      "ticket": "F063/F326 / cat-cafe#5799 / clowder-ai#1649"
+    },
+    {
+      "path": "packages/api/src/infrastructure/capability-evolution/adapters",
+      "owner": "codex-astra",
+      "reason": "2026-10-21 daily sync: reviewed #5854 adds archive-source-repository, taking this directory from 24 to 25 files. The shared immutable historical repository identity is consumed by the Microduck and request-review adapters; it must not become deployment branding. Reassess an archive-provenance module boundary with all consumers before expiry, preserving those signed source coordinates.",
+      "expiresAt": "2026-10-31",
+      "ticket": "F330/F311 / cat-cafe#5854 / clowder-ai#1649"
+    },
     {
       "path": "packages/api/src/domains/collaborative-content/collective-artifact",
       "owner": "codex61-sol",

.env.example

@@ -153,6 +153,16 @@ EMBED_MODE=off
 # TELEMETRY_HMAC_SALT=
 
 # ── Logging 日志（可选）─────────────────────────────────────
+# Windows ACP bootstrap and audit admission are separate, restart-only Host settings.
+# Persist intranet configuration once in Host .env; plugins cannot enable these policies.
+# CAT_CAFE_WINDOWS_ACP_BOOTSTRAP_MODE=strict
+# CAT_CAFE_ACP_BOOTSTRAP_CONFIG_AUDIT_MODE=required
+# trusted-host skips ancestor trust only; warn-bootstrap-root permits only verified existing ACP root changes.
+# The legacy exact CAT_CAFE_TRUSTED_HOST_COMPATIBILITY=1 maps missing new keys to that narrow preset.
+# Explicit strict/required win; audit exceptions are inactive outside Windows trusted-host.
+# Deprecated alias remains for at least two applicable releases and 90 days, then review (no timed disable).
+# ACP strict is unrelated to CAT_CAFE_STRICT_PROFILE_DEFAULTS.
+# AUDIT_LOG_DIR changes require an API restart; existing explicit paths are never silently relocated.
 # Log level: debug, info, warn, error
 
 LOG_LEVEL=info

.githooks/commit-msg

@@ -0,0 +1,3 @@
+#!/bin/bash
+set -euo pipefail
+exec node "$(dirname "${BASH_SOURCE[0]}")/../scripts/secret-git-guard.mjs" message "$1"

.githooks/pre-commit

@@ -17,6 +17,11 @@
 
 BRANCH=$(git branch --show-current 2>/dev/null)
 REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null)
+# Read INDEX blobs, not the worktree; do not print matched content on failure.
+SECRET_GUARD="$(dirname "${BASH_SOURCE[0]}")/../scripts/secret-git-guard.mjs"
+if ! node "$SECRET_GUARD" index; then
+  exit 1
+fi
 STAGED_FILES="$(git diff --cached --name-only || true)"
 VERDICT_BRANCH_DOMAIN=""
 VERDICT_ID=""

.github/scripts/check-public-test-ci-contract.mjs

@@ -3,6 +3,12 @@ import { readFileSync } from 'node:fs';
 import { parse } from 'yaml';
 
 const workflow = parse(readFileSync(new URL('../workflows/ci.yml', import.meta.url), 'utf8'));
+const lintCheckout = workflow.jobs.lint.steps.find((step) => step.uses === 'actions/checkout@v4');
+assert.equal(
+  lintCheckout?.with?.['fetch-depth'],
+  0,
+  'the lint job runs MCP lineage checks and must fetch complete Git history',
+);
 const runtimeJobs = ['public-test-prepare', 'public-test-shards', 'public-test-summary'];
 const versions = runtimeJobs.map((jobName) => {
   const setupNode = workflow.jobs[jobName].steps.find((step) => step.uses === 'actions/setup-node@v4');
@@ -116,11 +122,27 @@ for (const [pattern, message] of [
 ]) {
   assert.match(distributableLauncher, pattern, message);
 }
+assert.doesNotMatch(
+  summaryStep.run,
+  /--max-critical-path-ms\b/,
+  'public-test coverage must not fail solely because runner-dependent timing exceeds a target',
+);
 assert.match(
   summaryStep.run,
-  /--max-critical-path-ms 600000(?:\s|$)/,
-  'public-test evidence must fail when the measured critical path exceeds 10 minutes',
+  /::warning title=Public test timing::/,
+  'public-test timing above the optimization target must remain visible as a warning',
 );
+assert.match(
+  summaryStep.run,
+  /GITHUB_STEP_SUMMARY/,
+  'public-test timing and runner consumption must remain visible in the job summary',
+);
+for (const job of ['public-test-shards', 'public-test-summary', 'public-test-serial']) {
+  assert.ok(
+    Number.isInteger(workflow.jobs[job]['timeout-minutes']) && workflow.jobs[job]['timeout-minutes'] > 0,
+    `${job} must retain a bounded job timeout for stuck processes`,
+  );
+}
 
 process.stdout.write(
   `public-test CI contract OK (Node ${versions[0]}, owner ${distributableShardStep.env.DEFAULT_OWNER_USER_ID})\n`,

.github/workflows/build-mac-dmg.yml

@@ -43,7 +43,7 @@ jobs:
   build:
     name: DMG (${{ matrix.arch }})
     runs-on: ${{ matrix.arch == 'x64' && 'macos-15-intel' || 'macos-latest' }}
-    timeout-minutes: 60
+    timeout-minutes: 90
     strategy:
       fail-fast: false
       matrix:
@@ -59,19 +59,6 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Sync desktop/package.json version
-        shell: bash
-        run: |
-          VERSION="${{ inputs.version }}"
-          node -e "
-            const fs = require('fs');
-            const path = 'desktop/package.json';
-            const pkg = JSON.parse(fs.readFileSync(path, 'utf8'));
-            pkg.version = '$VERSION';
-            fs.writeFileSync(path, JSON.stringify(pkg, null, 2) + '\n');
-            console.log('desktop/package.json version =', pkg.version);
-          "
-
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
@@ -80,6 +67,7 @@ jobs:
 
       - name: Build macOS DMG (${{ matrix.arch }})
         env:
+          NODE_OPTIONS: --max-old-space-size=4096
           CATCAFE_VERSION: ${{ inputs.version }}
         run: |
           chmod +x desktop/scripts/build-mac.sh

.github/workflows/build-windows-desktop.yml

@@ -42,19 +42,6 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Sync desktop/package.json version
-        shell: bash
-        run: |
-          VERSION="${{ inputs.version }}"
-          node -e "
-            const fs = require('fs');
-            const path = 'desktop/package.json';
-            const pkg = JSON.parse(fs.readFileSync(path, 'utf8'));
-            pkg.version = '$VERSION';
-            fs.writeFileSync(path, JSON.stringify(pkg, null, 2) + '\n');
-            console.log('desktop/package.json version =', pkg.version);
-          "
-
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
@@ -73,8 +60,18 @@ jobs:
           $env:Path += ";C:\Program Files (x86)\Inno Setup 6"
           iscc.exe /? | Select-Object -First 1
 
+      - name: Test native installer preparation and menu behavior
+        shell: pwsh
+        run: |
+          $env:ISCC_EXE = @('C:\Program Files\Inno Setup 7\ISCC.exe', 'C:\Program Files (x86)\Inno Setup 6\ISCC.exe') |
+            Where-Object { Test-Path -LiteralPath $_ } | Select-Object -First 1
+          if (-not $env:ISCC_EXE) { throw 'Native Inno compiler was not found after installation' }
+          node --test desktop/installer-preparation-log.test.js desktop/installer-no-icons.test.js
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
       - name: Build Windows installer
         env:
+          NODE_OPTIONS: --max-old-space-size=4096
           CATCAFE_VERSION: ${{ inputs.version }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         shell: pwsh