Release 4.260429.13 — hookify foundation + Mac CPU hardening sweep

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "genie",
-      "version": "4.260428.3",
+      "version": "4.260428.10",
       "source": "./plugins/genie",
       "description": "Human-AI partnership for Claude Code. Share a terminal, orchestrate workers, evolve together. Brainstorm ideas, wish them into plans, make with parallel agents, ship as one team. A coding genie that grows with your project."
     }

.github/workflows/ci.yml

@@ -14,6 +14,20 @@ concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
 
+# Pin terminal width for the test process. test/visual/tui-snapshot.test.tsx
+# (and any future visual regression test) renders OpenTUI components without
+# forcing an explicit width — OpenTUI auto-detects from $COLUMNS. Local
+# developer terminals default to 80 cols (snapshots were captured at 80);
+# Blacksmith CI runners default to ~100+ cols, which produces wider card
+# borders and breaks every visual snapshot.
+#
+# Pin COLUMNS=80 at the workflow level so every job/step inherits the same
+# render width as the snapshots. Both `unit-tests > Visual regression` and
+# `pg-tests > Test` run test/visual/* and need the same value, so a single
+# workflow-level env is the right scope.
+env:
+  COLUMNS: "80"
+
 jobs:
   secrets-scan:
     name: Secrets Scan (GitGuardian)

.github/workflows/version.yml

@@ -177,17 +177,19 @@ jobs:
         # On dev context: publish the version we just bumped to as @next.
         run: npm publish --access public --tag ${{ steps.context.outputs.npm_tag }}
 
-      - name: Mark published version as deprecated (npm-distribution sunset)
-        # The npm distribution channel is being soft-deprecated in favor of
-        # the cosign + SLSA verified installer at get.automagik.dev/genie.
-        # Every published version carries an `npm warn deprecated` notice
-        # pointing operators at the canonical install path. Existing pinned
-        # versions continue to install (the postinstall shim handles the
-        # delegation in the next umbrella PR); this step just makes the
-        # sunset visible in npm's own UX.
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: |
-          version="$(node -p 'require("./package.json").version')"
-          npm deprecate "@automagik/genie@${version}" \
-            "@automagik/genie via npm is soft-deprecated. Canonical install: curl -fsSL https://get.automagik.dev/genie | bash (cosign + SLSA verified). See https://automagik.dev/genie/security/distribution-sovereignty for the threat model and verification flow."
+      # The post-publish `npm deprecate` step lived here through
+      # 4.260428.8 and was retired on 2026-04-28 — it depended on a
+      # classic NPM_TOKEN secret (OIDC trusted-publisher tokens are
+      # publish-only, can't deprecate), and even with valid auth it
+      # raced the registry's <1s post-publish indexing window. Both
+      # failure modes are documented at:
+      #   automagik.dev/genie/security/distribution-sovereignty
+      #
+      # The npm soft-deprecation message moves to the postinstall
+      # shim per the umbrella sovereignty plan: every install via
+      # npm prints the canonical-install redirect at install time,
+      # which is closer to the user (lives in the package, not the
+      # registry config) and works without long-lived secrets.
+      #
+      # NPM_TOKEN secret is no longer used anywhere in this repo.
+      # Safe to delete from automagik-dev/genie repo + org settings.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/genie",
-  "version": "4.260428.3",
+  "version": "4.260428.10",
   "description": "Collaborative terminal toolkit for human + AI workflows. NOTE: the npm distribution is being soft-deprecated — the canonical install is `curl -fsSL https://get.automagik.dev/genie | bash` (cosign + SLSA verified). See https://automagik.dev/genie/security/distribution-sovereignty",
   "type": "module",
   "bin": {

plugins/genie/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "genie",
-  "version": "4.260428.3",
+  "version": "4.260428.10",
   "description": "Human-AI partnership for Claude Code. Share a terminal, orchestrate workers, evolve together. Brainstorm ideas, turn them into wishes, execute with /work, validate with /review, and ship as one team.",
   "author": {
     "name": "Namastex Labs"

plugins/genie/package.json

@@ -1,6 +1,6 @@
 {
   "name": "genie-plugin",
-  "version": "4.260428.3",
+  "version": "4.260428.10",
   "private": true,
   "description": "Runtime dependencies for genie bundled CLIs",
   "type": "module",

src/db/migrations/054_mailbox_source_meta.sql

@@ -0,0 +1,28 @@
+-- 054_mailbox_source_meta.sql
+--
+-- Foundation for the channel-shaped envelope (PR A in the channels-pivot
+-- roadmap). The mailbox row gains two optional, idempotent columns so the
+-- delivery layer can carry source attribution and arbitrary metadata
+-- (whatsapp phone, telegram chat id, system nudge kind, …) end-to-end:
+--
+--   - `source TEXT NOT NULL DEFAULT 'agent'` — origin of the message. The
+--     default keeps every pre-existing row (and every legacy `mailbox.send`
+--     caller that doesn't pass an opts arg) reading as `'agent'`, which is
+--     the back-compat behaviour the renderer expects (plain body, no
+--     `<channel …>` wrap).
+--   - `meta JSONB NOT NULL DEFAULT '{}'::jsonb` — free-form k/v map.
+--     Persisted verbatim and re-hydrated by the inbox/outbox readers so
+--     channel-aware UIs round-trip the data.
+--
+-- Indexes are deliberately omitted — every existing inbox/outbox query
+-- already filters on `to_worker` / `from_worker`, so no extra index is
+-- needed for the foundation. PR C+ may add a `(to_worker, source)` index
+-- once it's clear which sources warrant their own hot path.
+--
+-- Re-runnable: both ALTER COLUMN clauses use `IF NOT EXISTS`.
+
+ALTER TABLE mailbox
+  ADD COLUMN IF NOT EXISTS source TEXT NOT NULL DEFAULT 'agent';
+
+ALTER TABLE mailbox
+  ADD COLUMN IF NOT EXISTS meta JSONB NOT NULL DEFAULT '{}'::jsonb;

src/db/migrations/055_runtime_events_partition_drain.sql

@@ -0,0 +1,138 @@
+-- 055_runtime_events_partition_drain.sql
+-- Bug: genie_runtime_events_maintain_partitions never drained the DEFAULT
+-- partition. Rows that landed in genie_runtime_events_default (e.g. inserts
+-- after UTC midnight before the next maintenance call ran) permanently
+-- blocked creation of new dated partitions, because PG validates that no
+-- existing default-partition row would belong to the new partition. Symptom:
+-- SQLSTATE 23514 "updated partition constraint for default partition
+-- genie_runtime_events_default would be violated by some row" on every
+-- subsequent `genie serve start`. Migration 038's docstring claimed the
+-- nightly scheduler converted DEFAULT rows into named partitions; no such
+-- code ever existed.
+--
+-- Fix:
+--   1. New helper genie_runtime_events_drain_default() detaches DEFAULT,
+--      ensures dated partitions exist for every day represented by its rows,
+--      re-inserts the rows (parent-routing them to the correct dated
+--      partition) with notify-trigger suppression, truncates the now-empty
+--      detached default, and re-attaches it as DEFAULT.
+--   2. genie_runtime_events_maintain_partitions calls drain_default() before
+--      creating today..today+forward_days, so a stuck DEFAULT can no longer
+--      poison subsequent partition creation.
+--   3. One-shot drain at migration time so existing installs unstick on the
+--      first post-upgrade `genie serve start`.
+
+CREATE OR REPLACE FUNCTION genie_runtime_events_drain_default()
+RETURNS INTEGER AS $$
+DECLARE
+  drained   INTEGER := 0;
+  d_rec     RECORD;
+  prev_role TEXT;
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+      FROM pg_class c
+      JOIN pg_namespace n ON n.oid = c.relnamespace
+     WHERE c.relname = 'genie_runtime_events_default'
+       AND n.nspname = current_schema()
+  ) THEN
+    RETURN 0;
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM genie_runtime_events_default LIMIT 1) THEN
+    RETURN 0;
+  END IF;
+
+  -- Detach so the re-insert below routes to dated partitions instead of
+  -- looping back into DEFAULT. Non-CONCURRENTLY form is transaction-safe.
+  EXECUTE 'ALTER TABLE genie_runtime_events DETACH PARTITION genie_runtime_events_default';
+
+  -- Ensure a dated partition exists for every day represented in the
+  -- detached default. create_partition is CREATE TABLE IF NOT EXISTS, so
+  -- pre-existing partitions are fine.
+  FOR d_rec IN
+    SELECT DISTINCT date_trunc('day', created_at)::DATE AS d
+      FROM genie_runtime_events_default
+  LOOP
+    PERFORM genie_runtime_events_create_partition(d_rec.d);
+  END LOOP;
+
+  -- Suppress AFTER INSERT triggers (notify_runtime_event_split, audit chain
+  -- triggers, etc.) for the drain. These rows already fired their notifies
+  -- on their original insert; re-firing would broadcast duplicates to every
+  -- LISTEN'er.
+  prev_role := current_setting('session_replication_role');
+  PERFORM set_config('session_replication_role', 'replica', true);
+
+  EXECUTE $sql$
+    INSERT INTO genie_runtime_events (
+      id, repo_path, subject, kind, source, agent, team, direction, peer,
+      text, data, thread_id, trace_id, parent_event_id, span_id, parent_span_id,
+      severity, schema_version, duration_ms, dedup_key, source_subsystem, created_at
+    )
+    OVERRIDING SYSTEM VALUE
+    SELECT id, repo_path, subject, kind, source, agent, team, direction, peer,
+           text, data, thread_id, trace_id, parent_event_id, span_id, parent_span_id,
+           severity, schema_version, duration_ms, dedup_key, source_subsystem, created_at
+      FROM genie_runtime_events_default
+  $sql$;
+
+  GET DIAGNOSTICS drained = ROW_COUNT;
+
+  PERFORM set_config('session_replication_role', prev_role, true);
+
+  EXECUTE 'TRUNCATE genie_runtime_events_default';
+  EXECUTE 'ALTER TABLE genie_runtime_events ATTACH PARTITION genie_runtime_events_default DEFAULT';
+
+  RETURN drained;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE OR REPLACE FUNCTION genie_runtime_events_maintain_partitions(
+  forward_days   INTEGER DEFAULT 2,
+  retention_days INTEGER DEFAULT 30
+)
+RETURNS JSONB AS $$
+DECLARE
+  drained INTEGER;
+  created INTEGER := 0;
+  dropped INTEGER := 0;
+  i       INTEGER;
+BEGIN
+  -- Drain DEFAULT first so any rows that accumulated there (UTC-midnight
+  -- rollover between maintenance calls) get routed to their proper dated
+  -- partitions before we try to CREATE the new ones.
+  drained := genie_runtime_events_drain_default();
+
+  FOR i IN 0..forward_days LOOP
+    PERFORM genie_runtime_events_create_partition((CURRENT_DATE + i)::DATE);
+    created := created + 1;
+  END LOOP;
+  SELECT genie_runtime_events_drop_old_partitions(retention_days) INTO dropped;
+  RETURN jsonb_build_object(
+    'created_or_present',  created,
+    'dropped',             dropped,
+    'drained_from_default', drained,
+    'next_rotation_at',    (CURRENT_DATE + 1)::TIMESTAMPTZ
+  );
+END;
+$$ LANGUAGE plpgsql;
+
+-- Mirror the role grants from migration 041 for the new helper. Conditional
+-- so this works on installs that ran 041 before events_admin existed.
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'events_admin') THEN
+    EXECUTE 'GRANT EXECUTE ON FUNCTION genie_runtime_events_drain_default() TO events_admin';
+  END IF;
+END$$;
+
+DO $$
+DECLARE
+  drained INTEGER;
+BEGIN
+  drained := genie_runtime_events_drain_default();
+  IF drained > 0 THEN
+    RAISE NOTICE 'genie_runtime_events_default: drained % stuck row(s) into dated partitions', drained;
+  END IF;
+END$$;

src/db/migrations/observability-migrations.test.ts

@@ -196,6 +196,53 @@ describe.skipIf(!DB_AVAILABLE)('Group 1 observability migrations', () => {
     expect(deleteErr?.message).toMatch(/append-only/);
   });
 
+  test('maintain_partitions drains rows stuck in DEFAULT (regression: SQLSTATE 23514)', async () => {
+    const sql = await getConnection();
+
+    // Pick a far-future date that no rolling-window partition covers.
+    // create_partition uses session-TZ midnight, so the date string suffices.
+    const stuckDate = '2099-12-31';
+
+    // Pre-clean any leftovers from a previous test run.
+    await sql`DELETE FROM genie_runtime_events WHERE kind = 'partition.drain.test'`;
+
+    // Insert a row whose created_at falls outside every dated partition. It
+    // must route to genie_runtime_events_default.
+    await sql`
+      INSERT INTO genie_runtime_events (repo_path, kind, source, agent, text, created_at)
+      VALUES ('test', 'partition.drain.test', 'test', 'test', 'stuck', ${`${stuckDate} 12:00:00+00`}::TIMESTAMPTZ)
+    `;
+
+    const beforeDefault = await sql<{ n: number }[]>`
+      SELECT count(*)::INT AS n FROM genie_runtime_events_default
+       WHERE kind = 'partition.drain.test'
+    `;
+    expect(beforeDefault[0].n).toBe(1);
+
+    const result = await sql<
+      Array<{ r: { created_or_present: number; drained_from_default: number } }>
+    >`SELECT genie_runtime_events_maintain_partitions(2, 30)::jsonb AS r`;
+    expect(result[0].r.drained_from_default).toBeGreaterThanOrEqual(1);
+
+    const afterDefault = await sql<{ n: number }[]>`
+      SELECT count(*)::INT AS n FROM genie_runtime_events_default
+       WHERE kind = 'partition.drain.test'
+    `;
+    expect(afterDefault[0].n).toBe(0);
+
+    const inDated = await sql<{ relname: string }[]>`
+      SELECT tableoid::regclass::TEXT AS relname
+        FROM genie_runtime_events
+       WHERE kind = 'partition.drain.test'
+    `;
+    expect(inDated.length).toBe(1);
+    expect(inDated[0].relname).toMatch(/genie_runtime_events_p20991231$/);
+
+    // Cleanup so the dated partition created above doesn't haunt the rolling
+    // window or the retention sweep on subsequent runs.
+    await sql`DELETE FROM genie_runtime_events WHERE kind = 'partition.drain.test'`;
+  });
+
   test('Group 1 migrations are idempotent on re-apply', async () => {
     // Re-run each migration body against the already-migrated schema and
     // confirm the guarded statements are all no-ops.