fix(#722,#724,#726): escape placeholder tokens, sandbox the nested summarizer, stop trusting a repo-local haiku config - #732

…he nested summarizer, and stop trusting a cloned repo's own haiku config

- #722: substituted values in the save/NDC/consolidation prompts are now
  escaped so a literal {{TIME}}/{{BRANCH}}/{{LAST_ENTRY}}/{{EXTRACT}} token
  reaching the pipeline via transcript content cannot be mistaken by
  save-session.sh's placeholder guard for a genuinely unsubstituted
  placeholder and permanently stall memory capture for that session.

- #724: every built-in Claude Code tool is now explicitly disallowed
  unless requested (--allowedTools "" alone left approval-free tools like
  Read/Glob/Grep/Task still callable), both summarizer routes spawn in a
  fresh, empty directory instead of the shared system tempdir, and the
  Codex route's child environment is now an allow-list of only what the
  CLI needs rather than the full parent environment minus a deny-list.

- #726: a cloned repository's own .remember/config.json can no longer
  choose the nested summarizer's credential or force ANTHROPIC_API_KEY to
  be stripped -- the per-project haiku config block is no longer merged in
  at all when REMEMBER_DIR sits inside the project checkout, at both the
  shell merge layer and the Python fallback-candidate layer.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

…gnostics

PR #732's CI was red on 4 legs (pytest ubuntu-latest 3.9-3.12), both
failures caused by #726's fix to scripts/lib-memory-dir.sh changing the
file's code shape without updating the two tests that pin it exactly.

- tests/test_case_divergence_298.py: `_SANCTIONED_DIVERGENCE` for
  scripts/lib-memory-dir.sh did not register #726's new
  `_classify_project_cfg_haiku_trust` function or the changed jq/Python
  merge programs -- the byte-pin guard compared this branch against
  origin/main and failed on every diverging line. Four new sanctioned
  substitution pairs cover the insertion and both merge-path changes,
  each verified (in isolation, before this commit) to reproduce this
  branch's file exactly when applied to origin/main's.
- tests/test_git_restore_no_resource_when_disabled_663.py: the positive
  control asserted the literal substring "jq -s reduce", which #726
  split by inserting `--argjson strip_last_haiku ...` between `-s` and
  the program text. Replaced with two substrings either side of the new
  flag, so the assertion still proves the full merge chain ran rather
  than being skipped.
- tests/test_config_flatten_cache_668.py:149 carried the same stale
  "jq -s reduce ..." string in a comment only (never asserted) --
  updated for accuracy while in the file.

Reproduced both failures locally first (red), then green after each
fix; ran all four touched test files together afterward (47 passed).
Narrowed to these files per this repo's own guard-lookup -- no
cross-cutting guard test matches (edited test files, not the guarded
source). No changelog fragment needed: #722/#724/#726 already have one
describing the shipped behavior; this is a CI-only test-pin fix with
no behavior change. `.oss/assemble_changelog.py --check` still passes.

Co-Authored-By: Max <noreply>

… a macOS-only spawn-budget CI failure

PR #732's own follow-up self-review (a separate maintainer session) found
CI red on all 3 macos-latest legs (py 3.9/3.10/3.11), all 12 other legs
green, on tests/test_post_tool_hook_spawns.py::
test_the_post_tool_hook_stays_inside_its_spawn_budget (observed 20 spawns
against POST_TOOL_SPAWN_BUDGET=19). The maintainer's own local macOS run
could not reproduce it (cold=20, warm=16, under budget) and traced the gap
to `date` calls without being able to isolate it further, since their
local `bash` resolves to a homebrew/GNU build rather than the CI runner's
stock /bin/bash 3.2.

Reproduced locally by prefixing PATH with `/bin` so the test's `bash`
resolves to this machine's own stock 3.2.57 (same binary family as the
macOS CI runner), confirming the exact failure (20 <= 19 assertion, same
20-line spawn dump CI reported). A/B-swapped scripts/lib-memory-dir.sh
in place between this branch's content and `git show origin/main:...`
under that same PATH (restoring and verifying `git status` clean
before/after each swap) to isolate the cause: origin/main's version
measures 16 (comfortably under budget); this branch's #726 change alone
pushes it to 20, a delta of exactly +4.

Root cause: not an extra process. #726 wrote the jq merge filter as a
multi-line quoted string. The spawn-counting shim
(tests/spawn_counting.py) logs each process as `printf "%s %s\n" "$name"
"$*"`, and the filter's own embedded newlines reach that log line
verbatim -- one jq process now writes 5 physical log lines instead of 1
(the miscount tests/spawn_counting.py's `spawns()` makes by splitting on
newlines), a phantom +4 with no real spawn behind it. jq is
whitespace-insensitive, so collapsing the filter to a single line is a
pure counting fix: verified the collapsed filter produces byte-identical
output on a hand-built fixture (haiku key still stripped from the last
source, other keys still merged).

Updated the byte-pin guard's sanctioned-divergence tuple for this hunk
(tests/test_case_divergence_298.py) to match the new one-line jq text,
since the guard pins scripts/lib-memory-dir.sh byte-for-byte against
origin/main.

Verified green under stock bash 3.2 (PATH-prefixed /bin): the full
spawn-budget test class this repo carries (tests/test_post_tool_hook_spawns.py,
test_post_tool_fast_path_350.py, and 14 other files matching
`grep -l spawn_counting`) -- 147 passed, 11 pre-existing loud skips
(bash-version-floor guards unrelated to this change), 0 failures. Also
re-ran tests/test_untrusted_project_haiku_config_726.py (13 passed) and
the four files from the previous commit on this branch (60 passed) to
confirm #726's actual behavior is unchanged.

Logged the investigation as trap.d/732.jq-multiline-filter-inflates-spawn-count.md
-- a reusable lesson (a multi-line quoted filter/heredoc argument silently
inflates every spawn-count test that logs via newline-split "$*", with no
functional change and no signal at write time) for `/oss:curate` to weigh
against a jit-context rule later.

Co-Authored-By: Max <noreply>