fix(classifier): drop --bare, gate hook recursion via TJ_IN_CLASSIFIER (v0.2.9)

claude --bare ignores ~/.claude/.credentials.json and demands
ANTHROPIC_API_KEY. Subscription-auth users (Pro/Max — most of the
audience) hit "Not logged in" on every classification, so the
journal stayed empty in production. claude-memory-0kk.

We previously needed --bare to stop the classifier path from
spawning a `claude -p` that re-reads settings.json and re-fires our
hooks recursively. Replace that mechanism with an explicit sentinel
env var:

- ClaudeCliClassifier.classify() drops --bare from argv and sets
  TJ_IN_CLASSIFIER=1 on the spawned process.
- IngestHook handler returns Ok(()) immediately when it sees
  TJ_IN_CLASSIFIER in env. Recursion broken without touching auth.

One regression test (ingest_hook_short_circuits_when_in_classifier_
env_set) plus the existing 40 ingest-hook tests stay green.

Trade-off: without --bare the inner claude loads CLAUDE.md / skills
on the first call per 5-minute prompt-cache window (one-time ~60K
cache_creation tokens; subsequent calls hit cache and stay cheap).
The classifier prompt explicitly demands JSON-only output, so model
compliance survives the larger system prompt.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Shahinyanm

.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Task Journal — append-only reasoning chain memory for AI-coding tasks",
-    "version": "0.2.8"
+    "version": "0.2.9"
   },
   "plugins": [
     {
       "name": "task-journal",
       "source": "./plugin",
       "description": "Append-only journal of AI-coding task reasoning chains. Captures hypotheses, decisions, rejections, evidence — renders compact resume packs so an agent can pick up a 2-week-old task with full context.",
-      "version": "0.2.8",
+      "version": "0.2.9",
       "author": {
         "name": "Digital-Threads"
       },

CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.9] - 2026-05-07
+
+Critical fix: classifier path now works for users on Claude Pro/Max
+subscription (the majority of Claude Code users). v0.2.8 still
+shipped `--bare` to the inner `claude -p` invocation; that flag
+silently bypasses `~/.claude/.credentials.json` and demands
+`ANTHROPIC_API_KEY`. With only a subscription, every classification
+returned "Not logged in".
+
+### Fixed
+- `ClaudeCliClassifier` no longer passes `--bare`. Hook recursion
+  (the original reason for `--bare`) is now broken via an explicit
+  env-var sentinel: the classifier sets `TJ_IN_CLASSIFIER=1` on the
+  child process, and `ingest-hook` returns immediately when it sees
+  that env. One regression test (`ingest_hook_short_circuits_when_in_
+  classifier_env_set`) covers the guard. Closes claude-memory-0kk.
+
+### Notes
+- Without `--bare`, the inner `claude -p` loads the user's
+  `CLAUDE.md`, skills, and hooks. That increases the prompt-cache
+  cost the first time per 5-minute window. The classifier prompt is
+  explicit about the JSON-only output contract, so model compliance
+  is preserved; subsequent calls within the cache TTL hit the
+  prompt cache and stay cheap.
+
 ## [0.2.8] - 2026-05-07
 
 Critical fix: hooks now actually carry content end-to-end. Without

Cargo.lock

@@ -7,7 +7,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.2.8"
+version = "0.2.9"
 edition = "2021"
 rust-version = "1.88"
 license = "MIT"

Cargo.toml

@@ -16,7 +16,7 @@ name = "task-journal"
 path = "src/main.rs"
 
 [dependencies]
-tj-core = { package = "task-journal-core", version = "0.2.8", path = "../tj-core" }
+tj-core = { package = "task-journal-core", version = "0.2.9", path = "../tj-core" }
 anyhow = { workspace = true }
 clap = { workspace = true }
 tracing = { workspace = true }

crates/tj-cli/Cargo.toml

@@ -1186,6 +1186,19 @@ fn main() -> Result<()> {
             mock_task_id,
             mock_confidence,
         } => {
+            // Recursion guard. The classifier spawns `claude -p` to do
+            // the actual work; that nested claude invocation re-reads
+            // ~/.claude/settings.json and would re-fire our hooks,
+            // recursively calling ingest-hook → classifier → claude → …
+            // Until v0.2.8 we relied on `--bare` to suppress the hooks
+            // on the inner invocation, but --bare doesn't work with
+            // subscription auth (claude-memory-0kk), so the classifier
+            // now sets TJ_IN_CLASSIFIER=1 in the child env and we bail
+            // here when we see it.
+            if std::env::var("TJ_IN_CLASSIFIER").is_ok() {
+                return Ok(());
+            }
+
             // Resolve (kind, text) source: explicit args win; otherwise
             // read the Claude Code hook payload from stdin. The earlier
             // settings.json template interpolated `$CLAUDE_HOOK_NAME` /

crates/tj-cli/src/main.rs

@@ -1236,6 +1236,67 @@ fn ingest_hook_session_start_with_no_open_tasks_emits_no_context() {
     );
 }
 
+#[test]
+fn ingest_hook_short_circuits_when_in_classifier_env_set() {
+    // Recursion guard: classifier sets TJ_IN_CLASSIFIER=1 before
+    // spawning claude. The nested claude re-fires our hooks; without
+    // this guard, ingest-hook would re-enter the classifier path
+    // ad infinitum. With the guard, it returns silently and no event
+    // is written.
+    let dir = assert_fs::TempDir::new().unwrap();
+    let task_id = String::from_utf8(
+        Command::cargo_bin("task-journal")
+            .unwrap()
+            .env("XDG_DATA_HOME", dir.path())
+            .args(["create", "Recursion guard host"])
+            .assert()
+            .success()
+            .get_output()
+            .stdout
+            .clone(),
+    )
+    .unwrap()
+    .trim()
+    .to_string();
+
+    Command::cargo_bin("task-journal")
+        .unwrap()
+        .env("XDG_DATA_HOME", dir.path())
+        .env("TJ_IN_CLASSIFIER", "1")
+        .args([
+            "ingest-hook",
+            "--kind",
+            "UserPromptSubmit",
+            "--text",
+            "should not be ingested",
+            "--mock-event-type",
+            "decision",
+            "--mock-task-id",
+            &task_id,
+            "--mock-confidence",
+            "0.99",
+        ])
+        .assert()
+        .success();
+
+    // The pack must NOT contain the hook text — guard kicked in
+    // before the mock branch could write.
+    let out = Command::cargo_bin("task-journal")
+        .unwrap()
+        .env("XDG_DATA_HOME", dir.path())
+        .args(["pack", &task_id, "--mode", "full"])
+        .assert()
+        .success()
+        .get_output()
+        .stdout
+        .clone();
+    let body = String::from_utf8(out).unwrap();
+    assert!(
+        !body.contains("should not be ingested"),
+        "TJ_IN_CLASSIFIER must short-circuit before any write: {body}"
+    );
+}
+
 #[test]
 fn ingest_hook_reads_user_prompt_submit_payload_from_stdin() {
     // Real Claude Code passes hook input as JSON over stdin, NOT via env

crates/tj-cli/tests/cli.rs

@@ -57,6 +57,13 @@ impl Classifier for ClaudeCliClassifier {
             .ok_or_else(|| anyhow!("TJ_CLASSIFIER_CLI is empty"))?;
         let base_args: Vec<&str> = parts.collect();
 
+        // `--bare` would skip hooks/CLAUDE.md/skills (cheap + non-recursive),
+        // but it ALSO bypasses the subscription credentials file and only
+        // works with ANTHROPIC_API_KEY — see claude-memory-0kk. Most users
+        // pay through Claude Pro/Max, so we drop --bare and gate recursion
+        // explicitly with the TJ_IN_CLASSIFIER env var: ingest-hook checks
+        // it on entry and short-circuits, breaking the loop without
+        // touching auth.
         let output = std::process::Command::new(program)
             .args(&base_args)
             .args([
@@ -65,9 +72,9 @@ impl Classifier for ClaudeCliClassifier {
                 &self.model,
                 "--output-format",
                 "json",
-                "--bare", // skip hooks/skills/CLAUDE.md to avoid recursion + speed up
                 &prompt,
             ])
+            .env("TJ_IN_CLASSIFIER", "1")
             .output()
             .with_context(|| format!("spawn `{}` for classification", self.command))?;
 

crates/tj-core/src/classifier/cli.rs

@@ -16,7 +16,7 @@ name = "task-journal-mcp"
 path = "src/main.rs"
 
 [dependencies]
-tj-core = { package = "task-journal-core", version = "0.2.8", path = "../tj-core" }
+tj-core = { package = "task-journal-core", version = "0.2.9", path = "../tj-core" }
 anyhow = { workspace = true }
 tokio = { workspace = true }
 tracing = { workspace = true }

crates/tj-mcp/Cargo.toml

@@ -1,6 +1,6 @@
 {
   "name": "task-journal",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "Append-only journal of AI-coding task reasoning chains: hypotheses, decisions, rejections, evidence. Renders compact resume packs so an agent can pick up a 2-week-old task with full context.",
   "author": {
     "name": "Mher Shahinyan"