fix: follow-ups to #152 — session learner on macOS, Sonnet 5 price, release npm check

[CodeWithJuber]

Summary

Follow-ups found while verifying #152, which was merged (at f64c540) before these commits arrived. One commit per fix:

• Session learner on macOS (b78b55e). global/guards/session-learner.sh ran timeout 90 claude -p. Stock macOS has no timeout, so the opt-in learner silently never recorded a lesson on a Mac; the error only reached .learn.log.

  • A shared forge_timeout in _guardlib.sh runs timeout, else gtimeout, else a bash watchdog.
  • The watchdog keeps stdin and the exit status. Its output goes to /dev/null, so a caller's $(…) never waits on it.
  • It also keeps the 90 s cap that the learner's lock reclaim relies on.
  • learn-consolidate.sh --llm, which 1.1.0 fixed by running without a limit, now uses the same helper and keeps its 180 s cap.

• Windows home folder (339a869). learnedDir() follows HOME, which is where the bash learner writes.

  • Node's homedir() reads USERPROFILE on Windows, so a differing Git Bash HOME sent the consolidator to another folder.
  • The hermetic test now accepts HOME/USERPROFILE while test/_setup.js points them at its sandbox, and still fails if either holds the real home.

• Sonnet 5 price (154246e). src/model_tiers.json scheduled $2/$10 → $3/$15 on 2026-09-01. Anthropic cancelled that increase.

  • The pricing page, checked 2026-09-22, lists $2/$10 as the standard price.
  • Since 2026-09-01 forge priced Sonnet 5 50% high. The cost report reads the flat price, so it always had.
  • Now a flat $2/$10, with pricingVerified 2026-09-22 (all four tier prices re-checked). The universal router registry matches.

• Release post-publish check (c5227db). v1.0.0 and v1.1.0 both shipped but their release jobs went red. The check gave npm 60 s:

  Release	Publish finished	Check gave up	Packument Last-Modified
  v1.0.0	02:17:23	02:18:27	02:20:02 (+159 s)
  v1.1.0	13:12:17	13:13:23	13:16:29 (+252 s)

  The registry also sends Cache-Control: max-age=300, so a retry could re-read the copy cached by the pre-publish npm view. The check now tries 40 × 15 s (10 minutes) with --prefer-online.

Verification

Run locally on Windows (Node 24), on this branch's tree (d9cab12):

Check	Result
npm test	1,389 tests: 1,381 pass, 0 fail, 8 skipped
npm run lint	0 errors, 14 warnings (same as master)
npm run typecheck	0 errors
forge docs check	passes
release verify step	bash -n passes; npm view … --prefer-online returns the published version

Why 8 tests skip here:

• 6 are Windows-only guards, including the two new no-timeout tests. They build a symlinked PATH, which needs elevation on Windows, and Git Bash ships timeout anyway.
• 2 need opt-in settings.
• The two new tests run on the Linux and macOS jobs, where the symlinked PATH reproduces stock macOS.

Checked by hand in Git Bash, with a PATH holding no timeout/gtimeout:

• Unfixed hook: logs timeout: command not found and never calls the stub claude.
• Fixed hook: calls the stub once and appends its lesson.
• forge_timeout:
  • stdin passes through;
  • exit status 3 is kept;
  • a 6 s job is killed at 1 s;
  • $(…) returns in 0 s despite a 20 s watchdog.

Not in this PR

• Tier-table update. claude-opus-4-8 and claude-fable-5 are valid ids but listed as legacy; claude-opus-5 and claude-fable-5-1 are current, at the same prices. Moving the tier table onto them is a product decision.
• v1.1.0's red release job. It is a false alarm: npm serves 1.1.0 and the GitHub Release exists. Re-running the job goes green, because each step is idempotent.

🤖 Generated with Claude Code