fix(continual-learning): write memory to AGENTS.local.md in team repos

[Liqiuyue9597]

Summary

Make continual-learning safe to enable in team repositories.

The marketplace plugin currently writes learned bullets into the workspace AGENTS.md and keeps cadence/index under .cursor/hooks/state/. On a shared repo those paths are owned by every contributor, so personal preferences end up in the team's instructions and the state files show up in git status.

This PR changes the defaults to user-scoped locations under ~/.cursor/projects/<workspace-slug>/ (the same layout Cursor already uses for agent-transcripts/). Writes inside the repo stay strictly opt-in.

Related: #74. Same default memory path, with three differences intended as follow-ups to that PR:

• Keep existing headings (## Learned User Preferences / ## Learned Workspace Facts). Do not rename facts to (local), which would miss existing AGENTS.local.md files.
• Copy legacy .cursor/hooks/state/* into the user-scoped dir; do not delete originals when they are git-tracked.
• Add a preToolUse deny hook so Learned-section edits to tracked AGENTS.md / CLAUDE.md / GEMINI.md are blocked even if the updater ignores the prompt. The hook allows the write when CONTINUAL_LEARNING_WORKSPACE_FILE is set and the path is gitignored, or CONTINUAL_LEARNING_ALLOW_SHARED=1.

What changes

• Default memory file: ~/.cursor/projects/<slug>/AGENTS.local.md
• Default state dir: ~/.cursor/projects/<slug>/continual-learning/ (cadence.json, index.json)
• Stop hook embeds resolved absolute paths in followup_message and tells the updater not to write the repo AGENTS.md
• Opt-in shared file via CONTINUAL_LEARNING_WORKSPACE_FILE, refused when the path is tracked and not gitignored unless CONTINUAL_LEARNING_ALLOW_SHARED=1
• preToolUse deny for Learned-section writes to tracked agent files, with the same allow exception

Backwards compatibility

• Default memory path changes from workspace AGENTS.md to the user-scoped file. Restore the old behavior with CONTINUAL_LEARNING_WORKSPACE_FILE=<abs path to AGENTS.md> and CONTINUAL_LEARNING_ALLOW_SHARED=1.
• Existing cadence env vars and CONTINUOUS_LEARNING_* aliases are unchanged.
• Existing heading names are unchanged.

Test plan

• bun build --target bun continual-learning/hooks/continual-learning-stop.ts bundles
• Deny hook blocks Learned writes to repo AGENTS.md by default
• Deny hook allows the write when CONTINUAL_LEARNING_WORKSPACE_FILE matches and CONTINUAL_LEARNING_ALLOW_SHARED=1
• Deny hook still blocks when ALLOW_SHARED is set but the path is a different file

---

Note

Medium Risk
Default memory and state locations change behavior for existing installs; the preToolUse deny hook alters what agents can write in team agent files, though shared writes remain explicitly opt-in.

Overview
Continual-learning v1.1.0 stops writing learned bullets into the repo by default and routes personal memory to ~/.cursor/projects/<slug>/AGENTS.local.md, with cadence/index under ~/.cursor/projects/<slug>/continual-learning/.

The stop hook now resolves targets via memory-targets.ts, migrates legacy .cursor/hooks/state/* into the user dir (copies tracked files without deleting them), and emits a followup that embeds absolute paths and forbids repo AGENTS.md unless an allowed shared workspace file is configured (CONTINUAL_LEARNING_WORKSPACE_FILE + gitignore or CONTINUAL_LEARNING_ALLOW_SHARED=1).

A new preToolUse hook (block-repo-agents-md.mjs) denies Write/StrReplace that add ## Learned * sections to tracked AGENTS.md / CLAUDE.md / GEMINI.md, with the same opt-in exception. Agent/skill docs and README describe the new env knobs and migration path to restore old shared-file behavior.

^{Reviewed by Cursor Bugbot for commit 341d9e9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[Liqiuyue9597]

Thanks — all four review findings are addressed in a43311e.

• Repo-write block misses relative paths (high): isInsideGitWorkTree now runs dirname(resolve(filePath)), so a workspace-relative AGENTS.md resolves to its directory instead of being handed to git -C as a file. Verified that both continual-learning/AGENTS.md and its absolute form are denied.
• Followup blocks opted-in workspace file (medium): the followup now branches. With no allowed workspace file it still says "user memory file only"; with an opted-in, non-blocked file it routes team-shareable workspace facts there and keeps everything else in the user file.
• Marketplace listing copy diverges (medium): the plugin-local marketplace.json was dropped (it was only needed to install the branch locally), and the root marketplace entry now describes the user-scoped AGENTS.local.md target.
• Helper takes interchangeable string arguments (low): isPathTeamShared, isGitTracked, and isGitIgnored take named arguments.

Hook behavior checked manually: deny for relative and absolute repo AGENTS.md; allow when CONTINUAL_LEARNING_WORKSPACE_FILE matches and CONTINUAL_LEARNING_ALLOW_SHARED=1; still deny when ALLOW_SHARED is set but the path is a different file; pass-through for AGENTS.local.md and for edits with no Learned section. bun build --target bun on the stop hook succeeds.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit a43311e. Configure here.}

[Liqiuyue9597]

The remaining listing-copy mismatch is fixed in 341d9e9: the root marketplace continual-learning description now matches continual-learning/.cursor-plugin/plugin.json verbatim.