fix: bash heredoc + python triple-quote interpolation crashes

surrogate-dev-loop.sh + surrogate-daemon.sh used '''\$VAR''' which broke when
$VAR contained quotes (e.g. error msgs like [err] 'choices'). Replaced with
env-var passing + sys.argv. This was the root cause of the cron 'unterminated
string literal' errors blocking the dev-loop and daemon chains.

bin/surrogate-daemon.sh

@@ -33,13 +33,20 @@ case "$CMD" in
         shift
         TASK="$*"
         [[ -z "$TASK" ]] && { echo "need task"; exit 2; }
-        python3 -c "
-import json, uuid
+        ENQUEUE_TASK="$TASK" /usr/bin/python3 - "$QUEUE" <<'PYEOF'
+import json, uuid, os, sys
 from datetime import datetime
-task = {'id': uuid.uuid4().hex[:12], 'ts': datetime.utcnow().isoformat(), 'task': '''$TASK''', 'status': 'pending', 'priority': 'P0-user'}
-open('$QUEUE','a').write(json.dumps(task, ensure_ascii=False) + '\n')
-print(f\"enqueued: {task['id']} {task['task'][:60]}\")
-"
+queue_path = sys.argv[1]
+task = {
+    'id': uuid.uuid4().hex[:12],
+    'ts': datetime.utcnow().isoformat(),
+    'task': os.environ.get('ENQUEUE_TASK', ''),
+    'status': 'pending',
+    'priority': 'P0-user',
+}
+open(queue_path, 'a').write(json.dumps(task, ensure_ascii=False) + '\n')
+print(f"enqueued: {task['id']} {task['task'][:60]}")
+PYEOF
         exit 0
         ;;
     plan)
@@ -152,7 +159,7 @@ print(f\"enqueued: {task['id']} {task['task'][:60]}\")
     _worker)
         # ── Pop one task from queue (P0-user first, then plan, then self-gen) ──────
         _pop_queue() {
-            python3 <<PYEOF
+            /usr/bin/python3 <<PYEOF
 import json, os, sys, fcntl
 from pathlib import Path
 q = Path(os.path.expanduser('$QUEUE'))
@@ -181,7 +188,7 @@ PYEOF
 
         # ── Pop next task from active plan (no sleep needed — plan drives work) ──
         _pop_plan() {
-            python3 <<'PYEOF'
+            /usr/bin/python3 <<'PYEOF'
 import sys, json, os, re, uuid
 from pathlib import Path
 from datetime import datetime
@@ -216,7 +223,7 @@ PYEOF
 
         # ── Self-generate task from pool (fallback when no plan + queue empty) ──
         _self_gen() {
-            AUTO_TASK=$(python3 <<'PYEOF'
+            AUTO_TASK=$(/usr/bin/python3 <<'PYEOF'
 import json, os, random
 from pathlib import Path
 ep = Path(os.path.expanduser('~/.claude/state/surrogate-memory/episodes.jsonl'))
@@ -271,7 +278,7 @@ for t in random.sample(pool, len(pool)):
 print(chosen or pool[0])
 PYEOF
 )
-            echo "{\"id\":\"auto-$(python3 -c 'import uuid; print(uuid.uuid4().hex[:8])')\",\"task\":\"$AUTO_TASK\",\"self_generated\":true,\"source\":\"self-gen\"}"
+            echo "{\"id\":\"auto-$(/usr/bin/python3 -c 'import uuid; print(uuid.uuid4().hex[:8])')\",\"task\":\"$AUTO_TASK\",\"self_generated\":true,\"source\":\"self-gen\"}"
         }
 
         # ── Task resolution: queue → plan → self-gen (no 60s sleep) ─────────────
@@ -290,9 +297,9 @@ PYEOF
         fi
 
         # Extract task
-        TASK=$(echo "$TASK_JSON" | python3 -c "import json,sys; print(json.loads(sys.stdin.read())['task'])")
-        TID=$(echo "$TASK_JSON" | python3 -c "import json,sys; print(json.loads(sys.stdin.read())['id'])")
-        SOURCE=$(echo "$TASK_JSON" | python3 -c "import json,sys; print(json.loads(sys.stdin.read()).get('source','queue'))")
+        TASK=$(echo "$TASK_JSON" | /usr/bin/python3 -c "import json,sys; print(json.loads(sys.stdin.read())['task'])")
+        TID=$(echo "$TASK_JSON" | /usr/bin/python3 -c "import json,sys; print(json.loads(sys.stdin.read())['id'])")
+        SOURCE=$(echo "$TASK_JSON" | /usr/bin/python3 -c "import json,sys; print(json.loads(sys.stdin.read()).get('source','queue'))")
 
         echo "[$(date +%H:%M:%S)] worker picked $TID [$SOURCE]: ${TASK:0:80}" >> "$LOG"
         START=$(date +%s)
@@ -302,30 +309,35 @@ PYEOF
         END=$(date +%s)
         DUR=$((END - START))
 
-        # If task came from plan, mark as done ([ ] → [x])
+        # If task came from plan, mark as done ([ ] → [x]) — env vars = safe quoting
         if [[ "$SOURCE" == "plan" ]]; then
-            python3 <<PYEOF >> "$LOG" 2>&1
-import re
+            DAEMON_TASK="$TASK" /usr/bin/python3 - >> "$LOG" 2>&1 <<'PYEOF'
+import re, os
 from pathlib import Path
 plan_file = Path.home() / '.surrogate' / 'active-plan.md'
 if plan_file.exists():
-    task = '''$TASK'''
+    task = os.environ.get('DAEMON_TASK', '')
     text = plan_file.read_text()
-    # Mark [~] in-progress → [x] done
     new_text = text.replace(f'- [~] {task}', f'- [x] {task}', 1)
     plan_file.write_text(new_text)
-    # Count remaining
     remaining = len(re.findall(r'^- \[ \]', new_text, re.MULTILINE))
     print(f"[plan] marked done: {task[:60]} | remaining: {remaining}")
 PYEOF
         fi
 
         # Mark done in audit log
-        python3 <<PYEOF >> "$LOG" 2>&1
-import json
-done = {'id': '$TID', 'source': '$SOURCE', 'task': '''$TASK''', 'duration_sec': $DUR, 'output_tail': '''$(echo "$OUTPUT" | tail -20 | python3 -c "import sys; print(sys.stdin.read().replace(chr(39),chr(34))[:2000])")'''}
-open('$DONE','a').write(json.dumps(done, ensure_ascii=False) + '\n')
-print(f"[{'$TID'}] done in {$DUR}s")
+        DAEMON_TASK="$TASK" DAEMON_OUTPUT="$(echo "$OUTPUT" | tail -20)" \
+            /usr/bin/python3 - "$TID" "$SOURCE" "$DUR" "$DONE" >> "$LOG" 2>&1 <<'PYEOF'
+import json, os, sys
+tid, source, dur, done_path = sys.argv[1], sys.argv[2], int(sys.argv[3]), sys.argv[4]
+done = {
+    'id': tid, 'source': source,
+    'task': os.environ.get('DAEMON_TASK', ''),
+    'duration_sec': dur,
+    'output_tail': os.environ.get('DAEMON_OUTPUT', '')[:2000],
+}
+open(done_path, 'a').write(json.dumps(done, ensure_ascii=False) + '\n')
+print(f"[{tid}] done in {dur}s")
 PYEOF
         exit 0
         ;;

bin/surrogate-dev-loop.sh

@@ -33,7 +33,7 @@ SEARCH_ROOTS=(
 
 # ── Task generators (pick one per cycle, weighted random) ────────────────────
 pick_task() {
-    python3 <<'PYEOF'
+    /usr/bin/python3 <<'PYEOF'
 import os, random, re, subprocess, json
 from pathlib import Path
 
@@ -47,7 +47,7 @@ ROOTS = [p for p in ROOTS if p.exists()]
 
 def find_todo():
     """Find a TODO/FIXME/XXX/HACK comment in user code (uses ripgrep — fast)."""
-    cmd = ['rg', '--no-heading', '-n', '-m', '3',
+    cmd = ['/opt/homebrew/bin/rg', '--no-heading', '-n', '-m', '3',
            '--type', 'py', '--type', 'sh', '--type', 'ts', '--type', 'go',
            '-g', '!node_modules', '-g', '!.venv', '-g', '!__pycache__',
            '-g', '!.git', '-g', '!dist', '-g', '!build',
@@ -178,7 +178,7 @@ load_reflexion_lessons() {
     local kind="$1"
     local file="$HOME/.hermes/workspace/reflexion/lessons-${kind}.jsonl"
     [[ ! -f "$file" ]] && { echo ""; return; }
-    python3 <<PYEOF
+    /usr/bin/python3 <<PYEOF
 import json
 from pathlib import Path
 p = Path("$file")
@@ -209,17 +209,15 @@ save_reflexion_lesson() {
     local kind="$1" task="$2" response="$3" duration="$4"
     local file="$HOME/.hermes/workspace/reflexion/lessons-${kind}.jsonl"
     mkdir -p "$(dirname "$file")"
-    python3 <<PYEOF
-import json, re, sys
-from pathlib import Path
+    # Pass payload via env vars + sys.argv (safe — no shell quoting issues with embedded quotes)
+    REFLEX_RESP="$response" REFLEX_TASK="$task" \
+        /usr/bin/python3 - "$kind" "$duration" "$file" <<'PYEOF'
+import json, re, os, sys
 from datetime import datetime
+kind, dur, out_file = sys.argv[1], int(sys.argv[2]), sys.argv[3]
+resp = os.environ.get('REFLEX_RESP', '')
+task = os.environ.get('REFLEX_TASK', '')[:200]
 
-resp = '''$response'''
-task = '''$task'''[:200]
-dur = $duration
-
-# Heuristic: extract a "lesson" line from the response.
-# Look for explicit "lesson:", "key insight:", "note:", or use first concrete-sounding sentence.
 lesson = None
 for pat in [
     r'(?:lesson|key insight|key takeaway|note):\s*([^\n]{20,200})',
@@ -227,23 +225,17 @@ for pat in [
 ]:
     m = re.search(pat, resp, re.IGNORECASE)
     if m: lesson = m.group(1).strip(); break
-
 if not lesson:
-    # Fallback: first declarative sentence in response (after prelude)
     sentences = [s.strip() for s in re.split(r'[\.\n]+', resp) if 30 < len(s.strip()) < 200]
-    if sentences:
-        lesson = sentences[0]
-
+    if sentences: lesson = sentences[0]
 if lesson:
     record = {
         'ts': datetime.utcnow().isoformat(),
-        'kind': '$kind',
-        'task': task,
-        'lesson': lesson[:300],
+        'kind': kind, 'task': task, 'lesson': lesson[:300],
         'duration_sec': dur,
-        'score': 1.0 if dur < 60 else 0.5,  # fast cycle = better quality usually
+        'score': 1.0 if dur < 60 else 0.5,
     }
-    with open("$file", 'a') as f:
+    with open(out_file, 'a') as f:
         f.write(json.dumps(record, ensure_ascii=False) + '\n')
 PYEOF
 }
@@ -259,11 +251,11 @@ run_cycle() {
     fi
 
     local kind path line task_text context
-    kind=$(echo "$task_json" | python3 -c "import json,sys; print(json.loads(sys.stdin.read()).get('kind',''))")
-    path=$(echo "$task_json" | python3 -c "import json,sys; print(json.loads(sys.stdin.read()).get('path',''))")
-    line=$(echo "$task_json" | python3 -c "import json,sys; print(json.loads(sys.stdin.read()).get('line',0))")
-    task_text=$(echo "$task_json" | python3 -c "import json,sys; print(json.loads(sys.stdin.read()).get('task',''))")
-    context=$(echo "$task_json" | python3 -c "import json,sys; print(json.loads(sys.stdin.read()).get('context',''))")
+    kind=$(echo "$task_json" | /usr/bin/python3 -c "import json,sys; print(json.loads(sys.stdin.read()).get('kind',''))")
+    path=$(echo "$task_json" | /usr/bin/python3 -c "import json,sys; print(json.loads(sys.stdin.read()).get('path',''))")
+    line=$(echo "$task_json" | /usr/bin/python3 -c "import json,sys; print(json.loads(sys.stdin.read()).get('line',0))")
+    task_text=$(echo "$task_json" | /usr/bin/python3 -c "import json,sys; print(json.loads(sys.stdin.read()).get('task',''))")
+    context=$(echo "$task_json" | /usr/bin/python3 -c "import json,sys; print(json.loads(sys.stdin.read()).get('context',''))")
 
     local id="$(date +%s)-${kind}"
     local out="$OUT_DIR/${id}.md"
@@ -285,7 +277,7 @@ $context
 
     # Call Surrogate-1 via Ollama (keep_alive=5m so model stays warm between cycles)
     local body
-    body=$(PROMPT_VAR="$prompt" python3 <<'PYEOF'
+    body=$(PROMPT_VAR="$prompt" /usr/bin/python3 <<'PYEOF'
 import json, os
 print(json.dumps({
     "model": "surrogate-1",
@@ -298,13 +290,13 @@ print(json.dumps({
 PYEOF
 )
     local resp
-    resp=$(curl -sS --max-time 120 \
+    resp=$(/usr/bin/curl -sS --max-time 120 \
         http://localhost:11434/v1/chat/completions \
         -H 'Content-Type: application/json' \
         -d "$body" 2>/dev/null)
 
     local answer
-    answer=$(echo "$resp" | python3 -c "
+    answer=$(echo "$resp" | /usr/bin/python3 -c "
 import json, sys
 try:
     d = json.load(sys.stdin)
@@ -341,18 +333,21 @@ EOF
     # Reflexion: extract & save lesson from this cycle
     save_reflexion_lesson "$kind" "$task_text" "$answer" "$dur"
 
-    # Append to training-data candidate (will be reviewed before promoting to JSONL)
-    python3 <<PYEOF
-import json
+    # Append to training-data candidate (env vars + argv = safe quoting)
+    DEV_TASK="$task_text" DEV_ANSWER="$answer" \
+        /usr/bin/python3 - "$kind" "$dur" <<'PYEOF'
+import json, os, sys
 from pathlib import Path
+from datetime import datetime
+kind, dur = sys.argv[1], int(sys.argv[2])
 candidate = Path.home() / 'axentx/surrogate/data/training-jsonl/local-dev-pending.jsonl'
 candidate.parent.mkdir(parents=True, exist_ok=True)
 record = {
-    'ts': '$(date -u +%Y-%m-%dT%H:%M:%SZ)',
-    'kind': '$kind',
-    'task': '''$task_text''',
-    'response': '''$answer'''[:5000],
-    'duration_sec': $dur,
+    'ts': datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ'),
+    'kind': kind,
+    'task': os.environ.get('DEV_TASK', '')[:8000],
+    'response': os.environ.get('DEV_ANSWER', '')[:5000],
+    'duration_sec': dur,
     'source': 'surrogate-dev-loop',
 }
 with open(candidate, 'a') as f: