Hivemind turns agent traces into skills and shares with your team

Summary

The open-goals SessionStart banner (src/notifications/sources/open-goals.ts) filtered goals with owner LIKE '%${userName}%'. That substring match has two real failure modes — the same ones CodeRabbit flagged on #203 for the SessionStart context block:

1. Substring collision — '%ali%' matches malice@…, leaking another user's goals into the banner.
2. Reverse-alias miss — a full-email userName never matches a row whose owner is the short form.

The context-renderer already fixed this with listOpenGoals (exact full / exact short / short@% alias), but the banner was never ported and kept the worse query plus a loose bidirectional includes() JS guard.

This PR makes the banner reuse listOpenGoals instead of duplicating its own SQL. Net change is a deletion: the substring query and the JS guard both go away.

Changes

• open-goals.ts: drop the owner LIKE '%…%' SQL + includes() guard; call listOpenGoals(sql => api.query(sql), goalsTable, userName, { limit: 25 }).
• Updated notifications-open-goals-source.test.ts SQL-shape assertions to the canonical-forms query. 18/18 pass.

Verified

Built the bundle, installed locally, and ran the actual SessionStart hook against the live API. It now issues:

WHERE (owner = 'sasun' OR owner = 'sasun' OR owner LIKE 'sasun@%')

exact owner match, no substring scan — rendered the banner correctly, exit 0.

⚠️ Note / follow-up (NOT fixed here)

While testing I confirmed the "N goals open" double-count is a separate bug that this PR does not fix. listOpenGoals carries a version = MAX(version) filter, but version is vestigial — always 1 (deeplake-fs.ts:459-461), so it never dedups. The duplicate rows come from Deeplake's UPDATE-coalescing quirk (deeplake-fs.ts:466-468): a single logical goal can have 2+ rows with the same (goal_id, version). A real fix needs DISTINCT ON (goal_id) / GROUP BY goal_id in both readers (open-goals and context-renderer). Happy to do that in a follow-up.

Test plan

• [x] vitest run tests/claude-code/notifications-open-goals-source.test.ts (18/18)
• [x] tsc --noEmit --skipLibCheck
• [x] Live SessionStart hook emits canonical-forms query, exit 0

Summary by CodeRabbit

• Refactor
  • Enhanced open goals notification fetching with more precise canonical owner-form matching instead of substring patterns, improving accuracy and security while maintaining existing deduplication and filtering.
• Tests
  • Updated tests to verify canonical owner-form matching and edge-case filtering behavior.