@ashlr/hub 2.2.0

package/dist/core/onboard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboard.js","sourceRoot":"","sources":["../../src/core/onboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,6CAA6C;AAC7C,SAAS,IAAI,CACX,IAAY,EACZ,MAA6B,EAC7B,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E,kDAAkD;AAClD,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QAC5D,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,qBAAqB,UAAU,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;QACjC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,6BAA6B,UAAU,EAAE,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,4BAA4B,GAAG,2BAA2B,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,UAAU,CAAC,GAAgB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtE,OAAO,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,uBAAuB,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,aAAa,GAAG,eAAe,EAAE,CAAC;QACxC,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,IAAI,CACT,QAAQ,EACR,QAAQ,EACR,gGAAgG,CACjG,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CACT,QAAQ,EACR,QAAQ,EACR,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,iCAAiC,GAAG,kCAAkC,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,KAAK,UAAU,WAAW,CAAC,IAAuB;IAChD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,yDAAyD,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,IAAI,CACT,SAAS,EACT,UAAU,EACV,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD,CACzF,CAAC;QACJ,CAAC;QACD,+DAA+D;QAC/D,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAuC,CAAC;YACvD,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,mCAAmC,GAAG,mBAAmB,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,WAAW;IACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,wCAAwC;QACxC,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;gBACvE,OAAO,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,oBAAoB,WAAW,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,oBAAoB,WAAW,MAAM,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,6EAA6E;QAC7E,kFAAkF;QAClF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,sDAAsD;QACtD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAEjD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CACT,SAAS,EACT,QAAQ,EACR,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QAED,0DAA0D;QAC1D,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,oBAAoB,WAAW,MAAM,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,IAAI,CACT,SAAS,EACT,QAAQ,EACR,6BAA6B,GAAG,gDAAgD,CACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,UAAU;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,yBAAyB,SAAS,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,yBAAyB,SAAS,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,gCAAgC,GAAG,2BAA2B,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,OAAO,IAAI,CACT,SAAS,EACT,QAAQ,EACR,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,OAAO,IAAI,CACT,SAAS,EACT,UAAU,EACV,YAAY,MAAM,CAAC,OAAO,IAAI,SAAS,yDAAyD,CACjG,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;QACxC,OAAO,IAAI,CACT,SAAS,EACT,IAAI,EACJ,YAAY,MAAM,CAAC,OAAO,IAAI,SAAS,yBAAyB,KAAK,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CACzG,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,+BAA+B,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE5C,kEAAkE;AAClE,KAAK,UAAU,UAAU,CAAC,GAAgB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,WAAW,IAAI,UAAU,IAAI,UAAU,IAAI,OAAO,CAAC;QAElE,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChE,OAAO;gBACL,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,UAAU,2BAA2B,CAAC;gBACnG,eAAe,EAAE,IAAI;aACtB,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7D,OAAO;gBACL,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,sBAAsB,UAAU,2BAA2B,CAAC;gBAC5G,eAAe,EAAE,KAAK;aACvB,CAAC;QACJ,CAAC;QAED,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;YAChE,eAAe,EAAE,KAAK;SACvB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,wBAAwB,GAAG,qBAAqB,CAAC;YACtF,eAAe,EAAE,KAAK,EAAE,sDAAsD;SAC/E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAgB,EAChB,IAAqC;IAErC,sEAAsE;IACtE,6EAA6E;IAC7E,0EAA0E;IAE1E,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,WAAW,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,MAAM,WAAW,EAAE,CAAC;IACxC,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAE9D,MAAM,KAAK,GAAkB;QAC3B,UAAU;QACV,UAAU;QACV,WAAW;QACX,WAAW;QACX,UAAU;QACV,WAAW;QACX,UAAU;KACX,CAAC;IAEF,wDAAwD;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,KAAK,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,QAAQ,IAAI,CAAC,eAAe,CAAC;IAE3C,4BAA4B;IAC5B,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,SAAS,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnC,SAAS,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACpD,SAAS,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACpC,SAAS,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACrF,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,IAAI,eAAe,EAAE,CAAC;QACtD,SAAS,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,sDAAsD;IACtD,SAAS,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAE3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC"}

package/dist/core/orient.d.ts

@@ -0,0 +1,23 @@
+/**
+ * M31: buildOrientation — composite session-start context for agents.
+ *
+ * Answers "what should I know before I start working here" in ONE read-only
+ * call: genome memory hits + latest health score + persisted backlog items +
+ * pending proposal count + portfolio attention (dirty/stale).
+ *
+ * Contract (CONTRACT-M31):
+ *   - READ-ONLY: derives everything from local stores; never scans repos,
+ *     never builds an index, never calls a model or the network.
+ *   - Every section is BEST-EFFORT: a failing store yields an empty section,
+ *     never an exception. buildOrientation NEVER throws.
+ *   - Bounded: hits/items are capped so the result stays context-friendly.
+ *
+ * Consumed by: `ashlr orient` (CLI), the `ashlr_orient` native MCP tool, and
+ * the read-only `GET /api/orient` web route.
+ */
+import type { AshlrConfig, OrientResult } from './types.js';
+/**
+ * Build the orientation. `repo` may be absolute or relative (resolved against
+ * cwd); when omitted the orientation is portfolio-wide.
+ */
+export declare function buildOrientation(cfg: AshlrConfig, repo?: string): Promise<OrientResult>;

package/dist/core/orient.js

@@ -0,0 +1,135 @@
+/**
+ * M31: buildOrientation — composite session-start context for agents.
+ *
+ * Answers "what should I know before I start working here" in ONE read-only
+ * call: genome memory hits + latest health score + persisted backlog items +
+ * pending proposal count + portfolio attention (dirty/stale).
+ *
+ * Contract (CONTRACT-M31):
+ *   - READ-ONLY: derives everything from local stores; never scans repos,
+ *     never builds an index, never calls a model or the network.
+ *   - Every section is BEST-EFFORT: a failing store yields an empty section,
+ *     never an exception. buildOrientation NEVER throws.
+ *   - Bounded: hits/items are capped so the result stays context-friendly.
+ *
+ * Consumed by: `ashlr orient` (CLI), the `ashlr_orient` native MCP tool, and
+ * the read-only `GET /api/orient` web route.
+ */
+import { resolve, basename } from 'node:path';
+import { recall } from './genome/recall.js';
+import { loadPreviousReport } from './quality/store.js';
+import { loadBacklog } from './portfolio/backlog.js';
+import { pendingCount } from './inbox/store.js';
+import { loadIndex } from './index-engine.js';
+/** Bounds keeping an orientation small enough to inject into a session. */
+const MAX_GENOME_HITS = 5;
+const MAX_BACKLOG_ITEMS = 8;
+const MAX_HIT_TEXT = 400;
+const WORST_DIMENSIONS = 3;
+/**
+ * Build the orientation. `repo` may be absolute or relative (resolved against
+ * cwd); when omitted the orientation is portfolio-wide.
+ */
+export async function buildOrientation(cfg, repo) {
+    const abs = repo && repo.trim() !== '' ? resolve(repo) : null;
+    // ── Genome memory (best-effort) ───────────────────────────────────────────
+    let genomeHits = [];
+    try {
+        const query = abs ? basename(abs) : 'project conventions decisions overview';
+        const hits = await recall(query, cfg, { limit: MAX_GENOME_HITS });
+        genomeHits = hits.map((h) => ({
+            title: h.entry.title,
+            text: h.entry.text.slice(0, MAX_HIT_TEXT),
+            score: h.score,
+            project: h.entry.project,
+        }));
+    }
+    catch {
+        genomeHits = [];
+    }
+    // ── Health (best-effort; persisted report only — never re-scans) ─────────
+    let health = null;
+    try {
+        const report = loadPreviousReport();
+        if (report) {
+            const score = abs
+                ? report.scores.find((s) => resolve(s.repo) === abs) ?? null
+                : null;
+            if (score) {
+                const worst = [...score.dimensions]
+                    .sort((a, b) => a.score - b.score)
+                    .slice(0, WORST_DIMENSIONS)
+                    .map((d) => `${d.dimension} (${d.score})`);
+                health = { score: score.score, grade: score.grade, worstDimensions: worst };
+            }
+            else if (!abs) {
+                health = {
+                    score: report.averageScore,
+                    grade: report.averageGrade,
+                    worstDimensions: report.scores
+                        .slice(0, WORST_DIMENSIONS)
+                        .map((s) => `${basename(s.repo)} (${s.score})`),
+                };
+            }
+        }
+    }
+    catch {
+        health = null;
+    }
+    // ── Backlog (persisted only — never triggers a scan) ──────────────────────
+    let backlogItems = [];
+    try {
+        const backlog = loadBacklog();
+        if (backlog) {
+            const items = abs
+                ? backlog.items.filter((it) => resolve(it.repo) === abs)
+                : backlog.items;
+            backlogItems = items.slice(0, MAX_BACKLOG_ITEMS).map((it) => ({
+                id: it.id,
+                source: it.source,
+                title: it.title,
+                score: it.score,
+            }));
+        }
+    }
+    catch {
+        backlogItems = [];
+    }
+    // ── Pending proposals ──────────────────────────────────────────────────────
+    let pendingProposals = 0;
+    try {
+        pendingProposals = pendingCount();
+    }
+    catch {
+        pendingProposals = 0;
+    }
+    // ── Attention (index-derived; no rebuild) ─────────────────────────────────
+    let attention = null;
+    try {
+        const index = loadIndex();
+        if (index) {
+            let dirty = 0;
+            let stale = 0;
+            for (const item of index.items) {
+                if (item.git && item.git.dirty > 0)
+                    dirty++;
+                if (item.kind === 'repo' && !item.active)
+                    stale++;
+            }
+            attention = { dirtyRepos: dirty, staleRepos: stale };
+        }
+    }
+    catch {
+        attention = null;
+    }
+    return {
+        generatedAt: new Date().toISOString(),
+        repo: abs,
+        genomeHits,
+        health,
+        backlogItems,
+        pendingProposals,
+        attention,
+    };
+}
+//# sourceMappingURL=orient.js.map

package/dist/core/orient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orient.js","sourceRoot":"","sources":["../../src/core/orient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,2EAA2E;AAC3E,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAgB,EAChB,IAAa;IAEb,MAAM,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9D,6EAA6E;IAC7E,IAAI,UAAU,GAA+B,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,wCAAwC,CAAC;QAC7E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAClE,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK;YACpB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC;YACzC,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO;SACzB,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,EAAE,CAAC;IAClB,CAAC;IAED,4EAA4E;IAC5E,IAAI,MAAM,GAA2B,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,GAAG;gBACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI;gBAC5D,CAAC,CAAC,IAAI,CAAC;YACT,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;qBAChC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;qBACjC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC;qBAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;gBAC7C,MAAM,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;YAC9E,CAAC;iBAAM,IAAI,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,GAAG;oBACP,KAAK,EAAE,MAAM,CAAC,YAAY;oBAC1B,KAAK,EAAE,MAAM,CAAC,YAAY;oBAC1B,eAAe,EAAE,MAAM,CAAC,MAAM;yBAC3B,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC;yBAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC;iBAClD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,6EAA6E;IAC7E,IAAI,YAAY,GAAiC,EAAE,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,GAAG;gBACf,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC;gBACxD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;YAClB,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC5D,EAAE,EAAE,EAAE,CAAC,EAAE;gBACT,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,KAAK,EAAE,EAAE,CAAC,KAAK;gBACf,KAAK,EAAE,EAAE,CAAC,KAAK;aAChB,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,8EAA8E;IAC9E,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,gBAAgB,GAAG,YAAY,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,6EAA6E;IAC7E,IAAI,SAAS,GAA8B,IAAI,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAC/B,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC;oBAAE,KAAK,EAAE,CAAC;gBAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,KAAK,EAAE,CAAC;YACpD,CAAC;YACD,SAAS,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,IAAI,EAAE,GAAG;QACT,UAAU;QACV,MAAM;QACN,YAAY;QACZ,gBAAgB;QAChB,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/core/phantom.d.ts

@@ -0,0 +1,23 @@
+/**
+ * core/phantom.ts — Phantom secrets CLI integration.
+ *
+ * INTENTIONALLY VALUES-FREE: this module inspects only the Phantom CLI's
+ * metadata (version, initialization state, secret NAMES).  It never reads,
+ * captures, logs, or returns secret values under any code path.
+ */
+import type { PhantomStatus } from './types.js';
+/**
+ * Returns true when the `phantom` binary is resolvable and executes without a
+ * fatal error.  Uses `phantom --version` as the probe (fast, side-effect-free).
+ */
+export declare function phantomInstalled(): boolean;
+/**
+ * Returns a read-only status snapshot of the Phantom CLI.
+ *
+ * Guarantees:
+ *  - Never throws.
+ *  - Never returns secret values — only secret NAMES (keys).
+ *  - Degrades gracefully when phantom is absent, uninitialized, or returns
+ *    an unexpected format.
+ */
+export declare function getPhantomStatus(): PhantomStatus;

package/dist/core/phantom.js

@@ -0,0 +1,279 @@
+/**
+ * core/phantom.ts — Phantom secrets CLI integration.
+ *
+ * INTENTIONALLY VALUES-FREE: this module inspects only the Phantom CLI's
+ * metadata (version, initialization state, secret NAMES).  It never reads,
+ * captures, logs, or returns secret values under any code path.
+ */
+import { spawnSync } from 'node:child_process';
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+const PHANTOM_BIN = 'phantom';
+const TIMEOUT_MS = 5_000;
+/**
+ * Run a phantom sub-command synchronously.
+ * Returns stdout/stderr as strings and the exit status.
+ * Never throws — all errors are caught and returned in `error`.
+ */
+function runPhantom(args, options = {}) {
+    try {
+        const result = spawnSync(PHANTOM_BIN, args, {
+            encoding: 'utf8',
+            timeout: TIMEOUT_MS,
+            cwd: options.cwd,
+            // Do NOT inherit env vars that could trigger interactive prompts.
+            env: { ...process.env, PHANTOM_NO_UPDATE_CHECK: '1' },
+        });
+        if (result.error) {
+            return { stdout: '', stderr: '', status: null, error: result.error.message };
+        }
+        return {
+            stdout: result.stdout ?? '',
+            stderr: result.stderr ?? '',
+            status: result.status,
+        };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { stdout: '', stderr: '', status: null, error: msg };
+    }
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Returns true when the `phantom` binary is resolvable and executes without a
+ * fatal error.  Uses `phantom --version` as the probe (fast, side-effect-free).
+ */
+export function phantomInstalled() {
+    const { status, error } = runPhantom(['--version']);
+    // spawnSync returns null status when the binary could not be found/launched.
+    return error === undefined && status !== null && status === 0;
+}
+/**
+ * Returns a read-only status snapshot of the Phantom CLI.
+ *
+ * Guarantees:
+ *  - Never throws.
+ *  - Never returns secret values — only secret NAMES (keys).
+ *  - Degrades gracefully when phantom is absent, uninitialized, or returns
+ *    an unexpected format.
+ */
+export function getPhantomStatus() {
+    // ── 1. Binary presence ──────────────────────────────────────────────────
+    if (!phantomInstalled()) {
+        return {
+            installed: false,
+            version: null,
+            initialized: false,
+            secretNames: [],
+        };
+    }
+    // ── 2. Version ──────────────────────────────────────────────────────────
+    let version = null;
+    {
+        const { stdout, status } = runPhantom(['--version']);
+        if (status === 0) {
+            // Expected format: "phantom 0.6.0"
+            const match = stdout.trim().match(/\d+\.\d+(?:\.\d+)?/);
+            version = match ? match[0] : stdout.trim() || null;
+        }
+    }
+    // ── 3. Initialized state (phantom status --json) ─────────────────────────
+    //
+    // Prefer the documented `--json` flag and read a structured initialized /
+    // secret-count field when present (robust against wording/localization
+    // changes). Fall back to the legacy human-text heuristic only when the
+    // output is not parseable JSON.
+    //
+    // Human-text fallback: when NOT initialized, phantom prints something like
+    //   "! Not initialized. Run phantom init to get started."
+    // When initialized it prints proxy state and a mapped-secrets count. We treat
+    // the presence of "not initialized" / "run phantom init" as initialized:false.
+    //
+    // statusError is reserved for GENUINE spawn failures (binary missing /
+    // crashed). A non-zero exit whose output is parseable (e.g. proxy stopped)
+    // is NOT a fault and records no error.
+    let initialized = false;
+    let statusError;
+    {
+        const { stdout, stderr, status, error } = runPhantom(['status', '--json']);
+        if (error !== undefined) {
+            // Genuine spawn failure (could not launch the binary).
+            statusError = error;
+        }
+        else {
+            const combined = stdout + stderr;
+            const structured = parseInitializedFromJson(combined);
+            if (structured !== null) {
+                initialized = structured;
+            }
+            else {
+                // Fallback: human-text heuristic (labeled, brittle-by-design).
+                const lc = combined.toLowerCase();
+                initialized = !lc.includes('not initialized') && !lc.includes('run phantom init');
+            }
+            // A stopped proxy / non-zero exit is benign once we have parseable
+            // output; do not surface it as a hard error. statusError stays unset.
+            void status;
+        }
+    }
+    // ── 4. Secret NAMES (phantom list --json) ───────────────────────────────
+    //
+    // Only attempt when initialized; avoids spurious error output.
+    // We use --json for deterministic parsing.  Expected shape (when secrets
+    // exist) is an array of objects each containing at minimum a "name" or
+    // "key" field.  If the shape is unrecognised we return [] rather than
+    // risk accidentally surfacing values.
+    let secretNames = [];
+    if (initialized) {
+        const { stdout, status, error } = runPhantom(['list', '--json']);
+        if (error === undefined && status === 0 && stdout.trim().length > 0) {
+            secretNames = parseSecretNames(stdout);
+        }
+    }
+    const result = {
+        installed: true,
+        version,
+        initialized,
+        secretNames,
+    };
+    if (statusError !== undefined) {
+        result.error = statusError;
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Private parsing — deliberately conservative
+// ---------------------------------------------------------------------------
+/**
+ * Read the initialized state from `phantom status --json` output.
+ *
+ * Returns:
+ *   - true / false when a structured boolean field can be determined
+ *   - null when the output is not parseable JSON (caller should fall back to
+ *     the human-text heuristic)
+ *
+ * Recognised shapes (defensive — phantom's exact schema may evolve):
+ *   { "initialized": true, ... }
+ *   { "vault": { "initialized": true }, ... }
+ *   { "secrets": 3, ... }  / { "secretCount": 3 } → initialized when count >= 0
+ * Never reads or returns secret values — only boolean/count metadata.
+ */
+function parseInitializedFromJson(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed.startsWith('{') && !trimmed.startsWith('['))
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch {
+        return null;
+    }
+    if (parsed === null || typeof parsed !== 'object')
+        return null;
+    const obj = parsed;
+    // Direct boolean field
+    if (typeof obj['initialized'] === 'boolean')
+        return obj['initialized'];
+    // Nested vault.initialized
+    const vault = obj['vault'];
+    if (vault !== null && typeof vault === 'object') {
+        const v = vault['initialized'];
+        if (typeof v === 'boolean')
+            return v;
+    }
+    // A numeric secret count implies an initialized vault.
+    for (const key of ['secretCount', 'secrets', 'mapped', 'count']) {
+        if (typeof obj[key] === 'number')
+            return true;
+    }
+    // Parseable JSON but no recognised field — treat as initialized (a vault
+    // that emits structured status is, by definition, set up).
+    return true;
+}
+/**
+ * Extract ONLY secret names from `phantom list --json` output.
+ *
+ * The function intentionally returns an empty array whenever it cannot
+ * confidently identify a "name" field, preventing accidental value leakage
+ * if the JSON schema changes.
+ *
+ * NEVER include or return values, tokens, or any field that is not the
+ * human-readable key name.
+ */
+function parseSecretNames(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        // ── Array of objects: [{ name: "KEY" }, ...]  or  [{ key: "KEY" }, ...]
+        if (Array.isArray(parsed)) {
+            const names = [];
+            for (const item of parsed) {
+                if (item !== null && typeof item === 'object') {
+                    const obj = item;
+                    // Prefer "name", fall back to "key" — both are safe identifier fields.
+                    if (typeof obj['name'] === 'string') {
+                        names.push(obj['name']);
+                    }
+                    else if (typeof obj['key'] === 'string') {
+                        names.push(obj['key']);
+                    }
+                    // Deliberately skip any other field to avoid leaking values.
+                }
+                else if (typeof item === 'string') {
+                    // Some CLIs emit a flat string array of names.
+                    names.push(item);
+                }
+            }
+            return names;
+        }
+        // ── Object with a "secrets" or "keys" array at the top level
+        if (parsed !== null && typeof parsed === 'object') {
+            const obj = parsed;
+            for (const key of ['secrets', 'keys', 'names']) {
+                if (Array.isArray(obj[key])) {
+                    return parseSecretNames(JSON.stringify(obj[key]));
+                }
+            }
+        }
+        // Unknown shape — return empty rather than risk leaking values.
+        return [];
+    }
+    catch {
+        // JSON parse failed — fall back to line-based extraction.
+        return parseSecretNamesFromText(raw);
+    }
+}
+/**
+ * Last-resort line-by-line name extractor for plain-text `phantom list` output.
+ *
+ * Phantom's table format typically looks like:
+ *   NAME            PROTECTED
+ *   MY_API_KEY      yes
+ *   ANOTHER_SECRET  yes
+ *
+ * We extract the first whitespace-delimited token from each non-header line
+ * that looks like an environment-variable name (ALL_CAPS / SCREAMING_SNAKE).
+ *
+ * Deliberately conservative — returns [] for any line that doesn't look like
+ * a canonical env-var name.
+ */
+function parseSecretNamesFromText(text) {
+    const ENV_VAR_RE = /^[A-Z_][A-Z0-9_]{0,127}$/;
+    const names = [];
+    for (const raw of text.split('\n')) {
+        const line = raw.trim();
+        if (!line)
+            continue;
+        const token = line.split(/\s+/)[0];
+        // Skip header lines ("NAME", "KEY", etc.) implicitly — they pass the
+        // same regex but are single-word and won't look like multi-word values.
+        if (token && ENV_VAR_RE.test(token) && token !== 'NAME' && token !== 'KEY') {
+            names.push(token);
+        }
+    }
+    return names;
+}
+//# sourceMappingURL=phantom.js.map

package/dist/core/phantom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phantom.js","sourceRoot":"","sources":["../../src/core/phantom.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,WAAW,GAAG,SAAS,CAAC;AAC9B,MAAM,UAAU,GAAG,KAAK,CAAC;AAEzB;;;;GAIG;AACH,SAAS,UAAU,CACjB,IAAc,EACd,UAA4B,EAAE;IAE9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE;YAC1C,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,UAAU;YACnB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,kEAAkE;YAClE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,uBAAuB,EAAE,GAAG,EAAE;SACtD,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/E,CAAC;QAED,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACpD,6EAA6E;IAC7E,OAAO,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC9B,2EAA2E;IAC3E,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QACxB,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,KAAK;YAClB,WAAW,EAAE,EAAE;SAChB,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,CAAC;QACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,mCAAmC;YACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACrD,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,EAAE;IACF,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,gCAAgC;IAChC,EAAE;IACF,2EAA2E;IAC3E,0DAA0D;IAC1D,8EAA8E;IAC9E,+EAA+E;IAC/E,EAAE;IACF,uEAAuE;IACvE,2EAA2E;IAC3E,uCAAuC;IACvC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,WAA+B,CAAC;IACpC,CAAC;QACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,uDAAuD;YACvD,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;YACjC,MAAM,UAAU,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,WAAW,GAAG,UAAU,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,+DAA+D;gBAC/D,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAClC,WAAW,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YACpF,CAAC;YACD,mEAAmE;YACnE,sEAAsE;YACtE,KAAK,MAAM,CAAC;QACd,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,EAAE;IACF,+DAA+D;IAC/D,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,sCAAsC;IACtC,IAAI,WAAW,GAAa,EAAE,CAAC;IAC/B,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjE,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAkB;QAC5B,SAAS,EAAE,IAAI;QACf,OAAO;QACP,WAAW;QACX,WAAW;KACZ,CAAC;IAEF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC;IAC7B,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,SAAS,wBAAwB,CAAC,GAAW;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,uBAAuB;IACvB,IAAI,OAAO,GAAG,CAAC,aAAa,CAAC,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,aAAa,CAAC,CAAC;IAEvE,2BAA2B;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,CAAC,GAAI,KAAiC,CAAC,aAAa,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,uDAAuD;IACvD,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QAChE,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IAChD,CAAC;IAED,yEAAyE;IACzE,2DAA2D;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAExC,yEAAyE;QACzE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC9C,MAAM,GAAG,GAAG,IAA+B,CAAC;oBAC5C,uEAAuE;oBACvE,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;wBACpC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC1B,CAAC;yBAAM,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;wBAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;oBACzB,CAAC;oBACD,6DAA6D;gBAC/D,CAAC;qBAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACpC,+CAA+C;oBAC/C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,8DAA8D;QAC9D,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,GAAG,GAAG,MAAiC,CAAC;YAC9C,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC5B,OAAO,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,OAAO,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,UAAU,GAAG,0BAA0B,CAAC;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,qEAAqE;QACrE,wEAAwE;QACxE,IAAI,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YAC3E,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/core/plugins/host-api.d.ts

@@ -0,0 +1,29 @@
+/**
+ * core/plugins/host-api.ts — M33 PluginHost factory.
+ *
+ * CONTRACT RULES (non-negotiable):
+ *  - buildHostApi returns a fully frozen PluginHost. Every nested object is
+ *    deep-frozen via structuredClone + recursive Object.freeze.
+ *  - `settings` is a deep-frozen copy of cfg.plugins.settings[name] ONLY.
+ *    The plugin NEVER receives the full AshlrConfig.
+ *  - `view` is a frozen allowlisted projection — only editor + staleDays.
+ *  - `audit()` delegates to core/sandbox/audit.ts and prefixes the action
+ *    with "plugin:<name>:" automatically. Never throws.
+ *  - `log()` writes to stderr, prefixed "[plugin:<name>]". Never throws.
+ *  - `dataDir` is created eagerly at ~/.ashlr/plugin-data/<name>/ if absent.
+ *  - homedir() is resolved at call time so tests can relocate HOME.
+ */
+import { type PluginHost } from './types.js';
+import type { AshlrConfig } from '../types.js';
+/**
+ * Build a fully frozen PluginHost for a plugin identified by `manifest.name`.
+ *
+ * `cfg` is the current AshlrConfig. Only a safe projection is exposed to the
+ * plugin — never the full config object.
+ *
+ * dataDir (~/.ashlr/plugin-data/<name>/) is created eagerly so the plugin can
+ * use it immediately after activate() without setup.
+ */
+export declare function buildHostApi(manifest: {
+    name: string;
+}, cfg: AshlrConfig): PluginHost;

package/dist/core/plugins/host-api.js

@@ -0,0 +1,113 @@
+/**
+ * core/plugins/host-api.ts — M33 PluginHost factory.
+ *
+ * CONTRACT RULES (non-negotiable):
+ *  - buildHostApi returns a fully frozen PluginHost. Every nested object is
+ *    deep-frozen via structuredClone + recursive Object.freeze.
+ *  - `settings` is a deep-frozen copy of cfg.plugins.settings[name] ONLY.
+ *    The plugin NEVER receives the full AshlrConfig.
+ *  - `view` is a frozen allowlisted projection — only editor + staleDays.
+ *  - `audit()` delegates to core/sandbox/audit.ts and prefixes the action
+ *    with "plugin:<name>:" automatically. Never throws.
+ *  - `log()` writes to stderr, prefixed "[plugin:<name>]". Never throws.
+ *  - `dataDir` is created eagerly at ~/.ashlr/plugin-data/<name>/ if absent.
+ *  - homedir() is resolved at call time so tests can relocate HOME.
+ */
+import { mkdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { audit } from '../sandbox/audit.js';
+import { PLUGIN_API_VERSION } from './types.js';
+// ---------------------------------------------------------------------------
+// Deep-freeze helper
+// ---------------------------------------------------------------------------
+/**
+ * Recursively freeze `value` and all nested plain-object/array values.
+ * Returns the input (mutated in-place by Object.freeze, same reference).
+ * Only freezes plain objects and arrays to avoid freezing class instances.
+ */
+function deepFreeze(value) {
+    if (value === null || typeof value !== 'object')
+        return value;
+    Object.freeze(value);
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            deepFreeze(item);
+        }
+    }
+    else {
+        for (const key of Object.keys(value)) {
+            deepFreeze(value[key]);
+        }
+    }
+    return value;
+}
+// ---------------------------------------------------------------------------
+// buildHostApi — public factory
+// ---------------------------------------------------------------------------
+/**
+ * Build a fully frozen PluginHost for a plugin identified by `manifest.name`.
+ *
+ * `cfg` is the current AshlrConfig. Only a safe projection is exposed to the
+ * plugin — never the full config object.
+ *
+ * dataDir (~/.ashlr/plugin-data/<name>/) is created eagerly so the plugin can
+ * use it immediately after activate() without setup.
+ */
+export function buildHostApi(manifest, cfg) {
+    const name = manifest.name;
+    // --- dataDir: created eagerly ---
+    // Re-resolve homedir() at call time (house convention: tests relocate HOME).
+    const dataDir = join(homedir(), '.ashlr', 'plugin-data', name);
+    try {
+        mkdirSync(dataDir, { recursive: true });
+    }
+    catch {
+        // best-effort: if creation fails, log but don't throw — the host is still usable.
+    }
+    // --- settings: deep-frozen copy of the plugin's own settings only ---
+    const rawSettings = cfg.plugins?.settings?.[name] ?? {};
+    const frozenSettings = deepFreeze(structuredClone(rawSettings));
+    // --- view: frozen allowlisted projection ---
+    const frozenView = Object.freeze({
+        editor: cfg.editor ?? 'vscode',
+        staleDays: cfg.staleDays ?? 30,
+    });
+    // --- Build the host (freeze the outer object last) ---
+    const host = {
+        apiVersion: PLUGIN_API_VERSION,
+        pluginName: name,
+        log(msg) {
+            try {
+                process.stderr.write(`[plugin:${name}] ${msg}\n`);
+            }
+            catch {
+                // log must never throw
+            }
+        },
+        audit(action, summary) {
+            // Delegate to core audit(), prefixing action with "plugin:<name>:".
+            // audit() never throws (house invariant).
+            audit({
+                action: `plugin:${name}:${action}`,
+                repo: null,
+                sandboxId: null,
+                summary,
+                result: 'ok',
+            });
+        },
+        get settings() {
+            return frozenSettings;
+        },
+        get view() {
+            return frozenView;
+        },
+        get dataDir() {
+            return dataDir;
+        },
+    };
+    // Freeze the host object itself. Methods are enumerable only if they appear
+    // on the object, not the prototype, so we freeze the literal object.
+    return Object.freeze(host);
+}
+//# sourceMappingURL=host-api.js.map

package/dist/core/plugins/host-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-api.js","sourceRoot":"","sources":["../../../src/core/plugins/host-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAmB,MAAM,YAAY,CAAC;AAGjE,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAkB,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,EAAE,CAAC;YAC/C,UAAU,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,QAA0B,EAC1B,GAAgB;IAEhB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAE3B,mCAAmC;IACnC,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,kFAAkF;IACpF,CAAC;IAED,uEAAuE;IACvE,MAAM,WAAW,GACd,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAyC,IAAI,EAAE,CAAC;IAC/E,MAAM,cAAc,GAAG,UAAU,CAAC,eAAe,CAAC,WAAW,CAAC,CAE7D,CAAC;IAEF,8CAA8C;IAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,QAAQ;QAC9B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;KAC/B,CAAC,CAAC;IAEH,wDAAwD;IACxD,MAAM,IAAI,GAAe;QACvB,UAAU,EAAE,kBAAkB;QAC9B,UAAU,EAAE,IAAI;QAEhB,GAAG,CAAC,GAAW;YACb,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAc,EAAE,OAAe;YACnC,oEAAoE;YACpE,0CAA0C;YAC1C,KAAK,CAAC;gBACJ,MAAM,EAAE,UAAU,IAAI,IAAI,MAAM,EAAE;gBAClC,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,IAAI;gBACf,OAAO;gBACP,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ;YACV,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,IAAI,IAAI;YACN,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,IAAI,OAAO;YACT,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IAEF,4EAA4E;IAC5E,qEAAqE;IACrE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAe,CAAC;AAC3C,CAAC"}