@bunshin-cc/bunshin 0.1.0 → 0.1.2

package/README.md

@@ -14,7 +14,9 @@ bunshin setup --harness codex
 
 In Bunshin, open **Agent keys** and create a key for this computer. Paste it into the hidden setup prompt. Setup reads your role, team, and permissions from the workspace, saves the key in a private file outside the project, and configures four project hooks. It does not need a separate model API key.
 
-Open a new Codex session in the same project, run `/hooks`, and review and trust the four Bunshin hooks. For Claude Code, use `bunshin setup --harness claude-code`, then start a new session in the project.
+Run `codex` interactively in the same project. Review and accept its project trust prompt, then run `/hooks` and review and trust the four Bunshin hooks. Project trust and hook trust are separate steps. If `/hooks` does not list Bunshin, check that you opened the connected project and trusted its configuration. This guide tests interactive sessions; `codex exec` is not a substitute for this setup check.
+
+For Claude Code, use `bunshin setup --harness claude-code`, then start a new session in the project.
 
 For Pi, use Node.js 22.19 or later and run `bunshin setup --harness pi`. It installs a project extension in `.pi/extensions/bunshin.js`. Start Pi in the project (or run `/reload` in an existing session), review its project resources, and check `/bunshin status`. The extension ships in this npm package; you do not need a second package or a repository checkout.
 

package/dist/bin.js

@@ -753,9 +753,9 @@ function mergeClaudeSettings(settings, { bin = "bunshin", harness = "claude-code
   for (const { event, arg, timeout } of HOOK_EVENTS) {
     const groups = Array.isArray(hooks[event]) ? [...hooks[event]] : [];
     const hook = bunshinHookEntry(arg, timeout, bin);
+    hook.command = `BUNSHIN_HARNESS=${harness} ${hook.command}`;
     if (harness === "codex") {
       delete hook._bunshin;
-      hook.command = `BUNSHIN_HARNESS=codex ${hook.command}`;
       if (event === "UserPromptSubmit") {
         hook.async = true;
         hook.timeout = 30;
@@ -957,7 +957,7 @@ async function connectionProfile(apiUrl, apiKey) {
   if (!response.ok) throw new Error(`Bunshin returned HTTP ${response.status}. No connection settings were changed.`);
   const body = await response.json();
   const profile = body.profile;
-  if (!profile || ![profile.orgId, profile.userId, profile.role, profile.orgUnit].every((value) => typeof value === "string" && value.length > 0) || !["public", "org", "department", "team", "leadership", "csuite", "private"].includes(profile.clearance) || !Array.isArray(profile.responsibilities) || !profile.responsibilities.every((value) => typeof value === "string")) {
+  if (!profile || ![profile.orgId, profile.userId, profile.role].every((value) => typeof value === "string" && value.length > 0) || typeof profile.orgUnit !== "string" || !["public", "org", "department", "team", "leadership", "csuite", "private"].includes(profile.clearance) || !Array.isArray(profile.responsibilities) || !profile.responsibilities.every((value) => typeof value === "string")) {
     throw new Error("Bunshin returned an incomplete profile. No connection settings were changed.");
   }
   return profile;
@@ -1861,6 +1861,8 @@ var init_prompts = __esm({
 
 2. IS THERE A REUSABLE WORKFLOW? If the session carried out a multi-step, end-to-end procedure that someone would plausibly need to repeat (release, migration, end-to-end test of a ticket, onboarding a service, an incident runbook), emit a WORKFLOW lesson: preconditions, ordered imperative steps each with how to verify it succeeded, and what "done" looks like. Write the steps so an agent with no memory of this session could execute them reliably; include exact commands, paths and checks where they were shown. Otherwise emit FACT lessons: short, one idea each, the trap and the fix.
 
+Workflow evidence is mandatory. Include verificationEvidence: exact, contiguous quotes from successful TOOL RESULT output in this excerpt showing that the procedure's checks actually ran. A user request, a plan, code printed in an answer, a tool invocation without its result, or the assistant saying "done" is not execution evidence. Do not turn a proposed procedure into a workflow, even if the proposal gives exact paths and commands. Every workflow needs at least two steps, a verification check for every step, and an explicit outcome. Without observed verification, omit the workflow. You may save a useful human-stated requirement or reported process as a FACT, clearly attributed as such; never imply that requested files already exist or that planned checks passed.
+
 3. ATTRIBUTION. For every served lesson listed, decide whether the agent ACTUALLY USED it. Default is false. On-topic is not used. Used means the agent's behaviour visibly depended on it: it followed the workflow, avoided the trap, cited the fact, chose differently because of it. Classify each served lesson exactly one way: used, irrelevant (did not apply to this task), redundant (applied but the agent already knew or the repo showed it), relevant-but-ignored (applied and would have helped, agent did not act on it). Then list MISSED lessons: ids from the full index that were relevant and would have helped but were not served.
 
 Also give the session an outcome (success / failure / unknown) and whether the user had to correct the agent.
@@ -1902,7 +1904,8 @@ Content rules: write lessons for a stranger, name systems and teams explicitly,
               preconditions: { type: "array", items: { type: "string" } },
               steps: { type: "array", items: workflowStep },
               outcome: { type: "string" },
-              estimatedMinutes: { type: "integer" }
+              estimatedMinutes: { type: "integer" },
+              verificationEvidence: { type: "array", items: { type: "string" }, description: "For workflows, exact quotes from successful tool results showing completed verification. Not user requests or assistant claims." }
             }
           }
         },
@@ -2433,13 +2436,42 @@ async function reflectSession(store, opts) {
     return { ...empty, skipped: res.error };
   }
   const out = res.value;
-  const lessonIds = out.lessons.map((raw) => store.saveLesson(buildLesson(raw, store, opts), { reindex: false }).id);
+  const lessonIds = [];
+  for (const raw of out.lessons) {
+    const rejection = workflowRejection(raw, facts, excerpt);
+    if (rejection) {
+      store.log("reflect-workflow-rejected", { session: opts.sessionId, title: redact(raw.title), reason: rejection });
+      continue;
+    }
+    const lesson = store.saveLesson(buildLesson(raw, store, opts), { reindex: false });
+    lessonIds.push(lesson.id);
+    if (lesson.kind === "workflow") store.appendTraceEvent(opts.sessionId, {
+      type: "workflow-evidence",
+      lessonId: lesson.id,
+      quotes: raw.verificationEvidence.map(redact)
+    });
+  }
   const { used, missed } = applyAttribution(store, opts.sessionId, out, served);
   store.rebuildIndex();
   store.writeSession(opts.sessionId, { ...store.readSession(opts.sessionId), reflectedMessages: facts.turns.length, lastReflectAt: nowIso() });
   store.log("reflect", { session: opts.sessionId, lessons: lessonIds, used, missed, outcome: out.outcome, corrected: out.corrected });
   return { lessonIds, used, missed, attribution: out.attribution ?? [] };
 }
+function workflowRejection(raw, facts, excerpt) {
+  if (raw.kind !== "workflow") return;
+  if (!Array.isArray(raw.steps) || raw.steps.length < 2 || raw.steps.some((step) => !step.action?.trim() || !step.verify?.trim()) || !raw.outcome?.trim()) {
+    return "workflow requires two steps, per-step checks, and an outcome";
+  }
+  const normalize = (text) => redact(text).replace(/\s+/g, " ").trim();
+  const visible = normalize(excerpt);
+  const results = facts.turns.filter((turn) => turn.role === "tool" && turn.tool === "result" && !turn.isError).map((turn) => normalize(turn.text));
+  const evidence = raw.verificationEvidence;
+  if (!Array.isArray(evidence) || !evidence.length || evidence.some((quote) => {
+    if (typeof quote !== "string") return true;
+    const text = normalize(quote);
+    return !text || !visible.includes(text) || !results.some((result) => result.includes(text));
+  })) return "workflow requires matching verification evidence from successful tool results";
+}
 function countFacts(turns) {
   return {
     turns,
@@ -3026,7 +3058,7 @@ async function main(argv, opts = {}) {
       }) : process.env.BUNSHIN_API_KEY || (!apiUrl || apiUrl === existing.apiUrl) && existing.apiKey || await readKey2();
       out("Connecting to Bunshin\u2026\n");
       const result = await setupProject2({ cwd, harness, apiKey: key, apiUrl, noHooks: bool(args.flags["no-hooks"]) });
-      out(`Connected as ${result.profile.role} in ${result.profile.orgUnit}.
+      out(`Connected as ${result.profile.role}${result.profile.orgUnit ? ` in ${result.profile.orgUnit}` : " (company-wide)"}.
 `);
       out(`Project: ${cwd}
 Key saved privately outside the project.
@@ -3034,7 +3066,7 @@ Key saved privately outside the project.
       if (result.hooks?.error) throw new Error(`Connected, but hooks could not be configured: ${result.hooks.error}. Fix the file and run setup again.`);
       if (result.hooks) out(`${result.hooks.installed} ${harness === "pi" ? "extension" : "hooks"} configured in ${result.hooks.file}
 `);
-      if (harness === "codex" && result.hooks) out("Open a new Codex session in this project, run /hooks, and review and trust the four Bunshin hooks.\n");
+      if (harness === "codex" && result.hooks) out("Run codex interactively in this project. Review and accept project trust, then run /hooks and review and trust the four Bunshin hooks.\n");
       else if (harness === "pi" && result.hooks) out("Open Pi in this project and approve its project extension. Check it with /bunshin status.\n");
       else if (result.hooks) out("Open a new Claude Code session in this project to load the hooks.\n");
       else out("Hooks are disabled. Run setup again without --no-hooks to configure them.\n");
@@ -3054,7 +3086,7 @@ Key saved privately outside the project.
   }
   const store = openStore(args, cwd);
   if (!store) {
-    err("bunshin: no .bunshin store found. Run `bunshin init` first.\n");
+    err("bunshin: this project is not connected. Run `bunshin setup --harness codex` (or use --harness claude-code / --harness pi). For offline use, run `bunshin init`.\n");
     return 1;
   }
   try {
@@ -3138,7 +3170,7 @@ async function cmdInit(args, cwd, out, err) {
     if (result.hooks.error) err(`  hooks:    ${result.hooks.error}
 `);
   }
-  if (result.config.harness === "codex" && result.hooks?.installed) out("\nOpen a new Codex session, run /hooks, and review and trust the four Bunshin hooks.\n");
+  if (result.config.harness === "codex" && result.hooks?.installed) out("\nRun codex interactively in this project. Review and accept project trust, then run /hooks and review and trust the four Bunshin hooks.\n");
   if (!result.config.apiUrl) out("\nTo connect this project to your workspace, run `bunshin setup --harness " + result.config.harness + "`.\n");
   for (const w of result.warnings) err(`! ${w}
 `);
@@ -3172,7 +3204,7 @@ function cmdStatus(store, args, out) {
     mothership: config.apiUrl ? { apiUrl: config.apiUrl, key: config.apiKey ? "set" : "missing", lastSyncAt: config.lastSyncAt ?? null } : null,
     llmBackend: resolveBackend(config) ?? "none (set ANTHROPIC_API_KEY or install the claude/codex CLI)",
     hooks: { [config.harness]: hooks },
-    hookFiles,
+    hookFiles: hookFiles.filter((file) => fs9.existsSync(file)),
     recallQuality: last50 ? { precision: last50.precision, recall: last50.recall, f1: last50.f1, traces: last50.traces } : null
   };
   if (bool(args.flags.json)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bunshin-cc/bunshin",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Shared memory for company AI agents. Connect Codex, Claude Code, or Pi to Bunshin.",
   "type": "module",
   "bin": {
@@ -14,6 +14,13 @@
   "engines": {
     "node": ">=20"
   },
+  "scripts": {
+    "build": "tsc -p tsconfig.json --noEmit && esbuild src/bin.ts --bundle --platform=node --target=node20 --format=esm --external:@anthropic-ai/sdk --external:yaml --outfile=dist/bin.js && esbuild ../../adapters/pi/index.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/pi-extension.js",
+    "dev": "tsx src/bin.ts",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "prepack": "pnpm build"
+  },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.127.0",
     "yaml": "^2.8.0"
@@ -24,7 +31,7 @@
     "tsx": "^4.20.0",
     "typescript": "^5.8.0",
     "vitest": "^3.2.0",
-    "@bunshin/core": "0.1.0"
+    "@bunshin/core": "workspace:*"
   },
   "license": "MIT",
   "homepage": "https://bunshin.cc",
@@ -47,11 +54,5 @@
     "claude-code",
     "memory",
     "knowledge"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json --noEmit && esbuild src/bin.ts --bundle --platform=node --target=node20 --format=esm --external:@anthropic-ai/sdk --external:yaml --outfile=dist/bin.js && esbuild ../../adapters/pi/index.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/pi-extension.js",
-    "dev": "tsx src/bin.ts",
-    "test": "vitest run",
-    "typecheck": "tsc -p tsconfig.json --noEmit"
-  }
-}
+  ]
+}