@cofoundr/init 1.5.0

package/src/commands/remove.mjs

@@ -0,0 +1,89 @@
+import { resolve, join } from 'node:path';
+import { existsSync, readFileSync, rmSync } from 'node:fs';
+import { c, log } from '../core/log.mjs';
+import { confirm } from '../core/prompts.mjs';
+import { locateSource, loadManifest } from '../core/source.mjs';
+
+const TOOL_PATHS = {
+  'claude-code': ['.claude/commands', '.claude/agents'], // CLAUDE.md is hand-edited; we only strip the cofoundr block via sync. Doctor flags it.
+  cursor: ['.cursor/rules/cofoundr.mdc'],
+  windsurf: ['.windsurf/rules/cofoundr.md', '.windsurfrules'],
+  cline: ['.clinerules/cofoundr.md'],
+  codex: ['.codex/instructions.md'],
+  aider: ['.aider.conf.yml'],
+  copilot: ['.github/copilot-instructions.md'],
+  gemini: ['GEMINI.md'],
+};
+
+export async function remove(opts) {
+  const repoPath = resolve(opts.cwd);
+  const projManPath = join(repoPath, '.cofoundr', 'manifest.json');
+  if (!existsSync(projManPath)) {
+    log.err('No CoFoundr install detected here.');
+    process.exitCode = 1;
+    return;
+  }
+
+  const projMan = JSON.parse(readFileSync(projManPath, 'utf8'));
+  const source = await locateSource();
+  const manifest = await loadManifest(source);
+
+  log.warn(`This will remove tool shims for: ${projMan.tools.join(', ')}`);
+  if (opts.hard) {
+    log.warn(`${c.bold('--hard')} given: also deleting .cofoundr/ entirely (specs/, memory/, reports/ will be lost).`);
+  } else {
+    log.info('Specs, memory, decisions, and reports will be preserved. Pass --hard to wipe them too.');
+  }
+
+  if (!opts.yes) {
+    const ok = await confirm('Continue?', { defaultYes: false });
+    if (!ok) {
+      log.info('Cancelled.');
+      return;
+    }
+  }
+
+  // Per-tool shims.
+  const removed = [];
+  for (const id of projMan.tools) {
+    const paths = TOOL_PATHS[id] || [];
+    for (const rel of paths) {
+      const abs = join(repoPath, rel);
+      if (!existsSync(abs)) continue;
+      if (!opts.dryRun) rmSync(abs, { recursive: true, force: true });
+      removed.push(rel);
+    }
+  }
+
+  // Always-written shim files.
+  for (const rel of ['AGENTS.md']) {
+    // Don't remove AGENTS.md — it may have been hand-edited and is widely useful even without CoFoundr.
+    // Doctor will note its presence; user can delete manually if they really want to.
+  }
+
+  if (opts.hard) {
+    const dir = join(repoPath, '.cofoundr');
+    if (existsSync(dir) && !opts.dryRun) rmSync(dir, { recursive: true, force: true });
+    removed.push('.cofoundr/');
+  } else {
+    // Soft remove: keep memory/, specs/, reports/. Wipe commands/, agents/, templates/, README.md, manifest.json, constitution.md? Keep constitution — it's user content.
+    for (const rel of [
+      '.cofoundr/commands',
+      '.cofoundr/agents',
+      '.cofoundr/templates',
+      '.cofoundr/manifest.json',
+      '.cofoundr/README.md',
+    ]) {
+      const abs = join(repoPath, rel);
+      if (!existsSync(abs)) continue;
+      if (!opts.dryRun) rmSync(abs, { recursive: true, force: true });
+      removed.push(rel);
+    }
+  }
+
+  log.blank();
+  log.ok(`Removed ${removed.length} path(s):`);
+  for (const r of removed) log.list(r);
+  log.blank();
+  log.info(c.dim('AGENTS.md was preserved (it is useful even without CoFoundr). Delete it manually if you want to.'));
+}

package/src/commands/sync.mjs

@@ -0,0 +1,81 @@
+import { resolve, join, basename } from 'node:path';
+import { existsSync, readFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { c, log } from '../core/log.mjs';
+import { locateSource, loadManifest } from '../core/source.mjs';
+import { adapters, getAdapter } from '../adapters/index.mjs';
+import { writeScaffold, writeProjectManifest } from '../core/scaffold.mjs';
+
+export async function sync(opts) {
+  const repoPath = resolve(opts.cwd);
+  const projManPath = join(repoPath, '.cofoundr', 'manifest.json');
+
+  if (!existsSync(projManPath)) {
+    throw new Error(
+      `No CoFoundr install at ${repoPath}. Run \`npx @cofoundr/init init\` first.`
+    );
+  }
+
+  const projMan = JSON.parse(await readFile(projManPath, 'utf8'));
+  const source = await locateSource();
+  const manifest = await loadManifest(source);
+
+  log.info(
+    `${c.bold('CoFoundr sync')} ${c.dim(`→ ${repoPath}`)}\n  ${c.dim(
+      `current: v${projMan.cofoundrVersion} → latest: v${manifest.version}`
+    )}`
+  );
+
+  let selected;
+  if (opts.allTools) {
+    selected = adapters.map((a) => a.id);
+  } else if (opts.tools) {
+    selected = opts.tools;
+  } else {
+    selected = projMan.tools && projMan.tools.length ? projMan.tools : adapters.map((a) => a.id);
+  }
+
+  // Sync rewrites everything by design — opt out of skip-on-exists.
+  const writeOpts = { dryRun: opts.dryRun, force: true };
+
+  log.step('Refreshing scaffold (.cofoundr/, AGENTS.md)');
+  const scaffold = await writeScaffold({
+    repoPath,
+    source,
+    manifest,
+    projectName: deriveProjectName(repoPath),
+    selectedTools: selected,
+    dryRun: writeOpts.dryRun,
+    force: true,
+  });
+  reportFileResult(scaffold);
+
+  for (const id of selected) {
+    const adapter = getAdapter(id);
+    if (!adapter) {
+      log.warn(`No adapter for "${id}" — skipping.`);
+      continue;
+    }
+    log.step(`Refreshing ${c.bold(adapter.name)} shim`);
+    const result = await adapter.apply({ repoPath, source, manifest, opts: writeOpts });
+    reportFileResult(result);
+  }
+
+  await writeProjectManifest({ repoPath, manifest, selectedTools: selected, dryRun: opts.dryRun });
+
+  log.blank();
+  log.ok(`Sync complete. CoFoundr v${manifest.version}.`);
+}
+
+function deriveProjectName(repoPath) {
+  try {
+    const pkg = JSON.parse(readFileSync(join(repoPath, 'package.json'), 'utf8'));
+    if (pkg.name) return pkg.name;
+  } catch {}
+  return basename(repoPath);
+}
+
+function reportFileResult({ written, skipped }) {
+  for (const p of written) log.ok(c.dim(p));
+  for (const s of skipped) log.list(c.dim(`${s.path} (${s.reason})`));
+}

package/src/core/detect.mjs

@@ -0,0 +1,121 @@
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+// Each adapter contributes its own detect signals; this module runs them in parallel
+// against the target repo and returns a stable list of detection results.
+
+export const DETECT_SIGNALS = {
+  'claude-code': [
+    '.claude',
+    '.claude/commands',
+    '.claude/agents',
+    '.claude/skills',
+    'CLAUDE.md',
+    '.claude-plugin',
+  ],
+  cursor: ['.cursor', '.cursor/rules', '.cursorrules'],
+  windsurf: ['.windsurf', '.windsurf/rules', '.windsurfrules'],
+  cline: ['.clinerules', '.roo'],
+  codex: ['AGENTS.md', '.codex'],
+  aider: ['.aider.conf.yml', '.aider.conf.yaml', '.aider'],
+  copilot: ['.github/copilot-instructions.md'],
+  gemini: ['GEMINI.md', '.gemini'],
+};
+
+export function detectTools(repoPath) {
+  const out = {};
+  for (const [tool, signals] of Object.entries(DETECT_SIGNALS)) {
+    const evidence = signals.filter((s) => existsSync(join(repoPath, s)));
+    out[tool] = { found: evidence.length > 0, evidence };
+  }
+  return out;
+}
+
+export function detectRuntime(repoPath) {
+  // Best-effort: language and framework hints used by `init` and `onboard`.
+  const findings = {
+    languages: [],
+    frameworks: [],
+    packageManagers: [],
+    isMonorepo: false,
+  };
+
+  if (existsSync(join(repoPath, 'package.json'))) findings.languages.push('javascript');
+  if (existsSync(join(repoPath, 'tsconfig.json'))) findings.languages.push('typescript');
+  if (existsSync(join(repoPath, 'pyproject.toml')) || existsSync(join(repoPath, 'requirements.txt')))
+    findings.languages.push('python');
+  if (existsSync(join(repoPath, 'go.mod'))) findings.languages.push('go');
+  if (existsSync(join(repoPath, 'Cargo.toml'))) findings.languages.push('rust');
+  if (existsSync(join(repoPath, 'Gemfile'))) findings.languages.push('ruby');
+  if (existsSync(join(repoPath, 'composer.json'))) findings.languages.push('php');
+
+  if (existsSync(join(repoPath, 'pnpm-workspace.yaml'))) findings.packageManagers.push('pnpm');
+  if (existsSync(join(repoPath, 'pnpm-lock.yaml'))) findings.packageManagers.push('pnpm');
+  if (existsSync(join(repoPath, 'yarn.lock'))) findings.packageManagers.push('yarn');
+  if (existsSync(join(repoPath, 'package-lock.json'))) findings.packageManagers.push('npm');
+  if (existsSync(join(repoPath, 'bun.lockb')) || existsSync(join(repoPath, 'bun.lock')))
+    findings.packageManagers.push('bun');
+  if (existsSync(join(repoPath, 'uv.lock'))) findings.packageManagers.push('uv');
+  if (existsSync(join(repoPath, 'poetry.lock'))) findings.packageManagers.push('poetry');
+
+  if (
+    existsSync(join(repoPath, 'pnpm-workspace.yaml')) ||
+    existsSync(join(repoPath, 'turbo.json')) ||
+    existsSync(join(repoPath, 'lerna.json')) ||
+    (existsSync(join(repoPath, 'packages')) && safeIsDir(join(repoPath, 'packages'))) ||
+    (existsSync(join(repoPath, 'apps')) && safeIsDir(join(repoPath, 'apps')))
+  ) {
+    findings.isMonorepo = true;
+  }
+
+  for (const candidate of [
+    'next.config.ts',
+    'next.config.js',
+    'next.config.mjs',
+    'nuxt.config.ts',
+    'nuxt.config.js',
+    'vite.config.ts',
+    'vite.config.js',
+    'astro.config.mjs',
+    'remix.config.js',
+    'svelte.config.js',
+    'angular.json',
+    'manage.py',
+    'mix.exs',
+  ]) {
+    if (existsSync(join(repoPath, candidate))) findings.frameworks.push(candidate);
+  }
+
+  return findings;
+}
+
+function safeIsDir(p) {
+  try {
+    return statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+export function listTopLevel(repoPath, depth = 2) {
+  const entries = [];
+  walk(repoPath, '', depth, entries);
+  return entries;
+}
+
+function walk(root, rel, depth, acc) {
+  if (depth < 0) return;
+  let items;
+  try {
+    items = readdirSync(join(root, rel), { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const it of items) {
+    if (it.name.startsWith('.git')) continue;
+    if (it.name === 'node_modules' || it.name === '.next' || it.name === 'dist' || it.name === 'build') continue;
+    const sub = rel ? `${rel}/${it.name}` : it.name;
+    acc.push({ path: sub, dir: it.isDirectory() });
+    if (it.isDirectory()) walk(root, sub, depth - 1, acc);
+  }
+}

package/src/core/fs.mjs

@@ -0,0 +1,42 @@
+import { mkdir, writeFile, readFile, stat } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { dirname } from 'node:path';
+
+export async function ensureDir(path) {
+  await mkdir(path, { recursive: true });
+}
+
+export async function writeIfChanged(path, contents, { dryRun = false, force = false } = {}) {
+  if (existsSync(path)) {
+    if (!force) {
+      const existing = await readFile(path, 'utf8');
+      if (existing === contents) return { wrote: false, reason: 'unchanged', path };
+      return { wrote: false, reason: 'exists', path };
+    }
+  }
+  if (dryRun) return { wrote: true, dryRun: true, path };
+  await ensureDir(dirname(path));
+  await writeFile(path, contents, 'utf8');
+  return { wrote: true, path };
+}
+
+export async function writeAlways(path, contents, { dryRun = false } = {}) {
+  if (dryRun) return { wrote: true, dryRun: true, path };
+  await ensureDir(dirname(path));
+  await writeFile(path, contents, 'utf8');
+  return { wrote: true, path };
+}
+
+export async function readIfExists(path) {
+  if (!existsSync(path)) return null;
+  return readFile(path, 'utf8');
+}
+
+export async function pathExists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}

package/src/core/license.mjs

@@ -0,0 +1,170 @@
+// License verification against https://cofoundr.ai/api/licenses/verify.
+//
+// Resolution order (caller picks):
+//   1. --license <key> flag
+//   2. COFOUNDR_LICENSE_KEY env var
+//   3. cached key from ~/.cofoundr/license-cache.json
+//   4. interactive prompt
+//
+// Cache: stores { key, plan, email, verifiedAt }. Within CACHE_TTL_MS of
+// verifiedAt we short-circuit and trust the cached "valid" verdict. Past
+// that, we re-hit the server. The key itself is never re-prompted as long
+// as the cache file exists — even if the server is unreachable.
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+
+const KEY_PATTERN = /^csk_live_[A-Za-z0-9_-]{32}$/;
+const DEFAULT_ENDPOINT = 'https://cofoundr.ai';
+const CACHE_DIR = join(homedir(), '.cofoundr');
+const CACHE_PATH = join(CACHE_DIR, 'license-cache.json');
+const CACHE_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
+
+export const PURCHASE_URL = 'https://cofoundr.ai/starter';
+export const RECOVERY_URL = 'https://cofoundr.ai/account/licenses';
+
+export function isValidLicenseFormat(key) {
+  return typeof key === 'string' && KEY_PATTERN.test(key);
+}
+
+function endpoint() {
+  return process.env.COFOUNDR_LICENSE_ENDPOINT || DEFAULT_ENDPOINT;
+}
+
+function readCache() {
+  try {
+    if (!existsSync(CACHE_PATH)) return null;
+    const raw = readFileSync(CACHE_PATH, 'utf8');
+    const parsed = JSON.parse(raw);
+    if (typeof parsed?.key !== 'string') return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+function writeCache(payload) {
+  try {
+    if (!existsSync(CACHE_DIR)) mkdirSync(CACHE_DIR, { recursive: true });
+    writeFileSync(CACHE_PATH, JSON.stringify(payload, null, 2), { mode: 0o600 });
+    chmodSync(CACHE_PATH, 0o600);
+  } catch {
+    // Cache write failure is non-fatal — verification still succeeded for this run.
+  }
+}
+
+export function getCachedLicense() {
+  return readCache();
+}
+
+export function clearCache() {
+  try {
+    if (existsSync(CACHE_PATH)) writeFileSync(CACHE_PATH, JSON.stringify({}), { mode: 0o600 });
+  } catch {
+    // No-op.
+  }
+}
+
+/**
+ * @param {string} key
+ * @param {{ fetchImpl?: typeof fetch, skipCache?: boolean }} [opts]
+ * @returns {Promise<{ valid: true, plan: string, email: string, source: 'cache'|'server' }
+ *                 | { valid: false, reason: 'malformed'|'not_found'|'not_authorized'|'refunded'|'revoked'|'network' }>}
+ */
+export async function verifyLicense(key, opts = {}) {
+  if (!isValidLicenseFormat(key)) {
+    return { valid: false, reason: 'malformed' };
+  }
+
+  if (!opts.skipCache) {
+    const cached = readCache();
+    if (
+      cached &&
+      cached.key === key &&
+      typeof cached.verifiedAt === 'number' &&
+      Date.now() - cached.verifiedAt < CACHE_TTL_MS
+    ) {
+      return {
+        valid: true,
+        plan: cached.plan || 'starter_kit',
+        email: cached.email || '',
+        source: 'cache',
+      };
+    }
+  }
+
+  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== 'function') {
+    // No fetch available (very old Node) — fall through to cache-or-fail.
+    const cached = readCache();
+    if (cached && cached.key === key) {
+      return { valid: true, plan: cached.plan || 'starter_kit', email: cached.email || '', source: 'cache' };
+    }
+    return { valid: false, reason: 'network' };
+  }
+
+  let res;
+  try {
+    res = await fetchImpl(`${endpoint()}/api/licenses/verify`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ license: key }),
+    });
+  } catch {
+    // Network failure — fall back to cache if we have any record of this key.
+    const cached = readCache();
+    if (cached && cached.key === key) {
+      return { valid: true, plan: cached.plan || 'starter_kit', email: cached.email || '', source: 'cache' };
+    }
+    return { valid: false, reason: 'network' };
+  }
+
+  if (!res.ok) {
+    if (res.status === 429) return { valid: false, reason: 'network' };
+    return { valid: false, reason: 'network' };
+  }
+
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    return { valid: false, reason: 'network' };
+  }
+
+  if (body?.valid === true) {
+    writeCache({
+      key,
+      plan: body.plan,
+      email: body.email,
+      verifiedAt: Date.now(),
+    });
+    return { valid: true, plan: body.plan, email: body.email, source: 'server' };
+  }
+
+  // Server-flagged invalid: clear cache for this key so subsequent runs don't
+  // resurrect a revoked key from an old cache entry.
+  const cached = readCache();
+  if (cached?.key === key) clearCache();
+
+  return { valid: false, reason: body?.reason || 'not_found' };
+}
+
+export function reasonMessage(reason) {
+  switch (reason) {
+    case 'malformed':
+      return 'The license key format is invalid. Expected: csk_live_<32 chars>.';
+    case 'not_found':
+      return 'This license key is not recognised. Double-check the key, or recover it at ' + RECOVERY_URL + '.';
+    case 'not_authorized':
+      return 'This key is not authorized for the Starter Kit. Buy at ' + PURCHASE_URL + '.';
+    case 'refunded':
+      return 'This license was refunded and is no longer active.';
+    case 'revoked':
+      return 'This license has been revoked. Contact contact@cofoundr.ai if you think this is a mistake.';
+    case 'network':
+      return 'Could not reach the license server. Check your connection and try again.';
+    default:
+      return 'License verification failed.';
+  }
+}

package/src/core/log.mjs

@@ -0,0 +1,32 @@
+// Zero-dep ANSI helpers. Honors NO_COLOR.
+
+const enabled = !process.env.NO_COLOR && process.stdout.isTTY !== false;
+
+function wrap(open, close) {
+  return (s) => (enabled ? `\x1b[${open}m${s}\x1b[${close}m` : String(s));
+}
+
+export const c = {
+  bold: wrap(1, 22),
+  dim: wrap(2, 22),
+  red: wrap(31, 39),
+  green: wrap(32, 39),
+  yellow: wrap(33, 39),
+  blue: wrap(34, 39),
+  magenta: wrap(35, 39),
+  cyan: wrap(36, 39),
+  gray: wrap(90, 39),
+};
+
+export const log = {
+  info: (msg) => process.stdout.write(`${msg}\n`),
+  ok: (msg) => process.stdout.write(`${c.green('✓')} ${msg}\n`),
+  warn: (msg) => process.stdout.write(`${c.yellow('!')} ${msg}\n`),
+  err: (msg) => process.stderr.write(`${c.red('✗')} ${msg}\n`),
+  step: (msg) => process.stdout.write(`${c.cyan('›')} ${msg}\n`),
+  list: (msg) => process.stdout.write(`  ${c.dim('•')} ${msg}\n`),
+  blank: () => process.stdout.write('\n'),
+  debug: (msg) => {
+    if (process.env.COFOUNDR_DEBUG) process.stderr.write(`${c.gray('[debug]')} ${msg}\n`);
+  },
+};

package/src/core/prompts.mjs

@@ -0,0 +1,62 @@
+// Tiny zero-dep prompt helpers built on readline/promises.
+
+import { createInterface } from 'node:readline/promises';
+import { stdin as input, stdout as output } from 'node:process';
+import { c } from './log.mjs';
+
+export async function confirm(question, { defaultYes = true } = {}) {
+  if (!input.isTTY) return defaultYes;
+  const rl = createInterface({ input, output });
+  try {
+    const hint = defaultYes ? 'Y/n' : 'y/N';
+    const ans = (await rl.question(`${c.cyan('?')} ${question} ${c.dim(`(${hint}) `)}`)).trim().toLowerCase();
+    if (!ans) return defaultYes;
+    return ans === 'y' || ans === 'yes';
+  } finally {
+    rl.close();
+  }
+}
+
+export async function text(question, { defaultValue = '' } = {}) {
+  if (!input.isTTY) return defaultValue;
+  const rl = createInterface({ input, output });
+  try {
+    const hint = defaultValue ? c.dim(` (${defaultValue})`) : '';
+    const ans = (await rl.question(`${c.cyan('?')} ${question}${hint} `)).trim();
+    return ans || defaultValue;
+  } finally {
+    rl.close();
+  }
+}
+
+/**
+ * Multi-select via space-separated indices or "all" / "none".
+ * Returns an array of ids in the original order.
+ */
+export async function multiSelect(question, items, { defaults = [] } = {}) {
+  if (!input.isTTY) return defaults;
+  process.stdout.write(`${c.cyan('?')} ${question}\n`);
+  items.forEach((it, idx) => {
+    const marker = defaults.includes(it.id) ? c.green('✓') : ' ';
+    const sub = it.note ? c.dim(`  — ${it.note}`) : '';
+    process.stdout.write(`  ${marker} ${c.bold(String(idx + 1).padStart(2, ' '))}. ${it.label}${sub}\n`);
+  });
+  process.stdout.write(
+    `${c.dim('  Enter numbers separated by space (e.g. "1 3 5"), "all", "none", or just press Enter for the defaults.')}\n`
+  );
+
+  const rl = createInterface({ input, output });
+  try {
+    const raw = (await rl.question('  > ')).trim().toLowerCase();
+    if (!raw) return defaults;
+    if (raw === 'all') return items.map((it) => it.id);
+    if (raw === 'none') return [];
+    const idxs = raw
+      .split(/[,\s]+/)
+      .map((s) => parseInt(s, 10) - 1)
+      .filter((n) => !Number.isNaN(n) && n >= 0 && n < items.length);
+    return idxs.map((i) => items[i].id);
+  } finally {
+    rl.close();
+  }
+}