@compr/opscontext-mcp 2.1.1 → 2.1.3

package/dist/cli.js

@@ -503,6 +503,12 @@ async function runInit() {
         console.log("  2. Start a Copilot chat — ContextEngine tools are now available");
         console.log("  3. Run `contextengine score` to get your AI-readiness baseline");
         console.log("");
+        // Browser-capture nudge — fires once, never blocks init
+        const extensionSecretPath = join(homedir(), ".contextengine", "extension-secret");
+        if (!existsSync(extensionSecretPath)) {
+            console.log("  💡 Next: run `opscontext init-extension-secret` to enable browser capture from Claude.ai and ChatGPT.");
+            console.log("");
+        }
     }
     finally {
         rl.close();
@@ -520,9 +526,10 @@ import { listProjects, runComplianceAudit, formatProjectList, formatPlan, scoreP
 import { listLearnings, learningsToChunks, learningsStats, formatLearnings, saveLearning, deleteLearning, importLearningsFromFile, autoImportFromSources, LEARNING_CATEGORIES, } from "./learnings.js";
 import { saveSession, loadSession, listSessions, deleteSession, formatSession, formatSessionList, } from "./sessions.js";
 import { activate, deactivate, getActivationStatus, gateCheck, } from "./activation.js";
+import { syncTierA, syncTierB, loadCommunityStore, communityRulesToChunks, mergeWithDedup, STORE_PATH as COMMUNITY_STORE_PATH, } from "./community-sync.js";
 import { readAuditLog, verifyChain, filterByRange, toCsv, } from "./audit.js";
 import { loadRepoPolicy, parsePolicy, formatPolicySummary, formatValidationErrors, repoPolicyPath, } from "./policy.js";
-import { getStagedFiles, runSecretScan, runDocCoverage, formatSecretViolations, formatDocCoverageViolations, formatSecretViolationsJson, formatDocCoverageViolationsJson, } from "./hooks.js";
+import { getStagedFiles, runSecretScan, runDocCoverage, runCommitMessageRequired, formatSecretViolations, formatDocCoverageViolations, formatSecretViolationsJson, formatDocCoverageViolationsJson, formatCommitMessageViolations, formatCommitMessageViolationsJson, } from "./hooks.js";
 import { safeAppend } from "./audit.js";
 import { installSkill, locateBundledSkill, buildManagedBlock, syncClaudeMd, } from "./claude-integration.js";
 import { fileURLToPath } from "url";
@@ -537,7 +544,7 @@ const isNonInteractive = !process.stdin.isTTY || process.argv.includes("--yes")
  */
 async function initEngine() {
     const sources = loadSources();
-    const chunks = ingestSources(sources);
+    let chunks = ingestSources(sources);
     const config = loadConfig();
     const projectDirs = loadProjectDirs();
     // Collect operational data
@@ -567,6 +574,16 @@ async function initEngine() {
     const projectNames = projectDirs.map((d) => d.name);
     const learningChunks = learningsToChunks(projectNames);
     chunks.push(...learningChunks);
+    // Inject community rules (Tier A public + Tier B Pro), deduped against
+    // the local Learnings Store so identical content doesn't double-emit.
+    // Network is NOT touched here — only the cached store at
+    // ~/.contextengine/community-learnings.json is read. Use the
+    // `sync-community-rules` subcommand to refresh the cache.
+    const communityChunks = communityRulesToChunks();
+    if (communityChunks.length > 0) {
+        const localChunks = chunks;
+        chunks = mergeWithDedup(localChunks, communityChunks);
+    }
     return { sources, chunks };
 }
 // ---------------------------------------------------------------------------
@@ -828,6 +845,9 @@ async function cliExportLearnings(args) {
     let category;
     let format = "json";
     let universalToo = false;
+    let tier;
+    let outputPath;
+    let review = false;
     for (let i = 0; i < args.length; i++) {
         const a = args[i];
         if ((a === "--project" || a === "-p") && args[i + 1]) {
@@ -851,25 +871,114 @@ async function cliExportLearnings(args) {
             universalToo = true;
             continue;
         }
+        if (a === "--tier" && args[i + 1]) {
+            const t = args[++i];
+            if (t !== "A" && t !== "B") {
+                console.error(`Unknown tier: ${t}. Supported: A, B.`);
+                process.exit(1);
+            }
+            tier = t;
+            continue;
+        }
+        if ((a === "--output" || a === "-o") && args[i + 1]) {
+            outputPath = args[++i];
+            continue;
+        }
+        if (a === "--review") {
+            review = true;
+            continue;
+        }
         if (a === "-h" || a === "--help") {
-            console.log(`Usage: contextengine export-learnings [--project NAME] [--category CAT] [--format json|markdown] [--include-universal]
+            console.log(`Usage: contextengine export-learnings [--tier A|B] [--output PATH] [--review]
+                                       [--project NAME] [--category CAT]
+                                       [--format json|markdown] [--include-universal]
+
+TWO MODES:
 
-Exports learnings as JSON or Markdown. Use --project to scope to a single
-project's learnings (essential for consultants who share artifacts with
-clients — the universal store mixes all projects together by default).
+  1) Legacy raw export — no --tier flag. Writes the raw, unredacted store
+     filtered by --project / --category. Use only for personal backups or
+     when sharing inside a trusted team. NOT safe for public distribution.
 
-  --project NAME         Only learnings tagged with this project (case-insensitive)
+  2) Tier-aware redacted export — pass --tier A or --tier B.
+
+       --tier A   MIT-publishable subset. Pipeline:
+                    a) Reuses the secret/PII patterns from
+                       chrome-extension/src/content/shared/redact.ts
+                       (cloud-vendor credential shapes, JWT, bearer
+                       tokens, SSH private-key blocks, generic
+                       credential-assignment patterns).
+                    b) Strips PII: emails → [EMAIL], phone digits →
+                       [PHONE], credit-card-shape → [CC].
+                    c) Strips personal identifiers ("yannick", "yan",
+                       "compr.ch/.fr") and project brand names
+                       (CROWLR / KONIVE / INVOC / PLANK / COMPR / FASTPROD)
+                       → [project]. Local /Users/yan/Projects/* paths
+                       become /workspace/*. api.compr.ch → [SERVER].
+                    d) Filters to allow-list categories
+                       (debugging / tooling / git / frontend / testing /
+                       dependencies / performance / other). Drops
+                       security / deployment / infrastructure / devops
+                       unless the entry is tagged 'safe' (manual vet).
+                    e) Hashes IDs and project names — co-clustering
+                       survives but local UUIDs and brand names do not.
+                  Safety contract enforced by the LOCK comment block at
+                  the top of src/community-export.ts. Do NOT relax the
+                  redactor without re-running the full test suite.
+
+       --tier B   Full corpus for PRO subscribers (api.compr.ch heartbeat).
+                  Still redacted for secrets + PII (the redactor handles
+                  that), but security/deployment learnings are INCLUDED
+                  and original IDs are preserved (authenticated surface).
+
+       --output PATH   Where to write the JSON. Default:
+                       ./learnings-export-tierA.json / -tierB.json.
+       --review        Open \$EDITOR (or vi) on the export JSON for a
+                       manual trim before final write. Skipped if stdin
+                       is not a TTY.
+
+Legacy flags (no --tier):
+  --project NAME         Only learnings tagged with this project
   --category CAT         Only this category (deployment, security, etc.)
   --format json|markdown Output format (default: json)
-  --include-universal    Also include unscoped learnings (project=undefined)
-                         alongside the project-filtered ones
+  --include-universal    Also include unscoped learnings
 
-Cross-client confidentiality: without --project, this exports the FULL store.
-Always use --project NAME when sharing exported learnings with anyone outside
-the owning project's team.`);
+Cross-client confidentiality: without --tier and without --project, this
+exports the FULL raw store. Always use --tier A for public sharing, or
+--project NAME for trusted-team sharing inside one engagement.`);
             return;
         }
     }
+    // Tier-aware sanitized export path.
+    if (tier) {
+        const { exportLearnings, reviewLoop } = await import("./community-export.js");
+        const out = outputPath || join(process.cwd(), `learnings-export-tier${tier}.json`);
+        let result = exportLearnings({ tier, outputPath: out, review });
+        if (review) {
+            const edited = await reviewLoop(result.rules);
+            const payload = {
+                version: 1,
+                tier,
+                generatedAt: new Date().toISOString(),
+                count: edited.length,
+                dropped: result.dropped + (result.count - edited.length),
+                rules: edited,
+            };
+            writeFileSync(out, JSON.stringify(payload, null, 2) + "\n", "utf-8");
+            result = { ...result, count: edited.length, rules: edited };
+        }
+        console.log(`✅ Tier ${tier} export written to ${out}`);
+        console.log(`   Included: ${result.count}`);
+        console.log(`   Dropped:  ${result.dropped}`);
+        if (tier === "A") {
+            console.log(`   Note: Tier A is MIT-publishable. Safety guarantees enforced by`);
+            console.log(`         the LOCK [COMMUNITY-EXPORT-SAFETY] block in src/community-export.ts.`);
+        }
+        else {
+            console.log(`   Note: Tier B is PRO-only. Distribute via the api.compr.ch`);
+            console.log(`         license heartbeat, never via a public mirror.`);
+        }
+        return;
+    }
     let all = listLearnings(category);
     if (project) {
         const lower = project.toLowerCase();
@@ -941,7 +1050,7 @@ async function cliAuditExport(args) {
             continue;
         }
         if (a === "-h" || a === "--help") {
-            console.log(`Usage: contextengine audit-export [--since ISO_DATE] [--until ISO_DATE] [--format jsonl|csv]\n\nExports the hash-chained audit log from ~/.contextengine/audit.log.\nCompliance use: SOC2 CC7.2, ISO 27001 A.12.4.1.`);
+            console.log(`Usage: contextengine audit-export [--since ISO_DATE] [--until ISO_DATE] [--format jsonl|csv]\n\nExports the hash-chained audit log from ~/.contextengine/audit.log.\nCompliance use: produces evidence aligned with SOC 2 CC7.2 + ISO 27001 A.12.4.1\n(evidence artifacts — OpsContext is not itself certified; see docs/compliance/).`);
             return;
         }
     }
@@ -1118,6 +1227,23 @@ Subcommands:
   doc-coverage   For each policy.doc_coverage rule, check whether the
                  commit touches matching source paths AND the required
                  doc section is staged. Exit 1 on blocking violations.
+  commit-message-required [MSG_FILE]
+                 For each policy.commit_message_required rule, check
+                 whether the commit touches matching source paths AND
+                 the commit message matches the required pattern. Exit 1
+                 on blocking violations. Bypass: include
+                 \`--skip-multi-agent-reason: <reason>\` in the commit
+                 body (≥ 20 chars, must contain whitespace, must be at
+                 the start of its own line) — bypass is recorded as a
+                 policy.skipped audit event (no exit-1).
+
+                 MSG_FILE: path to the commit message file. Passed by the
+                 commit-msg git hook as \$1. Lookup order:
+                   1. positional arg (preferred, what commit-msg passes)
+                   2. COMMIT_MSG_FILE env (test injection)
+                   3. .git/COMMIT_EDITMSG (legacy fallback — note this is
+                      UNRELIABLE from pre-commit; use the commit-msg
+                      hook lifecycle).
 
 Env:
   CE_JSON=1      Emit one-line JSON per check instead of human-readable
@@ -1209,6 +1335,69 @@ tamper-evident audit log at ~/.contextengine/audit.log.`);
             process.exit(1);
         return;
     }
+    if (sub === "commit-message-required") {
+        // Locate the commit-message file. Order:
+        //   1. CLI positional arg (`contextengine hook commit-message-required
+        //      <path>`) — this is what the commit-msg git hook passes via $1.
+        //      Verifier P0 fix (2026-06-26): the previous implementation read
+        //      .git/COMMIT_EDITMSG from inside the PRE-COMMIT hook, but git
+        //      does not populate that file until AFTER pre-commit returns.
+        //      The check now runs from commit-msg, which gets the actual
+        //      message file path as its first argument.
+        //   2. COMMIT_MSG_FILE env (for test injection / scripted callers).
+        //   3. .git/COMMIT_EDITMSG in the repo root — backward-compat
+        //      fallback ONLY for legacy invocations. Will be empty / stale
+        //      when called from pre-commit; that's the documented footgun
+        //      this fix retires.
+        const commitMsgFile = args[1] ||
+            process.env.COMMIT_MSG_FILE ||
+            join(repoRoot, ".git", "COMMIT_EDITMSG");
+        let commitMessage = "";
+        if (existsSync(commitMsgFile)) {
+            try {
+                commitMessage = readFileSync(commitMsgFile, "utf-8");
+            }
+            catch {
+                // Fall through — empty message will fail any rule that fires,
+                // surfacing the description to the user.
+            }
+        }
+        const violations = runCommitMessageRequired(policy, stagedFiles, commitMessage);
+        if (jsonMode) {
+            process.stdout.write(formatCommitMessageViolationsJson(violations) + "\n");
+        }
+        else {
+            console.log(formatCommitMessageViolations(violations));
+        }
+        let exitBlock = false;
+        for (const v of violations) {
+            if (v.kind === "bypass") {
+                // Bypass IS the auditable opt-out. Record the reason; let the
+                // commit proceed.
+                safeAppend("policy.skipped", {
+                    check: "commit-message-required",
+                    rule_id: v.ruleId,
+                    matched_files: v.matchedFiles,
+                    pattern: v.pattern,
+                    bypass_reason: v.bypassReason,
+                });
+                continue;
+            }
+            // missing-pattern
+            safeAppend("hook.block", {
+                check: "commit-message-required",
+                rule_id: v.ruleId,
+                matched_files: v.matchedFiles,
+                pattern: v.pattern,
+                reason: "commit-message-pattern-not-matched",
+            });
+            if (v.severity === "block")
+                exitBlock = true;
+        }
+        if (exitBlock)
+            process.exit(1);
+        return;
+    }
     console.error(`Unknown hook subcommand: ${sub}. Try 'contextengine hook --help'.`);
     process.exit(1);
 }
@@ -1716,6 +1905,107 @@ async function cliImportLearnings(args) {
     }
 }
 // ---------------------------------------------------------------------------
+// CLI: sync-community-rules — fetch + cache community learnings
+// ---------------------------------------------------------------------------
+async function cliSyncCommunityRules(args) {
+    let force = false;
+    let tier = "all";
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--force" || a === "-f") {
+            force = true;
+            continue;
+        }
+        if (a === "--tier" && args[i + 1]) {
+            const t = args[++i];
+            if (t !== "A" && t !== "B" && t !== "all") {
+                console.error(`Unknown tier: ${t}. Try A | B | all.`);
+                process.exit(1);
+            }
+            tier = t;
+            continue;
+        }
+        if (a === "-h" || a === "--help") {
+            console.log(`Usage: opscontext sync-community-rules [--force] [--tier A|B|all]
+
+Fetches community-contributed learnings into the local cache at
+${COMMUNITY_STORE_PATH}.
+
+Two tiers:
+  Tier A (public)   raw.githubusercontent.com — no license required
+  Tier B (pro)      api.compr.ch — requires an activated Pro license
+
+Behavior:
+  - Daily run recommended. Cron / launchd / periodic CI all fine — the
+    sync is idempotent and ETag-guarded (304 = cheap no-op).
+  - Network failures NEVER crash the search engine. On any HTTP error
+    (timeout, DNS, 5xx, malformed JSON), the cached store is preserved
+    and search continues to work offline.
+  - Tier B is best-effort: with no license loaded (free tier) it is
+    skipped silently with a note on stderr. On HTTP 401 / 403 the
+    error is logged but no exception is thrown — your existing search
+    keeps working.
+  - Tier B responses are Ed25519-signed; an invalid signature causes
+    the fetched payload to be discarded.
+
+Flags:
+  --force, -f         Bypass the ETag cache; always re-fetch.
+  --tier A|B|all      Restrict the sync to one tier. Default: all.
+
+After sync, the new rules are picked up automatically by search_context
+the next time the MCP server (re)indexes. Restart the server or run
+'opscontext reindex' to force an immediate pickup.`);
+            return;
+        }
+    }
+    console.log(`\n🌐 Sync community rules (tier=${tier}, force=${force})\n`);
+    if (tier === "A" || tier === "all") {
+        const r = await syncTierA({ force });
+        if (r.cached) {
+            console.log(`  Tier A — cached (no changes since last fetch)`);
+        }
+        else {
+            console.log(`  Tier A — fetched ${r.fetched} rule(s)`);
+        }
+    }
+    if (tier === "B" || tier === "all") {
+        // Resolve license through the activation module to keep auth shape
+        // identical to /heartbeat — same machineId, same key.
+        const licenseFile = join(homedir(), ".contextengine", "license.json");
+        let token = null;
+        if (existsSync(licenseFile)) {
+            try {
+                const data = JSON.parse(readFileSync(licenseFile, "utf-8"));
+                token = typeof data.key === "string" ? data.key : null;
+            }
+            catch { /* malformed — treat as no license */ }
+        }
+        if (!token) {
+            if (tier === "B") {
+                console.error(`  Tier B — no license loaded. Activate with: opscontext activate <key> <email>`);
+            }
+            else {
+                console.log(`  Tier B — skipped (no license loaded)`);
+            }
+        }
+        else {
+            const r = await syncTierB(token, { force });
+            if (r.cached) {
+                console.log(`  Tier B — cached (no changes since last fetch)`);
+            }
+            else if (r.fetched === 0) {
+                console.log(`  Tier B — 0 rules (auth rejected or empty payload — see stderr)`);
+            }
+            else {
+                console.log(`  Tier B — fetched ${r.fetched} rule(s)`);
+            }
+        }
+    }
+    const store = loadCommunityStore();
+    console.log(`\n  Store now holds ${store.rules.length} total community rule(s).`);
+    console.log(`  Path: ${COMMUNITY_STORE_PATH}\n`);
+}
+// ---------------------------------------------------------------------------
 // CLI: stats — show live session stats from MCP server
 // ---------------------------------------------------------------------------
 function cliStats() {
@@ -1770,15 +2060,18 @@ Usage:
   contextengine save-learning <text> -c <category>  Save a learning
   contextengine delete-learning <id>   Delete a learning by ID
   contextengine import-learnings <file> [-c cat] [-p project]  Bulk-import learnings
-  contextengine export-learnings [--project NAME] [--category CAT] [--format json|markdown] [--include-universal]
-                                       Export learnings (scope to one project for safe sharing)
+  contextengine export-learnings [--tier A|B] [--output PATH] [--review] [--project NAME] [--category CAT] [--format json|markdown] [--include-universal]
+                                       Export learnings. --tier A → MIT-publishable redacted subset (LOCKed safety pipeline).
+                                                         --tier B → full PRO corpus (still redacted; original IDs preserved).
+                                                         (no --tier) → legacy raw export, NOT safe for public distribution.
   contextengine save-session <name> <key> <value>   Save session context
   contextengine load-session <name>    Restore session context
   contextengine list-sessions          List all saved sessions
   contextengine delete-session <name>  Delete a saved session
   contextengine end-session            Pre-flight checklist (uncommitted changes, doc freshness)
   contextengine audit-export [--since DATE] [--until DATE] [--format jsonl|csv]
-                                       Export hash-chained audit log (SOC2/ISO27001 evidence)
+                                       Export hash-chained audit log (evidence aligned with
+                                       SOC 2 CC7.2 + ISO 27001 A.12.4.1 — not a certification)
   contextengine audit-verify           Verify audit log chain integrity (tamper detection)
   contextengine policy <validate|show> [args]
                                        Author + validate the declarative .contextengine/policy.json
@@ -1801,6 +2094,10 @@ Usage:
   contextengine sync-claude-md [--path CLAUDE.md] [--dry-run]
                                        Refresh the OpsContext-managed block in CLAUDE.md
                                        (top learnings + policy summary + recent hook blocks)
+  contextengine sync-community-rules [--force] [--tier A|B|all]
+                                       Fetch community-contributed learnings (Tier A = GitHub
+                                       public, Tier B = api.compr.ch Pro). Daily run recommended.
+                                       Network failures fall back to cached store.
   contextengine score [project] [--html] [--no-save] AI-readiness score (Pro, writes SCORE.md)
   contextengine audit                  Run compliance audit (Pro)
   contextengine activate <key> <email> Activate a Pro license
@@ -2039,6 +2336,12 @@ else if (command === "uninstall-claude-hook") {
         process.exit(1);
     });
 }
+else if (command === "sync-community-rules") {
+    cliSyncCommunityRules(process.argv.slice(3)).catch((err) => {
+        console.error("Error:", err);
+        process.exit(1);
+    });
+}
 else if (command === "stats") {
     cliStats();
 }

package/dist/community-export.d.ts

@@ -0,0 +1,84 @@
+/**
+ * An ExportedRule is the sanitized, publishable shape of a Learning.
+ *
+ * Differences from Learning:
+ * - `id` is NOT the user's local UUID. For Tier A it's sha256(originalId, salt)
+ *   so it's stable across exports but does not link back to the user's store.
+ *   For Tier B it can preserve the original id (PRO subscribers are
+ *   authenticated; not a public artifact).
+ * - `rule` and `context` are passed through `redactRule` — secrets, PII, and
+ *   personal/project identifiers replaced with token markers.
+ * - `project` is a sha256 prefix when present — co-clustering survives
+ *   ("these 3 learnings came from the same project") but the human-readable
+ *   brand is gone.
+ * - `tags` are preserved verbatim (they're already low-entropy and useful
+ *   for the recipient agent's relevance ranking).
+ * - `created` / `updated` are intentionally OMITTED — timestamps narrow the
+ *   anonymity set, and downstream consumers don't need them.
+ */
+export interface ExportedRule {
+    id: string;
+    category: string;
+    rule: string;
+    context: string;
+    project?: string;
+    tags: string[];
+}
+export interface ExportResult {
+    tier: "A" | "B";
+    outputPath: string;
+    count: number;
+    dropped: number;
+    rules: ExportedRule[];
+}
+export interface ExportOptions {
+    tier: "A" | "B";
+    outputPath: string;
+    review?: boolean;
+}
+/**
+ * Run the full redaction pipeline on a single string.
+ *
+ * Returns the redacted text, or an empty string if the input is too short /
+ * empty / one-word (callers should treat empty-return as "drop this rule").
+ *
+ * Deterministic: identical input → identical output, no timestamps, no
+ * randomness.
+ */
+export declare function redactRule(text: string): string;
+/**
+ * Hash a local learning ID into a stable, public-safe Tier-A ID.
+ *
+ * Deterministic: same input → same hash → idempotent re-exports.
+ * Doesn't reveal the local UUID format (e.g. timestamp-based prefix).
+ */
+declare function hashPublicId(localId: string): string;
+/**
+ * Hash a project name into a short prefix. Co-clustering survives (same
+ * project name → same prefix) but the brand is gone.
+ */
+declare function hashProject(name: string): string;
+/**
+ * Build the sanitized export for the given tier and write it to disk.
+ *
+ * Tier A: MIT-publishable. Filters to allow-list categories + 'safe' tag.
+ *         IDs are sha256(localId)-derived (stable but not traceable).
+ * Tier B: PRO-only. Full corpus (still redacted for secrets/PII). IDs are
+ *         the original UUIDs (PRO users are authenticated).
+ */
+export declare function exportLearnings(opts: ExportOptions): ExportResult;
+/**
+ * Open the export in $EDITOR (or vi) for a manual review pass. The user can
+ * delete entries or hand-edit text; the parsed JSON is returned. In a
+ * non-interactive shell (no TTY) the rules are returned unchanged.
+ */
+export declare function reviewLoop(rules: ExportedRule[]): Promise<ExportedRule[]>;
+export declare const __testing: {
+    hashPublicId: typeof hashPublicId;
+    hashProject: typeof hashProject;
+    PUBLIC_ID_SALT: string;
+    TIER_A_ALLOWED_CATEGORIES: Set<string>;
+    TIER_A_DENIED_CATEGORIES: Set<string>;
+};
+export {};
+//# sourceMappingURL=community-export.d.ts.map