@cruxy/cli 1.2.1 → 1.4.0

package/dist/config/effective.js

@@ -0,0 +1,225 @@
+import { ENV_OVERRIDES, } from "./manager.js";
+/** What a redacted scalar renders as. A marker, never a length-preserving mask
+ * — a mask that matched the length would leak the length. */
+export const REDACTED = "<redacted>";
+/** Layers in precedence order (last wins), paired with the origin they name. */
+function layerOrder(layers) {
+    return [
+        ["global", layers.global],
+        ["project", layers.project],
+        ["explicit", layers.explicit],
+        ["env", layers.env],
+    ];
+}
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/**
+ * Whether `layer` explicitly sets `path`.
+ *
+ * Presence, not definedness: `in` rather than `!== undefined`, because a key
+ * written as `null` was still written, and reporting it as "default" would
+ * point someone at the schema for a value their file is responsible for.
+ */
+function hasPath(layer, path) {
+    if (layer === null)
+        return false;
+    let cursor = layer;
+    for (const key of path.split(".")) {
+        if (!isPlainObject(cursor) || !(key in cursor))
+            return false;
+        cursor = cursor[key];
+    }
+    return true;
+}
+/** The highest-precedence layer that set `path`, or `default` if none did. */
+function originOf(layers, path) {
+    let found = "default";
+    for (const [origin, layer] of layerOrder(layers)) {
+        if (hasPath(layer, path))
+            found = origin;
+    }
+    return found;
+}
+/**
+ * Paths whose value NAMES a secret rather than being one — checked before the
+ * name heuristic below, which would otherwise redact both of them.
+ *
+ * This distinction is the whole point of these two fields: `credentialRef` and
+ * `apiKeyEnv` exist so that a config file can say WHERE the secret comes from
+ * without containing it, and redacting them would hide the answer to "which
+ * credential is this server using" while protecting nothing.
+ */
+const SECRET_REFERENCE_PATHS = [
+    /^mcp\.servers\.[^.]+\.credentialRef$/,
+    /^web\.apiKeyEnv$/,
+];
+/**
+ * Paths that carry a live secret, structurally.
+ *
+ * `mcp.servers.<id>.headers.<name>` is the obvious one — the schema calls a live
+ * header value a secret in so many words, and only accepts it from user-scope
+ * config for that reason. `env` is the same class by a different route: it is
+ * how a stdio server is handed its token (`GITHUB_TOKEN`, `…_API_KEY`), and the
+ * fact that it is spelled as an environment variable rather than a header
+ * changes nothing about what is in it.
+ */
+const SECRET_VALUE_PATHS = [
+    /^mcp\.servers\.[^.]+\.headers\.[^.]+$/,
+    /^mcp\.servers\.[^.]+\.env\.[^.]+$/,
+];
+/**
+ * Backstop for keys that do not exist yet.
+ *
+ * The structural rules above enumerate today's secret-carrying paths, and an
+ * enumeration is exactly the kind of thing a later schema addition forgets to
+ * update — at which point a new key holding a credential renders in full on a
+ * pane someone is screen-sharing. So the leaf NAME is also checked, and the
+ * failure mode is inverted: a new secret is redacted by default, and a false
+ * positive costs one line of a read-only pane (the value is still readable
+ * with `cruxy config get`).
+ *
+ * `token` is NOT in this list, and that omission is the whole reason the rule
+ * needs stating carefully. In this schema "token" almost always means an LLM
+ * token: `context.maxTokens`, `memory.maxRecallTokens`,
+ * `agent.maxTokensPerTurn`, `index.search.tokenBudget`. A heuristic that
+ * matched it would blank out a dozen of the most-consulted numbers in the
+ * product to protect nothing — a redaction that hides only ordinary values
+ * teaches the reader that `<redacted>` means "noise", which is exactly how a
+ * real one gets skimmed past. {@link isSecretPath} catches the credential-ish
+ * senses of the word through the value type instead: a token COUNT is a
+ * number, a bearer token is a string.
+ */
+const SECRET_NAME = /(secret|password|passwd|apikey|api_key|credential)/i;
+/** Names that are secret-shaped only when they carry a string. */
+const SECRET_NAME_IF_STRING = /(token|bearer)/i;
+/** Whether this leaf's value must never be printed. */
+function isSecretPath(path, value) {
+    if (SECRET_REFERENCE_PATHS.some((re) => re.test(path)))
+        return false;
+    if (SECRET_VALUE_PATHS.some((re) => re.test(path)))
+        return true;
+    const leaf = path.split(".").pop() ?? "";
+    if (SECRET_NAME.test(leaf))
+        return true;
+    return typeof value === "string" && SECRET_NAME_IF_STRING.test(leaf);
+}
+/**
+ * A URL with its credential-carrying parts removed: userinfo (`user:pass@`) and
+ * the query string, which is where a remote MCP endpoint's token most often
+ * rides (`?token=…`). The origin and path survive, because WHICH server this is
+ * remains the useful part and it is not the sensitive one.
+ *
+ * Returns null when nothing had to be removed, so an ordinary URL is not
+ * flagged as redacted.
+ */
+function redactUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        // Not parseable as a URL — the schema rejects those, but this module is
+        // also handed layers that never reached the schema. Leave it alone rather
+        // than guess at its structure.
+        return null;
+    }
+    const hadUserinfo = url.username !== "" || url.password !== "";
+    const hadQuery = url.search !== "";
+    if (!hadUserinfo && !hadQuery)
+        return null;
+    url.username = "";
+    url.password = "";
+    if (hadQuery)
+        url.search = "";
+    let out = url.toString();
+    // Both removals are MARKED rather than silent: a URL that quietly lost its
+    // query reads as the whole address, and someone debugging why a server 401s
+    // would be looking at a string their config does not contain.
+    if (hadQuery)
+        out += `?${REDACTED}`;
+    if (hadUserinfo)
+        out = out.replace("://", `://${REDACTED}@`);
+    return out;
+}
+/** One leaf's display value, with any secret removed. */
+function redact(path, value) {
+    if (isSecretPath(path, value))
+        return { value: REDACTED, redacted: true };
+    if (typeof value === "string" && /^https?:\/\//i.test(value)) {
+        const stripped = redactUrl(value);
+        if (stripped !== null)
+            return { value: stripped, redacted: true };
+    }
+    return { value, redacted: false };
+}
+/**
+ * Depth-first walk to the leaves.
+ *
+ * A leaf is anything that is not a plain object — INCLUDING an array (the merge
+ * replaces arrays wholesale, so an array is one decision, not many) and an
+ * empty object, which is a real answer: `routing.map: {}` is what "routing is
+ * configured but inert" looks like, and a walk that recursed into it would emit
+ * nothing and leave the key looking unset.
+ *
+ * The walk is over the RESOLVED config, so what it yields is exactly the keys
+ * that have an effective value. A schema key that is optional with no default
+ * (`shell.executable`, `git.defaultBase`, `test.command`) therefore has no row
+ * while it is unset — there is no value to attribute and no layer to blame.
+ * The moment any layer sets one it appears, correctly attributed, because JSON
+ * cannot express `undefined`: a key present in a file is present in the merge.
+ * Enumerating the schema's unset knobs is a job for documentation and
+ * `cruxy config set`, not for a pane whose subject is what is in effect.
+ */
+function walk(value, prefix, out) {
+    if (isPlainObject(value) && Object.keys(value).length > 0) {
+        for (const [key, child] of Object.entries(value)) {
+            walk(child, prefix === "" ? key : `${prefix}.${key}`, out);
+        }
+        return;
+    }
+    out.push({ path: prefix, value });
+}
+/**
+ * Every effective setting, in schema order, with its origin and nothing secret.
+ *
+ * Schema order rather than alphabetical or overrides-first: this is read by
+ * scanning, and a list that reorders itself as values change moves the row
+ * being read out from under the reader — the same reason the Tasks view keeps
+ * dispatch order.
+ */
+export function effectiveSettings(loaded) {
+    const leaves = [];
+    walk(loaded.config, "", leaves);
+    return leaves.map(({ path, value }) => {
+        const { value: shown, redacted } = redact(path, value);
+        return {
+            path,
+            value: shown,
+            redacted,
+            origin: originOf(loaded.layers, path),
+        };
+    });
+}
+/**
+ * Which environment variables are contributing to this result, by name. Read
+ * off the layer this load actually built, through the one {@link ENV_OVERRIDES}
+ * table — never `process.env`, so what is named is what was USED (a variable
+ * exported after startup is not in effect, and must not be listed as if it is).
+ */
+export function envOverrideNames(loaded) {
+    return ENV_OVERRIDES.filter(({ path }) => hasPath(loaded.layers.env, path)).map(({ envVar }) => envVar);
+}
+/** The file a given origin was read from, when it has one. */
+export function originFile(loaded, origin) {
+    switch (origin) {
+        case "global":
+            return loaded.sources.global;
+        case "project":
+            return loaded.sources.project;
+        case "explicit":
+            return loaded.sources.explicit;
+        default:
+            return null;
+    }
+}

package/dist/config/index.js

@@ -1,5 +1,6 @@
 export * from "./schema.js";
 export * from "./paths.js";
 export * from "./manager.js";
+export * from "./effective.js";
 export * from "./project.js";
 export * from "./credentials.js";

package/dist/config/manager.js

@@ -59,18 +59,35 @@ function rejectProjectScopeHeaders(obj, file) {
         }
     }
 }
+/**
+ * Which environment variable overrides which config path — a TABLE rather than
+ * a run of `if`s, because two surfaces need it read in opposite directions:
+ * this file turns variables into a layer, and the settings view turns a layer
+ * back into "which variable is doing this". A second hand-written copy of the
+ * mapping would drift on the first variable added, and the copy that drifts is
+ * the one telling the user where the value came from.
+ */
+export const ENV_OVERRIDES = [
+    { envVar: "CRUXY_MODEL", path: "model.model" },
+    { envVar: "CRUXY_PROVIDER", path: "model.provider" },
+    { envVar: "CRUXY_LOG_LEVEL", path: "logLevel" },
+];
 /** Overrides sourced from environment variables. */
 function envOverrides() {
     const out = {};
-    const model = {};
-    if (process.env.CRUXY_MODEL)
-        model.model = process.env.CRUXY_MODEL;
-    if (process.env.CRUXY_PROVIDER)
-        model.provider = process.env.CRUXY_PROVIDER;
-    if (Object.keys(model).length)
-        out.model = model;
-    if (process.env.CRUXY_LOG_LEVEL)
-        out.logLevel = process.env.CRUXY_LOG_LEVEL;
+    for (const { envVar, path } of ENV_OVERRIDES) {
+        const value = process.env[envVar];
+        if (!value)
+            continue;
+        const keys = path.split(".");
+        let cursor = out;
+        for (const key of keys.slice(0, -1)) {
+            if (!isPlainObject(cursor[key]))
+                cursor[key] = {};
+            cursor = cursor[key];
+        }
+        cursor[keys[keys.length - 1]] = value;
+    }
     return out;
 }
 /**
@@ -83,15 +100,23 @@ export function loadConfig(opts = {}) {
         project: null,
         explicit: null,
     };
+    const layers = {
+        global: null,
+        project: null,
+        explicit: null,
+        env: {},
+    };
     let merged = {};
     const gPath = globalConfigPath();
     if (existsSync(gPath)) {
-        merged = deepMerge(merged, readJsonFile(gPath));
+        layers.global = readJsonFile(gPath);
+        merged = deepMerge(merged, layers.global);
         sources.global = gPath;
     }
     if (opts.configPath) {
         const obj = readJsonFile(opts.configPath);
         rejectProjectScopeHeaders(obj, opts.configPath);
+        layers.explicit = obj;
         merged = deepMerge(merged, obj);
         sources.explicit = opts.configPath;
     }
@@ -100,11 +125,13 @@ export function loadConfig(opts = {}) {
         if (pPath) {
             const obj = readJsonFile(pPath);
             rejectProjectScopeHeaders(obj, pPath);
+            layers.project = obj;
             merged = deepMerge(merged, obj);
             sources.project = pPath;
         }
     }
-    merged = deepMerge(merged, envOverrides());
+    layers.env = envOverrides();
+    merged = deepMerge(merged, layers.env);
     const result = CruxyConfigSchema.safeParse(merged);
     if (!result.success) {
         const issues = result.error.issues
@@ -112,7 +139,7 @@ export function loadConfig(opts = {}) {
             .join("\n");
         throw configInvalid(issues, sources.project ?? sources.global ?? undefined);
     }
-    return { config: result.data, sources };
+    return { config: result.data, sources, layers };
 }
 /** Resolve a dot-path (e.g. "model.temperature") against a config object. */
 export function getPath(obj, path) {
@@ -176,12 +203,15 @@ export function resolveApiKey(provider) {
 }
 /** The API key from the environment for `provider`, or `undefined`. */
 function envApiKey(provider) {
-    switch (provider) {
-        case "cruxy":
-            return process.env.CRUXY_API_KEY;
-        case "openai":
-            return process.env.OPENAI_API_KEY;
-        default:
-            return process.env.CRUXY_API_KEY;
-    }
+    return process.env[apiKeyEnvVar(provider)];
+}
+/**
+ * The environment variable a provider's API key is read from — the NAME only,
+ * never the value, so a surface can say where a key would come from without
+ * ever holding one. Exported so nothing has to restate this mapping: a second
+ * copy would drift the moment a provider is added, and the copy that drifts is
+ * always the one telling the user where to put their key.
+ */
+export function apiKeyEnvVar(provider) {
+    return provider === "openai" ? "OPENAI_API_KEY" : "CRUXY_API_KEY";
 }

package/dist/config/project.js

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { PROJECT_INSTRUCTION_FILENAMES } from "../constants.js";
 /** Cap on instruction file size; the rest is dropped with a notice. */
@@ -34,3 +34,55 @@ export function loadProjectInstructions(cwd) {
     }
     return null;
 }
+/**
+ * The starting `CRUXY.md` (P6 track 4).
+ *
+ * Deliberately a SKELETON with prompts rather than filled-in guesses. cruxy
+ * cannot know this project's conventions at scaffold time, and a template that
+ * asserted some would be injected into every subsequent turn's system prompt as
+ * though the user had written it — instructions the agent follows and nobody
+ * chose. Empty headings ask; invented content misleads.
+ */
+export const PROJECT_INSTRUCTIONS_TEMPLATE = `# Project instructions for cruxy
+
+These notes are loaded into cruxy's context on every run. Keep them short and
+high-signal — conventions, where things live, how to build and test.
+
+## Conventions
+
+- (e.g. language, style, naming rules the agent should follow)
+
+## Build & test
+
+- (e.g. how to install deps, run the app, run the test suite)
+
+## Gotchas
+
+- (e.g. anything non-obvious about this codebase)
+`;
+/**
+ * Write the starter `CRUXY.md` into `cwd`, unless project instructions already
+ * exist there.
+ *
+ * NEVER OVERWRITES, and the check is {@link loadProjectInstructions} rather than
+ * a bare `existsSync("CRUXY.md")` — a project whose instructions live in
+ * `AGENTS.md` already has them, and scaffolding a second file beside it would
+ * create two sources for one thing where the loader honours only the first.
+ *
+ * Extracted from the onboarding scaffold step (P6 track 4) so `/init` and
+ * `cruxy init` write the same file. The step's own y/N prompt and IO stay in
+ * `onboarding/steps.ts`, which is the part that genuinely differs between an
+ * onboarding flow and a slash command.
+ */
+export function scaffoldProjectInstructions(cwd) {
+    if (loadProjectInstructions(cwd) !== null)
+        return { kind: "exists" };
+    const file = join(cwd, PROJECT_INSTRUCTION_FILENAMES[0]);
+    try {
+        writeFileSync(file, PROJECT_INSTRUCTIONS_TEMPLATE, "utf8");
+    }
+    catch (err) {
+        return { kind: "failed", message: err.message };
+    }
+    return { kind: "written", file };
+}

package/dist/config/schema.js

@@ -49,8 +49,14 @@ export const AgentConfigSchema = z
      * cumulative across turns.
      */
     maxTokensPerTurn: z.number().int().nonnegative().default(0),
-    /** Skip per-action confirmation prompts. */
-    autoApprove: z.boolean().default(false),
+    // `autoApprove` used to sit here (P5 track 3 removed it). It had ZERO
+    // consumers — nothing in the codebase ever read it — while promising to
+    // "skip per-action confirmation prompts", and `ApprovalConfigSchema` below
+    // stated in the same file that no such mode exists. A flag on disk also
+    // disarms every approval in every session that loads it, with nothing on
+    // screen to say so. Auto-approve is now a runtime SESSION MODE
+    // (`agent/mode.ts`): chosen in the session it affects, shown while active,
+    // gone when the session ends.
     /** Plan mode: propose a plan for approval before executing (C.31, opt-in). */
     planMode: z.boolean().default(false),
 })
@@ -120,9 +126,13 @@ export const ContextConfigSchema = z
     .strict();
 /**
  * How tool-action approval is resolved. Only `prompt` exists: ask interactively
- * and **deny by default** when non-interactive. There is deliberately no
- * auto-approve / skip mode — the policy seam for a future CI mode lives in
- * `src/approval` (see U.3), not behind a footgun flag.
+ * and **deny by default** when non-interactive.
+ *
+ * There is still deliberately no auto-approve mode HERE, and that is the point
+ * this schema has always made: not that unattended execution is forbidden, but
+ * that it must not be armed from a file. It is a runtime session mode
+ * (`agent/mode.ts`) reached through the policy seam in `src/approval` — chosen
+ * in the session it affects and visible the whole time it is on.
  */
 export const ApprovalConfigSchema = z
     .object({
@@ -436,7 +446,13 @@ export const LspConfigSchema = z
     maxResults: z.number().int().positive().default(100),
 })
     .strict();
-/** A per-tier price, in the user's own currency, PER MILLION TOKENS (C.22). */
+/**
+ * RETIRED (C.22): a per-tier price, in the user's own currency, PER MILLION
+ * TOKENS. Nothing reads it. Kept only so `usage.prices` still VALIDATES — see
+ * {@link UsageConfigSchema}.
+ *
+ * @deprecated cost comes from the gateway now; delete `usage.prices` from config.
+ */
 export const TierPriceSchema = z
     .object({
     /** Price per 1,000,000 input tokens. */
@@ -447,22 +463,39 @@ export const TierPriceSchema = z
     .strict();
 /**
  * Usage telemetry + cost tracking (C.22): LOCAL usage accounting only — nothing
- * here is ever transmitted. Costs are opt-in and honest: prices are per-TIER and
- * per-million-tokens, configured by the user; with none set, tokens are shown
- * and cost is omitted (cruxy ships no bundled price table). The `prices` keys are
- * the fixed {@link MODEL_TIERS}, so an upstream model name can never appear here
- * (U.8 gag holds by construction) and a mistyped tier is rejected at config load.
+ * here is ever transmitted.
+ *
+ * `currency` and `prices` are RETIRED and read by nothing. They modelled a
+ * per-million-token cost basis that no cruxy subscriber is billed on: the
+ * gateway meters a weighted token pool and quotes its own cost per request, and
+ * `cruxy usage` now shows both of those instead of arithmetic over a number the
+ * user typed in.
+ *
+ * They are still ACCEPTED, and deliberately so. This schema is `.strict()` and
+ * `loadConfig` turns any parse failure into a hard error, so deleting the keys
+ * would mean every user who had set them gets a CLI that refuses to start until
+ * they hand-edit a file — a broken binary as the punishment for having used a
+ * documented feature. Tolerating a dead key costs nothing; rejecting it costs
+ * the whole tool. `cruxy usage` tells anyone who still has them set that they no
+ * longer do anything, which is the part that actually needed saying.
+ *
+ * Both are now `.optional()` with NO default, so a freshly-initialized config
+ * doesn't write retired keys into a new file — absent is the new normal, present
+ * is the tolerated legacy.
  */
 export const UsageConfigSchema = z
     .object({
     /** Master switch. When false, no usage is collected, persisted, or shown. */
     enabled: z.boolean().default(true),
-    /** Currency label to prefix costs with (e.g. "$", "€"). Empty ⇒ no symbol is
-     * assumed — a bare number is shown, since the user configured the prices. */
-    currency: z.string().default(""),
+    /**
+     * @deprecated retired, unread. Cost is shown in the gateway's own currency.
+     */
+    currency: z.string().optional(),
     /** How many past runs to keep in the store; older ones are pruned oldest-first. */
     retention: z.number().int().positive().default(50),
-    /** Per-tier prices. Any tier omitted is simply unpriced (cost omitted for it). */
+    /**
+     * @deprecated retired, unread. Cost comes from the gateway per request.
+     */
     prices: z
         .object({
         kavi: TierPriceSchema.optional(),
@@ -470,7 +503,7 @@ export const UsageConfigSchema = z
         mira: TierPriceSchema.optional(),
     })
         .strict()
-        .default({}),
+        .optional(),
 })
     .strict();
 /**

package/dist/jobs/log-renderer.js

@@ -1,4 +1,5 @@
 import { themeForColor } from "../theme/index.js";
+import { changedSteps } from "../render/plan-view.js";
 /** Non-terminal capabilities: a background job renders to NOTHING on screen. */
 const OFFSCREEN_CAPS = {
     tty: false,
@@ -8,7 +9,12 @@ const OFFSCREEN_CAPS = {
     reducedMotion: true,
     screenReader: false,
     unicode: true,
+    // No stdin and no screen: a job is never interactive and never repaints, so
+    // both input-axis flags are false regardless of what the foreground has.
+    stdinTty: false,
+    interactive: false,
     width: 80,
+    height: 24,
 };
 /**
  * A {@link StreamRenderer} for a background job (C.28) that captures activity into
@@ -26,6 +32,8 @@ export class JobLogRenderer {
     caps = OFFSCREEN_CAPS;
     theme = themeForColor(false);
     pending = "";
+    /** Last plan snapshot logged, so `setPlan` records only what changed. */
+    planSteps = [];
     constructor(sink) {
         this.sink = sink;
     }
@@ -51,6 +59,14 @@ export class JobLogRenderer {
     note(text) {
         this.sink("out", text);
     }
+    /**
+     * Ignored: a job log is an append-only transcript, and a served tier is
+     * standing state rather than an event. The run's tier is recorded by the
+     * usage store, which is where a job's accounting is read from.
+     */
+    servedRouting() {
+        // no-op
+    }
     toolLifecycle(event) {
         if (event.event !== "end")
             return; // only the committed outcome is log-worthy
@@ -60,6 +76,37 @@ export class JobLogRenderer {
     endTurn() {
         this.endSegment();
     }
+    /**
+     * Plan steps are committed outcomes, so a background job's log records them —
+     * one line per step whose status actually changed (the whole list arrives on
+     * every transition). Status is a word, not a glyph, matching this log's
+     * `[ok]`/`[fail]` style: nothing here is a terminal, so a themed mark would
+     * only add bytes `cruxy logs` has to strip.
+     */
+    setPlan(steps) {
+        if (steps === null) {
+            this.planSteps = [];
+            return;
+        }
+        for (const step of changedSteps(this.planSteps, steps)) {
+            this.sink(step.status === "failed" ? "err" : "out", `[${step.status}] ${step.id}. ${step.title}`);
+        }
+        this.planSteps = steps.map((s) => ({ ...s }));
+    }
+    /**
+     * A job's test run is exactly the kind of outcome `cruxy logs` exists to
+     * show. Plain text, no theme glyphs, matching this log's `[ok]`/`[fail]`
+     * style — and no count this renderer was not given.
+     */
+    testResult(report) {
+        const counted = report.total !== undefined
+            ? ` ${report.failures.length}/${report.total} failed`
+            : "";
+        this.sink(report.passed ? "out" : "err", `[${report.passed ? "tests ok" : "tests failed"}]${report.passed ? "" : counted} ${report.command} (${Math.round(report.durationMs)}ms)`);
+        for (const f of report.failures) {
+            this.sink("err", `  ${f.name}${f.file === undefined ? "" : ` ${f.file}${f.line === undefined ? "" : `:${f.line}`}`}`);
+        }
+    }
     // Transient decor / previews have no place in an append-only job log.
     preview() { }
     status() { }

package/dist/onboarding/steps.js

@@ -1,8 +1,6 @@
-import { writeFileSync } from "node:fs";
-import { join } from "node:path";
 import { themeForColor } from "../theme/index.js";
 import { CREATE_KEY_URL } from "../constants.js";
-import { loadProjectInstructions } from "../config/index.js";
+import { loadProjectInstructions, scaffoldProjectInstructions, } from "../config/index.js";
 /**
  * The individual onboarding steps (U.6). Each returns a {@link StepResult} and
  * never throws across its boundary; the secret is read masked and is never echoed
@@ -45,26 +43,14 @@ export async function acquireKeyStep(io, deps, provider) {
     }
     return { status: "failed", message: "key rejected after 3 attempts" };
 }
-const CRUXY_MD_TEMPLATE = `# Project instructions for cruxy
-
-These notes are loaded into cruxy's context on every run. Keep them short and
-high-signal — conventions, where things live, how to build and test.
-
-## Conventions
-
-- (e.g. language, style, naming rules the agent should follow)
-
-## Build & test
-
-- (e.g. how to install deps, run the app, run the test suite)
-
-## Gotchas
-
-- (e.g. anything non-obvious about this codebase)
-`;
 /**
  * Offer to scaffold a project `CRUXY.md`. Skipped silently when one already
  * exists (or `AGENTS.md`); otherwise a `y` confirmation writes the template.
+ *
+ * The template and the write moved to `config/project.ts` (P6 track 4) so
+ * `/init` writes the same file. What stays here is the part that genuinely
+ * differs between an onboarding flow and a slash command: the y/N prompt and
+ * the IO it is drawn on.
  */
 export async function scaffoldStep(io, cwd) {
     const col = c(io);
@@ -76,8 +62,13 @@ export async function scaffoldStep(io, cwd) {
     io.write("\n");
     if (key !== "y")
         return { status: "skipped" };
-    const file = join(cwd, "CRUXY.md");
-    writeFileSync(file, CRUXY_MD_TEMPLATE, "utf8");
+    const outcome = scaffoldProjectInstructions(cwd);
+    if (outcome.kind === "failed") {
+        // Previously this threw out of the step on an unwritable directory. A step
+        // must not throw across its boundary, so a failed write is reported.
+        io.write(`${col.danger(col.glyph.failure)} could not write CRUXY.md — ${outcome.message}\n`);
+        return { status: "failed", message: outcome.message };
+    }
     io.write(`${col.success(col.glyph.success)} wrote ${col.strong("CRUXY.md")}\n`);
     return { status: "ok" };
 }