@dzhechkov/p-replicator 1.5.17 → 1.6.0

package/templates/.claude/hooks/autocommit-roadmap.cjs

@@ -10,35 +10,118 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { execFileSync } = require('node:child_process');
 
-const TARGET = path.resolve(process.cwd(), '.claude', 'feature-roadmap.json');
-const RELATIVE = path.relative(process.cwd(), TARGET);
-const SILENT = { stdio: 'ignore' };
+// The project root, never the process cwd: a `cd` inside any tool call moves cwd for the rest of
+// the session, and these hooks are non-blocking, so a wrong anchor fails SILENTLY. CLAUDE_PROJECT_DIR
+// first — the host is authoritative about what the project is. `__dirname` second: a hook always
+// lives at <project>/.claude/hooks/<x>.cjs, so its own location settles the root with no cooperation
+// from anyone, which is what keeps this working when the variable is absent (hand-run, older host).
+const ENV_ROOT = process.env.CLAUDE_PROJECT_DIR;
+// isAbsolute, not just truthy: a RELATIVE value would still be resolved against the drifting
+// cwd, which is the very bug this anchor exists to remove.
+const ROOT = (ENV_ROOT && path.isAbsolute(ENV_ROOT))
+  ? ENV_ROOT
+  : path.resolve(__dirname, '..', '..');
+
+const TARGET = path.resolve(ROOT, '.claude', 'feature-roadmap.json');
+const RELATIVE = path.relative(ROOT, TARGET);
+// cwd: ROOT — the paths below are relative to ROOT, so git must run there too.
+// stderr is PIPED, not ignored: on success nothing is printed anyway, and on failure git's
+// own words are the only thing that tells a reader WHY. Discarding them leaves a report that
+// names what failed and not why, which is half a report.
+const SILENT = { stdio: ['ignore', 'pipe', 'pipe'], cwd: ROOT };
+
+// What the hook was DOING when it failed. The outer catch also sees staging failures and a
+// missing git binary, and reporting either of those as "could not commit" would send the reader
+// looking in the wrong place.
+let stage = 'start';
 
 function git(args) {
   return execFileSync('git', args, SILENT);
 }
 
 try {
-  // Skip if file doesn't exist or we're not in a git repo.
-  if (!fs.existsSync(TARGET)) process.exit(0);
-  try { git(['rev-parse', '--git-dir']); } catch { process.exit(0); }
+  // The repository probe comes FIRST now, because the absence check below needs to ask git a
+  // question and there is no point asking outside a repository.
+  stage = 'inspect the repository';
+  try {
+    git(['rev-parse', '--git-dir']);
+  } catch (probeErr) {
+    // "Not a git repository" is the ordinary case and stays silent. Everything else — no git on
+    // PATH, dubious ownership, a permission error — is a real failure that used to look exactly
+    // like it, which is how a broken machine and an ordinary directory became indistinguishable.
+    const why = String((probeErr && probeErr.stderr) || '').trim();
+    if (!why || /not a git repository/i.test(why)) process.exit(0);
+    throw probeErr;
+  }
+
+  // Absent — but absent HOW? A path that never existed is nothing to do, as before. A path git
+  // still tracks is a DELETION, and a deletion is exactly the change this hook exists to record.
+  //
+  // `git ls-files` is the discriminator, and it must run BEFORE staging: staging a deletion
+  // removes the entry from the index, after which the same question answers "not tracked".
+  // CORRECTION, measured: `--error-unmatch` also discriminates correctly here, for files AND for
+  // directories — 0 for a deleted-but-tracked path, 1 for one that never existed. An earlier note
+  // here claimed otherwise; that claim came from measuring it AFTER staging, which is what made it
+  // fail, not the directory-ness. `ls-files --` is preferred only because it answers with DATA
+  // (empty or not) instead of by throwing, so the ordinary case needs no exception handling.
+  //
+  // Simply DELETING the existence guard would have been the naive fix and would have broken the
+  // reporting that shipped yesterday: `git add` on a path that never existed exits 128, so every
+  // session stop in every project without this artifact would print a failure line. MEASURED.
+  if (!fs.existsSync(TARGET)) {
+    // A bare `catch { tracked = '' }` here would turn a REAL git failure into "never existed"
+    // and skip a deletion that should have been recorded — a silent bypass of the very thing
+    // this feature adds. A failure is rethrown into the reporting path; only a genuinely
+    // empty answer means the artifact never lived here.
+    const tracked = String(git(['ls-files', '--', RELATIVE]) || '').trim();
+    if (!tracked) process.exit(0);   // never existed here — silent, exactly as before
+  }
 
-  // Stage only the target file.
+  // Stage the target (or its removal).
+  stage = 'stage the change';
   git(['add', '--', RELATIVE]);
 
   // Check whether anything is staged for THIS path.
   // `git diff --cached --quiet -- <path>` exits 0 = no diff, 1 = diff exists.
-  let hasDiff = false;
+  // Ask git WHAT it staged, not merely WHETHER something changed — same subprocess, strictly
+  // more information. Deriving "this is a removal" from whether the path still exists was
+  // wrong for a directory: deleting ONE file inside it, or deleting every tracked file while
+  // an ignored one keeps the directory present, would have been committed as an update and
+  // defeated the very search this feature promises.
+  let staged = '';
   try {
-    git(['diff', '--cached', '--quiet', '--', RELATIVE]);
+    staged = String(git(['diff', '--cached', '--name-status', '--', RELATIVE]) || '').trim();
   } catch {
-    hasDiff = true;
+    // No HEAD yet (an unborn repository): there is no history to record a removal against.
+    staged = '';
   }
+  const deleted = staged.split('\n').some((l) => /^D/.test(l.trim()));
+  const hasDiff = staged.length > 0;
 
   if (hasDiff) {
-    git(['commit', '--only', '--', RELATIVE, '-m', 'docs(roadmap): auto-update']);
+    // -m BEFORE the `--`: everything after `--` is a PATHSPEC, so the old order made git
+    // look for files literally named '-m' and 'docs(roadmap): auto-update' — it failed every
+    // time, from every directory, and this hook exits 0 on failure, so nobody saw it.
+    stage = 'commit';
+    // A deletion gets its own subject, so the event is findable in `git log` without
+    // reading diffs — which is the whole point of recording it.
+    git(['commit', '-m', deleted ? 'docs(roadmap): auto-remove' : 'docs(roadmap): auto-update', '--only', '--', RELATIVE]);
   }
-} catch (_err) {
-  // Best-effort — never break Claude session on commit failures.
+} catch (err) {
+  // Best-effort — never break the Claude session on commit failures. But "not breaking the session"
+  // and "saying nothing" are different things, and only the first one is the contract: it is about
+  // the EXIT CODE. Silence is what let a permanent defect live here undetected — `-m` after `--`
+  // made every commit fail, from every directory, forever, and nothing said so.
+  //
+  // A held index.lock, a missing user.email, a repository pre-commit hook that rejected the commit,
+  // an ignored target: each now costs one line and still exits 0. The ordinary "nothing to commit"
+  // path never reaches here, deliberately — a notice that fires when nothing is wrong trains people
+  // to ignore notices, and the next real failure scrolls past with them.
+  const artifactName = '.claude/feature-roadmap.json';
+  const gitSaid = err && err.stderr ? String(err.stderr).trim() : '';
+  const detail = (gitSaid || String((err && err.message) || err)).split('\n')
+    .map((l) => l.trim()).filter(Boolean)[0] || 'unknown error';
+  process.stdout.write('[autocommit-roadmap] could not ' + stage + ' — ' + artifactName + ': '
+    + detail.slice(0, 200) + '\n');
   process.exit(0);
 }

package/templates/.claude/hooks/check-ports.cjs

@@ -0,0 +1,232 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * check-ports.cjs — enforce `.claude/rules/docker-ports.md` («Правило №0») against a real compose.
+ *
+ * NOT an event hook. Like `state-update.cjs`, it lives here because this directory already carries
+ * plain Node utilities; nothing registers it in settings.json and nothing runs it on a schedule.
+ * Invoke it deliberately:
+ *
+ *   node .claude/hooks/check-ports.cjs [path-to-project | path-to-compose-file]
+ *
+ * Exit codes — three, and the third is the point:
+ *   0  the rule holds
+ *   1  the rule is violated (each violation is printed with the service and the remedy)
+ *   2  THE CHECK DID NOT RUN — no compose, no docker, or a config that would not parse
+ *
+ * A guard that answers "clean" when it could not look is worse than no guard: it converts an unknown
+ * into a reassurance. That is why an absent compose, a missing docker and an unreadable config all
+ * exit 2 rather than 0.
+ *
+ * It implements the RULE, not any prior script. In particular it checks `network_mode: host`, which
+ * publishes everything a container listens on without any `ports:` entry at all.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+// Storage recognised the way the rule names it — by image and by well-known port. Both lists live
+// here, side by side, so a reader extending one can see the other.
+// Recognition is a HEURISTIC and stays one — but it must not be a substring match. A substring
+// called `rediscommander/redis-commander` storage (it is a web UI), and missed
+// `mcr.microsoft.com/mssql/server` on its standard 1433 entirely. So: take the image NAME —
+// the last path component, without registry, tag or digest — and anchor to it.
+const STORAGE_NAMES = /^(postgres|postgresql|pgvector|mysql|mariadb|percona|mongo|mongodb|redis|valkey|keydb|elasticsearch|opensearch|minio|rabbitmq|memcached|clickhouse|cassandra|scylla|neo4j|influxdb|timescaledb|mssql|sqlserver|couchdb|etcd)$/i;
+const STORAGE_PORT = new Set([5432, 3306, 27017, 6379, 9200, 9300, 5672, 11211, 9000, 8123,
+  1433, 9042, 7687, 8086, 2379, 5984]);
+const PROXY_NAMES = /^(caddy|nginx|traefik|haproxy|envoy)$/i;
+
+/** `mcr.microsoft.com/mssql/server:2022` → `server`; `postgres:16` → `postgres`. */
+function imageName(image) {
+  const noDigest = String(image || '').split('@')[0];
+  const last = noDigest.split('/').pop() || '';
+  return last.split(':')[0];
+}
+/** The whole path matters too: mssql/server names the engine one component up. */
+function imageParts(image) {
+  const noDigest = String(image || '').split('@')[0].split(':')[0];
+  return noDigest.split('/').filter(Boolean);
+}
+
+function say(s) { process.stdout.write(s + '\n'); }
+
+/** Exit 2 with a reason. Never merged with "clean": not-run and not-violated are different facts. */
+function cannotCheck(reason, hint) {
+  say('⚠️  проверка НЕ выполнена: ' + reason);
+  if (hint) say('    ' + hint);
+  process.exit(2);
+}
+
+function resolveCompose(arg) {
+  const target = arg || '.';
+  let file = target;
+  try {
+    if (fs.statSync(target).isDirectory()) file = path.join(target, 'docker-compose.yml');
+  } catch {
+    cannotCheck('путь не существует: ' + target);
+  }
+  if (!fs.existsSync(file)) cannotCheck('нет файла ' + file);
+  return file;
+}
+
+/** The normalised config. Parsing the raw YAML would re-implement `extends`, interpolation and the
+ *  short `"5432:5432"` form — and the short form is exactly where a hand parser gets host_ip wrong. */
+function normalisedConfig(file) {
+  const r = spawnSync('docker', ['compose', '-f', file, 'config'],
+    { encoding: 'utf8', cwd: path.dirname(path.resolve(file)) });
+  if (r.error && r.error.code === 'ENOENT') {
+    cannotCheck('docker недоступен на этой машине',
+      'без него нормализованный конфиг получить нечем, а разбирать YAML руками — значит ошибиться на короткой форме портов');
+  }
+  if (r.status !== 0) {
+    const why = String(r.stderr || '').trim().split('\n')[0] || 'причина неизвестна';
+    cannotCheck('docker compose config вернул ошибку: ' + why,
+      'обычно это незаданная переменная; посмотреть: docker compose -f ' + file + ' config');
+  }
+  return String(r.stdout || '');
+}
+
+/**
+ * Services with what this check needs.
+ *
+ * The parser must know WHICH FIELD it is inside. A first version started a port record at every YAML
+ * sequence item and matched `published:` anywhere on a line, so this file — a perfectly legal one —
+ * reported a violation that does not exist:
+ *
+ *     services:
+ *       db:
+ *         image: postgres:16
+ *         command:
+ *           - postgres
+ *           - -c
+ *           - "log_line_prefix=published: 6543"
+ *
+ * A check that invents violations is worse than one that misses them: it teaches people to ignore it.
+ * So: indentation decides the service, the field under a service is tracked by name, and only inside
+ * `ports:` does a sequence item begin a port record. Every field pattern is anchored to the start of
+ * the line.
+ */
+function parseServices(yaml) {
+  const services = [];
+  let cur = null;
+  let inServices = false;
+  let field = '';          // the service-level key we are inside right now
+  let fieldIndent = 0;
+  let port = null;
+
+  const flush = () => { if (port && cur) { cur.ports.push(port); } port = null; };
+
+  for (const raw of yaml.split('\n')) {
+    if (/^services:\s*$/.test(raw)) { inServices = true; continue; }
+    if (/^\S/.test(raw)) { flush(); inServices = /^services:/.test(raw); cur = null; field = ''; continue; }
+    if (!inServices || !raw.trim()) continue;
+
+    const indent = raw.length - raw.replace(/^\s+/, '').length;
+
+    const svc = raw.match(/^ {2}([A-Za-z0-9_.-]+):\s*$/);
+    if (svc) {
+      flush();
+      cur = { name: svc[1], image: '', networkMode: '', ports: [] };
+      services.push(cur);
+      field = ''; fieldIndent = 0;
+      continue;
+    }
+    if (!cur) continue;
+
+    // A service-level key: `    image:`, `    ports:`, `    command:` …
+    const key = raw.match(/^ {4}([A-Za-z0-9_]+):\s*(.*)$/);
+    if (key) {
+      flush();
+      field = key[1];
+      fieldIndent = indent;
+      if (field === 'image') cur.image = key[2].trim();
+      if (field === 'network_mode') cur.networkMode = key[2].trim().replace(/^"|"$/g, '');
+      continue;
+    }
+    if (indent <= fieldIndent && field) { /* still inside the same field's block */ }
+
+    // Only inside `ports:` does a sequence item mean anything to this check. Under `command:`,
+    // `environment:` or `labels:` a line may contain any text at all, including the word published.
+    if (field !== 'ports') continue;
+
+    if (/^\s+-\s/.test(raw)) { flush(); port = { hostIp: '', published: '', target: '' }; }
+    if (!port) continue;
+    const hip = raw.match(/^\s+host_ip:\s*"?([^"\s]+)"?\s*$/);
+    if (hip) { port.hostIp = hip[1]; continue; }
+    const pub = raw.match(/^\s+published:\s*"?([^"\s]+)"?\s*$/);
+    if (pub) { port.published = pub[1]; continue; }
+    const tgt = raw.match(/^\s+target:\s*"?([0-9]+)"?\s*$/);
+    if (tgt) { port.target = tgt[1]; continue; }
+    // The short form survives normalisation in some versions: `- "127.0.0.1:55432:5432"`.
+    const short = raw.match(/^\s+-\s+"?(?:(\[?[0-9a-fA-F.:]+\]?):)?([0-9]+):([0-9]+)"?\s*$/);
+    if (short) { port.hostIp = short[1] || ''; port.published = short[2]; port.target = short[3]; }
+  }
+  flush();
+  return services;
+}
+
+const isLoopback = (hostIp) => /^127\./.test(hostIp) || hostIp === '::1' || hostIp === '[::1]';
+const isStorage = (svc) =>
+  imageParts(svc.image).some((part) => STORAGE_NAMES.test(part))
+  || svc.ports.some((p) => STORAGE_PORT.has(Number(p.target)));
+const isProxy = (svc) => imageParts(svc.image).some((part) => PROXY_NAMES.test(part));
+
+function main() {
+  const file = resolveCompose(process.argv[2]);
+  const services = parseServices(normalisedConfig(file));
+  if (!services.length) {
+    cannotCheck('в нормализованном конфиге не нашлось ни одного сервиса',
+      'разбор мог не совпасть с форматом вывода вашей версии docker — это не «нарушений нет»');
+  }
+
+  const bad = [];
+
+  for (const svc of services) {
+    // network_mode: host publishes everything the container listens on, with no ports: entry at all.
+    // The rule forbids it for storage; the script this was rewritten from never checked it.
+    if (isStorage(svc) && svc.networkMode === 'host') {
+      bad.push(svc.name + ': network_mode: host — контейнер слушает прямо на хосте, публикации не '
+        + 'видно, а порт наружу. Хранилищу этот режим не подходит');
+      continue;
+    }
+    if (!isStorage(svc)) continue;
+    for (const p of svc.ports) {
+      if (!p.published) continue;
+      if (isLoopback(p.hostIp)) continue;   // the loopback exception IS part of the rule
+      bad.push(svc.name + ': порт ' + p.published + ' → ' + (p.target || '?')
+        + (p.hostIp ? ' (host_ip ' + p.hostIp + ')' : ' (без адреса — значит все интерфейсы)')
+        + ' — хранилище опубликовано наружу. Убрать ports: целиком, либо привязать к 127.0.0.1');
+    }
+  }
+
+  // Behind a reverse-proxy the proxy is the only door; anything published beside it can be reached
+  // directly, bypassing everything the proxy guarantees.
+  const proxies = services.filter(isProxy);
+  if (proxies.length) {
+    for (const svc of services) {
+      if (isProxy(svc)) continue;
+      const pub = svc.ports.filter((p) => p.published && !isLoopback(p.hostIp));
+      if (pub.length) {
+        bad.push(svc.name + ': публикуется рядом с reverse-proxy ('
+          + proxies.map((p) => p.name).join(', ') + ') — прокси обходится прямым обращением');
+      }
+    }
+  }
+
+  if (bad.length) {
+    say('❌ Правило №0 нарушено (.claude/rules/docker-ports.md):');
+    for (const b of bad) say('   • ' + b);
+    process.exit(1);
+  }
+  say('✅ ни одно хранилище не публикует порт наружу, обходов reverse-proxy нет');
+  process.exit(0);
+}
+
+try {
+  main();
+} catch (err) {
+  // Even an unexpected failure must not read as "clean".
+  cannotCheck('внутренняя ошибка проверки: ' + String((err && err.message) || err));
+}

package/templates/.claude/hooks/session-insights.cjs

@@ -11,7 +11,19 @@
 const fs = require('node:fs');
 const path = require('node:path');
 
-const INDEX = path.resolve(process.cwd(), '.claude', 'insights', 'index.md');
+// The project root, never the process cwd: a `cd` inside any tool call moves cwd for the rest of
+// the session, and these hooks are non-blocking, so a wrong anchor fails SILENTLY. CLAUDE_PROJECT_DIR
+// first — the host is authoritative about what the project is. `__dirname` second: a hook always
+// lives at <project>/.claude/hooks/<x>.cjs, so its own location settles the root with no cooperation
+// from anyone, which is what keeps this working when the variable is absent (hand-run, older host).
+const ENV_ROOT = process.env.CLAUDE_PROJECT_DIR;
+// isAbsolute, not just truthy: a RELATIVE value would still be resolved against the drifting
+// cwd, which is the very bug this anchor exists to remove.
+const ROOT = (ENV_ROOT && path.isAbsolute(ENV_ROOT))
+  ? ENV_ROOT
+  : path.resolve(__dirname, '..', '..');
+
+const INDEX = path.resolve(ROOT, '.claude', 'insights', 'index.md');
 
 try {
   if (!fs.existsSync(INDEX)) process.exit(0);

package/templates/.claude/hooks/state-update.cjs

@@ -26,7 +26,19 @@
 const fs = require('node:fs');
 const path = require('node:path');
 
-const STATE_FILE = path.resolve(process.cwd(), '.claude', '.p-replicator-state.json');
+// The project root, never the process cwd: a `cd` inside any tool call moves cwd for the rest of
+// the session, and these hooks are non-blocking, so a wrong anchor fails SILENTLY. CLAUDE_PROJECT_DIR
+// first — the host is authoritative about what the project is. `__dirname` second: a hook always
+// lives at <project>/.claude/hooks/<x>.cjs, so its own location settles the root with no cooperation
+// from anyone, which is what keeps this working when the variable is absent (hand-run, older host).
+const ENV_ROOT = process.env.CLAUDE_PROJECT_DIR;
+// isAbsolute, not just truthy: a RELATIVE value would still be resolved against the drifting
+// cwd, which is the very bug this anchor exists to remove.
+const ROOT = (ENV_ROOT && path.isAbsolute(ENV_ROOT))
+  ? ENV_ROOT
+  : path.resolve(__dirname, '..', '..');
+
+const STATE_FILE = path.resolve(ROOT, '.claude', '.p-replicator-state.json');
 
 function parseArgs(argv) {
   const out = {};

package/templates/.claude/hooks/statusline.cjs

@@ -17,7 +17,25 @@
 const fs = require('node:fs');
 const path = require('node:path');
 
-const CWD = process.cwd();
+// The project root, never the process cwd: a `cd` inside any tool call moves cwd for the rest of
+// the session, and these hooks are non-blocking, so a wrong anchor fails SILENTLY. CLAUDE_PROJECT_DIR
+// first — the host is authoritative about what the project is. `__dirname` second: a hook always
+// lives at <project>/.claude/hooks/<x>.cjs, so its own location settles the root with no cooperation
+// from anyone, which is what keeps this working when the variable is absent (hand-run, older host).
+const ENV_ROOT = process.env.CLAUDE_PROJECT_DIR;
+// isAbsolute, not just truthy: a RELATIVE value would still be resolved against the drifting
+// cwd, which is the very bug this anchor exists to remove.
+const ROOT = (ENV_ROOT && path.isAbsolute(ENV_ROOT))
+  ? ENV_ROOT
+  : path.resolve(__dirname, '..', '..');
+
+const CWD = ROOT;
+
+// Two questions, two names. WHERE THE INSTRUMENTS ARE is answered by the hook's own location and is
+// correct from any cwd; WHICH PROJECT'S ROADMAP TO SHOW is a different question, answered by the
+// survey below. Collapsing them into one anchor is what made the status line report half the truth
+// from every directory: the toolkit half from the project directory, the roadmap half from the root.
+const TOOLKIT_ROOT = ROOT;
 const NOW = Date.now();
 
 // ─── ANSI helpers ─────────────────────────────────────────────────────────
@@ -77,8 +95,8 @@ function parseState() {
   return state;
 }
 
-function parseRoadmap() {
-  const r = safeReadJson(path.join(CWD, '.claude', 'feature-roadmap.json'));
+function summariseRoadmap(file) {
+  const r = safeReadJson(file);
   if (!r || !Array.isArray(r.features)) return null;
   const features = r.features;
   const total = features.length;
@@ -87,7 +105,48 @@ function parseRoadmap() {
   const blocked = features.filter((f) => f.status === 'blocked').length;
   const mvp = features.filter((f) => f.priority === 'mvp');
   const mvpDone = mvp.filter((f) => f.status === 'done').length;
-  return { total, done, inProgress, blocked, mvpTotal: mvp.length, mvpDone };
+  // A roadmap that does not match the schema used to render "mvp 0/0" and say nothing, so the
+  // divergence became permanent: the number was right, the reader learned nothing. `priority` is a
+  // CLOSED set (.claude/commands/next.md). Anything else — a value like "critical", or MVP moved
+  // into `tags` leaving no `priority` at all — is marked, never silently counted as zero.
+  const PRIORITIES = ['mvp', 'high', 'medium', 'low'];
+  // EVERY feature must carry a priority from the set. Counting only the ones that already have a
+  // string hid the mixed case: one valid entry beside a missing or non-string sibling passed
+  // silently, which is the most likely real roadmap of all.
+  const offSchemaCount = features.filter(
+    (f) => typeof f.priority !== 'string' || !PRIORITIES.includes(f.priority)).length;
+  return { total, done, inProgress, blocked, mvpTotal: mvp.length, mvpDone, offSchemaCount };
+}
+
+function parseRoadmap() {
+  return summariseRoadmap(path.join(CWD, '.claude', 'feature-roadmap.json'));
+}
+
+// A SURVEY, not a guess. The roadmap may live one level DOWN (a course with projects/01-app), which
+// is why walking upward does not treat this symptom. Enumerating is honest where guessing is not,
+// and a cwd-based guess is exactly the drift this whole line of work removed.
+// This runs on EVERY prompt, so the survey is bounded on both axes: how many entries it will look
+// at, and how large a file it will parse. Without those bounds a projects/ directory with hundreds
+// of entries, or one enormous roadmap, would add its cost to every keystroke's status line.
+const SUB_SCAN_LIMIT = 24;              // entries examined per render
+const SUB_ROADMAP_MAX_BYTES = 512 * 1024;
+
+function parseSubProjects() {
+  const base = path.join(CWD, 'projects');
+  const out = [];
+  let looked = 0;
+  for (const name of safeListDir(base).sort()) {       // sorted: the same render every time
+    if (looked >= SUB_SCAN_LIMIT) break;
+    looked += 1;
+    const dir = path.join(base, name);
+    if (!safeRun(() => fs.statSync(dir).isDirectory(), false)) continue;   // a FILE named projects/x
+    const file = path.join(dir, '.claude', 'feature-roadmap.json');
+    const size = safeRun(() => fs.statSync(file).size, -1);
+    if (size < 0 || size > SUB_ROADMAP_MAX_BYTES) continue;                // absent or absurd
+    const sum = summariseRoadmap(file);
+    if (sum) out.push({ name, ...sum });                                   // malformed → skipped
+  }
+  return out;
 }
 
 function parseSparcDocs() {
@@ -155,7 +214,7 @@ function parseInsights() {
 }
 
 function parseToolkit() {
-  const dir = path.join(CWD, '.claude');
+  const dir = path.join(TOOLKIT_ROOT, '.claude');
   const skills = safeListDir(path.join(dir, 'skills')).filter((d) => {
     return safeRun(() => fs.statSync(path.join(dir, 'skills', d)).isDirectory(), false);
   }).length;
@@ -176,13 +235,13 @@ function parseExpectedToolkit() {
     skillsExpected: 10,
     commandsExpected: 11,
     agentsExpected: 4,    // pre-shipped only (project agents are extra)
-    rulesExpected: 5,     // pre-shipped only (project rules are extra)
-    hooksExpected: 6,     // 4 v1.4.1 hooks + statusline + state-update (v1.5.0)
+    rulesExpected: 6,     // pre-shipped only (project rules are extra)
+    hooksExpected: 7,     // 4 v1.4.1 hooks + statusline + state-update + check-ports
   };
 }
 
 function parseSettingsStatus(manifest) {
-  const settingsPath = path.join(CWD, '.claude', 'settings.json');
+  const settingsPath = path.join(TOOLKIT_ROOT, '.claude', 'settings.json');
   if (!exists(settingsPath)) return 'missing';
   const cur = safeReadJson(settingsPath);
   if (!cur) return 'corrupt';
@@ -211,11 +270,53 @@ function parseKeysarium() {
 function parseDomain() {
   const claudeMd = safeReadText(path.join(CWD, 'CLAUDE.md'));
   if (!claudeMd) return null;
-  // Heuristic keyword search
-  const banking = /банк|bank|финт|fintech|gigachat|yandexgpt|ФЗ-152|ЦБ|ФСТЭК/i;
-  const retail = /retail|e-commerce|ecommerce|ритейл|рекоменд|conversion/i;
-  const enterprise = /enterprise|b2b|legacy|sla|change\s*management/i;
-  const healthcare = /health|medical|клиник|hipaa|ФЗ-323/i;
+  // Heuristic keyword search, with UNICODE word boundaries.
+  //
+  // Without them this was wrong in four ways at once, all reproduced: "healthchecks" made a project
+  // medical, "translate" and "slack" made it enterprise (`sla` sits inside both), and "embankment"
+  // made it a bank.
+  //
+  // `\b` is NOT the fix and would quietly break the Russian half: it is defined over \w =
+  // [A-Za-z0-9_], so there is no word boundary between a space and `б`. MEASURED —
+  // /\bбанк/.test('банк России') is FALSE. Hence Unicode lookarounds with the `u` flag.
+  //
+  // Two kinds of term, deliberately distinguished. A STEM is meant to match inflections — `банк` in
+  // «банкинг», `финт` in «финтех», `рекоменд` in «рекомендательный» — so it takes a LEFT boundary
+  // only. A WHOLE WORD (`sla`, `bank`, `conversion`) takes both, because matching it inside another
+  // word is exactly the defect.
+  const L = '(?<![\\p{L}\\p{N}])';   // start of a word, in any alphabet
+  const R = '(?![\\p{L}\\p{N}])';    // end of a word
+  const stem = (alts) => new RegExp(L + '(?:' + alts + ')', 'iu');
+  const word = (alts) => new RegExp(L + '(?:' + alts + ')' + R, 'iu');
+
+  // A LEFT-only boundary is not enough for every Russian stem, and cross-family QE named the
+  // counter-examples: «Сервис организации банкетов» is not a bank, «Финты в футболе» is not fintech,
+  // «ЦБС городской библиотеки» is not the central bank. So the ambiguous stems are spelled out with
+  // their real inflections and right-bounded, and the two-letter acronym `цб` is dropped outright —
+  // two letters cannot be made safe by any boundary.
+  const bankingStem = stem('банковск|финтех|фз-152|фстэк');
+  const bankingWord = word('банк(?:а|у|ом|е|и|ов|ам|ами|ах|инг)?|bank(?:ing|s|er|ers)?'
+    + '|fintech|gigachat|yandexgpt');
+  // `retail` IS a stem — "Retailer inventory analytics" is retail and whole-word-only missed it.
+  // `conversion` alone is not: "Video conversion service" is not commerce. It needs its qualifier.
+  const retailStem = stem('ритейл|рекоменд|retail');
+  // `\\w` is [A-Za-z0-9_] and does NOT cover Cyrillic — the same trap as `\\b`, one level down:
+  // «конверси» + \\w* + a right boundary fails on «конверсию», because `ю` is neither \\w nor a
+  // boundary. Use \\p{L}. And the Russian term needs its qualifier for the same reason the English
+  // one does: «конверсия файлов» is no more commerce than "video conversion" is.
+  const retailWord = word('e-?commerce|conversion\\s+rate'
+    + '|конверси\\p{L}*\\s+(?:воронк|продаж|лид)\\p{L}*');
+  const enterpriseWord = word('enterprise(?:s)?|b2b|legacy|sla|change\\s*management');
+  // `health` alone cannot be made right: bounded it stops matching "healthcare", unbounded it matches
+  // "healthcheck". So it is replaced by the forms that actually mean the domain — including the
+  // space-separated "health tech", which the first version missed.
+  const healthcareStem = stem('медицин|клиник|фз-323');
+  const healthcareWord = word('health[\\s-]?(?:care|tech)|healthcare|medical|hipaa');
+
+  const banking = { test: (t) => bankingStem.test(t) || bankingWord.test(t) };
+  const retail = { test: (t) => retailStem.test(t) || retailWord.test(t) };
+  const enterprise = enterpriseWord;
+  const healthcare = { test: (t) => healthcareStem.test(t) || healthcareWord.test(t) };
   if (banking.test(claudeMd)) return 'banking';
   if (retail.test(claudeMd)) return 'retail';
   if (enterprise.test(claudeMd)) return 'enterprise';
@@ -281,16 +382,37 @@ function buildPipeline(state) {
   return parts.join('  ' + dim('│') + '  ');
 }
 
-function buildRoadmap(roadmap, domain) {
+function buildRoadmap(roadmap, domain, subProjects) {
+  const subs = Array.isArray(subProjects) ? subProjects : [];
   if (!roadmap) {
+    // No roadmap at the root. If sub-projects have one, report THEIRS — labelled as theirs. The old
+    // line said "no roadmap yet" while thirteen features sat one directory down.
+    if (subs.length > 0) {
+      const total = subs.reduce((n, s) => n + s.total, 0);
+      const done = subs.reduce((n, s) => n + s.done, 0);
+      const where = subs.length === 1 ? subs[0].name : subs.length + ' projects';
+      return [
+        `🎯 ${bold('Roadmap')}`,
+        `${dim('in')} ${cyan(where)}`,
+        `${dotBar(done, total, 8)} ${dim('Done')} ${green(done + '/' + total)}`,
+      ].join(`  ${dim('│')}  `);
+    }
     return `🎯 ${bold('Roadmap')}  ${dim('— no roadmap yet (run /next or /replicate)')}`;
   }
-  const { total, done, inProgress, blocked, mvpTotal, mvpDone } = roadmap;
+  const { total, done, inProgress, blocked, mvpTotal, mvpDone, offSchemaCount } = roadmap;
   const dotbar = dotBar(done, total, 8);
   const parts = [
     `🎯 ${bold('Roadmap')}`,
-    `${dotbar} mvp ${green(mvpDone + '/' + mvpTotal)}`,
-    `${dim('Done')} ${green(done + '/' + total)}`,
+    // The bar is drawn from done/total, so it is captioned Done. It used to sit beside `mvp`, which
+    // it never showed — one glyph and two different quantities, read as one statement. The bar is
+    // CORRECT and stays; the caption is what was wrong, and hiding a working indicator to mask a
+    // wrong caption would have been the wrong half of the fix.
+    `${dotbar} ${dim('Done')} ${green(done + '/' + total)}`,
+    offSchemaCount > 0
+      // The known count is still knowledge — replacing it with '?' throws away what WAS established
+      // and tells the reader less than before. Show both: what is counted, and how much was not.
+      ? `${dim('mvp')} ${green(mvpDone + '/' + mvpTotal)} ${yellow('⚠' + offSchemaCount)} ${dim('schema')}`
+      : `${dim('mvp')} ${green(mvpDone + '/' + mvpTotal)}`,
   ];
   if (inProgress) {
     parts.push(`${dim('▶')} ${cyan(inProgress.id)}`);
@@ -298,6 +420,10 @@ function buildRoadmap(roadmap, domain) {
   if (blocked > 0) {
     parts.push(`${red('Blocked')} ${blocked}`);
   }
+  if (subs.length > 0) {
+    const subTotal = subs.reduce((n, s) => n + s.total, 0);
+    parts.push(`${dim('+' + subs.length + ' sub')} ${green(String(subTotal))}`);
+  }
   if (domain) {
     parts.push(`${dim('Domain:')} ${cyan(domain)}`);
   }
@@ -367,6 +493,7 @@ function main() {
   const manifest = safeRun(() => parseManifest(), null);
   const state = safeRun(() => parseState(), null);
   const roadmap = safeRun(() => parseRoadmap(), null);
+  const subProjects = safeRun(() => parseSubProjects(), []);
   const sparc = safeRun(() => parseSparcDocs(), { present: 0, total: 11 });
   const validation = safeRun(() => parseValidationScore(), null);
   const adrs = safeRun(() => parseAdrs(), 0);
@@ -384,7 +511,7 @@ function main() {
   const lines = [
     buildHeader(manifest),
     buildPipeline(state),
-    buildRoadmap(roadmap, domain),
+    buildRoadmap(roadmap, domain, subProjects),
     buildDocs(sparc, validation, plans, adrs, lastHarvest),
     buildToolkit(toolkit, expected),
     buildStatus(insights, lastTest, mcpServers, settingsStatus, keysarium),