@fiodos/cli 0.1.10 → 0.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiodos/cli",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Fiodos CLI — analyzes your app's source code and generates the in-app voice-agent manifest, then wires the orb. Powers `npx @fiodos/cli analyze`.",
   "type": "commonjs",
   "bin": {
@@ -19,7 +19,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@fiodos/core": "^0.1.0",
+    "@fiodos/core": "^0.1.1",
     "esbuild": "^0.28.1",
     "jsdom": "^24.0.0",
     "typescript": "^5.6.0"

package/src/aiAnalyze.js

@@ -66,7 +66,9 @@ AppManifest (all fields required unless noted):
   "actions": [{
     "intent": string (snake_case, UNIQUE across routes AND actions),
     "label": string, "category": string,
-    "handler": string (name of the REAL function in the app code that implements it),
+    "kind": "function" | "link" (OPTIONAL, default "function". Use "link" for navigation/link actions: open an external/download URL, jump to a page section, open an email/phone/social link. Web landing pages are mostly these.),
+    "handler": string (for kind "function": name of the REAL function in the app code that implements it. For kind "link": OMIT or empty — link actions have no handler.),
+    "navTarget": string (REQUIRED for kind "link": the EXACT href/URL/anchor string as written in the code — e.g. "https://apps.apple.com/...", "#contact", "mailto:hi@x.com". Must appear verbatim in the evidence file.),
     "description": string (what the action does, in clear plain language),
     "preconditions": string (what must be true to run it, in words — e.g. "the cart must have at least one item"; empty string if none),
     "effect": string (what happens AFTER it runs — the result/outcome the user perceives),
@@ -80,7 +82,7 @@ AppManifest (all fields required unless noted):
   "policies": {"requireConfirmationForDestructive": true, "allowedWithoutAuth": string[], "contextRetentionTurns": 5}
 }
 Validation rules: no duplicate intents anywhere; every route/action needs non-empty examples;
-actions need non-empty handler; requireConfirmation implies confirmationMessageTemplate.
+"function" actions need non-empty handler; "link" actions need non-empty navTarget (no handler); requireConfirmation implies confirmationMessageTemplate.
 The description/preconditions/effect/relatedIntents (actions), description (routes) and appType/appFlow
 fields are the app's "manual": they go verbatim into the agent's prompt so it understands the app.
 Base them on the REAL code you read; be precise and concise, never padding.`;
@@ -98,7 +100,10 @@ const PLATFORM_GUIDES = {
     routeHintLine:
       'No reliable static route list is available for web apps, so infer routes/views from the router setup, page/route components, and navigation calls (react-router <Route>, Next.js pages, navigate()/<Link>). Routes you propose are NOT statically verified, so only include ones you can actually see in the code below.',
     actionHintLine:
-      'Actions are functions wired to UI IN THE SOURCE FILES PROVIDED BELOW: handlers inside components, store/context actions (Zustand, Redux, React Context), or service functions. Set "handler" to that real function name exactly. CRITICAL: the manifest is for THIS web deployment only — do NOT include routes or actions from mobile/native code that is not in the file list (even if you infer it exists elsewhere in the monorepo).',
+      'Web actions come in TWO kinds, BOTH first-class — detect both:\n' +
+      '  (1) FUNCTION actions (kind "function"): functions wired to UI — handlers inside components, store/context actions (Zustand, Redux, React Context), or service functions. Set "handler" to that real function name exactly. INCLUDE common web product actions you might be tempted to skip: switching language/locale (e.g. setLang/setLocale/i18n.changeLanguage), toggling theme, submitting a contact/newsletter/search form. (Still skip pure micro-plumbing like opening a dropdown or controlled input onChange.)\n' +
+      '  (2) LINK actions (kind "link"): the core actions of marketing/landing pages, which are NAVIGATION not function calls — download/get-the-app buttons (App Store / Google Play / direct download), "contact us" / email / phone links, social links, and in-page jumps to a section (anchor hrefs like #pricing). For these set kind "link" and navTarget to the EXACT href string in the code; do NOT set handler. A list of detected link elements on the product-surface pages is provided below — turn the meaningful ones into link actions (group obvious duplicates, e.g. several App Store buttons → one "download on the App Store").\n' +
+      'CRITICAL: the manifest is for THIS web deployment only — do NOT include routes or actions from mobile/native code that is not in the file list (even if you infer it exists elsewhere in the monorepo).',
   },
   mobile: {
     appKindLabel: 'a mobile app (Expo / React Native)',
@@ -138,7 +143,9 @@ function buildSystemPrompt(platform) {
   const { appKindLabel, screenWord, routeHintLine, actionHintLine } = guide;
   return `You analyze the FULL source code of ${appKindLabel} and produce the manifest of an in-app voice agent (Fiodos AppManifest).
 
-ROUTES: every ${screenWord} the user can navigate to. ${routeHintLine} Skip auth screens (sign-in/sign-up) and dynamic [param] routes. Always include a BACK route ("route": "BACK").
+${platform === 'web' ? `PRODUCT SURFACE FOCUS (IMPORTANT): some files below are marked [PRODUCT SURFACE] and others [SECONDARY]. The PRODUCT SURFACE is what is reachable by navigation from the deployed home page — it is what this web product actually IS. Concentrate your routes and actions there. [SECONDARY] files exist in the repo but are NOT reachable from the home (e.g. a separate app mirrored inside the same codebase, dead/work-in-progress screens); model something from them ONLY if it is unmistakably part of this same product. When in doubt, prefer the product surface. This is how you avoid drowning a landing's real actions under a secondary app's internals.
+
+` : ''}ROUTES: every ${screenWord} the user can navigate to. ${routeHintLine} Skip auth screens (sign-in/sign-up) and dynamic [param] routes. Always include a BACK route ("route": "BACK").
 
 ACTIONS: things a user could trigger by voice. ${actionHintLine} CRITICAL RULES:
 - Every action MUST be backed by a REAL function you can see in the provided code. Set "handler" to that real function's name exactly as written in the code.
@@ -232,8 +239,23 @@ For EVERY action, also return a "wiring" entry describing how a separate module
 - The confirmation flow is enforced by the engine BEFORE your handler runs, so never add your own confirmation logic; just perform the action.`;
 }
 
-function buildUserPrompt(appMeta, files, omitted, staticRoutes) {
-  const codeBlob = files.map((f) => `===== FILE: ${f.rel} =====\n${f.content}`).join('\n\n');
+function buildUserPrompt(appMeta, files, omitted, staticRoutes, surface = null) {
+  // When a reachability surface is available, tag each file header so the model
+  // knows what is the live product vs secondary code, and list the detected
+  // link elements on the product surface (seed for LINK actions).
+  const reachableRel = new Set();
+  if (surface && surface.applied && surface.relOf) {
+    for (const abs of surface.reachableClosure) reachableRel.add(surface.relOf(abs));
+    for (const abs of surface.entryFiles) reachableRel.add(surface.relOf(abs));
+  }
+  const tagFor = (rel) => {
+    if (!surface || !surface.applied) return '';
+    return reachableRel.has(rel) ? ' [PRODUCT SURFACE]' : ' [SECONDARY]';
+  };
+  const codeBlob = files
+    .map((f) => `===== FILE${tagFor(f.rel)}: ${f.rel} =====\n${f.content}`)
+    .join('\n\n');
+
   const routeHint = staticRoutes
     .map((r) => `${r.routePath}${r.isDynamic ? ' (dynamic)' : ''} ← ${r.relFile}`)
     .join('\n');
@@ -244,10 +266,24 @@ function buildUserPrompt(appMeta, files, omitted, staticRoutes) {
     ? `Statically-scanned routes (existence is verified — use these hrefs):\n${routeHint}\n`
     : `No static route list (web app): infer routes/views from the router and navigation calls in the code below.\n`;
 
+  // Detected interactive link elements on the product surface — concrete hrefs
+  // the model should turn into LINK actions (verified later against the file).
+  let linkBlock = '';
+  const links = (surface && surface.productLinks) || [];
+  if (links.length) {
+    const lines = links
+      .slice(0, 60)
+      .map((l) => `- [${l.kind}] ${l.target}${l.label ? `  (label: ${l.label})` : ''}  ← ${l.file}`)
+      .join('\n');
+    linkBlock =
+      `\nDETECTED LINK ELEMENTS ON THE PRODUCT SURFACE (turn the meaningful ones into "link" actions; navTarget must match the target string exactly; group duplicates):\n${lines}\n`;
+  }
+
   return (
     `App: ${appMeta.name}\nDescription: ${appMeta.description || '(none)'}\n` +
     `App id / bundle id (if any): ${appMeta.bundleId || '(none)'}\nDependencies: ${(appMeta.dependencies || []).join(', ')}\n\n` +
     routeBlock +
+    linkBlock +
     omittedNote +
     `\nManifest schema:\n${manifestSchemaDoc()}\n\n` +
     `FULL SOURCE CODE (${files.length} files):\n\n${codeBlob}`
@@ -384,11 +420,11 @@ async function analyzeViaProxy({ apiKey, apiUrl, model, system, user }) {
  */
 async function analyzeWithAI({
   appMeta, files, omitted, staticRoutes, model = DEFAULT_MODEL, platform = 'mobile',
-  useProxy = false, apiKey = '', apiUrl = '',
+  useProxy = false, apiKey = '', apiUrl = '', surface = null,
 }) {
   const resolved = resolveModel(model);
   const system = buildSystemPrompt(platform);
-  const user = buildUserPrompt(appMeta, files, omitted, staticRoutes);
+  const user = buildUserPrompt(appMeta, files, omitted, staticRoutes, surface);
 
   const t0 = Date.now();
   let parsed;

package/src/ast.js

@@ -106,6 +106,13 @@ function extractFromFile(filePath, appRoot) {
     // createRouter). Such a file's links act as GLOBAL navigation (available
     // from any screen), unlike a per-section sidebar.
     routeHost: false,
+    // Interactive LINK elements found in this file: <a href>, <Link href|to>,
+    // window.open(...), Linking.openURL(...). Each is {target, kind, label}.
+    // kind ∈ internal | external | store | anchor | mailto | tel. These feed the
+    // analyzer so web "link/navigation actions" (download, contact, social,
+    // jump-to-section, change-language-by-link) are detected with the href as
+    // concrete, hallucination-proof evidence — not just state-mutating handlers.
+    linkEls: [],
     // Soft signals that this file sits behind authentication (used ONLY to keep
     // an orphaned cluster ACTIVE — never to disable). Identifiers/paths that
     // commonly indicate an auth gate.
@@ -123,6 +130,30 @@ function extractFromFile(filePath, appRoot) {
     out.navTargets.push(v);
   }
 
+  // Classify a link/navigation target for the analyzer hint + link actions.
+  function classifyLink(value) {
+    if (!value || typeof value !== 'string') return null;
+    const v = value.trim();
+    if (!v || v === '#') return null;
+    if (/^mailto:/i.test(v)) return { target: v, kind: 'mailto' };
+    if (/^tel:/i.test(v)) return { target: v, kind: 'tel' };
+    if (v.startsWith('#')) return { target: v, kind: 'anchor' };
+    if (/^https?:\/\//i.test(v) || v.startsWith('//')) {
+      const store = /(apps\.apple\.com|itunes\.apple\.com|play\.google\.com|testflight)/i.test(v);
+      return { target: v, kind: store ? 'store' : 'external' };
+    }
+    if (v.startsWith('/')) return { target: v, kind: 'internal' };
+    // Template/expression placeholders (e.g. `#${id}`) or unknown — skip as a
+    // concrete link (no verifiable literal href).
+    return null;
+  }
+
+  function pushLink(value, label) {
+    const c = classifyLink(value);
+    if (!c) return;
+    out.linkEls.push({ target: c.target, kind: c.kind, label: label || null, file: rel });
+  }
+
   // GATING constructs only (a redirect/block when unauthenticated) — NOT mere
   // session reading (useUser/useSession): reading the user does not gate access,
   // and counting it would wrongly protect public-but-orphaned pages from being
@@ -275,6 +306,12 @@ function extractFromFile(filePath, appRoot) {
       if (/^Linking\.(openURL|canOpenURL)$/.test(exprText) && node.arguments[0]) {
         const t = literalText(node.arguments[0]) || node.arguments[0].getText().slice(0, 60);
         out.linkingCalls.push({ target: t, file: rel });
+        pushLink(literalText(node.arguments[0]));
+      }
+
+      // window.open(url, ...) / window.location.assign(url) — web external nav.
+      if (/^(window\.open|window\.location\.assign|window\.location\.replace|location\.assign|location\.replace)$/.test(exprText) && node.arguments[0]) {
+        pushLink(literalText(node.arguments[0]));
       }
 
       // Zustand: create<T>()(persist((set) => ({...}))) or create((set) => ({...}))
@@ -308,7 +345,11 @@ function extractFromFile(filePath, appRoot) {
       // Any element carrying an internal route via href/to (next/link <Link>,
       // <a href>, react-router <Link to>/<Navigate to>/<Redirect to>).
       const linkTarget = jsxAttr(attrs, ['href', 'to']);
-      if (linkTarget) pushNavTarget(linkTarget);
+      if (linkTarget) {
+        pushNavTarget(linkTarget);
+        const label = jsxAttr(attrs, ['aria-label', 'title', 'download', 'alt']);
+        pushLink(linkTarget, label);
+      }
       // react-router <Route> table → global navigation host.
       if (tag === 'Route') out.routeHost = true;
       if (/Button/i.test(tag) || tag === 'TouchableOpacity' || tag === 'Pressable') {

package/src/index.js

@@ -96,7 +96,7 @@ const { verifyManifest } = require('./verify');
 const { wireWebOrb, reportWireResult } = require('./wireWeb');
 const { wireHandlers, reportHandlerResult } = require('./wireHandlers');
 const { offerWriteEnv, printEnvManualReminder } = require('./writeEnv');
-const { scoreSurface } = require('./scoreSurface');
+const { scoreSurface, computeSurface } = require('./scoreSurface');
 
 function arg(flag, fallback) {
   const i = process.argv.indexOf(flag);
@@ -275,6 +275,21 @@ async function main() {
   logDev(`[collect] files=${included.length} (~${estimatedTokens} tokens)` +
     (omitted.length ? ` omitted=${omitted.length} (over budget)` : ''));
 
+  // ── 2c. Reachability surface (web) — computed BEFORE the AI call so it can
+  // GUIDE detection, not just clean up afterwards. It tells the model which
+  // files are the live product (reachable from the home) vs secondary code, and
+  // hands it the concrete link elements on those pages (download/contact/social/
+  // anchors) so landing-page actions stop being invisible. Reused after verify
+  // for scoring (no recompute). Best-effort: never blocks analysis.
+  let surface = null;
+  try {
+    surface = computeSurface({ included, analysisRoot, platform });
+    logDev(`[surface] pre-analysis applied=${surface.applied} reason=${surface.reason} ` +
+      `reachable=${surface.reached.size} links=${surface.productLinks.length}`);
+  } catch (e) {
+    logDev(`[surface] pre-analysis skipped: ${e.message}`);
+  }
+
   let manifest;
   let provenance;
   let evidence = {};
@@ -328,7 +343,7 @@ async function main() {
         'Analyzing your project — may take 1–2 min',
         () => analyzeWithAI({
           appMeta, files: included, omitted, staticRoutes: routes, model, platform,
-          useProxy, apiKey, apiUrl,
+          useProxy, apiKey, apiUrl, surface,
         }),
       );
     if (usedModel) model = usedModel;
@@ -390,18 +405,18 @@ async function main() {
   // Anything uncertain stays ACTIVE (fail towards including). The on/off lives
   // in the workspace's disabled-intent sets (reused infra); the developer flips
   // it in the dashboard. Web-first; other platforms are not scored yet.
-  let surface = { disabledRouteIntents: [], disabledActionIntents: [], stats: { applied: false } };
+  let surfaceScore = { disabledRouteIntents: [], disabledActionIntents: [], stats: { applied: false } };
   try {
-    surface = scoreSurface({ manifest, evidence, included, analysisRoot, platform });
+    surfaceScore = scoreSurface({ manifest, evidence, included, analysisRoot, platform, surface });
     for (const r of manifest.routes) {
-      const s = surface.routes && surface.routes[r.intent];
+      const s = surfaceScore.routes && surfaceScore.routes[r.intent];
       if (s) { r.surfaceConfidence = s.confidence; r.surfaceReason = s.reason; }
     }
     for (const a of manifest.actions) {
-      const s = surface.actions && surface.actions[a.intent];
+      const s = surfaceScore.actions && surfaceScore.actions[a.intent];
       if (s) { a.surfaceConfidence = s.confidence; a.surfaceReason = s.reason; }
     }
-    logDev(`[surface] ${JSON.stringify(surface.stats)}`);
+    logDev(`[surface] ${JSON.stringify(surfaceScore.stats)}`);
   } catch (e) {
     // Scoring is best-effort: a failure must never block publishing. Fail OPEN
     // (everything stays active) — consistent with the "fail towards including".
@@ -437,15 +452,15 @@ async function main() {
     // the first publish / when the developer has not customized scope (no
     // clobbering manual choices). Empty when scoring did not apply.
     scopeDefaults: {
-      disabledRouteIntents: surface.disabledRouteIntents || [],
-      disabledActionIntents: surface.disabledActionIntents || [],
+      disabledRouteIntents: surfaceScore.disabledRouteIntents || [],
+      disabledActionIntents: surfaceScore.disabledActionIntents || [],
     },
   };
 
   // Informative, non-blocking summary (the dashboard is where scope is managed).
-  const offR = (surface.disabledRouteIntents || []).length;
-  const offA = (surface.disabledActionIntents || []).length;
-  if (surface.stats && surface.stats.applied && (offR || offA)) {
+  const offR = (surfaceScore.disabledRouteIntents || []).length;
+  const offA = (surfaceScore.disabledActionIntents || []).length;
+  if (surfaceScore.stats && surfaceScore.stats.applied && (offR || offA)) {
     const onR = manifest.routes.length - offR;
     const onA = manifest.actions.length - offA;
     logUser(`Main surface (active): ${onR} route(s), ${onA} action(s)`);

package/src/scoreSurface.js

@@ -227,61 +227,46 @@ function hasGlobalAuthGate(included, analysisRoot, extracted) {
   return false;
 }
 
+/** Actionable (non-internal-route) link kinds → candidates for LINK actions. */
+const ACTION_LINK_KINDS = new Set(['external', 'store', 'anchor', 'mailto', 'tel']);
+
 /**
- * Score every route/action of a manifest by product-surface confidence and
- * compute the conservative default-disabled sets.
+ * Compute the navigation reachability surface ONCE, from the collected files —
+ * independent of any manifest. Used (a) BEFORE the AI call to focus the prompt
+ * on the real product surface, and (b) AFTER it by scoreSurface() to score
+ * intents. Lifting it earlier is what turns reachability from a post-filter into
+ * a signal that GUIDES detection.
  *
- * @param {object}   p
- * @param {object}   p.manifest
- * @param {object}   p.evidence   { routes: {intent:{file}}, actions: {intent:{file}} }
- * @param {Array}    p.included   collected files [{rel, content}]
- * @param {string}   p.analysisRoot
- * @param {string}   p.platform
  * @returns {{
- *   routes: Object<string,{confidence:string,reason:string}>,
- *   actions: Object<string,{confidence:string,reason:string}>,
- *   disabledRouteIntents: string[],
- *   disabledActionIntents: string[],
- *   stats: object,
+ *   applied: boolean, reason: string,
+ *   extracted: Map, edges: Map, absSet: Set, routeMap: Map,
+ *   entryFiles: Set<string>, reached: Set<string>, reachableClosure: Set<string>,
+ *   globalAuthGate: boolean, trustworthy: boolean, resolvableTargets: number,
+ *   productLinks: Array<{target:string,kind:string,label:?string,file:string}>,
+ *   relOf: (abs:string)=>string,
  * }}
  */
-function scoreSurface({ manifest, evidence = {}, included = [], analysisRoot, platform = 'web' }) {
-  const empty = {
-    routes: {},
-    actions: {},
-    disabledRouteIntents: [],
-    disabledActionIntents: [],
-    stats: { applied: false, reason: 'not-web' },
-  };
-
-  // Web-first. Other platforms: reachability is not computed confidently yet,
-  // so we return no disables (fail towards including). Honest limitation.
-  if (platform !== 'web') return empty;
-  if (!manifest || !Array.isArray(manifest.routes)) return empty;
-
+function computeSurface({ included = [], analysisRoot, platform = 'web' }) {
   const { extracted, edges, absSet } = buildGraphFromFiles(included, analysisRoot);
   const routeMap = buildWebRouteMap(included, analysisRoot);
+  const relOf = (abs) => toPosix(path.relative(analysisRoot, abs));
+
+  // Web-first. Other platforms: reachability is not computed confidently yet.
+  if (platform !== 'web') {
+    return {
+      applied: false, reason: 'not-web', extracted, edges, absSet, routeMap,
+      entryFiles: new Set(), reached: new Set(), reachableClosure: new Set(),
+      globalAuthGate: false, trustworthy: false, resolvableTargets: 0,
+      productLinks: [], relOf,
+    };
+  }
 
-  const evAbs = (rel) => {
-    if (!rel) return null;
-    const abs = path.resolve(analysisRoot, rel);
-    return absSet.has(abs) ? abs : null;
-  };
-  const routeEv = evidence.routes || {};
-  const actionEv = evidence.actions || {};
-
-  // Global auth gate (root middleware) → keep everything active.
   const globalAuthGate = hasGlobalAuthGate(included, analysisRoot, extracted);
-
-  // Entry screen file(s). Without one we cannot judge orphans → disable nothing.
   const entryFiles = findEntryFiles(routeMap, extracted);
 
-  // SPA route hosts (react-router/Angular/Vue): their links are GLOBAL nav.
   const routeHostFiles = [];
   for (const [abs, ex] of extracted) if (ex.routeHost) routeHostFiles.push(abs);
 
-  // Is the navigation graph trustworthy? (Enough resolvable internal links that
-  // an "orphan" is believable rather than just unparsed dynamic navigation.)
   const allTargets = new Set();
   for (const ex of extracted.values()) {
     for (const t of ex.navTargets || []) {
@@ -290,12 +275,8 @@ function scoreSurface({ manifest, evidence = {}, included = [], analysisRoot, pl
     }
   }
   const trustworthy = allTargets.size >= 2;
+  const applied = entryFiles.size > 0 && trustworthy && !globalAuthGate;
 
-  const canScore = entryFiles.size > 0 && trustworthy && !globalAuthGate;
-
-  // BFS over screen files from the entry, following nav links found in each
-  // reached screen's closure AND its layout chain. SPA route-host links are
-  // seeded as globally available.
   const reached = new Set(entryFiles);
   const queue = [...entryFiles];
   const seedTargets = (files) => {
@@ -307,16 +288,12 @@ function scoreSurface({ manifest, evidence = {}, included = [], analysisRoot, pl
       }
     }
   };
-  // Global navigation from route hosts (SPA) is reachable from anywhere.
   seedTargets(routeHostFiles);
   while (queue.length) {
     const f = queue.shift();
-    const shell = [f, ...layoutChain(f, analysisRoot, absSet)];
-    seedTargets(shell);
+    seedTargets([f, ...layoutChain(f, analysisRoot, absSet)]);
   }
 
-  // Closure of everything reachable (for action membership): a non-screen file
-  // (service/store) is "on the product surface" if a reachable screen imports it.
   const reachableClosure = new Set();
   for (const f of reached) {
     for (const dep of closure(f, edges)) reachableClosure.add(dep);
@@ -325,6 +302,86 @@ function scoreSurface({ manifest, evidence = {}, included = [], analysisRoot, pl
     }
   }
 
+  // Link/navigation signals living on the reachable product surface (the files
+  // the user actually sees + their shells/closures). Deduped by target. These
+  // seed the analyzer so download/contact/social/anchor actions are detected.
+  // When reachability is not trustworthy, fall back to ALL files' links (better
+  // to surface candidates than to hide them — fail towards including).
+  const linkScope = applied ? reachableClosure : new Set(extracted.keys());
+  const productLinks = [];
+  const seenLink = new Set();
+  for (const abs of linkScope) {
+    const ex = extracted.get(abs);
+    if (!ex || !ex.linkEls) continue;
+    for (const l of ex.linkEls) {
+      if (!ACTION_LINK_KINDS.has(l.kind)) continue;
+      const key = l.kind + '|' + l.target;
+      if (seenLink.has(key)) continue;
+      seenLink.add(key);
+      productLinks.push({ target: l.target, kind: l.kind, label: l.label, file: relOf(abs) });
+    }
+  }
+
+  return {
+    applied,
+    reason: applied
+      ? 'scored'
+      : globalAuthGate ? 'global-auth-gate'
+        : entryFiles.size === 0 ? 'no-entry'
+          : !trustworthy ? 'sparse-graph' : 'unknown',
+    extracted, edges, absSet, routeMap,
+    entryFiles, reached, reachableClosure,
+    globalAuthGate, trustworthy, resolvableTargets: allTargets.size,
+    productLinks, relOf,
+  };
+}
+
+/**
+ * Score every route/action of a manifest by product-surface confidence and
+ * compute the conservative default-disabled sets.
+ *
+ * @param {object}   p
+ * @param {object}   p.manifest
+ * @param {object}   p.evidence   { routes: {intent:{file}}, actions: {intent:{file}} }
+ * @param {Array}    p.included   collected files [{rel, content}]
+ * @param {string}   p.analysisRoot
+ * @param {string}   p.platform
+ * @param {object}   [p.surface]  precomputed computeSurface() result (avoids recompute)
+ * @returns {{
+ *   routes: Object<string,{confidence:string,reason:string}>,
+ *   actions: Object<string,{confidence:string,reason:string}>,
+ *   disabledRouteIntents: string[],
+ *   disabledActionIntents: string[],
+ *   stats: object,
+ * }}
+ */
+function scoreSurface({ manifest, evidence = {}, included = [], analysisRoot, platform = 'web', surface = null }) {
+  const empty = {
+    routes: {},
+    actions: {},
+    disabledRouteIntents: [],
+    disabledActionIntents: [],
+    stats: { applied: false, reason: 'not-web' },
+  };
+
+  // Web-first. Other platforms: reachability is not computed confidently yet,
+  // so we return no disables (fail towards including). Honest limitation.
+  if (platform !== 'web') return empty;
+  if (!manifest || !Array.isArray(manifest.routes)) return empty;
+
+  const surf = surface || computeSurface({ included, analysisRoot, platform });
+  const { extracted, edges, absSet, routeMap, entryFiles, reached, reachableClosure, globalAuthGate, trustworthy } = surf;
+  const canScore = surf.applied;
+  const allTargetsSize = surf.resolvableTargets;
+
+  const evAbs = (rel) => {
+    if (!rel) return null;
+    const abs = path.resolve(analysisRoot, rel);
+    return absSet.has(abs) ? abs : null;
+  };
+  const routeEv = evidence.routes || {};
+  const actionEv = evidence.actions || {};
+
   const routes = {};
   const disabledRouteIntents = [];
   const entryUrls = new Set([...entryFiles].map(() => '/'));
@@ -393,7 +450,7 @@ function scoreSurface({ manifest, evidence = {}, included = [], analysisRoot, pl
               : 'unknown',
       entryCount: entryFiles.size,
       reachableScreens: reached.size,
-      resolvableTargets: allTargets.size,
+      resolvableTargets: allTargetsSize,
       trustworthy,
       globalAuthGate,
       routesDisabled: disabledRouteIntents.length,
@@ -402,4 +459,4 @@ function scoreSurface({ manifest, evidence = {}, included = [], analysisRoot, pl
   };
 }
 
-module.exports = { scoreSurface, normUrl, buildWebRouteMap, buildGraphFromFiles };
+module.exports = { scoreSurface, computeSurface, normUrl, buildWebRouteMap, buildGraphFromFiles };

package/src/verify.js

@@ -117,6 +117,36 @@ function verifyManifest(manifest, evidence, sentFiles, staticRoutes, opts = {})
       continue;
     }
 
+    // LINK/navigation actions: no handler. Verify the navTarget appears VERBATIM
+    // in the evidence file (the real href/URL/anchor) — concrete, hallucination-
+    // proof evidence. No wiring is generated for these.
+    if (action.kind === 'link') {
+      const target = String(action.navTarget || ev.href || '').trim();
+      if (!target) {
+        provenance.actions.push({
+          intent: action.intent, included: false,
+          reason: `link action '${action.intent}' has no navTarget — DROPPED`,
+        });
+        continue;
+      }
+      if (!content.includes(target)) {
+        provenance.actions.push({
+          intent: action.intent, included: false,
+          reason: `link action navTarget '${target}' not found verbatim in '${evFile}' — DROPPED`,
+        });
+        continue;
+      }
+      // Normalize: link actions carry no handler and never require wiring.
+      action.handler = '';
+      actions.push(action);
+      provenance.actions.push({
+        intent: action.intent, included: true,
+        verification: `link target '${target}' confirmed in ${evFile}`,
+        evidence: ev,
+      });
+      continue;
+    }
+
     // The handler must be a real identifier in the evidence file. Also accept
     // any identifier from the symbol (covers "store.addItem"-style handlers).
     const candidates = [action.handler, ...identifiersIn(ev.symbol)].filter(Boolean);

package/src/wireHandlers.js

@@ -612,6 +612,9 @@ function prepareHandlerPlan({ appRoot, manifest, evidence, wiring = {}, fyodosDi
 
   for (const action of actions) {
     const intent = action.intent;
+    // Link/navigation actions have no handler and need NO wiring — the client
+    // performs the navigation in navTarget. Skip them entirely here.
+    if (action.kind === 'link') continue;
     const handler = action.handler || intent;
     const ev = evActions[intent] || {};
     const evFile = normRel(ev.file);
@@ -1373,6 +1376,9 @@ async function runAutoCorrectionLoop(ctx) {
 
   for (const action of manifest.actions || []) {
     const intent = action.intent;
+    // Link/navigation actions need no wiring (no handler); never run the wiring
+    // verify/auto-correct loop for them.
+    if (action.kind === 'link') continue;
     let attempt = 0;
     let lastError = '';
     let resolved = null;