@geraldmaron/construct 1.0.14 → 1.0.16

package/commands/remember/runbook.md

@@ -1,12 +1,6 @@
-<!--
-commands/remember/runbook.md (Write a runbook) step-by-step procedure for a recurring task or incident
-
-Write a runbook: step-by-step procedure for a recurring task or incident
--->
 ---
 description: "Write a runbook: step-by-step procedure for a recurring task or incident"
 ---
-
 You are Construct. Write a runbook for: $ARGUMENTS
 
 Structure:

package/commands/review/code.md

@@ -1,12 +1,6 @@
-<!--
-commands/review/code.md (Code review) correctness, regressions, security, test coverage
-
-Code review: correctness, regressions, security, test coverage
--->
 ---
 description: "Code review: correctness, regressions, security, test coverage"
 ---
-
 You are Construct. Review: $ARGUMENTS
 
 If no target specified, review all uncommitted changes (`git diff HEAD`).

package/commands/review/quality.md

@@ -1,12 +1,6 @@
-<!--
-commands/review/quality.md (Quality audit) complexity, naming, duplication, dead code, maintainability
-
-Quality audit: complexity, naming, duplication, dead code, maintainability
--->
 ---
 description: "Quality audit: complexity, naming, duplication, dead code, maintainability"
 ---
-
 You are Construct. Audit quality for: $ARGUMENTS
 
 Check:

package/commands/review/security.md

@@ -1,12 +1,6 @@
-<!--
-commands/review/security.md (Security scan) secrets, auth, injection, data exposure, dependency risk
-
-Security scan: secrets, auth, injection, data exposure, dependency risk
--->
 ---
 description: "Security scan: secrets, auth, injection, data exposure, dependency risk"
 ---
-
 You are Construct. Scan: $ARGUMENTS
 
 If no target specified, scan all uncommitted changes.

package/commands/ship/ready.md

@@ -1,12 +1,6 @@
-<!--
-commands/ship/ready.md (Pre-release check) is this ready to ship?
-
-Pre-release check: is this ready to ship?
--->
 ---
 description: "Pre-release check: is this ready to ship?"
 ---
-
 You are Construct. Check if the following is ready: $ARGUMENTS
 
 Check:

package/commands/ship/release.md

@@ -1,12 +1,6 @@
-<!--
-commands/ship/release.md (Release) plan rollout, changelog, rollback, and post-release verification
-
-Release: plan rollout, changelog, rollback, and post-release verification
--->
 ---
 description: "Release: plan rollout, changelog, rollback, and post-release verification"
 ---
-
 You are Construct. Release the following: $ARGUMENTS
 
 Readiness checklist:

package/commands/ship/status.md

@@ -1,12 +1,6 @@
-<!--
-commands/ship/status.md (Status) current project state, workflow, uncommitted changes, recent activity
-
-Status: current project state, workflow, uncommitted changes, recent activity
--->
 ---
 description: "Status: current project state, workflow, uncommitted changes, recent activity"
 ---
-
 You are Construct. Report status for: $ARGUMENTS
 
 Check and report:

package/commands/understand/docs.md

@@ -1,12 +1,6 @@
-<!--
-commands/understand/docs.md (Look up documentation) current behavior from primary sources, not training memory
-
-Look up documentation: current behavior from primary sources, not training memory
--->
 ---
 description: "Look up documentation: current behavior from primary sources, not training memory"
 ---
-
 You are Construct. Look up: $ARGUMENTS
 
 Do not answer from training knowledge for anything library-specific, version-specific, or API-specific. Search first.

package/commands/understand/research.md

@@ -1,12 +1,6 @@
-<!--
-commands/understand/research.md. Research a topic. Verify facts from primary sources, separate evidence from inference.
-
-Research a topic. Verify facts from primary sources, separate evidence from inference.
--->
 ---
 description: Research a topic. Verify facts from primary sources, separate evidence from inference.
 ---
-
 You are Construct. Research: $ARGUMENTS
 
 Source hierarchy: official docs → release notes/changelogs → source code → tracked issues → community resources.

package/commands/understand/this.md

@@ -1,12 +1,6 @@
-<!--
-commands/understand/this.md (Explore and understand something) trace execution paths, map structure, gather evidence
-
-Explore and understand something: trace execution paths, map structure, gather evidence
--->
 ---
 description: "Explore and understand something: trace execution paths, map structure, gather evidence"
 ---
-
 You are Construct. Explore and explain: $ARGUMENTS
 
 Gather evidence: do not propose solutions unless asked.

package/commands/understand/why.md

@@ -1,12 +1,6 @@
-<!--
-commands/understand/why.md (Investigate a failure) why is this broken, what is the root cause
-
-Investigate a failure: why is this broken, what is the root cause
--->
 ---
 description: "Investigate a failure: why is this broken, what is the root cause"
 ---
-
 You are Construct. Investigate: $ARGUMENTS
 
 1. Capture: exact error, stack trace, reproduction steps

package/commands/work/clean.md

@@ -1,12 +1,6 @@
-<!--
-commands/work/clean.md (Remove AI-generated code smells) verbosity, hedging, dead comments, generic names
-
-Remove AI-generated code smells: verbosity, hedging, dead comments, generic names
--->
 ---
 description: "Remove AI-generated code smells: verbosity, hedging, dead comments, generic names"
 ---
-
 You are cx-reviewer identifying AI slop in: $ARGUMENTS
 
 Then dispatch cx-engineer to apply the fixes.

package/commands/work/drive.md

@@ -1,12 +1,6 @@
-<!--
-commands/work/drive.md (Full autonomous execution) explore, plan, implement, verify, loop until done
-
-Full autonomous execution: explore, plan, implement, verify, loop until done
--->
 ---
 description: "Full autonomous execution: explore, plan, implement, verify, loop until done"
 ---
-
 You are Construct in drive mode. Execute $ARGUMENTS fully and autonomously without stopping for confirmation.
 
 ## Execution contract

package/commands/work/optimize-prompts.md

@@ -1,12 +1,6 @@
-<!--
-commands/work/optimize-prompts.md: Prompt optimization command.
-
-Runs the closed-loop prompt optimization workflow using telemetry trace data.
--->
 ---
 description: "Closed-loop prompt optimization: read telemetry traces, diagnose failures, push improved version to staging"
 ---
-
 You are cx-trace-reviewer running a prompt optimization cycle for: $ARGUMENTS
 
 If $ARGUMENTS is empty, optimize all agents with median quality score below 0.65 in the past 7 days.

package/commands/work/parallel-review.md

@@ -1,12 +1,6 @@
-<!--
-commands/work/parallel-review.md (Adversarial parallel review) 5 reviewers must agree before output ships
-
-Adversarial parallel review: 5 reviewers must agree before output ships
--->
 ---
 description: "Adversarial parallel review: 5 reviewers must agree before output ships"
 ---
-
 You are Construct running a parallel adversarial review of: $ARGUMENTS
 
 Dispatch the following 5 review roles concurrently:

package/db/schema/010_cx_scores.sql

@@ -0,0 +1,51 @@
+-- db/schema/010_cx_scores.sql — Per-trace quality score log + skill quality correlation view.
+--
+-- Backs `construct skills correlate-quality`.  Producer: lib/mcp/tools/telemetry.mjs
+-- cxScore() writes a row here when CONSTRUCT_DB_URL (or DATABASE_URL) is set.
+-- Local JSONL/observation paths remain primary in solo mode; this table is
+-- primary in team/enterprise mode where multiple agents share a session
+-- timeline and the dashboard reads aggregate correlations.
+
+create table if not exists construct_cx_scores (
+  id           bigserial    primary key,
+  ts           timestamptz  not null,
+  trace_id     text         not null,
+  session_id   text,
+  agent_id     text,
+  name         text         not null default 'quality',
+  value        numeric      not null,
+  comment      text
+);
+
+create index if not exists construct_cx_scores_trace_idx
+  on construct_cx_scores (trace_id);
+
+create index if not exists construct_cx_scores_session_ts_idx
+  on construct_cx_scores (session_id, ts desc);
+
+create index if not exists construct_cx_scores_agent_ts_idx
+  on construct_cx_scores (agent_id, ts desc);
+
+-- Skill quality correlation view: joins skill invocations and quality
+-- scores by session_id so a reader can ask "for sessions where skill X was
+-- invoked, what's the median / mean / p10 quality score?" The view is a
+-- simple aggregate over the past 90 days; queries that need a longer
+-- window can pull straight from the underlying tables. Materialised view
+-- not used here because the correlation surface is small and the freshness
+-- expectation is "current session" not "yesterday's batch."
+
+create or replace view construct_skill_quality_correlation as
+select
+  inv.skill_id,
+  count(distinct inv.session_id)                            as sessions,
+  count(distinct sc.id)                                     as score_count,
+  round(avg(sc.value)::numeric, 3)                          as mean_score,
+  round((percentile_cont(0.5) within group (order by sc.value))::numeric, 3)  as median_score,
+  round((percentile_cont(0.10) within group (order by sc.value))::numeric, 3) as p10_score,
+  round((percentile_cont(0.90) within group (order by sc.value))::numeric, 3) as p90_score,
+  max(sc.ts)                                                as last_scored_at
+from construct_skill_invocations inv
+  inner join construct_cx_scores sc on sc.session_id = inv.session_id
+where inv.ts > now() - interval '90 days'
+  and sc.ts  > now() - interval '90 days'
+group by inv.skill_id;

package/lib/beads-client.mjs

@@ -28,6 +28,21 @@ import {
   cleanupStaleQueue,
 } from './beads-lock.mjs';
 
+// Anchored bead-ID format. IDs reaching the bd shell boundary must match this;
+// regex-extracted IDs from PR bodies, agent transcripts, or intake packets get
+// re-validated here so a malformed value cannot reach the database. spawnSync
+// uses argv-array form so shell injection isn't the failure mode — log
+// corruption from a bogus ID is.
+
+const BEAD_ID_RE = /^[a-z]+-[a-z0-9]+$/;
+
+export function assertBeadId(id) {
+  if (typeof id !== 'string' || !BEAD_ID_RE.test(id)) {
+    throw new Error(`bd: invalid bead id ${JSON.stringify(id)} — expected prefix-suffix slug`);
+  }
+  return id;
+}
+
 import {
   concurrentRead,
   optimisticWrite,
@@ -253,7 +268,7 @@ async function runWithLegacyLock(args, opts, cwd, commandDesc) {
   if (!lock) {
     // Failed to get lock; add to queue if allowed
     const maxQueueWaitMs = opts.maxQueueWaitSeconds * 1000;
-    if (Date.now() - startWait + maxQueueWaitMs > maxQueueWaitMs) {
+    if (Date.now() - startWait > maxQueueWaitMs) {
       return {
         success: false,
         error: `Timeout waiting for lock after ${opts.timeoutSeconds}s`,
@@ -365,6 +380,7 @@ export async function listIssues(options = {}) {
  * Uses concurrent read (no locking needed).
  */
 export async function showIssue(id, options = {}) {
+  assertBeadId(id);
   return runBdJson(['show', id], { useOptimisticLocking: true, ...options });
 }
 
@@ -373,6 +389,7 @@ export async function showIssue(id, options = {}) {
  * Uses optimistic locking for better concurrency.
  */
 export async function claimIssue(id, options = {}) {
+  assertBeadId(id);
   // Use the specialized optimistic claim function
   const result = await claimBeadOptimistic(id, options);
   
@@ -388,6 +405,7 @@ export async function claimIssue(id, options = {}) {
  * Close an issue.
  */
 export async function closeIssue(id, options = {}) {
+  assertBeadId(id);
   return runBd(['close', id], options);
 }