@geraldmaron/construct 1.4.2 → 1.5.1

package/lib/intake/session-prelude.mjs

@@ -13,12 +13,14 @@
 import { createIntakeQueue } from './queue.mjs';
 import { formatTriageLine } from './classify.mjs';
 import { isBrokered } from '../mcp/broker.mjs';
+import { getDeploymentMode } from '../deployment-mode.mjs';
 import { getRebrand } from '../scopes/rebrand.mjs';
 import { homedir as osHomedir } from 'node:os';
 import { readLastTick } from '../oracle/index.mjs';
 import { listPending } from '../oracle/actions.mjs';
 import { readLatestVerdict } from '../oracle/verdicts.mjs';
 import { isVerdictOnlyGap } from '../oracle/policy.mjs';
+import { heartbeatFreshness, formatAge } from '../oracle/heartbeat.mjs';
 
 export function buildIntakePrelude({ cwd, env = process.env } = {}) {
   if (!cwd) return '';
@@ -41,9 +43,9 @@ export function buildIntakePrelude({ cwd, env = process.env } = {}) {
   }
 }
 
-export function buildBrokerStatusLine({ env = process.env } = {}) {
-  const active = isBrokered(env);
-  const mode = env?.CONSTRUCT_DEPLOYMENT_MODE || 'solo';
+export function buildBrokerStatusLine({ env = process.env, cwd } = {}) {
+  const active = isBrokered(env, { cwd });
+  const mode = getDeploymentMode(env, { cwd });
   if (!active) {
     return `MCP broker: off · deployment mode: ${mode} (set CONSTRUCT_MCP_BROKER=on to engage in solo mode).`;
   }
@@ -52,7 +54,7 @@ export function buildBrokerStatusLine({ env = process.env } = {}) {
 
 export function buildSessionPrelude({ cwd, env = process.env } = {}) {
   const intake = buildIntakePrelude({ cwd, env });
-  const broker = buildBrokerStatusLine({ env });
+  const broker = buildBrokerStatusLine({ env, cwd });
   const oracle = buildOraclePrelude({ cwd, env });
   if (!intake && !broker && !oracle) return '';
   const parts = [];
@@ -62,6 +64,26 @@ export function buildSessionPrelude({ cwd, env = process.env } = {}) {
   return parts.join('\n\n');
 }
 
+/**
+ * lib/oracle/synthesize.mjs renders gap detail text against a 24h lookback
+ * window ("in the last 24h"); a verdict older than that window describes a
+ * period disjoint from the present, so the same threshold marks it stale.
+ * Missing/unparseable `at` resolves to Infinity (stale, not fresh) rather
+ * than defaulting to zero age.
+ */
+const VERDICT_STALE_MS = 24 * 60 * 60 * 1000;
+
+function verdictFreshness(verdict, now = Date.now()) {
+  const at = verdict?.at;
+  const parsed = at ? Date.parse(at) : NaN;
+  const ageMs = Number.isFinite(parsed) ? now - parsed : Infinity;
+  return {
+    ageMs,
+    stale: !Number.isFinite(ageMs) || ageMs > VERDICT_STALE_MS,
+    asOf: Number.isFinite(parsed) ? new Date(parsed).toISOString() : null,
+  };
+}
+
 /**
  * Oracle verdict + pending queue for session-start (mirror doctor warnings).
  */
@@ -75,7 +97,19 @@ export function buildOraclePrelude({ cwd, env = process.env, homeDir } = {}) {
     const pending = listPending(cwd).filter((p) => p.status === 'pending');
     const v = verdict?.verdict ?? last?.verdict ?? 'unknown';
     if (v === 'healthy' && pending.length === 0) return '';
-    const lines = [`\n## Oracle overseer · verdict: **${v}**`];
+    const source = verdict ?? last;
+    const { ageMs, stale, asOf } = verdictFreshness(source);
+    const verdictHead = v === 'unknown'
+      ? `\n## Oracle overseer · verdict: **${v}**`
+      : `\n## Oracle overseer · verdict: **${v}** (as of ${asOf ?? 'unknown'}, ${formatAge(ageMs)} ago)`;
+    const lines = [verdictHead];
+    if (v !== 'unknown' && stale) {
+      lines.push(`- STALE: verdict is older than ${formatAge(VERDICT_STALE_MS)}; gap details below describe the verdict date, not now.`);
+    }
+    const heartbeat = heartbeatFreshness(last);
+    if (heartbeat.stale && pending.length > 0) {
+      lines.push(`- [high] oracle-producer-stalled: no oracle tick in ${formatAge(heartbeat.ageMs)} while ${pending.length} approval(s) wait — the daemon looks stalled, not idle; run \`construct oracle status\` / \`construct oracle start\`.`);
+    }
     const gapSource = verdict?.gaps ?? last?.gaps ?? [];
     const top = gapSource.filter((g) => g.severity === 'high').slice(0, 3);
     for (const g of top) {
@@ -83,7 +117,7 @@ export function buildOraclePrelude({ cwd, env = process.env, homeDir } = {}) {
         const hint = g.id === 'beads-hygiene'
           ? 'run `construct beads drift`'
           : g.id === 'workflow-misaligned'
-            ? 'run `construct workflow init` or `construct init`'
+            ? 'run `construct workflow new` or `construct init`'
             : 'see `construct oracle gaps`';
         lines.push(`- [${g.severity}] ${g.id} (verdict-only): ${g.detail} — ${hint}`);
       } else {
@@ -102,7 +136,7 @@ export function buildOraclePrelude({ cwd, env = process.env, homeDir } = {}) {
 
 export function readOracleDockState({ cwd, env = process.env, homeDir } = {}) {
   if (!cwd || env.CONSTRUCT_ORACLE === 'off' || env.CONSTRUCT_ORACLE === '0') {
-    return { visible: false, verdict: null, pendingCount: 0, topGaps: [], summary: '' };
+    return { visible: false, verdict: null, pendingCount: 0, topGaps: [], summary: '', asOf: null, stale: false, producerStalled: false, producerAgeMs: null };
   }
   try {
     const home = homeDir ?? osHomedir();
@@ -113,23 +147,38 @@ export function readOracleDockState({ cwd, env = process.env, homeDir } = {}) {
     const gapSource = verdictDoc?.gaps ?? last?.gaps ?? [];
     const topGaps = gapSource.filter((g) => g.severity === 'high').slice(0, 3);
     const visible = verdict !== 'healthy' || pending.length > 0;
+    const { stale, asOf } = verdictFreshness(verdictDoc ?? last);
+    const heartbeat = heartbeatFreshness(last);
+    const producerStalled = heartbeat.stale && pending.length > 0;
     const parts = [`verdict ${verdict}`];
     if (pending.length) parts.push(`${pending.length} pending`);
+    if (verdict !== 'unknown' && stale) parts.push('STALE');
+    if (producerStalled) parts.push('PRODUCER STALLED');
     return {
       visible,
       verdict,
       pendingCount: pending.length,
       topGaps,
       summary: parts.join(' · '),
+      asOf,
+      stale: verdict !== 'unknown' && stale,
+      producerStalled,
+      producerAgeMs: heartbeat.ageMs,
     };
   } catch {
-    return { visible: false, verdict: null, pendingCount: 0, topGaps: [], summary: '' };
+    return { visible: false, verdict: null, pendingCount: 0, topGaps: [], summary: '', asOf: null, stale: false, producerStalled: false, producerAgeMs: null };
   }
 }
 
 export function formatOracleDockDetail(state) {
   if (!state?.visible) return 'Oracle: healthy — no pending approvals.';
   const lines = [`Oracle overseer · ${state.summary}`];
+  if (state.stale) {
+    lines.push(`  STALE: verdict as of ${state.asOf ?? 'unknown'}; gap details describe the verdict date, not now.`);
+  }
+  if (state.producerStalled) {
+    lines.push(`  PRODUCER STALLED: no oracle tick in ${formatAge(state.producerAgeMs)} while ${state.pendingCount} approval(s) wait — the daemon may be down.`);
+  }
   for (const g of state.topGaps || []) {
     if (isVerdictOnlyGap(g)) {
       lines.push(`  [${g.severity}] ${g.id} (verdict-only): ${g.detail}`);

package/lib/integrations/intake-integrations.mjs

@@ -19,7 +19,7 @@ import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { configDir } from '../config/xdg.mjs';
-import { resolveOpRef } from '../providers/secret-resolver.mjs';
+import { resolveOpRef, hasSecret, hasAnySecret, peekRawCredential } from '../providers/secret-resolver.mjs';
 
 // ── Multi-method auth helpers ────────────────────────────────────────────
 
@@ -588,8 +588,13 @@ export function tagIntakeWithExternalRef(rootDir, intakeId, system, externalUrl,
 }
 
 /**
- * Synchronous credential resolver for use in constructors and sync contexts.
- * Mirrors the async resolveCredential above. Checks env → .env → config.env → shell rc.
+ * Credential resolver for the actual publish paths (createGitHubIssue,
+ * createJiraTicket, publishArtifactToConfluence) that need a real, materialized
+ * value to make an API call. Checks env → .env → config.env → shell rc,
+ * resolving a 1Password op:// reference through resolveOpRef when the rc tier
+ * carries one. Not for status/detection — detectIntegrationConfig below uses
+ * hasSecret/hasAnySecret/peekRawCredential instead, which never resolve op:// or
+ * source a shell rc file (ADR-0049 §2: presence-first in short-lived paths).
  */
 function resolveCredentialSync(varName, homeDir) {
   if (process.env[varName]) return process.env[varName];
@@ -640,126 +645,71 @@ function resolveCredentialSync(varName, homeDir) {
 // ── Configuration detection ──────────────────────────────────────────────
 
 /**
- * Check which integrations are configured.
- * Scopes environment, .env files, ~/.construct/config.env, and shell rc
- * files (including 1Password op:// refs).
+ * Check which integrations are configured. A status/detection surface must
+ * never materialize a credential (ADR-0049 §2: "never to merely list or
+ * check") — this reports presence by shape only: env var set, a project/config/
+ * home .env entry exists, or a shell rc `export VAR=...` line matches. It never
+ * calls resolveOpRef and never sources a shell rc file (contrast
+ * resolveCredentialSync above, used only when an actual API call needs the
+ * real value). `gh auth status` / `gh repo view` are read-only CLI queries,
+ * not secret materialization — gh manages its own token internally and never
+ * hands Construct a plaintext value here.
  *
  * @param {object} [opts]
  * @param {string} [opts.homeDir]
- * @returns {{ github: boolean, jira: boolean, confluence: boolean, githubToken: boolean, jiraToken: boolean, confluenceToken: boolean }}
+ * @returns {{ github: boolean, jira: boolean, confluence: boolean, githubMethod: string|null, githubRepo: string|null, jiraHost: string|null, confluenceSpace: string|null }}
  */
 export function detectIntegrationConfig({ homeDir } = {}) {
   const hd = homeDir || homedir();
 
-  // GitHub — try gh CLI first, then env vars
-  const ghAuth = resolveGitHubAuth(hd);
-
-  // Jira
-  const jiraHost = resolveCredentialSync('JIRA_HOST', hd);
-  const jiraUser = resolveCredentialSync('JIRA_USER', hd);
-  const jiraToken = resolveCredentialSync('JIRA_API_TOKEN', hd);
-  const jiraProject = resolveCredentialSync('JIRA_PROJECT', hd);
-
-  // Confluence
-  const confHost = resolveCredentialSync('CONFLUENCE_HOST', hd);
-  const confUser = resolveCredentialSync('CONFLUENCE_USER', hd);
-  const confToken = resolveCredentialSync('CONFLUENCE_API_TOKEN', hd);
-  const confSpace = resolveCredentialSync('CONFLUENCE_SPACE', hd);
-
-  return {
-    github: ghAuth.method === 'gh' || Boolean(ghAuth.token && ghAuth.repo),
-    githubMethod: ghAuth.method || null,
-    githubRepo: ghAuth.repo || null,
-    jira: Boolean(jiraHost && jiraUser && jiraToken && jiraProject),
-    jiraHost: jiraHost || null,
-    confluence: Boolean(confHost && confUser && confToken && confSpace),
-    confluenceSpace: confSpace || null,
-  };
-}
-
-/**
- * Resolve a credential from env, .env files, config.env, or shell rc files.
- * Mirrors the approach in lib/health-check.mjs.
- */
-function resolveCredential(varName, homeDir) {
-  if (process.env[varName]) return process.env[varName];
-
-  // Project .env
+  // GitHub
+  let ghCliAuthenticated = false;
   try {
-    const projectEnv = join(process.cwd(), '.env');
-    if (existsSync(projectEnv)) {
-      const content = readFileSync(projectEnv, 'utf8');
-      const m = content.match(new RegExp(`^${varName}=["']?(.+?)["']?$`, 'm'));
-      if (m) return m[1].trim();
-    }
-  } catch { /* skip */ }
+    const status = spawnSync('gh', ['auth', 'status'], { encoding: 'utf8', timeout: 5000 });
+    ghCliAuthenticated = status.status === 0;
+  } catch { /* gh not available */ }
 
-  // ~/.env
-  try {
-    const homeEnv = join(homeDir, '.env');
-    if (existsSync(homeEnv)) {
-      const content = readFileSync(homeEnv, 'utf8');
-      const m = content.match(new RegExp(`^${varName}=["']?(.+?)["']?$`, 'm'));
-      if (m) return m[1].trim();
-    }
-  } catch { /* skip */ }
+  const githubTokenPresent = hasAnySecret(['GITHUB_TOKEN', 'GH_TOKEN'], { home: hd });
+  let githubRepo = process.env.GITHUB_REPO || peekRawCredential('GITHUB_REPO', { home: hd })?.raw || null;
+  let githubMethod = null;
 
-  // config.env in the XDG config dir
-  try {
-    const cfgPath = join(configDir(homeDir), 'config.env');
-    if (existsSync(cfgPath)) {
-      const content = readFileSync(cfgPath, 'utf8');
-      const m = content.match(new RegExp(`^${varName}=(.+)$`, 'm'));
-      if (m) return m[1].trim();
+  if (ghCliAuthenticated) {
+    githubMethod = 'gh';
+    if (!githubRepo) {
+      try {
+        const remote = spawnSync('gh', ['repo', 'view', '--json', 'nameWithOwner', '--jq', '.nameWithOwner'], { encoding: 'utf8', timeout: 5000 });
+        if (remote.status === 0 && remote.stdout?.trim()) githubRepo = remote.stdout.trim();
+      } catch { /* gh not available */ }
     }
-  } catch { /* skip */ }
+  } else if (githubTokenPresent) {
+    githubMethod = 'env';
+  }
 
-  // Shell rc files (including 1Password op:// refs and command substitutions)
-  try {
-    const shellFiles = [join(homeDir, '.zshrc'), join(homeDir, '.bashrc'), join(homeDir, '.bash_profile'), join(homeDir, '.profile')];
-    for (const rcPath of shellFiles) {
-      if (!existsSync(rcPath)) continue;
-      try {
-        const content = readFileSync(rcPath, 'utf8');
-        // Direct export (simple values only, not command substitutions)
-        const directRe = new RegExp(`^\\s*export\\s+${varName}="?([^"'\\$\\(]+)"?$`, 'm');
-        const directMatch = content.match(directRe);
-        if (directMatch) return directMatch[1].trim();
-
-        // op:// ref — try 1Password CLI
-        const opRe = new RegExp(`export\\s+${varName}=["']?\\$\\(op read '([^']+)'\\)["']?`, 'm');
-        const opMatch = content.match(opRe);
-        if (opMatch) {
-          // op read failures often mean the rc-file field name doesn't match the
-          // actual 1Password item field; surface them under the debug flag.
-          try {
-            return resolveOpRef(opMatch[1]);
-          } catch (err) {
-            if (process.env.CONSTRUCT_DEBUG_CREDENTIALS === '1') {
-              process.stderr.write(`[credentials] op read failed for ${varName}: ${String(err.message).slice(0, 200)}\n`);
-            }
-          }
-        }
+  // Jira
+  const jiraConfigured = Boolean(
+    hasSecret('JIRA_HOST', { home: hd })
+    && hasSecret('JIRA_USER', { home: hd })
+    && hasSecret('JIRA_API_TOKEN', { home: hd })
+    && hasSecret('JIRA_PROJECT', { home: hd }),
+  );
+  const jiraHost = peekRawCredential('JIRA_HOST', { home: hd })?.raw || null;
 
-        // If the value uses command substitution ($(...)), try evaluating via
-        // a shell that sources the rc file. This catches any $(...) pattern
-        // including op read with different field names or other secret managers.
-        const cmdSubRe = new RegExp(`^export\\s+${varName}="?\\$\\((.+)\\)"?`, 'm');
-        const cmdMatch = content.match(cmdSubRe);
-        if (cmdMatch) {
-          try {
-            const shellResult = spawnSync('zsh', ['-c', `source "${rcPath}" 2>/dev/null; echo "\${${varName}}"`], {
-              encoding: 'utf8', timeout: 5000,
-            });
-            if (shellResult.status === 0 && shellResult.stdout?.trim()) {
-              const val = shellResult.stdout.trim().split('\n').pop()?.trim();
-              if (val && !val.includes('ERROR') && !val.includes('could not read')) return val;
-            }
-          } catch { /* shell eval failed */ }
-        }
-      } catch { /* skip unreadable */ }
-    }
-  } catch { /* skip */ }
+  // Confluence
+  const confluenceConfigured = Boolean(
+    hasSecret('CONFLUENCE_HOST', { home: hd })
+    && hasSecret('CONFLUENCE_USER', { home: hd })
+    && hasSecret('CONFLUENCE_API_TOKEN', { home: hd })
+    && hasSecret('CONFLUENCE_SPACE', { home: hd }),
+  );
+  const confluenceSpace = peekRawCredential('CONFLUENCE_SPACE', { home: hd })?.raw || null;
 
-  return null;
+  return {
+    github: ghCliAuthenticated || Boolean(githubTokenPresent && githubRepo),
+    githubMethod,
+    githubRepo,
+    jira: jiraConfigured,
+    jiraHost,
+    confluence: confluenceConfigured,
+    confluenceSpace,
+  };
 }

package/lib/intent-classifier.mjs

@@ -27,6 +27,7 @@
 import crypto from 'node:crypto';
 import { readCurrentModels, readOpenRouterApiKeyFromOpenCodeConfig } from './model-router.mjs';
 import { getUserEnvPath } from './env-config.mjs';
+import { extractOpRef, hasSecret, resolveOpRefAsync, resolveSecretAsync } from './providers/secret-resolver.mjs';
 import { logIntentVerification } from './telemetry/intent-verifications.mjs';
 
 export const INTENT_VERIFY_TIMEOUT_MS = 3000;
@@ -66,12 +67,49 @@ export function resetCache() {
   CACHE.clear();
 }
 
+async function resolveSecretOrNull(varName, { env = process.env, allowAmbient = true } = {}) {
+  try {
+    return await resolveSecretAsync(varName, { env, allowAmbient });
+  } catch {
+    return null;
+  }
+}
+
+async function materializeConfiguredKey(rawValue) {
+  if (typeof rawValue !== 'string' || rawValue.length === 0) return null;
+  const ref = extractOpRef(rawValue);
+  try {
+    return ref ? await resolveOpRefAsync(ref) : rawValue;
+  } catch {
+    return null;
+  }
+}
+
+async function resolveOpenRouterApiKey() {
+  const envKey = await resolveSecretOrNull('OPENROUTER_API_KEY');
+  if (envKey) return envKey;
+  try {
+    return await materializeConfiguredKey(readOpenRouterApiKeyFromOpenCodeConfig());
+  } catch {
+    return null;
+  }
+}
+
+async function resolveAnthropicApiKey() {
+  return resolveSecretOrNull('ANTHROPIC_API_KEY');
+}
+
 function isApiKeyConfigured() {
-  if (process.env.ANTHROPIC_API_KEY) return true;
-  if (process.env.OPENROUTER_API_KEY) return true;
+  // Presence gate only — hasSecret detects a configured key (including an op://
+  // reference) without materializing it, so deciding whether to run the background
+  // intent verifier never spawns `op read` or a 1Password biometric prompt on the
+  // routing hot path. Materialization happens lazily in defaultModelCaller when a
+  // verification call is actually made.
+  if (hasSecret('ANTHROPIC_API_KEY')) return true;
+  if (hasSecret('OPENROUTER_API_KEY')) return true;
   try {
     if (readOpenRouterApiKeyFromOpenCodeConfig()) return true;
-  } catch { /* ignore */ }
+  } catch { /* OpenCode provider config is optional */ }
   return false;
 }
 
@@ -115,8 +153,8 @@ async function fetchWithTimeout(url, options, timeoutMs = INTENT_VERIFY_TIMEOUT_
 }
 
 async function defaultModelCaller({ system, user }) {
-  const orKey = process.env.OPENROUTER_API_KEY || readOpenRouterApiKeyFromOpenCodeConfig();
-  const anthropicKey = process.env.ANTHROPIC_API_KEY;
+  const orKey = await resolveOpenRouterApiKey();
+  const anthropicKey = await resolveAnthropicApiKey();
   if (!orKey && !anthropicKey) throw new Error('no model api key configured');
 
   const envPath = getUserEnvPath();

package/lib/libreoffice-export.mjs

@@ -15,26 +15,26 @@ const SOFFICE_CANDIDATES = [
   '/Applications/LibreOffice.app/Contents/MacOS/soffice',
 ];
 
-function whichBin(name) {
+function whichBin(name, env) {
   const cmd = process.platform === 'win32' ? 'where' : 'which';
-  const result = spawnSync(cmd, [name], { encoding: 'utf8' });
+  const result = spawnSync(cmd, [name], { encoding: 'utf8', env });
   if (result.status !== 0) return null;
   return (result.stdout || '').trim().split('\n')[0] || null;
 }
 
-export function resolveLibreOfficeBin(env = process.env) {
+export function resolveLibreOfficeBin(env = process.env, { existsSyncFn = fs.existsSync } = {}) {
   const fromEnv = (env.CONSTRUCT_LIBREOFFICE_BIN || env.SOFFICE_BIN || '').trim();
-  if (fromEnv && fs.existsSync(fromEnv)) return fromEnv;
+  if (fromEnv && existsSyncFn(fromEnv)) return fromEnv;
   for (const candidate of SOFFICE_CANDIDATES) {
-    if (candidate.includes('/') && fs.existsSync(candidate)) return candidate;
-    const found = whichBin(candidate);
+    if (candidate.includes('/') && existsSyncFn(candidate)) return candidate;
+    const found = whichBin(candidate, env);
     if (found) return found;
   }
   return null;
 }
 
-export function libreOfficePresent(env = process.env) {
-  return Boolean(resolveLibreOfficeBin(env));
+export function libreOfficePresent(env = process.env, opts) {
+  return Boolean(resolveLibreOfficeBin(env, opts));
 }
 
 export function libreOfficeInstallHint() {

package/lib/logging/rotate.mjs

@@ -2,8 +2,9 @@
  * lib/logging/rotate.mjs — shared file-rotation primitive.
  *
  * Two consumers need bounded log files: the trace writer
- * (`.cx/traces/<date>.jsonl`, capped to avoid >100MB single-file commits
- * that GitHub rejects) and the embed daemon stdout log
+ * (state-root `traces/<date>.jsonl` — ADR-0066, machine-scoped, not
+ * project-local — capped to avoid >100MB single-file commits that GitHub
+ * would reject if ever committed) and the embed daemon stdout log
  * (`~/.cx/runtime/embed-daemon.log`, capped so a stuck "Telemetry skipped"
  * message can't fill the disk).
  *
@@ -183,8 +184,8 @@ export function appendWithRotationSync(filePath, line, { maxBytes, maxSegments =
  * background daemons).
  */
 export const LIMITS = {
-  // Trace shards under .cx/traces/<date>.jsonl — capped below GitHub's
-  // 100 MB single-file ceiling. Bead construct-1vv5.
+  // Trace shards under the state-root's traces/<date>.jsonl — capped below
+  // GitHub's 100 MB single-file ceiling. Bead construct-1vv5.
 
   trace: {
     maxBytes: 100 * 1024 * 1024,