@ghostpaw/questlog 0.9.1 → 0.10.1

package/dist/{questlog_skill_spec-LOQ2FNOF.js → chunk-D2W5MYNO.js}

@@ -1,7 +1,4 @@
 #!/usr/bin/env node
-import { questlogMcpInstructions } from './chunk-SVWAEAKC.js';
-import { reviewQuestlogTool, questlogSurfaceTools } from './chunk-3Y5F3SMB.js';
-
 // src/skills/skill_types.ts
 function defineQuestlogSkill(skill) {
   return skill;
@@ -727,8 +724,16 @@ Failure handling:
 - Do not filter by tags and assume that is the same as a schedule or dependency review.`
 });
 
+// src/skills/webhooks.ts
+var webhooksSkill = defineQuestlogSkill({
+  name: "webhooks",
+  description: "Configure signed outbound event webhooks and verify deliveries.",
+  content: '# Webhooks\n\nUse `questlog` to configure opt-in outbound automation. No server or scheduler is added.\nNo targets means no network calls. `manage_hooks` supports list, remove, tick with\n`dry_run`, and deliveries; add/test are CLI-only. `review_questlog` view `deliveries`\nand `questlog show <id>` expose pending/failed deliveries.\n\n```sh\nquestlog hook add https://example.org/wake --min-gap 60\nquestlog hook add https://example.org/team --tag work --events quest.due,quest.overdue --secret-stdin\nquestlog hook label work\nquestlog hook list\nquestlog tick --dry-run\nquestlog tick\nquestlog watch --interval 60\nquestlog hook test 1\nquestlog review deliveries\nquestlog show 12\nquestlog hook remove 1\n```\n\n`hook add` prints its random 32-byte signing secret once, also as `secret` in `--json`.\nSave it securely. `--secret-stdin` supplies one via stdin; there is no secret flag.\nList output redacts userinfo/query strings. Removal deletes the target and deliveries.\nDefault scope is the database; `--tag` matches quest tags, never rumors.\n`--events` defaults to all types. The DB label defaults to the filename without its\npath/extension (`questlog` in memory); set it to a name suitable for disclosure.\n\n```cron\n* * * * * questlog tick\n```\n\nCron\'s PATH may need `$HOME/.local/bin/questlog tick --db /path/to/quests.db`.\nWatch defaults to 60 seconds (minimum 5); SIGINT/SIGTERM finishes the current tick.\nTick exits 0 even when deliveries need retries. Dry-run records nothing and sends nothing.\n\nEvents are detected from the model at tick time:\n\n- `quest.due`: an unresolved, undeleted quest reaches its effective due time (own `due_at`, otherwise its undeleted questline\'s due time).\n- `quest.overdue`: that effective deadline is strictly earlier than now and the quest remains unresolved.\n- `quest.unblocked`: an unresolved quest is available, all active prerequisites have succeeded or been deleted, and at least one prerequisite succeeded after its unlock was installed. Occurrence time is the latest active prerequisite success or not-before time, whichever is later.\n- `repeatable.spawned`: a concrete repeatable instance was created; occurrence time is its creation time. Tick first materializes due anchors through the existing spawn operation.\n- `rumor.captured`: an undeleted rumor was created; occurrence time is its creation time, even if subsequently settled or dismissed.\n\nPersistent event keys contain type, entity ids, and occurrence time. Restarts and repeated\nticks do not repeat occurrences. Removed transitions between ticks cannot be reconstructed.\nOnly occurrences at/after target creation are assigned; tags are evaluated at assignment.\nTick materializes due repeatables using the existing spawn path, including during preview\nwith rollback. Batches contain only ids, event types, timestamps, and the DB label:\n\n```json\n{"type":"questlog.events","db":"work","deliveryId":"d_\u2026","sentAt":"2026-10-28T10:00:00.000Z","events":[{"id":"e_\u2026","type":"quest.due","questId":12,"occurredAt":"2026-10-28T09:59:00.000Z"}]}\n```\n\nHeaders are `content-type: application/json`, `user-agent: questlog/<version>`,\n`x-questlog-delivery: <deliveryId>`, `x-questlog-timestamp: <unix seconds>`, and\n`x-questlog-signature: sha256=<hex HMAC-SHA256(secret, timestamp + "." + rawBody)>`.\nNo titles, objectives, details, or tag text are sent. `hook test` sends a logged `hook.test`\nevent immediately, ignoring the min gap. Add and test are CLI-only in the tool facade;\n`manage_hooks` supports list, remove, tick (with `dry_run`), and deliveries.\n\n2xx delivers. Timeout is 5 seconds. Failures retry after 30 s, 1 m, 2 m, 4 m, doubling\nto 1 h plus <1 s jitter, subject to the target\'s min gap. Eight failures mark failed.\nRetries keep the delivery id/events; new events queue behind them. Keep the last 500\ndelivered log entries per target and all pending/failed entries. Transactional claims\nlease work for two minutes. A crash after receipt may retry: dedupe at the receiver.\n\n### Verifying a delivery\n\nCompute HMAC-SHA256 over `timestamp + "." + rawBody` with the secret and compare in constant\ntime. Reject timestamps older than 5 minutes (and timestamps too far in the future), then\ndedupe on `x-questlog-delivery`. Use durable deduplication storage in a production receiver.\nThis 15-line Node example uses an in-memory set:\n\n```js\nimport { createHmac, timingSafeEqual } from \'node:crypto\';\nimport { createServer } from \'node:http\';\nconst secret = process.env.WEBHOOK_SECRET, seen = new Set();\ncreateServer(async (req, res) => {\n  const chunks = []; for await (const chunk of req) chunks.push(chunk);\n  const rawBody = Buffer.concat(chunks), h = req.headers;\n  const timestamp = h[\'x-questlog-timestamp\'], id = h[\'x-questlog-delivery\'];\n  const age = Date.now() / 1000 - Number(timestamp);\n  const expected = createHmac(\'sha256\', secret).update(timestamp + \'.\').update(rawBody).digest();\n  const signature = String(h[\'x-questlog-signature\'] || \'\');\n  const actual = Buffer.from(signature.slice(7), \'hex\');\n  if (!id || !/^\\d+$/.test(timestamp) || age > 300 || age < -300 || !/^sha256=[a-f0-9]{64}$/.test(signature) || actual.length !== expected.length || !timingSafeEqual(actual, expected)) { res.writeHead(401).end(); return; }\n  if (!seen.has(id)) { seen.add(id); console.log(JSON.parse(rawBody)); }\n  res.writeHead(204).end();\n}).listen(8080, \'127.0.0.1\');\n```\n'
+});
+
 // src/skills/skill_registry.ts
 var questlogSkills = [
+  webhooksSkill,
   archiveDeleteAndPruneSkill,
   chooseWorkShapeSkill,
   clarifyAmbiguousRequestsSkill,
@@ -756,54 +761,4 @@ var questlogSkills = [
   tagAndFilterPortfoliosSkill
 ];
 
-// src/soul.ts
-var questlogSoulTraits = [
-  {
-    principle: "Store the least committed truth first.",
-    provenance: "The worst downstream errors usually start upstream: vague asks are turned into quests, soft ideas become fake deadlines, and half-understood work is treated as fully shaped. Using rumors and clarification before commitment keeps uncertainty where it belongs."
-  },
-  {
-    principle: "Read before you prescribe.",
-    provenance: "Many management mistakes are category mistakes: blocked work gets treated as available, missed schedule as overdue, or resolved work as fully closed when follow-through still remains. Reading the derived state first prevents confident but wrong interventions."
-  },
-  {
-    principle: "Protect history when reality changes.",
-    provenance: "Once execution starts, rewriting a quest into a different commitment destroys the meaning of the record. Honest finishes, abandonments, and follow-up quests preserve what actually happened and keep later review, planning, and reporting trustworthy."
-  },
-  {
-    principle: "Close the last mile, not just the main work.",
-    provenance: "Operational debt often hides in almost-done states: work finished but not claimed, reported, handed off, reviewed, or retired. Treating closure as a real phase prevents stale rewards, lingering initiatives, and misleading progress signals."
-  }
-];
-
-// src/surface/questlog_skill_spec.ts
-var questlogSkillSpec = {
-  name: "questlog",
-  cheatSheet: [
-    "No install? Use `npx -y @ghostpaw/questlog <command>`.",
-    "`questlog` and `ghostpaw-questlog` are the same binary.",
-    "",
-    "- `questlog search <words>` before `add` to avoid duplicates.",
-    '- `questlog add --title "..." --tag a,b --due tomorrow`',
-    `- \`questlog list [--view <view>]\`: ${reviewQuestlogTool.inputSchema.properties?.view?.enum?.join(", ")}.`,
-    '- `questlog done <id> --outcome "..."`',
-    "- `questlog search <words>`",
-    "- `questlog show <id>`",
-    "- Use `--json` on any plain command.",
-    "- Exit codes: 0 ok / 1 error / 2 usage / 3 needs input.",
-    "- Database: `~/.ghostpaw/questlog.db`; override with `--db` or `GHOSTPAW_QUESTLOG_DB`.",
-    "- Use one database per agent or project."
-  ].join("\n"),
-  description: "Manage local tasks, calendar commitments, and recurring work. Use when planning, executing, reviewing, or organizing work.",
-  license: "MIT",
-  compatibility: "Node.js 24 or newer. MCP stdio or ghostpaw-questlog CLI.",
-  bin: "ghostpaw-questlog",
-  packageName: "@ghostpaw/questlog",
-  server: "ghostpaw-questlog",
-  about: questlogMcpInstructions,
-  tools: questlogSurfaceTools,
-  workflows: questlogSkills,
-  principles: questlogSoulTraits.map((trait) => trait.principle)
-};
-
-export { questlogSkillSpec };
+export { questlogSkills };

package/dist/chunk-GVD6A3RR.js

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+
+var CliUsageError = class extends Error {
+  exitCode = 2;
+};
+var keyOf = (name) => name.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+function parseCliArgs(argv, spec) {
+  const values = {};
+  const positions = [];
+  const flags = spec.flags ?? [];
+  const convert = (raw, arg) => {
+    let value = raw;
+    if (raw.startsWith("@")) {
+      try {
+        value = readFileSync(raw.slice(1), "utf8");
+      } catch {
+        throw new CliUsageError(`Cannot read value file: ${raw.slice(1)}`);
+      }
+    }
+    let result = value;
+    if (arg.type === "number" || arg.type === "integer") {
+      result = Number(value);
+      if (!value.trim() || !Number.isFinite(result) || arg.type === "integer" && !Number.isInteger(result))
+        throw new CliUsageError(`Expected ${arg.type} for ${arg.name}: ${value}`);
+    } else if (arg.type === "boolean") {
+      if (!["true", "false"].includes(value))
+        throw new CliUsageError(`Expected boolean for ${arg.name}`);
+      result = value === "true";
+    } else if (arg.type === "json") {
+      try {
+        result = JSON.parse(value);
+      } catch {
+        throw new CliUsageError(`Invalid JSON for ${arg.name}`);
+      }
+    }
+    if (arg.enum && !arg.enum.includes(result))
+      throw new CliUsageError(`${arg.name} must be one of: ${arg.enum.join(", ")}`);
+    return result;
+  };
+  let ended = false;
+  for (let i = 0; i < argv.length; i++) {
+    const token = argv[i];
+    if (!ended && token === "--") {
+      ended = true;
+      continue;
+    }
+    if (ended || token === "-" || !token.startsWith("-")) {
+      positions.push(token);
+      continue;
+    }
+    const [flag, inline] = token.split(/=(.*)/s);
+    const negative = flag?.startsWith("--no-");
+    const name = flag?.replace(/^--?/, "").replace(/^no-/, "");
+    const arg = flags.find(
+      (entry) => entry.name === name || keyOf(entry.name) === name || entry.short === name
+    );
+    if (!arg) {
+      const prefix = (name ?? "").slice(0, 3);
+      const suggestion = prefix ? flags.find((entry) => entry.name.startsWith(prefix)) : void 0;
+      throw new CliUsageError(
+        `Unknown flag: ${flag}${suggestion ? `; did you mean --${suggestion.name}?` : ""}`
+      );
+    }
+    if (negative && arg.type !== "boolean")
+      throw new CliUsageError(`--no-${arg.name} requires a boolean flag`);
+    let raw = inline;
+    if (arg.type === "boolean" && raw === void 0) raw = negative ? "false" : "true";
+    if (raw === void 0) {
+      const next = argv[i + 1];
+      if (next === void 0 || /^--[a-z]/i.test(next))
+        throw new CliUsageError(`Missing value: --${arg.name}`);
+      raw = next;
+      i++;
+    }
+    const key = keyOf(arg.name);
+    if (arg.type === "array") {
+      const item = convert(raw, { ...arg, type: arg.itemType ?? "string" });
+      values[key] = [...values[key] ?? [], item];
+    } else values[key] = convert(raw, arg);
+  }
+  let index = 0;
+  for (const arg of spec.positionals ?? []) {
+    if (index >= positions.length) continue;
+    values[keyOf(arg.name)] = arg.variadic ? positions.slice(index).map((value) => convert(value, { ...arg, type: arg.itemType ?? arg.type })) : convert(positions[index], arg);
+    index = arg.variadic ? positions.length : index + 1;
+  }
+  if (index < positions.length)
+    throw new CliUsageError(`Unexpected positional: ${positions[index]}`);
+  for (const arg of [...flags, ...spec.positionals ?? []]) {
+    if (arg.required && values[keyOf(arg.name)] === void 0)
+      throw new CliUsageError(`Missing required argument: ${arg.name}`);
+  }
+  return values;
+}
+function renderCliHelp(spec) {
+  const describe = (arg) => `${arg.type}${arg.enum ? ` (${arg.enum.join("|")})` : ""}${arg.required ? " required" : ""}  ${arg.description ?? ""}`;
+  return `Usage: ${spec.command} ${(spec.positionals ?? []).map((arg) => `<${arg.name}${arg.variadic ? "..." : ""}>`).join(" ")} [flags]
+${spec.description ?? ""}
+
+Positionals:
+${(spec.positionals ?? []).map((arg) => `  ${arg.name}  ${describe(arg)}`).join("\n")}
+Flags:
+${(spec.flags ?? []).map((arg) => `  --${arg.name}${arg.short ? `, -${arg.short}` : ""}  ${describe(arg)}`).join("\n")}
+`;
+}
+
+export { CliUsageError, parseCliArgs, renderCliHelp };

package/dist/chunk-IL2QRKZL.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+function resolveQuestlogDbPath(options = {}) {
+  return options.flag ?? ((options.env ?? process.env).GHOSTPAW_QUESTLOG_DB || join(homedir(), ".ghostpaw", "questlog.db"));
+}
+
+// src/surfaces/surface_types.ts
+function isErrorResult(result) {
+  return typeof result === "object" && result !== null && "ok" in result && result.ok === false;
+}
+
+export { isErrorResult, resolveQuestlogDbPath };