@hasna/instructions 0.4.19 → 0.4.20

package/README.md

@@ -331,14 +331,22 @@ workflows:
 - `{{PROJECT_DASHBOARD_DIR}}` -> `.hasna/project`
 - `{{PROJECT_DASHBOARD_RENDER_MANIFEST}}` -> `.hasna/project/dashboard/render.json`
 - `{{PROJECT_DASHBOARD_SNAPSHOTS_DIR}}` -> `.hasna/project/dashboard/snapshots`
-- `{{PROJECT_CHANNEL_PREFIX}}` -> `iproj-`
+- `{{PROJECT_CHANNEL_PREFIX}}` -> `""` (no prefix; the channel is the normalized project slug)
+
+Existing profiles can be migrated in place without deleting or recreating them:
+
+```bash
+instructions profile update linux-arm64 \
+  --var PROJECT_CHANNEL_PREFIX= \
+  --unset-var LEGACY_VARIABLE
+```
 
 `instructions init` and `bun run seed` seed the
 `agent-managed-project-dashboard-standard` reference. It documents the standard
 `.hasna/project` layout, `projects dashboard *` commands, provider panel
-commands, `#iproj-*` channel naming, durable todos/goal workflow, and the rule
-that dashboards must show ids/statuses/evidence refs instead of raw private
-documents or secrets.
+commands, normalized project-slug channel naming, durable todos/goal workflow,
+and the rule that dashboards must show ids/statuses/evidence refs instead of raw
+private documents or secrets.
 
 ## License
 

package/dist/cli/add-reference-update.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=add-reference-update.test.d.ts.map

package/dist/cli/add-reference-update.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-reference-update.test.d.ts","sourceRoot":"","sources":["../../src/cli/add-reference-update.test.ts"],"names":[],"mappings":""}

package/dist/cli/doctor-reference-duplicates.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=doctor-reference-duplicates.test.d.ts.map

package/dist/cli/doctor-reference-duplicates.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-reference-duplicates.test.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-reference-duplicates.test.ts"],"names":[],"mappings":""}

package/dist/cli/index.js

@@ -13882,6 +13882,7 @@ import { basename as basename7, join as join15, resolve as resolve8 } from "path
 
 // src/lib/config-target-identity.ts
 init_apply();
+init_database();
 function findConfigsByTargetPath(configs, targetPath) {
   const wanted = normalizeTargetPath(targetPath);
   return configs.filter((config) => {
@@ -13892,6 +13893,20 @@ function findConfigsByTargetPath(configs, targetPath) {
     return normalizeTargetPath(config.target_path) === wanted;
   });
 }
+function findReferenceConfigsByName(configs, name) {
+  const wantedSlug = slugify(name);
+  return configs.filter((config) => config.kind === "reference" && (config.name === name || slugify(config.name) === wantedSlug));
+}
+function findDuplicateReferenceNameGroups(configs) {
+  const groups = new Map;
+  for (const config of configs) {
+    if (config.kind !== "reference")
+      continue;
+    const key = slugify(config.name);
+    groups.set(key, [...groups.get(key) ?? [], config]);
+  }
+  return [...groups.entries()].filter(([, rows]) => rows.length > 1).map(([, rows]) => ({ name: rows[0].name, configs: rows }));
+}
 function findDuplicateTargetPathGroups(configs) {
   const groups = new Map;
   for (const config of configs) {
@@ -14921,7 +14936,7 @@ var PROJECT_DASHBOARD_PROFILE_VARIABLES = {
   PROJECT_DASHBOARD_DIR: ".hasna/project",
   PROJECT_DASHBOARD_RENDER_MANIFEST: ".hasna/project/dashboard/render.json",
   PROJECT_DASHBOARD_SNAPSHOTS_DIR: ".hasna/project/dashboard/snapshots",
-  PROJECT_CHANNEL_PREFIX: "iproj-"
+  PROJECT_CHANNEL_PREFIX: ""
 };
 var PROJECT_DASHBOARD_STANDARD_CONTENT = `# Agent-Managed Project Dashboard Standard
 
@@ -14976,8 +14991,8 @@ context.
 
 ## Coordination
 
-- Project conversation channels use \`iproj-<project-slug>\` in the CLI and are
-  displayed to humans as \`#iproj-<project-slug>\`.
+- Project conversation channels use the normalized project slug in the CLI and
+  are displayed to humans as \`#<project-slug>\`.
 - Todos tasks are the source of truth for work; messages are only coordination.
 - Durable Codewith goal plans should own long-running implementation.
 - New implementation/verification work should route through task-triggered fresh
@@ -15082,10 +15097,15 @@ function mergeProfileSelectors(preset, existing) {
   };
 }
 function mergeProfileVariables(preset, existing) {
-  return {
+  const variables = {
     ...preset ?? {},
     ...existing
   };
+  for (const [key, value] of Object.entries(preset ?? {})) {
+    if (value === "")
+      variables[key] = value;
+  }
+  return variables;
 }
 function mergeUnique(preset, existing) {
   const values = [...new Set([...preset ?? [], ...existing ?? []])];
@@ -15665,6 +15685,15 @@ function parseVarArgs(values) {
   }
   return Object.keys(vars).length > 0 ? vars : undefined;
 }
+function parseUnsetVarArgs(values) {
+  if (!values || values.length === 0)
+    return [];
+  const keys = [...new Set(values.map((value) => value.trim()))];
+  if (keys.some((key) => key.length === 0 || key.includes("="))) {
+    throw new Error('Invalid --unset-var (expected variable names without "=")');
+  }
+  return keys;
+}
 function parseProfileSelectors(opts) {
   const selectors = {};
   const os = splitCsv(opts.os);
@@ -15779,20 +15808,33 @@ program.command("add <path>").description("Ingest a file into the config DB").op
   const targetPath = abs.startsWith(homedir7()) ? abs.replace(homedir7(), "~") : abs;
   const name = opts.name || filePath.split("/").pop();
   const store = resolveConfigStore();
-  const existingOwners = opts.kind === "reference" ? [] : findConfigsByTargetPath(await store.listConfigs(), targetPath);
+  const allConfigs = await store.listConfigs();
+  const existingOwners = opts.kind === "reference" ? findReferenceConfigsByName(allConfigs, name) : findConfigsByTargetPath(allConfigs, targetPath);
+  const isReference = opts.kind === "reference";
+  const identityLabel = isReference ? `Reference config "${name}"` : targetPath;
+  const identityNoun = isReference ? "name" : "path";
   if (existingOwners.length > 0 && !opts.update) {
     const owners = existingOwners.map((owner) => `${owner.slug} (${owner.id})`).join(", ");
-    console.error(chalk.red(`${targetPath} is already tracked by: ${owners}`));
+    console.error(chalk.red(`${identityLabel} is already tracked by: ${owners}`));
     if (existingOwners.length > 1) {
-      console.error(chalk.red(`  ${existingOwners.length} rows already collide on this path \u2014 apply order between them is undefined.`));
+      console.error(chalk.red(`  ${existingOwners.length} rows already collide on this ${identityNoun} \u2014 apply order between them is undefined.`));
     }
     console.error(chalk.dim("  Use `instructions add <path> --update` to refresh that row in place,"));
-    console.error(chalk.dim("  `instructions sync` to pull disk changes in, or `instructions delete <id>` first."));
+    if (isReference) {
+      console.error(chalk.dim("  or `instructions delete <id>` first."));
+    } else {
+      console.error(chalk.dim("  `instructions sync` to pull disk changes in, or `instructions delete <id>` first."));
+    }
     process.exit(1);
   }
   let config;
   if (existingOwners.length > 0) {
-    const [target, ...rest] = existingOwners;
+    const exactIndex = isReference ? existingOwners.findIndex((owner) => owner.name === name) : -1;
+    const target = exactIndex >= 0 ? existingOwners[exactIndex] : existingOwners[0];
+    const rest = existingOwners.filter((owner) => owner.id !== target.id);
+    if (content !== target.content) {
+      await store.createSnapshot(target.id, target.content, target.version);
+    }
     config = await store.updateConfig(target.id, {
       content,
       format: fmt,
@@ -15802,7 +15844,7 @@ program.command("add <path>").description("Ingest a file into the config DB").op
     });
     console.log(chalk.green("\u2713") + ` Updated: ${chalk.bold(config.name)} ${chalk.dim(`(${config.slug})`)}`);
     if (rest.length > 0) {
-      console.log(chalk.yellow(`  \u26A0 ${rest.length} other row(s) still target ${targetPath}: ${rest.map((r) => r.slug).join(", ")}`));
+      console.log(chalk.yellow(`  \u26A0 ${rest.length} other row(s) still share this ${identityNoun}: ${rest.map((r) => r.slug).join(", ")}`));
       console.log(chalk.yellow("    Apply order between them is undefined. Delete the extras."));
     }
     if (redacted.length > 0) {
@@ -16067,6 +16109,31 @@ profileCmd.command("create <name>").description("Create a new profile").option("
   });
   console.log(chalk.green("\u2713") + ` Created profile: ${chalk.bold(p.name)} ${chalk.dim(`(${p.slug})`)}`);
 });
+profileCmd.command("update <id>").description("Update an existing profile's variables in one store operation").option("--var <vars...>", "set profile variable(s) as KEY=VALUE").option("--unset-var <keys...>", "remove profile variable(s) by key").action(async (id, opts) => {
+  try {
+    const setVariables = parseVarArgs(opts.var) ?? {};
+    const unsetVariables = parseUnsetVarArgs(opts.unsetVar);
+    const setKeys = new Set(Object.keys(setVariables));
+    const conflicts = unsetVariables.filter((key) => setKeys.has(key));
+    if (conflicts.length > 0) {
+      throw new Error(`Variables cannot be both set and unset: ${conflicts.join(", ")}`);
+    }
+    if (Object.keys(setVariables).length === 0 && unsetVariables.length === 0) {
+      throw new Error("Provide --var KEY=VALUE and/or --unset-var KEY");
+    }
+    const store = resolveConfigStore();
+    const profile = await store.getProfile(id);
+    const variables = { ...profile.variables };
+    for (const key of unsetVariables)
+      delete variables[key];
+    Object.assign(variables, setVariables);
+    const updated = await store.updateProfile(profile.id, { variables });
+    console.log(chalk.green("\u2713") + ` Updated profile: ${chalk.bold(updated.name)} ${chalk.dim(`(${updated.slug})`)}`);
+  } catch (e) {
+    console.error(chalk.red(formatCliError(e)));
+    process.exit(1);
+  }
+});
 profileCmd.command("show <id>").description("Show profile and its configs").option("--limit <n>", `max config rows (default ${DEFAULT_LIST_LIMIT})`).option("--cursor <n>", "zero-based pagination cursor").action(async (id, opts) => {
   try {
     const store = resolveConfigStore();
@@ -16843,6 +16910,20 @@ Stored configs (${allConfigs.length}):`));
     }
     console.log(chalk.dim("      Keep one row per path: `instructions delete <id>` for the extras."));
   }
+  const duplicateReferenceNames = findDuplicateReferenceNameGroups(allConfigs);
+  if (duplicateReferenceNames.length === 0) {
+    pass("No reference config name is claimed by more than one row");
+  } else {
+    const rowCount = duplicateReferenceNames.reduce((total, group) => total + group.configs.length, 0);
+    fail(`${duplicateReferenceNames.length} reference name(s) claimed by more than one row (${rowCount} rows) \u2014 only one is live in the next render`);
+    for (const group of duplicateReferenceNames) {
+      console.log(chalk.yellow(`      ${group.name}`));
+      for (const c of group.configs) {
+        console.log(chalk.dim(`        ${c.slug}  (${c.id})  updated ${c.updated_at}`));
+      }
+    }
+    console.log(chalk.dim("      Keep one row per name: `instructions delete <id>` for the extras."));
+  }
   console.log(`
 ${issues === 0 ? chalk.green("\u2713 All checks passed") : chalk.yellow(`${issues} issue(s) found`)}`);
 });

package/dist/cli/profile-update.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=profile-update.test.d.ts.map

package/dist/cli/profile-update.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-update.test.d.ts","sourceRoot":"","sources":["../../src/cli/profile-update.test.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -11251,7 +11251,7 @@ var PROJECT_DASHBOARD_PROFILE_VARIABLES = {
   PROJECT_DASHBOARD_DIR: ".hasna/project",
   PROJECT_DASHBOARD_RENDER_MANIFEST: ".hasna/project/dashboard/render.json",
   PROJECT_DASHBOARD_SNAPSHOTS_DIR: ".hasna/project/dashboard/snapshots",
-  PROJECT_CHANNEL_PREFIX: "iproj-"
+  PROJECT_CHANNEL_PREFIX: ""
 };
 var PROJECT_DASHBOARD_STANDARD_CONTENT = `# Agent-Managed Project Dashboard Standard
 
@@ -11306,8 +11306,8 @@ context.
 
 ## Coordination
 
-- Project conversation channels use \`iproj-<project-slug>\` in the CLI and are
-  displayed to humans as \`#iproj-<project-slug>\`.
+- Project conversation channels use the normalized project slug in the CLI and
+  are displayed to humans as \`#<project-slug>\`.
 - Todos tasks are the source of truth for work; messages are only coordination.
 - Durable Codewith goal plans should own long-running implementation.
 - New implementation/verification work should route through task-triggered fresh
@@ -11412,10 +11412,15 @@ function mergeProfileSelectors(preset, existing) {
   };
 }
 function mergeProfileVariables(preset, existing) {
-  return {
+  const variables = {
     ...preset ?? {},
     ...existing
   };
+  for (const [key, value] of Object.entries(preset ?? {})) {
+    if (value === "")
+      variables[key] = value;
+  }
+  return variables;
 }
 function mergeUnique(preset, existing) {
   const values = [...new Set([...preset ?? [], ...existing ?? []])];

package/dist/lib/config-target-identity.d.ts

@@ -15,6 +15,82 @@ import type { Config } from "../types/index.js";
  * Reference configs (`kind: "reference"`) own no target path and never match.
  */
 export declare function findConfigsByTargetPath(configs: Config[], targetPath: string): Config[];
+/**
+ * Every reference-kind row already ingested under `name`.
+ *
+ * A reference config (`kind: "reference"`) owns no target_path — it is not
+ * mirrored 1:1 onto one file on disk, so `findConfigsByTargetPath` can never
+ * find it, by design (see that function's own doc comment). That left
+ * `add <path> --kind reference --update` with no identity signal at all: every
+ * re-ingest of a reference config's content minted a fresh row instead of
+ * updating the one that already existed, at every `--update` setting, because
+ * there was nothing to match on. Measured live 2026-08-04, todos 757cefdb: 20
+ * of 20 reference-kind rows in the fleet store had target_path=null.
+ *
+ * For a reference config, `name` IS the identity, in exactly the same sense a
+ * file-kind config's target_path is its identity: re-ingest with the same
+ * name, get the same row; re-ingest with a different name, get a different
+ * (or new) row. Two comparisons, both needed:
+ *
+ *  - EXACT name match. `uniqueSlug` (db/database.ts) only de-duplicates the
+ *    SLUG column, which carries a DB-level UNIQUE constraint — it never
+ *    touches `name`, which carries no such constraint. So every prior
+ *    duplicate this bug already produced still has the identical `name` and a
+ *    `-1`, `-2`, ... suffixed slug. Measured live 2026-08-04 in the fleet
+ *    store: 8 reference rows all named "Global Agent Rules Standard"
+ *    (`global-agent-rules-standard-1` through `-8`), one identical SHA-256
+ *    content hash across all 8, ingested on 6 different days — the exact
+ *    shape this function exists to stop.
+ *  - Slugified match, for a re-ingest whose `--name` differs only in case or
+ *    punctuation from an existing row's name.
+ *
+ *    CORRECTED 2026-08-04 (todos 195272ae, Finding 1): this used to compare
+ *    the query's slug against each candidate's STORED `.slug` COLUMN
+ *    (`config.slug === wantedSlug`). That is sound only for a candidate whose
+ *    own slug was never disambiguated — the moment two rows already collide
+ *    and `uniqueSlug` has suffixed one of them (`sample-rule-1`), its stored
+ *    slug no longer equals what re-slugifying its OWN name produces, so the
+ *    old comparison went blind to it. Reproduced live: row A "Sample Rule"
+ *    (slug "sample-rule"), row B "sample rule" (slug disambiguated to
+ *    "sample-rule-1" because A already held the base slug) — querying "Sample
+ *    Rule" found only A. `add --update` then updated A, reported
+ *    `rest.length === 0` (no "N other rows share this name" warning), and
+ *    left B — the exact row a human would call a duplicate of A — untouched
+ *    and unmentioned. This is the one population the slug clause exists to
+ *    catch: it is impossible for a fresh, non-colliding row to need it, since
+ *    an un-disambiguated slug already matches via `slugify(name)` trivially.
+ *    Comparing against `slugify(config.name)` instead — recomputed from the
+ *    candidate's own name rather than trusted from its (possibly
+ *    disambiguated) stored column — fixes this without weakening the EXACT
+ *    name clause above, which still independently catches the byte-identical
+ *    case regardless: it can only ADD matches the old comparison missed, not
+ *    remove any a query's name literally shares.
+ */
+export declare function findReferenceConfigsByName(configs: Config[], name: string): Config[];
+/**
+ * Groups of reference-kind rows that collide on identity, the mirror image of
+ * `findDuplicateTargetPathGroups` for the identity axis reference configs
+ * actually use. Only groups with more than one member are returned, so an
+ * empty result means the store is clean.
+ *
+ * CORRECTED 2026-08-04 (todos 195272ae, Finding 1): grouping used to key on
+ * the raw, exact `config.name` string. `doctor` (which calls this) therefore
+ * reported a store CLEAN for two rows whose names differ only in case or
+ * punctuation — precisely the pair `findReferenceConfigsByName` above treats
+ * as one identity (see its doc comment for the reproduction). The two
+ * functions disagreeing about what "the same reference config" means was the
+ * same defect class PR #57 fixed one level up, one file down: `doctor` a
+ * store clean, `add --update` half-fixing it. Keying on `slugify(config.name)`
+ * instead makes this agree with `findReferenceConfigsByName`'s identity
+ * notion — a case/punctuation variant is now reported as a duplicate group
+ * too, not only a byte-identical one. The reported `name` is the first
+ * colliding row's own (human-authored) name, for display — the grouping key
+ * itself is never surfaced.
+ */
+export declare function findDuplicateReferenceNameGroups(configs: Config[]): Array<{
+    name: string;
+    configs: Config[];
+}>;
 /**
  * Groups of rows that collide on one normalized target path. Only groups with
  * more than one member are returned, so an empty result means the store is

package/dist/lib/config-target-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-target-identity.d.ts","sourceRoot":"","sources":["../../src/lib/config-target-identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAGhD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAOvF;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAUlH"}
+{"version":3,"file":"config-target-identity.d.ts","sourceRoot":"","sources":["../../src/lib/config-target-identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAIhD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAOvF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAKpF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAU9G;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAUlH"}

package/dist/lib/project-dashboard-standard.d.ts

@@ -2,6 +2,6 @@ import type { Config, ProfileVariables } from "../types/index.js";
 import { type ConfigStore } from "../data/config-store.js";
 export declare const PROJECT_DASHBOARD_STANDARD_SLUG = "agent-managed-project-dashboard-standard";
 export declare const PROJECT_DASHBOARD_PROFILE_VARIABLES: ProfileVariables;
-export declare const PROJECT_DASHBOARD_STANDARD_CONTENT = "# Agent-Managed Project Dashboard Standard\n\nThis standard applies to Hasna work projects under `Workspace/<division>/project/<slug>`.\nHumans do not work directly inside these folders; agents keep structure,\nevidence, tasks, knowledge, and dashboard output consistent.\n\n## Canonical Files\n\n- Project manifest root: `.hasna/project/`\n- Dashboard render manifest: `.hasna/project/dashboard/render.json`\n- Latest snapshot: `.hasna/project/dashboard/snapshots/latest.snapshot.json`\n- Dashboard schema ids come from `@hasna/contracts`.\n- Project folders may contain private documents, but render JSON must contain\n  only ids, counts, statuses, resource refs, evidence refs, and redacted\n  summaries.\n\n## Viewer Commands\n\nUse the Projects-owned viewer. Do not invent a separate per-project app unless\n`open-projects` cannot express the surface.\n\n```bash\nprojects dashboard snapshot <project> --write --json\nprojects dashboard render <project> --json\nprojects dashboard validate <project> --json\nPROJECTS_DASHBOARD_TOKEN=<token> projects dashboard serve <project> --host 0.0.0.0 --port <port>\n```\n\nNon-loopback serving must use `--token`, `PROJECTS_DASHBOARD_TOKEN`, or an\nexplicit `--trust-network` choice. Never put the token in a URL, task\nevidence, render spec, or report.\n\n## Provider Panels\n\nProvider CLIs emit bounded `hasna.project_panel.v1` summaries:\n\n```bash\ntodos project-panel --project <project> --json --contract\nfiles project-panel --project <project> --json --contract\nmailery project-panel --project <project> --limit 20 --json --contract\nconversations project-panel --project <project> --limit 30 --json --contract\nknowledge project-panel --project <project> --scope project --limit 30 --json --contract\nmementos --json project-panel --project <project> --contract\nreports project-panel --project <project> --json --contract\n```\n\nProviders must degrade to unavailable/error panels instead of dumping raw\ncontent. Mailery is workspace-scoped until explicit project-email mapping is\nconfigured; Knowledge must run from the project cwd or with the correct store\ncontext.\n\n## Coordination\n\n- Project conversation channels use `iproj-<project-slug>` in the CLI and are\n  displayed to humans as `#iproj-<project-slug>`.\n- Todos tasks are the source of truth for work; messages are only coordination.\n- Durable Codewith goal plans should own long-running implementation.\n- New implementation/verification work should route through task-triggered fresh\n  agent runs, not by opening or pasting into existing tmux panes.\n- Agent handoff should reference task ids, project ids, commit ids, evidence\n  paths, and dashboard URLs without exposing secrets or raw private documents.\n\n## Report Rules\n\nReports and dashboards should use JSON Render/React Flow through\n`projects dashboard render`. Include decisions, open questions, bank/document\nids, tasks, and evidence refs. Exclude raw email bodies, account numbers, tax\nids, passport numbers, credentials, and contract clauses unless an explicit\napproved storage policy exists.\n";
+export declare const PROJECT_DASHBOARD_STANDARD_CONTENT = "# Agent-Managed Project Dashboard Standard\n\nThis standard applies to Hasna work projects under `Workspace/<division>/project/<slug>`.\nHumans do not work directly inside these folders; agents keep structure,\nevidence, tasks, knowledge, and dashboard output consistent.\n\n## Canonical Files\n\n- Project manifest root: `.hasna/project/`\n- Dashboard render manifest: `.hasna/project/dashboard/render.json`\n- Latest snapshot: `.hasna/project/dashboard/snapshots/latest.snapshot.json`\n- Dashboard schema ids come from `@hasna/contracts`.\n- Project folders may contain private documents, but render JSON must contain\n  only ids, counts, statuses, resource refs, evidence refs, and redacted\n  summaries.\n\n## Viewer Commands\n\nUse the Projects-owned viewer. Do not invent a separate per-project app unless\n`open-projects` cannot express the surface.\n\n```bash\nprojects dashboard snapshot <project> --write --json\nprojects dashboard render <project> --json\nprojects dashboard validate <project> --json\nPROJECTS_DASHBOARD_TOKEN=<token> projects dashboard serve <project> --host 0.0.0.0 --port <port>\n```\n\nNon-loopback serving must use `--token`, `PROJECTS_DASHBOARD_TOKEN`, or an\nexplicit `--trust-network` choice. Never put the token in a URL, task\nevidence, render spec, or report.\n\n## Provider Panels\n\nProvider CLIs emit bounded `hasna.project_panel.v1` summaries:\n\n```bash\ntodos project-panel --project <project> --json --contract\nfiles project-panel --project <project> --json --contract\nmailery project-panel --project <project> --limit 20 --json --contract\nconversations project-panel --project <project> --limit 30 --json --contract\nknowledge project-panel --project <project> --scope project --limit 30 --json --contract\nmementos --json project-panel --project <project> --contract\nreports project-panel --project <project> --json --contract\n```\n\nProviders must degrade to unavailable/error panels instead of dumping raw\ncontent. Mailery is workspace-scoped until explicit project-email mapping is\nconfigured; Knowledge must run from the project cwd or with the correct store\ncontext.\n\n## Coordination\n\n- Project conversation channels use the normalized project slug in the CLI and\n  are displayed to humans as `#<project-slug>`.\n- Todos tasks are the source of truth for work; messages are only coordination.\n- Durable Codewith goal plans should own long-running implementation.\n- New implementation/verification work should route through task-triggered fresh\n  agent runs, not by opening or pasting into existing tmux panes.\n- Agent handoff should reference task ids, project ids, commit ids, evidence\n  paths, and dashboard URLs without exposing secrets or raw private documents.\n\n## Report Rules\n\nReports and dashboards should use JSON Render/React Flow through\n`projects dashboard render`. Include decisions, open questions, bank/document\nids, tasks, and evidence refs. Exclude raw email bodies, account numbers, tax\nids, passport numbers, credentials, and contract clauses unless an explicit\napproved storage policy exists.\n";
 export declare function ensureProjectDashboardStandardConfig(store?: ConfigStore): Promise<Config>;
 //# sourceMappingURL=project-dashboard-standard.d.ts.map

package/dist/lib/project-dashboard-standard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-dashboard-standard.d.ts","sourceRoot":"","sources":["../../src/lib/project-dashboard-standard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE/E,eAAO,MAAM,+BAA+B,6CAA6C,CAAC;AAE1F,eAAO,MAAM,mCAAmC,EAAE,gBAKjD,CAAC;AAEF,eAAO,MAAM,kCAAkC,2hGAqE9C,CAAC;AAEF,wBAAsB,oCAAoC,CAAC,KAAK,GAAE,WAAkC,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BrH"}
+{"version":3,"file":"project-dashboard-standard.d.ts","sourceRoot":"","sources":["../../src/lib/project-dashboard-standard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE/E,eAAO,MAAM,+BAA+B,6CAA6C,CAAC;AAE1F,eAAO,MAAM,mCAAmC,EAAE,gBAKjD,CAAC;AAEF,eAAO,MAAM,kCAAkC,0hGAqE9C,CAAC;AAEF,wBAAsB,oCAAoC,CAAC,KAAK,GAAE,WAAkC,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BrH"}

package/dist/mcp/index.js

@@ -6957,7 +6957,7 @@ var init_sync_dir = __esm(() => {
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "@hasna/instructions",
-    version: "0.4.19",
+    version: "0.4.20",
     description: "AI coding agent instruction & configuration manager \u2014 store, version, apply, and share all your AI coding configs. CLI + MCP + HTTP API (instructions-serve) + generated SDK + Dashboard.",
     type: "module",
     main: "dist/index.js",
@@ -7062,6 +7062,7 @@ import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprot
 
 // src/lib/config-target-identity.ts
 init_apply();
+init_database();
 function findConfigsByTargetPath(configs, targetPath) {
   const wanted = normalizeTargetPath(targetPath);
   return configs.filter((config) => {
@@ -7072,6 +7073,10 @@ function findConfigsByTargetPath(configs, targetPath) {
     return normalizeTargetPath(config.target_path) === wanted;
   });
 }
+function findReferenceConfigsByName(configs, name) {
+  const wantedSlug = slugify(name);
+  return configs.filter((config) => config.kind === "reference" && (config.name === name || slugify(config.name) === wantedSlug));
+}
 
 // src/mcp/server.ts
 init_sync_dir();
@@ -7178,7 +7183,7 @@ function summarizeApplyResult(result) {
 var TOOL_DOCS = {
   list_configs: "List configs. Params: category?, agent?, kind?, search?, limit?, cursor?, verbose?. Defaults to a paged compact envelope without content; use get_config for full content.",
   get_config: "Get a config by id or slug. Returns full config including content.",
-  create_config: "Create a new config. Required: name, content, category. Optional: agent, target_path, outputs, kind, format, tags, description, is_template. Refuses when target_path is already tracked by another config (one target path, one row) \u2014 use update_config on the owning row, or delete_config first. kind:'reference' owns no target path and is exempt.",
+  create_config: "Create a new config. Required: name, content, category. Optional: agent, target_path, outputs, kind, format, tags, description, is_template. Refuses when target_path is already tracked by another config (one target path, one row) \u2014 use update_config on the owning row, or delete_config first. kind:'reference' owns no target path and is exempt from that check, but is instead refused when its name (or a case/punctuation variant of it) already tracks another reference config.",
   update_config: "Update a config by id or slug. Optional: content, name, tags, description, category, agent, target_path, outputs.",
   apply_config: "Apply a config through the shared ownership gate. Params: id_or_slug, dry_run?, verbose?. Returns results plus session-renderer-owned targets that were skipped.",
   sync_directory: "Sync a directory with the DB. Params: dir, direction ('from_disk'|'to_disk'). Returns sync result.",
@@ -7269,6 +7274,15 @@ function buildServer() {
               return err(`${targetPath} is already tracked by: ${named}.${collision}` + ` Use update_config on that row to refresh it in place, or delete_config first.`);
             }
           }
+          if (kind === "reference") {
+            const name2 = args["name"];
+            const owners = findReferenceConfigsByName(await store.listConfigs(), name2);
+            if (owners.length > 0) {
+              const named = owners.map((owner) => `${owner.slug} (${owner.id})`).join(", ");
+              const collision = owners.length > 1 ? ` ${owners.length} rows already collide on this name \u2014 apply order between them is undefined.` : "";
+              return err(`Reference config "${name2}" is already tracked by: ${named}.${collision}` + ` Use update_config on that row to refresh it in place, or delete_config first.`);
+            }
+          }
           const c = await store.createConfig({
             name: args["name"],
             content: args["content"],

package/dist/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AA4EnE,wBAAgB,WAAW,IAAI,MAAM,CAyTpC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AA4EnE,wBAAgB,WAAW,IAAI,MAAM,CAyVpC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/instructions",
-  "version": "0.4.19",
+  "version": "0.4.20",
   "description": "AI coding agent instruction & configuration manager \u2014 store, version, apply, and share all your AI coding configs. CLI + MCP + HTTP API (instructions-serve) + generated SDK + Dashboard.",
   "type": "module",
   "main": "dist/index.js",