@hoilab/ada-cli 0.84.22 → 0.85.0

package/CHANGELOG.md

@@ -1,13 +1,40 @@
 # Changelog
 
-## [Unreleased]
+## [0.85.0] - 2026-08-25
 
 ### Added
 
+- **Added PDF reading without a browser.** `read` on a PDF now extracts its **text layer** using only `node:zlib` — content streams travel Flate-compressed, so no new dependency and no headless browser are needed (the competing agent renders the document and screenshots it; that buys exact layout at the cost of a browser per read). Three states are told apart, never two: text extracted (truncated with the same limits as any other file); **scanned / image-only** — reported as such, instead of passing for an empty file; and **cannot read** (encrypted or malformed), with the reason. The `%PDF-` signature is checked against the file's first kilobyte, never against its extension.
+- **Added detection of empty model turns.** A provider answering a well-formed request with *nothing* — no text, no reasoning, no tool calls (`x-preview-f-free` did exactly that) used to look like success everywhere: `ada-cli -p` printed an empty stdout and exited 0, and the task bench counted the case as "the model chose not to edit". Both halves are fixed: print mode now writes `El modelo no ha contestado: …` to stderr and exits 1; the interactive session emits a warning notification; and the bench reports those cases separately (`vacío`) instead of counting them as ghosts. An unknown content block or a reasoning-only turn never triggers the notice — the detector stays silent about anything that might be something.
+
+- Added OTLP export of the session ledger to your own OpenTelemetry collector (`ada-cli telemetria`, `--cuerpo`, `--enviar`), following the standard `OTEL_EXPORTER_OTLP_*` contract. What leaves the machine comes from an **explicit allowlist of shape** — event type, tool, exit code, byte counts, hashes, destination domain, provider, model, token counts — and the number of attributes dropped is recorded so a silent truncation cannot pass for a complete export. A second belt discards any value containing a newline or longer than 200 characters even if its key is allowed. There is deliberately no environment variable, option or parameter that enables content export, and a test walks the module's own source to keep it that way; `--cuerpo` prints the exact JSON that would be sent so you can verify it rather than take our word for it.
+- Added a software bill of materials and a licence gate: `npm run sbom` writes CycloneDX 1.5 (reproducible byte for byte), and `npm run check:licencias` fails on a denied **or unknown** licence. A dependency that declares no licence is *unknown*, and unknown does not pass; an empty dependency tree also fails, because a gate that passes because it inspected nothing is worse than no gate. Compound SPDX expressions (`OR`, `AND`, parentheses) are understood, and anything unparseable lands in *unknown*, never in *allowed*.
+- Added detection and masking of GDPR art. 9 special categories and art. 10 convictions before anything reaches disk, on both the audit ledger and the edit diary. National identifiers are validated rather than pattern-matched (Spanish DNI mod-23, IBAN mod-97), and vocabulary categories require a nearby person marker so that "diagnostic" in compiler output and "union" in SQL do not trigger. Measured over 469 real source files of this repository the detector produces 3 findings, down from 116 in the first implementation. Text that cannot be analysed is masked whole rather than passed through.
+- Added `ada-cli audit purge --dias N --politica "..."` (also `--antes-de AAAA-MM-DD`, with `--dry-run`), which writes a chained tombstone into the session ledger before deleting anything. A lawful retention purge under GDPR art. 5.1.e used to either trip the tamper alarm (deleting `sesion/`) or vanish without trace while the ledger still reported "intact" (deleting both directories). `audit verify` now reports purges as *explained* gaps, naming the policy they were carried out under, and reports them even when no gap remains — which is the normal case, since a purge removes the file and its index anchor.
+- Added a machine-wide policy scope that the user cannot edit, at `/Library/Application Support/Ada/politica.json`, `/etc/ada/politica.json` and `%ProgramData%\Ada\politica.json`. It can only ever *restrict*: a `modoMaximo` ceiling lowers the requested permission mode and never raises it, and `denegadas` disables tools for the whole fleet in a way `yolo` cannot lift. Until now both configuration scopes were files the user owned, so the line a CISO added to forbid `yolo` could be deleted by the very person it applied to. Inspect it with `ada-cli politica`.
 - Added transcript usage notices for compaction and branch summaries when cache miss notices are enabled.
 
-### Fixed
+### Changed
 
+- **Removed the install ping to `pi.dev`.** `reportInstallTelemetry` sent the version and user agent of every installation to `https://pi.dev/api/report-install`, enabled by default. It is gone, and is not replaced by an endpoint of our own.
+- **Removed the default provider attribution headers** (`HTTP-Referer: https://ada.dev` and `X-OpenRouter-Title` on OpenRouter, `X-BILLING-INVOKE-ORIGIN` on NVIDIA NIM, `User-Agent: ada-cli` on Cloudflare). None of them were needed for a request to work; they told the provider which tool the client uses. Attribution is still possible for anyone who wants it, by configuring the headers on the model. The functional `x-opencode-session` header is unaffected. As a result `enableInstallTelemetry` no longer governs anything and is documented as inert.
+- Changed session sharing to render clickable terminal links and Radius shares to display only the artifact's canonical URL.
+
+### Fixed
+
+- **Fixed aborting a turn leaving the whole conversation unresumable.** When a message arrived with stop reason `aborted` or `error`, the agent loop returned without closing the tool calls that same message already carried. A `tool_use` without its `tool_result` is rejected by providers, so pressing Ctrl-C at the wrong moment did not leave the turn half-done — it left the conversation unable to resume. The test that was meant to guard this had a mock that reported `aborted` while returning a message whose stop reason said `toolUse`, which sent the loop into an infinite retry at 99% CPU: it did not fail, it hung, and with it the whole suite for 71 measured minutes. That is why the defect went unseen.
+- **Fixed `ada-cli session <id> <op>` failing with an opaque error on installed copies.** The protocol extension point it needs is added by this fork to upstream's client/protocol/server packages, which the published package resolves from the registry — so an installed copy does not carry it. It now explains that and points at a source build, instead of crashing with `client.extension is not a function`.
+- **Fixed the published package being uninstallable, and then broken at runtime.** Both found by packing the tarball and installing it the way a user would, before publishing. First, `npm version --workspaces` had rewritten the dependency *ranges* too, so the package asked for `@earendil-works/pi-agent-core@^0.85.0` — a version upstream never published — and every `npm install` failed with `notarget`. Then, with that fixed, the installed copy died with `Cannot find package 'typescript'`: six files under `src/core/` import TypeScript at module load and it was only a devDependency, so structural editing and post-edit type checking were broken for every client. Two gates now catch both classes: `check-dependencias-resuelven.mjs` (every declared range has a published version that satisfies it) and `check-imports-de-runtime.mjs` (no production file imports a dev-only dependency).
+- **Fixed the argument coercion not being applied on the path the SDK actually uses.** It was wired into `createTool`/`createToolDefinition`, which looked like the funnels but are not: `createCodingTools` calls each factory directly and bypassed them. The tests passed while the installed copy still rejected the call. It now lives in `wrapToolDefinition`, which every tool does go through — verified by installing the tarball and running it against a real free model: **4 model calls and no validation rejections, matching the competing agent**.
+- **Fixed our own fixes not reaching anyone who installs from npm.** `@hoilab/ada-cli` declares `"@earendil-works/pi-ai": "^0.84.2"` and the shrinkwrap resolves it from the registry, so an installing user gets **upstream's** tarball, not our patched copy. Measured on the real artifact with `npm pack --dry-run`: 2,066 files, **zero** from `pi-ai`. Fourteen of our patches live in packages we do not publish, including the two most important ones of this release. The tolerant JSON parse now also lives in the package that *is* published and is used by `edit`'s argument preparation, verified by unpacking the tarball and running it outside the repository. A gate (`check-fork-llega-al-usuario.mjs`, wired into `prepublishOnly`) now blocks publishing while any patch sits in an unpublished package, so this cannot pass unnoticed again.
+- **Fixed a tool argument arriving as a JSON string with raw tabs costing a whole turn.** The root cause was not that the argument was a string — `edit` had handled that since before — but that the string contained **raw control characters**. Measured on a real payload: 309 characters with 18 raw tab characters inside JSON string literals, which JSON forbids, so `JSON.parse` answered *Invalid control character* and a silent `catch {}` swallowed it. That is what every model produces when it writes tab-indented code inside an argument. Argument coercion now parses tolerantly — escaping raw control characters only inside string literals, leaving valid JSON byte-identical and still rejecting genuinely malformed JSON — and it runs before TypeBox's `Value.Convert`, which otherwise wraps the string in a one-element array and destroys the evidence. Measured against `nvidia/nemotron-3-ultra-550b-a55b:free` on the same task as a competing agent: **6 model calls and one validation rejection before, 4 calls and none after — the same round-trip count as the competitor**, with equivalent output.
+- **Fixed a tool argument arriving as a JSON string costing a whole turn.** Small models routinely send nested JSON as a string, and the argument coercion covered number, integer, boolean, string and null but not array or object. Measured against `nvidia/nemotron-3-ultra-550b-a55b:free` on the same task as a competing agent: 6 model calls and 42,717 input tokens versus their 4 and 29,393, with identical final code. Two of those six round trips were a stringified `edits` array, its rejection, and the recovery. Coercion is applied only when the schema asks for an array or object and the text parses to exactly that type, so a bash command beginning with `[` remains a string and a malformed JSON still produces the validation error that tells the model what shape was expected.
+- **Fixed tool calls rejected before execution leaving no trace in the audit ledger.** Argument validation runs before the audit hook, so a call that failed validation — or named a tool that does not exist — reached neither of the recording points. A real run had two `edit` calls in the transcript and one in the ledger. They are now reconciled on the next model message and recorded as `no-ejecutada`.
+- **Fixed the machine-wide update check being able to install a package outside our own scope.** A remote-announced package name is now accepted only within our npm scope, so a legitimate rename is still followed while a jump to someone else's scope is refused out loud.
+- **Fixed `ada-cli update` being one upstream release away from installing a different product.** The version check queried `https://pi.dev/api/latest-version`, which answers `{"version":"0.84.3","packageName":"@earendil-works/pi-coding-agent"}`, and the self-update plan built its `npm install -g` spec from *that* package name. It did not fire only because 0.84.3 is not greater than our 0.84.22 — arithmetic, not design. The check now queries the npm registry for our own package, and the install spec always uses our own package name regardless of what any server replies.
+- **Fixed `audit verify` accusing an intact installation of tampering.** A single condition answered two different questions and always blamed the first, so a file written by two desktop processes — each starting its own chain — was reported as "the hash of an entry does not match its content" when it matched perfectly, and verification stopped there. Three causes are now told apart: an edited entry, a broken link, and a chain restart. A restart is neither an accusation nor an absolution: it is reported with its file and timestamp, and counting continues.
+- **Fixed the DPO report hiding its own scope caveat whenever there was data.** The sentence naming which network paths the ledger observes travelled inside the "nothing happened" text, which is only printed when the table is empty. The caveat matters more with rows than without: an empty table asserts an absence, a populated one implies an exhaustive list. It is now always rendered, and the list of uncovered paths — which was wrong — was rebuilt by walking every `fetch(` in the source and is now guarded by a test.
+- Fixed writes to `auth.json` and `models-store.json` overriding administrator-managed file permissions and ACLs ([#7779](https://github.com/earendil-works/pi/issues/7779)).
 - Fixed UTF-8 BOM markers preventing frontmatter and user configuration files from loading ([#8337](https://github.com/earendil-works/pi/issues/8337)).
 - Fixed invalid settings files being easy to miss during interactive startup by rendering warnings with the file path inside the TUI ([#7829](https://github.com/earendil-works/pi/issues/7829)).
 - Fixed the subagent example repeatedly prompting before running project-local agents in trusted repositories ([#8261](https://github.com/earendil-works/pi/issues/8261)).

package/README.es.md

@@ -72,6 +72,13 @@ pi.dev es deliberadamente mínimo — su propia filosofía es saltarse sub-agent
 | ✨ **Prompt Optimizer** | Antes de procesar una petición, decide si hace falta preguntar hasta 3 huecos críticos (`clarify`) o reescribirla como prompt estructurado (`enhance`). |
 | 🔐 **Vault** (`/vault`) | Almacén local de secretos cifrado con passphrase, compartido entre el CLI, la app de escritorio y los subagentes de una sesión desbloqueada. |
 | 🖥️ **App de escritorio** | Tauri 2 + Next.js, sobre el mismo SDK y `settings.json` que el CLI. pi.dev es solo terminal. |
+| ⏰ **Scheduler** (`ada-cli schedule`) | Trabajo recurrente que corre dentro de `ada-cli serve`. `maxRuns` y `expiresAt` son **obligatorios**: un trabajo recurrente sin techo es gasto indefinido, y nadie se acuerda de apagarlo. Cada job usa su propia sesión para que dos programaciones no se contaminen el contexto. |
+| 🔁 **Continual Harness** (`ada-cli refine`) | Convierte lo aprendido en una sesión terminada en notas durables que se inyectan en prompts futuros. Cada propuesta **exige evidencia citada** (`fichero:línea`, un comando y su salida, un mensaje tuyo); las que no la traen se rechazan y te lo dice. El prompt de sistema base no se toca nunca. |
+| 🌐 **Tools web** (`web_search`, `web_fetch`) | TypeScript nativo, clave desde el vault cifrado y guardas SSRF: los rangos privados y el endpoint de metadatos del cloud se bloquean antes de hacer la petición. Opt-in por subagente: el acceso a red nunca se hereda de `readOnly`. |
+| 🔌 **MCP** (`mcp_list_tools`, `mcp_call_tool`) | Cliente MCP de TypeScript real, con los tokens en el vault. Exactamente **dos** tools, nunca una por herramienta remota: un servidor con 40 inundaría el system prompt y desplazaría el prefijo cacheable. |
+| 💾 **Optimizador de caché de prompt** | Reordena el system prompt para que lo estable vaya delante, mide el hit rate real por proveedor y repara las rarezas de cada uno. Con caché por prefijo el coste de un cambio depende de su **posición**, no de su tamaño — en DeepSeek un fallo cuesta 31 veces un acierto. |
+| 🖧 **Sesiones residentes** (`ada-cli serve` / `attach` / `session`) | El trabajo sobrevive al cierre del terminal. Puedes reengancharte para mirar o dirigir, y hacer `compact`, `rename`, `fork` o `kill` por el socket. |
+| 🧩 **Integración con editores** (`ada-cli acp`) | Habla Agent Client Protocol por stdio, así que Zed y cualquier cliente ACP pueden conducir Ada en vez del TUI. |
 
 <details>
 <summary><b>Comparativa fila a fila vs. pi.dev upstream</b> (verificado contra ambos códigos fuente)</summary>
@@ -94,21 +101,25 @@ pi.dev es deliberadamente mínimo — su propia filosofía es saltarse sub-agent
 <details>
 <summary><b>Ada CLI vs. Prime Agent</b> (otro fork de pi.dev, 17k+ ⭐)</summary>
 
-[PrimeIntellect-ai/prime-agent](https://github.com/PrimeIntellect-ai/prime-agent) también está construido sobre `earendil-works/pi`, con un modelo de ejecución basado en un kernel Python persistente y un "Continual Harness" auto-mejorable. Desglose completo con fuentes: [docs/AUDIT.md §7.5](../../docs/AUDIT.md).
+[PrimeIntellect-ai/prime-agent](https://github.com/PrimeIntellect-ai/prime-agent) también está construido sobre `earendil-works/pi`, con un modelo de ejecución basado en un kernel Python persistente y un "Continual Harness" auto-mejorable. Desglose completo con fuentes: [docs/AUDIT.md §8](../../docs/AUDIT.md).
 
 | Capacidad | Ada CLI | Prime Agent | Ventaja |
 |---|---|---|---|
-| Sesiones en background que sobreviven al cierre de terminal | No | Basado en daemon, `attach`/`detach` | Prime Agent |
+| Sesiones en background que sobreviven al cierre de terminal | `ada serve` / `ada attach` / `ada session` | Basado en daemon, `attach`/`detach` | Empate |
+| Integración con editores (Agent Client Protocol) | `ada acp` | Modo `acp` | Empate |
+| Trabajo recurrente / scheduling | `ada-cli schedule`, con `maxRuns`/`expiresAt` obligatorios | `/heartbeat`, cron schedules | Empate |
+| Auto-mejora de instrucciones | `ada-cli refine`, cada propuesta exige evidencia citada | `/refine` con snapshots de rollback | Empate |
 | Mensajería agente-a-agente | Bloqueada a propósito (anti-recursión por diseño) | Incluida | Trade-off de diseño, no un gap |
-| Scheduling / heartbeats | No | `/heartbeat`, cron schedules | Prime Agent |
-| Auto-mejora de instrucciones | La memoria guarda, no se auto-edita | `/refine` con snapshots de rollback | Prime Agent |
-| Skills ejecutables / con Python | Solo markdown | Paquetes Python + skill-creator | Prime Agent |
+| Skills ejecutables / con Python | Solo markdown, por decisión | Paquetes Python + skill-creator | Prime Agent |
+| Integración MCP | Cliente TypeScript nativo, tokens desde el vault | El protocolo vive dentro del kernel de Python | **Ada CLI** |
+| Búsqueda web | `web_search`/`web_fetch`, clave en el vault, con guardas SSRF | Skill de Python, clave en `auth.json` en claro | **Ada CLI** |
+| Optimización de caché de prompt | Estabilización de prefijo + medición de hit rate por proveedor | No tiene | **Ada CLI** |
 | Grafo de trazabilidad del trabajo | Sí, con gates de evidencia | No tiene | **Ada CLI** |
 | App de escritorio nativa | Sí | Solo TUI | **Ada CLI** |
 | Vault de secretos cifrado dedicado | Sí | `auth.json` plano | **Ada CLI** |
 | Juez obligatorio con evidencia | Sí, por defecto | Gates configurables por el usuario, no forzados | **Ada CLI** |
 
-Ver [docs/AUDIT.md](../../docs/AUDIT.md) para la auditoría técnica completa, la mecánica exacta de fork/sync, y las mejoras propuestas (daemon en background, scheduling, memoria auto-mejorable) mapeadas a cómo encajarían en el motor ya existente.
+Ver [docs/AUDIT.md](../../docs/AUDIT.md) para la auditoría técnica completa, la mecánica exacta de fork/sync, y el desglose de paridad capacidad por capacidad — incluido lo que decidimos deliberadamente NO copiar, y por qué.
 
 </details>
 

package/README.md

@@ -30,7 +30,7 @@ Where most coding agents ask you to trust a single long-running chat, Ada is bui
 - **Autonomy requires a signed-off contract.** The [Goal Engine](#ada-intelligence-engine) won't touch a codebase until you `/goal approve` its plan, runs fixed TDD phases, and never marks work `done` without a judge citing evidence for it.
 - **Nothing is "done" on the model's word alone.** The [Work Graph](#ada-intelligence-engine) gates completion on observed evidence — a passing test, a real diff, a verified command — not a claim in the transcript.
 - **Memory is compliance-ready by default.** The [Memory Engine](#ada-intelligence-engine) blocks PII before it's ever written to disk and keeps a hash-chained audit log of every write and rejection.
-- **Secrets never touch the model's context.** The built-in [Vault](#ada-intelligence-engine) is a local encrypted store shared across the CLI, desktop app, and subagents of an unlocked session.
+- **Secrets stay off disk, and out of reach of the agent.** The built-in [Vault](#ada-intelligence-engine) is a local encrypted store shared across the CLI, desktop app, and subagents of an unlocked session. Provider credentials and MCP tokens never enter the model's context. An explicit `@vault:NAME` reference *does* expand into the prompt — that is its purpose, so the model can use the secret in a command — but the expansion is redacted in everything persisted and displayed. The agent cannot read the vault: `core/aprobacion/politica.ts` denies it permanently, and that denial survives `yolo`.
 - **Teams get a GUI, not just a terminal.** The [Ada Desktop](../../desktop/) app (Tauri + Next.js) reads the exact same SDK and config as the CLI — no parallel product to maintain.
 - **Extensible instead of opinionated.** No baked-in MCP, sub-agent framework, or permission popups — build exactly the workflow you need with [extensions](docs/extensions.md), [skills](docs/skills.md), or third-party [Ada packages](docs/packages.md). See [Philosophy](#philosophy).
 
@@ -47,14 +47,101 @@ ada-cli
 
 Or authenticate with an existing subscription: run `ada-cli`, then `/login`. First run in a new project asks you to trust the folder — see [Project Trust](docs/security.md).
 
+Compliance controls in detail — ledger, retention purge, machine policy,
+art. 9 detection, OTLP and SBOM — with what each one proves and what it does
+not: [Compliance](docs/compliance.md).
+
 Full walkthrough: [Quickstart](docs/quickstart.md) · [Providers & models](docs/providers.md) · [Windows](docs/windows.md) · [Termux](docs/termux.md) · [tmux](docs/tmux.md)
 
+### One limitation of the published package
+
+`ada-cli session <id> <op>` (compact, rename, fork, kill, ops) needs a protocol
+extension point that this fork adds to `@earendil-works/pi-{client,protocol,server}`.
+Those are upstream packages: the published `@hoilab/ada-cli` resolves them from
+the npm registry, so an installed copy does not carry it. The command says so
+instead of failing with an opaque error. Everything else — including `serve`,
+`attach` and the whole agent — works from the published package.
+
+A source build has no such limitation.
+
+### Building from source
+
+Organisations that will not install from a public registry can build the same
+artifact locally. `dist/` is what the published package and the desktop app
+consume, so it has to be built — running from `src/` is not the same thing.
+
+```bash
+git clone https://github.com/HOILAB/ada-cli.git
+cd ada-cli
+npm ci                                   # exact versions from npm-shrinkwrap.json
+npm run build --prefix packages/coding-agent
+npm link --prefix packages/coding-agent  # puts `ada-cli` on PATH
+```
+
+To verify the build before trusting it:
+
+```bash
+npm run check          # types, lint, pinned deps, shrinkwrap, startup budget, fork budget
+npx vitest run         # the full suite (from packages/coding-agent)
+ada-cli --version
+```
+
+`ada-cli update` only runs when you ask for it and it queries the npm registry
+for this package, so a source build stays put until you rebuild it. Nothing
+phones home — see [Telemetry and update checks](docs/settings.md#telemetry-and-update-checks).
+
+## Measured against the alternatives
+
+Four coding tasks, the **installed package** (not the source tree), the same
+free OpenRouter model as the competing agent, comparing each one's own session
+logs:
+
+| task | Ada | oh-my-pi |
+|---|---:|---:|
+| queue: fix a bug and add a method | 4 calls | 4 |
+| parser: honour quotes in CSV splitting | **4** | 10 |
+| retry: two bugs at once | 5 | 4 |
+| stack: add a method, throw on empty | 4 | 4 |
+| **total round trips** | **17** | **22** |
+
+Both produced correct code on all four — verified by *running* the result, not
+reading it. Ada uses somewhat more context per turn (its system prompt carries
+the compliance doctrine, and it re-reads a file after editing to verify), and
+fewer round trips, which is what costs time and money per call.
+
+**Re-run on the release candidate (0.85.0)** with a different free model
+(`x-preview-f-free` via the same gateway for both agents) and freshly written
+task fixtures, same method — installed package, executed results, each one's
+own session logs:
+
+| task | Ada | oh-my-pi |
+|---|---:|---:|
+| queue: fix a bug and add a method | 8 calls | 8 |
+| parser: honour quotes in CSV splitting | **13** | 15 |
+| retry: two bugs at once | 7 | **4** |
+| stack: add a method, throw on empty | **7** | 10 |
+| **total round trips** | **35** | **37** |
+
+Again 8/8 correct across both agents. On this model the aggregate favours Ada,
+with per-task wins split both ways — the honest reading is functional parity
+with fewer round trips, not dominance.
+
+The one feature where the competing agent still led — reading PDFs, which it
+does by rendering the document in a headless browser and screenshotting it — is
+closed as of this release: `read` now extracts a PDF's text layer with
+`node:zlib` alone. It reports the three states that matter (text extracted /
+scanned, no text layer / unreadable) instead of letting a scanned document pass
+for an empty file; what it deliberately does not do is reproduce exact layout,
+which would need the browser back.
+
 ## Built for Enterprise
 
-- **Governed autonomy.** Permission modes (`ask` / `auto` / `plan` / `full`) and the Goal Engine's `askBefore` brakes gate irreversible actions (publish, delete, spend) behind explicit approval, in both the CLI and the desktop app.
+- **Governed autonomy.** Permission modes (`plan` / `manual` / `auto` / `yolo`) and the Goal Engine's `askBefore` brakes gate irreversible actions (publish, delete, spend) behind explicit approval, in both the CLI and the desktop app. `manual` asks before every write; `auto` is the default; `plan` makes the tree read-only.
 - **Evidence over assertions.** The Goal Engine's judge and the Work Graph's gates both require cited, observed evidence before anything counts as complete — no autonomous run can silently mark itself done.
+- **Retention you can defend.** `ada-cli audit purge --dias N --politica "..."` deletes old ledger files by writing a **chained tombstone** first — which period, how many entries, under what policy, and the closing hash. `audit verify` then reports the gap as *explained* rather than as tampering, so complying with GDPR art. 5.1.e stops looking like covering your tracks. `--dry-run` shows exactly what would go, down the same code path that removes it.
+- **A policy the user cannot switch off.** A third configuration scope lives where the operating system requires administrator rights to write (`/Library/Application Support/Ada/`, `/etc/ada/`, `%ProgramData%\Ada\`). It can only ever *restrict*: a `modoMaximo` ceiling lowers the requested permission mode and never raises it, and tools listed in `denegadas` stay denied even in `yolo`. There is deliberately no environment variable pointing at another file — that would be the back door that voids the policy with one `export`. `ada-cli politica` shows whether it is in force, and whether the file is one this account could edit. Every decision records which rule decided it.
 - **Privacy and audit built in.** `memoryPrivacyLevel: "strict"` (default) blocks PII before it's persisted; every memory write, rejection, and search is hash-chained in an audit log via `/memory-audit` — designed to support GDPR/AI Act obligations without extra tooling.
-- **Secrets isolation.** Vault-backed credentials never enter the model's prompt context and never touch disk unencrypted.
+- **Secrets isolation.** Provider credentials and MCP tokens never enter the model's prompt context, and nothing in the vault touches disk unencrypted. `auth.json` is encrypted at rest with AES-256-GCM under a key held in the system keychain.
 - **Budgeted, bounded runs.** Every autonomous surface (Goal Engine, Workflows) enforces turn limits, repeat-loop detection, a stop-file kill switch, and token/cost budgets — no open-ended spend.
 - **Deployable as CLI or desktop.** Same SDK, same `settings.json`, same audit trail whether your team works in a terminal or a GUI.
 - **Stays current automatically.** A deterministic daily sync (`scripts/sync-ada.sh` + GitHub Action) re-bases onto upstream pi.dev, so security fixes and new provider support land without manual patch-tracking.
@@ -72,6 +159,13 @@ pi.dev is deliberately minimal — its own philosophy is to skip sub-agents and
 | ✨ **Prompt Optimizer** | Before processing a request, decides whether to ask up to 3 clarifying questions (`clarify`) or rewrite it as a structured prompt (`enhance`). |
 | 🔐 **Vault** (`/vault`) | Passphrase-encrypted local secret store, shared across the CLI, the desktop app, and subagents of an unlocked session. |
 | 🖥️ **Desktop app** | Tauri 2 + Next.js, running on the exact same SDK and `settings.json` as the CLI. pi.dev is terminal-only. |
+| ⏰ **Scheduler** (`ada-cli schedule`) | Recurring work that runs inside `ada-cli serve`. `maxRuns` and `expiresAt` are **mandatory** — an open-ended recurring job is open-ended spend, and nobody remembers to turn it off. Each job gets its own session so two schedules never contaminate each other's context. |
+| 🔁 **Continual Harness** (`ada-cli refine`) | Turns what a finished session learned into durable notes injected into future prompts. Every proposal **requires cited evidence** (`file:line`, a command and its output, a message from you); the ones without it are rejected and shown to you. The base system prompt is never touched. |
+| 🌐 **Web tools** (`web_search`, `web_fetch`) | Native TypeScript, key from the encrypted vault, SSRF-guarded — private ranges and the cloud metadata endpoint are blocked before the request is made. Opt-in per subagent: network access is never inherited from `readOnly`. |
+| 🔌 **MCP** (`mcp_list_tools`, `mcp_call_tool`) | A real TypeScript MCP client with tokens from the vault. Exactly **two** tools, never one per remote tool: a 40-tool server would flood the system prompt and displace the cacheable prefix. |
+| 💾 **Prompt cache optimizer** | Reorders the system prompt so stable content comes first, meters the real hit rate per provider, and repairs provider-specific quirks. With prefix caching the cost of a change depends on its **position**, not its size — on DeepSeek a miss costs 31x a hit. |
+| 🖧 **Resident sessions** (`ada-cli serve` / `attach` / `session`) | Work survives closing the terminal. Reattach to watch or steer, and run `compact`, `rename`, `fork` or `kill` over the socket. |
+| 🧩 **Editor integration** (`ada-cli acp`) | Speaks Agent Client Protocol over stdio, so Zed and any ACP client can drive Ada instead of the TUI. |
 
 <details>
 <summary><b>Row-by-row comparison vs. upstream pi.dev</b> (verified against both codebases)</summary>
@@ -94,21 +188,25 @@ pi.dev is deliberately minimal — its own philosophy is to skip sub-agents and
 <details>
 <summary><b>Ada CLI vs. Prime Agent</b> (another pi.dev fork, 17k+ ⭐)</summary>
 
-[PrimeIntellect-ai/prime-agent](https://github.com/PrimeIntellect-ai/prime-agent) is also built on `earendil-works/pi`, with a persistent-Python-kernel execution model and a self-improving "Continual Harness". Full breakdown with sources: [docs/AUDIT.md §7.5](../../docs/AUDIT.md).
+[PrimeIntellect-ai/prime-agent](https://github.com/PrimeIntellect-ai/prime-agent) is also built on `earendil-works/pi`, with a persistent-Python-kernel execution model and a self-improving "Continual Harness". Full breakdown with sources: [docs/AUDIT.md §8](../../docs/AUDIT.md).
 
 | Capability | Ada CLI | Prime Agent | Edge |
 |---|---|---|---|
-| Background sessions surviving terminal close | No | Daemon-backed, `attach`/`detach` | Prime Agent |
+| Background sessions surviving terminal close | `ada serve` / `ada attach` / `ada session` | Daemon-backed `attach`/`detach` | Even |
+| Editor integration (Agent Client Protocol) | `ada acp` | `acp` mode | Even |
+| Scheduling / recurring work | `ada-cli schedule`, with mandatory `maxRuns`/`expiresAt` | `/heartbeat`, cron schedules | Even |
+| Self-improving instructions | `ada-cli refine`, every proposal requires cited evidence | `/refine` with rollback snapshots | Even |
 | Agent-to-agent messaging | Deliberately blocked (anti-recursion by design) | Built in | Design trade-off, not a gap |
-| Scheduling / heartbeats | No | `/heartbeat`, cron schedules | Prime Agent |
-| Self-improving instructions | Memory stores, doesn't self-edit | `/refine` with rollback snapshots | Prime Agent |
-| Executable / Python-backed skills | Markdown only | Python packages + skill-creator | Prime Agent |
+| Executable / Python-backed skills | Markdown only, by choice | Python packages + skill-creator | Prime Agent |
+| MCP integration | Native TypeScript client, tokens from the vault | Protocol lives inside the Python kernel | **Ada CLI** |
+| Web search | `web_search`/`web_fetch`, key in the vault, SSRF-guarded | Python skill, key in plaintext `auth.json` | **Ada CLI** |
+| Prompt-cache optimisation | Prefix stabilisation + per-provider hit-rate metering | None | **Ada CLI** |
 | Work traceability graph | Yes, evidence-gated | None | **Ada CLI** |
 | Native desktop app | Yes | TUI-only | **Ada CLI** |
 | Dedicated encrypted secrets vault | Yes | Plain `auth.json` | **Ada CLI** |
 | Mandatory evidence-backed judge | Yes, by default | User-configurable gates, not forced | **Ada CLI** |
 
-See [docs/AUDIT.md](../../docs/AUDIT.md) for the full technical audit, the exact fork/sync mechanics, and proposed improvements (background daemon, scheduling, self-refining memory) mapped to how they'd plug into the existing engine.
+See [docs/AUDIT.md](../../docs/AUDIT.md) for the full technical audit, the exact fork/sync mechanics, and the capability-by-capability parity breakdown — including what we deliberately chose *not* to copy, and why.
 
 </details>
 
@@ -118,11 +216,11 @@ These are enforced in code, not by policy. Each line is checkable — open the f
 
 | Guarantee | Where it is enforced |
 |---|---|
-| **A goal cannot complete without a judge citing evidence.** The judge is independent, sees only the goal, its `doneCriteria`, the `verifyCommand` and the cited evidence, and runs cross-model. No verdict, no completion. | `workflows/goal-engine/engine.ts` (`runJudge`), `resource-loader.ts` |
+| **A goal cannot complete without a judge citing evidence.** The judge is independent, sees only the goal, its `doneCriteria`, the `verifyCommand` and the cited evidence, and runs on its own session — on a different model when the workers are configured on a cheaper tier. No verdict, no completion. | `workflows/goal-engine/engine.ts` (`runJudge`), `resource-loader.ts` |
 | **Subagents cannot orchestrate or write durable memory — structurally.** The tools are not registered in a subagent's registry at all; it is not a permission check that could be bypassed or relaxed. Asserted in `test/anti-recursion-tools.test.ts`. | `agent-session.ts` (`_isSubagentSession` gates) |
 | **Memory is written through a PII scanner and a hash-chained audit log.** Rejections are logged too, and `/memory-audit` verifies the chain. | `memory-engine/scanner.ts`, `memory-engine/audit.ts` |
 
-**What Ada does *not* claim.** The `node:vm` sandbox contains the *orchestrator script* — it has no `require`, `process` or `import` and cannot reach the host. The **leaf agents it spawns are ordinary sessions** with `read`/`bash`/`edit`/`write` and the same OS permissions as any coding agent, yours included. Ada is not an OS sandbox and does not pretend to be one; for untrusted work, run it in a container. What is genuinely contained is the orchestration layer, and credentials live in an encrypted vault rather than in plaintext environment variables.
+**What Ada does *not* claim.** The workflow interpreter rejects scripts that use `require`, `process` or `import`, but that check is a **text filter, not a security boundary**: `node:vm` is escapable through the constructor chain, and we verified it — a script reaching the host process, its 67 environment variables and its working directory. Node documents this itself: *«The node:vm module is not a security mechanism.»* The filter's real job is to turn naive host access into a readable error, and the guard for that limit lives in `test/workflows-sandbox-limite.test.ts`. The **leaf agents Ada spawns are ordinary sessions** with `read`/`bash`/`edit`/`write` and the same OS permissions as any coding agent, yours included. **Ada is not an OS sandbox**; for untrusted work, run it in a container. What Ada does contain is narrower and real: credentials live in an encrypted vault that is permanently out of the agent's reach, every tool call and command is recorded in a hash-chained ledger, and extensions go through the same approval policy as the agent.
 
 Engine command reference, `settings.json` schema, and model-routing rules: [docs/AUDIT.md §4](../../docs/AUDIT.md) covers the architecture; slash-command syntax for `/goal`, `/workflow`, `/graph`, `/memory-*`, and `/vault` is documented inline via `--help` and `/hotkeys` in the CLI itself.
 

package/dist/ada-publico.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Superficie pública de Ada.
+ *
+ * Todo lo que Ada añade a la API del paquete sale por aquí y entra en
+ * `index.ts` por UNA sola línea. No es cosmética: `index.ts` es de upstream y
+ * biome ordena sus exportaciones por ruta de módulo, así que cada bloque
+ * nuestro caía en un sitio distinto del fichero y costaba un hunk de
+ * presupuesto de sync (5 en total). Juntos cuestan 2, y los 3 recuperados son
+ * los que paga el registro denso de `core/compactar/`.
+ *
+ * ADA-CLI.md ya señalaba este camino como "el margen barato"; esto es cobrarlo.
+ */
+export { type EntradaDelLibro, LibroDeSesion, type SucesoDeSesion, type Veredicto, } from "./core/audit/libro.ts";
+export { type EstadoMotor, estadoDelMotor, instalarMotor, type PermisoMac, pedirPermisos, recomprobarPermisos, VERSION_MOTOR, } from "./core/computer/driver.ts";
+export { esAppProhibida, type Nivel, techoDeCategoria } from "./core/computer/politica.ts";
+export { leerCredencialGuardada as readStoredCredential } from "./core/credenciales/reposo.ts";
+export { configureHttpDispatcher, DEFAULT_HTTP_IDLE_TIMEOUT_MS, HTTP_IDLE_TIMEOUT_CHOICES, } from "./core/http-dispatcher.ts";
+export { type AuditEntry, AuditLog } from "./core/memory-engine/audit.ts";
+export { isCorrection, MEMORY_POLICY_PROMPT, MemoryEngine, parseOperations, projectHashOf, } from "./core/memory-engine/engine.ts";
+export { InvertedIndex, tokenize } from "./core/memory-engine/inverted-index.ts";
+export { isKeychainAvailable, keychainClearPassphrase, keychainHasPassphrase, keychainLoadPassphrase, keychainSavePassphrase, } from "./core/memory-engine/keychain.ts";
+export { ENTRY_DELIMITER, encodeEntry, listProjectHashes, loadStores, ObservationStore, parseEntry, stripMetadata, } from "./core/memory-engine/observation-store.ts";
+export { scanContent } from "./core/memory-engine/scanner.ts";
+export { classifySensitive, type PrivacyLevel, type SensitiveCategory, type SensitivityResult, } from "./core/memory-engine/security.ts";
+export { extractText, parseSessionFile, SessionIndexer } from "./core/memory-engine/session-indexer.ts";
+export { createMemoryEngineTools, type MemoryEngineToolSet } from "./core/memory-engine/tools.ts";
+export { DEFAULT_MEMORY_CONFIG, type MemoryEngineConfig, type MemoryMode, type MemoryMutationInput, type MemoryOperation, type MemoryResult, type MemorySearchHit, type MemorySearchQuery, type MemoryTarget, OBSERVATION_TYPES, type Observation, type ObservationType, type ObservationView, type SessionSearchHit, } from "./core/memory-engine/types.ts";
+export { expandVaultRefs, ProjectVault, SessionVault, VAULT_REF_PATTERN, type VaultExpansion, type VaultListEntry, VaultManager, type VaultSecret, } from "./core/memory-engine/vault.ts";
+export { getProjectMemoryDirName, getProjectMemoryPath, hasProjectMemory, loadProjectMemory, loadProjectMemorySync, type ProjectMemory, saveProjectMemory, } from "./core/project-memory.ts";
+export { esRutaTemporal, porCoste, type Resumen, resumir, type Totales, } from "./core/usage/aggregate.ts";
+export { generateCodebaseAuditScript, generateCodeReviewScript, generateDeepResearchScript, generateMultiPerspectiveScript, generateProductBuildScript, } from "./core/workflows/builtins.ts";
+export { AgentRunner, type AgentRunOptions, type AgentRunResult, type AgentUsage, agentIdentityHash, createLimiter, DEFAULT_WORKFLOW_LIMITS, extractJson, messageText, parseWorkflowScript, runWorkflow, SharedStore, type WorkflowApi, WorkflowError, type WorkflowErrorCode, type WorkflowMeta, type WorkflowPhase, type WorkflowRunResult, } from "./core/workflows/index.ts";
+export type { ResolveWorkflowResult } from "./core/workflows/resolve-script.ts";
+export { listUserWorkflowScripts, resolveBuiltinWorkflowScript, resolveWorkflowScriptByName, } from "./core/workflows/resolve-script.ts";
+//# sourceMappingURL=ada-publico.d.ts.map

package/dist/ada-publico.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ada-publico.d.ts","sourceRoot":"","sources":["../src/ada-publico.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EACN,KAAK,eAAe,EACpB,aAAa,EACb,KAAK,cAAc,EACnB,KAAK,SAAS,GACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,KAAK,WAAW,EAChB,cAAc,EACd,aAAa,EACb,KAAK,UAAU,EACf,aAAa,EACb,mBAAmB,EACnB,aAAa,GACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,KAAK,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAM3F,OAAO,EAAE,sBAAsB,IAAI,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC/F,OAAO,EACN,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,KAAK,UAAU,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACN,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,aAAa,GACb,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EACN,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,GACtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,aAAa,GACb,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EACN,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AACxG,OAAO,EAAE,uBAAuB,EAAE,KAAK,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAClG,OAAO,EACN,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACrB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,YAAY,EACZ,KAAK,WAAW,GAChB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,aAAa,EAClB,iBAAiB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,cAAc,EACd,QAAQ,EACR,KAAK,OAAO,EACZ,OAAO,EACP,KAAK,OAAO,GACZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,2BAA2B,EAC3B,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,0BAA0B,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACN,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,KAAK,WAAW,EAChB,aAAa,EACb,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACtB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EACN,uBAAuB,EACvB,4BAA4B,EAC5B,2BAA2B,GAC3B,MAAM,oCAAoC,CAAC","sourcesContent":["/**\n * Superficie pública de Ada.\n *\n * Todo lo que Ada añade a la API del paquete sale por aquí y entra en\n * `index.ts` por UNA sola línea. No es cosmética: `index.ts` es de upstream y\n * biome ordena sus exportaciones por ruta de módulo, así que cada bloque\n * nuestro caía en un sitio distinto del fichero y costaba un hunk de\n * presupuesto de sync (5 en total). Juntos cuestan 2, y los 3 recuperados son\n * los que paga el registro denso de `core/compactar/`.\n *\n * ADA-CLI.md ya señalaba este camino como \"el margen barato\"; esto es cobrarlo.\n */\n\n// Libro de sesión: qué hizo el agente, en una cadena de hashes verificable.\nexport {\n\ttype EntradaDelLibro,\n\tLibroDeSesion,\n\ttype SucesoDeSesion,\n\ttype Veredicto,\n} from \"./core/audit/libro.ts\";\nexport {\n\ttype EstadoMotor,\n\testadoDelMotor,\n\tinstalarMotor,\n\ttype PermisoMac,\n\tpedirPermisos,\n\trecomprobarPermisos,\n\tVERSION_MOTOR,\n} from \"./core/computer/driver.ts\";\nexport { esAppProhibida, type Nivel, techoDeCategoria } from \"./core/computer/politica.ts\";\n// Sustituye a la exportación upstream del mismo nombre: la de\n// auth-storage.ts lee auth.json con su propio readFileSync + JSON.parse, sin\n// pasar por el cifrado en reposo (credenciales/reposo.ts) — con auth.json ya\n// migrado a cifrado devolvía SIEMPRE undefined, en silencio, a cualquier\n// consumidor de esta función pública. Ver reposo.ts.\nexport { leerCredencialGuardada as readStoredCredential } from \"./core/credenciales/reposo.ts\";\nexport {\n\tconfigureHttpDispatcher,\n\tDEFAULT_HTTP_IDLE_TIMEOUT_MS,\n\tHTTP_IDLE_TIMEOUT_CHOICES,\n} from \"./core/http-dispatcher.ts\";\nexport { type AuditEntry, AuditLog } from \"./core/memory-engine/audit.ts\";\nexport {\n\tisCorrection,\n\tMEMORY_POLICY_PROMPT,\n\tMemoryEngine,\n\tparseOperations,\n\tprojectHashOf,\n} from \"./core/memory-engine/engine.ts\";\nexport { InvertedIndex, tokenize } from \"./core/memory-engine/inverted-index.ts\";\nexport {\n\tisKeychainAvailable,\n\tkeychainClearPassphrase,\n\tkeychainHasPassphrase,\n\tkeychainLoadPassphrase,\n\tkeychainSavePassphrase,\n} from \"./core/memory-engine/keychain.ts\";\nexport {\n\tENTRY_DELIMITER,\n\tencodeEntry,\n\tlistProjectHashes,\n\tloadStores,\n\tObservationStore,\n\tparseEntry,\n\tstripMetadata,\n} from \"./core/memory-engine/observation-store.ts\";\nexport { scanContent } from \"./core/memory-engine/scanner.ts\";\nexport {\n\tclassifySensitive,\n\ttype PrivacyLevel,\n\ttype SensitiveCategory,\n\ttype SensitivityResult,\n} from \"./core/memory-engine/security.ts\";\nexport { extractText, parseSessionFile, SessionIndexer } from \"./core/memory-engine/session-indexer.ts\";\nexport { createMemoryEngineTools, type MemoryEngineToolSet } from \"./core/memory-engine/tools.ts\";\nexport {\n\tDEFAULT_MEMORY_CONFIG,\n\ttype MemoryEngineConfig,\n\ttype MemoryMode,\n\ttype MemoryMutationInput,\n\ttype MemoryOperation,\n\ttype MemoryResult,\n\ttype MemorySearchHit,\n\ttype MemorySearchQuery,\n\ttype MemoryTarget,\n\tOBSERVATION_TYPES,\n\ttype Observation,\n\ttype ObservationType,\n\ttype ObservationView,\n\ttype SessionSearchHit,\n} from \"./core/memory-engine/types.ts\";\nexport {\n\texpandVaultRefs,\n\tProjectVault,\n\tSessionVault,\n\tVAULT_REF_PATTERN,\n\ttype VaultExpansion,\n\ttype VaultListEntry,\n\tVaultManager,\n\ttype VaultSecret,\n} from \"./core/memory-engine/vault.ts\";\nexport {\n\tgetProjectMemoryDirName,\n\tgetProjectMemoryPath,\n\thasProjectMemory,\n\tloadProjectMemory,\n\tloadProjectMemorySync,\n\ttype ProjectMemory,\n\tsaveProjectMemory,\n} from \"./core/project-memory.ts\";\nexport {\n\tesRutaTemporal,\n\tporCoste,\n\ttype Resumen,\n\tresumir,\n\ttype Totales,\n} from \"./core/usage/aggregate.ts\";\nexport {\n\tgenerateCodebaseAuditScript,\n\tgenerateCodeReviewScript,\n\tgenerateDeepResearchScript,\n\tgenerateMultiPerspectiveScript,\n\tgenerateProductBuildScript,\n} from \"./core/workflows/builtins.ts\";\nexport {\n\tAgentRunner,\n\ttype AgentRunOptions,\n\ttype AgentRunResult,\n\ttype AgentUsage,\n\tagentIdentityHash,\n\tcreateLimiter,\n\tDEFAULT_WORKFLOW_LIMITS,\n\textractJson,\n\tmessageText,\n\tparseWorkflowScript,\n\trunWorkflow,\n\tSharedStore,\n\ttype WorkflowApi,\n\tWorkflowError,\n\ttype WorkflowErrorCode,\n\ttype WorkflowMeta,\n\ttype WorkflowPhase,\n\ttype WorkflowRunResult,\n} from \"./core/workflows/index.ts\";\nexport type { ResolveWorkflowResult } from \"./core/workflows/resolve-script.ts\";\nexport {\n\tlistUserWorkflowScripts,\n\tresolveBuiltinWorkflowScript,\n\tresolveWorkflowScriptByName,\n} from \"./core/workflows/resolve-script.ts\";\n"]}

package/dist/ada-publico.js

@@ -0,0 +1,40 @@
+/**
+ * Superficie pública de Ada.
+ *
+ * Todo lo que Ada añade a la API del paquete sale por aquí y entra en
+ * `index.ts` por UNA sola línea. No es cosmética: `index.ts` es de upstream y
+ * biome ordena sus exportaciones por ruta de módulo, así que cada bloque
+ * nuestro caía en un sitio distinto del fichero y costaba un hunk de
+ * presupuesto de sync (5 en total). Juntos cuestan 2, y los 3 recuperados son
+ * los que paga el registro denso de `core/compactar/`.
+ *
+ * ADA-CLI.md ya señalaba este camino como "el margen barato"; esto es cobrarlo.
+ */
+// Libro de sesión: qué hizo el agente, en una cadena de hashes verificable.
+export { LibroDeSesion, } from "./core/audit/libro.js";
+export { estadoDelMotor, instalarMotor, pedirPermisos, recomprobarPermisos, VERSION_MOTOR, } from "./core/computer/driver.js";
+export { esAppProhibida, techoDeCategoria } from "./core/computer/politica.js";
+// Sustituye a la exportación upstream del mismo nombre: la de
+// auth-storage.ts lee auth.json con su propio readFileSync + JSON.parse, sin
+// pasar por el cifrado en reposo (credenciales/reposo.ts) — con auth.json ya
+// migrado a cifrado devolvía SIEMPRE undefined, en silencio, a cualquier
+// consumidor de esta función pública. Ver reposo.ts.
+export { leerCredencialGuardada as readStoredCredential } from "./core/credenciales/reposo.js";
+export { configureHttpDispatcher, DEFAULT_HTTP_IDLE_TIMEOUT_MS, HTTP_IDLE_TIMEOUT_CHOICES, } from "./core/http-dispatcher.js";
+export { AuditLog } from "./core/memory-engine/audit.js";
+export { isCorrection, MEMORY_POLICY_PROMPT, MemoryEngine, parseOperations, projectHashOf, } from "./core/memory-engine/engine.js";
+export { InvertedIndex, tokenize } from "./core/memory-engine/inverted-index.js";
+export { isKeychainAvailable, keychainClearPassphrase, keychainHasPassphrase, keychainLoadPassphrase, keychainSavePassphrase, } from "./core/memory-engine/keychain.js";
+export { ENTRY_DELIMITER, encodeEntry, listProjectHashes, loadStores, ObservationStore, parseEntry, stripMetadata, } from "./core/memory-engine/observation-store.js";
+export { scanContent } from "./core/memory-engine/scanner.js";
+export { classifySensitive, } from "./core/memory-engine/security.js";
+export { extractText, parseSessionFile, SessionIndexer } from "./core/memory-engine/session-indexer.js";
+export { createMemoryEngineTools } from "./core/memory-engine/tools.js";
+export { DEFAULT_MEMORY_CONFIG, OBSERVATION_TYPES, } from "./core/memory-engine/types.js";
+export { expandVaultRefs, ProjectVault, SessionVault, VAULT_REF_PATTERN, VaultManager, } from "./core/memory-engine/vault.js";
+export { getProjectMemoryDirName, getProjectMemoryPath, hasProjectMemory, loadProjectMemory, loadProjectMemorySync, saveProjectMemory, } from "./core/project-memory.js";
+export { esRutaTemporal, porCoste, resumir, } from "./core/usage/aggregate.js";
+export { generateCodebaseAuditScript, generateCodeReviewScript, generateDeepResearchScript, generateMultiPerspectiveScript, generateProductBuildScript, } from "./core/workflows/builtins.js";
+export { AgentRunner, agentIdentityHash, createLimiter, DEFAULT_WORKFLOW_LIMITS, extractJson, messageText, parseWorkflowScript, runWorkflow, SharedStore, WorkflowError, } from "./core/workflows/index.js";
+export { listUserWorkflowScripts, resolveBuiltinWorkflowScript, resolveWorkflowScriptByName, } from "./core/workflows/resolve-script.js";
+//# sourceMappingURL=ada-publico.js.map

package/dist/ada-publico.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ada-publico.js","sourceRoot":"","sources":["../src/ada-publico.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,8EAA4E;AAC5E,OAAO,EAEN,aAAa,GAGb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEN,cAAc,EACd,aAAa,EAEb,aAAa,EACb,mBAAmB,EACnB,aAAa,GACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAc,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,+DAA8D;AAC9D,6EAA6E;AAC7E,+EAA6E;AAC7E,0EAAyE;AACzE,uDAAqD;AACrD,OAAO,EAAE,sBAAsB,IAAI,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC/F,OAAO,EACN,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAmB,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACN,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,aAAa,GACb,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EACN,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,GACtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,aAAa,GACb,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EACN,iBAAiB,GAIjB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AACxG,OAAO,EAAE,uBAAuB,EAA4B,MAAM,+BAA+B,CAAC;AAClG,OAAO,EACN,qBAAqB,EASrB,iBAAiB,GAKjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,iBAAiB,EAGjB,YAAY,GAEZ,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EAErB,iBAAiB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,cAAc,EACd,QAAQ,EAER,OAAO,GAEP,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,2BAA2B,EAC3B,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,0BAA0B,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACN,WAAW,EAIX,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,WAAW,EAEX,aAAa,GAKb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACN,uBAAuB,EACvB,4BAA4B,EAC5B,2BAA2B,GAC3B,MAAM,oCAAoC,CAAC","sourcesContent":["/**\n * Superficie pública de Ada.\n *\n * Todo lo que Ada añade a la API del paquete sale por aquí y entra en\n * `index.ts` por UNA sola línea. No es cosmética: `index.ts` es de upstream y\n * biome ordena sus exportaciones por ruta de módulo, así que cada bloque\n * nuestro caía en un sitio distinto del fichero y costaba un hunk de\n * presupuesto de sync (5 en total). Juntos cuestan 2, y los 3 recuperados son\n * los que paga el registro denso de `core/compactar/`.\n *\n * ADA-CLI.md ya señalaba este camino como \"el margen barato\"; esto es cobrarlo.\n */\n\n// Libro de sesión: qué hizo el agente, en una cadena de hashes verificable.\nexport {\n\ttype EntradaDelLibro,\n\tLibroDeSesion,\n\ttype SucesoDeSesion,\n\ttype Veredicto,\n} from \"./core/audit/libro.ts\";\nexport {\n\ttype EstadoMotor,\n\testadoDelMotor,\n\tinstalarMotor,\n\ttype PermisoMac,\n\tpedirPermisos,\n\trecomprobarPermisos,\n\tVERSION_MOTOR,\n} from \"./core/computer/driver.ts\";\nexport { esAppProhibida, type Nivel, techoDeCategoria } from \"./core/computer/politica.ts\";\n// Sustituye a la exportación upstream del mismo nombre: la de\n// auth-storage.ts lee auth.json con su propio readFileSync + JSON.parse, sin\n// pasar por el cifrado en reposo (credenciales/reposo.ts) — con auth.json ya\n// migrado a cifrado devolvía SIEMPRE undefined, en silencio, a cualquier\n// consumidor de esta función pública. Ver reposo.ts.\nexport { leerCredencialGuardada as readStoredCredential } from \"./core/credenciales/reposo.ts\";\nexport {\n\tconfigureHttpDispatcher,\n\tDEFAULT_HTTP_IDLE_TIMEOUT_MS,\n\tHTTP_IDLE_TIMEOUT_CHOICES,\n} from \"./core/http-dispatcher.ts\";\nexport { type AuditEntry, AuditLog } from \"./core/memory-engine/audit.ts\";\nexport {\n\tisCorrection,\n\tMEMORY_POLICY_PROMPT,\n\tMemoryEngine,\n\tparseOperations,\n\tprojectHashOf,\n} from \"./core/memory-engine/engine.ts\";\nexport { InvertedIndex, tokenize } from \"./core/memory-engine/inverted-index.ts\";\nexport {\n\tisKeychainAvailable,\n\tkeychainClearPassphrase,\n\tkeychainHasPassphrase,\n\tkeychainLoadPassphrase,\n\tkeychainSavePassphrase,\n} from \"./core/memory-engine/keychain.ts\";\nexport {\n\tENTRY_DELIMITER,\n\tencodeEntry,\n\tlistProjectHashes,\n\tloadStores,\n\tObservationStore,\n\tparseEntry,\n\tstripMetadata,\n} from \"./core/memory-engine/observation-store.ts\";\nexport { scanContent } from \"./core/memory-engine/scanner.ts\";\nexport {\n\tclassifySensitive,\n\ttype PrivacyLevel,\n\ttype SensitiveCategory,\n\ttype SensitivityResult,\n} from \"./core/memory-engine/security.ts\";\nexport { extractText, parseSessionFile, SessionIndexer } from \"./core/memory-engine/session-indexer.ts\";\nexport { createMemoryEngineTools, type MemoryEngineToolSet } from \"./core/memory-engine/tools.ts\";\nexport {\n\tDEFAULT_MEMORY_CONFIG,\n\ttype MemoryEngineConfig,\n\ttype MemoryMode,\n\ttype MemoryMutationInput,\n\ttype MemoryOperation,\n\ttype MemoryResult,\n\ttype MemorySearchHit,\n\ttype MemorySearchQuery,\n\ttype MemoryTarget,\n\tOBSERVATION_TYPES,\n\ttype Observation,\n\ttype ObservationType,\n\ttype ObservationView,\n\ttype SessionSearchHit,\n} from \"./core/memory-engine/types.ts\";\nexport {\n\texpandVaultRefs,\n\tProjectVault,\n\tSessionVault,\n\tVAULT_REF_PATTERN,\n\ttype VaultExpansion,\n\ttype VaultListEntry,\n\tVaultManager,\n\ttype VaultSecret,\n} from \"./core/memory-engine/vault.ts\";\nexport {\n\tgetProjectMemoryDirName,\n\tgetProjectMemoryPath,\n\thasProjectMemory,\n\tloadProjectMemory,\n\tloadProjectMemorySync,\n\ttype ProjectMemory,\n\tsaveProjectMemory,\n} from \"./core/project-memory.ts\";\nexport {\n\tesRutaTemporal,\n\tporCoste,\n\ttype Resumen,\n\tresumir,\n\ttype Totales,\n} from \"./core/usage/aggregate.ts\";\nexport {\n\tgenerateCodebaseAuditScript,\n\tgenerateCodeReviewScript,\n\tgenerateDeepResearchScript,\n\tgenerateMultiPerspectiveScript,\n\tgenerateProductBuildScript,\n} from \"./core/workflows/builtins.ts\";\nexport {\n\tAgentRunner,\n\ttype AgentRunOptions,\n\ttype AgentRunResult,\n\ttype AgentUsage,\n\tagentIdentityHash,\n\tcreateLimiter,\n\tDEFAULT_WORKFLOW_LIMITS,\n\textractJson,\n\tmessageText,\n\tparseWorkflowScript,\n\trunWorkflow,\n\tSharedStore,\n\ttype WorkflowApi,\n\tWorkflowError,\n\ttype WorkflowErrorCode,\n\ttype WorkflowMeta,\n\ttype WorkflowPhase,\n\ttype WorkflowRunResult,\n} from \"./core/workflows/index.ts\";\nexport type { ResolveWorkflowResult } from \"./core/workflows/resolve-script.ts\";\nexport {\n\tlistUserWorkflowScripts,\n\tresolveBuiltinWorkflowScript,\n\tresolveWorkflowScriptByName,\n} from \"./core/workflows/resolve-script.ts\";\n"]}

package/dist/cli/audit-command.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `ada-cli audit` — el libro de sesión desde la línea de comandos.
+ *
+ * El libro (`core/audit/libro.ts`) registra qué hizo el agente en una cadena de
+ * hashes. Sin una superficie que lo lea, es un fichero que nadie mira: quien
+ * tiene que responder a una auditoría necesita poder enseñar la verificación,
+ * no fiarse de que existe.
+ *
+ * Tres estados que hay que distinguir y que es fácil confundir en uno:
+ * no hay libro · el libro está vacío · el libro está alterado. Un mensaje que
+ * sale siempre no distingue una instalación nueva de una manipulada.
+ */
+/** Devuelve true si consumió los argumentos. */
+export declare function runAuditCommand(args: string[], agentDir: string): Promise<boolean>;
+//# sourceMappingURL=audit-command.d.ts.map

package/dist/cli/audit-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-command.d.ts","sourceRoot":"","sources":["../../src/cli/audit-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA4EH,iDAAgD;AAChD,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAmOxF","sourcesContent":["/**\n * `ada-cli audit` — el libro de sesión desde la línea de comandos.\n *\n * El libro (`core/audit/libro.ts`) registra qué hizo el agente en una cadena de\n * hashes. Sin una superficie que lo lea, es un fichero que nadie mira: quien\n * tiene que responder a una auditoría necesita poder enseñar la verificación,\n * no fiarse de que existe.\n *\n * Tres estados que hay que distinguir y que es fácil confundir en uno:\n * no hay libro · el libro está vacío · el libro está alterado. Un mensaje que\n * sale siempre no distingue una instalación nueva de una manipulada.\n */\n\nimport { writeFile } from \"node:fs/promises\";\nimport { informeParaDpo } from \"../core/audit/exportacion.ts\";\nimport type { EntradaDelLibro } from \"../core/audit/libro.ts\";\nimport { LibroDeSesion } from \"../core/audit/libro.ts\";\n\n/**\n * Tope de la exportación.\n *\n * Existe porque `leer` necesita uno, no porque queramos recortar. Si se alcanza,\n * el informe lo dice y deja de afirmar ausencias: sobre una lectura truncada,\n * \"no hubo transferencias\" sería mentira.\n */\nconst TOPE_EXPORT = 100_000;\n\nconst AYUDA = `Uso:\n  ada-cli audit verify              Reverifica la cadena de hashes del libro\n  ada-cli audit show [--limit N]    Enseña las últimas entradas (por defecto 20)\n  ada-cli audit export [--out F]    Informe para un DPO en Markdown (por defecto, a la salida estándar)\n  ada-cli audit purge --dias N --politica \"texto\" [--dry-run]\n                                    Purga lo anterior al corte DEJANDO CONSTANCIA (art. 5.1.e RGPD).\n                                    También --antes-de AAAA-MM-DD.\n\nEl libro registra qué HIZO el agente —tools, comandos, llamadas al modelo,\nficheros tocados y salidas a la red— en una cadena donde cada entrada lleva\nel hash de la anterior, así que alterar un registro se detecta al reverificar.\n\nGuarda la forma, no el contenido: del fichero, su hash antes y después,\nnunca el texto.\n\nverify contesta tres estados y no dos: cadena íntegra, cadena alterada y\nFALTA algo que debería estar. Lo último lo sabe por el índice, que guarda un\nenlace duro a cada fichero de sesión, así que borrar sesion/ ya no deja un\nlibro valido y vacio.`;\n\n/** Formatea un suceso en una línea legible. */\nfunction describir(suceso: Record<string, unknown>): string {\n\tswitch (suceso.tipo) {\n\t\tcase \"modelo\": {\n\t\t\tconst coste = typeof suceso.coste === \"number\" && suceso.coste > 0 ? `  ${suceso.coste.toFixed(4)} $` : \"\";\n\t\t\treturn `modelo   ${suceso.proveedor}/${suceso.modelo}  ${suceso.entrada}→${suceso.salida} tok${coste}  ${suceso.motivoParada ?? \"\"}`;\n\t\t}\n\t\tcase \"comando\": {\n\t\t\tconst argv = Array.isArray(suceso.argv) ? suceso.argv.join(\" \") : \"\";\n\t\t\tconst encierro = suceso.sandbox ? `  [${suceso.sandbox}]` : \"\";\n\t\t\t// Sin origen se asume \"agente\": es lo que escribía el bash tool antes\n\t\t\t// de que existiera la terminal del usuario, y no hay que reetiquetar\n\t\t\t// entradas antiguas para que sigan leyéndose bien.\n\t\t\t// Y `extension` es el tercero: código de terceros cargado en el proceso,\n\t\t\t// que no es ni el modelo ni la persona. Sin la ruta no es accionable —\n\t\t\t// un \"lo hizo una extensión\" sin decir cuál no se puede investigar.\n\t\t\tconst origen =\n\t\t\t\tsuceso.origen === \"usuario\"\n\t\t\t\t\t? \"  [usuario]\"\n\t\t\t\t\t: suceso.origen === \"extension\"\n\t\t\t\t\t\t? `  [extension ${suceso.extension ?? \"?\"}]`\n\t\t\t\t\t\t: \"\";\n\t\t\treturn `comando  ${argv.slice(0, 70)}  →${suceso.codigo}${encierro}${origen}`;\n\t\t}\n\t\tcase \"fichero\":\n\t\t\treturn `fichero  ${suceso.ruta}  ${suceso.antes ?? \"(nuevo)\"}→${suceso.despues ?? \"(borrado)\"}  vía ${suceso.tool}`;\n\t\tcase \"red\":\n\t\t\treturn `red      ${suceso.dominio}  ${suceso.permitido ? \"permitido\" : \"DENEGADO\"}${suceso.motivo ? `  ${suceso.motivo}` : \"\"}`;\n\t\tdefault: {\n\t\t\tconst decision = suceso.decision ? `  (${suceso.decision})` : \"\";\n\t\t\treturn `tool     ${suceso.nombre}  ${suceso.ok ? \"ok\" : \"ERROR\"}${decision}`;\n\t\t}\n\t}\n}\n\nfunction linea(entrada: EntradaDelLibro): string {\n\tconst hora = entrada.ts.slice(11, 19);\n\treturn `#${String(entrada.seq).padStart(3)}  ${hora}  ${describir(entrada.suceso)}`;\n}\n\n/** Devuelve true si consumió los argumentos. */\nexport async function runAuditCommand(args: string[], agentDir: string): Promise<boolean> {\n\tif (args[0] !== \"audit\") return false;\n\n\tif (args.includes(\"--help\") || args.includes(\"-h\") || args.length === 1) {\n\t\tconsole.log(AYUDA);\n\t\treturn true;\n\t}\n\n\tconst libro = new LibroDeSesion(agentDir, \"cli\");\n\tconst sub = args[1];\n\n\tif (sub === \"verify\") {\n\t\tconst veredicto = await libro.verificar();\n\n\t\t// Lo que FALTA va PRIMERO, antes que «vacío» y antes que «íntegra».\n\t\t//\n\t\t// Es el estado que no existía y por el que se abrió este arreglo: borrado\n\t\t// el fichero del libro, esto contestaba «el libro está vacío» y salía con\n\t\t// código 0 — indistinguible de una instalación nueva. Un fichero que el\n\t\t// índice recuerda y ya no está no es «nada»: es una ausencia, y se cuenta.\n\t\tif (veredicto.faltan?.length) {\n\t\t\tconst entradas = veredicto.faltan.reduce((n, f) => n + f.entradas, 0);\n\t\t\tconsole.error(\n\t\t\t\t`FALTAN ${veredicto.faltan.length} fichero(s) del libro con ${entradas} entrada(s): alguien los ha borrado de sesion/.`,\n\t\t\t);\n\t\t\tfor (const f of veredicto.faltan) console.error(`  sesion/${f.fichero}  ${f.entradas} entrada(s)`);\n\t\t\t// Se dice que se pueden recuperar porque se puede: el índice no es una\n\t\t\t// copia de metadatos, es un enlace duro al mismo fichero.\n\t\t\tconsole.error(\"El índice conserva su contenido: ada-cli audit show los sigue enseñando.\");\n\t\t\tif (veredicto.motivo) console.error(`Y además: ${veredicto.motivo}.`);\n\t\t\tprocess.exitCode = 1;\n\t\t\treturn true;\n\t\t}\n\n\t\t// El tercer estado, y va antes que «íntegra» por la misma razón que\n\t\t// `faltan`: si sale después, no sale. Ni acusa ni absuelve, porque desde el\n\t\t// fichero no se puede hacer ninguna de las dos cosas.\n\t\tif (veredicto.reinicios?.length) {\n\t\t\tconsole.error(\n\t\t\t\t`La cadena vuelve a empezar en ${veredicto.reinicios.length} sitio(s) dentro de un mismo fichero:`,\n\t\t\t);\n\t\t\tfor (const r of veredicto.reinicios) {\n\t\t\t\tconsole.error(`  sesion/${r.fichero}  tras ${r.entradasAntes} entrada(s), en la del ${r.ts}`);\n\t\t\t}\n\t\t\tconsole.error(\n\t\t\t\t\"Lo produce un reinicio del proceso, y lo produce igual quien quite entradas\\n\" +\n\t\t\t\t\t\"del medio y escriba una cadena nueva: desde el fichero no se distinguen.\\n\" +\n\t\t\t\t\t\"Lo verificado sigue verificado; lo que no se puede afirmar es que no falte nada.\",\n\t\t\t);\n\t\t\tprocess.exitCode = 1;\n\t\t}\n\n\t\t// Las purgas se dicen SIEMPRE, tanto si la cadena está íntegra como si no.\n\t\t// Un libro con menos entradas de las que tuvo y ninguna explicación a la\n\t\t// vista es indistinguible de uno al que le han quitado cosas.\n\t\tif (veredicto.purgados?.length) {\n\t\t\tconst entradas = veredicto.purgados.reduce((n, f) => n + f.entradas, 0);\n\t\t\tconsole.log(\n\t\t\t\t`Purgadas ${entradas} entrada(s) en ${veredicto.purgados.length} fichero(s), con constancia en el libro:`,\n\t\t\t);\n\t\t\tfor (const f of veredicto.purgados) {\n\t\t\t\tconsole.log(`  ${f.fichero}  ${f.entradas} entrada(s)  política: ${f.politica}`);\n\t\t\t}\n\t\t}\n\n\t\tif (veredicto.sinAncla?.length) {\n\t\t\t// Ni bien ni mal: el tercer estado de verdad. Son libros escritos antes\n\t\t\t// de que existiera el índice. Decirlo con la palabra «alterado» habría\n\t\t\t// hecho gritar a toda instalación que se actualice.\n\t\t\tconsole.log(\n\t\t\t\t`Nota: ${veredicto.sinAncla.length} fichero(s) sin ancla en el índice (escritos antes de que existiera). Su desaparición no se podría detectar.`,\n\t\t\t);\n\t\t}\n\n\t\tif (veredicto.comprobadas === 0 && veredicto.valido) {\n\t\t\t// Ni roto ni sano: no hay nada. Decirlo así evita el \"todo correcto\"\n\t\t\t// que tranquiliza sobre un libro que no existe.\n\t\t\tconsole.log(\"El libro está vacío: este agente aún no ha registrado nada.\");\n\t\t\treturn true;\n\t\t}\n\t\tif (veredicto.valido) {\n\t\t\tconsole.log(`Cadena íntegra: ${veredicto.comprobadas} entradas verificadas.`);\n\t\t\treturn true;\n\t\t}\n\t\tconsole.error(\n\t\t\t`CADENA ALTERADA tras ${veredicto.comprobadas} entradas correctas` +\n\t\t\t\t(veredicto.alteradaEn ? `, en la del ${veredicto.alteradaEn}` : \"\") +\n\t\t\t\t(veredicto.motivo ? `\\n  motivo: ${veredicto.motivo}` : \"\") +\n\t\t\t\t(veredicto.ficheroAlterado ? `\\n  fichero: sesion/${veredicto.ficheroAlterado}` : \".\"),\n\t\t);\n\t\tconsole.error(\"Las entradas anteriores a esa siguen siendo fiables; a partir de ahí, no.\");\n\t\tprocess.exitCode = 1;\n\t\treturn true;\n\t}\n\n\tif (sub === \"show\") {\n\t\tconst i = args.indexOf(\"--limit\");\n\t\tconst limite = i >= 0 ? Number(args[i + 1]) : 20;\n\t\tif (!Number.isFinite(limite) || limite <= 0) {\n\t\t\tconsole.error(\"--limit necesita un número positivo.\");\n\t\t\tprocess.exitCode = 1;\n\t\t\treturn true;\n\t\t}\n\t\tconst entradas = await libro.leer(limite);\n\t\tif (entradas.length === 0) {\n\t\t\tconsole.log(\"El libro está vacío: este agente aún no ha registrado nada.\");\n\t\t\treturn true;\n\t\t}\n\t\tfor (const entrada of entradas) console.log(linea(entrada));\n\t\t// La verificación va DESPUÉS de listar: quien mira quiere ver las\n\t\t// entradas aunque la cadena esté rota, y saber que lo está.\n\t\tconst veredicto = await libro.verificar();\n\t\tif (!veredicto.valido) {\n\t\t\tconst faltan = veredicto.faltan?.length\n\t\t\t\t? `; FALTAN ${veredicto.faltan.length} fichero(s) borrados de sesion/, recuperados del índice`\n\t\t\t\t: \"\";\n\t\t\tconsole.error(\n\t\t\t\t`\\n⚠ El libro NO verifica (${veredicto.comprobadas} entradas correctas${faltan}). Detalle: ada-cli audit verify`,\n\t\t\t);\n\t\t\tprocess.exitCode = 1;\n\t\t}\n\t\treturn true;\n\t}\n\n\tif (sub === \"export\") {\n\t\t// `leer` da las entradas de la más reciente hacia atrás; el informe las\n\t\t// quiere en orden cronológico, que es como se lee un registro.\n\t\tconst recientesPrimero = await libro.leer(TOPE_EXPORT);\n\t\tconst entradas = [...recientesPrimero].reverse();\n\t\tconst veredicto = await libro.verificar();\n\t\tconst informe = informeParaDpo(entradas, veredicto, recientesPrimero.length >= TOPE_EXPORT);\n\n\t\tconst i = args.indexOf(\"--out\");\n\t\tconst destino = i >= 0 ? args[i + 1] : undefined;\n\t\tif (i >= 0 && !destino) {\n\t\t\tconsole.error(\"--out necesita una ruta de fichero.\");\n\t\t\tprocess.exitCode = 1;\n\t\t\treturn true;\n\t\t}\n\t\tif (destino) {\n\t\t\tawait writeFile(destino, informe, \"utf-8\");\n\t\t\tconsole.log(`Informe escrito en ${destino} (${entradas.length} entrada(s)).`);\n\t\t} else {\n\t\t\tconsole.log(informe);\n\t\t}\n\t\t// La cadena rota NO impide exportar —el informe lo dice dentro y es\n\t\t// justo lo que hay que poder enseñar—, pero sí sale con código 1: quien\n\t\t// automatice la exportación tiene que enterarse sin leer el Markdown.\n\t\tif (!veredicto.valido) process.exitCode = 1;\n\t\treturn true;\n\t}\n\n\tif (sub === \"purge\" || sub === \"purgar\") {\n\t\t// El art. 5.1.e del RGPD obliga a no conservar más de lo necesario, así que\n\t\t// un DPO TIENE que poder borrar lo viejo. Hasta ahora el único camino era\n\t\t// `rm`, y las dos formas de hacerlo salían mal: borrar `sesion/` hacía que\n\t\t// `verify` acusara de manipulación, y borrar también el índice hacía\n\t\t// desaparecer la purga sin rastro. Ver `core/audit/retencion.ts`.\n\t\tconst iDias = args.indexOf(\"--dias\");\n\t\tconst iAntes = args.indexOf(\"--antes-de\");\n\t\tif (iDias < 0 && iAntes < 0) {\n\t\t\tconsole.error(\n\t\t\t\t\"Falta el corte: --dias N (purga lo anterior a hace N días) o --antes-de AAAA-MM-DD.\\n\" +\n\t\t\t\t\t\"No hay valor por defecto a propósito: un borrado que se decide solo no es una política de retención.\",\n\t\t\t);\n\t\t\tprocess.exitCode = 1;\n\t\t\treturn true;\n\t\t}\n\t\tlet corte: Date;\n\t\tif (iAntes >= 0) {\n\t\t\tcorte = new Date(`${args[iAntes + 1]}T00:00:00Z`);\n\t\t\tif (Number.isNaN(corte.getTime())) {\n\t\t\t\tconsole.error(`--antes-de necesita una fecha AAAA-MM-DD (recibido: ${args[iAntes + 1] ?? \"nada\"}).`);\n\t\t\t\tprocess.exitCode = 1;\n\t\t\t\treturn true;\n\t\t\t}\n\t\t} else {\n\t\t\tconst dias = Number(args[iDias + 1]);\n\t\t\tif (!Number.isFinite(dias) || dias < 0) {\n\t\t\t\tconsole.error(`--dias necesita un número de días (recibido: ${args[iDias + 1] ?? \"nada\"}).`);\n\t\t\t\tprocess.exitCode = 1;\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\tcorte = new Date(Date.now() - dias * 86_400_000);\n\t\t}\n\n\t\tconst iPol = args.indexOf(\"--politica\");\n\t\tconst politica = iPol >= 0 ? args[iPol + 1] : undefined;\n\t\tif (!politica) {\n\t\t\t// La política no es decoración: es lo que convierte el borrado en un\n\t\t\t// hecho justificable delante de un auditor. Sin ella, la lápida diría\n\t\t\t// «se purgó» y no «se purgó porque».\n\t\t\tconsole.error(\n\t\t\t\t'Falta --politica \"texto\": bajo qué regla se purga (p. ej. \"retención 90 días, art. 5.1.e RGPD\").\\n' +\n\t\t\t\t\t\"Queda escrito en el libro, que es lo que hace la purga defendible.\",\n\t\t\t);\n\t\t\tprocess.exitCode = 1;\n\t\t\treturn true;\n\t\t}\n\n\t\tconst seco = args.includes(\"--dry-run\") || args.includes(\"--simular\");\n\t\tconst { purgarAntesDe } = await import(\"../core/audit/retencion.ts\");\n\t\tconst r = await purgarAntesDe(libro, agentDir, corte, politica, seco);\n\t\tconsole.log(\n\t\t\t`${seco ? \"Se purgarían\" : \"Purgados\"} ${r.purgados.length} fichero(s) anteriores a ${corte.toISOString().slice(0, 10)}.`,\n\t\t);\n\t\tfor (const l of r.purgados) {\n\t\t\tconsole.log(`  ${l.fichero}  ${l.entradas} entrada(s)  ${l.desde.slice(0, 10)} → ${l.hasta.slice(0, 10)}`);\n\t\t}\n\t\tfor (const c of r.conservados) console.log(`  (conservado) ${c.fichero}: ${c.porque}`);\n\t\tif (seco) {\n\t\t\tconsole.log(\"\\nSimulación: no se ha tocado nada. Repite sin --dry-run para purgar.\");\n\t\t\treturn true;\n\t\t}\n\t\tif (r.purgados.length > 0) {\n\t\t\tconsole.log(\n\t\t\t\t`\\nCada purga ha quedado anotada en el libro bajo la política \"${politica}\".` +\n\t\t\t\t\t\"\\n`audit verify` las cuenta como huecos EXPLICADOS, no como manipulación.\",\n\t\t\t);\n\t\t}\n\t\treturn true;\n\t}\n\n\tconsole.error(`Subcomando desconocido: ${sub}\\n`);\n\tconsole.log(AYUDA);\n\tprocess.exitCode = 1;\n\treturn true;\n}\n"]}