@holmes-lab/holmes-kit 0.1.18 → 0.2.1

package/dist/holmes/cli/init.js

@@ -46,6 +46,7 @@ const playbook_skills_1 = require("./playbook-skills");
 const agents_1 = require("./agents");
 const roles_readme_1 = require("./roles-readme");
 const mcp_launcher_1 = require("./mcp-launcher");
+const codex_toml_1 = require("./codex-toml");
 const pre_tool_use_1 = require("../hooks/pre-tool-use");
 const governed_precondition_1 = require("./governed-precondition");
 const risk_gate_1 = require("../guardrail/risk-gate");
@@ -269,6 +270,13 @@ function runInit(opts) {
         if ((0, gitignore_merge_1.hasGitignoreBlock)(gitignoreBefore)) {
             changes.push({ path: gitignorePath, before: gitignoreBefore, after: (0, gitignore_merge_1.removeGitignoreBlock)(gitignoreBefore) });
         }
+        // @implements A-SPEC-256.1 — remove is install's mirror: the union-attributes block this init
+        // wrote leaves with it (round-1 adversarial finding: it stayed behind forever).
+        const rmAttrsPath = path.join(opts.target, '.gitattributes');
+        const rmAttrsBefore = fs.existsSync(rmAttrsPath) ? fs.readFileSync(rmAttrsPath, 'utf8') : '';
+        if ((0, gitignore_merge_1.hasGitignoreBlock)(rmAttrsBefore)) {
+            changes.push({ path: rmAttrsPath, before: rmAttrsBefore, after: (0, gitignore_merge_1.removeGitignoreBlock)(rmAttrsBefore) });
+        }
         // round-7: the past tense fired under --dry-run too, so 'Removed' announced a removal that
         // had not happened — the one spelling whose entire purpose is to write nothing.
         messages.push(opts.dryRun
@@ -319,6 +327,13 @@ function runInit(opts) {
         const gitignoreAfter = (0, gitignore_merge_1.mergeGitignore)(gitignoreBefore);
         if (gitignoreAfter !== gitignoreBefore)
             changes.push({ path: gitignorePath, before: gitignoreBefore || null, after: gitignoreAfter });
+        // @implements A-SPEC-256.1 — the append-only files merge with union in every governed project,
+        // not only this repository: a colleague's merge losing ledger lines is the disease.
+        const gitattributesPath = path.join(opts.target, '.gitattributes');
+        const gitattributesBefore = fs.existsSync(gitattributesPath) ? fs.readFileSync(gitattributesPath, 'utf8') : '';
+        const gitattributesAfter = (0, gitignore_merge_1.mergeGitattributes)(gitattributesBefore);
+        if (gitattributesAfter !== gitattributesBefore)
+            changes.push({ path: gitattributesPath, before: gitattributesBefore || null, after: gitattributesAfter });
         messages.push(`mode=${opts.mode} matcher=${matcher} specs=${opts.specsDir}`);
         if (opts.mode === 'guardrail') {
             messages.push('Guardrail mode: nothing is blocked on a spec-less project; only genuinely dangerous shell commands are gated.');
@@ -329,6 +344,71 @@ function runInit(opts) {
         }
         messages.push('Restart Claude Code — hooks and MCP servers are read at session start.');
     }
+    // @implements A-SPEC-266 — Codex reads MCP servers from `.codex/config.toml` (TOML
+    // `[mcp_servers.*]`), NOT the `.codex/mcp_config.json` (JSON) this project used to write and Codex
+    // never loaded. That file also holds the user's other Codex settings, so — like `.mcp.json` — we
+    // MERGE only our table. The obsolete JSON is migrated away so no dead wiring is left behind.
+    let codexJsonToMigrate = null; // deleted only after the write loop confirms config.toml
+    {
+        const codexDir = path.join(opts.target, '.codex');
+        const codexTomlPath = path.join(codexDir, 'config.toml');
+        const codexJsonPath = path.join(codexDir, 'mcp_config.json');
+        // A `.codex/config.toml` we cannot read (a directory, a permission wall, a dangling symlink) is
+        // NOT touched — reading it eagerly with readFileSync threw and crashed the whole init. Mirror the
+        // `.mcp.json` "refusing to touch it" discipline: skip codex wiring and say so, migrate nothing.
+        let codexTomlBefore = null;
+        let codexUnreadable = false;
+        if (fs.existsSync(codexTomlPath)) {
+            try {
+                codexTomlBefore = fs.readFileSync(codexTomlPath, 'utf8');
+            }
+            catch {
+                codexUnreadable = true;
+            }
+        }
+        const wantsCodex = (opts.agents ?? []).includes('codex') && !codexUnreadable;
+        if (codexUnreadable)
+            messages.push(`Refusing to touch ${codexTomlPath} — it is not a readable file. Fix or remove it, then re-run.`);
+        // @implements A-SPEC-266 (round-2 F3) — the obsolete JSON is deleted AFTER the config.toml write is
+        // confirmed, never before: an eager delete followed by a failed toml write left the user with NO
+        // codex wiring at all (and a message claiming nothing was lost). Here we only PLAN the migration;
+        // the deletion runs post-write-loop (dry-run just previews it in `removals`).
+        const migrateAwayCodexJson = () => {
+            if (!fs.existsSync(codexJsonPath))
+                return;
+            if (opts.dryRun) {
+                removals.push(codexJsonPath);
+                return;
+            }
+            codexJsonToMigrate = codexJsonPath;
+        };
+        if (opts.remove) {
+            if (codexTomlBefore !== null) {
+                const after = (0, codex_toml_1.removeCodexToml)(codexTomlBefore);
+                if (after.trim() === '' && after !== codexTomlBefore) {
+                    // Our table was the only content — delete the file rather than leave it empty.
+                    if (opts.dryRun)
+                        removals.push(codexTomlPath);
+                    else if (fs.existsSync(codexTomlPath)) {
+                        fs.rmSync(codexTomlPath, { force: true });
+                        messages.push(`Removed ${codexTomlPath} (holmes-kit MCP table was its only content).`);
+                    }
+                }
+                else if (after !== codexTomlBefore) {
+                    changes.push({ path: codexTomlPath, before: codexTomlBefore, after });
+                }
+            }
+            migrateAwayCodexJson();
+        }
+        else if (wantsCodex && opts.mcp) {
+            const mcpBin = path.join(opts.packageRoot, 'bin', 'holmes-mcp.js');
+            const entry = (0, mcp_launcher_1.mcpEntryForInstall)({ packageRoot: opts.packageRoot, mcpBinPath: mcpBin, flag: opts.mcpLauncher });
+            const after = (0, codex_toml_1.mergeCodexToml)(codexTomlBefore, (0, codex_toml_1.codexMcpBlock)(entry, opts.specsDir));
+            if (after !== codexTomlBefore)
+                changes.push({ path: codexTomlPath, before: codexTomlBefore, after });
+            migrateAwayCodexJson();
+        }
+    }
     if (opts.dryRun) {
         // @implements A-SPEC-190 (round 8) — dry-run must plan the SAME set the real run touches, and
         // must not print a deletion under the verb 'would write'. Round-7 planned installs only from
@@ -408,6 +488,18 @@ function runInit(opts) {
                     ] };
             }
         }
+        // @implements A-SPEC-266 (round-2 F3) — the config.toml write above is confirmed now, so it is
+        // safe to remove the obsolete JSON. Doing it earlier risked deleting codex's only wiring and then
+        // failing the toml write.
+        if (codexJsonToMigrate !== null && fs.existsSync(codexJsonToMigrate)) {
+            try {
+                fs.rmSync(codexJsonToMigrate, { force: true });
+                messages.push(`Removed obsolete ${codexJsonToMigrate} (Codex never read it — MCP wiring now lives in config.toml).`);
+            }
+            catch (e) {
+                messages.push(`Could not remove obsolete ${codexJsonToMigrate}: ${e instanceof Error ? e.message : String(e)}`);
+            }
+        }
         if (!opts.remove && opts.mode === 'governed') {
             for (const d of SPEC_SUBDIRS)
                 fs.mkdirSync(path.join(opts.target, opts.specsDir, d), { recursive: true });

package/dist/holmes/cli/interactive-prompt.js

@@ -52,12 +52,12 @@ function parseAgentList(input) {
 /**
  * Renders an interactive TTY checkbox selection menu using standard readline & ANSI codes.
  */
-async function promptAgentSelection(availableAgents = agents_1.AGENTS, currentWired = ['claude']) {
+async function promptAgentSelection(availableAgents = agents_1.AGENTS, currentWired = [...agents_1.AGENTS]) {
     if (!process.stdin.isTTY || !process.stdout.isTTY) {
-        return ['claude', 'antigravity']; // Fallback for non-TTY
+        return [...availableAgents]; // Fallback for non-TTY — default to all harnesses
     }
     return new Promise((resolve) => {
-        const selected = new Set(currentWired.length ? currentWired : ['claude', 'antigravity']);
+        const selected = new Set(currentWired.length ? currentWired : [...availableAgents]);
         let cursor = 0;
         const items = [...availableAgents, 'all'];
         const rl = readline.createInterface({
@@ -91,7 +91,7 @@ async function promptAgentSelection(availableAgents = agents_1.AGENTS, currentWi
                 }
                 else if (item === 'codex') {
                     isChecked = selected.has('codex');
-                    label = '💻 Codex CLI            (.codex/mcp_config.json)';
+                    label = '💻 Codex CLI            (.codex/config.toml)';
                 }
                 const box = isChecked ? '[X]' : '[ ]';
                 const line = `${prefix}${box} ${label}\n`;

package/dist/holmes/cli/mcp-launcher.d.ts

@@ -1,8 +1,8 @@
 /**
  * MCP 서버 배선의 launch 방식을 한 곳에서 계산한다.
  *
- * 왜 한 곳인가: `.mcp.json`(Claude)·`.agents/mcp_config.json`(antigravity)·`.codex/mcp_config.json`
- * 세 배선이 같은 서버를 띄운다. 셋이 각자 command/args 를 지으면 하나가 npx 로 옮겨갈 때 나머지가
+ * 왜 한 곳인가: `.mcp.json`(Claude)·`.agents/mcp_config.json`(antigravity)·`.codex/config.toml`
+ * (codex, TOML `[mcp_servers.holmes-kit]` — A-SPEC-266) 세 배선이 같은 서버를 띄운다. 셋이 각자 command/args 를 지으면 하나가 npx 로 옮겨갈 때 나머지가
  * 절대경로에 남아 어긋난다 — 그 드리프트가 REQ-251 자체의 출발점이었다.
  *
  * 왜 두 모드인가: 최종 사용자는 npm 설치본에서 init 하므로 `npx ...@<정확한버전> holmes-mcp` 가

package/dist/holmes/cli/screen-safe.d.ts

@@ -0,0 +1,94 @@
+/**
+ * One terminal row's worth of SUBJECT, with the template's own cells already subtracted: an 80
+ * column row, minus the widest template prefix on this screen (`\u2713 \uc2b9\uc778 \u2014 `, nine columns)
+ * and the kind cell (16) and its space, leaves 52. Every line the decision surface prints is bounded by it, so a queue of any size stays a
+ * screen the operator can read top to bottom — the property the batch confirmation depends on
+ * (round-5: the field was bounded and the LINE was not, so a bounded field still wrapped).
+ */
+/** The terminal this screen promises to fit. The floor no terminal goes below. */
+export declare const ROW_MAX = 80;
+export declare const ROW_COLS = 50;
+/**
+ * The `kind` cell. Round-7: at 16 the truncation NOTICE (`… (200자 잘림)`, fifteen columns) consumed
+ * the entire budget, so a non-ASCII kind rendered ZERO columns of the operator's text — the category
+ * of authority being granted, unreadable, in the list AND the item header AND the confirmation AND
+ * every decision echo. That is the round-5 lesson ("a bound met by showing nothing is the
+ * concealment this module exists to prevent") reached through a budget nobody re-checked. Twenty
+ * columns plus the short notice form below leaves real text on the line.
+ */
+export declare const KIND_COLS = 20;
+/**
+ * Did rendering this value into `max` columns hide any of it?
+ *
+ * Round-8: this used to be a REGEX OVER THE RENDERED TEXT, and the data can end with any string it
+ * likes — a target ending `… (5자 잘림)` was reported as clipped when nothing had been clipped, so
+ * `[A]` refused to batch it and told the operator, falsely, that it did not fit on a row. An agent
+ * could disable batch approval for a whole session by choosing its own suffix. The renderer knows
+ * the answer; nobody should have to parse it back out of the output.
+ */
+export declare function isClipped(value: string, max?: number): boolean;
+/**
+ * How many terminal COLUMNS a string occupies. Round-5 measured why a code-point budget is not a
+ * screen budget: a 200-code-point line of markers rendered 302 columns — four wrapped rows at 80 —
+ * because `⟪`, `⟫` and every Hangul character in `자 제거` are East Asian WIDE (two columns each).
+ * The budget exists to bound SCREEN SPACE, so it must be counted in the unit the screen uses.
+ */
+export declare function displayWidth(s: string): number;
+/**
+ * One line, no control bytes, bounded in terminal COLUMNS — for a field the template puts on a line
+ * of its own. `max` is a column budget, not a character count (round-5): the caller is buying screen
+ * space, and on this screen a character can cost one column or two.
+ *
+ * The budget is spent on the OPERATOR'S text: the source is clipped first so escape spam cannot
+ * evict the real command (round-3), and the sanitised result is clipped again so markers cannot
+ * inflate the output (round-4). The truncation notice is appended AFTER sanitising, so no sequence
+ * sitting at the clip boundary can swallow it (round-4).
+ */
+export declare function flattenField(s: string, max?: number): string;
+/**
+ * @implements A-SPEC-262.1 §13
+ * The form agent-controlled text takes on a DECISION ROW: only characters whose width is fixed by
+ * the standard, everything else as an ASCII escape.
+ *
+ * Eight adversarial rounds found the same shape of defect eight times — a character whose width the
+ * code guessed (Ambiguous, combining, zero-width), or whose cursor effect it did not model (TAB,
+ * ESC), or whose position let the data choose a line boundary (alignment, folding). None of them can
+ * occur here, because none of those characters survive to the row: a control byte is not stripped
+ * and counted, it is SHOWN as `\u001b`. Nothing is removed, so nothing is hidden — which also
+ * retires the removal marker, its forgery guard and its size accounting from this path entirely.
+ *
+ * What passes through: printable ASCII (one column each) and East_Asian_Width W or F (two columns
+ * each, fixed by the standard). Korean and CJK commands therefore stay readable on the screen the
+ * operator decides from — the requirement that made this a hybrid rather than a full escaping.
+ * A backslash is doubled first, so data can never spell an escape the renderer did not write.
+ */
+export declare function rowLiteral(s: string): string;
+/**
+ * @implements A-SPEC-262.1 §13
+ * A decision row's field: the row literal, cut to `max` columns, with what it could not show stated.
+ */
+export declare function rowField(value: string, max?: number): string;
+export declare function wrapColumns(s: string, cols?: number, indent?: string): string;
+export declare function stripControl(s: string): string;
+/**
+ * Clip on a CODE POINT boundary. Round-1: slicing UTF-16 units cut a surrogate pair in half and the
+ * last visible character of a clipped command rendered as a replacement glyph — on a screen whose
+ * whole job is showing the subject verbatim.
+ */
+export declare function clipCodePoints(s: string, max: number): string;
+/**
+ * Quote a value that is about to appear inside a COPY-PASTEABLE command line.
+ *
+ * Round-2: the non-TTY hint (A-SPEC-260) fills the real queue id into three `holmes-kit approve …`
+ * lines whose whole purpose is being pasted into a shell — and the id is agent-controlled. Flattening
+ * stops it forging lines, but a flattened `… | sh` still PIPES when pasted. POSIX single quotes make
+ * any byte inert; a literal quote is closed, escaped and reopened.
+ */
+export declare function shellQuote(s: string): string;
+/**
+ * A reference for a pasteable command line: left ALONE when it is already inert (the shape a real
+ * queue id has), quoted only when it is not. Round-2 wanted every pasted byte harmless; quoting
+ * unconditionally would also have rewritten the A-SPEC-260 hint that ships today, so the blast
+ * radius is kept to the case that needs it — a normal session's screen is byte-for-byte unchanged.
+ */
+export declare function safeRef(s: string): string;