@hybridlabor-api/aos 4.6.6 → 4.7.0

package/.claude/workflows/startcycle-dispatch.mjs

@@ -92,6 +92,27 @@ if (!fs && typeof process !== 'undefined') {
   } catch {}
 }
 
+function readStdinSync() {
+  const chunks = [];
+  const buffer = Buffer.alloc(64 * 1024);
+  const sleeper = new Int32Array(new SharedArrayBuffer(4));
+  for (;;) {
+    let bytes;
+    try {
+      bytes = fs.readSync(0, buffer, 0, buffer.length, null);
+    } catch (error) {
+      if (error?.code === 'EAGAIN' || error?.code === 'EWOULDBLOCK') {
+        Atomics.wait(sleeper, 0, 0, 2);
+        continue;
+      }
+      throw error;
+    }
+    if (bytes === 0) break;
+    chunks.push(Buffer.from(buffer.subarray(0, bytes)));
+  }
+  return Buffer.concat(chunks).toString('utf8');
+}
+
 let inputGoal = null;
 let inputSkills = [];
 let isHookInvocation = false;
@@ -100,7 +121,7 @@ let isHookInvocation = false;
 if (typeof process !== 'undefined' && process.stdin && !process.stdin.isTTY && fs) {
   try {
     let stdinRaw = '';
-    try { stdinRaw = fs.readFileSync(0, 'utf8').trim(); } catch {}
+    try { stdinRaw = readStdinSync().trim(); } catch {}
     if (stdinRaw) {
       isHookInvocation = true;
       let payload = null;
@@ -818,6 +839,13 @@ if (BUILD_NODES.length === 0) {
 const NODE_ENUM = BUILD_NODES.map((n) => n.id);
 const NODE_NAMES = humanList(NODE_ENUM);
 
+// Live map (agenttrail skill, Trigger B): best-effort, never blocks or fails the run.
+// aos-trail exits on its own when a map for this repo is already running.
+try {
+  child_process?.spawn('aos-trail', [process.cwd(), '--plan', 'production_artifacts/00_execution_plan.md', '--no-open'],
+    { detached: true, stdio: 'ignore', shell: process.platform === 'win32' }).on('error', () => {}).unref();
+} catch { /* no child_process in this runtime: run without the map */ }
+
 let findings = [];
 let reviewedClean = false;
 let nodesToRun = BUILD_NODES; // first pass: everyone applicable

package/.opencode/agents/architect.md

@@ -10,3 +10,7 @@ Turns the user's goal (or `/bdbrainstorm` / `/grill-me` output) into a system pl
 **MCP servers used:** openwiki-skill, memb_mcp
 
 **Output artifact(s):** `production_artifacts/00_execution_plan.md`
+
+- The plan uses the agenttrail component convention (`## Name {#id}`, `needs:`, `files:`, tasks `- [ ] ... {#id}`).
+- The Architect renders the architecture with `aos-archify` to `production_artifacts/00_architecture.html` and links it from the relevant component with a `url:` line.
+- Plan-canvas can review that HTML too.

package/.opencode/plugins/bdb-aos.js

@@ -7,6 +7,8 @@
  *    unless the user explicitly authorized it with the literal word "GO".
  * 2. chat.message: Ambient memory injection (memB). Injects relevant project & user
  *    memories as ephemeral context from ~/.MemBDB/memb.db via node:sqlite.
+ * 3. tool.execute.before/after: Best-effort live-map telemetry for the AOS
+ *    agenttrail daemon (PreToolUse/PostToolUse, fire-and-forget).
  *
  * Zero external runtime dependencies. Fails open on memory lookup, fails closed
  * on unguarded destructive actions.
@@ -35,6 +37,50 @@ function verifyGoAuthorized(lastPrompt) {
   return trimmed.toUpperCase() === 'GO';
 }
 
+// Best-effort fire-and-forget telemetry for the AOS live map (agenttrail daemon).
+// 300 ms timeout per request, all errors swallowed, never throws. Self-contained
+// on purpose: the plugin must not import from mcps/.
+const pendingArgs = new Map();
+
+async function postTrail(event) {
+  const body = JSON.stringify(event);
+  const ports = process.env.AGENTTRAIL_PORT
+    ? [Number(process.env.AGENTTRAIL_PORT)]
+    : Array.from({ length: 15 }, (_, i) => 5330 + i);
+  await Promise.allSettled(
+    ports.map((port) =>
+      fetch(`http://127.0.0.1:${port}/hook`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body,
+        signal: AbortSignal.timeout(300),
+      }).catch(() => {})
+    )
+  );
+}
+
+function mapTrailToolName(name) {
+  const lower = (name || '').toLowerCase();
+  if (lower === 'edit') return 'Edit';
+  if (lower === 'write') return 'Write';
+  if (lower === 'bash') return 'Bash';
+  if (lower === 'read') return 'Read';
+  return lower ? lower.charAt(0).toUpperCase() + lower.slice(1) : '';
+}
+
+function mapTrailToolInput(args, directory) {
+  const mapped = {};
+  if (args && typeof args === 'object') {
+    if (typeof args.filePath === 'string' && args.filePath) {
+      mapped.file_path = path.resolve(directory, args.filePath);
+    }
+    if (typeof args.command === 'string') {
+      mapped.command = args.command;
+    }
+  }
+  return mapped;
+}
+
 // Extract ambient memory from local memB database
 async function getMembContext(prompt, currentDir) {
   const home = os.homedir();
@@ -133,6 +179,20 @@ export default async function bdbAosPlugin(input) {
     },
 
     'tool.execute.before': async (toolInput, toolOutput) => {
+      // Live-map telemetry first; must never affect the go-gate logic below.
+      try {
+        const tool_name = mapTrailToolName(toolInput.tool);
+        const tool_input = mapTrailToolInput(toolOutput?.args, directory);
+        pendingArgs.set(toolInput.callID, tool_input);
+        postTrail({
+          hook_event_name: 'PreToolUse',
+          session_id: toolInput.sessionID,
+          cwd: directory,
+          agent: 'opencode',
+          tool_name,
+          tool_input,
+        });
+      } catch {}
       const toolName = (toolInput.tool || '').toLowerCase();
       // Intercept bash, terminal, or command execution tools
       if (toolName === 'bash' || toolName === 'terminal' || toolName === 'shell' || toolName === 'exec' || toolName === 'run_command') {
@@ -167,5 +227,20 @@ export default async function bdbAosPlugin(input) {
         }
       }
     },
+
+    'tool.execute.after': async (toolInput) => {
+      try {
+        const tool_input = pendingArgs.get(toolInput.callID);
+        pendingArgs.delete(toolInput.callID);
+        postTrail({
+          hook_event_name: 'PostToolUse',
+          session_id: toolInput.sessionID,
+          cwd: directory,
+          agent: 'opencode',
+          tool_name: mapTrailToolName(toolInput.tool),
+          tool_input,
+        });
+      } catch {}
+    },
   };
 }

package/THIRD_PARTY_NOTICES.md

@@ -231,6 +231,54 @@ redistributable.
 | `CloudAI-X/threejs-skills` | No `LICENSE` file; README claims MIT. | `threejs-skills` |
 | `Shpigford/skills` | Repository returns **404** — deleted, renamed, or made private. Provenance cannot be verified at all. | `readme` |
 
+## tt-a1i/archify
+
+<https://github.com/tt-a1i/archify> — MIT. Copyright (c) 2026 tt-a1i (Archify),
+Copyright (c) 2025 Cocoon AI (based on Cocoon-AI/architecture-diagram-generator, MIT).
+
+`skills/global_config/archify/` is upstream `archify/` at commit `9e35d2b`,
+without `test/`, rendered example HTML, and the remote update check
+(`scripts/check-update.mjs`, `scripts/update-contract.mjs`); AOS pins the version.
+The skill's own `LICENSE` and `THIRD_PARTY_NOTICES.md` ship alongside it.
+
+---
+
+## sodiumsun/agenttrail
+
+<https://github.com/sodiumsun/agenttrail> — MIT.
+
+`skills/global_config/agenttrail/` carries the Map runtime only
+(`bin/agenttrail.mjs`, `public/index.html`) at commit `e4ba2da`, with its
+`LICENSE`. Kitchen is not included. Four patches, each marked `// AOS patch:`:
+a `--plan <path>` flag, a `hook --agent <name>` flag, serving files under
+`production_artifacts/` so a card's relative `url:` opens, and AOS wording in
+the page when `--plan` is set (real plan path, no upstream init/backfill hints).
+
+---
+
+## duriantaco/skylos
+
+<https://github.com/duriantaco/skylos> — Apache-2.0. Copyright duriantaco.
+
+Tracked in `.agents/vendor-manifest.json` at pinned commit
+`0c95b002424453983d5c96708cf7865939745d98`. Diff-based AST and static security
+analyzer feeding the shipping gate, for `bdb-security-audit` and
+`godmode-shipping`.
+
+---
+
+## SnailSploit/claude-red
+
+<https://github.com/SnailSploit/claude-red> — MIT.
+Copyright (c) 2024-2025 SnailSploit / Kai Aizen.
+
+Tracked in `.agents/vendor-manifest.json` at pinned commit
+`739512a8588b28ff3b554e669391c22508602878`. Defensive audit heuristics and
+vulnerability checklists for `bdb-security-audit` and `security-reviewer`;
+the upstream offensive exploit content is stripped and not carried over.
+
+---
+
 ## Note on `mcps/`
 
 Sub-repositories vendored under `mcps/` carry their own `LICENSE` files in

package/bin/aos-uninstall.mjs

@@ -39,6 +39,8 @@ const DATA_PATHS = [
   { path: h('.synapse'), what: 'Synapse logs and reports' },
   { path: h('.memb'), what: 'memB WebUI logs' },
   { path: h('.ao'), what: 'AO Orchestrator logs' },
+  { path: h('.cache', 'deja'), what: 'deja-vu Index — alle indizierten Agenten-Sessions' },
+  { path: h('.config', 'deja'), what: 'deja-vu Privacy-Config — Ausschlussliste und Tombstones' },
 ];
 
 const AGENTS = [
@@ -181,6 +183,58 @@ function execute(p) {
   for (const m of modules) { try { rmSync(m, { recursive: true, force: true }); } catch { /* in use */ } }
   if (modules.length) console.log(`  ${modules.length} Module entfernt`);
 
+  try {
+    execFileSync('npm', ['uninstall', '-g', '@vshulcz/deja-vu'], { stdio: 'ignore', shell: process.platform === 'win32' });
+    console.log('  deja-vu (npm) entfernt');
+  } catch {
+    console.log('  deja-vu nicht per npm entfernt — von Hand entfernen: npm uninstall -g @vshulcz/deja-vu');
+  }
+
+  const dejaMcpJson = [
+    h('.gemini', 'config', 'mcp_config.json'),
+    process.platform === 'win32'
+      ? path.join(process.env.APPDATA || HOME, 'Claude', 'claude_desktop_config.json')
+      : h('Library', 'Application Support', 'Claude', 'claude_desktop_config.json'),
+    h('.claude.json'),
+    h('.cursor', 'mcp.json'),
+    h('.roo', 'mcp_settings.json'),
+    h('.cline', 'mcp_settings.json'),
+    h('.windsurf', 'mcp.json'),
+    h('.aider', 'mcp.json'),
+  ];
+  for (const f of dejaMcpJson.filter(existsSync)) {
+    try {
+      const cfg = JSON.parse(readFileSync(f, 'utf8'));
+      if (cfg.mcpServers && cfg.mcpServers.deja) {
+        delete cfg.mcpServers.deja;
+        writeFileSync(f, JSON.stringify(cfg, null, 2) + '\n');
+        console.log(`  deja-Eintrag aus ${tilde(f)} entfernt`);
+      }
+    } catch { console.log(`  ${tilde(f)} nicht lesbar — von Hand prüfen`); }
+  }
+
+  const opencodeCfg = h('.config', 'opencode', 'opencode.jsonc');
+  if (existsSync(opencodeCfg) && /"deja"\s*:/.test(readFileSync(opencodeCfg, 'utf8'))) {
+    console.log(`  ${tilde(opencodeCfg)} enthält noch einen deja-Eintrag — von Hand entfernen (JSONC, wird nicht automatisch umgeschrieben)`);
+  }
+
+  const codexToml = h('.codex', 'config.toml');
+  if (existsSync(codexToml)) {
+    try {
+      const raw = readFileSync(codexToml, 'utf8');
+      const eol = raw.includes('\r\n') ? '\r\n' : '\n';
+      const lines = raw.split(/\r?\n/);
+      const i = lines.findIndex((l) => l.trim() === '[mcp_servers.deja]');
+      if (i !== -1) {
+        let j = i + 1;
+        while (j < lines.length && !lines[j].trimStart().startsWith('[') && lines[j].trim() !== '# AOS:MCP:END') j++;
+        lines.splice(i, j - i);
+        writeFileSync(codexToml, lines.join(eol));
+        console.log(`  deja-Tabelle aus ${tilde(codexToml)} entfernt`);
+      }
+    } catch { console.log(`  ${tilde(codexToml)} nicht lesbar — von Hand prüfen`); }
+  }
+
   for (const l of legacy) { try { rmSync(l); } catch { /* already gone */ } }
   if (legacy.length) console.log(`  ${legacy.length} Installations-Marker entfernt`);
 
@@ -190,7 +244,7 @@ function execute(p) {
   if (existsSync(settings)) {
     try {
       const s = JSON.parse(readFileSync(settings, 'utf8'));
-      const bdb = ['go-gate.mjs', 'graph-gate.mjs', 'memb-inject.mjs'];
+      const bdb = ['go-gate.mjs', 'graph-gate.mjs', 'memb-inject.mjs', 'trail-relay.mjs'];
       let touched = false;
       for (const [event, entries] of Object.entries(s.hooks || {})) {
         const kept = entries.filter((e) => !(e.hooks || []).some((x) => bdb.some((n) => String(x.command).includes(n))));

package/docs/handover/agenttrail-for-ao.md

@@ -0,0 +1,58 @@
+# agenttrail for AO — waiting questions & GO/Nein handover
+
+AO (the Go daemon shipped as `@hybridlabor-api/bdb-agent-orchestrator`, binary at `~/.local/bin/ao`) can mirror what the agenttrail live map shows: an agent that waits on the human appears as a question with GO / Nein, and AO surfaces "Needs you" in its own UI — then types the human's decision into the waiting session (approved_plan_go.md:25, :57). agenttrail is the live-map daemon vendored into AOS at `skills/global_config/agenttrail/bin/agenttrail.mjs`, run as `aos-trail`; one daemon per repo, bound to 127.0.0.1 only. This document lists the HTTP surfaces AO may call and the things it must never do. The ask/answer endpoints are the AOS patch defined in production_artifacts/00_execution_plan.md ({#ask-engine}, lines 8-13) and production_artifacts/approved_plan_go.md; `/whoami` and `/model` already exist in the vendored daemon (agenttrail.mjs:583-584, :674-675).
+
+## What AO calls
+
+### 1. Find the repo's daemon — `GET /whoami`
+
+Probe `http://127.0.0.1:5330` through `5344` and match `repoPath` against the repo AO is working in — the same pattern the daemon itself uses for boot dedup (agenttrail.mjs:733-741):
+
+```sh
+curl -s http://127.0.0.1:$p/whoami
+# {"project":"aos","port":5330,"repoPath":"/Users/tim/dev/bdb-dev/aos-wt-go"}
+```
+
+Stop at the first match. If no daemon answers there is nothing to mirror — do not spawn a daemon from AO; the asker's CLI already prints `start: aos-trail . --plan …` on stderr (00_execution_plan.md:5). The `AGENTTRAIL_PORT` env var pins a single port and wins over the probe range (agenttrail.mjs:91).
+
+### 2. Read open questions — `GET /model`, `GET /ask/<id>`, `GET /events`
+
+- `GET /model` carries `asks`: one object per question `{id, question, askedBy, askedAt, expiryAt, status: 'pending' | 'go' | 'deny', decidedAt, by, expired}`. Show every ask, oldest first (`askedAt` ascending — approved_plan_go.md:36).
+- `GET /ask/<id>` returns one ask plus the last 10 decisions — the "wer · wann · was" log (00_execution_plan.md:13).
+- `GET /events` is the SSE stream; activity ticks carry `asks` too (00_execution_plan.md:10), so AO can mirror live instead of polling.
+
+A pending question past `expiryAt` flips to `status: 'deny'` with `expired: true` — render it greyed out (abgelaufen), never as a live GO/Nein pair (00_execution_plan.md:52).
+
+### 3. Answer — `POST /answer`
+
+```sh
+curl -s -X POST http://127.0.0.1:$port/answer \
+  -H 'Content-Type: application/json' \
+  --data '{"id":"<ask-id>","decision":"go"}'   # or "deny"
+```
+
+- The `content-type` header must be exactly `application/json` — a missing or different header (`text/plain`, JSON with a charset suffix) is rejected (00_execution_plan.md:13).
+- The body `{id, decision}` is capped at 4 KB.
+- `origin`: browser callers always send it, and it must equal the daemon's own `http://localhost:<port>` or `http://127.0.0.1:<port>`; AO is a local non-browser caller and may omit the header entirely (00_execution_plan.md:51 — the curl above does). If AO sends an `origin`, it must be the daemon's own.
+- A valid answer sets the ask's status + `decidedAt` + `by: 'you'` and appends `{question, decision, by, at}` to the timestamped decision log; timeout denials land there too, as `by: 'timeout'` (00_execution_plan.md:13).
+- The daemon binds 127.0.0.1 only (agenttrail.mjs:700) and sets no `Access-Control-*` header and no `OPTIONS` handler anywhere in its route chain (agenttrail.mjs:572-689) — that absence is the CSRF protection for the map's browser buttons. AO must not ask for CORS to be relaxed.
+
+That is the whole surface: AO does not call the daemon's other mutating endpoints (`/spawn`, `/setup`, `/setup-board`, `/hook`) and never writes into the repo — the daemon itself never touches the repo; state lives under `~/.agenttrail` (agenttrail.mjs:307).
+
+## What the answer means
+
+`aos-trail ask "<question>"` blocks until the question is answered or expires and exits 0 on go, 1 on deny/timeout (00_execution_plan.md:5). The default deadline is 30 minutes, overridable per question via the asker's `--timeout <10s|30m|2h|N>`; expiry auto-denies and is logged like a human decision (00_execution_plan.md:52). Questions and the decision log persist across daemon restarts in `~/.agenttrail/<repo-hash>.json` (agenttrail.mjs:308).
+
+## Mirroring in AO's UI
+
+- Pending ask → a pinned "Needs you" card with the question, the asking agent (`askedBy`), elapsed time, and one GO and one Nein button.
+- AO answers `POST /answer` only after the human clicked or said the decision for that exact ask id, and only then may it type that decision into the waiting session (approved_plan_go.md:57 — AO already recognizes "Needs You GO" and can write to the terminal, :25).
+- Re-check `GET /ask/<id>` immediately before typing: the human may have answered on the map instead, or the question may have expired meanwhile.
+
+## Hard rules
+
+- The AO button never authorizes `git push`, `npm publish`, `npm version` or recursive `rm` (approved_plan_go.md:30). Those four stay under go-gate's sole authority (`.claude/hooks/go-gate.mjs:43-49`), which opens only for the literal, human-typed `GO` as the last message in the session transcript (go-gate.mjs:10-13, transcript-only check in main() :116-151). The ask/answer flow only resolves explicit `aos-trail ask` questions and never writes to any session transcript — the map and AO remain "an observer and an answer relay, never a permission system" (00_execution_plan.md:50, approved_plan_go.md:49).
+- Never answer without the human. No batching, no defaults, no "the agent seemed sure" — one answer per explicit human decision, per question id.
+- Never auto-retry a timed-out question. Expiry → deny is final (`by: 'timeout'` in the log); only the human asking again starts a new question (approved_plan_go.md:57; the same "no silent retries / a fresh GO per action" rule the gate runs on, go-gate.mjs:13).
+- Never read `~/.agenttrail/<repo-hash>.json` or anything else inside `~/.agenttrail/` directly (agenttrail.mjs:307-308). Those files are internal state with no format contract — use the HTTP surfaces above.
+- Keep the CSRF contract intact: exact `Content-Type: application/json`, own-or-absent `origin`, and never relay an answer through web content the agent loaded.

package/docs/handover/deja-for-ao.md

@@ -0,0 +1,51 @@
+# deja for AO — session-memory handover
+
+AO (the Go daemon shipped as `@hybridlabor-api/bdb-agent-orchestrator`, binary at `~/.local/bin/ao`) can ask deja — the local session-memory engine installed together with memB by the AOS installer — for project history. This document lists the surfaces AO may call and the two things it must not do. Every command below is verified against deja-vu 0.21.1.
+
+## What AO calls at session start
+
+Run in the project directory:
+
+```sh
+deja wip --json
+```
+
+The answer is what the last session in that directory was doing (deja-vu docs/json-output.md:1192-1223):
+
+```json
+{
+  "schema_version": 2,
+  "session": "ses_fb76fff…",
+  "harness": "opencode",
+  "asked": "the orders worker is exhausting its database connections under load",
+  "decision": "bound every orders-worker query with a context",
+  "files": ["internal/worker/orders.go"],
+  "command": "go test ./internal/worker/...",
+  "command_failed": true,
+  "lines": ["working on: …", "settled: …"]
+}
+```
+
+- `schema_version: 2` is the only guaranteed field. Every other field is optional and omitted when the transcript does not carry it — treat all of them as nullable.
+- `lines` is the inject-verbatim form: one string per fact, in display order. A caller that wants to show the digest reads `lines` and does not re-assemble the fields.
+
+## Untrusted historical data
+
+Everything deja returns is transcript-derived and may carry text an attacker influenced: a directive copied from a web page persists in the index and replays into later sessions. deja-vu wraps its own agent-facing recall in `<deja-recall>` markers with an untrusted-data preamble (deja-vu docs/SECURITY-MODEL.md:235-245). AO must label or wrap the content the same way before it reaches a model, and instructions inside it must not be followed.
+
+## Other surfaces AO may use
+
+- `deja fix "<error>" --json` — what this machine ran after that error. Rows carry `command` or `edit`; `candidate: true` marks ran-next-but-unconfirmed evidence, not a guaranteed fix (deja-vu docs/json-output.md:763).
+- `deja last --json` — recent session metadata, never message bodies (deja-vu docs/json-output.md:200).
+- `deja handoff [id-prefix]` — the handoff digest for a session (deja-vu CLI reference, docs/guide/commands.html).
+- `deja blame <path> --json` — which sessions discussed a file; a top-level JSON array, no envelope (deja-vu docs/json-output.md:1107).
+- `deja doctor --json --offline` — index and store health; `--offline` keeps the version check off the network (deja-vu docs/json-output.md:356).
+
+## Stability contract
+
+Envelope-shaped answers carry `schema_version: 2`. Within a version, changes are additive only: existing field names, types and meanings stay the same. Bumping the version signals a breaking change, so branch on `schema_version` before parsing the rest of the envelope (deja-vu docs/json-output.md:7-28). `deja blame --json` returns a bare array and carries no version; its element shapes are stable.
+
+## Hard rules
+
+- Never read `~/.cache/deja/index.db` or anything else inside the index directory (`manifest.gob`, `sessions.gob`, `records.bin`, the buckets, the sidecars) directly. The format has moved forty-odd times and is explicitly not a contract (deja-vu docs/INTEGRATING.md:102-106). Use the CLI surfaces above.
+- AO must NOT run `deja install --auto` and must not wire session-start auto-recall. The approved AOS plan rules both out (production_artifacts/approved_plan_deja.md:61-66): a second writer into agent configs, and old history injected automatically at every session start, are exactly the injection vectors AOS installed deja to avoid. AO calls the `deja` CLI itself, on demand, in the project directory.