@iowarp/clio-coder 0.3.9 → 0.4.1

package/src/domains/resources/skills/promotion.ts

@@ -0,0 +1,214 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { safeResourceWrite } from "../../../core/safe-resource-write.js";
+import { clioConfigDir } from "../../../core/xdg.js";
+import type { MarketplaceSkill } from "./marketplace.js";
+
+/**
+ * Marketplace self-promotion: local detection that an uninstalled marketplace
+ * skill serves the operator's current request, plus the two policy pieces the
+ * offer flow needs — the persistent "never offer this skill" store and the
+ * own-marketplace source gate that bounds what a promotion-flow install may
+ * ever fetch.
+ *
+ * Detection is a pure lexical match against the local catalog: no model call,
+ * no network, and no request text ever leaves the process. False positives
+ * cost operator trust, so the matcher is deliberately conservative — a
+ * trigger-phrase hit or a strong distinctive-token overlap fires; anything
+ * weaker stays silent and the broad paths (the first-turn reminder,
+ * context(scope="skills")) remain the fallback.
+ */
+
+export interface PromotionMatch {
+	entry: MarketplaceSkill;
+	score: number;
+	/** The trigger phrase that fired, when the match came from one. */
+	matchedTrigger?: string;
+}
+
+const TOKEN_STOPWORDS = new Set([
+	"the",
+	"a",
+	"an",
+	"and",
+	"or",
+	"for",
+	"with",
+	"this",
+	"that",
+	"when",
+	"what",
+	"how",
+	"into",
+	"from",
+	"use",
+	"used",
+	"using",
+	"one",
+	"not",
+	"skill",
+	"skills",
+	"clio",
+	"please",
+	"can",
+	"you",
+	"should",
+	"would",
+	"about",
+	"need",
+	"want",
+	"help",
+	"make",
+	"file",
+	"files",
+	"code",
+]);
+
+function normalize(text: string): string {
+	return text
+		.toLowerCase()
+		.replace(/[^\p{L}\p{N}\s]/gu, " ")
+		.replace(/\s+/g, " ")
+		.trim();
+}
+
+/** Distinctive tokens: 4+ chars and outside the stopword set. */
+function distinctiveTokens(text: string): Set<string> {
+	return new Set(
+		normalize(text)
+			.split(" ")
+			.filter((token) => token.length >= 4 && !TOKEN_STOPWORDS.has(token)),
+	);
+}
+
+const TRIGGER_SCORE = 4;
+/** Distinct description/name token overlaps required to fire without a trigger. */
+const TOKEN_FIRE_THRESHOLD = 3;
+
+/**
+ * Score one marketplace entry against the operator's request text. A trigger
+ * phrase is a whole-phrase substring match on normalized text; token overlap
+ * is a fallback for skills whose triggers have not been authored yet.
+ */
+export function scorePromotionEntry(userText: string, entry: MarketplaceSkill): PromotionMatch | null {
+	const haystack = ` ${normalize(userText)} `;
+	if (haystack.trim().length === 0) return null;
+	for (const trigger of entry.triggers ?? []) {
+		const phrase = normalize(trigger);
+		if (phrase.length >= 4 && haystack.includes(` ${phrase} `)) {
+			return { entry, score: TRIGGER_SCORE, matchedTrigger: trigger };
+		}
+	}
+	const requestTokens = distinctiveTokens(userText);
+	if (requestTokens.size === 0) return null;
+	const entryTokens = distinctiveTokens(`${entry.name.replace(/-/g, " ")} ${entry.description}`);
+	let overlap = 0;
+	for (const token of requestTokens) if (entryTokens.has(token)) overlap += 1;
+	return overlap >= TOKEN_FIRE_THRESHOLD ? { entry, score: overlap } : null;
+}
+
+/**
+ * The uninstalled marketplace entries that match the request, best first.
+ * `excludedNames` carries installed skills plus every decline scope the
+ * caller tracks; the matcher itself is stateless.
+ */
+export function matchMarketplaceSkills(
+	userText: string,
+	entries: ReadonlyArray<MarketplaceSkill>,
+	excludedNames: ReadonlySet<string>,
+): PromotionMatch[] {
+	const matches: PromotionMatch[] = [];
+	for (const entry of entries) {
+		if (entry.kind !== "skill" || excludedNames.has(entry.name)) continue;
+		const match = scorePromotionEntry(userText, entry);
+		if (match) matches.push(match);
+	}
+	return matches.sort((a, b) => b.score - a.score || a.entry.name.localeCompare(b.entry.name));
+}
+
+/**
+ * The hard runtime gate on promotion-flow installs: only Clio's own
+ * marketplace is ever an acceptable source, whether the install runs on
+ * operator consent or autonomously at full-auto. A local path is the shipped
+ * package catalog (install copies files, no network); the one acceptable URL
+ * shape is this project's own repository tree. Public skill registries and
+ * arbitrary GitHub sources are rejected here, in code — a prompt instruction
+ * is not the enforcement mechanism.
+ *
+ * This gates the promotion flow only. Operator-driven installs through
+ * `clio-coder skills install <url>` keep their existing behavior.
+ */
+export const OWN_MARKETPLACE_URL_PREFIX = "https://github.com/iowarp/clio-coder/";
+
+export function isOwnMarketplaceSource(entry: Pick<MarketplaceSkill, "origin" | "sourceUrl">): boolean {
+	const source = entry.sourceUrl.trim();
+	if (/^(?:https?:\/\/|git@)/.test(source)) return source.startsWith(OWN_MARKETPLACE_URL_PREFIX);
+	// A non-URL source is a local filesystem path; only catalog discovery
+	// produces those, and it resolves them against the shipped package.
+	return entry.origin === "catalog" && path.isAbsolute(source);
+}
+
+export function assertPromotionInstallSource(entry: MarketplaceSkill): void {
+	if (isOwnMarketplaceSource(entry)) return;
+	throw new Error(
+		`skill promotion: refusing to install "${entry.name}" from ${entry.sourceUrl}; ` +
+			"promotion installs only from Clio's own marketplace (local catalog or " +
+			`${OWN_MARKETPLACE_URL_PREFIX}). Install manually with clio-coder skills install if intended.`,
+	);
+}
+
+/**
+ * Persistent "never offer this skill" store. Session-scoped declines live in
+ * the offer registration's memory and die with the session; this file holds
+ * only the explicit fourth option. It is a standalone JSON document in the
+ * config dir rather than a settings key because the settings-v2 manifest is
+ * owned elsewhere this sprint; the proposed key for a later migration is
+ * `skills.promotionDeclines`.
+ */
+export const PROMOTION_DECLINES_FILE = "skill-promotion-declines.json";
+
+export interface PromotionDeclineStore {
+	/** decline key (name@version) -> ISO timestamp of the operator's "never" answer. */
+	never: Record<string, string>;
+}
+
+/**
+ * The decline store key. A "never" answer is scoped to the catalog version the
+ * operator saw, so a later version of the same skill is offerable again while a
+ * re-published identical version stays declined. Absent version keys as
+ * `name@`, distinct from any real version, so it re-offers once a version
+ * appears.
+ */
+export function declineKey(name: string, version?: string): string {
+	return `${name}@${version ?? ""}`;
+}
+
+function declinesPath(configDir?: string): string {
+	return path.join(configDir ?? clioConfigDir(), PROMOTION_DECLINES_FILE);
+}
+
+export function readPromotionDeclines(configDir?: string): PromotionDeclineStore {
+	const file = declinesPath(configDir);
+	if (!existsSync(file)) return { never: {} };
+	try {
+		const parsed = JSON.parse(readFileSync(file, "utf8")) as unknown;
+		const never =
+			parsed && typeof parsed === "object" && !Array.isArray(parsed) ? (parsed as { never?: unknown }).never : undefined;
+		if (never && typeof never === "object" && !Array.isArray(never)) {
+			const entries = Object.entries(never as Record<string, unknown>).filter(
+				(pair): pair is [string, string] => typeof pair[1] === "string",
+			);
+			return { never: Object.fromEntries(entries) };
+		}
+	} catch {
+		// An unreadable store means no recorded declines; the worst outcome is
+		// one extra offer, which the operator can re-decline.
+	}
+	return { never: {} };
+}
+
+export function recordPromotionNeverDecline(name: string, version?: string, configDir?: string): void {
+	const store = readPromotionDeclines(configDir);
+	store.never[declineKey(name, version)] = new Date().toISOString();
+	safeResourceWrite(declinesPath(configDir), `${JSON.stringify(store, null, 2)}\n`, { encoding: "utf8" });
+}

package/src/domains/safety/action-classifier.ts

@@ -104,6 +104,12 @@ function baseClassify(tool: string): ActionClass | null {
 		// local mirror. Neither touches the workspace, so it is never gated
 		// behind a confirmation.
 		case ToolNames.Ledger:
+		// panes focuses, opens, and closes terminal panes Clio itself created, in
+		// a pane host that lives outside the workspace. Nothing it does writes a
+		// file, runs a model-supplied command (its schema exposes presets only),
+		// or survives the session, so it is reversible, local, and never gated
+		// behind a confirmation.
+		case ToolNames.Panes:
 			return "read";
 		case ToolNames.Write:
 		case ToolNames.Edit:

package/src/domains/safety/audit.ts

@@ -11,7 +11,7 @@ import type { SafetyPolicyDecision } from "./policy-engine.js";
  * rotation, and on a low-frequency background interval instead of once per
  * row, which kept blocking the admission hot path on disk latency. Write
  * errors never throw back to the caller because safety must not kill the hot
- * path; they are logged to stderr with a `[clio:audit]` prefix for
+ * path; they are logged to stderr with a `[clio-coder:audit]` prefix for
  * post-mortem review.
  *
  * Records are a discriminated union over `kind`:
@@ -404,7 +404,7 @@ interface OpenFile {
 function logAuditError(err: unknown, path?: string): void {
 	const msg = err instanceof Error ? err.message : String(err);
 	const where = path ? ` (${path})` : "";
-	process.stderr.write(`[clio:audit] ${msg}${where}\n`);
+	process.stderr.write(`[clio-coder:audit] ${msg}${where}\n`);
 }
 
 /** Cadence of the background safety flush that bounds how long rows can sit unfsynced. */

package/src/domains/safety/finish-contract.ts

@@ -490,9 +490,10 @@ function bashExecutionEvidence(entry: unknown): FinishContractEvidence | null {
 	if (record.exitCode !== 0) return null;
 	const detected = detectValidationCommand(record.command);
 	if (detected.kind !== "validation") return null;
+	const contextMarker = record.excludeFromContext === true ? " [not sent to model]" : "";
 	const evidence: FinishContractEvidence = {
 		kind: "validation_command",
-		summary: `validation command passed: ${detected.matched}`,
+		summary: `validation command passed: ${detected.matched}${contextMarker}`,
 	};
 	const turnId = turnIdOf(entry);
 	if (turnId !== null) evidence.turnId = turnId;

package/src/domains/safety/run-effects.ts

@@ -140,7 +140,7 @@ const ENUMERABLE_ACTION_CLASSES: ReadonlySet<string> = new Set(["read", "write"]
  * `unknown` and is opaque, which is the fail-closed answer for a tool whose
  * arguments this process has no schema for.
  */
-export function toolWritesOpaquely(toolName: string): boolean {
+function toolWritesOpaquely(toolName: string): boolean {
 	return !ENUMERABLE_ACTION_CLASSES.has(classify({ tool: toolName }).actionClass);
 }
 

package/src/domains/scheduling/extension.ts

@@ -28,14 +28,14 @@ export function createSchedulingBundle(context: DomainContext): DomainBundle<Sch
 	const observability = context.getContract<ObservabilityContract>("observability");
 
 	const settings = config.get();
-	let budget = createBudgetState(settings.budget.sessionCeilingUsd);
+	let budget = createBudgetState(settings.safety.limits.sessionCostUsd);
 	const fleet = createFleetRegistry(() => config.get().fleet?.nodes ?? [], {
-		localMaxWorkers: () => resolveMaxWorkers(config.get().budget.concurrency),
+		localMaxWorkers: () => resolveMaxWorkers(config.get().fleet.concurrency),
 	});
 	const unsubscribes: Array<() => void> = [];
 
 	function syncBudget(): void {
-		const nextCeiling = config.get().budget.sessionCeilingUsd;
+		const nextCeiling = config.get().safety.limits.sessionCostUsd;
 		if (nextCeiling === budget.ceilingUsd) return;
 		budget = createBudgetState(nextCeiling);
 	}
@@ -83,7 +83,7 @@ export function createSchedulingBundle(context: DomainContext): DomainBundle<Sch
 			const { verdict, currentUsd } = evaluate();
 			return { verdict, currentUsd, ceilingUsd: budget.ceilingUsd };
 		},
-		maxWorkers: () => resolveMaxWorkers(config.get().budget.concurrency),
+		maxWorkers: () => resolveMaxWorkers(config.get().fleet.concurrency),
 		fleet,
 	};
 

package/src/domains/session/archive-readers.ts

@@ -42,6 +42,14 @@ export interface SessionLedgerRef {
 	path: string;
 }
 
+const ROUTING_NOTICE_CUSTOM_TYPE = "clio-coder.routing-notice";
+const LEGACY_ROUTING_NOTICE_CUSTOM_TYPE = "clio.routing-notice";
+
+function normalizeReleasedCustomType(entry: SessionEntry): SessionEntry {
+	if (entry.kind !== "custom" || entry.customType !== LEGACY_ROUTING_NOTICE_CUSTOM_TYPE) return entry;
+	return { ...entry, customType: ROUTING_NOTICE_CUSTOM_TYPE };
+}
+
 /**
  * Read every `<stateDir>/audit/<date>.jsonl` row. Malformed lines are skipped
  * and reported in `errors` instead of failing the read.
@@ -157,7 +165,7 @@ export function parseSessionEntries(raw: string, source: string): SessionReadRes
 		}
 		if (isSessionHeader(parsed)) continue;
 		if (isSessionEntry(parsed)) {
-			entries.push(parsed);
+			entries.push(normalizeReleasedCustomType(parsed));
 			continue;
 		}
 		errors.push(

package/src/domains/session/compaction/branch-summary.ts

@@ -162,6 +162,10 @@ export function serializeConversation(entries: ReadonlyArray<SessionEntry>): str
 			continue;
 		}
 		if (entry.kind === "bashExecution") {
+			// `!!` is an operator-private terminal command. Its immutable ledger
+			// entry remains available to transcript replay, but neither its command
+			// nor its output may cross a model boundary through compaction.
+			if (entry.excludeFromContext === true) continue;
 			parts.push(`[Bash]: $ ${entry.command}\n${truncate(entry.output, TOOL_RESULT_MAX_CHARS)}`);
 			continue;
 		}

package/src/domains/session/compaction/compact.ts

@@ -497,7 +497,7 @@ interface TextBlock {
 	text: string;
 }
 
-export function textFromAssistant(message: unknown): string {
+function textFromAssistant(message: unknown): string {
 	if (!message || typeof message !== "object" || !("content" in message)) return "";
 	const content = (message as { content: unknown }).content;
 	if (typeof content === "string") return content;

package/src/domains/session/compaction/tokens.ts

@@ -49,6 +49,10 @@ function estimateMessage(entry: MessageEntry): number {
 }
 
 function estimateBashExecution(entry: BashExecutionEntry): number {
+	// `!!` rows are transcript-only and never become provider input, including
+	// through a later compaction prompt. Charging their bytes to the model
+	// context would make the context meter claim the model can see private output.
+	if (entry.excludeFromContext === true) return 0;
 	return ceilChars(entry.command.length + entry.output.length);
 }
 

package/src/domains/session/context-accounting.ts

@@ -370,7 +370,7 @@ export function lastLoadedContextWindow(meta: SessionMeta, providerId: string, m
 	return null;
 }
 
-export function buildSnapshotCategories(inputs: {
+function buildSnapshotCategories(inputs: {
 	systemPrompt?: string | undefined;
 	promptSegments?: ReadonlyArray<{ id: string; tokenEstimate: number }> | undefined;
 	tools?: ReadonlyArray<unknown> | undefined;

package/src/domains/session/decision-board.ts

@@ -54,7 +54,7 @@ function answeredAtForDecision(policy: AskUserToolPolicy, sourceQuestion: string
  * The policy already keeps last-value-wins decisions; the defensive map also
  * makes conversion deterministic for hand-built policies and older callers.
  */
-export function finalizedInterviewEntryFields(policy: AskUserToolPolicy): DecisionLedgerEntryFields | null {
+function finalizedInterviewEntryFields(policy: AskUserToolPolicy): DecisionLedgerEntryFields | null {
 	if (policy.rounds.length === 0 && policy.decisions.length === 0) return null;
 	if (!policy.turnId) throw new Error(`decision board: interview ${policy.id} has no originating user turn`);
 	if (policy.status !== "complete" && policy.status !== "cancelled") {

package/src/domains/session/extension.ts

@@ -392,7 +392,7 @@ export function createSessionBundle(context: DomainContext): DomainBundle<Sessio
 				await performCheckpoint(state, "shutdown");
 			} catch (err) {
 				process.stderr.write(
-					`[clio:session] shutdown checkpoint failed: ${err instanceof Error ? err.message : String(err)}\n`,
+					`[clio-coder:session] shutdown checkpoint failed: ${err instanceof Error ? err.message : String(err)}\n`,
 				);
 			}
 			await closeCurrent("shutdown");

package/src/domains/session/handoff.ts

@@ -176,7 +176,7 @@ function isRecord(value: unknown): value is Record<string, unknown> {
  * ceiling, so the returned string is never longer than the bound, and the cut
  * lands on a whole code point rather than mid-sequence.
  */
-export function boundHandoffString(value: string): { text: string; truncated: boolean } {
+function boundHandoffString(value: string): { text: string; truncated: boolean } {
 	const text = value.trim();
 	const bytes = Buffer.byteLength(text, "utf8");
 	if (bytes <= HANDOFF_MAX_STRING_BYTES) return { text, truncated: false };
@@ -343,7 +343,7 @@ export interface HandoffReadLedgerOptions {
  * absolute form, which is what makes it fail the ledger check against paths
  * recorded relative to the workspace root.
  */
-export function normalizeHandoffPath(value: string, cwd: string | null): string {
+function normalizeHandoffPath(value: string, cwd: string | null): string {
 	const trimmed = value.trim().replace(/[\\/]+$/u, "");
 	if (trimmed.length === 0) return "";
 	const absolute = isAbsolute(trimmed) ? normalize(trimmed) : cwd === null ? normalize(trimmed) : resolve(cwd, trimmed);

package/src/domains/session/prompt-manifest.ts

@@ -155,11 +155,6 @@ function isSessionPromptCompileRecord(value: unknown): value is SessionPromptCom
 	);
 }
 
-/** A record written before the field existed describes the 0.3.8 layout. */
-export function promptManifestVersion(record: SessionPromptCompileRecord): number {
-	return record.version ?? 1;
-}
-
 export function getPromptManifestFilePath(meta: SessionMeta, stateDir?: string): string {
 	const safeMeta = {
 		...meta,

package/src/domains/session/protected-artifact-journal.ts

@@ -63,9 +63,12 @@ function artifactPayload(artifact: ProtectedArtifact): Record<string, unknown> {
 	};
 }
 
-function recordPayload(record: Omit<PendingProtectedArtifactRecord, "integrity">): Record<string, unknown> {
+function recordPayload(
+	record: Omit<PendingProtectedArtifactRecord, "integrity">,
+	legacyNaming = false,
+): Record<string, unknown> {
 	return {
-		contract: "clio.protectedArtifact.pending",
+		contract: legacyNaming ? "clio.protectedArtifact.pending" : "clio-coder.protectedArtifact.pending",
 		version: record.version,
 		id: record.id,
 		sessionId: record.sessionId,
@@ -81,9 +84,9 @@ function recordPayload(record: Omit<PendingProtectedArtifactRecord, "integrity">
 	};
 }
 
-function digest(record: Omit<PendingProtectedArtifactRecord, "integrity">): string {
+function digest(record: Omit<PendingProtectedArtifactRecord, "integrity">, legacyNaming = false): string {
 	return createHash("sha256")
-		.update(JSON.stringify(recordPayload(record)), "utf8")
+		.update(JSON.stringify(recordPayload(record, legacyNaming)), "utf8")
 		.digest("hex");
 }
 
@@ -153,7 +156,10 @@ function parseRecord(value: unknown, sessionId: string): PendingProtectedArtifac
 		createdAt: value.createdAt,
 		integrity: { algorithm: "sha256", digest: value.integrity.digest },
 	};
-	return digest(withoutIntegrity(parsed)) === parsed.integrity.digest ? parsed : null;
+	const without = withoutIntegrity(parsed);
+	return digest(without) === parsed.integrity.digest || digest(without, true) === parsed.integrity.digest
+		? parsed
+		: null;
 }
 
 export function stagePendingProtectedArtifact(
@@ -190,7 +196,7 @@ export function clearPendingProtectedArtifact(handle: PendingProtectedArtifactHa
 	rmSync(handle.path, { force: true });
 }
 
-export function readPendingProtectedArtifacts(sessionId: string): PendingProtectedArtifactReadResult {
+function readPendingProtectedArtifacts(sessionId: string): PendingProtectedArtifactReadResult {
 	const directory = journalDirectory(sessionId);
 	if (!existsSync(directory)) return { records: [], errors: [] };
 	const records: PendingProtectedArtifactHandle[] = [];

package/src/domains/session/retry.ts

@@ -70,7 +70,7 @@ const MODEL_LOADING_MIN_DELAY_MS = 15000;
  * True when the error says the target is loading the model, so the wait should
  * be sized for disk and VRAM rather than for a provider backing off.
  */
-export function isModelLoadingErrorMessage(errorMessage: string | null | undefined): boolean {
+function isModelLoadingErrorMessage(errorMessage: string | null | undefined): boolean {
 	if (!errorMessage || errorMessage.length === 0) return false;
 	return MODEL_LOADING_PATTERN.test(errorMessage);
 }