@jaimevalasek/aioson 1.7.2 → 1.8.0

package/src/session-handoff.js

@@ -5,9 +5,11 @@ const path = require('node:path');
 const { exists, ensureDir } = require('./utils');
 
 const HANDOFF_RELATIVE_PATH = '.aioson/context/last-handoff.json';
+const HANDOFF_PROTOCOL_RELATIVE_PATH = '.aioson/context/handoff-protocol.json';
 
 async function writeHandoff(targetDir, payload) {
   const handoffPath = path.join(targetDir, HANDOFF_RELATIVE_PATH);
+  const protocolPath = path.join(targetDir, HANDOFF_PROTOCOL_RELATIVE_PATH);
   await ensureDir(path.dirname(handoffPath));
   const handoff = {
     version: 1,
@@ -24,7 +26,16 @@ async function writeHandoff(targetDir, payload) {
     feature_slug: payload.featureSlug || null
   };
   await fs.writeFile(handoffPath, `${JSON.stringify(handoff, null, 2)}\n`, 'utf8');
-  return { handoffPath: HANDOFF_RELATIVE_PATH, handoff };
+
+  const protocol = payload.protocol || buildBasicHandoffProtocol(payload);
+  await fs.writeFile(protocolPath, `${JSON.stringify(protocol, null, 2)}\n`, 'utf8');
+
+  return {
+    handoffPath: HANDOFF_RELATIVE_PATH,
+    protocolPath: HANDOFF_PROTOCOL_RELATIVE_PATH,
+    handoff,
+    protocol
+  };
 }
 
 async function readHandoff(targetDir) {
@@ -38,6 +49,17 @@ async function readHandoff(targetDir) {
   }
 }
 
+async function readHandoffProtocol(targetDir) {
+  const protocolPath = path.join(targetDir, HANDOFF_PROTOCOL_RELATIVE_PATH);
+  if (!(await exists(protocolPath))) return null;
+  try {
+    const content = await fs.readFile(protocolPath, 'utf8');
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+}
+
 function buildWorkflowHandoff(state, completedStage, nextAgent) {
   const agentLabel = completedStage ? `@${completedStage}` : null;
   const nextLabel = nextAgent ? `@${nextAgent}` : null;
@@ -58,6 +80,91 @@ function buildWorkflowHandoff(state, completedStage, nextAgent) {
   };
 }
 
+function mapStageToCapability(stageName) {
+  const normalized = String(stageName || '').replace(/^@/, '').trim().toLowerCase();
+  if (!normalized) return null;
+
+  const map = {
+    setup: 'initialize_project_context',
+    product: 'define_product_scope',
+    analyst: 'analyze_requirements',
+    architect: 'design_architecture',
+    'ux-ui': 'design_ui_spec',
+    pm: 'plan_delivery',
+    orchestrator: 'coordinate_parallel_work',
+    dev: 'implement_feature',
+    pentester: 'adversarial_review',
+    qa: 'verify_feature',
+    committer: 'prepare_commit'
+  };
+
+  return map[normalized] || null;
+}
+
+function buildWorkflowHandoffProtocol(state, completedStage, nextAgent, options = {}) {
+  const fromAgentId = completedStage || null;
+  const toAgentId = nextAgent || null;
+  const fromCapability = mapStageToCapability(fromAgentId);
+  const toCapability = mapStageToCapability(toAgentId);
+
+  return {
+    version: '1.0',
+    protocol_id: `hnd-${fromAgentId || 'init'}-${toAgentId || 'end'}-${Date.now()}`,
+    created_at: new Date().toISOString(),
+    workflow_mode: state.mode || null,
+    classification: state.classification || null,
+    feature_slug: state.featureSlug || null,
+    from: {
+      agent_id: fromAgentId,
+      capability_transferred: fromCapability
+    },
+    to: {
+      agent_id: toAgentId,
+      capability_required: toCapability
+    },
+    capabilities_transferred: fromCapability ? [fromCapability] : [],
+    artifact_uris: Array.isArray(options.artifactUris) ? options.artifactUris : [],
+    gate_status: options.gateStatus && typeof options.gateStatus === 'object' ? options.gateStatus : {},
+    autonomy_mode: options.autonomyMode || null,
+    validation: {
+      handoff_contract_ok: options.handoffContractOk !== false,
+      technical_gate_ok: options.technicalGateOk !== false,
+      validated_at: new Date().toISOString()
+    }
+  };
+}
+
+function buildBasicHandoffProtocol(payload) {
+  const fromAgentId = payload.lastStage ? String(payload.lastStage).replace(/^@/, '') : null;
+  const toAgentId = payload.nextAgent ? String(payload.nextAgent).replace(/^@/, '') : null;
+  const fromCapability = mapStageToCapability(fromAgentId);
+  return {
+    version: '1.0',
+    protocol_id: `hnd-${fromAgentId || 'init'}-${toAgentId || 'end'}-${Date.now()}`,
+    created_at: new Date().toISOString(),
+    workflow_mode: payload.workflowMode || null,
+    classification: payload.classification || null,
+    feature_slug: payload.featureSlug || null,
+    from: {
+      agent_id: fromAgentId,
+      capability_transferred: fromCapability
+    },
+    to: {
+      agent_id: toAgentId,
+      capability_required: mapStageToCapability(toAgentId)
+    },
+    capabilities_transferred: fromCapability ? [fromCapability] : [],
+    artifact_uris: Array.isArray(payload.contextFilesUpdated) ? payload.contextFilesUpdated : [],
+    gate_status: {},
+    autonomy_mode: payload.autonomyMode || null,
+    validation: {
+      handoff_contract_ok: true,
+      technical_gate_ok: true,
+      validated_at: new Date().toISOString()
+    }
+  };
+}
+
 function buildRuntimeLogHandoff(agentName, message, summary) {
   return {
     lastAgent: agentName ? `@${agentName.replace(/^@/, '')}` : null,
@@ -70,8 +177,11 @@ function buildRuntimeLogHandoff(agentName, message, summary) {
 
 module.exports = {
   HANDOFF_RELATIVE_PATH,
+  HANDOFF_PROTOCOL_RELATIVE_PATH,
   writeHandoff,
   readHandoff,
+  readHandoffProtocol,
   buildWorkflowHandoff,
+  buildWorkflowHandoffProtocol,
   buildRuntimeLogHandoff
 };

package/src/squad/squad-scaffold.js

@@ -10,7 +10,7 @@
  * Integrates with state-manager.js for STATE.md generation.
  *
  * Usage:
- *   node squad-scaffold.js --slug=<slug> --name="Name" --mode=content|code|hybrid
+ *   node squad-scaffold.js --slug=<slug> --name="Name" --mode=content|software|research|mixed
  */
 
 const fs = require('node:fs/promises');
@@ -19,27 +19,94 @@ const stateManager = require('./state-manager');
 
 const SQUADS_DIR = path.join('.aioson', 'squads');
 
-// ─── Templates ───────────���─────────────────────────��─────────────────────────
+// ─── Templates ───────────────────────────────────────────────────────────────
+
+function normalizeMode(mode) {
+  const raw = String(mode || '').trim().toLowerCase();
+  if (raw === 'code') return 'software';
+  if (raw === 'hybrid') return 'mixed';
+  if (raw === 'content' || raw === 'software' || raw === 'research' || raw === 'mixed') {
+    return raw;
+  }
+  return null;
+}
 
 function agentsSkeleton(name, mode) {
   const executorTypes = {
     content: ['writer', 'editor', 'researcher'],
-    code: ['developer', 'reviewer', 'tester'],
-    hybrid: ['researcher', 'developer', 'writer']
+    software: ['developer', 'reviewer', 'tester'],
+    research: ['researcher', 'analyst', 'reviewer'],
+    mixed: ['researcher', 'developer', 'writer']
   };
 
-  const types = executorTypes[mode] || executorTypes.hybrid;
-  const slots = types.map((t) => `### ${t}\n- **Role:** (define)\n- **Tools:** (define)\n- **Checklist:** (define)`);
+  const types = executorTypes[mode] || executorTypes.mixed;
+  const slots = [
+    '## Mission',
+    '(define the squad mission here)',
+    '',
+    '## Does',
+    '- (define the main responsibilities)',
+    '',
+    '## Does not',
+    '- (define explicit out-of-scope boundaries)',
+    '',
+    '## Permanent executors',
+    '- @orquestrador — coordinates work, routes requests, and synthesizes outputs',
+    ...types.map((t) => `- @${t} — (define role)`),
+    '',
+    '## Squad skills',
+    '- (declare reusable skills when they exist)',
+    '',
+    '## Squad MCPs',
+    '- (declare MCPs when they exist)',
+    '',
+    '## Subagent policy',
+    '- (define when temporary subagents are allowed)',
+    '',
+    '## Outputs and review',
+    '- (define output locations and review policy)'
+  ];
 
-  return `# ${name} — Agent Roster\n\n${slots.join('\n\n')}\n`;
+  return `# Squad ${name}\n\n${slots.join('\n')}\n`;
 }
 
 function manifestSkeleton(slug, name, mode) {
+  const rootDir = `${SQUADS_DIR}/${slug}`;
   return JSON.stringify({
+    schemaVersion: '1.0.0',
+    packageVersion: '1.0.0',
     slug,
     name,
     mode,
-    created_at: new Date().toISOString(),
+    mission: `Define the mission for ${name}.`,
+    goal: `Define the goal for ${name}.`,
+    visibility: 'private',
+    locale_scope: 'universal',
+    storagePolicy: {
+      primary: 'file',
+      artifacts: `output/${slug}/`,
+      exports: {
+        html: true,
+        markdown: true,
+        json: true
+      }
+    },
+    package: {
+      rootDir,
+      agentsDir: `${rootDir}/agents`,
+      workersDir: `${rootDir}/workers`,
+      workflowsDir: `${rootDir}/workflows`,
+      checklistsDir: `${rootDir}/checklists`,
+      skillsDir: `${rootDir}/skills`,
+      templatesDir: `${rootDir}/templates`,
+      docsDir: `${rootDir}/docs`
+    },
+    rules: {
+      outputsDir: `output/${slug}`,
+      logsDir: `aioson-logs/${slug}`,
+      mediaDir: `media/${slug}`,
+      reviewPolicy: []
+    },
     budget: {
       max_tokens_per_session: null,
       max_tokens_per_task: null,
@@ -54,12 +121,66 @@ function manifestSkeleton(slug, name, mode) {
     anti_loop: {
       threshold: 8,
       action: 'feedback'
-    }
+    },
+    skills: [],
+    mcps: [],
+    subagents: [],
+    contentBlueprints: [],
+    executors: [
+      {
+        slug: 'orquestrador',
+        title: 'Orquestrador',
+        type: 'agent',
+        role: 'Coordinate the squad execution and synthesize specialist outputs.',
+        file: `${rootDir}/agents/orquestrador.md`,
+        usesLLM: true,
+        deterministic: false,
+        modelTier: 'balanced',
+        skills: [],
+        genomes: []
+      }
+    ],
+    checklists: [
+      {
+        slug: 'quality',
+        title: 'Quality Checklist',
+        file: `${rootDir}/checklists/quality.md`
+      }
+    ],
+    workflows: [
+      {
+        slug: 'default',
+        title: 'Default Workflow',
+        file: `${rootDir}/workflows/default.md`,
+        phases: []
+      }
+    ],
+    genomes: [],
+    created_at: new Date().toISOString()
   }, null, 2);
 }
 
-function squadMdSkeleton(name, mode) {
-  return `# ${name}\n\n## Overview\n(describe the squad's purpose)\n\n## Mode\n${mode}\n\n## Executors\nSee agents/agents.md\n\n## Workflows\n(define execution workflows)\n\n## Quality Gates\nSee checklists/quality.md\n`;
+function squadMdSkeleton(slug, name, mode) {
+  return `# ${name}
+
+Mode: ${mode}
+Goal: (define the squad goal)
+Agents: .aioson/squads/${slug}/agents
+Manifest: .aioson/squads/${slug}/squad.manifest.json
+Output: output/${slug}
+Logs: aioson-logs/${slug}
+Media: media/${slug}
+LatestSession: output/${slug}/latest.html
+
+## Skills
+- (declare squad-level skills here)
+
+## MCPs
+- (declare MCPs here)
+
+## SubagentPolicy
+- (define temporary subagent rules)
+`;
 }
 
 function designDocSkeleton(name) {
@@ -78,6 +199,47 @@ function learningsIndexSkeleton(name) {
   return `# ${name} — Learnings Index\n\nsession_count: 0\n\n## Extracted Learnings\n*(populated automatically by learning-extractor after sessions)*\n\n## Manual Observations\n*(add observations here)*\n`;
 }
 
+function orchestratorSkeleton(name, slug) {
+  return `# Agent @orquestrador
+
+> ⚡ **ACTIVATED** — Execute immediately as @orquestrador.
+
+## Mission
+Coordinate the ${name} squad, route requests to the right executor, and synthesize the final output.
+
+## Quick context
+Squad: ${name} | Slug: ${slug}
+
+## Focus
+- Route work to the right specialist
+- Protect scope and output quality
+- Keep workflows, reviews, and hand-offs coherent
+
+## Hard constraints
+- Respect the squad manifest and package contract
+- Do not absorb specialist work silently when routing is required
+- Keep user-facing interaction aligned with the squad locale policy
+
+## Output contract
+- Primary synthesis: .aioson/squads/${slug}/docs/design-doc.md
+- Session deliverables: output/${slug}/
+`;
+}
+
+function workflowSkeleton(name) {
+  return `# Workflow: default
+
+## Goal
+Default execution flow for ${name}.
+
+## Phases
+1. Intake
+2. Execution
+3. Review
+4. Final synthesis
+`;
+}
+
 // ─── Public API ──────────────────────────────────────────────────────────────
 
 /**
@@ -88,12 +250,13 @@ function learningsIndexSkeleton(name) {
  * @returns {Promise<object>}  — { ok, slug, files, directories }
  */
 async function scaffoldSquad(projectDir, options = {}) {
-  const { slug, name, mode = 'hybrid' } = options;
+  const { slug, name } = options;
+  const mode = normalizeMode(options.mode || 'mixed');
 
   if (!slug) return { ok: false, error: 'slug is required' };
   if (!name) return { ok: false, error: 'name is required' };
-  if (!['content', 'code', 'hybrid'].includes(mode)) {
-    return { ok: false, error: `Invalid mode "${mode}" — use content|code|hybrid` };
+  if (!mode) {
+    return { ok: false, error: `Invalid mode "${options.mode}" — use content|software|research|mixed` };
   }
 
   const squadDir = path.join(projectDir, SQUADS_DIR, slug);
@@ -125,18 +288,19 @@ async function scaffoldSquad(projectDir, options = {}) {
 
   // Squad directory files
   await writeFile(path.join(base, 'agents', 'agents.md'), agentsSkeleton(name, mode));
+  await writeFile(path.join(base, 'agents', 'orquestrador.md'), orchestratorSkeleton(name, slug));
   await writeFile(path.join(base, 'squad.manifest.json'), manifestSkeleton(slug, name, mode));
-  await writeFile(path.join(base, 'squad.md'), squadMdSkeleton(name, mode));
+  await writeFile(path.join(base, 'squad.md'), squadMdSkeleton(slug, name, mode));
   await writeFile(path.join(base, 'docs', 'design-doc.md'), designDocSkeleton(name));
   await writeFile(path.join(base, 'docs', 'readiness.md'), readinessSkeleton(name));
   await writeFile(path.join(base, 'checklists', 'quality.md'), qualitySkeleton(name));
   await writeFile(path.join(base, 'learnings', 'index.md'), learningsIndexSkeleton(name));
+  await writeFile(path.join(base, 'workflows', 'default.md'), workflowSkeleton(name));
 
   // Empty directories
-  await ensureDir(path.join(base, 'workflows'));
-  await ensureDir(path.join(base, 'scripts'));
-  await ensureDir(path.join(base, 'script-plans'));
-  await ensureDir(path.join(base, 'bus'));
+  await ensureDir(path.join(base, 'workers'));
+  await ensureDir(path.join(base, 'skills'));
+  await ensureDir(path.join(base, 'templates'));
 
   // Output directories
   await ensureDir(path.join('output', slug));

package/src/test-briefing.js

@@ -0,0 +1,226 @@
+'use strict';
+
+/**
+ * test-briefing — auto-generate test context for @qa and @tester agents.
+ *
+ * Reduces friction from:
+ *   - wrong UI text assertions (mock strings, button labels)
+ *   - mock ordering bugs
+ *   - incorrect test patterns
+ *
+ * Scans the project for:
+ *   - existing test helpers / mock factories
+ *   - recent test files to use as templates
+ *   - UI text strings from components referenced in the spec
+ */
+
+const path = require('node:path');
+const fs = require('node:fs/promises');
+const { readFileSafe, fileExists } = require('./preflight-engine');
+
+const MAX_MOCK_FILES = 5;
+const MAX_COMPONENT_FILES = 8;
+const MAX_TEST_FILES = 4;
+
+async function findFiles(targetDir, patterns, maxDepth = 4) {
+  const found = [];
+  async function walk(dir, depth) {
+    if (depth > maxDepth || found.length >= patterns.max) return;
+    let entries;
+    try {
+      entries = await fs.readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name.startsWith('.')) continue;
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name === 'node_modules' || entry.name === 'dist' || entry.name === 'build' || entry.name === '.aioson') continue;
+        await walk(full, depth + 1);
+      } else if (patterns.test(entry.name)) {
+        found.push(full);
+        if (found.length >= patterns.max) return;
+      }
+    }
+  }
+  await walk(targetDir, 0);
+  return found;
+}
+
+async function findMockHelpers(targetDir) {
+  // Look for common mock/helper patterns
+  const candidates = [
+    path.join(targetDir, 'tests', 'helpers', 'mocks.ts'),
+    path.join(targetDir, 'tests', 'helpers', 'mocks.js'),
+    path.join(targetDir, 'test', 'helpers', 'mocks.ts'),
+    path.join(targetDir, 'test', 'helpers', 'mocks.js'),
+    path.join(targetDir, 'src', '__mocks__', 'index.ts'),
+    path.join(targetDir, 'src', '__mocks__', 'index.js'),
+    path.join(targetDir, '__mocks__', 'index.ts'),
+    path.join(targetDir, '__mocks__', 'index.js'),
+  ];
+  const found = [];
+  for (const p of candidates) {
+    if (await fileExists(p)) found.push(p);
+  }
+  return found;
+}
+
+async function findRecentTestFiles(targetDir) {
+  const files = await findFiles(targetDir, {
+    test: (name) => /\.(test|spec)\.(js|jsx|ts|tsx)$/.test(name),
+    max: 20
+  });
+  // Sort by mtime descending, keep top N
+  const withStat = [];
+  for (const f of files) {
+    try {
+      const stat = await fs.stat(f);
+      withStat.push({ path: f, mtime: stat.mtime });
+    } catch { /* ignore */ }
+  }
+  withStat.sort((a, b) => b.mtime - a.mtime);
+  return withStat.slice(0, MAX_TEST_FILES).map((x) => x.path);
+}
+
+async function findComponentFiles(targetDir) {
+  // Heuristic: look in src/ for .tsx/.jsx files that are not tests
+  const files = await findFiles(path.join(targetDir, 'src'), {
+    test: (name) => /\.(tsx|jsx)$/.test(name) && !/(test|spec)\./.test(name),
+    max: 30
+  });
+  // Prefer files modified recently (likely part of the current feature)
+  const withStat = [];
+  for (const f of files) {
+    try {
+      const stat = await fs.stat(f);
+      withStat.push({ path: f, mtime: stat.mtime });
+    } catch { /* ignore */ }
+  }
+  withStat.sort((a, b) => b.mtime - a.mtime);
+  return withStat.slice(0, MAX_COMPONENT_FILES).map((x) => x.path);
+}
+
+function extractUiStrings(content) {
+  // Extract text inside JSX/TSX that looks user-facing
+  // Pattern 1: string literals inside tags > "text" or {'text'}
+  const strings = [];
+  const tagTextRe = />([^<>{}]{2,80})</g;
+  let m;
+  while ((m = tagTextRe.exec(content)) !== null) {
+    const text = m[1].trim();
+    if (text && !text.startsWith('{') && !text.endsWith('}')) {
+      strings.push(text);
+    }
+  }
+  // Pattern 2: placeholder="..." label="..." title="..." aria-label="..."
+  const attrRe = /(?:placeholder|label|title|aria-label|aria-labelledby|alt|helperText|errorText)\s*=\s*["']([^"']{1,80})["']/g;
+  while ((m = attrRe.exec(content)) !== null) {
+    strings.push(m[1].trim());
+  }
+  // Deduplicate and limit
+  return [...new Set(strings)].slice(0, 40);
+}
+
+function extractMockPatterns(content) {
+  const patterns = [];
+  // Look for vi.mock / vi.fn / jest.mock / jest.fn patterns
+  const mockRe = /^(?:\s*)(vi|jest)\.(mock|fn)\s*\(/gm;
+  let m;
+  while ((m = mockRe.exec(content)) !== null) {
+    const lineStart = content.lastIndexOf('\n', m.index) + 1;
+    const lineEnd = content.indexOf('\n', m.index);
+    const line = content.slice(lineStart, lineEnd === -1 ? undefined : lineEnd).trim();
+    patterns.push(line);
+  }
+  return patterns.slice(0, 20);
+}
+
+async function buildTestBriefing(targetDir) {
+  const lines = [];
+  lines.push('## Auto-generated Test Context (motor do AIOSON)');
+  lines.push('');
+
+  // 1. Mock helpers
+  const mockHelpers = await findMockHelpers(targetDir);
+  if (mockHelpers.length > 0) {
+    lines.push('### Shared mock helpers found');
+    for (const p of mockHelpers) {
+      const rel = path.relative(targetDir, p);
+      lines.push(`- ${rel}`);
+    }
+    lines.push('> Use these helpers instead of writing ad-hoc mocks. This prevents ordering bugs.');
+    lines.push('');
+  }
+
+  // 2. Recent test templates
+  const recentTests = await findRecentTestFiles(targetDir);
+  if (recentTests.length > 0) {
+    lines.push('### Recent test files (use as templates for patterns)');
+    for (const p of recentTests) {
+      const rel = path.relative(targetDir, p);
+      lines.push(`- ${rel}`);
+    }
+    lines.push('> Reference these files for mock ordering, assertion style, and helpers before writing new tests.');
+    lines.push('');
+  }
+
+  // 3. Mock patterns from recent tests
+  if (recentTests.length > 0) {
+    const mockPatterns = [];
+    for (const p of recentTests.slice(0, 2)) {
+      const content = await readFileSafe(p);
+      if (content) {
+        mockPatterns.push(...extractMockPatterns(content));
+      }
+    }
+    if (mockPatterns.length > 0) {
+      lines.push('### Common mock patterns in this project');
+      for (const pat of [...new Set(mockPatterns)].slice(0, 10)) {
+        lines.push(`- \`${pat}\``);
+      }
+      lines.push('');
+    }
+  }
+
+  // 4. UI text strings from recent components
+  const components = await findComponentFiles(targetDir);
+  if (components.length > 0) {
+    const allStrings = [];
+    for (const p of components) {
+      const content = await readFileSafe(p);
+      if (content) {
+        const strings = extractUiStrings(content);
+        if (strings.length > 0) {
+          allStrings.push({ file: path.relative(targetDir, p), strings });
+        }
+      }
+    }
+    if (allStrings.length > 0) {
+      lines.push('### UI text strings from recent components');
+      lines.push('> Verify exact strings before using them in assertions. Prefer `getByRole` over `getByText` when possible.');
+      for (const item of allStrings.slice(0, MAX_COMPONENT_FILES)) {
+        lines.push(`\n**${item.file}:**`);
+        for (const s of item.strings.slice(0, 12)) {
+          lines.push(`- "${s}"`);
+        }
+      }
+      lines.push('');
+    }
+  }
+
+  // 5. Testing conventions reminder
+  lines.push('### Testing conventions');
+  lines.push('- Verify exact UI text strings against component source before using them in assertions.');
+  lines.push('- Use `getByRole` over `getByText` when possible.');
+  lines.push('- If using `vi.mock`, ensure deterministic ordering (mock factories > mock implementations).');
+  lines.push('- Reference existing test files as templates for assertion style and helper usage.');
+  lines.push('');
+
+  return lines.join('\n');
+}
+
+module.exports = {
+  buildTestBriefing
+};

package/src/updater.js

@@ -23,7 +23,7 @@ async function updateInstallation(targetDir, options = {}) {
     mode: 'update',
     backupOnOverwrite: true,
     frameworkDetection: options.frameworkDetection || null,
-    installProfile: null,
+    installProfile: savedProfile,
     selectiveUpdate: !options.all
   });
 

package/src/utils.js

@@ -33,6 +33,9 @@ function nowStamp() {
 
 function toRelativeSafe(baseDir, absolutePath) {
   const rel = path.relative(baseDir, absolutePath);
+  if (rel.startsWith('..')) {
+    throw new Error(`Path traversal detected: "${absolutePath}" escapes base "${baseDir}"`);
+  }
   return rel.split(path.sep).join('/');
 }