@kienntpixon/dieu-phoi 0.7.1 → 0.7.2

package/lib/profile-scan.cjs

@@ -0,0 +1,85 @@
+'use strict';
+// `dieu-phoi profile scan` (core 0.7.2): look for secrets / machine-specific data in the profile files before they are
+// published (Skill Hub zip, repo). Regex-only: it cannot see customer, person or secret-project NAMES - the user still
+// reads the lessons diff (see profile publish). It never prints a matched value, only file:line:kind.
+
+const fs = require('fs');
+const path = require('path');
+
+const SCAN_FILES = ['lessons.md', 'profile.json', 'unity-lanes.md'];
+
+const PLACEHOLDER = /^(?:<[^>]*>?|\$\{?\w+\}?|%\w+%|\*+|\.{2,}|…|x{3,}|["'`]?[.…]*["'`]?|["'`]?<.*)$/i;
+
+// kind → [regex, optional filter(matchText, line) → boolean]. Every regex needs the g flag.
+const RULES = [
+  ['abs-path', /(?<![A-Za-z0-9])[A-Za-z]:[\\/](?![\\/])[^\s`'")\]]*|(?<![\w.])\/(?:Users|home)\/[^\s/`'")]+/g],
+  ['ipv4', /(?<![\d.])(?:\d{1,3}\.){3}\d{1,3}(?![\d.]*\d)/g, (m) => {
+    const o = m.split('.').map(Number);
+    if (o.some((n) => n > 255)) return false;
+    return !(m === '127.0.0.1' || m === '0.0.0.0'); // loopback / any-address: not machine data
+  }],
+  ['email', /[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+/g],
+  ['signed-url', /https?:\/\/[^\s)>"'`]*[?&](?:sig|signature|token|access_token|key|X-Amz-[A-Za-z-]+|X-Goog-[A-Za-z-]+)=[^\s)>"'`]*/gi],
+  ['token-prefix', /\b(?:sk-[A-Za-z0-9_-]{8,}|ghp_[A-Za-z0-9]{8,}|gho_[A-Za-z0-9]{8,}|glpat-[A-Za-z0-9_-]{8,}|npm_[A-Za-z0-9]{8,}|xox[abprso]-[A-Za-z0-9-]{8,}|AKIA[0-9A-Z]{12,})|\bBearer\s+[A-Za-z0-9._~+/-]{8,}/g],
+  ['secret-assign', /\b[A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)[A-Za-z0-9_]*\s*=\s*(\S+)/gi, (m) => {
+    const v = m.slice(m.indexOf('=') + 1).trim();
+    return !!v && !PLACEHOLDER.test(v);
+  }],
+  ['long-hex', /\b[0-9a-fA-F]{32,}\b/g],
+  ['long-base64', /(?<![A-Za-z0-9+/_-])[A-Za-z0-9+/_-]{32,}={0,2}(?![A-Za-z0-9+/_-])/g, (m) => /[a-z]/.test(m) && /[A-Z]/.test(m) && /\d/.test(m)],
+];
+
+// Known false positives. Match is the literal matched text (never a secret); `reason` is shown in the output.
+const ALLOW = [
+  { file: 'unity-lanes.md', kind: 'abs-path', match: 'D:/', reason: 'ví dụ gốc ổ đĩa "D:/" cho PFF_DATA_ROOT, không có đường dẫn thật' },
+];
+
+function allowed(file, kind, match) {
+  return ALLOW.find((a) => a.file === file && a.kind === kind && a.match === match) || null;
+}
+
+/** Findings of one text: [{line, kind, allowed: reason|null}] (values are not returned). */
+function scanText(file, text) {
+  const out = [];
+  const lines = String(text).replace(/^/, '').split(/\r?\n/);
+  lines.forEach((ln, i) => {
+    const seen = new Set();
+    for (const [kind, re, filter] of RULES) {
+      re.lastIndex = 0;
+      let m;
+      while ((m = re.exec(ln))) {
+        if (m[0] === '') { re.lastIndex++; continue; }
+        if (filter && !filter(m[0], ln)) continue;
+        if (seen.has(kind)) continue; // one finding per kind per line is enough to point at it
+        seen.add(kind);
+        const al = allowed(file, kind, m[0]);
+        out.push({ file, line: i + 1, kind, allowed: al ? al.reason : null });
+      }
+    }
+  });
+  return out;
+}
+
+/** Scan files of a profile dir (or {file: text} map). → {findings, files, clean}. */
+function scanProfile(source) {
+  const texts = {};
+  if (typeof source === 'string') {
+    for (const f of SCAN_FILES) {
+      try { texts[f] = fs.readFileSync(path.join(source, f), 'utf8'); } catch (e) { if (e.code !== 'ENOENT') throw e; }
+    }
+  } else Object.assign(texts, source);
+  const findings = [];
+  for (const [f, t] of Object.entries(texts)) findings.push(...scanText(f, t));
+  const hits = findings.filter((x) => !x.allowed);
+  return { files: Object.keys(texts), findings, hits, skipped: findings.filter((x) => x.allowed), clean: hits.length === 0 };
+}
+
+function formatScan(r, dir) {
+  const L = [`profile scan ${dir ? `${String(dir).replace(/\\/g, '/')} ` : ''}— ${r.files.join(', ') || '(không có file)'}`];
+  for (const x of r.hits) L.push(`  ! ${x.file}:${x.line}: ${x.kind}`);
+  for (const x of r.skipped) L.push(`  ~ ${x.file}:${x.line}: ${x.kind} (bỏ qua — ${x.allowed})`);
+  L.push(r.clean ? `  sạch: ${r.skipped.length} dương tính giả đã bỏ qua` : `  ${r.hits.length} chỗ nghi ngờ (giá trị không in). Xem dòng đó, sửa hoặc xác nhận dương tính giả, rồi quét lại.`);
+  return L.join('\n');
+}
+
+module.exports = { scanText, scanProfile, formatScan, SCAN_FILES, ALLOW };

package/lib/profile-seed.cjs

@@ -0,0 +1,147 @@
+'use strict';
+// Gói npm mang bản tuyển của profile (cli/profile/, do scripts/pack-profile.cjs chép từ skill/profile lúc prepack).
+// `setup` gộp vào profile đã cài (<skill>/profile):
+//   - lessons.md: dòng gạch đầu dòng nào chưa có → nối vào CUỐI file; dòng có sẵn và dòng riêng của máy không đụng tới;
+//   - .lessons.published.md: cộng dồn các dòng đã tuyển (dòng riêng máy không bao giờ vào đây, nên publish vẫn nhận ra chúng);
+//   - unity-lanes.md: chưa có → chép; đã có → không ghi đè, chỉ báo số dòng khác;
+//   - profile.json: không đụng.
+// Idempotent: chạy lại không thêm gì. So khớp dòng theo normLine = norm() của tools/lessons_sync.cjs
+// (bỏ gạch đầu dòng, [ngày] đầu, khoảng trắng thừa, chữ hoa, dấu chấm cuối) → dòng chỉ khác ngày/dấu chấm không nhân đôi.
+
+const fs = require('fs');
+const path = require('path');
+const core = require('../hook.cjs');
+
+const PUBLISHED = '.lessons.published.md';
+const UNITY = 'unity-lanes.md';
+const BULLET_RE = /^\s*[-*] +/;
+
+const lf = (txt) => String(txt).replace(/^/, '').replace(/\r\n/g, '\n');
+
+function readLF(file) {
+  try { return lf(fs.readFileSync(file, 'utf8')); } catch (e) { if (e.code === 'ENOENT') return null; throw e; }
+}
+
+/** Bullet lines outside ``` fences, trimmed (same reading as lessons_sync.cjs). */
+function bulletsOf(txt) {
+  const out = [];
+  let fence = false;
+  for (const raw of String(txt || '').split(/\r?\n/)) {
+    if (/^\s*```/.test(raw)) { fence = !fence; continue; }
+    if (fence || !BULLET_RE.test(raw)) continue;
+    out.push(raw.trim());
+  }
+  return out;
+}
+
+/** Comparison key, same as lessons_sync.cjs norm(): no bullet, no leading [date], lower-case, single spaces, no final period. */
+function normLine(line) {
+  return String(line).replace(BULLET_RE, '').replace(/^\[\d{4}-\d{2}-\d{2}\]\s*/, '')
+    .replace(/\s+/g, ' ').trim().replace(/[.\s]+$/, '').toLowerCase();
+}
+
+/** Bullets of srcTxt whose key is not in `have` (and not repeated inside srcTxt). */
+function newBullets(srcTxt, have) {
+  const seen = new Set(have);
+  const out = [];
+  for (const l of bulletsOf(srcTxt)) {
+    const k = normLine(l);
+    if (!k || seen.has(k)) continue;
+    seen.add(k);
+    out.push(l);
+  }
+  return out;
+}
+
+/** Text with `lines` appended after its last line (one newline between). */
+function appendLines(txt, lines) {
+  return `${txt.replace(/\n*$/, '\n')}${lines.join('\n')}\n`;
+}
+
+/**
+ * seedProfile(srcDir, dstDir, { dryRun }) — srcDir: <pkg>/profile, dstDir: <skill>/profile (phải đã tồn tại).
+ * → { src, dst, dry_run, skipped?, lessons: {action, added}, published: {action}, unity_lanes: {action, diff} }
+ * action: lessons copied|appended|unchanged; published written|appended|unchanged; unity_lanes copied|kept|unchanged.
+ */
+function seedProfile(srcDir, dstDir, opts) {
+  const dry = !!(opts && opts.dryRun);
+  const res = {
+    src: srcDir, dst: dstDir, dry_run: dry,
+    lessons: { action: 'unchanged', added: 0 }, published: { action: 'unchanged' }, unity_lanes: { action: 'unchanged', diff: 0 },
+  };
+  const srcL = readLF(path.join(srcDir, 'lessons.md'));
+  if (srcL === null) return Object.assign(res, { skipped: 'no-package-lessons' });
+  if (!fs.existsSync(dstDir) || !fs.statSync(dstDir).isDirectory()) return Object.assign(res, { skipped: 'no-skill-profile' });
+
+  // lessons.md
+  const dstFile = path.join(dstDir, 'lessons.md');
+  const dstL = readLF(dstFile);
+  let lessonsOut = null;
+  if (dstL === null) {
+    lessonsOut = srcL;
+    res.lessons = { action: 'copied', added: bulletsOf(srcL).length };
+  } else {
+    const add = newBullets(srcL, new Set(bulletsOf(dstL).map(normLine)));
+    if (add.length) {
+      lessonsOut = appendLines(dstL, add);
+      res.lessons = { action: 'appended', added: add.length };
+    }
+  }
+
+  // .lessons.published.md
+  const pubFile = path.join(dstDir, PUBLISHED);
+  const pubOld = readLF(pubFile);
+  let pubOut = null;
+  if (pubOld === null) {
+    pubOut = srcL;
+    res.published = { action: 'written' };
+  } else {
+    const add = newBullets(srcL, new Set(bulletsOf(pubOld).map(normLine)));
+    if (add.length) {
+      pubOut = appendLines(pubOld, add);
+      res.published = { action: 'appended' };
+    }
+  }
+
+  // unity-lanes.md
+  const srcU = readLF(path.join(srcDir, UNITY));
+  let unityOut = null;
+  if (srcU !== null) {
+    const dstU = readLF(path.join(dstDir, UNITY));
+    if (dstU === null) {
+      unityOut = srcU;
+      res.unity_lanes = { action: 'copied', diff: srcU.split('\n').filter((l) => l.trim()).length };
+    } else if (dstU !== srcU) {
+      const have = new Set(dstU.split('\n'));
+      res.unity_lanes = { action: 'kept', diff: srcU.split('\n').filter((l) => l.trim() && !have.has(l)).length };
+    }
+  }
+
+  if (!dry) {
+    if (lessonsOut !== null) core.writeFileAtomic(dstFile, lessonsOut);
+    if (pubOut !== null) core.writeFileAtomic(pubFile, pubOut);
+    if (unityOut !== null) core.writeFileAtomic(path.join(dstDir, UNITY), unityOut);
+  }
+  return res;
+}
+
+/** Dòng tóm tắt tiếng Việt cho `setup` (không in nội dung dòng). */
+function seedSummary(res) {
+  if (res.skipped) {
+    return res.skipped === 'no-package-lessons'
+      ? 'Profile gói npm: không có (chạy từ bản đã đóng gói mới có lessons đã tuyển)'
+      : 'Profile gói npm: bỏ qua (không thấy profile/ của skill)';
+  }
+  const tag = res.dry_run ? ' (dry-run, không ghi)' : '';
+  const L = res.lessons.action === 'copied' ? `lessons.md chép mới (${res.lessons.added} dòng bài học)`
+    : res.lessons.action === 'appended' ? `lessons.md thêm ${res.lessons.added} dòng mới của bản tuyển`
+      : 'lessons.md không đổi';
+  const U = res.unity_lanes.action === 'copied' ? 'unity-lanes.md chép mới'
+    : res.unity_lanes.action === 'kept' ? `unity-lanes.md giữ bản cài (khác ${res.unity_lanes.diff} dòng so với gói; không ghi đè)`
+      : 'unity-lanes.md không đổi';
+  const P = res.published.action === 'appended' ? '; .lessons.published.md cộng thêm dòng đã tuyển'
+    : res.published.action === 'written' ? '; .lessons.published.md ghi mới' : '';
+  return `Profile: ${L}; ${U}${P}${tag}`;
+}
+
+module.exports = { PUBLISHED, BULLET_RE, bulletsOf, normLine, seedProfile, seedSummary };

package/lib/profile.cjs

@@ -11,6 +11,11 @@
 //                                 the proposal plus those lines (each after the line it followed, else at the end);
 //                               - lessons.md lines edited/deleted since base, or profile.json changed at all → stop,
 //                                 exit 2, write nothing (the user decides).
+//   profile scan [--dir <profile>]   regex scan for secrets / machine data (profile-scan.cjs); exit 2 on a hit.
+//   profile publish --to <repo>/skill/profile [--curated <file>] [--include-local] [--dry-run]
+//                               copy the installed curated profile into the repo, minus this machine's own lines, after a scan.
+//                               `apply` records what the retro approved in profile/.lessons.curated.md; a lessons.md line
+//                               that is in neither .lessons.published.md nor that record is machine-local and is left out.
 // `>>` appenders take no lock: the live file is re-read right before the renames and the merge redone if it moved
 // (up to 5 times). What is left is the sub-millisecond gap between that last read and the rename.
 
@@ -18,6 +23,7 @@ const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
 const core = require('../hook.cjs');
+const { BULLET_RE, bulletsOf, normLine } = require('./profile-seed.cjs');
 
 const BASE_DIR = 'profile-base';
 const FILES = { lessons: 'lessons.md', profile: 'profile.json' };
@@ -31,7 +37,16 @@ const HELP = `Cách dùng: dieu-phoi profile <lệnh> [--skill-dir P] [--json]
   apply --base <thư mục> [--lessons <file đề xuất>] [--profile <file đề xuất>] [--dry-run]
                          áp retro đã duyệt, dưới khoá profile/profile.lock. File chưa đổi từ base → ghi đề xuất.
                          lessons.md chỉ có dòng THÊM MỚI (phiên khác >> bài học) → tự gộp các dòng đó vào đề xuất.
-                         lessons.md có dòng cũ bị sửa/xoá, hoặc profile.json đã đổi → dừng, exit 2, không ghi gì`;
+                         lessons.md có dòng cũ bị sửa/xoá, hoặc profile.json đã đổi → dừng, exit 2, không ghi gì
+                         (ghi thêm profile/.lessons.curated.md = các dòng bài học retro đã duyệt, cho profile publish)
+  scan [--dir <profile>]  quét lessons.md, profile.json, unity-lanes.md tìm đường dẫn tuyệt đối, IPv4, email, URL ký, tiền tố
+                         token, KEY/TOKEN/SECRET/PASSWORD=<giá trị>, chuỗi hex/base64 dài. In file:dòng:loại, KHÔNG in giá trị;
+                         exit 2 khi có chỗ nghi ngờ. Dương tính giả đã biết nằm trong ALLOW của lib/profile-scan.cjs (kèm lý do)
+  publish --to <repo>/skill/profile [--curated <file>[,<file>]] [--include-local] [--dry-run]
+                         chép profile đã cài (lessons.md, profile.json, unity-lanes.md) sang repo: bỏ dòng bài học riêng của máy
+                         (không có trong .lessons.published.md và không nằm trong .lessons.curated.md / --curated), chuẩn hoá LF,
+                         quét secret TRƯỚC khi ghi (có chỗ nghi ngờ → exit 2, không ghi gì), in tóm tắt khác biệt.
+                         Không commit, không push, không đụng Hub: người dùng đọc \`git diff -- skill/profile\` rồi quyết định`;
 
 const sha = (txt) => crypto.createHash('sha256').update(txt, 'utf8').digest('hex');
 const lf = (txt) => String(txt).replace(/^/, '').replace(/\r\n/g, '\n');
@@ -179,6 +194,7 @@ function cmdApply(opts) {
 `);
       if (todo.some((w) => readText(path.join(dir, w.f)) !== w.cur)) continue; // a `>>` landed while we merged: redo
       for (const w of todo) core.writeFileAtomic(path.join(dir, w.f), w.text);
+      if (props.lessons !== undefined) recordCurated(dir, props.lessons);
       written = true;
       break;
     }
@@ -193,11 +209,135 @@ function cmdApply(opts) {
   return { code: 0, out: `${dry ? '(dry-run — không ghi gì)\n' : ''}profile ${slash(dir)}:\n${lines.join('\n')}` };
 }
 
+// ---------------------------------------------------------------- scan / publish (0.7.2)
+
+const PUBLISHED = '.lessons.published.md'; // written by tools/lessons_sync.cjs update
+const CURATED = '.lessons.curated.md'; // written by profile apply: the bullets a retro approved
+const PUBLISH_FILES = ['lessons.md', 'profile.json', 'unity-lanes.md'];
+const LOCAL_MARK = /^\s*<!--\s*dòng riêng của máy/;
+
+/** apply → remember which lessons bullets the retro approved, so publish can tell them from machine-local `>>` lines. */
+function recordCurated(dir, proposalTxt) {
+  const file = path.join(dir, CURATED);
+  const old = readText(file);
+  const have = new Set(bulletsOf(old).map(normLine));
+  const add = bulletsOf(proposalTxt).filter((l) => !have.has(normLine(l)));
+  if (!add.length && old !== null) return;
+  const head = old === null ? '# dòng bài học retro đã duyệt (profile apply ghi; profile publish đọc) — đừng sửa tay\n' : old.replace(/\n*$/, '\n');
+  core.writeFileAtomic(file, `${head}${add.join('\n')}${add.length ? '\n' : ''}`);
+}
+
+function cmdScan(opts) {
+  const sc = require('./profile-scan.cjs');
+  const dir = typeof opts.dir === 'string' ? path.resolve(core.nativePath(opts.dir)) : profileDir(opts);
+  if (!fs.existsSync(dir)) return { code: 1, out: `không thấy thư mục ${slash(dir)}` };
+  const r = sc.scanProfile(dir);
+  const code = r.clean ? 0 : 2;
+  if (opts.json) return { code, out: JSON.stringify({ dir: slash(dir), files: r.files, clean: r.clean, hits: r.hits, skipped: r.skipped }, null, 2) };
+  return { code, out: sc.formatScan(r, dir) };
+}
+
+/** Multiset line diff: how many lines of `next` are new / gone compared with `prev` (order ignored). */
+function lineDelta(prev, next) {
+  const count = new Map();
+  for (const l of String(prev || '').split('\n')) count.set(l, (count.get(l) || 0) + 1);
+  let added = 0;
+  for (const l of String(next).split('\n')) {
+    const n = count.get(l) || 0;
+    if (n > 0) count.set(l, n - 1); else added++;
+  }
+  let removed = 0;
+  for (const n of count.values()) removed += n;
+  return { added, removed };
+}
+
+function dropLines(txt, drop) {
+  const out = [];
+  let after = false; // the previous line was dropped: do not leave two blank lines behind
+  for (const raw of txt.split('\n')) {
+    const key = BULLET_RE.test(raw) ? raw.trim() : null;
+    if (LOCAL_MARK.test(raw) || (key !== null && drop.has(key))) { after = true; continue; }
+    if (after && raw.trim() === '' && out.length && out[out.length - 1].trim() === '') continue;
+    after = false;
+    out.push(raw);
+  }
+  return out.join('\n');
+}
+
+function cmdPublish(opts) {
+  if (typeof opts.to !== 'string' || !opts.to.trim()) return { code: 1, out: 'profile publish cần --to <repo>/skill/profile (thư mục profile của repo).' };
+  const to = path.resolve(core.nativePath(opts.to));
+  if (!fs.existsSync(to) || !fs.statSync(to).isDirectory()) return { code: 1, out: `--to không phải thư mục: ${slash(to)}` };
+  const from = profileDir(opts);
+  if (path.resolve(from).toLowerCase() === to.toLowerCase()) return { code: 1, out: '--to trùng thư mục profile đã cài.' };
+  const sc = require('./profile-scan.cjs');
+  const dry = !!opts['dry-run'];
+
+  const installed = readText(path.join(from, 'lessons.md'));
+  if (installed === null) return { code: 1, out: `không thấy ${slash(path.join(from, 'lessons.md'))}` };
+  const published = readText(path.join(from, PUBLISHED));
+  const keys = new Set(bulletsOf(published === null ? installed : published).map(normLine));
+  const curatedFiles = [path.join(from, CURATED)];
+  if (typeof opts.curated === 'string') curatedFiles.push(...opts.curated.split(',').map((f) => path.resolve(core.nativePath(f.trim()))).filter(Boolean));
+  for (const f of curatedFiles) {
+    const t = readText(f);
+    if (t === null) { if (f !== curatedFiles[0]) return { code: 1, out: `không thấy file --curated ${slash(f)}` }; continue; }
+    for (const l of bulletsOf(t)) keys.add(normLine(l));
+  }
+  const local = [];
+  const seen = new Set();
+  for (const l of bulletsOf(installed)) {
+    const k = normLine(l);
+    if (keys.has(k) || seen.has(k)) continue;
+    seen.add(k);
+    local.push(l);
+  }
+  const drop = opts['include-local'] ? new Set() : new Set(local);
+
+  const texts = {};
+  texts['lessons.md'] = dropLines(installed, drop);
+  for (const f of PUBLISH_FILES.slice(1)) {
+    const t = readText(path.join(from, f));
+    if (t !== null) texts[f] = t;
+  }
+  const scan = sc.scanProfile(texts);
+  const files = Object.entries(texts).map(([f, t]) => {
+    const prev = readText(path.join(to, f));
+    return Object.assign({ file: f, same: prev === t, new: prev === null }, prev === t ? { added: 0, removed: 0 } : lineDelta(prev, t));
+  });
+  const res = {
+    from: slash(from), to: slash(to), dry_run: dry, published_record: published !== null,
+    local_lines: local.length, local_excluded: opts['include-local'] ? 0 : local.length,
+    local_preview: local.map((l) => `${l.replace(BULLET_RE, '').replace(/\s+/g, ' ').slice(0, 70)}…`),
+    scan: { clean: scan.clean, hits: scan.hits, skipped: scan.skipped }, files, written: false,
+  };
+  if (!scan.clean) {
+    res.stopped = 'scan';
+    if (opts.json) return { code: 2, out: JSON.stringify(res, null, 2) };
+    return { code: 2, out: `DỪNG — không ghi gì:\n${sc.formatScan(scan, from)}\nSửa file đã cài (hoặc thêm dương tính giả có lý do vào ALLOW) rồi publish lại.` };
+  }
+  if (!dry) {
+    for (const f of files.filter((x) => !x.same)) core.writeFileAtomic(path.join(to, f.file), texts[f.file]);
+    res.written = true;
+  }
+  if (opts.json) return { code: 0, out: JSON.stringify(res, null, 2) };
+  const L = [`${dry ? '(dry-run — không ghi gì)\n' : ''}profile publish ${slash(from)} → ${slash(to)}`];
+  for (const f of files) L.push(`  ${f.same ? '=' : (dry ? '~' : '✓')} ${f.file}${f.same ? ' (không đổi)' : ` (+${f.added} −${f.removed} dòng${f.new ? ', file mới' : ''})`}`);
+  if (!res.published_record) L.push(`  ! thiếu ${PUBLISHED}: không phân biệt được dòng riêng của máy — coi mọi dòng là đã tuyển`);
+  L.push(`  dòng riêng của máy: ${local.length}${opts['include-local'] ? ' (--include-local: vẫn chép)' : local.length ? ' — bỏ ra, không chép:' : ''}`);
+  if (!opts['include-local']) for (const p of res.local_preview) L.push(`    - ${p}`);
+  L.push(`  scan: ${scan.clean ? 'sạch' : 'CÓ'}${scan.skipped.length ? `, bỏ qua ${scan.skipped.length} dương tính giả (${scan.skipped.map((x) => `${x.file}:${x.line}:${x.kind}`).join(', ')})` : ''}`);
+  L.push('  Kế tiếp: đọc `git diff -- skill/profile` trong repo (tên khách hàng/người/dự án mật mà regex không bắt được), rồi mới commit.');
+  return { code: 0, out: L.join('\n') };
+}
+
 function cmdProfile(opts) {
   const sub = opts._.shift();
   if (!sub || opts.help || opts.h || sub === 'help') return { code: sub || opts.help || opts.h ? 0 : 1, out: HELP };
   if (sub === 'base') return cmdBase(opts);
   if (sub === 'apply') return cmdApply(opts);
+  if (sub === 'scan') return cmdScan(opts);
+  if (sub === 'publish') return cmdPublish(opts);
   return { code: 1, out: `Lệnh profile lạ: ${sub}\n\n${HELP}` };
 }
 

package/lib/prune.cjs

@@ -55,17 +55,24 @@ function human(n) {
   return `${n} B`;
 }
 
+// contract/steps/plan/handoff files of a run dir: the record of what was planned and handed over (never pruned)
+const KEEP_RE = /^(?:contract-r.*\.md|steps-r.*\.json|plan.*\.md|handoff-.*\.md)$/;
+const DELTA_RE = /^knowledge-delta.*\.md$/i;
+
 /**
  * Files to keep in a run dir: retro-*.md + per task/role the highest-try result AND the newest-by-mtime result
  * (dp-out, legacy or .inline.md). A re-run can write a lower try number later (e.g. try1 after a blocked try5),
  * so the try number alone can pick a stale attempt. `mtimeOf(name)` is optional; without it only the highest try is kept.
  */
-function keepSet(names, mtimeOf) {
+function keepSet(names, mtimeOf, unmerged) {
   const keep = new Set();
   const best = new Map(); // task|role -> max try
   const parsed = [];
   for (const n of names) {
     if (/^retro-.*\.md$/.test(n)) { keep.add(n); continue; }
+    if (KEEP_RE.test(n)) { keep.add(n); continue; }
+    // a delta no store has applied yet is still work to merge; a merged one is only history
+    if (DELTA_RE.test(n)) { if (typeof unmerged !== 'function' || unmerged(n)) keep.add(n); continue; }
     const inline = /\.inline\.md$/.test(n); // hook fallback copy: only written when the agent wrote no dp-out
     let m = OUT_RE.exec(n);
     let task; let role; let tr;
@@ -113,7 +120,10 @@ function taskIdsOfDir(id, names, plansDir) {
 }
 
 /** Eligible run dirs: every event of its tasks ≤ cutoff and every dispatched task has a user verdict (or was discarded). */
-function planRuns(ctx, events, cutoffMs, protect) {
+function planRuns(ctx, events, cutoffMs, protect, popts) {
+  const po = popts || {};
+  const nowMs = typeof po.now === 'number' ? po.now : Date.now();
+  const cls = core.deltaClassifier(events, ctx.paths.plans);
   const runs = core.runsDir();
   const byTask = new Map();
   for (const e of events) {
@@ -124,9 +134,17 @@ function planRuns(ctx, events, cutoffMs, protect) {
   const out = { prune: [], skipped: [] };
   let dirs = [];
   try { dirs = fs.readdirSync(runs, { withFileTypes: true }); } catch (_) { return out; }
+  let applied = null; // sha256 of every delta a knowledge store has applied (read once, lazily)
+  const appliedSet = () => {
+    if (!applied) {
+      applied = new Set();
+      try { for (const st of core.storeCatalog()) for (const h of st.applied) applied.add(h); } catch (_) { /* none known: keep every delta */ }
+    }
+    return applied;
+  };
   for (const d of dirs) {
     const id = d.name;
-    if (!d.isDirectory() || !RUN_ID_RE.test(id)) continue;
+    if (!d.isDirectory() || !RUN_ID_RE.test(id) || id.startsWith('_')) continue; // _archive is ours, not a run
     const dir = path.join(runs, id);
     if (!inside(runs, dir)) continue;
     const names = fs.readdirSync(dir);
@@ -155,17 +173,34 @@ function planRuns(ctx, events, cutoffMs, protect) {
       }
     }
     if (reason) { out.skipped.push({ id, reason }); continue; }
-    const keep = keepSet(names, (n) => { try { return fs.lstatSync(path.join(dir, n)).mtimeMs; } catch (_) { return 0; } });
+    const unmerged = (n) => {
+      let text = null;
+      try { text = fs.readFileSync(path.join(dir, n), 'utf8'); } catch (_) { return true; }
+      return !appliedSet().has(core.deltaHash(text));
+    };
+    const keep = keepSet(names, (n) => { try { return fs.lstatSync(path.join(dir, n)).mtimeMs; } catch (_) { return 0; } }, unmerged);
+    // retro 11-05 K1: an unmerged delta older than 30 d that the user never judged is history, not work: move it to
+    // runs/_archive/deltas/<run>/ (never deleted) so it stops being kept here and warned about.
+    const archive = [];
+    for (const n of names) {
+      if (!DELTA_RE.test(n) || !keep.has(n) || !unmerged(n)) continue;
+      let m = 0;
+      try { m = fs.lstatSync(path.join(dir, n)).mtimeMs; } catch (_) { continue; }
+      if (nowMs - m > core.DELTA_WINDOW_MS && cls.deltaState(id, core.deltaTagOf(n)) === null) archive.push(n);
+    }
+    for (const n of archive) keep.delete(n);
+    const keepDeltas = names.filter((n) => DELTA_RE.test(n) && keep.has(n)).length;
     const del = [];
     let delBytes = 0; let keepBytes = 0;
     for (const n of names) {
       const p = path.join(dir, n);
+      if (archive.includes(n)) continue;
       if (keep.has(n) || (protect && path.resolve(p) === protect)) { keepBytes += sizeOf(p); continue; }
       const b = sizeOf(p);
       del.push({ name: n, bytes: b });
       delBytes += b;
     }
-    out.prune.push({ id, dir, tasks, keep: Array.from(keep).sort(), del, delete_bytes: delBytes, keep_bytes: keepBytes });
+    out.prune.push({ id, dir, tasks, keep: Array.from(keep).sort(), keep_deltas: keepDeltas, archive, del, delete_bytes: delBytes, keep_bytes: keepBytes });
   }
   return out;
 }
@@ -255,7 +290,7 @@ function cmdPrune(opts) {
   const cut = cutoffOf(retro);
   const { lines } = fs.existsSync(ctx.paths.events) ? eventLines(ctx) : { lines: [] };
   const allEvents = core.readEvents(ctx);
-  const rp = planRuns(ctx, allEvents, cut.ms, retro);
+  const rp = planRuns(ctx, allEvents, cut.ms, retro, { now: typeof opts.now === 'number' ? opts.now : undefined });
   const prunedTasks = new Set();
   for (const r of rp.prune) for (const t of r.tasks) prunedTasks.add(t);
   const plans = badPlans(ctx);
@@ -273,7 +308,7 @@ function cmdPrune(opts) {
 
   const report = {
     mode: yes ? 'apply' : 'dry-run', retro, cutoff: new Date(cut.ms).toISOString(), cutoff_source: cut.source,
-    runs: rp.prune.map((r) => ({ id: r.id, delete_files: r.del.length, delete_bytes: r.delete_bytes, keep: r.keep, keep_bytes: r.keep_bytes })),
+    runs: rp.prune.map((r) => ({ id: r.id, delete_files: r.del.length, delete_bytes: r.delete_bytes, keep: r.keep, keep_deltas: r.keep_deltas, archive_deltas: r.archive.length, keep_bytes: r.keep_bytes })),
     runs_skipped: rp.skipped.length,
     skipped_reasons: rp.skipped.reduce((a, s) => { const k = s.reason.replace(/task \S+/, 'task *').replace(/\(task \S+\)/, ''); a[k] = (a[k] || 0) + 1; return a; }, {}),
     bad_plans: plans.map((p) => ({ name: p.name, bytes: p.bytes })),
@@ -281,6 +316,7 @@ function cmdPrune(opts) {
   };
   report.totals = {
     run_dirs: rp.prune.length,
+    archive_deltas: rp.prune.reduce((n, r) => n + r.archive.length, 0),
     files: rp.prune.reduce((n, r) => n + r.del.length, 0),
     bytes: rp.prune.reduce((n, r) => n + r.delete_bytes, 0) + plans.reduce((n, p) => n + p.bytes, 0),
   };
@@ -331,6 +367,18 @@ function cmdPrune(opts) {
         try { fs.unlinkSync(ctx.paths.lock); } catch (_) { /* gone */ }
       }
     }
+    // 2a. unmerged deltas older than 30 d without a user verdict -> runs/_archive/deltas/<run>/ (moved, not deleted)
+    for (const r of rp.prune) {
+      for (const n of r.archive) {
+        const from = path.join(r.dir, n);
+        const toDir = path.join(runs, '_archive', 'deltas', r.id);
+        if (!inside(r.dir, from) || !inside(runs, toDir)) continue;
+        fs.mkdirSync(toDir, { recursive: true });
+        let to = path.join(toDir, n);
+        if (fs.existsSync(to)) to = path.join(toDir, `${Date.now()}-${n}`);
+        core.renameWithRetry(from, to);
+      }
+    }
     // 2. run dirs
     for (const r of rp.prune) {
       for (const f of r.del) {
@@ -348,7 +396,7 @@ function cmdPrune(opts) {
   const L = [];
   L.push(`prune ${yes ? '(ĐÃ THỰC HIỆN)' : '(dry-run — thêm --yes để thực hiện)'}: mốc cắt ${report.cutoff} (${cut.source}) từ ${retro}`);
   L.push(`Run dir: ${rp.prune.length} sẽ dọn, ${rp.skipped.length} giữ nguyên (còn mở / sau mốc)`);
-  for (const r of rp.prune) L.push(`  ${r.id}: xoá ${r.del.length} mục (${human(r.delete_bytes)}), giữ ${r.keep.length} (${human(r.keep_bytes)})`);
+  for (const r of rp.prune) L.push(`  ${r.id}: xoá ${r.del.length} mục (${human(r.delete_bytes)}), giữ ${r.keep.length} (${human(r.keep_bytes)}), trong đó delta chưa gộp ${r.keep_deltas}${r.archive.length ? `; chuyển ${r.archive.length} delta >30 ngày chưa có verdict sang _archive/deltas/` : ''}`);
   L.push(`Plan hỏng: ${plans.length} (${human(plans.reduce((n, p) => n + p.bytes, 0))})${plans.length ? ` — ${plans.map((p) => p.name).join(', ')}` : ''}`);
   L.push(`events.jsonl: ${moving.length}/${lines.length} dòng → archive/events-${archiveToday()}.jsonl.gz (${human(evBytes)})${heldBack ? `; ${heldBack} dòng chưa đẩy lên sink nên giữ lại` : ''}; không xoá dòng nào`);
   L.push(`Tổng xoá khỏi đĩa: ${report.totals.files} mục run dir + ${plans.length} plan = ${human(report.totals.bytes)}`);

package/lib/setup.cjs

@@ -4,10 +4,16 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const core = require('../hook.cjs');
+const { seedProfile } = require('./profile-seed.cjs');
 
 const PKG_ROOT = path.join(__dirname, '..');
 const MARKER = 'dieu-phoi/bin/hook.cjs';
 
+/** <pkg>/profile (mang lessons đã tuyển); DIEU_PHOI_TEST_PROFILE_SRC chỉ để test trỏ tới thư mục khác. */
+function profileSrcDir() {
+  return process.env.DIEU_PHOI_TEST_PROFILE_SRC || path.join(PKG_ROOT, 'profile');
+}
+
 function tsStamp(d) {
   const x = d || new Date();
   const p = (n) => String(n).padStart(2, '0');
@@ -322,17 +328,36 @@ function removeAgents(claudeDir) {
  * Install: copy hook + pricing, register hooks, write config.
  * opts: { claudeDir, dept, sinkUrl, sinkToken, skillDir }
  */
+/** Skill dir của lần cài này: --skill-dir, rồi skill_dir đã nhớ trong config (còn hợp lệ), rồi tìm dưới claudeDir. */
+function skillDirOfInstall(opts, claudeDir, home) {
+  let skillDir = opts.skillDir ? path.resolve(opts.skillDir) : null;
+  if (!skillDir) {
+    const cfg = core.loadConfig(home);
+    if (cfg.skill_dir && fs.existsSync(path.join(cfg.skill_dir, 'profile', 'profile.json'))) skillDir = cfg.skill_dir;
+  }
+  return skillDir || findSkillDir(claudeDir);
+}
+
 function setup(opts) {
   const claudeDir = path.resolve(opts.claudeDir);
   const home = path.join(claudeDir, 'dieu-phoi');
   const paths = core.pathsFor(home);
+  if (opts.dryRun) {
+    // --dry-run: chỉ báo phần profile sẽ gộp; không ghi hook, settings, agent hay config
+    const sd = skillDirOfInstall(opts, claudeDir, home);
+    return {
+      dry_run: true, home, settings: path.join(claudeDir, 'settings.json'), skill_dir: sd ? toSlash(sd) : null,
+      profile: sd ? seedProfile(profileSrcDir(), path.join(sd, 'profile'), { dryRun: true }) : { skipped: 'no-skill-dir' },
+    };
+  }
   fs.mkdirSync(paths.bin, { recursive: true });
   fs.mkdirSync(paths.data, { recursive: true });
 
   // 1. hook + pricing (LF, self-contained)
-  for (const f of ['hook.cjs', 'pricing.json']) {
+  // s16: lib/procs.cjs rides along as bin/procs.cjs (the hook requires ./procs.cjs for the leftover-process scan)
+  for (const [f, dest] of [['hook.cjs', 'hook.cjs'], ['pricing.json', 'pricing.json'], [path.join('lib', 'procs.cjs'), 'procs.cjs']]) {
     const src = fs.readFileSync(path.join(PKG_ROOT, f), 'utf8').replace(/\r\n/g, '\n');
-    core.writeFileAtomic(path.join(paths.bin, f), src);
+    core.writeFileAtomic(path.join(paths.bin, dest), src);
   }
 
   // 2. config
@@ -340,15 +365,13 @@ function setup(opts) {
   if (opts.dept !== undefined) cfg.dept = String(opts.dept);
   if (opts.sinkUrl !== undefined) cfg.sink_url = String(opts.sinkUrl);
   if (opts.sinkToken !== undefined) cfg.sink_token = String(opts.sinkToken);
-  let skillDir = opts.skillDir ? path.resolve(opts.skillDir) : null;
-  if (!skillDir && cfg.skill_dir && fs.existsSync(path.join(cfg.skill_dir, 'profile', 'profile.json'))) {
-    skillDir = cfg.skill_dir;
-  }
-  if (!skillDir) skillDir = findSkillDir(claudeDir);
+  const skillDir = skillDirOfInstall(opts, claudeDir, home);
   if (skillDir) {
     cfg.skill_dir = toSlash(skillDir);
     cfg.skill_version = skillVersionOf(skillDir) || cfg.skill_version || null;
   }
+  // 2b. lessons đã tuyển của gói → profile đã cài (chỉ thêm dòng mới; dòng riêng của máy giữ nguyên)
+  const profile = skillDir ? seedProfile(profileSrcDir(), path.join(skillDir, 'profile'), {}) : { skipped: 'no-skill-dir' };
   if (!cfg.user_hash) cfg.user_hash = core.computeUserHash();
   cfg.core_version = core.CORE_VERSION;
   if (!cfg.installed_at) cfg.installed_at = core.nowIso();
@@ -391,6 +414,7 @@ function setup(opts) {
     permissions: perms,
     legacy_permissions_removed: legacyRemoved,
     config: cfg,
+    profile,
   };
 }