@lore-co/cli 0.1.0

package/LICENSE

@@ -0,0 +1,110 @@
+# Functional Source License, Version 1.1
+
+## Abbreviation
+
+FSL-1.1-MIT
+
+## Notice
+
+Copyright (c) 2026 Treadie, Inc
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the MIT license that is effective on the second anniversary of the date we make
+the Software available. On or after that date, you may use the Software under
+the MIT license, in which case the following will apply:
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,218 @@
+# Lore CLI
+
+The Lore connector installs native Codex and Claude Code lifecycle hooks. Every
+prompt retrieves relevant engineering context. A first prompt is observed on
+its own; later prompts are paired with the previous assistant response so Lore
+can capture explicit corrections.
+
+## Connect
+
+```sh
+curl -fsSL https://raw.githubusercontent.com/treadiehq/lore/main/scripts/install.sh | bash
+lore connect \
+  --url https://lore.example.com \
+  --token "$LORE_TOKEN"
+```
+
+The standalone binary supports macOS and Linux on x64 and arm64. Downloads are
+verified against the release SHA-256 manifest and do not require a JavaScript
+runtime. Use `lore update` to install a newer release.
+
+The npm package remains available for JavaScript-based environments:
+
+```sh
+npx @lore-co/cli connect \
+  --url https://lore.example.com \
+  --token "$LORE_TOKEN"
+```
+
+Only the npm package scope is `@lore-co`; the installed executable and every
+command remain `lore`.
+
+`connect` auto-detects `codex` and `claude`. Use `--agent codex` or
+`--agent claude` for an explicit headless install. Configuration is stored in
+`~/.lore/config.json` with mode `0600`.
+
+The command merges Lore-owned entries into `~/.codex/hooks.json` and
+`~/.claude/settings.json`. Existing settings and hooks are retained, changed
+files receive timestamped backups, and rerunning `connect` does not duplicate
+entries.
+
+## Inspect or remove
+
+```sh
+lore status
+lore doctor
+lore disconnect
+```
+
+All commands also support `--json`. `disconnect` removes only hook handlers
+marked as Lore-owned, then deletes Lore's credential, legacy hook runtime,
+pending state, and retry queue. It does not remove the installed `lore` binary
+or restore a whole backup over newer agent settings.
+
+## Runtime behavior
+
+The hook handler:
+
+- reads native hook JSON from standard input;
+- observes and enriches the first prompt in a new session;
+- uses `last_assistant_message`, not a potentially stale transcript;
+- stores pending state and failed turn requests under `~/.lore`;
+- retries one queued request on a later prompt;
+- redacts common API keys, bearer tokens, passwords, and private keys;
+- times out network calls and always fails open without writing hook errors.
+
+First prompts use `POST /v1/observations` and audited
+`POST /v1/context/deliveries`. Paired turns use `POST /v1/turns` with a
+workspace bearer token and an `Idempotency-Key` header. Teachings default to
+workspace scope so connected agents can share them; the inferred repository
+still guides task retrieval. A correction made in one native repository is
+therefore workspace-global by default; only an integration that supplies a
+narrower learning scope changes that behavior. Observations, paired turns, and
+deliveries are visible through Lore activity.
+
+## External hosts
+
+`lore host` gives local services and CI jobs a noninteractive bridge to the
+strict audited endpoints:
+
+```sh
+LORE_API_URL=http://localhost:3004 \
+LORE_WORKSPACE_TOKEN=... \
+  lore host deliver --input delivery.json --output prompt
+
+cat webhook-observation.json |
+  lore host observe --input - --output json
+
+lore host turn --input incident-turn.json \
+  --idempotency-key incident-42:reply-3 \
+  --output prompt
+```
+
+`deliver`, `observe`, and `turn` accept the exact JSON bodies for
+`POST /v1/context/deliveries`, `POST /v1/observations`, and `POST /v1/turns`.
+There is no interactive or implicit-stdin fallback: pass `--input <file|->`.
+`json` output contains the complete audited response; `context` prints only
+returned context; `prompt` safely places that context before the original task
+or current user prompt. Standard output contains only the selected result.
+
+Authentication comes from `LORE_API_URL` plus `LORE_WORKSPACE_TOKEN` (or
+`LORE_TOKEN`), or `~/.lore/config.json`. Secret command-line flags are
+intentionally unavailable. Requests have a bounded timeout. Run
+`lore host --help` and `lore host turn --help` for endpoint-specific examples.
+Use stable connector, event, and session IDs from the calling model service,
+CI run, webhook, or incident; do not generate a new event ID when retrying.
+This bridge is a one-time host integration: the host must call it before and
+after model turns. `lore connect` cannot intercept an arbitrary external model
+API or bot by itself. The Lore web/wiki service is optional; the bridge needs
+only a reachable headless Lore API.
+
+## Devin sessions
+
+Create a Lore-enriched Devin session, then send later prompts through the same
+audited context-delivery path:
+
+```sh
+DEVIN_API_KEY=... DEVIN_ORG_ID=... \
+  lore devin start \
+  --repo owner/repository \
+  --prompt "Fix the failing tests"
+
+DEVIN_API_KEY=... DEVIN_ORG_ID=... \
+  lore devin prompt \
+  --session devin-session-id \
+  --repo owner/repository \
+  --prompt "Apply the reviewer correction"
+```
+
+Both commands retrieve Lore context with a stable delivery event and receipt.
+`devin start` registers the created session for transcript polling.
+`devin prompt` re-registers the session before sending, so a paused poller can
+capture the later correction. Prompts can also come from `--prompt-file` or
+explicit `--stdin`; `--project` narrows retrieval and polling. Use
+`--message-as-user-id` on `devin prompt` when Devin impersonation is configured.
+Later prompts entered directly in Devin's UI do not pass through Lore delivery
+and are not enriched. If the session was registered, transcript polling can
+still capture a correction after the fact.
+
+Lore credentials come from `LORE_API_URL` plus `LORE_WORKSPACE_TOKEN`, or from
+the stored `~/.lore/config.json`. Devin credentials come from `DEVIN_API_KEY`
+and `DEVIN_ORG_ID`. Credential flags are intentionally unavailable. Run
+`lore devin start --help` or `lore devin prompt --help` for copy-pasteable
+examples.
+
+## GitHub reviews
+
+Install Lore-owned Codex and Devin review workflows into the current
+repository:
+
+```sh
+OPENAI_API_KEY=... DEVIN_API_KEY=... DEVIN_ORG_ID=org-... \
+  lore connect github \
+  --repo owner/repository \
+  --configure-secrets
+```
+
+The installer copies trusted workflow and output-schema templates without
+committing them. Codex uses the official Codex action. Devin uses a normal v3
+session because the dedicated Devin Review API cannot accept dynamic Lore
+context. Reviews run only for same-repository, non-draft pull requests bearing
+the corresponding `lore:codex-review` or `lore:devin-review` label.
+
+Generated jobs download a pinned standalone release. Set repository variable
+`LORE_CLI_VERSION` to the release tag and, when using a fork, set
+`LORE_CLI_REPOSITORY` to its `owner/repository` value. The installer verifies
+the downloaded binary before each job invokes `lore` directly.
+
+The workflows require secret `LORE_WORKSPACE_TOKEN` and variable
+`LORE_API_URL`. Codex additionally requires secret `OPENAI_API_KEY`. Devin
+additionally requires secret `DEVIN_API_KEY` and variable `DEVIN_ORG_ID`.
+Review jobs use `contents: read` plus `pull-requests: write` so the workflow
+token can inspect and publish PR comments; the correction workflow has
+read-only GitHub permissions.
+Native `/devin review` cannot accept dynamic Lore context; the generated Lore
+workflow uses a normal capped Devin session instead. The optional managed
+plugin remains a closed-beta path controlled by Devin availability.
+
+An authorized maintainer can turn a false-positive bot comment into shared
+knowledge with:
+
+```text
+/lore correct <Lore bot comment URL>
+
+The correction and current behavior go here.
+```
+
+## Release acceptance
+
+From the repository root, deterministic unit/integration checks, browser
+acceptance, and package-consumer smoke are:
+
+```sh
+pnpm test
+pnpm typecheck
+pnpm build
+pnpm test:browser
+pnpm test:pack
+pnpm build:binary
+pnpm test:binary
+```
+
+Credential-gated live commands are explicit and separate:
+
+```sh
+RUN_NATIVE_AGENT_LIVE_TESTS=1 pnpm test:agents:live
+RUN_DEVIN_LIVE_TESTS=1 pnpm test:devin:live
+RUN_THREE_AGENT_CHAIN_LIVE_TESTS=RUN pnpm test:chain:live
+RUN_GITHUB_PR_LIVE_TESTS=1 pnpm test:github:live
+```
+
+The native command covers first prompts and real resumed later turns in both
+Claude and Codex. The chain command covers Claude → Devin → fresh Codex and
+Claude. Both paths, plus standalone Devin acceptance, have passed with real
+authenticated clients. Both GitHub review/correction paths passed target
+preflight and exact-head acceptance with a packed current artifact on August
+13, 2026. The current acceptance gate preflights a published standalone release.
+Rerun all live gates with customer credentials before rollout.
+Lore has no dream mode or company-wide search.

package/dist/cli.d.ts

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+import { type AgentName } from "./runtime.js";
+export interface LorePaths {
+    home: string;
+    loreDirectory: string;
+    config: string;
+    runtime: string;
+    runtimeRepository: string;
+    runtimePackage: string;
+    state: string;
+    queue: string;
+    codexHooks: string;
+    claudeSettings: string;
+}
+export interface ConnectorConfig {
+    version: 1;
+    apiUrl: string;
+    token: string;
+    agents: AgentName[];
+    connectedAt: string;
+    timeoutMs: number;
+}
+export declare function getLorePaths(home?: string): LorePaths;
+export declare function mergeLoreHooks(input: Record<string, unknown>, agent: AgentName, paths: LorePaths): Record<string, unknown>;
+export declare function removeLoreHooks(input: Record<string, unknown>): Record<string, unknown>;
+export declare function countLoreHooks(input: Record<string, unknown>): number;
+export declare function runCli(args?: readonly string[]): Promise<void>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAmBA,OAAO,EACL,KAAK,SAAS,EAEf,MAAM,cAAc,CAAC;AAWtB,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AA2HD,wBAAgB,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAerD;AA2DD,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE,SAAS,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiBzB;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsBzB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAiBrE;AA6mBD,wBAAsB,MAAM,CAC1B,IAAI,GAAE,SAAS,MAAM,EAA0B,GAC9C,OAAO,CAAC,IAAI,CAAC,CA8Cf"}