@merchantduo/code 0.3.0-beta.1 → 0.4.0-beta.1

package/dist/integrations/pi/context.js

@@ -13,7 +13,11 @@ export default function context(pi) {
         if (state.environmentStatus === "stopped") {
             refreshStatus(ctx, state);
             sessionEvents.emit("merchantduo.context", state);
-            pi.appendEntry("merchantduo.context", { environment: state.selected.name, environmentStatus: state.environmentStatus, permissionMode: state.permissionMode });
+            pi.appendEntry("merchantduo.context", {
+                environment: state.selected.name,
+                environmentStatus: state.environmentStatus,
+                permissionMode: state.permissionMode,
+            });
             return;
         }
         const record = (argv, result) => state.nativeLog.record(state.backend.command(argv), result);
@@ -23,27 +27,70 @@ export default function context(pi) {
         // Prefer non-Snap Chrome: Snap Chromium cannot write MerchantDuo artifacts
         // and its private /tmp makes generated output unavailable to the host.
         const hostRunner = new NodeHostProcessRunner();
-        const nativeHost = { run: async (file, args, options) => {
+        const nativeHost = {
+            run: async (file, args, options) => {
                 const result = await hostRunner.run(file, args, options);
-                await state.nativeLog.record({ file, args, cwd: options.cwd }, { stdout: result.output, stderr: "", exitCode: result.code, truncated: result.truncated ?? false });
+                await state.nativeLog.record({ file, args, cwd: options.cwd }, {
+                    stdout: result.output,
+                    stderr: "",
+                    exitCode: result.code,
+                    truncated: result.truncated ?? false,
+                });
                 return result;
-            } };
+            },
+        };
         const [http, browser] = await Promise.all([
             discoverHostExecutable(["curl"], nativeHost),
-            discoverHostExecutable(["google-chrome", "google-chrome-stable", "chromium", "chromium-browser"], nativeHost),
+            discoverHostExecutable([
+                "google-chrome",
+                "google-chrome-stable",
+                "chromium",
+                "chromium-browser",
+            ], nativeHost),
         ]);
         runtime.setMagerun2(magerun2);
-        runtime.setTesting(await discoverTesting(state.selected.environment, state.backend, ctx.cwd, { ...state.config.testing, ...state.selected.environment.testing, allowInsecureTls: state.selected.environment.testing?.allowInsecureTls ?? state.config.testing.allowInsecureTls }, { http, browser }, record));
+        runtime.setTesting(await discoverTesting(state.selected.environment, state.backend, ctx.cwd, {
+            ...state.config.testing,
+            ...state.selected.environment.testing,
+            allowInsecureTls: state.selected.environment.testing?.allowInsecureTls ??
+                state.config.testing.allowInsecureTls,
+        }, { http, browser }, record));
         refreshStatus(ctx, state);
         sessionEvents.emit("merchantduo.context", state);
-        pi.appendEntry("merchantduo.context", { environment: state.selected.name, environmentStatus: state.environmentStatus, permissionMode: state.permissionMode, testing: state.testing, magerun2: state.magerun2 });
+        pi.appendEntry("merchantduo.context", {
+            environment: state.selected.name,
+            environmentStatus: state.environmentStatus,
+            permissionMode: state.permissionMode,
+            testing: state.testing,
+            magerun2: state.magerun2,
+        });
     });
     pi.on("session_compact", () => runtime.resetInjection());
     pi.on("session_shutdown", () => sessionEvents.clear());
-    pi.registerCommand("duo-status", { description: "Show the current MerchantDuo session status.", handler: async (_args, ctx) => {
+    pi.registerCommand("duo-status", {
+        description: "Show the current MerchantDuo session status.",
+        handler: async (_args, ctx) => {
             const state = await runtime.boot(ctx.cwd);
-            pi.sendMessage({ customType: "merchantduo.status", content: statusMessage(state), display: true, details: {} });
-        } });
+            pi.sendMessage({
+                customType: "merchantduo.status",
+                content: statusMessage(state),
+                display: true,
+                details: {},
+            });
+        },
+    });
+    pi.registerCommand("duo-upgrade-core", {
+        description: "Assess available Magento core upgrades, present plans, and proceed after a chat selection.",
+        handler: async (_args, ctx) => {
+            const state = await runtime.boot(ctx.cwd);
+            if (state.environmentStatus === "stopped") {
+                ctx.ui.notify("Start the selected environment before assessing a Magento core upgrade.", "error");
+                return;
+            }
+            pi.sendUserMessage(coreUpgradePrompt(state));
+            ctx.ui.notify("Asked the agent to assess Magento core-upgrade plans from project and release evidence.", "info");
+        },
+    });
     pi.on("tool_call", (event) => {
         if (event.toolName !== "write" && event.toolName !== "edit")
             return;
@@ -61,12 +108,45 @@ export default function context(pi) {
         const state = await runtime.boot(ctx.cwd);
         const operatorRole = await loadOperatorRole();
         const testing = state.testing;
-        return { systemPrompt: `${event.systemPrompt}\n${merchantDuoSystemPrompt(operatorRole)}\nEnvironment: ${state.selected.name} is ${state.environmentStatus}; permission mode=${state.permissionMode}. ${state.environmentStatus === "stopped" ? "Use environment_start only after the user directly asks to start it; do not use project tools until it is running." : "Testing URLs are discovered but unverified. Frontend: " + (testing?.frontendUrl ?? "unavailable") + "; Admin: " + (testing?.adminUrl ?? "unavailable") + ". HTTP, browser, navigation, and test artifacts are host-only; never use environment bash to locate or repair their host paths. Use explicit test tools only when relevant."}` };
+        return {
+            systemPrompt: `${event.systemPrompt}\n${merchantDuoSystemPrompt(operatorRole)}\nEnvironment: ${state.selected.name} is ${state.environmentStatus}; permission mode=${state.permissionMode}. ${state.environmentStatus === "stopped" ? "Use environment_start only after the user directly asks to start it; do not use project tools until it is running." : "Testing URLs are discovered but unverified. Frontend: " + (testing?.frontendUrl ?? "unavailable") + "; Admin: " + (testing?.adminUrl ?? "unavailable") + ". HTTP, browser, navigation, and test artifacts are host-only; never use environment bash to locate or repair their host paths. Use explicit test tools only when relevant."}`,
+        };
     });
 }
+/**
+ * Algorithm: inspect the selected instance and authoritative release evidence without mutation;
+ * compare every newer core target against the instance; present plans; wait for one chat choice;
+ * then constrain later upgrade work to that selected target and the normal permission boundaries.
+ */
+export function coreUpgradePrompt(state) {
+    const current = [
+        state.magento.edition ?? "unknown edition",
+        state.magento.version ?? "version unavailable",
+        state.magento.phpVersion ? `PHP ${state.magento.phpVersion}` : undefined,
+    ]
+        .filter(Boolean)
+        .join(", ");
+    return `Start an agentic Magento core-upgrade assessment for the selected ${state.selected.name} environment. The current startup snapshot is ${current}; verify it from the real project before relying on it.
+
+This assessment phase is read-only. Do not edit files, change Composer dependencies, run Magento setup/deployment commands, enable maintenance mode, or make any other mutation before the merchant explicitly selects a plan below.
+
+First inspect the actual Magento instance: its edition and core package/version, root composer.json and composer.lock, Composer platform constraints, runtime PHP and relevant service requirements, custom app/code and themes, installed Composer packages, and third-party extension compatibility evidence. Never read, print, or expose deployment credentials or other secrets.
+
+Determine every newer stable Magento core version available for this edition. Prefer Composer package metadata for installable-version availability and official Adobe/Magento release notes for support status, platform requirements, security fixes, breaking changes, and merchant-facing benefits. Do not infer compatibility from version numbers alone. Mark every unresolved package, customization, service, or deployment dependency as unknown rather than guessing.
+
+Present the results in this order:
+1. verified current state and evidence;
+2. every newer available core version, clearly labeling unsupported or end-of-life targets;
+3. a short numbered set of practical upgrade plans. For each plan, state the target version, effort tier and rationale, prerequisites/blockers, merchant benefits, project-specific risks, and required operational/validation work. Do not make calendar promises from incomplete evidence.
+
+Ask the merchant to select exactly one plan by its number or target version, then stop and wait. Do not start the upgrade while presenting options. After an explicit selection, treat it as authority to proceed only with that chosen Magento core target: make only compatibility updates required for that target, not opportunistic extension upgrades. Keep every existing MerchantDuo workspace permission and operational confirmation boundary; use the supported Magento workflow tools for their covered operations.`;
+}
 export function statusMessage(state) {
     const lines = [
         `Environment: ${state.selected.name} (${state.environmentStatus})`,
+        state.magento.database.status === "unavailable"
+            ? "Database: unavailable"
+            : `Database: ${state.magento.database.location} ${state.magento.database.name} (${state.magento.database.status === "ready" ? "ready" : "not ready"})`,
         `Permission mode: ${state.permissionMode}`,
         `Magento: ${state.magento.edition ?? "unknown"} ${state.magento.version ?? "version unavailable"}`,
         `PHP: ${state.magento.phpVersion ?? "unavailable"}`,
@@ -76,8 +156,11 @@ export function statusMessage(state) {
         `Admin URL: ${state.testing?.adminUrl ?? "unavailable"}`,
         `Capabilities: HTTP ${state.testing?.http.available ? "available" : "unavailable"}; browser ${state.testing?.browser.available ? "available" : "unavailable"}; magerun2 ${state.magerun2?.available ? "available" : "unavailable"}`,
         ...state.magento.warnings.map((warning) => `Warning: ${warning}`),
-        ...(state.testing?.diagnostics.map((warning) => `Warning: ${warning}`) ?? []),
-        ...(state.magerun2?.diagnostic ? [`Warning: ${state.magerun2.diagnostic}`] : []),
+        ...(state.testing?.diagnostics.map((warning) => `Warning: ${warning}`) ??
+            []),
+        ...(state.magerun2?.diagnostic
+            ? [`Warning: ${state.magerun2.diagnostic}`]
+            : []),
         ...(state.nativeLog.warning ? [`Warning: ${state.nativeLog.warning}`] : []),
     ];
     return lines.join("\n");

package/dist/integrations/pi/environment.js

@@ -3,32 +3,68 @@ import { refreshStatus } from "#app/status";
 import { runtime, text } from "#integrations/pi/session";
 /** Warden is managed directly; a local project's lifecycle is selected by the agent from live project evidence. */
 export default function environment(pi) {
-    pi.registerTool({ name: "environment_status", label: "Environment status", description: "Report whether the selected MerchantDuo environment is running or stopped.", parameters: Type.Object({}), async execute(_id, _params, _signal, _update, ctx) {
+    pi.registerTool({
+        name: "environment_status",
+        label: "Environment status",
+        description: "Report whether the selected MerchantDuo environment is running or stopped.",
+        parameters: Type.Object({}),
+        async execute(_id, _params, _signal, _update, ctx) {
             const state = await runtime.boot(ctx.cwd);
             return text(environmentMessage(state));
-        } });
-    pi.registerTool({ name: "environment_start", label: "Start environment", description: "Start Warden directly, or run the agent-selected local lifecycle command after inspection.", parameters: Type.Object({ command: Type.Optional(Type.String({ minLength: 1 })) }), async execute(_id, params, signal, _update, ctx) {
+        },
+    });
+    pi.registerTool({
+        name: "environment_start",
+        label: "Start environment",
+        description: "Start Warden directly, or run the agent-selected local lifecycle command after inspection.",
+        parameters: Type.Object({
+            command: Type.Optional(Type.String({ minLength: 1 })),
+        }),
+        async execute(_id, params, signal, _update, ctx) {
             const state = await change("start", ctx.cwd, params.command, signal);
             refreshStatus(ctx, state);
             return text(environmentMessage(state));
-        } });
-    pi.registerTool({ name: "environment_stop", label: "Stop environment", description: "Stop Warden directly, or run the agent-selected local lifecycle command after inspection.", parameters: Type.Object({ command: Type.Optional(Type.String({ minLength: 1 })) }), async execute(_id, params, signal, _update, ctx) {
+        },
+    });
+    pi.registerTool({
+        name: "environment_stop",
+        label: "Stop environment",
+        description: "Stop Warden directly, or run the agent-selected local lifecycle command after inspection.",
+        parameters: Type.Object({
+            command: Type.Optional(Type.String({ minLength: 1 })),
+        }),
+        async execute(_id, params, signal, _update, ctx) {
             const state = await change("stop", ctx.cwd, params.command, signal);
             refreshStatus(ctx, state);
             return text(environmentMessage(state));
-        } });
-    pi.registerTool({ name: "environment_set_status", label: "Set environment status", description: "Record the local environment lifecycle status after inspecting or running its project-specific commands. Include concise command/output evidence.", parameters: Type.Object({ status: Type.Union([Type.Literal("running"), Type.Literal("stopped")]), evidence: Type.String({ minLength: 1 }) }), async execute(_id, params, _signal, _update, ctx) {
+        },
+    });
+    pi.registerTool({
+        name: "environment_set_status",
+        label: "Set environment status",
+        description: "Record the local environment lifecycle status after inspecting or running its project-specific commands. Include concise command/output evidence.",
+        parameters: Type.Object({
+            status: Type.Union([Type.Literal("running"), Type.Literal("stopped")]),
+            evidence: Type.String({ minLength: 1 }),
+        }),
+        async execute(_id, params, _signal, _update, ctx) {
             const state = await runtime.boot(ctx.cwd);
             if (state.selected.environment.type !== "local")
                 throw new Error("Only local environment status is agent-reported.");
-            refreshStatus(ctx, runtime.setEnvironmentStatus(params.status));
+            const changed = runtime.setEnvironmentStatus(params.status);
+            if (params.status === "running")
+                await runtime.refreshMagento(ctx.cwd);
+            refreshStatus(ctx, changed);
             return text(`Local environment marked ${params.status}: ${params.evidence}`);
-        } });
+        },
+    });
     registerCommand(pi, "duo-env-start", "start");
     registerCommand(pi, "duo-env-stop", "stop");
 }
 function registerCommand(pi, name, action) {
-    pi.registerCommand(name, { description: `${action === "start" ? "Start" : "Stop"} the selected environment. Warden is direct; local is agent-directed.`, handler: async (_args, ctx) => {
+    pi.registerCommand(name, {
+        description: `${action === "start" ? "Start" : "Stop"} the selected environment. Warden is direct; local is agent-directed.`,
+        handler: async (_args, ctx) => {
             const state = await runtime.boot(ctx.cwd);
             if (state.selected.environment.type === "local") {
                 pi.sendUserMessage(localLifecyclePrompt(action));
@@ -38,7 +74,8 @@ function registerCommand(pi, name, action) {
             const changed = await change(action, ctx.cwd);
             refreshStatus(ctx, changed);
             ctx.ui.notify(environmentMessage(changed), "info");
-        } });
+        },
+    });
 }
 async function change(action, cwd, command, signal) {
     const state = await runtime.boot(cwd);
@@ -49,16 +86,25 @@ async function change(action, cwd, command, signal) {
             throw new Error(`Inspect the local project first, then call environment_${action} with its exact lifecycle command.`);
         const result = await state.backend.run(["sh", "-lc", command], { signal });
         if (result.exitCode !== 0)
-            throw new Error(result.stderr || result.stdout || `Could not ${action} local environment`);
-        return runtime.setEnvironmentStatus(action === "start" ? "running" : "stopped");
+            throw new Error(result.stderr ||
+                result.stdout ||
+                `Could not ${action} local environment`);
+        const changed = runtime.setEnvironmentStatus(action === "start" ? "running" : "stopped");
+        return action === "start" ? runtime.refreshMagento(cwd) : changed;
     }
-    return action === "start" ? runtime.startEnvironment(cwd) : runtime.stopEnvironment(cwd);
+    return action === "start"
+        ? runtime.startEnvironment(cwd)
+        : runtime.stopEnvironment(cwd);
 }
 function localLifecyclePrompt(action) {
     return `The user directly requested that you ${action} the selected local environment. This local stack is not assumed to use any one runtime. Inspect the project documentation, package scripts, Compose files, service configuration, and existing process state first. Determine the smallest correct ${action} command, explain the evidence and intended effect, then execute it through environment_${action} with the exact command. Do not use a generic command, do not stop unrelated host services, and if the project lifecycle cannot be determined safely, ask the user. After a successful command, the tool records ${action === "start" ? "running" : "stopped"}.`;
 }
 function environmentMessage(state) {
     const environment = state.selected.environment;
-    const managed = environment.type === "warden" ? "Warden-managed" : environment.type === "local" ? "agent-directed" : "remote unmanaged";
+    const managed = environment.type === "warden"
+        ? "Warden-managed"
+        : environment.type === "local"
+            ? "agent-directed"
+            : "remote unmanaged";
     return `${state.selected.name} (${environment.type}): ${state.environmentStatus} [${managed}]`;
 }

package/dist/integrations/pi/permissions.d.ts

@@ -1,6 +1,7 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { type PermissionMode } from "#app/permission-mode";
 import type { Environment } from "#environments/model";
+export declare function permissionChoices(): PermissionMode[];
 export declare function requiresExecuteConfirmation(toolName: string, input: Record<string, unknown>): boolean;
 /** Return block/confirmation behavior; callers retain all hard capability constraints. */
 export declare function permissionDecision(mode: PermissionMode, environment: Environment, toolName: string, input: Record<string, unknown>): "allow" | "block" | "confirm";

package/dist/integrations/pi/permissions.js

@@ -3,6 +3,9 @@ import { refreshStatus } from "#app/status";
 import { runtime } from "#integrations/pi/session";
 const workspaceMutations = new Set(["write", "edit"]);
 const stoppedAllowed = new Set(["environment_status", "environment_start", "environment_stop", "environment_set_status"]);
+export function permissionChoices() {
+    return [...permissionModes];
+}
 export function requiresExecuteConfirmation(toolName, input) {
     return ["environment_start", "environment_stop"].includes(toolName) || ((toolName === "mage2gen_generate_module" || toolName === "magento_workflow" || toolName === "magerun2") && input.execute === true);
 }
@@ -26,9 +29,13 @@ async function confirm(ctx, title, message) {
 /** The sole MerchantDuo confirmation gate. YOLO removes dialogs, never hard constraints. */
 export default function permissions(pi) {
     pi.registerCommand("duo-switch-permissions", { description: "Set this session's permission mode: read-only, normal, or yolo.", handler: async (args, ctx) => {
-            const mode = args.trim();
-            if (!permissionModes.includes(mode)) {
-                ctx.ui.notify("Choose one of: read-only, normal, yolo", "error");
+            const choices = permissionChoices();
+            const typed = args.trim();
+            const mode = typed || (ctx.hasUI ? await ctx.ui.select("Select session permission mode", choices) : undefined);
+            if (!mode)
+                return;
+            if (!choices.includes(mode)) {
+                ctx.ui.notify(`Choose one of: ${choices.join(", ")}`, "error");
                 return;
             }
             await runtime.boot(ctx.cwd);

package/dist/integrations/pi/workspace.d.ts

@@ -16,6 +16,7 @@ type SearchParameters = {
  */
 export declare function searchCommand(params: SearchParameters, path: string): string;
 export declare function workspacePath(backend: EnvironmentBackend, cwd: string, candidate: string): string;
+export declare function wardenHostPathWarning(backend: EnvironmentBackend, cwd: string, candidate: string): string | undefined;
 /** Return only a declared MerchantDuo skill asset; project files remain environment-routed. */
 export declare function packagedSkillPath(candidate: string): string | undefined;
 export {};

package/dist/integrations/pi/workspace.js

@@ -1,9 +1,10 @@
 import { access as hostAccess, readFile as hostReadFile } from "node:fs/promises";
-import { relative, resolve } from "node:path";
+import { isAbsolute, relative, resolve } from "node:path";
 import { Type } from "typebox";
 import { createEditToolDefinition, createReadToolDefinition, createWriteToolDefinition, } from "@earendil-works/pi-coding-agent";
 import { runtime } from "#integrations/pi/session";
 import { packagePath } from "#shared/package-paths";
+import { postEditHints, validateMagentoXml } from "#workflows/post-edit";
 const shell = (value) => `'${value.replace(/'/g, "'\\''")}'`;
 const result = (value) => ({ content: [{ type: "text", text: value }], details: {} });
 const packageSkillRoots = [
@@ -34,9 +35,19 @@ function registerFileTools(pi) {
     const localRead = createReadToolDefinition(process.cwd());
     const localWrite = createWriteToolDefinition(process.cwd());
     const localEdit = createEditToolDefinition(process.cwd());
-    pi.registerTool({ ...localRead, async execute(id, params, signal, update, ctx) { const state = await runtime.boot(ctx.cwd); return createReadToolDefinition(ctx.cwd, { operations: fileOps(state.backend, ctx.cwd) }).execute(id, params, signal, update, ctx); } });
-    pi.registerTool({ ...localWrite, async execute(id, params, signal, update, ctx) { const state = await runtime.boot(ctx.cwd); return createWriteToolDefinition(ctx.cwd, { operations: fileOps(state.backend, ctx.cwd) }).execute(id, params, signal, update, ctx); } });
-    pi.registerTool({ ...localEdit, async execute(id, params, signal, update, ctx) { const state = await runtime.boot(ctx.cwd); return createEditToolDefinition(ctx.cwd, { operations: fileOps(state.backend, ctx.cwd) }).execute(id, params, signal, update, ctx); } });
+    pi.registerTool({ ...localRead, async execute(id, params, signal, update, ctx) { const state = await runtime.boot(ctx.cwd); const response = await createReadToolDefinition(ctx.cwd, { operations: fileOps(state.backend, ctx.cwd) }).execute(id, params, signal, update, ctx); return appendNotice(response, wardenHostPathWarning(state.backend, ctx.cwd, params.path)); } });
+    pi.registerTool({ ...localWrite, async execute(id, params, signal, update, ctx) { const state = await runtime.boot(ctx.cwd); const response = await createWriteToolDefinition(ctx.cwd, { operations: fileOps(state.backend, ctx.cwd) }).execute(id, params, signal, update, ctx); return appendPostEdit(response, state.backend, ctx.cwd, params.path, signal); } });
+    pi.registerTool({ ...localEdit, async execute(id, params, signal, update, ctx) { const state = await runtime.boot(ctx.cwd); const response = await createEditToolDefinition(ctx.cwd, { operations: fileOps(state.backend, ctx.cwd) }).execute(id, params, signal, update, ctx); return appendPostEdit(response, state.backend, ctx.cwd, params.path, signal); } });
+}
+async function appendPostEdit(response, backend, cwd, path, signal) {
+    const target = workspacePath(backend, cwd, path);
+    const validation = await validateMagentoXml(backend, target, signal);
+    return appendNotice(response, [wardenHostPathWarning(backend, cwd, path), ...postEditHints(path), validation].filter((value) => Boolean(value)).join("\n"));
+}
+function appendNotice(response, notice) {
+    if (!notice)
+        return response;
+    return { ...response, content: [...response.content, { type: "text", text: `MerchantDuo: ${notice}` }] };
 }
 function fileOps(backend, cwd) {
     const readFile = async (path) => {
@@ -58,8 +69,27 @@ function fileOps(backend, cwd) {
             throw new Error("Path is inaccessible"); }, mkdir: async (path) => { const response = await backend.run(["mkdir", "-p", workspacePath(backend, cwd, path)]); if (response.exitCode)
             throw new Error(response.stderr || "Cannot create directory"); } };
 }
-export function workspacePath(backend, cwd, candidate) { const full = resolve(cwd, candidate); const value = relative(resolve(cwd), full); if (value === ".." || value.startsWith("../"))
-    throw new Error(`Path escapes workspace: ${candidate}`); return backend.path(value); }
+export function workspacePath(backend, cwd, candidate) {
+    if (backend.environment.type === "warden" && isAbsolute(candidate)) {
+        const containerPath = resolve(candidate);
+        if (contains(resolve(backend.environment.root), containerPath))
+            return containerPath;
+    }
+    const full = resolve(cwd, candidate);
+    const value = relative(resolve(cwd), full);
+    if (value === ".." || value.startsWith("../"))
+        throw new Error(`Path escapes workspace: ${candidate}`);
+    return backend.path(value);
+}
+export function wardenHostPathWarning(backend, cwd, candidate) {
+    if (backend.environment.type !== "warden" || !isAbsolute(candidate))
+        return undefined;
+    const hostPath = resolve(candidate);
+    if (!contains(resolve(cwd), hostPath))
+        return undefined;
+    const value = relative(resolve(cwd), hostPath);
+    return `Warden path warning: ${candidate} was mapped to ${backend.path(value)}. This session runs inside Warden; use the container path next time.`;
+}
 /** Return only a declared MerchantDuo skill asset; project files remain environment-routed. */
 export function packagedSkillPath(candidate) {
     const full = resolve(candidate);

package/dist/magento/index.d.ts

@@ -1,5 +1,5 @@
 export { parseDeployMode } from "#magento/deploy-mode";
 export { DefaultMagentoInspector, type MagentoInspector, } from "#magento/inspector";
-export type { MagentoDeployMode, MagentoSnapshot, MagentoTheme, RawTheme, } from "#magento/model";
+export type { MagentoDeployMode, MagentoDatabaseLocation, MagentoDatabaseSnapshot, MagentoDatabaseStatus, MagentoSnapshot, MagentoTheme, RawTheme, } from "#magento/model";
 export { snapshotPrompt } from "#magento/prompt";
 export { parseRegisteredThemes, resolveThemes } from "#magento/themes";

package/dist/magento/inspector.d.ts

@@ -1,9 +1,10 @@
 import type { CommandExecutor, CommandResult } from "#environments/executor";
+import type { Environment } from "#environments/model";
 import type { MagentoSnapshot } from "#magento/model";
 export interface MagentoInspector {
-    inspect(executor: CommandExecutor, record?: (argv: string[], result: CommandResult) => Promise<void>): Promise<MagentoSnapshot>;
+    inspect(executor: CommandExecutor, record?: (argv: string[], result: CommandResult) => Promise<void>, environment?: Environment): Promise<MagentoSnapshot>;
 }
 /** Ordered, fail-soft Magento inspection. New probes can be extracted without changing consumers. */
 export declare class DefaultMagentoInspector implements MagentoInspector {
-    inspect(executor: CommandExecutor, record?: (argv: string[], result: CommandResult) => Promise<void>): Promise<MagentoSnapshot>;
+    inspect(executor: CommandExecutor, record?: (argv: string[], result: CommandResult) => Promise<void>, environment?: Environment): Promise<MagentoSnapshot>;
 }

package/dist/magento/inspector.js

@@ -2,7 +2,7 @@ import { parseDeployMode } from "#magento/deploy-mode";
 import { parseRegisteredThemes, resolveThemes } from "#magento/themes";
 /** Ordered, fail-soft Magento inspection. New probes can be extracted without changing consumers. */
 export class DefaultMagentoInspector {
-    async inspect(executor, record) {
+    async inspect(executor, record, environment) {
         const warnings = [];
         const evidence = [];
         const run = async (argv) => {
@@ -34,11 +34,12 @@ export class DefaultMagentoInspector {
             cliVersion &&
             !cliVersion.startsWith(composerVersion))
             warnings.push(`Composer (${composerVersion}) and CLI (${cliVersion}) disagree`);
-        const [php, mode, cache, registeredThemes] = await Promise.all([
+        const [php, mode, cache, registeredThemes, database] = await Promise.all([
             run(["php", "-r", "echo PHP_VERSION;"]),
             run(["bin/magento", "deploy:mode:show"]),
             run(["bin/magento", "cache:status", "--no-ansi"]),
             run(["sh", "-lc", themeDiscoveryScript]),
+            inspectDatabase(run, environment),
         ]);
         return {
             version: composerVersion ?? cliVersion,
@@ -49,12 +50,60 @@ export class DefaultMagentoInspector {
                 .split("\n")
                 .map((line) => line.match(/^([^:]+):/)?.[1])
                 .filter((value) => Boolean(value)),
+            database,
             warnings,
             evidence,
             themes: resolveThemes(parseRegisteredThemes(registeredThemes.stdout)),
         };
     }
 }
+/**
+ * Read only the non-secret connection metadata inside the selected runtime.
+ * The command emits location/name, never the configured host or credentials.
+ */
+async function inspectDatabase(run, environment) {
+    const localHosts = ["", "localhost", "127.0.0.1", "::1"];
+    if (environment?.type === "warden")
+        localHosts.push("db");
+    const metadata = await run([
+        "sh",
+        "-lc",
+        databaseMetadataCommand(localHosts),
+    ]);
+    const parsed = parseDatabaseMetadata(metadata.stdout);
+    if (!parsed)
+        return { status: "unavailable" };
+    const readiness = await run([
+        "sh",
+        "-lc",
+        "bin/magento setup:db:status >/dev/null 2>&1",
+    ]);
+    return {
+        ...parsed,
+        status: readiness.exitCode === 0 ? "ready" : "not-ready",
+    };
+}
+function databaseMetadataCommand(localHosts) {
+    const localHostsJson = JSON.stringify(localHosts);
+    const script = `try { $config = require "app/etc/env.php"; $connection = $config["db"]["connection"]["default"] ?? null; $name = is_array($connection) ? ($connection["dbname"] ?? null) : null; $host = is_array($connection) ? ($connection["host"] ?? "") : ""; $local = in_array((string) $host, ${localHostsJson}, true); if (!is_string($name) || $name === "") { echo "{}"; } else { echo json_encode(["location" => $local ? "local" : "remote", "name" => $name]); } } catch (Throwable $error) { echo "{}"; }`;
+    return `php -d display_errors=0 -r '${script}' 2>/dev/null`;
+}
+function parseDatabaseMetadata(stdout) {
+    try {
+        const value = JSON.parse(stdout.trim());
+        if (!value || typeof value !== "object")
+            return undefined;
+        const { location, name } = value;
+        if ((location !== "local" && location !== "remote") ||
+            typeof name !== "string" ||
+            !name)
+            return undefined;
+        return { location, name };
+    }
+    catch {
+        return undefined;
+    }
+}
 const themeDiscoveryScript = `{
   find vendor -mindepth 3 -maxdepth 3 -type f -name registration.php 2>/dev/null
   find app/design -mindepth 4 -maxdepth 4 -type f -name registration.php 2>/dev/null

package/dist/magento/model.d.ts

@@ -1,4 +1,11 @@
 export type MagentoDeployMode = "default" | "developer" | "production";
+export type MagentoDatabaseLocation = "local" | "remote";
+export type MagentoDatabaseStatus = "ready" | "not-ready" | "unavailable";
+export type MagentoDatabaseSnapshot = {
+    location?: MagentoDatabaseLocation;
+    name?: string;
+    status: MagentoDatabaseStatus;
+};
 export type MagentoTheme = {
     code: string;
     title?: string;
@@ -18,6 +25,7 @@ export type MagentoSnapshot = {
     phpVersion?: string;
     mode?: MagentoDeployMode;
     cacheTypes: string[];
+    database: MagentoDatabaseSnapshot;
     warnings: string[];
     evidence: string[];
     themes: MagentoTheme[];

package/dist/workflows/post-edit.d.ts

@@ -0,0 +1,7 @@
+import type { EnvironmentBackend } from "#environments/backend";
+/** Keep immediate post-edit guidance narrow; operational work remains an explicit request. */
+export declare function postEditHints(path: string): string[];
+export declare function isMagentoXml(path: string): boolean;
+/** Validate changed Magento XML in its own selected environment using Magento's URN resolver. */
+export declare function validateMagentoXml(backend: EnvironmentBackend, path: string, signal?: AbortSignal): Promise<string>;
+export declare function xmlValidationCommand(path: string): string[];

package/dist/workflows/post-edit.js

@@ -0,0 +1,51 @@
+const xsdValidator = String.raw `
+$file = $argv[1] ?? '';
+libxml_use_internal_errors(true);
+$dom = new DOMDocument();
+if (!$dom->load($file)) {
+    foreach (libxml_get_errors() as $error) fwrite(STDERR, trim($error->message) . " at line " . $error->line . "\n");
+    exit(2);
+}
+$root = $dom->documentElement;
+$schema = $root ? $root->getAttributeNS('http://www.w3.org/2001/XMLSchema-instance', 'noNamespaceSchemaLocation') : '';
+if (!$schema || strpos($schema, 'urn:magento:') !== 0) {
+    fwrite(STDERR, "Magento XML must declare xsi:noNamespaceSchemaLocation with a urn:magento schema.\n");
+    exit(2);
+}
+require getcwd() . '/app/bootstrap.php';
+$errors = Magento\Framework\Config\Dom::validateDomDocument($dom, $schema);
+if ($errors) {
+    foreach ($errors as $error) fwrite(STDERR, (string)$error . "\n");
+    exit(2);
+}
+echo "Magento XML XSD validation passed.\n";
+`;
+/** Keep immediate post-edit guidance narrow; operational work remains an explicit request. */
+export function postEditHints(path) {
+    const value = path.toLowerCase();
+    const hints = ["Inspect the changed file and its closest Magento precedent before continuing."];
+    if (value.endsWith(".php") || value.endsWith(".phtml"))
+        hints.push("Use magento_workflow action=syntax-check when PHP syntax verification is relevant.");
+    if (value.endsWith(".xml"))
+        hints.push("Review the XSD result below; preview a cache clean only when this configuration change requires it.");
+    if (value.endsWith("etc/module.xml") || value.endsWith("db_schema.xml") || value.endsWith("composer.json"))
+        hints.push("This may require setup:upgrade; explain the evidence and use magento_workflow only after the user directly requests execution.");
+    return hints;
+}
+export function isMagentoXml(path) {
+    return path.toLowerCase().endsWith(".xml")
+        && /(?:^|\/)(?:app\/(?:code|design)|vendor)\//.test(path.replace(/\\/g, "/"));
+}
+/** Validate changed Magento XML in its own selected environment using Magento's URN resolver. */
+export async function validateMagentoXml(backend, path, signal) {
+    if (!isMagentoXml(path))
+        return "";
+    const output = await backend.run(xmlValidationCommand(path), { signal });
+    const detail = `${output.stdout}${output.stderr}`.trim();
+    return output.exitCode === 0
+        ? detail || "Magento XML XSD validation passed."
+        : `Warning: Magento XML XSD validation failed for ${path}: ${detail || "validation could not run."}`;
+}
+export function xmlValidationCommand(path) {
+    return ["php", "-r", xsdValidator, path];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@merchantduo/code",
-  "version": "0.3.0-beta.1",
+  "version": "0.4.0-beta.1",
   "private": false,
   "description": "Magento-native Pi-based Coding Agent",
   "type": "module",
@@ -57,18 +57,18 @@
     ]
   },
   "dependencies": {
-    "@earendil-works/pi-coding-agent": "0.84.1",
+    "@earendil-works/pi-coding-agent": "0.84.3",
     "@modelcontextprotocol/client": "2.0.0",
     "pi-goal": "0.1.7",
-    "pi-web-access": "0.22.0",
-    "typebox": "1.3.7",
-    "yaml": "^2.8.1",
-    "zod": "^3.24.4"
+    "pi-web-access": "0.25.0",
+    "typebox": "1.3.19",
+    "yaml": "^2.9.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^22.15.3",
+    "@types/node": "^26.4.0",
     "prettier": "^3.9.6",
-    "typescript": "^5.8.3"
+    "typescript": "^7.0.2"
   },
   "scripts": {
     "clean": "node -e \"const fs=require('node:fs'); for(const path of ['dist','.test-dist']) fs.rmSync(path,{recursive:true,force:true})\"",