@mindrian_os/cli 1.13.0-beta.10 → 1.13.0-beta.44

package/lib/core/artifact-id.cjs

@@ -1,148 +0,0 @@
-/**
- * MindrianOS Plugin -- Artifact ID & Pipeline Provenance
- * Stable artifact ID computation and frontmatter injection.
- * IDs are deterministic 12-char hex hashes from room+section+title+created.
- *
- * Exports: computeArtifactId, injectArtifactId, injectPipelineProvenance
- */
-
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const crypto = require('crypto');
-
-/**
- * Compute a stable artifact ID from room, section, title, and creation date.
- * @param {string} roomDir - Absolute path to room directory
- * @param {string} section - Section name (e.g. "problem-definition")
- * @param {string} title - Artifact title (first # heading or filename)
- * @param {string} created - Creation date string (e.g. "2026-03-15")
- * @returns {string} 12-char hex hash
- */
-function computeArtifactId(roomDir, section, title, created) {
-  const roomName = path.basename(roomDir);
-  const input = roomName + ':' + section + ':' + title + ':' + created;
-  return crypto.createHash('sha256').update(input).digest('hex').slice(0, 12);
-}
-
-/**
- * Extract the first # heading from file content.
- * @param {string} content - File content
- * @param {string} filePath - Fallback basename
- * @returns {string}
- */
-function extractTitle(content, filePath) {
-  const match = content.match(/^# (.+)$/m);
-  return match ? match[1].trim() : path.basename(filePath, '.md');
-}
-
-/**
- * Extract a frontmatter field value from content.
- * @param {string} content - File content
- * @param {string} field - Field name
- * @returns {string}
- */
-function extractField(content, field) {
-  const fmMatch = content.match(/^---\n([\s\S]*?)\n---/);
-  if (!fmMatch) return '';
-  const line = fmMatch[1].split('\n').find(l => l.startsWith(field + ':'));
-  if (!line) return '';
-  return line.slice(field.length + 1).trim().replace(/^["']|["']$/g, '');
-}
-
-/**
- * Inject artifact_id into frontmatter of a markdown file. Idempotent.
- * @param {string} filePath - Absolute path to .md file
- * @param {string} roomDir - Absolute path to room directory
- * @returns {{artifact_id: string, injected: boolean} | null} null if no frontmatter or already has ID
- */
-function injectArtifactId(filePath, roomDir) {
-  if (!fs.existsSync(filePath)) return null;
-
-  const content = fs.readFileSync(filePath, 'utf-8');
-
-  // Must have frontmatter
-  if (!content.startsWith('---\n')) return null;
-
-  // Already has artifact_id -- idempotent
-  const fmEnd = content.indexOf('\n---', 4);
-  if (fmEnd === -1) return null;
-  const frontmatter = content.slice(4, fmEnd);
-  if (frontmatter.includes('artifact_id:')) return null;
-
-  // Extract metadata
-  const section = path.basename(path.dirname(filePath));
-  const title = extractTitle(content, filePath);
-  const created = extractField(content, 'date') || extractField(content, 'created') || '';
-
-  const artifactId = computeArtifactId(roomDir, section, title, created);
-
-  // Insert artifact_id line after the first ---
-  const lines = content.split('\n');
-  // lines[0] is '---', insert after it
-  lines.splice(1, 0, `artifact_id: ${artifactId}`);
-  fs.writeFileSync(filePath, lines.join('\n'), 'utf-8');
-
-  return { artifact_id: artifactId, injected: true };
-}
-
-/**
- * Inject pipeline provenance fields into frontmatter. Idempotent.
- * @param {string} filePath - Absolute path to .md file
- * @param {string} pipeline - Pipeline name (e.g. "meeting-filing")
- * @param {string} stage - Pipeline stage (e.g. "3")
- * @param {string[]} requires - What this stage requires
- * @param {string[]} provides - What this stage provides
- * @returns {{injected: boolean} | null}
- */
-function injectPipelineProvenance(filePath, pipeline, stage, requires, provides) {
-  if (!fs.existsSync(filePath)) return null;
-
-  const content = fs.readFileSync(filePath, 'utf-8');
-
-  // Must have frontmatter
-  if (!content.startsWith('---\n')) return null;
-
-  // Already has pipeline -- idempotent
-  const fmEnd = content.indexOf('\n---', 4);
-  if (fmEnd === -1) return null;
-  const frontmatter = content.slice(4, fmEnd);
-  if (frontmatter.includes('pipeline:')) return null;
-
-  // Find insertion point: after artifact_id if present, otherwise after first ---
-  const lines = content.split('\n');
-  let insertIdx = 1; // default: right after first ---
-  for (let i = 1; i < lines.length; i++) {
-    if (lines[i] === '---') break;
-    if (lines[i].startsWith('artifact_id:')) {
-      insertIdx = i + 1;
-      break;
-    }
-  }
-
-  const reqYaml = requires && requires.length > 0
-    ? '[' + requires.join(', ') + ']'
-    : '[]';
-  const provYaml = provides && provides.length > 0
-    ? '[' + provides.join(', ') + ']'
-    : '[]';
-
-  const provenanceLines = [
-    `pipeline: ${pipeline}`,
-    `pipeline_stage: ${stage}`,
-    `pipeline_requires: ${reqYaml}`,
-    `pipeline_provides: ${provYaml}`,
-  ];
-
-  lines.splice(insertIdx, 0, ...provenanceLines);
-  fs.writeFileSync(filePath, lines.join('\n'), 'utf-8');
-
-  return { injected: true };
-}
-
-module.exports = {
-  computeArtifactId,
-  injectArtifactId,
-  injectPipelineProvenance,
-};

package/lib/core/asset-ops.cjs

@@ -1,151 +0,0 @@
-/**
- * MindrianOS Plugin -- Asset Operations
- * Wraps scripts/file-asset via execSync. Pure Node.js built-ins only.
- * Provides manifest reading for dashboard/wiki consumption.
- */
-
-'use strict';
-
-const { execSync } = require('child_process');
-const fs = require('fs');
-const path = require('path');
-
-const SCRIPTS_DIR = path.resolve(__dirname, '../../scripts');
-
-/**
- * File a binary asset into a room with markdown wrapper + manifest update.
- * @param {string} roomDir - Path to room directory
- * @param {string} filePath - Path to the binary file to file
- * @param {string} section - Target section name
- * @param {object} [options] - Optional parameters
- * @param {string} [options.meetingId] - Meeting ID for meeting-mode filing
- * @returns {string} Output from file-asset script (e.g. "FILED:section:type:filename")
- */
-function fileAsset(roomDir, filePath, section, options) {
-  const resolved = path.resolve(roomDir);
-  const resolvedFile = path.resolve(filePath);
-  const scriptPath = path.join(SCRIPTS_DIR, 'file-asset');
-
-  let cmd = `bash "${scriptPath}" "${resolved}" "${resolvedFile}" "${section}"`;
-  if (options && options.meetingId) {
-    cmd += ` --meeting "${options.meetingId}"`;
-  }
-
-  try {
-    const result = execSync(cmd, {
-      timeout: 10000,
-      encoding: 'utf-8',
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
-    return result.trim();
-  } catch (e) {
-    throw new Error(`file-asset failed: ${e.message}`);
-  }
-}
-
-/**
- * Read and parse ASSET_MANIFEST.md from room root.
- * Returns array of asset objects. Empty array if no manifest exists.
- * @param {string} roomDir - Path to room directory
- * @returns {Array<{file: string, type: string, section: string, size: string, date: string, path: string}>}
- */
-function readManifest(roomDir) {
-  const resolved = path.resolve(roomDir);
-  const manifestPath = path.join(resolved, 'ASSET_MANIFEST.md');
-
-  if (!fs.existsSync(manifestPath)) {
-    return [];
-  }
-
-  const content = fs.readFileSync(manifestPath, 'utf-8');
-  const lines = content.split('\n');
-  const assets = [];
-
-  // Skip header lines: title, empty, blockquote, empty, table header, separator
-  // Find the table by looking for lines starting with |
-  let inTable = false;
-  let headerSkipped = 0;
-
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed.startsWith('|')) {
-      inTable = false;
-      headerSkipped = 0;
-      continue;
-    }
-
-    if (!inTable) {
-      inTable = true;
-      headerSkipped = 0;
-    }
-
-    headerSkipped++;
-    // Skip table header row and separator row
-    if (headerSkipped <= 2) continue;
-
-    // Parse pipe-delimited columns: | File | Type | Section | Size | Date |
-    const cols = trimmed.split('|').map(c => c.trim()).filter(c => c.length > 0);
-    if (cols.length < 5) continue;
-
-    // Extract link target from [text](path) pattern in File column
-    const fileCol = cols[0];
-    const linkMatch = fileCol.match(/\[([^\]]+)\]\(([^)]+)\)/);
-    const fileName = linkMatch ? linkMatch[1] : fileCol;
-    const filePath = linkMatch ? linkMatch[2] : '';
-
-    assets.push({
-      file: fileName,
-      type: cols[1],
-      section: cols[2],
-      size: cols[3],
-      date: cols[4],
-      path: filePath,
-    });
-  }
-
-  return assets;
-}
-
-/**
- * Regenerate ASSET_MANIFEST.md without filing a new asset.
- * Useful for dashboard refresh.
- * @param {string} roomDir - Path to room directory
- * @returns {string} Output from file-asset --manifest-only
- */
-function updateManifest(roomDir) {
-  const resolved = path.resolve(roomDir);
-  const scriptPath = path.join(SCRIPTS_DIR, 'file-asset');
-
-  try {
-    const result = execSync(`bash "${scriptPath}" "${resolved}" --manifest-only`, {
-      timeout: 10000,
-      encoding: 'utf-8',
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
-    return result.trim();
-  } catch (e) {
-    throw new Error(`file-asset --manifest-only failed: ${e.message}`);
-  }
-}
-
-/**
- * Get assets filtered by section.
- * @param {string} roomDir - Path to room directory
- * @param {string} section - Section name to filter by
- * @returns {Array<{file: string, type: string, section: string, size: string, date: string, path: string}>}
- */
-function getAssetsBySection(roomDir, section) {
-  return readManifest(roomDir).filter(a => a.section === section);
-}
-
-/**
- * Get assets filtered by type (pdf, image, video, audio, document, archive).
- * @param {string} roomDir - Path to room directory
- * @param {string} type - Asset type to filter by
- * @returns {Array<{file: string, type: string, section: string, size: string, date: string, path: string}>}
- */
-function getAssetsByType(roomDir, type) {
-  return readManifest(roomDir).filter(a => a.type === type);
-}
-
-module.exports = { fileAsset, readManifest, updateManifest, getAssetsBySection, getAssetsByType };

package/lib/core/auto-commit-throttle.cjs

@@ -1,129 +0,0 @@
-/*
- * Copyright (c) 2026 Mindrian. BSL 1.1.
- *
- * Phase 88.1-08 -- async artifact auto-commit throttle
- * ======================================================
- * Pure throttle bookkeeping for the async artifact auto-commit hook. The
- * hook fires PostToolUse on Write|Edit|MultiEdit and must avoid commit
- * storms under rapid-write sequences (MultiEdit, tool chains). This module
- * is the decision layer: given a file path, a wall-clock timestamp, and a
- * ledger of per-path last-commit timestamps, it answers:
- *   - should this write be throttled (drop the auto-commit this time)?
- *   - what is the ledger after recording a fresh commit for this path?
- *   - which stale entries can be pruned to keep the ledger bounded?
- *
- * Pure CJS, zero fs imports, zero network. The hook script wraps this
- * module with openSync('wx') + rename atomic writes (Phase 87-02 pattern)
- * for ledger persistence. This file is LOCAL-by-construction per Canon
- * Part 8: it has no I/O surface at all.
- *
- * Canon references:
- *   Part 4 Every Choice Is Graph Data -- auto-commits preserve the
- *     provenance trail of every artifact write (filesystem IS the graph).
- *   Part 6 Product-as-Venture -- our own rooms get auto-commits too.
- *   Part 8 Graph Boundary -- auto-commit is LOCAL; this pure module has no
- *     exfiltration surface.
- *
- * API:
- *   THROTTLE_WINDOW_MS                          -- number, fixed at 5000ms.
- *   shouldThrottle(filePath, now, ledger)       -> boolean
- *   updateLedger(filePath, now, ledger)         -> new ledger object
- *   pruneOldEntries(ledger, now)                -> new ledger object with
- *                                                   entries older than 1 day
- *                                                   dropped.
- *
- * Ledger shape:
- *   { [absolutePath:string]: lastCommitTsMs:number }
- */
-
-'use strict';
-
-// ---------- Tunables (frozen invariants) ----------
-
-// 1 commit / 5 seconds per path. Matches PLAN spec and prevents commit
-// storms during rapid-write sequences (MultiEdit, chained tools).
-const THROTTLE_WINDOW_MS = 5000;
-
-// 1 day retention on ledger entries. Anything older is irrelevant because
-// the 5s throttle window is vastly smaller; old entries only exist because
-// the hook has not re-fired recently. Pruning keeps the ledger bounded.
-const LEDGER_RETENTION_MS = 24 * 60 * 60 * 1000; // 86400000
-
-// ---------- Core functions ----------
-
-/**
- * shouldThrottle
- *   Decide whether an auto-commit for filePath at wall-clock now should be
- *   suppressed because a prior commit landed inside the throttle window.
- *
- *   Semantics:
- *     - No ledger entry for filePath   -> not throttled.
- *     - now - lastTs <  WINDOW_MS      -> throttled (drop the commit).
- *     - now - lastTs >= WINDOW_MS      -> not throttled (allow commit).
- *
- *   Boundary behavior: exactly WINDOW_MS old is allowed (matches the
- *   user-visible contract "1 commit per 5 seconds": the 5-second tick
- *   unlocks the next commit).
- */
-function shouldThrottle(filePath, now, ledger) {
-  if (!ledger || typeof ledger !== 'object') return false;
-  const lastTs = ledger[filePath];
-  if (typeof lastTs !== 'number') return false;
-  const age = now - lastTs;
-  if (!Number.isFinite(age)) return false;
-  return age < THROTTLE_WINDOW_MS;
-}
-
-/**
- * updateLedger
- *   Return a NEW ledger object with filePath's timestamp set to now. The
- *   input ledger is never mutated (pure function). Pre-existing entries
- *   for other paths are preserved.
- */
-function updateLedger(filePath, now, ledger) {
-  const base = (ledger && typeof ledger === 'object') ? ledger : {};
-  // Object spread yields a fresh object; assignment to filePath sets the
-  // new timestamp without mutating the input.
-  const next = Object.assign({}, base);
-  next[filePath] = now;
-  return next;
-}
-
-/**
- * pruneOldEntries
- *   Return a NEW ledger object containing only entries with timestamps
- *   within LEDGER_RETENTION_MS of now. Entries exactly at the boundary
- *   (now - ts === LEDGER_RETENTION_MS) are dropped -- this matches the
- *   "older than 1 day" wording in the PLAN: strictly older is pruned.
- *
- *   Non-number or non-finite timestamps are treated as stale and pruned
- *   defensively so a corrupt ledger entry cannot survive forever.
- */
-function pruneOldEntries(ledger, now) {
-  const out = {};
-  if (!ledger || typeof ledger !== 'object') return out;
-  const keys = Object.keys(ledger);
-  for (let i = 0; i < keys.length; i += 1) {
-    const k = keys[i];
-    const ts = ledger[k];
-    if (typeof ts !== 'number' || !Number.isFinite(ts)) continue;
-    const age = now - ts;
-    // Keep entries strictly newer than the retention window.
-    // age < LEDGER_RETENTION_MS -> keep.
-    // age >= LEDGER_RETENTION_MS -> prune.
-    if (age < LEDGER_RETENTION_MS) {
-      out[k] = ts;
-    }
-  }
-  return out;
-}
-
-// ---------- Exports ----------
-
-module.exports = {
-  THROTTLE_WINDOW_MS: THROTTLE_WINDOW_MS,
-  LEDGER_RETENTION_MS: LEDGER_RETENTION_MS,
-  shouldThrottle: shouldThrottle,
-  updateLedger: updateLedger,
-  pruneOldEntries: pruneOldEntries,
-};

package/lib/core/bearer-token.cjs

@@ -1,199 +0,0 @@
-'use strict';
-
-/**
- * bearer-token.cjs -- In-memory Bearer token + CSRF token session store for
- * the live dashboard's BYO-API chat panel (Phase 87-09).
- *
- * BSL 1.1. Copyright (c) Mindrian 2026.
- * (Business Source License 1.1; SPDX BUSL-1.1; see LICENSE.)
- *
- * Purpose
- *   Browser POSTs its Anthropic api_key to /api/auth/session ONCE. Server
- *   generates a 64-hex Bearer token + 32-hex CSRF token, binds both to the
- *   request's Origin, holds the api_key in memory keyed by the token for a
- *   30-minute TTL, returns {token, expires_in, csrf_token} to the browser,
- *   and sets a Set-Cookie: mos_csrf=<csrf> for the OWASP double-submit
- *   cookie pattern. Subsequent /api/room/chat calls send
- *   `Authorization: Bearer <token>` + `X-CSRF-Token: <csrf>` (echoed from
- *   the mos_csrf cookie). The api_key NEVER flows through a request body
- *   after auth.
- *
- * Security model (R-87-09-CSRF):
- *   Gap 3 -- tokens are bound to their creating Origin. lookupToken(token,
- *   origin) returns the api_key only if record.origin === origin.
- *   Gap 6 -- every Bearer token has an associated csrfToken that the caller
- *   (serve-dashboard-live) compares against both the mos_csrf cookie AND the
- *   X-CSRF-Token header.
- *   The api_key is never logged, never written to disk, and is cleared on
- *   server shutdown via clearAll().
- *
- * Dependencies
- *   Node built-in `crypto` only. Zero new runtime deps.
- */
-
-const crypto = require('node:crypto');
-
-const DEFAULT_TTL_MS = 30 * 60 * 1000; // 30 minutes
-
-/**
- * Internal token registry.
- * Map<tokenHex, { apiKey, origin, csrfToken, expiresAt }>
- */
-const tokens = new Map();
-
-let sweepTimer = null;
-
-/**
- * Create a new Bearer + CSRF token pair bound to the calling Origin.
- * Returns { token, expiresIn, csrfToken }; does NOT log the api_key.
- * @param {string} apiKey Anthropic api_key string (sk-...).
- * @param {string} origin The request's Origin header value at creation time.
- *   Stored verbatim; lookupToken() later compares strict-equal.
- * @param {number} [ttlMs=DEFAULT_TTL_MS]
- * @returns {{token:string, expiresIn:number, csrfToken:string}}
- */
-function createToken(apiKey, origin, ttlMs = DEFAULT_TTL_MS) {
-  if (!apiKey || typeof apiKey !== 'string') {
-    throw new Error('createToken: apiKey must be a non-empty string');
-  }
-  if (typeof origin !== 'string') {
-    throw new Error('createToken: origin must be a string');
-  }
-  const token = crypto.randomBytes(32).toString('hex');      // 64 hex chars
-  const csrfToken = crypto.randomBytes(16).toString('hex');  // 32 hex chars
-  tokens.set(token, {
-    apiKey,
-    origin,
-    csrfToken,
-    expiresAt: Date.now() + ttlMs,
-  });
-  return { token, expiresIn: Math.floor(ttlMs / 1000), csrfToken };
-}
-
-/**
- * Look up the api_key bound to a token, enforcing Origin binding.
- * Returns the api_key only if the token exists, is unexpired, AND the
- * requestOrigin matches the origin recorded at creation time
- * (R-87-09-CSRF gap 3). Returns null otherwise. Expired entries are
- * purged as a side effect.
- * @param {string} token
- * @param {string} requestOrigin
- * @returns {string|null}
- */
-function lookupToken(token, requestOrigin) {
-  if (!token || typeof token !== 'string') return null;
-  const entry = tokens.get(token);
-  if (!entry) return null;
-  if (entry.expiresAt <= Date.now()) {
-    tokens.delete(token);
-    return null;
-  }
-  if (entry.origin !== requestOrigin) {
-    // R-87-09-CSRF gap 3: a token created for Origin A must not work from
-    // Origin B, even if both origins are in the server's allowlist.
-    return null;
-  }
-  return entry.apiKey;
-}
-
-/**
- * Return the CSRF token bound to this Bearer token, for server-side
- * double-submit verification (R-87-09-CSRF gap 6). Returns null if the
- * token is unknown or expired.
- * @param {string} token
- * @returns {string|null}
- */
-function lookupCsrfForToken(token) {
-  if (!token || typeof token !== 'string') return null;
-  const entry = tokens.get(token);
-  if (!entry) return null;
-  if (entry.expiresAt <= Date.now()) {
-    tokens.delete(token);
-    return null;
-  }
-  return entry.csrfToken;
-}
-
-/**
- * Explicitly revoke a token (e.g. on user logout). Returns true if the
- * entry existed, false otherwise.
- * @param {string} token
- * @returns {boolean}
- */
-function revokeToken(token) {
-  return tokens.delete(token);
-}
-
-/**
- * Iterate the registry and delete every entry whose expiresAt <= now.
- * Returns the number of entries removed.
- * @returns {number}
- */
-function sweepExpired() {
-  const now = Date.now();
-  let removed = 0;
-  for (const [t, entry] of tokens.entries()) {
-    if (entry.expiresAt <= now) {
-      tokens.delete(t);
-      removed += 1;
-    }
-  }
-  return removed;
-}
-
-/**
- * Start a background interval timer that calls sweepExpired() every
- * `intervalMs` milliseconds (default 60s). The timer is `unref()`ed so it
- * never keeps the process alive on its own. Idempotent: a second call
- * returns the existing handle.
- * @param {number} [intervalMs=60000]
- * @returns {NodeJS.Timeout}
- */
-function startSweepInterval(intervalMs = 60000) {
-  if (sweepTimer) return sweepTimer;
-  sweepTimer = setInterval(sweepExpired, intervalMs);
-  if (sweepTimer && typeof sweepTimer.unref === 'function') sweepTimer.unref();
-  return sweepTimer;
-}
-
-/**
- * Stop the background sweep timer. Safe to call when none is running.
- */
-function stopSweepInterval() {
-  if (sweepTimer) {
-    clearInterval(sweepTimer);
-    sweepTimer = null;
-  }
-}
-
-/**
- * Nuke every token entry and stop the sweep timer. Called on SIGINT /
- * SIGTERM by serve-dashboard-live so no api_key survives a restart.
- */
-function clearAll() {
-  tokens.clear();
-  stopSweepInterval();
-}
-
-/**
- * Test-only introspection hook. Returns the current number of live
- * entries. NOT part of the public contract; do not rely on it from
- * production code paths.
- * @returns {number}
- */
-function _size() {
-  return tokens.size;
-}
-
-module.exports = {
-  createToken,
-  lookupToken,
-  lookupCsrfForToken,
-  revokeToken,
-  sweepExpired,
-  startSweepInterval,
-  stopSweepInterval,
-  clearAll,
-  _size,
-  DEFAULT_TTL_MS,
-};