@mindrian_os/cli 2.0.0-beta.3 → 2.0.0-beta.31

package/lib/hmi/mindrian-ascii-logo.cjs

@@ -0,0 +1,96 @@
+'use strict';
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * mindrian-ascii-logo.cjs - the MINDRIAN terminal logo (De Stijl / Mondrian).
+ *
+ * Design contract (navigator-confirmed banner rule, 2026-05 + 2026-07-02):
+ *   - Same-size block letters, Mondrian BACKGROUND-COLOR ZONES per letter
+ *     GROUP: MIN on red, DRI on yellow, AN on blue, framed by a black grid.
+ *   - Tagline + "larry --navigate" prompt underneath.
+ *   - Degrades to plain monochrome when NO_COLOR is set or stdout is not a
+ *     TTY (README / logs stay clean).
+ *
+ * Consumers: /mos:update post-update banner (F8 restart cue), /mos:splash
+ * (optional), any first-touch surface that wants the mark.
+ *
+ * CLI: node lib/hmi/mindrian-ascii-logo.cjs [--plain]
+ */
+
+const RESET = '\x1b[0m';
+// Mondrian primaries as ANSI backgrounds + readable foregrounds.
+const Z = {
+  red:    { bg: '\x1b[48;5;160m', fg: '\x1b[97m' },  // red block, white letters
+  yellow: { bg: '\x1b[48;5;220m', fg: '\x1b[30m' },  // yellow block, black letters
+  blue:   { bg: '\x1b[48;5;26m',  fg: '\x1b[97m' },  // blue block, white letters
+  grid:   { fg: '\x1b[1;37m' },                      // bold white grid on black
+  dim:    { fg: '\x1b[2;37m' },
+};
+
+// 6-row ANSI-shadow block font, one entry per letter, SAME height (rule: same-size letters).
+const F = {
+  M: ['███╗   ███╗', '████╗ ████║', '██╔████╔██║', '██║╚██╔╝██║', '██║ ╚═╝ ██║', '╚═╝     ╚═╝'],
+  I: ['██╗', '██║', '██║', '██║', '██║', '╚═╝'],
+  N: ['███╗   ██╗', '████╗  ██║', '██╔██╗ ██║', '██║╚██╗██║', '██║ ╚████║', '╚═╝  ╚═══╝'],
+  D: ['██████╗ ', '██╔══██╗', '██║  ██║', '██║  ██║', '██████╔╝', '╚═════╝ '],
+  R: ['██████╗ ', '██╔══██╗', '██████╔╝', '██╔══██╗', '██║  ██║', '╚═╝  ╚═╝'],
+  A: [' █████╗ ', '██╔══██╗', '███████║', '██╔══██║', '██║  ██║', '╚═╝  ╚═╝'],
+};
+
+// The three Mondrian zones: letter groups with their palette.
+const ZONES = [
+  { letters: ['M', 'I', 'N'], zone: 'red' },
+  { letters: ['D', 'R', 'I'], zone: 'yellow' },
+  { letters: ['A', 'N'], zone: 'blue' },
+];
+
+const TAGLINE = "Stuck on a decision you can't name? Let's find the shape of it.";
+const PROMPT = '❯ larry --navigate';
+
+function zoneRows(zone) {
+  // Render one zone's letters side by side (1 space between letters), 6 rows.
+  const rows = [];
+  for (let r = 0; r < 6; r++) {
+    rows.push(zone.letters.map((L) => F[L][r]).join(' '));
+  }
+  return rows;
+}
+
+function buildLogo(opts) {
+  const color = opts && Object.prototype.hasOwnProperty.call(opts, 'color')
+    ? !!opts.color
+    : (process.stdout.isTTY && !process.env.NO_COLOR);
+
+  const zones = ZONES.map(zoneRows);
+  const widths = zones.map((rows) => rows[0].length);
+  const lines = [];
+
+  // Black grid frame: top border with zone dividers (the Mondrian grid).
+  const gTop = '┏' + widths.map((w) => '━'.repeat(w + 2)).join('┳') + '┓';
+  const gBot = '┗' + widths.map((w) => '━'.repeat(w + 2)).join('┻') + '┛';
+  const G = (s) => (color ? Z.grid.fg + s + RESET : s);
+
+  lines.push(G(gTop));
+  for (let r = 0; r < 6; r++) {
+    let line = G('┃');
+    zones.forEach((rows, zi) => {
+      const z = Z[ZONES[zi].zone];
+      const cell = ' ' + rows[r] + ' ';
+      line += color ? z.bg + z.fg + cell + RESET : cell;
+      line += G('┃');
+    });
+    lines.push(line);
+  }
+  lines.push(G(gBot));
+  lines.push('');
+  lines.push(color ? Z.dim.fg + '  ' + TAGLINE + RESET : '  ' + TAGLINE);
+  lines.push(color ? '  ' + Z.grid.fg + PROMPT + RESET : '  ' + PROMPT);
+  return lines.join('\n');
+}
+
+module.exports = { buildLogo, TAGLINE, PROMPT };
+
+if (require.main === module) {
+  const plain = process.argv.includes('--plain');
+  process.stdout.write(buildLogo(plain ? { color: false } : {}) + '\n');
+}

package/lib/hmi/part8-egress-gate.cjs

@@ -0,0 +1,149 @@
+'use strict';
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * Phase 196-05 (PB8-07/08) -- the Part-8 ambiguous-egress Decision Gate.
+ * ==========================================================================
+ * When classify() (lib/core/part8-egress-guard.cjs) cannot PROVE a MOVE-SET
+ * packet yet finds no hard CONTENT-SET hit, the safe move is to gate to the
+ * navigator (D-08), never a silent send-anyway (D-01). This module is that
+ * gate: a thin composition over the shipped open-vocab Shape F.1 renderer
+ * (lib/hmi/shape-f1-renderer.cjs). It invents no new selector shape (Part 7
+ * reuse) and mints no new frozen scalar.
+ *
+ * Constitutional invariants:
+ *   - D-01: the verb set is EXACTLY {Reformulate, Cancel} plus the auto-appended
+ *     Free-Text. There is NO send-anyway / Approve / Override / Proceed verb.
+ *     A flagged packet has no way through; the only options are reformulate to a
+ *     generic methodology handle or cancel. Asserted by construction below.
+ *   - D-09: the header names the leak CLASS slug ONLY, never the offending bytes.
+ *     No payload sample rides the render.
+ *   - D-08a: the Brain-less degrade helper does NOT render. With no wire nothing
+ *     can leak, so it best-effort LOCAL-logs brain_egress_ambiguous and signals
+ *     allow -- no navigator interruption.
+ *   - This module opens ZERO Brain wire and makes ZERO network call.
+ *
+ * 'Reformulate' is already a CANONICAL_VERB (shape-f1-renderer.cjs:44); 'Cancel'
+ * rides the user-supplied verb path (capped at 5, Free-Text appended last).
+ * Reformulate is marked recommended in Mode A.
+ *
+ * NO em-dashes anywhere (CLAUDE.md HARD RULE). Hyphens only. Pure CJS, zero deps.
+ *
+ * License: BSL 1.1.
+ */
+
+const path = require('node:path');
+
+const RENDERER_PATH = path.join(__dirname, 'shape-f1-renderer.cjs');
+const ONTOLOGY_PATH = path.join(__dirname, '..', 'core', 'part8-egress-ontology.cjs');
+
+// The exact verb set the gate offers. Reformulate + Cancel ONLY; the renderer
+// appends Free-Text last automatically. This constant is the D-01 contract.
+const GATE_VERBS = ['Reformulate', 'Cancel'];
+const RECOMMENDED_VERB = 'Reformulate';
+
+// By-construction guard: no verb in this deny-list may ever appear in a rendered
+// gate. A send-anyway verb would let a flagged packet egress, breaching D-01.
+const FORBIDDEN_VERBS = [
+  'Send', 'SendAnyway', 'Send-Anyway', 'Send Anyway',
+  'Approve', 'Override', 'Proceed', 'Allow', 'Force',
+];
+
+/**
+ * _classSlug(v) -> string
+ *
+ * Reduce the class to a bounded lowercase slug so the header can name the leak
+ * CATEGORY without ever carrying an offending byte (D-09). Anything non-slug
+ * collapses to 'unknown'.
+ */
+function _classSlug(v) {
+  if (typeof v !== 'string' || v.length === 0) return 'unknown';
+  const s = v.toLowerCase().replace(/[^a-z0-9_]/g, '_').slice(0, 40);
+  return s.length > 0 ? s : 'unknown';
+}
+
+/**
+ * _numericTier(tier) -> number
+ *
+ * The renderer keys Mode A off a NUMERIC tier >= 2 (shape-f1-renderer.cjs:133).
+ * The gate is always a Mode-A decision gate (Reformulate recommended), so map
+ * 'A' / undefined / any non-number to 2, and an explicit 'B' to 0. A caller that
+ * passes a real number keeps it.
+ */
+function _numericTier(tier) {
+  if (typeof tier === 'number') return tier;
+  if (tier === 'B') return 0;
+  return 2; // Mode A default -- the ambiguous gate always recommends Reformulate.
+}
+
+/**
+ * renderGate(v) -> { zones, contract }
+ *
+ * v = { verdict?, class?, reason?, tier? }. Compose the Shape F.1 renderer with
+ * the fixed {Reformulate, Cancel} verb set and a class-slug-only header. Returns
+ * the renderer's { zones, contract } straight through. Asserts by construction
+ * that no send-anyway verb leaked into the contract before returning.
+ */
+function renderGate(v) {
+  const input = (v && typeof v === 'object') ? v : {};
+  const classSlug = _classSlug(input.class);
+  const tier = _numericTier(input.tier);
+  const header = '-- part 8 -- this may leak ' + classSlug + ' -- pick --';
+
+  const renderShapeF1 = require(RENDERER_PATH).renderShapeF1;
+  const out = renderShapeF1({
+    tier: tier,
+    recommendedVerb: RECOMMENDED_VERB,
+    verbs: GATE_VERBS.slice(),
+    header: header,
+  });
+
+  // By-construction assertion (D-01): the composed contract must carry NO
+  // send-anyway verb. The verb set is fixed above so this can never trip; it is
+  // a self-check that fails LOUD rather than silently egress a flagged packet.
+  const verbs = (out && out.contract && Array.isArray(out.contract.verbs))
+    ? out.contract.verbs
+    : [];
+  for (let i = 0; i < FORBIDDEN_VERBS.length; i++) {
+    if (verbs.indexOf(FORBIDDEN_VERBS[i]) !== -1) {
+      throw new Error('part8-egress-gate: send-anyway verb "' + FORBIDDEN_VERBS[i]
+        + '" is forbidden (D-01)');
+    }
+  }
+  return out;
+}
+
+/**
+ * degrade(info, db) -> { allow, rendered }
+ *
+ * The Brain-less path (D-08a): isAvailable() is false, so there is no wire and
+ * nothing can leak. Do NOT render the gate. Best-effort LOCAL-log the ambiguous
+ * decision via the ontology writer (scalars + slug only, D-09), then signal
+ * allow. Never throws; a telemetry failure never changes the allow signal.
+ *
+ * info = { class?, reason?, count?, sessionId? }. db is the SQLite handle (or
+ * undefined -- the ontology writer no-ops on a falsy db).
+ */
+function degrade(info, db) {
+  const meta = (info && typeof info === 'object') ? info : {};
+  try {
+    require(ONTOLOGY_PATH).record(db, {
+      verdict: 'ambiguous',
+      class: meta.class,
+      matched_pattern: meta.reason,
+      count: meta.count,
+      sessionId: meta.sessionId,
+    });
+  } catch (_e) {
+    // best-effort: a telemetry failure never blocks the allow (D-08a).
+  }
+  return { allow: true, rendered: false };
+}
+
+module.exports = {
+  renderGate: renderGate,
+  degrade: degrade,
+  GATE_VERBS: GATE_VERBS.slice(),
+  RECOMMENDED_VERB: RECOMMENDED_VERB,
+  FORBIDDEN_VERBS: FORBIDDEN_VERBS.slice(),
+};

package/lib/hmi/reach-component-map.json

@@ -0,0 +1,47 @@
+{
+  "_doc": {
+    "purpose": "Phase 148-03 (IRW-04, D-03): the reach_id/sub_mode -> archetype component map. Registry-is-the-table: the dispatcher (lib/hmi/selector-dispatcher.cjs) reads this data file via resolveArchetype() and NEVER a hardcoded switch, mirroring the connector-registry / dispatch-framework-map pattern. A new reach joins by adding a row here, never by editing dispatcher code.",
+    "archetype_vocabulary": [
+      "select",
+      "multiSelect",
+      "ordered",
+      "group",
+      "confirm",
+      "auto",
+      "text"
+    ],
+    "vocabulary_meaning": [
+      { "archetype": "select", "meaning": "the default Shape F.1 single-pick path" },
+      { "archetype": "multiSelect", "meaning": "AskUserQuestion multiSelect:true (batch several engines, D-01)" },
+      { "archetype": "ordered", "meaning": "an ordering follow-up prompt for compose-a-chain (D-02; NOT a live ordered widget -- the TTY wall forbids it, Phase 154)" },
+      { "archetype": "group", "meaning": "grouped multi-select lanes" },
+      { "archetype": "confirm", "meaning": "a confirm follow-up gate before running (D-06 hats, plan-gated deep_research)" },
+      { "archetype": "auto", "meaning": "no pick -- the host runs it automatically (D-04 Brain review)" },
+      { "archetype": "freeText", "meaning": "free-text capture (the text archetype routes here)" }
+    ],
+    "dispatch_rule": "Every archetype resolves through the dispatcher (SEED-020). No bespoke AskUserQuestion construction outside lib/hmi/selector-dispatcher.cjs.",
+    "default_on_miss": "select"
+  },
+  "reaches": {
+    "context_block": { "archetype": "select" },
+    "contradiction": { "archetype": "select" },
+    "cross_room": { "archetype": "select" },
+    "brain_consult": { "archetype": "select" },
+    "deep_research": { "archetype": "confirm" },
+    "hats": { "archetype": "confirm" }
+  },
+  "sub_modes": {
+    "reverse-salient": { "archetype": "multiSelect" },
+    "whitespace": { "archetype": "multiSelect" },
+    "cross-domain-analogy": { "archetype": "multiSelect" },
+    "cross-domain-connect": { "archetype": "multiSelect" },
+    "dominant-design": { "archetype": "multiSelect" },
+    "six-hats": { "archetype": "confirm" },
+    "systems-thinking-loop": { "archetype": "multiSelect" }
+  },
+  "standing_options": {
+    "_compose": { "archetype": "ordered" },
+    "_file": { "archetype": "multiSelect" },
+    "_brain_review": { "archetype": "auto" }
+  }
+}

package/lib/hmi/reach-relevance-gate.cjs

@@ -0,0 +1,147 @@
+'use strict';
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * reach-sensor-relevance-gap B1 -- the structural relevance gate for the reach dial.
+ * =============================================================================
+ * Root cause B (proven in .planning/debug/resolved/reach-sensor-relevance-gap.md):
+ * the reach-dial render seam had NO structural check that a candidate reach is
+ * actually relevant to the live conversation. `cross_room` is a permanent
+ * registry_only member of the 6-reach bank (dial-reach-orchestrator REACH_DEFS,
+ * default 0.5), so in a cold/tier_0 room it is always offered; its {room_name}/
+ * {topic} slots were filled from the CURRENT room and the top graph node, never
+ * compared to the live turn -- so it surfaced a topically-disconnected room+claim
+ * (the observed "Borrow what iris2026 learned about claim:derive:5c15cde4" case
+ * during an unrelated Windows-update conversation). Relevance was delegated
+ * entirely to advisory model text.
+ *
+ * THIS MODULE is the machine-enforced relevance check. It is PURE + synchronous:
+ * given the live turn text and the resolved slot content, it returns the set of
+ * reach_ids to SUPPRESS. The caller (renderEngineDecisionWithDial) merges that set
+ * into the existing suppressedReachIds drop path that buildReachList already
+ * honors -- so the render SEAM stays pure (buildReachList does the drop; this
+ * module never touches the reach bank, the frozen 0.70/0.15 gate, or renderDial).
+ *
+ * SCOPE (the "starting with cross_room" scope from the approved fix decision):
+ * only the CROSS-ROOM class of reach is turn-relevance-gated. A within-room reach
+ * (context_block / contradiction / hats / deep_research / brain_consult) operates
+ * on the CURRENT room's own content and its {topic} is the room's own focus node,
+ * so "off-topic to this one turn" does NOT make it irrelevant -- suppressing it
+ * would be over-enforcement. cross_room is the one reach whose entire value is
+ * reaching into a DIFFERENT room, so it is relevant ONLY when that different room
+ * relates to what is being discussed. RELEVANCE_GATED_REACHES is the extension
+ * point if a future cross-room-class reach is minted.
+ *
+ * NO-OP CONTRACT: when there is no live turn text (empty), the gate returns [] --
+ * byte-identical to the pre-B1 render (the classifier always has a live turn in
+ * production; a unit test that drives the render seam without a turn is unchanged).
+ *
+ * Canon Part 8: LOCAL-only. Zero Brain calls, zero network, zero fs, zero db.
+ * Pure CJS, node built-ins only, zero deps. No em-dashes. Hyphens only.
+ *
+ * Public API:
+ *   computeOffTopicReachIds({ slotContext, liveTurnText, currentRoomName }) -> string[]
+ *   RELEVANCE_GATED_REACHES
+ *
+ * License: BSL 1.1.
+ */
+
+// The reach classes whose relevance genuinely depends on the live-turn topic.
+// Only cross_room today: the one reach that reaches into a DIFFERENT room.
+const RELEVANCE_GATED_REACHES = Object.freeze(['cross_room']);
+
+// Local stopword set (mirrors scripts/intent-classifier.cjs tokenize so the gate
+// tokenizes the live turn the same way the room scorer does -- no shared import to
+// keep this module dependency-free and pure).
+const STOP_WORDS = new Set([
+  'a', 'an', 'the', 'of', 'to', 'in', 'on', 'at',
+  'and', 'or', 'but', 'is', 'are', 'was', 'were', 'be', 'been',
+]);
+
+function tokenize(text) {
+  if (!text || typeof text !== 'string') return [];
+  const rough = text.toLowerCase().split(/[^a-z0-9]+/);
+  const out = [];
+  for (const t of rough) {
+    if (!t) continue;
+    if (t.length < 2) continue;
+    if (STOP_WORDS.has(t)) continue;
+    out.push(t);
+  }
+  return out;
+}
+
+// Any single shared token counts as topical overlap (a deliberately LOW floor:
+// the goal is to drop the ZERO-overlap off-topic case the bug produced, not to
+// second-guess a genuinely related reach).
+function hasOverlap(liveTokenSet, contentTokens) {
+  for (const t of contentTokens) {
+    if (liveTokenSet.has(t)) return true;
+  }
+  return false;
+}
+
+/**
+ * computeOffTopicReachIds({ slotContext, liveTurnText, currentRoomName }) -> string[]
+ *
+ * slotContext:     the resolved dial slot map (buildDialSlotContext output). For
+ *                  cross_room the relevant slots are `room_name` (the resolved
+ *                  cross-room TARGET room) and `topic`.
+ * liveTurnText:    the current user turn (STDIN_MESSAGE on the live hook).
+ * currentRoomName: the current room's basename, used to catch borrow-from-self.
+ *
+ * Returns the reach_ids to suppress. Never throws (a malformed input yields []).
+ */
+function computeOffTopicReachIds(args) {
+  try {
+    const a = (args && typeof args === 'object') ? args : {};
+    const slotContext = (a.slotContext && typeof a.slotContext === 'object') ? a.slotContext : {};
+    const liveTurnText = (typeof a.liveTurnText === 'string') ? a.liveTurnText : '';
+    const currentRoomName = (typeof a.currentRoomName === 'string' && a.currentRoomName.length > 0)
+      ? a.currentRoomName
+      : null;
+
+    const liveTokens = new Set(tokenize(liveTurnText));
+    // No live turn -> no basis to judge relevance -> no-op (NO-OP CONTRACT above).
+    if (liveTokens.size === 0) return [];
+
+    const suppressed = [];
+    for (const reachId of RELEVANCE_GATED_REACHES) {
+      if (reachId === 'cross_room') {
+        const room = (typeof slotContext.room_name === 'string') ? slotContext.room_name.trim() : '';
+        // No genuinely different target room was resolved -> cross_room has nowhere
+        // to reach -> suppress (this is the cold-room case that produced the bug;
+        // buildDialSlotContext no longer borrows the current room into room_name).
+        if (room.length === 0) { suppressed.push(reachId); continue; }
+        // Borrow-from-self guard: a target equal to the current room is not a
+        // cross-room reach at all.
+        if (currentRoomName && room.toLowerCase() === currentRoomName.toLowerCase()) {
+          suppressed.push(reachId);
+          continue;
+        }
+        // Off-topic: the target room name + topic share ZERO tokens with the live
+        // turn -> the navigator is not talking about anything that room covers.
+        const topic = (typeof slotContext.topic === 'string') ? slotContext.topic : '';
+        const contentTokens = tokenize(room + ' ' + topic);
+        if (!hasOverlap(liveTokens, contentTokens)) {
+          suppressed.push(reachId);
+        }
+      }
+    }
+    return suppressed;
+  } catch (_e) {
+    // Fail-open: a gate fault never blocks or distorts the render (it degrades to
+    // the pre-B1 no-suppression behavior).
+    return [];
+  }
+}
+
+module.exports = {
+  computeOffTopicReachIds: computeOffTopicReachIds,
+  RELEVANCE_GATED_REACHES: RELEVANCE_GATED_REACHES,
+  // Exposed for direct unit testing (never buried as closures).
+  _test: Object.freeze({
+    tokenize: tokenize,
+    hasOverlap: hasOverlap,
+  }),
+};