@mindrian_os/install 1.13.0-beta.11

package/lib/core/persona-taxonomy.cjs

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+'use strict';
+
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * Phase 91-01 -- persona taxonomy frozen tables (pure, zero I/O)
+ * ==============================================================
+ * Frozen vocabulary tables that codify the Larry / Brain persona
+ * boundary plus the Canon Part 2 + Part 2a role-blend and journey-stage
+ * enums. These tables are the contract between:
+ *
+ *   - lib/core/user-md-ops.cjs   (validates USER.md frontmatter values)
+ *   - lib/core/navigation-engine.cjs (routes by persona + journey stage)
+ *   - lib/core/brain-derivation-prompts.cjs (only generic persona TAGS
+ *     ever cross the Canon Part 8 boundary; never role_blend weights or
+ *     user_id)
+ *
+ * Locked decision D-03 (Phase 91 CONTEXT):
+ *   Larry detects 3 personas -- TTO / Researcher / Business
+ *   Brain knows 2 personas -- Explicit / Implicit
+ *   Translation is many-to-one -- TTO + Business -> Explicit;
+ *                                Researcher -> Implicit
+ *
+ * Inverse translation (Brain -> Larry) is intentionally NOT exported
+ * because the mapping cannot be inverted deterministically.
+ *
+ * Pure module: zero I/O, zero requires beyond the (omitted) stdlib. All
+ * exports are frozen at module load time. Three-surface compatible
+ * (CLI hook, Desktop MCP handler, Cowork shared runner) by construction.
+ *
+ * License: BSL 1.1.
+ */
+
+// ---------- Larry-side detection vocabulary ----------
+
+/**
+ * Three Larry personas, in detection-priority order. Frozen.
+ * Source: MindrianV2 prompts/larry_skill/* + 89.5-0X discovery engine
+ * persona-detection rules.
+ */
+const LARRY_PERSONAS = Object.freeze([
+  'TTO',
+  'Researcher',
+  'Business',
+]);
+
+// ---------- Brain-side classification vocabulary ----------
+
+/**
+ * Two Brain personas. The Brain side of the boundary uses a coarser
+ * grain than Larry by design: Explicit problems chain to well-defined
+ * methodology trees; Implicit problems chain to ill-defined / wicked
+ * methodology trees. Frozen.
+ */
+const BRAIN_PERSONAS = Object.freeze([
+  'Explicit',
+  'Implicit',
+]);
+
+// ---------- D-03 translation table (Larry -> Brain, many-to-one) ----------
+
+/**
+ * Many-to-one Larry -> Brain mapping.
+ *
+ * | Larry      | Brain    | Rationale                                   |
+ * |------------|----------|---------------------------------------------|
+ * | TTO        | Explicit | Tech-Transfer-Officer asks well-defined     |
+ * |            |          | questions about tools.                      |
+ * | Researcher | Implicit | Researcher works in undefined / ill-defined |
+ * |            |          | problem space.                              |
+ * | Business   | Explicit | Business asks well-defined strategic /      |
+ * |            |          | operational questions.                      |
+ *
+ * Frozen.
+ */
+const LARRY_TO_BRAIN = Object.freeze({
+  TTO: 'Explicit',
+  Researcher: 'Implicit',
+  Business: 'Explicit',
+});
+
+// ---------- Campbell journey-stage vocabulary (Canon Part 2a) ----------
+
+/**
+ * Twelve-stage Campbell monomyth in canonical order. The user's current
+ * journey stage is one axis of persona = role-blend x journey-stage.
+ * Frozen.
+ */
+const JOURNEY_STAGES = Object.freeze([
+  'ordinary_world',
+  'call_to_adventure',
+  'refusal',
+  'meeting_the_mentor',
+  'crossing_threshold',
+  'tests_allies_enemies',
+  'approach_inmost_cave',
+  'ordeal',
+  'reward',
+  'road_back',
+  'resurrection',
+  'return_with_elixir',
+]);
+
+// ---------- Role-blend axes (Canon Part 2 9-role minus regulatory) ----------
+
+/**
+ * Seven role-blend weight axes per Canon Part 2 9-role taxonomy with
+ * regulatory subtypes (Researcher.IND, Founder.grant) excluded -- those
+ * are regulatory layers on top of a base role, not first-class blend
+ * axes. The two excluded subtypes still appear in Canon Part 8 persona
+ * protections but never as role_blend keys. Frozen.
+ */
+const ROLE_BLEND_AXES = Object.freeze([
+  'Founder',
+  'Researcher',
+  'Operator',
+  'Investor',
+  'Mentor',
+  'Domain Expert',
+  'Student',
+]);
+
+// ---------- Problem-type vocabulary (Canon Part 3 + Phase 90) ----------
+
+/**
+ * Closed problem-type enum: Undefined, Ill-Defined, Well-Defined, plus
+ * an explicit unknown sentinel for cold starts. Matches BONO axis 1
+ * (definition clarity) per Canon Part 3 + Phase 90 ProblemType
+ * classification. Frozen.
+ */
+const PROBLEM_TYPES = Object.freeze([
+  'UDP',
+  'IDP',
+  'WDP',
+  'unknown',
+]);
+
+// ---------- Venture-stage vocabulary (Canon) ----------
+
+/**
+ * Closed venture-stage enum tracking the user's stage in the venture
+ * lifecycle. unknown sentinel allowed for cold-start sessions. Frozen.
+ */
+const VENTURE_STAGES = Object.freeze([
+  'pre_opportunity',
+  'thesis_build',
+  'validation',
+  'execution',
+  'scale',
+  'unknown',
+]);
+
+// ---------- Translation helper ----------
+
+/**
+ * Translate a Larry persona to its Brain counterpart per D-03.
+ *
+ * Returns the corresponding Brain persona string when the input is a
+ * known Larry persona; returns null otherwise. Graceful fallback: never
+ * throws on unknown / non-string input. The null sentinel lets callers
+ * decide how to handle a cold-start "no persona detected yet" condition
+ * without a try/catch.
+ *
+ * No inverse function is exported: the mapping is many-to-one (TTO +
+ * Business both map to Explicit) and therefore not deterministically
+ * invertible. Callers that need Brain -> Larry must consult full
+ * USER.md context.
+ *
+ * @param {string} larryPersona One of LARRY_PERSONAS (case-sensitive).
+ * @returns {string|null} Brain persona string or null when unknown.
+ */
+function translateLarryToBrain(larryPersona) {
+  if (typeof larryPersona !== 'string') return null;
+  if (!Object.prototype.hasOwnProperty.call(LARRY_TO_BRAIN, larryPersona)) {
+    return null;
+  }
+  return LARRY_TO_BRAIN[larryPersona];
+}
+
+module.exports = {
+  LARRY_PERSONAS,
+  BRAIN_PERSONAS,
+  LARRY_TO_BRAIN,
+  JOURNEY_STAGES,
+  ROLE_BLEND_AXES,
+  PROBLEM_TYPES,
+  VENTURE_STAGES,
+  translateLarryToBrain,
+};

package/lib/core/platform-gates.cjs

@@ -0,0 +1,120 @@
+'use strict';
+
+/**
+ * platform-gates.cjs -- GrowthBook feature gate monitor
+ *
+ * Monitors Anthropic platform feature gates via environment variables.
+ * Returns boolean status for each gate so MindrianOS can auto-activate
+ * features when they go live.
+ *
+ * Gates are GrowthBook feature flags injected into the Claude runtime
+ * environment when Anthropic ships new platform capabilities.
+ *
+ * Requirement: READY-04
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * Known platform gates and their MindrianOS feature mappings
+ */
+const GATE_MAP = {
+  tengu_kairos: {
+    envVar: 'tengu_kairos',
+    description: 'KAIROS background memory - daily log consolidation, overnight context processing',
+    mindrianFeature: 'kairos-daily-log',
+    skillAffected: 'context-engine',
+  },
+  tengu_harbor: {
+    envVar: 'tengu_harbor',
+    description: 'UDS cross-instance state sharing - multi-user room sync',
+    mindrianFeature: 'uds-listener',
+    skillAffected: 'room-passive',
+  },
+  tengu_scratch: {
+    envVar: 'tengu_scratch',
+    description: 'Scratch persistent workspace - file persistence across sessions',
+    mindrianFeature: 'persistent-workspace',
+    skillAffected: 'room-passive',
+  },
+  tengu_portal_quail: {
+    envVar: 'tengu_portal_quail',
+    description: 'Portal - enhanced MCP App rendering and interaction capabilities',
+    mindrianFeature: 'enhanced-mcp-apps',
+    skillAffected: 'app-views',
+  },
+};
+
+/**
+ * Check all known platform gates
+ *
+ * @returns {{ kairos: boolean, harbor: boolean, scratch: boolean, portal: boolean }}
+ */
+function checkGates() {
+  return {
+    kairos: isGateActive('tengu_kairos'),
+    harbor: isGateActive('tengu_harbor'),
+    scratch: isGateActive('tengu_scratch'),
+    portal: isGateActive('tengu_portal_quail'),
+  };
+}
+
+/**
+ * Check if a specific gate is active
+ *
+ * A gate is active when:
+ * 1. The corresponding env var is set to 'true' or '1', OR
+ * 2. A local override file exists at room/.mindrian/{gate}-active
+ *
+ * @param {string} gateName - Gate key from GATE_MAP
+ * @param {string} [roomPath] - Optional room path for local override check
+ * @returns {boolean}
+ */
+function isGateActive(gateName, roomPath) {
+  const gate = GATE_MAP[gateName];
+  if (!gate) return false;
+
+  // Check environment variable
+  const envVal = process.env[gate.envVar];
+  if (envVal === 'true' || envVal === '1') return true;
+
+  // Check local override file (allows testing without env var)
+  if (roomPath) {
+    const overridePath = path.join(roomPath, '.mindrian', `${gateName}-active`);
+    if (fs.existsSync(overridePath)) return true;
+  }
+
+  return false;
+}
+
+/**
+ * Get a summary of all gates for session-start display
+ *
+ * @param {string} [roomPath] - Optional room path for local override check
+ * @returns {object} Summary with active gates and their features
+ */
+function getGateSummary(roomPath) {
+  const gates = checkGates();
+  const active = [];
+  const inactive = [];
+
+  for (const [key, isActive] of Object.entries(gates)) {
+    const fullKey = key === 'portal' ? 'tengu_portal_quail' : `tengu_${key}`;
+    const gate = GATE_MAP[fullKey];
+    if (isActive) {
+      active.push({ gate: fullKey, feature: gate.mindrianFeature, skill: gate.skillAffected });
+    } else {
+      inactive.push(fullKey);
+    }
+  }
+
+  return {
+    anyActive: active.length > 0,
+    active,
+    inactive,
+    total: Object.keys(GATE_MAP).length,
+  };
+}
+
+module.exports = { checkGates, isGateActive, getGateSummary, GATE_MAP };

package/lib/core/platform.cjs

@@ -0,0 +1,257 @@
+'use strict';
+
+/**
+ * platform.cjs -- canonical cross-platform dispatch helper for MindrianOS.
+ *
+ * Provides OS detection, terminal code-page introspection, safe plugin.json
+ * reads, and hook-script path resolution. Every downstream plan (85-02
+ * node:sqlite migration, 85-06 banner rendering) depends on this module as
+ * the single source of truth for platform-sensitive behavior.
+ *
+ * Design notes:
+ *   - Zero new runtime dependencies. Only Node built-ins.
+ *   - detectPlatform() reports the EXECUTION environment, not the user's
+ *     desktop OS. On Cowork, process.platform may be 'linux' even if the
+ *     user is driving from Windows. Callers that care about the user's
+ *     actual terminal (banner rendering, code-page gating) must handle
+ *     that distinction themselves.
+ *   - All helpers are fail-safe. getPluginVersion() returns the literal
+ *     string 'unknown' on any error rather than throwing, so the banner
+ *     always renders.
+ *
+ * Requirement: WIN-FIX-H-01, WIN-FIX-B-01, WIN-FIX-B-02
+ */
+
+const { spawnSync } = require('node:child_process');
+const path = require('node:path');
+
+let _cachedPlatform = null;
+
+/**
+ * Detect the current execution environment.
+ *
+ * @returns {{
+ *   os: 'win32'|'linux'|'darwin',
+ *   shell: string|null,
+ *   hasPython3: boolean,
+ *   hasBashNative: boolean,
+ *   codePage: number|null,
+ *   supportsUtf8: boolean
+ * }}
+ */
+function detectPlatform() {
+  if (_cachedPlatform) return _cachedPlatform;
+
+  const os = process.platform;
+
+  // Shell sniff: SHELL (POSIX) -> TERM_PROGRAM (macOS Terminal/iTerm)
+  // -> ComSpec (win32 cmd.exe).
+  const shell =
+    process.env.SHELL ||
+    process.env.TERM_PROGRAM ||
+    process.env.ComSpec ||
+    null;
+
+  // python3 probe. On win32, the Microsoft Store alias stub lives under
+  // AppData/Local/Microsoft/WindowsApps/python3.exe and responds to
+  // --version with an install prompt, not a version string. Treat the
+  // stub as hasPython3:false so callers do not try to pipe JSON through
+  // an installer prompt.
+  let hasPython3 = false;
+  try {
+    const probe = spawnSync('python3', ['--version'], { stdio: 'ignore' });
+    hasPython3 = probe.status === 0;
+    if (hasPython3 && os === 'win32') {
+      try {
+        const where = spawnSync('where', ['python3'], { encoding: 'utf8' });
+        if (where.status === 0 && /WindowsApps[\\/]python3\.exe/i.test(where.stdout || '')) {
+          hasPython3 = false;
+        }
+      } catch (_e) {
+        hasPython3 = false;
+      }
+    }
+  } catch (_e) {
+    hasPython3 = false;
+  }
+
+  // bash probe.
+  let hasBashNative = false;
+  try {
+    const probe = spawnSync('bash', ['--version'], { stdio: 'ignore' });
+    hasBashNative = probe.status === 0;
+  } catch (_e) {
+    hasBashNative = false;
+  }
+
+  // Terminal code page (win32 only). On POSIX there is no equivalent
+  // concept; LANG governs encoding.
+  let codePage = null;
+  if (os === 'win32') {
+    try {
+      const cp = spawnSync('chcp', [], { shell: true, encoding: 'utf8' });
+      if (cp.status === 0 && typeof cp.stdout === 'string') {
+        const match = cp.stdout.match(/(\d{3,5})/);
+        if (match) codePage = parseInt(match[1], 10);
+      }
+    } catch (_e) {
+      codePage = null;
+    }
+  }
+
+  const supportsUtf8 =
+    os !== 'win32' ||
+    codePage === 65001 ||
+    /UTF-?8/i.test(process.env.LANG || '');
+
+  _cachedPlatform = {
+    os,
+    shell,
+    hasPython3,
+    hasBashNative,
+    codePage,
+    supportsUtf8,
+  };
+  return _cachedPlatform;
+}
+
+/**
+ * Read and parse the plugin.json manifest from the given plugin root.
+ * Uses Node's native JSON loader so no python3 / jq / shell is involved.
+ *
+ * @param {string} pluginRoot absolute path to the plugin root directory
+ * @returns {object} parsed plugin.json contents
+ * @throws if the file is missing or invalid JSON
+ */
+function readPluginJson(pluginRoot) {
+  const abs = path.resolve(pluginRoot, '.claude-plugin', 'plugin.json');
+  // Bust the require cache so hot version bumps during a single process
+  // lifetime are reflected. Cheap: the file is a few KB.
+  delete require.cache[require.resolve(abs)];
+  // eslint-disable-next-line global-require, import/no-dynamic-require
+  return require(abs);
+}
+
+/**
+ * Convenience helper. Returns the plugin version string, or the literal
+ * 'unknown' on any error. NEVER throws. The banner MUST always render.
+ *
+ * @param {string} pluginRoot absolute path to the plugin root directory
+ * @returns {string} version string or 'unknown'
+ */
+function getPluginVersion(pluginRoot) {
+  try {
+    const manifest = readPluginJson(pluginRoot);
+    if (manifest && typeof manifest.version === 'string' && manifest.version.length > 0) {
+      return manifest.version;
+    }
+    return 'unknown';
+  } catch (_e) {
+    return 'unknown';
+  }
+}
+
+/**
+ * Back-compat alias. Plan 85-09 owns scripts/self-update and will define
+ * its own helper pattern. Exposed here under the exact name the plan
+ * frontmatter calls out for symmetry with getPluginVersion.
+ *
+ * @param {string} pluginRoot absolute path to the plugin root directory
+ * @returns {string} version string or 'unknown'
+ */
+function readPluginJsonVersion(pluginRoot) {
+  return getPluginVersion(pluginRoot);
+}
+
+/**
+ * Resolve the absolute path to a hook script under scripts/ using the
+ * current platform's path separator. On win32 this returns a backslash
+ * path; on POSIX, forward slashes. No shell-quoting is applied -- the
+ * caller is responsible for escaping when passing to a shell.
+ *
+ * Consumed by plan 85-06 for cross-platform banner wrapper paths.
+ *
+ * @param {string} scriptName base name of the script (e.g. 'session-start')
+ * @param {string} [pluginRoot] absolute path to the plugin root. Defaults
+ *                              to two levels up from this file (lib/core/..).
+ * @returns {string} absolute path to the resolved script
+ */
+function resolveHookScript(scriptName, pluginRoot) {
+  const root = pluginRoot || path.resolve(__dirname, '..', '..');
+  return path.join(root, 'scripts', scriptName);
+}
+
+/**
+ * Test-only helper. Resets the module-level memoization so tests can
+ * exercise detectPlatform() under controlled conditions.
+ */
+function __resetForTests() {
+  _cachedPlatform = null;
+}
+
+/**
+ * Open a URL in the user's default browser. Cross-platform dispatch with a
+ * STRICT localhost-only guard: non-local URLs are refused.
+ *
+ * Rationale (R-87-08-B): this helper is used by serve-dashboard-live and
+ * similar localhost tooling. Accepting arbitrary URLs here would let a
+ * malicious caller invoke a shell command with a URL we did not construct;
+ * the guard defense-in-depths against that. Spawn uses an argv array (never
+ * exec+template-string) so URL content cannot be interpreted as shell.
+ *
+ * @param {string} url  Must match http(s)://(127.0.0.1|localhost)(:port)?(/|$)
+ * @param {{preferredBrowser?: string}} [opts] reserved for future use
+ * @throws {Error} if url is not a localhost URL
+ * @returns {void}
+ */
+function openBrowser(url, opts) {
+  opts = opts || {};
+  if (typeof url !== 'string' || !url) {
+    throw new Error('openBrowser: url must be a non-empty string');
+  }
+  // R-87-08-B: reject anything that is not 127.0.0.1 or localhost.
+  // The trailing group requires a slash OR end-of-string so substrings
+  // like "http://localhost.evil.com/" cannot slip through.
+  if (!/^https?:\/\/(127\.0\.0\.1|localhost)(:\d+)?(\/|$)/.test(url)) {
+    throw new Error('openBrowser refuses non-localhost URL: ' + url);
+  }
+  // Test / CI gate (R-87-08-B follow-up): run through the guard above but do
+  // NOT actually spawn a browser when any of these env vars are set. This
+  // lets dashboard-server.test.cjs exercise the localhost guard without
+  // hijacking the developer's browser on every suite run. Activated by any
+  // of: MINDRIAN_OPEN_BROWSER_DISABLE=1, MINDRIAN_TEST_MODE=1, CI=1.
+  if (
+    process.env.MINDRIAN_OPEN_BROWSER_DISABLE === '1' ||
+    process.env.MINDRIAN_TEST_MODE === '1' ||
+    process.env.CI === '1'
+  ) {
+    return;
+  }
+  const { spawn } = require('node:child_process');
+  const plat = detectPlatform().os;
+  try {
+    if (plat === 'darwin') {
+      spawn('open', [url], { stdio: 'ignore', detached: true }).unref();
+    } else if (plat === 'win32') {
+      // `start "" <url>` -- the empty title arg is required by cmd.exe's
+      // `start` builtin. URL is already validated as localhost-only.
+      spawn('cmd', ['/c', 'start', '""', url], { stdio: 'ignore', detached: true, shell: false }).unref();
+    } else {
+      spawn('xdg-open', [url], { stdio: 'ignore', detached: true }).unref();
+    }
+  } catch (err) {
+    // Do NOT throw -- the caller has already printed the URL to stderr,
+    // so the user can still click / copy it. Surface the failure for debug.
+    process.stderr.write('[mindrian-os] openBrowser spawn failed: ' + err.message + '\n');
+  }
+}
+
+module.exports = {
+  detectPlatform,
+  readPluginJson,
+  readPluginJsonVersion,
+  getPluginVersion,
+  resolveHookScript,
+  openBrowser,
+  __resetForTests,
+};