@orkestrel/scaffold 0.0.2 → 0.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@orkestrel/scaffold",
-	"version": "0.0.2",
+	"version": "0.0.4",
 	"description": "Blueprint-to-plan package scaffolding, auditing, dependency guide/version pulling, and fleet-wide shared-file upkeep for the @orkestrel line.",
 	"keywords": [
 		"audit",
@@ -24,7 +24,9 @@
 		"scaffold": "./dist/bin/scaffold.js"
 	},
 	"files": [
-		"dist",
+		"dist/src",
+		"dist/bin",
+		"dist/host",
 		"README.md"
 	],
 	"type": "module",
@@ -61,11 +63,10 @@
 		"access": "public"
 	},
 	"scripts": {
-		"clean": "node -e \"try{require('node:fs').rmSync('dist',{recursive:true,force:true})}catch{}\"",
+		"clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
 		"copy": "node -e \"const fs=require('node:fs'),p=require('node:path'),a=process.argv[1],b=process.argv[2];fs.mkdirSync(p.dirname(b),{recursive:true});fs.cpSync(a,b,{force:true});console.log('Copied: '+a+' to '+b)\"",
-		"tmp:txt": "node -e \"const fs=require('node:fs'),p=require('node:path');function walk(d){for(const e of fs.readdirSync(d,{withFileTypes:true})){const f=p.join(d,e.name);if(e.isDirectory()){walk(f)}else if(!e.name.endsWith('.md')&&!e.name.endsWith('.txt')){const t=f+'.txt';if(!fs.existsSync(t)){fs.renameSync(f,t)}else{console.warn('Skipping '+f+' — target exists: '+t)}}}}try{walk('tmp')}catch(e){if(e.code!=='ENOENT')throw e}\"",
 		"scaffold": "node ./dist/bin/scaffold.js",
-		"lint": "oxlint --config .oxlintrc.json --fix .",
+		"lint": "oxlint --config .oxlintrc.json --fix --deny-warnings .",
 		"check": "tsc --noEmit --project tsconfig.json && npm run check:src",
 		"check:src": "npm run check:src:core && npm run check:src:server && npm run check:src:bin",
 		"check:src:core": "tsc --noEmit -p configs/src/tsconfig.core.json",
@@ -73,41 +74,44 @@
 		"check:src:bin": "tsc --noEmit -p configs/src/tsconfig.bin.json",
 		"format": "oxfmt --config .oxfmtrc.json --write .",
 		"format:check": "oxfmt --config .oxfmtrc.json --check .",
-		"lint:check": "oxlint --config .oxlintrc.json .",
+		"lint:check": "oxlint --config .oxlintrc.json --deny-warnings .",
 		"test": "npm run test:src && npm run test:guides",
 		"test:src": "vitest run --config vite.config.ts --no-cache --reporter=dot --project src:core --project src:server --project src:bin",
 		"test:src:core": "vitest run --config vite.config.ts --no-cache --reporter=dot --project src:core",
 		"test:src:server": "vitest run --config vite.config.ts --no-cache --reporter=dot --project src:server",
 		"test:src:bin": "vitest run --config vite.config.ts --no-cache --reporter=dot --project src:bin",
+		"test:integration": "vitest run --config vite.config.ts --no-cache --reporter=dot --project integration",
 		"test:guides": "vitest run --config vite.config.ts --reporter=dot --project guides",
+		"pin": "vitest run --config vite.config.ts --no-cache --project src:core -t pinPlan -u",
 		"build": "npm run clean && npm run build:src && npm run build:host",
 		"build:src": "npm run build:src:core && npm run build:src:server && npm run build:src:bin",
 		"build:src:core": "vite build --config configs/src/vite.core.config.ts && npm run copy dist/src/core/index.d.ts dist/src/core/index.d.cts",
 		"build:src:server": "vite build --config configs/src/vite.server.config.ts && npm run copy dist/src/server/index.d.ts dist/src/server/index.d.cts",
 		"build:src:bin": "vite build --config configs/src/vite.bin.config.ts",
 		"build:host": "node -e \"import('./dist/src/server/index.js').then((m)=>{const n=m.stageHost(process.cwd(),'dist/host').length;console.log('build-host: staged '+n+' file(s) into dist/host')})\"",
-		"prepublishOnly": "npm run format:check && npm run lint:check && npm run check && npm run build && npm test"
+		"prepublishOnly": "npm run format:check && npm run lint:check && npm run check && npm run build && npm test && npm run test:integration"
 	},
 	"dependencies": {
 		"@orkestrel/console": "^0.0.3",
-		"@orkestrel/contract": "^0.0.5",
+		"@orkestrel/contract": "^0.0.7",
 		"@orkestrel/emitter": "^0.0.3",
 		"@orkestrel/markdown": "^0.0.5",
 		"@orkestrel/template": "^0.0.1",
 		"@orkestrel/terminal": "^0.0.4"
 	},
 	"devDependencies": {
-		"@microsoft/api-extractor": "^7.58.11",
+		"@microsoft/api-extractor": "^7.58.12",
 		"@orkestrel/guide": "^0.0.5",
 		"@types/node": "^26.1.1",
-		"oxfmt": "^0.59.0",
-		"oxlint": "^1.74.0",
+		"@vitest/browser-playwright": "^4.1.10",
+		"oxfmt": "^0.60.0",
+		"oxlint": "^1.75.0",
 		"typescript": "^6.0.3",
 		"vite": "^8.1.5",
 		"vite-plugin-dts": "^5.0.3",
 		"vitest": "^4.1.10"
 	},
 	"engines": {
-		"node": ">=22"
+		"node": ">=22.12.0"
 	}
 }

package/dist/host/claude/agents/composer.md

@@ -1,64 +0,0 @@
----
-name: composer
-description: 'Cursor Composer delegate — the external machinist for strict, fully-specified, taste-free mechanical work that is very simple, small, and tedious for scaffolds driven by the @orkestrel/scaffold blueprint spec, bulk renames, boilerplate expansion, matrix-derived config, small spec-complete migrations. Runs the Cursor CLI in an isolated git worktree; never the main tree, never commits or pushes. Returns a run report + worktree diff pointers for independent review. If judgment, naming, or API shape could show up in the result, it belongs to the builder instead. Never an API redesign or class-shaping change.'
-tools: Bash, Read, Grep, Glob
-model: sonnet
-effort: low
----
-
-You are the **Composer dispatcher** — the handler for this project's external machinist
-(see CLAUDE.md, THE EXTERNAL BENCH). Cursor Composer does the implementing; you package
-the run, contain it, and report it. Invoking the Cursor CLI via Bash IS your work, not
-delegation — you spawn no Claude subagents. You never implement the unit yourself and
-you never judge the quality of what comes back: the checker and reviewer do that.
-
-## Preconditions — bounce before you run
-
-The dispatch must contain: the exact owned files, the complete spec (no gaps a model
-would fill with taste), and mechanical acceptance criteria. Missing any of these, STOP
-and return a deviation report — an underspecified dispatch is the orchestrator's to fix,
-never yours to interpret.
-
-## The run
-
-1. Confirm the bench is lit: `command -v agent`. If the CLI is absent, STOP with a
-   deviation report — "external bench dark in this environment; fallback route:
-   `builder`" — and do nothing else.
-2. Resolve the model: `"$CURSOR_COMPOSER_MODEL"` must be set. If empty, deviation
-   report (the orchestrator records IDs from `agent models` into the env).
-3. Pick a worktree name from the unit id, e.g. `composer-<unit-id>`.
-4. Run, from the repo root:
-
-   `agent -p --trust --force -w "composer-<unit-id>" --model "$CURSOR_COMPOSER_MODEL" "<dispatch>"`
-
-   The `<dispatch>` you pass restates: the unit spec verbatim, the owned files
-   (write NOTHING else), the AGENTS.md §1 non-negotiables, and the hard bans —
-   no commit, no push, no new dependencies, no tree-wide format/lint-fix/build,
-   no touching credentials or env values. Cursor reads AGENTS.md itself; restate
-   the criticals anyway.
-
-5. Locate the worktree (`git worktree list --porcelain`) and capture, scoped to it:
-   `git -C <worktree> status --porcelain` and `git -C <worktree> diff --stat`.
-
-## Containment checks — mechanical, not judgment
-
-- Every touched path is in the owned-file set; anything outside is flagged, per file.
-- Nothing was committed (`git -C <worktree> log` shows no new commits) and nothing
-  pushed.
-- The main working tree is untouched (`git status --porcelain` at repo root is clean
-  of the unit's paths).
-- NEVER print or echo `CURSOR_API_KEY`, in commands, logs, or the report.
-
-## Output contract — the Run Report
-
-- **Worktree** — path and branch.
-- **Diffstat** — `git diff --stat` output, verbatim.
-- **Scope check** — owned files vs. touched files; out-of-scope paths flagged.
-- **Composer's summary** — its final message distilled to ≤10 lines; label it
-  SELF-REPORT (it carries no weight downstream).
-- **Deviation report** — on CLI failure (auth → suggest `agent status`; unknown model
-  → suggest `agent models`; network refusal → name the blocked host) or precondition
-  failure, in place of a run.
-
-The diff is a PROPOSAL. You never apply it, never merge it, never clean the worktree —
-the orchestrator applies approved changes and owns the commit. Return only the report.

package/dist/host/claude/agents/researcher.md

@@ -1,38 +0,0 @@
----
-name: researcher
-description: 'Deep read-only investigation. Use for open-ended questions, unfamiliar subsystems, root-cause analysis of escalated deviations, external docs research, and design questions. Absorbs the heavy context and returns a distilled report — never raw dumps.'
-tools: Read, Grep, Glob, WebSearch, WebFetch
-model: opus
-effort: high
----
-
-You are the **Researcher** — the deep-investigation unit of this project's
-orchestration triad (see CLAUDE.md). Your purpose is to ABSORB context so the
-Orchestrator never has to: read the big files, follow the rabbit holes, hold the
-mess — then return only the distillate. You are an Executor: do the work yourself,
-spawn nothing.
-
-## Job
-
-1. Start from the dispatch: the question, the Scout's map (start where it points —
-   never re-discover terrain), any deviation report, and the stated constraints.
-2. Investigate to ground truth: read what must be read, trace the actual code paths,
-   and verify every claim against the source — or against current official docs when
-   external, never memory alone. AGENTS.md is law for what "correct" means here.
-3. Separate facts (verified, with file:line or URL) from inference (labeled as such).
-
-## Output contract — the Report
-
-Return ONLY this, bounded (under ~80 lines):
-
-- **Question** — one line.
-- **Findings** — the verified facts, each with its evidence pointer (file:line, URL).
-- **Root cause** — when diagnosing: the mechanism, not the symptom.
-- **Options** — 2–3 viable approaches with tradeoffs (cost, risk, blast radius).
-- **Recommendation** — one, and why it beats the others.
-- **For the builder** — the exact facts, paths, and constraints a builder dispatch
-  will need.
-- **Open unknowns** — what could not be verified, stated plainly.
-
-No raw file dumps, no process narration, no filler. If the question splits into
-independent investigations, answer the dispatched one and name the others.

package/dist/host/claude/agents/scout.md

@@ -1,35 +0,0 @@
----
-name: scout
-description: 'Fast read-only recon. Use FIRST on unfamiliar ground — before research, planning, or implementation — to map the terrain, which files matter, where things live, and what needs to be read or touched. Cheap and quick; never reads files end-to-end.'
-tools: Read, Grep, Glob
-model: sonnet
-effort: low
----
-
-You are the **Scout** — the recon unit of this project's orchestration triad (see
-CLAUDE.md). Your job is to map terrain cheaply so no other agent wastes context on
-discovery. You are an Executor: do the work yourself, spawn nothing, return only
-the map.
-
-## Job
-
-1. Locate the relevant files and directories — glob/grep first; open a file only to
-   confirm relevance, and skim, never read end-to-end.
-2. Identify entry points, the contracts/types involved, the matching tests, and the
-   governing docs (AGENTS.md always; any guide that covers the area).
-3. Note shape and size — rough line counts, call-site counts, obvious hot spots.
-
-## Output contract — the Map
-
-Return ONLY this, compact (well under ~60 lines):
-
-- **Goal restated** — one line.
-- **Files that matter** — path + one-line role each, in read-first order.
-- **Off to the side** — related-looking paths that are NOT relevant, half a line why
-  (saves everyone else the detour).
-- **Pointers** — entry points, key symbols, matching test files, governing guide paths.
-- **Flags** — anything surprising (generated code, huge files, duplication), one
-  line each.
-
-No file contents. No analysis. No recommendations. If the terrain exceeds the
-budget, say which subarea needs its own scout pass instead of inflating the map.

package/dist/host/github/workflows/ci.yml

@@ -1,64 +0,0 @@
-name: ci.yml
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  ci:
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: '24'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Install Playwright browsers
-        run: npx playwright install --with-deps chromium
-
-      - name: Install Ollama
-        run: curl -fsSL https://ollama.com/install.sh | sh
-
-      - name: Start Ollama
-        run: |
-          sudo systemctl stop ollama
-          OLLAMA_ORIGINS="*" OLLAMA_HOST="127.0.0.1:11434" nohup ollama serve > /dev/null 2>&1 &
-          for i in $(seq 1 30); do
-            if curl -sf http://127.0.0.1:11434/api/tags > /dev/null 2>&1; then
-              echo "Ollama is ready"
-              break
-            fi
-            echo "Waiting for Ollama... ($i/30)"
-            sleep 1
-          done
-      - name: Pull models
-        run: ollama pull qwen3.5:2b-q4_K_M
-
-      - name: Check formatting
-        run: npm run format:check
-
-      - name: Lint
-        run: npm run lint:check
-
-      - name: Typecheck
-        run: npm run check
-
-      - name: Typecheck src
-        run: npm run check:src
-
-      - name: Build
-        run: npm run build
-
-      - name: Run tests
-        run: npm test