@ouro.bot/cli 0.1.0-alpha.36 → 0.1.0-alpha.361

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (326) hide show
  1. package/README.md +194 -184
  2. package/{AdoptionSpecialist.ouro → SerpentGuide.ouro}/agent.json +3 -2
  3. package/{AdoptionSpecialist.ouro → SerpentGuide.ouro}/psyche/SOUL.md +1 -1
  4. package/{AdoptionSpecialist.ouro → SerpentGuide.ouro}/psyche/identities/the-serpent.md +1 -1
  5. package/changelog.json +2155 -0
  6. package/dist/arc/attention-types.js +8 -0
  7. package/dist/arc/cares.js +140 -0
  8. package/dist/arc/episodes.js +117 -0
  9. package/dist/arc/intentions.js +133 -0
  10. package/dist/arc/json-store.js +117 -0
  11. package/dist/arc/obligations.js +237 -0
  12. package/dist/arc/packets.js +193 -0
  13. package/dist/arc/presence.js +185 -0
  14. package/dist/arc/task-lifecycle.js +65 -0
  15. package/dist/heart/active-work.js +832 -0
  16. package/dist/heart/agent-entry.js +37 -2
  17. package/dist/heart/attachments/image-normalize.js +194 -0
  18. package/dist/heart/attachments/materialize.js +97 -0
  19. package/dist/heart/attachments/originals.js +88 -0
  20. package/dist/heart/attachments/render.js +29 -0
  21. package/dist/heart/attachments/sources/adapter.js +2 -0
  22. package/dist/heart/attachments/sources/bluebubbles.js +156 -0
  23. package/dist/heart/attachments/sources/cli-local-file.js +78 -0
  24. package/dist/heart/attachments/sources/index.js +16 -0
  25. package/dist/heart/attachments/store.js +103 -0
  26. package/dist/heart/attachments/types.js +93 -0
  27. package/dist/heart/auth/auth-flow.js +463 -0
  28. package/dist/heart/bridges/manager.js +358 -0
  29. package/dist/heart/bridges/state-machine.js +135 -0
  30. package/dist/heart/bridges/store.js +123 -0
  31. package/dist/heart/bundle-state.js +168 -0
  32. package/dist/heart/commitments.js +111 -0
  33. package/dist/heart/config-registry.js +304 -0
  34. package/dist/heart/config.js +53 -21
  35. package/dist/heart/core.js +743 -252
  36. package/dist/heart/cross-chat-delivery.js +131 -0
  37. package/dist/heart/daemon/agent-config-check.js +561 -0
  38. package/dist/heart/daemon/agent-discovery.js +79 -3
  39. package/dist/heart/daemon/agent-service.js +360 -0
  40. package/dist/heart/daemon/agentic-repair.js +185 -0
  41. package/dist/heart/daemon/bluebubbles-health-diagnostics.js +122 -0
  42. package/dist/heart/daemon/cadence.js +70 -0
  43. package/dist/heart/daemon/cli-defaults.js +591 -0
  44. package/dist/heart/daemon/cli-exec.js +2649 -0
  45. package/dist/heart/daemon/cli-help.js +306 -0
  46. package/dist/heart/daemon/cli-parse.js +913 -0
  47. package/dist/heart/daemon/cli-render-doctor.js +57 -0
  48. package/dist/heart/daemon/cli-render.js +560 -0
  49. package/dist/heart/daemon/cli-types.js +8 -0
  50. package/dist/heart/daemon/daemon-cli.js +30 -1171
  51. package/dist/heart/daemon/daemon-entry.js +358 -3
  52. package/dist/heart/daemon/daemon-health.js +141 -0
  53. package/dist/heart/daemon/daemon-runtime-sync.js +157 -12
  54. package/dist/heart/daemon/daemon-tombstone.js +236 -0
  55. package/dist/heart/daemon/daemon.js +757 -58
  56. package/dist/heart/daemon/doctor-types.js +8 -0
  57. package/dist/heart/daemon/doctor.js +465 -0
  58. package/dist/heart/daemon/health-monitor.js +79 -1
  59. package/dist/heart/daemon/hooks/agent-config-v2.js +33 -0
  60. package/dist/heart/daemon/hooks/bundle-meta.js +115 -1
  61. package/dist/heart/daemon/http-health-probe.js +80 -0
  62. package/dist/heart/daemon/inner-status.js +89 -0
  63. package/dist/heart/daemon/interactive-repair.js +91 -0
  64. package/dist/heart/daemon/launchd.js +46 -9
  65. package/dist/heart/daemon/log-tailer.js +82 -12
  66. package/dist/heart/daemon/logs-prune.js +105 -0
  67. package/dist/heart/daemon/message-router.js +17 -8
  68. package/dist/heart/daemon/os-cron-deps.js +134 -0
  69. package/dist/heart/daemon/ouro-bot-entry.js +1 -1
  70. package/dist/heart/daemon/process-manager.js +201 -0
  71. package/dist/heart/daemon/provider-discovery.js +140 -0
  72. package/dist/heart/daemon/pulse.js +475 -0
  73. package/dist/heart/daemon/run-hooks.js +2 -0
  74. package/dist/heart/daemon/runtime-logging.js +67 -16
  75. package/dist/heart/daemon/runtime-metadata.js +101 -0
  76. package/dist/heart/daemon/runtime-mode.js +67 -0
  77. package/dist/heart/daemon/safe-mode.js +161 -0
  78. package/dist/heart/daemon/sense-manager.js +72 -3
  79. package/dist/heart/daemon/session-id-resolver.js +131 -0
  80. package/dist/heart/daemon/skill-management-installer.js +94 -0
  81. package/dist/heart/daemon/socket-client.js +307 -0
  82. package/dist/heart/daemon/stale-bundle-prune.js +96 -0
  83. package/dist/heart/daemon/startup-tui.js +237 -0
  84. package/dist/heart/daemon/task-scheduler.js +3 -25
  85. package/dist/heart/daemon/thoughts.js +510 -0
  86. package/dist/heart/daemon/up-progress.js +135 -0
  87. package/dist/heart/delegation.js +62 -0
  88. package/dist/heart/habits/habit-migration.js +181 -0
  89. package/dist/heart/habits/habit-parser.js +140 -0
  90. package/dist/heart/habits/habit-scheduler.js +371 -0
  91. package/dist/heart/{daemon → hatch}/hatch-flow.js +52 -120
  92. package/dist/heart/{daemon → hatch}/hatch-specialist.js +3 -3
  93. package/dist/heart/{daemon → hatch}/specialist-prompt.js +10 -7
  94. package/dist/heart/{daemon → hatch}/specialist-tools.js +56 -10
  95. package/dist/heart/identity.js +154 -59
  96. package/dist/heart/kept-notes.js +357 -0
  97. package/dist/heart/kicks.js +2 -20
  98. package/dist/heart/machine-identity.js +161 -0
  99. package/dist/heart/mcp/mcp-server.js +653 -0
  100. package/dist/heart/migrate-config.js +127 -0
  101. package/dist/heart/model-capabilities.js +59 -0
  102. package/dist/heart/outlook/outlook-http-hooks.js +64 -0
  103. package/dist/heart/outlook/outlook-http-response.js +7 -0
  104. package/dist/heart/outlook/outlook-http-routes.js +232 -0
  105. package/dist/heart/outlook/outlook-http-static.js +99 -0
  106. package/dist/heart/outlook/outlook-http-transport.js +116 -0
  107. package/dist/heart/outlook/outlook-http.js +99 -0
  108. package/dist/heart/outlook/outlook-read.js +28 -0
  109. package/dist/heart/outlook/outlook-types.js +27 -0
  110. package/dist/heart/outlook/outlook-view.js +195 -0
  111. package/dist/heart/outlook/readers/agent-machine.js +359 -0
  112. package/dist/heart/outlook/readers/continuity-readers.js +332 -0
  113. package/dist/heart/outlook/readers/runtime-readers.js +660 -0
  114. package/dist/heart/outlook/readers/sessions.js +232 -0
  115. package/dist/heart/outlook/readers/shared.js +111 -0
  116. package/dist/heart/progress-story.js +42 -0
  117. package/dist/heart/provider-attempt.js +133 -0
  118. package/dist/heart/provider-binding-resolver.js +240 -0
  119. package/dist/heart/provider-credential-pool.js +395 -0
  120. package/dist/heart/provider-failover.js +274 -0
  121. package/dist/heart/provider-models.js +81 -0
  122. package/dist/heart/provider-ping.js +227 -0
  123. package/dist/heart/provider-state.js +208 -0
  124. package/dist/heart/provider-visibility.js +183 -0
  125. package/dist/heart/providers/anthropic-token.js +163 -0
  126. package/dist/heart/providers/anthropic.js +177 -50
  127. package/dist/heart/providers/azure.js +102 -11
  128. package/dist/heart/providers/error-classification.js +63 -0
  129. package/dist/heart/providers/github-copilot.js +145 -0
  130. package/dist/heart/providers/minimax-vlm.js +189 -0
  131. package/dist/heart/providers/minimax.js +28 -6
  132. package/dist/heart/providers/openai-codex.js +38 -23
  133. package/dist/heart/session-activity.js +190 -0
  134. package/dist/heart/session-events.js +855 -0
  135. package/dist/heart/session-transcript.js +167 -0
  136. package/dist/heart/start-of-turn-packet.js +345 -0
  137. package/dist/heart/streaming.js +36 -27
  138. package/dist/heart/sync.js +332 -0
  139. package/dist/heart/target-resolution.js +127 -0
  140. package/dist/heart/tempo.js +93 -0
  141. package/dist/heart/temporal-view.js +41 -0
  142. package/dist/heart/tool-activity-callbacks.js +36 -0
  143. package/dist/heart/tool-description.js +135 -0
  144. package/dist/heart/tool-friction.js +55 -0
  145. package/dist/heart/tool-loop.js +200 -0
  146. package/dist/heart/turn-context.js +362 -0
  147. package/dist/heart/turn-coordinator.js +28 -0
  148. package/dist/heart/{daemon → versioning}/ouro-bot-global-installer.js +1 -1
  149. package/dist/heart/{daemon → versioning}/ouro-bot-wrapper.js +1 -1
  150. package/dist/heart/versioning/ouro-path-installer.js +296 -0
  151. package/dist/heart/versioning/ouro-version-manager.js +295 -0
  152. package/dist/heart/{daemon → versioning}/staged-restart.js +40 -8
  153. package/dist/heart/{daemon → versioning}/update-checker.js +12 -2
  154. package/dist/heart/{daemon → versioning}/update-hooks.js +63 -59
  155. package/dist/mind/bundle-manifest.js +7 -1
  156. package/dist/mind/context.js +141 -94
  157. package/dist/mind/diary-integrity.js +60 -0
  158. package/dist/mind/{memory.js → diary.js} +84 -96
  159. package/dist/mind/embedding-provider.js +60 -0
  160. package/dist/mind/file-state.js +179 -0
  161. package/dist/mind/first-impressions.js +14 -1
  162. package/dist/mind/friends/channel.js +56 -0
  163. package/dist/mind/friends/group-context.js +144 -0
  164. package/dist/mind/friends/resolver.js +38 -1
  165. package/dist/mind/friends/store-file.js +58 -3
  166. package/dist/mind/friends/trust-explanation.js +74 -0
  167. package/dist/mind/friends/types.js +9 -1
  168. package/dist/mind/journal-index.js +161 -0
  169. package/dist/mind/note-search.js +268 -0
  170. package/dist/mind/obligation-steering.js +221 -0
  171. package/dist/mind/pending.js +74 -7
  172. package/dist/mind/prompt.js +1013 -112
  173. package/dist/mind/provenance-trust.js +26 -0
  174. package/dist/mind/scrutiny.js +173 -0
  175. package/dist/mind/token-estimate.js +8 -12
  176. package/dist/nerves/cli-logging.js +7 -1
  177. package/dist/nerves/coverage/audit-rules.js +15 -6
  178. package/dist/nerves/coverage/audit.js +28 -2
  179. package/dist/nerves/coverage/cli.js +1 -1
  180. package/dist/nerves/coverage/file-completeness.js +83 -5
  181. package/dist/nerves/coverage/run-artifacts.js +1 -1
  182. package/dist/nerves/event-buffer.js +111 -0
  183. package/dist/nerves/index.js +224 -4
  184. package/dist/nerves/observation.js +20 -0
  185. package/dist/nerves/redact.js +79 -0
  186. package/dist/nerves/runtime.js +5 -1
  187. package/dist/outlook-ui/assets/index-LwChZTgL.css +1 -0
  188. package/dist/outlook-ui/assets/index-xTdv64BV.js +61 -0
  189. package/dist/outlook-ui/index.html +15 -0
  190. package/dist/repertoire/ado-client.js +15 -56
  191. package/dist/repertoire/ado-semantic.js +11 -10
  192. package/dist/repertoire/api-client.js +97 -0
  193. package/dist/repertoire/bitwarden-store.js +319 -0
  194. package/dist/repertoire/bundle-templates.js +72 -0
  195. package/dist/repertoire/bw-installer.js +79 -0
  196. package/dist/repertoire/coding/codex-jsonl.js +64 -0
  197. package/dist/repertoire/coding/context-pack.js +330 -0
  198. package/dist/repertoire/coding/feedback.js +197 -30
  199. package/dist/repertoire/coding/manager.js +158 -9
  200. package/dist/repertoire/coding/spawner.js +55 -9
  201. package/dist/repertoire/coding/tools.js +170 -7
  202. package/dist/repertoire/commerce-errors.js +109 -0
  203. package/dist/repertoire/commerce-self-test.js +156 -0
  204. package/dist/repertoire/credential-access.js +527 -0
  205. package/dist/repertoire/duffel-client.js +185 -0
  206. package/dist/repertoire/github-client.js +14 -55
  207. package/dist/repertoire/graph-client.js +11 -52
  208. package/dist/repertoire/guardrails.js +375 -0
  209. package/dist/repertoire/mcp-client.js +255 -0
  210. package/dist/repertoire/mcp-manager.js +305 -0
  211. package/dist/repertoire/mcp-tools.js +63 -0
  212. package/dist/repertoire/shell-sessions.js +133 -0
  213. package/dist/repertoire/skills.js +15 -24
  214. package/dist/repertoire/stripe-client.js +131 -0
  215. package/dist/repertoire/tasks/board.js +43 -5
  216. package/dist/repertoire/tasks/fix.js +182 -0
  217. package/dist/repertoire/tasks/index.js +28 -10
  218. package/dist/repertoire/tasks/lifecycle.js +2 -2
  219. package/dist/repertoire/tasks/parser.js +3 -2
  220. package/dist/repertoire/tasks/scanner.js +194 -37
  221. package/dist/repertoire/tasks/transitions.js +16 -79
  222. package/dist/repertoire/tool-results.js +29 -0
  223. package/dist/repertoire/tools-attachments.js +316 -0
  224. package/dist/repertoire/tools-base.js +45 -771
  225. package/dist/repertoire/tools-bluebubbles.js +1 -0
  226. package/dist/repertoire/tools-bridge.js +141 -0
  227. package/dist/repertoire/tools-bundle.js +984 -0
  228. package/dist/repertoire/tools-config.js +185 -0
  229. package/dist/repertoire/tools-continuity.js +248 -0
  230. package/dist/repertoire/tools-credential.js +182 -0
  231. package/dist/repertoire/tools-files.js +342 -0
  232. package/dist/repertoire/tools-flight.js +224 -0
  233. package/dist/repertoire/tools-flow.js +105 -0
  234. package/dist/repertoire/tools-github.js +1 -7
  235. package/dist/repertoire/tools-notes.js +376 -0
  236. package/dist/repertoire/tools-session.js +739 -0
  237. package/dist/repertoire/tools-shell.js +120 -0
  238. package/dist/repertoire/tools-stripe.js +180 -0
  239. package/dist/repertoire/tools-surface.js +243 -0
  240. package/dist/repertoire/tools-teams.js +12 -62
  241. package/dist/repertoire/tools-travel.js +125 -0
  242. package/dist/repertoire/tools-user-profile.js +144 -0
  243. package/dist/repertoire/tools-vault.js +110 -0
  244. package/dist/repertoire/tools.js +144 -138
  245. package/dist/repertoire/travel-api-client.js +360 -0
  246. package/dist/repertoire/user-profile.js +118 -0
  247. package/dist/repertoire/vault-setup.js +241 -0
  248. package/dist/scripts/claude-code-hook.js +41 -0
  249. package/dist/scripts/claude-code-stop-hook.js +47 -0
  250. package/dist/senses/attention-queue.js +116 -0
  251. package/dist/senses/bluebubbles/attachment-cache.js +53 -0
  252. package/dist/senses/bluebubbles/attachment-download.js +137 -0
  253. package/dist/senses/{bluebubbles-client.js → bluebubbles/client.js} +225 -9
  254. package/dist/senses/bluebubbles/entry.js +13 -0
  255. package/dist/senses/bluebubbles/inbound-log.js +113 -0
  256. package/dist/senses/bluebubbles/index.js +1620 -0
  257. package/dist/senses/{bluebubbles-media.js → bluebubbles/media.js} +121 -70
  258. package/dist/senses/{bluebubbles-model.js → bluebubbles/model.js} +43 -12
  259. package/dist/senses/{bluebubbles-mutation-log.js → bluebubbles/mutation-log.js} +46 -6
  260. package/dist/senses/bluebubbles/replay.js +129 -0
  261. package/dist/senses/bluebubbles/runtime-state.js +109 -0
  262. package/dist/senses/{bluebubbles-session-cleanup.js → bluebubbles/session-cleanup.js} +1 -1
  263. package/dist/senses/cli/bracketed-paste.js +82 -0
  264. package/dist/senses/cli/image-paste.js +287 -0
  265. package/dist/senses/cli/image-ref-navigation.js +75 -0
  266. package/dist/senses/cli/ink-app.js +156 -0
  267. package/dist/senses/cli/inline-diff.js +64 -0
  268. package/dist/senses/cli/input-keys.js +174 -0
  269. package/dist/senses/cli/kill-ring.js +86 -0
  270. package/dist/senses/cli/message-list.js +51 -0
  271. package/dist/senses/cli/ouro-tui.js +605 -0
  272. package/dist/senses/cli/spinner-imperative.js +135 -0
  273. package/dist/senses/cli/spinner.js +101 -0
  274. package/dist/senses/cli/status-line.js +60 -0
  275. package/dist/senses/cli/streaming-markdown.js +526 -0
  276. package/dist/senses/cli/tool-display.js +83 -0
  277. package/dist/senses/cli/tool-render.js +85 -0
  278. package/dist/senses/cli/tui-store.js +240 -0
  279. package/dist/senses/cli/virtual-list.js +35 -0
  280. package/dist/senses/cli-entry.js +1 -1
  281. package/dist/senses/cli-layout.js +187 -0
  282. package/dist/senses/cli.js +587 -249
  283. package/dist/senses/commands.js +66 -3
  284. package/dist/senses/continuity.js +94 -0
  285. package/dist/senses/habit-turn-message.js +108 -0
  286. package/dist/senses/inner-dialog-worker.js +112 -19
  287. package/dist/senses/inner-dialog.js +636 -86
  288. package/dist/senses/pipeline.js +603 -0
  289. package/dist/senses/proactive-content-guard.js +51 -0
  290. package/dist/senses/shared-turn.js +205 -0
  291. package/dist/senses/surface-tool.js +68 -0
  292. package/dist/senses/teams.js +693 -160
  293. package/dist/senses/trust-gate.js +112 -2
  294. package/package.json +29 -7
  295. package/skills/agent-commerce.md +106 -0
  296. package/skills/browser-navigation.md +110 -0
  297. package/skills/commerce-setup-guide.md +116 -0
  298. package/skills/commerce-setup.md +84 -0
  299. package/skills/configure-dev-tools.md +81 -0
  300. package/skills/travel-planning.md +138 -0
  301. package/dist/heart/daemon/ouro-path-installer.js +0 -178
  302. package/dist/heart/daemon/subagent-installer.js +0 -134
  303. package/dist/mind/associative-recall.js +0 -197
  304. package/dist/senses/bluebubbles-entry.js +0 -11
  305. package/dist/senses/bluebubbles.js +0 -558
  306. package/dist/senses/debug-activity.js +0 -127
  307. package/subagents/README.md +0 -73
  308. package/subagents/work-doer.md +0 -235
  309. package/subagents/work-merger.md +0 -618
  310. package/subagents/work-planner.md +0 -382
  311. /package/{AdoptionSpecialist.ouro → SerpentGuide.ouro}/psyche/identities/basilisk.md +0 -0
  312. /package/{AdoptionSpecialist.ouro → SerpentGuide.ouro}/psyche/identities/jafar.md +0 -0
  313. /package/{AdoptionSpecialist.ouro → SerpentGuide.ouro}/psyche/identities/jormungandr.md +0 -0
  314. /package/{AdoptionSpecialist.ouro → SerpentGuide.ouro}/psyche/identities/kaa.md +0 -0
  315. /package/{AdoptionSpecialist.ouro → SerpentGuide.ouro}/psyche/identities/medusa.md +0 -0
  316. /package/{AdoptionSpecialist.ouro → SerpentGuide.ouro}/psyche/identities/monty.md +0 -0
  317. /package/{AdoptionSpecialist.ouro → SerpentGuide.ouro}/psyche/identities/nagini.md +0 -0
  318. /package/{AdoptionSpecialist.ouro → SerpentGuide.ouro}/psyche/identities/ouroboros.md +0 -0
  319. /package/{AdoptionSpecialist.ouro → SerpentGuide.ouro}/psyche/identities/python.md +0 -0
  320. /package/{AdoptionSpecialist.ouro → SerpentGuide.ouro}/psyche/identities/quetzalcoatl.md +0 -0
  321. /package/{AdoptionSpecialist.ouro → SerpentGuide.ouro}/psyche/identities/sir-hiss.md +0 -0
  322. /package/{AdoptionSpecialist.ouro → SerpentGuide.ouro}/psyche/identities/the-snake.md +0 -0
  323. /package/dist/heart/{daemon → hatch}/hatch-animation.js +0 -0
  324. /package/dist/heart/{daemon → hatch}/specialist-orchestrator.js +0 -0
  325. /package/dist/heart/{daemon → versioning}/ouro-uti.js +0 -0
  326. /package/dist/heart/{daemon → versioning}/wrapper-publish-guard.js +0 -0
package/dist/outlook-ui/index.html ADDED
@@ -0,0 +1,15 @@
1
+ <!doctype html>
2
+ <html lang="en" class="dark">
3
+ <head>
4
+ <meta charset="utf-8" />
5
+ <meta name="viewport" content="width=device-width, initial-scale=1" />
6
+ <meta name="color-scheme" content="dark" />
7
+ <title>Ouro Outlook</title>
8
+ <meta name="description" content="The daemon-hosted shared orientation surface for agents alive on this machine." />
9
+ <script type="module" crossorigin src="/assets/index-xTdv64BV.js"></script>
10
+ <link rel="stylesheet" crossorigin href="/assets/index-LwChZTgL.css">
11
+ </head>
12
+ <body>
13
+ <div id="app"></div>
14
+ </body>
15
+ </html>
package/dist/repertoire/ado-client.js CHANGED
@@ -9,6 +9,7 @@ exports.discoverOrganizations = discoverOrganizations;
9
9
  exports.discoverProjects = discoverProjects;
10
10
  const api_error_1 = require("../heart/api-error");
11
11
  const runtime_1 = require("../nerves/runtime");
12
+ const api_client_1 = require("./api-client");
12
13
  const ADO_BASE = "https://dev.azure.com";
13
14
  const VSSPS_BASE = "https://app.vssps.visualstudio.com";
14
15
  const DEFAULT_API_VERSION = "api-version=7.1";
@@ -30,62 +31,20 @@ function resolveContentType(method, path) {
30
31
  // Generic ADO API request. Returns response body as pretty-printed JSON string.
31
32
  // `host` overrides the base URL for non-standard APIs (e.g. "vsapm.dev.azure.com", "vssps.dev.azure.com").
32
33
  async function adoRequest(token, method, org, path, body, host) {
33
- try {
34
- const base = host ? `https://${host}/${org}` : `${ADO_BASE}/${org}`;
35
- (0, runtime_1.emitNervesEvent)({
36
- event: "client.request_start",
37
- component: "clients",
38
- message: "starting ADO request",
39
- meta: { client: "ado", method, org, path },
40
- });
41
- const fullPath = ensureApiVersion(path);
42
- const url = `${base}${fullPath}`;
43
- const contentType = resolveContentType(method, path);
44
- const opts = {
45
- method,
46
- headers: {
47
- Authorization: `Bearer ${token}`,
48
- "Content-Type": contentType,
49
- },
50
- };
51
- if (body)
52
- opts.body = body;
53
- const res = await fetch(url, opts);
54
- if (!res.ok) {
55
- (0, runtime_1.emitNervesEvent)({
56
- level: "error",
57
- event: "client.error",
58
- component: "clients",
59
- message: "ADO request failed",
60
- meta: { client: "ado", method, org, path, status: res.status },
61
- });
62
- return (0, api_error_1.handleApiError)(res, "ADO", "ado");
63
- }
64
- const data = await res.json();
65
- (0, runtime_1.emitNervesEvent)({
66
- event: "client.request_end",
67
- component: "clients",
68
- message: "ADO request completed",
69
- meta: { client: "ado", method, org, path, success: true },
70
- });
71
- return JSON.stringify(data, null, 2);
72
- }
73
- catch (err) {
74
- (0, runtime_1.emitNervesEvent)({
75
- level: "error",
76
- event: "client.error",
77
- component: "clients",
78
- message: "ADO request threw exception",
79
- meta: {
80
- client: "ado",
81
- method,
82
- org,
83
- path,
84
- reason: err instanceof Error ? err.message : String(err),
85
- },
86
- });
87
- return (0, api_error_1.handleApiError)(err, "ADO", "ado");
88
- }
34
+ const base = host ? `https://${host}/${org}` : `${ADO_BASE}/${org}`;
35
+ const fullPath = ensureApiVersion(path);
36
+ return (0, api_client_1.apiRequest)({
37
+ baseUrl: base,
38
+ method,
39
+ path: fullPath,
40
+ token,
41
+ clientName: "ado",
42
+ serviceLabel: "ADO",
43
+ connectionName: "ado",
44
+ body,
45
+ contentType: resolveContentType(method, path),
46
+ eventMeta: { org },
47
+ });
89
48
  }
90
49
  // Backward-compatible thin wrapper: runs WIQL query and returns formatted work items.
91
50
  async function queryWorkItems(token, org, query) {
package/dist/repertoire/ado-semantic.js CHANGED
@@ -221,7 +221,7 @@ exports.adoSemanticToolDefinitions = [
221
221
  type: "function",
222
222
  function: {
223
223
  name: "ado_backlog_list",
224
- description: "Query the backlog and return enriched work items with hierarchy, type, parent, assignee, area path, and iteration. Supports filtering. Use this instead of raw WIQL queries.",
224
+ description: "Query the backlog and return enriched work items with hierarchy, type, parent, assignee, area path, and iteration. Supports filtering. Use this instead of raw WIQL queries. Provides enriched results with hierarchy.",
225
225
  parameters: {
226
226
  type: "object",
227
227
  properties: {
@@ -279,6 +279,7 @@ exports.adoSemanticToolDefinitions = [
279
279
  return formatForChannel(items, ctx, organization, project);
280
280
  },
281
281
  integration: "ado",
282
+ summaryKeys: ["organization", "project"],
282
283
  },
283
284
  // -- ado_create_epic --
284
285
  {
@@ -286,7 +287,7 @@ exports.adoSemanticToolDefinitions = [
286
287
  type: "function",
287
288
  function: {
288
289
  name: "ado_create_epic",
289
- description: "Create an epic in Azure DevOps with title, description, area path, and optional parent.",
290
+ description: "Create an epic in Azure DevOps with title, description, area path, and optional parent. Use ado_preview_changes first to dry-run the operation.",
290
291
  parameters: {
291
292
  type: "object",
292
293
  properties: {
@@ -317,7 +318,7 @@ exports.adoSemanticToolDefinitions = [
317
318
  return result;
318
319
  },
319
320
  integration: "ado",
320
- confirmationRequired: true,
321
+ summaryKeys: ["organization", "project", "title"],
321
322
  },
322
323
  // -- ado_create_issue --
323
324
  {
@@ -325,7 +326,7 @@ exports.adoSemanticToolDefinitions = [
325
326
  type: "function",
326
327
  function: {
327
328
  name: "ado_create_issue",
328
- description: "Create an issue or user story in Azure DevOps with title, description, area path, and parent epic.",
329
+ description: "Create an issue or user story in Azure DevOps with title, description, area path, and parent epic. Use ado_preview_changes first to dry-run the operation.",
329
330
  parameters: {
330
331
  type: "object",
331
332
  properties: {
@@ -358,7 +359,7 @@ exports.adoSemanticToolDefinitions = [
358
359
  return result;
359
360
  },
360
361
  integration: "ado",
361
- confirmationRequired: true,
362
+ summaryKeys: ["organization", "project", "title"],
362
363
  },
363
364
  // -- ado_move_items --
364
365
  {
@@ -366,7 +367,7 @@ exports.adoSemanticToolDefinitions = [
366
367
  type: "function",
367
368
  function: {
368
369
  name: "ado_move_items",
369
- description: "Reparent work items -- move them to a new parent epic or feature.",
370
+ description: "Reparent work items -- move them to a new parent epic or feature. Use ado_preview_changes first. These mutations affect real work items.",
370
371
  parameters: {
371
372
  type: "object",
372
373
  properties: {
@@ -412,7 +413,7 @@ exports.adoSemanticToolDefinitions = [
412
413
  return JSON.stringify({ moved, errors, organization: adoCtx.organization, project: adoCtx.project });
413
414
  },
414
415
  integration: "ado",
415
- confirmationRequired: true,
416
+ summaryKeys: ["organization", "project", "workItemIds"],
416
417
  },
417
418
  // -- ado_restructure_backlog --
418
419
  {
@@ -420,7 +421,7 @@ exports.adoSemanticToolDefinitions = [
420
421
  type: "function",
421
422
  function: {
422
423
  name: "ado_restructure_backlog",
423
- description: "Bulk restructure: reparent multiple work items in a single logical operation.",
424
+ description: "Bulk restructure: reparent multiple work items in a single logical operation. Use ado_preview_changes first. These mutations affect real work items.",
424
425
  parameters: {
425
426
  type: "object",
426
427
  properties: {
@@ -470,7 +471,7 @@ exports.adoSemanticToolDefinitions = [
470
471
  return JSON.stringify({ results, organization: adoCtx.organization, project: adoCtx.project });
471
472
  },
472
473
  integration: "ado",
473
- confirmationRequired: true,
474
+ summaryKeys: ["organization", "project"],
474
475
  },
475
476
  // -- ado_validate_structure --
476
477
  {
@@ -671,7 +672,7 @@ exports.adoSemanticToolDefinitions = [
671
672
  return JSON.stringify({ results, organization: adoCtx.organization, project: adoCtx.project });
672
673
  },
673
674
  integration: "ado",
674
- confirmationRequired: true,
675
+ summaryKeys: ["organization", "project"],
675
676
  },
676
677
  // -- ado_detect_orphans --
677
678
  {
package/dist/repertoire/api-client.js ADDED
@@ -0,0 +1,97 @@
1
+ "use strict";
2
+ /**
3
+ * Shared HTTP API client for Graph, ADO, and GitHub clients.
4
+ *
5
+ * All three API clients follow the same pattern: emit request_start event,
6
+ * build request with auth header, fetch, handle errors, emit request_end,
7
+ * and return pretty-printed JSON. This module extracts that shared logic.
8
+ */
9
+ Object.defineProperty(exports, "__esModule", { value: true });
10
+ exports.apiRequest = apiRequest;
11
+ const api_error_1 = require("../heart/api-error");
12
+ const runtime_1 = require("../nerves/runtime");
13
+ const credential_access_1 = require("./credential-access");
14
+ /**
15
+ * Execute an authenticated API request with standard logging and error handling.
16
+ * Returns the response body as a pretty-printed JSON string.
17
+ */
18
+ async function apiRequest(options) {
19
+ const { baseUrl, method, path, token, clientName, serviceLabel, connectionName, body, extraHeaders, contentType, eventMeta, credentialDomain, credentialField, } = options;
20
+ // Resolve token from credential store if credentialDomain is provided
21
+ let resolvedToken = token;
22
+ if (credentialDomain) {
23
+ try {
24
+ const store = (0, credential_access_1.getCredentialStore)();
25
+ resolvedToken = await store.getRawSecret(credentialDomain, credentialField ?? "password");
26
+ (0, runtime_1.emitNervesEvent)({
27
+ event: "client.credential_fetch",
28
+ component: "clients",
29
+ message: `fetched credential from store for ${serviceLabel}`,
30
+ meta: { client: clientName, credentialDomain },
31
+ });
32
+ }
33
+ catch (err) {
34
+ (0, runtime_1.emitNervesEvent)({
35
+ level: "error",
36
+ event: "client.credential_error",
37
+ component: "clients",
38
+ message: `failed to fetch credential for ${serviceLabel}`,
39
+ /* v8 ignore next -- defensive: getRawSecret throws Error instances @preserve */
40
+ meta: { client: clientName, credentialDomain, reason: err instanceof Error ? err.message : String(err) },
41
+ });
42
+ return (0, api_error_1.handleApiError)(err, serviceLabel, connectionName);
43
+ }
44
+ }
45
+ try {
46
+ (0, runtime_1.emitNervesEvent)({
47
+ event: "client.request_start",
48
+ component: "clients",
49
+ message: `starting ${serviceLabel} request`,
50
+ meta: { client: clientName, method, path, ...eventMeta },
51
+ });
52
+ const url = `${baseUrl}${path}`;
53
+ const headers = {
54
+ Authorization: `Bearer ${resolvedToken}`,
55
+ "Content-Type": contentType ?? "application/json",
56
+ ...extraHeaders,
57
+ };
58
+ const opts = { method, headers };
59
+ if (body)
60
+ opts.body = body;
61
+ const res = await fetch(url, opts);
62
+ if (!res.ok) {
63
+ (0, runtime_1.emitNervesEvent)({
64
+ level: "error",
65
+ event: "client.error",
66
+ component: "clients",
67
+ message: `${serviceLabel} request failed`,
68
+ meta: { client: clientName, method, path, status: res.status, ...eventMeta },
69
+ });
70
+ return (0, api_error_1.handleApiError)(res, serviceLabel, connectionName);
71
+ }
72
+ const data = await res.json();
73
+ (0, runtime_1.emitNervesEvent)({
74
+ event: "client.request_end",
75
+ component: "clients",
76
+ message: `${serviceLabel} request completed`,
77
+ meta: { client: clientName, method, path, success: true, ...eventMeta },
78
+ });
79
+ return JSON.stringify(data, null, 2);
80
+ }
81
+ catch (err) {
82
+ (0, runtime_1.emitNervesEvent)({
83
+ level: "error",
84
+ event: "client.error",
85
+ component: "clients",
86
+ message: `${serviceLabel} request threw exception`,
87
+ meta: {
88
+ client: clientName,
89
+ method,
90
+ path,
91
+ reason: err instanceof Error ? err.message : String(err),
92
+ ...eventMeta,
93
+ },
94
+ });
95
+ return (0, api_error_1.handleApiError)(err, serviceLabel, connectionName);
96
+ }
97
+ }
package/dist/repertoire/bitwarden-store.js ADDED
@@ -0,0 +1,319 @@
1
+ "use strict";
2
+ /**
3
+ * Bitwarden CLI credential store — wraps `bw` CLI for the agent's own vault.
4
+ *
5
+ * Unlike AacCredentialStore (which accesses someone else's vault via approval),
6
+ * this store authenticates directly as the agent using its own master password.
7
+ * The agent owns the vault, so no human-in-the-loop is needed.
8
+ *
9
+ * Requires the `bw` CLI to be installed. Session tokens are cached process-local.
10
+ */
11
+ Object.defineProperty(exports, "__esModule", { value: true });
12
+ exports.BitwardenCredentialStore = void 0;
13
+ const node_child_process_1 = require("node:child_process");
14
+ const runtime_1 = require("../nerves/runtime");
15
+ const bw_installer_1 = require("./bw-installer");
16
+ // ---------------------------------------------------------------------------
17
+ // bw CLI wrapper
18
+ // ---------------------------------------------------------------------------
19
+ function execBw(args, sessionToken) {
20
+ const env = sessionToken
21
+ ? { ...process.env, BW_SESSION: sessionToken }
22
+ : process.env;
23
+ return new Promise((resolve, reject) => {
24
+ (0, node_child_process_1.execFile)("bw", args, { timeout: 30_000, env }, (err, stdout) => {
25
+ if (err) {
26
+ if (isBwNotInstalled(err)) {
27
+ reject(new Error("bw CLI not found. Install from https://bitwarden.com/help/cli/"));
28
+ return;
29
+ }
30
+ reject(new Error(`bw CLI error: ${err.message}`));
31
+ return;
32
+ }
33
+ resolve(stdout);
34
+ });
35
+ });
36
+ }
37
+ /** Check if the error indicates the bw CLI binary is not installed. */
38
+ function isBwNotInstalled(err) {
39
+ const msg = err.message.toLowerCase();
40
+ const code = err.code;
41
+ return code === "ENOENT" || msg.includes("enoent") || msg.includes("not found") || msg.includes("command not found");
42
+ }
43
+ /** Check if the error is transient (network/timeout) and worth retrying. */
44
+ function isTransientError(err) {
45
+ const msg = err.message.toLowerCase();
46
+ return (msg.includes("econnrefused") ||
47
+ msg.includes("etimedout") ||
48
+ msg.includes("enotfound") ||
49
+ msg.includes("socket hang up") ||
50
+ msg.includes("503") ||
51
+ msg.includes("server unavailable"));
52
+ }
53
+ const MAX_RETRIES = 3;
54
+ const BASE_BACKOFF_MS = 1000;
55
+ function delay(ms) {
56
+ return new Promise((resolve) => setTimeout(resolve, ms));
57
+ }
58
+ // ---------------------------------------------------------------------------
59
+ // BitwardenCredentialStore
60
+ // ---------------------------------------------------------------------------
61
+ class BitwardenCredentialStore {
62
+ serverUrl;
63
+ email;
64
+ masterPassword;
65
+ sessionToken = null;
66
+ constructor(serverUrl, email, masterPassword) {
67
+ this.serverUrl = serverUrl;
68
+ this.email = email;
69
+ this.masterPassword = masterPassword;
70
+ }
71
+ isReady() {
72
+ return true;
73
+ }
74
+ /**
75
+ * Ensure the bw CLI is authenticated and unlocked.
76
+ * Handles three states: logged out → login, locked → unlock, already unlocked → no-op.
77
+ * Retries transient failures (network/timeout) up to MAX_RETRIES with exponential backoff.
78
+ */
79
+ async login() {
80
+ // Ensure bw CLI is installed before any bw commands
81
+ await (0, bw_installer_1.ensureBwCli)();
82
+ let lastError;
83
+ for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
84
+ try {
85
+ await this.loginAttempt();
86
+ return;
87
+ }
88
+ catch (err) {
89
+ /* v8 ignore next -- defensive: loginAttempt always throws Error instances @preserve */
90
+ lastError = err instanceof Error ? err : new Error(String(err));
91
+ // Don't retry non-transient errors (auth failures, bw not installed)
92
+ if (!isTransientError(lastError)) {
93
+ throw lastError;
94
+ }
95
+ // Don't retry after final attempt
96
+ if (attempt === MAX_RETRIES - 1)
97
+ break;
98
+ const backoffMs = BASE_BACKOFF_MS * Math.pow(2, attempt);
99
+ (0, runtime_1.emitNervesEvent)({
100
+ event: "repertoire.bw_login_retry",
101
+ component: "repertoire",
102
+ message: `bw login attempt ${attempt + 1} failed, retrying in ${backoffMs}ms`,
103
+ meta: { attempt: attempt + 1, backoffMs, reason: lastError.message },
104
+ });
105
+ await delay(backoffMs);
106
+ }
107
+ }
108
+ throw lastError;
109
+ }
110
+ /** Single login attempt — called by login() retry loop. */
111
+ async loginAttempt() {
112
+ // Check current status
113
+ let status = {};
114
+ try {
115
+ const raw = await execBw(["status"]);
116
+ status = JSON.parse(raw);
117
+ }
118
+ catch (err) {
119
+ // If bw CLI is not installed or a transient error, propagate it for retry
120
+ if (err instanceof Error && (isBwNotInstalled(err) || isTransientError(err))) {
121
+ throw err;
122
+ }
123
+ // CLI not configured or broken — proceed with full setup
124
+ }
125
+ // Configure server URL if needed (only works when logged out)
126
+ if (status.status === "unauthenticated" || !status.serverUrl) {
127
+ try {
128
+ await execBw(["config", "server", this.serverUrl]);
129
+ }
130
+ catch {
131
+ // "Logout required" means already logged in — that's fine, skip config
132
+ }
133
+ }
134
+ if (status.status === "locked") {
135
+ // Already logged in, just needs unlock
136
+ const unlockOutput = await execBw(["unlock", this.masterPassword, "--raw"]);
137
+ this.sessionToken = unlockOutput.trim();
138
+ }
139
+ else if (status.status === "unauthenticated" || !status.status) {
140
+ // Not logged in — full login
141
+ const loginOutput = await execBw(["login", this.email, this.masterPassword, "--raw"]);
142
+ try {
143
+ const parsed = JSON.parse(loginOutput);
144
+ this.sessionToken = parsed.access_token ?? loginOutput.trim();
145
+ }
146
+ catch {
147
+ this.sessionToken = loginOutput.trim();
148
+ }
149
+ }
150
+ else {
151
+ // Status is "unlocked" — already good, just need the session token
152
+ const unlockOutput = await execBw(["unlock", this.masterPassword, "--raw"]);
153
+ this.sessionToken = unlockOutput.trim();
154
+ }
155
+ }
156
+ async ensureSession() {
157
+ if (!this.sessionToken) {
158
+ await this.login();
159
+ }
160
+ /* v8 ignore next -- defensive: login() always sets sessionToken on success @preserve */
161
+ return this.sessionToken ?? undefined;
162
+ }
163
+ async get(domain) {
164
+ (0, runtime_1.emitNervesEvent)({
165
+ event: "repertoire.bw_credential_get_start",
166
+ component: "repertoire",
167
+ message: `getting credential via bw for ${domain}`,
168
+ meta: { domain, backend: "bitwarden" },
169
+ });
170
+ const session = await this.ensureSession();
171
+ const item = await this.findItemByDomain(domain, session);
172
+ if (!item) {
173
+ (0, runtime_1.emitNervesEvent)({
174
+ event: "repertoire.bw_credential_get_end",
175
+ component: "repertoire",
176
+ message: `no bw credential for ${domain}`,
177
+ meta: { domain, found: false, backend: "bitwarden" },
178
+ });
179
+ return null;
180
+ }
181
+ (0, runtime_1.emitNervesEvent)({
182
+ event: "repertoire.bw_credential_get_end",
183
+ component: "repertoire",
184
+ message: `bw credential found for ${domain}`,
185
+ meta: { domain, found: true, backend: "bitwarden" },
186
+ });
187
+ return {
188
+ domain: item.name,
189
+ username: item.login?.username,
190
+ notes: item.notes ?? undefined,
191
+ createdAt: item.revisionDate ?? new Date().toISOString(),
192
+ };
193
+ }
194
+ async getRawSecret(domain, field) {
195
+ const session = await this.ensureSession();
196
+ const item = await this.findItemByDomain(domain, session);
197
+ if (!item) {
198
+ throw new Error(`no credential found for domain "${domain}"`);
199
+ }
200
+ // Map common field names to bw item structure
201
+ let value;
202
+ if (field === "password") {
203
+ value = item.login?.password;
204
+ }
205
+ else if (field === "username") {
206
+ value = item.login?.username;
207
+ }
208
+ else {
209
+ value = item[field];
210
+ }
211
+ if (value === undefined || value === null) {
212
+ throw new Error(`field "${field}" not found for domain "${domain}"`);
213
+ }
214
+ return String(value);
215
+ }
216
+ async store(domain, data) {
217
+ (0, runtime_1.emitNervesEvent)({
218
+ event: "repertoire.bw_credential_store_start",
219
+ component: "repertoire",
220
+ message: `storing credential via bw for ${domain}`,
221
+ meta: { domain, backend: "bitwarden" },
222
+ });
223
+ const session = await this.ensureSession();
224
+ // Create a new login item
225
+ const item = {
226
+ type: 1, // Login type
227
+ name: domain,
228
+ login: {
229
+ username: data.username ?? "",
230
+ password: data.password,
231
+ uris: [{ match: null, uri: `https://${domain}` }],
232
+ },
233
+ notes: data.notes ?? null,
234
+ };
235
+ const encoded = Buffer.from(JSON.stringify(item)).toString("base64");
236
+ await execBw(["create", "item", encoded], session);
237
+ (0, runtime_1.emitNervesEvent)({
238
+ event: "repertoire.bw_credential_store_end",
239
+ component: "repertoire",
240
+ message: `credential stored via bw for ${domain}`,
241
+ meta: { domain, backend: "bitwarden" },
242
+ });
243
+ }
244
+ async list() {
245
+ (0, runtime_1.emitNervesEvent)({
246
+ event: "repertoire.bw_credential_list_start",
247
+ component: "repertoire",
248
+ message: "listing bw credentials",
249
+ meta: { backend: "bitwarden" },
250
+ });
251
+ const session = await this.ensureSession();
252
+ try {
253
+ const stdout = await execBw(["list", "items"], session);
254
+ const items = JSON.parse(stdout);
255
+ const results = items.map((item) => ({
256
+ domain: item.name,
257
+ username: item.login?.username,
258
+ notes: item.notes ?? undefined,
259
+ createdAt: item.revisionDate ?? new Date().toISOString(),
260
+ }));
261
+ (0, runtime_1.emitNervesEvent)({
262
+ event: "repertoire.bw_credential_list_end",
263
+ component: "repertoire",
264
+ message: "bw credentials listed",
265
+ meta: { backend: "bitwarden", count: results.length },
266
+ });
267
+ return results;
268
+ }
269
+ catch {
270
+ (0, runtime_1.emitNervesEvent)({
271
+ event: "repertoire.bw_credential_list_end",
272
+ component: "repertoire",
273
+ message: "bw credential list failed",
274
+ meta: { backend: "bitwarden", count: 0 },
275
+ });
276
+ return [];
277
+ }
278
+ }
279
+ async delete(domain) {
280
+ (0, runtime_1.emitNervesEvent)({
281
+ event: "repertoire.bw_credential_delete_start",
282
+ component: "repertoire",
283
+ message: `deleting credential via bw for ${domain}`,
284
+ meta: { domain, backend: "bitwarden" },
285
+ });
286
+ const session = await this.ensureSession();
287
+ const item = await this.findItemByDomain(domain, session);
288
+ if (!item) {
289
+ (0, runtime_1.emitNervesEvent)({
290
+ event: "repertoire.bw_credential_delete_end",
291
+ component: "repertoire",
292
+ message: `no bw credential to delete for ${domain}`,
293
+ meta: { domain, deleted: false, backend: "bitwarden" },
294
+ });
295
+ return false;
296
+ }
297
+ await execBw(["delete", "item", item.id], session);
298
+ (0, runtime_1.emitNervesEvent)({
299
+ event: "repertoire.bw_credential_delete_end",
300
+ component: "repertoire",
301
+ message: `credential deleted via bw for ${domain}`,
302
+ meta: { domain, deleted: true, backend: "bitwarden" },
303
+ });
304
+ return true;
305
+ }
306
+ // --- Private ---
307
+ async findItemByDomain(domain, session) {
308
+ try {
309
+ const stdout = await execBw(["list", "items", "--search", domain], session);
310
+ const items = JSON.parse(stdout);
311
+ // Find exact match by name
312
+ return items.find((item) => item.name === domain) ?? items[0] ?? null;
313
+ }
314
+ catch {
315
+ return null;
316
+ }
317
+ }
318
+ }
319
+ exports.BitwardenCredentialStore = BitwardenCredentialStore;
package/dist/repertoire/bundle-templates.js ADDED
@@ -0,0 +1,72 @@
1
+ "use strict";
2
+ /**
3
+ * Templates for agent bundle scaffolding.
4
+ *
5
+ * ## .gitignore design philosophy
6
+ *
7
+ * The bundle .gitignore handles FUNCTIONAL "shouldn't track" cases only:
8
+ *
9
+ * - Runtime state (sessions, logs, runtime files) — stale data with no
10
+ * value for review or history.
11
+ * - Credentials — real secrets live in `~/.agentsecrets`, but defense
12
+ * in depth in case anything leaks into the bundle.
13
+ * - Editor / OS noise (.DS_Store, .idea/, etc.).
14
+ * - Build artifacts (rare in bundles, but possible).
15
+ *
16
+ * It DOES NOT handle PII. The bundle is inherently full of PII — `friends/`,
17
+ * `diary/`, `journal/`, `psyche/`, `arc/`, `facts/`, `family/`, `travel/`
18
+ * etc. That's the point of the bundle; blocking those via .gitignore would
19
+ * defeat the purpose.
20
+ *
21
+ * PII is handled at first-push time by `bundle_first_push_review`, which
22
+ * enumerates PII-bearing directories, shows the agent counts, probes the
23
+ * remote URL for GitHub visibility, and hard-pauses until the human
24
+ * confirms. See Directive D in the planning doc.
25
+ *
26
+ * No content-pattern blocks (no `**\/sk-ant-*` or similar). Content-review
27
+ * failures are a different safety layer — credential scanning at commit
28
+ * time would be a follow-up feature.
29
+ */
30
+ Object.defineProperty(exports, "__esModule", { value: true });
31
+ exports.PII_BUNDLE_DIRECTORIES = exports.BUNDLE_GITIGNORE_TEMPLATE = void 0;
32
+ exports.BUNDLE_GITIGNORE_TEMPLATE = `# Runtime state — sessions, logs, runtime files, never tracked
33
+ state/
34
+
35
+ # Credentials — never tracked. Real secrets live in ~/.agentsecrets, but
36
+ # defense in depth in case anything leaks into the bundle.
37
+ .env
38
+ .env.*
39
+ secrets/
40
+ **/*.key
41
+ **/*.pem
42
+ **/*.credentials
43
+ **/*.pfx
44
+
45
+ # Editor and OS noise
46
+ .DS_Store
47
+ .idea/
48
+ .vscode/
49
+ *.swp
50
+ *.swo
51
+
52
+ # Build artifacts (rare in bundles, but possible if a workspace lands here)
53
+ node_modules/
54
+ dist/
55
+ `;
56
+ /**
57
+ * PII-sensitive top-level directories. Enumerated here so `bundle_first_push_review`
58
+ * can categorize and count. Adding a new PII bucket to the bundle means adding
59
+ * it here so the first-push warning includes it.
60
+ */
61
+ exports.PII_BUNDLE_DIRECTORIES = [
62
+ "friends",
63
+ "diary",
64
+ "journal",
65
+ "psyche",
66
+ "arc",
67
+ "facts",
68
+ "family",
69
+ "travel",
70
+ "notes",
71
+ "sessions",
72
+ ];