@pareto4/pp-core 1.11.0 → 1.11.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pp-core",
   "displayName": "PP Core",
-  "version": "1.11.0",
+  "version": "1.11.1",
   "description": "PP Core is a meta-prompting, context engineering, and spec-driven development system for AI coding agents.",
   "author": {
     "name": "pareto4",

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "pp-core",
-  "version": "1.11.0",
+  "version": "1.11.1",
   "description": "PP Core — a meta-prompting, context engineering, and spec-driven development system for AI coding agents. Loads pp-core's operating context into every Gemini CLI session.",
   "contextFileName": "GEMINI.md"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pareto4/pp-core",
-  "version": "1.11.0",
+  "version": "1.11.1",
   "description": "Pareto pp-core — The Pareto Project's AI-assisted engineering framework: meta-prompting, context engineering, and spec-driven development for AI coding agents.",
   "bin": {
     "pp-core": "bin/install.js",

package/pp-core/bin/lib/compose-bindings.cjs

@@ -46,6 +46,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.COMPOSE_BINDINGS_FLAGS = exports.SEED_VALUE_MAX_LENGTH = void 0;
+exports._resetPlatformTagMemoForTests = _resetPlatformTagMemoForTests;
 exports.composeBindings = composeBindings;
 exports.cmdComposeBindings = cmdComposeBindings;
 const node_fs_1 = __importDefault(require("node:fs"));
@@ -336,6 +337,22 @@ function readSeed(cwd, opts) {
     return { values, profile, warnings };
 }
 // ─── resolveLatestPlatformTag (D-04) ─────────────────────────────────────────
+/**
+ * Per-process memo for the D-04 tag lookup, keyed by the resolved URL, holding
+ * the full `{ tag, warnings }` verdict — successes AND failures. One real
+ * `pp-tools init` run calls `composeBindings` twice (the dry-run preview in
+ * `computeCurrentStep`, then the write-mode call after `compose_confirm`), so
+ * without this memo a decline costs a network round-trip for nothing and a
+ * failed lookup would print its bounded warning twice.
+ */
+const platformTagMemo = new Map();
+/** Test-only seam: clear the per-process platform.tag lookup memo so a test
+ * suite that shares a resolved URL across cases sees an empty memo each time
+ * (`init-tag-lookup-raw-git-error`). Mirrors the reset-seam convention at
+ * `src/active-workstream-store.cts`'s controlling-TTY probe cache. */
+function _resetPlatformTagMemoForTests() {
+    platformTagMemo.clear();
+}
 /**
  * Resolve the latest STABLE tag for `repo` over the resolved host, never
  * shell-eval'd (T-34-25): `git ls-remote` is spawned with an argv array via
@@ -344,6 +361,13 @@ function readSeed(cwd, opts) {
  * else `defaultHostForProvider(provider)` — the host is authoritative and
  * never derived from the repo string (Phase 31 D-09).
  *
+ * The child's stderr is piped into the parent's buffer rather than inherited
+ * — an explicit `stdio: ['ignore', 'pipe', 'pipe']` — and deliberately
+ * discarded rather than logged: the bounded warning this function returns on
+ * failure is the single user-visible surface for a lookup failure. Inheriting
+ * the child's stream let a raw git `fatal:` line reach the terminal during an
+ * otherwise successful first-run experience (`init-tag-lookup-raw-git-error`).
+ *
  * Every candidate ref is filtered with `isStableTripletSemver` and ordered
  * with `compareSemverCore` — the single blessed comparison source, never
  * reimplemented. An empty result degrades to `{ tag: null, warnings: [] }`
@@ -353,13 +377,34 @@ function readSeed(cwd, opts) {
  * platform being unpinned, never a compose failure.
  */
 function resolveLatestPlatformTag(cwd, repo, provider, opts) {
+    let url;
     try {
         const hostRes = (0, vault_coordinates_cjs_1.resolvePlatformHost)(cwd);
         const host = hostRes.host ?? (0, vault_coordinates_cjs_1.defaultHostForProvider)(provider);
-        const url = `https://${host}/${repo}`;
+        url = `https://${host}/${repo}`;
+    }
+    catch {
+        return {
+            tag: null,
+            warnings: [
+                bound('platform.tag could not be resolved — the tag lookup failed or was unreachable; the platform is unpinned.'),
+            ],
+        };
+    }
+    const cached = platformTagMemo.get(url);
+    if (cached)
+        return cached;
+    let result;
+    try {
         const lsOutput = typeof opts._lsRemote === 'function'
             ? opts._lsRemote(url)
-            : node_child_process_1.default.execFileSync('git', ['ls-remote', '--tags', '--refs', '--sort=-v:refname', url, 'v*'], { encoding: 'utf-8', timeout: 10_000, maxBuffer: 512 * 1024, windowsHide: true });
+            : node_child_process_1.default.execFileSync('git', ['ls-remote', '--tags', '--refs', '--sort=-v:refname', url, 'v*'], {
+                encoding: 'utf-8',
+                timeout: 10_000,
+                maxBuffer: 512 * 1024,
+                windowsHide: true,
+                stdio: ['ignore', 'pipe', 'pipe'],
+            });
         const tags = lsOutput
             .split('\n')
             .map((line) => {
@@ -368,23 +413,27 @@ function resolveLatestPlatformTag(cwd, repo, provider, opts) {
         })
             .filter((t) => t && (0, semver_compare_cjs_1.isStableTripletSemver)(t));
         if (tags.length === 0) {
-            return { tag: null, warnings: [] };
+            result = { tag: null, warnings: [] };
         }
-        let latest = tags[0];
-        for (const t of tags) {
-            if ((0, semver_compare_cjs_1.compareSemverCore)(t, latest) > 0)
-                latest = t;
+        else {
+            let latest = tags[0];
+            for (const t of tags) {
+                if ((0, semver_compare_cjs_1.compareSemverCore)(t, latest) > 0)
+                    latest = t;
+            }
+            result = { tag: latest, warnings: [] };
         }
-        return { tag: latest, warnings: [] };
     }
     catch {
-        return {
+        result = {
             tag: null,
             warnings: [
                 bound('platform.tag could not be resolved — the tag lookup failed or was unreachable; the platform is unpinned.'),
             ],
         };
     }
+    platformTagMemo.set(url, result);
+    return result;
 }
 /**
  * Read the first readable, semver-shaped `VERSION` file among the installed

package/pp-core/bin/lib/init-contract.cjs

@@ -165,6 +165,14 @@ function getDotted(obj, dottedPath) {
  * `optionalAnswer: true` — that flag describes the ANSWER (pressing Enter
  * is a complete, valid response), never whether the question is asked.
  *
+ * Question 6 (`org_profile`)'s `preselected` is resolved via
+ * `resolveDetectedOrgProfile` — set only when exactly one org-profile-shaped
+ * package is installed (INIT-PATCH-C); the prompt text is built from that
+ * detected value rather than kept as two hard-coded strings that can drift.
+ * `opts._globalRoot` is forwarded to it unchanged, the same test-seam
+ * convention `verifyInitInvariants`'s own `_globalRoot` already follows —
+ * production callers omit it.
+ *
  * Question 7 (`provider`) carries the fixed, complete option list: every
  * value in `PROVIDERS` (imported, never retyped — this is what keeps
  * `azure` from being silently dropped again, T-34-50) plus the three
@@ -173,7 +181,7 @@ function getDotted(obj, dottedPath) {
  * probe reads (pure config + org-profile consultation, no network) — so
  * calling it directly here is equivalent, not a second implementation.
  */
-function buildInitQuestions(cwd) {
+function buildInitQuestions(cwd, opts = {}) {
     let preselected = git_provider_cjs_1.DEFAULT_PROVIDER;
     try {
         preselected = (0, git_provider_cjs_1.resolveProvider)(cwd).provider;
@@ -182,6 +190,29 @@ function buildInitQuestions(cwd) {
         preselected = git_provider_cjs_1.DEFAULT_PROVIDER;
     }
     const providerOptions = Object.freeze([...git_provider_cjs_1.PROVIDERS, ...IDENTITY_ONLY_PROVIDER_OPTIONS]);
+    const detectedOrgProfile = resolveDetectedOrgProfile(cwd, opts);
+    // The template example is written as an angle-bracket placeholder, not a
+    // literal package name. `tests/org-profile.test.cjs`'s client-confidentiality
+    // guard scans this file for any concrete scope-slash-org-prefix package
+    // identifier, so even a generic literal placeholder trips it — the template
+    // keeps the naming convention visible while staying clean, and the guard
+    // stays maximally strict, no allowlist entry was added for it. The detected
+    // value itself is never a literal in this file — it is a runtime string
+    // read from an installed package, interpolated into the prompt below.
+    const orgProfileQuestion = isUsableString(detectedOrgProfile)
+        ? {
+            id: 'org_profile',
+            prompt: `Org profile package (optional — a single installed org profile was detected: "${detectedOrgProfile}". ` +
+                'Press Enter to use it, type "none" to skip it, or type a different package name.)',
+            optionalAnswer: true,
+            preselected: detectedOrgProfile,
+            preselectedLabel: `${detectedOrgProfile} (detected installed profile)`,
+        }
+        : {
+            id: 'org_profile',
+            prompt: 'Org profile package (optional — press Enter to skip, e.g. "@<your-scope>/org-<name>")',
+            optionalAnswer: true,
+        };
     return [
         { id: 'project_name', prompt: 'Project name (human-readable, e.g. "Acme Dashboard")', optionalAnswer: false },
         { id: 'project_slug', prompt: 'Project slug (kebab-case, e.g. "acme-dashboard")', optionalAnswer: false },
@@ -196,17 +227,7 @@ function buildInitQuestions(cwd) {
             optionalAnswer: false,
         },
         { id: 'description', prompt: 'One-line description (what this project does)', optionalAnswer: false },
-        {
-            id: 'org_profile',
-            // The example is written as an angle-bracket TEMPLATE, not a literal package
-            // name. `tests/org-profile.test.cjs`'s client-confidentiality guard scans this
-            // file for any concrete scope-slash-org-prefix package identifier, so even a
-            // generic literal placeholder trips it. The template keeps the naming
-            // convention visible while staying clean, and the guard stays maximally
-            // strict — no allowlist entry was added for it.
-            prompt: 'Org profile package (optional — press Enter to skip, e.g. "@<your-scope>/org-<name>")',
-            optionalAnswer: true,
-        },
+        orgProfileQuestion,
         {
             id: 'provider',
             prompt: 'Provider (gitlab / azure / github / other / none)',
@@ -249,30 +270,47 @@ function resolveGlobalNodeModulesRoot() {
         return null;
     }
 }
+/** Conservative npm-package-name shape check (bare `name` or scoped
+ * `@scope/name`; lowercase, digits, `.`/`_`/`-`, never leading `.`/`_` in
+ * either segment). A directory name that does not match is never offered as
+ * a detected default (T-QP-02): it cannot be a resolvable package pointer,
+ * so rejecting it here keeps a hostile directory name (control characters,
+ * terminal escapes) from ever reaching a rendered prompt. */
+const NPM_PACKAGE_NAME_SHAPE_RE = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
 /**
- * True when `nodeModulesDir` contains at least one package directory (one
- * level, or one level inside an `@scope/` directory) carrying a file named
- * `ORG_PROFILE_DATA_FILE` at its root — the same fixed filename
- * `resolveOrgProfileDocument` reads, imported rather than retyped. Bounded
- * at `NODE_MODULES_SCAN_CAP` total directory entries visited (T-34-54: this
- * check must never hang on a pathological `node_modules` tree).
+ * Walk `nodeModulesDir` exactly like the boolean check below (one level, or
+ * one level inside an `@scope/` directory), collecting the name of every
+ * package directory carrying `ORG_PROFILE_DATA_FILE` at its root instead of
+ * stopping at the first hit. `opts.limit`, when set, stops the walk once
+ * that many names have been collected — passing `1` reproduces the boolean
+ * check's early-exit behaviour exactly. Bounded at `NODE_MODULES_SCAN_CAP`
+ * total directory entries visited (T-34-54: this check must never hang on a
+ * pathological `node_modules` tree).
  *
  * This is a heuristic, not a resolution: it answers "a package shaped like
  * an org profile is installed here", not "this exact profile would
- * resolve" — `verifyInitInvariants` never claims more than that.
+ * resolve" — callers never claim more than that.
  */
-function containsOrgProfileShapedPackage(nodeModulesDir) {
+function collectOrgProfileShapedPackages(nodeModulesDir, opts = {}) {
+    const names = [];
     let visited = 0;
+    const limitReached = () => opts.limit !== undefined && names.length >= opts.limit;
+    const addIfShaped = (name) => {
+        if (NPM_PACKAGE_NAME_SHAPE_RE.test(name))
+            names.push(name);
+    };
     let entries;
     try {
         entries = node_fs_1.default.readdirSync(nodeModulesDir, { withFileTypes: true });
     }
     catch {
-        return false;
+        return { names, capped: false };
     }
     for (const entry of entries) {
+        if (limitReached())
+            return { names, capped: false };
         if (visited >= NODE_MODULES_SCAN_CAP)
-            return false;
+            return { names, capped: true };
         visited += 1;
         if (!entry.isDirectory())
             continue;
@@ -286,14 +324,17 @@ function containsOrgProfileShapedPackage(nodeModulesDir) {
                 continue;
             }
             for (const scopedEntry of scoped) {
+                if (limitReached())
+                    return { names, capped: false };
                 if (visited >= NODE_MODULES_SCAN_CAP)
-                    return false;
+                    return { names, capped: true };
                 visited += 1;
                 if (!scopedEntry.isDirectory())
                     continue;
                 try {
-                    if (node_fs_1.default.existsSync(node_path_1.default.join(scopeDir, scopedEntry.name, org_profile_cjs_1.ORG_PROFILE_DATA_FILE)))
-                        return true;
+                    if (node_fs_1.default.existsSync(node_path_1.default.join(scopeDir, scopedEntry.name, org_profile_cjs_1.ORG_PROFILE_DATA_FILE))) {
+                        addIfShaped(`${entry.name}/${scopedEntry.name}`);
+                    }
                 }
                 catch {
                     continue;
@@ -302,15 +343,27 @@ function containsOrgProfileShapedPackage(nodeModulesDir) {
         }
         else {
             try {
-                if (node_fs_1.default.existsSync(node_path_1.default.join(nodeModulesDir, entry.name, org_profile_cjs_1.ORG_PROFILE_DATA_FILE)))
-                    return true;
+                if (node_fs_1.default.existsSync(node_path_1.default.join(nodeModulesDir, entry.name, org_profile_cjs_1.ORG_PROFILE_DATA_FILE))) {
+                    addIfShaped(entry.name);
+                }
             }
             catch {
                 continue;
             }
         }
     }
-    return false;
+    return { names, capped: false };
+}
+/**
+ * True when `nodeModulesDir` contains at least one package directory (one
+ * level, or one level inside an `@scope/` directory) carrying a file named
+ * `ORG_PROFILE_DATA_FILE` at its root — the same fixed filename
+ * `resolveOrgProfileDocument` reads, imported rather than retyped. Reduced to
+ * the collecting walk above with `limit: 1`, preserving its early-exit
+ * behaviour exactly.
+ */
+function containsOrgProfileShapedPackage(nodeModulesDir) {
+    return collectOrgProfileShapedPackages(nodeModulesDir, { limit: 1 }).names.length > 0;
 }
 function orgProfilePackageResolvable(cwd, opts) {
     try {
@@ -328,6 +381,44 @@ function orgProfilePackageResolvable(cwd, opts) {
         return false;
     }
 }
+/**
+ * Detect a single, unambiguous installed org-profile-shaped package
+ * (INIT-PATCH-C): collects from the project's `node_modules` and — using the
+ * same `opts._globalRoot` override convention `orgProfilePackageResolvable`
+ * already follows — the global root, de-duplicates by package name across
+ * both roots, and returns that single name only when exactly one distinct
+ * name was found and NEITHER scan reported `capped`. A capped scan is
+ * inconclusive and must never yield a default (T-QP-03). Two or more
+ * distinct names, or none, returns null. Never throws.
+ */
+function resolveDetectedOrgProfile(cwd, opts) {
+    try {
+        const names = new Set();
+        let anyCapped = false;
+        const projectNodeModules = node_path_1.default.join(cwd, 'node_modules');
+        if (node_fs_1.default.existsSync(projectNodeModules)) {
+            const projectResult = collectOrgProfileShapedPackages(projectNodeModules);
+            if (projectResult.capped)
+                anyCapped = true;
+            for (const name of projectResult.names)
+                names.add(name);
+        }
+        const globalRoot = opts._globalRoot !== undefined ? opts._globalRoot : resolveGlobalNodeModulesRoot();
+        if (globalRoot) {
+            const globalResult = collectOrgProfileShapedPackages(globalRoot);
+            if (globalResult.capped)
+                anyCapped = true;
+            for (const name of globalResult.names)
+                names.add(name);
+        }
+        if (anyCapped)
+            return null;
+        return names.size === 1 ? [...names][0] : null;
+    }
+    catch {
+        return null;
+    }
+}
 /** Read `.planning/config.json` at `cwd`, distinguishing "file absent" from
  * "file present but empty/malformed" — `INIT_IDENTITY_MISSING` only fires
  * on the latter (see `verifyInitInvariants`'s own doc comment for why an
@@ -654,7 +745,7 @@ function computeCurrentStep(cwd, session, opts) {
     // the convention: any failure anywhere in this body degrades to a
     // `write_failed` verdict instead of propagating.
     try {
-        const questions = buildInitQuestions(cwd);
+        const questions = buildInitQuestions(cwd, { _globalRoot: opts._globalRoot });
         for (const q of questions) {
             if (!Object.prototype.hasOwnProperty.call(session.answers, q.id)) {
                 return { kind: 'question', question: q };

package/pp-core/bin/lib/init-interactive.cjs

@@ -168,7 +168,26 @@ async function runInitInteractive(cwd, prompter, opts = {}) {
                 preselectedLabel: state.preselectedLabel,
                 optionalAnswer: state.optionalAnswer,
             });
-            const result = (0, init_contract_cjs_1.initSessionAnswer)(cwd, stepId, answer, sessionOpts);
+            // INIT-PATCH-C: Enter accepts a carried default, "none" clears it.
+            // Scoped to an OPTIONAL step carrying a usable `preselected` — today
+            // that is only `org_profile` when exactly one org-profile-shaped
+            // package was detected. `provider` also carries a `preselected` but is
+            // NOT `optionalAnswer`, so the `state.optionalAnswer === true` guard
+            // below leaves it untouched: a blank answer there still falls through
+            // to `initSessionAnswer` verbatim, which still rejects it and re-asks
+            // exactly as today.
+            const hasUsableDefault = state.optionalAnswer === true && typeof state.preselected === 'string' && state.preselected.trim() !== '';
+            let submittedAnswer = answer;
+            if (hasUsableDefault) {
+                const trimmedLower = answer.trim().toLowerCase();
+                if (answer.trim() === '') {
+                    submittedAnswer = state.preselected;
+                }
+                else if (trimmedLower === 'none') {
+                    submittedAnswer = '';
+                }
+            }
+            const result = (0, init_contract_cjs_1.initSessionAnswer)(cwd, stepId, submittedAnswer, sessionOpts);
             if (result.ok) {
                 if (stepId === 'compose_confirm') {
                     wroteBinding = readBindingsContent(cwd) !== preBindings;

package/pp-core/bin/pp-tools.cjs

@@ -725,9 +725,17 @@ function createReadlinePrompter() {
           )
           .join(' / ');
         rendered += `\n  Options: ${optionsRendered}`;
+      } else if (question.preselected) {
+        // INIT-PATCH-C: an option-less question carrying a `preselected`
+        // (e.g. a detected org profile) rendered no default at all today —
+        // render one, naming it via `preselectedLabel` when present.
+        rendered += `\n  Default: ${question.preselectedLabel || question.preselected} (press Enter to accept)`;
       }
       if (question.optionalAnswer) {
-        rendered += '\n  (press Enter to skip)';
+        // The unconditional "Enter skips" hint would be a lie once a
+        // default is carried — Enter now ACCEPTS the default above, so the
+        // skip hint must point at "none" instead.
+        rendered += question.preselected ? '\n  (type "none" to skip)' : '\n  (press Enter to skip)';
       }
       return new Promise((resolve) => {
         rl.question(`${rendered}\n> `, (answer) => resolve(answer));
@@ -1497,6 +1505,8 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
         if (!process.stdin.isTTY) {
           error(
             '"pp-tools init" requires an interactive terminal (stdin is not a TTY) and will not prompt. ' +
+              'This command cannot run inside an AI-agent shell or a piped session — open a regular ' +
+              'terminal window (e.g. Terminal, iTerm, or Windows Terminal) and run it there. ' +
               'For a non-interactive/CI-driven session, use "pp-tools query init-contract --session-next" / ' +
               '"--session-answer <stepId>=<value>" directly instead.',
             ERROR_REASON.INIT_NON_INTERACTIVE,