@pareto4/pp-core 1.11.0 → 1.12.0

package/pp-core/bin/lib/init-contract.cjs

@@ -50,6 +50,7 @@ exports.verifyInitInvariants = verifyInitInvariants;
 exports.initSessionNext = initSessionNext;
 exports.initSessionAnswer = initSessionAnswer;
 exports.initSessionReset = initSessionReset;
+exports.armVault = armVault;
 exports.cmdInitContract = cmdInitContract;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
@@ -102,6 +103,7 @@ exports.INIT_CONTRACT_FLAGS = Object.freeze([
     '--session-answer',
     '--session-reset',
     '--offline',
+    '--arm-vault',
 ]);
 /** `.planning/.init-session.json` — the CLI-owned session state file
  * (Artifacts table, 34-08). Never hand-edited; malformed content is
@@ -165,6 +167,14 @@ function getDotted(obj, dottedPath) {
  * `optionalAnswer: true` — that flag describes the ANSWER (pressing Enter
  * is a complete, valid response), never whether the question is asked.
  *
+ * Question 6 (`org_profile`)'s `preselected` is resolved via
+ * `resolveDetectedOrgProfile` — set only when exactly one org-profile-shaped
+ * package is installed (INIT-PATCH-C); the prompt text is built from that
+ * detected value rather than kept as two hard-coded strings that can drift.
+ * `opts._globalRoot` is forwarded to it unchanged, the same test-seam
+ * convention `verifyInitInvariants`'s own `_globalRoot` already follows —
+ * production callers omit it.
+ *
  * Question 7 (`provider`) carries the fixed, complete option list: every
  * value in `PROVIDERS` (imported, never retyped — this is what keeps
  * `azure` from being silently dropped again, T-34-50) plus the three
@@ -173,7 +183,7 @@ function getDotted(obj, dottedPath) {
  * probe reads (pure config + org-profile consultation, no network) — so
  * calling it directly here is equivalent, not a second implementation.
  */
-function buildInitQuestions(cwd) {
+function buildInitQuestions(cwd, opts = {}) {
     let preselected = git_provider_cjs_1.DEFAULT_PROVIDER;
     try {
         preselected = (0, git_provider_cjs_1.resolveProvider)(cwd).provider;
@@ -182,6 +192,29 @@ function buildInitQuestions(cwd) {
         preselected = git_provider_cjs_1.DEFAULT_PROVIDER;
     }
     const providerOptions = Object.freeze([...git_provider_cjs_1.PROVIDERS, ...IDENTITY_ONLY_PROVIDER_OPTIONS]);
+    const detectedOrgProfile = resolveDetectedOrgProfile(cwd, opts);
+    // The template example is written as an angle-bracket placeholder, not a
+    // literal package name. `tests/org-profile.test.cjs`'s client-confidentiality
+    // guard scans this file for any concrete scope-slash-org-prefix package
+    // identifier, so even a generic literal placeholder trips it — the template
+    // keeps the naming convention visible while staying clean, and the guard
+    // stays maximally strict, no allowlist entry was added for it. The detected
+    // value itself is never a literal in this file — it is a runtime string
+    // read from an installed package, interpolated into the prompt below.
+    const orgProfileQuestion = isUsableString(detectedOrgProfile)
+        ? {
+            id: 'org_profile',
+            prompt: `Org profile package (optional — a single installed org profile was detected: "${detectedOrgProfile}". ` +
+                'Press Enter to use it, type "none" to skip it, or type a different package name.)',
+            optionalAnswer: true,
+            preselected: detectedOrgProfile,
+            preselectedLabel: `${detectedOrgProfile} (detected installed profile)`,
+        }
+        : {
+            id: 'org_profile',
+            prompt: 'Org profile package (optional — press Enter to skip, e.g. "@<your-scope>/org-<name>")',
+            optionalAnswer: true,
+        };
     return [
         { id: 'project_name', prompt: 'Project name (human-readable, e.g. "Acme Dashboard")', optionalAnswer: false },
         { id: 'project_slug', prompt: 'Project slug (kebab-case, e.g. "acme-dashboard")', optionalAnswer: false },
@@ -196,17 +229,7 @@ function buildInitQuestions(cwd) {
             optionalAnswer: false,
         },
         { id: 'description', prompt: 'One-line description (what this project does)', optionalAnswer: false },
-        {
-            id: 'org_profile',
-            // The example is written as an angle-bracket TEMPLATE, not a literal package
-            // name. `tests/org-profile.test.cjs`'s client-confidentiality guard scans this
-            // file for any concrete scope-slash-org-prefix package identifier, so even a
-            // generic literal placeholder trips it. The template keeps the naming
-            // convention visible while staying clean, and the guard stays maximally
-            // strict — no allowlist entry was added for it.
-            prompt: 'Org profile package (optional — press Enter to skip, e.g. "@<your-scope>/org-<name>")',
-            optionalAnswer: true,
-        },
+        orgProfileQuestion,
         {
             id: 'provider',
             prompt: 'Provider (gitlab / azure / github / other / none)',
@@ -249,30 +272,47 @@ function resolveGlobalNodeModulesRoot() {
         return null;
     }
 }
+/** Conservative npm-package-name shape check (bare `name` or scoped
+ * `@scope/name`; lowercase, digits, `.`/`_`/`-`, never leading `.`/`_` in
+ * either segment). A directory name that does not match is never offered as
+ * a detected default (T-QP-02): it cannot be a resolvable package pointer,
+ * so rejecting it here keeps a hostile directory name (control characters,
+ * terminal escapes) from ever reaching a rendered prompt. */
+const NPM_PACKAGE_NAME_SHAPE_RE = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
 /**
- * True when `nodeModulesDir` contains at least one package directory (one
- * level, or one level inside an `@scope/` directory) carrying a file named
- * `ORG_PROFILE_DATA_FILE` at its root — the same fixed filename
- * `resolveOrgProfileDocument` reads, imported rather than retyped. Bounded
- * at `NODE_MODULES_SCAN_CAP` total directory entries visited (T-34-54: this
- * check must never hang on a pathological `node_modules` tree).
+ * Walk `nodeModulesDir` exactly like the boolean check below (one level, or
+ * one level inside an `@scope/` directory), collecting the name of every
+ * package directory carrying `ORG_PROFILE_DATA_FILE` at its root instead of
+ * stopping at the first hit. `opts.limit`, when set, stops the walk once
+ * that many names have been collected — passing `1` reproduces the boolean
+ * check's early-exit behaviour exactly. Bounded at `NODE_MODULES_SCAN_CAP`
+ * total directory entries visited (T-34-54: this check must never hang on a
+ * pathological `node_modules` tree).
  *
  * This is a heuristic, not a resolution: it answers "a package shaped like
  * an org profile is installed here", not "this exact profile would
- * resolve" — `verifyInitInvariants` never claims more than that.
+ * resolve" — callers never claim more than that.
  */
-function containsOrgProfileShapedPackage(nodeModulesDir) {
+function collectOrgProfileShapedPackages(nodeModulesDir, opts = {}) {
+    const names = [];
     let visited = 0;
+    const limitReached = () => opts.limit !== undefined && names.length >= opts.limit;
+    const addIfShaped = (name) => {
+        if (NPM_PACKAGE_NAME_SHAPE_RE.test(name))
+            names.push(name);
+    };
     let entries;
     try {
         entries = node_fs_1.default.readdirSync(nodeModulesDir, { withFileTypes: true });
     }
     catch {
-        return false;
+        return { names, capped: false };
     }
     for (const entry of entries) {
+        if (limitReached())
+            return { names, capped: false };
         if (visited >= NODE_MODULES_SCAN_CAP)
-            return false;
+            return { names, capped: true };
         visited += 1;
         if (!entry.isDirectory())
             continue;
@@ -286,14 +326,17 @@ function containsOrgProfileShapedPackage(nodeModulesDir) {
                 continue;
             }
             for (const scopedEntry of scoped) {
+                if (limitReached())
+                    return { names, capped: false };
                 if (visited >= NODE_MODULES_SCAN_CAP)
-                    return false;
+                    return { names, capped: true };
                 visited += 1;
                 if (!scopedEntry.isDirectory())
                     continue;
                 try {
-                    if (node_fs_1.default.existsSync(node_path_1.default.join(scopeDir, scopedEntry.name, org_profile_cjs_1.ORG_PROFILE_DATA_FILE)))
-                        return true;
+                    if (node_fs_1.default.existsSync(node_path_1.default.join(scopeDir, scopedEntry.name, org_profile_cjs_1.ORG_PROFILE_DATA_FILE))) {
+                        addIfShaped(`${entry.name}/${scopedEntry.name}`);
+                    }
                 }
                 catch {
                     continue;
@@ -302,15 +345,27 @@ function containsOrgProfileShapedPackage(nodeModulesDir) {
         }
         else {
             try {
-                if (node_fs_1.default.existsSync(node_path_1.default.join(nodeModulesDir, entry.name, org_profile_cjs_1.ORG_PROFILE_DATA_FILE)))
-                    return true;
+                if (node_fs_1.default.existsSync(node_path_1.default.join(nodeModulesDir, entry.name, org_profile_cjs_1.ORG_PROFILE_DATA_FILE))) {
+                    addIfShaped(entry.name);
+                }
             }
             catch {
                 continue;
             }
         }
     }
-    return false;
+    return { names, capped: false };
+}
+/**
+ * True when `nodeModulesDir` contains at least one package directory (one
+ * level, or one level inside an `@scope/` directory) carrying a file named
+ * `ORG_PROFILE_DATA_FILE` at its root — the same fixed filename
+ * `resolveOrgProfileDocument` reads, imported rather than retyped. Reduced to
+ * the collecting walk above with `limit: 1`, preserving its early-exit
+ * behaviour exactly.
+ */
+function containsOrgProfileShapedPackage(nodeModulesDir) {
+    return collectOrgProfileShapedPackages(nodeModulesDir, { limit: 1 }).names.length > 0;
 }
 function orgProfilePackageResolvable(cwd, opts) {
     try {
@@ -328,6 +383,44 @@ function orgProfilePackageResolvable(cwd, opts) {
         return false;
     }
 }
+/**
+ * Detect a single, unambiguous installed org-profile-shaped package
+ * (INIT-PATCH-C): collects from the project's `node_modules` and — using the
+ * same `opts._globalRoot` override convention `orgProfilePackageResolvable`
+ * already follows — the global root, de-duplicates by package name across
+ * both roots, and returns that single name only when exactly one distinct
+ * name was found and NEITHER scan reported `capped`. A capped scan is
+ * inconclusive and must never yield a default (T-QP-03). Two or more
+ * distinct names, or none, returns null. Never throws.
+ */
+function resolveDetectedOrgProfile(cwd, opts) {
+    try {
+        const names = new Set();
+        let anyCapped = false;
+        const projectNodeModules = node_path_1.default.join(cwd, 'node_modules');
+        if (node_fs_1.default.existsSync(projectNodeModules)) {
+            const projectResult = collectOrgProfileShapedPackages(projectNodeModules);
+            if (projectResult.capped)
+                anyCapped = true;
+            for (const name of projectResult.names)
+                names.add(name);
+        }
+        const globalRoot = opts._globalRoot !== undefined ? opts._globalRoot : resolveGlobalNodeModulesRoot();
+        if (globalRoot) {
+            const globalResult = collectOrgProfileShapedPackages(globalRoot);
+            if (globalResult.capped)
+                anyCapped = true;
+            for (const name of globalResult.names)
+                names.add(name);
+        }
+        if (anyCapped)
+            return null;
+        return names.size === 1 ? [...names][0] : null;
+    }
+    catch {
+        return null;
+    }
+}
 /** Read `.planning/config.json` at `cwd`, distinguishing "file absent" from
  * "file present but empty/malformed" — `INIT_IDENTITY_MISSING` only fires
  * on the latter (see `verifyInitInvariants`'s own doc comment for why an
@@ -654,7 +747,7 @@ function computeCurrentStep(cwd, session, opts) {
     // the convention: any failure anywhere in this body degrades to a
     // `write_failed` verdict instead of propagating.
     try {
-        const questions = buildInitQuestions(cwd);
+        const questions = buildInitQuestions(cwd, { _globalRoot: opts._globalRoot });
         for (const q of questions) {
             if (!Object.prototype.hasOwnProperty.call(session.answers, q.id)) {
                 return { kind: 'question', question: q };
@@ -678,14 +771,18 @@ function computeCurrentStep(cwd, session, opts) {
             // end states and must record (and later report) distinct decisions,
             // never sharing the inert-path (INIT-02) message below.
             if (dryRun.composable === true && dryRun.action !== 'unchanged') {
+                // Pack 6 D-07: `info` is display-only (the CLI and the TTY renderer
+                // print it); approval re-composes with `write: true`, so the written
+                // file keeps the RAW coordinates.
+                const shown = (0, compose_bindings_cjs_1.redactComposeResultForEmission)(dryRun);
                 return {
                     kind: 'compose_confirm',
                     info: {
-                        provenance: dryRun.provenance,
-                        drift: dryRun.drift,
+                        provenance: shown.provenance,
+                        drift: shown.drift,
                         action: dryRun.action,
-                        composed: dryRun.composed,
-                        warnings: dryRun.warnings,
+                        composed: shown.composed,
+                        warnings: shown.warnings,
                     },
                 };
             }
@@ -927,6 +1024,81 @@ function initSessionReset(cwd) {
     }
     return { ok: true };
 }
+/**
+ * `init-contract --arm-vault`: turn the client vault on for a project whose
+ * client vault is bound. Writes `vault.enabled: true` ONLY when the key is
+ * absent — an explicit `false` (or any other explicit value) is the
+ * operator's decision and is kept. With no client vault bound (no or
+ * malformed `.platform-bindings.json`, or `client.vaultRepo` /
+ * `client.vaultRef` missing — the same "bound" the gate's verdict uses) it
+ * writes nothing and returns `ok: false` naming /pp-init. A present but
+ * unparseable `.planning/config.json` is never overwritten. Never throws.
+ * The reported coordinate is display-safe (D-07).
+ */
+function armVault(cwd) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const vaultMod = require('./vault.cjs');
+    let binding = { bound: false, repo: null, ref: null };
+    try {
+        binding = vaultMod.readClientBinding(cwd);
+    }
+    catch {
+        /* unbound */
+    }
+    const client = { repo: vaultMod.redactCloneTarget(binding.repo), ref: binding.ref };
+    const configPath = node_path_1.default.join(cwd, '.planning', 'config.json');
+    let cfg = {};
+    let cfgExists = false;
+    try {
+        cfgExists = node_fs_1.default.existsSync(configPath);
+        if (cfgExists) {
+            const parsed = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
+            if (!isObject(parsed))
+                throw new Error('not an object');
+            cfg = parsed;
+        }
+    }
+    catch {
+        return {
+            ok: false,
+            armed: false,
+            enabled: undefined,
+            client,
+            message: '.planning/config.json is not valid JSON — fix it (or re-run /pp-init), then arm the vault again. Nothing was written.',
+        };
+    }
+    const vaultSection = isObject(cfg.vault) ? cfg.vault : null;
+    const nested = vaultSection && Object.prototype.hasOwnProperty.call(vaultSection, 'enabled');
+    const flat = Object.prototype.hasOwnProperty.call(cfg, 'vault.enabled');
+    const current = nested && vaultSection ? vaultSection.enabled : flat ? cfg['vault.enabled'] : undefined;
+    if (!binding.bound) {
+        return {
+            ok: false,
+            armed: false,
+            enabled: current,
+            client,
+            message: 'No client vault is bound — .platform-bindings.json needs client.vaultRepo and client.vaultRef. Run /pp-init to bind it; vault.enabled was not changed.',
+        };
+    }
+    if (nested || flat) {
+        return {
+            ok: true,
+            armed: false,
+            enabled: current,
+            client,
+            message: current === true
+                ? 'vault.enabled is already true — nothing to do.'
+                : `vault.enabled is explicitly set to ${JSON.stringify(current)} — kept as the operator's choice.`,
+        };
+    }
+    try {
+        writeConfigMerge(cwd, { vault: { enabled: true } });
+    }
+    catch (err) {
+        return { ok: false, armed: false, enabled: undefined, client, message: writeFailedMessage(err) };
+    }
+    return { ok: true, armed: true, enabled: true, client, message: 'vault.enabled set to true (it was absent).' };
+}
 // ─── cmdInitContract ────────────────────────────────────────────────────────
 /**
  * CLI adapter for `pp-tools query init-contract`.
@@ -954,6 +1126,14 @@ function initSessionReset(cwd) {
  * convention as `--verify`.
  */
 function cmdInitContract(cwd, options, raw) {
+    if (options.armVault === true) {
+        const result = armVault(cwd);
+        output(result, raw);
+        if (!result.ok) {
+            process.exitCode = 1;
+        }
+        return;
+    }
     if (options.sessionReset === true) {
         const result = initSessionReset(cwd);
         output(result, raw);

package/pp-core/bin/lib/init-interactive.cjs

@@ -168,7 +168,26 @@ async function runInitInteractive(cwd, prompter, opts = {}) {
                 preselectedLabel: state.preselectedLabel,
                 optionalAnswer: state.optionalAnswer,
             });
-            const result = (0, init_contract_cjs_1.initSessionAnswer)(cwd, stepId, answer, sessionOpts);
+            // INIT-PATCH-C: Enter accepts a carried default, "none" clears it.
+            // Scoped to an OPTIONAL step carrying a usable `preselected` — today
+            // that is only `org_profile` when exactly one org-profile-shaped
+            // package was detected. `provider` also carries a `preselected` but is
+            // NOT `optionalAnswer`, so the `state.optionalAnswer === true` guard
+            // below leaves it untouched: a blank answer there still falls through
+            // to `initSessionAnswer` verbatim, which still rejects it and re-asks
+            // exactly as today.
+            const hasUsableDefault = state.optionalAnswer === true && typeof state.preselected === 'string' && state.preselected.trim() !== '';
+            let submittedAnswer = answer;
+            if (hasUsableDefault) {
+                const trimmedLower = answer.trim().toLowerCase();
+                if (answer.trim() === '') {
+                    submittedAnswer = state.preselected;
+                }
+                else if (trimmedLower === 'none') {
+                    submittedAnswer = '';
+                }
+            }
+            const result = (0, init_contract_cjs_1.initSessionAnswer)(cwd, stepId, submittedAnswer, sessionOpts);
             if (result.ok) {
                 if (stepId === 'compose_confirm') {
                     wroteBinding = readBindingsContent(cwd) !== preBindings;