@pareto4/pp-core 1.11.1 → 1.12.0

package/pp-core/bin/lib/template.cjs

@@ -21,12 +21,12 @@ const { toPosixPath, generateSlugInternal } = coreUtilsMod;
 const phaseIdMod = require("./phase-id.cjs");
 const { normalizePhaseName } = phaseIdMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
-const phaseLocatorMod = require("./phase-locator.cjs");
-const { findPhaseInternal } = phaseLocatorMod;
+const phaseScopeMod = require("./phase-scope.cjs");
+const { resolvePhaseForWrite } = phaseScopeMod;
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
-const { planningDir } = planningWorkspace;
+const { planningDir, resolveProjectFile } = planningWorkspace;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const frontmatter = require("./frontmatter.cjs");
 const { reconstructFrontmatter } = frontmatter;
@@ -79,8 +79,23 @@ function cmdTemplateFill(cwd, templateType, options, raw) {
     if (!options.phase) {
         error('--phase required');
     }
-    const phaseInfo = findPhaseInternal(cwd, options.phase);
-    if (!phaseInfo || !phaseInfo.found) {
+    // D-02 (todo "template-fill-writes-into-an-archived-
+    // phase-directory"): a writer never resolves into a closed milestone's archive. The
+    // phase-scope owner hands back a live match only; an archive this phase still names
+    // (current milestone, or no longer on the ROADMAP) is refused naming the archive, and a
+    // prior milestone's archive whose number the current ROADMAP reuses takes the not-found
+    // line below, as the init verbs already answer.
+    const verdict = resolvePhaseForWrite(cwd, options.phase);
+    if (!verdict.ok && verdict.reason === 'archived') {
+        output({ error: 'Phase archived', phase: options.phase, archived: verdict.version, directory: verdict.directory }, raw, undefined);
+        return;
+    }
+    if (!verdict.ok) {
+        output({ error: 'Phase not found', phase: options.phase }, raw, undefined);
+        return;
+    }
+    const phaseInfo = verdict.match;
+    if (!phaseInfo.found) {
         output({ error: 'Phase not found', phase: options.phase }, raw, undefined);
         return;
     }
@@ -156,7 +171,8 @@ function cmdTemplateFill(cwd, templateType, options, raw) {
                 ...fields,
             };
             const planBase = planningDir(cwd);
-            const projectRef = toPosixPath(node_path_1.default.relative(cwd, node_path_1.default.join(planBase, 'PROJECT.md')));
+            // D1 (261007-jkl): the context reference names the PROJECT.md that answers for this cwd.
+            const projectRef = toPosixPath(node_path_1.default.relative(cwd, resolveProjectFile(cwd).path));
             const roadmapRef = toPosixPath(node_path_1.default.relative(cwd, node_path_1.default.join(planBase, 'ROADMAP.md')));
             const stateRef = toPosixPath(node_path_1.default.relative(cwd, node_path_1.default.join(planBase, 'STATE.md')));
             body = [

package/pp-core/bin/lib/vault-command-router.cjs

@@ -33,6 +33,20 @@ const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs")
 const { ERROR_REASON } = io;
 // Default CoreModule implementation. _core seam overrides this for test injection.
 const _defaultCore = { output: io.output };
+/**
+ * Pack 6 D-01: the vault router's subcommand table. `readsVerdict` marks every
+ * subcommand that reports the vault load verdict — each one must spread the
+ * owner's `VAULT_VERDICT_FIELDS` verbatim (tests/vault-status-check.test.cjs
+ * enumerates this table and compares every reader against the owner).
+ */
+const VAULT_SUBCOMMANDS = Object.freeze([
+    { name: 'fetch', readsVerdict: false },
+    { name: 'status', readsVerdict: true },
+    { name: 'summary', readsVerdict: false },
+    { name: 'practices', readsVerdict: false },
+    { name: 'org-profile', readsVerdict: false },
+    { name: 'probe', readsVerdict: false },
+]);
 /**
  * Render a short plain-text `vault org-profile` report from its structured
  * shape — one line naming the pointer, one naming the resolution, a
@@ -93,7 +107,24 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
         c.output(vault.vaultFetch(cwd), raw);
     }
     else if (subcommand === 'status') {
-        c.output(vault.vaultStatus(cwd), raw);
+        // Pack 6 D-01: the manifest read is unchanged; the verdict fields come
+        // from the one owner, never from a second derivation here.
+        const status = vault.vaultStatus(cwd);
+        const verdict = vault.computeVaultVerdict && vault.verdictFields ? vault.verdictFields(vault.computeVaultVerdict(cwd)) : {};
+        c.output({ ...status, ...verdict }, raw);
+    }
+    else if (subcommand === 'probe') {
+        // Pack 6 D-09: one reachability line, empty when the vault is disabled (D-06).
+        const result = vault.vaultProbe ? vault.vaultProbe(cwd) : { line: '', enabled: false };
+        if (!result.enabled) {
+            c.output(result, true, '');
+        }
+        else if (raw) {
+            c.output(result, true, JSON.stringify(result));
+        }
+        else {
+            c.output(result, true, `${result.line}\n`);
+        }
     }
     else if (subcommand === 'summary') {
         c.output(vault.vaultSummary(cwd), raw);
@@ -257,6 +288,21 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
                 overridden.push({ key, profile: profileValue, effective: effectiveValue });
             }
         }
+        // Pack 6 D-07: the drift comparison above ran on RAW values (two repos
+        // differing only by a credential still report drift); what is EMITTED is
+        // display-safe — the shared-repo coordinate through the owner, prose
+        // through the prose redactor.
+        const shownRepo = (key, v) => key === coordinates.SHARED_REPO_CONFIG_KEY && typeof v === 'string' && vault.redactCloneTarget
+            ? vault.redactCloneTarget(v)
+            : v;
+        const shownText = (t) => (vault.redactRemoteText ? vault.redactRemoteText(t) : t);
+        const shownContributes = {};
+        for (const key of Object.keys(resolution.contributes)) {
+            shownContributes[key] = shownRepo(key, resolution.contributes[key]) ?? '';
+        }
+        const shownEffective = {};
+        for (const key of Object.keys(effective))
+            shownEffective[key] = shownRepo(key, effective[key]);
         const report = {
             pointer: { key: orgProfile.ORG_PROFILE_CONFIG_KEY, value: resolution.configured },
             profile: {
@@ -266,12 +312,16 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
                 source: resolution.source,
                 dataPath: resolution.dataPath,
             },
-            contributes: resolution.contributes,
-            effective,
-            overridden,
+            contributes: shownContributes,
+            effective: shownEffective,
+            overridden: overridden.map((o) => ({
+                key: o.key,
+                profile: shownRepo(o.key, o.profile) ?? '',
+                effective: shownRepo(o.key, o.effective),
+            })),
             ignored: resolution.ignored,
             rejected: resolution.rejected,
-            warnings: resolution.warnings,
+            warnings: resolution.warnings.map(shownText),
         };
         // Never call error() for a project with no profile, and never exit
         // non-zero for a resolution failure — this is a diagnostic, not an
@@ -285,9 +335,10 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
         }
     }
     else {
-        error('Unknown vault subcommand. Available: fetch, status, summary, practices, org-profile', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+        error(`Unknown vault subcommand. Available: ${VAULT_SUBCOMMANDS.map((x) => x.name).join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
     }
 }
 module.exports = {
     routeVaultCommand,
+    VAULT_SUBCOMMANDS,
 };

package/pp-core/bin/lib/vault-practices.cjs

@@ -642,42 +642,12 @@ function discoverPracticeFiles(cwd) {
     }
 }
 // ─── Matching + report (PRAC-02 / PRAC-03 / COMM-01) ───────────────────────────
-// External-content fence markers (D-15 / T-24-05) — copied verbatim from
-// `vaultSummary`'s untrusted-reference preamble in src/vault.cts so every
-// consumer of a global practice's excerpt inherits the same fencing
-// discipline from day one, rather than retrofitting it in a later phase.
-const EXTERNAL_CONTENT_FENCE_START = '<!-- vault:external-content-start -->';
-const EXTERNAL_CONTENT_FENCE_END = '<!-- vault:external-content-end -->';
-// Zero-width space (U+200B) — invisible when rendered, but breaks an exact
-// string match against the literal fence marker (CR-01 / T-24-05). Used by
-// `defangFenceMarkers` to neutralize a spoofed marker planted inside untrusted
-// body text without visibly mangling the text for a human/agent reader.
-const ZERO_WIDTH_SPACE = '\u200B';
-/**
- * Neutralize any occurrence of the external-content fence marker strings
- * inside untrusted body text BEFORE it is wrapped between the real markers
- * (CR-01 / T-24-05 fence-spoof escape). Without this, a practice body
- * containing the literal end-fence marker (`<!-- vault:external-content-end
- * -->`) could make a downstream consumer that naively splits on the exact
- * marker treat the injected text as being OUTSIDE the untrusted-content
- * fence — the classic "premature fence close" prompt-injection escape.
- *
- * Replaces each literal marker occurrence with a defanged variant (a
- * zero-width space inserted immediately after the opening `<!--`) that is
- * visually indistinguishable but no longer matches the real marker string —
- * so only the two GENUINE markers `boundedFencedExcerpt` appends afterward
- * remain real fence boundaries.
- */
-function defangFenceMarkers(body) {
-    let result = body;
-    for (const marker of [EXTERNAL_CONTENT_FENCE_START, EXTERNAL_CONTENT_FENCE_END]) {
-        if (result.includes(marker)) {
-            const defanged = `${marker.slice(0, 4)}${ZERO_WIDTH_SPACE}${marker.slice(4)}`;
-            result = result.split(marker).join(defanged);
-        }
-    }
-    return result;
-}
+// External-content fence (D-15 / T-24-05). Pack 6 D-08: the fence has ONE
+// owner, src/vault.cts — the marker strings and `defangFenceMarkers` are
+// imported from it rather than copied, so every path that hands vault text to
+// an agent defangs every marker spelling (case, whitespace, HTML entities,
+// compatibility forms, zero-width characters), not only the literal marker.
+const { EXTERNAL_CONTENT_FENCE_START, EXTERNAL_CONTENT_FENCE_END, defangFenceMarkers } = vaultMod;
 /**
  * Read a BOUNDED prefix of a practice file's markdown BODY (frontmatter
  * stripped) and wrap it in the `vault:external-content` fence + untrusted-

package/pp-core/bin/lib/vault-write-back.cjs

@@ -440,7 +440,7 @@ function previewPromotion({ cwd, filePath, _exec, _vault, _practices }) {
             cloneDir,
         ], { timeout: 120_000 });
         if (cl.exitCode !== 0) {
-            const cause = boundedToken((cl.stderr || '').split(/\r?\n/)[0] || 'unknown error');
+            const cause = shownCause(cl.stderr);
             return refusal(PROMOTE_GUARD.TRANSPORT, ERROR_REASON.VAULT_PROMOTE_TRANSPORT_FAILED, `This practice was not pushed: git could not reach the vault (${cause}). Check your access to the vault and run the promotion again.`);
         }
         // 3. Capture the baseline BEFORE writing — an id already present in the
@@ -558,7 +558,7 @@ function previewPromotion({ cwd, filePath, _exec, _vault, _practices }) {
         const expect = buildExpectToken(pre.raw, baseline);
         return {
             status: 'preview',
-            repo: pre.repo,
+            repo: shownRepo(pre.repo),
             ref: pre.ref,
             destination: pre.destination,
             mode,
@@ -577,9 +577,25 @@ function previewPromotion({ cwd, filePath, _exec, _vault, _practices }) {
     }
 }
 // ─── Confirm (write half of the write path) ──────────────────────────────────────
+/**
+ * Pack 6 D-07: the display-safe forms used in every verdict and refusal this
+ * module EMITS — the one owner in src/vault.cts, lazily required (the
+ * module's `_vault` seam stays the fetch seam; redaction is never mocked).
+ * Comparisons, the expect token and every git invocation keep the RAW values.
+ */
+function shownRepo(repo) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const v = require('./vault.cjs');
+    return v.redactCloneTarget(repo) ?? repo;
+}
+function shownCause(stderr) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const v = require('./vault.cjs');
+    return boundedToken(v.redactRemoteText((stderr || '').split(/\r?\n/)[0] || 'unknown error'));
+}
 /** Build a TRANSPORT refusal from a failed git invocation's stderr (first line only). */
 function transportRefusal(res) {
-    const cause = boundedToken((res.stderr || '').split(/\r?\n/)[0] || 'unknown error');
+    const cause = shownCause(res.stderr);
     return refusal(PROMOTE_GUARD.TRANSPORT, ERROR_REASON.VAULT_PROMOTE_TRANSPORT_FAILED, `This practice was not pushed: git could not reach the vault (${cause}). Check your access to the vault and run the promotion again.`);
 }
 /**
@@ -739,7 +755,7 @@ function confirmPromotion({ cwd, filePath, expect, _exec, _vault, _practices })
         }
         return {
             status: 'pushed',
-            repo: pre.repo,
+            repo: shownRepo(pre.repo),
             ref: pre.ref,
             destination: pre.destination,
             mode,