@pareto4/pp-core 1.13.0 → 1.18.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (204) hide show
  1. package/.claude-plugin/plugin.json +3 -3
  2. package/README.md +31 -12
  3. package/agents/pp-code-fixer.md +0 -11
  4. package/agents/pp-code-reviewer.md +1 -77
  5. package/agents/pp-debug-session-manager.md +9 -6
  6. package/agents/pp-executor.md +12 -29
  7. package/agents/pp-plan-checker.md +4 -4
  8. package/agents/pp-planner.md +34 -20
  9. package/agents/pp-vault-reviewer.md +100 -23
  10. package/agents/pp-verifier.md +1 -3
  11. package/bin/install.js +10 -3
  12. package/commands/pp-execute-phase.md +1 -3
  13. package/commands/pp-ns-manage.md +1 -1
  14. package/commands/pp-ns-review.md +1 -1
  15. package/commands/pp-plan-phase.md +1 -2
  16. package/commands/pp-vault-promote.md +7 -8
  17. package/commands/pp-vault-review.md +6 -5
  18. package/commands/pp-verify-work.md +1 -2
  19. package/gemini-extension.json +1 -1
  20. package/hooks/dist/pp-check-update.js +0 -0
  21. package/hooks/dist/pp-cursor-session-start.js +1 -1
  22. package/hooks/dist/pp-statusline.js +1 -1
  23. package/hooks/dist/pp-update-banner.js +0 -0
  24. package/hooks/pp-check-update.js +0 -0
  25. package/hooks/pp-cursor-session-start.js +1 -1
  26. package/hooks/pp-statusline.js +1 -1
  27. package/hooks/pp-update-banner.js +0 -0
  28. package/package.json +10 -18
  29. package/pareto-skills/_shared/create-project-board.sh +0 -0
  30. package/pareto-skills/pp-project-setup/SKILL.md +1 -1
  31. package/pp-core/bin/check-latest-version.cjs +0 -0
  32. package/pp-core/bin/detect-build-commands.sh +2 -2
  33. package/pp-core/bin/lib/capability-activation.cjs +83 -9
  34. package/pp-core/bin/lib/capability-registry.cjs +201 -229
  35. package/pp-core/bin/lib/capability-state.cjs +93 -1
  36. package/pp-core/bin/lib/capability-writer.cjs +3 -3
  37. package/pp-core/bin/lib/check-command-router.cjs +1906 -1514
  38. package/pp-core/bin/lib/clusters.cjs +3 -0
  39. package/pp-core/bin/lib/command-aliases.cjs +0 -35
  40. package/pp-core/bin/lib/commands.cjs +9 -4
  41. package/pp-core/bin/lib/compose-bindings.cjs +251 -88
  42. package/pp-core/bin/lib/config-loader.cjs +7 -103
  43. package/pp-core/bin/lib/config-schema.cjs +1 -1
  44. package/pp-core/bin/lib/config.cjs +151 -62
  45. package/pp-core/bin/lib/decisions.cjs +4 -4
  46. package/pp-core/bin/lib/discovery-vault-check.cjs +246 -0
  47. package/pp-core/bin/lib/frontmatter.cjs +1 -38
  48. package/pp-core/bin/lib/git-base-branch.cjs +11 -12
  49. package/pp-core/bin/lib/git-provider.cjs +9 -10
  50. package/pp-core/bin/lib/init-command-router.cjs +5 -8
  51. package/pp-core/bin/lib/init-contract.cjs +620 -738
  52. package/pp-core/bin/lib/init-interactive.cjs +62 -4
  53. package/pp-core/bin/lib/init.cjs +24 -51
  54. package/pp-core/bin/lib/install-profiles.cjs +1 -1
  55. package/pp-core/bin/lib/io.cjs +4 -2
  56. package/pp-core/bin/lib/loop-resolver.cjs +165 -129
  57. package/pp-core/bin/lib/org-profile.cjs +402 -161
  58. package/pp-core/bin/lib/package-identity.cjs +3 -3
  59. package/pp-core/bin/lib/phase-command-router.cjs +1 -29
  60. package/pp-core/bin/lib/phase-scope.cjs +1 -1
  61. package/pp-core/bin/lib/phase.cjs +11 -253
  62. package/pp-core/bin/lib/platform-bindings.cjs +40 -19
  63. package/pp-core/bin/lib/profile-output.cjs +1 -1
  64. package/pp-core/bin/lib/shell-command-projection.cjs +104 -1
  65. package/pp-core/bin/lib/state.cjs +11 -85
  66. package/pp-core/bin/lib/template.cjs +1 -1
  67. package/pp-core/bin/lib/vault-command-router.cjs +1682 -477
  68. package/pp-core/bin/lib/vault-coordinates.cjs +16 -7
  69. package/pp-core/bin/lib/vault-index.cjs +656 -0
  70. package/pp-core/bin/lib/vault-seal.cjs +1851 -0
  71. package/pp-core/bin/lib/vault-standards-promote.cjs +577 -0
  72. package/pp-core/bin/lib/vault-standards-review.cjs +293 -0
  73. package/pp-core/bin/lib/vault-standards.cjs +1504 -0
  74. package/pp-core/bin/lib/vault-trace.cjs +155 -2778
  75. package/pp-core/bin/lib/vault-update.cjs +10 -59
  76. package/pp-core/bin/lib/vault.cjs +2570 -950
  77. package/pp-core/bin/lib/verify.cjs +0 -11
  78. package/pp-core/bin/portable-timeout.sh +1 -1
  79. package/pp-core/bin/pp-tools.cjs +157 -54
  80. package/pp-core/bin/shared/config-defaults.manifest.json +0 -7
  81. package/pp-core/bin/shared/config-schema.manifest.json +0 -3
  82. package/pp-core/bin/shared/model-catalog.json +2 -2
  83. package/pp-core/bin/verify-reapply-patches.cjs +0 -0
  84. package/pp-core/org-profile.json +26 -0
  85. package/pp-core/references/autonomous-best-effort.md +8 -7
  86. package/pp-core/references/loop-hook-dispatch.md +0 -25
  87. package/pp-core/references/planner-gap-closure.md +0 -1
  88. package/pp-core/references/planner-tdd.md +0 -1
  89. package/pp-core/references/planner-vault-standards.md +311 -0
  90. package/pp-core/references/planning-config.md +0 -8
  91. package/pp-core/references/tdd.md +0 -1
  92. package/pp-core/templates/README.md +1 -0
  93. package/pp-core/templates/VAULT-REVIEW.md +56 -0
  94. package/pp-core/templates/phase-prompt.md +2 -6
  95. package/pp-core/workflows/_runtime-launcher.snippet.sh +0 -0
  96. package/pp-core/workflows/add-tests.md +55 -4
  97. package/pp-core/workflows/audit-fix.md +63 -2
  98. package/pp-core/workflows/audit-milestone.md +1 -1
  99. package/pp-core/workflows/autonomous.md +85 -11
  100. package/pp-core/workflows/check-todos.md +13 -2
  101. package/pp-core/workflows/code-review-fix.md +59 -3
  102. package/pp-core/workflows/code-review.md +10 -57
  103. package/pp-core/workflows/complete-milestone.md +1 -1
  104. package/pp-core/workflows/debug.md +54 -4
  105. package/pp-core/workflows/discovery-sprint/prefill.md +19 -7
  106. package/pp-core/workflows/discovery-sprint/prototype.md +46 -49
  107. package/pp-core/workflows/discovery-sprint/session-13-gates.md +2 -0
  108. package/pp-core/workflows/discovery-sprint/sessions/01-kick-off.md +1 -3
  109. package/pp-core/workflows/discovery-sprint/sessions/02-as-is.md +1 -3
  110. package/pp-core/workflows/discovery-sprint/sessions/03-to-be.md +1 -3
  111. package/pp-core/workflows/discovery-sprint/sessions/04-ux-design.md +20 -24
  112. package/pp-core/workflows/discovery-sprint/sessions/05-architecture.md +1 -3
  113. package/pp-core/workflows/discovery-sprint/sessions/06-security.md +1 -3
  114. package/pp-core/workflows/discovery-sprint/sessions/07-identity.md +1 -3
  115. package/pp-core/workflows/discovery-sprint/sessions/08-integration.md +1 -3
  116. package/pp-core/workflows/discovery-sprint/sessions/09-qa.md +1 -3
  117. package/pp-core/workflows/discovery-sprint/sessions/10-infrastructure.md +1 -6
  118. package/pp-core/workflows/discovery-sprint/sessions/11-roadmap.md +1 -3
  119. package/pp-core/workflows/discovery-sprint/sessions/12-delivery-model.md +1 -3
  120. package/pp-core/workflows/discovery-sprint/sessions/13-wrap-up.md +1 -3
  121. package/pp-core/workflows/discovery-sprint/templates/context-template.md +1 -1
  122. package/pp-core/workflows/discovery-sprint/vault-context.md +207 -0
  123. package/pp-core/workflows/discovery-sprint.md +7 -3
  124. package/pp-core/workflows/discovery-to-build/steps/architecture-deliverables.md +4 -4
  125. package/pp-core/workflows/discovery-to-build/templates/pp-handoff.md +43 -1
  126. package/pp-core/workflows/discovery-to-build.md +10 -2
  127. package/pp-core/workflows/discuss-phase.md +3 -10
  128. package/pp-core/workflows/execute-phase/steps/check-query-gate.md +327 -0
  129. package/pp-core/workflows/execute-phase/steps/client-context-gate.md +3 -2
  130. package/pp-core/workflows/execute-phase/steps/cross-ai-delegation.md +1 -1
  131. package/pp-core/workflows/execute-phase/steps/execute-pre-dispatch.md +78 -0
  132. package/pp-core/workflows/execute-phase/steps/per-plan-worktree-gate.md +94 -0
  133. package/pp-core/workflows/execute-phase/steps/post-merge-gate.md +6 -8
  134. package/pp-core/workflows/execute-phase/steps/vault-fetch.md +115 -14
  135. package/pp-core/workflows/execute-phase/steps/vault-load-gate.md +219 -20
  136. package/pp-core/workflows/execute-phase/steps/verify-post-gate.md +147 -0
  137. package/pp-core/workflows/execute-phase.md +152 -128
  138. package/pp-core/workflows/execute-plan.md +54 -6
  139. package/pp-core/workflows/fast.md +53 -4
  140. package/pp-core/workflows/help/modes/full.md +3 -3
  141. package/pp-core/workflows/init/steps/client-context-capture.md +101 -0
  142. package/pp-core/workflows/init/steps/gitlab-provisioning.md +130 -0
  143. package/pp-core/workflows/init/steps/project-md-deferral-narration.md +66 -0
  144. package/pp-core/workflows/init/steps/reachability-outcome.md +70 -0
  145. package/pp-core/workflows/init.md +232 -272
  146. package/pp-core/workflows/new-project.md +31 -23
  147. package/pp-core/workflows/plan-phase.md +98 -45
  148. package/pp-core/workflows/quick.md +117 -3
  149. package/pp-core/workflows/secure-phase.md +1 -1
  150. package/pp-core/workflows/ship.md +57 -28
  151. package/pp-core/workflows/undo.md +1 -1
  152. package/pp-core/workflows/update.md +3 -3
  153. package/pp-core/workflows/validate-phase.md +58 -3
  154. package/pp-core/workflows/vault-review.md +161 -23
  155. package/pp-core/workflows/vault-write-back.md +73 -110
  156. package/pp-core/workflows/verify-work.md +12 -14
  157. package/scripts/changeset/cli.cjs +6 -5
  158. package/scripts/changeset/lint.cjs +0 -0
  159. package/scripts/changeset/new.cjs +33 -50
  160. package/scripts/dev-env.cjs +25 -85
  161. package/scripts/gen-capability-registry.cjs +120 -13
  162. package/scripts/lib/allowlist-ratchet.cjs +1 -103
  163. package/scripts/lint-allow-test-rule-refs.allowlist.json +0 -2
  164. package/scripts/lint-docs-required.cjs +0 -0
  165. package/scripts/lint-pr-check-project-dir.cjs +1 -3
  166. package/scripts/lint-test-file-count.allowlist.json +3 -19
  167. package/scripts/lint-test-file-count.cjs +5 -6
  168. package/scripts/prompt-injection-scan.sh +19 -17
  169. package/scripts/release-channel.cjs +0 -0
  170. package/scripts/sync-manifest-versions.cjs +5 -4
  171. package/scripts/sync-rulesets.sh +1 -1
  172. package/scripts/update-size-baseline.cjs +30 -274
  173. package/scripts/verify-opengsd-sweep.cjs +3 -5
  174. package/scripts/workflow-size.cjs +9 -61
  175. package/pp-core/bin/lib/dispatch-plan.cjs +0 -483
  176. package/pp-core/bin/lib/install-run.cjs +0 -536
  177. package/pp-core/bin/lib/loop-gates.cjs +0 -213
  178. package/pp-core/bin/lib/phase-manifest.cjs +0 -527
  179. package/pp-core/bin/lib/phase-tier.cjs +0 -480
  180. package/pp-core/bin/lib/plan-graph.cjs +0 -368
  181. package/pp-core/bin/lib/practices-review-check.cjs +0 -938
  182. package/pp-core/bin/lib/vault-audit.cjs +0 -2070
  183. package/pp-core/bin/lib/vault-practices.cjs +0 -1990
  184. package/pp-core/bin/lib/vault-review.cjs +0 -2359
  185. package/pp-core/bin/lib/vault-write-back.cjs +0 -877
  186. package/pp-core/references/executor-vault-trace.md +0 -47
  187. package/pp-core/references/planner-plan-graph.md +0 -66
  188. package/pp-core/references/planner-vault-practices.md +0 -112
  189. package/pp-core/templates/practices/README.md +0 -251
  190. package/pp-core/templates/practices/error-handling.md +0 -18
  191. package/pp-core/templates/practices/minimal-comments.md +0 -14
  192. package/pp-core/templates/practices/naming-convention.md +0 -18
  193. package/pp-core/templates/practices/practice-template.md +0 -23
  194. package/pp-core/workflows/discovery-sprint/vault-fetch.md +0 -37
  195. package/pp-core/workflows/execute-phase/steps/checkpoint-handling.md +0 -45
  196. package/pp-core/workflows/execute-phase/steps/install-run.md +0 -29
  197. package/pp-core/workflows/execute-phase/steps/phase-close-rebaseline.md +0 -23
  198. package/pp-core/workflows/execute-phase/steps/serial-group-dispatch.md +0 -73
  199. package/pp-core/workflows/execute-phase/steps/vault-door-gate.md +0 -19
  200. package/pp-core/workflows/plan-phase/steps/phase-tier.md +0 -43
  201. package/scripts/lib/size-budget.cjs +0 -311
  202. package/scripts/lint-neutrality-names.cjs +0 -694
  203. package/scripts/lint-org-coordinates.allowlist.json +0 -35
  204. package/scripts/lint-org-coordinates.cjs +0 -426
@@ -1,8 +1,8 @@
1
1
  "use strict";
2
2
  /**
3
- * src/vault-update.cts — `pp-tools vault update [<tag>] [--yes]`.
3
+ * src/vault-update.cts — `pp-tools vault update [<tag>] [--yes]` (PBI 74316).
4
4
  *
5
- * Moves a project to another version of its client vault. The
5
+ * FORK-ONLY. Moves a project to another version of its client vault. The
6
6
  * vault version is a PROJECT property: `client.vaultRef` in the committed
7
7
  * `.platform-bindings.json` is the one place it lives, so no pp-core release
8
8
  * can move it — changing it is a deliberate act, and this is its command.
@@ -15,20 +15,9 @@
15
15
  * Two steps, so the confirmation is explicit and works the same for a person
16
16
  * and for an agent shell: without `--yes` it only reports the plan
17
17
  * (current → target) and writes nothing; with `--yes` it writes
18
- * `client.vaultRef`, fetches the vault at the new version, and reports any
19
- * practice whose `schemaVersion` is newer than this pp-core supports (the
20
- * vault version a project picks implies a minimum pp-core, never the reverse).
18
+ * `client.vaultRef` and fetches the vault at the new version.
21
19
  * It never commits: the command it prints is the operator's to run.
22
20
  *
23
- * With no `<tag>` it proposes the newest stable `vX.Y.Z` tag of the configured
24
- * vault repository, listed with `git ls-remote` at the same clone target the
25
- * fetch uses (`resolveClientCoordinates` + `composeCloneTarget`). Nothing here
26
- * reads an org profile for a version: the vault version is the project's.
27
- *
28
- * Every repository coordinate it prints goes through `redactCloneTarget`, and
29
- * every value it echoes from the bindings file or the command line is
30
- * bounded to one short line.
31
- *
32
21
  * ADR-457 build-at-publish: this TypeScript file is the SOURCE OF TRUTH. It
33
22
  * compiles to the git-ignored `pp-core/bin/lib/vault-update.cjs`.
34
23
  */
@@ -48,8 +37,8 @@ const compose_bindings_cjs_1 = require("./compose-bindings.cjs");
48
37
  const git_provider_cjs_1 = require("./git-provider.cjs");
49
38
  const vault_coordinates_cjs_1 = require("./vault-coordinates.cjs");
50
39
  const platform_bindings_cjs_1 = require("./platform-bindings.cjs");
51
- // The one coordinate redactor. Cycle-free — src/vault.cts imports nothing from
52
- // this module; the lazy `require` in runFetch exists for the `_fetch` seam default.
40
+ // VAULT-EGRESS-1 (quick 261005-8py): the one coordinate redactor. Cycle-free — src/vault.cts imports
41
+ // nothing from this module; the lazy `require` in runFetch exists for the `_fetch` seam default.
53
42
  // eslint-disable-next-line @typescript-eslint/no-require-imports
54
43
  const vaultModule = require("./vault.cjs");
55
44
  const { redactCloneTarget } = vaultModule;
@@ -57,8 +46,6 @@ const { redactCloneTarget } = vaultModule;
57
46
  /** How many tags a report lists — enough to pick from, bounded for a long history. */
58
47
  exports.AVAILABLE_TAGS_CAP = 10;
59
48
  const BINDINGS_FILE = '.platform-bindings.json';
60
- /** Matches the degrade warning `parsePracticeFile` emits for a newer schemaVersion. */
61
- const NEWER_SCHEMA_WARNING_RE = /schemaVersion \d+ is newer than this pp-core supports/;
62
49
  // ─── Helpers ─────────────────────────────────────────────────────────────────
63
50
  function isObject(v) {
64
51
  return v !== null && typeof v === 'object' && !Array.isArray(v);
@@ -66,11 +53,6 @@ function isObject(v) {
66
53
  function usableString(v) {
67
54
  return typeof v === 'string' && v.trim() !== '' ? v.trim() : null;
68
55
  }
69
- /** A value from the bindings file or the command line, made safe to print: one line, at most 80 characters. */
70
- function shown(v) {
71
- const flat = v.replace(/[\u0000-\u001F\u007F]+/g, ' ').trim();
72
- return flat.length > 80 ? `${flat.slice(0, 80)}…` : flat;
73
- }
74
56
  function resolveRoot(cwd) {
75
57
  try {
76
58
  return (0, project_root_cjs_1.findProjectRoot)(cwd) || cwd;
@@ -103,21 +85,9 @@ function runFetch(root, opts) {
103
85
  return {
104
86
  source: typeof manifest.source === 'string' ? manifest.source : 'unknown',
105
87
  ref: typeof manifest.ref === 'string' ? manifest.ref : null,
106
- tier: typeof manifest.tier === 'string' ? manifest.tier : null,
107
88
  warnings,
108
89
  };
109
90
  }
110
- function findNewerSchemaPractices(root, opts) {
111
- // eslint-disable-next-line @typescript-eslint/no-require-imports
112
- const discover = opts._discover ?? require('./vault-practices.cjs').discoverPracticeFiles;
113
- const discovery = discover(root);
114
- const ids = [];
115
- for (const entry of discovery.degraded ?? []) {
116
- if (entry.warnings.some((w) => NEWER_SCHEMA_WARNING_RE.test(w)) && !ids.includes(entry.id))
117
- ids.push(entry.id);
118
- }
119
- return ids;
120
- }
121
91
  // ─── vaultUpdate ─────────────────────────────────────────────────────────────
122
92
  /**
123
93
  * Plan — and with `apply` perform — a move of the project's client vault to
@@ -141,7 +111,6 @@ function vaultUpdate(cwd, opts = {}) {
141
111
  latest: null,
142
112
  available: [],
143
113
  fetch: null,
144
- newerSchemaPractices: [],
145
114
  nextStep: null,
146
115
  };
147
116
  const fail = (reason, message) => ({
@@ -173,8 +142,7 @@ function vaultUpdate(cwd, opts = {}) {
173
142
  let tags;
174
143
  try {
175
144
  const provider = (0, git_provider_cjs_1.resolveProvider)(root).provider;
176
- // The same host chain the fetch uses (client.vaultHost, platform host, provider default).
177
- const host = (0, vault_coordinates_cjs_1.resolveClientCoordinates)(root, provider).host;
145
+ const host = usableString(client.vaultHost) ?? (0, vault_coordinates_cjs_1.resolvePlatformHost)(root).host ?? (0, vault_coordinates_cjs_1.defaultHostForProvider)(provider);
178
146
  const target = (0, git_provider_cjs_1.composeCloneTarget)(provider, repo, host);
179
147
  tags = (0, compose_bindings_cjs_1.listStableTagsAt)(target.url, { _lsRemote: opts._lsRemote });
180
148
  }
@@ -190,10 +158,10 @@ function vaultUpdate(cwd, opts = {}) {
190
158
  const requested = usableString(opts.target);
191
159
  const to = requested ? matchRequestedTag(requested, tags) : tags[0];
192
160
  if (!to) {
193
- return fail('unknown_tag', `The vault repo has no tag "${shown(requested ?? "")}". Available (newest first): ${result.available.join(', ')}.`);
161
+ return fail('unknown_tag', `The vault repo has no tag "${requested}". Available (newest first): ${result.available.join(', ')}.`);
194
162
  }
195
163
  result.to = to;
196
- const fromLabel = result.from === null ? 'main (unpinned)' : shown(result.from);
164
+ const fromLabel = result.from ?? 'main (unpinned)';
197
165
  if (result.from === to) {
198
166
  return { ...result, ok: true, message: `The project is already on vault ${to}.` };
199
167
  }
@@ -227,13 +195,7 @@ function vaultUpdate(cwd, opts = {}) {
227
195
  applied.fetch = runFetch(root, opts);
228
196
  }
229
197
  catch {
230
- applied.fetch = { source: 'error', ref: null, tier: null, warnings: ['The vault could not be fetched at the new version — run "pp-tools vault fetch" to retry.'] };
231
- }
232
- try {
233
- applied.newerSchemaPractices = findNewerSchemaPractices(root, opts);
234
- }
235
- catch {
236
- applied.newerSchemaPractices = [];
198
+ applied.fetch = { source: 'error', ref: null, warnings: ['The vault could not be fetched at the new version — run "pp-tools vault fetch" to retry.'] };
237
199
  }
238
200
  return applied;
239
201
  }
@@ -244,21 +206,10 @@ function renderVaultUpdate(r) {
244
206
  lines.push(`Newest available: ${r.latest}.`);
245
207
  }
246
208
  if (r.fetch) {
247
- if (r.fetch.tier !== null && r.fetch.tier !== 'client' && r.fetch.source !== 'error') {
248
- // A fallback-tier fetch is not the client vault at the new version, and
249
- // must not read as if it were.
250
- lines.push(`The client vault at ${r.to ?? 'the new version'} was NOT loaded: the fetch fell back to the ${r.fetch.tier} tier` +
251
- `${r.fetch.ref ? ` at ${r.fetch.ref}` : ''}. Check access to the client vault, then run "pp-tools vault fetch".`);
252
- }
253
- else {
254
- lines.push(`Fetched the vault: ${r.fetch.source}${r.fetch.ref ? ` at ${r.fetch.ref}` : ''}.`);
255
- }
209
+ lines.push(`Fetched the vault: ${r.fetch.source}${r.fetch.ref ? ` at ${r.fetch.ref}` : ''}.`);
256
210
  for (const w of r.fetch.warnings)
257
211
  lines.push(w);
258
212
  }
259
- if (r.newerSchemaPractices.length > 0) {
260
- lines.push(`${r.newerSchemaPractices.length} practice(s) in this vault version were written for a newer pp-core and apply only in degraded form: ${r.newerSchemaPractices.join(', ')}. Update pp-core to apply them fully.`);
261
- }
262
213
  if (r.nextStep) {
263
214
  lines.push(r.applied ? `Commit the change: ${r.nextStep}` : `To apply: ${r.nextStep}`);
264
215
  }