@pareto4/pp-core 1.8.2 → 1.10.0

package/pp-core/bin/lib/profile-output.cjs

@@ -441,8 +441,10 @@ function generateSkillsSection(cwd) {
         for (const entry of entries) {
             if (!entry.isDirectory())
                 continue;
-            // Skip GSD's own installed skills — only surface project-specific skills
-            if (entry.name.startsWith('gsd-'))
+            // Skip pp-core's own installed skills (current 'pp-' naming plus legacy
+            // 'gsd-' directories, backward compatibility retained) — only surface
+            // project-specific skills.
+            if (entry.name.startsWith('pp-') || entry.name.startsWith('gsd-'))
                 continue;
             const skillMdPath = node_path_1.default.join(absDir, entry.name, 'SKILL.md');
             if (!node_fs_1.default.existsSync(skillMdPath))

package/pp-core/bin/lib/vault-command-router.cjs

@@ -29,11 +29,12 @@
  */
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const io = require("./io.cjs");
+const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 const { ERROR_REASON } = io;
 // Default CoreModule implementation. _core seam overrides this for test injection.
 const _defaultCore = { output: io.output };
 // ─── Implementation ───────────────────────────────────────────────────────────
-function routeVaultCommand({ args, cwd, raw, error, _vault, _core }) {
+function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _exec, _writeBack }) {
     // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
     const vault = _vault ?? require('./vault.cjs');
     const c = _core ?? _defaultCore;
@@ -47,8 +48,113 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core }) {
     else if (subcommand === 'summary') {
         c.output(vault.vaultSummary(cwd), raw);
     }
+    else if (subcommand === 'practices') {
+        const verb = args[2];
+        if (verb === 'match') {
+            // T-24-08b: reject any unrecognized `--`-prefixed argument BEFORE the
+            // `--changed` git call (so a typo never spawns a subprocess) instead
+            // of silently filtering it out of the positional file list. Matched on
+            // the WHOLE token so `--files=…` is caught by the same check as
+            // `--files value`. DECISION (recorded, not deferred): `--files=` is
+            // NOT implemented as a comma-splitting alias here, unlike
+            // `/pp-code-review`'s `--files=a,b` (pp-core/workflows/code-review.md).
+            // The auditor marked the alias "optional and secondary"; the required
+            // behavior is loud failure, and the error message below names the
+            // supported forms instead. The host (pp-core/bin/pp-tools.cjs) already
+            // splices out its own global flags (--json-errors/--cwd/--ws/--raw/
+            // --pick/--default) before dispatch, which is why the recognized set
+            // here is only two flags wide.
+            const RECOGNIZED_MATCH_FLAGS = new Set(['--changed', '--raw', '--block']);
+            const unrecognizedFlag = args.slice(3).find((a) => a.startsWith('--') && !RECOGNIZED_MATCH_FLAGS.has(a));
+            if (unrecognizedFlag !== undefined) {
+                error(`Unrecognized flag "${unrecognizedFlag}" for vault practices match. Supported: positional file paths, --changed, --raw, or --block.`, ERROR_REASON.SDK_FAIL_FAST);
+                return;
+            }
+            // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+            const practices = _practices ?? require('./vault-practices.cjs');
+            const runGit = _exec ?? shell_command_projection_cjs_1.execGit;
+            let files;
+            if (args.includes('--changed')) {
+                const gitResult = runGit(['diff', '--name-only', 'HEAD'], { cwd });
+                if (gitResult.exitCode !== 0) {
+                    error('Could not determine changed files: git diff failed (WR-02)', ERROR_REASON.SDK_FAIL_FAST);
+                    return;
+                }
+                files = gitResult.stdout.split('\n').map((f) => f.trim()).filter((f) => f.length > 0);
+            }
+            else {
+                files = args.slice(3).filter((a) => !a.startsWith('--'));
+            }
+            const result = practices.matchPractices({ cwd, files });
+            if (args.includes('--block')) {
+                // T-25-08: emit the finished <vault_practices> block so the planner
+                // embeds it VERBATIM. The planner never renames a field or applies a
+                // fence itself — that transformation used to be prose-only, which is
+                // what left the phase's prompt-injection mitigation unenforced.
+                c.output(result, true, practices.renderPracticesBlock(result));
+            }
+            else if (raw) {
+                c.output(result, true, JSON.stringify(result));
+            }
+            else {
+                c.output(result, true, practices.renderPracticesReport(result));
+            }
+        }
+        else if (verb === 'promote') {
+            // T-29-16: reject any unrecognized `--`-prefixed argument BEFORE the
+            // lazy require of the write-back module and before any subprocess can
+            // spawn — mirrors the `match` branch's T-24-08b guard exactly. Matched
+            // on the WHOLE token so `--name=value` is caught by the same check as
+            // `--name value`. The recognized set holds exactly three flags — no
+            // flag that disables, bypasses, or relaxes any guard exists.
+            const RECOGNIZED_PROMOTE_FLAGS = new Set(['--confirmed', '--expect', '--raw']);
+            const promoteArgs = args.slice(3);
+            const unrecognizedPromoteFlag = promoteArgs.find((a) => a.startsWith('--') && !RECOGNIZED_PROMOTE_FLAGS.has(a));
+            if (unrecognizedPromoteFlag !== undefined) {
+                error(`Unrecognized flag "${unrecognizedPromoteFlag}" for vault practices promote. Supported: --confirmed, --expect <token>, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+                return;
+            }
+            // Positional file path: the first token that is not `--`-prefixed and
+            // is not the value immediately following `--expect`.
+            const expectFlagIdx = promoteArgs.indexOf('--expect');
+            const expectValueIdx = expectFlagIdx !== -1 ? expectFlagIdx + 1 : -1;
+            const filePath = promoteArgs.find((a, i) => !a.startsWith('--') && i !== expectValueIdx);
+            if (filePath === undefined) {
+                error('No practice file was given. Usage: vault practices promote <file> [--confirmed --expect <token>] [--raw].', ERROR_REASON.SDK_MISSING_ARG);
+                return;
+            }
+            const confirmed = promoteArgs.includes('--confirmed');
+            const expect = expectValueIdx !== -1 ? promoteArgs[expectValueIdx] : undefined;
+            if (confirmed && (expect === undefined || expect.startsWith('--'))) {
+                error('This practice was not pushed: the confirmation is missing the preview token it needs. ' +
+                    'Run the promotion without confirming first, then pass the token it prints.', ERROR_REASON.VAULT_PROMOTE_CONCURRENT_EDIT);
+                return;
+            }
+            // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+            const writeBack = _writeBack ?? require('./vault-write-back.cjs');
+            const verdict = writeBack.promotePractice({ cwd, filePath, confirmed, expect });
+            // Emit the structured verdict BEFORE any error call — a refusal still
+            // carries its verdict to stdout. This ordering is the whole point of
+            // the uniform D-16 refusal contract and is what lets a wrapper
+            // workflow render results without scraping prose.
+            if (raw) {
+                c.output(verdict, true, JSON.stringify(verdict));
+            }
+            else {
+                c.output(verdict, true, writeBack.renderPromoteReport(verdict));
+            }
+            if (verdict.status === 'refused') {
+                // An action command's refusal must be observable in the exit code —
+                // do not adopt the ship gate's always-exit-zero convention here.
+                error(verdict.message ?? 'This practice was not promoted.', verdict.reason ?? ERROR_REASON.UNKNOWN);
+            }
+        }
+        else {
+            error('Unknown practices subcommand. Available: match, promote', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+        }
+    }
     else {
-        error('Unknown vault subcommand. Available: fetch, status, summary', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+        error('Unknown vault subcommand. Available: fetch, status, summary, practices', ERROR_REASON.SDK_UNKNOWN_COMMAND);
     }
 }
 module.exports = {