@prismer/runtime 2.2.55 → 2.2.64

package/built-in-skills/competitor-intelligence/scripts/watch_state.py

@@ -0,0 +1,160 @@
+#!/usr/bin/env python3
+"""Task-bound competitor watch checkpoint; no scheduler or network side effects."""
+import argparse
+import copy
+import json
+import os
+from pathlib import Path
+import sys
+import tempfile
+from datetime import datetime
+from urllib.parse import urlsplit
+
+
+def initial(workspace, task, sources):
+    if not workspace or not task or not sources or any(not isinstance(s, str) or not s for s in sources):
+        raise ValueError("workspace, task and source IDs are required")
+    return {"version": 1, "workspace": workspace, "task": task, "revision": 0,
+            "sources": {source: {"cursor": None, "error": None} for source in sources}, "events": {}}
+
+
+def check_identity(state, workspace, task):
+    if state.get("version") != 1 or (state.get("workspace"), state.get("task")) != (workspace, task):
+        raise ValueError("checkpoint belongs to another workspace/task or schema")
+
+
+def collect(state, results, events):
+    state = copy.deepcopy(state)
+    successful = set()
+    seen = set()
+    for result in results:
+        source = result["source"]
+        if source in seen:
+            raise ValueError("duplicate source result; aggregate all pages before collecting")
+        seen.add(source)
+        if source not in state["sources"]:
+            raise ValueError("unknown source: " + source)
+        previous = state["sources"][source]
+        if result.get("ok") is True:
+            cursor = result["cursor"]
+            instant = datetime.fromisoformat(cursor.replace("Z", "+00:00"))
+            if instant.tzinfo is None:
+                raise ValueError("cursor requires timezone")
+            if previous["cursor"] and instant < datetime.fromisoformat(previous["cursor"].replace("Z", "+00:00")):
+                raise ValueError("source cursor cannot move backwards")
+            previous.update(cursor=cursor, error=None)
+            successful.add(source)
+        else:
+            previous["error"] = str(result.get("error") or "unknown coverage")
+    for event in events:
+        event_id = event.get("id")
+        if not isinstance(event_id, str) or not event_id or not event.get("summary"):
+            raise ValueError("event requires stable underlying-event ID and summary")
+        if event_id in state["events"]:
+            continue
+        if event.get("source") not in successful:
+            raise ValueError("new event requires a successful source result")
+        url = urlsplit(event.get("url", ""))
+        if url.scheme not in {"http", "https"} or not url.hostname or url.username or url.password:
+            raise ValueError("event requires an evidence URL without credentials")
+        state["events"][event_id] = {**event, "delivery": "new", "receipt": None}
+    return state
+
+
+def prepare(state, ids):
+    state = copy.deepcopy(state)
+    if not ids or len(set(ids)) != len(ids):
+        raise ValueError("unique event IDs required")
+    for event_id in ids:
+        event = state["events"][event_id]
+        if event["delivery"] != "new":
+            raise ValueError("already pending/delivered; reconcile receipt before retry")
+        event["delivery"] = "pending"
+    return state
+
+
+def ack(state, ids, receipt):
+    state = copy.deepcopy(state)
+    if not isinstance(receipt, str) or not receipt.strip() or not ids:
+        raise ValueError("actual delivery receipt and event IDs required")
+    for event_id in ids:
+        event = state["events"][event_id]
+        if event["delivery"] == "delivered" and event["receipt"] == receipt:
+            continue
+        if event["delivery"] != "pending":
+            raise ValueError("event is not pending this delivery")
+        event.update(delivery="delivered", receipt=receipt)
+    return state
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--state", required=True, type=Path)
+    parser.add_argument("--workspace", required=True)
+    parser.add_argument("--task", required=True)
+    parser.add_argument("--expected-revision", type=int)
+    sub = parser.add_subparsers(dest="action", required=True)
+    init = sub.add_parser("init")
+    init.add_argument("--source", action="append", required=True)
+    sub.add_parser("show")
+    tick = sub.add_parser("collect")
+    tick.add_argument("--input", type=Path, required=True)
+    sending = sub.add_parser("prepare")
+    sending.add_argument("ids", nargs="+")
+    sent = sub.add_parser("ack")
+    sent.add_argument("ids", nargs="+")
+    sent.add_argument("--receipt", required=True)
+    args = parser.parse_args()
+    path = args.state
+    if not path.is_absolute():
+        parser.error("--state must be an absolute task-specific path")
+    path.parent.mkdir(parents=True, exist_ok=True)
+    lock = path.with_suffix(path.suffix + ".lock")
+    fd = None
+    temporary = None
+    try:
+        fd = os.open(lock, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
+        if args.action == "init":
+            if path.exists():
+                raise ValueError("state already exists; restore/read it instead of resetting")
+            state = initial(args.workspace, args.task, args.source)
+        else:
+            state = json.loads(path.read_text(encoding="utf-8"))
+            check_identity(state, args.workspace, args.task)
+            if args.action != "show" and args.expected_revision != state["revision"]:
+                raise ValueError("expected-revision missing or stale; reload latest task checkpoint")
+            if args.action == "collect":
+                data = json.loads(args.input.read_text(encoding="utf-8"))
+                state = collect(state, data["sources"], data.get("events", []))
+            elif args.action == "prepare":
+                state = prepare(state, args.ids)
+            elif args.action == "ack":
+                state = ack(state, args.ids, args.receipt)
+        if args.action != "show":
+            state["revision"] += 1
+            with tempfile.NamedTemporaryFile(mode="w", encoding="utf-8", dir=path.parent, delete=False) as handle:
+                temporary = Path(handle.name)
+                json.dump(state, handle, ensure_ascii=False, indent=2)
+                handle.flush()
+                os.fsync(handle.fileno())
+            os.replace(temporary, path)
+        print(json.dumps(state, ensure_ascii=False, indent=2))
+        return 0
+    except (OSError, ValueError, KeyError, TypeError) as exc:
+        print(f"watch checkpoint failed: {exc}", file=sys.stderr)
+        return 1
+    finally:
+        if temporary:
+            temporary.unlink(missing_ok=True)
+        if fd is not None:
+            try:
+                own = os.fstat(fd)
+                current = lock.stat(follow_symlinks=False)
+                if (own.st_dev, own.st_ino) == (current.st_dev, current.st_ino):
+                    lock.unlink()
+            finally:
+                os.close(fd)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/built-in-skills/conversation-compaction/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: conversation-compaction
 scope: common
+metadata:
+  internal: true
+  excludeFromDefaultInstall: true
 description: Produce the SESSION PROJECTION of memory for an aging conversation slice. Runs as a single background model call (mirroring the memory `extract` hook) with NO live memory tools — durable capture to memory is `extract`'s job. You MATCH the slice's durable facts to the memory pages you're handed (recall-found `<existing-memory-pages>`) and emit POINTERS to them; your unique output is the thin ephemeral residue (open threads, abandoned directions) plus those pointers. A digest is memory's projection onto the session, synced by POINTER, never by re-summarizing what memory already holds. Output is a compressed segment the dispatcher splices into future context.
 ---
 

package/built-in-skills/council-creator/SKILL.md

@@ -142,10 +142,11 @@ assets** (use your ingest/asset skills first — a path on disk is not an asset)
 and `brief.facts[].text` must carry grounded facts. Neither can be faked past
 the gate.
 
-## convene — `prismer council convene --plan <planId>`
+## Convene receipt (Team Manager UI only)
 
-Cast defaults to the plan's cast; pass `--file` with `{ cast }` only when the Team Manager
-edited the roster in the proposal. The cloud then, on your behalf:
+This is not an agent command. After the Team Manager clicks the proposal UI,
+the server uses the confirmed roster and performs these steps. Wait for its
+receipt; never call an internal endpoint to bypass the UI confirmation:
 
 1. Creates the group shell (real members: Team Manager + you + optional extras);
    `conversation.metadata.council = { sessionId, planId, question, agenda,

package/built-in-skills/diagnosing-bugs/SKILL.md

@@ -1,12 +1,24 @@
 ---
 name: diagnosing-bugs
 scope: coding
+metadata:
+  nativeReplaces: [systematic-debugging, inspecting-hermes-desktop-dom]
 source: https://github.com/mattpocock/skills (MIT, © 2026 Matt Pocock)
 description: Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.
 ---
 
 # Diagnosing Bugs
 
+For cross-component tracing and hypothesis testing, consult
+references/systematic-debugging/GUIDE.md. Its supporting files are relative to
+that directory. Use tools actually exposed by this Runtime; upstream repository
+paths and named subagents are not installed capabilities. Diagnose, reproduce,
+fix the cause, and rerun the reproducer before claiming success.
+
+For Electron DOM/CSS or stale-renderer diagnosis, read
+references/desktop-dom/GUIDE.md. Match the actual app/build/PID and use an
+authorized loopback target; never relaunch the user's app to obtain CDP.
+
 A discipline for hard bugs. Skip phases only when explicitly justified.
 
 When exploring the codebase, read `CONTEXT.md` (if it exists) to get a clear mental model of the relevant modules, and check ADRs in the area you're touching.

package/built-in-skills/diagnosing-bugs/references/desktop-dom/GUIDE.md

@@ -0,0 +1,64 @@
+# Desktop DOM and CSS Diagnosis
+
+Adapted from Hermes inspecting-hermes-desktop-dom; this is a supporting method,
+not an independent Hermes launch protocol.
+
+## Target and permissions
+
+Inspect the repository's actual Electron harness and startup configuration.
+Prismer uses apps/desktop with a prebuilt Vite WorkspaceShell. A web HMR update
+does not establish that the desktop renderer was rebuilt. Confirm the running
+build, PID, renderer URL and user-data directory before diagnosing stale UI.
+Do not assume Hermes dev-cdp.ts, eval.mjs, cdp.mjs, HERMES_DESKTOP_* or port 9222
+exist in Prismer. These helpers are not bundled here.
+
+Use the browser/CDP tool already exposed by the host, or an installed Playwright
+client connected to a user-authorized loopback CDP endpoint. List /json/version
+and /json/list for that exact port; match the renderer URL/title and PID. A port
+list is not permission to inspect another window. Never bind CDP publicly.
+If no endpoint is available, use the project's real harness in a new isolated
+instance with its own task-owned user-data directory and ports. Do not restart,
+kill or relaunch the user's app. Report blocked if an isolated harness is absent.
+
+## Read the rendered state
+
+First inspect a screenshot at the target viewport. Then query a narrow selector
+from actual DOM evidence. With an existing Playwright Page named page:
+
+```javascript
+const facts = await page.locator(selector).evaluate(el => ({
+  tag: el.tagName,
+  classes: el.className,
+  rect: el.getBoundingClientRect().toJSON(),
+  display: getComputedStyle(el).display,
+  padding: getComputedStyle(el).padding,
+  fontWeight: getComputedStyle(el).fontWeight,
+  parents: (() => {
+    const rows = [];
+    let node = el.parentElement;
+    while (node && rows.length < 6) {
+      rows.push({tag: node.tagName, classes: node.className});
+      node = node.parentElement;
+    }
+    return rows;
+  })()
+}));
+```
+
+Use the matching rule inspector for stylesheet origin/specificity. Inheritance,
+plugin styles and state selectors can override local utility classes; do not
+edit every call site before identifying the winning rule. Re-read computed style,
+geometry and screenshot after the change. Check mobile/desktop dimensions,
+keyboard focus, console and network failures. DOM facts do not replace visual QA.
+
+## Evidence and cleanup
+
+Record target identity, build, viewport, selector, expected/actual properties,
+the winning rule, screenshot and console errors. Avoid entire DOM dumps or
+session content containing secrets. A DevTools marker alone is not a paused
+exception: collect the stack and source map for runtime faults.
+
+Poll readiness with a bounded timeout. End only the test processes you started,
+detach without leaving the target paused, and preserve task-bound evidence.
+Never infer a broken port from an isolated app exiting due to missing backend
+configuration. No actual Electron/CDP live acceptance is implied by this guide.

package/built-in-skills/diagnosing-bugs/references/desktop-dom/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Nous Research
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/built-in-skills/diagnosing-bugs/references/desktop-dom/NOTICE.md

@@ -0,0 +1,17 @@
+# Resource provenance
+
+## Engineering adaptation (2026-09-23)
+
+Source: https://github.com/NousResearch/hermes-agent/tree/1a1f4a59e252e1dc0137e7b2e7bcc8b0381d19c4/skills/software-development/inspecting-hermes-desktop-dom
+
+Upstream authors: Hermes Agent.
+Hermes MIT copyright (c) 2025 Nous Research is preserved in LICENSE.
+All bundled references/templates/scripts remain covered by that notice unless
+an additional license is explicitly supplied. External CLI binaries, services,
+accounts and downloaded assets are not redistributed by this skill and retain
+their own terms. No API keys or third-party runtime packages are bundled.
+
+Prismer modifications: unique discovery/ownership mapping where applicable,
+resource-path and authorization corrections, bounded helpers, honest readiness
+and verification states. See docs/bugfix223/implementation-engineering.md in the
+source repository for resource mapping, tests and remaining live acceptance.