@stravica-ai/digital-operator-pa 0.1.42 → 0.1.44

package/dist/engineering-pa-cli/src/pa/cli.mjs

@@ -360,9 +360,11 @@ Usage:
 Bind host defaults to loopback (127.0.0.1). Use --host <addr> (or the
 WORKSPACE_HOST env var) to expose the workspace on another interface.
 
-When the workspace is supervised by launchd (~/Library/LaunchAgents/com.dave.workspace.plist)
-or systemd (~/.config/systemd/user/dave-workspace.service), \`stop\` is refused and \`restart\`
+When the workspace is supervised by launchd (~/Library/LaunchAgents/com.<paName>.workspace.plist)
+or systemd (~/.config/systemd/user/<paName>-workspace.service), \`stop\` is refused and \`restart\`
 delegates to the supervisor — this is the in-place version-pickup path after \`pnpm update\`.
+Unit labels are derived from operator/config/preferences.json:paName; the legacy
+com.dave.workspace / dave-workspace.service is still recognised for pre-0.1.44 installs.
 
 Exit codes (tooling standard §6):
   0 ok | 1 usage error | 2 operational failure | 3 transport/IO failure

package/dist/engineering-pa-core/knowledge/platform-tooling/workspace-server.md

@@ -33,7 +33,7 @@ The workspace server hosts `viewer.html` — the PA's canonical surface for long
 
 ## Supervisor-aware lifecycle
 
-When the workspace is supervised by launchd (`~/Library/LaunchAgents/com.dave.workspace.plist`) or systemd (`~/.config/systemd/user/dave-workspace.service`), `stop` is refused and `restart` delegates to the supervisor. This is the in-place version-pickup path after `pnpm update @stravica-ai/digital-operator-pa`.
+When the workspace is supervised by launchd (`~/Library/LaunchAgents/com.<paName>.workspace.plist`) or systemd (`~/.config/systemd/user/<paName>-workspace.service`), `stop` is refused and `restart` delegates to the supervisor. This is the in-place version-pickup path after `pnpm update @stravica-ai/digital-operator-pa`. Unit labels follow the scheduler's `com.{agent}.{id}` convention with `id = workspace` and `agent` resolved from `paName` in `operator/config/preferences.json`; pre-0.1.44 installs are still recognised under the legacy `com.dave.workspace` / `dave-workspace.service` name until you run `install-daemon install --migrate` to rename.
 
 ## When to use the workspace
 

package/dist/engineering-pa-core-extensions-atlassian/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stravica-ai/engineering-pa-core-extensions-atlassian",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Atlassian (Jira, Confluence, confluence-fetch) CLIs and library surface. Promoted into core for the alpha solo scaffold.",
   "type": "module",
   "main": "./index.mjs",

package/dist/engineering-pa-core-extensions-atlassian/src/confluence/client.mjs

@@ -9,6 +9,7 @@
 // Zero external dependencies - uses Node.js built-in fetch() and child_process.
 
 import { loadAtlassianCredentials } from '../common/secrets.mjs';
+import { readBody, formatHttpError } from '../jira/client.mjs';
 
 // ---- Exit-code-aware error ----------------------------------------------
 
@@ -145,33 +146,12 @@ export function createClient(options = {}) {
       // Parse response
       let data = null;
       if (res.status !== 204) {
-        const contentType = res.headers.get('Content-Type') || '';
-        if (contentType.includes('application/json')) {
-          data = await res.json();
-        } else {
-          const text = await res.text();
-          if (text) data = text;
-        }
+        data = await readBody(res);
       }
 
       // 4xx errors
       if (res.status >= 400) {
-        const msgs = [];
-        if (data && data.errorMessages) msgs.push(...data.errorMessages);
-        if (data && data.errors) {
-          if (Array.isArray(data.errors)) {
-            for (const e of data.errors) {
-              msgs.push(e.title || e.message || JSON.stringify(e));
-            }
-          } else {
-            for (const [field, msg] of Object.entries(data.errors)) {
-              msgs.push(`${field}: ${msg}`);
-            }
-          }
-        }
-        if (data && data.message) msgs.push(data.message);
-        const detail = msgs.length > 0 ? msgs.join('; ') : `HTTP ${res.status}`;
-        throw new ConfluenceError(`Confluence API error (${res.status}): ${detail}`, 2);
+        throw new ConfluenceError(formatHttpError('Confluence', res.status, data), 2);
       }
 
       return { status: res.status, data, headers: res.headers };

package/dist/engineering-pa-core-extensions-atlassian/src/jira/client.mjs

@@ -17,6 +17,71 @@ export class JiraError extends Error {
   }
 }
 
+// ---- Shared response parsing --------------------------------------------
+
+/**
+ * Read a fetch Response body without ever throwing on a bad body.
+ *
+ * Atlassian sometimes returns a non-JSON body (bare text, an HTML error
+ * page from Cloudflare, a proxy edge string) with a `Content-Type` that
+ * still says `application/json`, and a raw `res.json()` on that body throws
+ * `SyntaxError: Unexpected token 'C', "Client mus"... is not valid JSON`,
+ * which surfaces as an unhandled stack trace instead of an
+ * "authentication failed" message. Falls back to raw text on any parse
+ * failure and returns null for empty bodies.
+ *
+ * @param {Response} res
+ * @returns {Promise<any|string|null>}
+ */
+export async function readBody(res) {
+  const contentType = res.headers.get('Content-Type') || '';
+  const wantsJson = contentType.includes('application/json');
+  const raw = await res.text();
+  if (!raw) return null;
+  if (wantsJson) {
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return raw.trim();
+    }
+  }
+  return raw.trim();
+}
+
+/**
+ * Turn a parsed error body into a one-line, colleague-facing HTTP
+ * error message. `data` may be a parsed JSON object (Atlassian error
+ * shape), a plain string (non-JSON body), or null.
+ *
+ * @param {string} product   "Jira" or "Confluence"
+ * @param {number} status    HTTP status
+ * @param {any} data         Parsed body, string, or null
+ * @returns {string}
+ */
+export function formatHttpError(product, status, data) {
+  const parts = [];
+  if (data && typeof data === 'object') {
+    if (Array.isArray(data.errorMessages)) parts.push(...data.errorMessages);
+    if (data.errors) {
+      if (Array.isArray(data.errors)) {
+        for (const e of data.errors) {
+          parts.push(e.title || e.message || JSON.stringify(e));
+        }
+      } else if (typeof data.errors === 'object') {
+        for (const [field, msg] of Object.entries(data.errors)) {
+          parts.push(`${field}: ${msg}`);
+        }
+      }
+    }
+    if (data.message && parts.length === 0) parts.push(data.message);
+  } else if (typeof data === 'string' && data.length > 0) {
+    const trimmed = data.length > 120 ? `${data.slice(0, 120)}...` : data;
+    parts.push(trimmed);
+  }
+  const detail = parts.length > 0 ? parts.join('; ') : `HTTP ${status}`;
+  return `${product} API error (${status}): ${detail}`;
+}
+
 // ---- Credential loading -------------------------------------------------
 
 /**
@@ -142,26 +207,12 @@ export function createClient(options = {}) {
       // Parse response
       let data = null;
       if (res.status !== 204) {
-        const contentType = res.headers.get('Content-Type') || '';
-        if (contentType.includes('application/json')) {
-          data = await res.json();
-        } else {
-          const text = await res.text();
-          if (text) data = text;
-        }
+        data = await readBody(res);
       }
 
       // 4xx errors
       if (res.status >= 400) {
-        const msgs = [];
-        if (data && data.errorMessages) msgs.push(...data.errorMessages);
-        if (data && data.errors) {
-          for (const [field, msg] of Object.entries(data.errors)) {
-            msgs.push(`${field}: ${msg}`);
-          }
-        }
-        const detail = msgs.length > 0 ? msgs.join('; ') : `HTTP ${res.status}`;
-        throw new JiraError(`Jira API error (${res.status}): ${detail}`, 2);
+        throw new JiraError(formatHttpError('Jira', res.status, data), 2);
       }
 
       return { status: res.status, data, headers: res.headers };
@@ -309,19 +360,11 @@ export function createClient(options = {}) {
 
       let data = null;
       if (res.status !== 204) {
-        const contentType = res.headers.get('Content-Type') || '';
-        if (contentType.includes('application/json')) data = await res.json();
-        else { const text = await res.text(); if (text) data = text; }
+        data = await readBody(res);
       }
 
       if (res.status >= 400) {
-        const msgs = [];
-        if (data && data.errorMessages) msgs.push(...data.errorMessages);
-        if (data && data.errors) {
-          for (const [field, msg] of Object.entries(data.errors)) msgs.push(`${field}: ${msg}`);
-        }
-        const detail = msgs.length > 0 ? msgs.join('; ') : `HTTP ${res.status}`;
-        throw new JiraError(`Jira API error (${res.status}): ${detail}`, 2);
+        throw new JiraError(formatHttpError('Jira', res.status, data), 2);
       }
 
       return { status: res.status, data, headers: res.headers };

package/dist/engineering-pa-library-cli/README.md

@@ -27,6 +27,31 @@ deliberately not a shim for the pre-remote library sweep.
 - `library status [--json]`
   GETs `/status` from the service, plus `git rev-list HEAD..origin/main --count`
   per tier clone.
+- `library up-merge [--repo <owner/name>]... [--pr <number>] [--dry-run] [--once] [--verbose] [--json]`
+  Scheduled auto-merger for library up-path PRs. Scans configured library
+  repos for open PRs from branch `library-sync-up/<device>` and merges each
+  one whose diff is confined to the paths `<device>` owns per
+  `operator/registry/repos.json`. Anything else is a refusal: the PR is
+  left open with a one-time comment (idempotent via an HTML marker) and no
+  merge is ever attempted. Writes one JSONL line per PR per pass to
+  `library.upMerge.eventsLog` (default `.cache/library-up-merger/events.jsonl`).
+  Runs the same in SIMPLE and REMOTE mode (GitHub-side maintenance verb,
+  no ingest touch). Config in the `library.upMerge` stanza; see below.
+
+### Scope rule (verbatim)
+
+```
+A PR is eligible when both:
+  (1) its head branch matches "library-sync-up/<device>"
+  (2) every changed file's repo-relative path falls under a path <device>
+      owns for that library repo per operator/registry/repos.json:
+        for each mount M where M.upPath === true and M.upPathOwner === <device>:
+          allowed prefix = M.from + include, for each include in M.upPathInclude
+        a file matches when its path equals a prefix (single-file include)
+        or starts with prefix + "/" (directory include).
+Any file outside the device's allowed prefixes is a refusal - the PR is
+left open, a one-time comment is posted, and no merge is ever attempted.
+```
 
 ## Configuration
 
@@ -45,6 +70,40 @@ deliberately not a shim for the pre-remote library sweep.
 
 - `LIBRARY_PULL_CLONES_ROOT` env — overrides the pull-clones root at runtime.
 
+- `library.upMerge` stanza in preferences (used by `library up-merge` only):
+
+  ```json
+  {
+    "library": {
+      "upMerge": {
+        "repos": ["Stravica/stravica-library-wsd"],
+        "registryPath": "operator/registry/repos.json",
+        "eventsLog": ".cache/library-up-merger/events.jsonl",
+        "mergeMethod": "merge",
+        "branchPrefix": "library-sync-up/",
+        "deleteBranchOnMerge": true,
+        "ghBin": "gh"
+      }
+    }
+  }
+  ```
+
+  Every field has a safe default; `repos` defaults to `[]` (no repos scanned)
+  and can be overridden per invocation with `--repo <owner/name>` (repeatable).
+
+### Migrating from the HQ `library-up-merger` tool
+
+`library up-merge` is a behaviour-identical promotion of the HQ tool at
+`operator/extensions/tools/library-up-merger/`. The scheduled command
+changes from
+`node operator/extensions/tools/library-up-merger/bin/library-up-merger`
+to `pnpm exec library up-merge`. The scope rule, refusal marker, events
+log path, and default merge method are unchanged; the HQ tool's
+`config.json` maps 1:1 to the `library.upMerge` stanza above (`repos`,
+`registryPath`, `eventsLog`, `mergeMethod`, `branchPrefix`,
+`deleteBranchOnMerge`). Repoint the schedule at the new command and
+retire the HQ tool.
+
 Ingest authenticates by subkey alone (spec §3.4, main ruling 2026-08-20 option b);
 no install-key header is sent. The former `REMOTE_LIBRARY_INSTALL_KEY` env
 interim was removed in the same pass.

package/dist/engineering-pa-library-cli/src/cli.mjs

@@ -22,6 +22,7 @@ import { runGet } from './verbs/get.mjs';
 import { runSearch } from './verbs/search.mjs';
 import { runStatus } from './verbs/status.mjs';
 import { runRefreshClones } from './verbs/refresh-clones.mjs';
+import { runUpMerge } from './verbs/up-merge.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -52,13 +53,15 @@ Usage:
   library search <query> [--files-only]
   library status [--json]
   library refresh-clones [--json] [--timeout-ms <n>] [--tier <name>]...
+  library up-merge [--repo <owner/name>]... [--pr <number>] [--dry-run] [--once] [--verbose] [--json]
   library -h | --help
   library -v | --version
 
 Reads config from operator/config/preferences.json (+ preferences.local.json overlay).
 Verbs are only active in REMOTE mode. SIMPLE mode 'library status' prints a
 one-line mode summary and exits 0; every other verb exits 1 in SIMPLE mode
-with a clean not-applicable message.
+with a clean not-applicable message. 'library up-merge' is a GitHub-side
+maintenance verb and runs in both SIMPLE and REMOTE mode.
 
 --help and --version never touch config or the vault, so they always work
 from a directory with no operator config and no vault installed.
@@ -102,6 +105,18 @@ export async function main(argv, seams = {}) {
   }
 
   if (config.mode === 'simple') {
+    // `library up-merge` is a GitHub-side maintenance verb: it reads
+    // library.upMerge from preferences and hits gh, never the ingest
+    // service. It runs the same in SIMPLE and REMOTE mode.
+    if (verb === 'up-merge') {
+      const ctxUp = { config, log, err };
+      try {
+        return await runUpMerge({ ...ctxUp, args: parseUpMerge(rest) });
+      } catch (e) {
+        err(`[library up-merge] ${e.message ?? e}`);
+        return typeof e.exitCode === 'number' ? e.exitCode : 2;
+      }
+    }
     // `library status` is the one verb useful in SIMPLE mode too: a plain
     // one-line mode summary that tells the operator the CLI is installed
     // and the remote path is intentionally not wired. No vault touch,
@@ -141,6 +156,7 @@ export async function main(argv, seams = {}) {
       case 'search':   return await runSearch({ ...ctx, args: parseSearch(rest) });
       case 'status':   return await runStatus({ ...ctx, args: parseStatus(rest) });
       case 'refresh-clones': return await runRefreshClones({ ...ctx, args: parseRefreshClones(rest) });
+      case 'up-merge': return await runUpMerge({ ...ctx, args: parseUpMerge(rest) });
       default:
         err(`[library] unknown verb: ${verb}`);
         log(USAGE);
@@ -195,6 +211,30 @@ function parseStatus(argv) {
   });
   return { json: values.json };
 }
+function parseUpMerge(argv) {
+  const { values } = parseArgs({
+    args: argv,
+    strict: true,
+    allowPositionals: false,
+    options: {
+      repo:      { type: 'string', multiple: true },
+      pr:        { type: 'string' },
+      'dry-run': { type: 'boolean', default: false },
+      once:      { type: 'boolean', default: false },
+      verbose:   { type: 'boolean', default: false },
+      json:      { type: 'boolean', default: false },
+    },
+  });
+  const pr = values.pr ? parseInt(values.pr, 10) : undefined;
+  return {
+    repos: values.repo,
+    pr,
+    dryRun: values['dry-run'],
+    once: values.once,
+    verbose: values.verbose,
+    json: values.json,
+  };
+}
 function parseRefreshClones(argv) {
   const { values } = parseArgs({
     args: argv,

package/dist/engineering-pa-library-cli/src/up-merge/github.mjs

@@ -0,0 +1,103 @@
+// Thin wrappers around the gh CLI, factored so tests can inject a runner
+// and never spawn a real gh. Auth is handled by gh from the host's own
+// login (TheFoot on smarthome01 for the scheduled path today).
+//
+// The runner signature is deliberately narrow: (cmd, args, { input }) ->
+// Promise<{ code, stdout, stderr }>. Every wrapper takes an optional
+// `runner` seam that defaults to the module-local `defaultRunner`, which
+// is a plain spawn. Tests build a runner that inspects args and returns
+// canned stdout/stderr, so no gh process is ever invoked.
+//
+// Ported from operator/extensions/tools/library-up-merger/src/github.mjs
+// and factored for injection (w-2026-09-16-dave-014, d-2026-09-17-013).
+
+import { spawn } from 'node:child_process';
+
+/**
+ * @typedef {(cmd: string, args: string[], opts?: { input?: string }) => Promise<{ code: number, stdout: string, stderr: string }>} Runner
+ */
+
+/** @type {Runner} */
+export function defaultRunner(cmd, args, { input } = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(cmd, args, { stdio: ['pipe', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (chunk) => { stdout += chunk.toString(); });
+    child.stderr.on('data', (chunk) => { stderr += chunk.toString(); });
+    child.on('error', reject);
+    child.on('close', (code) => {
+      resolve({ code, stdout, stderr });
+    });
+    if (input != null) child.stdin.end(input);
+    else child.stdin.end();
+  });
+}
+
+async function ghJson(args, { runner = defaultRunner, ghBin = 'gh' } = {}) {
+  const res = await runner(ghBin, args);
+  if (res.code !== 0) {
+    const err = new Error(`gh ${args.join(' ')} exited ${res.code}: ${res.stderr.trim()}`);
+    err.stderr = res.stderr;
+    err.stdout = res.stdout;
+    throw err;
+  }
+  const text = res.stdout.trim();
+  if (!text) return null;
+  return JSON.parse(text);
+}
+
+export async function listOpenPrs(repoSlug, opts = {}) {
+  const data = await ghJson([
+    'pr', 'list', '--repo', repoSlug, '--state', 'open',
+    '--json', 'number,headRefName,author,title,url,isDraft',
+    '--limit', '100',
+  ], opts);
+  return data || [];
+}
+
+export async function listChangedFiles(repoSlug, number, opts = {}) {
+  const data = await ghJson([
+    'pr', 'view', String(number), '--repo', repoSlug,
+    '--json', 'files',
+  ], opts);
+  return (data && Array.isArray(data.files) ? data.files : []).map((f) => f.path);
+}
+
+export async function mergePr(repoSlug, number, {
+  method = 'merge', deleteBranch = true, runner = defaultRunner, ghBin = 'gh',
+} = {}) {
+  const args = ['pr', 'merge', String(number), '--repo', repoSlug, `--${method}`];
+  if (deleteBranch) args.push('--delete-branch');
+  const res = await runner(ghBin, args);
+  return {
+    ok: res.code === 0,
+    code: res.code,
+    stdout: res.stdout.trim(),
+    stderr: res.stderr.trim(),
+  };
+}
+
+export async function commentOnPr(repoSlug, number, body, {
+  runner = defaultRunner, ghBin = 'gh',
+} = {}) {
+  const res = await runner(
+    ghBin,
+    ['pr', 'comment', String(number), '--repo', repoSlug, '--body-file', '-'],
+    { input: body },
+  );
+  return {
+    ok: res.code === 0,
+    code: res.code,
+    stdout: res.stdout.trim(),
+    stderr: res.stderr.trim(),
+  };
+}
+
+export async function listExistingComments(repoSlug, number, opts = {}) {
+  const data = await ghJson(
+    ['pr', 'view', String(number), '--repo', repoSlug, '--json', 'comments'],
+    opts,
+  );
+  return (data && Array.isArray(data.comments) ? data.comments : []).map((c) => c.body || '');
+}

package/dist/engineering-pa-library-cli/src/up-merge/scope.mjs

@@ -0,0 +1,95 @@
+// Scope-rule computation for library up-path PRs.
+//
+// A PR from head branch `<branchPrefix><device>` on library repo <repoSlug> may be merged
+// when and only when EVERY changed file's repo-relative path falls under one of the
+// device's owned up-paths for that library repo, computed from operator/registry/repos.json:
+//
+//   For each mount M in repos[<library repo id>].mounts where M.upPath === true
+//   and M.upPathOwner === <device>:
+//     allowedPrefix = M.from + include, for each include in (M.upPathInclude || [])
+//     A file matches when its path === allowedPrefix (single-file include)
+//     or starts with allowedPrefix + "/" (directory include).
+//
+// A device with no owned up-paths on the repo, or a file matching none of its allowed
+// prefixes, is a refusal. Refusals never merge.
+//
+// Ported verbatim (behaviour) from operator/extensions/tools/library-up-merger/src/scope.mjs
+// on the promotion to core (w-2026-09-16-dave-014, d-2026-09-17-013). The HQ tool was the
+// reference implementation; this module is the canonical home from 0.1.44 onward.
+
+/**
+ * @param {object} registry  parsed operator/registry/repos.json
+ * @param {string} repoSlug  e.g. "Stravica/stravica-library-wsd"
+ * @returns {string|null}    matching registry key, or null
+ */
+export function repoIdForSlug(registry, repoSlug) {
+  const wanted = repoSlug.toLowerCase();
+  for (const [id, cfg] of Object.entries(registry.repos || {})) {
+    const remote = (cfg.gitRemote || '').toLowerCase();
+    // git@github.com:Owner/name.git  -> Owner/name
+    const m = remote.match(/[:/]([^/:]+\/[^/]+?)(?:\.git)?$/);
+    if (m && m[1] === wanted) return id;
+  }
+  return null;
+}
+
+/**
+ * Compute the sorted, de-duplicated list of allowed repo-relative path prefixes for a
+ * device on a library repo. Each entry is either an exact file path or a directory path
+ * (no trailing slash) - the matcher below appends "/" for directory matching.
+ */
+export function allowedPathsForDevice(registry, repoId, device) {
+  const repo = (registry.repos || {})[repoId];
+  if (!repo || !Array.isArray(repo.mounts)) return [];
+  const out = new Set();
+  for (const mount of repo.mounts) {
+    if (!mount || mount.upPath !== true) continue;
+    if (mount.upPathOwner !== device) continue;
+    const fromPrefix = String(mount.from || '').replace(/\/+$/, '');
+    const includes = Array.isArray(mount.upPathInclude) ? mount.upPathInclude : [];
+    for (const inc of includes) {
+      const clean = String(inc).replace(/\/+$/, '');
+      if (!clean) continue;
+      out.add(fromPrefix ? `${fromPrefix}/${clean}` : clean);
+    }
+  }
+  return [...out].sort();
+}
+
+/**
+ * Does `filePath` (repo-relative) fall under one of the `allowed` entries?
+ * An entry matches when the path equals it, or starts with `entry + "/"`.
+ */
+export function fileAllowed(filePath, allowed) {
+  const f = String(filePath || '').replace(/^\/+/, '');
+  for (const entry of allowed) {
+    if (f === entry) return true;
+    if (f.startsWith(`${entry}/`)) return true;
+  }
+  return false;
+}
+
+/**
+ * Classify a PR's file list against a device's allowed prefixes.
+ * @returns {{ ok: boolean, refused: string[], allowed: string[] }}
+ */
+export function classifyFiles(files, allowed) {
+  const refused = [];
+  const allowedFiles = [];
+  for (const f of files) {
+    if (fileAllowed(f, allowed)) allowedFiles.push(f);
+    else refused.push(f);
+  }
+  return { ok: refused.length === 0, refused, allowed: allowedFiles };
+}
+
+/**
+ * Parse a device out of a head-ref of the form `<branchPrefix><device>`.
+ * Returns null if the branch does not match.
+ */
+export function deviceFromBranch(branch, branchPrefix) {
+  if (!branch || !branch.startsWith(branchPrefix)) return null;
+  const rest = branch.slice(branchPrefix.length);
+  if (!rest || rest.includes('/')) return null;
+  return rest;
+}