@webpresso/agent-kit 0.28.0 → 0.29.1

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Webpresso agent-kit Claude Code plugin: blueprints, skills, hooks, MCP server",
-    "version": "0.28.0"
+    "version": "0.29.1"
   },
   "plugins": [
     {
@@ -23,5 +23,5 @@
       ]
     }
   ],
-  "version": "0.28.0"
+  "version": "0.29.1"
 }

package/.claude-plugin/plugin.json

@@ -1,14 +1,13 @@
 {
   "name": "webpresso",
-  "version": "0.28.0",
+  "version": "0.29.1",
   "description": "Webpresso agent-kit: blueprints, skills, lore commit protocol, tech-debt lifecycle",
   "skills": "./skills",
   "commands": "./commands",
   "mcpServers": {
     "webpresso": {
-      "command": "node",
+      "command": "${CLAUDE_PLUGIN_ROOT}/bin/wp",
       "args": [
-        "${CLAUDE_PLUGIN_ROOT}/bin/wp.js",
         "mcp"
       ]
     }

package/README.md

@@ -1,7 +1,7 @@
 # @webpresso/agent-kit
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
-[![CI](https://github.com/webpresso/agent-kit/actions/workflows/ci.webpresso.yml/badge.svg)](https://github.com/webpresso/agent-kit/actions/workflows/ci.webpresso.yml)
+[![CI](https://github.com/webpresso/agent-kit/actions/workflows/ci.agent-kit.yml/badge.svg)](https://github.com/webpresso/agent-kit/actions/workflows/ci.agent-kit.yml)
 
 > TypeScript infrastructure for AI-agent-driven development. One `wp` runtime
 > gives agents planning, tests, mutation, e2e, CI, docs, and debt tracking —
@@ -74,7 +74,7 @@ vp run public:consumer-smoke -- --setup-only
 | **Summary-first `wp_*` MCP tools** | `wp_test` / `wp_typecheck` / `wp_lint` / `wp_qa` / `wp_e2e` / `wp_format` / `wp_ci_act` / `wp_audit` return JSON with `bytes` / `tokensSaved` budget metadata | [`src/mcp/tools/`](src/mcp/tools/) (each with co-located `.test.ts`), [`src/mcp/server.integration.test.ts`](src/mcp/server.integration.test.ts) |
 | **MCP server + CLI surface** | Registers the tool set and exposes it to agents | [`src/mcp/server.ts`](src/mcp/server.ts), [`src/mcp/cli.ts`](src/mcp/cli.ts), [`src/mcp/cli.integration.test.ts`](src/mcp/cli.integration.test.ts) |
 | **Blueprint runtime** | Lifecycle states, dependency-aware task graph, structured authoring control plane (`wp_blueprint_depgraph` / `put` / `transition`) | [`src/mcp/blueprint-server.ts`](src/mcp/blueprint-server.ts), [`docs/lifecycle.md`](docs/lifecycle.md), [`docs/blueprint-format.md`](docs/blueprint-format.md) |
-| **Audit contract family** | `blueprint-lifecycle`, `docs-frontmatter`, `catalog-drift`, `vision`, `architecture-drift`, `bundle-budget`, `commit-message` (Lore), `tech-debt`, `absolute-path-policy`, `open-source-licenses`, … — each runs as a `wp_audit` MCP tool **and** a pre-commit/CI gate | [`src/audit/`](src/audit/), [`src/mcp/tools/audit.ts`](src/mcp/tools/audit.ts), [`.github/workflows/ci.webpresso.yml`](.github/workflows/ci.webpresso.yml) |
+| **Audit contract family** | `blueprint-lifecycle`, `docs-frontmatter`, `catalog-drift`, `vision`, `architecture-drift`, `bundle-budget`, `commit-message` (Lore), `tech-debt`, `absolute-path-policy`, `open-source-licenses`, … — each runs as a `wp_audit` MCP tool **and** a pre-commit/CI gate | [`src/audit/`](src/audit/), [`src/mcp/tools/audit.ts`](src/mcp/tools/audit.ts), [`.github/workflows/ci.agent-kit.yml`](.github/workflows/ci.agent-kit.yml) |
 | **Symlinker** | Syncs canonical `.agent/` to per-IDE surfaces (Codex/Amp skills, Gemini TOML commands) via rulesync | [`src/symlinker/index.ts`](src/symlinker/index.ts), [`src/symlinker/symlinker.integration.test.ts`](src/symlinker/symlinker.integration.test.ts), [`docs/symlinker.md`](docs/symlinker.md) |
 | **Mutation testing** | `wp audit mutation` (Stryker) catches tests that pass without asserting | [`src/config/stryker/`](src/config/stryker/), `./stryker` + `./mutation` exports |
 | **Tech-debt lifecycle** | `accepted → needs-remediation → monitoring → resolved`, auto-filed from failing audits | [`src/blueprint/tech-debt/`](src/blueprint/tech-debt/), [`src/cli/commands/tech-debt/`](src/cli/commands/tech-debt/) |

package/bin/_run.js

@@ -41,6 +41,8 @@ const RUNTIME_BIN_ARGS = {
   'wp-sessionstart-routing': ['hook', 'sessionstart-routing'],
 }
 
+const RUNTIME_WP_SUBCOMMANDS = new Set(['mcp'])
+
 function resolvePackageRoot() {
   return join(dirname(fileURLToPath(import.meta.url)), '..')
 }
@@ -158,6 +160,10 @@ function buildRuntimeLaunchPlan({
 }) {
   const selectorArgs = RUNTIME_BIN_ARGS[binName]
   if (!selectorArgs) return null
+  if (binName === 'wp') {
+    const subcommand = forwardedArgs[0]
+    if (!RUNTIME_WP_SUBCOMMANDS.has(subcommand) && !forceCompiledRuntime) return null
+  }
 
   const manifest = runtimeManifest ?? readRuntimeManifest(repoRoot)
   if (!manifest) return null

package/bin/wp

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+import { runNamedBin } from './_run.js'
+
+runNamedBin('wp')

package/catalog/base-kit/.github/actions/setup-webpresso/action.yml.tmpl

@@ -0,0 +1,21 @@
+name: Set up Webpresso tooling
+description: >
+  Install shared Webpresso CLIs needed by the base-kit workflow surface.
+  Resolves @webpresso/agent-kit from package.json and installs vite-plus only
+  when the consumer repo explicitly catalogs it.
+runs:
+  using: composite
+  steps:
+    - name: Install shared Webpresso CLIs
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        AGENT_KIT_VERSION="$(node -e "const pkg=require('./package.json'); console.log(pkg.devDependencies?.['@webpresso/agent-kit'] || pkg.dependencies?.['@webpresso/agent-kit'] || 'latest')")"
+        VITE_PLUS_VERSION="$(node -e "const fs=require('fs'); const text=fs.existsSync('pnpm-workspace.yaml') ? fs.readFileSync('pnpm-workspace.yaml','utf8') : ''; const match=text.match(/^\\s*vite-plus:\\s*(.+)$/m); console.log(match ? match[1].trim() : '')")"
+
+        if [[ -n "${VITE_PLUS_VERSION}" ]]; then
+          npm install -g "vite-plus@${VITE_PLUS_VERSION}" "@webpresso/agent-kit@${AGENT_KIT_VERSION}"
+        else
+          npm install -g "@webpresso/agent-kit@${AGENT_KIT_VERSION}"
+        fi

package/catalog/base-kit/.github/workflows/{ci.webpresso.yml.tmpl → ci.yml.tmpl}

@@ -1,4 +1,4 @@
-name: CI (webpresso baseline)
+name: CI
 
 on:
   push:
@@ -22,16 +22,23 @@ jobs:
         with:
           node-version: '24.16.0'
           cache: pnpm
+      - uses: ./.github/actions/setup-webpresso
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
       - run: pnpm install --frozen-lockfile
       - run: pnpm run verify:secrets
       - run: pnpm run audit:secret-provider-quarantine
+      - name: Run wp audit guardrails
+        run: |
+          WP="$(pwd)/node_modules/.bin/wp"
+          [ -x "$WP" ] || WP=wp
+          "$WP" audit guardrails
       - run: pnpm run typecheck
       - run: pnpm run lint
+      - run: pnpm run test
 
-  test:
+  e2e:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
@@ -40,13 +47,14 @@ jobs:
         with:
           node-version: '24.16.0'
           cache: pnpm
+      - uses: ./.github/actions/setup-webpresso
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
       - run: pnpm install --frozen-lockfile
-      - run: pnpm run test
+      - run: pnpm run e2e
 
-  wp-audits:
+  architecture-drift:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
@@ -55,17 +63,18 @@ jobs:
         with:
           node-version: '24.16.0'
           cache: pnpm
+      - uses: ./.github/actions/setup-webpresso
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
       - run: pnpm install --frozen-lockfile
-      - name: Run wp audit guardrails
+      - name: Check architecture drift contract
         run: |
           WP="$(pwd)/node_modules/.bin/wp"
           [ -x "$WP" ] || WP=wp
-          "$WP" audit guardrails
+          "$WP" audit architecture-drift --root .
 
-  deploy-contract:
+  deploy-verify:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
@@ -74,6 +83,7 @@ jobs:
         with:
           node-version: '24.16.0'
           cache: pnpm
+      - uses: ./.github/actions/setup-webpresso
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest

package/catalog/base-kit/tsconfig.json.tmpl

@@ -1,5 +1,5 @@
 {
-  "extends": "./node_modules/@webpresso/agent-kit/tsconfig/base.json",
+  "extends": "@webpresso/agent-kit/tsconfig/base.json",
   "compilerOptions": {
     "types": ["node", "vitest/globals"],
     "noEmit": true

package/catalog/docs/templates/blueprint.yaml

@@ -104,7 +104,7 @@ task_format:
       - 'These are the current accepted task-heading forms enforced by the validator.'
       - 'Lane prefix is optional but recommended. Common lanes: [schema], [backend], [ui], [infra], [docs], [qa].'
   required_metadata:
-    - '**Status:** todo|in_progress|blocked|done'
+    - '**Status:** todo|in-progress|blocked|done|dropped'
   notes:
     - 'Task metadata rules here reflect the current validator contract.'
     - 'Acceptance checkboxes are evidence, not the lifecycle source of truth.'

package/dist/esm/audit/_budgets.d.ts

@@ -12,10 +12,18 @@ export declare const DEFAULT_BUDGETS: {
     readonly 'skill-md-total-each': {
         readonly max_bytes: 16384;
     };
+    readonly 'blueprint-wip-in-progress-max': {
+        readonly max: 3;
+    };
+    readonly 'blueprint-stale-in-progress-days': {
+        readonly max_days: 14;
+    };
 };
 export type BudgetKey = keyof typeof DEFAULT_BUDGETS;
 export type BudgetEntry = {
-    max_bytes: number;
+    max_bytes?: number;
+    max?: number;
+    max_days?: number;
     suggest_compact_at?: number;
     warn_pct?: number;
 };

package/dist/esm/audit/_budgets.js

@@ -8,9 +8,14 @@ import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import { z } from 'zod';
 const budgetEntrySchema = z.object({
-    max_bytes: z.number().int().positive(),
+    max_bytes: z.number().int().positive().optional(),
+    max: z.number().int().positive().optional(),
+    max_days: z.number().int().positive().optional(),
     suggest_compact_at: z.number().min(0).max(1).optional(),
     warn_pct: z.number().min(1).optional(),
+})
+    .refine((entry) => entry.max_bytes !== undefined || entry.max !== undefined || entry.max_days !== undefined, {
+    message: 'budget entry must define at least one of max_bytes, max, or max_days',
 });
 const budgetFileSchema = z.object({
     budgets: z.record(z.string(), budgetEntrySchema),
@@ -20,6 +25,8 @@ export const DEFAULT_BUDGETS = {
     'claude-skill-description-each': { max_bytes: 800 },
     'agents-md-section-each': { max_bytes: 4096, suggest_compact_at: 0.75 },
     'skill-md-total-each': { max_bytes: 16384 },
+    'blueprint-wip-in-progress-max': { max: 3 },
+    'blueprint-stale-in-progress-days': { max_days: 14 },
 };
 /**
  * Load budgets from `.agent/.audit-budgets.yaml` if present, merging with defaults.

package/dist/esm/audit/blueprint-db-consistency.js

@@ -13,8 +13,8 @@
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
+import { resolveBlueprintProjectionDbPath } from '#db/paths.js';
 import { scanBlueprintDirectory } from '#service/scanner.js';
-const DB_PATH = path.join('.agent', '.blueprints.db');
 const _DISABLED_RESULT = {
     ok: true,
     title: 'Blueprint DB consistency (SQL)',
@@ -34,7 +34,7 @@ export async function auditBlueprintDbConsistency(cwd) {
             violations: [],
         };
     }
-    const dbFile = path.join(cwd, DB_PATH);
+    const dbFile = resolveBlueprintProjectionDbPath(cwd);
     if (!existsSync(dbFile)) {
         return {
             ok: true,

package/dist/esm/audit/blueprint-lifecycle-sql.d.ts

@@ -1,17 +1,27 @@
 /**
- * `wp audit blueprint-lifecycle-sql` — SQL-backed rewrite of the existing
- * blueprint-lifecycle audit.
+ * `wp audit blueprint-lifecycle` — the single, deterministic blueprint-lifecycle
+ * audit.
  *
- * Uses the SQLite replica as the primary source when the DB file exists.
- * Falls back to the markdown-based audit when the DB has not been built yet.
+ * The verdict is a pure function of `markdown@HEAD`: this builds an EPHEMERAL
+ * in-memory SQLite projection from the repo's blueprint markdown
+ * (`buildEphemeralProjection`), runs the relational checks against it, and
+ * discards it. It also runs the structural markdown checks
+ * (`auditBlueprintLifecycle` — type / status-vs-folder / `_overview.md` presence /
+ * linking-frontmatter) and merges both result sets. No persistent on-disk
+ * projection is read, so the audit can never hit a stale/missing/locked DB and
+ * is identical across CLI, the `wp_audit` MCP tool, `wp doctor`, and CI.
  *
- * SQL checks (when DB exists):
+ * Relational checks (against the in-memory projection):
  * 1. Blueprints with status='in-progress' that have 0 tasks (invalid).
  * 2. Blueprints whose `status` column doesn't match the directory segment
- *    derived from `file_path` (e.g. stored in completed/ but status=in-progress).
+ *    derived from `file_path`.
  * 3. Tasks in state 'in-progress' whose dependencies are not all done.
  * 4. Blueprints with progress_pct < 100 but status='completed'.
  */
 import type { RepoAuditResult } from './repo-guardrails.js';
-export declare function auditBlueprintLifecycleSql(cwd: string): Promise<RepoAuditResult>;
+export interface BlueprintLifecycleAuditOptions {
+    /** Opt-in: also audit `.omx/plans/` derived-handoff governance (`--legacy-omx`). */
+    readonly includeOmxPlans?: boolean;
+}
+export declare function auditBlueprintLifecycleSql(cwd?: string, options?: BlueprintLifecycleAuditOptions): Promise<RepoAuditResult>;
 //# sourceMappingURL=blueprint-lifecycle-sql.d.ts.map