agent-bober 0.17.1 → 0.19.0

package/dist/vault/mcp-adapter.js

@@ -0,0 +1,176 @@
+/**
+ * VaultMcpAdapter — read/write/list Obsidian vault notes via a WRAPPED on-device MCP server.
+ *
+ * Design:
+ *   - Accepts any object satisfying McpServerLike (constructor-injected), so tests can
+ *     inject a hand-rolled fake without spawning a subprocess.
+ *   - Resolves tool names from config.toolNames overrides before falling back to
+ *     DEFAULT_VAULT_TOOL_NAMES (cyanheads/obsidian-mcp-server convention).
+ *   - Runs an isOnDevice() guard before the first server interaction; rejects any
+ *     declaration whose mcpCommand implies a non-local network transport.
+ *
+ * SECURITY: mcpEnv may contain secrets. This module NEVER includes mcpEnv values in
+ * error messages, log lines, or thrown strings. Only config.name is safe to surface.
+ *
+ * bober: on-device-only guard inspects mcpCommand/mcpArgs (never mcpEnv). If a
+ *        remote-transport MCP server is ever needed, add a new adapter — do not relax
+ *        this guard; it is a deliberate security/privacy boundary.
+ */
+import { parseNote, serializeNote } from "./frontmatter.js";
+// ── Default tool names ───────────────────────────────────────────────
+/**
+ * Default MCP tool names for cyanheads/obsidian-mcp-server.
+ * Override any entry via config.obsidian.toolNames to support alternative servers
+ * (e.g., Obsidian Local REST API plugin's built-in MCP).
+ */
+export const DEFAULT_VAULT_TOOL_NAMES = {
+    readNote: "obsidian_read_file",
+    writeNote: "obsidian_update_file",
+    listNotes: "obsidian_list_files_in_dir",
+};
+// ── On-device guard ──────────────────────────────────────────────────
+/** URL-scheme pattern that signals a remote (non-local) transport. */
+const REMOTE_SCHEME_RE = /^(https?|wss?|ftp|tcp):\/\//i;
+/**
+ * Detect non-loopback host in a URL-like argument element.
+ * Accepts strings of the form scheme://host[/...] and rejects if host is not a
+ * loopback alias (localhost / 127.0.0.1 / ::1 / 0.0.0.0).
+ */
+function argImpliesRemoteHost(arg) {
+    // Match <scheme>://<host>[:<port>][/...] or --flag=<scheme>://<host>
+    const urlMatch = arg.match(/(?:^|=)(https?|wss?|ftp|tcp):\/\/([^/:?\s]+)/i);
+    if (!urlMatch)
+        return false;
+    const host = urlMatch[2].toLowerCase();
+    const loopback = new Set(["localhost", "127.0.0.1", "::1", "0.0.0.0"]);
+    return !loopback.has(host);
+}
+/**
+ * Returns true when the obsidian config describes an on-device (local) MCP server.
+ *
+ * Predicate:
+ *   REJECT if mcpCommand matches a remote URL scheme (https?|wss?|ftp|tcp://).
+ *   REJECT if any mcpArgs element embeds a non-loopback host (e.g. --url=https://cloud.example.com).
+ *   ACCEPT bare executables (node, npx, /abs/path) with no remote-pointing args.
+ *
+ * SECURITY: Never inspects mcpEnv values — those are secrets and must not drive guard logic.
+ */
+export function isOnDevice(cfg) {
+    if (REMOTE_SCHEME_RE.test(cfg.mcpCommand))
+        return false;
+    for (const arg of cfg.mcpArgs ?? []) {
+        if (argImpliesRemoteHost(arg))
+            return false;
+    }
+    return true;
+}
+// ── Envelope parsing ─────────────────────────────────────────────────
+/**
+ * Extract the text payload from a callTool result.
+ * Tolerates both a raw string and the SDK envelope { content: [{ text }] }.
+ */
+function extractText(raw) {
+    if (typeof raw === "string")
+        return raw;
+    const envelope = raw;
+    if (Array.isArray(envelope.content) && envelope.content[0]?.text != null) {
+        return envelope.content[0].text;
+    }
+    throw new Error("VaultMcpAdapter: unexpected callTool result shape — no text payload found");
+}
+/**
+ * Extract a string list from a callTool result for listNotes.
+ * Tries JSON-parsing the text payload; falls back to splitting on newlines.
+ */
+function extractList(raw) {
+    const text = extractText(raw);
+    try {
+        const parsed = JSON.parse(text);
+        if (Array.isArray(parsed))
+            return parsed;
+    }
+    catch {
+        // not JSON — split on newlines
+    }
+    return text
+        .split(/\r?\n/)
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0);
+}
+// ── VaultMcpAdapter ─────────────────────────────────────────────────
+/**
+ * Thin adapter that exposes readNote / writeNote / listNotes over an injected MCP server.
+ *
+ * Usage (production):
+ *   const server = new ExternalMcpServer(provider);  // satisfies McpServerLike
+ *   const adapter = new VaultMcpAdapter(server, config.vault.obsidian);
+ *   await adapter.readNote("Notes/Foo.md");
+ *
+ * Usage (tests): inject a hand-rolled fake that satisfies McpServerLike.
+ */
+export class VaultMcpAdapter {
+    server;
+    config;
+    toolNames;
+    constructor(server, config) {
+        this.server = server;
+        this.config = config;
+        // Resolve overrides once at construction time.
+        this.toolNames = {
+            readNote: config.toolNames?.readNote ?? DEFAULT_VAULT_TOOL_NAMES.readNote,
+            writeNote: config.toolNames?.writeNote ?? DEFAULT_VAULT_TOOL_NAMES.writeNote,
+            listNotes: config.toolNames?.listNotes ?? DEFAULT_VAULT_TOOL_NAMES.listNotes,
+        };
+    }
+    /**
+     * Guard that MUST be called before any method that would invoke server.start().
+     * Throws a clear Error (naming only config.name) when the declaration is not on-device.
+     * SECURITY: error message never includes mcpEnv.
+     */
+    guardOnDevice() {
+        if (!isOnDevice(this.config)) {
+            throw new Error(`VaultMcpAdapter refuses non-local server "${this.config.name}": on-device only`);
+        }
+    }
+    // ── Public API ──────────────────────────────────────────────────────
+    /**
+     * Read a note at the given vault-relative path.
+     * Starts the server (after the on-device guard), calls the configured read tool,
+     * and parses the returned markdown into a VaultNote via sprint-1 parseNote.
+     */
+    async readNote(path) {
+        this.guardOnDevice();
+        await this.server.start();
+        const raw = await this.server.callTool(this.toolNames.readNote, { path });
+        const markdown = extractText(raw);
+        return parseNote(markdown, path);
+    }
+    /**
+     * Write a note to the vault.
+     * Serializes the VaultNote to markdown via sprint-1 serializeNote, then calls
+     * the configured write tool with the note's path and serialized content.
+     */
+    async writeNote(note) {
+        this.guardOnDevice();
+        await this.server.start();
+        const content = serializeNote(note);
+        await this.server.callTool(this.toolNames.writeNote, { path: note.path, content });
+    }
+    /**
+     * List notes in a vault directory.
+     * Calls the configured list tool and returns an array of path strings.
+     */
+    async listNotes(dir) {
+        this.guardOnDevice();
+        await this.server.start();
+        const raw = await this.server.callTool(this.toolNames.listNotes, dir != null ? { dir } : {});
+        return extractList(raw);
+    }
+    /**
+     * Stop the underlying MCP server. Safe to call even if start() was never called.
+     */
+    async stop() {
+        await this.server.stop();
+    }
+}
+//# sourceMappingURL=mcp-adapter.js.map

package/dist/vault/mcp-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-adapter.js","sourceRoot":"","sources":["../../src/vault/mcp-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAe5D,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,QAAQ,EAAE,oBAAoB;IAC9B,SAAS,EAAE,sBAAsB;IACjC,SAAS,EAAE,4BAA4B;CAC/B,CAAC;AAEX,wEAAwE;AAExE,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAExD;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,qEAAqE;IACrE,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC5E,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IACvE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,GAA0C;IACnE,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,oBAAoB,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AAExE;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,QAAQ,GAAG,GAA6C,CAAC;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;QACzE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;AAC/F,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,MAAkB,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IACD,OAAO,IAAI;SACR,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,uEAAuE;AAEvE;;;;;;;;;GASG;AACH,MAAM,OAAO,eAAe;IAQP;IACA;IARF,SAAS,CAIxB;IAEF,YACmB,MAAqB,EACrB,MAA6C;QAD7C,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAuC;QAE9D,+CAA+C;QAC/C,IAAI,CAAC,SAAS,GAAG;YACf,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,IAAI,wBAAwB,CAAC,QAAQ;YACzE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,IAAI,wBAAwB,CAAC,SAAS;YAC5E,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,IAAI,wBAAwB,CAAC,SAAS;SAC7E,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,aAAa;QACnB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,6CAA6C,IAAI,CAAC,MAAM,CAAC,IAAI,mBAAmB,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uEAAuE;IAEvE;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,IAAe;QAC7B,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACrF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,GAAY;QAC1B,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7F,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/dist/vault/note-io.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Vault note I/O — filesystem read / write / list helpers.
+ *
+ * Bridges the pure frontmatter parse/serialize layer (`./frontmatter.ts`) with
+ * the real filesystem:
+ *   - `readNote`  — readFile + parseFrontmatter, returns a typed VaultNote
+ *   - `writeNote` — ensureDir(dirname) + writeFile(serializeNote)
+ *   - `listNotes` — glob("**\/*.md", { cwd, absolute: true, nodir: true })
+ *
+ * All fs access is via `node:fs/promises` (no sync variants).
+ * Uses the existing `glob` dependency (same recipe as `src/discovery/scanners/`).
+ */
+import type { VaultNote } from "./types.js";
+/**
+ * Read a markdown file from disk and parse its YAML frontmatter.
+ * Returns a fully typed `VaultNote` with `path` set to the given path.
+ */
+export declare function readNote(path: string): Promise<VaultNote>;
+/**
+ * Serialize a `VaultNote` and write it to `note.path`.
+ * Parent directories are created automatically (mirrors `writeJson` in utils/fs.ts).
+ */
+export declare function writeNote(note: VaultNote): Promise<void>;
+/**
+ * Return the absolute paths of every `.md` file under `vaultDir`, recursively.
+ * Uses `glob` (existing repo dependency) — no hand-rolled walker.
+ */
+export declare function listNotes(vaultDir: string): Promise<string[]>;
+//# sourceMappingURL=note-io.d.ts.map

package/dist/vault/note-io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"note-io.d.ts","sourceRoot":"","sources":["../../src/vault/note-io.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAM5C;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAG/D;AAID;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAG9D;AAID;;;GAGG;AACH,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEnE"}

package/dist/vault/note-io.js

@@ -0,0 +1,44 @@
+/**
+ * Vault note I/O — filesystem read / write / list helpers.
+ *
+ * Bridges the pure frontmatter parse/serialize layer (`./frontmatter.ts`) with
+ * the real filesystem:
+ *   - `readNote`  — readFile + parseFrontmatter, returns a typed VaultNote
+ *   - `writeNote` — ensureDir(dirname) + writeFile(serializeNote)
+ *   - `listNotes` — glob("**\/*.md", { cwd, absolute: true, nodir: true })
+ *
+ * All fs access is via `node:fs/promises` (no sync variants).
+ * Uses the existing `glob` dependency (same recipe as `src/discovery/scanners/`).
+ */
+import { readFile, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { glob } from "glob";
+import { parseNote, serializeNote } from "./frontmatter.js";
+import { ensureDir } from "../utils/fs.js";
+// ── Read ─────────────────────────────────────────────────────────────
+/**
+ * Read a markdown file from disk and parse its YAML frontmatter.
+ * Returns a fully typed `VaultNote` with `path` set to the given path.
+ */
+export async function readNote(path) {
+    const raw = await readFile(path, "utf-8");
+    return parseNote(raw, path);
+}
+// ── Write ────────────────────────────────────────────────────────────
+/**
+ * Serialize a `VaultNote` and write it to `note.path`.
+ * Parent directories are created automatically (mirrors `writeJson` in utils/fs.ts).
+ */
+export async function writeNote(note) {
+    await ensureDir(dirname(note.path));
+    await writeFile(note.path, serializeNote(note), "utf-8");
+}
+// ── List ─────────────────────────────────────────────────────────────
+/**
+ * Return the absolute paths of every `.md` file under `vaultDir`, recursively.
+ * Uses `glob` (existing repo dependency) — no hand-rolled walker.
+ */
+export async function listNotes(vaultDir) {
+    return glob("**/*.md", { cwd: vaultDir, absolute: true, nodir: true });
+}
+//# sourceMappingURL=note-io.js.map

package/dist/vault/note-io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"note-io.js","sourceRoot":"","sources":["../../src/vault/note-io.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,wEAAwE;AAExE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY;IACzC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,wEAAwE;AAExE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAe;IAC7C,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,wEAAwE;AAExE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAgB;IAC9C,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACzE,CAAC"}

package/dist/vault/profile.d.ts

@@ -0,0 +1,35 @@
+/**
+ * profile — resolver for a vault's optional profile.yaml.
+ *
+ * Reads <vaultDir>/profile.yaml on demand and returns:
+ *   - The parsed VaultProfile when the file is plaintext YAML.
+ *   - { encrypted: true } when the file carries a SOPS top-level `sops:` key
+ *     (structural detection only — no decryption, no key management).
+ *   - undefined when the file is absent (ENOENT).
+ *
+ * PURE w.r.t. clock: never calls Date.now() or new Date().
+ *       No crypto, network, or sops-binary imports — detection is key-presence only.
+ *
+ * bober: reuses parseFrontmatter (the ONE YAML path) by wrapping the standalone
+ *        YAML body in `---` delimiters — no second YAML parser is introduced.
+ *        Swap for a full YAML library if nested mappings beyond the Dataview
+ *        scalar/list subset are needed.
+ */
+/**
+ * Generic, mostly-open vault profile. Domains add optional well-known keys
+ * at their own use sites — no medical or financial fields are hardcoded here.
+ */
+export type VaultProfile = Record<string, unknown>;
+/**
+ * Resolve the vault profile from `<vaultDir>/profile.yaml`.
+ *
+ * Returns:
+ *   - `VaultProfile` — plaintext YAML parsed into an open record.
+ *   - `{ encrypted: true }` — SOPS-encrypted file detected (top-level `sops:` key
+ *     present); no value is decrypted or exposed.
+ *   - `undefined` — profile.yaml is absent (no throw).
+ */
+export declare function resolveProfile(vaultDir: string): Promise<VaultProfile | {
+    encrypted: true;
+} | undefined>;
+//# sourceMappingURL=profile.d.ts.map

package/dist/vault/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/vault/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,GAAG;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,GAAG,SAAS,CAAC,CAmBzD"}

package/dist/vault/profile.js

@@ -0,0 +1,50 @@
+/**
+ * profile — resolver for a vault's optional profile.yaml.
+ *
+ * Reads <vaultDir>/profile.yaml on demand and returns:
+ *   - The parsed VaultProfile when the file is plaintext YAML.
+ *   - { encrypted: true } when the file carries a SOPS top-level `sops:` key
+ *     (structural detection only — no decryption, no key management).
+ *   - undefined when the file is absent (ENOENT).
+ *
+ * PURE w.r.t. clock: never calls Date.now() or new Date().
+ *       No crypto, network, or sops-binary imports — detection is key-presence only.
+ *
+ * bober: reuses parseFrontmatter (the ONE YAML path) by wrapping the standalone
+ *        YAML body in `---` delimiters — no second YAML parser is introduced.
+ *        Swap for a full YAML library if nested mappings beyond the Dataview
+ *        scalar/list subset are needed.
+ */
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parseFrontmatter } from "./frontmatter.js";
+/**
+ * Resolve the vault profile from `<vaultDir>/profile.yaml`.
+ *
+ * Returns:
+ *   - `VaultProfile` — plaintext YAML parsed into an open record.
+ *   - `{ encrypted: true }` — SOPS-encrypted file detected (top-level `sops:` key
+ *     present); no value is decrypted or exposed.
+ *   - `undefined` — profile.yaml is absent (no throw).
+ */
+export async function resolveProfile(vaultDir) {
+    let raw;
+    try {
+        raw = await readFile(join(vaultDir, "profile.yaml"), "utf-8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return undefined;
+        throw err;
+    }
+    // profile.yaml is a standalone YAML document (no leading `---`).
+    // Wrap it so the single declared parser handles it with consistent scalar/list rules.
+    const { frontmatter } = parseFrontmatter(`---\n${raw}\n---\n`);
+    // SOPS detection is key-PRESENCE, not truthiness:
+    // parseFrontmatter stores `sops:` (with indented children) as "" (empty string),
+    // which is falsy — use `in` to detect the key regardless of its value.
+    if ("sops" in frontmatter)
+        return { encrypted: true };
+    return frontmatter;
+}
+//# sourceMappingURL=profile.js.map

package/dist/vault/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/vault/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAQpD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB;IAEhB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAAyB,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACnE,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,iEAAiE;IACjE,sFAAsF;IACtF,MAAM,EAAE,WAAW,EAAE,GAAG,gBAAgB,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAE/D,kDAAkD;IAClD,iFAAiF;IACjF,uEAAuE;IACvE,IAAI,MAAM,IAAI,WAAW;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAEtD,OAAO,WAA2B,CAAC;AACrC,CAAC"}

package/dist/vault/reindex.d.ts

@@ -0,0 +1,55 @@
+/**
+ * reindex — reconcile-at-ingest index builder over VaultNote frontmatter.
+ *
+ * Walks a set of parsed VaultNotes, skips notes whose frontmatter.status is
+ * SUPERSEDED_STATUS, maps surviving notes to FactInput records via noteToFacts,
+ * and writes each fact through writeFact (the sanctioned reconcile-at-ingest path).
+ *
+ * PURE w.r.t. clock: accepts `now` as an injected ISO string — never calls
+ * Date.now() or new Date() internally.
+ *
+ * bober: no judge is wired by default; ambiguous-key collisions fall back to
+ *        deterministic ADD (reconcile.ts:93-96). Wire a judge via opts.judge
+ *        if LLM-assisted conflict resolution is needed in a future sprint.
+ */
+import type { VaultNote } from "./types.js";
+import type { FactStore } from "../state/facts.js";
+import type { FactJudge } from "../orchestrator/memory/fact-judge.js";
+import { SUPERSEDED_STATUS } from "./conventions.js";
+export { SUPERSEDED_STATUS };
+/** Summary of a reindex pass over a set of notes. */
+export interface ReindexSummary {
+    /** Number of notes actually indexed (excludes superseded notes). */
+    notesParsed: number;
+    /** Facts written for the first time (ReconcileAction === "add"). */
+    factsAdded: number;
+    /**
+     * Facts whose value changed — prior row is superseded (ReconcileAction === "update").
+     * Named "superseded" in the summary because update = supersede the prior fact.
+     */
+    factsSuperseded: number;
+    /** Facts with an identical value already active — no write (ReconcileAction === "noop"). */
+    factsNoop: number;
+}
+/**
+ * Walk `notes`, skip superseded ones, map each surviving note's frontmatter to
+ * FactInput records, and write them through `writeFact` (never store.insertFact).
+ *
+ * Returns a tally of actions taken across all facts in all indexed notes.
+ *
+ * @param store  Target FactStore — use new FactStore(':memory:') in tests.
+ * @param notes  Parsed VaultNotes from Sprint-1 parseNote / note-io.
+ * @param opts.scope        Fact scope label (e.g. "medical", "finance").
+ * @param opts.now          Injected ISO-8601 wall-clock string; stamped on every
+ *                          new FactInput as tValid and tCreated.
+ * @param opts.sourceRunId  Optional run provenance tag; null when absent.
+ * @param opts.judge        Optional LLM judge for ambiguous collisions; absent
+ *                          = deterministic ADD fallback (reconcile.ts:93-96).
+ */
+export declare function reindexNotes(store: FactStore, notes: VaultNote[], opts: {
+    scope: string;
+    now: string;
+    sourceRunId?: string | null;
+    judge?: FactJudge;
+}): Promise<ReindexSummary>;
+//# sourceMappingURL=reindex.d.ts.map

package/dist/vault/reindex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reindex.d.ts","sourceRoot":"","sources":["../../src/vault/reindex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,mBAAmB,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAI7B,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,4FAA4F;IAC5F,SAAS,EAAE,MAAM,CAAC;CACnB;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE,SAAS,EAAE,EAClB,IAAI,EAAE;IACJ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,GACA,OAAO,CAAC,cAAc,CAAC,CAiCzB"}

package/dist/vault/reindex.js

@@ -0,0 +1,69 @@
+/**
+ * reindex — reconcile-at-ingest index builder over VaultNote frontmatter.
+ *
+ * Walks a set of parsed VaultNotes, skips notes whose frontmatter.status is
+ * SUPERSEDED_STATUS, maps surviving notes to FactInput records via noteToFacts,
+ * and writes each fact through writeFact (the sanctioned reconcile-at-ingest path).
+ *
+ * PURE w.r.t. clock: accepts `now` as an injected ISO string — never calls
+ * Date.now() or new Date() internally.
+ *
+ * bober: no judge is wired by default; ambiguous-key collisions fall back to
+ *        deterministic ADD (reconcile.ts:93-96). Wire a judge via opts.judge
+ *        if LLM-assisted conflict resolution is needed in a future sprint.
+ */
+import { writeFact } from "../state/facts.js";
+import { noteToFacts } from "./index-map.js";
+import { SUPERSEDED_STATUS } from "./conventions.js";
+// ── Sprint 5 convergence: SUPERSEDED_STATUS is canonical in conventions.ts ───
+export { SUPERSEDED_STATUS };
+// ── Implementation ───────────────────────────────────────────────────────────
+/**
+ * Walk `notes`, skip superseded ones, map each surviving note's frontmatter to
+ * FactInput records, and write them through `writeFact` (never store.insertFact).
+ *
+ * Returns a tally of actions taken across all facts in all indexed notes.
+ *
+ * @param store  Target FactStore — use new FactStore(':memory:') in tests.
+ * @param notes  Parsed VaultNotes from Sprint-1 parseNote / note-io.
+ * @param opts.scope        Fact scope label (e.g. "medical", "finance").
+ * @param opts.now          Injected ISO-8601 wall-clock string; stamped on every
+ *                          new FactInput as tValid and tCreated.
+ * @param opts.sourceRunId  Optional run provenance tag; null when absent.
+ * @param opts.judge        Optional LLM judge for ambiguous collisions; absent
+ *                          = deterministic ADD fallback (reconcile.ts:93-96).
+ */
+export async function reindexNotes(store, notes, opts) {
+    const summary = {
+        notesParsed: 0,
+        factsAdded: 0,
+        factsSuperseded: 0,
+        factsNoop: 0,
+    };
+    for (const note of notes) {
+        // Skip superseded notes — they contribute no active facts to the index.
+        if (note.frontmatter.status === SUPERSEDED_STATUS)
+            continue;
+        summary.notesParsed++;
+        const inputs = noteToFacts(note, {
+            scope: opts.scope,
+            now: opts.now,
+            sourceRunId: opts.sourceRunId,
+        });
+        for (const input of inputs) {
+            const action = await writeFact(store, input, {
+                judge: opts.judge,
+                now: opts.now,
+            });
+            if (action === "add")
+                summary.factsAdded++;
+            else if (action === "update")
+                summary.factsSuperseded++;
+            else if (action === "noop")
+                summary.factsNoop++;
+            // "delete" only occurs if judge returns delete; not counted in summary shape.
+        }
+    }
+    return summary;
+}
+//# sourceMappingURL=reindex.js.map

package/dist/vault/reindex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reindex.js","sourceRoot":"","sources":["../../src/vault/reindex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,gFAAgF;AAChF,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAmB7B,gFAAgF;AAEhF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAgB,EAChB,KAAkB,EAClB,IAKC;IAED,MAAM,OAAO,GAAmB;QAC9B,WAAW,EAAE,CAAC;QACd,UAAU,EAAE,CAAC;QACb,eAAe,EAAE,CAAC;QAClB,SAAS,EAAE,CAAC;KACb,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,wEAAwE;QACxE,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,iBAAiB;YAAE,SAAS;QAE5D,OAAO,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QAEH,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAoB,MAAM,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE;gBAC5D,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;YAEH,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,CAAC,UAAU,EAAE,CAAC;iBACtC,IAAI,MAAM,KAAK,QAAQ;gBAAE,OAAO,CAAC,eAAe,EAAE,CAAC;iBACnD,IAAI,MAAM,KAAK,MAAM;gBAAE,OAAO,CAAC,SAAS,EAAE,CAAC;YAChD,8EAA8E;QAChF,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/vault/types.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Vault note model — the canonical in-memory shape of an Obsidian markdown note.
+ *
+ * Domain-agnostic: frontmatter is an open Record; no domain-specific keys are
+ * hardcoded here. Consumers narrow frontmatter values at their own use sites.
+ * No execution logic lives here — types only.
+ */
+/** A parsed Obsidian vault note: YAML frontmatter + opaque markdown body + source path. */
+export interface VaultNote {
+    /**
+     * Parsed YAML frontmatter. Values follow Dataview conventions:
+     * string | number | string[] (for lists) or a status enum string.
+     */
+    frontmatter: Record<string, unknown>;
+    /** Opaque markdown body — everything after the closing `---` delimiter, preserved verbatim. */
+    body: string;
+    /** Absolute or vault-relative path the note was read from / will be written to. */
+    path: string;
+}
+/**
+ * Documented Dataview-compatible status enum.
+ * Stored as a plain string in frontmatter — no coercion at runtime.
+ */
+export type NoteStatus = "active" | "superseded";
+//# sourceMappingURL=types.d.ts.map

package/dist/vault/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/vault/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;CACd;AAID;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,YAAY,CAAC"}

package/dist/vault/types.js

@@ -0,0 +1,9 @@
+/**
+ * Vault note model — the canonical in-memory shape of an Obsidian markdown note.
+ *
+ * Domain-agnostic: frontmatter is an open Record; no domain-specific keys are
+ * hardcoded here. Consumers narrow frontmatter values at their own use sites.
+ * No execution logic lives here — types only.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/vault/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/vault/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-bober",
-  "version": "0.17.1",
-  "description": "Multi-agent harness for building applications autonomously with any LLM. Researcher, Planner, Curator, Generator, Evaluator, Documenter pipeline. Supports Claude, GPT, Gemini, DeepSeek, Ollama, and Claude Code subscriptions. MCP server for Cursor/Windsurf.",
+  "version": "0.19.0",
+  "description": "Multi-agent, multi-provider harness for building software autonomously with any LLM. Researcher, Planner, Curator, Generator, Evaluator, Documenter pipeline with a fail-closed security-audit gate, a fleet orchestrator for bulk multi-agent runs, and a cross-domain knowledge platform (medical, vault, priority hub). Supports Claude, GPT, Gemini, DeepSeek, Ollama, and Claude Code subscriptions. MCP server for Cursor/Windsurf.",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -13,6 +13,7 @@
     "dev": "tsc --watch",
     "lint": "eslint src/",
     "typecheck": "tsc --noEmit",
+    "typecheck:tests": "tsc --noEmit -p tsconfig.test.json",
     "test": "vitest",
     "update-all": "node scripts/update-all.mjs",
     "update-all:check": "node scripts/update-all.mjs --check",
@@ -32,7 +33,11 @@
     "gemini",
     "deepseek",
     "ollama",
-    "plugin"
+    "plugin",
+    "security-audit",
+    "fleet",
+    "incident-response",
+    "knowledge-platform"
   ],
   "author": "BOBER3r",
   "license": "MIT",
@@ -62,19 +67,24 @@
   "dependencies": {
     "@anthropic-ai/sdk": "^0.100.1",
     "@modelcontextprotocol/sdk": "^1.28.0",
+    "better-sqlite3": "^11.9.1",
     "chalk": "^5.4.1",
     "commander": "^13.1.0",
     "execa": "^9.5.2",
     "glob": "^11.0.1",
+    "grammy": "^1.44.0",
     "ora": "^8.1.1",
     "prompts": "^2.4.2",
+    "sax": "^1.6.0",
     "semver": "^7.8.1",
     "zod": "^3.24.2",
     "zod-to-json-schema": "^3.25.2"
   },
   "peerDependencies": {
     "@google/generative-ai": ">=0.21.0",
-    "openai": "^6.42.0"
+    "openai": "^6.42.0",
+    "damcrawler": ">=0.3.0",
+    "playwright": ">=1.40.0"
   },
   "peerDependenciesMeta": {
     "openai": {
@@ -82,12 +92,20 @@
     },
     "@google/generative-ai": {
       "optional": true
+    },
+    "damcrawler": {
+      "optional": true
+    },
+    "playwright": {
+      "optional": true
     }
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
+    "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^22.13.0",
     "@types/prompts": "^2.4.9",
+    "@types/sax": "^1.2.7",
     "@types/semver": "^7.7.1",
     "@typescript-eslint/eslint-plugin": "^8.22.0",
     "@typescript-eslint/parser": "^8.22.0",

package/scripts/sync-targets.json

@@ -6,7 +6,8 @@
   ],
   "targets": [
     "/Users/bober4ik/WebstormProjects/solex-integration-demo",
+    "/Users/bober4ik/WebstormProjects/solex-integration-demo copy",
     "/Users/bober4ik/WebstormProjects/solex-integration-demo/apps/api",
     "/Users/bober4ik/WebstormProjects/solex-integration-demo/solex-games-betbook (Copy)"
   ]
-}
+}