agent-enderun 1.10.2 → 1.11.0

package/src/cli/utils/compliance.ts

@@ -14,12 +14,11 @@ export function scanProjectCompliance(): ComplianceIssue[] {
 
     for (const file of files) {
         // Absolute skip for the scanner itself to avoid recursion/self-flagging
-        if (file.includes("compliance") || 
+        if (file.includes("compliance") ||
             file.includes("definitions") ||
             file.includes("agents/registry") || // Skip agent definitions
-            file.includes("app-backend.ts") || // Template generator
             file.includes("scaffold-ops.ts") || // Template generator
-            file.includes("logger") || 
+            file.includes("logger") ||
             file.includes("errors") ||
             file.includes("shared/fs")) continue;
 
@@ -31,8 +30,8 @@ export function scanProjectCompliance(): ComplianceIssue[] {
             const trimmedLine = line.trim();
 
             // Skip comments and common doc string patterns
-            if (trimmedLine.startsWith("//") || 
-                trimmedLine.startsWith("*") || 
+            if (trimmedLine.startsWith("//") ||
+                trimmedLine.startsWith("*") ||
                 trimmedLine.startsWith("-") ||
                 trimmedLine.includes("\": \"") || // Ignore JSON-like values
                 trimmedLine.includes("default: ") || // Ignore default template values
@@ -48,9 +47,9 @@ export function scanProjectCompliance(): ComplianceIssue[] {
             }
 
             // 2. Secret check (Regex for simple API keys/assignments) - skip UI messages and templates
-            if (/(API_KEY|SECRET|PASSWORD)\s*[:=]/i.test(line) && 
-                !file.includes(".env") && 
-                !isUIMessage && 
+            if (/(API_KEY|SECRET|PASSWORD)\s*[:=]/i.test(line) &&
+                !file.includes(".env") &&
+                !isUIMessage &&
                 !trimmedLine.includes(".env.example") && // Skip template lines
                 !trimmedLine.includes("your_secret_key_here") && // Skip common placeholders
                 !trimmedLine.includes("pattern:")) {
@@ -68,7 +67,7 @@ export function scanProjectCompliance(): ComplianceIssue[] {
             }
 
             // 5. Raw fs write check (Atomic safety enforcement)
-            if ((line.includes("fs.writeFileSync") || line.includes("fs.appendFileSync")) && 
+            if ((line.includes("fs.writeFileSync") || line.includes("fs.appendFileSync")) &&
                 !file.includes("src/shared/fs.ts") && // Ignore the utility itself
                 !line.includes(".lock") && // Allow lock files
                 !line.includes("lockPath") && // Allow lock path variables

package/src/cli/utils/fs.ts

@@ -8,7 +8,7 @@ import { ensureDir, writeTextFile, writeJsonFile, appendFile } from "../../share
 
 export { ensureDir, writeTextFile, writeJsonFile, appendFile };
 
-export function updateGitIgnore(targetPath: string, frameworkDir = ".gemini", dryRun = false): void {
+export function updateGitIgnore(targetPath: string, frameworkDir = ".enderun", dryRun = false): void {
     const IGNORE_LINES = [
         "# Agent Enderun",
         `${frameworkDir}/logs/*.json`,

package/src/cli/utils/memory.ts

@@ -5,9 +5,13 @@ import { logger } from "../../shared/logger.js";
 import { ensureDir, writeTextFile, writeJsonFile } from "../../shared/fs.js";
 import { StateSchema, AgentStatusSchema, TaskSchema } from "./schemas.js";
 import type { TraceID } from "../../shared/types.js";
+import {
+    FRAMEWORK,
+    FRAMEWORK_DIR_CANDIDATES,
+    MCP,
+} from "../../shared/constants.js";
 
 export { generateULID } from "./time.js";
-export { FRAMEWORK_DIR_CANDIDATES } from "../adapters/index.js";
 
 const CWD = process.cwd();
 const HOME = os.homedir();
@@ -28,9 +32,24 @@ function findFrameworkDir(basePath: string): string | null {
     return null;
 }
 
+export function isFrameworkDevelopmentRepo(): boolean {
+    try {
+        const pkgPath = path.join(CWD, "package.json");
+        if (fs.existsSync(pkgPath)) {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+            if (pkg.name === "agent-enderun") {
+                return true;
+            }
+        }
+    } catch (err) {
+        logger.debug("Failed to read package.json in isFrameworkDevelopmentRepo", err);
+    }
+    return false;
+}
+
 export function getLocalFrameworkDir(): string {
     const localDir = findFrameworkDir(CWD);
-    return localDir || path.join(CWD, ".gemini");
+    return localDir || path.join(CWD, FRAMEWORK.CORE_DIR);
 }
 
 export function getConfigDir(): string {
@@ -38,17 +57,23 @@ export function getConfigDir(): string {
     if (localDir) return localDir;
 
     // Check for standard local directories if package.json doesn't specify
-    const localCandidates = [".enderun", ".gemini", ".claude", ".cursor", ".antigravity", ".agent"];
+    const localCandidates = [...FRAMEWORK_DIR_CANDIDATES, ".agent"] as string[];
     for (const cand of localCandidates) {
         const p = path.join(CWD, cand);
         if (fs.existsSync(p)) return p;
     }
 
-    return path.join(HOME, ".gemini");
+    // In dev repo, don't fall back to global dir. Point to local default.
+    if (isFrameworkDevelopmentRepo()) {
+        return path.join(CWD, FRAMEWORK.CORE_DIR);
+    }
+
+    return path.join(HOME, FRAMEWORK.CORE_DIR);
 }
 
 export function getFrameworkDir(): string {
-    if (process.env.ENDERUN_TEST_DIR) return process.env.ENDERUN_TEST_DIR;
+    const testDir = process.env[MCP.TEST_DIR_ENV];
+    if (testDir) return testDir;
     return getConfigDir();
 }
 
@@ -105,7 +130,7 @@ export function readActiveTraceId(memoryContent: string): string | null {
     try {
         const state = JSON.parse(memoryContent);
         return state.traceId || null;
-    } catch {
+    } catch (_e) { /* ignore */
         return null;
     }
 }
@@ -254,7 +279,7 @@ export function acquireMemoryLock(lockPath: string): boolean {
                     fs.writeFileSync(lockPath, String(Date.now()), { flag: "wx" });
                     return true;
                 }
-            } catch {
+            } catch (_e) { /* ignore */
                 // Ignore
             }
         }

package/src/cli/utils/pkg.ts

@@ -1,6 +1,6 @@
 import fs from "fs";
 import path from "path";
-import { writeTextFile, writeJsonFile } from "./fs.js";
+import { writeJsonFile, writeTextFile } from "./fs.js";
 
 export function getPackageVersion() {
     const root = getPackageRoot();
@@ -21,7 +21,7 @@ export function getPackageManager() {
     // Check for lockfiles in target directory
     if (fs.existsSync(path.join(process.cwd(), "pnpm-lock.yaml")) || fs.existsSync(path.join(process.cwd(), "pnpm-workspace.yaml"))) return "pnpm";
     if (fs.existsSync(path.join(process.cwd(), "yarn.lock"))) return "yarn";
-  
+
     return "npm";
 }
 
@@ -74,28 +74,57 @@ export function getDependencyVersions() {
     const dependencies = pkg.dependencies || {};
 
     return {
-        // Backend dependencies
+        // ── Backend Core ──────────────────────────────────────────
         "fastify": dependencies["fastify"] || "^5.0.0",
         "@fastify/cors": dependencies["@fastify/cors"] || "^11.0.0",
+        "@fastify/swagger": dependencies["@fastify/swagger"] || "^9.0.0",
+        "@fastify/swagger-ui": dependencies["@fastify/swagger-ui"] || "^5.0.0",
+        "@fastify/rate-limit": dependencies["@fastify/rate-limit"] || "^10.0.0",
+        "@fastify/static": dependencies["@fastify/static"] || "^8.0.0",
         "zod": dependencies["zod"] || "^3.24.2",
 
+        // ── Database / ORM ────────────────────────────────────────
+        "kysely": dependencies["kysely"] || "^0.27.0",
+        "typeorm": dependencies["typeorm"] || "^0.3.0",
+        "reflect-metadata": dependencies["reflect-metadata"] || "^0.2.0",
+        "pg": dependencies["pg"] || "^8.13.0",
+        "better-sqlite3": dependencies["better-sqlite3"] || "^11.0.0",
+
+        // ── Authentication ────────────────────────────────────────
+        "bcrypt": dependencies["bcrypt"] || "^5.1.0",
+        "@types/bcrypt": devDependencies["@types/bcrypt"] || "^5.0.0",
+        "jsonwebtoken": dependencies["jsonwebtoken"] || "^9.0.0",
+        "@types/jsonwebtoken": devDependencies["@types/jsonwebtoken"] || "^9.0.0",
+
+        // ── Logging ───────────────────────────────────────────────
+        "pino": dependencies["pino"] || "^9.0.0",
+        "pino-pretty": devDependencies["pino-pretty"] || "^12.0.0",
+
+        // ── Validation ────────────────────────────────────────────
+        "@fastify/type-provider-typebox": dependencies["@fastify/type-provider-typebox"] || "^5.0.0",
+
         // Backend devDependencies
         "@types/node": devDependencies["@types/node"] || "^22.13.4",
         "tsx": devDependencies["tsx"] || "^4.19.4",
         "typescript": devDependencies["typescript"] || "^5.9.3",
-        "vitest-backend": devDependencies["vitest"] || "^3.0.5", // Renamed to avoid conflict
+        "vitest-backend": devDependencies["vitest"] || "^3.0.5",
 
-        // Frontend dependencies
+        // ── Frontend Core ─────────────────────────────────────────
         "@vitejs/plugin-react": dependencies["@vitejs/plugin-react"] || "^5.0.0",
         "vite": dependencies["vite"] || "^7.0.0",
         "react": dependencies["react"] || "^19.0.0",
         "react-dom": dependencies["react-dom"] || "^19.0.0",
         "lucide-react": dependencies["lucide-react"] || "^0.468.0",
-        
+        "react-router-dom": dependencies["react-router-dom"] || "^7.0.0",
+        "@tanstack/react-query": dependencies["@tanstack/react-query"] || "^5.0.0",
+
         // Frontend devDependencies
         "@types/react": devDependencies["@types/react"] || "^19.0.0",
         "@types/react-dom": devDependencies["@types/react-dom"] || "^19.0.0",
-        "vitest-frontend": devDependencies["vitest"] || "^3.0.5", // Renamed to avoid conflict
+        "vitest-frontend": devDependencies["vitest"] || "^3.0.5",
+
+        // ── Testing ───────────────────────────────────────────────
+        "@playwright/test": devDependencies["@playwright/test"] || "^1.50.0",
     };
 }
 
@@ -113,7 +142,7 @@ interface PackageJson {
   }
 
 export function mergePackageJson(targetPath: string, sourcePath: string): void {
-    let targetPkg: PackageJson = {}; 
+    let targetPkg: PackageJson = {};
     if (fs.existsSync(targetPath)) {
         try {
             targetPkg = JSON.parse(fs.readFileSync(targetPath, "utf8"));
@@ -123,7 +152,7 @@ export function mergePackageJson(targetPath: string, sourcePath: string): void {
     }
 
     const sourcePkg: PackageJson = JSON.parse(fs.readFileSync(sourcePath, "utf8"));
-  
+
   type PackageMap = Record<string, string>;
   const sanitizeDeps = (deps: PackageMap | Record<string, unknown> | undefined): Record<string, string> | undefined => {
       if (!deps) return deps as undefined;
@@ -159,7 +188,7 @@ export function mergePackageJson(targetPath: string, sourcePath: string): void {
   // Merge scripts
   const pkgMgr = getPackageManager();
   const runCmd = pkgMgr === "yarn" ? "yarn" : (pkgMgr === "pnpm" ? "pnpm" : "npm run");
-  
+
   targetPkg.scripts = {
       ...targetPkg.scripts,
       "enderun:status": "agent-enderun status",
@@ -242,12 +271,12 @@ export function sanitizeJson(obj: unknown, targetScope = ""): unknown {
             if (typeof value === "string" && value.startsWith("agent-enderun-")) {
                 finalValue = value.replace("agent-enderun-", `${scopeName}-`);
             }
-      
+
             // Handle agent-enderun -> target (ONLY for the package name)
             if (key === "name" && value === "agent-enderun") {
                 finalValue = scopeName;
             }
-      
+
             // Preserve agent-enderun in dependencies and bin
             // (No action needed as finalKey/finalValue default to original)
 
@@ -265,7 +294,7 @@ export function sanitizeJson(obj: unknown, targetScope = ""): unknown {
 
 export function deepCleanProtocols(dir: string, targetScope = ""): void {
     if (!fs.existsSync(dir)) return;
-  
+
     const entries = fs.readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
         const fullPath = path.join(dir, entry.name);

package/src/modules/adapters/definitions.ts

@@ -3,6 +3,7 @@ import type { AdapterConfig, AdapterId } from "./types.js";
 import { addMcpServerToClaude, findClaudeConfigPath } from "../../cli/utils/claude.js";
 import { writeJsonFile } from "../../shared/fs.js";
 import { registerGlobalAntigravityPlugins } from "./shared.js";
+import { unifiedAdapterPath, UNIFIED_ADAPTER_SLUG } from "../../shared/constants.js";
 
 /**
  * Mapped Adapter Configurations
@@ -16,7 +17,7 @@ export const ADAPTER_CONFIGS: Record<AdapterId, AdapterConfig> = {
         role: "commander",
         templateDir: ".enderun",
         nestedDirs: ["agents", "rules"],
-        agentsDir: ".gemini/agents",
+        agentsDir: ".gemini/agents", // Use unified path
         agentsExt: ".md"
     },
     claude: {
@@ -38,7 +39,7 @@ export const ADAPTER_CONFIGS: Record<AdapterId, AdapterConfig> = {
         role: "researcher",
         templateDir: ".enderun",
         nestedDirs: ["rules"],
-        agentsDir: ".grok",
+        agentsDir: ".grok/agents",
         agentsExt: ".md"
     },
     cursor: {
@@ -60,7 +61,7 @@ export const ADAPTER_CONFIGS: Record<AdapterId, AdapterConfig> = {
         role: "implementer",
         templateDir: ".enderun",
         nestedDirs: ["skills", "rules", "instructions"],
-        agentsDir: ".agents/skills",
+        agentsDir: ".agents/instructions",
         agentsExt: ".md"
     },
     "antigravity-cli": {

package/src/modules/agents/definitions.ts

@@ -6,6 +6,7 @@
 import fs from "fs";
 import path from "path";
 import { AgentDefinition } from "./types.js";
+import { getPackageRoot } from "../../cli/utils/pkg.js";
 
 // Import individual agent definitions
 import { manager } from "./registry/manager.js";
@@ -124,7 +125,7 @@ function resolveModel(
 }
 
 /** Build a flat system prompt string from structured instructions */
-function buildSystemPrompt(ag: AgentDefinition, baseKnowledgeDir: string = path.join(process.cwd(), "templates/standards")): string {
+function buildSystemPrompt(ag: AgentDefinition, baseKnowledgeDir: string = path.join(getPackageRoot(), "templates/standards")): string {
     const lines: string[] = [
         "# Identity",
         ag.instructions.identity,

package/src/modules/agents/registry/analyst.ts

@@ -10,7 +10,7 @@ export const analyst: AgentDefinition = {
   "Specs verification and Contract Audit specialist. " +
   "Audits truth and contracts within the Army.",
     capability: 9,
-    tier: "core",
+    tier: "recon",
     tags: ["core", "strategy"],
     stateMachine: STATE_MACHINE,
     tools: [

package/src/modules/agents/registry/architect.ts

@@ -42,5 +42,6 @@ export const architect: AgentDefinition = {
             "CONTRACT STABILITY: Validate 'contract.version.json' consistency before and after every schema change.",
             "GOVERNANCE READ: Always read architecture governance docs before making design decisions.",
         ],
+        knowledgeFiles: ["architecture-standards.md"],
     },
 };

package/src/modules/agents/registry/backend.ts

@@ -7,8 +7,8 @@ export const backend: AgentDefinition = {
     displayName: "Backend Specialist",
     role: "Backend Development",
     description:
-  "Server logic, Databases, and API implementation specialist. " +
-  "Owns the Database Management & Migrations discipline.",
+  "Server logic and API implementation specialist. " +
+  "Owns the API contracts and business logic implementation.",
     capability: 9,
     tier: "core",
     tags: ["core", "logic"],
@@ -28,20 +28,21 @@ export const backend: AgentDefinition = {
     instructions: {
         identity: "Backend Domain Engineer and Database Management Owner",
         mission:
-    "Deliver reliable, type-safe server logic that upholds Kysley-only " +
+    "Deliver reliable, type-safe server logic that upholds Kysely/TypeORM " +
     "data access and strict repository/service separation.",
         chainOfThought: "1. Analyze: Read the task, context, and relevant governance documents.\n" +
                         "2. Validate: Cross-reference with project rules, contracts, and architecture standards.\n" +
                         "3. Plan: Break down the task into small, atomic, and verifiable steps.\n" +
                         "4. Execute: Perform the task using approved tools, adhering to quality and security constraints.",
         rules: [
-            "BRANDED TYPES: Use branded types for all domain IDs — never raw string or number.",
-            "KYSELY ONLY: All database access via Kysely — raw SQL strings are unconditionally forbidden.",
+            "STRICT BRANDED TYPES: Absolute enforcement of branded types for ALL domain IDs (e.g., UserId, ProjectId). Raw 'string' or 'number' for IDs is a Nizam violation and will cause task rejection.",
+            "KYSELY ONLY: All database access via Kysely — raw SQL strings are unconditionally forbidden. No exceptions.",
             "LAYER SEPARATION: Isolate queries in repository/service layers — direct DB calls in controllers are forbidden.",
             "ERROR HANDLING: Wrap all async logic in robust try/catch blocks with typed error responses.",
+            "PII PROTECTION: Never log or store real user data. Use anonymized hashes for debugging tasks.",
             "HIGH-RISK OPS: Refuse User/Role management, bulk deletes, schema alterations, and billing changes autonomously. " +
       "Return a standard refusal, send a managerApproval request to @manager, and shift to WAITING status.",
         ],
-        knowledgeFiles: ["skills/database_management.md"],
+        knowledgeFiles: ["crud-governance.md", "kysely-standards.md", "typeorm-standards.md"],
     },
 };

package/src/modules/agents/registry/database.ts

@@ -7,8 +7,8 @@ export const database: AgentDefinition = {
     displayName: "Database Specialist",
     role: "Data Management",
     description:
-  "SQL Schema design and Query Optimization specialist. " +
-  "Manages data as the empire's treasury — secure and optimized.",
+  "SQL Schema design, migration, and query optimization specialist. " +
+  "Owns the database schema, migrations, and data integrity.",
     capability: 9,
     tier: "core",
     tags: ["core", "data"],
@@ -21,6 +21,7 @@ export const database: AgentDefinition = {
         "list_dir",
         "grep_search",
         "read_project_memory",
+        "send_agent_message",
     ],
     instructions: {
         identity: "Database Architect and Migration Integrity Owner",
@@ -37,6 +38,6 @@ export const database: AgentDefinition = {
             "DETERMINISTIC MIGRATIONS: Every migration must be reversible and produce identical results across environments.",
             "PERFORMANCE FIRST: Design indexes proactively — never retroactively after a performance incident.",
         ],
-        knowledgeFiles: ["skills/database_management.md"],
+        knowledgeFiles: ["kysely-standards.md", "typeorm-standards.md", "quality-standards.md"],
     },
 };

package/src/modules/agents/registry/devops.ts

@@ -37,6 +37,6 @@ export const devops: AgentDefinition = {
             "ENVIRONMENT ISOLATION: All variables managed via '.env' — hardcoded secrets trigger immediate escalation.",
             "NO UNTRACKED DEPLOYMENTS: Every deployment must be declared, versioned, and traceable.",
         ],
-        knowledgeFiles: ["skills/devops_infrastructure.md"],
+        knowledgeFiles: ["deployment-standards.md"],
     },
 };

package/src/modules/agents/registry/git.ts

@@ -10,7 +10,7 @@ export const git: AgentDefinition = {
   "Git flow, Branching, and Atomic Commit master. " +
   "Manages the scrolls of history.",
     capability: 9,
-    tier: "core",
+    tier: "recon",
     tags: ["core", "logistics"],
     stateMachine: STATE_MACHINE,
     tools: [

package/src/modules/agents/registry/manager.ts

@@ -40,8 +40,9 @@ export const manager: AgentDefinition = {
                         "4. Execute: Delegate sub-tasks to appropriate specialists and verify compliance at each step.",
         rules: [
             "ABSOLUTE COMPLIANCE: Freeze project and block task on any Nizam violation " +
-      "(e.g. 'any' type, 'console.log', file overwrite). No further action until breach is purged.",
-            "PHASE WALL: Gate every phase transition — reject if even one TODO or lint error exists in scope.",
+      "(e.g. 'any' type, 'console.log', PII leakage, or raw ID usage). No further action until breach is purged.",
+            "PII AUDIT: Proactively scan all specialist logs and memories for PII (Emails, Names). Purge immediately if detected.",
+            "PHASE WALL: Gate every phase transition — reject if even one TODO, lint error, or unbranded ID exists in scope.",
             "ORCHESTRATION AUDIT: Audit every specialist message for constitutional compliance before delegating next sub-task.",
             "STRATEGIC RECIPES: Direct specialists to '.enderun/prompts/' for all refactor, bug-fix, or feature tasks.",
             "SURGICAL PRECISION: Reject any full-file overwrite proposal unless the file is under 50 lines.",

package/src/modules/agents/registry/native.ts

@@ -10,7 +10,7 @@ export const native: AgentDefinition = {
   "Desktop apps and system-level logic specialist. " +
   "Handles OS deep layers with paramount security.",
     capability: 9,
-    tier: "core",
+    tier: "recon",
     tags: ["core", "native"],
     stateMachine: STATE_MACHINE,
     tools: [

package/src/modules/agents/registry/quality.ts

@@ -21,6 +21,7 @@ export const quality: AgentDefinition = {
         "read_project_memory",
         "get_memory_insights",
         "run_tests",
+        "check_lint",
         "log_agent_action",
         "send_agent_message",
     ],

package/src/modules/agents/registry/security.ts

@@ -17,6 +17,7 @@ export const security: AgentDefinition = {
         "read_file",
         "replace_text",
         "grep_search",
+        "send_agent_message",
         "read_project_memory",
         "get_memory_insights",
         "log_agent_action",