arkgate 4.8.7 → 4.8.9

package/bin/ark-layer-match.mjs

@@ -362,15 +362,27 @@ export function crossSliceEdgeAllowed(allowedCrossSlice, fromSlice, toSlice) {
  * Fail-closed stays fail-closed: absent evidence denies. What changed in 4.8.4
  * is what counts as evidence — a declared shared root, or a declared directed
  * cross-slice edge, is the repo telling us its design, so it is no longer
- * "unclassifiable". Order: no paths → no slice folders → a side that is neither
- * in a slice nor declared shared → same slice → declared cross edge → deny.
+ * "unclassifiable". Order: no fromPath → no slice folders → intent (no toPath):
+ * shared-root allow / slice fail-closed → a side that is neither in a slice nor
+ * declared shared → same slice → declared cross edge → deny.
+ *
+ * Intent/event names are not files. Callers pass fromPath only and must not
+ * invent a toPath (that would mis-slice). A declared shared root is classified
+ * the same way as on import edges.
  */
 export function peerIsolationDecision(input) {
-    if (!input.fromPath || !input.toPath)
+    if (!input.fromPath)
         return { denied: true, reason: 'missing-path' };
     if (input.folderCount <= 0)
         return { denied: true, reason: 'no-slice-folders' };
     const fromClassified = Boolean(input.fromSlice) || input.fromShared === true;
+    if (!input.toPath) {
+        if (!fromClassified)
+            return { denied: true, reason: 'unclassifiable-path' };
+        if (!input.fromSlice)
+            return { denied: false };
+        return { denied: true, reason: 'missing-path' };
+    }
     const toClassified = Boolean(input.toSlice) || input.toShared === true;
     if (!fromClassified || !toClassified)
         return { denied: true, reason: 'unclassifiable-path' };
@@ -387,8 +399,9 @@ export function peerIsolationDecision(input) {
 /**
  * Boolean face of {@link peerIsolationDecision}, kept for parity consumers.
  *
- * Fail-closed: missing path, no classifiable folders, or unclassifiable either
- * side → deny. Same-slice → allow (return false). Cross-slice → deny unless the
+ * Fail-closed: missing fromPath, no classifiable folders, or unclassifiable
+ * either side → deny. Intent refs (no toPath) allow only a declared shared
+ * root. Same-slice → allow (return false). Cross-slice → deny unless the
  * rule declared that directed edge.
  */
 export function peerIsolationMustDeny(input) {
@@ -426,9 +439,11 @@ export function peerIsolationDenyExplanation(reason, context) {
  *   Same-layer is always allowed (historical short-circuit).
  * - `peerIsolation: true` + `allowed: false`: deny only when importer and importee
  *   resolve to **different** slice ids (same or cross layer). Same-slice → allow.
- *   Missing paths, no slice folders, or unclassifiable slices → **fail-closed**
- *   (deny): isolation is configured, so insufficient evidence must not silently
- *   allow a possible cross-slice edge.
+ *   File imports pass fromPath + toPath. Intent references pass fromPath only.
+ *   A declared shared root is classified (no denial). Missing fromPath, no slice
+ *   folders, or unclassifiable slices → **fail-closed** (deny): isolation is
+ *   configured, so insufficient evidence must not silently allow a possible
+ *   cross-slice edge.
  */
 export function findDeniedEdgeRule(rules, from, to, options) {
     return findDeniedEdgeDecision(rules, from, to, options)?.rule;
@@ -448,8 +463,8 @@ export function findDeniedEdgeDecision(rules, from, to, options) {
             const fromPath = options?.fromPath;
             const toPath = options?.toPath;
             const folders = resolveSliceFolders(rule, from, options?.layers);
-            const fromSlice = fromPath && toPath ? sliceIdForPath(fromPath, folders) : undefined;
-            const toSlice = fromPath && toPath ? sliceIdForPath(toPath, folders) : undefined;
+            const fromSlice = fromPath ? sliceIdForPath(fromPath, folders) : undefined;
+            const toSlice = toPath ? sliceIdForPath(toPath, folders) : undefined;
             const decision = peerIsolationDecision({
                 fromPath,
                 toPath,

package/bin/ark.mjs

@@ -39,6 +39,36 @@ import { setupUsage, setupUsageAll, upgradeUsage } from './lib/first-run-help.mj
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const arkCheck = path.join(here, 'ark-check.mjs');
+const arkDashboard = path.join(here, 'ark-dashboard.mjs');
+const dashboardHelp = `arkgate dashboard (alias ark dashboard) — observability TUI.
+Usage: arkgate dashboard [--url <snapshot-url>] [--interval <ms>]
+Polls an ArkRun inspector; it does not start the kernel.`;
+
+function withDashboardHelp(text, detailed) {
+  if (detailed) {
+    return text
+      .replace(
+        '  arkgate agents-md [--root',
+        '  arkgate dashboard [--url <snapshot-url>] [--interval <ms>]\n  arkgate agents-md [--root'
+      )
+      .replace(
+        '  agents-md Version-matched',
+        '  dashboard  ANSI observability TUI against a running ArkRun inspector (spawns ark-dashboard).\n  agents-md Version-matched'
+      );
+  }
+  return text.replace(
+    '  arkgate-check --doctor     status — one next step\n',
+    '  arkgate-check --doctor     status — one next step\n  arkgate dashboard         observability TUI (inspector)\n'
+  );
+}
+
+function runDashboard(passthroughArgs) {
+  const result = spawnSync(process.execPath, [arkDashboard, ...passthroughArgs], {
+    stdio: 'inherit',
+    encoding: 'utf8',
+  });
+  return result.status ?? 1;
+}
 
 /**
  * Day-zero architecture picture: freeze origin under `.ark/reports/` as soon as
@@ -93,6 +123,7 @@ function parseArgs(argv) {
     help: false,
     all: false,
     version: false,
+    passthrough: [],
   };
 
   const requireValue = (flag, index) => {
@@ -147,7 +178,14 @@ function parseArgs(argv) {
     else if (arg === '--help' || arg === '-h' || arg === 'help') args.help = true;
     else if (arg === '--all') args.all = true;
     else if (arg === '--version' || arg === '-V') args.version = true;
-    else if (!arg.startsWith('-') && args.command === undefined) args.command = arg;
+    else if (!arg.startsWith('-') && args.command === undefined) {
+      args.command = arg;
+      // Dashboard owns its flags (--url/--interval); pass the rest through untouched.
+      if (arg === 'dashboard') {
+        args.passthrough = argv.slice(i + 1);
+        break;
+      }
+    }
     else throw new Error(`Unknown argument: ${arg}. Run arkgate --help for usage.`);
   }
 
@@ -782,11 +820,21 @@ async function main() {
     console.log(upgradeUsage());
     return 0;
   }
+  if (args.command === 'dashboard' && args.passthrough.some((arg) => ['--help', '-h', 'help'].includes(arg))) {
+    console.log(dashboardHelp);
+    return 0;
+  }
   if (args.help || !args.command) {
-    console.log(args.all ? setupUsageAll() : setupUsage());
+    console.log(
+      withDashboardHelp(args.all ? setupUsageAll() : setupUsage(), Boolean(args.all))
+    );
     return 0;
   }
 
+  if (args.command === 'dashboard') {
+    return runDashboard(args.passthrough);
+  }
+
   if (args.requireWriteHook && !['start', 'init'].includes(args.command)) {
     console.error('--require-write-hook is supported by ark start and ark init.');
     return 2;
@@ -913,7 +961,7 @@ async function main() {
   }
 
   console.error(`Unknown command: ${args.command}`);
-  console.error(setupUsage());
+  console.error(withDashboardHelp(setupUsage(), false));
   return 2;
 }
 

package/bin/lib/agent-homes.mjs

@@ -108,7 +108,7 @@ function usesDefaultHome(spec, env, homeDir) {
 
 function skillsDirFor(host, env = process.env) {
   const spec = HOSTS[host];
-  return path.join(resolveHomeDir(spec, env), 'skills');
+  return path.join(resolveHomeDir(spec, env, os.homedir()), 'skills');
 }
 
 function readHomeCatalogFloor(skillsDir) {