claudenv 1.3.0 → 1.3.2

package/src/capabilities.js

@@ -0,0 +1,164 @@
+/**
+ * capabilities.js — `claudenv capabilities` (alias `caps`).
+ *
+ * Builds a structured map of everything the current claudenv install offers so
+ * that Claude can "connect to claudenv, understand it, and extend itself":
+ * installed skills, CLI surface, memory state, the active workspace + its
+ * connectors, the kimi-webbridge browser daemon, project MCP servers, and the
+ * skills registry. The harness skill runs this first as its self-introspection
+ * step.
+ *
+ * Everything degrades gracefully — a missing piece is reported, never thrown.
+ */
+
+import { readFile, readdir, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import {
+  claudenvHome,
+  memoriesDir,
+  globalDecisionsDir,
+  indexMdPath,
+  activeWorkspaceId,
+  workspaceConnectorsDir,
+  skillsRegistryCachePath,
+} from './memory-paths.js';
+import { listInstalledSkills } from './skills-registry.js';
+import { BUNDLED_CATALOG } from './bundled-catalog.js';
+import { kimiStatus } from './kimi.js';
+
+const CLI_SURFACE = [
+  { cmd: 'claudenv loop', what: 'autonomous improvement loop (goal = law)' },
+  { cmd: 'claudenv autonomy', what: 'autonomy profiles (safe/moderate/full/ci)' },
+  { cmd: 'claudenv memory', what: 'global memory: init / index / show / edit' },
+  { cmd: 'claudenv decisions', what: 'vibe-decisions: list / show / search / archive' },
+  { cmd: 'claudenv canon', what: 'personal canon of references' },
+  { cmd: 'claudenv workspace', what: 'isolated per-company/context memory spaces' },
+  { cmd: 'claudenv source', what: 'data-source connectors of the active workspace' },
+  { cmd: 'claudenv skills', what: 'discover & install skills (search / list / add / info / refresh)' },
+  { cmd: 'claudenv capabilities', what: 'this self-introspection map' },
+  { cmd: 'claudenv doctor', what: 'health-check the setup' },
+];
+
+async function pathExists(p) {
+  try {
+    await stat(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function countDecisions() {
+  try {
+    const names = await readdir(globalDecisionsDir());
+    return names.filter((n) => n.endsWith('.md')).length;
+  } catch {
+    return 0;
+  }
+}
+
+async function readActiveConnectors() {
+  const id = activeWorkspaceId();
+  if (!id) return { active: null, connectors: [] };
+  let files = [];
+  try {
+    files = (await readdir(workspaceConnectorsDir(id))).filter((f) => f.endsWith('.md'));
+  } catch {
+    return { active: id, connectors: [] };
+  }
+  return { active: id, connectors: files.map((f) => f.replace(/\.md$/, '')) };
+}
+
+async function readProjectMcp(cwd) {
+  try {
+    const parsed = JSON.parse(await readFile(join(cwd, '.mcp.json'), 'utf-8'));
+    return Object.keys(parsed.mcpServers || {});
+  } catch {
+    return [];
+  }
+}
+
+async function countCache() {
+  try {
+    const arr = JSON.parse(await readFile(skillsRegistryCachePath(), 'utf-8'));
+    return Array.isArray(arr) ? arr.length : 0;
+  } catch {
+    return 0;
+  }
+}
+
+/**
+ * Build the capability map.
+ * @param {object} [opts]
+ * @param {string} [opts.cwd] - project dir (defaults to process.cwd())
+ * @param {string} [opts.claudeHome] - override ~/.claude (for tests)
+ * @param {string} [opts.version] - claudenv version string
+ */
+export async function buildCapabilityMap(opts = {}) {
+  const cwd = opts.cwd || process.cwd();
+  const installed = await listInstalledSkills(opts.claudeHome);
+  const ws = await readActiveConnectors();
+
+  return {
+    version: opts.version || null,
+    node: process.version,
+    cli: CLI_SURFACE,
+    skills: {
+      installed,
+      count: installed.length,
+    },
+    memory: {
+      home: claudenvHome(),
+      indexExists: await pathExists(indexMdPath()),
+      memoriesExists: await pathExists(memoriesDir()),
+      decisions: await countDecisions(),
+    },
+    workspace: ws,
+    kimi: kimiStatus(),
+    mcp: { project: await readProjectMcp(cwd) },
+    registry: { bundled: BUNDLED_CATALOG.length, cached: await countCache() },
+  };
+}
+
+/** Render the capability map as a compact human-readable report. */
+export function formatCapabilities(map) {
+  const L = [];
+  L.push(`claudenv capabilities${map.version ? ` v${map.version}` : ''}  (Node ${map.node})`);
+  L.push('');
+
+  L.push(`Skills installed (~/.claude/skills): ${map.skills.count}`);
+  for (const s of map.skills.installed) {
+    L.push(`  - ${s.slug}${s.hasSkillMd ? '' : '  (no SKILL.md)'}`);
+  }
+  if (map.skills.count === 0) L.push('  (none — try `claudenv skills search <task>`)');
+  L.push('');
+
+  const k = map.kimi;
+  const kimiState = !k.installed
+    ? 'not installed (`claudenv skills add kimi-webbridge`)'
+    : k.running && k.extensionConnected
+      ? 'healthy (daemon + extension connected)'
+      : k.running
+        ? 'daemon up, browser extension NOT connected'
+        : 'installed, daemon stopped (`~/.kimi-webbridge/bin/kimi-webbridge start`)';
+  L.push(`Browser automation (kimi-webbridge): ${kimiState}`);
+  L.push('');
+
+  L.push('Memory & workspaces:');
+  L.push(`  global memory: ${map.memory.memoriesExists ? 'present' : 'not initialised (`claudenv memory init`)'}, ${map.memory.decisions} decisions, INDEX.md ${map.memory.indexExists ? 'present' : 'absent'}`);
+  if (map.workspace.active) {
+    L.push(`  active workspace: ${map.workspace.active} — connectors: ${map.workspace.connectors.length ? map.workspace.connectors.join(', ') : 'none'}`);
+  } else {
+    L.push('  active workspace: none (`claudenv workspace use <id>`)');
+  }
+  L.push('');
+
+  L.push(`Project MCP servers (.mcp.json): ${map.mcp.project.length ? map.mcp.project.join(', ') : 'none'}`);
+  L.push(`Skills registry: ${map.registry.bundled} curated + ${map.registry.cached} cached live`);
+  L.push('');
+
+  L.push('CLI surface:');
+  for (const c of map.cli) L.push(`  ${c.cmd.padEnd(24)} ${c.what}`);
+
+  return L.join('\n');
+}

package/src/doctor.js

@@ -13,7 +13,11 @@ import {
   memoriesDir,
   globalDecisionsDir,
   indexMdPath,
+  activeWorkspaceId,
+  workspaceConnectorsDir,
 } from './memory-paths.js';
+import { scanForSecretLeaks } from './sources.js';
+import { kimiStatus } from './kimi.js';
 
 const OK = '[OK]  ';
 const WARN = '[WARN]';
@@ -103,6 +107,34 @@ async function vibeDecisionsCheck() {
   };
 }
 
+async function harnessSkillCheck() {
+  const skill = join(homedir(), '.claude', 'skills', 'harness', 'SKILL.md');
+  if (await pathExists(skill)) {
+    return { status: OK, msg: 'harness skill installed globally (self-extension)' };
+  }
+  return {
+    status: WARN,
+    msg: 'harness skill not installed — run `claudenv install --force`',
+  };
+}
+
+async function kimiBridgeCheck() {
+  const k = kimiStatus();
+  if (!k.installed) {
+    return {
+      status: WARN,
+      msg: 'kimi-webbridge not installed — optional browser automation (`claudenv skills add kimi-webbridge`)',
+    };
+  }
+  if (k.running && k.extensionConnected) {
+    return { status: OK, msg: 'kimi-webbridge healthy (daemon + extension connected)' };
+  }
+  if (k.running) {
+    return { status: WARN, msg: 'kimi-webbridge daemon up, browser extension not connected' };
+  }
+  return { status: WARN, msg: 'kimi-webbridge installed, daemon stopped (`kimi-webbridge start`)' };
+}
+
 async function projectHooksCheck() {
   const settingsPath = join(process.cwd(), '.claude', 'settings.json');
   if (!(await pathExists(settingsPath))) {
@@ -151,6 +183,28 @@ async function countDecisionsCheck() {
   return { status: OK, msg: `${count} global decisions logged` };
 }
 
+async function workspaceLeakCheck() {
+  const id = activeWorkspaceId();
+  if (!id) return { status: OK, msg: 'no active workspace — secret-leak scan skipped' };
+  let files;
+  try {
+    files = (await readdir(workspaceConnectorsDir(id))).filter((f) => f.endsWith('.md'));
+  } catch {
+    return { status: OK, msg: `workspace "${id}": no connectors to scan` };
+  }
+  const leaks = [];
+  for (const f of files) {
+    try {
+      const found = scanForSecretLeaks(await readFile(join(workspaceConnectorsDir(id), f), 'utf-8'));
+      if (found.length) leaks.push(`${f}:${found[0].line}`);
+    } catch { /* skip */ }
+  }
+  if (leaks.length) {
+    return { status: FAIL, msg: `secret values in workspace memory: ${leaks.join(', ')} — move to .env.local` };
+  }
+  return { status: OK, msg: `workspace "${id}": connector memory clean (no secret values)` };
+}
+
 export async function runDoctor() {
   const checks = [
     await nodeVersionCheck(),
@@ -159,9 +213,12 @@ export async function runDoctor() {
     await memoriesLayoutCheck(),
     await indexSizeCheck(),
     await vibeDecisionsCheck(),
+    await harnessSkillCheck(),
+    await kimiBridgeCheck(),
     await projectHooksCheck(),
     await pythonModuleCheck(),
     await countDecisionsCheck(),
+    await workspaceLeakCheck(),
   ];
 
   let hasFail = false;

package/src/installer.js

@@ -135,8 +135,12 @@ export async function uninstallGlobal(options = {}) {
     join(targetBase, 'commands', 'decisions.md'),
     join(targetBase, 'commands', 'canon.md'),
     join(targetBase, 'commands', 'just-code.md'),
+    join(targetBase, 'commands', 'add-source.md'),
+    join(targetBase, 'commands', 'harness.md'),
     join(targetBase, 'skills', 'claudenv'),
     join(targetBase, 'skills', 'vibe-decisions'),
+    join(targetBase, 'skills', 'source-connector'),
+    join(targetBase, 'skills', 'harness'),
   ];
 
   for (const target of targets) {

package/src/kimi.js

@@ -0,0 +1,43 @@
+/**
+ * kimi-webbridge status helper — shared by `claudenv capabilities` and
+ * `claudenv doctor` so the daemon shell-out lives in exactly one place.
+ *
+ * kimi-webbridge drives the user's real browser via a local daemon. The binary
+ * always lives at ~/.kimi-webbridge/bin/kimi-webbridge (per its operations.md).
+ */
+
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { execSync } from 'node:child_process';
+
+export function kimiBinPath() {
+  return join(homedir(), '.kimi-webbridge', 'bin', 'kimi-webbridge');
+}
+
+/**
+ * Resolve the daemon state. Never throws.
+ * @returns {{installed: boolean, running: boolean, extensionConnected: boolean, version: string|null}}
+ */
+export function kimiStatus() {
+  const bin = kimiBinPath();
+  if (!existsSync(bin)) {
+    return { installed: false, running: false, extensionConnected: false, version: null };
+  }
+  try {
+    const out = execSync(`"${bin}" status`, {
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 5000,
+    }).trim();
+    const json = JSON.parse(out);
+    return {
+      installed: true,
+      running: !!json.running,
+      extensionConnected: !!json.extension_connected,
+      version: json.version || null,
+    };
+  } catch {
+    return { installed: true, running: false, extensionConnected: false, version: null };
+  }
+}

package/src/loop.js

@@ -246,10 +246,32 @@ Generated by claudenv loop. Goal: General improvement.
 7. Commit the improvement plan: \`git add .claude/improvement-plan.md && git commit -m "Add improvement plan"\``;
 }
 
+/**
+ * Orchestration directive injected into the execution prompt. Lives in the
+ * USER prompt (not the system prompt) on purpose: the Workflow tool's opt-in
+ * keys on the user message, so the literal word "workflow" here is what makes
+ * the tool actually reachable — a system-prompt fragment alone does not
+ * trigger it (measured). Guarded by the 3+-independent-sub-tasks condition so
+ * trivial or sequential items stay single-threaded (fan-out costs ~15×).
+ */
+const ORCHESTRATION_DIRECTIVE = `## Parallel decomposition (dynamic workflow)
+
+If — and ONLY if — the item you picked naturally decomposes into 3 or more
+INDEPENDENT sub-tasks (the same operation across many files, a multi-dimension
+review/audit, several independent builds-then-judge), you MUST run a dynamic
+**workflow** via the Workflow tool to fan them out instead of doing them one by
+one. Keep the workflow small (cap concurrent agents to a handful) — it runs
+under this iteration's budget and multi-agent fan-out costs ~15× the tokens.
+For a single file, strictly sequential work, or trivial edits, do NOT use a
+workflow — stay single-threaded. See the dynamic-workflows skill for patterns.
+If the Workflow tool is unavailable in this run, fall back to a few parallel
+Agent calls for the same fan-out.`;
+
 /**
  * Build the execution prompt for iterations 1-N.
+ * Exported for testing (and to let the faithful smoke test reuse the real prompt).
  */
-function buildExecutionPrompt(iteration, maxIterations, goal) {
+export function buildExecutionPrompt(iteration, maxIterations, goal) {
   const maxLine = maxIterations ? ` (iteration ${iteration} of ${maxIterations})` : ` (iteration ${iteration})`;
 
   if (goal) {
@@ -273,6 +295,8 @@ GOAL: ${goal}
 5. Commit all changes with a descriptive message
 6. Report what you did in a brief summary
 
+${ORCHESTRATION_DIRECTIVE}
+
 ## Critical rules
 - You MUST implement real changes. Writing docs or analysis alone does NOT count.
 - Create files, write code, build features, install dependencies — whatever it takes.
@@ -301,6 +325,8 @@ GOAL: ${goal}
 5. Commit all changes with a descriptive message
 6. Report what you did in a brief summary
 
+${ORCHESTRATION_DIRECTIVE}
+
 ## Important rules
 - Do NOT delete files unless the deletion IS the improvement itself
 - Do NOT make changes beyond the single item you picked

package/src/memory-context.js

@@ -1,11 +1,13 @@
 /**
  * Builds the `--append-system-prompt` payload for `claudenv loop`.
  *
- * Three composable fragments, joined with blank lines:
+ * Four composable fragments, joined with blank lines:
  *
  *   1. Autonomy=law directive from the goal (existing 1.2.x behavior)
  *   2. Vibe-decisions loop-mode marker so the skill skips pause-and-ask
- *   3. Memory briefing — current INDEX.md contents, capped for cache stability
+ *   3. Dynamic-workflows loop-mode marker so the loop may fan out decomposable
+ *      plan items via the Workflow tool (with a hard fan-out cap)
+ *   4. Memory briefing — current INDEX.md contents, capped for cache stability
  *
  * Cache discipline: the function is pure on its inputs (goal + file state at
  * call time). Loop.js calls it once per iteration but with stable inputs
@@ -23,6 +25,31 @@ immediately (Write tool to /memories/decisions/<date>-<slug>.md with the
 __VIBE_DECISION__ marker), continue with code. Do NOT pause for user
 confirmation. Do NOT ask "делать так?". The goal is law.`;
 
+const WORKFLOW_LOOP_FRAGMENT = `## Dynamic-workflows mode (loop)
+
+When a plan item genuinely splits into many INDEPENDENT sub-tasks (the same
+operation over many files, several review dimensions, N independent attempts),
+you MAY orchestrate them with the Workflow tool instead of working serially —
+see the dynamic-workflows skill for patterns. Otherwise stay single-threaded:
+one item, one focused change. Hard limits — fan-out costs ~15× the tokens and
+this iteration runs under a per-iteration budget cap, so orchestrate only when
+the width is real and keep the number of concurrent agents small (a handful,
+not dozens). If the Workflow tool's background completion does not resolve
+under this headless run, fall back to a few parallel Agent calls for the same
+fan-out. Never pause to ask whether to orchestrate — the goal is law.`;
+
+const HARNESS_LOOP_FRAGMENT = `## Harness mode (loop)
+
+You can extend your own harness. If the current plan item would be done far
+better with a capability you lack — a skill, connector, MCP, or browser — run
+\`claudenv capabilities\` to see what you have, \`claudenv skills search "<need>"\`
+to find it, and \`claudenv skills add <slug>\` to equip it. The goal is law: do
+not pause to ask. HARD limit — only auto-install CURATED (★) skills and
+known-safe bootstraps; a fetched SKILL.md is auto-loaded model-facing text, so
+NEVER auto-install a live (non-curated) skill in this headless run — note the
+gap and proceed with what you have. Secrets only in .env.local; connector
+knowledge into the active workspace. See the harness skill for the full flow.`;
+
 const MAX_BRIEFING_CHARS = 4000;
 
 /**
@@ -44,6 +71,14 @@ export async function buildSystemPromptWithMemory(goal, opts = {}) {
   // Vibe-decisions loop mode is always on inside `claudenv loop`.
   parts.push(VIBE_LOOP_FRAGMENT);
 
+  // Dynamic-workflows loop mode — lets the loop fan out decomposable plan
+  // items via the Workflow tool, with a hard cap on fan-out width.
+  parts.push(WORKFLOW_LOOP_FRAGMENT);
+
+  // Harness loop mode — lets the loop self-equip missing capabilities
+  // (curated skills only) instead of doing tooling-shaped work by hand.
+  parts.push(HARNESS_LOOP_FRAGMENT);
+
   // Memory briefing — INDEX.md if present.
   if (opts.includeMemoryBriefing !== false) {
     try {

package/src/memory-paths.js

@@ -8,6 +8,7 @@
 
 import { join } from 'node:path';
 import { homedir } from 'node:os';
+import { readFileSync } from 'node:fs';
 
 export function claudenvHome() {
   return process.env.CLAUDENV_HOME || join(homedir(), '.claudenv');
@@ -37,10 +38,70 @@ export function dirtyFlagPath() {
   return join(claudenvHome(), '.index-dirty');
 }
 
+// --- Skills layer (~/.claude/skills/ — where Claude Code loads skills from) ---
+
+/**
+ * Path to ~/.claude/ — where Claude Code reads global commands and skills.
+ * Distinct from claudenvHome() (~/.claudenv/), which holds memory/canon/workspaces.
+ */
+export function claudeDir() {
+  return process.env.CLAUDE_HOME || join(homedir(), '.claude');
+}
+
+export function claudeSkillsDir() {
+  return join(claudeDir(), 'skills');
+}
+
+/** Cache of the parsed awesome-claude-skills registry. */
+export function skillsRegistryCachePath() {
+  return join(claudenvHome(), 'skills-registry.json');
+}
+
 export function projectDecisionsDir(cwd) {
   return join(cwd, '.claude', 'memories', 'decisions');
 }
 
+// --- Workspace layer (isolated per-company/context memory) ---
+
+export function workspacesDir() {
+  return join(claudenvHome(), 'workspaces');
+}
+
+export function activeWorkspaceFile() {
+  return join(claudenvHome(), 'active-workspace');
+}
+
+export function workspaceDir(id) {
+  return join(workspacesDir(), id);
+}
+
+export function workspaceManifestPath(id) {
+  return join(workspaceDir(id), 'workspace.yaml');
+}
+
+export function workspaceConnectorsDir(id) {
+  return join(workspaceDir(id), 'memories', 'connectors');
+}
+
+export function workspaceContextDir(id) {
+  return join(workspaceDir(id), 'memories', 'context');
+}
+
+/**
+ * Resolve the active workspace id. Priority: env CLAUDENV_WORKSPACE, then the
+ * pointer file ~/.claudenv/active-workspace. Returns null if none set.
+ * Intentionally does NOT scan all workspaces - isolation barrier.
+ */
+export function activeWorkspaceId() {
+  if (process.env.CLAUDENV_WORKSPACE) return process.env.CLAUDENV_WORKSPACE.trim();
+  try {
+    const id = readFileSync(activeWorkspaceFile(), 'utf-8').trim();
+    return id || null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Minimal YAML frontmatter parser. Returns null when no frontmatter is present.
  * Handles `key: value` and inline arrays `[a, b, c]`. Heavier structures fall