npm - cohorte - Versions diffs - 1.0.0 - Mend

cohorte 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (57) hide show

package/CHANGELOG.md +264 -0
package/LICENSE +661 -0
package/README.md +269 -0
package/bin/cli.js +339 -0
package/core/agents/implementer.template.md +74 -0
package/core/agents/release.md +51 -0
package/core/agents/review.md +85 -0
package/core/commands/align-ds.md +32 -0
package/core/commands/audit.md +31 -0
package/core/commands/brainstorm.md +48 -0
package/core/commands/build.md +91 -0
package/core/commands/doctor.md +50 -0
package/core/commands/fix.md +62 -0
package/core/commands/init-pipeline.md +32 -0
package/core/commands/refactor.md +38 -0
package/core/commands/review.md +68 -0
package/core/commands/ship.md +68 -0
package/core/commands/smoke.md +55 -0
package/core/commands/spec.md +67 -0
package/core/commands/update-pipeline.md +96 -0
package/core/hooks/__pycache__/gate.cpython-312.pyc +0 -0
package/core/hooks/gate.py +129 -0
package/core/templates/agent-handoff.md +34 -0
package/core/templates/brainstorm-return.md +36 -0
package/core/templates/design-brief.md +35 -0
package/core/templates/pr-body.md +29 -0
package/core/templates/review-feedback.md +36 -0
package/core/templates/spec.template.md +84 -0
package/core/templates/steps/init-pipeline/01-detect-stack.md +40 -0
package/core/templates/steps/init-pipeline/02-interview-gaps.md +41 -0
package/core/templates/steps/init-pipeline/03-draft-profile.md +10 -0
package/core/templates/steps/init-pipeline/04-write-render.md +88 -0
package/core/templates/steps/init-pipeline/05-report.md +12 -0
package/dashboard/README.md +54 -0
package/dashboard/dist/apple-touch-icon-180.png +0 -0
package/dashboard/dist/assets/index-CoBuEdy-.js +42 -0
package/dashboard/dist/assets/index-DN5OGW9g.css +1 -0
package/dashboard/dist/favicon-16.png +0 -0
package/dashboard/dist/favicon-32.png +0 -0
package/dashboard/dist/favicon-48.png +0 -0
package/dashboard/dist/icon-192.png +0 -0
package/dashboard/dist/icon-512.png +0 -0
package/dashboard/dist/index.html +16 -0
package/dashboard/server/doctor.js +266 -0
package/dashboard/server/fleet.js +119 -0
package/dashboard/server/index.js +306 -0
package/dashboard/server/kanban.js +158 -0
package/dashboard/server/versions.js +111 -0
package/dashboard/server/yaml.js +126 -0
package/install.ps1 +359 -0
package/install.sh +301 -0
package/package.json +40 -0
package/profile/PIPELINE.template.md +208 -0
package/profile/SCHEMA.md +303 -0
package/profile/cohorte.config.template.yaml +43 -0
package/scripts/new-feature.sh.template +89 -0
package/scripts/remove-feature.sh.template +53 -0

package/dashboard/server/index.js ADDED Viewed

@@ -0,0 +1,306 @@
+'use strict';
+// Local dashboard HTTP server — dependency-free (node built-ins only).
+// Serves the built React app from dashboard/dist and a small JSON API.
+// Phase 0: GET /api/versions (freshness). Later phases add /api/state, /api/fleet, /api/action.
+const http = require('http');
+const fs = require('fs');
+const path = require('path');
+const { spawn } = require('child_process');
+const { versions } = require('./versions');
+const { state } = require('./doctor');
+const { kanban } = require('./kanban');
+const fleet = require('./fleet');
+const MIME = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.ico': 'image/x-icon',
+  '.woff2': 'font/woff2',
+  '.map': 'application/json; charset=utf-8',
+};
+function sendJson(res, status, body) {
+  const data = JSON.stringify(body);
+  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
+  res.end(data);
+}
+// Read + JSON-parse a request body (POST/DELETE), capped to avoid unbounded buffering.
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    let raw = '';
+    req.on('data', chunk => {
+      raw += chunk;
+      if (raw.length > 1e6) { reject(new Error('body too large')); req.destroy(); }
+    });
+    req.on('end', () => {
+      if (raw.trim() === '') return resolve({});
+      try { resolve(JSON.parse(raw)); } catch { reject(new Error('invalid JSON body')); }
+    });
+    req.on('error', reject);
+  });
+}
+function notBuiltPage(distDir) {
+  return `<!doctype html><meta charset="utf-8"><title>dashboard — not built</title>
+<body style="font:16px/1.6 ui-monospace,monospace;max-width:42rem;margin:4rem auto;padding:0 1rem;color:#ddd;background:#111">
+<h1>Dashboard not built yet</h1>
+<p>No <code>${distDir}</code> found. Build the React app once:</p>
+<pre style="background:#000;padding:1rem;border-radius:8px;overflow:auto">npm --prefix dashboard/app install
+npm --prefix dashboard/app run build</pre>
+<p>Or, for live development, run the Vite dev server (<code>npm --prefix dashboard/app run dev</code>)
+which proxies <code>/api</code> here.</p></body>`;
+}
+// Serve a static file from distDir; SPA-fallback to index.html for unknown routes.
+function serveStatic(req, res, distDir) {
+  let rel = decodeURIComponent(req.url.split('?')[0]);
+  if (rel === '/' || rel === '') rel = '/index.html';
+  // Contain the path inside distDir (no traversal).
+  const abs = path.join(distDir, path.normalize(rel));
+  if (!abs.startsWith(distDir)) { res.writeHead(403); return res.end('forbidden'); }
+  fs.readFile(abs, (err, buf) => {
+    if (err) {
+      // SPA fallback: hand index.html to the client router.
+      const index = path.join(distDir, 'index.html');
+      return fs.readFile(index, (e2, html) => {
+        if (e2) { res.writeHead(404, { 'content-type': 'text/html' }); return res.end(notBuiltPage(distDir)); }
+        res.writeHead(200, { 'content-type': MIME['.html'] });
+        res.end(html);
+      });
+    }
+    res.writeHead(200, { 'content-type': MIME[path.extname(abs)] || 'application/octet-stream' });
+    res.end(buf);
+  });
+}
+const STREAM_HEADERS = {
+  'content-type': 'text/plain; charset=utf-8',
+  'cache-control': 'no-cache',
+  'x-accel-buffering': 'no', // defeat proxy buffering so lines stream live
+};
+// Run `cli.js install|update [target] [--global]` and stream its output back as a plain-text
+// chunked response (the client reads it via fetch's ReadableStream). Ends with __EXIT__ <code>.
+function runAction(req, res, body, { pkgRoot }) {
+  const { action, scope, project } = body;
+  if (action !== 'install' && action !== 'update') {
+    return sendJson(res, 400, { error: "action must be 'install' or 'update'" });
+  }
+  const args = [path.join(pkgRoot, 'bin', 'cli.js'), action];
+  if (scope === 'global') args.push('--global');
+  else if (project) args.push(project);
+  res.writeHead(200, STREAM_HEADERS);
+  res.write(`$ node cli.js ${args.slice(1).join(' ')}\n\n`);
+  const child = spawn(process.execPath, args, { cwd: pkgRoot, env: process.env });
+  child.stdout.on('data', d => res.write(d));
+  child.stderr.on('data', d => res.write(d));
+  child.on('close', code => { res.write(`\n__EXIT__ ${code == null ? 1 : code}\n`); res.end(); });
+  child.on('error', err => { res.write(`\nspawn error: ${err.message}\n__EXIT__ 1\n`); res.end(); });
+  req.on('close', () => { try { child.kill(); } catch { /* already gone */ } });
+}
+// Run a pipeline slash-command through Claude Code headless (`claude -p`) in the project dir,
+// streaming its output. The command is whitelisted (no arbitrary injection into claude -p) and
+// runs autonomously (--dangerously-skip-permissions), so it never hangs waiting on a prompt.
+function runClaude(req, res, body) {
+  const project = body.project ? path.resolve(body.project) : null;
+  const command = String(body.command || '');
+  if (!/^\/(init-pipeline|update-pipeline)$/.test(command)) {
+    return sendJson(res, 400, { error: 'unsupported command (only /init-pipeline or /update-pipeline)' });
+  }
+  if (!project || !fs.existsSync(project)) {
+    return sendJson(res, 400, { error: 'project path not found' });
+  }
+  res.writeHead(200, STREAM_HEADERS);
+  res.write(`$ claude -p "${command}"   (cwd: ${project})\n\n`);
+  const args = ['-p', command, '--permission-mode', 'bypassPermissions', '--dangerously-skip-permissions', '--verbose'];
+  const child = spawn('claude', args, { cwd: project, env: process.env });
+  child.stdout.on('data', d => res.write(d));
+  child.stderr.on('data', d => res.write(d));
+  child.on('close', code => { res.write(`\n__EXIT__ ${code == null ? 1 : code}\n`); res.end(); });
+  child.on('error', err => {
+    res.write(`\nspawn error: ${err.message}\n(is the \`claude\` CLI on PATH and authenticated?)\n__EXIT__ 1\n`);
+    res.end();
+  });
+  req.on('close', () => { try { child.kill(); } catch { /* already gone */ } });
+}
+// Full project reset: back up the project's pipeline footprint (.claude/, PIPELINE.md, and
+// optionally specs/) to .claude.bak-<ts>, remove it, then reinstall a fresh BUNDLED core (or,
+// for global-mode projects, leave the shared ~/.claude core untouched). Never touches ~/.claude.
+// Streams progress; ends with __EXIT__ <code>. The profile is regenerated by /init-pipeline after.
+function runReset(req, res, body, { pkgRoot }) {
+  const project = body.project ? path.resolve(body.project) : null;
+  const purgeSpecs = !!body.purgeSpecs;
+  if (!project || !fs.existsSync(project)) {
+    return sendJson(res, 400, { error: 'project path not found' });
+  }
+  res.writeHead(200, STREAM_HEADERS);
+  const log = s => res.write(s + '\n');
+  const done = code => { res.write(`\n__EXIT__ ${code == null ? 1 : code}\n`); res.end(); };
+  try {
+    const claudeDir = path.join(project, '.claude');
+    const pipelineMd = path.join(project, 'PIPELINE.md');
+    const specsDir = path.join(project, 'specs');
+    // Detect the prior install mode before we move anything.
+    let priorMode = 'unknown';
+    const ptr = path.join(claudeDir, 'pipeline.json');
+    if (fs.existsSync(ptr)) { try { priorMode = JSON.parse(fs.readFileSync(ptr, 'utf8')).mode || 'unknown'; } catch { /* keep unknown */ } }
+    const hadBundledCore = fs.existsSync(path.join(claudeDir, 'pipeline', 'VERSION'));
+    const bundled = priorMode === 'bundled' || (priorMode === 'unknown' && hadBundledCore);
+    const ts = new Date().toISOString().replace(/[:.]/g, '-');
+    const backup = path.join(project, `.claude.bak-${ts}`);
+    fs.mkdirSync(backup, { recursive: true });
+    log(`Backing up the project's pipeline footprint → ${path.basename(backup)}/`);
+    let moved = 0;
+    if (fs.existsSync(claudeDir)) { fs.renameSync(claudeDir, path.join(backup, '.claude')); log('  · moved .claude/'); moved++; }
+    if (fs.existsSync(pipelineMd)) { fs.renameSync(pipelineMd, path.join(backup, 'PIPELINE.md')); log('  · moved PIPELINE.md'); moved++; }
+    if (purgeSpecs && fs.existsSync(specsDir)) { fs.renameSync(specsDir, path.join(backup, 'specs')); log('  · moved specs/'); moved++; }
+    if (!moved) log('  · nothing to move (no .claude/ or PIPELINE.md found)');
+    log(`\nPrior mode: ${bundled ? 'bundled' : 'global'} — the shared ~/.claude core is never touched.`);
+    if (bundled) {
+      log('\nReinstalling a fresh bundled core…\n');
+      const args = [path.join(pkgRoot, 'bin', 'cli.js'), 'install', project];
+      const child = spawn(process.execPath, args, { cwd: pkgRoot, env: process.env });
+      child.stdout.on('data', d => res.write(d));
+      child.stderr.on('data', d => res.write(d));
+      child.on('close', code => {
+        log('\n✔ Reset complete. Now run  /init-pipeline  in Claude Code to regenerate PIPELINE.md + the surface agents.');
+        done(code);
+      });
+      child.on('error', err => { log(`\nspawn error: ${err.message}`); done(1); });
+      req.on('close', () => { try { child.kill(); } catch { /* already gone */ } });
+    } else {
+      log('\n✔ Reset complete. The shared global core stays installed in ~/.claude.');
+      log('Now run  /init-pipeline  in Claude Code to regenerate this project\'s PIPELINE.md + agents.');
+      done(0);
+    }
+  } catch (e) {
+    log(`\nreset error: ${(e && e.message) || e}`);
+    done(1);
+  }
+}
+const LOOPBACK = new Set(['127.0.0.1', 'localhost', '::1']);
+// Best-effort browser open (opt-in via --open). Never throws; failure is silent.
+function openBrowserAt(url) {
+  const cmd = process.platform === 'darwin' ? 'open'
+    : process.platform === 'win32' ? 'cmd'
+      : 'xdg-open';
+  const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+  try { spawn(cmd, args, { stdio: 'ignore', detached: true }).on('error', () => {}).unref(); }
+  catch { /* no opener available */ }
+}
+function start({ projectRoot, globalDir, port, host, openBrowser, pkgRoot, version }) {
+  const distDir = path.join(pkgRoot, 'dashboard', 'dist');
+  const bindHost = host || '127.0.0.1';
+  try { fleet.ensureSeed(globalDir, projectRoot); } catch { /* registry is best-effort */ }
+  const server = http.createServer(async (req, res) => {
+    const url = req.url.split('?')[0];
+    try {
+      if (url === '/api/versions') {
+        return sendJson(res, 200, await versions({ projectRoot, globalDir, cliVersion: version }));
+      }
+      if (url === '/api/state') {
+        // ?project=<abs path> overrides the launch cwd (fleet-ready); default = launch project.
+        const q = new URL(req.url, 'http://localhost').searchParams.get('project');
+        const root = q ? path.resolve(q) : projectRoot;
+        return sendJson(res, 200, await state({ projectRoot: root, globalDir, cliVersion: version }));
+      }
+      if (url === '/api/fleet') {
+        return sendJson(res, 200, { projects: await fleet.list(globalDir, version) });
+      }
+      if (url === '/api/browse') {
+        const dir = new URL(req.url, 'http://localhost').searchParams.get('dir');
+        return sendJson(res, 200, fleet.browse(dir));
+      }
+      if (url === '/api/kanban') {
+        const q = new URL(req.url, 'http://localhost').searchParams.get('project');
+        const root = q ? path.resolve(q) : projectRoot;
+        return sendJson(res, 200, kanban({ projectRoot: root, globalDir }));
+      }
+      if (url === '/api/projects') {
+        const body = await readBody(req);
+        if (req.method === 'POST') {
+          if (!body.path) return sendJson(res, 400, { error: 'path is required' });
+          let abs;
+          try { abs = fleet.add(globalDir, body.path); }
+          catch (e) { return sendJson(res, 400, { error: String((e && e.message) || e) }); }
+          return sendJson(res, 200, { added: abs, projects: await fleet.list(globalDir, version) });
+        }
+        if (req.method === 'DELETE') {
+          if (!body.path) return sendJson(res, 400, { error: 'path is required' });
+          fleet.remove(globalDir, body.path);
+          return sendJson(res, 200, { removed: body.path, projects: await fleet.list(globalDir, version) });
+        }
+        return sendJson(res, 405, { error: 'use POST to add, DELETE to remove' });
+      }
+      if (url === '/api/action' && req.method === 'POST') {
+        let body;
+        try { body = await readBody(req); } catch (e) { return sendJson(res, 400, { error: e.message }); }
+        if (body.action === 'reset') return runReset(req, res, body, { pkgRoot });
+        if (body.action === 'claude') return runClaude(req, res, body);
+        return runAction(req, res, body, { pkgRoot });
+      }
+      if (url.startsWith('/api/')) {
+        return sendJson(res, 404, { error: `unknown endpoint: ${url}` });
+      }
+      return serveStatic(req, res, distDir);
+    } catch (err) {
+      return sendJson(res, 500, { error: String(err && err.message || err) });
+    }
+  });
+  server.listen(port, bindHost, () => {
+    const shownHost = LOOPBACK.has(bindHost) ? 'localhost' : bindHost;
+    const url = `http://${shownHost}:${port}`;
+    console.log(`\n  cohorte dashboard  v${version}`);
+    console.log(`  ┌${'─'.repeat(url.length + 10)}┐`);
+    console.log(`  │  open  ${url}  │`);
+    console.log(`  └${'─'.repeat(url.length + 10)}┘`);
+    console.log(`  project : ${projectRoot}`);
+    console.log(`  bind    : ${bindHost}:${port}`);
+    if (!LOOPBACK.has(bindHost)) {
+      console.log('  ⚠ SECURITY: bound to a non-loopback address — the dashboard\'s actions execute');
+      console.log('    code (install/update/reset/claude). Anyone who can reach this host+port can');
+      console.log('    run them. Only do this on a trusted network.');
+    }
+    if (!fs.existsSync(path.join(distDir, 'index.html'))) {
+      console.log('  note    : React app not built yet — run  npm --prefix dashboard/app run build');
+    }
+    console.log('  (Ctrl-C to stop)\n');
+    if (openBrowser) openBrowserAt(url);
+  });
+  server.on('error', (err) => {
+    if (err.code === 'EADDRINUSE') {
+      console.error(`error: port ${port} is in use — pass another with --port=<N>`);
+      process.exit(1);
+    }
+    throw err;
+  });
+}
+module.exports = start;

package/dashboard/server/kanban.js ADDED Viewed

@@ -0,0 +1,158 @@
+'use strict';
+// Read a project's linked Obsidian Kanban board (from ~/.claude/cohorte.config.yaml) and
+// parse it into columns + cards. The board is a plain markdown file in the user's vault, so this
+// stays local + dependency-free. The kanban mirror is Obsidian-only by design.
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { parse, parseProfileBlock } = require('./yaml');
+// owner/repo from the project's GitHub origin remote (SSH or HTTPS form), or null.
+function githubRepo(projectRoot) {
+  try {
+    const r = spawnSync('git', ['-C', projectRoot, 'remote', 'get-url', 'origin'],
+      { encoding: 'utf8', timeout: 3000 });
+    if (r.status !== 0 || !r.stdout) return null;
+    const m = r.stdout.trim().match(/github\.com[:/]([^/]+)\/(.+?)(?:\.git)?$/);
+    return m ? `${m[1]}/${m[2]}` : null;
+  } catch { return null; }
+}
+// PR metadata (state, draft, dates) for the repo, keyed by number. Uses the user's authenticated
+// `gh` CLI; cached 60s so the dashboard poll doesn't hammer the API. Empty map if gh is absent/fails.
+let _prCache = { repo: null, at: 0, map: {} };
+function fetchPRs(repo) {
+  if (!repo) return {};
+  if (_prCache.repo === repo && Date.now() - _prCache.at < 60000) return _prCache.map;
+  try {
+    const r = spawnSync('gh', ['pr', 'list', '--repo', repo, '--state', 'all', '--limit', '200',
+      '--json', 'number,state,isDraft,createdAt,mergedAt,url,headRefName'], { encoding: 'utf8', timeout: 8000 });
+    if (r.status !== 0 || !r.stdout) return _prCache.repo === repo ? _prCache.map : {};
+    const map = {};
+    for (const pr of JSON.parse(r.stdout)) map[String(pr.number)] = pr;
+    _prCache = { repo, at: Date.now(), map };
+    return map;
+  } catch { return {}; }
+}
+function readConfig(globalDir) {
+  // cohorte.config.yaml, then the pre-rename legacy names (read-only fallback).
+  for (const n of ['cohorte.config.yaml', 'thebidouille.config.yaml']) {
+    try { return parse(fs.readFileSync(path.join(globalDir, n), 'utf8')); } catch { /* try next */ }
+  }
+  return null;
+}
+// The project's PIPELINE.md `name`, or the directory basename as a fallback (a purged project
+// has no profile, but its board is still keyed by the old name — match case-insensitively).
+function projectName(projectRoot) {
+  const md = (() => { try { return fs.readFileSync(path.join(projectRoot, 'PIPELINE.md'), 'utf8'); } catch { return null; } })();
+  const profile = md ? parseProfileBlock(md) : null;
+  return (profile && profile.name) || path.basename(projectRoot);
+}
+// Resolve the board key for this project: exact name, else case-insensitive basename match.
+function boardEntry(boards, name, projectRoot) {
+  if (!boards || typeof boards !== 'object') return null;
+  if (boards[name]) return boards[name];
+  const base = path.basename(projectRoot).toLowerCase();
+  const key = Object.keys(boards).find(k => k.toLowerCase() === name.toLowerCase() || k.toLowerCase() === base);
+  return key ? boards[key] : null;
+}
+// Parse an Obsidian Kanban markdown file into columns of cards. `repo` (owner/repo) turns
+// bare `#123` PR references into links.
+function parseBoard(md, repo) {
+  const cols = [];
+  let cur = null;
+  for (const raw of md.split(/\r?\n/)) {
+    const line = raw.replace(/\s+$/, '');
+    if (/^%%/.test(line)) break; // the `%% kanban:settings %%` trailer ends the board
+    const h = line.match(/^##\s+(.+?)\s*$/);
+    if (h) { cur = { name: h[1], cards: [] }; cols.push(cur); continue; }
+    const c = line.match(/^\s*-\s*\[([ xX])\]\s+(.+?)\s*$/);
+    if (c && cur) {
+      const src = c[2];
+      // `#123` = PR reference; `#word` (letter-first) = a feature tag.
+      const prs = [...src.matchAll(/#(\d+)\b/g)].map(m => ({
+        num: m[1], url: repo ? `https://github.com/${repo}/pull/${m[1]}` : null,
+      }));
+      const tags = [...src.matchAll(/#([A-Za-zÀ-ɏ][\wÀ-ɏ/-]*)/g)].map(m => m[1]);
+      const text = src
+        .replace(/#[\wÀ-ɏ/-]+/g, '')   // strip tags + PR refs
+        .replace(/\bPR\b/g, '')         // and the leftover "PR" label
+        .replace(/[—–-]\s*$/, '')       // trailing dash
+        .replace(/\s{2,}/g, ' ').trim();
+      cur.cards.push({ text, done: c[1].toLowerCase() === 'x', tags, prs });
+    }
+  }
+  return cols;
+}
+function kanban({ projectRoot, globalDir }) {
+  const cfg = readConfig(globalDir);
+  if (!cfg) return { enabled: false, reason: 'no cohorte.config.yaml' };
+  const k = cfg.kanban;
+  if (!k || k.enabled !== true) return { enabled: false, reason: 'kanban disabled in config' };
+  const vault = cfg.obsidian && cfg.obsidian.vault_path;
+  if (!vault) return { enabled: false, reason: 'no obsidian.vault_path configured' };
+  const name = projectName(projectRoot);
+  const entry = boardEntry(k.boards, name, projectRoot);
+  if (!entry || !entry.board) return { enabled: false, reason: `no board linked for "${name}"` };
+  const boardPath = path.join(vault, entry.board);
+  let md;
+  try { md = fs.readFileSync(boardPath, 'utf8'); }
+  catch { return { enabled: false, reason: `board file unreadable: ${entry.board}` }; }
+  const repo = githubRepo(projectRoot);
+  const columns = parseBoard(md, repo);
+  // Enrich PR refs with live status (state/draft/dates) from gh, and compute each card's ship date.
+  const prMap = fetchPRs(repo);
+  const byBranch = {};
+  for (const pr of Object.values(prMap)) if (pr.headRefName) byBranch[pr.headRefName] = pr;
+  const applyMeta = (pr, meta) => {
+    pr.state = meta.state; pr.draft = meta.isDraft; pr.mergedAt = meta.mergedAt; pr.createdAt = meta.createdAt;
+    pr.url = pr.url || meta.url; pr.num = pr.num || String(meta.number);
+  };
+  // A card with a `#<feature_id>` tag but no explicit `#<num>`: infer its PR from the branch
+  // `<...>/<feature_id>` (the old cards predate "always write the PR number"). Marked inferred.
+  const inferPR = tags => {
+    for (const t of tags) {
+      const hit = byBranch[`feature/${t}`] || Object.values(prMap).find(p => p.headRefName && p.headRefName.endsWith(`/${t}`));
+      if (hit) return { num: String(hit.number), inferred: true };
+    }
+    return null;
+  };
+  for (const col of columns) {
+    for (const card of col.cards) {
+      if (card.prs.length === 0) {
+        const inf = inferPR(card.tags);
+        if (inf) card.prs.push(inf);
+      }
+      let latest = null;
+      for (const pr of card.prs) {
+        const meta = prMap[pr.num];
+        if (meta) {
+          applyMeta(pr, meta);
+          const d = meta.mergedAt || meta.createdAt;
+          if (d && (!latest || d > latest)) latest = d;
+        }
+      }
+      card.shipDate = latest; // ISO string of the newest merge/creation among the card's PRs
+    }
+    // Shipped column: most-recently-shipped first (cards without a date sink to the bottom).
+    if (/shipped/i.test(col.name)) {
+      col.cards.sort((a, b) => (b.shipDate || '').localeCompare(a.shipDate || ''));
+    }
+  }
+  const total = columns.reduce((n, c) => n + c.cards.length, 0);
+  return { enabled: true, name, boardRel: entry.board, prSource: Object.keys(prMap).length ? 'gh' : 'none', columns, total };
+}
+module.exports = { kanban };

package/dashboard/server/versions.js ADDED Viewed

@@ -0,0 +1,111 @@
+'use strict';
+// Freshness data: which core is installed where, and how it compares to npm latest.
+// Dependency-free — reads VERSION files + the committed pointer, fetches the npm registry.
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+function readTrimmed(file) {
+  try { return fs.readFileSync(file, 'utf8').trim(); } catch { return null; }
+}
+function readJson(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
+}
+// Installed core in a given root (global ~/.claude or a repo's bundled .claude).
+function coreAt(claudeDir) {
+  const version = readTrimmed(path.join(claudeDir, 'pipeline', 'VERSION'));
+  return { present: version != null, version, dir: claudeDir };
+}
+// The committed per-repo pointer (bundled mode); names the mode + core_version.
+function pointerAt(projectRoot) {
+  const ptr = readJson(path.join(projectRoot, '.claude', 'pipeline.json'));
+  if (!ptr || typeof ptr !== 'object') return { present: false };
+  return { present: true, mode: ptr.mode || null, core_version: ptr.core_version || null };
+}
+// Latest published version — registry fetch first, `npm view` as a fallback (it uses the
+// user's configured registry/proxy, which works where a raw fetch may be blocked). Cached
+// briefly so the dashboard's poll doesn't hammer the network. null only if both fail.
+let _cache = { value: null, at: 0 };
+const CACHE_MS = 5 * 60 * 1000;
+async function fetchRegistry() {
+  const ctrl = new AbortController();
+  const t = setTimeout(() => ctrl.abort(), 5000);
+  try {
+    const res = await fetch('https://registry.npmjs.org/cohorte/latest', {
+      signal: ctrl.signal,
+      headers: { accept: 'application/vnd.npm.install-v1+json' },
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    return typeof body.version === 'string' ? body.version : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(t);
+  }
+}
+function npmView() {
+  try {
+    const r = spawnSync('npm', ['view', 'cohorte', 'version'],
+      { encoding: 'utf8', timeout: 8000, shell: process.platform === 'win32' });
+    if (r.status === 0 && r.stdout) {
+      const v = r.stdout.trim();
+      return /^\d+\.\d+\.\d+/.test(v) ? v : null;
+    }
+  } catch { /* npm absent or slow */ }
+  return null;
+}
+async function latestNpm() {
+  if (_cache.value && (Date.now() - _cache.at) < CACHE_MS) return _cache.value;
+  const v = (await fetchRegistry()) || npmView();
+  if (v) _cache = { value: v, at: Date.now() };
+  return v;
+}
+// Naive semver compare — returns -1|0|1 (a<b|a==b|a>b). Ignores pre-release tags.
+function cmpSemver(a, b) {
+  if (!a || !b) return null;
+  const pa = a.split('.').map(n => parseInt(n, 10) || 0);
+  const pb = b.split('.').map(n => parseInt(n, 10) || 0);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] || 0) < (pb[i] || 0)) return -1;
+    if ((pa[i] || 0) > (pb[i] || 0)) return 1;
+  }
+  return 0;
+}
+async function versions({ projectRoot, globalDir, cliVersion }) {
+  const global = coreAt(globalDir);
+  const bundled = coreAt(path.join(projectRoot, '.claude'));
+  const pointer = pointerAt(projectRoot);
+  const latest = await latestNpm();
+  // The core that actually serves this project: bundled wins if present, else global.
+  const effective = bundled.present ? bundled : global.present ? global : null;
+  const installedVersion = effective ? effective.version : null;
+  const behind = cmpSemver(installedVersion, latest);
+  return {
+    cli: cliVersion,
+    latest,
+    global,
+    bundled,
+    pointer,
+    installMode: bundled.present ? 'bundled' : global.present ? 'global' : 'none',
+    installedVersion,
+    // -1 behind, 0 up-to-date, 1 ahead of registry (dev), null unknown
+    freshness: behind,
+    // freshness of the GLOBAL core specifically (for the fleet banner, independent of project mode)
+    globalFreshness: global.present ? cmpSemver(global.version, latest) : null,
+  };
+}
+module.exports = { versions };