continuous-improvement 3.12.3 → 3.15.0

package/bin/check-test-imports-only.mjs

@@ -12,7 +12,7 @@
  *   - reach-through into `hooks/`, `scripts/`, `src/`, or deeper paths under
  *     `bin/` or `lib/`
  *
- * Baseline: all 50 `src/test/*.test.mts` files pass today.
+ * Baseline: all 56 `src/test/*.test.mts` files pass today.
  *
  * Usage:
  *   node bin/check-test-imports-only.mjs              # Check the current repo

package/bin/generate-plugin-manifests.mjs

@@ -107,7 +107,7 @@ async function writePluginBundleReadme() {
         "- `tdd-workflow` — RED/GREEN/REFACTOR + 80% coverage gate",
         "- `workspace-surface-audit` — environment + capability audit",
         "- Tier-1/Tier-2 enforcement skills (`gateguard`, `verification-loop`,",
-        "  `para-memory-files`, `safety-guard`, `token-budget-advisor`,",
+        "  `safety-guard`, `token-budget-advisor`,",
         "  `strategic-compact`, `wild-risa-balance`)",
         "",
         "**Optional companions the orchestrator routes to (install separately if",
@@ -152,6 +152,7 @@ async function writePluginBundle() {
         copyFileTo(join(REPO_ROOT, "lib", "observe-event.mjs"), join(PLUGIN_BUNDLE_DIR, "lib", "observe-event.mjs")),
         copyFileTo(join(REPO_ROOT, "lib", "goal-state.mjs"), join(PLUGIN_BUNDLE_DIR, "lib", "goal-state.mjs")),
         copyFileTo(join(REPO_ROOT, "lib", "goal-drift-gate.mjs"), join(PLUGIN_BUNDLE_DIR, "lib", "goal-drift-gate.mjs")),
+        copyFileTo(join(REPO_ROOT, "lib", "hook-pack-gate.mjs"), join(PLUGIN_BUNDLE_DIR, "lib", "hook-pack-gate.mjs")),
         copyFileTo(join(REPO_ROOT, "lib", "recall-index.mjs"), join(PLUGIN_BUNDLE_DIR, "lib", "recall-index.mjs")),
         copyFileTo(join(REPO_ROOT, "lib", "recall-briefing.mjs"), join(PLUGIN_BUNDLE_DIR, "lib", "recall-briefing.mjs")),
         copyFileTo(join(REPO_ROOT, "lib", "skill-distill.mjs"), join(PLUGIN_BUNDLE_DIR, "lib", "skill-distill.mjs")),

package/bin/hook-stats.mjs

@@ -46,27 +46,27 @@ import { platform } from "node:os";
 import { join } from "node:path";
 import { argv, cwd, exit, stderr, stdout } from "node:process";
 import { resolveHomeDir } from "../lib/resolve-home-dir.mjs";
-const USAGE = `Usage: node bin/hook-stats.mjs [options]
-
-Reads JSONL telemetry from <HOME>/.claude/hook-telemetry/*.jsonl and
-prints per-hook aggregate counts over a recent time window.
-
-Options:
-  --hours=<n>            Time window in hours (default: 24)
-  --hash=<hash>          Only read this single <hash>.jsonl file
-                         (default: sha256 of the current working directory,
-                         normalized to forward slashes and lowercased on
-                         Windows, then first 12 hex chars)
-  --telemetry-dir=<path> Override telemetry dir
-                         (default: <HOME>/.claude/hook-telemetry)
-  --help                 Show this help and exit 0
-
-Output:
-  One line per hook: "<hook> last <hours>h: pass=<n> block=<n>
-  skip-short=<n> total=<n> avg-duration=<X>ms".
-  If there are no records in the window: "no records in last <hours>h".
-
-The reader is parse-tolerant: malformed JSONL lines are skipped silently.
+const USAGE = `Usage: node bin/hook-stats.mjs [options]
+
+Reads JSONL telemetry from <HOME>/.claude/hook-telemetry/*.jsonl and
+prints per-hook aggregate counts over a recent time window.
+
+Options:
+  --hours=<n>            Time window in hours (default: 24)
+  --hash=<hash>          Only read this single <hash>.jsonl file
+                         (default: sha256 of the current working directory,
+                         normalized to forward slashes and lowercased on
+                         Windows, then first 12 hex chars)
+  --telemetry-dir=<path> Override telemetry dir
+                         (default: <HOME>/.claude/hook-telemetry)
+  --help                 Show this help and exit 0
+
+Output:
+  One line per hook: "<hook> last <hours>h: pass=<n> block=<n>
+  skip-short=<n> total=<n> avg-duration=<X>ms".
+  If there are no records in the window: "no records in last <hours>h".
+
+The reader is parse-tolerant: malformed JSONL lines are skipped silently.
 `;
 function parseArgs(rawArgs) {
     const opts = {

package/bin/install.mjs

@@ -6,6 +6,7 @@
  *   npx continuous-improvement install                # beginner mode (default)
  *   npx continuous-improvement install --mode expert  # + MCP server + session hooks
  *   npx continuous-improvement install --pack react   # load starter instinct pack
+ *   npx continuous-improvement install --target gemini,codex  # skill into other agents' rules files
  *   npx continuous-improvement install --uninstall    # remove everything
  */
 import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
@@ -15,6 +16,7 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createHash } from "node:crypto";
 import { getToolNames } from "../lib/plugin-metadata.mjs";
+import { TARGET_IDS, planTargetWrites, resolveTargets } from "../lib/install-targets.mjs";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const SKILL_SOURCE = join(__dirname, "..", "SKILL.md");
@@ -493,6 +495,17 @@ Options for 'install':
                       beginner  — hooks + skill + commands (default)
                       expert    — beginner + MCP server + session hooks
   --pack <name>     Load a starter instinct pack (react, python, go, meta)
+  --target <names>  Comma-separated platform list (default: claude):
+                      claude    — full install: hooks + skill + commands
+                      gemini    — GEMINI.md (Gemini CLI)
+                      codex     — AGENTS.md (Codex CLI / agents.md standard)
+                      cursor    — .cursor/rules/continuous-improvement.mdc
+                      windsurf  — .windsurf/rules/continuous-improvement.md
+                      zed       — .rules
+                      aider     — CONVENTIONS.md + .aider.conf.yml
+                      copilot   — .github/copilot-instructions.md
+                    Non-claude targets write the 7-Laws skill text into the
+                    current project; hooks/MCP/instincts stay Claude Code-only.
   --help            Show this help
 
 Options for 'backfill':
@@ -503,6 +516,7 @@ Examples:
   npx continuous-improvement install                # beginner (default)
   npx continuous-improvement install --mode expert  # full power
   npx continuous-improvement install --pack react   # load React instincts
+  npx continuous-improvement install --target gemini,codex  # other agents' rules files
   npx continuous-improvement backfill --dry-run     # report thin/rich row counts
   npx continuous-improvement backfill               # tag rows in place
   npx continuous-improvement install --uninstall    # remove everything
@@ -510,7 +524,12 @@ Examples:
 }
 function getProjectHashSync() {
     try {
-        const root = execSync("git rev-parse --show-toplevel 2>/dev/null", { encoding: "utf8" }).trim();
+        // No shell redirect — `2>/dev/null` breaks under cmd.exe (tries to open a
+        // file literally named /dev/null); ignore stderr via stdio instead.
+        const root = execSync("git rev-parse --show-toplevel", {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
         const hash = createHash("sha256").update(root).digest("hex").slice(0, 12);
         return { root, hash };
     }
@@ -547,6 +566,60 @@ if (args.includes("--uninstall")) {
     uninstallAll();
     process.exit(0);
 }
+// --target <names>: comma-separated platform list, default claude-only.
+// Non-claude targets receive the skill text in their platform's rules file
+// (project-level); the full hook/MCP/instinct install stays Claude Code-only.
+const targetFlagIndex = rawArgs.indexOf("--target");
+let requestedTargets = ["claude"];
+if (targetFlagIndex !== -1) {
+    const targetCsv = rawArgs[targetFlagIndex + 1];
+    if (!targetCsv || targetCsv.startsWith("--")) {
+        console.error(`--target requires a value. Valid targets: ${TARGET_IDS.join(", ")}`);
+        process.exit(1);
+    }
+    const resolved = resolveTargets(targetCsv);
+    if (resolved.unknown.length > 0) {
+        console.error(`Unknown --target name(s): ${resolved.unknown.join(", ")}. Valid targets: ${TARGET_IDS.join(", ")}`);
+        process.exit(1);
+    }
+    if (resolved.targets.length === 0) {
+        console.error(`--target requires at least one name. Valid targets: ${TARGET_IDS.join(", ")}`);
+        process.exit(1);
+    }
+    requestedTargets = resolved.targets;
+}
+function installNonClaudeTargets(targetIds) {
+    const skillMd = readFileSync(SKILL_SOURCE, "utf8");
+    const project = getProjectHashSync();
+    const projectRoot = project.root === "global" ? process.cwd() : project.root;
+    const readExisting = (relPath) => {
+        const absPath = join(projectRoot, relPath);
+        return existsSync(absPath) ? readFileSync(absPath, "utf8") : null;
+    };
+    const notes = new Set();
+    for (const targetId of targetIds) {
+        const plan = planTargetWrites(targetId, skillMd, readExisting);
+        for (const write of plan.writes) {
+            const absPath = join(projectRoot, write.relPath);
+            mkdirSync(dirname(absPath), { recursive: true });
+            writeFileSync(absPath, write.content);
+            console.log(`  ✓ ${targetId} → ${write.relPath}`);
+        }
+        for (const note of plan.notes)
+            notes.add(note);
+    }
+    for (const note of notes)
+        console.log(`  ℹ ${note}`);
+}
+const nonClaudeTargets = requestedTargets.filter((targetId) => targetId !== "claude");
+if (nonClaudeTargets.length > 0) {
+    console.log("\ncontinuous-improvement multi-platform install\n");
+    installNonClaudeTargets(nonClaudeTargets);
+    if (!requestedTargets.includes("claude")) {
+        console.log("\nDone. Claude Code install skipped (not in --target list).");
+        process.exit(0);
+    }
+}
 console.log(`
 continuous-improvement (mode: ${INSTALL_MODE})
 Research → Plan → Execute → Verify → Reflect → Learn → Iterate

package/bin/mcp-server.mjs

@@ -13,15 +13,15 @@
 import { execSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, dirname, join } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { fileURLToPath } from "node:url";
 import { createHash } from "node:crypto";
 import { PACKAGE_NAME, VERSION, getToolDefinitions, isPluginMode, } from "../lib/plugin-metadata.mjs";
 import { formatDriftReport, parseGoalFromPlan, scoreObservations, } from "../lib/goal-state.mjs";
 import { buildIndex, formatRecallHits, parseSince, query as queryRecall, } from "../lib/recall-index.mjs";
-import { draftFromCandidate, extractTrajectories, findCandidates, formatCandidates, serializeDraft, } from "../lib/skill-distill.mjs";
-import { MAX_CLEARED_FILES, clearFiles, resolveSessionDir, } from "../lib/gateguard-state.mjs";
+import { draftFromCandidate, draftFromWorkflowRun, extractTrajectories, findCandidates, formatCandidates, serializeDraft, workflowRunFromObservations, } from "../lib/skill-distill.mjs";
+import { MAX_CLEARED_FILES, canonicalizeFileKey, clearFiles, resolveInstinctsRoot, resolveSessionDir, } from "../lib/gateguard-state.mjs";
 function getHomeDir() {
     return process.env.HOME || process.env.USERPROFILE || homedir();
 }
@@ -508,10 +508,11 @@ function handleTool(name, params) {
         }
         case "ci_gateguard_clear": {
             // Beginner-available on purpose: the GateGuard hook fires for every
-            // install, so the clearance action must too. Resolves the session dir via
-            // gateguard-state (canonical), the same way the hook does, so the marker
-            // lands where the hook looks regardless of how each process spelled the
-            // project root.
+            // install, so the clearance action must too. The hook's block reason now
+            // prints state_path (the session-scoped state file); honoring it writes
+            // the marker exactly where the hook looks. Without it the MCP server can't
+            // know the caller's session, so it falls back to the canonical session dir
+            // — correct only on the legacy unscoped path.
             const rawList = Array.isArray(params.file_paths) ? params.file_paths : [];
             const listPaths = rawList.filter((value) => typeof value === "string" && value.length > 0);
             const single = getString(params.file_path).trim();
@@ -519,7 +520,24 @@ function handleTool(name, params) {
             if (paths.length === 0) {
                 return error("file_paths is required — pass the file path(s) named in the GateGuard block reason, e.g. { file_paths: [\"src/x.ts\"] }.");
             }
-            const sessionDir = resolveSessionDir();
+            // state_path is a model-controlled argument, so it could be a traversal
+            // string (`../../etc/...`). dirname leaves `..` segments for the OS to
+            // resolve at write time, so without a bound this is an arbitrary-write
+            // primitive. Resolve + canonicalize, then require containment within the
+            // instincts root (the only tree the hook ever prints a state_path inside).
+            const rawStatePath = getString(params.state_path).trim();
+            let sessionDir;
+            if (rawStatePath) {
+                const resolvedKey = canonicalizeFileKey(resolve(rawStatePath));
+                const rootKey = canonicalizeFileKey(resolveInstinctsRoot());
+                if (resolvedKey !== rootKey && !resolvedKey.startsWith(`${rootKey}/`)) {
+                    return error("state_path must resolve inside ~/.claude/instincts/. Pass it verbatim from the GateGuard block reason.");
+                }
+                sessionDir = dirname(resolve(rawStatePath));
+            }
+            else {
+                sessionDir = resolveSessionDir();
+            }
             const { cleared, skippedForCap } = clearFiles(sessionDir, paths);
             const lines = [
                 "## GateGuard clearance",
@@ -837,6 +855,45 @@ function handleTool(name, params) {
                 "```",
             ].join("\n"));
         }
+        case "ci_distill_from_workflow": {
+            if (MODE !== "expert") {
+                return error("ci_distill_from_workflow requires expert mode");
+            }
+            const run = workflowRunFromObservations(readDistillObservations(project.hash));
+            if (!run) {
+                return text("No completed-and-verified Workflow run found in this project's observations. " +
+                    "A run qualifies when a `Workflow` tool call is followed by a passing verify/test/build in the same feed. " +
+                    "Run a workflow, verify its output, then try `ci_distill_from_workflow` again.");
+            }
+            const draftInstinct = draftFromWorkflowRun(run);
+            if (!isSafeDraftId(draftInstinct.id)) {
+                return error(`Internal error: generated draft id "${draftInstinct.id}" failed the safety check.`);
+            }
+            const draft = serializeDraft(draftInstinct);
+            const draftsDir = join(INSTINCTS_DIR, project.hash, "drafts");
+            const draftPath = join(draftsDir, `${draftInstinct.id}.yaml`);
+            try {
+                mkdirSync(draftsDir, { recursive: true });
+                writeFileSync(draftPath, draft);
+            }
+            catch (err) {
+                return error(`Failed to write draft to ${draftPath}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            return text([
+                "## Draft written from a verified workflow run",
+                "",
+                `**Workflow:** ${run.name}`,
+                `**Path:** ${draftPath}`,
+                "",
+                "Edit the body to capture the real recipe (preconditions, concrete steps, gotchas), then promote with:",
+                "",
+                `  ci_distill_promote id=${draftInstinct.id}`,
+                "",
+                "```yaml",
+                draft.trimEnd(),
+                "```",
+            ].join("\n"));
+        }
         case "ci_distill_promote": {
             if (MODE !== "expert") {
                 return error("ci_distill_promote requires expert mode");

package/bin/plan-pack.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+/**
+ * plan-pack (`ci-plan-pack`).
+ *
+ * Turn a plan doc into a commentable review packet a colleague can mark up.
+ *
+ *   node bin/plan-pack.mjs <plan.md>            write <plan>.review.md
+ *   node bin/plan-pack.mjs <plan.md> --stdout   print the packet to stdout
+ *   node bin/plan-pack.mjs <plan.md> --gh-issue write the packet, then print a
+ *                                               ready-to-run `gh issue create`
+ *                                               command (does NOT auto-post)
+ */
+import { readFileSync, writeFileSync } from "node:fs";
+import { extname } from "node:path";
+import { pathToFileURL } from "node:url";
+import { buildReviewPacket } from "../lib/plan-review-packet.mjs";
+function getErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function reviewPathFor(source) {
+    const ext = extname(source);
+    return ext ? `${source.slice(0, -ext.length)}.review${ext}` : `${source}.review.md`;
+}
+function packetTitle(packet) {
+    const match = /^# Review packet: (.*)$/m.exec(packet);
+    return match ? match[1].trim() : "Plan review";
+}
+const HELP = `
+plan-pack (ci-plan-pack) - turn a plan doc into a commentable review packet
+
+Usage: ci-plan-pack <plan.md> [--stdout] [--gh-issue]
+
+Options:
+  --stdout      Print the packet to stdout instead of writing a file
+  --gh-issue    Write the packet, then print a 'gh issue create' command
+                (does not post anything - you run it)
+
+Examples:
+  ci-plan-pack docs/plans/2026-06-15-plan-pack.md
+  ci-plan-pack docs/plans/2026-06-15-plan-pack.md --stdout
+`;
+function main() {
+    const args = process.argv.slice(2);
+    if (args.length === 0 || args.includes("--help") || args.includes("-h")) {
+        console.log(HELP);
+        process.exit(args.length === 0 ? 1 : 0);
+    }
+    const toStdout = args.includes("--stdout");
+    const ghIssue = args.includes("--gh-issue");
+    const source = args.find((a) => !a.startsWith("-"));
+    if (!source) {
+        throw new Error("Usage: ci-plan-pack <plan.md> [--stdout] [--gh-issue]");
+    }
+    const markdown = readFileSync(source, "utf8");
+    const packet = buildReviewPacket(markdown, { source });
+    if (toStdout) {
+        process.stdout.write(packet.endsWith("\n") ? packet : `${packet}\n`);
+        return;
+    }
+    const outPath = reviewPathFor(source);
+    writeFileSync(outPath, packet.endsWith("\n") ? packet : `${packet}\n`);
+    console.log(`Wrote review packet: ${outPath}`);
+    if (ghIssue) {
+        const title = packetTitle(packet);
+        console.log("\nTo open it for comments on GitHub, run:");
+        console.log(`  gh issue create --title "${title}" --body-file "${outPath}"`);
+    }
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    try {
+        main();
+    }
+    catch (error) {
+        console.error(`Error: ${getErrorMessage(error)}`);
+        process.exit(1);
+    }
+}