corporateai 0.0.1

package/scripts/check-forbidden-tokens.mjs

@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+/**
+ * check-forbidden-tokens.mjs
+ *
+ * Scans the codebase for forbidden tokens before publishing to npm.
+ * Mirrors the git pre-commit hook logic, but runs against the full
+ * working tree (not just staged changes).
+ *
+ * Token list: .git/hooks/forbidden-tokens.txt (one per line, # comments ok).
+ * If the file is missing, the check still uses the active local username when
+ * available. If username detection fails, the check degrades gracefully.
+ */
+
+import { execSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import os from "node:os";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+function uniqueNonEmpty(values) {
+  return Array.from(new Set(values.map((value) => value?.trim() ?? "").filter(Boolean)));
+}
+
+export function resolveDynamicForbiddenTokens(env = process.env, osModule = os) {
+  const candidates = [env.USER, env.LOGNAME, env.USERNAME];
+
+  try {
+    candidates.push(osModule.userInfo().username);
+  } catch {
+    // Some environments do not expose userInfo; env vars are enough fallback.
+  }
+
+  return uniqueNonEmpty(candidates);
+}
+
+export function readForbiddenTokensFile(tokensFile) {
+  if (!existsSync(tokensFile)) return [];
+
+  return readFileSync(tokensFile, "utf8")
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line && !line.startsWith("#"));
+}
+
+export function resolveForbiddenTokens(tokensFile, env = process.env, osModule = os) {
+  return uniqueNonEmpty([
+    ...resolveDynamicForbiddenTokens(env, osModule),
+    ...readForbiddenTokensFile(tokensFile),
+  ]);
+}
+
+export function runForbiddenTokenCheck({
+  repoRoot,
+  tokens,
+  exec = execSync,
+  log = console.log,
+  error = console.error,
+}) {
+  if (tokens.length === 0) {
+    log("  ℹ  Forbidden tokens list is empty — skipping check.");
+    return 0;
+  }
+
+  let found = false;
+
+  for (const token of tokens) {
+    try {
+      const result = exec(
+        `git grep -in --no-color -- ${JSON.stringify(token)} -- ':!pnpm-lock.yaml' ':!.git'`,
+        { encoding: "utf8", cwd: repoRoot, stdio: ["pipe", "pipe", "pipe"] },
+      );
+      if (result.trim()) {
+        if (!found) {
+          error("ERROR: Forbidden tokens found in tracked files:\n");
+        }
+        found = true;
+        const lines = result.trim().split("\n");
+        for (const line of lines) {
+          error(`  ${line}`);
+        }
+      }
+    } catch {
+      // git grep returns exit code 1 when no matches — that's fine
+    }
+  }
+
+  if (found) {
+    error("\nBuild blocked. Remove the forbidden token(s) before publishing.");
+    return 1;
+  }
+
+  log("  ✓  No forbidden tokens found.");
+  return 0;
+}
+
+function resolveRepoPaths(exec = execSync) {
+  const repoRoot = exec("git rev-parse --show-toplevel", { encoding: "utf8" }).trim();
+  const gitDir = exec("git rev-parse --git-dir", { encoding: "utf8", cwd: repoRoot }).trim();
+  return {
+    repoRoot,
+    tokensFile: resolve(repoRoot, gitDir, "hooks/forbidden-tokens.txt"),
+  };
+}
+
+function main() {
+  const { repoRoot, tokensFile } = resolveRepoPaths();
+  const tokens = resolveForbiddenTokens(tokensFile);
+  process.exit(runForbiddenTokenCheck({ repoRoot, tokens }));
+}
+
+const isMainModule = process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+
+if (isMainModule) {
+  main();
+}

package/scripts/clean-onboard-git.sh

@@ -0,0 +1,14 @@
+#!/bin/bash -ex
+export PC_TEST_ROOT="$(mktemp -d /tmp/paperclip-clean.XXXXXX)"
+export PC_HOME="$PC_TEST_ROOT/home"
+export PC_CACHE="$PC_TEST_ROOT/npm-cache"
+export PC_DATA="$PC_TEST_ROOT/paperclip-data"
+mkdir -p "$PC_HOME" "$PC_CACHE" "$PC_DATA"
+echo "PC_TEST_ROOT: $PC_TEST_ROOT"
+echo "PC_HOME: $PC_HOME"
+cd $PC_TEST_ROOT
+git clone https://github.com/EvanGribar/corporate.git repo
+cd repo
+pnpm install
+env HOME="$PC_HOME" npm_config_cache="$PC_CACHE" npm_config_userconfig="$PC_HOME/.npmrc" \
+  pnpm corporateai onboard --yes --data-dir "$PC_DATA"

package/scripts/clean-onboard-npm.sh

@@ -0,0 +1,13 @@
+#!/bin/bash -ex
+export PC_TEST_ROOT="$(mktemp -d /tmp/paperclip-clean.XXXXXX)"
+export PC_HOME="$PC_TEST_ROOT/home"
+export PC_CACHE="$PC_TEST_ROOT/npm-cache"
+export PC_DATA="$PC_TEST_ROOT/paperclip-data"
+mkdir -p "$PC_HOME" "$PC_CACHE" "$PC_DATA"
+echo "PC_TEST_ROOT: $PC_TEST_ROOT"
+echo "PC_HOME: $PC_HOME"
+cd $PC_TEST_ROOT
+env HOME="$PC_HOME" \
+  npm_config_cache="$PC_CACHE" \
+  npm_config_userconfig="$PC_HOME/.npmrc" \
+  npx --yes corporateai onboard --yes --data-dir "$PC_DATA"

package/scripts/clean-onboard-ref.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+TARGET_REF="${1:-HEAD}"
+
+usage() {
+  cat <<'EOF'
+Usage:
+  ./scripts/clean-onboard-ref.sh [git-ref]
+
+Examples:
+  ./scripts/clean-onboard-ref.sh
+  ./scripts/clean-onboard-ref.sh HEAD
+  ./scripts/clean-onboard-ref.sh v0.2.7
+
+Environment overrides:
+  KEEP_TEMP=1                 Keep the temp directory and detached worktree for debugging
+  PC_TEST_ROOT=/tmp/custom    Base temp directory to use
+  PC_DATA=/tmp/data           Paperclip data dir to use
+  PAPERCLIP_HOST=127.0.0.1    Host passed to the onboarded server
+  PAPERCLIP_PORT=3232         Port passed to the onboarded server
+
+Notes:
+  - Defaults to the current committed ref (HEAD), not uncommitted local edits.
+  - Creates an isolated temp HOME, npm cache, data dir, and detached git worktree.
+EOF
+}
+
+if [ $# -gt 1 ]; then
+  usage
+  exit 1
+fi
+
+if [ $# -eq 1 ] && [[ "$1" =~ ^(-h|--help)$ ]]; then
+  usage
+  exit 0
+fi
+
+TARGET_COMMIT="$(git -C "$REPO_ROOT" rev-parse --verify "${TARGET_REF}^{commit}")"
+
+export KEEP_TEMP="${KEEP_TEMP:-0}"
+export PC_TEST_ROOT="${PC_TEST_ROOT:-$(mktemp -d /tmp/paperclip-clean-ref.XXXXXX)}"
+export PC_HOME="${PC_HOME:-$PC_TEST_ROOT/home}"
+export PC_CACHE="${PC_CACHE:-$PC_TEST_ROOT/npm-cache}"
+export PC_DATA="${PC_DATA:-$PC_TEST_ROOT/paperclip-data}"
+export PC_REPO="${PC_REPO:-$PC_TEST_ROOT/repo}"
+export PAPERCLIP_HOST="${PAPERCLIP_HOST:-127.0.0.1}"
+export PAPERCLIP_PORT="${PAPERCLIP_PORT:-3100}"
+export PAPERCLIP_OPEN_ON_LISTEN="${PAPERCLIP_OPEN_ON_LISTEN:-false}"
+
+cleanup() {
+  if [ "$KEEP_TEMP" = "1" ]; then
+    return
+  fi
+
+  git -C "$REPO_ROOT" worktree remove --force "$PC_REPO" >/dev/null 2>&1 || true
+  rm -rf "$PC_TEST_ROOT"
+}
+
+trap cleanup EXIT
+
+mkdir -p "$PC_HOME" "$PC_CACHE" "$PC_DATA"
+
+echo "TARGET_REF: $TARGET_REF"
+echo "TARGET_COMMIT: $TARGET_COMMIT"
+echo "PC_TEST_ROOT: $PC_TEST_ROOT"
+echo "PC_HOME: $PC_HOME"
+echo "PC_DATA: $PC_DATA"
+echo "PC_REPO: $PC_REPO"
+echo "PAPERCLIP_HOST: $PAPERCLIP_HOST"
+echo "PAPERCLIP_PORT: $PAPERCLIP_PORT"
+
+git -C "$REPO_ROOT" worktree add --detach "$PC_REPO" "$TARGET_COMMIT"
+
+cd "$PC_REPO"
+pnpm install
+
+env \
+  HOME="$PC_HOME" \
+  npm_config_cache="$PC_CACHE" \
+  npm_config_userconfig="$PC_HOME/.npmrc" \
+  HOST="$PAPERCLIP_HOST" \
+  PORT="$PAPERCLIP_PORT" \
+  PAPERCLIP_OPEN_ON_LISTEN="$PAPERCLIP_OPEN_ON_LISTEN" \
+  pnpm corporateai onboard --yes --data-dir "$PC_DATA"

package/scripts/create-github-release.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=./release-lib.sh
+. "$REPO_ROOT/scripts/release-lib.sh"
+
+dry_run=false
+version=""
+
+usage() {
+  cat <<'EOF'
+Usage:
+  ./scripts/create-github-release.sh <version> [--dry-run]
+
+Examples:
+  ./scripts/create-github-release.sh 2026.318.0
+  ./scripts/create-github-release.sh 2026.318.0 --dry-run
+
+Notes:
+  - Run this after pushing the stable tag.
+  - Resolves the git remote automatically.
+  - In GitHub Actions, origin is used explicitly.
+  - If the release already exists, this script updates its title and notes.
+EOF
+}
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --dry-run) dry_run=true ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      if [ -n "$version" ]; then
+        echo "Error: only one version may be provided." >&2
+        exit 1
+      fi
+      version="$1"
+      ;;
+  esac
+  shift
+done
+
+if [ -z "$version" ]; then
+  usage
+  exit 1
+fi
+
+if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  echo "Error: version must be a stable calendar version like 2026.318.0." >&2
+  exit 1
+fi
+
+tag="v$version"
+notes_file="$REPO_ROOT/releases/${tag}.md"
+if [ "${GITHUB_ACTIONS:-}" = "true" ] && [ -z "${PUBLISH_REMOTE:-}" ] && git_remote_exists origin; then
+  PUBLISH_REMOTE=origin
+fi
+PUBLISH_REMOTE="$(resolve_release_remote)"
+if ! command -v gh >/dev/null 2>&1; then
+  echo "Error: gh CLI is required to create GitHub releases." >&2
+  exit 1
+fi
+
+GITHUB_REPO="$(github_repo_from_remote "$PUBLISH_REMOTE" || true)"
+if [ -z "$GITHUB_REPO" ]; then
+  echo "Error: could not determine GitHub repository from remote $PUBLISH_REMOTE." >&2
+  exit 1
+fi
+
+if [ ! -f "$notes_file" ]; then
+  echo "Error: release notes file not found at $notes_file." >&2
+  exit 1
+fi
+
+if ! git -C "$REPO_ROOT" rev-parse "$tag" >/dev/null 2>&1; then
+  echo "Error: local git tag $tag does not exist." >&2
+  exit 1
+fi
+
+if [ "$dry_run" = true ]; then
+  echo "[dry-run] gh release create $tag -R $GITHUB_REPO --title $tag --notes-file $notes_file"
+  exit 0
+fi
+
+if ! git -C "$REPO_ROOT" ls-remote --exit-code --tags "$PUBLISH_REMOTE" "refs/tags/$tag" >/dev/null 2>&1; then
+  echo "Error: remote tag $tag was not found on $PUBLISH_REMOTE. Push the release commit and tag first." >&2
+  exit 1
+fi
+
+if gh release view "$tag" -R "$GITHUB_REPO" >/dev/null 2>&1; then
+  gh release edit "$tag" -R "$GITHUB_REPO" --title "$tag" --notes-file "$notes_file"
+  echo "Updated GitHub Release $tag"
+else
+  gh release create "$tag" -R "$GITHUB_REPO" --title "$tag" --notes-file "$notes_file"
+  echo "Created GitHub Release $tag"
+fi

package/scripts/dev-runner-paths.mjs

@@ -0,0 +1,38 @@
+const testDirectoryNames = new Set([
+  "__tests__",
+  "_tests",
+  "test",
+  "tests",
+]);
+
+const ignoredTestConfigBasenames = new Set([
+  "jest.config.cjs",
+  "jest.config.js",
+  "jest.config.mjs",
+  "jest.config.ts",
+  "playwright.config.ts",
+  "vitest.config.ts",
+]);
+
+export function shouldTrackDevServerPath(relativePath) {
+  const normalizedPath = String(relativePath).replaceAll("\\", "/").replace(/^\.\/+/, "");
+  if (normalizedPath.length === 0) return false;
+
+  const segments = normalizedPath.split("/");
+  const basename = segments.at(-1) ?? normalizedPath;
+
+  if (segments.includes(".paperclip")) {
+    return false;
+  }
+  if (ignoredTestConfigBasenames.has(basename)) {
+    return false;
+  }
+  if (segments.some((segment) => testDirectoryNames.has(segment))) {
+    return false;
+  }
+  if (/\.(test|spec)\.[^/]+$/i.test(basename)) {
+    return false;
+  }
+
+  return true;
+}