create-evda 0.1.5 → 0.1.7

package/lib/prompt-hook.mjs

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+// Every message the owner sends, filed, in Claude Code (HQ-1385): a UserPromptSubmit hook that
+// appends each prompt verbatim to the day's record, deterministically, before the model sees it.
+//
+// Mike, 2026-09-22, asked what the Claude app files: "Everything... how we can make this even more
+// sustainable so that I can do this for all of the users." A tool description and an instruction
+// are prompts, and a model can ignore both; a hook cannot be ignored. It exists only for an owner who
+// answered "everything" to the one setup question: it reads evda.json `filing` on every call and
+// files nothing when it says anything else, and `evda hook install` installs it only then.
+//
+// The append is lib/day-file.mjs appendToDay, the path evda_write uses: the first prompt of a
+// session opens `## HH:MM`, later ones go under it. The session is Claude Code's session_id, kept
+// in a small state file outside the record. A prompt holding something shaped like a password, key
+// or token is not filed (lib/secret-shape.mjs, the check evda_write makes); a slash command is not
+// the owner's words and is not filed.
+//
+// What it prints is added to the model's context: one line naming the file, so the model does not
+// file the same words again with evda_write.
+//
+// Copied byte for byte into <record>/.claude/hooks/evda-file-prompt.mjs beside day-file.mjs and
+// secret-shape.mjs. Any error of its own exits 0 with no output: a broken hook must never block the
+// owner's message.
+//
+// EVDA_CHAT_FALSIFY=ignore-filing files even when evda.json does not say "everything", for the test
+// that shows the hook reads the owner's answer.
+
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
+import { tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
+import { dayRole, findRecord, filingOf, appendToDay, localDate } from "./day-file.mjs";
+import { secretShape } from "./secret-shape.mjs";
+
+export const PROMPT_HOOK_NAME = "evda-file-prompt.mjs";
+
+const falsified = (mode) => (process.env.EVDA_CHAT_FALSIFY ?? "").split(",").map((s) => s.trim()).includes(mode);
+
+function stateFile(sid) {
+  const dir = process.env.EVDA_PROMPT_STATE_DIR || join(tmpdir(), "evda-file-prompt");
+  mkdirSync(dir, { recursive: true });
+  return join(dir, `${String(sid).replace(/[^A-Za-z0-9_-]/g, "_")}.json`);
+}
+
+// One UserPromptSubmit event in, the hook's stdout out ("" for nothing to say). Never throws.
+export function run(payload, { now = new Date() } = {}) {
+  try {
+    const prompt = typeof payload?.prompt === "string" ? payload.prompt : "";
+    if (!prompt.trim() || /^\s*\//.test(prompt)) return "";
+    const here = dirname(fileURLToPath(import.meta.url));
+    const root = findRecord(payload.cwd || process.cwd()) ?? findRecord(here);
+    if (!root) return "";
+    const manifest = JSON.parse(readFileSync(join(root, "evda.json"), "utf8"));
+    if (filingOf(manifest) !== "everything" && !falsified("ignore-filing")) return "";
+    const role = dayRole(manifest.mapping ?? {});
+    if (!role) return "";
+    const shape = prompt.split("\n").map(secretShape).find(Boolean);
+    if (shape) return `evda: this message was not filed, because it holds ${shape}. Keep that in a password manager; file the rest of what they said with evda_write if it is worth keeping.`;
+    const dayAbs = join(root, manifest.mapping[role].replace(/\/+$/, ""));
+    mkdirSync(dayAbs, { recursive: true });
+    const abs = join(dayAbs, `${localDate(now)}.md`);
+    const sf = stateFile(payload.session_id ?? "unknown");
+    let session = {};
+    try { session = JSON.parse(readFileSync(sf, "utf8")); } catch { /* the first prompt of the session */ }
+    appendToDay(abs, { now, words: prompt, session });
+    writeFileSync(sf, JSON.stringify(session) + "\n");
+    const rel = relative(root, abs).split("\\").join("/");
+    return `evda: the owner's message above is already filed verbatim in ${rel}. Do not file it again with evda_write.`;
+  } catch {
+    return "";
+  }
+}
+
+const entry = (() => {
+  try { return process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url)); } catch { return false; }
+})();
+
+if (entry && existsSync(process.argv[1])) {
+  let input = "";
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", (d) => (input += d));
+  process.stdin.on("end", () => {
+    let payload = null;
+    try { payload = JSON.parse(input); } catch { /* not a hook call */ }
+    const out = run(payload);
+    if (out) process.stdout.write(out);
+    process.exit(0);
+  });
+}

package/lib/publish.mjs

@@ -0,0 +1,264 @@
+// `evda publish public`: the public circle as a signed, plaintext export (Spec 08, section 4).
+//
+// Runs on the owner's device, reads only the public circle's declared members, and writes
+//
+//   <out>/manifest.json   format, circle id, record id, publishedAt, files [{ path, sha256, bytes }],
+//                         tables [{ table, where, rows }], publicKey, signature (Ed25519 over the
+//                         canonical manifest, which is the manifest without its signature, keys sorted)
+//   <out>/files/<path>    the member files, byte for byte; and each render member's file, rendered
+//                         from the released entries that name its view (lib/render.mjs, HQ-1351),
+//                         listed in the manifest with `by: "view"`, the view's name and the source
+//                         entries' record paths and sha256s. The entries a view consumes are not
+//                         exported as themselves: the rendering is their public form, and the
+//                         public set stays exactly what the site reads.
+//
+// Never through the relay: a public circle needs no key, a durable URL and a cache, and the relay
+// is delete-on-ack with sealed envelopes a browser cannot open.
+//
+// Three checks run on the device before anything is written, and each can refuse (exit 2):
+//
+//   1. the circle is opened through `publicCircle`, which throws unless exactly one public circle
+//      is named, and only its declared members are read;
+//   2. one keyed circle per path, and that circle allows release: a file under a public path member
+//      that any other circle also covers is refused, so a private path cannot also be a public
+//      member; a file gathered by rule (Spec 07 section 3, HQ-1351) is exported at its record path
+//      only when its one home circle's release names the public circle, and a match the home
+//      refuses refuses the whole publish rather than being dropped; a view with any problem (an
+//      entry naming a view nothing renders, a repeated order, a body with no JSON) refuses too;
+//   3. render as a stranger: every private circle's label is searched for in the bytes about to be
+//      written, and a hit refuses. A label is its opaque id, its namespace, its own directory, a
+//      member path, or its name between slashes. The exported files' own paths are the released
+//      set (doctor prints them every run) and are left out of that search, since a marked file
+//      necessarily lives under a keyed circle's member path.
+//
+// The fourth check in the spec (the site holds no credential to anything else) is a property of
+// where the export is served, not of this code.
+//
+// The signing key is the record's identity key. The Node host keeps it in its own database until
+// the keychain adapter (slice 2), so this reads the 32-byte Ed25519 seed from a file the device
+// exports, hex encoded, named by --key.
+
+import { createHash, createPrivateKey, createPublicKey, sign, verify } from "node:crypto";
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { openEvda } from "./manifest.mjs";
+import { publicCircle, readCircles, released, homesOf, withoutSealed, carries } from "./circles.mjs";
+import { renderViews } from "./render.mjs";
+import { EvdaError } from "./errors.mjs";
+
+export const EXPORT_FORMAT = "evda-public-export/1";
+
+// The boundary checks, as a switch a test can turn off to show that the acceptance test fails
+// without them (FALSIFIED lines in atlas-local/src/slice.e2e.test.ts). Nothing in this package
+// turns them off.
+export const PUBLISH_CHECKS = { onePerPath: true, strangerRender: true };
+
+const ED25519_PKCS8 = "302e020100300506032b657004220420";
+const sha256Hex = (bytes) => createHash("sha256").update(bytes).digest("hex");
+
+function filesUnder(abs) {
+  const st = statSync(abs);
+  if (st.isFile()) return [abs];
+  const out = [];
+  for (const name of readdirSync(abs).sort()) {
+    if (name.startsWith(".")) continue;
+    out.push(...filesUnder(join(abs, name)));
+  }
+  return out;
+}
+
+const posix = (rel) => rel.split(sep).join("/");
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+// Build the export in memory and run the checks. Writes nothing.
+export function buildPublicExport(evda, { circleName = null, publishedAt = new Date() } = {}) {
+  const circle = publicCircle(evda, circleName);
+  const all = readCircles(evda) ?? [];
+
+  const files = [];
+  for (const m of Object.values(circle.members)) {
+    if (m.kind !== "path") continue;
+    for (const abs of filesUnder(m.abs)) files.push({ abs, path: posix(relative(evda.dir, abs)), by: "path" });
+  }
+
+  if (PUBLISH_CHECKS.onePerPath) {
+    // A file under a public member is exported only when the public circle is its HOME, by longest
+    // member path (HQ-1364): a private circle at the record root does not make it private, and a
+    // private circle with a longer member under the public one does.
+    for (const f of files) {
+      const others = homesOf(evda, all, f.abs).filter((n) => n !== circle.name);
+      if (others.length) {
+        throw new EvdaError(`REFUSED: ${f.path} is a public member and is also covered by circle "${others[0]}". One access answer per entry; nothing was written.`, { code: "TWO_CIRCLES", exit: 2 });
+      }
+    }
+  }
+
+  // Files gathered by rule: from wherever they live, only out of a home whose release names this
+  // circle. With the check off (a test proving it matters), a refused match is exported like any other.
+  const gathered = released(evda, all).find((r) => r.circle === circle.name) ?? { byRule: [], refused: [] };
+  if (PUBLISH_CHECKS.onePerPath && gathered.refused.length) {
+    const f = gathered.refused[0];
+    throw new EvdaError(`REFUSED: ${f.path} matches a rule of the public circle and ${f.reason}. Nothing was written.`, { code: "REFUSED_MARK", exit: 2 });
+  }
+  for (const f of gathered.byRule) files.push({ abs: f.abs, path: f.path, by: "mark", circle: f.circle });
+  if (!PUBLISH_CHECKS.onePerPath) for (const f of gathered.refused.filter((f) => f.abs !== undefined && f.member !== "release")) files.push({ abs: f.abs, path: f.path, by: "mark", circle: f.circle });
+
+  // Views (HQ-1351): every released entry that names a view is consumed by the render member that
+  // declares it, and the rendered file is exported in its place. Any problem refuses the publish.
+  const rendered = renderViews(evda, circle, { byPath: files.filter((f) => f.by === "path"), byRule: files.filter((f) => f.by === "mark") });
+  if (rendered.problems.length) {
+    const p = rendered.problems[0];
+    throw new EvdaError(`REFUSED: ${p.path} ${p.message}${rendered.problems.length > 1 ? ` (${rendered.problems.length - 1} more problem(s); evda doctor names them all)` : ""} Nothing was written.`, { code: "REFUSED_VIEW", exit: 2 });
+  }
+  const consumed = new Set(rendered.views.flatMap((v) => v.entries.map((e) => e.path)));
+  // A sealed section (HQ-1220) is cut out of every markdown file on the way out; the rest of the
+  // file is exported, and nothing marks where the section was. A sealed FILE never gets here:
+  // released() refuses it, and a refusal refuses the publish above.
+  let sealedCut = 0;
+  const exportBytes = (abs) => {
+    const bytes = readFileSync(abs);
+    if (!/\.md$/i.test(abs) || !carries("publish", "sealed")) return bytes;
+    const cut = withoutSealed(bytes.toString("utf8"));
+    if (!cut.sections) return bytes;
+    sealedCut += cut.sections;
+    return Buffer.from(cut.text, "utf8");
+  };
+  const loaded = files.filter((f) => !consumed.has(f.path)).map((f) => ({ path: f.path, bytes: exportBytes(f.abs), by: f.by }));
+  for (const v of rendered.views) loaded.push({ path: v.path, bytes: v.bytes, by: "view", view: v.view, sources: v.entries.map((e) => ({ path: e.path, sha256: e.sha256 })) });
+  loaded.sort((a, b) => a.path.localeCompare(b.path));
+
+  const tables = Object.values(circle.members)
+    .filter((m) => m.kind === "table")
+    // A table member is a live read on the host that serves it. The snapshot for a reader that has
+    // no such host is not built in the first slice, so the rows are recorded as not included.
+    .map((m) => ({ table: m.table, where: m.where, rows: null }));
+  const manifest = {
+    format: EXPORT_FORMAT,
+    circle: circle.id,
+    record: evda.manifest.id ?? null,
+    publishedAt: publishedAt instanceof Date ? publishedAt.toISOString() : String(publishedAt),
+    files: loaded.map((f) => (f.by === "view"
+      ? { path: f.path, sha256: sha256Hex(f.bytes), bytes: f.bytes.length, by: "view", view: f.view, sources: f.sources }
+      : { path: f.path, sha256: sha256Hex(f.bytes), bytes: f.bytes.length })),
+    tables,
+  };
+
+  if (PUBLISH_CHECKS.strangerRender) {
+    // The manifest minus the exported paths themselves and a rendered file's source paths: they
+    // are the released set by definition, and a marked file's path is always under some keyed
+    // circle's member path. A rendered file's own path is chosen, not inherited, so it is searched.
+    const manifestSansPaths = { ...manifest, files: manifest.files.map(({ path: _p, sources: _s, ...rest }) => rest) };
+    const haystacks = [
+      { where: "manifest.json", text: JSON.stringify(manifestSansPaths) },
+      { where: "manifest.json (rendered paths)", text: manifest.files.filter((f) => f.by === "view").map((f) => f.path).join("\n") },
+      ...loaded.map((f) => ({ where: f.path, text: f.bytes.toString("utf8") })),
+    ];
+    for (const c of all.filter((x) => x.manifest?.public !== true)) {
+      // What identifies a private circle to a stranger is a LABEL: a path segment, the circle's own
+      // directory, or the opaque id that travels on a Change and in an export manifest. A name
+      // matched as a word anywhere in the bytes is not that test, and on a real record it refuses
+      // every publish there is: his private circles are core, health, money, people, school,
+      // therapy, wellness and workshop, and his public fact sheet says "10 core mechanics" and
+      // "help other people understand me" (2026-09-21, HQ-1199). So the name is matched only
+      // between slashes, and the id and namespace, which the word match never looked at, are
+      // matched literally. The gap this leaves, stated so the next reader does not rediscover it:
+      // a distinctive circle name written as bare prose passes.
+      const needles = [];
+      // A one-segment path is a bare name, so it is matched the way a name is: between slashes.
+      // "CLAUDE.md" is a member of his core circle AND a filename his public projects page names;
+      // as a raw substring it refuses every publish while disclosing nothing.
+      const label = (s) => (s.includes("/") ? new RegExp(escapeRe(s)) : new RegExp(`(^|[\\\\/])${escapeRe(s)}($|[\\\\/])`, "iu"));
+      for (const s of new Set([c.name, c.manifest?.title].filter((v) => typeof v === "string" && v.trim() !== ""))) {
+        needles.push({ what: `the name of private circle "${c.name}" as a path segment`, re: label(s) });
+      }
+      for (const s of new Set([c.id, c.manifest?.id, c.manifest?.namespace].filter((v) => typeof v === "string" && v.trim() !== ""))) {
+        needles.push({ what: `the id of private circle "${c.name}" (${s})`, re: new RegExp(escapeRe(s)) });
+      }
+      needles.push({ what: `the directory of private circle "${c.name}" (${c.rel})`, re: label(c.rel.replace(/\/+$/, "")) });
+      for (const m of Object.values(c.members)) {
+        // The record root ("") is a member with no name: it identifies nothing to a stranger, and as
+        // a bare label it matched every "//" in a URL and refused every publish (found 2026-09-22,
+        // the day after HQ-1364 made core a root member).
+        if (m.kind === "path" && m.rel !== "") needles.push({ what: `a member path of private circle "${c.name}" (${m.rel})`, re: label(m.rel.replace(/\/+$/, "")) });
+      }
+      for (const n of needles) {
+        const hit = haystacks.find((h) => n.re.test(h.text));
+        if (hit) throw new EvdaError(`REFUSED: rendered as a stranger, the export shows ${n.what} in ${hit.where}. Nothing was written.`, { code: "STRANGER_RENDER", exit: 2 });
+      }
+    }
+  }
+
+  return { manifest, files: loaded, sealedCut };
+}
+
+export function canonicalManifest(manifest) {
+  const sortKeys = (v) => (Array.isArray(v) ? v.map(sortKeys) : v && typeof v === "object" ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, sortKeys(v[k])])) : v);
+  const { signature: _omit, ...rest } = manifest;
+  return JSON.stringify(sortKeys(rest));
+}
+
+export function signManifest(manifest, seedHex) {
+  if (!/^[0-9a-f]{64}$/i.test(seedHex.trim())) throw new EvdaError("REFUSED: the signing key must be a 32-byte Ed25519 seed, hex encoded.", { code: "BAD_KEY", exit: 2 });
+  const privateKey = createPrivateKey({ key: Buffer.concat([Buffer.from(ED25519_PKCS8, "hex"), Buffer.from(seedHex.trim(), "hex")]), format: "der", type: "pkcs8" });
+  const { x } = createPublicKey(privateKey).export({ format: "jwk" });
+  const withKey = { ...manifest, publicKey: Buffer.from(x, "base64url").toString("base64") };
+  return { ...withKey, signature: sign(null, Buffer.from(canonicalManifest(withKey)), privateKey).toString("base64") };
+}
+
+// Verify an export against a key the reader already trusts (raw 32-byte Ed25519 public key), never
+// against the key the manifest carries. Returns { ok, why }.
+export function verifyExport(out, publicKeyRaw) {
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(join(out, "manifest.json"), "utf8"));
+  } catch (e) {
+    return { ok: false, why: `manifest.json is unreadable (${e.message})` };
+  }
+  const key = createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: Buffer.from(publicKeyRaw).toString("base64url") }, format: "jwk" });
+  let good = false;
+  try {
+    good = verify(null, Buffer.from(canonicalManifest(manifest)), key, Buffer.from(String(manifest.signature ?? ""), "base64"));
+  } catch {
+    good = false;
+  }
+  if (!good) return { ok: false, why: "the signature does not verify against the key given" };
+  for (const f of manifest.files ?? []) {
+    const p = join(out, "files", f.path);
+    if (!existsSync(p)) return { ok: false, why: `${f.path} is listed and missing` };
+    const bytes = readFileSync(p);
+    if (bytes.length !== f.bytes || sha256Hex(bytes) !== f.sha256) return { ok: false, why: `${f.path} does not match its manifest entry` };
+  }
+  return { ok: true, why: `signature verifies; ${manifest.files.length} file(s) match` };
+}
+
+// Write the export. The record is never the destination.
+export function writeExport(evda, out, { manifest, files }) {
+  const abs = resolve(out);
+  if (abs === evda.dir || abs.startsWith(evda.dir + sep)) throw new EvdaError(`REFUSED: ${out} is inside the record; an export is written outside it.`, { code: "EXPORT_INSIDE", exit: 2 });
+  rmSync(join(abs, "files"), { recursive: true, force: true });
+  for (const f of files) {
+    const p = join(abs, "files", f.path);
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(p, f.bytes);
+  }
+  writeFileSync(join(abs, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
+  return abs;
+}
+
+// The CLI half, called from bin/evda.mjs so that file only dispatches.
+export async function publishCommand(dir, circleName, { out, key }) {
+  if (circleName !== "public") throw new EvdaError(`publish takes the public circle: evda publish public --out <dir> --key <seed file>`, { exit: 2 });
+  if (!out || !key) throw new EvdaError("publish needs --out <dir> and --key <file holding the identity seed, hex>", { exit: 2 });
+  const evda = openEvda(dir);
+  const built = buildPublicExport(evda);
+  const signed = signManifest(built.manifest, readFileSync(key, "utf8"));
+  const at = writeExport(evda, out, { manifest: signed, files: built.files });
+  const marked = built.files.filter((f) => f.by === "mark").length;
+  const views = built.files.filter((f) => f.by === "view");
+  const drawn = views.reduce((n, f) => n + f.sources.length, 0);
+  console.log(`published ${built.files.length} file(s) from the public circle to ${at} (${built.files.length - marked - views.length} by path, ${marked} by mark${views.length ? `, ${views.length} rendered from ${drawn} entries` : ""})`);
+  for (const f of views) console.log(`  view  ${f.path}  rendered from ${f.sources.length} entries (${f.view})`);
+  if (built.sealedCut) console.log(`  ${built.sealedCut} sealed section(s) left out of the files they sit in`);
+  console.log(`CHECKED ${built.files.length} public members, signed by ${signed.publicKey}`);
+  return 0;
+}