create-pmos 0.14.0 → 0.16.0

package/workspace/lib/repo-scan.js

@@ -0,0 +1,469 @@
+'use strict';
+/*
+ * Repo scanner for the product-ingest pipeline (design bundle 2, area 3 — "multiple products").
+ *
+ * WHAT THIS IS. A PURE reader. `scanRepo(root)` opens a repository the PM has pointed at, reads the
+ * initiative records under `planning/initiatives/` and the ADRs under `okf/**\/adr/`, and returns a
+ * PROPOSAL describing what an import WOULD contain. It writes nothing — no files, no state rows, no
+ * board. The caller decides; this module only reports.
+ *
+ * THE ONE RULE THE DESIGN STATES AND THIS MODULE ENFORCES: **the scan proposes, it never decides.**
+ * Concretely that means the two anchor fields are separate and can never be confused:
+ *
+ *     declaredAnchor   what the repository itself wrote in `parent_kr:`. A statement by the repo.
+ *     guessedAnchor    what this scanner INFERRED from prose because no `parent_kr:` was written.
+ *
+ * They are mutually exclusive by construction — a record with a declaration is never guessed at, and
+ * a guess is never written into the declared slot. That separation is the whole point of the module.
+ * D59 rejects unanchored work; if a guess could reach a consumer wearing a declaration's clothes,
+ * the ingest pipeline would become a laundering path for exactly the work the anchor gate exists to
+ * stop. `why` states, per record, which of the two it is and on what evidence, in words a PM can
+ * check without reading this file.
+ *
+ * HONEST STATES (the same three the rest of the workspace uses):
+ *   - A read that SUCCEEDS and finds nothing is CALM: an empty `initiatives` array plus a log line
+ *     saying the directory is absent or holds no records. Never an error.
+ *   - A read that FAILS is RED and carries its reason: the file lands in `unreadable` with the
+ *     actual error, and a mirrored `error`-level entry appears in the log. It is never dropped.
+ *   - ABSENCE IS STATED, never implied. Every file the scan chose not to propose gets a log line
+ *     saying so and why. "Not in the output" is not a way to communicate anything.
+ *
+ * `ok` is narrow on purpose: it answers ONLY "could the scan run at all" — i.e. is `root` a readable
+ * directory. A repository whose `planning/` is missing, or one file of thirty that will not parse,
+ * still returns `ok: true`, because the scan DID run and its findings are trustworthy as far as they
+ * go. Collapsing "this folder has no initiatives" into the same flag as "I could not look" would
+ * make a partial-but-honest result indistinguishable from a broken one.
+ *
+ * Return shape (identical in every outcome, including failure — a consumer never branches on shape):
+ *   {
+ *     ok: boolean,
+ *     error: string|null,                                  // set only when ok === false
+ *     root: string,
+ *     initiatives: [{ id, path, declaredAnchor|null, guessedAnchor|null, why }],
+ *     adrs:        [{ id, path, title|null }],
+ *     log:         [{ level: 'info'|'warn'|'error', path|null, message }],
+ *     unreadable:  [{ path, error }],
+ *   }
+ *
+ * CommonJS, zero dependencies, stock Node. Nothing here shells out or touches the network.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+/*
+ * Caps. A scan reads a repository this machine did not write, so it has to be willing to meet a
+ * hostile or merely broken one and still terminate with an honest answer.
+ *
+ * MAX_BYTES — an initiative record is prose with frontmatter; a megabyte is already absurd for one.
+ * Past the cap the file becomes `unreadable` WITH ITS SIZE rather than being read into memory or
+ * quietly skipped, so the PM learns the real reason a record is missing from the proposal.
+ *
+ * MAX_DEPTH — the ADR search walks `okf/` looking for directories named `adr`. A cycle made of
+ * directory symlinks would otherwise spin forever; we also refuse to descend into symlinked
+ * directories at all (see `walkForAdrDirs`), so the cap is a belt to that braces.
+ */
+const MAX_BYTES = 1024 * 1024;
+const MAX_DEPTH = 8;
+const SKIP_DIRS = new Set(['.git', 'node_modules', '.venv', 'venv', '__pycache__', 'dist', 'build', '.next', 'coverage']);
+
+/** Repo-relative, forward-slash path — what the log and the proposal quote back to the PM. */
+function relPath(root, p) {
+  const r = path.relative(root, p);
+  return r.split(path.sep).join('/');
+}
+
+function shortErr(e) {
+  const m = (e && (e.code || e.message)) || String(e);
+  return String(m).slice(0, 200);
+}
+
+/*
+ * ── reading one file ──────────────────────────────────────────────────────────────────────────
+ *
+ * SYMLINKS ARE REFUSED, NOT FOLLOWED. This scanner is pointed at a repository the PM cloned rather
+ * than wrote, and `planning/initiatives/x.md` could be a link to anything on the machine. Following
+ * it would put a file from outside the repo into a proposal labelled as belonging to the repo —
+ * which is a false statement about provenance even when the contents are harmless. Refusing states
+ * the fact ("it is a symlink") instead of silently importing something else.
+ */
+function readTextFile(file) {
+  let st;
+  try { st = fs.lstatSync(file); }
+  catch (e) { return { ok: false, error: `could not stat the file (${shortErr(e)})` }; }
+  if (st.isSymbolicLink()) {
+    return { ok: false, error: 'is a symbolic link — not followed, because a scan must not import a file from outside the repository it claims to describe' };
+  }
+  if (!st.isFile()) return { ok: false, error: 'is not a regular file' };
+  if (st.size > MAX_BYTES) {
+    return { ok: false, error: `is ${st.size} bytes, past the ${MAX_BYTES}-byte scan cap — not read, so nothing is claimed about it` };
+  }
+  try { return { ok: true, text: fs.readFileSync(file, 'utf8') }; }
+  catch (e) { return { ok: false, error: `could not be read (${shortErr(e)})` }; }
+}
+
+/*
+ * ── frontmatter ───────────────────────────────────────────────────────────────────────────────
+ *
+ * Deliberately close to `lib/file-mode-parse.js#parseLeadingFrontmatter` — the LEADING block only,
+ * so body prose can never fake a declaration — with one addition that module does not need: an
+ * UNTERMINATED fence is reported as malformed rather than parsed leniently.
+ *
+ * Why that difference matters here and not there: file-mode-parse reads records this repo wrote and
+ * CI already lints. This reads a stranger's repo, where `---` with no closing `---` means the whole
+ * document is being read as frontmatter and the "record" we would propose is an artefact of a typo.
+ * Better to hand that file to a human as unreadable-with-a-reason than to propose a guess built on
+ * a misparse.
+ *
+ * Returns { ok:true, fm, fenced, bodyStartLine } | { ok:false, error }.
+ */
+function parseFrontmatter(text) {
+  const lines = String(text == null ? '' : text).split('\n');
+  let i = 0;
+  while (i < lines.length && !lines[i].trim()) i++;
+  const fenced = i < lines.length && lines[i].trim() === '---';
+
+  let block, bodyStartLine;
+  if (fenced) {
+    const open = i;
+    let close = -1;
+    for (let j = open + 1; j < lines.length; j++) {
+      if (lines[j].trim() === '---') { close = j; break; }
+    }
+    if (close === -1) {
+      return { ok: false, error: 'the frontmatter block opens with `---` and never closes — the whole file would be read as frontmatter, so nothing here can be trusted as a record' };
+    }
+    block = lines.slice(open + 1, close);
+    bodyStartLine = close + 2;            // 1-indexed line number of the first body line
+  } else {
+    // No fence: accept a leading run of `key: value` lines (the lenient house form), stopping at the
+    // first line that is neither blank nor a key — same boundary rule metrics.py and the CLI use.
+    const start = i;
+    let j = i;
+    for (; j < lines.length; j++) {
+      const line = lines[j];
+      if (!line.trim()) continue;
+      if (!/^[A-Za-z_][A-Za-z0-9_]*:\s*/.test(line)) break;
+    }
+    block = lines.slice(start, j);
+    bodyStartLine = j + 1;
+  }
+
+  const fm = {};
+  for (const line of block) {
+    const m = line.match(/^([A-Za-z_][A-Za-z0-9_]*):\s*(.*?)\s*$/);
+    if (!m) continue;                     // list items, comments, folded continuations — not keys
+    if (m[1] in fm) continue;             // first value wins, as everywhere else in PMOS
+    fm[m[1]] = stripQuotes(m[2]);
+  }
+  return { ok: true, fm, fenced, bodyStartLine };
+}
+
+function stripQuotes(v) {
+  const s = String(v == null ? '' : v).trim();
+  if (s.length >= 2 && ((s[0] === '"' && s[s.length - 1] === '"') || (s[0] === "'" && s[s.length - 1] === "'"))) {
+    return s.slice(1, -1);
+  }
+  return s;
+}
+
+/*
+ * ── the guess ─────────────────────────────────────────────────────────────────────────────────
+ *
+ * Only ever consulted when `parent_kr:` is absent or empty. It looks for anchor-SHAPED tokens in the
+ * record's BODY and, if exactly one distinct token appears, offers it as `guessedAnchor`.
+ *
+ * NARROWER THAN THE REAL RESOLVER, ON PURPOSE. `scripts/anchor-resolve.js` accepts a dozen legacy
+ * forms (`O1.KR3`, `**O1**`, `okrs-q3-2026 → O1.KR1`, …) because it must never reject a record a
+ * PMOS repo already wrote. This recogniser accepts only the two unambiguous modern forms — the colon
+ * triple/pair and `health:<id>`. The asymmetry is the point: a permissive resolver reading a
+ * DECLARATION is being generous about something a human wrote on purpose, while a permissive guesser
+ * reading PROSE would start proposing anchors out of sentences like "**O1** is the objective this
+ * quarter" — a bare `O1` in a paragraph is a mention, not an intention. A missing guess costs a PM
+ * one dropdown; a confident wrong guess costs them a mis-filed initiative they may never re-check.
+ *
+ * AMBIGUITY IS REPORTED, NOT BROKEN. Two or more distinct candidates yields NO guess and a `why`
+ * naming them all. Picking the first, or the most frequent, would be this module deciding.
+ *
+ * It reads the body and never another frontmatter key. A key that is not `parent_kr` is not an
+ * anchor field, and mining one would invent a second declaration site that nothing else in PMOS
+ * honours.
+ */
+const RE_ANCHOR_TOKEN = /(?:health:[a-z0-9_-]+|(?:okrs-)?[qQ][1-4]-\d{4}:[a-z0-9][a-z0-9-]*(?::[kK][rR]-?[a-z0-9-]+)?)/g;
+
+function guessAnchorFromBody(text, bodyStartLine) {
+  const lines = String(text == null ? '' : text).split('\n');
+  const found = new Map();                // token → first 1-indexed line it appeared on
+  for (let n = Math.max(1, bodyStartLine || 1); n <= lines.length; n++) {
+    const line = lines[n - 1];
+    RE_ANCHOR_TOKEN.lastIndex = 0;
+    let m;
+    while ((m = RE_ANCHOR_TOKEN.exec(line)) !== null) {
+      const tok = m[0];
+      if (!found.has(tok)) found.set(tok, n);
+    }
+  }
+  return [...found.entries()].map(([token, line]) => ({ token, line }));
+}
+
+/*
+ * The anchor half of one proposed initiative row. Returns { declaredAnchor, guessedAnchor, why }.
+ *
+ * Every branch below sets exactly one of the two fields (or neither). Nothing sets both — a caller
+ * that renders `declaredAnchor || guessedAnchor` gets a wrong-but-plausible board, so the invariant
+ * is asserted in the test suite rather than left to reviewer memory.
+ */
+function anchorFacts(fm, text, bodyStartLine) {
+  const raw = fm && typeof fm.parent_kr === 'string' ? fm.parent_kr.trim() : '';
+  if (raw) {
+    return {
+      declaredAnchor: raw,
+      guessedAnchor: null,
+      why: `declared by the repository in frontmatter as \`parent_kr: ${raw}\` — the repo's own statement, not an inference by this scan. Whether it RESOLVES to a KR or a declared health budget is a separate question this scanner does not answer.`,
+    };
+  }
+  const declaredButEmpty = fm && 'parent_kr' in fm;
+  const lead = declaredButEmpty
+    ? 'the `parent_kr:` key is present but empty'
+    : 'no `parent_kr:` key in frontmatter';
+  const cands = guessAnchorFromBody(text, bodyStartLine);
+  if (cands.length === 1) {
+    return {
+      declaredAnchor: null,
+      guessedAnchor: cands[0].token,
+      why: `${lead}. \`${cands[0].token}\` appears in the body (line ${cands[0].line}) and nothing else anchor-shaped does, so it is offered as a GUESS. A mention in prose is not a declaration: D59 rejects unanchored work, and this record stays unanchored until a human confirms or replaces this value.`,
+    };
+  }
+  if (cands.length > 1) {
+    const listed = cands.map((c) => `\`${c.token}\` (line ${c.line})`).join(', ');
+    return {
+      declaredAnchor: null,
+      guessedAnchor: null,
+      why: `${lead}. The body mentions ${cands.length} different anchor-shaped tokens — ${listed} — which is too many to guess from; choosing one would be this scan deciding. A human picks.`,
+    };
+  }
+  return {
+    declaredAnchor: null,
+    guessedAnchor: null,
+    why: `${lead}, and nothing anchor-shaped appears in the body. This record is unanchored, and D59 rejects unanchored work — only the PM can anchor it.`,
+  };
+}
+
+/*
+ * ── the ADR sweep ─────────────────────────────────────────────────────────────────────────────
+ *
+ * `okf/**\/adr/*.md`: walk the OKF bundle for directories literally named `adr` and take the
+ * markdown directly inside them. Symlinked directories are not entered, for the same provenance
+ * reason single files are not followed, and the walk is depth-capped.
+ *
+ * A directory it could not read is recorded in `unreadable` like any other failed read. A walk that
+ * silently returns fewer directories than exist is the failure mode this whole module is written
+ * against: the PM would see a short ADR list and have no way to know it was short.
+ */
+function walkForAdrDirs(dir, depth, acc, onError) {
+  if (depth > MAX_DEPTH) { onError(dir, `directory nesting past the ${MAX_DEPTH}-level scan cap — not descended`); return; }
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
+  catch (e) { onError(dir, `directory could not be listed (${shortErr(e)})`); return; }
+  for (const ent of entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))) {
+    if (ent.isSymbolicLink()) { onError(path.join(dir, ent.name), 'is a symbolic link — not followed'); continue; }
+    if (!ent.isDirectory()) continue;
+    if (SKIP_DIRS.has(ent.name)) continue;
+    const full = path.join(dir, ent.name);
+    if (ent.name === 'adr') { acc.push(full); continue; }   // an `adr` dir is a leaf for this purpose
+    walkForAdrDirs(full, depth + 1, acc, onError);
+  }
+}
+
+/*
+ * ── the scan ──────────────────────────────────────────────────────────────────────────────────
+ */
+function scanRepo(root) {
+  const out = {
+    ok: true,
+    error: null,
+    root: typeof root === 'string' ? root : null,
+    initiatives: [],
+    adrs: [],
+    log: [],
+    unreadable: [],
+  };
+  const note = (level, p, message) => { out.log.push({ level, path: p, message }); };
+  // Every failed read goes to BOTH lists: `unreadable` is the machine-checkable account, the log is
+  // the human one shown in the ingest panel. A file that appears in only one of them is invisible to
+  // whoever happens to be reading the other.
+  const fail = (p, error) => { out.unreadable.push({ path: p, error }); note('error', p, error); };
+
+  if (typeof root !== 'string' || !root.trim()) {
+    out.ok = false;
+    out.error = 'no repository path was given to the scan';
+    note('error', null, out.error);
+    return out;
+  }
+  let rootStat;
+  try { rootStat = fs.statSync(root); }
+  catch (e) {
+    out.ok = false;
+    out.error = `the repository path could not be read (${shortErr(e)}) — nothing was scanned, and nothing about its contents is claimed`;
+    note('error', root, out.error);
+    return out;
+  }
+  if (!rootStat.isDirectory()) {
+    out.ok = false;
+    out.error = 'the repository path is not a directory — nothing was scanned';
+    note('error', root, out.error);
+    return out;
+  }
+  note('info', null, `scanning ${root} — reading only; nothing is written, imported or decided`);
+
+  // ── initiative records: planning/initiatives/*.md, flat ─────────────────────────────────────
+  // Flat on purpose: `planning/initiatives/` is a flat directory in every PMOS repo and in the kit
+  // scaffold. Recursing would start proposing records out of an `archive/` subfolder someone made
+  // precisely to get them off the board.
+  const initDirRel = 'planning/initiatives';
+  const initDir = path.join(root, 'planning', 'initiatives');
+  let initEntries = null;
+  try { initEntries = fs.readdirSync(initDir, { withFileTypes: true }); }
+  catch (e) {
+    if (e && e.code === 'ENOENT') {
+      // ABSENT, and said out loud. This is a successful read of nothing, not a failure: plenty of
+      // repositories legitimately have no initiative records, and a bare folder importing nothing is
+      // the documented behaviour of the ingest pipeline.
+      note('info', initDirRel, 'does not exist — this repository declares no initiative records, so the proposal has none. Stated, not assumed.');
+    } else {
+      fail(initDirRel, `directory could not be listed (${shortErr(e)}) — initiative records may exist and are NOT accounted for in this proposal`);
+    }
+  }
+
+  if (initEntries) {
+    const files = initEntries
+      .filter((ent) => !ent.isDirectory() && /\.md$/i.test(ent.name))
+      .map((ent) => ent.name)
+      .sort();
+    if (!files.length) {
+      note('info', initDirRel, 'exists but holds no markdown files — an empty read, not a failed one');
+    }
+    for (const name of files) {
+      const rp = `${initDirRel}/${name}`;
+      const full = path.join(initDir, name);
+      // `index.md` / `log.md` are OKF-reserved and carry no frontmatter by design (D63 exempts
+      // them). They are not records; saying so keeps their absence from the proposal explicit.
+      if (name === 'index.md' || name === 'log.md') {
+        note('info', rp, 'is an OKF-reserved filename (index/log) — not an initiative record, not proposed');
+        continue;
+      }
+      const read = readTextFile(full);
+      if (!read.ok) { fail(rp, read.error); continue; }
+      const parsed = parseFrontmatter(read.text);
+      if (!parsed.ok) { fail(rp, parsed.error); continue; }
+      const fm = parsed.fm;
+      if (!fm.type) {
+        fail(rp, 'has no `type:` in its frontmatter — D63 requires one, and a file whose kind is unstated is not assumed to be an initiative record');
+        continue;
+      }
+      if (String(fm.type).toLowerCase() !== 'initiative') {
+        note('info', rp, `declares \`type: ${fm.type}\`, not Initiative — read and not proposed`);
+        continue;
+      }
+      const stem = name.replace(/\.md$/i, '');
+      const id = (fm.id && String(fm.id).trim()) || stem;
+      if (!fm.id || !String(fm.id).trim()) {
+        note('warn', rp, `has no \`id:\` in its frontmatter — using the filename stem \`${stem}\` as the proposed id. A filename is a guess at an identity, and the import should confirm it.`);
+      }
+      const a = anchorFacts(fm, read.text, parsed.bodyStartLine);
+      out.initiatives.push({
+        id,
+        path: rp,
+        declaredAnchor: a.declaredAnchor,
+        guessedAnchor: a.guessedAnchor,
+        why: a.why,
+      });
+    }
+
+    // Duplicate ids: both rows are kept. Dropping one would make the proposal quietly disagree with
+    // the directory, and picking a winner is a decision this module does not get to make.
+    const byId = new Map();
+    for (const r of out.initiatives) {
+      if (!byId.has(r.id)) byId.set(r.id, []);
+      byId.get(r.id).push(r.path);
+    }
+    for (const [id, paths] of byId) {
+      if (paths.length > 1) {
+        note('warn', null, `${paths.length} records propose the same id \`${id}\` (${paths.join(', ')}) — all are listed; the import must resolve the collision, this scan does not pick one`);
+      }
+    }
+    const guessed = out.initiatives.filter((r) => r.guessedAnchor).length;
+    const unanchored = out.initiatives.filter((r) => !r.declaredAnchor).length;
+    note(unanchored ? 'warn' : 'info', null,
+      `${out.initiatives.length} initiative record(s) proposed — ${out.initiatives.length - unanchored} carry a declared anchor, ${guessed} carry a GUESS that must be confirmed, ${unanchored - guessed} have neither. A guess is not a declaration and does not satisfy D59.`);
+  }
+
+  // ── ADRs: okf/**/adr/*.md ───────────────────────────────────────────────────────────────────
+  const okfDir = path.join(root, 'okf');
+  let okfStat = null;
+  try { okfStat = fs.statSync(okfDir); }
+  catch (e) {
+    if (e && e.code === 'ENOENT') note('info', 'okf', 'does not exist — this repository carries no OKF bundle, so no ADRs are proposed. Stated, not assumed.');
+    else fail('okf', `could not be read (${shortErr(e)}) — ADRs may exist and are NOT accounted for in this proposal`);
+  }
+  if (okfStat && !okfStat.isDirectory()) {
+    fail('okf', 'exists but is not a directory — no ADRs were read');
+  } else if (okfStat) {
+    const adrDirs = [];
+    walkForAdrDirs(okfDir, 1, adrDirs, (p, err) => fail(relPath(root, p), err));
+    if (!adrDirs.length) note('info', 'okf', 'contains no `adr/` directory — no ADRs proposed');
+    for (const dir of adrDirs) {
+      const dirRel = relPath(root, dir);
+      let entries;
+      try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
+      catch (e) { fail(dirRel, `directory could not be listed (${shortErr(e)}) — ADRs in it are NOT accounted for`); continue; }
+      const files = entries.filter((ent) => !ent.isDirectory() && /\.md$/i.test(ent.name)).map((e2) => e2.name).sort();
+      if (!files.length) note('info', dirRel, 'holds no markdown files — an empty read, not a failed one');
+      for (const name of files) {
+        const rp = `${dirRel}/${name}`;
+        if (name === 'index.md' || name === 'log.md') {
+          note('info', rp, 'is an OKF-reserved filename (index/log) — not an ADR, not proposed');
+          continue;
+        }
+        const read = readTextFile(path.join(dir, name));
+        if (!read.ok) { fail(rp, read.error); continue; }
+        const parsed = parseFrontmatter(read.text);
+        if (!parsed.ok) { fail(rp, parsed.error); continue; }
+        const fm = parsed.fm;
+        if (!fm.type) {
+          fail(rp, 'has no `type:` in its frontmatter — D63 requires one, and a file in an adr/ directory is not assumed to be an ADR on the strength of its location');
+          continue;
+        }
+        if (String(fm.type).toLowerCase() !== 'adr') {
+          note('info', rp, `declares \`type: ${fm.type}\`, not ADR — read and not proposed`);
+          continue;
+        }
+        const title = fm.title && String(fm.title).trim() ? String(fm.title).trim() : null;
+        if (!title) {
+          // null, not the filename. A board that prints a filename in the title column is asserting
+          // a title the document does not have; null lets the UI say "untitled" honestly.
+          note('warn', rp, 'has no `title:` — proposed with a null title rather than a filename standing in for one');
+        }
+        out.adrs.push({ id: name.replace(/\.md$/i, ''), path: rp, title });
+      }
+    }
+    if (adrDirs.length) {
+      note('info', null, `${out.adrs.length} ADR(s) proposed from ${adrDirs.length} adr/ director${adrDirs.length === 1 ? 'y' : 'ies'} — each still has to be accepted or superseded by a human before it joins knowledge`);
+    }
+  }
+
+  if (out.unreadable.length) {
+    note('warn', null, `${out.unreadable.length} file(s) or director${out.unreadable.length === 1 ? 'y' : 'ies'} could not be read — they are listed with their reasons and are NOT represented in the proposal above`);
+  }
+  // Deterministic ordering — two scans of the same tree must produce the same proposal, or a diff of
+  // one import against the next is noise.
+  out.initiatives.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+  out.adrs.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+  out.unreadable.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+  return out;
+}
+
+// parseFrontmatter / guessAnchorFromBody / anchorFacts are exported for the unit suite: the
+// declared-vs-guessed separation is the invariant this module exists to hold, and an invariant that
+// can only be checked through a full filesystem scan tends to be checked less often than it should.
+module.exports = { scanRepo, parseFrontmatter, guessAnchorFromBody, anchorFacts, MAX_BYTES, MAX_DEPTH };

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.12.0",
+  "version": "0.16.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.12.0",
+      "version": "0.16.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",
@@ -19,6 +19,10 @@
       "bin": {
         "pmos": "bin/pmos.js"
       },
+      "devDependencies": {
+        "pixelmatch": "^7.1.0",
+        "pngjs": "^7.0.0"
+      },
       "engines": {
         "node": ">=18"
       }
@@ -57,6 +61,19 @@
         "node-addon-api": "^7.1.0"
       }
     },
+    "node_modules/pixelmatch": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/pixelmatch/-/pixelmatch-7.2.0.tgz",
+      "integrity": "sha512-xhcb4yHu9sM/G7foGzoLtXYcC0zHEaOXXjRKhGup0fw78Nf2Tkiapv4EQyMzrbcmQPsllAI7DbFY2UT7PlI9Pg==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "pngjs": "^7.0.0"
+      },
+      "bin": {
+        "pixelmatch": "bin/pixelmatch"
+      }
+    },
     "node_modules/playwright-core": {
       "version": "1.61.1",
       "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.61.1.tgz",
@@ -69,6 +86,16 @@
         "node": ">=18"
       }
     },
+    "node_modules/pngjs": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/pngjs/-/pngjs-7.0.0.tgz",
+      "integrity": "sha512-LKWqWJRhstyYo9pGvgor/ivk2w94eSjE3RGVuzLGlr3NmD8bf7RcYGze1mNdEHRP6TRP6rMuDHk5t44hnTRyow==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.19.0"
+      }
+    },
     "node_modules/ws": {
       "version": "8.21.1",
       "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz",

package/workspace/package.json

@@ -1,17 +1,22 @@
 {
   "name": "pmos-workspace",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "private": true,
-  "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
+  "description": "PMOS Terminal Workspace \u2014 local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",
   "bin": {
     "pmos": "bin/pmos.js"
   },
   "scripts": {
     "start": "node server.js",
-    "test": "node test.js",
+    "test": "node test.js && npm run test:modules",
+    "test:modules": "node focus.test.js && node handoff.test.js && node repo-scan.test.js && node profiles.test.js && node no-network.test.js && node fixture-parity.test.mjs",
     "test:ui": "node ui-test.js",
-    "doctor": "node doctor.js"
+    "test:parity": "node design-parity.js --states",
+    "test:all": "npm test && npm run test:panels && npm run test:ui && npm run test:parity && npm run test:offline",
+    "doctor": "node doctor.js",
+    "test:panels": "node pm-shell-test.js && node pm-repos-test.js && node pm-initiatives-test.js && node pm-detail-test.js && node pm-tabs-test.js && node pm-term-test.js && node pm-modes-test.js",
+    "test:offline": "node offline-tarball.test.js"
   },
   "engines": {
     "node": ">=18"
@@ -23,5 +28,10 @@
     "node-pty": "^1.0.0",
     "playwright-core": "^1.61.1",
     "ws": "^8.18.0"
+  },
+  "//devDependencies": "design-parity's pixel axis only. Kept OUT of dependencies deliberately: `create-pmos workspace` installs this package with `npm install -g`, which takes dependencies and not devDependencies, so an adopter installing a local PM tool does not also install a screenshot differ. design-parity.js requires both optionally and degrades to text+style+geometry when they are absent, so the parity check still runs \u2014 it just stops measuring pixels, and says so.",
+  "devDependencies": {
+    "pixelmatch": "^7.1.0",
+    "pngjs": "^7.0.0"
   }
 }