create-principles-disciple 1.144.26 → 1.145.0

package/dist/installer.js

@@ -11,9 +11,9 @@ import { select } from '@inquirer/prompts';
 import { logger } from './utils/logger.js';
 import { checkOpenClawGateway, stopOpenClawGateway, restartOpenClawGateway } from './utils/env.js';
 import { t } from './i18n.js';
-import { generateConfigYamlContent, ExistingConfigVerifyInfraError, validateExistingConfigYamlForPreserve, getConfigYamlPath, readEnabledChannelsFromConfigYaml, getOpenClawDir, getPdDir, getPdRuntimeDir, getInstallManifestPath, getPdRuntimeBackupsDir, getPluginExtDir, getInstalledPluginDir, getInstalledLayoutPackageDir, getPdBackupsDir, getInstalledPdCliDir, getInstalledBinDir, getInstalledConsoleDir, isWindows, } from './mvp-config.js';
+import { generateConfigYamlContent, ExistingConfigVerifyInfraError, validateExistingConfigYamlForPreserve, getConfigYamlPath, readEnabledChannelsFromConfigYaml, getOpenClawDir, getPdDir, getPdRuntimeDir, getInstallManifestPath, getPdRuntimeBackupsDir, getPluginExtDir, getInstalledPluginDir, getInstalledLayoutPackageDir, getPdBackupsDir, getInstalledPdCliDir, getInstalledBinDir, getInstalledConsoleDir, getHomeDir, isWindows, } from './mvp-config.js';
 import { getHostInstallers } from './installers/index.js';
-import { mergeInstallManifestWorkspaces, parseInstallManifest } from '@principles/install-layout';
+import { INSTALL_LAYOUT_VERSION, getWorkbuddyWorkspaceDir, mergeInstallManifestWorkspaces, parseInstallManifest } from '@principles/install-layout';
 import { detectOpenClawMainWorkspaceDivergence } from './utils/workspace-divergence.js';
 import { applySkillLanguageSelection } from './skill-language.js';
 import { parseReleaseAssetIdentity, parseReleaseAssetManifest, ReleaseAssetManifestError, verifyReleaseAssetManifestAsync, verifyReleaseAssetTarget, } from './update/release-asset-manifest.js';
@@ -142,6 +142,10 @@ export function mergeInstallManifestHosts(current, host) {
         hosts.add('codex');
     if (host === 'all' || host === 'openclaw')
         hosts.add('openclaw');
+    // WorkBuddy is its own explicit target — 'all' must not attach a third host
+    // the operator never asked for (SPEC workbuddy-host-adapter §6, OD-03).
+    if (host === 'workbuddy')
+        hosts.add('workbuddy');
     return [...hosts];
 }
 function resolveInstallManifestHosts(host) {
@@ -159,8 +163,13 @@ function resolveInstallManifestHosts(host) {
  * PRI-624 Slice C: the install manifest records every Workspace this install
  * serves so the Companion can discover its per-Workspace workers (SPEC §13
  * "canonical install manifest"). Idempotent by canonical path.
+ *
+ * WorkBuddy (SPEC workbuddy-host-adapter §6): when the run targets workbuddy,
+ * the OD-07 governance workspace (~/.workbuddy/pd-workspace) is registered the
+ * same way — derived from install-layout, never hand-joined, never reused from
+ * another host's state.
  */
-function resolveInstallManifestWorkspaces(workspaceDir) {
+function resolveInstallManifestWorkspaces(workspaceDir, host) {
     let current;
     try {
         current = JSON.parse(readFileSync(getInstallManifestPath(), 'utf8'));
@@ -173,7 +182,13 @@ function resolveInstallManifestWorkspaces(workspaceDir) {
     if (current !== undefined && !parsed.manifest) {
         throw new Error(parsed.error ?? 'install_manifest_malformed');
     }
-    return mergeInstallManifestWorkspaces(parsed.manifest, path.resolve(workspaceDir));
+    let workspaces = mergeInstallManifestWorkspaces(parsed.manifest, path.resolve(workspaceDir));
+    if (host === 'workbuddy') {
+        // Set-union via the same authority helper — order of existing entries is
+        // preserved, the governance dir is appended when absent (idempotent).
+        workspaces = mergeInstallManifestWorkspaces({ layoutVersion: parsed.manifest?.layoutVersion ?? INSTALL_LAYOUT_VERSION, mode: parsed.manifest?.mode ?? 'canonical', hosts: parsed.manifest?.hosts ?? [], workspaces }, getWorkbuddyWorkspaceDir(getHomeDir()));
+    }
+    return workspaces;
 }
 function writeInstallManifest(hosts, workspaces) {
     mkdirSync(getPdDir(), { recursive: true });
@@ -1844,6 +1859,20 @@ function verifyPdCliShim() {
         }
         localError = detail;
         logger.warn(`PD CLI local verification failed: ${detail}`);
+        // First-install sequencing (WorkBuddy remediation): on a fresh home the
+        // ~/.pd active record is written only at commit (AFTER this verify), and
+        // host targets that deploy no OpenClaw legacy overlay (--host workbuddy)
+        // have no fallback branch in the version report — so the version probe
+        // legitimately reports active_record_missing here. That exact shape
+        // proves the deployed CLI EXECUTES (entry reachable, imports resolved);
+        // activation arrives at commit. Strict behavior is preserved whenever an
+        // active record already exists (upgrades).
+        const activeRecordPath = path.join(getPdDir(), 'active.json');
+        if (!localOk && detail.includes('no active release record') && !existsSync(activeRecordPath)) {
+            localOk = true;
+            localError = undefined;
+            logger.info('PD CLI executed without an activation record (first install); the record is written at commit.');
+        }
     }
     const globalOk = (() => {
         try {
@@ -1976,6 +2005,9 @@ function getInstalledHostRuntimeDir() {
 function getInstalledCodexAdapterDir() {
     return path.join(getPdRuntimeDir(), 'codex-adapter');
 }
+function getInstalledWorkbuddyAdapterDir() {
+    return path.join(getPdRuntimeDir(), 'workbuddy-adapter');
+}
 function installBundledCore(pluginDir) {
     const coreSrc = path.join(pluginDir, 'core');
     const coreDest = getInstalledCoreDir();
@@ -2024,40 +2056,30 @@ function installBundledCodexAdapter(pluginDir) {
     cpSync(codexAdapterSrc, codexAdapterDest, { recursive: true });
 }
 /**
- * PRI-711: materialize node_modules links for the INSTALLED codex-adapter so
- * its declared `file:../<component>` dependencies resolve under ESM realpath
- * rules. The adapter's dist imports @principles/host-runtime and
- * @principles/core, and pd-cli's eager import graph (health-codex) statically
- * imports the adapter — without these links every pd command dies with
- * ERR_MODULE_NOT_FOUND at startup (observed 2026-09-09: the 1.231.2 full
- * update swapped in Slice-D pd-cli while the deployed adapter, laid down by
- * older installers, had no node_modules at all).
- *
- * Data-driven from the deployed adapter manifest: every dependency whose ref
- * starts with `file:../` names a sibling runtime component directory. An
- * existing correct link is kept; a stale physical copy (self-contained
- * payloads ship materialized node_modules) or a wrong-target link is
- * replaced with the canonical junction/symlink, mirroring syncPdCli.
- * Idempotent. MUST run after installBundledCodexAdapter AND the
- * core/host-runtime/install-layout installs — the manifest declares all
- * three as file:../ siblings, and a missing sibling means a corrupted
+ * PRI-711 (generalized for ADR-0020 host adapters): materialize node_modules
+ * links for an INSTALLED runtime component so its declared `file:../<component>`
+ * dependencies resolve under ESM realpath rules. Data-driven from the deployed
+ * manifest: every dependency whose ref starts with `file:../` names a sibling
+ * runtime component directory. An existing correct link is kept; a stale
+ * physical copy or a wrong-target link is replaced with the canonical
+ * junction/symlink. Idempotent. MUST run after the component AND all its
+ * file:../ siblings are installed — a missing sibling means a corrupted
  * payload or a call-order regression, which fails the install loudly.
  */
-export function ensureCodexAdapterResolution() {
-    const codexAdapterDir = getInstalledCodexAdapterDir();
-    const manifestPath = path.join(codexAdapterDir, 'package.json');
+function ensureComponentFileDependencyLinks(componentDir, componentLabel) {
+    const manifestPath = path.join(componentDir, 'package.json');
     let manifest;
     try {
         manifest = JSON.parse(readFileSync(manifestPath, 'utf-8'));
     }
     catch (error) {
-        throw new Error(`Installed @principles/codex-adapter package.json is missing or malformed (${manifestPath}): ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+        throw new Error(`Installed ${componentLabel} package.json is missing or malformed (${manifestPath}): ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
     if (!isRecord(manifest)) {
-        throw new Error(`Installed @principles/codex-adapter package.json must contain an object (${manifestPath}).`);
+        throw new Error(`Installed ${componentLabel} package.json must contain an object (${manifestPath}).`);
     }
     if (manifest.dependencies !== undefined && !isRecord(manifest.dependencies)) {
-        throw new Error(`Installed @principles/codex-adapter package.json dependencies must be an object (${manifestPath}).`);
+        throw new Error(`Installed ${componentLabel} package.json dependencies must be an object (${manifestPath}).`);
     }
     const runtimeDir = getPdRuntimeDir();
     for (const [name, ref] of Object.entries(manifest.dependencies ?? {})) {
@@ -2067,13 +2089,13 @@ export function ensureCodexAdapterResolution() {
         // rc-1: the manifest is untrusted input — only accept single-path segment
         // siblings so a crafted ref cannot escape the runtime dir.
         if (!/^[A-Za-z0-9._-]+$/.test(siblingName) || siblingName === '.' || siblingName === '..') {
-            throw new Error(`Installed @principles/codex-adapter declares an unsupported file dependency ref "${ref}" for ${name}.`);
+            throw new Error(`Installed ${componentLabel} declares an unsupported file dependency ref "${ref}" for ${name}.`);
         }
         const siblingDir = path.join(runtimeDir, siblingName);
         if (!existsSync(siblingDir)) {
-            throw new Error(`@principles/codex-adapter depends on ${ref} but the sibling runtime component is missing: ${siblingDir}`);
+            throw new Error(`${componentLabel} depends on ${ref} but the sibling runtime component is missing: ${siblingDir}`);
         }
-        const linkPath = path.join(codexAdapterDir, 'node_modules', name);
+        const linkPath = path.join(componentDir, 'node_modules', name);
         let stat;
         try {
             stat = lstatSync(linkPath);
@@ -2102,6 +2124,61 @@ export function ensureCodexAdapterResolution() {
         }
     }
 }
+/**
+ * PRI-711: materialize node_modules links for the INSTALLED codex-adapter so
+ * its declared `file:../<component>` dependencies resolve under ESM realpath
+ * rules. The adapter's dist imports @principles/host-runtime and
+ * @principles/core, and pd-cli's eager import graph (health-codex) statically
+ * imports the adapter — without these links every pd command dies with
+ * ERR_MODULE_NOT_FOUND at startup (observed 2026-09-09: the 1.231.2 full
+ * update swapped in Slice-D pd-cli while the deployed adapter, laid down by
+ * older installers, had no node_modules at all).
+ */
+export function ensureCodexAdapterResolution() {
+    ensureComponentFileDependencyLinks(getInstalledCodexAdapterDir(), '@principles/codex-adapter');
+}
+/**
+ * SPEC workbuddy-host-adapter §4.1/§5: the bundled @principles/workbuddy-adapter
+ * payload installs as a runtime sibling exactly like codex-adapter, and its
+ * `file:../<component>` dependency links are materialized the same way so the
+ * plugin wrapper resolves core/host-runtime/install-layout under ESM realpath
+ * rules.
+ *
+ * Unlike codex-adapter, the payload's ABSENCE is an observable skip, not a
+ * failure: installer builds published before the adapter component landed (or
+ * cut from a tree where it is not yet bundled) still deploy OpenClaw/Codex
+ * untouched; the WorkBuddy host installer then reports
+ * workbuddy_adapter_payload_missing for --host workbuddy (rc-9).
+ */
+export function installBundledWorkbuddyAdapter(pluginDir) {
+    const workbuddyAdapterSrc = path.join(pluginDir, 'workbuddy-adapter');
+    const workbuddyAdapterDest = getInstalledWorkbuddyAdapterDir();
+    if (!existsSync(workbuddyAdapterSrc)) {
+        logger.warn(`Bundled @principles/workbuddy-adapter not found in this installer package (${workbuddyAdapterSrc}) — the WorkBuddy host stays unavailable in this deployment. OpenClaw/Codex installation is unaffected.`);
+        return false;
+    }
+    const workbuddyAdapterPkgJson = path.join(workbuddyAdapterSrc, 'package.json');
+    const workbuddyAdapterDist = path.join(workbuddyAdapterSrc, 'dist');
+    if (!existsSync(workbuddyAdapterPkgJson) || !existsSync(workbuddyAdapterDist)) {
+        throw new Error('Bundled @principles/workbuddy-adapter is incomplete (missing package.json or dist). Package may be corrupted.');
+    }
+    rmSync(workbuddyAdapterDest, { recursive: true, force: true });
+    cpSync(workbuddyAdapterSrc, workbuddyAdapterDest, { recursive: true });
+    return true;
+}
+/**
+ * Materialize the resolution links for the INSTALLED workbuddy-adapter.
+ * Mirrors ensureCodexAdapterResolution; tolerates the component's absence
+ * (observable skip — see installBundledWorkbuddyAdapter).
+ */
+export function ensureWorkbuddyAdapterResolution() {
+    const workbuddyAdapterDir = getInstalledWorkbuddyAdapterDir();
+    if (!existsSync(workbuddyAdapterDir)) {
+        return { installed: false, skipReason: 'workbuddy_adapter_not_installed' };
+    }
+    ensureComponentFileDependencyLinks(workbuddyAdapterDir, '@principles/workbuddy-adapter');
+    return { installed: true };
+}
 const CORE_JUNCTION_PACKAGE = '@principles/core';
 /** Reads a package.json `name` as untrusted input (rc-1); null when absent/malformed. */
 function readPackageJsonName(manifestPath) {
@@ -2547,6 +2624,16 @@ function probeAutolaunchHealth(port, timeoutMs = 1500) {
  * EP-04: detached + unref keeps the console running after the installer exits.
  * EP-06: reuses pd-cli's handleConsoleOpen via the CLI entry — no new launcher.
  */
+/**
+ * WorkBuddy remediation (review 2026-10-13 §4 P1): the auto-launched Console,
+ * canary and manual-open instructions must manage the directory the host's
+ * hook/worker actually read. For the WorkBuddy host that is the dedicated
+ * governance workspace (SPEC §4.1) — NOT the project directory, which is only
+ * the task project path. Other hosts keep the project workspace.
+ */
+export function resolveConsoleWorkspaceDir(host, projectWorkspaceDir, homeDir) {
+    return host === 'workbuddy' ? getWorkbuddyWorkspaceDir(homeDir) : projectWorkspaceDir;
+}
 async function autoLaunchConsole(workspaceDir) {
     // Test/smoke seam (mirrors PD_SKIP_GLOBAL_SHIM): isolated installs (release
     // smoke, upgrade gate) must not spawn a detached console that holds the
@@ -3228,6 +3315,14 @@ transaction) {
         // siblings exist — the manifest declares file:../core, file:../host-runtime
         // AND file:../install-layout, and install-layout lands just above.
         ensureCodexAdapterResolution();
+        // WorkBuddy third host (SPEC workbuddy-host-adapter §5 build/delivery
+        // face): the adapter payload refreshes on every runtime deployment like
+        // its codex sibling — updates rewrite the dir and its resolution links,
+        // while WorkBuddy plugin registration and governance data are owned by
+        // the host installer and preserved. Absence of the payload in older
+        // installer builds is an observable skip, not a failure.
+        installBundledWorkbuddyAdapter(pluginDir);
+        ensureWorkbuddyAdapterResolution();
         if (spinner)
             updateProgress(spinner, stepIndex, 'Installing release-manager authority module...');
         installBundledReleaseManagerPackage(pluginDir);
@@ -3331,7 +3426,12 @@ transaction) {
         stepIndex++;
         if (spinner)
             updateProgress(spinner, stepIndex, 'Generating config.yaml...');
-        const configYamlPath = await generateConfigYamlConfig(options.workspaceDir, options.runtimeProfile);
+        // Round-3 remediation P1: for the WorkBuddy host the LLM runtime profile
+        // is GOVERNANCE state — WorkBuddyHostInstaller applies it to the
+        // governance workspace config (the file its worker/console/hook chain
+        // reads). Writing it here too would create a second truth. Other hosts
+        // keep the historical project-dir profile (Fix-4 behavior, unchanged).
+        const configYamlPath = await generateConfigYamlConfig(options.workspaceDir, options.host === 'workbuddy' ? undefined : options.runtimeProfile);
         verification.features = 'passed';
         stepIndex++;
         if (spinner)
@@ -3411,6 +3511,7 @@ transaction) {
                     provider: options.runtimeProfile.provider,
                     model: options.runtimeProfile.model,
                     apiKeyEnv: options.runtimeProfile.apiKeyEnv,
+                    baseUrl: options.runtimeProfile.baseUrl,
                 }
                 : undefined,
         });
@@ -3433,7 +3534,7 @@ transaction) {
         if (hostFailures.length > 0) {
             throw new Error(`Host installation failed: ${hostFailures.join(' | ')}`);
         }
-        writeInstallManifest(installManifestHosts, resolveInstallManifestWorkspaces(options.workspaceDir));
+        writeInstallManifest(installManifestHosts, resolveInstallManifestWorkspaces(options.workspaceDir, options.host));
         // PRI-709 P0-1: persist the metadata source after the manifest write, so
         // the durable tier cannot be clobbered by the same install.
         persistReleaseMetadataSource();
@@ -3504,7 +3605,10 @@ transaction) {
         // Task 8: auto-launch console via `pd console open` (reuses PRI-300
         // handleConsoleOpen — no new launcher subsystem). Opens the browser to
         // /welcome for onboarding. Detached so the console survives installer exit.
-        const launchResult = await autoLaunchConsole(options.workspaceDir);
+        // WorkBuddy remediation: the console manages the GOVERNANCE workspace for
+        // this host — the directory hook/worker read — never the project dir.
+        const consoleWorkspaceDir = resolveConsoleWorkspaceDir(activeHostTarget, options.workspaceDir, getHomeDir());
+        const launchResult = await autoLaunchConsole(consoleWorkspaceDir);
         // PRI-645: report the ACTUAL effective channels (registry default +
         // sparse override). Never mask an explicit Owner disable with the
         // requested channels — that would re-create ERR-042 (reporting the
@@ -3517,10 +3621,10 @@ transaction) {
         // success=false and be guided to fix the failed host.
         const nextActions = [];
         if (components.cli === 'verified') {
-            nextActions.push(`pd runtime canary --workspace "${options.workspaceDir}" --json`);
+            nextActions.push(`pd runtime canary --workspace "${consoleWorkspaceDir}" --json`);
         }
         else if (components.cli === 'verified_local_only' && components.cliLocalPath) {
-            nextActions.push(`"${components.cliLocalPath}" runtime canary --workspace "${options.workspaceDir}" --json`);
+            nextActions.push(`"${components.cliLocalPath}" runtime canary --workspace "${consoleWorkspaceDir}" --json`);
         }
         if (components.console === 'configured') {
             if (launchResult.consoleUrl) {
@@ -3529,7 +3633,7 @@ transaction) {
             }
             else {
                 // EP-03: auto-launch did not succeed — keep manual start instruction.
-                nextActions.push(`pd console --workspace "${options.workspaceDir}" --no-auth (listens on 127.0.0.1 only)`);
+                nextActions.push(`pd console --workspace "${consoleWorkspaceDir}" --no-auth (listens on 127.0.0.1 only)`);
             }
         }
         if (launchResult.fallbackAction) {