create-principles-disciple 1.145.39 → 1.145.42

package/dist/installers/workbuddy-host-installer.d.ts

@@ -151,6 +151,45 @@ export type FlagOverrideResult = {
     reason: string;
     nextAction: string;
 };
+/**
+ * Enable/disable `features.host.workbuddy.enabled` in the GOVERNANCE
+ * workspace's .pd/config.yaml with a line-targeted edit (comments and unknown
+ * keys preserved), creating a loader-valid config from the installer template
+ * when absent. Atomic write; round-trip verified.
+ */
+/**
+ * PRI-1064 (Owner directive 2026-10-31): governance is ON by default at
+ * install time. The only state preserved as OFF is an EXPLICIT opt-out
+ * (`enabled: false` the Owner wrote). A pre-existing config with sparse
+ * flags (e.g. left by a failed install round) no longer silently keeps
+ * governance off — the user saw "Install complete!" while every hook
+ * skipped with host.workbuddy_disabled.
+ * Both entries are validated and atomically committed in one file write;
+ * an already-correct config is left byte-identical (no rewrite).
+ */
+export declare function ensureWorkbuddyGovernanceEnabled(governanceDir: string): FlagOverrideResult & {
+    hostExplicitOff: boolean;
+    keywordExplicitOff: boolean;
+    changed: boolean;
+};
+/**
+ * PRI-1064 review: the install summary must state BOTH gates.
+ *
+ * The first version derived the whole sentence from `hostExplicitOff` alone,
+ * so a config with `workbuddy_live_keyword_pain.enabled: false` was reported as
+ * "governance and four-term keyword Pain detection are ON" — a false summary
+ * of exactly the kind this change set out to remove. Each gate is now stated
+ * on its own, and an OFF state always names the flag the Owner wrote.
+ *
+ * Inherited verbatim by the PRI-1063 copy work, which keeps the flag ids
+ * dotted (they ARE the flat keys) but replaces the prose with paste-ready
+ * snippets.
+ */
+export declare function describeGovernanceDefaults(state: {
+    hostExplicitOff: boolean;
+    keywordExplicitOff: boolean;
+    changed: boolean;
+} | null, governanceDir: string): string;
 export declare function setWorkbuddyGovernanceFlag(governanceDir: string, enabled: boolean): FlagOverrideResult;
 /** Read the explicit host.workbuddy override state (null = no explicit override → registry default OFF). */
 export declare function readWorkbuddyGovernanceFlagOverride(governanceDir: string): boolean | null;
@@ -174,6 +213,42 @@ export interface WorkbuddyDetectDetails extends HostDetectResult {
     /** settings.json exists AND parsed (false also when unparsable — install fails loud there). */
     settingsExisted: boolean;
 }
+export interface WorkbuddyEarlyPreflightDeps {
+    homeDir?: () => string;
+    /** Bash availability probe override (default: literal `bash -c "exit 0"`). */
+    probeBash?: () => {
+        ok: true;
+    } | {
+        ok: false;
+        detail: string;
+    };
+    /** Exclusive-open probe; returns the errno string when the file is held. */
+    probeHostFileLock?: (filePath: string) => string | undefined;
+    platform?: (typeof process)['platform'];
+}
+export type WorkbuddyEarlyPreflight = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+    nextAction: string;
+};
+/**
+ * PRI-1062: hard preflights the main installer runs BEFORE any side effect.
+ *
+ * Call-site contract (enforced in installer.ts): this must run before the
+ * gateway pre-flight, because that block may STOP a running OpenClaw gateway.
+ * A refusal from here returns immediately and would otherwise leave the
+ * Owner's gateway down, since the restart is only honoured at the end of the
+ * install flow.
+ *
+ * A RUNNING WorkBuddy holds settings.json with exclusive sharing — the
+ * commit-stage atomic rename fails with EPERM after minutes of npm work and
+ * the whole install rolls back. Git Bash availability is equally knowable
+ * up front. Both checks are cheap (one bash spawn + two file opens) and
+ * fail with a nextAction naming the exact user action.
+ */
+export declare function runWorkbuddyEarlyPreflight(deps?: WorkbuddyEarlyPreflightDeps): WorkbuddyEarlyPreflight;
 export declare class WorkBuddyHostInstaller implements HostInstaller {
     readonly hostId = "workbuddy";
     private readonly deps;

package/dist/installers/workbuddy-host-installer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workbuddy-host-installer.d.ts","sourceRoot":"","sources":["../../src/installers/workbuddy-host-installer.ts"],"names":[],"mappings":"AA2DA,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,uBAAuB,CAAC;AAM/B,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAC3D,qFAAqF;AACrF,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AACvE,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,mDAA2D,CAAC;AAiB7F,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,UAA6E,CAAC;AA4DpH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,0BAA0B;IACzC,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACtC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACtC,gFAAgF;IAChF,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,uBAAuB,KAAK,sBAAsB,CAAC;CAChH;AAED,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,eAAe,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,aAAa,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0BAA0B;IAC1B,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAyBrE;AAoBD;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GACpC,MAAM,EAAE,CAkBV;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,SAAS,CAU/D;AAID,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,KAAK,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAgC/D;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA2C9I;AAID;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG;IAAE,OAAO,CAAC,EAAE,sBAAsB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA4C9I;AAcD;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAmDlE;AA4CD,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AA6CxI,wBAAgB,0BAA0B,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,kBAAkB,CAqHtG;AAED,4GAA4G;AAC5G,wBAAgB,mCAAmC,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAYzF;AAmRD,MAAM,WAAW,sBAAuB,SAAQ,gBAAgB;IAC9D,qDAAqD;IACrD,SAAS,EAAE,OAAO,CAAC;IACnB,iCAAiC;IACjC,WAAW,EAAE,OAAO,CAAC;IACrB,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,UAAU,EAAE,OAAO,CAAC;IACpB,kDAAkD;IAClD,aAAa,EAAE,OAAO,CAAC;IACvB,sFAAsF;IACtF,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,qEAAqE;IACrE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,4DAA4D;IAC5D,qBAAqB,EAAE,OAAO,CAAC;IAC/B,+FAA+F;IAC/F,eAAe,EAAE,OAAO,CAAC;CAC1B;AAmBD,qBAAa,sBAAuB,YAAW,aAAa;IAC1D,QAAQ,CAAC,MAAM,eAAe;IAE9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuC;IAE5D,YAAY,IAAI,GAAE,0BAA+B,EA0BhD;IAED,OAAO,CAAC,KAAK;IAIb;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,SAAS;IAejB,oGAAoG;IACpG,OAAO,CAAC,gBAAgB;IAwBlB,OAAO,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAqKjE;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,6BAA6B;IAwDrC,OAAO,CAAC,cAAc;IA6EtB,OAAO,CAAC,yBAAyB;IAoBjC;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAa9B;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAoK/B,4FAA4F;IAC5F,wBAAwB,IAAI;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAQ9G;IAED,mEAAmE;IACnE,gBAAgB,IAAI,kBAAkB,CAGrC;IAED,oEAAoE;IACpE,iBAAiB,IAAI,kBAAkB,CAGtC;IAIK,SAAS,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+KxE;IAED;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IA8C1B,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB;IAmB3B,MAAM,IAAI,gBAAgB,CAEzB;IAED,iHAAiH;IACjH,aAAa,IAAI,sBAAsB,CAyCtC;CACF"}
+{"version":3,"file":"workbuddy-host-installer.d.ts","sourceRoot":"","sources":["../../src/installers/workbuddy-host-installer.ts"],"names":[],"mappings":"AA2DA,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,uBAAuB,CAAC;AAM/B,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAC3D,qFAAqF;AACrF,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AACvE,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,mDAA2D,CAAC;AAiB7F,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,UAA6E,CAAC;AA4DpH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,0BAA0B;IACzC,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACtC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACtC,gFAAgF;IAChF,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,uBAAuB,KAAK,sBAAsB,CAAC;CAChH;AAED,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,eAAe,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,aAAa,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0BAA0B;IAC1B,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAyBrE;AAoBD;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GACpC,MAAM,EAAE,CAkBV;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,SAAS,CAU/D;AAID,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,KAAK,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAgC/D;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA2C9I;AAID;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG;IAAE,OAAO,CAAC,EAAE,sBAAsB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA4C9I;AAcD;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAmDlE;AA4CD,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAExI;;;;;GAKG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAAC,aAAa,EAAE,MAAM,GAAG,kBAAkB,GAAG;IAC5F,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;CAClB,CAmCA;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE;IAAE,eAAe,EAAE,OAAO,CAAC;IAAC,kBAAkB,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,EACzF,aAAa,EAAE,MAAM,GACpB,MAAM,CAYR;AAED,wBAAgB,0BAA0B,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,kBAAkB,CAqHtG;AAED,4GAA4G;AAC5G,wBAAgB,mCAAmC,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAYzF;AAmRD,MAAM,WAAW,sBAAuB,SAAQ,gBAAgB;IAC9D,qDAAqD;IACrD,SAAS,EAAE,OAAO,CAAC;IACnB,iCAAiC;IACjC,WAAW,EAAE,OAAO,CAAC;IACrB,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,UAAU,EAAE,OAAO,CAAC;IACpB,kDAAkD;IAClD,aAAa,EAAE,OAAO,CAAC;IACvB,sFAAsF;IACtF,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,qEAAqE;IACrE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,4DAA4D;IAC5D,qBAAqB,EAAE,OAAO,CAAC;IAC/B,+FAA+F;IAC/F,eAAe,EAAE,OAAO,CAAC;CAC1B;AAYD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC;CACzC;AAED,MAAM,MAAM,uBAAuB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AA+CvG;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,GAAE,2BAAgC,GAAG,uBAAuB,CAwB1G;AAiBD,qBAAa,sBAAuB,YAAW,aAAa;IAC1D,QAAQ,CAAC,MAAM,eAAe;IAE9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuC;IAE5D,YAAY,IAAI,GAAE,0BAA+B,EA0BhD;IAED,OAAO,CAAC,KAAK;IAIb;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,SAAS;IAejB,oGAAoG;IACpG,OAAO,CAAC,gBAAgB;IAoBlB,OAAO,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiLjE;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,6BAA6B;IAwDrC,OAAO,CAAC,cAAc;IA6EtB,OAAO,CAAC,yBAAyB;IAoBjC;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAa9B;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAoK/B,4FAA4F;IAC5F,wBAAwB,IAAI;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAQ9G;IAED,mEAAmE;IACnE,gBAAgB,IAAI,kBAAkB,CAGrC;IAED,oEAAoE;IACpE,iBAAiB,IAAI,kBAAkB,CAGtC;IAIK,SAAS,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+KxE;IAED;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IA8C1B,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB;IAmB3B,MAAM,IAAI,gBAAgB,CAEzB;IAED,iHAAiH;IACjH,aAAa,IAAI,sBAAsB,CAyCtC;CACF"}

package/dist/installers/workbuddy-host-installer.js

@@ -41,8 +41,8 @@
  * - rc-9-no-silent-fallback: engine-unreachable fallback is reported in the
  *   result reason; every result carries reason + nextAction.
  */
-import { spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, cpSync, writeFileSync } from 'node:fs';
+import { spawnSync, execFileSync } from 'node:child_process';
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, cpSync, writeFileSync, openSync, closeSync } from 'node:fs';
 import * as path from 'node:path';
 import * as yaml from 'js-yaml';
 import semver from 'semver';
@@ -487,44 +487,81 @@ function isEmptyFeaturesMapping(line) {
  * when absent. Atomic write; round-trip verified.
  */
 /**
- * On genuinely new WorkBuddy installations only, persist both gates in the
- * newly created governance workspace. Never change registry defaults: old
- * workspaces with sparse flags must NOT silently enable on upgrade.
- * Both entries are validated and atomically committed in one file write.
+ * PRI-1064 (Owner directive 2026-10-31): governance is ON by default at
+ * install time. The only state preserved as OFF is an EXPLICIT opt-out
+ * (`enabled: false` the Owner wrote). A pre-existing config with sparse
+ * flags (e.g. left by a failed install round) no longer silently keeps
+ * governance off — the user saw "Install complete!" while every hook
+ * skipped with host.workbuddy_disabled.
+ * Both entries are validated and atomically committed in one file write;
+ * an already-correct config is left byte-identical (no rewrite).
  */
-function enableFreshWorkbuddyKeywordPain(governanceDir) {
+export function ensureWorkbuddyGovernanceEnabled(governanceDir) {
     const configPath = path.join(governanceDir, '.pd', 'config.yaml');
     let raw;
     try {
         raw = yaml.load(readFileSync(configPath, 'utf-8'));
     }
     catch {
-        return { ok: false, reason: 'fresh_workbuddy_config_unreadable', nextAction: 'Repair governance config and retry.' };
+        return { ok: false, reason: 'fresh_workbuddy_config_unreadable', nextAction: 'Repair governance config and retry.', hostExplicitOff: false, keywordExplicitOff: false, changed: false };
     }
     if (!isRecord(raw) || !isRecord(raw.features)) {
-        return { ok: false, reason: 'fresh_workbuddy_features_invalid', nextAction: 'Governance config needs a features mapping.' };
+        return { ok: false, reason: 'fresh_workbuddy_features_invalid', nextAction: 'Governance config needs a features mapping.', hostExplicitOff: false, keywordExplicitOff: false, changed: false };
     }
     const oldHost = raw.features['host.workbuddy'];
     const oldKeyword = raw.features.workbuddy_live_keyword_pain;
+    const hostExplicitOff = isRecord(oldHost) && oldHost.enabled === false;
+    const keywordExplicitOff = isRecord(oldKeyword) && oldKeyword.enabled === false;
     const features = {
         ...raw.features,
-        'host.workbuddy': { ...(isRecord(oldHost) ? oldHost : {}), enabled: true, category: WORKBUDDY_FLAG_CATEGORY },
-        workbuddy_live_keyword_pain: { ...(isRecord(oldKeyword) ? oldKeyword : {}), enabled: true, category: WORKBUDDY_FLAG_CATEGORY },
+        'host.workbuddy': { ...(isRecord(oldHost) ? oldHost : {}), enabled: !hostExplicitOff, category: WORKBUDDY_FLAG_CATEGORY },
+        workbuddy_live_keyword_pain: { ...(isRecord(oldKeyword) ? oldKeyword : {}), enabled: !keywordExplicitOff, category: WORKBUDDY_FLAG_CATEGORY },
     };
     const next = yaml.dump({ ...raw, features }, { lineWidth: -1, noRefs: true });
+    const alreadyCorrect = isRecord(oldHost) && oldHost.enabled === !hostExplicitOff && oldHost.category === WORKBUDDY_FLAG_CATEGORY
+        && isRecord(oldKeyword) && oldKeyword.enabled === !keywordExplicitOff && oldKeyword.category === WORKBUDDY_FLAG_CATEGORY;
+    if (alreadyCorrect) {
+        return { ok: true, configPath, enabled: !hostExplicitOff, hostExplicitOff, keywordExplicitOff, changed: false };
+    }
     try {
         const verify = yaml.load(next);
         if (!isRecord(verify) || !isRecord(verify.features) ||
-            !isRecord(verify.features['host.workbuddy']) || verify.features['host.workbuddy'].enabled !== true ||
-            !isRecord(verify.features.workbuddy_live_keyword_pain) || verify.features.workbuddy_live_keyword_pain.enabled !== true) {
-            return { ok: false, reason: 'fresh_workbuddy_flags_verification_failed', nextAction: 'No changes written.' };
+            !isRecord(verify.features['host.workbuddy']) || verify.features['host.workbuddy'].enabled !== !hostExplicitOff ||
+            !isRecord(verify.features.workbuddy_live_keyword_pain) || verify.features.workbuddy_live_keyword_pain.enabled !== !keywordExplicitOff) {
+            return { ok: false, reason: 'fresh_workbuddy_flags_verification_failed', nextAction: 'No changes written.', hostExplicitOff, keywordExplicitOff, changed: false };
         }
         atomicReplaceTextFile(configPath, next);
     }
     catch {
-        return { ok: false, reason: 'fresh_workbuddy_flag_write_failed', nextAction: 'Repair config storage and retry.' };
+        return { ok: false, reason: 'fresh_workbuddy_flag_write_failed', nextAction: 'Repair config storage and retry.', hostExplicitOff, keywordExplicitOff, changed: false };
     }
-    return { ok: true, configPath, enabled: true };
+    return { ok: true, configPath, enabled: !hostExplicitOff, hostExplicitOff, keywordExplicitOff, changed: true };
+}
+/**
+ * PRI-1064 review: the install summary must state BOTH gates.
+ *
+ * The first version derived the whole sentence from `hostExplicitOff` alone,
+ * so a config with `workbuddy_live_keyword_pain.enabled: false` was reported as
+ * "governance and four-term keyword Pain detection are ON" — a false summary
+ * of exactly the kind this change set out to remove. Each gate is now stated
+ * on its own, and an OFF state always names the flag the Owner wrote.
+ *
+ * Inherited verbatim by the PRI-1063 copy work, which keeps the flag ids
+ * dotted (they ARE the flat keys) but replaces the prose with paste-ready
+ * snippets.
+ */
+export function describeGovernanceDefaults(state, governanceDir) {
+    if (state === null) {
+        return ` Governance flag state is UNKNOWN — no governance config exists at ${governanceDir} (run "pd runtime init --workspace ${governanceDir}", then re-run the installer).`;
+    }
+    if (state.hostExplicitOff) {
+        return ' WorkBuddy governance is OFF — your explicit opt-out (features.host.workbuddy.enabled=false) was preserved; four-term keyword Pain detection is ON.';
+    }
+    const hostState = ` WorkBuddy governance is ON${state.changed ? ' (enabled by this install)' : ' (already enabled)'}`;
+    const keywordState = state.keywordExplicitOff
+        ? 'four-term keyword Pain detection is OFF — your explicit opt-out (features.workbuddy_live_keyword_pain.enabled=false) was preserved'
+        : 'four-term keyword Pain detection is ON';
+    return `${hostState}; ${keywordState}.`;
 }
 export function setWorkbuddyGovernanceFlag(governanceDir, enabled) {
     const configDir = path.join(governanceDir, '.pd');
@@ -937,6 +974,105 @@ function applyWorkbuddyGovernanceRuntimeProfile(governanceDir, profile) {
     return { ok: true, configPath, profileId: GOVERNANCE_PROFILE_ID, model, pendingAgents };
 }
 // ─── WorkBuddyHostInstaller ─────────────────────────────────────────────────
+/** Shared Git Bash failure message (win32 hooks launch through bash). */
+function gitBashUnavailableReason(detail) {
+    return {
+        reason: `git_bash_not_available: WorkBuddy executes command hooks through Git Bash on Windows, but "bash" is not resolvable (${detail}). Hooks would fail to launch.`,
+        nextAction: 'Install Git for Windows (or otherwise provide bash.exe on PATH), then re-run the installer.',
+    };
+}
+/** Default bash probe: literal program name + argv array, no shell. */
+function defaultProbeBash() {
+    try {
+        execFileSync('bash', ['-c', 'exit 0'], { encoding: 'utf-8', timeout: 15_000, windowsHide: true });
+        return { ok: true };
+    }
+    catch (error) {
+        const err = error;
+        return { ok: false, detail: typeof err.status === 'number' ? `exit ${err.status}` : (err.message ?? 'unresolvable') };
+    }
+}
+/**
+ * Default lock probe: a read-WRITE open of the host JSON file.
+ *
+ * Why `r+` and not `r`: a plain read open succeeds whenever the holder shared
+ * FILE_SHARE_READ — the common case for a running editor-host — while the
+ * commit-stage `rename` still fails. A write-intent open narrows that gap by
+ * requiring write access on the shared handle.
+ *
+ * Known limit (documented, not guessed): the final `rename` to this path needs
+ * DELETE sharing, which Node exposes no flag for, so a host that grants
+ * read+write but not delete is NOT detectable here. That residual case is
+ * covered by atomicReplaceTextFile's rename retry rather than by this probe.
+ *
+ * EPERM/EBUSY (sharing violation while WorkBuddy runs) and EACCES are lock
+ * signals; anything else (incl. ENOENT) is not a lock verdict.
+ */
+function defaultProbeHostFileLock(filePath) {
+    let fd;
+    try {
+        fd = openSync(filePath, 'r+');
+        closeSync(fd);
+        fd = undefined;
+        return undefined;
+    }
+    catch (error) {
+        const code = error?.code;
+        if (code === 'EPERM' || code === 'EBUSY' || code === 'EACCES')
+            return String(code);
+        return undefined;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* already closed */ }
+        }
+    }
+}
+/**
+ * PRI-1062: hard preflights the main installer runs BEFORE any side effect.
+ *
+ * Call-site contract (enforced in installer.ts): this must run before the
+ * gateway pre-flight, because that block may STOP a running OpenClaw gateway.
+ * A refusal from here returns immediately and would otherwise leave the
+ * Owner's gateway down, since the restart is only honoured at the end of the
+ * install flow.
+ *
+ * A RUNNING WorkBuddy holds settings.json with exclusive sharing — the
+ * commit-stage atomic rename fails with EPERM after minutes of npm work and
+ * the whole install rolls back. Git Bash availability is equally knowable
+ * up front. Both checks are cheap (one bash spawn + two file opens) and
+ * fail with a nextAction naming the exact user action.
+ */
+export function runWorkbuddyEarlyPreflight(deps = {}) {
+    const platform = deps.platform ?? process.platform;
+    if (platform === 'win32') {
+        const bash = (deps.probeBash ?? defaultProbeBash)();
+        if (!bash.ok)
+            return { ok: false, ...gitBashUnavailableReason(bash.detail) };
+    }
+    const paths = resolveWorkbuddyPaths((deps.homeDir ?? getHomeDir)());
+    const probe = deps.probeHostFileLock ?? defaultProbeHostFileLock;
+    const hostFiles = [
+        ['settings.json', paths.settingsPath],
+        ['installed_plugins.json', paths.registryPath],
+    ];
+    for (const [label, filePath] of hostFiles) {
+        if (!existsSync(filePath))
+            continue;
+        const code = probe(filePath);
+        if (code !== undefined) {
+            return {
+                ok: false,
+                reason: `workbuddy_host_file_locked: ${label} is held with an exclusive handle (${code}) — WorkBuddy appears to be running. The registration commit would fail after minutes of work and roll the install back.`,
+                nextAction: 'Fully exit WorkBuddy (tray icon → Quit, then confirm in Task Manager that no WorkBuddy process remains) and re-run the installer. This check ran before any installation work, so nothing needs recovering.',
+            };
+        }
+    }
+    return { ok: true };
+}
 /** Materialize the PD-owned marketplace dir (source never escapes its root). */
 function materializeMarketplace(marketplaceRoot, pluginDir) {
     rmSync(marketplaceRoot, { recursive: true, force: true });
@@ -1024,11 +1160,7 @@ export class WorkBuddyHostInstaller {
         if (process.platform === 'win32') {
             const bashCheck = this.deps.runCommand('bash', ['-c', 'exit 0'], { timeoutMs: 15_000 });
             if (bashCheck.status !== 0) {
-                return {
-                    ok: false,
-                    reason: `git_bash_not_available: WorkBuddy executes command hooks through Git Bash on Windows, but "bash" is not resolvable (${bashCheck.error ?? `exit ${bashCheck.status}`}). Hooks would fail to launch.`,
-                    nextAction: 'Install Git for Windows (or otherwise provide bash.exe on PATH), then re-run the installer.',
-                };
+                return { ok: false, ...gitBashUnavailableReason(bashCheck.error ?? `exit ${bashCheck.status}`) };
             }
         }
         return { ok: true };
@@ -1037,7 +1169,6 @@ export class WorkBuddyHostInstaller {
     async install(ctx) {
         const p = this.paths();
         const details = this.detectDetails();
-        const freshKeywordInstall = !details.registered && !existsSync(path.join(p.governanceDir, '.pd', 'config.yaml'));
         // 1. Preflight: host presence + hook runtime prerequisites.
         if (!details.hostFound && !details.engineFound) {
             return {
@@ -1164,18 +1295,19 @@ export class WorkBuddyHostInstaller {
                 nextAction: manifest.nextAction,
             };
         }
-        // 8. Install ≠ enable (OD-03): the host.workbuddy flag stays at its quiet
-        //    default (OFF). No config.yaml override is written here.
-        // Only a truly NEW WorkBuddy governance workspace gets both gates on.
-        // Existing config and reinstalls retain their previous effective state.
-        const keywordDefaults = freshKeywordInstall ? enableFreshWorkbuddyKeywordPain(p.governanceDir) : null;
-        if (keywordDefaults !== null && !keywordDefaults.ok) {
+        // 8. Install ⇒ governance ON by default (PRI-1064, Owner directive
+        //    2026-10-31): the ONLY preserved-off state is an explicit opt-out the
+        //    Owner wrote (enabled: false). Sparse/legacy configs left OFF by a
+        //    failed install round are turned ON here — an install that ends with
+        //    every hook skipping (host.workbuddy_disabled) is the P1 defect this
+        //    replaces. The summary line below always states the effective state.
+        const governanceConfigExists = existsSync(path.join(p.governanceDir, '.pd', 'config.yaml'));
+        const governanceDefaults = governanceConfigExists ? ensureWorkbuddyGovernanceEnabled(p.governanceDir) : null;
+        if (governanceDefaults !== null && !governanceDefaults.ok) {
             return { success: false, hostId: this.hostId, configPath: p.settingsPath,
-                configAction: registration.settingsAction, reason: keywordDefaults.reason, nextAction: keywordDefaults.nextAction };
+                configAction: registration.settingsAction, reason: governanceDefaults.reason, nextAction: governanceDefaults.nextAction };
         }
-        const keywordDefaultsNote = keywordDefaults !== null
-            ? ' New WorkBuddy governance and four-term keyword Pain detection are ENABLED by default.'
-            : ' Existing governance flags were PRESERVED without implicit opt-in.';
+        const governanceDefaultsNote = describeGovernanceDefaults(governanceDefaults, p.governanceDir);
         const effectiveNote = 'Registration takes effect in NEW WorkBuddy sessions (or /reload-plugins in a running CLI session).';
         // Round-4 S1: honest pending-config surface — legacy init rows and Owner
         // rows are kept (no silent override); the rebind path is stated, never
@@ -1188,8 +1320,20 @@ export class WorkBuddyHostInstaller {
             hostId: this.hostId,
             configPath: p.settingsPath,
             configAction: registration.settingsAction,
-            reason: `Registered ${WORKBUDDY_PLUGIN_KEY} via ${registration.mode}${registration.mode === 'engine' ? '' : ` (engine unreachable: ${registration.engineNote})`}. Governance workspace initialized at ${p.governanceDir}${governance.dbInit === 'skipped' ? ` (${governance.note})` : ''}.${profileNote}${keywordDefaultsNote}`,
-            nextAction: `${effectiveNote}${governance.dbInit === 'skipped' ? ` After the install, run "pd runtime init --workspace ${p.governanceDir}" to create the governance databases.` : ''} To disable keyword Pain, set features.workbuddy_live_keyword_pain.enabled=false; to disable all WorkBuddy governance, set features.host.workbuddy.enabled=false. Existing workspaces retain their prior settings.${pendingRebindNote}`,
+            governance: governanceDefaults === null
+                ? undefined
+                : {
+                    enabled: !governanceDefaults.hostExplicitOff,
+                    explicitOptOut: governanceDefaults.hostExplicitOff,
+                    keywordPainEnabled: !governanceDefaults.keywordExplicitOff,
+                    configPath: governanceDefaults.configPath,
+                },
+            reason: `Registered ${WORKBUDDY_PLUGIN_KEY} via ${registration.mode}${registration.mode === 'engine' ? '' : ` (engine unreachable: ${registration.engineNote})`}. Governance workspace initialized at ${p.governanceDir}${governance.dbInit === 'skipped' ? ` (${governance.note})` : ''}.${profileNote}${governanceDefaultsNote}`,
+            // PRI-1063 copy (single-line flat-key flow mapping) carried over from
+            // main; the "Existing workspaces retain their prior settings" sentence is
+            // deliberately dropped — PRI-1064 turns governance ON for those
+            // workspaces, so keeping it would state the opposite of what happens.
+            nextAction: `${effectiveNote}${governance.dbInit === 'skipped' ? ` After the install, run "pd runtime init --workspace ${p.governanceDir}" to create the governance databases.` : ''} To disable, edit ${path.join(p.governanceDir, '.pd', 'config.yaml')} — each flag id is ONE flat key (not nested). In the existing "features:" block set workbuddy_live_keyword_pain: {enabled: false} to disable keyword Pain only, or host.workbuddy: {enabled: false} to disable all WorkBuddy governance.${pendingRebindNote}`,
         };
     }
     /**