create-principles-disciple 1.91.0 → 1.93.0

package/README.md

@@ -18,7 +18,7 @@ Three MVP-Core channels are always enabled and cannot be disabled:
 - `code_tool_hook` — RuleHost hard enforcement
 - `defer_archive` — graceful deferral
 
-Quiet and gone capabilities (gfi, nocturnal, idle_trigger, model_training, trainer) are **not surfaced** to users.
+Quiet and gone capabilities (gfi, nocturnal, idle_trigger) are **not surfaced** to users.
 
 ## Usage
 

package/console/dist/server/config/AuthConfig.js

@@ -26,6 +26,12 @@ export class AuthConfig {
             return false;
         }
         const [, provided] = match;
+        if (!provided) {
+            return false;
+        }
+        if (!this.token) {
+            return false;
+        }
         const providedBuf = Buffer.from(provided, 'utf8');
         const expectedBuf = Buffer.from(this.token, 'utf8');
         if (providedBuf.length !== expectedBuf.length) {

package/console/dist/server/index.js

@@ -45,7 +45,10 @@ function resolveWorkspaceDir(argv) {
     let explicitWorkspace = undefined;
     for (let i = 0; i < args.length; i++) {
         if (args[i] === '--workspace' && i + 1 < args.length) {
-            explicitWorkspace = path.resolve(args[i + 1]);
+            const next = args[i + 1];
+            if (next !== undefined) {
+                explicitWorkspace = path.resolve(next);
+            }
             break;
         }
     }
@@ -60,12 +63,15 @@ function resolveWorkspaceDir(argv) {
     const workspaces = configStore.getWorkspaces();
     const enabled = workspaces.filter(e => e.config?.enabled !== false);
     if (enabled.length > 0) {
-        const resolved = path.resolve(enabled[0].path);
-        if (fs.existsSync(resolved)) {
-            console.log('[pd-console] No --workspace flag; using registered workspace: ' + resolved);
-            return resolved;
+        const [first] = enabled;
+        if (first) {
+            const resolved = path.resolve(first.path);
+            if (fs.existsSync(resolved)) {
+                console.log('[pd-console] No --workspace flag; using registered workspace: ' + resolved);
+                return resolved;
+            }
+            console.warn('[pd-console] Registered workspace path does not exist: ' + resolved + ', falling back to cwd');
         }
-        console.warn('[pd-console] Registered workspace path does not exist: ' + resolved + ', falling back to cwd');
     }
     return process.cwd();
 }
@@ -78,24 +84,33 @@ function parseArgs(argv) {
     let token = undefined;
     for (let i = 0; i < args.length; i++) {
         if (args[i] === '--port' && i + 1 < args.length) {
-            const parsed = parseInt(args[i + 1], 10);
-            if (Number.isNaN(parsed) || parsed < 1 || parsed > 65535) {
-                console.error('Invalid port: ' + args[i + 1] + '. Must be 1-65535.');
-                process.exit(1);
+            const portStr = args[i + 1];
+            if (portStr !== undefined) {
+                const parsed = parseInt(portStr, 10);
+                if (Number.isNaN(parsed) || parsed < 1 || parsed > 65535) {
+                    console.error('Invalid port: ' + portStr + '. Must be 1-65535.');
+                    process.exit(1);
+                }
+                port = parsed;
+                i++;
             }
-            port = parsed;
-            i++;
         }
         else if (args[i] === '--host' && i + 1 < args.length) {
-            host = args[i + 1];
-            i++;
+            const next = args[i + 1];
+            if (next !== undefined) {
+                host = next;
+                i++;
+            }
         }
         else if (args[i] === '--no-auth') {
             noAuth = true;
         }
         else if (args[i] === '--token' && i + 1 < args.length) {
-            token = args[i + 1];
-            i++;
+            const next = args[i + 1];
+            if (next !== undefined) {
+                token = next;
+                i++;
+            }
         }
     }
     if (noAuth && host !== '127.0.0.1' && host !== 'localhost') {

package/console/dist/server/models/ApprovalsGroupedConsoleModel.js

@@ -1,4 +1,5 @@
-import { SqliteConnection, SqliteApprovalQueueStore, SqlitePIArtifactStore, ApprovalQueue, loadLedger, } from '@principles/core/runtime-v2';
+import { SqliteConnection, SqliteApprovalQueueStore, SqlitePIArtifactStore, ApprovalQueue, } from '@principles/core/runtime-v2';
+import { loadLedger } from '@principles/core/principle-tree-ledger';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 /** Type guard: non-null object (not array). Replaces `as Record<string, unknown>` assertions. */
@@ -41,8 +42,10 @@ function extractCandidateDescription(contentJson) {
     if (typeof obj.implementationCode === 'string') {
         const principleMatch = /\/\/\s*Principle:\s*(.+)/.exec(obj.implementationCode);
         const ruleMatch = /\/\/\s*Rule:\s*(.+)/.exec(obj.implementationCode);
-        const principleText = principleMatch ? principleMatch[1].trim() : null;
-        const ruleText = ruleMatch ? ruleMatch[1].trim() : null;
+        const principleRaw = principleMatch ? principleMatch[1] : undefined;
+        const ruleRaw = ruleMatch ? ruleMatch[1] : undefined;
+        const principleText = principleRaw ? principleRaw.trim() : null;
+        const ruleText = ruleRaw ? ruleRaw.trim() : null;
         if (principleText && ruleText)
             return `${principleText} — ${ruleText}`;
         if (ruleText)

package/console/dist/server/models/ConsoleLifecycleDatasource.js

@@ -1,4 +1,4 @@
-import { loadLedger } from '@principles/core/runtime-v2';
+import { loadLedger } from '@principles/core/principle-tree-ledger';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 export class LineageSourceRetiredError extends Error {

package/console/dist/server/routes/activations.js

@@ -49,6 +49,10 @@ export async function handleActivationsRoute(req, res, workspaceDir, subPath) {
     const disableExec = /^\/([^/]+)\/disable$/.exec(subPath);
     if (req.method === 'POST' && disableExec) {
         const [, rawId] = disableExec;
+        if (!rawId) {
+            sendError(res, 400, 'invalid_id', 'Activation ID is missing');
+            return;
+        }
         let activationId;
         try {
             activationId = decodeURIComponent(rawId);

package/console/dist/server/routes/approvals.js

@@ -77,9 +77,14 @@ export async function handleApprovalsRoute(req, res, workspaceDir, subPath) {
     // GET /api/v1/approvals/:id - detail
     const detailMatch = /^[/]([^/]+)$/.exec(subPath);
     if (req.method === 'GET' && detailMatch) {
+        const [, rawId] = detailMatch;
+        if (!rawId) {
+            sendError(res, 400, 'invalid_id', 'Approval ID is missing');
+            return;
+        }
         let approvalId;
         try {
-            approvalId = decodeURIComponent(detailMatch[1]);
+            approvalId = decodeURIComponent(rawId);
         }
         catch {
             sendError(res, 400, 'invalid_id', 'Approval ID contains invalid URI encoding');
@@ -101,9 +106,14 @@ export async function handleApprovalsRoute(req, res, workspaceDir, subPath) {
     // POST /api/v1/approvals/:id/approve
     const approveMatch = /^[/]([^/]+)[/]approve$/.exec(subPath);
     if (req.method === 'POST' && approveMatch) {
+        const [, rawId] = approveMatch;
+        if (!rawId) {
+            sendError(res, 400, 'invalid_id', 'Approval ID is missing');
+            return;
+        }
         let approvalId;
         try {
-            approvalId = decodeURIComponent(approveMatch[1]);
+            approvalId = decodeURIComponent(rawId);
         }
         catch {
             sendError(res, 400, 'invalid_id', 'Approval ID contains invalid URI encoding');
@@ -151,9 +161,14 @@ export async function handleApprovalsRoute(req, res, workspaceDir, subPath) {
     // POST /api/v1/approvals/:id/reject
     const rejectMatch = /^[/]([^/]+)[/]reject$/.exec(subPath);
     if (req.method === 'POST' && rejectMatch) {
+        const [, rawId] = rejectMatch;
+        if (!rawId) {
+            sendError(res, 400, 'invalid_id', 'Approval ID is missing');
+            return;
+        }
         let approvalId;
         try {
-            approvalId = decodeURIComponent(rejectMatch[1]);
+            approvalId = decodeURIComponent(rawId);
         }
         catch {
             sendError(res, 400, 'invalid_id', 'Approval ID contains invalid URI encoding');
@@ -201,9 +216,14 @@ export async function handleApprovalsRoute(req, res, workspaceDir, subPath) {
     // POST /api/v1/approvals/:id/edit — edit a pending approval's artifact (P1 #2 fix)
     const editMatch = /^[/]([^/]+)[/]edit$/.exec(subPath);
     if (req.method === 'POST' && editMatch) {
+        const [, rawId] = editMatch;
+        if (!rawId) {
+            sendError(res, 400, 'invalid_id', 'Approval ID is missing');
+            return;
+        }
         let approvalId;
         try {
-            approvalId = decodeURIComponent(editMatch[1]);
+            approvalId = decodeURIComponent(rawId);
         }
         catch {
             sendError(res, 400, 'invalid_id', 'Approval ID contains invalid URI encoding');

package/console/dist/server/routes/feedback-reports.js

@@ -78,17 +78,19 @@ export async function handleFeedbackReportsRoute(req, res, ctx) {
         if (method === 'POST') {
             // Feature flag gate — feedback_channel must be enabled to create drafts
             if (ctx.featureFlags
-                && Object.hasOwn(ctx.featureFlags, 'feedback_channel')
-                && !ctx.featureFlags.feedback_channel.enabled) {
-                sendError(res, 403, 'feedback_channel_disabled', 'feedback_channel feature flag is disabled. Enable feedback_channel in .pd/feature-flags.yaml to use feedback reports.');
-                return;
+                && Object.hasOwn(ctx.featureFlags, 'feedback_channel')) {
+                const feedbackChannel = ctx.featureFlags.feedback_channel;
+                if (feedbackChannel && !feedbackChannel.enabled) {
+                    sendError(res, 403, 'feedback_channel_disabled', 'feedback_channel feature flag is disabled. Enable feedback_channel in .pd/feature-flags.yaml to use feedback reports.');
+                    return;
+                }
             }
             const bodyResult = await readJsonBody(req);
             if (!bodyResult.ok) {
                 sendBadRequest(res, bodyResult.error);
                 return;
             }
-            if (bodyResult.value === null || typeof bodyResult.value !== 'object') {
+            if (bodyResult.value === null || typeof bodyResult.value !== 'object' || Array.isArray(bodyResult.value)) {
                 sendBadRequest(res, 'request body must be a JSON object with {input, diagnostics}');
                 return;
             }

package/console/dist/server/routes/lifecycle.js

@@ -18,9 +18,14 @@ export async function handleLifecycleRoute(req, res, workspaceDir, subPath) {
     // GET /api/v1/lifecycle/principles/:principleId
     const principleMatch = /^[/]principles[/]([^/]+)$/.exec(subPath);
     if (principleMatch) {
+        const [, rawId] = principleMatch;
+        if (!rawId) {
+            sendError(res, 400, 'invalid_encoding', 'Principle ID is missing');
+            return;
+        }
         let principleId;
         try {
-            principleId = decodeURIComponent(principleMatch[1]);
+            principleId = decodeURIComponent(rawId);
         }
         catch {
             sendError(res, 400, 'invalid_encoding', 'Principle ID contains invalid percent encoding');

package/console/dist/server/routes/principles.js

@@ -96,7 +96,7 @@ export async function handlePrinciplesRoute({ req, res, workspaceDir, subPath, }
             sendSuccess(res, result);
         }
         catch (err) {
-            sendError(res, 500, 'principles_list_error', err.message);
+            sendError(res, 500, 'principles_list_error', err instanceof Error ? err.message : String(err));
         }
         return;
     }
@@ -104,6 +104,10 @@ export async function handlePrinciplesRoute({ req, res, workspaceDir, subPath, }
     const trajectoryMatch = /^\/([^/]+)\/trajectory$/.exec(subPath);
     if (trajectoryMatch) {
         const [, rawPrincipleId] = trajectoryMatch;
+        if (!rawPrincipleId) {
+            sendError(res, 400, 'invalid_principle_id', 'Principle ID is missing');
+            return;
+        }
         let decodedPrincipleId;
         try {
             decodedPrincipleId = decodeURIComponent(rawPrincipleId);
@@ -130,6 +134,10 @@ export async function handlePrinciplesRoute({ req, res, workspaceDir, subPath, }
     const detailMatch = /^\/([^/]+)$/.exec(subPath);
     if (detailMatch) {
         const [, principleId] = detailMatch;
+        if (!principleId) {
+            sendError(res, 400, 'invalid_principle_id', 'Principle ID is missing');
+            return;
+        }
         try {
             const result = await model.getPrincipleDetail(principleId);
             if (!result) {
@@ -139,7 +147,7 @@ export async function handlePrinciplesRoute({ req, res, workspaceDir, subPath, }
             sendSuccess(res, result);
         }
         catch (err) {
-            sendError(res, 500, 'principle_detail_error', err.message);
+            sendError(res, 500, 'principle_detail_error', err instanceof Error ? err.message : String(err));
         }
         return;
     }

package/console/dist/server/routes/workspaces.js

@@ -56,6 +56,10 @@ export function createWorkspacesRoutes(configStore, workspaceService) {
             return;
         }
         const [, wsName, rest] = nameMatch;
+        if (!wsName) {
+            sendError(res, 400, 'invalid_name', 'Workspace name is missing');
+            return;
+        }
         let decodedWsName;
         try {
             decodedWsName = decodeURIComponent(wsName);

package/console/dist/ui/components/ui/charts.js

@@ -63,7 +63,10 @@ export function computeValueBuckets(principles, bucketCount = 5) {
     }));
     for (const p of principles) {
         const bucketIndex = Math.min(Math.floor(p.valueScore / bucketSize), bucketCount - 1);
-        buckets[bucketIndex].count++;
+        const bucket = buckets[bucketIndex];
+        if (bucket) {
+            bucket.count++;
+        }
     }
     return buckets;
 }

package/console/dist/ui/components/ui/markdown.js

@@ -27,7 +27,7 @@ function detectCodeBlocks(text) {
         if (match.index > lastIndex) {
             parts.push({ type: "text", content: text.slice(lastIndex, match.index) });
         }
-        parts.push({ type: "code", language: match[1] || "", code: match[2].trimEnd() });
+        parts.push({ type: "code", language: match[1] || "", code: (match[2] ?? "").trimEnd() });
         lastIndex = match.index + match[0].length;
     }
     if (lastIndex < text.length) {
@@ -77,18 +77,22 @@ function renderTextBlock(text) {
             inList = false;
         }
         if (headingMatch) {
-            const level = headingMatch[1].length;
+            const levelStr = headingMatch[1] ?? "";
+            const content = headingMatch[2] ?? "";
+            const level = levelStr.length;
             const Tag = `h${level}`;
             const sizeClass = level === 1 ? "text-lg" : level === 2 ? "text-base" : "text-sm";
-            nodes.push(_jsx(Tag, { className: cn("font-semibold mt-3 mb-1", sizeClass), children: renderInlineMarkdown(headingMatch[2]) }, key++));
+            nodes.push(_jsx(Tag, { className: cn("font-semibold mt-3 mb-1", sizeClass), children: renderInlineMarkdown(content) }, key++));
         }
         else if (listItemMatch) {
             inList = true;
-            nodes.push(_jsxs("div", { className: "flex items-start gap-2 ml-2", children: [_jsx("span", { className: "text-muted-foreground mt-0.5", children: "\u2022" }), _jsx("span", { className: "flex-1", children: renderInlineMarkdown(listItemMatch[1]) })] }, key++));
+            const itemText = listItemMatch[1] ?? "";
+            nodes.push(_jsxs("div", { className: "flex items-start gap-2 ml-2", children: [_jsx("span", { className: "text-muted-foreground mt-0.5", children: "\u2022" }), _jsx("span", { className: "flex-1", children: renderInlineMarkdown(itemText) })] }, key++));
         }
         else if (numberedItemMatch) {
             inList = true;
-            nodes.push(_jsxs("div", { className: "flex items-start gap-2 ml-2", children: [_jsx("span", { className: "text-muted-foreground text-xs tabular-nums", children: "\u2022" }), _jsx("span", { className: "flex-1", children: renderInlineMarkdown(numberedItemMatch[1]) })] }, key++));
+            const itemText = numberedItemMatch[1] ?? "";
+            nodes.push(_jsxs("div", { className: "flex items-start gap-2 ml-2", children: [_jsx("span", { className: "text-muted-foreground text-xs tabular-nums", children: "\u2022" }), _jsx("span", { className: "flex-1", children: renderInlineMarkdown(itemText) })] }, key++));
         }
         else if (line.trim() === "") {
             nodes.push(_jsx("div", { className: "h-2" }, key++));

package/console/dist/ui/i18n/en.json

@@ -726,8 +726,7 @@
                 "code_tool_hook": "RuleHost",
                 "defer_archive": "Defer Archive",
                 "prompt": "Prompt",
-                "skill": "Skill (retired)",
-                "model_training": "Model Training (retired)"
+                "skill": "Skill (retired)"
             },
             "retired": "This channel is retired and cannot be actioned",
             "riskLevel": "Risk Level"

package/console/dist/ui/i18n/zh-CN.json

@@ -726,8 +726,7 @@
                 "code_tool_hook": "RuleHost",
                 "defer_archive": "延迟归档",
                 "prompt": "提示词注入",
-                "skill": "技能激活（已停用）",
-                "model_training": "模型训练（已停用）"
+                "skill": "技能激活（已停用）"
             },
             "retired": "此通道已停用，无法执行审批操作",
             "riskLevel": "风险级别"

package/console/dist/ui/utils/enum-labels.js

@@ -53,7 +53,6 @@ const LOCAL_LABELS = {
         'defer_archive': '延迟归档',
         'code_tool_hook': 'Code Tool Hook',
         'skill': '技能激活（已停用）',
-        'model_training': '模型训练（已停用）',
     },
     readiness: {
         'ready': '就绪',
@@ -149,7 +148,10 @@ export function enumLabel(category, value, t) {
     // 2. Fall back to local map
     const localMap = LOCAL_LABELS[category];
     if (localMap && Object.hasOwn(localMap, value)) {
-        return localMap[value];
+        const label = localMap[value];
+        if (label !== undefined) {
+            return label;
+        }
     }
     // 3. Last resort: raw value
     return value;