create-principles-disciple 1.92.0 → 1.94.0

package/console/dist/server/config/AuthConfig.js

@@ -26,6 +26,12 @@ export class AuthConfig {
             return false;
         }
         const [, provided] = match;
+        if (!provided) {
+            return false;
+        }
+        if (!this.token) {
+            return false;
+        }
         const providedBuf = Buffer.from(provided, 'utf8');
         const expectedBuf = Buffer.from(this.token, 'utf8');
         if (providedBuf.length !== expectedBuf.length) {

package/console/dist/server/config/pd-config-store.d.ts

@@ -13,7 +13,7 @@
  * - ERR-013: Object.hasOwn() for untrusted keys
  * - ERR-045: ANY-segment redaction for sensitive keys
  */
-import type { EffectivePdConfig, RedactedPdConfigSummary, InternalAgentName } from '@principles/core/runtime-v2';
+import type { EffectivePdConfig, RedactedPdConfigSummary, InternalAgentName, FeatureFlagsResult } from '@principles/core/runtime-v2';
 export interface ConfigLoadResultOk {
     ok: true;
     effective: EffectivePdConfig;
@@ -76,6 +76,12 @@ export declare function validateBindingPayload(payload: unknown): {
 };
 export declare function getPdConfigPath(workspaceDir: string): string;
 export declare function loadPdConfig(workspaceDir: string): ConfigLoadResult;
+/**
+ * Compute feature flags from the loaded PD config (PRI-460).
+ * Works with both ok and error results (uses defaults for errors).
+ * Replaces the legacy `loadWorkspaceFeatureFlags` + `buildFeedbackChannelFlags` path.
+ */
+export declare function computeFlagsFromLoadResult(result: ConfigLoadResult): FeatureFlagsResult;
 export declare function getConfigSummary(workspaceDir: string): {
     summary: RedactedPdConfigSummary;
     errors?: {

package/console/dist/server/config/pd-config-store.js

@@ -16,7 +16,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import yaml from 'js-yaml';
-import { validatePdConfig, computeEffectivePdConfig, redactPdConfig, checkAgentRuntimeReadiness, resolveAgentRuntimeBinding, INTERNAL_AGENT_NAMES, } from '@principles/core/runtime-v2';
+import { validatePdConfig, computeEffectivePdConfig, computeFeatureFlagsFromConfig, redactPdConfig, checkAgentRuntimeReadiness, resolveAgentRuntimeBinding, INTERNAL_AGENT_NAMES, } from '@principles/core/runtime-v2';
 // ── Constants ────────────────────────────────────────────────────────────────
 const PD_CONFIG_DIR = '.pd';
 const PD_CONFIG_FILENAME = 'config.yaml';
@@ -211,6 +211,16 @@ export function loadPdConfig(workspaceDir) {
         warnings: effective.warnings,
     };
 }
+// ── Feature Flags from Config ────────────────────────────────────────────────
+/**
+ * Compute feature flags from the loaded PD config (PRI-460).
+ * Works with both ok and error results (uses defaults for errors).
+ * Replaces the legacy `loadWorkspaceFeatureFlags` + `buildFeedbackChannelFlags` path.
+ */
+export function computeFlagsFromLoadResult(result) {
+    const effective = result.ok ? result.effective : result.defaults;
+    return computeFeatureFlagsFromConfig(effective);
+}
 // ── Get Redacted Summary ─────────────────────────────────────────────────────
 export function getConfigSummary(workspaceDir) {
     const result = loadPdConfig(workspaceDir);

package/console/dist/server/index.js

@@ -2,7 +2,7 @@ import * as http from 'http';
 import * as fs from 'fs';
 import * as path from 'path';
 import { fileURLToPath } from 'url';
-import { loadWorkspaceFeatureFlags, buildFeedbackChannelFlags, } from './config/feature-flags.js';
+import { loadPdConfig, computeFlagsFromLoadResult } from './config/pd-config-store.js';
 import { AuthConfig } from './config/AuthConfig.js';
 import { WorkspaceConfigStore } from './config/WorkspaceConfigStore.js';
 import { WorkspaceService } from './models/WorkspaceService.js';
@@ -45,7 +45,10 @@ function resolveWorkspaceDir(argv) {
     let explicitWorkspace = undefined;
     for (let i = 0; i < args.length; i++) {
         if (args[i] === '--workspace' && i + 1 < args.length) {
-            explicitWorkspace = path.resolve(args[i + 1]);
+            const next = args[i + 1];
+            if (next !== undefined) {
+                explicitWorkspace = path.resolve(next);
+            }
             break;
         }
     }
@@ -60,12 +63,15 @@ function resolveWorkspaceDir(argv) {
     const workspaces = configStore.getWorkspaces();
     const enabled = workspaces.filter(e => e.config?.enabled !== false);
     if (enabled.length > 0) {
-        const resolved = path.resolve(enabled[0].path);
-        if (fs.existsSync(resolved)) {
-            console.log('[pd-console] No --workspace flag; using registered workspace: ' + resolved);
-            return resolved;
+        const [first] = enabled;
+        if (first) {
+            const resolved = path.resolve(first.path);
+            if (fs.existsSync(resolved)) {
+                console.log('[pd-console] No --workspace flag; using registered workspace: ' + resolved);
+                return resolved;
+            }
+            console.warn('[pd-console] Registered workspace path does not exist: ' + resolved + ', falling back to cwd');
         }
-        console.warn('[pd-console] Registered workspace path does not exist: ' + resolved + ', falling back to cwd');
     }
     return process.cwd();
 }
@@ -78,24 +84,33 @@ function parseArgs(argv) {
     let token = undefined;
     for (let i = 0; i < args.length; i++) {
         if (args[i] === '--port' && i + 1 < args.length) {
-            const parsed = parseInt(args[i + 1], 10);
-            if (Number.isNaN(parsed) || parsed < 1 || parsed > 65535) {
-                console.error('Invalid port: ' + args[i + 1] + '. Must be 1-65535.');
-                process.exit(1);
+            const portStr = args[i + 1];
+            if (portStr !== undefined) {
+                const parsed = parseInt(portStr, 10);
+                if (Number.isNaN(parsed) || parsed < 1 || parsed > 65535) {
+                    console.error('Invalid port: ' + portStr + '. Must be 1-65535.');
+                    process.exit(1);
+                }
+                port = parsed;
+                i++;
             }
-            port = parsed;
-            i++;
         }
         else if (args[i] === '--host' && i + 1 < args.length) {
-            host = args[i + 1];
-            i++;
+            const next = args[i + 1];
+            if (next !== undefined) {
+                host = next;
+                i++;
+            }
         }
         else if (args[i] === '--no-auth') {
             noAuth = true;
         }
         else if (args[i] === '--token' && i + 1 < args.length) {
-            token = args[i + 1];
-            i++;
+            const next = args[i + 1];
+            if (next !== undefined) {
+                token = next;
+                i++;
+            }
         }
     }
     if (noAuth && host !== '127.0.0.1' && host !== 'localhost') {
@@ -182,11 +197,15 @@ function asyncHandler(fn, timeoutMs = REQUEST_TIMEOUT_MS) {
 async function initServices(workspaceDir, authConfig) {
     const configStore = new WorkspaceConfigStore();
     const workspaceService = new WorkspaceService(configStore);
-    // Load feature flags — fail-closed: on error, feedback_channel is disabled
-    const flagLoadResult = loadWorkspaceFeatureFlags(workspaceDir);
-    const feedbackFlags = buildFeedbackChannelFlags(flagLoadResult);
-    if (!flagLoadResult.ok) {
-        console.warn('[pd-console] Feature flag loading failed (feedback channel disabled):', flagLoadResult.reason);
+    // Load feature flags from canonical .pd/config.yaml — fail-closed: on error, feedback_channel uses defaults
+    const configResult = loadPdConfig(workspaceDir);
+    const pdFlags = computeFlagsFromLoadResult(configResult);
+    const feedbackChannelEnabled = pdFlags.flags.feedback_channel?.enabled ?? false;
+    const feedbackFlags = {
+        feedback_channel: { enabled: feedbackChannelEnabled },
+    };
+    if (!configResult.ok) {
+        console.warn('[pd-console] PD config loading failed (using defaults for feedback channel):', configResult.errors.map(e => e.reason).join('; '));
     }
     return {
         workspaceDir,

package/console/dist/server/models/ApprovalsConsoleModel.js

@@ -1,7 +1,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { SqliteConnection, SqliteApprovalQueueStore, SqliteActivationStateStore, SqlitePIArtifactStore, ActivationDispatcher, PromptWriter, DeferArchiveWriter, RuleHostWriter, createProductionGateDeps, ApprovalCompletionService, ApprovalQueue, mapConfidenceToLabel, isArtifactRevisionOf, MVP_CHANNELS, } from '@principles/core/runtime-v2';
-import { loadWorkspaceFeatureFlags } from '../config/feature-flags.js';
+import { loadPdConfig, computeFlagsFromLoadResult } from '../config/pd-config-store.js';
 const MVP_PROVEN_CHANNELS = new Set(MVP_CHANNELS);
 const EMPTY_STATS = { pending: 0, approved: 0, rejected: 0, cancelled: 0 };
 function isMissingTableError(err) {
@@ -216,17 +216,9 @@ export class ApprovalsConsoleModel {
         // Feature flag gate (Contract F): when story_a_approval_completion is disabled,
         // the new orchestrator is deactivated without damaging existing data.
         // The approval remains in 'approved' status; only activation is skipped.
-        const flagResult = loadWorkspaceFeatureFlags(this.workspaceDir);
-        if (!flagResult.ok) {
-            return {
-                decision: 'refused',
-                reason: `feature_flag_load_failed: ${flagResult.reason}`,
-                nextAction: 'fix feature flag config or manually dispatch via pd runtime activation dispatch',
-                channel: existing.channel,
-                riskLevel: existing.riskLevel,
-            };
-        }
-        const completionFlag = flagResult.flags.flags.story_a_approval_completion;
+        const configResult = loadPdConfig(this.workspaceDir);
+        const pdFlags = computeFlagsFromLoadResult(configResult);
+        const completionFlag = pdFlags.flags.story_a_approval_completion;
         if (!completionFlag || !completionFlag.enabled) {
             // Flag disabled — return undefined so the caller knows activation was skipped.
             // The approval record itself is not rolled back (Contract F: no data damage).

package/console/dist/server/models/ApprovalsGroupedConsoleModel.js

@@ -1,4 +1,5 @@
-import { SqliteConnection, SqliteApprovalQueueStore, SqlitePIArtifactStore, ApprovalQueue, loadLedger, } from '@principles/core/runtime-v2';
+import { SqliteConnection, SqliteApprovalQueueStore, SqlitePIArtifactStore, ApprovalQueue, } from '@principles/core/runtime-v2';
+import { loadLedger } from '@principles/core/principle-tree-ledger';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 /** Type guard: non-null object (not array). Replaces `as Record<string, unknown>` assertions. */
@@ -41,8 +42,10 @@ function extractCandidateDescription(contentJson) {
     if (typeof obj.implementationCode === 'string') {
         const principleMatch = /\/\/\s*Principle:\s*(.+)/.exec(obj.implementationCode);
         const ruleMatch = /\/\/\s*Rule:\s*(.+)/.exec(obj.implementationCode);
-        const principleText = principleMatch ? principleMatch[1].trim() : null;
-        const ruleText = ruleMatch ? ruleMatch[1].trim() : null;
+        const principleRaw = principleMatch ? principleMatch[1] : undefined;
+        const ruleRaw = ruleMatch ? ruleMatch[1] : undefined;
+        const principleText = principleRaw ? principleRaw.trim() : null;
+        const ruleText = ruleRaw ? ruleRaw.trim() : null;
         if (principleText && ruleText)
             return `${principleText} — ${ruleText}`;
         if (ruleText)

package/console/dist/server/models/ConsoleLifecycleDatasource.js

@@ -1,4 +1,4 @@
-import { loadLedger } from '@principles/core/runtime-v2';
+import { loadLedger } from '@principles/core/principle-tree-ledger';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 export class LineageSourceRetiredError extends Error {

package/console/dist/server/routes/activations.js

@@ -49,6 +49,10 @@ export async function handleActivationsRoute(req, res, workspaceDir, subPath) {
     const disableExec = /^\/([^/]+)\/disable$/.exec(subPath);
     if (req.method === 'POST' && disableExec) {
         const [, rawId] = disableExec;
+        if (!rawId) {
+            sendError(res, 400, 'invalid_id', 'Activation ID is missing');
+            return;
+        }
         let activationId;
         try {
             activationId = decodeURIComponent(rawId);

package/console/dist/server/routes/approvals.js

@@ -77,9 +77,14 @@ export async function handleApprovalsRoute(req, res, workspaceDir, subPath) {
     // GET /api/v1/approvals/:id - detail
     const detailMatch = /^[/]([^/]+)$/.exec(subPath);
     if (req.method === 'GET' && detailMatch) {
+        const [, rawId] = detailMatch;
+        if (!rawId) {
+            sendError(res, 400, 'invalid_id', 'Approval ID is missing');
+            return;
+        }
         let approvalId;
         try {
-            approvalId = decodeURIComponent(detailMatch[1]);
+            approvalId = decodeURIComponent(rawId);
         }
         catch {
             sendError(res, 400, 'invalid_id', 'Approval ID contains invalid URI encoding');
@@ -101,9 +106,14 @@ export async function handleApprovalsRoute(req, res, workspaceDir, subPath) {
     // POST /api/v1/approvals/:id/approve
     const approveMatch = /^[/]([^/]+)[/]approve$/.exec(subPath);
     if (req.method === 'POST' && approveMatch) {
+        const [, rawId] = approveMatch;
+        if (!rawId) {
+            sendError(res, 400, 'invalid_id', 'Approval ID is missing');
+            return;
+        }
         let approvalId;
         try {
-            approvalId = decodeURIComponent(approveMatch[1]);
+            approvalId = decodeURIComponent(rawId);
         }
         catch {
             sendError(res, 400, 'invalid_id', 'Approval ID contains invalid URI encoding');
@@ -151,9 +161,14 @@ export async function handleApprovalsRoute(req, res, workspaceDir, subPath) {
     // POST /api/v1/approvals/:id/reject
     const rejectMatch = /^[/]([^/]+)[/]reject$/.exec(subPath);
     if (req.method === 'POST' && rejectMatch) {
+        const [, rawId] = rejectMatch;
+        if (!rawId) {
+            sendError(res, 400, 'invalid_id', 'Approval ID is missing');
+            return;
+        }
         let approvalId;
         try {
-            approvalId = decodeURIComponent(rejectMatch[1]);
+            approvalId = decodeURIComponent(rawId);
         }
         catch {
             sendError(res, 400, 'invalid_id', 'Approval ID contains invalid URI encoding');
@@ -201,9 +216,14 @@ export async function handleApprovalsRoute(req, res, workspaceDir, subPath) {
     // POST /api/v1/approvals/:id/edit — edit a pending approval's artifact (P1 #2 fix)
     const editMatch = /^[/]([^/]+)[/]edit$/.exec(subPath);
     if (req.method === 'POST' && editMatch) {
+        const [, rawId] = editMatch;
+        if (!rawId) {
+            sendError(res, 400, 'invalid_id', 'Approval ID is missing');
+            return;
+        }
         let approvalId;
         try {
-            approvalId = decodeURIComponent(editMatch[1]);
+            approvalId = decodeURIComponent(rawId);
         }
         catch {
             sendError(res, 400, 'invalid_id', 'Approval ID contains invalid URI encoding');

package/console/dist/server/routes/feedback-reports.js

@@ -78,17 +78,19 @@ export async function handleFeedbackReportsRoute(req, res, ctx) {
         if (method === 'POST') {
             // Feature flag gate — feedback_channel must be enabled to create drafts
             if (ctx.featureFlags
-                && Object.hasOwn(ctx.featureFlags, 'feedback_channel')
-                && !ctx.featureFlags.feedback_channel.enabled) {
-                sendError(res, 403, 'feedback_channel_disabled', 'feedback_channel feature flag is disabled. Enable feedback_channel in .pd/feature-flags.yaml to use feedback reports.');
-                return;
+                && Object.hasOwn(ctx.featureFlags, 'feedback_channel')) {
+                const feedbackChannel = ctx.featureFlags.feedback_channel;
+                if (feedbackChannel && !feedbackChannel.enabled) {
+                    sendError(res, 403, 'feedback_channel_disabled', 'feedback_channel feature flag is disabled. Enable feedback_channel in .pd/config.yaml to use feedback reports.');
+                    return;
+                }
             }
             const bodyResult = await readJsonBody(req);
             if (!bodyResult.ok) {
                 sendBadRequest(res, bodyResult.error);
                 return;
             }
-            if (bodyResult.value === null || typeof bodyResult.value !== 'object') {
+            if (bodyResult.value === null || typeof bodyResult.value !== 'object' || Array.isArray(bodyResult.value)) {
                 sendBadRequest(res, 'request body must be a JSON object with {input, diagnostics}');
                 return;
             }

package/console/dist/server/routes/lifecycle.js

@@ -18,9 +18,14 @@ export async function handleLifecycleRoute(req, res, workspaceDir, subPath) {
     // GET /api/v1/lifecycle/principles/:principleId
     const principleMatch = /^[/]principles[/]([^/]+)$/.exec(subPath);
     if (principleMatch) {
+        const [, rawId] = principleMatch;
+        if (!rawId) {
+            sendError(res, 400, 'invalid_encoding', 'Principle ID is missing');
+            return;
+        }
         let principleId;
         try {
-            principleId = decodeURIComponent(principleMatch[1]);
+            principleId = decodeURIComponent(rawId);
         }
         catch {
             sendError(res, 400, 'invalid_encoding', 'Principle ID contains invalid percent encoding');

package/console/dist/server/routes/principles.js

@@ -96,7 +96,7 @@ export async function handlePrinciplesRoute({ req, res, workspaceDir, subPath, }
             sendSuccess(res, result);
         }
         catch (err) {
-            sendError(res, 500, 'principles_list_error', err.message);
+            sendError(res, 500, 'principles_list_error', err instanceof Error ? err.message : String(err));
         }
         return;
     }
@@ -104,6 +104,10 @@ export async function handlePrinciplesRoute({ req, res, workspaceDir, subPath, }
     const trajectoryMatch = /^\/([^/]+)\/trajectory$/.exec(subPath);
     if (trajectoryMatch) {
         const [, rawPrincipleId] = trajectoryMatch;
+        if (!rawPrincipleId) {
+            sendError(res, 400, 'invalid_principle_id', 'Principle ID is missing');
+            return;
+        }
         let decodedPrincipleId;
         try {
             decodedPrincipleId = decodeURIComponent(rawPrincipleId);
@@ -130,6 +134,10 @@ export async function handlePrinciplesRoute({ req, res, workspaceDir, subPath, }
     const detailMatch = /^\/([^/]+)$/.exec(subPath);
     if (detailMatch) {
         const [, principleId] = detailMatch;
+        if (!principleId) {
+            sendError(res, 400, 'invalid_principle_id', 'Principle ID is missing');
+            return;
+        }
         try {
             const result = await model.getPrincipleDetail(principleId);
             if (!result) {
@@ -139,7 +147,7 @@ export async function handlePrinciplesRoute({ req, res, workspaceDir, subPath, }
             sendSuccess(res, result);
         }
         catch (err) {
-            sendError(res, 500, 'principle_detail_error', err.message);
+            sendError(res, 500, 'principle_detail_error', err instanceof Error ? err.message : String(err));
         }
         return;
     }

package/console/dist/server/routes/workspaces.js

@@ -56,6 +56,10 @@ export function createWorkspacesRoutes(configStore, workspaceService) {
             return;
         }
         const [, wsName, rest] = nameMatch;
+        if (!wsName) {
+            sendError(res, 400, 'invalid_name', 'Workspace name is missing');
+            return;
+        }
         let decodedWsName;
         try {
             decodedWsName = decodeURIComponent(wsName);

package/console/dist/ui/components/ui/charts.js

@@ -63,7 +63,10 @@ export function computeValueBuckets(principles, bucketCount = 5) {
     }));
     for (const p of principles) {
         const bucketIndex = Math.min(Math.floor(p.valueScore / bucketSize), bucketCount - 1);
-        buckets[bucketIndex].count++;
+        const bucket = buckets[bucketIndex];
+        if (bucket) {
+            bucket.count++;
+        }
     }
     return buckets;
 }

package/console/dist/ui/components/ui/markdown.js

@@ -27,7 +27,7 @@ function detectCodeBlocks(text) {
         if (match.index > lastIndex) {
             parts.push({ type: "text", content: text.slice(lastIndex, match.index) });
         }
-        parts.push({ type: "code", language: match[1] || "", code: match[2].trimEnd() });
+        parts.push({ type: "code", language: match[1] || "", code: (match[2] ?? "").trimEnd() });
         lastIndex = match.index + match[0].length;
     }
     if (lastIndex < text.length) {
@@ -77,18 +77,22 @@ function renderTextBlock(text) {
             inList = false;
         }
         if (headingMatch) {
-            const level = headingMatch[1].length;
+            const levelStr = headingMatch[1] ?? "";
+            const content = headingMatch[2] ?? "";
+            const level = levelStr.length;
             const Tag = `h${level}`;
             const sizeClass = level === 1 ? "text-lg" : level === 2 ? "text-base" : "text-sm";
-            nodes.push(_jsx(Tag, { className: cn("font-semibold mt-3 mb-1", sizeClass), children: renderInlineMarkdown(headingMatch[2]) }, key++));
+            nodes.push(_jsx(Tag, { className: cn("font-semibold mt-3 mb-1", sizeClass), children: renderInlineMarkdown(content) }, key++));
         }
         else if (listItemMatch) {
             inList = true;
-            nodes.push(_jsxs("div", { className: "flex items-start gap-2 ml-2", children: [_jsx("span", { className: "text-muted-foreground mt-0.5", children: "\u2022" }), _jsx("span", { className: "flex-1", children: renderInlineMarkdown(listItemMatch[1]) })] }, key++));
+            const itemText = listItemMatch[1] ?? "";
+            nodes.push(_jsxs("div", { className: "flex items-start gap-2 ml-2", children: [_jsx("span", { className: "text-muted-foreground mt-0.5", children: "\u2022" }), _jsx("span", { className: "flex-1", children: renderInlineMarkdown(itemText) })] }, key++));
         }
         else if (numberedItemMatch) {
             inList = true;
-            nodes.push(_jsxs("div", { className: "flex items-start gap-2 ml-2", children: [_jsx("span", { className: "text-muted-foreground text-xs tabular-nums", children: "\u2022" }), _jsx("span", { className: "flex-1", children: renderInlineMarkdown(numberedItemMatch[1]) })] }, key++));
+            const itemText = numberedItemMatch[1] ?? "";
+            nodes.push(_jsxs("div", { className: "flex items-start gap-2 ml-2", children: [_jsx("span", { className: "text-muted-foreground text-xs tabular-nums", children: "\u2022" }), _jsx("span", { className: "flex-1", children: renderInlineMarkdown(itemText) })] }, key++));
         }
         else if (line.trim() === "") {
             nodes.push(_jsx("div", { className: "h-2" }, key++));

package/console/dist/ui/utils/enum-labels.js

@@ -148,7 +148,10 @@ export function enumLabel(category, value, t) {
     // 2. Fall back to local map
     const localMap = LOCAL_LABELS[category];
     if (localMap && Object.hasOwn(localMap, value)) {
-        return localMap[value];
+        const label = localMap[value];
+        if (label !== undefined) {
+            return label;
+        }
     }
     // 3. Last resort: raw value
     return value;