create-snipara 2.0.15 → 2.0.17

package/README.md

@@ -29,7 +29,7 @@ Use it for:
 - free account signup with reviewed Context + Memory
 - local project wiring, `doctor`, `repair`, and `upgrade`
 - local source activation without GitHub, plus optional GitHub repository sync and PR Answer Packs approval when the current folder is a GitHub repo
-- day-zero proof with a ready-to-ask grounded question and a small hosted README/docs seed sync for new projects; advanced briefs, memory candidates, and diagnostics remain available in the generated activation artifacts
+- day-zero proof with a ready-to-ask grounded question, a small hosted README/docs seed sync, and an evidence-linked Project Bootstrap for new projects
 
 ## Why It Exists
 
@@ -137,6 +137,47 @@ That distinction matters:
 - optionally installs Claude Code agent hooks and companion local code overlay Git hooks
 - supports `doctor`, `repair`, `upgrade`, and `print-config`
 
+## Project Bootstrap: Cold-Start Intelligence
+
+During setup, `create-snipara` builds a reviewable picture of the repository
+before the first agent task. It writes both a machine-readable artifact and a
+human-readable report:
+
+- `.snipara/activation/project-bootstrap.json`
+- `.snipara/activation/project-bootstrap.md`
+
+The report summarizes eight dynamic sections. Counts come from the current
+repository; they are not fixed demo numbers:
+
+- architecture patterns
+- conventions
+- decision candidates
+- procedures
+- skills and candidate workflows
+- recurring failure candidates
+- critical code symbols
+- verification patterns
+
+The local pass uses bounded evidence from Git history, `AGENTS.md`,
+`CLAUDE.md`, `README`, `docs/`, CI configuration, package scripts, test
+patterns, and release history. Every item links back to its evidence. Directly
+detected facts can be marked `observed`; inferred decisions, workflows, and
+failure patterns remain `needs_review` and are not promoted to durable project
+memory automatically.
+
+The artifact also includes a coverage ledger. PR and issue history are marked
+`unavailable` until the user explicitly connects a source provider. Critical
+symbols are marked `deferred` until Code Graph indexing is available. Snipara
+does not invent candidates to make these sections look complete.
+
+After setup, start here:
+
+> Review what Snipara learned about your project.
+
+The Project Bootstrap summary is also carried into the First Work Brief so the
+agent begins with the repository's inherited experience and its remaining
+evidence gaps in view.
+
 ## Product Boundary
 
 Keep the package roles simple:
@@ -461,6 +502,10 @@ After setup, the project gets a local pack at `.snipara/companion/`:
 - `commands.json`: starter commands for the current project
 - `doctor.json`: most recent validation report
 
+Activation evidence is kept separately under `.snipara/activation/`, including
+the Project Bootstrap JSON/Markdown pair, First Work Brief, handoff, and memory
+candidate review artifacts.
+
 This pack is meant to be the local source of truth for machine-level setup. When
 `snipara-companion` is installed, it includes business-folder onboarding commands
 such as:

package/dist/index.js

@@ -13,8 +13,8 @@ import { homedir } from "os";
 // package.json
 var package_default = {
   name: "create-snipara",
-  version: "2.0.15",
-  description: "Onboard Snipara Hosted MCP Context + Memory with auth, companion workflows, and optional Snipara Sandbox",
+  version: "2.0.17",
+  description: "Onboard Snipara Hosted MCP Context + Memory with project bootstrap intelligence and optional local workflows",
   main: "dist/index.js",
   type: "module",
   bin: {
@@ -107,8 +107,8 @@ var DEVICE_CLIENT_ID = "create-snipara";
 var DAY_ZERO_CORPUS_MAX_FILES = 8;
 var DAY_ZERO_CORPUS_MAX_FILE_CHARS = 12e3;
 var DAY_ZERO_CORPUS_MAX_TOTAL_CHARS = 5e4;
-var ACTIVATION_MANIFEST_SCHEMA_VERSION = "snipara.activation.manifest.v1";
-var ACTIVATION_CONSUMER_CONTRACT_VERSION = "snipara.editor.activation.v1";
+var PROJECT_BOOTSTRAP_MAX_WALKED_FILES = 2500;
+var PROJECT_BOOTSTRAP_MAX_MATCHED_FILES = 80;
 var EXPERIENCE_GOAL_SECTION = `## Experience Goal
 
 The target experience is outcome-first agent work across supported clients:
@@ -154,6 +154,12 @@ function getFirstWorkBriefPath() {
 function getMemoryCandidatesPath() {
   return path.join(getActivationDir(), "memory-candidates.json");
 }
+function getProjectBootstrapJsonPath() {
+  return path.join(getActivationDir(), "project-bootstrap.json");
+}
+function getProjectBootstrapMarkdownPath() {
+  return path.join(getActivationDir(), "project-bootstrap.md");
+}
 function writeActivationManifest(manifest) {
   fs.mkdirSync(getActivationDir(), { recursive: true });
   const payload = JSON.stringify(manifest, null, 2) + "\n";
@@ -561,6 +567,23 @@ function listFilesUnder(relativeDir, maxFiles) {
   visit(root);
   return results;
 }
+function isCreateSniparaGeneratedInstructionSource(relativePath) {
+  if (!["AGENTS.md", "CLAUDE.md", ".cursor/rules/snipara.mdc"].includes(relativePath)) {
+    return false;
+  }
+  try {
+    const prefix = fs.readFileSync(path.join(process.cwd(), relativePath), "utf8").slice(0, 4096);
+    return prefix.includes(
+      "## Snipara Context Workflow\n\nThis project uses Snipara Hosted MCP for project context and reviewed memory."
+    ) || prefix.includes(
+      "Canonical project context is in `AGENTS.md`. This file exists for Claude Code compatibility."
+    ) || prefix.includes(
+      "description: Use Snipara Hosted MCP for project context and reviewed memory."
+    );
+  } catch {
+    return false;
+  }
+}
 function findDecisionArchaeologySources(cwd) {
   const exists = (relativePath) => fs.existsSync(path.join(cwd, relativePath));
   const directSources = [
@@ -578,7 +601,527 @@ function findDecisionArchaeologySources(cwd) {
     ...listFilesUnder("docs/decisions", 20),
     ...listFilesUnder(".cursor/rules", 20)
   ];
-  return [.../* @__PURE__ */ new Set([...directSources, ...archaeologySources])].slice(0, 80);
+  return [.../* @__PURE__ */ new Set([...directSources, ...archaeologySources])].filter((source) => !isCreateSniparaGeneratedInstructionSource(source)).slice(0, 80);
+}
+function findBoundedProjectFiles(predicate, maxMatches = PROJECT_BOOTSTRAP_MAX_MATCHED_FILES) {
+  const ignoredDirectories = /* @__PURE__ */ new Set([
+    ".git",
+    ".next",
+    ".snipara",
+    ".turbo",
+    ".venv",
+    "build",
+    "coverage",
+    "dist",
+    "node_modules",
+    "target",
+    "vendor"
+  ]);
+  const results = [];
+  let walkedFiles = 0;
+  const visit = (directory) => {
+    if (walkedFiles >= PROJECT_BOOTSTRAP_MAX_WALKED_FILES || results.length >= maxMatches) {
+      return;
+    }
+    let entries;
+    try {
+      entries = fs.readdirSync(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.isSymbolicLink()) {
+        continue;
+      }
+      const absolutePath = path.join(directory, entry.name);
+      if (entry.isDirectory()) {
+        if (!ignoredDirectories.has(entry.name)) {
+          visit(absolutePath);
+        }
+      } else if (entry.isFile()) {
+        walkedFiles += 1;
+        const relativePath = path.relative(process.cwd(), absolutePath).replace(/\\/g, "/");
+        if (predicate(relativePath)) {
+          results.push(relativePath);
+        }
+      }
+      if (walkedFiles >= PROJECT_BOOTSTRAP_MAX_WALKED_FILES || results.length >= maxMatches) {
+        return;
+      }
+    }
+  };
+  visit(process.cwd());
+  return results;
+}
+function readProjectPackageMetadata() {
+  const packageJsonPath = path.join(process.cwd(), "package.json");
+  if (!fs.existsSync(packageJsonPath)) {
+    return { scripts: {}, dependencies: [], workspaces: false };
+  }
+  try {
+    const parsed = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+    const scripts = Object.fromEntries(
+      Object.entries(parsed.scripts ?? {}).filter(
+        (entry) => typeof entry[1] === "string"
+      )
+    );
+    const dependencies = [
+      ...Object.keys(parsed.dependencies ?? {}),
+      ...Object.keys(parsed.devDependencies ?? {}),
+      ...Object.keys(parsed.peerDependencies ?? {})
+    ];
+    return {
+      scripts,
+      dependencies: [...new Set(dependencies)].sort(),
+      workspaces: Boolean(parsed.workspaces)
+    };
+  } catch {
+    return { scripts: {}, dependencies: [], workspaces: false };
+  }
+}
+function readBootstrapGitSubjects(maxCount) {
+  try {
+    const output = execSync(`git log --pretty=format:%h%x20%s --max-count=${maxCount}`, {
+      cwd: process.cwd(),
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 1500
+    }).trim();
+    return output ? output.split(/\r?\n/).map((line) => line.trim()) : [];
+  } catch {
+    return [];
+  }
+}
+function readBootstrapReleaseTags() {
+  try {
+    const output = execSync("git tag --sort=-creatordate", {
+      cwd: process.cwd(),
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 1e3
+    }).trim();
+    return output ? output.split(/\r?\n/).slice(0, 20) : [];
+  } catch {
+    return [];
+  }
+}
+function createBootstrapItem(section, title, status, detail, evidence) {
+  const slug = title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 56);
+  return {
+    id: `${section}:${slug || "candidate"}`,
+    title,
+    status,
+    detail,
+    evidence
+  };
+}
+function buildProjectBootstrap(scan) {
+  const cwd = process.cwd();
+  const exists = (relativePath) => fs.existsSync(path.join(cwd, relativePath));
+  const packageMetadata = readProjectPackageMetadata();
+  const allDetectedFiles = findBoundedProjectFiles(() => true, PROJECT_BOOTSTRAP_MAX_WALKED_FILES);
+  const testFiles = allDetectedFiles.filter(
+    (relativePath) => /(^|\/)(?:__tests__|tests?|spec)(\/|$)|(?:^|\/)[^/]+\.(?:test|spec)\.[^/]+$|(?:^|\/)test_[^/]+\.py$/i.test(
+      relativePath
+    )
+  );
+  const skillFiles = allDetectedFiles.filter(
+    (relativePath) => /(^|\/)SKILL\.md$/i.test(relativePath)
+  );
+  const ciFiles = [
+    ...allDetectedFiles.filter(
+      (relativePath) => /^\.github\/workflows\/[^/]+\.ya?ml$/i.test(relativePath)
+    ),
+    ...[".gitlab-ci.yml", "azure-pipelines.yml", "Jenkinsfile", ".circleci/config.yml"].filter(
+      exists
+    )
+  ].filter((value, index, values) => values.indexOf(value) === index);
+  const instructionSources = scan.files.candidateDocs.filter(
+    (source) => classifyDecisionSource(source) === "agent_instruction"
+  );
+  const documentationSources = [
+    ...["README.md", "CHANGELOG.md", "MEMORY.md"].filter(exists),
+    ...listFilesUnder("docs", 40)
+  ].filter((value, index, values) => values.indexOf(value) === index);
+  const releaseTags = scan.git.detected ? readBootstrapReleaseTags() : [];
+  const gitSubjects = scan.git.detected ? readBootstrapGitSubjects(120) : [];
+  const architecture = [];
+  if (scan.languages.length > 0) {
+    architecture.push(
+      createBootstrapItem(
+        "architecture",
+        `Languages: ${scan.languages.join(", ")}`,
+        "observed",
+        "Detected from root manifests and source extensions.",
+        scan.files.hasPackageJson ? [{ source: "package.json", kind: "manifest" }] : [{ source: ".", kind: "filesystem_scan" }]
+      )
+    );
+  }
+  if (scan.packageManagers.length > 0) {
+    architecture.push(
+      createBootstrapItem(
+        "architecture",
+        `Package manager: ${scan.packageManagers.join(", ")}`,
+        "observed",
+        "Detected from lockfiles.",
+        scan.files.lockfiles.map((source) => ({ source, kind: "lockfile" }))
+      )
+    );
+  }
+  const workspaceEvidence = ["pnpm-workspace.yaml", "turbo.json", "nx.json", "lerna.json"].filter(
+    exists
+  );
+  if (packageMetadata.workspaces || workspaceEvidence.length > 0) {
+    architecture.push(
+      createBootstrapItem(
+        "architecture",
+        "Workspace or monorepo layout",
+        "observed",
+        "A workspace declaration or workspace configuration file is present.",
+        (workspaceEvidence.length > 0 ? workspaceEvidence : ["package.json"]).map((source) => ({
+          source,
+          kind: "config"
+        }))
+      )
+    );
+  }
+  for (const directory of ["apps", "packages", "services", "libs"].filter(exists)) {
+    architecture.push(
+      createBootstrapItem(
+        "architecture",
+        `${directory}/ project boundary`,
+        "observed",
+        "Top-level project organization detected; no architectural meaning was inferred beyond its presence.",
+        [{ source: `${directory}/`, kind: "directory" }]
+      )
+    );
+  }
+  const frameworks = [
+    ["next", "Next.js"],
+    ["react", "React"],
+    ["@nestjs/core", "NestJS"],
+    ["express", "Express"],
+    ["fastify", "Fastify"],
+    ["vitest", "Vitest"],
+    ["jest", "Jest"]
+  ];
+  for (const [dependency, label] of frameworks) {
+    if (packageMetadata.dependencies.includes(dependency)) {
+      architecture.push(
+        createBootstrapItem(
+          "architecture",
+          `${label} dependency`,
+          "observed",
+          `The root manifest declares ${dependency}; its role still needs code-level confirmation.`,
+          [{ source: "package.json", kind: "manifest" }]
+        )
+      );
+    }
+  }
+  if (scan.files.hasDockerfile) {
+    architecture.push(
+      createBootstrapItem(
+        "architecture",
+        "Container build surface",
+        "observed",
+        "A root Dockerfile is present.",
+        [{ source: "Dockerfile", kind: "config" }]
+      )
+    );
+  }
+  const candidates = buildMemoryCandidatePreviews(scan);
+  const conventions = candidates.filter(
+    (candidate) => candidate.evidence === "agent_instruction" || candidate.evidence === "project_document"
+  ).slice(0, 16).map(
+    (candidate) => createBootstrapItem(
+      "conventions",
+      candidate.text.slice(0, 100),
+      "needs_review",
+      candidate.reason,
+      [{ source: candidate.source, kind: candidate.evidence }]
+    )
+  );
+  const decisions = candidates.filter(
+    (candidate) => ["git_commit_subject", "adr_or_decision_doc", "changelog"].includes(candidate.evidence)
+  ).slice(0, 12).map(
+    (candidate) => createBootstrapItem(
+      "decisions",
+      candidate.text.slice(0, 100),
+      "needs_review",
+      candidate.reason,
+      [{ source: candidate.source, kind: candidate.evidence }]
+    )
+  );
+  const procedureScriptPattern = /(^|:)(build|dev|start|lint|test|type-?check|check|verify|deploy|release|migrate|seed|smoke|e2e)(:|$)/i;
+  const procedures = Object.keys(packageMetadata.scripts).filter((name) => procedureScriptPattern.test(name)).slice(0, 20).map(
+    (name) => createBootstrapItem(
+      "procedures",
+      `package script: ${name}`,
+      "observed",
+      "A root package script is configured; its exact command remains in package.json.",
+      [{ source: "package.json", kind: "package_script" }]
+    )
+  );
+  for (const source of ciFiles.slice(0, 8)) {
+    procedures.push(
+      createBootstrapItem(
+        "procedures",
+        `CI workflow: ${path.basename(source)}`,
+        "observed",
+        "Automation configuration detected; individual jobs were not interpreted during the bounded scan.",
+        [{ source, kind: "ci_workflow" }]
+      )
+    );
+  }
+  const skills = skillFiles.slice(0, 12).map(
+    (source) => createBootstrapItem(
+      "skills",
+      `Existing skill: ${path.basename(path.dirname(source)) || "root"}`,
+      "observed",
+      "An explicit SKILL.md workflow was found.",
+      [{ source, kind: "skill_definition" }]
+    )
+  );
+  const verificationScriptNames = Object.keys(packageMetadata.scripts).filter(
+    (name) => /test|lint|type|check|verify|smoke|e2e|build/i.test(name)
+  );
+  if (verificationScriptNames.length >= 2 && skills.length < 12) {
+    skills.push(
+      createBootstrapItem(
+        "skills",
+        "Verification workflow candidate",
+        "needs_review",
+        `Related scripts detected: ${verificationScriptNames.slice(0, 8).join(", ")}. Review their intended order before promoting this to a skill.`,
+        [{ source: "package.json", kind: "package_scripts" }]
+      )
+    );
+  }
+  const failureTerms = [
+    ["rollback or revert", /\b(?:rollback|revert)\b/i],
+    ["hotfix", /\bhotfix\b/i],
+    ["regression", /\bregression\b/i],
+    ["flaky verification", /\b(?:flaky|flakiness)\b/i],
+    ["broken or failing behavior", /\b(?:broken|failing|failure)\b/i]
+  ];
+  const recurringFailures = failureTerms.flatMap(([label, matcher]) => {
+    const matches = gitSubjects.filter((subject) => matcher.test(subject)).slice(0, 6);
+    if (matches.length < 2) {
+      return [];
+    }
+    return [
+      createBootstrapItem(
+        "recurringFailures",
+        `${label} signal (${matches.length} commits)`,
+        "needs_review",
+        "Repeated commit-language is a signal, not proof of a common root cause. Review the linked commits before accepting this anti-pattern.",
+        matches.map((source) => ({ source, kind: "git_commit_subject" }))
+      )
+    ];
+  });
+  const verificationPatterns = verificationScriptNames.slice(0, 16).map(
+    (name) => createBootstrapItem(
+      "verificationPatterns",
+      `Verification script: ${name}`,
+      "observed",
+      "A root verification script is configured; its exact command remains in package.json.",
+      [{ source: "package.json", kind: "package_script" }]
+    )
+  );
+  const testPatternGroups = [
+    ["*.test.*", /\.test\.[^/]+$/i],
+    ["*.spec.*", /\.spec\.[^/]+$/i],
+    ["__tests__/", /(^|\/)__tests__\//i],
+    ["test_*.py", /(^|\/)test_[^/]+\.py$/i]
+  ];
+  for (const [label, matcher] of testPatternGroups) {
+    const matches = testFiles.filter((source) => matcher.test(source));
+    if (matches.length === 0) {
+      continue;
+    }
+    verificationPatterns.push(
+      createBootstrapItem(
+        "verificationPatterns",
+        `Test pattern: ${label}`,
+        "observed",
+        `${matches.length} matching file(s) found in the bounded scan.`,
+        matches.slice(0, 6).map((source) => ({ source, kind: "test_file" }))
+      )
+    );
+  }
+  const sections = {
+    architecture: {
+      title: "Architecture",
+      status: architecture.length > 0 ? "observed" : "deferred",
+      detail: "Manifest, filesystem, dependency, and configuration patterns only.",
+      items: architecture.slice(0, 20)
+    },
+    conventions: {
+      title: "Conventions",
+      status: conventions.length > 0 ? "needs_review" : "deferred",
+      detail: "Guidance-language candidates require human review before durable import.",
+      items: conventions
+    },
+    decisions: {
+      title: "Decisions",
+      status: decisions.length > 0 ? "needs_review" : "deferred",
+      detail: "Commit and decision-document candidates are never auto-approved.",
+      items: decisions
+    },
+    procedures: {
+      title: "Procedures",
+      status: procedures.length > 0 ? "observed" : "deferred",
+      detail: "Configured scripts and CI files; execution order is not inferred.",
+      items: procedures.slice(0, 24)
+    },
+    skills: {
+      title: "Skills",
+      status: skills.some((item) => item.status === "needs_review") ? "needs_review" : skills.length > 0 ? "observed" : "deferred",
+      detail: "Explicit skill definitions plus reviewable workflow candidates.",
+      items: skills
+    },
+    recurringFailures: {
+      title: "Recurring failures",
+      status: recurringFailures.length > 0 ? "needs_review" : "deferred",
+      detail: "Only repeated failure-language signals are shown; no root cause is inferred.",
+      items: recurringFailures
+    },
+    criticalCode: {
+      title: "Critical code",
+      status: "deferred",
+      detail: "Critical symbols require Code Graph indexing; the local bootstrap does not guess them.",
+      items: []
+    },
+    verificationPatterns: {
+      title: "Verification patterns",
+      status: verificationPatterns.length > 0 ? "observed" : "deferred",
+      detail: "Configured checks and test naming patterns from the bounded local scan.",
+      items: verificationPatterns.slice(0, 24)
+    }
+  };
+  const summary = Object.fromEntries(
+    Object.entries(sections).map(([key, section]) => [key, section.items.length])
+  );
+  const coverage = {
+    gitHistory: createBootstrapCoverage(
+      scan.git.detected ? "partial" : "unavailable",
+      scan.git.detected ? "Inspected up to 120 recent commit subjects; commit bodies and diffs were not interpreted." : "No local Git repository was detected.",
+      scan.git.detected ? ["git log"] : []
+    ),
+    pullRequests: createBootstrapCoverage(
+      "unavailable",
+      "Pull request history requires an explicitly connected provider.",
+      []
+    ),
+    issues: createBootstrapCoverage(
+      "unavailable",
+      "Issue history requires an explicitly connected provider.",
+      []
+    ),
+    instructions: createBootstrapCoverage(
+      instructionSources.length > 0 ? "observed" : "unavailable",
+      instructionSources.length > 0 ? "Project instruction files were included in the bounded local scan." : "No AGENTS.md, CLAUDE.md, or Copilot instruction file was found.",
+      instructionSources
+    ),
+    documentation: createBootstrapCoverage(
+      documentationSources.length > 0 ? "partial" : "unavailable",
+      documentationSources.length > 0 ? `Inspected a bounded set of ${documentationSources.length} README, changelog, memory, and docs files.` : "No README, changelog, memory, or docs files were found.",
+      documentationSources
+    ),
+    ci: createBootstrapCoverage(
+      ciFiles.length > 0 ? "observed" : "unavailable",
+      ciFiles.length > 0 ? "CI configuration files were detected." : "No standard CI configuration was found.",
+      ciFiles
+    ),
+    packageScripts: createBootstrapCoverage(
+      Object.keys(packageMetadata.scripts).length > 0 ? "observed" : "unavailable",
+      Object.keys(packageMetadata.scripts).length > 0 ? "Root package scripts were inspected." : "No root package scripts were available.",
+      Object.keys(packageMetadata.scripts).length > 0 ? ["package.json"] : []
+    ),
+    testPatterns: createBootstrapCoverage(
+      testFiles.length > 0 ? "partial" : "unavailable",
+      testFiles.length > 0 ? `Found ${testFiles.length} test-like files within a ${PROJECT_BOOTSTRAP_MAX_WALKED_FILES}-file scan cap.` : `No test-like files were found within the ${PROJECT_BOOTSTRAP_MAX_WALKED_FILES}-file scan cap.`,
+      testFiles.slice(0, 20)
+    ),
+    releaseHistory: createBootstrapCoverage(
+      releaseTags.length > 0 || exists("CHANGELOG.md") ? "partial" : "unavailable",
+      releaseTags.length > 0 || exists("CHANGELOG.md") ? `Detected ${releaseTags.length} recent tag(s)${exists("CHANGELOG.md") ? " and CHANGELOG.md" : ""}.` : "No Git tags or root CHANGELOG.md were detected.",
+      [
+        ...releaseTags.map((tag) => `git tag ${tag}`),
+        ...exists("CHANGELOG.md") ? ["CHANGELOG.md"] : []
+      ]
+    ),
+    codeGraph: createBootstrapCoverage(
+      "deferred",
+      "Critical symbols and structural impact require Code Graph indexing after activation.",
+      []
+    )
+  };
+  return {
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    repoPath: cwd,
+    reviewPrompt: "Review what Snipara learned about your project.",
+    scanLimits: {
+      walkedFiles: PROJECT_BOOTSTRAP_MAX_WALKED_FILES,
+      matchedFilesPerQuery: PROJECT_BOOTSTRAP_MAX_MATCHED_FILES,
+      gitCommitSubjects: 120
+    },
+    summary,
+    coverage,
+    sections
+  };
+}
+function createBootstrapCoverage(status, detail, sources) {
+  return { status, detail, sources };
+}
+function writeProjectBootstrap(report) {
+  fs.mkdirSync(getActivationDir(), { recursive: true });
+  fs.writeFileSync(getProjectBootstrapJsonPath(), JSON.stringify(report, null, 2) + "\n", "utf8");
+  const lines = [
+    "# PROJECT BOOTSTRAP",
+    "",
+    `Generated: ${report.generatedAt}`,
+    `Repository: ${report.repoPath}`,
+    "",
+    "## Coverage",
+    "",
+    ...Object.entries(report.coverage).map(
+      ([name, entry]) => `- ${name}: ${entry.status} \u2014 ${entry.detail}`
+    ),
+    "",
+    ...Object.values(report.sections).flatMap((section) => [
+      `## ${section.title} \u2014 ${section.items.length}`,
+      "",
+      section.detail,
+      "",
+      ...section.items.length > 0 ? section.items.flatMap((item) => [
+        `- [${item.status}] ${item.title}`,
+        `  ${item.detail}`,
+        ...item.evidence.length > 0 ? [
+          `  Evidence: ${item.evidence.map((entry) => entry.source).join(", ")}`
+        ] : []
+      ]) : ["- No evidence-backed item available yet."],
+      ""
+    ]),
+    `**${report.reviewPrompt}**`,
+    ""
+  ];
+  fs.writeFileSync(getProjectBootstrapMarkdownPath(), lines.join("\n"), "utf8");
+}
+function addProjectBootstrapToFirstWorkBrief(manifest, report) {
+  manifest.firstBrief.sections.splice(1, 0, {
+    title: "Project Bootstrap",
+    lines: [
+      `Architecture: ${report.summary.architecture} pattern(s).`,
+      `Conventions: ${report.summary.conventions} candidate(s).`,
+      `Decisions: ${report.summary.decisions} inferred candidate(s).`,
+      `Procedures: ${report.summary.procedures} observed workflow(s).`,
+      `Skills: ${report.summary.skills} existing or candidate workflow(s).`,
+      `Recurring failures: ${report.summary.recurringFailures} review candidate(s).`,
+      `Critical code: ${report.summary.criticalCode}; deferred until Code Graph indexes symbols.`,
+      `Verification patterns: ${report.summary.verificationPatterns} observed pattern(s).`,
+      report.reviewPrompt
+    ]
+  });
 }
 function createInitialFirstWorkBrief(answers, detection, scan) {
   const surfaceContract = buildActivationSurfaceContract(answers.aiClient);
@@ -651,8 +1194,6 @@ function createActivationManifest(answers, detection, mode = "default", scan) {
   const dayZeroQuery = "What is this project, what is currently in flight, and what should an agent know before making the first edit?";
   const surfaceContract = buildActivationSurfaceContract(answers.aiClient);
   return {
-    version: "create-snipara-activation-v1",
-    schemaVersion: ACTIVATION_MANIFEST_SCHEMA_VERSION,
     activationId: buildActivationId(),
     mode,
     surfaceContract,
@@ -706,6 +1247,10 @@ function createActivationManifest(answers, detection, mode = "default", scan) {
         hasCompanion ? "queued" : "skipped",
         hasCompanion ? "Free Code Graph indexing starts from local source overlay within capacity caps." : "Free Code Graph is available after companion or hosted provider sync."
       ),
+      projectBootstrap: createActivationLane(
+        "queued",
+        "Bounded local cold-start analysis will prepare an evidence-linked Project Bootstrap."
+      ),
       memoryCandidates: createActivationLane(
         hasCompanion ? "needs_review" : "skipped",
         hasCompanion ? "Candidate decisions stay pending review; no durable memory is auto-approved." : "Install companion later to extract reviewable memory candidates."
@@ -728,7 +1273,9 @@ function createActivationManifest(answers, detection, mode = "default", scan) {
       legacyManifestPath: path.relative(process.cwd(), getActivationManifestPath()),
       firstBriefPath: null,
       handoffPath: null,
-      memoryCandidatesPath: null
+      memoryCandidatesPath: null,
+      projectBootstrapJsonPath: null,
+      projectBootstrapMarkdownPath: null
     },
     nextActions: buildActivationNextActions(surfaceContract, answers),
     firstBrief: createInitialFirstWorkBrief(answers, detection, localScan),
@@ -918,6 +1465,22 @@ async function runHostedDayZeroCorpusSync(answers, manifest, enabled) {
   updateActivationManifest(manifest);
 }
 function createActivationArtifacts(answers, manifest) {
+  const projectBootstrap = buildProjectBootstrap(manifest.localScan);
+  writeProjectBootstrap(projectBootstrap);
+  manifest.artifacts.projectBootstrapJsonPath = path.relative(
+    process.cwd(),
+    getProjectBootstrapJsonPath()
+  );
+  manifest.artifacts.projectBootstrapMarkdownPath = path.relative(
+    process.cwd(),
+    getProjectBootstrapMarkdownPath()
+  );
+  manifest.lanes.projectBootstrap = createActivationLane(
+    "needs_review",
+    "Evidence-linked Project Bootstrap generated; inferred candidates require review.",
+    manifest.artifacts.projectBootstrapMarkdownPath
+  );
+  addProjectBootstrapToFirstWorkBrief(manifest, projectBootstrap);
   const candidates = buildMemoryCandidatePreviews(manifest.localScan);
   writeMemoryCandidates(candidates);
   manifest.artifacts.memoryCandidatesPath = path.relative(process.cwd(), getMemoryCandidatesPath());
@@ -1258,8 +1821,6 @@ function buildActivationJsonSummary(manifest, validation) {
     ok: true,
     activationStatus,
     activationId: manifest.activationId,
-    schemaVersion: manifest.schemaVersion,
-    consumerContractVersion: manifest.consumerContract.version,
     projectSlug: manifest.projectSlug,
     aiClient: manifest.aiClient,
     profile: validation.profile,
@@ -3524,22 +4085,24 @@ function buildActivationSurfaceContract(client) {
 function buildEditorActivationConsumerContract(client) {
   const secretRule = client === "vscode" ? "Use VS Code SecretStorage for SNIPARA_API_KEY and pass it to create-snipara through the child-process environment; never write raw secrets into extension settings or logs." : "Pass SNIPARA_API_KEY through the process environment or client secret store; never parse, log, or persist raw secrets from terminal output.";
   return {
-    version: ACTIVATION_CONSUMER_CONTRACT_VERSION,
     audience: "editor_extension",
     stableFiles: {
       activationManifest: ".snipara/activation/activation-manifest.json",
       firstBrief: ".snipara/activation/first-brief.md",
       handoff: ".snipara/activation/handoff.md",
-      memoryCandidates: ".snipara/activation/memory-candidates.json"
+      memoryCandidates: ".snipara/activation/memory-candidates.json",
+      projectBootstrapJson: ".snipara/activation/project-bootstrap.json",
+      projectBootstrapMarkdown: ".snipara/activation/project-bootstrap.md"
     },
     requiredManifestFields: [
-      "schemaVersion",
-      "consumerContract.version",
       "surfaceContract",
       "artifacts.activationManifestPath",
       "artifacts.firstBriefPath",
       "artifacts.handoffPath",
+      "artifacts.projectBootstrapJsonPath",
+      "artifacts.projectBootstrapMarkdownPath",
       "lanes.connection.status",
+      "lanes.projectBootstrap.status",
       "lanes.firstBrief.status",
       "nextActions"
     ],

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "create-snipara",
-  "version": "2.0.15",
-  "description": "Onboard Snipara Hosted MCP Context + Memory with auth, companion workflows, and optional Snipara Sandbox",
+  "version": "2.0.17",
+  "description": "Onboard Snipara Hosted MCP Context + Memory with project bootstrap intelligence and optional local workflows",
   "main": "dist/index.js",
   "type": "module",
   "bin": {