devworkspace 0.0.0-stage → 0.1.0

package/dist/integrations/omniroute.js

@@ -0,0 +1,24 @@
+/**
+ * OmniRoute (model routing) is OPTIONAL and outside the V1 execution path.
+ * This adapter only reports whether an `omniroute` executable exists so a future provider
+ * boundary has somewhere to plug in. Nothing in DevWorkspace requires it, API keys, or model configuration.
+ */
+export const omniroute = {
+    id: 'omniroute',
+    name: 'OmniRoute',
+    optional: true,
+    usage: 'Not used by DevWorkspace V1.',
+    async detect(ctx) {
+        const exe = await ctx.which('omniroute');
+        return {
+            id: 'omniroute',
+            name: 'OmniRoute',
+            optional: true,
+            state: exe ? 'PARTIAL' : 'NOT_DETECTED',
+            details: exe ? ['executable found; not used by V1'] : ['optional; not required'],
+            remediation: [],
+            docsUrl: 'https://github.com/diegosouzapw/OmniRoute',
+        };
+    },
+};
+//# sourceMappingURL=omniroute.js.map

package/dist/integrations/omniroute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"omniroute.js","sourceRoot":"","sources":["../../src/integrations/omniroute.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAgB;IACpC,EAAE,EAAE,WAAW;IACf,IAAI,EAAE,WAAW;IACjB,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,8BAA8B;IACrC,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,WAAW;YACf,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc;YACvC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC;YAChF,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,2CAA2C;SACrD,CAAC;IACJ,CAAC;CACF,CAAC","sourcesContent":["import type { Integration, IntegrationStatus } from './types.js';\n\n/**\n * OmniRoute (model routing) is OPTIONAL and outside the V1 execution path.\n * This adapter only reports whether an `omniroute` executable exists so a future provider\n * boundary has somewhere to plug in. Nothing in DevWorkspace requires it, API keys, or model configuration.\n */\nexport const omniroute: Integration = {\n  id: 'omniroute',\n  name: 'OmniRoute',\n  optional: true,\n  usage: 'Not used by DevWorkspace V1.',\n  async detect(ctx): Promise<IntegrationStatus> {\n    const exe = await ctx.which('omniroute');\n    return {\n      id: 'omniroute',\n      name: 'OmniRoute',\n      optional: true,\n      state: exe ? 'PARTIAL' : 'NOT_DETECTED',\n      details: exe ? ['executable found; not used by V1'] : ['optional; not required'],\n      remediation: [],\n      docsUrl: 'https://github.com/diegosouzapw/OmniRoute',\n    };\n  },\n};\n"]}

package/dist/integrations/ponytail.d.ts

@@ -0,0 +1,10 @@
+import type { Integration } from './types.js';
+/**
+ * Ponytail is a code-quality/simplification skill. Documented install for Claude Code:
+ *   /plugin marketplace add DietrichGebert/ponytail
+ *   /plugin install ponytail@ponytail
+ * Commands: /ponytail [lite|full|ultra|off], /ponytail-review, /ponytail-audit, /ponytail-debt.
+ * Other agents: copy AGENTS.md or install skills/ponytail/SKILL.md. Optional config: ~/.config/ponytail/config.json.
+ * Ponytail assists quality review; it is never a substitute for tests.
+ */
+export declare const ponytail: Integration;

package/dist/integrations/ponytail.js

@@ -0,0 +1,58 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { claudeConfigMentions, skillDirExists } from './probe.js';
+import { pathExists } from '../utils/fs.js';
+const DOCS = 'https://github.com/DietrichGebert/ponytail';
+/**
+ * Ponytail is a code-quality/simplification skill. Documented install for Claude Code:
+ *   /plugin marketplace add DietrichGebert/ponytail
+ *   /plugin install ponytail@ponytail
+ * Commands: /ponytail [lite|full|ultra|off], /ponytail-review, /ponytail-audit, /ponytail-debt.
+ * Other agents: copy AGENTS.md or install skills/ponytail/SKILL.md. Optional config: ~/.config/ponytail/config.json.
+ * Ponytail assists quality review; it is never a substitute for tests.
+ */
+export const ponytail = {
+    id: 'ponytail',
+    name: 'Ponytail',
+    optional: false,
+    usage: 'Use /ponytail-review on the diff of meaningful changes (features, refactors, security work) to catch unnecessary complexity and debt; ' +
+        'use /ponytail-audit only when the user asks for a repository-wide quality pass. Quality review never replaces running tests.',
+    async detect(ctx) {
+        const details = [];
+        const plugin = await claudeConfigMentions(ctx, 'ponytail');
+        const skill = await skillDirExists(ctx, 'ponytail');
+        if (plugin)
+            details.push(`referenced in Claude Code config (${plugin})`);
+        if (skill)
+            details.push(`skill installed (${skill})`);
+        let agentsMention = false;
+        try {
+            agentsMention = (await fs.readFile(path.join(ctx.root, 'AGENTS.md'), 'utf8')).toLowerCase().includes('ponytail');
+        }
+        catch {
+            /* no AGENTS.md */
+        }
+        if (agentsMention)
+            details.push('AGENTS.md references Ponytail');
+        const userCfg = path.join(ctx.home, '.config', 'ponytail', 'config.json');
+        if (await pathExists(userCfg))
+            details.push('user config present (~/.config/ponytail/config.json)');
+        const found = plugin || skill || agentsMention;
+        return {
+            id: 'ponytail',
+            name: 'Ponytail',
+            optional: false,
+            state: found ? 'READY' : 'UNVERIFIED',
+            details: found ? details : ['not found in Claude Code settings or project skills; plugin state is held by Claude Code so this check is best-effort'],
+            remediation: found
+                ? []
+                : [
+                    'In Claude Code run: /plugin marketplace add DietrichGebert/ponytail',
+                    'Then: /plugin install ponytail@ponytail',
+                    'Other agents: copy Ponytail\'s AGENTS.md into the project (see its INSTALL.md).',
+                ],
+            docsUrl: DOCS,
+        };
+    },
+};
+//# sourceMappingURL=ponytail.js.map

package/dist/integrations/ponytail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ponytail.js","sourceRoot":"","sources":["../../src/integrations/ponytail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,MAAM,IAAI,GAAG,4CAA4C,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAgB;IACnC,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,KAAK;IACf,KAAK,EACH,wIAAwI;QACxI,8HAA8H;IAChI,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACpD,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,qCAAqC,MAAM,GAAG,CAAC,CAAC;QACzE,IAAI,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,KAAK,GAAG,CAAC,CAAC;QACtD,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC;YACH,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACnH,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;QACD,IAAI,aAAa;YAAE,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;QAC1E,IAAI,MAAM,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QAEpG,MAAM,KAAK,GAAG,MAAM,IAAI,KAAK,IAAI,aAAa,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,UAAU;YACd,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY;YACrC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,uHAAuH,CAAC;YACpJ,WAAW,EAAE,KAAK;gBAChB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,qEAAqE;oBACrE,yCAAyC;oBACzC,iFAAiF;iBAClF;YACL,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;CACF,CAAC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport path from 'node:path';\nimport type { Integration, IntegrationStatus } from './types.js';\nimport { claudeConfigMentions, skillDirExists } from './probe.js';\nimport { pathExists } from '../utils/fs.js';\n\nconst DOCS = 'https://github.com/DietrichGebert/ponytail';\n\n/**\n * Ponytail is a code-quality/simplification skill. Documented install for Claude Code:\n *   /plugin marketplace add DietrichGebert/ponytail\n *   /plugin install ponytail@ponytail\n * Commands: /ponytail [lite|full|ultra|off], /ponytail-review, /ponytail-audit, /ponytail-debt.\n * Other agents: copy AGENTS.md or install skills/ponytail/SKILL.md. Optional config: ~/.config/ponytail/config.json.\n * Ponytail assists quality review; it is never a substitute for tests.\n */\nexport const ponytail: Integration = {\n  id: 'ponytail',\n  name: 'Ponytail',\n  optional: false,\n  usage:\n    'Use /ponytail-review on the diff of meaningful changes (features, refactors, security work) to catch unnecessary complexity and debt; ' +\n    'use /ponytail-audit only when the user asks for a repository-wide quality pass. Quality review never replaces running tests.',\n  async detect(ctx): Promise<IntegrationStatus> {\n    const details: string[] = [];\n    const plugin = await claudeConfigMentions(ctx, 'ponytail');\n    const skill = await skillDirExists(ctx, 'ponytail');\n    if (plugin) details.push(`referenced in Claude Code config (${plugin})`);\n    if (skill) details.push(`skill installed (${skill})`);\n    let agentsMention = false;\n    try {\n      agentsMention = (await fs.readFile(path.join(ctx.root, 'AGENTS.md'), 'utf8')).toLowerCase().includes('ponytail');\n    } catch {\n      /* no AGENTS.md */\n    }\n    if (agentsMention) details.push('AGENTS.md references Ponytail');\n    const userCfg = path.join(ctx.home, '.config', 'ponytail', 'config.json');\n    if (await pathExists(userCfg)) details.push('user config present (~/.config/ponytail/config.json)');\n\n    const found = plugin || skill || agentsMention;\n    return {\n      id: 'ponytail',\n      name: 'Ponytail',\n      optional: false,\n      state: found ? 'READY' : 'UNVERIFIED',\n      details: found ? details : ['not found in Claude Code settings or project skills; plugin state is held by Claude Code so this check is best-effort'],\n      remediation: found\n        ? []\n        : [\n            'In Claude Code run: /plugin marketplace add DietrichGebert/ponytail',\n            'Then: /plugin install ponytail@ponytail',\n            'Other agents: copy Ponytail\\'s AGENTS.md into the project (see its INSTALL.md).',\n          ],\n      docsUrl: DOCS,\n    };\n  },\n};\n"]}

package/dist/integrations/probe.d.ts

@@ -0,0 +1,6 @@
+import type { IntegrationContext } from './types.js';
+/** Candidate Claude Code settings/plugin registries, project first then user. Read-only and best effort. */
+export declare function claudeConfigFiles(ctx: IntegrationContext): string[];
+/** True if any Claude Code config file mentions the needle (case-insensitive). Plugin install state belongs to Claude Code, so this can only suggest, never prove. */
+export declare function claudeConfigMentions(ctx: IntegrationContext, needle: string): Promise<string | null>;
+export declare function skillDirExists(ctx: IntegrationContext, name: string): Promise<string | null>;

package/dist/integrations/probe.js

@@ -0,0 +1,41 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { pathExists } from '../utils/fs.js';
+/** Candidate Claude Code settings/plugin registries, project first then user. Read-only and best effort. */
+export function claudeConfigFiles(ctx) {
+    return [
+        path.join(ctx.root, '.claude', 'settings.json'),
+        path.join(ctx.root, '.claude', 'settings.local.json'),
+        path.join(ctx.home, '.claude', 'settings.json'),
+        path.join(ctx.home, '.claude', 'plugins', 'installed_plugins.json'),
+        path.join(ctx.home, '.claude', 'plugins', 'known_marketplaces.json'),
+    ];
+}
+/** True if any Claude Code config file mentions the needle (case-insensitive). Plugin install state belongs to Claude Code, so this can only suggest, never prove. */
+export async function claudeConfigMentions(ctx, needle) {
+    const n = needle.toLowerCase();
+    for (const file of claudeConfigFiles(ctx)) {
+        try {
+            const st = await fs.stat(file);
+            if (!st.isFile() || st.size > 2 * 1024 * 1024)
+                continue;
+            if ((await fs.readFile(file, 'utf8')).toLowerCase().includes(n)) {
+                return file.startsWith(ctx.root) ? path.relative(ctx.root, file).replace(/\\/g, '/') : '~/' + path.relative(ctx.home, file).replace(/\\/g, '/');
+            }
+        }
+        catch {
+            /* missing or unreadable */
+        }
+    }
+    return null;
+}
+export async function skillDirExists(ctx, name) {
+    const project = path.join(ctx.root, '.claude', 'skills', name);
+    if (await pathExists(project))
+        return `.claude/skills/${name}`;
+    const user = path.join(ctx.home, '.claude', 'skills', name);
+    if (await pathExists(user))
+        return `~/.claude/skills/${name}`;
+    return null;
+}
+//# sourceMappingURL=probe.js.map

package/dist/integrations/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../src/integrations/probe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG5C,4GAA4G;AAC5G,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACvD,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,wBAAwB,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,yBAAyB,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,sKAAsK;AACtK,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAuB,EAAE,MAAc;IAChF,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;gBAAE,SAAS;YACxD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAClJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAuB,EAAE,IAAY;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,MAAM,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,kBAAkB,IAAI,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,oBAAoB,IAAI,EAAE,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport path from 'node:path';\nimport { pathExists } from '../utils/fs.js';\nimport type { IntegrationContext } from './types.js';\n\n/** Candidate Claude Code settings/plugin registries, project first then user. Read-only and best effort. */\nexport function claudeConfigFiles(ctx: IntegrationContext): string[] {\n  return [\n    path.join(ctx.root, '.claude', 'settings.json'),\n    path.join(ctx.root, '.claude', 'settings.local.json'),\n    path.join(ctx.home, '.claude', 'settings.json'),\n    path.join(ctx.home, '.claude', 'plugins', 'installed_plugins.json'),\n    path.join(ctx.home, '.claude', 'plugins', 'known_marketplaces.json'),\n  ];\n}\n\n/** True if any Claude Code config file mentions the needle (case-insensitive). Plugin install state belongs to Claude Code, so this can only suggest, never prove. */\nexport async function claudeConfigMentions(ctx: IntegrationContext, needle: string): Promise<string | null> {\n  const n = needle.toLowerCase();\n  for (const file of claudeConfigFiles(ctx)) {\n    try {\n      const st = await fs.stat(file);\n      if (!st.isFile() || st.size > 2 * 1024 * 1024) continue;\n      if ((await fs.readFile(file, 'utf8')).toLowerCase().includes(n)) {\n        return file.startsWith(ctx.root) ? path.relative(ctx.root, file).replace(/\\\\/g, '/') : '~/' + path.relative(ctx.home, file).replace(/\\\\/g, '/');\n      }\n    } catch {\n      /* missing or unreadable */\n    }\n  }\n  return null;\n}\n\nexport async function skillDirExists(ctx: IntegrationContext, name: string): Promise<string | null> {\n  const project = path.join(ctx.root, '.claude', 'skills', name);\n  if (await pathExists(project)) return `.claude/skills/${name}`;\n  const user = path.join(ctx.home, '.claude', 'skills', name);\n  if (await pathExists(user)) return `~/.claude/skills/${name}`;\n  return null;\n}\n"]}

package/dist/integrations/types.d.ts

@@ -0,0 +1,25 @@
+export type IntegrationState = 'READY' | 'PARTIAL' | 'NOT_DETECTED' | 'UNVERIFIED' | 'ERROR';
+export interface IntegrationStatus {
+    id: string;
+    name: string;
+    optional: boolean;
+    state: IntegrationState;
+    details: string[];
+    remediation: string[];
+    docsUrl: string;
+}
+export interface IntegrationContext {
+    root: string;
+    home: string;
+    env: NodeJS.ProcessEnv;
+    which(name: string): Promise<string | null>;
+}
+/** Adapter boundary: core code only ever sees IntegrationStatus, never tool internals. */
+export interface Integration {
+    id: string;
+    name: string;
+    optional: boolean;
+    /** Short text embedded in generated agent instructions describing how the agent should use the tool. */
+    usage: string;
+    detect(ctx: IntegrationContext): Promise<IntegrationStatus>;
+}

package/dist/integrations/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/integrations/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/integrations/types.ts"],"names":[],"mappings":"","sourcesContent":["export type IntegrationState = 'READY' | 'PARTIAL' | 'NOT_DETECTED' | 'UNVERIFIED' | 'ERROR';\n\nexport interface IntegrationStatus {\n  id: string;\n  name: string;\n  optional: boolean;\n  state: IntegrationState;\n  details: string[];\n  remediation: string[];\n  docsUrl: string;\n}\n\nexport interface IntegrationContext {\n  root: string;\n  home: string;\n  env: NodeJS.ProcessEnv;\n  which(name: string): Promise<string | null>;\n}\n\n/** Adapter boundary: core code only ever sees IntegrationStatus, never tool internals. */\nexport interface Integration {\n  id: string;\n  name: string;\n  optional: boolean;\n  /** Short text embedded in generated agent instructions describing how the agent should use the tool. */\n  usage: string;\n  detect(ctx: IntegrationContext): Promise<IntegrationStatus>;\n}\n"]}

package/dist/knowledge/facts.d.ts

@@ -0,0 +1,43 @@
+import { type Confidence, type Fact, type FactsFile, type FactStatus, type SourceType } from '../config/schemas.js';
+import type { Ws } from '../core/workspace.js';
+export interface FactInput {
+    key: string;
+    value: string;
+    source: string;
+    sourceType: SourceType;
+    sources?: string[];
+    confidence: Confidence;
+    status?: FactStatus;
+}
+export declare const MISSING_HASH = "MISSING";
+export declare function emptyFacts(): FactsFile;
+export declare function loadFacts(ws: Ws): Promise<FactsFile>;
+export declare function saveFacts(ws: Ws, file: FactsFile): Promise<void>;
+/**
+ * Authority rank. Mirrors the hierarchy: user decisions > current repository evidence >
+ * verified facts > AI-derived findings > stale/unknown. Lower-ranked input never silently replaces a higher-ranked fact.
+ */
+export declare function authorityRank(f: Pick<Fact, 'status' | 'sourceType'>): number;
+export declare function factId(key: string): string;
+export declare function hashSources(root: string, sources: string[], cache?: Map<string, string>): Promise<Record<string, string>>;
+export declare function buildFact(root: string, input: FactInput, now: string, existing?: Fact): Promise<Fact>;
+export type UpsertAction = 'created' | 'updated' | 'unchanged';
+export declare function upsertFact(file: FactsFile, fact: Fact): UpsertAction;
+export interface StalenessReport {
+    checked: number;
+    newlyStale: {
+        key: string;
+        reason: string;
+    }[];
+    alreadyStale: string[];
+    /** User decisions whose sources changed. They are never auto-staled; a human should review them. */
+    needsReview: {
+        key: string;
+        reason: string;
+    }[];
+}
+/** Compare stored source hashes with the repository now. Mutates facts that became stale. */
+export declare function applyStaleness(root: string, file: FactsFile, now: string): Promise<StalenessReport>;
+/** Re-hash a fact's sources and mark it verified (called after the agent re-checks it against the repository). */
+export declare function verifyFact(root: string, file: FactsFile, key: string, now: string): Promise<Fact>;
+export declare function removeFact(file: FactsFile, key: string): boolean;

package/dist/knowledge/facts.js

@@ -0,0 +1,195 @@
+import { promises as fs } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { DevWorkspaceError } from '../errors/index.js';
+import { SCHEMA_VERSION, validateFacts, } from '../config/schemas.js';
+import { pathExists, sha256File } from '../utils/fs.js';
+import { findAbsolutePaths, resolveInside, validateRelativePath } from '../utils/paths.js';
+import { containsSecret } from '../security/redact.js';
+import { isSensitiveFile } from '../security/files.js';
+import { readVersioned, writeVersioned } from '../core/versioned.js';
+export const MISSING_HASH = 'MISSING';
+export function emptyFacts() {
+    return { schemaVersion: SCHEMA_VERSION, facts: [] };
+}
+export async function loadFacts(ws) {
+    if (!(await pathExists(ws.facts)))
+        return emptyFacts();
+    return (await readVersioned(ws.facts, 'facts', SCHEMA_VERSION, validateFacts)).data;
+}
+export async function saveFacts(ws, file) {
+    validateFacts(file);
+    await writeVersioned(ws, ws.facts, file);
+}
+/**
+ * Authority rank. Mirrors the hierarchy: user decisions > current repository evidence >
+ * verified facts > AI-derived findings > stale/unknown. Lower-ranked input never silently replaces a higher-ranked fact.
+ */
+export function authorityRank(f) {
+    if (f.status === 'USER_DECISION')
+        return 5;
+    if (f.status === 'DETECTED' && f.sourceType !== 'ai')
+        return 4;
+    if (f.status === 'VERIFIED')
+        return f.sourceType === 'ai' ? 3 : 4;
+    if (f.status === 'INFERRED')
+        return 2;
+    return 1;
+}
+function defaultStatus(t) {
+    if (t === 'user')
+        return 'USER_DECISION';
+    if (t === 'ai')
+        return 'INFERRED';
+    return 'DETECTED';
+}
+export function factId(key) {
+    return 'f-' + createHash('sha256').update(key).digest('hex').slice(0, 10);
+}
+export async function hashSources(root, sources, cache = new Map()) {
+    const out = {};
+    for (const s of sources) {
+        let h = cache.get(s);
+        if (h === undefined) {
+            const full = resolveInside(root, s);
+            try {
+                const st = await fs.lstat(full);
+                h = st.isFile() ? await sha256File(full) : MISSING_HASH;
+            }
+            catch {
+                h = MISSING_HASH;
+            }
+            cache.set(s, h);
+        }
+        out[s] = h;
+    }
+    return out;
+}
+const KEY_RE = /^[a-z0-9][a-z0-9._-]{0,99}$/;
+export async function buildFact(root, input, now, existing) {
+    if (!KEY_RE.test(input.key)) {
+        throw new DevWorkspaceError('USAGE', `Invalid fact key "${input.key}".`, {
+            hint: 'Use lowercase letters, digits, dots, dashes (e.g. "auth.session-store").',
+        });
+    }
+    if (input.value.trim() === '')
+        throw new DevWorkspaceError('USAGE', 'Fact value must not be empty.');
+    if (input.value.length > 4000)
+        throw new DevWorkspaceError('USAGE', 'Fact value is too long (max 4000 characters).', { hint: 'Store a concise summary; link to the source file instead.' });
+    if (containsSecret(input.value) || containsSecret(input.source)) {
+        throw new DevWorkspaceError('SECURITY', 'Fact looks like it contains a secret; refusing to store it.', {
+            hint: 'Describe where the secret is configured, never its value.',
+        });
+    }
+    const abs = findAbsolutePaths(input.value);
+    if (abs.length > 0) {
+        throw new DevWorkspaceError('UNSAFE_PATH', `Fact value contains a machine-specific absolute path (${abs[0]}).`, {
+            hint: 'Use project-relative paths so knowledge stays portable.',
+        });
+    }
+    const sources = [...new Set(input.sources ?? [])];
+    for (const s of sources) {
+        const err = validateRelativePath(s);
+        if (err)
+            throw new DevWorkspaceError('UNSAFE_PATH', `Invalid fact source "${s}" (${err}).`);
+        if (isSensitiveFile(s))
+            throw new DevWorkspaceError('SECURITY', `Fact source "${s}" is a sensitive file.`);
+    }
+    const status = input.status ?? defaultStatus(input.sourceType);
+    const hashes = await hashSources(root, sources);
+    const missing = sources.filter((s) => hashes[s] === MISSING_HASH);
+    if (missing.length > 0 && input.sourceType !== 'user') {
+        throw new DevWorkspaceError('NOT_FOUND', `Fact source file(s) not found: ${missing.join(', ')}`, {
+            hint: 'Cite files that exist in the repository.',
+        });
+    }
+    return {
+        id: factId(input.key),
+        key: input.key,
+        value: input.value.trim(),
+        source: input.source,
+        sourceType: input.sourceType,
+        sources,
+        sourceHashes: hashes,
+        confidence: input.confidence,
+        status,
+        createdAt: existing?.createdAt ?? now,
+        updatedAt: now,
+        lastVerifiedAt: status === 'VERIFIED' || status === 'DETECTED' || status === 'USER_DECISION' ? now : null,
+    };
+}
+export function upsertFact(file, fact) {
+    const i = file.facts.findIndex((f) => f.key === fact.key);
+    if (i === -1) {
+        file.facts.push(fact);
+        return 'created';
+    }
+    const existing = file.facts[i];
+    if (existing.status !== 'STALE' && authorityRank(fact) < authorityRank(existing)) {
+        throw new DevWorkspaceError('CONFLICT', `Fact "${fact.key}" is held at higher authority (${existing.status}); refusing to overwrite it.`, {
+            hint: 'Ask the user to confirm the change, then record it as a user decision.',
+        });
+    }
+    fact.createdAt = existing.createdAt;
+    const same = existing.value === fact.value &&
+        existing.status === fact.status &&
+        existing.confidence === fact.confidence &&
+        JSON.stringify(existing.sourceHashes) === JSON.stringify(fact.sourceHashes);
+    // Leave an identical fact byte-for-byte alone so repeated analysis never churns version control.
+    if (same)
+        return 'unchanged';
+    file.facts[i] = fact;
+    return 'updated';
+}
+/** Compare stored source hashes with the repository now. Mutates facts that became stale. */
+export async function applyStaleness(root, file, now) {
+    const cache = new Map();
+    const report = { checked: 0, newlyStale: [], alreadyStale: [], needsReview: [] };
+    for (const f of file.facts) {
+        if (f.status === 'STALE') {
+            report.alreadyStale.push(f.key);
+            continue;
+        }
+        if (f.sources.length === 0)
+            continue;
+        report.checked++;
+        const current = await hashSources(root, f.sources, cache);
+        const changed = f.sources.filter((s) => current[s] !== f.sourceHashes[s]);
+        if (changed.length === 0)
+            continue;
+        const reason = changed.map((s) => `${s} ${current[s] === MISSING_HASH ? 'removed' : 'changed'}`).join('; ');
+        if (f.status === 'USER_DECISION') {
+            report.needsReview.push({ key: f.key, reason });
+            continue;
+        }
+        f.status = 'STALE';
+        f.staleReason = reason;
+        f.updatedAt = now;
+        report.newlyStale.push({ key: f.key, reason });
+    }
+    return report;
+}
+/** Re-hash a fact's sources and mark it verified (called after the agent re-checks it against the repository). */
+export async function verifyFact(root, file, key, now) {
+    const f = file.facts.find((x) => x.key === key);
+    if (!f)
+        throw new DevWorkspaceError('NOT_FOUND', `No fact with key "${key}".`);
+    f.sourceHashes = await hashSources(root, f.sources);
+    const gone = f.sources.filter((s) => f.sourceHashes[s] === MISSING_HASH);
+    if (gone.length > 0) {
+        throw new DevWorkspaceError('NOT_FOUND', `Cannot verify "${key}": source(s) missing: ${gone.join(', ')}`, {
+            hint: 'Update the fact with new sources or remove it.',
+        });
+    }
+    if (f.status !== 'USER_DECISION')
+        f.status = f.sourceType === 'detector' ? 'DETECTED' : 'VERIFIED';
+    delete f.staleReason;
+    f.lastVerifiedAt = now;
+    f.updatedAt = now;
+    return f;
+}
+export function removeFact(file, key) {
+    const n = file.facts.length;
+    file.facts = file.facts.filter((f) => f.key !== key);
+    return file.facts.length !== n;
+}
+//# sourceMappingURL=facts.js.map

package/dist/knowledge/facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"facts.js","sourceRoot":"","sources":["../../src/knowledge/facts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,cAAc,EACd,aAAa,GAMd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAarE,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC;AAEtC,MAAM,UAAU,UAAU;IACxB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAM;IACpC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,UAAU,EAAE,CAAC;IACvD,OAAO,CAAC,MAAM,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,IAAe;IACrD,aAAa,CAAC,IAAI,CAAC,CAAC;IACpB,MAAM,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,CAAsC;IAClE,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAC/D,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC;IACtC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,CAAa;IAClC,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAClC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,OAAO,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,OAAiB,EAAE,QAA6B,IAAI,GAAG,EAAE;IACvG,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChC,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,CAAC,GAAG,YAAY,CAAC;YACnB,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,MAAM,GAAG,6BAA6B,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,KAAgB,EAAE,GAAW,EAAE,QAAe;IAC1F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,KAAK,CAAC,GAAG,IAAI,EAAE;YACvE,IAAI,EAAE,0EAA0E;SACjF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC;IACrG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,+CAA+C,EAAE,EAAE,IAAI,EAAE,2DAA2D,EAAE,CAAC,CAAC;IAC5L,IAAI,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,6DAA6D,EAAE;YACrG,IAAI,EAAE,2DAA2D;SAClE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,yDAAyD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;YAC9G,IAAI,EAAE,yDAAyD;SAChE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,GAAG;YAAE,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,wBAAwB,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QAC5F,IAAI,eAAe,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QACtD,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YAC/F,IAAI,EAAE,0CAA0C;SACjD,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO;QACP,YAAY,EAAE,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM;QACN,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;QACrC,SAAS,EAAE,GAAG;QACd,cAAc,EAAE,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;KAC1G,CAAC;AACJ,CAAC;AAID,MAAM,UAAU,UAAU,CAAC,IAAe,EAAE,IAAU;IACpD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACb,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;IAChC,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,SAAS,IAAI,CAAC,GAAG,kCAAkC,QAAQ,CAAC,MAAM,8BAA8B,EAAE;YACxI,IAAI,EAAE,wEAAwE;SAC/E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACpC,MAAM,IAAI,GACR,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;QAC7B,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAC/B,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;QACvC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9E,iGAAiG;IACjG,IAAI,IAAI;QAAE,OAAO,WAAW,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,CAAC;AACnB,CAAC;AAUD,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,IAAe,EAAE,GAAW;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,MAAM,GAAoB,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACrC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5G,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACjC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC;QACnB,CAAC,CAAC,WAAW,GAAG,MAAM,CAAC;QACvB,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;QAClB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,IAAe,EAAE,GAAW,EAAE,GAAW;IACtF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC/E,CAAC,CAAC,YAAY,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC;IACzE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,kBAAkB,GAAG,yBAAyB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACxG,IAAI,EAAE,gDAAgD;SACvD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe;QAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;IACnG,OAAO,CAAC,CAAC,WAAW,CAAC;IACrB,CAAC,CAAC,cAAc,GAAG,GAAG,CAAC;IACvB,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;IAClB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAe,EAAE,GAAW;IACrD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC5B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;AACjC,CAAC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport { createHash } from 'node:crypto';\nimport { DevWorkspaceError } from '../errors/index.js';\nimport {\n  SCHEMA_VERSION,\n  validateFacts,\n  type Confidence,\n  type Fact,\n  type FactsFile,\n  type FactStatus,\n  type SourceType,\n} from '../config/schemas.js';\nimport { pathExists, sha256File } from '../utils/fs.js';\nimport { findAbsolutePaths, resolveInside, validateRelativePath } from '../utils/paths.js';\nimport { containsSecret } from '../security/redact.js';\nimport { isSensitiveFile } from '../security/files.js';\nimport { readVersioned, writeVersioned } from '../core/versioned.js';\nimport type { Ws } from '../core/workspace.js';\n\nexport interface FactInput {\n  key: string;\n  value: string;\n  source: string;\n  sourceType: SourceType;\n  sources?: string[];\n  confidence: Confidence;\n  status?: FactStatus;\n}\n\nexport const MISSING_HASH = 'MISSING';\n\nexport function emptyFacts(): FactsFile {\n  return { schemaVersion: SCHEMA_VERSION, facts: [] };\n}\n\nexport async function loadFacts(ws: Ws): Promise<FactsFile> {\n  if (!(await pathExists(ws.facts))) return emptyFacts();\n  return (await readVersioned(ws.facts, 'facts', SCHEMA_VERSION, validateFacts)).data;\n}\n\nexport async function saveFacts(ws: Ws, file: FactsFile): Promise<void> {\n  validateFacts(file);\n  await writeVersioned(ws, ws.facts, file);\n}\n\n/**\n * Authority rank. Mirrors the hierarchy: user decisions > current repository evidence >\n * verified facts > AI-derived findings > stale/unknown. Lower-ranked input never silently replaces a higher-ranked fact.\n */\nexport function authorityRank(f: Pick<Fact, 'status' | 'sourceType'>): number {\n  if (f.status === 'USER_DECISION') return 5;\n  if (f.status === 'DETECTED' && f.sourceType !== 'ai') return 4;\n  if (f.status === 'VERIFIED') return f.sourceType === 'ai' ? 3 : 4;\n  if (f.status === 'INFERRED') return 2;\n  return 1;\n}\n\nfunction defaultStatus(t: SourceType): FactStatus {\n  if (t === 'user') return 'USER_DECISION';\n  if (t === 'ai') return 'INFERRED';\n  return 'DETECTED';\n}\n\nexport function factId(key: string): string {\n  return 'f-' + createHash('sha256').update(key).digest('hex').slice(0, 10);\n}\n\nexport async function hashSources(root: string, sources: string[], cache: Map<string, string> = new Map()): Promise<Record<string, string>> {\n  const out: Record<string, string> = {};\n  for (const s of sources) {\n    let h = cache.get(s);\n    if (h === undefined) {\n      const full = resolveInside(root, s);\n      try {\n        const st = await fs.lstat(full);\n        h = st.isFile() ? await sha256File(full) : MISSING_HASH;\n      } catch {\n        h = MISSING_HASH;\n      }\n      cache.set(s, h);\n    }\n    out[s] = h;\n  }\n  return out;\n}\n\nconst KEY_RE = /^[a-z0-9][a-z0-9._-]{0,99}$/;\n\nexport async function buildFact(root: string, input: FactInput, now: string, existing?: Fact): Promise<Fact> {\n  if (!KEY_RE.test(input.key)) {\n    throw new DevWorkspaceError('USAGE', `Invalid fact key \"${input.key}\".`, {\n      hint: 'Use lowercase letters, digits, dots, dashes (e.g. \"auth.session-store\").',\n    });\n  }\n  if (input.value.trim() === '') throw new DevWorkspaceError('USAGE', 'Fact value must not be empty.');\n  if (input.value.length > 4000) throw new DevWorkspaceError('USAGE', 'Fact value is too long (max 4000 characters).', { hint: 'Store a concise summary; link to the source file instead.' });\n  if (containsSecret(input.value) || containsSecret(input.source)) {\n    throw new DevWorkspaceError('SECURITY', 'Fact looks like it contains a secret; refusing to store it.', {\n      hint: 'Describe where the secret is configured, never its value.',\n    });\n  }\n  const abs = findAbsolutePaths(input.value);\n  if (abs.length > 0) {\n    throw new DevWorkspaceError('UNSAFE_PATH', `Fact value contains a machine-specific absolute path (${abs[0]}).`, {\n      hint: 'Use project-relative paths so knowledge stays portable.',\n    });\n  }\n  const sources = [...new Set(input.sources ?? [])];\n  for (const s of sources) {\n    const err = validateRelativePath(s);\n    if (err) throw new DevWorkspaceError('UNSAFE_PATH', `Invalid fact source \"${s}\" (${err}).`);\n    if (isSensitiveFile(s)) throw new DevWorkspaceError('SECURITY', `Fact source \"${s}\" is a sensitive file.`);\n  }\n  const status = input.status ?? defaultStatus(input.sourceType);\n  const hashes = await hashSources(root, sources);\n  const missing = sources.filter((s) => hashes[s] === MISSING_HASH);\n  if (missing.length > 0 && input.sourceType !== 'user') {\n    throw new DevWorkspaceError('NOT_FOUND', `Fact source file(s) not found: ${missing.join(', ')}`, {\n      hint: 'Cite files that exist in the repository.',\n    });\n  }\n  return {\n    id: factId(input.key),\n    key: input.key,\n    value: input.value.trim(),\n    source: input.source,\n    sourceType: input.sourceType,\n    sources,\n    sourceHashes: hashes,\n    confidence: input.confidence,\n    status,\n    createdAt: existing?.createdAt ?? now,\n    updatedAt: now,\n    lastVerifiedAt: status === 'VERIFIED' || status === 'DETECTED' || status === 'USER_DECISION' ? now : null,\n  };\n}\n\nexport type UpsertAction = 'created' | 'updated' | 'unchanged';\n\nexport function upsertFact(file: FactsFile, fact: Fact): UpsertAction {\n  const i = file.facts.findIndex((f) => f.key === fact.key);\n  if (i === -1) {\n    file.facts.push(fact);\n    return 'created';\n  }\n  const existing = file.facts[i]!;\n  if (existing.status !== 'STALE' && authorityRank(fact) < authorityRank(existing)) {\n    throw new DevWorkspaceError('CONFLICT', `Fact \"${fact.key}\" is held at higher authority (${existing.status}); refusing to overwrite it.`, {\n      hint: 'Ask the user to confirm the change, then record it as a user decision.',\n    });\n  }\n  fact.createdAt = existing.createdAt;\n  const same =\n    existing.value === fact.value &&\n    existing.status === fact.status &&\n    existing.confidence === fact.confidence &&\n    JSON.stringify(existing.sourceHashes) === JSON.stringify(fact.sourceHashes);\n  // Leave an identical fact byte-for-byte alone so repeated analysis never churns version control.\n  if (same) return 'unchanged';\n  file.facts[i] = fact;\n  return 'updated';\n}\n\nexport interface StalenessReport {\n  checked: number;\n  newlyStale: { key: string; reason: string }[];\n  alreadyStale: string[];\n  /** User decisions whose sources changed. They are never auto-staled; a human should review them. */\n  needsReview: { key: string; reason: string }[];\n}\n\n/** Compare stored source hashes with the repository now. Mutates facts that became stale. */\nexport async function applyStaleness(root: string, file: FactsFile, now: string): Promise<StalenessReport> {\n  const cache = new Map<string, string>();\n  const report: StalenessReport = { checked: 0, newlyStale: [], alreadyStale: [], needsReview: [] };\n  for (const f of file.facts) {\n    if (f.status === 'STALE') {\n      report.alreadyStale.push(f.key);\n      continue;\n    }\n    if (f.sources.length === 0) continue;\n    report.checked++;\n    const current = await hashSources(root, f.sources, cache);\n    const changed = f.sources.filter((s) => current[s] !== f.sourceHashes[s]);\n    if (changed.length === 0) continue;\n    const reason = changed.map((s) => `${s} ${current[s] === MISSING_HASH ? 'removed' : 'changed'}`).join('; ');\n    if (f.status === 'USER_DECISION') {\n      report.needsReview.push({ key: f.key, reason });\n      continue;\n    }\n    f.status = 'STALE';\n    f.staleReason = reason;\n    f.updatedAt = now;\n    report.newlyStale.push({ key: f.key, reason });\n  }\n  return report;\n}\n\n/** Re-hash a fact's sources and mark it verified (called after the agent re-checks it against the repository). */\nexport async function verifyFact(root: string, file: FactsFile, key: string, now: string): Promise<Fact> {\n  const f = file.facts.find((x) => x.key === key);\n  if (!f) throw new DevWorkspaceError('NOT_FOUND', `No fact with key \"${key}\".`);\n  f.sourceHashes = await hashSources(root, f.sources);\n  const gone = f.sources.filter((s) => f.sourceHashes[s] === MISSING_HASH);\n  if (gone.length > 0) {\n    throw new DevWorkspaceError('NOT_FOUND', `Cannot verify \"${key}\": source(s) missing: ${gone.join(', ')}`, {\n      hint: 'Update the fact with new sources or remove it.',\n    });\n  }\n  if (f.status !== 'USER_DECISION') f.status = f.sourceType === 'detector' ? 'DETECTED' : 'VERIFIED';\n  delete f.staleReason;\n  f.lastVerifiedAt = now;\n  f.updatedAt = now;\n  return f;\n}\n\nexport function removeFact(file: FactsFile, key: string): boolean {\n  const n = file.facts.length;\n  file.facts = file.facts.filter((f) => f.key !== key);\n  return file.facts.length !== n;\n}\n"]}

package/dist/portability/bundle.d.ts

@@ -0,0 +1,22 @@
+export declare const BUNDLE_FORMAT = "devworkspace-export";
+export declare const MAX_BUNDLE_BYTES: number;
+export declare const MAX_FILE_BYTES: number;
+export declare const MAX_FILES = 5000;
+export interface Bundle {
+    format: typeof BUNDLE_FORMAT;
+    schemaVersion: number;
+    exportedAt: string;
+    devworkspaceVersion: string;
+    projectId: string;
+    projectName: string;
+    files: Record<string, string>;
+}
+export declare function isPortablePath(rel: string): boolean;
+/** Workspace files that may go into a bundle (excludes machine-local state and regenerable prompts). */
+export declare function isExportable(rel: string): boolean;
+export interface BundleProblem {
+    path: string;
+    problem: string;
+}
+/** Strictly validate an untrusted bundle. Returns the typed bundle or throws with every problem found. */
+export declare function parseBundle(raw: string): Bundle;

package/dist/portability/bundle.js

@@ -0,0 +1,102 @@
+import { DevWorkspaceError } from '../errors/index.js';
+import { SCHEMA_VERSION } from '../config/schemas.js';
+import { validateRelativePath } from '../utils/paths.js';
+import { findSecrets } from '../security/redact.js';
+import { isSensitiveFile } from '../security/files.js';
+import { migrateData } from '../core/migrations.js';
+export const BUNDLE_FORMAT = 'devworkspace-export';
+export const MAX_BUNDLE_BYTES = 25 * 1024 * 1024;
+export const MAX_FILE_BYTES = 1024 * 1024;
+export const MAX_FILES = 5000;
+/** Workspace-relative paths that may travel in a bundle. Anything else is rejected on import. */
+const ALLOWED = [
+    /^project\.json$/,
+    /^context\/[A-Za-z0-9._-]+\.(?:json|md)$/,
+    /^decisions\/[A-Za-z0-9._-]+\.md$/,
+    /^tasks\/(?:active|completed)\/[A-Za-z0-9._-]+\.json$/,
+    /^sessions\/[A-Za-z0-9._-]+\.json$/,
+    /^analysis\/discovery\.json$/,
+];
+export function isPortablePath(rel) {
+    return ALLOWED.some((re) => re.test(rel));
+}
+/** Workspace files that may go into a bundle (excludes machine-local state and regenerable prompts). */
+export function isExportable(rel) {
+    return isPortablePath(rel) && !isSensitiveFile(rel);
+}
+/** Strictly validate an untrusted bundle. Returns the typed bundle or throws with every problem found. */
+export function parseBundle(raw) {
+    if (raw.length > MAX_BUNDLE_BYTES) {
+        throw new DevWorkspaceError('SECURITY', `Bundle is larger than the ${MAX_BUNDLE_BYTES / 1024 / 1024} MB limit.`);
+    }
+    let data;
+    try {
+        data = JSON.parse(raw.replace(/^\uFEFF/, ''));
+    }
+    catch (e) {
+        throw new DevWorkspaceError('SCHEMA', 'The import file is not valid JSON.', { cause: e });
+    }
+    if (typeof data !== 'object' || data === null || Array.isArray(data))
+        throw new DevWorkspaceError('SCHEMA', 'The import file is not a DevWorkspace export.');
+    const b = data;
+    if (b.format !== BUNDLE_FORMAT)
+        throw new DevWorkspaceError('SCHEMA', `Not a DevWorkspace export (format "${String(b.format)}").`);
+    if (typeof b.schemaVersion !== 'number' || !Number.isInteger(b.schemaVersion))
+        throw new DevWorkspaceError('SCHEMA', 'Export has no schemaVersion.');
+    if (b.schemaVersion > SCHEMA_VERSION) {
+        throw new DevWorkspaceError('SCHEMA_TOO_NEW', `Export uses schema v${b.schemaVersion}; this DevWorkspace understands up to v${SCHEMA_VERSION}.`, {
+            hint: 'Upgrade DevWorkspace, then retry.',
+        });
+    }
+    for (const k of ['exportedAt', 'devworkspaceVersion', 'projectId', 'projectName']) {
+        if (typeof b[k] !== 'string' || b[k].length > 300)
+            throw new DevWorkspaceError('SCHEMA', `Export field "${k}" is missing or invalid.`);
+    }
+    if (typeof b.files !== 'object' || b.files === null || Array.isArray(b.files))
+        throw new DevWorkspaceError('SCHEMA', 'Export has no files map.');
+    const files = b.files;
+    const names = Object.keys(files);
+    if (names.length > MAX_FILES)
+        throw new DevWorkspaceError('SECURITY', `Export contains too many files (${names.length}).`);
+    const problems = [];
+    for (const name of names) {
+        const content = files[name];
+        const pathErr = validateRelativePath(name);
+        if (pathErr) {
+            problems.push({ path: name, problem: `unsafe path (${pathErr})` });
+            continue;
+        }
+        if (!isPortablePath(name)) {
+            problems.push({ path: name, problem: 'path is not an allowed workspace file' });
+            continue;
+        }
+        if (typeof content !== 'string') {
+            problems.push({ path: name, problem: 'content is not text' });
+            continue;
+        }
+        if (content.length > MAX_FILE_BYTES) {
+            problems.push({ path: name, problem: 'file too large' });
+            continue;
+        }
+        if (findSecrets(content).length > 0) {
+            problems.push({ path: name, problem: 'contains secret-like values' });
+            continue;
+        }
+        if (name.endsWith('.json')) {
+            try {
+                const parsed = JSON.parse(content);
+                migrateData(parsed, SCHEMA_VERSION, [], name);
+            }
+            catch (e) {
+                problems.push({ path: name, problem: `invalid JSON content: ${e.message.split('\n')[0]}` });
+            }
+        }
+    }
+    if (problems.length > 0) {
+        throw new DevWorkspaceError('SECURITY', `Import rejected; nothing was changed:\n  - ${problems.slice(0, 15).map((p) => `${p.path}: ${p.problem}`).join('\n  - ')}`, {
+            hint: 'Only import bundles you trust, produced by "devworkspace export".',
+        });
+    }
+    return b;
+}
+//# sourceMappingURL=bundle.js.map

package/dist/portability/bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/portability/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AACnD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACjD,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC;AAY9B,iGAAiG;AACjG,MAAM,OAAO,GAAa;IACxB,iBAAiB;IACjB,yCAAyC;IACzC,kCAAkC;IAClC,sDAAsD;IACtD,mCAAmC;IACnC,6BAA6B;CAC9B,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAOD,0GAA0G;AAC1G,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,GAAG,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,6BAA6B,gBAAgB,GAAG,IAAI,GAAG,IAAI,YAAY,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,oCAAoC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,+CAA+C,CAAC,CAAC;IAC7J,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa;QAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,sCAAsC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnI,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,8BAA8B,CAAC,CAAC;IACrJ,IAAI,CAAC,CAAC,aAAa,GAAG,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,uBAAuB,CAAC,CAAC,aAAa,0CAA0C,cAAc,GAAG,EAAE;YAC/I,IAAI,EAAE,mCAAmC;SAC1C,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,qBAAqB,EAAE,WAAW,EAAE,aAAa,CAAU,EAAE,CAAC;QAC3F,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,CAAC,CAAY,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;IACrJ,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IACjJ,MAAM,KAAK,GAAG,CAAC,CAAC,KAAgC,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,mCAAmC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IAE3H,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,OAAO,GAAG,EAAE,CAAC,CAAC;YACnE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;YAChF,SAAS;QACX,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;gBAC9C,WAAW,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,yBAA0B,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzG,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,8CAA8C,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAClK,IAAI,EAAE,mEAAmE;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAsB,CAAC;AAChC,CAAC","sourcesContent":["import { DevWorkspaceError } from '../errors/index.js';\nimport { SCHEMA_VERSION } from '../config/schemas.js';\nimport { validateRelativePath } from '../utils/paths.js';\nimport { findSecrets } from '../security/redact.js';\nimport { isSensitiveFile } from '../security/files.js';\nimport { migrateData } from '../core/migrations.js';\n\nexport const BUNDLE_FORMAT = 'devworkspace-export';\nexport const MAX_BUNDLE_BYTES = 25 * 1024 * 1024;\nexport const MAX_FILE_BYTES = 1024 * 1024;\nexport const MAX_FILES = 5000;\n\nexport interface Bundle {\n  format: typeof BUNDLE_FORMAT;\n  schemaVersion: number;\n  exportedAt: string;\n  devworkspaceVersion: string;\n  projectId: string;\n  projectName: string;\n  files: Record<string, string>;\n}\n\n/** Workspace-relative paths that may travel in a bundle. Anything else is rejected on import. */\nconst ALLOWED: RegExp[] = [\n  /^project\\.json$/,\n  /^context\\/[A-Za-z0-9._-]+\\.(?:json|md)$/,\n  /^decisions\\/[A-Za-z0-9._-]+\\.md$/,\n  /^tasks\\/(?:active|completed)\\/[A-Za-z0-9._-]+\\.json$/,\n  /^sessions\\/[A-Za-z0-9._-]+\\.json$/,\n  /^analysis\\/discovery\\.json$/,\n];\n\nexport function isPortablePath(rel: string): boolean {\n  return ALLOWED.some((re) => re.test(rel));\n}\n\n/** Workspace files that may go into a bundle (excludes machine-local state and regenerable prompts). */\nexport function isExportable(rel: string): boolean {\n  return isPortablePath(rel) && !isSensitiveFile(rel);\n}\n\nexport interface BundleProblem {\n  path: string;\n  problem: string;\n}\n\n/** Strictly validate an untrusted bundle. Returns the typed bundle or throws with every problem found. */\nexport function parseBundle(raw: string): Bundle {\n  if (raw.length > MAX_BUNDLE_BYTES) {\n    throw new DevWorkspaceError('SECURITY', `Bundle is larger than the ${MAX_BUNDLE_BYTES / 1024 / 1024} MB limit.`);\n  }\n  let data: unknown;\n  try {\n    data = JSON.parse(raw.replace(/^\\uFEFF/, ''));\n  } catch (e) {\n    throw new DevWorkspaceError('SCHEMA', 'The import file is not valid JSON.', { cause: e });\n  }\n  if (typeof data !== 'object' || data === null || Array.isArray(data)) throw new DevWorkspaceError('SCHEMA', 'The import file is not a DevWorkspace export.');\n  const b = data as Record<string, unknown>;\n  if (b.format !== BUNDLE_FORMAT) throw new DevWorkspaceError('SCHEMA', `Not a DevWorkspace export (format \"${String(b.format)}\").`);\n  if (typeof b.schemaVersion !== 'number' || !Number.isInteger(b.schemaVersion)) throw new DevWorkspaceError('SCHEMA', 'Export has no schemaVersion.');\n  if (b.schemaVersion > SCHEMA_VERSION) {\n    throw new DevWorkspaceError('SCHEMA_TOO_NEW', `Export uses schema v${b.schemaVersion}; this DevWorkspace understands up to v${SCHEMA_VERSION}.`, {\n      hint: 'Upgrade DevWorkspace, then retry.',\n    });\n  }\n  for (const k of ['exportedAt', 'devworkspaceVersion', 'projectId', 'projectName'] as const) {\n    if (typeof b[k] !== 'string' || (b[k] as string).length > 300) throw new DevWorkspaceError('SCHEMA', `Export field \"${k}\" is missing or invalid.`);\n  }\n  if (typeof b.files !== 'object' || b.files === null || Array.isArray(b.files)) throw new DevWorkspaceError('SCHEMA', 'Export has no files map.');\n  const files = b.files as Record<string, unknown>;\n  const names = Object.keys(files);\n  if (names.length > MAX_FILES) throw new DevWorkspaceError('SECURITY', `Export contains too many files (${names.length}).`);\n\n  const problems: BundleProblem[] = [];\n  for (const name of names) {\n    const content = files[name];\n    const pathErr = validateRelativePath(name);\n    if (pathErr) {\n      problems.push({ path: name, problem: `unsafe path (${pathErr})` });\n      continue;\n    }\n    if (!isPortablePath(name)) {\n      problems.push({ path: name, problem: 'path is not an allowed workspace file' });\n      continue;\n    }\n    if (typeof content !== 'string') {\n      problems.push({ path: name, problem: 'content is not text' });\n      continue;\n    }\n    if (content.length > MAX_FILE_BYTES) {\n      problems.push({ path: name, problem: 'file too large' });\n      continue;\n    }\n    if (findSecrets(content).length > 0) {\n      problems.push({ path: name, problem: 'contains secret-like values' });\n      continue;\n    }\n    if (name.endsWith('.json')) {\n      try {\n        const parsed = JSON.parse(content) as unknown;\n        migrateData(parsed, SCHEMA_VERSION, [], name);\n      } catch (e) {\n        problems.push({ path: name, problem: `invalid JSON content: ${(e as Error).message.split('\\n')[0]}` });\n      }\n    }\n  }\n  if (problems.length > 0) {\n    throw new DevWorkspaceError('SECURITY', `Import rejected; nothing was changed:\\n  - ${problems.slice(0, 15).map((p) => `${p.path}: ${p.problem}`).join('\\n  - ')}`, {\n      hint: 'Only import bundles you trust, produced by \"devworkspace export\".',\n    });\n  }\n  return b as unknown as Bundle;\n}\n"]}