fdeops 3.8.1 → 3.8.3

package/bin/fde.js

@@ -217,9 +217,46 @@ function removeExactEntryLine(md, entry) {
 }
 
 
+// Map Node fs errno codes to one-line field messages - never dump a stack at an FDE.
+function formatFsError(err, action, target) {
+  const code = err && err.code
+  const where = path.basename(String(target || '')) || String(target || 'path')
+  if (code === 'ENOSPC') return `cannot ${action} ${where} - disk full`
+  if (code === 'EACCES' || code === 'EPERM' || code === 'EROFS') {
+    return `cannot ${action} ${where} - permission denied (read-only or locked down)`
+  }
+  if (code === 'ELOOP') return `cannot ${action} ${where} - symlink loop`
+  if (code === 'ENOENT') return `cannot ${action} ${where} - path missing`
+  return `cannot ${action} ${where}${code ? ` (${code})` : ''}${err && err.message && !code ? ': ' + err.message : ''}`
+}
+
+function failFs(err, action, target) {
+  console.error(formatFsError(err, action, target))
+  process.exit(1)
+}
+
+// Refuse writes that would follow a symlink out of the engagement tree.
+// Missing path is fine (new file). Soft mode returns the message instead of exiting
+// (session capture must never crash a hook).
+function refuseSymlinkWrite(p, opts = {}) {
+  try {
+    if (fs.lstatSync(p).isSymbolicLink()) {
+      const msg = `refused: ${path.basename(p)} is a symlink - write would leave the engagement tree. Replace it with a real file.`
+      if (opts.soft) return msg
+      console.error(msg)
+      process.exit(1)
+    }
+  } catch (e) {
+    if (e.code === 'ENOENT') return null
+    if (opts.soft) return formatFsError(e, 'check', p)
+    failFs(e, 'check', p)
+  }
+  return null
+}
+
 // Exclusive create lock + retry. Two parallel agent sessions (or hook + CLI)
 // appending the same .fde file otherwise interleave/corrupt under load.
-function withFileLock(targetPath, fn) {
+function withFileLock(targetPath, fn, opts = {}) {
   const lockPath = targetPath + '.lock'
   const deadline = Date.now() + 5000
   while (true) {
@@ -227,14 +264,19 @@ function withFileLock(targetPath, fn) {
     try {
       fd = fs.openSync(lockPath, 'wx')
     } catch (e) {
-      if (e.code !== 'EEXIST') throw e
-      if (Date.now() > deadline) {
-        console.error(`could not lock ${path.basename(targetPath)} - another writer is active; retry`)
-        process.exit(1)
+      if (e.code === 'EEXIST') {
+        if (Date.now() > deadline) {
+          const msg = `could not lock ${path.basename(targetPath)} - another writer is active; retry`
+          if (opts.soft) throw Object.assign(new Error(msg), { code: 'ELOCKED' })
+          console.error(msg)
+          process.exit(1)
+        }
+        const waitUntil = Date.now() + 20
+        while (Date.now() < waitUntil) { /* spin */ }
+        continue
       }
-      const waitUntil = Date.now() + 20
-      while (Date.now() < waitUntil) { /* spin */ }
-      continue
+      if (opts.soft) throw e
+      failFs(e, 'lock', targetPath)
     }
     try {
       return fn()
@@ -245,14 +287,39 @@ function withFileLock(targetPath, fn) {
   }
 }
 
-function atomicWriteFile(p, content) {
+function atomicWriteFile(p, content, opts = {}) {
+  const blocked = refuseSymlinkWrite(p, opts)
+  if (blocked) {
+    if (opts.soft) throw Object.assign(new Error(blocked), { code: 'ESYMLINK' })
+    return
+  }
   const tmp = `${p}.${process.pid}.${Date.now()}.tmp`
-  fs.writeFileSync(tmp, content)
-  fs.renameSync(tmp, p)
+  try {
+    fs.writeFileSync(tmp, content)
+    fs.renameSync(tmp, p)
+  } catch (e) {
+    try { fs.unlinkSync(tmp) } catch (_) {}
+    if (opts.soft) throw e
+    failFs(e, 'write', p)
+  }
 }
 
-function lockedAppendFile(p, text) {
-  withFileLock(p, () => { fs.appendFileSync(p, text) })
+function lockedAppendFile(p, text, opts = {}) {
+  const blocked = refuseSymlinkWrite(p, opts)
+  if (blocked) {
+    if (opts.soft) throw Object.assign(new Error(blocked), { code: 'ESYMLINK' })
+    return
+  }
+  try {
+    withFileLock(p, () => { fs.appendFileSync(p, text) }, opts)
+  } catch (e) {
+    if (opts.soft) throw e
+    failFs(e, 'append', p)
+  }
+}
+
+function rmTreeQuiet(dir) {
+  try { fs.rmSync(dir, { recursive: true, force: true }) } catch (_) {}
 }
 
 // Pull the body under a "## Heading" up to the next "##" (or EOF).
@@ -349,31 +416,82 @@ function stakeholdersMemoryHealth(eng) {
   return { ok: true, warn: '' }
 }
 
+// Subject key for a signal-history line - first real name word (same spirit as
+// extractStakeholders). A green about Randy must not clear an amber about Denise.
+function signalSubjectKey(text) {
+  const words = String(text).replace(/\([^)]*\)/g, '').split(/\s+/).filter(w => w && !/^(dr|mr|mrs|ms)\.?$/i.test(w))
+  const frag = (words[0] || '').replace(/[^a-z0-9]/gi, '').toLowerCase()
+  return frag.length >= 3 ? frag : ('anon:' + String(text).slice(0, 48).toLowerCase())
+}
+
+function parsePhase(ctx) {
+  // Template ships "**Phase:** land | discover | ..." - that is UNSET, not land.
+  const m = ctx.match(/\*\*Phase:\*\*\s*(.+)/i) || ctx.match(/^phase[:\s*]+(.+)$/im)
+  if (!m) return '?'
+  const raw = m[1].replace(/\*/g, '').trim()
+  if (!raw || /\|/.test(raw) || /^unset$/i.test(raw) || /^[\[(]/.test(raw)) return '?'
+  const one = raw.toLowerCase().match(/^(land|discover|plan|build|ship|close)\b/)
+  return one ? one[1] : '?'
+}
+
+function countOpenRisks(eng) {
+  const md = readClean(eng, 'risks.md')
+  const body = md.split(/^#{1,6}\s+Retired\b/im)[0] || md
+  let n = 0
+  for (const raw of body.split('\n')) {
+    const t = raw.trim()
+    if (!t || t.startsWith('<!--') || /^#{1,6}\s/.test(t)) continue
+    if (/risk\s*\|\s*status|mitigation/i.test(t) || /^\|?[\s|:-]+$/.test(t)) continue
+    if (/^[-*]/.test(t) || (/^\|/.test(t) && t.length > 12)) n++
+  }
+  return n
+}
+
+function nextActionLine(ctx) {
+  const body = sectionBody(ctx, 'Next action')
+  for (const raw of body.split('\n')) {
+    const t = raw.trim().replace(/^[-*]\s+/, '')
+    if (t) return t.slice(0, 120)
+  }
+  return ''
+}
+
 function computeSignals(eng) {
   // readClean, not readEng: status/dashboard echo topRisk and stakeholder lines
   // to the terminal and the rendered HTML - a <private> risk must never surface.
   const ctx = readClean(eng, 'context.md'); const stake = readClean(eng, 'stakeholders.md'); const risks = readClean(eng, 'risks.md')
   // Prefer structured tokens from stakeholders + CLI ledger (ledger survives wipes)
   const signalText = stake + '\n' + readClean(eng, SIGNAL_LEDGER)
-  const phase = (ctx.match(/phase[:* ]+\**([a-z-]+)/i) || [])[1] || '?'
-  let latest = null
+  const phase = parsePhase(ctx)
+  // Latest signal PER stakeholder, then worst-of those actives.
+  // Global "latest wins" let a green from person B hide a sponsor crisis on A.
+  const byPerson = new Map()
   for (const l of signalText.split('\n')) {
     const sm = l.match(/\[signal:(red|amber|green)\]/i)
     if (!sm) continue
     const date = (l.match(/\[(\d{4}-\d{2}-\d{2})\]/) || [])[1] || ''
     const text = l.replace(/^\s*-\s*/, '').replace(/\[signal:(red|amber|green)\]/i, '').replace(/\[\d{4}-\d{2}-\d{2}\]/, '').trim()
-    if (!latest || date >= latest.date) latest = { date, sig: sm[1].toLowerCase(), text }
+    const key = signalSubjectKey(text)
+    const prev = byPerson.get(key)
+    if (!prev || date >= prev.date) byPerson.set(key, { date, sig: sm[1].toLowerCase(), text })
+  }
+  const RANK = { red: 0, amber: 1, green: 2 }
+  let worst = null
+  for (const s of byPerson.values()) {
+    if (!worst || RANK[s.sig] < RANK[worst.sig] || (RANK[s.sig] === RANK[worst.sig] && s.date >= worst.date)) {
+      worst = s
+    }
   }
   const mem = stakeholdersMemoryHealth(eng)
   let trust, signalAge = null, stale = false, trustReason = ''
-  if (!mem.ok && !latest) {
+  if (!mem.ok && !worst) {
     trust = 'amber'
     trustReason = mem.warn
-  } else if (latest) {
-    trust = latest.sig === 'red' ? 'RED' : latest.sig
-    trustReason = (latest.text || '').slice(0, 80)
-    if (latest.date) {
-      signalAge = Math.max(0, Math.floor((Date.now() - Date.parse(latest.date)) / 86400000))
+  } else if (worst) {
+    trust = worst.sig === 'red' ? 'RED' : worst.sig
+    trustReason = (worst.text || '').slice(0, 80)
+    if (worst.date) {
+      signalAge = Math.max(0, Math.floor((Date.now() - Date.parse(worst.date)) / 86400000))
       stale = signalAge > 21
     }
   } else {
@@ -388,14 +506,33 @@ function computeSignals(eng) {
   }) || '').replace(/\|/g, ' ').replace(/\s+/g, ' ').trim().slice(0, 80)
   // Prefer the trust trigger (signal / memory warn) over a random risk line when triage is not green
   const reason = (trust !== 'green' && (trustReason || mem.warn)) ? (trustReason || mem.warn) : topRisk
+  const openRisks = countOpenRisks(eng)
+  const nextAction = nextActionLine(ctx)
   let updated = 'never', ageDays = Infinity
   try {
     ageDays = Math.floor((Date.now() - fs.statSync(path.join(eng, 'context.md')).mtimeMs) / 86400000)
     updated = ageDays === 0 ? 'today' : `${ageDays}d ago`
   } catch (_) {}
-  return { phase, trust, signalAge, stale, topRisk, reason, memoryWarn: mem.warn, updated, ageDays }
+  return { phase, trust, signalAge, stale, topRisk, reason, memoryWarn: mem.warn, openRisks, nextAction, updated, ageDays }
+}
+
+function resumeTriage(eng) {
+  const s = computeSignals(eng)
+  const label = s.trust + (s.stale ? '?' : '')
+  const phase = s.phase === '?' ? 'unset' : s.phase
+  const lines = [
+    `TRIAGE  [${label.padEnd(6)}]  phase:${phase}  updated:${s.updated}  open risks:${s.openRisks}`,
+  ]
+  if (s.reason) {
+    const age = s.signalAge != null ? ` (${s.signalAge}d old${s.stale ? ', STALE - reconfirm' : ''})` : ''
+    lines.push(`  trust: ${s.reason}${age}`)
+  }
+  if (s.nextAction) lines.push(`  next: ${s.nextAction}`)
+  else lines.push('  next: (none set - add under ## Next action in context.md)')
+  return lines.join('\n')
 }
 
+
 // ---------- dashboard content extractors (best-effort, read-only) ----------
 // The fieldbook's structured widgets (stakeholders, risks, log, stats) want
 // data shapes that .fde/ markdown does not literally carry - it is written by
@@ -722,14 +859,50 @@ function cmdResume(args) {
     const tpl = templatesDir()
     if (!tpl) { console.error('templates not found - run from the fdeops clone or reinstall'); process.exit(1) }
     const slug = slugify(name)
-    const fdeDir = path.join(ENGAGEMENTS_ROOT, slug, '.fde')
-    fs.mkdirSync(fdeDir, { recursive: true })
-    for (const f of fs.readdirSync(tpl)) {
-      const src = path.join(tpl, f); const dst = path.join(fdeDir, f)
-      if (fs.statSync(src).isDirectory()) fs.mkdirSync(dst, { recursive: true })
-      else if (!fs.existsSync(dst)) fs.copyFileSync(src, dst)
+    const engRoot = path.join(ENGAGEMENTS_ROOT, slug)
+    const fdeDir = path.join(engRoot, '.fde')
+    const existed = fs.existsSync(fdeDir)
+
+    const fillTemplates = (destFde) => {
+      for (const f of fs.readdirSync(tpl)) {
+        const src = path.join(tpl, f); const dst = path.join(destFde, f)
+        if (fs.statSync(src).isDirectory()) fs.mkdirSync(dst, { recursive: true })
+        else if (!fs.existsSync(dst)) fs.copyFileSync(src, dst)
+      }
+      fs.mkdirSync(path.join(destFde, 'retrospectives'), { recursive: true })
+    }
+
+    try {
+      if (!existed) {
+        // Atomic create: build under a staging dir, then rename into place.
+        // Disk-full / permission mid-copy must not leave a half-built engagement.
+        fs.mkdirSync(ENGAGEMENTS_ROOT, { recursive: true })
+        const stagingRoot = path.join(ENGAGEMENTS_ROOT, `.init-${slug}-${process.pid}`)
+        const stagingEng = path.join(stagingRoot, slug)
+        const stagingFde = path.join(stagingEng, '.fde')
+        rmTreeQuiet(stagingRoot)
+        try {
+          fs.mkdirSync(stagingFde, { recursive: true })
+          fillTemplates(stagingFde)
+          // If a partial engRoot exists from an older failed run, remove it first.
+          if (fs.existsSync(engRoot)) rmTreeQuiet(engRoot)
+          fs.renameSync(stagingEng, engRoot)
+          rmTreeQuiet(stagingRoot)
+        } catch (e) {
+          rmTreeQuiet(stagingRoot)
+          if (fs.existsSync(engRoot) && !fs.existsSync(path.join(engRoot, '.fde', 'context.md'))) {
+            rmTreeQuiet(engRoot)
+          }
+          failFs(e, 'create engagement', engRoot)
+        }
+      } else {
+        // Re-init / rebind: only fill missing template files in place.
+        fillTemplates(fdeDir)
+      }
+    } catch (e) {
+      failFs(e, 'init engagement', fdeDir)
     }
-    fs.mkdirSync(path.join(fdeDir, 'retrospectives'), { recursive: true })
+
     // bind THIS workspace to the engagement (zero ceremony next time).
     // A workspace binds to exactly ONE engagement: rebinding REPLACES the old
     // line - resolution is first-match-wins, so appending a second line would
@@ -764,7 +937,9 @@ function cmdResume(args) {
     console.log(`NO ENGAGEMENT for this workspace.\nexisting: ${list}\ncreate + bind one:  fde resume --init <client-name>`)
     process.exit(2)
   }
-  console.log(`ENGAGEMENT: ${eng}\n`)
+  // Monday-morning command: triage first (trust / phase / risks / next), then memory.
+  console.log(resumeTriage(eng))
+  console.log(`\nENGAGEMENT: ${eng}\n`)
   // readClean, not fs.readFileSync: this output is what an agent loads as
   // context, so it goes through the same <private> redaction as the dashboard.
   const ctx = readClean(eng, 'context.md')
@@ -842,10 +1017,23 @@ function cmdLog(args) {
     args.splice(sigIdx, 2)
   }
   const type = args[0]; const text = args.slice(1).join(' ')
-  if (!LOG_FILES[type] || !text) { console.error('usage: fde log <decision|risk|delivery|contact> <text> [--signal red|amber|green] [--force]\n       fde log --undo'); process.exit(1) }
-  if (signal && type !== 'contact') { console.error('--signal only applies to: fde log contact'); process.exit(1) }
   const eng = resolveEngagement({ forWrite: true })
   if (!eng) { console.error('no engagement - run: fde resume --init <name>'); process.exit(2) }
+
+  // fde log phase <land|discover|plan|build|ship|close> - advances portfolio phase
+  if (type === 'phase') {
+    const phase = (text || '').toLowerCase().trim()
+    if (!['land', 'discover', 'plan', 'build', 'ship', 'close'].includes(phase)) {
+      console.error('usage: fde log phase <land|discover|plan|build|ship|close>')
+      process.exit(1)
+    }
+    setContextPhase(eng, phase)
+    console.log(`phase → ${phase}`)
+    return
+  }
+
+  if (!LOG_FILES[type] || !text) { console.error('usage: fde log <decision|risk|delivery|contact> <text> [--signal red|amber|green] [--force]\n       fde log phase <land|discover|plan|build|ship|close>\n       fde log --undo'); process.exit(1) }
+  if (signal && type !== 'contact') { console.error('--signal only applies to: fde log contact'); process.exit(1) }
   const hit = findSecretHit(text)
   if (hit && !force) { refuseSecret('log text', hit); process.exit(1) }
   if (hit && force) console.error(`warning: logging possible ${hit} (--force)`)
@@ -855,6 +1043,23 @@ function cmdLog(args) {
   console.log(`logged → ${LOG_FILES[type]}${signal ? ` (signal:${signal})` : ''}`)
 }
 
+function setContextPhase(eng, phase) {
+  const p = path.join(eng, 'context.md')
+  let md = readEng(eng, 'context.md')
+  if (!md) md = '# Engagement context\n\n'
+  if (/\*\*Phase:\*\*/i.test(md)) {
+    md = md.replace(/\*\*Phase:\*\*\s*.*/i, `**Phase:** ${phase}`)
+  } else {
+    md = md.replace(/\n*$/, `\n\n**Phase:** ${phase}\n`)
+  }
+  const today = new Date().toISOString().slice(0, 10)
+  if (/\*\*Last updated:\*\*/i.test(md)) {
+    md = md.replace(/\*\*Last updated:\*\*\s*.*/i, `**Last updated:** ${today}`)
+  }
+  withFileLock(p, () => { atomicWriteFile(p, md.endsWith('\n') ? md : md + '\n') })
+}
+
+
 // Meeting notes → structured memory. Deterministic routing, zero AI: lines that
 // start with decision:/risk:/delivery:/contact: (case-insensitive) go to their
 // LOG_FILES target as dated bullets; everything else lands in context.md as one
@@ -1007,7 +1212,7 @@ function cmdCapture() {
   if (branch) block += `- workspace: \`${branch}\` @ ${lastCommit || 'no commits yet'}\n`
   if (changed) block += `- uncommitted: ${changed}\n`
   if (updated) block += `- engagement files updated: ${updated}\n`
-  try { lockedAppendFile(path.join(eng, 'context.md'), block) } catch (_) {}
+  try { lockedAppendFile(path.join(eng, 'context.md'), block, { soft: true }) } catch (_) {}
 }
 
 function engagementSlugFromPath(eng) {
@@ -1043,10 +1248,10 @@ function cmdStatus(args) {
     // "amber?" = structured signal went stale (>21d) - reconfirm before trusting it
     const label = r.trust + (r.stale ? '?' : '')
     const sig = r.signalAge != null ? `signal ${r.signalAge}d old${r.stale ? ' (STALE - reconfirm)' : ''}  ` : ''
-    console.log(`  [${label.padEnd(6)}] ${r.name.padEnd(24)} phase:${r.phase.padEnd(10)} updated:${r.updated.padEnd(8)} ${sig}${r.reason}`)
+    console.log(`  [${label.padEnd(6)}] ${r.name.padEnd(24)} phase:${(r.phase === '?' ? 'unset' : r.phase).padEnd(10)} updated:${r.updated.padEnd(8)} ${sig}${r.reason}`)
   }
   if (!all) console.log('\n(current engagement only - pass --all for the full portfolio)')
-  console.log('\ntrust: latest [signal:x] token in stakeholders.md wins (fde log contact --signal, fde debrief); keyword heuristic only when none exists - verify before acting.')
+  console.log('\ntrust: worst active [signal:x] across stakeholders (latest per person) - a green from B cannot clear an amber/red on A; keyword heuristic only when none exists.')
 }
 
 // ---------- dashboard (deterministic markdown → one local HTML) ----------
@@ -1789,8 +1994,13 @@ ${clientViews}
 <script>${dashScript()}</script>
 </body></html>`
 
-  fs.mkdirSync(path.dirname(outPath), { recursive: true })
-  fs.writeFileSync(outPath, html)
+  try {
+    fs.mkdirSync(path.dirname(outPath), { recursive: true })
+    refuseSymlinkWrite(outPath)
+    fs.writeFileSync(outPath, html)
+  } catch (e) {
+    failFs(e, 'write fieldbook', outPath)
+  }
   console.log(`fieldbook → ${outPath}`)
   console.log(`${engagements.length} engagement(s) rendered · ${counts.RED} red / ${counts.amber} amber / ${counts.green} green · 0 tokens (pure render)`)
   if (args.includes('--open')) {
@@ -1812,6 +2022,7 @@ function printUsage() {
   fde resume --init <name> create + bind engagement for this workspace (rebind replaces)
   fde resume --bind        show what this workspace is bound to, and what resolves
   fde log <type> <text>    append decision|risk|delivery|contact (contact takes --signal red|amber|green; --force to allow secret-like text)
+  fde log phase <phase>    set engagement phase (land|discover|plan|build|ship|close)
   fde log --undo           remove the last CLI log/debrief entry from memory
   fde debrief [file]       meeting notes → memory: decision:/risk:/delivery:/contact: lines route, rest → context.md (stdin if no file; --dry-run; --force)
   fde receipts <term>      "what did we agree?" with dates

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops",
-  "version": "3.8.1",
+  "version": "3.8.3",
   "description": "Field kit for engineers embedded in client work - a real CLI (recon, memory, portfolio), one @fde skill with field judgment on top, and hooks that make it automatic. Claude Code plugin and any agent that loads skills.",
   "bin": {
     "fdeops": "bin/install.js",

package/templates/.fde/context.md

@@ -4,7 +4,7 @@
 
 **Engagement:**
 **Customer:**
-**Phase:** land | discover | build | ship | close
+**Phase:** unset
 **Last updated:**
 
 ## Current state