fdeops 5.1.17 → 5.1.19

package/bin/fde.js

@@ -527,10 +527,11 @@ function formatFsError(err, action, target) {
 }
 
 let debriefTransactionActive = false
+let activeFileLocks = 0
 const ownedDebriefLocks = new Set()
 
 function failFs(err, action, target) {
-  if (debriefTransactionActive || ownedDebriefLocks.size) throw new Error(formatFsError(err, action, target))
+  if (activeFileLocks || debriefTransactionActive || ownedDebriefLocks.size) throw new Error(formatFsError(err, action, target))
   console.error(formatFsError(err, action, target))
   process.exit(1)
 }
@@ -546,7 +547,7 @@ function refuseSymlinkWrite(p, opts = {}) {
       const msg = st.isSymbolicLink()
         ? `refused: ${path.basename(p)} is a symlink - write would leave the engagement tree. Replace it with a real file.`
         : `refused: ${path.basename(p)} is not a regular file - remove it and re-run; every write is refused while it is there.`
-      if ((debriefTransactionActive || ownedDebriefLocks.size) && !opts.soft) throw new Error(msg)
+      if ((activeFileLocks || debriefTransactionActive || ownedDebriefLocks.size) && !opts.soft) throw new Error(msg)
       if (opts.soft) return msg
       console.error(msg)
       process.exit(1)
@@ -563,7 +564,7 @@ function refuseSymlinkWrite(p, opts = {}) {
 // appending the same .fde file otherwise interleave/corrupt under load.
 function withFileLock(targetPath, fn, opts = {}) {
   if (ownedDebriefLocks.has(targetPath)) return fn()
-  if (debriefTransactionActive || ownedDebriefLocks.size) opts = { ...opts, soft: true }
+  if (activeFileLocks || debriefTransactionActive || ownedDebriefLocks.size) opts = { ...opts, soft: true }
   const lockPath = targetPath + '.lock'
   const deadline = Date.now() + 5000
   while (true) {
@@ -585,9 +586,12 @@ function withFileLock(targetPath, fn, opts = {}) {
       if (opts.soft) throw e
       failFs(e, 'lock', targetPath)
     }
+    // Filesystem failures must unwind this lock instead of exiting in place.
+    activeFileLocks++
     try {
       return fn()
     } finally {
+      activeFileLocks--
       try { fs.closeSync(fd) } catch (_) {}
       try { fs.unlinkSync(lockPath) } catch (_) {}
     }
@@ -794,6 +798,13 @@ function appendLogEntry(eng, type, entry, opts = {}) {
     })
     // Durable CLI ledger - not rewritten by agent artifact passes.
     lockedAppendFile(path.join(eng, SIGNAL_LEDGER), `${entry}\n`)
+  } else if (type === 'risk') {
+    withFileLock(p, () => {
+      const md = readEng(eng, LOG_FILES[type])
+      const retired = md.search(/^#{1,6}\s+Retired\b/im)
+      const end = retired < 0 ? md.length : retired
+      atomicWriteFile(p, `${md.slice(0, end).trimEnd()}\n\n${entry}\n${retired < 0 ? '' : '\n' + md.slice(end)}`, { soft: true })
+    })
   } else {
     lockedAppendFile(p, `\n${entry}\n`)
   }
@@ -1406,14 +1417,18 @@ function cmdResume(args) {
     // line - resolution is first-match-wins, so appending a second line would
     // leave the stale binding winning and silently write to the wrong client.
     const cwd = process.cwd()
-    const prev = readRegistry().find(r => r.workspace === cwd)
-    const kept = readRegistry().filter(r => r.workspace !== cwd).map(r => `${r.workspace} ${r.slug}`)
-    kept.push(`${cwd} ${slug}`)
+    let prev
     let bindErr = null
     // soft: an unwritable registry must not process.exit() from inside the lock -
     // that skipped the finally and left a stale .registry.lock behind.
     try {
-      withFileLock(REGISTRY, () => { atomicWriteFile(REGISTRY, kept.join('\n') + '\n', { soft: true }) }, { soft: true })
+      withFileLock(REGISTRY, () => {
+        const registry = readRegistry()
+        prev = registry.find(r => r.workspace === cwd)
+        const kept = registry.filter(r => r.workspace !== cwd).map(r => `${r.workspace} ${r.slug}`)
+        kept.push(`${cwd} ${slug}`)
+        atomicWriteFile(REGISTRY, kept.join('\n') + '\n', { soft: true })
+      }, { soft: true })
     } catch (e) { bindErr = e }
     if (bindErr || !readRegistry().some(r => r.workspace === cwd && r.slug === slug)) {
       // Silently unbound is the worst outcome: the memory exists, every later
@@ -1423,7 +1438,6 @@ function cmdResume(args) {
         `could not bind this workspace - ${REGISTRY} is not writable${bindErr ? ` (${bindErr.code || bindErr.message})` : ''}.\n` +
         `  fix the file (it must be a regular file), or work with: export FDEOPS_ENGAGEMENT=${fdeDir}\n`
       )
-      try { fs.unlinkSync(REGISTRY + '.lock') } catch (_) {}
       process.exit(1)
     }
     console.log(`ENGAGEMENT READY: ${fdeDir}\nbound to workspace: ${cwd}`)
@@ -2540,7 +2554,10 @@ function cmdIngest(args) {
     if (args[i] === '--force') { force = true; continue }
     rest.push(args[i])
   }
-  source = sanitizeIngestToken(source, 'manual')
+  // Redact before slugification: filenames no longer retain privacy markers.
+  const cleanMetadata = value => masking.mask(splitPrivate(value, { sealDangling: true }).clean).replace(/[\r\n]+/g, ' ')
+  source = sanitizeIngestToken(cleanMetadata(source), 'manual')
+  title = cleanMetadata(title)
   const titleSlug = sanitizeIngestToken(title || 'notes', 'notes')
   if (!title) title = titleSlug
 
@@ -2574,23 +2591,35 @@ function cmdIngest(args) {
 
   const box = inboxDir(eng)
   try {
-    if (!checkedInbox(eng)) fs.mkdirSync(box)
+    if (!checkedInbox(eng)) {
+      try { fs.mkdirSync(box) } catch (error) { if (error.code !== 'EEXIST') throw error }
+    }
     checkedInbox(eng)
   } catch (e) { failFs(e, 'create inbox', box) }
   const compact = new Date().toISOString().replace(/[-:]/g, '').replace(/\.\d{3}Z$/, 'Z')
-  const id = `${compact}-${source}-${titleSlug}.md`
-  const dest = path.join(box, id)
-  const body = [
-    '---',
-    `source: ${source}`,
-    `title: ${title.replace(/\n/g, ' ')}`,
-    `staged: ${new Date().toISOString()}`,
-    `id: ${id}`,
-    '---',
-    '',
-    input.replace(/\s+$/, '') + '\n',
-  ].join('\n')
-  withFileLock(dest, () => { atomicWriteFile(dest, body) })
+  const stem = `${compact}-${source}-${titleSlug}`
+  let id, dest
+  // Serialize name selection with the write: two agents can stage in one second.
+  withFileLock(path.join(box, '.stage'), () => {
+    let suffix = 0
+    while (true) {
+      id = `${stem}${suffix ? `-${suffix}` : ''}.md`
+      dest = path.join(box, id)
+      try { fs.lstatSync(dest); suffix++ }
+      catch (error) { if (error.code === 'ENOENT') break; throw error }
+    }
+    const body = [
+      '---',
+      `source: ${source}`,
+      `title: ${title.replace(/\n/g, ' ')}`,
+      `staged: ${new Date().toISOString()}`,
+      `id: ${id}`,
+      '---',
+      '',
+      input.replace(/\s+$/, '') + '\n',
+    ].join('\n')
+    atomicWriteFile(dest, body)
+  })
   console.log(`staged → ${dest}`)
   console.log(`id: ${id}`)
   console.log('next:   fde ingest propose ' + id)
@@ -3932,9 +3961,13 @@ function cmdDashboard(args) {
 // Stamped into the vault so a stale folder is identifiable. Best-effort: a
 // missing package.json must not stop an FDE generating their vault.
 function cliVersion() {
-  try {
-    return String(JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8')).version || '')
-  } catch (_) { return '' }
+  for (const file of [path.join(__dirname, 'package.json'), path.join(__dirname, '..', 'package.json')]) {
+    try {
+      const metadata = JSON.parse(fs.readFileSync(file, 'utf8'))
+      if (metadata.name === 'fdeops' && typeof metadata.version === 'string') return metadata.version
+    } catch (_) {}
+  }
+  return ''
 }
 
 function valueLedgerRows(eng) {
@@ -4318,7 +4351,7 @@ switch (cmd) {
   case 'setup': finishAsync(setup.command(setupStore, args)); break
   case 'privacy':
     if (args.length) { console.error('usage: fde privacy'); process.exitCode = 2; break }
-    console.log(`FDEOps ${require('../package.json').version} - identifier masking enabled by default.\nCLI responses, smart proposals, handoff packets and ingest MCP results use local aliases.\nPatterns: common emails, international/US phones, SSN-shaped identifiers and supported credentials.\nNames and arbitrary sensitive prose are not automatically detected; mark them <private> or supply local custom terms with fde setup.\nRaw files, pasted chat and upstream MCP content bypass this protection. Local reports retain identifiers by default; fde setup can also mask newly generated report content.`)
+    console.log(`FDEOps ${cliVersion() || '(version unavailable)'} - identifier masking enabled by default.\nCLI responses, smart proposals, handoff packets and ingest MCP results use local aliases.\nPatterns: common emails, international/US phones, SSN-shaped identifiers and supported credentials.\nNames and arbitrary sensitive prose are not automatically detected; mark them <private> or supply local custom terms with fde setup.\nRaw files, pasted chat and upstream MCP content bypass this protection. Local reports retain identifiers by default; fde setup can also mask newly generated report content.`)
     break
   case 'demo': cmdDemo(args); break
   case 'scan': cmdScan(); break

package/bin/install.js

@@ -22,7 +22,8 @@ const LIB_SRC = path.join(__dirname, 'lib')
 const GLOBAL_SKILLS_DIR = path.join(os.homedir(), '.claude', 'skills')
 const GLOBAL_HOOKS_DIR = path.join(os.homedir(), '.claude', 'hooks')
 const HOOK_SCRIPTS = ['session-start', 'session-stop', 'pre-compact']
-const ENGAGEMENTS_ROOT = path.join(os.homedir(), 'fde-engagements')
+const ENGAGEMENTS_ROOT = (process.env.FDEOPS_ENGAGEMENTS_ROOT || '').trim().replace(/^~/, os.homedir())
+  || path.join(os.homedir(), 'fde-engagements')
 
 function copyDir(src, dest) {
   checkTree(src, dest)
@@ -268,6 +269,7 @@ function installSkills(opts = {}) {
   mkdir(cliHome)
   copyFile(path.join(__dirname, 'fde.js'), path.join(cliHome, 'fde.js'))
   copyDir(LIB_SRC, path.join(cliHome, 'lib'))
+  copyFile(path.join(__dirname, '..', 'package.json'), path.join(cliHome, 'package.json'))
   try { fs.chmodSync(path.join(cliHome, 'fde.js'), '755') } catch (_) {}
   copyDir(FDE_TEMPLATES_SRC, path.join(cliHome, 'templates', '.fde'))
 
@@ -292,7 +294,10 @@ function placePointer(destPath, content, label, appendable) {
   mkdir(path.dirname(destPath))
   if (fs.existsSync(destPath)) {
     const existing = fs.readFileSync(destPath, 'utf8')
-    if (/FDEOS|fdeops/i.test(existing)) {
+    // Templates can change wording; a branded pointer remains installed.
+    const hasIdentity = existing.includes(FDE_MARKER) || /^#\s+fde(?:ops|os)\b/im.test(existing)
+    const hasSkillPointer = /\bskills\/fde\/SKILL\.md\b/.test(existing)
+    if (hasIdentity && hasSkillPointer) {
       console.log(`  skip   ${label} (already wired)`)
       return
     }

package/mcp/fdeops-ingest/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops-ingest-mcp",
-  "version": "5.1.17",
+  "version": "5.1.19",
   "private": true,
   "description": "Thin stdio MCP sink for FDEOps ingest (stage \u2192 propose \u2192 apply). Zero runtime dependencies.",
   "bin": {

package/mcp/fdeops-ingest/server.js

@@ -164,8 +164,11 @@ function runFde(args, stdin, extraEnv) {
 }
 
 function engagementEnv(args) {
-  const p = args && typeof args.engagement === 'string' ? args.engagement.trim() : ''
-  return p ? { FDEOPS_ENGAGEMENT: p } : {}
+  if (!Object.prototype.hasOwnProperty.call(args, 'engagement')) return {}
+  if (typeof args.engagement !== 'string' || !args.engagement.trim()) {
+    throw new Error('engagement must be a non-empty string when supplied; no customer was selected')
+  }
+  return { FDEOPS_ENGAGEMENT: args.engagement.trim() }
 }
 
 function cliPayload(out) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops",
-  "version": "5.1.17",
+  "version": "5.1.19",
   "description": "Skills for forward deployed engineers across strategy, architecture and engineering. Use individual tasks or @fde coordination; local customer memory supports continuity.",
   "bin": {
     "fdeops": "bin/install.js",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "fdeops",
-  "version": "5.1.17",
+  "version": "5.1.19",
   "description": "Skills for forward deployed engineers across strategy, architecture and engineering. Use individual tasks or @fde coordination; local customer memory supports continuity.",
   "author": {
     "name": "Subash Natarajan",