fidelizare-integrate 0.1.0

package/README.md

@@ -0,0 +1,55 @@
+# @fidelizare/integrate
+
+Interactive CLI that integrates the Fidelizare loyalty API into a management /
+POS codebase. It scans the project, finds where the register detects a scanned
+code, and proposes the integration as a reviewed diff, applied only after you
+confirm. Modeled on how mature setup wizards (PostHog) work: a deterministic
+harness around an optional coding agent, with strict permissions.
+
+## Run
+
+```bash
+# visual demo on a bundled sample POS (no key, nothing real touched)
+npx fidelizare-integrate --demo
+
+# on a real project (deterministic, works offline)
+cd /path/to/soft-de-gestiune
+npx fidelizare-integrate
+
+# agentic mode: a real tool-use coding agent (Opus 4.8 via OpenRouter)
+export OPENROUTER_API_KEY=sk-or-...
+npx fidelizare-integrate --agent
+```
+
+Flags: `--demo`, `--dir <path>`, `--agent`, `--model <id>` (default `anthropic/claude-opus-4.8`), `--yes`, `--no-anim`.
+
+## Two modes
+
+- **Deterministic** (default, no key): detect stack -> scan -> propose a helper + the call at the fidelity-card branch -> diff + confirm -> apply. Verified across Node, PHP, Python.
+- **Agentic** (`--agent`, OpenRouter): a real tool-use loop (`src/core/agent-loop.js`) where the model autonomously calls `list_files / read_file / grep / create_file / insert_code / check_syntax / finish`. Every write is gated by an opencode-style permission harness (`y` / `a`=always / `N`), cwd-jailed, secret-redacted, `.bak` backups.
+
+## Tests
+
+`npm test` runs the suite (`node --test`): integration across Node/PHP/Python (with `node --check`, `php -l`, `python -m py_compile`), vault redaction, and the cwd-jail. All green.
+
+## What it does
+
+1. Hand-built ASCII intro + animations (logo sweep, codebase scan beam, spinners, progress) - all in `src/ui/anim.js`, zero animation libraries.
+2. Takes the API key into a **secret vault** (`src/core/vault.js`): the raw key never enters a diff or the agent's context; it is written only to `.env` host-side.
+3. **Detects the stack** (`src/core/detect.js`): C#/.NET, PHP, Delphi, Java, Python, Node.
+4. **Scans** (`src/core/scan.js`) for the safest integration point: where a scanned code is handled / the sale is finalized / a fidelity card is detected.
+5. **Proposes** a minimal change (`src/core/propose.js`, or `agent.js` with Opus): a helper file + the `acumuleazaPuncte(codCard, items, total)` call inserted exactly at the card-detection branch + the import.
+6. Renders a **colored diff**, checks git state, asks to confirm.
+7. **Applies safely** (`src/core/apply.js`): cwd-jailed, read-before-write, `.bak` backups, writes `.env`.
+
+## Safety (what it can and cannot do)
+
+- Only edits files inside the target project (cwd jail; refuses paths outside).
+- Read-before-write; `.bak` backup per edited file; warns if git is dirty / not a repo.
+- The API key is never written into source (verified) - only into `.env`.
+- The generated helper catches API errors so a failed call **never blocks a sale**.
+- Nothing is written until you confirm; `node --check` on the result passes (no broken code).
+
+## Verified
+
+`node src/cli.js --demo --no-anim --yes` produces: a `fidelizare.js` helper, the call inserted in the `isCardFidelitate` branch of `pos.js`, the import added, `.env` with the key (absent from source), both files pass `node --check`, and the integrated POS runs end to end with a graceful API failure.

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "fidelizare-integrate",
+  "version": "0.1.0",
+  "description": "Asistent de integrare Fidelizare pentru softuri de gestiune si case de marcat. Scaneaza codul, gaseste locul potrivit si propune integrarea API-ului, in siguranta.",
+  "type": "module",
+  "bin": {
+    "fidelizare-integrate": "src/cli.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "start": "node src/cli.js",
+    "demo": "node src/cli.js --demo",
+    "test": "node --test tests/*.test.js"
+  },
+  "files": [
+    "src",
+    "sample-pos",
+    "sample-pos-php",
+    "sample-pos-python",
+    "README.md"
+  ],
+  "keywords": [
+    "fidelizare",
+    "loyalty",
+    "pos",
+    "integration",
+    "casa-de-marcat",
+    "soft-de-gestiune"
+  ],
+  "license": "MIT"
+}

package/sample-pos/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "casa-demo",
+  "version": "1.0.0",
+  "private": true,
+  "type": "module",
+  "description": "Mic soft de casa de marcat (demo) pentru asistentul de integrare Fidelizare."
+}

package/sample-pos/pos.js

@@ -0,0 +1,36 @@
+// Casa de marcat (demo). Scannerul apeleaza onScan() pentru fiecare cod citit.
+import { isProduct, priceOf, nameOf } from './products.js';
+
+const cart = [];
+let total = 0;
+
+// Apelat de scannerul de la casa pentru fiecare cod scanat.
+export async function onScan(code) {
+  if (isProduct(code)) {
+    cart.push({ name: nameOf(code), qty: 1, total: priceOf(code) });
+    total += priceOf(code);
+    console.log('Produs adaugat:', nameOf(code), '->', total, 'lei');
+  } else if (isCardFidelitate(code)) {
+    // card de fidelitate detectat (nu este produs)
+    console.log('Card de fidelitate scanat:', code);
+  } else {
+    console.log('Cod necunoscut:', code);
+  }
+}
+
+// Cardurile de fidelitate au 5 cifre si incep cu 1 (ex: 12333).
+function isCardFidelitate(code) {
+  return /^1\d{4}$/.test(code);
+}
+
+export function finalizeSale() {
+  printReceipt(cart, total);
+  cart.length = 0;
+  total = 0;
+}
+
+function printReceipt(items, sum) {
+  console.log('--- BON ---');
+  for (const it of items) console.log(it.name, it.total);
+  console.log('TOTAL', sum, 'lei');
+}

package/sample-pos/products.js

@@ -0,0 +1,16 @@
+// Catalog minimal de produse pentru demo.
+const CATALOG = {
+  '5941234567890': { name: 'Cafea', price: 9.0 },
+  '5941000000011': { name: 'Apa plata', price: 6.0 },
+  '2000000012456': { name: 'Paine', price: 4.5 },
+};
+
+export function isProduct(code) {
+  return Object.prototype.hasOwnProperty.call(CATALOG, code);
+}
+export function priceOf(code) {
+  return CATALOG[code]?.price ?? 0;
+}
+export function nameOf(code) {
+  return CATALOG[code]?.name ?? code;
+}

package/sample-pos-php/composer.json

@@ -0,0 +1 @@
+{ "name": "casa-demo-php", "description": "Casa de marcat demo PHP", "require": {} }

package/sample-pos-php/index.php

@@ -0,0 +1,21 @@
+<?php
+require_once __DIR__ . '/products.php';
+
+$cart = [];
+$total = 0.0;
+
+// Apelat de scannerul de la casa pentru fiecare cod scanat.
+function onScan($code) {
+    global $cart, $total;
+    if (isProduct($code)) {
+        $cart[] = $code;
+        $total += priceOf($code);
+    } elseif (isCardFidelitate($code)) {
+        // card de fidelitate detectat (nu este produs)
+        echo "Card de fidelitate: $code\n";
+    }
+}
+
+function isCardFidelitate($code) {
+    return preg_match('/^1\d{4}$/', $code) === 1;
+}

package/sample-pos-php/products.php

@@ -0,0 +1,3 @@
+<?php
+function isProduct($code) { return in_array($code, ['5941234567890','2000000012456']); }
+function priceOf($code) { return $code === '5941234567890' ? 9.0 : 4.5; }

package/sample-pos-python/pos.py

@@ -0,0 +1,20 @@
+import re
+from products import is_product, price_of
+
+cart = []
+total = 0.0
+
+
+# Apelat de scannerul de la casa pentru fiecare cod scanat.
+def on_scan(code):
+    global total
+    if is_product(code):
+        cart.append(code)
+        total += price_of(code)
+    elif is_card_fidelitate(code):
+        # card de fidelitate detectat (nu este produs)
+        print("Card de fidelitate:", code)
+
+
+def is_card_fidelitate(code):
+    return re.match(r"^1\d{4}$", code) is not None

package/sample-pos-python/products.py

@@ -0,0 +1,3 @@
+CATALOG = {"5941234567890": 9.0, "2000000012456": 4.5}
+def is_product(code): return code in CATALOG
+def price_of(code): return CATALOG.get(code, 0.0)

package/sample-pos-python/requirements.txt

@@ -0,0 +1 @@
+# casa de marcat demo (python) - fara dependinte externe

package/src/cli.js

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+// @fidelizare/integrate — asistent interactiv de integrare a API-ului
+// Fidelizare in softuri de gestiune si case de marcat. Scaneaza codul, gaseste
+// locul potrivit, propune modificarea si o aplica DOAR dupa confirmare.
+import { mkdtempSync, cpSync, writeFileSync, appendFileSync, existsSync, readFileSync } from 'fs';
+import { join, resolve } from 'path';
+import { tmpdir } from 'os';
+import { fileURLToPath } from 'url';
+import readline from 'node:readline/promises';
+import { stdin as input, stdout as output } from 'node:process';
+
+import { ansi, C, paint, bold, out, sleep } from './ui/ansi.js';
+import { logoIntro, withSpinner, scanSweep, heading, note, rule, setAnim } from './ui/anim.js';
+import { detectStack, listSourceFiles } from './core/detect.js';
+import { scanForIntegrationPoints } from './core/scan.js';
+import { proposeChange } from './core/propose.js';
+import { runAgentLoop } from './core/agent-loop.js';
+import { renderPlan, applyPlan, gitState, undoHint } from './core/apply.js';
+import { vaultPut, vaultResolve } from './core/vault.js';
+
+const args = process.argv.slice(2);
+const has = (f) => args.includes(f);
+const val = (f, d) => { const i = args.indexOf(f); return i >= 0 ? args[i + 1] : d; };
+if (has('--no-anim')) setAnim(false);
+const DEMO = has('--demo');
+const AUTO = has('--yes') || has('-y');
+const HERE = resolve(fileURLToPath(new URL('.', import.meta.url)), '..');
+
+async function main() {
+  await logoIntro();
+
+  // 1. Target directory
+  let root;
+  if (DEMO) {
+    const tmp = mkdtempSync(join(tmpdir(), 'fidelizare-demo-'));
+    cpSync(join(HERE, 'sample-pos'), tmp, { recursive: true });
+    root = tmp;
+    note('Mod demo: proiect de test copiat in ' + paint(root, C.white), C.ink);
+  } else {
+    root = resolve(val('--dir', process.cwd()));
+    note('Proiect: ' + paint(root, C.white), C.ink);
+  }
+  rule();
+
+  const rl = readline.createInterface({ input, output });
+  const ask = async (q) => (await rl.question('  ' + paint(q, C.white) + ' ')).trim();
+
+  // 2. API key into the vault (never written to diffs/agent context)
+  heading('Autentificare');
+  let rawKey;
+  if (DEMO) {
+    rawKey = 's2s_beta_demo_0000000000000000000000000000';
+    note('Cheie API demo incarcata in seif (nu apare niciodata in cod sau in agent).', C.ink);
+  } else {
+    rawKey = await ask('Lipeste cheia ta API Fidelizare:');
+    if (!rawKey) { note('Fara cheie API. Inchidem.', C.amber); rl.close(); return; }
+  }
+  const keyRef = vaultPut(rawKey, 'Fidelizare API key');
+  note('Seif: ' + paint(keyRef, C.green) + '  (valoarea reala ramane doar local)', C.dim);
+  rule();
+
+  // 3. Detect stack
+  heading('Analiza codului');
+  const det = await withSpinner('Detectez limbajul si structura proiectului', async () => {
+    await sleep(500);
+    return detectStack(root);
+  });
+  note('Limbaj: ' + bold(paint(det.label, C.red)) + paint('  (' + (det.via || '?') + ')', C.dim));
+
+  // 4. Scan for integration points
+  await scanSweep('Caut unde se citeste codul scanat si se finalizeaza bonul…', 1700);
+  const files = listSourceFiles(root);
+  const candidates = await withSpinner('Evaluez cele mai sigure locuri de integrare', async () => {
+    await sleep(400);
+    return scanForIntegrationPoints(files, root);
+  });
+
+  if (candidates.length === 0) {
+    note('Nu am gasit un punct clar de integrare. Ruleaza cu --dir spre folderul softului.', C.amber);
+    rl.close();
+    return;
+  }
+  const top = candidates[0];
+  note('Punct gasit: ' + bold(paint(top.rel, C.white)) +
+    paint('  linia ' + top.topLine.line + '  (' + top.topLine.reasons.join(', ') + ')', C.dim));
+  rule();
+
+  const git = gitState(root);
+
+  // 5a. Agentic tool-loop (real coding agent): the model uses tools and
+  // applies the integration itself, each write gated by confirmation.
+  if (has('--agent') && (process.env.OPENROUTER_API_KEY || process.env.FIDELIZARE_LLM_KEY)) {
+    heading('Agent de integrare');
+    if (!git.isRepo) note('• Nu e repo git. Fac copii .bak la fiecare modificare.', C.amber);
+    else if (!git.clean) note('• Repo git cu modificari necomise (le poti anula cu git checkout).', C.amber);
+    else note('• Repo git curat. Orice modificare e reversibila.', C.green);
+    note('• Agent: ' + bold(paint(val('--model') || 'Opus 4.8', C.red)) +
+      paint('  tool-uri: list/read/grep/create/insert/check. Fiecare scriere cere confirmare.', C.dim));
+    out('\n');
+    const r = await runAgentLoop({
+      stack: det.stack, rootDir: root, files,
+      askRaw: ask, auto: AUTO, model: val('--model'), log: out,
+    });
+    if (r.ok) {
+      writeEnv(root, vaultResolve(keyRef));
+      rule(); heading('Gata');
+      note('Rezumat agent: ' + r.summary, C.white);
+      note('Fisiere atinse: ' + (r.changes.join(', ') || '—'), C.ink);
+      note('Configuratie: .env (cheia API, nu in cod). Anulare: fisiere .bak / git checkout.', C.dim);
+      note('Test: scaneaza un cod de fidelitate (ex 12333) si verifica punctele.', C.ink);
+      out('\n  ' + paint('Integrare pregatita.', C.green) + ' ' + paint('Fidelizare', C.red) + '\n\n');
+      rl.close();
+      return;
+    }
+    note('Agent indisponibil (' + r.reason + '). Trec la propunerea determinista.', C.amber);
+  }
+
+  // 5b. Deterministic proposer (fallback / no key).
+  heading('Propunere de integrare');
+  let plan = null;
+  if (!plan) {
+    plan = await withSpinner('Construiesc modificarea minima si sigura', async () => {
+      await sleep(500);
+      return proposeChange({ stack: det.stack, candidate: top, rootDir: root });
+    });
+  }
+  if (!plan) {
+    note('Nu pot genera o propunere pentru acest limbaj inca: ' + det.label, C.amber);
+    rl.close();
+    return;
+  }
+  note(plan.summary, C.ink);
+  renderPlan(plan, root);
+  rule();
+
+  // 6. Safety: git state + confirmation (git computed above)
+  heading('Siguranta');
+  if (!git.isRepo) note('• Nu e repo git. Vom face copii .bak pentru fiecare fisier modificat.', C.amber);
+  else if (!git.clean) note('• Repo git cu modificari necomise. Recomandat: commit inainte (le poti anula cu git checkout).', C.amber);
+  else note('• Repo git curat. Orice modificare poate fi anulata cu git checkout.', C.green);
+  note('• Modific doar fisiere din proiect. Cheia API merge in .env, nu in cod.', C.green);
+
+  let go = AUTO;
+  if (!AUTO) {
+    const a = (await ask('\n  Aplic modificarile? [y/N]')).toLowerCase();
+    go = a === 'y' || a === 'yes' || a === 'da' || a === 'd';
+  }
+  if (!go) { note('Anulat. Nimic nu a fost scris.', C.amber); rl.close(); return; }
+
+  // 7. Apply + write .env (secret resolved host-side from the vault)
+  const res = await withSpinner('Aplic modificarile si scriu configuratia', async () => {
+    await sleep(500);
+    const r = applyPlan(plan, root);
+    const envPath = join(root, '.env');
+    const keyVal = vaultResolve(keyRef);
+    const block = `\n# Fidelizare\nFIDELIZARE_API_KEY=${keyVal}\nFIDELIZARE_STORE_ID=MAGAZINUL-TAU\nFIDELIZARE_POS_ID=CASA-1\n`;
+    if (!existsSync(envPath) || !readFileSync(envPath, 'utf8').includes('FIDELIZARE_API_KEY')) {
+      appendFileSync(envPath, block);
+    }
+    r.written.push(envPath);
+    return r;
+  });
+
+  rule();
+  heading('Gata');
+  note('Fisiere scrise:', C.white);
+  for (const w of res.written) out('    ' + paint('•', C.green) + ' ' + paint(w.replace(root, '.'), C.ink) + '\n');
+  out('\n');
+  undoHint(root, res);
+  note('Test: ruleaza un cod de fidelitate (ex 12333) prin scanner si verifica punctele in panoul tau.', C.ink);
+  note('Documentatie completa: cere acces pe fidelizare.ro/integrare', C.dim);
+  out('\n  ' + paint('Integrare pregatita.', C.green) + ' ' + paint('Fidelizare', C.red) + '\n\n');
+  rl.close();
+}
+
+// Write the Fidelizare config block to .env (idempotent). The key comes from
+// the host-side vault, never from a diff or the model.
+function writeEnv(root, keyVal) {
+  const envPath = join(root, '.env');
+  if (existsSync(envPath) && readFileSync(envPath, 'utf8').includes('FIDELIZARE_API_KEY')) return;
+  appendFileSync(envPath, `\n# Fidelizare\nFIDELIZARE_API_KEY=${keyVal}\nFIDELIZARE_STORE_ID=MAGAZINUL-TAU\nFIDELIZARE_POS_ID=CASA-1\n`);
+}
+
+main().catch((e) => {
+  out('\n  ' + paint('Eroare: ', C.redBright) + (e?.message || String(e)) + '\n');
+  out(ansi.showCursor);
+  process.exit(1);
+});

package/src/core/agent-loop.js

@@ -0,0 +1,150 @@
+// A real agentic tool-use loop (like a coding agent: opencode / Claude Code).
+// The model autonomously calls tools to explore the repo and apply the
+// integration. Every tool is gated by a permission harness:
+//   - reads are cwd-jailed and secret-redacted
+//   - writes go through a diff + confirmation (auto only with --yes), .bak backup
+//   - the only command it can run is a syntax check (no arbitrary shell)
+//   - a hard step cap prevents runaway
+// Runs on OpenRouter (function-calling), default Opus 4.8.
+import { readFileSync, existsSync } from 'fs';
+import { relative, join, resolve, extname } from 'path';
+import { execFileSync } from 'child_process';
+import { redact } from './vault.js';
+import { safeCreateFile, safeInsert, insideRoot } from './apply.js';
+import { C, paint, out } from '../ui/ansi.js';
+
+const URL = 'https://openrouter.ai/api/v1/chat/completions';
+const DEFAULT_MODEL = 'anthropic/claude-opus-4.8';
+const MAX_STEPS = 24;
+
+const SYSTEM = `Esti un agent de integrare care lucreaza DIRECT in codul unui soft de
+gestiune / casa de marcat, prin apeluri de tool. Scopul: integreaza API-ul
+Fidelizare astfel incat, cand scannerul citeste un cod de fidelitate (nu un
+produs), softul sa apeleze POST https://fidelizare.ro/api/integration/s2s/submitReceipt.
+
+Lucreaza in pasi: foloseste tool-urile pentru a citi codul (list_files, read_file,
+grep), apoi creeaza un fisier helper (create_file) care apeleaza API-ul folosind
+cheia din variabila de mediu FIDELIZARE_API_KEY (NICIODATA cheie in cod), intr-un
+try/catch ce nu blocheaza vanzarea; apoi insereaza apelul (insert_code) exact la
+ramura unde se detecteaza cardul, plus importul. Verifica cu check_syntax. La final
+apeleaza finish.
+
+Reguli: modificari minime, fara refactor; pastreaza stilul; nu inventa cai de fisier.`;
+
+const TOOLS = [
+  { type: 'function', function: { name: 'list_files', description: 'Listeaza fisierele sursa din proiect.', parameters: { type: 'object', properties: {} } } },
+  { type: 'function', function: { name: 'read_file', description: 'Citeste un fisier (cu numere de linie).', parameters: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'] } } },
+  { type: 'function', function: { name: 'grep', description: 'Cauta un pattern (regex) in tot codul.', parameters: { type: 'object', properties: { pattern: { type: 'string' } }, required: ['pattern'] } } },
+  { type: 'function', function: { name: 'create_file', description: 'Creeaza un fisier nou (gated: confirmare + backup).', parameters: { type: 'object', properties: { path: { type: 'string' }, content: { type: 'string' } }, required: ['path', 'content'] } } },
+  { type: 'function', function: { name: 'insert_code', description: 'Insereaza linii dupa atLine (gated: diff + confirmare + backup).', parameters: { type: 'object', properties: { path: { type: 'string' }, atLine: { type: 'number' }, lines: { type: 'array', items: { type: 'string' } }, reason: { type: 'string' } }, required: ['path', 'atLine', 'lines'] } } },
+  { type: 'function', function: { name: 'check_syntax', description: 'Verifica sintaxa unui fisier (doar Node).', parameters: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'] } } },
+  { type: 'function', function: { name: 'finish', description: 'Termina integrarea.', parameters: { type: 'object', properties: { summary: { type: 'string' } }, required: ['summary'] } } },
+];
+
+export async function runAgentLoop({ stack, rootDir, files, askRaw, auto, model, log }) {
+  const key = process.env.OPENROUTER_API_KEY || process.env.FIDELIZARE_LLM_KEY;
+  if (!key) return { ok: false, reason: 'no_key' };
+  const usedModel = model || DEFAULT_MODEL;
+
+  const rel = (p) => relative(rootDir, p);
+  const abs = (p) => resolve(join(rootDir, p));
+  const changes = [];
+  let finished = null;
+
+  // Permission harness (opencode-style): read/grep/list/check are auto-allowed;
+  // writes ask, with an "always" reply that approves that action for the run.
+  const policy = { create_file: 'ask', insert_code: 'ask' };
+  const permit = async (action, label) => {
+    if (auto || policy[action] === 'allow') return true;
+    const a = (await askRaw(label + ' [y=da / a=mereu / N=nu]')).toLowerCase();
+    if (a === 'a' || a === 'mereu' || a === 'always') { policy[action] = 'allow'; return true; }
+    return a === 'y' || a === 'yes' || a === 'da' || a === 'd';
+  };
+
+  const tools = {
+    list_files: () => files.map(rel).join('\n') || '(niciun fisier)',
+    read_file: ({ path }) => {
+      const a = abs(path);
+      if (!insideRoot(rootDir, a) || !existsSync(a)) return 'EROARE: fisier inexistent';
+      const body = redact(readFileSync(a, 'utf8')).split('\n').slice(0, 300);
+      return body.map((l, i) => `${i + 1}: ${l}`).join('\n');
+    },
+    grep: ({ pattern }) => {
+      let re; try { re = new RegExp(pattern, 'i'); } catch { return 'regex invalid'; }
+      const hits = [];
+      for (const f of files) {
+        let t; try { t = readFileSync(f, 'utf8'); } catch { continue; }
+        t.split('\n').forEach((l, i) => { if (re.test(l)) hits.push(`${rel(f)}:${i + 1}: ${redact(l.trim()).slice(0, 120)}`); });
+        if (hits.length > 60) break;
+      }
+      return hits.slice(0, 60).join('\n') || '(fara potriviri)';
+    },
+    create_file: async ({ path, content }) => {
+      const a = abs(path);
+      if (!insideRoot(rootDir, a)) return 'REFUZAT: in afara proiectului';
+      log('\n  ' + paint('＋ fisier nou  ', C.green) + paint(rel(a), C.white) + '\n');
+      content.split('\n').slice(0, 12).forEach((l) => log('    ' + paint('+ ', C.green) + paint(redact(l), C.ink) + '\n'));
+      if (!(await permit('create_file', 'Creez acest fisier?'))) return 'REFUZAT de utilizator';
+      const r = safeCreateFile(rootDir, a, content);
+      changes.push(rel(a)); return 'OK creat (' + r.lines + ' linii)';
+    },
+    insert_code: async ({ path, atLine, lines, reason }) => {
+      const a = abs(path);
+      if (!insideRoot(rootDir, a) || !existsSync(a)) return 'REFUZAT: fisier inexistent';
+      const src = readFileSync(a, 'utf8').split('\n');
+      log('\n  ' + paint('✎ ' + rel(a) + ' @ linia ' + atLine, C.amber) + (reason ? paint('  ' + reason, C.dim) : '') + '\n');
+      for (let i = Math.max(0, atLine - 2); i < atLine; i++) log('    ' + paint('  ' + (src[i] ?? ''), C.dim) + '\n');
+      lines.forEach((l) => log('    ' + paint('+ ' + l, C.green) + '\n'));
+      if (!(await permit('insert_code', 'Aplic aceasta modificare?'))) return 'REFUZAT de utilizator';
+      const r = safeInsert(rootDir, a, atLine, lines);
+      changes.push(rel(a)); return 'OK inserat ' + r.added + ' linii dupa ' + r.atLine;
+    },
+    check_syntax: ({ path }) => {
+      const a = abs(path);
+      if (!existsSync(a)) return 'fisier inexistent';
+      if (!['.js', '.mjs', '.cjs'].includes(extname(a))) return 'omis (verificare doar pentru Node)';
+      try { execFileSync('node', ['--check', a], { stdio: 'pipe' }); return 'OK sintaxa valida'; }
+      catch (e) { return 'EROARE sintaxa: ' + (e.stderr?.toString() || e.message).slice(0, 300); }
+    },
+    finish: ({ summary }) => { finished = summary || 'gata'; return 'gata'; },
+  };
+
+  const messages = [
+    { role: 'system', content: SYSTEM },
+    { role: 'user', content: `Stack: ${stack}. Proiect cu ${files.length} fisiere sursa. Integreaza API-ul Fidelizare. Incepe prin a te orienta in cod.` },
+  ];
+
+  for (let step = 0; step < MAX_STEPS && !finished; step++) {
+    let data;
+    try {
+      const res = await fetch(URL, {
+        method: 'POST',
+        headers: { Authorization: 'Bearer ' + key, 'Content-Type': 'application/json', 'X-Title': 'Fidelizare Integrate' },
+        body: JSON.stringify({ model: usedModel, temperature: 0, tools: TOOLS, messages }),
+        signal: AbortSignal.timeout(90_000),
+      });
+      if (!res.ok) return { ok: false, reason: 'http_' + res.status };
+      data = await res.json();
+    } catch (e) { return { ok: false, reason: 'fetch:' + (e?.message || e) }; }
+
+    const msg = data.choices?.[0]?.message;
+    if (!msg) return { ok: false, reason: 'no_message' };
+    messages.push(msg);
+    const calls = msg.tool_calls || [];
+    if (calls.length === 0) {
+      // model spoke without a tool call; nudge once, else stop
+      if (step > 0 && !finished) break;
+      messages.push({ role: 'user', content: 'Continua folosind tool-urile. Cand ai terminat, apeleaza finish.' });
+      continue;
+    }
+    for (const call of calls) {
+      let arg = {};
+      try { arg = JSON.parse(call.function.arguments || '{}'); } catch { /* */ }
+      const fn = tools[call.function.name];
+      const result = fn ? await fn(arg) : 'tool necunoscut';
+      messages.push({ role: 'tool', tool_call_id: call.id, content: String(result) });
+    }
+  }
+
+  return { ok: true, changes: [...new Set(changes)], summary: finished || 'oprit', model: usedModel };
+}

package/src/core/apply.js

@@ -0,0 +1,117 @@
+// Safe application of a change plan. Guarantees:
+//  - cwd jail: refuses to touch anything outside the target root.
+//  - read-before-write: edits re-read the file immediately before writing.
+//  - reversible: a .bak copy is written for every edited file; new files are
+//    listed so they can be removed.
+//  - dry-run by default at the plan level; nothing is written without confirm.
+import { readFileSync, writeFileSync, existsSync, copyFileSync } from 'fs';
+import { resolve, relative, dirname } from 'path';
+import { execFileSync } from 'child_process';
+import { ansi, C, paint, out } from '../ui/ansi.js';
+
+export function gitState(dir) {
+  try {
+    execFileSync('git', ['rev-parse', '--is-inside-work-tree'], { cwd: dir, stdio: 'ignore' });
+  } catch {
+    return { isRepo: false, clean: false };
+  }
+  try {
+    const o = execFileSync('git', ['status', '--porcelain'], { cwd: dir }).toString();
+    return { isRepo: true, clean: o.trim().length === 0 };
+  } catch {
+    return { isRepo: true, clean: false };
+  }
+}
+
+function insideRoot(root, p) {
+  const rel = relative(resolve(root), resolve(p));
+  return rel && !rel.startsWith('..') && !resolve(p).includes('\0');
+}
+
+// Render a colored preview of the plan. No writes.
+export function renderPlan(plan, rootDir) {
+  for (const nf of plan.newFiles) {
+    out('\n  ' + paint('＋ fisier nou  ', C.green) + paint(relative(rootDir, nf.path), C.white) + '\n');
+    const lines = nf.content.split('\n').slice(0, 14);
+    for (const l of lines) out('    ' + paint('+ ', C.green) + paint(l, C.ink) + '\n');
+    if (nf.content.split('\n').length > 14) out('    ' + paint('  …', C.dim) + '\n');
+  }
+  // group edits by file
+  const byFile = new Map();
+  for (const e of plan.edits) {
+    if (!byFile.has(e.path)) byFile.set(e.path, []);
+    byFile.get(e.path).push(e);
+  }
+  for (const [file, edits] of byFile) {
+    out('\n  ' + paint('✎ modific     ', C.amber) + paint(relative(rootDir, file), C.white) + '\n');
+    const src = readFileSync(file, 'utf8').split('\n');
+    for (const e of edits.sort((a, b) => a.atLine - b.atLine)) {
+      const ctx = Math.max(0, e.atLine - 2);
+      out('    ' + paint(`@@ linia ${e.atLine}  ${e.reason}`, C.dim) + '\n');
+      for (let i = ctx; i < e.atLine; i++) out('    ' + paint('  ' + (src[i] ?? ''), C.dim) + '\n');
+      for (const ins of e.insert) out('    ' + paint('+ ' + ins, C.green) + '\n');
+      if (src[e.atLine] !== undefined) out('    ' + paint('  ' + src[e.atLine], C.dim) + '\n');
+    }
+  }
+}
+
+// Apply the plan. Returns a summary of what was written + how to undo.
+export function applyPlan(plan, rootDir) {
+  const written = [];
+  const backups = [];
+
+  for (const nf of plan.newFiles) {
+    if (!insideRoot(rootDir, nf.path)) throw new Error('refuz scriere in afara proiectului: ' + nf.path);
+    if (existsSync(nf.path)) {
+      copyFileSync(nf.path, nf.path + '.bak');
+      backups.push(nf.path + '.bak');
+    }
+    writeFileSync(nf.path, nf.content, 'utf8');
+    written.push(nf.path);
+  }
+
+  // group edits per file, apply bottom-up so line numbers stay valid
+  const byFile = new Map();
+  for (const e of plan.edits) {
+    if (!insideRoot(rootDir, e.path)) throw new Error('refuz scriere in afara proiectului: ' + e.path);
+    if (!byFile.has(e.path)) byFile.set(e.path, []);
+    byFile.get(e.path).push(e);
+  }
+  for (const [file, edits] of byFile) {
+    // read-before-write
+    const lines = readFileSync(file, 'utf8').split('\n');
+    copyFileSync(file, file + '.bak');
+    backups.push(file + '.bak');
+    for (const e of edits.sort((a, b) => b.atLine - a.atLine)) {
+      lines.splice(e.atLine, 0, ...e.insert);
+    }
+    writeFileSync(file, lines.join('\n'), 'utf8');
+    written.push(file);
+  }
+  return { written, backups };
+}
+
+// --- Granular, gated primitives used by the agent tool-loop. Each is
+// cwd-jailed, read-before-write, and leaves a .bak. ---
+export function safeCreateFile(rootDir, absPath, content) {
+  if (!insideRoot(rootDir, absPath)) throw new Error('in afara proiectului');
+  if (existsSync(absPath)) { copyFileSync(absPath, absPath + '.bak'); }
+  writeFileSync(absPath, content, 'utf8');
+  return { path: absPath, lines: content.split('\n').length };
+}
+export function safeInsert(rootDir, absPath, atLine, insertLines) {
+  if (!insideRoot(rootDir, absPath)) throw new Error('in afara proiectului');
+  if (!existsSync(absPath)) throw new Error('fisier inexistent');
+  const lines = readFileSync(absPath, 'utf8').split('\n'); // read-before-write
+  copyFileSync(absPath, absPath + '.bak');
+  const at = Math.max(0, Math.min(atLine, lines.length));
+  lines.splice(at, 0, ...insertLines);
+  writeFileSync(absPath, lines.join('\n'), 'utf8');
+  return { path: absPath, atLine: at, added: insertLines.length };
+}
+export { insideRoot };
+
+export function undoHint(rootDir, result) {
+  out('  ' + paint('Anulare:', C.ink) + ' restaureaza din fisierele .bak sau ' + paint('git checkout .', C.white) + '\n');
+  void rootDir; void result;
+}

package/src/core/detect.js

@@ -0,0 +1,70 @@
+// Detect the vendor's stack from manifest/extension signals. Read-only.
+import { readdirSync, existsSync, statSync } from 'fs';
+import { join, extname } from 'path';
+
+const MANIFESTS = [
+  { file: 'composer.json', stack: 'php', label: 'PHP' },
+  { file: 'package.json', stack: 'node', label: 'Node.js' },
+  { file: 'requirements.txt', stack: 'python', label: 'Python' },
+  { file: 'pyproject.toml', stack: 'python', label: 'Python' },
+  { file: 'pom.xml', stack: 'java', label: 'Java' },
+  { file: 'build.gradle', stack: 'java', label: 'Java' },
+];
+const EXT_STACK = {
+  '.cs': { stack: 'csharp', label: 'C# / .NET' },
+  '.csproj': { stack: 'csharp', label: 'C# / .NET' },
+  '.php': { stack: 'php', label: 'PHP' },
+  '.dpr': { stack: 'delphi', label: 'Delphi' },
+  '.dproj': { stack: 'delphi', label: 'Delphi' },
+  '.pas': { stack: 'delphi', label: 'Delphi' },
+  '.java': { stack: 'java', label: 'Java' },
+  '.py': { stack: 'python', label: 'Python' },
+  '.ts': { stack: 'node', label: 'Node.js' },
+  '.js': { stack: 'node', label: 'Node.js' },
+};
+const IGNORE = new Set(['node_modules', '.git', 'dist', 'build', 'bin', 'obj', 'vendor', '.next', '__pycache__']);
+
+export function listSourceFiles(dir, max = 4000) {
+  const out = [];
+  const walk = (d) => {
+    if (out.length >= max) return;
+    let entries;
+    try { entries = readdirSync(d, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      if (out.length >= max) return;
+      if (e.name.startsWith('.') && e.name !== '.') continue;
+      if (IGNORE.has(e.name)) continue;
+      const p = join(d, e.name);
+      if (e.isDirectory()) walk(p);
+      else if (EXT_STACK[extname(e.name).toLowerCase()]) out.push(p);
+    }
+  };
+  walk(dir);
+  return out;
+}
+
+export function detectStack(dir) {
+  for (const m of MANIFESTS) {
+    if (existsSync(join(dir, m.file))) return { stack: m.stack, label: m.label, via: m.file };
+  }
+  // fall back to extension frequency
+  const files = listSourceFiles(dir, 2000);
+  const counts = {};
+  for (const f of files) {
+    const s = EXT_STACK[extname(f).toLowerCase()];
+    if (s) counts[s.stack] = (counts[s.stack] || 0) + 1;
+  }
+  const best = Object.entries(counts).sort((a, b) => b[1] - a[1])[0];
+  if (!best) return { stack: 'unknown', label: 'necunoscut', via: null };
+  const label = Object.values(EXT_STACK).find((x) => x.stack === best[0])?.label || best[0];
+  return { stack: best[0], label, via: 'extensii (' + best[1] + ' fisiere)' };
+}
+
+export function isGitClean(dir) {
+  // Best-effort: if not a git repo, treat as "unknown" (caller warns).
+  try {
+    const { execSync } = require('child_process');
+    void execSync;
+  } catch { /* esm: use dynamic */ }
+  return null; // resolved in cli via child_process
+}

package/src/core/propose.js

@@ -0,0 +1,91 @@
+// Deterministic proposal: given the detected stack and the best candidate
+// location, build a safe change plan (a new helper file + the inserted call +
+// an import). Language-aware indentation and import anchoring so the result
+// stays syntactically valid. Runs without an LLM; the agent mode (agent-loop)
+// replaces it for arbitrary real codebases.
+import { readFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { HELPERS } from './snippets.js';
+
+export function proposeChange({ stack, candidate, rootDir }) {
+  const helper = HELPERS[stack];
+  if (!helper) return null;
+
+  const plan = { stack, newFiles: [], edits: [], summary: '' };
+  const targetDir = candidate ? dirname(candidate.file) : rootDir;
+  if (helper.content) {
+    plan.newFiles.push({ path: join(targetDir, helper.filename), content: helper.content });
+  }
+
+  if (candidate) {
+    const lines = readFileSync(candidate.file, 'utf8').split('\n');
+    const at = findFidelityLine(lines) ?? candidate.topLine.line;
+    const bodyIndent = blockBodyIndent(lines, at);
+    const codVar = inferCodeVar(lines[at - 1], stack);
+    const cmt = stack === 'python' ? '#' : '//';
+
+    plan.edits.push({
+      path: candidate.file,
+      atLine: at,
+      insert: [
+        bodyIndent + cmt + ' Fidelizare: cod de fidelitate detectat -> acumuleaza puncte',
+        bodyIndent + helper.call(codVar),
+      ],
+      reason: 'Apel API la detectarea cardului de fidelitate',
+    });
+
+    if (helper.importLine) {
+      const anchor = importAnchor(lines, stack);
+      plan.edits.push({ path: candidate.file, atLine: anchor, insert: [helper.importLine], reason: 'Import helper Fidelizare' });
+    }
+  }
+
+  plan.summary = `${plan.newFiles.length} fisier nou + ${plan.edits.length} modificare in ` +
+    (candidate ? candidate.rel : 'proiect');
+  return plan;
+}
+
+// The safest place to call the API is exactly where the code detects a
+// fidelity card (a branch on it).
+function findFidelityLine(lines) {
+  const FID = /(fidelit|fideliz|loyalty|loyaltycard|cardclient)/i;
+  const BRANCH = /\b(if|elif|else|when|case|switch)\b/i;
+  for (let i = 0; i < lines.length; i++) {
+    if (FID.test(lines[i]) && BRANCH.test(lines[i]) && !/^\s*(\/\/|#|\*)/.test(lines[i])) return i + 1;
+  }
+  for (let i = 0; i < lines.length; i++) {
+    if (FID.test(lines[i]) && !/^\s*(\/\/|#|\*)/.test(lines[i])) return i + 1;
+  }
+  return null;
+}
+
+// Match the indentation of the block opened at `at` by looking at the next
+// non-empty line that is more indented; else the line indent + one step.
+function blockBodyIndent(lines, at) {
+  const own = lines[at - 1].match(/^\s*/)?.[0] || '';
+  for (let i = at; i < lines.length; i++) {
+    if (!lines[i].trim()) continue;
+    const ind = lines[i].match(/^\s*/)?.[0] || '';
+    if (ind.length > own.length) return ind;
+    break;
+  }
+  return own + (own.includes('\t') ? '\t' : '    ');
+}
+
+function inferCodeVar(line, stack) {
+  const matches = [...line.matchAll(/\(\s*(\$?[a-zA-Z_][\w$]*)\s*\)/g)];
+  if (matches.length) return matches[matches.length - 1][1];
+  return stack === 'php' ? '$code' : 'code';
+}
+
+function importAnchor(lines, stack) {
+  const IMP = /^\s*(import |from .+ import|require_once|require|use |#include|uses )/i;
+  let last = 0;
+  lines.forEach((l, i) => { if (IMP.test(l)) last = i + 1; });
+  if (last > 0) return last;
+  if (stack === 'php') {
+    const tag = lines.findIndex((l) => /<\?php/.test(l));
+    return tag >= 0 ? tag + 1 : 0;
+  }
+  return 0;
+}

package/src/core/scan.js

@@ -0,0 +1,50 @@
+// Find the most reliable place to call the Fidelizare API: where the POS
+// handles a scanned code / finalizes a sale. Read-only, pattern + heuristic
+// ranking. Returns ranked candidates with file, line, and why.
+import { readFileSync } from 'fs';
+import { relative } from 'path';
+
+// Signals that a line is near the scan / sale-finalize logic. Weighted.
+const SIGNALS = [
+  { re: /(on_?scan|scannerinput|barcodescanned|onbarcode|citirecod|codscanat|handlescan)/i, w: 10, why: 'handler de scanare' },
+  { re: /(fidelit|fideliz|loyalty|loyaltycard|cardclient)/i, w: 9, why: 'card de fidelitate' },
+  { re: /(barcod|scanner|scaner|ean13|cod_?bare|cod de bare)/i, w: 6, why: 'cod de bare / scanner' },
+  { re: /(finalize|finalizeaz|inchidebon|closereceipt|emitebon|printreceipt|tipareste)/i, w: 7, why: 'finalizare bon' },
+  { re: /(additem|adaugaprodus|scanitem|isproduct|esteprodus)/i, w: 4, why: 'adaugare produs' },
+  { re: /(receipt|totalbon|coscumparaturi|\bcart\b)/i, w: 3, why: 'context bon' },
+];
+
+export function scanForIntegrationPoints(files, rootDir) {
+  const candidates = [];
+  for (const file of files) {
+    let text;
+    try { text = readFileSync(file, 'utf8'); } catch { continue; }
+    if (text.length > 600_000) continue; // skip huge/minified
+    const lines = text.split('\n');
+    let fileScore = 0;
+    const hits = [];
+    lines.forEach((line, idx) => {
+      let lineScore = 0;
+      const reasons = [];
+      for (const s of SIGNALS) {
+        if (s.re.test(line)) { lineScore += s.w; reasons.push(s.why); }
+      }
+      if (lineScore > 0) {
+        fileScore += lineScore;
+        hits.push({ line: idx + 1, text: line.trim().slice(0, 100), score: lineScore, reasons });
+      }
+    });
+    if (fileScore > 0) {
+      hits.sort((a, b) => b.score - a.score);
+      candidates.push({
+        file,
+        rel: relative(rootDir, file),
+        score: fileScore,
+        topLine: hits[0],
+        hits: hits.slice(0, 4),
+      });
+    }
+  }
+  candidates.sort((a, b) => b.score - a.score);
+  return candidates;
+}

package/src/core/snippets.js

@@ -0,0 +1,187 @@
+// Canonical integration artifacts per stack: a helper file that wraps the
+// Fidelizare API call, and the call inserted where the POS detects a fidelity
+// card. The API key is referenced from the environment, never inlined.
+
+export const HELPERS = {
+  node: {
+    filename: 'fidelizare.js',
+    importLine: `import { acumuleazaPuncte } from "./fidelizare.js";`,
+    call: (v) => `await acumuleazaPuncte(${v}, cart, total);`,
+    content: `// Generat de fidelizare-integrate. Cheia din mediu, niciodata in cod.
+const FIDELIZARE_API = "https://fidelizare.ro/api/integration/s2s/submitReceipt";
+
+export async function acumuleazaPuncte(codFidelitate, items, total) {
+  try {
+    const bon = "BF" + Date.now();
+    const res = await fetch(FIDELIZARE_API, {
+      method: "POST",
+      headers: {
+        Authorization: "Bearer " + process.env.FIDELIZARE_API_KEY,
+        "Content-Type": "application/json",
+        "Idempotency-Key": "BON-" + bon,
+      },
+      body: JSON.stringify({
+        store_id: process.env.FIDELIZARE_STORE_ID || "MAGAZINUL-TAU",
+        pos_id: process.env.FIDELIZARE_POS_ID || "CASA-1",
+        receipt_number: bon,
+        fidelity_card: codFidelitate,
+        total,
+        items,
+      }),
+    });
+    return await res.json();
+  } catch (e) {
+    return { success: false }; // nu blocheaza vanzarea
+  }
+}
+`,
+  },
+
+  php: {
+    filename: 'Fidelizare.php',
+    importLine: `require_once __DIR__ . '/Fidelizare.php';`,
+    call: (v) => `Fidelizare::acumuleazaPuncte(${v}, $cart, $total);`,
+    content: `<?php
+// Generat de fidelizare-integrate. Cheia din mediu, niciodata in cod.
+class Fidelizare {
+  public static function acumuleazaPuncte($codFidelitate, $items, $total) {
+    try {
+      $bon = 'BF' . time();
+      $ch = curl_init('https://fidelizare.ro/api/integration/s2s/submitReceipt');
+      curl_setopt_array($ch, [
+        CURLOPT_POST => true,
+        CURLOPT_RETURNTRANSFER => true,
+        CURLOPT_TIMEOUT => 3,
+        CURLOPT_HTTPHEADER => [
+          'Authorization: Bearer ' . getenv('FIDELIZARE_API_KEY'),
+          'Content-Type: application/json',
+          'Idempotency-Key: BON-' . $bon,
+        ],
+        CURLOPT_POSTFIELDS => json_encode([
+          'store_id' => getenv('FIDELIZARE_STORE_ID') ?: 'MAGAZINUL-TAU',
+          'pos_id' => getenv('FIDELIZARE_POS_ID') ?: 'CASA-1',
+          'receipt_number' => $bon,
+          'fidelity_card' => $codFidelitate,
+          'total' => $total,
+          'items' => $items,
+        ]),
+      ]);
+      $res = curl_exec($ch);
+      curl_close($ch);
+      return json_decode($res, true);
+    } catch (\\Throwable $e) {
+      return ['success' => false]; // nu blocheaza vanzarea
+    }
+  }
+}
+`,
+  },
+
+  python: {
+    filename: 'fidelizare.py',
+    importLine: `from fidelizare import acumuleaza_puncte`,
+    call: (v) => `acumuleaza_puncte(${v}, cart, total)`,
+    content: `# Generat de fidelizare-integrate. Cheia din mediu, niciodata in cod.
+import os, time, json, urllib.request
+
+
+def acumuleaza_puncte(cod_fidelitate, items, total):
+    try:
+        bon = "BF" + str(int(time.time()))
+        body = json.dumps({
+            "store_id": os.environ.get("FIDELIZARE_STORE_ID", "MAGAZINUL-TAU"),
+            "pos_id": os.environ.get("FIDELIZARE_POS_ID", "CASA-1"),
+            "receipt_number": bon,
+            "fidelity_card": cod_fidelitate,
+            "total": total,
+            "items": items,
+        }).encode()
+        req = urllib.request.Request(
+            "https://fidelizare.ro/api/integration/s2s/submitReceipt",
+            data=body, method="POST",
+            headers={
+                "Authorization": "Bearer " + os.environ.get("FIDELIZARE_API_KEY", ""),
+                "Content-Type": "application/json",
+                "Idempotency-Key": "BON-" + bon,
+            })
+        with urllib.request.urlopen(req, timeout=3) as r:
+            return json.loads(r.read())
+    except Exception:
+        return {"success": False}  # nu blocheaza vanzarea
+`,
+  },
+
+  csharp: {
+    filename: 'Fidelizare.cs',
+    call: (v) => `await Fidelizare.AcumuleazaPuncte(${v});`,
+    content: `// Generat de fidelizare-integrate. Cheia din mediu, niciodata in cod.
+using System;
+using System.Net.Http;
+using System.Text;
+using System.Threading.Tasks;
+
+public static class Fidelizare {
+  static readonly HttpClient Http = new HttpClient();
+  public static async Task AcumuleazaPuncte(string codFidelitate) {
+    try {
+      var bon = "BF" + DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+      var json = "{\\"fidelity_card\\":\\"" + codFidelitate + "\\"}";
+      var req = new HttpRequestMessage(HttpMethod.Post,
+        "https://fidelizare.ro/api/integration/s2s/submitReceipt");
+      req.Headers.Add("Authorization", "Bearer " + Environment.GetEnvironmentVariable("FIDELIZARE_API_KEY"));
+      req.Headers.Add("Idempotency-Key", "BON-" + bon);
+      req.Content = new StringContent(json, Encoding.UTF8, "application/json");
+      await Http.SendAsync(req);
+    } catch { /* nu blocheaza vanzarea */ }
+  }
+}
+`,
+  },
+
+  java: {
+    filename: 'Fidelizare.java',
+    call: (v) => `Fidelizare.acumuleazaPuncte(${v});`,
+    content: `// Generat de fidelizare-integrate. Cheia din mediu, niciodata in cod.
+import java.net.URI;
+import java.net.http.*;
+
+public class Fidelizare {
+  public static void acumuleazaPuncte(String codFidelitate) {
+    try {
+      String body = "{\\"fidelity_card\\":\\"" + codFidelitate + "\\"}";
+      HttpRequest req = HttpRequest.newBuilder()
+        .uri(URI.create("https://fidelizare.ro/api/integration/s2s/submitReceipt"))
+        .header("Authorization", "Bearer " + System.getenv("FIDELIZARE_API_KEY"))
+        .POST(HttpRequest.BodyPublishers.ofString(body)).build();
+      HttpClient.newHttpClient().send(req, HttpResponse.BodyHandlers.ofString());
+    } catch (Exception e) { /* nu blocheaza vanzarea */ }
+  }
+}
+`,
+  },
+
+  delphi: {
+    filename: 'Fidelizare.pas',
+    call: (v) => `AcumuleazaPuncte(${v});`,
+    content: `// Generat de fidelizare-integrate. Cheia din mediu, niciodata in cod.
+unit Fidelizare;
+interface
+procedure AcumuleazaPuncte(const CodFidelitate: string);
+implementation
+uses System.Net.HttpClient, System.Classes, System.SysUtils;
+procedure AcumuleazaPuncte(const CodFidelitate: string);
+var Http: THTTPClient; Body: TStringStream;
+begin
+  try
+    Http := THTTPClient.Create;
+    Body := TStringStream.Create('{"fidelity_card":"' + CodFidelitate + '"}', TEncoding.UTF8);
+    Http.CustomHeaders['Authorization'] := 'Bearer ' + GetEnvironmentVariable('FIDELIZARE_API_KEY');
+    Http.Post('https://fidelizare.ro/api/integration/s2s/submitReceipt', Body);
+  except
+    // nu blocheaza vanzarea
+  end;
+end;
+end.
+`,
+  },
+};

package/src/core/vault.js

@@ -0,0 +1,30 @@
+// Session secret vault. The API key is stored host-side and never placed into
+// the agent/LLM conversation: tools see only an opaque ref. Mirrors the
+// approach used by mature setup wizards (PostHog) so secrets cannot leak into
+// model context or generated source.
+import { randomUUID } from 'crypto';
+
+const store = new Map();
+
+export function vaultPut(value, label = 'API key') {
+  const ref = 'secret:' + randomUUID();
+  store.set(ref, { value, label });
+  return ref;
+}
+export function vaultResolve(ref) {
+  return store.get(ref)?.value;
+}
+export function vaultHas(ref) {
+  return store.has(ref);
+}
+// Redact any stored secret value if it appears in a string (defense in depth).
+export function redact(text) {
+  let t = text;
+  for (const { value } of store.values()) {
+    if (value && value.length > 6) t = t.split(value).join('‹FIDELIZARE_API_KEY›');
+  }
+  return t;
+}
+export function vaultClear() {
+  store.clear();
+}

package/src/ui/anim.js

@@ -0,0 +1,146 @@
+// Hand-built ASCII animations. No animation libraries: every frame is drawn
+// with raw ANSI cursor control. Honors --no-anim / non-TTY by degrading to
+// plain static lines.
+import { ansi, C, paint, bold, out, isTTY, sleep } from './ansi.js';
+
+let ANIM = isTTY && !process.argv.includes('--no-anim');
+export const setAnim = (v) => { ANIM = v && isTTY; };
+
+// --- The Fix pin logo in ASCII, drawn line by line with a red sweep. ---
+const LOGO = [
+  '      ▄▄███████▄▄      ',
+  '   ▄██▀▀     ▀▀██▄   ',
+  '  ██▀   ▟█▙   ▀██   ',
+  ' ██    ▟█ █▙    ██  ',
+  ' ██   ▟█   █▙   ██  ',
+  '  ██▖  ▜█████▛  ▗██  ',
+  '   ▀██▄▖     ▗▄██▀   ',
+  '     ▀▀██▄▄▄██▀▀     ',
+  '         ▀█▀         ',
+  '          ▀          ',
+];
+
+export async function logoIntro() {
+  if (!ANIM) {
+    out(paint('  Fidelizare', C.red) + paint('  ·  asistent de integrare\n\n', C.ink));
+    return;
+  }
+  out(ansi.hideCursor);
+  out('\n');
+  for (const line of LOGO) {
+    // colour the filled blocks red, leave spacing dim
+    out('   ' + paint(line, C.red) + '\n');
+    await sleep(34);
+  }
+  // wordmark types in
+  out('\n   ');
+  await typewrite('FIDELIZARE', 30, C.red, true);
+  out(paint('   ·  asistent de integrare\n\n', C.ink));
+  out(ansi.showCursor);
+}
+
+export async function typewrite(text, msPerChar = 24, color = C.white, isBold = false) {
+  if (!ANIM) { out((isBold ? bold(paint(text, color)) : paint(text, color))); return; }
+  for (const ch of text) {
+    out(isBold ? ansi.bold + color + ch + ansi.reset : color + ch + ansi.reset);
+    await sleep(msPerChar);
+  }
+}
+
+// --- Spinner that runs while an async task works. ---
+const DOTS = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+export async function withSpinner(label, task) {
+  if (!ANIM) {
+    out('  ' + paint('•', C.red) + ' ' + label + ' ');
+    try { const r = await task(); out(paint('ok\n', C.green)); return r; }
+    catch (e) { out(paint('esuat\n', C.redBright)); throw e; }
+  }
+  out(ansi.hideCursor);
+  let i = 0, running = true;
+  const tick = async () => {
+    while (running) {
+      out(ansi.toLineStart + ansi.clearLine + '  ' + paint(DOTS[i % DOTS.length], C.red) + '  ' + paint(label, C.white));
+      i++;
+      await sleep(70);
+    }
+  };
+  const spin = tick();
+  try {
+    const result = await task();
+    running = false; await spin;
+    out(ansi.toLineStart + ansi.clearLine + '  ' + paint('✓', C.green) + '  ' + paint(label, C.ink) + '\n');
+    out(ansi.showCursor);
+    return result;
+  } catch (e) {
+    running = false; await spin;
+    out(ansi.toLineStart + ansi.clearLine + '  ' + paint('✗', C.redBright) + '  ' + paint(label, C.ink) + '\n');
+    out(ansi.showCursor);
+    throw e;
+  }
+}
+
+// --- Codebase "scan" animation: a red beam sweeps over faux code lines,
+// like a barcode scanner reading the project. ---
+const FAUX = [
+  'function onScan(code) {',
+  '  if (isProduct(code)) addItem(code);',
+  '  else if (isFidelityCard(code)) { /* ? */ }',
+  '  total += price; printReceipt(items);',
+  '}',
+  'class PosController { finalizeSale() { ... } }',
+];
+export async function scanSweep(label, ms = 1500) {
+  if (!ANIM) { out('  ' + paint('•', C.red) + ' ' + label + '\n'); return; }
+  out(ansi.hideCursor);
+  out('  ' + paint(label, C.white) + '\n');
+  const rows = FAUX.length;
+  // draw faux code dim
+  for (const l of FAUX) out('    ' + paint(l, C.dim) + '\n');
+  const start = Date.now();
+  let beam = 0;
+  while (Date.now() - start < ms) {
+    // redraw with the beam line highlighted red
+    out(ansi.up(rows));
+    for (let r = 0; r < rows; r++) {
+      out(ansi.clearLine);
+      if (r === beam % rows) out('  ' + paint('▶ ', C.red) + paint(FAUX[r], C.redBright) + '\n');
+      else out('    ' + paint(FAUX[r], C.dim) + '\n');
+    }
+    beam++;
+    await sleep(130);
+  }
+  // settle: highlight the fidelity-card line as the found spot
+  out(ansi.up(rows));
+  for (let r = 0; r < rows; r++) {
+    out(ansi.clearLine);
+    if (r === 2) out('  ' + paint('◆ ', C.green) + paint(FAUX[r], C.white) + '\n');
+    else out('    ' + paint(FAUX[r], C.dim) + '\n');
+  }
+  out(ansi.showCursor);
+}
+
+// --- Progress bar. ---
+export async function progress(label, steps = 20, ms = 1200) {
+  if (!ANIM) { out('  ' + label + ' ...\n'); return; }
+  out(ansi.hideCursor);
+  const per = ms / steps;
+  for (let i = 0; i <= steps; i++) {
+    const filled = '█'.repeat(i);
+    const empty = '░'.repeat(steps - i);
+    const pct = Math.round((i / steps) * 100);
+    out(ansi.toLineStart + ansi.clearLine + '  ' + paint(filled, C.red) + paint(empty, C.dim) +
+      '  ' + paint(String(pct).padStart(3) + '%', C.ink) + '  ' + paint(label, C.white));
+    await sleep(per);
+  }
+  out('\n' + ansi.showCursor);
+}
+
+export function rule() {
+  out('  ' + paint('─'.repeat(54), C.dim) + '\n');
+}
+export function heading(s) {
+  out('\n  ' + bold(paint(s, C.white)) + '\n');
+}
+export function note(s, color = C.ink) {
+  out('  ' + paint(s, color) + '\n');
+}

package/src/ui/ansi.js

@@ -0,0 +1,41 @@
+// Zero-dependency ANSI helpers. Truecolor where supported, graceful when not.
+const ESC = '\x1b[';
+
+export const ansi = {
+  reset: ESC + '0m',
+  bold: ESC + '1m',
+  dim: ESC + '2m',
+  italic: ESC + '3m',
+  hideCursor: ESC + '?25l',
+  showCursor: ESC + '?25h',
+  clearLine: ESC + '2K',
+  toLineStart: '\r',
+  up: (n = 1) => ESC + n + 'A',
+  down: (n = 1) => ESC + n + 'B',
+  // 24-bit colour
+  fg: (r, g, b) => `${ESC}38;2;${r};${g};${b}m`,
+  bg: (r, g, b) => `${ESC}48;2;${r};${g};${b}m`,
+};
+
+// Brand palette (Fidelizare red + warm orange + inks).
+export const C = {
+  red: ansi.fg(160, 12, 8),
+  redBright: ansi.fg(220, 38, 30),
+  orange: ansi.fg(232, 90, 44),
+  white: ansi.fg(245, 245, 245),
+  ink: ansi.fg(120, 120, 128),
+  dim: ansi.fg(90, 90, 96),
+  green: ansi.fg(34, 168, 90),
+  amber: ansi.fg(214, 158, 46),
+  onRed: ansi.bg(160, 12, 8) + ansi.fg(255, 255, 255),
+};
+
+export const paint = (s, color) => color + s + ansi.reset;
+export const bold = (s) => ansi.bold + s + ansi.reset;
+
+const supportsColor = process.stdout.isTTY && process.env.NO_COLOR === undefined;
+export function out(s) {
+  process.stdout.write(supportsColor ? s : s.replace(/\x1b\[[0-9;?]*[A-Za-z]/g, ''));
+}
+export const isTTY = Boolean(process.stdout.isTTY);
+export const sleep = (ms) => new Promise((r) => setTimeout(r, ms));