fraim-framework 2.0.171 → 2.0.174

package/dist/src/cli/utils/remote-sync.js

@@ -11,6 +11,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SYNCED_CONTENT_BANNER_MARKER = void 0;
 exports.syncFromRemote = syncFromRemote;
 const axios_1 = __importDefault(require("axios"));
 const fs_1 = require("fs");
@@ -20,7 +21,41 @@ const script_sync_utils_1 = require("./script-sync-utils");
 const fraim_gitignore_1 = require("./fraim-gitignore");
 const project_fraim_paths_1 = require("../../core/utils/project-fraim-paths");
 const LOCK_SYNCED_CONTENT_ENV = 'FRAIM_LOCK_SYNCED_CONTENT';
-const SYNCED_CONTENT_BANNER_MARKER = '<!-- FRAIM_SYNC_MANAGED_CONTENT -->';
+exports.SYNCED_CONTENT_BANNER_MARKER = '<!-- FRAIM_SYNC_MANAGED_CONTENT -->';
+function isTransientNetworkError(error) {
+    if (error?.response) {
+        return false;
+    }
+    const code = String(error?.code || '');
+    const message = String(error?.message || '');
+    return ['ECONNRESET', 'ETIMEDOUT', 'ECONNABORTED', 'EPIPE', 'socket hang up'].some((needle) => code.includes(needle) || message.includes(needle));
+}
+function wait(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function fetchRegistrySync(remoteUrl, apiKey) {
+    let lastError;
+    for (let attempt = 1; attempt <= 3; attempt++) {
+        try {
+            return await axios_1.default.get(`${remoteUrl}/api/registry/sync`, {
+                headers: {
+                    'x-api-key': apiKey,
+                    Connection: 'close'
+                },
+                timeout: 30000
+            });
+        }
+        catch (error) {
+            lastError = error;
+            if (!isTransientNetworkError(error) || attempt === 3) {
+                throw error;
+            }
+            console.warn(chalk_1.default.yellow(`Registry sync request reset; retrying (${attempt + 1}/3)...`));
+            await wait(250 * attempt);
+        }
+    }
+    throw lastError;
+}
 function shouldLockSyncedContent() {
     const raw = process.env[LOCK_SYNCED_CONTENT_ENV];
     if (!raw) {
@@ -35,15 +70,64 @@ function getSyncedContentLockTargets(projectRoot) {
         .map((entry) => entry.replace(/[\\/]+$/, ''))
         .map((entry) => (0, path_1.join)(projectRoot, entry));
 }
-function setFileWriteLockRecursively(dirPath, readOnly) {
+function isPathInside(parentPath, childPath) {
+    const relativePath = (0, path_1.relative)(parentPath, childPath);
+    return relativePath.length > 0 && !relativePath.startsWith('..') && !(0, path_1.isAbsolute)(relativePath);
+}
+function assertPathInsideDirectory(baseDir, targetPath, label) {
+    const resolvedBase = (0, path_1.resolve)(baseDir);
+    const resolvedTarget = (0, path_1.resolve)(targetPath);
+    if (!isPathInside(resolvedBase, resolvedTarget)) {
+        throw new Error(`Refusing to sync ${label}: "${resolvedTarget}" is outside "${resolvedBase}".`);
+    }
+}
+function normalizeRegistryRelativePath(rawPath, label) {
+    const normalized = rawPath.replace(/\\/g, '/');
+    const parts = normalized.split('/');
+    if (normalized.length === 0 ||
+        normalized.includes('\0') ||
+        (0, path_1.isAbsolute)(normalized) ||
+        /^[a-zA-Z]:\//.test(normalized) ||
+        parts.some((part) => part.length === 0 || part === '.' || part === '..')) {
+        throw new Error(`Refusing to sync ${label}: unsafe registry path "${rawPath}".`);
+    }
+    return normalized;
+}
+function prepareWorkspaceDirectory(projectRoot, dirPath, _label, ...expectedParts) {
+    (0, project_fraim_paths_1.assertExactWorkspaceFraimPath)(projectRoot, dirPath, ...expectedParts);
+    if (!(0, fs_1.existsSync)(dirPath)) {
+        (0, fs_1.mkdirSync)(dirPath, { recursive: true });
+    }
+    (0, project_fraim_paths_1.assertExactWorkspaceFraimPath)(projectRoot, dirPath, ...expectedParts);
+}
+function cleanWorkspaceDirectory(projectRoot, dirPath, label, assertWorkspacePath, ...expectedParts) {
+    prepareWorkspaceDirectory(projectRoot, dirPath, label, ...expectedParts);
+    cleanDirectory(dirPath, assertWorkspacePath);
+}
+function resolveWorkspaceRegistryFile(projectRoot, baseDir, registryPath, label, assertWorkspacePath) {
+    const relativePath = normalizeRegistryRelativePath(registryPath, label);
+    const filePath = (0, path_1.join)(baseDir, relativePath);
+    assertPathInsideDirectory(baseDir, filePath, label);
+    assertWorkspacePath(filePath);
+    return { filePath, relativePath };
+}
+function resolveUserRegistryFile(baseDir, registryPath, label) {
+    const relativePath = normalizeRegistryRelativePath(registryPath, label);
+    const filePath = (0, path_1.join)(baseDir, relativePath);
+    assertPathInsideDirectory(baseDir, filePath, label);
+    return { filePath, relativePath };
+}
+function setFileWriteLockRecursively(dirPath, readOnly, assertSafePath = () => undefined) {
     if (!(0, fs_1.existsSync)(dirPath)) {
         return;
     }
+    assertSafePath(dirPath);
     const entries = (0, fs_1.readdirSync)(dirPath, { withFileTypes: true });
     for (const entry of entries) {
         const fullPath = (0, path_1.join)(dirPath, entry.name);
+        assertSafePath(fullPath);
         if (entry.isDirectory()) {
-            setFileWriteLockRecursively(fullPath, readOnly);
+            setFileWriteLockRecursively(fullPath, readOnly, assertSafePath);
             continue;
         }
         try {
@@ -80,7 +164,7 @@ function insertAfterFrontmatter(content, banner) {
     return `${frontmatter}${banner}${body}`;
 }
 function buildSyncedContentBanner(typeLabel) {
-    return `${SYNCED_CONTENT_BANNER_MARKER}\r\n> [!IMPORTANT]\r\n> This ${typeLabel} is synced from FRAIM and will be overwritten on the next \`fraim sync\`.\r\n> Do not edit this file.\r\n`;
+    return `${exports.SYNCED_CONTENT_BANNER_MARKER}\r\n> [!IMPORTANT]\r\n> This ${typeLabel} is synced from FRAIM and will be overwritten on the next \`fraim sync\`.\r\n> Do not edit this file.\r\n`;
 }
 function applySyncedContentBanner(file) {
     const registryPath = getBannerRegistryPath(file);
@@ -112,15 +196,12 @@ async function syncFromRemote(options) {
         };
     }
     try {
+        (0, project_fraim_paths_1.assertWorkspaceFraimRoot)(options.projectRoot);
+        const assertWorkspacePath = (0, project_fraim_paths_1.createWorkspaceFraimPathAsserter)(options.projectRoot);
         console.log(chalk_1.default.blue('🔄 Syncing from remote FRAIM server...'));
         console.log(chalk_1.default.gray(`   Remote: ${remoteUrl}`));
         // Fetch registry files from remote server
-        const response = await axios_1.default.get(`${remoteUrl}/api/registry/sync`, {
-            headers: {
-                'x-api-key': apiKey
-            },
-            timeout: 30000
-        });
+        const response = await fetchRegistrySync(remoteUrl, apiKey);
         const files = response.data.files || [];
         if (!files || files.length === 0) {
             console.log(chalk_1.default.yellow('⚠️  No files received from remote server'));
@@ -136,94 +217,85 @@ async function syncFromRemote(options) {
             };
         }
         const lockTargets = getSyncedContentLockTargets(options.projectRoot);
+        for (const target of lockTargets) {
+            assertWorkspacePath(target);
+        }
         if (shouldLockSyncedContent()) {
             // If previous sync locked these paths read-only, temporarily unlock before cleanup/write.
             for (const target of lockTargets) {
-                setFileWriteLockRecursively(target, false);
+                setFileWriteLockRecursively(target, false, assertWorkspacePath);
             }
         }
         // Sync job stubs to role-specific folders under fraim/
         const allJobFiles = files.filter(f => f.type === 'job');
-        const managerJobFiles = allJobFiles.filter(f => f.path.startsWith('ai-manager/'));
-        const jobFiles = allJobFiles.filter(f => !f.path.startsWith('ai-manager/'));
+        const managerJobFiles = allJobFiles.filter(f => f.path.replace(/\\/g, '/').startsWith('ai-manager/'));
+        const jobFiles = allJobFiles.filter(f => !f.path.replace(/\\/g, '/').startsWith('ai-manager/'));
         const employeeJobsDir = (0, project_fraim_paths_1.getWorkspaceFraimPath)(options.projectRoot, 'ai-employee', 'jobs');
-        if (!(0, fs_1.existsSync)(employeeJobsDir)) {
-            (0, fs_1.mkdirSync)(employeeJobsDir, { recursive: true });
-        }
-        cleanDirectory(employeeJobsDir);
+        cleanWorkspaceDirectory(options.projectRoot, employeeJobsDir, 'employee job directory', assertWorkspacePath, 'ai-employee', 'jobs');
         for (const file of jobFiles) {
             // Strip "jobs/" prefix and "ai-employee/" role prefix
-            let relPath = file.path;
+            let relPath = file.path.replace(/\\/g, '/');
             if (relPath.startsWith('jobs/'))
                 relPath = relPath.substring('jobs/'.length);
             relPath = relPath.replace(/^ai-employee\//, '');
-            const filePath = (0, path_1.join)(employeeJobsDir, relPath);
+            const { filePath, relativePath } = resolveWorkspaceRegistryFile(options.projectRoot, employeeJobsDir, relPath, 'employee job file', assertWorkspacePath);
             const fileDir = (0, path_1.dirname)(filePath);
             if (!(0, fs_1.existsSync)(fileDir)) {
                 (0, fs_1.mkdirSync)(fileDir, { recursive: true });
             }
             (0, fs_1.writeFileSync)(filePath, applySyncedContentBanner(file), 'utf8');
-            console.log(chalk_1.default.gray(`  + ${(0, project_fraim_paths_1.getWorkspaceFraimDisplayPath)(`ai-employee/jobs/${relPath}`)}`));
+            console.log(chalk_1.default.gray(`  + ${(0, project_fraim_paths_1.getWorkspaceFraimDisplayPath)(`ai-employee/jobs/${relativePath}`)}`));
         }
         // Sync ai-manager job stubs to fraim/ai-manager/jobs/
         const managerJobsDir = (0, project_fraim_paths_1.getWorkspaceFraimPath)(options.projectRoot, 'ai-manager', 'jobs');
-        if (!(0, fs_1.existsSync)(managerJobsDir)) {
-            (0, fs_1.mkdirSync)(managerJobsDir, { recursive: true });
-        }
-        cleanDirectory(managerJobsDir);
+        cleanWorkspaceDirectory(options.projectRoot, managerJobsDir, 'manager job directory', assertWorkspacePath, 'ai-manager', 'jobs');
         for (const file of managerJobFiles) {
             // Strip "jobs/" prefix and "ai-manager/" role prefix
-            let relPath = file.path;
+            let relPath = file.path.replace(/\\/g, '/');
             if (relPath.startsWith('jobs/'))
                 relPath = relPath.substring('jobs/'.length);
             relPath = relPath.replace(/^ai-manager\//, '');
-            const filePath = (0, path_1.join)(managerJobsDir, relPath);
+            const { filePath, relativePath } = resolveWorkspaceRegistryFile(options.projectRoot, managerJobsDir, relPath, 'manager job file', assertWorkspacePath);
             const fileDir = (0, path_1.dirname)(filePath);
             if (!(0, fs_1.existsSync)(fileDir)) {
                 (0, fs_1.mkdirSync)(fileDir, { recursive: true });
             }
             (0, fs_1.writeFileSync)(filePath, applySyncedContentBanner(file), 'utf8');
-            console.log(chalk_1.default.gray(`  + ${(0, project_fraim_paths_1.getWorkspaceFraimDisplayPath)(`ai-manager/jobs/${relPath}`)}`));
+            console.log(chalk_1.default.gray(`  + ${(0, project_fraim_paths_1.getWorkspaceFraimDisplayPath)(`ai-manager/jobs/${relativePath}`)}`));
         }
         // Sync skill STUBS to fraim/ai-employee/skills/
         const skillFiles = files.filter(f => f.type === 'skill');
         const skillsDir = (0, project_fraim_paths_1.getWorkspaceFraimPath)(options.projectRoot, 'ai-employee', 'skills');
-        if (!(0, fs_1.existsSync)(skillsDir)) {
-            (0, fs_1.mkdirSync)(skillsDir, { recursive: true });
-        }
-        cleanDirectory(skillsDir);
+        cleanWorkspaceDirectory(options.projectRoot, skillsDir, 'skill directory', assertWorkspacePath, 'ai-employee', 'skills');
         for (const file of skillFiles) {
             // Strip "skills/" prefix to avoid redundant nesting in fraim/ai-employee/skills/
-            let relPath = file.path;
+            let relPath = file.path.replace(/\\/g, '/');
             if (relPath.startsWith('skills/'))
                 relPath = relPath.substring('skills/'.length);
-            const filePath = (0, path_1.join)(skillsDir, relPath);
+            const { filePath, relativePath } = resolveWorkspaceRegistryFile(options.projectRoot, skillsDir, relPath, 'skill file', assertWorkspacePath);
             const fileDir = (0, path_1.dirname)(filePath);
             if (!(0, fs_1.existsSync)(fileDir)) {
                 (0, fs_1.mkdirSync)(fileDir, { recursive: true });
             }
             (0, fs_1.writeFileSync)(filePath, applySyncedContentBanner(file), 'utf8');
-            console.log(chalk_1.default.gray(`  + ${(0, project_fraim_paths_1.getWorkspaceFraimDisplayPath)(`ai-employee/skills/${relPath}`)} (stub)`));
+            console.log(chalk_1.default.gray(`  + ${(0, project_fraim_paths_1.getWorkspaceFraimDisplayPath)(`ai-employee/skills/${relativePath}`)} (stub)`));
         }
         // Sync rule STUBS to fraim/ai-employee/rules/
         const ruleFiles = files.filter(f => f.type === 'rule');
         const rulesDir = (0, project_fraim_paths_1.getWorkspaceFraimPath)(options.projectRoot, 'ai-employee', 'rules');
-        if (!(0, fs_1.existsSync)(rulesDir)) {
-            (0, fs_1.mkdirSync)(rulesDir, { recursive: true });
-        }
-        cleanDirectory(rulesDir);
+        cleanWorkspaceDirectory(options.projectRoot, rulesDir, 'rule directory', assertWorkspacePath, 'ai-employee', 'rules');
         for (const file of ruleFiles) {
             // Strip "rules/" prefix to avoid redundant nesting in fraim/ai-employee/rules/
-            let relPath = file.path;
+            let relPath = file.path.replace(/\\/g, '/');
             if (relPath.startsWith('rules/'))
                 relPath = relPath.substring('rules/'.length);
-            const filePath = (0, path_1.join)(rulesDir, relPath);
+            const { filePath, relativePath } = resolveWorkspaceRegistryFile(options.projectRoot, rulesDir, relPath, 'rule file', assertWorkspacePath);
             const fileDir = (0, path_1.dirname)(filePath);
             if (!(0, fs_1.existsSync)(fileDir)) {
                 (0, fs_1.mkdirSync)(fileDir, { recursive: true });
             }
             (0, fs_1.writeFileSync)(filePath, applySyncedContentBanner(file), 'utf8');
-            console.log(chalk_1.default.gray(`  + ${(0, project_fraim_paths_1.getWorkspaceFraimDisplayPath)(`ai-employee/rules/${relPath}`)} (stub)`));
+            console.log(chalk_1.default.gray(`  + ${(0, project_fraim_paths_1.getWorkspaceFraimDisplayPath)(`ai-employee/rules/${relativePath}`)} (stub)`));
         }
         // Sync scripts to user directory
         const scriptFiles = files.filter(f => f.type === 'script');
@@ -233,36 +305,37 @@ async function syncFromRemote(options) {
             (0, fs_1.mkdirSync)(scriptsDir, { recursive: true });
         }
         // Clean existing scripts
-        cleanDirectory(scriptsDir);
+        cleanDirectory(scriptsDir, (candidatePath) => {
+            if ((0, path_1.resolve)(candidatePath) !== (0, path_1.resolve)(scriptsDir)) {
+                assertPathInsideDirectory(scriptsDir, candidatePath, 'script directory');
+            }
+        });
         // Write script files
         for (const file of scriptFiles) {
-            const filePath = (0, path_1.join)(scriptsDir, file.path);
+            const { filePath, relativePath } = resolveUserRegistryFile(scriptsDir, file.path, 'script file');
             const fileDir = (0, path_1.dirname)(filePath);
             if (!(0, fs_1.existsSync)(fileDir)) {
                 (0, fs_1.mkdirSync)(fileDir, { recursive: true });
             }
             (0, fs_1.writeFileSync)(filePath, file.content, 'utf8');
-            console.log(chalk_1.default.gray(`  + ${file.path}`));
+            console.log(chalk_1.default.gray(`  + ${relativePath}`));
         }
         // Sync docs to fraim/docs/
         const docsFiles = files.filter(f => f.type === 'docs');
         const docsDir = (0, project_fraim_paths_1.getWorkspaceFraimPath)(options.projectRoot, 'docs');
-        if (!(0, fs_1.existsSync)(docsDir)) {
-            (0, fs_1.mkdirSync)(docsDir, { recursive: true });
-        }
-        cleanDirectory(docsDir);
+        cleanWorkspaceDirectory(options.projectRoot, docsDir, 'docs directory', assertWorkspacePath, 'docs');
         for (const file of docsFiles) {
-            const filePath = (0, path_1.join)(docsDir, file.path);
+            const { filePath, relativePath } = resolveWorkspaceRegistryFile(options.projectRoot, docsDir, file.path, 'docs file', assertWorkspacePath);
             const fileDir = (0, path_1.dirname)(filePath);
             if (!(0, fs_1.existsSync)(fileDir)) {
                 (0, fs_1.mkdirSync)(fileDir, { recursive: true });
             }
             (0, fs_1.writeFileSync)(filePath, file.content, 'utf8');
-            console.log(chalk_1.default.gray(`  + ${(0, project_fraim_paths_1.getWorkspaceFraimDisplayPath)(`docs/${file.path}`)}`));
+            console.log(chalk_1.default.gray(`  + ${(0, project_fraim_paths_1.getWorkspaceFraimDisplayPath)(`docs/${relativePath}`)}`));
         }
         if (shouldLockSyncedContent()) {
             for (const target of lockTargets) {
-                setFileWriteLockRecursively(target, true);
+                setFileWriteLockRecursively(target, true, assertWorkspacePath);
             }
             console.log(chalk_1.default.gray(`  🔒 Synced FRAIM content locked as read-only (set ${LOCK_SYNCED_CONTENT_ENV}=false to disable)`));
         }
@@ -293,15 +366,18 @@ async function syncFromRemote(options) {
 /**
  * Clean directory contents (but keep the directory itself)
  */
-function cleanDirectory(dirPath) {
+function cleanDirectory(dirPath, assertSafePath = () => undefined) {
     if (!(0, fs_1.existsSync)(dirPath))
         return;
+    assertSafePath(dirPath);
     const entries = (0, fs_1.readdirSync)(dirPath, { withFileTypes: true });
     for (const entry of entries) {
         const fullPath = (0, path_1.join)(dirPath, entry.name);
+        assertSafePath(fullPath);
         if (entry.isDirectory()) {
-            cleanDirectory(fullPath);
+            cleanDirectory(fullPath, assertSafePath);
             try {
+                assertSafePath(fullPath);
                 (0, fs_1.rmdirSync)(fullPath);
             }
             catch (e) {

package/dist/src/cli/utils/user-config.js

@@ -5,6 +5,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readUserFraimConfig = readUserFraimConfig;
 exports.writeUserFraimConfig = writeUserFraimConfig;
+exports.getInstalledIdes = getInstalledIdes;
+exports.addInstalledIde = addInstalledIde;
 exports.getOrganizationConfig = getOrganizationConfig;
 exports.getManagerStorageConfig = getManagerStorageConfig;
 /**
@@ -48,6 +50,16 @@ function writeUserFraimConfig(patch) {
     fs_1.default.writeFileSync(getUserConfigPath(), JSON.stringify(merged, null, 2));
     return merged;
 }
+function getInstalledIdes() {
+    const raw = readUserFraimConfig().installedIdes;
+    return Array.isArray(raw) ? raw : null;
+}
+function addInstalledIde(configType) {
+    const current = getInstalledIdes() ?? [];
+    if (!current.includes(configType)) {
+        writeUserFraimConfig({ installedIdes: [...current, configType] });
+    }
+}
 /**
  * Resolve the validated organization configuration, or null when no valid
  * organization is configured on this machine (R1.1).

package/dist/src/config/ai-manager-hiring.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HUMAN_MANAGER_PROFILES = exports.AI_MANAGER_QUALITIES = exports.HIRING_SERVICES = void 0;
+exports.getHumanManagerProfile = getHumanManagerProfile;
+exports.buildSearchQuery = buildSearchQuery;
+exports.buildJobDescription = buildJobDescription;
+exports.buildServiceUrl = buildServiceUrl;
+exports.buildManagerHiringCatalog = buildManagerHiringCatalog;
+/**
+ * Issue #538 — human-manager hiring engine (app side).
+ *
+ * Self-contained on purpose: the app (AI Hub UI modal + bootstrap) must resolve this
+ * at runtime in every packaging context (dev tsx, compiled dist, packed CLI), so it
+ * must NOT import across the app→registry boundary. The `hire-the-right-human-ai-manager`
+ * job uses the mirror engine `registry/scripts/ai-manager-hiring.ts` (self-contained +
+ * CLI). The two are kept identical by a parity test (tests/isolated/test-538-ai-manager-hiring.ts);
+ * that is the DRY contract — one behavior, enforced, with no fragile cross-boundary import.
+ */
+const persona_hiring_1 = require("./persona-hiring");
+exports.HIRING_SERVICES = ['linkedin', 'indeed', 'seekout'];
+/** The qualities of a strong AI manager — embedded in both the query and the JD. */
+exports.AI_MANAGER_QUALITIES = [
+    { title: 'Clear specification & written communication', detail: 'Can brief an AI agent so it executes correctly the first time.' },
+    { title: 'Trust-but-verify judgment', detail: 'Knows when to delegate to the agent and when to review deeply.' },
+    { title: 'Coaching mindset', detail: 'Gives feedback that compounds into reusable rules and learnings.' },
+    { title: 'Outcome ownership & AI fluency', detail: 'Owns results; comfortable directing autonomous agents.' },
+];
+const GENERALIST_PROFILE = {
+    humanTitle: 'Manager',
+    keywords: ['"Manager"', '"Director"', '"Team Lead"', '"Chief of Staff"'],
+};
+/** Role key -> the human manager best suited to manage that AI employee. Mirror of registry/scripts/ai-manager-hiring.ts. */
+exports.HUMAN_MANAGER_PROFILES = {
+    maestro: { humanTitle: 'Co-Founder / General Manager', keywords: ['"Co-Founder"', '"General Manager"', '"Chief of Staff"', '"Founder"'] },
+    beza: { humanTitle: 'Head of Strategy', keywords: ['"Head of Strategy"', '"Strategy Director"', '"Chief of Staff"'] },
+    pam: { humanTitle: 'Head of Product', keywords: ['"Head of Product"', '"Group Product Manager"', '"Director of Product"'] },
+    swen: { humanTitle: 'Engineering Manager', keywords: ['"Engineering Manager"', '"Tech Lead"', '"Staff Software Engineer"'] },
+    qasm: { humanTitle: 'QA Manager', keywords: ['"QA Manager"', '"QA Lead"', '"Head of Quality"'] },
+    huxley: { humanTitle: 'Design Manager', keywords: ['"Design Manager"', '"Head of Design"', '"Design Lead"'] },
+    gautam: { humanTitle: 'Marketing Director', keywords: ['"Head of Growth"', '"Marketing Director"', '"Demand Generation Lead"'] },
+    cela: { humanTitle: 'General Counsel', keywords: ['"General Counsel"', '"Head of Legal"', '"Legal Director"'] },
+    sekhar: { humanTitle: 'Security Manager', keywords: ['"Security Manager"', '"Head of Security"', '"CISO"'] },
+    ashley: { humanTitle: 'Chief of Staff', keywords: ['"Chief of Staff"', '"Executive Operations Manager"', '"Office Manager"'] },
+    mandy: { humanTitle: 'Head of Operations', keywords: ['"Head of Operations"', '"Director of Operations"', '"Program Manager"'] },
+    ricardo: { humanTitle: 'Recruiting Manager', keywords: ['"Recruiting Manager"', '"Head of Talent"', '"Talent Acquisition Lead"'] },
+    hari: { humanTitle: 'HR Manager', keywords: ['"HR Manager"', '"Head of People"', '"HR Business Partner"'] },
+    careena: { humanTitle: 'Head of Talent Development', keywords: ['"Head of Talent Development"', '"L&D Manager"', '"Career Coaching Lead"'] },
+    sade: { humanTitle: 'Salesforce Manager', keywords: ['"Salesforce Manager"', '"CRM Lead"', '"Salesforce Architect"'] },
+    sam: { humanTitle: 'Sales Manager', keywords: ['"Sales Manager"', '"Head of Sales"', '"Director of Sales"'] },
+    casey: { humanTitle: 'Customer Success Manager', keywords: ['"Customer Success Manager"', '"Head of Customer Success"', '"Support Manager"'] },
+    deidre: { humanTitle: 'Head of DEI', keywords: ['"Head of DEI"', '"Director of Inclusion"', '"DEI Program Manager"'] },
+    mona: { humanTitle: 'Finance Manager', keywords: ['"Finance Manager"', '"Head of Finance"', '"Controller"'] },
+    sreya: { humanTitle: 'SRE Manager', keywords: ['"SRE Manager"', '"Head of Reliability"', '"Platform Engineering Lead"'] },
+    procella: { humanTitle: 'Procurement Manager', keywords: ['"Procurement Manager"', '"Head of Procurement"', '"Sourcing Lead"'] },
+    banke: { humanTitle: 'KYC Operations Manager', keywords: ['"KYC Operations Manager"', '"AML Compliance Manager"', '"Banking Compliance Lead"'] },
+    auditya: { humanTitle: 'Audit Manager', keywords: ['"Audit Manager"', '"Internal Audit Lead"', '"Compliance Audit Manager"'] },
+};
+function getHumanManagerProfile(roleKey) {
+    return exports.HUMAN_MANAGER_PROFILES[roleKey] ?? GENERALIST_PROFILE;
+}
+const AI_MANAGER_QUERY_TERMS = '("AI" OR "LLM" OR "agentic") AND ("coaching" OR "mentoring")';
+function buildSearchQuery(roleKey) {
+    const profile = getHumanManagerProfile(roleKey);
+    return `${profile.keywords.join(' OR ')} AND ${AI_MANAGER_QUERY_TERMS}`;
+}
+function buildJobDescription(roleKey) {
+    const profile = getHumanManagerProfile(roleKey);
+    const role = persona_hiring_1.PERSONA_HIRE_CATALOG[roleKey]?.role ?? 'AI Employee';
+    return [
+        `${profile.humanTitle} — manager for an ${role}`,
+        '',
+        `You will manage an ${role} (an autonomous AI agent) and the humans around it, owning the outcomes it ships.`,
+        '',
+        "What you'll do:",
+        `- Write crisp specifications and acceptance criteria the ${role} can execute against.`,
+        `- Review the agent's output with judgment: know when to trust it and when to dig in.`,
+        '- Coach the agent and team so feedback compounds into reusable rules.',
+        '- Own delivery outcomes, not activity; prioritize ruthlessly.',
+        '',
+        'What makes a strong AI manager:',
+        ...exports.AI_MANAGER_QUALITIES.map((q) => `- ${q.title}: ${q.detail}`),
+    ].join('\n');
+}
+function buildServiceUrl(service, query, location) {
+    const q = encodeURIComponent(query);
+    const loc = location && location.trim().length > 0 ? location.trim() : '';
+    switch (service) {
+        case 'linkedin':
+            return `https://www.linkedin.com/search/results/people/?keywords=${q}`;
+        case 'indeed':
+            return `https://www.indeed.com/jobs?q=${q}${loc ? `&l=${encodeURIComponent(loc)}` : ''}`;
+        case 'seekout':
+            return 'https://app.seekout.com/';
+    }
+}
+/**
+ * Catalog projection for the AI Hub bootstrap so the client renders off the server's
+ * source of truth. Defaults to exactly the hireable personas in `PERSONA_HIRE_CATALOG`.
+ */
+function buildManagerHiringCatalog(roleKeys = Object.keys(persona_hiring_1.PERSONA_HIRE_CATALOG)) {
+    const roles = {};
+    for (const key of roleKeys) {
+        const profile = getHumanManagerProfile(key);
+        const query = buildSearchQuery(key);
+        // managedRole is derived from PERSONA_HIRE_CATALOG so the bootstrap response
+        // shape is unchanged even after removing the field from HumanManagerProfile.
+        const managedRole = persona_hiring_1.PERSONA_HIRE_CATALOG[key]?.role ?? 'AI Employee';
+        roles[key] = {
+            ...profile,
+            managedRole,
+            query,
+            jobDescription: buildJobDescription(key),
+            serviceUrls: {
+                linkedin: buildServiceUrl('linkedin', query),
+                indeed: buildServiceUrl('indeed', query),
+                seekout: buildServiceUrl('seekout', query),
+            },
+        };
+    }
+    return { qualities: exports.AI_MANAGER_QUALITIES, services: exports.HIRING_SERVICES, roles };
+}

package/dist/src/config/compat.js

@@ -0,0 +1,16 @@
+"use strict";
+/**
+ * Compatibility configuration for FRAIM.
+ * This file defines breaking changes and minimum required versions for clients.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getBreakingChangesNotice = exports.MINIMUM_CLIENT_VERSION = void 0;
+exports.MINIMUM_CLIENT_VERSION = '2.0.94';
+/**
+ * Notice template for clients running outdated versions.
+ * This is appended to tool responses to guide users toward the standardized setup.
+ */
+const getBreakingChangesNotice = (currentVersion) => {
+    return `\n\n---\n\n> [!WARNING] migration_notice\n> **Action Required**: You are using an outdated FRAIM configuration (v${currentVersion}). FRAIM requires at least v${exports.MINIMUM_CLIENT_VERSION}.\n> \n> To fix this permanently so you never have to update again, please run this terminal command **once**:\n> \`\`\`bash\n> npx fraim@latest setup\n> \`\`\`\n> Then restart your IDE.`;
+};
+exports.getBreakingChangesNotice = getBreakingChangesNotice;

package/dist/src/config/feature-flags.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getFeatureFlags = getFeatureFlags;
+exports.isPersonaEntitlementsEnabled = isPersonaEntitlementsEnabled;
+exports.getPublicFeatureFlags = getPublicFeatureFlags;
+function parseBooleanFlag(value) {
+    if (!value)
+        return false;
+    return ['1', 'true', 'yes', 'on'].includes(value.trim().toLowerCase());
+}
+function getFeatureFlags() {
+    return {
+        personaEntitlements: {
+            enabled: parseBooleanFlag(process.env.FRAIM_FF_PERSONA_ENTITLEMENTS)
+        }
+    };
+}
+function isPersonaEntitlementsEnabled() {
+    return getFeatureFlags().personaEntitlements.enabled;
+}
+function getPublicFeatureFlags() {
+    return {
+        personaEntitlementsEnabled: isPersonaEntitlementsEnabled()
+    };
+}