fraim-framework 2.0.176 → 2.0.179

package/dist/src/cli/setup/auto-mcp-setup.js

@@ -44,17 +44,7 @@ const prompts_1 = __importDefault(require("prompts"));
 const ide_detector_1 = require("./ide-detector");
 const mcp_config_generator_1 = require("./mcp-config-generator");
 const codex_local_config_1 = require("./codex-local-config");
-const provider_registry_1 = require("../providers/provider-registry");
-const normalizePlatformTokens = (tokenInput) => {
-    if (!tokenInput)
-        return {};
-    if (typeof tokenInput === 'string') {
-        return tokenInput ? { github: tokenInput } : {};
-    }
-    return tokenInput;
-};
-const promptForIDESelection = async (detectedIDEs, tokenInput) => {
-    const tokens = normalizePlatformTokens(tokenInput);
+const promptForIDESelection = async (detectedIDEs) => {
     if (process.env.FRAIM_NON_INTERACTIVE) {
         console.log(chalk_1.default.yellow(`\nℹ️  Non-interactive mode: configuring all detected IDEs (${detectedIDEs.length})`));
         return detectedIDEs;
@@ -70,17 +60,8 @@ const promptForIDESelection = async (detectedIDEs, tokenInput) => {
     console.log(chalk_1.default.blue('FRAIM will add these MCP servers to selected IDEs:'));
     console.log(chalk_1.default.gray('   • fraim (required for FRAIM jobs)'));
     console.log(chalk_1.default.gray('   • git (version control integration)'));
-    // Show configured provider MCP servers dynamically
-    const allProviderIds = await (0, provider_registry_1.getAllProviderIds)();
-    for (const providerId of allProviderIds) {
-        if (tokens[providerId]) {
-            const provider = await (0, provider_registry_1.getProvider)(providerId);
-            if (provider) {
-                console.log(chalk_1.default.gray(`   - ${providerId} (${provider.displayName} API access)`));
-            }
-        }
-    }
     console.log(chalk_1.default.gray('   • playwright (browser automation)'));
+    console.log(chalk_1.default.blue('\n💡 Run "fraim add-provider <provider>" after setup to connect GitHub, GitLab, Jira, or other tools.'));
     console.log(chalk_1.default.yellow('\n💡 Existing MCP servers will be preserved - only missing servers will be added.'));
     const response = await (0, prompts_1.default)({
         type: 'text',
@@ -153,8 +134,7 @@ const validateSetupResults = async (configuredIDEs) => {
     }
 };
 exports.validateSetupResults = validateSetupResults;
-const configureIDEMCP = async (ide, fraimKey, tokenInput, providerConfigs) => {
-    const tokens = normalizePlatformTokens(tokenInput);
+const configureIDEMCP = async (ide, fraimKey) => {
     const configPath = (0, ide_detector_1.expandPath)(ide.configPath);
     console.log(chalk_1.default.blue(`🔧 Configuring ${ide.name}...`));
     // Create backup
@@ -185,11 +165,9 @@ const configureIDEMCP = async (ide, fraimKey, tokenInput, providerConfigs) => {
             existingTomlContent = fs_1.default.readFileSync(configPath, 'utf8');
             console.log(chalk_1.default.gray(`  📋 Found existing TOML config`));
         }
-        const newTomlContent = await (0, mcp_config_generator_1.generateMCPConfig)(ide.configType, fraimKey, tokens, providerConfigs);
+        const newTomlContent = await (0, mcp_config_generator_1.generateMCPConfig)(ide.configType, fraimKey, {});
         const { getAllMCPServerIds } = await Promise.resolve().then(() => __importStar(require('../mcp/mcp-server-registry')));
-        const baseServerIds = getAllMCPServerIds();
-        const providerServerIds = Object.keys(tokens).filter(id => tokens[id]);
-        const serversToAdd = [...baseServerIds, ...providerServerIds];
+        const serversToAdd = getAllMCPServerIds();
         const mergeResult = (0, mcp_config_generator_1.mergeTomlMCPServers)(existingTomlContent, newTomlContent, serversToAdd);
         fs_1.default.writeFileSync(configPath, mergeResult.content);
         mergeResult.addedServers.forEach(server => {
@@ -204,7 +182,7 @@ const configureIDEMCP = async (ide, fraimKey, tokenInput, providerConfigs) => {
     }
     else {
         // For JSON configs - intelligent merging
-        const newConfig = await (0, mcp_config_generator_1.generateMCPConfig)(ide.configType, fraimKey, tokens, providerConfigs);
+        const newConfig = await (0, mcp_config_generator_1.generateMCPConfig)(ide.configType, fraimKey, {});
         const newMCPServers = newConfig[serversKey] || newConfig.mcpServers || {};
         // Merge MCP servers intelligently
         const mergedMCPServers = { ...existingMCPServers };
@@ -251,8 +229,7 @@ const configureIDEMCP = async (ide, fraimKey, tokenInput, providerConfigs) => {
         console.log(chalk_1.default.green(`  ✅ ${status} local Codex config: ${localResult.path}`));
     }
 };
-const autoConfigureMCP = async (fraimKey, tokenInput, selectedIDEs, providerConfigs) => {
-    const tokens = normalizePlatformTokens(tokenInput);
+const autoConfigureMCP = async (fraimKey, selectedIDEs) => {
     const detectedIDEs = (0, ide_detector_1.detectInstalledIDEs)();
     if (detectedIDEs.length === 0 && (!selectedIDEs || selectedIDEs.length === 0)) {
         console.log(chalk_1.default.yellow('⚠️ No supported IDEs detected.'));
@@ -294,7 +271,7 @@ const autoConfigureMCP = async (fraimKey, tokenInput, selectedIDEs, providerConf
     }
     else {
         // Interactive selection
-        idesToConfigure = await (0, exports.promptForIDESelection)(detectedIDEs, tokens);
+        idesToConfigure = await (0, exports.promptForIDESelection)(detectedIDEs);
     }
     if (idesToConfigure.length === 0) {
         console.log(chalk_1.default.yellow('⚠️ No IDEs selected for configuration.'));
@@ -308,7 +285,7 @@ const autoConfigureMCP = async (fraimKey, tokenInput, selectedIDEs, providerConf
     };
     for (const ide of idesToConfigure) {
         try {
-            await configureIDEMCP(ide, fraimKey, tokens, providerConfigs);
+            await configureIDEMCP(ide, fraimKey);
             results.successful.push(ide.name);
         }
         catch (error) {

package/dist/src/cli/setup/ide-detector.js

@@ -23,6 +23,58 @@ exports.expandPath = expandPath;
 const checkMultiplePaths = (paths) => {
     return paths.some(p => fs_1.default.existsSync(expandPath(p)));
 };
+// Issue #646 (Bug 2): a config directory left behind after uninstall (e.g. ~/.cursor,
+// ~/Library/Application Support/Cursor) made config-surface detection report Cursor
+// as "Installed" when it was not. App evidence is the reliable signal for Cursor;
+// other GUI surfaces keep their existing config-surface checks for compatibility
+// with the #640 first-run detection contract.
+const appBundlePaths = (appName) => [
+    `/Applications/${appName}.app`,
+    `~/Applications/${appName}.app`,
+];
+const windowsUserAppPaths = (appName) => {
+    switch (appName) {
+        case 'Cursor':
+            return [
+                '~/AppData/Local/Programs/Cursor/Cursor.exe',
+                '~/AppData/Local/Cursor/Cursor.exe',
+            ];
+        default:
+            return [];
+    }
+};
+// Issue #646 follow-up: a user may run a GUI app from a non-standard location
+// (e.g. straight from a mounted DMG: /Volumes/.../Cursor.app) that the
+// /Applications checks miss. A running process of the app is definitive proof it
+// is installed and in use, and a stale config dir alone has no such process — so
+// this catches real installs without re-introducing the stale-dir false positive.
+const isMacAppRunning = (appName) => {
+    if (process.platform !== 'darwin')
+        return false;
+    // Test seam: `pgrep` is system-global (not HOME-scoped), so tests that simulate
+    // "app not installed" via a temp HOME set this to keep results deterministic.
+    if (process.env.FRAIM_DETECT_DISABLE_PROCESS_CHECK === '1')
+        return false;
+    const result = (0, child_process_1.spawnSync)('pgrep', ['-f', `${appName}.app/Contents`], { encoding: 'utf8', timeout: 1500 });
+    return result.status === 0 && Boolean((result.stdout || '').trim());
+};
+const hasAppEvidence = (appName) => {
+    const evidencePaths = process.platform === 'win32'
+        ? [...appBundlePaths(appName), ...windowsUserAppPaths(appName)]
+        : appBundlePaths(appName);
+    return checkMultiplePaths(evidencePaths) || isMacAppRunning(appName);
+};
+const guiAppDetect = (configSurfaceCheck, appName, options = {}) => {
+    return () => {
+        if (options.requireAppEvidence) {
+            return hasAppEvidence(appName);
+        }
+        if (process.platform === 'darwin') {
+            return hasAppEvidence(appName);
+        }
+        return configSurfaceCheck();
+    };
+};
 const availableByVersionProbe = (command) => {
     const result = process.platform === 'win32'
         ? (0, child_process_1.spawnSync)('cmd.exe', ['/d', '/s', '/c', `${command} --version`], { encoding: 'utf8', timeout: 1500 })
@@ -48,12 +100,12 @@ const detectVSCode = () => {
     ];
     return checkMultiplePaths(paths);
 };
-const detectCursor = () => {
+const detectCursorMcpConfig = () => {
     const paths = [
-        '~/.cursor',
-        '~/Library/Application Support/Cursor',
-        '~/AppData/Roaming/Cursor',
-        '~/.config/Cursor'
+        '~/.cursor/mcp.json',
+        '~/Library/Application Support/Cursor/mcp.json',
+        '~/AppData/Roaming/Cursor/mcp.json',
+        '~/.config/Cursor/mcp.json'
     ];
     return checkMultiplePaths(paths);
 };
@@ -71,6 +123,7 @@ const detectGeminiCli = () => {
 };
 const detectGeminiSurface = () => {
     const paths = [
+        '~/.gemini',
         '~/.gemini/settings.json',
         '~/AppData/Roaming/gemini/settings.json',
         '~/.config/gemini/settings.json'
@@ -112,7 +165,7 @@ exports.IDE_CONFIGS = [
         configFormat: 'json',
         configType: 'claude',
         invocationProfile: 'launch-phrase',
-        detectMethod: detectClaude,
+        detectMethod: guiAppDetect(detectClaude, 'Claude'),
         aliases: ['claude', 'claude-desktop', 'claude desktop', 'claude-cowork', 'cowork', 'claude cowork'],
         alternativePaths: [
             '~/Library/Application Support/Claude/claude_desktop_config.json'
@@ -126,9 +179,9 @@ exports.IDE_CONFIGS = [
         configFormat: 'json',
         configType: 'standard',
         invocationProfile: 'cursor-mention',
-        detectMethod: () => fs_1.default.existsSync(expandPath('~/.gemini/antigravity')),
+        detectMethod: guiAppDetect(() => fs_1.default.existsSync(expandPath('~/.gemini/antigravity')), 'Antigravity'),
         description: 'Google Gemini Antigravity IDE',
-        downloadUrl: 'https://deepmind.google/technologies/gemini/',
+        downloadUrl: 'https://antigravity.google/',
     },
     {
         name: 'Gemini CLI',
@@ -152,7 +205,7 @@ exports.IDE_CONFIGS = [
         configFormat: 'json',
         configType: 'kiro',
         invocationProfile: 'kiro-hashtag',
-        detectMethod: () => fs_1.default.existsSync(expandPath('~/.kiro')),
+        detectMethod: guiAppDetect(() => fs_1.default.existsSync(expandPath('~/.kiro')), 'Kiro'),
         description: 'Kiro AI-powered IDE',
         downloadUrl: 'https://kiro.dev/',
     },
@@ -163,7 +216,7 @@ exports.IDE_CONFIGS = [
         configType: 'kiro',
         adapterConfigType: 'cursor',
         invocationProfile: 'cursor-mention',
-        detectMethod: detectCursor,
+        detectMethod: () => detectCursorMcpConfig() || hasAppEvidence('Cursor'),
         alternativePaths: [
             '~/Library/Application Support/Cursor/mcp.json',
             '~/AppData/Roaming/Cursor/mcp.json',
@@ -182,7 +235,7 @@ exports.IDE_CONFIGS = [
         configFormat: 'json',
         configType: 'vscode',
         invocationProfile: 'vscode-prompt',
-        detectMethod: detectVSCode,
+        detectMethod: guiAppDetect(detectVSCode, 'Visual Studio Code'),
         alternativePaths: [
             '~/Library/Application Support/Code/User/mcp.json',
             '~/AppData/Roaming/Code/User/mcp.json',
@@ -219,7 +272,7 @@ exports.IDE_CONFIGS = [
         configFormat: 'json',
         configType: 'windsurf',
         invocationProfile: 'windsurf-command',
-        detectMethod: detectWindsurf,
+        detectMethod: guiAppDetect(detectWindsurf, 'Windsurf'),
         alternativePaths: [
             '~/Library/Application Support/Windsurf/mcp_config.json',
             '~/AppData/Roaming/Windsurf/mcp_config.json',

package/dist/src/config/persona-capability-bundles.js

@@ -40,7 +40,7 @@ exports.PERSONA_CAPABILITY_BUNDLES = {
         personaKey: 'beza',
         bundleId: 'persona-beza-core',
         catalogMetadata: buildCatalogMetadata('beza', ['competitive-analysis', 'review-business-strategy', 'business-plan-creation']),
-        protectedJobs: ['competitive-analysis', 'review-business-strategy', 'business-plan-creation', 'problem-statement-crystallization', 'business-idea-validation-and-scoping', 'founder-market-fit-analysis', 'rfp-response-preparation', 'aws-activate-credits-application', 'community-funding-preparation', 'fundraising-prospect-discovery', 'google-cloud-credits-application', 'investor-pitch-preparation', 'microsoft-azure-credits-application', 'review-funding-preparation', 'advisory-board-development', 'advisor-interview', 'advisory-board-selection'],
+        protectedJobs: ['competitive-analysis', 'review-business-strategy', 'business-plan-creation', 'problem-statement-crystallization', 'business-idea-validation-and-scoping', 'founder-market-fit-analysis', 'community-funding-preparation', 'fundraising-prospect-discovery', 'investor-pitch-preparation', 'review-funding-preparation', 'advisory-board-development', 'advisor-interview', 'advisory-board-selection', 'blue-sky-brainstorming', 'domain-registration-research'],
         protectedAliases: ['business-strategy', 'company-strategy'],
         defaultHireMode: 'job',
         lockCopy: 'Hire BeZa to unlock business strategy work for this request.'
@@ -49,7 +49,7 @@ exports.PERSONA_CAPABILITY_BUNDLES = {
         personaKey: 'pam',
         bundleId: 'persona-pam-core',
         catalogMetadata: buildCatalogMetadata('pam', ['feature-specification', 'technical-design', 'issue-preparation']),
-        protectedJobs: ['feature-specification', 'technical-design', 'issue-preparation', 'implementation-design-review', 'issue-retrospective', 'work-completion', 'scrum-sprint-planning', 'mvp-validation-plan'],
+        protectedJobs: ['feature-specification', 'technical-design', 'issue-preparation', 'implementation-design-review', 'issue-retrospective', 'work-completion', 'scrum-sprint-planning', 'mvp-validation-plan', 'sprint-planning', 'customer-prospect-discovery', 'interview-preparation', 'participant-recruitment', 'process-interview-notes', 'review-customer-development', 'triage-customer-needs'],
         protectedAliases: ['product-management', 'product-spec'],
         defaultHireMode: 'job',
         lockCopy: 'Hire PaM to unlock product-management work for this request.'
@@ -58,7 +58,7 @@ exports.PERSONA_CAPABILITY_BUNDLES = {
         personaKey: 'swen',
         bundleId: 'persona-swen-core',
         catalogMetadata: buildCatalogMetadata('swen', ['feature-implementation', 'code-refactoring', 'pr-iteration']),
-        protectedJobs: ['feature-implementation', 'code-refactoring', 'pr-iteration', 'mobile-app-development', 'mcp-server-creation', 'cloud-application-deployment', 'cloud-cost-optimization', 'cloud-performance-diagnosis', 'route-llm-spend-to-cloud-credits', 'set-up-cloud-cost-alerts', 'gitlabs-to-github', 'system-migration', 'cross-cloud-migration', 'data-pipeline-design', 'data-quality-monitoring', 'data-platform-architecture', 'write-dev-docs', 'database-schema-design'],
+        protectedJobs: ['feature-implementation', 'code-refactoring', 'pr-iteration', 'mobile-app-development', 'mcp-server-creation', 'cloud-application-deployment', 'cloud-cost-optimization', 'cloud-performance-diagnosis', 'route-llm-spend-to-cloud-credits', 'set-up-cloud-cost-alerts', 'gitlabs-to-github', 'system-migration', 'cross-cloud-migration', 'data-pipeline-design', 'data-quality-monitoring', 'data-platform-architecture', 'write-dev-docs', 'database-schema-design', 'create-architecture', 'project-scaffolding', 'codebase-analysis-and-ideation', 'github-org-setup', 'google-workspace-setup', 'mobile-app-rejection-response', 'mobile-app-submission', 'publish-mcp-app', 'application-replication-workflow'],
         protectedAliases: ['software-engineering', 'implementation'],
         defaultHireMode: 'job',
         lockCopy: 'Hire SWEn to unlock software-engineering delivery for this request.'
@@ -76,7 +76,7 @@ exports.PERSONA_CAPABILITY_BUNDLES = {
         personaKey: 'huxley',
         bundleId: 'persona-huxley-core',
         catalogMetadata: buildCatalogMetadata('huxley', ['design-system-creation', 'user-facing-prototyping', 'ux-research-synthesis']),
-        protectedJobs: ['design-system-creation', 'user-facing-prototyping', 'website-creation', 'linkedin-carousel-from-deck', 'brand-creation', 'branding-quality-audit', 'ux-research-synthesis', 'user-journey-mapping'],
+        protectedJobs: ['design-system-creation', 'user-facing-prototyping', 'website-creation', 'brand-creation', 'branding-quality-audit', 'ux-research-synthesis', 'user-journey-mapping'],
         protectedAliases: ['ux-design', 'brand-design'],
         defaultHireMode: 'job',
         lockCopy: 'Hire hUXley to unlock design-system, UX research, and brand design work for this request.'
@@ -85,7 +85,7 @@ exports.PERSONA_CAPABILITY_BUNDLES = {
         personaKey: 'gautam',
         bundleId: 'persona-gautam-core',
         catalogMetadata: buildCatalogMetadata('gautam', ['analyze-revenue-system', 'build-gtm-motion', 'ppc-campaign-management']),
-        protectedJobs: ['pricing-strategy-definition', 'marketing-strategy-definition', 'product-launch-management', 'customer-prospect-discovery', 'evangelist-content-development', 'funnel-analysis', 'growth-loop-design', 'analyze-revenue-system', 'design-gtm-system', 'build-gtm-motion', 'build-gtm-stack', 'plan-gtm-team', 'marketing-content-creation', 'ppc-campaign-management', 'paid-social-strategy', 'ad-performance-analysis', 'tracking-and-attribution-setup', 'developer-advocacy', 'seo-strategy', 'marketing-analytics-review'],
+        protectedJobs: ['pricing-strategy-definition', 'marketing-strategy-definition', 'product-launch-management', 'evangelist-content-development', 'funnel-analysis', 'growth-loop-design', 'analyze-revenue-system', 'design-gtm-system', 'build-gtm-motion', 'build-gtm-stack', 'plan-gtm-team', 'marketing-content-creation', 'ppc-campaign-management', 'paid-social-strategy', 'ad-performance-analysis', 'tracking-and-attribution-setup', 'developer-advocacy', 'seo-strategy', 'marketing-analytics-review', 'linkedin-company-page-setup', 'x-account-setup', 'social-engagement-campaign', 'thought-leadership-engagement', 'promo-video-creation', 'linkedin-carousel-from-deck'],
         protectedAliases: ['gtm', 'marketing'],
         defaultHireMode: 'job',
         lockCopy: 'Hire GauTaM to unlock go-to-market and paid media work for this request.'
@@ -94,7 +94,7 @@ exports.PERSONA_CAPABILITY_BUNDLES = {
         personaKey: 'cela',
         bundleId: 'persona-cela-core',
         catalogMetadata: buildCatalogMetadata('cela', ['contract-review-analysis', 'nda-creation', 'saas-contract-package-creation']),
-        protectedJobs: ['contract-review-analysis', 'nda-creation', 'saas-contract-package-creation', 'trademark-registration-management', 'provisional-patent-application-creation', 'opensign-cloud-esign-dispatch', 'w9-creation', 'invoice-generation', 'entity-type-selection', 'state-incorporation-filing', 'business-tax-registration', 'ein-application', 'cap-table-construction', 'founder-and-equity-agreements', 'ip-assignment-agreement-creation', 'employment-structure-decision', 'business-banking-setup'],
+        protectedJobs: ['contract-review-analysis', 'nda-creation', 'saas-contract-package-creation', 'trademark-registration-management', 'provisional-patent-application-creation', 'opensign-cloud-esign-dispatch', 'w9-creation', 'entity-type-selection', 'state-incorporation-filing', 'business-tax-registration', 'ein-application', 'cap-table-construction', 'founder-and-equity-agreements', 'ip-assignment-agreement-creation', 'employment-structure-decision'],
         protectedAliases: ['legal', 'counsel'],
         defaultHireMode: 'job',
         lockCopy: 'Hire CELiA to unlock legal workflow support for this request.'
@@ -103,7 +103,7 @@ exports.PERSONA_CAPABILITY_BUNDLES = {
         personaKey: 'sekhar',
         bundleId: 'persona-sekhar-core',
         catalogMetadata: buildCatalogMetadata('sekhar', ['security-review', 'ai-native-security-setup', 'security-findings-command-center']),
-        protectedJobs: ['security-review', 'ai-native-security-setup', 'security-findings-command-center', 'vulnerability-triage-and-remediation', 'production-readiness-review', 'compliance-review', 'compliance-continuous-monitoring', 'compliance-policy-authoring', 'compliance-questionnaire-response', 'compliance-requirements-detection', 'generate-audit-evidence', 'regulation-evidence-management', 'soc2-evidence-management'],
+        protectedJobs: ['security-review', 'ai-native-security-setup', 'security-findings-command-center', 'vulnerability-triage-and-remediation', 'compliance-review', 'compliance-continuous-monitoring', 'compliance-policy-authoring', 'compliance-questionnaire-response', 'compliance-requirements-detection', 'generate-audit-evidence', 'regulation-evidence-management', 'soc2-evidence-management'],
         protectedAliases: ['security', 'appsec'],
         defaultHireMode: 'job',
         lockCopy: 'Hire SEChar to unlock security setup, review, and findings-command work for this request.'
@@ -112,7 +112,7 @@ exports.PERSONA_CAPABILITY_BUNDLES = {
         personaKey: 'ashley',
         bundleId: 'persona-ashley-core',
         catalogMetadata: buildCatalogMetadata('ashley', ['executive-assistant', 'weekly-operating-review', 'send-thank-you-notes']),
-        protectedJobs: ['executive-assistant', 'weekly-operating-review', 'send-thank-you-notes', 'send-newsletter', 'analyze-transcript', 'send-stakeholder-update', 'portfolio-impact-report'],
+        protectedJobs: ['executive-assistant', 'weekly-operating-review', 'send-thank-you-notes', 'send-newsletter', 'analyze-transcript', 'send-stakeholder-update'],
         protectedAliases: ['executive-assistant', 'operations-assistant'],
         defaultHireMode: 'job',
         lockCopy: 'Hire AshLey to unlock executive-assistant work for this request.'
@@ -121,7 +121,7 @@ exports.PERSONA_CAPABILITY_BUNDLES = {
         personaKey: 'mandy',
         bundleId: 'persona-mandy-core',
         catalogMetadata: buildCatalogMetadata('mandy', ['fully-delegate', 'project-plan-creation', 'stakeholder-status-reporting']),
-        protectedJobs: ['fully-delegate', 'delivery-governance-review', 'project-plan-creation', 'stakeholder-status-reporting', 'experiment-tracking', 'cross-functional-dependency-management'],
+        protectedJobs: ['fully-delegate', 'delivery-governance-review', 'project-plan-creation', 'stakeholder-status-reporting', 'experiment-tracking', 'cross-functional-dependency-management', 'portfolio-impact-report'],
         protectedAliases: ['manager', 'team-lead', 'orchestrator'],
         defaultHireMode: 'job',
         lockCopy: 'Hire MANdy to unlock autonomous multi-role orchestration — MANdy plans the job sequence, runs sub-agents in parallel, coaches them through verification loops, and hands back a synthesized DRAFT for your approval.'
@@ -175,7 +175,7 @@ exports.PERSONA_CAPABILITY_BUNDLES = {
         personaKey: 'casey',
         bundleId: 'persona-casey-core',
         catalogMetadata: buildCatalogMetadata('casey', ['support-case-resolution', 'support-sop-operationalization', 'support-system-operationalization', 'support-playbook-evaluation']),
-        protectedJobs: ['crm-account-health-review', 'crm-case-resolution', 'customer-health-review', 'loyalty-program-management', 'survey-campaign-management', 'support-queue-management', 'support-case-resolution', 'support-sop-operationalization', 'support-system-operationalization', 'support-playbook-evaluation'],
+        protectedJobs: ['crm-account-health-review', 'crm-case-resolution', 'customer-health-review', 'loyalty-program-management', 'survey-campaign-management', 'support-queue-management', 'support-case-resolution', 'support-sop-operationalization', 'support-system-operationalization', 'support-playbook-evaluation', 'user-survey-management'],
         protectedAliases: ['customer-success', 'customer-support', 'csm', 'support'],
         defaultHireMode: 'job',
         lockCopy: 'Hire CaSey to unlock customer success and support work for this request.'
@@ -205,7 +205,7 @@ exports.PERSONA_CAPABILITY_BUNDLES = {
         personaKey: 'mona',
         bundleId: 'persona-mona-core',
         catalogMetadata: buildCatalogMetadata('mona', ['financial-analysis', 'fpa-and-forecasting', 'monthly-close-review']),
-        protectedJobs: ['financial-analysis', 'fpa-and-forecasting', 'monthly-close-review', 'tax-strategy-planning'],
+        protectedJobs: ['financial-analysis', 'fpa-and-forecasting', 'monthly-close-review', 'tax-strategy-planning', 'aws-activate-credits-application', 'google-cloud-credits-application', 'microsoft-azure-credits-application', 'invoice-generation', 'business-banking-setup'],
         protectedAliases: ['finance', 'financial-modeling', 'fpa', 'bookkeeping'],
         defaultHireMode: 'job',
         lockCopy: 'Hire MONa to unlock financial modeling, FP&A, and tax strategy work for this request.'
@@ -214,7 +214,7 @@ exports.PERSONA_CAPABILITY_BUNDLES = {
         personaKey: 'sreya',
         bundleId: 'persona-sreya-core',
         catalogMetadata: buildCatalogMetadata('sreya', ['slo-design-and-implementation', 'incident-response', 'reliability-review']),
-        protectedJobs: ['slo-design-and-implementation', 'incident-response', 'reliability-review'],
+        protectedJobs: ['slo-design-and-implementation', 'incident-response', 'reliability-review', 'production-readiness-review'],
         protectedAliases: ['sre', 'reliability', 'incident-response', 'on-call'],
         defaultHireMode: 'job',
         lockCopy: 'Hire SREya to unlock SLO governance, incident response, and production reliability work for this request.'
@@ -231,7 +231,8 @@ exports.PERSONA_CAPABILITY_BUNDLES = {
             'procurement-negotiation-prep',
             'purchase-approval-and-po-package',
             'equipment-acceptance-and-supplier-retrospective',
-            'supplier-performance-review'
+            'supplier-performance-review',
+            'rfp-response-preparation'
         ],
         protectedAliases: ['procurement', 'sourcing', 'purchasing', 'supplier-management'],
         defaultHireMode: 'job',
@@ -266,6 +267,9 @@ function getPersonaCapabilityBundle(personaKey) {
     return exports.PERSONA_CAPABILITY_BUNDLES[personaKey];
 }
 function getProtectedPersonaForJob(jobName) {
+    if (isFreeJob(jobName)) {
+        return null;
+    }
     return PROTECTED_JOB_TO_PERSONA.get(jobName) || null;
 }
 function listPersonaCapabilityBundles() {

package/dist/src/first-run/install-state.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.maskInstallKey = maskInstallKey;
 exports.createInitialFirstRunState = createInitialFirstRunState;
 exports.loadFirstRunState = loadFirstRunState;
 exports.saveFirstRunState = saveFirstRunState;

package/dist/src/first-run/server.js

@@ -183,6 +183,19 @@ class FirstRunServer {
                 return res.status(500).json({ error: error instanceof Error ? error.message : 'Could not run row.' });
             }
         });
+        // Issue #646: accept a user-pasted key when first-run was launched without one
+        // (the no-terminal macOS installer path).
+        this.app.post('/api/first-run/set-key', (req, res) => {
+            const { key } = req.body || {};
+            if (!key || typeof key !== 'string') {
+                return res.status(400).json({ ok: false, error: 'key is required.' });
+            }
+            const result = this.sessionService.setKey(key);
+            if (!result.ok) {
+                return res.status(400).json({ ok: false, error: result.message });
+            }
+            return res.json({ ok: true, session: this.sessionService.getSession() });
+        });
         this.app.post('/api/first-run/agent/change', (req, res) => {
             try {
                 return res.json(this.sessionService.changeAgent(req.body || {}));

package/dist/src/first-run/session-service.js

@@ -200,7 +200,10 @@ function surfaceForAgent(option) {
 }
 class FirstRunSessionService {
     constructor(options) {
-        this.key = options.key;
+        // Issue #646: the key may be absent when first-run is launched by the macOS
+        // installer (.pkg) instead of `fraim first-run --key=…`. In that case the
+        // wizard prompts the user to paste their key (see setKey / needsKey).
+        this.key = options.key || '';
         this.headless = options.headless === true;
         this.fakeMode = getFakeStateMode();
         this.fakeStderr =
@@ -449,8 +452,24 @@ class FirstRunSessionService {
             agentOptions: types_1.FIRST_RUN_AGENT_OPTIONS,
             currentAgentId: this.state.agentId,
             supportedAgents,
+            needsKey: !this.key,
         };
     }
+    /**
+     * Issue #646: accept a user-pasted FRAIM key when first-run was launched
+     * without one (the no-terminal macOS installer path). Returns ok=false with a
+     * message on an invalid key so the wizard can show inline guidance.
+     */
+    setKey(rawKey) {
+        const key = (rawKey || '').trim();
+        if (!/^fraim_[A-Za-z0-9]+$/.test(key)) {
+            return { ok: false, message: 'That doesn\'t look like a FRAIM key. It should start with "fraim_" — copy it from your account page.' };
+        }
+        this.key = key;
+        this.state.installKeyRef = (0, install_state_1.maskInstallKey)(key);
+        this.persist();
+        return { ok: true };
+    }
     respond(message, ok) {
         return {
             ok,
@@ -588,12 +607,12 @@ class FirstRunSessionService {
             persistShellPath();
             const detectedIDEs = (0, ide_detector_1.detectInstalledIDEs)();
             if (detectedIDEs.length > 0) {
-                await (0, auto_mcp_setup_1.autoConfigureMCP)(this.key, {}, detectedIDEs.map((ide) => ide.name), {});
+                await (0, auto_mcp_setup_1.autoConfigureMCP)(this.key, detectedIDEs.map((ide) => ide.name));
             }
             // Write config.json after autoConfigureMCP so detectRowsOnLoad can use its
             // existence as a signal that IDE setup completed. Writing it before would cause
             // the wizard to mark this row 'ok' on retry before IDEs are actually configured.
-            (0, setup_1.saveGlobalConfig)(this.key, 'conversational', {}, {});
+            (0, setup_1.saveGlobalConfig)(this.key, 'conversational');
             const { syncUserLevelArtifacts } = await Promise.resolve().then(() => __importStar(require('../cli/setup/user-level-sync')));
             await syncUserLevelArtifacts();
             const { installSlashCommands, installGlobalRules } = await Promise.resolve().then(() => __importStar(require('../cli/setup/ide-global-integration')));

package/dist/src/local-mcp-server/stdio-server.js

@@ -413,6 +413,7 @@ class FraimLocalMCPServer {
         this.otlpServer = null;
         this.isShutdown = false;
         this.mentoringResponseCache = null;
+        this.jobStartCache = new Map();
         this.connectSyncInFlight = null;
         this.latestConnectSyncWarning = null;
         this.orgCacheRefreshInFlight = false;
@@ -1996,7 +1997,7 @@ class FraimLocalMCPServer {
                     if (!this.mentoringResponseCache) {
                         this.mentoringResponseCache = new Map();
                     }
-                    this.mentoringResponseCache.set(requestId, {
+                    this.mentoringResponseCache.set(request.id, {
                         nextPhase: tutoringResponse.nextPhase,
                         jobId: args.jobId || requestSessionId // Use jobId from args, fallback to sessionId
                     });
@@ -2063,10 +2064,13 @@ class FraimLocalMCPServer {
                         const overview = await mentor.getJobOverview(name);
                         if (overview) {
                             this.log(`✅ Local override found for get_fraim_job: ${name}`);
+                            const jobId = (0, crypto_1.randomUUID)();
+                            this.jobStartCache.set(request.id, { jobId, jobName: name });
+                            this.log(`📊 Generated jobId=${jobId} for job=${name}`);
                             let responseText = overview.overview;
                             if (!overview.isSimple) {
                                 responseText = `${mentor.getCompactPhaseAuthority()}\n\n${responseText}`;
-                                responseText += `\n\n---\n\n**This job has phases.** Use \`seekMentoring\` to get phase-specific instructions.`;
+                                responseText += `\n\n---\n\n**Job ID:** \`${jobId}\`\n\n**This job has phases.** Use \`seekMentoring\` with the jobId above to get phase-specific instructions.`;
                             }
                             // Inject local learning context for job requests (RFC 177).
                             const userEmail = this.ensureEngine().getUserEmail();
@@ -2356,7 +2360,7 @@ class FraimLocalMCPServer {
             if (!this.repoInfo) {
                 this.detectRepoInfo();
             }
-            // Bug fix: Enrich seekMentoring args with response data
+            // Enrich seekMentoring args with response data (nextPhase, jobId from cache)
             if (toolName === 'seekMentoring' && this.mentoringResponseCache) {
                 const requestId = request.id;
                 const cachedResponse = this.mentoringResponseCache.get(requestId);
@@ -2366,10 +2370,20 @@ class FraimLocalMCPServer {
                         nextPhase: cachedResponse.nextPhase,
                         jobId: cachedResponse.jobId
                     };
-                    this.mentoringResponseCache.delete(requestId); // Clean up
+                    this.mentoringResponseCache.delete(requestId);
                     this.log(`📊 Enriched seekMentoring args with nextPhase=${cachedResponse.nextPhase}, jobId=${cachedResponse.jobId}`);
                 }
             }
+            // Enrich get_fraim_job args with the UUID jobId and action:start from jobStartCache
+            if (toolName === 'get_fraim_job') {
+                const requestId = request.id;
+                const cached = this.jobStartCache.get(requestId);
+                if (cached) {
+                    args = { ...args, jobId: cached.jobId, action: 'start' };
+                    this.jobStartCache.delete(requestId);
+                    this.log(`📊 Enriched get_fraim_job args with jobId=${cached.jobId}, action=start`);
+                }
+            }
             // Capture the current queue size before collection
             const beforeCount = this.usageCollector.getEventCount();
             try {
@@ -2410,6 +2424,16 @@ class FraimLocalMCPServer {
                         this.log(`📊 🔍 Debug: get_fraim_file path="${args.path}"`);
                     }
                 }
+                // Emit job-complete event when seekMentoring reaches the final phase
+                if (toolName === 'seekMentoring' && args.nextPhase === null && args.jobName && args.jobId) {
+                    try {
+                        this.usageCollector.collectJobComplete(args.jobName, args.jobId, requestSessionId);
+                        this.log(`📊 ✅ Job complete event emitted: ${args.jobName} (jobId: ${args.jobId})`);
+                    }
+                    catch (err) {
+                        this.log(`📊 ⚠️ Job complete event failed (non-blocking): ${err.message}`);
+                    }
+                }
             }
             catch (error) {
                 this.log(`📊 ❌ Usage collection error: ${error.message}`);

package/dist/src/local-mcp-server/usage-collector.js

@@ -142,6 +142,8 @@ class UsageCollector {
             case 'get_fraim_job':
                 if (args.job)
                     analyticsArgs.job = args.job;
+                if (args.action)
+                    analyticsArgs.action = args.action;
                 break;
             case 'fraim_connect':
                 if (args.agent?.name)
@@ -179,6 +181,28 @@ class UsageCollector {
                 return null;
         }
     }
+    /**
+     * Emit a job-completion event when seekMentoring returns nextPhase === null.
+     * Called by the local proxy after the final mentoring event is queued.
+     */
+    collectJobComplete(jobName, jobId, sessionId) {
+        const event = {
+            type: 'job',
+            name: jobName,
+            userId: this.userId || 'unknown',
+            sessionId,
+            success: true,
+            jobId,
+            repoIdentifier: this.repoIdentifier || undefined,
+            agentName: this.agentName || undefined,
+            agentModel: this.agentModel || undefined,
+            args: { action: 'complete', jobId },
+        };
+        this.events.push(event);
+        const msg = `[UsageCollector] ✅ Job complete event: ${jobName} (jobId: ${jobId}, queue: ${this.events.length})`;
+        console.error(msg);
+        process.stderr.write(msg + '\n');
+    }
     /**
      * Get collected events for upload and clear the queue
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim-framework",
-  "version": "2.0.176",
+  "version": "2.0.179",
   "description": "FRAIM: AI Workforce Infrastructure — the organizational capability that turns AI agents into an accountable workforce, their operators into capable AI managers, and executives into leaders with clear optics on AI proficiency.",
   "main": "index.js",
   "bin": {
@@ -9,7 +9,7 @@
   "scripts": {
     "dev": "tsx --watch src/fraim-mcp-server.ts > server.log 2>&1",
     "dev:prod": "npm run build && node dist/src/fraim-mcp-server.js > server.log 2>&1",
-    "build": "tsx scripts/build-fraim-config-schema-template.ts && npm run typecheck:scripts && tsc && npm run build:stubs && npm run build:fraim-brain && node scripts/copy-registry.js && npm run validate:registry && npm run validate:fraim-pro-assets && npm run validate:employee-catalog && npm run validate:learning-format-contract && tsx scripts/validate-purity.ts",
+    "build": "tsx scripts/build-fraim-config-schema-template.ts && npm run typecheck:scripts && tsc && npm run build:stubs && npm run build:fraim-brain && node scripts/copy-registry.js && npm run validate:registry && npm run validate:marketplaces && npm run validate:fraim-pro-assets && npm run validate:employee-catalog && npm run validate:learning-format-contract && tsx scripts/validate-purity.ts",
     "validate:learning-format-contract": "tsx scripts/validate-learning-format-contract.ts",
     "build:stubs": "tsx scripts/build-stub-registry.ts",
     "build:fraim-brain": "node scripts/generate-fraim-brain.js",
@@ -28,6 +28,8 @@
     "hub:desktop": "npm run build && electron dist/src/ai-hub/desktop-main.js",
     "hub:dev": "tsx scripts/start-hub-dev.ts",
     "firstrun:dev": "tsx scripts/start-firstrun-dev.ts",
+    "sign:mac": "bash scripts/sign-macos-installer.sh",
+    "build:mac-installer": "bash scripts/build-macos-installer.sh",
     "start:fraim": "tsx src/fraim-mcp-server.ts",
     "dev:fraim": "tsx --watch src/fraim-mcp-server.ts",
     "serve:website": "node fraim-pro/serve.js",
@@ -48,6 +50,7 @@
     "publish-fraim-only": "node scripts/publish-fraim.js",
     "publish-both-manual": "node scripts/publish-both.js",
     "validate:registry": "tsx scripts/verify-registry-paths.ts && npm run validate:jobs && npm run validate:skills && npm run validate:registry-references && npm run validate:platform-agnostic && npm run validate:template-namespaces && npm run validate:config-fallbacks && npm run validate:bootstrap-config-coverage && npm run validate:provider-action-mappings && npm run validate:fidelity && npm run validate:config-tokens && npm run validate:brain-mapping && npm run validate:template-syntax",
+    "validate:marketplaces": "tsx scripts/validate-marketplace-bundles.ts",
     "typecheck:scripts": "tsc -p tsconfig.scripts.json --pretty false",
     "validate:registry-references": "tsx scripts/validate-registry-references.ts",
     "validate:brain-mapping": "tsx scripts/validate-brain-mapping.ts",

package/public/ai-hub/index.html

@@ -144,8 +144,20 @@
     <!-- Overview sub-view: dashboard project cards -->
     <div id="proj-overview">
       <div class="hub-area-page">
-        <div class="sec-label">All projects</div>
-        <div class="proj-grid" id="proj-grid"></div>
+        <!-- Issue #671: Cards / Kanban view toggle -->
+        <div class="kb-view-toggle" id="kb-view-toggle">
+          <button class="kb-vtab on" data-view="cards" type="button">Cards</button>
+          <button class="kb-vtab" data-view="kanban" type="button">Kanban</button>
+        </div>
+        <div id="proj-cards-view">
+          <div class="sec-label" id="proj-cards-label">All projects</div>
+          <div class="proj-grid" id="proj-grid"></div>
+          <div id="kb-runs-grid" hidden></div>
+        </div>
+      </div>
+      <!-- Issue #671: Kanban board — rendered by tfRenderKanban() -->
+      <div id="proj-kanban" hidden>
+        <div id="kb-stats" class="kb-stats"></div>
       </div>
     </div>