fraim-hub 2.0.211 → 2.0.213

package/dist/src/ai-hub/hosts.js

@@ -364,8 +364,12 @@ function extractSignalFromArgs(args) {
     const discriminant = typeof args.runDiscriminant === 'string' ? args.runDiscriminant : undefined;
     const jobName = typeof args.jobName === 'string' ? args.jobName : undefined;
     const jobId = typeof args.jobId === 'string' ? args.jobId : undefined;
+    const issueNumber = typeof args.issueNumber === 'string' ? args.issueNumber
+        : typeof args.issueNumber === 'number' ? String(args.issueNumber)
+            : undefined;
     const reviewHandoff = extractReviewHandoffFromArgs(args);
     const delegationLedger = extractDelegationLedgerFromArgs(args);
+    const nextJobRecommendations = extractNextJobRecommendationsFromArgs(args);
     return {
         phaseId,
         phaseStatus,
@@ -373,8 +377,10 @@ function extractSignalFromArgs(args) {
         discriminant,
         jobName,
         jobId,
+        ...(issueNumber ? { issueNumber } : {}),
         ...(reviewHandoff ? { reviewHandoff } : {}),
         ...(delegationLedger ? { delegationLedger } : {}),
+        ...(nextJobRecommendations ? { nextJobRecommendations } : {}),
     };
 }
 function extractDelegationLedgerFromArgs(args) {
@@ -625,6 +631,52 @@ function readReviewHandoffCandidate(value) {
         ...(reviewActions.length > 0 ? { reviewActions } : {}),
     };
 }
+// Issue #848: next-job recommendations follow the same evidence-channel pattern as
+// reviewHandoff — accept either the top-level arg or evidence.nextJobRecommendations.
+const MAX_NEXT_JOB_RECOMMENDATIONS = 3;
+function extractNextJobRecommendationsFromArgs(args) {
+    const direct = readNextJobRecommendationsCandidate(args.nextJobRecommendations);
+    if (direct)
+        return direct;
+    const evidence = args.evidence;
+    if (evidence && typeof evidence === 'object' && !Array.isArray(evidence)) {
+        return readNextJobRecommendationsCandidate(evidence.nextJobRecommendations);
+    }
+    return null;
+}
+function readNextJobRecommendationsCandidate(value) {
+    let candidate = value;
+    if (typeof candidate === 'string') {
+        try {
+            candidate = JSON.parse(candidate);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (!Array.isArray(candidate))
+        return null;
+    const recs = candidate
+        .map((entry) => readNextJobRecommendationCandidate(entry))
+        .filter((entry) => entry !== null)
+        .slice(0, MAX_NEXT_JOB_RECOMMENDATIONS);
+    return recs.length > 0 ? recs : null;
+}
+function readNextJobRecommendationCandidate(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const obj = value;
+    const jobId = typeof obj.jobId === 'string' ? obj.jobId.trim() : '';
+    const label = typeof obj.label === 'string' ? obj.label.trim() : '';
+    if (!jobId || !label)
+        return null;
+    return {
+        jobId,
+        label: label.slice(0, 60),
+        ...(typeof obj.reason === 'string' && obj.reason.trim() ? { reason: obj.reason.trim().slice(0, 200) } : {}),
+        ...(typeof obj.contextSummary === 'string' && obj.contextSummary.trim() ? { contextSummary: obj.contextSummary.trim().slice(0, 300) } : {}),
+    };
+}
 const EMPLOYEE_LABELS = {
     codex: 'Codex',
     claude: 'Claude Code',

package/dist/src/ai-hub/server.js

@@ -210,15 +210,19 @@ function directoryExists(projectPath) {
         return false;
     }
 }
-function resolveInitialHubProjectPath(preferencesStore, fallbackPath) {
-    const fallback = path_1.default.resolve(fallbackPath || process.cwd());
-    const recorded = preferencesStore.load(fallback).projectPath;
+// Issue #866 R2: the directory the Hub was launched in is NOT a project. The
+// active project is a previously-recorded project that still exists on disk;
+// when none is recorded the Hub has no active project and opens on an empty
+// project list. This deliberately never falls back to process.cwd() — the launch
+// directory must not masquerade as a project.
+function resolveInitialHubProjectPath(preferencesStore) {
+    const recorded = preferencesStore.load('').projectPath;
     if (typeof recorded === 'string' && recorded.trim().length > 0) {
         const resolved = path_1.default.resolve(recorded);
         if (directoryExists(resolved))
             return resolved;
     }
-    return fallback;
+    return '';
 }
 class AiHubRunRegistry {
     constructor() {
@@ -296,9 +300,19 @@ class AiHubRunRegistry {
 }
 // ─── Issue #578: Deployment + Host stores ─────────────────────────────────────
 const VALID_EMPLOYEE_IDS = ['codex', 'claude', 'gemini', 'copilot'];
+const SCHEDULED_FIRE_LEASE_TTL_MS = 2 * 60 * 1000;
+const SCHEDULED_FIRE_LEASE_PRUNE_MS = 7 * 24 * 60 * 60 * 1000;
 function startSessionSeedForHost(hostId, runId) {
     return hostId === 'gemini' ? undefined : runId;
 }
+function safeScheduledLeasePart(value) {
+    return value.replace(/[^a-zA-Z0-9._-]/g, '_');
+}
+function scheduledFireBucketMs(cronExpr, nowMs = Date.now()) {
+    const fieldCount = cronExpr.trim().split(/\s+/).filter(Boolean).length;
+    const bucketMs = fieldCount === 6 ? 1000 : 60 * 1000;
+    return Math.floor(nowMs / bucketMs) * bucketMs;
+}
 class DeploymentStore {
     constructor(filePath) {
         this.filePath = filePath ?? path_1.default.join(getUserHubDir(), 'hub-deployments.json');
@@ -341,6 +355,76 @@ class DeploymentStore {
         this.save(next);
         return true;
     }
+    claimScheduledFire(deploymentId, fireTimeMs, nowMs = Date.now()) {
+        const leaseDir = path_1.default.join(path_1.default.dirname(this.filePath), 'hub-scheduler-leases');
+        fs_1.default.mkdirSync(leaseDir, { recursive: true });
+        this.pruneScheduledFireLeases(leaseDir, nowMs);
+        const leasePath = path_1.default.join(leaseDir, `${safeScheduledLeasePart(deploymentId)}-${fireTimeMs}.json`);
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            try {
+                const fd = fs_1.default.openSync(leasePath, 'wx');
+                try {
+                    fs_1.default.writeFileSync(fd, JSON.stringify({
+                        deploymentId,
+                        fireTimeMs,
+                        claimedAt: new Date(nowMs).toISOString(),
+                        pid: process.pid,
+                    }, null, 2));
+                }
+                finally {
+                    fs_1.default.closeSync(fd);
+                }
+                return true;
+            }
+            catch (err) {
+                const code = err.code;
+                if (code !== 'EEXIST') {
+                    console.warn(`[ai-hub] scheduled deployment lease claim failed for ${deploymentId}:`, err);
+                    return false;
+                }
+                if (!this.isStaleScheduledFireLease(leasePath, nowMs))
+                    return false;
+                try {
+                    fs_1.default.unlinkSync(leasePath);
+                }
+                catch (unlinkErr) {
+                    if (unlinkErr.code !== 'ENOENT')
+                        return false;
+                }
+            }
+        }
+        return false;
+    }
+    isStaleScheduledFireLease(leasePath, nowMs) {
+        try {
+            const stat = fs_1.default.statSync(leasePath);
+            return nowMs - stat.mtimeMs > SCHEDULED_FIRE_LEASE_TTL_MS;
+        }
+        catch {
+            return false;
+        }
+    }
+    pruneScheduledFireLeases(leaseDir, nowMs) {
+        try {
+            for (const entry of fs_1.default.readdirSync(leaseDir, { withFileTypes: true })) {
+                if (!entry.isFile() || !entry.name.endsWith('.json'))
+                    continue;
+                const leasePath = path_1.default.join(leaseDir, entry.name);
+                try {
+                    const stat = fs_1.default.statSync(leasePath);
+                    if (nowMs - stat.mtimeMs > SCHEDULED_FIRE_LEASE_PRUNE_MS) {
+                        fs_1.default.unlinkSync(leasePath);
+                    }
+                }
+                catch {
+                    // Best-effort cleanup; failed pruning must not block scheduler startup.
+                }
+            }
+        }
+        catch {
+            // Best-effort cleanup; lease creation below remains the correctness gate.
+        }
+    }
 }
 exports.DeploymentStore = DeploymentStore;
 class HostConfigStore {
@@ -506,6 +590,34 @@ function normalizeReviewHandoff(raw) {
     }
     return null;
 }
+// Issue #848: defensively re-validate next-job recommendations on the run.
+// hosts.parseSeekMentoringSignal already normalizes the evidence-channel payload,
+// but the server owns the persisted contract: require jobId + label, clamp text
+// lengths, and cap at 3.
+const MAX_NEXT_JOB_RECOMMENDATIONS = 3;
+function normalizeNextJobRecommendations(raw) {
+    if (!Array.isArray(raw))
+        return null;
+    const recs = [];
+    for (const entry of raw) {
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+            continue;
+        const obj = entry;
+        const jobId = typeof obj.jobId === 'string' ? obj.jobId.trim() : '';
+        const label = typeof obj.label === 'string' ? obj.label.trim() : '';
+        if (!jobId || !label)
+            continue;
+        recs.push({
+            jobId,
+            label: label.slice(0, 60),
+            ...(typeof obj.reason === 'string' && obj.reason.trim() ? { reason: obj.reason.trim().slice(0, 200) } : {}),
+            ...(typeof obj.contextSummary === 'string' && obj.contextSummary.trim() ? { contextSummary: obj.contextSummary.trim().slice(0, 300) } : {}),
+        });
+        if (recs.length >= MAX_NEXT_JOB_RECOMMENDATIONS)
+            break;
+    }
+    return recs.length > 0 ? recs : null;
+}
 const DELEGATION_TASK_STATUSES = new Set([
     'planned',
     'running',
@@ -823,6 +935,15 @@ function applySeekMentoringSignal(run, signal) {
     const callJobName = signal.jobName;
     if (callJobName && targetJobId && callJobName !== targetJobId)
         return;
+    // Issue #848: capture the issue number the call carries so a launched follow-on
+    // run can reference the originating issue, and persist any next-job recommendations.
+    if (signal.issueNumber)
+        run.issueNumber = signal.issueNumber;
+    if (signal.nextJobRecommendations) {
+        const normalized = normalizeNextJobRecommendations(signal.nextJobRecommendations);
+        if (normalized)
+            run.nextJobRecommendations = normalized;
+    }
     if (signal.reviewHandoff) {
         const normalizedReviewHandoff = normalizeReviewHandoff(signal.reviewHandoff);
         run.reviewHandoff = normalizedReviewHandoff || signal.reviewHandoff;
@@ -1233,7 +1354,7 @@ class AiHubServer {
         this.preferencesStore = options.preferencesStore || new preferences_1.AiHubPreferencesStore();
         this.projectPath = options.projectPath
             ? path_1.default.resolve(options.projectPath)
-            : resolveInitialHubProjectPath(this.preferencesStore, process.cwd());
+            : resolveInitialHubProjectPath(this.preferencesStore);
         this.conversationStore = options.conversationStore || new conversation_store_1.AiHubConversationStore();
         this.configuredAgentStore = options.configuredAgentStore || new configured_agents_1.AiHubConfiguredAgentStore();
         this.wordTaskpaneDir = options.wordTaskpaneDir ?? resolveWordTaskpaneDir(this.projectPath);
@@ -1376,7 +1497,10 @@ class AiHubServer {
         return this.projectPath;
     }
     defaultProjectPath() {
-        return resolveInitialHubProjectPath(this.preferencesStore, this.projectPath);
+        // Prefer the recorded project (reflects a project switch), then the active
+        // project resolved at construction, then '' when no project has been chosen
+        // (#866 R2). Never falls back to cwd.
+        return resolveInitialHubProjectPath(this.preferencesStore) || this.projectPath;
     }
     async start(port) {
         this.httpPort = port;
@@ -1454,7 +1578,10 @@ class AiHubServer {
     }
     getHttpsPort() { return this.httpsPort; }
     knownProjects(projectPath, extras = []) {
-        const normalizedProjectPath = path_1.default.resolve(projectPath || this.projectPath);
+        // #866 R2: guard against path.resolve('') === cwd. When there is no active
+        // project, keep the path empty so no invocation-directory project is injected.
+        const activeProjectPath = projectPath || this.projectPath;
+        const normalizedProjectPath = activeProjectPath ? path_1.default.resolve(activeProjectPath) : '';
         const preferences = this.preferencesStore.load(normalizedProjectPath);
         const conversationProjects = this.conversationStore.listProjectPaths().map((folderPath) => ({ folderPath }));
         return (0, preferences_1.normalizeAiHubProjectList)([
@@ -1464,7 +1591,9 @@ class AiHubServer {
         ], normalizedProjectPath, { removedProjectPaths: preferences.removedProjectPaths || [] });
     }
     async bootstrapResponse(projectPath) {
-        const normalizedProjectPath = path_1.default.resolve(projectPath || this.projectPath);
+        // #866 R2: guard against path.resolve('') === cwd; '' means "no active project".
+        const activeProjectPath = projectPath || this.projectPath;
+        const normalizedProjectPath = activeProjectPath ? path_1.default.resolve(activeProjectPath) : '';
         const employees = this.hostRuntime.detectEmployees();
         const configuredAgents = this.configuredAgentStore
             .listWithDefaults(employees)
@@ -1617,6 +1746,10 @@ class AiHubServer {
             reviewHandoff: run.reviewHandoff || null,
             delegation: run.delegation || null,
             delegationTaskId: run.delegationTaskId || null,
+            // Issue #848: fold next-job recommendations + issue pointer onto the record
+            // so completed conversations render "What's next?" chips after reload.
+            nextJobRecommendations: run.nextJobRecommendations || null,
+            issueNumber: run.issueNumber ?? null,
             managedByRunId: run.managedByRunId || null,
             managedByPersonaKey: run.managedByPersonaKey || null,
             humanCoachingDisabled: run.humanCoachingDisabled || false,
@@ -2494,11 +2627,17 @@ class AiHubServer {
                     return res.status(400).json({ error: 'projectPath required for project conversations' });
                 }
                 const projectPath = scope ? (0, conversation_store_1.conversationScopeKey)(scope, '') : ensureDirectoryPath(body.projectPath);
-                this.conversationStore.patchConversation(projectPath, req.params.conversationId, body);
+                const patchFields = Object.keys(body).filter((key) => key !== 'projectPath' && key !== 'scope' && key !== 'activeId');
+                if (patchFields.length > 0) {
+                    this.conversationStore.patchConversation(projectPath, req.params.conversationId, body);
+                }
                 if (body.activeId !== undefined) {
                     // Body-safe: set activeId via the index, never by rewriting conversation bodies (#820).
                     this.conversationStore.setActiveId(projectPath, body.activeId);
                 }
+                if (patchFields.length === 0 && body.activeId !== undefined) {
+                    return res.json({ projectPath, scope: scope ?? 'project', activeId: body.activeId, source: 'disk' });
+                }
                 const loaded = this.conversationStore.loadProject(projectPath);
                 return res.json({ projectPath, ...loaded, source: 'disk' });
             }
@@ -2976,7 +3115,7 @@ class AiHubServer {
                     sourceTrigger: req.body.sourceTrigger ?? 'manager',
                 };
                 this.runRegistry.create(run, {});
-                this.persistRunConversation(run, run.conversationId || run.id);
+                this.scheduleRunConversationPersistence(run, run.conversationId || run.id);
                 // Issue #442: create the Direct (B) run before spawning either process
                 // so we can cross-link both runs via compareRunId before any events arrive.
                 // directMsg is the plain user instructions — no FRAIM invocation prefix.
@@ -3012,6 +3151,7 @@ class AiHubServer {
                         current.compareRunId = directRun.id;
                     });
                     this.runRegistry.create(directRun, {});
+                    this.scheduleRunConversationPersistence(directRun, directRun.id);
                 }
                 const child = this.hostRuntime.startRun(hostId, projectPath, message, {
                     onEvent: (event, channel) => {
@@ -3314,7 +3454,7 @@ class AiHubServer {
                 if (reviewApprovalSystemEventText)
                     run.events.push((0, hosts_1.createHubEvent)('system', reviewApprovalSystemEventText));
                 this.runRegistry.create(run, {});
-                this.persistRunConversation(run, run.conversationId || run.id);
+                this.scheduleRunConversationPersistence(run, run.conversationId || run.id);
                 const child = this.hostRuntime.continueRun(hostId, projectPath, sessionId, message, {
                     onEvent: (event, channel) => {
                         this.runRegistry.update(run.id, (current) => {
@@ -3451,6 +3591,129 @@ class AiHubServer {
             }
             return res.json(this.enrichRunForResponse(run));
         });
+        // ─── Issue #834: Learning sharing map + per-layer backend config ─────────
+        // Strips embedded credentials from a git URL before including it in any response
+        // (e.g. https://token@github.com/org/repo → https://github.com/org/repo).
+        // Used by the sharing-map and sharing-backend GET handlers below.
+        function redactGitUrl(url) {
+            if (!url)
+                return null;
+            try {
+                const parsed = new URL(url);
+                parsed.username = '';
+                parsed.password = '';
+                return parsed.toString();
+            }
+            catch {
+                return null;
+            }
+        }
+        // GET /api/ai-hub/sharing-map — metadata-only projection of all four learning
+        // scopes: org, manager, project, raw. Returns backend posture and recommendation
+        // per scope. No artifact bodies, no credentials, no raw file paths.
+        this.app.get('/api/ai-hub/sharing-map', (req, res) => {
+            const projectPath = typeof req.query.projectPath === 'string' && req.query.projectPath.length > 0
+                ? path_1.default.resolve(req.query.projectPath)
+                : this.defaultProjectPath();
+            const orgBackend = (0, user_config_1.getLayerBackend)('org');
+            const managerBackend = (0, user_config_1.getLayerBackend)('manager');
+            // Project backend is read from fraim/config.json (team-shared, repo-local).
+            let projectBackend = 'single-machine';
+            try {
+                const projCfg = path_1.default.join(projectPath, 'fraim', 'config.json');
+                if (fs_1.default.existsSync(projCfg)) {
+                    const parsed = JSON.parse(fs_1.default.readFileSync(projCfg, 'utf8'));
+                    if (parsed?.projectStorage?.backend)
+                        projectBackend = parsed.projectStorage.backend;
+                }
+            }
+            catch { /* serve default */ }
+            const teamCtx = (0, learning_context_builder_1.resolveTeamContextFiles)(projectPath);
+            const map = [
+                {
+                    scope: 'org',
+                    label: 'Company',
+                    backend: orgBackend?.backend ?? 'single-machine',
+                    configuredHome: orgBackend ? (orgBackend.backend === 'git' ? redactGitUrl(orgBackend.gitUrl) : orgBackend.backend === 'local-folder' ? orgBackend.localPath ?? null : orgBackend.backend) : null,
+                    recommendation: 'git',
+                    artifactsPresent: !!(teamCtx.orgContext?.present || teamCtx.orgRules?.present),
+                    nextJob: 'organization-onboarding',
+                },
+                {
+                    scope: 'manager',
+                    label: 'Manager',
+                    backend: managerBackend?.backend ?? 'single-machine',
+                    configuredHome: managerBackend ? (managerBackend.backend === 'git' ? redactGitUrl(managerBackend.gitUrl) : managerBackend.backend === 'local-folder' ? managerBackend.localPath ?? null : managerBackend.backend) : null,
+                    recommendation: 'single-machine',
+                    personalDataWarning: true,
+                    artifactsPresent: !!(teamCtx.managerContext?.present || teamCtx.managerRules?.present),
+                    nextJob: 'manager-agreements',
+                },
+                {
+                    scope: 'project',
+                    label: 'Project',
+                    backend: projectBackend,
+                    configuredHome: null,
+                    recommendation: 'git',
+                    artifactsPresent: !!(teamCtx.projectContext?.present || teamCtx.projectBrief?.present),
+                    nextJob: 'project-onboarding',
+                },
+                {
+                    scope: 'raw',
+                    label: 'Source signals',
+                    backend: 'single-machine',
+                    configuredHome: null,
+                    recommendation: 'single-machine',
+                    locked: true,
+                    nextJob: 'sleep-on-learnings',
+                },
+            ];
+            return res.json(map);
+        });
+        // GET /api/ai-hub/sharing-backend?layer=<org|manager>&projectPath=
+        // Returns the configured backend for the named layer.
+        this.app.get('/api/ai-hub/sharing-backend', (req, res) => {
+            const layer = req.query.layer;
+            if (layer !== 'org' && layer !== 'manager') {
+                return res.status(400).json({ error: 'layer must be org or manager' });
+            }
+            const cfg = (0, user_config_1.getLayerBackend)(layer);
+            return res.json({
+                layer,
+                backend: cfg?.backend ?? 'single-machine',
+                gitUrl: cfg?.backend === 'git' ? redactGitUrl(cfg.gitUrl) : undefined,
+                localPath: cfg?.backend === 'local-folder' ? cfg.localPath : undefined,
+            });
+        });
+        // POST /api/ai-hub/sharing-backend { layer, backend, gitUrl?, override? }
+        // Writes the backend selection for the named layer.
+        // Guardrail: manager + git blocked without override:true (GDPR, issue #834).
+        this.app.post('/api/ai-hub/sharing-backend', (req, res) => {
+            const body = (req.body ?? {});
+            const layer = body.layer;
+            const backend = body.backend;
+            if (layer !== 'org' && layer !== 'manager') {
+                return res.status(400).json({ error: 'layer must be org or manager' });
+            }
+            if (backend !== 'git' && backend !== 'fraim-cloud' && backend !== 'local-folder' && backend !== 'single-machine') {
+                return res.status(400).json({ error: 'backend must be git, fraim-cloud, local-folder, or single-machine' });
+            }
+            // GDPR guardrail: personal-bearing layer + git blocked without explicit override.
+            const personalLayers = ['manager'];
+            if (personalLayers.includes(layer) && backend === 'git' && !body.override) {
+                return res.status(409).json({
+                    error: 'guardrailBlocked',
+                    message: 'Manager learnings may contain personal data. Git history makes GDPR erasure impossible. Set override:true to proceed.',
+                });
+            }
+            const gitUrl = backend === 'git' && typeof body.gitUrl === 'string' ? body.gitUrl.trim() : undefined;
+            const localPath = backend === 'local-folder' && typeof body.localPath === 'string' ? body.localPath.trim() : undefined;
+            if (backend === 'local-folder' && !localPath) {
+                return res.status(400).json({ error: 'localPath is required for the local-folder backend' });
+            }
+            (0, user_config_1.setLayerBackend)(layer, { backend: backend, gitUrl, localPath });
+            return res.json({ layer, backend, gitUrl: gitUrl ?? null, localPath: localPath ?? null });
+        });
         // ─── Issue #578: Scheduled + Reactive Employees ───────────────────────────
         // POST /api/ai-hub/schedules — create a recurring scheduled deployment.
         this.app.post('/api/ai-hub/schedules', (req, res) => {
@@ -3821,6 +4084,11 @@ class AiHubServer {
             }
             const task = cron.schedule(deployment.cronExpr, async () => {
                 try {
+                    const fireTimeMs = scheduledFireBucketMs(deployment.cronExpr || '');
+                    if (!this.deploymentStore.claimScheduledFire(deployment.id, fireTimeMs)) {
+                        console.log(`[ai-hub] scheduled deployment ${deployment.id} skipped - scheduled fire already claimed`);
+                        return;
+                    }
                     await this.fireDeploymentRun(deployment);
                 }
                 catch (err) {

package/dist/src/cli/utils/user-config.js

@@ -3,6 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.getLayerBackend = getLayerBackend;
+exports.setLayerBackend = setLayerBackend;
 exports.readUserFraimConfig = readUserFraimConfig;
 exports.writeUserFraimConfig = writeUserFraimConfig;
 exports.getInstalledIdes = getInstalledIdes;
@@ -19,6 +21,23 @@ exports.getManagerStorageConfig = getManagerStorageConfig;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const project_fraim_paths_1 = require("../../core/utils/project-fraim-paths");
+/** Resolve the backend config for a named layer, or null when unconfigured (issue #834). */
+function getLayerBackend(layer) {
+    if (layer === 'org')
+        return getOrganizationConfig();
+    if (layer === 'manager')
+        return getManagerStorageConfig();
+    return null;
+}
+/** Write the backend config for a named layer (issue #834). */
+function setLayerBackend(layer, config) {
+    if (layer === 'org') {
+        writeUserFraimConfig({ organization: config });
+    }
+    else if (layer === 'manager') {
+        writeUserFraimConfig({ managerStorage: config });
+    }
+}
 function getUserConfigPath() {
     return path_1.default.join((0, project_fraim_paths_1.getUserFraimDirPath)(), 'config.json');
 }
@@ -77,6 +96,15 @@ function getOrganizationConfig() {
     if (raw.backend === 'fraim-cloud') {
         return { backend: 'fraim-cloud', id: raw.id };
     }
+    if (raw.backend === 'local-folder') {
+        const localPath = typeof raw.localPath === 'string' ? raw.localPath.trim() : '';
+        if (!localPath)
+            return null;
+        return { backend: 'local-folder', localPath };
+    }
+    if (raw.backend === 'single-machine') {
+        return { backend: 'single-machine' };
+    }
     return null;
 }
 /**
@@ -96,5 +124,14 @@ function getManagerStorageConfig() {
     if (raw.backend === 'fraim-cloud') {
         return { backend: 'fraim-cloud', id: raw.id };
     }
+    if (raw.backend === 'local-folder') {
+        const localPath = typeof raw.localPath === 'string' ? raw.localPath.trim() : '';
+        if (!localPath)
+            return null;
+        return { backend: 'local-folder', localPath };
+    }
+    if (raw.backend === 'single-machine') {
+        return { backend: 'single-machine' };
+    }
     return null;
 }

package/dist/src/config/persona-capability-bundles.js

@@ -130,7 +130,7 @@ exports.PERSONA_CAPABILITY_BUNDLES = {
         personaKey: 'ricardo',
         bundleId: 'persona-ricardo-core',
         catalogMetadata: buildCatalogMetadata('ricardo', ['role-intake-and-scorecard', 'job-posting-and-sourcing', 'candidate-pipeline-management']),
-        protectedJobs: ['role-intake-and-scorecard', 'job-posting-and-sourcing', 'candidate-pipeline-management', 'interview-coordination', 'offer-and-close-management'],
+        protectedJobs: ['role-intake-and-scorecard', 'job-posting-and-sourcing', 'candidate-pipeline-management', 'sourcing-funnel-recap', 'interview-coordination', 'offer-and-close-management'],
         protectedAliases: ['recruiting', 'recruiter', 'hiring'],
         defaultHireMode: 'job',
         lockCopy: 'Hire RECardo to unlock full-cycle recruiting work for this request.'