fullstackgtm 0.47.0 → 0.49.0

package/CHANGELOG.md

@@ -3,10 +3,80 @@
 All notable changes to the `fullstackgtm` package are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and the project adheres to [Semantic Versioning](https://semver.org/).
-The path to 1.0 is planned in the roadmap doc in the repository.
+The path to 1.0 is planned in [docs/roadmap-to-1.0.md](https://github.com/fullstackgtm/core/blob/main/docs/roadmap-to-1.0.md).
 
 ## [Unreleased]
 
+## [0.49.0] — 2026-07-10
+
+### Security
+
+- MCP apply now accepts only store-backed, HMAC-approved plan ids; external
+  plan paths and caller-supplied approvals/value overrides are rejected.
+- Apply uses an atomic single-owner claim and durable attempt journal.
+  Uncertain attempts remain fail-closed until an operator acknowledges provider
+  state; recovery clears every approval and never replays writes automatically.
+- Salesforce credential-bearing endpoints are restricted to canonical HTTPS
+  Salesforce origins and redirects are handled without forwarding credentials.
+- Executable rule packages require explicit CLI trust and are disabled entirely
+  in MCP. Implicit repository configuration cannot activate plugins.
+- Sensitive local files use atomic no-follow writes and verified no-follow
+  reads; symlinked credential, plan, and managed-home paths are refused.
+- Market capture/sourcing uses DNS-pinned public-only HTTP with per-hop redirect
+  validation, bounded responses, and cross-origin credential stripping.
+- Provider HTTP failures expose typed status metadata without raw response
+  bodies, reflected secrets, or PII.
+
+### Changed
+
+- **Breaking pre-1.0 plan-store contract:** `PlanStore` implementations now
+  participate in apply claims, attempt recovery, and claim-bound run recording;
+  `ApprovalStatus` includes `applying`. Custom stores must implement the new
+  lifecycle before upgrading.
+- Public mirror generation is commit-derived, allowlisted, secret-scanned, and
+  fail-closed. npm publishing uses pinned actions/npm plus a protected release
+  environment and provenance verification.
+- Package CI now validates Node 20/22, Linux/macOS/Windows compiled runtimes,
+  and actual installed tarballs with and without optional MCP peers.
+
+### Fixed
+
+- `bulk-update --help` and `-h` now return focused help before parsing an object
+  type or touching configuration, credentials, disk, or network.
+- Installation guidance no longer pins a brittle exact demo finding count.
+
+## [0.48.0] — 2026-07-08
+
+### Added
+
+- Added `GtmAuditRule.emitsOperations` and `isFindingsOnlyRule` so hosts can derive findings-only rule behavior from the package registry instead of duplicating rule IDs.
+- **Route, hierarchy, and relationships open surfaces.** `route leads` builds governed lead-to-account/owner patch plans; `hierarchy report` and `relationships account` provide read-only planning reports for account trees and stakeholder maps.
+
+### Changed
+
+- **CLI human path now uses progressive disclosure by default.** Bare
+  `fullstackgtm`/`--help` shows a compact lifecycle-grouped command map instead
+  of the full flag wall; `help <command>` and `<command> --help` show focused
+  per-command guidance; `help --full` (including `help <command> --full`) keeps
+  the complete reference available. `audit` now defaults to a summary view with
+  `--full` for per-operation detail and prints next-step guidance on stderr for
+  human runs while keeping `--json` machine-clean. The dry-run footer now frames
+  approval/write safety as invariants rather than prototype copy.
+- **Patch-plan assumptions and open questions are canonical.** Plan exports and
+  markdown use `assumptions` plus `openQuestions`; the duplicate
+  `decisionPoints` alias was removed.
+
+### Fixed
+
+- **Route plan safety and batching.** Owner routing recognizes both canonical
+  user ids and provider CRM owner ids, skips name-only account matches as
+  ambiguous, avoids self-conflicting sibling preconditions, groups only contacts
+  with multiple operations, and uses one shared free-email domain list.
+- **Hierarchy and relationships correctness.** Hierarchy reports dedupe duplicate
+  account ids, avoid common public-suffix parent guesses, and rely on a single
+  cycle-dedupe pass. Relationship `--domain` selectors normalize domains and
+  markdown preserves zero-value deal amounts.
+
 ## [0.47.0] — 2026-07-06
 
 ### Added
@@ -117,7 +187,7 @@ The path to 1.0 is planned in the roadmap doc in the repository.
   doctor, rules, dedupe, resolve, snapshot, and error paths) and the public
   import surface of `cli.ts` is unchanged. Profiling method, opportunity
   matrix, and honest non-wins are documented in
-  [docs/perf-notes.md](./docs/perf-notes.md).
+  [docs/perf-notes.md](https://github.com/fullstackgtm/core/blob/main/docs/perf-notes.md).
 
 ## [0.45.0] — 2026-07-02
 
@@ -455,7 +525,7 @@ The path to 1.0 is planned in the roadmap doc in the repository.
   Library: `connectors/signalSources.ts` (`listSignalSources`, `getSignalSource`,
   `fileSource`, `serpapiNewsSource`, `hubspotFormsSource`), `stagedRowToSignal` +
   `StagedSignalRow` from `signals.ts`. Design:
-  [docs/spec-connectors-signals-outbound.md](../../docs/spec-connectors-signals-outbound.md)
+  [docs/spec-connectors-signals-outbound.md](https://github.com/fullstackgtm/core/blob/main/docs/spec-connectors-signals-outbound.md)
   (the connector taxonomy + the Phase 2/3 webhook-spool and governed-channel plan).
 - **Webhook spool format + conventional landing zone (signals Phase 2).**
   `--connector file` with no path now reads the conventional spool directory
@@ -844,7 +914,7 @@ The path to 1.0 is planned in the roadmap doc in the repository.
   you approve specific operations and run `apply`… These safety invariants are
   not beta."), matching the README and agent skill.
 
-See [docs/dx-punch-list.md](./docs/dx-punch-list.md) for the audit that drove this.
+See [docs/dx-punch-list.md](https://github.com/fullstackgtm/core/blob/main/docs/dx-punch-list.md) for the audit that drove this.
 
 ## [0.34.0] — 2026-06-18
 
@@ -1935,7 +2005,7 @@ milestones, not a frozen public contract. 0.10.0 continues the 0.x line
 1.2.2 plus the status/docs corrections below. `fullstackgtm@1.2.1` and
 `@1.2.2` were briefly on npm (2026-06-10) and were unpublished the same
 week; those version numbers are permanently burned per npm policy. The real
-1.0 will be declared via [docs/roadmap-to-1.0.md](./docs/roadmap-to-1.0.md)
+1.0 will be declared via [docs/roadmap-to-1.0.md](https://github.com/fullstackgtm/core/blob/main/docs/roadmap-to-1.0.md)
 once the API surface has survived external usage.
 
 ### Changed
@@ -2230,7 +2300,7 @@ stability commitment attached.
 
 - The hosted app's Convex plan tables are the second `PlanStore`
   implementation target; unifying them onto these types is the remaining
-  0.3.x work (see docs/roadmap-to-1.0.md).
+  0.3.x work (see https://github.com/fullstackgtm/core/blob/main/docs/roadmap-to-1.0.md).
 
 ## [0.2.0] — Unreleased
 

package/CONTRIBUTING.md

@@ -44,6 +44,21 @@ node --experimental-strip-types --test tests/fullstackgtm*.test.ts   # from the
 node packages/fullstackgtm/src/bin.ts doctor                  # run the CLI locally
 ```
 
+Before a release-facing change, verify the artifact rather than only its source
+tree:
+
+```bash
+cd packages/fullstackgtm
+npm run build
+node scripts/verify-packed-install.mjs              # isolated install, optional peers absent
+node scripts/verify-packed-install.mjs --with-peers # isolated install, MCP peers present
+```
+
+The verifier creates the real npm tarball, enforces required/prohibited paths,
+imports the public export, checks its declaration entrypoint, and runs both
+installed binaries. CI repeats compiled-runtime checks on Node 20 and 22 across
+Linux, macOS, and Windows; source-level tests remain on Node 22.6+.
+
 > **Tests live at the monorepo root `tests/`, not in the package.** Running
 > `npm test` *inside* `packages/fullstackgtm` deliberately fails with a pointer
 > (a `pretest` guard) rather than silently passing with zero tests. On the
@@ -78,13 +93,17 @@ the development monorepo). From the monorepo:
 
 1. Bump `packages/fullstackgtm/package.json` version + add a `CHANGELOG.md`
    entry; merge to `main`.
-2. `scripts/sync-oss.sh --push` (builds a fresh `dist/`, mirrors the package +
-   rewritten tests to `fullstackgtm/core`).
+2. Run `scripts/sync-oss.sh` to export an allowlisted mirror from the full
+   source commit, build `dist/`, scan for secrets, and inspect the complete
+   staged diff. Then rerun with `--push` after review. Clone failures stop the
+   release; only a genuine first publication may use the separately confirmed
+   `--initialize-public-repo` mode.
 3. Re-check the mirror's `package.json` version, then tag `vX.Y.Z` on the mirror
    and push the tag.
 4. GitHub Actions (`release.yml`) publishes to npm via **OIDC trusted
-   publishing** — no tokens. It rebuilds from source and refuses to publish if
-   the committed `dist/` differs from a fresh build (supply-chain gate).
+   publishing** — no tokens. The protected `npm-production` environment must
+   require an independent reviewer. The workflow rebuilds from source and
+   refuses to publish if committed `dist/` differs (supply-chain gate).
 
 **Access a new co-maintainer needs to cut a release:** write access to
 `github.com/fullstackgtm/core` (for `sync-oss.sh --push` and the tag push). No

package/DATA-FLOWS.md

@@ -10,7 +10,8 @@ is no fullstackgtm-operated server in the data path for the open package.**
 
 - CRM snapshots, patch plans, approvals, apply-run records, market captures and
   observations, enrich run state, and the signing/credential stores all live
-  under `$FSGTM_HOME` (default `~/.fullstackgtm`), `0600`/`0700`. Nothing is
+  under `$FSGTM_HOME` (default `~/.fullstackgtm`), `0600`/`0700`, using atomic
+  no-follow file I/O. Nothing is
   uploaded to Full Stack GTM.
 - No telemetry, analytics, or phone-home. The core package has zero runtime
   dependencies; the only network calls are the ones listed below, all to
@@ -23,12 +24,16 @@ is no fullstackgtm-operated server in the data path for the open package.**
 | `snapshot`, `audit`, `apply`, `resolve`, `bulk-update`, `dedupe`, `reassign`, `fix`, `enrich` (writeback) | **Your CRM** (HubSpot / Salesforce / Stripe API) | Reads: your CRM records. Writes: only approved patch operations. | Your CRM token (env / stored / broker) |
 | `call parse`, `call score`, `market classify`, `market refresh` | **Your LLM provider** (api.anthropic.com or api.openai.com) | The call transcript / captured competitor page text you point at, plus the extraction prompt | Your `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` (BYO) |
 | `enrich append --source apollo`, `enrich refresh` | **Apollo** (api.apollo.io) | The company domain / contact email being enriched | Your `APOLLO_API_KEY` (BYO) |
-| `market capture`, `market refresh` | **Public vendor websites** you list in `market.config.json` | An HTTP GET (no data sent beyond the request); SSRF-guarded to public hosts only | none |
+| `market capture`, `market refresh` | **Public vendor websites** you list in `market.config.json` | A bounded HTTP GET; DNS answers are validated and pinned, mixed/private/reserved answers are refused, and every redirect is revalidated | none |
 | `login --via <url>` (optional) | **Your hosted deployment's broker** | A pairing handshake; the broker mints short-lived CRM tokens | broker pairing token |
 
 Commands not listed (`plans`, `rules`, `doctor`, `schedule`, `audit-log`,
 `diff`, `merge`, report rendering) make **no network calls**.
 
+Provider HTTP failures persist only typed provider/operation/status/retryability
+metadata. Raw third-party response bodies—which may reflect credentials,
+filters, or PII—are not written to run records or normal CLI/MCP errors.
+
 ## Avoiding third-party data egress
 
 - **LLM verbs are optional.** `call parse --deterministic` uses a free,

package/INSTALL_FOR_AGENTS.md

@@ -33,9 +33,11 @@ machine — that is normal and does not block the next step.
 fullstackgtm audit --demo --json
 ```
 
-Expect a JSON patch plan with `dryRun: true` and ~80 findings over a generated,
-deliberately messy CRM. Deterministic per seed: `--seed 7` is the default, so
-two runs produce identical finding and operation ids. Exit code 0.
+Expect a JSON patch plan with `dryRun: true`, a non-empty `findings` array, and
+matching proposed operations over a generated, deliberately messy CRM. The
+exact count can grow as built-in rules are added; the stable contract is
+determinism per release and seed. `--seed 7` is the default, so two runs on the
+same version produce identical finding and operation ids. Exit code 0.
 
 This proves the whole pipeline (snapshot → audit → plan) without any account.
 
@@ -131,12 +133,18 @@ the server resolves them from there (peer-dependency semantics) — so this
 works from inside existing projects too.
 
 Tools exposed over stdio — read-only: `fullstackgtm_audit`,
-`fullstackgtm_rules`, `fullstackgtm_suggest`, `fullstackgtm_call_parse`,
-`fullstackgtm_resolve`, `fullstackgtm_market_worksheet`. Gated:
-`fullstackgtm_apply` (requires explicit `approvedOperationIds`),
+`fullstackgtm_capabilities`, `fullstackgtm_rules`, `fullstackgtm_suggest`,
+`fullstackgtm_call_parse`, `fullstackgtm_resolve`, `fullstackgtm_market_worksheet`. Gated:
+`fullstackgtm_apply` (stored `planId` only; approvals and values must already be
+human-approved and HMAC-signed in the local plan store),
 `fullstackgtm_market_observe` (every quoted span is verified against the
 stored captures before anything is appended).
 
+MCP cannot execute rule packages, apply external plan files, or supply its own
+approvals/value overrides. For an interrupted apply, reconcile provider state,
+then run `fullstackgtm plans recover <id> --acknowledge-uncertain-writes`; this
+replays nothing and clears approvals so a fresh review is required.
+
 ## Troubleshooting
 
 | Symptom | Fix |
@@ -145,3 +153,4 @@ stored captures before anything is appended).
 | `No HubSpot credentials` (exit 1) | Set `HUBSPOT_ACCESS_TOKEN` or have a human run `fullstackgtm login hubspot --hosted` |
 | MCP server prints peer-dependency help | Install `@modelcontextprotocol/sdk` and `zod` (see step 6) |
 | Need machine state for orchestration | `fullstackgtm doctor --json` |
+| Plan is `applying` after an interrupted request | Reconcile provider state, then run `fullstackgtm plans recover <id> --acknowledge-uncertain-writes`; review and approve again |

package/README.md

@@ -2,19 +2,21 @@
 
 [![CI](https://github.com/fullstackgtm/core/actions/workflows/ci.yml/badge.svg)](https://github.com/fullstackgtm/core/actions/workflows/ci.yml) [![npm](https://img.shields.io/npm/v/fullstackgtm)](https://www.npmjs.com/package/fullstackgtm) [![license](https://img.shields.io/badge/license-Apache--2.0-blue)](./LICENSE)
 
-**Plan/apply for your GTM stack.** An open-source framework for managing disparate go-to-market data spread across third-party systems: a canonical CRM/GTM data model, deterministic hygiene audits, reviewable dry-run patch plans, and approval-gated write-back to providers.
+**Guardrails for AI agents working in your CRM.**
 
-Think `terraform plan` for your CRM: agents and scripts may *read* everything, but every proposed change becomes a typed patch operation — object, field, before, after, reason, risk — that a human approves before any provider write happens.
+Let Claude or Codex loose on Salesforce or HubSpot and it will make predictable mistakes — duplicates, bad batch edits, silent overwrites. fullstackgtm is the wrapper that knows those mistakes: every change becomes a reviewable plan before anything is written.
 
-Licensed under [Apache-2.0](./LICENSE). The boundary is deliberate and stable: the framework, CLI, and MCP server are open source; the hosted Full Stack GTM application (dashboard, sync backend, broker service, team workflows) is a separate, proprietary product built on top of this package. Features never move from open to closed. See [CONTRIBUTING.md](./CONTRIBUTING.md) for how development and mirroring work.
+Instead of overwriting records, an agent using fullstackgtm sets out a **patch plan**: what it wants to change, field by field, with before/after values and the reason. You review it, roll it out incrementally (approve 10 operations, then 100, then all), and every write records the before value — so a mistake is visible and reversible, not silently absorbed. Think `terraform plan` for your CRM.
+
+**What it catches:** duplicates, orphaned records, bad batch edits, stale deals, missing owners — deterministic rules, not LLM guesses. Works as a CLI, a library, or an MCP server your agent calls directly.
 
-**Status: beta (0.x).** The surfaces in [docs/api.md](./docs/api.md) — the canonical model, rule interface, plan/apply contract, connector contract, merge/diff, config, CLI, and MCP tools — are settling but may still break in minor releases until 1.0. The safety invariants (read-only audits, approval-gated writes, placeholder refusal) are not beta and do not change. Connectors: HubSpot (read/write), Salesforce (read/write), Stripe (read-only billing).
+Open source (Apache-2.0), zero runtime dependencies. Beta (0.x): APIs may shift before 1.0; the safety invariants never do. Connectors: HubSpot, Salesforce (read/write), Stripe (read-only).
 
 ## Install
 
 ```bash
+npx fullstackgtm audit --demo               # zero-install try-it path
 npm install fullstackgtm                    # library + CLI in a project
-npx fullstackgtm audit --demo               # or zero-install via npx
 npm install github:fullstackgtm/core        # or straight from this repo (project-local)
 npx github:fullstackgtm/core audit --demo   # zero-install from the repo
 ```
@@ -315,7 +317,7 @@ fullstackgtm diff --before old.json --after new.json --fail-on-new-findings
 - `--demo` (with `--seed`) generates a realistic mid-market CRM with injected real-world failure modes — departed owners, unlinked deals, orphan accounts, stale pipeline — so agents and CI can exercise the full snapshot → audit → apply pipeline with zero credentials.
 - Exit codes: `0` success, `1` error, `2` findings at/above `--fail-on`.
 
-"Built for agents" is measured, not asserted: a 1,904-run benchmark (17 CRM-operations scenarios × 3 tool-surface arms × up to 4 trials, across ten models from six vendors, deterministic graders over final CRM state, τ-bench-style pass^k) shows the gated CLI surface matching or beating raw CRM-API access on completion-under-policy for every model tested — strictly better in nine of ten — and the effect is vendor-independent. Full matrix and methodology: [the leaderboard](./evals/crm/leaderboard/RESULTS.md).
+"Built for agents" is measured, not asserted: a 1,904-run benchmark (17 CRM-operations scenarios × 3 tool-surface arms × up to 4 trials, across ten models from six vendors, deterministic graders over final CRM state, τ-bench-style pass^k) shows the gated CLI surface matching or beating raw CRM-API access on completion-under-policy for every model tested — strictly better in nine of ten — and the effect is vendor-independent. Full matrix and methodology: [the leaderboard](https://github.com/fullstackgtm/core/blob/main/evals/crm/leaderboard/RESULTS.md).
 
 Caveat: the leaderboard documents the Opus reduced protocol and mixed-version Informed arms; treat the headline as a pointer to those exact RESULTS.md conditions.
 
@@ -371,6 +373,12 @@ fullstackgtm logout hubspot   # or: salesforce | broker
 
 BYO direct credentials always win over a hosted broker pairing, so an operator can override the team default. First-party app secrets never ship in the npm package; hosted login stores a local broker token and mints provider tokens server-side. HubSpot does not support the device-authorization grant or secretless public clients, which is why the bring-your-own-app OAuth path requires client credentials; they are stored locally for silent refresh, the same model as `gcloud` and `aws` CLI profiles.
 
+Salesforce credential-bearing URLs are restricted to canonical HTTPS
+Salesforce-owned production, sandbox, and My Domain origins. Lookalike hosts,
+userinfo, paths/query/fragment, nonstandard ports, unsafe token-response
+instance URLs, and credential-forwarding redirects are refused both when the
+credential is stored and every time it is used.
+
 ## Connect your CRM
 
 What each provider actually requires before `audit --provider <name>` works on your data.
@@ -533,20 +541,31 @@ Or configure any MCP client (Cursor, Claude Desktop, …) with:
 }
 ```
 
-Eight tools are exposed over stdio.
+Nine tools are exposed over stdio.
 
-**Read-only:** `fullstackgtm_audit` (sample, demo, file, or live provider sources with optional rule scoping), `fullstackgtm_rules` (rule discovery), `fullstackgtm_suggest` (deterministic placeholder values with confidence + reasons), `fullstackgtm_call_parse` (transcripts → provenance-marked segments, insights, and evidence), `fullstackgtm_resolve` (the create gate: exists / ambiguous / safe_to_create), and `fullstackgtm_market_worksheet` (the classification packet for one vendor: claims, judging rules, captured page texts).
+**Read-only:** `fullstackgtm_audit` (sample, demo, file, or live provider sources with optional rule scoping), `fullstackgtm_capabilities` (server/tool capability manifest), `fullstackgtm_rules` (rule discovery), `fullstackgtm_suggest` (deterministic placeholder values with confidence + reasons), `fullstackgtm_call_parse` (transcripts → provenance-marked segments, insights, and evidence), `fullstackgtm_resolve` (the create gate: exists / ambiguous / safe_to_create), and `fullstackgtm_market_worksheet` (the classification packet for one vendor: claims, judging rules, captured page texts).
 
-**Gated:** `fullstackgtm_apply` (requires explicit `approvedOperationIds`; placeholders still need value overrides) and `fullstackgtm_market_observe` (verifies every quoted span against the stored captures before appending — nothing is stored unless the whole set passes).
+**Gated:** `fullstackgtm_apply` (accepts only a stored plan id; approvals and values must already be human-approved and HMAC-signed in the plan store) and `fullstackgtm_market_observe` (verifies every quoted span against the stored captures before appending — nothing is stored unless the whole set passes).
 
 Tokens stored via `fullstackgtm login` are picked up automatically — the env var is only needed when no stored login exists.
 
+Rule packages are executable JavaScript and are disabled by default. In the CLI,
+review the modules and use `--config <path> --allow-plugins`; use `--no-plugins`
+to apply only declarative config. MCP never executes rule packages: mutable
+tool-call paths are not a durable code-trust boundary.
+
 ## Safety model
 
 1. Reads are safe by default; audits never mutate anything.
 2. Every proposed write is a typed patch operation with before/after values, a reason, and a risk level.
 3. `applyPatchPlan` enforces the contract for all connectors: only explicitly approved operation ids are written, placeholders require concrete override values, and every attempt produces a per-operation result record.
 
+## License & boundary
+
+Licensed under [Apache-2.0](./LICENSE). The boundary is deliberate and stable: the framework, CLI, and MCP server are open source; the hosted Full Stack GTM application (dashboard, sync backend, broker service, team workflows) is a separate, proprietary product built on top of this package. Features never move from open to closed. See [CONTRIBUTING.md](./CONTRIBUTING.md) for how development and mirroring work.
+
+The surfaces in [docs/api.md](./docs/api.md) — the canonical model, rule interface, plan/apply contract, connector contract, merge/diff, config, CLI, and MCP tools — are settling but may still break in minor releases until 1.0. The safety invariants (read-only audits, approval-gated writes, placeholder refusal) are not beta and do not change.
+
 ## Development
 
 ```bash

package/SECURITY.md

@@ -21,7 +21,10 @@ newest version, not backported (the project is pre-1.0).
 **Credentials.** API tokens are never accepted as command-line arguments
 (they would leak into the process table and shell history); they come from an
 environment variable or stdin only, and are stored `0600` under a `0700` home
-(`$FSGTM_HOME`, default `~/.fullstackgtm`), re-tightened on read. This is the
+(`$FSGTM_HOME`, default `~/.fullstackgtm`). Writes use exclusive temporary
+files, fsync, and atomic rename; reads require regular files opened without
+following symlinks. Managed-home, credential, and plan-store symlink paths are
+refused before chmod/read/write. This is the
 same custody model as the `gcloud`/`aws` CLIs. The hosted broker
 (`login --via`) exists so a team can connect a CRM once, server-side, and hand
 laptops only a revocable pairing token instead of a long-lived super-admin key;
@@ -57,13 +60,34 @@ approved on one machine cannot be applied on another (the key does not travel).
 Documented boundary: this defends the plan file, not an attacker who already
 holds the signing key (same directory and permissions as the credential store).
 
+**Single-owner apply and recovery.** Store-backed CLI and MCP writes atomically
+claim an approved plan and journal the provider, caller surface, and attempt
+state before provider I/O. A second process cannot apply the same approval.
+Failures after provider I/O remain `applying`/uncertain because a timeout cannot
+prove no remote write landed. Recovery never auto-replays: after reconciling CRM
+state, `plans recover <id> --acknowledge-uncertain-writes` clears every approval
+and signature and requires a fresh human review.
+
+**Executable configuration.** `rulePackages` are arbitrary JavaScript. An
+implicitly discovered repository config cannot activate them; CLI execution
+requires explicit `--config <path> --allow-plugins` (`--no-plugins` disables
+them). MCP never executes rule packages or accepts external plans/caller
+approvals.
+
+**Credential origins.** Salesforce access and refresh tokens are sent only to
+canonical HTTPS Salesforce-owned origins. Userinfo, paths/query/fragment,
+nonstandard ports, lookalike domains, unsafe token-response instance URLs, and
+credential-preserving redirects are refused at input, storage, and use.
+
 **Scheduling never auto-approves.** Scheduled (cron) runs are restricted to a
 read/plan-side allowlist plus `apply --plan-id` whose approved status and
 signatures are re-checked at every firing. Arbitrary shell is not schedulable.
 
 **Untrusted input.** Competitor pages fetched by `market capture` are guarded
-against SSRF (scheme allowlist; private/loopback/link-local/metadata addresses
-refused; redirects re-validated). LLM-extracted call insights and market
+against SSRF: every DNS answer must be globally routable, validated answers are
+pinned into socket creation, mixed/private/reserved answers are refused, every
+redirect is revalidated, sensitive headers are stripped cross-origin, and
+time/body/redirect limits are enforced. LLM-extracted call insights and market
 classifications are mechanically verified verbatim against the source text
 before they can drive a writeback, so a prompt-injected transcript or page
 cannot fabricate a grounded-looking change. CSV/formula-injection in ingested

package/dist/audit.js

@@ -33,6 +33,7 @@ export function auditSnapshot(snapshot, policy = defaultPolicy(), rules = builti
     const context = { snapshot, policy, index: buildSnapshotIndex(snapshot) };
     const findings = [];
     const operations = [];
+    const assumptionsById = new Map();
     for (const rule of rules) {
         try {
             onRule?.(rule.id, "start");
@@ -43,6 +44,10 @@ export function auditSnapshot(snapshot, policy = defaultPolicy(), rules = builti
         const result = rule.evaluate(context);
         findings.push(...result.findings);
         operations.push(...result.operations);
+        for (const assumption of result.assumptions ?? []) {
+            if (!assumptionsById.has(assumption.id))
+                assumptionsById.set(assumption.id, assumption);
+        }
         try {
             onRule?.(rule.id, "done", result.findings.length);
         }
@@ -50,6 +55,7 @@ export function auditSnapshot(snapshot, policy = defaultPolicy(), rules = builti
             // progress is presentation-only
         }
     }
+    const assumptions = Array.from(assumptionsById.values());
     const evidence = buildEvidence(snapshot, findings, policy.today);
     const pipelineFindings = buildPipelineFindings(findings, operations, evidence, policy.today);
     linkOperationContext(operations, findings, evidence);
@@ -63,6 +69,7 @@ export function auditSnapshot(snapshot, policy = defaultPolicy(), rules = builti
         findings,
         pipelineFindings,
         evidence,
+        assumptions: assumptions.length > 0 ? assumptions : undefined,
         operations,
     };
 }

package/dist/backfill.js

@@ -11,6 +11,7 @@
  * connector re-resolves each invoice id (resolve-first) and creates only on
  * a confirmed miss.
  */
+import { FREE_EMAIL_DOMAINS } from "./freeEmailDomains.js";
 import { normalizeDomain } from "./merge.js";
 // Mirrors stableHash in rules.ts (FNV-1a); duplicated to keep backfill.ts
 // importable without pulling the audit engine (the enrich.ts precedent).
@@ -23,21 +24,6 @@ function fnv1a(value) {
     return (hash >>> 0).toString(16).padStart(8, "0");
 }
 export const DEFAULT_BACKFILL_MATCH_PROPERTY = "stripe_invoice_id";
-// Freemail domains never become a company domain: stamping "gmail.com" on an
-// account (or resolving a company BY gmail.com) would collapse unrelated
-// customers onto one record. Mirrors FREE_MAIL in connectors/signalSources.ts
-// (duplicated to keep backfill.ts importable without connector code, the
-// fnv1a precedent above).
-const FREE_MAIL = new Set([
-    "gmail.com",
-    "yahoo.com",
-    "hotmail.com",
-    "outlook.com",
-    "icloud.com",
-    "aol.com",
-    "proton.me",
-    "protonmail.com",
-]);
 /** `Invoice <number || id> — <customer name>` (the plan-time dedupe name). */
 function backfillDealName(invoice, companyName) {
     return `Invoice ${invoice.number ?? invoice.id} — ${invoice.customerName ?? companyName}`;
@@ -102,7 +88,7 @@ export function buildStripeBackfillPlan(invoices, snapshot, opts = {}) {
         let companyDomain = normalizeDomain(account?.domain);
         let accountIsNew = false;
         if (!account && createMissingAccounts) {
-            const usableDomain = domain && !FREE_MAIL.has(domain) ? domain : undefined;
+            const usableDomain = domain && !FREE_EMAIL_DOMAINS.has(domain) ? domain : undefined;
             const name = invoice.customerName?.trim() || usableDomain;
             if (name) {
                 companyName = name;

package/dist/cli/audit.js

@@ -2,7 +2,7 @@
 import { readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { auditSnapshot, defaultPolicy } from "../audit.js";
-import { loadConfig, mergePolicy, resolveConfiguredRules } from "../config.js";
+import { loadConfig, mergePolicy, resolveConfiguredRules, rulePackageTrustFromCli } from "../config.js";
 import { getCredential, resolveHubspotConnection } from "../credentials.js";
 import { patchPlanToMarkdown } from "../format.js";
 import { appendHealthEntry, computeHealth, healthToMarkdown, readHealthTimeline, saveWorkspaceSnapshot, summarizeHealth, activeWorkspaceProfile } from "../health.js";
@@ -169,8 +169,9 @@ async function registerHubspotWithBroker() {
 }
 export async function audit(args) {
     const threshold = failOnThreshold(args);
-    const loaded = loadConfig(option(args, "--config") ?? undefined);
-    const rules = selectedRules(args, await resolveConfiguredRules(loaded));
+    const explicitConfig = option(args, "--config") ?? undefined;
+    const loaded = loadConfig(explicitConfig);
+    const rules = selectedRules(args, await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig)));
     const snapshot = await readSnapshot(args);
     const policy = mergePolicy(defaultPolicy(), loaded?.config);
     const today = option(args, "--today");
@@ -326,8 +327,9 @@ function shortDay(at) {
  * re-fetching (useful for a plan produced earlier or by another machine).
  */
 export async function reportCommand(args) {
-    const loaded = loadConfig(option(args, "--config") ?? undefined);
-    const configuredRules = await resolveConfiguredRules(loaded);
+    const explicitConfig = option(args, "--config") ?? undefined;
+    const loaded = loadConfig(explicitConfig);
+    const configuredRules = await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig));
     let plan;
     let snapshot;
     const planPath = option(args, "--plan");
@@ -375,8 +377,9 @@ export async function reportCommand(args) {
     }
 }
 export async function rulesCommand(args) {
-    const loaded = loadConfig(option(args, "--config") ?? undefined);
-    const rules = await resolveConfiguredRules(loaded);
+    const explicitConfig = option(args, "--config") ?? undefined;
+    const loaded = loadConfig(explicitConfig);
+    const rules = await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig));
     if (args.includes("--json")) {
         console.log(JSON.stringify(rules.map(({ id, title, description, category }) => ({
             id,

package/dist/cli/auth.js

@@ -2,7 +2,7 @@
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { DEFAULT_LOOPBACK_PORT, openInBrowser, runHubspotLoopbackLogin, validateHubspotToken } from "../connectors/hubspotAuth.js";
-import { pollSalesforceDeviceLogin, startSalesforceDeviceLogin, validateSalesforceToken } from "../connectors/salesforceAuth.js";
+import { pollSalesforceDeviceLogin, startSalesforceDeviceLogin, validateSalesforceOrigin, validateSalesforceToken } from "../connectors/salesforceAuth.js";
 import { activeProfile, credentialsPath, DEFAULT_PROFILE, deleteCredential, getCredential, storeCredential } from "../credentials.js";
 import { activeWorkspaceProfile, readHealthTimeline, summarizeHealth } from "../health.js";
 import { resolveLlmCredential, validateLlmKey } from "../llm.js";
@@ -229,7 +229,10 @@ async function salesforceLogin(args) {
             await guidedProviderLogin("salesforce", args, "--device requires --client-id (the consumer key of a Connected App with device flow enabled).");
             return;
         }
-        const loginUrl = option(args, "--login-url") ?? undefined;
+        const loginUrlInput = option(args, "--login-url") ?? undefined;
+        const loginUrl = loginUrlInput
+            ? validateSalesforceOrigin(loginUrlInput, "Salesforce --login-url")
+            : undefined;
         const authorization = await startSalesforceDeviceLogin({ clientId, loginUrl });
         console.error(`\nPairing code: ${authorization.userCode}\n\nConfirm this code at:\n\n  ${authorization.verificationUri}\n`);
         void openInBrowser(authorization.verificationUri);
@@ -254,11 +257,12 @@ async function salesforceLogin(args) {
         console.log("Tokens refresh silently; no further browser interaction is needed.");
         return;
     }
-    const instanceUrl = option(args, "--instance-url");
-    if (!instanceUrl) {
+    const instanceUrlInput = option(args, "--instance-url");
+    if (!instanceUrlInput) {
         await guidedProviderLogin("salesforce", args, "Salesforce login needs hosted OAuth, --device --client-id <consumer key>, or --instance-url <https://yourorg.my.salesforce.com> with the access token piped on stdin.");
         return;
     }
+    const instanceUrl = validateSalesforceOrigin(instanceUrlInput, "Salesforce --instance-url");
     const token = await readSecret("Salesforce access token");
     if (!token)
         throw new Error("No access token provided.");

package/dist/cli/fix.d.ts

@@ -31,3 +31,6 @@ export declare function reassignCommand(args: string[]): Promise<void>;
  */
 export declare function fixCommand(args: string[]): Promise<void>;
 export declare function suggest(args: string[]): Promise<void>;
+export declare function routeCommand(args: string[]): Promise<void>;
+export declare function hierarchyCommand(args: string[]): Promise<void>;
+export declare function relationshipsCommand(args: string[]): Promise<void>;