fullstackgtm 0.47.0 → 0.49.0

package/dist/secureFile.js

@@ -0,0 +1,164 @@
+import { randomBytes } from "node:crypto";
+import { chmodSync, closeSync, constants, fsyncSync, fchmodSync, fstatSync, lstatSync, openSync, renameSync, unlinkSync, writeFileSync, readFileSync, } from "node:fs";
+import { dirname, isAbsolute, parse, resolve } from "node:path";
+export class UnsafeManagedPathError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UnsafeManagedPathError";
+    }
+}
+export function assertNoSymlinkComponents(path) {
+    const absolute = isAbsolute(path) ? path : resolve(path);
+    const root = parse(absolute).root;
+    const relative = absolute.slice(root.length);
+    let current = root;
+    for (const component of relative.split(/[\\/]+/).filter(Boolean)) {
+        current = resolve(current, component);
+        let stat;
+        try {
+            stat = lstatSync(current);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return;
+            throw error;
+        }
+        if (stat.isSymbolicLink()) {
+            throw new UnsafeManagedPathError(`Refusing to use unsafe path containing a symbolic link: ${current}`);
+        }
+    }
+}
+/** Read a managed file through a no-follow descriptor and require a regular file. */
+export function readSecureRegularFile(path, options = {}) {
+    const absolute = resolve(path);
+    assertNoSymlinkComponents(dirname(absolute));
+    try {
+        if (lstatSync(absolute).isSymbolicLink()) {
+            throw new UnsafeManagedPathError(`Refusing to read symbolic link: ${absolute}`);
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const noFollow = "O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0;
+    let fd;
+    try {
+        fd = openSync(absolute, constants.O_RDONLY | noFollow);
+        const stat = fstatSync(fd);
+        if (!stat.isFile()) {
+            throw new UnsafeManagedPathError(`Refusing to read non-regular file: ${absolute}`);
+        }
+        if (options.tightenMode !== undefined) {
+            const previousMode = stat.mode & 0o777;
+            if ((previousMode & ~options.tightenMode) !== 0) {
+                try {
+                    fchmodSync(fd, options.tightenMode);
+                    options.onModeTightened?.(previousMode);
+                }
+                catch {
+                    // Windows and some non-POSIX filesystems do not implement chmod.
+                }
+            }
+        }
+        return readFileSync(fd, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ELOOP") {
+            throw new UnsafeManagedPathError(`Refusing to read symbolic link: ${absolute}`);
+        }
+        throw error;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+/**
+ * Atomically replace a private file without ever opening the destination.
+ * Existing destination and parent symlinks are rejected. The temporary file
+ * is created exclusively beside the destination so rename remains atomic.
+ */
+export function writeSecureFileAtomic(path, contents) {
+    const destination = resolve(path);
+    const parent = dirname(destination);
+    assertNoSymlinkComponents(parent);
+    try {
+        if (lstatSync(destination).isSymbolicLink()) {
+            throw new Error(`Refusing to replace symbolic link: ${destination}`);
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    let temporary = "";
+    let fd;
+    try {
+        for (let attempt = 0; attempt < 10; attempt++) {
+            temporary = `${destination}.tmp-${process.pid}-${randomBytes(8).toString("hex")}`;
+            try {
+                const noFollow = "O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0;
+                fd = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | noFollow, 0o600);
+                break;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+            }
+        }
+        if (fd === undefined)
+            throw new Error(`Unable to create an exclusive temporary file for ${destination}`);
+        writeFileSync(fd, contents);
+        fsyncSync(fd);
+        closeSync(fd);
+        fd = undefined;
+        try {
+            chmodSync(temporary, 0o600);
+        }
+        catch {
+            // Windows and some non-POSIX filesystems do not implement chmod.
+        }
+        // Recheck immediately before replacement. rename replaces a symlink rather
+        // than following it, but rejecting one makes managed-path policy explicit.
+        try {
+            if (lstatSync(destination).isSymbolicLink()) {
+                throw new Error(`Refusing to replace symbolic link: ${destination}`);
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        assertNoSymlinkComponents(parent);
+        renameSync(temporary, destination);
+        temporary = "";
+        // Persist the directory entry where supported. Opening/fsyncing a
+        // directory is not available on Windows, so this durability enhancement is
+        // deliberately best-effort there.
+        let directoryFd;
+        try {
+            directoryFd = openSync(parent, constants.O_RDONLY);
+            fsyncSync(directoryFd);
+        }
+        catch {
+            // Unsupported by the platform/filesystem.
+        }
+        finally {
+            if (directoryFd !== undefined)
+                closeSync(directoryFd);
+        }
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+        if (temporary) {
+            try {
+                unlinkSync(temporary);
+            }
+            catch {
+                // Best-effort cleanup after a failed write.
+            }
+        }
+    }
+}

package/dist/types.d.ts

@@ -7,7 +7,7 @@
  */
 export type CrmProvider = "salesforce" | "hubspot" | "mock" | "unknown" | (string & {});
 export type RiskLevel = "low" | "medium" | "high";
-export type ApprovalStatus = "draft" | "needs_approval" | "approved" | "rejected" | "applied";
+export type ApprovalStatus = "draft" | "needs_approval" | "approved" | "applying" | "rejected" | "applied";
 export type GtmObjectType = "account" | "contact" | "deal" | "user" | "activity";
 export type GtmEvidenceSourceSystem = "salesforce" | "hubspot" | "gong" | "chorus" | "fathom" | "manual" | "csv" | "mock" | "web" | "unknown";
 export type PatchOperationType = "set_field" | "clear_field" | "link_record" | "archive_record" | "create_task" | "create_record" | "merge_records";
@@ -58,6 +58,13 @@ export type CreateRecordPayload = {
     dealPipeline?: string;
 };
 export type AuditFindingSeverity = "info" | "warning" | "critical";
+export type PatchPlanAssumptionConfidence = "derived" | "heuristic" | "guess";
+export type PatchPlanAssumption = {
+    id: string;
+    text: string;
+    source?: string;
+    confidence?: PatchPlanAssumptionConfidence;
+};
 /**
  * One claim that a canonical record exists in an external system. A record
  * merged from several providers carries one identity per provider.
@@ -323,6 +330,10 @@ export type PatchPlan = {
      *  Account/contact hygiene findings are NOT here; read `findings` for those. */
     pipelineFindings?: PipelineFinding[];
     evidence?: GtmEvidence[];
+    /** Assumptions used to turn audit observations into findings and operations. */
+    assumptions?: PatchPlanAssumption[];
+    /** Human decisions or unresolved questions that affect how the plan should be applied. */
+    openQuestions?: string[];
     operations: PatchOperation[];
     /**
      * The filter this plan's operations were selected by. Re-evaluated per
@@ -374,6 +385,8 @@ export type GtmRuleContext = {
 export type GtmRuleResult = {
     findings: AuditFinding[];
     operations: PatchOperation[];
+    /** Rule-level assumptions that explain the policy or heuristic behind returned findings. */
+    assumptions?: PatchPlanAssumption[];
 };
 /**
  * A deterministic audit rule. Rules read the snapshot through the context and
@@ -385,6 +398,8 @@ export type GtmAuditRule = {
     description: string;
     /** Grouping for docs and discovery, e.g. "hygiene", "forecast", "coverage". */
     category?: string;
+    /** False for findings-only rules whose evaluator intentionally emits no patch operations. */
+    emitsOperations?: boolean;
     evaluate: (context: GtmRuleContext) => GtmRuleResult;
 };
 export type PatchOperationResult = {

package/docs/api.md

@@ -62,6 +62,12 @@ release.
 
 - `fullstackgtm.config.json`: `{ policy?, rules?: { enabled?, disabled? }, rulePackages? }`.
 - Rule packages export `rules: GtmAuditRule[]`.
+- Rule packages are executable code and are fail-closed. CLI execution requires
+  an explicit `--config <path> --allow-plugins`; `--no-plugins` applies only
+  declarative policy/rule filters. An implicitly discovered config never grants
+  plugin trust.
+- MCP never executes rule packages. Mutable tool-call paths are not accepted as
+  a durable code-trust boundary; use the reviewed CLI plugin flow instead.
 - Precedence: CLI flags > config file > defaults.
 
 ## CLI
@@ -69,7 +75,8 @@ release.
 Commands: `init`, `login` / `logout`, `snapshot`, `audit`, `report`, `diff`, `merge`, `plans`,
 `apply`, `suggest`, `audit-log` (`export` / `verify`),
 `call` (`parse` / `classify` / `score` / `link` / `plan`), `resolve`,
-`bulk-update`, `dedupe`, `reassign`, `fix`, `health`,
+`hierarchy` (`report`), `relationships` (`account`),
+`route` (`leads`), `bulk-update`, `dedupe`, `reassign`, `fix`, `health`,
 `market` (`init` / `capture` / `classify` / `worksheet` / `observe` / `fronts` /
 `axes` / `overlay` / `scale` / `report` / `refresh`),
 `tam` (`estimate` / `accounts` / `status` / `report` / `populate`),
@@ -160,8 +167,8 @@ per-rule detail with capped examples, and next steps. `auditReportToMarkdown` /
 
 ## Governed write verbs
 
-Plan builders behind `bulk-update`, `dedupe`, and `reassign` — every one
-emits a standard dry-run `PatchPlan` for the normal approve → apply chain:
+Plan builders behind `route`, `bulk-update`, `dedupe`, and `reassign` — every
+one emits a standard dry-run `PatchPlan` for the normal approve → apply chain:
 
 - `buildBulkUpdatePlan(snapshot, options: BulkUpdateOptions)` with
   `parseWhere` (filter expressions: `=`, `!=`, `~`, `!~`, `:empty`,
@@ -179,6 +186,22 @@ emits a standard dry-run `PatchPlan` for the normal approve → apply chain:
   `assignUnowned` (CLI `--assign-unowned`) it targets ownerless records
   (`ownerId:empty`) and claims them for `--to` — the backfill twin of
   `enrich acquire`'s create-time assignment, for clearing existing ownerless debt.
+- `buildLeadRoutePlan(snapshot, options: LeadRouteOptions)` — matches contacts
+  to accounts by email domain and optional company-name fallback, skips free
+  email domains and ambiguous matches, then emits approval-gated account-link
+  and owner-assignment operations. Owner routing can inherit active account
+  owners for ownerless contacts or use the shared deterministic
+  `AssignmentPolicy`; existing owners are preserved unless
+  `reassignExistingOwner` (CLI `--reassign-owned`) is set.
+
+Read-only prevention reports:
+
+- `buildAccountHierarchy(snapshot)` / `accountHierarchyToMarkdown(report)` —
+  provider parent hints plus subdomain inference, with duplicate-domain,
+  ambiguous-parent, and parent-cycle conflicts surfaced rather than written.
+- `buildRelationshipMap(snapshot, { accountId | domain })` /
+  `relationshipMapToMarkdown(map)` — account stakeholders, inferred roles,
+  activity sentiment evidence, open deals, and missing-role gaps.
 
 `fix` is CLI-only composition of existing surfaces (audit → suggest →
 approve → apply for one rule).
@@ -266,6 +289,23 @@ domain stamped — so the acquired account is immediately signal-watchable
 `CanonicalContact.linkedin` (mapped from HubSpot `hs_linkedin_url`) is the
 strong dedup key across all of the above.
 
+## Apply recovery
+
+Store-backed applies persist an apply-attempt claim before provider I/O. If the
+process exits without a completed run, the plan remains `applying`: the CLI
+cannot know whether a remote write landed and will not replay it. Inspect the
+attempt with `fullstackgtm plans show <id>` and reconcile the named provider's
+records. Only then run:
+
+```bash
+fullstackgtm plans recover <id> --acknowledge-uncertain-writes
+```
+
+Recovery performs no provider calls. It clears the old approvals and returns
+the plan to `needs_approval`, requiring a fresh review and signed approval
+before another apply. Provider APIs do not all expose idempotency keys, so this
+operator reconciliation remains necessary after a timeout or crash.
+
 ## Schedule
 
 The horizontal scheduler: a declarative schedule-entry store, a
@@ -330,8 +370,12 @@ the stored capture it cites before a set is accepted; failed captures read as
 Tools: `fullstackgtm_capabilities` (the machine-readable server contract —
 tool inventory with per-tool CRM-write flags, derived from the server's own
 registration table), `fullstackgtm_audit`, `fullstackgtm_rules`,
-`fullstackgtm_apply` (requires explicit `approvedOperationIds`),
+`fullstackgtm_apply` (accepts only a stored `planId`; approved operation ids and
+placeholder values come exclusively from the HMAC-signed plan store),
 `fullstackgtm_suggest`, `fullstackgtm_call_parse`, `fullstackgtm_resolve`,
 `fullstackgtm_market_worksheet`, `fullstackgtm_market_observe` (validates,
 verifies quoted spans against the stored captures, appends, returns front
-states). Input schemas are stable.
+states). Input schemas are stable. MCP never executes rule packages and cannot
+accept external plan files or caller-supplied approvals/value overrides. An
+uncertain apply is reconciled with the CLI `plans recover` workflow and is
+never replayed automatically.

package/docs/architecture.md

@@ -27,14 +27,22 @@ provider  ──fetchSnapshot()──►  CanonicalGtmSnapshot
                          plans approve  (planStore.ts + integrity.ts: HMAC-signed)
                                       │
                                       ▼
+                    atomic apply claim + durable attempt journal
+                                      │
+                                      ▼
                     applyPatchPlan (connector.ts): for each APPROVED op —
                     compare-and-set vs live value, precondition + guard recheck,
                     irreversible-op drift guard → connector.applyOperation()
                                       │
                                       ▼
-                               PatchPlanRun  (the audit record; auditLog.ts exports it)
+                               PatchPlanRun  (claim-bound audit record)
 ```
 
+An interrupted provider attempt stays `applying`/uncertain. Recovery never
+replays automatically: reconcile provider state, then `plans recover ...
+--acknowledge-uncertain-writes` clears approvals and returns the plan to
+`needs_approval` for a fresh signed review.
+
 ## Module map (`src/`)
 
 **Contracts & model**
@@ -49,17 +57,23 @@ provider  ──fetchSnapshot()──►  CanonicalGtmSnapshot
 - `audit.ts` — runs rules over a snapshot into a `PatchPlan`.
 - `suggest.ts` — derives concrete values for `requires_human_*` placeholders from
   snapshot evidence, with confidence + reasons.
-- `planStore.ts` — durable plan lifecycle (save / approve / record runs), 0600.
+- `planStore.ts` — durable plan lifecycle (save / approve / atomic claim /
+  attempt journal / no-replay recovery / claim-bound runs), atomic 0600 files.
 - `integrity.ts` — HMAC-signs approvals (per-install key) and verifies at apply.
 - `connector.ts` — `applyPatchPlan`: the safety contract (approval filter,
   placeholder refusal, CAS, precondition/guard recheck, irreversible-op drift
   guard). Provider-agnostic.
 - `auditLog.ts` — hash-chained, signed export of every apply run.
+- `secureFile.ts` — atomic no-follow sensitive-file reads/writes.
+- `publicHttp.ts` — DNS-pinned, redirect-validating, bounded public-only HTTP.
 
 **Governed write verbs (each builds a plan; never writes directly)**
-- `bulkUpdate.ts`, `dedupe.ts`, `reassign.ts` — filtered/duplicate/ownership
-  plan builders. `merge.ts` — snapshot diff/merge + entity resolution.
+- `bulkUpdate.ts`, `dedupe.ts`, `reassign.ts`, `route.ts` — filtered,
+  duplicate, ownership handoff, and lead-to-account/owner routing plan builders.
+  `merge.ts` — snapshot diff/merge + entity resolution.
 - `resolve.ts` — the create-gate (exists / ambiguous / safe_to_create).
+- `hierarchy.ts`, `relationships.ts` — read-only account hierarchy and
+  stakeholder relationship-map reports for planning/prevention workflows.
 
 **Connectors** (`connectors/`)
 - `hubspot.ts`, `salesforce.ts`, `stripe.ts` + their `*Auth.ts` OAuth/device

package/llms.txt

@@ -10,6 +10,13 @@ CLI quick check: `fullstackgtm doctor --json`. Zero-credential demo:
 explicitly approved operation ids. Exit codes: 0 success, 1 error, 2 findings
 at/above `--fail-on`.
 
+MCP apply accepts only a stored `planId`; approvals and concrete values come
+from the HMAC-signed plan store, never the tool caller. MCP never executes rule
+packages or external plans. Store-backed apply is single-owner and journaled;
+an interrupted provider attempt remains uncertain and is never auto-replayed.
+After reconciling provider state, `plans recover <id>
+--acknowledge-uncertain-writes` clears approvals for a fresh human review.
+
 ## Docs
 
 - [README](https://github.com/fullstackgtm/core/blob/main/README.md): install, five-minute loop, auth ladder, MCP setup, programmatic use

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullstackgtm",
-  "version": "0.47.0",
+  "version": "0.49.0",
   "description": "Open-source agentic GTM ops framework: canonical GTM data model, pluggable deterministic audits, reviewable dry-run patch plans, approval-gated write-back with conflict detection, and cross-system entity resolution. HubSpot, Salesforce, and Stripe connectors included.",
   "license": "Apache-2.0",
   "author": "Full Stack GTM LLC <ryan@fullstackgtm.com> (https://fullstackgtm.com)",
@@ -45,10 +45,12 @@
     "DATA-FLOWS.md"
   ],
   "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "clean": "node scripts/clean.mjs",
+    "build": "npm run clean && tsc -p tsconfig.build.json",
     "pretest": "test -d tests || { echo 'No tests/ in this directory. In the published mirror, tests live here and `npm test` works. In the monorepo, run package tests from the repo ROOT: `node --experimental-strip-types --test tests/fullstackgtm*.test.ts` (the tests live at the monorepo root tests/).' >&2; exit 1; }",
     "test": "node --experimental-strip-types --test tests/*.test.ts",
-    "prepublishOnly": "npm run build && npm pack --dry-run && node dist/bin.js --help && node dist/mcp-bin.js --help"
+    "verify:package": "npm run build && node scripts/verify-packed-install.mjs --with-peers",
+    "prepublishOnly": "npm run verify:package"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",

package/skills/fullstackgtm/SKILL.md

@@ -85,16 +85,22 @@ npx -y fullstackgtm-mcp
 
 Tools over stdio: `fullstackgtm_audit` (read-only), `fullstackgtm_rules`,
 `fullstackgtm_suggest`, `fullstackgtm_call_parse`,
-`fullstackgtm_apply` (requires `approvedOperationIds`),
+`fullstackgtm_apply` (stored `planId` only; approvals and values come from the
+HMAC-signed plan store and cannot be supplied by the MCP caller),
 `fullstackgtm_resolve`, `fullstackgtm_market_worksheet`,
 `fullstackgtm_market_observe`.
 
+MCP never executes rule packages or external plans. An uncertain apply is
+never replayed automatically: reconcile provider state, then use
+`fullstackgtm plans recover <id> --acknowledge-uncertain-writes`, which clears
+approvals and requires a fresh review.
+
 ## Composing the primitives into plays
 
 This CLI ships governed **primitives** — there is no `outbound` mega-command.
 **You (the agent) are the orchestrator:** chain these verbs into the play the
 operator wants, surface the one approve gate, and bridge the last mile to the
-sender (**the package never sends**). [docs/recipes.md](https://github.com/fullstackgtm/core/blob/main/packages/fullstackgtm/docs/recipes.md)
+sender (**the package never sends**). [docs/recipes.md](https://github.com/fullstackgtm/core/blob/main/docs/recipes.md)
 has five worked plays — cold-start lead-fill, the trigger→judge→draft outbound
 loop, scheduled-continuous, ABM-from-companies, and hygiene-gated outbound.
 `fullstackgtm init` scaffolds a workspace (icp.json + enrich config + a PLAYBOOK
@@ -102,7 +108,7 @@ pointing at those recipes) to start from.
 
 ## Going deeper
 
-- [docs/recipes.md](https://github.com/fullstackgtm/core/blob/main/packages/fullstackgtm/docs/recipes.md) — five composable GTM plays over the primitives (cold-start, outbound loop, scheduled, ABM, hygiene-gated)
+- [docs/recipes.md](https://github.com/fullstackgtm/core/blob/main/docs/recipes.md) — five composable GTM plays over the primitives (cold-start, outbound loop, scheduled, ABM, hygiene-gated)
 - [llms.txt](https://github.com/fullstackgtm/core/blob/main/llms.txt) — the full invariant map per layer (calls, market, write verbs, enrich, schedule, engagement/health)
 - [INSTALL_FOR_AGENTS.md](https://github.com/fullstackgtm/core/blob/main/INSTALL_FOR_AGENTS.md) — deterministic install-and-verify with expected outputs
 - [docs/api.md](https://github.com/fullstackgtm/core/blob/main/docs/api.md) — semver-covered surfaces: canonical model, rule interface, plan/apply contract, connectors, config, CLI, MCP

package/src/audit.ts

@@ -9,6 +9,7 @@ import type {
   PipelineFindingType,
   PatchOperation,
   PatchPlan,
+  PatchPlanAssumption,
   SourceFreshness,
 } from "./types.ts";
 
@@ -53,6 +54,7 @@ export function auditSnapshot(
   const context = { snapshot, policy, index: buildSnapshotIndex(snapshot) };
   const findings: AuditFinding[] = [];
   const operations: PatchOperation[] = [];
+  const assumptionsById = new Map<string, PatchPlanAssumption>();
 
   for (const rule of rules) {
     try {
@@ -63,6 +65,9 @@ export function auditSnapshot(
     const result = rule.evaluate(context);
     findings.push(...result.findings);
     operations.push(...result.operations);
+    for (const assumption of result.assumptions ?? []) {
+      if (!assumptionsById.has(assumption.id)) assumptionsById.set(assumption.id, assumption);
+    }
     try {
       onRule?.(rule.id, "done", result.findings.length);
     } catch {
@@ -70,6 +75,7 @@ export function auditSnapshot(
     }
   }
 
+  const assumptions = Array.from(assumptionsById.values());
 
   const evidence = buildEvidence(snapshot, findings, policy.today);
   const pipelineFindings = buildPipelineFindings(findings, operations, evidence, policy.today);
@@ -85,6 +91,7 @@ export function auditSnapshot(
     findings,
     pipelineFindings,
     evidence,
+    assumptions: assumptions.length > 0 ? assumptions : undefined,
     operations,
   };
 }

package/src/backfill.ts

@@ -21,6 +21,7 @@ import type {
   PatchPlan,
 } from "./types.ts";
 import type { StripePaidInvoice } from "./connectors/stripe.ts";
+import { FREE_EMAIL_DOMAINS } from "./freeEmailDomains.ts";
 import { normalizeDomain } from "./merge.ts";
 
 // Mirrors stableHash in rules.ts (FNV-1a); duplicated to keep backfill.ts
@@ -36,22 +37,6 @@ function fnv1a(value: string): string {
 
 export const DEFAULT_BACKFILL_MATCH_PROPERTY = "stripe_invoice_id";
 
-// Freemail domains never become a company domain: stamping "gmail.com" on an
-// account (or resolving a company BY gmail.com) would collapse unrelated
-// customers onto one record. Mirrors FREE_MAIL in connectors/signalSources.ts
-// (duplicated to keep backfill.ts importable without connector code, the
-// fnv1a precedent above).
-const FREE_MAIL = new Set([
-  "gmail.com",
-  "yahoo.com",
-  "hotmail.com",
-  "outlook.com",
-  "icloud.com",
-  "aol.com",
-  "proton.me",
-  "protonmail.com",
-]);
-
 export type StripeBackfillOptions = {
   /** Pipeline id or case-insensitive label; absent = the portal's default pipeline. */
   pipeline?: string;
@@ -183,7 +168,7 @@ export function buildStripeBackfillPlan(
     let companyDomain = normalizeDomain(account?.domain);
     let accountIsNew = false;
     if (!account && createMissingAccounts) {
-      const usableDomain = domain && !FREE_MAIL.has(domain) ? domain : undefined;
+      const usableDomain = domain && !FREE_EMAIL_DOMAINS.has(domain) ? domain : undefined;
       const name = invoice.customerName?.trim() || usableDomain;
       if (name) {
         companyName = name;

package/src/cli/audit.ts

@@ -3,7 +3,7 @@
 import { readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { auditSnapshot, defaultPolicy } from "../audit.ts";
-import { loadConfig, mergePolicy, resolveConfiguredRules } from "../config.ts";
+import { loadConfig, mergePolicy, resolveConfiguredRules, rulePackageTrustFromCli } from "../config.ts";
 import { getCredential, resolveHubspotConnection } from "../credentials.ts";
 import { patchPlanToMarkdown } from "../format.ts";
 import { appendHealthEntry, computeHealth, healthToMarkdown, readHealthTimeline, saveWorkspaceSnapshot, summarizeHealth, activeWorkspaceProfile, type HealthRollup } from "../health.ts";
@@ -174,8 +174,9 @@ async function registerHubspotWithBroker(): Promise<void> {
 
 export async function audit(args: string[]) {
   const threshold = failOnThreshold(args);
-  const loaded = loadConfig(option(args, "--config") ?? undefined);
-  const rules = selectedRules(args, await resolveConfiguredRules(loaded));
+  const explicitConfig = option(args, "--config") ?? undefined;
+  const loaded = loadConfig(explicitConfig);
+  const rules = selectedRules(args, await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig)));
   const snapshot = await readSnapshot(args);
 
   const policy = mergePolicy(defaultPolicy(), loaded?.config);
@@ -371,8 +372,9 @@ function shortDay(at: string): string {
  * re-fetching (useful for a plan produced earlier or by another machine).
  */
 export async function reportCommand(args: string[]) {
-  const loaded = loadConfig(option(args, "--config") ?? undefined);
-  const configuredRules = await resolveConfiguredRules(loaded);
+  const explicitConfig = option(args, "--config") ?? undefined;
+  const loaded = loadConfig(explicitConfig);
+  const configuredRules = await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig));
 
   let plan: PatchPlan;
   let snapshot: CanonicalGtmSnapshot | undefined;
@@ -424,8 +426,9 @@ export async function reportCommand(args: string[]) {
 }
 
 export async function rulesCommand(args: string[]) {
-  const loaded = loadConfig(option(args, "--config") ?? undefined);
-  const rules = await resolveConfiguredRules(loaded);
+  const explicitConfig = option(args, "--config") ?? undefined;
+  const loaded = loadConfig(explicitConfig);
+  const rules = await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig));
   if (args.includes("--json")) {
     console.log(
       JSON.stringify(

package/src/cli/auth.ts

@@ -3,7 +3,7 @@
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { DEFAULT_LOOPBACK_PORT, openInBrowser, runHubspotLoopbackLogin, validateHubspotToken } from "../connectors/hubspotAuth.ts";
-import { pollSalesforceDeviceLogin, startSalesforceDeviceLogin, validateSalesforceToken } from "../connectors/salesforceAuth.ts";
+import { pollSalesforceDeviceLogin, startSalesforceDeviceLogin, validateSalesforceOrigin, validateSalesforceToken } from "../connectors/salesforceAuth.ts";
 import { activeProfile, credentialsPath, DEFAULT_PROFILE, deleteCredential, getCredential, storeCredential, type StoredCredential } from "../credentials.ts";
 import { activeWorkspaceProfile, readHealthTimeline, summarizeHealth } from "../health.ts";
 import { resolveLlmCredential, validateLlmKey } from "../llm.ts";
@@ -252,7 +252,10 @@ async function salesforceLogin(args: string[]) {
       await guidedProviderLogin("salesforce", args, "--device requires --client-id (the consumer key of a Connected App with device flow enabled).");
       return;
     }
-    const loginUrl = option(args, "--login-url") ?? undefined;
+    const loginUrlInput = option(args, "--login-url") ?? undefined;
+    const loginUrl = loginUrlInput
+      ? validateSalesforceOrigin(loginUrlInput, "Salesforce --login-url")
+      : undefined;
     const authorization = await startSalesforceDeviceLogin({ clientId, loginUrl });
     console.error(
       `\nPairing code: ${authorization.userCode}\n\nConfirm this code at:\n\n  ${authorization.verificationUri}\n`,
@@ -282,8 +285,8 @@ async function salesforceLogin(args: string[]) {
     return;
   }
 
-  const instanceUrl = option(args, "--instance-url");
-  if (!instanceUrl) {
+  const instanceUrlInput = option(args, "--instance-url");
+  if (!instanceUrlInput) {
     await guidedProviderLogin(
       "salesforce",
       args,
@@ -291,6 +294,7 @@ async function salesforceLogin(args: string[]) {
     );
     return;
   }
+  const instanceUrl = validateSalesforceOrigin(instanceUrlInput, "Salesforce --instance-url");
   const token = await readSecret("Salesforce access token");
   if (!token) throw new Error("No access token provided.");
   if (!args.includes("--no-validate")) {