fullstackgtm 0.48.0 → 0.50.0

package/CHANGELOG.md

@@ -7,6 +7,97 @@ The path to 1.0 is planned in [docs/roadmap-to-1.0.md](https://github.com/fullst
 
 ## [Unreleased]
 
+## [0.50.0] — 2026-07-10
+
+### Added
+
+- CLI and hosted now act as local-first replicas of one immutable patch plan.
+  Either surface may execute when it has a compatible CRM connection; online
+  execution uses a shared claim, while offline CLI work remains available and
+  reconciles later through stable provider idempotency and exact receipts.
+- `fullstackgtm plans sync` explicitly exchanges approval revisions, terminal
+  state, and per-operation execution receipts. Plan list, show, and apply also
+  perform best-effort ambient check-ins.
+- Hosted can execute fully synchronized CLI-origin plans through its connected
+  HubSpot or Salesforce connector. The CLI imports hosted runs without replaying
+  provider writes, and hosted imports exact CLI outcomes rather than inferring
+  success for every approved row.
+
+### Security
+
+- Shared execution claims are bound to the immutable plan, exact approved
+  subset, replica, and paired CLI token. Approval edits freeze during apply;
+  stranded claims require an explicit audited recovery, and preflight release
+  is permitted only before provider I/O by the owning replica.
+- Hosted ingestion recomputes the immutable document digest and verifies an
+  exact one-to-one operation set. Terminal transitions require complete,
+  duplicate-free receipts for the approved subset and cannot widen authority.
+
+### Fixed
+
+- Paired CLIs now mirror saved plans into the hosted Patch Plans queue and
+  print an exact review deep-link. Mirrors are org-scoped, immutable and
+  idempotent; hosted approvals are hash/operation-verified and locally
+  HMAC-signed before CLI execution. Security state and evidence/findings stay
+  local, while bounded provider receipts replicate between capable executors.
+- `enrich acquire` now reports discovery, resolution, and plan-building progress
+  across the previously silent provider/dedupe middle. Paired hosted runs render
+  the same live stage, counters, and generic progress notes on their detail page.
+- Interactive acquisition runs retain both the CRM snapshot and acquisition
+  checklists in terminal history, then print a compact plan summary, copyable
+  review/approve/apply commands, and the paired hosted Runs deep-link.
+- Persistent progress completion freezes the already-painted final frame rather
+  than repainting it, preventing duplicate live/final checklists in scrollback.
+- Acquisition now persists query-bound Pipe0 cursors and HeyReach/Explorium
+  offsets so scheduled runs traverse the full audience instead of repeatedly
+  exhausting the first 25 results. `--max` controls desired new leads and the
+  new `--scan-limit` bounds raw duplicate-heavy scanning. Run history records
+  the complete discovery funnel and provider-confirmed exhaustion state.
+- Checkpoints now live in a dedicated profile-scoped store keyed independently
+  by provider/source/list/query. Paired CLIs synchronize opaque continuation to
+  an organization-scoped hosted record using broker authentication and
+  compare-and-swap revisions; conflicts retain the newer hosted checkpoint.
+- The documented LinkedIn `--list <id>` flag is accepted by strict CLI parsing,
+  and NAICS-only software ICPs retain their industry constraint on Pipe0.
+
+## [0.49.0] — 2026-07-10
+
+### Security
+
+- MCP apply now accepts only store-backed, HMAC-approved plan ids; external
+  plan paths and caller-supplied approvals/value overrides are rejected.
+- Apply uses an atomic single-owner claim and durable attempt journal.
+  Uncertain attempts remain fail-closed until an operator acknowledges provider
+  state; recovery clears every approval and never replays writes automatically.
+- Salesforce credential-bearing endpoints are restricted to canonical HTTPS
+  Salesforce origins and redirects are handled without forwarding credentials.
+- Executable rule packages require explicit CLI trust and are disabled entirely
+  in MCP. Implicit repository configuration cannot activate plugins.
+- Sensitive local files use atomic no-follow writes and verified no-follow
+  reads; symlinked credential, plan, and managed-home paths are refused.
+- Market capture/sourcing uses DNS-pinned public-only HTTP with per-hop redirect
+  validation, bounded responses, and cross-origin credential stripping.
+- Provider HTTP failures expose typed status metadata without raw response
+  bodies, reflected secrets, or PII.
+
+### Changed
+
+- **Breaking pre-1.0 plan-store contract:** `PlanStore` implementations now
+  participate in apply claims, attempt recovery, and claim-bound run recording;
+  `ApprovalStatus` includes `applying`. Custom stores must implement the new
+  lifecycle before upgrading.
+- Public mirror generation is commit-derived, allowlisted, secret-scanned, and
+  fail-closed. npm publishing uses pinned actions/npm plus a protected release
+  environment and provenance verification.
+- Package CI now validates Node 20/22, Linux/macOS/Windows compiled runtimes,
+  and actual installed tarballs with and without optional MCP peers.
+
+### Fixed
+
+- `bulk-update --help` and `-h` now return focused help before parsing an object
+  type or touching configuration, credentials, disk, or network.
+- Installation guidance no longer pins a brittle exact demo finding count.
+
 ## [0.48.0] — 2026-07-08
 
 ### Added

package/CONTRIBUTING.md

@@ -44,6 +44,21 @@ node --experimental-strip-types --test tests/fullstackgtm*.test.ts   # from the
 node packages/fullstackgtm/src/bin.ts doctor                  # run the CLI locally
 ```
 
+Before a release-facing change, verify the artifact rather than only its source
+tree:
+
+```bash
+cd packages/fullstackgtm
+npm run build
+node scripts/verify-packed-install.mjs              # isolated install, optional peers absent
+node scripts/verify-packed-install.mjs --with-peers # isolated install, MCP peers present
+```
+
+The verifier creates the real npm tarball, enforces required/prohibited paths,
+imports the public export, checks its declaration entrypoint, and runs both
+installed binaries. CI repeats compiled-runtime checks on Node 20 and 22 across
+Linux, macOS, and Windows; source-level tests remain on Node 22.6+.
+
 > **Tests live at the monorepo root `tests/`, not in the package.** Running
 > `npm test` *inside* `packages/fullstackgtm` deliberately fails with a pointer
 > (a `pretest` guard) rather than silently passing with zero tests. On the
@@ -78,13 +93,17 @@ the development monorepo). From the monorepo:
 
 1. Bump `packages/fullstackgtm/package.json` version + add a `CHANGELOG.md`
    entry; merge to `main`.
-2. `scripts/sync-oss.sh --push` (builds a fresh `dist/`, mirrors the package +
-   rewritten tests to `fullstackgtm/core`).
+2. Run `scripts/sync-oss.sh` to export an allowlisted mirror from the full
+   source commit, build `dist/`, scan for secrets, and inspect the complete
+   staged diff. Then rerun with `--push` after review. Clone failures stop the
+   release; only a genuine first publication may use the separately confirmed
+   `--initialize-public-repo` mode.
 3. Re-check the mirror's `package.json` version, then tag `vX.Y.Z` on the mirror
    and push the tag.
 4. GitHub Actions (`release.yml`) publishes to npm via **OIDC trusted
-   publishing** — no tokens. It rebuilds from source and refuses to publish if
-   the committed `dist/` differs from a fresh build (supply-chain gate).
+   publishing** — no tokens. The protected `npm-production` environment must
+   require an independent reviewer. The workflow rebuilds from source and
+   refuses to publish if committed `dist/` differs (supply-chain gate).
 
 **Access a new co-maintainer needs to cut a release:** write access to
 `github.com/fullstackgtm/core` (for `sync-oss.sh --push` and the tag push). No

package/DATA-FLOWS.md

@@ -10,7 +10,8 @@ is no fullstackgtm-operated server in the data path for the open package.**
 
 - CRM snapshots, patch plans, approvals, apply-run records, market captures and
   observations, enrich run state, and the signing/credential stores all live
-  under `$FSGTM_HOME` (default `~/.fullstackgtm`), `0600`/`0700`. Nothing is
+  under `$FSGTM_HOME` (default `~/.fullstackgtm`), `0600`/`0700`, using atomic
+  no-follow file I/O. Nothing is
   uploaded to Full Stack GTM.
 - No telemetry, analytics, or phone-home. The core package has zero runtime
   dependencies; the only network calls are the ones listed below, all to
@@ -23,12 +24,17 @@ is no fullstackgtm-operated server in the data path for the open package.**
 | `snapshot`, `audit`, `apply`, `resolve`, `bulk-update`, `dedupe`, `reassign`, `fix`, `enrich` (writeback) | **Your CRM** (HubSpot / Salesforce / Stripe API) | Reads: your CRM records. Writes: only approved patch operations. | Your CRM token (env / stored / broker) |
 | `call parse`, `call score`, `market classify`, `market refresh` | **Your LLM provider** (api.anthropic.com or api.openai.com) | The call transcript / captured competitor page text you point at, plus the extraction prompt | Your `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` (BYO) |
 | `enrich append --source apollo`, `enrich refresh` | **Apollo** (api.apollo.io) | The company domain / contact email being enriched | Your `APOLLO_API_KEY` (BYO) |
-| `market capture`, `market refresh` | **Public vendor websites** you list in `market.config.json` | An HTTP GET (no data sent beyond the request); SSRF-guarded to public hosts only | none |
+| `market capture`, `market refresh` | **Public vendor websites** you list in `market.config.json` | A bounded HTTP GET; DNS answers are validated and pinned, mixed/private/reserved answers are refused, and every redirect is revalidated | none |
 | `login --via <url>` (optional) | **Your hosted deployment's broker** | A pairing handshake; the broker mints short-lived CRM tokens | broker pairing token |
+| paired `enrich acquire` checkpoint sync (optional) | **Your hosted deployment** | Opaque query fingerprint plus provider cursor/list offset, exhaustion flag, and CAS revision. No prospect records, emails, names, or provider credentials. Scoped to the broker token's organization. | broker pairing token |
 
 Commands not listed (`plans`, `rules`, `doctor`, `schedule`, `audit-log`,
 `diff`, `merge`, report rendering) make **no network calls**.
 
+Provider HTTP failures persist only typed provider/operation/status/retryability
+metadata. Raw third-party response bodies—which may reflect credentials,
+filters, or PII—are not written to run records or normal CLI/MCP errors.
+
 ## Avoiding third-party data egress
 
 - **LLM verbs are optional.** `call parse --deterministic` uses a free,

package/INSTALL_FOR_AGENTS.md

@@ -33,9 +33,11 @@ machine — that is normal and does not block the next step.
 fullstackgtm audit --demo --json
 ```
 
-Expect a JSON patch plan with `dryRun: true` and 110 findings/110 operations over a generated,
-deliberately messy CRM. Deterministic per seed: `--seed 7` is the default, so
-two runs produce identical finding and operation ids. Exit code 0.
+Expect a JSON patch plan with `dryRun: true`, a non-empty `findings` array, and
+matching proposed operations over a generated, deliberately messy CRM. The
+exact count can grow as built-in rules are added; the stable contract is
+determinism per release and seed. `--seed 7` is the default, so two runs on the
+same version produce identical finding and operation ids. Exit code 0.
 
 This proves the whole pipeline (snapshot → audit → plan) without any account.
 
@@ -133,10 +135,16 @@ works from inside existing projects too.
 Tools exposed over stdio — read-only: `fullstackgtm_audit`,
 `fullstackgtm_capabilities`, `fullstackgtm_rules`, `fullstackgtm_suggest`,
 `fullstackgtm_call_parse`, `fullstackgtm_resolve`, `fullstackgtm_market_worksheet`. Gated:
-`fullstackgtm_apply` (requires explicit `approvedOperationIds`),
+`fullstackgtm_apply` (stored `planId` only; approvals and values must already be
+human-approved and HMAC-signed in the local plan store),
 `fullstackgtm_market_observe` (every quoted span is verified against the
 stored captures before anything is appended).
 
+MCP cannot execute rule packages, apply external plan files, or supply its own
+approvals/value overrides. For an interrupted apply, reconcile provider state,
+then run `fullstackgtm plans recover <id> --acknowledge-uncertain-writes`; this
+replays nothing and clears approvals so a fresh review is required.
+
 ## Troubleshooting
 
 | Symptom | Fix |
@@ -145,3 +153,4 @@ stored captures before anything is appended).
 | `No HubSpot credentials` (exit 1) | Set `HUBSPOT_ACCESS_TOKEN` or have a human run `fullstackgtm login hubspot --hosted` |
 | MCP server prints peer-dependency help | Install `@modelcontextprotocol/sdk` and `zod` (see step 6) |
 | Need machine state for orchestration | `fullstackgtm doctor --json` |
+| Plan is `applying` after an interrupted request | Reconcile provider state, then run `fullstackgtm plans recover <id> --acknowledge-uncertain-writes`; review and approve again |

package/README.md

@@ -192,6 +192,7 @@ echo "$PIPE0_API_KEY" | fullstackgtm login pipe0            # discovery + work-e
 
 fullstackgtm enrich acquire --provider hubspot              # zero-config: ICP → discover → score → dedup → dry-run diff
 fullstackgtm enrich acquire --provider hubspot --max 25 --save   # cap the batch, persist the needs_approval plan
+fullstackgtm enrich acquire --provider hubspot --max 25 --scan-limit 500 --save # scan through duplicate-heavy pages for 25 fresh leads
 fullstackgtm plans approve <id> --operations all
 fullstackgtm apply --plan-id <id> --provider hubspot        # the only step that creates contacts
 ```
@@ -206,6 +207,46 @@ The **ICP** (`icp.json`) is the single targeting artifact: it generates each pro
 
 Every run is **metered**: a per-profile budget caps both record count and provider spend (per-day + per-month, whichever binds first), charged only for creates that actually land. `enrich acquire` runs with just an `icp.json` and a `login` — sensible defaults for budget, provider, and create-mapping ship in the box.
 
+Discovery continuation is profile-scoped and independently keyed by the exact
+provider, source, list, and ICP query. Scheduled runs resume the saved Pipe0
+cursor or HeyReach offset instead of rereading page one, even when several
+lists alternate. When the CLI is paired, this non-PII checkpoint is mirrored
+to the hosted organization with compare-and-swap so another authenticated
+worker can resume without moving a newer cursor backwards. `--max` is the desired net-new plan size;
+`--scan-limit` independently bounds raw candidates scanned after ICP filtering
+and dedupe. `enrich status --runs` exposes the full funnel and whether the
+audience is continuing or provider-confirmed exhausted.
+
+When paired, every saved plan is also mirrored into the hosted Patch Plans
+review queue and the CLI prints its exact deep-link. The mirror is immutable
+and organization-scoped: replaying the same plan is idempotent, while the same
+id with different content is rejected. Hosted reviewers can approve or reject;
+the plan is executable from any synchronized surface with a compatible CRM
+connection. A CLI-created plan can be applied in hosted, and a hosted approval
+can be applied from the CLI—the plan's origin does not permanently own it.
+
+This is local-first replication, not remote control. The local plan store works
+offline, and plan commands perform a best-effort hosted check-in. Run
+`fullstackgtm plans sync` to explicitly exchange every plan's latest approval,
+execution claim, status, and receipts. If hosted applies while the CLI is
+offline, the next check-in imports the exact per-operation results and marks
+the local plan applied. If the CLI applies while hosted is unavailable, it
+keeps the result locally and uploads the receipt on a later check-in.
+
+Before either surface writes, it verifies the immutable plan hash, selected
+operation ids, current approval revision, connector capability, and provider
+state. Online replicas use a short-lived execution claim to coordinate; stable
+operation ids, resolve-before-create, compare-and-set guards, and provider
+readback protect offline retries. Receipts record each operation as `applied`,
+`skipped`, or `failed`, plus provider record ids when available, so another
+replica learns what happened rather than inferring it from plan status. A
+conflicting plan body or approval revision is surfaced for review and is never
+merged by expanding authority.
+
+Local signing keys and HMAC digests never upload. Operation before/after values
+do upload to the paired organization because they are required for informed
+review and hosted execution.
+
 **Discovery sources** are zero-config presets behind `--source`: `explorium` and `pipe0` run ICP-driven people search, while `linkedin` (Phase 1 — discovery + dry-run) reads a pre-built **HeyReach** lead list:
 
 ```bash
@@ -373,6 +414,12 @@ fullstackgtm logout hubspot   # or: salesforce | broker
 
 BYO direct credentials always win over a hosted broker pairing, so an operator can override the team default. First-party app secrets never ship in the npm package; hosted login stores a local broker token and mints provider tokens server-side. HubSpot does not support the device-authorization grant or secretless public clients, which is why the bring-your-own-app OAuth path requires client credentials; they are stored locally for silent refresh, the same model as `gcloud` and `aws` CLI profiles.
 
+Salesforce credential-bearing URLs are restricted to canonical HTTPS
+Salesforce-owned production, sandbox, and My Domain origins. Lookalike hosts,
+userinfo, paths/query/fragment, nonstandard ports, unsafe token-response
+instance URLs, and credential-forwarding redirects are refused both when the
+credential is stored and every time it is used.
+
 ## Connect your CRM
 
 What each provider actually requires before `audit --provider <name>` works on your data.
@@ -539,10 +586,15 @@ Nine tools are exposed over stdio.
 
 **Read-only:** `fullstackgtm_audit` (sample, demo, file, or live provider sources with optional rule scoping), `fullstackgtm_capabilities` (server/tool capability manifest), `fullstackgtm_rules` (rule discovery), `fullstackgtm_suggest` (deterministic placeholder values with confidence + reasons), `fullstackgtm_call_parse` (transcripts → provenance-marked segments, insights, and evidence), `fullstackgtm_resolve` (the create gate: exists / ambiguous / safe_to_create), and `fullstackgtm_market_worksheet` (the classification packet for one vendor: claims, judging rules, captured page texts).
 
-**Gated:** `fullstackgtm_apply` (requires explicit `approvedOperationIds`; placeholders still need value overrides) and `fullstackgtm_market_observe` (verifies every quoted span against the stored captures before appending — nothing is stored unless the whole set passes).
+**Gated:** `fullstackgtm_apply` (accepts only a stored plan id; approvals and values must already be human-approved and HMAC-signed in the plan store) and `fullstackgtm_market_observe` (verifies every quoted span against the stored captures before appending — nothing is stored unless the whole set passes).
 
 Tokens stored via `fullstackgtm login` are picked up automatically — the env var is only needed when no stored login exists.
 
+Rule packages are executable JavaScript and are disabled by default. In the CLI,
+review the modules and use `--config <path> --allow-plugins`; use `--no-plugins`
+to apply only declarative config. MCP never executes rule packages: mutable
+tool-call paths are not a durable code-trust boundary.
+
 ## Safety model
 
 1. Reads are safe by default; audits never mutate anything.

package/SECURITY.md

@@ -21,7 +21,10 @@ newest version, not backported (the project is pre-1.0).
 **Credentials.** API tokens are never accepted as command-line arguments
 (they would leak into the process table and shell history); they come from an
 environment variable or stdin only, and are stored `0600` under a `0700` home
-(`$FSGTM_HOME`, default `~/.fullstackgtm`), re-tightened on read. This is the
+(`$FSGTM_HOME`, default `~/.fullstackgtm`). Writes use exclusive temporary
+files, fsync, and atomic rename; reads require regular files opened without
+following symlinks. Managed-home, credential, and plan-store symlink paths are
+refused before chmod/read/write. This is the
 same custody model as the `gcloud`/`aws` CLIs. The hosted broker
 (`login --via`) exists so a team can connect a CRM once, server-side, and hand
 laptops only a revocable pairing token instead of a long-lived super-admin key;
@@ -57,13 +60,34 @@ approved on one machine cannot be applied on another (the key does not travel).
 Documented boundary: this defends the plan file, not an attacker who already
 holds the signing key (same directory and permissions as the credential store).
 
+**Single-owner apply and recovery.** Store-backed CLI and MCP writes atomically
+claim an approved plan and journal the provider, caller surface, and attempt
+state before provider I/O. A second process cannot apply the same approval.
+Failures after provider I/O remain `applying`/uncertain because a timeout cannot
+prove no remote write landed. Recovery never auto-replays: after reconciling CRM
+state, `plans recover <id> --acknowledge-uncertain-writes` clears every approval
+and signature and requires a fresh human review.
+
+**Executable configuration.** `rulePackages` are arbitrary JavaScript. An
+implicitly discovered repository config cannot activate them; CLI execution
+requires explicit `--config <path> --allow-plugins` (`--no-plugins` disables
+them). MCP never executes rule packages or accepts external plans/caller
+approvals.
+
+**Credential origins.** Salesforce access and refresh tokens are sent only to
+canonical HTTPS Salesforce-owned origins. Userinfo, paths/query/fragment,
+nonstandard ports, lookalike domains, unsafe token-response instance URLs, and
+credential-preserving redirects are refused at input, storage, and use.
+
 **Scheduling never auto-approves.** Scheduled (cron) runs are restricted to a
 read/plan-side allowlist plus `apply --plan-id` whose approved status and
 signatures are re-checked at every firing. Arbitrary shell is not schedulable.
 
 **Untrusted input.** Competitor pages fetched by `market capture` are guarded
-against SSRF (scheme allowlist; private/loopback/link-local/metadata addresses
-refused; redirects re-validated). LLM-extracted call insights and market
+against SSRF: every DNS answer must be globally routable, validated answers are
+pinned into socket creation, mixed/private/reserved answers are refused, every
+redirect is revalidated, sensitive headers are stripped cross-origin, and
+time/body/redirect limits are enforced. LLM-extracted call insights and market
 classifications are mechanically verified verbatim against the source text
 before they can drive a writeback, so a prompt-injected transcript or page
 cannot fabricate a grounded-looking change. CSV/formula-injection in ingested

package/dist/acquireCheckpoint.d.ts

@@ -0,0 +1,33 @@
+/** The complete identity of one independently traversable provider audience. */
+export type AcquireCheckpointKey = {
+    provider: string;
+    source: string;
+    listId: string | null;
+    queryFingerprint: string;
+};
+export type AcquireContinuation = {
+    cursor?: string | null;
+    offset?: number | null;
+    exhausted: boolean;
+};
+/** Versioned wire format shared by local persistence and hosted sync. */
+export type AcquireCheckpoint = {
+    version: 1;
+    id: string;
+    key: AcquireCheckpointKey;
+    continuation: AcquireContinuation;
+    updatedAt: string;
+};
+export declare function validateAcquireCheckpointKey(value: unknown): AcquireCheckpointKey;
+/** Stable, non-secret filename/key suitable for both filesystem and hosted records. */
+export declare function acquireCheckpointId(key: AcquireCheckpointKey): string;
+export declare function validateAcquireCheckpoint(value: unknown): AcquireCheckpoint;
+export declare function acquireCheckpointsDir(baseDir?: string): string;
+export interface AcquireCheckpointStore {
+    get(key: AcquireCheckpointKey): Promise<AcquireCheckpoint | null>;
+    put(key: AcquireCheckpointKey, continuation: AcquireContinuation, updatedAt?: Date): Promise<AcquireCheckpoint>;
+    /** Import a validated local/hosted record without changing its timestamp. */
+    putRecord(record: AcquireCheckpoint): Promise<AcquireCheckpoint>;
+    list(): Promise<AcquireCheckpoint[]>;
+}
+export declare function createFileAcquireCheckpointStore(baseDir?: string): AcquireCheckpointStore;

package/dist/acquireCheckpoint.js

@@ -0,0 +1,149 @@
+import { createHash } from "node:crypto";
+import { chmodSync, mkdirSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { credentialsDir, ensureSecureHomeDir } from "./credentials.js";
+import { assertNoSymlinkComponents, readSecureRegularFile, writeSecureFileAtomic, } from "./secureFile.js";
+const COMPONENT_MAX = 512;
+function requireComponent(value, name) {
+    if (typeof value !== "string" || value.length === 0 || value.length > COMPONENT_MAX || /[\u0000-\u001f]/.test(value)) {
+        throw new Error(`Invalid acquisition checkpoint ${name}`);
+    }
+    return value;
+}
+export function validateAcquireCheckpointKey(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Invalid acquisition checkpoint key");
+    }
+    const candidate = value;
+    const listId = candidate.listId;
+    if (listId !== null && listId !== undefined)
+        requireComponent(listId, "listId");
+    return {
+        provider: requireComponent(candidate.provider, "provider"),
+        source: requireComponent(candidate.source, "source"),
+        listId: listId ?? null,
+        queryFingerprint: requireComponent(candidate.queryFingerprint, "queryFingerprint"),
+    };
+}
+/** Stable, non-secret filename/key suitable for both filesystem and hosted records. */
+export function acquireCheckpointId(key) {
+    const valid = validateAcquireCheckpointKey(key);
+    const canonical = JSON.stringify([valid.provider, valid.source, valid.listId, valid.queryFingerprint]);
+    return `acqcp_${createHash("sha256").update(canonical).digest("hex")}`;
+}
+function validateContinuation(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Invalid acquisition checkpoint continuation");
+    }
+    const candidate = value;
+    if (typeof candidate.exhausted !== "boolean")
+        throw new Error("Invalid acquisition checkpoint exhausted flag");
+    if (candidate.cursor !== undefined && candidate.cursor !== null)
+        requireComponent(candidate.cursor, "cursor");
+    if (candidate.offset !== undefined && candidate.offset !== null &&
+        (!Number.isSafeInteger(candidate.offset) || candidate.offset < 0)) {
+        throw new Error("Invalid acquisition checkpoint offset");
+    }
+    return {
+        ...(candidate.cursor !== undefined ? { cursor: candidate.cursor } : {}),
+        ...(candidate.offset !== undefined ? { offset: candidate.offset } : {}),
+        exhausted: candidate.exhausted,
+    };
+}
+export function validateAcquireCheckpoint(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Invalid acquisition checkpoint");
+    }
+    const candidate = value;
+    if (candidate.version !== 1)
+        throw new Error(`Unsupported acquisition checkpoint version: ${String(candidate.version)}`);
+    const key = validateAcquireCheckpointKey(candidate.key);
+    const id = acquireCheckpointId(key);
+    if (candidate.id !== id)
+        throw new Error("Acquisition checkpoint id does not match its key");
+    if (typeof candidate.updatedAt !== "string" || !Number.isFinite(Date.parse(candidate.updatedAt))) {
+        throw new Error("Invalid acquisition checkpoint updatedAt");
+    }
+    return {
+        version: 1,
+        id,
+        key,
+        continuation: validateContinuation(candidate.continuation),
+        updatedAt: candidate.updatedAt,
+    };
+}
+export function acquireCheckpointsDir(baseDir) {
+    return join(baseDir ?? credentialsDir(), "acquire", "checkpoints");
+}
+export function createFileAcquireCheckpointStore(baseDir) {
+    const directory = acquireCheckpointsDir(baseDir);
+    function fileForId(id) {
+        return join(directory, `${id}.json`);
+    }
+    function readId(id) {
+        try {
+            return validateAcquireCheckpoint(JSON.parse(readSecureRegularFile(fileForId(id), { tightenMode: 0o600 })));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+    }
+    function ensureDirectory() {
+        if (baseDir === undefined)
+            ensureSecureHomeDir();
+        // Tighten both managed levels. mkdir's mode does not affect a directory
+        // restored or pre-created with broader permissions.
+        const levels = [join(baseDir ?? credentialsDir(), "acquire"), directory];
+        for (const level of levels) {
+            assertNoSymlinkComponents(level);
+            mkdirSync(level, { recursive: true, mode: 0o700 });
+            assertNoSymlinkComponents(level);
+            try {
+                chmodSync(level, 0o700);
+            }
+            catch { /* chmod is unavailable on some filesystems. */ }
+        }
+    }
+    function writeRecord(value) {
+        const record = validateAcquireCheckpoint(value);
+        ensureDirectory();
+        writeSecureFileAtomic(fileForId(record.id), `${JSON.stringify(record, null, 2)}\n`);
+        return record;
+    }
+    return {
+        async get(key) {
+            return readId(acquireCheckpointId(key));
+        },
+        async put(key, continuation, updatedAt = new Date()) {
+            const validKey = validateAcquireCheckpointKey(key);
+            return writeRecord({
+                version: 1,
+                id: acquireCheckpointId(validKey),
+                key: validKey,
+                continuation: validateContinuation(continuation),
+                updatedAt: updatedAt.toISOString(),
+            });
+        },
+        async putRecord(record) {
+            return writeRecord(record);
+        },
+        async list() {
+            let names;
+            try {
+                assertNoSymlinkComponents(directory);
+                names = readdirSync(directory).filter((name) => /^acqcp_[a-f0-9]{64}\.json$/.test(name));
+            }
+            catch (error) {
+                if (error.code === "ENOENT")
+                    return [];
+                throw error;
+            }
+            return names
+                .map((name) => readId(name.slice(0, -5)))
+                .filter((record) => record !== null)
+                .sort((a, b) => a.updatedAt.localeCompare(b.updatedAt));
+        },
+    };
+}

package/dist/acquireLinkedIn.d.ts

@@ -25,6 +25,8 @@ export type DiscoverLinkedInOptions = {
     sourceId?: string;
     /** Hard cap on prospects pulled. */
     max?: number;
+    /** Opaque provider continuation cursor. */
+    cursor?: string;
 };
 /**
  * Discovery branch for `acquireFromApi`: read prospects from a LinkedIn source

package/dist/acquireLinkedIn.js

@@ -41,7 +41,7 @@ export function linkedInProspectToProspect(lp) {
  * provider is injected so this is fully testable against the fake (no key).
  */
 export async function discoverLinkedInProspects(provider, options = {}) {
-    const raw = await provider.fetchProspects({ sourceId: options.sourceId, max: options.max });
+    const raw = await provider.fetchProspects({ sourceId: options.sourceId, max: options.max, cursor: options.cursor });
     return raw.map(linkedInProspectToProspect);
 }
 /**

package/dist/cli/audit.js

@@ -2,7 +2,7 @@
 import { readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { auditSnapshot, defaultPolicy } from "../audit.js";
-import { loadConfig, mergePolicy, resolveConfiguredRules } from "../config.js";
+import { loadConfig, mergePolicy, resolveConfiguredRules, rulePackageTrustFromCli } from "../config.js";
 import { getCredential, resolveHubspotConnection } from "../credentials.js";
 import { patchPlanToMarkdown } from "../format.js";
 import { appendHealthEntry, computeHealth, healthToMarkdown, readHealthTimeline, saveWorkspaceSnapshot, summarizeHealth, activeWorkspaceProfile } from "../health.js";
@@ -169,8 +169,9 @@ async function registerHubspotWithBroker() {
 }
 export async function audit(args) {
     const threshold = failOnThreshold(args);
-    const loaded = loadConfig(option(args, "--config") ?? undefined);
-    const rules = selectedRules(args, await resolveConfiguredRules(loaded));
+    const explicitConfig = option(args, "--config") ?? undefined;
+    const loaded = loadConfig(explicitConfig);
+    const rules = selectedRules(args, await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig)));
     const snapshot = await readSnapshot(args);
     const policy = mergePolicy(defaultPolicy(), loaded?.config);
     const today = option(args, "--today");
@@ -326,8 +327,9 @@ function shortDay(at) {
  * re-fetching (useful for a plan produced earlier or by another machine).
  */
 export async function reportCommand(args) {
-    const loaded = loadConfig(option(args, "--config") ?? undefined);
-    const configuredRules = await resolveConfiguredRules(loaded);
+    const explicitConfig = option(args, "--config") ?? undefined;
+    const loaded = loadConfig(explicitConfig);
+    const configuredRules = await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig));
     let plan;
     let snapshot;
     const planPath = option(args, "--plan");
@@ -375,8 +377,9 @@ export async function reportCommand(args) {
     }
 }
 export async function rulesCommand(args) {
-    const loaded = loadConfig(option(args, "--config") ?? undefined);
-    const rules = await resolveConfiguredRules(loaded);
+    const explicitConfig = option(args, "--config") ?? undefined;
+    const loaded = loadConfig(explicitConfig);
+    const rules = await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig));
     if (args.includes("--json")) {
         console.log(JSON.stringify(rules.map(({ id, title, description, category }) => ({
             id,

package/dist/cli/auth.js

@@ -2,7 +2,7 @@
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { DEFAULT_LOOPBACK_PORT, openInBrowser, runHubspotLoopbackLogin, validateHubspotToken } from "../connectors/hubspotAuth.js";
-import { pollSalesforceDeviceLogin, startSalesforceDeviceLogin, validateSalesforceToken } from "../connectors/salesforceAuth.js";
+import { pollSalesforceDeviceLogin, startSalesforceDeviceLogin, validateSalesforceOrigin, validateSalesforceToken } from "../connectors/salesforceAuth.js";
 import { activeProfile, credentialsPath, DEFAULT_PROFILE, deleteCredential, getCredential, storeCredential } from "../credentials.js";
 import { activeWorkspaceProfile, readHealthTimeline, summarizeHealth } from "../health.js";
 import { resolveLlmCredential, validateLlmKey } from "../llm.js";
@@ -229,7 +229,10 @@ async function salesforceLogin(args) {
             await guidedProviderLogin("salesforce", args, "--device requires --client-id (the consumer key of a Connected App with device flow enabled).");
             return;
         }
-        const loginUrl = option(args, "--login-url") ?? undefined;
+        const loginUrlInput = option(args, "--login-url") ?? undefined;
+        const loginUrl = loginUrlInput
+            ? validateSalesforceOrigin(loginUrlInput, "Salesforce --login-url")
+            : undefined;
         const authorization = await startSalesforceDeviceLogin({ clientId, loginUrl });
         console.error(`\nPairing code: ${authorization.userCode}\n\nConfirm this code at:\n\n  ${authorization.verificationUri}\n`);
         void openInBrowser(authorization.verificationUri);
@@ -254,11 +257,12 @@ async function salesforceLogin(args) {
         console.log("Tokens refresh silently; no further browser interaction is needed.");
         return;
     }
-    const instanceUrl = option(args, "--instance-url");
-    if (!instanceUrl) {
+    const instanceUrlInput = option(args, "--instance-url");
+    if (!instanceUrlInput) {
         await guidedProviderLogin("salesforce", args, "Salesforce login needs hosted OAuth, --device --client-id <consumer key>, or --instance-url <https://yourorg.my.salesforce.com> with the access token piped on stdin.");
         return;
     }
+    const instanceUrl = validateSalesforceOrigin(instanceUrlInput, "Salesforce --instance-url");
     const token = await readSecret("Salesforce access token");
     if (!token)
         throw new Error("No access token provided.");