gnosys 5.10.0 → 5.11.0

package/dist/lib/maintenance.d.ts

@@ -9,10 +9,10 @@
  *
  * All operations produce safe Git commits with rollback on failure.
  */
-import { GnosysStore, Memory } from "./store.js";
-import { GnosysConfig } from "./config.js";
-import { GnosysResolver } from "./resolver.js";
-import { GnosysDB } from "./db.js";
+import type { GnosysStore, Memory } from "./store.js";
+import { type GnosysConfig } from "./config.js";
+import type { GnosysResolver } from "./resolver.js";
+import type { GnosysDB } from "./db.js";
 export interface MaintenanceOptions {
     /** Show what would change without modifying anything */
     dryRun?: boolean;
@@ -123,4 +123,3 @@ export declare class GnosysMaintenanceEngine {
  * Format a maintenance report as a human-readable string.
  */
 export declare function formatMaintenanceReport(report: MaintenanceReport): string;
-//# sourceMappingURL=maintenance.d.ts.map

package/dist/lib/maintenance.js

@@ -546,4 +546,3 @@ export function formatMaintenanceReport(report) {
     }
     return lines.join("\n");
 }
-//# sourceMappingURL=maintenance.js.map

package/dist/lib/mcpClientConfig.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Point an IDE at a REMOTE gnosys server (v5.12 Phase B).
+ *
+ * In the central-server topology, a client machine doesn't spawn a local
+ * `gnosys serve` — its IDE connects to the host's URL. This writes the URL-based
+ * MCP entry into the IDE config (instead of the `{ command, args }` stdio form
+ * the local setup writes).
+ */
+export interface RemoteOpts {
+    url: string;
+    token?: string;
+}
+/** The MCP server entry for a remote (HTTP/URL) gnosys server. */
+export declare function remoteMcpEntry(opts: RemoteOpts): Record<string, unknown>;
+/** Merge a `gnosys` entry into a JSON file's `mcpServers` map (create if absent). */
+export declare function mergeJsonMcpServer(file: string, entry: Record<string, unknown>): Promise<void>;
+/** Write the remote entry into a project's `.cursor/mcp.json`. Returns the path. */
+export declare function writeCursorRemote(projectDir: string, opts: RemoteOpts): Promise<string>;
+export type RemoteIde = "cursor" | "claude-desktop";
+export declare function writeRemoteClientConfig(ide: RemoteIde, projectDir: string, opts: RemoteOpts): Promise<string>;

package/dist/lib/mcpClientConfig.js

@@ -0,0 +1,62 @@
+/**
+ * Point an IDE at a REMOTE gnosys server (v5.12 Phase B).
+ *
+ * In the central-server topology, a client machine doesn't spawn a local
+ * `gnosys serve` — its IDE connects to the host's URL. This writes the URL-based
+ * MCP entry into the IDE config (instead of the `{ command, args }` stdio form
+ * the local setup writes).
+ */
+import fs from "fs/promises";
+import path from "path";
+import os from "os";
+/** The MCP server entry for a remote (HTTP/URL) gnosys server. */
+export function remoteMcpEntry(opts) {
+    return {
+        url: opts.url,
+        ...(opts.token ? { headers: { Authorization: `Bearer ${opts.token}` } } : {}),
+    };
+}
+/** Platform-specific Claude Desktop config path (mirrors setup.ts). */
+function claudeDesktopConfigPath() {
+    const home = os.homedir();
+    if (process.platform === "darwin") {
+        return path.join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    }
+    if (process.platform === "win32") {
+        const appData = process.env.APPDATA || path.join(home, "AppData", "Roaming");
+        return path.join(appData, "Claude", "claude_desktop_config.json");
+    }
+    return path.join(home, ".config", "Claude", "claude_desktop_config.json");
+}
+/** Merge a `gnosys` entry into a JSON file's `mcpServers` map (create if absent). */
+export async function mergeJsonMcpServer(file, entry) {
+    let config = {};
+    try {
+        config = JSON.parse(await fs.readFile(file, "utf-8"));
+    }
+    catch {
+        // missing or invalid — start fresh
+    }
+    const servers = (config.mcpServers ?? {});
+    servers.gnosys = entry;
+    config.mcpServers = servers;
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    await fs.writeFile(file, JSON.stringify(config, null, 2) + "\n", "utf-8");
+}
+/** Write the remote entry into a project's `.cursor/mcp.json`. Returns the path. */
+export async function writeCursorRemote(projectDir, opts) {
+    const file = path.join(projectDir, ".cursor", "mcp.json");
+    await mergeJsonMcpServer(file, remoteMcpEntry(opts));
+    return file;
+}
+/** Write the remote entry into the Claude Desktop config. Returns the path. */
+async function writeClaudeDesktopRemote(opts) {
+    const file = claudeDesktopConfigPath();
+    await mergeJsonMcpServer(file, remoteMcpEntry(opts));
+    return file;
+}
+export async function writeRemoteClientConfig(ide, projectDir, opts) {
+    return ide === "claude-desktop"
+        ? writeClaudeDesktopRemote(opts)
+        : writeCursorRemote(projectDir, opts);
+}

package/dist/lib/mcpHttp.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Streamable HTTP transport for the Gnosys MCP server (v5.12 Phase A).
+ *
+ * Lets clients connect to a long-running gnosys server over HTTP instead of
+ * spawning a local stdio process — the basis for the "central server" topology
+ * (one host owns the brain; other machines point their IDE at the URL).
+ *
+ * Stateful sessions: each `initialize` mints a session id and gets its OWN
+ * McpServer (built by `makeServer`), so concurrent clients don't share MCP
+ * protocol state. The servers all reference the same module-global brain/search,
+ * so there's no per-session data — only a fresh capability registration.
+ *
+ * Uses Node's built-in http (no express). The SDK's StreamableHTTPServerTransport
+ * accepts a pre-parsed body, so we read+parse POST bodies ourselves.
+ */
+import http from "node:http";
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export interface McpHttpOptions {
+    host: string;
+    port: number;
+    /** MCP endpoint path. Default "/mcp". */
+    path?: string;
+    /** Build a fully-registered McpServer for a new session. */
+    makeServer: () => Promise<McpServer> | McpServer;
+    /** Phase C: require `Authorization: Bearer <token>` when set. */
+    authToken?: string;
+    log?: (msg: string) => void;
+    /** Reap sessions idle longer than this (ms). Default 30 min. */
+    sessionIdleMs?: number;
+    /** Sweep cadence (ms). Default 60s. */
+    sweepIntervalMs?: number;
+    /** Browser origins explicitly allowed to call the endpoint. Default: none. */
+    allowedOrigins?: string[];
+    /** Max request body bytes. Default 4 MiB. */
+    maxBodyBytes?: number;
+    /** Max ms to fully receive a request body. Default 30s. */
+    bodyTimeoutMs?: number;
+}
+export interface McpHttpHandle {
+    server: http.Server;
+    /** Active session count (for tests/observability). */
+    sessionCount: () => number;
+    /** Close+remove sessions idle beyond sessionIdleMs. Returns count reaped. */
+    reapIdleSessions: (now?: number) => number;
+    close: () => Promise<void>;
+}
+/** True when the bind host is loopback-only (token optional). */
+export declare function isLoopbackHost(host: string): boolean;
+/**
+ * Start the MCP Streamable HTTP server. Resolves once it is listening.
+ */
+export declare function startMcpHttpServer(opts: McpHttpOptions): Promise<McpHttpHandle>;

package/dist/lib/mcpHttp.js

@@ -0,0 +1,227 @@
+/**
+ * Streamable HTTP transport for the Gnosys MCP server (v5.12 Phase A).
+ *
+ * Lets clients connect to a long-running gnosys server over HTTP instead of
+ * spawning a local stdio process — the basis for the "central server" topology
+ * (one host owns the brain; other machines point their IDE at the URL).
+ *
+ * Stateful sessions: each `initialize` mints a session id and gets its OWN
+ * McpServer (built by `makeServer`), so concurrent clients don't share MCP
+ * protocol state. The servers all reference the same module-global brain/search,
+ * so there's no per-session data — only a fresh capability registration.
+ *
+ * Uses Node's built-in http (no express). The SDK's StreamableHTTPServerTransport
+ * accepts a pre-parsed body, so we read+parse POST bodies ourselves.
+ */
+import http from "node:http";
+import { randomUUID } from "node:crypto";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+/** True when the bind host is loopback-only (token optional). */
+export function isLoopbackHost(host) {
+    const h = (host || "").trim().toLowerCase();
+    if (h === "localhost" || h === "::1" || h === "[::1]")
+        return true;
+    if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h))
+        return true;
+    return false;
+}
+class HttpBodyError extends Error {
+    statusCode;
+    constructor(statusCode, message) {
+        super(message);
+        this.statusCode = statusCode;
+    }
+}
+function readBody(req, maxBytes, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let total = 0;
+        let settled = false;
+        const done = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            fn();
+        };
+        const timer = setTimeout(() => done(() => {
+            reject(new HttpBodyError(408, "Request body timeout"));
+        }), timeoutMs);
+        if (typeof timer.unref === "function")
+            timer.unref();
+        req.on("data", (c) => {
+            total += c.length;
+            if (total > maxBytes) {
+                done(() => {
+                    reject(new HttpBodyError(413, "Payload too large"));
+                });
+                return;
+            }
+            chunks.push(c);
+        });
+        req.on("end", () => done(() => {
+            const raw = Buffer.concat(chunks).toString("utf-8");
+            if (!raw)
+                return resolve(undefined);
+            try {
+                resolve(JSON.parse(raw));
+            }
+            catch (e) {
+                reject(e);
+            }
+        }));
+        req.on("error", (e) => done(() => reject(e)));
+    });
+}
+function jsonRpcError(res, status, code, message) {
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(JSON.stringify({ jsonrpc: "2.0", error: { code, message }, id: null }));
+}
+/**
+ * Start the MCP Streamable HTTP server. Resolves once it is listening.
+ */
+export function startMcpHttpServer(opts) {
+    if (!isLoopbackHost(opts.host) && !opts.authToken) {
+        return Promise.reject(new Error(`Refusing to start: HTTP transport is binding to a non-loopback address ` +
+            `(${opts.host}) without an auth token. Anyone who can reach this address ` +
+            `would get unauthenticated access to your memory. Set --token <token> ` +
+            `(or GNOSYS_SERVE_TOKEN), or bind to 127.0.0.1.`));
+    }
+    const mcpPath = opts.path ?? "/mcp";
+    const log = opts.log ?? (() => { });
+    const transports = new Map();
+    const lastSeen = new Map();
+    const idleMs = opts.sessionIdleMs ?? 30 * 60 * 1000;
+    const sweepMs = opts.sweepIntervalMs ?? 60 * 1000;
+    const maxBodyBytes = opts.maxBodyBytes ?? 4 * 1024 * 1024;
+    const bodyTimeoutMs = opts.bodyTimeoutMs ?? 30_000;
+    const touch = (sid) => lastSeen.set(sid, Date.now());
+    function reapIdle(now = Date.now()) {
+        let reaped = 0;
+        for (const [sid, t] of transports) {
+            if (now - (lastSeen.get(sid) ?? now) > idleMs) {
+                void t.close();
+                lastSeen.delete(sid);
+                reaped++;
+            }
+        }
+        return reaped;
+    }
+    const httpServer = http.createServer((req, res) => {
+        void handle(req, res).catch((e) => {
+            log(`request error: ${e instanceof Error ? e.message : String(e)}`);
+            if (!res.headersSent)
+                jsonRpcError(res, 500, -32603, "Internal error");
+        });
+    });
+    httpServer.headersTimeout = 15_000;
+    httpServer.requestTimeout = 60_000;
+    async function handle(req, res) {
+        const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+        // Liveness probe — unauthenticated, no MCP involvement.
+        if (url.pathname === "/health") {
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ status: "ok", sessions: transports.size }));
+            return;
+        }
+        if (url.pathname !== mcpPath) {
+            res.writeHead(404, { "content-type": "text/plain" });
+            res.end("Not found");
+            return;
+        }
+        // CORS default-deny: browsers send Origin on cross-origin calls; IDE/CLI clients do not.
+        const origin = req.headers["origin"];
+        if (origin && !(opts.allowedOrigins ?? []).includes(origin)) {
+            jsonRpcError(res, 403, -32001, "Origin not allowed");
+            return;
+        }
+        // Phase C: bearer auth (only enforced when a token is configured).
+        if (opts.authToken) {
+            if (req.headers["authorization"] !== `Bearer ${opts.authToken}`) {
+                jsonRpcError(res, 401, -32001, "Unauthorized");
+                return;
+            }
+        }
+        const sessionId = req.headers["mcp-session-id"];
+        if (req.method === "POST") {
+            let body;
+            try {
+                body = await readBody(req, maxBodyBytes, bodyTimeoutMs);
+            }
+            catch (e) {
+                if (e instanceof HttpBodyError) {
+                    jsonRpcError(res, e.statusCode, -32000, e.message);
+                    req.destroy();
+                    return;
+                }
+                jsonRpcError(res, 400, -32700, "Parse error");
+                req.destroy();
+                return;
+            }
+            let transport = sessionId ? transports.get(sessionId) : undefined;
+            if (!transport) {
+                if (!isInitializeRequest(body)) {
+                    jsonRpcError(res, 400, -32000, "No valid session; send an initialize request first");
+                    return;
+                }
+                // New session: fresh server + transport.
+                const server = await opts.makeServer();
+                transport = new StreamableHTTPServerTransport({
+                    sessionIdGenerator: () => randomUUID(),
+                    onsessioninitialized: (sid) => {
+                        transports.set(sid, transport);
+                        touch(sid);
+                        log(`session initialized: ${sid} (${transports.size} active)`);
+                    },
+                });
+                transport.onclose = () => {
+                    const sid = transport.sessionId;
+                    if (sid)
+                        lastSeen.delete(sid);
+                    if (sid && transports.delete(sid))
+                        log(`session closed: ${sid} (${transports.size} active)`);
+                };
+                await server.connect(transport);
+            }
+            else if (sessionId) {
+                touch(sessionId);
+            }
+            await transport.handleRequest(req, res, body);
+            return;
+        }
+        if (req.method === "GET" || req.method === "DELETE") {
+            const transport = sessionId ? transports.get(sessionId) : undefined;
+            if (!transport) {
+                jsonRpcError(res, 400, -32000, "Missing or unknown session id");
+                return;
+            }
+            if (sessionId)
+                touch(sessionId);
+            await transport.handleRequest(req, res);
+            return;
+        }
+        res.writeHead(405, { "content-type": "text/plain" });
+        res.end("Method not allowed");
+    }
+    return new Promise((resolve) => {
+        httpServer.listen(opts.port, opts.host, () => {
+            log(`listening on http://${opts.host}:${opts.port}${mcpPath}`);
+            const sweep = setInterval(() => reapIdle(), sweepMs);
+            sweep.unref();
+            resolve({
+                server: httpServer,
+                sessionCount: () => transports.size,
+                reapIdleSessions: (now) => reapIdle(now),
+                close: () => new Promise((r) => {
+                    clearInterval(sweep);
+                    for (const t of transports.values())
+                        void t.close();
+                    transports.clear();
+                    lastSeen.clear();
+                    httpServer.close(() => r());
+                }),
+            });
+        });
+    });
+}

package/dist/lib/migrate.d.ts

@@ -5,7 +5,7 @@
  * Safe: original .md files and old DBs are untouched.
  * Reversible: delete gnosys.db to revert.
  */
-import { MigrationStats } from "./db.js";
+import { type MigrationStats } from "./db.js";
 /**
  * Migrate all data from v1.x format into gnosys.db.
  */
@@ -16,4 +16,3 @@ export declare function migrate(storePath: string, options?: {
  * Format migration results for CLI output.
  */
 export declare function formatMigrationReport(stats: MigrationStats): string;
-//# sourceMappingURL=migrate.d.ts.map

package/dist/lib/migrate.js

@@ -169,6 +169,7 @@ export async function migrate(storePath, options) {
         const embPath = path.join(storePath, ".config", "embeddings.db");
         if (Database) {
             const embDb = new Database(embPath, { readonly: true });
+            embDb.pragma("busy_timeout = 5000");
             const rows = embDb.prepare("SELECT file_path, embedding FROM embeddings").all();
             let embCount = 0;
             for (const row of rows) {
@@ -257,4 +258,3 @@ export function formatMigrationReport(stats) {
     ];
     return lines.join("\n");
 }
-//# sourceMappingURL=migrate.js.map

package/dist/lib/modelValidation.d.ts

@@ -19,4 +19,3 @@ export declare function validateModel(provider: string, model: string, apiKey: s
     customBaseUrl?: string;
     timeoutMs?: number;
 }): Promise<ValidationResult>;
-//# sourceMappingURL=modelValidation.d.ts.map

package/dist/lib/modelValidation.js

@@ -154,4 +154,3 @@ export async function validateModel(provider, model, apiKey, opts) {
         return { ok: false, error: msg };
     }
 }
-//# sourceMappingURL=modelValidation.js.map

package/dist/lib/multimodalIngest.d.ts

@@ -5,7 +5,7 @@
  * Supports PDF and DOCX in Phase 2. Image, audio, and video ingestion
  * will be added in Phase 3/4.
  */
-import { FileType } from "./fileDetect.js";
+import { type FileType } from "./fileDetect.js";
 import { type AttachmentRecord } from "./attachments.js";
 export interface MultimodalIngestOptions {
     /** Absolute path to the file to ingest */
@@ -65,4 +65,3 @@ export interface MultimodalIngestResult {
  * 7. Link each memory back to the attachment
  */
 export declare function ingestFile(options: MultimodalIngestOptions): Promise<MultimodalIngestResult>;
-//# sourceMappingURL=multimodalIngest.d.ts.map

package/dist/lib/multimodalIngest.js

@@ -488,4 +488,3 @@ async function ingestImage(filePath, storePath, config, attachment, opts) {
         fileType: "image",
     };
 }
-//# sourceMappingURL=multimodalIngest.js.map

package/dist/lib/packageManager.d.ts

@@ -0,0 +1,5 @@
+export type PkgManager = "npm" | "pnpm" | "yarn" | "npx";
+/** Detect how the running global gnosys was installed, from its path + env. */
+export declare function detectPackageManager(execPath?: string, env?: NodeJS.ProcessEnv): PkgManager;
+/** The upgrade command for a manager, or null when there's nothing to install (npx). */
+export declare function upgradeCommand(pm: PkgManager): string | null;

package/dist/lib/packageManager.js

@@ -0,0 +1,30 @@
+/** Detect how the running global gnosys was installed, from its path + env. */
+export function detectPackageManager(execPath = process.argv[1] || "", env = process.env) {
+    const p = execPath.replace(/\\/g, "/").toLowerCase();
+    if (p.includes("/_npx/") || p.includes("/.npm/_npx/"))
+        return "npx";
+    if (p.includes("/pnpm/") || (env.PNPM_HOME && p.startsWith(env.PNPM_HOME.replace(/\\/g, "/").toLowerCase()))) {
+        return "pnpm";
+    }
+    if (p.includes("/.yarn/") || p.includes("/yarn/global/") || p.includes("/.config/yarn/"))
+        return "yarn";
+    const ua = (env.npm_config_user_agent || "").toLowerCase();
+    if (ua.startsWith("pnpm"))
+        return "pnpm";
+    if (ua.startsWith("yarn"))
+        return "yarn";
+    return "npm";
+}
+/** The upgrade command for a manager, or null when there's nothing to install (npx). */
+export function upgradeCommand(pm) {
+    switch (pm) {
+        case "pnpm":
+            return "pnpm add -g gnosys@latest";
+        case "yarn":
+            return "yarn global add gnosys@latest";
+        case "npx":
+            return null;
+        default:
+            return "npm install -g gnosys@latest";
+    }
+}

package/dist/lib/paths.d.ts

@@ -27,12 +27,6 @@ export declare function getGnosysHome(): string;
 export declare function getCentralDbPath(): string;
 /** Path to the sandbox runtime directory (socket + helper template live here). */
 export declare function getSandboxDir(): string;
-/**
- * Path to the user-level config directory: `~/.config/gnosys/`. Holds
- * the project registry, .env, and other per-user CLI metadata that
- * lives OUTSIDE the central data store at `~/.gnosys/`.
- */
-export declare function getConfigDir(): string;
 /** Path to the project registry file (~/.config/gnosys/projects.json). */
 export declare function getProjectRegistryPath(): string;
 /**
@@ -46,4 +40,3 @@ export declare function getProjectRegistryPath(): string;
  * machine-local counterpart. See machineConfig.ts.
  */
 export declare function getMachineConfigPath(): string;
-//# sourceMappingURL=paths.d.ts.map

package/dist/lib/paths.js

@@ -42,7 +42,7 @@ export function getSandboxDir() {
  * the project registry, .env, and other per-user CLI metadata that
  * lives OUTSIDE the central data store at `~/.gnosys/`.
  */
-export function getConfigDir() {
+function getConfigDir() {
     if (process.env.GNOSYS_CONFIG_DIR)
         return process.env.GNOSYS_CONFIG_DIR;
     const home = process.env.HOME || process.env.USERPROFILE || "/tmp";
@@ -65,4 +65,3 @@ export function getProjectRegistryPath() {
 export function getMachineConfigPath() {
     return path.join(getConfigDir(), "machine.json");
 }
-//# sourceMappingURL=paths.js.map

package/dist/lib/pdfExtract.d.ts

@@ -26,4 +26,3 @@ export interface PdfChunk {
  * where the content appears.
  */
 export declare function extractPdfText(filePath: string): Promise<PdfChunk[]>;
-//# sourceMappingURL=pdfExtract.d.ts.map

package/dist/lib/pdfExtract.js

@@ -160,4 +160,3 @@ function findPageForOffset(pageBlocks, combinedText, offset) {
     }
     return pageBlocks[pageBlocks.length - 1]?.pageNum || 1;
 }
-//# sourceMappingURL=pdfExtract.js.map

package/dist/lib/portfolio.d.ts

@@ -5,7 +5,7 @@
  * a formatted dashboard showing blockers, production readiness,
  * open questions, and roadmap status.
  */
-import { GnosysDB, DbProject } from "./db.js";
+import type { GnosysDB, DbProject } from "./db.js";
 export interface ActionItem {
     type: "question" | "blocker" | "manual" | "decision";
     text: string;
@@ -90,4 +90,3 @@ export declare function formatPortfolioCompact(report: PortfolioReport): string;
 export declare const STATUS_UPDATE_PROMPT = "# Gnosys Status Update \u2014 Guided Checklist\n\nYou are updating the project status for the Gnosys portfolio dashboard. Follow this process exactly.\n\n## Step 1: Analyze the codebase\n\nRead the project structure, recent git history, test results, build status, and any existing status memories (use gnosys_discover and gnosys_read). Fill in as much as you can from code.\n\n## Step 2: Work through every section below\n\nFor EACH section, either fill it in from your analysis or ASK the user. Do NOT skip sections. Do NOT write the status memory until all sections are addressed.\n\n### Section A: What's Complete\nList all features, milestones, and capabilities that are done and working. Be specific (e.g., \"14 Playwright E2E tests passing\" not \"tests exist\").\n\n### Section B: What's NOT Done\nList everything remaining before the project can go live. Include partial work, missing features, and known gaps.\n\n### Section C: Waiting on Human\n**YOU MUST ASK THE USER** if you cannot determine these from code:\n- Are there accounts that need to be created or configured? (Apple Developer, cloud providers, API keys, DNS, domain registrars, app store submissions)\n- Are there approvals or sign-offs needed? (legal, compliance, stakeholder review)\n- Are there purchases needed? (certificates, licenses, subscriptions)\n- Are there manual deployment steps only the user can do?\n- Is the user waiting on anyone else? (contractors, partners, third-party services)\n\nIf the code shows signs of these (e.g., placeholder API keys, TODO comments about accounts, unsigned builds), list what you found and confirm with the user.\n\n### Section D: Blockers\nItems that are actively preventing progress. Distinguish between:\n- **Technical blockers**: bugs, dependency issues, broken builds\n- **External blockers**: waiting on third-party, account access, API approval\n- **Decision blockers**: choices that need to be made before work can continue\n\n### Section E: Open Decisions\nQuestions or choices that haven't been resolved yet. **ASK the user** about any you find:\n- Architecture or technology choices still open\n- Scope decisions (what's in v1 vs deferred)\n- Prioritization questions\n- Trade-offs that need a human call\n\n### Section F: Go-Live Readiness\nAssess each area \u2014 mark as Ready, Partial, Not Started, or N/A:\n- [ ] Core features functional\n- [ ] Error handling and edge cases\n- [ ] Security review (auth, input validation, secrets management)\n- [ ] Performance acceptable (or: performance testing not done)\n- [ ] Functional testing sufficient (state coverage level and any known gaps)\n- [ ] Documentation (user-facing: README, API docs, guides)\n- [ ] Deployment pipeline (CI/CD, hosting, domain, SSL)\n- [ ] Monitoring and logging\n- [ ] Data migration / seed data\n- [ ] Legal (privacy policy, terms, licenses, compliance)\n\n### Section G: Testing Status\n- **Functional tests**: What exists? What's the coverage? Any known failing tests?\n- **Performance tests**: Have they been run? Any issues found? Any remediation done?\n- **Integration tests**: Do external services / APIs work end-to-end?\n- **Known defects**: List any open bugs with severity (critical/major/minor)\n- **Defect remediation**: Any bugs that were found and fixed recently?\n\n### Section H: Roadmap Changes\n- Has the plan changed since the last status update?\n- Any new work discovered during development?\n- Any scope added or removed?\n- What's the recommended next priority?\n\n## Step 3: Ask the user about gaps\n\nBefore writing the memory, present your findings and explicitly ask about anything you couldn't determine:\n\n> \"I've analyzed the codebase and filled in what I can. I need your input on these items before I can write the status:\n> 1. [specific question]\n> 2. [specific question]\n> ...\"\n\nIf the user says \"skip\" or \"not applicable\" for a section, mark it as \"N/A \u2014 skipped by owner\" in the status.\n\n## Step 4: Write the status memory\n\nOnce all sections are addressed, call gnosys_add_structured with:\n\n- **title**: \"[Project Name] status as of [YYYY-MM-DD] \u2014 [one-line summary]\"\n- **category**: \"landscape\"\n- **tags**: { \"type\": [\"status\", \"milestone\"], \"concern\": [\"release\"] }\n- **relevance**: \"[project-name] status complete shipped ready go-live production blockers testing\"\n- **author**: \"human+ai\"\n- **authority**: \"observed\"\n- **confidence**: 0.95\n- **projectRoot**: \"[the project's working directory]\"\n\nThe content MUST use these exact heading formats (the dashboard parser depends on them):\n\n```markdown\n# [Project Name] Status \u2014 [YYYY-MM-DD]\n\n## What's Complete\n- [from Section A]\n\n## What's NOT Done\n- [from Section B]\n\n## Waiting on Human\n- [from Section C \u2014 manual steps, accounts, approvals]\n\n## Blockers\n- [from Section D \u2014 categorized as Technical / External / Decision]\n\n## Open Decisions\n- [from Section E]\n\n## Go-Live Readiness\n- [from Section F \u2014 checklist with status per area]\n\n## Testing Status\n- [from Section G \u2014 functional, performance, integration, defects]\n\n## Roadmap Changes\n- [from Section H \u2014 plan changes, new work, next priority]\n```\n\nIMPORTANT: Be specific enough that someone reading the dashboard can take action immediately. \"Needs testing\" is useless \u2014 \"No load tests run; API response times unknown under concurrent usage\" is actionable.";
 /** Generate the status update prompt pre-filled for a specific project */
 export declare function generateStatusPrompt(projectName: string, projectRoot: string): string;
-//# sourceMappingURL=portfolio.d.ts.map

package/dist/lib/portfolio.js

@@ -600,4 +600,3 @@ export function generateStatusPrompt(projectName, projectRoot) {
         .replace(/\[the project's working directory\]/g, projectRoot)
         .replace(/\[one-line summary\]/g, "[fill in based on analysis]");
 }
-//# sourceMappingURL=portfolio.js.map

package/dist/lib/portfolioHtml.d.ts

@@ -4,6 +4,5 @@
  * Blockers-first, production-readiness-focused dashboard.
  * Self-contained HTML with embedded data and styling.
  */
-import { PortfolioReport } from "./portfolio.js";
+import { type PortfolioReport } from "./portfolio.js";
 export declare function generatePortfolioHtml(report: PortfolioReport, outputPath?: string): string;
-//# sourceMappingURL=portfolioHtml.d.ts.map

package/dist/lib/portfolioHtml.js

@@ -534,4 +534,3 @@ document.querySelectorAll('.project-card.has-blockers').forEach(c=>c.classList.a
 </body>
 </html>`;
 }
-//# sourceMappingURL=portfolioHtml.js.map

package/dist/lib/preferences.d.ts

@@ -9,7 +9,7 @@
  * and a `value` (stored in content). They're searchable, decayable,
  * and versioned just like any other memory.
  */
-import { GnosysDB } from "./db.js";
+import { type GnosysDB } from "./db.js";
 export interface Preference {
     key: string;
     value: string;
@@ -21,6 +21,11 @@ export interface Preference {
 }
 /** Well-known preference keys used by the rules generator */
 export declare const KNOWN_PREFERENCE_KEYS: readonly ["commit-convention", "code-style", "llm-provider", "agent-behavior", "testing-approach", "documentation-style", "naming-convention", "error-handling", "review-process", "deploy-workflow"];
+/**
+ * Suggest the closest known preference key for a likely typo, or null.
+ * Returns null for exact known keys and for far custom keys (distance > 3).
+ */
+export declare function suggestPreferenceKey(input: string): string | null;
 /**
  * Set a user preference. Creates or updates a memory in the central DB
  * with scope='user' and category='preferences'.
@@ -46,4 +51,3 @@ export declare function deletePreference(db: GnosysDB, key: string): boolean;
  * Search preferences by keyword.
  */
 export declare function searchPreferences(db: GnosysDB, query: string): Preference[];
-//# sourceMappingURL=preferences.d.ts.map

package/dist/lib/preferences.js

@@ -10,6 +10,7 @@
  * and versioned just like any other memory.
  */
 import { fnv1a } from "./db.js";
+import { levenshtein } from "./setup/configSetRender.js";
 /** Well-known preference keys used by the rules generator */
 export const KNOWN_PREFERENCE_KEYS = [
     "commit-convention",
@@ -23,6 +24,24 @@ export const KNOWN_PREFERENCE_KEYS = [
     "review-process",
     "deploy-workflow",
 ];
+/**
+ * Suggest the closest known preference key for a likely typo, or null.
+ * Returns null for exact known keys and for far custom keys (distance > 3).
+ */
+export function suggestPreferenceKey(input) {
+    if (KNOWN_PREFERENCE_KEYS.includes(input))
+        return null;
+    let best = null;
+    let bestDist = Infinity;
+    for (const candidate of KNOWN_PREFERENCE_KEYS) {
+        const d = levenshtein(input, candidate);
+        if (d < bestDist) {
+            bestDist = d;
+            best = candidate;
+        }
+    }
+    return bestDist <= 3 ? best : null;
+}
 // ─── Preference CRUD ────────────────────────────────────────────────────
 /**
  * Set a user preference. Creates or updates a memory in the central DB
@@ -146,4 +165,3 @@ function formatPreferenceTitle(key) {
         .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
         .join(" ");
 }
-//# sourceMappingURL=preferences.js.map