greprag 5.79.0 → 5.82.0

package/dist/commands/persona.js

@@ -38,8 +38,38 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.fitPersonaAnnounce = fitPersonaAnnounce;
 exports.runPersona = runPersona;
 const fs = __importStar(require("fs"));
+const harness_limits_1 = require("../harness-limits");
+/** Last line of defence against a silently half-delivered Persona.
+ *
+ *  `validatePersonaContent` rejects an oversize persona at set time, but rows
+ *  written before that check existed are still in the table and the column has no
+ *  DB constraint — so a rendered announce can still arrive over the cap. The
+ *  harness's own handling is the failure this ADR exists to end: it keeps the
+ *  first 2KB, drops the rest, and says nothing.
+ *
+ *  So the hook cuts it deliberately and SAYS SO. A session that knows its
+ *  speaking rules are incomplete, and where to read the rest, is strictly better
+ *  off than one silently obeying half of them — and better off than one given
+ *  nothing, since a truncated persona still carries whatever the operator put
+ *  first. adr: adr/persona.md */
+function fitPersonaAnnounce(announce, cap = harness_limits_1.ANNOUNCE_HARNESS_CAP) {
+    if (Buffer.byteLength(announce, 'utf8') <= cap)
+        return announce;
+    const notice = '\n[/Persona]\n[greprag: persona TRUNCATED — the stored persona is larger than the '
+        + `${cap} bytes this harness inlines per hook, so the rules above are INCOMPLETE. `
+        + 'Read the whole thing with `greprag persona show`.]';
+    const room = cap - Buffer.byteLength(notice, 'utf8');
+    // Slicing bytes can land mid-codepoint; a trailing U+FFFD is the evidence.
+    let body = Buffer.from(announce, 'utf8').subarray(0, room).toString('utf8').replace(/�+$/, '');
+    // Prefer a whole-line cut, but never throw away most of the persona to get one.
+    const nl = body.lastIndexOf('\n');
+    if (nl > room * 0.5)
+        body = body.slice(0, nl);
+    return body + notice;
+}
 function getConfig() {
     return {
         apiUrl: process.env.GREPRAG_API_URL || 'https://api.greprag.com',
@@ -161,9 +191,29 @@ async function show() {
     }
     const source = p.mode === 'template' ? `template ${p.templateId}` : 'custom';
     console.log(`Persona (${source})`);
+    const warning = deliveryWarning(data.announce);
+    if (warning)
+        console.log(warning);
     console.log('');
     console.log(p.content || '');
 }
+/** Say plainly when what is STORED is bigger than what is DELIVERED.
+ *
+ *  The server returns the rendered announce — content plus its provenance
+ *  envelope — and that is the string the harness caps. A row written before the
+ *  set-time limit existed can still be over it, and until now `show` printed it
+ *  in full as if all of it reached a session. adr: adr/persona.md */
+function deliveryWarning(announce) {
+    if (typeof announce !== 'string' || !announce)
+        return null;
+    const bytes = Buffer.byteLength(announce, 'utf8');
+    if (bytes <= harness_limits_1.ANNOUNCE_HARNESS_CAP)
+        return null;
+    return `⚠ OVER THE DELIVERY LIMIT — this persona renders to ${bytes} bytes, but the harness `
+        + `inlines only ${harness_limits_1.ANNOUNCE_HARNESS_CAP} per hook. About ${bytes - harness_limits_1.ANNOUNCE_HARNESS_CAP} bytes `
+        + 'never reach a session; what does arrive is marked as truncated. Shorten it with '
+        + '`greprag persona set`.';
+}
 async function clear() {
     const { ok, status, data } = await api('DELETE', '/v1/persona');
     if (!ok)

package/dist/commands/procedure.js

@@ -7,6 +7,8 @@
  *    show <verb>              — print one procedure + effective runtime behavior
  *    seed [--git]             — write the git-ecosystem seed set (commit/merge/push/deploy/release)
  *    register --verb V --steps "..." [--caveats "..."] [--endpoint "..."] [--trigger T ...] [--destructive]
+ *                             — non-lifecycle verbs only; a lifecycle verb is refused, never
+ *                               half-written (the seed refresh would reclaim the row on read)
  *    rm <verb>                — remove a procedure
  *    match "<text>"           — dry-run: effective prompt-boundary behavior
  *
@@ -19,7 +21,9 @@ exports.runProcedure = runProcedure;
 const procedure_1 = require("../procedure");
 const procedure_run_1 = require("../procedure-run");
 const procedure_runtime_1 = require("../procedure-runtime");
+const delivery_lifecycle_1 = require("../delivery-lifecycle");
 const project_anchor_1 = require("../project-anchor");
+const procedure_enabled_1 = require("../procedure-enabled");
 function getFlag(args, flag) {
     const idx = args.indexOf(flag);
     if (idx === -1 || idx + 1 >= args.length)
@@ -64,6 +68,11 @@ function runtimeState(proc, install) {
     return (0, procedure_runtime_1.procedureRuntimeState)(install.state, proc);
 }
 function printRuntimeDisposition(proc, install) {
+    // adr: adr/procedure-system-off.md
+    if (!procedure_enabled_1.PROCEDURE_SYSTEM_ENABLED) {
+        console.log('Inert. The Procedure System is off, so the prompt boundary injects nothing for any verb.');
+        return true;
+    }
     const state = runtimeState(proc, install);
     if (state === 'active')
         return false;
@@ -108,6 +117,17 @@ function printInstall(proc, install) {
     if (install.ratifiedAt)
         console.log(`  ratified:   ${install.ratifiedAt} (${install.ratifiedBy || 'operator'})`);
 }
+/** Did the store honour exactly what `register` asked for? Compares only the
+ *  register-owned fields (the store stamps `updatedAt` of its own accord).
+ *  The invariant: the CLI never reports a write it will not honour. */
+function storedMatchesRegistration(stored, asked) {
+    return stored.steps === asked.steps
+        && (stored.caveats ?? '') === (asked.caveats ?? '')
+        && (stored.endpoint ?? '') === (asked.endpoint ?? '')
+        && stored.status === asked.status
+        && !!stored.destructive === !!asked.destructive
+        && JSON.stringify(stored.triggers) === JSON.stringify(asked.triggers);
+}
 function installForState(proc, current, state, settings = current.settings) {
     const now = new Date().toISOString();
     return {
@@ -121,6 +141,8 @@ function installForState(proc, current, state, settings = current.settings) {
     };
 }
 async function runProcedure(args) {
+    if (!procedure_enabled_1.PROCEDURE_SYSTEM_ENABLED)
+        console.log(procedure_enabled_1.PROCEDURE_SYSTEM_OFF_NOTE + '\n');
     const sub = args[0];
     const rest = args.slice(1);
     const { projectId, projectName } = resolveProjectId();
@@ -390,13 +412,16 @@ async function runProcedure(args) {
             // --git is the only seed set today; default to it so bare `seed` works.
             const store = (0, procedure_1.readProcedureStore)(projectId);
             let next = store;
-            for (const p of procedure_1.GIT_SEED_SET) {
+            const seeds = procedure_1.GIT_SEED_SET;
+            for (const p of seeds) {
                 next = (0, procedure_1.upsertProcedure)(next, p, /* force */ true);
             }
             (0, procedure_1.writeProcedureStore)(projectId, next);
-            console.log(`Seeded ${procedure_1.GIT_SEED_SET.length} git-ecosystem procedures for ${projectName}:`);
-            for (const p of procedure_1.GIT_SEED_SET)
-                console.log(`  • ${p.verb}${p.destructive ? ' (destructive — seed-only)' : ''}`);
+            console.log(`Seeded ${seeds.length} git-ecosystem procedures for ${projectName}:`);
+            for (const p of seeds) {
+                const note = p.destructive ? ' (destructive — seed-only)' : '';
+                console.log(`  • ${p.verb}${note}`);
+            }
             console.log(`\n  store: ${(0, procedure_1.procedureStorePath)(projectId)}`);
             return;
         }
@@ -407,6 +432,39 @@ async function runProcedure(args) {
                 console.error('Usage: greprag procedure register --verb <v> --steps "<...>" [--caveats "<...>"] [--endpoint "<...>"] [--trigger <t> ...] [--destructive]');
                 process.exit(1);
             }
+            // A delivery-owned verb cannot carry a recipe. Its text belongs to the
+            // repo's Delivery Profile document, and a copy here forks from that
+            // document the moment the document is corrected — with nothing to surface
+            // the divergence. The bundled definition reclaims the row on the next read
+            // either way, so refuse the write rather than confirm one that will not
+            // survive. adr: adr/delivery-owned-procedures.md
+            if ((0, delivery_lifecycle_1.isDeliveryOwnedVerb)(verb)) {
+                const lifecycle = (0, delivery_lifecycle_1.isDeliveryLifecycleVerb)(verb);
+                console.error(`Refusing to register "${verb}" — nothing was written.`);
+                if (lifecycle) {
+                    console.error(`  The lifecycle verbs (${delivery_lifecycle_1.DELIVERY_LIFECYCLE_VERBS.join(', ')}) are vocabulary-only during the`);
+                    console.error('  announce-first Delivery System pilot. Procedure records shadow evidence for them and');
+                    console.error('  never injects steps, and the bundled seed definition reclaims the row on the next read.');
+                }
+                else {
+                    console.error(`  "${verb}" is delivery-owned: its recipe is a section of this repo's Delivery Profile`);
+                    console.error('  document, and Procedure injects a live pointer to that section rather than a copy.');
+                    console.error('  Correcting the document is what changes what a session is told — there is no');
+                    console.error('  registered text to keep in sync, which is exactly why this write is refused.');
+                }
+                console.error(`  Put the ${verb} recipe in this repo's Delivery Profile document instead:`);
+                console.error('    greprag delivery resolve            # names the profile + its documents');
+                console.error('  See docs/procedure-system.md (Seeding) and docs/delivery-profiles.md.');
+                process.exit(1);
+            }
+            // Every other verb: the system is off, so a registered recipe would never
+            // reach a session, and the CLI never reports a write it will not honour.
+            // adr: adr/procedure-system-off.md
+            if (!procedure_enabled_1.PROCEDURE_SYSTEM_ENABLED) {
+                console.error(`Refusing to register "${verb}" — nothing was written.`);
+                console.error(`  ${procedure_enabled_1.PROCEDURE_SYSTEM_OFF_NOTE}`);
+                process.exit(1);
+            }
             const triggers = collectFlags(rest, '--trigger');
             const proc = {
                 verb,
@@ -419,8 +477,21 @@ async function runProcedure(args) {
             };
             const store = (0, procedure_1.readProcedureStore)(projectId);
             (0, procedure_1.writeProcedureStore)(projectId, (0, procedure_1.upsertProcedure)(store, proc, /* force */ true));
+            // Report the STORED row, never the in-memory candidate. Echoing the
+            // candidate is what let a discarded write look like a success.
+            const after = (0, procedure_1.readProcedureStore)(projectId);
+            const stored = after.procedures.find(p => p.verb === verb);
+            if (!stored || !storedMatchesRegistration(stored, proc)) {
+                console.error(`Registered "${verb}" did not survive the store round-trip — the definition was NOT honoured.`);
+                if (stored) {
+                    console.error('  the store now holds:');
+                    printProcedure(stored, after);
+                }
+                console.error(`  store: ${(0, procedure_1.procedureStorePath)(projectId)}`);
+                process.exit(1);
+            }
             console.log(`Registered procedure "${verb}" for ${projectName}.`);
-            printProcedure(proc);
+            printProcedure(stored, after);
             return;
         }
         case 'rm': {
@@ -476,7 +547,7 @@ async function runProcedure(args) {
             console.log('  run-status <id>       show latest run + evidence');
             console.log('  complete <id> <outcome> close the current run');
             console.log('  seed --git           write the git-ecosystem seed set');
-            console.log('  register --verb ...  hand-roll a procedure');
+            console.log('  register --verb ...  hand-roll a procedure (lifecycle verbs are refused — see the Delivery Profile)');
             console.log('  rm <verb>            remove a procedure');
             console.log('  match "<text>"       dry-run effective prompt-boundary behavior');
             return;

package/dist/commands/reminder-registry.js

@@ -5,10 +5,12 @@
  *  PURE over ReminderEnv — the hook assembles env (i/o) and emits the returned lines;
  *  a broken module never blocks a turn (fail-open per module). */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.compactReannounceModules = exports.commandModules = exports.promptModules = exports.harnessModules = exports.REGISTRY = void 0;
+exports.ANNOUNCE_POINTER_RESERVE = exports.ANNOUNCE_HARNESS_CAP = exports.ANNOUNCE_INLINE_BUDGET = exports.compactReannounceModules = exports.commandModules = exports.promptModules = exports.harnessModules = exports.REGISTRY = void 0;
 exports.collectReminders = collectReminders;
 exports.bootOrder = bootOrder;
 exports.collectAnnounces = collectAnnounces;
+exports.collectAnnounceBlocks = collectAnnounceBlocks;
+exports.fitAnnounceBudget = fitAnnounceBudget;
 const os_primer_reminder_1 = require("./os-primer-reminder");
 const inbox_primer_reminder_1 = require("./inbox-primer-reminder");
 const load_primer_reminder_1 = require("./load-primer-reminder");
@@ -16,7 +18,6 @@ const email_primer_reminder_1 = require("./email-primer-reminder");
 const corpus_reminder_1 = require("./corpus-reminder");
 const doc_pointer_reminder_1 = require("./doc-pointer-reminder");
 const setup_reminder_1 = require("./setup-reminder");
-const assistant_reminder_1 = require("./assistant-reminder");
 const memory_reflex_1 = require("./memory-reflex");
 const arm_reminder_1 = require("./arm-reminder");
 const friction_reminder_1 = require("./friction-reminder");
@@ -28,6 +29,7 @@ const procedure_reminder_1 = require("./procedure-reminder");
 const loadout_reminder_1 = require("./loadout-reminder");
 const delivery_reminder_1 = require("./delivery-reminder");
 const persona_reminder_1 = require("./persona-reminder");
+const parity_reminder_1 = require("./parity-reminder");
 /** Registry order = display order. THE single agent-facing announce/reminder assembly:
  *  the hook does I/O → fills ReminderEnv → collectAnnounces (SessionStart) / collectReminders
  *  (per turn) render every module here in this order. A module may own either surface or both;
@@ -47,11 +49,11 @@ exports.REGISTRY = [
     procedure_reminder_1.procedureAnnounceModule, // active project procedures, rendered generically from operator-owned installs
     delivery_reminder_1.deliveryControlModule, // repo-scoped announce-first Delivery System pilot (all harnesses)
     persona_reminder_1.personaAnnounceModule, // tenant-scoped Persona, shared across projects/harnesses
+    parity_reminder_1.parityPendingModule, // what THIS harness still owes when another one advanced
     loadout_reminder_1.loadoutRegistrarModule, // equipped loadouts: one advisor announce each + per-turn keyword Match (docs/loadout.md)
     setup_reminder_1.setupWarningModule,
     version_reminder_1.versionUpgradeModule, // Deficiency-gated announce — silent unless a newer release exists
     enrichment_health_reminder_1.enrichmentHealthModule, // Deficiency-gated announce — silent unless the Gemini probe fails (fix c2eb8777)
-    assistant_reminder_1.assistantDoctrineModule,
     memory_reflex_1.memoryPrimerModule,
     arm_reminder_1.watcherArmModule,
     friction_reminder_1.mechanicFrictionModule,
@@ -147,3 +149,105 @@ function collectAnnounces(env, registry = exports.REGISTRY) {
     }
     return out;
 }
+/** Same as collectAnnounces, but keeps each block paired with the module that
+ *  produced it so the budget fitter can rank and name them.
+ *  adr: adr/announce-inline-budget.md */
+function collectAnnounceBlocks(env, registry = exports.REGISTRY) {
+    const out = [];
+    for (const m of bootOrder(registry)) {
+        let a = null;
+        try {
+            a = m.announce(env);
+        }
+        catch {
+            continue;
+        }
+        if (a)
+            out.push({ id: m.id, text: a });
+    }
+    return out;
+}
+/** Bytes of SessionStart context a harness will actually inline. MEASURED, not
+ *  guessed: Claude Code wraps any hook output over 2048 bytes in
+ *  `<persisted-output>`, spills the full text to a tool-results file, and injects
+ *  only "Preview (first 2KB)". This is true of BOTH raw stdout and the
+ *  `additionalContext` envelope — the cap is on inline context, not the channel.
+ *  Measured 2026-09-03 with an 80-marker ruler: markers 250..2000 arrived, 2250
+ *  and beyond did not. 1800 leaves headroom for the harness's own wrapper text.
+ *  adr: adr/announce-inline-budget.md */
+exports.ANNOUNCE_INLINE_BUDGET = 1650;
+/** The harness's hard ceiling. Past this, output is replaced by a 2KB preview and
+ *  a `<persisted-output>` file reference. ANNOUNCE_INLINE_BUDGET must stay under
+ *  it with room for the trailing memory-recap pointer.
+ *
+ *  Re-exported, not redeclared: the number now has one owner in
+ *  `@greprag/core`'s `harness-limits`, mirrored into the CLI at
+ *  `src/harness-limits.ts`. The server derives the Persona content limit from
+ *  the same value, and a second literal is how `PERSONA_MAX_CHARS = 12_000`
+ *  became a limit that governed nothing. */
+var harness_limits_1 = require("../harness-limits");
+Object.defineProperty(exports, "ANNOUNCE_HARNESS_CAP", { enumerable: true, get: function () { return harness_limits_1.ANNOUNCE_HARNESS_CAP; } });
+/** Bytes the overflow pointer line costs, reserved before fitting so adding it can
+ *  never be what pushes the payload over the cap. Declared here beside the budget
+ *  because the `mustInline` guard has to charge a module the same reserve the hook
+ *  does — a module sized against the raw budget would still be dropped in the field.
+ *  adr: adr/announce-inline-budget.md */
+exports.ANNOUNCE_POINTER_RESERVE = 220;
+/** Inline-worthiness ranking, most-keepable first. The rule: a block earns inline
+ *  space when it is SHORT, SESSION-SPECIFIC, and available nowhere else. A block
+ *  that is long, static, and already loadable on demand does not — it is exactly
+ *  what `greprag load` exists for. Anything unlisted sorts last.
+ *
+ *  Persona leads because it is 523 bytes of tenant-set speaking instructions that
+ *  no other surface carries. The grepragOS laws are deliberately NOT here: 1753
+ *  bytes of static doctrine that `greprag load os` already serves on demand, which
+ *  until now consumed the entire budget and starved everything behind it. */
+const ANNOUNCE_PRIORITY = [
+    'persona-announce',
+    // Work this harness owes. Deficiency-gated, so it is silent almost always — and
+    // when it does fire it is the most actionable thing in the announce.
+    'parity-pending',
+    'setup-warning',
+    'version-upgrade',
+    'enrichment-health',
+    'watcher-arm',
+    'skill-mirror-announce',
+    'delivery-control',
+    'doc-pointer-announce',
+];
+function announceRank(id) {
+    const i = ANNOUNCE_PRIORITY.indexOf(id);
+    return i === -1 ? ANNOUNCE_PRIORITY.length : i;
+}
+/** Fit the announce into the harness's inline budget.
+ *
+ *  Returns the blocks that fit (restored to boot order, so a primer still precedes
+ *  anything that depends on it) plus the ids that did not. The caller is expected
+ *  to persist the FULL text and give the agent a way to read it — dropping content
+ *  silently is the failure this whole mechanism exists to end.
+ *
+ *  A single block larger than the budget is never emitted; it would blow the cap
+ *  on its own and take everything after it down too. */
+function fitAnnounceBudget(blocks, budget = exports.ANNOUNCE_INLINE_BUDGET, reserve = 0) {
+    const order = new Map(blocks.map((b, i) => [b.id, i]));
+    const ranked = [...blocks].sort((a, b) => {
+        const d = announceRank(a.id) - announceRank(b.id);
+        return d !== 0 ? d : (order.get(a.id) - order.get(b.id));
+    });
+    const kept = [];
+    const droppedIds = [];
+    let used = reserve;
+    const SEP = 2; // the '\n\n' join between blocks
+    for (const b of ranked) {
+        const cost = b.text.length + (kept.length ? SEP : 0);
+        if (used + cost <= budget) {
+            kept.push(b);
+            used += cost;
+        }
+        else {
+            droppedIds.push(b.id);
+        }
+    }
+    kept.sort((a, b) => order.get(a.id) - order.get(b.id));
+    return { kept, droppedIds };
+}