imprnt 0.1.3-edge.13 → 0.1.3-edge.48

package/CLAUDE.md

@@ -131,7 +131,7 @@ The discipline that keeps the list lean moved **off the write path** to a non-bl
 
 ## The two robot commands (explicit, never a daemon)
 
-imprnt keeps exactly two "robot" helpers stolen from the system it replaces, and both are **commands you run**, never background hooks. The auto-magic is what made that system bill rent.
+imprnt keeps exactly two "robot" helpers, carried over from PAI (the system imprnt grew out of), and both are **commands you run**, never background hooks. Always-on auto-magic is the cost pattern this avoids: machinery you pay for in every session whether you use it or not.
 
 - **`imprnt check`** - integrity + regenerate. Flags orphan `[[links]]`, notes that resolve no entity, **untagged notes** (empty `tags:`, the topic axis is blank), unclassified snapshots, and near-duplicate tags. Rebuilds `index.md` deterministically from every note's `summary` + tags + links, and **syncs new tags into `_tags.md`** (the auto-growing vocabulary). Run it after an ingest or any hand-edit. Writes only the three non-note control files (`index.md`, `_tags.md`, and `_needs-review.md`, where it regenerates only its own delimited section), never mutates a note. (The dedup audit catches *spelling*-near tags only. *Semantic* synonyms like `clothing`/`wardrobe` are the LLM's call at write time + a `_tags.md` synonym entry. Code never merges meaning.)
 - **harvest** - the conversation→vault bridge: at the end of a chat, you ask the assistant to harvest the session ("harvest this", "wrap it up") and it hands the durable learnings to `imprnt ingest`, so a decision made in conversation becomes a filed note. Conscious, on demand, never automatic.
@@ -158,7 +158,7 @@ A migration is the one-time bulk WRITE: snapshot every chosen source into `raw/<
 
 ## Plugins (opt-in add-ons) - the contract
 
-Core is the vault + `ingest → recall → check`. Everything else (a task-mirror sync, a documents librarian, an anti-slop behavior ruleset, graph lint, the guard) is a **pluggable plugin**. Full contract + the worked instances: `plugins/README.md`. The standing rules:
+Core is the vault + `ingest → recall → check`. Everything else (a task-mirror sync, a documents librarian, an anti-slop behavior ruleset, graph lint, a local snapshot safety net) is a **pluggable plugin**. Full contract + the worked instances: `plugins/README.md`. The standing rules:
 
 - **The one rule:** core never knows a plugin exists. Litmus: **you can add or remove any plugin with zero edits to `packages/imprnt/`.** A plugin depends on exactly two things: `vault/` notes (+ their frontmatter *format*) and its own sibling folder. Nothing else. Not core code, not another plugin, not another plugin's folder/labels.
 - **Entry point = the agent fragment.** Each plugin ships `plugins/<name>/agent.md`, a fixed-size fragment that tells the *agent* (never the core code) what the plugin is, where its data/mirror/join-table lives, its commands, and any always-on rules. Install = add one `@plugins/<name>/agent.md` import line to **`CLAUDE.local.md`** (gitignored, per-machine, auto-loaded after this contract). Never wire plugins into this committed file. Remove = delete that line + `rm -rf plugins/<name>`.
@@ -166,7 +166,8 @@ Core is the vault + `ingest → recall → check`. Everything else (a task-mirro
 - **Write** single-writer-per-path: a plugin writes only its own folder and **proposes** vault-note changes for `ingest`/you to apply. It never mutates a note. Frontmatter labels are **slug-namespaced** (`whenful.synced`), read-your-own-only. Core ignores unknown keys.
 - **`recall` searches `vault/` only, forever.** Sibling dirs + `raw/` are outside the corpus by construction. A plugin surfaces into search only by **proposing one low-frequency summary note** (the escape hatch).
 - **Behavior plugins** are a separate class: ship a fixed-size fragment the **user wires into the agent's system prompt**. The vault never auto-injects. Remove = delete the wire-in. No referee for conflicting fragments, the user owns composition. (The old system imposed. imprnt composes.)
-- **Harness plugins** are the third class: they customize Claude Code itself, never the vault (guard's PreToolUse hook, the statusline, a skill). The same plugin folder doubles as a **native Claude Code plugin** (`.claude-plugin/plugin.json` + `hooks/` + `skills/`, Anthropic's format) and/or carries **`imp-settings.json`** (the settings keys Claude only takes via config, e.g. `statusLine`, with `${PLUGIN_DIR}` as the plugin's absolute dir). `imp` carries enabled ones into every session it launches: one `--plugin-dir` per native plugin + one merged `--settings`. Stock `claude` stays stock, nothing is ever written to settings files, `plugin rm` undoes everything.
+- **Harness plugins** are the third class: they customize Claude Code itself, never the vault (timemachine's PreToolUse snapshot hook, the statusline, a skill). The same plugin folder doubles as a **native Claude Code plugin** (`.claude-plugin/plugin.json` + `hooks/` + `skills/`, Anthropic's format) and/or carries **`imp-settings.json`** (the settings keys Claude only takes via config, e.g. `statusLine`, with `${PLUGIN_DIR}` as the plugin's absolute dir). `imp` carries enabled ones into every session it launches: one `--plugin-dir` per native plugin + one merged `--settings`. Stock `claude` stays stock, nothing is ever written to settings files, `plugin rm` undoes everything.
+- **Capability modules** are the one bend in "share nothing": a module may *provide* a capability another *consumes* (the session-host brokers an authed-session token to the kleinanzeigen watcher). Bounded so it can't re-bloat core: the consumer copies a tiny client (`sessionToken(site) -> string | null`) over a **localhost broker**, never imports the provider or reads its folder. The invariant that replaces "no cross-plugin reads": **removing a provider degrades a consumer gracefully** (`null` = host down, fall back), never breaks it. This is a third contact surface (vault . agent-context . broker), fenced like the sync edge: deterministic, answer-on-request, auditable (token fingerprint, never the token), never resident. The litmus extends: zero core edits to add/remove a *provider* too, because there is no capability registry in core. Credential-holding modules follow the auth finding: human login once, read-only attach, never copy a profile, never automate the password. Full rules: `plugins/README.md`.
 - **Secrets are env vars at the plugin's edge.** A plugin calling an external service reads its key from an env var named in its README and fails loud when missing. Keys never land in the vault, the plugin folder, or anything committed. No central secret store.
 - **Commands only, no forced daemon.** The user schedules sync. Install/remove is manual (README `## Install` / `## Remove` + `rm -rf`), no registry.
 - **Core ↔ plugin contact = exactly three convention-based aggregators**, all dumb and uniform: `imprnt check --all` globs `plugins/*/check.js` (each plugin's built artifact), runs each with `node`, reads **exit code only**, forwards stdout verbatim, never parses plugin output. `imprnt ingest --apply` files staged notes the plugins drop in `plugins/*/proposed/`. `imp` turns the enable list into launch flags (`--plugin-dir` per native plugin + one merged `--settings`) for the session it spawns. All discover by filename/dir convention, never by import, never by naming a specific plugin. Fence: core may provide read-only *aggregation* helpers, never write/orchestration. (Not k8s liveness/readiness. Nothing runs, so the only health question is "is the data sound", which is what `check` answers.)

package/README.md

@@ -59,6 +59,20 @@ assistant cheap, honest, and yours:
 - **Yours, in the strongest sense.** Plain text on your disk. It opens in any editor, graphs in
   [Obsidian](https://obsidian.md), and cannot 404, bloat, or hold your context hostage.
 
+## The robot does the work. You stay the boss.
+
+The current crop of AI tools wants the wheel. Resident agents (OpenClaw and friends) read your
+inbox and act on your behalf. Auto-schedulers rearrange your calendar while you sleep. imprnt
+takes the other side, the same side its sibling [Whenful](https://whenful.com) takes against
+auto-planners like Motion. The rule, in full:
+
+> The model never takes an action you didn't approve.
+
+In practice: plain code does every read, so it's cheap, auditable, and immune to prompt injection
+hiding in your data. The model writes and drafts where judgment pays. And anything that touches
+the world - filing a note, sending a reply - ends with you pressing the button. A watcher built
+on imprnt can triage a hostile inbox all day for free. The send button stays human.
+
 ## Start in two minutes
 
 ```sh
@@ -112,7 +126,9 @@ asking ("add the anti-slop plugin"), each a separate `imprnt-plugin-*` package:
 | `imprnt-plugin-character` | A voice and standards to write in. "Scribe" is the default you copy and personalize. |
 | `imprnt-plugin-anti-slop` | Rules that keep its prose from reading like AI. |
 | `imprnt-plugin-whenful` | A local mirror of your [Whenful](https://whenful.com) tasks, shown inline at read. |
-| `imprnt-plugin-guard` | A hook that blocks dangerous shell commands before they run. |
+| `imprnt-plugin-kleinanzeigen` | A watcher for your Kleinanzeigen inbox: regex triage of buyer messages, drafts, a phone digest. You press send. |
+| `imprnt-plugin-session-host` | A warm browser holding your logged-in sessions, providing the authed-session capability. You enroll each site once. |
+| `imprnt-plugin-timemachine` | Snapshots your work before each change so you can recover what the agent breaks. |
 | `imprnt-plugin-statusline` | A customizable status line: model, branch, context, cost, rate limits, clock. |
 | `imprnt-plugin-telegram` | Your vault from your phone: text a bot, the answer comes from your notes. |
 
@@ -146,17 +162,20 @@ assistant that files and recalls for you:
 
 ## Docs
 
-- [`docs/architecture.md`](docs/architecture.md), how the whole thing works, in plain English. Start here.
-- [`docs/design-decisions.md`](docs/design-decisions.md), the durable calls and why they were made.
-- [`docs/releasing.md`](docs/releasing.md), how a change becomes a published package.
+The docs are the website, [imprnt.dev](https://imprnt.dev), built straight from markdown in
+[`site/docs/`](site/docs/) (the single source): getting started, how it works, the model, plugins,
+architecture, design decisions, and contributing. Edit a file there and the site updates on the next
+deploy.
+
 - [`CLAUDE.md`](CLAUDE.md), the contract your assistant reads inside the vault: note formats, conventions.
+- [`plugins/README.md`](plugins/README.md), the plugin contract.
 
 ## Hacking on imprnt
 
 The engine is built with [Bun](https://bun.sh) and [Turborepo](https://turborepo.com) (dev tools
 only, never needed by people who use it through their assistant). Clone, `bun install`,
-`bun run build`, `bun run test`. The architecture and the contributor map are in
-[`docs/architecture.md`](docs/architecture.md).
+`bun run build`, `bun run test`. The architecture and the build-and-release model are in the
+[architecture](https://imprnt.dev/architecture/) and [contributing](https://imprnt.dev/contributing/) docs.
 
 ## License