kushi-agents 4.4.0 → 4.4.3

package/plugin/templates/init/m365-auth.template.json

@@ -15,16 +15,16 @@
       "dataverse": "https://iscrm.crm.dynamics.com"
     },
     "oneNote": {
-      "defaultNotebookName": "",
-      "defaultNotebookId": "",
+      "defaultNotebookName": "__FILL_ME_IN__",
+      "defaultNotebookId": "__FILL_ME_IN__",
       "defaultSectionResolverUrl": "",
       "defaultNotebookRootLink": "",
-      "defaultLinkOwner": ""
+      "defaultLinkOwner": "__FILL_ME_IN__"
     },
     "emailContext": {
       "enabled": true,
       "dateFloor": "",
-      "folders": [],
+      "folders": ["__FILL_ME_IN__"],
       "includeSubfolders": true,
       "sourceCoverageLabel": "",
       "matchingPolicy": {
@@ -56,7 +56,7 @@
     },
     "sharePointContext": {
       "enabled": true,
-      "localProjectsRoot": "",
+      "localProjectsRoot": "__FILL_ME_IN__",
       "matchingPolicy": {
         "mode": "fuzzy-folder-name",
         "rankingOrder": ["exact", "prefix", "contains"],

package/plugin/templates/init/project-integrations.template.yml

@@ -3,8 +3,8 @@
 # AND declares the explicit boundaries inside which Kushi is allowed to query.
 #
 # Connection / auth / field mappings are NOT here — those are global at:
-#   <engagement-root>/.project-evidence/crm/config.yml
-#   <engagement-root>/.project-evidence/ado/config.yml
+#   <workspace>/.kushi/config/shared/integrations.yml
+#   <workspace>/.kushi/config/shared/integrations.yml
 #
 # Boundaries doctrine: see plugin/instructions/scope-boundaries.instructions.md.
 # Required boundary keys MUST be filled or the source is disabled (not silently widened).

package/plugin/templates/snapshot/onenote-page.template.md

@@ -20,7 +20,7 @@ captured_at:   "<ISO-8601 if captured/user-pasted, else empty>"
 - **Capture status:** `<last_status>`
 - **Attempts:** <int>
 - **Last attempt:** <ts>
-- **Source basis:** WorkIQ enumerate + per-page verbatim probe (pull-onenote v2.5.0). Graph `/me/onenote/*` skipped per workspace policy. Per-page retry registry: `.project-evidence/m365/m365-mutable.json#knownSections.<projectKey>.one_pages`.
+- **Source basis:** WorkIQ enumerate + per-page verbatim probe (pull-onenote v2.5.0). Graph `/me/onenote/*` skipped per workspace policy. Per-page retry registry: `.kushi/config/user/m365-mutable.json#knownSections.<projectKey>.one_pages`.
 
 <!-- IF last_status == "captured" or "user-pasted" -->
 
@@ -43,7 +43,7 @@ captured_at:   "<ISO-8601 if captured/user-pasted, else empty>"
 
 ❌ **page-body-unavailable: WorkIQ returned BODY-NOT-EXPOSED on attempt <N>.**
 
-> Per `pull-onenote` v2.5.0 § "Empirical contract": WorkIQ OneNote body retrieval is non-deterministic — the same page may return a body on a later refresh. This page IS registered for retry in `.project-evidence/m365/m365-mutable.json#knownSections.<projectKey>.one_pages` and will be re-attempted on every refresh until `last_status` becomes `captured` or `user-pasted`. Inferring the page contents from adjacent emails or chat traffic is forbidden.
+> Per `pull-onenote` v2.5.0 § "Empirical contract": WorkIQ OneNote body retrieval is non-deterministic — the same page may return a body on a later refresh. This page IS registered for retry in `.kushi/config/user/m365-mutable.json#knownSections.<projectKey>.one_pages` and will be re-attempted on every refresh until `last_status` becomes `captured` or `user-pasted`. Inferring the page contents from adjacent emails or chat traffic is forbidden.
 
 ### next_step
 
@@ -93,5 +93,5 @@ Per `thoroughness-detector.instructions.md`, the writer must tick all that apply
 - [ ] If `last_status == captured` or `user-pasted`: AI Narrative Summary (3+ paragraphs) AND verbatim Body section are present and non-empty
 - [ ] If `last_status == BODY-NOT-EXPOSED`: explicit marker, `next_step` block, and metadata table all present; NO inferred or paraphrased body content
 - [ ] If `last_status == enumeration-only`: explicit transient marker present; NO body content of any kind
-- [ ] Page is registered in `.project-evidence/m365/m365-mutable.json#knownSections.<projectKey>.one_pages` with matching `last_status` and `attempts`
+- [ ] Page is registered in `.kushi/config/user/m365-mutable.json#knownSections.<projectKey>.one_pages` with matching `last_status` and `attempts`
 - [ ] No fabrication: nothing in this file came from adjacent emails, chats, or other sources to "fill in" what WorkIQ did not return

package/src/config-loader.mjs

@@ -1,6 +1,74 @@
 import fs from 'node:fs';
 import path from 'node:path';
 
+/**
+ * Schema-aware required-field map (kushi v4.4.1+).
+ * For each logical config name, list the dot-paths that MUST be populated
+ * (non-empty, non-sentinel) before the config is considered usable.
+ */
+const REQUIRED_FIELDS = {
+  'm365-auth': [
+    'm365Auth.defaultTenantId',
+    'm365Auth.oneNote.defaultNotebookName',
+    'm365Auth.oneNote.defaultNotebookId',
+    'm365Auth.oneNote.defaultLinkOwner',
+    'm365Auth.emailContext.folders',
+    'm365Auth.sharePointContext.localProjectsRoot',
+  ],
+  'project-evidence': [
+    'identity.alias',
+    'identity.email',
+    'engagement_root',
+  ],
+  'integrations': [],
+};
+
+const SENTINELS = [
+  '__FILL_ME_IN__',
+  '<auto>',
+  '<TENANT_ID>',
+  '<NOTEBOOK_ID>',
+  '<NOTEBOOK_NAME>',
+  '<LINK_OWNER>',
+  '<SP_LOCAL_ROOT>',
+  '<your-alias>',
+  '<Your Full Name>',
+  'your.email@example.com',
+];
+
+function isSentinel(v) {
+  if (v === null || v === undefined) return true;
+  if (typeof v !== 'string') return false;
+  if (v.trim() === '') return true;
+  return SENTINELS.some(s => v.includes(s));
+}
+
+function getDotPath(obj, dotPath) {
+  let cur = obj;
+  for (const seg of dotPath.split('.')) {
+    if (cur === null || cur === undefined) return undefined;
+    cur = cur[seg];
+  }
+  return cur;
+}
+
+function checkRequired(name, parsed) {
+  const required = REQUIRED_FIELDS[name] || [];
+  const missing = [];
+  for (const field of required) {
+    const v = getDotPath(parsed, field);
+    if (v === null || v === undefined) { missing.push(field); continue; }
+    if (Array.isArray(v)) {
+      if (v.length === 0 || v.every(x => typeof x === 'string' && isSentinel(x))) {
+        missing.push(field);
+      }
+      continue;
+    }
+    if (typeof v === 'string' && isSentinel(v)) missing.push(field);
+  }
+  return missing;
+}
+
 /**
  * Node-side twin of Get-KushiConfig.ps1.
  *
@@ -44,18 +112,37 @@ export function loadKushiConfig(name, opts = {}) {
   const raw = fs.readFileSync(resolved, 'utf8');
 
   if (!opts.allowPlaceholders) {
-    if (raw.includes('__FILL_ME_IN__') || raw.includes('<auto>')) {
+    if (SENTINELS.some(s => raw.includes(s))) {
       throw new Error(
-        `Kushi config '${resolved}' still has template placeholders. ` +
+        `Kushi config '${resolved}' still has template placeholders ` +
+        `(e.g. __FILL_ME_IN__, <auto>, <TENANT_ID>). ` +
         `Edit it with real values, or pass {allowPlaceholders: true}.`
       );
     }
   }
 
   if (opts.raw) return raw;
-  if (ext === 'json') return JSON.parse(raw);
-  // YAML: return raw — Node has no built-in parser. Caller installs js-yaml if needed.
-  return raw;
+
+  let parsed;
+  if (ext === 'json') {
+    parsed = JSON.parse(raw);
+  } else {
+    // YAML: return raw — Node has no built-in parser. Caller installs js-yaml if needed.
+    return raw;
+  }
+
+  if (!opts.allowPlaceholders) {
+    const missing = checkRequired(name, parsed);
+    if (missing.length > 0) {
+      throw new Error(
+        `Kushi config '${resolved}' is missing required fields:\n` +
+        missing.map(f => `  - ${f}`).join('\n') + '\n' +
+        `Edit it with real values, or pass {allowPlaceholders: true}.`
+      );
+    }
+  }
+
+  return parsed;
 }
 
 function defaultExt(name) {

package/src/main.mjs

@@ -12,7 +12,6 @@ import {
   PLUGIN_SOURCE_DIR,
   PROJECT_MARKERS,
 } from './constants.mjs';
-import { promptForDestination } from './prompt.mjs';
 import { copyAssets } from './copy-assets.mjs';
 import { mergeSettings } from './settings.mjs';
 import { mergeCopilotInstructions } from './copilot-instructions.mjs';
@@ -92,32 +91,7 @@ async function installVscode(options, resolved, version) {
     warnIfNotProjectRoot(projectRoot);
   }
 
-  let dest;
-  if (options.dest) {
-    dest = options.dest.replace(/\\/g, '/');
-    if (path.isAbsolute(dest)) {
-      console.error('\n  Please use a relative path (e.g., .kushi).\n');
-      process.exit(1);
-    }
-    dest = dest.replace(/\/+$/, '');
-    if (!dest) {
-      console.error('\n  Please provide a non-empty destination path.\n');
-      process.exit(1);
-    }
-    const resolvedPath = path.resolve(projectRoot, dest);
-    if (
-      !resolvedPath.startsWith(projectRoot + path.sep) &&
-      resolvedPath !== projectRoot
-    ) {
-      console.error('\n  Destination must be within the current project.\n');
-      process.exit(1);
-    }
-  } else if (options.yes) {
-    dest = DEFAULT_DEST;
-  } else {
-    dest = await promptForDestination(DEFAULT_DEST);
-  }
-
+  const dest = DEFAULT_DEST;
   const fullDest = path.resolve(projectRoot, dest);
   await confirmOverwriteIfExists(fullDest, dest, options.force);
 
@@ -182,9 +156,7 @@ async function installVscode(options, resolved, version) {
  */
 async function installClawpilot(options, resolved, version) {
   const home = os.homedir();
-  const fullDest = options.dest
-    ? path.resolve(options.dest)
-    : path.join(home, ...CLAWPILOT_DEST_SUBPATH.split('/'));
+  const fullDest = path.join(home, ...CLAWPILOT_DEST_SUBPATH.split('/'));
 
   const displayDest = fullDest.startsWith(home + path.sep)
     ? '~' + path.sep + path.relative(home, fullDest)

package/plugin/templates/init/ado-config.template.yml

@@ -1,21 +0,0 @@
-# Azure DevOps connection — per-user filled. Lives at:
-#   <engagement-root>/.project-evidence/ado/config.yml
-# NOT in repo. NOT in `.kushi/`.
-
-tenantId: "72f988bf-86f1-41af-91ab-2d7cd011db47"   # Microsoft tenant
-organization: "https://dev.azure.com/<your-org>"
-defaultProject: "<your-default-ado-project>"
-apiVersion: "7.1"
-
-# ADO scope GUID — fixed across tenants
-azDevOpsResourceId: "499b84ac-1321-427f-aa17-267ca6975798"
-
-# Saved queries / area paths can be overridden per project in
-#   <engagement-root>/<project>/integrations.yml under `ado:`
-defaults:
-  queryId: ""
-  areaPath: ""
-  iterationPath: ""
-
-auth:
-  strategy: "az-cli"

package/plugin/templates/init/crm-config.template.yml

@@ -1,16 +0,0 @@
-# CRM (Dataverse) connection — per-user filled. Lives at:
-#   <engagement-root>/.project-evidence/crm/config.yml
-# NOT in repo. NOT in `.kushi/`.
-
-tenantId: "72f988bf-86f1-41af-91ab-2d7cd011db47"   # Microsoft tenant
-environmentUrl: "https://<your-org>.crm.dynamics.com"
-apiVersion: "9.2"
-
-# Default entity to query. Override per project in
-#   <engagement-root>/<project>/integrations.yml
-defaultEntitySet: "msdyn_engagements"
-
-# Authentication strategy. Currently only "az-cli" supported.
-# kushi will run: az account get-access-token --resource <environmentUrl> --tenant <tenantId>
-auth:
-  strategy: "az-cli"

package/src/prompt.mjs

@@ -1,42 +0,0 @@
-import { createInterface } from 'node:readline/promises';
-import path from 'node:path';
-
-/**
- * Prompt the user for a destination directory.
- * @param {string} defaultDest
- * @returns {Promise<string>}
- */
-export async function promptForDestination(defaultDest) {
-  const { stdin: input, stdout: output } = await import('node:process');
-  const rl = createInterface({ input, output });
-
-  rl.on('close', () => {});
-
-  let dest;
-  try {
-    const answer = await rl.question(
-      `  Where should Kushi assets be installed? (${defaultDest}): `,
-    );
-    dest = answer.trim() || defaultDest;
-  } catch {
-    process.exit(0);
-  } finally {
-    rl.close();
-  }
-
-  return validatePath(dest);
-}
-
-function validatePath(raw) {
-  if (path.isAbsolute(raw)) {
-    console.error('\n  Please use a relative path (e.g., .kushi).\n');
-    process.exit(1);
-  }
-  const resolved = path.resolve(process.cwd(), raw);
-  const root = process.cwd();
-  if (!resolved.startsWith(root + path.sep) && resolved !== root) {
-    console.error('\n  Destination must be within the current project.\n');
-    process.exit(1);
-  }
-  return raw.replace(/\\/g, '/').replace(/\/+$/, '');
-}