kushi-agents 5.7.0 → 5.7.1

package/bin/cli.mjs

@@ -182,10 +182,16 @@ if (args.includes('--help') || args.includes('-h')) {
     --clawpilot       Install to ~/.copilot/m-skills/kushi/
     --vscode          Install to ~/.vscode/chat/skills/kushi/  (a.k.a. GitHub Copilot Chat)
     --all-hosts       Install to BOTH hosts
+    --no-workspace    Skip the auto workspace install (host install only)
     --uninstall [--clawpilot|--vscode|--all]
                       Cleanly remove the kushi install + skills-metadata.json entry
                       from the chosen host(s). Default = all detected hosts.
 
+    Note: when run from inside a project directory (any of: package.json, .git,
+    .kushi/, Evidence/, etc.), host installs ALSO refresh the workspace
+    .kushi/ install in cwd. One command covers both. Pass --no-workspace to
+    suppress, or run from a non-project directory.
+
   Workspace install (legacy / default when no host flag is given):
     --target vscode     Install to <cwd>/.kushi/ + update .vscode/settings.json   [default]
     --target clawpilot  Alias for --clawpilot (kept for back-compat)
@@ -274,6 +280,7 @@ if (wantsVscode || wantsAllHosts || wantsUninstall) {
     all,
     uninstall: wantsUninstall,
     profile: getFlag('--profile'),
+    includeWorkspace: !args.includes('--no-workspace'),
   }).catch((err) => {
     console.error(`\n  ${err.message}\n`);
     process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kushi-agents",
-  "version": "5.7.0",
+  "version": "5.7.1",
   "description": "Install Kushi — multi-source project evidence agent with Comprehensive Structured Capture (CSC) into weekly-only files across Email, Teams, OneNote, Loop, SharePoint, Meetings, CRM, ADO. Meetings retain a sibling verbatim/ audit folder. WorkIQ-only for M365 sources (Graph / m365_* FORBIDDEN as fallbacks; user-paste is first-class). Host-agnostic.",
   "type": "module",
   "bin": {

package/plugin/runners/lib/workiq.mjs

@@ -4,15 +4,45 @@
 import { spawn } from 'node:child_process';
 import { platform } from 'node:os';
 import path from 'node:path';
-import { promises as fs } from 'node:fs';
+import { promises as fs, existsSync } from 'node:fs';
 
 /** Resolve the workiq binary for the current platform. */
 export function resolveWorkiqBin(explicit = process.env.KUSHI_WORKIQ_BIN) {
-  if (explicit) return explicit;
+  if (explicit) {
+    if (path.isAbsolute(explicit)) return explicit;
+    const found = whichSync(explicit);
+    return found || explicit;
+  }
+  // 1. Try PATH first (npm-installed workiq lands in AppData\Roaming\npm).
+  const onPath = whichSync(platform() === 'win32' ? 'workiq.cmd' : 'workiq');
+  if (onPath) return onPath;
+  // 2. Fallback to Clawpilot-managed location.
   if (platform() === 'win32') return path.join(process.env.USERPROFILE || '', '.copilot', 'bin', 'workiq.cmd');
   return path.join(process.env.HOME || '', '.copilot', 'bin', 'workiq');
 }
 
+function whichSync(name) {
+  const PATH = process.env.PATH || process.env.Path || '';
+  const sep = platform() === 'win32' ? ';' : ':';
+  const exts = platform() === 'win32'
+    ? (process.env.PATHEXT || '.COM;.EXE;.BAT;.CMD').split(';')
+    : [''];
+  const hasExt = /\.[a-zA-Z0-9]{1,5}$/.test(name);
+  for (const dir of PATH.split(sep)) {
+    if (!dir) continue;
+    if (hasExt) {
+      const candidate = path.join(dir, name);
+      if (existsSync(candidate)) return candidate;
+      continue;
+    }
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      if (existsSync(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+
 /**
  * Ask WorkIQ a question. Returns the raw stdout text and any parsed CSC blocks.
  *
@@ -86,7 +116,20 @@ async function pathExists(p) { try { await fs.access(p); return true; } catch {
 
 function runProcess(exe, args, { timeoutMs, env }) {
   return new Promise((resolve, reject) => {
-    const child = spawn(exe, args, { env, shell: false });
+    // Node 20.12+ refuses to spawn .cmd/.bat on Windows without shell:true
+    // (CVE-2024-27980). Detect and route through cmd.exe explicitly with
+    // verbatim args so quoting in the prompt survives intact.
+    const isWinShim = platform() === 'win32' && /\.(cmd|bat)$/i.test(exe);
+    const spawnOpts = { env, shell: false };
+    let spawnExe = exe;
+    let spawnArgs = args;
+    if (isWinShim) {
+      const quoted = [exe, ...args].map(quoteForCmd).join(' ');
+      spawnExe = process.env.ComSpec || 'cmd.exe';
+      spawnArgs = ['/d', '/s', '/c', quoted];
+      spawnOpts.windowsVerbatimArguments = true;
+    }
+    const child = spawn(spawnExe, spawnArgs, spawnOpts);
     let stdout = '';
     let stderr = '';
     let timeoutTimer = null;
@@ -102,3 +145,10 @@ function runProcess(exe, args, { timeoutMs, env }) {
     child.on('close', code => { if (timeoutTimer) clearTimeout(timeoutTimer); resolve({ stdout, stderr, exitCode: code ?? 0 }); });
   });
 }
+
+function quoteForCmd(s) {
+  if (s === '' || /[\s"&|<>^()]/.test(s)) {
+    return '"' + String(s).replace(/"/g, '""') + '"';
+  }
+  return String(s);
+}

package/src/main.mjs

@@ -394,7 +394,7 @@ function warnIfNotProjectRoot(projectRoot) {
  * @param {string} dir
  * @returns {{ name: string, kind: 'code'|'engagement', type: 'file'|'dir' } | null}
  */
-function findProjectMarker(dir) {
+export function findProjectMarker(dir) {
   let entries;
   try {
     entries = fs.readdirSync(dir, { withFileTypes: true });

package/src/multi-host.mjs

@@ -37,6 +37,7 @@ import {
 import { copyAssets } from './copy-assets.mjs';
 import { installRunnerDeps } from './install-runner-deps.mjs';
 import { seedConfig } from './seed-config.mjs';
+import { findProjectMarker } from './main.mjs';
 import {
   resolveProfile,
   makeIncludeFilter,
@@ -275,6 +276,40 @@ export async function runMultiHost(opts) {
       results.push(installHost(t.id, { home, force: true, profile: opts.profile }));
     }
   }
+
+  // Unified install (v5.7.1+): when the user upgrades hosts AND is sitting in
+  // a project directory, also refresh the workspace `.kushi/` install in cwd.
+  // This collapses the historical two-command dance:
+  //   npx kushi-agents@latest --all-hosts --profile full
+  //   cd <repo> && npx kushi-agents@latest --profile full
+  // into a single invocation. Suppress with `--no-workspace`. Skipped on
+  // uninstall and when cwd is not a recognized project (no marker, empty dir,
+  // or just plain files).
+  if (!opts.uninstall && opts.includeWorkspace !== false) {
+    const cwd = opts.cwd || process.cwd();
+    const marker = findProjectMarker(cwd);
+    if (marker) {
+      console.log('');
+      console.log(`  Workspace install detected (${marker.kind}: ${marker.name}) — installing into ${cwd}/.kushi/ ...`);
+      try {
+        const { main } = await import('./main.mjs');
+        await main({
+          target: 'vscode',
+          yes: true,
+          force: true,
+          profile: opts.profile,
+          skipWorkiqCheck: true,
+        });
+      } catch (err) {
+        console.error(`  Workspace install failed: ${err.message}`);
+      }
+    } else {
+      console.log('');
+      console.log('  Workspace install skipped — current directory is not a recognized project.');
+      console.log('  (cd into a repo or engagement folder and re-run, or pass --no-workspace to silence.)');
+    }
+  }
+
   console.log('');
   console.log(`  Done. ${results.length} host(s) processed.\n`);
   return results;