kushi-agents 6.0.0 → 6.0.1

package/bin/cli.mjs

@@ -24,30 +24,21 @@ if (args.length > 0 && VERB_ALIASES[args[0]]) {
   args[0] = VERB_ALIASES[args[0]];
 }
 
-// ── alias resolution (v5.9.7+) ──────────────────────────────────────────────
-// Mirrors `instructions/identity-resolution.instructions.md`: read alias from
-// <cwd>/.kushi/config/user/project-evidence.yml, with KUSHI_ALIAS env override.
-// No silent git-email derivation, no Graph fallback — same rules as chat.
+// ── alias resolution (v5.9.7+ / v6.0.1 deterministic auto) ─────────────────
+// Mirrors `instructions/identity-resolution.instructions.md`. Precedence:
+//   1. KUSHI_ALIAS env var (cron / CI override)
+//   2. <cwd>/.kushi/config/user/project-evidence.yml -> alias: field
+//      (skipped if value is a placeholder like `<auto>` / `<...>` / `your-alias`)
+//   3. m365-auth.json -> _meta.owner UPN — mailNickname before '@'.
+//   4. os.userInfo().username — sanitized, mirrors seed-config.applyDerivedDefaults().
+//   5. only if all of those fail → return null and print the 4-fix error.
+//
+// v6.0.0 incorrectly stopped at step 2 and treated `<auto>` as a hard error,
+// which contradicted the project-evidence.yml comment that promises auto-detection.
+// Implementation lives in src/resolve-alias.mjs so it's unit-testable.
 async function resolveAlias() {
-  if (process.env.KUSHI_ALIAS && process.env.KUSHI_ALIAS.trim()) {
-    return { alias: process.env.KUSHI_ALIAS.trim(), source: 'env' };
-  }
-  const fs = await import('node:fs');
-  const path = await import('node:path');
-  const cfgPath = path.resolve(process.cwd(), '.kushi', 'config', 'user', 'project-evidence.yml');
-  if (!fs.existsSync(cfgPath)) return { alias: null, source: 'missing-config' };
-  try {
-    const txt = fs.readFileSync(cfgPath, 'utf-8');
-    const m = txt.match(/^\s*alias:\s*([^\s#]+)/m);
-    if (!m) return { alias: null, source: 'no-alias-key' };
-    const v = m[1].trim();
-    if (!v || v === '<auto>' || v.startsWith('<') || v === 'your-alias') {
-      return { alias: null, source: 'placeholder' };
-    }
-    return { alias: v, source: 'project-evidence.yml' };
-  } catch {
-    return { alias: null, source: 'read-error' };
-  }
+  const { resolveAliasFor } = await import('../src/resolve-alias.mjs');
+  return resolveAliasFor(process.cwd());
 }
 
 function printAliasError(verb, project) {
@@ -313,6 +304,8 @@ if (args.length > 0 && ['refresh', 'bootstrap', 'discover', 'references'].includ
     aliasArgs = ['--alias', alias];
     if (source === 'env') {
       process.stderr.write(`\n  Using alias='${alias}' from KUSHI_ALIAS env var.\n`);
+    } else if (source === 'm365-auth-upn' || source === 'os-username') {
+      process.stderr.write(`\n  Using alias='${alias}' (auto-derived from ${source === 'm365-auth-upn' ? 'm365-auth.json owner UPN' : 'OS username'}). Override via 'alias:' in .kushi/config/user/project-evidence.yml or KUSHI_ALIAS env var.\n`);
     }
   }
   const r = spawnSync(process.execPath, [runner, '--project', project, ...aliasArgs, ...passthrough], { stdio: 'inherit' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kushi-agents",
-  "version": "6.0.0",
+  "version": "6.0.1",
   "description": "Install Kushi — multi-source project evidence agent with Comprehensive Structured Capture (CSC) into weekly-only files across Email, Teams, OneNote, Loop, SharePoint, Meetings, CRM, ADO. Meetings retain a sibling verbatim/ audit folder. WorkIQ-only for M365 sources (Graph / m365_* FORBIDDEN as fallbacks; user-paste is first-class). Host-agnostic.",
   "type": "module",
   "bin": {
@@ -44,7 +44,7 @@
   },
   "license": "MIT",
   "scripts": {
-    "test": "node --test src/check-workiq.test.mjs src/seed-config.test.mjs src/sanitize-workiq-input.test.mjs src/detect-vertex-repo.test.mjs src/vertex-validate.test.mjs src/emit-vertex.e2e.test.mjs src/config-root-resolve.test.mjs src/forbidden-workiq-phrasings.test.mjs src/multi-host-install.test.mjs src/eval-aggregator.test.mjs src/eval-runner.test.mjs src/hooks-dispatcher.test.mjs src/parallel-refresh.test.mjs src/otel-emit.test.mjs src/doctor.test.mjs src/setup-wizard.test.mjs src/cli-no-args.test.mjs src/cli-no-args-tty.test.mjs src/per-user-files.test.mjs src/layout-portable.test.mjs src/profile-coverage.test.mjs src/get-kushi-config.test.mjs src/seed-config-derived.test.mjs plugin/runners/test/unit/*.test.mjs",
+    "test": "node --test src/check-workiq.test.mjs src/seed-config.test.mjs src/sanitize-workiq-input.test.mjs src/detect-vertex-repo.test.mjs src/vertex-validate.test.mjs src/emit-vertex.e2e.test.mjs src/config-root-resolve.test.mjs src/forbidden-workiq-phrasings.test.mjs src/multi-host-install.test.mjs src/eval-aggregator.test.mjs src/eval-runner.test.mjs src/hooks-dispatcher.test.mjs src/parallel-refresh.test.mjs src/otel-emit.test.mjs src/doctor.test.mjs src/setup-wizard.test.mjs src/cli-no-args.test.mjs src/cli-no-args-tty.test.mjs src/per-user-files.test.mjs src/layout-portable.test.mjs src/profile-coverage.test.mjs src/get-kushi-config.test.mjs src/seed-config-derived.test.mjs src/resolve-alias.test.mjs plugin/runners/test/unit/*.test.mjs",
     "test:runners": "node --test plugin/runners/test/unit/*.test.mjs",
     "test:runners:integration": "node --test plugin/runners/test/integration/*.test.mjs",
     "test:integration:bootstrap": "node src/bootstrap-dryrun.integration.test.mjs",

package/plugin/runners/pull-email.mjs

@@ -117,7 +117,19 @@ async function main() {
   const client = await buildClient({ mailbox: args.mailbox, fixture: args.fixture });
   const startedAt = new Date().toISOString();
 
-  const folder = await client.findFolder(args.entity).catch(e => { throw e; });
+  let folder;
+  try {
+    folder = await client.findFolder(args.entity);
+  } catch (e) {
+    const retryable = !e.status || [429, 502, 503, 504].includes(e.status);
+    const status = retryable ? 'deferred' : 'failed';
+    await updateCell(projectRoot, args.alias, SOURCE, args.entity, weekStart, { last_status: status, last_error: `findFolder: ${e.message}` });
+    if (retryable && !args.dryRun) await enqueue(projectRoot, args.alias, { source: SOURCE, entity: args.entity, weekStart, signature: 'find-folder-failed', reason: e.message });
+    if (!retryable && !args.dryRun) await emitLearningCandidate({ projectRoot, alias: args.alias, source: SOURCE, entity: args.entity, week: weekStart, error: { signature: 'find-folder-failed', message: e.message, status: e.status }, context: { runner: 'pull-email' } });
+    if (!args.dryRun) await appendRunLog(projectRoot, { runner: 'pull-email', alias: args.alias, entity: args.entity, week: weekStart, status, error: e.message, http_status: e.status ?? null });
+    emit({ source: SOURCE, entity: args.entity, week: weekStart, status, errors: [{ signature: 'find-folder-failed', message: e.message, status: e.status }] });
+    return retryable ? 1 : 0;
+  }
   if (!folder) {
     await updateCell(projectRoot, args.alias, SOURCE, args.entity, weekStart, {
       last_status: 'failed', last_error: `folder not found: ${args.entity}`,
@@ -134,12 +146,14 @@ async function main() {
     await updateCell(projectRoot, args.alias, SOURCE, args.entity, weekStart, { last_status: retryable ? 'deferred' : 'failed', last_error: e.message });
     if (retryable && !args.dryRun) await enqueue(projectRoot, args.alias, { source: SOURCE, entity: args.entity, weekStart, signature: 'fetch-failed', reason: e.message });
     if (!retryable && !args.dryRun) await emitLearningCandidate({ projectRoot, alias: args.alias, source: SOURCE, entity: args.entity, week: weekStart, error: { signature: 'fetch-failed', message: e.message, status: e.status }, context: { runner: 'pull-email' } });
+    if (!args.dryRun) await appendRunLog(projectRoot, { runner: 'pull-email', alias: args.alias, entity: args.entity, week: weekStart, status: retryable ? 'deferred' : 'failed', error: e.message, http_status: e.status ?? null });
     emit({ source: SOURCE, entity: args.entity, week: weekStart, status: retryable ? 'deferred' : 'failed', errors: [{ message: e.message, status: e.status }] });
     return retryable ? 1 : 0;
   }
 
   if (messages.length === 0) {
     await updateCell(projectRoot, args.alias, SOURCE, args.entity, weekStart, { last_status: 'no-activity', items_pulled: 0, folder_id: folder.id, folder_name: folder.displayName });
+    if (!args.dryRun) await appendRunLog(projectRoot, { runner: 'pull-email', alias: args.alias, entity: args.entity, week: weekStart, status: 'no-activity', items_pulled: 0 });
     emit({ source: SOURCE, entity: args.entity, week: weekStart, status: 'no-activity', items_pulled: 0, files_written: [] });
     return 0;
   }

package/plugin/runners/refresh.mjs

@@ -24,6 +24,7 @@ import { loadConfig, assertProject } from './lib/config.mjs';
 import { readLedger, needsPull } from './lib/ledger.mjs';
 import { currentIsoMonday, ymd } from './lib/weeks.mjs';
 import { readCandidateCount } from './lib/learnings.mjs';
+import { writeRefreshReport, appendRunLog } from './lib/runlog.mjs';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 
@@ -237,6 +238,54 @@ async function main() {
 
   const learning_candidates_total = args.dryRun ? 0 : await readCandidateCount(args.project);
 
+  // v6.0.1: orchestrator-level diagnostics — write a refresh report and append
+  // run-log entries for EVERY result (captured / no-activity / partial /
+  // deferred / failed). Per-runner appendRunLog calls only fired on success
+  // before, so failures left no audit trail beyond the ephemeral stdout JSON.
+  const counts = { captured: 0, 'no-activity': 0, partial: 0, deferred: 0, failed: 0, other: 0 };
+  for (const r of results) {
+    const status = r?.parsed?.status || (r?.dry_run ? 'dry-run' : 'unknown');
+    if (counts[status] !== undefined) counts[status]++; else counts.other++;
+  }
+  if (!args.dryRun) {
+    try {
+      await writeRefreshReport(args.project, args.alias, {
+        type: args.mode,
+        summary: `${args.mode} ${weekStart}: planned=${planned.length} skipped=${skipped.length} captured=${counts.captured} no-activity=${counts['no-activity']} partial=${counts.partial} deferred=${counts.deferred} failed=${counts.failed}`,
+        details: {
+          week: weekStart,
+          mode: args.mode,
+          planned: planned.length,
+          skipped: skipped.length,
+          counts,
+          results: results.map(r => ({
+            source: r.source,
+            entity: r.entity,
+            status: r?.parsed?.status,
+            exit_code: r.exit_code,
+            errors: r?.parsed?.errors,
+          })),
+        },
+      });
+    } catch (e) { /* refresh-report is diagnostics-only, never block */ }
+
+    for (const r of results) {
+      const status = r?.parsed?.status;
+      if (!status || status === 'captured') continue; // captured already logged by per-runner
+      try {
+        await appendRunLog(args.project, {
+          runner: `pull-${r.source}`,
+          alias: args.alias,
+          entity: r.entity,
+          week: weekStart,
+          status,
+          via: 'refresh-orchestrator',
+          errors: r?.parsed?.errors,
+        });
+      } catch (e) { /* run-log is append-only diagnostics */ }
+    }
+  }
+
   emit({
     status: 'ok',
     project: args.project,

package/src/resolve-alias.mjs

@@ -0,0 +1,60 @@
+// src/resolve-alias.mjs
+// Deterministic alias resolution for the CLI runner-dispatch path.
+// Extracted from bin/cli.mjs so it's unit-testable.
+//
+// Precedence:
+//   1. KUSHI_ALIAS env var (cron / CI override)
+//   2. <cwd>/.kushi/config/user/project-evidence.yml -> alias: field
+//      (skipped if value is a placeholder like `<auto>` / `<...>` / `your-alias`)
+//   3. <cwd>/.kushi/config/user/m365-auth.json -> _meta.owner UPN
+//      (mailNickname before '@'; sanitized)
+//   4. os.userInfo().username — sanitized (mirrors seed-config.applyDerivedDefaults)
+//   5. else null with source 'placeholder'
+
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+
+function sanitize(raw) {
+  return String(raw || '').toLowerCase().replace(/[^a-z0-9._-]/g, '');
+}
+
+export function resolveAliasFor(cwd, env = process.env, userInfo = () => os.userInfo()) {
+  if (env.KUSHI_ALIAS && env.KUSHI_ALIAS.trim()) {
+    return { alias: env.KUSHI_ALIAS.trim(), source: 'env' };
+  }
+
+  const cfgPath = path.resolve(cwd, '.kushi', 'config', 'user', 'project-evidence.yml');
+  const cfgExists = fs.existsSync(cfgPath);
+
+  if (cfgExists) {
+    try {
+      const txt = fs.readFileSync(cfgPath, 'utf-8');
+      const m = txt.match(/^\s*alias:\s*([^\s#]+)/m);
+      if (m) {
+        const v = m[1].trim();
+        const isPlaceholder = !v || v === '<auto>' || v.startsWith('<') || v === 'your-alias';
+        if (!isPlaceholder) return { alias: v, source: 'project-evidence.yml' };
+      }
+    } catch { /* fall through */ }
+
+    const authPath = path.resolve(cwd, '.kushi', 'config', 'user', 'm365-auth.json');
+    if (fs.existsSync(authPath)) {
+      try {
+        const obj = JSON.parse(fs.readFileSync(authPath, 'utf-8'));
+        const upn = obj && obj._meta && typeof obj._meta.owner === 'string' ? obj._meta.owner : '';
+        const local = sanitize(upn.split('@')[0]);
+        if (local && !local.startsWith('<')) {
+          return { alias: local, source: 'm365-auth-upn' };
+        }
+      } catch { /* fall through */ }
+    }
+  }
+
+  try {
+    const u = sanitize(userInfo().username);
+    if (u) return { alias: u, source: 'os-username' };
+  } catch { /* fall through */ }
+
+  return { alias: null, source: 'placeholder' };
+}

package/src/resolve-alias.test.mjs

@@ -0,0 +1,91 @@
+// src/resolve-alias.test.mjs
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { resolveAliasFor } from './resolve-alias.mjs';
+
+function tmp() {
+  const d = fs.mkdtempSync(path.join(os.tmpdir(), 'kushi-alias-'));
+  return d;
+}
+
+function seedEvidenceYml(dir, value) {
+  const p = path.join(dir, '.kushi', 'config', 'user');
+  fs.mkdirSync(p, { recursive: true });
+  fs.writeFileSync(path.join(p, 'project-evidence.yml'), `alias: ${value}\nfoo: bar\n`);
+}
+
+function seedM365Auth(dir, owner) {
+  const p = path.join(dir, '.kushi', 'config', 'user');
+  fs.mkdirSync(p, { recursive: true });
+  fs.writeFileSync(path.join(p, 'm365-auth.json'), JSON.stringify({ _meta: { owner } }));
+}
+
+test('resolveAlias: env var wins over yml + m365-auth', () => {
+  const d = tmp();
+  seedEvidenceYml(d, 'fromyml');
+  seedM365Auth(d, 'fromupn@contoso.com');
+  const r = resolveAliasFor(d, { KUSHI_ALIAS: 'fromenv' }, () => ({ username: 'fromos' }));
+  assert.equal(r.source, 'env');
+  assert.equal(r.alias, 'fromenv');
+});
+
+test('resolveAlias: real value in project-evidence.yml is used', () => {
+  const d = tmp();
+  seedEvidenceYml(d, 'realalias');
+  const r = resolveAliasFor(d, {}, () => ({ username: 'fromos' }));
+  assert.equal(r.source, 'project-evidence.yml');
+  assert.equal(r.alias, 'realalias');
+});
+
+test('resolveAlias: <auto> placeholder falls through to m365-auth UPN', () => {
+  const d = tmp();
+  seedEvidenceYml(d, '<auto>');
+  seedM365Auth(d, 'jane.doe@microsoft.com');
+  const r = resolveAliasFor(d, {}, () => ({ username: 'shouldnotuse' }));
+  assert.equal(r.source, 'm365-auth-upn');
+  assert.equal(r.alias, 'jane.doe');
+});
+
+test('resolveAlias: <auto> + no m365-auth falls through to OS username', () => {
+  const d = tmp();
+  seedEvidenceYml(d, '<auto>');
+  const r = resolveAliasFor(d, {}, () => ({ username: 'OS_User' }));
+  assert.equal(r.source, 'os-username');
+  assert.equal(r.alias, 'os_user');
+});
+
+test('resolveAlias: <foo> generic placeholder also falls through', () => {
+  const d = tmp();
+  seedEvidenceYml(d, '<your-alias>');
+  const r = resolveAliasFor(d, {}, () => ({ username: 'osuser' }));
+  assert.equal(r.source, 'os-username');
+  assert.equal(r.alias, 'osuser');
+});
+
+test('resolveAlias: literal "your-alias" treated as placeholder', () => {
+  const d = tmp();
+  seedEvidenceYml(d, 'your-alias');
+  const r = resolveAliasFor(d, {}, () => ({ username: 'osuser' }));
+  assert.equal(r.source, 'os-username');
+  assert.equal(r.alias, 'osuser');
+});
+
+test('resolveAlias: missing .kushi/ falls through to OS username (deterministic last resort)', () => {
+  const d = tmp();
+  const r = resolveAliasFor(d, {}, () => ({ username: 'osuser' }));
+  assert.equal(r.source, 'os-username');
+  assert.equal(r.alias, 'osuser');
+});
+
+test('resolveAlias: m365-auth UPN sanitizes uppercase + special chars', () => {
+  const d = tmp();
+  seedEvidenceYml(d, '<auto>');
+  seedM365Auth(d, 'Bob+Tag@microsoft.com');
+  const r = resolveAliasFor(d, {}, () => ({ username: 'osuser' }));
+  assert.equal(r.source, 'm365-auth-upn');
+  // '+' is stripped, lowercased
+  assert.equal(r.alias, 'bobtag');
+});