openmerit 0.3.11 → 0.4.0

package/dist/terminal/src/telemetry.mjs

@@ -1,138 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { readFileSync } from 'node:fs';
-
-export let clientVersion;
-for (const path of ['../../../package.json', '../../../../package.json']) {
-  try { const pkg = JSON.parse(readFileSync(new URL(path, import.meta.url), 'utf8')); if (pkg.name === 'openmerit') { clientVersion = pkg.version; break; } } catch {}
-}
-const frameFiles = Object.freeze(['cli.mjs', 'install.mjs']);
-const applicationURLs = frameFiles.map(file => new URL(`../../terminal/src/${file}`, import.meta.url).href);
-export function safeFrames(error) {
-  try {
-    const stack = error?.stack;
-    if (typeof stack !== 'string') return [];
-    return stack.slice(0, 8000).split('\n').slice(1, 40).flatMap(line => {
-      const match = line.match(/(?:\(|\s)(file:\/\/[^\s)]+):(\d+):(\d+)\)?$/);
-      if (!match || !applicationURLs.includes(match[1])) return [];
-      const lineNumber = Number(match[2]), column = Number(match[3]);
-      return lineNumber > 0 && lineNumber <= 1000000 && column > 0 && column <= 1000000 ? [{ filename: match[1].split('/').at(-1), lineno: lineNumber, colno: column }] : [];
-    }).slice(0, 8);
-  } catch { return []; }
-}
-export function errorProperties(error) {
-  try { return { error_type: errorType(error), frames: safeFrames(error) }; }
-  catch { return { error_type: 'Error', frames: [] }; }
-}
-const environment = () => ({ ...(clientVersion ? { client_version: clientVersion } : {}), platform: ['darwin', 'linux', 'win32'].includes(process.platform) ? process.platform : 'unknown', runtime_major: Number(process.versions.node.split('.')[0]) });
-
-const anonymousId = randomUUID();
-export const telemetryEnabled = (defaultEnabled = false) => (process.env.OPENMERIT_TELEMETRY ? process.env.OPENMERIT_TELEMETRY === '1' : defaultEnabled) && process.env.DO_NOT_TRACK !== '1';
-export const setupCorrelationEnabled = () => telemetryEnabled(true) && process.env.OPENMERIT_ANALYTICS_ACCOUNT !== 'off';
-export const setupUUID = value => typeof value === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
-// Scout setup defaults to analytics on; explicit privacy refusals must survive
-// device approval and future agent sessions. Prompt content stays off.
-export function setupHeaders(ids = {}, client = 'cli') {
-  return {
-    'X-Scout-Client': client,
-    'X-Scout-Agent': ids.agent === 'pi' ? 'pi' : 'claude-code',
-    ...(clientVersion ? { 'X-Scout-Client-Version': clientVersion } : {}),
-    'X-Scout-Analytics-Content': 'off',
-    ...(client === 'cli' ? { 'X-Scout-Analytics': telemetryEnabled(true) ? 'on' : 'off' } : !telemetryEnabled(true) ? { 'X-Scout-Analytics': 'off' } : {}),
-    ...(process.env.OPENMERIT_ANALYTICS_ACCOUNT === 'off' || !telemetryEnabled(true) ? { 'X-Scout-Analytics-Account': 'off' } : {}),
-    ...(setupCorrelationEnabled() && setupUUID(ids.setup_id) ? { 'X-Scout-Setup-Id': ids.setup_id } : {}),
-    ...(setupCorrelationEnabled() && setupUUID(ids.installation_id) ? { 'X-Scout-Installation-Id': ids.installation_id } : {}),
-  };
-}
-export function installationProperties(input) {
-  if (!input || typeof input !== 'object' || Array.isArray(input)) return null;
-  const out = {};
-  const enums = {
-    stage: ['started', 'preflight', 'login', 'browser_open', 'configuration', 'verification', 'status', 'remove', 'completed'],
-    outcome: ['started', 'ok', 'error', 'pending', 'denied', 'conflict', 'not_installed'],
-    command: ['install', 'status', 'remove', 'login', 'logout', 'project', 'doctor', 'unknown'],
-    agent: ['claude-code', 'pi'], scope: ['user', 'project'],
-    rule_status: ['matches', 'missing', 'modified_or_unowned'],
-    skill_status: ['matches', 'missing', 'modified_or_unowned'],
-    server_status: ['matches', 'missing', 'modified_or_unowned'],
-    connection: ['connected', 'failed', 'key_rejected', 'not_checked'],
-    code: ['command_error', 'approval_pending', 'access_denied', 'install_conflict', 'openmerit_unreachable'],
-  };
-  for (const [key, values] of Object.entries(enums)) {
-    if (input[key] === undefined && !['stage', 'outcome'].includes(key)) continue;
-    if (!values.includes(input[key])) return null;
-    out[key] = input[key];
-  }
-  for (const key of ['setup_id', 'installation_id']) if (setupUUID(input[key])) out[key] = input[key];
-  for (const key of ['applied', 'installed']) if (typeof input[key] === 'boolean') out[key] = input[key];
-  return out;
-}
-export async function sendInstallationEvent(input) {
-  if (!telemetryEnabled(true)) return;
-  const properties = installationProperties(input);
-  if (!properties) return;
-  if (!setupCorrelationEnabled()) { delete properties.setup_id; delete properties.installation_id; }
-  // One immutable envelope across a transient retry. A hard total deadline
-  // bounds awaited milestones even if the transport ignores cancellation.
-  const body = JSON.stringify({ event: 'scout_installation_step', event_id: randomUUID(), anonymousId, properties: { ...properties, ...environment() } });
-  const controller = new AbortController();
-  let timer;
-  try {
-    await Promise.race([
-      (async () => {
-        for (let attempt = 0; attempt < 2 && !controller.signal.aborted && telemetryEnabled(true); attempt++) {
-          try {
-            const response = await fetch('https://openmerit.ai/scout/api/analytics', {
-              method: 'POST', headers: { 'Content-Type': 'application/json', ...setupHeaders(properties) },
-              body, signal: controller.signal, redirect: 'error',
-            });
-            await response.body?.cancel();
-            if (response.ok || response.status !== 429 && response.status < 500) return;
-          } catch { /* Only a bounded retry; never export error text. */ }
-        }
-      })(),
-      new Promise(resolve => { timer = setTimeout(() => { controller.abort(); resolve(); }, 1500); }),
-    ]);
-  } catch { /* Never affect setup, even if the transport ignores abort. */ }
-  finally { clearTimeout(timer); }
-}
-const errorType = error => ['Error', 'TypeError', 'RangeError', 'SyntaxError', 'ReferenceError', 'URIError', 'EvalError', 'AggregateError', 'AbortError'].includes(error?.name) ? error.name : 'Error';
-// Command identity is ephemeral; the installer separately manages the owned
-// installation's correlation IDs.
-export function commandTelemetry(args) {
-  const setup = ['install', 'status', 'remove', 'login', 'logout', 'project', 'doctor'];
-  const enabled = () => telemetryEnabled(setup.includes(args[0]));
-  if (!enabled()) return async () => {};
-  const started = performance.now();
-  const command_id = randomUUID();
-  const command = !args.length || args.includes('--help') || args.includes('-h')
-    ? 'help' : setup.includes(args[0]) ? args[0] : 'unknown';
-  async function send(event, properties) {
-    if (!enabled()) return;
-    const controller = new AbortController();
-    const body = JSON.stringify({ event, event_id: randomUUID(), anonymousId, properties: { ...properties, ...environment(), command_id } });
-    let timer;
-    try {
-      await Promise.race([
-        Promise.resolve().then(() => fetch('https://openmerit.ai/scout/api/analytics', {
-          method: 'POST', headers: { 'Content-Type': 'application/json', 'X-Scout-Client': 'cli', 'X-Scout-Analytics': 'on', ...(process.env.OPENMERIT_ANALYTICS_ACCOUNT === 'off' ? { 'X-Scout-Analytics-Account': 'off' } : {}) },
-          body,
-          signal: controller.signal, redirect: 'error',
-        })).then(response => response.body?.cancel()),
-        new Promise(resolve => { timer = setTimeout(() => { controller.abort(); resolve(); }, 750); }),
-      ]);
-    } catch { /* Analytics must never affect command behavior. */ }
-    finally { clearTimeout(timer); }
-  }
-  const pending = send('cli_command_started', { command });
-  let completed = false;
-  // code: a content-free setup outcome such as approval_pending; never a message.
-  return async (outcome, error, code) => {
-    if (completed) return;
-    completed = true;
-    await Promise.all([pending, send('cli_command_completed', {
-      command, outcome: outcome === 'ok' ? 'ok' : 'error',
-      ...(outcome === 'ok' ? {} : { code: code ?? 'command_error', ...(error ? errorProperties(error) : {}) }),
-      duration_ms: Math.min(86400000, Math.max(0, Math.round(performance.now() - started))),
-    })]);
-  };
-}

package/dist/terminal/src/updates.js

@@ -1,397 +0,0 @@
-// Standalone updater copied into Claude's configuration directory. Only Node
-// built-ins: it must survive the npx cache disappearing, without installing or
-// executing code from the release it downloads.
-import { createHash, randomUUID } from 'node:crypto';
-import { realpathSync } from 'node:fs';
-import { mkdir, open, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { gunzipSync } from 'node:zlib';
-export const updateContract = 'scout-recommend-v2';
-const registry = 'https://registry.npmjs.org/openmerit/latest';
-const day = 24 * 60 * 60 * 1000;
-const retry = 15 * 60 * 1000;
-const digest = (text) => createHash('sha256').update(text).digest('hex');
-const isObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
-const parsed = (text) => {
-    const value = JSON.parse(text);
-    if (!isObject(value))
-        throw new Error('Expected a JSON object.');
-    return value;
-};
-async function optional(path) {
-    try {
-        return await readFile(path, 'utf8');
-    }
-    catch (error) {
-        if (isObject(error) && error.code === 'ENOENT')
-            return null;
-        throw error;
-    }
-}
-async function object(path) { return parsed(await optional(path) ?? '{}'); }
-async function atomic(path, value) {
-    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    const temp = `${path}.${randomUUID()}.tmp`;
-    try {
-        await writeFile(temp, typeof value === 'string' ? value : `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
-        await rename(temp, path);
-    }
-    finally {
-        await rm(temp, { force: true });
-    }
-}
-export function updatePaths(base, scope) {
-    return {
-        record: join(base, 'openmerit-install.json'), runner: join(base, 'openmerit-updater.mts'),
-        settings: join(base, scope === 'user' ? 'settings.json' : 'settings.local.json'),
-        state: join(base, 'openmerit-updates.json'), backup: join(base, 'openmerit-update-backup.json'),
-        skill: join(base, 'skills/openmerit-scout/SKILL.md'), rule: join(base, 'rules/openmerit-scout.md'),
-    };
-}
-function updateRecord(record) {
-    const value = record.updates;
-    if (!isObject(value) || typeof value.enabled !== 'boolean' || typeof value.version !== 'string'
-        || typeof value.runnerHash !== 'string' || !isObject(value.hook))
-        return null;
-    return value;
-}
-// Serialize installs, removals and hooks. A dead process's lock is recoverable;
-// an active login is not mistaken for a stale updater just because it is slow.
-export async function withUpdateLock(base, work) {
-    await mkdir(base, { recursive: true, mode: 0o700 });
-    const path = join(base, 'openmerit-update.lock');
-    let handle;
-    for (let attempt = 0; attempt < 2; attempt++) {
-        try {
-            handle = await open(path, 'wx', 0o600);
-            break;
-        }
-        catch (error) {
-            if (!isObject(error) || error.code !== 'EEXIST')
-                throw error;
-            // Only one process may reap a dead lock. Without this guard, two stale
-            // observers can unlink each other's newly acquired live lock.
-            const recoveryPath = `${path}.recovery`;
-            let recovery;
-            try {
-                recovery = await open(recoveryPath, 'wx', 0o600);
-            }
-            catch {
-                throw new Error('Another OpenMerit lock recovery is running. If it was interrupted, review openmerit-update.lock.recovery before removing it.');
-            }
-            try {
-                await recovery.writeFile(JSON.stringify({ pid: process.pid }));
-                const text = await optional(path);
-                if (text === null)
-                    continue;
-                let alive = true;
-                try {
-                    const pid = parsed(text).pid;
-                    if (typeof pid === 'number' && pid > 0) {
-                        try {
-                            process.kill(pid, 0);
-                        }
-                        catch (failure) {
-                            if (isObject(failure) && failure.code === 'ESRCH')
-                                alive = false;
-                        }
-                    }
-                    else
-                        alive = Date.now() - (await stat(path)).mtimeMs < 10 * 60_000;
-                }
-                catch {
-                    alive = Date.now() - (await stat(path)).mtimeMs < 10 * 60_000;
-                }
-                if (alive)
-                    throw new Error('Another OpenMerit install or update is running. Retry shortly.');
-                await rm(path, { force: true });
-            }
-            finally {
-                await recovery.close();
-                await rm(recoveryPath, { force: true });
-            }
-        }
-    }
-    if (!handle)
-        throw new Error('Another OpenMerit update is running.');
-    try {
-        await handle.writeFile(JSON.stringify({ pid: process.pid }));
-        return await work();
-    }
-    finally {
-        await handle.close();
-        await rm(path, { force: true });
-    }
-}
-function groups(settings) {
-    if (settings.hooks === undefined)
-        return {};
-    if (!isObject(settings.hooks))
-        throw new Error('Claude settings.hooks is not an object; nothing changed.');
-    return settings.hooks;
-}
-function eventGroups(hooks, event) {
-    const value = hooks[event];
-    if (value === undefined)
-        return [];
-    if (!Array.isArray(value))
-        throw new Error(`Claude ${event} hooks are not an array; nothing changed.`);
-    return value;
-}
-function usesRunner(group, runner) {
-    return isObject(group) && Array.isArray(group.hooks) && group.hooks.some(hook => isObject(hook) && typeof hook.command === 'string' && (hook.command.includes(runner) || hook.command.includes(quote(runner))));
-}
-export async function inspectUpdates(base, scope, record) {
-    const paths = updatePaths(base, scope), saved = updateRecord(record);
-    const pending = updateRecord({ updates: record.pendingUpdates });
-    const owners = [saved, pending].filter(value => value !== null);
-    const runner = await optional(paths.runner), settings = await object(paths.settings), hooks = groups(settings);
-    const conflicts = [];
-    if (runner !== null && !owners.some(owner => digest(runner) === owner.runnerHash))
-        conflicts.push('OpenMerit updater was edited or is not owned; nothing changed.');
-    for (const event of ['SessionStart', 'Stop']) {
-        for (const group of eventGroups(hooks, event)) {
-            if (usesRunner(group, paths.runner) && !owners.some(owner => JSON.stringify(group) === JSON.stringify(owner.hook))) {
-                conflicts.push(`OpenMerit ${event} hook was edited or is not owned; nothing changed.`);
-            }
-        }
-    }
-    const active = runner !== null && ['SessionStart', 'Stop'].every(event => eventGroups(hooks, event).some(group => owners.some(owner => JSON.stringify(group) === JSON.stringify(owner.hook))));
-    return { paths, saved: saved ?? pending, runner, settings, hooks, conflicts, active };
-}
-// Claude Code uses a shell for command hooks, including Git Bash on Windows.
-const quote = (value) => `'${value.replaceAll("'", "'\"'\"'")}'`;
-export async function configureUpdates(base, scope, record, version, enabled) {
-    const state = await inspectUpdates(base, scope, record);
-    if (state.conflicts.length)
-        throw new Error(state.conflicts.join('\n'));
-    // This module is the runner: updates.ts in source, the compiled updates.js in the npm package.
-    const source = await readFile(new URL(import.meta.url), 'utf8');
-    const hook = { hooks: [{ type: 'command', command: `${quote(process.execPath)} ${quote(state.paths.runner)} --base ${quote(base)} --scope ${scope} --hook`, async: true, timeout: 150 }] };
-    const hooks = { ...state.hooks };
-    for (const event of ['SessionStart', 'Stop']) {
-        const kept = eventGroups(hooks, event).filter(group => !usesRunner(group, state.paths.runner));
-        if (enabled)
-            kept.push(hook);
-        if (kept.length)
-            hooks[event] = kept;
-        else
-            delete hooks[event];
-    }
-    // Avoid clobbering settings that changed while the installer was signing in.
-    const latest = await object(state.paths.settings);
-    if (JSON.stringify(latest) !== JSON.stringify(state.settings))
-        throw new Error('Claude settings changed during setup. Retry.');
-    const next = { enabled, version, runnerHash: digest(source), hook };
-    await atomic(state.paths.record, { ...await object(state.paths.record), pendingUpdates: next });
-    await atomic(state.paths.runner, source);
-    await atomic(state.paths.settings, { ...state.settings, hooks });
-    return next;
-}
-export async function removeUpdates(base, scope, record) {
-    const state = await inspectUpdates(base, scope, record);
-    const hooks = { ...state.hooks };
-    for (const event of ['SessionStart', 'Stop']) {
-        const kept = eventGroups(hooks, event).filter(group => !state.saved || JSON.stringify(group) !== JSON.stringify(state.saved.hook));
-        if (kept.length)
-            hooks[event] = kept;
-        else
-            delete hooks[event];
-    }
-    if (state.saved)
-        await atomic(state.paths.settings, { ...state.settings, hooks });
-    const stillReferenced = ['SessionStart', 'Stop'].some(event => eventGroups(hooks, event).some(group => usesRunner(group, state.paths.runner)));
-    if (!stillReferenced && state.runner !== null && state.saved && digest(state.runner) === state.saved.runnerHash)
-        await rm(state.paths.runner, { force: true });
-    await rm(state.paths.state, { force: true });
-}
-// Read one fixed regular file in memory, never extract archive paths onto disk.
-function instructionBundle(bytes) {
-    const tar = gunzipSync(bytes, { maxOutputLength: 32 * 1024 * 1024 });
-    let found = null;
-    for (let offset = 0; offset + 512 <= tar.length;) {
-        const header = tar.subarray(offset, offset + 512);
-        if (header.every(byte => byte === 0))
-            break;
-        const name = header.subarray(0, 100).toString().replace(/\0.*$/s, '');
-        const rawSize = header.subarray(124, 136).toString().replace(/\0.*$/s, '').trim();
-        if (!/^[0-7]+$/.test(rawSize))
-            throw new Error('Invalid package archive.');
-        const size = Number.parseInt(rawSize, 8), start = offset + 512;
-        if (start + size > tar.length)
-            throw new Error('Truncated package archive.');
-        if (name === 'package/dist/terminal/scout-update.json') {
-            if (found || size > 256 * 1024 || ![0, 48].includes(header[156] ?? -1))
-                throw new Error('Invalid instruction bundle.');
-            found = parsed(tar.subarray(start, start + size).toString('utf8'));
-        }
-        offset = start + Math.ceil(size / 512) * 512;
-    }
-    return found;
-}
-const stableVersion = (version) => /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(version);
-function newer(next, installed) {
-    if (!stableVersion(next) || !stableVersion(installed))
-        return false;
-    const a = next.split('.').map(Number), b = installed.split('.').map(Number);
-    for (let i = 0; i < 3; i++) {
-        if (a[i] !== b[i])
-            return a[i] > b[i];
-    }
-    return false;
-}
-async function boundedFetch(url, max, fetcher, timeout = 12_000) {
-    const controller = new AbortController();
-    let reader;
-    let timer;
-    const deadline = new Promise((_, reject) => {
-        timer = setTimeout(() => { controller.abort(); reject(new Error('Update download timed out.')); }, timeout);
-    });
-    const download = async () => {
-        const response = await fetcher(url, { redirect: 'error', signal: controller.signal, headers: { Accept: 'application/json' } });
-        if (!response.ok || !response.body || controller.signal.aborted)
-            throw new Error('Update server unavailable.');
-        const parts = [];
-        let size = 0;
-        reader = response.body.getReader();
-        for (;;) {
-            const { value, done } = await reader.read();
-            if (done)
-                break;
-            size += value.length;
-            if (size > max)
-                throw new Error('Update download exceeded its size limit.');
-            parts.push(value);
-        }
-        return Buffer.concat(parts);
-    };
-    try {
-        return await Promise.race([download(), deadline]);
-    }
-    finally {
-        clearTimeout(timer);
-        controller.abort();
-        // Cancellation itself must not keep a timed-out hook alive.
-        void reader?.cancel().catch(() => { });
-    }
-}
-async function recover(base, scope) {
-    const paths = updatePaths(base, scope), text = await optional(paths.backup);
-    if (!text)
-        return;
-    const backup = parsed(text);
-    if (typeof backup.skill !== 'string' || typeof backup.rule !== 'string' || !isObject(backup.record))
-        throw new Error('Update recovery needs manual review.');
-    for (const field of ['skill', 'rule']) {
-        const current = await optional(paths[field]);
-        if (current !== null && digest(current) !== digest(backup[field]) && digest(current) !== backup[`${field}Hash`])
-            throw new Error('An interrupted update has user edits; nothing changed.');
-    }
-    // Recover the previous complete pair before any retry. Atomic per-file writes
-    // plus a durable journal cover failure between the two renames.
-    await atomic(paths.skill, backup.skill);
-    await atomic(paths.rule, backup.rule);
-    await atomic(paths.record, backup.record);
-    await rm(paths.backup, { force: true });
-}
-export async function recoverUpdates(base, scope) { await recover(base, scope); }
-export async function runUpdate(base, scope, options = {}) {
-    return withUpdateLock(base, async () => {
-        await recover(base, scope);
-        const paths = updatePaths(base, scope), record = await object(paths.record), saved = updateRecord(record);
-        if (record.version !== 3 || record.scope !== scope || !saved)
-            return { status: 'manual_required', message: 'Run npx -y openmerit@latest install --client claude-code to bootstrap updates in this scope.' };
-        if (options.hook && (!saved.enabled || process.env.OPENMERIT_AUTO_UPDATE === 'off'))
-            return { status: 'disabled', message: 'Automatic updates disabled.' };
-        const now = options.now ?? Date.now(), state = options.enabled === undefined ? await object(paths.state) : {};
-        if (options.hook && typeof state.nextCheckAt === 'number' && now < state.nextCheckAt)
-            return { status: 'not_due', message: 'Update check not due.' };
-        const support = await inspectUpdates(base, scope, record);
-        if (support.conflicts.length) {
-            if (options.hook)
-                await atomic(paths.state, { nextCheckAt: now + day, status: 'conflict' });
-            return { status: 'conflict', message: `${support.conflicts.join(' ')} Say “update openmerit” after resolving the conflict.` };
-        }
-        if (options.enabled !== undefined) {
-            record.updates = await configureUpdates(base, scope, record, saved.version, options.enabled);
-            delete record.pendingUpdates;
-            await atomic(paths.record, record);
-            return { status: options.enabled ? 'enabled' : 'disabled', message: `Automatic Scout instruction updates ${options.enabled ? 'enabled' : 'disabled'}. Start a new Claude Code session to reload hooks.` };
-        }
-        // Record the attempt before networking so a crashed hook cannot hammer npm.
-        await atomic(paths.state, { ...state, nextCheckAt: now + retry });
-        try {
-            const fetcher = options.fetcher ?? fetch;
-            const release = parsed((await boundedFetch(registry, 512 * 1024, fetcher)).toString('utf8'));
-            const version = release.version;
-            if (release.name !== 'openmerit' || typeof version !== 'string' || !stableVersion(version))
-                throw new Error('Invalid stable release metadata.');
-            if (!newer(version, saved.version)) {
-                await atomic(paths.state, { checkedAt: now, nextCheckAt: now + day, status: 'current' });
-                return { status: 'current', version: saved.version, message: `Scout instructions ${saved.version} are current.` };
-            }
-            const dist = release.dist;
-            const tarball = `https://registry.npmjs.org/openmerit/-/openmerit-${version}.tgz`;
-            if (!isObject(dist) || dist.tarball !== tarball || typeof dist.integrity !== 'string' || !/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(dist.integrity))
-                throw new Error('Release has no trusted SHA-512 package integrity.');
-            const bytes = await boundedFetch(tarball, 16 * 1024 * 1024, fetcher, 120_000);
-            if (`sha512-${createHash('sha512').update(bytes).digest('base64')}` !== dist.integrity)
-                throw new Error('Package integrity verification failed.');
-            const bundle = instructionBundle(bytes);
-            if (!bundle || bundle.format !== 1 || bundle.contract !== updateContract || bundle.version !== version) {
-                await atomic(paths.state, { checkedAt: now, nextCheckAt: now + day, status: 'manual_required' });
-                return { status: 'manual_required', version, message: `Release ${version} needs a reviewed installer upgrade. Review its changes, then run npx -y openmerit@latest install --client claude-code --scope ${scope}. Do not bypass permissions or rerun login automatically.` };
-            }
-            if (typeof bundle.skill !== 'string' || typeof bundle.rule !== 'string' || !bundle.skill.startsWith('---\nname: openmerit-scout\n') || !bundle.rule.trim())
-                throw new Error('Invalid Scout instructions.');
-            const instructions = bundle;
-            const skill = await optional(paths.skill), rule = await optional(paths.rule);
-            if (skill === null || rule === null || digest(skill) !== record.skillHash || digest(rule) !== record.ruleHash) {
-                await atomic(paths.state, { checkedAt: now, nextCheckAt: now + day, status: 'conflict' });
-                return { status: 'conflict', message: 'Scout instructions are missing or edited. Nothing changed. Say “update openmerit” after reviewing the files.' };
-            }
-            const skillHash = digest(instructions.skill), ruleHash = digest(instructions.rule);
-            await atomic(paths.backup, { record, skill, rule, skillHash, ruleHash });
-            try {
-                // Do not overwrite edits made during the download or journal write.
-                if (await optional(paths.skill) !== skill || await optional(paths.rule) !== rule)
-                    throw new Error('Scout instructions changed during the update.');
-                await atomic(paths.skill, instructions.skill);
-                await atomic(paths.rule, instructions.rule);
-                await atomic(paths.record, { ...record, skillHash, ruleHash, updates: { ...saved, version } });
-                await rm(paths.backup, { force: true });
-            }
-            catch (error) {
-                try {
-                    await recover(base, scope);
-                }
-                catch {
-                    return { status: 'conflict', message: 'An interrupted Scout update could not be recovered safely. Review the installed files and openmerit-update-backup.json; no user edits were overwritten.' };
-                }
-                throw error;
-            }
-            // A failed schedule write must not misreport an already applied update.
-            await atomic(paths.state, { checkedAt: now, nextCheckAt: now + day, status: 'updated', version }).catch(() => { });
-            return { status: 'updated', version, message: `Scout instructions updated to ${version}. Start a new Claude Code session to load them; the running session may still use its previous instructions.` };
-        }
-        catch {
-            await atomic(paths.state, { nextCheckAt: now + retry, status: 'retry' });
-            return { status: 'retry', message: 'Could not safely update Scout. The installed version was retained. Automatic checks retry after 15 minutes while Claude Code is in use; say “update openmerit” to retry now.' };
-        }
-    });
-}
-// Hooks deliberately never ask Claude to continue, read transcripts or emit
-// blocking decisions. Offline and concurrent-hook failures exit successfully.
-if (process.argv[1] && realpathSync(resolve(process.argv[1])) === fileURLToPath(import.meta.url)) {
-    const args = process.argv.slice(2), base = args[args.indexOf('--base') + 1], scope = args[args.indexOf('--scope') + 1];
-    if (base && ['user', 'project'].includes(scope ?? '')) {
-        process.stdin.resume();
-        try {
-            const result = await runUpdate(resolve(base), scope, { hook: args.includes('--hook') });
-            if (['updated', 'conflict', 'manual_required', 'retry'].includes(result.status))
-                console.log(JSON.stringify({ systemMessage: result.message }));
-        }
-        catch { /* Maintenance cannot block the user's task. */ }
-    }
-}

package/docs/agent-evaluations.md

@@ -1,15 +0,0 @@
-# Agent-evaluation CLI retirement
-
-**npm 0.3.0, 4 November 2026.** The standalone `openmerit eval` CLI is retired in full, including `init`, `doctor`, `plan`, `run`, `watch` and `report`. Older installed packages keep it until they are upgraded. The old Scout JSON recommendation API went offline with the Scout serving deploy of 5 November 2026.
-
-After an approved Scout release, `/scout/api/recommend` and its legacy alpha/versioned paths return 404, regardless of authentication. There is no replacement frozen-plan protocol. Use the [Scout conversational agent or MCP](scout.md) for provisional model guidance and your own representative task checks for evaluation. The Inference Terminal is [retired as well](inference-terminal.md); the Pi adapter remains a native Scout MCP integration, not an evaluation runner.
-
-## Existing local artifacts
-
-Upgrading does not delete `.openmerit/eval.json`, reports, budget ledgers, task fixtures or grader files. Review and retain or remove them yourself. Stop any old foreground watcher before upgrading. Instructions previously appended to `AGENTS.md` or `CLAUDE.md` are not automatically rewritten; remove obsolete evaluation instructions deliberately, preserving unrelated project guidance.
-
-Historical reports remain evidence only for the versions and tasks actually tested. Unknown costs do not become known, and past budget reservations are not reconciled provider bills. Retirement does not cancel external agent/provider work, erase historical Scout analytics, change provider retention or enforce billing limits.
-
-## Preserved capabilities
-
-Scout's agent, MCP, coding-agent setup, catalogue refresh/publication, status and account/privacy controls remain. Shared evidence preparation and model projections remain available to those consumers. See [commands](commands.md), [security](security.md) and [testing](testing.md) for the remaining interfaces and verification boundary.

package/docs/commands.md

@@ -1,9 +0,0 @@
-# Commands
-
-**Pi adapter — npm 0.1.12 and later:** Pi 1.5.0 uses only native Scout MCP and shared guidance. Run `npx -y openmerit@latest install --client pi [--scope user|project]` and approve in the browser. Shell `login`, `logout`, `status`, `remove`, and `doctor` accept the same target flags. Updates require explicit reinstall; no Pi update hooks or scheduler are installed. See [Pi setup](pi-extension.md).
-
-The Pi 0.87 `/openmerit` slash commands were removed with that adapter and have no replacement.
-
-**Retired in npm 0.3.0:** `openmerit dash` ([details](inference-terminal.md)) and all `openmerit eval` commands, including `plan`. Existing local files are untouched. The Scout serving deploy of 5 November 2026 retired `/scout/api/recommend`; use Scout's conversational agent or MCP. Hosted Workers change only through separate approved deployments. See [retirement details](agent-evaluations.md).
-
-The [Scout setup commands](scout.md#commands) remain available, beginning with `npx -y openmerit@latest install --client claude-code`.

package/docs/getting-started.md

@@ -1,37 +0,0 @@
-# Getting started
-
-OpenMerit provides Scout model-selection guidance. The Inference Terminal (`openmerit dash`) is [retired in npm 0.3.0](inference-terminal.md). Pi Scout setup requires OpenMerit **0.1.12** or newer and Pi **1.5.0**. Package publication and website deployment are independent releases.
-
-## Connect Scout to a coding agent
-
-Claude Code setup is described in [the Scout guide](scout.md#connect-a-coding-agent). For the new Pi integration, use Pi **1.5.0**, Node.js 22.19 or newer, and npm. Run the intended command in your shell:
-
-```sh
-npx -y openmerit@latest install --client pi --scope user
-```
-
-Approve the matching device code in the browser, then start a **new Pi session**. Only approve a request you initiated. User scope is the default and applies across projects. For one project, run this from that project's root instead:
-
-```sh
-npx -y openmerit@latest install --client pi --scope project
-```
-
-Each client/scope installation has its own private Scout key; project keys are stored outside the repository. Do not install overlapping Pi user/project adapters or a duplicate `openmerit` MCP entry. The installer reports conflicts rather than overwriting edited or unowned files.
-
-The adapter connects Scout through Pi's native MCP and supplies the shared Scout rule and skill. Pi owns tool discovery, tool execution, model choice, permissions, and sessions. Scout recommends application-model candidates; it does not execute those candidates or change Pi's own model. There are no `/openmerit` lifecycle commands, automatic evaluation setup, scheduler, or LaunchAgent in this adapter.
-
-## Check, update, or remove Pi setup
-
-```sh
-npx -y openmerit@latest status --client pi --scope user --check
-npx -y openmerit@latest doctor --client pi --scope user
-npx -y openmerit@latest remove --client pi --scope user
-```
-
-Use `--scope project` from the original project root for a project installation. `login` and `logout` accept the same `--client` and `--scope` flags. These commands target that installation, not another client's connection. Updating Pi setup requires explicitly rerunning `install` and starting a new session; no Pi auto-update hooks are installed. Installing or updating the npm package alone does not reconfigure Pi.
-
-See [the Pi extension guide](pi-extension.md) for installed paths, migration from Pi 0.87, and SDK embedding. Use [troubleshooting](troubleshooting.md) for setup failures.
-
-## Evaluate application changes
-
-The standalone evaluation CLI is retired in npm 0.3.0, and the legacy JSON recommendation API went offline with the Scout serving deploy of 5 November 2026. Scout guidance is not measured application quality; use your own task checks and provider budget controls. See [retirement details](agent-evaluations.md).

package/docs/index.md

@@ -1,25 +0,0 @@
-# OpenMerit documentation
-
-These maintained Markdown guides describe Scout setup and model-selection workflows. The policy, protected memo, Scout service and npm package are released independently. A local documentation build does not publish a hosted change.
-
-## Discover model candidates
-
-Start with [installation and setup](getting-started.md). The [Scout beta](scout.md) provides conversational application-model guidance at [openmerit.ai/scout/](https://openmerit.ai/scout/) and through MCP for coding agents. The legacy prompt-only JSON recommendation endpoint is retired.
-
-## Connect Scout to Pi
-
-The thin Pi 1.5.0 adapter uses native MCP and shared Scout guidance. Pi owns tools, models, permissions and sessions; the adapter has no `/openmerit` lifecycle commands, evaluation scheduling, LaunchAgent or automatic updates.
-
-Follow [setup](getting-started.md#connect-scout-to-a-coding-agent) and [the Pi guide](pi-extension.md), including browser approval, per-client/scope credentials, explicit reinstall updates and SDK requirements. Registry setup requires OpenMerit 0.1.12 or newer.
-
-## Evaluate application changes
-
-Use your own representative task checks to evaluate model candidates. The [standalone evaluation CLI is retired in npm 0.3.0](agent-evaluations.md); existing local artifacts are not deleted.
-
-Follow [close the model-selection loop](scout-close-loop.md) to consult, measure,
-import aggregates and choose. Protected Langfuse setup requires npm 0.3.5 or newer
-and a matching hosted connector; npm 0.3.6 adds saved-key mapping updates.
-
-## Operate and troubleshoot
-
-[Commands](commands.md) lists the Scout and setup commands. The [Inference Terminal is retired in npm 0.3.0](inference-terminal.md); existing local files are not deleted. [Troubleshooting](troubleshooting.md), [security and data](security.md), and [current limitations](roadmap.md) explain setup failures and product boundaries. [Testing and validation](testing.md) distinguishes automated coverage from product evidence.