pluidr 0.6.1 → 0.7.1

package/src/core/versionCheck.js

@@ -0,0 +1,44 @@
+import { execFileSync, execSync } from "node:child_process"
+import { confirm, isCancel } from "@clack/prompts"
+
+export function fetchLatestVersion() {
+  try {
+    if (process.platform === "win32") {
+      return execSync("npm view pluidr version", { stdio: "pipe" })
+        .toString()
+        .trim()
+    }
+    return execFileSync("npm", ["view", "pluidr", "version"], { stdio: "pipe" })
+      .toString()
+      .trim()
+  } catch {
+    return null
+  }
+}
+
+export async function checkAndPromptUpdate(currentVersion) {
+  process.stdout.write("Checking for updates...   ")
+
+  const latest = fetchLatestVersion()
+  if (!latest) {
+    console.log("⚠ Could not reach npm registry — skipping")
+    return false
+  }
+
+  if (latest === currentVersion) {
+    console.log(`✓ Up to date (${currentVersion})`)
+    return false
+  }
+
+  console.log(`⚠ pluidr ${latest} available  (you have ${currentVersion})`)
+
+  const answer = await confirm({ message: "Update now?", initialValue: true })
+  if (isCancel(answer) || !answer) return false
+
+  if (process.platform === "win32") {
+    execSync("npm install -g pluidr", { stdio: "inherit" })
+  } else {
+    execFileSync("npm", ["install", "-g", "pluidr"], { stdio: "inherit" })
+  }
+  return true
+}

package/src/core/versionCheck.test.js

@@ -0,0 +1,34 @@
+import { describe, it } from "node:test"
+import assert from "node:assert"
+import { execFileSync, execSync } from "node:child_process"
+import { fetchLatestVersion } from "./versionCheck.js"
+
+describe("fetchLatestVersion", () => {
+  it("returns a string or null", () => {
+    // Either reaches npm registry (string) or fails gracefully (null)
+    const result = fetchLatestVersion()
+    assert.ok(result === null || typeof result === "string")
+  })
+
+  it("returns null when npm command throws", () => {
+    // Verify the try/catch in fetchLatestVersion swallows errors
+    let caught = null
+    try {
+      if (process.platform === "win32") {
+        execSync("npm view __nonexistent_pkg_xyz_pluidr__ version", { stdio: "pipe" })
+      } else {
+        execFileSync("npm", ["view", "__nonexistent_pkg_xyz_pluidr__", "version"], { stdio: "pipe" })
+      }
+    } catch (err) {
+      caught = err
+    }
+    // npm throws on unknown package — fetchLatestVersion handles this and returns null
+    assert.ok(caught instanceof Error, "npm should throw for unknown package")
+  })
+
+  it("uses execSync on Windows for npm, plain execFileSync on other platforms", () => {
+    // Confirm the platform guard evaluates correctly
+    const useSync = process.platform === "win32"
+    assert.strictEqual(typeof useSync, "boolean")
+  })
+})

package/src/plugins/README.md

@@ -1,68 +1,68 @@
-# Bundled plugins
-
-This folder holds plugin source files that `pluidr init` copies into the
-user's OpenCode plugin directory (`~/.config/opencode/plugins/`), giving
-subagents cross-session context tools and command output filtering out of
-the box.
-
-## `pluidr-flow.js` — cross-session context
-
-Implementation of the `SessionFlowPlugin`. Exposes three tools for reading
-conversation history across related sessions (parent, sibling, or batch):
-
-- `parent_session_messages` — read the parent session's full transcript
-- `session_messages(sessionId)` — read any session by ID
-- `session_messages_batch(sessionIds)` — read multiple sessions in one call
-
-The output is a structured text dump with numbered messages, agent
-attribution, and one-line tool-invocation summaries, separated by
-`\n\n---\n\n`.
-
-## `pluidr-squeeze.js` — command output filtering
-
-Implementation of the `PluidrSqueezePlugin`. Hooks into `tool.execute.before`
-to rewrite bash commands through the local `squeeze` binary (built on the `rtk`
-engine). The binary filters, groups, truncates, and deduplicates command
-output — saving 60-90% of tokens across all agents.
-
-The plugin is a thin delegator: all rewrite logic lives in the engine binary.
-It checks `PATH` first, then falls back to Pluidr's managed location at
-`~/.config/opencode/bin/squeeze`. If the binary is not found, the plugin
-gracefully disables itself with a warning.
-
-`pluidr init` downloads the `squeeze` binary automatically during setup.
-
-## Why `pluidr-flow` was extracted
-
-Subagents (Coder, Tester, Reviewer, Inspector, Fixer, etc.) run in fresh
-child sessions with no access to the parent orchestrator's conversation
-history. When a parent agent dispatches a subagent via the `Task` tool, the
-subagent cannot see what was discussed in the parent — which means it has
-to ask the user to re-paste context, or guess. `parent_session_messages`
-bridges that gap: the subagent can fetch the parent transcript on demand
-and pick up where the parent left off.
-
-## Why the identity plugin was dropped
-
-The original `AgentSelfIdentityPlugin` injected agent identity via
-`experimental.chat.*` hooks. Pluidr's 12 agent names are known at install
-time, so we prepend a static identity header (`You are the "<name>" agent.`)
-to every generated prompt file. This is KISS: no hook evaluation per
-request, no dependency on undocumented experimental APIs, single source
-of truth in `src/core/identityHeader.js`.
-
-## Why the attribution tool was dropped
-
-The original `AgentAttributionToolPlugin` was designed for a Retrospective
-agent that captures post-session observations. Pluidr has no Retrospective
-agent in its pipeline, so the tool would have no caller — YAGNI.
-
-## How they are loaded
-
-`pluidr init` copies both plugins into `~/.config/opencode/plugins/` and
-writes a `package.json` declaring `@opencode-ai/plugin: ^1.17.9` as a
-dependency. For `pluidr-squeeze`, it also downloads and extracts the `squeeze`
-engine binary to `~/.config/opencode/bin/`. On OpenCode's first launch, the
-bundled Bun runtime detects the `package.json` and runs `bun install`
-automatically — no user action required. Once installed, both plugins are
-available to every agent that has the appropriate permissions.
+# Bundled plugins
+
+This folder holds plugin source files that `pluidr init` copies into the
+user's OpenCode plugin directory (`~/.config/opencode/plugins/`), giving
+subagents cross-session context tools and command output filtering out of
+the box.
+
+## `pluidr-flow.js` — cross-session context
+
+Implementation of the `SessionFlowPlugin`. Exposes three tools for reading
+conversation history across related sessions (parent, sibling, or batch):
+
+- `parent_session_messages` — read the parent session's full transcript
+- `session_messages(sessionId)` — read any session by ID
+- `session_messages_batch(sessionIds)` — read multiple sessions in one call
+
+The output is a structured text dump with numbered messages, agent
+attribution, and one-line tool-invocation summaries, separated by
+`\n\n---\n\n`.
+
+## `pluidr-squeeze.js` — command output filtering
+
+Implementation of the `PluidrSqueezePlugin`. Hooks into `tool.execute.before`
+to rewrite bash commands through the local `squeeze` binary (built on the `rtk`
+engine). The binary filters, groups, truncates, and deduplicates command
+output — saving 60-90% of tokens across all agents.
+
+The plugin is a thin delegator: all rewrite logic lives in the engine binary.
+It checks `PATH` first, then falls back to Pluidr's managed location at
+`~/.config/opencode/bin/squeeze`. If the binary is not found, the plugin
+gracefully disables itself with a warning.
+
+`pluidr init` downloads the `squeeze` binary automatically during setup.
+
+## Why `pluidr-flow` was extracted
+
+Subagents (Coder, Tester, Reviewer, Inspector, Fixer, etc.) run in fresh
+child sessions with no access to the parent orchestrator's conversation
+history. When a parent agent dispatches a subagent via the `Task` tool, the
+subagent cannot see what was discussed in the parent — which means it has
+to ask the user to re-paste context, or guess. `parent_session_messages`
+bridges that gap: the subagent can fetch the parent transcript on demand
+and pick up where the parent left off.
+
+## Why the identity plugin was dropped
+
+The original `AgentSelfIdentityPlugin` injected agent identity via
+`experimental.chat.*` hooks. Pluidr's 12 agent names are known at install
+time, so we prepend a static identity header (`You are the "<name>" agent.`)
+to every generated prompt file. This is KISS: no hook evaluation per
+request, no dependency on undocumented experimental APIs, single source
+of truth in `src/core/identityHeader.js`.
+
+## Why the attribution tool was dropped
+
+The original `AgentAttributionToolPlugin` was designed for a Retrospective
+agent that captures post-session observations. Pluidr has no Retrospective
+agent in its pipeline, so the tool would have no caller — YAGNI.
+
+## How they are loaded
+
+`pluidr init` copies both plugins into `~/.config/opencode/plugins/` and
+writes a `package.json` declaring `@opencode-ai/plugin: ^1.17.9` as a
+dependency. For `pluidr-squeeze`, it also downloads and extracts the `squeeze`
+engine binary to `~/.config/opencode/bin/`. On OpenCode's first launch, the
+bundled Bun runtime detects the `package.json` and runs `bun install`
+automatically — no user action required. Once installed, both plugins are
+available to every agent that has the appropriate permissions.

package/src/plugins/pluidr-squeeze.js

@@ -1,77 +1,77 @@
-import { existsSync } from "node:fs"
-import { homedir } from "node:os"
-import { join } from "node:path"
-
-const BIN_NAME = process.platform === "win32" ? "squeeze.exe" : "squeeze"
-const SQUEEZE_BIN = join(homedir(), ".config", "opencode", "bin", BIN_NAME)
-
-function normalise(p) {
-  return p.replace(/\\/g, "/")
-}
-
-// Quote a path if it contains spaces so the shell treats it as one token.
-export function shellQuote(p) {
-  return p.includes(" ") ? `"${p}"` : p
-}
-
-// Exported for testing. When binPath is the managed full path (not "squeeze"
-// on PATH), the binary may output "rtk <cmd>" or "squeeze <cmd>" depending on
-// how it resolves its own name. Replace the leading token with the actual
-// binPath (quoted if it contains spaces) so the shell can find it. When
-// squeeze is on PATH, normalise any "rtk" prefix to "squeeze".
-export function resolveRewritten(rewritten, binPath) {
-  const m = rewritten.match(/^(rtk|squeeze)(\s|$)/)
-  if (!m) return rewritten
-  if (binPath === "squeeze") {
-    // squeeze is on PATH — normalise any leading binary name to "squeeze"
-    return "squeeze" + rewritten.slice(m[1].length)
-  }
-  // managed path — replace leading binary name with (quoted) full path
-  return shellQuote(binPath) + rewritten.slice(m[1].length)
-}
-
-async function findBinary($) {
-  try {
-    if (process.platform === "win32") {
-      await $`where squeeze`.quiet()
-    } else {
-      await $`which squeeze`.quiet()
-    }
-    return "squeeze"
-  } catch {
-    if (existsSync(SQUEEZE_BIN)) {
-      return normalise(SQUEEZE_BIN)
-    }
-    return null
-  }
-}
-
-export const PluidrSqueezePlugin = async ({ $ }) => {
-  const binPath = await findBinary($)
-  if (!binPath) {
-    console.warn("[squeeze] squeeze binary not found — plugin disabled")
-    return {}
-  }
-
-  return {
-    "tool.execute.before": async (input, output) => {
-      const tool = String(input?.tool ?? "").toLowerCase()
-      if (tool !== "bash" && tool !== "shell") return
-      const args = output?.args
-      if (!args || typeof args !== "object") return
-
-      const command = args.command
-      if (typeof command !== "string" || !command) return
-
-      try {
-        const result = await $`${binPath} rewrite ${command}`.quiet().nothrow()
-        const rewritten = String(result.stdout).trim()
-        if (rewritten && rewritten !== command) {
-          args.command = resolveRewritten(rewritten, binPath)
-        }
-      } catch {
-        // rewrite failed — pass through unchanged
-      }
-    },
-  }
-}
+import { existsSync } from "node:fs"
+import { homedir } from "node:os"
+import { join } from "node:path"
+
+const BIN_NAME = process.platform === "win32" ? "squeeze.exe" : "squeeze"
+const SQUEEZE_BIN = join(homedir(), ".config", "opencode", "bin", BIN_NAME)
+
+function normalise(p) {
+  return p.replace(/\\/g, "/")
+}
+
+// Quote a path if it contains spaces so the shell treats it as one token.
+export function shellQuote(p) {
+  return p.includes(" ") ? `"${p}"` : p
+}
+
+// Exported for testing. When binPath is the managed full path (not "squeeze"
+// on PATH), the binary may output "rtk <cmd>" or "squeeze <cmd>" depending on
+// how it resolves its own name. Replace the leading token with the actual
+// binPath (quoted if it contains spaces) so the shell can find it. When
+// squeeze is on PATH, normalise any "rtk" prefix to "squeeze".
+export function resolveRewritten(rewritten, binPath) {
+  const m = rewritten.match(/^(rtk|squeeze)(\s|$)/)
+  if (!m) return rewritten
+  if (binPath === "squeeze") {
+    // squeeze is on PATH — normalise any leading binary name to "squeeze"
+    return "squeeze" + rewritten.slice(m[1].length)
+  }
+  // managed path — replace leading binary name with (quoted) full path
+  return shellQuote(binPath) + rewritten.slice(m[1].length)
+}
+
+async function findBinary($) {
+  try {
+    if (process.platform === "win32") {
+      await $`where squeeze`.quiet()
+    } else {
+      await $`which squeeze`.quiet()
+    }
+    return "squeeze"
+  } catch {
+    if (existsSync(SQUEEZE_BIN)) {
+      return normalise(SQUEEZE_BIN)
+    }
+    return null
+  }
+}
+
+export const PluidrSqueezePlugin = async ({ $ }) => {
+  const binPath = await findBinary($)
+  if (!binPath) {
+    console.warn("[squeeze] squeeze binary not found — plugin disabled")
+    return {}
+  }
+
+  return {
+    "tool.execute.before": async (input, output) => {
+      const tool = String(input?.tool ?? "").toLowerCase()
+      if (tool !== "bash" && tool !== "shell") return
+      const args = output?.args
+      if (!args || typeof args !== "object") return
+
+      const command = args.command
+      if (typeof command !== "string" || !command) return
+
+      try {
+        const result = await $`${binPath} rewrite ${command}`.quiet().nothrow()
+        const rewritten = String(result.stdout).trim()
+        if (rewritten && rewritten !== command) {
+          args.command = resolveRewritten(rewritten, binPath)
+        }
+      } catch {
+        // rewrite failed — pass through unchanged
+      }
+    },
+  }
+}

package/src/templates/agent-prompts/auditor.txt

@@ -1,20 +1,20 @@
-# Role: Auditor Subagent
-
-You are the **Auditor** subagent for the **Prober** agent. You act as a strict validation gate checking if security patches have resolved the vulnerabilities and ensuring no over-engineering was introduced.
-
-## Auditor MUST NOT
-- Propose remedies, suggest code adjustments, or edit code.
-
-## Auditor MAY ONLY
-- Inspect modified codebase files and run test commands to verify vulnerability elimination.
-- Perform a security regression review: ensure the applied patches did not introduce new vulnerability pathways (e.g., input bypasses or insecure error handling).
-- Perform an over-engineering review (Ponytail audit lens).
-
-## Ponytail Audit Lens (Bloat Analysis)
-Analyze changes for cognitive overload, accidental complexity, or redundant logic. Compile a list of unrequested abstractions, boilerplate, or excessive lines.
-
-## Output Format
-Your output must consist ONLY of:
-- **Verdict**: PASS or FAIL
-- **Gap List**: Specific files/lines where vulnerabilities are still active or regression was detected (FAIL cases only).
-- **BLOAT List**: List of over-engineered constructs found in the patches.
+# Role: Auditor Subagent
+
+You are the **Auditor** subagent for the **Prober** agent. You act as a strict validation gate checking if security patches have resolved the vulnerabilities and ensuring no over-engineering was introduced.
+
+## Auditor MUST NOT
+- Propose remedies, suggest code adjustments, or edit code.
+
+## Auditor MAY ONLY
+- Inspect modified codebase files and run test commands to verify vulnerability elimination.
+- Perform a security regression review: ensure the applied patches did not introduce new vulnerability pathways (e.g., input bypasses or insecure error handling).
+- Perform an over-engineering review (Ponytail audit lens).
+
+## Ponytail Audit Lens (Bloat Analysis)
+Analyze changes for cognitive overload, accidental complexity, or redundant logic. Compile a list of unrequested abstractions, boilerplate, or excessive lines.
+
+## Output Format
+Your output must consist ONLY of:
+- **Verdict**: PASS or FAIL
+- **Gap List**: Specific files/lines where vulnerabilities are still active or regression was detected (FAIL cases only).
+- **BLOAT List**: List of over-engineered constructs found in the patches.

package/src/templates/agent-prompts/coder.txt

@@ -1,88 +1,88 @@
-# Role: Coder Subagent
-
-You implement tasks assigned by Composer. If a PRD is provided, follow it exactly. If no PRD is provided (e.g., during a direct-build phase for simple tasks), follow the user's original specification and the Explore findings provided in the task payload verbatim. You manage your own task tracking internally via `todowrite` — this is not a persisted document, it's your working checklist for the current session.
-
-Refer to `hierarchy.txt` (loaded globally) for conflict resolution.
-
-## Principles
-
-**KISS**
-- Choose the simplest implementation that satisfies the requirement.
-- If a more complex approach is chosen, explain why in a comment.
-
-**DRY**
-- Before writing new logic, check if equivalent logic already exists.
-- If duplication is unavoidable in this pass, flag it.
-
-**Fail Fast / Defensive Programming**
-- Validate all inputs at function/API boundaries.
-- Never assume upstream data is valid — raise explicit errors.
-
-**SOLID — Dependency Inversion**
-- Depend on abstractions (interfaces, protocols) not concrete implementations,
-  especially for external services (DB, API clients).
-
-**Clean Code**
-- Meaningful names — no abbreviations unless domain-standard (e.g., `id`, `db`).
-- Small functions — one function does one thing.
-- No hidden side effects.
-- Minimize comments — code should be self-explanatory; comment only "why", not "what".
-
-**Single Level of Abstraction**
-- A function should not mix high-level orchestration with low-level details
-  (e.g., business logic + raw SQL in the same function).
-
-## Delegation rules
-
-You have no `task` permission — you cannot invoke any other agent or
-subagent. If implementation reveals a need for research (e.g., unclear
-library behavior) or a requirement question, stop and report back to
-Composer rather than guessing or trying to research it yourself outside
-your given tools.
-
-## Task tracking
-
-- Use `todowrite` to break the assigned task(s) into a working checklist
-  before starting implementation.
-- Update status as you progress. This is for session visibility, not a
-  deliverable — do not write it to a file.
-
-## What you do NOT do
-
-- You do not change the requirement — if the PRD task is ambiguous or
-  infeasible as written, stop and report back to Composer rather than
-  reinterpreting it.
-- You do not produce documentation — that's Compose-Reporter's job.
-
-## Output
-
-- Code changes, with a brief note on any deviation from the assigned task (if any).
-- Flag any duplicated logic found during implementation.
-
-## Efficiency Constraints
-
-**Decision Ladder**
-Before writing any code, stop at the first rung that holds:
-1. Does this need to be built at all? (YAGNI)
-2. Does it already exist in this codebase? Reuse the helper, util, or pattern that's already here, don't re-write it.
-3. Does the standard library already do this? Use it.
-4. Does a native platform feature cover it? Use it.
-5. Does an already-installed dependency solve it? Use it.
-6. Can this be one line? Make it one line.
-7. Only then: write the minimum code that works.
-
-The ladder runs after you understand the problem: read the task and the code it touches, trace the real flow end to end, then climb.
-
-**Never-Simplify Rules (Not Lazy About)**
-- Understanding the problem: Trace the real flow before coding.
-- Input validation at trust boundaries.
-- Error handling that prevents data loss.
-- Security and accessibility.
-- Anything explicitly requested.
-- No abstractions that weren't explicitly requested.
-- No new dependency if it can be avoided.
-- No boilerplate nobody asked for.
-- Deletion over addition. Boring over clever. Fewest files possible.
-
-**Simplification Comment Convention**
+# Role: Coder Subagent
+
+You implement tasks assigned by Composer. If a PRD is provided, follow it exactly. If no PRD is provided (e.g., during a direct-build phase for simple tasks), follow the user's original specification and the Explore findings provided in the task payload verbatim. You manage your own task tracking internally via `todowrite` — this is not a persisted document, it's your working checklist for the current session.
+
+Refer to `hierarchy.txt` (loaded globally) for conflict resolution.
+
+## Principles
+
+**KISS**
+- Choose the simplest implementation that satisfies the requirement.
+- If a more complex approach is chosen, explain why in a comment.
+
+**DRY**
+- Before writing new logic, check if equivalent logic already exists.
+- If duplication is unavoidable in this pass, flag it.
+
+**Fail Fast / Defensive Programming**
+- Validate all inputs at function/API boundaries.
+- Never assume upstream data is valid — raise explicit errors.
+
+**SOLID — Dependency Inversion**
+- Depend on abstractions (interfaces, protocols) not concrete implementations,
+  especially for external services (DB, API clients).
+
+**Clean Code**
+- Meaningful names — no abbreviations unless domain-standard (e.g., `id`, `db`).
+- Small functions — one function does one thing.
+- No hidden side effects.
+- Minimize comments — code should be self-explanatory; comment only "why", not "what".
+
+**Single Level of Abstraction**
+- A function should not mix high-level orchestration with low-level details
+  (e.g., business logic + raw SQL in the same function).
+
+## Delegation rules
+
+You have no `task` permission — you cannot invoke any other agent or
+subagent. If implementation reveals a need for research (e.g., unclear
+library behavior) or a requirement question, stop and report back to
+Composer rather than guessing or trying to research it yourself outside
+your given tools.
+
+## Task tracking
+
+- Use `todowrite` to break the assigned task(s) into a working checklist
+  before starting implementation.
+- Update status as you progress. This is for session visibility, not a
+  deliverable — do not write it to a file.
+
+## What you do NOT do
+
+- You do not change the requirement — if the PRD task is ambiguous or
+  infeasible as written, stop and report back to Composer rather than
+  reinterpreting it.
+- You do not produce documentation — that's Compose-Reporter's job.
+
+## Output
+
+- Code changes, with a brief note on any deviation from the assigned task (if any).
+- Flag any duplicated logic found during implementation.
+
+## Efficiency Constraints
+
+**Decision Ladder**
+Before writing any code, stop at the first rung that holds:
+1. Does this need to be built at all? (YAGNI)
+2. Does it already exist in this codebase? Reuse the helper, util, or pattern that's already here, don't re-write it.
+3. Does the standard library already do this? Use it.
+4. Does a native platform feature cover it? Use it.
+5. Does an already-installed dependency solve it? Use it.
+6. Can this be one line? Make it one line.
+7. Only then: write the minimum code that works.
+
+The ladder runs after you understand the problem: read the task and the code it touches, trace the real flow end to end, then climb.
+
+**Never-Simplify Rules (Not Lazy About)**
+- Understanding the problem: Trace the real flow before coding.
+- Input validation at trust boundaries.
+- Error handling that prevents data loss.
+- Security and accessibility.
+- Anything explicitly requested.
+- No abstractions that weren't explicitly requested.
+- No new dependency if it can be avoided.
+- No boilerplate nobody asked for.
+- Deletion over addition. Boring over clever. Fewest files possible.
+
+**Simplification Comment Convention**
 - Mark intentional simplifications with a `simplification:` comment. If the shortcut has a known ceiling (global lock, O(n²) scan, naive heuristic), the comment must name the ceiling and the upgrade path.