projectstore-claude 0.30.5 → 0.30.6

package/node_modules/projectstore/hooks/session-start.mjs

@@ -25,6 +25,7 @@ import {
   adoptHookInput,
   projectRoot,
   layoutPaths,
+  cachePaths,
   pickExisting,
   activeHarnessId,
   ensureStateRoot,
@@ -46,31 +47,48 @@ import {
 import { runStartupChecks } from "../scripts/doctor.mjs";
 import { resolveBinding, bindingOfferText } from "../scripts/worktree.mjs";
 
-// The marker lives under the harness's state directory; a legacy marker at
-// .claude/.projectstore-welcomed still counts while the window is open.
-function welcomedMarkerPath(proj) {
-  const p = layoutPaths(proj);
-  return pickExisting(p.welcomed(activeHarnessId()), p.legacy.welcomed);
+// The welcome has been seen, by this harness, when either marker exists: the
+// project's (state/<id>/welcomed, or the legacy .claude/.projectstore-welcomed
+// while the window is open) or the machine's (the user-level cache's
+// welcomed/<id>). Both branches read both; only the write follows the binding
+// (the story "Opening a project that is not bound writes nothing into it…",
+// decisions 1 and 2). So a project that holds a marker an unbound session of
+// 0.30.5 or earlier wrote is not welcomed again.
+//
+// The machine's marker is null with no cache root, and a home the platform
+// cannot answer for must not break startup either (skeleton spec, contract 17).
+function machineMarker(id) {
+  try {
+    return cachePaths().welcomed(id);
+  } catch {
+    return null;
+  }
 }
-function welcomedMarkerWritePath(proj) {
-  return layoutPaths(proj).welcomed(activeHarnessId());
+function welcomeSeen(proj, id) {
+  const p = layoutPaths(proj);
+  const machine = machineMarker(id);
+  return existsSync(pickExisting(p.welcomed(id), p.legacy.welcomed)) || (machine !== null && existsSync(machine));
 }
 
-// One-time orientation packet shown when projectstore first loads in a project.
-// Idempotent via a marker file at <project>/.claude/.projectstore-welcomed.
-// The welcome fires once per project, and a project can already be bound when
-// it does — a fresh install into a project someone bound first is the ordinary
+// One-time orientation packet shown when projectstore first loads. A bound
+// project shows it once per project; a project that is not bound shows it once
+// on this machine, because a user-scope install is on in every repository the
+// person opens, and writing a marker into each of them is a write into
+// projects nobody set up. A project can already be bound when the welcome
+// fires — a fresh install into a project someone bound first is the ordinary
 // case, not a corner (measured 2026-09-06: the first line a new user read told
 // them to bind a project whose vault the install preview had just named). So
-// the one instruction it carries branches on the binding; everything else is
-// the same message.
+// the one instruction it carries branches on the binding, and so does the
+// footer that says how often it appears; everything else is the same message.
 function buildWelcome(cfg = null) {
   const start =
     cfg && cfg.vault_path
       ? `**Already bound**: this project's vault is \`${truncFront(String(cfg.vault_path), PATH_CELL)}\`. Ask for what you want — the agent picks up commands like \`${commandForm("adr")}\` and \`${commandForm("epic")}\` from the conversation, and you approve every write. If the vault has no folders yet, \`${commandForm("scaffold")}\` lays them out.`
       : `**To start using it**: run \`${commandForm("bind", { args: "<vault-path>" })}\` and point it at an Obsidian vault (or any folder). After that, the agent will pick up commands like \`${commandForm("adr")}\` and \`${commandForm("epic")}\` from the conversation; you only approve the writes.`;
   return [
-    "# 👋 projectstore is loaded for the first time in this project",
+    cfg
+      ? "# 👋 projectstore is loaded for the first time in this project"
+      : "# 👋 projectstore is loaded for the first time on this machine",
     "",
     "**What it does**: turns the conversation's decisions into a structured Obsidian-friendly markdown vault — ADRs, epics, stories, runbooks, research. Agent-maintained, you approve every write.",
     "",
@@ -80,7 +98,7 @@ function buildWelcome(cfg = null) {
     // a git marketplace's toggle means nothing to a harness installed from npm.
     ...updateHint().welcome,
     "",
-    "_This message appears once per project._",
+    cfg ? "_This message appears once per project._" : "_This message appears once on this machine._",
     "",
     "_If projectstore helps you ship, a [GitHub star](https://github.com/SmartAndPoint/ProjectStore) helps others discover it. No pressure._",
     "",
@@ -88,17 +106,30 @@ function buildWelcome(cfg = null) {
 }
 
 function showWelcomeOnce(proj, cfg = null) {
-  if (existsSync(welcomedMarkerPath(proj))) return "";
+  const id = activeHarnessId();
+  if (welcomeSeen(proj, id)) return "";
   const text = buildWelcome(cfg);
   try {
-    const marker = welcomedMarkerWritePath(proj);
-    // The state directory's own .gitignore, header included, even in an
-    // unbound project — and no sessions/ there: it is how a project uninstall
-    // recognises this marker as ours (install spec contract 13, as amended by
-    // the shell-fetch story).
-    ensureStateRoot(proj);
-    mkdirSync(dirname(marker), { recursive: true });
-    writeFileSync(marker, new Date().toISOString() + "\n", "utf8");
+    let marker = null;
+    if (cfg) {
+      // Bound: the project's marker, beside the launcher (layout spec contract
+      // 5). The state directory's own .gitignore comes with it, header
+      // included, and no sessions/: it is how a project uninstall recognises
+      // this marker as ours (install spec contract 13, as amended by the
+      // shell-fetch story).
+      ensureStateRoot(proj);
+      marker = layoutPaths(proj).welcomed(id);
+    } else {
+      // Not bound: the machine's marker, and nothing in the project. With no
+      // cache root (no usable home) nothing is written and the welcome shows
+      // again next time — startup never breaks over it (skeleton spec,
+      // contract 17).
+      marker = machineMarker(id);
+    }
+    if (marker) {
+      mkdirSync(dirname(marker), { recursive: true });
+      writeFileSync(marker, new Date().toISOString() + "\n", "utf8");
+    }
   } catch {}
   return text;
 }

package/node_modules/projectstore/package.json

@@ -1,6 +1,6 @@
 {
   "name": "projectstore",
-  "version": "0.30.5",
+  "version": "0.30.6",
   "description": "Your agent runs the project through a verified loop: task → artifact (ADR / spec / epic / story) → adversarial critic → backlog → planner → reviewer → done. Plain markdown in git — any model can pick the project up tomorrow.",
   "keywords": [
     "project-management",
@@ -17,7 +17,7 @@
     "agentic",
     "ai-agents"
   ],
-  "homepage": "https://github.com/SmartAndPoint/ProjectStore#readme",
+  "homepage": "https://projectstore.dev",
   "bugs": {
     "url": "https://github.com/SmartAndPoint/ProjectStore/issues"
   },
@@ -60,21 +60,20 @@
   "scripts": {
     "test": "node --test --import ./tests/fixtures/hermetic.mjs tests/*.test.mjs",
     "guard": "node scripts/version-guard.mjs",
+    "directory:check": "node packaging/directory-guard.mjs",
     "packlist": "node scripts/version-guard.mjs --write-packlist",
     "adapters": "node scripts/build-adapters.mjs --write",
     "adapters:check": "node scripts/build-adapters.mjs --check",
     "shells": "node packaging/shells.mjs --write",
     "shells:check": "node packaging/shells.mjs --check",
     "shells:build": "node packaging/shells.mjs --build --out dist",
-    "release:check": "npm run adapters:check && npm run guard && npm run shells:check && npm run lint && npm run format:check && npm test && npm pack --dry-run",
-    "lint": "eslint --max-warnings 0 bin scripts \"hooks/*.mjs\" \"packaging/**/*.mjs\" \"tests/**/*.mjs\" eslint.config.mjs",
-    "format": "prettier --write bin scripts \"hooks/*.mjs\" \"packaging/**/*.mjs\" \"tests/**/*.mjs\" eslint.config.mjs",
-    "format:check": "prettier --check bin scripts \"hooks/*.mjs\" \"packaging/**/*.mjs\" \"tests/**/*.mjs\" eslint.config.mjs"
-  },
-  "devDependencies": {
-    "@eslint/js": "10.0.1",
-    "eslint": "10.12.0",
-    "eslint-plugin-n": "18.4.1",
-    "prettier": "3.9.10"
+    "release:check": "npm run adapters:check && npm run guard && npm run directory:check && npm run shells:check && npm run lint && npm run format:check && npm test && npm pack --dry-run",
+    "lint:setup": "npm ci --prefix tools/lint",
+    "prelint": "node tools/lint/setup-check.mjs",
+    "preformat": "node tools/lint/setup-check.mjs",
+    "preformat:check": "node tools/lint/setup-check.mjs",
+    "lint": "node tools/lint/node_modules/eslint/bin/eslint.js --max-warnings 0 bin scripts \"hooks/*.mjs\" \"packaging/**/*.mjs\" \"tests/**/*.mjs\" eslint.config.mjs tools/lint/eslint.config.mjs tools/lint/setup-check.mjs",
+    "format": "node tools/lint/node_modules/prettier/bin/prettier.cjs --write bin scripts \"hooks/*.mjs\" \"packaging/**/*.mjs\" \"tests/**/*.mjs\" eslint.config.mjs tools/lint/eslint.config.mjs tools/lint/setup-check.mjs",
+    "format:check": "node tools/lint/node_modules/prettier/bin/prettier.cjs --check bin scripts \"hooks/*.mjs\" \"packaging/**/*.mjs\" \"tests/**/*.mjs\" eslint.config.mjs tools/lint/eslint.config.mjs tools/lint/setup-check.mjs"
   }
 }

package/node_modules/projectstore/scripts/binding.mjs

@@ -20,7 +20,7 @@
 // project's decisions, not the vault's.
 //
 // Never reads ambient cwd or ambient env: the caller resolves the project
-// (cli.mjs's resolveProject) and supplies the author. Normative: the CLI
+// (verbs.mjs's resolveProject) and supplies the author. Normative: the CLI
 // story's slice-2 plan (PS-CORE); the fresh config's keys mirror
 // commands/bind.md step 3 (a test pins the two together).
 //

package/node_modules/projectstore/scripts/build-adapters.mjs

@@ -251,7 +251,39 @@ function renderRole(file) {
   const { data, body } = frontmatter(read(file), file);
   const role = file.split("/").pop().replace(/\.md$/, "");
   const name = renderedName("agents", role);
-  const orchestration = `## Codex orchestration\n\nThis is a role-orchestration skill, not a native agent registration. Resolve the\nrole's model and effort by running:\n\n\`\`\`bash\nnode "\${PROJECTSTORE_CORE_ROOT}/bin/projectstore.mjs" agents model ${role} --json --project "$PWD"\n\`\`\`\n\nSpawn a collaboration agent for the bounded task. If the result names a model,\npass that model and use an empty or bounded context fork; otherwise inherit the\ncurrent model. If the result names an effort, pass it as \`${effortParam()}\`,\nwith or without a model; otherwise pass none. Give the spawned agent the role\ncontract below and the exact artifact/diff it must inspect. Wait for its final\nresult.\n\n## Role contract\n\n`;
+  // The spawn sentences name the fields and the value, verbatim: "if the
+  // result names a model, pass that model" let a parent read "that model" as
+  // its own, and pass it in 2 of 3 runs (the story "Codex role skills pass the
+  // model the core names, verbatim", PS-HARNESS). No example slug: the failure
+  // is a substituted model name, and an example is one more name to copy.
+  const orchestration = `## Codex orchestration
+
+This is a role-orchestration skill, not a native agent registration. Resolve the
+role's model and effort by running:
+
+\`\`\`bash
+node "\${PROJECTSTORE_CORE_ROOT}/bin/projectstore.mjs" agents model ${role} --json --project "$PWD"
+\`\`\`
+
+Spawn a collaboration agent for the bounded task. Its model and effort are the
+two fields that command printed, \`result.model\` and \`result.effort\`, passed
+verbatim:
+
+- If \`result.model\` is a string, pass \`result.model\` exactly as \`model\`: the
+  string the command printed, even when it names the model you are running
+  on. Never substitute your own model for it. Use an empty or bounded context
+  fork.
+- If \`result.model\` is \`null\`, pass no model at all, not even your own; the
+  agent inherits the current model.
+- If \`result.effort\` is a string, pass it as \`${effortParam()}\`, verbatim,
+  with or without a model. If \`result.effort\` is \`null\`, pass none.
+
+Give the spawned agent the role contract below and the exact artifact/diff it
+must inspect. Wait for its final result.
+
+## Role contract
+
+`;
   const description = (data.description || `Run the ProjectStore ${role} role in a fresh collaboration agent.`).replace(
     /^(?:Opus|Sonnet) \([a-z]+-effort\)\s+/,
     "",
@@ -267,14 +299,23 @@ export function renderHooks(manifest, root = ROOT) {
   if (!hasBand(manifest)) delete source.modules;
   const post = source.hooks?.PostToolUse || [];
   for (const group of post) if (group.matcher) group.matcher = (manifest.tools?.write_tools || []).join("|");
+  const sourceRoot = "${" + SOURCE.runtime.plugin_root_env + "}";
+  const targetRoot = "${" + manifest.runtime.plugin_root_env + "}";
+  // The source may write its root bare, quote the whole path ("${ROOT}/x") or
+  // quote the variable alone ("${ROOT}"/x): the host's two documentation pages
+  // show the last two. Codex keys hook trust to the rendered command text, so
+  // all three render the one command, and a re-quoted source cannot ask every
+  // Codex user to trust the hooks again (the story "Every hook command quotes
+  // its plugin root…", PS-DIRECTORY, decision 2).
+  const r = escapeRe(sourceRoot);
+  const sourceCommand = new RegExp(`^node (?:"${r}/([^"\\s]+)"|"${r}"/([^"\\s]+)|${r}/([^"\\s]+))$`);
   const rewrite = (value) => {
     if (Array.isArray(value)) return value.map(rewrite);
     if (value && typeof value === "object")
       return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, rewrite(v)]));
     if (typeof value !== "string") return value;
-    const sourceRoot = "${" + SOURCE.runtime.plugin_root_env + "}";
-    const targetRoot = "${" + manifest.runtime.plugin_root_env + "}";
-    const command = value.startsWith(`node ${sourceRoot}/`) ? value.slice(`node ${sourceRoot}/`.length) : null;
+    const m = sourceCommand.exec(value);
+    const command = m ? m[1] || m[2] || m[3] : null;
     return command
       ? `node "${targetRoot}/node_modules/projectstore/${command}"`
       : value.replaceAll(sourceRoot, `${targetRoot}/node_modules/projectstore`);