projectstore-claude 0.30.6 → 0.30.7

package/node_modules/projectstore/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
       "name": "projectstore",
       "displayName": "projectstore",
       "description": "📚 Your agent runs the project through a verified loop: task → artifact (ADR · spec · epic · story) → adversarial critic → backlog → planner → reviewer → done. Plain markdown in an Obsidian-friendly vault, every write approved by you — and any model can pick the project up tomorrow.",
-      "version": "0.30.6",
+      "version": "0.30.7",
       "author": {
         "name": "Evgenii Konev",
         "email": "ekonev@smartandpoint.com",

package/node_modules/projectstore/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "projectstore",
   "displayName": "projectstore",
-  "version": "0.30.6",
+  "version": "0.30.7",
   "description": "Your agent runs the project through a verified loop: task → artifact (ADR / spec / epic / story) → adversarial critic → backlog → planner → reviewer → done. Plain markdown in git — any model can pick the project up tomorrow.",
   "author": {
     "name": "Evgenii Konev @ SmartAndPoint",

package/node_modules/projectstore/README.md

@@ -223,7 +223,7 @@ npx projectstore configure
 
 At a terminal it opens a settings menu that works like a monitor's: ↑ and ↓ move, → opens a group or a setting in a frame beside it, space chooses, ← goes back, and Enter shows the plan. A second Enter writes it. Under the frames, a few lines say what the row under the cursor means. The settings:
 
-- each agent's model and effort, per harness. Claude Code offers its aliases: `fable`, `opus`, `sonnet` and `haiku`. Codex offers its own list of models, with its descriptions. With `ANTHROPIC_API_KEY` set, each alias also names the newest model of its line. A list is kept for a day in projectstore's user cache, and "refresh the list" asks again. Each agent's effort sits under its model: Claude Code's levels, `low` to `max`, or the levels that Codex model lists. With none set, a Claude Code agent runs at its frontmatter's level (`max`, the clerk `low`) and a Codex one at its model's own default;
+- each agent's model and effort, per harness. Claude Code offers its aliases: `fable`, `opus`, `sonnet` and `haiku`. Codex offers its own list of models, with its descriptions, kept for a day in projectstore's user cache; "refresh the list" asks Codex again. Each agent's effort sits under its model: Claude Code's levels, `low` to `max`, or the levels that Codex model lists. With none set, a Claude Code agent runs at its frontmatter's level (`max`, the clerk `low`) and a Codex one at its model's own default;
 - the status line and the band above the prompt (Claude Code);
 - the vault's template language, the default author and tags;
 - the vault's spec policy and lifecycle gates.
@@ -393,7 +393,7 @@ The deep dive — real session files, measured payloads, how every mechanism wor
 
 ## What ProjectStore runs, writes, sends and fetches
 
-ProjectStore has no server, no account and no telemetry. It collects nothing about you, your project or your vault. Its own code makes three requests, the ones under "What it sends and fetches" below, and each one is made by a command you run, never by a hook. One program it runs makes a request of its own: Codex's model command, which refreshes Codex's catalog with your Codex login. This list covers everything in the package, and a [test](https://github.com/SmartAndPoint/ProjectStore/blob/main/tests/disclosure.test.mjs) fails when a shipped module that starts a program or makes a request is not accounted for here.
+ProjectStore has no server, no account and no telemetry. It collects nothing about you, your project or your vault, and it reads no credential from your environment. Its own code makes two requests, the ones under "What it sends and fetches" below, and each one is made by a command you run, never by a hook. One program it runs makes a request of its own: Codex's model command, which refreshes Codex's catalog with your Codex login. This list covers everything in the package, and a [test](https://github.com/SmartAndPoint/ProjectStore/blob/main/tests/disclosure.test.mjs) fails when a shipped module that starts a program or makes a request is not accounted for here.
 
 ### What it runs
 
@@ -420,7 +420,6 @@ ProjectStore never changes Claude Code's or Codex's permission settings.
 
 - **The npm registry**, `https://registry.npmjs.org/` or the registry your npm is set to. One `GET <registry>/projectstore` request with no credentials and a 2-second limit asks for the newest release. Setup, install and upgrade make it when they run from npm (npx or a global install) or from a git checkout. They never make it from the copy that Claude Code or Codex loads, and never in a dry run. The answer is kept for 24 hours, and `PROJECTSTORE_NO_UPDATE_CHECK=1` turns the request off.
 - **The Codex package.** The `npm install` above fetches `projectstore-codex` from the registry your npm is set to, with npm's own settings, only when setup, install or upgrade sets up Codex.
-- **Anthropic's model list**, `https://api.anthropic.com/v1/models`, or the same path under `$ANTHROPIC_BASE_URL` when that is set. Only the model menu of `configure` at a terminal sends it, only when `ANTHROPIC_API_KEY` is set, and only when the model list is missing or older than a day, or you ask to refresh it. The request carries your key in its `x-api-key` header and nothing else of yours. Only the model names, labels and families of the answer are kept, for a day. Without the variable nothing is sent, and the menu offers Claude Code's aliases.
 
 ProjectStore's own code sends nothing else: the hooks, the MCP server, the band and the status line open no connection. Two programs it runs may connect on their own. When the model menu reads Codex's list, `codex debug models` refreshes Codex's catalog with your Codex login. The status line command you had before is yours, and it runs as you set it.
 

package/node_modules/projectstore/harnesses/claude-code.json

@@ -649,30 +649,8 @@
           "description": "Follows the newest Haiku model: Claude Code resolves the alias when it starts the agent."
         }
       ],
-      "static_reason": "The enum above, in the order the menu lists it. A line the catalog below reports that this list lacks is never offered: a Claude Code release that adds an alias is named with `--set`, with the warning, until this list learns it.",
-      "catalogs": [
-        {
-          "kind": "http",
-          "source": "the Anthropic API",
-          "caption": "Anthropic API",
-          "url": "https://api.anthropic.com/v1/models?limit=1000",
-          "base_env": "ANTHROPIC_BASE_URL",
-          "path": "/v1/models?limit=1000",
-          "key_env": "ANTHROPIC_API_KEY",
-          "key_header": "x-api-key",
-          "headers": { "anthropic-version": "2023-06-01" },
-          "fields": {
-            "list": "data",
-            "id": "id",
-            "label": "display_name",
-            "family": "line",
-            "order": "created_at",
-            "order_desc": true,
-            "keep_when": { "lifecycle": "active" }
-          },
-          "reason": "Measured 2026-10-13: 14 models in 0.5–0.7 s, each with id, display_name, created_at, line (fable, opus, sonnet, haiku) and lifecycle. `line` is the family an alias follows, so the newest active entry of a line is the best local account of what that alias starts; Claude Code resolves the alias itself. Read only when a model list opens with a stale cache, or on refresh, and only with ANTHROPIC_API_KEY set; ANTHROPIC_BASE_URL, when set, is the base the key belongs to."
-        }
-      ]
+      "static_reason": "The enum above, in the order the menu lists it. It is the whole list: Anthropic's model list takes a key, and ProjectStore reads no credential from the environment (the 0.30.7 story, PS-DIRECTORY), so no catalog is declared and the menu asks nothing. A Claude Code release that adds an alias is named with `--set`, with the warning, until this list learns it.",
+      "catalogs": []
     }
   }
 }

package/node_modules/projectstore/package.json

@@ -1,6 +1,6 @@
 {
   "name": "projectstore",
-  "version": "0.30.6",
+  "version": "0.30.7",
   "description": "Your agent runs the project through a verified loop: task → artifact (ADR / spec / epic / story) → adversarial critic → backlog → planner → reviewer → done. Plain markdown in git — any model can pick the project up tomorrow.",
   "keywords": [
     "project-management",

package/node_modules/projectstore/scripts/configure-menu.mjs

@@ -444,16 +444,17 @@ function effortOptions(es, display, item, name, isDefault, levels, model, d, men
   return opts;
 }
 
-// The values frame's footer: the list's source and age, the host being
-// asked, or why nothing can be asked (the ADR, decisions 3 and 6).
+// The values frame's footer: the list's source and age, the catalog being
+// asked, or why nothing can be asked (the ADR, decisions 3 and 6). An alias
+// harness with no list says that its aliases are all it offers.
 function caption(cat, now) {
   const k = cat.known;
   if (!k) return null;
   const name = k.caption || k.live?.caption || "";
-  if (cat.busy) return { text: `asking ${k.live?.host || k.live?.caption || name}…`, busy: true };
+  if (cat.busy) return { text: `asking ${k.live?.caption || name}…`, busy: true };
   if (cat.error) return { text: `${k.live?.caption || name} · ${cat.error}` };
   if (k.at) return { text: `${name} · checked ${checkedWhen(k.at, now())}` };
-  if (k.why && k.spawnTakes === "alias") return { text: `aliases only · ${k.why}` };
+  if (k.spawnTakes === "alias") return { text: k.why ? `aliases only · ${k.why}` : "aliases only" };
   return k.why ? { text: k.why } : null;
 }
 
@@ -503,7 +504,9 @@ function modelOptions(h, display, item, cat, { isDefault, defaultNow, menu, now,
         section: opts.length ? undefined : "",
         description: k?.hidden?.has(v)
           ? `${display} hides it from its own picker. It is kept as it is.`
-          : `Not in ${source ? `${source}'s list` : "any list"}. It is kept as it is.`,
+          : k?.spawnTakes === "alias"
+            ? `Not one of ${display}'s aliases. It is kept as it is.`
+            : `Not in ${source ? `${source}'s list` : "any list"}. It is kept as it is.`,
       });
   // No free text where the spawn takes aliases: every other name fails at
   // spawn, and --set is the way to name one (the ADR, decision 5).
@@ -524,7 +527,7 @@ function modelOptions(h, display, item, cat, { isDefault, defaultNow, menu, now,
       description: cat.busy
         ? `Asking ${liveSource} for its list now.`
         : !k?.live
-          ? `Nothing to ask: ${k?.why || "this harness declares no list to read"}.`
+          ? `Nothing to ask: ${k?.why || (k.spawnTakes === "alias" ? `${display}'s list is its aliases` : "this harness declares no list to read")}.`
           : cat.error
             ? `The last ask failed: ${cat.error}. The list is as it was.`
             : `Asks ${liveSource} for its list now.${k.at ? ` Last checked ${checkedWhen(k.at, now())}.` : ""} A list is kept for a day, so opening it never waits on the network.`,
@@ -612,7 +615,6 @@ export async function runMenu(ctx) {
       home,
       now,
       signal: ac.signal,
-      ...(ctx.fetch ? { fetch: ctx.fetch } : {}),
       ...(ctx.spawn ? { spawn: ctx.spawn } : {}),
       ...(ctx.timers ? { timers: ctx.timers } : {}),
     }).then((r) => {

package/node_modules/projectstore/scripts/configure.mjs

@@ -949,7 +949,6 @@ export async function runConfigure(ctx) {
       now,
       path: tildeOf(f.project, f.home),
       dryRun,
-      fetch: ctx.fetch,
       spawn: ctx.spawn,
       timers: ctx.timers,
       review: (list) => {

package/node_modules/projectstore/scripts/doctor.mjs

@@ -109,8 +109,8 @@ import {
   hostRegistry,
   autoUpdateDefault,
 } from "./harness.mjs";
-// The pure reader, never models.mjs: that file holds a fetch, and the
-// SessionStart hook imports this one (the portability suite's hook fence).
+// The pure reader, never models.mjs: that file starts a catalog command, and
+// the SessionStart hook imports this one (the portability suite's hook fence).
 import { effortSpec } from "./model-spec.mjs";
 
 // A remedy used to interpolate the surface's harness variable here. It cannot:

package/node_modules/projectstore/scripts/model-spec.mjs

@@ -6,11 +6,12 @@
 //
 // Pure readers, split from models.mjs (which re-exports them) so a hook can
 // read the manifest without loading the module that reads a live catalog.
-// models.mjs holds a `fetch` that sends a key from the environment; doctor,
-// which the SessionStart hook imports, needs only effortSpec. The portability
-// suite fences every hook's imports off any module with a fetch call: the
-// story "The MCP server's entry reaches no install verb…", PS-DIRECTORY,
-// decision 4.
+// models.mjs starts a harness's catalog command as a subprocess, and reads
+// no credential from the environment (the 0.30.7 story, PS-DIRECTORY);
+// doctor, which the SessionStart hook imports, needs only effortSpec. The
+// portability suite fences every hook's imports off any module with a fetch
+// call, and holds models.mjs out of SessionStart's: the story "The MCP
+// server's entry reaches no install verb…", PS-DIRECTORY, decision 4.
 // This file imports nothing: keep it that way.
 
 export function modelSpec(manifest) {

package/node_modules/projectstore/scripts/models.mjs

@@ -31,9 +31,11 @@
 //   effortProblem(manifest)              → what is wrong with the block, or null
 //
 // Local reads are synchronous and cheap: the manifest, a `file` catalog, and
-// projectstore's own cache. A `command` or `http` catalog is read only by
-// readLive, which a menu starts in the background. env, home, now, fetch,
-// spawn and timers are parameters, so no test reads the machine.
+// projectstore's own cache. A `command` catalog is read only by readLive,
+// which a menu starts in the background. There is no `http` kind: this module
+// makes no request and reads no credential from the environment (the 0.30.7
+// story, PS-DIRECTORY). env, home, now, spawn and timers are parameters, so
+// no test reads the machine.
 
 import { spawn as spawnChild } from "node:child_process";
 import { mkdirSync, readFileSync, statSync } from "node:fs";
@@ -44,8 +46,8 @@ import { writeFileAtomic } from "./lib.mjs";
 import { modelSpec, effortSpec } from "./model-spec.mjs";
 
 // The two block readers live in model-spec.mjs, which imports nothing, so a
-// hook's imports reach them without reaching this file's fetch. Re-exported:
-// every caller that reads the catalog too keeps one import.
+// hook's imports reach them without reaching this file's subprocess.
+// Re-exported: every caller that reads the catalog too keeps one import.
 export { modelSpec, effortSpec };
 
 // A known list is fresh for a day (decision 3); a live read is bounded by 3 s.
@@ -162,6 +164,10 @@ export function modelCachePath(manifest, { env = process.env, home = homedir() }
   return cachePaths({ env, home }).models(manifest?.id);
 }
 
+// The cache is read only when a catalog the manifest declares names its
+// source: a cache an older release wrote from a catalog this one no longer
+// declares is ignored, never deleted, since opening a list writes nothing
+// (the ADR, decision 3; the 0.30.7 story, PS-DIRECTORY).
 function readCache(manifest, opts) {
   const p = modelCachePath(manifest, opts);
   if (!p) return null;
@@ -169,6 +175,9 @@ function readCache(manifest, opts) {
     const c = JSON.parse(readFileSync(p, "utf8"));
     const t = timeOf(c?.at);
     if (t === null || !Array.isArray(c.models)) return null;
+    const source = typeof c.source === "string" ? c.source : "";
+    const from = (modelSpec(manifest)?.catalogs || []).find((x) => x.source === source);
+    if (!from) return null;
     // Cleaned again: the cache is a file anyone can edit.
     const entries = c.models
       .filter((x) => x && typeof x.id === "string" && clean(x.id))
@@ -180,9 +189,7 @@ function readCache(manifest, opts) {
         hidden: Boolean(x.hidden),
         ...cachedLevels(x),
       }));
-    const source = typeof c.source === "string" ? c.source : "";
-    const from = (modelSpec(manifest)?.catalogs || []).find((x) => x.source === source);
-    return { at: t, source, caption: from?.caption || source, entries };
+    return { at: t, source, caption: from.caption || source, entries };
   } catch {
     return null;
   }
@@ -206,33 +213,11 @@ function readFileCatalog(manifest, spec, catalog, opts) {
   }
 }
 
-// Where an http catalog's key goes: the key's own base when the manifest
-// names a base variable and it is set, else the manifest's URL (the ADR,
-// decision 2). Never any other host.
-function urlOf(catalog, env) {
-  const base = catalog.base_env && env?.[catalog.base_env] ? String(env[catalog.base_env]).replace(/\/+$/, "") : null;
-  return base && catalog.path ? `${base}${catalog.path}` : catalog.url;
-}
-function hostOf(catalog, env) {
-  try {
-    return new URL(urlOf(catalog, env)).host;
-  } catch {
-    return null;
-  }
-}
-
-// The catalog a refresh asks: the first `command` or `http` one that can run
-// here — its key variable set, or its bin on PATH — or null, with why not.
+// The catalog a refresh asks: the first `command` one whose bin is on PATH,
+// or null, with why not.
 function liveCatalog(spec, env) {
   let why = null;
   for (const c of spec.catalogs || []) {
-    if (c.kind === "http") {
-      if (c.key_env && !(env && env[c.key_env])) {
-        why = why || `no ${c.key_env}`;
-        continue;
-      }
-      return { catalog: c, why: null, host: hostOf(c, env) };
-    }
     if (c.kind === "command") {
       const bin = Array.isArray(c.argv) ? c.argv[0] : null;
       if (!bin || !whichOnPath(bin, env || {})) {
@@ -315,7 +300,6 @@ export function knownModels(manifest, { env = process.env, home = homedir(), now
           source: live.catalog.source || "",
           caption: live.catalog.caption || live.catalog.source || "",
           kind: live.catalog.kind,
-          ...(live.host ? { host: live.host } : {}),
         }
       : null,
     why: live.why,
@@ -409,7 +393,10 @@ export function modelsProblem(manifest) {
   if (!Array.isArray(spec.catalogs)) return "catalogs is not a list";
   for (const c of spec.catalogs) {
     const fields = fieldsOf(spec, c);
-    if (!["file", "command", "http"].includes(c?.kind)) return `a catalog's kind is ${c?.kind}`;
+    // The kind 0.30.6 read a key from the environment with: refused by name
+    // (the 0.30.7 story, PS-DIRECTORY).
+    if (c?.kind === "http") return "an http catalog is not read: a catalog is a file or a command";
+    if (!["file", "command"].includes(c?.kind)) return `a catalog's kind is ${c?.kind}`;
     if (typeof c.source !== "string" || !c.source) return `a ${c.kind} catalog names no source`;
     if (!fields.list || !fields.id) return `the ${c.source} catalog names no list or id field`;
     if (typeof c.reason !== "string" || !c.reason) return `the ${c.source} catalog carries no reason`;
@@ -417,12 +404,6 @@ export function modelsProblem(manifest) {
       return `the ${c.source} file catalog's path is not under the harness home`;
     if (c.kind === "command" && (!Array.isArray(c.argv) || !c.argv.length || c.argv.some((a) => typeof a !== "string")))
       return `the ${c.source} command catalog has no argv`;
-    if (c.kind === "http") {
-      if (!/^https:\/\//.test(String(c.url))) return `the ${c.source} http catalog's url is not https`;
-      if (!c.key_env || !c.key_header) return `the ${c.source} http catalog names no key variable and header`;
-      if (c.base_env && !String(c.path || "").startsWith("/"))
-        return `the ${c.source} http catalog's path is not absolute`;
-    }
   }
   return null;
 }
@@ -461,72 +442,6 @@ export function effortProblem(manifest) {
   return null;
 }
 
-// One bounded fetch, settled by a timer whatever the request does after: the
-// pattern of convergence.mjs's request(). The key goes in its header and
-// nowhere else; nothing of the request is kept.
-function readHttp(catalog, { env, fetch, timers, timeoutMs, signal }) {
-  return new Promise((settle) => {
-    if (typeof fetch !== "function") return settle({ error: "no fetch in this Node" });
-    let done = false,
-      timer = null;
-    const ac = typeof AbortController === "function" ? new AbortController() : null;
-    const finish = (r) => {
-      if (done) return;
-      done = true;
-      if (timer !== null)
-        try {
-          timers.clearTimeout(timer);
-        } catch {}
-      settle(r);
-    };
-    timer = timers.setTimeout(() => {
-      timer = null;
-      try {
-        ac?.abort();
-      } catch {}
-      finish({ error: `no answer within ${timeoutMs / 1000} s` });
-    }, timeoutMs);
-    try {
-      timer?.unref?.();
-    } catch {}
-    signal?.addEventListener?.("abort", () => {
-      try {
-        ac?.abort();
-      } catch {}
-      finish({ error: "stopped" });
-    });
-    const url = urlOf(catalog, env);
-    const headers = { accept: "application/json", ...(catalog.headers || {}) };
-    if (catalog.key_env && catalog.key_header) headers[catalog.key_header] = String(env?.[catalog.key_env] || "");
-    Promise.resolve()
-      .then(() => fetch(url, { headers, ...(ac ? { signal: ac.signal } : {}) }))
-      .then(async (res) => {
-        if (!res || !res.ok) {
-          try {
-            Promise.resolve(res?.body?.cancel?.()).catch(() => {});
-          } catch {}
-          const status = res?.status ?? "error";
-          return finish({
-            error: status === 401 || status === 403 ? `the key was refused (HTTP ${status})` : `HTTP ${status}`,
-          });
-        }
-        const size = Number(res.headers?.get?.("content-length"));
-        if (Number.isFinite(size) && size > MAX_BYTES) {
-          try {
-            Promise.resolve(res?.body?.cancel?.()).catch(() => {});
-          } catch {}
-          return finish({ error: "the answer is too large" });
-        }
-        try {
-          finish({ body: await res.json() });
-        } catch {
-          finish({ error: "the answer is not JSON" });
-        }
-      })
-      .catch((e) => finish({ error: String(e?.cause?.code || e?.code || e?.message || "the request failed") }));
-  });
-}
-
 // One bounded run of a catalog command: its stdout as JSON. Asynchronous, so
 // a menu keeps drawing while it runs; killed at the bound.
 function readCommand(catalog, { env, spawn, timers, timeoutMs, signal }) {
@@ -604,8 +519,6 @@ export async function readLive(
     env = process.env,
     home = homedir(),
     now = Date.now,
-    // eslint-disable-next-line n/no-unsupported-features/node-builtins -- the global fetch is experimental at Node 20 and stable from 21; without it the read answers "no fetch in this Node"
-    fetch = globalThis.fetch,
     spawn = spawnChild,
     timers = globalThis,
     timeoutMs = LIVE_TIMEOUT_MS,
@@ -618,10 +531,7 @@ export async function readLive(
   if (!catalog) return { error: why || "no catalog to ask" };
   let r;
   try {
-    r =
-      catalog.kind === "http"
-        ? await readHttp(catalog, { env, fetch, timers, timeoutMs, signal })
-        : await readCommand(catalog, { env, spawn, timers, timeoutMs, signal });
+    r = await readCommand(catalog, { env, spawn, timers, timeoutMs, signal });
   } catch (e) {
     r = { error: String(e?.message || e) };
   }

package/node_modules/projectstore/scripts/version-guard.mjs

@@ -298,6 +298,14 @@ export function unshippedTopLevel(entries, packlist) {
 // The packlist is the second release-time invariant: what npm would actually
 // ship. Stored as sorted paths only — sizes churn on every content edit and
 // would make the fixture unreviewable.
+// The one package in `npm pack --json`'s answer: an array of one entry up to
+// npm 11, an object keyed by the package's name from npm 12.
+export function packEntry(answer) {
+  const [pkg] = Array.isArray(answer) ? answer : Object.values(answer ?? {});
+  if (!pkg || !Array.isArray(pkg.files)) throw new Error("no package entry with a file list");
+  return pkg;
+}
+
 export function currentPacklist(root = ROOT) {
   const r = spawnSync("npm", ["pack", "--dry-run", "--json"], {
     cwd: root,
@@ -306,7 +314,7 @@ export function currentPacklist(root = ROOT) {
   });
   if (r.status !== 0) return { error: `npm pack failed: ${r.stderr?.trim()}` };
   try {
-    const [pkg] = JSON.parse(r.stdout);
+    const pkg = packEntry(JSON.parse(r.stdout));
     return { files: pkg.files.map((f) => f.path).sort() };
   } catch (e) {
     return { error: `npm pack output unparseable: ${e.message}` };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "projectstore-claude",
-  "version": "0.30.6",
+  "version": "0.30.7",
   "description": "projectstore for Claude Code: the core pinned and bundled, the harness fixed. A release artifact; the way in is npx projectstore setup",
   "keywords": [
     "projectstore",
@@ -37,7 +37,7 @@
     "README.md"
   ],
   "dependencies": {
-    "projectstore": "=0.30.6"
+    "projectstore": "=0.30.7"
   },
   "bundleDependencies": [
     "projectstore"