qualia-framework 7.2.1 → 7.2.2

package/CHANGELOG.md

@@ -8,6 +8,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 > Note: git tags for historical versions were not retained; commit references are approximate
 > and dates reflect commit history rather than npm publish timestamps.
 
+## [7.2.2] - 2026-06-27 (install UX — masked codes, clean references, update-on-/qualia)
+
+### Fixed
+- **Install code is masked** — the `QS-NAME-##` code now shows as `*` in the
+  interactive prompt and is hidden in piped/log output, so it never appears on screen.
+- **`archetypes` EISDIR warning gone** — the `references/` flat copy now skips
+  directories (the `archetypes/` tree is handled by the recursive canonical copy);
+  a clean install reports zero warnings.
+
+### Added
+- **Update notice on `/qualia`** — the router surfaces the cached "update available"
+  notice (the same one `auto-update.js` writes for the session-start banner), so an
+  operator who only ever runs `/qualia` still learns a new framework version is out.
+
 ## [7.2.1] - 2026-06-27 (system-audit makeover — portability, least-privilege, the one-loop)
 
 Outcome of a full four-system audit. Doc-truth and portability fixes plus the

package/bin/install.js

@@ -507,6 +507,29 @@ function closeRl() {
   if (SHARED_RL) { try { SHARED_RL.close(); } catch {} SHARED_RL = null; }
 }
 
+// Ask a question while masking the typed answer with '*' (for install codes).
+// The prompt itself is written before muting, so only keystrokes are hidden.
+function questionMasked(rl, prompt) {
+  return new Promise((resolve) => {
+    rl.question(prompt, (answer) => {
+      rl.stdoutMuted = false;
+      rl.output.write("\n");
+      resolve(answer);
+    });
+    rl.stdoutMuted = true;
+    if (!rl.__maskPatched) {
+      rl.__maskPatched = true;
+      const origWrite = rl._writeToOutput.bind(rl);
+      rl._writeToOutput = function (str) {
+        if (!rl.stdoutMuted) return origWrite(str);
+        // Pass control sequences (newlines) through; mask printable input.
+        if (str === "\n" || str === "\r\n" || str === "\r") return rl.output.write(str);
+        return rl.output.write("*");
+      };
+    }
+  });
+}
+
 // Read every available stdin line into an array. Resolves immediately on
 // 'end'. Used only when stdin is piped (legacy `echo ... | install`).
 function bufferStdin() {
@@ -536,8 +559,9 @@ function askCode() {
     if (!IS_INTERACTIVE) {
       printHeader();
       const line = nextPipedLine();
-      // Echo the prompt + answer for log readability.
-      process.stdout.write(`  ${WHITE}Enter install code (or "EMPLOYEE" for no-code install):${RESET} ${line}\n`);
+      // Echo the prompt for log readability, but never reveal the code itself.
+      const shown = isEmployeeKeyword(line) ? String(line).trim().toUpperCase() : (line ? "*".repeat(String(line).trim().length || 1) : "");
+      process.stdout.write(`  ${WHITE}Enter install code (or "EMPLOYEE" for no-code install):${RESET} ${shown}\n`);
       resolve(String(line || "").trim());
       return;
     }
@@ -546,7 +570,7 @@ function askCode() {
     console.log(`  ${DIM}OWNER / team member? Enter your install code (QS-NAME-##).${RESET}`);
     console.log(`  ${DIM}New employee without a code? Type ${RESET}${TEAL}EMPLOYEE${RESET}${DIM} to install in employee mode.${RESET}`);
     console.log("");
-    rl.question(`  ${WHITE}Install code or "EMPLOYEE":${RESET} `, (answer) => {
+    questionMasked(rl, `  ${WHITE}Install code or "EMPLOYEE":${RESET} `).then((answer) => {
       resolve(String(answer || "").trim());
     });
   });
@@ -1028,7 +1052,11 @@ async function main() {
   const refDest = path.join(CLAUDE_DIR, "qualia-references");
   if (fs.existsSync(refDir)) {
     if (!fs.existsSync(refDest)) fs.mkdirSync(refDest, { recursive: true });
-    for (const file of fs.readdirSync(refDir)) {
+    for (const entry of fs.readdirSync(refDir, { withFileTypes: true })) {
+      // Skip nested dirs (e.g. archetypes/) — they are handled by the canonical
+      // tree copy below. Reading a directory as a text file throws EISDIR.
+      if (entry.isDirectory()) continue;
+      const file = entry.name;
       try {
         copyTextTransform(path.join(refDir, file), path.join(refDest, file), claudeText);
         ok(file);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qualia-framework",
-  "version": "7.2.1",
+  "version": "7.2.2",
   "description": "Claude Code and Codex workflow framework by Qualia Solutions. Plan, build, verify, ship.",
   "bin": {
     "qualia-framework": "./bin/cli.js"

package/skills/qualia/SKILL.md

@@ -39,6 +39,12 @@ node ${QUALIA_BIN}/last-report.js 2>/dev/null
 ```
 Exit 0 → it prints a one-line digest of the newest session report (`Last session ({date}, {age}d ago): {summary} → next: {next}`). Exit 1 → no reports yet (nothing to surface). When a project is loaded and a digest exists, print that line **at the very TOP of your output**, before the banner — so the first thing the operator (or a teammate picking the project up) sees is exactly where the last session ended.
 
+Surface a pending framework update — read the same sticky notice the session-start banner uses (written by `auto-update.js` when npm ships a newer version), so an operator who only ever types `/qualia` still learns an update is out:
+```bash
+node -e "try{const fs=require('fs'),os=require('os'),p=require('path');const h=process.env.QUALIA_HOME||p.join(os.homedir(),'.claude');const n=JSON.parse(fs.readFileSync(p.join(h,'.qualia-update-available.json'),'utf8'));const cur=(JSON.parse(fs.readFileSync(p.join(h,'.qualia-config.json'),'utf8')).version)||n.current;if(n&&n.latest&&n.latest!==cur)console.log('UPDATE_AVAILABLE '+cur+' -> '+n.latest)}catch{}"
+```
+If it prints `UPDATE_AVAILABLE {cur} -> {latest}`, show one line at the **very top** of your reply (above the last-session digest and banner): `▲ Framework update available: v{cur} → v{latest}. Run: npx qualia-framework@latest install`. If it prints nothing, say nothing. Never run a live `npm view` here — `/qualia` must stay instant; this only reads the cached notice.
+
 Read conversation context — what has the user been doing, what errors occurred.
 
 ### 2. Classify and Route