supipowers 2.2.1 → 2.2.3

package/src/mempalace/hooks.ts

@@ -7,6 +7,7 @@ import { resolveInstalledBridgeScriptPath } from "./runtime.js";
 import { getEventStore as getContextEventStore, getSessionId as getContextSessionId } from "../context-mode/hooks.js";
 import { buildCompactionCheckpoint, buildShutdownDiary } from "./session-summary.js";
 import { snapshotMempalaceInstall } from "./installer-helper.js";
+import { buildMempalaceGuidance } from "./contract.js";
 
 export interface MempalaceHooksDeps {
   createBridge?: (config: ResolvedMempalaceConfig, cwd: string) => MempalaceBridgeFacade;
@@ -162,12 +163,9 @@ function wakeUpBlock(resolved: ResolvedMempalaceConfig, wing: string, text: stri
     "# MemPalace memory",
     `- palace: ${resolved.palacePath}`,
     `- default wing: ${wing}`,
-  ];
-  if (resolved.hooks.searchGuidance) {
-    lines.push(
-      "- You **MUST** call `mempalace(action=\"search\", query=...)` before answering questions about prior decisions, people, projects, or past events. Skip only when the answer is fully derivable from the current turn or the active codebase.",
-    );
-  }
+    "",
+    ...buildMempalaceGuidance(resolved.hooks, "full"),
+  ].filter((line) => line.length > 0);
   if (excerpt.trim()) {
     lines.push("", "## Wake-up excerpt", excerpt.trim());
   }
@@ -175,19 +173,15 @@ function wakeUpBlock(resolved: ResolvedMempalaceConfig, wing: string, text: stri
 }
 
 /**
- * Compact one-line refresher injected on turns where we skip the full
- * wake-up dump. Keeps the model oriented (palace/wing) and re-asserts the
- * RFC-2119 search nudge in ~140 chars instead of ~870 tokens.
+ * Compact refresher injected on turns where we skip the full wake-up dump.
+ * Keeps the model oriented (palace/wing) and re-asserts the MemPalace
+ * read/write contract without paying for the wake-up excerpt.
  */
 function wakeUpRefresher(resolved: ResolvedMempalaceConfig, wing: string): string {
   const lines = [
     `# MemPalace memory: wing=${wing}`,
+    ...buildMempalaceGuidance(resolved.hooks, "refresher"),
   ];
-  if (resolved.hooks.searchGuidance) {
-    lines.push(
-      "- You **MUST** call `mempalace(action=\"search\", query=...)` before answering past-fact questions; per-turn search results appear below when relevant.",
-    );
-  }
   return lines.join("\n");
 }
 
@@ -326,7 +320,8 @@ export function registerMempalaceHooks(
     const wakeUpEnabled = config.mempalace.hooks.wakeUp;
     const guidanceEnabled = config.mempalace.hooks.searchGuidance;
     const autoSearchEnabled = config.mempalace.hooks.autoSearchOnPrompt;
-    if (!wakeUpEnabled && !guidanceEnabled && !autoSearchEnabled) return undefined;
+    const writeGuidanceEnabled = config.mempalace.hooks.writeGuidance;
+    if (!wakeUpEnabled && !guidanceEnabled && !writeGuidanceEnabled && !autoSearchEnabled) return undefined;
 
     const cwd = contextCwd(ctx);
     const resolved = resolveMempalaceConfig(config, cwd, platform.paths);

package/src/mempalace/tool.ts

@@ -15,6 +15,7 @@ import {
   snapshotMempalaceInstall,
   type MempalaceInstallSnapshot,
 } from "./installer-helper.js";
+import { MEMPALACE_TOOL_DESCRIPTION } from "./contract.js";
 
 export interface MempalaceToolDeps {
   createBridge?: (config: ResolvedMempalaceConfig, cwd: string) => MempalaceBridgeFacade;
@@ -130,8 +131,7 @@ export function registerMempalaceTool(
   platform.registerTool({
     name: "mempalace",
     label: "MemPalace",
-    description:
-      "MemPalace memory dispatcher. **MUST** call `search` before answering past-fact questions; write only on explicit user request.",
+    description: MEMPALACE_TOOL_DESCRIPTION,
     parameters: mempalaceToolParameters,
     async execute(_toolCallId: string, rawParams: unknown, _signal: AbortSignal, onUpdate: unknown, toolCtx: unknown) {
       try {

package/src/mempalace/uv.ts

@@ -12,6 +12,10 @@ export const PINNED_UV_VERSION = "0.5.30";
 
 const UV_BASE_URL = "https://github.com/astral-sh/uv/releases/download";
 
+const TAR_PREFLIGHT_TIMEOUT_MS = 3_000;
+const TAR_REMEDIATION =
+  "Install GNU tar / BSD tar (built-in on macOS, Linux, and Windows 10+). On older Windows, install Git for Windows or run `/supi:memory setup` after adding tar to PATH.";
+
 export type UvPlatform =
   | "darwin-arm64"
   | "darwin-x64"
@@ -49,17 +53,22 @@ export function uvTargetFor(uvPlatform: UvPlatform): UvTarget {
     case "linux-arm64":
       return target("aarch64-unknown-linux-gnu", ".tar.gz", "uv");
     case "win32-x64":
-      return target("x86_64-pc-windows-msvc", ".zip", "uv.exe");
+      return target("x86_64-pc-windows-msvc", ".zip", "uv.exe", "uv.exe");
   }
 }
 
-function target(triple: string, archiveSuffix: string, binary: string): UvTarget {
+function target(
+  triple: string,
+  archiveSuffix: string,
+  binary: string,
+  archiveBinaryRelativePath = path.join(`uv-${triple}`, binary),
+): UvTarget {
   const archive = `uv-${triple}${archiveSuffix}`;
   return {
     triple,
     archive,
     binary,
-    archiveBinaryRelativePath: path.join(`uv-${triple}`, binary),
+    archiveBinaryRelativePath,
   };
 }
 
@@ -113,6 +122,34 @@ function writeVersionStamp(managedBinDir: string, version: string): void {
   fs.writeFileSync(versionStampPath(managedBinDir), `${version}\n`, "utf8");
 }
 
+function tarUnavailable(message: string): EnsureUvResult {
+  return {
+    ok: false,
+    error: {
+      code: "uv_extract_failed",
+      message,
+      remediation: TAR_REMEDIATION,
+    },
+  };
+}
+
+async function verifyTarAvailable(runner: ProcessRunner): Promise<EnsureUvResult | null> {
+  let result;
+  try {
+    result = await runner("tar", ["--version"], { timeoutMs: TAR_PREFLIGHT_TIMEOUT_MS });
+  } catch (error) {
+    return tarUnavailable(
+      `tar is required to extract the uv archive but could not be launched: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+
+  if (result.code !== 0) {
+    return tarUnavailable("tar is required to extract the uv archive but is not on PATH.");
+  }
+
+  return null;
+}
+
 export async function ensureUv(options: EnsureUvOptions): Promise<EnsureUvResult> {
   const version = options.version ?? PINNED_UV_VERSION;
   const uvPlatform = options.platform === undefined ? detectUvPlatform() : options.platform;
@@ -134,6 +171,9 @@ export async function ensureUv(options: EnsureUvOptions): Promise<EnsureUvResult
     return { ok: true, uvPath: managedPath, version, source: "cached" };
   }
 
+  const tarPreflight = await verifyTarAvailable(options.runner);
+  if (tarPreflight) return tarPreflight;
+
   const fetcher = options.fetcher ?? defaultFetcher;
   options.onProgress?.(`Downloading uv ${version} for ${targetSpec.triple}`);
 
@@ -210,7 +250,7 @@ export async function ensureUv(options: EnsureUvOptions): Promise<EnsureUvResult
         message: `tar failed to extract uv archive (code ${extract.code}): ${
           extract.stderr.trim() || extract.stdout.trim() || "no output"
         }`,
-        remediation: "Ensure tar is on PATH (built-in on macOS, Linux, and Windows 10+).",
+        remediation: TAR_REMEDIATION,
       },
     };
   }
@@ -226,11 +266,14 @@ export async function ensureUv(options: EnsureUvOptions): Promise<EnsureUvResult
     };
   }
 
-  // Replace any pre-existing managed binary atomically-ish.
-  if (fs.existsSync(managedPath)) {
-    try { fs.unlinkSync(managedPath); } catch { /* best effort */ }
+  // Replace any pre-existing managed binary atomically-ish. Windows uv zips place
+  // uv.exe at the archive root, which is already `managedPath` after extraction.
+  if (path.resolve(extractedBinary) !== path.resolve(managedPath)) {
+    if (fs.existsSync(managedPath)) {
+      try { fs.unlinkSync(managedPath); } catch { /* best effort */ }
+    }
+    fs.renameSync(extractedBinary, managedPath);
   }
-  fs.renameSync(extractedBinary, managedPath);
   if (process.platform !== "win32") {
     fs.chmodSync(managedPath, 0o755);
   }

package/src/planning/approval-flow.ts

@@ -278,7 +278,7 @@ async function executeApproveFlow(
       debugLogger?.log("execution_handoff_new_session_cancelled", {
         planPath,
       });
-      ctx.ui.notify("Session start cancelled. Plan saved; run /supi:plan again to execute.");
+      ctx.ui?.notify?.("Session start cancelled. Plan saved; run /supi:plan again to execute.");
       return;
     }
     platform.sendUserMessage(prompt);
@@ -298,7 +298,7 @@ async function executeApproveFlow(
     debugLogger?.log("execution_handoff_same_session_steer_sent", {
       planPath,
     });
-    ctx.ui.notify("Plan approved — starting execution");
+    ctx.ui?.notify?.("Plan approved — starting execution");
   }
 }
 
@@ -408,25 +408,23 @@ export function registerPlanApprovalHook(platform: Platform): void {
       });
     } catch {}
     if (!ctx?.hasUI) {
-      const message = [
-        `Plan saved to \`${planPath}\`.`,
-        "Interactive approval is unavailable in this runtime, so no execution was started.",
-        `To continue manually, explicitly send: \`Execute the saved plan at ${planPath} step by step; verify each step before proceeding.\``,
-      ].join("\n");
-      debugLogger?.log("approval_flow_no_ui", {
+      debugLogger?.log("approval_flow_no_ui_auto_execute", {
         planName,
         planPath,
       });
-      ctx?.ui?.notify?.("Plan saved; interactive approval is required before execution.", "warning");
-      platform.sendMessage(
-        {
-          customType: "supi-plan-awaiting-interactive-approval",
-          content: [{ type: "text", text: message }],
-          display: true,
-        },
-        { deliverAs: "steer", triggerTurn: false },
-      );
+      const executionNewSession = capturedNewSession;
+      const executionModel = capturedResolvedModel;
       cancelPlanTracking();
+      await executeApproveFlow(
+        platform,
+        ctx,
+        canonicalContent,
+        planPath,
+        executionNewSession,
+        executionModel,
+        debugLogger,
+        parsedPlan,
+      );
       return;
     }
 

package/src/planning/planning-ask-tool.ts

@@ -129,11 +129,11 @@ function getAskRedirectReason(): string | null {
  */
 export function registerPlanningAskToolGuard(platform: Platform): void {
   platform.on("tool_call", (event) => {
-    if (event.toolName === "resolve" && isPlanApprovalResolveInput(event.input) && isPlanningActive()) {
+    if (event.toolName === "resolve" && isResolveApplyInput(event.input) && isPlanningActive()) {
       return {
         block: true,
         reason:
-          "Planning mode: /supi:plan uses a file-based approval hook. Do not call `resolve` with `extra.title` because it is OMP's native approval path and bypasses supipowers plan tracking.",
+          "Planning mode: /supi:plan uses a file-based approval hook. Native OMP plan approval is blocked because it bypasses supipowers plan tracking.",
       };
     }
 
@@ -149,13 +149,7 @@ export function registerPlanningAskToolGuard(platform: Platform): void {
   });
 }
 
-function isPlanApprovalResolveInput(input: unknown): boolean {
+function isResolveApplyInput(input: unknown): boolean {
   if (input === null || typeof input !== "object" || Array.isArray(input)) return false;
-  const candidate = input as { action?: unknown; extra?: unknown };
-  if (candidate.action !== "apply") return false;
-  const extra = candidate.extra;
-  return extra !== null
-    && typeof extra === "object"
-    && !Array.isArray(extra)
-    && typeof (extra as { title?: unknown }).title === "string";
+  return (input as { action?: unknown }).action === "apply";
 }

package/src/release/executor.ts

@@ -116,7 +116,8 @@ export async function executeRelease(opts: ExecuteReleaseOptions): Promise<Relea
     } else {
       console.log(`[dry-run] Would git tag -a ${tagName}`);
     }
-    console.log(`[dry-run] Would git push origin HEAD --follow-tags`);
+    console.log(`[dry-run] Would git push origin HEAD`);
+    console.log(`[dry-run] Would git push origin ${tagName}`);
     for (const channel of channels) {
       console.log(`[dry-run] Would publish to channel: ${channel}`);
     }
@@ -199,8 +200,8 @@ export async function executeRelease(opts: ExecuteReleaseOptions): Promise<Relea
 
   let pushAttempt = 0;
   while (true) {
-    progress("git-push", "active", pushAttempt === 0 ? "Pushing to origin" : "Retrying push after rebase");
-    const gitPush = await exec("git", ["push", "origin", "HEAD", "--follow-tags"], { cwd });
+    progress("git-push", "active", pushAttempt === 0 ? "Pushing commit to origin" : "Retrying commit push after rebase");
+    const gitPush = await exec("git", ["push", "origin", "HEAD"], { cwd });
     if (gitPush.code === 0) {
       progress("git-push", "done");
       break;
@@ -228,6 +229,15 @@ export async function executeRelease(opts: ExecuteReleaseOptions): Promise<Relea
     }
   }
 
+  progress("git-push-tags", "active", `Pushing ${tagName} to origin`);
+  const gitPushTag = await exec("git", ["push", "origin", tagName], { cwd });
+  if (gitPushTag.code !== 0) {
+    const detail = gitPushTag.stderr || gitPushTag.stdout || `exit code ${gitPushTag.code}`;
+    progress("git-push-tags", "error", detail);
+    return { version, tagCreated: true, pushed: false, channels: [], error: `git push tag: ${detail}` };
+  }
+  progress("git-push-tags", "done");
+
   const channelResults: ReleaseResult["channels"] = [];
   for (const channel of channels) {
     progress(`publish-${channel}`, "active", `Publishing to ${channel}`);

package/src/storage/plans.ts

@@ -1,6 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { normalizeLineEndings } from "../text.js";
+import { ensureTrailingNewline, normalizeLineEndings } from "../text.js";
 import type { Plan, PlanTask, TaskComplexity, WorkspaceTarget } from "../types.js";
 import type { PlatformPaths } from "../platform/types.js";
 import { getProjectStatePath, getProjectTargetStatePath } from "../workspace/state-paths.js";
@@ -40,7 +40,7 @@ export function savePlan(paths: PlatformPaths, cwd: string, filename: string, co
   const dir = getPlansDir(paths, cwd);
   fs.mkdirSync(dir, { recursive: true });
   const filePath = path.join(dir, filename);
-  fs.writeFileSync(filePath, content);
+  fs.writeFileSync(filePath, ensureTrailingNewline(normalizeLineEndings(content)));
   return filePath;
 }
 

package/src/text.ts

@@ -1,6 +1,11 @@
-/** Normalizes Windows CRLF line endings to LF. */
+/** Normalizes CRLF and lone CR line endings to LF for deterministic artifacts. */
 export function normalizeLineEndings(text: string): string {
-  return text.replace(/\r\n/g, "\n");
+  return text.replace(/\r\n?/g, "\n");
+}
+
+/** Ensures text files have a trailing LF without changing already-terminated content. */
+export function ensureTrailingNewline(text: string): string {
+  return text.endsWith("\n") ? text : `${text}\n`;
 }
 
 /** Removes a single outer markdown code fence wrapper when present. */

package/src/types.ts

@@ -572,9 +572,11 @@ export interface MempalaceConfig {
   hooks: {
     wakeUp: boolean;
     searchGuidance: boolean;
+    writeGuidance: boolean;
     autoSearchOnPrompt: boolean;
     compactionCheckpoint: boolean;
     shutdownDiary: boolean;
+    postCommitReindex: boolean;
   };
   budgets: {
     wakeUpTokens: number;
@@ -1550,6 +1552,16 @@ export type HarnessStage =
   | "docs"
   | "validate";
 
+/** Progress event emitted by harness pipeline drivers and long-running stages. */
+export type HarnessPipelineProgressEvent =
+  | { type: "stage-started"; stage: HarnessStage }
+  | { type: "stage-progress"; stage: HarnessStage; detail: string }
+  | { type: "stage-skipped"; stage: HarnessStage }
+  | { type: "stage-completed"; stage: HarnessStage; detail?: string }
+  | { type: "stage-blocked"; stage: HarnessStage; detail: string }
+  | { type: "stage-failed"; stage: HarnessStage; detail: string }
+  | { type: "awaiting-user"; stage: HarnessStage; detail?: string };
+
 /** Operational status of a harness stage. Mirrors UltraPlanAuthoringStageStatus. */
 export type HarnessStageStatus =
   | "pending"

package/src/utils/editor.ts

@@ -6,7 +6,7 @@ import type { Platform } from "../platform/types.js";
  * Resolution order:
  *  1. `$VISUAL`
  *  2. `$EDITOR`
- *  3. OS default opener (`open` on darwin, `start` on win32, `xdg-open` elsewhere)
+ *  3. OS default opener (`open` on darwin, `cmd /d /s /c start` on win32, `xdg-open` elsewhere)
  *
  * `platform.exec` blocks until the spawned editor process exits, which is what
  * the synthesize stage needs for its `$EDITOR` round-trip. For OS-default openers
@@ -18,7 +18,34 @@ import type { Platform } from "../platform/types.js";
  * without throwing. Callers that need to verify the user actually edited the file
  * should detect changes by comparing mtime / contents before and after.
  */
-export async function openInEditor(platform: Platform, filePath: string): Promise<void> {
+export interface EditorInvocation {
+  command: string;
+  args: string[];
+}
+
+
+function quoteCmdArgument(arg: string): string {
+  return `"${arg.replace(/"/g, '""')}"`;
+}
+
+export function resolveDefaultEditorInvocation(
+  hostPlatform: NodeJS.Platform,
+  filePath: string,
+): EditorInvocation {
+  if (hostPlatform === "win32") {
+    return { command: "cmd", args: ["/d", "/s", "/c", `start "" ${quoteCmdArgument(filePath)}`] };
+  }
+
+  return hostPlatform === "darwin"
+    ? { command: "open", args: [filePath] }
+    : { command: "xdg-open", args: [filePath] };
+}
+
+export async function openInEditor(
+  platform: Platform,
+  filePath: string,
+  hostPlatform: NodeJS.Platform = process.platform,
+): Promise<void> {
   const editor = process.env.VISUAL || process.env.EDITOR;
   try {
     if (editor) {
@@ -28,9 +55,8 @@ export async function openInEditor(platform: Platform, filePath: string): Promis
       const args = [...tokens.slice(1), filePath];
       await platform.exec(cmd, args);
     } else {
-      const cmd = process.platform === "darwin" ? "open"
-        : process.platform === "win32" ? "start" : "xdg-open";
-      await platform.exec(cmd, [filePath]);
+      const invocation = resolveDefaultEditorInvocation(hostPlatform, filePath);
+      await platform.exec(invocation.command, invocation.args);
     }
   } catch {
     // Editor open failed — non-fatal, file was still written

package/src/utils/exec-cli.ts

@@ -0,0 +1,106 @@
+import { dirname, join } from "node:path";
+import { existsSync } from "node:fs";
+
+import type { ExecOptions, ExecResult } from "../platform/types.js";
+import { findExecutable } from "./executable.js";
+
+/**
+ * Cross-platform invocation for npm/npx that survives Windows `.cmd` shims.
+ *
+ * OMP's `platform.exec` is a thin wrapper over libuv's `uv_spawn`. On Windows
+ * that exposes two distinct bugs when the target is an npm-shipped CLI:
+ *
+ *   1. libuv does not consult `PATHEXT`, so spawning `"npm"` fails with
+ *      `ENOENT: uv_spawn 'npm'` because the on-disk file is `npm.cmd`.
+ *   2. Even when callers resolve the absolute path, Node ≥18.20.2 hard-rejects
+ *      spawning `.cmd`/`.bat` shims without `shell: true` (CVE-2024-27980).
+ *      `ExecOptions` does not expose `shell`.
+ *
+ * Wrapping in `cmd.exe /d /s /c` is the canonical workaround, but only safe
+ * when the spawner sets `windowsVerbatimArguments: true` — Node's default
+ * CRT escaping double-quotes the command line and cmd's `/s` only strips one
+ * pair. We don't control the spawner, so we sidestep the whole problem by
+ * resolving the shim to the real `node <cli.js>` invocation, which is exactly
+ * what `npm.cmd` does internally. `node.exe` is a plain binary that libuv
+ * spawns without ceremony.
+ *
+ * Non-shim binaries (`bun`, `git`, `node`, `gh`, `rustup`, `go`, `pip`, …
+ * all ship as `.exe` on Windows) pass through untouched; POSIX always passes
+ * through.
+ */
+
+export type ExecFn = (
+  cmd: string,
+  args: string[],
+  opts?: ExecOptions,
+) => Promise<ExecResult>;
+
+interface ResolvedInvocation {
+  cmd: string;
+  prefixArgs: string[];
+}
+
+const NODE_SHIMS = new Set<string>(["npm", "npx"]);
+const resolutionCache = new Map<string, ResolvedInvocation>();
+
+function resolveNodeShim(command: string): ResolvedInvocation | null {
+  if (!NODE_SHIMS.has(command)) return null;
+
+  // node.exe is the executor; npm-cli.js / npx-cli.js sits next to it under
+  // node_modules/npm/bin/. We deliberately key off node's location (not the
+  // shim's) because `npm.cmd` can live in a user-global dir (e.g. nvm,
+  // %AppData%\npm) while the actual CLI bundle stays alongside node.
+  const nodeBin = findExecutable("node");
+  if (!nodeBin) return null;
+
+  const cliJs = join(
+    dirname(nodeBin),
+    "node_modules",
+    "npm",
+    "bin",
+    `${command}-cli.js`,
+  );
+  if (!existsSync(cliJs)) return null;
+
+  return { cmd: nodeBin, prefixArgs: [cliJs] };
+}
+
+function resolveInvocation(command: string): ResolvedInvocation {
+  if (process.platform !== "win32") {
+    return { cmd: command, prefixArgs: [] };
+  }
+  const cached = resolutionCache.get(command);
+  if (cached) return cached;
+
+  const resolved = resolveNodeShim(command) ?? { cmd: command, prefixArgs: [] };
+  resolutionCache.set(command, resolved);
+  return resolved;
+}
+
+/**
+ * Drop-in replacement for `platform.exec` callers that invoke npm/npx by name.
+ * Other commands pass through unchanged.
+ */
+export function execCli(
+  exec: ExecFn,
+  command: string,
+  args: string[],
+  opts?: ExecOptions,
+): Promise<ExecResult> {
+  const resolved = resolveInvocation(command);
+  return exec(resolved.cmd, [...resolved.prefixArgs, ...args], opts);
+}
+
+/**
+ * Wrap an `ExecFn` so every call routes through `execCli`. Use when threading
+ * an exec callback into helpers that dispatch arbitrary tools by string name
+ * (e.g. the deps installer which splits install-command strings).
+ */
+export function wrapExecForCli(exec: ExecFn): ExecFn {
+  return (cmd, args, opts) => execCli(exec, cmd, args, opts);
+}
+
+/** Clears cached CLI resolutions after PATH or tooling changes. */
+export function clearExecCliResolutionCache(): void {
+  resolutionCache.clear();
+}