thevoidforge 21.0.0

package/dist/wizard/lib/deep-current.js

@@ -0,0 +1,234 @@
+/**
+ * Deep Current — Situation Model + Cold Start Intake (v12.0).
+ *
+ * The Deep Current maintains a persistent situation model that represents
+ * the system's understanding of the project at any point in time. The
+ * cold start intake classifies new projects and bootstraps the model.
+ *
+ * PRD Reference: ROADMAP v12.0, docs/methods/DEEP_CURRENT.md
+ */
+import { readFile, mkdir, writeFile as writeFileAsync } from 'node:fs/promises';
+import { join } from 'node:path';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { scanSite, scoreScan } from './site-scanner.js';
+const DEEP_CURRENT_DIR = join(process.cwd(), 'logs', 'deep-current');
+const SITUATION_PATH = join(DEEP_CURRENT_DIR, 'situation.json');
+const PROPOSALS_DIR = join(DEEP_CURRENT_DIR, 'proposals');
+const PREDICTIONS_PATH = join(DEEP_CURRENT_DIR, 'predictions.jsonl');
+const CORRELATIONS_PATH = join(DEEP_CURRENT_DIR, 'correlations.jsonl');
+/**
+ * Classify the current project's state by checking for key files and config.
+ */
+export async function classifyProject() {
+    const cwd = process.cwd();
+    // Check for codebase indicators
+    const hasCodebase = existsSync(join(cwd, 'package.json')) ||
+        existsSync(join(cwd, 'pyproject.toml')) ||
+        existsSync(join(cwd, 'Gemfile')) ||
+        existsSync(join(cwd, 'src')) ||
+        existsSync(join(cwd, 'app'));
+    // Check for PRD
+    const hasPrd = existsSync(join(cwd, 'docs', 'PRD.md')) ||
+        existsSync(join(cwd, 'PRD.md')) ||
+        existsSync(join(cwd, 'PRD-VOIDFORGE.md'));
+    // Check for deployment evidence
+    const voidforgeDir = join(homedir(), '.voidforge');
+    const hasDeployLog = existsSync(join(voidforgeDir, 'deploys'));
+    const hasEnv = existsSync(join(cwd, '.env'));
+    // Check for analytics/revenue connections
+    const treasuryExists = existsSync(join(voidforgeDir, 'treasury', 'vault.enc'));
+    const heartbeatExists = existsSync(join(voidforgeDir, 'heartbeat.json'));
+    // Read deploy URL if available
+    let deployedUrl;
+    try {
+        const deployLog = await readFile(join(voidforgeDir, 'deploys', 'latest.json'), 'utf-8');
+        const data = JSON.parse(deployLog);
+        deployedUrl = data.url;
+    }
+    catch { /* no deploy data */ }
+    // Classify
+    const isDeployed = hasDeployLog && !!deployedUrl;
+    const hasAnalytics = treasuryExists || heartbeatExists;
+    const hasRevenue = treasuryExists;
+    let state;
+    if (!hasCodebase && !hasPrd)
+        state = 'GREENFIELD';
+    else if (hasPrd && !hasCodebase)
+        state = 'IDEA_PRD';
+    else if (hasCodebase && !isDeployed)
+        state = 'PARTIAL';
+    else if (isDeployed && !hasRevenue)
+        state = 'DEPLOYED';
+    else
+        state = 'OPERATING';
+    return { state, hasCodebase, hasPrd, isDeployed, hasAnalytics, hasRevenue, deployedUrl };
+}
+function createEmptyModel(projectName, state) {
+    const emptyDimension = { score: 0, gaps: ['Not yet analyzed'], lastUpdated: new Date().toISOString() };
+    return {
+        projectState: state,
+        projectName,
+        lastScan: new Date().toISOString(),
+        dimensions: {
+            featureCompleteness: { ...emptyDimension },
+            quality: { ...emptyDimension },
+            performance: { ...emptyDimension },
+            growthReadiness: { ...emptyDimension },
+            revenuePotential: { ...emptyDimension },
+        },
+        campaignHistory: [],
+        pendingProposals: [],
+        averagePredictionAccuracy: 0,
+        autonomyTier: 1,
+    };
+}
+// ── Persistence ───────────────────────────────────────
+export async function loadSituation() {
+    if (!existsSync(SITUATION_PATH))
+        return null;
+    try {
+        const content = await readFile(SITUATION_PATH, 'utf-8');
+        return JSON.parse(content);
+    }
+    catch {
+        return null;
+    }
+}
+export async function saveSituation(model) {
+    await mkdir(DEEP_CURRENT_DIR, { recursive: true });
+    await writeFileAsync(SITUATION_PATH, JSON.stringify(model, null, 2));
+}
+// ── SENSE Step — Update situation model from scans ────
+export async function sense(model) {
+    const classification = await classifyProject();
+    model.projectState = classification.state;
+    model.deployedUrl = classification.deployedUrl;
+    model.lastScan = new Date().toISOString();
+    // Torres scans the site (if deployed)
+    if (classification.deployedUrl) {
+        try {
+            const scanResult = await scanSite(classification.deployedUrl);
+            const scores = scoreScan(scanResult);
+            model.lastSiteScan = scanResult;
+            // Update dimension scores from scan
+            model.dimensions.performance = {
+                score: scores.performance,
+                gaps: buildPerformanceGaps(scanResult),
+                lastUpdated: new Date().toISOString(),
+            };
+            model.dimensions.growthReadiness = {
+                score: scores.growthReadiness,
+                gaps: buildGrowthGaps(scanResult),
+                lastUpdated: new Date().toISOString(),
+            };
+        }
+        catch (err) {
+            // Site scan failure — don't crash, just note it
+            model.dimensions.performance.gaps.push(`Site scan failed: ${err.message}`);
+        }
+    }
+    return model;
+}
+// ── Gap Builders ──────────────────────────────────────
+function buildPerformanceGaps(scan) {
+    const gaps = [];
+    if (scan.performance.ttfbMs && scan.performance.ttfbMs > 800) {
+        gaps.push(`TTFB ${scan.performance.ttfbMs}ms exceeds 800ms target`);
+    }
+    if (!scan.performance.compressed)
+        gaps.push('Response not compressed (no gzip/brotli)');
+    if (!scan.performance.cacheControl)
+        gaps.push('No Cache-Control header');
+    if (!scan.security.https)
+        gaps.push('Not served over HTTPS');
+    return gaps;
+}
+function buildGrowthGaps(scan) {
+    const gaps = [];
+    if (scan.growth.analyticsDetected.length === 0)
+        gaps.push('No analytics detected');
+    if (!scan.growth.socialMetaComplete)
+        gaps.push('Incomplete social meta (OG/Twitter Card)');
+    if (!scan.growth.emailCaptureDetected)
+        gaps.push('No email capture form detected');
+    if (!scan.seo.sitemapExists)
+        gaps.push('No sitemap.xml');
+    if (!scan.seo.jsonLd)
+        gaps.push('No JSON-LD structured data');
+    if (!scan.seo.description)
+        gaps.push('Missing meta description');
+    if (!scan.growth.cookieConsentDetected && scan.growth.analyticsDetected.length > 0) {
+        gaps.push('Analytics present but no cookie consent banner');
+    }
+    return gaps;
+}
+/**
+ * Cold start intake: classify the project, scan if deployed, create situation model.
+ * Returns the initial situation and a recommended first action.
+ */
+export async function intake(projectName) {
+    const classification = await classifyProject();
+    const model = createEmptyModel(projectName, classification.state);
+    let siteScan;
+    // Scan deployed site if available
+    if (classification.deployedUrl) {
+        try {
+            siteScan = await scanSite(classification.deployedUrl);
+            const scores = scoreScan(siteScan);
+            model.lastSiteScan = siteScan;
+            model.dimensions.performance.score = scores.performance;
+            model.dimensions.performance.gaps = buildPerformanceGaps(siteScan);
+            model.dimensions.growthReadiness.score = scores.growthReadiness;
+            model.dimensions.growthReadiness.gaps = buildGrowthGaps(siteScan);
+            model.dimensions.performance.lastUpdated = new Date().toISOString();
+            model.dimensions.growthReadiness.lastUpdated = new Date().toISOString();
+        }
+        catch { /* scan failed — continue with empty scores */ }
+    }
+    model.deployedUrl = classification.deployedUrl;
+    // Determine recommended first action based on state
+    let recommendedFirstAction;
+    switch (classification.state) {
+        case 'GREENFIELD':
+            recommendedFirstAction = 'Run /prd to create a PRD from your product description, then /campaign to build it.';
+            break;
+        case 'IDEA_PRD':
+            recommendedFirstAction = 'PRD exists. Run /campaign to start building.';
+            break;
+        case 'PARTIAL':
+            recommendedFirstAction = 'Code exists but not deployed. Run /campaign --resume to continue building, then deploy.';
+            break;
+        case 'DEPLOYED':
+            recommendedFirstAction = siteScan
+                ? `Site is live. Lowest dimension: ${findLowestDimension(model)}. Run /grow to start growth, or /current to get a full campaign proposal.`
+                : 'Site is live. Run /current --scan for a full analysis.';
+            break;
+        case 'OPERATING':
+            recommendedFirstAction = 'Revenue connected. Run /current for a data-driven campaign proposal.';
+            break;
+    }
+    // Save the model
+    await saveSituation(model);
+    return { classification, situation: model, siteScan, recommendedFirstAction };
+}
+function findLowestDimension(model) {
+    const dims = model.dimensions;
+    let lowest = 'featureCompleteness';
+    let lowestScore = dims.featureCompleteness.score;
+    for (const [key, val] of Object.entries(dims)) {
+        if (val.score < lowestScore) {
+            lowestScore = val.score;
+            lowest = key;
+        }
+    }
+    const labels = {
+        featureCompleteness: 'Feature Completeness',
+        quality: 'Quality',
+        performance: 'Performance',
+        growthReadiness: 'Growth Readiness',
+        revenuePotential: 'Revenue Potential',
+    };
+    return `${labels[lowest]} (${lowestScore}/100)`;
+}
+export { DEEP_CURRENT_DIR, SITUATION_PATH, PROPOSALS_DIR, PREDICTIONS_PATH, CORRELATIONS_PATH };

package/dist/wizard/lib/deploy-coordinator.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Deploy Coordinator — Orchestrates coordinated deploys across linked services.
+ *
+ * When deploying a linked project, checks if peer services also need redeployment
+ * (based on last deploy timestamp vs. last build phase change). Executes deploys
+ * in configurable order with per-service confirmation gates.
+ */
+export interface DeployCheckResult {
+    projectId: string;
+    name: string;
+    needsDeploy: boolean;
+    reason: string;
+    lastDeployAt: string;
+    lastBuildPhase: number;
+}
+export interface CoordinatedDeployPlan {
+    triggerProject: string;
+    linkedProjects: DeployCheckResult[];
+    totalNeedingDeploy: number;
+}
+/**
+ * Check which projects in a linked group need redeployment.
+ * A project needs deploy if:
+ * - It has never been deployed (lastDeployAt is empty)
+ * - Its build phase advanced since the last deploy
+ * - It was explicitly marked for deploy
+ */
+export declare function checkDeployNeeded(projectId: string): Promise<CoordinatedDeployPlan | null>;
+/**
+ * Get a deploy plan for a linked group — returns ordered list of projects
+ * that need deployment, with the trigger project first.
+ */
+export declare function getDeployPlan(projectId: string, username: string, ip: string): Promise<CoordinatedDeployPlan | null>;
+/**
+ * Get linked project summary for a single project (used in Lobby UI).
+ */
+export declare function getLinkedSummary(projectId: string): Promise<{
+    linkedCount: number;
+    linkedNames: string[];
+}>;

package/dist/wizard/lib/deploy-coordinator.js

@@ -0,0 +1,86 @@
+/**
+ * Deploy Coordinator — Orchestrates coordinated deploys across linked services.
+ *
+ * When deploying a linked project, checks if peer services also need redeployment
+ * (based on last deploy timestamp vs. last build phase change). Executes deploys
+ * in configurable order with per-service confirmation gates.
+ */
+import { getLinkedGroup, getProject } from './project-registry.js';
+import { audit } from './audit-log.js';
+/**
+ * Check which projects in a linked group need redeployment.
+ * A project needs deploy if:
+ * - It has never been deployed (lastDeployAt is empty)
+ * - Its build phase advanced since the last deploy
+ * - It was explicitly marked for deploy
+ */
+export async function checkDeployNeeded(projectId) {
+    const group = await getLinkedGroup(projectId);
+    if (group.length === 0)
+        return null;
+    const results = group.map((project) => {
+        let needsDeploy = false;
+        let reason = 'Up to date';
+        if (!project.deployTarget || project.deployTarget === 'unknown') {
+            reason = 'No deploy target configured';
+        }
+        else if (!project.lastDeployAt) {
+            needsDeploy = true;
+            reason = 'Never deployed';
+        }
+        else if (project.lastBuildPhase > 0) {
+            // Simple heuristic: if there's build activity, may need deploy
+            // In a real system, this would compare git SHAs or timestamps
+            const deployDate = new Date(project.lastDeployAt).getTime();
+            const now = Date.now();
+            const hoursSinceDeploy = (now - deployDate) / (1000 * 60 * 60);
+            if (hoursSinceDeploy > 24) {
+                needsDeploy = true;
+                reason = `Last deployed ${Math.floor(hoursSinceDeploy)}h ago`;
+            }
+        }
+        return {
+            projectId: project.id,
+            name: project.name,
+            needsDeploy,
+            reason,
+            lastDeployAt: project.lastDeployAt,
+            lastBuildPhase: project.lastBuildPhase,
+        };
+    });
+    return {
+        triggerProject: projectId,
+        linkedProjects: results,
+        totalNeedingDeploy: results.filter((r) => r.needsDeploy).length,
+    };
+}
+/**
+ * Get a deploy plan for a linked group — returns ordered list of projects
+ * that need deployment, with the trigger project first.
+ */
+export async function getDeployPlan(projectId, username, ip) {
+    const plan = await checkDeployNeeded(projectId);
+    if (!plan)
+        return null;
+    await audit('deploy', ip, username, {
+        action: 'deploy_check',
+        projectId,
+        linkedCount: plan.linkedProjects.length,
+        needingDeploy: plan.totalNeedingDeploy,
+    });
+    return plan;
+}
+/**
+ * Get linked project summary for a single project (used in Lobby UI).
+ */
+export async function getLinkedSummary(projectId) {
+    const project = await getProject(projectId);
+    if (!project || project.linkedProjects.length === 0) {
+        return { linkedCount: 0, linkedNames: [] };
+    }
+    const group = await getLinkedGroup(projectId);
+    const linkedNames = group
+        .filter((p) => p.id !== projectId)
+        .map((p) => p.name);
+    return { linkedCount: linkedNames.length, linkedNames };
+}

package/dist/wizard/lib/deploy-log.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Structured deploy logging (ADR-021).
+ * Persists deploy results to ~/.voidforge/deploys/ for history.
+ * No dependencies — pure Node.js stdlib.
+ */
+export interface DeployLogEntry {
+    runId: string;
+    timestamp: string;
+    target: string;
+    projectName: string;
+    framework: string;
+    deployUrl: string;
+    hostname: string;
+    region: string;
+    resources: {
+        type: string;
+        id: string;
+    }[];
+    outputs: Record<string, string>;
+}
+/**
+ * Persist a deploy result to the structured log.
+ */
+export declare function logDeploy(entry: DeployLogEntry): Promise<string>;
+/**
+ * List recent deploy logs, newest first.
+ */
+export declare function listDeploys(limit?: number): Promise<DeployLogEntry[]>;

package/dist/wizard/lib/deploy-log.js

@@ -0,0 +1,52 @@
+/**
+ * Structured deploy logging (ADR-021).
+ * Persists deploy results to ~/.voidforge/deploys/ for history.
+ * No dependencies — pure Node.js stdlib.
+ */
+import { writeFile, readdir, readFile, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+const DEPLOYS_DIR = join(homedir(), '.voidforge', 'deploys');
+/**
+ * Persist a deploy result to the structured log.
+ */
+export async function logDeploy(entry) {
+    await mkdir(DEPLOYS_DIR, { recursive: true });
+    const date = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);
+    const filename = `${date}-${entry.target}-${entry.runId.slice(0, 8)}.json`;
+    const filepath = join(DEPLOYS_DIR, filename);
+    await writeFile(filepath, JSON.stringify(entry, null, 2) + '\n', { encoding: 'utf-8', mode: 0o600 });
+    return filepath;
+}
+/**
+ * List recent deploy logs, newest first.
+ */
+export async function listDeploys(limit = 20) {
+    let files;
+    try {
+        files = await readdir(DEPLOYS_DIR);
+    }
+    catch {
+        return []; // Directory doesn't exist yet
+    }
+    const jsonFiles = files
+        .filter(f => f.endsWith('.json'))
+        .sort()
+        .reverse()
+        .slice(0, limit);
+    const entries = [];
+    for (const file of jsonFiles) {
+        try {
+            const content = await readFile(join(DEPLOYS_DIR, file), 'utf-8');
+            const parsed = JSON.parse(content);
+            // Basic validation — ensure required fields exist
+            if (parsed.runId && parsed.target && parsed.timestamp) {
+                entries.push(parsed);
+            }
+        }
+        catch {
+            // Skip corrupt log files
+        }
+    }
+    return entries;
+}

package/dist/wizard/lib/desktop-notify.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Desktop Notifications — macOS/Linux native notifications for daemon events.
+ *
+ * Uses osascript on macOS and notify-send on Linux. No dependencies.
+ * Notifications are non-blocking and failure-tolerant (notification failure
+ * should never crash the daemon).
+ *
+ * PRD Reference: §9.7 (Danger Room shows warning), v11.3 deliverables
+ */
+type NotificationUrgency = 'low' | 'normal' | 'critical';
+interface NotificationOptions {
+    title: string;
+    message: string;
+    urgency?: NotificationUrgency;
+    sound?: boolean;
+}
+/**
+ * Send a desktop notification. Fails silently — never throws.
+ */
+export declare function notify(opts: NotificationOptions): void;
+export declare function notifySpendSpike(platform: string, amount: string): void;
+export declare function notifyCampaignKilled(name: string, reason: string): void;
+export declare function notifyTokenExpiring(platform: string, hoursLeft: number): void;
+export declare function notifyReconciliationDiscrepancy(platform: string, amount: string): void;
+export declare function notifyVaultExpiring(hoursLeft: number): void;
+export declare function notifyRevenueMilestone(amount: string): void;
+export {};

package/dist/wizard/lib/desktop-notify.js

@@ -0,0 +1,98 @@
+/**
+ * Desktop Notifications — macOS/Linux native notifications for daemon events.
+ *
+ * Uses osascript on macOS and notify-send on Linux. No dependencies.
+ * Notifications are non-blocking and failure-tolerant (notification failure
+ * should never crash the daemon).
+ *
+ * PRD Reference: §9.7 (Danger Room shows warning), v11.3 deliverables
+ */
+import { execFileSync } from 'node:child_process';
+import { platform } from 'node:os';
+/**
+ * Send a desktop notification. Fails silently — never throws.
+ */
+export function notify(opts) {
+    try {
+        if (platform() === 'darwin') {
+            notifyMacOS(opts);
+        }
+        else if (platform() === 'linux') {
+            notifyLinux(opts);
+        }
+        // Windows: notifications deferred — WSL2 path recommended
+    }
+    catch {
+        // Notification failure is never fatal
+    }
+}
+function notifyMacOS(opts) {
+    // SEC-005: Use execFileSync with args array to prevent shell injection
+    const sound = opts.sound !== false ? ' sound name "Submarine"' : '';
+    const script = `display notification "${sanitize(opts.message)}" with title "VoidForge"${sound} subtitle "${sanitize(opts.title)}"`;
+    try {
+        execFileSync('osascript', ['-e', script], { timeout: 5000, stdio: 'ignore' });
+    }
+    catch { /* notification failure is never fatal */ }
+}
+function notifyLinux(opts) {
+    // SEC-006: Use execFileSync with args array, validate urgency enum
+    const validUrgencies = ['low', 'normal', 'critical'];
+    const urgency = validUrgencies.includes(opts.urgency || '') ? opts.urgency : 'normal';
+    try {
+        execFileSync('notify-send', ['-u', urgency, '-a', 'VoidForge', sanitize(opts.title), sanitize(opts.message)], { timeout: 5000, stdio: 'ignore' });
+    }
+    catch { /* notification failure is never fatal */ }
+}
+/** Strip characters that could be dangerous in shell/AppleScript contexts */
+function sanitize(input) {
+    return input.replace(/[`$\\"\n\r\0]/g, '').slice(0, 200);
+}
+// ── Daemon Event Notifications ────────────────────────
+// Pre-built notifications for common daemon events (§9.20.7 agent voice)
+export function notifySpendSpike(platform, amount) {
+    notify({
+        title: `Spend Spike — ${platform}`,
+        message: `Wax reports: ${platform} spend is ${amount} above average this hour.`,
+        urgency: 'critical',
+        sound: true,
+    });
+}
+export function notifyCampaignKilled(name, reason) {
+    notify({
+        title: 'Campaign Paused',
+        message: `Wax pulled the trigger on "${name}" — ${reason}.`,
+        urgency: 'normal',
+    });
+}
+export function notifyTokenExpiring(platform, hoursLeft) {
+    notify({
+        title: `Token Expiring — ${platform}`,
+        message: `Breeze warns: ${platform} token expires in ${hoursLeft} hours. Refresh needed.`,
+        urgency: hoursLeft < 2 ? 'critical' : 'normal',
+        sound: hoursLeft < 2,
+    });
+}
+export function notifyReconciliationDiscrepancy(platform, amount) {
+    notify({
+        title: 'Reconciliation Alert',
+        message: `Dockson: Numbers don't match on ${platform} — ${amount} discrepancy.`,
+        urgency: 'critical',
+        sound: true,
+    });
+}
+export function notifyVaultExpiring(hoursLeft) {
+    notify({
+        title: 'Vault Session Expiring',
+        message: `Vault session expires in ${hoursLeft} hour(s). Run \`voidforge heartbeat unlock\` to extend.`,
+        urgency: 'critical',
+        sound: true,
+    });
+}
+export function notifyRevenueMilestone(amount) {
+    notify({
+        title: 'Revenue Milestone!',
+        message: `Dockson: ${amount} total revenue. Every coin has a story — this one's a good chapter.`,
+        urgency: 'low',
+    });
+}

package/dist/wizard/lib/dns/cloudflare-dns.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Cloudflare DNS provisioning — zone lookup, record CRUD.
+ * Uses the shared HTTP client. No external dependencies.
+ */
+import type { DnsRecord, ZoneInfo, DnsProvisionResult } from './types.js';
+import type { ProvisionEmitter } from '../provisioners/types.js';
+/**
+ * Extract the root zone from a hostname.
+ * "app.voidforge.dev" → "voidforge.dev"
+ * "voidforge.dev" → "voidforge.dev"
+ */
+export declare function extractZoneName(hostname: string): string;
+/**
+ * Find the Cloudflare zone for a hostname.
+ * Accepts zones in any status (active, pending, etc.) — Cloudflare allows DNS
+ * record creation on pending zones, which is needed after fresh domain registration
+ * where zones start as pending until nameservers are verified (Kusanagi-5).
+ */
+export declare function findZone(token: string, hostname: string): Promise<ZoneInfo | null>;
+/** List existing DNS records for a hostname. */
+export declare function listRecords(token: string, zoneId: string, hostname: string): Promise<DnsRecord[]>;
+/** Create a DNS record. */
+export declare function createRecord(token: string, zoneId: string, type: 'A' | 'CNAME', name: string, content: string, proxied: boolean): Promise<DnsRecord>;
+/** Delete a DNS record. */
+export declare function deleteRecord(token: string, zoneId: string, recordId: string): Promise<void>;
+/**
+ * Full DNS provisioning flow — called as a post-provision step.
+ * Non-fatal: returns success=false with error message, never throws.
+ */
+export declare function provisionDns(runId: string, token: string, hostname: string, deployTarget: string, outputs: Record<string, string>, emit: ProvisionEmitter): Promise<DnsProvisionResult>;
+/**
+ * Clean up DNS records created during provisioning.
+ * Resource IDs are stored as "zoneId:recordId".
+ */
+export declare function cleanupDnsRecords(token: string, resourceIds: string[]): Promise<void>;