integration/consolidated-current — single-branch consolidation + Phase 2 (2A/2B)

.cursor/rules/graphify.mdc

@@ -0,0 +1,21 @@
+---
+description: graphify knowledge graph context
+alwaysApply: true
+---
+
+This project can build a Graphify knowledge graph under `graphify-out/` (generated locally; not committed). Scope/exclusions: `.graphifyignore` and `code/.graphifyignore`.
+
+**When exploring architecture, prefer Graphify if a local graph exists:**
+- `graphify query "<question>"` — scoped subgraph for codebase or architecture questions
+- `graphify path "<A>" "<B>"` — dependency path between two symbols
+- `graphify explain "<concept>"` — nodes related to a concept
+
+If `graphify-out/graph.json` is missing, regenerate with AST-only Graphify against `code/` (respect `.graphifyignore`; do not ingest PDFs), then query. Treat Graphify edges as hints — always source-verify before concluding.
+
+Only use Read/Grep/Glob directly when:
+1. Graphify has already oriented you and you need specific lines
+2. Graphify is unavailable and regeneration is not practical
+
+- If `graphify-out/wiki/index.md` exists, navigate it instead of reading raw files
+- Read `graphify-out/GRAPH_REPORT.md` only for broad architecture review when query/path/explain are insufficient
+- After substantial code changes, run `graphify update .` locally to refresh the graph (AST-only)

.github/workflows/webmcp-ci.yml

@@ -20,79 +20,93 @@ jobs:
   webmcp-release-gate:
     name: "WebMCP Gate (build + unit tests)"
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: code
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-node@v4
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
         with:
-          node-version: 20
-          cache: npm
+          version: 10.28.2
 
-      - name: Install root dependencies
-        run: npm ci
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: code/pnpm-lock.yaml
 
-      - name: Install extension dependencies
-        run: npm ci
-        working-directory: code/apps/extension-chromium
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
 
       - name: Build extension
-        run: npm run build
-        working-directory: code/apps/extension-chromium
+        run: pnpm --filter @optimandoai/extension-chromium run build
 
       - name: Run WebMCP unit + sender-gate tests
-        run: npm run test:webmcp:ci
-        working-directory: code
+        run: pnpm run test:webmcp:ci
 
   quarantine-monitor:
     name: "Quarantine (pre-existing failures, non-blocking)"
     runs-on: ubuntu-latest
     continue-on-error: true
+    defaults:
+      run:
+        working-directory: code
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-node@v4
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
         with:
-          node-version: 20
-          cache: npm
+          version: 10.28.2
 
-      - name: Install root dependencies
-        run: npm ci
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: code/pnpm-lock.yaml
 
-      - name: Install extension dependencies
-        run: npm ci
-        working-directory: code/apps/extension-chromium
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
 
       - name: Run quarantined tests (informational)
-        run: npm run test:quarantine || true
-        working-directory: code
+        run: pnpm run test:quarantine || true
 
   webmcp-e2e-smoke:
     name: "WebMCP E2E Smoke (opt-in)"
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.run_e2e == true }}
+    defaults:
+      run:
+        working-directory: code
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-node@v4
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
         with:
-          node-version: 20
-          cache: npm
+          version: 10.28.2
 
-      - name: Install root dependencies
-        run: npm ci
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: code/pnpm-lock.yaml
 
-      - name: Install extension dependencies
-        run: npm ci
-        working-directory: code/apps/extension-chromium
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
 
       - name: Install Playwright browsers
-        run: npx playwright install --with-deps chromium
+        run: pnpm exec playwright install --with-deps chromium
         working-directory: code/apps/extension-chromium
 
       - name: Build extension
-        run: npm run build
-        working-directory: code/apps/extension-chromium
+        run: pnpm --filter @optimandoai/extension-chromium run build
 
       - name: Run WebMCP E2E smoke
-        run: npm run test:e2e:webmcp
+        run: pnpm run test:e2e:webmcp
         working-directory: code/apps/extension-chromium

.gitignore

@@ -40,3 +40,18 @@ code/packages/ingestion-core/src/*.js
 
 # Chromium extension Vite outDir (versioned per release, e.g. build55647)
 code/apps/extension-chromium/build*/
+
+# graphify generated outputs + caches (regenerate with `graphify` / graphifyy)
+# Keep hand-authored: .graphifyignore, code/.graphifyignore, .cursor/rules/graphify.mdc
+graphify-out/
+code/graphify-out/
+
+# Cursor tooling artefacts (agent state, dumps). The Graphify↔Cursor
+# integration is hand-authored and must stay visible: the always-on rule in
+# .cursor/rules/ and, when used, .cursor/mcp.json.
+.cursor/*
+!.cursor/rules/
+!.cursor/mcp.json
+
+# Accidental vitest JSON dumps (not source)
+code/phase2-before-native.json

.graphifyignore

@@ -0,0 +1,34 @@
+# Initial graphify pass: codebase AST only.
+# PDFs and documentation are excluded; add selectively later with /graphify --update.
+*.pdf
+**/*.pdf
+*.md
+**/*.md
+*.mdx
+**/*.mdx
+*.txt
+**/*.txt
+*.html
+**/*.html
+*.rst
+**/*.rst
+*.qmd
+**/*.qmd
+*.yaml
+**/*.yaml
+*.yml
+**/*.yml
+*.png
+**/*.png
+*.jpg
+**/*.jpg
+*.jpeg
+**/*.jpeg
+*.webp
+**/*.webp
+*.gif
+**/*.gif
+*.svg
+**/*.svg
+**/THIRD_PARTY_LICENSES/**
+**/docs/**

code/.gitignore

@@ -338,3 +338,7 @@ apps/extension-chromium/build179/
 apps/extension-chromium/build180/
 apps/extension-chromium/build181/
 apps/extension-chromium/build182/
+
+# Accidental vitest JSON dumps (not source)
+phase2-before-native.json
+*-before-native.json

code/.graphifyignore

@@ -0,0 +1,34 @@
+# Initial graphify pass: codebase AST only.
+# PDFs and documentation are excluded; add selectively later with /graphify --update.
+*.pdf
+**/*.pdf
+*.md
+**/*.md
+*.mdx
+**/*.mdx
+*.txt
+**/*.txt
+*.html
+**/*.html
+*.rst
+**/*.rst
+*.qmd
+**/*.qmd
+*.yaml
+**/*.yaml
+*.yml
+**/*.yml
+*.png
+**/*.png
+*.jpg
+**/*.jpg
+*.jpeg
+**/*.jpeg
+*.webp
+**/*.webp
+*.gif
+**/*.gif
+*.svg
+**/*.svg
+**/THIRD_PARTY_LICENSES/**
+**/docs/**

code/apps/electron-vite-project/electron-builder.config.cjs

@@ -7,10 +7,10 @@ const appDir = __dirname
 
 /**
  * Parsed by scripts/kill-wr-desk.cjs — must contain a line matching:
- *   return 'C:\\build-output\\build044'
+ *   return 'C:\\build-output\\build046'
  */
 function windowsOutputDirMarker() {
-  return 'C:\\build-output\\build044'
+  return 'C:\\build-output\\build046'
 }
 
 const workspaceRoot = path.resolve(appDir, '../..')

code/apps/electron-vite-project/electron/handshakeAcceptSafeOpts.ts

@@ -1,8 +1,8 @@
 /**
  * Pure builder for `handshake:accept` IPC options — shared with preload tests.
  * Forwards an explicit allowlist only (no pass-through of arbitrary objects).
- * Internal vs normal and X25519 requirements are decided in main using persisted
- * `record.handshake_type` — this module does not use `device_role` as proof of internal.
+ * Internal vs normal and X25519 requirements are decided in main using the persisted
+ * `record.same_principal` flag — this module does not use `device_role` as proof of internal.
  */
 
 const MAX_B64 = 8192