feat(ai-briefing): wire grok-capture Wave 0 + address publish-review findings

[kyle-sexton]

Post-publish behavior fixes for the ai-briefing plugin, surfaced by bot review on the publish PR (#122). All were pre-existing engine characteristics carried over in the migration; none block plugin load/validate.

Ships

• Wire grok-capture (Wave 0 S0). Registered cmdGrokCapture in the runner dispatch (thin adapter over grok-capture-agent.js). init --grok-preload now probes the Grok CLI and sets config.grok_preload / grok_preload_requested — degrades to grok_degraded on a missing/unsigned CLI, or hard-fails with --require-grok. next-handle surfaces grok_preload; S3 synthesize merges Grok captures with Chrome (mergeTweetLists, Chrome URLs win on dedup). Non-blocking: preload-disabled or a capture error records S0_grok_capture: skipped and exits 0 so Chrome Wave 1 always proceeds. Added grok-wave0-orchestration.test.js to the scripts test script and un-deferred the docs (SKILL.md standing default fix: harden telemetry data fallback in bash-lint and markdown-formatter #20, references/runner-architecture.md).
• source_type no longer hard-coded "twitter" in state.js appendToSeenItems — honors item.source_type ?? "twitter". This runner is the Wave-1 X (twitter) loop, so the default stays correct for its own items; the change generalizes the writer so the main-session-driven RSS/Perplexity/GitHub waves (which append to the same store per the documented twitter|blog|changelog|github schema) can record their own source. No other in-plugin caller sets a non-twitter source today — the threading is the forward-compatible fix, deliberately, not a missed one.
• Single model constant. lib/models.js BRIEFING_AGENT_MODEL; synthesize-agent.js + categorize-agent.js route through it (one edit to bump).
• output/build/validate.js wraps loadSlidesData() in try/catch — prints "run emit-slides-data.js first" and exits non-zero instead of a raw dynamic-import stack.
• JS-string injection hardening in chrome-extract.js buildExtractorJs: handle + cutoffIso are escaped for single-quoted JS-string context (\ then ') before substitution, via function replacers so a $ in the value can't form a replacement pattern.

Bumps plugin version 0.2.0 → 0.3.0 (behavior change → consumers receive it on /plugin marketplace update).

Verification

• scripts suite: npm test — all green incl. new grok-wave0-orchestration.test.js (env-isolated from leaked CLAUDE_PLUGIN_DATA).
• output/build suite: node --test — 2 pass.
• S3 Chrome-wins merge verified directly (dry-run skips the merge path).
• Escaping verified against a malicious evil'];window.__pwned=1;// handle; backslash-doubling confirmed.
• validate.js diagnostic path exercised (no slides-data.js → clean message, exit 1).
• claude plugin validate plugins/ai-briefing --strict — passed.

Refs melodic-software/medley#1457

---

Note

Medium Risk
Touches browser-injected extractor JS and optional external Grok CLI orchestration; failures are designed to degrade without blocking Chrome Wave 1, but S3 merge semantics and seen-items source_type affect dedup and downstream briefing content.

Overview
ai-briefing 0.3.0 wires optional Grok Wave 0 into the per-profile runner and folds in several publish-review fixes.

Grok Wave 0 registers grok-capture in the runner. init --grok-preload probes the Grok CLI, sets config.grok_preload / grok_degraded, and supports --require-grok for hard failure. cmdGrokCapture is non-blocking (skip + exit 0 on disabled preload or errors). S3 synthesize merges Grok and Chrome posts via mergeTweetLists (Chrome wins on URL dedup). Docs and CLI usage drop the “not yet wired” deferral; tests add grok-wave0-orchestration.test.js.

Other behavior changes: appendToSeenItems uses item.source_type ?? "twitter" for forward-compatible RSS/GitHub waves. BRIEFING_AGENT_MODEL in models.js centralizes the S3/S4 claude -p model. buildExtractorJs escapes handle/cutoff for single-quoted JS literals. validate.js fails clearly when slides-data.js is missing.

^{Reviewed by Cursor Bugbot for commit c602645. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_604832cf-b42b-469c-8b6e-bfe4f39c3461)

[cursor]

Risk: medium. Not approving: Cursor Bugbot completed as skipped (usage limit reached), so automated review did not finish successfully. Human review is needed before merge; no reviewers were assigned because the PR author is the sole human repository contributor.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}