refactor(gjc): enforce that the engine does not depend on the app

A closed core is only possible while the part that would close depends on
nothing it cannot take with it. The engine - the Rust core, the desktop shell,
and the worker with its SDK adapter and protocol - shares no file path with the
historical upstream, so it is the part that can move. That property held by
construction rather than by rule, and one convenient import would have ended it
without anyone noticing.

`gjc-command-surface.generated.ts` is generated from the installed runtime but
lived in server/modules/providers/, which forced the adapter to import the app
to read it. It now sits beside the engine that generates it and the app imports
it from there, which is the direction that survives a split.

eslint now classifies the engine and fails any import from it into a backend
module. The rule is last in the list because this plugin lets a later rule
re-allow what an earlier one denied: written first, the barrel allowance above
it silently reopened the door, and a mutation test importing through
modules/database/index.js passed. Its first form also used `to` as a sibling of
`disallow`, which the plugin ignores - that version rejected the engine's own
internal imports, seventeen of them, while allowing exactly what it was written
to stop.

gjc-cli.js and gjc-worker-node-runtime.ts stay outside the classified engine
rather than being exempted inside it. gjc-cli.js still reaches into the app for
providerAuthService and the notification orchestrator, and only to supply
defaults its caller can already override, so injecting that pair at the wiring
point is the whole remaining job. Listing them now would describe a boundary
that does not exist.

Author: devswha

docs/LICENSING.md

@@ -99,6 +99,43 @@ The fix for both is a generated `THIRD-PARTY-NOTICES` produced at build time fro
 the shipped tree, so new dependencies are covered without anyone maintaining a
 list by hand.
 
+## The engine boundary
+
+A closed core is possible only if the part that would close depends on nothing
+it cannot take with it. That part exists and is measured:
+
+| Layer | Files sharing a path with the historical upstream | Original to this project |
+| --- | --- | --- |
+| `native/` (Rust core) | 0 | 5,368 lines |
+| `src-tauri/src` (desktop shell) | 0 | 784 lines |
+| `server/gjc-*` (worker, adapter, protocol) | 0 | 13,397 lines |
+
+The app may call into the engine. **The engine may not reach back**, and that is
+enforced rather than hoped for: `eslint.config.js` classifies the engine files as
+`gjc-engine` and fails any import from them into `server/modules/*`, barrel
+imports included. The rule sits last in the list because this plugin lets a later
+rule re-allow what an earlier one denied, and the barrel allowance above it would
+otherwise reopen the door.
+
+One file moved to make that true: `gjc-command-surface.generated.ts` is generated
+from the installed runtime and was living in `server/modules/providers/`, so the
+engine had to import the app to read it. It now sits beside the engine that
+generates it, and the app imports it from there - the allowed direction.
+
+### What is not separable yet
+
+`server/gjc-cli.js` and `server/gjc-worker-node-runtime.ts` are the pre-worker
+spawn path, still loaded as the Node-only production runtime. `gjc-cli.js`
+imports `providerAuthService` and the notification orchestrator from the app,
+**and only to supply default values its caller can already override**
+(`gjc-cli.js:232-234`). Injecting that pair at the wiring point instead is the
+whole remaining job; the two files then join `gjc-engine` and the boundary is
+complete.
+
+They are deliberately left out of the `gjc-engine` list rather than exempted
+inside it. A rule that skipped them quietly would describe a boundary that does
+not exist.
+
 ## Adding a dependency
 
 1. Check the license before adding it. MIT, BSD, ISC, Apache-2.0 and MPL-2.0 are

eslint.config.js

@@ -149,6 +149,44 @@ export default tseslint.config(
         }),
       ],
       "boundaries/elements": [
+        {
+          // The GJC engine: the worker process, its SDK adapter, its tool policy
+          // and the protocol between them. Every file here is original to this
+          // project and imports nothing from the app around it, which is what
+          // makes it separable from the AGPL shell. The rule below keeps it that
+          // way, because the property is easy to lose and expensive to rebuild.
+          //
+          // Three files are deliberately absent. `gjc-worker-client.ts` is the
+          // app's end of the protocol and runs in the app's process. `gjc-cli.js`
+          // and `gjc-worker-node-runtime.ts` are the pre-worker spawn path, which
+          // still reaches into the app for `providerAuthService` and the
+          // notification orchestrator - and only to supply default values its
+          // caller can already override (`gjc-cli.js:232-234`). Injecting that
+          // pair at the wiring point instead is what moves them in here and
+          // finishes the boundary; see docs/LICENSING.md. Listing them now would
+          // make this rule a claim rather than a fact.
+          type: "gjc-engine",
+          pattern: [
+            "server/gjc-agent-tools.ts",
+            "server/gjc-automation-tools.ts",
+            "server/gjc-bun-ask-controller.ts",
+            "server/gjc-bun-oauth-controller.ts",
+            "server/gjc-bun-sdk-adapter.ts",
+            "server/gjc-bun-sdk-events.ts",
+            "server/gjc-bun-worker.ts",
+            "server/gjc-command-surface.generated.ts",
+            "server/gjc-export-path.ts",
+            "server/gjc-runtime-manifest.ts",
+            "server/gjc-sdk-bridge.ts",
+            "server/gjc-sdk-client.ts",
+            "server/gjc-session-state.ts",
+            "server/gjc-windows-job.ts",
+            "server/gjc-worker.ts",
+            "server/gjc-worker-protocol.ts",
+          ],
+          mode: "file",
+        },
+
         {
           type: "backend-shared-type-contract", // shared backend type/interface contracts that modules may consume without creating runtime coupling
           pattern: [
@@ -253,6 +291,21 @@ export default tseslint.config(
                 },
               }, // re-allow only public module entry points (barrel files)
             },
+            {
+              // Last, because boundaries lets a later rule re-allow what an
+              // earlier one denied: the barrel allowance directly above would
+              // otherwise let the engine import any module through its index.
+              //
+              // The engine is separable from the AGPL shell only while it depends
+              // on nothing in it. That is true today by construction, not by
+              // accident of what nobody has needed yet, and one convenient import
+              // would end it silently. The app may call into the engine; the
+              // engine may not reach back - through a barrel or otherwise.
+              from: { type: "gjc-engine" },
+              disallow: { to: { type: ["backend-module", "backend-legacy-runtime"] } },
+              message:
+                "The GJC engine may not import the app around it, barrel included. Move the shared piece next to the engine, or pass it through server/gjc-worker-protocol.ts.",
+            },
           ],
         },
       ],

scripts/generate-command-surface.mjs

@@ -33,7 +33,7 @@ const execFile = promisify(execFileCallback);
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const rootDir = path.resolve(__dirname, '..');
 const bunPath = path.join(rootDir, 'dist-native', process.platform === 'win32' ? 'bun.exe' : 'bun');
-const outputPath = path.join(rootDir, 'server', 'modules', 'providers', 'gjc-command-surface.generated.ts');
+const outputPath = path.join(rootDir, 'server', 'gjc-command-surface.generated.ts');
 const update = process.argv.slice(2).includes('--update');
 
 if (process.argv.slice(2).some((argument) => argument !== '--update')) {

server/gjc-bun-sdk-adapter.ts

@@ -11,7 +11,7 @@ import { initTheme, theme } from '@gajae-code/coding-agent/modes/theme/theme';
 import { getSupportedEfforts } from '@gajae-code/ai/model-thinking';
 
 import { GjcBunOAuthController, type GjcBunOAuthControllerOptions } from './gjc-bun-oauth-controller.js';
-import { GJC_APP_BUILTIN_COMMAND_NAMES } from './modules/providers/gjc-command-surface.generated.js';
+import { GJC_APP_BUILTIN_COMMAND_NAMES } from './gjc-command-surface.generated.js';
 import type { GjcWorkerOAuthRuntime, GjcWorkerRuntime, GjcWorkerWriter } from './gjc-worker.js';
 import { GjcBunAskController } from './gjc-bun-ask-controller.js';
 import { forwardPromptTerminal, forwardSdkEvent, normalizeBuiltinCommandStdout, type SdkRunState } from './gjc-bun-sdk-events.js';

…oviders/gjc-command-surface.generated.ts server/gjc-command-surface.generated.tsserver/modules/providers/gjc-command-surface.generated.ts renamed to server/gjc-command-surface.generated.ts server/modules/providers/gjc-command-surface.generated.ts renamed to server/gjc-command-surface.generated.ts

@@ -13,7 +13,7 @@ import {
   GJC_APP_BUILTIN_COMMANDS,
   GJC_APP_BUILTIN_COMMAND_ALIASES,
   GJC_APP_BUILTIN_COMMAND_NAMES,
-} from './modules/providers/gjc-command-surface.generated.js';
+} from './gjc-command-surface.generated.js';
 import {
   GjcBunSdkAdapter,
   createGjcBunSdkAdapter,
@@ -77,7 +77,7 @@ async function waitFor<T>(read: () => T | undefined): Promise<T> {
  * command it does not know is to forward the raw text to the model as a prompt.
  */
 const generatedSurface = await readFile(
-  join(process.cwd(), 'server/modules/providers/gjc-command-surface.generated.ts'),
+  join(process.cwd(), 'server/gjc-command-surface.generated.ts'),
   'utf8',
 );
 

server/gjc-sdk-contract.bun.test.ts

@@ -6,7 +6,7 @@ import matter from 'gray-matter';
 
 import type { IProviderSkills } from '@/shared/interfaces.js';
 import type { ProviderSkill, ProviderSkillListOptions } from '@/shared/types.js';
-import { GJC_BUNDLED_SKILLS } from '@/modules/providers/gjc-command-surface.generated.js';
+import { GJC_BUNDLED_SKILLS } from '@/gjc-command-surface.generated.js';
 
 // Names and descriptions come from each SKILL.md in the installed runtime,
 // generated rather than transcribed: `BUNDLED_SKILLS` is not exported upstream,

server/modules/providers/list/gjc/gjc-skills.provider.ts

@@ -4,7 +4,7 @@ import path from 'node:path';
 
 import matter from 'gray-matter';
 
-import { GJC_APP_BUILTIN_COMMANDS } from '@/modules/providers/gjc-command-surface.generated.js';
+import { GJC_APP_BUILTIN_COMMANDS } from '@/gjc-command-surface.generated.js';
 import { projectsDb } from '@/modules/database/index.js';
 import { AppError } from '@/shared/utils.js';
 

server/modules/providers/services/provider-commands.service.ts

@@ -4,7 +4,7 @@ import os from 'node:os';
 import path from 'node:path';
 import test from 'node:test';
 
-import { GJC_APP_BUILTIN_COMMANDS } from '@/modules/providers/gjc-command-surface.generated.js';
+import { GJC_APP_BUILTIN_COMMANDS } from '@/gjc-command-surface.generated.js';
 import { createProviderCommandsService } from '@/modules/providers/services/provider-commands.service.js';
 
 async function writeCommand(root: string, relativePath: string, description: string): Promise<void> {