@agentskit/cli 0.11.3 → 0.12.0

package/dist/index.cjs

@@ -14,6 +14,7 @@ var fs = require('fs');
 var tools = require('@agentskit/tools');
 var skills = require('@agentskit/skills');
 var memory = require('@agentskit/memory');
+var integrations = require('@agentskit/integrations');
 var child_process = require('child_process');
 var jsxRuntime = require('react/jsx-runtime');
 var url = require('url');
@@ -24,6 +25,8 @@ var chokidar = require('chokidar');
 var rag = require('@agentskit/rag');
 var agentSchema = require('@agentskit/core/agent-schema');
 var yaml = require('yaml');
+var security = require('@agentskit/core/security');
+var core = require('@agentskit/core');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
@@ -152,7 +155,7 @@ function createDemoAdapter(provider, model) {
           ].join(" ");
           for (const chunk of reply.match(/.{1,18}/g) ?? []) {
             if (cancelled) return;
-            await new Promise((resolve4) => setTimeout(resolve4, 35));
+            await new Promise((resolve6) => setTimeout(resolve6, 35));
             yield { type: "text", content: chunk };
           }
           yield { type: "done" };
@@ -607,7 +610,7 @@ function instantiate(kind) {
     case "filesystem":
       return tools.filesystem({ basePath: process.cwd() });
     case "shell":
-      return [tools.shell({ timeout: 3e4 })];
+      return [tools.shell({ timeout: 3e4, allowAny: true })];
   }
 }
 function gateTool(tool) {
@@ -627,9 +630,19 @@ function resolveTools(toolNames) {
       case "shell":
         tools.push(...instantiate(name));
         break;
-      default:
-        process.stderr.write(`Unknown tool: ${name}
+      default: {
+        if (integrations.getIntegration(name)) {
+          const { tools: projected, credentialFound, envVar } = integrations.integrationToolsFromEnv(name, process.env);
+          if (!credentialFound) {
+            process.stderr.write(`Integration "${name}" needs ${envVar} set in the environment.
 `);
+          }
+          tools.push(...projected);
+        } else {
+          process.stderr.write(`Unknown tool: ${name}
+`);
+        }
+      }
     }
   }
   return tools;
@@ -864,20 +877,39 @@ function configHooksToHandlers(config) {
 function runShellHook(entry, payload) {
   return new Promise((resolvePromise) => {
     const timeoutMs = entry.timeout ?? 5e3;
+    let settled = false;
+    const settle = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolvePromise(result);
+    };
     const child = child_process.spawn("sh", ["-c", entry.run], {
-      stdio: ["pipe", "pipe", "inherit"]
+      stdio: ["pipe", "pipe", "inherit"],
+      detached: true
     });
     let stdout = "";
     child.stdout.on("data", (chunk) => {
       stdout += chunk.toString();
     });
     const timer = setTimeout(() => {
-      child.kill("SIGTERM");
+      if (child.pid !== void 0) {
+        try {
+          process.kill(-child.pid, "SIGKILL");
+        } catch {
+        }
+      }
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+      settle({ decision: "block", reason: `shell hook timed out after ${timeoutMs}ms` });
     }, timeoutMs);
+    child.stdin.on("error", () => {
+    });
     child.on("close", (code) => {
-      clearTimeout(timer);
       if (code !== 0) {
-        resolvePromise({
+        settle({
           decision: "block",
           reason: `shell hook exited with code ${code}`
         });
@@ -885,19 +917,18 @@ function runShellHook(entry, payload) {
       }
       const trimmed = stdout.trim();
       if (!trimmed) {
-        resolvePromise({ decision: "continue" });
+        settle({ decision: "continue" });
         return;
       }
       try {
         const parsed = JSON.parse(trimmed);
-        resolvePromise(parsed);
+        settle(parsed);
       } catch {
-        resolvePromise({ decision: "continue" });
+        settle({ decision: "continue" });
       }
     });
     child.on("error", (err) => {
-      clearTimeout(timer);
-      resolvePromise({ decision: "block", reason: err.message });
+      settle({ decision: "block", reason: err.message });
     });
     try {
       child.stdin.write(JSON.stringify(payload));
@@ -3687,13 +3718,6 @@ function registerConfigCommand(program) {
 `);
       process.exit(2);
     }
-    if (fs.existsSync(targetPath) && !options.force) {
-      process.stderr.write(
-        `Config already exists at ${targetPath}. Re-run with --force to overwrite.
-`
-      );
-      process.exit(1);
-    }
     const template = {
       defaults: {
         provider: "openai",
@@ -3704,7 +3728,20 @@ function registerConfigCommand(program) {
       }
     };
     fs.mkdirSync(path__default.default.dirname(targetPath), { recursive: true });
-    fs.writeFileSync(targetPath, JSON.stringify(template, null, 2) + "\n");
+    try {
+      fs.writeFileSync(targetPath, JSON.stringify(template, null, 2) + "\n", {
+        flag: options.force ? "w" : "wx"
+      });
+    } catch (err) {
+      if (err.code === "EEXIST") {
+        process.stderr.write(
+          `Config already exists at ${targetPath}. Re-run with --force to overwrite.
+`
+        );
+        process.exit(1);
+      }
+      throw err;
+    }
     process.stdout.write(
       `Wrote ${targetPath}
 Edit it to taste, then run:
@@ -4002,12 +4039,12 @@ function scaffoldAgent(schema) {
   return files;
 }
 async function writeScaffold(files, outDir, opts = {}) {
-  const { writeFile: writeFile2, mkdir: mkdir2, access } = await import('fs/promises');
-  const { dirname, join: join5 } = await import('path');
+  const { writeFile: writeFile3, mkdir: mkdir3, access } = await import('fs/promises');
+  const { dirname: dirname2, join: join6 } = await import('path');
   const written = [];
   for (const f of files) {
-    const full = join5(outDir, f.path);
-    await mkdir2(dirname(full), { recursive: true });
+    const full = join6(outDir, f.path);
+    await mkdir3(dirname2(full), { recursive: true });
     if (!opts.overwrite) {
       try {
         await access(full);
@@ -4015,7 +4052,7 @@ async function writeScaffold(files, outDir, opts = {}) {
       } catch {
       }
     }
-    await writeFile2(full, f.content, "utf8");
+    await writeFile3(full, f.content, "utf8");
     written.push(f.path);
   }
   return written;
@@ -4168,6 +4205,469 @@ function registerFlowCommand(program) {
     }
   });
 }
+function lintTaxonomyFile(filePath) {
+  const absolute = path.resolve(filePath);
+  let raw;
+  try {
+    raw = fs.readFileSync(absolute, "utf8");
+  } catch (err) {
+    return {
+      file: absolute,
+      ruleCount: 0,
+      result: {
+        ok: false,
+        issues: [{ index: -1, path: "", message: `cannot read file: ${err.message}` }]
+      }
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    return {
+      file: absolute,
+      ruleCount: 0,
+      result: {
+        ok: false,
+        issues: [{ index: -1, path: "", message: `invalid JSON: ${err.message}` }]
+      }
+    };
+  }
+  const result = security.validatePIITaxonomy(parsed);
+  const ruleCount = parsed && typeof parsed === "object" && Array.isArray(parsed.rules) ? parsed.rules.length : 0;
+  return { file: absolute, result, ruleCount };
+}
+function renderLintReport(report, opts = {}) {
+  const { color = false } = opts;
+  const red = (s) => color ? `\x1B[31m${s}\x1B[0m` : s;
+  const green = (s) => color ? `\x1B[32m${s}\x1B[0m` : s;
+  const dim = (s) => color ? `\x1B[2m${s}\x1B[0m` : s;
+  const lines = [];
+  lines.push(dim(report.file));
+  if (report.result.ok) {
+    lines.push(green(`\u2713 valid \xB7 ${report.ruleCount} rule${report.ruleCount === 1 ? "" : "s"}`));
+  } else {
+    lines.push(red(`\u2717 ${report.result.issues.length} issue${report.result.issues.length === 1 ? "" : "s"}`));
+    for (const issue of report.result.issues) {
+      lines.push(`  ${red("\u2022")} ${issue.path || "<root>"}: ${issue.message}`);
+    }
+  }
+  return `${lines.join("\n")}
+`;
+}
+
+// src/commands/pii.ts
+function registerPiiCommand(program) {
+  const pii = program.command("pii").description("Inspect and validate PII taxonomies.");
+  pii.command("lint <file...>").description("Validate one or more PII taxonomy JSON files.").option("--json", "Emit JSON instead of formatted output").action((files, options) => {
+    const reports = files.map(lintTaxonomyFile);
+    const failed = reports.filter((r) => !r.result.ok).length;
+    if (options.json) {
+      process.stdout.write(JSON.stringify(reports, null, 2) + "\n");
+    } else {
+      for (const report of reports) {
+        process.stdout.write(renderLintReport(report, { color: process.stdout.isTTY }));
+      }
+      if (failed > 0) {
+        process.stderr.write(`
+${failed} of ${reports.length} taxonomy file${reports.length === 1 ? "" : "s"} failed validation
+`);
+      }
+    }
+    if (failed > 0) process.exit(1);
+  });
+}
+
+// src/rules/cursor.ts
+var CURSOR_RULE = `---
+description: AgentsKit conventions \u2014 apply to every file in this workspace
+globs: ["**/*.ts", "**/*.tsx"]
+alwaysApply: true
+---
+
+# AgentsKit project rules
+
+When writing or editing TypeScript in this workspace, follow these rules. They
+are non-negotiable and enforced by CI.
+
+## Imports
+
+- Use **named exports only**. No \`export default\`.
+- Import from package roots: \`@agentskit/core\`, \`@agentskit/runtime\`, \`@agentskit/react\`,
+  \`@agentskit/ink\`, \`@agentskit/adapters\`, \`@agentskit/tools\`, \`@agentskit/skills\`,
+  \`@agentskit/memory\`, \`@agentskit/rag\`, \`@agentskit/observability\`, \`@agentskit/eval\`,
+  \`@agentskit/sandbox\`, \`@agentskit/cli\`, \`@agentskit/templates\`.
+- For tools subpaths, use \`@agentskit/tools/integrations\`, \`@agentskit/tools/mcp\`,
+  \`@agentskit/tools/mcp-devtools\`.
+
+## Types
+
+- TypeScript strict mode is on. **Do not use \`any\`** \u2014 use \`unknown\` and narrow.
+- Headless React components: no hardcoded styles, use \`data-ak-*\` attributes.
+
+## Errors
+
+- Never \`throw new Error(...)\` inside package source. Use the typed errors from
+  \`@agentskit/core\`: \`AdapterError\`, \`ToolError\`, \`MemoryError\`, \`RuntimeError\`,
+  \`SandboxError\`, \`SkillError\`, \`ConfigError\`. Pair with \`ErrorCodes.<...>\`.
+
+## Tests
+
+- vitest. Place tests under \`packages/<pkg>/tests/\` mirroring \`src/\`.
+- E2E lives in \`apps/example-*\` with Playwright.
+
+## Versioning
+
+- Every PR with a behavior change requires a Changeset (\`pnpm changeset\`).
+
+## Where to look first
+
+- Architecture, contracts, ADRs: \`docs/architecture/adrs/\`
+- Per-package conventions: \`packages/<pkg>/CONVENTIONS.md\`
+- Agent-facing index: \`AGENTS.md\` and \`apps/docs-next/content/docs/for-agents/\`
+`;
+
+// src/rules/windsurf.ts
+var WINDSURF_RULE = `# AgentsKit project rules (read first)
+
+This workspace builds AgentsKit \u2014 a JavaScript agent toolkit with a 10 KB core,
+six formal contracts, and ~19 plug-and-play packages. When generating or
+editing code, follow these rules \u2014 they are enforced by CI.
+
+## Imports
+- **Named exports only.** No \`export default\`.
+- Import from package roots (\`@agentskit/core\`, \`@agentskit/runtime\`, \`@agentskit/react\`, etc.).
+- Tools subpaths: \`@agentskit/tools/integrations\`, \`@agentskit/tools/mcp\`, \`@agentskit/tools/mcp-devtools\`.
+
+## Types
+- Strict mode TypeScript. **No \`any\`** \u2014 use \`unknown\` and narrow.
+
+## Errors
+- **Do not** \`throw new Error(...)\` in package source. Use \`AdapterError\` /
+  \`ToolError\` / \`MemoryError\` / \`RuntimeError\` / \`SandboxError\` / \`SkillError\` /
+  \`ConfigError\` from \`@agentskit/core\`, paired with \`ErrorCodes\`.
+
+## Tests
+- vitest. Tests live in \`packages/<pkg>/tests/\` mirroring \`src/\`.
+- E2E lives in \`apps/example-*\` with Playwright.
+
+## Versioning
+- Every behavior change needs a Changeset (\`pnpm changeset\`).
+
+## Read first
+- \`AGENTS.md\` \u2014 universal agent guidance
+- \`apps/docs-next/content/docs/for-agents/\` \u2014 per-package agent docs
+- \`docs/architecture/adrs/\` \u2014 six core contracts (Adapter, Tool, Memory, Retriever, Skill, Runtime)
+- \`packages/<pkg>/CONVENTIONS.md\` \u2014 per-package contribution rules
+`;
+
+// src/rules/codex.ts
+var CODEX_PROFILE = `<!-- agentskit-codex-profile:start -->
+## Codex / Aider profile
+
+Structured hints for CLI coding agents (OpenAI Codex, Aider, Claude Code,
+Cursor) running against this workspace. Update via \`agentskit rules codex\`.
+
+\`\`\`yaml
+# AgentsKit Codex profile v1
+profile: agentskit
+runtime: node-25
+package_manager: pnpm
+test_runner: vitest
+build_runner: turborepo
+
+allowed_commands:
+  - pnpm install
+  - pnpm build
+  - pnpm test
+  - pnpm lint
+  - pnpm changeset
+  - pnpm --filter @agentskit/* test
+  - pnpm --filter @agentskit/* lint
+  - pnpm --filter @agentskit/* build
+
+restricted_paths:
+  - packages/core/src/errors.ts        # Touch carefully \u2014 every package depends on the typed errors here.
+  - packages/core/src/security/        # Security-sensitive \u2014 small surface, requires review.
+  - docs/architecture/adrs/            # Contract changes need a new ADR + major bump.
+
+models_recommended:
+  - claude-sonnet-4-6                  # Default \u2014 long context, fast.
+  - gpt-5                              # Strong reasoning for refactors / cross-package work.
+  - claude-opus-4-7                    # Heavy refactors, contract redesigns.
+
+invariants:
+  core_max_kb_gzip: 10
+  no_default_exports: true
+  strict_typescript: true
+  no_bare_throw_new_error: true
+  named_exports_only: true
+  changeset_required_for_behavior_changes: true
+
+read_first:
+  - AGENTS.md
+  - apps/docs-next/content/docs/for-agents/
+  - docs/architecture/adrs/
+\`\`\`
+<!-- agentskit-codex-profile:end -->
+`;
+
+// src/rules/claude-code.ts
+var CLAUDE_CODE_SKILL = [
+  {
+    path: "SKILL.md",
+    contents: `---
+name: agentskit
+description: Scaffold AgentsKit projects, add tools/skills, run doctor, and inspect the runtime \u2014 wraps the agentskit CLI.
+---
+
+# AgentsKit
+
+Skill bundle for working with the AgentsKit toolkit from inside Claude Code.
+
+Pair this skill with the project-scoped slash commands at \`.claude/commands/agentskit-*.md\`:
+
+- \`/agentskit-new-agent\` \u2014 interactive scaffold (\`agentskit init\`)
+- \`/agentskit-doctor\` \u2014 diagnose the local environment (\`agentskit doctor\`)
+- \`/agentskit-add-tool\` \u2014 add a tool integration template
+- \`/agentskit-add-skill\` \u2014 add a skill template
+- \`/agentskit-lint-pii\` \u2014 validate a PII taxonomy file
+- \`/agentskit-rules\` \u2014 write \`.cursor/rules\` / \`.windsurfrules\` / Codex profile
+
+When the user is inside an AgentsKit workspace, prefer the slash commands over
+hand-rolling shell invocations \u2014 they share the canonical defaults.
+
+For convention reminders (named exports only, no bare throw, etc.), read
+\`AGENTS.md\` at the workspace root.
+`
+  }
+];
+var CLAUDE_CODE_SLASH_COMMANDS = [
+  {
+    path: "agentskit-new-agent.md",
+    contents: `---
+description: Scaffold a new AgentsKit project (interactive)
+allowed-tools: Bash(npx agentskit init:*)
+---
+
+Run \`npx @agentskit/cli init\` interactively in the user's chosen directory.
+After scaffold completes, summarise the layout (templates created, next
+commands the user should run).
+`
+  },
+  {
+    path: "agentskit-doctor.md",
+    contents: `---
+description: Run the AgentsKit environment doctor and summarise findings
+allowed-tools: Bash(npx agentskit doctor:*)
+---
+
+Run \`npx @agentskit/cli doctor\` in the workspace root. Format the output
+into pass / warn / fail buckets and propose a fix for each fail / warn.
+`
+  },
+  {
+    path: "agentskit-add-tool.md",
+    contents: `---
+description: Add a tool template to the current package
+---
+
+Ask the user which tool to add. Use \`packages/templates/src/blueprints/tool.ts\`
+to scaffold the file under \`packages/<pkg>/src/tools/\`. Update the package's
+\`src/index.ts\` to re-export the new tool. Add a vitest mock test under
+\`packages/<pkg>/tests/\`.
+`
+  },
+  {
+    path: "agentskit-add-skill.md",
+    contents: `---
+description: Add a skill template to @agentskit/skills
+---
+
+Use \`packages/templates/src/blueprints/skill.ts\` to scaffold a new skill
+under \`packages/skills/src/\`. Re-export from the package index. Add a
+golden-dataset test fixture under \`packages/skills/tests/\` (10\u201350 input/
+expected examples, per the conventions).
+`
+  },
+  {
+    path: "agentskit-lint-pii.md",
+    contents: `---
+description: Validate a PII taxonomy JSON file
+allowed-tools: Bash(npx agentskit pii lint:*)
+---
+
+Ask the user for a path. Run \`npx @agentskit/cli pii lint <path>\` and
+display the report. If issues exist, suggest concrete fixes per the
+issue messages.
+`
+  },
+  {
+    path: "agentskit-rules.md",
+    contents: `---
+description: Write editor rule files (Cursor / Windsurf / Codex / Claude Code)
+allowed-tools: Bash(npx agentskit rules:*)
+---
+
+Ask which editor (or "all"). Run the matching:
+- \`npx @agentskit/cli rules cursor\`
+- \`npx @agentskit/cli rules windsurf\`
+- \`npx @agentskit/cli rules codex\`
+- \`npx @agentskit/cli rules claude-code\`
+
+After writing, summarise which files landed and what each one does.
+`
+  }
+];
+
+// src/rules.ts
+var CODEX_BLOCK_START = "<!-- agentskit-codex-profile:start -->";
+var CODEX_BLOCK_END = "<!-- agentskit-codex-profile:end -->";
+async function ensureDir2(path5) {
+  await promises.mkdir(path.dirname(path5), { recursive: true });
+}
+async function writeIfChanged(absPath, contents, force) {
+  let existing;
+  try {
+    existing = await promises.readFile(absPath, "utf8");
+  } catch {
+  }
+  if (existing === contents) return "skipped";
+  if (existing !== void 0 && !force) {
+    return "skipped";
+  }
+  await ensureDir2(absPath);
+  await promises.writeFile(absPath, contents, "utf8");
+  return existing === void 0 ? "wrote" : "updated";
+}
+async function writeCursor(rootDir, force) {
+  const path5 = path.join(rootDir, ".cursor", "rules", "agentskit.mdc");
+  const action = await writeIfChanged(path5, CURSOR_RULE, force);
+  return [{ path: path5, action }];
+}
+async function writeWindsurf(rootDir, force) {
+  const path5 = path.join(rootDir, ".windsurfrules");
+  const action = await writeIfChanged(path5, WINDSURF_RULE, force);
+  return [{ path: path5, action }];
+}
+async function writeCodex(rootDir, force) {
+  const path5 = path.join(rootDir, "AGENTS.md");
+  let existing = "";
+  try {
+    existing = await promises.readFile(path5, "utf8");
+  } catch {
+  }
+  const startIdx = existing.indexOf(CODEX_BLOCK_START);
+  const endIdx = startIdx >= 0 ? existing.lastIndexOf(CODEX_BLOCK_END, existing.length) : -1;
+  if (startIdx >= 0 && endIdx <= startIdx) {
+    throw new core.ConfigError({
+      code: core.ErrorCodes.AK_CONFIG_INVALID,
+      message: `${path5}: found agentskit-codex-profile:start sentinel but no matching :end after it \u2014 refusing to modify a half-edited block.`,
+      hint: "Restore the closing sentinel or remove the partial block, then re-run."
+    });
+  }
+  let next;
+  if (startIdx >= 0 && endIdx > startIdx) {
+    next = existing.slice(0, startIdx) + CODEX_PROFILE.trimEnd() + existing.slice(endIdx + CODEX_BLOCK_END.length);
+  } else if (existing) {
+    next = `${existing.replace(/\s+$/, "")}
+
+${CODEX_PROFILE}`;
+  } else {
+    next = CODEX_PROFILE;
+  }
+  if (next === existing) return [{ path: path5, action: "skipped" }];
+  if (existing && !force) {
+    return [{ path: path5, action: "skipped" }];
+  }
+  await ensureDir2(path5);
+  await promises.writeFile(path5, next, "utf8");
+  return [{ path: path5, action: existing ? "updated" : "wrote" }];
+}
+async function writeClaudeCode(rootDir, force) {
+  const out = [];
+  const skillRoot = path.join(rootDir, ".claude", "skills", "agentskit");
+  for (const file of CLAUDE_CODE_SKILL) {
+    const abs = path.join(skillRoot, file.path);
+    const action = await writeIfChanged(abs, file.contents, force);
+    out.push({ path: abs, action });
+  }
+  const commandsRoot = path.join(rootDir, ".claude", "commands");
+  for (const cmd of CLAUDE_CODE_SLASH_COMMANDS) {
+    const abs = path.join(commandsRoot, cmd.path);
+    const action = await writeIfChanged(abs, cmd.contents, force);
+    out.push({ path: abs, action });
+  }
+  return out;
+}
+async function writeRules(editor, options = {}) {
+  const root = path.resolve(options.rootDir ?? process.cwd());
+  const force = options.force === true;
+  if (editor === "all") {
+    return [
+      { editor: "cursor", files: await writeCursor(root, force) },
+      { editor: "windsurf", files: await writeWindsurf(root, force) },
+      { editor: "codex", files: await writeCodex(root, force) },
+      { editor: "claude-code", files: await writeClaudeCode(root, force) }
+    ];
+  }
+  switch (editor) {
+    case "cursor":
+      return [{ editor, files: await writeCursor(root, force) }];
+    case "windsurf":
+      return [{ editor, files: await writeWindsurf(root, force) }];
+    case "codex":
+      return [{ editor, files: await writeCodex(root, force) }];
+    case "claude-code":
+      return [{ editor, files: await writeClaudeCode(root, force) }];
+  }
+}
+
+// src/commands/rules.ts
+var VALID = ["cursor", "windsurf", "codex", "claude-code", "all"];
+function registerRulesCommand(program) {
+  program.command("rules <editor>").description(
+    "Write editor rule files (cursor | windsurf | codex | claude-code | all). Teaches the editor AgentsKit conventions so generated code respects named-export-only, package boundaries, and the for-agents/* manifest."
+  ).option("--out <dir>", "Workspace root to write files into (default: cwd)").option("-f, --force", "Overwrite existing rule files (codex / claude-code skill always update in place)").action(async (editor, options) => {
+    if (!VALID.includes(editor)) {
+      process.stderr.write(`unknown editor "${editor}". Valid: ${VALID.join(", ")}
+`);
+      process.exit(1);
+    }
+    try {
+      const results = await writeRules(editor, {
+        rootDir: options.out,
+        force: options.force === true
+      });
+      const counts = { wrote: 0, updated: 0, skipped: 0 };
+      for (const { editor: ed, files } of results) {
+        process.stdout.write(`
+[${ed}]
+`);
+        for (const f of files) {
+          counts[f.action]++;
+          process.stdout.write(`  ${f.action.padEnd(7)} ${f.path}
+`);
+        }
+      }
+      process.stdout.write(
+        `
+Done \u2014 ${counts.wrote} wrote, ${counts.updated} updated, ${counts.skipped} skipped.
+`
+      );
+      if (counts.skipped > 0 && options.force !== true) {
+        process.stdout.write(`(re-run with --force to overwrite skipped files)
+`);
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`
+rules failed: ${message}
+`);
+      process.exit(1);
+    }
+  });
+}
 
 // src/commands/index.ts
 function createCli() {
@@ -4183,6 +4683,8 @@ function createCli() {
   registerRagCommand(program);
   registerAiCommand(program);
   registerFlowCommand(program);
+  registerPiiCommand(program);
+  registerRulesCommand(program);
   return program;
 }