@amoree-code/ocean 0.0.0-stage → 1.1.0

package/dist/interfaces/cli/memory-command.js

@@ -0,0 +1,317 @@
+import { readFile } from "node:fs/promises";
+import { evaluateRecall, } from "@ocean/brain/brain/brain-eval.js";
+import { brainIndexPath, computeCorpusHash, reindexBrain, } from "@ocean/brain/brain/brain-reindex.js";
+import { brainNeighbors, brainRead, brainSearch, } from "@ocean/brain/brain/brain-service.js";
+import { doctorMemoryIndexes, syncMemoryIndexes, } from "@ocean/brain/memory/index-sync.js";
+import { memoryDigest } from "@ocean/brain/memory/memory-digest.js";
+import { HARVEST_SOURCES, harvestMemory, importClaudeExport, } from "@ocean/brain/memory/memory-harvest.js";
+import { approveCandidate, listCandidates, rejectCandidate, } from "@ocean/brain/memory/memory-review.js";
+import { deleteMemoryRecord, memoryHistory, purgeMemoryCopies, restoreMemory, } from "@ocean/brain/memory/memory-trash.js";
+import { deleteProfileFact, readProfileFacts, writeProfileFact, } from "@ocean/brain/memory/profile-facts.js";
+import { isValidProjectId } from "@ocean/core/domain/context/project-id.js";
+import { folderProject } from "@ocean/core/shared/project-resolution.js";
+import { defaultBrainIndexPort } from "../../composition/runtime.js";
+import { createOllamaEmbedder } from "../../infrastructure/providers/ollama-embedder.js";
+async function runReindex(args) {
+    const noVectors = args.includes("--no-vectors");
+    let embedder = null;
+    if (!noVectors) {
+        try {
+            embedder = await createOllamaEmbedder();
+        }
+        catch (error) {
+            console.error(`reindex refused: embedder unavailable (${error instanceof Error ? error.message : String(error)}). Pass --no-vectors to index without vectors.`);
+            process.exitCode = 1;
+            return;
+        }
+    }
+    const result = await reindexBrain({
+        embedder,
+        indexPort: defaultBrainIndexPort,
+    });
+    console.log(JSON.stringify(result, null, 2));
+}
+const searchUsage = "Usage: ocean memory search <query> [--project <id> | --all] [--json]";
+const neighborsUsage = "Usage: ocean memory neighbors <id|path> [--depth N] [--project <id> | --all]";
+// --project <id> / --all, shared by search and neighbors. Default: the cwd's project plus
+// global records; --all is the explicit unscoped view. null means the flags are malformed.
+function parseScopeFlags(args) {
+    let all = false;
+    let project;
+    const rest = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--all")
+            all = true;
+        else if (arg === "--project") {
+            project = args[index + 1] ?? "";
+            index += 1;
+        }
+        else
+            rest.push(arg);
+    }
+    if (project !== undefined && (all || !isValidProjectId(project)))
+        return null;
+    return { all, project, rest };
+}
+async function scopeFrom(flags) {
+    return flags.all
+        ? undefined
+        : { project: flags.project ?? (await folderProject(process.cwd())) };
+}
+async function runSearch(args) {
+    const flags = parseScopeFlags(args);
+    const json = args.includes("--json");
+    const query = (flags?.rest ?? [])
+        .filter((arg) => !arg.startsWith("--"))
+        .join(" ");
+    if (!flags || !query) {
+        console.error(searchUsage);
+        process.exitCode = 1;
+        return;
+    }
+    try {
+        const result = await brainSearch({
+            query,
+            scope: await scopeFrom(flags),
+            indexPort: defaultBrainIndexPort,
+        });
+        console.log(json ? JSON.stringify(result) : JSON.stringify(result, null, 2));
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exitCode = 1;
+    }
+}
+async function runRead(args) {
+    const idOrPath = args[0];
+    if (!idOrPath) {
+        console.error("Usage: ocean memory read <id|path>");
+        process.exitCode = 1;
+        return;
+    }
+    try {
+        console.log(JSON.stringify(await brainRead({ idOrPath, indexPort: defaultBrainIndexPort }), null, 2));
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exitCode = 1;
+    }
+}
+async function runNeighbors(args) {
+    const flags = parseScopeFlags(args);
+    const rest = flags?.rest ?? [];
+    const depthIndex = rest.indexOf("--depth");
+    const depth = depthIndex >= 0 ? Number(rest[depthIndex + 1]) : 1;
+    const idOrPath = rest[0];
+    if (!flags || !idOrPath || idOrPath.startsWith("--")) {
+        console.error(neighborsUsage);
+        process.exitCode = 1;
+        return;
+    }
+    try {
+        console.log(JSON.stringify(await brainNeighbors({
+            idOrPath,
+            depth: depth === 2 ? 2 : 1,
+            scope: await scopeFrom(flags),
+            indexPort: defaultBrainIndexPort,
+        }), null, 2));
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exitCode = 1;
+    }
+}
+async function runFacts(args) {
+    const profile = args[0];
+    if (!profile) {
+        console.error("Usage: ocean memory facts <profile> [key] [value]");
+        process.exitCode = 1;
+        return;
+    }
+    try {
+        if (args[1] === "delete" && args[2])
+            console.log(JSON.stringify({ deleted: await deleteProfileFact(profile, args[2]) }, null, 2));
+        else if (args.length >= 3)
+            console.log(JSON.stringify(await writeProfileFact(profile, args[1], args.slice(2).join(" ")), null, 2));
+        else
+            console.log(JSON.stringify(await readProfileFacts(profile), null, 2));
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exitCode = 1;
+    }
+}
+// The value after a flag, or undefined.
+function flagValue(args, flag) {
+    const index = args.indexOf(flag);
+    return index >= 0 ? args[index + 1] : undefined;
+}
+// Soft delete, history, restore and purge of memory records (T-296). Purge is CLI-only and
+// lists what it would drop until --yes confirms it.
+async function runRecordCommand(action, args) {
+    const positional = args.filter((arg, index) => !arg.startsWith("--") && !args[index - 1]?.startsWith("--"));
+    let result;
+    if (action === "history") {
+        const limit = Number(flagValue(args, "--limit") ?? 20);
+        result = await memoryHistory({ path: positional[0], limit });
+    }
+    else if (action === "restore") {
+        if (!positional[0])
+            throw new Error("Usage: ocean memory restore <audit-id> [--hash <sha256>]");
+        result = await restoreMemory({
+            id: positional[0],
+            expectedHash: flagValue(args, "--hash"),
+            source: "cli",
+        });
+    }
+    else if (action === "delete") {
+        const hash = flagValue(args, "--hash");
+        if (!positional[0] || !hash)
+            throw new Error("Usage: ocean memory delete <path> --hash <sha256>");
+        result = await deleteMemoryRecord({
+            path: positional[0],
+            expectedHash: hash,
+            source: "cli",
+        });
+    }
+    else {
+        const days = flagValue(args, "--days");
+        result = await purgeMemoryCopies({
+            apply: args.includes("--yes"),
+            days: days === undefined ? undefined : Number(days),
+        });
+        if (!args.includes("--yes"))
+            console.error("Dry run: pass --yes to remove these copies for good.");
+    }
+    console.log(JSON.stringify(result, null, 2));
+}
+// Candidate review (T-296 P5): list, approve into a record, or reject. Edit = edit the candidate
+// file, then approve it.
+async function runReview(args) {
+    const [verb = "list", id] = args;
+    if (verb === "list") {
+        // `--project <id>`: the candidates `ocean pull` filed under that project (T-305).
+        const project = flagValue(args, "--project");
+        const candidates = (await listCandidates()).filter((item) => !project || item.meta.project === project);
+        if (args.includes("--json")) {
+            console.log(JSON.stringify(candidates, null, 2));
+            return;
+        }
+        if (!candidates.length)
+            console.log("No memory candidates to review.");
+        for (const item of candidates)
+            console.log(`${item.id}  ${item.origin.padEnd(8)} ${typeof item.meta.project === "string" ? `[${item.meta.project}] ` : ""}${item.target || "(no target)"}  ${item.file}${item.reason ? ` — ${item.reason}` : ""}`);
+        return;
+    }
+    if ((verb === "approve" || verb === "reject") && id) {
+        const result = verb === "approve"
+            ? await approveCandidate({ id, to: flagValue(args, "--to") })
+            : await rejectCandidate(id);
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    console.error("Usage: ocean memory review [list] [--project <id>] [--json] | approve <id> [--to <record path>] | reject <id>");
+    process.exitCode = 1;
+}
+// Recall@k over a JSON list of {question, expect, project?}; fails below --min.
+async function runEval(args) {
+    const file = args.find((arg, index) => !arg.startsWith("--") && !args[index - 1]?.startsWith("--"));
+    if (!file) {
+        console.error("Usage: ocean memory eval <questions.json> [--k N] [--min 0.9] [--vectors]");
+        process.exitCode = 1;
+        return;
+    }
+    const cases = JSON.parse(await readFile(file, "utf8"));
+    const result = await evaluateRecall(cases, {
+        indexPort: defaultBrainIndexPort,
+        embedder: args.includes("--vectors") ? await createOllamaEmbedder() : null,
+        k: Number(flagValue(args, "--k") ?? 5),
+    });
+    console.log(JSON.stringify(result, null, 2));
+    if (result.recall < Number(flagValue(args, "--min") ?? 0.9))
+        process.exitCode = 1;
+}
+async function indexIsStale() {
+    try {
+        const reader = defaultBrainIndexPort.openIndexReadOnly(brainIndexPath());
+        try {
+            return reader.meta.corpusHash !== (await computeCorpusHash());
+        }
+        finally {
+            reader.close();
+        }
+    }
+    catch {
+        return null;
+    }
+}
+export async function runMemoryCommand(action, args) {
+    if (action === "history" ||
+        action === "restore" ||
+        action === "delete" ||
+        action === "purge")
+        return runRecordCommand(action, args);
+    if (action === "reindex")
+        return runReindex(args);
+    if (action === "review")
+        return runReview(args);
+    if (action === "harvest") {
+        const source = flagValue(args, "--source");
+        if (source && !HARVEST_SOURCES.includes(source))
+            throw new Error(`--source must be one of ${HARVEST_SOURCES.join(", ")}`);
+        const items = await harvestMemory({
+            sources: source ? [source] : undefined,
+            apply: args.includes("--yes"),
+        });
+        console.log(JSON.stringify(items, null, 2));
+        if (!args.includes("--yes"))
+            console.error("Dry run: pass --yes to propose the new ones as candidates.");
+        return;
+    }
+    if (action === "import-claude") {
+        const directory = args.find((arg) => !arg.startsWith("--"));
+        if (!directory)
+            throw new Error("Usage: ocean memory import-claude <export-dir> [--yes]");
+        console.log(JSON.stringify(await importClaudeExport(directory, { apply: args.includes("--yes") }), null, 2));
+        if (!args.includes("--yes"))
+            console.error("Dry run: pass --yes to propose them as candidates.");
+        return;
+    }
+    if (action === "eval")
+        return runEval(args);
+    if (action === "digest") {
+        const lines = await memoryDigest({ stale: await indexIsStale() });
+        console.log(lines.length ? lines.join("\n") : "memory: nothing to review");
+        return;
+    }
+    if (action === "search")
+        return runSearch(args);
+    if (action === "read")
+        return runRead(args);
+    if (action === "neighbors")
+        return runNeighbors(args);
+    if (action === "facts")
+        return runFacts(args);
+    if (action === "doctor") {
+        const result = await doctorMemoryIndexes();
+        if (!result.ok) {
+            if (result.missing.length)
+                console.error(`NOT READY: unindexed records: ${result.missing.join(", ")}`);
+            if (result.broken.length)
+                console.error(`NOT READY: broken index links: ${result.broken.join(", ")}`);
+            process.exitCode = 1;
+        }
+        else
+            console.log("PROVEN: memory and knowledge indexes are synchronized.");
+        return;
+    }
+    if (action === "sync") {
+        const result = await syncMemoryIndexes(args.includes("--apply"));
+        console.log(JSON.stringify({ dryRun: !args.includes("--apply"), stores: result }, null, 2));
+        return;
+    }
+    console.error("Usage: ocean memory doctor|sync [--apply]|review [list|approve <id> [--to <path>]|reject <id>]|eval <questions.json> [--k N] [--min R]|digest|harvest [--source <id>] [--yes]|import-claude <export-dir> [--yes]|history [path] [--limit N]|restore <id> [--hash <sha256>]|delete <path> --hash <sha256>|purge [--days N] [--yes]|facts <profile> [key] [value]|facts <profile> delete <key>|reindex [--no-vectors]|search <q> [--project <id>|--all] [--json]|read <id|path>|neighbors <id|path> [--depth N] [--project <id>|--all]");
+    process.exitCode = 1;
+}
+//# sourceMappingURL=memory-command.js.map

package/dist/interfaces/cli/migrate-command.js

@@ -0,0 +1,26 @@
+import { access } from "node:fs/promises";
+import { oceanPath, SYSTEM_DIR } from "@ocean/core/shared/paths.js";
+import { openSessionStore } from "@ocean/loop/infrastructure/persistence/session-store.js";
+import { backfillSessionProjects } from "@ocean/loop/sessions/session-projects.js";
+export async function runMigrateCommand(apply) {
+    const database = oceanPath(SYSTEM_DIR, "sessions", "sessions.sqlite");
+    const exists = await access(database).then(() => true, () => false);
+    if (!apply) {
+        console.log(JSON.stringify({
+            applyRequired: true,
+            databaseExists: exists,
+            action: "ocean migrate --apply",
+            note: "Applying opens the session database and runs idempotent schema migrations.",
+        }, null, 2));
+        return;
+    }
+    const store = await openSessionStore();
+    try {
+        const projects = await backfillSessionProjects(store);
+        console.log(JSON.stringify({ migrated: true, integrity: store.integrityCheck(), projects }, null, 2));
+    }
+    finally {
+        store.close();
+    }
+}
+//# sourceMappingURL=migrate-command.js.map

package/dist/interfaces/cli/observe-command.js

@@ -0,0 +1,78 @@
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { oceanPath, resolveWithin, SYSTEM_DIR, } from "@ocean/core/shared/paths.js";
+import { redactSecrets } from "../../infrastructure/observability/runtime-logger.js";
+const observationsRoot = () => oceanPath(SYSTEM_DIR, "observations");
+export async function runObserveCommand(args) {
+    if (args[0] === "show") {
+        const id = args[1];
+        if (!id || !/^[a-f0-9-]+$/i.test(id))
+            throw new Error("Usage: ocean observe show <id> [--grep <pattern>]");
+        const observation = JSON.parse(await readFile(resolveWithin(observationsRoot(), `${id}.json`), "utf8"));
+        const grepIndex = args.indexOf("--grep");
+        if (grepIndex >= 0) {
+            const pattern = args[grepIndex + 1];
+            if (!pattern)
+                throw new Error("--grep requires a pattern");
+            const matcher = new RegExp(pattern, "i");
+            process.stdout.write(`${[observation.stdout, observation.stderr]
+                .join("\n")
+                .split("\n")
+                .filter((line) => matcher.test(line))
+                .join("\n")}\n`);
+        }
+        else
+            console.log(JSON.stringify(observation, null, 2));
+        return;
+    }
+    const separator = args.indexOf("--");
+    const command = separator >= 0 ? args.slice(separator + 1) : args;
+    if (!command.length)
+        throw new Error("Usage: ocean observe -- <command> [args]");
+    const result = await capture(command);
+    await mkdir(observationsRoot(), { recursive: true });
+    await writeFile(resolveWithin(observationsRoot(), `${result.id}.json`), `${JSON.stringify(result, null, 2)}\n`, { mode: 0o600 });
+    const decisive = result.exitCode === 0
+        ? lastLines(result.stdout, 8)
+        : lastLines(`${result.stderr}\n${result.stdout}`, 16);
+    console.log(JSON.stringify({ id: result.id, exitCode: result.exitCode, decisive }, null, 2));
+    process.exitCode = result.exitCode;
+}
+async function capture(command) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command[0], command.slice(1), {
+            cwd: process.cwd(),
+            env: process.env,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (chunk) => {
+            stdout = boundedAppend(stdout, chunk.toString());
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr = boundedAppend(stderr, chunk.toString());
+        });
+        child.once("error", reject);
+        child.once("close", (code) => resolve({
+            id: randomUUID(),
+            command,
+            cwd: process.cwd(),
+            exitCode: code ?? 1,
+            stdout: redactSecrets(stdout),
+            stderr: redactSecrets(stderr),
+            createdAt: new Date().toISOString(),
+        }));
+    });
+}
+function boundedAppend(current, chunk) {
+    const combined = current + chunk;
+    return combined.length <= 1_000_000
+        ? combined
+        : combined.slice(combined.length - 1_000_000);
+}
+function lastLines(value, count) {
+    return value.trim().split("\n").filter(Boolean).slice(-count);
+}
+//# sourceMappingURL=observe-command.js.map

package/dist/interfaces/cli/onboard-command.js

@@ -0,0 +1,123 @@
+import { createInterface } from "node:readline/promises";
+import { applyClients, planClients, readClientState, recordVerification, verifyClient, } from "../../application/clients/clients.js";
+import { applyHooks, planHooks } from "../../application/clients/hooks.js";
+import { applyNative, planNative } from "../../application/clients/native.js";
+import { loadOnboardingState, saveOnboardingState, } from "../../application/onboarding/state.js";
+import { buildSteps, ONBOARDING_VERSION, } from "../../application/onboarding/steps.js";
+import { installShellIntegration, setProviderEnabled, syncProviderWrappers, wrapperDoctor, wrapperStatus, } from "../../infrastructure/wrappers/wrapper-manager.js";
+import { setup } from "./setup-command.js";
+const stepDependencies = () => ({
+    setup: () => setup(),
+    wrappers: {
+        wrapperStatus,
+        setProviderEnabled,
+        syncProviderWrappers,
+        installShellIntegration,
+        wrapperDoctor: () => wrapperDoctor(),
+    },
+    clients: {
+        plan: () => planClients(),
+        apply: (clients) => applyClients({ clients }),
+        verify: async (client) => {
+            const check = await verifyClient(client);
+            await recordVerification(client, check.ok);
+            return check;
+        },
+        approved: async () => Object.keys((await readClientState()).approved),
+        hooks: () => planHooks(),
+        applyHooks: async (batch) => (await applyHooks({ batch })).results,
+        native: () => planNative(),
+        applyNative: async (batch) => (await applyNative({ batch })).results,
+    },
+});
+function terminalIO(interactive) {
+    const prompt = interactive
+        ? createInterface({ input: process.stdin, output: process.stdout })
+        : undefined;
+    return {
+        io: {
+            interactive,
+            say: (line) => console.log(line),
+            ask: async (question, fallback) => prompt ? await prompt.question(question) : fallback,
+        },
+        close: () => prompt?.close(),
+    };
+}
+// Runs every step that is not already done/skipped, saving after each one so an
+// interrupted run resumes at the first pending step. A completed state is a no-op.
+export async function onboard(options = {}) {
+    const interactive = !options.yes && Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    const terminal = options.io ? undefined : terminalIO(interactive);
+    const io = options.io ?? terminal.io;
+    const steps = options.steps ?? buildSteps(stepDependencies());
+    try {
+        const state = await loadOnboardingState();
+        if (options.reset) {
+            if (!steps.some((step) => step.id === options.reset))
+                throw new Error(`Unknown onboarding step '${options.reset}'`);
+            delete state.steps[options.reset];
+        }
+        for (const step of steps) {
+            if (!state.steps[step.id] || !step.reopen)
+                continue;
+            const reason = await step.reopen();
+            if (!reason)
+                continue;
+            io.say(`Reopening ${step.id}: ${reason}`);
+            delete state.steps[step.id];
+        }
+        const pending = steps.filter((step) => !state.steps[step.id]);
+        if (pending.length === 0) {
+            io.say("Ocean onboarding is complete. Use `ocean onboard --reset <step>` to redo a step, or `ocean doctor` for health.");
+            return;
+        }
+        io.say(`Ocean onboarding: ${pending.length} of ${steps.length} steps to go.`);
+        for (const [index, step] of pending.entries()) {
+            io.say(`\n[${index + 1}/${pending.length}] ${step.title}`);
+            state.steps[step.id] =
+                !io.interactive && step.optional ? "skipped" : await step.run(io);
+            state.version = ONBOARDING_VERSION;
+            await saveOnboardingState(state);
+        }
+        await onboardStatus(steps, io.say);
+        const skipped = Object.entries(state.steps)
+            .filter(([, status]) => status === "skipped")
+            .map(([id]) => id);
+        io.say(`\nOnboarding finished.${skipped.length ? ` Skipped: ${skipped.join(", ")} (redo with ocean onboard --reset <step>).` : ""}`);
+    }
+    finally {
+        terminal?.close();
+    }
+}
+// Read-only: shows each step as done, skipped or pending, without running anything.
+export async function onboardStatus(steps, say = console.log) {
+    const state = await loadOnboardingState();
+    for (const step of steps)
+        say(`${(state.steps[step.id] ?? "pending").padEnd(8)} ${step.id.padEnd(10)} ${step.title}`);
+}
+// Re-runs just the clients step (enable/disable + sync), independent of onboarding state.
+export async function manageClients() {
+    const step = buildSteps(stepDependencies()).find((candidate) => candidate.id === "clients");
+    const terminal = terminalIO(Boolean(process.stdin.isTTY && process.stdout.isTTY));
+    try {
+        await step?.run(terminal.io);
+    }
+    finally {
+        terminal.close();
+    }
+}
+export async function runOnboardCommand(argv) {
+    if (argv.includes("--status")) {
+        await onboardStatus(buildSteps(stepDependencies()));
+        return;
+    }
+    const resetIndex = argv.indexOf("--reset");
+    const reset = resetIndex >= 0 ? argv[resetIndex + 1] : undefined;
+    if (resetIndex >= 0 && !reset) {
+        console.error("Usage: ocean onboard [--yes] [--status] [--reset <step>]");
+        process.exitCode = 1;
+        return;
+    }
+    await onboard({ yes: argv.includes("--yes"), reset });
+}
+//# sourceMappingURL=onboard-command.js.map

package/dist/interfaces/cli/operate-command.js

@@ -0,0 +1,59 @@
+import { classifyIntent } from "@ocean/context/context/intent-router.js";
+import { oceanRoot } from "@ocean/core/shared/paths.js";
+import { knownTaskPrefixes } from "@ocean/core/shared/project-resolution.js";
+import { operationForIntent, } from "@ocean/loop/operations/operation-contract.js";
+import { runOperation } from "@ocean/loop/operations/record-operations.js";
+import { guardedRunOperation, } from "@ocean/loop/operations/write-guard.js";
+import { defaultBrainIndexPort } from "../../composition/runtime.js";
+const OPERATION_BUDGET = {
+    maxFiles: 20,
+    maxBytes: 200_000,
+    maxChars: 50_000,
+    maxOperationCost: 10,
+};
+export async function runOperateCommand(text) {
+    const classification = classifyIntent(text, await knownTaskPrefixes());
+    const mapped = operationForIntent(classification);
+    if (!mapped.operation) {
+        console.log(JSON.stringify({
+            classification,
+            operation: null,
+            ok: false,
+            reason: mapped.reason,
+        }));
+        return;
+    }
+    const operation = mapped.operation;
+    const scope = {
+        action: operation,
+        target: oceanRoot(),
+        identifier: classification.identifier ?? null,
+        projectId: null,
+    };
+    const { decision, result } = await guardedRunOperation({
+        sessionId: "cli-operate",
+        classification,
+        scope,
+        budget: OPERATION_BUDGET,
+    }, async (approval) => runOperation(operation, classification, OPERATION_BUDGET, {
+        cwd: process.cwd(),
+        query: text,
+        approval: approval ?? undefined,
+        indexPort: defaultBrainIndexPort,
+    }));
+    console.log(JSON.stringify({
+        classification,
+        operation,
+        decision,
+        ...(result ?? { ok: false, reason: decision.reason }),
+    }));
+    if (!decision.allowed ||
+        (result &&
+            typeof result === "object" &&
+            "ok" in result &&
+            result.ok === false &&
+            operation.endsWith(".write"))) {
+        process.exitCode = 2;
+    }
+}
+//# sourceMappingURL=operate-command.js.map

package/dist/interfaces/cli/profiles-command.js

@@ -0,0 +1,70 @@
+import { selectProfileForTask } from "../../application/profiles/profile-suggestion.js";
+import { applyProfileUpgrade, planProfileUpgrade, rollbackProfileUpgrade, validateProfiles, } from "../../application/profiles/profile-upgrade-service.js";
+import { loadProfile } from "../../infrastructure/filesystem/profile-loader.js";
+const usage = "Usage: ocean profiles validate | upgrade --check | --apply | --rollback | suggest --task <id> [--profile <name>]";
+function print(value) {
+    console.log(JSON.stringify(value, null, 2));
+}
+export async function runProfilesCommand(args) {
+    const [action, mode] = args;
+    try {
+        if (action === "suggest") {
+            const value = (flag) => {
+                const index = args.indexOf(flag);
+                return index >= 0 ? args[index + 1] : undefined;
+            };
+            const task = value("--task");
+            if (!task)
+                throw new Error(usage);
+            print(await selectProfileForTask(task, {
+                cwd: process.cwd(),
+                override: value("--profile"),
+            }));
+            return;
+        }
+        if (action === "validate") {
+            const results = await validateProfiles(loadProfile);
+            print(results);
+            if (results.some((result) => !result.ok))
+                process.exitCode = 1;
+            return;
+        }
+        if (action === "upgrade" && mode === "--check") {
+            const plan = await planProfileUpgrade();
+            // The manifest shows what would change; the new file contents are not printed.
+            print(plan.map(({ next: _next, ...entry }) => entry));
+            if (plan.some((e) => e.status === "rejected" || e.status === "collision"))
+                process.exitCode = 1;
+            return;
+        }
+        if (action === "upgrade" && mode === "--apply") {
+            const result = await applyProfileUpgrade();
+            print({
+                applied: result.applied,
+                blocked: result.blocked.map(({ next: _next, ...entry }) => entry),
+                ...(result.applied.length
+                    ? {
+                        note: "Upgraded profiles have a new identity: sessions created before the upgrade cannot be resumed. `ocean profiles upgrade --rollback` restores the v1 files.",
+                    }
+                    : {}),
+            });
+            if (result.blocked.length)
+                process.exitCode = 1;
+            return;
+        }
+        if (action === "upgrade" && mode === "--rollback") {
+            const result = await rollbackProfileUpgrade();
+            print(result);
+            if (result.skipped.length)
+                process.exitCode = 1;
+            return;
+        }
+        console.error(usage);
+        process.exitCode = 1;
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=profiles-command.js.map