@aragon-agent/cli 0.6.44 → 0.6.46

package/dist/agent/invocation-card.js

@@ -0,0 +1,169 @@
+/**
+ * Invocation cards (tui-invocation-cards): what a transcript shows INSTEAD of the
+ * system prompt a command submitted on the user's behalf.
+ *
+ * Pure and total: no IO, no React, no Ink, nothing but `import type`. ASCII ONLY -
+ * `src/agent/**` new files sit inside the `glyphs.test.ts` scan scope.
+ *
+ * ONE CONSTRUCTOR (I-3). `buildInvocationCard` is the only function that turns raw
+ * command-layer material into a card, `App.submitMessage` is its only caller, and
+ * `sanitizeInvocationCard` (the session-load path) shares its normaliser so a card
+ * written today and a card read back tomorrow cannot drift apart.
+ *
+ * ORDER IS REDACT -> NORMALISE -> LIMIT, and it is the load-bearing part (I-6). Cut
+ * first and a secret that straddles the cut leaves a prefix shorter than the
+ * redaction patterns' minimum length: the half-key sails through into the
+ * transcript, the session file and the exit replay.
+ */
+/**
+ * The renderer, the height estimate and the loader all read THESE numbers (I-4).
+ * A card's height is a function of its data and these limits, so it is bounded:
+ * header + `inputMaxLines` + hidden tail + note.
+ */
+export const INVOCATION_LIMITS = {
+    commandLineMaxChars: 2000,
+    inputMaxChars: 480,
+    inputMaxLines: 8,
+    nameMaxChars: 64,
+    factsMax: 5,
+    factMaxChars: 28,
+    noteMaxChars: 140,
+};
+const VARIANTS = ['skill', 'team', 'todo', 'govern'];
+// C0 except TAB (\x09) and LF (\x0a), then DEL and C1 (which includes the 8-bit CSI
+// \x9b). Matches the range `QueueOverlay` strips, so the card is no more permissive.
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARS = /[\x00-\x08\x0b-\x1f\x7f-\x9f]/g;
+const CAP_MARK = '...';
+/** Cut at a code-point boundary: a surrogate pair is never split. */
+function sliceCodePoints(text, count) {
+    if (count <= 0)
+        return '';
+    if (text.length <= count)
+        return text;
+    let end = count;
+    const last = text.charCodeAt(end - 1);
+    // A high surrogate at the cut would orphan its low half.
+    if (last >= 0xd800 && last <= 0xdbff)
+        end -= 1;
+    return text.slice(0, end);
+}
+function countCodePoints(text) {
+    let count = 0;
+    for (const _ of text)
+        count += 1;
+    return count;
+}
+/** CRLF and bare CR to LF (a bare CR returns Ink's cursor to column 0), then strip controls. */
+function normalizeText(text) {
+    return text.replace(/\r\n?/g, '\n').replace(CONTROL_CHARS, '');
+}
+function capCommandLine(text) {
+    const max = INVOCATION_LIMITS.commandLineMaxChars;
+    if (text.length <= max)
+        return text;
+    return sliceCodePoints(text, max - CAP_MARK.length) + CAP_MARK;
+}
+function capInput(text) {
+    const trimmed = text.trim();
+    if (trimmed === '')
+        return { input: '', hidden: 0 };
+    const lines = trimmed.split('\n');
+    let kept = lines.length > INVOCATION_LIMITS.inputMaxLines
+        ? lines.slice(0, INVOCATION_LIMITS.inputMaxLines).join('\n') : trimmed;
+    kept = sliceCodePoints(kept, INVOCATION_LIMITS.inputMaxChars).trimEnd();
+    return { input: kept, hidden: countCodePoints(trimmed) - countCodePoints(kept) };
+}
+function capSingleLine(text, max) {
+    const flat = text.replace(/\s+/g, ' ').trim();
+    if (countCodePoints(flat) <= max)
+        return flat;
+    return sliceCodePoints(flat, max - CAP_MARK.length) + CAP_MARK;
+}
+function capFacts(facts) {
+    return facts
+        .map((fact) => capSingleLine(fact, INVOCATION_LIMITS.factMaxChars))
+        .filter((fact) => fact !== '')
+        .slice(0, INVOCATION_LIMITS.factsMax);
+}
+function capNote(note) {
+    if (note === undefined)
+        return undefined;
+    const capped = capSingleLine(note, INVOCATION_LIMITS.noteMaxChars);
+    return capped === '' ? undefined : capped;
+}
+/** Shared by the write path and the load path so the two cannot diverge. */
+function assemble(parts) {
+    const { input, hidden } = capInput(normalizeText(parts.input));
+    const note = capNote(normalizeText(parts.note ?? ''));
+    return {
+        variant: parts.variant,
+        name: capSingleLine(normalizeText(parts.name), INVOCATION_LIMITS.nameMaxChars),
+        commandLine: capCommandLine(normalizeText(parts.commandLine).trim()),
+        input,
+        inputHidden: hidden,
+        facts: capFacts(parts.facts.map(normalizeText)),
+        ...(note !== undefined ? { note } : {}),
+    };
+}
+/**
+ * Total, never throws. `redact` is injected (the same closure `Command:` echo uses) so
+ * this module depends on nothing; the default is the identity for tests and the loader.
+ */
+export function buildInvocationCard(input, redact = (text) => text) {
+    const scrub = (text) => {
+        if (text === undefined)
+            return '';
+        try {
+            return redact(text);
+        }
+        catch {
+            return '';
+        }
+    };
+    return assemble({
+        variant: input.variant,
+        name: scrub(input.name),
+        commandLine: scrub(input.commandLine),
+        input: scrub(input.input),
+        facts: (input.facts ?? []).map((fact) => scrub(fact)),
+        note: input.note === undefined ? undefined : scrub(input.note),
+    });
+}
+function asString(value) {
+    return typeof value === 'string' ? value : null;
+}
+/**
+ * Session-load path: `null` for anything that is not a plausible card, so the caller
+ * drops the field and the entry degrades to a plain user message (I-7). Re-derives
+ * `inputHidden` from nothing - it trusts the stored count only when it is a sane integer.
+ */
+export function sanitizeInvocationCard(value) {
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const raw = value;
+    const variant = VARIANTS.find((candidate) => candidate === raw.variant);
+    const commandLine = asString(raw.commandLine);
+    if (variant === undefined || commandLine === null)
+        return null;
+    const name = asString(raw.name) ?? '';
+    const input = asString(raw.input) ?? '';
+    const facts = Array.isArray(raw.facts)
+        ? raw.facts.filter((fact) => typeof fact === 'string') : [];
+    const note = asString(raw.note) ?? undefined;
+    const card = assemble({ variant, name, commandLine, input, facts, note });
+    // A stored card that was already capped must keep its recorded `inputHidden`; the
+    // re-cap above can only ever add to it.
+    const stored = raw.inputHidden;
+    const storedHidden = typeof stored === 'number' && Number.isInteger(stored) && stored > 0
+        ? Math.min(stored, 10_000_000) : 0;
+    return { ...card, inputHidden: Math.max(card.inputHidden, storedHidden) };
+}
+/**
+ * Emergency kill switch (`ARAGON_NO_INVOCATION_CARDS=1`): every command and the App fall
+ * back to the pre-card behaviour. Read at call time, not import time, so a test (or a
+ * wrapper script) that sets the variable after load is honoured.
+ */
+export function invocationCardsEnabled(env = process.env) {
+    return env.ARAGON_NO_INVOCATION_CARDS !== '1';
+}

package/dist/agent/plan-prompt.d.ts

@@ -12,5 +12,12 @@ export declare const PLAN_MODE_BLOCK_VERSION = "v3-2026-10-26";
 export interface PlanModeBlockOptions {
     /** False under `-p` / piped stdin: no overlay can be rendered, so no tools. */
     interactive: boolean;
+    /**
+     * PLAN+GOVERN's interview addendum (governance-mode 6.3). Appended INSIDE the block,
+     * just before the closing tag, and only for an interactive block: a governed team needs
+     * a human to interview. Absent leaves the block byte-identical, so
+     * `PLAN_MODE_BLOCK_VERSION` does not move.
+     */
+    governAddendum?: string;
 }
 export declare function buildPlanModeBlock(options: PlanModeBlockOptions): string;

package/dist/agent/plan-prompt.js

@@ -42,7 +42,7 @@ const HEADLESS_PARAGRAPH = [
     '  write the finished plan as your final message in markdown.',
 ].join('\n');
 export function buildPlanModeBlock(options) {
-    const { interactive } = options;
+    const { interactive, governAddendum } = options;
     // NO ROUND COUNT APPEARS HERE, and none may be reintroduced: the number used
     // to be substituted from `planModeMaxAskRounds`, which meant the prompt itself
     // told the model it would run out. "3-5 questions" was also wrong against a
@@ -95,6 +95,7 @@ export function buildPlanModeBlock(options) {
         '- Never invent a path. Cite files you have read.',
         ...verdictRule,
         interactive ? SUPERSEDE_PARAGRAPH : HEADLESS_PARAGRAPH,
+        ...(interactive && governAddendum ? ['', governAddendum] : []),
         '</plan_mode>',
     ].join('\n');
 }

package/dist/agent/prompt-options.d.ts

@@ -1,3 +1,4 @@
+import type { InvocationCardInput } from './invocation-card.js';
 /** Explicit TUI task boundary; omission retains legacy programmatic behavior. */
 export interface PromptOptions {
     todoPolicy?: 'new-task' | 'continue';
@@ -5,6 +6,11 @@ export interface PromptOptions {
 /** History recording is independent of whether this message continues a plan. */
 export interface SubmitMessageOptions extends PromptOptions {
     userInitiated?: boolean;
+    /**
+     * Raw material for the transcript card. `submitMessage` builds the card exactly once
+     * (redact -> normalise -> limit); the payload sent to the model is unaffected.
+     */
+    invocation?: InvocationCardInput;
 }
 /** Startup outcome only; engine events still describe the result of the run. */
 export type PromptOutcome = {

package/dist/agent/queued-messages.d.ts

@@ -1,8 +1,11 @@
 import type { Entry } from './reducer.js';
+import type { InvocationCard } from './invocation-card.js';
 /** Full user text retained until Core acknowledges its opaque ID. */
 export interface PendingSteering {
     readonly queueId: string;
     readonly text: string;
+    /** Carried so the `queued -> user` rewrite keeps the card (tui-invocation-cards). */
+    readonly invocation?: InvocationCard;
 }
 /** Hide only active pending entries, using the same projection for measurement and paint. */
 export declare function selectTranscriptEntries(entries: Entry[], pending: readonly PendingSteering[]): Entry[];

package/dist/agent/queued-messages.js

@@ -13,7 +13,10 @@ export function reconcileSteeringReceipt(options) {
     if (!ids.size)
         return { entries: options.entries, pending: [...options.pending], changed: false };
     const entries = mergePendingEntries(options.entries, options.pending).map((entry) => entry.kind === 'queued' && ids.has(entry.queueId ?? '')
-        ? { id: entry.id, kind: 'user', text: entry.text } : entry);
+        ? {
+            id: entry.id, kind: 'user', text: entry.text,
+            ...(entry.invocation ? { invocation: entry.invocation } : {}),
+        } : entry);
     return { entries, pending: options.pending.filter((item) => !ids.has(item.queueId)), changed: true };
 }
 /** Supplement trimmed/cleared history for save and exit without deduplicating text. */

package/dist/agent/reducer.d.ts

@@ -11,6 +11,7 @@
  *     synthesizes a generic error notice (a swallowed throw is never a no-op).
  */
 import type { PendingSteering } from './queued-messages.js';
+import type { InvocationCard } from './invocation-card.js';
 import type { AgentEvent, ModelCost, ToolResult, TokenUsage } from '@aragon-agent/core';
 import type { AgentMode } from './agent-mode.js';
 import type { DispatchOutcome, SubagentRun, SubagentSpec, TeamSnapshot } from '../team/types.js';
@@ -21,9 +22,11 @@ import type { JobKind, ServiceSnapshot, ServiceStatus } from '../proc/types.js';
 import type { RetryPhase } from './retry-view.js';
 import type { FilePatch } from '../tools/patch.js';
 import type { TaskSummaryView } from '../fast/task-summary-types.js';
+import type { GovernanceCardData, GovernanceSnapshot } from '../governance/types.js';
+import type { Posture } from '../governance/posture.js';
 export type NoticeLevel = 'info' | 'warn' | 'error';
 export type ToastLevel = NoticeLevel | 'success';
-export type Overlay = null | 'settings' | 'model' | 'help' | 'queue' | 'confirm' | 'question' | 'plan' | 'kit' | 'prompts' | 'prompt-pick' | 'agents'
+export type Overlay = null | 'settings' | 'model' | 'help' | 'queue' | 'confirm' | 'question' | 'plan' | 'kit' | 'prompts' | 'prompt-pick' | 'agents' | 'governance'
 /**
  * tui-shortcut-drawer-and-task-summary §4.5: the keyboard drawer (`Ctrl+G` /
  * `/keys`). A single field, so the drawer and `/help` cannot both hold the
@@ -45,6 +48,7 @@ export type Entry = {
     id: string;
     kind: 'user';
     text: string;
+    invocation?: InvocationCard;
 }
 /**
  * A message submitted while a run was in flight (tui-shift-enter-copy-queue
@@ -61,6 +65,7 @@ export type Entry = {
     kind: 'queued';
     text: string;
     queueId?: string;
+    invocation?: InvocationCard;
 } | {
     id: string;
     kind: 'assistant';
@@ -140,6 +145,11 @@ export type Entry = {
     kind: 'notice';
     level: NoticeLevel;
     text: string;
+} | {
+    id: string;
+    kind: 'governance';
+    at: number;
+    card: GovernanceCardData;
 } | {
     id: string;
     kind: 'team';
@@ -372,6 +382,20 @@ export interface ViewState {
     agentMode: AgentMode;
     /** Set only by a DEFERRED `plan -> build`; drives the `PLAN -> BUILD` readout. */
     pendingAgentMode: AgentMode | null;
+    /**
+     * The user-visible posture and its deferred twin (governance-mode 4.3). Written in the
+     * SAME dispatch as `agentMode` / `pendingAgentMode` and only from what the controller
+     * adopted, so the badge and the gate cannot diverge. `agentMode` keeps gating.
+     */
+    posture: Posture;
+    pendingPosture: Posture | null;
+    /**
+     * The live governed-run snapshot, or `null` when there is no run.
+     *
+     * NEVER PERSISTED, like `team`: `/save` writes `entries` (the settlement cards are the
+     * history) and a resumed session has no live run to show.
+     */
+    governance: GovernanceSnapshot | null;
     /**
      * The live team roster, or `null` when no dispatch is running.
      *
@@ -486,6 +510,7 @@ export declare function initialViewState(seed?: ViewStateSeed): ViewState;
 export type ViewAction = {
     type: 'submit';
     text: string;
+    invocation?: InvocationCard;
 }
 /**
  * `controller.steer` was accepted; append the persistent queue marker
@@ -496,6 +521,7 @@ export type ViewAction = {
     type: 'steerQueued';
     queueId: string;
     text: string;
+    invocation?: InvocationCard;
 } | {
     type: 'steeringAccepted';
     ids: readonly string[];
@@ -622,6 +648,17 @@ export type ViewAction = {
     type: 'setAgentMode';
     mode: AgentMode;
     pending: AgentMode | null;
+    posture?: Posture;
+    pendingPosture?: Posture | null;
+} | {
+    type: 'govSnapshot';
+    snapshot: GovernanceSnapshot;
+} | {
+    type: 'govEnd';
+} | {
+    type: 'governanceCard';
+    card: GovernanceCardData;
+    at?: number;
 } | {
     type: 'teamStart';
     dispatchId: string;

package/dist/agent/reducer.js

@@ -15,6 +15,8 @@ import { reconcileSteeringReceipt } from './queued-messages.js';
 import { emptyContextUsage } from '../compaction/meter.js';
 import { addUsage, computeCost } from './usage.js';
 import { ENTRY_LIMITS, appendBounded, entryRetain, trimEntries } from './entry-limits.js';
+import { isGovernedDispatch } from '../governance/governed-dispatch.js';
+import { adoptPosture, foldGovernanceSnapshot } from './governance-view.js';
 /** Default auto-dismiss window for a toast. */
 export const DEFAULT_TOAST_TTL_MS = 2500;
 /**
@@ -62,6 +64,9 @@ export function initialViewState(seed = {}) {
         // `controller.getAgentMode()` so `--plan` renders on the first frame.
         agentMode: 'build',
         pendingAgentMode: null,
+        posture: 'build',
+        pendingPosture: null,
+        governance: null,
         team: null,
         todos: null,
         retry: null,
@@ -479,7 +484,10 @@ export function viewReducer(state, action) {
     switch (action.type) {
         case 'submit': {
             const { id, seq } = nextId(state);
-            const entry = { id, kind: 'user', text: action.text };
+            const entry = {
+                id, kind: 'user', text: action.text,
+                ...(action.invocation ? { invocation: action.invocation } : {}),
+            };
             return {
                 ...state,
                 seq,
@@ -502,7 +510,10 @@ export function viewReducer(state, action) {
             if (state.seenSteeringIds.has(action.queueId))
                 return state;
             const { id, seq } = nextId(state);
-            const entry = { id, kind: 'queued', queueId: action.queueId, text: action.text };
+            const entry = {
+                id, kind: 'queued', queueId: action.queueId, text: action.text,
+                ...(action.invocation ? { invocation: action.invocation } : {}),
+            };
             // NOTHING ELSE RESETS. This is not a new turn -- `turnProduced`,
             // `errorNoticed` and `aborted` describe the run that is still in
             // flight, and clearing them here would let the next `runEnd` failure
@@ -510,7 +521,10 @@ export function viewReducer(state, action) {
             return {
                 ...state, seq, ...appendEntry(state, state.entries, entry),
                 seenSteeringIds: new Set([...state.seenSteeringIds, action.queueId]),
-                pendingSteering: [...state.pendingSteering, { queueId: action.queueId, text: action.text }],
+                pendingSteering: [...state.pendingSteering, {
+                        queueId: action.queueId, text: action.text,
+                        ...(action.invocation ? { invocation: action.invocation } : {}),
+                    }],
             };
         }
         case 'steeringAccepted': {
@@ -904,6 +918,9 @@ export function viewReducer(state, action) {
                 // those three.
                 status: 'idle',
                 team: null,
+                // The live run snapshot goes with the conversation it was shown in (the run itself
+                // survives on disk and announces itself again on its next event).
+                governance: null,
                 fastEntryId: undefined,
                 turnProduced: false,
                 errorNoticed: false,
@@ -931,7 +948,24 @@ export function viewReducer(state, action) {
         // `controller.setAgentMode()` reported it ADOPTED, so this reducer has no
         // deferral logic of its own to get out of step with (§3.1 / R-P7).
         case 'setAgentMode':
-            return { ...state, agentMode: action.mode, pendingAgentMode: action.pending };
+            return {
+                ...state,
+                agentMode: action.mode,
+                pendingAgentMode: action.pending,
+                ...adoptPosture(state.posture, action),
+            };
+        // --- Governance (governance-mode 14.4) -------------------------------------
+        case 'govSnapshot': {
+            const governance = foldGovernanceSnapshot(state.governance, action.snapshot);
+            return governance === state.governance ? state : { ...state, governance };
+        }
+        case 'govEnd':
+            return state.governance === null ? state : { ...state, governance: null };
+        case 'governanceCard': {
+            const { id, seq } = nextId(state);
+            const entry = { id, kind: 'governance', at: action.at ?? Date.now(), card: action.card };
+            return { ...state, seq, ...appendEntry(state, state.entries, entry) };
+        }
         case 'toggleThinking':
             return { ...state, thinkingVisible: !state.thinkingVisible };
         case 'pushToast': {
@@ -976,19 +1010,26 @@ export function viewReducer(state, action) {
                 aborted: false,
                 active: true,
             };
+            const team = {
+                dispatchId: action.dispatchId,
+                active: true,
+                runs,
+                requested: action.requested,
+                startedAt: Date.now(),
+                messageCount: 0,
+            };
+            // A GOVERNED DISPATCH LEAVES NO TRANSCRIPT CARD (RV-3): a run is 10-20 dispatches,
+            // and a `TeamCard` for each would bury the conversation. The live snapshot is still
+            // written - the legion panel and `/agents` read it - and with no `teamEntryId`,
+            // `teamUpdate` / `teamEnd` already pass `entries` through untouched.
+            if (isGovernedDispatch(action.specs))
+                return { ...state, team };
             return {
                 ...state,
                 seq,
                 ...appendEntry(state, state.entries, entry),
                 teamEntryId: id,
-                team: {
-                    dispatchId: action.dispatchId,
-                    active: true,
-                    runs,
-                    requested: action.requested,
-                    startedAt: Date.now(),
-                    messageCount: 0,
-                },
+                team,
             };
         }
         case 'teamUpdate': {
@@ -1476,6 +1517,10 @@ export function viewReducer(state, action) {
                 // restored entries BEFORE this branch runs.
                 taskSummary: null,
                 taskSummaryPending: false,
+                // Same rule for a live governed run: `/resume` adopts another conversation, and
+                // a snapshot of the old one's run must not be drawn over it. Settlement cards
+                // arrive with the restored `entries`.
+                governance: null,
             };
         }
         // --- Background services (§3.10 / D-11) -----------------------------

package/dist/agent/system-prompt.d.ts

@@ -159,6 +159,25 @@ export interface SystemPromptParams {
      * own appended instructions still come last and still win.
      */
     structuredResultBlock?: string;
+    /**
+     * The rendered `<governance_mode>` block (the Orchestrator's rules), or `''`
+     * (governance-mode 6.1). Spliced AFTER the plan block and BEFORE `teamBlock`, and
+     * conditional like every block above: governance off produces the pre-feature prompt
+     * BYTE FOR BYTE. The caller omits `teamBlock` / `forcedTeamBlock` in GOVERN with gate
+     * mode `build`, because `task` is refused there and advertising it would describe a
+     * refused capability.
+     */
+    governBlock?: string;
+    /**
+     * The rendered `<governance_role>` block of a governed CHILD, or `''`. Spliced after
+     * `subagentBlock`. Never set together with `governBlock`.
+     */
+    governanceRoleBlock?: string;
+    /**
+     * PLAN+GOVERN's interview addendum (governance-mode 6.3), placed inside `<plan_mode>`.
+     * Only read when `agentMode` is `'plan'`; absent leaves the plan block unchanged.
+     */
+    governAddendum?: string;
 }
 /** Describe the active shell so the model does not emit incompatible syntax. */
 export declare function describeShell(): {

package/dist/agent/system-prompt.js

@@ -33,7 +33,10 @@ export function buildSystemPrompt(params) {
     const skillsBlock = params.skillsBlock ?? '';
     const hasSkills = skillsBlock.length > 0;
     const planBlock = params.agentMode === 'plan'
-        ? buildPlanModeBlock({ interactive: params.planInteractive !== false })
+        ? buildPlanModeBlock({
+            interactive: params.planInteractive !== false,
+            ...(params.governAddendum ? { governAddendum: params.governAddendum } : {}),
+        })
         : '';
     // `''` when the caller has no candidates or the feature is off — which is what
     // keeps this block's absence byte-identical to the pre-feature prompt (I-T1).
@@ -41,6 +44,8 @@ export function buildSystemPrompt(params) {
     const teamBlock = params.teamBlock ?? '';
     const forcedTeamBlock = params.forcedTeamBlock ?? '';
     const subagentBlock = params.subagentBlock ?? '';
+    const governBlock = params.governBlock ?? '';
+    const governanceRoleBlock = params.governanceRoleBlock ?? '';
     const todoBlock = params.todoBlock ?? '';
     const fastBlock = params.fastBlock ?? '';
     const backgroundBlock = params.backgroundBlock ?? '';
@@ -66,12 +71,15 @@ export function buildSystemPrompt(params) {
         // (whose step 1 defers to it). Conditional like every other optional block.
         ...(skillTriageBlock ? ['', skillTriageBlock] : []),
         ...(planBlock ? ['', planBlock] : []),
+        // AFTER the plan block it extends and BEFORE `<team_mode>` (governance-mode 6.1).
+        ...(governBlock ? ['', governBlock] : []),
         ...(teamBlock ? ['', teamBlock] : []),
         // IMMEDIATELY AFTER `<team_mode>`: "can" then "must". BEFORE the subagent
         // block, because a child reading an order to dispatch would be ordered to use
         // a tool it does not have (§3.6).
         ...(forcedTeamBlock ? ['', forcedTeamBlock] : []),
         ...(subagentBlock ? ['', subagentBlock] : []),
+        ...(governanceRoleBlock ? ['', governanceRoleBlock] : []),
         ...(todoBlock ? ['', todoBlock] : []),
         ...(fastBlock ? ['', fastBlock] : []),
         ...(backgroundBlock ? ['', backgroundBlock] : []),

package/dist/cli.js

@@ -25,7 +25,8 @@ import { formatMigrationNotice, migrateLegacyState } from './config/migrate-lega
 import { formatHomeMigrationNotice, migrateToHome } from './config/migrate-home.js';
 import { migrateStateOutOfConfig } from './config/migrate-state-out-of-config.js';
 import { runHistoryCommand } from './config/history-commands.js';
-import { COMPACTION_CONFIG_SET_KEYS, FAST_CONFIG_SET_KEYS, LOG_CONFIG_SET_KEYS, RETRY_CONFIG_SET_KEYS, TEAM_CONFIG_SET_KEYS, JOBS_CONFIG_SET_KEYS, TASK_SUMMARY_CONFIG_SET_KEYS, UPDATE_CONFIG_SET_KEYS, applyCompactionConfigSet, applyFastConfigSet, applyLogConfigSet, applyRetryConfigSet, applyTeamConfigSet, applyJobsConfigSet, applyTaskSummaryConfigSet, applyUpdateConfigSet, runConfigEdit, runConfigGet, runConfigHome, runConfigList, warnIfRedactionDisabled, } from './config/cli-commands.js';
+import { checkGovernanceCommandLine } from './config/governance-launch.js';
+import { COMPACTION_CONFIG_SET_KEYS, FAST_CONFIG_SET_KEYS, LOG_CONFIG_SET_KEYS, RETRY_CONFIG_SET_KEYS, TEAM_CONFIG_SET_KEYS, GOVERNANCE_CONFIG_SET_KEYS, JOBS_CONFIG_SET_KEYS, TASK_SUMMARY_CONFIG_SET_KEYS, UPDATE_CONFIG_SET_KEYS, applyCompactionConfigSet, applyFastConfigSet, applyLogConfigSet, applyRetryConfigSet, applyTeamConfigSet, applyGovernanceConfigSet, applyJobsConfigSet, applyTaskSummaryConfigSet, applyUpdateConfigSet, runConfigEdit, runConfigGet, runConfigHome, runConfigList, warnIfRedactionDisabled, } from './config/cli-commands.js';
 import { attachAgentEvents, attachTeamEvents, installLogging, setScreenRestore, setSignalTerminator, } from './logging/install.js';
 import { getLogger } from './logging/logger.js';
 import { runLogsCommand } from './logging/cli-commands.js';
@@ -230,6 +231,12 @@ function toFlags(opts) {
         // reports nothing, does nothing, and leaves compaction armed.
         compaction: opts.compaction,
         compactionThreshold: opts.compactionThreshold,
+        // Site three of three for the governance flags. `--no-governance` is declared alone, so
+        // commander defaults `opts.governance` to `true` when it is absent; only an explicit
+        // `false` is forwarded, which keeps silence from reading as an override.
+        govern: opts.govern,
+        planGovern: opts.planGovern,
+        governance: opts.governance === false ? false : undefined,
         // Site three of three for `--resume` / `--save` -- ELEVEN features, one trap
         // (`mouse` P1-2, `team` P1-4, `todo` C-9, render L4, retry, fast, update,
         // compaction, now session identity). A flag needs the `.option()`
@@ -1599,6 +1606,11 @@ const CONFIG_SET_KEYS = new Set([
     // membership set accepts a write that never happens - the two halves the static
     // guard in `config.test.ts` exists to pair up.
     ...TASK_SUMMARY_CONFIG_SET_KEYS,
+    // `governance.*` keys are handled by `applyGovernanceConfigSet`, same reasoning again
+    // (governance-mode 11.1): without this line they fall through to `Unknown config key`,
+    // and without the matching case in `runConfigSet` the membership set accepts a write
+    // that never happens.
+    ...GOVERNANCE_CONFIG_SET_KEYS,
 ]);
 /**
  * `aragon config set maxTokens <n|auto|default>`.
@@ -1771,6 +1783,15 @@ function runConfigSetValue(key, value) {
         process.stdout.write(`Set ${key} = ${String(merged.taskSummary[field])}\n`);
         return;
     }
+    const governancePatch = applyGovernanceConfigSet(key, value);
+    if (governancePatch) {
+        // Echoed from the STORED value, like every section above: `config set
+        // governance.maxRework 9` prints 5, which is what the read path will report.
+        const merged = updatePersistedConfig(governancePatch);
+        const field = key.slice('governance.'.length);
+        process.stdout.write(`Set ${key} = ${String(merged.governance[field])}\n`);
+        return;
+    }
     const patch = {};
     switch (key) {
         case 'provider':
@@ -2188,6 +2209,13 @@ function buildProgram() {
         .option('--compaction', 'Compact the conversation when the context window fills (the default)')
         .option('--no-compaction', 'Never compact; a full context window ends the run as before')
         .option('--compaction-threshold <n>', 'Occupancy that triggers compaction for this run: 0.9 or 90% (0.5-0.95)')
+        // Governance mode (governance-mode 11.2). `--govern` and `--plan-govern` only pick the
+        // starting posture, so neither is a persisted pair. `--no-governance` is deliberately
+        // negative-only: it can only ever switch the feature off, and `toFlags` forwards it only
+        // when explicitly given. The rules between them live in `validateGovernanceLaunch`.
+        .option('--govern', 'Start in GOVERN posture (a governed team of dev / review / test roles)')
+        .option('--plan-govern', 'Start in PLAN+GOVERN posture (clarify and plan first, then govern)')
+        .option('--no-governance', 'Disable governance mode for this launch (not persisted)')
         .option('--no-skills', 'Disable the skill system entirely (no catalog, no skill tools)')
         .option('--skill <name>', 'Force-load a skill at Level 2 for this run (repeatable)', (value, previous = []) => [...previous, value])
         .option('--skills-yes', 'Approve skill installs for this run (CI / headless)')
@@ -2251,6 +2279,22 @@ function buildProgram() {
         }
         void runInteractive(flags, { initialPrompt: prompt });
     });
+    // The governance flag rules (governance-mode 11.2), checked for EVERY command because the
+    // flags are root-level options and `exec` reads them through `toFlags(program.opts())`.
+    // A `preAction` hook runs before the root action as well as before each subcommand, so one
+    // place covers `aragon -p`, piped input and `aragon exec`.
+    program.hook('preAction', (root, action) => {
+        const check = checkGovernanceCommandLine(root.opts(), {
+            commandName: action.name(),
+            isRootAction: action === root,
+            stdinIsTty: !!process.stdin.isTTY,
+            stdoutIsTty: !!process.stdout.isTTY,
+        });
+        if (check.ok)
+            return;
+        process.stderr.write(`${check.message}\n`);
+        process.exit(2);
+    });
     // aragon config [set <key> <value> | path]
     const configCmd = program
         .command('config')