@attest-ai/core 1.0.0-rc.2 → 1.0.0-rc.4

package/dist/esm/cli.js

@@ -2,13 +2,14 @@
 
 // src/cli.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import * as fs3 from "fs";
+import * as fs4 from "fs";
 import * as os2 from "os";
-import { fileURLToPath } from "url";
+import * as path4 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/version.ts
-var VERSION = "1.0.0-rc.2";
-var ENGINE_VERSION = "1.0.0-rc.2";
+var VERSION = "1.0.0-rc.4";
+var ENGINE_VERSION = "1.0.0-rc.4";
 
 // src/engine-manager.ts
 import { spawn, spawnSync } from "child_process";
@@ -76,7 +77,7 @@ function httpsGet(url, redirectCount = 0) {
       new Error(`Too many redirects (>${MAX_REDIRECTS}) following ${url}`)
     );
   }
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const client = url.startsWith("https:") ? https : http;
     client.get(url, (res) => {
       const status = res.statusCode ?? 0;
@@ -87,7 +88,7 @@ function httpsGet(url, redirectCount = 0) {
           return;
         }
         res.resume();
-        resolve(httpsGet(location, redirectCount + 1));
+        resolve2(httpsGet(location, redirectCount + 1));
         return;
       }
       if (status < 200 || status >= 300) {
@@ -97,7 +98,7 @@ function httpsGet(url, redirectCount = 0) {
       }
       const chunks = [];
       res.on("data", (chunk) => chunks.push(chunk));
-      res.on("end", () => resolve(Buffer.concat(chunks)));
+      res.on("end", () => resolve2(Buffer.concat(chunks)));
       res.on("error", reject);
     }).on("error", reject);
   });
@@ -228,8 +229,8 @@ Install options:
   }
   return [await downloadEngine(), "download"];
 }
-async function resolveEngine(explicitPath, options = {}) {
-  const [enginePath, source] = await locateEngine(explicitPath, options.allowDownload ?? true);
+async function resolveEngine(explicitPath, options2 = {}) {
+  const [enginePath, source] = await locateEngine(explicitPath, options2.allowDownload ?? true);
   const found = engineVersion(enginePath);
   if (found !== ENGINE_VERSION) {
     throw new EngineVersionMismatchError(enginePath, source, found, ENGINE_VERSION);
@@ -288,8 +289,8 @@ not_evaluated: warn
 `;
 var GITHUB_WORKFLOW_TEMPLATE = `# Written by \`attest init --ci github\`.
 # The test step records its outcome and continues so the report is always uploaded,
-# the policy evaluated and the pull request annotated; the last step fails the job
-# when the tests failed. A policy warning (exit 2) does not fail the job.
+# the JUnit file written, the policy evaluated and the pull request summarised; the last
+# step fails the job when the tests failed. A policy warning (exit 2) does not fail the job.
 name: attest
 
 on:
@@ -299,11 +300,13 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   attest:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@v6
         with:
@@ -317,12 +320,17 @@ jobs:
         id: tests
         continue-on-error: true
         run: npx vitest run ${REPORT_ARGS}
+      - name: Write the JUnit report
+        if: always()
+        run: npx attest report junit --report attest-report.json --out attest-junit.xml
       - name: Upload the Attest report
         if: always()
         uses: actions/upload-artifact@v7
         with:
           name: attest-report
-          path: attest-report.json
+          path: |
+            attest-report.json
+            attest-junit.xml
           if-no-files-found: error
       - name: Evaluate the merge policy
         if: always()
@@ -336,8 +344,9 @@ jobs:
           fi
           exit "$code"
       - name: Annotate the pull request
-        # Fork pull requests get a read-only token that cannot post reviews; the last step
-        # still fails the job when tests failed.
+        # Posts one summary comment (updated on every run) and annotates failures at their
+        # file and line. Fork pull requests get a read-only token that cannot comment; the
+        # last step still fails the job when tests failed.
         if: >-
           always() && github.event_name == 'pull_request' &&
           github.event.pull_request.head.repo.full_name == github.repository
@@ -350,49 +359,264 @@ jobs:
           echo "::error::vitest failed; see the Run tests step"
           exit 1
 `;
-function write(file, content) {
+function write(targetDir, rel, content, result, quiet) {
+  const file = path2.join(targetDir, ...rel.split("/"));
   if (fs2.existsSync(file)) {
-    process.stderr.write(`Skipped (exists): ${file}
+    result.skipped.push(rel);
+    if (!quiet) process.stderr.write(`Skipped (exists): ${file}
 `);
     return;
   }
   fs2.mkdirSync(path2.dirname(file), { recursive: true });
   fs2.writeFileSync(file, content);
-  process.stdout.write(`Created: ${file}
+  result.created.push(rel);
+  if (!quiet) process.stdout.write(`Created: ${file}
 `);
 }
-function scaffoldProject(targetDir, options = {}) {
-  write(path2.join(targetDir, "tests", "my-agent.test.ts"), SAMPLE_TEST_TEMPLATE);
-  write(path2.join(targetDir, "attest.policy.yaml"), POLICY_TEMPLATE);
-  if (options.ci === "github") {
-    write(path2.join(targetDir, ".github", "workflows", "attest.yml"), GITHUB_WORKFLOW_TEMPLATE);
+function scaffoldProject(targetDir, options2 = {}) {
+  const quiet = options2.quiet ?? false;
+  const result = { created: [], skipped: [] };
+  write(targetDir, "tests/my-agent.test.ts", SAMPLE_TEST_TEMPLATE, result, quiet);
+  write(targetDir, "attest.policy.yaml", POLICY_TEMPLATE, result, quiet);
+  if (options2.ci === "github") {
+    write(targetDir, ".github/workflows/attest.yml", GITHUB_WORKFLOW_TEMPLATE, result, quiet);
   }
-  process.stdout.write(
-    `
+  if (!quiet) {
+    process.stdout.write(
+      `
 Next: run \`npx vitest run\`. Then change the line marked ${DEMO_MARKER} in tests/my-agent.test.ts and run it again to see a failure.
 `
-  );
+    );
+  }
+  return result;
 }
 
-// src/cli.ts
-var HELP_FLAGS = /* @__PURE__ */ new Set(["-h", "--help"]);
-var SDK_USAGE = "usage: attest <command> [args]\n\nSDK commands:\n  init [--ci github]  scaffold a sample test and merge policy here\n                      (--ci github also writes .github/workflows/attest.yml)\n\noptions:\n  --version  print the SDK version and the engine version it requires\n  --help     print this help\n";
-var INIT_USAGE = "usage: attest init [--ci github]  (scaffolds into the current directory)";
-function cmdInit(args) {
-  if (args.some((a) => HELP_FLAGS.has(a))) {
-    process.stdout.write(`${INIT_USAGE}
-`);
-    return 0;
+// src/capture.ts
+import { spawn as spawn2 } from "child_process";
+import * as fs3 from "fs";
+import * as path3 from "path";
+import { fileURLToPath } from "url";
+var FIXTURE_VERSION = 1;
+var DEFAULT_FIXTURE_DIR = path3.join("tests", "attest", "fixtures");
+var CaptureError = class extends Error {
+  /** The fixture written, when the engine wrote one. */
+  fixture;
+  constructor(message, fixture = null) {
+    super(message);
+    this.name = "CaptureError";
+    this.fixture = fixture;
   }
-  const joined = args.join(" ");
-  if (args.length > 0 && joined !== "--ci github" && joined !== "--ci=github") {
-    process.stderr.write(`${INIT_USAGE}
-`);
-    return 2;
+};
+function toPath(p) {
+  return p instanceof URL ? fileURLToPath(p) : p;
+}
+function loadFixture(file) {
+  const p = toPath(file);
+  const doc = JSON.parse(fs3.readFileSync(p, "utf8"));
+  if (!isObject(doc) || doc["fixture_version"] !== FIXTURE_VERSION) {
+    throw new CaptureError(`${p}: not a fixture_version ${FIXTURE_VERSION} capture fixture`);
   }
-  scaffoldProject(process.cwd(), args.length > 0 ? { ci: "github" } : {});
-  return 0;
+  validate(p, doc);
+  return doc;
+}
+var NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+function isObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function kindOf(v) {
+  if (Array.isArray(v)) return "array";
+  if (isObject(v)) return "object";
+  if (typeof v === "string" || typeof v === "boolean") return typeof v;
+  return "other";
+}
+function validate(p, doc) {
+  const need = (where, obj, fields) => {
+    if (!isObject(obj)) throw new CaptureError(`${p}: ${where} is not an object`);
+    for (const [key, kind] of Object.entries(fields)) {
+      if (kindOf(obj[key]) !== kind) throw new CaptureError(`${p}: ${where}.${key} is missing or not a ${kind}`);
+    }
+    return obj;
+  };
+  need("fixture", doc, { name: "string", source: "object", trace: "object", exchanges: "array", contracts: "array", verification: "object" });
+  if (!("world" in doc)) throw new CaptureError(`${p}: fixture.world is missing`);
+  if (!NAME_PATTERN.test(doc["name"])) {
+    throw new CaptureError(`${p}: fixture name ${JSON.stringify(doc["name"])} is not a valid fixture name`);
+  }
+  const v = need("fixture.verification", doc["verification"], {
+    verified: "boolean",
+    expect_fail: "boolean",
+    results: "array",
+    expected_failures: "array"
+  });
+  doc["contracts"].forEach(
+    (c, i) => need(`fixture.contracts[${i}]`, c, { id: "string", kind: "string", description: "string", type: "string", spec: "object" })
+  );
+  v["results"].forEach(
+    (r, i) => need(`fixture.verification.results[${i}]`, r, { contract: "string", status: "string", explanation: "string" })
+  );
+}
+function objectKey(k) {
+  if (k === "__proto__") return `[${JSON.stringify(k)}]`;
+  return /^[A-Za-z_$][\w$]*$/.test(k) ? k : JSON.stringify(k);
+}
+function comment(text) {
+  return text.replace(/[\p{Cc}\p{Zl}\p{Zp}]/gu, " ");
+}
+function ts(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "number") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "string") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(ts).join(", ")}]`;
+  if (typeof value === "object") {
+    const entries = Object.entries(value).map(
+      ([k, v]) => `${objectKey(k)}: ${ts(v)}`
+    );
+    return entries.length === 0 ? "{}" : `{ ${entries.join(", ")} }`;
+  }
+  throw new Error(`value ${String(value)} has no literal`);
+}
+function str(spec, key) {
+  const v = spec[key];
+  if (typeof v !== "string") throw new Error(`missing ${key}`);
+  return v;
+}
+function options(entries) {
+  const set = entries.filter(([, v]) => v !== void 0 && v !== null && v !== false);
+  return set.length === 0 ? "" : `{ ${set.map(([k, v]) => `${k}: ${ts(v)}`).join(", ")} }`;
+}
+function call(method, args, opts) {
+  return `.${method}(${[...args, ...opts ? [opts] : []].join(", ")})`;
 }
+function dslCall(contract) {
+  const s = contract.spec;
+  const soft = s["soft"] === true ? true : void 0;
+  try {
+    if (contract.type === "trace") {
+      const check = s["check"];
+      if (check === "trajectory" && s["mode"] !== "partial_order") {
+        const mode = s["mode"] === "strict" || s["mode"] === void 0 ? void 0 : s["mode"];
+        if (!Array.isArray(s["tools"])) throw new Error("missing tools");
+        return call("trajectory", [ts(s["tools"])], options([["mode", mode], ["soft", soft]]));
+      }
+      if (check === "tool_order") {
+        return call("toolCalledBefore", [ts(str(s, "before")), ts(str(s, "after"))], options([["soft", soft]]));
+      }
+      if (check === "tool_cardinality") {
+        return call(
+          "toolCardinality",
+          [ts(str(s, "tool"))],
+          options([
+            ["per", s["per"]],
+            ["atLeast", s["min"]],
+            ["atMost", s["max"]],
+            ["soft", soft]
+          ])
+        );
+      }
+    }
+    if (contract.type === "schema" && s["target"] === "output.structured") {
+      if (typeof s["schema"] !== "object" || s["schema"] === null) throw new Error("missing schema");
+      return call("outputMatchesSchema", [ts(s["schema"])], "");
+    }
+    if (contract.type === "constraint" && s["field"] === "metadata.cost_usd" && s["operator"] === "lte") {
+      if (typeof s["value"] !== "number") throw new Error("missing value");
+      return call("costUnder", [ts(s["value"])], options([["soft", soft]]));
+    }
+  } catch (err) {
+    throw new Error(`contract ${contract.id}: malformed spec (${err.message})`);
+  }
+  throw new Error(`contract ${contract.id}: no TypeScript DSL call for ${contract.type} spec`);
+}
+function testPathFor(fixturePath) {
+  const name = path3.basename(fixturePath).replace(/\.attest\.json$/, "");
+  return path3.join(path3.dirname(path3.dirname(fixturePath)), `${name}.test.ts`);
+}
+function renderVitest(fixture, fixturePath, testPath) {
+  const calls = [];
+  const skipped = [];
+  for (const c of fixture.contracts) {
+    try {
+      calls.push([c, dslCall(c)]);
+    } catch (err) {
+      skipped.push(err.message);
+    }
+  }
+  const rel = path3.relative(path3.dirname(testPath), fixturePath).split(path3.sep).join("/");
+  const status = new Map(fixture.verification.results.map((r) => [r.contract, r.status]));
+  const expectFail = fixture.verification.expect_fail;
+  const lines = [
+    `// Contracts drafted by \`attest capture\` from fixture ${comment(ts(fixture.name))}.`,
+    "//",
+    "// Review and edit before committing: they check the captured trace without running",
+    "// the agent. Re-capturing does not overwrite this file.",
+    `import { attestExpect, loadFixture, type ExpectChain } from "@attest-ai/core";`,
+    `import { ${expectFail ? "inspect" : "evaluate"} } from "@attest-ai/vitest";`,
+    `import { describe, ${expectFail ? "expect, " : ""}it } from "vitest";`,
+    "",
+    `const FIXTURE = loadFixture(new URL(${ts(rel.startsWith(".") ? rel : `./${rel}`)}, import.meta.url));`
+  ];
+  if (skipped.length > 0) {
+    lines.push("", "// Drafted contracts without a TypeScript DSL call (left out):");
+    for (const s of skipped) lines.push(`// - ${comment(s)}`);
+  }
+  lines.push("", "function contracts(): ExpectChain {", "  return attestExpect(FIXTURE.trace)");
+  for (const [c, dsl] of calls) {
+    lines.push(`    // ${comment(`${c.id}: ${c.description}`)}`, `    ${dsl}`);
+  }
+  lines[lines.length - 1] += ";";
+  lines.push("}");
+  if (expectFail) {
+    lines.push("", "// Status of each contract on the captured incident, in contracts() order.");
+    lines.push("const EXPECTED: Array<[string, string]> = [");
+    for (const [c] of calls) lines.push(`  [${ts(c.id)}, ${ts(status.get(c.id) ?? "pass")}],`);
+    lines.push(
+      "];",
+      "",
+      `describe(${ts(fixture.name)}, () => {`,
+      `  it("reproduces the incident", async () => {`,
+      "    const result = await inspect(contracts());",
+      "",
+      "    expect(result.assertionResults.map((row) => row.status)).toEqual(EXPECTED.map(([, s]) => s));",
+      "  });",
+      "});"
+    );
+  } else {
+    lines.push(
+      "",
+      `describe(${ts(fixture.name)}, () => {`,
+      `  it("keeps its drafted contracts", async () => {`,
+      "    await evaluate(contracts());",
+      "  });",
+      "});"
+    );
+  }
+  return `${lines.join("\n")}
+`;
+}
+function emitVitest(fixturePath) {
+  const testPath = testPathFor(fixturePath);
+  const existing = fs3.lstatSync(testPath, { throwIfNoEntry: false });
+  if (existing?.isSymbolicLink()) {
+    throw new CaptureError(`${testPath} is a symbolic link; refusing to draft a test through it`);
+  }
+  if (existing !== void 0) return null;
+  const source = renderVitest(loadFixture(fixturePath), fixturePath, testPath);
+  fs3.mkdirSync(path3.dirname(testPath), { recursive: true });
+  try {
+    fs3.writeFileSync(testPath, source, { encoding: "utf8", flag: "wx" });
+  } catch (err) {
+    if (err.code === "EEXIST") {
+      throw new CaptureError(`${testPath} appeared while drafting; left unchanged`);
+    }
+    throw err;
+  }
+  return testPath;
+}
+
+// src/cli.ts
+var HELP_FLAGS = /* @__PURE__ */ new Set(["-h", "--help"]);
+var SDK_USAGE = "usage: attest <command> [args]\n\nSDK commands:\n  init [--ci github] [--skills] [--mcp] [--json]\n                      scaffold a sample test and merge policy here\n                      (--ci github also writes .github/workflows/attest.yml;\n                      --skills installs the agent skills with attest-engine;\n                      --mcp writes the MCP client configs (.mcp.json, .cursor/mcp.json,\n                      .codex/config.toml) with attest-engine;\n                      --json prints {created, updated, skipped} paths as JSON)\n\n`attest capture` (engine) also drafts tests/attest/<name>.test.ts from a verified\nfixture, unless that file exists.\n\noptions:\n  --version  print the SDK version and the engine version it requires\n  --help     print this help\n";
 var HELP_PROBE_TIMEOUT_MS = 1e4;
 function errorMessage(err) {
   return err instanceof Error ? err.message : String(err);
@@ -450,28 +674,291 @@ function exitStatus(status, signal) {
   if (signal !== null) return 128 + (os2.constants.signals[signal] ?? 0);
   return 1;
 }
-async function forward(args) {
+async function engineProviding(command) {
   let engine;
   try {
     engine = await resolveEngine();
   } catch (err) {
     process.stderr.write(`attest: ${errorMessage(err)}
 `);
-    return 1;
+    return null;
   }
-  const command = args[0] ?? "";
   const commands = engineCommands(engine);
   if (commands === null || command !== "help" && !commands.has(command)) {
     process.stderr.write(
       `attest: attest-engine at ${engine} (version ${ENGINE_VERSION}) predates \`attest ${command}\`: its help does not list that command. Set ATTEST_ENGINE_PATH to an engine built from this release (make engine), or install a release whose engine provides it.
 `
     );
+    return null;
+  }
+  return engine;
+}
+var INIT_HELP_ENTRY = {
+  name: "init",
+  summary: "scaffold a sample test and policy; --ci github, --skills, --mcp, --json",
+  schema: "cli/init.schema.json",
+  exit_codes: [
+    { code: 0, meaning: "success" },
+    {
+      code: 1,
+      meaning: "--skills or --mcp could not install: the engine is missing, too old or failed"
+    },
+    { code: 2, meaning: "usage error" }
+  ]
+};
+function helpJson(engine) {
+  const proc = spawnSync2(engine, ["help", "--json"], {
+    stdio: ["ignore", "pipe", "pipe"],
+    encoding: "utf-8"
+  });
+  if (proc.error) throw proc.error;
+  if (proc.status !== 0) {
+    process.stderr.write(proc.stderr);
+    return exitStatus(proc.status, proc.signal);
+  }
+  let doc;
+  try {
+    doc = JSON.parse(proc.stdout);
+    if (!Array.isArray(doc.commands)) throw new Error("no commands array");
+  } catch (err) {
+    process.stderr.write(`attest: \`${engine} help --json\` printed an unexpected document: ${errorMessage(err)}
+`);
     return 1;
   }
+  doc.commands = [...doc.commands, INIT_HELP_ENTRY].sort(
+    (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0
+  );
+  process.stdout.write(`${JSON.stringify(doc, null, 2)}
+`);
+  return 0;
+}
+async function forward(args) {
+  const command = args[0] ?? "";
+  const engine = await engineProviding(command);
+  if (engine === null) return 1;
+  if (args.length === 2 && command === "help" && args[1] === "--json") return helpJson(engine);
+  if (command === "capture" && captureWritesFixture(args.slice(1))) {
+    return captureAndEmit(engine, args.slice(1));
+  }
   const proc = spawnSync2(engine, args, { stdio: "inherit" });
   if (proc.error) throw proc.error;
   return exitStatus(proc.status, proc.signal);
 }
+var CAPTURE_NO_TEST = /* @__PURE__ */ new Set(["check-redaction", "serve", "h", "help"]);
+function flagName(arg) {
+  if (!arg.startsWith("-") || arg === "-" || arg === "--") return null;
+  return arg.replace(/^-+/, "").split("=", 1)[0] ?? null;
+}
+function captureWritesFixture(args) {
+  for (const a of args) {
+    if (a === "--") break;
+    const name = flagName(a);
+    if (name !== null && CAPTURE_NO_TEST.has(name)) return false;
+  }
+  return true;
+}
+function userResultFile(args) {
+  for (const a of args) {
+    if (a === "--") break;
+    if (flagName(a) === "result-file") return true;
+  }
+  return false;
+}
+function captureAndEmit(engine, args) {
+  if (userResultFile(args)) {
+    process.stderr.write(
+      "attest: capture --result-file is set by the attest CLI; run attest-engine capture directly to choose it\n"
+    );
+    return 2;
+  }
+  const tmp = fs4.mkdtempSync(path4.join(os2.tmpdir(), "attest-capture-"));
+  const resultFile = path4.join(tmp, "result.json");
+  let result;
+  let code;
+  try {
+    const proc = spawnSync2(engine, ["capture", "--result-file", resultFile, ...args], { stdio: "inherit" });
+    if (proc.error) throw proc.error;
+    code = exitStatus(proc.status, proc.signal);
+    if (!fs4.existsSync(resultFile)) return code;
+    result = JSON.parse(fs4.readFileSync(resultFile, "utf8"));
+  } finally {
+    fs4.rmSync(tmp, { recursive: true, force: true });
+  }
+  const fixture = result.fixture;
+  if (!result.verified) {
+    process.stderr.write(`  test: none drafted for unverified ${fixture}
+`);
+    return code;
+  }
+  const written = emitVitest(fixture);
+  process.stderr.write(
+    written === null ? `  test: ${testPathFor(fixture)} exists; left unchanged
+` : `  test: drafted ${written}
+`
+  );
+  return code;
+}
+var INIT_USAGE = "usage: attest init [--ci github] [--skills] [--mcp] [--json]  (scaffolds into the current directory)";
+var INIT_KINDS = ["created", "updated", "skipped"];
+var INIT_KINDS_WITH_CONFLICT = [...INIT_KINDS, "conflict"];
+var SKILLS_KINDS = [
+  ["created", "created"],
+  ["updated", "updated"],
+  ["unchanged", "skipped"]
+];
+var MCP_KINDS = [
+  ["created", "created"],
+  ["updated", "updated"],
+  ["unchanged", "skipped"],
+  ["conflict", "conflict"]
+];
+function parseInitArgs(args) {
+  const parsed = { ci: false, skills: false, mcp: false, json: false };
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--ci" && args[i + 1] === "github" && !parsed.ci) {
+      parsed.ci = true;
+      i++;
+    } else if (arg === "--ci=github" && !parsed.ci) {
+      parsed.ci = true;
+    } else if (arg === "--skills" && !parsed.skills) {
+      parsed.skills = true;
+    } else if (arg === "--mcp" && !parsed.mcp) {
+      parsed.mcp = true;
+    } else if (arg === "--json" && !parsed.json) {
+      parsed.json = true;
+    } else {
+      return null;
+    }
+  }
+  return parsed;
+}
+function emptyInitResult() {
+  return { created: [], updated: [], skipped: [], conflict: [] };
+}
+function runEngineInstall(engine, subcommand, kinds, what) {
+  const argv = [...subcommand, "--json"];
+  const shown = [engine, ...argv].join(" ");
+  const proc = spawnSync2(engine, argv, {
+    stdio: ["ignore", "pipe", "pipe"],
+    encoding: "utf-8"
+  });
+  if (proc.error) throw proc.error;
+  if (proc.status !== 0) {
+    const detail = proc.stderr.trim();
+    throw new Error(
+      `${what} failed (\`${shown}\` exited ${String(exitStatus(proc.status, proc.signal))})` + (detail === "" ? "" : `: ${detail}`)
+    );
+  }
+  process.stderr.write(proc.stderr);
+  let doc;
+  try {
+    doc = JSON.parse(proc.stdout);
+  } catch (err) {
+    throw new Error(`\`${shown}\` printed invalid JSON: ${errorMessage(err)}`);
+  }
+  if (typeof doc !== "object" || doc === null || Array.isArray(doc)) {
+    throw new Error(`\`${shown}\` printed ${JSON.stringify(doc)}, not an object`);
+  }
+  const record = doc;
+  const result = emptyInitResult();
+  for (const [engineKind, initKind] of kinds) {
+    const paths = record[engineKind];
+    if (!Array.isArray(paths) || !paths.every((p) => typeof p === "string")) {
+      throw new Error(`\`${shown}\` printed no \`${engineKind}\` list of paths: ${proc.stdout}`);
+    }
+    result[initKind].push(...paths);
+  }
+  return result;
+}
+function installSkills(engine, root) {
+  return runEngineInstall(engine, ["skills", "install", "--dir", root], SKILLS_KINDS, "skills install");
+}
+function mcpLaunchCommand(root) {
+  return fs4.existsSync(path4.join(root, "pnpm-lock.yaml")) ? ["pnpm", "exec", "attest", "mcp"] : ["npx", "--no", "attest", "mcp"];
+}
+function installMcp(engine, root) {
+  return runEngineInstall(
+    engine,
+    ["mcp", "install", "--dir", root, "--command", JSON.stringify(mcpLaunchCommand(root))],
+    MCP_KINDS,
+    "mcp install"
+  );
+}
+function printSkills(root, skills) {
+  const abs = (rel) => path4.join(root, ...rel.split("/"));
+  for (const rel of skills.created) process.stdout.write(`Created: ${abs(rel)}
+`);
+  for (const rel of skills.updated) process.stdout.write(`Updated: ${abs(rel)}
+`);
+  for (const rel of skills.skipped) process.stderr.write(`Skipped (unchanged): ${abs(rel)}
+`);
+  for (const rel of skills.conflict) {
+    process.stderr.write(
+      `Conflict (a different attest entry, left as it is; \`attest-engine mcp install --force\` replaces it): ${abs(rel)}
+`
+    );
+  }
+}
+async function runInit(parsed, root) {
+  const result = emptyInitResult();
+  const installs = [
+    [parsed.skills, "skills", installSkills],
+    [parsed.mcp, "mcp", installMcp]
+  ];
+  for (const [wanted, command, install] of installs) {
+    if (!wanted) continue;
+    const engine = await engineProviding(command);
+    if (engine === null) return null;
+    let installed;
+    try {
+      installed = install(engine, root);
+    } catch (err) {
+      process.stderr.write(`attest: ${errorMessage(err)}
+`);
+      return null;
+    }
+    if (!parsed.json) printSkills(root, installed);
+    for (const kind of INIT_KINDS_WITH_CONFLICT) result[kind].push(...installed[kind]);
+  }
+  const scaffolded = scaffoldProject(root, {
+    ...parsed.ci ? { ci: "github" } : {},
+    quiet: parsed.json
+  });
+  result.created.push(...scaffolded.created);
+  result.skipped.push(...scaffolded.skipped);
+  return result;
+}
+async function cmdInit(args) {
+  if (args.some((a) => HELP_FLAGS.has(a))) {
+    process.stdout.write(`${INIT_USAGE}
+`);
+    return 0;
+  }
+  const parsed = parseInitArgs(args);
+  if (parsed === null) {
+    process.stderr.write(`${INIT_USAGE}
+`);
+    return 2;
+  }
+  const root = process.cwd();
+  if (!parsed.json) return await runInit(parsed, root) === null ? 1 : 0;
+  const stdoutWrite = process.stdout.write;
+  process.stdout.write = process.stderr.write.bind(process.stderr);
+  let result;
+  try {
+    result = await runInit(parsed, root);
+  } finally {
+    process.stdout.write = stdoutWrite;
+  }
+  if (result === null) return 1;
+  const done = result;
+  const kinds = parsed.mcp ? INIT_KINDS_WITH_CONFLICT : INIT_KINDS;
+  const sorted = Object.fromEntries(kinds.map((k) => [k, [...done[k]].sort()]));
+  process.stdout.write(`${JSON.stringify(sorted)}
+`);
+  return 0;
+}
 async function main(argv = process.argv.slice(2)) {
   const [command] = argv;
   if (command === void 0 || HELP_FLAGS.has(command) || command === "help" && argv.length === 1) {
@@ -495,8 +982,8 @@ ${SDK_USAGE}`);
 }
 function isDirectExecution() {
   const script = process.argv[1];
-  if (script === void 0 || !fs3.existsSync(script)) return false;
-  return fs3.realpathSync(script) === fs3.realpathSync(fileURLToPath(import.meta.url));
+  if (script === void 0 || !fs4.existsSync(script)) return false;
+  return fs4.realpathSync(script) === fs4.realpathSync(fileURLToPath2(import.meta.url));
 }
 if (isDirectExecution()) {
   main().then(
@@ -509,8 +996,10 @@ if (isDirectExecution()) {
   );
 }
 export {
+  captureWritesFixture,
   engineCommands,
   exitStatus,
+  helpJson,
   main
 };
 //# sourceMappingURL=cli.js.map