@b00dea/cockpit 0.1.0 → 0.1.1

package/dist/cli-main.js

@@ -1,9 +1,10 @@
 import { randomUUID } from 'node:crypto';
-import { EVALUATOR_COMMANDS, runningEvaluatorTool } from './schema.js';
+import { ComposeProfileName, EVALUATOR_COMMANDS, runningEvaluatorTool, UNCONFIRMABLE_ANSWERS } from './schema.js';
 import { installedPackageMetadata } from './package-metadata.js';
 import { validateTeamMetadata } from './team-metadata.js';
 import { renderComposeScaffold, SCAFFOLD_BACKING_SERVICES, writeComposeScaffold } from './init/scaffold.js';
 import { discoverReleaseFreshness } from './freshness.js';
+import { observeMcpStartup } from './environment/mcp-observation.js';
 import { lstat, mkdir, realpath, writeFile } from 'node:fs/promises';
 import { parse as parseToml, TomlError } from 'smol-toml';
 import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
@@ -13,6 +14,7 @@ import { createInvocationRecord, EXIT_CODES } from './invocation.js';
 import { commandGroups, commandSpelling, commandStages, commands, describePublicOption, internalCommands, isWorkHandler, isRecordedAnswerField, resolveOrdinaryInvocation } from './command-table.js';
 import { SURFACE_TARGETS } from './surfaces/contract.js';
 import { DEFAULT_SURFACE_TOOLS, GUARD_SURFACE_TARGETS, isGuardSurfaceTarget } from './surfaces/harness-registry.js';
+import { cockpitCommand } from './fix-catalogue.js';
 import { renderHumanDiagnostics, renderHumanValue, renderJsonResponse } from './diagnostics.js';
 import { classifyEstateObservation, draftFromEstate, observeCockpitRoot, observePublicEstate } from './init/draft.js';
 import { runInitOperatorCommand } from './init/command.js';
@@ -25,25 +27,31 @@ import { beginOperatorReset as beginOperatorResetApplication, runDown as runDown
 import { runDoctor as runDoctorApplication } from './environment/application/doctor.js';
 import { runGuardCommand } from './cli-guard.js';
 import { runPreflight as runPreflightApplication } from './environment/application/health.js';
+import { runConfirm } from './environment/application/confirm.js';
+import { isUnconfirmedAnswerName } from './guards/answer-confirmation.js';
 import { runSession as runSessionApplication, runSleep as runSleepApplication, runUp as runUpApplication, } from './environment/application/lifecycle.js';
 import {} from './environment/application/lifecycle-context.js';
 import { runLogs as runLogsApplication } from './environment/application/logs.js';
-import { executeForegroundProcess, executePlan, executeProbe } from './environment-exec/execute.js';
+import { runDocsCheck } from './docs/check.js';
+import { runServiceExec, runServicePs, runServiceRestart } from './environment/application/services.js';
+import { executeForegroundProcess, executePlan, executeProbe, foregroundTerminal } from './environment-exec/execute.js';
 import { createDestructiveCommandAdapters, selectDestructiveDaemon } from './environment/destructive-composition.js';
 import { createHealthCommandAdapters } from './environment/health-composition.js';
-import { inspectInitReadiness } from './environment/readiness-composition.js';
+import { inspectInitReadiness, measureInitMachine } from './environment/readiness-composition.js';
 import { createLifecycleCommandAdapters } from './environment/lifecycle-composition.js';
 import { isProcessStart, observeProcessStart, processHost } from './environment/claims.js';
 import { createReadCommandAdapters } from './environment/read-composition.js';
 import { probeInstalledRuntime, runRuntimeMeasure } from './environment/runtime-measurement.js';
 import { initializeLocalGitRepository, runSiblingAdd, runSiblingRemove } from './environment/sibling-registration.js';
 import { runToolChange } from './environment/tool-registration.js';
+import { runPull, runUse } from './environment/application/siblings.js';
 import { issueSetupRunContext, setupEnvironment } from './environment/application/setup.js';
 import { consumeSetupCheckoutProjection, observeEnvironmentIgnore, observeSetupCheckout, observeSetupPath, withSetupCheckoutProjection, } from './environment/setup-observation.js';
 import { RefusalError, ENVIRONMENT_CODES, errorCause, hasErrorCode, INHERITED_TOOL_ENVIRONMENT, isCanonicalTimestamp, } from './environment/contract.js';
 import { refusalOutcome } from './refusal.js';
 import { loadAutonomyPolicy, loadCockpitConfig, observeConfigSource, readBoundedInput } from './config/load.js';
 import { policyWeakening, policyWeakeningDiagnostic } from './autonomy.js';
+import { inspectGuardConfigChange } from './guards/policy-change.js';
 import { gitEnvironment, planSetup } from './environment/setup.js';
 import { synchronizeInstructionPointer } from './environment/instruction-pointer.js';
 import { synchronizeSiblingInstructionFiles } from './environment/sibling-instructions.js';
@@ -58,7 +66,9 @@ import { prepareSelectedBootstrapSurface, resumeSelectedBootstrapSurface, applyS
 import { runUpgrade } from './environment/upgrade-application.js';
 import { inspectCodexHookTrust } from './environment/codex-hook-trust.js';
 import { runConfiguredSurfaceSelftestOutcome, runSelftestOperatorCommand, } from './environment/selftest-application.js';
-import { loadOperatorPolicy, runResetOperatorApplication } from './environment/operator-application.js';
+import { loadOperatorPolicy, runResetOperatorApplication, runStacksPruneOperatorApplication } from './environment/operator-application.js';
+import { beginStacksPrune } from './environment/stack-inventory-prune.js';
+import { runStacksInventory } from './environment/stack-inventory-report.js';
 function setupDiagnostic(code, message, target) {
     return { severity: 'error', code, message, target };
 }
@@ -260,7 +270,7 @@ function readAdapters(configPath, runtime, sessionId) {
         sessionId,
         timeoutMs: RUNTIME_STEP_TIMEOUT_MS,
         ...(runtime.signal ? { signal: runtime.signal } : {}),
-    }, executeProbe);
+    }, executeProbe, executeForegroundProcess);
 }
 // Each return is a literal, so the diagnostic inventory captures the fix beside its code.
 function unsatisfiedWorkDiagnostic(operation, message) {
@@ -268,6 +278,10 @@ function unsatisfiedWorkDiagnostic(operation, message) {
         return { severity: 'error', message,
             code: 'TEST_GATE_UNSATISFIED',
             fix: 'the message gives the verdict and its reasons. FAIL: a check a stage ran failed, so fix the product. DEGRADED: start the stack with npx --no cockpit up --config <your cockpit.toml> for a stage that needs it, make a stage command that could not start runnable from the cockpit root, raise testing.stages[].timeout_seconds for a stage that timed out, or declare testing.stages[].select.<kind> for a --select a stage lacks. VOID: stop changing the checkouts and run the gate again. PARTIAL: only the complete gate can PASS, so run it without --select or --mode staged' };
+    if (operation === 'browser-drive')
+        return { severity: 'error', message,
+            code: 'BROWSER_ROUTE_FINDINGS',
+            fix: 'this run asked for a clean route (--fail-on-findings). Read result.receipt.surfaces[].diagnostics, including excerpt.messages where present: fix the product for each console error, uncaught page error and failed request that matters, then rerun npx --no cockpit browser drive --config <your cockpit.toml> --route <name> --fail-on-findings; third-party traffic never counts' };
     if (operation === 'work-check')
         return { severity: 'error', message,
             code: 'WORK_CHECK_FAILED',
@@ -275,14 +289,19 @@ function unsatisfiedWorkDiagnostic(operation, message) {
     if (operation === 'work-verify')
         return { severity: 'error', message,
             code: 'WORK_VERIFY_FAILED',
-            fix: 'for an order changed since acceptance, run npx --no cockpit work accept --config <your cockpit.toml> --work-order <id> or revert the change; for a done order without a passing grade, regrade it with work grade' };
-    if (operation === 'grade-criteria')
-        return { severity: 'error', message,
-            code: 'WORK_GRADE_UNSATISFIED',
-            fix: 'read result.criteria, result.checks and result.outOfScope: fix the product for an unmet or unclear criterion, make a failed check pass, move or revert a change outside scope, then grade again with npx --no cockpit grade --config <your cockpit.toml> --criteria <file>' };
+            fix: 'for an order changed since acceptance, run npx --no cockpit work accept --config <your cockpit.toml> --work-order <id> or revert the change; for a done order without a passing grade, regrade it with work grade; for a decision record that is missing or no longer cites its order, restore it from git or put back its "Work order: <id>" line' };
     return { severity: 'error', message,
         code: 'WORK_GRADE_UNSATISFIED',
-        fix: 'read result.criteria, result.checks and result.outOfScope: fix the product for an unmet or unclear criterion, make a failed check pass, move or revert a change outside scope, then grade again with npx --no cockpit work grade --config <your cockpit.toml> --work-order <id>' };
+        fix: operation === 'grade-criteria'
+            ? 'read result.criteria and result.checks: fix the product for an unmet or unclear criterion, make a failed check pass, revert each change outside scope the scope-changes-necessary verdict calls unneeded, then grade again with npx --no cockpit grade --config <your cockpit.toml> --criteria <file>'
+            : 'read result.criteria, result.checks and result.outOfScope: fix the product for an unmet or unclear criterion, make a failed check pass, revert each change outside scope the scope-changes-necessary verdict calls unneeded (under [work] grading = "checks", every change outside scope), have a person amend the order when amendments-hold-bar is unmet, then grade again with npx --no cockpit work grade --config <your cockpit.toml> --work-order <id>' };
+}
+function weakenedTestsDiagnostic(operation, message) {
+    return { severity: 'error', message,
+        code: 'WORK_TEST_WEAKENED',
+        fix: operation === 'work-grade'
+            ? 'read result.testProtection.findings and the verdict on them: restore each test weakened to make the change pass. Under [work] grading = "independent" the evaluator judged the test changes unjustified in the diff; under "self" your --note names each flagged file and why; under "checks" acknowledge a legitimate change with npx --no cockpit work acknowledge --config <your cockpit.toml> --work-order <id> --note <why it is not a weakening>, which [work.gates] acknowledge = "person" leaves to a person at a terminal with --interactive; never type the digest for them'
+            : 'read result.testProtection: restore each deleted, skipped, suppressed or loosened test. A grade without an order has the evaluator judge the test changes; an order records the base they are compared with, and under [work] grading = "checks" a legitimate change is acknowledged with npx --no cockpit work acknowledge --config <your cockpit.toml> --work-order <id> --note <why>, with --interactive by a person where [work.gates] acknowledge = "person"' };
 }
 // A person gate binds what the person reads to the digest they type, so it never completes for an agent.
 function personRequired(handler, prompt) {
@@ -302,8 +321,12 @@ function sameToolGradeWarnings(value, env) {
 function workCommandOutcome(outcome, env) {
     if (outcome.kind === 'complete')
         return { status: 0, result: outcome.value, diagnostics: sameToolGradeWarnings(outcome.value, env) };
-    if (outcome.kind === 'unsatisfied')
-        return { status: 2, result: outcome.value, diagnostics: [unsatisfiedWorkDiagnostic(outcome.operation, outcome.reason), ...sameToolGradeWarnings(outcome.value, env)] };
+    if (outcome.kind === 'unsatisfied') {
+        const weakened = outcome.weakening ? [weakenedTestsDiagnostic(outcome.operation, outcome.weakening)] : [];
+        // A failure that is only test weakening is already stated by its own diagnostic.
+        const unsatisfied = weakened.length === 0 || outcome.reason !== '' ? [unsatisfiedWorkDiagnostic(outcome.operation, outcome.reason)] : [];
+        return { status: 2, result: outcome.value, diagnostics: [...weakened, ...unsatisfied, ...sameToolGradeWarnings(outcome.value, env)] };
+    }
     return usageOutcome('WORK_APPLICATION_REFUSED', outcome.kind === 'refusal' ? outcome.reason : 'this step needs a person at a terminal');
 }
 async function configuredWorkApplication(input, runtime) {
@@ -358,18 +381,23 @@ function defaultHandlers(runtime) {
     const env = runtime.env ?? process.env;
     const inherited = inheritedSessionId(env);
     const ordinarySessionId = inherited === undefined ? 'cockpit-cli' : inherited;
-    const lifecycleAdapters = (configPath, sessionId, holderProcess) => createLifecycleCommandAdapters({
+    const lifecycleAdapters = (configPath, sessionId, holderProcess, profiles = []) => createLifecycleCommandAdapters({
         configPath,
         env,
         sessionId,
         timeoutMs: RUNTIME_STEP_TIMEOUT_MS,
         ...(holderProcess === undefined ? {} : { holderProcess }),
+        activeProfiles: profiles,
     }, executeProbe);
     const healthAdapters = (configPath) => createHealthCommandAdapters({
         configPath,
         env,
         timeoutMs: RUNTIME_STEP_TIMEOUT_MS,
     }, executeProbe);
+    // The ordinary (non-session) verbs all need a valid session identity and an absolute config path.
+    const withSession = (run) => async (input) => ordinarySessionId === null
+        ? usageOutcome('CLI_USAGE_INVALID', 'COCKPIT_SESSION_ID must be a canonical UUID', 'COCKPIT_SESSION_ID')
+        : run(input, resolve(input.configPath), ordinarySessionId);
     const workHandlers = {};
     for (const command of commands)
         if (isWorkHandler(command.handler)) {
@@ -388,6 +416,7 @@ function defaultHandlers(runtime) {
             infer: deriveInferredFacts,
             composeFindings,
             inspectReadiness: input => inspectInitReadiness(input, { env, timeoutMs: RUNTIME_STEP_TIMEOUT_MS, execute: executeProbe }),
+            measureMachine: input => measureInitMachine(input, { env, timeoutMs: RUNTIME_STEP_TIMEOUT_MS, execute: executeProbe }),
             observeDestination: async ({ path, byteLimit }) => {
                 const node = await nodeAuthority();
                 const read = node ? await readAnchoredBatches(dirname(path), [
@@ -426,36 +455,28 @@ function defaultHandlers(runtime) {
             // A weakening sync would refuse is a failing check, so an agent's edit cannot sit unreported.
             const policy = await loadAutonomyPolicy(input.configPath);
             const weakened = 'recorded' in policy && policy.recorded ? policyWeakening(policy.recorded, policy.current) : [];
+            // An edit the guards were not regenerated for holds the agent; one that widens them waits for a person.
+            const guardChange = await inspectGuardConfigChange(dirname(loaded.result.source.path), loaded.result.source.path, { sha256: loaded.result.source.sha256, config: loaded.result.config });
             // Codex hook trust concerns a Codex user only; a leftover hooks.json of an unlisted Codex is stale, which check reports.
             const [outcome, hookTrust] = await Promise.all([checkGeneratedEnvironment(input),
                 loaded.result.config.surfaces.tools.includes('codexcli')
                     ? inspectCodexHookTrust({ root: dirname(resolve(input.configPath)), env }) : Promise.resolve([])]);
-            if (weakened.length)
+            if (weakened.length || guardChange.some(row => row.severity === 'error'))
                 return { kind: 'refusal', status: 2, result: null,
-                    diagnostics: [policyWeakeningDiagnostic(weakened), ...outcome.diagnostics, ...hookTrust] };
-            return { ...outcome, diagnostics: [...outcome.diagnostics, ...hookTrust], result: outcome.report
+                    diagnostics: [...weakened.length ? [policyWeakeningDiagnostic(weakened)] : [], ...guardChange, ...outcome.diagnostics, ...hookTrust] };
+            return { ...outcome, diagnostics: [...guardChange, ...outcome.diagnostics, ...hookTrust], result: outcome.report
                     ? outcome.kind === 'complete' ? { ...outcome.result, currentness: outcome.report } : outcome.report
                     : outcome.result };
         },
         selftest: runConfiguredSurfaceSelftestOutcome,
         upgrade: input => runUpgrade({ ...input, env: concreteEnvironment(env) }, { execute: executeProbe, executeForeground: executeForegroundProcess }),
-        up: async (input) => {
-            const sessionId = ordinarySessionId;
-            if (sessionId === null)
-                return usageOutcome('CLI_USAGE_INVALID', 'COCKPIT_SESSION_ID must be a canonical UUID', 'COCKPIT_SESSION_ID');
+        up: withSession(async (input, configPath, sessionId) => {
             const wrapper = await sessionChildHolderProcess(env);
             if (wrapper.refusal)
                 return wrapper.refusal;
-            const configPath = resolve(input.configPath);
-            return runUpApplication({ configPath }, lifecycleAdapters(configPath, sessionId, wrapper.holderProcess));
-        },
-        sleep: (input) => {
-            const sessionId = ordinarySessionId;
-            if (sessionId === null)
-                return Promise.resolve(usageOutcome('CLI_USAGE_INVALID', 'COCKPIT_SESSION_ID must be a canonical UUID', 'COCKPIT_SESSION_ID'));
-            const configPath = resolve(input.configPath);
-            return runSleepApplication({ configPath }, lifecycleAdapters(configPath, sessionId));
-        },
+            return runUpApplication({ configPath }, lifecycleAdapters(configPath, sessionId, wrapper.holderProcess, input.profiles));
+        }),
+        sleep: withSession((_input, configPath, sessionId) => runSleepApplication({ configPath }, lifecycleAdapters(configPath, sessionId))),
         session: async (input) => {
             if (inherited === null)
                 return usageOutcome('CLI_USAGE_INVALID', 'COCKPIT_SESSION_ID must be a canonical UUID', 'COCKPIT_SESSION_ID');
@@ -473,8 +494,9 @@ function defaultHandlers(runtime) {
                 sessionId,
                 timeoutMs: RUNTIME_STEP_TIMEOUT_MS,
                 holderProcess: { pid: process.pid, ...(started.state === 'present' ? { processStart: started.start } : {}) },
+                activeProfiles: input.profiles,
             }, executeProbe);
-            return runSessionApplication({ ...input, configPath, cwd: process.cwd(), env: childEnv }, {
+            return runSessionApplication({ configPath, argv: input.argv, cwd: process.cwd(), env: childEnv }, {
                 up: (request) => runUpApplication(request, adapters),
                 sleep: (request) => runSleepApplication(request, adapters),
                 resolveExecutable: (name) => resolveExecutable(name, sessionEnvironment),
@@ -482,18 +504,8 @@ function defaultHandlers(runtime) {
                 ...(runtime.signal ? { signal: runtime.signal } : {}),
             });
         },
-        down: async (input) => {
-            if (ordinarySessionId === null)
-                return usageOutcome('CLI_USAGE_INVALID', 'COCKPIT_SESSION_ID must be a canonical UUID', 'COCKPIT_SESSION_ID');
-            const configPath = resolve(input.configPath);
-            return runDownApplication({ configPath }, await destructiveAdapters(configPath, runtime, ordinarySessionId));
-        },
-        reset: async (input) => {
-            if (ordinarySessionId === null)
-                return usageOutcome('CLI_USAGE_INVALID', 'COCKPIT_SESSION_ID must be a canonical UUID', 'COCKPIT_SESSION_ID');
-            const configPath = resolve(input.configPath);
-            return runResetApplication({ configPath }, await destructiveAdapters(configPath, runtime, ordinarySessionId));
-        },
+        down: withSession(async (_input, configPath, sessionId) => runDownApplication({ configPath }, await destructiveAdapters(configPath, runtime, sessionId))),
+        reset: withSession(async (_input, configPath, sessionId) => runResetApplication({ configPath }, await destructiveAdapters(configPath, runtime, sessionId))),
         preflight: (input) => {
             const configPath = resolve(input.configPath);
             return runPreflightApplication({ configPath }, healthAdapters(configPath));
@@ -504,19 +516,36 @@ function defaultHandlers(runtime) {
                 ...healthAdapters(configPath),
                 discoverReleaseFreshness: () => discoverReleaseFreshness({ verb: 'doctor', env,
                     ...(runtime.createReleaseMetadataTransport ? { createTransport: runtime.createReleaseMetadataTransport } : {}) }),
+                inspectMcpStartup: servers => observeMcpStartup(servers, env),
             });
         },
         runtime: (input) => runRuntimeMeasure({ ...input, env }, { execute: executeProbe, probe: probeInstalledRuntime }),
+        stacks: (input) => runStacksInventory({ configPath: resolve(input.configPath), env }, { execute: executeProbe }),
+        'docs-check': (input) => runDocsCheck({ configPath: resolve(input.configPath), env }, { execute: executeProbe }),
+        confirm: (input) => {
+            const configPath = resolve(input.configPath);
+            return runConfirm({ configPath, answer: input.answer }, {
+                preflight: ({ configPath }) => runPreflightApplication({ configPath }, healthAdapters(configPath)),
+                check: async ({ configPath }) => {
+                    const metadata = teamMetadataOutcome(await validateTeamMetadata(configPath));
+                    return metadata ?? checkGeneratedEnvironment({ configPath });
+                },
+                now: () => new Date(),
+            });
+        },
         sibling: (request) => request.operation === 'add'
             ? runSiblingAdd({ ...request.input, env }, { execute: executeProbe })
             : runSiblingRemove({ ...request.input, env }),
         tool: runToolChange,
-        logs: (input) => {
-            if (ordinarySessionId === null)
-                return Promise.resolve(usageOutcome('CLI_USAGE_INVALID', 'COCKPIT_SESSION_ID must be a canonical UUID', 'COCKPIT_SESSION_ID'));
-            const configPath = resolve(input.configPath);
-            return runLogsApplication({ ...input, configPath }, readAdapters(configPath, runtime, ordinarySessionId).logs);
-        },
+        use: (input) => runUse({ ...input, env }, { execute: executeProbe }),
+        pull: (input) => runPull({ ...input, env }, { execute: executeProbe }),
+        logs: withSession((input, configPath, sessionId) => runLogsApplication({ ...input, configPath }, readAdapters(configPath, runtime, sessionId).logs)),
+        ps: withSession((_input, configPath, sessionId) => runServicePs({ configPath }, readAdapters(configPath, runtime, sessionId).services)),
+        restart: withSession((input, configPath, sessionId) => runServiceRestart({ configPath, service: input.service, verb: 'restart' }, readAdapters(configPath, runtime, sessionId).services)),
+        rebuild: withSession((input, configPath, sessionId) => runServiceRestart({ configPath, service: input.service, verb: 'rebuild' }, readAdapters(configPath, runtime, sessionId).services)),
+        // A terminal on both ends gets an interactive shell or client; anything else, an agent's
+        // captured output included, gets plain streams.
+        exec: withSession((input, configPath, sessionId) => runServiceExec({ configPath, service: input.service, argv: input.argv, tty: foregroundTerminal() }, readAdapters(configPath, runtime, sessionId).services)),
     };
 }
 function commandLines(rows, width = Math.max(...rows.map(row => row.name.length))) {
@@ -539,8 +568,9 @@ function renderHelp() {
     const width = Math.max(...entries.map(entry => entry.name.length));
     const sections = commandStages.map(stage => [`${stage.title}:`,
         ...commandLines(entries.filter(entry => entry.stage === stage.id), width)].join('\n'));
+    const groups = commandGroups.map(group => `'cockpit ${group.name} --help'`);
     return ['Usage: cockpit <command> [options]', '', sections.join('\n\n'), '',
-        `Run 'cockpit <command> --help' for its options, and ${commandGroups.map(group => `'cockpit ${group.name} --help'`).join(' or ')} for its subcommands.`, ''].join('\n');
+        `Run 'cockpit <command> --help' for its options, and ${[groups.slice(0, -1).join(', '), ...groups.slice(-1)].filter(Boolean).join(' or ')} for its subcommands.`, ''].join('\n');
 }
 function renderGroupHelp(group) {
     const members = groupMembers(group.name);
@@ -563,6 +593,15 @@ function renderCommandHelp(definition) {
 function renderVersion() {
     return `${installedPackageMetadata.name} ${installedPackageMetadata.version} (Node ${installedPackageMetadata.engines.node}; source ${installedPackageMetadata.cockpitSourceRevision})\n`;
 }
+// Repeated --profile values, each in the spelling environment.profiles accepts, or why not.
+function composeProfiles(values) {
+    const profiles = values ?? [];
+    const invalid = profiles.find(profile => !ComposeProfileName.safeParse(profile).success);
+    if (invalid !== undefined)
+        return { error: `--profile ${JSON.stringify(invalid)} must be a lowercase Compose profile name: letters, digits, '.', '_' and '-', starting with a letter or digit` };
+    return { profiles: [...new Set(profiles)] };
+}
+const namedOnly = (handler, positionals) => positionals.length > 0 ? usageOutcome('CLI_USAGE_INVALID', `${handler} accepts named inputs only`) : undefined;
 const missingConfig = () => usageOutcome('CLI_USAGE_INVALID', 'provide --config <file>', '--config');
 function usageOutcome(code, message, target) {
     return {
@@ -743,7 +782,24 @@ async function decodeRequest(handler, parsed, runtimeEnv) {
             const note = text('text');
             if (!note)
                 return usageOutcome('CLI_USAGE_INVALID', 'provide --text <note>', '--text');
-            request = { operation: handler, workOrderId: workOrderId, text: note, question: values.ask === true };
+            if (values.ask === true && values.decision === true)
+                return usageOutcome('CLI_USAGE_INVALID', 'pass at most one of --ask and --decision');
+            request = { operation: handler, workOrderId: workOrderId, text: note, kind: values.ask === true ? 'question' : values.decision === true ? 'decision' : 'note' };
+        }
+        else if (handler === 'work-decide') {
+            const decision = Number(text('decision')), file = text('record-file'), supersedes = text('supersedes'), reason = text('reason');
+            const record = values.record === true || file !== undefined;
+            if (!Number.isSafeInteger(decision) || decision < 1 || record === (values.none === true)) {
+                return usageOutcome('CLI_USAGE_INVALID', 'provide --decision <number> and one of --record, --record-file <path> or --none --reason <why>');
+            }
+            if (values.record === true && file !== undefined)
+                return usageOutcome('CLI_USAGE_INVALID', 'pass --record to write a new record or --record-file <path> to cite one, not both');
+            if (values.none === true && (!reason || supersedes !== undefined))
+                return usageOutcome('CLI_USAGE_INVALID', '--none needs --reason <why the decision is not lasting> and takes no --supersedes', '--reason');
+            if (record && reason !== undefined)
+                return usageOutcome('CLI_USAGE_INVALID', '--reason goes with --none', '--reason');
+            request = { operation: handler, workOrderId: workOrderId, decision, resolution: values.none === true ? { kind: 'none', reason: reason }
+                    : { kind: 'record', ...file !== undefined ? { path: file } : {}, ...supersedes !== undefined ? { supersedes } : {} } };
         }
         else if (handler === 'work-answer') {
             const answer = text('text'), question = Number(text('question'));
@@ -751,6 +807,12 @@ async function decodeRequest(handler, parsed, runtimeEnv) {
                 return usageOutcome('CLI_USAGE_INVALID', 'provide --question <number> and --text <answer>');
             request = { operation: handler, workOrderId: workOrderId, question, text: answer };
         }
+        else if (handler === 'work-acknowledge') {
+            const note = text('note');
+            if (!note)
+                return usageOutcome('CLI_USAGE_INVALID', 'provide --note <why this change to the tests is not a weakening>', '--note');
+            request = { operation: handler, workOrderId: workOrderId, note };
+        }
         else if (handler === 'work-grade') {
             const verdict = text('verdict'), note = text('note');
             if (verdict !== undefined && verdict !== 'met' && verdict !== 'unmet')
@@ -791,7 +853,10 @@ async function decodeRequest(handler, parsed, runtimeEnv) {
             const role = text('role');
             if (values.role !== undefined && !role)
                 return usageOutcome('CLI_USAGE_INVALID', '--role requires a bounded identifier');
-            request = { operation: handler, ...(role ? { role } : {}) };
+            const route = text('route');
+            if (values.route !== undefined && !route)
+                return usageOutcome('CLI_USAGE_INVALID', '--route requires a declared route name or path', '--route');
+            request = { operation: handler, ...(role ? { role } : {}), ...(route ? { route } : {}), ...(values['fail-on-findings'] === true ? { failOnFindings: true } : {}) };
         }
         const { captureWorkApplicationRequest } = await import('./work-orders/application.js');
         const captured = captureWorkApplicationRequest(request);
@@ -955,6 +1020,10 @@ async function decodeRequest(handler, parsed, runtimeEnv) {
         const [command, ...argv] = parsed.positionals;
         if (!values.config)
             return missingConfig();
+        const composed = composeProfiles(values.profile);
+        if ('error' in composed)
+            return usageOutcome('CLI_USAGE_INVALID', composed.error, '--profile');
+        const { profiles } = composed;
         if (!command)
             return usageOutcome('CLI_USAGE_INVALID', 'session requires a command after --', 'session');
         const inherited = inheritedSessionId(runtimeEnv);
@@ -962,17 +1031,40 @@ async function decodeRequest(handler, parsed, runtimeEnv) {
             return usageOutcome('CLI_USAGE_INVALID', 'COCKPIT_SESSION_ID must be a canonical UUID', 'COCKPIT_SESSION_ID');
         if (inherited !== undefined)
             return usageOutcome('CLI_USAGE_INVALID', 'session cannot be nested inside another supervised session', 'session');
-        return { handler, input: { configPath: values.config, argv: [command, ...argv], sessionId: randomUUID() } };
+        return { handler, input: { configPath: values.config, argv: [command, ...argv], sessionId: randomUUID(), profiles } };
     }
-    if (handler === 'check' || handler === 'up' || handler === 'sleep' || handler === 'down' || handler === 'reset'
-        || handler === 'preflight' || handler === 'doctor') {
+    if (handler === 'up') {
         const values = parsed.values;
-        if (parsed.positionals.length > 0) {
-            return usageOutcome('CLI_USAGE_INVALID', `${handler} accepts named inputs only`);
-        }
+        if (parsed.positionals.length > 0)
+            return usageOutcome('CLI_USAGE_INVALID', 'up accepts named inputs only');
         if (!values.config)
             return missingConfig();
-        return { handler, input: { configPath: values.config } };
+        const composed = composeProfiles(values.profile);
+        if ('error' in composed)
+            return usageOutcome('CLI_USAGE_INVALID', composed.error, '--profile');
+        const { profiles } = composed;
+        return { handler, input: { configPath: values.config, profiles } };
+    }
+    if (handler === 'ps' || handler === 'restart' || handler === 'rebuild' || handler === 'exec') {
+        const values = parsed.values;
+        if (!values.config)
+            return missingConfig();
+        if (handler === 'ps')
+            return namedOnly(handler, parsed.positionals) ?? { handler, input: { configPath: values.config } };
+        if (!values.service)
+            return usageOutcome('CLI_USAGE_INVALID', 'provide --service <name>', '--service');
+        if (handler === 'exec') {
+            const [command, ...argv] = parsed.positionals;
+            if (!command)
+                return usageOutcome('CLI_USAGE_INVALID', 'exec requires a command after --', 'exec');
+            return { handler, input: { configPath: values.config, service: values.service, argv: [command, ...argv] } };
+        }
+        return namedOnly(handler, parsed.positionals) ?? { handler, input: { configPath: values.config, service: values.service } };
+    }
+    if (handler === 'check' || handler === 'sleep' || handler === 'down' || handler === 'reset'
+        || handler === 'preflight' || handler === 'doctor' || handler === 'docs-check') {
+        const values = parsed.values;
+        return namedOnly(handler, parsed.positionals) ?? (values.config ? { handler, input: { configPath: values.config } } : missingConfig());
     }
     if (handler === 'logs') {
         const values = parsed.values;
@@ -1000,6 +1092,16 @@ async function decodeRequest(handler, parsed, runtimeEnv) {
             },
         };
     }
+    if (handler === 'confirm') {
+        const values = parsed.values;
+        const [answer, ...extra] = parsed.positionals;
+        if (answer === undefined || extra.length > 0 || !isUnconfirmedAnswerName(answer)) {
+            return usageOutcome('CLI_USAGE_INVALID', `confirm takes one answer listed under unconfirmed, one of ${UNCONFIRMABLE_ANSWERS.join(', ')}: ${cockpitCommand('confirm', { operand: 'ports.bases' })}`);
+        }
+        if (!values.config)
+            return missingConfig();
+        return { handler, input: { configPath: values.config, answer } };
+    }
     if (handler === 'runtime') {
         const values = parsed.values;
         const [operation, ...extra] = parsed.positionals;
@@ -1012,6 +1114,21 @@ async function decodeRequest(handler, parsed, runtimeEnv) {
             return usageOutcome('CLI_USAGE_INVALID', 'provide --image <local-image>; the probe never pulls', '--image');
         return { handler, input: { configPath: values.config, image: values.image } };
     }
+    if (handler === 'stacks') {
+        const values = parsed.values;
+        const [operation, ...extra] = parsed.positionals;
+        if (operation !== undefined && operation !== 'prune' || extra.length > 0) {
+            return usageOutcome('CLI_USAGE_INVALID', `stacks takes no operation, or prune: ${cockpitCommand('stacks')}, or ${cockpitCommand('stacks prune', { args: '[--apply | --interactive]' })}`);
+        }
+        if (operation === undefined && (values.apply || values.interactive)) {
+            return usageOutcome('CLI_USAGE_INVALID', '--apply and --interactive belong to stacks prune; stacks alone only lists', values.apply ? '--apply' : '--interactive');
+        }
+        if (values.apply && values.interactive)
+            return usageOutcome('CLI_USAGE_INVALID', 'choose --apply or --interactive, not both', '--apply');
+        if (!values.config)
+            return missingConfig();
+        return { handler, input: { configPath: values.config, operation: operation === 'prune' ? 'prune' : 'list' } };
+    }
     if (handler === 'sibling') {
         const values = parsed.values;
         const [operation, slug, ...extra] = parsed.positionals;
@@ -1036,6 +1153,26 @@ async function decodeRequest(handler, parsed, runtimeEnv) {
                     ...(values['instruction-pointer'] === true ? { instructionPointer: true } : {}),
                 } } };
     }
+    if (handler === 'use') {
+        const values = parsed.values;
+        const [slug, checkout, ...extra] = parsed.positionals;
+        const shape = 'npx --no cockpit use <slug> <checkout> --config <your cockpit.toml>, or npx --no cockpit use <slug> --clear --config <your cockpit.toml>';
+        if (!slug || extra.length > 0 || (checkout === undefined) === (values.clear !== true)) {
+            return usageOutcome('CLI_USAGE_INVALID', `use takes a sibling slug and either one checkout directory or --clear: ${shape}`);
+        }
+        if (!values.config)
+            return missingConfig();
+        return { handler, input: { configPath: values.config, slug, clear: values.clear === true,
+                ...(checkout === undefined ? {} : { checkout: resolve(checkout) }) } };
+    }
+    if (handler === 'pull') {
+        const values = parsed.values;
+        if (parsed.positionals.length > 0)
+            return usageOutcome('CLI_USAGE_INVALID', 'pull accepts named inputs only');
+        if (!values.config)
+            return missingConfig();
+        return { handler, input: { configPath: values.config } };
+    }
     if (handler === 'tool') {
         const values = parsed.values;
         const [operation, tool, ...extra] = parsed.positionals;
@@ -1089,7 +1226,7 @@ async function invokeHandler(request, handlers, operators, options, io) {
 async function dispatchHandler(request, handlers, operators, options, io) {
     const unavailable = () => usageOutcome('CLI_INTERNAL_ERROR', `the "${request.handler}" command is unavailable`, request.handler);
     if (isWorkHandler(request.handler) && 'request' in request.input) {
-        if (request.handler === 'work-accept' || request.handler === 'work-answer' || request.handler === 'work-signoff') {
+        if (request.handler === 'work-accept' || request.handler === 'work-answer' || request.handler === 'work-signoff' || request.handler === 'work-acknowledge') {
             const opened = await operators.beginOperatorWorkApplication?.(request.input);
             if (!opened)
                 return unavailable();
@@ -1170,6 +1307,10 @@ async function dispatchHandler(request, handlers, operators, options, io) {
         return runSyncOperatorCommand(request.input, options, io, handlers.sync ?? (async () => unavailable()), operators.loadPolicy ?? loadOperatorPolicy);
     if (request.handler === 'check')
         return handlers.check?.(request.input) ?? unavailable();
+    if (request.handler === 'docs-check')
+        return handlers['docs-check']?.(request.input) ?? unavailable();
+    if (request.handler === 'confirm')
+        return handlers.confirm?.(request.input) ?? unavailable();
     if (request.handler === 'selftest') {
         const selftest = handlers.selftest ?? (async () => unavailable());
         return 'writeProbeSpecificationsPath' in request.input ? selftest(request.input)
@@ -1201,12 +1342,49 @@ async function dispatchHandler(request, handlers, operators, options, io) {
         return handlers.doctor?.(request.input) ?? unavailable();
     if (request.handler === 'logs')
         return handlers.logs?.(request.input) ?? unavailable();
+    if (request.handler === 'ps')
+        return handlers.ps?.(request.input) ?? unavailable();
+    if (request.handler === 'restart')
+        return handlers.restart?.(request.input) ?? unavailable();
+    if (request.handler === 'rebuild')
+        return handlers.rebuild?.(request.input) ?? unavailable();
+    if (request.handler === 'exec')
+        return handlers.exec?.(request.input) ?? unavailable();
     if (request.handler === 'runtime')
         return handlers.runtime?.(request.input) ?? unavailable();
+    if (request.handler === 'stacks') {
+        if (request.input.operation === 'list')
+            return handlers.stacks?.(request.input) ?? unavailable();
+        return runStacksPruneOperatorApplication({ configPath: request.input.configPath }, {
+            ...options,
+            terminal: io.confirmStacksPrune !== undefined || io.stdin?.isTTY === true,
+        }, {
+            policy: operators.loadPolicy ?? loadOperatorPolicy,
+            begin: operators.beginStacksPrune ?? (async () => unavailable()),
+            confirm: async (preview) => {
+                if (io.confirmStacksPrune)
+                    return io.confirmStacksPrune(preview);
+                if (!io.stdin)
+                    return undefined;
+                io.stderr.write(renderHumanValue(preview.result));
+                const prompt = createInterface({ input: io.stdin, output: io.stderr, terminal: true });
+                try {
+                    return (await prompt.question('Type the exact prune digest to remove these stacks: ')).trim();
+                }
+                finally {
+                    prompt.close();
+                }
+            },
+        });
+    }
     if (request.handler === 'sibling')
         return handlers.sibling?.(request.input) ?? unavailable();
     if (request.handler === 'tool')
         return handlers.tool?.(request.input) ?? unavailable();
+    if (request.handler === 'use')
+        return handlers.use?.(request.input) ?? unavailable();
+    if (request.handler === 'pull')
+        return handlers.pull?.(request.input) ?? unavailable();
     return unavailable();
 }
 function operatorRefusal(message) {
@@ -1237,6 +1415,7 @@ function defaultOperatorHandlers(runtime) {
             return { digest: outcome.continuation.digest, prompt: outcome.continuation.prompt,
                 decide: async (answer) => workCommandOutcome(await outcome.continuation.decide(answer), runtime.env ?? process.env) };
         },
+        beginStacksPrune: (input) => beginStacksPrune({ configPath: resolve(input.configPath), env: runtime.env ?? process.env }, input.scope, { execute: executeProbe }),
         beginOperatorReset: async (input) => {
             if (sessionId === null)
                 return operatorRefusal('COCKPIT_SESSION_ID must be a canonical UUID');
@@ -1264,7 +1443,7 @@ export async function runCli(args, io = process, handlerOverrides = {}, runtime
                 exitCode, resolvedConfigPath });
             io.stdout.write(renderJsonResponse({ ...outcome, invocation }, outcome.fixContext));
         }
-        return verb === 'session' && Number.isInteger(status) && status > 0 && status < 256 ? status : exitCode;
+        return (verb === 'session' || verb === 'exec') && Number.isInteger(status) && status > 0 && status < 256 ? status : exitCode;
     };
     // One refusal here instead of per-command checks: process ownership, filesystem publication and
     // the shell guards assume POSIX semantics, so a native Windows run could fail part-way through a