@bragi-gmbh/codebus 1.3.0 → 1.6.0

package/dist/commands/plan.js

@@ -1,7 +1,13 @@
+import { existsSync, readFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { userInfo } from "node:os";
+import { join } from "node:path";
+import { parse } from "yaml";
 import { resolveConfig } from "../config.js";
 import { makeCtx, workspaceId, repoId } from "../client.js";
 import { render } from "../output.js";
 import { CodebusError } from "../errors.js";
+import { planCapsFindings, planCapsLabel } from "./plan-lint.js";
 /**
  * codebus plan … — SP-A planning-layer CLI (fleet-v3 build/w2-sp-a-cli,
  * lane 2 of docs/plans/fleet-v3/sp-a-planning-layer.md §A.3).
@@ -132,6 +138,317 @@ export async function planReviewRecordCore(ctx, planId, opts) {
     if (error)
         throw new CodebusError(error.message);
 }
+export const unavailableTriageTransport = {
+    async review() { throw new CodebusError("plan triage requires an injected review transport"); },
+};
+export const trackedTriageTransport = {
+    async review(input) {
+        const prompt = [
+            "Review this immutable CodeBus plan as a read-only adversarial reason-role reviewer.",
+            "Return only one compact JSON object: {\"verdict\":\"approve|reject\",\"findings\":[],\"evidence\":[]}.",
+            "Reject material safety, dependency, authority, or verification gaps. Do not edit files or execute the plan.",
+            JSON.stringify({ revision_digest: input.revisionDigest, plan: input.plan }),
+        ].join("\n");
+        let output;
+        try {
+            const ownerHome = userInfo().homedir;
+            const monitoredWrapper = join(ownerHome, ".local/bin/opencode-mon.sh");
+            if (!existsSync(monitoredWrapper))
+                throw new Error(`monitoring wrapper not found: ${monitoredWrapper}`);
+            const childEnv = { ...process.env, HOME: ownerHome, FACTORY_HOME: ownerHome };
+            delete childEnv.REAL;
+            delete childEnv.DEV01_TRACKED;
+            delete childEnv.AGENT_RUNS_DIR;
+            output = execFileSync(monitoredWrapper, [
+                "run", "--agent", "plan", "--format", "json", prompt,
+            ], {
+                encoding: "utf8", timeout: 300_000, maxBuffer: 2 * 1024 * 1024,
+                env: childEnv,
+            });
+        }
+        catch (error) {
+            throw new CodebusError(`tracked plan triage failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const records = output.split("\n").filter(Boolean).flatMap((line) => {
+            try {
+                return [JSON.parse(line)];
+            }
+            catch {
+                return [];
+            }
+        });
+        const runId = records.find((record) => typeof record.sessionID === "string")?.sessionID;
+        const text = records.flatMap((record) => {
+            const candidate = record.part?.text ?? record.text;
+            return typeof candidate === "string" ? [candidate] : [];
+        }).at(-1);
+        if (!runId || !text)
+            throw new CodebusError("tracked plan triage returned no auditable result");
+        let result;
+        try {
+            const match = text.match(/\{[\s\S]*\}/);
+            result = JSON.parse(match?.[0] ?? "");
+        }
+        catch {
+            throw new CodebusError("tracked plan triage returned malformed JSON");
+        }
+        if (!['approve', 'reject'].includes(String(result.verdict)) || !Array.isArray(result.findings)) {
+            throw new CodebusError("tracked plan triage returned an invalid verdict");
+        }
+        return {
+            verdict: result.verdict,
+            findings: result.findings,
+            evidence: Array.isArray(result.evidence) ? result.evidence : [],
+            cost: undefined,
+            runId,
+        };
+    },
+};
+async function readPlanProjection(ctx, view) {
+    const ws = await workspaceId(ctx);
+    const { data, error } = await ctx.supabase.from(view).select("*").eq("workspace_id", ws);
+    if (error)
+        throw new CodebusError(error.message);
+    return (data ?? []);
+}
+export async function planObjectListCore(ctx) {
+    return readPlanProjection(ctx, "plan_list_v1");
+}
+export async function planObjectWhoCore(ctx) {
+    return readPlanProjection(ctx, "plan_who_v1");
+}
+/** The projection owns effective state; observed fields are returned separately and untouched. */
+export async function planObjectStuckCore(ctx) {
+    return readPlanProjection(ctx, "plan_stuck_v1");
+}
+export async function planObjectShowCore(ctx, planRef) {
+    const ws = await workspaceId(ctx);
+    const key = /^CB-PLAN-/i.test(planRef) ? "display_id" : "id";
+    const { data: plan, error: planError } = await ctx.supabase.from("plan_list_v1")
+        .select("*").eq("workspace_id", ws).eq(key, key === "display_id" ? planRef.toUpperCase() : planRef).single();
+    if (planError || !plan)
+        throw new CodebusError(`plan not found (or not visible to you): ${planRef}`);
+    const { data: assignments, error: assignmentsError } = await ctx.supabase.from("plan_who_v1")
+        .select("*").eq("workspace_id", ws).eq("plan_id", plan.id).is("active_to", null);
+    if (assignmentsError)
+        throw new CodebusError(assignmentsError.message);
+    const revisionId = plan.latest_revision_id;
+    if (!revisionId)
+        return { ...plan, assignments: assignments ?? [], stages: [] };
+    const { data: revision, error: revisionError } = await ctx.supabase.from("plan_revisions")
+        .select("document").eq("id", revisionId).single();
+    if (revisionError)
+        throw new CodebusError(revisionError.message);
+    const { data: stages, error: stagesError } = await ctx.supabase.from("plan_stages")
+        .select("*").eq("revision_id", revisionId).order("ordinal");
+    if (stagesError)
+        throw new CodebusError(stagesError.message);
+    return { ...plan, document: revision?.document ?? null, assignments: assignments ?? [], stages: stages ?? [] };
+}
+export async function planObjectImportCore(ctx, sourceRef, document, idempotencyKey) {
+    const ws = await workspaceId(ctx);
+    const { data, error } = await ctx.supabase.rpc("plan_import_v1", {
+        p_workspace_id: ws,
+        p_source_ref: sourceRef,
+        p_document: document,
+        p_idempotency_key: idempotencyKey,
+    });
+    if (error)
+        throw new CodebusError(error.message);
+    if (!data || typeof data !== "object" || Array.isArray(data)) {
+        throw new CodebusError("plan import RPC returned an invalid response");
+    }
+    return data;
+}
+export async function planTriageCore(ctx, planRef, opts, transport = unavailableTriageTransport) {
+    const plan = await planObjectShowCore(ctx, planRef);
+    const planId = String(plan.id);
+    if (String(plan.revision_digest ?? "") !== opts.revisionDigest) {
+        throw new CodebusError("stale plan revision digest; triage was not submitted");
+    }
+    const submission = await transport.review({ plan, planId, revisionDigest: opts.revisionDigest, role: opts.role });
+    const latest = await planObjectShowCore(ctx, planRef);
+    if (String(latest.revision_digest ?? "") !== opts.revisionDigest) {
+        throw new CodebusError("plan revision changed while triaging; result was not submitted");
+    }
+    const { data, error } = await ctx.supabase.rpc("plan_triage_report_record", {
+        p_revision_id: latest.latest_revision_id, p_revision_digest: opts.revisionDigest,
+        p_verdict: submission.verdict,
+        p_report: { role: opts.role, findings: submission.findings,
+            evidence: submission.evidence ?? [], cost: submission.cost ?? null,
+            run_id: submission.runId ?? null },
+    });
+    if (error)
+        throw new CodebusError(error.message);
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        throw new CodebusError("plan triage RPC returned an invalid response");
+    return { ...data, verdict: submission.verdict, findings: submission.findings };
+}
+export async function planApproveCore(ctx, revisionId, revisionDigest) {
+    const { data, error } = await ctx.supabase.rpc("plan_approve", { p_revision_id: revisionId, p_revision_digest: revisionDigest });
+    if (error)
+        throw new CodebusError(error.message);
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        throw new CodebusError("plan approval RPC returned an invalid response");
+    return data;
+}
+export async function planGateProposeCore(ctx, revisionId, revisionDigest, stageId) {
+    const { data, error } = await ctx.supabase.rpc("plan_gate_propose", {
+        p_revision_id: revisionId, p_revision_digest: revisionDigest, p_stage_id: stageId,
+    });
+    if (error)
+        throw new CodebusError(error.message);
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        throw new CodebusError("plan gate proposal RPC returned an invalid response");
+    return data;
+}
+export async function planGateReleaseCore(ctx, opts) {
+    const { data, error } = await ctx.supabase.rpc("plan_gate_release", {
+        p_gate_id: opts.gateId, p_reason: opts.reason ?? null,
+    });
+    if (error)
+        throw new CodebusError(error.message);
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        throw new CodebusError("plan gate release RPC returned an invalid response");
+    return data;
+}
+function readPlanSource(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new CodebusError(`unable to read plan file '${path}': ${detail}`);
+    }
+}
+// ──────────────────────────────────────────────── Plan Ledger projection
+/**
+ * Resolve the task form accepted by `codebus plan <task>` without ever doing
+ * an unscoped display-id lookup. Ledger status is keyed by the task UUID in
+ * SQL, while the human-facing CLI convention also accepts CB-TASK-… ids.
+ */
+async function resolveLedgerTaskId(ctx, taskRef) {
+    if (!/^CB-TASK-/i.test(taskRef))
+        return taskRef;
+    const ws = await workspaceId(ctx);
+    const { data, error } = await ctx.supabase
+        .from("tasks")
+        .select("id")
+        .eq("workspace_id", ws)
+        .eq("display_id", taskRef.toUpperCase())
+        .single();
+    if (error || !data)
+        throw new CodebusError(`task not found (or not visible to you): ${taskRef}`);
+    return data.id;
+}
+function normalizeCapsRow(data, planId) {
+    const row = (data && typeof data === "object" && !Array.isArray(data) ? data : {});
+    const num = (value, fallback) => typeof value === "number" && Number.isFinite(value) ? value
+        : typeof value === "string" && value.trim() !== "" && Number.isFinite(Number(value)) ? Number(value)
+            : fallback;
+    const intOrNull = (value) => {
+        const parsed = num(value, NaN);
+        return Number.isFinite(parsed) ? Math.trunc(parsed) : null;
+    };
+    return {
+        ...(row.workspace_id != null ? { workspace_id: String(row.workspace_id) } : {}),
+        plan_id: row.plan_id != null ? String(row.plan_id) : planId ?? null,
+        max_budget_usd: num(row.max_budget_usd, 150),
+        max_stages: num(row.max_stages, 12),
+        max_children_per_stage: intOrNull(row.max_children_per_stage),
+        decision_id: row.decision_id != null ? String(row.decision_id) : null,
+        decision_display_id: row.decision_display_id != null ? String(row.decision_display_id) : null,
+        source: row.source === "decision" ? "decision" : "default",
+    };
+}
+/** Effective admission caps: from plan_caps_effective_v1 (one plan) or
+ *  plan_caps_for (workspace level, e.g. before a plan exists). */
+export async function planCapsShowCore(ctx, planRef) {
+    const ws = await workspaceId(ctx);
+    if (!planRef) {
+        const { data, error } = await ctx.supabase.rpc("plan_caps_for", { p_workspace_id: ws, p_plan_id: null });
+        if (error)
+            throw new CodebusError(error.message);
+        return normalizeCapsRow(data);
+    }
+    const plan = await planObjectShowCore(ctx, planRef);
+    const { data, error } = await ctx.supabase.from("plan_caps_effective_v1")
+        .select("*").eq("plan_id", plan.id).maybeSingle();
+    if (error)
+        throw new CodebusError(error.message);
+    return normalizeCapsRow(data, String(plan.id));
+}
+/** Create a PENDING plan-caps decision; approval stays the owner action
+ *  (decision accept / decision_transition). */
+export async function planCapsProposeCore(ctx, opts) {
+    const ws = await workspaceId(ctx);
+    const { data, error } = await ctx.supabase.rpc("plan_caps_propose", {
+        p_workspace_id: ws,
+        p_max_budget_usd: opts.maxBudgetUsd ?? null,
+        p_max_stages: opts.maxStages ?? null,
+        p_max_children_per_stage: opts.maxChildrenPerStage ?? null,
+        p_applies_to: opts.appliesTo ?? "all",
+        p_expires_at: opts.expiresAt ?? null,
+    });
+    if (error)
+        throw new CodebusError(error.message);
+    if (!data || typeof data !== "object" || Array.isArray(data)) {
+        throw new CodebusError("plan caps proposal RPC returned an invalid response");
+    }
+    return data;
+}
+export async function planLedgerCore(ctx, taskRef) {
+    const taskId = await resolveLedgerTaskId(ctx, taskRef);
+    const { data, error } = await ctx.supabase.rpc("plan_ledger_status", { p_task_id: taskId });
+    if (error)
+        throw new CodebusError(error.message);
+    if (!data || typeof data !== "object")
+        throw new CodebusError("plan_ledger_status returned an invalid result");
+    return data;
+}
+function renderPlanLedgerHuman(result) {
+    const task = (result.task ?? {});
+    const predicates = (result.predicates ?? {});
+    const findings = Array.isArray(result.findings) ? result.findings : [];
+    const workItems = Array.isArray(result.work_items) ? result.work_items : [];
+    const contested = Array.isArray(result.contested) ? result.contested : [];
+    const edges = Array.isArray(result.edges) ? result.edges : [];
+    const lines = [
+        `task ${task.display_id ?? task.id} — ${task.title ?? "(untitled)"}`,
+        `  status=${task.status ?? "(unknown)"} done=${task.done ?? false}`,
+        `  SETTLED=${predicates.settled ?? false} EXHAUSTED=${predicates.exhausted ?? false}`,
+        `  blocking_risk=${predicates.blocking_risk ?? false} epochs=${predicates.epochs_observed ?? 0}`,
+        "",
+        "findings:",
+    ];
+    for (const [index, finding] of findings.entries()) {
+        const branch = index === findings.length - 1 ? "└─" : "├─";
+        const claim = String(finding.claim ?? "").replace(/\s+/g, " ").trim();
+        lines.push(`  ${branch} [${finding.status}] ${finding.id} ${finding.type}: ${claim}`);
+    }
+    if (findings.length === 0)
+        lines.push("  (none)");
+    lines.push("", "dependency edges:");
+    for (const edge of edges) {
+        lines.push(`  ${edge.source_finding_id} -[${edge.edge_type}]-> ${edge.target_finding_id}`);
+    }
+    if (edges.length === 0)
+        lines.push("  (none)");
+    lines.push("", "work items:");
+    for (const item of workItems) {
+        lines.push(`  ${item.compilable ? "✓" : "·"} ${item.work_item_id} compilable=${item.compilable}`
+            + (item.hold_reason ? ` hold=${item.hold_reason}` : ""));
+    }
+    if (workItems.length === 0)
+        lines.push("  (none)");
+    lines.push("", "contested findings:");
+    for (const finding of contested) {
+        lines.push(`  ! ${finding.id} ${finding.type}: ${finding.claim}`);
+    }
+    if (contested.length === 0)
+        lines.push("  (none)");
+    return lines.join("\n");
+}
 // Round-1 review (CB-MSG-005365) MAJOR finding 5: `plan show` used to run a
 // single unbounded PostgREST select for tickets and events. PostgREST's
 // `api.max_rows` (supabase/config.toml, 1000 by default) silently caps ANY
@@ -296,9 +613,37 @@ function renderPlanShowHuman(r) {
     lines.push(render(r.events.map((e) => ({ id: e.id, type: e.event_type, actor: e.actor_agent_id, summary: e.summary })), { json: false }));
     return lines.join("\n");
 }
-// ───────────────────────────────────────────────────────────── registration
-export function registerPlan(program, g) {
-    const plan = program.command("plan").description("planning layer: plan maps, tickets, frontier (SP-A)");
+export function registerPlan(program, g, dependencies = {}) {
+    const plan = g(program.command("plan"))
+        .argument("[task_id]", "task UUID or CB-TASK-… for the computed Plan Ledger view")
+        .description("planning layer: plan maps, tickets, frontier, and Plan Ledger status (SP-A/PL-3)")
+        // Commander keeps options declared on a parent command in the parent
+        // command's option bag. Existing plan subcommands declare the same
+        // shared options through `g`, and their actions read the child bag, so a
+        // parent `--json` would otherwise make `plan create --json` render a
+        // table. Copy explicitly supplied parent options into the dispatched
+        // child before its action runs; child-local values remain authoritative.
+        .hook("preAction", (_parent, actionCommand) => {
+        for (const [key, value] of Object.entries(plan.opts())) {
+            if (value !== undefined)
+                actionCommand.setOptionValue(key, value);
+        }
+    })
+        .action(async (taskId, o) => {
+        // A parent command action is only reached when no registered subcommand
+        // matched. Keep the no-argument behavior quiet for compatibility, while
+        // making the spec's `codebus plan <task_id>` a direct read surface.
+        if (!taskId)
+            return;
+        const ctx = await makeCtx(resolveConfig(o));
+        const result = await planLedgerCore(ctx, taskId);
+        if (o.json) {
+            console.log(JSON.stringify(result, null, 2));
+        }
+        else {
+            console.log(renderPlanLedgerHuman(result));
+        }
+    });
     g(plan.command("create"))
         .requiredOption("--title <t>")
         .requiredOption("--destination <d>", "what this plan produces")
@@ -415,23 +760,144 @@ export function registerPlan(program, g) {
         await planReviewRecordCore(ctx, planId, { kind: o.kind, verdict: o.verdict, msg: o.msg, loop: Number(o.loop) });
         console.log(render([{ plan_id: planId, kind: o.kind, verdict: o.verdict, loop: Number(o.loop) }], { json: !!o.json }));
     });
-    async function showPlan(planId, o) {
+    async function showPlanObject(planRef, o) {
         const ctx = await makeCtx(resolveConfig(o));
-        const result = await planShowCore(ctx, planId);
-        if (o.json) {
-            console.log(JSON.stringify(result, null, 2));
+        // Raw UUIDs are the pre-0097 SP-A surface and retain the frontier/event
+        // response exactly; CB-PLAN display IDs select the owned-plan object view.
+        if (!/^CB-PLAN-/i.test(planRef)) {
+            const legacy = await planShowCore(ctx, planRef);
+            if (o.json) {
+                console.log(JSON.stringify(legacy, null, 2));
+                return;
+            }
+            console.log(renderPlanShowHuman(legacy));
             return;
         }
-        console.log(renderPlanShowHuman(result));
+        const result = await planObjectShowCore(ctx, planRef);
+        console.log(o.json ? JSON.stringify(result, null, 2) : render([result], { json: false }));
     }
-    g(plan.command("show").argument("<plan>")).action(showPlan);
+    g(plan.command("show").argument("<plan>")).action(showPlanObject);
     // Compatibility restored (Sol round-1, F3/MAJOR + coordinator ruling):
-    // `plan status <plan>` is EXACTLY the pre-0069 alias again — same
-    // required argument, same handler (`showPlan`, the frontier view via
-    // planShowCore) — no output-shape change for any existing caller. The
-    // new bus_plan_status rollup lives at `plan rollup` instead (below), a
-    // brand new verb with no compatibility surface to protect.
-    g(plan.command("status").argument("<plan>")).action(showPlan); // alias — same frontier view
+    // `plan status` is a true alias of `plan show` — same handler, same
+    // output shape. The new bus_plan_status rollup lives at `plan rollup`
+    // instead (below), a brand new verb with no compatibility surface.
+    //
+    // Issue #350: `plan status` previously called planShowCore directly,
+    // bypassing display-id resolution — CB-PLAN-… refs failed with a
+    // misleading "plan not found" error. Delegating to showPlanObject
+    // (the same handler `plan show` uses) makes status accept both CB-PLAN-…
+    // display ids (resolved via planObjectShowCore) and raw UUIDs
+    // (frontier view via planShowCore), exactly as documented.
+    g(plan.command("status").argument("<plan>")).action(showPlanObject);
+    g(plan.command("list")).action(async (o) => {
+        const rows = await planObjectListCore(await makeCtx(resolveConfig(o)));
+        console.log(render(rows, { json: !!o.json }));
+    });
+    g(plan.command("who")).action(async (o) => {
+        const rows = await planObjectWhoCore(await makeCtx(resolveConfig(o)));
+        console.log(render(rows, { json: !!o.json }));
+    });
+    g(plan.command("stuck")).action(async (o) => {
+        const rows = await planObjectStuckCore(await makeCtx(resolveConfig(o)));
+        console.log(render(rows, { json: !!o.json }));
+    });
+    g(plan.command("import").argument("<yaml>"))
+        .requiredOption("--key <key>", "idempotency key for replay-safe import")
+        .action(async (path, o) => {
+        const source = readPlanSource(path);
+        let document;
+        try {
+            document = parse(source);
+        }
+        catch (error) {
+            throw new CodebusError(`unable to parse plan file '${path}': ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const ctx = await makeCtx(resolveConfig(o));
+        // Admission caps are owner decisions (0111): resolve the effective
+        // workspace caps and refuse before import, naming the decision id or
+        // the defaults. plan_import_v1 re-enforces the same caps server-side.
+        const capsRow = await planCapsShowCore(ctx);
+        const caps = {
+            max_budget_usd: capsRow.max_budget_usd,
+            max_stages: capsRow.max_stages,
+            max_children_per_stage: capsRow.max_children_per_stage,
+            decision_id: capsRow.decision_id,
+            decision_display_id: capsRow.decision_display_id,
+            source: capsRow.source,
+        };
+        const capFindings = planCapsFindings(document, caps);
+        if (capFindings.length > 0) {
+            throw new CodebusError(`plan import refused (${planCapsLabel(caps)}): ${capFindings.map((item) => `${item.code} ${item.message}`).join("; ")}`);
+        }
+        const result = await planObjectImportCore(ctx, path, document, o.key);
+        console.log(o.json ? JSON.stringify(result, null, 2) : render([result], { json: false }));
+    });
+    g(plan.command("triage").argument("<plan>"))
+        .requiredOption("--revision <digest>", "exact immutable revision digest")
+        .requiredOption("--role <role>", "reason")
+        .action(async (planRef, o) => {
+        if (o.role !== "reason")
+            throw new CodebusError("--role must be reason");
+        const result = await planTriageCore(await makeCtx(resolveConfig(o)), planRef, { revisionDigest: o.revision, role: "reason" }, dependencies.triageTransport ?? trackedTriageTransport);
+        console.log(o.json ? JSON.stringify(result, null, 2) : render([result], { json: false }));
+    });
+    g(plan.command("approve").argument("<plan>"))
+        .requiredOption("--revision <digest>", "exact immutable revision digest")
+        .action(async (planId, o) => {
+        const ctx = await makeCtx(resolveConfig(o));
+        const planObject = await planObjectShowCore(ctx, planId);
+        if (String(planObject.revision_digest) !== o.revision || typeof planObject.latest_revision_id !== "string") {
+            throw new CodebusError("stale plan revision digest; approval was not submitted");
+        }
+        const result = await planApproveCore(ctx, planObject.latest_revision_id, o.revision);
+        console.log(o.json ? JSON.stringify(result, null, 2) : render([result], { json: false }));
+    });
+    const gate = plan.command("gate").description("human plan gate operations");
+    g(gate.command("propose").argument("<revision>"))
+        .requiredOption("--revision-digest <digest>", "exact immutable revision digest")
+        .requiredOption("--stage <stage>", "exact human stage reference")
+        .action(async (revisionId, o) => {
+        const result = await planGateProposeCore(await makeCtx(resolveConfig(o)), revisionId, o.revisionDigest, o.stage);
+        console.log(o.json ? JSON.stringify(result, null, 2) : render([result], { json: false }));
+    });
+    g(gate.command("release").argument("<gate>"))
+        .option("--reason <reason>")
+        .action(async (gateId, o) => {
+        const result = await planGateReleaseCore(await makeCtx(resolveConfig(o)), {
+            gateId, reason: o.reason,
+        });
+        console.log(o.json ? JSON.stringify(result, null, 2) : render([result], { json: false }));
+    });
+    const caps = plan.command("caps").description("plan admission caps (owner decisions)");
+    g(caps.command("show").argument("[plan]", "plan display ID (CB-PLAN-…) or UUID; omit for workspace-level caps"))
+        .action(async (planRef, o) => {
+        const result = await planCapsShowCore(await makeCtx(resolveConfig(o)), planRef);
+        console.log(o.json ? JSON.stringify(result, null, 2) : render([result], { json: false }));
+    });
+    g(caps.command("propose"))
+        .option("--max-budget-usd <n>", "maximum plan budget in USD")
+        .option("--max-stages <n>", "maximum number of normal stages")
+        .option("--max-children-per-stage <n>", "maximum dependent stages per stage")
+        .option("--plan <id>", "apply to one plan (default: all plans in the workspace)")
+        .option("--expires-at <ts>", "ISO timestamp after which the caps lapse")
+        .action(async (o) => {
+        const num = (value, name) => {
+            if (value == null)
+                return undefined;
+            const parsed = Number(value);
+            if (!Number.isFinite(parsed))
+                throw new CodebusError(`${name} must be a number`);
+            return parsed;
+        };
+        const result = await planCapsProposeCore(await makeCtx(resolveConfig(o)), {
+            maxBudgetUsd: num(o.maxBudgetUsd, "--max-budget-usd"),
+            maxStages: num(o.maxStages, "--max-stages"),
+            maxChildrenPerStage: num(o.maxChildrenPerStage, "--max-children-per-stage"),
+            appliesTo: o.plan,
+            expiresAt: o.expiresAt,
+        });
+        console.log(o.json ? JSON.stringify(result, null, 2) : render([result], { json: false }));
+    });
     g(plan.command("rollup").argument("[plan]"))
         .action(async (planId, o) => {
         const ctx = await makeCtx(resolveConfig(o));