@cairnkeep/cli 2.6.0 → 2.8.0

package/mcp-memory-server/dist/eval-workspace.js

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { constants, existsSync } from "node:fs";
 import { chmod, lstat, mkdir, mkdtemp, open, readFile, realpath, writeFile, } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -155,7 +156,7 @@ export async function createEvalWorkspace(options) {
     };
     try {
         if (options.plan.source.kind === "git") {
-            const added = await gitCommand(options.plan.source.repository_root, ["worktree", "add", "--detach", workspace.source_path, options.plan.source.revision], "exit-only");
+            const added = await gitCommand(options.plan.source.repository_root, ["worktree", "add", "--quiet", "--detach", workspace.source_path, options.plan.source.revision], "exit-only");
             requireSuccessfulCommand(added, "workspace_add_failed");
             workspace.worktree_registered = true;
             await verifyGitWorkspace(workspace);
@@ -192,6 +193,54 @@ export async function runTaskPreparation(workspace, options = {}) {
         signal: options.signal,
     });
 }
+export async function applyEvalWorkspaceOverlay(workspace, overlay) {
+    const segments = overlay.relative_path.split("/");
+    if (overlay.relative_path.startsWith("/") || overlay.relative_path.endsWith("/")
+        || overlay.relative_path.includes("\\") || segments.some((segment) => segment === "" || segment === "." || segment === "..")
+        || /[\u0000-\u001f\u007f]/.test(overlay.relative_path)) {
+        throw new Error("workspace_overlay_path_invalid");
+    }
+    const target = resolve(workspace.source_path, overlay.relative_path);
+    if (!isContained(workspace.source_path, target) || target === workspace.source_path) {
+        throw new Error("workspace_overlay_path_escape");
+    }
+    let cursor = workspace.source_path;
+    for (const segment of segments.slice(0, -1)) {
+        cursor = join(cursor, segment);
+        try {
+            const info = await lstat(cursor);
+            if (info.isSymbolicLink() || !info.isDirectory())
+                throw new Error("workspace_overlay_parent_unsafe");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+            await mkdir(cursor, { mode: 0o700 });
+        }
+    }
+    try {
+        const info = await lstat(target);
+        if (info.isSymbolicLink() || !info.isFile())
+            throw new Error("workspace_overlay_target_unsafe");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const parent = await realpath(dirname(target));
+    const source = await realpath(workspace.source_path);
+    if (!isContained(source, parent))
+        throw new Error("workspace_overlay_parent_escape");
+    const bytes = Buffer.from(overlay.content, "utf8");
+    const digest = createHash("sha256").update(bytes).digest("hex");
+    if (digest !== overlay.digest)
+        throw new Error("workspace_overlay_digest_mismatch");
+    await writeFile(target, bytes, { mode: 0o600 });
+    await chmod(target, 0o600);
+    const storedDigest = createHash("sha256").update(await readFile(target)).digest("hex");
+    if (storedDigest !== overlay.digest)
+        throw new Error("workspace_overlay_write_mismatch");
+}
 function verifierReason(code) {
     return `verifier_${code}`;
 }

package/mcp-memory-server/dist/graph-cli.js

@@ -0,0 +1,386 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { lstat, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+import { resolveCapabilityStatus } from "./capability-config.js";
+import { isGraphCapabilityCompatible } from "./capability-registry.js";
+const INSPECTION_TIMEOUT_MS = 30_000;
+const BUILD_TIMEOUT_MS = 300_000;
+const MAX_GRAPH_BYTES = 256 * 1024 * 1024;
+const MAX_AUXILIARY_BYTES = 64 * 1024 * 1024;
+const MAX_SUBPROCESS_OUTPUT_BYTES = 16 * 1024 * 1024;
+const STALE_AFTER_MS = 24 * 60 * 60 * 1000;
+function usage() {
+    return `cairn graph — build and inspect the optional local Graphify graph
+
+Usage:
+  cairn graph build [--force]
+  cairn graph query <term>
+  cairn graph status
+  cairn graph diff
+  cairn graph explain <symbol>
+  cairn graph path <from> <to>
+`;
+}
+function graphEdges(graph) {
+    return Array.isArray(graph.edges) ? graph.edges : Array.isArray(graph.links) ? graph.links : [];
+}
+function graphHyperedges(graph) {
+    return Array.isArray(graph.hyperedges) ? graph.hyperedges : [];
+}
+function plural(count, singular) {
+    return `${count} ${singular}${count === 1 ? "" : "s"}`;
+}
+async function readBoundedFile(path, maximumBytes) {
+    const info = await lstat(path);
+    if (!info.isFile() || info.isSymbolicLink() || info.size > maximumBytes) {
+        throw new Error("graph artifact is missing, unsafe, or too large.");
+    }
+    const bytes = await readFile(path);
+    if (bytes.byteLength > maximumBytes)
+        throw new Error("graph artifact is too large.");
+    return bytes;
+}
+function parseGraph(bytes) {
+    const value = JSON.parse(bytes.toString("utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("graph.json is not a JSON object.");
+    }
+    const graph = value;
+    if (!Array.isArray(graph.nodes)
+        || (!Array.isArray(graph.edges) && !Array.isArray(graph.links))) {
+        throw new Error("graph.json is missing its node or edge arrays.");
+    }
+    return graph;
+}
+async function readGraph(path) {
+    try {
+        return parseGraph(await readBoundedFile(path, MAX_GRAPH_BYTES));
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            throw new Error("no published graph found; run /graphify build first.");
+        }
+        throw error;
+    }
+}
+function publishedGraphPath(projectRoot) {
+    return join(projectRoot, ".planning", "graphs", "graph.json");
+}
+async function requireGraphCapability(projectRoot) {
+    const status = await resolveCapabilityStatus({ projectRoot });
+    const graph = status.capabilities.find(({ id }) => id === "graph");
+    const enabled = status.contract_enabled
+        ? graph?.enabled === true
+        : await isGraphCapabilityCompatible(projectRoot);
+    if (!enabled) {
+        throw new Error("graph capability is disabled; use `cairn capabilities enable graph` with the managed contract, or enable `graphify.enabled` in .planning/config.json.");
+    }
+}
+function graphifyEnvironment() {
+    const environment = { PYTHONUNBUFFERED: "1" };
+    for (const name of [
+        "PATH", "HOME", "TMPDIR", "TMP", "TEMP", "LANG", "LC_ALL",
+        "XDG_CACHE_HOME", "XDG_CONFIG_HOME", "XDG_DATA_HOME", "VIRTUAL_ENV", "PYTHONPATH",
+    ]) {
+        if (process.env[name] !== undefined)
+            environment[name] = process.env[name];
+    }
+    return environment;
+}
+function executeGraphify(projectRoot, args, timeout) {
+    const result = spawnSync("graphify", args, {
+        cwd: projectRoot,
+        encoding: "utf8",
+        shell: false,
+        timeout,
+        maxBuffer: MAX_SUBPROCESS_OUTPUT_BYTES,
+        env: graphifyEnvironment(),
+    });
+    if (result.error) {
+        const code = result.error.code;
+        if (code === "ENOENT") {
+            throw new Error("Graphify CLI not found; install it with `uv tool install graphifyy` (or `pipx install graphifyy`).");
+        }
+        if (code === "ETIMEDOUT")
+            throw new Error(`Graphify timed out after ${Math.round(timeout / 1000)} seconds.`);
+        if (code === "ENOBUFS")
+            throw new Error("Graphify exceeded the 16 MiB subprocess-output limit.");
+        throw new Error("Graphify could not start.");
+    }
+    if (result.signal)
+        throw new Error("Graphify terminated before completion.");
+    return result;
+}
+function forwardResult(result) {
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderr)
+        process.stderr.write(result.stderr);
+    if (result.status === 0)
+        return true;
+    process.exitCode = result.status ?? 1;
+    return false;
+}
+async function ensureSafeDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    const info = await lstat(path);
+    if (!info.isDirectory() || info.isSymbolicLink())
+        throw new Error("graph directory is unsafe.");
+}
+async function ensureSafeGraphBoundary(projectRoot, createGraphs) {
+    const planningDirectory = join(projectRoot, ".planning");
+    let planningInfo;
+    try {
+        planningInfo = await lstat(planningDirectory);
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            throw new Error("planning directory not found; run `cairn bootstrap` first.");
+        }
+        throw error;
+    }
+    if (!planningInfo.isDirectory() || planningInfo.isSymbolicLink()) {
+        throw new Error("planning directory is unsafe.");
+    }
+    const graphsDirectory = join(planningDirectory, "graphs");
+    try {
+        const graphsInfo = await lstat(graphsDirectory);
+        if (!graphsInfo.isDirectory() || graphsInfo.isSymbolicLink()) {
+            throw new Error("graph directory is unsafe.");
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        if (createGraphs)
+            await ensureSafeDirectory(graphsDirectory);
+    }
+}
+async function atomicWrite(path, bytes) {
+    const temporary = join(dirname(path), `.${basename(path)}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`);
+    try {
+        await writeFile(temporary, bytes, { mode: 0o600, flag: "wx" });
+        await rename(temporary, path);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+async function publishOptional(source, destination) {
+    try {
+        await atomicWrite(destination, await readBoundedFile(source, MAX_AUXILIARY_BYTES));
+        return true;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        await rm(destination, { force: true });
+        return false;
+    }
+}
+async function isolatePublishedArtifacts(projectRoot) {
+    const directory = join(projectRoot, ".planning", "graphs");
+    const managedPaths = [
+        join(directory, "graph.json"),
+        join(directory, "graph.html"),
+        join(directory, "GRAPH_REPORT.md"),
+        join(directory, ".last-build-snapshot.json"),
+    ];
+    const saved = new Map();
+    try {
+        for (const [destination, maximumBytes] of [
+            [managedPaths[0], MAX_GRAPH_BYTES],
+            [managedPaths[1], MAX_AUXILIARY_BYTES],
+            [managedPaths[2], MAX_AUXILIARY_BYTES],
+            [managedPaths[3], MAX_GRAPH_BYTES],
+        ]) {
+            try {
+                saved.set(destination, await readBoundedFile(destination, maximumBytes));
+                await rm(destination);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+        }
+        const previousBytes = saved.get(join(directory, "graph.json"));
+        const previousGraph = previousBytes ? parseGraph(previousBytes) : undefined;
+        return {
+            previousGraph,
+            finish: async (keepNewArtifact) => {
+                if (!keepNewArtifact) {
+                    for (const path of managedPaths)
+                        await rm(path, { force: true });
+                    for (const [path, bytes] of saved)
+                        await atomicWrite(path, bytes);
+                }
+            },
+        };
+    }
+    catch (error) {
+        for (const [path, bytes] of saved)
+            await atomicWrite(path, bytes);
+        throw error;
+    }
+}
+async function buildGraph(projectRoot, force) {
+    const outputDirectory = join(projectRoot, "graphify-out");
+    try {
+        const info = await lstat(outputDirectory);
+        if (!info.isDirectory() || info.isSymbolicLink())
+            throw new Error("Graphify output directory is unsafe.");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const isolatedArtifacts = await isolatePublishedArtifacts(projectRoot);
+    let published = false;
+    try {
+        const result = executeGraphify(projectRoot, ["update", ".", ...(force ? ["--force"] : [])], BUILD_TIMEOUT_MS);
+        if (result.status !== 0) {
+            forwardResult(result);
+            return;
+        }
+        if (result.stderr)
+            process.stderr.write(result.stderr);
+        const sourceGraphPath = join(outputDirectory, "graph.json");
+        const sourceGraphBytes = await readBoundedFile(sourceGraphPath, MAX_GRAPH_BYTES);
+        const sourceGraph = parseGraph(sourceGraphBytes);
+        const graphsDirectory = join(projectRoot, ".planning", "graphs");
+        await ensureSafeDirectory(graphsDirectory);
+        const destinationGraphPath = publishedGraphPath(projectRoot);
+        if (isolatedArtifacts.previousGraph) {
+            const previous = isolatedArtifacts.previousGraph;
+            await atomicWrite(join(graphsDirectory, ".last-build-snapshot.json"), `${JSON.stringify({
+                version: 1,
+                timestamp: new Date().toISOString(),
+                nodes: previous.nodes,
+                edges: graphEdges(previous),
+            }, null, 2)}\n`);
+        }
+        await atomicWrite(destinationGraphPath, sourceGraphBytes);
+        const publishedNames = ["graph.json"];
+        for (const name of ["graph.html", "GRAPH_REPORT.md"]) {
+            if (await publishOptional(join(outputDirectory, name), join(graphsDirectory, name)))
+                publishedNames.push(name);
+        }
+        published = true;
+        process.stdout.write(`Built local code graph: ${plural(sourceGraph.nodes.length, "node")}, ${plural(graphEdges(sourceGraph).length, "edge")}, ${plural(graphHyperedges(sourceGraph).length, "hyperedge")}.\n`
+            + `Published: ${publishedNames.join(", ")} in .planning/graphs/.\n`);
+    }
+    finally {
+        await isolatedArtifacts.finish(published);
+    }
+}
+async function showStatus(projectRoot) {
+    const path = publishedGraphPath(projectRoot);
+    const [graph, info] = await Promise.all([readGraph(path), lstat(path)]);
+    const ageMs = Math.max(0, Date.now() - info.mtimeMs);
+    process.stdout.write(`Graph: ${plural(graph.nodes.length, "node")}, ${plural(graphEdges(graph).length, "edge")}, ${plural(graphHyperedges(graph).length, "hyperedge")}.\n`
+        + `Freshness: ${ageMs > STALE_AFTER_MS ? "STALE" : "FRESH"}; built ${new Date(info.mtimeMs).toISOString()}.\n`);
+}
+function keyedNodes(graph) {
+    return new Map(graph.nodes.flatMap((node) => {
+        if (!node || typeof node !== "object" || Array.isArray(node))
+            return [];
+        const id = node.id;
+        return typeof id === "string" ? [[id, node]] : [];
+    }));
+}
+function keyedEdges(graph) {
+    return new Map(graphEdges(graph).flatMap((edge) => {
+        if (!edge || typeof edge !== "object" || Array.isArray(edge))
+            return [];
+        const row = edge;
+        if (typeof row.source !== "string" || typeof row.target !== "string")
+            return [];
+        return [[`${row.source}\u0000${row.target}\u0000${String(row.relation ?? row.label ?? "")}`, edge]];
+    }));
+}
+function delta(current, previous) {
+    let added = 0;
+    let removed = 0;
+    let changed = 0;
+    for (const [key, value] of current) {
+        if (!previous.has(key))
+            added += 1;
+        else if (JSON.stringify(previous.get(key)) !== JSON.stringify(value))
+            changed += 1;
+    }
+    for (const key of previous.keys())
+        if (!current.has(key))
+            removed += 1;
+    return { added, removed, changed };
+}
+async function showDiff(projectRoot) {
+    const current = await readGraph(publishedGraphPath(projectRoot));
+    const snapshotPath = join(projectRoot, ".planning", "graphs", ".last-build-snapshot.json");
+    let previous;
+    try {
+        previous = await readGraph(snapshotPath);
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith("no published graph found")) {
+            throw new Error("no previous graph snapshot found; run /graphify build again after a code change.");
+        }
+        throw error;
+    }
+    const nodes = delta(keyedNodes(current), keyedNodes(previous));
+    const edges = delta(keyedEdges(current), keyedEdges(previous));
+    process.stdout.write(`Nodes: ${nodes.added} added, ${nodes.removed} removed, ${nodes.changed} changed.\n`
+        + `Edges: ${edges.added} added, ${edges.removed} removed, ${edges.changed} changed.\n`);
+}
+function validInspectionArguments(command, args) {
+    const expected = command === "path" ? 2 : 1;
+    return args.length === expected
+        && args.every((value) => value.length > 0 && value.length <= 1024 && !value.startsWith("-"));
+}
+async function main() {
+    const [command = "help", ...args] = process.argv.slice(2);
+    if (command === "help" || command === "--help" || command === "-h") {
+        process.stdout.write(usage());
+        return;
+    }
+    const valid = (command === "build" && (args.length === 0 || (args.length === 1 && args[0] === "--force")))
+        || ((command === "status" || command === "diff") && args.length === 0)
+        || (["query", "explain", "path"].includes(command) && validInspectionArguments(command, args));
+    if (!valid) {
+        process.stderr.write(usage());
+        process.exitCode = 2;
+        return;
+    }
+    try {
+        const projectRoot = resolve(process.cwd());
+        await requireGraphCapability(projectRoot);
+        await ensureSafeGraphBoundary(projectRoot, command === "build");
+        if (command === "build") {
+            await buildGraph(projectRoot, args[0] === "--force");
+            return;
+        }
+        if (command === "status") {
+            await showStatus(projectRoot);
+            return;
+        }
+        if (command === "diff") {
+            await showDiff(projectRoot);
+            return;
+        }
+        await readGraph(publishedGraphPath(projectRoot));
+        const result = executeGraphify(projectRoot, [command, ...args, "--graph", publishedGraphPath(projectRoot)], INSPECTION_TIMEOUT_MS);
+        forwardResult(result);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "operation failed.";
+        process.stderr.write(`cairn graph: ${message}\n`);
+        process.exitCode = 1;
+    }
+}
+process.stdout.on("error", (error) => {
+    if (error.code === "EPIPE")
+        process.exit(0);
+    throw error;
+});
+await main();

package/mcp-memory-server/dist/skill-cli.js

@@ -0,0 +1,236 @@
+#!/usr/bin/env node
+import { resolve } from "node:path";
+import { canonicalDigest } from "./eval-schema.js";
+import { evaluateSkillProposal } from "./skill-evaluation.js";
+import { applySkillProposal, approveSkillCandidate, harvestSkillCandidates, listSkillApplications, listSkillCandidates, listSkillEvaluations, listSkillProposals, proposeSkill, readSkillApplication, readSkillCandidate, readSkillEvaluation, readSkillProposal, rollbackSkillApplication, } from "./skill-store.js";
+process.stdout.on("error", (error) => {
+    if (error.code === "EPIPE")
+        process.exit(0);
+    throw error;
+});
+const ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,127}$/;
+const DIGEST_PATTERN = /^[a-f0-9]{64}$/;
+const KINDS = ["candidate", "proposal", "evaluation", "application"];
+function usage() {
+    return `cairn skill: reviewed, evidence-gated skill improvement
+
+Usage:
+  cairn skill harvest [--project PATH] [--minimum-occurrences N] [--json]
+  cairn skill list [--project PATH] [--kind KIND] [--json]
+  cairn skill show --kind KIND --id ID [--project PATH] [--json]
+  cairn skill review --candidate ID --approve [--project PATH] [--json]
+  cairn skill propose --candidate ID --target RELATIVE_PATH --adapter PATH [--edit-budget N] [--project PATH] [--json]
+  cairn skill evaluate --proposal ID --exploration-task-set PATH --confirmation-task-set PATH --adapter PATH
+                       [--output ROOT] [--repetitions N] [--seed VALUE] [--minimum-improvement N]
+                       [--project PATH] --yes [--json]
+  cairn skill apply --proposal ID --evaluation ID --confirm PROPOSAL_DIGEST [--project PATH] [--json]
+  cairn skill rollback --application ID --confirm [--project PATH] [--json]
+
+KIND is candidate, proposal, evaluation, or application. Proposal generation
+receives evidence only after review. Evaluation is opt-in with CAIRN_EVAL=1,
+uses disjoint committed exploration and confirmation task sets, and invokes the
+operator-owned adapter. Apply is allowed only for an eligible exact evaluation.
+`;
+}
+const valueFlags = new Set([
+    "--project", "--minimum-occurrences", "--kind", "--id", "--candidate", "--target", "--adapter",
+    "--edit-budget", "--proposal", "--exploration-task-set", "--confirmation-task-set", "--output",
+    "--repetitions", "--seed", "--minimum-improvement", "--evaluation", "--application", "--confirm",
+]);
+const booleanFlags = new Set(["--json", "--approve", "--yes"]);
+function parse(args, allowed) {
+    const permitted = new Set(allowed);
+    const result = new Map();
+    for (let index = 0; index < args.length; index += 1) {
+        const flag = args[index];
+        if (!flag.startsWith("--") || !permitted.has(flag))
+            throw new Error(`Unknown option: ${flag}`);
+        if (result.has(flag))
+            throw new Error(`Option may be supplied only once: ${flag}`);
+        if (flag === "--confirm" && (!args[index + 1] || args[index + 1].startsWith("--"))) {
+            result.set(flag, true);
+            continue;
+        }
+        if (booleanFlags.has(flag)) {
+            result.set(flag, true);
+            continue;
+        }
+        if (!valueFlags.has(flag))
+            throw new Error(`Unsupported option: ${flag}`);
+        const value = args[index + 1];
+        if (!value || value.startsWith("--"))
+            throw new Error(`${flag} requires a value.`);
+        result.set(flag, value);
+        index += 1;
+    }
+    return result;
+}
+function stringValue(flags, name, required = false) {
+    const value = flags.get(name);
+    if (required && typeof value !== "string")
+        throw new Error(`${name} is required.`);
+    return typeof value === "string" ? value : undefined;
+}
+function positiveInteger(flags, name, fallback) {
+    const raw = stringValue(flags, name);
+    if (raw === undefined)
+        return fallback;
+    if (!/^[1-9][0-9]*$/.test(raw))
+        throw new Error(`${name} must be a positive integer.`);
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value))
+        throw new Error(`${name} is outside the supported range.`);
+    return value;
+}
+function identifier(flags, name) {
+    const value = stringValue(flags, name, true);
+    if (!ID_PATTERN.test(value))
+        throw new Error(`${name} must be a canonical artifact ID.`);
+    return value;
+}
+function projectRoot(flags) {
+    return resolve(stringValue(flags, "--project") ?? process.cwd());
+}
+function kind(flags, fallback) {
+    const value = stringValue(flags, "--kind") ?? fallback;
+    if (!value || !KINDS.includes(value))
+        throw new Error(`--kind must be one of: ${KINDS.join(", ")}.`);
+    return value;
+}
+function emit(value, json) {
+    process.stdout.write(`${JSON.stringify(value, null, json ? 0 : 2)}\n`);
+}
+function list(root, selected) {
+    const values = {
+        candidates: listSkillCandidates(root),
+        proposals: listSkillProposals(root),
+        evaluations: listSkillEvaluations(root),
+        applications: listSkillApplications(root),
+    };
+    if (!selected)
+        return values;
+    return values[`${selected}s`];
+}
+function show(root, selected, id) {
+    if (selected === "candidate")
+        return readSkillCandidate(root, id);
+    if (selected === "proposal")
+        return readSkillProposal(root, id);
+    if (selected === "evaluation")
+        return readSkillEvaluation(root, id);
+    return readSkillApplication(root, id);
+}
+async function main() {
+    const [command = "help", ...args] = process.argv.slice(2);
+    if (command === "help" || command === "--help" || command === "-h") {
+        process.stdout.write(usage());
+        return;
+    }
+    if (command === "harvest") {
+        const flags = parse(args, ["--project", "--minimum-occurrences", "--json"]);
+        emit(harvestSkillCandidates({
+            projectRoot: projectRoot(flags),
+            minimumOccurrences: positiveInteger(flags, "--minimum-occurrences"),
+        }), flags.has("--json"));
+        return;
+    }
+    if (command === "list") {
+        const flags = parse(args, ["--project", "--kind", "--json"]);
+        const selected = stringValue(flags, "--kind") ? kind(flags) : undefined;
+        emit(list(projectRoot(flags), selected), flags.has("--json"));
+        return;
+    }
+    if (command === "show") {
+        const flags = parse(args, ["--project", "--kind", "--id", "--json"]);
+        emit(show(projectRoot(flags), kind(flags), identifier(flags, "--id")), flags.has("--json"));
+        return;
+    }
+    if (command === "review") {
+        const flags = parse(args, ["--project", "--candidate", "--approve", "--json"]);
+        if (!flags.has("--approve"))
+            throw new Error("Review currently requires --approve.");
+        emit(approveSkillCandidate(projectRoot(flags), identifier(flags, "--candidate")), flags.has("--json"));
+        return;
+    }
+    if (command === "propose") {
+        const flags = parse(args, ["--project", "--candidate", "--target", "--adapter", "--edit-budget", "--json"]);
+        const controller = new AbortController();
+        const cancel = () => controller.abort();
+        process.once("SIGINT", cancel);
+        process.once("SIGTERM", cancel);
+        try {
+            const proposal = await proposeSkill({
+                projectRoot: projectRoot(flags),
+                candidateId: identifier(flags, "--candidate"),
+                targetPath: stringValue(flags, "--target", true),
+                adapterPath: stringValue(flags, "--adapter", true),
+                editBudget: positiveInteger(flags, "--edit-budget"),
+                signal: controller.signal,
+            });
+            emit({ ...proposal, proposal_digest: canonicalDigest(proposal) }, flags.has("--json"));
+        }
+        finally {
+            process.removeListener("SIGINT", cancel);
+            process.removeListener("SIGTERM", cancel);
+        }
+        return;
+    }
+    if (command === "evaluate") {
+        const flags = parse(args, [
+            "--project", "--proposal", "--exploration-task-set", "--confirmation-task-set", "--adapter",
+            "--output", "--repetitions", "--seed", "--minimum-improvement", "--yes", "--json",
+        ]);
+        const controller = new AbortController();
+        const cancel = () => controller.abort();
+        process.once("SIGINT", cancel);
+        process.once("SIGTERM", cancel);
+        try {
+            emit(await evaluateSkillProposal({
+                projectRoot: projectRoot(flags),
+                proposalId: identifier(flags, "--proposal"),
+                explorationTaskSetPath: stringValue(flags, "--exploration-task-set", true),
+                confirmationTaskSetPath: stringValue(flags, "--confirmation-task-set", true),
+                adapterPath: stringValue(flags, "--adapter", true),
+                outputRoot: stringValue(flags, "--output"),
+                repetitions: positiveInteger(flags, "--repetitions"),
+                seed: stringValue(flags, "--seed"),
+                minimumImprovement: positiveInteger(flags, "--minimum-improvement"),
+                confirm: flags.has("--yes"),
+                signal: controller.signal,
+            }), flags.has("--json"));
+        }
+        finally {
+            process.removeListener("SIGINT", cancel);
+            process.removeListener("SIGTERM", cancel);
+        }
+        return;
+    }
+    if (command === "apply") {
+        const flags = parse(args, ["--project", "--proposal", "--evaluation", "--confirm", "--json"]);
+        const confirm = flags.get("--confirm");
+        if (typeof confirm !== "string" || !DIGEST_PATTERN.test(confirm)) {
+            throw new Error("--confirm requires the exact 64-character proposal digest.");
+        }
+        emit(applySkillProposal({
+            projectRoot: projectRoot(flags),
+            proposalId: identifier(flags, "--proposal"),
+            evaluationId: identifier(flags, "--evaluation"),
+            confirmDigest: confirm,
+        }), flags.has("--json"));
+        return;
+    }
+    if (command === "rollback") {
+        const flags = parse(args, ["--project", "--application", "--confirm", "--json"]);
+        emit(rollbackSkillApplication({
+            projectRoot: projectRoot(flags),
+            applicationId: identifier(flags, "--application"),
+            confirm: flags.has("--confirm"),
+        }), flags.has("--json"));
+        return;
+    }
+    throw new Error(`Unknown skill command: ${command}`);
+}
+main().catch((error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+});