@contextecf/guardian-cli 0.1.2 → 0.1.4

package/dist/packages/guardian-cli/src/index.js

@@ -593,7 +593,7 @@ function $constructor(name, initializer3, params) {
   Object.defineProperty(_, "name", { value: name });
   return _;
 }
-var $brand = Symbol("zod_brand");
+var $brand = /* @__PURE__ */ Symbol("zod_brand");
 var $ZodAsyncError = class extends Error {
   constructor() {
     super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);
@@ -10336,8 +10336,8 @@ function yo_default() {
 
 // node_modules/zod/v4/core/registries.js
 var _a2;
-var $output = Symbol("ZodOutput");
-var $input = Symbol("ZodInput");
+var $output = /* @__PURE__ */ Symbol("ZodOutput");
+var $input = /* @__PURE__ */ Symbol("ZodInput");
 var $ZodRegistry = class {
   constructor() {
     this._map = /* @__PURE__ */ new WeakMap();
@@ -16275,13 +16275,16 @@ function cloneList(values) {
 }
 
 // packages/guardian-cli/src/runtime.ts
-var GUARDIAN_CLI_VERSION = "0.1.2";
+var GUARDIAN_CLI_VERSION = "0.1.4";
 var GUARDIAN_PROFILE_SCHEMA_VERSION = "contextecf/project-guardian-profile/v1";
 var GUARDIAN_NPM_PACKAGE_NAME = "@contextecf/guardian-cli";
+var GUARDIAN_NPM_REGISTRY = "https://registry.npmjs.org/";
 var GUARDIAN_GLOBAL_INSTALL_COMMAND = `npm install -g ${GUARDIAN_NPM_PACKAGE_NAME}`;
 var GUARDIAN_NPX_SETUP_COMMAND = `npx ${GUARDIAN_NPM_PACKAGE_NAME}@latest setup`;
 var GUARDIAN_FIRST_RUN_COMMAND = "guardian setup";
-var GUARDIAN_OPEN_CONTROL_TOWER_COMMAND = "guardian launch";
+var GUARDIAN_OPEN_CONTROL_TOWER_COMMAND = "guardian open";
+var GUARDIAN_RELEASE_DISPATCH_WORKFLOW = "guardian-release-dispatch.yml";
+var GUARDIAN_RELEASE_REPOSITORY = "Intelligent-Context-AI-Inc/ContextECF-GITHUB";
 var GUARDIAN_CONTROL_TOWER_URL_ENV = "GUARDIAN_CONTROL_TOWER_URL";
 var GUARDIAN_DEFAULT_CONTROL_TOWER_URL = "http://127.0.0.1:4317/control-tower";
 var GUARDIAN_LOCAL_DATA_ENCRYPTION_KEY_ENV = "GUARDIAN_LOCAL_DATA_ENCRYPTION_KEY";
@@ -16708,28 +16711,6 @@ var GUARDIAN_NOT_PROVEN_PRODUCTION_GATES = [
       "Release evidence includes artifact digests without signing secrets."
     ]
   },
-  {
-    id: "browser-store-distribution",
-    label: "Browser store distribution",
-    boundary: "Pending store submission, review, and release evidence.",
-    owner: "browser-release",
-    runtimeBoundary: "Pending store submission, review, and release evidence.",
-    releaseBoundary: "Browser store approval and listing evidence are not yet proven.",
-    evidencePacket: "browser-store-distribution",
-    evidenceRequiredFields: [
-      "stores",
-      "submitted_versions",
-      "review_status",
-      "package_digest_matches_release",
-      "listing_boundary_proof"
-    ],
-    closesWhen: [
-      "Chrome Web Store package id, version, and approval state are recorded.",
-      "Any claimed Edge or Firefox store distribution has matching approval evidence.",
-      "Store package digest matches the validated MV3 release artifact.",
-      "Store listing text uses the same proven/not-proven boundary."
-    ]
-  },
   {
     id: "high-risk-desktop-action-execution",
     label: "High-risk desktop action execution after authorization",
@@ -16810,19 +16791,26 @@ No global install:
 
 Open Control Tower:
   ${GUARDIAN_OPEN_CONTROL_TOWER_COMMAND}
-  aliases: guardian tower, guardian control-tower
+  start aliases: guardian launch, guardian tower, guardian control-tower
 
 Usage:
   guardian --version
   guardian version [--json]
-  guardian setup [--json] [--print] [--host=127.0.0.1] [--port=4317] [--no-launch] [--no-mcp] [--extension-id=<chrome-extension-id>]
+  guardian setup [--json] [--open] [--print] [--host=127.0.0.1] [--port=4317] [--no-launch] [--no-mcp] [--extension-id=<chrome-extension-id>]
   guardian install [--json]
   guardian doctor [--json]
   guardian readiness [--json] [--strict]
+  guardian release checklist --version=<semver> [--json]
+  guardian release flow --version=<semver> [--json]
+  guardian release verify --version=<semver> [--json]
+  guardian release paste --version=<semver> [--json]
+  guardian release command --version=<semver> [--publish|--dry-run=false] [--channels=all|npm|browser|evidence] [--run-docker-smoke=true|false] [--json]
+  guardian release secrets [--json]
+  guardian release browser-store [--json]
   guardian open [--json] [--print] [--url=http://127.0.0.1:<port>]
   guardian status [--json]
   guardian start [--json] [--host=127.0.0.1] [--port=4317]
-  guardian launch|tower|control-tower [--json] [--print] [--host=127.0.0.1] [--port=4317]
+  guardian launch|tower|control-tower [--json] [--open] [--print] [--host=127.0.0.1] [--port=4317]
   guardian stop [--json] [--url=http://127.0.0.1:<port>/control-tower]
   guardian service install [--json] [--platform=auto|launchd|systemd|windows-task-scheduler] [--force]
   guardian service status [--json]
@@ -16895,6 +16883,8 @@ async function runGuardianCli(argv, options = {}) {
       write(stdout, renderGuardianProductionReadiness(readiness, flags));
       return flags.has("strict") && (readiness.npmPreview.status !== "ready" || readiness.fullProduction.status !== "ready") ? 1 : 0;
     }
+    case "release":
+      return runReleaseCommand(argv.slice(1), flags, options);
     case "open":
       return runControlTowerOpenCommand(flags, options);
     case "status":
@@ -17048,7 +17038,7 @@ async function installGuardian(flags, options = {}) {
     `First run: ${GUARDIAN_FIRST_RUN_COMMAND}`,
     `Open Control Tower: ${GUARDIAN_OPEN_CONTROL_TOWER_COMMAND}`,
     `No global install: ${GUARDIAN_NPX_SETUP_COMMAND}`,
-    "Next: guardian setup; guardian doctor; guardian readiness; guardian launch; guardian mcp install; guardian extension open-setup; guardian daemon pair --json; guardian extension native-host install --extension-id=<browser-extension-id>"
+    "Next: guardian setup; guardian doctor; guardian readiness; guardian launch; guardian open; guardian mcp install; guardian extension open-setup; guardian daemon pair --json; guardian extension native-host install --extension-id=<browser-extension-id>"
   ].join("\n")}
 `;
 }
@@ -17095,7 +17085,7 @@ async function runSetupCommand(flags, options) {
       ["json", true],
       ...copyStringFlags(flags, ["host", "port"])
     ]);
-    if (flags.has("print")) {
+    if (!flags.has("open") || flags.has("print")) {
       launchFlags.set("print", true);
     }
     const launchExitCode = await runLaunchCommand(launchFlags, {
@@ -17174,6 +17164,7 @@ async function runSetupCommand(flags, options) {
     nextCommands: [
       "guardian status",
       "guardian readiness",
+      "guardian open",
       "guardian policy list",
       "guardian posture list",
       "guardian preferences show",
@@ -17251,10 +17242,761 @@ async function buildGuardianProductionReadinessStatus(home, profile, env = proce
       productionGateEvidenceStatus: protectedEvidence.productionGateEvidence?.status ?? "not_recorded",
       productionGateEvidencePath: protectedEvidence.productionGateEvidence?.evidencePath
     },
+    distribution: buildGuardianDistributionReadiness(npmPreviewReady),
+    tokenPrinted: false,
+    rawContentIncluded: false
+  };
+}
+function buildGuardianDistributionReadiness(npmPreviewReady) {
+  return {
+    status: npmPreviewReady ? "preview_install_ready" : "setup_or_release_evidence_required",
+    oneLineInstallCommand: GUARDIAN_GLOBAL_INSTALL_COMMAND,
+    oneLineTryCommand: GUARDIAN_NPX_SETUP_COMMAND,
+    openControlTowerCommand: GUARDIAN_OPEN_CONTROL_TOWER_COMMAND,
+    localUserCommands: {
+      setup: GUARDIAN_FIRST_RUN_COMMAND,
+      launch: "guardian launch",
+      open: "guardian open",
+      status: "guardian status",
+      readiness: "guardian readiness"
+    },
+    aiToolIntegration: {
+      mcpInstallCommand: "guardian mcp install --client=all --write",
+      browserSetupCommand: "guardian extension open-setup",
+      nativeHostInstallCommand: "guardian extension native-host install --extension-id=<browser-extension-id>"
+    },
+    browserStoreHandoff: {
+      status: npmPreviewReady ? "operator_handoff_ready_not_submitted" : "blocked_until_preview_ready",
+      submissionPackCommand: "npm run guardian:browser-store:submission-pack",
+      closeoutChecklistPath: "release/evidence/guardian-browser-store-submission-pack/browser-store-closeout-checklist.json",
+      productionGateStatus: "not_proven"
+    },
+    enterpriseDeployment: {
+      status: "managed_rollout_ready_for_customer_pack",
+      note: "Use enterprise policy packs, managed browser deployment, and customer evidence as a separate company or school-district rollout lane; it does not prove public browser-store distribution."
+    },
+    releaseAutomation: {
+      workflow: GUARDIAN_RELEASE_DISPATCH_WORKFLOW,
+      dryRunCommand: buildGuardianReleaseDispatchCommand(true),
+      publishCommand: buildGuardianReleaseDispatchCommand(false),
+      requiredPublishCredentialName: "NPM_TOKEN",
+      channels: ["all", "npm", "browser", "evidence"],
+      defaultDockerSmoke: true,
+      provenance: "github_actions_oidc_supported",
+      status: npmPreviewReady ? "ready_for_dispatch_after_preview_evidence" : "blocked_until_preview_release_evidence_passes",
+      boundaries: [
+        "Use dry_run=true before public publication.",
+        "dry_run=false requires the repository secret NPM_TOKEN and must not print npm tokens, OTP values, or .npmrc contents.",
+        "The workflow can publish the npm preview package, upload evidence, and run public install smokes; it does not sign native installers or approve future browser-store listings.",
+        "GitHub Actions OIDC/provenance applies to CI release context; manual local publishes are recorded separately and should not claim CI provenance."
+      ]
+    },
+    boundaries: [
+      "One-line npm install and Control Tower launch prove preview distribution only.",
+      "Chrome Web Store distribution is proven for the evidenced ContextECF Halo listing; future store submissions still require fresh official review evidence.",
+      "Enterprise managed deployment can support company or school-district rollout but remains a separate rollout lane.",
+      "MCP and browser setup commands must not print runtime tokens, raw prompts, raw responses, source archives, source maps, credentials, or private policy packs."
+    ]
+  };
+}
+function buildGuardianReleaseDispatchCommand(dryRun) {
+  return buildGuardianReleaseDispatchCommandFor({
+    dryRun,
+    releaseVersion: "<version>",
+    channels: "all",
+    runDockerSmoke: true
+  });
+}
+function buildGuardianReleaseDispatchCommandFor(input) {
+  return [
+    `gh workflow run ${GUARDIAN_RELEASE_DISPATCH_WORKFLOW} \\`,
+    `  -f release_version=${input.releaseVersion} \\`,
+    `  -f channels=${input.channels} \\`,
+    `  -f dry_run=${input.dryRun ? "true" : "false"} \\`,
+    `  -f run_docker_smoke=${input.runDockerSmoke ? "true" : "false"}`
+  ].join("\n");
+}
+async function runReleaseCommand(argv, flags, options) {
+  const subcommand = argv[0];
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  if (!subcommand || subcommand === "help" || subcommand === "quickstart") {
+    write(stdout, renderGuardianReleaseHelp(buildGuardianReleaseHelp(), flags));
+    return 0;
+  }
+  if (subcommand === "browser-store" || subcommand === "browser-store-handoff" || subcommand === "store") {
+    write(
+      stdout,
+      renderGuardianBrowserStoreHandoffCommand(
+        buildGuardianBrowserStoreHandoffCommandResult(),
+        flags
+      )
+    );
+    return 0;
+  }
+  if (subcommand === "secrets" || subcommand === "secret-setup" || subcommand === "npm-token") {
+    write(stdout, renderGuardianReleaseSecretSetup(buildGuardianReleaseSecretSetup(), flags));
+    return 0;
+  }
+  if (subcommand === "checklist" || subcommand === "plan") {
+    const releaseVersion2 = stringFlag(flags, "version") ?? stringFlag(flags, "release-version");
+    if (!releaseVersion2) {
+      write(
+        stderr,
+        "Missing release version. Usage: guardian release checklist --version=<semver>\n"
+      );
+      return 1;
+    }
+    if (!isValidReleaseVersion(releaseVersion2)) {
+      write(stderr, "Invalid --version. Expected a semver value like 0.1.4 or 0.1.4-beta.1.\n");
+      return 1;
+    }
+    write(
+      stdout,
+      renderGuardianReleaseChecklist(buildGuardianReleaseChecklist(releaseVersion2), flags)
+    );
+    return 0;
+  }
+  if (subcommand === "flow" || subcommand === "train" || subcommand === "next") {
+    const releaseVersion2 = stringFlag(flags, "version") ?? stringFlag(flags, "release-version");
+    if (!releaseVersion2) {
+      write(stderr, "Missing release version. Usage: guardian release flow --version=<semver>\n");
+      return 1;
+    }
+    if (!isValidReleaseVersion(releaseVersion2)) {
+      write(stderr, "Invalid --version. Expected a semver value like 0.1.4 or 0.1.4-beta.1.\n");
+      return 1;
+    }
+    write(stdout, renderGuardianReleaseFlow(buildGuardianReleaseFlow(releaseVersion2), flags));
+    return 0;
+  }
+  if (subcommand === "verify" || subcommand === "post-release") {
+    const releaseVersion2 = stringFlag(flags, "version") ?? stringFlag(flags, "release-version");
+    if (!releaseVersion2) {
+      write(stderr, "Missing release version. Usage: guardian release verify --version=<semver>\n");
+      return 1;
+    }
+    if (!isValidReleaseVersion(releaseVersion2)) {
+      write(stderr, "Invalid --version. Expected a semver value like 0.1.4 or 0.1.4-beta.1.\n");
+      return 1;
+    }
+    write(stdout, renderGuardianReleaseVerify(buildGuardianReleaseVerify(releaseVersion2), flags));
+    return 0;
+  }
+  if (subcommand === "paste" || subcommand === "smoke" || subcommand === "install-smoke") {
+    const releaseVersion2 = stringFlag(flags, "version") ?? stringFlag(flags, "release-version");
+    if (!releaseVersion2) {
+      write(stderr, "Missing release version. Usage: guardian release paste --version=<semver>\n");
+      return 1;
+    }
+    if (!isValidReleaseVersion(releaseVersion2)) {
+      write(stderr, "Invalid --version. Expected a semver value like 0.1.4 or 0.1.4-beta.1.\n");
+      return 1;
+    }
+    write(stdout, renderGuardianReleasePaste(buildGuardianReleasePaste(releaseVersion2), flags));
+    return 0;
+  }
+  if (subcommand !== "command" && subcommand !== "dispatch") {
+    write(stderr, `Unknown Guardian release command: ${subcommand}
+`);
+    return 1;
+  }
+  const releaseVersion = stringFlag(flags, "version") ?? stringFlag(flags, "release-version");
+  if (!releaseVersion) {
+    write(
+      stderr,
+      "Missing release version. Usage: guardian release command --version=<semver> [--publish|--dry-run=false]\n"
+    );
+    return 1;
+  }
+  if (!isValidReleaseVersion(releaseVersion)) {
+    write(stderr, "Invalid --version. Expected a semver value like 0.1.4 or 0.1.4-beta.1.\n");
+    return 1;
+  }
+  const channels = stringFlag(flags, "channels") ?? "all";
+  if (!isValidReleaseChannels(channels)) {
+    write(stderr, "Invalid --channels. Expected one of: all, npm, browser, evidence.\n");
+    return 1;
+  }
+  const dryRun = flags.has("publish") ? false : booleanFlag(flags, "dry-run", true);
+  const runDockerSmoke = booleanFlag(flags, "run-docker-smoke", true);
+  const result = buildGuardianReleaseDispatchCommandResult({
+    releaseVersion,
+    channels,
+    dryRun,
+    runDockerSmoke
+  });
+  write(stdout, renderGuardianReleaseDispatchCommand(result, flags));
+  return 0;
+}
+function buildGuardianReleaseHelp() {
+  return {
+    schema_version: "contextecf/project-guardian-release-help/v1",
+    cli_version: GUARDIAN_CLI_VERSION,
+    repository: GUARDIAN_RELEASE_REPOSITORY,
+    status: "release_owner_quickstart",
+    commands: {
+      checklist: "guardian release checklist --version=<version>",
+      flow: "guardian release flow --version=<version>",
+      secrets: "guardian release secrets",
+      dryRunDispatch: "guardian release command --version=<version>",
+      publishDispatch: "guardian release command --version=<version> --publish",
+      verifyPublishedVersion: "guardian release verify --version=<version>",
+      pasteLocalSmoke: "guardian release paste --version=<version>",
+      browserStoreHandoff: "guardian release browser-store",
+      readiness: "guardian readiness"
+    },
+    suggestedOrder: [
+      "Run the checklist for the target version.",
+      "Set or verify the repository publish credential if this is a public npm release.",
+      "Run the dry-run dispatch before any publish dispatch.",
+      "Run the publish dispatch only after dry-run evidence passes.",
+      "Verify the published version and refresh release evidence.",
+      "Use browser-store handoff only for submission/review evidence; it does not upload or approve listings."
+    ],
+    boundaries: [
+      "Release quickstart output is operator guidance only, not release evidence or production-gate proof.",
+      "Do not paste npm tokens, OTP values, .npmrc contents, signing keys, browser-store credentials, raw prompts, raw responses, private policy packs, or customer content into release commands, chat, PR bodies, or evidence.",
+      "Public npm preview publication does not close signed-installer, browser-store, high-risk desktop action, or autonomous local app execution production gates.",
+      "Full production claims remain blocked until every not-proven production gate has real validated external evidence."
+    ],
+    tokenPrinted: false,
+    rawContentIncluded: false
+  };
+}
+function renderGuardianReleaseHelp(result, flags) {
+  if (flags.has("json")) {
+    return `${JSON.stringify(result, null, 2)}
+`;
+  }
+  return `${[
+    "Project Guardian Release Quickstart",
+    `Repository: ${result.repository}`,
+    `Status: ${result.status}`,
+    "Commands:",
+    `- Checklist: ${result.commands.checklist}`,
+    `- Flow: ${result.commands.flow}`,
+    `- Secrets: ${result.commands.secrets}`,
+    `- Dry run: ${result.commands.dryRunDispatch}`,
+    `- Publish: ${result.commands.publishDispatch}`,
+    `- Verify published version: ${result.commands.verifyPublishedVersion}`,
+    `- Copy-paste local smoke: ${result.commands.pasteLocalSmoke}`,
+    `- Browser-store handoff: ${result.commands.browserStoreHandoff}`,
+    `- Readiness: ${result.commands.readiness}`,
+    "Suggested order:",
+    ...result.suggestedOrder.map((step, index) => `${index + 1}. ${step}`),
+    "Boundaries:",
+    ...result.boundaries.map((boundary) => `- ${boundary}`),
+    "Token printed: no"
+  ].join("\n")}
+`;
+}
+function buildGuardianReleaseDispatchCommandResult(input) {
+  return {
+    schema_version: "contextecf/project-guardian-release-dispatch-command/v1",
+    cli_version: GUARDIAN_CLI_VERSION,
+    workflow: GUARDIAN_RELEASE_DISPATCH_WORKFLOW,
+    releaseVersion: input.releaseVersion,
+    channels: input.channels,
+    dryRun: input.dryRun,
+    runDockerSmoke: input.runDockerSmoke,
+    command: buildGuardianReleaseDispatchCommandFor(input),
+    ...input.dryRun ? {} : { requiredPublishCredentialName: "NPM_TOKEN" },
+    provenance: "github_actions_oidc_supported",
+    boundaries: [
+      "Use dry_run=true before public publication.",
+      "dry_run=false requires the repository secret NPM_TOKEN and must not print npm tokens, OTP values, or .npmrc contents.",
+      "This dispatch can publish the npm preview package, upload evidence, and run public install smokes; it does not sign native installers or approve future browser-store listings.",
+      "A release-dispatch command is operator guidance, not production-gate proof."
+    ],
+    tokenPrinted: false,
+    rawContentIncluded: false
+  };
+}
+function renderGuardianReleaseDispatchCommand(result, flags) {
+  if (flags.has("json")) {
+    return `${JSON.stringify(result, null, 2)}
+`;
+  }
+  return `${[
+    "Project Guardian Release Dispatch Command",
+    `Release: ${result.releaseVersion}`,
+    `Mode: ${result.dryRun ? "dry run" : "publish"}`,
+    `Workflow: ${result.workflow}`,
+    `Channels: ${result.channels}`,
+    `Docker smoke: ${result.runDockerSmoke ? "yes" : "no"}`,
+    result.requiredPublishCredentialName ? `Required repository secret: ${result.requiredPublishCredentialName}` : "Required repository secret: not needed for dry run",
+    "Command:",
+    result.command,
+    "Boundaries:",
+    ...result.boundaries.map((boundary) => `- ${boundary}`),
+    "Token printed: no"
+  ].join("\n")}
+`;
+}
+function buildGuardianBrowserStoreHandoffCommandResult() {
+  return {
+    schema_version: "contextecf/project-guardian-browser-store-handoff-command/v1",
+    cli_version: GUARDIAN_CLI_VERSION,
+    status: "chrome_distribution_proven_next_submission_pack_ready",
+    primaryStore: "chrome_web_store",
+    productionGate: {
+      id: "browser-store-distribution",
+      status: "proven",
+      nextSubmissionRequiresFreshOfficialReviewEvidence: true
+    },
+    commands: {
+      submissionPack: "npm run guardian:browser-store:submission-pack -- --json --output-dir release/evidence/guardian-browser-store-submission-pack",
+      preSubmissionSmoke: "GUARDIAN_BROWSER_STORE_SMOKE_WORKSPACE=/tmp/guardian-browser-store-pre-submission-smoke bash release/evidence/guardian-browser-store-submission-pack/run-pre-submission-readiness-smoke.sh",
+      preSubmissionReadiness: [
+        "npm run guardian:browser-store:readiness:collect -- \\",
+        "  --package artifacts/guardian-browser-store/guardian-browser-extension-<version>.zip \\",
+        "  --assert-pre-submission-only \\",
+        "  --assert-mv3-validation-passed \\",
+        "  --assert-source-archive-excluded \\",
+        "  --assert-store-credentials-excluded \\",
+        "  --output release/evidence/guardian-browser-store-submission-pack/pre-submission-readiness.json"
+      ].join("\n"),
+      reviewPreflightAfterApproval: [
+        "npm run guardian:browser-store:review-preflight -- \\",
+        "  --store-evidence release/evidence/guardian-browser-store-submission-pack/browser-store-evidence-input.json \\",
+        "  --assert-metadata-only \\",
+        "  --assert-no-store-credentials \\",
+        "  --assert-approved-review-status \\",
+        "  --assert-public-listing-url \\",
+        "  --output release/evidence/guardian-browser-store-submission-pack/browser-store-review-preflight.json"
+      ].join("\n"),
+      collectorAfterApproval: [
+        "npm run guardian:production-gates:collect:browser-store -- \\",
+        "  --store-evidence release/evidence/guardian-browser-store-submission-pack/browser-store-evidence-input.json \\",
+        "  --review-preflight-summary release/evidence/guardian-browser-store-submission-pack/browser-store-review-preflight.json \\",
+        "  --assert-no-source-archives \\",
+        "  --assert-package-digest-matches-release \\",
+        "  --assert-listing-matches-release-boundary \\",
+        "  --assert-listing-names-not-proven-gates \\",
+        "  --assert-production-claim-absent \\",
+        "  --output release/evidence/guardian-production-gates/browser-store-distribution.json"
+      ].join("\n"),
+      finalGateValidation: "npm run validate:guardian-production-gates -- --claim production"
+    },
+    evidence: {
+      submissionPackDir: "release/evidence/guardian-browser-store-submission-pack",
+      closeoutChecklistPath: "release/evidence/guardian-browser-store-submission-pack/browser-store-closeout-checklist.json",
+      preSubmissionChecklistPath: "docs/project-guardian/browser-store-pre-submission-checklist.md",
+      readinessOutput: "release/evidence/guardian-browser-store-submission-pack/pre-submission-readiness.json",
+      reviewPreflightOutput: "release/evidence/guardian-browser-store-submission-pack/browser-store-review-preflight.json",
+      productionGatePacket: "release/evidence/guardian-production-gates/browser-store-distribution.json"
+    },
+    boundaries: [
+      "This command surface prepares browser-store submission handoff for future extension versions; it does not upload, submit, approve, or distribute the extension.",
+      "Chrome Web Store distribution is proven for the evidenced ContextECF Halo listing; each future extension package still needs fresh review/submission evidence before updating that proof.",
+      "Do not place browser-store credentials, dashboard cookies, source archives, source maps, runtime tokens, private policy packs, raw prompts, raw responses, or customer content in browser-store evidence.",
+      "Enterprise managed browser deployment is a separate customer rollout lane and does not replace public store review evidence for public listings."
+    ],
+    tokenPrinted: false,
+    rawContentIncluded: false
+  };
+}
+function renderGuardianBrowserStoreHandoffCommand(result, flags) {
+  if (flags.has("json")) {
+    return `${JSON.stringify(result, null, 2)}
+`;
+  }
+  return `${[
+    "Project Guardian Browser Store Handoff",
+    `Status: ${result.status}`,
+    `Primary store: ${result.primaryStore}`,
+    `Production gate: ${result.productionGate.id} (${result.productionGate.status})`,
+    "1. Build submission pack:",
+    result.commands.submissionPack,
+    "2. Run pre-submission smoke:",
+    result.commands.preSubmissionSmoke,
+    "3. Record pre-submission readiness:",
+    result.commands.preSubmissionReadiness,
+    "4. After official approval, run review preflight:",
+    result.commands.reviewPreflightAfterApproval,
+    "5. After official approval, collect production-gate evidence:",
+    result.commands.collectorAfterApproval,
+    `Closeout checklist: ${result.evidence.closeoutChecklistPath}`,
+    `Pre-submission checklist: ${result.evidence.preSubmissionChecklistPath}`,
+    "Boundaries:",
+    ...result.boundaries.map((boundary) => `- ${boundary}`),
+    "Token printed: no"
+  ].join("\n")}
+`;
+}
+function buildGuardianReleaseSecretSetup() {
+  return {
+    schema_version: "contextecf/project-guardian-release-secret-setup/v1",
+    cli_version: GUARDIAN_CLI_VERSION,
+    repository: GUARDIAN_RELEASE_REPOSITORY,
+    requiredForPublish: "NPM_TOKEN",
+    githubActionsSecretUrl: `https://github.com/${GUARDIAN_RELEASE_REPOSITORY}/settings/secrets/actions/new`,
+    commands: {
+      setNpmToken: `gh secret set NPM_TOKEN --repo ${GUARDIAN_RELEASE_REPOSITORY} --app actions`,
+      verifyNpmTokenPresence: `gh secret list --repo ${GUARDIAN_RELEASE_REPOSITORY} --app actions | rg '^NPM_TOKEN\\b'`,
+      dryRunDispatch: buildGuardianReleaseDispatchCommandFor({
+        dryRun: true,
+        releaseVersion: "<version>",
+        channels: "all",
+        runDockerSmoke: true
+      }),
+      publishDispatch: buildGuardianReleaseDispatchCommandFor({
+        dryRun: false,
+        releaseVersion: "<version>",
+        channels: "all",
+        runDockerSmoke: true
+      })
+    },
+    boundaries: [
+      "NPM_TOKEN belongs only in GitHub Actions repository secrets for guarded dry_run=false npm publication.",
+      "Do not paste npm tokens, OTP values, .npmrc contents, signing keys, browser-store credentials, raw prompts, raw responses, private policy packs, or customer content into chat, PR bodies, release evidence, or CLI output.",
+      "Use dry_run=true before dry_run=false; dry-run dispatch does not require NPM_TOKEN.",
+      "Adding NPM_TOKEN enables the npm preview publish lane only; it does not close signed-installer, browser-store, high-risk desktop, or autonomous app production gates."
+    ],
+    tokenPrinted: false,
+    rawContentIncluded: false
+  };
+}
+function renderGuardianReleaseSecretSetup(result, flags) {
+  if (flags.has("json")) {
+    return `${JSON.stringify(result, null, 2)}
+`;
+  }
+  return `${[
+    "Project Guardian Release Secret Setup",
+    `Repository: ${result.repository}`,
+    `Required for publish: ${result.requiredForPublish}`,
+    `GitHub Actions secret page: ${result.githubActionsSecretUrl}`,
+    "Set secret:",
+    result.commands.setNpmToken,
+    "Verify secret presence:",
+    result.commands.verifyNpmTokenPresence,
+    "Dry-run release command:",
+    result.commands.dryRunDispatch,
+    "Publish release command:",
+    result.commands.publishDispatch,
+    "Boundaries:",
+    ...result.boundaries.map((boundary) => `- ${boundary}`),
+    "Token printed: no"
+  ].join("\n")}
+`;
+}
+function buildGuardianReleaseChecklist(releaseVersion) {
+  return {
+    schema_version: "contextecf/project-guardian-release-checklist/v1",
+    cli_version: GUARDIAN_CLI_VERSION,
+    releaseVersion,
+    repository: GUARDIAN_RELEASE_REPOSITORY,
+    status: "preview_release_operator_ready_full_production_blocked",
+    operatorCommands: {
+      secretSetup: "guardian release secrets",
+      dryRunDispatch: buildGuardianReleaseDispatchCommandFor({
+        dryRun: true,
+        releaseVersion,
+        channels: "all",
+        runDockerSmoke: true
+      }),
+      publishDispatch: buildGuardianReleaseDispatchCommandFor({
+        dryRun: false,
+        releaseVersion,
+        channels: "all",
+        runDockerSmoke: true
+      }),
+      browserStoreHandoff: "guardian release browser-store",
+      readiness: "guardian readiness"
+    },
+    requiredRepositoryCredentialName: "NPM_TOKEN",
+    evidenceOutputs: [
+      "release/evidence/guardian-release-dispatch-summary.json",
+      "release/evidence/guardian-npm-publish-execution-summary.json",
+      "release/evidence/guardian-npm-publish-status-verification.json",
+      "release/evidence/guardian-browser-store-submission-pack/browser-store-closeout-checklist.json",
+      "release/evidence/guardian-finish-line-status.json"
+    ],
+    notProvenProductionGates: GUARDIAN_NOT_PROVEN_PRODUCTION_GATES.map((gate) => ({
+      id: gate.id,
+      label: gate.label,
+      owner: gate.owner,
+      releaseBoundary: gate.releaseBoundary
+    })),
+    boundaries: [
+      "This checklist is an operator command surface for Guardian preview releases; it is not production-gate proof.",
+      "Run the dry-run dispatch before any dry_run=false publish dispatch.",
+      "dry_run=false requires NPM_TOKEN in GitHub Actions repository secrets and must not print npm tokens, OTP values, or .npmrc contents.",
+      "The checklist does not sign native installers, submit browser-store packages, execute high-risk desktop actions, or enable autonomous local app execution.",
+      "Full production claims remain blocked until every not-proven production gate has real validated external evidence."
+    ],
+    tokenPrinted: false,
+    rawContentIncluded: false
+  };
+}
+function buildGuardianReleaseFlow(releaseVersion) {
+  const checklist = buildGuardianReleaseChecklist(releaseVersion);
+  const verify = buildGuardianReleaseVerify(releaseVersion);
+  const dryRunDispatch = buildGuardianReleaseDispatchCommandFor({
+    dryRun: true,
+    releaseVersion,
+    channels: "all",
+    runDockerSmoke: true
+  });
+  const publishDispatch = buildGuardianReleaseDispatchCommandFor({
+    dryRun: false,
+    releaseVersion,
+    channels: "all",
+    runDockerSmoke: true
+  });
+  return {
+    schema_version: "contextecf/project-guardian-release-flow/v1",
+    cli_version: GUARDIAN_CLI_VERSION,
+    releaseVersion,
+    repository: GUARDIAN_RELEASE_REPOSITORY,
+    status: "release_owner_flow_ready_full_production_blocked",
+    steps: [
+      {
+        id: "review-checklist",
+        label: "Review the release checklist",
+        command: `guardian release checklist --version=${releaseVersion}`,
+        credentialRequired: false
+      },
+      {
+        id: "verify-secrets",
+        label: "Verify npm publish secret setup",
+        command: "guardian release secrets",
+        credentialRequired: false
+      },
+      {
+        id: "dry-run-dispatch",
+        label: "Run the GitHub Actions dry run",
+        command: dryRunDispatch,
+        credentialRequired: false
+      },
+      {
+        id: "publish-dispatch",
+        label: "Run the guarded publish dispatch after dry-run evidence passes",
+        command: publishDispatch,
+        credentialRequired: true
+      },
+      {
+        id: "verify-public-release",
+        label: "Verify the published package and local install smoke",
+        command: `guardian release verify --version=${releaseVersion}`,
+        credentialRequired: false
+      },
+      {
+        id: "copy-paste-local-smoke",
+        label: "Copy-paste the local end-user smoke block",
+        command: `guardian release paste --version=${releaseVersion}`,
+        credentialRequired: false
+      },
+      {
+        id: "browser-store-handoff",
+        label: "Prepare browser-store submission handoff",
+        command: "guardian release browser-store",
+        credentialRequired: false
+      }
+    ],
+    copyPasteLocalSmoke: verify.commands.copyPasteLocalSmoke,
+    evidenceOutputs: Array.from(
+      /* @__PURE__ */ new Set([
+        ...checklist.evidenceOutputs,
+        ...verify.evidenceOutputs,
+        "release/evidence/guardian-browser-store-submission-pack/browser-store-closeout-checklist.json"
+      ])
+    ),
+    notProvenProductionGates: checklist.notProvenProductionGates.map((gate) => ({
+      id: gate.id,
+      label: gate.label,
+      releaseBoundary: gate.releaseBoundary
+    })),
+    boundaries: [
+      "This release flow is copy-paste operator guidance only; it is not release evidence or production-gate proof.",
+      "Publish dispatch requires NPM_TOKEN in GitHub Actions repository secrets and must not print npm tokens, OTP values, or .npmrc contents.",
+      "Run the dry-run dispatch before the guarded dry_run=false publish dispatch.",
+      "Public npm preview publication and local install smoke prove the CLI preview lane only.",
+      "Signed native installers, high-risk desktop action execution, and autonomous local app execution remain separate not-proven production gates until real external evidence is collected and validated."
+    ],
+    tokenPrinted: false,
+    rawContentIncluded: false
+  };
+}
+function renderGuardianReleaseFlow(result, flags) {
+  if (flags.has("json")) {
+    return `${JSON.stringify(result, null, 2)}
+`;
+  }
+  const lines = [
+    "Project Guardian Release Flow",
+    `Release: ${result.releaseVersion}`,
+    `Repository: ${result.repository}`,
+    `Status: ${result.status}`,
+    "Steps:",
+    ...result.steps.flatMap((step, index) => [
+      `${index + 1}. ${step.label}${step.credentialRequired ? " (requires NPM_TOKEN secret)" : ""}:`,
+      step.command
+    ]),
+    "Post-publish copy-paste local smoke:",
+    result.copyPasteLocalSmoke,
+    "Evidence outputs:",
+    ...result.evidenceOutputs.map((output) => `- ${output}`),
+    "Not-proven production gates:",
+    ...result.notProvenProductionGates.map(
+      (gate) => `- ${gate.label}: ${gate.releaseBoundary ?? "not proven"}`
+    ),
+    "Boundaries:",
+    ...result.boundaries.map((boundary) => `- ${boundary}`),
+    "Token printed: no"
+  ];
+  return `${lines.join("\n")}
+`;
+}
+function renderGuardianReleaseChecklist(result, flags) {
+  if (flags.has("json")) {
+    return `${JSON.stringify(result, null, 2)}
+`;
+  }
+  return `${[
+    "Project Guardian Release Checklist",
+    `Release: ${result.releaseVersion}`,
+    `Repository: ${result.repository}`,
+    `Status: ${result.status}`,
+    `Required repository credential: ${result.requiredRepositoryCredentialName}`,
+    "1. Secret setup:",
+    result.operatorCommands.secretSetup,
+    "2. Dry-run dispatch:",
+    result.operatorCommands.dryRunDispatch,
+    "3. Publish dispatch:",
+    result.operatorCommands.publishDispatch,
+    "4. Browser-store handoff:",
+    result.operatorCommands.browserStoreHandoff,
+    "5. Readiness check:",
+    result.operatorCommands.readiness,
+    "Evidence outputs:",
+    ...result.evidenceOutputs.map((output) => `- ${output}`),
+    "Not-proven production gates:",
+    ...result.notProvenProductionGates.map(
+      (gate) => `- ${gate.label}: ${gate.releaseBoundary ?? "not proven"}`
+    ),
+    "Boundaries:",
+    ...result.boundaries.map((boundary) => `- ${boundary}`),
+    "Token printed: no"
+  ].join("\n")}
+`;
+}
+function buildGuardianReleaseVerify(releaseVersion) {
+  const copyPasteLocalSmoke = buildGuardianReleasePaste(releaseVersion).command;
+  return {
+    schema_version: "contextecf/project-guardian-release-verify/v1",
+    cli_version: GUARDIAN_CLI_VERSION,
+    releaseVersion,
+    repository: GUARDIAN_RELEASE_REPOSITORY,
+    packageName: GUARDIAN_NPM_PACKAGE_NAME,
+    registry: GUARDIAN_NPM_REGISTRY,
+    status: "post_release_verification_required",
+    commands: {
+      registryVersion: `npm view ${GUARDIAN_NPM_PACKAGE_NAME}@${releaseVersion} version --registry=${GUARDIAN_NPM_REGISTRY}`,
+      publicInstall: `npm install -g ${GUARDIAN_NPM_PACKAGE_NAME}@${releaseVersion}`,
+      installedVersion: "guardian --version",
+      setup: "guardian setup",
+      launch: "guardian launch",
+      status: "guardian status",
+      openControlTower: "guardian open",
+      copyPasteLocalSmoke,
+      publishStatusVerification: "npm run guardian:npm:publish:verify-status -- --status release/evidence/guardian-npm-publish-status.json --assert-ready --verify-artifacts --output release/evidence/guardian-npm-publish-status-verification.json",
+      finishLineStatus: "npm run guardian:finish-line:status -- --npm-publish-status release/evidence/guardian-npm-publish-status.json --json --output release/evidence/guardian-finish-line-status.json"
+    },
+    evidenceOutputs: [
+      "release/evidence/guardian-npm-publish-status.json",
+      "release/evidence/guardian-npm-publish-status-verification.json",
+      "release/evidence/guardian-finish-line-status.json"
+    ],
+    boundaries: [
+      "This command surface verifies public preview release visibility and installability; it does not publish to npm.",
+      "Do not print npm tokens, OTP values, .npmrc contents, signing keys, browser-store credentials, raw prompts, raw responses, private policy packs, or customer content in release verification evidence.",
+      "A passing public npm install smoke proves the CLI preview lane only; signed installers, high-risk desktop action execution, and autonomous app execution remain separate production gates.",
+      "Full production claims remain blocked until every not-proven production gate has real validated external evidence."
+    ],
+    tokenPrinted: false,
+    rawContentIncluded: false
+  };
+}
+function buildGuardianReleasePaste(releaseVersion) {
+  const commands = [
+    `npm view ${GUARDIAN_NPM_PACKAGE_NAME}@${releaseVersion} version --registry=${GUARDIAN_NPM_REGISTRY}`,
+    `npm install -g ${GUARDIAN_NPM_PACKAGE_NAME}@${releaseVersion}`,
+    "guardian --version",
+    "guardian stop",
+    "guardian setup",
+    "guardian launch",
+    "guardian open",
+    "guardian status"
+  ];
+  return {
+    schema_version: "contextecf/project-guardian-release-paste/v1",
+    cli_version: GUARDIAN_CLI_VERSION,
+    releaseVersion,
+    packageName: GUARDIAN_NPM_PACKAGE_NAME,
+    registry: GUARDIAN_NPM_REGISTRY,
+    command: commands.join("\n"),
+    commands,
+    boundaries: [
+      "This paste block verifies public npm visibility, global install, first-run setup, daemon launch, Control Tower open, and status.",
+      "It does not publish to npm and must not include npm tokens, OTP values, .npmrc contents, signing keys, browser-store credentials, raw prompts, raw responses, private policy packs, or customer content.",
+      "guardian stop is included before setup so stale local daemons or local token mismatches are cleared before launch."
+    ],
     tokenPrinted: false,
     rawContentIncluded: false
   };
 }
+function renderGuardianReleasePaste(result, flags) {
+  if (flags.has("json")) {
+    return `${JSON.stringify(result, null, 2)}
+`;
+  }
+  return `${result.command}
+`;
+}
+function renderGuardianReleaseVerify(result, flags) {
+  if (flags.has("json")) {
+    return `${JSON.stringify(result, null, 2)}
+`;
+  }
+  return `${[
+    "Project Guardian Release Verification",
+    `Release: ${result.releaseVersion}`,
+    `Package: ${result.packageName}`,
+    `Registry: ${result.registry}`,
+    `Status: ${result.status}`,
+    "1. Confirm registry visibility:",
+    result.commands.registryVersion,
+    "2. Install the published version:",
+    result.commands.publicInstall,
+    "3. Confirm installed CLI version:",
+    result.commands.installedVersion,
+    "4. Run first-use smoke:",
+    result.commands.setup,
+    result.commands.launch,
+    result.commands.status,
+    result.commands.openControlTower,
+    "5. Copy-paste local smoke block:",
+    result.commands.copyPasteLocalSmoke,
+    "6. Verify release evidence:",
+    result.commands.publishStatusVerification,
+    result.commands.finishLineStatus,
+    "Evidence outputs:",
+    ...result.evidenceOutputs.map((output) => `- ${output}`),
+    "Boundaries:",
+    ...result.boundaries.map((boundary) => `- ${boundary}`),
+    "Token printed: no"
+  ].join("\n")}
+`;
+}
+function isValidReleaseVersion(value) {
+  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(value);
+}
+function isValidReleaseChannels(value) {
+  return ["all", "npm", "browser", "evidence"].includes(value);
+}
 function renderGuardianProductionReadiness(result, flags) {
   if (flags.has("json")) {
     return `${JSON.stringify(result, null, 2)}
@@ -17267,6 +18009,18 @@ function renderGuardianProductionReadiness(result, flags) {
     `Doctor: ${result.doctorOverall.toUpperCase()}`,
     `NPM preview install: ${result.npmPreview.status.toUpperCase()} - ${result.npmPreview.reason}`,
     result.npmPreview.publishCommand ? `NPM publish command: ${result.npmPreview.publishCommand}` : "NPM publish command: not available until publish dry-run evidence passes",
+    `Distribution: ${result.distribution.status}`,
+    `Install: ${result.distribution.oneLineInstallCommand}`,
+    `Try without global install: ${result.distribution.oneLineTryCommand}`,
+    `Open Control Tower: ${result.distribution.openControlTowerCommand}`,
+    `AI tool setup: ${result.distribution.aiToolIntegration.mcpInstallCommand}; ${result.distribution.aiToolIntegration.browserSetupCommand}`,
+    `Browser-store handoff: ${result.distribution.browserStoreHandoff.status}; gate ${result.distribution.browserStoreHandoff.productionGateStatus}`,
+    `Browser-store checklist: ${result.distribution.browserStoreHandoff.closeoutChecklistPath}`,
+    `Release workflow: ${result.distribution.releaseAutomation.workflow}; status=${result.distribution.releaseAutomation.status}`,
+    `Release dry run:
+${result.distribution.releaseAutomation.dryRunCommand}`,
+    `Release publish:
+${result.distribution.releaseAutomation.publishCommand}`,
     `Full production release: ${result.fullProduction.status.toUpperCase()} - ${result.fullProduction.reason}`,
     `Production gate evidence: ${result.fullProduction.productionGateEvidenceStatus}`,
     `Blocked production gates: ${result.fullProduction.blockedGateCount}`,
@@ -17286,6 +18040,19 @@ async function statusGuardian(flags, options) {
   const releaseEvidence = await buildGuardianReleaseEvidenceStatus(home);
   const serviceSupervision = await buildGuardianServiceSupervisionStatus(home);
   const osKeyStorage = await buildGuardianOsKeyStorageStatus(home);
+  const privacy = {
+    rawContentCaptureEnabled: profile?.privacy.raw_content_capture_enabled ?? false,
+    cloudSyncEnabled: profile?.privacy.cloud_sync_enabled ?? false,
+    localAppAutopilotEnabled: profile?.privacy.local_app_autopilot_enabled ?? false
+  };
+  const nextCommands = buildGuardianStatusNextCommands({
+    installed: profile !== void 0,
+    daemonStatus: daemonHealth.daemon.status
+  });
+  const daemonVersionMismatch = daemonHealth.daemon.status === "reachable" && daemonHealth.daemon.version !== void 0 && daemonHealth.daemon.version !== GUARDIAN_CLI_VERSION ? { cliVersion: GUARDIAN_CLI_VERSION, daemonVersion: daemonHealth.daemon.version } : null;
+  if (daemonVersionMismatch) {
+    nextCommands.push("guardian stop", "guardian launch");
+  }
   const result = {
     schema_version: "contextecf/project-guardian-status/v1",
     cli_version: GUARDIAN_CLI_VERSION,
@@ -17299,11 +18066,7 @@ async function statusGuardian(flags, options) {
     controlTowerUrl: daemonHealth.controlTowerUrl,
     controlTowerUrlSource: profile?.control_tower?.source ?? "default_loopback",
     daemon: daemonHealth.daemon,
-    privacy: {
-      rawContentCaptureEnabled: profile?.privacy.raw_content_capture_enabled ?? false,
-      cloudSyncEnabled: profile?.privacy.cloud_sync_enabled ?? false,
-      localAppAutopilotEnabled: profile?.privacy.local_app_autopilot_enabled ?? false
-    },
+    privacy,
     preferences: {
       promptCoachMode: profile?.prompt_coach_mode ?? "not_installed",
       learningGraphEnabled: profile?.learning_graph.enabled ?? false
@@ -17322,7 +18085,9 @@ async function statusGuardian(flags, options) {
     releaseEvidence,
     serviceSupervision,
     osKeyStorage,
-    notProvenProductionGates: GUARDIAN_NOT_PROVEN_PRODUCTION_GATES
+    notProvenProductionGates: GUARDIAN_NOT_PROVEN_PRODUCTION_GATES,
+    daemonVersionMismatch,
+    nextCommands
   };
   if (flags.has("json")) {
     return `${JSON.stringify(result, null, 2)}
@@ -17336,6 +18101,7 @@ async function statusGuardian(flags, options) {
     `Control Tower: ${result.controlTowerUrl ?? "not configured"}`,
     `Daemon health: ${result.daemon.status}${result.daemon.statusCode ? ` (HTTP ${result.daemon.statusCode})` : ""}`,
     result.daemon.error ? `Daemon detail: ${result.daemon.error}` : void 0,
+    result.daemonVersionMismatch ? `Daemon version: ${result.daemonVersionMismatch.daemonVersion} (this CLI is ${result.daemonVersionMismatch.cliVersion} \u2014 versions differ, likely because the CLI was reinstalled or changed version while this daemon kept running; run guardian stop && guardian launch to restart it on the current version)` : void 0,
     `MCP stdio: ${result.runtime.mcpStdioAvailable ? "available" : "unavailable"}`,
     `Posture Profile: ${result.postureProfile.selected}`,
     `Prompt Coach: ${result.preferences.promptCoachMode}`,
@@ -17345,11 +18111,36 @@ async function statusGuardian(flags, options) {
     `Service supervision: ${result.serviceSupervision.status}`,
     `OS key storage: ${result.osKeyStorage.status}`,
     `Not-proven production gates: ${result.notProvenProductionGates.length}`,
-    "Privacy: raw capture off, cloud sync off, local app autopilot off",
-    result.installed ? "Next: guardian launch" : "Next: guardian install"
+    formatGuardianPrivacyStatus(result.privacy),
+    `Next: ${result.nextCommands.join("; ")}`
   ].filter(Boolean).join("\n")}
 `;
 }
+function buildGuardianStatusNextCommands(input) {
+  if (!input.installed) {
+    return ["guardian install"];
+  }
+  if (input.daemonStatus === "reachable") {
+    return ["guardian open", "guardian readiness", "guardian extension open-setup"];
+  }
+  if (input.daemonStatus === "unauthorized") {
+    return ["guardian stop", "guardian launch --port=4322", "guardian status"];
+  }
+  if (input.daemonStatus === "token_missing" || input.daemonStatus === "invalid_control_tower_url") {
+    return ["guardian setup", "guardian launch", "guardian status"];
+  }
+  return ["guardian launch", "guardian status"];
+}
+function formatGuardianPrivacyStatus(input) {
+  return [
+    `Privacy: raw capture ${formatOnOff(input.rawContentCaptureEnabled)}`,
+    `cloud sync ${formatOnOff(input.cloudSyncEnabled)}`,
+    `local app autopilot ${formatOnOff(input.localAppAutopilotEnabled)}`
+  ].join(", ");
+}
+function formatOnOff(enabled) {
+  return enabled ? "on" : "off";
+}
 async function runControlTowerOpenCommand(flags, options) {
   const stdout = options.stdout ?? process.stdout;
   const stderr = options.stderr ?? process.stderr;
@@ -17400,7 +18191,7 @@ async function runLaunchCommand(flags, options) {
     return startExitCode;
   }
   const start = JSON.parse(startOutput);
-  const shouldOpen = !flags.has("print");
+  const shouldOpen = flags.has("open") && !flags.has("print");
   if (shouldOpen) {
     const opener = options.openUrl ?? ((url2) => openUrlInDefaultBrowser(url2, options));
     await opener(start.controlTowerUrl);
@@ -17414,7 +18205,12 @@ async function runLaunchCommand(flags, options) {
     controlTowerUrl: start.controlTowerUrl,
     pid: start.pid,
     healthStatus: start.healthStatus,
-    nextCommands: ["guardian status", "guardian daemon pair --json", "guardian policy list"]
+    nextCommands: [
+      "guardian open",
+      "guardian status",
+      "guardian daemon pair --json",
+      "guardian policy list"
+    ]
   };
   write(
     stdout,
@@ -17424,7 +18220,7 @@ async function runLaunchCommand(flags, options) {
       `Daemon: ${result.daemonUrl}${result.reusedExistingDaemon ? " (already running)" : ""}`,
       `Control Tower: ${result.controlTowerUrl}`,
       shouldOpen ? `Opening: ${result.controlTowerUrl}` : void 0,
-      "Next: guardian status"
+      "Next: guardian open; guardian status"
     ].filter(Boolean).join("\n")}
 `
   );
@@ -17848,6 +18644,7 @@ function requestGuardianDaemonHealth(request) {
           const parsedBody = parseJsonObject(body);
           const service = typeof parsedBody?.service === "string" ? parsedBody.service : void 0;
           const rawContentPersistence = typeof parsedBody?.rawContentPersistence === "boolean" ? parsedBody.rawContentPersistence : void 0;
+          const version2 = typeof parsedBody?.version === "string" ? parsedBody.version : void 0;
           const error51 = typeof parsedBody?.error === "string" ? parsedBody.error : void 0;
           const ok = typeof statusCode === "number" && statusCode >= 200 && statusCode < 300;
           resolve({
@@ -17856,6 +18653,7 @@ function requestGuardianDaemonHealth(request) {
             statusCode,
             service,
             rawContentPersistence,
+            version: version2,
             error: ok ? void 0 : error51 ?? "daemon_health_failed"
           });
         });
@@ -21563,6 +22361,7 @@ async function buildDaemonHealthStatus(home, flags, options, profile) {
       statusCode: checked.statusCode,
       service: checked.service,
       rawContentPersistence: checked.rawContentPersistence,
+      version: checked.version,
       error: checked.error
     }
   };
@@ -21875,6 +22674,19 @@ async function buildGuardianDoctorStatus(home, profile, env = process.env) {
     rawContentIncluded: false
   };
 }
+var GUARDIAN_MIN_SUPPORTED_NODE_VERSION = [20, 20, 0];
+function isGuardianSupportedNodeVersion(nodeVersion) {
+  const parts = nodeVersion.replace(/^v/, "").split(".").map((part) => Number.parseInt(part, 10));
+  const [major = 0, minor = 0, patch = 0] = parts;
+  const [minMajor, minMinor, minPatch] = GUARDIAN_MIN_SUPPORTED_NODE_VERSION;
+  if (major !== minMajor) {
+    return major > minMajor;
+  }
+  if (minor !== minMinor) {
+    return minor > minMinor;
+  }
+  return patch >= minPatch;
+}
 async function buildDoctorChecks(home, profile, env = process.env) {
   const encryption = buildGuardianLocalDataEncryptionStatus(
     env,
@@ -21884,6 +22696,12 @@ async function buildDoctorChecks(home, profile, env = process.env) {
   const serviceSupervision = await buildGuardianServiceSupervisionStatus(home);
   const osKeyStorage = await buildGuardianOsKeyStorageStatus(home);
   return [
+    {
+      id: "node-runtime",
+      label: "Node.js runtime",
+      status: isGuardianSupportedNodeVersion(process.version) ? "pass" : "warn",
+      detail: isGuardianSupportedNodeVersion(process.version) ? `Node ${process.version} meets the >=20.20.0 floor` : `Node ${process.version} is below the supported >=20.20.0 floor; upgrade to Node 20.20+ or 22 LTS`
+    },
     {
       id: "profile",
       label: "Guardian profile",
@@ -21985,6 +22803,26 @@ function stringFlag(flags, key) {
   const value = flags.get(key);
   return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
+function booleanFlag(flags, key, defaultValue) {
+  const value = flags.get(key);
+  if (value === void 0) {
+    return defaultValue;
+  }
+  if (value === true) {
+    return true;
+  }
+  if (typeof value !== "string") {
+    return defaultValue;
+  }
+  const normalized = value.trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(normalized)) {
+    return true;
+  }
+  if (["0", "false", "no", "off"].includes(normalized)) {
+    return false;
+  }
+  return defaultValue;
+}
 function copyStringFlags(flags, keys) {
   return keys.flatMap((key) => {
     const value = stringFlag(flags, key);
@@ -22146,6 +22984,7 @@ export {
   GUARDIAN_LOCAL_DATA_ENCRYPTION_KEY_ID_ENV,
   GUARDIAN_NOT_PROVEN_PRODUCTION_GATES,
   GUARDIAN_NPM_PACKAGE_NAME,
+  GUARDIAN_NPM_REGISTRY,
   GUARDIAN_NPX_SETUP_COMMAND,
   GUARDIAN_OPEN_CONTROL_TOWER_COMMAND,
   GUARDIAN_OS_KEY_STORAGE_PROOF_SCHEMA_VERSION,
@@ -22154,6 +22993,8 @@ export {
   GUARDIAN_POSTURE_PROFILE_IDS,
   GUARDIAN_PROFILE_SCHEMA_VERSION,
   GUARDIAN_PROVIDER_IDS,
+  GUARDIAN_RELEASE_DISPATCH_WORKFLOW,
+  GUARDIAN_RELEASE_REPOSITORY,
   GUARDIAN_SERVICE_PROOF_SCHEMA_VERSION,
   GUARDIAN_SOURCE_TYPES,
   GUARDIAN_SQLITE_PAGE_ENCRYPTION_KEY_ENV,
@@ -22170,6 +23011,7 @@ export {
   executeGuardianDesktopActionPlan,
   exportGuardianDataSnapshot,
   installGuardian,
+  isGuardianSupportedNodeVersion,
   normalizeGuardianProfile,
   requestGuardianDaemonHealth,
   requestGuardianDaemonStop,