@contextecf/guardian-cli 0.1.3 → 0.1.4

package/dist/packages/guardian-cli/src/bin.js

@@ -1,8 +1,13 @@
 #!/usr/bin/env node
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -73,7 +78,7 @@ var init_core = __esm({
     NEVER = /* @__PURE__ */ Object.freeze({
       status: "aborted"
     });
-    $brand = Symbol("zod_brand");
+    $brand = /* @__PURE__ */ Symbol("zod_brand");
     $ZodAsyncError = class extends Error {
       constructor() {
         super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);
@@ -10242,8 +10247,8 @@ function registry() {
 var _a2, $output, $input, $ZodRegistry, globalRegistry;
 var init_registries = __esm({
   "node_modules/zod/v4/core/registries.js"() {
-    $output = Symbol("ZodOutput");
-    $input = Symbol("ZodInput");
+    $output = /* @__PURE__ */ Symbol("ZodOutput");
+    $input = /* @__PURE__ */ Symbol("ZodInput");
     $ZodRegistry = class {
       constructor() {
         this._map = /* @__PURE__ */ new WeakMap();
@@ -17052,6 +17057,8 @@ async function runGuardianCli(argv, options = {}) {
       write(stdout, renderGuardianProductionReadiness(readiness, flags));
       return flags.has("strict") && (readiness.npmPreview.status !== "ready" || readiness.fullProduction.status !== "ready") ? 1 : 0;
     }
+    case "release":
+      return runReleaseCommand(argv.slice(1), flags, options);
     case "open":
       return runControlTowerOpenCommand(flags, options);
     case "status":
@@ -17205,7 +17212,7 @@ async function installGuardian(flags, options = {}) {
     `First run: ${GUARDIAN_FIRST_RUN_COMMAND}`,
     `Open Control Tower: ${GUARDIAN_OPEN_CONTROL_TOWER_COMMAND}`,
     `No global install: ${GUARDIAN_NPX_SETUP_COMMAND}`,
-    "Next: guardian setup; guardian doctor; guardian readiness; guardian launch; guardian mcp install; guardian extension open-setup; guardian daemon pair --json; guardian extension native-host install --extension-id=<browser-extension-id>"
+    "Next: guardian setup; guardian doctor; guardian readiness; guardian launch; guardian open; guardian mcp install; guardian extension open-setup; guardian daemon pair --json; guardian extension native-host install --extension-id=<browser-extension-id>"
   ].join("\n")}
 `;
 }
@@ -17252,7 +17259,7 @@ async function runSetupCommand(flags, options) {
       ["json", true],
       ...copyStringFlags(flags, ["host", "port"])
     ]);
-    if (flags.has("print")) {
+    if (!flags.has("open") || flags.has("print")) {
       launchFlags.set("print", true);
     }
     const launchExitCode = await runLaunchCommand(launchFlags, {
@@ -17331,6 +17338,7 @@ async function runSetupCommand(flags, options) {
     nextCommands: [
       "guardian status",
       "guardian readiness",
+      "guardian open",
       "guardian policy list",
       "guardian posture list",
       "guardian preferences show",
@@ -17408,10 +17416,761 @@ async function buildGuardianProductionReadinessStatus(home, profile, env = proce
       productionGateEvidenceStatus: protectedEvidence.productionGateEvidence?.status ?? "not_recorded",
       productionGateEvidencePath: protectedEvidence.productionGateEvidence?.evidencePath
     },
+    distribution: buildGuardianDistributionReadiness(npmPreviewReady),
+    tokenPrinted: false,
+    rawContentIncluded: false
+  };
+}
+function buildGuardianDistributionReadiness(npmPreviewReady) {
+  return {
+    status: npmPreviewReady ? "preview_install_ready" : "setup_or_release_evidence_required",
+    oneLineInstallCommand: GUARDIAN_GLOBAL_INSTALL_COMMAND,
+    oneLineTryCommand: GUARDIAN_NPX_SETUP_COMMAND,
+    openControlTowerCommand: GUARDIAN_OPEN_CONTROL_TOWER_COMMAND,
+    localUserCommands: {
+      setup: GUARDIAN_FIRST_RUN_COMMAND,
+      launch: "guardian launch",
+      open: "guardian open",
+      status: "guardian status",
+      readiness: "guardian readiness"
+    },
+    aiToolIntegration: {
+      mcpInstallCommand: "guardian mcp install --client=all --write",
+      browserSetupCommand: "guardian extension open-setup",
+      nativeHostInstallCommand: "guardian extension native-host install --extension-id=<browser-extension-id>"
+    },
+    browserStoreHandoff: {
+      status: npmPreviewReady ? "operator_handoff_ready_not_submitted" : "blocked_until_preview_ready",
+      submissionPackCommand: "npm run guardian:browser-store:submission-pack",
+      closeoutChecklistPath: "release/evidence/guardian-browser-store-submission-pack/browser-store-closeout-checklist.json",
+      productionGateStatus: "not_proven"
+    },
+    enterpriseDeployment: {
+      status: "managed_rollout_ready_for_customer_pack",
+      note: "Use enterprise policy packs, managed browser deployment, and customer evidence as a separate company or school-district rollout lane; it does not prove public browser-store distribution."
+    },
+    releaseAutomation: {
+      workflow: GUARDIAN_RELEASE_DISPATCH_WORKFLOW,
+      dryRunCommand: buildGuardianReleaseDispatchCommand(true),
+      publishCommand: buildGuardianReleaseDispatchCommand(false),
+      requiredPublishCredentialName: "NPM_TOKEN",
+      channels: ["all", "npm", "browser", "evidence"],
+      defaultDockerSmoke: true,
+      provenance: "github_actions_oidc_supported",
+      status: npmPreviewReady ? "ready_for_dispatch_after_preview_evidence" : "blocked_until_preview_release_evidence_passes",
+      boundaries: [
+        "Use dry_run=true before public publication.",
+        "dry_run=false requires the repository secret NPM_TOKEN and must not print npm tokens, OTP values, or .npmrc contents.",
+        "The workflow can publish the npm preview package, upload evidence, and run public install smokes; it does not sign native installers or approve future browser-store listings.",
+        "GitHub Actions OIDC/provenance applies to CI release context; manual local publishes are recorded separately and should not claim CI provenance."
+      ]
+    },
+    boundaries: [
+      "One-line npm install and Control Tower launch prove preview distribution only.",
+      "Chrome Web Store distribution is proven for the evidenced ContextECF Halo listing; future store submissions still require fresh official review evidence.",
+      "Enterprise managed deployment can support company or school-district rollout but remains a separate rollout lane.",
+      "MCP and browser setup commands must not print runtime tokens, raw prompts, raw responses, source archives, source maps, credentials, or private policy packs."
+    ]
+  };
+}
+function buildGuardianReleaseDispatchCommand(dryRun) {
+  return buildGuardianReleaseDispatchCommandFor({
+    dryRun,
+    releaseVersion: "<version>",
+    channels: "all",
+    runDockerSmoke: true
+  });
+}
+function buildGuardianReleaseDispatchCommandFor(input2) {
+  return [
+    `gh workflow run ${GUARDIAN_RELEASE_DISPATCH_WORKFLOW} \\`,
+    `  -f release_version=${input2.releaseVersion} \\`,
+    `  -f channels=${input2.channels} \\`,
+    `  -f dry_run=${input2.dryRun ? "true" : "false"} \\`,
+    `  -f run_docker_smoke=${input2.runDockerSmoke ? "true" : "false"}`
+  ].join("\n");
+}
+async function runReleaseCommand(argv, flags, options) {
+  const subcommand = argv[0];
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  if (!subcommand || subcommand === "help" || subcommand === "quickstart") {
+    write(stdout, renderGuardianReleaseHelp(buildGuardianReleaseHelp(), flags));
+    return 0;
+  }
+  if (subcommand === "browser-store" || subcommand === "browser-store-handoff" || subcommand === "store") {
+    write(
+      stdout,
+      renderGuardianBrowserStoreHandoffCommand(
+        buildGuardianBrowserStoreHandoffCommandResult(),
+        flags
+      )
+    );
+    return 0;
+  }
+  if (subcommand === "secrets" || subcommand === "secret-setup" || subcommand === "npm-token") {
+    write(stdout, renderGuardianReleaseSecretSetup(buildGuardianReleaseSecretSetup(), flags));
+    return 0;
+  }
+  if (subcommand === "checklist" || subcommand === "plan") {
+    const releaseVersion2 = stringFlag(flags, "version") ?? stringFlag(flags, "release-version");
+    if (!releaseVersion2) {
+      write(
+        stderr,
+        "Missing release version. Usage: guardian release checklist --version=<semver>\n"
+      );
+      return 1;
+    }
+    if (!isValidReleaseVersion(releaseVersion2)) {
+      write(stderr, "Invalid --version. Expected a semver value like 0.1.4 or 0.1.4-beta.1.\n");
+      return 1;
+    }
+    write(
+      stdout,
+      renderGuardianReleaseChecklist(buildGuardianReleaseChecklist(releaseVersion2), flags)
+    );
+    return 0;
+  }
+  if (subcommand === "flow" || subcommand === "train" || subcommand === "next") {
+    const releaseVersion2 = stringFlag(flags, "version") ?? stringFlag(flags, "release-version");
+    if (!releaseVersion2) {
+      write(stderr, "Missing release version. Usage: guardian release flow --version=<semver>\n");
+      return 1;
+    }
+    if (!isValidReleaseVersion(releaseVersion2)) {
+      write(stderr, "Invalid --version. Expected a semver value like 0.1.4 or 0.1.4-beta.1.\n");
+      return 1;
+    }
+    write(stdout, renderGuardianReleaseFlow(buildGuardianReleaseFlow(releaseVersion2), flags));
+    return 0;
+  }
+  if (subcommand === "verify" || subcommand === "post-release") {
+    const releaseVersion2 = stringFlag(flags, "version") ?? stringFlag(flags, "release-version");
+    if (!releaseVersion2) {
+      write(stderr, "Missing release version. Usage: guardian release verify --version=<semver>\n");
+      return 1;
+    }
+    if (!isValidReleaseVersion(releaseVersion2)) {
+      write(stderr, "Invalid --version. Expected a semver value like 0.1.4 or 0.1.4-beta.1.\n");
+      return 1;
+    }
+    write(stdout, renderGuardianReleaseVerify(buildGuardianReleaseVerify(releaseVersion2), flags));
+    return 0;
+  }
+  if (subcommand === "paste" || subcommand === "smoke" || subcommand === "install-smoke") {
+    const releaseVersion2 = stringFlag(flags, "version") ?? stringFlag(flags, "release-version");
+    if (!releaseVersion2) {
+      write(stderr, "Missing release version. Usage: guardian release paste --version=<semver>\n");
+      return 1;
+    }
+    if (!isValidReleaseVersion(releaseVersion2)) {
+      write(stderr, "Invalid --version. Expected a semver value like 0.1.4 or 0.1.4-beta.1.\n");
+      return 1;
+    }
+    write(stdout, renderGuardianReleasePaste(buildGuardianReleasePaste(releaseVersion2), flags));
+    return 0;
+  }
+  if (subcommand !== "command" && subcommand !== "dispatch") {
+    write(stderr, `Unknown Guardian release command: ${subcommand}
+`);
+    return 1;
+  }
+  const releaseVersion = stringFlag(flags, "version") ?? stringFlag(flags, "release-version");
+  if (!releaseVersion) {
+    write(
+      stderr,
+      "Missing release version. Usage: guardian release command --version=<semver> [--publish|--dry-run=false]\n"
+    );
+    return 1;
+  }
+  if (!isValidReleaseVersion(releaseVersion)) {
+    write(stderr, "Invalid --version. Expected a semver value like 0.1.4 or 0.1.4-beta.1.\n");
+    return 1;
+  }
+  const channels = stringFlag(flags, "channels") ?? "all";
+  if (!isValidReleaseChannels(channels)) {
+    write(stderr, "Invalid --channels. Expected one of: all, npm, browser, evidence.\n");
+    return 1;
+  }
+  const dryRun = flags.has("publish") ? false : booleanFlag(flags, "dry-run", true);
+  const runDockerSmoke = booleanFlag(flags, "run-docker-smoke", true);
+  const result = buildGuardianReleaseDispatchCommandResult({
+    releaseVersion,
+    channels,
+    dryRun,
+    runDockerSmoke
+  });
+  write(stdout, renderGuardianReleaseDispatchCommand(result, flags));
+  return 0;
+}
+function buildGuardianReleaseHelp() {
+  return {
+    schema_version: "contextecf/project-guardian-release-help/v1",
+    cli_version: GUARDIAN_CLI_VERSION,
+    repository: GUARDIAN_RELEASE_REPOSITORY,
+    status: "release_owner_quickstart",
+    commands: {
+      checklist: "guardian release checklist --version=<version>",
+      flow: "guardian release flow --version=<version>",
+      secrets: "guardian release secrets",
+      dryRunDispatch: "guardian release command --version=<version>",
+      publishDispatch: "guardian release command --version=<version> --publish",
+      verifyPublishedVersion: "guardian release verify --version=<version>",
+      pasteLocalSmoke: "guardian release paste --version=<version>",
+      browserStoreHandoff: "guardian release browser-store",
+      readiness: "guardian readiness"
+    },
+    suggestedOrder: [
+      "Run the checklist for the target version.",
+      "Set or verify the repository publish credential if this is a public npm release.",
+      "Run the dry-run dispatch before any publish dispatch.",
+      "Run the publish dispatch only after dry-run evidence passes.",
+      "Verify the published version and refresh release evidence.",
+      "Use browser-store handoff only for submission/review evidence; it does not upload or approve listings."
+    ],
+    boundaries: [
+      "Release quickstart output is operator guidance only, not release evidence or production-gate proof.",
+      "Do not paste npm tokens, OTP values, .npmrc contents, signing keys, browser-store credentials, raw prompts, raw responses, private policy packs, or customer content into release commands, chat, PR bodies, or evidence.",
+      "Public npm preview publication does not close signed-installer, browser-store, high-risk desktop action, or autonomous local app execution production gates.",
+      "Full production claims remain blocked until every not-proven production gate has real validated external evidence."
+    ],
+    tokenPrinted: false,
+    rawContentIncluded: false
+  };
+}
+function renderGuardianReleaseHelp(result, flags) {
+  if (flags.has("json")) {
+    return `${JSON.stringify(result, null, 2)}
+`;
+  }
+  return `${[
+    "Project Guardian Release Quickstart",
+    `Repository: ${result.repository}`,
+    `Status: ${result.status}`,
+    "Commands:",
+    `- Checklist: ${result.commands.checklist}`,
+    `- Flow: ${result.commands.flow}`,
+    `- Secrets: ${result.commands.secrets}`,
+    `- Dry run: ${result.commands.dryRunDispatch}`,
+    `- Publish: ${result.commands.publishDispatch}`,
+    `- Verify published version: ${result.commands.verifyPublishedVersion}`,
+    `- Copy-paste local smoke: ${result.commands.pasteLocalSmoke}`,
+    `- Browser-store handoff: ${result.commands.browserStoreHandoff}`,
+    `- Readiness: ${result.commands.readiness}`,
+    "Suggested order:",
+    ...result.suggestedOrder.map((step, index) => `${index + 1}. ${step}`),
+    "Boundaries:",
+    ...result.boundaries.map((boundary) => `- ${boundary}`),
+    "Token printed: no"
+  ].join("\n")}
+`;
+}
+function buildGuardianReleaseDispatchCommandResult(input2) {
+  return {
+    schema_version: "contextecf/project-guardian-release-dispatch-command/v1",
+    cli_version: GUARDIAN_CLI_VERSION,
+    workflow: GUARDIAN_RELEASE_DISPATCH_WORKFLOW,
+    releaseVersion: input2.releaseVersion,
+    channels: input2.channels,
+    dryRun: input2.dryRun,
+    runDockerSmoke: input2.runDockerSmoke,
+    command: buildGuardianReleaseDispatchCommandFor(input2),
+    ...input2.dryRun ? {} : { requiredPublishCredentialName: "NPM_TOKEN" },
+    provenance: "github_actions_oidc_supported",
+    boundaries: [
+      "Use dry_run=true before public publication.",
+      "dry_run=false requires the repository secret NPM_TOKEN and must not print npm tokens, OTP values, or .npmrc contents.",
+      "This dispatch can publish the npm preview package, upload evidence, and run public install smokes; it does not sign native installers or approve future browser-store listings.",
+      "A release-dispatch command is operator guidance, not production-gate proof."
+    ],
+    tokenPrinted: false,
+    rawContentIncluded: false
+  };
+}
+function renderGuardianReleaseDispatchCommand(result, flags) {
+  if (flags.has("json")) {
+    return `${JSON.stringify(result, null, 2)}
+`;
+  }
+  return `${[
+    "Project Guardian Release Dispatch Command",
+    `Release: ${result.releaseVersion}`,
+    `Mode: ${result.dryRun ? "dry run" : "publish"}`,
+    `Workflow: ${result.workflow}`,
+    `Channels: ${result.channels}`,
+    `Docker smoke: ${result.runDockerSmoke ? "yes" : "no"}`,
+    result.requiredPublishCredentialName ? `Required repository secret: ${result.requiredPublishCredentialName}` : "Required repository secret: not needed for dry run",
+    "Command:",
+    result.command,
+    "Boundaries:",
+    ...result.boundaries.map((boundary) => `- ${boundary}`),
+    "Token printed: no"
+  ].join("\n")}
+`;
+}
+function buildGuardianBrowserStoreHandoffCommandResult() {
+  return {
+    schema_version: "contextecf/project-guardian-browser-store-handoff-command/v1",
+    cli_version: GUARDIAN_CLI_VERSION,
+    status: "chrome_distribution_proven_next_submission_pack_ready",
+    primaryStore: "chrome_web_store",
+    productionGate: {
+      id: "browser-store-distribution",
+      status: "proven",
+      nextSubmissionRequiresFreshOfficialReviewEvidence: true
+    },
+    commands: {
+      submissionPack: "npm run guardian:browser-store:submission-pack -- --json --output-dir release/evidence/guardian-browser-store-submission-pack",
+      preSubmissionSmoke: "GUARDIAN_BROWSER_STORE_SMOKE_WORKSPACE=/tmp/guardian-browser-store-pre-submission-smoke bash release/evidence/guardian-browser-store-submission-pack/run-pre-submission-readiness-smoke.sh",
+      preSubmissionReadiness: [
+        "npm run guardian:browser-store:readiness:collect -- \\",
+        "  --package artifacts/guardian-browser-store/guardian-browser-extension-<version>.zip \\",
+        "  --assert-pre-submission-only \\",
+        "  --assert-mv3-validation-passed \\",
+        "  --assert-source-archive-excluded \\",
+        "  --assert-store-credentials-excluded \\",
+        "  --output release/evidence/guardian-browser-store-submission-pack/pre-submission-readiness.json"
+      ].join("\n"),
+      reviewPreflightAfterApproval: [
+        "npm run guardian:browser-store:review-preflight -- \\",
+        "  --store-evidence release/evidence/guardian-browser-store-submission-pack/browser-store-evidence-input.json \\",
+        "  --assert-metadata-only \\",
+        "  --assert-no-store-credentials \\",
+        "  --assert-approved-review-status \\",
+        "  --assert-public-listing-url \\",
+        "  --output release/evidence/guardian-browser-store-submission-pack/browser-store-review-preflight.json"
+      ].join("\n"),
+      collectorAfterApproval: [
+        "npm run guardian:production-gates:collect:browser-store -- \\",
+        "  --store-evidence release/evidence/guardian-browser-store-submission-pack/browser-store-evidence-input.json \\",
+        "  --review-preflight-summary release/evidence/guardian-browser-store-submission-pack/browser-store-review-preflight.json \\",
+        "  --assert-no-source-archives \\",
+        "  --assert-package-digest-matches-release \\",
+        "  --assert-listing-matches-release-boundary \\",
+        "  --assert-listing-names-not-proven-gates \\",
+        "  --assert-production-claim-absent \\",
+        "  --output release/evidence/guardian-production-gates/browser-store-distribution.json"
+      ].join("\n"),
+      finalGateValidation: "npm run validate:guardian-production-gates -- --claim production"
+    },
+    evidence: {
+      submissionPackDir: "release/evidence/guardian-browser-store-submission-pack",
+      closeoutChecklistPath: "release/evidence/guardian-browser-store-submission-pack/browser-store-closeout-checklist.json",
+      preSubmissionChecklistPath: "docs/project-guardian/browser-store-pre-submission-checklist.md",
+      readinessOutput: "release/evidence/guardian-browser-store-submission-pack/pre-submission-readiness.json",
+      reviewPreflightOutput: "release/evidence/guardian-browser-store-submission-pack/browser-store-review-preflight.json",
+      productionGatePacket: "release/evidence/guardian-production-gates/browser-store-distribution.json"
+    },
+    boundaries: [
+      "This command surface prepares browser-store submission handoff for future extension versions; it does not upload, submit, approve, or distribute the extension.",
+      "Chrome Web Store distribution is proven for the evidenced ContextECF Halo listing; each future extension package still needs fresh review/submission evidence before updating that proof.",
+      "Do not place browser-store credentials, dashboard cookies, source archives, source maps, runtime tokens, private policy packs, raw prompts, raw responses, or customer content in browser-store evidence.",
+      "Enterprise managed browser deployment is a separate customer rollout lane and does not replace public store review evidence for public listings."
+    ],
     tokenPrinted: false,
     rawContentIncluded: false
   };
 }
+function renderGuardianBrowserStoreHandoffCommand(result, flags) {
+  if (flags.has("json")) {
+    return `${JSON.stringify(result, null, 2)}
+`;
+  }
+  return `${[
+    "Project Guardian Browser Store Handoff",
+    `Status: ${result.status}`,
+    `Primary store: ${result.primaryStore}`,
+    `Production gate: ${result.productionGate.id} (${result.productionGate.status})`,
+    "1. Build submission pack:",
+    result.commands.submissionPack,
+    "2. Run pre-submission smoke:",
+    result.commands.preSubmissionSmoke,
+    "3. Record pre-submission readiness:",
+    result.commands.preSubmissionReadiness,
+    "4. After official approval, run review preflight:",
+    result.commands.reviewPreflightAfterApproval,
+    "5. After official approval, collect production-gate evidence:",
+    result.commands.collectorAfterApproval,
+    `Closeout checklist: ${result.evidence.closeoutChecklistPath}`,
+    `Pre-submission checklist: ${result.evidence.preSubmissionChecklistPath}`,
+    "Boundaries:",
+    ...result.boundaries.map((boundary) => `- ${boundary}`),
+    "Token printed: no"
+  ].join("\n")}
+`;
+}
+function buildGuardianReleaseSecretSetup() {
+  return {
+    schema_version: "contextecf/project-guardian-release-secret-setup/v1",
+    cli_version: GUARDIAN_CLI_VERSION,
+    repository: GUARDIAN_RELEASE_REPOSITORY,
+    requiredForPublish: "NPM_TOKEN",
+    githubActionsSecretUrl: `https://github.com/${GUARDIAN_RELEASE_REPOSITORY}/settings/secrets/actions/new`,
+    commands: {
+      setNpmToken: `gh secret set NPM_TOKEN --repo ${GUARDIAN_RELEASE_REPOSITORY} --app actions`,
+      verifyNpmTokenPresence: `gh secret list --repo ${GUARDIAN_RELEASE_REPOSITORY} --app actions | rg '^NPM_TOKEN\\b'`,
+      dryRunDispatch: buildGuardianReleaseDispatchCommandFor({
+        dryRun: true,
+        releaseVersion: "<version>",
+        channels: "all",
+        runDockerSmoke: true
+      }),
+      publishDispatch: buildGuardianReleaseDispatchCommandFor({
+        dryRun: false,
+        releaseVersion: "<version>",
+        channels: "all",
+        runDockerSmoke: true
+      })
+    },
+    boundaries: [
+      "NPM_TOKEN belongs only in GitHub Actions repository secrets for guarded dry_run=false npm publication.",
+      "Do not paste npm tokens, OTP values, .npmrc contents, signing keys, browser-store credentials, raw prompts, raw responses, private policy packs, or customer content into chat, PR bodies, release evidence, or CLI output.",
+      "Use dry_run=true before dry_run=false; dry-run dispatch does not require NPM_TOKEN.",
+      "Adding NPM_TOKEN enables the npm preview publish lane only; it does not close signed-installer, browser-store, high-risk desktop, or autonomous app production gates."
+    ],
+    tokenPrinted: false,
+    rawContentIncluded: false
+  };
+}
+function renderGuardianReleaseSecretSetup(result, flags) {
+  if (flags.has("json")) {
+    return `${JSON.stringify(result, null, 2)}
+`;
+  }
+  return `${[
+    "Project Guardian Release Secret Setup",
+    `Repository: ${result.repository}`,
+    `Required for publish: ${result.requiredForPublish}`,
+    `GitHub Actions secret page: ${result.githubActionsSecretUrl}`,
+    "Set secret:",
+    result.commands.setNpmToken,
+    "Verify secret presence:",
+    result.commands.verifyNpmTokenPresence,
+    "Dry-run release command:",
+    result.commands.dryRunDispatch,
+    "Publish release command:",
+    result.commands.publishDispatch,
+    "Boundaries:",
+    ...result.boundaries.map((boundary) => `- ${boundary}`),
+    "Token printed: no"
+  ].join("\n")}
+`;
+}
+function buildGuardianReleaseChecklist(releaseVersion) {
+  return {
+    schema_version: "contextecf/project-guardian-release-checklist/v1",
+    cli_version: GUARDIAN_CLI_VERSION,
+    releaseVersion,
+    repository: GUARDIAN_RELEASE_REPOSITORY,
+    status: "preview_release_operator_ready_full_production_blocked",
+    operatorCommands: {
+      secretSetup: "guardian release secrets",
+      dryRunDispatch: buildGuardianReleaseDispatchCommandFor({
+        dryRun: true,
+        releaseVersion,
+        channels: "all",
+        runDockerSmoke: true
+      }),
+      publishDispatch: buildGuardianReleaseDispatchCommandFor({
+        dryRun: false,
+        releaseVersion,
+        channels: "all",
+        runDockerSmoke: true
+      }),
+      browserStoreHandoff: "guardian release browser-store",
+      readiness: "guardian readiness"
+    },
+    requiredRepositoryCredentialName: "NPM_TOKEN",
+    evidenceOutputs: [
+      "release/evidence/guardian-release-dispatch-summary.json",
+      "release/evidence/guardian-npm-publish-execution-summary.json",
+      "release/evidence/guardian-npm-publish-status-verification.json",
+      "release/evidence/guardian-browser-store-submission-pack/browser-store-closeout-checklist.json",
+      "release/evidence/guardian-finish-line-status.json"
+    ],
+    notProvenProductionGates: GUARDIAN_NOT_PROVEN_PRODUCTION_GATES.map((gate) => ({
+      id: gate.id,
+      label: gate.label,
+      owner: gate.owner,
+      releaseBoundary: gate.releaseBoundary
+    })),
+    boundaries: [
+      "This checklist is an operator command surface for Guardian preview releases; it is not production-gate proof.",
+      "Run the dry-run dispatch before any dry_run=false publish dispatch.",
+      "dry_run=false requires NPM_TOKEN in GitHub Actions repository secrets and must not print npm tokens, OTP values, or .npmrc contents.",
+      "The checklist does not sign native installers, submit browser-store packages, execute high-risk desktop actions, or enable autonomous local app execution.",
+      "Full production claims remain blocked until every not-proven production gate has real validated external evidence."
+    ],
+    tokenPrinted: false,
+    rawContentIncluded: false
+  };
+}
+function buildGuardianReleaseFlow(releaseVersion) {
+  const checklist = buildGuardianReleaseChecklist(releaseVersion);
+  const verify = buildGuardianReleaseVerify(releaseVersion);
+  const dryRunDispatch = buildGuardianReleaseDispatchCommandFor({
+    dryRun: true,
+    releaseVersion,
+    channels: "all",
+    runDockerSmoke: true
+  });
+  const publishDispatch = buildGuardianReleaseDispatchCommandFor({
+    dryRun: false,
+    releaseVersion,
+    channels: "all",
+    runDockerSmoke: true
+  });
+  return {
+    schema_version: "contextecf/project-guardian-release-flow/v1",
+    cli_version: GUARDIAN_CLI_VERSION,
+    releaseVersion,
+    repository: GUARDIAN_RELEASE_REPOSITORY,
+    status: "release_owner_flow_ready_full_production_blocked",
+    steps: [
+      {
+        id: "review-checklist",
+        label: "Review the release checklist",
+        command: `guardian release checklist --version=${releaseVersion}`,
+        credentialRequired: false
+      },
+      {
+        id: "verify-secrets",
+        label: "Verify npm publish secret setup",
+        command: "guardian release secrets",
+        credentialRequired: false
+      },
+      {
+        id: "dry-run-dispatch",
+        label: "Run the GitHub Actions dry run",
+        command: dryRunDispatch,
+        credentialRequired: false
+      },
+      {
+        id: "publish-dispatch",
+        label: "Run the guarded publish dispatch after dry-run evidence passes",
+        command: publishDispatch,
+        credentialRequired: true
+      },
+      {
+        id: "verify-public-release",
+        label: "Verify the published package and local install smoke",
+        command: `guardian release verify --version=${releaseVersion}`,
+        credentialRequired: false
+      },
+      {
+        id: "copy-paste-local-smoke",
+        label: "Copy-paste the local end-user smoke block",
+        command: `guardian release paste --version=${releaseVersion}`,
+        credentialRequired: false
+      },
+      {
+        id: "browser-store-handoff",
+        label: "Prepare browser-store submission handoff",
+        command: "guardian release browser-store",
+        credentialRequired: false
+      }
+    ],
+    copyPasteLocalSmoke: verify.commands.copyPasteLocalSmoke,
+    evidenceOutputs: Array.from(
+      /* @__PURE__ */ new Set([
+        ...checklist.evidenceOutputs,
+        ...verify.evidenceOutputs,
+        "release/evidence/guardian-browser-store-submission-pack/browser-store-closeout-checklist.json"
+      ])
+    ),
+    notProvenProductionGates: checklist.notProvenProductionGates.map((gate) => ({
+      id: gate.id,
+      label: gate.label,
+      releaseBoundary: gate.releaseBoundary
+    })),
+    boundaries: [
+      "This release flow is copy-paste operator guidance only; it is not release evidence or production-gate proof.",
+      "Publish dispatch requires NPM_TOKEN in GitHub Actions repository secrets and must not print npm tokens, OTP values, or .npmrc contents.",
+      "Run the dry-run dispatch before the guarded dry_run=false publish dispatch.",
+      "Public npm preview publication and local install smoke prove the CLI preview lane only.",
+      "Signed native installers, high-risk desktop action execution, and autonomous local app execution remain separate not-proven production gates until real external evidence is collected and validated."
+    ],
+    tokenPrinted: false,
+    rawContentIncluded: false
+  };
+}
+function renderGuardianReleaseFlow(result, flags) {
+  if (flags.has("json")) {
+    return `${JSON.stringify(result, null, 2)}
+`;
+  }
+  const lines = [
+    "Project Guardian Release Flow",
+    `Release: ${result.releaseVersion}`,
+    `Repository: ${result.repository}`,
+    `Status: ${result.status}`,
+    "Steps:",
+    ...result.steps.flatMap((step, index) => [
+      `${index + 1}. ${step.label}${step.credentialRequired ? " (requires NPM_TOKEN secret)" : ""}:`,
+      step.command
+    ]),
+    "Post-publish copy-paste local smoke:",
+    result.copyPasteLocalSmoke,
+    "Evidence outputs:",
+    ...result.evidenceOutputs.map((output2) => `- ${output2}`),
+    "Not-proven production gates:",
+    ...result.notProvenProductionGates.map(
+      (gate) => `- ${gate.label}: ${gate.releaseBoundary ?? "not proven"}`
+    ),
+    "Boundaries:",
+    ...result.boundaries.map((boundary) => `- ${boundary}`),
+    "Token printed: no"
+  ];
+  return `${lines.join("\n")}
+`;
+}
+function renderGuardianReleaseChecklist(result, flags) {
+  if (flags.has("json")) {
+    return `${JSON.stringify(result, null, 2)}
+`;
+  }
+  return `${[
+    "Project Guardian Release Checklist",
+    `Release: ${result.releaseVersion}`,
+    `Repository: ${result.repository}`,
+    `Status: ${result.status}`,
+    `Required repository credential: ${result.requiredRepositoryCredentialName}`,
+    "1. Secret setup:",
+    result.operatorCommands.secretSetup,
+    "2. Dry-run dispatch:",
+    result.operatorCommands.dryRunDispatch,
+    "3. Publish dispatch:",
+    result.operatorCommands.publishDispatch,
+    "4. Browser-store handoff:",
+    result.operatorCommands.browserStoreHandoff,
+    "5. Readiness check:",
+    result.operatorCommands.readiness,
+    "Evidence outputs:",
+    ...result.evidenceOutputs.map((output2) => `- ${output2}`),
+    "Not-proven production gates:",
+    ...result.notProvenProductionGates.map(
+      (gate) => `- ${gate.label}: ${gate.releaseBoundary ?? "not proven"}`
+    ),
+    "Boundaries:",
+    ...result.boundaries.map((boundary) => `- ${boundary}`),
+    "Token printed: no"
+  ].join("\n")}
+`;
+}
+function buildGuardianReleaseVerify(releaseVersion) {
+  const copyPasteLocalSmoke = buildGuardianReleasePaste(releaseVersion).command;
+  return {
+    schema_version: "contextecf/project-guardian-release-verify/v1",
+    cli_version: GUARDIAN_CLI_VERSION,
+    releaseVersion,
+    repository: GUARDIAN_RELEASE_REPOSITORY,
+    packageName: GUARDIAN_NPM_PACKAGE_NAME,
+    registry: GUARDIAN_NPM_REGISTRY,
+    status: "post_release_verification_required",
+    commands: {
+      registryVersion: `npm view ${GUARDIAN_NPM_PACKAGE_NAME}@${releaseVersion} version --registry=${GUARDIAN_NPM_REGISTRY}`,
+      publicInstall: `npm install -g ${GUARDIAN_NPM_PACKAGE_NAME}@${releaseVersion}`,
+      installedVersion: "guardian --version",
+      setup: "guardian setup",
+      launch: "guardian launch",
+      status: "guardian status",
+      openControlTower: "guardian open",
+      copyPasteLocalSmoke,
+      publishStatusVerification: "npm run guardian:npm:publish:verify-status -- --status release/evidence/guardian-npm-publish-status.json --assert-ready --verify-artifacts --output release/evidence/guardian-npm-publish-status-verification.json",
+      finishLineStatus: "npm run guardian:finish-line:status -- --npm-publish-status release/evidence/guardian-npm-publish-status.json --json --output release/evidence/guardian-finish-line-status.json"
+    },
+    evidenceOutputs: [
+      "release/evidence/guardian-npm-publish-status.json",
+      "release/evidence/guardian-npm-publish-status-verification.json",
+      "release/evidence/guardian-finish-line-status.json"
+    ],
+    boundaries: [
+      "This command surface verifies public preview release visibility and installability; it does not publish to npm.",
+      "Do not print npm tokens, OTP values, .npmrc contents, signing keys, browser-store credentials, raw prompts, raw responses, private policy packs, or customer content in release verification evidence.",
+      "A passing public npm install smoke proves the CLI preview lane only; signed installers, high-risk desktop action execution, and autonomous app execution remain separate production gates.",
+      "Full production claims remain blocked until every not-proven production gate has real validated external evidence."
+    ],
+    tokenPrinted: false,
+    rawContentIncluded: false
+  };
+}
+function buildGuardianReleasePaste(releaseVersion) {
+  const commands = [
+    `npm view ${GUARDIAN_NPM_PACKAGE_NAME}@${releaseVersion} version --registry=${GUARDIAN_NPM_REGISTRY}`,
+    `npm install -g ${GUARDIAN_NPM_PACKAGE_NAME}@${releaseVersion}`,
+    "guardian --version",
+    "guardian stop",
+    "guardian setup",
+    "guardian launch",
+    "guardian open",
+    "guardian status"
+  ];
+  return {
+    schema_version: "contextecf/project-guardian-release-paste/v1",
+    cli_version: GUARDIAN_CLI_VERSION,
+    releaseVersion,
+    packageName: GUARDIAN_NPM_PACKAGE_NAME,
+    registry: GUARDIAN_NPM_REGISTRY,
+    command: commands.join("\n"),
+    commands,
+    boundaries: [
+      "This paste block verifies public npm visibility, global install, first-run setup, daemon launch, Control Tower open, and status.",
+      "It does not publish to npm and must not include npm tokens, OTP values, .npmrc contents, signing keys, browser-store credentials, raw prompts, raw responses, private policy packs, or customer content.",
+      "guardian stop is included before setup so stale local daemons or local token mismatches are cleared before launch."
+    ],
+    tokenPrinted: false,
+    rawContentIncluded: false
+  };
+}
+function renderGuardianReleasePaste(result, flags) {
+  if (flags.has("json")) {
+    return `${JSON.stringify(result, null, 2)}
+`;
+  }
+  return `${result.command}
+`;
+}
+function renderGuardianReleaseVerify(result, flags) {
+  if (flags.has("json")) {
+    return `${JSON.stringify(result, null, 2)}
+`;
+  }
+  return `${[
+    "Project Guardian Release Verification",
+    `Release: ${result.releaseVersion}`,
+    `Package: ${result.packageName}`,
+    `Registry: ${result.registry}`,
+    `Status: ${result.status}`,
+    "1. Confirm registry visibility:",
+    result.commands.registryVersion,
+    "2. Install the published version:",
+    result.commands.publicInstall,
+    "3. Confirm installed CLI version:",
+    result.commands.installedVersion,
+    "4. Run first-use smoke:",
+    result.commands.setup,
+    result.commands.launch,
+    result.commands.status,
+    result.commands.openControlTower,
+    "5. Copy-paste local smoke block:",
+    result.commands.copyPasteLocalSmoke,
+    "6. Verify release evidence:",
+    result.commands.publishStatusVerification,
+    result.commands.finishLineStatus,
+    "Evidence outputs:",
+    ...result.evidenceOutputs.map((output2) => `- ${output2}`),
+    "Boundaries:",
+    ...result.boundaries.map((boundary) => `- ${boundary}`),
+    "Token printed: no"
+  ].join("\n")}
+`;
+}
+function isValidReleaseVersion(value) {
+  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(value);
+}
+function isValidReleaseChannels(value) {
+  return ["all", "npm", "browser", "evidence"].includes(value);
+}
 function renderGuardianProductionReadiness(result, flags) {
   if (flags.has("json")) {
     return `${JSON.stringify(result, null, 2)}
@@ -17424,6 +18183,18 @@ function renderGuardianProductionReadiness(result, flags) {
     `Doctor: ${result.doctorOverall.toUpperCase()}`,
     `NPM preview install: ${result.npmPreview.status.toUpperCase()} - ${result.npmPreview.reason}`,
     result.npmPreview.publishCommand ? `NPM publish command: ${result.npmPreview.publishCommand}` : "NPM publish command: not available until publish dry-run evidence passes",
+    `Distribution: ${result.distribution.status}`,
+    `Install: ${result.distribution.oneLineInstallCommand}`,
+    `Try without global install: ${result.distribution.oneLineTryCommand}`,
+    `Open Control Tower: ${result.distribution.openControlTowerCommand}`,
+    `AI tool setup: ${result.distribution.aiToolIntegration.mcpInstallCommand}; ${result.distribution.aiToolIntegration.browserSetupCommand}`,
+    `Browser-store handoff: ${result.distribution.browserStoreHandoff.status}; gate ${result.distribution.browserStoreHandoff.productionGateStatus}`,
+    `Browser-store checklist: ${result.distribution.browserStoreHandoff.closeoutChecklistPath}`,
+    `Release workflow: ${result.distribution.releaseAutomation.workflow}; status=${result.distribution.releaseAutomation.status}`,
+    `Release dry run:
+${result.distribution.releaseAutomation.dryRunCommand}`,
+    `Release publish:
+${result.distribution.releaseAutomation.publishCommand}`,
     `Full production release: ${result.fullProduction.status.toUpperCase()} - ${result.fullProduction.reason}`,
     `Production gate evidence: ${result.fullProduction.productionGateEvidenceStatus}`,
     `Blocked production gates: ${result.fullProduction.blockedGateCount}`,
@@ -17452,6 +18223,10 @@ async function statusGuardian(flags, options) {
     installed: profile !== void 0,
     daemonStatus: daemonHealth.daemon.status
   });
+  const daemonVersionMismatch = daemonHealth.daemon.status === "reachable" && daemonHealth.daemon.version !== void 0 && daemonHealth.daemon.version !== GUARDIAN_CLI_VERSION ? { cliVersion: GUARDIAN_CLI_VERSION, daemonVersion: daemonHealth.daemon.version } : null;
+  if (daemonVersionMismatch) {
+    nextCommands.push("guardian stop", "guardian launch");
+  }
   const result = {
     schema_version: "contextecf/project-guardian-status/v1",
     cli_version: GUARDIAN_CLI_VERSION,
@@ -17485,6 +18260,7 @@ async function statusGuardian(flags, options) {
     serviceSupervision,
     osKeyStorage,
     notProvenProductionGates: GUARDIAN_NOT_PROVEN_PRODUCTION_GATES,
+    daemonVersionMismatch,
     nextCommands
   };
   if (flags.has("json")) {
@@ -17499,6 +18275,7 @@ async function statusGuardian(flags, options) {
     `Control Tower: ${result.controlTowerUrl ?? "not configured"}`,
     `Daemon health: ${result.daemon.status}${result.daemon.statusCode ? ` (HTTP ${result.daemon.statusCode})` : ""}`,
     result.daemon.error ? `Daemon detail: ${result.daemon.error}` : void 0,
+    result.daemonVersionMismatch ? `Daemon version: ${result.daemonVersionMismatch.daemonVersion} (this CLI is ${result.daemonVersionMismatch.cliVersion} \u2014 versions differ, likely because the CLI was reinstalled or changed version while this daemon kept running; run guardian stop && guardian launch to restart it on the current version)` : void 0,
     `MCP stdio: ${result.runtime.mcpStdioAvailable ? "available" : "unavailable"}`,
     `Posture Profile: ${result.postureProfile.selected}`,
     `Prompt Coach: ${result.preferences.promptCoachMode}`,
@@ -17588,7 +18365,7 @@ async function runLaunchCommand(flags, options) {
     return startExitCode;
   }
   const start = JSON.parse(startOutput);
-  const shouldOpen = !flags.has("print");
+  const shouldOpen = flags.has("open") && !flags.has("print");
   if (shouldOpen) {
     const opener = options.openUrl ?? ((url2) => openUrlInDefaultBrowser(url2, options));
     await opener(start.controlTowerUrl);
@@ -17602,7 +18379,12 @@ async function runLaunchCommand(flags, options) {
     controlTowerUrl: start.controlTowerUrl,
     pid: start.pid,
     healthStatus: start.healthStatus,
-    nextCommands: ["guardian status", "guardian daemon pair --json", "guardian policy list"]
+    nextCommands: [
+      "guardian open",
+      "guardian status",
+      "guardian daemon pair --json",
+      "guardian policy list"
+    ]
   };
   write(
     stdout,
@@ -17612,7 +18394,7 @@ async function runLaunchCommand(flags, options) {
       `Daemon: ${result.daemonUrl}${result.reusedExistingDaemon ? " (already running)" : ""}`,
       `Control Tower: ${result.controlTowerUrl}`,
       shouldOpen ? `Opening: ${result.controlTowerUrl}` : void 0,
-      "Next: guardian status"
+      "Next: guardian open; guardian status"
     ].filter(Boolean).join("\n")}
 `
   );
@@ -18036,6 +18818,7 @@ function requestGuardianDaemonHealth(request) {
           const parsedBody = parseJsonObject(body);
           const service = typeof parsedBody?.service === "string" ? parsedBody.service : void 0;
           const rawContentPersistence = typeof parsedBody?.rawContentPersistence === "boolean" ? parsedBody.rawContentPersistence : void 0;
+          const version2 = typeof parsedBody?.version === "string" ? parsedBody.version : void 0;
           const error51 = typeof parsedBody?.error === "string" ? parsedBody.error : void 0;
           const ok = typeof statusCode === "number" && statusCode >= 200 && statusCode < 300;
           resolve({
@@ -18044,6 +18827,7 @@ function requestGuardianDaemonHealth(request) {
             statusCode,
             service,
             rawContentPersistence,
+            version: version2,
             error: ok ? void 0 : error51 ?? "daemon_health_failed"
           });
         });
@@ -21742,6 +22526,7 @@ async function buildDaemonHealthStatus(home, flags, options, profile) {
       statusCode: checked.statusCode,
       service: checked.service,
       rawContentPersistence: checked.rawContentPersistence,
+      version: checked.version,
       error: checked.error
     }
   };
@@ -22054,6 +22839,18 @@ async function buildGuardianDoctorStatus(home, profile, env = process.env) {
     rawContentIncluded: false
   };
 }
+function isGuardianSupportedNodeVersion(nodeVersion) {
+  const parts = nodeVersion.replace(/^v/, "").split(".").map((part) => Number.parseInt(part, 10));
+  const [major = 0, minor = 0, patch = 0] = parts;
+  const [minMajor, minMinor, minPatch] = GUARDIAN_MIN_SUPPORTED_NODE_VERSION;
+  if (major !== minMajor) {
+    return major > minMajor;
+  }
+  if (minor !== minMinor) {
+    return minor > minMinor;
+  }
+  return patch >= minPatch;
+}
 async function buildDoctorChecks(home, profile, env = process.env) {
   const encryption = buildGuardianLocalDataEncryptionStatus(
     env,
@@ -22063,6 +22860,12 @@ async function buildDoctorChecks(home, profile, env = process.env) {
   const serviceSupervision = await buildGuardianServiceSupervisionStatus(home);
   const osKeyStorage = await buildGuardianOsKeyStorageStatus(home);
   return [
+    {
+      id: "node-runtime",
+      label: "Node.js runtime",
+      status: isGuardianSupportedNodeVersion(process.version) ? "pass" : "warn",
+      detail: isGuardianSupportedNodeVersion(process.version) ? `Node ${process.version} meets the >=20.20.0 floor` : `Node ${process.version} is below the supported >=20.20.0 floor; upgrade to Node 20.20+ or 22 LTS`
+    },
     {
       id: "profile",
       label: "Guardian profile",
@@ -22164,6 +22967,26 @@ function stringFlag(flags, key) {
   const value = flags.get(key);
   return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
+function booleanFlag(flags, key, defaultValue) {
+  const value = flags.get(key);
+  if (value === void 0) {
+    return defaultValue;
+  }
+  if (value === true) {
+    return true;
+  }
+  if (typeof value !== "string") {
+    return defaultValue;
+  }
+  const normalized = value.trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(normalized)) {
+    return true;
+  }
+  if (["0", "false", "no", "off"].includes(normalized)) {
+    return false;
+  }
+  return defaultValue;
+}
 function copyStringFlags(flags, keys) {
   return keys.flatMap((key) => {
     const value = stringFlag(flags, key);
@@ -22311,19 +23134,22 @@ function openUrlInDefaultBrowser(url2, options = {}) {
     });
   });
 }
-var GUARDIAN_CLI_VERSION, GUARDIAN_PROFILE_SCHEMA_VERSION, GUARDIAN_NPM_PACKAGE_NAME, GUARDIAN_GLOBAL_INSTALL_COMMAND, GUARDIAN_NPX_SETUP_COMMAND, GUARDIAN_FIRST_RUN_COMMAND, GUARDIAN_OPEN_CONTROL_TOWER_COMMAND, GUARDIAN_DEFAULT_CONTROL_TOWER_URL, GUARDIAN_LOCAL_DATA_ENCRYPTION_KEY_ENV, GUARDIAN_LOCAL_DATA_ENCRYPTION_KEY_ID_ENV, GUARDIAN_SQLITE_PAGE_ENCRYPTION_KEY_ENV, GUARDIAN_SQLITE_PAGE_ENCRYPTION_KEY_ID_ENV, GUARDIAN_DESKTOP_ADAPTER_SIMULATE_OPEN_ENV, GUARDIAN_DESKTOP_URL_OPEN_ADAPTER_ID, GUARDIAN_DESKTOP_URL_OPEN_ADAPTER_VERSION, GUARDIAN_DESKTOP_URL_OPEN_ADAPTER_PROOF_SCHEMA_VERSION, GUARDIAN_SERVICE_PROOF_SCHEMA_VERSION, GUARDIAN_OS_KEY_STORAGE_PROOF_SCHEMA_VERSION, GUARDIAN_WINDOWS_NATIVE_HOST_REGISTRY_PROOF_SCHEMA_VERSION, PERSONAL_FABRIC_CONTRACTS_SCHEMA_VERSION2, PROMPT_COACH_MODES, DEFAULT_PROMPT_COACH_DAILY_SOFT_CARD_LIMIT, GUARDIAN_POSTURE_PROFILE_IDS, GUARDIAN_POSTURE_PROFILE_CATALOG, GUARDIAN_POLICY_PACK_MARKETPLACE_CATALOG, GUARDIAN_PROVIDER_IDS, GUARDIAN_SOURCE_TYPES, GUARDIAN_NOT_PROVEN_PRODUCTION_GATES, DEFAULT_POLICY_PACKS, GUARDIAN_BRIDGE_CONFIG_STORAGE_KEY, GUARDIAN_BRIDGE_TOKEN_STORAGE_KEY, GUARDIAN_BRIDGE_CONFIG_SCHEMA_VERSION, GUARDIAN_NATIVE_HOST_NAME, MCP_CLIENTS, NATIVE_HOST_BROWSERS, HELP_TEXT, normalizeGuardianPreferences, GUARDIAN_DATA_FILE_NAMES, GUARDIAN_DATA_DIR_NAMES;
+var GUARDIAN_CLI_VERSION, GUARDIAN_PROFILE_SCHEMA_VERSION, GUARDIAN_NPM_PACKAGE_NAME, GUARDIAN_NPM_REGISTRY, GUARDIAN_GLOBAL_INSTALL_COMMAND, GUARDIAN_NPX_SETUP_COMMAND, GUARDIAN_FIRST_RUN_COMMAND, GUARDIAN_OPEN_CONTROL_TOWER_COMMAND, GUARDIAN_RELEASE_DISPATCH_WORKFLOW, GUARDIAN_RELEASE_REPOSITORY, GUARDIAN_DEFAULT_CONTROL_TOWER_URL, GUARDIAN_LOCAL_DATA_ENCRYPTION_KEY_ENV, GUARDIAN_LOCAL_DATA_ENCRYPTION_KEY_ID_ENV, GUARDIAN_SQLITE_PAGE_ENCRYPTION_KEY_ENV, GUARDIAN_SQLITE_PAGE_ENCRYPTION_KEY_ID_ENV, GUARDIAN_DESKTOP_ADAPTER_SIMULATE_OPEN_ENV, GUARDIAN_DESKTOP_URL_OPEN_ADAPTER_ID, GUARDIAN_DESKTOP_URL_OPEN_ADAPTER_VERSION, GUARDIAN_DESKTOP_URL_OPEN_ADAPTER_PROOF_SCHEMA_VERSION, GUARDIAN_SERVICE_PROOF_SCHEMA_VERSION, GUARDIAN_OS_KEY_STORAGE_PROOF_SCHEMA_VERSION, GUARDIAN_WINDOWS_NATIVE_HOST_REGISTRY_PROOF_SCHEMA_VERSION, PERSONAL_FABRIC_CONTRACTS_SCHEMA_VERSION2, PROMPT_COACH_MODES, DEFAULT_PROMPT_COACH_DAILY_SOFT_CARD_LIMIT, GUARDIAN_POSTURE_PROFILE_IDS, GUARDIAN_POSTURE_PROFILE_CATALOG, GUARDIAN_POLICY_PACK_MARKETPLACE_CATALOG, GUARDIAN_PROVIDER_IDS, GUARDIAN_SOURCE_TYPES, GUARDIAN_NOT_PROVEN_PRODUCTION_GATES, DEFAULT_POLICY_PACKS, GUARDIAN_BRIDGE_CONFIG_STORAGE_KEY, GUARDIAN_BRIDGE_TOKEN_STORAGE_KEY, GUARDIAN_BRIDGE_CONFIG_SCHEMA_VERSION, GUARDIAN_NATIVE_HOST_NAME, MCP_CLIENTS, NATIVE_HOST_BROWSERS, HELP_TEXT, normalizeGuardianPreferences, GUARDIAN_DATA_FILE_NAMES, GUARDIAN_DATA_DIR_NAMES, GUARDIAN_MIN_SUPPORTED_NODE_VERSION;
 var init_runtime = __esm({
   "packages/guardian-cli/src/runtime.ts"() {
     "use strict";
     init_src();
     init_src2();
-    GUARDIAN_CLI_VERSION = "0.1.3";
+    GUARDIAN_CLI_VERSION = "0.1.4";
     GUARDIAN_PROFILE_SCHEMA_VERSION = "contextecf/project-guardian-profile/v1";
     GUARDIAN_NPM_PACKAGE_NAME = "@contextecf/guardian-cli";
+    GUARDIAN_NPM_REGISTRY = "https://registry.npmjs.org/";
     GUARDIAN_GLOBAL_INSTALL_COMMAND = `npm install -g ${GUARDIAN_NPM_PACKAGE_NAME}`;
     GUARDIAN_NPX_SETUP_COMMAND = `npx ${GUARDIAN_NPM_PACKAGE_NAME}@latest setup`;
     GUARDIAN_FIRST_RUN_COMMAND = "guardian setup";
-    GUARDIAN_OPEN_CONTROL_TOWER_COMMAND = "guardian launch";
+    GUARDIAN_OPEN_CONTROL_TOWER_COMMAND = "guardian open";
+    GUARDIAN_RELEASE_DISPATCH_WORKFLOW = "guardian-release-dispatch.yml";
+    GUARDIAN_RELEASE_REPOSITORY = "Intelligent-Context-AI-Inc/ContextECF-GITHUB";
     GUARDIAN_DEFAULT_CONTROL_TOWER_URL = "http://127.0.0.1:4317/control-tower";
     GUARDIAN_LOCAL_DATA_ENCRYPTION_KEY_ENV = "GUARDIAN_LOCAL_DATA_ENCRYPTION_KEY";
     GUARDIAN_LOCAL_DATA_ENCRYPTION_KEY_ID_ENV = "GUARDIAN_LOCAL_DATA_ENCRYPTION_KEY_ID";
@@ -22749,28 +23575,6 @@ var init_runtime = __esm({
           "Release evidence includes artifact digests without signing secrets."
         ]
       },
-      {
-        id: "browser-store-distribution",
-        label: "Browser store distribution",
-        boundary: "Pending store submission, review, and release evidence.",
-        owner: "browser-release",
-        runtimeBoundary: "Pending store submission, review, and release evidence.",
-        releaseBoundary: "Browser store approval and listing evidence are not yet proven.",
-        evidencePacket: "browser-store-distribution",
-        evidenceRequiredFields: [
-          "stores",
-          "submitted_versions",
-          "review_status",
-          "package_digest_matches_release",
-          "listing_boundary_proof"
-        ],
-        closesWhen: [
-          "Chrome Web Store package id, version, and approval state are recorded.",
-          "Any claimed Edge or Firefox store distribution has matching approval evidence.",
-          "Store package digest matches the validated MV3 release artifact.",
-          "Store listing text uses the same proven/not-proven boundary."
-        ]
-      },
       {
         id: "high-risk-desktop-action-execution",
         label: "High-risk desktop action execution after authorization",
@@ -22851,19 +23655,26 @@ No global install:
 
 Open Control Tower:
   ${GUARDIAN_OPEN_CONTROL_TOWER_COMMAND}
-  aliases: guardian tower, guardian control-tower
+  start aliases: guardian launch, guardian tower, guardian control-tower
 
 Usage:
   guardian --version
   guardian version [--json]
-  guardian setup [--json] [--print] [--host=127.0.0.1] [--port=4317] [--no-launch] [--no-mcp] [--extension-id=<chrome-extension-id>]
+  guardian setup [--json] [--open] [--print] [--host=127.0.0.1] [--port=4317] [--no-launch] [--no-mcp] [--extension-id=<chrome-extension-id>]
   guardian install [--json]
   guardian doctor [--json]
   guardian readiness [--json] [--strict]
+  guardian release checklist --version=<semver> [--json]
+  guardian release flow --version=<semver> [--json]
+  guardian release verify --version=<semver> [--json]
+  guardian release paste --version=<semver> [--json]
+  guardian release command --version=<semver> [--publish|--dry-run=false] [--channels=all|npm|browser|evidence] [--run-docker-smoke=true|false] [--json]
+  guardian release secrets [--json]
+  guardian release browser-store [--json]
   guardian open [--json] [--print] [--url=http://127.0.0.1:<port>]
   guardian status [--json]
   guardian start [--json] [--host=127.0.0.1] [--port=4317]
-  guardian launch|tower|control-tower [--json] [--print] [--host=127.0.0.1] [--port=4317]
+  guardian launch|tower|control-tower [--json] [--open] [--print] [--host=127.0.0.1] [--port=4317]
   guardian stop [--json] [--url=http://127.0.0.1:<port>/control-tower]
   guardian service install [--json] [--platform=auto|launchd|systemd|windows-task-scheduler] [--force]
   guardian service status [--json]
@@ -22919,6 +23730,7 @@ Defaults are local-first: raw capture, cloud sync, learning graph, and app autop
       "permissions.json"
     ];
     GUARDIAN_DATA_DIR_NAMES = ["ecl", "receipts", "mcp"];
+    GUARDIAN_MIN_SUPPORTED_NODE_VERSION = [20, 20, 0];
   }
 });
 
@@ -23837,10 +24649,16 @@ function confirmationTokenFor(receipt, actionRequest) {
   return `guardian-confirm:${stableId(
     receipt.receipt_hash,
     actionRequest.action_id,
+    actionRequest.app_id,
     actionRequest.action_type,
-    actionRequest.payload_hash
+    actionRequest.target_ref,
+    actionRequest.payload_hash,
+    normalizedPolicyPackBinding(actionRequest.policy_pack_ids)
   )}`;
 }
+function normalizedPolicyPackBinding(policyPackIds) {
+  return [...new Set(policyPackIds)].sort().join(",");
+}
 function buildLocalActionExecutionPlan(actionRequest, receipt, now) {
   const core = {
     action_id: actionRequest.action_id,
@@ -24937,6 +25755,7 @@ __export(daemon_exports, {
   processGuardianControlTowerSourcePermissionRequest: () => processGuardianControlTowerSourcePermissionRequest,
   processGuardianDaemonHealthRequest: () => processGuardianDaemonHealthRequest,
   processGuardianDaemonStopRequest: () => processGuardianDaemonStopRequest,
+  processGuardianLiveCoachEventRequest: () => processGuardianLiveCoachEventRequest,
   readGuardianDaemonJsonBody: () => readGuardianDaemonJsonBody,
   renderControlTowerStatusPage: () => renderControlTowerStatusPage,
   startGuardianDaemonLoopback: () => startGuardianDaemonLoopback
@@ -25063,7 +25882,8 @@ async function handleRequest(input2) {
     writeJson(input2.response, 200, {
       ok: true,
       service: "project-guardian-daemon",
-      rawContentPersistence: false
+      rawContentPersistence: false,
+      version: GUARDIAN_CLI_VERSION
     });
     return;
   }
@@ -25217,6 +26037,24 @@ async function handleRequest(input2) {
     writeAdminResponse(input2.response, result2.statusCode, result2.body, parsedBody2.redirect);
     return;
   }
+  if (input2.request.method === "POST" && input2.request.url === "/v1/guardian/live-coach-event") {
+    const suppliedToken2 = headerValue(input2.request, ADMIN_HEADER);
+    const parsedBody2 = await readGuardianDaemonJsonBody(input2.request);
+    if (!parsedBody2.ok) {
+      writeJson(input2.response, parsedBody2.statusCode, parsedBody2.body);
+      return;
+    }
+    const result2 = await processGuardianLiveCoachEventRequest({
+      profile: input2.profile,
+      token: input2.token,
+      suppliedToken: suppliedToken2,
+      body: parsedBody2.body,
+      now: input2.now,
+      store: input2.store
+    });
+    writeJson(input2.response, result2.statusCode, result2.body);
+    return;
+  }
   if (input2.request.method !== "POST" || input2.request.url !== "/v1/guardian/process-prompt") {
     writeJson(input2.response, 404, { ok: false, error: "not_found" });
     return;
@@ -25252,7 +26090,8 @@ function processGuardianDaemonHealthRequest(input2) {
     body: {
       ok: true,
       service: "project-guardian-daemon",
-      rawContentPersistence: false
+      rawContentPersistence: false,
+      version: GUARDIAN_CLI_VERSION
     }
   };
 }
@@ -25668,6 +26507,44 @@ async function processGuardianBrowserBridgeRequest(input2) {
   });
   return { statusCode: 200, body: { ok: true, decision } };
 }
+async function processGuardianLiveCoachEventRequest(input2) {
+  if (!isAuthorized(input2.token, input2.suppliedToken)) {
+    return {
+      statusCode: 401,
+      body: {
+        ok: false,
+        error: "unauthorized"
+      }
+    };
+  }
+  const envelope = parseLiveCoachEventEnvelope(input2.body);
+  if (!envelope.ok) {
+    return {
+      statusCode: 400,
+      body: {
+        ok: false,
+        error: envelope.error
+      }
+    };
+  }
+  const timestamp = validDateTime(envelope.request.capturedAt) ?? input2.now().toISOString();
+  const transactionId = `txn:browser-live-coach:${digest4(
+    `${envelope.request.provider}:${envelope.request.destination}:${envelope.request.category}:${timestamp}`
+  ).slice(0, 20)}`;
+  const receipt = buildLiveCoachReceipt(envelope.request, transactionId, timestamp);
+  await input2.store.putReceipt(receipt);
+  await input2.store.appendEvent(
+    buildLiveCoachEvent(envelope.request, transactionId, timestamp, receipt)
+  );
+  return {
+    statusCode: 200,
+    body: {
+      ok: true,
+      receipt_id: receipt.receipt_id,
+      raw_content_included: false
+    }
+  };
+}
 async function processBrowserPrompt(input2) {
   const timestamp = validDateTime(input2.request.capturedAt) ?? input2.now().toISOString();
   const transactionId = `txn:browser:${digest4(`${input2.request.promptText}:${timestamp}`).slice(0, 20)}`;
@@ -25846,6 +26723,95 @@ function parseBridgeEnvelope(value) {
     }
   };
 }
+function parseLiveCoachEventEnvelope(value) {
+  if (typeof value !== "object" || value === null) {
+    return { ok: false, error: "invalid_json_body" };
+  }
+  const envelope = value;
+  if (envelope.adapter !== "browser_mv3" || typeof envelope.request !== "object" || envelope.request === null) {
+    return { ok: false, error: "invalid_guardian_adapter_envelope" };
+  }
+  const candidate = envelope.request;
+  if ("promptText" in candidate || "rawPrompt" in candidate || "detectedValue" in candidate) {
+    return { ok: false, error: "raw_content_not_allowed_for_live_coach_event" };
+  }
+  const provider = parseProvider(candidate.provider);
+  const destination = stringField(candidate, "destination");
+  const pageOrigin = stringField(candidate, "pageOrigin");
+  const category = parseLiveCoachCategory(candidate.category);
+  const capturedAt = stringField(candidate, "capturedAt");
+  if (!destination || !pageOrigin || !category || !capturedAt) {
+    return { ok: false, error: "missing_required_live_coach_event_fields" };
+  }
+  return {
+    ok: true,
+    request: {
+      provider,
+      destination,
+      pageOrigin,
+      category,
+      capturedAt
+    }
+  };
+}
+function parseLiveCoachCategory(value) {
+  return value === "ssn" || value === "password" || value === "secret" || value === "payment" || value === "health" ? value : void 0;
+}
+function buildLiveCoachReceipt(request, transactionId, timestamp) {
+  const core = {
+    transaction_id: transactionId,
+    provider: request.provider,
+    destination_hash: digest4(request.destination),
+    page_origin_hash: digest4(request.pageOrigin),
+    category: request.category,
+    created_at: timestamp,
+    raw_content_included: false
+  };
+  return {
+    schema_version: PERSONAL_FABRIC_CONTRACTS_SCHEMA_VERSION,
+    receipt_id: `receipt:${transactionId}:live-coach`,
+    transaction_id: transactionId,
+    receipt_type: "policy",
+    disposition: "warn",
+    policy_basis: [
+      "live-sensitive-prompt-coach",
+      `category:${request.category}`,
+      `provider:${request.provider}`
+    ],
+    receipt_hash: `sha256:${digest4(JSON.stringify(core))}`,
+    raw_content_included: false,
+    created_at: timestamp,
+    summary: `Guardian flagged ${liveCoachCategoryLabel(request.category)} while drafting in ${providerDisplayName(request.provider)}.`
+  };
+}
+function buildLiveCoachEvent(request, transactionId, timestamp, receipt) {
+  const payload = {
+    provider: request.provider,
+    destination_hash: digest4(request.destination),
+    page_origin_hash: digest4(request.pageOrigin),
+    category: request.category,
+    raw_content_included: false
+  };
+  return {
+    event_id: `event:${transactionId}:live-coach`,
+    transaction_id: transactionId,
+    event_type: "coach_presented",
+    occurred_at: timestamp,
+    actor: "guardian-daemon",
+    summary: `Live Prompt Coach presented ${request.category} warning.`,
+    payload_hash: `sha256:${digest4(JSON.stringify(payload))}`,
+    receipt_id: receipt.receipt_id,
+    graph_refs: [`provider:${request.provider}`, `receipt:${receipt.receipt_id}`],
+    redaction_state: "metadata_only"
+  };
+}
+function liveCoachCategoryLabel(category) {
+  if (category === "ssn") return "possible SSN sharing";
+  if (category === "password") return "possible credential sharing";
+  if (category === "secret") return "possible secret sharing";
+  if (category === "payment") return "possible financial data";
+  return "possible health information";
+}
 function parseProvider(value) {
   return value === "chatgpt" || value === "claude" || value === "gemini" || value === "perplexity" ? value : "unknown";
 }