@controlvector/cv-agent 1.4.0 → 1.6.0

package/dist/bundle.cjs

@@ -3037,7 +3037,7 @@ var {
 } = import_index.default;
 
 // src/commands/agent.ts
-var import_node_child_process2 = require("node:child_process");
+var import_node_child_process4 = require("node:child_process");
 
 // node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
@@ -3643,7 +3643,7 @@ async function apiCall(creds, method, path, body) {
     body: body ? JSON.stringify(body) : void 0
   });
 }
-async function registerExecutor(creds, machineName, workingDir, repositoryId) {
+async function registerExecutor(creds, machineName, workingDir, repositoryId, metadata) {
   const body = {
     name: `cva:${machineName}`,
     machine_name: machineName,
@@ -3657,6 +3657,11 @@ async function registerExecutor(creds, machineName, workingDir, repositoryId) {
   if (repositoryId) {
     body.repository_id = repositoryId;
   }
+  if (metadata?.role) body.role = metadata.role;
+  if (metadata?.dispatch_guard) body.dispatch_guard = metadata.dispatch_guard;
+  if (metadata?.tags) body.tags = metadata.tags;
+  if (metadata?.owner_project) body.owner_project = metadata.owner_project;
+  if (metadata?.integration) body.integration = metadata.integration;
   const res = await apiCall(creds, "POST", "/api/v1/executors", body);
   if (!res.ok) {
     const err = await res.text();
@@ -4072,6 +4077,15 @@ ${source_default.yellow("\u26A0")} ${label} failed, retrying in ${delay}s... (${
 var import_fs2 = require("fs");
 var import_os2 = require("os");
 var import_path2 = require("path");
+async function readWorkspaceConfig(workspaceRoot) {
+  try {
+    const { readFile } = await import("fs/promises");
+    const content = await readFile((0, import_path2.join)(workspaceRoot, ".cva", "agent.json"), "utf-8");
+    return JSON.parse(content);
+  } catch {
+    return {};
+  }
+}
 function getConfigPath() {
   return (0, import_path2.join)((0, import_os2.homedir)(), ".config", "cva", "config.json");
 }
@@ -4089,6 +4103,277 @@ async function writeConfig(config) {
   await import_fs2.promises.writeFile(configPath, JSON.stringify(config, null, 2) + "\n", { mode: 384 });
 }
 
+// src/commands/git-safety.ts
+var import_node_child_process2 = require("node:child_process");
+function git(cmd, cwd) {
+  return (0, import_node_child_process2.execSync)(cmd, { cwd, encoding: "utf8", timeout: 3e4 }).trim();
+}
+function gitSafetyNet(workspaceRoot, taskTitle, taskId, branch) {
+  const targetBranch = branch || "main";
+  try {
+    let statusOutput;
+    try {
+      statusOutput = git("git status --porcelain", workspaceRoot);
+    } catch {
+      return { hadChanges: false, filesAdded: 0, filesModified: 0, filesDeleted: 0, pushed: false, error: "git status failed" };
+    }
+    const lines = statusOutput.split("\n").filter(Boolean);
+    if (lines.length === 0) {
+      try {
+        const unpushed = git(`git log origin/${targetBranch}..HEAD --oneline 2>/dev/null`, workspaceRoot);
+        if (unpushed) {
+          console.log(`  [git-safety] Found unpushed commits \u2014 pushing now`);
+          git(`git push origin ${targetBranch}`, workspaceRoot);
+          return { hadChanges: false, filesAdded: 0, filesModified: 0, filesDeleted: 0, pushed: true };
+        }
+      } catch {
+      }
+      return { hadChanges: false, filesAdded: 0, filesModified: 0, filesDeleted: 0, pushed: false };
+    }
+    let added = 0, modified = 0, deleted = 0;
+    for (const line of lines) {
+      const code = line.substring(0, 2);
+      if (code.includes("?")) added++;
+      else if (code.includes("D")) deleted++;
+      else if (code.includes("M") || code.includes("A")) modified++;
+      else added++;
+    }
+    console.log(
+      `  [git-safety] ${lines.length} uncommitted changes (${added} new, ${modified} modified, ${deleted} deleted) \u2014 committing now`
+    );
+    git("git add -A", workspaceRoot);
+    const shortId = taskId.substring(0, 8);
+    const commitMsg = `task: ${taskTitle} [${shortId}]
+
+Auto-committed by cv-agent git safety net.
+Task ID: ${taskId}
+Files: ${added} added, ${modified} modified, ${deleted} deleted`;
+    let commitSha;
+    try {
+      const commitOutput = git(`git commit -m ${JSON.stringify(commitMsg)}`, workspaceRoot);
+      const shaMatch = commitOutput.match(/\[[\w/]+ ([a-f0-9]+)\]/);
+      commitSha = shaMatch ? shaMatch[1] : void 0;
+    } catch (e) {
+      if (!e.message?.includes("nothing to commit")) {
+        return {
+          hadChanges: true,
+          filesAdded: added,
+          filesModified: modified,
+          filesDeleted: deleted,
+          pushed: false,
+          error: `Commit failed: ${e.message}`
+        };
+      }
+    }
+    try {
+      git(`git push origin ${targetBranch}`, workspaceRoot);
+      console.log(`  [git-safety] Committed and pushed: ${commitSha || "ok"}`);
+    } catch (pushErr) {
+      console.log(`  [git-safety] Push failed: ${pushErr.message}`);
+      return {
+        hadChanges: true,
+        filesAdded: added,
+        filesModified: modified,
+        filesDeleted: deleted,
+        commitSha,
+        pushed: false,
+        error: `Push failed: ${pushErr.message}`
+      };
+    }
+    return {
+      hadChanges: true,
+      filesAdded: added,
+      filesModified: modified,
+      filesDeleted: deleted,
+      commitSha,
+      pushed: true
+    };
+  } catch (err) {
+    return {
+      hadChanges: false,
+      filesAdded: 0,
+      filesModified: 0,
+      filesDeleted: 0,
+      pushed: false,
+      error: err.message
+    };
+  }
+}
+
+// src/commands/deploy-manifest.ts
+var import_node_child_process3 = require("node:child_process");
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
+function exec(cmd, cwd, timeoutMs = 3e5, env2) {
+  try {
+    const stdout = (0, import_node_child_process3.execSync)(cmd, {
+      cwd,
+      encoding: "utf8",
+      timeout: timeoutMs,
+      env: env2 ? { ...process.env, ...env2 } : void 0,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return { ok: true, stdout, stderr: "" };
+  } catch (err) {
+    return { ok: false, stdout: err.stdout || "", stderr: err.stderr || err.message || "" };
+  }
+}
+async function httpStatus(url, timeoutMs = 1e4) {
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    const res = await fetch(url, { signal: controller.signal });
+    clearTimeout(timer);
+    return res.status;
+  } catch {
+    return 0;
+  }
+}
+async function checkHealth(url, timeoutSeconds) {
+  const deadline = Date.now() + timeoutSeconds * 1e3;
+  while (Date.now() < deadline) {
+    const status = await httpStatus(url);
+    if (status >= 200 && status < 500) return true;
+    await new Promise((r) => setTimeout(r, 2e3));
+  }
+  return false;
+}
+function getHeadCommit(cwd) {
+  try {
+    return (0, import_node_child_process3.execSync)("git rev-parse HEAD", { cwd, encoding: "utf8", timeout: 5e3 }).trim();
+  } catch {
+    return null;
+  }
+}
+function loadDeployManifest(workspaceRoot) {
+  const manifestPath = (0, import_node_path.join)(workspaceRoot, ".cva", "deploy.json");
+  if (!(0, import_node_fs.existsSync)(manifestPath)) return null;
+  try {
+    const raw = (0, import_node_fs.readFileSync)(manifestPath, "utf8");
+    const manifest = JSON.parse(raw);
+    if (!manifest.version || manifest.version < 1) {
+      console.log("  [deploy] Invalid manifest version");
+      return null;
+    }
+    return manifest;
+  } catch (err) {
+    console.log(`  [deploy] Failed to read .cva/deploy.json: ${err.message}`);
+    return null;
+  }
+}
+async function postTaskDeploy(workspaceRoot, taskId, log) {
+  const manifest = loadDeployManifest(workspaceRoot);
+  if (!manifest) {
+    return { deployed: false, steps: [{ step: "manifest", status: "skipped", message: "No .cva/deploy.json" }] };
+  }
+  const steps = [];
+  const preDeployCommit = getHeadCommit(workspaceRoot);
+  if (manifest.build?.steps) {
+    for (const buildStep of manifest.build.steps) {
+      const stepName = `build:${buildStep.name}`;
+      console.log(`  [deploy] Building: ${buildStep.name}`);
+      log("lifecycle", `Building: ${buildStep.name}`);
+      const start = Date.now();
+      const cwd = (0, import_node_path.join)(workspaceRoot, buildStep.working_dir || ".");
+      const timeoutMs = (buildStep.timeout_seconds || 300) * 1e3;
+      const result = exec(buildStep.command, cwd, timeoutMs);
+      if (!result.ok) {
+        const msg = `Build failed: ${buildStep.name}
+${result.stderr.slice(-500)}`;
+        steps.push({ step: stepName, status: "failed", message: msg, durationMs: Date.now() - start });
+        log("error", msg);
+        return { deployed: false, steps, error: msg };
+      }
+      steps.push({ step: stepName, status: "ok", durationMs: Date.now() - start });
+    }
+  }
+  if (manifest.migrate?.command) {
+    console.log("  [deploy] Running migration...");
+    log("lifecycle", "Applying database migration");
+    const start = Date.now();
+    const env2 = manifest.migrate.env || {};
+    const result = exec(manifest.migrate.command, workspaceRoot, 6e4, env2);
+    if (!result.ok) {
+      const msg = `Migration failed:
+${result.stderr.slice(-500)}`;
+      steps.push({ step: "migrate", status: "failed", message: msg, durationMs: Date.now() - start });
+      log("error", msg);
+      return { deployed: false, steps, error: msg };
+    }
+    steps.push({ step: "migrate", status: "ok", durationMs: Date.now() - start });
+  }
+  if (manifest.service && manifest.service.type !== "none" && manifest.service.restart_command) {
+    console.log(`  [deploy] Restarting service: ${manifest.service.name || "default"}`);
+    log("lifecycle", `Restarting service: ${manifest.service.name || "default"}`);
+    const start = Date.now();
+    const result = exec(manifest.service.restart_command, workspaceRoot, 3e4);
+    if (!result.ok) {
+      const msg = `Restart failed:
+${result.stderr.slice(-300)}`;
+      steps.push({ step: "restart", status: "failed", message: msg, durationMs: Date.now() - start });
+    } else {
+      steps.push({ step: "restart", status: "ok", durationMs: Date.now() - start });
+    }
+    const waitMs = (manifest.service.startup_wait_seconds || 5) * 1e3;
+    await new Promise((r) => setTimeout(r, waitMs));
+  }
+  if (manifest.verify) {
+    console.log("  [deploy] Verifying deployment...");
+    log("lifecycle", "Verifying deployment");
+    const timeoutSec = manifest.verify.timeout_seconds || 30;
+    if (manifest.verify.health_url) {
+      const healthy = await checkHealth(manifest.verify.health_url, timeoutSec);
+      if (!healthy) {
+        const msg = `Health check failed: ${manifest.verify.health_url} did not respond within ${timeoutSec}s`;
+        steps.push({ step: "verify:health", status: "failed", message: msg });
+        log("error", msg);
+        if (manifest.rollback?.auto_rollback_on_verify_failure && preDeployCommit) {
+          await rollback(workspaceRoot, preDeployCommit, manifest, log);
+          return { deployed: false, steps, error: msg, rolledBack: true };
+        }
+        return { deployed: false, steps, error: msg };
+      }
+      steps.push({ step: "verify:health", status: "ok" });
+    }
+    for (const test of manifest.verify.smoke_tests || []) {
+      const status = await httpStatus(test.url);
+      if (!test.expected_status.includes(status)) {
+        const msg = `Smoke test "${test.name}" failed: got ${status}, expected ${test.expected_status.join("|")}`;
+        steps.push({ step: `verify:${test.name}`, status: "failed", message: msg });
+        log("error", msg);
+        if (manifest.rollback?.auto_rollback_on_verify_failure && preDeployCommit) {
+          await rollback(workspaceRoot, preDeployCommit, manifest, log);
+          return { deployed: false, steps, error: msg, rolledBack: true };
+        }
+        return { deployed: false, steps, error: msg };
+      }
+      steps.push({ step: `verify:${test.name}`, status: "ok" });
+    }
+  }
+  console.log("  [deploy] Deployment verified");
+  log("lifecycle", "Deployment verified successfully");
+  return { deployed: true, steps };
+}
+async function rollback(workspaceRoot, targetCommit, manifest, log) {
+  console.log(`  [deploy] Rolling back to ${targetCommit.substring(0, 8)}`);
+  log("lifecycle", `Rolling back to ${targetCommit.substring(0, 8)}`);
+  try {
+    exec(`git checkout ${targetCommit}`, workspaceRoot, 1e4);
+  } catch {
+    log("error", "Rollback: git checkout failed");
+    return;
+  }
+  if (manifest.build?.steps) {
+    for (const step of manifest.build.steps) {
+      exec(step.command, (0, import_node_path.join)(workspaceRoot, step.working_dir || "."), (step.timeout_seconds || 300) * 1e3);
+    }
+  }
+  if (manifest.service?.restart_command) {
+    exec(manifest.service.restart_command, workspaceRoot, 3e4);
+  }
+  log("lifecycle", "Rollback complete");
+}
+
 // src/commands/agent.ts
 var AUTH_ERROR_PATTERNS = [
   "Not logged in",
@@ -4110,7 +4395,7 @@ function containsAuthError(text) {
 }
 async function checkClaudeAuth() {
   try {
-    const output = (0, import_node_child_process2.execSync)("claude --version 2>&1", {
+    const output = (0, import_node_child_process4.execSync)("claude --version 2>&1", {
       encoding: "utf8",
       timeout: 1e4,
       env: { ...process.env }
@@ -4321,7 +4606,7 @@ async function launchAutoApproveMode(prompt, options) {
       if (sessionId && !isContinue) {
         args.push("--session-id", sessionId);
       }
-      const child = (0, import_node_child_process2.spawn)("claude", args, {
+      const child = (0, import_node_child_process4.spawn)("claude", args, {
         cwd: options.cwd,
         stdio: ["inherit", "pipe", "pipe"],
         env: options.spawnEnv || { ...process.env }
@@ -4455,7 +4740,7 @@ ${source_default.red("!")} Claude Code auth failure (stderr): "${authError}"`);
 }
 async function launchRelayMode(prompt, options) {
   return new Promise((resolve, reject) => {
-    const child = (0, import_node_child_process2.spawn)("claude", [], {
+    const child = (0, import_node_child_process4.spawn)("claude", [], {
       cwd: options.cwd,
       stdio: ["pipe", "pipe", "pipe"],
       env: options.spawnEnv || { ...process.env }
@@ -4681,19 +4966,19 @@ async function handleSelfUpdate(task, state, creds) {
     let output = "";
     if (source === "npm" || source.startsWith("npm:")) {
       const pkg = source === "npm" ? "@controlvector/cv-agent@latest" : source.replace("npm:", "");
-      output = (0, import_node_child_process2.execSync)(`npm install -g ${pkg} 2>&1`, { encoding: "utf8", timeout: 12e4 });
+      output = (0, import_node_child_process4.execSync)(`npm install -g ${pkg} 2>&1`, { encoding: "utf8", timeout: 12e4 });
     } else if (source.startsWith("git:")) {
       const repoPath = source.replace("git:", "");
-      output = (0, import_node_child_process2.execSync)(`cd ${repoPath} && git pull && npm install && npm run build && npm link 2>&1`, {
+      output = (0, import_node_child_process4.execSync)(`cd ${repoPath} && git pull && npm install && npm run build && npm link 2>&1`, {
         encoding: "utf8",
         timeout: 3e5
       });
     } else {
-      output = (0, import_node_child_process2.execSync)(`npm install -g @controlvector/cv-agent@latest 2>&1`, { encoding: "utf8", timeout: 12e4 });
+      output = (0, import_node_child_process4.execSync)(`npm install -g @controlvector/cv-agent@latest 2>&1`, { encoding: "utf8", timeout: 12e4 });
     }
     let newVersion = "unknown";
     try {
-      newVersion = (0, import_node_child_process2.execSync)("cva --version 2>/dev/null || echo unknown", { encoding: "utf8" }).trim();
+      newVersion = (0, import_node_child_process4.execSync)("cva --version 2>/dev/null || echo unknown", { encoding: "utf8" }).trim();
     } catch {
     }
     postTaskEvent(creds, task.id, {
@@ -4719,7 +5004,7 @@ async function handleSelfUpdate(task, state, creds) {
     if (task.input?.constraints?.includes("restart")) {
       console.log(source_default.yellow("Restarting agent with updated binary..."));
       const args = process.argv.slice(1).join(" ");
-      (0, import_node_child_process2.execSync)(`nohup cva ${args} > /tmp/cva-restart.log 2>&1 &`, { stdio: "ignore" });
+      (0, import_node_child_process4.execSync)(`nohup cva ${args} > /tmp/cva-restart.log 2>&1 &`, { stdio: "ignore" });
       process.exit(0);
     }
   } catch (err) {
@@ -4751,7 +5036,7 @@ async function runAgent(options) {
     process.exit(1);
   }
   try {
-    (0, import_node_child_process2.execSync)("claude --version", { stdio: "pipe", timeout: 5e3 });
+    (0, import_node_child_process4.execSync)("claude --version", { stdio: "pipe", timeout: 5e3 });
   } catch {
     console.log();
     console.log(source_default.red("Claude Code CLI not found.") + " Install it first:");
@@ -4780,7 +5065,7 @@ async function runAgent(options) {
     currentAuthStatus = "api_key_fallback";
   }
   try {
-    (0, import_node_child_process2.execSync)("cv --version", { stdio: "pipe", timeout: 5e3 });
+    (0, import_node_child_process4.execSync)("cv --version", { stdio: "pipe", timeout: 5e3 });
   } catch {
     console.log(source_default.yellow("!") + " cv-git CLI not found. Claude Code will fall back to raw git commands.");
     console.log(`  Install it: ${source_default.cyan("npm install -g @controlvector/cv-git")}`);
@@ -4800,7 +5085,7 @@ async function runAgent(options) {
   }
   let detectedRepoId;
   try {
-    const remoteUrl = (0, import_node_child_process2.execSync)("git remote get-url origin 2>/dev/null", {
+    const remoteUrl = (0, import_node_child_process4.execSync)("git remote get-url origin 2>/dev/null", {
       cwd: workingDir,
       encoding: "utf8",
       timeout: 5e3
@@ -4821,8 +5106,47 @@ async function runAgent(options) {
     }
   } catch {
   }
+  const wsConfig = await readWorkspaceConfig(workingDir);
+  const globalConfig = await readConfig();
+  const role = options.role || wsConfig.role || globalConfig.role || "development";
+  const dispatchGuard = options.dispatchGuard || wsConfig.dispatch_guard || globalConfig.dispatch_guard || "open";
+  const tags = (options.tags?.split(",") || wsConfig.tags || globalConfig.tags)?.map((t) => t.trim()).filter(Boolean);
+  const ownerProject = options.ownerProject || wsConfig.owner_project || globalConfig.owner_project;
+  let integration;
+  if (options.integration || wsConfig.integration) {
+    if (options.integration) {
+      const safeTasks = options.safeTasks?.split(",").map((t) => t.trim()).filter(Boolean);
+      const unsafeTasks = safeTasks ? ["code_change", "deploy", "test", "custom"].filter((t) => !safeTasks.includes(t)) : void 0;
+      integration = {
+        system: options.integration,
+        description: options.integrationDescription || `Integrated into ${options.integration}`,
+        service_port: options.integrationPort ? parseInt(options.integrationPort, 10) : void 0,
+        safe_task_types: safeTasks,
+        unsafe_task_types: unsafeTasks
+      };
+    } else if (wsConfig.integration) {
+      integration = wsConfig.integration;
+    }
+  }
+  const executorMeta = {
+    role,
+    dispatch_guard: dispatchGuard,
+    tags,
+    owner_project: ownerProject,
+    integration
+  };
+  if (role !== "development") {
+    console.log(source_default.yellow(`   Role:     ${role}`));
+  }
+  if (integration) {
+    console.log(source_default.yellow(`   Integration: ${integration.system}${integration.service_port ? ` (port ${integration.service_port})` : ""}`));
+  }
+  if (dispatchGuard !== "open") {
+    const guardIcon = dispatchGuard === "locked" ? "\u{1F512}" : "\u26A0\uFE0F";
+    console.log(source_default.yellow(`   Guard:    ${guardIcon} ${dispatchGuard}`));
+  }
   const executor = await withRetry(
-    () => registerExecutor(creds, machineName, workingDir, detectedRepoId),
+    () => registerExecutor(creds, machineName, workingDir, detectedRepoId, executorMeta),
     "Executor registration"
   );
   const mode = options.autoApprove ? "auto-approve" : "relay";
@@ -4970,6 +5294,33 @@ ${source_default.red("Timeout")} Task timed out after ${formatDuration(timeoutMs
       });
     }
     console.log(source_default.gray("\n" + "-".repeat(60)));
+    if (result.exitCode === 0 || result.exitCode === 1) {
+      try {
+        const gitSafety = gitSafetyNet(
+          options.workingDir,
+          task.title,
+          task.id,
+          task.branch
+        );
+        if (gitSafety.hadChanges) {
+          sendTaskLog(
+            creds,
+            state.executorId,
+            task.id,
+            "git",
+            `Safety net: committed ${gitSafety.filesAdded + gitSafety.filesModified} files (${gitSafety.commitSha || "ok"})`,
+            { added: gitSafety.filesAdded, modified: gitSafety.filesModified, deleted: gitSafety.filesDeleted }
+          );
+        } else if (gitSafety.pushed) {
+          sendTaskLog(creds, state.executorId, task.id, "git", "Safety net: pushed unpushed commits");
+        }
+        if (gitSafety.error) {
+          sendTaskLog(creds, state.executorId, task.id, "info", `Git safety warning: ${gitSafety.error}`);
+        }
+      } catch (gitErr) {
+        sendTaskLog(creds, state.executorId, task.id, "info", `Git safety net error: ${gitErr.message}`);
+      }
+    }
     const postGitState = capturePostTaskState(options.workingDir, preGitState);
     const payload = buildCompletionPayload(result.exitCode, preGitState, postGitState, startTime, result.output);
     const elapsed = formatDuration(Date.now() - startTime);
@@ -4978,6 +5329,28 @@ ${source_default.red("Timeout")} Task timed out after ${formatDuration(timeoutMs
       ...postGitState.filesModified,
       ...postGitState.filesDeleted
     ];
+    let deployResult;
+    if (result.exitCode === 0) {
+      try {
+        const logFn = (type, msg) => {
+          sendTaskLog(creds, state.executorId, task.id, type, msg);
+        };
+        deployResult = await postTaskDeploy(options.workingDir, task.id, logFn);
+        if (deployResult.deployed) {
+          sendTaskLog(creds, state.executorId, task.id, "lifecycle", "Post-task deploy: verified");
+        } else if (deployResult.error) {
+          sendTaskLog(
+            creds,
+            state.executorId,
+            task.id,
+            "error",
+            `Post-task deploy failed: ${deployResult.error}${deployResult.rolledBack ? " (rolled back)" : ""}`
+          );
+        }
+      } catch (deployErr) {
+        sendTaskLog(creds, state.executorId, task.id, "info", `Deploy manifest error: ${deployErr.message}`);
+      }
+    }
     postTaskEvent(creds, task.id, {
       event_type: "completed",
       content: {
@@ -5121,6 +5494,14 @@ function agentCommand() {
   cmd.option("--poll-interval <seconds>", "How often to check for tasks, minimum 3 (default: 5)", "5");
   cmd.option("--working-dir <path>", "Working directory for Claude Code (default: current directory)", ".");
   cmd.option("--auto-approve", "Pre-approve all tool permissions (uses -p mode)", false);
+  cmd.option("--role <role>", "Executor role: development, production, ci, staging");
+  cmd.option("--integration <system>", "System this executor is integrated into (e.g. nyx-forge)");
+  cmd.option("--integration-description <desc>", "Description of the integration");
+  cmd.option("--integration-port <port>", "Port the integrated service runs on");
+  cmd.option("--safe-tasks <types>", "Comma-separated task types safe for this executor (e.g. review,research)");
+  cmd.option("--dispatch-guard <guard>", "Dispatch guard: open, confirm, locked (default: open)");
+  cmd.option("--tags <tags>", "Comma-separated tags for this executor");
+  cmd.option("--owner-project <project>", "Project this executor belongs to");
   cmd.action(async (opts) => {
     await runAgent(opts);
   });
@@ -5228,7 +5609,7 @@ function authCommand() {
 }
 
 // src/commands/remote.ts
-var import_node_child_process3 = require("node:child_process");
+var import_node_child_process5 = require("node:child_process");
 function getGitHost(apiUrl) {
   return apiUrl.replace(/^https?:\/\//, "").replace(/^api\./, "git.");
 }
@@ -5243,16 +5624,16 @@ async function remoteAdd(ownerRepo) {
   }
   const remoteUrl = `https://${gitHost}/${owner}/${repo}.git`;
   try {
-    const existing = (0, import_node_child_process3.execSync)("git remote get-url cvhub", { encoding: "utf-8", timeout: 5e3 }).trim();
+    const existing = (0, import_node_child_process5.execSync)("git remote get-url cvhub", { encoding: "utf-8", timeout: 5e3 }).trim();
     if (existing === remoteUrl) {
       console.log(source_default.gray(`Remote 'cvhub' already set to ${remoteUrl}`));
       return;
     }
-    (0, import_node_child_process3.execSync)(`git remote set-url cvhub ${remoteUrl}`, { timeout: 5e3 });
+    (0, import_node_child_process5.execSync)(`git remote set-url cvhub ${remoteUrl}`, { timeout: 5e3 });
     console.log(source_default.green("Updated") + ` remote 'cvhub' -> ${remoteUrl}`);
   } catch {
     try {
-      (0, import_node_child_process3.execSync)(`git remote add cvhub ${remoteUrl}`, { timeout: 5e3 });
+      (0, import_node_child_process5.execSync)(`git remote add cvhub ${remoteUrl}`, { timeout: 5e3 });
       console.log(source_default.green("Added") + ` remote 'cvhub' -> ${remoteUrl}`);
     } catch (err) {
       console.log(source_default.red("Failed to add remote:") + ` ${err.message}`);
@@ -5444,7 +5825,7 @@ function statusCommand() {
 
 // src/index.ts
 var program2 = new Command();
-program2.name("cva").description("CV-Hub Agent \u2014 bridges Claude Code with CV-Hub task dispatch").version(true ? "1.4.0" : "1.1.0");
+program2.name("cva").description("CV-Hub Agent \u2014 bridges Claude Code with CV-Hub task dispatch").version(true ? "1.6.0" : "1.1.0");
 program2.addCommand(agentCommand());
 program2.addCommand(authCommand());
 program2.addCommand(remoteCommand());