@decantr/cli 2.9.7 → 2.9.8

package/README.md

@@ -17,7 +17,7 @@ Or run it without installing:
 npx @decantr/cli new my-app --blueprint=esports-hq
 ```
 
-Use `decantr setup` when you are unsure which path applies. It detects whether the repo is empty, already attached, or a Brownfield app and recommends the next command.
+Use `decantr setup` when you are unsure which path applies. It detects whether the repo is empty, already attached, or a Brownfield app and recommends the right entry path.
 Use `decantr new` for a greenfield workspace in a fresh directory. With a blueprint/archetype it uses the runnable adapter and Decantr CSS; without registry content it creates a contract-only workspace unless you explicitly pass `--adoption=decantr-css`.
 Use `decantr adopt` when you already have an app and want Decantr governance without adopting a blueprint. Brownfield attach is proposal-driven: Decantr inventories the app, writes an observed essence proposal, hydrates hosted execution packs when online, and only applies the contract when you explicitly accept or merge it.
 Use `decantr doctor` when the next step is unclear, `decantr task` before asking an LLM to modify a route, `decantr verify` after the edit, and `decantr ci` in required automation. Use `decantr codify --from-audit` when you want project-owned UI patterns and local rules such as button/card/shell/theme standards to appear in future task context and verification.
@@ -96,6 +96,12 @@ Brownfield analysis also writes `.decantr/doctrine-map.json`, a ranked source-pr
 - syncs paginated hosted registry content into a full slug-keyed local cache for offline guards and context generation
 - validates, refreshes, and maintains `decantr.essence.json`
 
+## Security And Permissions
+
+The CLI is intentionally a local project inspector and artifact writer. It reads selected project/workspace files, package manifests, routing/style/config files, `.decantr` artifacts, and Decantr cache/config files. It writes `decantr.essence.json`, `DECANTR.md`, `.decantr/*`, generated context packs, optional CI workflows/snippets, optional style/export files, and auth/telemetry config only when explicitly requested.
+
+Telemetry is disabled by default. Hosted registry, hosted pack hydration, hosted critique/audit, and browser evidence are explicit command paths; screenshots and Evidence Bundles stay local unless a hosted workflow is invoked. Release audits prove the installed package with `npm pack --dry-run --json`. See [security permissions](https://decantr.ai/reference/security-permissions.md).
+
 ## Common Commands
 
 ```bash
@@ -142,7 +148,7 @@ decantr showcase verification --json
 
 `decantr verify` is the workflow command most users should run locally after edits. It delegates to Project Health, can add Brownfield guard validation with `--brownfield`, requires an accepted local pattern pack with `--local-patterns`, scans `.decantr/rules.json` when present, supports workspace mode, and writes evidence to `.decantr/evidence/latest.json` by default when `--evidence` is used.
 
-`decantr doctor` explains project/workspace state, adoption mode, generated artifacts, local law, visual evidence, design authority signals, CI wiring, and the next command to run. It is the command to reach for when an app is in a monorepo, has stale Decantr files, or someone is not sure what Decantr expects next.
+`decantr doctor` explains project/workspace state, adoption mode, generated artifacts, local law, visual evidence, design authority signals, CI wiring, and an ordered next-step queue. It is the command to reach for when an app is in a monorepo, has stale Decantr files, or someone is not sure what Decantr expects next.
 
 `decantr setup` is non-mutating orientation. In an attached Brownfield app it reflects whether local law is already accepted, so the recommended verify command includes `--local-patterns` only when the project has that layer.
 

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "./chunk-66L74ZNJ.js";
+import "./chunk-JSILTE5V.js";
 import "./chunk-IQZCIMQJ.js";
 import "./chunk-QDMXZSVK.js";
 import "./chunk-WPP3JEMC.js";

package/dist/{chunk-66L74ZNJ.js → chunk-JSILTE5V.js}

@@ -3025,7 +3025,8 @@ var RESET2 = "\x1B[0m";
 var GREEN2 = "\x1B[32m";
 var CYAN = "\x1B[36m";
 var YELLOW2 = "\x1B[33m";
-async function cmdAnalyze(projectRoot = process.cwd(), workspace) {
+async function cmdAnalyze(projectRoot = process.cwd(), workspace, options = {}) {
+  const printNextStep = options.printNextStep ?? true;
   const startedAt = Date.now();
   console.log(`
 ${BOLD}Analyzing project...${RESET2}
@@ -3190,11 +3191,13 @@ ${DIM2}Written to:${RESET2} ${outputPath}`);
   console.log(`${DIM2}Brownfield intelligence:${RESET2} ${intelligenceArtifacts.intelligencePath}`);
   console.log(`${DIM2}Theme inventory:${RESET2} ${intelligenceArtifacts.themeInventoryPath}`);
   console.log(`${DIM2}Enrichment backlog:${RESET2} ${intelligenceArtifacts.backlogPath}`);
-  console.log(
-    `
+  if (printNextStep) {
+    console.log(
+      `
 ${YELLOW2}Next step:${RESET2} Review ${BOLD}${reportDisplayPath}${RESET2}, then run ${BOLD}${recommendedAttachCommand}${RESET2} to attach Decantr using the observed proposal.
 `
-  );
+    );
+  }
   await sendAnalyzeCompletedTelemetry({
     componentCount: components.componentCount,
     dependencyCategoryCount: [
@@ -4462,6 +4465,10 @@ function statusFromIssues(issues, essenceVersion) {
   }
   return "healthy";
 }
+function appendUnique(commands, command) {
+  if (!command) return;
+  if (!commands.includes(command)) commands.push(command);
+}
 function buildDoctorReport(root, args) {
   let projectArg;
   for (let index = 1; index < args.length; index += 1) {
@@ -4495,6 +4502,8 @@ function buildDoctorReport(root, args) {
   const workflowMode = projectJson?.initialized?.workflowMode ?? null;
   const adoptionMode = projectJson?.initialized?.adoptionMode ?? null;
   const packHydrationOptional = adoptionMode === "contract-only";
+  const localPatternsPresent = existsSync16(localPatternsPath(appRoot));
+  const localRulesPresent = existsSync16(localRulesPath(appRoot));
   const missingPackReferences = workspaceMode ? projects.flatMap(
     (project) => collectMissingPackManifestFiles(join18(workspaceRoot, project.path)).map(
       (missing) => `${project.path}/${missing.relativePath}`
@@ -4587,7 +4596,7 @@ function buildDoctorReport(root, args) {
       nextCommand: "decantr registry compile-packs <app-path>/decantr.essence.json --write-context"
     });
   }
-  if (workflowMode === "brownfield-attach" && !existsSync16(localPatternsPath(appRoot))) {
+  if (workflowMode === "brownfield-attach" && !localPatternsPresent) {
     issues.push({
       category: "local-law",
       severity: "info",
@@ -4615,7 +4624,39 @@ function buildDoctorReport(root, args) {
     issues,
     workspaceMode || workspaceInfo.requiresProjectSelection ? "4.0.0" : essenceVersion
   );
-  const recommendedNextCommand = issues.find((issue) => issue.category === "workspace" && issue.nextCommand)?.nextCommand ?? issues.find((issue) => issue.nextCommand)?.nextCommand ?? (workspaceMode ? "decantr ci --workspace" : projectPath ? `decantr ci --project ${projectPath}` : "decantr ci");
+  const projectFlag = projectPath ? ` --project ${projectPath}` : "";
+  const verifyCommand = workflowMode === "brownfield-attach" ? `decantr verify --brownfield --local-patterns${projectFlag}` : workspaceMode ? "decantr ci --workspace" : `decantr verify${projectFlag}`;
+  const ciCommand = workspaceMode ? "decantr ci --workspace --fail-on error" : `decantr ci${projectFlag} --fail-on error`;
+  const recommendedNextCommands = [];
+  const blockingIssue = issues.find((issue) => issue.category === "workspace" && issue.nextCommand) ?? issues.find(
+    (issue) => (issue.category === "setup" || issue.category === "migration") && issue.nextCommand
+  );
+  if (blockingIssue) {
+    appendUnique(recommendedNextCommands, blockingIssue.nextCommand);
+  } else {
+    appendUnique(
+      recommendedNextCommands,
+      issues.find((issue) => issue.category === "ci" && issue.message.includes("not pinned"))?.nextCommand
+    );
+    if (workflowMode === "brownfield-attach" && !localPatternsPresent) {
+      appendUnique(recommendedNextCommands, `decantr codify --from-audit${projectFlag}`);
+      appendUnique(recommendedNextCommands, `decantr codify --accept${projectFlag}`);
+    }
+    appendUnique(
+      recommendedNextCommands,
+      issues.find((issue) => issue.category === "generated-artifact")?.nextCommand
+    );
+    appendUnique(
+      recommendedNextCommands,
+      issues.find((issue) => issue.category === "ci" && issue.message.includes("No Decantr CI"))?.nextCommand
+    );
+    if (workflowMode === "brownfield-attach") {
+      appendUnique(recommendedNextCommands, `decantr task <route> "<change>"${projectFlag}`);
+    }
+    appendUnique(recommendedNextCommands, verifyCommand);
+    appendUnique(recommendedNextCommands, ciCommand);
+  }
+  const recommendedNextCommand = recommendedNextCommands[0] ?? ciCommand;
   return {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     workspaceRoot,
@@ -4647,8 +4688,8 @@ function buildDoctorReport(root, args) {
       missingReferencedFiles: missingPackReferences.slice(0, 25)
     },
     localLaw: {
-      patternsPresent: existsSync16(localPatternsPath(appRoot)),
-      rulesPresent: existsSync16(localRulesPath(appRoot))
+      patternsPresent: localPatternsPresent,
+      rulesPresent: localRulesPresent
     },
     visualEvidence: {
       manifestPresent: existsSync16(join18(appRoot, ".decantr", "evidence", "visual-manifest.json"))
@@ -4656,7 +4697,8 @@ function buildDoctorReport(root, args) {
     designAuthority,
     status,
     issues,
-    recommendedNextCommand
+    recommendedNextCommand,
+    recommendedNextCommands
   };
 }
 function colorForStatus(status) {
@@ -4713,13 +4755,20 @@ function formatDoctorText(report) {
       if (issue.nextCommand) lines.push(`    ${DIM4}${issue.nextCommand}${RESET4}`);
     }
   }
-  lines.push("", `${BOLD3}Next:${RESET4}`, `  ${report.recommendedNextCommand}`, "");
+  lines.push("", `${BOLD3}Next steps:${RESET4}`);
+  for (const [index, command] of report.recommendedNextCommands.entries()) {
+    lines.push(`  ${index + 1}. ${command}`);
+  }
+  if (report.recommendedNextCommands.length === 0) {
+    lines.push(`  ${report.recommendedNextCommand}`);
+  }
+  lines.push("");
   return `${lines.join("\n")}
 `;
 }
 function cmdDoctorHelp() {
   console.log(`
-${BOLD3}decantr doctor${RESET4} \u2014 Explain Decantr state and the next command to run
+${BOLD3}decantr doctor${RESET4} \u2014 Explain Decantr state and the next commands to run
 
 ${BOLD3}Usage:${RESET4}
   decantr doctor [--project <path>] [--workspace] [--json]
@@ -10399,8 +10448,10 @@ async function cmdAdoptWorkflow(args) {
       return;
     }
   }
-  await cmdAnalyze(projectRoot, workspaceInfo);
+  await cmdAnalyze(projectRoot, workspaceInfo, { printNextStep: false });
   if (process.exitCode && process.exitCode !== 0) return;
+  const initCommand = projectArg ? `decantr init --project ${projectArg} --existing ${proposalFlag}` : `decantr init --existing ${proposalFlag}`;
+  console.log(dim3(`Analysis artifacts written; continuing with ${initCommand}.`));
   await cmdInit({
     existing: true,
     yes: true,

package/dist/index.js

@@ -1,4 +1,4 @@
-import "./chunk-66L74ZNJ.js";
+import "./chunk-JSILTE5V.js";
 import "./chunk-IQZCIMQJ.js";
 import "./chunk-QDMXZSVK.js";
 import "./chunk-WPP3JEMC.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decantr/cli",
-  "version": "2.9.7",
+  "version": "2.9.8",
   "description": "Decantr CLI - scaffold, audit, inspect Project Health, and maintain Decantr projects from the terminal",
   "keywords": [
     "decantr",
@@ -49,10 +49,10 @@
   "dependencies": {
     "ajv": "^8.20.0",
     "@decantr/core": "2.1.0",
-    "@decantr/registry": "2.2.0",
     "@decantr/verifier": "2.3.3",
+    "@decantr/telemetry": "2.2.1",
     "@decantr/essence-spec": "2.0.1",
-    "@decantr/telemetry": "2.2.1"
+    "@decantr/registry": "2.2.0"
   },
   "scripts": {
     "build": "tsup",