@delegance/claude-autopilot 5.2.1 → 5.5.2

package/dist/src/cli/index.js

@@ -30,6 +30,7 @@ import { runMigrateV4 } from "./migrate-v4.js";
 import { runMigrateDoctor } from "./migrate-doctor.js";
 import { initMigrate, NoMigrationToolDetectedError } from "./init-migrate.js";
 import { dispatch as runMigrateDispatch } from "../core/migrate/dispatcher.js";
+import { runDeploy, runDeployRollback, runDeployStatus } from "./deploy.js";
 import { findPackageRoot } from "./_pkg-root.js";
 import { GuardrailError } from "../core/errors.js";
 // Format unhandled errors as a one-line user-facing message instead of dumping a
@@ -159,8 +160,8 @@ These are aliases for the flat subcommands; they still work without the 'advance
     }
     args.shift(); // drop 'advanced'
 }
-const SUBCOMMANDS = ['init', 'run', 'scan', 'report', 'explain', 'ignore', 'ci', 'pr', 'fix', 'costs', 'watch', 'hook', 'autoregress', 'baseline', 'triage', 'lsp', 'worker', 'mcp', 'test-gen', 'pr-desc', 'doctor', 'preflight', 'setup', 'council', 'migrate-v4', 'migrate', 'migrate-doctor', 'brainstorm', 'help', '--help', '-h'];
-const VALUE_FLAGS = ['base', 'config', 'files', 'format', 'output', 'debounce', 'ask', 'focus', 'fail-on', 'note', 'reason', 'expires', 'profile', 'severity', 'prompt', 'context-file', 'path'];
+const SUBCOMMANDS = ['init', 'run', 'scan', 'report', 'explain', 'ignore', 'ci', 'pr', 'fix', 'costs', 'watch', 'hook', 'autoregress', 'baseline', 'triage', 'lsp', 'worker', 'mcp', 'test-gen', 'pr-desc', 'doctor', 'preflight', 'setup', 'council', 'migrate-v4', 'migrate', 'migrate-doctor', 'deploy', 'brainstorm', 'help', '--help', '-h'];
+const VALUE_FLAGS = ['base', 'config', 'files', 'format', 'output', 'debounce', 'ask', 'focus', 'fail-on', 'note', 'reason', 'expires', 'profile', 'severity', 'prompt', 'context-file', 'path', 'adapter', 'ref', 'sha'];
 // Bare invocation — no subcommand, no flags → show welcome guide
 if (args.length === 0) {
     const hasKey = !!(process.env.ANTHROPIC_API_KEY || process.env.GEMINI_API_KEY ||
@@ -257,6 +258,7 @@ Commands:
   init         Scaffold guardrail.config.yaml + auto-detect migrate stack (writes .autopilot/stack.md)
   migrate      Run database migrations via the stack-aware dispatcher
   migrate doctor   Validate .autopilot/stack.md and skill manifests (alias: migrate-doctor)
+  deploy       Deploy via configured adapter (vercel | generic) — also: rollback, status
   setup        Auto-detect stack, write config, install pre-push hook
   doctor       Check prerequisites (alias: preflight)
   preflight    Check prerequisites (alias: doctor)
@@ -319,6 +321,21 @@ Options (migrate):
 
 Options (migrate doctor / migrate-doctor):
   --fix                Apply auto-fixable mutations (legacy stack.md, skills/migrate/, schema_version)
+
+Options (deploy):
+  --adapter <vercel|generic>   Override deploy.adapter from config
+  --config <path>              Path to config file
+  --ref <ref>                  Git ref (branch / tag) to deploy
+  --sha <commit>               Specific commit SHA to deploy
+  --watch                      Stream build logs to stderr in real time (Vercel only)
+  --to <deploy-id>             Target deploy ID for 'deploy rollback'
+  --pr <n>                     Post upserting deploy summary comment on the PR
+
+Subcommands (deploy):
+  deploy                       Deploy via configured adapter
+  deploy rollback              Roll back to previous prod deploy
+  deploy rollback --to <id>    Roll back to a specific deploy
+  deploy status                Show current prod + last 5 builds
 `);
 }
 switch (subcommand) {
@@ -638,7 +655,23 @@ switch (subcommand) {
         break;
     }
     case 'mcp': {
-        const { runMcp } = await import("./mcp.js");
+        let runMcp;
+        try {
+            ({ runMcp } = await import("./mcp.js"));
+        }
+        catch (err) {
+            const code = err.code;
+            const msg = err.message ?? String(err);
+            // The mcp module imports @modelcontextprotocol/sdk at the top — if the
+            // package was installed with --omit=optional the dynamic import surfaces
+            // ERR_MODULE_NOT_FOUND naming the SDK. Translate to a friendly hint.
+            if ((code === 'ERR_MODULE_NOT_FOUND' || code === 'MODULE_NOT_FOUND') && /modelcontextprotocol/.test(msg)) {
+                console.error('\x1b[31m[claude-autopilot] mcp subcommand requires @modelcontextprotocol/sdk\x1b[0m');
+                console.error('  install: npm install @modelcontextprotocol/sdk');
+                process.exit(1);
+            }
+            throw err;
+        }
         const configPath = flag('config');
         await runMcp({ cwd: process.cwd(), configPath });
         break;
@@ -705,6 +738,61 @@ switch (subcommand) {
         await runMigrateDoctorCLI();
         break;
     }
+    case 'deploy': {
+        const config = flag('config');
+        const adapterArg = flag('adapter');
+        if (adapterArg && !['vercel', 'generic'].includes(adapterArg)) {
+            console.error(`\x1b[31m[claude-autopilot] --adapter must be "vercel" or "generic"\x1b[0m`);
+            process.exit(1);
+        }
+        // Phase 3 — `deploy rollback` and `deploy status` subverbs. The first
+        // non-flag positional after `deploy` selects the verb. The historic
+        // `claude-autopilot deploy` (no subverb) keeps calling runDeploy.
+        const subverb = args[1] && !args[1].startsWith('--') ? args[1] : undefined;
+        if (subverb === 'rollback') {
+            const to = flag('to');
+            const code = await runDeployRollback({
+                configPath: config,
+                adapterOverride: adapterArg,
+                to,
+            });
+            process.exit(code);
+        }
+        if (subverb === 'status') {
+            const code = await runDeployStatus({
+                configPath: config,
+                adapterOverride: adapterArg,
+            });
+            process.exit(code);
+        }
+        if (subverb !== undefined) {
+            console.error(`\x1b[31m[claude-autopilot] unknown deploy subverb "${subverb}" — valid: rollback, status\x1b[0m`);
+            process.exit(1);
+        }
+        const ref = flag('ref');
+        const commitSha = flag('sha');
+        const watch = boolFlag('watch');
+        const prRaw = flag('pr');
+        let prNum;
+        if (prRaw !== undefined) {
+            const n = parseInt(prRaw, 10);
+            if (Number.isNaN(n) || n <= 0) {
+                console.error(`\x1b[31m[claude-autopilot] --pr must be a positive integer, got "${prRaw}"\x1b[0m`);
+                process.exit(1);
+            }
+            prNum = n;
+        }
+        const code = await runDeploy({
+            configPath: config,
+            adapterOverride: adapterArg,
+            ref,
+            commitSha,
+            watch,
+            pr: prNum,
+        });
+        process.exit(code);
+        break;
+    }
     case 'brainstorm': {
         // `brainstorm` is the front of the pipeline and is implemented as a Claude
         // Code skill (superpowers:brainstorming → autopilot), not a standalone CLI.

package/dist/src/cli/pr.js

@@ -25,9 +25,15 @@ function gitFetch(remote, ref, cwd) {
 export async function runPr(options = {}) {
     const cwd = options.cwd ?? process.cwd();
     const configPath = options.configPath ?? path.join(cwd, 'guardrail.config.yaml');
+    // 5.2.2 — pr previously hard-failed when guardrail.config.yaml was missing
+    // ("not found at <path>"). The first-run UX surprised users running
+    // `claude-autopilot pr <n>` on a fresh repo: setup hadn't been invoked, and
+    // the error didn't say to invoke it. Now matches `run`'s behavior — defer
+    // config-loading to the underlying runCommand, which auto-detects stack +
+    // testCommand when the file is missing.
     if (!fs.existsSync(configPath)) {
-        console.error(fmt('red', `[pr] guardrail.config.yaml not found at ${configPath}`));
-        return 1;
+        console.log(fmt('dim', `[pr] guardrail.config.yaml not found — auto-detecting from stack signals.`));
+        console.log(fmt('dim', `     Run \`claude-autopilot setup\` first to commit a config.`));
     }
     // Resolve PR number
     let prNumber = options.prNumber;

package/dist/src/cli/preflight.js

@@ -5,6 +5,7 @@ import { fileURLToPath } from 'node:url';
 import { runSafe } from "../core/shell.js";
 import { detectLLMKey, loadEnvFile, LLM_KEY_NAMES } from "../core/detect/llm-key.js";
 import { findPackageRoot } from "./_pkg-root.js";
+import { isSdkInstalled } from "../adapters/sdk-loader.js";
 const PASS = '\x1b[32m✓\x1b[0m';
 const FAIL = '\x1b[31m✗\x1b[0m';
 const WARN = '\x1b[33m!\x1b[0m';
@@ -29,6 +30,39 @@ function skillRoots() {
         roots.push(path.join(home, '.claude', 'plugins'));
     return roots.filter(p => fs.existsSync(p));
 }
+/**
+ * Reads `deploy.adapter` from guardrail.config.yaml without pulling in the
+ * full config loader (which validates against a JSON schema and would noise
+ * up the doctor output). Returns `null` if the config or field is absent.
+ */
+function readDeployAdapter(configPath) {
+    if (!fs.existsSync(configPath))
+        return null;
+    try {
+        const text = fs.readFileSync(configPath, 'utf8');
+        // Match `deploy:` block then look for `adapter:` two lines down. Cheap
+        // line-based parse — avoids js-yaml dependency in the doctor path.
+        const lines = text.split(/\r?\n/);
+        let inDeploy = false;
+        for (const line of lines) {
+            if (/^deploy\s*:\s*$/.test(line)) {
+                inDeploy = true;
+                continue;
+            }
+            if (inDeploy && /^\S/.test(line))
+                inDeploy = false; // dedented out of block
+            if (inDeploy) {
+                const m = line.match(/^\s+adapter\s*:\s*['"]?([a-zA-Z0-9_-]+)['"]?\s*$/);
+                if (m)
+                    return m[1] ?? null;
+            }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
 export function findMissingSuperpowersSkills() {
     // Traverse each root once, collect all discovered skill names, then diff against
     // the required set. Previous implementation did N × roots separate recursive walks.
@@ -173,7 +207,48 @@ export async function runDoctor() {
             ? 'git user.name / user.email not set — commits will fail.'
             : undefined,
     });
-    // 9. Superpowers plugin — required for pipeline phases, optional for review-only use
+    // 9. LLM SDK install state — surfaces which providers are usable. After
+    //    the v5.5 lazy-load refactor, three SDKs moved to optionalDependencies;
+    //    `--omit=optional` users may have removed them. This check shows users
+    //    which providers will work without `npm install <sdk>`.
+    const sdkChecks = [
+        { pkg: '@anthropic-ai/sdk', provider: 'claude' },
+        { pkg: 'openai', provider: 'openai/codex' },
+        { pkg: '@google/generative-ai', provider: 'gemini' },
+    ];
+    const installed = [];
+    const missing = [];
+    for (const { pkg } of sdkChecks) {
+        if (await isSdkInstalled(pkg))
+            installed.push(pkg);
+        else
+            missing.push(pkg);
+    }
+    checks.push({
+        name: `LLM SDKs installed (${installed.length}/${sdkChecks.length})`,
+        result: installed.length === 0 ? 'fail' : missing.length > 0 ? 'warn' : 'pass',
+        message: installed.length === 0
+            ? `No LLM SDKs found. Install at least one: ${sdkChecks.map(s => s.pkg).join(', ')}`
+            : missing.length > 0
+                ? `Missing (run npm install <pkg> to enable): ${missing.join(', ')}`
+                : undefined,
+    });
+    // 10. Vercel deploy adapter auth (Phase 6 of v5.4 spec). Detects
+    //     `deploy.adapter: vercel` in guardrail.config.yaml and verifies the
+    //     auth token is set. Warn-not-fail because users without deploy
+    //     configured don't care.
+    const deployAdapter = readDeployAdapter(configYaml);
+    if (deployAdapter === 'vercel') {
+        const token = process.env.VERCEL_TOKEN ?? envVars['VERCEL_TOKEN'];
+        checks.push({
+            name: 'VERCEL_TOKEN (deploy adapter: vercel)',
+            result: token ? 'pass' : 'warn',
+            message: token
+                ? undefined
+                : 'deploy.adapter is "vercel" but VERCEL_TOKEN is not set. Generate one at https://vercel.com/account/tokens',
+        });
+    }
+    // 11. Superpowers plugin — required for pipeline phases, optional for review-only use
     const missingSkills = findMissingSuperpowersSkills();
     const allSkillsFound = missingSkills.length === 0;
     checks.push({

package/dist/src/core/config/schema.d.ts

@@ -206,6 +206,40 @@ export declare const GUARDRAIL_CONFIG_SCHEMA: {
             };
             readonly additionalProperties: false;
         };
+        readonly deploy: {
+            readonly type: "object";
+            readonly required: readonly ["adapter"];
+            readonly additionalProperties: false;
+            readonly properties: {
+                readonly adapter: {
+                    readonly enum: readonly ["vercel", "generic"];
+                };
+                readonly project: {
+                    readonly type: "string";
+                };
+                readonly team: {
+                    readonly type: "string";
+                };
+                readonly target: {
+                    readonly enum: readonly ["production", "preview"];
+                };
+                readonly deployCommand: {
+                    readonly type: "string";
+                };
+                readonly watchBuildLogs: {
+                    readonly type: "boolean";
+                };
+                readonly rollbackOn: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly enum: readonly ["healthCheckFailure", "smokeTestFailure"];
+                    };
+                };
+                readonly healthCheckUrl: {
+                    readonly type: "string";
+                };
+            };
+        };
         readonly 'schema-alignment': {
             readonly type: "object";
             readonly properties: {

package/dist/src/core/config/schema.js

@@ -112,6 +112,24 @@ export const GUARDRAIL_CONFIG_SCHEMA = {
             },
             additionalProperties: false,
         },
+        deploy: {
+            type: 'object',
+            required: ['adapter'],
+            additionalProperties: false,
+            properties: {
+                adapter: { enum: ['vercel', 'generic'] },
+                project: { type: 'string' },
+                team: { type: 'string' },
+                target: { enum: ['production', 'preview'] },
+                deployCommand: { type: 'string' },
+                watchBuildLogs: { type: 'boolean' },
+                rollbackOn: {
+                    type: 'array',
+                    items: { enum: ['healthCheckFailure', 'smokeTestFailure'] },
+                },
+                healthCheckUrl: { type: 'string' },
+            },
+        },
         'schema-alignment': {
             type: 'object',
             properties: {

package/dist/src/core/config/types.d.ts

@@ -1,4 +1,5 @@
 import type { SchemaAlignmentConfig } from '../schema-alignment/types.ts';
+import type { DeployConfig } from '../../adapters/deploy/types.ts';
 export interface AdapterReference {
     adapter: string;
     options?: Record<string, unknown>;
@@ -92,6 +93,11 @@ export interface GuardrailConfig {
         };
     };
     'schema-alignment'?: SchemaAlignmentConfig;
+    /**
+     * Deploy phase configuration. Optional — when absent, the deploy phase is a
+     * no-op. See `src/adapters/deploy/types.ts` for the full DeployConfig shape.
+     */
+    deploy?: DeployConfig;
     cache?: Record<string, unknown>;
     persistence?: Record<string, unknown>;
     concurrency?: Record<string, unknown>;

package/dist/src/core/errors.d.ts

@@ -1,4 +1,4 @@
-export type ErrorCode = 'auth' | 'rate_limit' | 'transient_network' | 'invalid_config' | 'adapter_bug' | 'user_input' | 'budget_exceeded' | 'concurrency_lock' | 'superseded';
+export type ErrorCode = 'auth' | 'rate_limit' | 'transient_network' | 'invalid_config' | 'adapter_bug' | 'user_input' | 'budget_exceeded' | 'concurrency_lock' | 'superseded' | 'no_previous_deploy';
 export interface GuardrailErrorOptions {
     code: ErrorCode;
     retryable?: boolean;

package/dist/src/core/errors.js

@@ -3,6 +3,7 @@ const DEFAULT_RETRYABLE = {
     auth: false, rate_limit: true, transient_network: true, invalid_config: false,
     adapter_bug: false, user_input: false, budget_exceeded: false,
     concurrency_lock: false, superseded: false,
+    no_previous_deploy: false,
 };
 export class GuardrailError extends Error {
     code;

package/dist/src/core/migrate/detector-rules.js

@@ -38,6 +38,7 @@ export const DETECTION_RULES = [
         requireAll: ['prisma/schema.prisma'],
         excludeIf: ['prisma/migrations'],
         defaultSkill: 'migrate@1',
+        defaultCommand: { exec: 'prisma', args: ['db', 'push'] },
         promptOnSelect: true,
     },
     {
@@ -58,6 +59,7 @@ export const DETECTION_RULES = [
         requireAny: ['drizzle.config.ts', 'drizzle.config.js'],
         excludeIf: ['drizzle/migrations'],
         defaultSkill: 'migrate@1',
+        defaultCommand: { exec: 'drizzle-kit', args: ['push'] },
         promptOnSelect: true,
     },
     {
@@ -76,6 +78,9 @@ export const DETECTION_RULES = [
         confidence: 'high',
         requireAll: ['go.mod', 'migrate'],
         defaultSkill: 'migrate@1',
+        // Conventional invocation; users with non-standard layouts will edit
+        // the generated stack.md (e.g. different -path or DSN flag).
+        defaultCommand: { exec: 'migrate', args: ['-database', '$DATABASE_URL', '-path', 'migrations', 'up'] },
         promptOnSelect: false,
     },
     {
@@ -132,6 +137,7 @@ export const DETECTION_RULES = [
         requireAll: [],
         requireAny: ['ormconfig.json', 'ormconfig.ts', 'ormconfig.js', 'data-source.ts'],
         defaultSkill: 'migrate@1',
+        defaultCommand: { exec: 'typeorm', args: ['migration:run'] },
         promptOnSelect: true,
     },
     {

package/dist/src/core/migrate/schema-validator.js

@@ -12,6 +12,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import Ajv from 'ajv';
+import addFormats from 'ajv-formats';
 import * as yaml from 'js-yaml';
 import { requirePackageRoot } from "../../cli/_pkg-root.js";
 // Resolve presets/ relative to the canonical package root so this works under
@@ -28,6 +29,12 @@ function loadStableIds() {
 }
 function buildValidator() {
     const ajv = new Ajv({ strict: false, allErrors: true });
+    // Register standard formats (date-time, uri, email, etc.) so the schema's
+    // `format: "date-time"` constraint is actually validated rather than warned-
+    // about-and-ignored on every CLI invocation. Pre-5.2.3 every command printed:
+    //   "unknown format \"date-time\" ignored in schema at path #/.../detected_at"
+    // — twice, since the validator is built lazily in two paths.
+    addFormats(ajv);
     const stableIds = loadStableIds();
     // Custom keyword: validates that the value is one of the registered stable IDs.
     ajv.addKeyword({

package/dist/src/core/persist/cost-log.js

@@ -3,6 +3,14 @@ import * as path from 'node:path';
 const CACHE_DIR = '.guardrail-cache';
 const LOG_FILE = 'costs.jsonl';
 export function appendCostLog(cwd, entry) {
+    // Skip no-op entries that only pollute the report — runs that didn't
+    // actually invoke an LLM (dry-runs, no-findings paths, "no code files at
+    // path" early returns). Without this filter, randai's costs.jsonl picked up
+    // 6 zero-token zero-duration entries from setup-flow scans, drowning the
+    // 4 real review entries in `claude-autopilot costs` output.
+    if (entry.inputTokens === 0 && entry.outputTokens === 0 && entry.costUSD === 0) {
+        return;
+    }
     // Cost log is observability, not a contract. A failed write (read-only FS,
     // full disk, permission error) must NEVER block the caller — every callsite
     // calls this *after* its primary output is emitted, and a throw here would

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delegance/claude-autopilot",
-  "version": "5.2.1",
+  "version": "5.5.2",
   "type": "module",
   "description": "Autonomous development pipeline for Claude Code: brainstorm → spec → plan → implement → migrate → validate → PR → review → merge. Multi-model, local-first, every phase a skill you can intervene in.",
   "keywords": [
@@ -58,18 +58,21 @@
     "autoregress": "tsx scripts/autoregress.ts"
   },
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.91.1",
-    "@google/generative-ai": "^0.24.1",
-    "@modelcontextprotocol/sdk": "^1.29.0",
     "ajv": "^8",
+    "ajv-formats": "^3.0.1",
     "dotenv": ">=16",
     "js-yaml": "^4",
     "minimatch": ">=9",
-    "openai": ">=4",
     "proper-lockfile": "^4.1.2",
     "shell-quote": "^1.8.3",
     "tsx": ">=4"
   },
+  "optionalDependencies": {
+    "@anthropic-ai/sdk": "^0.91.1",
+    "@google/generative-ai": "^0.24.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "openai": ">=4"
+  },
   "devDependencies": {
     "@types/js-yaml": "^4",
     "@types/node": "^25",

package/scripts/autoregress.ts

@@ -6,7 +6,7 @@ import * as os from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { selectSnapshots } from './snapshots/impact-selector.ts';
-import OpenAI from 'openai';
+import { loadOpenAI } from '../src/adapters/sdk-loader.ts';
 import { buildImportMap } from './snapshots/import-scanner.ts';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -230,6 +230,7 @@ async function cmdGenerate(args: string[]): Promise<number> {
 
   console.log(`[autoregress generate] generating snapshots for ${srcFiles.length} file(s)`);
 
+  const OpenAI = await loadOpenAI();
   const client = new OpenAI({ apiKey });
   let sourceCommit = 'unknown';
   try {