@esneiderbravo/speclaw 0.3.13 → 1.0.0

package/dist/modules/foundation/scan.js

@@ -0,0 +1,227 @@
+/**
+ * Prompt-injection scanners for rule / skill files.
+ * Complements digests: hashes catch any edit; scanners catch known payloads.
+ */
+// Covers: req~injection-scan~1
+import fs from "node:fs";
+import path from "node:path";
+const OVERRIDE = /\b(ignore\s+previous\s+instructions|disregard\s+the\s+above|you\s+are\s+now|new\s+system\s+prompt|ignora\s+las\s+instrucciones\s+anteriores)\b/i;
+const SHELL = /\b(curl\s+[^\n|]*\|\s*(ba)?sh|bash\s+-c|Invoke-Expression|iex\b|eval\s*\(|npm\s+run\s+[^\s]+.*\|\s*sh)\b/i;
+const EXFIL = /\b(send\s+(this|the)\s+(repo|code|contents?)\s+to|exfiltrat|upload\s+to\s+https?:\/\/|read\s+(\.env|~\/\.ssh|~\/\.aws|\.npmrc)|exfiltra)\b/i;
+const URL_RE = /https?:\/\/[^\s)>\]]+/gi;
+const ZERO_WIDTH = /[\u200B-\u200D\uFEFF\u202A-\u202E]/;
+const IMPERATIVE_HTML = /<!--[\s\S]{0,200}\b(run|execute|ignore|disregard|curl|bash|send)\b[\s\S]{0,200}-->/i;
+/**
+ * Normalize text before detection (NFKC, strip zero-width/bidi, fold common
+ * Cyrillic lookalikes, collapse whitespace).
+ */
+export function normalizeForScan(text) {
+    let t = text.normalize("NFKC");
+    t = t.replace(ZERO_WIDTH, "");
+    t = t.replace(/[\u0400-\u04FF]/g, (ch) => CYRILLIC_FOLD[ch] ?? ch);
+    t = t.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+    t = t.replace(/\\\*|\\_|\\`/g, (m) => m.slice(1));
+    t = t.replace(/\s+/g, " ").trim();
+    return t;
+}
+const CYRILLIC_FOLD = {
+    а: "a",
+    е: "e",
+    о: "o",
+    р: "p",
+    с: "c",
+    у: "y",
+    х: "x",
+    А: "A",
+    Е: "E",
+    О: "O",
+    Р: "P",
+    С: "C",
+    У: "Y",
+    Х: "X",
+};
+/** Scan one file's raw contents; returns findings with original line numbers. */
+export function scanText(relPath, raw, opts = {}) {
+    const suppressions = opts.suppressions ?? [];
+    const allow = new Set((opts.allowHosts ?? []).map((h) => h.toLowerCase()));
+    const out = [];
+    const lines = raw.split(/\r?\n/);
+    const push = (f) => {
+        if (suppressions.some((s) => s.detector === f.detector && matchPath(s.path, f.path) && s.note.trim().length > 0)) {
+            return;
+        }
+        out.push(f);
+    };
+    if (ZERO_WIDTH.test(raw)) {
+        push({
+            detector: "injection/hidden-text",
+            severity: "error",
+            path: relPath,
+            line: 1,
+            excerpt: "zero-width or bidi control characters",
+            message: "Hidden / bidi control characters in a rule file.",
+        });
+    }
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const norm = normalizeForScan(line);
+        const ln = i + 1;
+        if (OVERRIDE.test(norm) || OVERRIDE.test(line)) {
+            push({
+                detector: "injection/instruction-override",
+                severity: "error",
+                path: relPath,
+                line: ln,
+                excerpt: clip(line),
+                message: "Instruction-override phrasing in a rule file.",
+            });
+        }
+        if (SHELL.test(norm) || SHELL.test(line)) {
+            push({
+                detector: "injection/shell-execution",
+                severity: "error",
+                path: relPath,
+                line: ln,
+                excerpt: clip(line),
+                message: "Shell-execution instruction in a rule file.",
+            });
+        }
+        if (EXFIL.test(norm) || EXFIL.test(line)) {
+            push({
+                detector: "injection/exfiltration",
+                severity: "error",
+                path: relPath,
+                line: ln,
+                excerpt: clip(line),
+                message: "Possible exfiltration instruction in a rule file.",
+            });
+        }
+        for (const m of line.matchAll(URL_RE)) {
+            try {
+                const host = new URL(m[0]).hostname.toLowerCase();
+                if (allow.size > 0 && !allow.has(host) && !host.endsWith(".github.com")) {
+                    push({
+                        detector: "injection/unallowlisted-url",
+                        severity: "warn",
+                        path: relPath,
+                        line: ln,
+                        excerpt: clip(m[0]),
+                        message: `URL host not on allowlist: ${host}`,
+                    });
+                }
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+    if (IMPERATIVE_HTML.test(raw)) {
+        const idx = raw.search(IMPERATIVE_HTML);
+        const snippet = raw.slice(Math.max(0, idx), idx + 220);
+        // Data-only speclaw markers (map/laws/provenance) are not agent instructions.
+        if (!/<!--\s*speclaw:/.test(snippet)) {
+            const line = lineOf(raw, idx);
+            push({
+                detector: "injection/imperative-html-comment",
+                severity: "warn",
+                path: relPath,
+                line,
+                excerpt: clip(raw.slice(idx, idx + 120)),
+                message: "HTML comment contains imperative language (visible to some agents).",
+            });
+        }
+    }
+    // External @import / @~/ / @C:\…
+    // External @import / @~/ / @C:\…
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const m = /@([~/][^\s)\]>"']+)/.exec(line) ??
+            /@([A-Za-z]:[^\s)\]>"']+)/.exec(line) ??
+            /@import\s+["']([^"']+)["']/.exec(line);
+        if (!m)
+            continue;
+        const target = m[1];
+        push({
+            detector: "injection/external-import",
+            severity: "warn",
+            path: relPath,
+            line: i + 1,
+            excerpt: clip(line),
+            message: `Import may resolve outside the working directory: ${target}`,
+        });
+    }
+    // Frontmatter ↔ body mismatch (skills)
+    const fm = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/.exec(raw);
+    if (fm) {
+        const front = fm[1];
+        const body = fm[2];
+        const frontDesc = /(?:^|\n)description:\s*["']?([^\n"']+)/i.exec(front)?.[1] ?? "";
+        if (frontDesc && SHELL.test(body) && !SHELL.test(frontDesc)) {
+            push({
+                detector: "injection/manifest-prose-mismatch",
+                severity: "warn",
+                path: relPath,
+                line: 1,
+                excerpt: clip(frontDesc),
+                message: "Skill frontmatter description and body disagree on shell risk.",
+            });
+        }
+    }
+    return out;
+}
+function matchPath(pattern, file) {
+    if (pattern === file)
+        return true;
+    if (pattern.endsWith("/**")) {
+        const prefix = pattern.slice(0, -3);
+        return file === prefix || file.startsWith(prefix + "/");
+    }
+    if (pattern.includes("*")) {
+        const re = new RegExp("^" + pattern.split("*").map(escapeRegExp).join(".*") + "$");
+        return re.test(file);
+    }
+    return false;
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function clip(s, n = 120) {
+    const t = s.trim();
+    return t.length <= n ? t : t.slice(0, n - 1) + "…";
+}
+function lineOf(text, index) {
+    if (index <= 0)
+        return 1;
+    return text.slice(0, index).split(/\r?\n/).length;
+}
+/** Load optional scan suppressions from lawbook/config.yaml (line-oriented). */
+export function loadScanSuppressions(projectPath) {
+    const cfgPath = path.join(projectPath, "lawbook", "config.yaml");
+    if (!fs.existsSync(cfgPath))
+        return [];
+    const text = fs.readFileSync(cfgPath, "utf8");
+    // Very small subset: repeated blocks under scanSuppressions are not fully
+    // parsed; support a flat JSON-ish list in a comment-free line for v1:
+    // scanSuppressions: [{"detector":"…","path":"…","note":"…"}]
+    const m = /^\s*scanSuppressions\s*:\s*(\[[\s\S]*?\])\s*$/m.exec(text);
+    if (!m)
+        return [];
+    try {
+        const arr = JSON.parse(m[1]);
+        return arr.filter((s) => s.detector && s.path && s.note);
+    }
+    catch {
+        return [];
+    }
+}
+/** Scan a list of project-relative files that exist. */
+export function scanPaths(projectPath, relPaths, opts = {}) {
+    const out = [];
+    for (const rel of relPaths) {
+        const abs = path.join(projectPath, rel);
+        if (!fs.existsSync(abs) || !fs.statSync(abs).isFile())
+            continue;
+        out.push(...scanText(rel, fs.readFileSync(abs, "utf8"), opts));
+    }
+    return out;
+}

package/dist/modules/foundation/setup-tool.js

@@ -0,0 +1,96 @@
+import { z } from "zod";
+import { loadPacks } from "../tools/packs.js";
+import { AGENTS, configureAgent } from "../../shared/agents.js";
+import { emptyReport } from "../../shared/install.js";
+import { refreshAgents } from "../../shared/agents.js";
+import { installPack } from "../tools/packs.js";
+/** Human help text for init questionnaire (not embedded in MCP schemas). */
+const profileFieldHelp = {
+    project_name: "Short project name, e.g. the repo name",
+    project_description: "One-line description of what the project does",
+    organization: "Company/team name",
+    stack_summary: "e.g. 'Next.js 15 + TypeScript frontend, FastAPI + PostgreSQL backend'",
+    architecture: "e.g. 'hexagonal architecture with bounded contexts'",
+    test_commands: "Real commands, e.g. 'pytest backend/tests && npm run test'",
+    lint_commands: "Real commands, e.g. 'ruff check . && npm run lint && tsc --noEmit'",
+    branch_pattern: "e.g. 'feature/<ticket-id>-<slug>'",
+    commit_style: "e.g. 'conventional commits, imperative, English'",
+    custom_laws: "Extra markdown for LAWS.md — project-specific binding rules",
+    compass_hints: "Markdown bullets with real entrypoints for docs/compass.md",
+    base_standards_extra: "Extra cross-cutting rules for base-standards.md",
+    modules_table: "Markdown table of modules/bounded contexts",
+    layering_rules: "Layers and allowed dependencies for architecture.md",
+    backend_layers: "Backend layer table for backend-standards.md",
+    frontend_layers: "Frontend layer table for frontend-standards.md",
+    versioning_rules: "Versioning/release convention for conventions.md",
+    documentation_extra: "Repo-specific docstring notes for documentation.md",
+};
+const profileShape = {
+    project_name: z.string(),
+    project_description: z.string().optional(),
+    organization: z.string().optional(),
+    stack_summary: z.string().optional(),
+    architecture: z.string().optional(),
+    test_commands: z.string().optional(),
+    lint_commands: z.string().optional(),
+    branch_pattern: z.string().optional(),
+    commit_style: z.string().optional(),
+    custom_laws: z.string().optional(),
+    compass_hints: z.string().optional(),
+    base_standards_extra: z.string().optional(),
+    modules_table: z.string().optional(),
+    layering_rules: z.string().optional(),
+    backend_layers: z.string().optional(),
+    frontend_layers: z.string().optional(),
+    versioning_rules: z.string().optional(),
+    documentation_extra: z.string().optional(),
+};
+export const setupActions = ["init", "configure-agent", "add-pack", "list-packs"];
+export const speclawSetupSchema = {
+    projectPath: z.string(),
+    action: z.enum(setupActions),
+    agent: z.enum(AGENTS.map((a) => a.id)).optional(),
+    pack: z.string().optional(),
+    vars: z.record(z.string()).optional(),
+};
+/**
+ * Dispatch `speclaw_setup` by action. Scaffold is CLI-only — not exposed here.
+ *
+ * @param args - Setup action and parameters.
+ */
+export function handleSpeclawSetup(args) {
+    switch (args.action) {
+        case "init":
+            return {
+                instructions: [
+                    "1. Analyze the repository at projectPath and fill profile fields from the real codebase.",
+                    "2. Call speclaw_setup with action configure-agent / add-pack as needed.",
+                    "3. Run lawbook_change action init and compass_index when scaffold completes via CLI if needed.",
+                ],
+                profileFields: profileFieldHelp,
+                packs: loadPacks(),
+                note: "Full scaffold runs via CLI: speclaw init — not MCP.",
+            };
+        case "configure-agent": {
+            if (!args.agent)
+                throw new Error(`speclaw_setup: action 'configure-agent' requires 'agent'`);
+            const report = emptyReport();
+            configureAgent(args.projectPath, args.agent, report);
+            return report;
+        }
+        case "list-packs":
+            return loadPacks();
+        case "add-pack": {
+            if (!args.pack)
+                throw new Error(`speclaw_setup: action 'add-pack' requires 'pack'`);
+            const report = emptyReport();
+            installPack(args.projectPath, args.pack, args.vars ?? {}, report);
+            refreshAgents(args.projectPath, report);
+            return report;
+        }
+        default:
+            throw new Error(`speclaw_setup: unknown action '${String(args.action)}'`);
+    }
+}
+/** Zod profile shape for CLI scaffold (not in MCP schema). */
+export { profileShape as setupProfileShape };

package/dist/modules/foundation/verify.js

@@ -1,6 +1,6 @@
 import { performance } from "node:perf_hooks";
 import { openDb, indexExists } from "../compass/db.js";
-import { hasBatchBackend, loadManifestForVerify } from "./laws.js";
+import { hasBatchBackend, isActiveLaw, loadManifestForVerify } from "./laws.js";
 import { runDepsLaw } from "./deps.js";
 import { runGraphLaw } from "./graph.js";
 export { underPaths } from "./verify-model.js";
@@ -50,6 +50,14 @@ export function verifyLaws(args) {
     const manifest = loadManifestForVerify(args.projectPath);
     const engines = args.engines;
     const selected = manifest.laws.filter((law) => {
+        if (!isActiveLaw(law)) {
+            skipped.push({
+                lawId: law.id,
+                reason: "draft",
+                detail: "status=draft — pending human activation; does not gate",
+            });
+            return false;
+        }
         if (!hasBatchBackend(law))
             return false;
         if (args.lawIds && !args.lawIds.includes(law.id))

package/dist/modules/lawbook/assets/commands/archive.md

@@ -6,5 +6,5 @@ Archive the completed change: $ARGUMENTS
 
 Follow the `archive` skill: confirm every task (or level-0 checklist) is done
 and gates are green, reconcile if the level has delta specs, run
-`lawbook_validate`, then `lawbook_archive` with today's date (YYYY-MM-DD). Sync
+`lawbook_change` (action: validate), then `lawbook_change` (action: archive) with today's date (YYYY-MM-DD). Sync
 runs only when the ceremony level requires specs. Never move the folder by hand.

package/dist/modules/lawbook/assets/commands/draft.md

@@ -8,4 +8,4 @@ Follow the `draft` skill: ensure `lawbook/` exists (`lawbook_init`), investigate
 with Compass, propose a ceremony level (`lawbook_level` mode `propose`) and
 **confirm** it with the human (`set`), then scaffold only the artifacts that
 level requires. For true one-liners use `speclaw quick` / the `quick` skill
-instead. Finish by running `lawbook_validate` and fixing every issue.
+instead. Finish by running `lawbook_change` (action: validate) and fixing every issue.

package/dist/modules/lawbook/assets/commands/explore.md

@@ -4,7 +4,7 @@ description: Enter explore mode — a thinking partner before or during a change
 
 Explore: $ARGUMENTS
 
-Follow the `explore` skill: use `compass_recall`/`compass_explore` to understand
+Follow the `explore` skill: use `compass_find` (mode: concept)/`compass_explore` to understand
 the code, ask sharp questions, check the relevant `docs/standards/`, weigh
 approaches with trade-offs, and give a recommendation. Write nothing to
 `lawbook/`; when the direction is clear, offer to `draft` the change.

package/dist/modules/lawbook/assets/commands/sync.md

@@ -5,6 +5,6 @@ description: Promote a change's delta specs into the canonical specs, without ar
 Sync the change's specs into canonical: $ARGUMENTS
 
 Follow the `sync` skill: reconcile the delta specs against what was actually
-built (branch diff + code graph), validate the change (`lawbook_validate`), then
-run `lawbook_sync` to promote each delta spec into `lawbook/specs/`. Report what
+built (branch diff + code graph), validate the change (`lawbook_change` (action: validate)), then
+run `lawbook_change` (action: sync) to promote each delta spec into `lawbook/specs/`. Report what
 you reconciled and what was promoted; leave the change active.

package/dist/modules/lawbook/assets/skills/archive/SKILL.md

@@ -9,7 +9,7 @@ Close out a completed change: its delta specs become canonical and the change
 folder moves to `lawbook/changes/archive/`. This is part of the PR that
 implements the change, not a post-merge chore.
 
-`lawbook_archive` is **gated** — the engine refuses to archive (and reports the
+`lawbook_change` (action: archive) is **gated** — the engine refuses to archive (and reports the
 reason) while any task is unchecked, while `reports/` holds no discipline report,
 or while the delta specs are not yet synced into the canonical specs. So archive
 is the last step of a completed change: reconcile, sync, then archive.

package/dist/modules/lawbook/assets/skills/archive/steps/03-validate-and-sync.md

@@ -1,8 +1,8 @@
 # Validate and sync
 
-Run `lawbook_validate`. If the confirmed ceremony level requires delta specs
-(levels 1–3), run `lawbook_sync` to promote them into `lawbook/specs/` —
-`lawbook_archive` refuses unless the canonical specs already match. At **level
+Run `lawbook_change` (action: validate). If the confirmed ceremony level requires delta specs
+(levels 1–3), run `lawbook_change` (action: sync) to promote them into `lawbook/specs/` —
+`lawbook_change` (action: archive) refuses unless the canonical specs already match. At **level
 0**, skip sync (there are no deltas).
 
 Next: read `steps/04-archive.md` and do only what it says.

package/dist/modules/lawbook/assets/skills/archive/steps/04-archive.md

@@ -1,6 +1,6 @@
 # Archive
 
-Run the `lawbook_archive` tool with the change name and today's date
+Run the `lawbook_change` (action: archive) tool with the change name and today's date
 (`YYYY-MM-DD`). It re-checks the gate deterministically and, if it passes,
 moves `lawbook/changes/<name>/` to `lawbook/changes/archive/<date>-<name>/`.
 If it refuses, resolve the reported blockers (unchecked tasks, missing

package/dist/modules/lawbook/assets/skills/draft/steps/02-understand.md

@@ -4,7 +4,7 @@
   code — it is incremental (unchanged files are skipped by hash), so this is
   cheap and guarantees your decisions rest on the current graph, not a stale one.
 - Clarify what the user wants (feature / fix / refactor) and confirm scope.
-- Use `compass_explore` and `compass_recall` (speclaw's code index) BEFORE
+- Use `compass_explore` and `compass_find` (mode: concept) (speclaw's code index) BEFORE
   grep/read to locate the real code the change touches and its blast radius.
 - **Propose a ceremony level** with `lawbook_level` (mode `propose`) using the
   paths/symbols you found; **confirm with the human** (mode `set`) before

package/dist/modules/lawbook/assets/skills/draft/steps/05-validate.md

@@ -1,6 +1,6 @@
 # Validate
 
-Run the `lawbook_validate` tool for the change and fix every issue it reports
+Run the `lawbook_change` (action: validate) tool for the change and fix every issue it reports
 (missing artifacts, non-normative specs, missing scenarios) before handing off
 to implementation. Read its advisory **warnings** too: a near-duplicate
 capability name usually means you should reuse the existing capability's exact

package/dist/modules/lawbook/assets/skills/explore/steps/01-investigate.md

@@ -3,7 +3,7 @@
 - **Refresh the index first.** Run `compass_index` before investigating — it is
   incremental (unchanged files skipped by hash), so it is cheap and keeps your
   reasoning on the current graph rather than a stale one.
-- **Understand the code first.** Use `compass_recall` to find relevant code by
+- **Understand the code first.** Use `compass_find` (mode: concept) to find relevant code by
   meaning and `compass_explore` to read a symbol's source plus its callers and
   callees — before grep/read.
 - **Ask sharp questions** to surface hidden assumptions, constraints, and edge

package/dist/modules/lawbook/assets/skills/quick/steps/02-implement.md

@@ -1,7 +1,7 @@
 # Implement and evidence
 
 Make the fix, tick every `- [ ]` in `record.md`, and write at least one
-discipline report under `reports/`. Archive with `lawbook_archive` (no sync at
+discipline report under `reports/`. Archive with `lawbook_change` (action: archive) (no sync at
 level 0). Promote via `lawbook_level` if scope grew.
 
 No further steps — workflow complete.

package/dist/modules/lawbook/assets/skills/sync/SKILL.md

@@ -9,7 +9,7 @@ Update the project's canonical specifications (`lawbook/specs/`) with a change's
 delta specs, without archiving the change. Use this when the specs should
 become the source of truth but the change isn't finished (e.g. multi-PR work).
 
-`lawbook_sync` is a deterministic copy — it is blind to the code. So before
+`lawbook_change` (action: sync) is a deterministic copy — it is blind to the code. So before
 promoting, YOU reconcile the delta specs against what was actually built, so the
 specs that become canonical describe reality, not just the original draft.
 

package/dist/modules/lawbook/assets/skills/sync/steps/03-validate.md

@@ -1,6 +1,6 @@
 # Validate
 
-Run `lawbook_validate` for the change; do not sync a change whose specs are
+Run `lawbook_change` (action: validate) for the change; do not sync a change whose specs are
 invalid.
 
 Next: read `steps/04-promote.md` and do only what it says.

package/dist/modules/lawbook/assets/skills/sync/steps/04-promote.md

@@ -1,6 +1,6 @@
 # Promote
 
-Run the `lawbook_sync` tool for the change. It copies each
+Run the `lawbook_change` (action: sync) tool for the change. It copies each
 `lawbook/changes/<name>/specs/<capability>/spec.md` over the canonical
 `lawbook/specs/<capability>/spec.md` and reports what it promoted, flagging
 each as **created** (new capability) or **updated** (overwrote an existing

package/dist/modules/lawbook/change-tool.js

@@ -0,0 +1,90 @@
+import { z } from "zod";
+import { specInit, specValidate, specSync, specArchive, specList } from "./engine.js";
+import { handleLevel } from "./quick.js";
+import { buildCoverageReport, loadCoverageConfig, renderCoverageAgent } from "./coverage.js";
+import { buildDriftReport, renderDriftAgent } from "./drift.js";
+export const lawbookChangeActions = [
+    "init",
+    "list",
+    "validate",
+    "sync",
+    "archive",
+    "level",
+    "coverage",
+    "drift",
+];
+export const lawbookChangeSchema = {
+    projectPath: z.string(),
+    action: z.enum(lawbookChangeActions),
+    change: z.string().optional(),
+    date: z
+        .string()
+        .regex(/^\d{4}-\d{2}-\d{2}$/)
+        .optional(),
+    mode: z.enum(["propose", "set", "promote", "explain"]).optional(),
+    paths: z.array(z.string()).optional(),
+    symbols: z.array(z.string()).optional(),
+    level: z.union([z.literal(0), z.literal(1), z.literal(2), z.literal(3)]).optional(),
+    reason: z.string().optional(),
+    onlyDefects: z.boolean().optional(),
+    json: z.boolean().optional(),
+    capability: z.string().optional(),
+    includeReverse: z.boolean().optional(),
+    maxItems: z.number().int().min(1).max(50).optional(),
+};
+function requireField(args, field) {
+    const v = args[field];
+    if (typeof v === "string" && v.length > 0)
+        return v;
+    throw new Error(`lawbook_change: action '${args.action}' requires '${String(field)}'`);
+}
+/**
+ * Dispatch `lawbook_change` by action.
+ *
+ * @param args - Unified lawbook lifecycle arguments.
+ */
+export function handleLawbookChange(args) {
+    switch (args.action) {
+        case "init":
+            return specInit(args.projectPath);
+        case "list":
+            return specList(args.projectPath);
+        case "validate":
+            return specValidate(args.projectPath, requireField(args, "change"));
+        case "sync":
+            return specSync(args.projectPath, requireField(args, "change"));
+        case "archive":
+            return specArchive(args.projectPath, requireField(args, "change"), requireField(args, "date"));
+        case "level":
+            if (!args.mode)
+                throw new Error(`lawbook_change: action 'level' requires 'mode'`);
+            return handleLevel({
+                projectPath: args.projectPath,
+                mode: args.mode,
+                change: args.change,
+                paths: args.paths,
+                symbols: args.symbols,
+                level: args.level,
+                reason: args.reason,
+            });
+        case "coverage": {
+            const cfg = loadCoverageConfig(args.projectPath);
+            const report = buildCoverageReport(args.projectPath, { change: args.change, cfg });
+            if (args.json)
+                return report;
+            return renderCoverageAgent(report, args.onlyDefects !== false);
+        }
+        case "drift": {
+            const report = buildDriftReport(args.projectPath, {
+                capability: args.capability,
+                reverse: args.includeReverse === true,
+                failOn: "semantic",
+            });
+            if (args.json)
+                return report;
+            return renderDriftAgent(report, args.maxItems ?? 10);
+        }
+        default:
+            throw new Error(`lawbook_change: unknown action '${String(args.action)}'`);
+    }
+}