@f-o-h/cli 0.1.67 → 0.1.69

package/README.md

@@ -89,7 +89,7 @@ returned short-lived token. Credential auth remains available as fallback.
 `foh prove` produces a compact signed proof report across auth, org context,
 agent validation, contact phone readiness, voice provider health, widget
 channel/embed readiness, and widget smoke. It does not run release
-certification by default; run `foh certify run --agent <id> --profile release`
+certification by default; run `foh certify run --agent <id> --profile release` (budget-safe default)
 before publish, or pass `--include-certification` only when you intentionally
 want the slower certification check inside proof. It is read-only by default;
 pass `--mutation-mode ensure` or `--repair` only when you explicitly want proof

package/dist/foh.js

@@ -32786,7 +32786,7 @@ var StdioServerTransport = class {
 };
 
 // src/lib/cli-version.ts
-var CLI_VERSION = "0.1.67";
+var CLI_VERSION = "0.1.69";
 
 // src/commands/mcp-serve.ts
 var DEFAULT_TIMEOUT_MS = 12e4;
@@ -35415,6 +35415,11 @@ function modeForProfile(profile) {
   if (profile === "stress") return "stress";
   return "full";
 }
+function defaultAdaptiveRuns(profile) {
+  if (profile === "smoke") return 1;
+  if (profile === "stress") return 30;
+  return 5;
+}
 function csv(raw) {
   if (!raw) return void 0;
   const values = String(raw).split(",").map((value) => value.trim()).filter(Boolean);
@@ -35427,11 +35432,11 @@ function channel(raw) {
 }
 function registerCertify(program3) {
   const certify = program3.command("certify").description("Produce release certification evidence for an agent");
-  certify.command("run").description("Run certification for an exact agent draft/profile and emit release evidence").requiredOption("--agent <id>", "Agent ID to certify").option("--profile <profile>", "Certification profile: smoke, release, or stress", "release").option("--adaptive-runs <n>", "Adaptive runs for release/stress profiles", "30").option("--journeys <list>", "Comma-separated journey allowlist").option("--scenario-ids <list>", "Comma-separated scenario ID allowlist").option("--channel <channel>", "Channel filter: chat, voice, or mixed", "mixed").option("--out <path>", "Write certification run JSON to this file path").option("--api-url <url>", "API base URL override").option("--json", "Output as machine-readable JSON").action(async (opts) => {
+  certify.command("run").description("Run certification for an exact agent draft/profile and emit release evidence").requiredOption("--agent <id>", "Agent ID to certify").option("--profile <profile>", "Certification profile: smoke, release, or stress", "release").option("--adaptive-runs <n>", "Adaptive runs override; release defaults to a budget-safe 5").option("--journeys <list>", "Comma-separated journey allowlist").option("--scenario-ids <list>", "Comma-separated scenario ID allowlist").option("--channel <channel>", "Channel filter: chat, voice, or mixed", "mixed").option("--out <path>", "Write certification run JSON to this file path").option("--api-url <url>", "API base URL override").option("--json", "Output as machine-readable JSON").action(async (opts) => {
     try {
       const profile = normalizeProfile(opts.profile);
       const mode = modeForProfile(profile);
-      const adaptiveRuns = Math.max(1, Math.min(120, Number(opts.adaptiveRuns ?? 30) || 30));
+      const adaptiveRuns = Math.max(1, Math.min(120, Number(opts.adaptiveRuns ?? defaultAdaptiveRuns(profile)) || defaultAdaptiveRuns(profile)));
       const response = await apiFetch(
         `/v1/console/agents/${opts.agent}/sim-certify`,
         {
@@ -39864,6 +39869,27 @@ function resolveWorkspaceRoot(input) {
   const repoStem = (0, import_path13.basename)((0, import_path13.resolve)(input.privateRepoRoot)).replace(/[^a-zA-Z0-9_.-]+/g, "-");
   return (0, import_path13.resolve)((0, import_os2.tmpdir)(), "foh-external-agent-workspaces", repoStem, batchStem);
 }
+function findNearestGitRoot(startPath) {
+  let current = (0, import_path13.resolve)(startPath);
+  while (true) {
+    if ((0, import_fs15.existsSync)((0, import_path13.join)(current, ".git"))) return current;
+    const parent = (0, import_path13.dirname)(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+function resolvePrivateRepoRoot(input) {
+  if (input.explicitPrivateRepoRoot) {
+    return { root: (0, import_path13.resolve)(input.explicitPrivateRepoRoot), explicit: true };
+  }
+  const cwd = (0, import_path13.resolve)(input.cwd || process.cwd());
+  const gitRoot = findNearestGitRoot(cwd);
+  if (gitRoot) return { root: gitRoot, explicit: false };
+  return {
+    root: (0, import_path13.join)(cwd, ".foh-no-private-repo-root-sentinel"),
+    explicit: false
+  };
+}
 function promptVersionFromPath(promptPath) {
   const raw = (0, import_fs15.readFileSync)(promptPath, "utf8");
   if (raw.includes("Do not assume access to the private source repository")) return "blank-setup.v1";
@@ -39881,7 +39907,11 @@ function createExternalAgentExecutorPlan(options) {
   const codexSandboxMode = normalizeCodexSandboxMode(options.codexSandboxMode);
   const codexModel = runner === "codex" ? normalizeCodexModel(options.codexModel) : null;
   const codexNetworkAccess = options.codexNetworkAccess === true;
-  const privateRepoRoot = (0, import_path13.resolve)(options.privateRepoRoot || options.cwd || process.cwd());
+  const privateRepo = resolvePrivateRepoRoot({
+    explicitPrivateRepoRoot: options.privateRepoRoot,
+    cwd: options.cwd
+  });
+  const privateRepoRoot = privateRepo.root;
   const workspaceRoot = resolveWorkspaceRoot({ batchPath, workspaceRoot: options.workspaceRoot, privateRepoRoot });
   if (isPathInside(workspaceRoot, privateRepoRoot)) {
     throw new ExternalAgentExecutorError(
@@ -39972,7 +40002,7 @@ function createExternalAgentExecutorPlan(options) {
     batch_path: batchPath,
     batch_dir: batchDir,
     private_repo_root: privateRepoRoot,
-    private_repo_root_explicit: Boolean(options.privateRepoRoot),
+    private_repo_root_explicit: privateRepo.explicit,
     workspace_root: workspaceRoot,
     timeout_minutes: timeoutMinutes,
     safety: {

package/package.json

@@ -1,41 +1,41 @@
-{
-  "name": "@f-o-h/cli",
-  "version": "0.1.67",
-  "description": "FOH CLI - AI-operator provisioning tool for Front Of House",
-  "license": "UNLICENSED",
-  "bin": {
-    "foh": "dist/foh.js"
-  },
-  "main": "dist/foh.js",
-  "files": [
-    "dist/",
-    "examples/",
-    "schemas/",
-    "README.md",
-    "package.json"
-  ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "scripts": {
-    "build": "node build.mjs",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "commander": "^12.1.0",
-    "js-yaml": "^4.1.1",
-    "picocolors": "^1.1.1",
-    "zod": "^4.3.6"
-  },
-  "devDependencies": {
-    "@types/js-yaml": "^4.0.9",
-    "@types/node": "^22.0.0",
-    "esbuild": "^0.24.0",
-    "vitest": "^2.0.0"
-  }
-}
+{
+  "name": "@f-o-h/cli",
+  "version": "0.1.69",
+  "description": "FOH CLI - AI-operator provisioning tool for Front Of House",
+  "license": "UNLICENSED",
+  "bin": {
+    "foh": "dist/foh.js"
+  },
+  "main": "dist/foh.js",
+  "files": [
+    "dist/",
+    "examples/",
+    "schemas/",
+    "README.md",
+    "package.json"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "node build.mjs",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "commander": "^12.1.0",
+    "js-yaml": "^4.1.1",
+    "picocolors": "^1.1.1",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^22.0.0",
+    "esbuild": "^0.24.0",
+    "vitest": "^2.0.0"
+  }
+}