@golden-frijoles/cli 0.1.0 → 0.2.0

package/README.md

@@ -103,6 +103,25 @@ could run: the credentials file, the credential, its shape, whether the deployme
 it accepts you, whether your active project is reachable, and whether this CLI is current. It never
 prints key material.
 
+Then one line per module (Plan, Build, Ship, Measure, Spend, Operate): *configured*, *not
+configured* (with the command that fixes it) or *could not look*. Module lines never change the
+exit code.
+
+## Settings: `gf setup` and `gf config`
+
+```bash
+gf setup                                   # three questions, each with a default; --yes takes them all
+gf config list                             # every setting, and which file it came from
+gf config get review.reviewScope
+gf config set review.reviewScope every-pr
+```
+
+Settings live in the project's `golden-frijoles.config.json`, the same file the Golden Frijoles
+skills read and write: these verbs use the config core that ships in `@golden-frijoles/kit`, so
+there is one set of rules. `set` refuses anything that looks like a secret (keep those in
+`.env.local`), and legacy files such as `review-config.json` are read but never edited. None of these
+verbs needs a credential.
+
 ## Environment
 
 | Variable | What it does |

package/dist/commands/config.d.ts

@@ -0,0 +1,23 @@
+import type { Command, CommandContext } from '../command';
+import { type RegistryEntry } from '../config-core';
+export declare const configListCommand: Command;
+export declare const configGetCommand: Command;
+export declare const configSetCommand: Command;
+/** Pure — the next cursor position for one keypress, or a final answer. Exported for the unit tests. */
+export declare function stepChoice(cursor: number, count: number, key: {
+    name?: string;
+    ctrl?: boolean;
+}): {
+    cursor: number;
+    done?: 'chosen' | 'default' | 'abort';
+};
+/** A chooser: given a question, resolves to the chosen value — or `undefined` when setup is aborted. */
+export type Chooser = (entry: RegistryEntry, choices: readonly unknown[]) => Promise<unknown>;
+/** Swapped by the unit tests; production uses the TTY chooser. */
+export declare const setupIo: {
+    isInteractive: () => boolean;
+    chooser: (context: CommandContext) => Chooser;
+};
+export declare const setupCommand: Command;
+/** Pure — what to do after setup, from the answers. Same rules as the umbrella skill's Stage 2. */
+export declare function nextSteps(answers: Record<string, unknown>, kit: string | null): string[];

package/dist/commands/config.js

@@ -0,0 +1,258 @@
+"use strict";
+// golden-frijoles-plugin · S5.2 — `gf config list|get|set` and `gf setup`.
+//
+// ── A thin front end over the kit's config core (D10) ─────────────────────────────────────────
+// Every rule — which file wins, what counts as a secret, where the project root is — lives in
+// `@golden-frijoles/kit/config` (see ../config-core.ts). These verbs parse arguments, call the core
+// and print. A `ConfigError` from the core (a malformed file, a value that looks like a secret, an
+// unknown section) is the caller's to fix, so it is EXIT.USAGE; nothing here decides what is valid.
+//
+// ── Local verbs: no credential, no network ────────────────────────────────────────────────────
+// `needsAuth: false` on all four. They read and write one file in the project; demanding a login
+// to change which reviewers run would make configuration depend on an account nobody needs.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupCommand = exports.setupIo = exports.configSetCommand = exports.configGetCommand = exports.configListCommand = void 0;
+exports.stepChoice = stepChoice;
+exports.nextSteps = nextSteps;
+const node_readline_1 = require("node:readline");
+const args_1 = require("../args");
+const config_core_1 = require("../config-core");
+const exit_codes_1 = require("../exit-codes");
+/** Load the core, or say plainly why it could not be loaded. `null` means the failure was already emitted. */
+async function coreOrFail(context) {
+    try {
+        const core = await (0, config_core_1.loadConfigCore)();
+        return { core, root: core.projectRoot({ env: context.env, cwd: context.cwd }) };
+    }
+    catch (err) {
+        context.emit.fail('server_error', `Could not load the config core from @golden-frijoles/kit: ${err instanceof Error ? err.message : String(err)}. ` +
+            'Reinstall the CLI (`npm i -g @golden-frijoles/cli`).');
+        return null;
+    }
+}
+/** A ConfigError is the caller's to fix (EXIT.USAGE); anything else is a bug and propagates to run()'s catch. */
+function configFailure(context, core, err) {
+    if (err instanceof core.ConfigError) {
+        context.emit.fail('invalid', err.message);
+        return exit_codes_1.EXIT.USAGE;
+    }
+    throw err;
+}
+const show = (value) => (typeof value === 'string' ? value : JSON.stringify(value));
+exports.configListCommand = {
+    path: ['config', 'list'],
+    summary: 'every setting in golden-frijoles.config.json and the legacy files, and which files each section came from',
+    usage: 'gf config list [--json]',
+    needsAuth: false,
+    detail: `Reads the project's golden-frijoles.config.json and any legacy config files
+  (review-config.json, jev.config.json, …). Where both set a section, the new file wins.`,
+    flags: [],
+    async run(context) {
+        if (context.args.positionals.length > 0) {
+            context.emit.fail('invalid', 'Usage: `gf config list` takes no arguments. For one setting: `gf config get <key>`.');
+            return exit_codes_1.EXIT.USAGE;
+        }
+        const loaded = await coreOrFail(context);
+        if (!loaded)
+            return exit_codes_1.EXIT.SERVER;
+        const { core, root } = loaded;
+        try {
+            const config = core.loadConfig({ root });
+            const names = Object.keys(config.sections);
+            const human = names.length
+                ? names
+                    .map((name) => `${name}  (${config.sources[name].map((source) => source.split('/').pop()).join(' + ')})\n` +
+                    JSON.stringify(config.sections[name], null, 2).replace(/^/gm, '  '))
+                    .join('\n')
+                : `No settings yet: no ${core.CONFIG_FILENAME} and no legacy config files. Run \`gf setup\`.`;
+            context.emit.ok({ root, ...config }, human);
+            return exit_codes_1.EXIT.OK;
+        }
+        catch (err) {
+            return configFailure(context, core, err);
+        }
+    },
+};
+exports.configGetCommand = {
+    path: ['config', 'get'],
+    summary: "one setting's effective value (or its default when nothing sets it)",
+    usage: 'gf config get <key> [--json]',
+    needsAuth: false,
+    flags: [],
+    async run(context) {
+        const [key, ...extra] = context.args.positionals;
+        if (!key || extra.length > 0) {
+            context.emit.fail('invalid', 'Usage: `gf config get <key>`, e.g. `gf config get review.reviewScope`.');
+            return exit_codes_1.EXIT.USAGE;
+        }
+        const loaded = await coreOrFail(context);
+        if (!loaded)
+            return exit_codes_1.EXIT.SERVER;
+        const { core, root } = loaded;
+        try {
+            const value = core.getKey(key, { root });
+            context.emit.ok({ key, value: value ?? null }, show(value ?? null));
+            return exit_codes_1.EXIT.OK;
+        }
+        catch (err) {
+            return configFailure(context, core, err);
+        }
+    },
+};
+exports.configSetCommand = {
+    path: ['config', 'set'],
+    summary: 'change one setting in golden-frijoles.config.json',
+    usage: 'gf config set <key> <value> [--json]',
+    needsAuth: false,
+    detail: `<value> is read as JSON when it is valid JSON (true, 3, ["codex","claude"]), otherwise
+  as text. Refuses anything that looks like a secret: keep keys and tokens in .env.local.
+  Legacy config files are never edited.`,
+    flags: [],
+    async run(context) {
+        const [key, ...words] = context.args.positionals;
+        if (!key || words.length === 0) {
+            context.emit.fail('invalid', 'Usage: `gf config set <key> <value>`, e.g. `gf config set review.reviewScope every-pr`.');
+            return exit_codes_1.EXIT.USAGE;
+        }
+        const loaded = await coreOrFail(context);
+        if (!loaded)
+            return exit_codes_1.EXIT.SERVER;
+        const { core, root } = loaded;
+        try {
+            core.setKey(key, (0, config_core_1.parseValue)(words.join(' ')), { root });
+            const value = core.getKey(key, { root });
+            context.emit.ok({ key, value: value ?? null }, `${key} = ${JSON.stringify(value ?? null)}`);
+            return exit_codes_1.EXIT.OK;
+        }
+        catch (err) {
+            return configFailure(context, core, err);
+        }
+    },
+};
+// ── gf setup ──────────────────────────────────────────────────────────────────────────────────
+/** Pure — the next cursor position for one keypress, or a final answer. Exported for the unit tests. */
+function stepChoice(cursor, count, key) {
+    if (key.ctrl && key.name === 'c')
+        return { cursor, done: 'abort' };
+    if (key.name === 'up' || key.name === 'k')
+        return { cursor: (cursor + count - 1) % count };
+    if (key.name === 'down' || key.name === 'j')
+        return { cursor: (cursor + 1) % count };
+    if (key.name === 'return' || key.name === 'enter')
+        return { cursor, done: 'chosen' };
+    if (key.name === 'escape' || key.name === 's')
+        return { cursor, done: 'default' };
+    return { cursor };
+}
+/** Arrow keys to move, Enter to choose, Esc or `s` to skip (the default). Only used on a real TTY. */
+const ttyChooser = (context) => (entry, choices) => new Promise((resolve) => {
+    const stdin = process.stdin;
+    const defaultIndex = Math.max(0, choices.indexOf(entry.default));
+    let cursor = defaultIndex;
+    const draw = (first) => {
+        if (!first)
+            process.stderr.write(`\x1b[${choices.length}A`);
+        choices.forEach((choice, index) => process.stderr.write(`\x1b[2K${index === cursor ? '›' : ' '} ${show(choice)}${choice === entry.default ? '  (default)' : ''}\n`));
+    };
+    context.writer.err(`${entry.question}${entry.required ? '' : '  [Esc skips]'}`);
+    draw(true);
+    (0, node_readline_1.emitKeypressEvents)(stdin);
+    stdin.setRawMode(true);
+    stdin.resume();
+    const onKey = (_, key) => {
+        const next = stepChoice(cursor, choices.length, key ?? {});
+        cursor = next.cursor;
+        if (!next.done)
+            return draw(false);
+        stdin.off('keypress', onKey);
+        stdin.setRawMode(false);
+        stdin.pause();
+        if (next.done === 'abort')
+            return resolve(undefined);
+        resolve(next.done === 'chosen' || entry.required ? choices[cursor] : entry.default);
+    };
+    stdin.on('keypress', onKey);
+});
+/** Swapped by the unit tests; production uses the TTY chooser. */
+exports.setupIo = {
+    isInteractive: () => Boolean(process.stdin.isTTY && process.stderr.isTTY),
+    chooser: ttyChooser,
+};
+exports.setupCommand = {
+    path: ['setup'],
+    summary: 'answer the setup questions (each has a default; only the first is required)',
+    usage: 'gf setup [--yes] [--json]',
+    needsAuth: false,
+    detail: `Asks what you are working on, where you are starting, and whether to connect an
+  account now — arrow keys to choose, Esc to take the default. --yes takes every default without
+  asking. Answers go to golden-frijoles.config.json; an account is connected with \`gf login\` and
+  \`gf init\`, which write .env.local, never the config file.`,
+    flags: [{ name: 'yes', describe: 'take every default without asking (required when not on a terminal)' }],
+    async run(context) {
+        const yes = (0, args_1.boolFlag)(context.args, 'yes');
+        if (context.args.positionals.length > 0) {
+            context.emit.fail('invalid', 'Usage: `gf setup [--yes]` takes no arguments.');
+            return exit_codes_1.EXIT.USAGE;
+        }
+        if (!yes && !exports.setupIo.isInteractive()) {
+            context.emit.fail('invalid', '`gf setup` asks questions on a terminal. Not on one: pass --yes for the defaults, or set each ' +
+                'answer with `gf config set <key> <value>`.');
+            return exit_codes_1.EXIT.USAGE;
+        }
+        const loaded = await coreOrFail(context);
+        if (!loaded)
+            return exit_codes_1.EXIT.SERVER;
+        const { core, root } = loaded;
+        const choose = yes ? null : exports.setupIo.chooser(context);
+        const answers = {};
+        try {
+            for (const entry of core.REGISTRY.filter((row) => row.askWhen === 'setup')) {
+                const choices = entry.choices ?? [entry.default];
+                const answer = choose ? await choose(entry, choices) : entry.default;
+                if (answer === undefined) {
+                    context.emit.fail('invalid', 'Setup stopped. Nothing after the last answered question was saved.', {
+                        answers,
+                    });
+                    return exit_codes_1.EXIT.USAGE;
+                }
+                answers[entry.key] = answer;
+                // `store: 'env'` answers are not settings: connecting an account is `gf login` + `gf init`.
+                if (entry.store !== 'env')
+                    core.setKey(entry.key, answer, { root });
+            }
+        }
+        catch (err) {
+            return configFailure(context, core, err);
+        }
+        const next = nextSteps(answers, (0, config_core_1.kitVersion)());
+        const envKeys = new Set(core.REGISTRY.filter((row) => row.store === 'env').map((row) => row.key));
+        const saved = Object.entries(answers).filter(([key]) => !envKeys.has(key));
+        const notSaved = Object.entries(answers).filter(([key]) => envKeys.has(key));
+        context.emit.ok({ root, answers, next }, [
+            `Saved to ${core.CONFIG_FILENAME} in ${root}${yes ? ' (--yes: every default)' : ''}:`,
+            ...saved.map(([key, value]) => `  ${key} = ${show(value)}`),
+            ...(notSaved.length
+                ? ['Not saved (an account lives in .env.local, via `gf login` + `gf init`):']
+                : []),
+            ...notSaved.map(([key, value]) => `  ${key} = ${show(value)}`),
+            '',
+            'Next:',
+            ...next.map((step) => `  ${step}`),
+            '',
+            'Change any answer later with `gf config set <key> <value>`.',
+        ].join('\n'));
+        return exit_codes_1.EXIT.OK;
+    },
+};
+/** Pure — what to do after setup, from the answers. Same rules as the umbrella skill's Stage 2. */
+function nextSteps(answers, kit) {
+    const steps = [];
+    if (answers['project.account'] === 'now')
+        steps.push('Connect your account: `gf login`, then `gf init`.');
+    if (answers['project.mode'] === 'existing' || answers['project.mode'] === 'new')
+        steps.push(`Add the Roadmap/ skeleton: \`npx -y @golden-frijoles/kit${kit ? `@${kit}` : ''} init\` (it never overwrites anything).`);
+    steps.push(answers['project.startPoint'] === 'building'
+        ? 'Ask your agent to run the `live-smoke` skill against what you are building.'
+        : 'Ask your agent to run the `groom` skill on your first idea.');
+    return steps;
+}

package/dist/commands/doctor.js

@@ -25,6 +25,8 @@ const credentials_1 = require("../credentials");
 const exit_codes_1 = require("../exit-codes");
 const output_1 = require("../output");
 const version_1 = require("../version");
+const config_core_1 = require("../config-core");
+const modules_1 = require("../modules");
 exports.doctorCommand = {
     path: ['doctor'],
     summary: 'why is it not working — every check, in order',
@@ -33,10 +35,15 @@ exports.doctorCommand = {
     detail: `Runs whether or not you are logged in — diagnosing a missing credential is the
   point. Prints no key material in either mode.
 
-  Exits 0 when every check that could run passed, and non-zero naming the first that did not.`,
+  Exits 0 when every check that could run passed, and non-zero naming the first that did not.
+  Then one line per module (Plan, Build, Ship, Measure, Spend, Operate): configured, not
+  configured (with the command that fixes it) or could not look. Module lines never change the
+  exit code.`,
     flags: [{ name: 'project', value: '<slug>', describe: 'check this project instead of the remembered one' }],
     async run(context) {
         const checks = [];
+        const modules = await moduleReport(context);
+        const report = (ctx, list) => printReport(ctx, list, modules);
         const path = (0, credentials_1.credentialsPath)(context.env);
         // ── 1. is there a credential at all, and where did it come from ───────────────────────────
         const fileExists = (0, node_fs_1.existsSync)(path);
@@ -215,9 +222,15 @@ function describeSource(source) {
  * legitimately be living with, and a doctor that exits non-zero for them is a doctor whose exit code
  * nobody can put in a CI step.
  */
-function report(context, checks) {
+function printReport(context, checks, modules) {
     const failed = checks.find((check) => check.status === 'fail');
-    context.emit.ok({ checks, healthy: failed === undefined }, checks.map((check) => `${symbol(check.status)} ${(0, output_1.pad)(check.id, 20)} ${check.detail}`).join('\n'));
+    context.emit.ok({ checks, healthy: failed === undefined, modules }, [
+        ...checks.map((check) => `${symbol(check.status)} ${(0, output_1.pad)(check.id, 20)} ${check.detail}`),
+        '',
+        'modules',
+        ...modules.map((line) => `${(0, output_1.pad)(line.module, 8)} ${(0, output_1.pad)(line.state.replace(/-/g, ' '), 15)} ${line.detail}${line.fix ? `  Fix: ${line.fix}` : ''}`),
+    ].join('\n'));
+    // D13: `modules` is reported, never scored. The exit code below is the checks' alone.
     if (!failed)
         return exit_codes_1.EXIT.OK;
     // The failing check decides the code, so a caller branching on it gets the same vocabulary the
@@ -228,6 +241,22 @@ function report(context, checks) {
         return exit_codes_1.EXIT.NOT_FOUND;
     return exit_codes_1.EXIT.AUTH;
 }
+/** The module lines for this project. Loading the kit can fail; that is could-not-look, never a thrown error. */
+async function moduleReport(context) {
+    const hasCredential = context.auth.token !== null;
+    try {
+        const core = await (0, config_core_1.loadConfigCore)();
+        const root = core.projectRoot({ env: context.env, cwd: context.cwd });
+        return (0, modules_1.moduleLines)(core, { root, hasCredential });
+    }
+    catch (err) {
+        return (0, modules_1.moduleLines)(null, {
+            root: null,
+            hasCredential,
+            unavailable: `could not load @golden-frijoles/kit: ${err instanceof Error ? err.message : String(err)}`,
+        });
+    }
+}
 function symbol(status) {
     if (status === 'ok')
         return 'ok  ';

package/dist/commands/index.js

@@ -15,11 +15,16 @@ const flags_history_1 = require("./flags-history");
 const flags_sync_1 = require("./flags-sync");
 const keys_1 = require("./keys");
 const doctor_1 = require("./doctor");
+const config_1 = require("./config");
 exports.COMMANDS = [
     auth_1.loginCommand,
     auth_1.logoutCommand,
     auth_1.whoamiCommand,
     doctor_1.doctorCommand,
+    config_1.setupCommand,
+    config_1.configListCommand,
+    config_1.configGetCommand,
+    config_1.configSetCommand,
     init_1.initCommand,
     projects_1.projectsLsCommand,
     projects_1.projectsCreateCommand,

package/dist/config-core.d.ts

@@ -0,0 +1,53 @@
+export type RegistryEntry = {
+    key: string;
+    module: 'Plan' | 'Build' | 'Ship' | 'Measure' | 'Spend' | 'Operate';
+    askWhen: string;
+    default: unknown;
+    question: string;
+    required?: boolean;
+    choices?: readonly unknown[];
+    store?: 'env';
+};
+type Io = {
+    root?: string;
+};
+/** The subset of the kit's `lib/config.mjs` this CLI calls. The kit ships the full types (config.d.mts). */
+export type ConfigCore = {
+    CONFIG_FILENAME: string;
+    LEGACY: Readonly<Record<string, string>>;
+    REGISTRY: readonly RegistryEntry[];
+    MODULES: readonly RegistryEntry['module'][];
+    ConfigError: new (message: string) => Error;
+    projectRoot(opts?: {
+        env?: NodeJS.ProcessEnv;
+        cwd?: string;
+    }): string;
+    readSection(name: string, opts?: Io): {
+        raw: unknown;
+        present: boolean;
+        sources: string[];
+    };
+    loadConfig(opts?: Io): {
+        sections: Record<string, unknown>;
+        sources: Record<string, string[]>;
+        duplicates: string[];
+        unknown: string[];
+    };
+    getKey(key: string, opts?: Io): unknown;
+    setKey(key: string, value: unknown, opts?: Io): Record<string, unknown>;
+};
+/** The installed kit's version, so a printed `npx @golden-frijoles/kit@<v>` runs the same code this CLI uses. */
+export declare function kitVersion(): string | null;
+/** Load the kit's config core once per process. Rejects when the kit is not installed or not loadable. */
+export declare function loadConfigCore(): Promise<ConfigCore>;
+/** Pure — a command-line value: JSON when it parses (true, 3, ["a"], null), otherwise the literal string. Same rule as `gf-kit config set`. */
+export declare function parseValue(text: string): unknown;
+/**
+ * The value a key has in the FILES — `undefined` when nothing sets it, never the registry default.
+ *
+ * `getKey` answers "what will a rail use", which falls back to the default; doctor and setup need
+ * "did anyone answer this", which must not. Same section resolution as the kit's `getKey`
+ * (a dotted sub-section with its own legacy file, like `smoke.triage`, is read as that sub-section).
+ */
+export declare function answeredValue(core: ConfigCore, key: string, root: string): unknown;
+export {};

package/dist/config-core.js

@@ -0,0 +1,84 @@
+"use strict";
+// golden-frijoles-plugin · S5.2 (D10) — the ONE config core, loaded from `@golden-frijoles/kit`.
+//
+// ── Why this CLI does not have its own config code ────────────────────────────────────────────
+// `gf config`, `gf setup` and `gf doctor`'s module lines read and write the same
+// golden-frijoles.config.json the kit's `gf-kit config` does, and an agent's skill writes it too.
+// Two implementations of "which file wins, what counts as a secret, where the project root is"
+// would drift, and the drift would show up as a setting one front end saved and the other ignored.
+// So every rule lives in the kit (`@golden-frijoles/kit/config`), and this file only loads it.
+//
+// ── Why `new Function('return import(u)')` and a file URL ─────────────────────────────────────
+// The kit is ESM and this CLI builds to CommonJS. TypeScript compiles a literal `import()` in a
+// CommonJS build into `require()`, which cannot load ESM on every Node this CLI supports
+// (engines >=20). A dynamic import the compiler cannot see survives into the build as a real
+// `import()`. It is handed an ABSOLUTE file URL (resolved through the kit's exported
+// package.json), so where that import resolves from never matters.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.kitVersion = kitVersion;
+exports.loadConfigCore = loadConfigCore;
+exports.parseValue = parseValue;
+exports.answeredValue = answeredValue;
+const node_fs_1 = require("node:fs");
+const node_module_1 = require("node:module");
+const node_path_1 = require("node:path");
+const node_url_1 = require("node:url");
+const importEsm = new Function('url', 'return import(url)');
+let cached = null;
+/** The kit's package.json, resolved the way Node resolves this CLI's own dependency. */
+function kitPackageJson() {
+    // `require` exists in the CommonJS build; the unit tests run this source as ESM, where it does not.
+    const req = typeof require === 'function' ? require : (0, node_module_1.createRequire)((0, node_path_1.join)(process.cwd(), 'noop.js'));
+    return req.resolve('@golden-frijoles/kit/package.json');
+}
+/** The installed kit's version, so a printed `npx @golden-frijoles/kit@<v>` runs the same code this CLI uses. */
+function kitVersion() {
+    try {
+        return JSON.parse((0, node_fs_1.readFileSync)(kitPackageJson(), 'utf8')).version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Load the kit's config core once per process. Rejects when the kit is not installed or not loadable. */
+function loadConfigCore() {
+    if (!cached) {
+        cached = (async () => {
+            const pkg = kitPackageJson();
+            return (await importEsm((0, node_url_1.pathToFileURL)((0, node_path_1.join)((0, node_path_1.dirname)(pkg), 'dist', 'lib', 'config.mjs')).href));
+        })();
+        // A failed load is not cached: the next call tries again rather than repeating a stale error.
+        cached.catch(() => {
+            cached = null;
+        });
+    }
+    return cached;
+}
+/** Pure — a command-line value: JSON when it parses (true, 3, ["a"], null), otherwise the literal string. Same rule as `gf-kit config set`. */
+function parseValue(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+/**
+ * The value a key has in the FILES — `undefined` when nothing sets it, never the registry default.
+ *
+ * `getKey` answers "what will a rail use", which falls back to the default; doctor and setup need
+ * "did anyone answer this", which must not. Same section resolution as the kit's `getKey`
+ * (a dotted sub-section with its own legacy file, like `smoke.triage`, is read as that sub-section).
+ */
+function answeredValue(core, key, root) {
+    const [head, ...rest] = key.split('.');
+    const section = rest.length > 0 && core.LEGACY[`${head}.${rest[0]}`] ? `${head}.${rest.shift()}` : head;
+    const { raw } = core.readSection(section, { root });
+    let value = raw ?? undefined;
+    for (const part of rest) {
+        if (value === null || typeof value !== 'object')
+            return undefined;
+        value = value[part];
+    }
+    return value === null ? undefined : value;
+}

package/dist/modules.d.ts

@@ -0,0 +1,20 @@
+import { type ConfigCore, type RegistryEntry } from './config-core';
+export type ModuleState = 'configured' | 'not-configured' | 'could-not-look';
+export type ModuleLine = {
+    module: RegistryEntry['module'];
+    state: ModuleState;
+    /** One sentence. For not-configured it names what is missing; for could-not-look, why. */
+    detail: string;
+    /** The command that fixes a not-configured module. `null` in the other two states. */
+    fix: string | null;
+};
+export declare const MODULE_ORDER: readonly RegistryEntry['module'][];
+/**
+ * Pure given the core — one line per module. `core === null` (or a core that throws while reading)
+ * makes every line could-not-look, with the reason.
+ */
+export declare function moduleLines(core: ConfigCore | null, opts: {
+    root: string | null;
+    hasCredential: boolean;
+    unavailable?: string;
+}): ModuleLine[];

package/dist/modules.js

@@ -0,0 +1,90 @@
+"use strict";
+// golden-frijoles-plugin · S5.3 (D13) — one line per product module, for `gf doctor`.
+//
+// ── Three states, never two ───────────────────────────────────────────────────────────────────
+// *configured*, *not configured* (with the command that fixes it) and *could not look*. The last is
+// its own state because "the config file is malformed" or "the kit is not installed" is a different
+// fact, with a different remedy, from "you have not answered this yet" (LEARNINGS: could not look is
+// never the failure outcome, and never silently the success one).
+//
+// ── Read from the registry, not a list kept here ──────────────────────────────────────────────
+// The questions a module needs answered are the kit registry's rows for that module, minus the
+// `never-yet` ones (declared, but nothing asks them this release). A new setting in the kit shows up
+// here with no change to this file.
+//
+// ── Never changes doctor's exit code (D13) ────────────────────────────────────────────────────
+// Doctor's exit code answers "can this CLI reach your project". An unanswered setting is normal on a
+// fresh repo; a CI step running `gf doctor` must not start failing because nobody chose reviewers.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MODULE_ORDER = void 0;
+exports.moduleLines = moduleLines;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const init_1 = require("./commands/init");
+const config_core_1 = require("./config-core");
+exports.MODULE_ORDER = [
+    'Plan',
+    'Build',
+    'Ship',
+    'Measure',
+    'Spend',
+    'Operate',
+];
+/** `.env.local` carries a Golden Frijoles project (what `gf init` writes). Where a `store: 'env'` answer lives. */
+function accountConnected(root, hasCredential) {
+    if (hasCredential)
+        return true;
+    const path = (0, node_path_1.join)(root, '.env.local');
+    if (!(0, node_fs_1.existsSync)(path))
+        return false;
+    return (0, init_1.readEnvValue)((0, node_fs_1.readFileSync)(path, 'utf8'), init_1.ENV_KEYS.flagRead) !== null;
+}
+function fixFor(entry) {
+    if (entry.store === 'env')
+        return '`gf login`, then `gf init`';
+    if (entry.askWhen === 'setup')
+        return '`gf setup`';
+    return `\`gf config set ${entry.key} <value>\``;
+}
+/**
+ * Pure given the core — one line per module. `core === null` (or a core that throws while reading)
+ * makes every line could-not-look, with the reason.
+ */
+function moduleLines(core, opts) {
+    const couldNotLook = (why) => exports.MODULE_ORDER.map((module) => ({ module, state: 'could-not-look', detail: why, fix: null }));
+    if (!core || !opts.root)
+        return couldNotLook(opts.unavailable ?? 'the config core is not available.');
+    const root = opts.root;
+    try {
+        return exports.MODULE_ORDER.map((module) => {
+            const asked = core.REGISTRY.filter((row) => row.module === module && row.askWhen !== 'never-yet');
+            // Nothing to answer is not "not configured": that state promises a fix, and there is none to give.
+            if (asked.length === 0)
+                return { module, state: 'configured', detail: 'nothing to set in this release.', fix: null };
+            // Missing = needs an answer to work: an account not connected, or a setting that is required or
+            // has no safe default (`null`: "unanswered", which a rail treats as its safest choice — jev.egress
+            // never sends). A setting with a real default is not missing; the rail already uses the default.
+            const missing = asked.filter((entry) => entry.store === 'env'
+                ? !accountConnected(root, opts.hasCredential)
+                : (entry.required || entry.default === null) && (0, config_core_1.answeredValue)(core, entry.key, root) === undefined);
+            if (missing.length === 0) {
+                const answered = asked.filter((entry) => entry.store !== 'env' && (0, config_core_1.answeredValue)(core, entry.key, root) !== undefined);
+                return {
+                    module,
+                    state: 'configured',
+                    detail: `${answered.length} of ${asked.length} settings answered; the rest use their defaults.`,
+                    fix: null,
+                };
+            }
+            return {
+                module,
+                state: 'not-configured',
+                detail: `not answered: ${missing.map((entry) => entry.key).join(', ')}.`,
+                fix: [...new Set(missing.map(fixFor))].join(' · '),
+            };
+        });
+    }
+    catch (err) {
+        return couldNotLook(`could not read the project's settings: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.1.0";
+export declare const VERSION = "0.2.0";

package/dist/version.js

@@ -10,4 +10,4 @@ exports.VERSION = void 0;
 //
 // It is a literal, and `version.test.ts` asserts it equals `package.json`'s — so the two cannot
 // drift, and the drift is caught by the unit gate rather than by someone reading `gf --version`.
-exports.VERSION = '0.1.0';
+exports.VERSION = '0.2.0';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@golden-frijoles/cli",
   "private": false,
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "The Golden Frijoles CLI — create, roll out and kill feature flags from a terminal, or from an agent.",
   "bin": {
     "gf": "./dist/bin.js"
@@ -32,6 +32,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
+    "@golden-frijoles/kit": "0.5.1",
     "@golden-frijoles/sdk": "^0.5.0"
   },
   "devDependencies": {