@intentius/chant 0.79.0 → 0.81.0

package/src/cli/main.ts

@@ -6,6 +6,7 @@ import { formatSuccess, formatError } from "./format";
 import { loadPlugins, resolveProjectLexicons } from "./plugins";
 import { resolveCommand, type CommandDef, type ParsedArgs } from "./registry";
 import { loadChantConfigUpward } from "../config";
+import { findProjectRoot, findWorkspaceRoot } from "../project-root";
 import { validateLexiconConfig, formatLexiconConfigProblems } from "../lexicon-config";
 import { armSandboxConfigEvaluation } from "../config-sandbox";
 import { armSandboxPolicyExecution } from "../lint/policy-import";
@@ -27,6 +28,7 @@ import { runCarveStatus } from "./handlers/carve-status";
 import { runLifecycleSnapshot, runLifecycleShow, runLifecycleDiff, runLifecycleRollback, runLifecyclePlan, runLifecycleAffected, runLifecycleLog, runLifecycleTeardown, runLifecycleWhoami, runLifecycleUnknown } from "./handlers/lifecycle";
 import { runComponentsStatus, runComponentsReleaseRecord, runComponentsExport, runComponentsUnknown } from "./handlers/components";
 import { runComponentsFanOut } from "./handlers/fan-out";
+import { runComponentsPromote, runComponentsRollback, runComponentsRedeploy } from "./handlers/promote";
 import { runScenarioCheck, runScenarioUnknown } from "./handlers/scenario";
 import { runGraph } from "./handlers/graph";
 import { runExplain } from "./handlers/explain";
@@ -93,6 +95,10 @@ const BOOLEAN_FLAGS = new Set([
   "--fail-on-drift",
   "--durable-requests",
   "--skip-mcp",
+  "--current",
+  "--allow-code",
+  "--root-only",
+  "--generated",
 ]);
 
 /**
@@ -205,8 +211,9 @@ export function parseArgs(args: string[]): ParsedArgs {
       if (v !== "source" && v !== "live") throw new Error(`--overlay-anchor must be 'source' or 'live', got '${v}'`);
       result.overlayAnchor = v;
     } else if (arg === "--from") {
-      // Shared by `migrate --from <lexicon>` and `import --from <env>`; the
-      // two commands never run together, so one field carries both.
+      // Shared by `migrate --from <lexicon>`, `import --from <env>`,
+      // `components promote --from <env>` and `init --from <repo>@<ref>`;
+      // the commands never run together, so one field carries all four.
       result.migrateFrom = args[++i];
     } else if (arg === "--kustomize") {
       // `chant import --kustomize <dir>` (#1548): render the overlay, import
@@ -265,6 +272,9 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.src = args[++i];
     } else if (arg === "--env") {
       result.env = args[++i];
+    } else if (arg === "--promote-to") {
+      result.promoteTo = args[++i];
+      if (!result.promoteTo || result.promoteTo.startsWith("-")) throw new Error("--promote-to needs an environment: --promote-to <env>");
     } else if (arg === "--tier") {
       result.tier = args[++i];
     } else if (arg === "--agents") {
@@ -277,6 +287,9 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.runtime = args[++i];
     } else if (arg === "--fail-on") {
       result.failOn = args[++i];
+    } else if (arg === "--max-files") {
+      // Validated by the audit handler, like `--limit` below.
+      result.maxFiles = Number(args[++i]);
     } else if (arg === "--theme") {
       result.theme = args[++i];
     } else if (arg === "--stacks") {
@@ -285,8 +298,12 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.components = true;
     } else if (arg === "--generate") {
       result.generate = args[++i];
+    } else if (arg === "--spec") {
+      result.opsSpec = args[++i];
     } else if (arg === "--dump-outputs") {
       result.dumpOutputs = args[++i];
+    } else if (arg === "--digest-file") {
+      result.digestFile = args[++i];
     } else if (arg === "--seed-outputs") {
       (result.seedOutputs ??= []).push(args[++i]);
     } else if (arg === "--detail") {
@@ -342,6 +359,16 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.deep = true;
     } else if (arg === "--at") {
       result.at = args[++i];
+    } else if (arg === "--kind") {
+      // `chant workspace records --kind <kind file>` (#2546)
+      result.kind = args[++i];
+      if (!result.kind || result.kind.startsWith("-")) throw new Error("--kind needs a kind file: --kind <path>");
+    } else if (arg === "--current") {
+      result.current = true;
+    } else if (arg === "--require") {
+      // `chant workspace records|verify --require attested` (#2547)
+      result.require = args[++i];
+      if (!result.require || result.require.startsWith("-")) throw new Error("--require needs a provenance level: --require attested");
     } else if (arg === "--ambient") {
       result.ambient = true;
     } else if (arg === "--check-live") {
@@ -362,6 +389,7 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.component = args[++i];
     } else if (arg === "--digest") {
       result.digest = args[++i];
+      if (result.digest !== undefined) (result.digests ??= []).push(result.digest);
     } else if (arg === "--git-sha") {
       result.gitSha = args[++i];
     } else if (arg === "--run-id") {
@@ -428,6 +456,24 @@ export function parseArgs(args: string[]): ParsedArgs {
     } else if (arg === "--agent") {
       // #2508 — record the approval as an agent's rather than a person's.
       result.agent = true;
+    } else if (arg === "--allow-code") {
+      // #2550 — `chant workspace upgrade` runs a template's code migrations
+      // only when asked to.
+      result.allowCode = true;
+    } else if (arg === "--root-only") {
+      // #2537 — `chant build` and `chant lint` at a declared workspace root
+      // run on the root project alone instead of refusing with WSP000.
+      result.rootOnly = true;
+    } else if (arg === "--generated") {
+      // #2641 — `chant workspace check --generated` runs each declared
+      // generator and compares its output with the file in the tree.
+      result.generated = true;
+    } else if (arg === "--member") {
+      // #2537 — `chant workspace build|lint|audit|graph --member <name>`.
+      // Repeatable, and a comma list works too.
+      const value = args[++i];
+      if (!value || value.startsWith("-")) throw new Error("--member needs a member or group name: --member <name>");
+      result.members = [...(result.members ?? []), ...value.split(",").map((m) => m.trim()).filter(Boolean)];
     } else if (arg === "--allow-same-origin") {
       // chant#2384 — record a resolution the same-origin rule would refuse,
       // deliberately. Flagged on the record, not just accepted quietly.
@@ -471,6 +517,19 @@ export function parseArgs(args: string[]): ParsedArgs {
     i++;
   }
 
+  // #2603 — `--promote-to` (#2575) adds a job to the pipeline that generate
+  // mode synthesizes; no other command or mode reads it. Checked here, once
+  // the whole command line is known, rather than in the build handler, so
+  // `chant build --promote-to prod` and `chant run --promote-to prod` both
+  // fail instead of running as if the flag were absent. A lexicon-mounted
+  // command that takes its own `--promote-to` still gets it: `main` tries the
+  // plugin commands before rethrowing a parse error.
+  if (result.promoteTo && !(result.command === "build" && result.components && result.generate)) {
+    throw new Error(
+      "--promote-to needs build --components --generate <lexicon>: it adds a promote job to the generated CI pipeline, and only generate mode emits one.",
+    );
+  }
+
   return result;
 }
 
@@ -489,13 +548,21 @@ Usage:
 
 Commands:
   init                  Initialize a new chant project
+                        (--from <repo>@<ref>[#<member>] copies a template
+                        repository and records its lineage; --param
+                        <name>=<value> sets a parameter the template's
+                        chant.template.json declares, repeatable)
   init lexicon <name>   Scaffold a new lexicon plugin project
   build                 Build infrastructure from specification files
-                        (--components --generate gitlab: generate mode (#563) —
-                         synthesize a thin .gitlab-ci.yml that triggers each
-                         discovered component's own deploy in wave order,
-                         instead of a normal lexicon build)
+                        (--components --generate github|gitlab|forgejo:
+                         generate mode (#563), which synthesizes a thin CI
+                         pipeline that triggers each discovered component's
+                         own deploy in wave order, instead of a normal
+                         lexicon build)
+                        At a declared workspace root it refuses with WSP000;
+                        --root-only builds the root project alone
   lint                  Check specifications for issues
+                        (at a declared workspace root: WSP000 unless --root-only)
   list                  List discovered entities
   describe              Show the effective config for one component
   explain               Summarize discovered entities (--format markdown|json|okf;
@@ -503,13 +570,16 @@ Commands:
                         concept per entity + index.md; -o <dir> writes the
                         bundle tree, otherwise JSON path→content on stdout)
   vendor                Pull pinned, checksummed patterns into your repo
+                        (pull [name] | check | migrate; migrate moves
+                        vendor.json into .chant/workspace.lock.json)
   import                Import external template into TypeScript
                         (--agents re-expresses this machine's agent config as
                          chant code instead of reading a template file)
   audit [path|url]      Audit a repo's CI YAML for security issues
                         (--format stylish|json|sarif|markdown|html, -o <file>,
                          --tier merge-worthy|all, --fail-on merge-worthy|warning|error|none,
-                         --template <file> / --theme <file> for the html report)
+                         --template <file> / --theme <file> for the html report,
+                         --max-files <n> to walk more than 1000 files)
                         --agents audits this machine's agent configuration —
                         instruction files, MCP servers, skills, plugins,
                         permissions — instead of a repository
@@ -556,6 +626,11 @@ Ops:
   run approve <op> <gate>  Record a gate's resolution and wake the runtime
   run cancel <name>     Cancel the active run (requires --force)
   run log <name>        Show run history for an Op
+  run --generate <provider>  Write one CI pipeline file per scheduled Op for
+                        github, gitlab or forgejo (#2533), from every Op that
+                        declares a schedule or from --spec <file.json>.
+                        Files go to the forge's own directory unless
+                        --output <dir>; --format json prints them instead
   run --components <name|all>  Run discovered Component(s) through the interpret
                         driver on the local executor (--env <env>; #585).
                         On success, auto-emits a release-ledger record per
@@ -615,6 +690,76 @@ Ops:
                         predicts the account. The level reaches the engine
                         verbatim; without the flag nothing is asked (#2377)
 
+Workspace (level 1, #2524):
+  workspace init [dir]  Propose a chant.workspace.json from the projects and
+                        packages already in the repository, print it with the
+                        directories that would leave the root project, and
+                        write it only on confirmation (--yes writes without
+                        asking; --name <name> names the workspace; --verbose
+                        lists every file leaving the root project)
+  workspace ls [dir]    List the declaration's members and example groups.
+                        A member that can't be read is listed with a reason
+                        code and still exits 0. --at <rev> reads a commit's
+                        git objects; --json prints the read-contract document
+  workspace status <env> [dir] [--compare-to <env>] [--json]
+                        Each member's latest release in <env>, as digest and
+                        git SHA, read from its ledger on the local
+                        chant/lifecycle branch (_members/<member>/ or the flat
+                        layout). --compare-to <env> shows a second environment
+                        beside it and marks the members whose digests differ.
+                        Read only; never fetches. --json prints the
+                        read-contract document
+  workspace records --kind <kind file> [--current] [--at <rev>] [--base <rev>] [--require attested] [--json]
+                        Read the records a record kind locates, validated
+                        against its schema, with reason codes for invalid
+                        ones. --current leaves out superseded records; --at
+                        reads a commit's git objects. Needs no workspace file.
+                        Each record reports its provenance level, judged by
+                        the signers at --base (default: the target branch);
+                        --require attested exits 2 if any record is not
+                        attested
+  workspace verify [--base <rev>] [--head <rev>] [--require attested]
+                        Check the commits in base..head against the signers
+                        and roles read from base. A change to the signers file
+                        or .chant/trust.json needs a signature by a signer
+                        trusted at base. Does nothing without a signers file
+  workspace lineage [--json]
+                        Show each scope in .chant/workspace.lock.json: its
+                        template and pin, locally edited files and open
+                        manual steps. Needs no workspace file
+  workspace lineage resolve <path>
+                        Close a manual step once the file is merged by hand
+  workspace upgrade [<scope>] [--to <ref>] [--allow-code] [--dry-run] [--output <file>]
+                        Bring a lineage scope to a newer template version: fetch
+                        it, migrate and merge per file in a worktree, run build,
+                        lint and workspace check there, then gate on the digest
+                        of the patch (chant approve workspace-upgrade <scope>).
+                        A second run with the approval applies the patch
+  workspace check [--at <rev>] [--json] [--format stylish|json|sarif] [--generated]
+                        Fail on an unreadable lineage lock or an open manual
+                        step, and, in a declared workspace, on a WSP check of
+                        the declaration, member ledgers, pipelines or
+                        generated files. --generated runs declared generators
+                        and compares their output. Needs no workspace file.
+                        --at reads a commit's git objects; --format json
+                        prints the read-contract document
+  workspace build [dir] [--member <name>] [-o <dir>] [--dry-run]
+                        Build every chant member and example project, each with
+                        its own chant, one process per toolchain. -o <dir>
+                        writes <dir>/<member>.json; --member narrows the run;
+                        --dry-run prints which chant runs which project
+  workspace lint [dir] [--format stylish|json|sarif] [--member <name>]
+                        Lint every chant member and example project with its
+                        own chant; sarif writes one run per member
+  workspace audit [dir] [--json] [--member <name>]
+                        Audit each chant member with its own .chant-audit.json;
+                        every finding carries a member field
+  workspace graph [dir] [--at <rev>] [--member <name>] [-o <file>]
+                        Compose each chant member's chant graph into one IR,
+                        with <member>/<id> ids and groups.byMember: the
+                        read-contract document. --at <rev> runs each member's
+                        source as it was at that commit
+
 Lifecycle (alias: lc):
   lifecycle snapshot <env>  Query API, save metadata to orphan branch
                             --deep: also record each resource's property tree,
@@ -670,6 +815,19 @@ Component release ledger + status:
                             [--digest <manifestDigest>] -o <dir> [--json]);
                             copies every image/template/asset/sbom entry
                             byte-for-byte plus a self-describing manifest.json
+  components promote        Deploy the digests one environment's release
+                            ledger records to another, without a build
+                            (--from <env> --to <env> [--component <name>
+                             [--digest <sha256:...>]]; --dry-run prints the
+                             plan; the target's gates still apply)
+  components rollback <env> Redeploy an earlier release of an environment
+                            from its recorded digest (--component <name>
+                            [--digest <sha256:...>]; defaults to the release
+                            before the current one; --dry-run prints the plan)
+  components redeploy <env> Redeploy the release an environment's ledger
+                            records as current, after a deploy that failed
+                            partway (--component <name> [--digest <sha256:...>];
+                            --dry-run prints the plan; gates still apply)
 
 Lexicon development:
   dev generate          Generate lexicon artifacts (+ validate + coverage)
@@ -712,7 +870,8 @@ Options:
                         re-evaluates for that environment (build + graph), and
                         drives organizational policy. Must be in chant.config
                         \`environments\` when declared.
-  -t, --template <name> Init template (e.g. node-pipeline, docker-build)
+  -t, --template <name> Init template (e.g. node-pipeline, docker-build);
+                        records its lineage in .chant/workspace.lock.json
   --skill <name>        Init: install only this skill from the lexicon
   --skip-mcp            Init: scaffold without writing the project's .mcp.json
   --fix                 Auto-fix fixable issues (lint command)
@@ -744,9 +903,14 @@ Options:
   --use-composites      Rewrite to composite calls when patterns match (migrate)
   --components          Target discovered Component declarations instead of
                         lexicon resources (list, describe, graph, build, run)
-  --generate <lexicon>  Generate mode (build --components only): synthesize CI
-                        YAML for <lexicon> instead of running a normal build.
-                        Only "gitlab" is implemented for v1.
+  --generate <lexicon>  Generate mode: synthesize CI YAML for <lexicon> (github,
+                        gitlab or forgejo) instead of running. build
+                        --components: one pipeline for the components; run:
+                        one pipeline file per scheduled Op
+  --spec <file>         (run --generate) JSON Op specs: an array, or
+                        { ops, options }
+  --promote-to <env>    (build --components --generate) Add a job that
+                        promotes the deployed releases to <env>
   --no-release-record   Skip auto-emitting a release-ledger record after a
                         successful \`run --components\` deploy (default: on;
                         also settable via chant.config.ts's
@@ -778,19 +942,24 @@ Options:
                         project source; network egress is NOT blocked (see
                         docs). Default: off (also settable via
                         chant.config.ts's build.sandbox: true; #1045)
-  --param <name=value>  (build, graph, run --components, components fan-out)
-                        Bind a declared
-                        build-time parameter (chant.config.ts's buildParams)
+  --param <name=value>  (build, graph, run --components, components fan-out,
+                        components promote, components rollback,
+                        components redeploy) Bind a
+                        declared build-time parameter (chant.config.ts's buildParams)
                         to a value, for source to read as params.<name>
                         (#1064) instead of process.env — repeatable.
                         Distinct from the AWS lexicon's deploy-time
                         Parameter(): this resolves before synthesis, so it
                         can change which resources are produced at all.
-                        Highest precedence.
-  --params-file <path>  (build, graph, run --components, components fan-out)
-                        JSON file of
-                        { "name": value } build-time parameter values
+                        Highest precedence. With init --from, it sets a
+                        template parameter that the template's
+                        chant.template.json declares instead (#2627).
+  --params-file <path>  (build, graph, run --components, components fan-out,
+                        components promote, components rollback,
+                        components redeploy) JSON file
+                        of { "name": value } build-time parameter values
                         (#1064). Second precedence, after --param.
+                        init --from refuses it: pass --param instead.
 
 Examples:
   chant build ./infra/
@@ -800,6 +969,7 @@ Examples:
   chant build ./infra/ --fold
   chant build ./infra/ --components --generate gitlab
   chant build ./infra/ --components --generate gitlab --output .gitlab-ci.yml
+  chant run --generate github
   chant run --components search-service --env staging
   chant run --components all --env production
   chant components export prod --component search-service -o ./dist/search-service
@@ -923,6 +1093,47 @@ async function loadPluginsOrExit(path: string): Promise<import("../lexicon").Lex
   return plugins;
 }
 
+/** Whether `def` must run without evaluating the project's `chant.config.ts` (chant#2591). */
+function commandRunsNoConfig(def: CommandDef, args: ParsedArgs): boolean {
+  return typeof def.runsNoConfig === "function" ? def.runsNoConfig(args) : def.runsNoConfig === true;
+}
+
+/**
+ * Run one level-0 command line in this process and return its exit code
+ * (#2537). `chant workspace member-run` calls it once per member, from inside
+ * the member's directory, so each member is built, linted, audited or graphed
+ * as `chant <verb> .` would do it there, while members that share a toolchain
+ * share one process. It is main()'s dispatch without the help, the root
+ * refusal and the lexicon command groups: the config is loaded, `--env` is
+ * checked, plugins are loaded when the command needs them, and the handler
+ * runs. A `process.exit` inside (loadPluginsOrExit's, say) is the caller's to
+ * catch.
+ */
+export async function runCommandInProcess(argv: string[]): Promise<number> {
+  const args = parseArgs(argv);
+  const match = resolveCommand(args, commandRegistry);
+  if (!match) {
+    console.error(formatError({ message: `Unknown command: ${args.command}` }));
+    return 1;
+  }
+  if (args.env) process.env[ENV_VAR] = args.env;
+  let loadedConfig;
+  try {
+    // chant#2618 — `workspace audit` reaches `audit` through here, once per
+    // member. A `runsNoConfig` command skips the load, as it does in main().
+    if (!commandRunsNoConfig(match.def, args)) loadedConfig = await loadChantConfigUpward(resolve(args.path));
+  } catch {
+    // A project with no config is the handler's to report, as in main().
+  }
+  const envErr = unknownEnvError(args.env, loadedConfig?.config.environments);
+  if (envErr) {
+    console.error(formatError({ message: envErr, hint: "Declare it in chant.config `environments`, or omit --env." }));
+    return 1;
+  }
+  const plugins = match.def.requiresPlugins ? await loadPluginsOrExit(match.compound ? "." : args.path) : [];
+  return match.def.handler({ args, plugins, serializers: plugins.map((p) => p.serializer) });
+}
+
 // ── Command registry ──────────────────────────────────────────────
 
 /**
@@ -943,8 +1154,10 @@ export const commandRegistry: CommandDef[] = [
   { name: "describe", handler: runDescribe },
   { name: "explain", handler: runExplain },
   { name: "search", handler: runSearch },
-  { name: "import", handler: runImport },
-  { name: "audit", handler: runAudit },
+  // chant#2591 — `import --agents` and `audit` read chant.config statically
+  // and never evaluate it (chant#2589 for audit, which audits code it must not run).
+  { name: "import", handler: runImport, runsNoConfig: (args) => args.agents === true },
+  { name: "audit", handler: runAudit, runsNoConfig: true },
   { name: "migrate", handler: runMigrate },
   // Read-only Terraform peelability advisor (#214). Compound so "advise" lands
   // in args.path; the estate dir comes from --from. No plugins, no project.
@@ -963,7 +1176,7 @@ export const commandRegistry: CommandDef[] = [
   // Status read over a tree of carve manifests (#2038): the contract a
   // renderer replaces its own walk-and-guess discovery with. Read-only.
   { name: "carve status", handler: runCarveStatus },
-  { name: "init", handler: runInit },
+  { name: "init", handler: runInit, runsNoConfig: true },
   { name: "init lexicon", handler: runInitLexicon },
 { name: "update", handler: runUpdate },
   { name: "doctor", handler: runDoctor },
@@ -971,7 +1184,7 @@ export const commandRegistry: CommandDef[] = [
   // Dev subcommands
   { name: "dev generate", requiresPlugins: true, handler: runDevGenerate },
   { name: "dev publish", requiresPlugins: true, handler: runDevPublish },
-  { name: "dev onboard", handler: runDevOnboard },
+  { name: "dev onboard", handler: runDevOnboard, runsNoConfig: true },
   { name: "dev check-lexicon", handler: runDevCheckLexicon },
   { name: "dev surface-diff", handler: runDevSurfaceDiff },
   { name: "dev pinned-upgrade", handler: runDevPinnedUpgrade },
@@ -994,6 +1207,27 @@ export const commandRegistry: CommandDef[] = [
   { name: "graph", handler: runGraph },
   { name: "vendor", handler: runVendor },
 
+  // Workspace reads (#2524). Imported on first use, so a level-0 command never
+  // loads anything under workspace/ (#2525 rule 5, pinned by #2526's goldens).
+  { name: "workspace records", handler: async (ctx) => (await import("../workspace/records-cli")).runWorkspaceRecords(ctx) },
+  { name: "workspace init", handler: async (ctx) => (await import("../workspace/init")).runWorkspaceInit(ctx) },
+  { name: "workspace ls", handler: async (ctx) => (await import("../workspace/ls")).runWorkspaceLs(ctx) },
+  { name: "workspace status", handler: async (ctx) => (await import("../workspace/status")).runWorkspaceStatus(ctx) },
+  { name: "workspace lineage", handler: async (ctx) => (await import("../workspace/lineage-cli")).runWorkspaceLineage(ctx) },
+  { name: "workspace upgrade", handler: async (ctx) => (await import("../workspace/lineage-upgrade-cli")).runWorkspaceUpgrade(ctx) },
+  // #2641 — workspace check reads member configs statically and never runs one.
+  { name: "workspace check", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/lineage-check")).runWorkspaceCheck(ctx) },
+  // #2537 — per-member commands. Each member runs under its own chant, one
+  // process per toolchain identity; `member-run` is that process's entry.
+  { name: "workspace build", handler: async (ctx) => (await import("../workspace/member-commands")).runWorkspaceMembers(ctx, "build") },
+  { name: "workspace lint", handler: async (ctx) => (await import("../workspace/member-commands")).runWorkspaceMembers(ctx, "lint") },
+  // chant#2618 — audit runs no project code, at the workspace level too.
+  { name: "workspace audit", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/member-commands")).runWorkspaceMembers(ctx, "audit") },
+  { name: "workspace graph", handler: async (ctx) => (await import("../workspace/member-commands")).runWorkspaceMembers(ctx, "graph") },
+  // Each unit decides for itself whether its config is loaded (runCommandInProcess).
+  { name: "workspace member-run", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/member-run")).runWorkspaceMemberRun(ctx, runCommandInProcess) },
+  { name: "workspace verify", handler: async (ctx) => (await import("../workspace/trust/verify-cli")).runWorkspaceVerify(ctx) },
+
   // State subcommands
   { name: "lifecycle snapshot", requiresPlugins: true, handler: runLifecycleSnapshot },
   { name: "lifecycle show", handler: runLifecycleShow },
@@ -1015,6 +1249,9 @@ export const commandRegistry: CommandDef[] = [
   { name: "components status", requiresPlugins: true, handler: runComponentsStatus },
   { name: "components release", handler: runComponentsReleaseRecord },
   { name: "components export", handler: runComponentsExport },
+  { name: "components promote", handler: runComponentsPromote },
+  { name: "components rollback", handler: runComponentsRollback },
+  { name: "components redeploy", handler: runComponentsRedeploy },
 
   // Local emulators of configured lexicons (#920). Compound so the action word
   // lands in args.path (not consumed as a project dir) and projectPath is forced ".".
@@ -1034,6 +1271,7 @@ export const commandRegistry: CommandDef[] = [
   { name: "dev", handler: runDevUnknown },
   { name: "serve", handler: runServeUnknown },
   { name: "components", handler: runComponentsUnknown },
+  { name: "workspace", handler: async (ctx) => (await import("../workspace/records-cli")).runWorkspaceUnknown(ctx) },
 ];
 
 /**
@@ -1094,10 +1332,16 @@ async function main(): Promise<void> {
   // subdirectory build/command (`chant build src/<stack> --env prod`) the
   // declared `environments` almost always live in the root `chant.config.ts`,
   // not `args.path` itself.
+  //
+  // chant#2591 — a command marked `runsNoConfig` skips this load: it must not
+  // run the project's `chant.config.ts` (see `CommandDef.runsNoConfig`). Such a
+  // command gets no `--env` check against the declared environments either.
+  const earlyMatch = resolveCommand(args, commandRegistry);
+  const runsNoConfig = earlyMatch != null && commandRunsNoConfig(earlyMatch.def, args);
   const projectPath0 = resolve(args.path === "." ? "." : args.path);
   let loadedConfig;
   try {
-    loadedConfig = await loadChantConfigUpward(projectPath0);
+    if (!runsNoConfig) loadedConfig = await loadChantConfigUpward(projectPath0);
     initRuntime();
   } catch {
     // Config may not exist yet (e.g. `chant init`)
@@ -1111,7 +1355,7 @@ async function main(): Promise<void> {
     process.exit(1);
   }
 
-  const match = resolveCommand(args, commandRegistry);
+  const match = earlyMatch;
   if (!match) {
     // chant #1078 — not one of core's own commands; check whether a lexicon
     // mounted a command group under this name before giving up. This is the
@@ -1129,6 +1373,28 @@ async function main(): Promise<void> {
     process.exit(1);
   }
 
+  // #2537 (#2524 D0) — at the root of a declared workspace, `build` and
+  // `lint` refuse with WSP000 unless `--root-only` or `rootOnly: true` says
+  // to run on the root project alone. Both lookups only test whether files
+  // exist; the workspace code loads only when this project is a declared root.
+  if (match.def.name === "build" || match.def.name === "lint") {
+    const target = resolve(args.path);
+    const workspace = findWorkspaceRoot(target);
+    if (workspace && findProjectRoot(target) === workspace.dir) {
+      const { guardRootCommand } = await import("../workspace/root-refusal");
+      const refused = guardRootCommand({
+        verb: match.def.name,
+        target,
+        workspaceDir: workspace.dir,
+        rootOnly: args.rootOnly === true || loadedConfig?.config.rootOnly === true,
+      });
+      if (refused !== undefined) {
+        await flushAndExit(refused);
+        return;
+      }
+    }
+  }
+
   // For compound commands (e.g. "run list", "lifecycle plan <env>"), the first
   // positional is a subcommand argument — an environment, op, or lexicon name —
   // not a project path. Plugins always load from the cwd; the handler reads its

package/src/cli/mcp/op-tools.ts

@@ -14,6 +14,7 @@
  * run.
  */
 
+import { lexiconNames } from "../../lexicon-module";
 import { resolve } from "node:path";
 import { discoverOps } from "../../op/discover";
 import { createLocalOpRuntime } from "../../op/runtimes/local";
@@ -39,7 +40,7 @@ async function runtimeFor(name: unknown): Promise<OpRuntimeProvider> {
   }
 
   const configured = await loadChantConfig(resolve("."))
-    .then(({ config }) => config.lexicons ?? [])
+    .then(({ config }) => lexiconNames(config.lexicons ?? []))
     .catch(() => [] as string[]);
   if (!configured.includes(wanted)) {
     throw new Error(