@intutic/cli 1.10.0 → 2.0.0

package/dist/commands/routing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing.js","sourceRoot":"","sources":["../../src/commands/routing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAkB,MAAM,eAAe,CAAA;AAC/D,OAAO,EAAE,MAAM,YAAY,CAAA;AAmC3B,KAAK,UAAU,SAAS,CAAC,IAAoB;IAC3C,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,eAAe,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxD,OAAO,eAAe,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;AACvD,CAAC;AAED,0EAA0E;AAE1E;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,KAAoB;IAChD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;IAC5D,MAAM,GAAG,GAAG,KAAK,GAAG,GAAG,CAAA;IACvB,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IAC/C,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;IAC3C,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,0BAA0B,CAAC,CAAA;IAC/D,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,0BAA0B,CAAC,CAAA;IAC7D,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,kBAAkB,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,eAAe,CAAC,KAAoB;IAC3C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAA;IAC7F,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IACnD,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAA;AACjD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAoB;IAC9C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAA;IAC5F,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IACnD,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAA;AACxC,CAAC;AAED,uEAAuE;AAEvE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAkE;IAElE,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAA;QAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAEjD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAA;IAEpC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,yDAAyD,kBAAkB,CAAC,cAAc,CAAC,EAAE,CAC9F,CAAA;QAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YAC1C,OAAM;QACR,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,uCAAuC,CAAC,CAAA;QACnD,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;QAEjD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACf,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAA;YACtF,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC,eAAe,WAAW,CAAC,CAAA;YACpF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACf,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YACvC,OAAM;QACR,CAAC;QAED,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;QACnD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QACrE,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAA;QACjE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QAClC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;QACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAA;QACxE,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAA;QACvE,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAA;QAC/E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,qGAAqG,CACtG,CACF,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,2CAA2C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACxG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC"}

package/dist/commands/setup.d.ts

@@ -0,0 +1,62 @@
+/**
+ * `intutic setup` — the cohort setup wizard (LLD #70, model catalog & cohort
+ * wizard): codescan → provider → credentials → verify → persist → judge
+ * model → summary. Mirrors the dashboard's `SetupWizard.tsx` step order
+ * (minus the parts that need a browser) and, wherever a step corresponds to
+ * an existing flag-driven command, calls exactly what that command calls —
+ * `detectHarnesses` (same as `intutic init`), the provider-credentials PUT
+ * (same route `intutic credentials set` hits), `probeProviderCredential`
+ * (same shared-types probe spec the dashboard's verify button uses). This is
+ * a guided sequence over existing actions, not a parallel code path.
+ *
+ * `intutic init` stays exactly as it was — flag-driven, safe for CI, no
+ * prompts. This command is the interactive counterpart for a human at a
+ * keyboard.
+ *
+ * @module
+ */
+export declare const CANCELLED: unique symbol;
+/**
+ * The subset of @clack/prompts this command uses, behind an interface so
+ * tests can inject a scripted fake instead of driving a real terminal.
+ * `select`/`text`/`password`/`confirm` return `CANCELLED` on Ctrl-C, mirroring
+ * clack's own `isCancel` convention rather than throwing.
+ */
+export interface SetupIO {
+    intro(msg: string): void;
+    outro(msg: string): void;
+    note(msg: string, title?: string): void;
+    log: {
+        info(msg: string): void;
+        success(msg: string): void;
+        warn(msg: string): void;
+        error(msg: string): void;
+    };
+    select<T extends string>(opts: {
+        message: string;
+        options: Array<{
+            value: T;
+            label: string;
+            hint?: string;
+        }>;
+    }): Promise<T | typeof CANCELLED>;
+    text(opts: {
+        message: string;
+        placeholder?: string;
+        defaultValue?: string;
+    }): Promise<string | typeof CANCELLED>;
+    password(opts: {
+        message: string;
+    }): Promise<string | typeof CANCELLED>;
+    confirm(opts: {
+        message: string;
+        initialValue?: boolean;
+    }): Promise<boolean | typeof CANCELLED>;
+}
+/** Real terminal IO, backed by @clack/prompts. */
+export declare function createClackIO(): SetupIO;
+export interface SetupOpts {
+    dev?: boolean;
+}
+export declare function runSetup(opts: SetupOpts, io?: SetupIO): Promise<void>;
+//# sourceMappingURL=setup.d.ts.map

package/dist/commands/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/commands/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA4CH,eAAO,MAAM,SAAS,eAAsB,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,GAAG,EAAE;QAAE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IAC/G,MAAM,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,CAAC,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,GAAG,OAAO,SAAS,CAAC,CAAA;IAC9I,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,SAAS,CAAC,CAAA;IAChH,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,SAAS,CAAC,CAAA;IACvE,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,GAAG,OAAO,SAAS,CAAC,CAAA;CAChG;AAED,kDAAkD;AAClD,wBAAgB,aAAa,IAAI,OAAO,CA6BvC;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,EAAE,OAAO,CAAA;CACd;AAmBD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,GAAE,OAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6J5F"}

package/dist/commands/setup.js

@@ -0,0 +1,238 @@
+/**
+ * `intutic setup` — the cohort setup wizard (LLD #70, model catalog & cohort
+ * wizard): codescan → provider → credentials → verify → persist → judge
+ * model → summary. Mirrors the dashboard's `SetupWizard.tsx` step order
+ * (minus the parts that need a browser) and, wherever a step corresponds to
+ * an existing flag-driven command, calls exactly what that command calls —
+ * `detectHarnesses` (same as `intutic init`), the provider-credentials PUT
+ * (same route `intutic credentials set` hits), `probeProviderCredential`
+ * (same shared-types probe spec the dashboard's verify button uses). This is
+ * a guided sequence over existing actions, not a parallel code path.
+ *
+ * `intutic init` stays exactly as it was — flag-driven, safe for CI, no
+ * prompts. This command is the interactive counterpart for a human at a
+ * keyboard.
+ *
+ * @module
+ */
+import * as p from '@clack/prompts';
+import pc from 'picocolors';
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { PROVIDER_REGISTRY, getProviderDefinition, judgeModelChoices, findCatalogModel, } from '@intutic/shared-types';
+import { findWorkspaceRoot } from './init.js';
+import { detectHarnesses } from '../harness/detector.js';
+import { loadCredentials } from '../config/store.js';
+import { resolveControlPlaneUrl } from '../config/paths.js';
+import { createApiClient } from '../lib/api.js';
+import { probeProviderCredential } from '../lib/providerProbe.js';
+// Exported (not just module-private) so a test's SetupIO implementation can
+// return the SAME unique-symbol value the SetupIO interface's method
+// signatures reference -- TS treats two `Symbol('cancelled')` literals in
+// different files as distinct unique-symbol types, so a test-local re-
+// declaration would fail to satisfy the interface even though it is
+// semantically "the same" cancellation marker.
+export const CANCELLED = Symbol('cancelled');
+/** Real terminal IO, backed by @clack/prompts. */
+export function createClackIO() {
+    return {
+        intro: (msg) => p.intro(msg),
+        outro: (msg) => p.outro(msg),
+        note: (msg, title) => p.note(msg, title),
+        log: { info: p.log.info, success: p.log.success, warn: p.log.warn, error: p.log.error },
+        async select(opts) {
+            // p.select<Value>'s Option<Value> is a conditional type that doesn't
+            // resolve against a still-generic T here (TS can't distribute
+            // `Value extends Primitive ? … : never` over an unresolved type
+            // parameter) -- the object shape is correct at runtime; the cast
+            // below is narrowing past that inference gap, not around a real type
+            // mismatch.
+            const res = await p.select(opts);
+            return p.isCancel(res) ? CANCELLED : res;
+        },
+        async text(opts) {
+            const res = await p.text(opts);
+            return p.isCancel(res) ? CANCELLED : res;
+        },
+        async password(opts) {
+            const res = await p.password(opts);
+            return p.isCancel(res) ? CANCELLED : res;
+        },
+        async confirm(opts) {
+            const res = await p.confirm(opts);
+            return p.isCancel(res) ? CANCELLED : res;
+        },
+    };
+}
+async function promptCredentialFields(io, def) {
+    const values = {};
+    for (const field of def.fields) {
+        const raw = field.type === 'password'
+            ? await io.password({ message: `${field.label}${field.required ? '' : ' (optional)'}` })
+            : await io.text({ message: `${field.label}${field.required ? '' : ' (optional)'}`, placeholder: field.placeholder });
+        if (raw === CANCELLED)
+            return null;
+        if (!raw && field.required) {
+            io.log.error(`${field.label} is required.`);
+            return null;
+        }
+        if (raw)
+            values[field.key] = raw;
+    }
+    return values;
+}
+export async function runSetup(opts, io = createClackIO()) {
+    io.intro(pc.bold('Intutic — Guided Setup'));
+    // ── Step 1: codescan — reuse exactly what `intutic init` uses ──
+    const workspaceRoot = findWorkspaceRoot();
+    if (workspaceRoot) {
+        const harnesses = await detectHarnesses(workspaceRoot);
+        const detected = harnesses.filter((h) => h.detected);
+        if (detected.length > 0) {
+            io.note(detected.map((h) => `${pc.green('✔')} ${h.type}`).join('\n'), 'Detected harnesses');
+        }
+        else {
+            io.log.warn('No harnesses detected in this workspace — Intutic still works via proxy redirect.');
+        }
+    }
+    else {
+        io.log.warn('Not inside a workspace (no .git/ or package.json found) — skipping harness detection.');
+    }
+    // ── Step 2: mode ──
+    const creds = await loadCredentials();
+    const mode = await io.select({
+        message: 'How do you want to configure this provider?',
+        options: [
+            {
+                value: 'connected',
+                label: 'Connected to Intutic',
+                hint: creds ? `authenticated as ${creds.email}` : 'requires `intutic login` first',
+            },
+            { value: 'local', label: 'Local / offline (no control plane)', hint: 'writes an env file you export yourself' },
+        ],
+    });
+    if (mode === CANCELLED)
+        return io.outro('Cancelled.');
+    if (mode === 'connected' && !creds) {
+        io.log.error('Not authenticated. Run `intutic login` first, or choose Local / offline.');
+        return io.outro('Cancelled.');
+    }
+    // ── Step 3: provider ──
+    const providerId = await io.select({
+        message: 'Which LLM provider do you want to configure?',
+        options: PROVIDER_REGISTRY.map((def) => ({
+            value: def.id,
+            label: def.displayName,
+            hint: def.routingLive ? 'live' : 'not yet routable',
+        })),
+    });
+    if (providerId === CANCELLED)
+        return io.outro('Cancelled.');
+    const def = getProviderDefinition(providerId);
+    // ── Step 4: credentials ──
+    io.note(`Enter your ${def.displayName} credential.${def.docsUrl ? ` Get one at ${def.docsUrl}` : ''}`, def.displayName);
+    const fields = await promptCredentialFields(io, def);
+    if (!fields)
+        return io.outro('Cancelled.');
+    // ── Step 5: verify (informational — 401/403 is the only hard stop) ──
+    io.log.info('Verifying credential…');
+    const probeResult = await probeProviderCredential(providerId, fields);
+    if (probeResult.status === 'invalid') {
+        io.log.error(probeResult.detail);
+        const proceed = await io.confirm({ message: 'Save it anyway?', initialValue: false });
+        if (proceed !== true)
+            return io.outro('Cancelled.');
+    }
+    else if (probeResult.status === 'valid') {
+        io.log.success(probeResult.detail);
+    }
+    else {
+        io.log.warn(probeResult.detail);
+    }
+    // ── Step 6: persist ──
+    if (mode === 'connected') {
+        const client = createApiClient(resolveControlPlaneUrl(opts.dev), creds.apiKey);
+        try {
+            await client.put(`/api/v1/workspace/provider-credentials/${encodeURIComponent(providerId)}`, fields);
+            io.log.success(`${def.displayName} credential saved to your workspace.`);
+        }
+        catch (err) {
+            io.log.error(`Failed to save credential: ${err instanceof Error ? err.message : String(err)}`);
+            return io.outro('Setup incomplete.');
+        }
+    }
+    else {
+        const envLines = Object.entries(fields).map(([k, v]) => `INTUTIC_${providerId.toUpperCase()}_${k.toUpperCase()}=${v}`);
+        const envPath = join(workspaceRoot ?? process.cwd(), '.intutic.env');
+        writeFileSync(envPath, envLines.join('\n') + '\n', { mode: 0o600 });
+        io.note(envLines.map((l) => l.replace(/=.*/, '=<redacted>')).join('\n'), `Written to ${envPath}`);
+        io.log.warn(`${envPath} contains a secret — do not commit it. Source it yourself before running your harness.`);
+    }
+    // ── Step 7: judge model ──
+    const wantJudge = await io.confirm({
+        message: "Set up an LLM-as-judge model for this workspace's checks?",
+        initialValue: false,
+    });
+    let judgeModel = null;
+    if (wantJudge === true) {
+        const choices = judgeModelChoices({ saasRoutableOnly: mode === 'connected' });
+        const CUSTOM = '__custom__';
+        const pick = await io.select({
+            message: 'Judge model',
+            options: [
+                ...choices.slice(0, 20).map((m) => ({ value: m.ref, label: `${m.displayName} (${m.provider})` })),
+                { value: CUSTOM, label: 'Enter a custom model name…' },
+            ],
+        });
+        if (pick !== CANCELLED) {
+            judgeModel = pick === CUSTOM ? null : pick;
+            if (pick === CUSTOM) {
+                const custom = await io.text({ message: 'Custom judge model name' });
+                judgeModel = custom === CANCELLED ? null : custom || null;
+            }
+        }
+    }
+    if (judgeModel) {
+        if (!findCatalogModel(judgeModel)) {
+            io.log.warn(`'${judgeModel}' is not in the known model catalog — treating it as a custom/BYO alias.`);
+        }
+        if (mode === 'connected') {
+            const client = createApiClient(resolveControlPlaneUrl(opts.dev), creds.apiKey);
+            try {
+                await client.put('/api/v1/workspace/settings', { managedJudgeModel: judgeModel });
+                io.log.success(`Judge model set to ${judgeModel}.`);
+            }
+            catch (err) {
+                io.log.error(`Failed to save judge model: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            // Same round-trip the dashboard's JudgeModelPanel Test button runs
+            // (POST /api/v1/workspace/judge-model/test, workspace.ts) — a real,
+            // tiny completion through the exact path a workspace judge would
+            // take. Reported, not gating: the setting is already saved above, the
+            // same way the dashboard's Save and Test are independent actions.
+            io.log.info('Verifying the judge model…');
+            try {
+                const testResult = await client.post('/api/v1/workspace/judge-model/test', {
+                    model: judgeModel,
+                });
+                if (testResult.ok) {
+                    io.log.success(`Judge model verified — routes via ${testResult.provider}, ${testResult.latencyMs}ms round-trip.`);
+                }
+                else {
+                    io.log.warn(`Judge model test failed at the ${testResult.stage} stage: ${testResult.error}` +
+                        (testResult.stage === 'provider'
+                            ? ' (this only means it cannot be tested right now — the setting above is already saved)'
+                            : ''));
+                }
+            }
+            catch (err) {
+                io.log.warn(`Could not run the judge model test: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        else {
+            io.note(`On-prem judge setup isn't finished by this command — run:\n  intutic judge configure`, 'Next step');
+        }
+    }
+    io.outro(pc.bold('Setup complete.'));
+}
+//# sourceMappingURL=setup.js.map

package/dist/commands/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/commands/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAA;AACnC,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,GAEjB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AAoBjE,4EAA4E;AAC5E,qEAAqE;AACrE,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,+CAA+C;AAC/C,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAA;AAmB5C,kDAAkD;AAClD,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAC5B,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAC5B,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC;QACxC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE;QACvF,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,qEAAqE;YACrE,8DAA8D;YAC9D,gEAAgE;YAChE,iEAAiE;YACjE,qEAAqE;YACrE,YAAY;YACZ,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAiD,CAAC,CAAA;YAC7E,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,GAAa,CAAA;QACrD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI;YACb,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9B,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,GAAc,CAAA;QACtD,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YAClC,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,GAAc,CAAA;QACtD,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACjC,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,GAAe,CAAA;QACvD,CAAC;KACF,CAAA;AACH,CAAC;AAMD,KAAK,UAAU,sBAAsB,CAAC,EAAW,EAAE,GAAuB;IACxE,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,GAAG,GACP,KAAK,CAAC,IAAI,KAAK,UAAU;YACvB,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC;YACxF,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;QACxH,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAClC,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,eAAe,CAAC,CAAA;YAC3C,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,GAAG;YAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;IAClC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAe,EAAE,KAAc,aAAa,EAAE;IAC3E,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAA;IAE3C,kEAAkE;IAClE,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAA;IACzC,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAA;QACtD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QACpD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,oBAAoB,CAAC,CAAA;QAC7F,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAA;QAClG,CAAC;IACH,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAA;IACtG,CAAC;IAED,qBAAqB;IACrB,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,6CAA6C;QACtD,OAAO,EAAE;YACP;gBACE,KAAK,EAAE,WAAW;gBAClB,KAAK,EAAE,sBAAsB;gBAC7B,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,oBAAoB,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,gCAAgC;aACnF;YACD,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,IAAI,EAAE,wCAAwC,EAAE;SAChH;KACF,CAAC,CAAA;IACF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAErD,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,KAAK,EAAE,CAAC;QACnC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAA;QACxF,OAAO,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC/B,CAAC;IAED,yBAAyB;IACzB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;QACjC,OAAO,EAAE,8CAA8C;QACvD,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACvC,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,KAAK,EAAE,GAAG,CAAC,WAAW;YACtB,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB;SACpD,CAAC,CAAC;KACJ,CAAC,CAAA;IACF,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC3D,MAAM,GAAG,GAAG,qBAAqB,CAAC,UAAU,CAAE,CAAA;IAE9C,4BAA4B;IAC5B,EAAE,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,WAAW,eAAe,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;IACvH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAE1C,uEAAuE;IACvE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;IACpC,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACrE,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACrC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAA;QACrF,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IACrD,CAAC;SAAM,IAAI,WAAW,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC1C,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;IACpC,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;IACjC,CAAC;IAED,wBAAwB;IACxB,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,eAAe,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAM,CAAC,MAAM,CAAC,CAAA;QAC/E,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,CAAC,0CAA0C,kBAAkB,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YACpG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,WAAW,sCAAsC,CAAC,CAAA;QAC1E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC9F,OAAO,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QACtH,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAA;QACpE,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACnE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,cAAc,OAAO,EAAE,CAAC,CAAA;QACjG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,wFAAwF,CAAC,CAAA;IACjH,CAAC;IAED,4BAA4B;IAC5B,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;QACjC,OAAO,EAAE,2DAA2D;QACpE,YAAY,EAAE,KAAK;KACpB,CAAC,CAAA;IACF,IAAI,UAAU,GAAkB,IAAI,CAAA;IACpC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC,CAAA;QAC7E,MAAM,MAAM,GAAG,YAAY,CAAA;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;YAC3B,OAAO,EAAE,aAAa;YACtB,OAAO,EAAE;gBACP,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;gBACjG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,4BAA4B,EAAE;aACvD;SACF,CAAC,CAAA;QACF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,UAAU,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;YAC1C,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAA;gBACpE,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAA;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,0EAA0E,CAAC,CAAA;QACvG,CAAC;QACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,eAAe,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAM,CAAC,MAAM,CAAC,CAAA;YAC/E,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,GAAG,CAAC,4BAA4B,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAA;gBACjF,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,sBAAsB,UAAU,GAAG,CAAC,CAAA;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACjG,CAAC;YAED,mEAAmE;YACnE,oEAAoE;YACpE,iEAAiE;YACjE,sEAAsE;YACtE,kEAAkE;YAClE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;YACzC,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,CAAuB,oCAAoC,EAAE;oBAC/F,KAAK,EAAE,UAAU;iBAClB,CAAC,CAAA;gBACF,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;oBAClB,EAAE,CAAC,GAAG,CAAC,OAAO,CACZ,qCAAqC,UAAU,CAAC,QAAQ,KAAK,UAAU,CAAC,SAAS,gBAAgB,CAClG,CAAA;gBACH,CAAC;qBAAM,CAAC;oBACN,EAAE,CAAC,GAAG,CAAC,IAAI,CACT,kCAAkC,UAAU,CAAC,KAAK,WAAW,UAAU,CAAC,KAAK,EAAE;wBAC7E,CAAC,UAAU,CAAC,KAAK,KAAK,UAAU;4BAC9B,CAAC,CAAC,uFAAuF;4BACzF,CAAC,CAAC,EAAE,CAAC,CACV,CAAA;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACxG,CAAC;QACH,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,IAAI,CACL,sFAAsF,EACtF,WAAW,CACZ,CAAA;QACH,CAAC;IACH,CAAC;IAED,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAA;AACtC,CAAC"}

package/dist/commands/skill.d.ts

@@ -3,8 +3,262 @@
  *
  * LLD Phase 8 — Loop Engineering & Ingestion Proposals
  */
+import { type SkillScanFinding, type SkillScanCategory } from '@intutic/shared-types';
+import { type CiscoDirScanResult } from '../lib/ciscoScanner.js';
+/**
+ * One row of the local skill/rule-file inventory reported to the control
+ * plane by `POST /api/v1/workspaces/:id/skills/report`.
+ */
+export interface SkillReportEntry {
+    /** Path relative to the workspace root, e.g. `CLAUDE.md`. */
+    filePath: string;
+    /** Line count of the file as scanned. */
+    linesCount: number;
+    /** Audit findings in this file; always 0 for `skill list`, which only counts. */
+    issuesDetected: number;
+    /**
+     * Bounded findings from `scanSkillContent` (`@intutic/shared-types`), for
+     * real `.agents/skills/**\/SKILL.md` / `.claude/skills/**\/SKILL.md` skill
+     * files. Absent for the legacy rule-file rows, which keep the coarse
+     * regex audit above — never full skill content, see `scanSkillContent`'s
+     * own doc comment.
+     */
+    findings?: SkillScanFinding[];
+    /** sha256 of the file content at scan time, so a consumer can tell which
+     *  content a set of findings refers to without re-uploading it. */
+    sha256?: string;
+    /**
+     * `false` when the file could not be read (permissions, vanished between
+     * discovery and read, etc). Refusal-not-pass: an unscanned file MUST NOT
+     * be reported as `issuesDetected: 0` implying safety — that would read as
+     * "scanned and clean" to anything downstream. Omitted (not `false`) for
+     * the legacy rule-file rows and for successfully scanned skill files, so
+     * `scanned === false` unambiguously means "we could not tell."
+     */
+    scanned?: boolean;
+    /**
+     * Which surface this row describes. `'skill_md'` for a skill's
+     * `SKILL.md`, `'script'` for a bundled file discovered by
+     * `discoverSkillBundledFiles` and audited by `auditScriptFile`. Absent for
+     * the legacy rule-file rows (`.cursorrules`, `CLAUDE.md`, etc), which
+     * predate this distinction and are neither.
+     */
+    kind?: 'skill_md' | 'script';
+    /**
+     * The script language `detectScriptLanguage` (`@intutic/shared-types`)
+     * inferred for a `kind: 'script'` row — `'unknown'` when neither the
+     * extension nor a shebang resolved (still hashed, never scanned; see
+     * `auditScriptFile`). Absent for anything that isn't a script row.
+     */
+    language?: string;
+    /**
+     * Phase S5 (TD-357). FULL content of a `kind: 'skill_md'` file, attached
+     * ONLY when the workspace has `semanticSkillAnalysisEnabled` on (read from
+     * `client.fetchConfig`'s resolved `settings`, the same way
+     * `enableLocalSkillAuditDelete` already is below) — never for `kind:
+     * 'script'` rows, which stay S2/S3/S4's domain. Capped client-side to the
+     * same 65536-char bound `SkillFileReportSchema` enforces server-side
+     * (`services/control-plane/src/routes/harnessConfig.ts`), so an oversized
+     * file 400s never a request; it is silently capped, the same
+     * refusal-vs-cap posture `capContentForTransport`'s own doc comment
+     * explains.
+     */
+    content?: string;
+}
+export declare function capContentForTransport(content: string): string;
+export interface DiscoveredSkillFile {
+    /** Path relative to the workspace root, e.g. `.agents/skills/foo/SKILL.md`. */
+    filePath: string;
+    fullPath: string;
+    source: string;
+}
+/**
+ * Read, content-scan, and (if `prune` is set and the scan is not clean)
+ * auto-prune one real skill file. Extracted from `runSkillAudit` so the
+ * discovery/read/scan/report path is testable without the network and
+ * credentials setup the full command does.
+ *
+ * Refusal-not-pass: a read failure returns `scanned: false` with
+ * `issuesDetected: 0` — the zero is not a clean bill of health, it is "we
+ * never got to look." Callers must treat `scanned: false` as its own status,
+ * never as `clean`.
+ */
+export declare function auditSkillFile(filePath: string, fullPath: string, prune: boolean, 
+/** Suppresses the per-finding `log.warn` narrative. Used by `--sarif`
+ *  (`runSkillAudit`), whose stdout contract is a single JSON document — a
+ *  CI tool piping that into a SARIF parser must not see decorated text
+ *  interleaved with it. Findings are still returned; only the console
+ *  narration is skipped. Defaults to `false` so every existing caller
+ *  (including the tests that assert on `log.warn` output indirectly via
+ *  behaviour) is unaffected. */
+quiet?: boolean, 
+/**
+ * Phase S5 (TD-357). Attach the file's full content to the returned entry
+ * — only ever set by a caller that already confirmed
+ * `semanticSkillAnalysisEnabled` for this workspace (`runSkillAudit`
+ * below reads it off `client.fetchConfig`'s resolved settings, the same
+ * way it already reads `enableLocalSkillAuditDelete`). Defaults to
+ * `false` so every existing caller/test is unaffected. */
+attachContent?: boolean): Promise<SkillReportEntry>;
+/** Enumerate real `SKILL.md` files under both skill directory roots. A
+ *  missing root is not an error — most workspaces have neither. Exported so
+ *  tests can walk a fixture directory tree without going through the full
+ *  `skill audit`/`skill list` command (credentials, network, etc). */
+export declare function discoverSkillFiles(workspaceRoot: string): Promise<DiscoveredSkillFile[]>;
+/** One bundled file discovered alongside a skill's `SKILL.md`. */
+export interface DiscoveredScriptFile {
+    /** Path relative to the workspace root. */
+    filePath: string;
+    fullPath: string;
+}
+/**
+ * Bounded, symlink-skipping recursive walk of a skill directory's sibling
+ * files — everything alongside `SKILL.md`, the surface TD-356
+ * (`docs/TECH_DEBT.md`) named as unenumerated. `SKILL.md` itself is excluded
+ * (it is already covered by `discoverSkillFiles`/`auditSkillFile` above);
+ * everything else found, at any depth up to the cap, is a candidate for
+ * `auditScriptFile`.
+ *
+ * Bounded by `MAX_SKILL_DIR_DEPTH` and `MAX_FILES_PER_SKILL`
+ * (`@intutic/shared-types`) — a skill directory is developer-authored
+ * content, not something this command should ever walk unboundedly. Depth 0
+ * is the skill directory itself; nested subdirectories increment from
+ * there, and the walk stops recursing once depth exceeds the cap.
+ *
+ * Symlinks are never followed: `Dirent.isSymbolicLink()` is checked during
+ * `readdir` and skipped outright, without ever stat-ing or resolving where
+ * the link points. A symlink inside a skill directory could point outside
+ * that directory — or outside the workspace entirely — which would turn a
+ * bounded, skill-scoped walk into an effectively unbounded one, and would
+ * let a skill directory "bundle" a script that does not actually live on
+ * disk inside it.
+ */
+export declare function discoverSkillBundledFiles(workspaceRoot: string, 
+/** Path to the skill directory (not `SKILL.md` itself), relative to
+ *  `workspaceRoot`, e.g. `.agents/skills/my-skill`. */
+skillDirPath: string): Promise<DiscoveredScriptFile[]>;
+/**
+ * Read, hash, and — when recognized and within the byte cap — content-scan
+ * one bundled script file discovered by `discoverSkillBundledFiles`.
+ *
+ * The sha256 hash is ALWAYS computed, even for a file this scanner cannot
+ * itself interpret (a binary, an unrecognized extension with no useful
+ * shebang) — that is deliberate, not a leftover from a simpler version of
+ * this function. A later, separate, opt-in phase (Cisco `skill-scanner` /
+ * VirusTotal-style hash lookup, Phase S3) needs the hash of every bundled
+ * file regardless of whether THIS scanner's regex patterns can say anything
+ * about its content.
+ *
+ * Refusal-not-pass, same contract as `auditSkillFile`: a read failure, a
+ * file over `MAX_SCRIPT_SCAN_BYTES`, or an unrecognized language all return
+ * `scanned: false` — never folded into `issuesDetected: 0` implying safety.
+ * A file over the byte cap is a REFUSAL to look, reported as such, not a
+ * silent skip and not a false "clean".
+ */
+export declare function auditScriptFile(filePath: string, fullPath: string, quiet?: boolean): Promise<SkillReportEntry>;
+/**
+ * A loop run as returned by `GET /api/v1/loops`.
+ *
+ * `totalTokenCostUsd` and `budgetLimitUsd` are strings, not numbers: both are
+ * Postgres `numeric` columns, which the driver hands back as strings to keep
+ * the scale exact — hence the `parseFloat` at every use site.
+ */
+export interface LoopRunSummary {
+    loopRunId: string;
+    name: string;
+    /**
+     * PENDING_REVIEW is the only non-ACTIVE status that is not terminal — see
+     * `LoopRunDetails` in the control plane's loopGovernanceService.
+     */
+    status: 'ACTIVE' | 'PENDING_REVIEW' | 'COMPLETED' | 'FAILED' | 'KILLED';
+    totalTokenCostUsd: string;
+    budgetLimitUsd: string;
+}
+/** Envelope of `GET /api/v1/loops`. */
+export interface LoopListResponse {
+    ok: boolean;
+    loops: LoopRunSummary[];
+}
 export declare function runSkillList(): Promise<void>;
-export declare function runSkillAudit(): Promise<void>;
+/**
+ * A minimal, valid SARIF 2.1.0 document for CI/code-scanning interop.
+ *
+ * Built for GitHub Code Scanning and any other consumer of the format — not
+ * for Cisco's open-source `skill-scanner` project specifically, but so that
+ * tool's findings and ours can land in the same code-scanning pane on a repo
+ * that runs both. We do not shell out to or depend on that project; this is
+ * only a compatible OUTPUT shape.
+ *
+ * `rules` lists every pattern `scanSkillContent` knows how to report —
+ * SARIF's convention is the tool's full rule catalog, not only the ids that
+ * fired in this run, so a code-scanning UI can show a rule as "0 findings"
+ * rather than "unknown rule". `results` is built only from real skill files
+ * (`SkillReportEntry.findings`, populated by `auditSkillFile`); the legacy
+ * `.cursorrules`/`CLAUDE.md` regex checks above have no pattern ids and stay
+ * out of SARIF for that reason — see the entries' own `findings` being
+ * absent, not an omission here.
+ *
+ * `locations` deliberately carries no `region`: `SkillScanFinding` bounds an
+ * excerpt (see `skillScan.ts`'s `excerptFor`) but not a line/column, and
+ * SARIF's `region` is optional — fabricating `startLine: 1` would claim a
+ * precision this scanner does not have.
+ *
+ * `additionalRuns` (Phase S3): zero or more extra SARIF `runs[]`-shaped
+ * objects appended AFTER this codebase's own run — the Cisco skill-scanner
+ * integration's combined run, when that engine ran. SARIF is explicitly
+ * designed to carry multiple runs from different tools in one document, so
+ * these are appended AS-IS, never translated or merged into this function's
+ * own `results`/`rules` — that translation only happens for the internal
+ * `SkillScanFinding` representation (`mergeCiscoFindings`), never for this
+ * output mode.
+ */
+export declare function buildSarifLog(entries: readonly SkillReportEntry[], additionalRuns?: readonly unknown[]): object;
+/** See {@link CISCO_CATEGORY_MAP}. Exported for tests. */
+export declare function mapCiscoCategory(category: string | undefined): SkillScanCategory;
+/**
+ * Merges one skill directory's Cisco findings into that skill's existing
+ * report entries — the `SKILL.md` row, or a bundled-script row when a
+ * finding's own location matches one of `candidateEntries` exactly. Falls
+ * back to `fallbackEntry` (always the skill's `SKILL.md` row) when no
+ * location match is found — this codebase does not assume `skill-scanner`
+ * always attributes a finding to a specific bundled file, so an
+ * unmatched/absent location is treated as "belongs to the skill as a
+ * whole," not an error.
+ *
+ * Each Cisco finding becomes a `SkillScanFinding` with `patternId: 'cisco.'
+ * + ruleId`, a category from {@link mapCiscoCategory} (mapped from the
+ * finding's own `category`, not its `ruleId`), an excerpt capped at
+ * {@link CISCO_EXCERPT_CAP}, and `engine: 'cisco-skill-scanner'` — this
+ * codebase's own findings stamp `engine: 'native'` at construction
+ * (`skillScan.ts`/`scriptScan.ts`), so every finding in a report entry now
+ * carries its provenance.
+ *
+ * Returns the number of findings merged, for the caller's running `issues`
+ * count.
+ */
+export declare function mergeCiscoFindings(candidateEntries: readonly SkillReportEntry[], fallbackEntry: SkillReportEntry, ciscoResult: CiscoDirScanResult, workspaceRoot: string): number;
+export declare function runSkillAudit(opts?: {
+    sarif?: boolean;
+    engine?: 'native' | 'cisco';
+}): Promise<void>;
+/**
+ * Warn-only skill-content scan over staged additions in the skill surface.
+ *
+ * TD-358. This is the CLI entry point `lib/gitHooks.ts`'s pre-commit hook
+ * shells out to (`intutic skill scan-staged`) — deliberately separate from
+ * `skill audit` above, which scans the whole workspace and is too slow and
+ * too broad for a commit-time check that must stay fast.
+ *
+ * Never refuses a commit and never throws: `scanSkillContent`'s
+ * false-positive rate against real, benign skill markdown is unmeasured (see
+ * `skillScan.ts`'s module doc comment), so this phase stages the signal as
+ * an advisory only. Contrast `lib/gitHooks.ts`'s secret scan, which DOES
+ * refuse — that check is high-precision, prefixed credential shapes with no
+ * known false positives; this one is not, and must not borrow that check's
+ * authority until it has earned it the same way.
+ */
+export declare function runSkillScanStaged(): Promise<void>;
+export declare function getClient(dev?: boolean): Promise<import("../lib/api.js").ApiClient>;
 export declare function runLoopStart(opts: {
     name: string;
     budget?: string;
@@ -21,6 +275,19 @@ export declare function runLoopKill(loopRunId: string, opts: {
 export declare function runLoopList(opts: {
     dev?: boolean;
 }): Promise<void>;
+/**
+ * Approve or reject a run held for human review.
+ *
+ * The other half of `review_before:`. Without it a hold has no resolution from
+ * the terminal, and the hold is deliberately permanent — there is no reaper, so
+ * an unreviewed run stays blocked until a person acts.
+ */
+export declare function runLoopReview(loopRunId: string, opts: {
+    approve?: boolean;
+    reject?: boolean;
+    note?: string;
+    dev?: boolean;
+}): Promise<void>;
 export declare function runLoopExec(commandAndArgs: string[], opts: {
     name?: string;
     budget?: string;

package/dist/commands/skill.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/commands/skill.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAcH,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAgDlD;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAmGnD;AA+CD,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CA+ChB;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/F;AAED,wBAAsB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAa3F;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBxE;AAED,wBAAsB,WAAW,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,GACA,OAAO,CAAC,IAAI,CAAC,CA6Ef"}
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/commands/skill.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,EASL,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAEvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAA;AAK/B;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAA;IAChB,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAA;IAClB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC7B;uEACmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAA;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAcD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAI9D;AAWD,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO;AACd;;;;;;gCAMgC;AAChC,KAAK,UAAQ;AACb;;;;;;0DAM0D;AAC1D,aAAa,UAAQ,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAsD3B;AAED;;;sEAGsE;AACtE,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAoB9F;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,yBAAyB,CAC7C,aAAa,EAAE,MAAM;AACrB;uDACuD;AACvD,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,oBAAoB,EAAE,CAAC,CA6BjC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,UAAQ,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAuD3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,MAAM,EAAE,QAAQ,GAAG,gBAAgB,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACvE,iBAAiB,EAAE,MAAM,CAAA;IACzB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,uCAAuC;AACvC,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,cAAc,EAAE,CAAA;CACxB;AAID,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAkElD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,EAAE,cAAc,GAAE,SAAS,OAAO,EAAO,GAAG,MAAM,CAqDnH;AA+CD,0DAA0D;AAC1D,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAGhF;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,gBAAgB,EAAE,SAAS,gBAAgB,EAAE,EAC7C,aAAa,EAAE,gBAAgB,EAC/B,WAAW,EAAE,kBAAkB,EAC/B,aAAa,EAAE,MAAM,GACpB,MAAM,CAyBR;AAED,wBAAsB,aAAa,CAAC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA0M9G;AAyCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CA+BxD;AAOD,wBAAsB,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,8CAsB5C;AAkCD,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CA+ChB;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/F;AAED,wBAAsB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAa3F;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BxE;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1E,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,wBAAsB,WAAW,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,GACA,OAAO,CAAC,IAAI,CAAC,CA6Gf"}