@ironbee-ai/cli 0.28.0 → 0.30.0

package/dist/clients/cursor/commands/ironbee-manage-scenario/SKILL.md

@@ -0,0 +1,100 @@
+---
+name: ironbee-manage-scenario
+description: "Add, update, or delete a reusable IronBee verification scenario. Authors the script in the devtools format and saves it to the right platform's store (or finds and updates/deletes an existing one) using the scenario-* MCP tools."
+disable-model-invocation: true
+---
+
+# IronBee — Manage scenario
+
+Add / update / delete a reusable verification **scenario** using the devtools `scenario-*` MCP
+tools directly. A scenario is a named, parameterizable script (`callTool('<tool>', {...})` JS) that
+drives ONE platform's tools. This is NOT a verification cycle — it submits no verdict and does not
+gate completion.
+
+## Steps
+1. **Resolve intent.** Content to save (inline text or a file path you read) → add/update. A target
+   only described → delete.
+2. **Add vs update (never duplicate).** Before adding, `*_scenario-search` / `*_scenario-list` to
+   check for a same-name / clearly-the-same scenario on the target platform; if it exists → update
+   it instead of creating a duplicate.
+3. **Pick the platform** from what the scenario does (see the platform sections for which platform fits) and author the script (see "Script
+   format"). Call `*_scenario-add` / `*_scenario-update` on **that platform's** server. A high-level
+   scenario spanning platforms → split into one sub-scenario per platform, linked by `ironbee.group`
+   + `ironbee.order` metadata.
+4. **Delete is destructive — always confirm.** Resolve the target, show the matched
+   **name + description + platform**, and ask the user before deleting. Multiple / low-score
+   candidates → list them and ask which. An **update resolved by fuzzy description** also confirms
+   (the script is overwritten); an exact-name update proceeds without confirm.
+5. **Scope**: pass `scope: "project"` (default) unless the user asked for `global`.
+
+## Live authoring (default for add / update) — build it against the running app
+
+Don't author a runtime scenario from source guesses (source rarely matches the running system exactly). By **default, drive the app to
+understand it — exactly what you'd do when verifying** (exercise the relevant flow through this platform's tools, whatever it takes) — author from what you actually observe, then validate by running it. Do this
+entirely through the `*_scenario-*` tools (run discovery via `*_scenario-run`, don't call the platform
+tools directly: that keeps it gate-orthogonal — no `verification_id`, can't false-block a later edit).
+
+1. **`draft` → skip:** if the request begins with `draft` (or says "source only"), author from source,
+   save, note *"not live-validated — run it to verify"*. Done.
+2. **Start the app only if it isn't already running** (track whether YOU started it). Can't start it
+   (missing env/DB/secrets, broken build) → **source-only draft + say so**, don't fail.
+3. **Understand it by running probe scenarios:** `*_scenario-add` the draft **under the FINAL scenario
+   name** (step 4 then iterates that SAME entry via `*_scenario-update` — do NOT spawn a separate
+   `*-probe` / throwaway scenario in the store) and `*_scenario-run` it to exercise the relevant flow —
+   whatever it takes to learn how the real system behaves — and read the returned snapshots/results.
+4. **Author the full flow** from what you observed → `*_scenario-update`. Make it a **verification flow**,
+   not a superficial run: exercise the cycle's evidence tools, capture their output with
+   `returnOutput: true`, and assert / return the expected outcomes — so running it later via
+   `/ironbee-verify scenario:<name>` can judge it and satisfy the gate.
+5. **Validate:** `*_scenario-run` end-to-end; fix the **SCRIPT** + update until it runs cleanly, and
+   **assert the real terminal outcome — not an optimistic intermediate signal**. Same app/env
+   considerations as any verification run (use a test/staging target for flows with real side effects).
+6. **Teardown — leave a clean store:** `*_scenario-delete` ANY temporary / probe / throwaway scenario you
+   added this session (anything named `*-probe`, a draft you decided not to keep, an exploratory copy);
+   the store must end with ONLY the finished deliverable scenario(s), never a leftover probe. THEN stop
+   ONLY the app / processes you started.
+
+> **A genuine defect is a STOP, not a workaround.** If validating shows the flow can't legitimately
+> succeed — a real bug makes the expected outcome unreachable (an error, a failed state, wrong
+> resulting data) — do NOT engineer the scenario around it: don't cherry-pick inputs / args / data that
+> dodge the bug, and don't weaken the assertion to an optimistic intermediate signal instead of the
+> real terminal outcome. That yields a green scenario that masks a broken flow and produces a FALSE
+> PASS when it's later run to verify. Instead STOP and report the defect to the user **in your summary,
+> not inside the scenario** — keep the saved scenario a clean verification flow (it asserts the real
+> outcome and will simply fail until the bug is fixed; that's it doing its job). Do NOT bake bug /
+> defect commentary into the scenario's `description` or metadata; `liveValidated: false` is the only
+> signal needed when you couldn't get a passing run — or leave the scenario unsaved. ("Fix until it
+> passes" means fixing the SCRIPT, never working around the app.)
+
+## Script format
+JS run in the devtools sandbox (async — top-level `await`/`return` work); reads params from `args`:
+
+```js
+const { baseUrl } = args;            // declared via argsSchema
+const result = await callTool('<bare-tool-name>', { /* tool input */ });
+return { ok: true };
+```
+
+Discover the available `callTool` tool names for a platform from your connected MCP schemas — don't
+guess. Document the expected `args` in the `description` + the `argsSchema` metadata.
+
+## Metadata conventions (stamp on add/update)
+- `argsSchema` — declared params, e.g. `{ "baseUrl": "string" }`. **Mandatory for parametric scenarios.**
+- `ironbee.coveredPaths` — source paths exercised (array), when derivable.
+- `ironbee.group` / `ironbee.order` — for a cross-platform split.
+- `*_scenario-update` does a **shallow replace** of metadata — to change one key, re-send the FULL
+  metadata object (read it first, merge, write back).
+
+The platform sections below list each enabled cycle's server, tool prefix, and store dir.
+
+<!--IRONBEE:PLATFORM:browser-->
+<!--/IRONBEE:PLATFORM:browser-->
+
+<!--IRONBEE:PLATFORM:node-->
+<!--/IRONBEE:PLATFORM:node-->
+
+<!--IRONBEE:PLATFORM:backend-->
+<!--/IRONBEE:PLATFORM:backend-->
+
+<!--IRONBEE:PLATFORM:android-->
+<!--/IRONBEE:PLATFORM:android-->

package/dist/clients/cursor/commands/ironbee-search-scenario/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: ironbee-search-scenario
+description: "Find reusable IronBee verification scenarios by name, description, or metadata across every enabled platform's store, using the scenario-search / scenario-list MCP tools."
+disable-model-invocation: true
+---
+
+# IronBee — Search scenarios
+
+Find saved verification **scenarios** using the devtools scenario tools directly. Read-only.
+
+## Steps
+1. **Pick the surface:**
+   - **`*_scenario-search`** (fuzzy, ranked over name + description) — discovery ("find login
+     scenarios").
+   - **`*_scenario-list` with `metadataMatch`** — precise structural lookup ("which scenarios cover
+     `src/auth/login.ts`"). Metadata is NOT indexed by `scenario-search`, so path/tag lookups use
+     `scenario-list`.
+2. **Search every enabled platform's server** (each platform is a separate server with its own
+   store) and union the results.
+3. **Report** name + description + platform + (for fuzzy search) relevance score; surface scope.
+
+The platform sections below list each enabled cycle's server, tool prefix, and store dir.
+
+<!--IRONBEE:PLATFORM:browser-->
+<!--/IRONBEE:PLATFORM:browser-->
+
+<!--IRONBEE:PLATFORM:node-->
+<!--/IRONBEE:PLATFORM:node-->
+
+<!--IRONBEE:PLATFORM:backend-->
+<!--/IRONBEE:PLATFORM:backend-->
+
+<!--IRONBEE:PLATFORM:android-->
+<!--/IRONBEE:PLATFORM:android-->

package/dist/clients/cursor/commands/ironbee-sync-scenario/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: ironbee-sync-scenario
+description: "Re-validate saved IronBee verification scenarios against the current code and repair MECHANICAL drift, using the scenario-* MCP tools directly. A leading `check` token = dry-run (report drift, no repair). Never auto-changes what a scenario verifies."
+disable-model-invocation: true
+---
+
+# IronBee — Sync scenario(s)
+
+Re-validate + repair saved verification **scenarios** using the devtools `*_scenario-*` MCP tools
+directly. This is NOT a verification cycle — no verdict, no gate.
+
+> Argument: `$ARGUMENTS`
+
+## Steps
+1. **Resolve mode + target**: strip a leading `check` token (→ dry-run) and a leading `force` token
+   (→ include ALL scenarios, not just stale); remainder = `all` (stale ones; with `force`, every one)
+   or a name / description (one). Empty → `all`. **Print the target list + count before running.**
+   Run targets that share an `ironbee.group` in ascending `ironbee.order` (a flow split across platforms).
+2. **For each target scenario** (resolve via `*_scenario-search` / `*_scenario-list`; `all` = the stale
+   ones — covered files changed since their `ironbee.commit`, or authored as drafts) **run it**
+   (`*_scenario-run`, against the live app — start it if needed, tear down what you started) and classify:
+   - **passes** → still current; (non-check) `*_scenario-update` to stamp `ironbee.commit` → HEAD
+     (read via `git rev-parse HEAD`) + `ironbee.liveValidated: true`. `*_scenario-update`
+     shallow-replaces metadata — read current metadata and re-send it MERGED with these two keys
+     (don't drop `coveredPaths` / `group` / `argsSchema`).
+   - **mechanical DRIFT** (the way to reach / drive the flow changed, not the expected outcome) →
+     repair the SCRIPT mechanics only, `*_scenario-update`, re-run until green, then stamp.
+   - **real DEFECT** (the expected outcome is unreachable — the app broke) → **STOP, report, do NOT
+     touch the scenario.**
+   - **expectation CHANGED** (a deliberate behavior / spec change) → do NOT auto-edit the assertion;
+     ask the user.
+   - **`check` mode** → only run + report drift; never repair / update.
+   - **Classify safely** (repair is the only branch that edits a scenario, so a defect mistaken for
+     drift masks a regression): before repairing, self-check whether the fix changes *how* the flow
+     is driven (drift — OK to repair) or *what* it asserts (never drift — a defect → STOP, or a
+     deliberate change → ask). A failure while reaching / driving the flow leans drift; a failure at
+     the terminal assertion leans defect. **Uncertain → treat as a defect and STOP.**
+3. **Report** per scenario: repaired / still-fresh / defect-reported / needs decision.
+
+**Hard rule: repair MECHANICS, never the ASSERTION / expected outcome** — silently relaxing an
+assertion to make a stale scenario pass would mask a regression. (To just *detect* staleness without
+running anything, use `ironbee scenario status`.)
+
+<!--IRONBEE:PLATFORM:browser-->
+<!--/IRONBEE:PLATFORM:browser-->
+
+<!--IRONBEE:PLATFORM:node-->
+<!--/IRONBEE:PLATFORM:node-->
+
+<!--IRONBEE:PLATFORM:backend-->
+<!--/IRONBEE:PLATFORM:backend-->
+
+<!--IRONBEE:PLATFORM:android-->
+<!--/IRONBEE:PLATFORM:android-->

package/dist/clients/cursor/commands/ironbee-verify/SKILL.md

@@ -22,7 +22,8 @@ The FIRST whitespace-delimited token of whatever the user provided alongside thi
 
 A custom verification scenario may be supplied when this command is invoked — either as **inline text** or as a **path to a file** (any location, any format; it is read at run time). The scenario is whatever the user provided alongside invoking this command, after stripping a leading `fix` / `report` mode token (see **Mode**).
 
-- **If a scenario is supplied, it is authoritative**: verify exactly what it describes. Drive each active cycle's tools to exercise precisely the flows, states, and endpoints it names — this **replaces** the default "exercise the changed pages/endpoints" guidance.
+- **If the scenario part starts with `scenario:`** (after the mode token), everything after `scenario:` (to the end) is a **SAVED scenario reference** — an exact name OR a semantic description. Resolve it across enabled platforms (`*_scenario-search` for the description + an exact-name `*_scenario-list` match), pick the single strong match (ambiguous → ask which; none → say so and fall back to the default flow), then **run it in ONE `*_scenario-run` call** (no manual re-discovery) and **judge its result (functional) + any returned visual evidence (e.g. screenshots)**. The scenario's nested tool calls satisfy each active cycle's required tools (as long as it exercises them). No exact name needed — e.g. `scenario: the full purchase flow`. **On PASS, keep it fresh:** `*_scenario-update` its `ironbee.commit` → HEAD (`git rev-parse HEAD`) + `liveValidated: true` (re-send the full metadata merged); on FAIL / defect, don't stamp.
+- **If a scenario is supplied (free text), it is authoritative**: verify exactly what it describes. Drive each active cycle's tools to exercise precisely the flows, states, and endpoints it names — this **replaces** the default "exercise the changed pages/endpoints" guidance.
 - **If the scenario is (or points to) a file path**, read that file with your file-read tool and treat its contents as the scenario. Do not assume a fixed location or format — read whatever path was given.
 - **If the path does not resolve to an existing file**, stop and report `scenario file not found: <path>`, then ask how to proceed — do not verify the literal path string or guess a target.
 - **If no scenario is supplied**, fall back to the default flow: exercise the changed pages/endpoints per the active platform sections below.

package/dist/clients/cursor/hooks/require-verification.js

@@ -1,9 +1,9 @@
-"use strict";var f=Object.defineProperty;var V=Object.getOwnPropertyDescriptor;var x=Object.getOwnPropertyNames;var B=Object.prototype.hasOwnProperty;var w=(o,t)=>f(o,"name",{value:t,configurable:!0});var F=(o,t)=>{for(var c in t)f(o,c,{get:t[c],enumerable:!0})},K=(o,t,c,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let r of x(t))!B.call(o,r)&&r!==c&&f(o,r,{get:()=>t[r],enumerable:!(s=V(t,r))||s.enumerable});return o};var j=o=>K(f({},"__esModule",{value:!0}),o);var W={};F(W,{run:()=>L});module.exports=j(W);var h=require("crypto"),e=require("../../../hooks/core/session-state"),I=require("../../../hooks/core/actions"),k=require("../../../hooks/core/activity"),O=require("../../../hooks/core/verification-lifecycle"),S=require("../../../lib/config"),U=require("../../../lib/recording-tools"),g=require("../../../lib/logger"),E=require("../../../lib/stdin");const R={"MCP:bdt_":"browser-devtools","MCP:ndt_":"node-devtools","MCP:bedt_":"backend-devtools","MCP:adt_":"android-devtools"},J="browser-devtools";async function L(o,t){const c=t?.soft===!0;let s;try{s=JSON.parse((0,E.readStdin)())}catch(n){g.logger.debug(`failed to parse stdin: ${n}`);const N={permission:"allow"};process.stdout.write(JSON.stringify(N)),process.exit(0);return}const r=s.conversation_id??"default",i=`${o}/.ironbee/sessions/${r}`;(0,g.setLogFile)(`${i}/session.log`);const C=`${i}/actions.jsonl`,P=(0,e.getActiveVerificationId)(i);if(!P&&!c){const n={permission:"deny",agent_message:`BLOCKED: You must start a verification cycle before using devtools tools (browser-devtools / node-devtools / backend-devtools / android-devtools).
+"use strict";var f=Object.defineProperty;var B=Object.getOwnPropertyDescriptor;var F=Object.getOwnPropertyNames;var K=Object.prototype.hasOwnProperty;var R=(o,t)=>f(o,"name",{value:t,configurable:!0});var j=(o,t)=>{for(var c in t)f(o,c,{get:t[c],enumerable:!0})},J=(o,t,c,i)=>{if(t&&typeof t=="object"||typeof t=="function")for(let r of F(t))!K.call(o,r)&&r!==c&&f(o,r,{get:()=>t[r],enumerable:!(i=B(t,r))||i.enumerable});return o};var L=o=>J(f({},"__esModule",{value:!0}),o);var D={};j(D,{run:()=>q});module.exports=L(D);var I=require("crypto"),e=require("../../../hooks/core/session-state"),S=require("../../../hooks/core/actions"),k=require("../../../hooks/core/activity"),O=require("../../../hooks/core/verification-lifecycle"),U=require("../../../lib/config"),E=require("../../../lib/recording-tools"),M=require("../../../hooks/core/scenario-tools"),g=require("../../../lib/logger"),$=require("../../../lib/stdin");const h={"MCP:bdt_":"browser-devtools","MCP:ndt_":"node-devtools","MCP:bedt_":"backend-devtools","MCP:adt_":"android-devtools"},W="browser-devtools";async function q(o,t){const c=t?.soft===!0;let i;try{i=JSON.parse((0,$.readStdin)())}catch(n){g.logger.debug(`failed to parse stdin: ${n}`);const x={permission:"allow"};process.stdout.write(JSON.stringify(x)),process.exit(0);return}const r=i.conversation_id??"default",s=`${o}/.ironbee/sessions/${r}`;(0,g.setLogFile)(`${s}/session.log`);const b=`${s}/actions.jsonl`,p=(0,M.isScenarioTool)(i.tool_name),P=(0,e.getActiveVerificationId)(s);if(!P&&!c&&!p){const n={permission:"deny",agent_message:`BLOCKED: You must start a verification cycle before using devtools tools (browser-devtools / node-devtools / backend-devtools / android-devtools).
 
 Start verification first:
   echo '{"session_id":"${r}"}' | ironbee hook verification-start
 
-Then use the verification tools for the active cycle(s) \u2014 MCP:bdt_* for browser, MCP:ndt_* for node, MCP:bedt_* for backend, MCP:adt_* for android.`};process.stdout.write(JSON.stringify(n)),process.exit(2);return}const p=s.tool_name??"",m=p.startsWith("MCP:")?p.slice(4):"",u=m?(0,U.recordingToolsForBareTool)(m):null;if(!c&&u!==null&&(0,e.isRecordingRequired)(i)&&!(0,e.isRecordingActive)(i)&&m!==u.startTool){const n={permission:"deny",agent_message:`BLOCKED: Recording is required but not started.
+Then use the verification tools for the active cycle(s) \u2014 MCP:bdt_* for browser, MCP:ndt_* for node, MCP:bedt_* for backend, MCP:adt_* for android.`};process.stdout.write(JSON.stringify(n)),process.exit(2);return}const m=i.tool_name??"",v=m.startsWith("MCP:")?m.slice(4):"",u=v?(0,E.recordingToolsForBareTool)(v):null;if(!c&&!p&&u!==null&&(0,e.isRecordingRequired)(s)&&!(0,e.isRecordingActive)(s)&&v!==u.startTool){const n={permission:"deny",agent_message:`BLOCKED: Recording is required but not started.
 
 1. Start recording NOW:
      Use MCP:${u.startTool}
@@ -12,4 +12,4 @@ Then use the verification tools for the active cycle(s) \u2014 MCP:bdt_* for bro
 
 3. **Stop recording BEFORE submitting verdict:**
      Use MCP:${u.stopTool}
-   submit-verdict will reject with "recording is still active" if you skip this.`};process.stdout.write(JSON.stringify(n)),process.exit(2);return}await(0,k.startActivity)({sessionDir:i,actionsFile:C,source:"pre_tool_use"});let a=P;c&&!a&&(a=(await(0,O.startVerification)({sessionId:r,sessionDir:i,actionsFile:C,recordingEnabled:!1})).verificationId);const M=(0,e.getActiveTraceId)(i),v=(0,e.getActiveActivityId)(i),b=(0,I.resolveProjectName)(o),_=[`prj:${b}`,`sid:${r}`];v&&_.push(`aid:${v}`),a&&_.push(`vid:${a}`);const $=`ironbee=${_.join(";")}`,l=(0,S.loadConfig)(o),y={...s.tool_input??{}},d={projectName:b,sessionId:r,activityId:v,verificationId:a,traceId:M,traceState:$,toolCallId:(0,h.randomUUID)()};s.tool_use_id&&(d.toolUseId=s.tool_use_id),d.mcpServer=(()=>{for(const n of Object.keys(R))if(p.startsWith(n))return R[n];return J})();const T=(0,e.getUserEmail)(i);T&&(d.userEmail=T),l.collector?.url&&(d.collectorUrl=l.collector.url),l.collector?.oauthToken?d.collectorOAuthToken=l.collector.oauthToken:l.collector?.apiKey&&(d.collectorApiKey=l.collector.apiKey),y._metadata=d;const A={permission:"allow",updated_input:y};process.stdout.write(JSON.stringify(A)),process.exit(0)}w(L,"run");0&&(module.exports={run});
+   submit-verdict will reject with "recording is still active" if you skip this.`};process.stdout.write(JSON.stringify(n)),process.exit(2);return}await(0,k.startActivity)({sessionDir:s,actionsFile:b,source:"pre_tool_use"});let d=P;c&&!d&&!p&&(d=(await(0,O.startVerification)({sessionId:r,sessionDir:s,actionsFile:b,recordingEnabled:!1})).verificationId);const A=(0,e.getActiveTraceId)(s),_=(0,e.getActiveActivityId)(s),y=(0,S.resolveProjectName)(o),C=[`prj:${y}`,`sid:${r}`];_&&C.push(`aid:${_}`),d&&C.push(`vid:${d}`);const N=`ironbee=${C.join(";")}`,l=(0,U.loadConfig)(o),T={...i.tool_input??{}},a={projectName:y,sessionId:r,activityId:_,verificationId:d,traceId:A,traceState:N,toolCallId:(0,I.randomUUID)()};i.tool_use_id&&(a.toolUseId=i.tool_use_id),a.mcpServer=(()=>{for(const n of Object.keys(h))if(m.startsWith(n))return h[n];return W})();const w=(0,e.getUserEmail)(s);w&&(a.userEmail=w),l.collector?.url&&(a.collectorUrl=l.collector.url),l.collector?.oauthToken?a.collectorOAuthToken=l.collector.oauthToken:l.collector?.apiKey&&(a.collectorApiKey=l.collector.apiKey),T._metadata=a;const V={permission:"allow",updated_input:T};process.stdout.write(JSON.stringify(V)),process.exit(0)}R(q,"run");0&&(module.exports={run});

package/dist/clients/cursor/hooks/track-action.js

@@ -1 +1 @@
-"use strict";var y=Object.defineProperty;var U=Object.getOwnPropertyDescriptor;var K=Object.getOwnPropertyNames;var j=Object.prototype.hasOwnProperty;var g=(o,t)=>y(o,"name",{value:t,configurable:!0});var Q=(o,t)=>{for(var l in t)y(o,l,{get:t[l],enumerable:!0})},Y=(o,t,l,i)=>{if(t&&typeof t=="object"||typeof t=="function")for(let r of K(t))!j.call(o,r)&&r!==l&&y(o,r,{get:()=>t[r],enumerable:!(i=U(t,r))||i.enumerable});return o};var q=o=>Y(y({},"__esModule",{value:!0}),o);var it={};Q(it,{run:()=>nt});module.exports=q(it);var _=require("../../../hooks/core/actions"),T=require("../../../hooks/core/nested-tools"),c=require("../../../hooks/core/session-state"),L=require("../../../hooks/core/verification-context"),E=require("../../../lib/config"),s=require("../../../lib/logger"),k=require("../../../lib/recording-tools"),F=require("../../../lib/output"),P=require("../../../lib/stdin"),f=require("../../../queue"),b=require("../util");const S="bdt_",$="ndt_",x="bedt_",D="adt_",G="browser-devtools",H="node-devtools",Z="backend-devtools",tt="android-devtools";function ot(o){return o.startsWith(x)?Z:o.startsWith(D)?tt:o.startsWith(S)?G:o.startsWith($)?H:null}g(ot,"resolveServerByPrefix");async function nt(o){let t;try{t=JSON.parse((0,P.readStdin)())}catch(n){s.logger.debug(`failed to parse stdin: ${n}`),process.stdout.write(JSON.stringify({})),process.exit(0);return}const l=t.conversation_id??"default",i=`${o}/.ironbee/sessions/${l}`,r=`${i}/actions.jsonl`;(0,s.setLogFile)(`${i}/session.log`);const v=t.tool_name??"unknown",R=Date.now(),w=t.tool_input&&typeof t.tool_input=="object"&&!Array.isArray(t.tool_input)?{...t.tool_input,_metadata:void 0}:t.tool_input,A=(0,c.getActiveActivityId)(i),O=(0,c.getActiveVerificationId)(i),C=(0,c.getActiveTraceId)(i),e=(0,b.classifyTool)(v,t.tool_input),W=e.tool_type==="mcp"&&e.tool_name.startsWith(S),B=e.tool_type==="mcp"&&e.tool_name.startsWith($),J=e.tool_type==="mcp"&&e.tool_name.startsWith(x),M=e.tool_type==="mcp"&&e.tool_name.startsWith(D),m=W||B||J||M,a=e.tool_type==="mcp"?ot(e.tool_name)??e.mcp_server:e.mcp_server,z=m?w:(0,b.extractCursorToolInput)(v,w),I=typeof t.error_message=="string"&&t.error_message.length>0?t.error_message:void 0;let d;if(I){const n=[];t.failure_type&&n.push(t.failure_type),t.is_interrupt&&n.push("interrupted"),d=`${n.length>0?`${n.join(",")}: `:""}${I}`}const h={...(0,_.baseFields)(r),type:"tool_call",timestamp:R,tool_name:e.tool_name,tool_type:e.tool_type,tool_use_id:t.tool_use_id,tool_input:z,tool_input_size:V(t.tool_input),tool_response:d?void 0:t.tool_output,tool_response_size:V(d?void 0:t.tool_output),activity_id:A,verification_id:O,trace_id:C,duration:typeof t.duration=="number"?t.duration:null,mcp_server:a,error:d};if(m){await(0,_.appendAction)(r,h);const n=(0,k.recordingToolsForServer)(a);n!==null&&(e.tool_name===n.startTool?((0,c.setRecordingActive)(i,!0),s.logger.debug(`track-action: recording started (${n.cycle})`)):e.tool_name===n.stopTool&&((0,c.setRecordingActive)(i,!1),s.logger.debug(`track-action: recording stopped (${n.cycle})`)))}else et(o,l,h);if(s.logger.debug(`track-action: ${v}${d?" (failed)":""}`),m&&a!==null&&e.tool_name===(0,T.executeToolBareName)(a)&&!d){const n=(0,T.extractNestedToolCalls)(t.tool_input,a),u=(0,k.recordingToolsForServer)(a);for(const p of n){u!==null&&(p.name===u.startTool?((0,c.setRecordingActive)(i,!0),s.logger.debug(`track-action (nested): recording started (${u.cycle})`)):p.name===u.stopTool&&((0,c.setRecordingActive)(i,!1),s.logger.debug(`track-action (nested): recording stopped (${u.cycle})`)));const X={...(0,_.baseFields)(r),type:"tool_call",timestamp:R,tool_name:p.name,tool_type:"mcp",tool_input:p.args,activity_id:A,verification_id:O,trace_id:C,duration:null,mcp_server:a};await(0,_.appendAction)(r,X),s.logger.debug(`track-action (nested): ${p.name}`)}}const N={};if(m)try{const n=(0,L.buildVerificationContextOnceForCycle)({projectDir:o,sessionId:l,sessionDir:i,activeVerificationId:O,config:(0,E.loadConfig)(o)});n.length>0&&(N.additional_context=n)}catch(n){s.logger.debug(`track-action: verification-context injection skipped: ${n instanceof Error?n.message:n}`)}(0,F.writeAndExit)(JSON.stringify(N),0)}g(nt,"run");function et(o,t,l){if(!(0,E.isJobQueueEnabled)(o))return;const i={...l};delete i.tool_response;try{(0,f.submit)(o,t,f.SEND_EVENT_TYPE,i)}catch(r){if(r instanceof f.JobTooLargeError){s.logger.debug(`track-action: wire event too large for ${l.tool_name}; dropping`);return}s.logger.debug(`track-action: failed to submit ${l.tool_name}: ${r instanceof Error?r.message:r}`)}}g(et,"submitEvent");function V(o){if(o==null)return 0;try{const t=typeof o=="string"?o:JSON.stringify(o);return t===void 0?0:Buffer.byteLength(t,"utf-8")}catch{return 0}}g(V,"byteSize");0&&(module.exports={run});
+"use strict";var y=Object.defineProperty;var U=Object.getOwnPropertyDescriptor;var K=Object.getOwnPropertyNames;var j=Object.prototype.hasOwnProperty;var g=(o,t)=>y(o,"name",{value:t,configurable:!0});var Q=(o,t)=>{for(var l in t)y(o,l,{get:t[l],enumerable:!0})},Y=(o,t,l,i)=>{if(t&&typeof t=="object"||typeof t=="function")for(let r of K(t))!j.call(o,r)&&r!==l&&y(o,r,{get:()=>t[r],enumerable:!(i=U(t,r))||i.enumerable});return o};var q=o=>Y(y({},"__esModule",{value:!0}),o);var it={};Q(it,{run:()=>nt});module.exports=q(it);var p=require("../../../hooks/core/actions"),T=require("../../../hooks/core/nested-tools"),c=require("../../../hooks/core/session-state"),L=require("../../../hooks/core/verification-context"),E=require("../../../lib/config"),s=require("../../../lib/logger"),k=require("../../../lib/recording-tools"),F=require("../../../lib/output"),P=require("../../../lib/stdin"),f=require("../../../queue"),b=require("../util");const S="bdt_",$="ndt_",x="bedt_",D="adt_",G="browser-devtools",H="node-devtools",Z="backend-devtools",tt="android-devtools";function ot(o){return o.startsWith(x)?Z:o.startsWith(D)?tt:o.startsWith(S)?G:o.startsWith($)?H:null}g(ot,"resolveServerByPrefix");async function nt(o){let t;try{t=JSON.parse((0,P.readStdin)())}catch(n){s.logger.debug(`failed to parse stdin: ${n}`),process.stdout.write(JSON.stringify({})),process.exit(0);return}const l=t.conversation_id??"default",i=`${o}/.ironbee/sessions/${l}`,r=`${i}/actions.jsonl`;(0,s.setLogFile)(`${i}/session.log`);const v=t.tool_name??"unknown",R=Date.now(),w=t.tool_input&&typeof t.tool_input=="object"&&!Array.isArray(t.tool_input)?{...t.tool_input,_metadata:void 0}:t.tool_input,A=(0,c.getActiveActivityId)(i),O=(0,c.getActiveVerificationId)(i),C=(0,c.getActiveTraceId)(i),e=(0,b.classifyTool)(v,t.tool_input),W=e.tool_type==="mcp"&&e.tool_name.startsWith(S),B=e.tool_type==="mcp"&&e.tool_name.startsWith($),J=e.tool_type==="mcp"&&e.tool_name.startsWith(x),M=e.tool_type==="mcp"&&e.tool_name.startsWith(D),m=W||B||J||M,a=e.tool_type==="mcp"?ot(e.tool_name)??e.mcp_server:e.mcp_server,z=m?w:(0,b.extractCursorToolInput)(v,w),I=typeof t.error_message=="string"&&t.error_message.length>0?t.error_message:void 0;let u;if(I){const n=[];t.failure_type&&n.push(t.failure_type),t.is_interrupt&&n.push("interrupted"),u=`${n.length>0?`${n.join(",")}: `:""}${I}`}const h={...(0,p.baseFields)(r),type:"tool_call",timestamp:R,tool_name:e.tool_name,tool_type:e.tool_type,tool_use_id:t.tool_use_id,tool_input:z,tool_input_size:V(t.tool_input),tool_response:u?void 0:t.tool_output,tool_response_size:V(u?void 0:t.tool_output),activity_id:A,verification_id:O,trace_id:C,duration:typeof t.duration=="number"?t.duration:null,mcp_server:a,error:u};if(m){await(0,p.appendAction)(r,h);const n=(0,k.recordingToolsForServer)(a);n!==null&&(e.tool_name===n.startTool?((0,c.setRecordingActive)(i,!0),s.logger.debug(`track-action: recording started (${n.cycle})`)):e.tool_name===n.stopTool&&((0,c.setRecordingActive)(i,!1),s.logger.debug(`track-action: recording stopped (${n.cycle})`)))}else et(o,l,h);if(s.logger.debug(`track-action: ${v}${u?" (failed)":""}`),m&&a!==null&&e.tool_name===(0,T.executeToolBareName)(a)&&!u){const n=(0,T.extractNestedToolCalls)(t.tool_input,a),_=(0,k.recordingToolsForServer)(a);for(const d of n){_!==null&&(d.name===_.startTool?((0,c.setRecordingActive)(i,!0),s.logger.debug(`track-action (nested): recording started (${_.cycle})`)):d.name===_.stopTool&&((0,c.setRecordingActive)(i,!1),s.logger.debug(`track-action (nested): recording stopped (${_.cycle})`)));const X={...(0,p.baseFields)(r),type:"tool_call",timestamp:d.startTime??R,tool_name:d.name,tool_type:"mcp",tool_input:d.args,activity_id:A,verification_id:O,trace_id:C,duration:d.duration??null,mcp_server:a,nested:!0,parent_tool_use_id:t.tool_use_id};await(0,p.appendAction)(r,X),s.logger.debug(`track-action (nested): ${d.name}`)}}const N={};if(m)try{const n=(0,L.buildVerificationContextOnceForCycle)({projectDir:o,sessionId:l,sessionDir:i,activeVerificationId:O,config:(0,E.loadConfig)(o)});n.length>0&&(N.additional_context=n)}catch(n){s.logger.debug(`track-action: verification-context injection skipped: ${n instanceof Error?n.message:n}`)}(0,F.writeAndExit)(JSON.stringify(N),0)}g(nt,"run");function et(o,t,l){if(!(0,E.isJobQueueEnabled)(o))return;const i={...l};delete i.tool_response;try{(0,f.submit)(o,t,f.SEND_EVENT_TYPE,i)}catch(r){if(r instanceof f.JobTooLargeError){s.logger.debug(`track-action: wire event too large for ${l.tool_name}; dropping`);return}s.logger.debug(`track-action: failed to submit ${l.tool_name}: ${r instanceof Error?r.message:r}`)}}g(et,"submitEvent");function V(o){if(o==null)return 0;try{const t=typeof o=="string"?o:JSON.stringify(o);return t===void 0?0:Buffer.byteLength(t,"utf-8")}catch{return 0}}g(V,"byteSize");0&&(module.exports={run});

package/dist/clients/cursor/index.js

@@ -1 +1 @@
-"use strict";var S=Object.defineProperty;var W=Object.getOwnPropertyDescriptor;var x=Object.getOwnPropertyNames;var z=Object.prototype.hasOwnProperty;var k=(l,o)=>S(l,"name",{value:o,configurable:!0});var Q=(l,o)=>{for(var e in o)S(l,e,{get:o[e],enumerable:!0})},X=(l,o,e,s)=>{if(o&&typeof o=="object"||typeof o=="function")for(let t of x(o))!z.call(l,t)&&t!==e&&S(l,t,{get:()=>o[t],enumerable:!(s=W(o,t))||s.enumerable});return l};var Y=l=>X(S({},"__esModule",{value:!0}),l);var io={};Q(io,{CursorClient:()=>so});module.exports=Y(io);var i=require("fs"),c=require("path"),p=require("../../lib/logger"),n=require("../../lib/output"),_=require("../../lib/fs-prune"),T=require("./hooks/verify-gate"),P=require("./hooks/clear-verdict"),I=require("./hooks/track-action"),N=require("./hooks/track-action-monitor"),B=require("./hooks/session-start"),V=require("./hooks/require-verdict"),J=require("./hooks/require-verification"),U=require("./hooks/activity-start"),D=require("./hooks/activity-end"),L=require("./hooks/session-end"),a=require("../../lib/config"),F=require("../../lib/platform-section"),K=require("../../lib/gitignore");const v="browser-devtools",y="node-devtools",h="backend-devtools",b="android-devtools",Z="ironbee";function oo(l){return(0,c.join)(__dirname,"..",l,"platforms")}k(oo,"platformsDirFor");function H(l){const o=Object.keys(l);if(o.length===0)return!0;if(o.length===1&&o[0]==="mcpServers"){const e=l.mcpServers;return e===void 0||Object.keys(e).length===0}return!1}k(H,"isMcpConfigEmpty");const w="ironbee",O=[`${v}:*`,`${y}:*`,`${h}:*`,`${b}:*`];function eo(l){const o=new Set(["mcpAllowlist","terminalAllowlist"]);for(const t of Object.keys(l))if(!o.has(t))return!1;const e=l.mcpAllowlist??[],s=l.terminalAllowlist??[];return e.length===0&&s.length===0}k(eo,"isPermissionsEmpty");function ro(l){const o=new Set(["version","hooks"]);for(const e of Object.keys(l))if(!o.has(e))return!1;return Object.keys(l.hooks??{}).length===0}k(ro,"isCursorHooksEmpty");function d(l){return n.pc.dim(l)}k(d,"cursorColor");class so{constructor(){this.name="cursor"}static{k(this,"CursorClient")}detect(o){return(0,i.existsSync)((0,c.join)(o,".cursor"))}resolveProjectDir(){return process.env.CURSOR_PROJECT_DIR??process.env.IRONBEE_PROJECT_DIR??process.cwd()}install(o,e){const s=e??(0,a.loadConfig)(o),t=(0,a.getVerificationMode)(s),r=t!=="monitor";this.cleanupArtifacts(o),(0,K.ensureIronBeeGitignored)(o);const u=(0,c.join)(o,".cursor"),g=(0,c.join)(u,"rules"),f=(0,c.join)(u,"skills");(0,i.mkdirSync)(g,{recursive:!0}),(0,i.mkdirSync)(f,{recursive:!0});const m=(0,c.join)(u,"hooks.json");if(this.mergeHooksConfig(m,t),r){if(t==="enforce"){const M=(0,c.join)(f,"ironbee-verification.md"),j=(0,i.readFileSync)((0,c.join)(__dirname,"skills","ironbee-verification.md"),"utf-8");(0,i.writeFileSync)(M,j);const R=(0,c.join)(g,"ironbee-verification.mdc"),G=(0,i.readFileSync)((0,c.join)(__dirname,"rules","ironbee-verification.mdc"),"utf-8");(0,i.writeFileSync)(R,G),console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} skill    ${n.pc.dim("\u2192")} ${n.pc.dim(M)}`),console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} rule     ${n.pc.dim("\u2192")} ${n.pc.dim(R)}`)}const C=(0,c.join)(f,"ironbee-verify");(0,i.mkdirSync)(C,{recursive:!0});const $=(0,c.join)(C,"SKILL.md"),q=(0,i.readFileSync)((0,c.join)(__dirname,"commands","ironbee-verify","SKILL.md"),"utf-8");(0,i.writeFileSync)($,q);const E=(0,c.join)(u,"mcp.json");this.writeMcpConfig(E,o);const A=(0,c.join)(u,"permissions.json");this.writePermissionsConfig(A,o),(0,F.syncPlatformSectionsToConfig)(o,oo),console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} hooks    ${n.pc.dim("\u2192")} ${n.pc.dim(m)}`),t==="assist"&&console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} ${n.pc.yellow("assist mode")} (verification.auto: false) \u2014 manual /ironbee-verify only, no enforcement`),console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} command  ${n.pc.dim("\u2192")} ${n.pc.dim($)}`),console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} mcp      ${n.pc.dim("\u2192")} ${n.pc.dim(E)}`),console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} perms    ${n.pc.dim("\u2192")} ${n.pc.dim(A)}`),console.log(),console.log(`  ${n.pc.yellow("\u26A0")} ${n.pc.yellow("Cursor requires manual steps:")}`),console.log(`    ${n.pc.yellow("1.")} Restart Cursor to load the new hooks and MCP config`),console.log(`    ${n.pc.yellow("2.")} Go to ${n.pc.bold("Settings \u2192 Tools & MCP")} and verify ${n.pc.bold("browser-devtools")} is enabled`),console.log(`    ${n.pc.yellow("3.")} If the server shows as enabled but tools are unavailable, toggle it off and on`)}else console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} ${n.pc.yellow("monitoring-only mode")} (verification.enable: false)`),console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} hooks    ${n.pc.dim("\u2192")} ${n.pc.dim(m)}`),console.log(),console.log(`  ${n.pc.yellow("\u26A0")} Restart Cursor to load the new hook config`)}uninstall(o){this.cleanupArtifacts(o),console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} removed hooks, skill, rule, command, and MCP`),console.log(),console.log(`  ${n.pc.yellow("\u26A0")} Restart Cursor to apply changes`)}cleanupArtifacts(o){const e=(0,c.join)(o,".cursor"),s=(0,c.join)(e,"skills","ironbee-verification.md"),t=(0,c.join)(e,"rules","ironbee-verification.mdc"),r=(0,c.join)(e,"skills","ironbee-analyze","SKILL.md"),u=(0,c.join)(e,"skills","ironbee-verify","SKILL.md");this.removeFile(s),this.removeFile(t),this.removeFile(r),this.removeFile(u);const g=(0,c.join)(e,"hooks.json");this.removeIronBeeHooks(g),this.maybeDeleteEmptyHooks(g);const f=(0,c.join)(e,"mcp.json");this.removeMcpServer(f);const m=(0,c.join)(e,"permissions.json");this.removePermissionsEntries(m),(0,_.pruneEmptyDirs)(e)}maybeDeleteEmptyHooks(o){if((0,i.existsSync)(o))try{const e=JSON.parse((0,i.readFileSync)(o,"utf-8"));ro(e)&&(0,i.unlinkSync)(o)}catch(e){p.logger.debug(`failed to inspect ${o} for emptiness: ${e}`)}}async runVerifyGate(o){await(0,T.run)(o)}async runClearVerdict(o){await(0,P.run)(o)}async runTrackAction(o){await(0,I.run)(o)}async runSessionStart(o){await(0,B.run)(o)}async runRequireVerdict(o,e){await(0,V.run)(o,e)}async runRequireVerification(o,e){await(0,J.run)(o,e)}async runActivityStart(o){await(0,U.run)(o)}async runActivityEnd(o){await(0,D.run)(o)}async runTrackActionMonitor(o){await(0,N.run)(o)}async runSessionEnd(o){await(0,L.run)(o)}async runTrackActionPre(o){}isIronBeeHook(o){return o.command.includes(Z)}mergeHooksConfig(o,e){const s=e!=="monitor",t=e==="assist"?" --soft":"";let r={version:1,hooks:{}};if((0,i.existsSync)(o))try{r=JSON.parse((0,i.readFileSync)(o,"utf-8")),r.hooks||(r.hooks={})}catch(f){p.logger.debug(`failed to parse ${o}: ${f}`),r={version:1,hooks:{}}}for(const f of Object.keys(r.hooks)){const m=r.hooks[f].filter(C=>!this.isIronBeeHook(C));m.length===0?delete r.hooks[f]:r.hooks[f]=m}r.hooks.sessionStart||(r.hooks.sessionStart=[]),r.hooks.sessionStart.push({command:"ironbee hook session-start --client cursor"}),r.hooks.beforeSubmitPrompt||(r.hooks.beforeSubmitPrompt=[]),r.hooks.beforeSubmitPrompt.push({command:"ironbee hook activity-start --client cursor"}),s&&(r.hooks.preToolUse||(r.hooks.preToolUse=[]),r.hooks.preToolUse.push({command:`ironbee hook require-verification --client cursor${t}`,matcher:"MCP:(bdt|ndt|bedt|adt)_.*",failClosed:e==="enforce"}),r.hooks.preToolUse.push({command:`ironbee hook require-verdict --client cursor${t}`,matcher:"Write|StrReplace|Delete",failClosed:e==="enforce"}),r.hooks.postToolUse||(r.hooks.postToolUse=[]),r.hooks.postToolUse.push({command:"ironbee hook clear-verdict --client cursor",matcher:"Write|StrReplace|Delete"})),r.hooks.postToolUse||(r.hooks.postToolUse=[]);const u=s?"ironbee hook track-action --client cursor":"ironbee hook track-action-monitor --client cursor";r.hooks.postToolUse.push({command:u}),r.hooks.postToolUseFailure||(r.hooks.postToolUseFailure=[]),r.hooks.postToolUseFailure.push({command:u}),r.hooks.stop||(r.hooks.stop=[]);const g=e==="enforce"?"ironbee hook verify-gate --client cursor":"ironbee hook activity-end --client cursor";r.hooks.stop.push({command:g}),r.hooks.sessionEnd||(r.hooks.sessionEnd=[]),r.hooks.sessionEnd.push({command:"ironbee hook session-end --client cursor"}),r.version=1,(0,i.writeFileSync)(o,JSON.stringify(r,null,2))}removeIronBeeHooks(o){if((0,i.existsSync)(o))try{const e=JSON.parse((0,i.readFileSync)(o,"utf-8"));if(!e.hooks)return;for(const s of Object.keys(e.hooks)){const t=e.hooks[s].filter(r=>!this.isIronBeeHook(r));t.length===0?delete e.hooks[s]:e.hooks[s]=t}(0,i.writeFileSync)(o,JSON.stringify(e,null,2))}catch(e){p.logger.debug(`failed to remove hooks from ${o}: ${e}`)}}removeMcpServer(o){if((0,i.existsSync)(o))try{const e=JSON.parse((0,i.readFileSync)(o,"utf-8"));let s=!1;e.mcpServers&&e.mcpServers[v]&&(delete e.mcpServers[v],s=!0),e.mcpServers&&e.mcpServers[y]&&(delete e.mcpServers[y],s=!0),e.mcpServers&&e.mcpServers[h]&&(delete e.mcpServers[h],s=!0),e.mcpServers&&e.mcpServers[b]&&(delete e.mcpServers[b],s=!0),H(e)?(0,i.unlinkSync)(o):s&&(0,i.writeFileSync)(o,JSON.stringify(e,null,2))}catch(e){p.logger.debug(`failed to remove MCP server from ${o}: ${e}`)}}removeFile(o){(0,i.existsSync)(o)&&(0,i.unlinkSync)(o)}writeMcpConfig(o,e){let s={mcpServers:{}};if((0,i.existsSync)(o))try{s=JSON.parse((0,i.readFileSync)(o,"utf-8")),s.mcpServers||(s.mcpServers={})}catch(r){p.logger.debug(`failed to parse ${o}: ${r}`),s={mcpServers:{}}}const t=(0,a.loadConfig)(e);if((0,a.isCycleEnabled)(t,"browser")?s.mcpServers[v]=(0,a.getMcpServerEntry)(e):delete s.mcpServers[v],(0,a.isCycleEnabled)(t,"node")?s.mcpServers[y]=(0,a.getNodeDevToolsMcpEntry)(e):delete s.mcpServers[y],(0,a.isCycleEnabled)(t,"backend")?s.mcpServers[h]=(0,a.getBackendDevToolsMcpEntry)(e):delete s.mcpServers[h],(0,a.isCycleEnabled)(t,"android")?s.mcpServers[b]=(0,a.getAndroidDevToolsMcpEntry)(e):delete s.mcpServers[b],H(s)){try{(0,i.rmSync)(o,{force:!0})}catch(r){p.logger.debug(`failed to remove empty ${o}: ${r}`)}return}(0,i.writeFileSync)(o,JSON.stringify(s,null,2))}writePermissionsConfig(o,e){let s={};if((0,i.existsSync)(o))try{s=JSON.parse((0,i.readFileSync)(o,"utf-8"))}catch(m){p.logger.debug(`failed to parse ${o}: ${m}`),s={}}const t=(0,a.loadConfig)(e),r=[];(0,a.isCycleEnabled)(t,"browser")&&r.push(`${v}:*`),(0,a.isCycleEnabled)(t,"node")&&r.push(`${y}:*`),(0,a.isCycleEnabled)(t,"backend")&&r.push(`${h}:*`),(0,a.isCycleEnabled)(t,"android")&&r.push(`${b}:*`);const u=new Set(O),g=(s.mcpAllowlist??[]).filter(m=>!u.has(m));for(const m of r)g.includes(m)||g.push(m);g.length>0?s.mcpAllowlist=g:delete s.mcpAllowlist;const f=(s.terminalAllowlist??[]).filter(m=>m!==w);f.push(w),s.terminalAllowlist=f,(0,i.writeFileSync)(o,JSON.stringify(s,null,2))}removePermissionsEntries(o){if((0,i.existsSync)(o))try{const e=JSON.parse((0,i.readFileSync)(o,"utf-8")),s=new Set(O);Array.isArray(e.mcpAllowlist)&&(e.mcpAllowlist=e.mcpAllowlist.filter(t=>!s.has(t)),e.mcpAllowlist.length===0&&delete e.mcpAllowlist),Array.isArray(e.terminalAllowlist)&&(e.terminalAllowlist=e.terminalAllowlist.filter(t=>t!==w),e.terminalAllowlist.length===0&&delete e.terminalAllowlist),eo(e)?(0,i.unlinkSync)(o):(0,i.writeFileSync)(o,JSON.stringify(e,null,2))}catch(e){p.logger.debug(`failed to remove permissions from ${o}: ${e}`)}}}0&&(module.exports={CursorClient});
+"use strict";var $=Object.defineProperty;var x=Object.getOwnPropertyDescriptor;var z=Object.getOwnPropertyNames;var Q=Object.prototype.hasOwnProperty;var v=(c,o)=>$(c,"name",{value:o,configurable:!0});var X=(c,o)=>{for(var e in o)$(c,e,{get:o[e],enumerable:!0})},Y=(c,o,e,s)=>{if(o&&typeof o=="object"||typeof o=="function")for(let t of z(o))!Q.call(c,t)&&t!==e&&$(c,t,{get:()=>o[t],enumerable:!(s=x(o,t))||s.enumerable});return c};var Z=c=>Y($({},"__esModule",{value:!0}),c);var no={};X(no,{CursorClient:()=>io});module.exports=Z(no);var i=require("fs"),l=require("path"),p=require("../../lib/logger"),n=require("../../lib/output"),T=require("../../lib/fs-prune"),N=require("./hooks/verify-gate"),P=require("./hooks/clear-verdict"),L=require("./hooks/track-action"),B=require("./hooks/track-action-monitor"),V=require("./hooks/session-start"),J=require("./hooks/require-verdict"),D=require("./hooks/require-verification"),F=require("./hooks/activity-start"),U=require("./hooks/activity-end"),K=require("./hooks/session-end"),a=require("../../lib/config"),q=require("../../lib/platform-section"),j=require("../../lib/gitignore");const y="browser-devtools",b="node-devtools",h="backend-devtools",S="android-devtools",oo="ironbee",O=["ironbee-manage-scenario","ironbee-search-scenario","ironbee-sync-scenario"];function eo(c){return(0,l.join)(__dirname,"..",c,"platforms")}v(eo,"platformsDirFor");function _(c){const o=Object.keys(c);if(o.length===0)return!0;if(o.length===1&&o[0]==="mcpServers"){const e=c.mcpServers;return e===void 0||Object.keys(e).length===0}return!1}v(_,"isMcpConfigEmpty");const E="ironbee",I=[`${y}:*`,`${b}:*`,`${h}:*`,`${S}:*`];function ro(c){const o=new Set(["mcpAllowlist","terminalAllowlist"]);for(const t of Object.keys(c))if(!o.has(t))return!1;const e=c.mcpAllowlist??[],s=c.terminalAllowlist??[];return e.length===0&&s.length===0}v(ro,"isPermissionsEmpty");function so(c){const o=new Set(["version","hooks"]);for(const e of Object.keys(c))if(!o.has(e))return!1;return Object.keys(c.hooks??{}).length===0}v(so,"isCursorHooksEmpty");function d(c){return n.pc.dim(c)}v(d,"cursorColor");class io{constructor(){this.name="cursor"}static{v(this,"CursorClient")}detect(o){return(0,i.existsSync)((0,l.join)(o,".cursor"))}resolveProjectDir(){return process.env.CURSOR_PROJECT_DIR??process.env.IRONBEE_PROJECT_DIR??process.cwd()}install(o,e){const s=e??(0,a.loadConfig)(o),t=(0,a.getVerificationMode)(s),r=t!=="monitor";this.cleanupArtifacts(o),(0,j.ensureIronBeeGitignored)(o);const u=(0,l.join)(o,".cursor"),g=(0,l.join)(u,"rules"),f=(0,l.join)(u,"skills");(0,i.mkdirSync)(g,{recursive:!0}),(0,i.mkdirSync)(f,{recursive:!0});const m=(0,l.join)(u,"hooks.json");if(this.mergeHooksConfig(m,t),r){if(t==="enforce"){const C=(0,l.join)(f,"ironbee-verification.md"),w=(0,i.readFileSync)((0,l.join)(__dirname,"skills","ironbee-verification.md"),"utf-8");(0,i.writeFileSync)(C,w);const H=(0,l.join)(g,"ironbee-verification.mdc"),W=(0,i.readFileSync)((0,l.join)(__dirname,"rules","ironbee-verification.mdc"),"utf-8");(0,i.writeFileSync)(H,W),console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} skill    ${n.pc.dim("\u2192")} ${n.pc.dim(C)}`),console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} rule     ${n.pc.dim("\u2192")} ${n.pc.dim(H)}`)}const k=(0,l.join)(f,"ironbee-verify");(0,i.mkdirSync)(k,{recursive:!0});const A=(0,l.join)(k,"SKILL.md"),G=(0,i.readFileSync)((0,l.join)(__dirname,"commands","ironbee-verify","SKILL.md"),"utf-8");(0,i.writeFileSync)(A,G);for(const C of O){const w=(0,l.join)(f,C);(0,i.mkdirSync)(w,{recursive:!0}),(0,i.writeFileSync)((0,l.join)(w,"SKILL.md"),(0,i.readFileSync)((0,l.join)(__dirname,"commands",C,"SKILL.md"),"utf-8"))}const M=(0,l.join)(u,"mcp.json");this.writeMcpConfig(M,o);const R=(0,l.join)(u,"permissions.json");this.writePermissionsConfig(R,o),(0,q.syncPlatformSectionsToConfig)(o,eo),console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} hooks    ${n.pc.dim("\u2192")} ${n.pc.dim(m)}`),t==="assist"&&console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} ${n.pc.yellow("assist mode")} (verification.auto: false) \u2014 manual /ironbee-verify only, no enforcement`),console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} command  ${n.pc.dim("\u2192")} ${n.pc.dim(A)}`),console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} mcp      ${n.pc.dim("\u2192")} ${n.pc.dim(M)}`),console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} perms    ${n.pc.dim("\u2192")} ${n.pc.dim(R)}`),console.log(),console.log(`  ${n.pc.yellow("\u26A0")} ${n.pc.yellow("Cursor requires manual steps:")}`),console.log(`    ${n.pc.yellow("1.")} Restart Cursor to load the new hooks and MCP config`),console.log(`    ${n.pc.yellow("2.")} Go to ${n.pc.bold("Settings \u2192 Tools & MCP")} and verify ${n.pc.bold("browser-devtools")} is enabled`),console.log(`    ${n.pc.yellow("3.")} If the server shows as enabled but tools are unavailable, toggle it off and on`)}else console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} ${n.pc.yellow("monitoring-only mode")} (verification.enable: false)`),console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} hooks    ${n.pc.dim("\u2192")} ${n.pc.dim(m)}`),console.log(),console.log(`  ${n.pc.yellow("\u26A0")} Restart Cursor to load the new hook config`)}uninstall(o){this.cleanupArtifacts(o),console.log(`  ${n.pc.dim("\u2192")} ${d("[cursor]")} removed hooks, skill, rule, command, and MCP`),console.log(),console.log(`  ${n.pc.yellow("\u26A0")} Restart Cursor to apply changes`)}cleanupArtifacts(o){const e=(0,l.join)(o,".cursor"),s=(0,l.join)(e,"skills","ironbee-verification.md"),t=(0,l.join)(e,"rules","ironbee-verification.mdc"),r=(0,l.join)(e,"skills","ironbee-analyze","SKILL.md"),u=(0,l.join)(e,"skills","ironbee-verify","SKILL.md");this.removeFile(s),this.removeFile(t),this.removeFile(r),this.removeFile(u);for(const k of O)this.removeFile((0,l.join)(e,"skills",k,"SKILL.md"));this.removeFile((0,l.join)(e,"skills","ironbee-run-scenario","SKILL.md"));const g=(0,l.join)(e,"hooks.json");this.removeIronBeeHooks(g),this.maybeDeleteEmptyHooks(g);const f=(0,l.join)(e,"mcp.json");this.removeMcpServer(f);const m=(0,l.join)(e,"permissions.json");this.removePermissionsEntries(m),(0,T.pruneEmptyDirs)(e)}maybeDeleteEmptyHooks(o){if((0,i.existsSync)(o))try{const e=JSON.parse((0,i.readFileSync)(o,"utf-8"));so(e)&&(0,i.unlinkSync)(o)}catch(e){p.logger.debug(`failed to inspect ${o} for emptiness: ${e}`)}}async runVerifyGate(o){await(0,N.run)(o)}async runClearVerdict(o){await(0,P.run)(o)}async runTrackAction(o){await(0,L.run)(o)}async runSessionStart(o){await(0,V.run)(o)}async runRequireVerdict(o,e){await(0,J.run)(o,e)}async runRequireVerification(o,e){await(0,D.run)(o,e)}async runActivityStart(o){await(0,F.run)(o)}async runActivityEnd(o){await(0,U.run)(o)}async runTrackActionMonitor(o){await(0,B.run)(o)}async runSessionEnd(o){await(0,K.run)(o)}async runTrackActionPre(o){}isIronBeeHook(o){return o.command.includes(oo)}mergeHooksConfig(o,e){const s=e!=="monitor",t=e==="assist"?" --soft":"";let r={version:1,hooks:{}};if((0,i.existsSync)(o))try{r=JSON.parse((0,i.readFileSync)(o,"utf-8")),r.hooks||(r.hooks={})}catch(f){p.logger.debug(`failed to parse ${o}: ${f}`),r={version:1,hooks:{}}}for(const f of Object.keys(r.hooks)){const m=r.hooks[f].filter(k=>!this.isIronBeeHook(k));m.length===0?delete r.hooks[f]:r.hooks[f]=m}r.hooks.sessionStart||(r.hooks.sessionStart=[]),r.hooks.sessionStart.push({command:"ironbee hook session-start --client cursor"}),r.hooks.beforeSubmitPrompt||(r.hooks.beforeSubmitPrompt=[]),r.hooks.beforeSubmitPrompt.push({command:"ironbee hook activity-start --client cursor"}),s&&(r.hooks.preToolUse||(r.hooks.preToolUse=[]),r.hooks.preToolUse.push({command:`ironbee hook require-verification --client cursor${t}`,matcher:"MCP:(bdt|ndt|bedt|adt)_.*",failClosed:e==="enforce"}),r.hooks.preToolUse.push({command:`ironbee hook require-verdict --client cursor${t}`,matcher:"Write|StrReplace|Delete",failClosed:e==="enforce"}),r.hooks.postToolUse||(r.hooks.postToolUse=[]),r.hooks.postToolUse.push({command:"ironbee hook clear-verdict --client cursor",matcher:"Write|StrReplace|Delete"})),r.hooks.postToolUse||(r.hooks.postToolUse=[]);const u=s?"ironbee hook track-action --client cursor":"ironbee hook track-action-monitor --client cursor";r.hooks.postToolUse.push({command:u}),r.hooks.postToolUseFailure||(r.hooks.postToolUseFailure=[]),r.hooks.postToolUseFailure.push({command:u}),r.hooks.stop||(r.hooks.stop=[]);const g=e==="enforce"?"ironbee hook verify-gate --client cursor":"ironbee hook activity-end --client cursor";r.hooks.stop.push({command:g}),r.hooks.sessionEnd||(r.hooks.sessionEnd=[]),r.hooks.sessionEnd.push({command:"ironbee hook session-end --client cursor"}),r.version=1,(0,i.writeFileSync)(o,JSON.stringify(r,null,2))}removeIronBeeHooks(o){if((0,i.existsSync)(o))try{const e=JSON.parse((0,i.readFileSync)(o,"utf-8"));if(!e.hooks)return;for(const s of Object.keys(e.hooks)){const t=e.hooks[s].filter(r=>!this.isIronBeeHook(r));t.length===0?delete e.hooks[s]:e.hooks[s]=t}(0,i.writeFileSync)(o,JSON.stringify(e,null,2))}catch(e){p.logger.debug(`failed to remove hooks from ${o}: ${e}`)}}removeMcpServer(o){if((0,i.existsSync)(o))try{const e=JSON.parse((0,i.readFileSync)(o,"utf-8"));let s=!1;e.mcpServers&&e.mcpServers[y]&&(delete e.mcpServers[y],s=!0),e.mcpServers&&e.mcpServers[b]&&(delete e.mcpServers[b],s=!0),e.mcpServers&&e.mcpServers[h]&&(delete e.mcpServers[h],s=!0),e.mcpServers&&e.mcpServers[S]&&(delete e.mcpServers[S],s=!0),_(e)?(0,i.unlinkSync)(o):s&&(0,i.writeFileSync)(o,JSON.stringify(e,null,2))}catch(e){p.logger.debug(`failed to remove MCP server from ${o}: ${e}`)}}removeFile(o){(0,i.existsSync)(o)&&(0,i.unlinkSync)(o)}writeMcpConfig(o,e){let s={mcpServers:{}};if((0,i.existsSync)(o))try{s=JSON.parse((0,i.readFileSync)(o,"utf-8")),s.mcpServers||(s.mcpServers={})}catch(r){p.logger.debug(`failed to parse ${o}: ${r}`),s={mcpServers:{}}}const t=(0,a.loadConfig)(e);if((0,a.isCycleEnabled)(t,"browser")?s.mcpServers[y]=(0,a.getMcpServerEntry)(e):delete s.mcpServers[y],(0,a.isCycleEnabled)(t,"node")?s.mcpServers[b]=(0,a.getNodeDevToolsMcpEntry)(e):delete s.mcpServers[b],(0,a.isCycleEnabled)(t,"backend")?s.mcpServers[h]=(0,a.getBackendDevToolsMcpEntry)(e):delete s.mcpServers[h],(0,a.isCycleEnabled)(t,"android")?s.mcpServers[S]=(0,a.getAndroidDevToolsMcpEntry)(e):delete s.mcpServers[S],_(s)){try{(0,i.rmSync)(o,{force:!0})}catch(r){p.logger.debug(`failed to remove empty ${o}: ${r}`)}return}(0,i.writeFileSync)(o,JSON.stringify(s,null,2))}writePermissionsConfig(o,e){let s={};if((0,i.existsSync)(o))try{s=JSON.parse((0,i.readFileSync)(o,"utf-8"))}catch(m){p.logger.debug(`failed to parse ${o}: ${m}`),s={}}const t=(0,a.loadConfig)(e),r=[];(0,a.isCycleEnabled)(t,"browser")&&r.push(`${y}:*`),(0,a.isCycleEnabled)(t,"node")&&r.push(`${b}:*`),(0,a.isCycleEnabled)(t,"backend")&&r.push(`${h}:*`),(0,a.isCycleEnabled)(t,"android")&&r.push(`${S}:*`);const u=new Set(I),g=(s.mcpAllowlist??[]).filter(m=>!u.has(m));for(const m of r)g.includes(m)||g.push(m);g.length>0?s.mcpAllowlist=g:delete s.mcpAllowlist;const f=(s.terminalAllowlist??[]).filter(m=>m!==E);f.push(E),s.terminalAllowlist=f,(0,i.writeFileSync)(o,JSON.stringify(s,null,2))}removePermissionsEntries(o){if((0,i.existsSync)(o))try{const e=JSON.parse((0,i.readFileSync)(o,"utf-8")),s=new Set(I);Array.isArray(e.mcpAllowlist)&&(e.mcpAllowlist=e.mcpAllowlist.filter(t=>!s.has(t)),e.mcpAllowlist.length===0&&delete e.mcpAllowlist),Array.isArray(e.terminalAllowlist)&&(e.terminalAllowlist=e.terminalAllowlist.filter(t=>t!==E),e.terminalAllowlist.length===0&&delete e.terminalAllowlist),ro(e)?(0,i.unlinkSync)(o):(0,i.writeFileSync)(o,JSON.stringify(e,null,2))}catch(e){p.logger.debug(`failed to remove permissions from ${o}: ${e}`)}}}0&&(module.exports={CursorClient});

package/dist/clients/cursor/platforms/scenario.android.md

@@ -0,0 +1,31 @@
+### android platform (enabled)
+- **Use for**: Android app scenarios on a real device / emulator.
+- **Server**: `android-devtools` · **scenario tools**: the `adt_scenario-*` tools
+  (`adt_scenario-add` / `-update` / `-delete` / `-list` / `-search` / `-run`).
+- **Store**: project → `.ironbee/scenarios/adt`, global → `~/.ironbee/scenarios/adt` (the
+  server's `SCENARIOS_DIR`; you pass `scope`, the server resolves the path).
+- Scenario **scripts** call this platform's tools via `callTool('<bare-tool>', {...})` — discover
+  the available `adt_*` tool names from your connected MCP tool schemas; don't guess.
+
+**What to test & how — capture the SAME evidence the verifier would** (a scenario runs FOR
+verification, so its script must collect what the android cycle collects). In the script:
+1. **Connect + launch** — `adt_device_connect` (list targets with `adt_device_list-targets`; an
+   emulator is usually `emulator-5554`), then `adt_device_launch-app` with the package name.
+2. Pick an **evidence path** for the changed code area:
+   - **Device-evidence path** — drive the UI to exercise the change (`adt_interaction_tap` /
+     `adt_interaction_input-text` / `adt_interaction_swipe` / `adt_interaction_scroll`; locate elements
+     with `adt_a11y_find-element` / the UI-snapshot's element refs — do NOT hand-parse the snapshot
+     TEXT with regex), then capture **BOTH**: a screenshot (`adt_content_take-screenshot`
+     **with `returnOutput: true`** — put the returned `filePath` in your result; the verifier `Read`s
+     that file to judge the pixels. **Do NOT set `includeBase64`** — a nested scenario screenshot isn't
+     surfaced as an inline image and base64 only bloats the result) **AND** a UI snapshot
+     (`adt_a11y_take-ui-snapshot`, `returnOutput: true` — its TEXT view hierarchy / labels is what the
+     verifier reads). Both are MANDATORY (visual + structural, like the browser screenshot + aria pair).
+   - **Log-evidence path** — `adt_o11y_log-read` / `adt_o11y_log-follow` (with `returnOutput: true`)
+     for the tag(s) relevant to the change; confirm expected lines appear AND no FATAL / crash (E/
+     entries) for the app package.
+
+`return` the evidence — UI-snapshot text, log lines, the screenshot `filePath`s — **plus explicit
+pass/fail assertions**. That returned result is what `/ironbee-verify scenario:<name>` reads to judge
+functional + structural (from the text) and **visual** (by `Read`ing the returned screenshot files).
+**`android-devtools` is Android-only.**

package/dist/clients/cursor/platforms/scenario.backend.md

@@ -0,0 +1,26 @@
+### backend platform (enabled)
+- **Use for**: backend protocol scenarios (HTTP / gRPC / GraphQL / WebSocket / DB).
+- **Server**: `backend-devtools` · **scenario tools**: the `bedt_scenario-*` tools
+  (`bedt_scenario-add` / `-update` / `-delete` / `-list` / `-search` / `-run`).
+- **Store**: project → `.ironbee/scenarios/bedt`, global → `~/.ironbee/scenarios/bedt` (the
+  server's `SCENARIOS_DIR`; you pass `scope`, the server resolves the path).
+- Scenario **scripts** call this platform's tools via `callTool('<bare-tool>', {...})` — discover
+  the available `bedt_*` tool names from your connected MCP tool schemas; don't guess.
+
+**What to test & how — capture the SAME evidence the verifier would** (a scenario runs FOR
+verification, so its script must collect what the backend cycle collects). At least ONE evidence path
+is required — in the script, exercise one+:
+- **Protocol-call** — `bedt_request_http` / `bedt_request_grpc` / `bedt_request_graphql` /
+  `bedt_request_websocket-open…` / `bedt_request_replay`; inspect the response `status` / body /
+  headers (4xx/5xx and gRPC non-OK are NORMAL results, not transport errors — decide pass/fail by what
+  the task requires). Chain POST→GET to confirm side effects.
+- **Log-evidence** — `bedt_log_register-source` then `bedt_log_read` / `bedt_log_read-multi` /
+  `bedt_log_follow` (filter by level / pattern / trace-id) when an external driver hits the endpoint.
+- **DB-evidence** — `bedt_db_connect` (read-only by default) then `bedt_db_query` /
+  `bedt_db_describe-table` / `bedt_db_snapshot` + `bedt_db_diff` to inspect state after a migration /
+  write.
+
+`return` the responses / log lines / rows (capture each read with `returnOutput: true` so the data
+reaches the script's `return`) **plus explicit pass/fail assertions** so a later verify run can judge
+them. Runtime-agnostic —
+works for any backend language (Node, Java, Python, Go, Rust, Ruby, .NET, …).

package/dist/clients/cursor/platforms/scenario.browser.md

@@ -0,0 +1,40 @@
+### browser platform (enabled)
+- **Use for**: UI / frontend scenarios driven through a real browser.
+- **Server**: `browser-devtools` · **scenario tools**: the `bdt_scenario-*` tools
+  (`bdt_scenario-add` / `-update` / `-delete` / `-list` / `-search` / `-run`).
+- **Store**: project → `.ironbee/scenarios/bdt`, global → `~/.ironbee/scenarios/bdt` (the
+  server's `SCENARIOS_DIR`; you pass `scope`, the server resolves the path).
+- Scenario **scripts** call this platform's tools via `callTool('<bare-tool>', {...})` — discover
+  the available `bdt_*` tool names from your connected MCP tool schemas; don't guess.
+
+**What to test & how — capture the SAME evidence the verifier would** (a scenario runs FOR
+verification, so its script must collect what the browser cycle collects). In the script:
+1. **Navigate** — `bdt_navigation_go-to` to the affected page(s), then **actually interact** (click
+   buttons, fill forms, submit data, trigger the workflow that changed). A click-through that asserts
+   nothing verifies nothing — the interaction is what makes the evidence meaningful. **Target elements
+   with the `selector`/`ref` the aria-snapshot returns for each** (e.g. `getByRole(...)` or `@e12`) —
+   do NOT hand-parse the snapshot TEXT with regex/string-matching: embedded quotes or special chars in
+   labels make that brittle (it silently misses elements). This includes deriving a positional
+   **`.nth(i)`** index by parsing the snapshot — a quote or special char in any earlier label shifts
+   every index, so the click lands on the wrong element (or none). Pick each element by its own
+   `getByRole(...)`/`ref`, or scope it to the matching card/row with a CSS `:has()` selector (e.g.
+   `.product-card:has(h4:has-text('Widget')) button:has-text('Add to cart')`). NOTE: the
+   browser-devtools resolver accepts only a flat `getByXYZ(...)` expression OR a CSS string — Playwright
+   locator chaining like `.filter({ hasText })` does NOT parse. Never compute element positions from
+   snapshot text.
+2. **Screenshot** — `bdt_content_take-screenshot` (or `includeScreenshot: true` on a nav/interaction
+   call) **with `returnOutput: true`, and put the returned `filePath` (absolute path to the saved PNG)
+   in your result**. The later verifier opens that file with its `Read` tool to judge the pixels
+   (readability, layout, cut-off content, expected render). **Do NOT set `includeBase64`** — a nested
+   scenario screenshot is NOT surfaced as an inline MCP image (`scenario-run` strips nested image data)
+   and base64 only bloats the result; the returned `filePath` is how visual judging works.
+3. **Accessibility** — `bdt_a11y_take-aria-snapshot` (or `includeSnapshot: true`), called with
+   `returnOutput: true` — the snapshot TEXT is what the verifier reads to judge page structure.
+4. **Console** — `bdt_o11y_get-console-messages` with `returnOutput: true` to surface errors.
+
+`return` the evidence — aria-snapshot text, page text (`bdt_content_get-as-text`), console errors, the
+screenshot `filePath`s — **plus explicit pass/fail assertions**. That returned result is what
+`/ironbee-verify scenario:<name>` reads to judge the run: functional + structural from the text, and
+**visual by `Read`ing the returned screenshot files**. Capture the evidence AFTER the interactions
+whose state you want to assert; for an intermediate state (a modal that opens then closes) capture at
+that point too.

package/dist/clients/cursor/platforms/scenario.node.md

@@ -0,0 +1,27 @@
+### node platform (enabled)
+- **Use for**: Node.js runtime-debug scenarios (V8 inspector probes / logs).
+- **Server**: `node-devtools` · **scenario tools**: the `ndt_scenario-*` tools
+  (`ndt_scenario-add` / `-update` / `-delete` / `-list` / `-search` / `-run`).
+- **Store**: project → `.ironbee/scenarios/ndt`, global → `~/.ironbee/scenarios/ndt` (the
+  server's `SCENARIOS_DIR`; you pass `scope`, the server resolves the path).
+- Scenario **scripts** call this platform's tools via `callTool('<bare-tool>', {...})` — discover
+  the available `ndt_*` tool names from your connected MCP tool schemas; don't guess.
+
+**What to test & how — capture the SAME evidence the verifier would** (a scenario runs FOR
+verification, so its script must collect what the node cycle collects). In the script:
+1. **Connect** — `ndt_debug_connect` (one of `pid` / `processName` / `containerName` /
+   `inspectorPort` / `wsUrl`).
+2. Pick an **evidence path** for the changed code path:
+   - **Probe path** (proves the code path executed) — set a probe at the changed location
+     (`ndt_debug_put-tracepoint` / `ndt_debug_put-logpoint` / `ndt_debug_put-exceptionpoint`),
+     **exercise the path** (drive it via a request / CLI / another platform's call — without this the
+     probe never fires), then read `ndt_debug_get-probe-snapshots`; at least one probe must come back
+     `triggered: true`.
+   - **Log path** (proves no errors during execution) — exercise the path, then `ndt_debug_get-logs`
+     filtered to the error level (no ERROR-level entries = pass).
+
+`return` the probe snapshots / logs (read them with `returnOutput: true` so their data reaches the
+script's `return`) **plus explicit pass/fail assertions** so a later verify run can judge them.
+**`node-devtools` is
+Node.js ONLY** — never author `ndt_*` scenarios for Java / Python / Go / Rust / Ruby / .NET / PHP
+backends; use the **backend** platform for those.

package/dist/commands/install.js

@@ -1 +1 @@
-"use strict";var y=Object.defineProperty;var V=Object.getOwnPropertyDescriptor;var A=Object.getOwnPropertyNames;var N=Object.prototype.hasOwnProperty;var u=(i,e)=>y(i,"name",{value:e,configurable:!0});var T=(i,e)=>{for(var o in e)y(i,o,{get:e[o],enumerable:!0})},R=(i,e,o,a)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of A(e))!N.call(i,r)&&r!==o&&y(i,r,{get:()=>e[r],enumerable:!(a=V(e,r))||a.enumerable});return i};var B=i=>R(y({},"__esModule",{value:!0}),i);var q={};T(q,{CYCLE_HINTS:()=>D,installCommand:()=>F,runInstallAll:()=>v,syncSchemaIfChanged:()=>W});module.exports=B(q);var $=require("commander"),P=require("fs"),x=require("path"),c=require("../clients/registry"),M=require("../clients/claude"),m=require("../lib/config"),t=require("../lib/output"),j=require("../lib/projects-registry"),f=require("../lib/prompt"),w=require("../lib/telemetry"),S=require("../lib/install-version"),p=require("../lib/schema-sync"),C=require("./cycle-toggle"),l=require("./mode-select");const D={browser:"web UI \xB7 DOM \xB7 console \xB7 a11y \xB7 screenshots \xB7 recording",node:"Node.js runtime \xB7 tracepoints \xB7 logpoints \xB7 exceptions \xB7 variables \xB7 logs",backend:"HTTP \xB7 gRPC \xB7 GraphQL \xB7 WebSocket \xB7 DB \xB7 logs"};async function _(i,e){if(e!==void 0)return e;if(!(0,f.isInteractive)())return;const o=(0,l.resolveInstallDefaultMode)(i),a=Math.max(0,l.ALL_MODES.indexOf(o)),r=l.ALL_MODES.map(d=>({label:l.MODE_LABELS[d],hint:l.MODE_HINTS[d]})),s=await(0,f.promptSelect)("Which verification mode?",r,a);return l.ALL_MODES[s]}u(_,"resolveModeSelection");function k(i,e){if(e===void 0)return;const a=(0,l.applyModeToLayer)(i,"project",e)?"":t.pc.dim(" (unchanged)");t.log.info(`Mode: ${t.pc.bold(l.MODE_LABELS[e])}${a}`)}u(k,"applyModeSelection");async function O(i,e,o){if(e!==void 0)return e;const a=(0,m.loadConfig)(i);if((o??(0,m.getVerificationMode)(a))==="monitor"||!(0,f.isInteractive)())return;const s=m.ALL_CYCLES.map(n=>({label:n,hint:D[n]})),d=m.ALL_CYCLES.map((n,g)=>(0,m.isCyclePatternsActive)(a,n)?g:-1).filter(n=>n>=0);return(await(0,f.promptMultiSelect)("Which platforms should require verification?",s,d)).map(n=>m.ALL_CYCLES[n])}u(O,"resolvePlatformSelection");function E(i,e){if(e===void 0)return;const o=(0,C.reconcileCyclesInLayer)(i,"project",e,!0),a=e.length>0?t.pc.bold(e.join(", ")):t.pc.dim("none (monitoring tools only)"),r=o.length>0?t.pc.dim(` \u2014 updated: ${o.join(", ")}`):"";t.log.info(`Platforms: ${a}${r}`)}u(E,"applyPlatformSelection");function H(i,e){return e!==void 0?(0,c.resolveTargetClients)(i.path,e):(0,c.detectClients)(i.path)}u(H,"clientsForBatchEntry");async function v(i){const e=(0,c.listActiveProjects)();if(e.length===0)return t.log.info("No registered projects to install. Run `ironbee install` somewhere first."),{failures:0,total:0};t.log.info(`Installing across ${t.pc.bold(String(e.length))} registered project(s)\u2026`),t.log.blank();let o=0;const a=[];for(const s of e)try{const d=H(s,i.client);if(d.length===0){t.log.warn(`Skipping ${s.path} \u2014 no resolvable clients`);continue}const h=d.map(n=>n.name);t.log.label("project",t.pc.dim(s.path)),t.log.step(`installing ${t.pc.bold(h.join(", "))}`),(0,M.prepareIronBeeDir)(s.path),k(s.path,i.mode),E(s.path,i.platforms);for(const n of d)n.install(s.path);(0,j.upsertProject)(s.path),a.push(...h)}catch(d){o++,t.log.error(`  ${s.path}: ${d instanceof Error?d.message:String(d)}`)}t.log.blank(),o===0?t.log.success(`Installed across ${e.length} project(s). ${t.pc.dim("Restart your AI coding client(s) to apply.")}`):t.log.warn(`Completed with ${o} failure(s) \u2014 see above.`);const r=Array.from(new Set(a));return r.length>0&&await(0,w.trackInstall)(r),{failures:o,total:e.length}}u(v,"runInstallAll");async function W(){try{if((0,p.isAutoRerenderDisabled)()||(0,p.readSyncedSchemaVersion)()>=S.INSTALL_SCHEMA_VERSION)return!1;const e=(0,c.listActiveProjects)();if(e.length===0)return(0,p.writeSyncedSchemaVersion)(S.INSTALL_SCHEMA_VERSION),!1;if(!(0,f.isInteractive)())return!1;t.log.blank(),t.log.warn(`IronBee's installed setup structure changed in this version \u2014 re-rendering ${t.pc.bold(String(e.length))} registered project(s):`);for(const o of e.slice(0,10))t.log.label("project",t.pc.dim(o.path));return e.length>10&&t.log.info(t.pc.dim(`  \u2026and ${e.length-10} more`)),await(0,f.promptAcknowledge)(t.pc.dim("  Press Enter to update them now\u2026 ")),await v({}),(0,p.writeSyncedSchemaVersion)(S.INSTALL_SCHEMA_VERSION),!0}catch(i){return t.log.blank(),t.log.warn(`IronBee schema sync skipped: ${i instanceof Error?i.message:String(i)}`),!1}}u(W,"syncSchemaIfChanged");const F=new $.Command("install").description("Install IronBee hooks and guidance files into a project. Use --all to install across every registered project (e.g. after a global config change).").argument("[project-dir]","target project directory",".").option("--client <name>",`client to install for (${(0,c.clientNames)()}), or "all"`).option("--all","Install across every project in the user-home inventory (~/.ironbee/projects.json) instead of just one. The [project-dir] argument is ignored when --all is set.").option("--platforms <list>",`comma-separated platforms to enable (${m.ALL_CYCLES.join(", ")}); skips the interactive picker. Empty ("") disables all. Default: interactive picker (pre-checked from current config), browser-only on a fresh non-interactive install.`).option("--mode <mode>",`verification mode (${l.ALL_MODES.join(", ")}); skips the interactive picker. enforce = full enforcement, assist = tools installed but not enforced (default), monitor = monitoring-only. Default: interactive picker (pre-selecting the current mode), untouched on a non-interactive install.`).action(async(i,e)=>{let o;if(e.platforms!==void 0)try{o=(0,C.parsePlatformsFlag)(e.platforms)}catch(n){t.log.error(n instanceof Error?n.message:String(n)),process.exit(1)}let a;if(e.mode!==void 0)try{a=(0,l.parseModeFlag)(e.mode)}catch(n){t.log.error(n instanceof Error?n.message:String(n)),process.exit(1)}if(e.all===!0){(await v({client:e.client,platforms:o,mode:a})).failures>0&&process.exit(1);return}const r=(0,x.resolve)(i);(0,P.existsSync)(r)||(t.log.error(`Directory not found: ${r}`),process.exit(1));let s;if(e.client!==void 0)try{s=(0,c.resolveTargetClients)(r,e.client)}catch(n){t.log.error(n instanceof Error?n.message:String(n)),process.exit(1)}else{const n=(0,c.detectClients)(r);if(n.length>0){s=n;const g=n.map(I=>I.name).join(", ");t.log.info(`Detected client(s): ${t.pc.bold(g)}`)}else if((0,f.isInteractive)()){const g=[...c.REGISTERED_CLIENTS.map(b=>b.name),"all"],I=g.map(b=>({label:b,hint:b==="all"?"every registered client":void 0}));t.log.warn(`No client detected in ${t.pc.dim(r)}.`);const L=await(0,f.promptSelect)("Which client(s) to install for?",I,0);s=(0,c.resolveTargetClients)(r,g[L])}else t.log.warn(`No client detected. Defaulting to: ${c.REGISTERED_CLIENTS[0].name}`),s=[c.REGISTERED_CLIENTS[0]]}const d=await _(r,a),h=await O(r,o,d);t.log.blank(),(0,M.prepareIronBeeDir)(r),k(r,d),E(r,h);for(const n of s)n.install(r);(0,j.upsertProject)(r),t.log.blank(),t.log.label("project",t.pc.dim(r)),t.log.blank(),t.log.success(`IronBee installed. ${t.pc.dim("Restart your AI coding client to activate the hooks.")}`),await(0,w.trackInstall)(s.map(n=>n.name),r)});0&&(module.exports={CYCLE_HINTS,installCommand,runInstallAll,syncSchemaIfChanged});
+"use strict";var S=Object.defineProperty;var N=Object.getOwnPropertyDescriptor;var A=Object.getOwnPropertyNames;var R=Object.prototype.hasOwnProperty;var g=(n,e)=>S(n,"name",{value:e,configurable:!0});var V=(n,e)=>{for(var r in e)S(n,r,{get:e[r],enumerable:!0})},_=(n,e,r,c)=>{if(e&&typeof e=="object"||typeof e=="function")for(let d of A(e))!R.call(n,d)&&d!==r&&S(n,d,{get:()=>e[d],enumerable:!(c=N(e,d))||c.enumerable});return n};var B=n=>_(S({},"__esModule",{value:!0}),n);var G={};V(G,{CYCLE_HINTS:()=>L,installCommand:()=>q,runInstallAll:()=>j,syncSchemaIfChanged:()=>F});module.exports=B(G);var P=require("commander"),T=require("fs"),D=require("path"),f=require("../clients/registry"),M=require("../clients/claude"),p=require("../lib/config"),t=require("../lib/output"),k=require("../lib/projects-registry"),m=require("../lib/prompt"),v=require("../lib/telemetry"),C=require("../lib/install-version"),h=require("../lib/schema-sync"),I=require("./cycle-toggle"),o=require("./mode-select");const L={browser:"web UI \xB7 DOM \xB7 console \xB7 a11y \xB7 screenshots \xB7 recording",node:"Node.js runtime \xB7 tracepoints \xB7 logpoints \xB7 exceptions \xB7 variables \xB7 logs",backend:"HTTP \xB7 gRPC \xB7 GraphQL \xB7 WebSocket \xB7 DB \xB7 logs"};async function O(n,e,r){if(e!==void 0)return r&&e!=="enforce"&&t.log.warn(`--strict ignored: it only applies to --mode enforce (strict is inert in ${e}).`),{mode:e,strict:e==="enforce"&&r?!0:void 0};if(r&&t.log.warn("--strict ignored: pass it together with --mode enforce."),!(0,m.isInteractive)())return;const c=Math.max(0,o.ALL_MODES.indexOf((0,o.resolveInstallDefaultMode)(n))),d=o.ALL_MODES.map(u=>({label:o.MODE_LABELS[u],hint:o.MODE_HINTS[u]})),i=(0,o.resolveInstallDefaultStrict)(n)?1:0,a=o.STRICT_OPTIONS.map(u=>({label:o.STRICT_LABELS[u?"true":"false"],hint:o.STRICT_HINTS[u?"true":"false"]}));for(;;){const u=await(0,m.promptSelect)("Which verification mode?",d,c),l=o.ALL_MODES[u];if(l!=="enforce")return{mode:l};const s=await(0,m.promptSelect)(`How strict should verification be?  (${t.pc.cyan("Esc")} = back)`,a,i,{allowBack:!0});if(s!==m.PROMPT_BACK)return{mode:l,strict:o.STRICT_OPTIONS[s]}}}g(O,"resolveModeSelection");function $(n,e){if(e===void 0)return;const{mode:r,strict:c}=e,i=(0,o.applyModeToLayer)(n,"project",r,c)?"":t.pc.dim(" (unchanged)"),a=r==="enforce"&&c!==void 0?t.pc.dim(` \xB7 ${o.STRICT_LABELS[c?"true":"false"]}`):"";t.log.info(`Mode: ${t.pc.bold(o.MODE_LABELS[r])}${a}${i}`)}g($,"applyModeSelection");async function H(n,e,r){if(e!==void 0)return e;const c=(0,p.loadConfig)(n);if((r??(0,p.getVerificationMode)(c))==="monitor"||!(0,m.isInteractive)())return;const i=p.ALL_CYCLES.map(l=>({label:l,hint:L[l]})),a=p.ALL_CYCLES.map((l,s)=>(0,p.isCyclePatternsActive)(c,l)?s:-1).filter(l=>l>=0);return(await(0,m.promptMultiSelect)("Which platforms should require verification?",i,a)).map(l=>p.ALL_CYCLES[l])}g(H,"resolvePlatformSelection");function E(n,e){if(e===void 0)return;const r=(0,I.reconcileCyclesInLayer)(n,"project",e,!0),c=e.length>0?t.pc.bold(e.join(", ")):t.pc.dim("none (monitoring tools only)"),d=r.length>0?t.pc.dim(` \u2014 updated: ${r.join(", ")}`):"";t.log.info(`Platforms: ${c}${d}`)}g(E,"applyPlatformSelection");function W(n,e){return e!==void 0?(0,f.resolveTargetClients)(n.path,e):(0,f.detectClients)(n.path)}g(W,"clientsForBatchEntry");async function j(n){const e=(0,f.listActiveProjects)();if(e.length===0)return t.log.info("No registered projects to install. Run `ironbee install` somewhere first."),{failures:0,total:0};t.log.info(`Installing across ${t.pc.bold(String(e.length))} registered project(s)\u2026`),t.log.blank();let r=0;const c=[];for(const i of e)try{const a=W(i,n.client);if(a.length===0){t.log.warn(`Skipping ${i.path} \u2014 no resolvable clients`);continue}const u=a.map(l=>l.name);t.log.label("project",t.pc.dim(i.path)),t.log.step(`installing ${t.pc.bold(u.join(", "))}`),(0,M.prepareIronBeeDir)(i.path),$(i.path,n.mode!==void 0?{mode:n.mode,strict:n.mode==="enforce"&&n.strict?!0:void 0}:void 0),E(i.path,n.platforms);for(const l of a)l.install(i.path);(0,k.upsertProject)(i.path),c.push(...u)}catch(a){r++,t.log.error(`  ${i.path}: ${a instanceof Error?a.message:String(a)}`)}t.log.blank(),r===0?t.log.success(`Installed across ${e.length} project(s). ${t.pc.dim("Restart your AI coding client(s) to apply.")}`):t.log.warn(`Completed with ${r} failure(s) \u2014 see above.`);const d=Array.from(new Set(c));return d.length>0&&await(0,v.trackInstall)(d),{failures:r,total:e.length}}g(j,"runInstallAll");async function F(){try{if((0,h.isAutoRerenderDisabled)()||(0,h.readSyncedSchemaVersion)()>=C.INSTALL_SCHEMA_VERSION)return!1;const e=(0,f.listActiveProjects)();if(e.length===0)return(0,h.writeSyncedSchemaVersion)(C.INSTALL_SCHEMA_VERSION),!1;if(!(0,m.isInteractive)())return!1;t.log.blank(),t.log.warn(`IronBee's installed setup structure changed in this version \u2014 re-rendering ${t.pc.bold(String(e.length))} registered project(s):`);for(const r of e.slice(0,10))t.log.label("project",t.pc.dim(r.path));return e.length>10&&t.log.info(t.pc.dim(`  \u2026and ${e.length-10} more`)),await(0,m.promptAcknowledge)(t.pc.dim("  Press Enter to update them now\u2026 ")),await j({}),(0,h.writeSyncedSchemaVersion)(C.INSTALL_SCHEMA_VERSION),!0}catch(n){return t.log.blank(),t.log.warn(`IronBee schema sync skipped: ${n instanceof Error?n.message:String(n)}`),!1}}g(F,"syncSchemaIfChanged");const q=new P.Command("install").description("Install IronBee hooks and guidance files into a project. Use --all to install across every registered project (e.g. after a global config change).").argument("[project-dir]","target project directory",".").option("--client <name>",`client to install for (${(0,f.clientNames)()}), or "all"`).option("--all","Install across every project in the user-home inventory (~/.ironbee/projects.json) instead of just one. The [project-dir] argument is ignored when --all is set.").option("--platforms <list>",`comma-separated platforms to enable (${p.ALL_CYCLES.join(", ")}); skips the interactive picker. Empty ("") disables all. Default: interactive picker (pre-checked from current config), browser-only on a fresh non-interactive install.`).option("--mode <mode>",`verification mode (${o.ALL_MODES.join(", ")}); skips the interactive picker. enforce = full enforcement, assist = tools installed but not enforced (default), monitor = monitoring-only. Default: interactive picker (pre-selecting the current mode), untouched on a non-interactive install.`).option("--strict","with --mode enforce: always make the agent actually try every change in the app \u2014 it can't skip any. Enforce-only (ignored for assist/monitor or with no --mode). Default: the agent may skip changes with nothing to try (refactors, type-only edits, docs). Interactively, picking enforce opens this as a sub-choice.").action(async(n,e)=>{let r;if(e.platforms!==void 0)try{r=(0,I.parsePlatformsFlag)(e.platforms)}catch(s){t.log.error(s instanceof Error?s.message:String(s)),process.exit(1)}let c;if(e.mode!==void 0)try{c=(0,o.parseModeFlag)(e.mode)}catch(s){t.log.error(s instanceof Error?s.message:String(s)),process.exit(1)}const d=e.strict===!0;if(e.all===!0){(await j({client:e.client,platforms:r,mode:c,strict:d})).failures>0&&process.exit(1);return}const i=(0,D.resolve)(n);(0,T.existsSync)(i)||(t.log.error(`Directory not found: ${i}`),process.exit(1));let a;if(e.client!==void 0)try{a=(0,f.resolveTargetClients)(i,e.client)}catch(s){t.log.error(s instanceof Error?s.message:String(s)),process.exit(1)}else{const s=(0,f.detectClients)(i);if(s.length>0){a=s;const b=s.map(w=>w.name).join(", ");t.log.info(`Detected client(s): ${t.pc.bold(b)}`)}else if((0,m.isInteractive)()){const b=[...f.REGISTERED_CLIENTS.map(y=>y.name),"all"],w=b.map(y=>({label:y,hint:y==="all"?"every registered client":void 0}));t.log.warn(`No client detected in ${t.pc.dim(i)}.`);const x=await(0,m.promptSelect)("Which client(s) to install for?",w,0);a=(0,f.resolveTargetClients)(i,b[x])}else t.log.warn(`No client detected. Defaulting to: ${f.REGISTERED_CLIENTS[0].name}`),a=[f.REGISTERED_CLIENTS[0]]}const u=await O(i,c,d),l=await H(i,r,u?.mode);t.log.blank(),(0,M.prepareIronBeeDir)(i),$(i,u),E(i,l);for(const s of a)s.install(i);(0,k.upsertProject)(i),t.log.blank(),t.log.label("project",t.pc.dim(i)),t.log.blank(),t.log.success(`IronBee installed. ${t.pc.dim("Restart your AI coding client to activate the hooks.")}`),await(0,v.trackInstall)(a.map(s=>s.name),i)});0&&(module.exports={CYCLE_HINTS,installCommand,runInstallAll,syncSchemaIfChanged});

package/dist/commands/mode-select.js

@@ -1,2 +1,2 @@
-"use strict";var f=Object.defineProperty;var m=Object.getOwnPropertyDescriptor;var p=Object.getOwnPropertyNames;var V=Object.prototype.hasOwnProperty;var t=(o,e)=>f(o,"name",{value:e,configurable:!0});var v=(o,e)=>{for(var n in e)f(o,n,{get:e[n],enumerable:!0})},M=(o,e,n,a)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of p(e))!V.call(o,i)&&i!==n&&f(o,i,{get:()=>e[i],enumerable:!(a=m(e,i))||a.enumerable});return o};var w=o=>M(f({},"__esModule",{value:!0}),o);var E={};v(E,{ALL_MODES:()=>g,MODE_HINTS:()=>C,MODE_LABELS:()=>L,applyModeToLayer:()=>O,buildVerificationBlockForMode:()=>y,parseModeFlag:()=>S,resolveInstallDefaultMode:()=>x});module.exports=w(E);var r=require("fs"),u=require("path"),c=require("../lib/config"),d=require("../lib/logger");const g=["enforce","assist","monitor"],L={enforce:"auto verify (enforce)",assist:"assist",monitor:"monitor only"},C={enforce:"block task completion until changes are verified \u2014 full enforcement",assist:"tools installed but not enforced \u2014 the agent verifies manually via /ironbee-verify (default)",monitor:"no enforcement \u2014 only track sessions / activity / tools for analytics"};function S(o){const e=o.trim().toLowerCase();if(e==="enforce"||e==="assist"||e==="monitor")return e;throw new Error(`Unknown mode '${o}'. Available: ${g.join(", ")}.`)}t(S,"parseModeFlag");function s(o){if(!(0,r.existsSync)(o))return{};try{return JSON.parse((0,r.readFileSync)(o,"utf-8"))}catch(e){throw d.logger.debug(`failed to read ${o}: ${e}`),new Error(`Config at ${o} is not valid JSON: ${e instanceof Error?e.message:e}`)}}t(s,"readLayerConfig");function B(o,e){(0,r.mkdirSync)((0,u.join)(o,".."),{recursive:!0}),(0,r.writeFileSync)(o,JSON.stringify(e,null,2)+`
-`)}t(B,"writeLayerConfig");function l(o){const e=o.verification;if(e&&typeof e=="object"&&!Array.isArray(e))return e}t(l,"readVerificationBlock");function x(o){let e,n;for(const a of["project","local"]){const i=l(s((0,c.getTargetConfigPath)(a,o)));i!==void 0&&(typeof i.enable=="boolean"&&(e=i.enable),typeof i.auto=="boolean"&&(n=i.auto))}return e===!1?"monitor":n===!0?"enforce":"assist"}t(x,"resolveInstallDefaultMode");function y(o,e){const n={...o??{}};switch(e){case"enforce":n.enable=!0,n.auto=!0,n.strict=n.strict??!1;break;case"assist":n.enable=!0,n.auto=!1,n.strict=n.strict??!1;break;case"monitor":n.enable=!1,delete n.auto,delete n.strict;break}return n}t(y,"buildVerificationBlockForMode");function O(o,e,n){const a=(0,c.getTargetConfigPath)(e,o),i=s(a),b=JSON.stringify(i.verification??null);i.verification=y(l(i),n);const k=JSON.stringify(i.verification);return b===k?!1:(B(a,i),!0)}t(O,"applyModeToLayer");0&&(module.exports={ALL_MODES,MODE_HINTS,MODE_LABELS,applyModeToLayer,buildVerificationBlockForMode,parseModeFlag,resolveInstallDefaultMode});
+"use strict";var s=Object.defineProperty;var m=Object.getOwnPropertyDescriptor;var S=Object.getOwnPropertyNames;var V=Object.prototype.hasOwnProperty;var r=(o,e)=>s(o,"name",{value:e,configurable:!0});var v=(o,e)=>{for(var t in e)s(o,t,{get:e[t],enumerable:!0})},w=(o,e,t,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of S(e))!V.call(o,i)&&i!==t&&s(o,i,{get:()=>e[i],enumerable:!(n=m(e,i))||n.enumerable});return o};var C=o=>w(s({},"__esModule",{value:!0}),o);var R={};v(R,{ALL_MODES:()=>y,MODE_HINTS:()=>h,MODE_LABELS:()=>L,STRICT_HINTS:()=>T,STRICT_LABELS:()=>B,STRICT_OPTIONS:()=>M,applyModeToLayer:()=>N,buildVerificationBlockForMode:()=>b,parseModeFlag:()=>x,resolveInstallDefaultMode:()=>E,resolveInstallDefaultStrict:()=>I});module.exports=C(R);var a=require("fs"),d=require("path"),f=require("../lib/config"),g=require("../lib/logger");const y=["enforce","assist","monitor"],L={enforce:"auto verify (enforce)",assist:"assist",monitor:"monitor only"},h={enforce:"block task completion until changes are verified \u2014 full enforcement",assist:"tools installed but not enforced \u2014 the agent verifies manually via /ironbee-verify (default)",monitor:"no enforcement \u2014 only track sessions / activity / tools for analytics"},M=[!1,!0],B={false:"non-strict",true:"strict"},T={false:"the agent can skip checking changes with nothing to try in the app \u2014 e.g. refactors, type-only edits, docs (recommended)",true:"always make the agent actually try the change in the app \u2014 it can't skip any change"};function x(o){const e=o.trim().toLowerCase();if(e==="enforce"||e==="assist"||e==="monitor")return e;throw new Error(`Unknown mode '${o}'. Available: ${y.join(", ")}.`)}r(x,"parseModeFlag");function l(o){if(!(0,a.existsSync)(o))return{};try{return JSON.parse((0,a.readFileSync)(o,"utf-8"))}catch(e){throw g.logger.debug(`failed to read ${o}: ${e}`),new Error(`Config at ${o} is not valid JSON: ${e instanceof Error?e.message:e}`)}}r(l,"readLayerConfig");function O(o,e){(0,a.mkdirSync)((0,d.join)(o,".."),{recursive:!0}),(0,a.writeFileSync)(o,JSON.stringify(e,null,2)+`
+`)}r(O,"writeLayerConfig");function u(o){const e=o.verification;if(e&&typeof e=="object"&&!Array.isArray(e))return e}r(u,"readVerificationBlock");function E(o){let e,t;for(const n of["project","local"]){const i=u(l((0,f.getTargetConfigPath)(n,o)));i!==void 0&&(typeof i.enable=="boolean"&&(e=i.enable),typeof i.auto=="boolean"&&(t=i.auto))}return e===!1?"monitor":t===!0?"enforce":"assist"}r(E,"resolveInstallDefaultMode");function I(o){let e;for(const t of["project","local"]){const n=u(l((0,f.getTargetConfigPath)(t,o)));n!==void 0&&typeof n.strict=="boolean"&&(e=n.strict)}return e===!0}r(I,"resolveInstallDefaultStrict");function b(o,e,t){const n={...o??{}};switch(e){case"enforce":n.enable=!0,n.auto=!0,n.strict=t!==void 0?t:n.strict??!1;break;case"assist":n.enable=!0,n.auto=!1,n.strict=n.strict??!1;break;case"monitor":n.enable=!1,delete n.auto,delete n.strict;break}return n}r(b,"buildVerificationBlockForMode");function N(o,e,t,n){const i=(0,f.getTargetConfigPath)(e,o),c=l(i),p=JSON.stringify(c.verification??null);c.verification=b(u(c),t,n);const k=JSON.stringify(c.verification);return p===k?!1:(O(i,c),!0)}r(N,"applyModeToLayer");0&&(module.exports={ALL_MODES,MODE_HINTS,MODE_LABELS,STRICT_HINTS,STRICT_LABELS,STRICT_OPTIONS,applyModeToLayer,buildVerificationBlockForMode,parseModeFlag,resolveInstallDefaultMode,resolveInstallDefaultStrict});

package/dist/commands/scenario.js

@@ -0,0 +1 @@
+"use strict";var S=Object.create;var g=Object.defineProperty;var C=Object.getOwnPropertyDescriptor;var $=Object.getOwnPropertyNames;var y=Object.getPrototypeOf,j=Object.prototype.hasOwnProperty;var h=(e,t)=>g(e,"name",{value:t,configurable:!0});var R=(e,t)=>{for(var r in t)g(e,r,{get:t[r],enumerable:!0})},p=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let i of $(t))!j.call(e,i)&&i!==r&&g(e,i,{get:()=>t[i],enumerable:!(s=C(t,i))||s.enumerable});return e};var N=(e,t,r)=>(r=e!=null?S(y(e)):{},p(t||!e||!e.__esModule?g(r,"default",{value:e,enumerable:!0}):r,e)),O=e=>p(g({},"__esModule",{value:!0}),e);var x={};R(x,{scenarioCommand:()=>m});module.exports=O(x);var b=require("commander"),u=require("path"),n=N(require("picocolors")),d=require("../lib/scenario-staleness"),w=require("../lib/git"),c=require("../lib/config");function F(e){return e==="fresh"?n.default.green("fresh  "):e==="stale"?n.default.yellow("stale  "):n.default.dim("unknown")}h(F,"stateLabel");function k(e){const t=(0,u.resolve)(e.project??process.cwd()),r=(0,d.checkScenarioFreshness)(t);if(e.json===!0){const o=e.stale===!0?r.filter(l=>l.state==="stale"):r;console.log(JSON.stringify(o,null,2)),e.stale===!0&&o.length>0&&(process.exitCode=1);return}if(r.length===0){console.log(n.default.dim("No saved scenarios found (.ironbee/scenarios/)."));return}const s=r.filter(o=>o.state==="stale");if(e.stale===!0){if(s.length===0){console.log(n.default.green("\u2713 No stale scenarios."));return}for(const o of s)v(o);console.log(""),console.log(n.default.yellow(`${s.length} stale scenario(s) \u2014 re-validate with /ironbee-sync-scenario or /ironbee-verify scenario:<name>.`)),process.exitCode=1;return}for(const o of r)v(o);const i=r.filter(o=>o.state==="fresh").length,f=r.filter(o=>o.state==="unknown").length;console.log(""),console.log(`${r.length} scenario(s): ${n.default.green(`${i} fresh`)}, ${n.default.yellow(`${s.length} stale`)}, ${n.default.dim(`${f} unknown`)}.`),s.length>0&&console.log(n.default.dim("Re-validate stale ones with /ironbee-sync-scenario or /ironbee-verify scenario:<name>."))}h(k,"runStatus");function v(e){if(console.log(`${F(e.state)}  ${n.default.bold(e.name)} ${n.default.dim(`[${e.platform}]`)} \u2014 ${e.reason}`),e.changedCoveredPaths.length>0){const t=e.changedCoveredPaths.slice(0,5);for(const r of t)console.log(`           ${n.default.dim("\xB7")} ${r}`);e.changedCoveredPaths.length>t.length&&console.log(`           ${n.default.dim(`\xB7 +${e.changedCoveredPaths.length-t.length} more`)}`)}}h(v,"printRow");function D(e){const t=(0,u.resolve)(e.project??process.cwd()),r=(0,c.loadConfig)(t);let s=(0,c.getVerificationContextCommitDepth)(r);if(e.commitDepth!==void 0){const a=Number.parseInt(e.commitDepth,10);Number.isFinite(a)&&a>=0&&(s=a)}const i=(0,w.getChangedPathsRelative)(t,s);if(i===null){if(e.json===!0){console.log(JSON.stringify({available:!1,reason:"not a git repository",scenarioCount:0,covered:[],gaps:[],changed:[]},null,2));return}console.log(n.default.dim("Not a git repository \u2014 cannot compute the changed set."));return}const f=i.filter(a=>(0,c.requiresVerification)(a,r)),o=(0,d.coverageGaps)(t,f);if(e.json===!0){console.log(JSON.stringify(o,null,2));return}if(o.changed.length===0){console.log(n.default.dim("No verification-relevant changed files in the current window (working tree + recent commits)."));return}if(o.scenarioCount===0){console.log(n.default.yellow(`No saved scenarios \u2014 all ${o.changed.length} verification-relevant changed file(s) are uncovered.`)),console.log(n.default.dim("Author one with /ironbee-manage-scenario."));return}if(o.gaps.length===0){console.log(n.default.green(`\u2713 All ${o.changed.length} verification-relevant changed file(s) are covered by a saved scenario.`));return}console.log(n.default.yellow(`${o.gaps.length} of ${o.changed.length} verification-relevant changed file(s) covered by NO scenario:`));const l=o.gaps.slice(0,30);for(const a of l)console.log(`  ${n.default.dim("\xB7")} ${a}`);o.gaps.length>l.length&&console.log(`  ${n.default.dim(`\xB7 +${o.gaps.length-l.length} more`)}`),console.log(""),console.log(n.default.dim("Author a scenario for an uncovered area with /ironbee-manage-scenario. (Advisory \u2014 coveredPaths is author-declared, so a gap can be a false positive.)"))}h(D,"runCoverage");const m=new b.Command("scenario").description("Inspect saved verification scenarios (.ironbee/scenarios/)");m.command("status").description("Show freshness (fresh / stale / unknown) of saved scenarios vs the current code").option("-p, --project <dir>","project directory (default: cwd)").option("--stale","show only stale scenarios; exit non-zero when any exist (CI gate)").option("--json","machine-readable JSON output").action(e=>{k(e)}),m.command("coverage").description("Show changed files (working tree + recent commits) covered by NO saved scenario (the inverse of status)").option("-p, --project <dir>","project directory (default: cwd)").option("--commit-depth <n>","commits back to include beyond the working tree (default: verificationContext.commitDepth)").option("--json","machine-readable JSON output").action(e=>{D(e)});0&&(module.exports={scenarioCommand});