@jeger-ai/opengantry 1.0.0

package/dist/cli/lib/break-glass.js

@@ -0,0 +1,134 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { CLI_NAME } from "./constants.js";
+import { gitHead, gitRevParse, gitRun } from "./git-repo.js";
+export const ENV_BYPASS_SECRET = "GXT_BYPASS_SECRET";
+export const REL_BYPASS_SHA256 = ".gitagent/foreman/BYPASS.sha256";
+export const GXT_BYPASS_NOTES_REF = "refs/notes/gxt-bypass";
+const MIN_REASON_LENGTH = 10;
+function sha256Hex(value) {
+    return crypto.createHash("sha256").update(value, "utf8").digest("hex");
+}
+function timingSafeEqualHex(a, b) {
+    const aBuf = Buffer.from(a, "utf8");
+    const bBuf = Buffer.from(b, "utf8");
+    if (aBuf.length !== bBuf.length)
+        return false;
+    return crypto.timingSafeEqual(aBuf, bBuf);
+}
+function readAnchorHash(repoRoot) {
+    const anchorPath = path.join(repoRoot, REL_BYPASS_SHA256);
+    if (!fs.existsSync(anchorPath))
+        return null;
+    for (const line of fs.readFileSync(anchorPath, "utf8").split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        if (/^[a-f0-9]{64}$/i.test(trimmed))
+            return trimmed.toLowerCase();
+    }
+    return null;
+}
+/** True when GXT_BYPASS_SECRET matches committed BYPASS.sha256 anchor. */
+export function isBypassSecretAuthorized(repoRoot) {
+    const secret = process.env[ENV_BYPASS_SECRET];
+    if (!secret?.length)
+        return false;
+    const anchor = readAnchorHash(repoRoot);
+    if (!anchor)
+        return false;
+    return timingSafeEqualHex(sha256Hex(secret), anchor);
+}
+export function assertBypassSecretAuthorized(repoRoot) {
+    if (isBypassSecretAuthorized(repoRoot))
+        return;
+    const anchorPath = path.join(repoRoot, REL_BYPASS_SHA256);
+    if (!fs.existsSync(anchorPath)) {
+        throw new Error(`${CLI_NAME}: break-glass: BYPASS_NOT_CONFIGURED — ${REL_BYPASS_SHA256} is missing. Teacher must install a SHA-256 anchor of the team secret.`);
+    }
+    if (!process.env[ENV_BYPASS_SECRET]?.length) {
+        throw new Error(`${CLI_NAME}: break-glass: BYPASS_SECRET_MISSING — Set ${ENV_BYPASS_SECRET} in the execution environment.`);
+    }
+    throw new Error(`${CLI_NAME}: break-glass: BYPASS_SECRET_INVALID — ${ENV_BYPASS_SECRET} does not match ${REL_BYPASS_SHA256}.`);
+}
+export function validateBreakGlassReason(reason) {
+    const trimmed = reason?.trim() ?? "";
+    if (trimmed.length < MIN_REASON_LENGTH) {
+        throw new Error(`${CLI_NAME}: break-glass: REASON_REQUIRED — Provide --reason with at least ${String(MIN_REASON_LENGTH)} characters.`);
+    }
+    return trimmed;
+}
+export function parseBypassNoteBody(noteBody) {
+    const trimmed = noteBody.trim();
+    if (!trimmed)
+        return null;
+    try {
+        const parsed = JSON.parse(trimmed);
+        if (parsed.v !== 1)
+            return null;
+        if (typeof parsed.reason !== "string" || parsed.reason.trim().length < MIN_REASON_LENGTH) {
+            return null;
+        }
+        return {
+            v: 1,
+            reason: parsed.reason.trim(),
+            ts: typeof parsed.ts === "string" ? parsed.ts : "",
+            msn_id: typeof parsed.msn_id === "string" ? parsed.msn_id : undefined,
+            mission_file: typeof parsed.mission_file === "string" ? parsed.mission_file : undefined,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function commitHasValidBypassNote(root, commit) {
+    const r = gitRun(root, ["notes", `--ref=${GXT_BYPASS_NOTES_REF}`, "show", commit]);
+    if (!r.ok)
+        return false;
+    return parseBypassNoteBody(r.stdout) !== null;
+}
+export function writeBypassGitNote(root, commit, payload) {
+    const message = JSON.stringify(payload);
+    const r = gitRun(root, ["notes", `--ref=${GXT_BYPASS_NOTES_REF}`, "add", "-f", "-m", message, commit]);
+    if (!r.ok) {
+        throw new Error(`${CLI_NAME}: break-glass: git notes add failed: ${r.stderr.trim() || "unknown"}`);
+    }
+}
+function resolveAuditCommit(root, commit) {
+    if (commit?.trim()) {
+        const sha = gitRevParse(root, commit);
+        if (!sha) {
+            throw new Error(`${CLI_NAME}: break-glass: invalid --commit ${commit}`);
+        }
+        return sha;
+    }
+    const sha = gitHead(root);
+    if (!sha) {
+        throw new Error(`${CLI_NAME}: break-glass: cannot resolve HEAD`);
+    }
+    return sha;
+}
+export function runBreakGlassAudit(root, options) {
+    const commitSha = resolveAuditCommit(root, options.commit);
+    const payload = {
+        v: 1,
+        reason: options.reason,
+        ts: new Date().toISOString(),
+        ...(options.msnId ? { msn_id: options.msnId } : {}),
+        ...(options.missionFile ? { mission_file: options.missionFile } : {}),
+    };
+    if (options.auditCommit === true) {
+        const subjectReason = options.reason.length > 72 ? `${options.reason.slice(0, 69)}...` : options.reason;
+        const subject = `[GXT-AUDIT] break-glass: ${subjectReason}`;
+        const body = JSON.stringify(payload, null, 2);
+        const r = gitRun(root, ["commit", "--allow-empty", "-m", subject, "-m", body]);
+        if (!r.ok) {
+            throw new Error(`${CLI_NAME}: break-glass: audit commit failed: ${r.stderr.trim() || "unknown"}`);
+        }
+        return gitHead(root) ?? commitSha;
+    }
+    writeBypassGitNote(root, commitSha, payload);
+    return commitSha;
+}
+//# sourceMappingURL=break-glass.js.map

package/dist/cli/lib/break-glass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"break-glass.js","sourceRoot":"","sources":["../../../src/cli/lib/break-glass.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AACrD,MAAM,CAAC,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAU7B,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAC1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,QAAgB;IAC3D,IAAI,wBAAwB,CAAC,QAAQ,CAAC;QAAE,OAAO;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAC1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,0CAA0C,iBAAiB,wEAAwE,CAC/I,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,8CAA8C,iBAAiB,gCAAgC,CAC3G,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,0CAA0C,iBAAiB,mBAAmB,iBAAiB,GAAG,CAC9G,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAA0B;IACjE,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,mEAAmE,MAAM,CAAC,iBAAiB,CAAC,cAAc,CACtH,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgC,CAAC;QAClE,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YACzF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,CAAC,EAAE,CAAC;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YAC5B,EAAE,EAAE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;YAClD,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACrE,YAAY,EAAE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;SACxF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,MAAc;IACnE,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,MAAc,EACd,OAA2B;IAE3B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACvG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,wCAAwC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,MAAe;IACvD,IAAI,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,mCAAmC,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,oCAAoC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,OAMC;IAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAuB;QAClC,CAAC,EAAE,CAAC;QACJ,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,aAAa,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACpF,MAAM,OAAO,GAAG,4BAA4B,aAAa,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,uCAAuC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACpC,CAAC;IAED,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/cli/lib/cli-io.d.ts

@@ -0,0 +1,9 @@
+export declare function logInfo(message: string): void;
+export declare function logWarn(message: string): void;
+export declare function logError(message: string): void;
+/** Red stderr for existing managed-asset conflicts (respects NO_COLOR). */
+export declare function logManagedAssetConflicts(conflicts: string[]): void;
+/** Relative path for user-facing messages */
+export declare function formatRepoRelative(repoRoot: string, absolutePath: string): string;
+export declare function setExitCode(code: number): void;
+//# sourceMappingURL=cli-io.d.ts.map

package/dist/cli/lib/cli-io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-io.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/cli-io.ts"],"names":[],"mappings":"AAIA,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAG7C;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAG7C;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAG9C;AAED,2EAA2E;AAC3E,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAWlE;AAED,6CAA6C;AAC7C,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAE9C"}

package/dist/cli/lib/cli-io.js

@@ -0,0 +1,38 @@
+import path from "node:path";
+import { CLI_NAME } from "./constants.js";
+import { shouldEmitError, shouldEmitInfo, shouldEmitWarn } from "./output-context.js";
+export function logInfo(message) {
+    if (!shouldEmitInfo())
+        return;
+    console.log(message);
+}
+export function logWarn(message) {
+    if (!shouldEmitWarn())
+        return;
+    console.error(`${CLI_NAME}: warning: ${message}`);
+}
+export function logError(message) {
+    if (!shouldEmitError(message))
+        return;
+    console.error(`${CLI_NAME}: ${message}`);
+}
+/** Red stderr for existing managed-asset conflicts (respects NO_COLOR). */
+export function logManagedAssetConflicts(conflicts) {
+    if (!shouldEmitWarn())
+        return;
+    const useColor = process.env.NO_COLOR === undefined;
+    const red = useColor ? "\x1b[31m" : "";
+    const reset = useColor ? "\x1b[0m" : "";
+    console.error(`${red}${CLI_NAME}: warning: managed files already exist and differ from templates:${reset}`);
+    for (const rel of conflicts) {
+        console.error(`${red}  - ${rel}${reset}`);
+    }
+}
+/** Relative path for user-facing messages */
+export function formatRepoRelative(repoRoot, absolutePath) {
+    return path.relative(repoRoot, absolutePath);
+}
+export function setExitCode(code) {
+    process.exitCode = code;
+}
+//# sourceMappingURL=cli-io.js.map

package/dist/cli/lib/cli-io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-io.js","sourceRoot":"","sources":["../../../src/cli/lib/cli-io.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEtF,MAAM,UAAU,OAAO,CAAC,OAAe;IACrC,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO;IAC9B,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAe;IACrC,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO;IAC9B,OAAO,CAAC,KAAK,CAAC,GAAG,QAAQ,cAAc,OAAO,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;QAAE,OAAO;IACtC,OAAO,CAAC,KAAK,CAAC,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB,CAAC,SAAmB;IAC1D,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC;IACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,OAAO,CAAC,KAAK,CACX,GAAG,GAAG,GAAG,QAAQ,oEAAoE,KAAK,EAAE,CAC7F,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,OAAO,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,YAAoB;IACvE,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC"}

package/dist/cli/lib/cli-timeout.d.ts

@@ -0,0 +1,9 @@
+/** Strict `--timeout-ms` parsing for CLI boundary (reject NaN/non-integer junk). */
+export declare function parseOptionalTimeoutMs(raw: string | undefined): {
+    ok: true;
+    ms: number | undefined;
+} | {
+    ok: false;
+    message: string;
+};
+//# sourceMappingURL=cli-timeout.d.ts.map

package/dist/cli/lib/cli-timeout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-timeout.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/cli-timeout.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAYvE"}

package/dist/cli/lib/cli-timeout.js

@@ -0,0 +1,17 @@
+/** Strict `--timeout-ms` parsing for CLI boundary (reject NaN/non-integer junk). */
+export function parseOptionalTimeoutMs(raw) {
+    if (raw === undefined)
+        return { ok: true, ms: undefined };
+    const t = raw.trim();
+    if (t === "")
+        return { ok: true, ms: undefined };
+    if (!/^\d+$/.test(t)) {
+        return {
+            ok: false,
+            message: "gapman: runtime exec: --timeout-ms must be a non-negative integer",
+        };
+    }
+    const n = Number.parseInt(t, 10);
+    return { ok: true, ms: Number.isFinite(n) ? n : undefined };
+}
+//# sourceMappingURL=cli-timeout.js.map

package/dist/cli/lib/cli-timeout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-timeout.js","sourceRoot":"","sources":["../../../src/cli/lib/cli-timeout.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CACpC,GAAuB;IAEvB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IAC1D,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,mEAAmE;SAC7E,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC"}

package/dist/cli/lib/constants.d.ts

@@ -0,0 +1,26 @@
+/** Repo-relative paths used across gapman */
+export declare const REL_MANIFEST: ".gitagent/foreman/MANIFEST.json";
+/** Agent discovery for code layout (file, directory, or external). */
+export declare const REL_ARCHITECTURE_POINTER: ".gitagent/ARCHITECTURE.pointer.json";
+/** Agent instructions when architecture access requires authentication. */
+export declare const REL_ARCHITECTURE_ACCESS_SKILL: ".gitagent/teacher/ARCHITECTURE-ACCESS.md";
+/** Agent instructions when architecture is unset, stub, or uncertain — ask before implementing. */
+export declare const REL_ARCHITECTURE_DISCOVERY_SKILL: ".gitagent/teacher/ARCHITECTURE-DISCOVERY.md";
+/** Git-ignored credential slots for architecture sources (see gapman arch cred). */
+export declare const REL_ARCHITECTURE_CREDENTIALS_DIR: ".gitagent/history/credentials";
+export declare const REL_MISSION_SCHEMA: ".gitagent/teacher/MISSION.schema.yaml";
+export declare const REL_MISSION_TEMPLATE: ".gitagent/teacher/MISSION.template.md";
+export declare const REL_HISTORY_DIR: ".gitagent/history";
+/** Git-ignored machine-readable runtime error (see templates/.gitignore.gxt). */
+export declare const REL_AGENT_ERROR_FILE: ".gitagent/history/.ignored-last-error.json";
+/** ADR markdown (optional `match_terms` in frontmatter) — Foreman may emit non-binding hints only. */
+export declare const REL_OUT_OF_SCOPE_DIR: ".gitagent/out-of-scope";
+export declare const SKILLS_DIR_NAME: "skills";
+export declare const WORKER_LOG_FILENAME: "WORKER_LOG.md";
+/** Default path for `--emit-mission` (must stay under `.gitagent/missions/` for `gapman verify` git-proof). */
+export declare const DEFAULT_ACTIVE_MISSION: ".gitagent/missions/ACTIVE_MISSION.md";
+/** Mission id in commits / missions (four digits) */
+export declare const MSN_ID_PATTERN: RegExp;
+export declare const CLI_NAME = "gapman";
+export { CLI_VERSION, NPM_PACKAGE_NAME } from "./version.gen.js";
+//# sourceMappingURL=constants.d.ts.map

package/dist/cli/lib/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/constants.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,eAAO,MAAM,YAAY,EAAG,iCAA0C,CAAC;AACvE,sEAAsE;AACtE,eAAO,MAAM,wBAAwB,EAAG,qCAA8C,CAAC;AACvF,2EAA2E;AAC3E,eAAO,MAAM,6BAA6B,EAAG,0CAAmD,CAAC;AACjG,mGAAmG;AACnG,eAAO,MAAM,gCAAgC,EAAG,6CAAsD,CAAC;AACvG,oFAAoF;AACpF,eAAO,MAAM,gCAAgC,EAAG,+BAAwC,CAAC;AACzF,eAAO,MAAM,kBAAkB,EAAG,uCAAgD,CAAC;AACnF,eAAO,MAAM,oBAAoB,EAAG,uCAAgD,CAAC;AACrF,eAAO,MAAM,eAAe,EAAG,mBAA4B,CAAC;AAC5D,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,EAAG,4CAAqD,CAAC;AAC1F,sGAAsG;AACtG,eAAO,MAAM,oBAAoB,EAAG,wBAAiC,CAAC;AACtE,eAAO,MAAM,eAAe,EAAG,QAAiB,CAAC;AACjD,eAAO,MAAM,mBAAmB,EAAG,eAAwB,CAAC;AAC5D,+GAA+G;AAC/G,eAAO,MAAM,sBAAsB,EAAG,sCAA+C,CAAC;AAEtF,qDAAqD;AACrD,eAAO,MAAM,cAAc,QAAgB,CAAC;AAE5C,eAAO,MAAM,QAAQ,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/cli/lib/constants.js

@@ -0,0 +1,26 @@
+/** Repo-relative paths used across gapman */
+export const REL_MANIFEST = ".gitagent/foreman/MANIFEST.json";
+/** Agent discovery for code layout (file, directory, or external). */
+export const REL_ARCHITECTURE_POINTER = ".gitagent/ARCHITECTURE.pointer.json";
+/** Agent instructions when architecture access requires authentication. */
+export const REL_ARCHITECTURE_ACCESS_SKILL = ".gitagent/teacher/ARCHITECTURE-ACCESS.md";
+/** Agent instructions when architecture is unset, stub, or uncertain — ask before implementing. */
+export const REL_ARCHITECTURE_DISCOVERY_SKILL = ".gitagent/teacher/ARCHITECTURE-DISCOVERY.md";
+/** Git-ignored credential slots for architecture sources (see gapman arch cred). */
+export const REL_ARCHITECTURE_CREDENTIALS_DIR = ".gitagent/history/credentials";
+export const REL_MISSION_SCHEMA = ".gitagent/teacher/MISSION.schema.yaml";
+export const REL_MISSION_TEMPLATE = ".gitagent/teacher/MISSION.template.md";
+export const REL_HISTORY_DIR = ".gitagent/history";
+/** Git-ignored machine-readable runtime error (see templates/.gitignore.gxt). */
+export const REL_AGENT_ERROR_FILE = ".gitagent/history/.ignored-last-error.json";
+/** ADR markdown (optional `match_terms` in frontmatter) — Foreman may emit non-binding hints only. */
+export const REL_OUT_OF_SCOPE_DIR = ".gitagent/out-of-scope";
+export const SKILLS_DIR_NAME = "skills";
+export const WORKER_LOG_FILENAME = "WORKER_LOG.md";
+/** Default path for `--emit-mission` (must stay under `.gitagent/missions/` for `gapman verify` git-proof). */
+export const DEFAULT_ACTIVE_MISSION = ".gitagent/missions/ACTIVE_MISSION.md";
+/** Mission id in commits / missions (four digits) */
+export const MSN_ID_PATTERN = /^MSN-\d{4}$/;
+export const CLI_NAME = "gapman";
+export { CLI_VERSION, NPM_PACKAGE_NAME } from "./version.gen.js";
+//# sourceMappingURL=constants.js.map

package/dist/cli/lib/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/cli/lib/constants.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,iCAA0C,CAAC;AACvE,sEAAsE;AACtE,MAAM,CAAC,MAAM,wBAAwB,GAAG,qCAA8C,CAAC;AACvF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,6BAA6B,GAAG,0CAAmD,CAAC;AACjG,mGAAmG;AACnG,MAAM,CAAC,MAAM,gCAAgC,GAAG,6CAAsD,CAAC;AACvG,oFAAoF;AACpF,MAAM,CAAC,MAAM,gCAAgC,GAAG,+BAAwC,CAAC;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,uCAAgD,CAAC;AACnF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uCAAgD,CAAC;AACrF,MAAM,CAAC,MAAM,eAAe,GAAG,mBAA4B,CAAC;AAC5D,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,4CAAqD,CAAC;AAC1F,sGAAsG;AACtG,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAiC,CAAC;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAiB,CAAC;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAwB,CAAC;AAC5D,+GAA+G;AAC/G,MAAM,CAAC,MAAM,sBAAsB,GAAG,sCAA+C,CAAC;AAEtF,qDAAqD;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC;AAE5C,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/cli/lib/dirty-missions.d.ts

@@ -0,0 +1,8 @@
+/** True for YAML/Markdown mission work orders under `.gitagent/missions/` (excludes README). */
+export declare function isVerifiableMissionPath(rel: string): boolean;
+/** Resolve merge-base for branch-scoped mission diff (pre-push). */
+export declare function resolveMergeBase(root: string): string | null;
+/** Repo-relative mission paths changed between base and HEAD. */
+export declare function listDirtyMissionPaths(repoRoot: string, baseRef?: string): string[];
+export declare function listDirtyMissionPathsAbsolute(repoRoot: string, baseRef?: string): string[];
+//# sourceMappingURL=dirty-missions.d.ts.map

package/dist/cli/lib/dirty-missions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dirty-missions.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/dirty-missions.ts"],"names":[],"mappings":"AAQA,gGAAgG;AAChG,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAO5D;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkB5D;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAoBlF;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAI1F"}

package/dist/cli/lib/dirty-missions.js

@@ -0,0 +1,65 @@
+import path from "node:path";
+import { gitRunOk } from "./git-repo.js";
+const MISSIONS_PREFIX = ".gitagent/missions/";
+/** Docs under missions/ are not gapman verify targets (no gate/trace contract). */
+const NON_VERIFIABLE_BASENAMES = new Set(["README.md"]);
+/** True for YAML/Markdown mission work orders under `.gitagent/missions/` (excludes README). */
+export function isVerifiableMissionPath(rel) {
+    const norm = rel.trim().replace(/\\/g, "/");
+    if (!norm.startsWith(MISSIONS_PREFIX))
+        return false;
+    if (!/\.(ya?ml|md)$/i.test(norm))
+        return false;
+    const base = norm.slice(MISSIONS_PREFIX.length).split("/").pop() ?? "";
+    if (NON_VERIFIABLE_BASENAMES.has(base))
+        return false;
+    return true;
+}
+/** Resolve merge-base for branch-scoped mission diff (pre-push). */
+export function resolveMergeBase(root) {
+    const upstream = gitRunOk(root, [
+        "rev-parse",
+        "--abbrev-ref",
+        "--symbolic-full-name",
+        "@{upstream}",
+    ]);
+    if (upstream.ok && upstream.stdout.trim()) {
+        const base = gitRunOk(root, ["merge-base", "HEAD", "@{upstream}"]);
+        if (base.ok && base.stdout.trim())
+            return base.stdout.trim();
+    }
+    for (const ref of ["main", "master"]) {
+        const base = gitRunOk(root, ["merge-base", "HEAD", ref]);
+        if (base.ok && base.stdout.trim())
+            return base.stdout.trim();
+    }
+    const parent = gitRunOk(root, ["rev-parse", "HEAD~1"]);
+    if (parent.ok && parent.stdout.trim())
+        return parent.stdout.trim();
+    return null;
+}
+/** Repo-relative mission paths changed between base and HEAD. */
+export function listDirtyMissionPaths(repoRoot, baseRef) {
+    const base = baseRef?.trim() || resolveMergeBase(repoRoot);
+    if (!base)
+        return [];
+    const r = gitRunOk(repoRoot, [
+        "diff",
+        "--name-only",
+        "--diff-filter=ACMRT",
+        `${base}..HEAD`,
+        "--",
+        MISSIONS_PREFIX,
+    ]);
+    if (!r.ok)
+        return [];
+    const paths = r.stdout
+        .split("\n")
+        .map((p) => p.trim().replace(/\\/g, "/"))
+        .filter((p) => isVerifiableMissionPath(p));
+    return [...new Set(paths)].sort();
+}
+export function listDirtyMissionPathsAbsolute(repoRoot, baseRef) {
+    return listDirtyMissionPaths(repoRoot, baseRef).map((rel) => path.join(repoRoot, rel.split("/").join(path.sep)));
+}
+//# sourceMappingURL=dirty-missions.js.map

package/dist/cli/lib/dirty-missions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dirty-missions.js","sourceRoot":"","sources":["../../../src/cli/lib/dirty-missions.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAE9C,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;AAExD,gGAAgG;AAChG,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACvE,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE;QAC9B,WAAW;QACX,cAAc;QACd,sBAAsB;QACtB,aAAa;KACd,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;QACnE,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/D,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,OAAgB;IACtE,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAErB,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE;QAC3B,MAAM;QACN,aAAa;QACb,qBAAqB;QACrB,GAAG,IAAI,QAAQ;QACf,IAAI;QACJ,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IAErB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM;SACnB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;SACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,QAAgB,EAAE,OAAgB;IAC9E,OAAO,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC1D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CACnD,CAAC;AACJ,CAAC"}

package/dist/cli/lib/doctor-checks.d.ts

@@ -0,0 +1,16 @@
+import type { Manifest } from "./types.js";
+export type DoctorLevel = "ok" | "warn" | "fail";
+export interface DoctorLine {
+    level: DoctorLevel;
+    message: string;
+}
+export interface DoctorCheckResult {
+    lines: DoctorLine[];
+    hasFail: boolean;
+    nextStep: string | null;
+    teacherAllowlistUnset: boolean;
+}
+export declare function pickNextStep(current: string | null, candidate: string): string | null;
+export declare function doctorLinesHasFail(lines: DoctorLine[]): boolean;
+export declare function runDoctorChecks(root: string, manifest: Manifest): DoctorCheckResult;
+//# sourceMappingURL=doctor-checks.d.ts.map

package/dist/cli/lib/doctor-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-checks.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/doctor-checks.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,MAAM,WAAW,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAcD,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAErF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAE/D;AA2FD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,iBAAiB,CA6BnF"}

package/dist/cli/lib/doctor-checks.js

@@ -0,0 +1,138 @@
+import fs from "node:fs";
+import path from "node:path";
+import { ENV_BYPASS_SECRET, isBypassSecretAuthorized, REL_BYPASS_SHA256 } from "./break-glass.js";
+import { REL_AGENT_ERROR_FILE, REL_MANIFEST } from "./constants.js";
+import { agentErrorAbsolutePath } from "./agent-error.js";
+import { gitConfigGet } from "./git-repo.js";
+import { resolveTeacherEmails } from "./teacher-identity.js";
+import { checkSkillManifestSync } from "./skill-sync.js";
+function readBypassAnchorState(repoRoot) {
+    const p = path.join(repoRoot, REL_BYPASS_SHA256);
+    if (!fs.existsSync(p))
+        return "missing";
+    const raw = fs.readFileSync(p, "utf8");
+    if (/^[a-f0-9]{64}$/im.test(raw))
+        return "configured";
+    return "placeholder";
+}
+function readHooksPath(repoRoot) {
+    return gitConfigGet(repoRoot, "core.hooksPath");
+}
+export function pickNextStep(current, candidate) {
+    return current ?? candidate;
+}
+export function doctorLinesHasFail(lines) {
+    return lines.some((line) => line.level === "fail");
+}
+function appendTeacherAllowlistChecks(root, lines, nextStep) {
+    const teacherIdentity = resolveTeacherEmails(root);
+    if (teacherIdentity.emails.length > 0) {
+        lines.push({
+            level: "ok",
+            message: `Teacher allowlist (${teacherIdentity.source}): ${teacherIdentity.emails.join(", ")}`,
+        });
+        if (teacherIdentity.source === "env") {
+            lines.push({
+                level: "warn",
+                message: "Teacher identity from GAPMAN_TEACHER_EMAILS env — prefer repo-local .gitagent/foreman/TEACHER.allowlist.local when working across projects",
+            });
+        }
+        return { nextStep, teacherAllowlistUnset: false };
+    }
+    lines.push({ level: "warn", message: "Teacher allowlist unset — verify git-proof will fail" });
+    nextStep = pickNextStep(nextStep, 'gapman teacher set "$(git config user.email)"');
+    return { nextStep, teacherAllowlistUnset: true };
+}
+function appendBypassChecks(root, lines) {
+    const bypassState = readBypassAnchorState(root);
+    if (bypassState === "configured") {
+        lines.push({ level: "ok", message: "BYPASS.sha256 anchor present" });
+        const secret = process.env[ENV_BYPASS_SECRET];
+        if (secret?.length) {
+            const authorized = isBypassSecretAuthorized(root);
+            lines.push({
+                level: authorized ? "ok" : "warn",
+                message: authorized
+                    ? "bypass: GXT_BYPASS_SECRET matches anchor"
+                    : "bypass: GXT_BYPASS_SECRET does NOT match anchor",
+            });
+        }
+        else {
+            lines.push({ level: "warn", message: "bypass: GXT_BYPASS_SECRET unset (expected unless in emergency)" });
+        }
+    }
+    else if (bypassState === "placeholder") {
+        lines.push({ level: "warn", message: "BYPASS.sha256 has no hash line — break-glass not provisioned" });
+    }
+    else {
+        lines.push({ level: "warn", message: `${REL_BYPASS_SHA256} missing` });
+    }
+}
+function appendHooksAndExampleMissionChecks(root, lines, nextStep) {
+    const hooks = readHooksPath(root);
+    if (hooks === ".githooks") {
+        lines.push({ level: "ok", message: "core.hooksPath=.githooks" });
+    }
+    else if (hooks) {
+        lines.push({ level: "warn", message: `core.hooksPath=${hooks} (expected .githooks for GXT hooks)` });
+    }
+    else {
+        lines.push({ level: "warn", message: "core.hooksPath unset — run: git config core.hooksPath .githooks" });
+    }
+    const exampleMission = ".gitagent/missions/example.verify.yaml";
+    const teacherIdentity = resolveTeacherEmails(root);
+    if (fs.existsSync(path.join(root, exampleMission))) {
+        lines.push({ level: "ok", message: `example mission: ${exampleMission}` });
+        if (teacherIdentity.emails.length > 0) {
+            nextStep = pickNextStep(nextStep, `gapman verify --mission ${exampleMission}`);
+        }
+    }
+    else {
+        lines.push({ level: "warn", message: "no example.verify.yaml — legislate a mission first" });
+        nextStep = pickNextStep(nextStep, 'gapman legislate "<intent>" --msn MSN-0001 --skill-key <key>');
+    }
+    return nextStep;
+}
+function appendAgentErrorCheck(root, lines) {
+    const errPath = agentErrorAbsolutePath(root);
+    if (!fs.existsSync(errPath))
+        return;
+    try {
+        const payload = JSON.parse(fs.readFileSync(errPath, "utf8"));
+        const summary = typeof payload.summary === "string" ? payload.summary : "(no summary)";
+        lines.push({ level: "warn", message: `last agent error: ${summary}` });
+        lines.push({ level: "warn", message: `  file: ${REL_AGENT_ERROR_FILE}` });
+    }
+    catch {
+        lines.push({ level: "warn", message: `stale ${REL_AGENT_ERROR_FILE} (unreadable)` });
+    }
+}
+export function runDoctorChecks(root, manifest) {
+    const lines = [{ level: "ok", message: `repo: ${root}` }];
+    let hasFail = false;
+    let nextStep = null;
+    let teacherAllowlistUnset = false;
+    const skillSync = checkSkillManifestSync(root, manifest);
+    if (skillSync.ok) {
+        lines.push({ level: "ok", message: "manifest + skills/ Rule 4.4 sync" });
+    }
+    else {
+        for (const err of skillSync.errors)
+            lines.push({ level: "fail", message: err });
+        hasFail = true;
+        nextStep = pickNextStep(nextStep, "gapman check");
+    }
+    const teacherResult = appendTeacherAllowlistChecks(root, lines, nextStep);
+    nextStep = teacherResult.nextStep;
+    teacherAllowlistUnset = teacherResult.teacherAllowlistUnset;
+    appendBypassChecks(root, lines);
+    nextStep = appendHooksAndExampleMissionChecks(root, lines, nextStep);
+    appendAgentErrorCheck(root, lines);
+    if (!fs.existsSync(path.join(root, REL_MANIFEST))) {
+        lines.push({ level: "fail", message: `${REL_MANIFEST} missing` });
+        hasFail = true;
+        nextStep = pickNextStep(nextStep, "gapman init");
+    }
+    return { lines, hasFail, nextStep, teacherAllowlistUnset };
+}
+//# sourceMappingURL=doctor-checks.js.map

package/dist/cli/lib/doctor-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-checks.js","sourceRoot":"","sources":["../../../src/cli/lib/doctor-checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAiBzD,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACtD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,YAAY,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAsB,EAAE,SAAiB;IACpE,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAmB;IACpD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,4BAA4B,CACnC,IAAY,EACZ,KAAmB,EACnB,QAAuB;IAEvB,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,sBAAsB,eAAe,CAAC,MAAM,MAAM,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC/F,CAAC,CAAC;QACH,IAAI,eAAe,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,MAAM;gBACb,OAAO,EACL,4IAA4I;aAC/I,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAC;IAC/F,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,+CAA+C,CAAC,CAAC;IACnF,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAmB;IAC3D,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC9C,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAClD,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;gBACjC,OAAO,EAAE,UAAU;oBACjB,CAAC,CAAC,0CAA0C;oBAC5C,CAAC,CAAC,iDAAiD;aACtD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;SAAM,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC,CAAC;IACzG,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,iBAAiB,UAAU,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,kCAAkC,CACzC,IAAY,EACZ,KAAmB,EACnB,QAAuB;IAEvB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACnE,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,KAAK,qCAAqC,EAAE,CAAC,CAAC;IACvG,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,iEAAiE,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,cAAc,GAAG,wCAAwC,CAAC;IAChE,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,oBAAoB,cAAc,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,2BAA2B,cAAc,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC,CAAC;QAC7F,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,8DAA8D,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,KAAmB;IAC9D,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO;IACpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAyB,CAAC;QACrF,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,OAAO,EAAE,EAAE,CAAC,CAAC;QACvE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,oBAAoB,eAAe,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAkB;IAC9D,MAAM,KAAK,GAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC;IACxE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAElC,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;IAC3E,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAChF,OAAO,GAAG,IAAI,CAAC;QACf,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAG,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1E,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC;IAClC,qBAAqB,GAAG,aAAa,CAAC,qBAAqB,CAAC;IAC5D,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChC,QAAQ,GAAG,kCAAkC,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACrE,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAEnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,YAAY,UAAU,EAAE,CAAC,CAAC;QAClE,OAAO,GAAG,IAAI,CAAC;QACf,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC;AAC7D,CAAC"}

package/dist/cli/lib/doctor-integration-checks.d.ts

@@ -0,0 +1,5 @@
+import { INTEGRATION_IDE_KEYS, loadIntegrationCompat, integrationWizardLabel } from "./integration-compat.js";
+import type { DoctorLine } from "./doctor-checks.js";
+export declare function runIntegrationDoctorChecks(repoRoot: string, templatesRoot: string): DoctorLine[];
+export { integrationWizardLabel, INTEGRATION_IDE_KEYS, loadIntegrationCompat };
+//# sourceMappingURL=doctor-integration-checks.d.ts.map

package/dist/cli/lib/doctor-integration-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-integration-checks.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/doctor-integration-checks.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAiCrD,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,UAAU,EAAE,CAsDd;AAED,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,CAAC"}