@keel_flow/cli 0.2.0

package/dist/index.js

@@ -0,0 +1,1015 @@
+#!/usr/bin/env node
+import { createReadStream, statSync, readdirSync, writeFileSync, readFileSync } from "fs";
+import { createHash } from "crypto";
+import { resolve, join, extname } from "path";
+import { pathToFileURL } from "url";
+import { Command } from "commander";
+import pc from "picocolors";
+import { createArchitecture, verify } from "@keel_flow/core";
+import { createSpecChecker, createProvider } from "@keel_flow/runtime";
+import { ArchitectureMapSchema } from "@keel_flow/schema";
+import { buildDiffFromGit, resolveDiffRef } from "./git.js";
+import { importTsConfig } from "./load-ts.js";
+import { printVerifyReport } from "./report.js";
+import { runDoctor, printDoctorReport, collectEnvPreflight } from "./doctor.js";
+import { envKeysProvider, printKeysList, runKeySet, runKeyTest, runKeyRemove, runSetupWalkthrough, } from "./keys.js";
+import { createCliEmitter } from "./telemetry-helper.js";
+import { runOrchestrate } from "./orchestrate.js";
+import { runMapRepo } from "./map-repo.js";
+import { runKbReindex, runKbStats, printKbStats } from "./kb-reindex.js";
+import { runBuildAbort, runBuildApprove, runBuildExecute, runBuildReject, runBuildResume, runBuildStart, runBuildStatus, } from "./build.js";
+import { runReflect, runReflectList } from "./reflect.js";
+import { runMemoryAdd, runMemoryList, runMemoryRemove, runMemoryShow, } from "./memory.js";
+import { runLearn, runLearnApply, runLearnList } from "./learn.js";
+import { runUp, runDown, runStatus, runOpen, runRestart } from "./up.js";
+import { CLAUDE_INSTALL_HINT, probeClaudeAuth, triggerClaudeLogin } from "./claude-auth.js";
+import { runGoalAbandon, runGoalApprove, runGoalCreate, runGoalEvaluate, runGoalList, runGoalPause, runGoalReject, runGoalResume, runGoalStatus, } from "./goals.js";
+import { runRulesList, runRulesAdd } from "./rules.js";
+const program = new Command();
+program.name("keel").description("Keel framework CLI").version("0.2.0");
+program
+    .command("verify")
+    .description("Run the Keel verify gate against a diff")
+    .option("--diff <ref>", "Git ref range to diff (e.g. origin/main..HEAD)")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .option("--spec <summary>", "Spec summary for LLM-driven spec compliance check")
+    .option("--json <path>", "Write VerifyResult as JSON to this file path")
+    .action(async (opts) => {
+    const cwd = resolve(opts.cwd);
+    const envWarnings = collectEnvPreflight();
+    if (envWarnings.length > 0) {
+        process.stderr.write(pc.yellow("⚠ Environment preflight\n"));
+        for (const w of envWarnings) {
+            process.stderr.write(pc.yellow(`  · ${w}\n`));
+        }
+        process.stderr.write("\n");
+    }
+    const { emitter } = createCliEmitter({ command: "verify", cwd });
+    const ref = resolveDiffRef(opts.diff, cwd);
+    const specSummaryEarly = opts.spec ?? process.env["KEEL_SPEC_SUMMARY"];
+    emitter?.emit({
+        sessionId: "",
+        parentEventId: null,
+        workspaceId: null,
+        triggeredBy: { kind: "user" },
+        kind: "session.start",
+        payload: { command: "verify", ref, hasSpec: !!specSummaryEarly },
+    });
+    let diff;
+    try {
+        diff = buildDiffFromGit(ref, cwd);
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`Failed to build diff from git: ${String(err)}\n`));
+        emitter?.emit({
+            sessionId: "",
+            parentEventId: null,
+            workspaceId: null,
+            triggeredBy: { kind: "user" },
+            kind: "session.end",
+            payload: { exitCode: 2, error: "git-diff-failed" },
+        });
+        if (emitter)
+            await emitter.close();
+        process.exit(2);
+    }
+    const archPath = join(cwd, "architecture/data.ts");
+    const archUrl = pathToFileURL(archPath).href;
+    const principlesUrl = pathToFileURL(join(cwd, "principles/index.ts")).href;
+    let architecture;
+    let architectureSource = "";
+    let principles;
+    try {
+        const archMod = await importTsConfig(archUrl);
+        architecture = createArchitecture((archMod.default ?? archMod));
+        architectureSource = readFileSync(archPath, "utf-8");
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`Failed to load architecture/data.ts: ${String(err)}\n`));
+        emitter?.emit({
+            sessionId: "",
+            parentEventId: null,
+            workspaceId: null,
+            triggeredBy: { kind: "user" },
+            kind: "session.end",
+            payload: { exitCode: 2, error: "arch-load-failed" },
+        });
+        if (emitter)
+            await emitter.close();
+        process.exit(2);
+    }
+    try {
+        const principlesMod = await importTsConfig(principlesUrl);
+        const registry = (principlesMod.keelPrinciples ?? principlesMod.default);
+        principles = registry;
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`Failed to load principles/index.ts: ${String(err)}\n`));
+        emitter?.emit({
+            sessionId: "",
+            parentEventId: null,
+            workspaceId: null,
+            triggeredBy: { kind: "user" },
+            kind: "session.end",
+            payload: { exitCode: 2, error: "principles-load-failed" },
+        });
+        if (emitter)
+            await emitter.close();
+        process.exit(2);
+    }
+    const specSummary = opts.spec ?? process.env["KEEL_SPEC_SUMMARY"];
+    let specChecker;
+    if (specSummary) {
+        const providerKind = (process.env["KEEL_PROVIDER_KIND"] ?? "anthropic");
+        const apiKey = providerKind === "anthropic"
+            ? process.env["ANTHROPIC_API_KEY"]
+            : providerKind === "openai-compatible"
+                ? process.env["OPENAI_API_KEY"]
+                : undefined;
+        // No key → leave specChecker undefined so spec compliance lands as PENDING
+        // (non-blocking) rather than hard-failing the gate. This matches the local
+        // no-key path and keeps CI green without a token; set ANTHROPIC_API_KEY (or
+        // OPENAI_API_KEY for openai-compatible) to run real spec checks.
+        // claude-bridge needs no key: it rides Claude subscription auth.
+        if (!apiKey && providerKind !== "claude-bridge") {
+            process.stderr.write(pc.yellow(providerKind === "anthropic"
+                ? "Spec check requested but ANTHROPIC_API_KEY is not set — marking spec compliance PENDING (non-blocking)\n"
+                : "Spec check requested but OPENAI_API_KEY is not set — marking spec compliance PENDING (non-blocking)\n"));
+        }
+        else {
+            const baseURL = process.env["OPENAI_BASE_URL"];
+            const defaultModel = process.env["KEEL_PROVIDER_MODEL"];
+            const provider = createProvider({
+                kind: providerKind,
+                apiKey: apiKey ?? "",
+                ...(baseURL ? { baseURL } : {}),
+                ...(defaultModel ? { defaultModel } : {}),
+            });
+            specChecker = createSpecChecker({ provider });
+        }
+    }
+    const result = await verify({
+        diff,
+        architecture: architecture.map,
+        architectureSource,
+        principles,
+        specChecker,
+        specSummary,
+        // Forward the resolved working directory so checkTestsAndLint shells out
+        // in the right repo and every principle.check resolves diff paths against
+        // --cwd rather than process.cwd() (orchestrate/scheduler run verify with a
+        // cwd that is not the shell's).
+        options: { cwd },
+    });
+    printVerifyReport(result);
+    if (opts.json) {
+        const jsonPath = resolve(opts.json);
+        writeFileSync(jsonPath, JSON.stringify({ ...result, exitCode: result.exitCode }, null, 2), "utf-8");
+    }
+    if (emitter) {
+        const allViolations = [
+            ...result.checks.spec.violations,
+            ...result.checks.architecture.violations,
+            ...result.checks.principles.violations,
+            ...result.checks["tests-lint"].violations,
+        ];
+        const criticalCount = allViolations.filter((v) => v.severity === "critical").length;
+        const warningCount = allViolations.filter((v) => v.severity === "warning").length;
+        emitter.emit({
+            sessionId: "",
+            parentEventId: null,
+            workspaceId: null,
+            triggeredBy: { kind: "user" },
+            kind: "verify.run",
+            payload: {
+                exitCode: result.exitCode,
+                checks: {
+                    spec: result.checks.spec.passed,
+                    architecture: result.checks.architecture.passed,
+                    principles: result.checks.principles.passed,
+                    "tests-lint": result.checks["tests-lint"].passed,
+                },
+                criticalCount,
+                warningCount,
+            },
+        });
+        for (const checkName of ["spec", "architecture", "principles", "tests-lint"]) {
+            const check = result.checks[checkName];
+            emitter.emit({
+                sessionId: "",
+                parentEventId: null,
+                workspaceId: null,
+                triggeredBy: { kind: "user" },
+                kind: "verify.check",
+                payload: {
+                    name: checkName,
+                    passed: check.passed,
+                    violations: check.violations.length,
+                },
+            });
+        }
+        emitter.emit({
+            sessionId: "",
+            parentEventId: null,
+            workspaceId: null,
+            triggeredBy: { kind: "user" },
+            kind: "session.end",
+            payload: { exitCode: result.exitCode },
+        });
+        await emitter.close();
+    }
+    process.exit(result.exitCode);
+});
+program
+    .command("map")
+    .description("Print or validate the architecture map (or the auto-derived repo-map with --repo)")
+    .option("--check", "Validate architecture/data.ts against schema, exit non-zero if invalid")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .option("--repo", "Emit the auto-derived repo-map (tree-sitter-style symbol summary)")
+    .option("--no-cache", "Skip the .keel/repo-map.cache.json cache")
+    .option("--output <path>", "Write output to a file instead of stdout")
+    .option("--json", "Emit structured JSON (only with --repo)")
+    .option("--max-tokens <n>", "Token budget for the repo-map summary", (v) => parseInt(v, 10))
+    .action(async (opts) => {
+    const cwd = resolve(opts.cwd);
+    if (opts.repo) {
+        try {
+            await runMapRepo({
+                cwd,
+                noCache: opts.cache === false,
+                ...(opts.output ? { output: opts.output } : {}),
+                ...(opts.json ? { json: true } : {}),
+                ...(opts.maxTokens !== undefined ? { maxTokens: opts.maxTokens } : {}),
+            });
+            return;
+        }
+        catch (err) {
+            process.stderr.write(pc.red(`map --repo failed: ${err instanceof Error ? err.message : String(err)}\n`));
+            process.exit(2);
+        }
+    }
+    const archUrl = pathToFileURL(join(cwd, "architecture/data.ts")).href;
+    let raw;
+    try {
+        const mod = await importTsConfig(archUrl);
+        raw = mod.default ?? mod;
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`Failed to load architecture/data.ts: ${String(err)}\n`));
+        process.exit(2);
+    }
+    if (opts.check) {
+        const result = ArchitectureMapSchema.safeParse(raw);
+        if (!result.success) {
+            process.stderr.write(pc.red("architecture/data.ts is invalid:\n"));
+            for (const issue of result.error.issues) {
+                process.stderr.write(pc.red(`  ${issue.path.join(".")} — ${issue.message}\n`));
+            }
+            process.exit(1);
+        }
+        process.stdout.write(pc.green("architecture/data.ts is valid\n"));
+        return;
+    }
+    const parsed = ArchitectureMapSchema.parse(raw);
+    process.stdout.write(pc.bold(`Architecture Map  (schema v${parsed.schemaVersion})\n`));
+    process.stdout.write(pc.dim("─".repeat(50) + "\n"));
+    for (const layer of parsed.layers) {
+        const nodes = parsed.nodes.filter((n) => n.layer === layer.id);
+        process.stdout.write(pc.bold(`\n[${layer.label}]\n`));
+        for (const node of nodes) {
+            const conns = parsed.connections.filter((c) => c.from === node.id || c.to === node.id).length;
+            process.stdout.write(`  ${pc.cyan(node.id)}  ${pc.dim(node.description)}\n`);
+            process.stdout.write(`    connections: ${conns}\n`);
+        }
+    }
+    process.stdout.write(pc.dim("\n" + "─".repeat(50) + "\n"));
+    process.stdout.write(`Total nodes: ${parsed.nodes.length}\n`);
+    process.stdout.write(`Total connections: ${parsed.connections.length}\n`);
+    process.stdout.write(`Contexts: ${parsed.contexts.map((c) => c.label).join(", ")}\n`);
+});
+const principlesCmd = program.command("principles").description("Manage principles");
+principlesCmd
+    .command("list")
+    .description("List principles from principles/index.ts")
+    .option("--severity <level>", "Filter by severity (critical|warning|info)")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .action(async (opts) => {
+    const cwd = resolve(opts.cwd);
+    const principlesUrl = pathToFileURL(join(cwd, "principles/index.ts")).href;
+    let registry;
+    try {
+        const mod = await importTsConfig(principlesUrl);
+        registry = (mod.keelPrinciples ?? mod.default);
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`Failed to load principles/index.ts: ${String(err)}\n`));
+        process.exit(2);
+    }
+    let principles = registry.all();
+    if (opts.severity) {
+        principles = principles.filter((p) => p.severity === opts.severity);
+    }
+    const byPack = new Map();
+    const ungrouped = [];
+    for (const p of principles) {
+        const packId = "packId" in p && typeof p.packId === "string" ? p.packId : undefined;
+        if (packId) {
+            if (!byPack.has(packId))
+                byPack.set(packId, []);
+            byPack.get(packId).push(p);
+        }
+        else {
+            ungrouped.push(p);
+        }
+    }
+    const printPrinciple = (p) => {
+        const sev = p.severity === "critical"
+            ? pc.red(p.severity)
+            : p.severity === "warning"
+                ? pc.yellow(p.severity)
+                : pc.cyan(p.severity);
+        process.stdout.write(`  ${pc.bold(p.id)}  [${sev}]\n`);
+        process.stdout.write(`    ${p.description}\n`);
+        if (p.check)
+            process.stdout.write(pc.dim("    (has check function)\n"));
+    };
+    for (const [packId, ps] of byPack) {
+        process.stdout.write(pc.bold(`\nPack: ${packId}\n`));
+        for (const p of ps)
+            printPrinciple(p);
+    }
+    if (ungrouped.length > 0) {
+        if (byPack.size > 0)
+            process.stdout.write(pc.bold("\nUngrouped\n"));
+        for (const p of ungrouped)
+            printPrinciple(p);
+    }
+    process.stdout.write(`\n${principles.length} principle(s) listed\n`);
+});
+const rulesCmd = program
+    .command("rules")
+    .description("Manage project command rules (rules/commands.ts)");
+rulesCmd
+    .command("list", { isDefault: true })
+    .description("List command rules declared in rules/commands.ts")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .action(async (opts) => {
+    try {
+        await runRulesList({ cwd: resolve(opts.cwd) });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`keel rules list failed: ${String(err)}\n`));
+        process.exit(2);
+    }
+});
+rulesCmd
+    .command("add <pattern>")
+    .description('Add a command rule, e.g. "pip,pip3" (comma/pipe = alternatives, space = token positions)')
+    .requiredOption("--justification <text>", "Why the rule exists / what to do instead")
+    .option("--decision <decision>", "forbidden | discouraged", "forbidden")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .action(async (pattern, opts) => {
+    if (opts.decision !== "forbidden" && opts.decision !== "discouraged") {
+        process.stderr.write(pc.red(`--decision must be "forbidden" or "discouraged", got "${opts.decision}"\n`));
+        process.exit(2);
+    }
+    try {
+        await runRulesAdd({
+            cwd: resolve(opts.cwd),
+            pattern,
+            decision: opts.decision,
+            justification: opts.justification,
+        });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`keel rules add failed: ${String(err)}\n`));
+        process.exit(2);
+    }
+});
+const kbCmd = program.command("kb").description("Knowledge base operations");
+kbCmd
+    .command("upload <path>")
+    .description("Upload a file or directory to the workspace KB")
+    .option("--workspace <id>", "Workspace ID")
+    .action(async (filePath, _opts) => {
+    const abs = resolve(filePath);
+    let entries;
+    try {
+        const stat = statSync(abs);
+        if (stat.isDirectory()) {
+            entries = readdirSync(abs)
+                .map((f) => join(abs, f))
+                .filter((f) => {
+                const ext = extname(f).toLowerCase();
+                return ext === ".md" || ext === ".txt" || ext === ".pdf";
+            });
+        }
+        else {
+            entries = [abs];
+        }
+    }
+    catch {
+        process.stderr.write(pc.red(`Cannot access path: ${abs}\n`));
+        process.exit(1);
+    }
+    for (const entry of entries) {
+        const ext = extname(entry).toLowerCase();
+        if (ext === ".pdf") {
+            // PDF text extraction is not wired into the CLI upload path yet. Skip
+            // this entry and continue the batch rather than aborting partway and
+            // leaving earlier files uploaded but later ones silently dropped.
+            process.stderr.write(pc.yellow(`Skipping ${entry}: PDF upload is not supported via the CLI yet.\n`));
+            continue;
+        }
+        const hash = await fileHash(entry);
+        const size = statSync(entry).size;
+        process.stdout.write(`${entry}  size=${size}  sha256=${hash}\n`);
+        const workspaceUrl = process.env["KEEL_WORKSPACE_URL"];
+        if (!workspaceUrl) {
+            process.stdout.write(pc.dim("KB upload will POST to workspace API once configured. Add KEEL_WORKSPACE_URL env var to enable.\n"));
+        }
+        else {
+            const { readFileSync } = await import("fs");
+            const content = readFileSync(entry, "utf-8");
+            const res = await fetch(`${workspaceUrl}/api/kb/ingest`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ source: entry, content }),
+            });
+            if (!res.ok) {
+                process.stderr.write(pc.red(`Upload failed: ${res.status} ${res.statusText}\n`));
+                process.exit(1);
+            }
+            process.stdout.write(pc.green(`Uploaded: ${entry}\n`));
+        }
+    }
+});
+kbCmd
+    .command("reindex")
+    .description("Re-embed all chunks with the active embedding model")
+    .option("--workspace <id>", "Workspace ID (defaults to KEEL_WORKSPACE_ID)")
+    .option("--model <name>", "Override the embedding model (voyage-context-3 | text-embedding-3-small | all-MiniLM-L6-v2)")
+    .action(async (opts) => {
+    try {
+        const result = await runKbReindex({
+            ...(opts.workspace ? { workspaceId: opts.workspace } : {}),
+            ...(opts.model ? { model: opts.model } : {}),
+        });
+        process.stdout.write(pc.green(`Reindex complete: ${result.reindexed} chunks re-embedded with ${result.model}` +
+            (result.skipped > 0 ? ` (${result.skipped} skipped)` : "") +
+            "\n"));
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`kb reindex failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+kbCmd
+    .command("stats")
+    .description("Show KB stats: docs, chunks, active embedder, rerank state")
+    .option("--workspace <id>", "Workspace ID (defaults to KEEL_WORKSPACE_ID)")
+    .action(async (opts) => {
+    try {
+        const stats = await runKbStats({
+            ...(opts.workspace ? { workspaceId: opts.workspace } : {}),
+        });
+        printKbStats(stats);
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`kb stats failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+program
+    .command("doctor")
+    .description("Diagnose environment + Keel project setup")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .action(async (opts) => {
+    const report = await runDoctor({ cwd: resolve(opts.cwd) });
+    printDoctorReport(report);
+    process.exit(report.exitCode);
+});
+program
+    .command("setup")
+    .description("Interactive walkthrough to configure required API keys and secrets")
+    .action(async () => {
+    await runSetupWalkthrough(envKeysProvider());
+});
+const keysCmd = program.command("keys").description("Manage API keys and secrets");
+keysCmd
+    .command("list")
+    .description("List all known keys with status")
+    .action(async () => {
+    await printKeysList(envKeysProvider());
+});
+keysCmd
+    .command("set <name> [value]")
+    .description("Set a key (prompts for value if not given)")
+    .action(async (name, value) => {
+    await runKeySet(envKeysProvider(), name, value);
+});
+keysCmd
+    .command("test <name>")
+    .description("Validate a key against its provider's auth endpoint")
+    .action(async (name) => {
+    await runKeyTest(envKeysProvider(), name);
+});
+keysCmd
+    .command("rm <name>")
+    .description("Remove a key")
+    .action(async (name) => {
+    await runKeyRemove(envKeysProvider(), name);
+});
+program
+    .command("orchestrate <task>")
+    .description("Run the Keel orchestrator agent against a task")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .option("--provider <kind>", "Provider kind (anthropic | openai-compatible)")
+    .option("--model <id>", "Model id (provider-specific)")
+    .option("--max-iterations <n>", "Max orchestrator iterations", (v) => parseInt(v, 10))
+    .option("--no-questions", "Skip clarifying questions")
+    .option("--dry-run", "Plan only; skip real writes")
+    .option("--json <path>", "Write the final result JSON to this path")
+    .action(async (task, opts) => {
+    try {
+        const result = await runOrchestrate({
+            task,
+            cwd: opts.cwd,
+            ...(opts.provider ? { provider: opts.provider } : {}),
+            ...(opts.model ? { model: opts.model } : {}),
+            ...(opts.maxIterations !== undefined ? { maxIterations: opts.maxIterations } : {}),
+            noQuestions: opts.questions === false,
+            ...(opts.dryRun ? { dryRun: true } : {}),
+            ...(opts.json ? { json: opts.json } : {}),
+        });
+        process.stdout.write(`\n${result.finalMessage}\n`);
+        process.stdout.write(pc.dim(`\nsession=${result.sessionId} iterations=${result.iterations} toolCalls=${result.toolCalls} verifyExitCode=${String(result.verifyExitCode)}\n`));
+        process.exit(result.verifyExitCode ?? 0);
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`orchestrate failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+const buildCmd = program.command("build").description("Structured planning loop: draft → distill → approve → codify → execute");
+buildCmd
+    .command("start <topic>", { isDefault: true })
+    .description("Start a new build (drafting REPL)")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .option("--provider <kind>", "Provider kind (anthropic | openai-compatible)")
+    .option("--model <id>", "Model id")
+    .action(async (topic, opts) => {
+    try {
+        await runBuildStart(topic, {
+            cwd: opts.cwd,
+            ...(opts.provider ? { provider: opts.provider } : {}),
+            ...(opts.model ? { model: opts.model } : {}),
+        });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`build start failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+buildCmd
+    .command("status [slug]")
+    .description("Show one build (if slug given) or all builds")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .action(async (slug, opts) => {
+    try {
+        await runBuildStatus(slug, { cwd: opts.cwd });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`build status failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+buildCmd
+    .command("approve <slug>")
+    .description("Approve the current summary and codify the spec")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .option("--provider <kind>", "Provider kind")
+    .option("--model <id>", "Model id")
+    .action(async (slug, opts) => {
+    try {
+        await runBuildApprove(slug, {
+            cwd: opts.cwd,
+            ...(opts.provider ? { provider: opts.provider } : {}),
+            ...(opts.model ? { model: opts.model } : {}),
+        });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`build approve failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+buildCmd
+    .command("reject <slug> <reason>")
+    .description("Reject the current summary and return to drafting")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .action(async (slug, reason, opts) => {
+    try {
+        await runBuildReject(slug, reason, { cwd: opts.cwd });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`build reject failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+buildCmd
+    .command("resume <slug>")
+    .description("Re-enter the REPL for a paused build")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .option("--provider <kind>", "Provider kind")
+    .option("--model <id>", "Model id")
+    .action(async (slug, opts) => {
+    try {
+        await runBuildResume(slug, {
+            cwd: opts.cwd,
+            ...(opts.provider ? { provider: opts.provider } : {}),
+            ...(opts.model ? { model: opts.model } : {}),
+        });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`build resume failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+buildCmd
+    .command("abort <slug>")
+    .description("Mark a build as abandoned (artifacts preserved)")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .action(async (slug, opts) => {
+    try {
+        await runBuildAbort(slug, { cwd: opts.cwd });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`build abort failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+buildCmd
+    .command("execute <slug>")
+    .description("Execute an approved spec via the orchestrator")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .option("--provider <kind>", "Provider kind")
+    .option("--model <id>", "Model id")
+    .option("--dry-run", "Plan only; skip real writes")
+    .action(async (slug, opts) => {
+    try {
+        await runBuildExecute(slug, {
+            cwd: opts.cwd,
+            ...(opts.provider ? { provider: opts.provider } : {}),
+            ...(opts.model ? { model: opts.model } : {}),
+            ...(opts.dryRun ? { dryRun: true } : {}),
+        });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`build execute failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+const reflectCmd = program.command("reflect").description("End-of-session retrospective");
+reflectCmd
+    .command("run", { isDefault: true })
+    .description("Generate a reflection for a session (defaults to most recent)")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .option("--session <id>", "Session id (defaults to most recent)")
+    .option("--auto", "Indicate the call came from an event trigger")
+    .option("--provider <kind>", "Provider kind")
+    .option("--model <id>", "Model id")
+    .action(async (opts) => {
+    try {
+        await runReflect({
+            cwd: opts.cwd,
+            ...(opts.session ? { session: opts.session } : {}),
+            ...(opts.auto ? { auto: true } : {}),
+            ...(opts.provider ? { provider: opts.provider } : {}),
+            ...(opts.model ? { model: opts.model } : {}),
+        });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`reflect failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+reflectCmd
+    .command("ls")
+    .description("List recent reflections")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .action(async (opts) => {
+    await runReflectList({ cwd: opts.cwd });
+});
+const memoryCmd = program.command("memory").description("Read and write memory files");
+memoryCmd
+    .command("list")
+    .description("List memory entries from project (default) or global")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .option("--global", "Read from ~/.keel/memory.md instead of project scope")
+    .action(async (opts) => {
+    await runMemoryList({ cwd: opts.cwd, ...(opts.global ? { global: true } : {}) });
+});
+memoryCmd
+    .command("add <fact>")
+    .description("Append a fact to memory (project scope by default)")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .option("--global", "Append to ~/.keel/memory.md instead of project scope")
+    .action(async (fact, opts) => {
+    await runMemoryAdd({
+        cwd: opts.cwd,
+        fact,
+        ...(opts.global ? { global: true } : {}),
+    });
+});
+memoryCmd
+    .command("show <pattern>")
+    .description("Search memory entries by regex or literal substring")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .option("--global", "Search ~/.keel/memory.md instead of project scope")
+    .action(async (pattern, opts) => {
+    await runMemoryShow({
+        cwd: opts.cwd,
+        pattern,
+        ...(opts.global ? { global: true } : {}),
+    });
+});
+memoryCmd
+    .command("rm <entryId>")
+    .description("Delete a memory entry by id (or id prefix)")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .action(async (entryId, opts) => {
+    await runMemoryRemove({ cwd: opts.cwd, id: entryId });
+});
+const learnCmd = program.command("learn").description("Review proposed framework updates");
+learnCmd
+    .command("review", { isDefault: true })
+    .description("Step through pending proposals interactively")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .option("--provider <kind>", "Provider kind")
+    .option("--model <id>", "Model id")
+    .action(async (opts) => {
+    try {
+        await runLearn({
+            cwd: opts.cwd,
+            ...(opts.provider ? { provider: opts.provider } : {}),
+            ...(opts.model ? { model: opts.model } : {}),
+        });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`learn failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+learnCmd
+    .command("ls")
+    .description("List proposals by status (default: pending)")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .option("--status <s>", "pending | accepted | rejected | deferred")
+    .action(async (opts) => {
+    const statusList = ["pending", "accepted", "rejected", "deferred"];
+    const status = opts.status && statusList.includes(opts.status)
+        ? opts.status
+        : "pending";
+    await runLearnList({ cwd: opts.cwd, status });
+});
+learnCmd
+    .command("apply <proposalId>")
+    .description("Apply a proposal non-interactively (for CI)")
+    .option("--cwd <path>", "Working directory", process.cwd())
+    .option("--provider <kind>", "Provider kind")
+    .option("--model <id>", "Model id")
+    .action(async (proposalId, opts) => {
+    try {
+        await runLearnApply({
+            cwd: opts.cwd,
+            proposalId,
+            ...(opts.provider ? { provider: opts.provider } : {}),
+            ...(opts.model ? { model: opts.model } : {}),
+        });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`learn apply failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+const goalCmd = program.command("goal").description("Manage goals (Phase 3g)");
+goalCmd
+    .command("list")
+    .description("List goals (optionally filtered by status)")
+    .option("--status <s>", "active | paused | achieved | abandoned")
+    .action(async (opts) => {
+    try {
+        await runGoalList({ ...(opts.status ? { status: opts.status } : {}) });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`goal list failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+goalCmd
+    .command("create [title]")
+    .description("Create a goal interactively (built-in or custom)")
+    .action(async (title) => {
+    try {
+        await runGoalCreate({ ...(title ? { title } : {}) });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`goal create failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+goalCmd
+    .command("status <id>")
+    .description("Show single-goal status + recent actions")
+    .action(async (id) => {
+    try {
+        await runGoalStatus({ id });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`goal status failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+goalCmd
+    .command("evaluate <id>")
+    .description("Force an immediate evaluation (bypasses trigger schedule)")
+    .action(async (id) => {
+    try {
+        await runGoalEvaluate({ id });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`goal evaluate failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+goalCmd
+    .command("approve <actionId>")
+    .description("Approve a pending action")
+    .option("--note <note>", "Optional approval note")
+    .action(async (actionId, opts) => {
+    try {
+        await runGoalApprove({ id: actionId, ...(opts.note ? { note: opts.note } : {}) });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`goal approve failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+goalCmd
+    .command("reject <actionId> <reason>")
+    .description("Reject a pending action with a reason")
+    .action(async (actionId, reason) => {
+    try {
+        await runGoalReject({ id: actionId, reason });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`goal reject failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+goalCmd
+    .command("pause <id>")
+    .description("Pause a goal")
+    .action(async (id) => {
+    try {
+        await runGoalPause({ id });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`goal pause failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+goalCmd
+    .command("resume <id>")
+    .description("Resume a paused goal")
+    .action(async (id) => {
+    try {
+        await runGoalResume({ id });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`goal resume failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+goalCmd
+    .command("abandon <id>")
+    .description("Abandon a goal")
+    .action(async (id) => {
+    try {
+        await runGoalAbandon({ id });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`goal abandon failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(2);
+    }
+});
+program
+    .command("up")
+    .description("Boot the workspace API + Next.js UI + database and open the browser")
+    .option("--no-open", "Do not open the browser after boot (for SSH/CI/detached runs)")
+    .option("--no-login", "Skip the Claude sign-in preflight (for CI; use CLAUDE_CODE_OAUTH_TOKEN)")
+    .action(async (opts) => {
+    // Match the house error style used by every other command: a runUp throw
+    // (port conflict, health timeout, docker/migration failure) becomes a single
+    // red line + clean exit, never the raw V8 stack trace + pnpm ELIFECYCLE that
+    // re-running `keel up` while already running used to produce.
+    try {
+        await runUp({ skipBrowser: opts.open === false, skipLogin: opts.login === false });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`\nkeel up failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(1);
+    }
+});
+program
+    .command("login")
+    .description("Sign in to your Claude subscription (keyless claude-bridge auth)")
+    .option("--token", "Mint a long-lived CLAUDE_CODE_OAUTH_TOKEN instead (headless/CI)")
+    .action(async (opts) => {
+    const existing = probeClaudeAuth();
+    if (existing.state === "authed" && !opts.token) {
+        process.stdout.write(pc.green(`✓ already signed in${existing.subscriptionType ? ` (${existing.subscriptionType})` : ""}\n`) +
+            (existing.email ? pc.dim(`  ${existing.email}\n`) : ""));
+        return;
+    }
+    if (existing.state === "cli-missing") {
+        process.stderr.write(pc.yellow(`${CLAUDE_INSTALL_HINT}\n`));
+        process.exit(1);
+    }
+    const ok = triggerClaudeLogin(opts.token ? "token" : "browser");
+    if (!ok) {
+        process.stderr.write(pc.red("sign-in did not complete.\n"));
+        process.exit(1);
+    }
+    if (!opts.token) {
+        const after = probeClaudeAuth();
+        process.stdout.write(after.state === "authed"
+            ? pc.green(`✓ signed in${after.subscriptionType ? ` (${after.subscriptionType})` : ""}\n`)
+            : pc.green("✓ sign-in complete\n"));
+    }
+});
+program
+    .command("down")
+    .description("Stop the running workspace (API + UI + managed database) from any terminal")
+    .action(async () => {
+    try {
+        await runDown();
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`\nkeel down failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(1);
+    }
+});
+program
+    .command("status")
+    .description("Show whether the workspace is running, and where")
+    .action(async () => {
+    try {
+        const allUp = await runStatus();
+        // Scriptable: non-zero when the workspace is not fully up.
+        if (!allUp)
+            process.exit(1);
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`\nkeel status failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(1);
+    }
+});
+program
+    .command("open")
+    .description("Open the running workspace in your browser")
+    .action(async () => {
+    try {
+        const opened = await runOpen();
+        if (!opened)
+            process.exit(1);
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`\nkeel open failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(1);
+    }
+});
+program
+    .command("restart")
+    .description("Stop the workspace if running, then boot it fresh")
+    .option("--no-open", "Do not open the browser after boot (for SSH/CI/detached runs)")
+    .action(async (opts) => {
+    try {
+        await runRestart({ skipBrowser: opts.open === false });
+    }
+    catch (err) {
+        process.stderr.write(pc.red(`\nkeel restart failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        process.exit(1);
+    }
+});
+function fileHash(filePath) {
+    return new Promise((resolve, reject) => {
+        const hash = createHash("sha256");
+        const stream = createReadStream(filePath);
+        stream.on("data", (d) => hash.update(d));
+        stream.on("end", () => resolve(hash.digest("hex")));
+        stream.on("error", reject);
+    });
+}
+program.parse(process.argv);
+//# sourceMappingURL=index.js.map