@kirrosh/zond 0.26.0 → 0.27.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (261) hide show
  1. package/CHANGELOG.md +59 -0
  2. package/README.md +22 -21
  3. package/bin/zond.mjs +23 -0
  4. package/package.json +13 -16
  5. package/scripts/npm/postinstall.mjs +76 -0
  6. package/src/CLAUDE.md +0 -112
  7. package/src/bun-types.d.ts +0 -5
  8. package/src/cli/argv.ts +0 -122
  9. package/src/cli/commands/add-api.ts +0 -146
  10. package/src/cli/commands/api/annotate/idempotency.ts +0 -59
  11. package/src/cli/commands/api/annotate/index.ts +0 -880
  12. package/src/cli/commands/api/annotate/lifecycle.ts +0 -74
  13. package/src/cli/commands/api/annotate/overlay.ts +0 -206
  14. package/src/cli/commands/api/annotate/pagination.ts +0 -64
  15. package/src/cli/commands/api/annotate/prompts.ts +0 -220
  16. package/src/cli/commands/api/annotate/readback.ts +0 -58
  17. package/src/cli/commands/api/annotate/resources.ts +0 -91
  18. package/src/cli/commands/api/annotate/seed-bodies.ts +0 -61
  19. package/src/cli/commands/audit.ts +0 -786
  20. package/src/cli/commands/catalog.ts +0 -97
  21. package/src/cli/commands/check.ts +0 -361
  22. package/src/cli/commands/checks.ts +0 -1072
  23. package/src/cli/commands/ci-init.ts +0 -223
  24. package/src/cli/commands/clean.ts +0 -212
  25. package/src/cli/commands/cleanup.ts +0 -236
  26. package/src/cli/commands/completions.ts +0 -192
  27. package/src/cli/commands/coverage.ts +0 -872
  28. package/src/cli/commands/db.ts +0 -611
  29. package/src/cli/commands/describe.ts +0 -120
  30. package/src/cli/commands/discover.ts +0 -1356
  31. package/src/cli/commands/doctor.ts +0 -661
  32. package/src/cli/commands/fixtures.ts +0 -402
  33. package/src/cli/commands/generate.ts +0 -577
  34. package/src/cli/commands/init/agents-md.ts +0 -61
  35. package/src/cli/commands/init/bootstrap.ts +0 -111
  36. package/src/cli/commands/init/index.ts +0 -244
  37. package/src/cli/commands/init/skills.ts +0 -141
  38. package/src/cli/commands/init/templates/agents.md +0 -86
  39. package/src/cli/commands/init/templates/markdown.d.ts +0 -4
  40. package/src/cli/commands/init/templates/skills/warm-up-target.md +0 -122
  41. package/src/cli/commands/init/templates/skills/zond-checks.md +0 -621
  42. package/src/cli/commands/init/templates/skills/zond-seed.md +0 -114
  43. package/src/cli/commands/init/templates/skills/zond-triage.md +0 -272
  44. package/src/cli/commands/init/templates/skills/zond.md +0 -861
  45. package/src/cli/commands/init/templates/zond-config.yml +0 -14
  46. package/src/cli/commands/prepare-fixtures.ts +0 -97
  47. package/src/cli/commands/probe/_seed-bodies.ts +0 -52
  48. package/src/cli/commands/probe/mass-assignment.ts +0 -594
  49. package/src/cli/commands/probe/security.ts +0 -537
  50. package/src/cli/commands/probe/static.ts +0 -255
  51. package/src/cli/commands/probe/webhooks.ts +0 -163
  52. package/src/cli/commands/probe.ts +0 -535
  53. package/src/cli/commands/reference.ts +0 -87
  54. package/src/cli/commands/refresh-api.ts +0 -227
  55. package/src/cli/commands/remove-api.ts +0 -150
  56. package/src/cli/commands/report-bundle.ts +0 -310
  57. package/src/cli/commands/report.ts +0 -241
  58. package/src/cli/commands/request.ts +0 -548
  59. package/src/cli/commands/run.ts +0 -1142
  60. package/src/cli/commands/schema-from-runs.ts +0 -128
  61. package/src/cli/commands/secrets.ts +0 -133
  62. package/src/cli/commands/session.ts +0 -244
  63. package/src/cli/commands/use.ts +0 -74
  64. package/src/cli/index.ts +0 -55
  65. package/src/cli/json-envelope.ts +0 -108
  66. package/src/cli/json-schemas.ts +0 -314
  67. package/src/cli/output.ts +0 -40
  68. package/src/cli/program.ts +0 -219
  69. package/src/cli/resolve.ts +0 -105
  70. package/src/cli/runtime.ts +0 -7
  71. package/src/cli/safe-live.ts +0 -24
  72. package/src/cli/status-filter.ts +0 -114
  73. package/src/cli/util/api-context.ts +0 -85
  74. package/src/cli/version.ts +0 -8
  75. package/src/core/audit/persist.ts +0 -183
  76. package/src/core/checks/budget.ts +0 -59
  77. package/src/core/checks/checks/_crud-helpers.ts +0 -133
  78. package/src/core/checks/checks/_negative_mutator.ts +0 -133
  79. package/src/core/checks/checks/_readback-helpers.ts +0 -133
  80. package/src/core/checks/checks/content_type_conformance.ts +0 -39
  81. package/src/core/checks/checks/cross_call_references.ts +0 -147
  82. package/src/core/checks/checks/cursor_boundary_fuzzing.ts +0 -219
  83. package/src/core/checks/checks/ensure_resource_availability.ts +0 -62
  84. package/src/core/checks/checks/idempotency_replay.ts +0 -242
  85. package/src/core/checks/checks/ignored_auth.ts +0 -254
  86. package/src/core/checks/checks/index.ts +0 -68
  87. package/src/core/checks/checks/lifecycle_transitions.ts +0 -416
  88. package/src/core/checks/checks/missing_required_header.ts +0 -40
  89. package/src/core/checks/checks/negative_data_rejection.ts +0 -148
  90. package/src/core/checks/checks/not_a_server_error.ts +0 -35
  91. package/src/core/checks/checks/open_cors_on_sensitive.ts +0 -160
  92. package/src/core/checks/checks/pagination_invariants.ts +0 -419
  93. package/src/core/checks/checks/positive_data_acceptance.ts +0 -33
  94. package/src/core/checks/checks/rate_limit_headers_absent.ts +0 -77
  95. package/src/core/checks/checks/response_headers_conformance.ts +0 -74
  96. package/src/core/checks/checks/response_schema_conformance.ts +0 -30
  97. package/src/core/checks/checks/status_code_conformance.ts +0 -132
  98. package/src/core/checks/checks/unsupported_method.ts +0 -63
  99. package/src/core/checks/checks/use_after_free.ts +0 -78
  100. package/src/core/checks/index.ts +0 -30
  101. package/src/core/checks/mode.ts +0 -82
  102. package/src/core/checks/recommended-action.ts +0 -68
  103. package/src/core/checks/registry.ts +0 -78
  104. package/src/core/checks/runner.ts +0 -1461
  105. package/src/core/checks/sarif.ts +0 -230
  106. package/src/core/checks/spec-findings.ts +0 -308
  107. package/src/core/checks/stateful.ts +0 -121
  108. package/src/core/checks/types.ts +0 -305
  109. package/src/core/checks/zond-extensions.ts +0 -73
  110. package/src/core/classifier/recommended-action.ts +0 -251
  111. package/src/core/context/current.ts +0 -51
  112. package/src/core/context/session.ts +0 -78
  113. package/src/core/coverage/loader.ts +0 -216
  114. package/src/core/coverage/reasons.ts +0 -300
  115. package/src/core/diagnostics/db-analysis.ts +0 -666
  116. package/src/core/diagnostics/failure-class.ts +0 -140
  117. package/src/core/diagnostics/failure-hints.ts +0 -112
  118. package/src/core/diagnostics/spec-pointer.ts +0 -99
  119. package/src/core/diagnostics/suggested-fixes.ts +0 -155
  120. package/src/core/exporter/case-study/index.ts +0 -270
  121. package/src/core/exporter/curl.ts +0 -40
  122. package/src/core/exporter/exporter.ts +0 -48
  123. package/src/core/exporter/html-report/escape.ts +0 -24
  124. package/src/core/exporter/html-report/index.ts +0 -479
  125. package/src/core/exporter/html-report/script.ts +0 -100
  126. package/src/core/exporter/html-report/styles.ts +0 -408
  127. package/src/core/generator/catalog-builder.ts +0 -179
  128. package/src/core/generator/chunker.ts +0 -78
  129. package/src/core/generator/coverage-phase.ts +0 -0
  130. package/src/core/generator/coverage-scanner.ts +0 -87
  131. package/src/core/generator/data-factory.ts +0 -759
  132. package/src/core/generator/describe.ts +0 -302
  133. package/src/core/generator/endpoint-warnings.ts +0 -52
  134. package/src/core/generator/fixtures-builder.ts +0 -332
  135. package/src/core/generator/index.ts +0 -14
  136. package/src/core/generator/openapi-reader.ts +0 -297
  137. package/src/core/generator/path-param-disambig.ts +0 -140
  138. package/src/core/generator/resources-builder.ts +0 -898
  139. package/src/core/generator/schema-utils.ts +0 -112
  140. package/src/core/generator/serializer.ts +0 -343
  141. package/src/core/generator/suite-generator.ts +0 -1301
  142. package/src/core/generator/types.ts +0 -63
  143. package/src/core/identity/identity-file.ts +0 -0
  144. package/src/core/lint/affects.ts +0 -28
  145. package/src/core/lint/config.ts +0 -96
  146. package/src/core/lint/format.ts +0 -42
  147. package/src/core/lint/index.ts +0 -94
  148. package/src/core/lint/reporter.ts +0 -128
  149. package/src/core/lint/rules/consistency.ts +0 -158
  150. package/src/core/lint/rules/heuristics.ts +0 -97
  151. package/src/core/lint/rules/strictness.ts +0 -109
  152. package/src/core/lint/types.ts +0 -96
  153. package/src/core/lint/walker.ts +0 -248
  154. package/src/core/meta/meta-store.ts +0 -11
  155. package/src/core/output/README.md +0 -73
  156. package/src/core/output/index.ts +0 -13
  157. package/src/core/output/run.ts +0 -91
  158. package/src/core/output/types.ts +0 -122
  159. package/src/core/parser/dynamic-values.ts +0 -160
  160. package/src/core/parser/env-interpolation.ts +0 -104
  161. package/src/core/parser/filter.ts +0 -97
  162. package/src/core/parser/schema.ts +0 -359
  163. package/src/core/parser/types.ts +0 -117
  164. package/src/core/parser/variables.ts +0 -0
  165. package/src/core/parser/yaml-parser.ts +0 -181
  166. package/src/core/probe/bootstrap.ts +0 -34
  167. package/src/core/probe/dry-run-envelope.ts +0 -61
  168. package/src/core/probe/mass-assignment/classify.ts +0 -175
  169. package/src/core/probe/mass-assignment/cleanup.ts +0 -52
  170. package/src/core/probe/mass-assignment/digest.ts +0 -114
  171. package/src/core/probe/mass-assignment/orchestrator.ts +0 -459
  172. package/src/core/probe/mass-assignment/regression.ts +0 -141
  173. package/src/core/probe/mass-assignment/suspects.ts +0 -92
  174. package/src/core/probe/mass-assignment/types.ts +0 -135
  175. package/src/core/probe/mass-assignment-probe-class.ts +0 -198
  176. package/src/core/probe/mass-assignment-probe.ts +0 -27
  177. package/src/core/probe/mass-assignment-template.ts +0 -240
  178. package/src/core/probe/method-probe.ts +0 -164
  179. package/src/core/probe/method-shared.ts +0 -69
  180. package/src/core/probe/negative-probe.ts +0 -691
  181. package/src/core/probe/orphan-tracker.ts +0 -188
  182. package/src/core/probe/path-discovery.ts +0 -439
  183. package/src/core/probe/probe-harness.ts +0 -119
  184. package/src/core/probe/registry.ts +0 -89
  185. package/src/core/probe/runner.ts +0 -136
  186. package/src/core/probe/security/baseline.ts +0 -174
  187. package/src/core/probe/security/classify.ts +0 -341
  188. package/src/core/probe/security/cleanup.ts +0 -125
  189. package/src/core/probe/security/detectors.ts +0 -71
  190. package/src/core/probe/security/digest.ts +0 -104
  191. package/src/core/probe/security/orchestrator.ts +0 -398
  192. package/src/core/probe/security/regression.ts +0 -103
  193. package/src/core/probe/security/types.ts +0 -151
  194. package/src/core/probe/security-probe-class.ts +0 -207
  195. package/src/core/probe/security-probe.ts +0 -32
  196. package/src/core/probe/shared.ts +0 -531
  197. package/src/core/probe/static-probe-class.ts +0 -125
  198. package/src/core/probe/types.ts +0 -165
  199. package/src/core/probe/verdict-aggregator.ts +0 -33
  200. package/src/core/probe/webhooks-probe.ts +0 -282
  201. package/src/core/reporter/console.ts +0 -240
  202. package/src/core/reporter/index.ts +0 -22
  203. package/src/core/reporter/json.ts +0 -22
  204. package/src/core/reporter/junit.ts +0 -93
  205. package/src/core/reporter/ndjson.ts +0 -37
  206. package/src/core/reporter/types.ts +0 -15
  207. package/src/core/runner/assertions.ts +0 -383
  208. package/src/core/runner/async-pool.ts +0 -108
  209. package/src/core/runner/auth-path.ts +0 -8
  210. package/src/core/runner/ci-context.ts +0 -72
  211. package/src/core/runner/executor.ts +0 -652
  212. package/src/core/runner/expr-eval.ts +0 -41
  213. package/src/core/runner/form-encode.ts +0 -41
  214. package/src/core/runner/http-client.ts +0 -224
  215. package/src/core/runner/learn-drift.ts +0 -293
  216. package/src/core/runner/preflight-vars.ts +0 -153
  217. package/src/core/runner/progress-tracker.ts +0 -73
  218. package/src/core/runner/rate-limiter.ts +0 -185
  219. package/src/core/runner/run-kind.ts +0 -45
  220. package/src/core/runner/schema-validator.ts +0 -308
  221. package/src/core/runner/send-request.ts +0 -232
  222. package/src/core/runner/transforms.ts +0 -65
  223. package/src/core/runner/types.ts +0 -94
  224. package/src/core/secrets/registry.ts +0 -164
  225. package/src/core/secrets/secrets-file.ts +0 -115
  226. package/src/core/selectors/operation-filter.ts +0 -144
  227. package/src/core/setup-api.ts +0 -590
  228. package/src/core/severity/category.ts +0 -94
  229. package/src/core/severity/index.ts +0 -58
  230. package/src/core/spec/infer-schema.ts +0 -102
  231. package/src/core/spec/layers.ts +0 -154
  232. package/src/core/spec/merge-specs.ts +0 -156
  233. package/src/core/spec/schema-from-runs.ts +0 -117
  234. package/src/core/spec/schema-overlay.ts +0 -130
  235. package/src/core/util/ajv.ts +0 -13
  236. package/src/core/util/format-eta.ts +0 -21
  237. package/src/core/util/headers.ts +0 -9
  238. package/src/core/util/url.ts +0 -24
  239. package/src/core/utils.ts +0 -13
  240. package/src/core/workspace/config.ts +0 -129
  241. package/src/core/workspace/fixture-gap-report.ts +0 -84
  242. package/src/core/workspace/fixture-gaps.ts +0 -71
  243. package/src/core/workspace/manifest.ts +0 -283
  244. package/src/core/workspace/output-rotation.ts +0 -62
  245. package/src/core/workspace/root.ts +0 -96
  246. package/src/core/workspace/triage-path.ts +0 -87
  247. package/src/db/lint-runs.ts +0 -47
  248. package/src/db/migrate.ts +0 -128
  249. package/src/db/migrations/0001_run_kind.sql +0 -25
  250. package/src/db/migrations/0002_run_kind_request.sql +0 -59
  251. package/src/db/migrations/sql.d.ts +0 -4
  252. package/src/db/queries/collections.ts +0 -133
  253. package/src/db/queries/coverage.ts +0 -9
  254. package/src/db/queries/dashboard.ts +0 -59
  255. package/src/db/queries/results.ts +0 -216
  256. package/src/db/queries/runs.ts +0 -289
  257. package/src/db/queries/sessions.ts +0 -42
  258. package/src/db/queries/settings.ts +0 -28
  259. package/src/db/queries/types.ts +0 -172
  260. package/src/db/queries.ts +0 -75
  261. package/src/db/schema.ts +0 -298
@@ -1,111 +0,0 @@
1
- import { existsSync, mkdirSync, writeFileSync } from "node:fs";
2
- import { join, resolve } from "node:path";
3
-
4
- import { upsertAgentsBlock, type AgentsBlockResult } from "./agents-md.ts";
5
- import {
6
- detectStaleSkills,
7
- pruneStaleSkills,
8
- upsertSkills,
9
- type SkillResult,
10
- type StaleSkill,
11
- } from "./skills.ts";
12
- import zondConfigTemplate from "./templates/zond-config.yml" with { type: "text" };
13
-
14
- export interface BootstrapOptions {
15
- cwd?: string;
16
- /** Whether to write/upsert AGENTS.md. Defaults to true. */
17
- writeAgents?: boolean;
18
- /** Whether to write Claude Code skills under .claude/skills/. Defaults to true. */
19
- writeSkills?: boolean;
20
- /** Remove legacy skill dirs (zond-base, zond-scenarios, …) instead of just warning. */
21
- pruneStaleSkills?: boolean;
22
- /** Override $HOME — used by tests and intentional overrides. */
23
- home?: string;
24
- dryRun?: boolean;
25
- }
26
-
27
- export interface BootstrapResult {
28
- cwd: string;
29
- configPath: string;
30
- configAction: "created" | "noop";
31
- apisDir: string;
32
- apisAction: "created" | "noop";
33
- agents: AgentsBlockResult | null;
34
- skills: SkillResult[];
35
- /** Legacy skill dirs that exist on disk but are no longer in `SKILLS`. */
36
- staleSkills: StaleSkill[];
37
- /** Subset of `staleSkills` that were actually removed (empty unless `pruneStaleSkills`). */
38
- prunedSkills: StaleSkill[];
39
- warnings: string[];
40
- }
41
-
42
- /**
43
- * Idempotent workspace bootstrap. Creates `zond.config.yml`, `apis/`, and
44
- * (unless `writeAgents` is false) `AGENTS.md`.
45
- */
46
- export function bootstrapWorkspace(opts: BootstrapOptions = {}): BootstrapResult {
47
- // Honor ZOND_WORKSPACE so `zond init` writes the workspace at the same root
48
- // that findWorkspaceRoot() reads from (headless/CI runs anchor both here).
49
- // Explicit opts.cwd (tests) still wins.
50
- const cwd = resolve(opts.cwd ?? process.env.ZOND_WORKSPACE?.trim() ?? process.cwd());
51
- const warnings: string[] = [];
52
- const writeAgents = opts.writeAgents ?? true;
53
- const writeSkills = opts.writeSkills ?? true;
54
-
55
- // 1. zond.config.yml
56
- const configPath = join(cwd, "zond.config.yml");
57
- let configAction: "created" | "noop" = "noop";
58
- if (!existsSync(configPath)) {
59
- if (!opts.dryRun) writeFileSync(configPath, zondConfigTemplate, "utf-8");
60
- configAction = "created";
61
- }
62
-
63
- // 2. apis/
64
- const apisDir = join(cwd, "apis");
65
- let apisAction: "created" | "noop" = "noop";
66
- if (!existsSync(apisDir)) {
67
- if (!opts.dryRun) mkdirSync(apisDir, { recursive: true });
68
- apisAction = "created";
69
- }
70
-
71
- // 3. AGENTS.md
72
- let agents: AgentsBlockResult | null = null;
73
- if (writeAgents) {
74
- if (!opts.dryRun) {
75
- agents = upsertAgentsBlock(cwd);
76
- } else {
77
- agents = { path: join(cwd, "AGENTS.md"), action: existsSync(join(cwd, "AGENTS.md")) ? "updated" : "created" };
78
- }
79
- }
80
-
81
- // 4. .claude/skills/zond-*/SKILL.md
82
- const skills: SkillResult[] = writeSkills ? upsertSkills(cwd, { dryRun: opts.dryRun }) : [];
83
-
84
- // 5. Detect (and optionally prune) legacy skill dirs left over from
85
- // retired templates. User-authored skill dirs are NOT touched —
86
- // only names in `LEGACY_SKILL_NAMES` are considered.
87
- const staleSkills = writeSkills ? detectStaleSkills(cwd) : [];
88
- let prunedSkills: StaleSkill[] = [];
89
- if (writeSkills && opts.pruneStaleSkills && staleSkills.length > 0) {
90
- prunedSkills = pruneStaleSkills(cwd, { dryRun: opts.dryRun });
91
- } else if (staleSkills.length > 0) {
92
- for (const { name } of staleSkills) {
93
- warnings.push(
94
- `stale skill detected: .claude/skills/${name}/ — re-run with --prune-stale-skills to remove`,
95
- );
96
- }
97
- }
98
-
99
- return {
100
- cwd,
101
- configPath,
102
- configAction,
103
- apisDir,
104
- apisAction,
105
- agents,
106
- skills,
107
- staleSkills,
108
- prunedSkills,
109
- warnings,
110
- };
111
- }
@@ -1,244 +0,0 @@
1
- import { existsSync, readdirSync } from "node:fs";
2
- import { setupApi, type SetupApiResult } from "../../../core/setup-api.ts";
3
- import { printError, printSuccess } from "../../output.ts";
4
- import { jsonOk, jsonError, printJson } from "../../json-envelope.ts";
5
- import { bootstrapWorkspace, type BootstrapResult } from "./bootstrap.ts";
6
-
7
- export interface InitOptions {
8
- // register-an-API options (existing)
9
- name?: string;
10
- spec?: string;
11
- baseUrl?: string;
12
- dir?: string;
13
- force?: boolean;
14
- insecure?: boolean;
15
- dbPath?: string;
16
- json?: boolean;
17
-
18
- // workspace bootstrap (new)
19
- workspace?: boolean;
20
- withSpec?: string;
21
- /** Skip writing AGENTS.md. */
22
- noAgents?: boolean;
23
- /** Skip writing Claude Code skills under .claude/skills/. */
24
- noSkills?: boolean;
25
- /** Remove legacy skill dirs (zond-base, zond-scenarios, …) — by default a warning is printed. */
26
- pruneStaleSkills?: boolean;
27
- /** Override cwd for bootstrap (used by tests; CLI always uses process.cwd()). */
28
- cwd?: string;
29
- /** Override $HOME for MCP install (used by tests). */
30
- home?: string;
31
- }
32
-
33
- type InitMode = "register" | "workspace" | "bootstrap+register";
34
-
35
- function resolveMode(options: InitOptions): InitMode {
36
- if (options.spec) return "register";
37
- if (options.withSpec) return "bootstrap+register";
38
- return "workspace";
39
- }
40
-
41
- export async function initCommand(options: InitOptions): Promise<number> {
42
- // Reject conflicting combos
43
- if (options.spec && options.workspace) {
44
- const msg = "Cannot use --spec and --workspace together. Use --with-spec to bootstrap and register in one step.";
45
- if (options.json) printJson(jsonError("init", [msg]));
46
- else printError(msg);
47
- return 2;
48
- }
49
-
50
- const mode = resolveMode(options);
51
- const writeAgents = !options.noAgents;
52
- const writeSkills = !options.noSkills;
53
-
54
- try {
55
- if (mode === "register") {
56
- const result = await registerApi(options);
57
- printRegisterResult(options, result);
58
- return 0;
59
- }
60
-
61
- const bootstrap = bootstrapWorkspace({
62
- writeAgents,
63
- writeSkills,
64
- pruneStaleSkills: options.pruneStaleSkills,
65
- cwd: options.cwd,
66
- home: options.home,
67
- });
68
- let register: SetupApiResult | null = null;
69
-
70
- if (mode === "bootstrap+register") {
71
- register = await registerApi({ ...options, spec: options.withSpec });
72
- }
73
-
74
- if (options.json) {
75
- const data: Record<string, unknown> = {
76
- mode,
77
- configPath: bootstrap.configPath,
78
- configAction: bootstrap.configAction,
79
- apisDir: bootstrap.apisDir,
80
- apisAction: bootstrap.apisAction,
81
- agentsPath: bootstrap.agents?.path ?? null,
82
- agentsAction: bootstrap.agents?.action ?? null,
83
- skills: bootstrap.skills.map((s) => ({ name: s.name, path: s.path, action: s.action })),
84
- staleSkills: bootstrap.staleSkills.map((s) => ({ name: s.name, path: s.path })),
85
- prunedSkills: bootstrap.prunedSkills.map((s) => ({ name: s.name, path: s.path })),
86
- };
87
- if (register) {
88
- data.collectionId = register.collectionId;
89
- data.baseDir = register.baseDir;
90
- data.testPath = register.testPath;
91
- data.endpoints = register.specEndpoints;
92
- }
93
- printJson(jsonOk("init", data, [...bootstrap.warnings, ...(register?.warnings ?? [])]));
94
- } else {
95
- printBootstrapResult(bootstrap, writeAgents);
96
- if (register) printRegisterResult(options, register);
97
- }
98
- return 0;
99
- } catch (err) {
100
- const message = err instanceof Error ? err.message : String(err);
101
- if (options.json) printJson(jsonError("init", [message]));
102
- else printError(message);
103
- return 2;
104
- }
105
- }
106
-
107
- async function registerApi(options: InitOptions): Promise<SetupApiResult> {
108
- const envVars: Record<string, string> = {};
109
- if (options.baseUrl) envVars.base_url = options.baseUrl;
110
-
111
- return await setupApi({
112
- name: options.name,
113
- spec: options.spec ?? options.withSpec,
114
- dir: options.dir,
115
- envVars: Object.keys(envVars).length > 0 ? envVars : undefined,
116
- dbPath: options.dbPath,
117
- force: options.force,
118
- insecure: options.insecure,
119
- });
120
- }
121
-
122
- function printRegisterResult(options: InitOptions, result: SetupApiResult): void {
123
- if (options.json) {
124
- // Only used by the legacy "register"-only path
125
- printJson(jsonOk("init", {
126
- mode: "register",
127
- collectionId: result.collectionId,
128
- baseDir: result.baseDir,
129
- testPath: result.testPath,
130
- endpoints: result.specEndpoints,
131
- }, result.warnings));
132
- return;
133
- }
134
- printSuccess(`Created API '${options.name ?? "api"}' at ${result.baseDir} (${result.specEndpoints} endpoints)`);
135
- if (result.warnings) {
136
- for (const w of result.warnings) process.stderr.write(`Warning: ${w}\n`);
137
- }
138
- }
139
-
140
- function printBootstrapResult(b: BootstrapResult, writeAgents: boolean): void {
141
- const lines: string[] = [];
142
- lines.push(` ${verb(b.configAction)} zond.config.yml`);
143
- lines.push(` ${verb(b.apisAction)} apis/`);
144
- if (b.agents) lines.push(` ${verb(b.agents.action)} AGENTS.md`);
145
- for (const s of b.skills) {
146
- lines.push(` ${verb(s.action)} .claude/skills/${s.name}/SKILL.md`);
147
- }
148
- for (const s of b.prunedSkills) {
149
- lines.push(` Removed .claude/skills/${s.name}/ (stale)`);
150
- }
151
- for (const w of b.warnings) {
152
- process.stderr.write(`Warning: ${w}\n`);
153
- }
154
- process.stdout.write(lines.join("\n") + "\n");
155
- if (!writeAgents) {
156
- printSuccess("Workspace ready. Run `zond init --spec <path>` to register your first API.");
157
- } else {
158
- printSuccess("Workspace ready. See AGENTS.md for the CLI workflow.");
159
- }
160
- const apiNames = listExistingApis(b.cwd);
161
- if (apiNames.length === 0) {
162
- process.stderr.write(
163
- `\nNext steps:\n` +
164
- ` 1. zond add api <name> --spec <path|url> # register API → builds .api-fixtures.yaml (manifest)\n` +
165
- ` 2. zond doctor --api <name> # gap report: which vars are UNSET in .env.yaml\n` +
166
- ` 3. zond prepare-fixtures --api <name> --apply # fill .env.yaml values (single-pass); fill any gaps by hand\n` +
167
- `\nNote: zond init only refreshes workspace files (skills, AGENTS.md, zond.config.yml).\n` +
168
- ` It does NOT touch fixtures or .env.yaml — that's the doctor/prepare-fixtures loop above.\n`
169
- );
170
- } else {
171
- const sample = apiNames[0]!;
172
- process.stderr.write(
173
- `\nFixtures untouched. zond init only refreshes skills/AGENTS.md/zond.config.yml.\n` +
174
- `Verify env state with:\n` +
175
- ` zond doctor --api ${sample} --missing-only # show UNSET vars + blocked endpoints\n` +
176
- ` zond prepare-fixtures --api ${sample} --apply # discover values (single-pass); fill any gaps by hand\n`
177
- );
178
- }
179
- }
180
-
181
- function listExistingApis(cwd: string): string[] {
182
- try {
183
- const apisDir = `${cwd}/apis`;
184
- if (!existsSync(apisDir)) return [];
185
- return readdirSync(apisDir, { withFileTypes: true })
186
- .filter((d) => d.isDirectory() && existsSync(`${apisDir}/${d.name}/spec.json`))
187
- .map((d) => d.name)
188
- .sort();
189
- } catch {
190
- return [];
191
- }
192
- }
193
-
194
- function verb(action: "created" | "updated" | "noop"): string {
195
- return action === "created" ? "Created" : action === "updated" ? "Updated" : "Up-to-date:";
196
- }
197
-
198
- import type { Command } from "commander";
199
- import { globalJson } from "../../resolve.ts";
200
-
201
- export function registerInit(program: Command): void {
202
- program
203
- .command("init [spec]")
204
- .description("Bootstrap a workspace, or register an API when --spec is given")
205
- .option("--name <name>", "API name (auto-detected from spec title if omitted)")
206
- .option("--spec <path>", "Path to OpenAPI spec file (registers a single API)")
207
- .option("--base-url <url>", "Override base URL")
208
- .option("--dir <path>", "Target directory")
209
- .option("--force", "Overwrite existing API collection")
210
- .option("--insecure", "Skip TLS verification when fetching the spec")
211
- .option("--db <path>", "Path to SQLite database file")
212
- .option("--workspace", "Bootstrap a zond workspace (zond.config.yml, apis/, AGENTS.md)")
213
- .option("--with-spec <path>", "Bootstrap workspace AND register first API from spec")
214
- .option("--no-agents-md", "Skip writing AGENTS.md when bootstrapping")
215
- .option("--no-skills", "Skip writing Claude Code skills under .claude/skills/")
216
- .option(
217
- "--prune-stale-skills",
218
- "Remove .claude/skills/ dirs for retired template names (zond-base, zond-scenarios)",
219
- )
220
- .action(async (specPos: string | undefined, opts, cmd: Command) => {
221
- const spec = opts.spec ?? specPos;
222
- const json = globalJson(cmd);
223
- if ((spec || opts.withSpec) && !json) {
224
- process.stderr.write(
225
- `Warning: 'zond init --spec' / '--with-spec' is deprecated. Use \`zond add api <name> --spec <path>\` (run \`zond init\` separately to bootstrap the workspace).\n`,
226
- );
227
- }
228
- process.exitCode = await initCommand({
229
- name: opts.name,
230
- spec,
231
- baseUrl: opts.baseUrl,
232
- dir: opts.dir,
233
- force: opts.force === true,
234
- insecure: opts.insecure === true,
235
- dbPath: opts.db,
236
- workspace: opts.workspace === true,
237
- withSpec: opts.withSpec,
238
- noAgents: opts.agentsMd === false,
239
- noSkills: opts.skills === false,
240
- pruneStaleSkills: opts.pruneStaleSkills === true,
241
- json,
242
- });
243
- });
244
- }
@@ -1,141 +0,0 @@
1
- import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
2
- import { dirname, join } from "node:path";
3
-
4
- import zondSkill from "./templates/skills/zond.md" with { type: "text" };
5
- import checksSkill from "./templates/skills/zond-checks.md" with { type: "text" };
6
- import triageSkill from "./templates/skills/zond-triage.md" with { type: "text" };
7
- import seedSkill from "./templates/skills/zond-seed.md" with { type: "text" };
8
- import warmUpSkill from "./templates/skills/warm-up-target.md" with { type: "text" };
9
-
10
- export interface SkillResult {
11
- name: string;
12
- path: string;
13
- action: "created" | "updated" | "noop";
14
- }
15
-
16
- interface SkillTemplate {
17
- name: string;
18
- body: string;
19
- }
20
-
21
- const SKILLS: SkillTemplate[] = [
22
- // Primary skill: artifact model + iron rules + full workflow
23
- // (init → fixtures → annotate → generate → run → stateful checks →
24
- // probes → coverage → share) + single-flow scenario authoring.
25
- { name: "zond", body: zondSkill },
26
- // Depth-check reference: conformance + security + m-20 stateful
27
- // (cross_call_references, idempotency_replay, pagination_invariants,
28
- // lifecycle_transitions) with per-aspect annotate flow.
29
- { name: "zond-checks", body: checksSkill },
30
- // Read-only triage of a finished run / probe artifact.
31
- { name: "zond-triage", body: triageSkill },
32
- // ARV-355: agent-orchestrated auto-seed loop (read gaps → order by
33
- // fkDependencies → author body → request POST --capture → fix 4xx + retry).
34
- { name: "zond-seed", body: seedSkill },
35
- // ARV-366: warm up external-input fixtures (issue_id/file_id/integration_id)
36
- // via the target's own SDK/CLI/replay — the honest-2xx ceiling zond-seed
37
- // can't reach with a plain POST. Agent warms, zond stores + measures.
38
- { name: "warm-up-target", body: warmUpSkill },
39
- ];
40
-
41
- /**
42
- * Names previously emitted by `upsertSkills` but no longer in `SKILLS`.
43
- * Detected as stale by `detectStaleSkills` and removed by
44
- * `pruneStaleSkills` (only when the user opts in via `--prune-stale-skills`).
45
- *
46
- * Append a name here whenever a skill template is retired. User-authored
47
- * skills (any name NOT in this list) are never touched.
48
- */
49
- const LEGACY_SKILL_NAMES: readonly string[] = [
50
- "zond-base", // retired by skills-consolidation refactor (folded into zond)
51
- "zond-scenarios", // retired by skills-consolidation refactor (folded into zond)
52
- ] as const;
53
-
54
- export interface StaleSkill {
55
- name: string;
56
- path: string;
57
- }
58
-
59
- /**
60
- * Per-skill drift status vs the in-binary template. `missing` is
61
- * non-actionable on its own (user may have intentionally passed
62
- * `--no-skills`); `outdated` is the actionable one — workspace skill
63
- * predates a binary upgrade and `zond init` will refresh it.
64
- */
65
- export type SkillDriftStatus = "fresh" | "outdated" | "missing";
66
-
67
- export interface SkillDrift {
68
- name: string;
69
- path: string;
70
- status: SkillDriftStatus;
71
- }
72
-
73
- /**
74
- * Compare each in-binary skill template against the workspace copy at
75
- * `<cwd>/.claude/skills/<name>/SKILL.md`. Returns one entry per skill —
76
- * callers filter by status (`outdated` → warn the user to re-run
77
- * `zond init`).
78
- */
79
- export function detectSkillDrift(cwd: string): SkillDrift[] {
80
- return SKILLS.map(({ name, body }) => {
81
- const path = join(cwd, ".claude", "skills", name, "SKILL.md");
82
- const desired = body.endsWith("\n") ? body : body + "\n";
83
- if (!existsSync(path)) return { name, path, status: "missing" as const };
84
- const current = readFileSync(path, "utf-8");
85
- return {
86
- name,
87
- path,
88
- status: (current === desired ? "fresh" : "outdated") as SkillDriftStatus,
89
- };
90
- });
91
- }
92
-
93
- /**
94
- * Returns directories under `<cwd>/.claude/skills/` whose name is in
95
- * `LEGACY_SKILL_NAMES`. User-authored skill directories (any other
96
- * name) are intentionally ignored.
97
- */
98
- export function detectStaleSkills(cwd: string): StaleSkill[] {
99
- const out: StaleSkill[] = [];
100
- for (const name of LEGACY_SKILL_NAMES) {
101
- const path = join(cwd, ".claude", "skills", name);
102
- if (existsSync(path)) out.push({ name, path });
103
- }
104
- return out;
105
- }
106
-
107
- /**
108
- * Recursively removes the directories returned by `detectStaleSkills`.
109
- * Returns the list of names that were actually removed.
110
- */
111
- export function pruneStaleSkills(cwd: string, opts: { dryRun?: boolean } = {}): StaleSkill[] {
112
- const stale = detectStaleSkills(cwd);
113
- if (!opts.dryRun) {
114
- for (const { path } of stale) rmSync(path, { recursive: true, force: true });
115
- }
116
- return stale;
117
- }
118
-
119
- /**
120
- * Idempotently writes Claude Code skills into `<cwd>/.claude/skills/<name>/SKILL.md`.
121
- * Body is identical to the in-binary template — overwrites on drift, noop on match.
122
- */
123
- export function upsertSkills(cwd: string, opts: { dryRun?: boolean } = {}): SkillResult[] {
124
- return SKILLS.map(({ name, body }) => {
125
- const path = join(cwd, ".claude", "skills", name, "SKILL.md");
126
- const desired = body.endsWith("\n") ? body : body + "\n";
127
-
128
- if (!existsSync(path)) {
129
- if (!opts.dryRun) {
130
- mkdirSync(dirname(path), { recursive: true });
131
- writeFileSync(path, desired, "utf-8");
132
- }
133
- return { name, path, action: "created" };
134
- }
135
-
136
- const current = readFileSync(path, "utf-8");
137
- if (current === desired) return { name, path, action: "noop" };
138
- if (!opts.dryRun) writeFileSync(path, desired, "utf-8");
139
- return { name, path, action: "updated" };
140
- });
141
- }
@@ -1,86 +0,0 @@
1
- ## API testing with zond
2
-
3
- This workspace uses [zond](https://github.com/kirrosh/zond) for API testing — CLI
4
- only, no MCP server in this workspace.
5
-
6
- ### Skills
7
-
8
- - **`.claude/skills/zond/SKILL.md` (primary)** — artifact model + iron
9
- rules + full workflow: fixtures → annotate → generate → smoke → CRUD
10
- → stateful checks → probes → coverage → report, plus single-flow
11
- scenario authoring. Loads on workspace touch and on intent ("audit
12
- this API", "find bugs", "write a test for X flow").
13
- - **`.claude/skills/zond-checks/SKILL.md`** — depth-check reference:
14
- conformance + security + m-20 stateful invariants
15
- (cross_call_references, idempotency_replay, pagination_invariants,
16
- lifecycle_transitions) and the `zond api annotate dump+apply` flow.
17
- - **`.claude/skills/zond-triage/SKILL.md`** — read-only triage of a
18
- finished run / probe artifact. Routes by `recommended_action` enum.
19
- - **`.claude/skills/zond-seed/SKILL.md`** — agent-orchestrated seed loop:
20
- read fixture gaps → order by FK deps → author body → `request POST
21
- --capture` → fix 4xx + retry. Fills what `prepare-fixtures` reports missing.
22
- - **`.claude/skills/warm-up-target/SKILL.md`** — warm external-input
23
- fixtures (issue_id/file_id/integration_id) via the target's own
24
- SDK/CLI/replay — the honest-2xx ceiling a plain POST can't reach.
25
-
26
- These skills work off the per-API artifacts written by `zond add api`:
27
-
28
- ```
29
- apis/<name>/
30
- spec.json # dereferenced OpenAPI (machine source — only generators read it)
31
- .api-catalog.yaml # endpoint index (cheap to read, agent-friendly)
32
- .api-resources.yaml # CRUD chains, FK deps, ETag/soft-delete flags
33
- .api-fixtures.yaml # MANIFEST: required {{vars}} (read-only, auto-generated)
34
- .env.yaml # VALUES: variable values (user-edited; auto-gitignored)
35
- tests/ scenarios/ probes/
36
- ```
37
-
38
- `.api-fixtures.yaml` is the **manifest** (single source of truth for the
39
- list of vars an API needs) and `.env.yaml` holds their **values**. Don't
40
- add a key to `.env.yaml` that's not in the manifest — it'll be warned and
41
- ignored. A missing entry in the manifest is a generator/manifest bug, not
42
- an env fix.
43
-
44
- ### Setup flow
45
-
46
- ```bash
47
- zond init # bootstrap workspace (no fixture changes)
48
- zond add api <name> --spec <path-or-url> # register API + emit manifest + seed empty .env.yaml
49
- zond doctor --api <name> --missing-only # gap report: which vars are UNSET
50
- zond prepare-fixtures --api <name> # gap report: verify + which FK vars need a value
51
- # → fill each gap yourself: `zond fixtures add` / edit .env.yaml (you pick the value)
52
- zond doctor --api <name> # re-check (exit 0 = ready)
53
- ```
54
-
55
- What each step does to `.env.yaml`:
56
-
57
- | Command | Touches `.env.yaml`? |
58
- |---|---|
59
- | `zond init` | no — only writes workspace/skills files |
60
- | `zond add api` | seeds skeleton with empty placeholders for every required var |
61
- | `zond doctor` | no — read-only diagnostic |
62
- | `zond prepare-fixtures` | no — reports gaps only; **never harvests a value** (which record/field fills a slot is your call) |
63
- | `zond prepare-fixtures --refresh` | unsets stale (404) ids so they resurface as gaps (`.bak` backup); does not re-resolve |
64
- | `zond fixtures add` / `import` | writes the value you supply (`.bak` backup) |
65
- | `zond refresh-api` | no — only re-snapshots `spec.json` and rebuilds the manifest |
66
-
67
- `zond refresh-api <name> [--spec <new-source>]` re-snapshots when the upstream
68
- spec changes.
69
-
70
- **Re-running `zond init`** is safe and expected after a CLI upgrade: it
71
- re-emits skills/AGENTS.md/zond.config.yml only. Fixtures stay exactly as
72
- they were — never relies on init to fill `.env.yaml`.
73
-
74
- ### Mandatory rules (mirrored from the skills — non-negotiable)
75
-
76
- - **NEVER read raw OpenAPI/Swagger** with Read/cat/grep — use the artifacts
77
- in `apis/<name>/.api-*.yaml`. Drop into `spec.json` only when a probe
78
- generator needs full schemas.
79
- - **NEVER use curl/wget** — use `zond request <method> <url>` for ad-hoc HTTP.
80
- - **NEVER write test YAML from scratch for autogen flows** — start with
81
- `zond generate`, then edit failures. (Hand-written YAML is fine for
82
- scenarios.)
83
- - **NEVER hardcode tokens** — `apis/<name>/.env.yaml` (auto-gitignored),
84
- reference as `{{auth_token}}`.
85
- - **`recommended_action: report_backend_bug` (5xx) → STOP**, do not edit
86
- assertions to make the test pass.
@@ -1,4 +0,0 @@
1
- declare module "*.md" {
2
- const content: string;
3
- export default content;
4
- }