@kynetic-ai/spec 0.4.0 → 0.6.0

package/dist/cli/commands/guard.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Native guard commands for kspec.
+ *
+ * Replaces bash shell script hooks with TypeScript CLI commands.
+ * `kspec guard worktree` replaces kspec-worktree-guard.sh.
+ *
+ * AC: @native-guard-commands ac-worktree-guard - blocks dangerous git ops in .kspec
+ * AC: @native-guard-commands ac-worktree-allow - allows safe commands
+ */
+import type { Command } from "commander";
+/**
+ * Decision from a guard check
+ */
+export interface GuardDecision {
+    decision: "allow" | "block";
+    reason?: string;
+}
+/**
+ * PreToolUse hook input from Claude Code
+ */
+interface PreToolUseInput {
+    tool_name?: string;
+    tool_input?: {
+        command?: string;
+    };
+    cwd?: string;
+}
+/**
+ * Evaluate a PreToolUse hook input and return a guard decision.
+ * This is the core logic, exported for testing.
+ *
+ * AC: @native-guard-commands ac-worktree-guard
+ * AC: @native-guard-commands ac-worktree-allow
+ */
+export declare function evaluateWorktreeGuard(input: PreToolUseInput): GuardDecision;
+/**
+ * Register the guard command group.
+ *
+ * AC: @trait-semantic-exit-codes ac-8 - exit code meanings documented in code
+ */
+export declare function registerGuardCommand(program: Command): void;
+export {};
+//# sourceMappingURL=guard.d.ts.map

package/dist/cli/commands/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,UAAU,eAAe;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AA2FD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,eAAe,GAAG,aAAa,CAiC3E;AAkBD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA4D3D"}

package/dist/cli/commands/guard.js

@@ -0,0 +1,200 @@
+/**
+ * Native guard commands for kspec.
+ *
+ * Replaces bash shell script hooks with TypeScript CLI commands.
+ * `kspec guard worktree` replaces kspec-worktree-guard.sh.
+ *
+ * AC: @native-guard-commands ac-worktree-guard - blocks dangerous git ops in .kspec
+ * AC: @native-guard-commands ac-worktree-allow - allows safe commands
+ */
+import { EXIT_CODES } from "../exit-codes.js";
+import { isJsonMode, output } from "../output.js";
+/**
+ * Dangerous git patterns that should be blocked when operating in .kspec/ worktree.
+ * These can corrupt session data or disrupt the kspec-meta branch.
+ */
+const DANGEROUS_PATTERNS = [
+    // Branch creation
+    "git checkout -b",
+    "git checkout -B",
+    "git branch -c",
+    "git branch -C",
+    "git branch -m",
+    "git branch -M",
+    "git switch -c",
+    "git switch -C",
+    "git switch --create",
+    // History rewriting
+    "git reset",
+    "git rebase",
+    "git cherry-pick",
+    "git commit --amend",
+    // Force push
+    "git push --force",
+    "git push -f",
+    // Discarding changes
+    "git stash",
+    "git clean",
+    "git checkout -- ",
+    "git restore",
+];
+/**
+ * Check if a command targets the .kspec directory, either via cwd or cd commands.
+ */
+function isInKspec(command, cwd) {
+    if (cwd) {
+        // Normalize path separators for cross-platform support
+        const normalizedCwd = cwd.replace(/\\/g, "/");
+        if (normalizedCwd.includes("/.kspec") || normalizedCwd.endsWith("/.kspec")) {
+            return true;
+        }
+    }
+    if (command.includes("cd .kspec") || /cd\s+.*\.kspec/.test(command)) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Check if a command attempts to delete the kspec-meta branch.
+ */
+function isKspecMetaDeletion(command) {
+    // Remove quote characters to catch split-quote bypasses like git "branch" -D kspec-meta
+    const unquoted = command.replace(/["']/g, "");
+    return (unquoted.includes("git branch -d kspec-meta") ||
+        unquoted.includes("git branch -D kspec-meta"));
+}
+/**
+ * Check if a command matches any dangerous pattern when operating in .kspec.
+ *
+ * Uses two matching strategies (same as the original shell script):
+ * 1. STRIPPED: Remove entire quoted strings to ignore patterns in arguments
+ *    (allows: echo "git reset", grep "git stash")
+ * 2. UNQUOTED + first-word check: Remove quote chars and check if first command is "git"
+ *    (blocks: git "reset" --hard, git st'ash')
+ */
+function matchesDangerousPattern(command) {
+    // STRIPPED: remove quoted strings entirely to ignore patterns in args
+    const stripped = command.replace(/'[^']*'/g, "").replace(/"[^"]*"/g, "");
+    // UNQUOTED: remove quote chars to catch split-quote bypasses
+    const unquoted = command.replace(/["']/g, "");
+    // First command word (trimmed)
+    const firstCmd = command.trimStart().split(/\s+/)[0] || "";
+    for (const pattern of DANGEROUS_PATTERNS) {
+        // Block if pattern is in the stripped command (actual command, not in quotes)
+        // OR if pattern is in unquoted AND first command word is "git"
+        if (stripped.includes(pattern) ||
+            (unquoted.includes(pattern) && firstCmd === "git")) {
+            return pattern;
+        }
+    }
+    return null;
+}
+/**
+ * Evaluate a PreToolUse hook input and return a guard decision.
+ * This is the core logic, exported for testing.
+ *
+ * AC: @native-guard-commands ac-worktree-guard
+ * AC: @native-guard-commands ac-worktree-allow
+ */
+export function evaluateWorktreeGuard(input) {
+    const command = input.tool_input?.command;
+    // No command means not a Bash tool call — allow
+    if (!command) {
+        return { decision: "allow" };
+    }
+    // Block kspec-meta branch deletion from anywhere
+    if (isKspecMetaDeletion(command)) {
+        return {
+            decision: "block",
+            reason: "[kspec-worktree-guard] BLOCKED: Cannot delete kspec-meta branch. This is the main branch for the .kspec worktree.",
+        };
+    }
+    // If not operating in .kspec, allow everything
+    if (!isInKspec(command, input.cwd)) {
+        return { decision: "allow" };
+    }
+    // Check for dangerous patterns in .kspec context
+    const matched = matchesDangerousPattern(command);
+    if (matched) {
+        return {
+            decision: "block",
+            reason: "[kspec-worktree-guard] BLOCKED: Dangerous git operation in .kspec worktree. This worktree contains active session data and must stay on kspec-meta. Operations like reset, rebase, stash, and clean can corrupt session files.",
+        };
+    }
+    return { decision: "allow" };
+}
+/**
+ * Read all stdin as a string (for hook JSON input).
+ */
+async function readStdin() {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        process.stdin.on("data", (chunk) => chunks.push(chunk));
+        process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+        process.stdin.on("error", reject);
+        // If stdin is already ended (e.g., no pipe), resolve empty
+        if (process.stdin.readableEnded) {
+            resolve("");
+        }
+    });
+}
+/**
+ * Register the guard command group.
+ *
+ * AC: @trait-semantic-exit-codes ac-8 - exit code meanings documented in code
+ */
+export function registerGuardCommand(program) {
+    const guard = program
+        .command("guard")
+        .description("Guard commands for protecting kspec state");
+    guard
+        .command("worktree")
+        .description("Guard against dangerous git operations in .kspec worktree (PreToolUse hook)")
+        .option("--json", "Output as JSON")
+        .action(async () => {
+        try {
+            const raw = await readStdin();
+            if (!raw.trim()) {
+                // No input — allow (not a tool call we need to guard)
+                // AC: @native-guard-commands ac-worktree-allow
+                const result = { decision: "allow" };
+                console.log(JSON.stringify(result));
+                process.exit(EXIT_CODES.SUCCESS);
+                return;
+            }
+            let input;
+            try {
+                input = JSON.parse(raw);
+            }
+            catch {
+                // Invalid JSON — this is a validation error
+                // AC: @trait-semantic-exit-codes ac-2 - validation error exit code 1
+                if (isJsonMode()) {
+                    output({ error: "Invalid JSON input on stdin" });
+                }
+                else {
+                    // Guard hooks always output JSON for the hook protocol
+                    console.log(JSON.stringify({
+                        error: "Invalid JSON input on stdin",
+                    }));
+                }
+                process.exit(EXIT_CODES.ERROR);
+                return;
+            }
+            const decision = evaluateWorktreeGuard(input);
+            // Guard commands always output JSON (hook protocol requirement)
+            // AC: @trait-json-output ac-1 - valid JSON with no ANSI codes
+            console.log(JSON.stringify(decision));
+            // AC: @trait-semantic-exit-codes ac-1 - exit 0 on success
+            process.exit(EXIT_CODES.SUCCESS);
+        }
+        catch (err) {
+            // AC: @trait-semantic-exit-codes ac-4 - runtime error exit code 3
+            // AC: @trait-json-output ac-3 - error as JSON
+            const errorMsg = err instanceof Error ? err.message : String(err);
+            console.log(JSON.stringify({ error: errorMsg }));
+            process.exit(EXIT_CODES.NOT_FOUND); // Using 3 for runtime errors
+        }
+    });
+}
+//# sourceMappingURL=guard.js.map

package/dist/cli/commands/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../../src/cli/commands/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAqBlD;;;GAGG;AACH,MAAM,kBAAkB,GAAsB;IAC5C,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;IACf,qBAAqB;IACrB,oBAAoB;IACpB,WAAW;IACX,YAAY;IACZ,iBAAiB;IACjB,oBAAoB;IACpB,aAAa;IACb,kBAAkB;IAClB,aAAa;IACb,qBAAqB;IACrB,WAAW;IACX,WAAW;IACX,kBAAkB;IAClB,aAAa;CACd,CAAC;AAEF;;GAEG;AACH,SAAS,SAAS,CAAC,OAAe,EAAE,GAAuB;IACzD,IAAI,GAAG,EAAE,CAAC;QACR,uDAAuD;QACvD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,OAAe;IAC1C,wFAAwF;IACxF,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO,CACL,QAAQ,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QAC7C,QAAQ,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,sEAAsE;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACzE,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9C,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE3D,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,8EAA8E;QAC9E,+DAA+D;QAC/D,IACE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC1B,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,EAClD,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAsB;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;IAE1C,gDAAgD;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,iDAAiD;IACjD,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,MAAM,EACJ,mHAAmH;SACtH,CAAC;IACJ,CAAC;IAED,+CAA+C;IAC/C,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,iDAAiD;IACjD,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,MAAM,EACJ,gOAAgO;SACnO,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAChF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClC,2DAA2D;QAC3D,IAAI,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAChC,OAAO,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,2CAA2C,CAAC,CAAC;IAE5D,KAAK;SACF,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CACV,6EAA6E,CAC9E;SACA,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;YAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChB,sDAAsD;gBACtD,+CAA+C;gBAC/C,MAAM,MAAM,GAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACjC,OAAO;YACT,CAAC;YAED,IAAI,KAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,4CAA4C;gBAC5C,qEAAqE;gBACrE,IAAI,UAAU,EAAE,EAAE,CAAC;oBACjB,MAAM,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,uDAAuD;oBACvD,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,6BAA6B;qBACrC,CAAC,CACH,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBAC/B,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAE9C,gEAAgE;YAChE,8DAA8D;YAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YAEtC,0DAA0D;YAC1D,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,8CAA8C;YAC9C,MAAM,QAAQ,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,6BAA6B;QACnE,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/index.d.ts

@@ -4,6 +4,7 @@ export { registerCloneForTestingCommand } from "./clone-for-testing.js";
 export { registerDeriveCommand } from "./derive.js";
 export { registerDoctorCommand } from "./doctor.js";
 export { registerExportCommand } from "./export.js";
+export { registerGuardCommand } from "./guard.js";
 export { registerHelpCommand } from "./help.js";
 export { registerInboxCommands } from "./inbox.js";
 export { registerInitCommand } from "./init.js";

package/dist/cli/commands/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC"}

package/dist/cli/commands/index.js

@@ -5,6 +5,7 @@ export { registerCloneForTestingCommand } from "./clone-for-testing.js";
 export { registerDeriveCommand } from "./derive.js";
 export { registerDoctorCommand } from "./doctor.js";
 export { registerExportCommand } from "./export.js";
+export { registerGuardCommand } from "./guard.js";
 export { registerHelpCommand } from "./help.js";
 export { registerInboxCommands } from "./inbox.js";
 export { registerInitCommand } from "./init.js";

package/dist/cli/commands/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/commands/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAE3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/commands/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAE3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC"}

package/dist/cli/commands/item.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"item.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/item.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwQzC;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA4iD3D"}
+{"version":3,"file":"item.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/item.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4QzC;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA6jD3D"}

package/dist/cli/commands/item.js

@@ -3,6 +3,7 @@ import { markMutating } from "../command-annotations.js";
 import { AlignmentIndex, addChildItem, buildIndexes, checkSlugUniqueness, createNote, createSpecItem, deleteSpecItem, findChildItems, findDescendantItems, findTraitImplementors, initContext, loadAllItems, loadAllTasks, patchSpecItems, ReferenceIndex, updateSpecItem, } from "../../parser/index.js";
 import { commitIfShadow } from "../../parser/shadow.js";
 import { SpecItemPatchSchema } from "../../schema/index.js";
+import { ImplementationStatusSchema, MaturitySchema, } from "../../schema/common.js";
 import { errors } from "../../strings/errors.js";
 import { fieldLabels, sectionHeaders } from "../../strings/labels.js";
 import { formatMatchedFields, grepItem } from "../../utils/grep.js";
@@ -217,7 +218,6 @@ export function registerItemCommands(program) {
             // AC: @multi-value-status-filter ac-item-list-parity, ac-invalid-item-status
             if (options.status) {
                 const { parseMultiStatus } = await import("./tasks.js");
-                const { ImplementationStatusSchema } = await import("../../schema/common.js");
                 const statuses = parseMultiStatus(options.status, ImplementationStatusSchema.options, "implementation status");
                 if (statuses) {
                     filter.implementation = statuses.length === 1 ? statuses[0] : statuses;
@@ -737,6 +737,23 @@ Examples:
                 updates.traits = options.trait;
             if (options.description)
                 updates.description = options.description;
+            // AC: @implementation-states ac-reject-invalid
+            // AC: @maturity-states ac-reject-invalid
+            // Validate enum values before writing
+            if (options.status) {
+                const valid = ImplementationStatusSchema.options;
+                if (!valid.includes(options.status)) {
+                    error(`Invalid implementation status: '${options.status}'. Valid values: ${valid.join(", ")}`);
+                    process.exit(EXIT_CODES.USAGE_ERROR);
+                }
+            }
+            if (options.maturity) {
+                const valid = MaturitySchema.options;
+                if (!valid.includes(options.maturity)) {
+                    error(`Invalid maturity: '${options.maturity}'. Valid values: ${valid.join(", ")}`);
+                    process.exit(EXIT_CODES.USAGE_ERROR);
+                }
+            }
             // Handle status updates
             if (options.status || options.maturity) {
                 const currentStatus = foundItem.status && typeof foundItem.status === "object"
@@ -1476,22 +1493,32 @@ async function readStdinFully() {
     }
     return new Promise((resolve) => {
         let data = "";
-        const timeout = setTimeout(() => {
-            process.stdin.removeAllListeners();
-            resolve(data || null);
-        }, 5000); // 5 second timeout for bulk input
-        process.stdin.setEncoding("utf8");
-        process.stdin.on("data", (chunk) => {
+        const onData = (chunk) => {
             data += chunk;
-        });
-        process.stdin.on("end", () => {
+        };
+        const onEnd = () => {
             clearTimeout(timeout);
+            cleanup();
             resolve(data || null);
-        });
-        process.stdin.on("error", () => {
+        };
+        const onError = () => {
             clearTimeout(timeout);
+            cleanup();
             resolve(null);
-        });
+        };
+        const cleanup = () => {
+            process.stdin.removeListener("data", onData);
+            process.stdin.removeListener("end", onEnd);
+            process.stdin.removeListener("error", onError);
+        };
+        const timeout = setTimeout(() => {
+            cleanup();
+            resolve(data || null);
+        }, 5000); // 5 second timeout for bulk input
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", onData);
+        process.stdin.on("end", onEnd);
+        process.stdin.on("error", onError);
         process.stdin.resume();
     });
 }
@@ -1505,22 +1532,32 @@ async function readStdinIfAvailable() {
     }
     return new Promise((resolve) => {
         let data = "";
-        const timeout = setTimeout(() => {
-            process.stdin.removeAllListeners();
-            resolve(data || null);
-        }, 100); // 100ms timeout for quick check
-        process.stdin.setEncoding("utf8");
-        process.stdin.on("data", (chunk) => {
+        const onData = (chunk) => {
             data += chunk;
-        });
-        process.stdin.on("end", () => {
+        };
+        const onEnd = () => {
             clearTimeout(timeout);
+            cleanup();
             resolve(data || null);
-        });
-        process.stdin.on("error", () => {
+        };
+        const onError = () => {
             clearTimeout(timeout);
+            cleanup();
             resolve(null);
-        });
+        };
+        const cleanup = () => {
+            process.stdin.removeListener("data", onData);
+            process.stdin.removeListener("end", onEnd);
+            process.stdin.removeListener("error", onError);
+        };
+        const timeout = setTimeout(() => {
+            cleanup();
+            resolve(data || null);
+        }, 100); // 100ms timeout for quick check
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", onData);
+        process.stdin.on("end", onEnd);
+        process.stdin.on("error", onError);
         process.stdin.resume();
     });
 }