@lumenflow/cli 3.1.2 → 3.1.3

package/dist/onboard.js

@@ -20,34 +20,299 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { createWUParser } from '@lumenflow/core';
-import { WORKSPACE_FILE_NAME } from '@lumenflow/kernel';
+import { WorkspaceControlPlaneConfigSchema, } from '@lumenflow/kernel';
 import YAML from 'yaml';
-import { buildWorkspaceConfig, generateWorkspaceYaml } from './workspace-init.js';
+import { buildWorkspaceConfig, CANONICAL_BOOTSTRAP_COMMAND, DEFAULT_DENY_OVERLAYS, DEFAULT_LANE_TITLE, DEFAULT_PROJECT_NAME, DEFAULT_SANDBOX_NETWORK_PROFILE, WORKSPACE_FILENAME, generateWorkspaceYaml, } from './workspace-init.js';
 import { DEFAULT_REGISTRY_URL, installPackFromRegistry } from './pack-install.js';
 import { runCLI } from './cli-entry-point.js';
 // --- Constants ---
 export const LOG_PREFIX = '[onboard]';
+const LEGACY_MARKER = 'legacy';
+const LEGACY_ONBOARD_ENTRYPOINT = 'onboard';
+const LEGACY_ONBOARD_ALIAS = 'lumenflow-onboard';
+const LEGACY_ONBOARD_CONNECT_ENTRYPOINT = `${LEGACY_ONBOARD_ENTRYPOINT} connect`;
+const CANONICAL_CLOUD_CONNECT_COMMAND = 'npx lumenflow cloud connect';
+const LEGACY_ONBOARD_MESSAGE_PREFIX = `${LOG_PREFIX} ${LEGACY_MARKER} entrypoint`;
 const NODE_BINARY = 'node';
 const GIT_BINARY = 'git';
 const DEFAULT_DOMAIN_PACK_VERSION = 'latest';
+const DOMAIN_IDS = {
+    SOFTWARE_DELIVERY: 'software-delivery',
+    INFRA: 'infra',
+    CUSTOM: 'custom',
+};
+const DOMAIN_PACK_IDS = {
+    SOFTWARE_DELIVERY: 'software-delivery',
+    INFRA: 'infra',
+};
+const DEFAULT_ONBOARD_LANE_TITLE = DEFAULT_LANE_TITLE;
+const DOMAIN_DEFAULT_PACKS = {
+    [DOMAIN_IDS.SOFTWARE_DELIVERY]: [DOMAIN_PACK_IDS.SOFTWARE_DELIVERY],
+    [DOMAIN_IDS.INFRA]: [DOMAIN_PACK_IDS.INFRA],
+    [DOMAIN_IDS.CUSTOM]: [],
+};
+const DOMAIN_DEFAULT_LANES = {
+    [DOMAIN_IDS.SOFTWARE_DELIVERY]: ['Backend', 'Frontend', 'DevOps'],
+    [DOMAIN_IDS.INFRA]: ['Provisioning', 'Networking', 'Security'],
+    [DOMAIN_IDS.CUSTOM]: [DEFAULT_ONBOARD_LANE_TITLE],
+};
+const DOMAIN_EMPTY_PACK_ID = 'none';
+const ONBOARD_DEFAULT_DOMAIN = DOMAIN_IDS.SOFTWARE_DELIVERY;
+const ONBOARD_FALLBACK_PROJECT_NAME = DEFAULT_PROJECT_NAME;
+const ONBOARD_SUBCOMMAND_CONNECT = 'connect';
+const CLOUD_CONNECT_LOG_PREFIX = '[cloud connect]';
+const CLOUD_CONNECT_DEFAULT_TOKEN_ENV = 'LUMENFLOW_CONTROL_PLANE_TOKEN';
+const CLOUD_CONNECT_DEFAULT_SYNC_INTERVAL_SECONDS = 30;
+const CLOUD_CONNECT_POLICY_MODES = {
+    AUTHORITATIVE: 'authoritative',
+    TIGHTEN_ONLY: 'tighten-only',
+    DEV_OVERRIDE: 'dev-override',
+};
+const CLOUD_CONNECT_DEFAULT_POLICY_MODE = CLOUD_CONNECT_POLICY_MODES.TIGHTEN_ONLY;
+const CLOUD_CONNECT_ALLOWED_POLICY_MODES = new Set([
+    CLOUD_CONNECT_POLICY_MODES.AUTHORITATIVE,
+    CLOUD_CONNECT_POLICY_MODES.TIGHTEN_ONLY,
+    CLOUD_CONNECT_POLICY_MODES.DEV_OVERRIDE,
+]);
+const CLOUD_CONNECT_ALLOWED_POLICY_MODE_NAMES = new Set([
+    ...CLOUD_CONNECT_ALLOWED_POLICY_MODES,
+]);
+const CLOUD_CONNECT_SECURE_PROTOCOL = 'https:';
+const CLOUD_CONNECT_LOCAL_PROTOCOL = 'http:';
+const CLOUD_CONNECT_LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
+const CLOUD_CONNECT_ENV_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/;
+const CLOUD_CONNECT_HELP_HINT = 'Example: npx lumenflow cloud connect --endpoint https://cp.example --org-id org-1 --project-id project-1 --token-env LUMENFLOW_CONTROL_PLANE_TOKEN';
+const YAML_TRAILING_NEWLINE = '\n';
+export function buildLegacyOnboardGuidance(entrypoint = LEGACY_ONBOARD_ENTRYPOINT) {
+    return (`${LEGACY_ONBOARD_MESSAGE_PREFIX} "${entrypoint}" is retired. ` +
+        `Use "${CANONICAL_BOOTSTRAP_COMMAND}" for bootstrap-all onboarding.`);
+}
+function buildLegacyCloudConnectGuidance(entrypoint = LEGACY_ONBOARD_CONNECT_ENTRYPOINT) {
+    return (`${LEGACY_ONBOARD_MESSAGE_PREFIX} "${entrypoint}" is retired. ` +
+        `Use "${CANONICAL_CLOUD_CONNECT_COMMAND}" instead.`);
+}
 /** Domain pack IDs mapped to human-readable descriptions */
 export const DOMAIN_CHOICES = [
     {
-        value: 'software-delivery',
+        value: DOMAIN_IDS.SOFTWARE_DELIVERY,
         label: 'Software Delivery',
         hint: 'Git tools, worktree isolation, quality gates, lane locking',
     },
     {
-        value: 'infra',
+        value: DOMAIN_IDS.INFRA,
         label: 'Infrastructure',
         hint: 'Terraform, Ansible, cloud resource management',
     },
     {
-        value: 'custom',
+        value: DOMAIN_IDS.CUSTOM,
         label: 'Custom (empty)',
         hint: 'Start with an empty workspace and add packs manually',
     },
 ];
+const CLOUD_CONNECT_OPTIONS = {
+    endpoint: {
+        name: 'endpoint',
+        flags: '--endpoint <url>',
+        description: 'Cloud control-plane endpoint URL',
+    },
+    orgId: {
+        name: 'orgId',
+        flags: '--org-id <id>',
+        description: 'Cloud organization identifier',
+    },
+    projectId: {
+        name: 'projectId',
+        flags: '--project-id <id>',
+        description: 'Cloud project identifier',
+    },
+    tokenEnv: {
+        name: 'tokenEnv',
+        flags: '--token-env <name>',
+        description: `Environment variable containing cloud auth token (default: ${CLOUD_CONNECT_DEFAULT_TOKEN_ENV})`,
+    },
+    policyMode: {
+        name: 'policyMode',
+        flags: '--policy-mode <mode>',
+        description: 'Policy mode: authoritative, tighten-only, dev-override',
+    },
+    syncInterval: {
+        name: 'syncInterval',
+        flags: '--sync-interval <seconds>',
+        description: 'Control-plane sync interval in seconds (positive integer)',
+    },
+    output: {
+        name: 'output',
+        flags: '--output, -o <dir>',
+        description: 'Workspace root directory (default: current directory)',
+    },
+    force: {
+        name: 'force',
+        flags: '--force, -f',
+        description: 'Overwrite existing control_plane section in workspace.yaml',
+    },
+};
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function parsePositiveInt(value, fieldName) {
+    const parsedValue = typeof value === 'number' ? value : Number(value);
+    if (!Number.isInteger(parsedValue) || parsedValue <= 0) {
+        throw new Error(`${CLOUD_CONNECT_LOG_PREFIX} Invalid ${fieldName}: expected a positive integer`);
+    }
+    return parsedValue;
+}
+function parsePolicyMode(value) {
+    if (typeof value !== 'string' || !CLOUD_CONNECT_ALLOWED_POLICY_MODE_NAMES.has(value)) {
+        const allowedValues = [...CLOUD_CONNECT_ALLOWED_POLICY_MODES].join(', ');
+        throw new Error(`${CLOUD_CONNECT_LOG_PREFIX} Invalid --policy-mode "${String(value)}". Valid values: ${allowedValues}`);
+    }
+    return value;
+}
+function validateEndpoint(endpoint) {
+    let parsedEndpoint;
+    try {
+        parsedEndpoint = new URL(endpoint);
+    }
+    catch {
+        throw new Error(`${CLOUD_CONNECT_LOG_PREFIX} Invalid endpoint "${endpoint}": expected a valid URL`);
+    }
+    const isSecureProtocol = parsedEndpoint.protocol === CLOUD_CONNECT_SECURE_PROTOCOL;
+    const isLocalHost = CLOUD_CONNECT_LOCAL_HOSTS.has(parsedEndpoint.hostname);
+    const isLocalHttp = parsedEndpoint.protocol === CLOUD_CONNECT_LOCAL_PROTOCOL && isLocalHost === true;
+    if (!isSecureProtocol && !isLocalHttp) {
+        throw new Error(`${CLOUD_CONNECT_LOG_PREFIX} Endpoint must use https (or http for localhost only): ${endpoint}`);
+    }
+    const normalizedEndpoint = parsedEndpoint.toString();
+    return normalizedEndpoint.endsWith('/')
+        ? normalizedEndpoint.slice(0, normalizedEndpoint.length - 1)
+        : normalizedEndpoint;
+}
+function validateTokenEnvName(tokenEnv) {
+    if (!CLOUD_CONNECT_ENV_NAME_PATTERN.test(tokenEnv)) {
+        throw new Error(`${CLOUD_CONNECT_LOG_PREFIX} Invalid --token-env "${tokenEnv}": expected an uppercase environment variable name`);
+    }
+    return tokenEnv;
+}
+function ensureTokenValue(tokenEnv, env) {
+    const tokenValue = env[tokenEnv];
+    if (!tokenValue || tokenValue.trim().length === 0) {
+        throw new Error(`${CLOUD_CONNECT_LOG_PREFIX} Missing token env "${tokenEnv}". Export it before connect. ${CLOUD_CONNECT_HELP_HINT}`);
+    }
+    return tokenValue;
+}
+function parseCloudConnectCliOptions() {
+    const opts = createWUParser({
+        name: 'cloud-connect',
+        description: 'Connect workspace.yaml to LumenFlow cloud control plane',
+        options: [
+            CLOUD_CONNECT_OPTIONS.endpoint,
+            CLOUD_CONNECT_OPTIONS.orgId,
+            CLOUD_CONNECT_OPTIONS.projectId,
+            CLOUD_CONNECT_OPTIONS.tokenEnv,
+            CLOUD_CONNECT_OPTIONS.policyMode,
+            CLOUD_CONNECT_OPTIONS.syncInterval,
+            CLOUD_CONNECT_OPTIONS.output,
+            CLOUD_CONNECT_OPTIONS.force,
+        ],
+        required: [
+            CLOUD_CONNECT_OPTIONS.endpoint.name,
+            CLOUD_CONNECT_OPTIONS.orgId.name,
+            CLOUD_CONNECT_OPTIONS.projectId.name,
+        ],
+    });
+    const tokenEnvRaw = opts.tokenEnv ?? CLOUD_CONNECT_DEFAULT_TOKEN_ENV;
+    const policyModeRaw = opts.policyMode ?? CLOUD_CONNECT_DEFAULT_POLICY_MODE;
+    const syncIntervalRaw = opts.syncInterval ??
+        CLOUD_CONNECT_DEFAULT_SYNC_INTERVAL_SECONDS;
+    return {
+        targetDir: (opts.output ?? process.cwd()).trim(),
+        endpoint: validateEndpoint(String(opts.endpoint)),
+        orgId: String(opts.orgId).trim(),
+        projectId: String(opts.projectId).trim(),
+        tokenEnv: validateTokenEnvName(tokenEnvRaw.trim()),
+        policyMode: parsePolicyMode(policyModeRaw),
+        syncInterval: parsePositiveInt(syncIntervalRaw, '--sync-interval'),
+        force: Boolean(opts.force),
+    };
+}
+function validateWorkspaceRootPath(targetDir) {
+    if (!targetDir || targetDir.trim().length === 0) {
+        throw new Error(`${CLOUD_CONNECT_LOG_PREFIX} Invalid --output: path must be non-empty`);
+    }
+    return path.resolve(targetDir);
+}
+function readWorkspaceDocument(workspacePath) {
+    if (!fs.existsSync(workspacePath)) {
+        throw new Error(`${CLOUD_CONNECT_LOG_PREFIX} ${WORKSPACE_FILENAME} not found at ${workspacePath}. Run "lumenflow init" first to bootstrap a workspace.`);
+    }
+    const rawContent = fs.readFileSync(workspacePath, 'utf-8');
+    const parsedYaml = YAML.parse(rawContent);
+    if (!isRecord(parsedYaml)) {
+        throw new Error(`${CLOUD_CONNECT_LOG_PREFIX} ${WORKSPACE_FILENAME} is malformed: expected YAML object at document root`);
+    }
+    return parsedYaml;
+}
+function buildControlPlaneConfig(input) {
+    const controlPlaneCandidate = {
+        endpoint: input.endpoint,
+        org_id: input.orgId,
+        project_id: input.projectId,
+        sync_interval: input.syncInterval,
+        policy_mode: input.policyMode,
+        auth: {
+            token_env: input.tokenEnv,
+        },
+    };
+    return WorkspaceControlPlaneConfigSchema.parse(controlPlaneCandidate);
+}
+export async function connectWorkspaceToCloud(options) {
+    try {
+        const workspaceRoot = validateWorkspaceRootPath(options.targetDir);
+        const workspacePath = path.join(workspaceRoot, WORKSPACE_FILENAME);
+        const workspaceDoc = readWorkspaceDocument(workspacePath);
+        const runtimeEnv = options.env ?? process.env;
+        ensureTokenValue(options.tokenEnv, runtimeEnv);
+        if (workspaceDoc.control_plane && !options.force) {
+            return {
+                success: false,
+                workspacePath,
+                error: `${CLOUD_CONNECT_LOG_PREFIX} ${WORKSPACE_FILENAME} already has control_plane configuration. ` +
+                    'Use --force to overwrite.',
+            };
+        }
+        const controlPlaneConfig = buildControlPlaneConfig(options);
+        workspaceDoc.control_plane = controlPlaneConfig;
+        const serializedWorkspace = YAML.stringify(workspaceDoc);
+        const normalizedYaml = serializedWorkspace.endsWith(YAML_TRAILING_NEWLINE)
+            ? serializedWorkspace
+            : `${serializedWorkspace}${YAML_TRAILING_NEWLINE}`;
+        fs.writeFileSync(workspacePath, normalizedYaml, 'utf-8');
+        return {
+            success: true,
+            workspacePath,
+            controlPlaneConfig,
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+export async function runCloudConnectCli() {
+    const connectOptions = parseCloudConnectCliOptions();
+    const result = await connectWorkspaceToCloud(connectOptions);
+    if (!result.success) {
+        console.error(result.error ?? `${CLOUD_CONNECT_LOG_PREFIX} Cloud connect failed`);
+        process.exit(1);
+    }
+    console.log(`${CLOUD_CONNECT_LOG_PREFIX} Updated ${WORKSPACE_FILENAME}`);
+    console.log(`${CLOUD_CONNECT_LOG_PREFIX} Endpoint: ${connectOptions.endpoint}`);
+    console.log(`${CLOUD_CONNECT_LOG_PREFIX} Org ID: ${connectOptions.orgId}`);
+    console.log(`${CLOUD_CONNECT_LOG_PREFIX} Project ID: ${connectOptions.projectId}`);
+    console.log(`${CLOUD_CONNECT_LOG_PREFIX} Token env: ${connectOptions.tokenEnv}`);
+}
 /**
  * Get version of a CLI tool by running it with a version flag.
  * Returns 'not found' if the tool is not available.
@@ -77,7 +342,7 @@ function getToolVersion(binary, args) {
 export async function detectEnvironment(targetDir) {
     const nodeVersion = getToolVersion(NODE_BINARY, ['--version']);
     const gitVersion = getToolVersion(GIT_BINARY, ['--version']);
-    const workspacePath = path.join(targetDir, WORKSPACE_FILE_NAME);
+    const workspacePath = path.join(targetDir, WORKSPACE_FILENAME);
     const existingWorkspace = fs.existsSync(workspacePath);
     return {
         node: {
@@ -98,14 +363,7 @@ export async function detectEnvironment(targetDir) {
  * @returns Array of pack IDs to include
  */
 function getPacksForDomain(domain) {
-    switch (domain) {
-        case 'software-delivery':
-            return ['software-delivery'];
-        case 'infra':
-            return ['infra'];
-        case 'custom':
-            return [];
-    }
+    return [...DOMAIN_DEFAULT_PACKS[domain]];
 }
 /**
  * Build lane configuration for a given domain.
@@ -114,14 +372,7 @@ function getPacksForDomain(domain) {
  * @returns Array of lane titles
  */
 function getLanesForDomain(domain) {
-    switch (domain) {
-        case 'software-delivery':
-            return ['Backend', 'Frontend', 'DevOps'];
-        case 'infra':
-            return ['Provisioning', 'Networking', 'Security'];
-        case 'custom':
-            return ['Default'];
-    }
+    return [...DOMAIN_DEFAULT_LANES[domain]];
 }
 /**
  * Convert a string to kebab-case.
@@ -140,12 +391,12 @@ function toKebabCase(input) {
  * @returns Result of workspace generation
  */
 export async function generateWorkspaceForDomain(targetDir, options) {
-    const workspacePath = path.join(targetDir, WORKSPACE_FILE_NAME);
+    const workspacePath = path.join(targetDir, WORKSPACE_FILENAME);
     // Check for existing file
     if (fs.existsSync(workspacePath) && !options.force) {
         return {
             success: false,
-            error: `${WORKSPACE_FILE_NAME} already exists at ${workspacePath}. Use --force to overwrite.`,
+            error: `${WORKSPACE_FILENAME} already exists at ${workspacePath}. Use --force to overwrite.`,
         };
     }
     const lanes = getLanesForDomain(options.domain);
@@ -154,8 +405,8 @@ export async function generateWorkspaceForDomain(targetDir, options) {
     const config = buildWorkspaceConfig({
         projectName: options.projectName,
         lanes,
-        sandboxProfile: 'off',
-        deniedPaths: ['~/.ssh', '~/.aws', '~/.gnupg', '.env'],
+        sandboxProfile: DEFAULT_SANDBOX_NETWORK_PROFILE,
+        deniedPaths: [...DEFAULT_DENY_OVERLAYS],
         cloudConnect: false,
     });
     // Installable packs are added in AC4 via installDomainPack.
@@ -191,7 +442,7 @@ export async function installDomainPack(targetDir, options) {
     const packs = getPacksForDomain(options.domain);
     if (packs.length === 0) {
         return {
-            packId: 'none',
+            packId: DOMAIN_EMPTY_PACK_ID,
             skipped: true,
             reason: `No packs to install for custom domain. Add packs manually with: pnpm pack:install --id <pack-id>`,
         };
@@ -225,7 +476,7 @@ export async function installDomainPack(targetDir, options) {
     let installedVersion;
     let installedIntegrity;
     try {
-        const workspacePath = path.join(targetDir, WORKSPACE_FILE_NAME);
+        const workspacePath = path.join(targetDir, WORKSPACE_FILENAME);
         const workspaceRaw = fs.readFileSync(workspacePath, 'utf-8');
         const parsed = YAML.parse(workspaceRaw);
         const installedPack = (parsed.packs ?? []).find((entry) => entry.id === packId);
@@ -284,7 +535,7 @@ export async function launchDashboard(targetDir, options = {}) {
  * @returns Onboard result
  */
 export async function runOnboard(options) {
-    const { targetDir, projectName = 'my-project', domain = 'software-delivery', force = false, skipPackInstall = false, skipDashboard = false, registryUrl = DEFAULT_REGISTRY_URL, fetchFn = globalThis.fetch, } = options;
+    const { targetDir, projectName = ONBOARD_FALLBACK_PROJECT_NAME, domain = ONBOARD_DEFAULT_DOMAIN, force = false, skipPackInstall = false, skipDashboard = false, registryUrl = DEFAULT_REGISTRY_URL, fetchFn = globalThis.fetch, } = options;
     const errors = [];
     const result = {
         success: false,
@@ -344,7 +595,7 @@ export async function runOnboard(options) {
  *
  * This is the main entry point for interactive mode.
  */
-async function runInteractiveOnboard(targetDir, force) {
+async function _runInteractiveOnboard(targetDir, force) {
     // Dynamic import to avoid loading @clack/prompts in non-interactive mode
     const clack = await import('@clack/prompts');
     clack.intro('Welcome to LumenFlow');
@@ -367,8 +618,8 @@ async function runInteractiveOnboard(targetDir, force) {
     // Step 2: Project name
     const projectName = await clack.text({
         message: 'Project name',
-        placeholder: 'my-project',
-        defaultValue: 'my-project',
+        placeholder: ONBOARD_FALLBACK_PROJECT_NAME,
+        defaultValue: ONBOARD_FALLBACK_PROJECT_NAME,
         validate: (value) => {
             if (!value?.trim())
                 return 'Project name is required';
@@ -406,7 +657,7 @@ async function runInteractiveOnboard(targetDir, force) {
     }
     spinner.stop('workspace.yaml created');
     // Step 5: Install pack (AC4)
-    if (domain !== 'custom') {
+    if (domain !== DOMAIN_IDS.CUSTOM) {
         spinner.start(`Installing ${domain} pack...`);
         const installResult = await installDomainPack(targetDir, {
             domain: domain,
@@ -422,108 +673,32 @@ async function runInteractiveOnboard(targetDir, force) {
     const dashResult = await launchDashboard(targetDir);
     // Final summary
     clack.note([
-        `Workspace: ${WORKSPACE_FILE_NAME}`,
+        `Workspace: ${WORKSPACE_FILENAME}`,
         `Domain: ${domain}`,
         `Dashboard: ${dashResult.instruction}`,
         '',
         'Next steps:',
         '  1. Run "lumenflow init" to scaffold agent config files',
-        '  2. Create your first task: pnpm wu:create --lane "Default" --title "My first task"',
+        `  2. Create your first task: pnpm wu:create --lane "${DEFAULT_LANE_TITLE}" --title "My first task"`,
         '  3. Claim it: pnpm wu:claim --id WU-1',
     ].join('\n'), 'Setup complete');
     clack.outro('Happy building!');
 }
 // --- CLI entry point ---
-const ONBOARD_OPTIONS = {
-    yes: {
-        name: 'yes',
-        flags: '--yes, -y',
-        description: 'Accept all defaults non-interactively',
-    },
-    domain: {
-        name: 'domain',
-        flags: '--domain <domain>',
-        description: 'Domain pack: software-delivery, infra, or custom',
-    },
-    projectName: {
-        name: 'projectName',
-        flags: '--project-name <name>',
-        description: 'Project name (default: directory name or "my-project")',
-    },
-    output: {
-        name: 'output',
-        flags: '--output, -o <dir>',
-        description: 'Output directory (default: current directory)',
-    },
-    force: {
-        name: 'force',
-        flags: '--force, -f',
-        description: 'Overwrite existing workspace.yaml',
-    },
-    skipPackInstall: {
-        name: 'skipPackInstall',
-        flags: '--skip-pack-install',
-        description: 'Skip pack installation step',
-    },
-    skipDashboard: {
-        name: 'skipDashboard',
-        flags: '--skip-dashboard',
-        description: 'Skip dashboard launch step',
-    },
-};
 /**
  * CLI main entry point for lumenflow onboard
  */
 export async function main() {
-    const opts = createWUParser({
-        name: 'onboard',
-        description: 'Interactive setup wizard for LumenFlow workspace',
-        options: [
-            ONBOARD_OPTIONS.yes,
-            ONBOARD_OPTIONS.domain,
-            ONBOARD_OPTIONS.projectName,
-            ONBOARD_OPTIONS.output,
-            ONBOARD_OPTIONS.force,
-            ONBOARD_OPTIONS.skipPackInstall,
-            ONBOARD_OPTIONS.skipDashboard,
-        ],
-    });
-    const targetDir = opts.output ?? process.cwd();
-    const force = Boolean(opts.force);
-    const useDefaults = Boolean(opts.yes);
-    const domain = opts.domain ?? 'software-delivery';
-    const projectName = opts.projectName ?? path.basename(path.resolve(targetDir));
-    const skipPackInstall = Boolean(opts.skipPackInstall);
-    const skipDashboard = Boolean(opts.skipDashboard);
-    if (useDefaults) {
-        // Non-interactive mode
-        const result = await runOnboard({
-            targetDir,
-            nonInteractive: true,
-            projectName,
-            domain,
-            force,
-            skipPackInstall,
-            skipDashboard,
-        });
-        if (!result.success) {
-            console.error(`${LOG_PREFIX} Onboarding failed:`);
-            for (const error of result.errors) {
-                console.error(`  - ${error}`);
-            }
-            process.exit(1);
-        }
-        console.log(`${LOG_PREFIX} Workspace created at ${targetDir}/${WORKSPACE_FILE_NAME}`);
-        console.log(`${LOG_PREFIX} Domain: ${domain}`);
-        if (!skipPackInstall && result.packInstalled === false) {
-            console.warn(`${LOG_PREFIX} Warning: Pack install did not complete. Retry with: pnpm pack:install --id ${domain} --source registry --version ${DEFAULT_DOMAIN_PACK_VERSION}`);
-        }
-        console.log(`${LOG_PREFIX} Next: run "lumenflow init" to scaffold agent config files`);
-    }
-    else {
-        // Interactive mode with @clack/prompts
-        await runInteractiveOnboard(targetDir, force);
+    const invokedBinary = path.basename(process.argv[1] ?? LEGACY_ONBOARD_ENTRYPOINT, '.js');
+    const invokedEntrypoint = invokedBinary === LEGACY_ONBOARD_ALIAS ? LEGACY_ONBOARD_ALIAS : LEGACY_ONBOARD_ENTRYPOINT;
+    const subcommand = process.argv[2];
+    if (subcommand === ONBOARD_SUBCOMMAND_CONNECT) {
+        console.warn(buildLegacyCloudConnectGuidance(`${invokedEntrypoint} ${ONBOARD_SUBCOMMAND_CONNECT}`));
+        process.argv.splice(2, 1);
+        await runCloudConnectCli();
+        return;
     }
+    console.warn(buildLegacyOnboardGuidance(invokedEntrypoint));
 }
 // Run if executed directly
 if (import.meta.main) {

package/dist/orchestrate-init-status.js

@@ -15,11 +15,10 @@ import { existsSync, readdirSync } from 'node:fs';
 import { loadInitiativeWUs, calculateProgress, formatProgress, getLaneAvailability, resolveLaneConfigsFromConfig, } from '@lumenflow/initiatives';
 import { EXIT_CODES, LUMENFLOW_PATHS } from '@lumenflow/core/wu-constants';
 import { getConfig } from '@lumenflow/core/config';
+import { getErrorMessage, ProcessExitError } from '@lumenflow/core/error-handler';
 import chalk from 'chalk';
+import { runCLI } from './cli-entry-point.js';
 const LOG_PREFIX = '[orchestrate:init-status]';
-function getErrorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
 function normalizeLifecycleStatus(value) {
     return typeof value === 'string' ? value.trim().toLowerCase() : '';
 }
@@ -113,12 +112,18 @@ const program = new Command()
         console.log(formatLaneAvailability(availability, laneConfigs));
     }
     catch (err) {
-        console.error(chalk.red(`${LOG_PREFIX} Error: ${getErrorMessage(err)}`));
-        process.exit(EXIT_CODES.ERROR);
+        if (err instanceof ProcessExitError) {
+            throw err;
+        }
+        const message = `${LOG_PREFIX} Error: ${getErrorMessage(err)}`;
+        console.error(chalk.red(message));
+        throw new ProcessExitError(message, EXIT_CODES.ERROR);
     }
 });
-// WU-1181 parity: avoid top-level parse when imported in tests
+export async function main() {
+    await program.parseAsync(process.argv);
+}
 if (import.meta.main) {
-    program.parse();
+    void runCLI(main);
 }
 //# sourceMappingURL=orchestrate-init-status.js.map

package/dist/orchestrate-initiative.js

@@ -16,9 +16,8 @@ import chalk from 'chalk';
 import { loadInitiativeWUs, loadMultipleInitiatives, buildExecutionPlanWithLockPolicy, resolveLaneConfigsFromConfig, formatExecutionPlan, formatExecutionPlanWithEmbeddedSpawns, calculateProgress, formatProgress, buildCheckpointWave, formatCheckpointOutput, validateCheckpointFlags, resolveCheckpointModeAsync, LOG_PREFIX, } from '@lumenflow/initiatives';
 import { EXIT_CODES } from '@lumenflow/core/wu-constants';
 import { getConfig } from '@lumenflow/core/config';
-function getErrorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
+import { getErrorMessage, ProcessExitError } from '@lumenflow/core/error-handler';
+import { runCLI } from './cli-entry-point.js';
 const program = new Command()
     .name('orchestrate-initiative')
     .description('Orchestrate initiative execution with parallel agent spawning')
@@ -34,16 +33,18 @@ const program = new Command()
         validateCheckpointFlags({ checkpointPerWave, dryRun, noCheckpoint });
     }
     catch (error) {
-        console.error(chalk.red(`${LOG_PREFIX} Error: ${getErrorMessage(error)}`));
-        process.exit(EXIT_CODES.ERROR);
+        const message = `${LOG_PREFIX} Error: ${getErrorMessage(error)}`;
+        console.error(chalk.red(message));
+        throw new ProcessExitError(message, EXIT_CODES.ERROR);
     }
     if (!initIds || initIds.length === 0) {
-        console.error(chalk.red(`${LOG_PREFIX} Error: --initiative is required`));
+        const message = `${LOG_PREFIX} Error: --initiative is required`;
+        console.error(chalk.red(message));
         console.error('');
         console.error('Usage:');
         console.error('  pnpm orchestrate:initiative --initiative INIT-001');
         console.error('  pnpm orchestrate:initiative --initiative INIT-001 --dry-run');
-        process.exit(EXIT_CODES.ERROR);
+        throw new ProcessExitError(message, EXIT_CODES.ERROR);
     }
     try {
         console.log(chalk.cyan(`${LOG_PREFIX} Loading initiative(s): ${initIds.join(', ')}`));
@@ -70,8 +71,9 @@ const program = new Command()
         const checkpointDecision = await resolveCheckpointModeAsync({ checkpointPerWave, noCheckpoint, dryRun }, wus);
         if (checkpointDecision.enabled) {
             if (initIds.length > 1) {
-                console.error(chalk.red(`${LOG_PREFIX} Error: Checkpoint mode only supports single initiative`));
-                process.exit(EXIT_CODES.ERROR);
+                const message = `${LOG_PREFIX} Error: Checkpoint mode only supports single initiative`;
+                console.error(chalk.red(message));
+                throw new ProcessExitError(message, EXIT_CODES.ERROR);
             }
             const waveData = buildCheckpointWave(initIds[0], { dryRun });
             if (!waveData) {
@@ -139,9 +141,18 @@ const program = new Command()
         console.log(chalk.cyan('Copy the spawn XML above to execute agents.'));
     }
     catch (error) {
-        console.error(chalk.red(`${LOG_PREFIX} Error: ${getErrorMessage(error)}`));
-        process.exit(EXIT_CODES.ERROR);
+        if (error instanceof ProcessExitError) {
+            throw error;
+        }
+        const message = `${LOG_PREFIX} Error: ${getErrorMessage(error)}`;
+        console.error(chalk.red(message));
+        throw new ProcessExitError(message, EXIT_CODES.ERROR);
     }
 });
-program.parse();
+export async function main() {
+    await program.parseAsync(process.argv);
+}
+if (import.meta.main) {
+    void runCLI(main);
+}
 //# sourceMappingURL=orchestrate-initiative.js.map