@lumenflow/cli 3.1.2 → 3.1.3

package/dist/workspace-init.js

@@ -17,11 +17,41 @@
 import * as readline from 'node:readline';
 import * as path from 'node:path';
 import YAML from 'yaml';
-import { createWUParser } from '@lumenflow/core';
 import { createFile } from './init-scaffolding.js';
 import { runCLI } from './cli-entry-point.js';
 export const LOG_PREFIX = '[workspace:init]';
-const WORKSPACE_FILENAME = 'workspace.yaml';
+export const WORKSPACE_FILENAME = 'workspace.yaml';
+export const DEFAULT_WORKSPACE_ID = 'default';
+export const DEFAULT_WORKSPACE_NAME = 'My Project';
+export const DEFAULT_PROJECT_NAME = 'my-project';
+export const DEFAULT_LANE_TITLE = 'Default';
+export const DEFAULT_NAMESPACE = DEFAULT_WORKSPACE_ID;
+export const CANONICAL_BOOTSTRAP_COMMAND = 'npx lumenflow';
+const LEGACY_WORKSPACE_INIT_ENTRYPOINT = 'workspace-init';
+const LEGACY_ENTRYPOINT_MARKER = 'legacy';
+const LEGACY_ENTRYPOINT_MESSAGE_PREFIX = `${LOG_PREFIX} ${LEGACY_ENTRYPOINT_MARKER} entrypoint`;
+export const DEFAULT_DENY_OVERLAYS = ['~/.ssh', '~/.aws', '~/.gnupg', '.env'];
+export const DEFAULT_DENY_OVERLAYS_PROMPT = DEFAULT_DENY_OVERLAYS.join(', ');
+export const SANDBOX_NETWORK_PROFILE = {
+    OFF: 'off',
+    FULL: 'full',
+};
+export const DEFAULT_SANDBOX_NETWORK_PROFILE = SANDBOX_NETWORK_PROFILE.OFF;
+export const CLOUD_CONNECT_RESPONSE = {
+    YES: 'yes',
+    NO: 'no',
+    SHORT_YES: 'y',
+    BOOLEAN_TRUE: 'true',
+};
+const CLOUD_CONNECT_TRUTHY = new Set([
+    CLOUD_CONNECT_RESPONSE.YES,
+    CLOUD_CONNECT_RESPONSE.SHORT_YES,
+    CLOUD_CONNECT_RESPONSE.BOOLEAN_TRUE,
+]);
+const EMPTY_SOFTWARE_DELIVERY_CONFIG = Object.freeze({});
+function createEmptySoftwareDeliveryConfig() {
+    return { ...EMPTY_SOFTWARE_DELIVERY_CONFIG };
+}
 /**
  * AC1: 5 interactive questions for workspace configuration
  */
@@ -29,29 +59,33 @@ export const WORKSPACE_QUESTIONS = [
     {
         name: 'projectName',
         prompt: 'Project name',
-        defaultValue: 'my-project',
+        defaultValue: DEFAULT_PROJECT_NAME,
     },
     {
         name: 'lanes',
         prompt: 'Work lanes (comma-separated, e.g., Backend, Frontend, DevOps)',
-        defaultValue: 'Default',
+        defaultValue: DEFAULT_LANE_TITLE,
     },
     {
         name: 'sandboxProfile',
         prompt: 'Sandbox network profile (off | full)',
-        defaultValue: 'off',
+        defaultValue: DEFAULT_SANDBOX_NETWORK_PROFILE,
     },
     {
         name: 'deniedPaths',
         prompt: 'Denied paths (comma-separated, e.g., ~/.ssh, ~/.aws, .env)',
-        defaultValue: '~/.ssh, ~/.aws, ~/.gnupg, .env',
+        defaultValue: DEFAULT_DENY_OVERLAYS_PROMPT,
     },
     {
         name: 'cloudConnect',
         prompt: 'Enable cloud agent support? (yes | no)',
-        defaultValue: 'no',
+        defaultValue: CLOUD_CONNECT_RESPONSE.NO,
     },
 ];
+export function buildLegacyWorkspaceInitGuidance(entrypoint = LEGACY_WORKSPACE_INIT_ENTRYPOINT) {
+    return (`${LEGACY_ENTRYPOINT_MESSAGE_PREFIX} "${entrypoint}" is retired. ` +
+        `Use "${CANONICAL_BOOTSTRAP_COMMAND}" for bootstrap-all onboarding.`);
+}
 /**
  * Parse raw string answers from interactive prompts into typed config inputs.
  */
@@ -66,10 +100,10 @@ export function parseAnswers(answers) {
             .map((p) => p.trim())
             .filter(Boolean)
         : [];
-    const cloudConnect = answers.cloudConnect.toLowerCase() === 'yes' ||
-        answers.cloudConnect.toLowerCase() === 'y' ||
-        answers.cloudConnect.toLowerCase() === 'true';
-    const sandboxProfile = answers.sandboxProfile === 'full' ? 'full' : 'off';
+    const cloudConnect = CLOUD_CONNECT_TRUTHY.has(answers.cloudConnect.toLowerCase());
+    const sandboxProfile = answers.sandboxProfile === SANDBOX_NETWORK_PROFILE.FULL
+        ? SANDBOX_NETWORK_PROFILE.FULL
+        : SANDBOX_NETWORK_PROFILE.OFF;
     return {
         projectName: answers.projectName,
         lanes,
@@ -94,24 +128,25 @@ function toKebabCase(title) {
  */
 export function getDefaultWorkspaceConfig() {
     return {
-        id: 'default',
-        name: 'My Project',
+        id: DEFAULT_WORKSPACE_ID,
+        name: DEFAULT_WORKSPACE_NAME,
         packs: [],
         lanes: [
             {
-                id: 'default',
-                title: 'Default',
+                id: DEFAULT_WORKSPACE_ID,
+                title: DEFAULT_LANE_TITLE,
                 allowed_scopes: [],
             },
         ],
         policies: {},
         security: {
             allowed_scopes: [],
-            network_default: 'off',
-            deny_overlays: ['~/.ssh', '~/.aws', '~/.gnupg', '.env'],
+            network_default: DEFAULT_SANDBOX_NETWORK_PROFILE,
+            deny_overlays: [...DEFAULT_DENY_OVERLAYS],
         },
-        memory_namespace: 'default',
-        event_namespace: 'default',
+        software_delivery: createEmptySoftwareDeliveryConfig(),
+        memory_namespace: DEFAULT_NAMESPACE,
+        event_namespace: DEFAULT_NAMESPACE,
     };
 }
 /**
@@ -134,6 +169,7 @@ export function buildWorkspaceConfig(input) {
             network_default: input.sandboxProfile,
             deny_overlays: input.deniedPaths,
         },
+        software_delivery: createEmptySoftwareDeliveryConfig(),
         memory_namespace: toKebabCase(input.projectName),
         event_namespace: toKebabCase(input.projectName),
     };
@@ -172,7 +208,7 @@ export function generateWorkspaceYaml(config) {
     lines.push('security:');
     lines.push('  # Workspace-level scope restrictions');
     lines.push(`  allowed_scopes: ${YAML.stringify(config.security.allowed_scopes).trim()}`);
-    lines.push('  # Network access default for sandbox (off = no network, full = unrestricted)');
+    lines.push(`  # Network access default for sandbox (${SANDBOX_NETWORK_PROFILE.OFF} = no network, ${SANDBOX_NETWORK_PROFILE.FULL} = unrestricted)`);
     lines.push(`  network_default: ${config.security.network_default}`);
     lines.push('  # Paths denied to agent sandbox via deny overlays');
     lines.push('  deny_overlays:');
@@ -186,6 +222,9 @@ export function generateWorkspaceYaml(config) {
         }
     }
     lines.push('');
+    lines.push('# Software delivery config extensions (required workspace v2 block)');
+    lines.push(`software_delivery: ${YAML.stringify(config.software_delivery).trim()}`);
+    lines.push('');
     lines.push('# Memory namespace for session tracking and context recovery');
     lines.push(`memory_namespace: ${YAML.stringify(config.memory_namespace).trim()}`);
     lines.push('');
@@ -270,51 +309,12 @@ export async function runInteractive(targetDir, force = false) {
     }
 }
 // --- CLI entry point ---
-const WORKSPACE_INIT_OPTIONS = {
-    yes: {
-        name: 'yes',
-        flags: '--yes, -y',
-        description: 'Accept all defaults non-interactively',
-    },
-    output: {
-        name: 'output',
-        flags: '--output, -o <dir>',
-        description: 'Output directory (default: current directory)',
-    },
-    force: {
-        name: 'force',
-        flags: '--force, -f',
-        description: 'Overwrite existing workspace.yaml',
-    },
-};
 /**
  * CLI main entry point for workspace:init
  */
 export async function main() {
-    const opts = createWUParser({
-        name: 'workspace-init',
-        description: 'Initialize a LumenFlow workspace configuration (workspace.yaml)',
-        options: [
-            WORKSPACE_INIT_OPTIONS.yes,
-            WORKSPACE_INIT_OPTIONS.output,
-            WORKSPACE_INIT_OPTIONS.force,
-        ],
-    });
-    const targetDir = opts.output ?? process.cwd();
-    const force = Boolean(opts.force);
-    const useDefaults = Boolean(opts.yes);
-    if (useDefaults) {
-        const result = await runNonInteractive(targetDir, force);
-        if (result.created.length > 0) {
-            console.log(`${LOG_PREFIX} Created ${WORKSPACE_FILENAME} with default settings`);
-        }
-        else if (result.skipped.length > 0) {
-            console.log(`${LOG_PREFIX} ${WORKSPACE_FILENAME} already exists. Use --force to overwrite.`);
-        }
-    }
-    else {
-        await runInteractive(targetDir, force);
-    }
+    const invokedEntryPoint = path.basename(process.argv[1] ?? LEGACY_WORKSPACE_INIT_ENTRYPOINT, '.js');
+    console.warn(buildLegacyWorkspaceInitGuidance(invokedEntryPoint));
 }
 // Run if executed directly
 if (import.meta.main) {

package/dist/wu-block.js

@@ -178,7 +178,7 @@ async function handleWorktreeRemoval(args, doc) {
         console.warn(`${LOG_PREFIX.BLOCK} No worktree path specified; skipping removal`);
     }
 }
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-block',
         description: 'Block a work unit and move it from in-progress to blocked status',

package/dist/wu-brief.js

@@ -26,7 +26,7 @@ const BRIEF_LOG_PREFIX = '[wu:brief]';
 /**
  * Main entry point for wu:brief (canonical command)
  */
-async function main() {
+export async function main() {
     await runBriefLogic({
         parserConfig: {
             name: 'wu-brief',

package/dist/wu-claim.js

@@ -127,7 +127,7 @@ export async function maybeLaunchClaimSandboxSession(input, deps = {}) {
 // Main orchestrator
 // ============================================================================
 // eslint-disable-next-line sonarjs/cognitive-complexity -- main() orchestrates multi-step claim workflow
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-claim',
         description: 'Claim a work unit by creating a worktree/branch and updating status',

package/dist/wu-cleanup.js

@@ -180,7 +180,7 @@ function hasStampFile(wuId) {
     const stampPath = path.join(process.cwd(), WU_PATHS.STAMP(wuId));
     return existsSync(stampPath);
 }
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-cleanup',
         description: 'Clean up worktree and branch after PR merge (PR-based completion workflow)',

package/dist/wu-create.js

@@ -124,7 +124,7 @@ export function warnIfBetterLaneExists(providedLane, codePathsArray, title, desc
  * Resolve lane lifecycle classification for wu:create without mutating config.
  *
  * WU-1751: wu:create must not persist lifecycle migration side effects to
- * .lumenflow.config.yaml on main.
+ * workspace.yaml on main.
  */
 export function resolveLaneLifecycleForWuCreate(projectRoot) {
     return ensureLaneLifecycleForProject(projectRoot, { persist: false });
@@ -182,7 +182,7 @@ async function getDefaultAssignedTo() {
         return '';
     }
 }
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-create',
         description: 'Create a new Work Unit with micro-worktree isolation (race-safe)',
@@ -267,7 +267,7 @@ async function main() {
             `  - Single colon with EXACTLY one space after (e.g., "Parent: Subdomain")\n` +
             `  - No spaces before colon\n` +
             `  - No multiple colons\n\n` +
-            `See .lumenflow.config.yaml for valid parent lanes.`);
+            `See workspace.yaml software_delivery.lanes.definitions for valid parent lanes.`);
     }
     // WU-2330: Warn if a more specific sub-lane matches code_paths or description
     warnIfBetterLaneExists(args.lane, args.codePaths, args.title, args.description);

package/dist/wu-delegate.js

@@ -8,7 +8,7 @@
  */
 import { runBriefLogic } from './wu-spawn.js';
 import { runCLI } from './cli-entry-point.js';
-async function main() {
+export async function main() {
     await runBriefLogic({
         mode: 'delegate',
         parserConfig: {

package/dist/wu-deps.js

@@ -18,7 +18,7 @@ import { buildDependencyGraphAsync, renderASCII, renderMermaid, validateGraph, }
 import { OUTPUT_FORMATS } from '@lumenflow/initiatives/constants';
 import { PATTERNS } from '@lumenflow/core/wu-constants';
 import { getConfig } from '@lumenflow/core/config';
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-deps',
         description: 'Visualize WU dependency graph',

package/dist/wu-done.js

@@ -126,6 +126,63 @@ const MEMORY_CHECKPOINT_NOTES = {
     PRE_GATES: 'Pre-gates checkpoint for recovery if gates fail',
 };
 const MEMORY_SIGNAL_WINDOW_MS = 60 * 60 * 1000; // 1 hour for recent signals
+export const CHECKPOINT_GATE_MODES = {
+    OFF: 'off',
+    WARN: 'warn',
+    BLOCK: 'block',
+};
+const CHECKPOINT_GATE_CONFIG = {
+    PATH: 'memory.enforcement.require_checkpoint_for_done',
+    COMMAND_PREFIX: 'pnpm mem:checkpoint --wu',
+    WARN_TAG: 'WU-1998',
+};
+function buildCheckpointGateBlockMessage(id) {
+    return (`${STRING_LITERALS.NEWLINE}${LOG_PREFIX.DONE} ${EMOJI.FAILURE} No checkpoints found for ${id} session.${STRING_LITERALS.NEWLINE}` +
+        `${LOG_PREFIX.DONE} ${CHECKPOINT_GATE_CONFIG.PATH} is set to '${CHECKPOINT_GATE_MODES.BLOCK}'.${STRING_LITERALS.NEWLINE}` +
+        `${LOG_PREFIX.DONE} Create a checkpoint before completing: ${CHECKPOINT_GATE_CONFIG.COMMAND_PREFIX} ${id}${STRING_LITERALS.NEWLINE}`);
+}
+function buildCheckpointGateWarnMessages(id) {
+    return [
+        `${STRING_LITERALS.NEWLINE}${LOG_PREFIX.DONE} ${EMOJI.INFO} ${CHECKPOINT_GATE_CONFIG.WARN_TAG}: No prior checkpoints recorded for ${id} in this session.`,
+        `${LOG_PREFIX.DONE} A pre-gates checkpoint will be created automatically by wu:done.`,
+        `${LOG_PREFIX.DONE} For earlier crash recovery, run '${CHECKPOINT_GATE_CONFIG.COMMAND_PREFIX} ${id}' after each acceptance criterion, before gates, or every 30 tool calls.${STRING_LITERALS.NEWLINE}`,
+    ];
+}
+export function resolveCheckpointGateMode(mode) {
+    if (mode === CHECKPOINT_GATE_MODES.OFF) {
+        return CHECKPOINT_GATE_MODES.OFF;
+    }
+    if (mode === CHECKPOINT_GATE_MODES.BLOCK) {
+        return CHECKPOINT_GATE_MODES.BLOCK;
+    }
+    return CHECKPOINT_GATE_MODES.WARN;
+}
+export async function enforceCheckpointGateForDone({ id, workspacePath, mode, queryByWuFn = queryByWu, hasSessionCheckpointsFn = hasSessionCheckpoints, log = console.log, blocker = (message) => {
+    die(message);
+}, }) {
+    if (mode === CHECKPOINT_GATE_MODES.OFF) {
+        return;
+    }
+    let wuNodes;
+    try {
+        wuNodes = await queryByWuFn(workspacePath, id);
+        if (hasSessionCheckpointsFn(id, wuNodes)) {
+            return;
+        }
+    }
+    catch {
+        // Fail-open: checkpoint discovery issues should not block wu:done.
+        return;
+    }
+    if (mode === CHECKPOINT_GATE_MODES.BLOCK) {
+        blocker(buildCheckpointGateBlockMessage(id));
+        return;
+    }
+    const warnMessages = buildCheckpointGateWarnMessages(id);
+    for (const message of warnMessages) {
+        log(message);
+    }
+}
 function normalizeWUDocLike(doc) {
     if (!doc || typeof doc !== 'object') {
         return {};
@@ -2078,7 +2135,7 @@ function printStateHUD({ id, docMain, isBranchOnly, isDocsOnly, derivedWorktree,
     console.log(`\n${LOG_PREFIX.DONE} HUD: WU=${id} status=${yamlStatus} stamp=${stampExists} locked=${yamlLocked} mode=${mode} branch=${branch} worktree=${worktreeDisplay}`);
 }
 // eslint-disable-next-line sonarjs/cognitive-complexity -- Pre-existing complexity, refactor tracked separately
-async function main() {
+export async function main() {
     // Allow pre-push hook to recognize wu:done automation (WU-1030)
     process.env.LUMENFLOW_WU_TOOL = 'wu-done';
     // Validate CLI arguments and WU ID format (extracted to wu-done-validators.ts)
@@ -2198,39 +2255,14 @@ async function main() {
     });
     // Step 0: Run gates (WU-1215: extracted to executeGates function)
     const worktreePath = effectiveWorktreePath;
-    // WU-1471 AC3: Config-driven checkpoint gate (replaces WU-1943 hardcoded warn)
-    // Reads memory.enforcement.require_checkpoint_for_done from config:
-    //   'off'  - skip checkpoint check entirely
-    //   'warn' - warn but allow wu:done (default, fail-open)
-    //   'block' - fail wu:done if no checkpoints found
-    try {
-        const checkpointGateConfig = getConfig();
-        const requireCheckpoint = checkpointGateConfig.memory?.enforcement?.require_checkpoint_for_done ?? 'warn';
-        if (requireCheckpoint !== 'off') {
-            const wuNodes = await queryByWu(worktreePath || mainCheckoutPath, id);
-            if (!hasSessionCheckpoints(id, wuNodes)) {
-                if (requireCheckpoint === 'block') {
-                    die(`\n${LOG_PREFIX.DONE} ${EMOJI.FAILURE} No checkpoints found for ${id} session.\n` +
-                        `${LOG_PREFIX.DONE} memory.enforcement.require_checkpoint_for_done is set to 'block'.\n` +
-                        `${LOG_PREFIX.DONE} Create a checkpoint before completing: pnpm mem:checkpoint --wu ${id}\n`);
-                }
-                else {
-                    // 'warn' mode (default)
-                    console.log(`\n${LOG_PREFIX.DONE} ${EMOJI.WARNING} WU-1943: No checkpoints found for ${id} session.`);
-                    console.log(`${LOG_PREFIX.DONE} Consider using 'pnpm mem:checkpoint --wu ${id}' periodically for crash recovery.`);
-                    console.log(`${LOG_PREFIX.DONE} Checkpoint triggers: after each acceptance criterion, before gates, every 30 tool calls.\n`);
-                }
-            }
-        }
-    }
-    catch (checkpointErr) {
-        // Non-blocking in 'warn' mode: checkpoint check failure should not block wu:done
-        // In 'block' mode, die() already exited, so this only catches non-die errors
-        if (checkpointErr instanceof Error && checkpointErr.message?.includes('No checkpoints found')) {
-            throw checkpointErr; // Re-throw die() errors
-        }
-        // Otherwise silently allow - fail-open
-    }
+    // WU-1471 AC3 + WU-1998: Config-driven checkpoint gate with accurate warn-mode messaging.
+    const checkpointGateConfig = getConfig();
+    const requireCheckpoint = resolveCheckpointGateMode(checkpointGateConfig.memory?.enforcement?.require_checkpoint_for_done);
+    await enforceCheckpointGateForDone({
+        id,
+        workspacePath: worktreePath || mainCheckoutPath,
+        mode: requireCheckpoint,
+    });
     // WU-1663: Preparation complete - transition to gating state
     pipelineActor.send({ type: WU_DONE_EVENTS.PREPARATION_COMPLETE });
     // WU-1663: Wrap gates in try/catch to send pipeline failure event

package/dist/wu-edit.js

@@ -247,7 +247,7 @@ async function ensureCleanWorkingTree() {
  * Main entry point
  */
 // eslint-disable-next-line sonarjs/cognitive-complexity -- Pre-existing complexity, refactor tracked separately
-async function main() {
+export async function main() {
     const opts = parseArgs();
     const { id } = opts;
     console.log(`${PREFIX} Starting WU edit for ${id}`);

package/dist/wu-infer-lane.js

@@ -97,7 +97,7 @@ function loadWuYaml(id) {
             `  2. Fix YAML errors manually and retry`);
     }
 }
-async function main() {
+export async function main() {
     const args = parseArgs(process.argv);
     let codePaths = [];
     let description = '';

package/dist/wu-preflight.js

@@ -54,7 +54,7 @@ function detectWorktreePath(id) {
 /**
  * Main entry point
  */
-async function main() {
+export async function main() {
     const PREFIX = LOG_PREFIX.PREFLIGHT;
     // WU-1180: Use createWUParser for proper Commander help output
     const args = createWUParser({

package/dist/wu-prep.js

@@ -317,7 +317,7 @@ function printSuccessMessage(wuId, mainCheckout) {
 /**
  * Main entry point.
  */
-async function main() {
+export async function main() {
     // Parse arguments
     const args = createWUParser({
         name: 'wu-prep',

package/dist/wu-proto.js

@@ -220,7 +220,7 @@ function claimWU(wuId, lane) {
         die(`Failed to claim WU: ${error.message}`);
     }
 }
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-proto',
         description: 'Create and claim a prototype WU with relaxed validation (rapid prototyping)',

package/dist/wu-prune.js

@@ -123,7 +123,7 @@ async function validateWorktree(wt) {
     }
     return { valid: true, warnings, errors };
 }
-async function main() {
+export async function main() {
     const args = parseArgs(process.argv);
     const PREFIX = LOG_PREFIX.PRUNE;
     if (args.help) {

package/dist/wu-recover.js

@@ -473,7 +473,7 @@ export async function executeRecoveryAction(action, wuId) {
 /**
  * Main entry point
  */
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-recover',
         description: 'Analyze and fix WU state inconsistencies (WU-1090)',

package/dist/wu-release.js

@@ -47,7 +47,7 @@ export function clearClaimMetadataOnRelease(doc) {
 export function shouldUseBranchPrReleasePath(doc) {
     return shouldUseBranchPrStatePath(doc);
 }
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-release',
         description: 'Release an orphaned WU from in_progress back to ready state for reclaiming',

package/dist/wu-repair.js

@@ -212,7 +212,7 @@ async function routeToRepairMode(options) {
     }
     return runConsistencyRepairMode(options);
 }
-async function main() {
+export async function main() {
     const options = createProgram();
     validateOptions(options);
     validateModeRequirements(options);

package/dist/wu-sandbox.js

@@ -11,14 +11,14 @@ import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { parse as parseYaml } from 'yaml';
-import { createWUParser, WU_OPTIONS, resolveLocation, readWURaw, buildSandboxProfile, resolveSandboxBackendForPlatform, SANDBOX_BACKEND_IDS, createLinuxSandboxBackend, createMacosSandboxBackend, createWindowsSandboxBackend, } from '@lumenflow/core';
+import { createWUParser, WU_OPTIONS, resolveLocation, readWURaw, buildSandboxProfile, resolveSandboxBackendForPlatform, SANDBOX_BACKEND_IDS, createLinuxSandboxBackend, createMacosSandboxBackend, createWindowsSandboxBackend, WORKSPACE_CONFIG_FILE_NAME, WORKSPACE_V2_KEYS, } from '@lumenflow/core';
 import { WU_PATHS, defaultWorktreeFrom } from '@lumenflow/core/wu-paths';
 import { die } from '@lumenflow/core/error-handler';
 import { LOG_PREFIX, EXIT_CODES } from '@lumenflow/core/wu-constants';
 import { runCLI } from './cli-entry-point.js';
 const PREFIX = LOG_PREFIX.CLAIM.replace('wu-claim', 'wu:sandbox');
-const CONFIG_FILE = '.lumenflow.config.yaml';
 const DEFAULT_ALLOW_UNSANDBOXED_ENV_VAR = 'LUMENFLOW_SANDBOX_ALLOW_UNSANDBOXED';
+const SOFTWARE_DELIVERY_KEY = WORKSPACE_V2_KEYS.SOFTWARE_DELIVERY;
 function toNormalizedAbsolute(targetPath) {
     const normalized = path.resolve(targetPath);
     return normalized.length > 1 && normalized.endsWith(path.sep)
@@ -36,41 +36,54 @@ function parsePolicyConfig(value) {
     }
     return value;
 }
-export function readSandboxPolicy(projectRoot) {
-    const configPath = path.join(projectRoot, CONFIG_FILE);
+function readWorkspaceSoftwareDelivery(projectRoot) {
+    const configPath = path.join(projectRoot, WORKSPACE_CONFIG_FILE_NAME);
     if (!existsSync(configPath)) {
-        return {
-            allowUnsandboxedEnvVar: DEFAULT_ALLOW_UNSANDBOXED_ENV_VAR,
-            extraWritableRoots: [],
-            denyWritableRoots: [],
-        };
+        return null;
     }
     try {
-        const raw = parseYaml(readFileSync(configPath, 'utf8'));
-        const sandbox = parsePolicyConfig(raw?.sandbox);
-        const allowUnsandboxedEnvVar = typeof sandbox.allow_unsandboxed_fallback_env === 'string' &&
-            sandbox.allow_unsandboxed_fallback_env.trim() !== ''
-            ? sandbox.allow_unsandboxed_fallback_env.trim()
-            : DEFAULT_ALLOW_UNSANDBOXED_ENV_VAR;
-        const extraWritableRoots = Array.isArray(sandbox.extra_writable_roots)
-            ? sandbox.extra_writable_roots.filter((value) => typeof value === 'string')
-            : [];
-        const denyWritableRoots = Array.isArray(sandbox.deny_writable_roots)
-            ? sandbox.deny_writable_roots.filter((value) => typeof value === 'string')
-            : [];
-        return {
-            allowUnsandboxedEnvVar,
-            extraWritableRoots,
-            denyWritableRoots,
-        };
+        const parsed = parseYaml(readFileSync(configPath, 'utf8'));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return null;
+        }
+        const workspace = parsed;
+        const softwareDelivery = workspace[SOFTWARE_DELIVERY_KEY];
+        if (!softwareDelivery ||
+            typeof softwareDelivery !== 'object' ||
+            Array.isArray(softwareDelivery)) {
+            return null;
+        }
+        return softwareDelivery;
     }
     catch {
+        return null;
+    }
+}
+export function readSandboxPolicy(projectRoot) {
+    const softwareDelivery = readWorkspaceSoftwareDelivery(projectRoot);
+    if (!softwareDelivery) {
         return {
             allowUnsandboxedEnvVar: DEFAULT_ALLOW_UNSANDBOXED_ENV_VAR,
             extraWritableRoots: [],
             denyWritableRoots: [],
         };
     }
+    const sandbox = parsePolicyConfig(softwareDelivery.sandbox);
+    const allowUnsandboxedEnvVar = typeof sandbox.allow_unsandboxed_fallback_env === 'string' &&
+        sandbox.allow_unsandboxed_fallback_env.trim() !== ''
+        ? sandbox.allow_unsandboxed_fallback_env.trim()
+        : DEFAULT_ALLOW_UNSANDBOXED_ENV_VAR;
+    const extraWritableRoots = Array.isArray(sandbox.extra_writable_roots)
+        ? sandbox.extra_writable_roots.filter((value) => typeof value === 'string')
+        : [];
+    const denyWritableRoots = Array.isArray(sandbox.deny_writable_roots)
+        ? sandbox.deny_writable_roots.filter((value) => typeof value === 'string')
+        : [];
+    return {
+        allowUnsandboxedEnvVar,
+        extraWritableRoots,
+        denyWritableRoots,
+    };
 }
 export function extractSandboxCommandFromArgv(argv) {
     const separator = argv.indexOf('--');
@@ -244,7 +257,7 @@ export async function runWuSandbox(input) {
     }
     return runCommand(commandToRun, commandArgs, worktreePath);
 }
-async function main() {
+export async function main() {
     const options = parseWuSandboxOptions(process.argv);
     const exitCode = await runWuSandbox(options);
     process.exit(exitCode);

package/dist/wu-status.js

@@ -152,7 +152,7 @@ export function getStatusExitCode(context) {
 /**
  * Main entry point
  */
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-status',
         description: 'Show WU status, location, and valid commands (WU-1090)',

package/dist/wu-unblock.js

@@ -114,7 +114,7 @@ function handleWorktreeCreation(args, doc) {
     }
     createWorktree(doc, worktreePath, branchName);
 }
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-unblock',
         description: 'Unblock a work unit and move it from blocked to in-progress status',

package/dist/wu-unlock-lane.js

@@ -96,7 +96,7 @@ function showLaneStatus(lane) {
         console.log(`    pnpm wu:unlock-lane --lane "${lane}" --reason "<explanation>" --force`);
     }
 }
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-unlock-lane',
         description: 'Safely unlock a lane lock with audit logging',

package/dist/wu-validate.js

@@ -139,7 +139,7 @@ function validateAllWUs({ strict = true } = {}) {
 /**
  * Main entry point
  */
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-validate',
         description: 'Validate WU YAML files against schema (strict mode by default, WU-1329)',