@mnemom/mnemom 0.9.1 → 0.11.0

package/dist/commands/governance.js

@@ -0,0 +1,331 @@
+/**
+ * `mnemom governance` — operator CLI for governance signals (ADR-048).
+ *
+ * Subcommands:
+ *
+ *   signals      list | show | ack | resolve | dismiss
+ *   destinations list | add | remove | test
+ *   rules        list | add | remove
+ *
+ * The signal surface is operator-actionable: cron-driven sideband
+ * detections, future protection / posture observations. Distinct from
+ * `mnemom advisories list` (now narrowed to runtime.* / manual.* per
+ * ADR-048 §1).
+ */
+import chalk from "chalk";
+import { acknowledgeGovernanceSignal, createGovernanceDestination, createGovernanceRule, deleteGovernanceDestination, deleteGovernanceRule, dismissGovernanceSignal, getGovernanceSignal, listGovernanceDestinations, listGovernanceRules, listGovernanceSignalsForAgent, listGovernanceSignalsForOrg, listGovernanceSignalsForTeam, resolveGovernanceSignal, testGovernanceDestination, } from "../lib/api.js";
+import { requireAuth } from "../lib/auth.js";
+// ─── Formatting helpers ──────────────────────────────────────────────────
+function shortId(id) {
+    return id.length <= 16 ? id : id.slice(0, 13) + "...";
+}
+function severityColor(s) {
+    switch (s) {
+        case "critical":
+            return chalk.bgRed.white;
+        case "high":
+            return chalk.red;
+        case "warn":
+            return chalk.yellow;
+        default:
+            return chalk.cyan;
+    }
+}
+function statusBadge(s) {
+    switch (s) {
+        case "open":
+            return chalk.bold.red("OPEN");
+        case "acknowledged":
+            return chalk.yellow("ACK");
+        case "resolved":
+            return chalk.green("RESOLVED");
+        case "dismissed":
+            return chalk.dim("DISMISSED");
+        case "expired":
+            return chalk.dim("expired");
+        default:
+            return chalk.dim(s.toUpperCase());
+    }
+}
+function formatSignalRow(s) {
+    const sev = severityColor(s.severity)(s.severity.toUpperCase().padEnd(8));
+    return [
+        chalk.dim(shortId(s.id).padEnd(16)),
+        sev,
+        chalk.cyan(s.source.padEnd(22)),
+        chalk.magenta((s.pattern_type || "—").slice(0, 28).padEnd(28)),
+        statusBadge(s.status).padEnd(20),
+        chalk.dim(s.detected_at.replace("T", " ").replace(/\.\d+Z$/, "Z")),
+    ].join("  ");
+}
+// ─── signals list ────────────────────────────────────────────────────────
+export async function governanceSignalsListCommand(opts) {
+    await requireAuth();
+    const filters = {
+        source: opts.source,
+        severity: opts.severity,
+        status: opts.status,
+        scope: opts.scope,
+        pattern_type: opts.patternType,
+        since: opts.since,
+        limit: opts.limit ? parseInt(opts.limit, 10) : 100,
+    };
+    let result;
+    if (opts.org) {
+        result = await listGovernanceSignalsForOrg(opts.org, filters);
+    }
+    else if (opts.team) {
+        result = await listGovernanceSignalsForTeam(opts.team, filters);
+    }
+    else if (opts.agent) {
+        result = await listGovernanceSignalsForAgent(opts.agent, filters);
+    }
+    else {
+        throw new Error("One of --org, --team, --agent is required.");
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    const signals = result.signals;
+    if (signals.length === 0) {
+        console.log(chalk.dim("(no governance signals match)"));
+        return;
+    }
+    console.log([
+        chalk.bold("ID".padEnd(16)),
+        chalk.bold("SEVERITY".padEnd(8)),
+        chalk.bold("SOURCE".padEnd(22)),
+        chalk.bold("PATTERN".padEnd(28)),
+        chalk.bold("STATUS".padEnd(20)),
+        chalk.bold("DETECTED"),
+    ].join("  "));
+    for (const s of signals)
+        console.log(formatSignalRow(s));
+    console.log("");
+    console.log(chalk.dim(`${signals.length} signal(s).`));
+}
+// ─── signals show ────────────────────────────────────────────────────────
+export async function governanceSignalsShowCommand(signalId, opts) {
+    await requireAuth();
+    const signal = await getGovernanceSignal(signalId);
+    if (opts.json) {
+        console.log(JSON.stringify(signal, null, 2));
+        return;
+    }
+    console.log(chalk.bold(`Signal ${signal.id}`));
+    console.log(`  scope:     ${signal.scope} (${signal.scope_id})`);
+    console.log(`  source:    ${chalk.cyan(signal.source)}`);
+    console.log(`  pattern:   ${chalk.magenta(signal.pattern_type)}`);
+    console.log(`  severity:  ${severityColor(signal.severity)(signal.severity)}`);
+    console.log(`  status:    ${statusBadge(signal.status)}`);
+    console.log(`  detected:  ${signal.detected_at} by ${signal.detected_by}`);
+    console.log(`  org:       ${signal.org_id}`);
+    if (signal.team_id)
+        console.log(`  team:      ${signal.team_id}`);
+    console.log(`  agents:    ${signal.agent_ids.length === 0 ? "(none)" : signal.agent_ids.join(", ")}`);
+    if (signal.acknowledged_at) {
+        console.log(`  ack:       ${signal.acknowledged_at} (${signal.acknowledged_actor_role ?? "?"})${signal.acknowledged_by ? ` by ${signal.acknowledged_by}` : ""}`);
+    }
+    if (signal.resolved_at) {
+        console.log(`  resolved:  ${signal.resolved_at} (${signal.resolution_status ?? "?"})${signal.action_taken ? ` — ${signal.action_taken}` : ""}`);
+    }
+    if (Object.keys(signal.detail ?? {}).length > 0) {
+        console.log(chalk.dim("  detail:"));
+        console.log(JSON.stringify(signal.detail, null, 2)
+            .split("\n")
+            .map((l) => "    " + l)
+            .join("\n"));
+    }
+}
+// ─── signals ack/resolve/dismiss ─────────────────────────────────────────
+export async function governanceSignalsAckCommand(signalId, opts) {
+    await requireAuth();
+    const signal = await acknowledgeGovernanceSignal(signalId, {
+        action_taken: opts.action,
+    });
+    if (opts.json) {
+        console.log(JSON.stringify(signal, null, 2));
+        return;
+    }
+    console.log(chalk.green(`✓ Acknowledged ${signal.id} as ${signal.acknowledged_actor_role}.`));
+}
+export async function governanceSignalsResolveCommand(signalId, opts) {
+    await requireAuth();
+    const valid = [
+        "action_taken",
+        "wont_fix",
+        "duplicate",
+        "false_positive",
+        "self_resolved",
+    ];
+    if (!valid.includes(opts.status)) {
+        throw new Error(`--status must be one of: ${valid.join(", ")}`);
+    }
+    const signal = await resolveGovernanceSignal(signalId, {
+        resolution_status: opts.status,
+        action_taken: opts.action,
+    });
+    if (opts.json) {
+        console.log(JSON.stringify(signal, null, 2));
+        return;
+    }
+    console.log(chalk.green(`✓ Resolved ${signal.id} (${signal.resolution_status}).`));
+}
+export async function governanceSignalsDismissCommand(signalId, opts) {
+    await requireAuth();
+    const signal = await dismissGovernanceSignal(signalId, { reason: opts.reason });
+    if (opts.json) {
+        console.log(JSON.stringify(signal, null, 2));
+        return;
+    }
+    console.log(chalk.dim(`✓ Dismissed ${signal.id}.`));
+}
+// ─── destinations ────────────────────────────────────────────────────────
+function formatDestinationRow(d) {
+    return [
+        chalk.dim(shortId(d.id).padEnd(16)),
+        chalk.cyan(d.channel.padEnd(10)),
+        (d.display_name ?? "(unnamed)").slice(0, 32).padEnd(32),
+        d.enabled ? chalk.green("enabled") : chalk.dim("disabled"),
+        d.last_test_status === "ok"
+            ? chalk.green(`tested ✓ ${d.last_tested_at?.slice(0, 19) ?? ""}`)
+            : d.last_test_status === "failed"
+                ? chalk.red(`tested ✗ ${d.last_test_error?.slice(0, 64) ?? ""}`)
+                : chalk.dim("untested"),
+    ].join("  ");
+}
+export async function governanceDestinationsListCommand(opts) {
+    await requireAuth();
+    const result = await listGovernanceDestinations(opts.org);
+    if (opts.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (result.destinations.length === 0) {
+        console.log(chalk.dim("(no destinations configured for this org)"));
+        return;
+    }
+    for (const d of result.destinations)
+        console.log(formatDestinationRow(d));
+}
+export async function governanceDestinationsAddCommand(opts) {
+    await requireAuth();
+    const validChannels = [
+        "webhook",
+        "slack",
+        "email",
+        "pagerduty",
+    ];
+    if (!validChannels.includes(opts.channel)) {
+        throw new Error(`--channel must be one of: ${validChannels.join(", ")}`);
+    }
+    let config;
+    try {
+        config = JSON.parse(opts.config);
+    }
+    catch {
+        throw new Error("--config must be valid JSON");
+    }
+    let filter;
+    if (opts.filter) {
+        try {
+            filter = JSON.parse(opts.filter);
+        }
+        catch {
+            throw new Error("--filter must be valid JSON");
+        }
+    }
+    const dest = await createGovernanceDestination(opts.org, {
+        channel: opts.channel,
+        config,
+        filter,
+        display_name: opts.name,
+    });
+    if (opts.json) {
+        console.log(JSON.stringify(dest, null, 2));
+        return;
+    }
+    console.log(chalk.green(`✓ Created destination ${dest.id} (${dest.channel}).`));
+}
+export async function governanceDestinationsRemoveCommand(destinationId, opts) {
+    await requireAuth();
+    await deleteGovernanceDestination(opts.org, destinationId);
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, removed: destinationId }, null, 2));
+        return;
+    }
+    console.log(chalk.green(`✓ Removed destination ${destinationId}.`));
+}
+export async function governanceDestinationsTestCommand(destinationId, opts) {
+    await requireAuth();
+    const result = await testGovernanceDestination(opts.org, destinationId);
+    if (opts.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (result.result.ok) {
+        console.log(chalk.green(`✓ Test signal delivered via ${result.channel} (${result.result.attempts} attempt).`));
+    }
+    else {
+        console.log(chalk.red(`✗ Test failed via ${result.channel}: ${result.result.last_error ?? "unknown"}`));
+        process.exitCode = 1;
+    }
+}
+// ─── rules ───────────────────────────────────────────────────────────────
+function formatRuleRow(r) {
+    return [
+        chalk.dim(shortId(r.id).padEnd(16)),
+        r.name.slice(0, 32).padEnd(32),
+        r.enabled ? chalk.green("enabled") : chalk.dim("disabled"),
+        chalk.dim(`fired ${r.fire_count}×`),
+        r.last_fired_at ? chalk.dim(`last ${r.last_fired_at.slice(0, 19)}`) : "",
+    ].join("  ");
+}
+export async function governanceRulesListCommand(opts) {
+    await requireAuth();
+    const result = await listGovernanceRules(opts.org);
+    if (opts.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (result.rules.length === 0) {
+        console.log(chalk.dim("(no escalation rules configured for this org)"));
+        return;
+    }
+    for (const r of result.rules)
+        console.log(formatRuleRow(r));
+}
+export async function governanceRulesAddCommand(opts) {
+    await requireAuth();
+    let predicate;
+    try {
+        predicate = JSON.parse(opts.predicate);
+    }
+    catch {
+        throw new Error("--predicate must be valid JSON");
+    }
+    const destinationIds = opts.destinations.split(",").map((s) => s.trim()).filter(Boolean);
+    if (destinationIds.length === 0) {
+        throw new Error("--destinations must list at least one destination ID (comma-separated)");
+    }
+    const rule = await createGovernanceRule(opts.org, {
+        name: opts.name,
+        predicate,
+        destination_ids: destinationIds,
+    });
+    if (opts.json) {
+        console.log(JSON.stringify(rule, null, 2));
+        return;
+    }
+    console.log(chalk.green(`✓ Created rule ${rule.id} ("${rule.name}").`));
+}
+export async function governanceRulesRemoveCommand(ruleId, opts) {
+    await requireAuth();
+    await deleteGovernanceRule(opts.org, ruleId);
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, removed: ruleId }, null, 2));
+        return;
+    }
+    console.log(chalk.green(`✓ Removed rule ${ruleId}.`));
+}

package/dist/commands/org.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `mnemom org list`
+ *
+ * Lists every org the user is a member of, including their personal-org-of-one
+ * (per ADR-044 Option A — GitHub model). Personal orgs are tagged `(personal)`
+ * in the Name column. Output is a human-readable table; pass `--json` for
+ * machine-readable output.
+ */
+export declare function orgListCommand(opts: {
+    json?: boolean;
+}): Promise<void>;
+/**
+ * `mnemom org show [<org_id>]` or `mnemom org show --personal`
+ *
+ * Print details for one organization. With `--personal`, fetches the user's
+ * personal org via `/v1/auth/me/personal-org`. Otherwise, the membership
+ * matching `<org_id>` is printed (or, if no id is given and the user has
+ * exactly one membership, that one).
+ */
+export declare function orgShowCommand(orgIdArg: string | undefined, opts: {
+    personal?: boolean;
+    json?: boolean;
+}): Promise<void>;

package/dist/commands/org.js

@@ -0,0 +1,122 @@
+import { listMyOrgs, getMyPersonalOrg } from "../lib/api.js";
+import { requireAuth } from "../lib/auth.js";
+import { fmt } from "../lib/format.js";
+/**
+ * `mnemom org list`
+ *
+ * Lists every org the user is a member of, including their personal-org-of-one
+ * (per ADR-044 Option A — GitHub model). Personal orgs are tagged `(personal)`
+ * in the Name column. Output is a human-readable table; pass `--json` for
+ * machine-readable output.
+ */
+export async function orgListCommand(opts) {
+    await requireAuth();
+    let orgs;
+    try {
+        orgs = await listMyOrgs();
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.log(fmt.error(`Failed to list orgs: ${msg}`) + "\n");
+        process.exit(1);
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(orgs, null, 2));
+        return;
+    }
+    console.log(fmt.header("Organizations"));
+    console.log();
+    if (orgs.length === 0) {
+        console.log("  No organizations found.\n");
+        return;
+    }
+    const nameW = 32;
+    const idW = 24;
+    const roleW = 10;
+    const ownerW = 8;
+    const header = "Name".padEnd(nameW) +
+        "ID".padEnd(idW) +
+        "Role".padEnd(roleW) +
+        "Owner".padEnd(ownerW);
+    console.log(`  ${header}`);
+    console.log(`  ${"─".repeat(nameW + idW + roleW + ownerW)}`);
+    for (const org of orgs) {
+        const tag = org.is_personal ? " (personal)" : "";
+        const name = `${org.name}${tag}`.slice(0, nameW - 2).padEnd(nameW);
+        const id = org.org_id.slice(0, idW - 2).padEnd(idW);
+        const role = (org.role ?? "-").padEnd(roleW);
+        const owner = (org.is_owner ? "yes" : "no").padEnd(ownerW);
+        console.log(`  ${name}${id}${role}${owner}`);
+    }
+    console.log(`\n  Total: ${orgs.length} organization(s)\n`);
+}
+/**
+ * `mnemom org show [<org_id>]` or `mnemom org show --personal`
+ *
+ * Print details for one organization. With `--personal`, fetches the user's
+ * personal org via `/v1/auth/me/personal-org`. Otherwise, the membership
+ * matching `<org_id>` is printed (or, if no id is given and the user has
+ * exactly one membership, that one).
+ */
+export async function orgShowCommand(orgIdArg, opts) {
+    await requireAuth();
+    let target = null;
+    try {
+        if (opts.personal) {
+            const ref = await getMyPersonalOrg();
+            // Re-resolve to the full org row so we can print every field.
+            const orgs = await listMyOrgs();
+            target = orgs.find((o) => o.org_id === ref.org_id) ?? null;
+        }
+        else {
+            const orgs = await listMyOrgs();
+            if (orgIdArg) {
+                target = orgs.find((o) => o.org_id === orgIdArg) ?? null;
+                if (!target) {
+                    console.log(fmt.error(`Org '${orgIdArg}' not found in your memberships.`) + "\n");
+                    process.exit(1);
+                }
+            }
+            else if (orgs.length === 1) {
+                target = orgs[0];
+            }
+            else {
+                console.log(fmt.warn(`You have ${orgs.length} memberships. Specify an org_id or pass --personal.`) + "\n");
+                process.exit(1);
+                return;
+            }
+        }
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.log(fmt.error(`Failed to fetch org: ${msg}`) + "\n");
+        process.exit(1);
+        return;
+    }
+    if (!target) {
+        console.log(fmt.error("Org not found.") + "\n");
+        process.exit(1);
+        return;
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(target, null, 2));
+        return;
+    }
+    console.log(fmt.header(target.name));
+    console.log();
+    console.log(`  ID:          ${target.org_id}`);
+    console.log(`  Slug:        ${target.slug}`);
+    console.log(`  Personal:    ${target.is_personal ? "yes" : "no"}`);
+    console.log(`  Role:        ${target.role ?? "-"}`);
+    console.log(`  Owner:       ${target.is_owner ? "yes (you)" : "no"}`);
+    if (target.billing_email) {
+        console.log(`  Billing:     ${target.billing_email}`);
+    }
+    if (target.company_name) {
+        console.log(`  Company:     ${target.company_name}`);
+    }
+    if (target.accepted_at) {
+        console.log(`  Accepted at: ${new Date(target.accepted_at).toLocaleDateString()}`);
+    }
+    console.log();
+}

package/dist/commands/posture.d.ts

@@ -0,0 +1,71 @@
+/**
+ * `mnemom posture ...` commands — Piece 3 of T1-3.1 (ADR-045).
+ *
+ *   mnemom posture list [--org <id>] [--include-platform=false] [--json]
+ *   mnemom posture show <posture_id> [--json]
+ *   mnemom posture create --org <id> --slug <slug> --name <name>
+ *                         --from <file> [--description <text>]
+ *   mnemom posture update <posture_id> --from <file> [--summary <text>]
+ *   mnemom posture clone <posture_id> --org <id> [--slug <slug>] [--name <name>]
+ *   mnemom posture revisions <posture_id> [--json]
+ *   mnemom posture diff <posture_id> --from <N> --to <M> [--json]
+ *   mnemom posture assign <posture_id> --team <team_id> [--pin-revision <N>]
+ *   mnemom posture unassign <posture_id> --team <team_id>
+ *   mnemom posture preview-compose <posture_id> --team <team_id> [--json]
+ *   mnemom posture delete <posture_id>
+ *
+ * Per ADR-045: postures are team-scoped policy input; cards remain
+ * agent-scoped runtime output. The CLI authenticates the user the same
+ * way `mnemom team` and `mnemom org` do — login token or MNEMOM_API_KEY.
+ */
+export declare function postureListCommand(opts: {
+    org?: string;
+    includePlatform?: boolean;
+    json?: boolean;
+}): Promise<void>;
+export declare function postureShowCommand(postureId: string | undefined, opts: {
+    json?: boolean;
+}): Promise<void>;
+export declare function postureCreateCommand(opts: {
+    org?: string;
+    slug?: string;
+    name?: string;
+    from?: string;
+    description?: string;
+    summary?: string;
+    json?: boolean;
+}): Promise<void>;
+export declare function postureUpdateCommand(postureId: string | undefined, opts: {
+    from?: string;
+    summary?: string;
+    name?: string;
+    description?: string;
+    json?: boolean;
+}): Promise<void>;
+export declare function postureCloneCommand(postureId: string | undefined, opts: {
+    org?: string;
+    slug?: string;
+    name?: string;
+    description?: string;
+    json?: boolean;
+}): Promise<void>;
+export declare function postureRevisionsCommand(postureId: string | undefined, opts: {
+    json?: boolean;
+}): Promise<void>;
+export declare function postureDiffCommand(postureId: string | undefined, opts: {
+    from?: string;
+    to?: string;
+    json?: boolean;
+}): Promise<void>;
+export declare function postureAssignCommand(postureId: string | undefined, opts: {
+    team?: string;
+    pinRevision?: string;
+}): Promise<void>;
+export declare function postureUnassignCommand(postureId: string | undefined, opts: {
+    team?: string;
+}): Promise<void>;
+export declare function posturePreviewComposeCommand(postureId: string | undefined, opts: {
+    team?: string;
+    json?: boolean;
+}): Promise<void>;
+export declare function postureDeleteCommand(postureId: string | undefined): Promise<void>;