@nepopsx/cli 0.0.23 → 0.0.25

package/dist/commands/guard.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `nepopsx guard` — a Claude Code PreToolUse hook. Reads the tool call from stdin,
+ * evaluates it against the local policy, and emits a `permissionDecision: deny`
+ * (which blocks the call) when a rule matches. NO network on the hot path.
+ *
+ * SOFT-FAIL by design: any error in the guard itself exits cleanly (fail-open) so it
+ * can never crash or hang the calling session. Only an explicit rule match blocks.
+ */
+export declare function guardCommand(): Promise<void>;
+//# sourceMappingURL=guard.d.ts.map

package/dist/commands/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/commands/guard.ts"],"names":[],"mappings":"AA0BA;;;;;;;GAOG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAgClD"}

package/dist/commands/guard.js

@@ -0,0 +1,63 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { BUILTIN_RULES, evaluate, validRule } from '../guard/policy.js';
+/** Read all of stdin (the hook payload). */
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString('utf-8');
+}
+/** Built-in rules + the locally-cached `.nepopsx/policy.json` (synced out-of-band). */
+function loadRules(cwd) {
+    const rules = [...BUILTIN_RULES];
+    const policyPath = resolve(cwd, '.nepopsx', 'policy.json');
+    if (existsSync(policyPath)) {
+        try {
+            const parsed = JSON.parse(readFileSync(policyPath, 'utf-8'));
+            if (Array.isArray(parsed.rules))
+                rules.push(...parsed.rules.filter(validRule));
+        }
+        catch {
+            /* fail-open: a corrupt policy file must never break the session */
+        }
+    }
+    return rules;
+}
+/**
+ * `nepopsx guard` — a Claude Code PreToolUse hook. Reads the tool call from stdin,
+ * evaluates it against the local policy, and emits a `permissionDecision: deny`
+ * (which blocks the call) when a rule matches. NO network on the hot path.
+ *
+ * SOFT-FAIL by design: any error in the guard itself exits cleanly (fail-open) so it
+ * can never crash or hang the calling session. Only an explicit rule match blocks.
+ */
+export async function guardCommand() {
+    try {
+        const raw = await readStdin();
+        if (!raw.trim())
+            return;
+        const payload = JSON.parse(raw);
+        const cwd = typeof payload.cwd === 'string' && payload.cwd ? payload.cwd : process.cwd();
+        const input = {
+            tool_name: typeof payload.tool_name === 'string' ? payload.tool_name : '',
+            tool_input: payload.tool_input ?? {},
+        };
+        const verdict = evaluate(input, loadRules(cwd));
+        if (verdict.decision === 'deny' && verdict.rule) {
+            // permissionDecision:deny blocks the tool call; the reason is shown to the agent.
+            process.stdout.write(`${JSON.stringify({
+                hookSpecificOutput: {
+                    hookEventName: 'PreToolUse',
+                    permissionDecision: 'deny',
+                    permissionDecisionReason: `[nepopsx policy:${verdict.rule.id}] ${verdict.rule.reason}`,
+                },
+            })}\n`);
+        }
+        // allow → no output, exit 0
+    }
+    catch {
+        /* fail-open */
+    }
+}
+//# sourceMappingURL=guard.js.map

package/dist/commands/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/commands/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAoC,MAAM,oBAAoB,CAAC;AAE1G,4CAA4C;AAC5C,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,uFAAuF;AACvF,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,KAAK,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IAC3D,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA0B,CAAC;YACtF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;YAAE,OAAO;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAI7B,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACzF,MAAM,KAAK,GAAe;YACxB,SAAS,EAAE,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;YACzE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;SACrC,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAChD,kFAAkF;YAClF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC;gBAChB,kBAAkB,EAAE;oBAClB,aAAa,EAAE,YAAY;oBAC3B,kBAAkB,EAAE,MAAM;oBAC1B,wBAAwB,EAAE,mBAAmB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE;iBACvF;aACF,CAAC,IAAI,CACP,CAAC;QACJ,CAAC;QACD,4BAA4B;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC"}

package/dist/commands/import-agents.d.ts

@@ -0,0 +1,17 @@
+interface ImportAgentsOptions {
+    config: string;
+    workspace?: string;
+    dryRun?: boolean;
+}
+/**
+ * `nepopsx import-agents` — comprehend a customer's existing custom agents
+ * (.claude/agents, .github/agents) into the platform as governed PENDING bundles.
+ *
+ * Scans both ecosystems, assembles agent-centric bundles (orchestration graph +
+ * dangling-ref flags), redacts secrets locally, then POSTs in size-bounded batches to
+ * /agents/import. Foreign agents are untrusted: every bundle lands PENDING (or
+ * QUARANTINED on a security-scan hit) for review — never auto-blessed.
+ */
+export declare function importAgentsCommand(options: ImportAgentsOptions): Promise<void>;
+export {};
+//# sourceMappingURL=import-agents.d.ts.map

package/dist/commands/import-agents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-agents.d.ts","sourceRoot":"","sources":["../../src/commands/import-agents.ts"],"names":[],"mappings":"AAYA,UAAU,mBAAmB;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAqED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+FrF"}

package/dist/commands/import-agents.js

@@ -0,0 +1,166 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { parse as parseYaml } from 'yaml';
+import chalk from 'chalk';
+import { resolveApiBase } from '../config/api-config.js';
+import { readLicense, resolveWorkspaceName } from '../licensing/index.js';
+import { fetchWithTimeout } from '../utils/fetch.js';
+import { DOWNLOAD_TIMEOUT_MS } from '../constants.js';
+import { scanRepo } from '../import/agents/scanner.js';
+import { assembleBundles } from '../import/agents/assembler.js';
+import { redactSecrets, redactValue } from '../import/agents/secret-scan.js';
+/** Conservative per-request budget — the /agents/import body limit 413s on big repos. */
+const MAX_REQUEST_BYTES = 60_000;
+/** Serialize one assembled bundle into the import payload, redacting secrets first. */
+function toPayload(b) {
+    const inst = redactSecrets(b.agent.instructions);
+    const rawR = redactSecrets(b.agent.raw);
+    const extraR = redactValue(b.agent.extra);
+    const redactions = inst.count + rawR.count + extraR.count;
+    const fidelity = [
+        ...b.fidelity,
+        ...b.agent.fidelity,
+        ...(redactions > 0
+            ? [{ field: 'secrets', severity: 'loss', detail: `Redacted ${redactions} secret(s) before import.` }]
+            : []),
+    ];
+    return {
+        redactions,
+        payload: {
+            slug: b.agent.slug,
+            name: b.agent.name,
+            kind: b.agent.kind,
+            description: b.agent.description,
+            originProvider: b.agent.originProvider,
+            instructions: inst.value,
+            importedFrom: b.agent.importedFrom,
+            fidelity,
+            ir: {
+                agent: {
+                    modelRaw: b.agent.modelRaw,
+                    tools: b.agent.tools,
+                    disallowedTools: b.agent.disallowedTools,
+                    subAgents: b.agent.subAgents,
+                    handoffs: b.agent.handoffs,
+                    userInvocable: b.agent.userInvocable,
+                    target: b.agent.target,
+                    extra: extraR.value,
+                    raw: rawR.value,
+                },
+                graph: b.graph,
+                skills: b.skills.map((s) => s.slug),
+            },
+        },
+    };
+}
+/** Greedily batch payloads so each POST body stays under the size limit (413 fix). */
+function chunkByBytes(items, maxBytes) {
+    const out = [];
+    let cur = [];
+    let size = 2; // "[]"
+    for (const it of items) {
+        const s = JSON.stringify(it).length + 1;
+        if (cur.length > 0 && size + s > maxBytes) {
+            out.push(cur);
+            cur = [];
+            size = 2;
+        }
+        cur.push(it);
+        size += s;
+    }
+    if (cur.length > 0)
+        out.push(cur);
+    return out;
+}
+/**
+ * `nepopsx import-agents` — comprehend a customer's existing custom agents
+ * (.claude/agents, .github/agents) into the platform as governed PENDING bundles.
+ *
+ * Scans both ecosystems, assembles agent-centric bundles (orchestration graph +
+ * dangling-ref flags), redacts secrets locally, then POSTs in size-bounded batches to
+ * /agents/import. Foreign agents are untrusted: every bundle lands PENDING (or
+ * QUARANTINED on a security-scan hit) for review — never auto-blessed.
+ */
+export async function importAgentsCommand(options) {
+    const cwd = process.cwd();
+    let config = {};
+    const configPath = resolve(cwd, options.config);
+    if (existsSync(configPath)) {
+        try {
+            const raw = parseYaml(readFileSync(configPath, 'utf-8'));
+            if (raw && typeof raw === 'object')
+                config = raw;
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+    const bundles = assembleBundles(scanRepo(cwd));
+    if (bundles.length === 0) {
+        console.log(chalk.dim('nepopsx import-agents: no agents found under .claude/agents or .github/agents.'));
+        return;
+    }
+    const serialized = bundles.map(toPayload);
+    const totalRedactions = serialized.reduce((n, s) => n + s.redactions, 0);
+    const dangling = bundles.reduce((n, b) => n + b.graph.filter((e) => !e.resolvedInSet).length, 0);
+    // ── Dry run: report locally, no auth, no POST ──────────────────────────────
+    if (options.dryRun) {
+        console.log(chalk.bold.cyan(`\n🔎 nepopsx import-agents — dry run (${bundles.length} bundle(s))\n`));
+        for (const b of bundles) {
+            const tag = b.agent.kind === 'command' ? chalk.magenta('orchestrator') : chalk.dim('agent');
+            const edges = b.graph.length ? ` graph[${b.graph.map((e) => e.to + (e.resolvedInSet ? '' : ' ✗')).join(', ')}]` : '';
+            console.log(`  ${chalk.bold(b.agent.slug)}  ${tag}  ${chalk.dim(`[${b.agent.originProvider}]`)}${edges}`);
+            console.log(`    ${chalk.dim(b.agent.importedFrom)}`);
+        }
+        const batches = chunkByBytes(serialized.map((s) => s.payload), MAX_REQUEST_BYTES);
+        console.log(chalk.dim(`\n  ${totalRedactions} secret(s) would be redacted · ${dangling} dangling ref(s) · ${batches.length} batch(es).`));
+        console.log(chalk.dim('  No changes sent. Re-run without --dry-run to import as PENDING for review.\n'));
+        return;
+    }
+    // ── Real run: auth + workspace, then POST in batches ───────────────────────
+    const license = readLicense(cwd);
+    if (!license) {
+        console.error(chalk.red('nepopsx import-agents: not logged in. Run `nepopsx login` first.'));
+        process.exitCode = 1;
+        return;
+    }
+    const workspace = options.workspace ?? resolveWorkspaceName(cwd, license, config);
+    if (!workspace || workspace === 'unknown') {
+        console.error(chalk.red('nepopsx import-agents: could not resolve a workspace. Pass --workspace.'));
+        process.exitCode = 1;
+        return;
+    }
+    const apiBase = resolveApiBase(cwd);
+    const batches = chunkByBytes(serialized.map((s) => s.payload), MAX_REQUEST_BYTES);
+    let received = 0;
+    let pending = 0;
+    let quarantined = 0;
+    try {
+        for (const [i, batch] of batches.entries()) {
+            const response = await fetchWithTimeout(`${apiBase}/agents/import`, {
+                method: 'POST',
+                headers: { Authorization: `Bearer ${license.key}`, 'Content-Type': 'application/json' },
+                body: JSON.stringify({ workspace, bundles: batch }),
+            }, DOWNLOAD_TIMEOUT_MS);
+            if (!response.ok) {
+                const body = await response.text().catch(() => '');
+                console.error(chalk.red(`nepopsx import-agents: batch ${i + 1}/${batches.length} → ${response.status} ${body.slice(0, 200)}`));
+                process.exitCode = 1;
+                return;
+            }
+            const json = (await response.json());
+            received += json.received ?? 0;
+            pending += json.pending ?? 0;
+            quarantined += json.quarantined ?? 0;
+        }
+    }
+    catch (err) {
+        console.error(chalk.red(`nepopsx import-agents: failed — ${err instanceof Error ? err.message : String(err)}`));
+        process.exitCode = 1;
+        return;
+    }
+    console.log(chalk.green(`\n✅ nepopsx import-agents: ${received} imported → ${pending} pending, ${quarantined} quarantined ` +
+        `(${totalRedactions} secret(s) redacted, ${batches.length} batch(es)).`));
+    console.log(chalk.dim('   Review pending agents in the dashboard before they render.'));
+}
+//# sourceMappingURL=import-agents.js.map

package/dist/commands/import-agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-agents.js","sourceRoot":"","sources":["../../src/commands/import-agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,eAAe,EAAoB,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAQ7E,yFAAyF;AACzF,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,uFAAuF;AACvF,SAAS,SAAS,CAAC,CAAc;IAC/B,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAE1D,MAAM,QAAQ,GAAG;QACf,GAAG,CAAC,CAAC,QAAQ;QACb,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ;QACnB,GAAG,CAAC,UAAU,GAAG,CAAC;YAChB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,UAAU,2BAA2B,EAAE,CAAC;YACrG,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO;QACL,UAAU;QACV,OAAO,EAAE;YACP,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI;YAClB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI;YAClB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI;YAClB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW;YAChC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc;YACtC,YAAY,EAAE,IAAI,CAAC,KAAK;YACxB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY;YAClC,QAAQ;YACR,EAAE,EAAE;gBACF,KAAK,EAAE;oBACL,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ;oBAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK;oBACpB,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe;oBACxC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS;oBAC5B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ;oBAC1B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa;oBACpC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;oBACtB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,GAAG,EAAE,IAAI,CAAC,KAAK;iBAChB;gBACD,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aACpC;SACF;KACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,YAAY,CAAI,KAAU,EAAE,QAAgB;IACnD,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,GAAG,GAAQ,EAAE,CAAC;IAClB,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO;IACrB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACxC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,QAAQ,EAAE,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,GAAG,GAAG,EAAE,CAAC;YACT,IAAI,GAAG,CAAC,CAAC;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,IAAI,CAAC,CAAC;IACZ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA4B;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAE1B,IAAI,MAAM,GAA4B,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YACzD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,MAAM,GAAG,GAA8B,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC,CAAC;QACzG,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAEjG,8EAA8E;IAC9E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC,OAAO,CAAC,MAAM,eAAe,CAAC,CAAC,CAAC;QACrG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5F,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrH,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;YAC1G,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,eAAe,kCAAkC,QAAQ,sBAAsB,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC;QAC1I,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC,CAAC;QACzG,OAAO;IACT,CAAC;IAED,8EAA8E;IAC9E,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC,CAAC;QAC7F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,IAAI,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAA2C,CAAC,CAAC;IACvG,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC,CAAC;QACpG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAClF,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,OAAO,gBAAgB,EAC1B;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBACvF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;aACpD,EACD,mBAAmB,CACpB,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,MAAM,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC/H,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkE,CAAC;YACtG,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;YAC/B,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YAC7B,WAAW,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,mCAAmC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAChH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CACT,8BAA8B,QAAQ,eAAe,OAAO,aAAa,WAAW,eAAe;QACjG,IAAI,eAAe,wBAAwB,OAAO,CAAC,MAAM,cAAc,CAC1E,CACF,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC,CAAC;AAC1F,CAAC"}

package/dist/commands/import.d.ts

@@ -0,0 +1,19 @@
+interface ImportOptions {
+    config: string;
+    workspace?: string;
+    source: string;
+    agent?: string;
+    dryRun?: boolean;
+    force?: boolean;
+}
+/**
+ * `nepopsx import` — ingest agent-memory files written by OTHER tools (GitHub
+ * Copilot instructions, Claude project memory) into the platform as PENDING
+ * learnings, routed to the resolved org/workspace and scoped by service.
+ *
+ * Governance: every imported learning is sent with frequency=1 so it can never
+ * auto-approve — it always lands in the review queue. Foreign memory is untrusted.
+ */
+export declare function importCommand(options: ImportOptions): Promise<void>;
+export {};
+//# sourceMappingURL=import.d.ts.map

package/dist/commands/import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import.d.ts","sourceRoot":"","sources":["../../src/commands/import.ts"],"names":[],"mappings":"AAeA,UAAU,aAAa;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAeD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAuLzE"}

package/dist/commands/import.js

@@ -0,0 +1,175 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { parse as parseYaml } from 'yaml';
+import chalk from 'chalk';
+import { resolveApiBase } from '../config/api-config.js';
+import { readLicense, resolveWorkspaceName } from '../licensing/index.js';
+import { fetchWithTimeout } from '../utils/fetch.js';
+import { DOWNLOAD_TIMEOUT_MS } from '../constants.js';
+import { writeYamlLearning } from '../learnings/yaml-learnings.js';
+import { regenerateMemoryIndex } from '../learnings/memory-index.js';
+import { copilotAdapter } from '../import/copilot-adapter.js';
+import { claudeMemoryAdapter } from '../import/claude-memory-adapter.js';
+const ADAPTERS = [copilotAdapter, claudeMemoryAdapter];
+/** Map an adapter's source tag to the constrained LearningYaml.source union. */
+function provenanceSource(adapterId) {
+    return adapterId === 'claude-memory' ? 'claude-auto-memory' : 'manual';
+}
+/**
+ * `nepopsx import` — ingest agent-memory files written by OTHER tools (GitHub
+ * Copilot instructions, Claude project memory) into the platform as PENDING
+ * learnings, routed to the resolved org/workspace and scoped by service.
+ *
+ * Governance: every imported learning is sent with frequency=1 so it can never
+ * auto-approve — it always lands in the review queue. Foreign memory is untrusted.
+ */
+export async function importCommand(options) {
+    const cwd = process.cwd();
+    // Load workspace config (services for scope inference + workspace name).
+    let config = {};
+    const configPath = resolve(cwd, options.config);
+    if (existsSync(configPath)) {
+        try {
+            const raw = parseYaml(readFileSync(configPath, 'utf-8'));
+            if (raw && typeof raw === 'object')
+                config = raw;
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+    const services = Array.isArray(config.services)
+        ? config.services
+            .filter((s) => typeof s?.name === 'string')
+            .map((s) => ({ name: s.name, path: s.path }))
+        : [];
+    const ctx = { rootDir: cwd, services };
+    // Select adapters.
+    const wanted = options.source === 'all' ? ADAPTERS.map((a) => a.id) : [options.source];
+    const selected = ADAPTERS.filter((a) => wanted.includes(a.id));
+    if (selected.length === 0) {
+        console.error(chalk.red(`Unknown --source "${options.source}". Use: copilot | claude-memory | all.`));
+        process.exitCode = 1;
+        return;
+    }
+    // Parse all candidates.
+    const importedDir = resolve(cwd, '.nepopsx', 'imported');
+    const candidates = [];
+    let skippedExisting = 0;
+    for (const adapter of selected) {
+        const agent = options.agent ?? adapter.id;
+        const files = adapter.detect(ctx);
+        for (const file of files) {
+            for (const raw of adapter.parse(file, ctx)) {
+                // Idempotency: skip a candidate already imported (unless --force).
+                const marker = resolve(importedDir, adapter.id, `${raw.slug}.yaml`);
+                if (!options.force && existsSync(marker)) {
+                    skippedExisting++;
+                    continue;
+                }
+                candidates.push({ adapterId: adapter.id, agent, raw });
+            }
+        }
+    }
+    if (candidates.length === 0) {
+        console.log(chalk.dim(`nepopsx import: nothing new to import` +
+            (skippedExisting > 0 ? ` (${skippedExisting} already imported — use --force to re-import).` : '.')));
+        return;
+    }
+    // ── Dry run: report and exit, no POST ──────────────────────────────────────
+    if (options.dryRun) {
+        console.log(chalk.bold.cyan(`\n🔎 nepopsx import — dry run (${candidates.length} candidate(s))\n`));
+        for (const c of candidates) {
+            const scope = c.raw.services && c.raw.services.length > 0 ? c.raw.services.join(', ') : 'workspace-wide';
+            console.log(`  ${chalk.bold(c.raw.slug)}  ${chalk.dim(`[${c.adapterId} → ${scope}]`)}`);
+            console.log(`    ${chalk.dim(c.raw.importedFrom)}`);
+        }
+        if (skippedExisting > 0) {
+            console.log(chalk.dim(`\n  (${skippedExisting} already imported; skipped.)`));
+        }
+        console.log(chalk.dim('\n  No changes written. Re-run without --dry-run to import as pending.\n'));
+        return;
+    }
+    // ── Real run: require auth + a resolved org/workspace ───────────────────────
+    const license = readLicense(cwd);
+    if (!license) {
+        console.error(chalk.red('nepopsx import: not logged in. Run `nepopsx login` first.'));
+        process.exitCode = 1;
+        return;
+    }
+    const workspace = options.workspace ?? resolveWorkspaceName(cwd, license, config);
+    if (!workspace || workspace === 'unknown') {
+        console.error(chalk.red('nepopsx import: could not resolve a workspace. Set workspace.name in workspace.yaml or pass --workspace.'));
+        process.exitCode = 1;
+        return;
+    }
+    if (!license.org) {
+        console.error(chalk.red('nepopsx import: could not resolve an org for this project. Run `nepopsx login` here, ' +
+            'or pin the org in workspace.yaml.'));
+        process.exitCode = 1;
+        return;
+    }
+    const namespace = `${license.org}/${workspace}`;
+    const apiBase = resolveApiBase(cwd);
+    // frequency=1 ⇒ low confidence ⇒ backend lands it PENDING (never auto-approved).
+    const patterns = candidates.map((c) => ({
+        type: c.raw.type ?? 'custom_instruction',
+        slug: c.raw.slug,
+        title: c.raw.title,
+        content: c.raw.content,
+        agent: c.agent,
+        applies_to: c.raw.appliesTo ?? [],
+        services: c.raw.services ?? [],
+        source: c.raw.source,
+        frequency: 1,
+        config_path: c.raw.configPath,
+        config_value: c.raw.configValue,
+    }));
+    let results = [];
+    try {
+        const response = await fetchWithTimeout(`${apiBase}/learnings/auto`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${license.key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ workspace, namespace, patterns }),
+        }, DOWNLOAD_TIMEOUT_MS);
+        if (!response.ok) {
+            const body = await response.text().catch(() => '');
+            console.error(chalk.red(`nepopsx import: backend ${response.status} — ${body.slice(0, 200)}`));
+            process.exitCode = 1;
+            return;
+        }
+        const json = (await response.json());
+        results = json.results ?? [];
+        // Write provenance YAML per candidate, stamped with the server's verdict.
+        const verdictBySlug = new Map(results.map((r) => [r.slug, r.status]));
+        for (const c of candidates) {
+            const status = verdictBySlug.get(c.raw.slug);
+            const yaml = {
+                slug: c.raw.slug,
+                type: (c.raw.type ?? 'custom_instruction'),
+                confidence: 'low',
+                agent: c.agent,
+                applies_to: c.raw.appliesTo ?? [],
+                services: c.raw.services ?? [],
+                status: status === 'rejected' ? 'reverted' : status === 'approved' ? 'approved' : 'pending',
+                content: c.raw.content,
+                evidence: `Imported from ${c.raw.importedFrom} via ${c.raw.source}`,
+                source: provenanceSource(c.adapterId),
+                created_at: new Date().toISOString(),
+            };
+            writeYamlLearning(resolve(importedDir, c.adapterId), yaml);
+        }
+        console.log(chalk.green(`\n✅ nepopsx import: ${json.received ?? patterns.length} imported → ` +
+            `${json.pending ?? 0} pending, ${json.auto_applied ?? 0} applied, ${json.rejected ?? 0} rejected (scanned).`));
+        console.log(chalk.dim('   Review pending imports in the dashboard, or `nepopsx sync` once approved.'));
+    }
+    catch (err) {
+        console.error(chalk.red(`nepopsx import: failed — ${err instanceof Error ? err.message : String(err)}`));
+        process.exitCode = 1;
+        return;
+    }
+    // Refresh the human-scannable index.
+    const index = regenerateMemoryIndex(cwd);
+    console.log(chalk.dim(`   MEMORY.md updated (${index.count} learnings indexed).\n`));
+}
+//# sourceMappingURL=import.js.map

package/dist/commands/import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import.js","sourceRoot":"","sources":["../../src/commands/import.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAWzE,MAAM,QAAQ,GAAoB,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;AAExE,gFAAgF;AAChF,SAAS,gBAAgB,CAAC,SAAiB;IACzC,OAAO,SAAS,KAAK,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzE,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAsB;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAE1B,yEAAyE;IACzE,IAAI,MAAM,GAA4B,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YACzD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,MAAM,GAAG,GAA8B,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC7C,CAAC,CAAE,MAAM,CAAC,QAAoD;aACzD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC;aAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAc,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,GAAG,GAAmB,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAEvD,mBAAmB;IACnB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,MAAM,wCAAwC,CAAC,CAAC,CAAC;QACtG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,wBAAwB;IACxB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC3C,mEAAmE;gBACnE,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;gBACpE,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzC,eAAe,EAAE,CAAC;oBAClB,SAAS;gBACX,CAAC;gBACD,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,uCAAuC;YACrC,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,eAAe,gDAAgD,CAAC,CAAC,CAAC,GAAG,CAAC,CACrG,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,8EAA8E;IAC9E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC,UAAU,CAAC,MAAM,kBAAkB,CAAC,CAAC,CAAC;QACpG,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;YACzG,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YACxF,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,eAAe,8BAA8B,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC,CAAC;QACnG,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,IAAI,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAA2C,CAAC,CAAC;IACvG,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,0GAA0G,CAAC,CACtH,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,uFAAuF;YACrF,mCAAmC,CACtC,CACF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAEpC,iFAAiF;IACjF,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,oBAAoB;QACxC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;QAChB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK;QAClB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE;QACjC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE;QAC9B,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;QACpB,SAAS,EAAE,CAAC;QACZ,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU;QAC7B,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW;KAChC,CAAC,CAAC,CAAC;IAEJ,IAAI,OAAO,GAAyE,EAAE,CAAC;IACvF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,OAAO,iBAAiB,EAC3B;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACvF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;SACzD,EACD,mBAAmB,CACpB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAMlC,CAAC;QACF,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAE7B,0EAA0E;QAC1E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAiB;gBACzB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;gBAChB,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,oBAAoB,CAAyB;gBAClE,UAAU,EAAE,KAAK;gBACjB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE;gBACjC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE;gBAC9B,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;gBAC3F,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO;gBACtB,QAAQ,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE;gBACnE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC;YACF,iBAAiB,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CACT,uBAAuB,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,cAAc;YACnE,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,IAAI,CAAC,sBAAsB,CAC/G,CACF,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC,CAAC;IACzG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACzG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,qCAAqC;IACrC,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,KAAK,CAAC,KAAK,wBAAwB,CAAC,CAAC,CAAC;AACvF,CAAC"}

package/dist/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAaA,UAAU,WAAW;IACnB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AA4ND,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA8JrE"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAaA,UAAU,WAAW;IACnB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AA+ND,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA8JrE"}

package/dist/commands/init.js

@@ -10,15 +10,23 @@ import { resolveApiBase } from '../config/api-config.js';
 import { API_TIMEOUT_MS, DOWNLOAD_TIMEOUT_MS } from '../constants.js';
 import { fetchEntitledAgents } from '../agents/catalog.js';
 // ─── Helpers ─────────────────────────────────────────────────────────────────
-function readStoredConfig(rootDir) {
-    const p = join(rootDir, '.nepopsx', 'config.json');
-    if (!existsSync(p))
-        return {};
+/**
+ * Ensure the repo `.gitignore` ignores `.nepopsx/config.json`. The device token
+ * lives in `~/.nepopsx` now, but this guards any pre-migration leftover and the
+ * non-secret local config from being committed. Best-effort.
+ */
+function ensureGitignoreGuard(rootDir) {
+    const guard = '.nepopsx/config.json';
+    const gitignorePath = join(rootDir, '.gitignore');
     try {
-        return JSON.parse(readFileSync(p, 'utf-8'));
+        const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, 'utf-8') : '';
+        if (existing.split(/\r?\n/).some((line) => line.trim() === guard))
+            return;
+        const prefix = existing.length > 0 && !existing.endsWith('\n') ? '\n' : '';
+        writeFileSync(gitignorePath, `${existing}${prefix}# nepopsx — never commit credentials\n${guard}\n`, 'utf-8');
     }
     catch {
-        return {};
+        /* best-effort */
     }
 }
 async function tryListRemoteWorkspaces(cwd, licenseKey) {
@@ -143,7 +151,7 @@ function printNextSteps(scenario, extra) {
             console.log(`  2. Enrich repo:    ${chalk.cyan('nepopsx scan')}`);
             console.log(`  3. Install agent:  ${chalk.cyan('nepopsx install feature-factory')}`);
             console.log(`  4. Generate files: ${chalk.cyan('nepopsx sync')}`);
-            console.log(`  5. Share with team: Run ${chalk.cyan('nepopsx init')} again and choose "Push to org"\n     (requires ${chalk.cyan('nepopsx activate <key>')} first)`);
+            console.log(`  5. Share with team: Run ${chalk.cyan('nepopsx login')} and then run ${chalk.cyan('nepopsx init')} again`);
             break;
         case 'pushed-team':
             console.log(`  1. Review config:  ${chalk.cyan('cat .nepopsx/workspace.yaml')}`);
@@ -162,8 +170,8 @@ function printNextSteps(scenario, extra) {
             break;
         case 'local-no-license':
             console.log(`  1. Review config:  ${chalk.cyan('cat .nepopsx/workspace.yaml')}`);
-            console.log(`  2. Get a license:  ${chalk.cyan('https://nepopsx.dev/pricing')}`);
-            console.log(`  3. Activate it:    ${chalk.cyan('nepopsx activate <your-license-key>')}`);
+            console.log(`  2. Choose a plan:  ${chalk.cyan('https://nepopsx.dev/pricing')}`);
+            console.log(`  3. Connect machine:${chalk.cyan('nepopsx login')}`);
             console.log(`  4. Enrich repo:    ${chalk.cyan('nepopsx scan')}`);
             console.log(`  5. Install agent:  ${chalk.cyan('nepopsx install feature-factory')}`);
             console.log(`  6. Generate files: ${chalk.cyan('nepopsx sync')}`);
@@ -200,12 +208,12 @@ export async function initCommand(options) {
     console.log(chalk.bold.cyan('\n🔧 NEPOPSX Workspace Setup\n'));
     // ── Probe auth state ──────────────────────────────────────────────────────
     const license = readLicense(cwd);
-    const storedConfig = readStoredConfig(cwd);
-    const orgSlug = storedConfig.auth?.org;
+    const orgSlug = license?.org || undefined;
     const apiBase = resolveApiBase(cwd);
+    ensureGitignoreGuard(cwd);
     if (!license) {
         // ── No license: local-only setup ────────────────────────────────────────
-        console.warn(chalk.yellow('⚠  No license key found (.nepopsx/license.json missing).'));
+        console.warn(chalk.yellow('⚠  Not logged in — run `nepopsx login` to sync with your team.'));
         console.log(chalk.dim('   Workspace will be set up locally (personal use only).\n'));
         const choice = await select({
             message: 'How do you want to proceed?',
@@ -216,8 +224,8 @@ export async function initCommand(options) {
         });
         if (choice === 'license') {
             console.log('');
-            console.log(`  1. Visit ${chalk.cyan('https://nepopsx.dev/pricing')} to get a license`);
-            console.log(`  2. Run   ${chalk.cyan('nepopsx activate <key>')} to bind it`);
+            console.log(`  1. Visit ${chalk.cyan('https://nepopsx.dev/pricing')} to choose a plan`);
+            console.log(`  2. Run   ${chalk.cyan('nepopsx login')} to connect this machine`);
             console.log(`  3. Re-run ${chalk.cyan('nepopsx init')} to configure your workspace\n`);
             return;
         }