@nerviq/cli 1.27.0 → 1.29.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (45) hide show
  1. package/CHANGELOG.md +1493 -0
  2. package/README.md +2 -2
  3. package/SECURITY.md +82 -0
  4. package/contracts/audit-webhook-event.schema.json +138 -0
  5. package/contracts/pack-contract.schema.json +15 -0
  6. package/contracts/technique-contract.schema.json +18 -0
  7. package/docs/ARCHITECTURE.md +74 -0
  8. package/docs/api-reference.md +356 -0
  9. package/docs/autofix.md +64 -0
  10. package/docs/bitbucket-pipe.yml +57 -0
  11. package/docs/case-studies.md +149 -0
  12. package/docs/category-definition-kit.md +56 -0
  13. package/docs/ci-integration.md +127 -0
  14. package/docs/claude-code-style.md +24 -0
  15. package/docs/claude-maintainer-ops.md +19 -0
  16. package/docs/external-validation.md +78 -0
  17. package/docs/first-tier-integration-gate.md +59 -0
  18. package/docs/getting-started.md +119 -0
  19. package/docs/gitlab-ci-template.yml +54 -0
  20. package/docs/index.html +597 -0
  21. package/docs/integration-contracts.md +287 -0
  22. package/docs/license-faq.md +53 -0
  23. package/docs/maintenance.md +155 -0
  24. package/docs/methodology.md +236 -0
  25. package/docs/new-platform-guide.md +202 -0
  26. package/docs/open-vsx-publishing.md +46 -0
  27. package/docs/platform-change-ingestion.md +46 -0
  28. package/docs/plugins.md +101 -0
  29. package/docs/pre-commit.md +58 -0
  30. package/docs/security-model.md +63 -0
  31. package/docs/shallow-risk.md +246 -0
  32. package/docs/versioning-policy.md +63 -0
  33. package/docs/why-nerviq.md +82 -0
  34. package/package.json +7 -2
  35. package/sdk/README.md +190 -0
  36. package/src/codex/setup.js +3 -2
  37. package/src/gemini/setup.js +3 -2
  38. package/src/init.js +4 -3
  39. package/src/opencode/context.js +42 -3
  40. package/src/opencode/techniques.js +198 -142
  41. package/src/output-icons.js +44 -0
  42. package/src/setup/runtime.js +6 -5
  43. package/src/setup.js +4 -3
  44. package/src/shallow-risk/patterns/agent-config-missing-file.js +254 -9
  45. package/src/shallow-risk/shared.js +135 -7
@@ -0,0 +1,356 @@
1
+ # API Reference
2
+
3
+ This document covers every function export surfaced through `src/index.js`. Constants and classes are intentionally omitted.
4
+
5
+ Return types are documented at the API boundary level. Most workflows return structured objects; formatter helpers return strings; async workflows return promises.
6
+
7
+ Known unresolved index aliases: `copilotInteractive`, `cursorInteractive`, and `windsurfInteractive` are present in `src/index.js`, but currently resolve `undefined` at runtime because their source modules export differently named wizard functions.
8
+
9
+ ## Example Recipes
10
+
11
+ ### audit
12
+
13
+ ```js
14
+ const { audit } = require('@nerviq/cli');
15
+
16
+ const result = await audit({
17
+ dir: process.cwd(),
18
+ format: 'json',
19
+ });
20
+
21
+ console.log(result.summary);
22
+ ```
23
+
24
+ ### setup
25
+
26
+ ```js
27
+ const { setup } = require('@nerviq/cli');
28
+
29
+ await setup({
30
+ dir: process.cwd(),
31
+ template: 'claude-md',
32
+ force: false,
33
+ });
34
+ ```
35
+
36
+ ### buildProposalBundle
37
+
38
+ ```js
39
+ const { buildProposalBundle } = require('@nerviq/cli');
40
+
41
+ const bundle = await buildProposalBundle({
42
+ dir: process.cwd(),
43
+ stacks: ['node', 'react'],
44
+ });
45
+
46
+ console.log(bundle.files);
47
+ ```
48
+
49
+ ### applyProposalBundle
50
+
51
+ ```js
52
+ const { buildProposalBundle, applyProposalBundle } = require('@nerviq/cli');
53
+
54
+ const bundle = await buildProposalBundle({ dir: process.cwd() });
55
+ await applyProposalBundle({ dir: process.cwd(), bundle });
56
+ ```
57
+
58
+ ### setupCodex
59
+
60
+ ```js
61
+ const { setupCodex } = require('@nerviq/cli');
62
+
63
+ await setupCodex({
64
+ dir: process.cwd(),
65
+ mode: 'guided',
66
+ });
67
+ ```
68
+
69
+ ### setupGemini
70
+
71
+ ```js
72
+ const { setupGemini } = require('@nerviq/cli');
73
+
74
+ await setupGemini({
75
+ dir: process.cwd(),
76
+ mcpPacks: ['filesystem', 'github'],
77
+ });
78
+ ```
79
+
80
+ ### harmonyAudit
81
+
82
+ ```js
83
+ const { harmonyAudit } = require('@nerviq/cli');
84
+
85
+ const report = await harmonyAudit({ dir: process.cwd() });
86
+ console.log(report.recommendations);
87
+ ```
88
+
89
+ ### generateStrategicAdvice
90
+
91
+ ```js
92
+ const { buildCanonicalModel, generateStrategicAdvice } = require('@nerviq/cli');
93
+
94
+ const canon = buildCanonicalModel(process.cwd());
95
+ const advice = generateStrategicAdvice(canon, []);
96
+ console.log(advice);
97
+ ```
98
+
99
+ ### synergyReport (Experimental)
100
+
101
+ ```js
102
+ const { synergyReport } = require('@nerviq/cli');
103
+
104
+ const report = await synergyReport(process.cwd());
105
+ console.log(report.score);
106
+ ```
107
+
108
+ ### createServer
109
+
110
+ ```js
111
+ const { createServer } = require('@nerviq/cli');
112
+
113
+ const server = createServer({ baseDir: process.cwd() });
114
+ server.listen(4310);
115
+
116
+ // GET http://127.0.0.1:4310/api/openapi.json
117
+ // GET http://127.0.0.1:4310/api/health
118
+ // GET http://127.0.0.1:4310/api/catalog
119
+ // GET http://127.0.0.1:4310/api/audit?platform=claude&dir=.
120
+ // GET http://127.0.0.1:4310/api/harmony?dir=.
121
+ ```
122
+
123
+ ### buildServeOpenApiSpec
124
+
125
+ ```js
126
+ const { buildServeOpenApiSpec } = require('@nerviq/cli');
127
+
128
+ const spec = buildServeOpenApiSpec({
129
+ serverUrl: 'http://127.0.0.1:4310',
130
+ });
131
+
132
+ console.log(spec.paths['/api/audit'].get.parameters);
133
+ ```
134
+
135
+ ## Core
136
+
137
+ Source modules: `src/audit.js`, `src/setup.js`, `src/analyze.js`, `src/plans.js`, `src/governance.js`, `src/benchmark.js`, `src/domain-packs.js`, `src/mcp-packs.js`, `src/activity.js`, `src/public-api.js`, `src/server.js`, `src/formatters/sarif.js`
138
+
139
+ | Function | Signature | Returns | Description |
140
+ | --- | --- | --- | --- |
141
+ | `audit` | `audit(options)` | `Promise<object>` | Run the primary NERVIQ audit pipeline against a project directory. |
142
+ | `setup` | `setup(options)` | `Promise<object>` | Apply the primary NERVIQ setup flow and write managed project scaffolding. |
143
+ | `analyzeProject` | `analyzeProject(options)` | `Promise<object>` | Inspect a project and return the raw analysis used by higher-level flows, including archetype, operating profile, and adopt/defer/ignore guidance. |
144
+ | `buildProposalBundle` | `buildProposalBundle(options)` | `Promise<object>` | Build a file-change proposal bundle without writing it to disk. |
145
+ | `applyProposalBundle` | `applyProposalBundle(options)` | `Promise<object>` | Apply a previously generated proposal bundle to a target project. |
146
+ | `getGovernanceSummary` | `getGovernanceSummary(platform = 'claude')` | `object` | Return governance guidance for the selected platform family. |
147
+ | `runBenchmark` | `runBenchmark(options)` | `Promise<object>` | Execute the benchmark pipeline and collect timing and score output. |
148
+ | `detectDomainPacks` | `detectDomainPacks(ctx, stacks, assets = null)` | `array` | Detect domain packs for the current project. |
149
+ | `getMcpPack` | `getMcpPack(key)` | `object` | Return mcp pack from the core module. |
150
+ | `mergeMcpServers` | `mergeMcpServers(existing = {}, packKeys = [])` | `object` | Merge mcp servers into an existing value. |
151
+ | `getMcpPackPreflight` | `getMcpPackPreflight(packKeys = [], env = process.env)` | `object` | Return mcp pack preflight from the core module. |
152
+ | `recommendMcpPacks` | `recommendMcpPacks(stacks = [], domainPacks = [], options = {})` | `array` | Recommend mcp packs based on detected project context. |
153
+ | `recordRecommendationOutcome` | `recordRecommendationOutcome(dir, payload)` | `object` | Record recommendation outcome in the project activity history. |
154
+ | `getRecommendationOutcomeSummary` | `getRecommendationOutcomeSummary(dir)` | `object` | Return recommendation outcome summary from the core module. |
155
+ | `formatRecommendationOutcomeSummary` | `formatRecommendationOutcomeSummary(dir)` | `string` | Format recommendation outcome summary for display or export. |
156
+ | `detectPlatforms` | `detectPlatforms(dir)` | `array` | Detect which agent platforms are active in the target repository. |
157
+ | `getCatalog` | `getCatalog()` | `object` | Return the public catalog of supported platforms, packs, and capabilities. |
158
+ | `synergyReport` | `synergyReport(dir)` | `Promise<object>` | (Experimental) Run the public cross-platform synergy report workflow for a repository. |
159
+ | `buildServeOpenApiSpec` | `buildServeOpenApiSpec(options = {})` | `object` | Build the OpenAPI 3.1 contract for the local `nerviq serve` HTTP surface. |
160
+ | `createServer` | `createServer(options = {})` | `http.Server` | Create the HTTP server used by the package API and local integrations. |
161
+ | `startServer` | `startServer(options = {})` | `Promise<http.Server>` | Start the package HTTP server with the supplied runtime options. |
162
+ | `getPlatformChangeManifest` | `getPlatformChangeManifest()` | `array` | Return the canonical platform-change watchlist manifest for all supported platforms. |
163
+ | `summarizePlatformChangeManifest` | `summarizePlatformChangeManifest()` | `object` | Return a summary of tracked platform sources, cadence, and update-trigger counts. |
164
+ | `formatSarif` | `formatSarif(auditResult, options = {})` | `string` | Format an audit result as SARIF output for code scanning tools. |
165
+
166
+ ## Codex
167
+
168
+ Source modules: `src/codex/*`
169
+
170
+ | Function | Signature | Returns | Description |
171
+ | --- | --- | --- | --- |
172
+ | `detectCodexVersion` | `detectCodexVersion()` | `object` | Detect codex version for the current project. |
173
+ | `recommendCodexMcpPacks` | `recommendCodexMcpPacks(stacks = [], domainPacks = [], options = {})` | `array` | Recommend codex mcp packs based on detected project context. |
174
+ | `getCodexMcpPreflight` | `getCodexMcpPreflight(packKeys = [], env = process.env)` | `object` | Return codex mcp preflight from the codex module. |
175
+ | `mergeCodexMcpToml` | `mergeCodexMcpToml(existingConfigContent = '', packKeys = [])` | `string` | Merge codex mcp toml into an existing value. |
176
+ | `buildCodexProposalBundle` | `buildCodexProposalBundle(options)` | `Promise<object>` | Build codex proposal bundle for downstream codex workflows. |
177
+ | `setupCodex` | `setupCodex(options)` | `Promise<object>` | Set up codex configuration and managed project files. |
178
+ | `getCodexHistory` | `getCodexHistory(dir, limit = 20)` | `array` | Return codex history from the codex module. |
179
+ | `formatCodexHistory` | `formatCodexHistory(dir)` | `string` | Format codex history for display or export. |
180
+ | `compareCodexLatest` | `compareCodexLatest(dir)` | `object` | Compare codex latest against the latest recorded baseline. |
181
+ | `exportCodexTrendReport` | `exportCodexTrendReport(dir)` | `object` | Export codex trend report for reporting or downstream processing. |
182
+ | `recordCodexFeedback` | `recordCodexFeedback(dir, payload)` | `object` | Record codex feedback in the project activity history. |
183
+ | `formatCodexFeedback` | `formatCodexFeedback(dir)` | `string` | Format codex feedback for display or export. |
184
+ | `generateCodexInsights` | `generateCodexInsights(dir)` | `object` | Generate codex insights from codex inputs. |
185
+ | `formatCodexInsights` | `formatCodexInsights(dir)` | `string` | Format codex insights for display or export. |
186
+ | `patchAgentsMd` | `patchAgentsMd(existingContent, managedSections)` | `string` | Patch agents md with managed sections. |
187
+ | `patchConfigToml` | `patchConfigToml(existingContent, newSections)` | `string` | Patch config toml with managed sections. |
188
+ | `detectMixedAgentRepo` | `detectMixedAgentRepo(dir)` | `object` | Detect mixed agent repo for the current project. |
189
+ | `applyPatch` | `applyPatch(dir, filePath, patchFn, options = {})` | `object` | Apply patch to the target project or model. |
190
+ | `getCodexGovernanceSummary` | `getCodexGovernanceSummary()` | `object` | Return codex governance summary from the codex module. |
191
+ | `checkReleaseGate` | `checkReleaseGate(sourceVerifications = {})` | `object` | Check release gate and return the evaluation result. |
192
+ | `formatReleaseGate` | `formatReleaseGate(gateResult)` | `string` | Format release gate for display or export. |
193
+ | `getPropagationTargets` | `getPropagationTargets(triggerKeyword)` | `array` | Return propagation targets from the codex module. |
194
+ | `runCodexDeepReview` | `runCodexDeepReview(options)` | `Promise<object>` | Run the codex deep review workflow. |
195
+ | `collectCodexConfig` | `collectCodexConfig(ctx, stacks)` | `object` | Collect codex config into a structured object. |
196
+ | `buildCodexReviewPayload` | `buildCodexReviewPayload(config)` | `object` | Build codex review payload for downstream codex workflows. |
197
+ | `codexInteractive` | `codexInteractive(options = {})` | `Promise<object|null>` | Return the codex interactive capability from the codex module. |
198
+ | `composePacks` | `composePacks(domainPackKeys = [], mcpPackKeys = [], options = {})` | `object` | Compose packs into a combined configuration payload. |
199
+ | `getCiTemplate` | `getCiTemplate(templateKey)` | `object` | Return ci template from the codex module. |
200
+ | `checkAdoptionGate` | `checkAdoptionGate(gateKey, dir)` | `object` | Check adoption gate and return the evaluation result. |
201
+
202
+ ## Gemini
203
+
204
+ Source modules: `src/gemini/*`
205
+
206
+ | Function | Signature | Returns | Description |
207
+ | --- | --- | --- | --- |
208
+ | `detectGeminiVersion` | `detectGeminiVersion()` | `object` | Detect gemini version for the current project. |
209
+ | `recommendGeminiMcpPacks` | `recommendGeminiMcpPacks(stacks = [], domainPacks = [], options = {})` | `array` | Recommend gemini mcp packs based on detected project context. |
210
+ | `getGeminiMcpPreflight` | `getGeminiMcpPreflight(packKeys = [], env = process.env)` | `object` | Return gemini mcp preflight from the gemini module. |
211
+ | `mergeGeminiMcpJson` | `mergeGeminiMcpJson(existingSettings = {}, packKeys = [])` | `object` | Merge gemini mcp json into an existing value. |
212
+ | `detectGeminiDomainPacks` | `detectGeminiDomainPacks(ctx, stacks = [], assets = {})` | `object` | Detect gemini domain packs for the current project. |
213
+ | `buildGeminiProposalBundle` | `buildGeminiProposalBundle(options)` | `Promise<object>` | Build gemini proposal bundle for downstream gemini workflows. |
214
+ | `setupGemini` | `setupGemini(options)` | `Promise<object>` | Set up gemini configuration and managed project files. |
215
+ | `getGeminiGovernanceSummary` | `getGeminiGovernanceSummary()` | `object` | Return gemini governance summary from the gemini module. |
216
+ | `getGeminiHistory` | `getGeminiHistory(dir, limit = 20)` | `array` | Return gemini history from the gemini module. |
217
+ | `formatGeminiHistory` | `formatGeminiHistory(dir)` | `string` | Format gemini history for display or export. |
218
+ | `compareGeminiLatest` | `compareGeminiLatest(dir)` | `object` | Compare gemini latest against the latest recorded baseline. |
219
+ | `exportGeminiTrendReport` | `exportGeminiTrendReport(dir)` | `object` | Export gemini trend report for reporting or downstream processing. |
220
+ | `recordGeminiFeedback` | `recordGeminiFeedback(dir, payload)` | `object` | Record gemini feedback in the project activity history. |
221
+ | `formatGeminiFeedback` | `formatGeminiFeedback(dir)` | `string` | Format gemini feedback for display or export. |
222
+ | `generateGeminiInsights` | `generateGeminiInsights(dir)` | `object` | Generate gemini insights from gemini inputs. |
223
+ | `formatGeminiInsights` | `formatGeminiInsights(dir)` | `string` | Format gemini insights for display or export. |
224
+ | `patchGeminiMd` | `patchGeminiMd(existingContent, managedSections)` | `string` | Patch gemini md with managed sections. |
225
+ | `patchSettingsJson` | `patchSettingsJson(existingContent, newKeys)` | `object` | Patch settings json with managed sections. |
226
+ | `detectMixedAgentRepoGemini` | `detectMixedAgentRepoGemini(dir)` | `object` | Detect mixed agent repo gemini for the current project. |
227
+ | `checkGeminiReleaseGate` | `checkGeminiReleaseGate(sourceVerifications = {})` | `object` | Check gemini release gate and return the evaluation result. |
228
+ | `formatGeminiReleaseGate` | `formatGeminiReleaseGate(gateResult)` | `string` | Format gemini release gate for display or export. |
229
+ | `runGeminiDeepReview` | `runGeminiDeepReview(options)` | `Promise<object>` | Run the gemini deep review workflow. |
230
+ | `collectGeminiConfig` | `collectGeminiConfig(ctx, stacks)` | `object` | Collect gemini config into a structured object. |
231
+ | `geminiInteractive` | `geminiInteractive(options = {})` | `Promise<object|null>` | Return the gemini interactive capability from the gemini module. |
232
+ | `composeGeminiPacks` | `composeGeminiPacks(domainPackKeys = [], mcpPackKeys = [], options = {})` | `object` | Compose gemini packs into a combined configuration payload. |
233
+ | `getGeminiCiTemplate` | `getGeminiCiTemplate(templateKey)` | `object` | Return gemini ci template from the gemini module. |
234
+ | `checkGeminiAdoptionGate` | `checkGeminiAdoptionGate(gateKey, dir)` | `object` | Check gemini adoption gate and return the evaluation result. |
235
+
236
+ ## Copilot
237
+
238
+ Source modules: `src/copilot/*`
239
+
240
+ | Function | Signature | Returns | Description |
241
+ | --- | --- | --- | --- |
242
+ | `recommendCopilotMcpPacks` | `recommendCopilotMcpPacks(stacks = [], domainPacks = [], options = {})` | `array` | Recommend copilot mcp packs based on detected project context. |
243
+ | `getCopilotMcpPreflight` | `getCopilotMcpPreflight(packKeys = [], env = process.env)` | `object` | Return copilot mcp preflight from the copilot module. |
244
+ | `detectCopilotDomainPacks` | `detectCopilotDomainPacks(ctx, stacks = [], assets = {})` | `object` | Detect copilot domain packs for the current project. |
245
+ | `buildCopilotProposalBundle` | `buildCopilotProposalBundle(options)` | `Promise<object>` | Build copilot proposal bundle for downstream copilot workflows. |
246
+ | `setupCopilot` | `setupCopilot(options)` | `Promise<object>` | Set up copilot configuration and managed project files. |
247
+ | `getCopilotGovernanceSummary` | `getCopilotGovernanceSummary()` | `object` | Return copilot governance summary from the copilot module. |
248
+ | `getCopilotHistory` | `getCopilotHistory(dir, limit = 20)` | `array` | Return copilot history from the copilot module. |
249
+ | `formatCopilotHistory` | `formatCopilotHistory(dir)` | `string` | Format copilot history for display or export. |
250
+ | `compareCopilotLatest` | `compareCopilotLatest(dir)` | `object` | Compare copilot latest against the latest recorded baseline. |
251
+ | `exportCopilotTrendReport` | `exportCopilotTrendReport(dir)` | `object` | Export copilot trend report for reporting or downstream processing. |
252
+ | `generateCopilotInsights` | `generateCopilotInsights(dir)` | `object` | Generate copilot insights from copilot inputs. |
253
+ | `runCopilotDeepReview` | `runCopilotDeepReview(options)` | `Promise<object>` | Run the copilot deep review workflow. |
254
+ | `copilotInteractive` | `copilotInteractive(...)` | `undefined` | Reserved index export for the Copilot interactive wizard; currently unresolved at runtime. The index exports `copilotInteractive`, but `src/copilot/interactive.js` currently exports `runCopilotWizard` and `runProjectDetection`. |
255
+ | `composeCopilotPacks` | `composeCopilotPacks(domainPackKeys = [], mcpPackKeys = [], options = {})` | `object` | Compose copilot packs into a combined configuration payload. |
256
+ | `getCopilotCiTemplate` | `getCopilotCiTemplate(templateKey)` | `object` | Return copilot ci template from the copilot module. |
257
+ | `checkCopilotAdoptionGate` | `checkCopilotAdoptionGate(gateKey, dir)` | `object` | Check copilot adoption gate and return the evaluation result. |
258
+
259
+ ## Cursor
260
+
261
+ Source modules: `src/cursor/*`
262
+
263
+ | Function | Signature | Returns | Description |
264
+ | --- | --- | --- | --- |
265
+ | `recommendCursorMcpPacks` | `recommendCursorMcpPacks(stacks = [], domainPacks = [], options = {})` | `array` | Recommend cursor mcp packs based on detected project context. |
266
+ | `detectCursorDomainPacks` | `detectCursorDomainPacks(ctx, stacks = [], assets = {})` | `object` | Detect cursor domain packs for the current project. |
267
+ | `buildCursorProposalBundle` | `buildCursorProposalBundle(options)` | `Promise<object>` | Build cursor proposal bundle for downstream cursor workflows. |
268
+ | `setupCursor` | `setupCursor(options)` | `Promise<object>` | Set up cursor configuration and managed project files. |
269
+ | `getCursorGovernanceSummary` | `getCursorGovernanceSummary()` | `object` | Return cursor governance summary from the cursor module. |
270
+ | `getCursorHistory` | `getCursorHistory(dir, limit = 20)` | `array` | Return cursor history from the cursor module. |
271
+ | `compareCursorLatest` | `compareCursorLatest(dir)` | `object` | Compare cursor latest against the latest recorded baseline. |
272
+ | `generateCursorInsights` | `generateCursorInsights(dir)` | `object` | Generate cursor insights from cursor inputs. |
273
+ | `runCursorDeepReview` | `runCursorDeepReview(options)` | `Promise<object>` | Run the cursor deep review workflow. |
274
+ | `cursorInteractive` | `cursorInteractive(...)` | `undefined` | Reserved index export for the Cursor interactive wizard; currently unresolved at runtime. The index exports `cursorInteractive`, but `src/cursor/interactive.js` currently exports `runCursorWizard` and `runProjectDetection`. |
275
+ | `composeCursorPacks` | `composeCursorPacks(domainPackKeys = [], mcpPackKeys = [], options = {})` | `object` | Compose cursor packs into a combined configuration payload. |
276
+ | `checkCursorAdoptionGate` | `checkCursorAdoptionGate(gateKey, dir)` | `object` | Check cursor adoption gate and return the evaluation result. |
277
+
278
+ ## Windsurf
279
+
280
+ Source modules: `src/windsurf/*`
281
+
282
+ | Function | Signature | Returns | Description |
283
+ | --- | --- | --- | --- |
284
+ | `detectWindsurfDomainPacks` | `detectWindsurfDomainPacks(ctx, stacks = [], assets = {})` | `object` | Detect windsurf domain packs for the current project. |
285
+ | `setupWindsurf` | `setupWindsurf(options)` | `Promise<object>` | Set up windsurf configuration and managed project files. |
286
+ | `getWindsurfGovernanceSummary` | `getWindsurfGovernanceSummary()` | `object` | Return windsurf governance summary from the windsurf module. |
287
+ | `runWindsurfDeepReview` | `runWindsurfDeepReview(options)` | `Promise<object>` | Run the windsurf deep review workflow. |
288
+ | `windsurfInteractive` | `windsurfInteractive(...)` | `undefined` | Reserved index export for the Windsurf interactive wizard; currently unresolved at runtime. The index exports `windsurfInteractive`, but `src/windsurf/interactive.js` currently exports `runWindsurfWizard` and `runProjectDetection`. |
289
+
290
+ ## Aider
291
+
292
+ Source modules: `src/aider/*`
293
+
294
+ | Function | Signature | Returns | Description |
295
+ | --- | --- | --- | --- |
296
+ | `detectAiderDomainPacks` | `detectAiderDomainPacks(ctx)` | `object` | Detect aider domain packs for the current project. |
297
+ | `setupAider` | `setupAider(options = {})` | `Promise<object>` | Set up aider configuration and managed project files. |
298
+ | `getAiderGovernanceSummary` | `getAiderGovernanceSummary()` | `object` | Return aider governance summary from the aider module. |
299
+ | `runAiderDeepReview` | `runAiderDeepReview(dir)` | `Promise<object>` | Run the aider deep review workflow. |
300
+ | `aiderInteractive` | `aiderInteractive(dir)` | `Promise<object|null>` | Return the aider interactive capability from the aider module. |
301
+
302
+ ## OpenCode
303
+
304
+ Source modules: `src/opencode/*`
305
+
306
+ | Function | Signature | Returns | Description |
307
+ | --- | --- | --- | --- |
308
+ | `detectOpenCodeDomainPacks` | `detectOpenCodeDomainPacks(ctx, stacks = [])` | `object` | Detect open code domain packs for the current project. |
309
+ | `setupOpenCode` | `setupOpenCode(options)` | `Promise<object>` | Set up opencode configuration and managed project files. |
310
+ | `getOpenCodeGovernanceSummary` | `getOpenCodeGovernanceSummary()` | `object` | Return open code governance summary from the opencode module. |
311
+ | `runOpenCodeDeepReview` | `runOpenCodeDeepReview(options)` | `Promise<object>` | Run the open code deep review workflow. |
312
+ | `opencodeInteractive` | `opencodeInteractive(options = {})` | `Promise<object|null>` | Return the opencode interactive capability from the opencode module. |
313
+
314
+ ## Harmony
315
+
316
+ Source modules: `src/harmony/*`
317
+
318
+ | Function | Signature | Returns | Description |
319
+ | --- | --- | --- | --- |
320
+ | `buildCanonicalModel` | `buildCanonicalModel(dir)` | `object` | Build the Harmony canonical model from the current repository state. |
321
+ | `detectActivePlatforms` | `detectActivePlatforms(dir)` | `array` | Detect active platforms for the current project. |
322
+ | `detectDrift` | `detectDrift(canonicalModel)` | `object` | Detect drift for the current project. |
323
+ | `formatDriftReport` | `formatDriftReport(driftResult, options = {})` | `string` | Format drift report for display or export. |
324
+ | `harmonyAudit` | `harmonyAudit(options)` | `Promise<object>` | Run the Harmony audit across detected platform configurations. |
325
+ | `formatHarmonyAuditReport` | `formatHarmonyAuditReport(result)` | `string` | Format harmony audit report for display or export. |
326
+ | `generateHarmonySync` | `generateHarmonySync(canonicalModel, options = {})` | `object` | Generate harmony sync from harmony inputs. |
327
+ | `applyHarmonySync` | `applyHarmonySync(dir, options = {})` | `object` | Apply harmony sync to the target project or model. |
328
+ | `previewHarmonySync` | `previewHarmonySync(dir, options = {})` | `object` | Return the preview harmony sync capability from the harmony module. |
329
+ | `generateStrategicAdvice` | `generateStrategicAdvice(canonicalModel, platformAudits)` | `object` | Generate cross-platform platform advice from the canonical model and audits. |
330
+ | `startHarmonyWatch` | `startHarmonyWatch(options)` | `Promise<object>` | Start harmony watch and return the running handle. |
331
+ | `saveHarmonyState` | `saveHarmonyState(dir, state)` | `object` | Save harmony state to persistent storage. |
332
+ | `loadHarmonyState` | `loadHarmonyState(dir)` | `object` | Load harmony state from persistent storage. |
333
+ | `getHarmonyHistory` | `getHarmonyHistory(dir, filter)` | `array` | Return harmony history from the harmony module. |
334
+ | `getHarmonyGovernanceSummary` | `getHarmonyGovernanceSummary(canonicalModel, platformAudits)` | `object` | Return harmony governance summary from the harmony module. |
335
+ | `formatHarmonyGovernanceReport` | `formatHarmonyGovernanceReport(summary, options)` | `string` | Format harmony governance report for display or export. |
336
+
337
+ ## Synergy (Experimental)
338
+
339
+ Source modules: `src/synergy/*` — static-rule research surface. Do not rely on for production task routing.
340
+
341
+ | Function | Signature | Returns | Description |
342
+ | --- | --- | --- | --- |
343
+ | `propagateInsight` | `propagateInsight(insight, sourcePlatform, targetPlatforms)` | `object` | Propagate insight across selected platforms. |
344
+ | `getCrossLearnings` | `getCrossLearnings(dir)` | `array` | Return cross learnings from the synergy module. |
345
+ | `routeTask` | `routeTask(taskDescription, activePlatforms, projectHistory)` | `object` | Route a task description to the most suitable active platforms. |
346
+ | `classifyTaskType` | `classifyTaskType(taskDescription)` | `string` | Classify task type into a known synergy category. |
347
+ | `compoundAudit` | `compoundAudit(platformAudits)` | `object` | Combine audit into a single evidence view. |
348
+ | `calculateAmplification` | `calculateAmplification(platformAudits)` | `number` | Calculate amplification for the current inputs. |
349
+ | `analyzeCompensation` | `analyzeCompensation(activePlatforms, platformAudits)` | `object` | Analyze compensation and return structured findings. |
350
+ | `getUncoveredGaps` | `getUncoveredGaps(activePlatforms)` | `array` | Return uncovered gaps from the synergy module. |
351
+ | `discoverPatterns` | `discoverPatterns(harmonyHistory)` | `object` | Discover patterns from accumulated history. |
352
+ | `rankRecommendations` | `rankRecommendations(recommendations, activePlatforms, context)` | `array` | Return the rank recommendations capability from the synergy module. |
353
+ | `calculateSynergyScore` | `calculateSynergyScore(recommendation, activePlatforms, context)` | `number` | Calculate synergy score for the current inputs. |
354
+ | `generateSynergyReport` | `generateSynergyReport(options)` | `Promise<object>` | Build the full Synergy report structure from routing and amplification inputs. |
355
+ | `detectProjectChanges` | `detectProjectChanges(dir, previousCanon)` | `object` | Detect project changes for the current project. |
356
+ | `generateAdaptiveUpdates` | `generateAdaptiveUpdates(changes)` | `object` | Generate adaptive updates from synergy inputs. |
@@ -0,0 +1,64 @@
1
+ # Autofix with `nerviq audit --fix`
2
+
3
+ `nerviq audit --fix` runs the normal audit, applies the fixable critical recommendations that are in scope for autofix, and then re-audits the repo.
4
+
5
+ ## Command surface
6
+
7
+ ```bash
8
+ nerviq audit --fix
9
+ nerviq audit --fix --auto
10
+ nerviq audit --fix --dry-run
11
+ ```
12
+
13
+ - `nerviq audit --fix`
14
+ Uses the conservative default flow. Nerviq plans the critical fixes, shows the file diff, and asks for confirmation per file before writing.
15
+
16
+ - `nerviq audit --fix --auto`
17
+ Applies the same critical fixes without prompts. This is the intended mode for CI or scripted remediation.
18
+
19
+ - `nerviq audit --fix --dry-run`
20
+ Shows the proposed diff and exits without writing files.
21
+
22
+ ## What v1 fixes
23
+
24
+ This first pass focuses on instruction-surface remediation:
25
+
26
+ - Missing `CLAUDE.md` baseline instructions.
27
+ - Missing verification guidance for critical audit checks.
28
+ - Hygiene templates that can be created safely (`LICENSE`, `CHANGELOG.md`, `CONTRIBUTING.md`) through the shared fix engine.
29
+
30
+ Autofix deliberately does **not** rewrite security, hooks, or permission-sensitive findings in this release.
31
+
32
+ ## Safety model
33
+
34
+ - Dry-run stays dry: no file writes and no rollback artifacts.
35
+ - Files that contain the literal `DO NOT AUTOEDIT` marker are skipped.
36
+ - `audit --fix` only targets fixable **critical** findings in this release.
37
+ - A rollback manifest is written to `.nerviq/rollbacks/` after successful writes.
38
+ - Nerviq re-audits after applying fixes and exits with a non-zero status if the targeted checks still fail.
39
+
40
+ ## Exit codes
41
+
42
+ - `0`: all targeted fixes applied and the targeted checks pass after re-audit
43
+ - `1`: a targeted fix failed, was skipped for safety, or still fails after re-audit
44
+ - `2`: bad flag combination or no fixable critical findings are available
45
+
46
+ ## Examples
47
+
48
+ Preview the exact patch without touching the working tree:
49
+
50
+ ```bash
51
+ nerviq audit --fix --dry-run
52
+ ```
53
+
54
+ Apply fixable critical items in CI:
55
+
56
+ ```bash
57
+ nerviq audit --fix --auto
58
+ ```
59
+
60
+ Apply with per-file confirmation in an interactive terminal:
61
+
62
+ ```bash
63
+ nerviq audit --fix
64
+ ```
@@ -0,0 +1,57 @@
1
+ # ============================================================
2
+ # Nerviq Audit — Bitbucket Pipelines
3
+ # ============================================================
4
+ # Copy this file to the root of your repository as
5
+ # bitbucket-pipelines.yml, or merge the relevant sections
6
+ # into your existing pipeline configuration.
7
+ #
8
+ # Environment variables (set in Repository Settings → Pipelines → Variables):
9
+ # NERVIQ_THRESHOLD — minimum passing score (default: 60)
10
+ # ============================================================
11
+
12
+ image: node:20-slim
13
+
14
+ pipelines:
15
+
16
+ # ----------------------------------------------------------
17
+ # Default pipeline — runs on every push to any branch
18
+ # ----------------------------------------------------------
19
+ default:
20
+ - step:
21
+ name: Nerviq Audit
22
+ script:
23
+ - npm install -g @nerviq/cli
24
+ # Exit non-zero when the score is below the threshold
25
+ - nerviq audit --json --threshold ${NERVIQ_THRESHOLD:-60}
26
+ artifacts:
27
+ - nerviq-report.json
28
+
29
+ # ----------------------------------------------------------
30
+ # Pull-request pipeline — runs on PRs targeting any branch
31
+ # The '**' glob matches all source branches.
32
+ # ----------------------------------------------------------
33
+ pull-requests:
34
+ '**':
35
+ - step:
36
+ name: Nerviq PR Audit
37
+ script:
38
+ - npm install -g @nerviq/cli
39
+ - nerviq audit --json --threshold ${NERVIQ_THRESHOLD:-60} --out nerviq-report.json
40
+ artifacts:
41
+ # The JSON report is available for download in the
42
+ # Bitbucket Pipelines UI under the Artifacts tab.
43
+ - nerviq-report.json
44
+
45
+ # ----------------------------------------------------------
46
+ # Custom pipeline — trigger manually from the Bitbucket UI
47
+ # (Repository → Pipelines → Run pipeline → harmony-audit)
48
+ # Runs the Harmony multi-config audit.
49
+ # ----------------------------------------------------------
50
+ custom:
51
+ harmony-audit:
52
+ - step:
53
+ name: Nerviq Harmony
54
+ script:
55
+ - npm install -g @nerviq/cli
56
+ - nerviq harmony-audit
57
+ trigger: manual
@@ -0,0 +1,149 @@
1
+ # Nerviq Case Studies — Real Public Repos
2
+
3
+ **Date:** 2026-04-07
4
+ **CLI Version:** 1.6.0
5
+ **Method:** `nerviq audit` from cloned repo root (read-only, no files written)
6
+
7
+ ---
8
+
9
+ ## 1. supabase/supabase — Popular BaaS Platform
10
+
11
+ **Stack:** TypeScript, Elixir | **Stars:** 175k | **AI Config:** None detected
12
+
13
+ | Metric | Value |
14
+ |--------|-------|
15
+ | Score | **48/100** |
16
+ | Passed | 36 |
17
+ | Failed | 55 |
18
+ | Critical | 2 |
19
+
20
+ **What Nerviq found:**
21
+ - 🔴 No secrets protection — `.env` files readable by any AI agent
22
+ - 🔴 No CLAUDE.md — agents have zero project context
23
+ - 🟡 No verification commands — agents can't self-check their work
24
+ - 🟡 No hooks configured — no automated quality gates after tool use
25
+
26
+ **What Nerviq got right:** Supabase is a monorepo with example code in Python, Flutter, and Rust. Nerviq correctly **skipped** all those stack checks (165 checks → null) and only reported findings about the core TypeScript/Elixir project. The 55 findings are all actionable AI agent config gaps.
27
+
28
+ **What would improve:** Adding `CLAUDE.md` with build commands and a Mermaid architecture diagram would immediately address the top 3 findings.
29
+
30
+ ---
31
+
32
+ ## 2. anthropics/anthropic-cookbook — Official Anthropic Examples
33
+
34
+ **Stack:** Python (pyproject.toml) | **Stars:** — | **AI Config:** CLAUDE.md ✅
35
+
36
+ | Metric | Value |
37
+ |--------|-------|
38
+ | Score | **51/100** |
39
+ | Passed | 49 |
40
+ | Failed | 60 |
41
+ | Critical | 1 |
42
+
43
+ **What Nerviq found:**
44
+ - ✅ Has CLAUDE.md with project instructions — correctly detected
45
+ - 🔴 No secrets protection configured
46
+ - 🟡 No PostToolUse hooks — missed opportunity for automated checks
47
+ - 🟡 No XML constraint blocks in CLAUDE.md
48
+ - 🟡 Python linter not configured in pyproject.toml
49
+
50
+ **Key insight:** Having CLAUDE.md gets you to ~50/100. The gap to 80+ is hooks, permissions, and verification loops — the "governance layer" that CLAUDE.md alone doesn't provide.
51
+
52
+ ---
53
+
54
+ ## 3. langchain-ai/langchain — Leading AI Framework
55
+
56
+ **Stack:** Python | **Stars:** — | **AI Config:** CLAUDE.md ✅, AGENTS.md ✅
57
+
58
+ | Metric | Value |
59
+ |--------|-------|
60
+ | Score | **40/100** |
61
+ | Passed | 26 |
62
+ | Failed | 57 |
63
+ | Critical | 1 |
64
+
65
+ **What Nerviq found:**
66
+ - ✅ Has CLAUDE.md and AGENTS.md — both correctly detected
67
+ - 🔴 No secrets protection
68
+ - 🟡 No hooks (PreToolUse, PostToolUse, StopFailure)
69
+ - 🟡 No custom commands despite complex workflow
70
+ - 🟡 Git attribution not configured
71
+
72
+ **Key insight:** Even with both CLAUDE.md and AGENTS.md, langchain scores 40/100. The missing layer is operational: hooks, commands, governance, and verification. Instructions alone don't make a well-governed agent setup.
73
+
74
+ ---
75
+
76
+ ## 4. openai/codex — OpenAI's Coding Agent
77
+
78
+ **Stack:** TypeScript, Python | **Stars:** — | **AI Config:** AGENTS.md ✅
79
+
80
+ | Metric | Value |
81
+ |--------|-------|
82
+ | Score | **27/100** |
83
+ | Passed | 25 |
84
+ | Failed | 78 |
85
+ | Critical | 3 |
86
+
87
+ **What Nerviq found:**
88
+ - ✅ Has AGENTS.md — correctly detected
89
+ - ❌ No CLAUDE.md (expected — this is a Codex repo)
90
+ - 🔴 No verification commands in agent instructions
91
+ - 🔴 No secrets protection
92
+ - 🔴 No .gitignore for .env files
93
+ - 🟡 No hooks, commands, or skills configured
94
+
95
+ **Key insight:** Even OpenAI's own agent repo has gaps in governance config. The AGENTS.md is present but lacks verification commands, and there are no operational safeguards (hooks, deny rules, permission profiles).
96
+
97
+ ---
98
+
99
+ ## 5. calcom/cal.com — Open-Source Scheduling
100
+
101
+ **Stack:** TypeScript (Next.js monorepo) | **Stars:** — | **AI Config:** CLAUDE.md ✅, AGENTS.md ✅
102
+
103
+ | Metric | Value |
104
+ |--------|-------|
105
+ | Score | **25/100** |
106
+ | Passed | 18 |
107
+ | Failed | 68 |
108
+ | Critical | 2 |
109
+
110
+ **What Nerviq found:**
111
+ - ✅ Has CLAUDE.md and AGENTS.md
112
+ - 🔴 No verification commands — CLAUDE.md missing test/lint/build commands
113
+ - 🔴 No secrets protection
114
+ - 🟡 No hooks configured
115
+ - 🟡 Monorepo detected but no workspace-aware agent config
116
+
117
+ **Key insight:** Cal.com has adopted AI agent instructions but scores only 25/100. The CLAUDE.md exists but is missing the critical operational elements: verification commands, deny rules, and hooks. This is the most common pattern — instructions without governance.
118
+
119
+ ---
120
+
121
+ ## Cross-Cutting Findings
122
+
123
+ ### Most Common Gaps (across all 6 repos)
124
+
125
+ | Finding | Repos Missing | Impact |
126
+ |---------|--------------|--------|
127
+ | Secrets protection (deny rules) | 6/6 (100%) | Critical |
128
+ | Verification commands in instructions | 5/6 (83%) | Critical |
129
+ | PostToolUse hooks | 6/6 (100%) | High |
130
+ | Custom slash commands | 5/6 (83%) | High |
131
+ | Permission profiles configured | 6/6 (100%) | High |
132
+ | Mermaid architecture diagram | 5/6 (83%) | High |
133
+
134
+ ### The "Instructions Gap"
135
+
136
+ Repos with CLAUDE.md average **38/100**. Repos without average **27/100**. The gap between "has instructions" and "well-governed" is ~50 points — filled by hooks, permissions, commands, verification, and deny rules.
137
+
138
+ ### False Positive Rate
139
+
140
+ After the v1.6.0 accuracy overhaul:
141
+ - **Stack false positives: 0** — no Python/Go/Rust/etc. checks on repos that don't use those stacks at root level
142
+ - **Generic quality noise: 0** — observability, caching, i18n etc. checks are skipped by default
143
+ - **All 55-78 findings per repo are AI agent configuration relevant**
144
+
145
+ ### Limitations Observed
146
+
147
+ - Some repos (supabase) don't use AI coding agents at all — their low score reflects configuration absence, not a problem
148
+ - Nerviq audits **Claude platform by default**; repos using only Codex or Cursor should use `--platform codex` or `--platform cursor`
149
+ - Monorepo detection works but workspace-specific scoring requires `--workspace` flag