@nerviq/cli 1.29.0 → 1.29.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +1527 -1493
- package/README.md +550 -538
- package/SECURITY.md +82 -82
- package/bin/cli.js +2562 -2558
- package/docs/api-reference.md +356 -356
- package/docs/audit-fix.md +109 -0
- package/docs/autofix.md +3 -62
- package/docs/getting-started.md +1 -1
- package/docs/index.html +592 -592
- package/docs/integration-contracts.md +287 -287
- package/docs/maintenance.md +128 -128
- package/docs/new-platform-guide.md +202 -202
- package/docs/release-process.md +63 -0
- package/docs/shallow-risk.md +244 -244
- package/docs/why-nerviq.md +82 -82
- package/package.json +67 -67
- package/src/aider/activity.js +226 -226
- package/src/aider/context.js +162 -162
- package/src/aider/freshness.js +123 -123
- package/src/aider/techniques.js +3465 -3465
- package/src/audit/layers.js +180 -180
- package/src/audit.js +1032 -1032
- package/src/benchmark.js +299 -299
- package/src/codex/activity.js +324 -324
- package/src/codex/freshness.js +142 -142
- package/src/codex/techniques.js +4895 -4895
- package/src/context.js +326 -326
- package/src/continuous-ops.js +11 -1
- package/src/convert.js +340 -340
- package/src/copilot/config-parser.js +280 -280
- package/src/copilot/context.js +218 -218
- package/src/copilot/freshness.js +177 -177
- package/src/copilot/patch.js +238 -238
- package/src/copilot/techniques.js +3578 -3578
- package/src/cursor/freshness.js +194 -194
- package/src/cursor/patch.js +243 -243
- package/src/cursor/techniques.js +3735 -3735
- package/src/doctor.js +201 -201
- package/src/fix-engine.js +511 -8
- package/src/formatters/csv.js +86 -86
- package/src/formatters/junit.js +123 -123
- package/src/formatters/markdown.js +164 -164
- package/src/formatters/otel.js +151 -151
- package/src/freshness.js +156 -156
- package/src/gemini/activity.js +402 -402
- package/src/gemini/context.js +290 -290
- package/src/gemini/freshness.js +183 -183
- package/src/gemini/patch.js +229 -229
- package/src/gemini/techniques.js +3811 -3811
- package/src/governance.js +533 -533
- package/src/harmony/audit.js +306 -306
- package/src/i18n.js +63 -63
- package/src/insights.js +119 -119
- package/src/integrations.js +134 -134
- package/src/locales/en.json +33 -33
- package/src/locales/es.json +33 -33
- package/src/migrate.js +354 -354
- package/src/opencode/activity.js +286 -286
- package/src/opencode/freshness.js +137 -137
- package/src/opencode/techniques.js +3450 -3450
- package/src/setup/analysis.js +12 -12
- package/src/setup.js +7 -6
- package/src/shallow-risk/index.js +56 -56
- package/src/shallow-risk/patterns/agent-config-cross-platform-drift.js +50 -50
- package/src/shallow-risk/patterns/agent-config-dangerous-autoapprove.js +46 -46
- package/src/shallow-risk/patterns/agent-config-deprecated-keys.js +46 -46
- package/src/shallow-risk/patterns/agent-config-missing-file.js +317 -317
- package/src/shallow-risk/patterns/agent-config-secret-literal.js +49 -49
- package/src/shallow-risk/patterns/agent-config-stack-contradiction.js +34 -34
- package/src/shallow-risk/patterns/hook-script-missing.js +70 -70
- package/src/shallow-risk/patterns/mcp-server-no-allowlist.js +52 -52
- package/src/shallow-risk/shared.js +648 -648
- package/src/source-urls.js +295 -295
- package/src/state-paths.js +85 -85
- package/src/supplemental-checks.js +805 -805
- package/src/telemetry.js +160 -160
- package/src/windsurf/context.js +359 -359
- package/src/windsurf/freshness.js +194 -194
- package/src/windsurf/patch.js +231 -231
- package/src/windsurf/techniques.js +3779 -3779
|
@@ -1,34 +1,34 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* OpenCode Freshness Operationalization
|
|
3
|
-
*
|
|
4
|
-
* Release gates, recurring probes, propagation checklists,
|
|
5
|
-
* and staleness blocking for OpenCode surfaces.
|
|
6
|
-
*/
|
|
7
|
-
|
|
8
|
-
const { version } = require('../../package.json');
|
|
9
|
-
|
|
10
|
-
const P0_SOURCES = [
|
|
11
|
-
{
|
|
12
|
-
key: 'opencode-docs',
|
|
13
|
-
label: 'OpenCode Official Docs',
|
|
14
|
-
url: 'https://opencode.ai/docs',
|
|
15
|
-
stalenessThresholdDays: 30,
|
|
16
|
-
verifiedAt: '2026-04-07',
|
|
17
|
-
},
|
|
18
|
-
{
|
|
19
|
-
key: 'opencode-config-reference',
|
|
20
|
-
label: 'OpenCode Config Reference',
|
|
21
|
-
url: 'https://opencode.ai/docs/config/',
|
|
22
|
-
stalenessThresholdDays: 30,
|
|
23
|
-
verifiedAt: '2026-04-07',
|
|
24
|
-
},
|
|
25
|
-
{
|
|
26
|
-
key: 'opencode-github-releases',
|
|
27
|
-
label: 'OpenCode GitHub Releases',
|
|
28
|
-
url: 'https://github.com/sst/opencode/releases',
|
|
29
|
-
stalenessThresholdDays: 14,
|
|
30
|
-
verifiedAt: '2026-04-07',
|
|
31
|
-
},
|
|
1
|
+
/**
|
|
2
|
+
* OpenCode Freshness Operationalization
|
|
3
|
+
*
|
|
4
|
+
* Release gates, recurring probes, propagation checklists,
|
|
5
|
+
* and staleness blocking for OpenCode surfaces.
|
|
6
|
+
*/
|
|
7
|
+
|
|
8
|
+
const { version } = require('../../package.json');
|
|
9
|
+
|
|
10
|
+
const P0_SOURCES = [
|
|
11
|
+
{
|
|
12
|
+
key: 'opencode-docs',
|
|
13
|
+
label: 'OpenCode Official Docs',
|
|
14
|
+
url: 'https://opencode.ai/docs',
|
|
15
|
+
stalenessThresholdDays: 30,
|
|
16
|
+
verifiedAt: '2026-04-07',
|
|
17
|
+
},
|
|
18
|
+
{
|
|
19
|
+
key: 'opencode-config-reference',
|
|
20
|
+
label: 'OpenCode Config Reference',
|
|
21
|
+
url: 'https://opencode.ai/docs/config/',
|
|
22
|
+
stalenessThresholdDays: 30,
|
|
23
|
+
verifiedAt: '2026-04-07',
|
|
24
|
+
},
|
|
25
|
+
{
|
|
26
|
+
key: 'opencode-github-releases',
|
|
27
|
+
label: 'OpenCode GitHub Releases',
|
|
28
|
+
url: 'https://github.com/sst/opencode/releases',
|
|
29
|
+
stalenessThresholdDays: 14,
|
|
30
|
+
verifiedAt: '2026-04-07',
|
|
31
|
+
},
|
|
32
32
|
{
|
|
33
33
|
key: 'opencode-plugin-api',
|
|
34
34
|
label: 'OpenCode Plugin API',
|
|
@@ -62,43 +62,43 @@ const P0_SOURCES = [
|
|
|
62
62
|
label: 'OpenCode Permissions Documentation',
|
|
63
63
|
url: 'https://opencode.ai/docs/permissions/',
|
|
64
64
|
stalenessThresholdDays: 30,
|
|
65
|
-
verifiedAt: '2026-04-07',
|
|
66
|
-
},
|
|
67
|
-
];
|
|
68
|
-
|
|
69
|
-
const PROPAGATION_CHECKLIST = [
|
|
70
|
-
{
|
|
71
|
-
trigger: 'OpenCode release with config changes',
|
|
72
|
-
targets: [
|
|
73
|
-
'src/opencode/techniques.js — update DEPRECATED_CONFIG_KEYS if keys renamed/removed',
|
|
74
|
-
'src/opencode/config-parser.js — update JSONC validation',
|
|
75
|
-
'src/opencode/governance.js — update caveats if behavior changes',
|
|
76
|
-
'test/opencode-check-matrix.js — update check expectations',
|
|
77
|
-
],
|
|
78
|
-
},
|
|
79
|
-
{
|
|
80
|
-
trigger: 'New OpenCode plugin event type added',
|
|
81
|
-
targets: [
|
|
82
|
-
'src/opencode/techniques.js — add to VALID_PLUGIN_EVENTS',
|
|
83
|
-
'src/opencode/governance.js — add to OPENCODE_PLUGIN_GOVERNANCE',
|
|
84
|
-
'src/opencode/setup.js — update plugins starter template',
|
|
85
|
-
],
|
|
86
|
-
},
|
|
87
|
-
{
|
|
88
|
-
trigger: 'New OpenCode permission tool added',
|
|
89
|
-
targets: [
|
|
90
|
-
'src/opencode/techniques.js — add to PERMISSIONED_TOOLS',
|
|
91
|
-
'src/opencode/governance.js — update permission profiles',
|
|
92
|
-
'src/opencode/setup.js — update default permission config',
|
|
93
|
-
],
|
|
94
|
-
},
|
|
95
|
-
{
|
|
96
|
-
trigger: 'OpenCode MCP schema change',
|
|
97
|
-
targets: [
|
|
98
|
-
'src/opencode/mcp-packs.js — update JSONC projections',
|
|
99
|
-
'src/opencode/techniques.js — update MCP checks',
|
|
100
|
-
],
|
|
101
|
-
},
|
|
65
|
+
verifiedAt: '2026-04-07',
|
|
66
|
+
},
|
|
67
|
+
];
|
|
68
|
+
|
|
69
|
+
const PROPAGATION_CHECKLIST = [
|
|
70
|
+
{
|
|
71
|
+
trigger: 'OpenCode release with config changes',
|
|
72
|
+
targets: [
|
|
73
|
+
'src/opencode/techniques.js — update DEPRECATED_CONFIG_KEYS if keys renamed/removed',
|
|
74
|
+
'src/opencode/config-parser.js — update JSONC validation',
|
|
75
|
+
'src/opencode/governance.js — update caveats if behavior changes',
|
|
76
|
+
'test/opencode-check-matrix.js — update check expectations',
|
|
77
|
+
],
|
|
78
|
+
},
|
|
79
|
+
{
|
|
80
|
+
trigger: 'New OpenCode plugin event type added',
|
|
81
|
+
targets: [
|
|
82
|
+
'src/opencode/techniques.js — add to VALID_PLUGIN_EVENTS',
|
|
83
|
+
'src/opencode/governance.js — add to OPENCODE_PLUGIN_GOVERNANCE',
|
|
84
|
+
'src/opencode/setup.js — update plugins starter template',
|
|
85
|
+
],
|
|
86
|
+
},
|
|
87
|
+
{
|
|
88
|
+
trigger: 'New OpenCode permission tool added',
|
|
89
|
+
targets: [
|
|
90
|
+
'src/opencode/techniques.js — add to PERMISSIONED_TOOLS',
|
|
91
|
+
'src/opencode/governance.js — update permission profiles',
|
|
92
|
+
'src/opencode/setup.js — update default permission config',
|
|
93
|
+
],
|
|
94
|
+
},
|
|
95
|
+
{
|
|
96
|
+
trigger: 'OpenCode MCP schema change',
|
|
97
|
+
targets: [
|
|
98
|
+
'src/opencode/mcp-packs.js — update JSONC projections',
|
|
99
|
+
'src/opencode/techniques.js — update MCP checks',
|
|
100
|
+
],
|
|
101
|
+
},
|
|
102
102
|
{
|
|
103
103
|
trigger: 'Known security bug fixed or new bug reported',
|
|
104
104
|
targets: [
|
|
@@ -132,72 +132,72 @@ const PROPAGATION_CHECKLIST = [
|
|
|
132
132
|
],
|
|
133
133
|
},
|
|
134
134
|
];
|
|
135
|
-
|
|
136
|
-
function checkReleaseGate(sourceVerifications = {}) {
|
|
137
|
-
const now = new Date();
|
|
138
|
-
const results = P0_SOURCES.map(source => {
|
|
139
|
-
const verifiedAt = sourceVerifications[source.key]
|
|
140
|
-
? new Date(sourceVerifications[source.key])
|
|
141
|
-
: source.verifiedAt ? new Date(source.verifiedAt) : null;
|
|
142
|
-
|
|
143
|
-
if (!verifiedAt) {
|
|
144
|
-
return { ...source, status: 'unverified', daysStale: null };
|
|
145
|
-
}
|
|
146
|
-
|
|
147
|
-
const daysSince = Math.floor((now - verifiedAt) / (1000 * 60 * 60 * 24));
|
|
148
|
-
const isStale = daysSince > source.stalenessThresholdDays;
|
|
149
|
-
|
|
150
|
-
return {
|
|
151
|
-
...source,
|
|
152
|
-
verifiedAt: verifiedAt.toISOString(),
|
|
153
|
-
daysStale: daysSince,
|
|
154
|
-
status: isStale ? 'stale' : 'fresh',
|
|
155
|
-
};
|
|
156
|
-
});
|
|
157
|
-
|
|
158
|
-
return {
|
|
159
|
-
ready: results.every(r => r.status === 'fresh'),
|
|
160
|
-
stale: results.filter(r => r.status === 'stale' || r.status === 'unverified'),
|
|
161
|
-
fresh: results.filter(r => r.status === 'fresh'),
|
|
162
|
-
results,
|
|
163
|
-
};
|
|
164
|
-
}
|
|
165
|
-
|
|
166
|
-
function formatReleaseGate(gateResult) {
|
|
167
|
-
const lines = [
|
|
168
|
-
`OpenCode Freshness Gate (nerviq v${version})`,
|
|
169
|
-
'═══════════════════════════════════════',
|
|
170
|
-
'',
|
|
171
|
-
`Status: ${gateResult.ready ? 'READY' : 'BLOCKED'}`,
|
|
172
|
-
`Fresh: ${gateResult.fresh.length}/${gateResult.results.length}`,
|
|
173
|
-
'',
|
|
174
|
-
];
|
|
175
|
-
|
|
176
|
-
for (const result of gateResult.results) {
|
|
177
|
-
const icon = result.status === 'fresh' ? '✓' : result.status === 'stale' ? '✗' : '?';
|
|
178
|
-
const age = result.daysStale !== null ? ` (${result.daysStale}d ago)` : ' (unverified)';
|
|
179
|
-
lines.push(` ${icon} ${result.label}${age} — threshold: ${result.stalenessThresholdDays}d`);
|
|
180
|
-
}
|
|
181
|
-
|
|
182
|
-
if (!gateResult.ready) {
|
|
183
|
-
lines.push('');
|
|
184
|
-
lines.push('Action required: verify stale/unverified sources before claiming release freshness.');
|
|
185
|
-
}
|
|
186
|
-
|
|
187
|
-
return lines.join('\n');
|
|
188
|
-
}
|
|
189
|
-
|
|
190
|
-
function getPropagationTargets(triggerKeyword) {
|
|
191
|
-
const keyword = triggerKeyword.toLowerCase();
|
|
192
|
-
return PROPAGATION_CHECKLIST.filter(item =>
|
|
193
|
-
item.trigger.toLowerCase().includes(keyword)
|
|
194
|
-
);
|
|
195
|
-
}
|
|
196
|
-
|
|
197
|
-
module.exports = {
|
|
198
|
-
P0_SOURCES,
|
|
199
|
-
PROPAGATION_CHECKLIST,
|
|
200
|
-
checkReleaseGate,
|
|
201
|
-
formatReleaseGate,
|
|
202
|
-
getPropagationTargets,
|
|
203
|
-
};
|
|
135
|
+
|
|
136
|
+
function checkReleaseGate(sourceVerifications = {}) {
|
|
137
|
+
const now = new Date();
|
|
138
|
+
const results = P0_SOURCES.map(source => {
|
|
139
|
+
const verifiedAt = sourceVerifications[source.key]
|
|
140
|
+
? new Date(sourceVerifications[source.key])
|
|
141
|
+
: source.verifiedAt ? new Date(source.verifiedAt) : null;
|
|
142
|
+
|
|
143
|
+
if (!verifiedAt) {
|
|
144
|
+
return { ...source, status: 'unverified', daysStale: null };
|
|
145
|
+
}
|
|
146
|
+
|
|
147
|
+
const daysSince = Math.floor((now - verifiedAt) / (1000 * 60 * 60 * 24));
|
|
148
|
+
const isStale = daysSince > source.stalenessThresholdDays;
|
|
149
|
+
|
|
150
|
+
return {
|
|
151
|
+
...source,
|
|
152
|
+
verifiedAt: verifiedAt.toISOString(),
|
|
153
|
+
daysStale: daysSince,
|
|
154
|
+
status: isStale ? 'stale' : 'fresh',
|
|
155
|
+
};
|
|
156
|
+
});
|
|
157
|
+
|
|
158
|
+
return {
|
|
159
|
+
ready: results.every(r => r.status === 'fresh'),
|
|
160
|
+
stale: results.filter(r => r.status === 'stale' || r.status === 'unverified'),
|
|
161
|
+
fresh: results.filter(r => r.status === 'fresh'),
|
|
162
|
+
results,
|
|
163
|
+
};
|
|
164
|
+
}
|
|
165
|
+
|
|
166
|
+
function formatReleaseGate(gateResult) {
|
|
167
|
+
const lines = [
|
|
168
|
+
`OpenCode Freshness Gate (nerviq v${version})`,
|
|
169
|
+
'═══════════════════════════════════════',
|
|
170
|
+
'',
|
|
171
|
+
`Status: ${gateResult.ready ? 'READY' : 'BLOCKED'}`,
|
|
172
|
+
`Fresh: ${gateResult.fresh.length}/${gateResult.results.length}`,
|
|
173
|
+
'',
|
|
174
|
+
];
|
|
175
|
+
|
|
176
|
+
for (const result of gateResult.results) {
|
|
177
|
+
const icon = result.status === 'fresh' ? '✓' : result.status === 'stale' ? '✗' : '?';
|
|
178
|
+
const age = result.daysStale !== null ? ` (${result.daysStale}d ago)` : ' (unverified)';
|
|
179
|
+
lines.push(` ${icon} ${result.label}${age} — threshold: ${result.stalenessThresholdDays}d`);
|
|
180
|
+
}
|
|
181
|
+
|
|
182
|
+
if (!gateResult.ready) {
|
|
183
|
+
lines.push('');
|
|
184
|
+
lines.push('Action required: verify stale/unverified sources before claiming release freshness.');
|
|
185
|
+
}
|
|
186
|
+
|
|
187
|
+
return lines.join('\n');
|
|
188
|
+
}
|
|
189
|
+
|
|
190
|
+
function getPropagationTargets(triggerKeyword) {
|
|
191
|
+
const keyword = triggerKeyword.toLowerCase();
|
|
192
|
+
return PROPAGATION_CHECKLIST.filter(item =>
|
|
193
|
+
item.trigger.toLowerCase().includes(keyword)
|
|
194
|
+
);
|
|
195
|
+
}
|
|
196
|
+
|
|
197
|
+
module.exports = {
|
|
198
|
+
P0_SOURCES,
|
|
199
|
+
PROPAGATION_CHECKLIST,
|
|
200
|
+
checkReleaseGate,
|
|
201
|
+
formatReleaseGate,
|
|
202
|
+
getPropagationTargets,
|
|
203
|
+
};
|