@nerviq/cli 1.29.0 → 1.29.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (80) hide show
  1. package/CHANGELOG.md +1527 -1493
  2. package/README.md +550 -538
  3. package/SECURITY.md +82 -82
  4. package/bin/cli.js +2562 -2558
  5. package/docs/api-reference.md +356 -356
  6. package/docs/audit-fix.md +109 -0
  7. package/docs/autofix.md +3 -62
  8. package/docs/getting-started.md +1 -1
  9. package/docs/index.html +592 -592
  10. package/docs/integration-contracts.md +287 -287
  11. package/docs/maintenance.md +128 -128
  12. package/docs/new-platform-guide.md +202 -202
  13. package/docs/release-process.md +63 -0
  14. package/docs/shallow-risk.md +244 -244
  15. package/docs/why-nerviq.md +82 -82
  16. package/package.json +67 -67
  17. package/src/aider/activity.js +226 -226
  18. package/src/aider/context.js +162 -162
  19. package/src/aider/freshness.js +123 -123
  20. package/src/aider/techniques.js +3465 -3465
  21. package/src/audit/layers.js +180 -180
  22. package/src/audit.js +1032 -1032
  23. package/src/benchmark.js +299 -299
  24. package/src/codex/activity.js +324 -324
  25. package/src/codex/freshness.js +142 -142
  26. package/src/codex/techniques.js +4895 -4895
  27. package/src/context.js +326 -326
  28. package/src/continuous-ops.js +11 -1
  29. package/src/convert.js +340 -340
  30. package/src/copilot/config-parser.js +280 -280
  31. package/src/copilot/context.js +218 -218
  32. package/src/copilot/freshness.js +177 -177
  33. package/src/copilot/patch.js +238 -238
  34. package/src/copilot/techniques.js +3578 -3578
  35. package/src/cursor/freshness.js +194 -194
  36. package/src/cursor/patch.js +243 -243
  37. package/src/cursor/techniques.js +3735 -3735
  38. package/src/doctor.js +201 -201
  39. package/src/fix-engine.js +511 -8
  40. package/src/formatters/csv.js +86 -86
  41. package/src/formatters/junit.js +123 -123
  42. package/src/formatters/markdown.js +164 -164
  43. package/src/formatters/otel.js +151 -151
  44. package/src/freshness.js +156 -156
  45. package/src/gemini/activity.js +402 -402
  46. package/src/gemini/context.js +290 -290
  47. package/src/gemini/freshness.js +183 -183
  48. package/src/gemini/patch.js +229 -229
  49. package/src/gemini/techniques.js +3811 -3811
  50. package/src/governance.js +533 -533
  51. package/src/harmony/audit.js +306 -306
  52. package/src/i18n.js +63 -63
  53. package/src/insights.js +119 -119
  54. package/src/integrations.js +134 -134
  55. package/src/locales/en.json +33 -33
  56. package/src/locales/es.json +33 -33
  57. package/src/migrate.js +354 -354
  58. package/src/opencode/activity.js +286 -286
  59. package/src/opencode/freshness.js +137 -137
  60. package/src/opencode/techniques.js +3450 -3450
  61. package/src/setup/analysis.js +12 -12
  62. package/src/setup.js +7 -6
  63. package/src/shallow-risk/index.js +56 -56
  64. package/src/shallow-risk/patterns/agent-config-cross-platform-drift.js +50 -50
  65. package/src/shallow-risk/patterns/agent-config-dangerous-autoapprove.js +46 -46
  66. package/src/shallow-risk/patterns/agent-config-deprecated-keys.js +46 -46
  67. package/src/shallow-risk/patterns/agent-config-missing-file.js +317 -317
  68. package/src/shallow-risk/patterns/agent-config-secret-literal.js +49 -49
  69. package/src/shallow-risk/patterns/agent-config-stack-contradiction.js +34 -34
  70. package/src/shallow-risk/patterns/hook-script-missing.js +70 -70
  71. package/src/shallow-risk/patterns/mcp-server-no-allowlist.js +52 -52
  72. package/src/shallow-risk/shared.js +648 -648
  73. package/src/source-urls.js +295 -295
  74. package/src/state-paths.js +85 -85
  75. package/src/supplemental-checks.js +805 -805
  76. package/src/telemetry.js +160 -160
  77. package/src/windsurf/context.js +359 -359
  78. package/src/windsurf/freshness.js +194 -194
  79. package/src/windsurf/patch.js +231 -231
  80. package/src/windsurf/techniques.js +3779 -3779
@@ -1,46 +1,46 @@
1
- /**
2
- * Windsurf Freshness Operationalization
3
- *
4
- * Release gates, recurring probes, propagation checklists,
5
- * and staleness blocking for Windsurf surfaces.
6
- *
7
- * P0 sources from windsurf.com docs, propagation for rule format changes.
8
- */
9
-
10
- const { version } = require('../../package.json');
11
-
12
- /**
13
- * P0 sources that must be fresh before any Windsurf release claim.
14
- */
15
- const P0_SOURCES = [
16
- {
17
- key: 'windsurf-rules-docs',
18
- label: 'Windsurf Rules & Memories Documentation',
19
- url: 'https://docs.windsurf.com/windsurf/cascade/memories',
20
- stalenessThresholdDays: 30,
21
- verifiedAt: '2026-04-07',
22
- },
23
- {
24
- key: 'windsurf-cascade-docs',
25
- label: 'Cascade Agent Documentation',
26
- url: 'https://docs.windsurf.com/windsurf/cascade',
27
- stalenessThresholdDays: 30,
28
- verifiedAt: '2026-04-07',
29
- },
30
- {
31
- key: 'windsurf-mcp-docs',
32
- label: 'Windsurf MCP Documentation',
33
- url: 'https://docs.windsurf.com/plugins/cascade/mcp',
34
- stalenessThresholdDays: 30,
35
- verifiedAt: '2026-04-07',
36
- },
37
- {
38
- key: 'windsurf-memories-docs',
39
- label: 'Memories & Rules Documentation',
40
- url: 'https://docs.windsurf.com/windsurf/cascade/memories',
41
- stalenessThresholdDays: 30,
42
- verifiedAt: '2026-04-07',
43
- },
1
+ /**
2
+ * Windsurf Freshness Operationalization
3
+ *
4
+ * Release gates, recurring probes, propagation checklists,
5
+ * and staleness blocking for Windsurf surfaces.
6
+ *
7
+ * P0 sources from windsurf.com docs, propagation for rule format changes.
8
+ */
9
+
10
+ const { version } = require('../../package.json');
11
+
12
+ /**
13
+ * P0 sources that must be fresh before any Windsurf release claim.
14
+ */
15
+ const P0_SOURCES = [
16
+ {
17
+ key: 'windsurf-rules-docs',
18
+ label: 'Windsurf Rules & Memories Documentation',
19
+ url: 'https://docs.windsurf.com/windsurf/cascade/memories',
20
+ stalenessThresholdDays: 30,
21
+ verifiedAt: '2026-04-07',
22
+ },
23
+ {
24
+ key: 'windsurf-cascade-docs',
25
+ label: 'Cascade Agent Documentation',
26
+ url: 'https://docs.windsurf.com/windsurf/cascade',
27
+ stalenessThresholdDays: 30,
28
+ verifiedAt: '2026-04-07',
29
+ },
30
+ {
31
+ key: 'windsurf-mcp-docs',
32
+ label: 'Windsurf MCP Documentation',
33
+ url: 'https://docs.windsurf.com/plugins/cascade/mcp',
34
+ stalenessThresholdDays: 30,
35
+ verifiedAt: '2026-04-07',
36
+ },
37
+ {
38
+ key: 'windsurf-memories-docs',
39
+ label: 'Memories & Rules Documentation',
40
+ url: 'https://docs.windsurf.com/windsurf/cascade/memories',
41
+ stalenessThresholdDays: 30,
42
+ verifiedAt: '2026-04-07',
43
+ },
44
44
  {
45
45
  key: 'windsurf-workflows-docs',
46
46
  label: 'Workflows Documentation',
@@ -60,93 +60,93 @@ const P0_SOURCES = [
60
60
  label: 'Steps Documentation (via Workflows)',
61
61
  url: 'https://docs.windsurf.com/windsurf/cascade/workflows',
62
62
  stalenessThresholdDays: 30,
63
- verifiedAt: '2026-04-07',
64
- },
65
- {
66
- key: 'windsurf-cascadeignore-docs',
67
- label: 'Windsurf Ignore Documentation',
68
- url: 'https://docs.windsurf.com/context-awareness/windsurf-ignore',
69
- stalenessThresholdDays: 30,
70
- verifiedAt: '2026-04-07',
71
- },
72
- {
73
- key: 'windsurf-changelog',
74
- label: 'Windsurf Changelog',
75
- url: 'https://windsurf.com/changelog',
76
- stalenessThresholdDays: 14,
77
- verifiedAt: '2026-04-07',
78
- },
79
- {
80
- key: 'windsurf-security',
81
- label: 'Windsurf Security Admin Guide',
82
- url: 'https://docs.windsurf.com/security/security-admin-guide',
83
- stalenessThresholdDays: 30,
84
- verifiedAt: '2026-04-07',
85
- },
86
- ];
87
-
88
- /**
89
- * Propagation checklist: when a Windsurf source changes, these must update.
90
- */
91
- const PROPAGATION_CHECKLIST = [
92
- {
93
- trigger: 'Rule format change (new frontmatter fields, activation mode change)',
94
- targets: [
95
- 'src/windsurf/config-parser.js — update VALID_WINDSURF_FIELDS, detectRuleType, parseSimpleYaml',
96
- 'src/windsurf/techniques.js — update rule validation checks (WS-A01..WS-A09)',
97
- 'src/windsurf/context.js — update windsurfRules() parsing and type detection',
98
- 'src/windsurf/setup.js — update rule template generation',
99
- ],
100
- },
101
- {
102
- trigger: 'Cascade agent behavior change (multi-file, Steps, Skills)',
103
- targets: [
104
- 'src/windsurf/techniques.js — update Cascade agent checks (WS-D01..WS-D05)',
105
- 'src/windsurf/governance.js — update permission profiles',
106
- 'src/windsurf/deep-review.js — update trust class detection',
107
- ],
108
- },
109
- {
110
- trigger: 'Memories format or sync behavior change',
111
- targets: [
112
- 'src/windsurf/techniques.js — update memory checks (WS-H01..WS-H05)',
113
- 'src/windsurf/context.js — update memoryContents() parsing',
114
- 'src/windsurf/governance.js — update team-managed permission profile',
115
- ],
116
- },
117
- {
118
- trigger: 'MCP configuration format change in .windsurf/mcp.json',
119
- targets: [
120
- 'src/windsurf/mcp-packs.js — update pack JSON projections and merge logic',
121
- 'src/windsurf/techniques.js — update MCP checks (WS-E01..WS-E05)',
122
- 'src/windsurf/context.js — update mcpConfig() parsing',
123
- 'src/windsurf/config-parser.js — update validateMcpEnvVars',
124
- ],
125
- },
126
- {
127
- trigger: 'MCP team whitelist format change',
128
- targets: [
129
- 'src/windsurf/techniques.js — update WS-B02, WS-E05 thresholds',
130
- 'src/windsurf/governance.js — update mcp-team-whitelist caveat',
131
- 'src/windsurf/mcp-packs.js — update recommendation logic',
132
- ],
133
- },
134
- {
135
- trigger: 'Workflow / slash command format change',
136
- targets: [
137
- 'src/windsurf/techniques.js — update workflow checks (WS-G01..WS-G05)',
138
- 'src/windsurf/context.js — update workflowFiles() parsing',
139
- 'src/windsurf/governance.js — update workflow-trigger hook',
140
- ],
141
- },
142
- {
143
- trigger: 'Cascadeignore format or behavior change',
144
- targets: [
145
- 'src/windsurf/techniques.js — update cascadeignore checks (WS-J01..WS-J02)',
146
- 'src/windsurf/context.js — update cascadeignoreContent() parsing',
147
- 'src/windsurf/patch.js — update patchCascadeignore',
148
- ],
149
- },
63
+ verifiedAt: '2026-04-07',
64
+ },
65
+ {
66
+ key: 'windsurf-cascadeignore-docs',
67
+ label: 'Windsurf Ignore Documentation',
68
+ url: 'https://docs.windsurf.com/context-awareness/windsurf-ignore',
69
+ stalenessThresholdDays: 30,
70
+ verifiedAt: '2026-04-07',
71
+ },
72
+ {
73
+ key: 'windsurf-changelog',
74
+ label: 'Windsurf Changelog',
75
+ url: 'https://windsurf.com/changelog',
76
+ stalenessThresholdDays: 14,
77
+ verifiedAt: '2026-04-07',
78
+ },
79
+ {
80
+ key: 'windsurf-security',
81
+ label: 'Windsurf Security Admin Guide',
82
+ url: 'https://docs.windsurf.com/security/security-admin-guide',
83
+ stalenessThresholdDays: 30,
84
+ verifiedAt: '2026-04-07',
85
+ },
86
+ ];
87
+
88
+ /**
89
+ * Propagation checklist: when a Windsurf source changes, these must update.
90
+ */
91
+ const PROPAGATION_CHECKLIST = [
92
+ {
93
+ trigger: 'Rule format change (new frontmatter fields, activation mode change)',
94
+ targets: [
95
+ 'src/windsurf/config-parser.js — update VALID_WINDSURF_FIELDS, detectRuleType, parseSimpleYaml',
96
+ 'src/windsurf/techniques.js — update rule validation checks (WS-A01..WS-A09)',
97
+ 'src/windsurf/context.js — update windsurfRules() parsing and type detection',
98
+ 'src/windsurf/setup.js — update rule template generation',
99
+ ],
100
+ },
101
+ {
102
+ trigger: 'Cascade agent behavior change (multi-file, Steps, Skills)',
103
+ targets: [
104
+ 'src/windsurf/techniques.js — update Cascade agent checks (WS-D01..WS-D05)',
105
+ 'src/windsurf/governance.js — update permission profiles',
106
+ 'src/windsurf/deep-review.js — update trust class detection',
107
+ ],
108
+ },
109
+ {
110
+ trigger: 'Memories format or sync behavior change',
111
+ targets: [
112
+ 'src/windsurf/techniques.js — update memory checks (WS-H01..WS-H05)',
113
+ 'src/windsurf/context.js — update memoryContents() parsing',
114
+ 'src/windsurf/governance.js — update team-managed permission profile',
115
+ ],
116
+ },
117
+ {
118
+ trigger: 'MCP configuration format change in .windsurf/mcp.json',
119
+ targets: [
120
+ 'src/windsurf/mcp-packs.js — update pack JSON projections and merge logic',
121
+ 'src/windsurf/techniques.js — update MCP checks (WS-E01..WS-E05)',
122
+ 'src/windsurf/context.js — update mcpConfig() parsing',
123
+ 'src/windsurf/config-parser.js — update validateMcpEnvVars',
124
+ ],
125
+ },
126
+ {
127
+ trigger: 'MCP team whitelist format change',
128
+ targets: [
129
+ 'src/windsurf/techniques.js — update WS-B02, WS-E05 thresholds',
130
+ 'src/windsurf/governance.js — update mcp-team-whitelist caveat',
131
+ 'src/windsurf/mcp-packs.js — update recommendation logic',
132
+ ],
133
+ },
134
+ {
135
+ trigger: 'Workflow / slash command format change',
136
+ targets: [
137
+ 'src/windsurf/techniques.js — update workflow checks (WS-G01..WS-G05)',
138
+ 'src/windsurf/context.js — update workflowFiles() parsing',
139
+ 'src/windsurf/governance.js — update workflow-trigger hook',
140
+ ],
141
+ },
142
+ {
143
+ trigger: 'Cascadeignore format or behavior change',
144
+ targets: [
145
+ 'src/windsurf/techniques.js — update cascadeignore checks (WS-J01..WS-J02)',
146
+ 'src/windsurf/context.js — update cascadeignoreContent() parsing',
147
+ 'src/windsurf/patch.js — update patchCascadeignore',
148
+ ],
149
+ },
150
150
  {
151
151
  trigger: '10K char rule limit change',
152
152
  targets: [
@@ -164,67 +164,67 @@ const PROPAGATION_CHECKLIST = [
164
164
  ],
165
165
  },
166
166
  ];
167
-
168
- /**
169
- * Release gate: check if all P0 sources are within staleness threshold.
170
- */
171
- function checkReleaseGate(sourceVerifications = {}) {
172
- const now = new Date();
173
- const results = P0_SOURCES.map(source => {
174
- const verifiedAt = sourceVerifications[source.key]
175
- ? new Date(sourceVerifications[source.key])
176
- : source.verifiedAt ? new Date(source.verifiedAt) : null;
177
-
178
- if (!verifiedAt) {
179
- return { ...source, status: 'unverified', daysStale: null };
180
- }
181
-
182
- const daysSince = Math.floor((now - verifiedAt) / (1000 * 60 * 60 * 24));
183
- const isStale = daysSince > source.stalenessThresholdDays;
184
-
185
- return { ...source, verifiedAt: verifiedAt.toISOString(), daysStale: daysSince, status: isStale ? 'stale' : 'fresh' };
186
- });
187
-
188
- return {
189
- ready: results.every(r => r.status === 'fresh'),
190
- stale: results.filter(r => r.status === 'stale' || r.status === 'unverified'),
191
- fresh: results.filter(r => r.status === 'fresh'),
192
- results,
193
- };
194
- }
195
-
196
- function formatReleaseGate(gateResult) {
197
- const lines = [
198
- `Windsurf Freshness Gate (nerviq v${version})`,
199
- '═══════════════════════════════════════',
200
- '',
201
- `Status: ${gateResult.ready ? 'READY' : 'BLOCKED'}`,
202
- `Fresh: ${gateResult.fresh.length}/${gateResult.results.length}`,
203
- '',
204
- ];
205
-
206
- for (const result of gateResult.results) {
207
- const icon = result.status === 'fresh' ? '✓' : result.status === 'stale' ? '✗' : '?';
208
- const age = result.daysStale !== null ? ` (${result.daysStale}d ago)` : ' (unverified)';
209
- lines.push(` ${icon} ${result.label}${age} — threshold: ${result.stalenessThresholdDays}d`);
210
- }
211
-
212
- if (!gateResult.ready) {
213
- lines.push('', 'Action required: verify stale/unverified sources before claiming release freshness.');
214
- }
215
-
216
- return lines.join('\n');
217
- }
218
-
219
- function getPropagationTargets(triggerKeyword) {
220
- const keyword = triggerKeyword.toLowerCase();
221
- return PROPAGATION_CHECKLIST.filter(item => item.trigger.toLowerCase().includes(keyword));
222
- }
223
-
224
- module.exports = {
225
- P0_SOURCES,
226
- PROPAGATION_CHECKLIST,
227
- checkReleaseGate,
228
- formatReleaseGate,
229
- getPropagationTargets,
230
- };
167
+
168
+ /**
169
+ * Release gate: check if all P0 sources are within staleness threshold.
170
+ */
171
+ function checkReleaseGate(sourceVerifications = {}) {
172
+ const now = new Date();
173
+ const results = P0_SOURCES.map(source => {
174
+ const verifiedAt = sourceVerifications[source.key]
175
+ ? new Date(sourceVerifications[source.key])
176
+ : source.verifiedAt ? new Date(source.verifiedAt) : null;
177
+
178
+ if (!verifiedAt) {
179
+ return { ...source, status: 'unverified', daysStale: null };
180
+ }
181
+
182
+ const daysSince = Math.floor((now - verifiedAt) / (1000 * 60 * 60 * 24));
183
+ const isStale = daysSince > source.stalenessThresholdDays;
184
+
185
+ return { ...source, verifiedAt: verifiedAt.toISOString(), daysStale: daysSince, status: isStale ? 'stale' : 'fresh' };
186
+ });
187
+
188
+ return {
189
+ ready: results.every(r => r.status === 'fresh'),
190
+ stale: results.filter(r => r.status === 'stale' || r.status === 'unverified'),
191
+ fresh: results.filter(r => r.status === 'fresh'),
192
+ results,
193
+ };
194
+ }
195
+
196
+ function formatReleaseGate(gateResult) {
197
+ const lines = [
198
+ `Windsurf Freshness Gate (nerviq v${version})`,
199
+ '═══════════════════════════════════════',
200
+ '',
201
+ `Status: ${gateResult.ready ? 'READY' : 'BLOCKED'}`,
202
+ `Fresh: ${gateResult.fresh.length}/${gateResult.results.length}`,
203
+ '',
204
+ ];
205
+
206
+ for (const result of gateResult.results) {
207
+ const icon = result.status === 'fresh' ? '✓' : result.status === 'stale' ? '✗' : '?';
208
+ const age = result.daysStale !== null ? ` (${result.daysStale}d ago)` : ' (unverified)';
209
+ lines.push(` ${icon} ${result.label}${age} — threshold: ${result.stalenessThresholdDays}d`);
210
+ }
211
+
212
+ if (!gateResult.ready) {
213
+ lines.push('', 'Action required: verify stale/unverified sources before claiming release freshness.');
214
+ }
215
+
216
+ return lines.join('\n');
217
+ }
218
+
219
+ function getPropagationTargets(triggerKeyword) {
220
+ const keyword = triggerKeyword.toLowerCase();
221
+ return PROPAGATION_CHECKLIST.filter(item => item.trigger.toLowerCase().includes(keyword));
222
+ }
223
+
224
+ module.exports = {
225
+ P0_SOURCES,
226
+ PROPAGATION_CHECKLIST,
227
+ checkReleaseGate,
228
+ formatReleaseGate,
229
+ getPropagationTargets,
230
+ };