@nerviq/cli 1.29.0 → 1.30.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (93) hide show
  1. package/CHANGELOG.md +1764 -1493
  2. package/README.md +568 -538
  3. package/SECURITY.md +78 -82
  4. package/bin/cli.js +2838 -2558
  5. package/docs/api-reference.md +356 -356
  6. package/docs/audit-fix.md +109 -0
  7. package/docs/autofix.md +3 -62
  8. package/docs/getting-started.md +1 -1
  9. package/docs/index.html +592 -592
  10. package/docs/integration-contracts.md +287 -287
  11. package/docs/maintenance.md +128 -128
  12. package/docs/new-platform-guide.md +202 -202
  13. package/docs/release-process.md +63 -0
  14. package/docs/shallow-risk.md +244 -244
  15. package/docs/why-nerviq.md +82 -82
  16. package/package.json +75 -67
  17. package/sdk/README.md +12 -3
  18. package/sdk/examples/langchain-integration.md +128 -0
  19. package/sdk/examples/self-governing-agent.js +135 -0
  20. package/sdk/index.d.ts +115 -0
  21. package/sdk/index.js +94 -0
  22. package/sdk/package.json +11 -0
  23. package/src/activity.js +13 -0
  24. package/src/aider/activity.js +226 -226
  25. package/src/aider/context.js +162 -162
  26. package/src/aider/freshness.js +123 -123
  27. package/src/aider/techniques.js +3465 -3465
  28. package/src/audit/layers.js +180 -180
  29. package/src/audit.js +1133 -1032
  30. package/src/auto-suggest.js +9 -2
  31. package/src/behavioral-drift.js +37 -2
  32. package/src/benchmark.js +299 -299
  33. package/src/codex/activity.js +324 -324
  34. package/src/codex/freshness.js +149 -142
  35. package/src/codex/techniques.js +4895 -4895
  36. package/src/context.js +326 -326
  37. package/src/continuous-ops.js +11 -1
  38. package/src/convert.js +340 -340
  39. package/src/copilot/config-parser.js +280 -280
  40. package/src/copilot/context.js +218 -218
  41. package/src/copilot/freshness.js +184 -177
  42. package/src/copilot/patch.js +238 -238
  43. package/src/copilot/techniques.js +3578 -3578
  44. package/src/cursor/freshness.js +194 -194
  45. package/src/cursor/patch.js +243 -243
  46. package/src/cursor/techniques.js +3735 -3735
  47. package/src/doctor.js +201 -201
  48. package/src/fix-engine.js +511 -8
  49. package/src/formatters/csv.js +86 -86
  50. package/src/formatters/junit.js +123 -123
  51. package/src/formatters/markdown.js +164 -164
  52. package/src/formatters/otel.js +151 -151
  53. package/src/freshness.js +163 -156
  54. package/src/gemini/activity.js +402 -402
  55. package/src/gemini/context.js +290 -290
  56. package/src/gemini/freshness.js +188 -188
  57. package/src/gemini/patch.js +229 -229
  58. package/src/gemini/techniques.js +3811 -3811
  59. package/src/governance.js +533 -533
  60. package/src/harmony/audit.js +306 -306
  61. package/src/i18n.js +63 -63
  62. package/src/insights.js +119 -119
  63. package/src/integrations.js +134 -134
  64. package/src/locales/en.json +33 -33
  65. package/src/locales/es.json +33 -33
  66. package/src/migrate.js +354 -354
  67. package/src/opencode/activity.js +286 -286
  68. package/src/opencode/freshness.js +137 -137
  69. package/src/opencode/techniques.js +3450 -3450
  70. package/src/safe-glyph.js +97 -0
  71. package/src/setup/analysis.js +12 -12
  72. package/src/setup.js +13 -6
  73. package/src/shallow-risk/index.js +113 -56
  74. package/src/shallow-risk/patterns/agent-config-cross-platform-drift.js +51 -50
  75. package/src/shallow-risk/patterns/agent-config-dangerous-autoapprove.js +47 -46
  76. package/src/shallow-risk/patterns/agent-config-deprecated-keys.js +47 -46
  77. package/src/shallow-risk/patterns/agent-config-framework-version-mismatch.js +138 -0
  78. package/src/shallow-risk/patterns/agent-config-missing-file.js +318 -317
  79. package/src/shallow-risk/patterns/agent-config-script-not-in-package-json.js +108 -0
  80. package/src/shallow-risk/patterns/agent-config-secret-literal.js +52 -49
  81. package/src/shallow-risk/patterns/agent-config-stack-contradiction.js +35 -34
  82. package/src/shallow-risk/patterns/hook-script-missing.js +71 -70
  83. package/src/shallow-risk/patterns/mcp-server-no-allowlist.js +53 -52
  84. package/src/shallow-risk/shared.js +653 -648
  85. package/src/source-urls.js +295 -295
  86. package/src/state-paths.js +85 -85
  87. package/src/supplemental-checks.js +805 -805
  88. package/src/telemetry.js +160 -160
  89. package/src/watch.js +46 -0
  90. package/src/windsurf/context.js +359 -359
  91. package/src/windsurf/freshness.js +194 -194
  92. package/src/windsurf/patch.js +231 -231
  93. package/src/windsurf/techniques.js +3779 -3779
@@ -1,218 +1,218 @@
1
- /**
2
- * Copilot project context.
3
- *
4
- * Extends the shared ProjectContext with Copilot-specific file lookups,
5
- * 3-surface detection (VS Code, cloud agent, CLI), instruction parsing,
6
- * and per-surface config resolution.
7
- */
8
-
9
- const fs = require('fs');
10
- const path = require('path');
11
- const { ProjectContext } = require('../context');
12
- const { tryParseJson, extractFrontmatter, getValueByPath } = require('./config-parser');
13
-
14
- function listFiles(fullPath, filter) {
15
- try {
16
- const entries = fs.readdirSync(fullPath).filter(f => !f.startsWith('.'));
17
- return filter ? entries.filter(filter) : entries;
18
- } catch {
19
- return [];
20
- }
21
- }
22
-
23
- class CopilotProjectContext extends ProjectContext {
24
-
25
- // ─── Instructions ─────────────────────────────────────────────────────
26
-
27
- /**
28
- * .github/copilot-instructions.md — repo-wide instructions for all surfaces.
29
- *
30
- * Copilot CLI also ingests root-level AGENTS.md and CLAUDE.md automatically
31
- * (see GitHub Copilot CLI docs — "custom instructions"). When the canonical
32
- * file is missing, fall back to these alternate cross-platform instruction
33
- * files so repos that standardize on AGENTS.md/CLAUDE.md (a common pattern
34
- * in the Rust/Python ecosystems) are not penalized as having no instructions.
35
- */
36
- copilotInstructionsContent() {
37
- return this.fileContent('.github/copilot-instructions.md') ||
38
- this.fileContent('AGENTS.md') ||
39
- this.fileContent('CLAUDE.md');
40
- }
41
-
42
- /**
43
- * Returns true if the repo has any instruction surface recognised by
44
- * Copilot (native or cross-platform via CLI auto-ingestion).
45
- */
46
- hasAnyInstructionsSurface() {
47
- return Boolean(
48
- this.fileContent('.github/copilot-instructions.md') ||
49
- this.fileContent('AGENTS.md') ||
50
- this.fileContent('CLAUDE.md')
51
- );
52
- }
53
-
54
- /**
55
- * .github/instructions/*.instructions.md — path-scoped instructions.
56
- * Returns array of { name, path, frontmatter, body, applyTo }.
57
- */
58
- scopedInstructions() {
59
- const dir = path.join(this.dir, '.github', 'instructions');
60
- const files = listFiles(dir, f => f.endsWith('.instructions.md'));
61
- return files.map(f => {
62
- const relPath = `.github/instructions/${f}`;
63
- const content = this.fileContent(relPath);
64
- if (!content) return null;
65
- const parsed = extractFrontmatter(content);
66
- return {
67
- name: f.replace('.instructions.md', ''),
68
- path: relPath,
69
- frontmatter: parsed.frontmatter,
70
- body: parsed.body,
71
- applyTo: parsed.frontmatter ? parsed.frontmatter.applyTo : null,
72
- };
73
- }).filter(Boolean);
74
- }
75
-
76
- /**
77
- * .github/prompts/*.prompt.md — reusable prompt templates.
78
- * Returns array of { name, path, frontmatter, body }.
79
- */
80
- promptFiles() {
81
- const dir = path.join(this.dir, '.github', 'prompts');
82
- const files = listFiles(dir, f => f.endsWith('.prompt.md'));
83
- return files.map(f => {
84
- const relPath = `.github/prompts/${f}`;
85
- const content = this.fileContent(relPath);
86
- if (!content) return null;
87
- const parsed = extractFrontmatter(content);
88
- return {
89
- name: f.replace('.prompt.md', ''),
90
- path: relPath,
91
- frontmatter: parsed.frontmatter,
92
- body: parsed.body,
93
- };
94
- }).filter(Boolean);
95
- }
96
-
97
- // ─── VS Code settings ─────────────────────────────────────────────────
98
-
99
- /**
100
- * .vscode/settings.json parsed — full VS Code settings (Copilot-relevant keys).
101
- */
102
- vscodeSettings() {
103
- const content = this.fileContent('.vscode/settings.json');
104
- if (!content) {
105
- return { ok: false, data: null, error: 'missing .vscode/settings.json', source: '.vscode/settings.json' };
106
- }
107
- const parsed = tryParseJson(content);
108
- return { ...parsed, source: '.vscode/settings.json' };
109
- }
110
-
111
- /**
112
- * Get a specific Copilot-related setting from .vscode/settings.json.
113
- */
114
- copilotSetting(dottedKey) {
115
- const result = this.vscodeSettings();
116
- if (!result.ok) return undefined;
117
- return getValueByPath(result.data, dottedKey);
118
- }
119
-
120
- // ─── Cloud agent config ───────────────────────────────────────────────
121
-
122
- /**
123
- * copilot-setup-steps.yml — cloud agent environment setup.
124
- */
125
- cloudAgentConfig() {
126
- return this.fileContent('.github/workflows/copilot-setup-steps.yml') ||
127
- this.fileContent('copilot-setup-steps.yml');
128
- }
129
-
130
- // ─── MCP config ───────────────────────────────────────────────────────
131
-
132
- /**
133
- * .vscode/mcp.json — VS Code MCP server configuration.
134
- * Note: Copilot MCP uses .vscode/mcp.json (separate from settings.json mcpServers).
135
- */
136
- mcpConfig() {
137
- const content = this.fileContent('.vscode/mcp.json');
138
- if (!content) {
139
- return { ok: false, data: null, error: 'missing .vscode/mcp.json', source: '.vscode/mcp.json' };
140
- }
141
- const parsed = tryParseJson(content);
142
- return { ...parsed, source: '.vscode/mcp.json' };
143
- }
144
-
145
- /**
146
- * MCP servers from .vscode/mcp.json.
147
- */
148
- mcpServers() {
149
- const result = this.mcpConfig();
150
- if (!result.ok || !result.data) return {};
151
- return result.data.servers || result.data.mcpServers || {};
152
- }
153
-
154
- // ─── Content exclusions ───────────────────────────────────────────────
155
-
156
- /**
157
- * Content exclusion patterns from .vscode/settings.json or org-level markers.
158
- * Returns array of glob patterns, or null if not configured.
159
- */
160
- contentExclusions() {
161
- const settings = this.vscodeSettings();
162
- if (!settings.ok) return null;
163
-
164
- // Check multiple possible config keys for content exclusions
165
- const exclusions = getValueByPath(settings.data, 'github.copilot.advanced.contentExclusion') ||
166
- getValueByPath(settings.data, 'github.copilot.contentExclusion') ||
167
- null;
168
-
169
- return exclusions;
170
- }
171
-
172
- // ─── Workflow files ───────────────────────────────────────────────────
173
-
174
- workflowFiles() {
175
- const dir = path.join(this.dir, '.github', 'workflows');
176
- return listFiles(dir, f => f.endsWith('.yml') || f.endsWith('.yaml'))
177
- .map(f => `.github/workflows/${f}`);
178
- }
179
-
180
- // ─── Surface detection ────────────────────────────────────────────────
181
-
182
- /**
183
- * Detect which Copilot surfaces are configured.
184
- */
185
- detectSurfaces() {
186
- const vscode = Boolean(
187
- this.fileContent('.vscode/settings.json') ||
188
- this.fileContent('.vscode/mcp.json')
189
- );
190
- const cloudAgent = Boolean(this.cloudAgentConfig());
191
- const cli = false; // CLI detection is local-only; can't detect from repo files
192
-
193
- return { vscode, cloudAgent, cli };
194
- }
195
-
196
- // ─── Static detection ─────────────────────────────────────────────────
197
-
198
- static isCopilotRepo(dir) {
199
- try {
200
- return fs.existsSync(path.join(dir, '.github', 'copilot-instructions.md')) ||
201
- fs.existsSync(path.join(dir, '.vscode', 'mcp.json')) ||
202
- fs.existsSync(path.join(dir, '.github', 'instructions')) ||
203
- fs.existsSync(path.join(dir, '.github', 'prompts'));
204
- } catch {
205
- return false;
206
- }
207
- }
208
-
209
- // ─── Stack detection (reuse shared) ───────────────────────────────────
210
-
211
- detectStacks(STACKS) {
212
- return super.detectStacks(STACKS);
213
- }
214
- }
215
-
216
- module.exports = {
217
- CopilotProjectContext,
218
- };
1
+ /**
2
+ * Copilot project context.
3
+ *
4
+ * Extends the shared ProjectContext with Copilot-specific file lookups,
5
+ * 3-surface detection (VS Code, cloud agent, CLI), instruction parsing,
6
+ * and per-surface config resolution.
7
+ */
8
+
9
+ const fs = require('fs');
10
+ const path = require('path');
11
+ const { ProjectContext } = require('../context');
12
+ const { tryParseJson, extractFrontmatter, getValueByPath } = require('./config-parser');
13
+
14
+ function listFiles(fullPath, filter) {
15
+ try {
16
+ const entries = fs.readdirSync(fullPath).filter(f => !f.startsWith('.'));
17
+ return filter ? entries.filter(filter) : entries;
18
+ } catch {
19
+ return [];
20
+ }
21
+ }
22
+
23
+ class CopilotProjectContext extends ProjectContext {
24
+
25
+ // ─── Instructions ─────────────────────────────────────────────────────
26
+
27
+ /**
28
+ * .github/copilot-instructions.md — repo-wide instructions for all surfaces.
29
+ *
30
+ * Copilot CLI also ingests root-level AGENTS.md and CLAUDE.md automatically
31
+ * (see GitHub Copilot CLI docs — "custom instructions"). When the canonical
32
+ * file is missing, fall back to these alternate cross-platform instruction
33
+ * files so repos that standardize on AGENTS.md/CLAUDE.md (a common pattern
34
+ * in the Rust/Python ecosystems) are not penalized as having no instructions.
35
+ */
36
+ copilotInstructionsContent() {
37
+ return this.fileContent('.github/copilot-instructions.md') ||
38
+ this.fileContent('AGENTS.md') ||
39
+ this.fileContent('CLAUDE.md');
40
+ }
41
+
42
+ /**
43
+ * Returns true if the repo has any instruction surface recognised by
44
+ * Copilot (native or cross-platform via CLI auto-ingestion).
45
+ */
46
+ hasAnyInstructionsSurface() {
47
+ return Boolean(
48
+ this.fileContent('.github/copilot-instructions.md') ||
49
+ this.fileContent('AGENTS.md') ||
50
+ this.fileContent('CLAUDE.md')
51
+ );
52
+ }
53
+
54
+ /**
55
+ * .github/instructions/*.instructions.md — path-scoped instructions.
56
+ * Returns array of { name, path, frontmatter, body, applyTo }.
57
+ */
58
+ scopedInstructions() {
59
+ const dir = path.join(this.dir, '.github', 'instructions');
60
+ const files = listFiles(dir, f => f.endsWith('.instructions.md'));
61
+ return files.map(f => {
62
+ const relPath = `.github/instructions/${f}`;
63
+ const content = this.fileContent(relPath);
64
+ if (!content) return null;
65
+ const parsed = extractFrontmatter(content);
66
+ return {
67
+ name: f.replace('.instructions.md', ''),
68
+ path: relPath,
69
+ frontmatter: parsed.frontmatter,
70
+ body: parsed.body,
71
+ applyTo: parsed.frontmatter ? parsed.frontmatter.applyTo : null,
72
+ };
73
+ }).filter(Boolean);
74
+ }
75
+
76
+ /**
77
+ * .github/prompts/*.prompt.md — reusable prompt templates.
78
+ * Returns array of { name, path, frontmatter, body }.
79
+ */
80
+ promptFiles() {
81
+ const dir = path.join(this.dir, '.github', 'prompts');
82
+ const files = listFiles(dir, f => f.endsWith('.prompt.md'));
83
+ return files.map(f => {
84
+ const relPath = `.github/prompts/${f}`;
85
+ const content = this.fileContent(relPath);
86
+ if (!content) return null;
87
+ const parsed = extractFrontmatter(content);
88
+ return {
89
+ name: f.replace('.prompt.md', ''),
90
+ path: relPath,
91
+ frontmatter: parsed.frontmatter,
92
+ body: parsed.body,
93
+ };
94
+ }).filter(Boolean);
95
+ }
96
+
97
+ // ─── VS Code settings ─────────────────────────────────────────────────
98
+
99
+ /**
100
+ * .vscode/settings.json parsed — full VS Code settings (Copilot-relevant keys).
101
+ */
102
+ vscodeSettings() {
103
+ const content = this.fileContent('.vscode/settings.json');
104
+ if (!content) {
105
+ return { ok: false, data: null, error: 'missing .vscode/settings.json', source: '.vscode/settings.json' };
106
+ }
107
+ const parsed = tryParseJson(content);
108
+ return { ...parsed, source: '.vscode/settings.json' };
109
+ }
110
+
111
+ /**
112
+ * Get a specific Copilot-related setting from .vscode/settings.json.
113
+ */
114
+ copilotSetting(dottedKey) {
115
+ const result = this.vscodeSettings();
116
+ if (!result.ok) return undefined;
117
+ return getValueByPath(result.data, dottedKey);
118
+ }
119
+
120
+ // ─── Cloud agent config ───────────────────────────────────────────────
121
+
122
+ /**
123
+ * copilot-setup-steps.yml — cloud agent environment setup.
124
+ */
125
+ cloudAgentConfig() {
126
+ return this.fileContent('.github/workflows/copilot-setup-steps.yml') ||
127
+ this.fileContent('copilot-setup-steps.yml');
128
+ }
129
+
130
+ // ─── MCP config ───────────────────────────────────────────────────────
131
+
132
+ /**
133
+ * .vscode/mcp.json — VS Code MCP server configuration.
134
+ * Note: Copilot MCP uses .vscode/mcp.json (separate from settings.json mcpServers).
135
+ */
136
+ mcpConfig() {
137
+ const content = this.fileContent('.vscode/mcp.json');
138
+ if (!content) {
139
+ return { ok: false, data: null, error: 'missing .vscode/mcp.json', source: '.vscode/mcp.json' };
140
+ }
141
+ const parsed = tryParseJson(content);
142
+ return { ...parsed, source: '.vscode/mcp.json' };
143
+ }
144
+
145
+ /**
146
+ * MCP servers from .vscode/mcp.json.
147
+ */
148
+ mcpServers() {
149
+ const result = this.mcpConfig();
150
+ if (!result.ok || !result.data) return {};
151
+ return result.data.servers || result.data.mcpServers || {};
152
+ }
153
+
154
+ // ─── Content exclusions ───────────────────────────────────────────────
155
+
156
+ /**
157
+ * Content exclusion patterns from .vscode/settings.json or org-level markers.
158
+ * Returns array of glob patterns, or null if not configured.
159
+ */
160
+ contentExclusions() {
161
+ const settings = this.vscodeSettings();
162
+ if (!settings.ok) return null;
163
+
164
+ // Check multiple possible config keys for content exclusions
165
+ const exclusions = getValueByPath(settings.data, 'github.copilot.advanced.contentExclusion') ||
166
+ getValueByPath(settings.data, 'github.copilot.contentExclusion') ||
167
+ null;
168
+
169
+ return exclusions;
170
+ }
171
+
172
+ // ─── Workflow files ───────────────────────────────────────────────────
173
+
174
+ workflowFiles() {
175
+ const dir = path.join(this.dir, '.github', 'workflows');
176
+ return listFiles(dir, f => f.endsWith('.yml') || f.endsWith('.yaml'))
177
+ .map(f => `.github/workflows/${f}`);
178
+ }
179
+
180
+ // ─── Surface detection ────────────────────────────────────────────────
181
+
182
+ /**
183
+ * Detect which Copilot surfaces are configured.
184
+ */
185
+ detectSurfaces() {
186
+ const vscode = Boolean(
187
+ this.fileContent('.vscode/settings.json') ||
188
+ this.fileContent('.vscode/mcp.json')
189
+ );
190
+ const cloudAgent = Boolean(this.cloudAgentConfig());
191
+ const cli = false; // CLI detection is local-only; can't detect from repo files
192
+
193
+ return { vscode, cloudAgent, cli };
194
+ }
195
+
196
+ // ─── Static detection ─────────────────────────────────────────────────
197
+
198
+ static isCopilotRepo(dir) {
199
+ try {
200
+ return fs.existsSync(path.join(dir, '.github', 'copilot-instructions.md')) ||
201
+ fs.existsSync(path.join(dir, '.vscode', 'mcp.json')) ||
202
+ fs.existsSync(path.join(dir, '.github', 'instructions')) ||
203
+ fs.existsSync(path.join(dir, '.github', 'prompts'));
204
+ } catch {
205
+ return false;
206
+ }
207
+ }
208
+
209
+ // ─── Stack detection (reuse shared) ───────────────────────────────────
210
+
211
+ detectStacks(STACKS) {
212
+ return super.detectStacks(STACKS);
213
+ }
214
+ }
215
+
216
+ module.exports = {
217
+ CopilotProjectContext,
218
+ };