@nerviq/cli 1.29.0 → 1.30.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (93) hide show
  1. package/CHANGELOG.md +1764 -1493
  2. package/README.md +568 -538
  3. package/SECURITY.md +78 -82
  4. package/bin/cli.js +2838 -2558
  5. package/docs/api-reference.md +356 -356
  6. package/docs/audit-fix.md +109 -0
  7. package/docs/autofix.md +3 -62
  8. package/docs/getting-started.md +1 -1
  9. package/docs/index.html +592 -592
  10. package/docs/integration-contracts.md +287 -287
  11. package/docs/maintenance.md +128 -128
  12. package/docs/new-platform-guide.md +202 -202
  13. package/docs/release-process.md +63 -0
  14. package/docs/shallow-risk.md +244 -244
  15. package/docs/why-nerviq.md +82 -82
  16. package/package.json +75 -67
  17. package/sdk/README.md +12 -3
  18. package/sdk/examples/langchain-integration.md +128 -0
  19. package/sdk/examples/self-governing-agent.js +135 -0
  20. package/sdk/index.d.ts +115 -0
  21. package/sdk/index.js +94 -0
  22. package/sdk/package.json +11 -0
  23. package/src/activity.js +13 -0
  24. package/src/aider/activity.js +226 -226
  25. package/src/aider/context.js +162 -162
  26. package/src/aider/freshness.js +123 -123
  27. package/src/aider/techniques.js +3465 -3465
  28. package/src/audit/layers.js +180 -180
  29. package/src/audit.js +1133 -1032
  30. package/src/auto-suggest.js +9 -2
  31. package/src/behavioral-drift.js +37 -2
  32. package/src/benchmark.js +299 -299
  33. package/src/codex/activity.js +324 -324
  34. package/src/codex/freshness.js +149 -142
  35. package/src/codex/techniques.js +4895 -4895
  36. package/src/context.js +326 -326
  37. package/src/continuous-ops.js +11 -1
  38. package/src/convert.js +340 -340
  39. package/src/copilot/config-parser.js +280 -280
  40. package/src/copilot/context.js +218 -218
  41. package/src/copilot/freshness.js +184 -177
  42. package/src/copilot/patch.js +238 -238
  43. package/src/copilot/techniques.js +3578 -3578
  44. package/src/cursor/freshness.js +194 -194
  45. package/src/cursor/patch.js +243 -243
  46. package/src/cursor/techniques.js +3735 -3735
  47. package/src/doctor.js +201 -201
  48. package/src/fix-engine.js +511 -8
  49. package/src/formatters/csv.js +86 -86
  50. package/src/formatters/junit.js +123 -123
  51. package/src/formatters/markdown.js +164 -164
  52. package/src/formatters/otel.js +151 -151
  53. package/src/freshness.js +163 -156
  54. package/src/gemini/activity.js +402 -402
  55. package/src/gemini/context.js +290 -290
  56. package/src/gemini/freshness.js +188 -188
  57. package/src/gemini/patch.js +229 -229
  58. package/src/gemini/techniques.js +3811 -3811
  59. package/src/governance.js +533 -533
  60. package/src/harmony/audit.js +306 -306
  61. package/src/i18n.js +63 -63
  62. package/src/insights.js +119 -119
  63. package/src/integrations.js +134 -134
  64. package/src/locales/en.json +33 -33
  65. package/src/locales/es.json +33 -33
  66. package/src/migrate.js +354 -354
  67. package/src/opencode/activity.js +286 -286
  68. package/src/opencode/freshness.js +137 -137
  69. package/src/opencode/techniques.js +3450 -3450
  70. package/src/safe-glyph.js +97 -0
  71. package/src/setup/analysis.js +12 -12
  72. package/src/setup.js +13 -6
  73. package/src/shallow-risk/index.js +113 -56
  74. package/src/shallow-risk/patterns/agent-config-cross-platform-drift.js +51 -50
  75. package/src/shallow-risk/patterns/agent-config-dangerous-autoapprove.js +47 -46
  76. package/src/shallow-risk/patterns/agent-config-deprecated-keys.js +47 -46
  77. package/src/shallow-risk/patterns/agent-config-framework-version-mismatch.js +138 -0
  78. package/src/shallow-risk/patterns/agent-config-missing-file.js +318 -317
  79. package/src/shallow-risk/patterns/agent-config-script-not-in-package-json.js +108 -0
  80. package/src/shallow-risk/patterns/agent-config-secret-literal.js +52 -49
  81. package/src/shallow-risk/patterns/agent-config-stack-contradiction.js +35 -34
  82. package/src/shallow-risk/patterns/hook-script-missing.js +71 -70
  83. package/src/shallow-risk/patterns/mcp-server-no-allowlist.js +53 -52
  84. package/src/shallow-risk/shared.js +653 -648
  85. package/src/source-urls.js +295 -295
  86. package/src/state-paths.js +85 -85
  87. package/src/supplemental-checks.js +805 -805
  88. package/src/telemetry.js +160 -160
  89. package/src/watch.js +46 -0
  90. package/src/windsurf/context.js +359 -359
  91. package/src/windsurf/freshness.js +194 -194
  92. package/src/windsurf/patch.js +231 -231
  93. package/src/windsurf/techniques.js +3779 -3779
@@ -1,238 +1,238 @@
1
- /**
2
- * Copilot Patch Intelligence
3
- *
4
- * Safe patching of existing Copilot files using managed blocks.
5
- * Supports copilot-instructions.md (HTML comment blocks) and
6
- * .vscode/settings.json + .vscode/mcp.json (JSON merge).
7
- *
8
- * Managed blocks are sections that nerviq controls.
9
- * Hand-authored content outside managed blocks is preserved.
10
- */
11
-
12
- const fs = require('fs');
13
- const path = require('path');
14
- const { writeRollbackArtifact, writeActivityArtifact } = require('../activity');
15
-
16
- // Managed block markers for Markdown
17
- const MANAGED_START_MD = '<!-- nerviq:managed:start -->';
18
- const MANAGED_END_MD = '<!-- nerviq:managed:end -->';
19
- const MANAGED_JSON_KEY = '_nerviq_managed';
20
-
21
- /**
22
- * Extract managed blocks from a file.
23
- */
24
- function extractManagedBlock(content, startMarker, endMarker) {
25
- const startIdx = content.indexOf(startMarker);
26
- const endIdx = content.indexOf(endMarker);
27
-
28
- if (startIdx === -1 || endIdx === -1 || endIdx <= startIdx) {
29
- return { before: content, managed: null, after: '' };
30
- }
31
-
32
- return {
33
- before: content.substring(0, startIdx),
34
- managed: content.substring(startIdx + startMarker.length, endIdx).trim(),
35
- after: content.substring(endIdx + endMarker.length),
36
- };
37
- }
38
-
39
- /**
40
- * Replace or insert a managed block in a file.
41
- */
42
- function upsertManagedBlock(content, newManaged, startMarker, endMarker) {
43
- const { before, managed, after } = extractManagedBlock(content, startMarker, endMarker);
44
-
45
- if (managed !== null) {
46
- return `${before}${startMarker}\n${newManaged}\n${endMarker}${after}`;
47
- }
48
-
49
- const separator = content.endsWith('\n') ? '\n' : '\n\n';
50
- return `${content}${separator}${startMarker}\n${newManaged}\n${endMarker}\n`;
51
- }
52
-
53
- /**
54
- * Patch copilot-instructions.md with managed sections.
55
- */
56
- function patchCopilotInstructionsMd(existingContent, managedSections) {
57
- const newManaged = Object.entries(managedSections)
58
- .map(([section, content]) => `## ${section}\n${content}`)
59
- .join('\n\n');
60
-
61
- return upsertManagedBlock(existingContent, newManaged, MANAGED_START_MD, MANAGED_END_MD);
62
- }
63
-
64
- /**
65
- * Patch .vscode/settings.json by safely merging new keys.
66
- * Only adds new keys or updates the _nerviq_managed namespace.
67
- */
68
- function patchVscodeSettingsJson(existingContent, newKeys) {
69
- let existing;
70
- try {
71
- existing = JSON.parse(existingContent);
72
- } catch {
73
- existing = {};
74
- }
75
-
76
- const merged = { ...existing };
77
-
78
- for (const [key, value] of Object.entries(newKeys)) {
79
- if (key === MANAGED_JSON_KEY) {
80
- merged[MANAGED_JSON_KEY] = { ...(existing[MANAGED_JSON_KEY] || {}), ...value };
81
- } else if (!(key in existing)) {
82
- merged[key] = value;
83
- }
84
- }
85
-
86
- if (!merged[MANAGED_JSON_KEY]) merged[MANAGED_JSON_KEY] = {};
87
- merged[MANAGED_JSON_KEY]._updatedAt = new Date().toISOString();
88
- merged[MANAGED_JSON_KEY]._generator = nerviq;
89
- merged[MANAGED_JSON_KEY]._platform = 'copilot';
90
-
91
- return JSON.stringify(merged, null, 2) + '\n';
92
- }
93
-
94
- /**
95
- * Patch .vscode/mcp.json by safely merging new servers.
96
- * Copilot MCP uses the "servers" wrapper format.
97
- */
98
- function patchMcpJson(existingContent, newServers) {
99
- let existing;
100
- try {
101
- existing = JSON.parse(existingContent);
102
- } catch {
103
- existing = {};
104
- }
105
-
106
- if (!existing.servers) existing.servers = {};
107
-
108
- const merged = { ...existing };
109
- for (const [serverName, config] of Object.entries(newServers)) {
110
- if (!(serverName in merged.servers)) {
111
- merged.servers[serverName] = config;
112
- }
113
- }
114
-
115
- if (!merged[MANAGED_JSON_KEY]) merged[MANAGED_JSON_KEY] = {};
116
- merged[MANAGED_JSON_KEY]._updatedAt = new Date().toISOString();
117
- merged[MANAGED_JSON_KEY]._generator = nerviq;
118
-
119
- return JSON.stringify(merged, null, 2) + '\n';
120
- }
121
-
122
- /**
123
- * Detect if a repo has multiple agent surfaces (Copilot + Claude + Codex + Gemini coexistence).
124
- */
125
- function detectMixedAgentRepo(dir) {
126
- const hasClaude = fs.existsSync(path.join(dir, 'CLAUDE.md')) || fs.existsSync(path.join(dir, '.claude'));
127
- const hasCodex = fs.existsSync(path.join(dir, 'AGENTS.md')) || fs.existsSync(path.join(dir, '.codex'));
128
- const hasGemini = fs.existsSync(path.join(dir, 'GEMINI.md')) || fs.existsSync(path.join(dir, '.gemini'));
129
- const hasCopilot = fs.existsSync(path.join(dir, '.github', 'copilot-instructions.md')) ||
130
- fs.existsSync(path.join(dir, '.vscode', 'mcp.json'));
131
-
132
- const platforms = [];
133
- if (hasClaude) platforms.push('claude');
134
- if (hasCodex) platforms.push('codex');
135
- if (hasGemini) platforms.push('gemini');
136
- if (hasCopilot) platforms.push('copilot');
137
-
138
- return {
139
- isMixed: platforms.length >= 2,
140
- hasClaude,
141
- hasCodex,
142
- hasGemini,
143
- hasCopilot,
144
- platforms,
145
- guidance: platforms.length >= 2
146
- ? `This is a mixed-agent repo (${platforms.join(', ')}). Keep each platform's instructions in its own file (CLAUDE.md, AGENTS.md, GEMINI.md, copilot-instructions.md). Do not merge them.`
147
- : null,
148
- };
149
- }
150
-
151
- /**
152
- * Generate a diff preview for a patch operation.
153
- */
154
- function generatePatchPreview(originalContent, patchedContent, filePath) {
155
- const origLines = originalContent.split('\n');
156
- const patchLines = patchedContent.split('\n');
157
- const lines = [`--- ${filePath} (original)`, `+++ ${filePath} (patched)`];
158
-
159
- let inChange = false;
160
- for (let i = 0; i < Math.max(origLines.length, patchLines.length); i++) {
161
- const orig = origLines[i] || '';
162
- const patched = patchLines[i] || '';
163
- if (orig !== patched) {
164
- if (!inChange) { lines.push(`@@ line ${i + 1} @@`); inChange = true; }
165
- if (i < origLines.length) lines.push(`-${orig}`);
166
- if (i < patchLines.length) lines.push(`+${patched}`);
167
- } else {
168
- inChange = false;
169
- }
170
- }
171
-
172
- return lines.join('\n');
173
- }
174
-
175
- /**
176
- * Apply a patch to a file with backup and rollback support.
177
- */
178
- function applyPatch(dir, filePath, patchFn, options = {}) {
179
- const fullPath = path.join(dir, filePath);
180
- const dryRun = options.dryRun === true;
181
-
182
- if (!fs.existsSync(fullPath)) {
183
- return { success: false, reason: `${filePath} does not exist`, preview: null };
184
- }
185
-
186
- const original = fs.readFileSync(fullPath, 'utf8');
187
- const patched = patchFn(original);
188
-
189
- if (patched === original) {
190
- return { success: true, reason: 'no changes needed', preview: null, unchanged: true };
191
- }
192
-
193
- const preview = generatePatchPreview(original, patched, filePath);
194
-
195
- if (dryRun) {
196
- return { success: true, reason: 'dry run', preview, unchanged: false };
197
- }
198
-
199
- const backupPath = fullPath + '.nerviq-backup';
200
- fs.writeFileSync(backupPath, original, 'utf8');
201
- fs.writeFileSync(fullPath, patched, 'utf8');
202
-
203
- const rollback = writeRollbackArtifact(dir, {
204
- sourcePlan: 'copilot-patch',
205
- patchedFiles: [filePath],
206
- backupFiles: [{ original: filePath, backup: path.relative(dir, backupPath) }],
207
- rollbackInstructions: [`Restore ${filePath} from ${path.relative(dir, backupPath)}`],
208
- });
209
-
210
- const activity = writeActivityArtifact(dir, 'copilot-patch', {
211
- platform: 'copilot',
212
- patchedFiles: [filePath],
213
- rollbackArtifact: rollback.relativePath,
214
- });
215
-
216
- return {
217
- success: true,
218
- reason: 'patched',
219
- preview,
220
- unchanged: false,
221
- rollbackArtifact: rollback.relativePath,
222
- activityArtifact: activity.relativePath,
223
- };
224
- }
225
-
226
- module.exports = {
227
- MANAGED_START_MD,
228
- MANAGED_END_MD,
229
- MANAGED_JSON_KEY,
230
- extractManagedBlock,
231
- upsertManagedBlock,
232
- patchCopilotInstructionsMd,
233
- patchVscodeSettingsJson,
234
- patchMcpJson,
235
- detectMixedAgentRepo,
236
- generatePatchPreview,
237
- applyPatch,
238
- };
1
+ /**
2
+ * Copilot Patch Intelligence
3
+ *
4
+ * Safe patching of existing Copilot files using managed blocks.
5
+ * Supports copilot-instructions.md (HTML comment blocks) and
6
+ * .vscode/settings.json + .vscode/mcp.json (JSON merge).
7
+ *
8
+ * Managed blocks are sections that nerviq controls.
9
+ * Hand-authored content outside managed blocks is preserved.
10
+ */
11
+
12
+ const fs = require('fs');
13
+ const path = require('path');
14
+ const { writeRollbackArtifact, writeActivityArtifact } = require('../activity');
15
+
16
+ // Managed block markers for Markdown
17
+ const MANAGED_START_MD = '<!-- nerviq:managed:start -->';
18
+ const MANAGED_END_MD = '<!-- nerviq:managed:end -->';
19
+ const MANAGED_JSON_KEY = '_nerviq_managed';
20
+
21
+ /**
22
+ * Extract managed blocks from a file.
23
+ */
24
+ function extractManagedBlock(content, startMarker, endMarker) {
25
+ const startIdx = content.indexOf(startMarker);
26
+ const endIdx = content.indexOf(endMarker);
27
+
28
+ if (startIdx === -1 || endIdx === -1 || endIdx <= startIdx) {
29
+ return { before: content, managed: null, after: '' };
30
+ }
31
+
32
+ return {
33
+ before: content.substring(0, startIdx),
34
+ managed: content.substring(startIdx + startMarker.length, endIdx).trim(),
35
+ after: content.substring(endIdx + endMarker.length),
36
+ };
37
+ }
38
+
39
+ /**
40
+ * Replace or insert a managed block in a file.
41
+ */
42
+ function upsertManagedBlock(content, newManaged, startMarker, endMarker) {
43
+ const { before, managed, after } = extractManagedBlock(content, startMarker, endMarker);
44
+
45
+ if (managed !== null) {
46
+ return `${before}${startMarker}\n${newManaged}\n${endMarker}${after}`;
47
+ }
48
+
49
+ const separator = content.endsWith('\n') ? '\n' : '\n\n';
50
+ return `${content}${separator}${startMarker}\n${newManaged}\n${endMarker}\n`;
51
+ }
52
+
53
+ /**
54
+ * Patch copilot-instructions.md with managed sections.
55
+ */
56
+ function patchCopilotInstructionsMd(existingContent, managedSections) {
57
+ const newManaged = Object.entries(managedSections)
58
+ .map(([section, content]) => `## ${section}\n${content}`)
59
+ .join('\n\n');
60
+
61
+ return upsertManagedBlock(existingContent, newManaged, MANAGED_START_MD, MANAGED_END_MD);
62
+ }
63
+
64
+ /**
65
+ * Patch .vscode/settings.json by safely merging new keys.
66
+ * Only adds new keys or updates the _nerviq_managed namespace.
67
+ */
68
+ function patchVscodeSettingsJson(existingContent, newKeys) {
69
+ let existing;
70
+ try {
71
+ existing = JSON.parse(existingContent);
72
+ } catch {
73
+ existing = {};
74
+ }
75
+
76
+ const merged = { ...existing };
77
+
78
+ for (const [key, value] of Object.entries(newKeys)) {
79
+ if (key === MANAGED_JSON_KEY) {
80
+ merged[MANAGED_JSON_KEY] = { ...(existing[MANAGED_JSON_KEY] || {}), ...value };
81
+ } else if (!(key in existing)) {
82
+ merged[key] = value;
83
+ }
84
+ }
85
+
86
+ if (!merged[MANAGED_JSON_KEY]) merged[MANAGED_JSON_KEY] = {};
87
+ merged[MANAGED_JSON_KEY]._updatedAt = new Date().toISOString();
88
+ merged[MANAGED_JSON_KEY]._generator = nerviq;
89
+ merged[MANAGED_JSON_KEY]._platform = 'copilot';
90
+
91
+ return JSON.stringify(merged, null, 2) + '\n';
92
+ }
93
+
94
+ /**
95
+ * Patch .vscode/mcp.json by safely merging new servers.
96
+ * Copilot MCP uses the "servers" wrapper format.
97
+ */
98
+ function patchMcpJson(existingContent, newServers) {
99
+ let existing;
100
+ try {
101
+ existing = JSON.parse(existingContent);
102
+ } catch {
103
+ existing = {};
104
+ }
105
+
106
+ if (!existing.servers) existing.servers = {};
107
+
108
+ const merged = { ...existing };
109
+ for (const [serverName, config] of Object.entries(newServers)) {
110
+ if (!(serverName in merged.servers)) {
111
+ merged.servers[serverName] = config;
112
+ }
113
+ }
114
+
115
+ if (!merged[MANAGED_JSON_KEY]) merged[MANAGED_JSON_KEY] = {};
116
+ merged[MANAGED_JSON_KEY]._updatedAt = new Date().toISOString();
117
+ merged[MANAGED_JSON_KEY]._generator = nerviq;
118
+
119
+ return JSON.stringify(merged, null, 2) + '\n';
120
+ }
121
+
122
+ /**
123
+ * Detect if a repo has multiple agent surfaces (Copilot + Claude + Codex + Gemini coexistence).
124
+ */
125
+ function detectMixedAgentRepo(dir) {
126
+ const hasClaude = fs.existsSync(path.join(dir, 'CLAUDE.md')) || fs.existsSync(path.join(dir, '.claude'));
127
+ const hasCodex = fs.existsSync(path.join(dir, 'AGENTS.md')) || fs.existsSync(path.join(dir, '.codex'));
128
+ const hasGemini = fs.existsSync(path.join(dir, 'GEMINI.md')) || fs.existsSync(path.join(dir, '.gemini'));
129
+ const hasCopilot = fs.existsSync(path.join(dir, '.github', 'copilot-instructions.md')) ||
130
+ fs.existsSync(path.join(dir, '.vscode', 'mcp.json'));
131
+
132
+ const platforms = [];
133
+ if (hasClaude) platforms.push('claude');
134
+ if (hasCodex) platforms.push('codex');
135
+ if (hasGemini) platforms.push('gemini');
136
+ if (hasCopilot) platforms.push('copilot');
137
+
138
+ return {
139
+ isMixed: platforms.length >= 2,
140
+ hasClaude,
141
+ hasCodex,
142
+ hasGemini,
143
+ hasCopilot,
144
+ platforms,
145
+ guidance: platforms.length >= 2
146
+ ? `This is a mixed-agent repo (${platforms.join(', ')}). Keep each platform's instructions in its own file (CLAUDE.md, AGENTS.md, GEMINI.md, copilot-instructions.md). Do not merge them.`
147
+ : null,
148
+ };
149
+ }
150
+
151
+ /**
152
+ * Generate a diff preview for a patch operation.
153
+ */
154
+ function generatePatchPreview(originalContent, patchedContent, filePath) {
155
+ const origLines = originalContent.split('\n');
156
+ const patchLines = patchedContent.split('\n');
157
+ const lines = [`--- ${filePath} (original)`, `+++ ${filePath} (patched)`];
158
+
159
+ let inChange = false;
160
+ for (let i = 0; i < Math.max(origLines.length, patchLines.length); i++) {
161
+ const orig = origLines[i] || '';
162
+ const patched = patchLines[i] || '';
163
+ if (orig !== patched) {
164
+ if (!inChange) { lines.push(`@@ line ${i + 1} @@`); inChange = true; }
165
+ if (i < origLines.length) lines.push(`-${orig}`);
166
+ if (i < patchLines.length) lines.push(`+${patched}`);
167
+ } else {
168
+ inChange = false;
169
+ }
170
+ }
171
+
172
+ return lines.join('\n');
173
+ }
174
+
175
+ /**
176
+ * Apply a patch to a file with backup and rollback support.
177
+ */
178
+ function applyPatch(dir, filePath, patchFn, options = {}) {
179
+ const fullPath = path.join(dir, filePath);
180
+ const dryRun = options.dryRun === true;
181
+
182
+ if (!fs.existsSync(fullPath)) {
183
+ return { success: false, reason: `${filePath} does not exist`, preview: null };
184
+ }
185
+
186
+ const original = fs.readFileSync(fullPath, 'utf8');
187
+ const patched = patchFn(original);
188
+
189
+ if (patched === original) {
190
+ return { success: true, reason: 'no changes needed', preview: null, unchanged: true };
191
+ }
192
+
193
+ const preview = generatePatchPreview(original, patched, filePath);
194
+
195
+ if (dryRun) {
196
+ return { success: true, reason: 'dry run', preview, unchanged: false };
197
+ }
198
+
199
+ const backupPath = fullPath + '.nerviq-backup';
200
+ fs.writeFileSync(backupPath, original, 'utf8');
201
+ fs.writeFileSync(fullPath, patched, 'utf8');
202
+
203
+ const rollback = writeRollbackArtifact(dir, {
204
+ sourcePlan: 'copilot-patch',
205
+ patchedFiles: [filePath],
206
+ backupFiles: [{ original: filePath, backup: path.relative(dir, backupPath) }],
207
+ rollbackInstructions: [`Restore ${filePath} from ${path.relative(dir, backupPath)}`],
208
+ });
209
+
210
+ const activity = writeActivityArtifact(dir, 'copilot-patch', {
211
+ platform: 'copilot',
212
+ patchedFiles: [filePath],
213
+ rollbackArtifact: rollback.relativePath,
214
+ });
215
+
216
+ return {
217
+ success: true,
218
+ reason: 'patched',
219
+ preview,
220
+ unchanged: false,
221
+ rollbackArtifact: rollback.relativePath,
222
+ activityArtifact: activity.relativePath,
223
+ };
224
+ }
225
+
226
+ module.exports = {
227
+ MANAGED_START_MD,
228
+ MANAGED_END_MD,
229
+ MANAGED_JSON_KEY,
230
+ extractManagedBlock,
231
+ upsertManagedBlock,
232
+ patchCopilotInstructionsMd,
233
+ patchVscodeSettingsJson,
234
+ patchMcpJson,
235
+ detectMixedAgentRepo,
236
+ generatePatchPreview,
237
+ applyPatch,
238
+ };