@nerviq/cli 1.29.0 → 1.30.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (93) hide show
  1. package/CHANGELOG.md +1764 -1493
  2. package/README.md +568 -538
  3. package/SECURITY.md +78 -82
  4. package/bin/cli.js +2838 -2558
  5. package/docs/api-reference.md +356 -356
  6. package/docs/audit-fix.md +109 -0
  7. package/docs/autofix.md +3 -62
  8. package/docs/getting-started.md +1 -1
  9. package/docs/index.html +592 -592
  10. package/docs/integration-contracts.md +287 -287
  11. package/docs/maintenance.md +128 -128
  12. package/docs/new-platform-guide.md +202 -202
  13. package/docs/release-process.md +63 -0
  14. package/docs/shallow-risk.md +244 -244
  15. package/docs/why-nerviq.md +82 -82
  16. package/package.json +75 -67
  17. package/sdk/README.md +12 -3
  18. package/sdk/examples/langchain-integration.md +128 -0
  19. package/sdk/examples/self-governing-agent.js +135 -0
  20. package/sdk/index.d.ts +115 -0
  21. package/sdk/index.js +94 -0
  22. package/sdk/package.json +11 -0
  23. package/src/activity.js +13 -0
  24. package/src/aider/activity.js +226 -226
  25. package/src/aider/context.js +162 -162
  26. package/src/aider/freshness.js +123 -123
  27. package/src/aider/techniques.js +3465 -3465
  28. package/src/audit/layers.js +180 -180
  29. package/src/audit.js +1133 -1032
  30. package/src/auto-suggest.js +9 -2
  31. package/src/behavioral-drift.js +37 -2
  32. package/src/benchmark.js +299 -299
  33. package/src/codex/activity.js +324 -324
  34. package/src/codex/freshness.js +149 -142
  35. package/src/codex/techniques.js +4895 -4895
  36. package/src/context.js +326 -326
  37. package/src/continuous-ops.js +11 -1
  38. package/src/convert.js +340 -340
  39. package/src/copilot/config-parser.js +280 -280
  40. package/src/copilot/context.js +218 -218
  41. package/src/copilot/freshness.js +184 -177
  42. package/src/copilot/patch.js +238 -238
  43. package/src/copilot/techniques.js +3578 -3578
  44. package/src/cursor/freshness.js +194 -194
  45. package/src/cursor/patch.js +243 -243
  46. package/src/cursor/techniques.js +3735 -3735
  47. package/src/doctor.js +201 -201
  48. package/src/fix-engine.js +511 -8
  49. package/src/formatters/csv.js +86 -86
  50. package/src/formatters/junit.js +123 -123
  51. package/src/formatters/markdown.js +164 -164
  52. package/src/formatters/otel.js +151 -151
  53. package/src/freshness.js +163 -156
  54. package/src/gemini/activity.js +402 -402
  55. package/src/gemini/context.js +290 -290
  56. package/src/gemini/freshness.js +188 -188
  57. package/src/gemini/patch.js +229 -229
  58. package/src/gemini/techniques.js +3811 -3811
  59. package/src/governance.js +533 -533
  60. package/src/harmony/audit.js +306 -306
  61. package/src/i18n.js +63 -63
  62. package/src/insights.js +119 -119
  63. package/src/integrations.js +134 -134
  64. package/src/locales/en.json +33 -33
  65. package/src/locales/es.json +33 -33
  66. package/src/migrate.js +354 -354
  67. package/src/opencode/activity.js +286 -286
  68. package/src/opencode/freshness.js +137 -137
  69. package/src/opencode/techniques.js +3450 -3450
  70. package/src/safe-glyph.js +97 -0
  71. package/src/setup/analysis.js +12 -12
  72. package/src/setup.js +13 -6
  73. package/src/shallow-risk/index.js +113 -56
  74. package/src/shallow-risk/patterns/agent-config-cross-platform-drift.js +51 -50
  75. package/src/shallow-risk/patterns/agent-config-dangerous-autoapprove.js +47 -46
  76. package/src/shallow-risk/patterns/agent-config-deprecated-keys.js +47 -46
  77. package/src/shallow-risk/patterns/agent-config-framework-version-mismatch.js +138 -0
  78. package/src/shallow-risk/patterns/agent-config-missing-file.js +318 -317
  79. package/src/shallow-risk/patterns/agent-config-script-not-in-package-json.js +108 -0
  80. package/src/shallow-risk/patterns/agent-config-secret-literal.js +52 -49
  81. package/src/shallow-risk/patterns/agent-config-stack-contradiction.js +35 -34
  82. package/src/shallow-risk/patterns/hook-script-missing.js +71 -70
  83. package/src/shallow-risk/patterns/mcp-server-no-allowlist.js +53 -52
  84. package/src/shallow-risk/shared.js +653 -648
  85. package/src/source-urls.js +295 -295
  86. package/src/state-paths.js +85 -85
  87. package/src/supplemental-checks.js +805 -805
  88. package/src/telemetry.js +160 -160
  89. package/src/watch.js +46 -0
  90. package/src/windsurf/context.js +359 -359
  91. package/src/windsurf/freshness.js +194 -194
  92. package/src/windsurf/patch.js +231 -231
  93. package/src/windsurf/techniques.js +3779 -3779
@@ -1,32 +1,32 @@
1
- /**
2
- * Gemini Freshness Operationalization
3
- *
4
- * Release gates, recurring probes, propagation checklists,
5
- * and staleness blocking for Gemini CLI surfaces.
6
- */
7
-
8
- const { version } = require('../../package.json');
9
-
10
- /**
11
- * P0 sources that must be fresh before any Gemini release claim.
12
- * Each source has a staleness threshold in days.
13
- * From the watchlist: 62 sources, 18 P0 — main ones listed here.
14
- */
15
- const P0_SOURCES = [
16
- {
17
- key: 'gemini-cli-docs',
18
- label: 'Gemini CLI Official Docs',
19
- url: 'https://google-gemini.github.io/gemini-cli/',
20
- stalenessThresholdDays: 30,
21
- verifiedAt: '2026-04-07',
22
- },
23
- {
24
- key: 'gemini-config-reference',
25
- label: 'Gemini Config Reference',
26
- url: 'https://google-gemini.github.io/gemini-cli/docs/get-started/configuration.html',
27
- stalenessThresholdDays: 30,
28
- verifiedAt: '2026-04-07',
29
- },
1
+ /**
2
+ * Gemini Freshness Operationalization
3
+ *
4
+ * Release gates, recurring probes, propagation checklists,
5
+ * and staleness blocking for Gemini CLI surfaces.
6
+ */
7
+
8
+ const { version } = require('../../package.json');
9
+
10
+ /**
11
+ * P0 sources that must be fresh before any Gemini release claim.
12
+ * Each source has a staleness threshold in days.
13
+ * From the watchlist: 62 sources, 18 P0 — main ones listed here.
14
+ */
15
+ const P0_SOURCES = [
16
+ {
17
+ key: 'gemini-cli-docs',
18
+ label: 'Gemini CLI Official Docs',
19
+ url: 'https://google-gemini.github.io/gemini-cli/',
20
+ stalenessThresholdDays: 30,
21
+ verifiedAt: '2026-04-07',
22
+ },
23
+ {
24
+ key: 'gemini-config-reference',
25
+ label: 'Gemini Config Reference',
26
+ url: 'https://google-gemini.github.io/gemini-cli/docs/get-started/configuration.html',
27
+ stalenessThresholdDays: 30,
28
+ verifiedAt: '2026-04-07',
29
+ },
30
30
  {
31
31
  key: 'gemini-md-guide',
32
32
  label: 'GEMINI.md Guide',
@@ -44,9 +44,9 @@ const P0_SOURCES = [
44
44
  {
45
45
  key: 'gemini-ide-integration-docs',
46
46
  label: 'Gemini IDE Integration',
47
- url: 'https://google-gemini.github.io/gemini-cli/docs/ide-integration.html',
47
+ url: 'https://google-gemini.github.io/gemini-cli/docs/ide-integration/',
48
48
  stalenessThresholdDays: 14,
49
- verifiedAt: '2026-04-10',
49
+ verifiedAt: '2026-04-16',
50
50
  },
51
51
  {
52
52
  key: 'gemini-architecture-docs',
@@ -56,85 +56,85 @@ const P0_SOURCES = [
56
56
  verifiedAt: '2026-04-10',
57
57
  },
58
58
  {
59
- key: 'gemini-hooks-docs',
60
- label: 'Gemini Hooks Documentation',
61
- url: 'https://google-gemini.github.io/gemini-cli/docs/hooks/',
59
+ key: 'gemini-sandbox-docs',
60
+ label: 'Gemini Sandbox Documentation',
61
+ url: 'https://google-gemini.github.io/gemini-cli/docs/cli/sandbox.html',
62
+ stalenessThresholdDays: 30,
63
+ verifiedAt: '2026-04-07',
64
+ },
65
+ {
66
+ key: 'gemini-policy-engine-docs',
67
+ label: 'Gemini Enterprise / Policy Guide',
68
+ url: 'https://google-gemini.github.io/gemini-cli/docs/cli/enterprise.html',
69
+ stalenessThresholdDays: 30,
70
+ verifiedAt: '2026-04-07',
71
+ },
72
+ {
73
+ key: 'gemini-mcp-docs',
74
+ label: 'Gemini MCP Documentation',
75
+ url: 'https://google-gemini.github.io/gemini-cli/docs/tools/mcp-server.html',
62
76
  stalenessThresholdDays: 30,
63
- verifiedAt: '2026-04-07',
64
- },
65
- {
66
- key: 'gemini-sandbox-docs',
67
- label: 'Gemini Sandbox Documentation',
68
- url: 'https://google-gemini.github.io/gemini-cli/docs/cli/sandbox.html',
69
- stalenessThresholdDays: 30,
70
- verifiedAt: '2026-04-07',
71
- },
72
- {
73
- key: 'gemini-policy-engine-docs',
74
- label: 'Gemini Enterprise / Policy Guide',
75
- url: 'https://google-gemini.github.io/gemini-cli/docs/cli/enterprise.html',
76
- stalenessThresholdDays: 30,
77
- verifiedAt: '2026-04-07',
78
- },
79
- {
80
- key: 'gemini-mcp-docs',
81
- label: 'Gemini MCP Documentation',
82
- url: 'https://google-gemini.github.io/gemini-cli/docs/tools/mcp-server.html',
83
- stalenessThresholdDays: 30,
84
- verifiedAt: '2026-04-07',
85
- },
86
- {
87
- key: 'gemini-changelog',
88
- label: 'Gemini CLI Changelog',
89
- url: 'https://github.com/google-gemini/gemini-cli/releases',
90
- stalenessThresholdDays: 14,
91
- verifiedAt: '2026-04-07',
92
- },
93
- {
94
- key: 'gemini-github-action-docs',
95
- label: 'Gemini GitHub Action',
96
- url: 'https://github.com/google-github-actions/run-gemini-cli',
97
- stalenessThresholdDays: 30,
98
- verifiedAt: '2026-04-07',
99
- },
100
- ];
101
-
102
- /**
103
- * Propagation checklist: when a Gemini source changes, these must update.
104
- */
105
- const PROPAGATION_CHECKLIST = [
106
- {
107
- trigger: 'Gemini CLI release with config or sandbox changes',
108
- targets: [
109
- 'src/gemini/techniques.js — update LEGACY patterns, sandbox options, policy syntax',
110
- 'src/gemini/config-parser.js update validation rules',
111
- 'src/gemini/domain-packs.js — update pack projections if schema changed',
112
- 'test/gemini-check-matrix.js — update check expectations',
113
- ],
114
- },
115
- {
116
- trigger: 'New Gemini hook event type added',
117
- targets: [
118
- 'src/gemini/techniques.js — add to SUPPORTED_HOOK_EVENTS',
119
- 'src/gemini/governance.js — add to GEMINI_HOOK_REGISTRY',
120
- 'src/gemini/setup.js — update hooks starter template',
121
- ],
122
- },
123
- {
124
- trigger: 'New Gemini MCP transport or field',
125
- targets: [
126
- 'src/gemini/mcp-packs.js — update pack JSON projections',
127
- 'src/gemini/techniques.js — update MCP checks',
128
- ],
129
- },
130
- {
131
- trigger: 'New sandbox option or isolation mode added',
132
- targets: [
133
- 'src/gemini/techniques.js — update sandbox checks',
134
- 'src/gemini/governance.js — update governance profiles with new sandbox options',
135
- 'src/gemini/setup.js — update sandbox starter template',
136
- ],
137
- },
77
+ verifiedAt: '2026-04-07',
78
+ },
79
+ {
80
+ key: 'gemini-changelog',
81
+ label: 'Gemini CLI Changelog',
82
+ url: 'https://github.com/google-gemini/gemini-cli/releases',
83
+ stalenessThresholdDays: 14,
84
+ verifiedAt: '2026-04-07',
85
+ },
86
+ {
87
+ key: 'gemini-github-action-docs',
88
+ label: 'Gemini GitHub Action',
89
+ url: 'https://github.com/google-github-actions/run-gemini-cli',
90
+ stalenessThresholdDays: 30,
91
+ verifiedAt: '2026-04-07',
92
+ },
93
+ {
94
+ key: 'gemini-models-docs',
95
+ label: 'Google Gemini API Models Overview',
96
+ url: 'https://ai.google.dev/gemini-api/docs/models',
97
+ stalenessThresholdDays: 14,
98
+ verifiedAt: '2026-04-16',
99
+ },
100
+ ];
101
+
102
+ /**
103
+ * Propagation checklist: when a Gemini source changes, these must update.
104
+ */
105
+ const PROPAGATION_CHECKLIST = [
106
+ {
107
+ trigger: 'Gemini CLI release with config or sandbox changes',
108
+ targets: [
109
+ 'src/gemini/techniques.js update LEGACY patterns, sandbox options, policy syntax',
110
+ 'src/gemini/config-parser.js — update validation rules',
111
+ 'src/gemini/domain-packs.js — update pack projections if schema changed',
112
+ 'test/gemini-check-matrix.js — update check expectations',
113
+ ],
114
+ },
115
+ {
116
+ trigger: 'New Gemini hook event type added',
117
+ targets: [
118
+ 'src/gemini/techniques.js — add to SUPPORTED_HOOK_EVENTS',
119
+ 'src/gemini/governance.js add to GEMINI_HOOK_REGISTRY',
120
+ 'src/gemini/setup.js — update hooks starter template',
121
+ ],
122
+ },
123
+ {
124
+ trigger: 'New Gemini MCP transport or field',
125
+ targets: [
126
+ 'src/gemini/mcp-packs.js — update pack JSON projections',
127
+ 'src/gemini/techniques.js — update MCP checks',
128
+ ],
129
+ },
130
+ {
131
+ trigger: 'New sandbox option or isolation mode added',
132
+ targets: [
133
+ 'src/gemini/techniques.js — update sandbox checks',
134
+ 'src/gemini/governance.js — update governance profiles with new sandbox options',
135
+ 'src/gemini/setup.js — update sandbox starter template',
136
+ ],
137
+ },
138
138
  {
139
139
  trigger: 'Policy engine syntax or rule format change',
140
140
  targets: [
@@ -168,82 +168,82 @@ const PROPAGATION_CHECKLIST = [
168
168
  ],
169
169
  },
170
170
  ];
171
-
172
- /**
173
- * Release gate: check if all P0 sources are within staleness threshold.
174
- * Returns { ready, stale, fresh } arrays.
175
- */
176
- function checkReleaseGate(sourceVerifications = {}) {
177
- const now = new Date();
178
- const results = P0_SOURCES.map(source => {
179
- const verifiedAt = sourceVerifications[source.key]
180
- ? new Date(sourceVerifications[source.key])
181
- : source.verifiedAt ? new Date(source.verifiedAt) : null;
182
-
183
- if (!verifiedAt) {
184
- return { ...source, status: 'unverified', daysStale: null };
185
- }
186
-
187
- const daysSince = Math.floor((now - verifiedAt) / (1000 * 60 * 60 * 24));
188
- const isStale = daysSince > source.stalenessThresholdDays;
189
-
190
- return {
191
- ...source,
192
- verifiedAt: verifiedAt.toISOString(),
193
- daysStale: daysSince,
194
- status: isStale ? 'stale' : 'fresh',
195
- };
196
- });
197
-
198
- return {
199
- ready: results.every(r => r.status === 'fresh'),
200
- stale: results.filter(r => r.status === 'stale' || r.status === 'unverified'),
201
- fresh: results.filter(r => r.status === 'fresh'),
202
- results,
203
- };
204
- }
205
-
206
- /**
207
- * Format the release gate results for display.
208
- */
209
- function formatReleaseGate(gateResult) {
210
- const lines = [
211
- `Gemini Freshness Gate (nerviq v${version})`,
212
- '═══════════════════════════════════════',
213
- '',
214
- `Status: ${gateResult.ready ? 'READY' : 'BLOCKED'}`,
215
- `Fresh: ${gateResult.fresh.length}/${gateResult.results.length}`,
216
- '',
217
- ];
218
-
219
- for (const result of gateResult.results) {
220
- const icon = result.status === 'fresh' ? '✓' : result.status === 'stale' ? '✗' : '?';
221
- const age = result.daysStale !== null ? ` (${result.daysStale}d ago)` : ' (unverified)';
222
- lines.push(` ${icon} ${result.label}${age} — threshold: ${result.stalenessThresholdDays}d`);
223
- }
224
-
225
- if (!gateResult.ready) {
226
- lines.push('');
227
- lines.push('Action required: verify stale/unverified sources before claiming release freshness.');
228
- }
229
-
230
- return lines.join('\n');
231
- }
232
-
233
- /**
234
- * Get the propagation checklist for a given trigger.
235
- */
236
- function getPropagationTargets(triggerKeyword) {
237
- const keyword = triggerKeyword.toLowerCase();
238
- return PROPAGATION_CHECKLIST.filter(item =>
239
- item.trigger.toLowerCase().includes(keyword)
240
- );
241
- }
242
-
243
- module.exports = {
244
- P0_SOURCES,
245
- PROPAGATION_CHECKLIST,
246
- checkReleaseGate,
247
- formatReleaseGate,
248
- getPropagationTargets,
249
- };
171
+
172
+ /**
173
+ * Release gate: check if all P0 sources are within staleness threshold.
174
+ * Returns { ready, stale, fresh } arrays.
175
+ */
176
+ function checkReleaseGate(sourceVerifications = {}) {
177
+ const now = new Date();
178
+ const results = P0_SOURCES.map(source => {
179
+ const verifiedAt = sourceVerifications[source.key]
180
+ ? new Date(sourceVerifications[source.key])
181
+ : source.verifiedAt ? new Date(source.verifiedAt) : null;
182
+
183
+ if (!verifiedAt) {
184
+ return { ...source, status: 'unverified', daysStale: null };
185
+ }
186
+
187
+ const daysSince = Math.floor((now - verifiedAt) / (1000 * 60 * 60 * 24));
188
+ const isStale = daysSince > source.stalenessThresholdDays;
189
+
190
+ return {
191
+ ...source,
192
+ verifiedAt: verifiedAt.toISOString(),
193
+ daysStale: daysSince,
194
+ status: isStale ? 'stale' : 'fresh',
195
+ };
196
+ });
197
+
198
+ return {
199
+ ready: results.every(r => r.status === 'fresh'),
200
+ stale: results.filter(r => r.status === 'stale' || r.status === 'unverified'),
201
+ fresh: results.filter(r => r.status === 'fresh'),
202
+ results,
203
+ };
204
+ }
205
+
206
+ /**
207
+ * Format the release gate results for display.
208
+ */
209
+ function formatReleaseGate(gateResult) {
210
+ const lines = [
211
+ `Gemini Freshness Gate (nerviq v${version})`,
212
+ '═══════════════════════════════════════',
213
+ '',
214
+ `Status: ${gateResult.ready ? 'READY' : 'BLOCKED'}`,
215
+ `Fresh: ${gateResult.fresh.length}/${gateResult.results.length}`,
216
+ '',
217
+ ];
218
+
219
+ for (const result of gateResult.results) {
220
+ const icon = result.status === 'fresh' ? '✓' : result.status === 'stale' ? '✗' : '?';
221
+ const age = result.daysStale !== null ? ` (${result.daysStale}d ago)` : ' (unverified)';
222
+ lines.push(` ${icon} ${result.label}${age} — threshold: ${result.stalenessThresholdDays}d`);
223
+ }
224
+
225
+ if (!gateResult.ready) {
226
+ lines.push('');
227
+ lines.push('Action required: verify stale/unverified sources before claiming release freshness.');
228
+ }
229
+
230
+ return lines.join('\n');
231
+ }
232
+
233
+ /**
234
+ * Get the propagation checklist for a given trigger.
235
+ */
236
+ function getPropagationTargets(triggerKeyword) {
237
+ const keyword = triggerKeyword.toLowerCase();
238
+ return PROPAGATION_CHECKLIST.filter(item =>
239
+ item.trigger.toLowerCase().includes(keyword)
240
+ );
241
+ }
242
+
243
+ module.exports = {
244
+ P0_SOURCES,
245
+ PROPAGATION_CHECKLIST,
246
+ checkReleaseGate,
247
+ formatReleaseGate,
248
+ getPropagationTargets,
249
+ };