@neurcode-ai/cli 0.9.44 → 0.9.46

package/README.md

@@ -49,14 +49,17 @@ neurcode brain mode --storage-mode no-code
 neurcode brain doctor "is userid used instead of org id"
 ```
 
-## Enterprise Governance Signing
+## Enterprise Governance Signing (Optional Hardening)
 
 Use signed AI change logs for fail-closed governance in `verify`/`ship`.
 
 ```bash
-# Mandatory signed logs (fail closed when key material is missing)
+# Optional strict mode: require signed logs (fail closed when key material is missing)
 export NEURCODE_GOVERNANCE_REQUIRE_SIGNED_LOGS=1
 
+# Optional: honor org-level signed log requirement from control plane
+export NEURCODE_GOVERNANCE_ENFORCE_ORG_SIGNED_LOG_REQUIREMENT=1
+
 # Single-key mode
 export NEURCODE_GOVERNANCE_SIGNING_KEY="<strong-random-secret>"
 export NEURCODE_GOVERNANCE_SIGNING_KEY_ID="kid-prod-2026-03"
@@ -68,10 +71,11 @@ export NEURCODE_GOVERNANCE_SIGNING_KEY_ID="kid-prod-2026-03"
 
 Notes:
 - `verify` writes and verifies `.neurcode/ai-change-log.json` with integrity chain checks.
-- If signed logs are required and integrity/signature checks fail, `verify` exits non-zero.
+- If strict signed-log mode is enabled and integrity/signature checks fail, `verify` exits non-zero.
 - `ship` will block deployment when required signed AI logs are missing/invalid.
 - `policy compile` and `plan` auto-sign deterministic artifacts when governance signing keys are configured.
 - Use `--require-signed-artifacts` (or `NEURCODE_VERIFY_REQUIRE_SIGNED_ARTIFACTS=1`) to fail closed on unsigned/tampered artifacts.
+- Default onboarding flow is non-blocking unless strict signing is explicitly enabled.
 
 ## Docs
 

package/dist/commands/contract.js

@@ -12,6 +12,7 @@ const policy_packs_1 = require("../utils/policy-packs");
 const policy_compiler_1 = require("../utils/policy-compiler");
 const change_contract_1 = require("../utils/change-contract");
 const artifact_signature_1 = require("../utils/artifact-signature");
+const plan_symbols_1 = require("../utils/plan-symbols");
 let chalk;
 try {
     chalk = require('chalk');
@@ -60,6 +61,49 @@ function parseAsJsonIfPossible(raw) {
 function normalizeProvider(provider) {
     return String(provider || 'generic').trim().toLowerCase();
 }
+function parseBooleanFlag(raw, fallback) {
+    if (!raw || !raw.trim())
+        return fallback;
+    const normalized = raw.trim().toLowerCase();
+    if (normalized === '1' || normalized === 'true' || normalized === 'yes' || normalized === 'on')
+        return true;
+    if (normalized === '0' || normalized === 'false' || normalized === 'no' || normalized === 'off')
+        return false;
+    return fallback;
+}
+function parseNonNegativeInt(raw) {
+    if (!raw || !raw.trim())
+        return undefined;
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed))
+        return undefined;
+    const rounded = Math.floor(parsed);
+    return rounded >= 0 ? rounded : undefined;
+}
+function resolveChangeContractOptionsFromEnv() {
+    const maxUnexpectedFiles = parseNonNegativeInt(process.env.NEURCODE_CHANGE_CONTRACT_MAX_UNEXPECTED_FILES);
+    const maxMissingExpectedSymbols = parseNonNegativeInt(process.env.NEURCODE_CHANGE_CONTRACT_MAX_MISSING_EXPECTED_SYMBOLS);
+    return {
+        enforceExpectedFiles: parseBooleanFlag(process.env.NEURCODE_CHANGE_CONTRACT_ENFORCE_EXPECTED_FILES, false),
+        enforceActionMatching: parseBooleanFlag(process.env.NEURCODE_CHANGE_CONTRACT_ENFORCE_ACTION_MATCHING, true),
+        allowRenameForModify: parseBooleanFlag(process.env.NEURCODE_CHANGE_CONTRACT_ALLOW_RENAME_FOR_MODIFY, true),
+        enforceExpectedSymbols: parseBooleanFlag(process.env.NEURCODE_CHANGE_CONTRACT_ENFORCE_EXPECTED_SYMBOLS, false),
+        enforceSymbolActionMatching: parseBooleanFlag(process.env.NEURCODE_CHANGE_CONTRACT_ENFORCE_SYMBOL_ACTION_MATCHING, false),
+        symbolTypeRelaxedMatching: parseBooleanFlag(process.env.NEURCODE_CHANGE_CONTRACT_SYMBOL_TYPE_RELAXED_MATCHING, true),
+        symbolFileBasenameFallback: parseBooleanFlag(process.env.NEURCODE_CHANGE_CONTRACT_SYMBOL_FILE_BASENAME_FALLBACK, false),
+        ...(maxUnexpectedFiles !== undefined ? { maxUnexpectedFiles } : {}),
+        ...(maxMissingExpectedSymbols !== undefined ? { maxMissingExpectedSymbols } : {}),
+    };
+}
+function mapPlanFilesForChangeContract(files) {
+    return files
+        .map((file) => ({
+        path: file.path,
+        action: file.action,
+        reason: file.reason,
+    }))
+        .filter((file) => typeof file.path === 'string' && file.path.trim().length > 0);
+}
 function normalizeCandidateLimit(value) {
     if (!Number.isFinite(value))
         return 8;
@@ -407,6 +451,9 @@ function contractCommand(program) {
                     projectId: options.projectId || null,
                     intent: options.intent || response.plan.summary || 'imported-plan',
                     expectedFiles,
+                    planFiles: mapPlanFilesForChangeContract(response.plan.files),
+                    expectedSymbols: (0, plan_symbols_1.mapPlanSymbolsForChangeContract)(response.plan),
+                    options: resolveChangeContractOptionsFromEnv(),
                     policyLockFingerprint: policyLock.lock?.effective.fingerprint || null,
                     compiledPolicyFingerprint: compiledPolicy.artifact?.fingerprint || null,
                 });

package/dist/commands/plan.js

@@ -55,6 +55,7 @@ const change_contract_1 = require("../utils/change-contract");
 const policy_packs_1 = require("../utils/policy-packs");
 const policy_compiler_1 = require("../utils/policy-compiler");
 const artifact_signature_1 = require("../utils/artifact-signature");
+const plan_symbols_1 = require("../utils/plan-symbols");
 // Import chalk with fallback for plain strings if not available
 let chalk;
 try {
@@ -591,6 +592,39 @@ function parseBooleanFlag(raw, fallback) {
     }
     return fallback;
 }
+function parseNonNegativeInt(raw) {
+    if (!raw || !raw.trim())
+        return undefined;
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed))
+        return undefined;
+    const rounded = Math.floor(parsed);
+    return rounded >= 0 ? rounded : undefined;
+}
+function resolveChangeContractOptionsFromEnv() {
+    const maxUnexpectedFiles = parseNonNegativeInt(process.env.NEURCODE_CHANGE_CONTRACT_MAX_UNEXPECTED_FILES);
+    const maxMissingExpectedSymbols = parseNonNegativeInt(process.env.NEURCODE_CHANGE_CONTRACT_MAX_MISSING_EXPECTED_SYMBOLS);
+    return {
+        enforceExpectedFiles: parseBooleanFlag(process.env.NEURCODE_CHANGE_CONTRACT_ENFORCE_EXPECTED_FILES, false),
+        enforceActionMatching: parseBooleanFlag(process.env.NEURCODE_CHANGE_CONTRACT_ENFORCE_ACTION_MATCHING, true),
+        allowRenameForModify: parseBooleanFlag(process.env.NEURCODE_CHANGE_CONTRACT_ALLOW_RENAME_FOR_MODIFY, true),
+        enforceExpectedSymbols: parseBooleanFlag(process.env.NEURCODE_CHANGE_CONTRACT_ENFORCE_EXPECTED_SYMBOLS, false),
+        enforceSymbolActionMatching: parseBooleanFlag(process.env.NEURCODE_CHANGE_CONTRACT_ENFORCE_SYMBOL_ACTION_MATCHING, false),
+        symbolTypeRelaxedMatching: parseBooleanFlag(process.env.NEURCODE_CHANGE_CONTRACT_SYMBOL_TYPE_RELAXED_MATCHING, true),
+        symbolFileBasenameFallback: parseBooleanFlag(process.env.NEURCODE_CHANGE_CONTRACT_SYMBOL_FILE_BASENAME_FALLBACK, false),
+        ...(maxUnexpectedFiles !== undefined ? { maxUnexpectedFiles } : {}),
+        ...(maxMissingExpectedSymbols !== undefined ? { maxMissingExpectedSymbols } : {}),
+    };
+}
+function mapPlanFilesForChangeContract(files) {
+    return files
+        .map((file) => ({
+        path: file.path,
+        action: file.action,
+        reason: file.reason,
+    }))
+        .filter((file) => typeof file.path === 'string' && file.path.trim().length > 0);
+}
 function parseConfidenceScoreThreshold(raw) {
     if (!raw)
         return null;
@@ -854,6 +888,9 @@ function emitCachedPlanHit(input) {
                 projectId: input.projectId || null,
                 intent: input.response.plan.summary || 'cached-plan',
                 expectedFiles,
+                planFiles: mapPlanFilesForChangeContract(input.response.plan.files),
+                expectedSymbols: (0, plan_symbols_1.mapPlanSymbolsForChangeContract)(input.response.plan),
+                options: resolveChangeContractOptionsFromEnv(),
                 policyLockFingerprint: lockRead.lock?.effective.fingerprint || null,
                 compiledPolicyFingerprint: compiledPolicyRead.artifact?.fingerprint || null,
             });
@@ -2284,6 +2321,9 @@ async function planCommand(intent, options) {
                     projectId: finalProjectId || null,
                     intent,
                     expectedFiles,
+                    planFiles: mapPlanFilesForChangeContract(response.plan.files),
+                    expectedSymbols: (0, plan_symbols_1.mapPlanSymbolsForChangeContract)(response.plan),
+                    options: resolveChangeContractOptionsFromEnv(),
                     policyLockFingerprint: lockRead.lock?.effective.fingerprint || null,
                     compiledPolicyFingerprint: compiledPolicyRead.artifact?.fingerprint || null,
                 });

package/dist/commands/ship.js

@@ -825,6 +825,15 @@ function isEnabledFlag(value) {
     const normalized = value.trim().toLowerCase();
     return normalized === '1' || normalized === 'true' || normalized === 'yes' || normalized === 'on';
 }
+function isSignedAiLogsRequired(orgGovernance) {
+    const explicitRequirement = isEnabledFlag(process.env.NEURCODE_GOVERNANCE_REQUIRE_SIGNED_LOGS) ||
+        isEnabledFlag(process.env.NEURCODE_AI_LOG_REQUIRE_SIGNED);
+    if (explicitRequirement) {
+        return true;
+    }
+    const honorOrgRequirement = isEnabledFlag(process.env.NEURCODE_GOVERNANCE_ENFORCE_ORG_SIGNED_LOG_REQUIREMENT);
+    return honorOrgRequirement && orgGovernance?.requireSignedAiLogs === true;
+}
 function collectApplyWrittenFiles(output) {
     const clean = stripAnsi(output);
     const files = [];
@@ -1846,9 +1855,7 @@ async function shipCommand(goal, options) {
     const manualApprovalBypass = options.manualApproveHighRisk === true || process.env.NEURCODE_MANUAL_APPROVE_HIGH_RISK === '1';
     const governanceDecision = finalVerifyPayload.governanceDecision?.decision;
     const orgGovernance = finalVerifyPayload.orgGovernance || null;
-    const signedAiLogsRequired = orgGovernance?.requireSignedAiLogs === true ||
-        isEnabledFlag(process.env.NEURCODE_GOVERNANCE_REQUIRE_SIGNED_LOGS) ||
-        isEnabledFlag(process.env.NEURCODE_AI_LOG_REQUIRE_SIGNED);
+    const signedAiLogsRequired = isSignedAiLogsRequired(orgGovernance);
     const aiLogIntegrity = finalVerifyPayload.aiChangeLog?.integrity;
     const signedAiLogsValid = aiLogIntegrity?.valid === true && aiLogIntegrity?.signed === true;
     const orgManualApprovalRequired = orgGovernance?.requireManualApproval === true;

package/dist/commands/verify.d.ts

@@ -37,6 +37,8 @@ interface VerifyOptions {
     runtimeGuard?: string;
     /** Print detailed AI change justification reasoning. */
     explain?: boolean;
+    /** Print extra explanatory output for demos/onboarding. */
+    demo?: boolean;
     /** Use queue-backed async verification mode on the API. */
     asyncMode?: boolean;
     /** Poll interval for async verification job status. */