@ornexus/neocortex 4.60.66 → 4.60.68

package/packages/client/dist/commands/architecture-non-ui-continuation.js

@@ -1 +1,100 @@
-import{isDeepStrictEqual as d}from"node:util";import{ARCHITECTURE_NON_UI_COMMANDS as R,ARCHITECTURE_PUBLIC_COMMANDS as A,parseArchitectureNonUiScopeReceipt as y}from"./shared-architecture-non-ui.js";const a=e=>!!e&&typeof e=="object"&&!Array.isArray(e),r=R;function C(e){const t=y(e.nonUiScopeReceipt);return t&&t.targetEpicId===e.targetEpicId&&t.graphRevision===e.graphRevision&&a(e.accounting)&&t.accountingId===e.accounting.accountingId&&a(e.evidenceExpectation)&&t.rootInputSha256===e.evidenceExpectation.inputHash?t:void 0}function D(e){if(e.nonUiScopeReceipt===void 0)return A.length-1;if(!C(e))throw new Error("architecture-non-ui-scope-invalid");return r.length-1}function f(e,t,c,n){return Array.isArray(e)&&e.length===t&&e.every((i,o)=>a(i)&&i.targetEpicId===c&&i.stageCommand===r[o]&&a(i.completionEvidence)&&a(i.validationEvidence)&&i.completionEvidence.stageCommand===i.stageCommand&&i.completionEvidence.status==="succeeded"&&i.validationEvidence.stageCommand===i.stageCommand&&i.validationEvidence.status==="passed"&&i.completionEvidence.targetEpicId===c&&i.validationEvidence.targetEpicId===c&&i.completionEvidence.artifactHash===i.validationEvidence.artifactHash&&a(i.validationEvidence.isolated)&&a(i.validationEvidence.regression)&&i.validationEvidence.isolated.graphHash===n&&i.validationEvidence.regression.graphHash===n)}function H(e){const t=e.reviewDecision,c=e.completionEvidence,n=e.validationEvidence;return a(t)&&a(c)&&a(n)&&t.schemaVersion==="ArchitectureReviewDecision/1"&&t.decision==="approved"&&t.targetEpicId===e.targetEpicId&&t.graphRevision===e.graphRevision&&t.artifactHash===c.artifactHash&&t.artifactHash===n.artifactHash&&t.completionReceiptId===c.receiptId&&t.validationReceiptId===n.receiptId}function O(e,t,c=!1){const n=t.checkpoint;if(!a(n))return;const i=C(n);if(!i||i.targetEpicId!==e.targetEpicId||i.graphRevision!==e.graphRevision||!a(e.evidenceExpectation)||i.rootInputSha256!==e.evidenceExpectation.inputHash||!a(e.accounting)||i.accountingId!==e.accounting.accountingId||e.nonUiScopeReceipt!==void 0&&!d(e.nonUiScopeReceipt,i))return;const o=e.acceptedStages,s=n.acceptedStages,l=r.indexOf(String(e.currentStageCommand)),p=e.targetEpicId,u=e.graphRevision,g=S=>d(n[S],e[S]),h=e.childStatus===void 0&&e.completionEvidence===void 0&&e.validationEvidence===void 0,E=n.childStatus===void 0&&n.completionEvidence===void 0&&n.validationEvidence===void 0;if(e.currentStageCommand==="arch-design-system"&&e.continuationState==="advance"&&h&&E&&n.currentStageCommand==="arch-performance"&&n.continuationState==="advance"&&t.nextAction==="resume"&&f(o,r.indexOf("arch-performance"),p,u)&&d(s,o))return"advance";if(l<r.indexOf("arch-security")||e.nonUiScopeReceipt===void 0&&e.currentStageCommand!=="arch-security")return;if(e.continuationState==="complete"&&e.currentStageCommand==="update-memory"&&n.continuationState==="complete"&&n.currentStageCommand==="update-memory"&&t.nextAction==="complete"&&f(o,r.length,p,u)&&d(s,o)&&["childStatus","completionEvidence","validationEvidence","reviewDecision","terminalMemoryCheckpoint"].every(g)&&c)return"complete-replay";if(!f(o,l,p,u))return;if(h&&E&&["advance","delegate"].includes(String(e.continuationState))&&n.currentStageCommand===e.currentStageCommand&&n.continuationState==="delegate"&&t.nextAction==="delegate"&&d(s,o)&&g("reviewDecision"))return"delegate";const m=e.completionEvidence,v=e.validationEvidence;if(e.childStatus!=="succeeded"||!a(m)||!a(v)||m.status!=="succeeded"||v.status!=="passed"||m.stageCommand!==e.currentStageCommand||v.stageCommand!==e.currentStageCommand||m.targetEpicId!==p||v.targetEpicId!==p||m.artifactHash!==v.artifactHash)return;if(e.currentStageCommand==="arch-review"&&!H(e))return n.currentStageCommand==="arch-review"&&n.continuationState==="ask-user"&&t.nextAction==="ask-user"&&d(s,o)&&["childStatus","completionEvidence","validationEvidence"].every(g)&&d(n.questionIds,["ARCH-REVIEW-A09-APPROVAL"])&&e.reviewDecision===void 0?"ask-user":void 0;if(e.currentStageCommand==="arch-review"&&(e.continuationState!=="ask-user"||!d(e.questionIds,["ARCH-REVIEW-A09-APPROVAL"])))return;const I=[...o,{targetEpicId:p,stageCommand:e.currentStageCommand,completionEvidence:m,validationEvidence:v}];if(!(!d(s,I)||!g("reviewDecision"))){if(e.currentStageCommand==="update-memory")return n.currentStageCommand==="update-memory"&&n.continuationState==="complete"&&t.nextAction==="complete"&&["childStatus","completionEvidence","validationEvidence","terminalMemoryCheckpoint"].every(g)&&c?"complete":void 0;if(E&&n.currentStageCommand===r[l+1]&&n.continuationState==="advance"&&t.nextAction==="resume")return"advance"}}export{D as architectureMemoryPredecessorCount,O as classifyNonUiArchitectureTransition};
+/** Closed client projection. Signature authenticity remains a server-only check. */
+import { isDeepStrictEqual } from 'node:util';
+import { ARCHITECTURE_NON_UI_COMMANDS, ARCHITECTURE_PUBLIC_COMMANDS, parseArchitectureNonUiScopeReceipt } from './shared-architecture-non-ui.js';
+const obj = (x) => !!x && typeof x === 'object' && !Array.isArray(x);
+const commands = ARCHITECTURE_NON_UI_COMMANDS;
+function boundScope(execution) {
+    const scope = parseArchitectureNonUiScopeReceipt(execution.nonUiScopeReceipt);
+    return scope && scope.targetEpicId === execution.targetEpicId && scope.graphRevision === execution.graphRevision
+        && obj(execution.accounting) && scope.accountingId === execution.accounting.accountingId
+        && obj(execution.evidenceExpectation) && scope.rootInputSha256 === execution.evidenceExpectation.inputHash ? scope : undefined;
+}
+export function architectureMemoryPredecessorCount(execution) {
+    if (execution.nonUiScopeReceipt === undefined)
+        return ARCHITECTURE_PUBLIC_COMMANDS.length - 1;
+    if (!boundScope(execution))
+        throw new Error('architecture-non-ui-scope-invalid');
+    return commands.length - 1;
+}
+function prefix(rows, n, target, graph) {
+    return Array.isArray(rows) && rows.length === n && rows.every((r, i) => obj(r) && r.targetEpicId === target && r.stageCommand === commands[i]
+        && obj(r.completionEvidence) && obj(r.validationEvidence)
+        && r.completionEvidence.stageCommand === r.stageCommand && r.completionEvidence.status === 'succeeded'
+        && r.validationEvidence.stageCommand === r.stageCommand && r.validationEvidence.status === 'passed'
+        && r.completionEvidence.targetEpicId === target && r.validationEvidence.targetEpicId === target
+        && r.completionEvidence.artifactHash === r.validationEvidence.artifactHash
+        && obj(r.validationEvidence.isolated) && obj(r.validationEvidence.regression)
+        && r.validationEvidence.isolated.graphHash === graph && r.validationEvidence.regression.graphHash === graph);
+}
+function approvedReview(r) {
+    const d = r.reviewDecision, c = r.completionEvidence, v = r.validationEvidence;
+    return obj(d) && obj(c) && obj(v) && d.schemaVersion === 'ArchitectureReviewDecision/1' && d.decision === 'approved'
+        && d.targetEpicId === r.targetEpicId && d.graphRevision === r.graphRevision && d.artifactHash === c.artifactHash
+        && d.artifactHash === v.artifactHash && d.completionReceiptId === c.receiptId && d.validationReceiptId === v.receiptId;
+}
+export function classifyNonUiArchitectureTransition(request, execution, memoryReceiptValid = false) {
+    const checkpoint = execution.checkpoint;
+    if (!obj(checkpoint))
+        return;
+    const scope = boundScope(checkpoint);
+    if (!scope || scope.targetEpicId !== request.targetEpicId || scope.graphRevision !== request.graphRevision
+        || !obj(request.evidenceExpectation) || scope.rootInputSha256 !== request.evidenceExpectation.inputHash
+        || !obj(request.accounting) || scope.accountingId !== request.accounting.accountingId
+        || request.nonUiScopeReceipt !== undefined && !isDeepStrictEqual(request.nonUiScopeReceipt, scope))
+        return;
+    const old = request.acceptedStages, next = checkpoint.acceptedStages, idx = commands.indexOf(String(request.currentStageCommand));
+    const target = request.targetEpicId, graph = request.graphRevision;
+    const same = (key) => isDeepStrictEqual(checkpoint[key], request[key]);
+    const idle = request.childStatus === undefined && request.completionEvidence === undefined && request.validationEvidence === undefined;
+    const cleared = checkpoint.childStatus === undefined && checkpoint.completionEvidence === undefined && checkpoint.validationEvidence === undefined;
+    if (request.currentStageCommand === 'arch-design-system' && request.continuationState === 'advance' && idle && cleared
+        && checkpoint.currentStageCommand === 'arch-performance' && checkpoint.continuationState === 'advance'
+        && execution.nextAction === 'resume' && prefix(old, commands.indexOf('arch-performance'), target, graph) && isDeepStrictEqual(next, old))
+        return 'advance';
+    if (idx < commands.indexOf('arch-security'))
+        return;
+    if (request.nonUiScopeReceipt === undefined && request.currentStageCommand !== 'arch-security')
+        return;
+    if (request.continuationState === 'complete' && request.currentStageCommand === 'update-memory'
+        && checkpoint.continuationState === 'complete' && checkpoint.currentStageCommand === 'update-memory'
+        && execution.nextAction === 'complete' && prefix(old, commands.length, target, graph) && isDeepStrictEqual(next, old)
+        && ['childStatus', 'completionEvidence', 'validationEvidence', 'reviewDecision', 'terminalMemoryCheckpoint'].every(same)
+        && memoryReceiptValid)
+        return 'complete-replay';
+    if (!prefix(old, idx, target, graph))
+        return;
+    if (idle && cleared && ['advance', 'delegate'].includes(String(request.continuationState))
+        && checkpoint.currentStageCommand === request.currentStageCommand && checkpoint.continuationState === 'delegate'
+        && execution.nextAction === 'delegate' && isDeepStrictEqual(next, old) && same('reviewDecision'))
+        return 'delegate';
+    const c = request.completionEvidence, v = request.validationEvidence;
+    if (request.childStatus !== 'succeeded' || !obj(c) || !obj(v) || c.status !== 'succeeded' || v.status !== 'passed'
+        || c.stageCommand !== request.currentStageCommand || v.stageCommand !== request.currentStageCommand
+        || c.targetEpicId !== target || v.targetEpicId !== target || c.artifactHash !== v.artifactHash)
+        return;
+    if (request.currentStageCommand === 'arch-review' && !approvedReview(request)) {
+        if (checkpoint.currentStageCommand === 'arch-review' && checkpoint.continuationState === 'ask-user'
+            && execution.nextAction === 'ask-user' && isDeepStrictEqual(next, old)
+            && ['childStatus', 'completionEvidence', 'validationEvidence'].every(same)
+            && isDeepStrictEqual(checkpoint.questionIds, ['ARCH-REVIEW-A09-APPROVAL'])
+            && request.reviewDecision === undefined)
+            return 'ask-user';
+        return;
+    }
+    if (request.currentStageCommand === 'arch-review' && (request.continuationState !== 'ask-user'
+        || !isDeepStrictEqual(request.questionIds, ['ARCH-REVIEW-A09-APPROVAL'])))
+        return;
+    const expected = [...old, { targetEpicId: target, stageCommand: request.currentStageCommand, completionEvidence: c, validationEvidence: v }];
+    if (!isDeepStrictEqual(next, expected) || !same('reviewDecision'))
+        return;
+    if (request.currentStageCommand === 'update-memory') {
+        if (checkpoint.currentStageCommand === 'update-memory' && checkpoint.continuationState === 'complete'
+            && execution.nextAction === 'complete' && ['childStatus', 'completionEvidence', 'validationEvidence', 'terminalMemoryCheckpoint'].every(same)
+            && memoryReceiptValid)
+            return 'complete';
+        return;
+    }
+    if (cleared && checkpoint.currentStageCommand === commands[idx + 1] && checkpoint.continuationState === 'advance'
+        && execution.nextAction === 'resume')
+        return 'advance';
+}

package/packages/client/dist/commands/architecture-root-binding.js

@@ -1 +1,51 @@
-import{createHash as f}from"node:crypto";import{execFileSync as g}from"node:child_process";import{lstatSync as u,realpathSync as n}from"node:fs";import{join as t,resolve as d}from"node:path";import{resolveClientPreFlightTrigger as v}from"../tier/tier-aware-client.js";const w=/^P[1-9][0-9]{0,11}$/,E=/^[a-f0-9]{40,64}$/;function S(s){const r=s.match(/^\s*(\*?[^\s]+)[ \t]+"[^"\n]{1,4096}"[ \t]+@docs\/epics\/epic-(P[1-9][0-9]{0,11})\.md\s*$/);return r&&v(r[1])==="arch-plan"?r[2]:void 0}function A(s,r){if(!w.test(r))throw new Error("architecture-root-epic-binding-invalid");const i=d(s),e=`docs/epics/epic-${r}.md`,a=t(i,e);try{if(n(i)!==i)throw new Error("architecture-root-epic-binding-invalid");if(n(t(i,"docs"))!==t(i,"docs")||n(t(i,"docs","epics"))!==t(i,"docs","epics")||n(a)!==a)throw new Error("architecture-root-epic-binding-invalid");const h=u(a);if(!h.isFile()||h.isSymbolicLink()||h.size>256*1024)throw new Error("architecture-root-epic-binding-invalid");const o=l=>g("git",[...l],{cwd:i,encoding:"utf8",stdio:["ignore","pipe","ignore"],maxBuffer:1024*1024}).trim();if(d(o(["rev-parse","--show-toplevel"]))!==i)throw new Error("architecture-root-epic-binding-invalid");const c=o(["rev-parse","--verify",`HEAD:${e}`]),p=o(["hash-object","--",e]),m=o(["ls-files","--stage","--",e]).match(/^100644 ([a-f0-9]{40,64}) 0\t/);if(!E.test(c)||p!==c||m?.[1]!==c)throw new Error("architecture-root-epic-binding-invalid");return f("sha256").update(`architecture-committed-epic-v1\0${r}\0${c}`).digest("hex")}catch{throw new Error("architecture-root-epic-binding-invalid")}}export{A as deriveCommittedArchitectureEpicGraphRevision,S as explicitArchitectureEpicTarget};
+/**
+ * A first architecture root may bind only to an explicitly selected,
+ * committed epic. The digest is stable across stage commits but changes when
+ * the epic source changes; it never grants child, Git or billing authority.
+ */
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { lstatSync, realpathSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { resolveClientPreFlightTrigger } from '../tier/tier-aware-client.js';
+const EPIC_ID = /^P[1-9][0-9]{0,11}$/;
+const OID = /^[a-f0-9]{40,64}$/;
+export function explicitArchitectureEpicTarget(args) {
+    const match = args.match(/^\s*(\*?[^\s]+)[ \t]+"[^"\n]{1,4096}"[ \t]+@docs\/epics\/epic-(P[1-9][0-9]{0,11})\.md\s*$/);
+    return match && resolveClientPreFlightTrigger(match[1]) === 'arch-plan' ? match[2] : undefined;
+}
+export function deriveCommittedArchitectureEpicGraphRevision(projectRoot, epicId) {
+    if (!EPIC_ID.test(epicId))
+        throw new Error('architecture-root-epic-binding-invalid');
+    const root = resolve(projectRoot);
+    const relativePath = `docs/epics/epic-${epicId}.md`;
+    const path = join(root, relativePath);
+    try {
+        if (realpathSync(root) !== root)
+            throw new Error('architecture-root-epic-binding-invalid');
+        if (realpathSync(join(root, 'docs')) !== join(root, 'docs')
+            || realpathSync(join(root, 'docs', 'epics')) !== join(root, 'docs', 'epics')
+            || realpathSync(path) !== path)
+            throw new Error('architecture-root-epic-binding-invalid');
+        const entry = lstatSync(path);
+        if (!entry.isFile() || entry.isSymbolicLink() || entry.size > 256 * 1024) {
+            throw new Error('architecture-root-epic-binding-invalid');
+        }
+        const run = (arguments_) => execFileSync('git', [...arguments_], {
+            cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1024 * 1024,
+        }).trim();
+        if (resolve(run(['rev-parse', '--show-toplevel'])) !== root) {
+            throw new Error('architecture-root-epic-binding-invalid');
+        }
+        const committed = run(['rev-parse', '--verify', `HEAD:${relativePath}`]);
+        const working = run(['hash-object', '--', relativePath]);
+        const staged = run(['ls-files', '--stage', '--', relativePath]).match(/^100644 ([a-f0-9]{40,64}) 0\t/);
+        if (!OID.test(committed) || working !== committed || staged?.[1] !== committed) {
+            throw new Error('architecture-root-epic-binding-invalid');
+        }
+        return createHash('sha256').update(`architecture-committed-epic-v1\0${epicId}\0${committed}`).digest('hex');
+    }
+    catch {
+        throw new Error('architecture-root-epic-binding-invalid');
+    }
+}

package/packages/client/dist/commands/cache-status.js

@@ -1,2 +1,112 @@
-import{readdir as y,stat as g}from"node:fs/promises";import{join as f}from"node:path";async function T(t){const r=t.staleThresholdMs??864e5;let e=0,s=0,c=0,i=null,a=null;try{const u=(await y(t.cacheDir)).filter(l=>l.endsWith(".enc"));e=u.length;const h=Date.now();for(const l of u)try{const m=f(t.cacheDir,l),d=await g(m);s+=d.size;const n=d.mtime;(!i||n<i)&&(i=n),(!a||n>a)&&(a=n),h-n.getTime()>r&&c++}catch{}}catch{}const S=t.circuitBreaker.getState().state;let o=0;try{o=(await t.telemetryQueue.getStats()).count}catch{}return{totalEntries:e,totalSizeBytes:s,totalSizeFormatted:$(s),oldestEntry:i,newestEntry:a,staleEntries:c,circuitState:S,lastSync:a,telemetryQueueSize:o}}function B(t){return["+-------------------------------------------------+","|  NEOCORTEX CACHE STATUS                         |","+-------------------------------------------------+",`|  Total entries:    ${String(t.totalEntries).padEnd(29)}|`,`|  Total size:       ${t.totalSizeFormatted.padEnd(29)}|`,`|  Oldest entry:     ${(t.oldestEntry?.toISOString()??"N/A").padEnd(29)}|`,`|  Newest entry:     ${(t.newestEntry?.toISOString()??"N/A").padEnd(29)}|`,`|  Stale entries:    ${String(t.staleEntries).padEnd(29)}|`,"|-------------------------------------------------|",`|  Circuit breaker:  ${t.circuitState.padEnd(29)}|`,`|  Last sync:        ${(t.lastSync?.toISOString()??"N/A").padEnd(29)}|`,`|  Telemetry queue:  ${(t.telemetryQueueSize+" events").padEnd(29)}|`,"+-------------------------------------------------+"].join(`
-`)}function $(t){if(t===0)return"0 B";const r=["B","KB","MB","GB"],e=Math.floor(Math.log(t)/Math.log(1024));return`${(t/Math.pow(1024,e)).toFixed(e===0?0:1)} ${r[e]}`}export{B as formatCacheStatus,T as getCacheStatus};
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+/**
+ * @neocortex/client - Cache Status Command
+ *
+ * Displays comprehensive cache and circuit breaker status information.
+ * Shows entry count, total size, age range, stale entries, circuit state,
+ * and telemetry queue stats.
+ *
+ * Story 42.9 - AC7
+ */
+import { readdir, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+// ── Implementation ──────────────────────────────────────────────────────
+/**
+ * Gather comprehensive cache status information.
+ */
+export async function getCacheStatus(options) {
+    const staleThreshold = options.staleThresholdMs ?? 86_400_000; // 24h default
+    let totalEntries = 0;
+    let totalSizeBytes = 0;
+    let staleEntries = 0;
+    let oldestEntry = null;
+    let newestEntry = null;
+    try {
+        const entries = await readdir(options.cacheDir);
+        const encFiles = entries.filter((e) => e.endsWith('.enc'));
+        totalEntries = encFiles.length;
+        const now = Date.now();
+        for (const file of encFiles) {
+            try {
+                const filePath = join(options.cacheDir, file);
+                const fileStat = await stat(filePath);
+                totalSizeBytes += fileStat.size;
+                const mtime = fileStat.mtime;
+                if (!oldestEntry || mtime < oldestEntry)
+                    oldestEntry = mtime;
+                if (!newestEntry || mtime > newestEntry)
+                    newestEntry = mtime;
+                if (now - mtime.getTime() > staleThreshold) {
+                    staleEntries++;
+                }
+            }
+            catch {
+                // Skip files that can't be stat'd
+            }
+        }
+    }
+    catch {
+        // Cache directory doesn't exist or can't be read
+    }
+    const circuitState = options.circuitBreaker.getState().state;
+    let telemetryQueueSize = 0;
+    try {
+        const queueStats = await options.telemetryQueue.getStats();
+        telemetryQueueSize = queueStats.count;
+    }
+    catch {
+        // Queue unavailable
+    }
+    return {
+        totalEntries,
+        totalSizeBytes,
+        totalSizeFormatted: formatBytes(totalSizeBytes),
+        oldestEntry,
+        newestEntry,
+        staleEntries,
+        circuitState,
+        lastSync: newestEntry, // Most recent cache write approximates last sync
+        telemetryQueueSize,
+    };
+}
+/**
+ * Format cache status as a human-readable string for terminal output.
+ */
+export function formatCacheStatus(info) {
+    const lines = [
+        '+-------------------------------------------------+',
+        '|  NEOCORTEX CACHE STATUS                         |',
+        '+-------------------------------------------------+',
+        `|  Total entries:    ${String(info.totalEntries).padEnd(29)}|`,
+        `|  Total size:       ${info.totalSizeFormatted.padEnd(29)}|`,
+        `|  Oldest entry:     ${(info.oldestEntry?.toISOString() ?? 'N/A').padEnd(29)}|`,
+        `|  Newest entry:     ${(info.newestEntry?.toISOString() ?? 'N/A').padEnd(29)}|`,
+        `|  Stale entries:    ${String(info.staleEntries).padEnd(29)}|`,
+        '|-------------------------------------------------|',
+        `|  Circuit breaker:  ${info.circuitState.padEnd(29)}|`,
+        `|  Last sync:        ${(info.lastSync?.toISOString() ?? 'N/A').padEnd(29)}|`,
+        `|  Telemetry queue:  ${(info.telemetryQueueSize + ' events').padEnd(29)}|`,
+        '+-------------------------------------------------+',
+    ];
+    return lines.join('\n');
+}
+// ── Helpers ─────────────────────────────────────────────────────────────
+function formatBytes(bytes) {
+    if (bytes === 0)
+        return '0 B';
+    const units = ['B', 'KB', 'MB', 'GB'];
+    const i = Math.floor(Math.log(bytes) / Math.log(1024));
+    const value = bytes / Math.pow(1024, i);
+    return `${value.toFixed(i === 0 ? 0 : 1)} ${units[i]}`;
+}

package/packages/client/dist/commands/config.js

@@ -1 +1,88 @@
-import{SUBAGENT_APPROVAL_EVIDENCE as d,deriveSubagentHostApprovalPolicy as v}from"../policy/subagent-approval-policy.js";import{detectPlatform as m}from"../adapters/platform-detector.js";import{ApprovalPolicyConfigError as E,getSubagentApprovalPolicy as b,resetSubagentApprovalMode as y,setSubagentApprovalMode as P}from"../config.js";function $(a,r){const t={evidence:d,...a.resolution,auditEvent:a.auditEvent?.event};return r?JSON.stringify(t,null,2):[d,`requested=${t.requestedMode}`,`effective=${t.effectiveMode}`,`source=${t.source}`,`scope=${t.scope}`,`platform=${t.platformTarget}`,`reason=${t.effectiveReason}`,`fallback=${t.fallbackMode}`,`fallbackReason=${t.fallbackReasonCode??"none"}`].join(" ")}async function w(a,r={}){const t=r.stdout??console.log,n=r.stderr??console.error;let s="status",l,i=!1,f=!1;for(let e=0;e<a.length;e+=1){const o=a[e];if(o==="--json")i=!0;else if(o==="--platform-target"){if(l=a[e+1],e+=1,!l)return n("Error: --platform-target requires a value."),1}else if(!f&&(o==="status"||o==="max"||o==="standard"||o==="disabled"||o==="reset"))s=o,f=!0;else return n("Error: expected status, max, standard, disabled, or reset."),1}const p=r.env??process.env,u=m({cwd:r.cwd??process.cwd(),env:p,targetFlag:l}),g=v(u.targetId),c={configFilePath:r.configFilePath,platformTarget:u.targetId,hostPolicy:g,now:r.now};try{const e=s==="status"?b(c):s==="reset"?y(c):P(s,c);return t($(e,i)),0}catch(e){return e instanceof E?(n(`Error: ${e.reasonCode}`),1):(n("Error: approval-policy-update-failed"),1)}}export{w as configCliHandler};
+import { SUBAGENT_APPROVAL_EVIDENCE, deriveSubagentHostApprovalPolicy, } from '../policy/subagent-approval-policy.js';
+import { detectPlatform } from '../adapters/platform-detector.js';
+import { ApprovalPolicyConfigError, getSubagentApprovalPolicy, resetSubagentApprovalMode, setSubagentApprovalMode, } from '../config.js';
+function renderResult(result, json) {
+    const payload = {
+        evidence: SUBAGENT_APPROVAL_EVIDENCE,
+        ...result.resolution,
+        auditEvent: result.auditEvent?.event,
+    };
+    if (json)
+        return JSON.stringify(payload, null, 2);
+    return [
+        SUBAGENT_APPROVAL_EVIDENCE,
+        `requested=${payload.requestedMode}`,
+        `effective=${payload.effectiveMode}`,
+        `source=${payload.source}`,
+        `scope=${payload.scope}`,
+        `platform=${payload.platformTarget}`,
+        `reason=${payload.effectiveReason}`,
+        `fallback=${payload.fallbackMode}`,
+        `fallbackReason=${payload.fallbackReasonCode ?? 'none'}`,
+    ].join(' ');
+}
+export async function configCliHandler(args, dependencies = {}) {
+    const stdout = dependencies.stdout ?? console.log;
+    const stderr = dependencies.stderr ?? console.error;
+    let action = 'status';
+    let platformTarget;
+    let json = false;
+    let actionSeen = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const value = args[index];
+        if (value === '--json') {
+            json = true;
+        }
+        else if (value === '--platform-target') {
+            platformTarget = args[index + 1];
+            index += 1;
+            if (!platformTarget) {
+                stderr('Error: --platform-target requires a value.');
+                return 1;
+            }
+        }
+        else if (!actionSeen &&
+            (value === 'status' ||
+                value === 'max' ||
+                value === 'standard' ||
+                value === 'disabled' ||
+                value === 'reset')) {
+            action = value;
+            actionSeen = true;
+        }
+        else {
+            stderr('Error: expected status, max, standard, disabled, or reset.');
+            return 1;
+        }
+    }
+    const env = dependencies.env ?? process.env;
+    const detection = detectPlatform({
+        cwd: dependencies.cwd ?? process.cwd(),
+        env,
+        targetFlag: platformTarget,
+    });
+    const hostPolicy = deriveSubagentHostApprovalPolicy(detection.targetId);
+    const options = {
+        configFilePath: dependencies.configFilePath,
+        platformTarget: detection.targetId,
+        hostPolicy,
+        now: dependencies.now,
+    };
+    try {
+        const result = action === 'status'
+            ? getSubagentApprovalPolicy(options)
+            : action === 'reset'
+                ? resetSubagentApprovalMode(options)
+                : setSubagentApprovalMode(action, options);
+        stdout(renderResult(result, json));
+        return 0;
+    }
+    catch (error) {
+        if (error instanceof ApprovalPolicyConfigError) {
+            stderr(`Error: ${error.reasonCode}`);
+            return 1;
+        }
+        stderr('Error: approval-policy-update-failed');
+        return 1;
+    }
+}

package/packages/client/dist/commands/doctor.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Read-only compatibility and release doctor (P223.02).
+ *
+ * The release contract is owned by P223.01. This command intentionally loads
+ * that authority through a narrow adapter instead of copying its validator.
+ * The dynamic boundary keeps this dependent story buildable while P223.01 is
+ * integrated in parallel.
+ */
+export declare const DOCTOR_SCHEMA_VERSION: "CompatibilityReleaseDoctor/1.0";
+export declare const DOCTOR_RESPONSE_SCHEMA_VERSION: "CompatibilityDoctorResponse/1.0";
+export declare const DOCTOR_EXIT_CODES: Readonly<{
+    readonly SUCCESS: 0;
+    readonly BLOCKED: 1;
+    readonly USAGE: 2;
+}>;
+export declare const DOCTOR_REASON_CODES: Readonly<{
+    readonly HEALTHY: "doctor-healthy";
+    readonly OFFLINE: "doctor-offline";
+    readonly SERVER_UNREACHABLE: "server-unreachable";
+    readonly CLIENT_TOO_OLD: "client-too-old";
+    readonly SERVER_TOO_OLD: "server-too-old";
+    readonly PROTOCOL_MISMATCH: "protocol-mismatch";
+    readonly SCHEMA_MISMATCH: "schema-mismatch";
+    readonly CAPABILITY_MISMATCH: "capability-mismatch";
+    readonly REGISTRY_DRIFT: "registry-drift";
+    readonly MALFORMED_RESPONSE: "malformed-response";
+    readonly AUTHORITY_UNAVAILABLE: "compatibility-authority-unavailable";
+    readonly RELEASE_LIFECYCLE_UNAVAILABLE: "release-lifecycle-unavailable";
+    readonly REQUIRED_DIMENSION_BLOCKED: "required-release-dimension-blocked";
+}>;
+export type DoctorMode = 'online' | 'offline';
+export type DoctorOverallStatus = 'healthy' | 'degraded' | 'incompatible';
+export type DoctorCompatibilityStatus = 'compatible' | 'degraded' | 'incompatible' | 'unknown';
+export type DoctorSeverity = 'error' | 'warning' | 'info';
+export type ReleaseTruth = true | false | 'unknown';
+export type ReleaseFreshness = 'fresh' | 'stale' | 'unknown';
+export type ReleaseDimensionName = 'implementationComplete' | 'betaOperable' | 'releaseReady' | 'productionPromoted';
+export type DoctorAffectedDimension = ReleaseDimensionName | 'compatibility' | 'releaseLifecycle';
+export interface DoctorFinding {
+    readonly severity: DoctorSeverity;
+    readonly reasonCode: string;
+    readonly affectedDimension: DoctorAffectedDimension;
+    readonly evidenceRef: string | null;
+    readonly remediation: string;
+}
+export interface DoctorReleaseDimension {
+    readonly value: ReleaseTruth;
+    readonly freshness: ReleaseFreshness;
+    readonly reasonCodes: readonly string[];
+    readonly evidenceRefs: readonly string[];
+}
+export interface DoctorReport {
+    readonly schemaVersion: typeof DOCTOR_SCHEMA_VERSION;
+    readonly publicSafe: true;
+    readonly readOnly: true;
+    readonly mode: DoctorMode;
+    readonly overall: DoctorOverallStatus;
+    readonly exitCode: 0 | 1;
+    readonly compatibility: {
+        readonly status: DoctorCompatibilityStatus;
+        readonly clientVersion: string;
+        readonly serverVersion: string | null;
+        readonly protocolVersion: string | null;
+        readonly schemaVersions: readonly string[];
+        readonly capabilityIds: readonly string[];
+        readonly registry: {
+            readonly localVersion: string;
+            readonly localChecksum: string;
+            readonly remoteVersion: string | null;
+            readonly remoteChecksum: string | null;
+            readonly status: 'matched' | 'mismatched' | 'unknown';
+        };
+    };
+    readonly release: {
+        readonly candidateId: string | null;
+        readonly lineageSha256: string | null;
+        readonly requiredDimension: ReleaseDimensionName | null;
+        readonly dimensions: Readonly<Record<ReleaseDimensionName, DoctorReleaseDimension>>;
+    };
+    readonly findings: readonly DoctorFinding[];
+}
+interface CompatibilityAuthority {
+    readonly createCompatibilityOffer: (input: {
+        readonly clientVersion: string;
+        readonly registryVersion: string;
+        readonly registryChecksum: string;
+    }) => unknown;
+    readonly isCompatibilityResultV1: (value: unknown) => boolean;
+    readonly validateReleaseLifecycle: (value: unknown) => {
+        readonly accepted: boolean;
+        readonly reasonCodes: readonly string[];
+        readonly projection?: unknown;
+    };
+    readonly createReleaseLifecycleContext?: (input: {
+        readonly projectId: string;
+        readonly candidateId: string;
+        readonly lineageSha256: string;
+    }) => unknown;
+}
+interface DoctorFetchResponse {
+    readonly ok: boolean;
+    readonly status: number;
+    text(): Promise<string>;
+}
+type DoctorFetch = (url: string, init: RequestInit) => Promise<DoctorFetchResponse>;
+export interface DoctorDependencies {
+    readonly fetch?: DoctorFetch;
+    readonly loadCompatibilityAuthority?: () => Promise<CompatibilityAuthority | null>;
+    readonly getClientVersion?: () => string;
+    readonly collectReleaseContext?: (projectRoot: string, authority: CompatibilityAuthority) => unknown | null;
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly stdout?: (message: string) => void;
+    readonly stderr?: (message: string) => void;
+}
+interface ParsedDoctorArgs {
+    readonly mode: DoctorMode;
+    readonly json: boolean;
+    readonly serverUrl: string;
+    readonly requiredDimension: ReleaseDimensionName | null;
+    /** Local-only selection root. It is never serialized or rendered. */
+    readonly projectRoot: string;
+}
+export declare function parseDoctorArgs(args: readonly string[], env?: Readonly<Record<string, string | undefined>>): ParsedDoctorArgs;
+/** P223.01 integration seam. No fallback validator is maintained here. */
+export declare function loadSharedCompatibilityAuthority(): Promise<CompatibilityAuthority | null>;
+/**
+ * Resolve the current project to an opaque selector without repairing or
+ * writing state. Git output is consumed locally and only domain-separated
+ * hashes plus the already-public project ID cross the network boundary.
+ */
+export declare function collectLocalReleaseLifecycleContext(projectRoot: string, authority: CompatibilityAuthority): unknown | null;
+export declare function runDoctor(options: ParsedDoctorArgs, dependencies?: DoctorDependencies): Promise<DoctorReport>;
+export declare function renderDoctorReport(report: DoctorReport): string;
+export declare function doctorCliHandler(args: readonly string[], dependencies?: DoctorDependencies): Promise<number>;
+export {};