@oxagen/cli 2.1.4-654 → 2.1.4-672

package/oxagen.mjs

@@ -9656,7 +9656,7 @@ function describeAgent(agent) {
   if (agent.host.revoked_at !== null)
     return `${what} (retired on this machine)`;
   if (agent.host.host_status === "revoked")
-    return `${what} (revoked on the fleet page)`;
+    return `${what} (revoked on the Runs page)`;
   return what;
 }
 function portsInUse(home, exceptDir) {
@@ -24104,7 +24104,7 @@ import { readFileSync as readFileSync11 } from "node:fs";
 import { dirname as dirname9, resolve as resolve3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function readVersion() {
-  if (true) return "2.1.4-654";
+  if (true) return "2.1.4-672";
   try {
     const here = dirname9(fileURLToPath(import.meta.url));
     const pkg = JSON.parse(
@@ -28266,7 +28266,7 @@ function printStatus(report, deps) {
   } = report;
   if (report.retired === true)
     deps.out(
-      `Not enrolled. ${h.host_enrollment_id} was unenrolled here on ${h.revoked_at ?? ""}. The server-side revoke is still pending: run \`oxagen agent unenroll\` again while signed in, or revoke it from the fleet page.`
+      `Not enrolled. ${h.host_enrollment_id} was unenrolled here on ${h.revoked_at ?? ""}. The server-side revoke is still pending: run \`oxagen agent unenroll\` again while signed in, or revoke it from the Runs page.`
     );
   for (const problem of report.problems ?? [])
     deps.out(`Unreadable  ${problem}`);
@@ -28428,7 +28428,7 @@ async function revokeOnControlPlane(host, options, deps, warnings) {
   );
   if ("missing" in resolved) {
     warnings.push(
-      "no operator token; the host stays active server-side until an operator revokes it (`oxagen login`, then `oxagen agent unenroll` again, or revoke from the fleet page)"
+      "no operator token; the host stays active server-side until an operator revokes it (`oxagen login`, then `oxagen agent unenroll` again, or revoke from the Runs page)"
     );
     return false;
   }
@@ -28806,7 +28806,7 @@ async function unenrollLocked(options, deps) {
   const host = read2.host;
   if (read2.error !== void 0) {
     warnings.push(
-      `${read2.error}; removing the hooks and the service anyway. The enrollment cannot be revoked from here: revoke it from the fleet page.`
+      `${read2.error}; removing the hooks and the service anyway. The enrollment cannot be revoked from here: revoke it from the Runs page.`
     );
     incomplete = true;
   }
@@ -29758,7 +29758,7 @@ ${problems.map((problem) => `  ${problem}`).join("\n")}`
         }
       } else
         warnings.push(
-          `the previous enrollment ${existing.host_enrollment_id} could not be revoked (${problems.join("; ")}); its host key stays valid until ${existing.expires_at} unless an operator revokes it from the fleet page`
+          `the previous enrollment ${existing.host_enrollment_id} could not be revoked (${problems.join("; ")}); its host key stays valid until ${existing.expires_at} unless an operator revokes it from the Runs page`
         );
     }
   }
@@ -31166,7 +31166,7 @@ ${refusals.map((refusal) => `  ${refusal}`).join("\n")}`
     warnings
   );
   deps.out(
-    revoked ? "      revoked" : "      not revoked server-side; the next reassign or unenroll asks again, or an operator can finish it from the fleet page"
+    revoked ? "      revoked" : "      not revoked server-side; the next reassign or unenroll asks again, or an operator can finish it from the Runs page"
   );
   deps.out("[2/3] Removing the old enrollment's hooks");
   for (const failure2 of (await stripEnrollmentHooks(host, deps)).failed)
@@ -31636,7 +31636,7 @@ async function uninstall(options, deps) {
   for (const path2 of tally2.removed) deps.out(`      removed ${path2}`);
   for (const revoke of pending)
     warnings.push(
-      `the control plane did not confirm the revoke of ${revoke}. Revoke it on the fleet page`
+      `the control plane did not confirm the revoke of ${revoke}. Revoke it on the Runs page`
     );
   for (const warning of warnings.slice(unenrolled.warnings.length))
     deps.err(`warning: ${warning}`);
@@ -55176,7 +55176,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@oxagen/cli",
-      version: "2.1.4-654",
+      version: "2.1.4-672",
       description: "Oxagen governance CLI \u2014 spend, lineage, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
       type: "module",
       main: "./dist/index.js",
@@ -58176,6 +58176,233 @@ var init_repo = __esm({
   }
 });
 
+// src/commands/steering-findings.ts
+var steering_findings_exports = {};
+__export(steering_findings_exports, {
+  PROPOSAL_STATUS_WORDS: () => PROPOSAL_STATUS_WORDS,
+  STEERING_FINDINGS_CAPABILITIES: () => STEERING_FINDINGS_CAPABILITIES,
+  apiRefusal: () => apiRefusal,
+  reportApiFailure: () => reportApiFailure,
+  steeringFindings: () => steeringFindings,
+  usageError: () => usageError
+});
+function isRecord7(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function textOrNull(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function apiRefusal(err2) {
+  const message = errorMessage(err2);
+  const start = message.indexOf("{");
+  const end = message.lastIndexOf("}");
+  if (start >= 0 && end > start) {
+    try {
+      const body2 = JSON.parse(message.slice(start, end + 1));
+      const error = isRecord7(body2) && isRecord7(body2.error) ? body2.error : null;
+      const said = error === null ? null : textOrNull(error.message);
+      if (error !== null && said !== null) {
+        return {
+          code: textOrNull(error.code),
+          reason: textOrNull(error.reason),
+          message: said
+        };
+      }
+    } catch {
+    }
+  }
+  return { code: null, reason: null, message };
+}
+function reportApiFailure(out, writer, err2, nextSteps = {}) {
+  const refusal = apiRefusal(err2);
+  out.error(refusal.message, refusal.reason ?? refusal.code ?? "api");
+  if (out.isJson || refusal.reason === null) return;
+  const next = nextSteps[refusal.reason];
+  if (next !== void 0) writer.writeErr(next);
+}
+function usageError(writer, message, line) {
+  writer.writeErr(`error: ${message}`);
+  writer.writeErr(`usage: ${line}`);
+  process.exitCode = 2;
+}
+function plural(count12, one, many) {
+  return `${count12} ${count12 === 1 ? one : many}`;
+}
+function findingRow(finding) {
+  const pr = finding.pull_request;
+  const proposal = finding.proposal;
+  return [
+    finding.id,
+    finding.kind,
+    `${finding.path}:${finding.line}`,
+    finding.record.label ?? finding.record.lineage,
+    `#${pr.number} ${pr.state}`,
+    proposal === null ? "none" : `${proposal.id} (${PROPOSAL_STATUS_WORDS[proposal.status]})`
+  ];
+}
+async function steeringFindings(opts = {}, writer = stdoutWriter) {
+  const out = createOutput({ json: opts.json }, writer);
+  let result2;
+  try {
+    result2 = await apiGetOrThrow(
+      "repository/findings"
+    );
+  } catch (err2) {
+    reportApiFailure(out, writer, err2);
+    return;
+  }
+  if (out.isJson) {
+    out.data(result2);
+    return;
+  }
+  const repositories = result2.repositories.filter((r) => r.findings.length > 0);
+  if (repositories.length === 0) {
+    writer.write(
+      "No findings. The Oxagen check found no statement in a linked repository's instruction files that repeats or contradicts a steering record."
+    );
+    return;
+  }
+  let total2 = 0;
+  for (const [index, repository] of repositories.entries()) {
+    if (index > 0) writer.write("");
+    writer.write(`${repository.full_name} (${repository.provider})`);
+    printTable(
+      ["FINDING", "KIND", "FILE", "RECORD", "PULL REQUEST", "PROPOSAL"],
+      repository.findings.map(findingRow),
+      writer
+    );
+    total2 += repository.findings.length;
+  }
+  writer.write("");
+  writer.write(
+    `${plural(total2, "finding", "findings")} in ${plural(repositories.length, "repository", "repositories")}.`
+  );
+  const promotable = repositories.some(
+    (r) => r.findings.some((f) => f.kind === "contradiction" && f.proposal === null)
+  );
+  if (promotable) {
+    writer.write(
+      "Promote a contradiction to a proposal with `oxagen steering promote <finding-id>`."
+    );
+  }
+}
+var STEERING_FINDINGS_CAPABILITIES, PROPOSAL_STATUS_WORDS;
+var init_steering_findings = __esm({
+  "src/commands/steering-findings.ts"() {
+    init_api();
+    init_capture_writer();
+    init_output();
+    STEERING_FINDINGS_CAPABILITIES = [
+      "list_code_repository_findings"
+    ];
+    PROPOSAL_STATUS_WORDS = {
+      proposed: "waiting for its steering PR",
+      pr_open: "steering PR open",
+      checks_running: "checks running",
+      checks_passed: "checks passed",
+      checks_failed: "checks failed",
+      merged: "merged",
+      rejected: "rejected"
+    };
+  }
+});
+
+// src/commands/repo-scan.ts
+var repo_scan_exports = {};
+__export(repo_scan_exports, {
+  REPO_SCAN_CAPABILITIES: () => REPO_SCAN_CAPABILITIES,
+  repoScan: () => repoScan
+});
+function fileRow(file) {
+  const size = file.size === null ? "-" : String(file.size);
+  const files3 = file.kind === "skill" ? ` (${file.files.length} files)` : "";
+  return [
+    file.kind,
+    `${file.path}${files3}`,
+    file.harness,
+    size,
+    file.fixture ? "fixture" : ""
+  ];
+}
+function plural2(count12, one, many) {
+  return `${count12} ${count12 === 1 ? one : many}`;
+}
+function countsLine(counts) {
+  const parts = [
+    [counts.instructions, "instruction file", "instruction files"],
+    [counts.rule, "rule", "rules"],
+    [counts.skill, "skill", "skills"],
+    [counts.command, "command", "commands"],
+    [counts.subagent, "subagent file", "subagent files"],
+    [counts.settings, "settings file", "settings files"],
+    [counts.mcpConfig, "MCP config", "MCP configs"],
+    [counts.personal, "personal file", "personal files"]
+  ];
+  const found = parts.filter(([n4]) => n4 > 0).map(([n4, one, many]) => plural2(n4, one, many));
+  const fixtures = counts.fixtures > 0 ? `, and ${plural2(counts.fixtures, "file", "files")} under fixture folders` : "";
+  return `${found.length > 0 ? found.join(", ") : "No harness files"}${fixtures}.`;
+}
+async function repoScan(ref2, opts = {}, writer = stdoutWriter) {
+  const fullName = ref2.trim().replace(/^\/+|\/+$/g, "");
+  if (!/^[^/\s]+(\/[^/\s]+)+$/.test(fullName)) {
+    usageError(
+      writer,
+      `expected <owner/name>, got ${JSON.stringify(ref2)}`,
+      USAGE
+    );
+    return;
+  }
+  const out = createOutput({ json: opts.json }, writer);
+  let result2;
+  try {
+    result2 = await apiPostOrThrow(
+      "repository/config/scan",
+      { provider: opts.gitlab ? "gitlab" : "github", fullName }
+    );
+  } catch (err2) {
+    reportApiFailure(out, writer, err2, NEXT_STEPS);
+    return;
+  }
+  if (out.isJson) {
+    out.data(result2);
+    return;
+  }
+  writer.write(
+    `${result2.fullName} (${result2.provider}), ${result2.defaultBranch} at ${result2.commitSha}`
+  );
+  if (result2.partialReason !== null) writer.write(result2.partialReason);
+  if (result2.files.length > 0) {
+    writer.write("");
+    printTable(
+      ["KIND", "PATH", "HARNESS", "BYTES", "FIXTURE"],
+      result2.files.map(fileRow),
+      writer
+    );
+  }
+  if (result2.aliases.length > 0) {
+    writer.write("");
+    for (const alias of result2.aliases) writer.write(`${alias.path}: ${alias.reason}`);
+  }
+  writer.write("");
+  writer.write(countsLine(result2.counts));
+}
+var REPO_SCAN_CAPABILITIES, USAGE, NEXT_STEPS;
+var init_repo_scan = __esm({
+  "src/commands/repo-scan.ts"() {
+    init_api();
+    init_capture_writer();
+    init_output();
+    init_steering_findings();
+    REPO_SCAN_CAPABILITIES = ["scan_repository_config"];
+    USAGE = "oxagen repo scan <owner/name> [--gitlab] [--json]";
+    NEXT_STEPS = {
+      github_not_connected: "Connect GitHub from the Repositories page, then scan again.",
+      repository_not_installed: "Give the Oxagen GitHub App access to the repository, then scan again.",
+      gitlab_not_connected: "Connect the GitLab project with a project access token, then scan again."
+    };
+  }
+});
+
 // ../../packages/steering-freshness/src/git.ts
 import { execFile as execFile5 } from "node:child_process";
 function classifyProbeFailure(err2) {
@@ -58601,23 +58828,23 @@ function hookConfigPath(projectRoot, harness, env = process.env, home = homedir1
 function stellaJsonPath(env, home) {
   return join46(env["STELLA_HOME"] ?? join46(home, ".stella"), "settings.json");
 }
-function isRecord7(v) {
+function isRecord8(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v);
 }
 function readConfig2(text5) {
   try {
     const parsed2 = JSON.parse(text5);
-    if (!isRecord7(parsed2)) return null;
+    if (!isRecord8(parsed2)) return null;
     if (parsed2["hooks"] === void 0) return parsed2;
     const hooks = parsed2["hooks"];
-    if (!isRecord7(hooks)) return null;
+    if (!isRecord8(hooks)) return null;
     for (const groups of Object.values(hooks)) {
       if (!Array.isArray(groups)) return null;
       for (const group of groups) {
-        if (!isRecord7(group)) return null;
+        if (!isRecord8(group)) return null;
         if (group["hooks"] === void 0) continue;
         if (!Array.isArray(group["hooks"])) return null;
-        if (!group["hooks"].every(isRecord7)) return null;
+        if (!group["hooks"].every(isRecord8)) return null;
       }
     }
     return parsed2;
@@ -58749,12 +58976,12 @@ async function groupHookInstalled(path2, io) {
 function readCursorConfig(text5) {
   try {
     const parsed2 = JSON.parse(text5);
-    if (!isRecord7(parsed2)) return null;
+    if (!isRecord8(parsed2)) return null;
     if (parsed2["hooks"] === void 0) return parsed2;
     const hooks = parsed2["hooks"];
-    if (!isRecord7(hooks)) return null;
+    if (!isRecord8(hooks)) return null;
     for (const entries2 of Object.values(hooks)) {
-      if (!Array.isArray(entries2) || !entries2.every(isRecord7)) return null;
+      if (!Array.isArray(entries2) || !entries2.every(isRecord8)) return null;
     }
     return parsed2;
   } catch {
@@ -73339,6 +73566,15 @@ var init_src4 = __esm({
   }
 });
 
+// ../../packages/oxagen/src/run-enrichment.ts
+var RUN_SUMMARY_MODES;
+var init_run_enrichment = __esm({
+  "../../packages/oxagen/src/run-enrichment.ts"() {
+    "use strict";
+    RUN_SUMMARY_MODES = ["always", "on_demand", "never"];
+  }
+});
+
 // ../../packages/oxagen/src/run-fit.ts
 var RUN_FIT_METHOD, runEffortSourceSchema, runFitReadSchema, runModelFitSchema, runEffortFitSchema, runFitReadingSchema, runFitSchema;
 var init_run_fit = __esm({
@@ -73415,6 +73651,7 @@ var init_run_list = __esm({
     init_zod();
     init_src3();
     init_registry2();
+    init_run_enrichment();
     init_run_fit();
     init_spend_shared();
     init_run_shared();
@@ -73802,21 +74039,38 @@ var init_run_list = __esm({
         version: external_exports.string().nullable(),
         runtime: external_exports.string().nullable()
       }).nullable(),
-      /** False when the workspace turned automatic run names and summaries off (ADR-153). */
+      /**
+       * The workspace's run summaries mode (D30): `always`, `on_demand`, or
+       * `never`. It decides whether the run offers Summarize
+       * (`summarizeOffered` in `@oxagen/oxagen/run-enrichment`). oxagen names
+       * every run in every mode.
+       */
+      summaries: external_exports.enum(RUN_SUMMARY_MODES).optional(),
+      /**
+       * Deprecated: true only under the `always` mode. It used to be the switch
+       * that turned run names and summaries off together (ADR-153).
+       */
       enrichmentEnabled: external_exports.boolean().optional(),
       /**
        * Why the last automatic account failed, as a short reason code such as
-       * `model_refused` or `credit_refused:<code>`. Absent once an account exists.
+       * `customer_key_refused` or `credit_refused:<code>`. Absent once an
+       * account exists, and under the `never` mode.
        */
       enrichmentError: external_exports.string().optional(),
+      /**
+       * True on a sealed run under `always` whose summary failed: the model
+       * provider refused a key the customer brought (D30). Such a run offers
+       * Summarize and a banner that names the reason.
+       */
+      summaryFailed: external_exports.boolean().optional(),
       /**
        * What the run is called, cut to `RUN_LABEL_MAX` with an ellipsis. A
        * name a person gave the run (`edit_run`) comes first. Otherwise a
        * wrapped session reads the title its harness gave it, then the name
        * Oxagen wrote (the model's, or the fallback from the first prompt),
        * then the title ingest derived, and a ledger run reads the name Oxagen
-       * wrote. With automatic accounts turned off, only a person's name and
-       * the harness title are read. Null when there is none.
+       * wrote. oxagen names every run in every run summaries mode (D30). Null
+       * when there is none.
        */
       name: external_exports.string().max(RUN_LABEL_MAX).nullable(),
       /**
@@ -73940,7 +74194,7 @@ var init_run_list = __esm({
         /**
          * `true` answers `liveRuns`, the workspace's live count. The count reads
          * every root session the workspace holds, so a read that does not show
-         * it leaves this out and pays nothing for it. Fleet sets it.
+         * it leaves this out and pays nothing for it. Runs sets it.
          */
         countLive: external_exports.boolean().optional()
       }).strict(),
@@ -74413,7 +74667,7 @@ var init_steering_repo = __esm({
 });
 
 // ../../packages/steering-check/src/repo.ts
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isString(value) {
@@ -74539,7 +74793,7 @@ function parseTomlLoose(text5) {
   if (text5 === void 0) return null;
   try {
     const value = parse(text5);
-    return isRecord8(value) ? value : null;
+    return isRecord9(value) ? value : null;
   } catch {
     return null;
   }
@@ -74547,7 +74801,7 @@ function parseTomlLoose(text5) {
 function canonicalJson(value) {
   if (Array.isArray(value))
     return `[${value.map(canonicalJson).join(",")}]`;
-  if (isRecord8(value)) {
+  if (isRecord9(value)) {
     const keys = Object.keys(value).sort();
     return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
   }
@@ -74557,7 +74811,7 @@ function parseJsonLoose(text5) {
   if (text5 === void 0) return null;
   try {
     const value = JSON.parse(text5);
-    return isRecord8(value) ? value : null;
+    return isRecord9(value) ? value : null;
   } catch {
     return null;
   }
@@ -74571,9 +74825,9 @@ function workspaceRepositories(tree) {
 }
 function entries(value) {
   const found = /* @__PURE__ */ new Map();
-  if (!isRecord8(value)) return found;
+  if (!isRecord9(value)) return found;
   for (const [key, entry2] of Object.entries(value)) {
-    if (isRecord8(entry2)) found.set(key, entry2);
+    if (isRecord9(entry2)) found.set(key, entry2);
   }
   return found;
 }
@@ -74739,7 +74993,7 @@ function isPositiveInteger(value) {
 }
 function alwaysOnBudget(tree) {
   const steering = parseTomlLoose(tree?.get(GOVERNANCE_TOML_PATH))?.steering;
-  const value = isRecord8(steering) ? steering.always_on_tokens : void 0;
+  const value = isRecord9(steering) ? steering.always_on_tokens : void 0;
   if (value === "off") return "off";
   if (isPositiveInteger(value))
     return { tokens: value, source: "governance.toml" };
@@ -74747,7 +75001,7 @@ function alwaysOnBudget(tree) {
 }
 function definitionBudget(tree) {
   const tools = parseTomlLoose(tree?.get(WORKSPACE_TOML_PATH))?.tools;
-  const value = isRecord8(tools) ? tools.definition_budget : void 0;
+  const value = isRecord9(tools) ? tools.definition_budget : void 0;
   return isPositiveInteger(value) ? { tokens: value, source: "workspace.toml" } : {
     tokens: DEFAULT_WORKSPACE_DEFINITION_BUDGET,
     source: "Oxagen's default"
@@ -74855,12 +75109,12 @@ function directDefinitions(tree) {
   const servers = [];
   for (const [name, folder] of serverFolders(tree)) {
     const exposure = folder.server?.exposure;
-    if (!isRecord8(exposure) || exposure.mode !== "direct") continue;
+    if (!isRecord9(exposure) || exposure.mode !== "direct") continue;
     let tokens = 0;
     let tools = 0;
     for (const [key, entry2] of folder.tools) {
       const upstream = folder.locked.get(key)?.upstream;
-      if (!isRecord8(upstream)) continue;
+      if (!isRecord9(upstream)) continue;
       const description = isString(entry2.description) ? entry2.description : upstream.description;
       const definition = {
         name: `${name}__${key}`,
@@ -75613,7 +75867,7 @@ function credentialFields(value, prefix = "") {
       (item, n4) => credentialFields(item, prefix === "" ? String(n4) : `${prefix}.${n4}`)
     );
   }
-  if (!isRecord8(value)) return [];
+  if (!isRecord9(value)) return [];
   return Object.entries(value).flatMap(
     ([key, item]) => credentialFields(item, prefix === "" ? key : `${prefix}.${key}`)
   );
@@ -75649,7 +75903,7 @@ function groupFindings(tree, context) {
   const reviewers = parsed2.reviewers;
   const findings = [];
   reviewers.forEach((entry2, n4) => {
-    if (!isRecord8(entry2) || !isString(entry2.group) || context.groups.includes(entry2.group))
+    if (!isRecord9(entry2) || !isString(entry2.group) || context.groups.includes(entry2.group))
       return;
     const field = `reviewers.${n4}.group`;
     findings.push(
@@ -77309,137 +77563,6 @@ var init_steering_import = __esm({
   }
 });
 
-// src/commands/steering-findings.ts
-var steering_findings_exports = {};
-__export(steering_findings_exports, {
-  PROPOSAL_STATUS_WORDS: () => PROPOSAL_STATUS_WORDS,
-  STEERING_FINDINGS_CAPABILITIES: () => STEERING_FINDINGS_CAPABILITIES,
-  apiRefusal: () => apiRefusal,
-  reportApiFailure: () => reportApiFailure,
-  steeringFindings: () => steeringFindings,
-  usageError: () => usageError
-});
-function isRecord9(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function textOrNull(value) {
-  return typeof value === "string" && value.length > 0 ? value : null;
-}
-function apiRefusal(err2) {
-  const message = errorMessage(err2);
-  const start = message.indexOf("{");
-  const end = message.lastIndexOf("}");
-  if (start >= 0 && end > start) {
-    try {
-      const body2 = JSON.parse(message.slice(start, end + 1));
-      const error = isRecord9(body2) && isRecord9(body2.error) ? body2.error : null;
-      const said = error === null ? null : textOrNull(error.message);
-      if (error !== null && said !== null) {
-        return {
-          code: textOrNull(error.code),
-          reason: textOrNull(error.reason),
-          message: said
-        };
-      }
-    } catch {
-    }
-  }
-  return { code: null, reason: null, message };
-}
-function reportApiFailure(out, writer, err2, nextSteps = {}) {
-  const refusal = apiRefusal(err2);
-  out.error(refusal.message, refusal.reason ?? refusal.code ?? "api");
-  if (out.isJson || refusal.reason === null) return;
-  const next = nextSteps[refusal.reason];
-  if (next !== void 0) writer.writeErr(next);
-}
-function usageError(writer, message, line) {
-  writer.writeErr(`error: ${message}`);
-  writer.writeErr(`usage: ${line}`);
-  process.exitCode = 2;
-}
-function plural(count12, one, many) {
-  return `${count12} ${count12 === 1 ? one : many}`;
-}
-function findingRow(finding) {
-  const pr = finding.pull_request;
-  const proposal = finding.proposal;
-  return [
-    finding.id,
-    finding.kind,
-    `${finding.path}:${finding.line}`,
-    finding.record.label ?? finding.record.lineage,
-    `#${pr.number} ${pr.state}`,
-    proposal === null ? "none" : `${proposal.id} (${PROPOSAL_STATUS_WORDS[proposal.status]})`
-  ];
-}
-async function steeringFindings(opts = {}, writer = stdoutWriter) {
-  const out = createOutput({ json: opts.json }, writer);
-  let result2;
-  try {
-    result2 = await apiGetOrThrow(
-      "repository/findings"
-    );
-  } catch (err2) {
-    reportApiFailure(out, writer, err2);
-    return;
-  }
-  if (out.isJson) {
-    out.data(result2);
-    return;
-  }
-  const repositories = result2.repositories.filter((r) => r.findings.length > 0);
-  if (repositories.length === 0) {
-    writer.write(
-      "No findings. The Oxagen check found no statement in a linked repository's instruction files that repeats or contradicts a steering record."
-    );
-    return;
-  }
-  let total2 = 0;
-  for (const [index, repository] of repositories.entries()) {
-    if (index > 0) writer.write("");
-    writer.write(`${repository.full_name} (${repository.provider})`);
-    printTable(
-      ["FINDING", "KIND", "FILE", "RECORD", "PULL REQUEST", "PROPOSAL"],
-      repository.findings.map(findingRow),
-      writer
-    );
-    total2 += repository.findings.length;
-  }
-  writer.write("");
-  writer.write(
-    `${plural(total2, "finding", "findings")} in ${plural(repositories.length, "repository", "repositories")}.`
-  );
-  const promotable = repositories.some(
-    (r) => r.findings.some((f) => f.kind === "contradiction" && f.proposal === null)
-  );
-  if (promotable) {
-    writer.write(
-      "Promote a contradiction to a proposal with `oxagen steering promote <finding-id>`."
-    );
-  }
-}
-var STEERING_FINDINGS_CAPABILITIES, PROPOSAL_STATUS_WORDS;
-var init_steering_findings = __esm({
-  "src/commands/steering-findings.ts"() {
-    init_api();
-    init_capture_writer();
-    init_output();
-    STEERING_FINDINGS_CAPABILITIES = [
-      "list_code_repository_findings"
-    ];
-    PROPOSAL_STATUS_WORDS = {
-      proposed: "waiting for its steering PR",
-      pr_open: "steering PR open",
-      checks_running: "checks running",
-      checks_passed: "checks passed",
-      checks_failed: "checks failed",
-      merged: "merged",
-      rejected: "rejected"
-    };
-  }
-});
-
 // src/commands/steering-promote.ts
 var steering_promote_exports = {};
 __export(steering_promote_exports, {
@@ -77452,7 +77575,7 @@ async function steeringPromote(findingId, opts = {}, writer = stdoutWriter) {
     usageError(
       writer,
       `expected a finding id that starts with crf_, got ${JSON.stringify(findingId)}. Run \`oxagen steering findings\` to list them.`,
-      USAGE
+      USAGE2
     );
     return;
   }
@@ -77464,7 +77587,7 @@ async function steeringPromote(findingId, opts = {}, writer = stdoutWriter) {
       { finding_id: id2 }
     );
   } catch (err2) {
-    reportApiFailure(out, writer, err2, NEXT_STEPS);
+    reportApiFailure(out, writer, err2, NEXT_STEPS2);
     return;
   }
   if (out.isJson) {
@@ -77481,7 +77604,7 @@ async function steeringPromote(findingId, opts = {}, writer = stdoutWriter) {
   writer.write(`Status: ${PROPOSAL_STATUS_WORDS[result2.status]}`);
   writer.write("Nothing steers until a person merges the steering PR.");
 }
-var STEERING_PROMOTE_CAPABILITIES, FINDING_ID, USAGE, NEXT_STEPS;
+var STEERING_PROMOTE_CAPABILITIES, FINDING_ID, USAGE2, NEXT_STEPS2;
 var init_steering_promote = __esm({
   "src/commands/steering-promote.ts"() {
     init_api();
@@ -77492,8 +77615,8 @@ var init_steering_promote = __esm({
       "promote_instruction_to_steering"
     ];
     FINDING_ID = /^crf_[0-9A-Za-z]+$/;
-    USAGE = "oxagen steering promote <finding-id> [--json]";
-    NEXT_STEPS = {
+    USAGE2 = "oxagen steering promote <finding-id> [--json]";
+    NEXT_STEPS2 = {
       finding_resolved: "Run `oxagen steering findings` to see the statements that still match a record.",
       already_proposed: "Run `oxagen steering findings` to see the open proposal and its steering PR.",
       lineage_pr_open: "Merge or close the PR that is open on the record, then promote the finding again."
@@ -77519,7 +77642,7 @@ async function steeringRestoreBlock(proposalId, path2, opts = {}, writer = stdou
     usageError(
       writer,
       `expected a proposal id that starts with prp_, got ${JSON.stringify(proposalId)}`,
-      USAGE2
+      USAGE3
     );
     return;
   }
@@ -77528,7 +77651,7 @@ async function steeringRestoreBlock(proposalId, path2, opts = {}, writer = stdou
     usageError(
       writer,
       `expected AGENTS.md, CLAUDE.md, or README.md, got ${JSON.stringify(path2)}`,
-      USAGE2
+      USAGE3
     );
     return;
   }
@@ -77553,7 +77676,7 @@ async function steeringRestoreBlock(proposalId, path2, opts = {}, writer = stdou
   writer.write(`Commit: ${result2.commit_sha}`);
   writer.write(`Status: ${PROPOSAL_STATUS_WORDS[result2.status]}`);
 }
-var STEERING_RESTORE_BLOCK_CAPABILITIES, MANAGED_BLOCK_FILES, PROPOSAL_ID2, USAGE2;
+var STEERING_RESTORE_BLOCK_CAPABILITIES, MANAGED_BLOCK_FILES, PROPOSAL_ID2, USAGE3;
 var init_steering_restore_block = __esm({
   "src/commands/steering-restore-block.ts"() {
     init_api();
@@ -77569,7 +77692,7 @@ var init_steering_restore_block = __esm({
       "README.md": true
     };
     PROPOSAL_ID2 = /^prp_[0-9A-Za-z]+$/;
-    USAGE2 = "oxagen steering restore-block <proposal-id> <AGENTS.md|CLAUDE.md|README.md> [--json]";
+    USAGE3 = "oxagen steering restore-block <proposal-id> <AGENTS.md|CLAUDE.md|README.md> [--json]";
   }
 });
 
@@ -79024,7 +79147,7 @@ function formatFrame(frame) {
   return parts.join("  ");
 }
 function formatCounts(counts) {
-  return counts.map((c) => `${c.kind} ${c.count} (in ${plural2(c.frames, "frame")})`).join(", ");
+  return counts.map((c) => `${c.kind} ${c.count} (in ${plural3(c.frames, "frame")})`).join(", ");
 }
 function formatVerification(result2) {
   const lines = [];
@@ -79037,7 +79160,7 @@ function formatVerification(result2) {
   ).length;
   if (notCarried > 0) {
     lines.push(
-      `  Digest not carried on ${plural2(notCarried, "wrapped (tse_) frame")}. A wrapped frame is hashed over its full event, and the bundle does not hold that event for these frames: an export before format 3 never did, and a format-3 export leaves it out when the stored row cannot be proven to rebuild it. For these frames, only the links and the Merkle root can be checked.`
+      `  Digest not carried on ${plural3(notCarried, "wrapped (tse_) frame")}. A wrapped frame is hashed over its full event, and the bundle does not hold that event for these frames: an export before format 3 never did, and a format-3 export leaves it out when the stored row cannot be proven to rebuild it. For these frames, only the links and the Merkle root can be checked.`
     );
   }
   lines.push("");
@@ -79066,7 +79189,7 @@ function formatVerification(result2) {
     (c) => c.status === "broken"
   ).length;
   lines.push(
-    result2.ok ? `HELD ${runId}: ${plural2(result2.frames.length, "frame")}` : `BROKEN ${runId}: ${brokenFrames} of ${plural2(result2.frames.length, "frame")} broken, ${plural2(brokenChecks, "check")} broken`
+    result2.ok ? `HELD ${runId}: ${plural3(result2.frames.length, "frame")}` : `BROKEN ${runId}: ${brokenFrames} of ${plural3(result2.frames.length, "frame")} broken, ${plural3(brokenChecks, "check")} broken`
   );
   return lines;
 }
@@ -79084,7 +79207,7 @@ async function verifyBundle3(bundle2, opts = {}, writer = stdoutWriter) {
   if (!result2.ok && (process.exitCode === void 0 || process.exitCode === 0))
     process.exitCode = 1;
 }
-var REQUIRED, OPTIONAL, BundleReadError, plural2;
+var REQUIRED, OPTIONAL, BundleReadError, plural3;
 var init_verify2 = __esm({
   "src/commands/verify.ts"() {
     init_esm2();
@@ -79099,7 +79222,7 @@ var init_verify2 = __esm({
     OPTIONAL = "redactions.json";
     BundleReadError = class extends Error {
     };
-    plural2 = (n4, word) => `${n4} ${word}${n4 === 1 ? "" : "s"}`;
+    plural3 = (n4, word) => `${n4} ${word}${n4 === 1 ? "" : "s"}`;
   }
 });
 
@@ -79320,7 +79443,7 @@ function ago(iso, now = /* @__PURE__ */ new Date()) {
   if (hours < 48) return `${hours}h ago`;
   return `${Math.round(hours / 24)}d ago`;
 }
-function plural3(count12, one, many) {
+function plural4(count12, one, many) {
   return `${count12} ${count12 === 1 ? one : many}`;
 }
 function table(headers, rows) {
@@ -79334,7 +79457,7 @@ function table(headers, rows) {
 }
 function formatWorkspaceMemories(result2, now = /* @__PURE__ */ new Date()) {
   if (result2.groups.length === 0) {
-    return result2.total_groups === 0 ? "No memories yet. Oxagen collects them from enrolled hosts every five minutes." : `No memories on this page. The list holds ${plural3(result2.total_groups, "group", "groups")}.`;
+    return result2.total_groups === 0 ? "No memories yet. Oxagen collects them from enrolled hosts every five minutes." : `No memories on this page. The list holds ${plural4(result2.total_groups, "group", "groups")}.`;
   }
   const rows = result2.groups.map((group) => {
     const { memory } = group;
@@ -79359,14 +79482,14 @@ function formatWorkspaceMemories(result2, now = /* @__PURE__ */ new Date()) {
   const shown2 = result2.groups.length;
   lines.push(
     "",
-    shown2 < result2.total_groups ? `Showing ${shown2} of ${plural3(result2.total_groups, "group", "groups")}. Use --limit and --offset to page.` : `${plural3(result2.total_groups, "group", "groups")}.`
+    shown2 < result2.total_groups ? `Showing ${shown2} of ${plural4(result2.total_groups, "group", "groups")}. Use --limit and --offset to page.` : `${plural4(result2.total_groups, "group", "groups")}.`
   );
   if (result2.truncated)
     lines.push(
       `More than ${result2.total_memories} memories matched, and the list groups the top ${result2.total_memories}. Narrow the filters to see the rest.`
     );
   lines.push(
-    `${plural3(result2.waiting, "memory waits", "memories wait")} in this workspace.`
+    `${plural4(result2.waiting, "memory waits", "memories wait")} in this workspace.`
   );
   return lines.join("\n");
 }
@@ -79450,7 +79573,7 @@ function formatDismissResult(result2, restore) {
   const lines = [];
   if (result2.changed.length > 0)
     lines.push(
-      `${restore ? "Restored" : "Dismissed"} ${plural3(result2.changed.length, "memory", "memories")}: ${result2.changed.join(", ")}.`
+      `${restore ? "Restored" : "Dismissed"} ${plural4(result2.changed.length, "memory", "memories")}: ${result2.changed.join(", ")}.`
     );
   else lines.push(`No memory was ${restore ? "restored" : "dismissed"}.`);
   if (!restore && result2.rejections > 0)
@@ -101965,11 +102088,11 @@ function errorText4(error) {
 function asSentence(text5) {
   return /[.!?…]$/.test(text5) ? text5 : `${text5}.`;
 }
-function plural4(count12, one, many) {
+function plural5(count12, one, many) {
   return `${count12} ${count12 === 1 ? one : many}`;
 }
 function pagingNote(paged, options) {
-  const read2 = `${plural4(paged.items, "item", "items")} from ${plural4(paged.pages, "page", "pages")}`;
+  const read2 = `${plural5(paged.items, "item", "items")} from ${plural5(paged.pages, "page", "pages")}`;
   switch (paged.stop) {
     case "last_page":
       return void 0;
@@ -121430,12 +121553,12 @@ function checkString(schema, value, path2) {
   const length = [...value].length;
   if (typeof schema.minLength === "number" && length < schema.minLength) {
     issues.push(
-      `${path2} must be at least ${schema.minLength} ${plural5(schema.minLength, "character")} long.`
+      `${path2} must be at least ${schema.minLength} ${plural6(schema.minLength, "character")} long.`
     );
   }
   if (typeof schema.maxLength === "number" && length > schema.maxLength) {
     issues.push(
-      `${path2} must be at most ${schema.maxLength} ${plural5(schema.maxLength, "character")} long.`
+      `${path2} must be at most ${schema.maxLength} ${plural6(schema.maxLength, "character")} long.`
     );
   }
   if (typeof schema.pattern === "string" && testPattern(schema.pattern, value) === false) {
@@ -121524,7 +121647,7 @@ function listOf(values) {
   const more = values.length - shown2.length;
   return more > 0 ? `${shown2.join(", ")}, and ${more} more` : shown2.join(", ");
 }
-function plural5(count12, one, many = `${one}s`) {
+function plural6(count12, one, many = `${one}s`) {
   return count12 === 1 ? one : many;
 }
 var MAX_DEPTH2, MAX_STEPS, MAX_ISSUES, TYPE_NAMES, Checker;
@@ -121588,12 +121711,12 @@ var init_validate = __esm({
         const issues = [];
         if (typeof schema.minItems === "number" && value.length < schema.minItems) {
           issues.push(
-            `${path2} must have at least ${schema.minItems} ${plural5(schema.minItems, "item")}.`
+            `${path2} must have at least ${schema.minItems} ${plural6(schema.minItems, "item")}.`
           );
         }
         if (typeof schema.maxItems === "number" && value.length > schema.maxItems) {
           issues.push(
-            `${path2} must have at most ${schema.maxItems} ${plural5(schema.maxItems, "item")}.`
+            `${path2} must have at most ${schema.maxItems} ${plural6(schema.maxItems, "item")}.`
           );
         }
         if (schema.uniqueItems === true) {
@@ -121640,12 +121763,12 @@ var init_validate = __esm({
         }
         if (typeof schema.minProperties === "number" && present.length < schema.minProperties) {
           issues.push(
-            `${path2} must have at least ${schema.minProperties} ${plural5(schema.minProperties, "property", "properties")}.`
+            `${path2} must have at least ${schema.minProperties} ${plural6(schema.minProperties, "property", "properties")}.`
           );
         }
         if (typeof schema.maxProperties === "number" && present.length > schema.maxProperties) {
           issues.push(
-            `${path2} must have at most ${schema.maxProperties} ${plural5(schema.maxProperties, "property", "properties")}.`
+            `${path2} must have at most ${schema.maxProperties} ${plural6(schema.maxProperties, "property", "properties")}.`
           );
         }
         const properties = isRecord10(schema.properties) ? schema.properties : {};
@@ -130773,6 +130896,14 @@ function buildProgram() {
     const { repoLink: repoLink2 } = await Promise.resolve().then(() => (init_repo(), repo_exports));
     await repoLink2(ref2, opts);
   });
+  repoCmd.command("scan").description(
+    "List the agent harness files on a repository's default branch: instruction and rule files, skills, commands, subagent files, settings files and MCP configs. The repository need not be linked."
+  ).argument("<owner/name>", "The repository, or the GitLab project path").option("--gitlab", "Scan a GitLab project the workspace has connected").option("--json", "Output JSON").action(
+    async (ref2, opts) => {
+      const { repoScan: repoScan2 } = await Promise.resolve().then(() => (init_repo_scan(), repo_scan_exports));
+      await repoScan2(ref2, opts);
+    }
+  );
   repoCmd.command("unlink").description(
     "Unlink a linked repository by its binding id. A repository workspace.toml lists is removed by a steering PR. The steering repository is refused."
   ).argument("<bindingId>", "The rpb_\u2026 binding id `oxagen repo list` shows").option("--json", "Output JSON").action(async (bindingId, opts) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxagen/cli",
-  "version": "2.1.4-654",
+  "version": "2.1.4-672",
   "description": "Oxagen governance CLI — spend, lineage, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
   "type": "module",
   "bin": {