@oxagen/cli 2.1.4-672 → 2.1.4-679

package/README.md

@@ -5,12 +5,8 @@ cost, run traces, knowledge-graph grounding, agent memory,
 environments, the credential vault, and audit logs — from the terminal.
 
 Oxagen **governs, grounds, explains, meters/bills and rates** agents; it does
-not run them ([ADR-043](../../docs/adr/ADR-043-runtime-excision.md)). The
-interactive coding agent this CLI used to ship — the REPL, sandboxes, skills,
-slash commands, evals, local rules and settings — is gone. Stella owns all
-things agentic: use the `stella` CLI with the oxagen MCP server. Every removed
-entry point stays registered as a stub that prints exactly that, so a stale
-script fails with guidance instead of an unknown-command error.
+not run them ([ADR-043](../../docs/adr/ADR-043-runtime-excision.md)). Stella
+owns all things agentic: use the `stella` CLI with the oxagen MCP server.
 
 Full reference: **https://docs.oxagen.sh/docs/cli**
 
@@ -19,9 +15,8 @@ Full reference: **https://docs.oxagen.sh/docs/cli**
 - **Owns:** the `oxagen` command tree (`src/program.ts`), the browser login
   with PKCE and a loopback listener (`src/auth/`), the local config and
   workspace binding (`src/lib/config.ts`, `.oxagen/workspace.json`), the HTTP
-  client for the platform API (`src/lib/api.ts`), output formatting, the
-  retirement stubs for the former coding-agent commands, and anonymous usage
-  telemetry (`src/telemetry/usage.ts`).
+  client for the platform API (`src/lib/api.ts`), output formatting, and
+  anonymous usage telemetry (`src/telemetry/usage.ts`).
 - **Does not own:** any capability logic. Every command that reads or changes
   platform state calls [`apps/api`](../api/README.md) over HTTP, and the
   kernel runs there. It also does not own the work behind the machine
@@ -46,11 +41,10 @@ Full reference: **https://docs.oxagen.sh/docs/cli**
 |---|---|---|---|
 | Platform API client (`/v1/{org}/{workspace}/…`, `/v1/user/…`, bearer token) | boundary | `apps/cli/src/lib/api.ts` | Commands in `apps/cli/src/commands/`. Served by `apps/api/src/app.ts` |
 | Browser login (`/cli/authorize`, then `POST /v1/auth/cli/token`) | boundary | `apps/cli/src/auth/loopback-login.ts`, `pkce.ts` | `oxagen login` |
-| `CliDeps` from `defaultCliDeps` | adapter | `apps/cli/src/commands/tacho.ts` | `oxagen agent enroll`, `status`, `reassign`, `unenroll`, `export`, `verify`, `hosts`, `run`, and `detect`, and the hidden alias group that keeps the older spelling. The work lives in `@oxagen/recorder/cli` |
+| `CliDeps` from `defaultCliDeps` | adapter | `apps/cli/src/commands/tacho.ts` | `oxagen agent enroll`, `status`, `reassign`, `unenroll`, `export`, `verify`, `hosts`, `run`, and `detect`. The work lives in `@oxagen/recorder/cli` |
 | Machine command dispatch | adapter | `apps/cli/src/index.ts`, `apps/cli/src/machine/` | `oxagen hook`, `daemon`, `mcp-stdio`, `credential`, `github`, and `arp`, which go straight to the recorder before the command tree loads. Hidden from `oxagen --help` |
 | `evaluateGate`, `renderGate`, `installHook` | adapter | `apps/cli/src/commands/steering.ts` | `oxagen steering …`, and each harness's prompt-submit hook |
 | Usage telemetry (`POST /v1/telemetry/usage`) | boundary | `apps/cli/src/telemetry/usage.ts` | Every command, unless `oxagen telemetry off` or `DO_NOT_TRACK=1` |
-| Retired command stubs | registry | `apps/cli/src/commands/retired.ts` | `apps/cli/src/program.ts` |
 
 The CLI bootstraps no kernel gate and registers no handler. Contracts that
 declare the `cli` surface are served through the API, and
@@ -70,8 +64,7 @@ for the capability or a command file names it.
 
 ## Rules
 
-- The CLI governs agents and runs none (ADR-043). A former coding-agent
-  command stays registered as a stub that points to `stella`.
+- The CLI governs agents and runs none (ADR-043).
 - Commands reach platform state through the API only, never through a
   database client or the kernel.
 - Telemetry never carries code, prompts, file contents, paths, model slugs,
@@ -145,8 +138,8 @@ command for its flags. The full command tree lives in
 `apps/cli/src/program.ts` and is documented at
 https://docs.oxagen.sh/docs/cli/commands.
 
-Everything except `cost`, `logs` and `telemetry` talks to the platform API and
-needs `oxagen login` first. `oxagen agent enroll` with a one-time enrollment
+Everything except `cost`, `logs`, `telemetry` and `codegraph` talks to the
+platform API and needs `oxagen login` first. `oxagen agent enroll` with a one-time enrollment
 token needs no login either.
 
 **Meter and bill**
@@ -159,6 +152,25 @@ oxagen cost --rates                 # print the rate card
 oxagen router stats|preview|policy  # the verified-outcome market router
 ```
 
+**Map the code** — the local code graph and CI upload
+
+```bash
+oxagen codegraph init [path]        # index a repo on this machine, watch it, and write the codegraph MCP entry
+oxagen codegraph init --embed-url http://127.0.0.1:11434/v1/embeddings   # embed through a server on this machine
+oxagen codegraph init --scip        # also build SCIP links
+oxagen codegraph status             # each local graph with its pin, build state, and pending jobs
+oxagen codegraph rebuild [path]     # build a fresh copy from the working tree
+oxagen codegraph stop [path]        # stop watching and remove the MCP entries; --purge deletes the local tables
+oxagen codegraph upload --coverage "lcov=coverage/lcov.info"   # CI: send coverage, reports, profiles, dumps, plans, and specs
+```
+
+`init` needs an enrolled machine. The local graph never leaves the machine.
+`upload` runs in CI and signs in with the CI provider's OIDC token, so it
+needs no login. Its other flags are `--test-report`, `--runtime`,
+`--schema-dump`, `--infra-plan`, `--api-spec`, `--environment`, `--api-url`,
+and `--fail-on-unconnected`. Each file flag takes `source=pattern` lines and
+can repeat. See https://docs.oxagen.sh/docs/cli/code-graph.
+
 **Explain** — traces and audit
 
 ```bash
@@ -213,17 +225,8 @@ oxagen telemetry [on|off|status]    # anonymous usage telemetry (on by default)
 oxagen login / logout
 ```
 
-### Retired commands
-
-`sandbox`, `sandbox-template`, `code`, `eval`, `file-lock`, `a2a`, `models`,
-`skill`, `prompt`, `command`, `rules`, `settings`, `config`, `mcp`, `import`,
-`pr`, `recover`, `lineage`, plus the interactive surfaces (`view`, `agents`, `solve`,
-`replay`, `fleet`) and a bare `oxagen "<prompt>"`. Each prints a
-retirement notice and exits non-zero. Use the `stella` CLI instead.
-
-The CLI no longer reads `.oxagen/settings.json` — that file configured the
-local coding agent. The only project-local state it writes is
-`.oxagen/workspace.json` (the org + workspace binding `oxagen init` creates).
+The only project-local state the CLI writes is `.oxagen/workspace.json`, the
+org and workspace binding that `oxagen init` creates.
 
 ## Configuration