@pieai/pro-gov 0.5.2 → 0.5.4

package/dist/cli.js

@@ -3585,25 +3585,35 @@ import {
   statSync as statSync4,
   writeFileSync as writeFileSync7
 } from "node:fs";
+import { homedir } from "node:os";
 import { dirname as dirname12, join as join20, relative as relative8, resolve as resolve4, sep } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function inspectPortfolioAiHealth(options) {
   const endpoints = collectEndpoints(options.manifest);
   const secretsRoot = options.secretsRoot ?? join20(dirname12(options.manifest.controlPlane?.path ?? endpoints[0]?.endpoint.path ?? process.cwd()), ".secrets");
-  const homeDir = options.homeDir ?? process.env.HOME ?? "";
+  const homeDir = options.homeDir ?? process.env.HOME ?? homedir();
+  const grokVersion = commandVersion("grok");
   const executionEngineRoot = options.manifest.executionEngine?.path;
   const skillRegistry = inspectSkillRegistry(executionEngineRoot);
   const expectedPackageVersion = packageVersion(join20(executionEngineRoot ?? "", "packages/pro-gov/package.json"));
-  const repositories = endpoints.map(({ endpoint, role }) => inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion, options.manifest.technologyGovernance));
+  const repositories = endpoints.map(({ endpoint, role }) => inspectRepository(
+    endpoint,
+    role,
+    secretsRoot,
+    homeDir,
+    expectedPackageVersion,
+    options.manifest.technologyGovernance,
+    grokVersion
+  ));
   const summary = { healthy: 0, attention: 0, unhealthy: 0 };
   for (const repository of repositories) summary[repository.status] += 1;
   return {
-    schemaVersion: 1,
+    schemaVersion: 2,
     portfolioId: options.manifest.portfolioId,
     generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-    privacy: "Names, paths, counts, and configuration structure only. Secret values, environment values, MCP commands, arguments, and MCP environment maps are never collected.",
+    privacy: "Names, paths, counts, scopes, and configuration origins only. Secret values, environment values, MCP commands, arguments, URLs, headers, and MCP environment maps are never retained or rendered.",
     secretsRoot: inspectSecretsRoot(secretsRoot),
-    userMcp: inspectUserMcp(homeDir),
+    hostEnvironment: inspectHostEnvironment(homeDir, grokVersion),
     skillRegistry,
     technologyGovernance: {
       strategySource: options.manifest.technologyGovernance?.strategySource,
@@ -3643,17 +3653,21 @@ function collectEndpoints(manifest) {
     return true;
   });
 }
-function inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion, technologyGovernance) {
+function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackageVersion, technologyGovernance, grokVersion) {
   const root = endpoint.path;
   const git = inspectGit2(root);
   const entries = inspectEntries(root);
-  const skills = inspectSkills(root);
+  const grokInspection = inspectGrokProject(root, homeDir, grokVersion);
+  const skills = inspectSkills(root, grokInspection);
   const hooks = inspectHooks(root);
   const docs = inspectDocs(root, role === "execution-engine" ? void 0 : expectedPackageVersion);
   const mcp = {
-    root: jsonObjectKeys(join20(root, ".mcp.json"), "mcpServers"),
-    claudeCode: jsonObjectKeys(join20(root, ".claude/settings.json"), "mcpServers"),
-    codex: tomlMcpNames(join20(root, ".codex/config.toml"))
+    codexProject: tomlMcpNames(join20(root, ".codex/config.toml")),
+    claudeCodeProjectShared: jsonObjectKeys(join20(root, ".mcp.json"), "mcpServers"),
+    claudeCodeProjectLocal: claudeProjectLocalMcpNames(homeDir, root),
+    grokProject: tomlMcpNames(join20(root, ".grok/config.toml")),
+    grokEffective: grokInspection.effectiveMcp,
+    grokInspection: grokInspection.inspection
   };
   const secrets = inspectRepositorySecrets(root, endpoint.id, secretsRoot, git.isRepository, endpoint.environmentPolicy);
   const projectModel = inspectProjectModel(root, endpoint, technologyGovernance);
@@ -3694,7 +3708,7 @@ function inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion,
     role,
     path: root,
     profile: "profile" in endpoint ? endpoint.profile : void 0,
-    status: deriveStatus(entries, git, hooks, skills, secrets, projectModel, Boolean(technologyGovernance)),
+    status: deriveStatus(role, entries, git, hooks, skills, secrets, docs, projectModel, Boolean(technologyGovernance)),
     recommendations,
     git,
     entries,
@@ -3706,13 +3720,15 @@ function inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion,
     projectModel
   };
 }
-function deriveStatus(entries, git, hooks, skills, secrets, projectModel, technologyGovernanceConfigured) {
+function deriveStatus(role, entries, git, hooks, skills, secrets, docs, projectModel, technologyGovernanceConfigured) {
   if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || skills.canonical.some((item) => item.kind === "dangling-symlink") || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template && !file.fixture) || hasUnsafeCentralSecretPermissions(secrets)) return "unhealthy";
   const missingBaseline = projectModel.baseline.some((technology) => !technology.detected && !hasBaselineException(projectModel, technology.id));
   const missingSelected = projectModel.optionalCapabilities.some((technology) => technology.selected && !technology.detected);
   const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template && !file.fixture);
   const secretMaterializationNeedsReview = liveEnv.some((file) => !file.centralized && !file.localOnly);
-  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected) return "attention";
+  const packageVersionNeedsReview = docs.packages.expected !== void 0 && !docs.packages.aligned;
+  const targetManifestMissing = role === "target" && !docs.manifest;
+  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected || packageVersionNeedsReview || targetManifestMissing) return "attention";
   return "healthy";
 }
 function inspectProjectModel(root, endpoint, governance) {
@@ -3819,7 +3835,7 @@ function inspectOptionalEntry(root, filename, agentsPath) {
   const content = safeRead(path);
   return /AGENTS\.md/.test(content) && content.length < 2e3 ? "thin-adapter" : "custom";
 }
-function inspectSkills(root) {
+function inspectSkills(root, grokInspection) {
   const lock = readJson3(join20(root, ".pro-gov/assets.lock.json"));
   const managed = /* @__PURE__ */ new Set();
   const bundleIds = stringArray(isRecord3(lock) ? lock.bundleIds : void 0);
@@ -3855,6 +3871,12 @@ function inspectSkills(root) {
       installed: canonical.filter((item) => item.managed && item.kind !== "dangling-symlink").length,
       discoverable: canonical.filter((item) => item.kind !== "dangling-symlink").length,
       runtime: "unobservable"
+    },
+    hosts: {
+      codexProject: canonical.filter((item) => item.kind !== "dangling-symlink").length,
+      claudeCodeProject: inspectSkillRoot(join20(root, ".claude/skills")).names.length,
+      grokNativeProject: inspectSkillRoot(join20(root, ".grok/skills")).names.length,
+      grokEffective: grokInspection.skills
     }
   };
 }
@@ -3965,13 +3987,147 @@ function hasUnsafeCentralSecretPermissions(secrets) {
 function inspectSecretsRoot(path) {
   return existsSync21(path) ? { path, exists: true, mode: modeString(statSync4(path).mode) } : { path, exists: false };
 }
-function inspectUserMcp(homeDir) {
-  if (!homeDir) return { codex: [], claudeCode: [] };
+function inspectHostEnvironment(homeDir, grokVersion) {
+  const codexConfig = join20(homeDir, ".codex/config.toml");
+  const claudeConfig = join20(homeDir, ".claude.json");
+  const grokConfig = join20(homeDir, ".grok/config.toml");
   return {
-    codex: tomlMcpNames(join20(homeDir, ".codex/config.toml")),
-    claudeCode: jsonObjectKeys(join20(homeDir, ".claude/settings.json"), "mcpServers")
+    mcp: {
+      codexUser: { path: codexConfig, names: tomlMcpNames(codexConfig) },
+      claudeCodeUser: { path: claudeConfig, names: jsonObjectKeys(claudeConfig, "mcpServers") },
+      grokUser: { path: grokConfig, names: tomlMcpNames(grokConfig) }
+    },
+    skills: {
+      codexUser: inspectSkillRoot(join20(homeDir, ".agents/skills")),
+      claudeCodeUser: inspectSkillRoot(join20(homeDir, ".claude/skills")),
+      grokUser: inspectSkillRoot(join20(homeDir, ".grok/skills")),
+      grokAgentsCompatibility: inspectSkillRoot(join20(homeDir, ".agents/skills")),
+      grokClaudeCompatibility: inspectSkillRoot(join20(homeDir, ".claude/skills"))
+    },
+    grok: {
+      available: grokVersion !== void 0,
+      ...grokVersion ? { version: grokVersion } : {},
+      inspectionCommand: "grok inspect --json"
+    }
   };
 }
+function inspectSkillRoot(path) {
+  const exists = pathLexists(path) && safeIsDirectory(path);
+  const names = exists ? safeReadDir(path).filter((name) => !name.startsWith(".") && existsSync21(join20(path, name, "SKILL.md"))) : [];
+  return { path, exists, names };
+}
+function claudeProjectLocalMcpNames(homeDir, root) {
+  if (!homeDir) return [];
+  const value = readJson3(join20(homeDir, ".claude.json"));
+  if (!isRecord3(value) || !isRecord3(value.projects)) return [];
+  const candidates = new Set([resolve4(root), safeRealpath(root)].filter((path) => Boolean(path)));
+  const names = /* @__PURE__ */ new Set();
+  for (const [path, project] of Object.entries(value.projects)) {
+    const projectPaths = [resolve4(path), safeRealpath(path)].filter((candidate) => Boolean(candidate));
+    if (!projectPaths.some((candidate) => candidates.has(candidate)) || !isRecord3(project) || !isRecord3(project.mcpServers)) continue;
+    for (const name of Object.keys(project.mcpServers)) names.add(name);
+  }
+  return [...names].sort();
+}
+function commandVersion(command2) {
+  try {
+    const output = execFileSync(command2, ["version"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 3e3
+    });
+    return output.match(/\b\d+\.\d+\.\d+\b/)?.[0];
+  } catch {
+    return void 0;
+  }
+}
+function inspectGrokProject(root, homeDir, grokVersion) {
+  const empty = (inspection) => ({
+    inspection,
+    effectiveMcp: [],
+    skills: { inspection, total: 0, project: 0, userOrCompatible: 0, plugin: 0, bundled: 0 },
+    claudeCompatibility: "unknown",
+    cursorCompatibility: "unknown"
+  });
+  if (!grokVersion) return empty("unavailable");
+  try {
+    const value = JSON.parse(execFileSync("grok", ["inspect", "--json"], {
+      cwd: root,
+      encoding: "utf8",
+      env: { ...process.env, HOME: homeDir, GROK_HOME: join20(homeDir, ".grok") },
+      maxBuffer: 10 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 8e3
+    }));
+    if (!isRecord3(value)) return empty("failed");
+    const userClaudeNames = new Set(jsonObjectKeys(join20(homeDir, ".claude.json"), "mcpServers"));
+    const localClaudeNames = new Set(claudeProjectLocalMcpNames(homeDir, root));
+    const effectiveMcp = Array.isArray(value.mcpServers) ? value.mcpServers.flatMap((item) => {
+      if (!isRecord3(item) || typeof item.name !== "string") return [];
+      const source = isRecord3(item.source) ? item.source : {};
+      const sourceType = typeof source.type === "string" ? source.type : "unknown";
+      const sourcePath = typeof source.path === "string" ? source.path : void 0;
+      const vendor = typeof item.vendor === "string" ? item.vendor : sourceType;
+      return [{
+        name: item.name,
+        vendor,
+        scope: inferGrokMcpScope(item.name, sourceType, sourcePath, root, homeDir, userClaudeNames, localClaudeNames),
+        sourceType,
+        ...sourcePath ? { sourcePath } : {}
+      }];
+    }) : [];
+    const skillCounts = { project: 0, userOrCompatible: 0, plugin: 0, bundled: 0 };
+    if (Array.isArray(value.skills)) {
+      for (const item of value.skills) {
+        if (!isRecord3(item) || !isRecord3(item.source)) continue;
+        const type = item.source.type;
+        const path = item.source.path;
+        if (typeof path === "string" && path.includes(sep + ".grok" + sep + "bundled" + sep)) skillCounts.bundled += 1;
+        else if (type === "project") skillCounts.project += 1;
+        else if (type === "plugin") skillCounts.plugin += 1;
+        else skillCounts.userOrCompatible += 1;
+      }
+    }
+    const cells = isRecord3(value.externalCompat) && Array.isArray(value.externalCompat.cells) ? value.externalCompat.cells : [];
+    return {
+      inspection: "ok",
+      effectiveMcp,
+      skills: {
+        inspection: "ok",
+        total: skillCounts.project + skillCounts.userOrCompatible + skillCounts.plugin + skillCounts.bundled,
+        ...skillCounts
+      },
+      claudeCompatibility: compatibilityEnabled(cells, "claude"),
+      cursorCompatibility: compatibilityEnabled(cells, "cursor")
+    };
+  } catch {
+    return empty("failed");
+  }
+}
+function compatibilityEnabled(cells, vendor) {
+  const matching = cells.filter((cell) => isRecord3(cell) && cell.vendor === vendor);
+  if (matching.length === 0) return "unknown";
+  return matching.some((cell) => isRecord3(cell) && cell.enabled === true);
+}
+function inferGrokMcpScope(name, sourceType, sourcePath, root, homeDir, userClaudeNames, localClaudeNames) {
+  if (!sourcePath) {
+    if (sourceType === "project") return "project";
+    if (localClaudeNames.has(name)) return "project-local";
+    if (userClaudeNames.has(name)) return "user";
+    return "unknown";
+  }
+  const resolvedSource = safeRealpath(sourcePath) ?? resolve4(sourcePath);
+  const resolvedRoot = safeRealpath(root) ?? resolve4(root);
+  if (resolvedSource === join20(resolvedRoot, ".mcp.json")) return "project-shared";
+  if (resolvedSource.startsWith(resolvedRoot + sep)) return "project";
+  if (homeDir && resolvedSource === join20(resolve4(homeDir), ".claude.json")) {
+    if (localClaudeNames.has(name)) return "project-local";
+    if (userClaudeNames.has(name)) return "user";
+  }
+  if (homeDir && resolvedSource.startsWith(resolve4(homeDir) + sep)) return "user";
+  if (sourceType === "project") return "project";
+  return "unknown";
+}
 var HOOK_EVENT_NAMES = /* @__PURE__ */ new Set([
   "PreToolUse",
   "PostToolUse",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pieai/pro-gov",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Project-level distribution kit for Project Governance System.",
   "keywords": [
     "ai-agents",
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pieai/doc-gov": "^0.5.2"
+    "@pieai/doc-gov": "^0.5.4"
   },
   "devDependencies": {
     "@pieai/swimmer-ui-kit": "1.0.1",