@praneeth_54/agentdoctor 1.1.1 → 2.0.1

package/dist/cli/commands/policy-graph-run.js

@@ -0,0 +1,200 @@
+import { evaluateAgentAction, EVALUATE_ONLY } from "../../platform/firewall/evaluate.js";
+import { runControlledCommand } from "../../enforcement/runner.js";
+import { graphBuild, graphRebuild, graphStatus, graphUpdate, } from "../../intelligence/graph/incremental.js";
+import { buildIntelligenceGraph } from "../../intelligence/graph/build.js";
+import { EXIT_CODES } from "../../types/index.js";
+function emit(json, value, human) {
+    if (json) {
+        process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+    }
+    else {
+        process.stdout.write(`${human}\n`);
+    }
+}
+export async function runGraphSurfaceCommand(options) {
+    try {
+        const mode = options.mode ?? "auto";
+        if (options.action === "status") {
+            const status = await graphStatus({ root: options.root });
+            emit(Boolean(options.json), status, [
+                `Graph index ${status.present ? "present" : "missing"}`,
+                `  path: ${status.path}`,
+                `  nodes=${status.nodeCount} edges=${status.edgeCount} files=${status.fileCount}`,
+                `  builder=${status.builder ?? "n/a"}`,
+                `  stale=${status.staleFiles.length} missing=${status.missingFiles.length}`,
+                status.corrupt ? `  corrupt: ${status.error}` : "",
+            ]
+                .filter(Boolean)
+                .join("\n"));
+            return EXIT_CODES.SUCCESS;
+        }
+        if (options.action === "update") {
+            const result = await graphUpdate({ root: options.root, mode });
+            emit(Boolean(options.json), result, `graph update rebuilt=${result.rebuilt} reason=${result.reason} changed=${result.changedFiles.length} nodes=${result.snapshot.nodes.length}`);
+            return EXIT_CODES.SUCCESS;
+        }
+        if (options.action === "rebuild") {
+            const result = await graphRebuild({ root: options.root, mode });
+            emit(Boolean(options.json), result, `graph rebuild nodes=${result.snapshot.nodes.length} edges=${result.snapshot.edges.length} builder=${result.snapshot.builder}`);
+            return EXIT_CODES.SUCCESS;
+        }
+        // build / show (backward-compat one-shot)
+        if (options.action === "show") {
+            const graph = await buildIntelligenceGraph({ root: options.root, mode });
+            emit(Boolean(options.json), graph, `graph builder=${graph.builder} nodes=${graph.nodes.length} edges=${graph.edges.length} astFiles=${graph.astFilesParsed}`);
+            return EXIT_CODES.SUCCESS;
+        }
+        const result = await graphBuild({ root: options.root, mode });
+        emit(Boolean(options.json), result, `graph build nodes=${result.snapshot.nodes.length} edges=${result.snapshot.edges.length} builder=${result.snapshot.builder} path=${result.path}`);
+        return EXIT_CODES.SUCCESS;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`Error: ${message}\n`);
+        return EXIT_CODES.INTERNAL_ERROR;
+    }
+}
+export async function runPolicyCheckCommand(options) {
+    try {
+        const verdict = await evaluateAgentAction(options.root, {
+            actionId: `policy-check-${Date.now()}`,
+            agentId: "cli",
+            timestamp: new Date().toISOString(),
+            type: "shell",
+            params: { command: options.command },
+            repositoryRoot: options.root,
+        }, { failClosed: options.failClosed === true });
+        emit(Boolean(options.json), { ...verdict, notice: EVALUATE_ONLY }, `policy check decision=${verdict.decision} risk=${verdict.riskLevel}\n  ${verdict.reason}\n  ${EVALUATE_ONLY}`);
+        return EXIT_CODES.SUCCESS;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`Error: ${message}\n`);
+        return EXIT_CODES.INTERNAL_ERROR;
+    }
+}
+export async function runPolicyExplainCommand(options) {
+    try {
+        const verdict = await evaluateAgentAction(options.root, {
+            actionId: `policy-explain-${Date.now()}`,
+            agentId: "cli",
+            timestamp: new Date().toISOString(),
+            type: "shell",
+            params: { command: options.command },
+            repositoryRoot: options.root,
+        }, { failClosed: options.failClosed === true });
+        const explanation = {
+            command: options.command,
+            decision: verdict.decision,
+            reason: verdict.reason,
+            policyId: verdict.policyId ?? null,
+            riskLevel: verdict.riskLevel,
+            approvalStatus: verdict.approvalStatus,
+            executionResult: verdict.executionResult,
+            notice: EVALUATE_ONLY,
+            meaning: verdict.decision === "allow"
+                ? "Allowlisted or matched an allow rule — still evaluate-only unless agentdoctor run / enforce --execute is used."
+                : verdict.decision === "block" || verdict.decision === "deny-network"
+                    ? "Would be blocked by AgentDoctor-controlled runner if executed through it."
+                    : "Requires human approval or further policy before controlled execution.",
+        };
+        emit(Boolean(options.json), explanation, [
+            `policy explain: ${options.command}`,
+            `  decision: ${verdict.decision}`,
+            `  policyId: ${verdict.policyId ?? "n/a"}`,
+            `  risk: ${verdict.riskLevel}`,
+            `  reason: ${verdict.reason}`,
+            `  ${explanation.meaning}`,
+        ].join("\n"));
+        return EXIT_CODES.SUCCESS;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`Error: ${message}\n`);
+        return EXIT_CODES.INTERNAL_ERROR;
+    }
+}
+export async function runPolicyEnforceCommand(options) {
+    try {
+        const result = await runControlledCommand({
+            root: options.root,
+            command: options.command,
+            executeIfAllowed: options.execute === true,
+            failClosed: options.failClosed === true,
+        });
+        emit(Boolean(options.json), result, [
+            `policy enforce decision=${result.decision.decision} status=${result.decision.executionStatus}`,
+            `  enforced=${result.enforced}`,
+            `  ${result.notice}`,
+        ].join("\n"));
+        return EXIT_CODES.SUCCESS;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`Error: ${message}\n`);
+        return EXIT_CODES.INTERNAL_ERROR;
+    }
+}
+export async function runRunExplainCommand(options) {
+    try {
+        const { explainControlledRun } = await import("../../enforcement/runner.js");
+        const explanation = await explainControlledRun({
+            root: options.root,
+            command: options.command,
+            failClosed: options.failClosed === true,
+            useShell: options.shell === true,
+        });
+        emit(Boolean(options.json), explanation, [
+            `run explain: ${explanation.command}`,
+            `  decision: ${explanation.decision}`,
+            `  policyId: ${explanation.policyId ?? "n/a"}`,
+            `  risk: ${explanation.riskLevel}`,
+            `  wouldExecute: ${explanation.wouldExecute}`,
+            `  ${explanation.meaning}`,
+            `  ${explanation.notice}`,
+        ].join("\n"));
+        return EXIT_CODES.SUCCESS;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`Error: ${message}\n`);
+        return EXIT_CODES.INTERNAL_ERROR;
+    }
+}
+export async function runRunCommand(options) {
+    try {
+        if (!options.argv.length) {
+            process.stderr.write("Error: provide a command after -- (e.g. agentdoctor run -- npm --version)\n");
+            return EXIT_CODES.USAGE_ERROR;
+        }
+        const result = await runControlledCommand({
+            root: options.root,
+            argv: options.argv,
+            executeIfAllowed: true,
+            useShell: options.shell === true,
+            ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
+            failClosed: options.failClosed === true,
+        });
+        emit(Boolean(options.json), result, [
+            `run decision=${result.decision.decision} status=${result.decision.executionStatus}`,
+            `  exitCode=${result.exitCode ?? "n/a"} durationMs=${result.durationMs ?? "n/a"}`,
+            `  ${result.notice}`,
+            result.stdout ? `--- stdout ---\n${result.stdout}` : "",
+            result.stderr ? `--- stderr ---\n${result.stderr}` : "",
+        ]
+            .filter(Boolean)
+            .join("\n"));
+        if (result.decision.executionStatus === "blocked-by-enforcement") {
+            return EXIT_CODES.ISSUES_OR_THRESHOLD;
+        }
+        if (result.decision.executionStatus === "execution-failed") {
+            return EXIT_CODES.INTERNAL_ERROR;
+        }
+        return EXIT_CODES.SUCCESS;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`Error: ${message}\n`);
+        return EXIT_CODES.INTERNAL_ERROR;
+    }
+}

package/dist/cli/commands/v2.d.ts

@@ -0,0 +1,55 @@
+import { type ExitCode } from "../../types/index.js";
+export declare function runChangesCommand(options: {
+    root?: string;
+    since?: string;
+    impact?: boolean;
+    json?: boolean;
+}): Promise<ExitCode>;
+export declare function runContextHealthCommand(options: {
+    root?: string;
+    json?: boolean;
+}): Promise<ExitCode>;
+export declare function runSecretsCommand(options: {
+    root?: string;
+    json?: boolean;
+}): Promise<ExitCode>;
+export declare function runFixUndoCommand(options: {
+    root?: string;
+    auditId: string;
+}): Promise<ExitCode>;
+export declare function runFixHistoryCommand(options: {
+    root?: string;
+    json?: boolean;
+}): Promise<ExitCode>;
+export declare function runBaselineCommand(options: {
+    action: "save" | "list" | "diff" | "delete" | "trends";
+    name?: string;
+    root?: string;
+    json?: boolean;
+}): Promise<ExitCode>;
+export declare function runPackagesCommand(options: {
+    root?: string;
+    json?: boolean;
+    scan?: boolean;
+}): Promise<ExitCode>;
+export declare function runPrReviewCommand(options: {
+    root?: string;
+    base?: string;
+    json?: boolean;
+}): Promise<ExitCode>;
+export declare function runDashboardCommand(options: {
+    root?: string;
+    host?: string;
+    port?: number;
+    allowNonLoopback?: boolean;
+}): Promise<ExitCode>;
+export declare function runPluginsCommand(options: {
+    root?: string;
+    json?: boolean;
+    run?: boolean;
+}): Promise<ExitCode>;
+export declare function runLocalAiCommand(options: {
+    provider?: string;
+    prompt?: string;
+    json?: boolean;
+}): Promise<ExitCode>;

package/dist/cli/commands/v2.js

@@ -0,0 +1,278 @@
+import { EXIT_CODES } from "../../types/index.js";
+import { resolveRepoRoot } from "../../utils/path.js";
+import { analyzeChanges } from "../../core/changes/analyze.js";
+import { analyzeContextHealth } from "../../core/context-health/analyze.js";
+import { scanSecrets } from "../../core/secrets/scan.js";
+import { listFixAudits, undoFix } from "../../core/fix/backup.js";
+import { baselineFromScan, compareToBaseline, computeBaselineTrends, deleteNamedBaseline, listNamedBaselines, loadNamedBaseline, saveNamedBaseline, } from "../../core/baseline/store.js";
+import { detectMonorepo } from "../../core/monorepo/detect.js";
+import { analyzePullRequest } from "../../integrations/github/pr-analyze.js";
+import { startDashboardServer } from "../../dashboard/server.js";
+import { discoverPlugins } from "../../plugins/sdk.js";
+import { runPluginAnalyzers } from "../../plugins/runtime.js";
+import { createLocalAiProvider, } from "../../integrations/local-ai/provider.js";
+import { scan } from "../../core/scanner/scan.js";
+function printJson(value) {
+    process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+export async function runChangesCommand(options) {
+    const root = resolveRepoRoot(options.root ?? process.cwd());
+    const report = await analyzeChanges({
+        root,
+        ...(options.since ? { since: options.since } : {}),
+        impact: options.impact === true,
+    });
+    if (options.json) {
+        printJson(report);
+    }
+    else {
+        process.stdout.write(`Changes (${report.gitAvailable ? "git" : "no-git"})\n  files: ${report.files.length}\n  added: ${report.summary.added} modified: ${report.summary.modified} deleted: ${report.summary.deleted}\n`);
+        for (const f of report.files.slice(0, 40)) {
+            const mods = f.modules?.length ? `  modules=${f.modules.join(",")}` : "";
+            process.stdout.write(`  ${f.staged ? "S" : " "} ${f.kind.padEnd(10)} ${f.path}${mods}\n`);
+        }
+        if (report.impact) {
+            process.stdout.write(`Impact: ${report.impact.status} — ${report.impact.reason}\n  edges: ${report.impact.edges.length}\n`);
+        }
+    }
+    return EXIT_CODES.SUCCESS;
+}
+export async function runContextHealthCommand(options) {
+    const root = resolveRepoRoot(options.root ?? process.cwd());
+    const report = await analyzeContextHealth(root);
+    if (options.json)
+        printJson(report);
+    else {
+        process.stdout.write(`Context health\n  instruction files: ${report.instructionFiles.length}\n  conflicts: ${report.conflicts.length}\n`);
+        for (const c of report.conflicts) {
+            process.stdout.write(`  [${c.severity}] ${c.kind}: ${c.message}\n`);
+        }
+    }
+    return EXIT_CODES.SUCCESS;
+}
+export async function runSecretsCommand(options) {
+    const root = resolveRepoRoot(options.root ?? process.cwd());
+    const report = await scanSecrets({ root, enabled: true });
+    if (options.json)
+        printJson(report);
+    else {
+        process.stdout.write(`Secret scan (opt-in)\n  files: ${report.filesScanned}\n  findings: ${report.findings.length}\n`);
+        for (const f of report.findings.slice(0, 30)) {
+            process.stdout.write(`  [${f.severity}] ${f.ruleId} ${f.file}:${f.line} ${f.redactedSnippet}\n`);
+        }
+    }
+    return report.findings.some((f) => f.severity === "critical")
+        ? EXIT_CODES.ISSUES_OR_THRESHOLD
+        : EXIT_CODES.SUCCESS;
+}
+export async function runFixUndoCommand(options) {
+    try {
+        const record = await undoFix({
+            root: resolveRepoRoot(options.root ?? process.cwd()),
+            auditId: options.auditId,
+        });
+        process.stdout.write(`Undid Safe Fix audit ${options.auditId} → undo audit ${record.id}\n`);
+        return EXIT_CODES.SUCCESS;
+    }
+    catch (error) {
+        console.error(`Error: ${error instanceof Error ? error.message : String(error)}`);
+        return EXIT_CODES.INTERNAL_ERROR;
+    }
+}
+export async function runFixHistoryCommand(options) {
+    const audits = await listFixAudits(resolveRepoRoot(options.root ?? process.cwd()));
+    if (options.json)
+        printJson({ audits });
+    else if (audits.length === 0)
+        process.stdout.write("No Safe Fix audits yet.\n");
+    else {
+        for (const a of audits) {
+            process.stdout.write(`${a.id}  ${a.mode}  ${a.createdAt}  entries=${a.entries.length}\n`);
+        }
+    }
+    return EXIT_CODES.SUCCESS;
+}
+export async function runBaselineCommand(options) {
+    const root = resolveRepoRoot(options.root ?? process.cwd());
+    try {
+        if (options.action === "list") {
+            const names = await listNamedBaselines(root);
+            if (options.json)
+                printJson({ baselines: names });
+            else
+                process.stdout.write(names.length ? `${names.join("\n")}\n` : "No named baselines.\n");
+            return EXIT_CODES.SUCCESS;
+        }
+        if (options.action === "trends") {
+            const trends = await computeBaselineTrends(root);
+            if (options.json)
+                printJson(trends);
+            else if (trends.points.length === 0) {
+                process.stdout.write("No baselines for trends.\n");
+            }
+            else {
+                for (const p of trends.points) {
+                    process.stdout.write(`${p.createdAt}  ${p.name}  total=${p.counts.total} critical=${p.counts.critical}\n`);
+                }
+                for (const d of trends.deltas) {
+                    process.stdout.write(`  Δ ${d.from}→${d.to}: total ${d.totalDelta >= 0 ? "+" : ""}${d.totalDelta}, critical ${d.criticalDelta >= 0 ? "+" : ""}${d.criticalDelta}\n`);
+                }
+            }
+            return EXIT_CODES.SUCCESS;
+        }
+        if (options.action === "save") {
+            if (!options.name) {
+                console.error("Error: --name required");
+                return EXIT_CODES.USAGE_ERROR;
+            }
+            const result = await scan({ cwd: root });
+            const baseline = baselineFromScan(options.name, result);
+            const file = await saveNamedBaseline(root, baseline);
+            process.stdout.write(`Saved baseline ${options.name} → ${file}\n`);
+            return EXIT_CODES.SUCCESS;
+        }
+        if (options.action === "delete") {
+            if (!options.name) {
+                console.error("Error: --name required");
+                return EXIT_CODES.USAGE_ERROR;
+            }
+            await deleteNamedBaseline(root, options.name);
+            process.stdout.write(`Deleted baseline ${options.name}\n`);
+            return EXIT_CODES.SUCCESS;
+        }
+        if (options.action === "diff") {
+            if (!options.name) {
+                console.error("Error: --name required");
+                return EXIT_CODES.USAGE_ERROR;
+            }
+            const baseline = await loadNamedBaseline(root, options.name);
+            if (!baseline) {
+                console.error(`Error: baseline not found: ${options.name}`);
+                return EXIT_CODES.USAGE_ERROR;
+            }
+            const result = await scan({ cwd: root });
+            const diff = compareToBaseline(baseline, result.findings);
+            if (options.json)
+                printJson(diff);
+            else {
+                process.stdout.write(`Baseline ${diff.name}\n  added: ${diff.added.length}\n  removed: ${diff.removed.length}\n  recurring: ${diff.recurring.length}\n  unchanged: ${diff.unchanged}\n`);
+            }
+            return EXIT_CODES.SUCCESS;
+        }
+        return EXIT_CODES.USAGE_ERROR;
+    }
+    catch (error) {
+        console.error(`Error: ${error instanceof Error ? error.message : String(error)}`);
+        return EXIT_CODES.USAGE_ERROR;
+    }
+}
+export async function runPackagesCommand(options) {
+    const root = resolveRepoRoot(options.root ?? process.cwd());
+    const mono = await detectMonorepo(root);
+    if (!options.scan) {
+        if (options.json)
+            printJson(mono);
+        else {
+            process.stdout.write(`Monorepo: ${mono.isMonorepo ? "yes" : "no"} (${mono.tool})\n  packages: ${mono.packages.length}\n`);
+            for (const p of mono.packages) {
+                process.stdout.write(`  - ${p.name} (${p.relativePath})\n`);
+            }
+        }
+        return EXIT_CODES.SUCCESS;
+    }
+    const packageScans = [];
+    for (const pkg of mono.packages) {
+        const result = await scan({ cwd: pkg.absolutePath });
+        packageScans.push({
+            name: pkg.name,
+            path: pkg.relativePath,
+            summary: result.summary,
+            overall: result.scores?.overall ?? null,
+        });
+    }
+    if (options.json)
+        printJson({ monorepo: mono, packageScans });
+    else {
+        for (const p of packageScans) {
+            process.stdout.write(`${p.name}: score=${p.overall} findings=${p.summary.total} (c=${p.summary.critical} w=${p.summary.warning})\n`);
+        }
+    }
+    return EXIT_CODES.SUCCESS;
+}
+export async function runPrReviewCommand(options) {
+    const report = await analyzePullRequest({
+        root: resolveRepoRoot(options.root ?? process.cwd()),
+        dryRun: true,
+        ...(options.base ? { baseRef: options.base } : {}),
+    });
+    if (options.json)
+        printJson(report);
+    else {
+        process.stdout.write(report.commentMarkdown);
+        process.stdout.write("\n(posted=false; local dry-run only)\n");
+    }
+    return EXIT_CODES.SUCCESS;
+}
+export async function runDashboardCommand(options) {
+    try {
+        const server = await startDashboardServer({
+            root: resolveRepoRoot(options.root ?? process.cwd()),
+            host: options.host ?? "127.0.0.1",
+            port: options.port ?? 8787,
+            readOnly: true,
+            allowNonLoopback: options.allowNonLoopback === true,
+        });
+        if (options.allowNonLoopback) {
+            process.stderr.write("WARNING: dashboard bound outside loopback with --allow-non-loopback. Local ?user= roles are not authentication.\n");
+        }
+        process.stdout.write(`AgentDoctor dashboard (read-only) at http://${server.host}:${server.port}/\nLocal ?user= is not authentication. Press Ctrl+C to stop.\n`);
+        await new Promise(() => {
+            /* keep process alive until signal */
+        });
+        return EXIT_CODES.SUCCESS;
+    }
+    catch (error) {
+        console.error(`Error: ${error instanceof Error ? error.message : String(error)}`);
+        return EXIT_CODES.USAGE_ERROR;
+    }
+}
+export async function runPluginsCommand(options) {
+    const root = resolveRepoRoot(options.root ?? process.cwd());
+    const plugins = await discoverPlugins(root);
+    const analyzerResults = options.run ? await runPluginAnalyzers(root) : undefined;
+    if (options.json) {
+        printJson({ plugins, ...(analyzerResults ? { analyzerResults } : {}) });
+    }
+    else if (plugins.length === 0) {
+        process.stdout.write("No plugins discovered under .agentdoctor/plugins/\n");
+    }
+    else {
+        for (const p of plugins) {
+            process.stdout.write(`${p.ok ? "ok" : "ERR"}  ${p.manifest.id}@${p.manifest.version}  caps=${p.manifest.capabilities.join(",")}\n`);
+            for (const e of p.errors)
+                process.stdout.write(`    ${e}\n`);
+        }
+        if (analyzerResults) {
+            for (const r of analyzerResults) {
+                process.stdout.write(`run ${r.ok ? "ok" : "ERR"}  ${r.pluginId}  notes=${r.notes.length}${r.error ? `  ${r.error}` : ""}\n`);
+            }
+        }
+    }
+    return EXIT_CODES.SUCCESS;
+}
+export async function runLocalAiCommand(options) {
+    const id = (options.provider ?? "none");
+    const provider = createLocalAiProvider(id === "mock" || id === "ollama" || id === "none" ? id : "none");
+    const response = await provider.generate({
+        prompt: options.prompt ?? "Summarize repository agent readiness.",
+        context: [],
+        maxTokens: 128,
+        timeoutMs: 3000,
+    });
+    if (options.json)
+        printJson(response);
+    else {
+        process.stdout.write(`provider=${response.provider} aiGenerated=${response.aiGenerated}\n${response.text || response.error || "(empty)"}\n`);
+    }
+    return EXIT_CODES.SUCCESS;
+}

package/dist/cli/commands/workspace.d.ts

@@ -0,0 +1,9 @@
+export declare function runWorkspaceCommand(options: {
+    action: "init" | "add" | "list" | "status" | "remove";
+    root: string;
+    name?: string;
+    id?: string;
+    repositoryRoot?: string;
+    allowCrossRead?: boolean;
+    json?: boolean;
+}): Promise<number>;

package/dist/cli/commands/workspace.js

@@ -0,0 +1,82 @@
+import { EXIT_CODES } from "../../types/index.js";
+import { addRepositoryToWorkspace, initWorkspace, listWorkspaces, removeWorkspace, workspaceStatus, } from "../../workspace/index.js";
+function emit(json, value, human) {
+    if (json) {
+        process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+    }
+    else {
+        process.stdout.write(`${human}\n`);
+    }
+}
+export async function runWorkspaceCommand(options) {
+    try {
+        const controlRoot = options.root;
+        switch (options.action) {
+            case "init": {
+                if (!options.name?.trim()) {
+                    process.stderr.write("Error: workspace init requires --name\n");
+                    return EXIT_CODES.USAGE_ERROR;
+                }
+                const ws = await initWorkspace({
+                    controlRoot,
+                    name: options.name,
+                    ...(options.id ? { id: options.id } : {}),
+                    ...(options.repositoryRoot ? { repositoryRoot: options.repositoryRoot } : {}),
+                    allowCrossRead: options.allowCrossRead === true,
+                });
+                emit(Boolean(options.json), ws, `workspace init id=${ws.id} name=${ws.name} roots=${ws.repositoryRoots.length} allowCrossRead=${ws.allowCrossRead}`);
+                return EXIT_CODES.SUCCESS;
+            }
+            case "add": {
+                if (!options.id?.trim() || !options.repositoryRoot?.trim()) {
+                    process.stderr.write("Error: workspace add requires --id and --repo\n");
+                    return EXIT_CODES.USAGE_ERROR;
+                }
+                const ws = await addRepositoryToWorkspace({
+                    controlRoot,
+                    workspaceId: options.id,
+                    repositoryRoot: options.repositoryRoot,
+                });
+                emit(Boolean(options.json), ws, `workspace add id=${ws.id} roots=${ws.repositoryRoots.join(", ")}`);
+                return EXIT_CODES.SUCCESS;
+            }
+            case "list": {
+                const list = await listWorkspaces(controlRoot);
+                emit(Boolean(options.json), { workspaces: list }, list.length === 0
+                    ? "No workspaces under .agentdoctor/workspaces/"
+                    : list
+                        .map((w) => `${w.id}\t${w.name}\troots=${w.repositoryRoots.length}\tcrossRead=${w.allowCrossRead}`)
+                        .join("\n"));
+                return EXIT_CODES.SUCCESS;
+            }
+            case "status": {
+                if (!options.id?.trim()) {
+                    process.stderr.write("Error: workspace status requires --id\n");
+                    return EXIT_CODES.USAGE_ERROR;
+                }
+                const status = await workspaceStatus(controlRoot, options.id);
+                emit(Boolean(options.json), status, status.ok
+                    ? `workspace ${options.id} ok roots=${status.workspace?.repositoryRoots.length ?? 0}`
+                    : `workspace ${options.id} ${status.error ?? "degraded"} missing=${status.missingRoots.join(", ") || "none"}`);
+                return status.ok ? EXIT_CODES.SUCCESS : EXIT_CODES.ISSUES_OR_THRESHOLD;
+            }
+            case "remove": {
+                if (!options.id?.trim()) {
+                    process.stderr.write("Error: workspace remove requires --id\n");
+                    return EXIT_CODES.USAGE_ERROR;
+                }
+                const removed = await removeWorkspace(controlRoot, options.id);
+                emit(Boolean(options.json), { removed, id: options.id }, removed ? `workspace removed ${options.id}` : `workspace not found ${options.id}`);
+                return removed ? EXIT_CODES.SUCCESS : EXIT_CODES.ISSUES_OR_THRESHOLD;
+            }
+            default:
+                process.stderr.write("Error: unknown workspace action\n");
+                return EXIT_CODES.USAGE_ERROR;
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`Error: ${message}\n`);
+        return EXIT_CODES.INTERNAL_ERROR;
+    }
+}