@prism-d1/cli 1.0.81 → 1.0.83

package/dist/assets/github-workflows/prism-ai-metrics.yml

@@ -86,8 +86,20 @@ jobs:
 
           # --- Commit SHAs: immutable facts for deferred origin resolution.
           # Capped at 50 to bound the event size and the render-time join.
-          COMMIT_SHAS=$(git rev-list "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null | head -50 | jq -R . | jq -sc . || echo '[]')
-          TOTAL_COMMITS=$(git rev-list --count "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null || echo 0)
+          #
+          # --no-merges matters here. HEAD_SHA is the PR's merge_commit_sha, so the
+          # range BASE..HEAD includes GitHub's own merge commit, authored by
+          # web-flow on GitHub's servers. codeburn attributes commits made on a
+          # developer's machine, so that commit can never appear in the attribution
+          # store. Counting it puts a structural ceiling on Attribution Coverage:
+          # a fully-onboarded team with 3 PRs and 9 authored commits reported
+          # 9 attributed / 12 seen = 75%, when the true coverage was 100%.
+          #
+          # Excluding every merge commit, not just GitHub's, is the right call for
+          # this pair: a merge commit introduces no authored lines, so it is not
+          # attributable content on either side of the ratio.
+          COMMIT_SHAS=$(git rev-list --no-merges "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null | head -50 | jq -R . | jq -sc . || echo '[]')
+          TOTAL_COMMITS=$(git rev-list --no-merges --count "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null || echo 0)
 
           # --- Lead time: PR open → merge. From the event payload, not git, so
           # it is unaffected by rebases and squashes.

package/dist/assets/github-workflows/prism-eval-gate-kiro.yml

@@ -262,14 +262,12 @@ jobs:
           REPO: ${{ github.repository }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
-          # Pre-flight: verify the specific subcommand exists (AWS CLI v2.36+)
-          if ! aws securityagent start-code-review-job help > /dev/null 2>&1; then
-            echo "::warning::AWS CLI lacks securityagent code review commands (need v2.36+). Skipping scan."
-            echo "findings=0" >> "$GITHUB_OUTPUT"
-            echo "skipped=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
+          # Config is read FIRST, on purpose. "Continuum was never deployed" is a
+          # deployment choice and may legitimately skip the scan; "Continuum is
+          # deployed but the scan could not run" is a failure and must block the
+          # merge. Probing the CLI before knowing which case we are in cannot tell
+          # them apart, so a missing subcommand used to silently pass the gate on a
+          # repo that had opted into scanning.
           AGENT_SPACE_ID=$(aws ssm get-parameter --name /prism/continuum/agent-space-id --query Parameter.Value --output text 2>/dev/null || echo "")
           SCAN_BUCKET=$(aws ssm get-parameter --name /prism/continuum/scan-bucket --query Parameter.Value --output text 2>/dev/null || echo "")
 
@@ -280,6 +278,16 @@ jobs:
             exit 0
           fi
 
+          # Continuum IS configured from here on, so every failure below fails
+          # closed: scan_error=true and findings=-1, never findings=0.
+          if ! aws securityagent start-code-review-job help > /dev/null 2>&1; then
+            echo "::error::Continuum is configured but this AWS CLI lacks the securityagent code review commands (need v2.36+)."
+            echo "  The security scan cannot run, so this PR is not verified. Upgrade the CLI in the workflow."
+            echo "scan_error=true" >> "$GITHUB_OUTPUT"
+            echo "findings=-1" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
           REPO_SLUG=$(echo "${REPO}" | tr '/' '-')
           CODE_REVIEW_ID=$(aws ssm get-parameter --name "/prism/continuum/code-review-id/${REPO_SLUG}" --query Parameter.Value --output text 2>/dev/null || echo "")
           if [ -z "$CODE_REVIEW_ID" ]; then
@@ -307,10 +315,10 @@ jobs:
             CODE_REVIEW_ID=$(echo "$CR_OUTPUT" | jq -r '.codeReviewId // empty' 2>/dev/null)
 
             if [ -z "$CODE_REVIEW_ID" ]; then
-              echo "::warning::Bootstrap failed: ${CR_OUTPUT}"
-              echo "  Run 'sudo prism-cli securityagent setup' from your DevBox to create manually."
-              echo "findings=0" >> "$GITHUB_OUTPUT"
-              echo "skipped=true" >> "$GITHUB_OUTPUT"
+              echo "::error::Could not create the Continuum Code Review resource: ${CR_OUTPUT}"
+              echo "  Run 'prism-cli securityagent setup' to create it manually."
+              echo "scan_error=true" >> "$GITHUB_OUTPUT"
+              echo "findings=-1" >> "$GITHUB_OUTPUT"
               exit 0
             fi
 
@@ -325,7 +333,13 @@ jobs:
           # Diff must be uploaded with .patch extension (API requirement)
           git diff "${BASE_SHA}..${HEAD_SHA}" > /tmp/changes.patch
           if [ ! -s /tmp/changes.patch ]; then
+            echo "No changes to scan."
+            # critical/high must be set explicitly. The gate tests
+            # `critical != '0'`, and an unset output is '', which is != '0' in a
+            # GitHub expression -- leaving them unset failed the gate on a no-op PR.
             echo "findings=0" >> "$GITHUB_OUTPUT"
+            echo "critical=0" >> "$GITHUB_OUTPUT"
+            echo "high=0" >> "$GITHUB_OUTPUT"
             exit 0
           fi
           DIFF_KEY="diffs/${REPO_SLUG}/${PR_NUMBER}/${HEAD_SHA}.patch"
@@ -350,18 +364,26 @@ jobs:
           done
 
           if [ "$STATUS" != "COMPLETED" ]; then
-            echo "::warning::Continuum scan did not complete (status: ${STATUS}) -- treating as skipped"
-            echo "findings=0" >> "$GITHUB_OUTPUT"
-            echo "skipped=true" >> "$GITHUB_OUTPUT"
+            echo "::error::Continuum scan did not complete (status: ${STATUS})."
+            echo "  An incomplete scan is not a clean scan -- failing closed. Re-run, or check the Continuum job logs."
+            echo "scan_error=true" >> "$GITHUB_OUTPUT"
+            echo "findings=-1" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
           # NOTE: list-findings takes agent-space-id + code-review-job-id only.
           # Response field is 'findingsSummaries', risk field is 'riskLevel'.
-          FINDINGS_JSON=$(aws securityagent list-findings \
+          # No `|| echo '{"findingsSummaries":[]}'` fallback: an API error there is
+          # indistinguishable from a clean scan, so it would pass the gate.
+          if ! FINDINGS_JSON=$(aws securityagent list-findings \
             --agent-space-id "${AGENT_SPACE_ID}" \
             --code-review-job-id "${JOB_ID}" \
-            --output json 2>/dev/null || echo '{"findingsSummaries":[]}')
+            --output json 2>&1); then
+            echo "::error::Continuum scan completed but its findings could not be retrieved: ${FINDINGS_JSON}"
+            echo "scan_error=true" >> "$GITHUB_OUTPUT"
+            echo "findings=-1" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
 
           TOTAL=$(echo "$FINDINGS_JSON" | jq '.findingsSummaries | length')
           CRITICAL=$(echo "$FINDINGS_JSON" | jq '[.findingsSummaries[] | select(.riskLevel == "CRITICAL")] | length')
@@ -443,7 +465,7 @@ jobs:
           fi
 
       - name: Fail on eval gate failure
-        if: ${{ steps.review.outputs.result == 'FAIL' || steps.review.outputs.result == 'ERROR' || (steps.security-gate.outputs.skipped != 'true' && (steps.security-gate.outputs.critical != '0' || steps.security-gate.outputs.high != '0')) }}
+        if: ${{ steps.review.outputs.result == 'FAIL' || steps.review.outputs.result == 'ERROR' || steps.security-gate.outputs.scan_error == 'true' || (steps.security-gate.outputs.skipped != 'true' && (steps.security-gate.outputs.critical != '0' || steps.security-gate.outputs.high != '0')) }}
         env:
           REVIEW_RESULT: ${{ steps.review.outputs.result }}
           REVIEW_HIGH: ${{ steps.review.outputs.high }}
@@ -451,6 +473,7 @@ jobs:
           REVIEW_SUMMARY: ${{ steps.review.outputs.summary }}
           SEC_CRITICAL: ${{ steps.security-gate.outputs.critical }}
           SEC_HIGH: ${{ steps.security-gate.outputs.high }}
+          SEC_SCAN_ERROR: ${{ steps.security-gate.outputs.scan_error }}
         run: |
           if [ "${REVIEW_RESULT}" = "ERROR" ]; then
             echo "❌ Eval gate failed closed: review output could not be parsed"
@@ -458,7 +481,10 @@ jobs:
             echo "❌ Kiro found ${REVIEW_HIGH:-?} high-severity issues (score: ${REVIEW_SCORE:-?})"
             echo "Summary: ${REVIEW_SUMMARY}"
           fi
-          if [ "${SEC_CRITICAL:-0}" -gt 0 ] || [ "${SEC_HIGH:-0}" -gt 0 ]; then
+          if [ "${SEC_SCAN_ERROR}" = "true" ]; then
+            echo "❌ Security gate failed closed: the Continuum scan produced no verdict."
+            echo "  This PR has NOT been security scanned. Re-run the workflow, or check the Continuum job logs."
+          elif [ "${SEC_CRITICAL:-0}" -gt 0 ] || [ "${SEC_HIGH:-0}" -gt 0 ]; then
             echo "❌ Continuum found ${SEC_CRITICAL:-0} critical, ${SEC_HIGH:-0} high security findings"
           fi
           exit 1

package/dist/assets/github-workflows/prism-eval-gate.yml

@@ -222,7 +222,7 @@ jobs:
             \"EventBusName\":\"prism-d1-metrics\",
             \"Detail\":$(echo "${EVAL_EVENT}" | jq -c '.' | jq -Rs '.')}]"
 
-      - name: Upgrade AWS CLI v2 (securityagent code review requires v2.35+)
+      - name: Upgrade AWS CLI v2 (securityagent code review requires v2.36+)
         run: |
           curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip
           curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip.sha256" -o /tmp/awscliv2.zip.sha256
@@ -240,14 +240,6 @@ jobs:
         env:
           AWS_REGION: us-west-2
         run: |
-          # Pre-flight: verify AWS CLI has securityagent subcommand
-          if ! aws securityagent start-code-review-job help > /dev/null 2>&1; then
-            echo "::warning::AWS CLI does not support 'securityagent code review' commands after upgrade. Skipping scan."
-            echo "findings=0" >> "$GITHUB_OUTPUT"
-            echo "skipped=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
           echo "::group::Retrieve Continuum config from SSM"
           AGENT_SPACE_ID=$(aws ssm get-parameter --name /prism/continuum/agent-space-id --query Parameter.Value --output text 2>/dev/null || echo "")
           SCAN_BUCKET=$(aws ssm get-parameter --name /prism/continuum/scan-bucket --query Parameter.Value --output text 2>/dev/null || echo "")
@@ -262,6 +254,19 @@ jobs:
             exit 0
           fi
 
+          # Continuum IS configured from here on, so every failure below fails
+          # closed. The CLI probe runs after the config lookup on purpose: before
+          # it, "never deployed" and "deployed but cannot scan" are
+          # indistinguishable, and the old order silently passed the gate on a repo
+          # that had opted into scanning.
+          if ! aws securityagent start-code-review-job help > /dev/null 2>&1; then
+            echo "::error::Continuum is configured but this AWS CLI lacks the securityagent code review commands (need v2.36+)."
+            echo "  The security scan cannot run, so this PR is not verified."
+            echo "scan_error=true" >> "$GITHUB_OUTPUT"
+            echo "findings=-1" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
           # Fallback for service role if SSM param not yet deployed
           if [[ -z "$SERVICE_ROLE" ]]; then
             ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
@@ -296,10 +301,9 @@ jobs:
             if [[ -z "$CODE_REVIEW_ID" ]]; then
               echo "  ⚠️ Bootstrap failed:"
               echo "  $CR_OUTPUT"
-              echo "  Run 'sudo prism-cli securityagent setup' from your DevBox to create manually."
-              echo "  Skipping security scan (non-blocking)."
-              echo "findings=0" >> "$GITHUB_OUTPUT"
-              echo "skipped=true" >> "$GITHUB_OUTPUT"
+              echo "  Run 'prism-cli securityagent setup' to create it manually."
+              echo "scan_error=true" >> "$GITHUB_OUTPUT"
+              echo "findings=-1" >> "$GITHUB_OUTPUT"
               exit 0
             fi
 
@@ -377,10 +381,18 @@ jobs:
           fi
 
           echo "::group::Retrieve findings"
-          FINDINGS_JSON=$(aws securityagent list-findings \
+          # No empty-array fallback: an API error there is indistinguishable from a
+          # clean scan, so it would pass the gate.
+          if ! FINDINGS_JSON=$(aws securityagent list-findings \
             --agent-space-id "${AGENT_SPACE_ID}" \
             --code-review-job-id "${JOB_ID}" \
-            --output json 2>/dev/null || echo '{"findingsSummaries":[]}')
+            --output json 2>&1); then
+            echo "::error::Continuum scan completed but its findings could not be retrieved: ${FINDINGS_JSON}"
+            echo "scan_error=true" >> "$GITHUB_OUTPUT"
+            echo "findings=-1" >> "$GITHUB_OUTPUT"
+            echo "::endgroup::"
+            exit 0
+          fi
 
           TOTAL=$(echo "$FINDINGS_JSON" | jq '.findingsSummaries | length')
           CRITICAL=$(echo "$FINDINGS_JSON" | jq '[.findingsSummaries[] | select(.riskLevel == "CRITICAL")] | length')
@@ -441,7 +453,7 @@ jobs:
           fi
 
       - name: Fail on eval or security issues
-        if: steps.eval.outputs.overall_result == 'FAIL' || (steps.security-gate.outputs.findings != '0' && steps.security-gate.outputs.skipped != 'true')
+        if: steps.eval.outputs.overall_result == 'FAIL' || steps.security-gate.outputs.scan_error == 'true' || (steps.security-gate.outputs.findings != '0' && steps.security-gate.outputs.skipped != 'true')
         run: |
           [[ "${{ steps.eval.outputs.overall_result }}" == "FAIL" ]] && echo "❌ Eval gate failed"
           if [[ "${{ steps.security-gate.outputs.scan_error }}" == "true" ]]; then

package/dist/assets/gitlab-workflows/prism-ai-metrics.yml

@@ -74,8 +74,15 @@ prism-ai-metrics:
       HEAD_SHA="${CI_COMMIT_SHA}"
 
       # --- Commit SHAs: immutable facts for deferred origin resolution.
-      COMMIT_SHAS=$(git rev-list "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null | head -50 | jq -R . | jq -sc . || echo '[]')
-      TOTAL_COMMITS=$(git rev-list --count "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null || echo "1")
+      #
+      # --no-merges for the same reason as the GitHub workflow: under a
+      # merge-commit strategy CI_COMMIT_SHA is the merge commit GitLab created,
+      # which no developer machine authored and codeburn can therefore never
+      # attribute. Counting it caps Attribution Coverage below 100% for a fully
+      # onboarded team. Harmless under squash or fast-forward, where the range
+      # holds no merge commits to exclude.
+      COMMIT_SHAS=$(git rev-list --no-merges "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null | head -50 | jq -R . | jq -sc . || echo '[]')
+      TOTAL_COMMITS=$(git rev-list --no-merges --count "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null || echo "1")
 
       # --- Lead time: MR open → now (this job runs on the post-merge push).
       LEAD_TIME_SECONDS=0

package/dist/assets/infra/lib/lambda/security-agent-processor.ts

@@ -1,6 +1,6 @@
 import {
   DynamoDBClient,
-  QueryCommand,
+  GetItemCommand,
   ScanCommand,
 } from '@aws-sdk/client-dynamodb';
 import {
@@ -14,6 +14,9 @@ const eventBridgeClient = new EventBridgeClient({});
 const EVENTS_TABLE = process.env.EVENTS_TABLE!;
 const METADATA_TABLE = process.env.METADATA_TABLE!;
 const EVENT_BUS_NAME = process.env.EVENT_BUS_NAME!;
+// Optional: unset when the OTEL collector is skipped, in which case no
+// attribution exists to join against and AI origin stays 'unknown'.
+const AI_USAGE_TABLE = process.env.AI_USAGE_TABLE;
 
 interface SecurityAgentPayload {
   findings: Array<{
@@ -177,55 +180,85 @@ async function lookupTeamId(repo: string): Promise<string> {
   }
 }
 
+/**
+ * Candidate `REPO#` partition keys for one repository name.
+ *
+ * The two sides of this join spell the repo differently and nothing normalizes
+ * either. codeburn sets the `git.repo` span attribute from the git remote, so
+ * the attribution store holds a host-qualified path (`github.com/owner/name`).
+ * CI sends `GITHUB_REPOSITORY`, which is bare (`owner/name`). A single GetItem
+ * on whichever form the caller happened to pass would miss roughly half the
+ * time — and miss silently, since a missing item is indistinguishable from an
+ * unattributed commit.
+ *
+ * Rather than guess, try the value as given and then the plausible
+ * translations: add a host if it looks bare, strip one if it looks qualified.
+ */
+function repoKeyCandidates(repo: string): string[] {
+  const bare = repo.replace(/^https?:\/\//, '').replace(/\.git$/, '').replace(/\/+$/, '');
+  const candidates = [bare];
+  const segments = bare.split('/');
+  if (segments.length === 2) {
+    // owner/name → try the hosts codeburn would have recorded.
+    candidates.push(`github.com/${bare}`, `gitlab.com/${bare}`);
+  } else if (segments.length > 2) {
+    // host/owner/name → try dropping the host.
+    candidates.push(segments.slice(1).join('/'));
+  }
+  return [...new Set(candidates)];
+}
+
+/**
+ * Resolves whether the code a finding lands on was AI-written.
+ *
+ * Reads the attribution store, which is the only place that answer now lives.
+ * This previously queried the events table for `prism.d1.commit` and counted
+ * ai vs human across the last 7 days — but nothing emits `prism.d1.commit`.
+ * The git hooks that were once expected to only ever wrote commit-message
+ * trailers, so the query never matched and every finding was tagged 'unknown',
+ * silently, with the CISO dashboard's AI-code-risk panel downstream of it.
+ *
+ * The per-commit verdict is frozen onto the COMMIT# item at ingest by
+ * otel-receiver (`ai_origin`), so a point lookup is enough — no span join, and
+ * no dependence on a span TTL that is shorter than the commit TTL.
+ */
 async function lookupAiOrigin(
   teamId: string,
   repo: string,
   commitSha: string | null,
   prNumber: number | null,
 ): Promise<'ai-generated' | 'ai-assisted' | 'human' | 'unknown'> {
-  if (!commitSha && !prNumber) return 'unknown';
-
-  try {
-    // Query recent commit events for this repo to find AI origin
-    const pk = `${teamId}#${repo}`;
-    const now = new Date();
-    const lookback = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000); // 7 days
-
-    const result = await dynamoClient.send(
-      new QueryCommand({
-        TableName: EVENTS_TABLE,
-        KeyConditionExpression: 'pk = :pk AND sk >= :start',
-        FilterExpression: 'detail_type = :dt',
-        ExpressionAttributeValues: {
-          ':pk': { S: pk },
-          ':start': { S: lookback.toISOString() },
-          ':dt': { S: 'prism.d1.commit' },
-        },
-        ScanIndexForward: false, // Most recent first
-        Limit: 20,
-      }),
-    );
+  // A PR number alone cannot identify a commit in the attribution store, whose
+  // key is REPO#<repo>/COMMIT#<sha>. Returning 'unknown' is correct here rather
+  // than guessing from the repo's recent history.
+  if (!commitSha) return 'unknown';
+  if (!AI_USAGE_TABLE) return 'unknown';
 
-    if (result.Items && result.Items.length > 0) {
-      // Count AI vs human commits to determine predominant origin
-      let aiCount = 0;
-      let humanCount = 0;
-      for (const item of result.Items) {
-        const data = JSON.parse(item.data?.S ?? '{}');
-        const origin = data.ai_context?.origin ?? 'human';
-        if (origin === 'ai-generated' || origin === 'ai-assisted') {
-          aiCount++;
-        } else {
-          humanCount++;
-        }
-      }
-      if (aiCount > humanCount) return 'ai-assisted';
-      if (humanCount > aiCount) return 'human';
+  for (const candidate of repoKeyCandidates(repo)) {
+    try {
+      const result = await dynamoClient.send(
+        new GetItemCommand({
+          TableName: AI_USAGE_TABLE,
+          Key: {
+            pk: { S: `REPO#${candidate}` },
+            sk: { S: `COMMIT#${commitSha}` },
+          },
+          ProjectionExpression: 'ai_origin',
+        }),
+      );
+      const origin = result.Item?.ai_origin?.S;
+      if (origin === 'ai-generated' || origin === 'human') return origin;
+      // Item exists but carries no frozen verdict (written before write-time
+      // resolution). Treat as unresolved rather than trying another key.
+      if (result.Item) return 'unknown';
+    } catch (err) {
+      console.error(`AI origin lookup failed for REPO#${candidate}:`, err);
+      return 'unknown';
     }
-
-    return 'unknown';
-  } catch (err) {
-    console.error('Failed to look up AI origin:', err);
-    return 'unknown';
   }
+
+  // No attribution for this commit — the author's machine is not onboarded to
+  // codeburn sync. Distinct from 'human', which is a positive verdict.
+  console.log(`No attribution found for ${repo}@${commitSha} (team ${teamId}, PR ${prNumber ?? 'n/a'})`);
+  return 'unknown';
 }

package/dist/assets/infra/lib/metrics-pipeline-stack.ts

@@ -839,6 +839,10 @@ export class MetricsPipelineStack extends cdk.Stack {
         EVENTS_TABLE: this.eventsTable.tableName,
         METADATA_TABLE: this.metadataTable.tableName,
         EVENT_BUS_NAME: this.eventBus.eventBusName,
+        // Findings are tagged AI vs human by looking the commit up in the
+        // attribution store. Left unset when the OTEL collector is skipped,
+        // in which case there is no attribution and origin stays 'unknown'.
+        AI_USAGE_TABLE: this.aiUsageTable.tableName,
       },
       logRetention: logs.RetentionDays.ONE_MONTH,
       description: 'Normalizes AWS Security Agent findings and emits to PRISM pipeline',
@@ -846,6 +850,10 @@ export class MetricsPipelineStack extends cdk.Stack {
 
     this.eventsTable.grantReadData(securityAgentProcessor);
     this.metadataTable.grantReadData(securityAgentProcessor);
+    // Read-only: the processor resolves a finding's AI origin from the frozen
+    // ai_origin on the COMMIT# item. grantReadData also grants kms:Decrypt on
+    // the table's customer-managed key, which a bare IAM action would not.
+    this.aiUsageTable.grantReadData(securityAgentProcessor);
     this.eventBus.grantPutEventsTo(securityAgentProcessor);
 
     // Security Remediation Tracker

package/dist/src/commands/bootstrapper/install-eval-harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-eval-harness.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-eval-harness.ts"],"names":[],"mappings":";;;;;;;;;;;iBA2DqB;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;;AAVvI,wBA8CE"}
+{"version":3,"file":"install-eval-harness.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-eval-harness.ts"],"names":[],"mappings":";;;;;;;;;;;iBA2DqB;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;;AAVvI,wBAwDE"}

package/dist/src/commands/bootstrapper/install-eval-harness.js

@@ -74,6 +74,15 @@ export default {
         }
         // Determine mode
         const mode = opts.mode || await prompt('Eval mode (kiro = recommended, bedrock = legacy)', 'kiro');
+        // Validated rather than falling through to bedrock. Both modes write the same
+        // workflow file, so a typo'd mode used to install the other gate silently --
+        // surfacing only as an unexpected Bedrock bill, or as a kiro gate with no
+        // KIRO_API_KEY. install-github-workflows rejects the same set.
+        if (mode !== 'kiro' && mode !== 'bedrock') {
+            console.error(`Error: unknown --mode "${mode}".`);
+            console.error('  Expected one of: kiro, bedrock');
+            process.exit(1);
+        }
         if (mode === 'kiro') {
             await installKiroMode(gitRoot, opts);
         }

package/dist/src/commands/bootstrapper/install-eval-harness.js.map

@@ -1 +1 @@
-{"version":3,"file":"install-eval-harness.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-eval-harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3H,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE3F;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,IAAY,EACZ,MAAc,EACd,KAAa,EACb,GAA+C;IAE/C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;QAC9E,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,OAAO,UAAU,CAAC,MAAM,mCAAmC,CAAC,CAAC;QAC1E,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,aAAa,MAAM,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;AAE/E,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9H,CAAC;AAED,eAAe;IACb,WAAW,EAAE,2DAA2D;IACxE,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,sFAAsF,EAAE;QAC/H,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,gDAAgD,EAAE;QAC1F,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC7F,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,sBAAsB,EAAE;QACjE,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,iDAAiD,EAAE,OAAO,EAAE,cAAc,EAAE;QACvH,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,kDAAkD,EAAE;KAC1F;IACD,KAAK,CAAC,MAAM,CAAC,IAAwH;QACnI,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAE1D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1B,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,sEAAsE;gBACtE,+DAA+D;gBAC/D,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC;YACvE,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO;QACT,CAAC;QAED,iBAAiB;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,MAAM,CAAC,kDAAkD,EAAE,MAAM,CAAC,CAAC;QAEnG,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,IAA6C;IAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC7C,gCAAgC;IAChC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACvD,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAE5D,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAC;QACtF,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IAC3D,CAAC;IAED,2BAA2B;IAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,wDAAwD,CAAC,CAAC;IAC5G,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,aAAa,CACjB,WAAW,EACX,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAC5C,MAAM,EACN,uCAAuC,EACvC,MAAM,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,SAAiB,EAAE,IAAoF;IACxJ,iBAAiB;IACjB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,MAAM,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;IACzG,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAEzE,kCAAkC;IAClC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9D,mBAAmB;IACnB,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IACrF,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;IAE3D,yBAAyB;IACzB,MAAM,MAAM,GAAG;QACb,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;QACrC,aAAa,EAAE,KAAK;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,kBAAkB;QAC7B,mBAAmB,EAAE,IAAI;KAC1B,CAAC;IACF,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAE9D,kBAAkB;IAClB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC5E,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,eAAe,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,CAAC;IACrG,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACvF,CAAC;IAED,mBAAmB;IACnB,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,mDAAmD,CAAC,CAAC;IACvG,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,aAAa,CACjB,WAAW,EACX,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAC5C,MAAM,EACN,uCAAuC,EACvC,MAAM,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iGAAiG,CAAC,CAAC;IAC/G,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"install-eval-harness.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-eval-harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3H,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE3F;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,IAAY,EACZ,MAAc,EACd,KAAa,EACb,GAA+C;IAE/C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;QAC9E,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,OAAO,UAAU,CAAC,MAAM,mCAAmC,CAAC,CAAC;QAC1E,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,aAAa,MAAM,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;AAE/E,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9H,CAAC;AAED,eAAe;IACb,WAAW,EAAE,2DAA2D;IACxE,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,sFAAsF,EAAE;QAC/H,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,gDAAgD,EAAE;QAC1F,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC7F,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,sBAAsB,EAAE;QACjE,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,iDAAiD,EAAE,OAAO,EAAE,cAAc,EAAE;QACvH,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,kDAAkD,EAAE;KAC1F;IACD,KAAK,CAAC,MAAM,CAAC,IAAwH;QACnI,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAE1D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1B,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,sEAAsE;gBACtE,+DAA+D;gBAC/D,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC;YACvE,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO;QACT,CAAC;QAED,iBAAiB;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,MAAM,CAAC,kDAAkD,EAAE,MAAM,CAAC,CAAC;QAEnG,8EAA8E;QAC9E,6EAA6E;QAC7E,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,IAAI,CAAC,CAAC;YAClD,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,IAA6C;IAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC7C,gCAAgC;IAChC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACvD,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAE5D,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAC;QACtF,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IAC3D,CAAC;IAED,2BAA2B;IAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,wDAAwD,CAAC,CAAC;IAC5G,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,aAAa,CACjB,WAAW,EACX,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAC5C,MAAM,EACN,uCAAuC,EACvC,MAAM,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,SAAiB,EAAE,IAAoF;IACxJ,iBAAiB;IACjB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,MAAM,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;IACzG,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAEzE,kCAAkC;IAClC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9D,mBAAmB;IACnB,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IACrF,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;IAE3D,yBAAyB;IACzB,MAAM,MAAM,GAAG;QACb,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;QACrC,aAAa,EAAE,KAAK;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,kBAAkB;QAC7B,mBAAmB,EAAE,IAAI;KAC1B,CAAC;IACF,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAE9D,kBAAkB;IAClB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC5E,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,eAAe,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,CAAC;IACrG,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACvF,CAAC;IAED,mBAAmB;IACnB,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,mDAAmD,CAAC,CAAC;IACvG,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,aAAa,CACjB,WAAW,EACX,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAC5C,MAAM,EACN,uCAAuC,EACvC,MAAM,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iGAAiG,CAAC,CAAC;IAC/G,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC"}

package/dist/src/commands/bootstrapper/install-github-workflows.d.ts

@@ -6,6 +6,7 @@ declare const _default: {
         default: string;
     }[];
     action(opts: {
+        mode?: string;
         region?: string;
         outputDir: string;
     }): Promise<void>;

package/dist/src/commands/bootstrapper/install-github-workflows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-github-workflows.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-github-workflows.ts"],"names":[],"mappings":";;;;;;;iBAWqB;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;;AAN3D,wBAsCE"}
+{"version":3,"file":"install-github-workflows.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-github-workflows.ts"],"names":[],"mappings":";;;;;;;iBAoCqB;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;;AAP1E,wBA8EE"}

package/dist/src/commands/bootstrapper/install-github-workflows.js

@@ -1,23 +1,63 @@
-import { mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { getAssetPath } from '../../utils/root.js';
-import { applyRegion, findDefaultRegionRefs } from '../../utils/region.js';
+import { applyRegion, findDefaultRegionRefs, DEFAULT_REGION } from '../../utils/region.js';
+/**
+ * The eval gate ships as one asset per mode, and exactly one may be installed.
+ *
+ * Both files declare `name: PRISM Eval Gate` with the same `pull_request`
+ * triggers, so installing both -- which this command used to do, by copying every
+ * asset -- produces two same-named check runs on every PR, one billing Bedrock
+ * and one billing the Kiro API.
+ *
+ * Both modes are written to a single output name, matching what
+ * `install-eval-harness --mode <mode>` does, so the two installers converge on
+ * the same file instead of leaving a mode-specific name behind.
+ */
+const EVAL_GATE_ASSETS = {
+    kiro: 'prism-eval-gate-kiro.yml',
+    bedrock: 'prism-eval-gate.yml',
+};
+const EVAL_GATE_OUTPUT = 'prism-eval-gate.yml';
+/** Rules or rubrics each mode's gate reads, installed separately. */
+const MODE_COMPANION = {
+    kiro: '.kiro/steering/code-review.md',
+    bedrock: '.prism/eval-harness/ (run-eval.sh + rubrics)',
+};
 export default {
     description: 'Install GitHub Actions workflow templates into the current repo',
     options: [
-        { flags: '--region <region>', description: 'AWS region for EventBridge/CloudWatch', default: 'us-west-2' },
+        { flags: '--mode <mode>', description: 'Eval gate mode: "kiro" (default, headless kiro-cli) or "bedrock" (legacy rubrics). Only one gate is installed', default: 'kiro' },
+        { flags: '--region <region>', description: 'AWS region for EventBridge/CloudWatch; must match setup-github-oidc', default: DEFAULT_REGION },
         { flags: '--output-dir <dir>', description: 'Output directory', default: '.github/workflows' },
     ],
     async action(opts) {
-        const region = opts.region || 'us-west-2';
+        const region = opts.region || DEFAULT_REGION;
         const outputDir = opts.outputDir;
+        // Validated rather than defaulted: silently treating an unrecognised mode as
+        // bedrock would install the gate the user did not ask for, and the failure
+        // only shows up as an unexpected Bedrock bill or a missing KIRO_API_KEY.
+        const mode = opts.mode || 'kiro';
+        if (!(mode in EVAL_GATE_ASSETS)) {
+            console.error(`Error: unknown --mode "${mode}".`);
+            console.error(`  Expected one of: ${Object.keys(EVAL_GATE_ASSETS).join(', ')}`);
+            process.exit(1);
+        }
         console.log(`\n📦 Installing GitHub Actions workflows`);
+        console.log(`   Mode:   ${mode} eval gate`);
         console.log(`   Region: ${region}`);
         console.log(`   Output: ${outputDir}/\n`);
         mkdirSync(outputDir, { recursive: true });
         const assetDir = getAssetPath(import.meta.url, 'github-workflows/prism-ai-metrics.yml').replace('/prism-ai-metrics.yml', '');
         const files = readdirSync(assetDir).filter(f => f.endsWith('.yml'));
+        const gateAssets = new Set(Object.values(EVAL_GATE_ASSETS));
+        const selectedGate = EVAL_GATE_ASSETS[mode];
+        let installed = 0;
         for (const file of files) {
+            // Skip the other mode's gate entirely.
+            if (gateAssets.has(file) && file !== selectedGate)
+                continue;
+            const outName = gateAssets.has(file) ? EVAL_GATE_OUTPUT : file;
             let content = readFileSync(join(assetDir, file), 'utf-8');
             content = applyRegion(content, region);
             const stragglers = findDefaultRegionRefs(content, file);
@@ -25,14 +65,34 @@ export default {
                 console.warn(`  ⚠ ${file}: ${stragglers.length} unconverted region reference(s):`);
                 stragglers.forEach(s => console.warn(`      ${s}`));
             }
-            writeFileSync(join(outputDir, file), content);
-            console.log(`  ✓ ${file}`);
+            writeFileSync(join(outputDir, outName), content);
+            console.log(`  ✓ ${outName}${file === outName ? '' : `   (${mode} mode, from ${file})`}`);
+            installed++;
         }
-        console.log(`\n✅ Installed ${files.length} workflow files to ${outputDir}/`);
+        // A pre-mode install of this command copied every asset, so an upgrading repo
+        // can still hold the other gate under its asset name. Reported rather than
+        // deleted: it is a tracked file in the user's repo, not ours to remove.
+        const stale = join(outputDir, EVAL_GATE_ASSETS.kiro);
+        if (EVAL_GATE_ASSETS.kiro !== EVAL_GATE_OUTPUT && existsSync(stale)) {
+            console.warn(`\n  ⚠ ${stale} is also present, left over from an earlier install.`);
+            console.warn(`    It declares the same check name and trigger as ${EVAL_GATE_OUTPUT},`);
+            console.warn(`    so both gates would run on every PR. Remove it:`);
+            console.warn(`      rm ${stale}`);
+        }
+        console.log(`\n✅ Installed ${installed} workflow files to ${outputDir}/`);
         console.log(`\nNext steps:`);
-        console.log(`  1. Run: prism-cli bootstrapper setup-github-oidc`);
+        console.log(`  1. Run: prism-cli bootstrapper setup-github-oidc --region ${region}`);
         console.log(`  2. Add repository secret PRISM_METRICS_ROLE_ARN in GitHub`);
-        console.log(`  3. Commit and push the workflow files`);
+        if (mode === 'kiro') {
+            console.log(`  3. Add repository secret KIRO_API_KEY (https://app.kiro.dev → Settings → API Keys)`);
+            console.log(`  4. Run: prism-cli bootstrapper install-eval-harness --mode kiro`);
+            console.log(`     — installs ${MODE_COMPANION.kiro}, the rules the gate reviews against`);
+        }
+        else {
+            console.log(`  3. Run: prism-cli bootstrapper install-eval-harness --with-rubrics`);
+            console.log(`     — installs ${MODE_COMPANION.bedrock}, which the gate reads`);
+        }
+        console.log(`  ${mode === 'kiro' ? '5' : '4'}. Commit and push the workflow files`);
         console.log('');
     },
 };

package/dist/src/commands/bootstrapper/install-github-workflows.js.map

@@ -1 +1 @@
-{"version":3,"file":"install-github-workflows.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-github-workflows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE3E,eAAe;IACb,WAAW,EAAE,iEAAiE;IAC9E,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,uCAAuC,EAAE,OAAO,EAAE,WAAW,EAAE;QAC1G,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,mBAAmB,EAAE;KAC/F;IACD,KAAK,CAAC,MAAM,CAAC,IAA4C;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAEjC,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,cAAc,SAAS,KAAK,CAAC,CAAC;QAE1C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;QAC7H,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,UAAU,CAAC,MAAM,mCAAmC,CAAC,CAAC;gBACnF,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,MAAM,sBAAsB,SAAS,GAAG,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"install-github-workflows.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-github-workflows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE3F;;;;;;;;;;;GAWG;AACH,MAAM,gBAAgB,GAA2B;IAC/C,IAAI,EAAE,0BAA0B;IAChC,OAAO,EAAE,qBAAqB;CAC/B,CAAC;AACF,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAE/C,qEAAqE;AACrE,MAAM,cAAc,GAA2B;IAC7C,IAAI,EAAE,+BAA+B;IACrC,OAAO,EAAE,8CAA8C;CACxD,CAAC;AAEF,eAAe;IACb,WAAW,EAAE,iEAAiE;IAC9E,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,+GAA+G,EAAE,OAAO,EAAE,MAAM,EAAE;QACzK,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,qEAAqE,EAAE,OAAO,EAAE,cAAc,EAAE;QAC3I,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,mBAAmB,EAAE;KAC/F;IACD,KAAK,CAAC,MAAM,CAAC,IAA2D;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAEjC,6EAA6E;QAC7E,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC;QACjC,IAAI,CAAC,CAAC,IAAI,IAAI,gBAAgB,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,IAAI,CAAC,CAAC;YAClD,OAAO,CAAC,KAAK,CAAC,sBAAsB,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,YAAY,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,cAAc,SAAS,KAAK,CAAC,CAAC;QAE1C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;QAC7H,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC5D,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,uCAAuC;YACvC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,YAAY;gBAAE,SAAS;YAE5D,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/D,IAAI,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,UAAU,CAAC,MAAM,mCAAmC,CAAC,CAAC;gBACnF,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,eAAe,IAAI,GAAG,EAAE,CAAC,CAAC;YAC1F,SAAS,EAAE,CAAC;QACd,CAAC;QAED,8EAA8E;QAC9E,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,gBAAgB,CAAC,IAAI,KAAK,gBAAgB,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,SAAS,KAAK,sDAAsD,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,sDAAsD,gBAAgB,GAAG,CAAC,CAAC;YACxF,OAAO,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,iBAAiB,SAAS,sBAAsB,SAAS,GAAG,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,+DAA+D,MAAM,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;QAC3E,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;YACpG,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;YACjF,OAAO,CAAC,GAAG,CAAC,mBAAmB,cAAc,CAAC,IAAI,sCAAsC,CAAC,CAAC;QAC5F,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC;YACpF,OAAO,CAAC,GAAG,CAAC,mBAAmB,cAAc,CAAC,OAAO,wBAAwB,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,sCAAsC,CAAC,CAAC;QACpF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}