@productbrain/cli 0.1.0-beta.14 → 0.1.0-beta.1400

package/dist/commands/proof-run.d.ts

@@ -0,0 +1,51 @@
+/**
+ * pb proof-run <proof-name> — run an admin-only proof against the seeded preview
+ * via the WP-459 proof bridge.
+ *
+ * NOT a kernel/MCP call: the bridge is a token-gated httpAction with a SIMPLER
+ * envelope than /api/aki. It authenticates with the short-lived preview admin
+ * token (pb_pat_…) minted into .productbrain/preview-admin.json by the seed
+ * (scripts/seed-preview.mjs step 7) — NOT the pb API key. So this command does
+ * not call getConfig()/kernelCall(); it reads the throwaway token from disk and
+ * POSTs directly to {siteUrl}/api/admin/proof-run.
+ *
+ *   Success → HTTP 200 { data: <verdict> } (verdict may carry zeroHandAuthoringProven)
+ *   Failure → non-200 { error, code }
+ *
+ * Chain: WP-459 (Admin-proof bridge).
+ */
+/** Resolved inputs for a proof-bridge call. */
+export interface ProofBridgeInputs {
+    siteUrl: string;
+    rawToken: string;
+    workspaceId: string;
+    /** Server-enforced expiry (ms epoch), if the token record carried one. */
+    expiresAt?: number;
+}
+/**
+ * Resolve the proof-bridge inputs (siteUrl, rawToken, workspaceId) from the
+ * worktree's seed sidecars. Pure + testable: takes the project root explicitly,
+ * throws CLIError with actionable guidance on any missing/invalid file.
+ */
+export declare function resolveProofBridgeInputs(projectRoot: string): ProofBridgeInputs;
+/** Parsed bridge response — discriminated on `ok`. */
+type BridgeResult = {
+    ok: true;
+    data: unknown;
+} | {
+    ok: false;
+    error: string;
+    code: string;
+};
+/**
+ * POST to the proof bridge and parse its simple envelope ({ data } / { error, code }).
+ * Uses an AbortController timeout (mirrors lib/client.js). Network / non-JSON
+ * failures surface as a structured { ok: false } so the caller can exit non-zero.
+ */
+export declare function callProofBridge(inputs: ProofBridgeInputs, proofName: string, timeoutMs?: number): Promise<BridgeResult>;
+interface ProofRunOptions {
+    proofName: string;
+}
+export declare function runProofRun(options: ProofRunOptions): Promise<void>;
+export {};
+//# sourceMappingURL=proof-run.d.ts.map

package/dist/commands/proof-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-run.d.ts","sourceRoot":"","sources":["../../src/commands/proof-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAuBH,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAeD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,CA8E/E;AAED,sDAAsD;AACtD,KAAK,YAAY,GACb;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC3B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,iBAAiB,EACzB,SAAS,EAAE,MAAM,EACjB,SAAS,SAAS,GACjB,OAAO,CAAC,YAAY,CAAC,CA8CvB;AAED,UAAU,eAAe;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAgEzE"}

package/dist/commands/proof-run.js

@@ -0,0 +1,209 @@
+/**
+ * pb proof-run <proof-name> — run an admin-only proof against the seeded preview
+ * via the WP-459 proof bridge.
+ *
+ * NOT a kernel/MCP call: the bridge is a token-gated httpAction with a SIMPLER
+ * envelope than /api/aki. It authenticates with the short-lived preview admin
+ * token (pb_pat_…) minted into .productbrain/preview-admin.json by the seed
+ * (scripts/seed-preview.mjs step 7) — NOT the pb API key. So this command does
+ * not call getConfig()/kernelCall(); it reads the throwaway token from disk and
+ * POSTs directly to {siteUrl}/api/admin/proof-run.
+ *
+ *   Success → HTTP 200 { data: <verdict> } (verdict may carry zeroHandAuthoringProven)
+ *   Failure → non-200 { error, code }
+ *
+ * Chain: WP-459 (Admin-proof bridge).
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { findProjectRoot } from '../lib/config.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+import { green, red, bold, dim, icons } from '../lib/style.js';
+/** Convert a Convex `.cloud` URL to its `.site` sibling, trailing slash stripped. */
+function toSiteUrl(convexUrl) {
+    return convexUrl.replace('.convex.cloud', '.convex.site').replace(/\/$/, '');
+}
+function readJsonFile(path) {
+    try {
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the proof-bridge inputs (siteUrl, rawToken, workspaceId) from the
+ * worktree's seed sidecars. Pure + testable: takes the project root explicitly,
+ * throws CLIError with actionable guidance on any missing/invalid file.
+ */
+export function resolveProofBridgeInputs(projectRoot) {
+    const seedPath = resolve(projectRoot, '.convex-seed.json');
+    if (!existsSync(seedPath)) {
+        throw new CLIError('No seeded preview found (.convex-seed.json missing).', {
+            code: ErrorCode.CONFIG_MISSING,
+            category: 'config',
+            guidance: 'Run `npm run convex:reprovision` first.',
+        });
+    }
+    const seed = readJsonFile(seedPath);
+    if (!seed) {
+        throw new CLIError('Could not parse .convex-seed.json.', {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Re-run `npm run convex:reprovision` to regenerate it.',
+        });
+    }
+    const adminPath = resolve(projectRoot, '.productbrain', 'preview-admin.json');
+    if (!existsSync(adminPath)) {
+        throw new CLIError('No preview admin token (.productbrain/preview-admin.json missing).', {
+            code: ErrorCode.CONFIG_MISSING,
+            category: 'config',
+            guidance: 'Run `npm run convex:reprovision` to mint one.',
+        });
+    }
+    const admin = readJsonFile(adminPath);
+    if (!admin?.rawToken) {
+        throw new CLIError('preview-admin.json is missing its rawToken.', {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Run `npm run convex:reprovision` to mint a fresh token.',
+        });
+    }
+    // Stale-sidecar guard: both sidecars are written by the SAME seed run, so their
+    // workspaceIds MUST agree. A mismatch means preview-admin.json is left over from an
+    // earlier preview — and because we prefer its pinned values below, using it would aim
+    // the proof at that stale (possibly still-live) deployment while THIS worktree's preview
+    // goes unexercised. Fail closed rather than silently proving the wrong workspace.
+    if (seed.workspaceId && admin.workspaceId && seed.workspaceId !== admin.workspaceId) {
+        throw new CLIError(`Stale preview admin token: preview-admin.json is pinned to workspace ${admin.workspaceId}, ` +
+            `but the current seed (.convex-seed.json) is workspace ${seed.workspaceId}.`, {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Run `npm run convex:reprovision` to re-mint the admin token for the current preview.',
+        });
+    }
+    // Prefer the pinned values from preview-admin.json; fall back to the seed sidecar.
+    const siteUrl = admin.siteUrl ?? (seed.convexUrl ? toSiteUrl(seed.convexUrl) : undefined);
+    if (!siteUrl) {
+        throw new CLIError('Could not determine the preview site URL.', {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Re-run `npm run convex:reprovision` to regenerate the seed sidecars.',
+        });
+    }
+    const workspaceId = admin.workspaceId ?? seed.workspaceId;
+    if (!workspaceId) {
+        throw new CLIError('Could not determine the preview workspaceId.', {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Re-run `npm run convex:reprovision` to regenerate the seed sidecars.',
+        });
+    }
+    return {
+        siteUrl: siteUrl.replace(/\/$/, ''),
+        rawToken: admin.rawToken,
+        workspaceId,
+        expiresAt: typeof admin.expiresAt === 'number' ? admin.expiresAt : undefined,
+    };
+}
+/**
+ * POST to the proof bridge and parse its simple envelope ({ data } / { error, code }).
+ * Uses an AbortController timeout (mirrors lib/client.js). Network / non-JSON
+ * failures surface as a structured { ok: false } so the caller can exit non-zero.
+ */
+export async function callProofBridge(inputs, proofName, timeoutMs = 30_000) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let res;
+    try {
+        res = await fetch(`${inputs.siteUrl}/api/admin/proof-run`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-pb-admin-token': inputs.rawToken,
+            },
+            body: JSON.stringify({ proofName, workspaceId: inputs.workspaceId }),
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        clearTimeout(timer);
+        const msg = err instanceof Error ? err.message : String(err);
+        const reason = msg === 'The operation was aborted' || msg.includes('abort')
+            ? `Request timed out after ${timeoutMs}ms`
+            : `Could not reach the proof bridge (${msg})`;
+        return { ok: false, error: reason, code: 'NETWORK_UNREACHABLE' };
+    }
+    clearTimeout(timer);
+    const body = (await res.json().catch(() => null));
+    if (!body) {
+        return {
+            ok: false,
+            error: `Bridge returned a non-JSON response (HTTP ${res.status}).`,
+            code: 'BAD_RESPONSE',
+        };
+    }
+    if (res.ok) {
+        return { ok: true, data: body.data };
+    }
+    return {
+        ok: false,
+        error: body.error ?? res.statusText ?? `HTTP ${res.status}`,
+        code: body.code ?? `HTTP_${res.status}`,
+    };
+}
+export async function runProofRun(options) {
+    const proofName = options.proofName.trim();
+    if (!proofName) {
+        throw new CLIError('Proof name is required.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'Usage: pb proof-run <proof-name>',
+        });
+    }
+    const projectRoot = findProjectRoot(process.cwd());
+    if (!projectRoot) {
+        throw new CLIError('Not inside a Product Brain project (no .productbrain/ found).', {
+            code: ErrorCode.CONFIG_MISSING,
+            category: 'config',
+            guidance: 'Run this from a worktree with a seeded preview (npm run convex:reprovision).',
+        });
+    }
+    const inputs = resolveProofBridgeInputs(projectRoot);
+    // Friendly pre-check — the server is the authority, so we still attempt the call.
+    if (inputs.expiresAt && Date.now() > inputs.expiresAt) {
+        process.stderr.write(`${icons.warn} preview admin token looks expired (${new Date(inputs.expiresAt).toISOString()}); ` +
+            `run \`npm run convex:reprovision\` to mint a fresh one.\n`);
+    }
+    const result = await callProofBridge(inputs, proofName);
+    if (!result.ok) {
+        throw new CLIError(`Proof bridge rejected the run: ${result.error}`, {
+            code: ErrorCode.INTERNAL,
+            category: 'internal',
+            guidance: `Bridge error code: ${result.code}`,
+        });
+    }
+    const verdict = result.data;
+    const proven = verdict && typeof verdict === 'object' && 'zeroHandAuthoringProven' in verdict
+        ? verdict.zeroHandAuthoringProven
+        : undefined;
+    if (typeof proven === 'boolean') {
+        const mark = proven ? green(icons.pass) : red(icons.fail);
+        process.stdout.write(`${mark} ${bold('zeroHandAuthoringProven')}: ${proven}\n`);
+    }
+    process.stdout.write(`${dim(`proof: ${proofName}`)}\n`);
+    process.stdout.write(JSON.stringify(verdict, null, 2) + '\n');
+    // A recognized proof boolean that came back `false` is a FAILED proof, not a successful
+    // run. This command is the agent-surface smoke proof, so its exit status must reflect the
+    // verdict — exit non-zero so operators/CI don't read a failed proof as passing. (We still
+    // print the full verdict above first.) Unrecognized verdicts (no boolean) stay exit-0:
+    // we can't adjudicate a proof we don't model.
+    if (proven === false) {
+        throw new CLIError(`Proof "${proofName}" did not hold: zeroHandAuthoringProven=false.`, {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'The seeded policy seam resolved away from the zero-hand-authoring default — inspect the verdict above.',
+        });
+    }
+}
+//# sourceMappingURL=proof-run.js.map

package/dist/commands/proof-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-run.js","sourceRoot":"","sources":["../../src/commands/proof-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AA0B/D,qFAAqF;AACrF,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CAAI,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAAmB;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,sDAAsD,EAAE;YACzE,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,yCAAyC;SACpD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAa,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,QAAQ,CAAC,oCAAoC,EAAE;YACvD,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,uDAAuD;SAClE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;IAC9E,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,QAAQ,CAAC,oEAAoE,EAAE;YACvF,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,+CAA+C;SAC1D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAmB,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,QAAQ,CAAC,6CAA6C,EAAE;YAChE,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,yDAAyD;SACpE,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,oFAAoF;IACpF,sFAAsF;IACtF,yFAAyF;IACzF,kFAAkF;IAClF,IAAI,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QACpF,MAAM,IAAI,QAAQ,CAChB,wEAAwE,KAAK,CAAC,WAAW,IAAI;YAC3F,yDAAyD,IAAI,CAAC,WAAW,GAAG,EAC9E;YACE,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,sFAAsF;SACjG,CACF,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,2CAA2C,EAAE;YAC9D,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,sEAAsE;SACjF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC;IAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,8CAA8C,EAAE;YACjE,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,sEAAsE;SACjF,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW;QACX,SAAS,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KAC7E,CAAC;AACJ,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAyB,EACzB,SAAiB,EACjB,SAAS,GAAG,MAAM;IAElB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAE9D,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,sBAAsB,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,MAAM,CAAC,QAAQ;aACpC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;YACpE,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,GAAG,KAAK,2BAA2B,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;YACzE,CAAC,CAAC,2BAA2B,SAAS,IAAI;YAC1C,CAAC,CAAC,qCAAqC,GAAG,GAAG,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;IACnE,CAAC;IACD,YAAY,CAAC,KAAK,CAAC,CAAC;IAEpB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAExC,CAAC;IAET,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,6CAA6C,GAAG,CAAC,MAAM,IAAI;YAClE,IAAI,EAAE,cAAc;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE;QAC3D,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE;KACxC,CAAC;AACJ,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAwB;IACxD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE;YAC5C,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,kCAAkC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,+DAA+D,EAAE;YAClF,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,8EAA8E;SACzF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAErD,kFAAkF;IAClF,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,KAAK,CAAC,IAAI,uCAAuC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK;YAC/F,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAExD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAAC,kCAAkC,MAAM,CAAC,KAAK,EAAE,EAAE;YACnE,IAAI,EAAE,SAAS,CAAC,QAAQ;YACxB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,sBAAsB,MAAM,CAAC,IAAI,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;IAC5B,MAAM,MAAM,GACV,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,yBAAyB,IAAI,OAAO;QAC5E,CAAC,CAAE,OAAgD,CAAC,uBAAuB;QAC3E,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,yBAAyB,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,UAAU,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAE9D,wFAAwF;IACxF,0FAA0F;IAC1F,0FAA0F;IAC1F,uFAAuF;IACvF,8CAA8C;IAC9C,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,QAAQ,CAAC,UAAU,SAAS,gDAAgD,EAAE;YACtF,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,wGAAwG;SACnH,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/commands/proposals.js

@@ -6,7 +6,7 @@
  * Read-only — no active session required.
  */
 import { getConfigOrGuide } from '../lib/config.js';
-import { mcpCall } from '../lib/client.js';
+import { kernelCall } from '../lib/client.js';
 import { runCliCommand } from '../lib/runner.js';
 import { formatProposalsList } from '../formatters/proposals.js';
 export async function runProposals() {
@@ -15,7 +15,7 @@ export async function runProposals() {
         return;
     await runCliCommand({
         fn: async () => {
-            const proposals = await mcpCall('governance.listProposals', {});
+            const proposals = await kernelCall('governance.listProposals', {});
             return { proposals, count: proposals.length };
         },
         formatPretty: (data) => formatProposalsList(data),

package/dist/commands/proposals.js.map

@@ -1 +1 @@
-{"version":3,"file":"proposals.js","sourceRoot":"","sources":["../../src/commands/proposals.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAA6C,MAAM,4BAA4B,CAAC;AAE5G,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,aAAa,CAAoB;QACrC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,MAAM,SAAS,GAAG,MAAM,OAAO,CAAiB,0BAA0B,EAAE,EAAE,CAAC,CAAC;YAChF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QAChD,CAAC;QACD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;KAClD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"proposals.js","sourceRoot":"","sources":["../../src/commands/proposals.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAA6C,MAAM,4BAA4B,CAAC;AAE5G,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,aAAa,CAAoB;QACrC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,MAAM,SAAS,GAAG,MAAM,UAAU,CAAiB,0BAA0B,EAAE,EAAE,CAAC,CAAC;YACnF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QAChD,CAAC;QACD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;KAClD,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/reject.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reject.d.ts","sourceRoot":"","sources":["../../src/commands/reject.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,UAAU,aAAa;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BrE"}
+{"version":3,"file":"reject.d.ts","sourceRoot":"","sources":["../../src/commands/reject.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,UAAU,aAAa;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAgCrE"}

package/dist/commands/reject.js

@@ -6,26 +6,33 @@
  * Reason is mandatory — objections must be explained (BR-7).
  */
 import { getConfigOrGuide } from '../lib/config.js';
-import { mcpCall } from '../lib/client.js';
+import { kernelCall } from '../lib/client.js';
 import { runCliCommand } from '../lib/runner.js';
 import { formatRejectReceipt } from '../formatters/proposals.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
 export async function runReject(options) {
     const config = await getConfigOrGuide(() => runReject(options));
     if (!config)
         return;
     const proposalId = options.proposalId?.trim();
     if (!proposalId) {
-        process.stderr.write('Proposal ID is required. Usage: pb reject <id> --reason "..."\n');
-        process.exit(1);
+        throw new CLIError('Proposal ID is required.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'Usage: pb reject <id> --reason "..."',
+        });
     }
     if (!options.reason?.trim()) {
-        process.stderr.write('A reason is required when rejecting. Usage: pb reject <id> --reason "..."\n');
-        process.stderr.write('Governance requires that objections are explained (BR-7).\n');
-        process.exit(1);
+        throw new CLIError('A reason is required when rejecting.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            // BR-7
+            guidance: 'Governance requires that objections are explained. Usage: pb reject <id> --reason "..."',
+        });
     }
     await runCliCommand({
         fn: async () => {
-            return await mcpCall('governance.respondToProposal', {
+            return await kernelCall('governance.respondToProposal', {
                 proposalId,
                 verdict: 'reject',
                 reason: options.reason.trim(),

package/dist/commands/reject.js.map

@@ -1 +1 @@
-{"version":3,"file":"reject.js","sourceRoot":"","sources":["../../src/commands/reject.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAA0B,MAAM,4BAA4B,CAAC;AAOzF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB;IACpD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACpG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,aAAa,CAAoB;QACrC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,OAAO,MAAM,OAAO,CAAoB,8BAA8B,EAAE;gBACtE,UAAU;gBACV,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;KAClD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"reject.js","sourceRoot":"","sources":["../../src/commands/reject.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAA0B,MAAM,4BAA4B,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAOvD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB;IACpD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE;YAC7C,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,sCAAsC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,sCAAsC,EAAE;YACzD,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,OAAO;YACP,QAAQ,EAAE,yFAAyF;SACpG,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,CAAoB;QACrC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,OAAO,MAAM,UAAU,CAAoB,8BAA8B,EAAE;gBACzE,UAAU;gBACV,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;KAClD,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/relate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relate.d.ts","sourceRoot":"","sources":["../../src/commands/relate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,UAAU,aAAa;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAUD,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAuCrE;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAgCvE"}
+{"version":3,"file":"relate.d.ts","sourceRoot":"","sources":["../../src/commands/relate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,UAAU,aAAa;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAWD,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAyErE;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCvE"}

package/dist/commands/relate.js

@@ -5,10 +5,11 @@
  * Thin client: relation type validation lives in Convex (BR-104).
  */
 import { getConfigOrGuide } from '../lib/config.js';
-import { mcpCallWithSession } from '../lib/client.js';
+import { kernelCallWithSession } from '../lib/client.js';
 import { readSession } from '../lib/session.js';
 import { runCliCommand } from '../lib/runner.js';
 import { formatRelateReceipt, formatUnrelateReceipt } from '../formatters/relate.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
 export async function runRelate(options) {
     const config = await getConfigOrGuide(() => runRelate(options));
     if (!config)
@@ -16,16 +17,22 @@ export async function runRelate(options) {
     // Require active session
     const session = readSession();
     if (!session) {
-        process.stderr.write('No active session. Run `pb session start` first.\n');
-        process.stderr.write('Write access requires a tracked session (DEC-9).\n');
-        process.exit(1);
+        throw new CLIError('No active session.', {
+            code: ErrorCode.SESSION_REQUIRED,
+            category: 'session',
+            // DEC-9
+            guidance: 'Run `pb session start` first. Write access requires a tracked session.',
+        });
     }
     const fromId = options.fromId.trim();
     const type = options.type.trim();
     const toId = options.toId.trim();
     if (!fromId || !type || !toId) {
-        process.stderr.write('All arguments required. Usage: pb relate <from-id> <type> <to-id>\n');
-        process.exit(1);
+        throw new CLIError('All arguments required.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'Usage: pb relate <from-id> <type> <to-id>',
+        });
     }
     await runCliCommand({
         fn: async () => {
@@ -37,11 +44,31 @@ export async function runRelate(options) {
             if (options.ifMissing) {
                 mcpArgs.ifMissing = true;
             }
-            const result = await mcpCallWithSession('chain.createEntryRelation', mcpArgs);
-            const alreadyExists = result?.alreadyExists === true;
-            const output = { fromId, type, toId, action: 'related' };
+            const result = await kernelCallWithSession('chain.createEntryRelation', mcpArgs);
+            // WP-363 S5: Chain debt prevented — misuse pattern intercepted, print coaching message.
+            if (result?.chainDebtPrevented) {
+                const alts = result.suggestedAlternatives ?? [];
+                console.warn(`\n⚠ Chain debt prevented`);
+                console.warn(`  "${result.originalType ?? type}" is a common misuse for this entry pair.`);
+                console.warn(`  Created agent sign-off proposal: ${result.proposalId}`);
+                console.warn(`\nSuggested alternatives:`);
+                for (const alt of alts) {
+                    console.warn(`  • ${alt.type}: ${alt.reason}`);
+                }
+                console.warn(`\nReview at /review in Cortex UI or use \`pb proposals\` to manage.`);
+                return { fromId, type, toId, action: 'proposal_created', proposalId: result.proposalId };
+            }
+            const isProposal = result?.status === 'proposal_created';
+            const output = {
+                fromId,
+                type,
+                toId,
+                action: isProposal ? 'proposal_created' : 'related',
+            };
+            if (isProposal && result?.proposalId)
+                output.proposalId = result.proposalId;
             if (options.ifMissing)
-                output.alreadyExists = alreadyExists;
+                output.alreadyExists = result?.alreadyExists === true;
             return output;
         },
         formatPretty: (result) => formatRelateReceipt(result),
@@ -54,20 +81,26 @@ export async function runUnrelate(options) {
     // Require active session
     const session = readSession();
     if (!session) {
-        process.stderr.write('No active session. Run `pb session start` first.\n');
-        process.stderr.write('Write access requires a tracked session (DEC-9).\n');
-        process.exit(1);
+        throw new CLIError('No active session.', {
+            code: ErrorCode.SESSION_REQUIRED,
+            category: 'session',
+            // DEC-9
+            guidance: 'Run `pb session start` first. Write access requires a tracked session.',
+        });
     }
     const fromId = options.fromId.trim();
     const type = options.type.trim();
     const toId = options.toId.trim();
     if (!fromId || !type || !toId) {
-        process.stderr.write('All arguments required. Usage: pb unrelate <from-id> <type> <to-id>\n');
-        process.exit(1);
+        throw new CLIError('All arguments required.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'Usage: pb unrelate <from-id> <type> <to-id>',
+        });
     }
     await runCliCommand({
         fn: async () => {
-            await mcpCallWithSession('chain.removeEntryRelation', {
+            await kernelCallWithSession('chain.removeEntryRelation', {
                 fromEntryId: fromId,
                 toEntryId: toId,
                 type,

package/dist/commands/relate.js.map

@@ -1 +1 @@
-{"version":3,"file":"relate.js","sourceRoot":"","sources":["../../src/commands/relate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAiBrF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB;IACpD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,yBAAyB;IACzB,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAEjC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;QAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,aAAa,CAAe;QAChC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,MAAM,OAAO,GAA4B;gBACvC,WAAW,EAAE,MAAM;gBACnB,SAAS,EAAE,IAAI;gBACf,IAAI;aACL,CAAC;YACF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,2BAA2B,EAAE,OAAO,CAA4C,CAAC;YACzH,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;YACrD,MAAM,MAAM,GAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC;YAChF,IAAI,OAAO,CAAC,SAAS;gBAAE,MAAM,CAAC,aAAa,GAAG,aAAa,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,yBAAyB;IACzB,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAEjC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,aAAa,CAAe;QAChC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,MAAM,kBAAkB,CAAC,2BAA2B,EAAE;gBACpD,WAAW,EAAE,MAAM;gBACnB,SAAS,EAAE,IAAI;gBACf,IAAI;aACL,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC;QAC9D,CAAC;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"relate.js","sourceRoot":"","sources":["../../src/commands/relate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAkBvD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB;IACpD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,yBAAyB;IACzB,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACvC,IAAI,EAAE,SAAS,CAAC,gBAAgB;YAChC,QAAQ,EAAE,SAAS;YACnB,QAAQ;YACR,QAAQ,EAAE,wEAAwE;SACnF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAEjC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE;YAC5C,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,2CAA2C;SACtD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,CAAe;QAChC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,MAAM,OAAO,GAA4B;gBACvC,WAAW,EAAE,MAAM;gBACnB,SAAS,EAAE,IAAI;gBACf,IAAI;aACL,CAAC;YACF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,2BAA2B,EAAE,OAAO,CAOlE,CAAC;YAEd,wFAAwF;YACxF,IAAI,MAAM,EAAE,kBAAkB,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,YAAY,IAAI,IAAI,2CAA2C,CAAC,CAAC;gBAC3F,OAAO,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;gBAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,OAAO,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjD,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;gBACpF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,kBAA2B,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;YACpG,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,EAAE,MAAM,KAAK,kBAAkB,CAAC;YACzD,MAAM,MAAM,GAAiB;gBAC3B,MAAM;gBACN,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,kBAA2B,CAAC,CAAC,CAAC,SAAkB;aACtE,CAAC;YACF,IAAI,UAAU,IAAI,MAAM,EAAE,UAAU;gBAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;YAC5E,IAAI,OAAO,CAAC,SAAS;gBAAE,MAAM,CAAC,aAAa,GAAG,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;YAC7E,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,yBAAyB;IACzB,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACvC,IAAI,EAAE,SAAS,CAAC,gBAAgB;YAChC,QAAQ,EAAE,SAAS;YACnB,QAAQ;YACR,QAAQ,EAAE,wEAAwE;SACnF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAEjC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE;YAC5C,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,6CAA6C;SACxD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,CAAe;QAChC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,MAAM,qBAAqB,CAAC,2BAA2B,EAAE;gBACvD,WAAW,EAAE,MAAM;gBACnB,SAAS,EAAE,IAAI;gBACf,IAAI;aACL,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC;QAC9D,CAAC;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/search.js

@@ -3,7 +3,7 @@
  * BET-181 Slice 0: routes through runCliCommand for JSON-default output.
  */
 import { getConfigOrGuide } from '../lib/config.js';
-import { mcpCall } from '../lib/client.js';
+import { kernelCall } from '../lib/client.js';
 import { runCliCommand } from '../lib/runner.js';
 import { formatSearchResults } from '../formatters/search.js';
 export async function runSearch(options) {
@@ -11,7 +11,7 @@ export async function runSearch(options) {
     if (!config)
         return;
     await runCliCommand({
-        fn: () => mcpCall('chain.searchEntries', { query: options.query }),
+        fn: () => kernelCall('chain.searchEntries', { query: options.query }),
         formatPretty: (results) => formatSearchResults(results ?? []),
     });
 }

package/dist/commands/search.js.map

@@ -1 +1 @@
-{"version":3,"file":"search.js","sourceRoot":"","sources":["../../src/commands/search.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAqB,MAAM,yBAAyB,CAAC;AAEjF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA0B;IACxD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,aAAa,CAAiB;QAClC,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAiB,qBAAqB,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAClF,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,IAAI,EAAE,CAAC;KAC9D,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"search.js","sourceRoot":"","sources":["../../src/commands/search.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAqB,MAAM,yBAAyB,CAAC;AAEjF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA0B;IACxD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,aAAa,CAAiB;QAClC,EAAE,EAAE,GAAG,EAAE,CAAC,UAAU,CAAiB,qBAAqB,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QACrF,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,IAAI,EAAE,CAAC;KAC9D,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/session.d.ts

@@ -5,16 +5,40 @@
  * BET-181 Slice 0: uses isJsonMode() for output branching. Existing --json flag
  * on session start preserved for backward compatibility.
  */
-export declare function runSessionStart(options?: {
+type SessionStartOptions = {
     /** @deprecated Use global --json flag instead. Preserved for backward compatibility. */
     json?: boolean;
-}): Promise<void>;
+};
+export declare function runSessionStart(options?: SessionStartOptions): Promise<void>;
 /**
  * pb session id — print current session ID bare to stdout (machine-readable).
  * Resolves TEN-707. Zero network call — reads local session.json only.
  */
 export declare function runSessionId(): void;
+/**
+ * pb session reset — hard-reset the worktree-local pb SESSION state. TEN-2189 / WP-456 E2.
+ *
+ * Discards session.json outright (via discardSession — NO resume marker, unlike
+ * `pb session close`). Purely local: no network call, no key needed — this is the recovery
+ * path when a session is stranded pinned to the wrong workspace (e.g. left over after a
+ * pb:preview/pb:real binding flip), so it must work even when the current binding is broken.
+ *
+ * Scope: SESSION state only. The preview *binding* (config.local.json keys + the
+ * .productbrain/PREVIEW_MODE marker) is owned end-to-end by `npm run pb:preview` /
+ * `npm run pb:real` — reset never touches it, so the marker can never disagree with the keys
+ * that actually route writes (codex PR #145 review: clearing the marker without the keys left
+ * the worktree silently still preview-bound). To return a preview-bound worktree to the real
+ * Chain: `pb session reset` (clear the session) then `npm run pb:real` (clear the binding).
+ *
+ * Guard (R4): if there IS an active session, confirm before discarding so in-flight captures
+ * aren't silently stranded. `--force` skips the prompt. In a non-interactive context the prompt
+ * can't run, so `--force` is required there.
+ */
+export declare function runSessionReset(options?: {
+    force?: boolean;
+}): Promise<void>;
 export declare function runSessionClose(options?: {
     force?: boolean;
 }): Promise<void>;
+export {};
 //# sourceMappingURL=session.d.ts.map

package/dist/commands/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/commands/session.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA0BH,wBAAsB,eAAe,CAAC,OAAO,GAAE;IAC7C,wFAAwF;IACxF,IAAI,CAAC,EAAE,OAAO,CAAA;CACV,GAAG,OAAO,CAAC,IAAI,CAAC,CAsErB;AAED;;;GAGG;AACH,wBAAgB,YAAY,IAAI,IAAI,CAOnC;AAED,wBAAsB,eAAe,CAAC,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDtF"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/commands/session.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgDH,KAAK,mBAAmB,GAAG;IACzB,wFAAwF;IACxF,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAgDF,wBAAsB,eAAe,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBtF;AA+LD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,IAAI,CAUnC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,eAAe,CAAC,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAkCtF;AAED,wBAAsB,eAAe,CAAC,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAkKtF"}