@productbrain/cli 0.1.0-beta.44 → 0.1.0-beta.4415

package/dist/lib/startup-signals.js

@@ -0,0 +1,172 @@
+/**
+ * WP-486 Slice 1 (FEAT-1371) — CLI-side collection of the startup signals the server's
+ * `resolveStartupDomain` (`convex/agentKnowledge/startupResolver.ts:344-379`) already knows how
+ * to consume — `changedPaths`, `branchName`, `worktreeName` — but `pb orient --task` never sent.
+ *
+ * Best-effort, fail-open: git absence, a non-repo cwd, or any shell error yields an empty signal
+ * set (never thrown), so a missing/broken git never blocks orient. Mirrors the existing
+ * `runGitText` pattern in `commands/handshake.ts` — kept local rather than shared because the two
+ * files serve different (unexported) internal needs and neither is imported by the other.
+ *
+ * `reviewedArtifactRefs` is deliberately NOT collected here — no CLI source exists (no "artifacts
+ * reviewed this session" tracking), per WP-486 spec §5 exclusions. Server-side sanitization
+ * (`convex/agentKnowledge/startupResolutionSignals.ts`) re-validates and caps every field this
+ * module produces — this collector does the best-effort gather; the server remains the trust
+ * boundary.
+ *
+ * NOT reusing `deriveHandshakeStartupSignals` (`commands/handshake.ts:744`), the CODE-INTEGRITY
+ * default: that function additionally reads `.productbrain/{context,briefing}.md`, dereferences
+ * "PR #N" refs via a `gh` subprocess (time-boxed but still I/O), and derives `reviewedArtifactRefs`
+ * from local doc text — behavior this slice's exclusions explicitly rule out inventing, and cost
+ * this module cannot afford: `pb orient --task` is a per-task hot path (every orient call), while
+ * `deriveHandshakeStartupSignals` runs once per session-start/close. A shared helper would force
+ * one of the two callers to carry work it doesn't want. `changedPaths` DOES mirror that function's
+ * two-source union (dirty worktree + committed branch delta vs `origin/main`) — see
+ * `collectCliStartupSignals` below — because the spec's own Slice 1 text (WP-B §4) names "git diff
+ * against the worktree's base" as the source, not merely `git status`; PR-review (Codex, PR #369)
+ * caught that the first cut only covered the dirty-worktree half.
+ */
+import { execSync } from 'node:child_process';
+import { basename } from 'node:path';
+const GIT_TIMEOUT_MS = 3_000;
+const CHANGED_PATHS_CAP = 25;
+/** `origin/main` is the worktree's base per Product-OS's one-repo-one-remote convention
+ *  (constitution §2/§3) — the same ref `deriveHandshakeStartupSignals` diffs against. */
+const BASE_REF = 'origin/main';
+function runGit(cwd, command) {
+    try {
+        const value = execSync(command, {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: GIT_TIMEOUT_MS,
+        }).trim();
+        return value.length > 0 ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Like `runGit`, but for `git status --porcelain`: does NOT `.trim()` the raw output. Porcelain
+ * v1's fixed-width status prefix (two status chars + one space) commonly STARTS with a space
+ * (unstaged-modified is `" M"`, unstaged-deleted is `" D"`); a blanket `.trim()` on the whole
+ * multi-line blob strips exactly that leading space off the FIRST line only, off-by-one-shifting
+ * `parseChangedPaths`'s positional `slice(3)` for that one entry (e.g. `" M convex/x.ts"` →
+ * trimmed → `"M convex/x.ts"` → sliced wrong → `"onvex/x.ts"`). Trims only the trailing newline.
+ */
+function runGitStatusRaw(cwd, command) {
+    try {
+        const value = execSync(command, {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: GIT_TIMEOUT_MS,
+        }).replace(/\r?\n$/, '');
+        return value.length > 0 ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Parse `git status --porcelain --untracked-files=all` output into a flat list of changed paths.
+ * `--untracked-files=all` (not the porcelain default `normal`) is REQUIRED: the default mode
+ * collapses a wholly-untracked directory to one entry (`?? src/routes/new-feature/`), losing the
+ * filename/extension evidence path-glob domain rules key on; `all` expands it to individual files
+ * (`?? src/routes/new-feature/page.svelte`) — reproduced live and confirmed by PR review (Codex,
+ * PR #369) against `git status -h`'s documented `--untracked-files=<mode>`.
+ *
+ * Rename lines (`R  old -> new`) keep only the new path — the server's domain resolver cares
+ * about the CURRENT file location, not its history. The leading two-character status code + one
+ * space (porcelain v1's fixed-width prefix) is stripped positionally rather than by
+ * regex-splitting on whitespace, so a path containing spaces survives intact. Callers MUST pass
+ * the UNTRIMMED output (`runGitStatusRaw`, not `runGit`) — see that function's doc for why a
+ * blanket outer trim breaks this positional slice on the first line.
+ */
+function parseChangedPaths(porcelainOutput) {
+    const paths = [];
+    for (const line of porcelainOutput.split(/\r?\n/)) {
+        if (line.length <= 3)
+            continue;
+        let entry = line.slice(3).trim();
+        if (!entry)
+            continue;
+        const renameSep = entry.indexOf(' -> ');
+        if (renameSep !== -1)
+            entry = entry.slice(renameSep + 4).trim();
+        // Porcelain quotes paths containing unusual characters in double quotes — strip them.
+        if (entry.startsWith('"') && entry.endsWith('"'))
+            entry = entry.slice(1, -1);
+        if (entry)
+            paths.push(entry);
+    }
+    return paths;
+}
+/**
+ * Parse `git diff --name-only -z` output — NUL-separated, bare paths, no status prefix. `-z` is
+ * REQUIRED on the caller's git invocation: it disables path quoting outright (regardless of
+ * `core.quotePath`), so a non-ASCII filename (e.g. `café.txt`) that porcelain would otherwise
+ * octal-escape into a quoted string (`"caf\303\251.txt"`) instead comes through as raw UTF-8
+ * bytes — no unescaping needed here, unlike `parseChangedPaths`'s newline-delimited quote strip.
+ */
+function parseNameOnlyPaths(diffOutput) {
+    return diffOutput.split('\0').map((entry) => entry.trim()).filter(Boolean);
+}
+/**
+ * Union two path lists, de-duped, order-stable (first-seen wins), capped at
+ * `CHANGED_PATHS_CAP`. The dirty-worktree and branch-delta lists overlap heavily in the common
+ * case (a file both dirty AND already differing from base), so de-dup keeps the cap from being
+ * spent on repeats.
+ */
+function unionCapped(a, b) {
+    const seen = new Set();
+    const out = [];
+    for (const p of [...a, ...b]) {
+        if (seen.has(p))
+            continue;
+        seen.add(p);
+        out.push(p);
+        if (out.length >= CHANGED_PATHS_CAP)
+            break;
+    }
+    return out;
+}
+/**
+ * Collect the CLI's best-effort startup signal bundle for THIS invocation's cwd. Every field is
+ * omitted (not empty-stringed) when unavailable, matching the server validator's `v.optional`
+ * contract (`startupResolutionSignalsValidator`) — an absent key, not a fabricated empty one.
+ */
+export function collectCliStartupSignals(cwd = process.cwd()) {
+    const signals = {};
+    // Two sources, unioned (mirrors deriveHandshakeStartupSignals' dirty+branch-delta union,
+    // commands/handshake.ts:753-763, minus its PR-diff/local-doc reads — see the module doc for
+    // why those stay out of this hot path):
+    //   1. Dirty worktree (uncommitted changes) — what the ORIGINAL cut covered.
+    //   2. Committed branch delta vs BASE_REF — a builder mid-lane with a clean, committed
+    //      worktree (the normal `pb orient --task` re-orientation case) otherwise contributes
+    //      NO changedPaths at all, even though the branch differs meaningfully from main. Spec
+    //      text (WP-B §4) names "git diff against the worktree's base" as the source — this closes
+    //      the gap between that text and the first cut's git-status-only implementation (PR #369
+    //      review, Codex).
+    const statusRaw = runGitStatusRaw(cwd, 'git status --porcelain --untracked-files=all');
+    const dirtyPaths = statusRaw ? parseChangedPaths(statusRaw) : [];
+    let branchPaths = [];
+    const mergeBase = runGit(cwd, `git merge-base HEAD ${BASE_REF}`);
+    if (mergeBase) {
+        const branchDiffRaw = runGit(cwd, `git diff --name-only -z ${mergeBase} HEAD`);
+        if (branchDiffRaw)
+            branchPaths = parseNameOnlyPaths(branchDiffRaw);
+    }
+    const allPaths = unionCapped(dirtyPaths, branchPaths);
+    if (allPaths.length > 0)
+        signals.changedPaths = allPaths;
+    const branch = runGit(cwd, 'git branch --show-current');
+    if (branch)
+        signals.branchName = branch;
+    const toplevel = runGit(cwd, 'git rev-parse --show-toplevel');
+    if (toplevel)
+        signals.worktreeName = basename(toplevel);
+    return signals;
+}
+//# sourceMappingURL=startup-signals.js.map

package/dist/lib/startup-signals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-signals.js","sourceRoot":"","sources":["../../src/lib/startup-signals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B;yFACyF;AACzF,MAAM,QAAQ,GAAG,aAAa,CAAC;AAQ/B,SAAS,MAAM,CAAC,GAAW,EAAE,OAAe;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE;YAC9B,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,OAAe;IACnD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE;YAC9B,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACzB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,iBAAiB,CAAC,eAAuB;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;YAAE,SAAS;QAC/B,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,SAAS,KAAK,CAAC,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,sFAAsF;QACtF,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,CAAW,EAAE,CAAW;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,GAAG,CAAC,MAAM,IAAI,iBAAiB;YAAE,MAAM;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAClE,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,yFAAyF;IACzF,4FAA4F;IAC5F,wCAAwC;IACxC,6EAA6E;IAC7E,uFAAuF;IACvF,0FAA0F;IAC1F,2FAA2F;IAC3F,+FAA+F;IAC/F,6FAA6F;IAC7F,uBAAuB;IACvB,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,EAAE,8CAA8C,CAAC,CAAC;IACvF,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjE,IAAI,WAAW,GAAa,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,EAAE,uBAAuB,QAAQ,EAAE,CAAC,CAAC;IACjE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,EAAE,2BAA2B,SAAS,OAAO,CAAC,CAAC;QAC/E,IAAI,aAAa;YAAE,WAAW,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC;IAEzD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACxD,IAAI,MAAM;QAAE,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC;IAExC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;IAC9D,IAAI,QAAQ;QAAE,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAExD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/lib/startup-signals.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=startup-signals.test.d.ts.map

package/dist/lib/startup-signals.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-signals.test.d.ts","sourceRoot":"","sources":["../../src/lib/startup-signals.test.ts"],"names":[],"mappings":""}

package/dist/lib/startup-signals.test.js

@@ -0,0 +1,165 @@
+/**
+ * WP-486 Slice 1 (FEAT-1371, TEN-2724) — `collectCliStartupSignals` unit tests. Mocks
+ * `child_process.execSync` so these are deterministic and never shell out to real git.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+const execSyncMock = vi.fn();
+vi.mock('node:child_process', () => ({
+    execSync: (...args) => execSyncMock(...args),
+}));
+import { collectCliStartupSignals } from './startup-signals.js';
+describe('collectCliStartupSignals', () => {
+    beforeEach(() => {
+        execSyncMock.mockReset();
+    });
+    function mockGitCommands(responses) {
+        execSyncMock.mockImplementation((command) => {
+            for (const [match, output] of Object.entries(responses)) {
+                if (command.includes(match))
+                    return output;
+            }
+            throw new Error(`unmocked git command: ${command}`);
+        });
+    }
+    it('collects changedPaths, branchName, worktreeName from git', () => {
+        mockGitCommands({
+            'git status --porcelain': ' M convex/agentKnowledge/orientView.ts\n?? packages/cli/src/lib/startup-signals.ts\n',
+            'git branch --show-current': 'ontology-r4-r5-signal-envelope\n',
+            'git rev-parse --show-toplevel': '/Users/randy/worktree/ontology-r4-r5-signal-envelope\n',
+        });
+        const signals = collectCliStartupSignals('/Users/randy/worktree/ontology-r4-r5-signal-envelope');
+        expect(signals).toEqual({
+            changedPaths: [
+                'convex/agentKnowledge/orientView.ts',
+                'packages/cli/src/lib/startup-signals.ts',
+            ],
+            branchName: 'ontology-r4-r5-signal-envelope',
+            worktreeName: 'ontology-r4-r5-signal-envelope',
+        });
+    });
+    it('resolves a rename line to the NEW path only', () => {
+        mockGitCommands({
+            'git status --porcelain': 'R  old-name.ts -> new-name.ts\n',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual(['new-name.ts']);
+    });
+    it('caps changedPaths at 25 entries', () => {
+        const lines = Array.from({ length: 40 }, (_, i) => ` M file-${i}.ts`).join('\n');
+        mockGitCommands({
+            'git status --porcelain': lines,
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toHaveLength(25);
+    });
+    it('is fail-open: a clean worktree yields no changedPaths key', () => {
+        mockGitCommands({
+            'git status --porcelain': '',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals).not.toHaveProperty('changedPaths');
+    });
+    it('is fail-open: git absence/error yields an empty signal set, never throws', () => {
+        execSyncMock.mockImplementation(() => {
+            throw new Error('git: command not found');
+        });
+        expect(() => collectCliStartupSignals('/not-a-repo')).not.toThrow();
+        expect(collectCliStartupSignals('/not-a-repo')).toEqual({});
+    });
+    // WP-486 Slice 1 — PR #369 review (Codex): two P2 findings, both reproduced live against a
+    // disposable git repo before being fixed here (see PR thread replies for the live evidence).
+    it('requests --untracked-files=all so a wholly-untracked directory expands to its files, not one directory entry', () => {
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': '?? src/routes/new-feature/page.svelte\n?? src/routes/new-feature/logic.ts\n',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual([
+            'src/routes/new-feature/page.svelte',
+            'src/routes/new-feature/logic.ts',
+        ]);
+        // Locks in the actual flag used — a regression back to bare `--porcelain` (default
+        // `--untracked-files=normal`, which collapses the directory to one `?? src/` entry) would
+        // fail this assertion even though the mock above still matches the substring.
+        const calledCommands = execSyncMock.mock.calls.map((c) => c[0]);
+        expect(calledCommands.some((c) => c.includes('--untracked-files=all'))).toBe(true);
+    });
+    it('includes committed branch paths (vs origin/main) when the worktree is clean — the normal re-orientation case', () => {
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': '',
+            'git merge-base HEAD origin/main': 'abc1234\n',
+            'git diff --name-only -z abc1234 HEAD': 'convex/agentKnowledge/orientView.ts\0packages/cli/src/commands/orient.ts\0',
+            'git branch --show-current': 'ontology-r4-r5-signal-envelope\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual([
+            'convex/agentKnowledge/orientView.ts',
+            'packages/cli/src/commands/orient.ts',
+        ]);
+    });
+    it('unions dirty-worktree and committed-branch paths, de-duped', () => {
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': ' M convex/agentKnowledge/orientView.ts\n',
+            'git merge-base HEAD origin/main': 'abc1234\n',
+            'git diff --name-only -z abc1234 HEAD': 'convex/agentKnowledge/orientView.ts\0packages/cli/src/commands/orient.ts\0',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual([
+            'convex/agentKnowledge/orientView.ts',
+            'packages/cli/src/commands/orient.ts',
+        ]);
+    });
+    it('parses -z NUL-separated branch-diff paths without quote-corruption on non-ASCII filenames (PR #369 review)', () => {
+        // `-z` disables git's default core.quotePath octal-escaping outright, so a non-ASCII path
+        // comes through as raw UTF-8 bytes, NUL-terminated — never as a quoted `"caf\303\251.txt"`
+        // string a newline-splitting parser would mis-glob against. This test locks in that the
+        // `-z` flag is actually present on the branch-diff git invocation (a regression back to
+        // bare `--name-only` would corrupt this exact case).
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': '',
+            'git merge-base HEAD origin/main': 'abc1234\n',
+            'git diff --name-only -z abc1234 HEAD': 'café.txt\0src/edge-case.ts\0',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual(['café.txt', 'src/edge-case.ts']);
+    });
+    it('is fail-open: no origin/main (e.g. no network) yields dirty-worktree paths only, never throws', () => {
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': ' M convex/agentKnowledge/orientView.ts\n',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+            // No 'git merge-base' entry — mockGitCommands throws "unmocked git command", simulating a
+            // real git failure (e.g. unknown revision origin/main); runGit's try/catch degrades this
+            // to undefined, same as any other fail-open git error.
+        });
+        expect(() => collectCliStartupSignals('/repo')).not.toThrow();
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual(['convex/agentKnowledge/orientView.ts']);
+    });
+    it('caps the UNIONED changedPaths at 25 entries', () => {
+        const dirty = Array.from({ length: 15 }, (_, i) => ` M dirty-${i}.ts`).join('\n');
+        const branch = Array.from({ length: 15 }, (_, i) => `branch-${i}.ts`).join('\0');
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': dirty,
+            'git merge-base HEAD origin/main': 'abc1234\n',
+            'git diff --name-only -z abc1234 HEAD': branch,
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toHaveLength(25);
+    });
+});
+//# sourceMappingURL=startup-signals.test.js.map

package/dist/lib/startup-signals.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-signals.test.js","sourceRoot":"","sources":["../../src/lib/startup-signals.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D,MAAM,YAAY,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC7B,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,QAAQ,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;CACxD,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,UAAU,CAAC,GAAG,EAAE;QACd,YAAY,CAAC,SAAS,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,SAAS,eAAe,CAAC,SAAiC;QACxD,YAAY,CAAC,kBAAkB,CAAC,CAAC,OAAe,EAAE,EAAE;YAClD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,OAAO,MAAM,CAAC;YAC7C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,eAAe,CAAC;YACd,wBAAwB,EAAE,sFAAsF;YAChH,2BAA2B,EAAE,kCAAkC;YAC/D,+BAA+B,EAAE,wDAAwD;SAC1F,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,sDAAsD,CAAC,CAAC;QAEjG,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YACtB,YAAY,EAAE;gBACZ,qCAAqC;gBACrC,yCAAyC;aAC1C;YACD,UAAU,EAAE,gCAAgC;YAC5C,YAAY,EAAE,gCAAgC;SAC/C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,eAAe,CAAC;YACd,wBAAwB,EAAE,iCAAiC;YAC3D,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjF,eAAe,CAAC;YACd,wBAAwB,EAAE,KAAK;YAC/B,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,eAAe,CAAC;YACd,wBAAwB,EAAE,EAAE;YAC5B,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,YAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE;YACnC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACpE,MAAM,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,2FAA2F;IAC3F,6FAA6F;IAE7F,EAAE,CAAC,8GAA8G,EAAE,GAAG,EAAE;QACtH,eAAe,CAAC;YACd,8CAA8C,EAAE,6EAA6E;YAC7H,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC;YACnC,oCAAoC;YACpC,iCAAiC;SAClC,CAAC,CAAC;QACH,mFAAmF;QACnF,0FAA0F;QAC1F,8EAA8E;QAC9E,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;QAC1E,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8GAA8G,EAAE,GAAG,EAAE;QACtH,eAAe,CAAC;YACd,8CAA8C,EAAE,EAAE;YAClD,iCAAiC,EAAE,WAAW;YAC9C,sCAAsC,EAAE,4EAA4E;YACpH,2BAA2B,EAAE,kCAAkC;YAC/D,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC;YACnC,qCAAqC;YACrC,qCAAqC;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,eAAe,CAAC;YACd,8CAA8C,EAAE,0CAA0C;YAC1F,iCAAiC,EAAE,WAAW;YAC9C,sCAAsC,EAAE,4EAA4E;YACpH,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC;YACnC,qCAAqC;YACrC,qCAAqC;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4GAA4G,EAAE,GAAG,EAAE;QACpH,0FAA0F;QAC1F,2FAA2F;QAC3F,wFAAwF;QACxF,wFAAwF;QACxF,qDAAqD;QACrD,eAAe,CAAC;YACd,8CAA8C,EAAE,EAAE;YAClD,iCAAiC,EAAE,WAAW;YAC9C,sCAAsC,EAAE,8BAA8B;YACtE,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+FAA+F,EAAE,GAAG,EAAE;QACvG,eAAe,CAAC;YACd,8CAA8C,EAAE,0CAA0C;YAC1F,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;YAC1C,0FAA0F;YAC1F,yFAAyF;YACzF,uDAAuD;SACxD,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjF,eAAe,CAAC;YACd,8CAA8C,EAAE,KAAK;YACrD,iCAAiC,EAAE,WAAW;YAC9C,sCAAsC,EAAE,MAAM;YAC9C,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/state.d.ts

@@ -0,0 +1,51 @@
+/**
+ * CLI setup state resolution — determines where the user is in the setup journey
+ * and what render tier to use for output.
+ *
+ * WP-325 S1: Foundation utilities consumed by S2 (index.ts) and S3 (connect.ts).
+ * No callers wired in this slice — this is the shared substrate.
+ *
+ * Stage model:
+ *   unconfigured     → no API key found anywhere
+ *   authenticated    → API key present, but workspace unreachable (offline or not yet connected)
+ *   workspace-bound  → key + workspace reachable, but no active session
+ *   active           → key + workspace + active session
+ */
+/** Four-stage setup journey from cold start to active use. */
+export type SetupStage = 'unconfigured' | 'authenticated' | 'workspace-bound' | 'active';
+export interface SetupState {
+    stage: SetupStage;
+    /** Human-readable list of what is still missing. Empty when stage === 'active'. */
+    missingSteps: string[];
+    /** Single most important next command to run. */
+    nextAction: string;
+    /** Workspace name — populated when workspace probe succeeds. */
+    workspaceName?: string;
+    /** Total entry count from the workspace — populated when workspace probe succeeds. */
+    entryCount?: number;
+    /** Whether a write session is currently active. */
+    sessionActive?: boolean;
+}
+/** Output render tier for the current runtime context. */
+export type RenderTier = 'json' | 'plain' | 'ink';
+/**
+ * Determine the user's current setup stage and surface what's missing.
+ *
+ * Resolution order mirrors the config cascade (getConfigSafe → probeWorkspace → readSession).
+ * Each step is attempted only if the previous one succeeded, matching how the system
+ * actually behaves when a command runs.
+ *
+ * Network calls: probeWorkspace() makes one lightweight orient call. If the caller is in a
+ * context where network is unavailable, this returns 'authenticated' rather than throwing.
+ */
+export declare function resolveSetupState(): Promise<SetupState>;
+/**
+ * Determine the appropriate output rendering tier for the current process context.
+ *
+ * Priority:
+ *   json  → isJsonMode() is true (explicit --json flag or non-TTY piped output)
+ *   plain → stdout is not a TTY (but isJsonMode() was false — e.g. --pretty on a pipe)
+ *   ink   → interactive TTY, Ink React rendering is safe
+ */
+export declare function detectRenderTier(): RenderTier;
+//# sourceMappingURL=state.d.ts.map

package/dist/lib/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/lib/state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH,8DAA8D;AAC9D,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,eAAe,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAEzF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,UAAU,CAAC;IAClB,mFAAmF;IACnF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,0DAA0D;AAC1D,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAMlD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,UAAU,CAAC,CA2C7D;AAMD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAI7C"}

package/dist/lib/state.js

@@ -0,0 +1,90 @@
+/**
+ * CLI setup state resolution — determines where the user is in the setup journey
+ * and what render tier to use for output.
+ *
+ * WP-325 S1: Foundation utilities consumed by S2 (index.ts) and S3 (connect.ts).
+ * No callers wired in this slice — this is the shared substrate.
+ *
+ * Stage model:
+ *   unconfigured     → no API key found anywhere
+ *   authenticated    → API key present, but workspace unreachable (offline or not yet connected)
+ *   workspace-bound  → key + workspace reachable, but no active session
+ *   active           → key + workspace + active session
+ */
+import { getConfigSafe } from './config.js';
+import { probeWorkspace } from './workspace-probe.js';
+import { readSession } from './session.js';
+import { isJsonMode } from './runner.js';
+// ---------------------------------------------------------------------------
+// resolveSetupState
+// ---------------------------------------------------------------------------
+/**
+ * Determine the user's current setup stage and surface what's missing.
+ *
+ * Resolution order mirrors the config cascade (getConfigSafe → probeWorkspace → readSession).
+ * Each step is attempted only if the previous one succeeded, matching how the system
+ * actually behaves when a command runs.
+ *
+ * Network calls: probeWorkspace() makes one lightweight orient call. If the caller is in a
+ * context where network is unavailable, this returns 'authenticated' rather than throwing.
+ */
+export async function resolveSetupState() {
+    // Step 1 — is an API key configured?
+    const configResult = getConfigSafe();
+    if (!configResult.ok) {
+        return {
+            stage: 'unconfigured',
+            missingSteps: ['API key not found'],
+            nextAction: 'pb login',
+        };
+    }
+    // Step 2 — can we reach the workspace?
+    const wsInfo = await probeWorkspace();
+    if (!wsInfo) {
+        return {
+            stage: 'authenticated',
+            missingSteps: ['Workspace not connected or unreachable'],
+            nextAction: 'pb connect',
+        };
+    }
+    // Step 3 — is there an active write session?
+    const session = readSession();
+    if (!session) {
+        return {
+            stage: 'workspace-bound',
+            missingSteps: ['No active write session'],
+            nextAction: 'pb session start',
+            workspaceName: wsInfo.name,
+            entryCount: wsInfo.entryCount,
+            sessionActive: false,
+        };
+    }
+    // All steps satisfied — fully active
+    return {
+        stage: 'active',
+        missingSteps: [],
+        nextAction: 'pb orient -b',
+        workspaceName: wsInfo.name,
+        entryCount: wsInfo.entryCount,
+        sessionActive: true,
+    };
+}
+// ---------------------------------------------------------------------------
+// detectRenderTier
+// ---------------------------------------------------------------------------
+/**
+ * Determine the appropriate output rendering tier for the current process context.
+ *
+ * Priority:
+ *   json  → isJsonMode() is true (explicit --json flag or non-TTY piped output)
+ *   plain → stdout is not a TTY (but isJsonMode() was false — e.g. --pretty on a pipe)
+ *   ink   → interactive TTY, Ink React rendering is safe
+ */
+export function detectRenderTier() {
+    if (isJsonMode())
+        return 'json';
+    if (!process.stdout.isTTY)
+        return 'plain';
+    return 'ink';
+}
+//# sourceMappingURL=state.js.map

package/dist/lib/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/lib/state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA0BzC,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,qCAAqC;IACrC,MAAM,YAAY,GAAG,aAAa,EAAE,CAAC;IACrC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO;YACL,KAAK,EAAE,cAAc;YACrB,YAAY,EAAE,CAAC,mBAAmB,CAAC;YACnC,UAAU,EAAE,UAAU;SACvB,CAAC;IACJ,CAAC;IAED,uCAAuC;IACvC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,YAAY,EAAE,CAAC,wCAAwC,CAAC;YACxD,UAAU,EAAE,YAAY;SACzB,CAAC;IACJ,CAAC;IAED,6CAA6C;IAC7C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,iBAAiB;YACxB,YAAY,EAAE,CAAC,yBAAyB,CAAC;YACzC,UAAU,EAAE,kBAAkB;YAC9B,aAAa,EAAE,MAAM,CAAC,IAAI;YAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,aAAa,EAAE,KAAK;SACrB,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,YAAY,EAAE,EAAE;QAChB,UAAU,EAAE,cAAc;QAC1B,aAAa,EAAE,MAAM,CAAC,IAAI;QAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,aAAa,EAAE,IAAI;KACpB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,UAAU,EAAE;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/strip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"strip.d.ts","sourceRoot":"","sources":["../../src/lib/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAelD"}
+{"version":3,"file":"strip.d.ts","sourceRoot":"","sources":["../../src/lib/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2BH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAelD"}

package/dist/lib/strip.js

@@ -16,8 +16,20 @@ const STRIP_KEYS = new Set(['_id', '_creationTime']);
  *
  * BET-269: Security baseline — C3 (CLI terminal escaping).
  */
+// Note: the CSI/OSC alternatives MUST precede the bare control-char class. Regex
+// alternation takes the first matching alternative at a given position, not the
+// longest — with the control-char class first, a lone ESC (0x1b, inside \x0b-\x1f)
+// matches and consumes before the longer `\x1b\[...` sequence gets a chance,
+// stripping only the ESC and leaving the rest of the escape sequence (e.g. `[31m`)
+// behind as inert-but-visible text (found via PR #341 review Finding 2 testing).
+// Late-fix consolidation round 1 (PRRT_kwDORS4ils6Y0pz3, P1): the control-char class
+// used to jump \x0b\x0c straight to \x0e-\x1f, deliberately skipping \x0d (carriage
+// return) — but a bare \r moves the terminal cursor to column zero and lets the
+// remaining attacker-controlled text overwrite/spoof the start of the line, so (unlike
+// \t/\n, which carry a legitimate multiline-formatting use) it belongs in the stripped
+// set. \x0b-\x1f is now one contiguous range (still excludes \x09 tab and \x0a newline).
 // eslint-disable-next-line no-control-regex
-const ANSI_AND_CONTROL_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]|\x1b\[[0-9;]*[A-Za-z]|\x1b\][^\x07]*\x07|\x1b[^[\]0-9;A-Za-z]?/g;
+const ANSI_AND_CONTROL_RE = /\x1b\[[0-9;]*[A-Za-z]|\x1b\][^\x07]*\x07|\x1b[^[\]0-9;A-Za-z]?|[\x00-\x08\x0b-\x1f\x7f]/g;
 export function stripControlChars(str) {
     if (!str)
         return str;

package/dist/lib/strip.js.map

@@ -1 +1 @@
-{"version":3,"file":"strip.js","sourceRoot":"","sources":["../../src/lib/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;AAErD;;;;;;;GAOG;AACH,4CAA4C;AAC5C,MAAM,mBAAmB,GAAG,kGAAkG,CAAC;AAE/H,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAI,IAAO;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAiB,CAAC;IACxE,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YAC3E,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,MAAsB,CAAC;IAChC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"strip.js","sourceRoot":"","sources":["../../src/lib/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;AAErD;;;;;;;GAOG;AACH,iFAAiF;AACjF,gFAAgF;AAChF,mFAAmF;AACnF,6EAA6E;AAC7E,mFAAmF;AACnF,iFAAiF;AACjF,qFAAqF;AACrF,oFAAoF;AACpF,gFAAgF;AAChF,uFAAuF;AACvF,uFAAuF;AACvF,yFAAyF;AACzF,4CAA4C;AAC5C,MAAM,mBAAmB,GAAG,0FAA0F,CAAC;AAEvH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAI,IAAO;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAiB,CAAC;IACxE,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YAC3E,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,MAAsB,CAAC;IAChC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/style.d.ts

@@ -14,6 +14,8 @@ export declare const green: (s: string) => string;
 export declare const red: (s: string) => string;
 export declare const yellow: (s: string) => string;
 export declare const cyan: (s: string) => string;
+export declare const magenta: (s: string) => string;
+export declare const blue: (s: string) => string;
 export declare const dim: (s: string) => string;
 export declare const bold: (s: string) => string;
 export declare const icons: {
@@ -65,15 +67,20 @@ export declare function formatCheck(status: 'pass' | 'fail' | 'warn', label: str
 /**
  * Print an environment-aware admin banner. Suppressed in quiet mode.
  *
- * Green [DEV] for localhost/127.0.0.1, red [PROD] for everything else.
+ * Labels:
+ * - [DEV] — localhost loopback
+ * - [DEV·CLOUD] — known Convex Development (Cloud) deployment
+ * - [PROD] — known production gateway / prod Convex deployment
+ * - [CLOUD] — other remote URL (unknown tier)
+ *
  * Format: "⚡ pb admin — [ENV] <host>"
  */
 export declare function adminBanner(siteUrl: string): void;
 /**
- * Prompt for confirmation before a production destructive operation.
+ * Prompt for confirmation before a destructive admin operation (remote deployments).
  *
  * Returns true immediately if:
- * - `isProduction` is false (dev — no ceremony needed)
+ * - `isProduction` is false (local loopback or known dev-cloud — no ceremony)
  * - `options.confirm` is true (--confirm flag passed by caller)
  *
  * In interactive TTY: shows a note() scope preview, then clack confirm().
@@ -83,5 +90,7 @@ export declare function confirmProdAction(options: {
     confirm: boolean;
     message: string;
     isProduction: boolean;
+    /** Title for the note() panel (e.g. ⚠ Production vs ⚠ Remote deployment). */
+    noteTitle?: string;
 }): Promise<boolean>;
 //# sourceMappingURL=style.d.ts.map

package/dist/lib/style.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"style.d.ts","sourceRoot":"","sources":["../../src/lib/style.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,0DAA0D;AAC1D,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAMD,eAAO,MAAM,KAAK,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AAC1F,eAAO,MAAM,GAAG,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AACxF,eAAO,MAAM,MAAM,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AAC3F,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AACzF,eAAO,MAAM,GAAG,GAAI,GAAG,MAAM,KAAG,MAAsD,CAAC;AACvF,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,KAAG,MAAsD,CAAC;AAMxF,eAAO,MAAM,KAAK;;;;;;CAMR,CAAC;AAMX,eAAO,MAAM,IAAI;;;;;;;;;;;;;gCAkBI,MAAM;sCACA,MAAM;CACvB,CAAC;AAMX;;;GAGG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAG1C;AAED;;;GAGG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAGvC;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAG3C;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CASnG;AAMD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAajD;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;CACvB,GAAG,OAAO,CAAC,OAAO,CAAC,CASnB"}
+{"version":3,"file":"style.d.ts","sourceRoot":"","sources":["../../src/lib/style.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,0DAA0D;AAC1D,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAMD,eAAO,MAAM,KAAK,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AAC1F,eAAO,MAAM,GAAG,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AACxF,eAAO,MAAM,MAAM,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AAC3F,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AACzF,eAAO,MAAM,OAAO,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AAC5F,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AACzF,eAAO,MAAM,GAAG,GAAI,GAAG,MAAM,KAAG,MAAsD,CAAC;AACvF,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,KAAG,MAAsD,CAAC;AAMxF,eAAO,MAAM,KAAK;;;;;;CAMR,CAAC;AAMX,eAAO,MAAM,IAAI;;;;;;;;;;;;;gCAkBI,MAAM;sCACA,MAAM;CACvB,CAAC;AAMX;;;GAGG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAG1C;AAED;;;GAGG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAGvC;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAG3C;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CASnG;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAoBjD;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,OAAO,CAAC,CASnB"}