@productbrain/cli 0.1.0-beta.9 → 0.1.0-beta.90

package/dist/lib/wizard-trust.test.js

@@ -0,0 +1,32 @@
+import { describe, it, expect } from 'vitest';
+import { validateTrustLevel, getTrustLevelDescription, getTrustLevels, } from './wizard-trust.js';
+describe('Trust Level Validation', () => {
+    it('should validate correct trust levels', () => {
+        expect(validateTrustLevel('basic')).toBeUndefined();
+        expect(validateTrustLevel('intermediate')).toBeUndefined();
+        expect(validateTrustLevel('full')).toBeUndefined();
+    });
+    it('should reject invalid trust levels', () => {
+        const result = validateTrustLevel('invalid');
+        expect(result).toBeDefined();
+        expect(result).toContain('Invalid trust level');
+    });
+    it('should return descriptions for trust levels', () => {
+        const basic = getTrustLevelDescription('basic');
+        expect(basic).toContain('names and titles');
+        const intermediate = getTrustLevelDescription('intermediate');
+        expect(intermediate).toContain('descriptions');
+        const full = getTrustLevelDescription('full');
+        expect(full).toContain('custom fields');
+    });
+    it('should return all trust levels', () => {
+        const levels = getTrustLevels();
+        expect(levels).toHaveLength(3);
+        expect(levels.map((l) => l.value)).toEqual(['basic', 'intermediate', 'full']);
+    });
+    it('should have valid TrustLevel type', () => {
+        const level = 'intermediate';
+        expect(level).toBe('intermediate');
+    });
+});
+//# sourceMappingURL=wizard-trust.test.js.map

package/dist/lib/wizard-trust.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wizard-trust.test.js","sourceRoot":"","sources":["../../src/lib/wizard-trust.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,cAAc,GAEf,MAAM,mBAAmB,CAAC;AAE3B,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC3D,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,KAAK,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAE5C,MAAM,YAAY,GAAG,wBAAwB,CAAC,cAAc,CAAC,CAAC;QAC9D,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAE/C,MAAM,IAAI,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,KAAK,GAAe,cAAc,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/workspace-probe.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Shared workspace probe utility — single source of truth for workspace connectivity check.
+ * Used by both `pb init` and the no-args dashboard in `index.ts`.
+ *
+ * Design: lightweight orient call to detect workspace reachability. Returns structured
+ * workspace info on success, null on any failure (network, auth, offline).
+ */
+/**
+ * Attempt to detect workspace connectivity via a lightweight API call.
+ * Returns workspace info on success, null on any failure.
+ *
+ * Uses resolveWorkspace (registered in http.ts) rather than orient, which is
+ * not exposed on the HTTP gateway — orient is MCP-server-only.
+ */
+export declare function probeWorkspace(): Promise<{
+    name: string;
+    entryCount?: number;
+} | null>;
+//# sourceMappingURL=workspace-probe.d.ts.map

package/dist/lib/workspace-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-probe.d.ts","sourceRoot":"","sources":["../../src/lib/workspace-probe.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;;GAMG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAQ5F"}

package/dist/lib/workspace-probe.js

@@ -0,0 +1,27 @@
+/**
+ * Shared workspace probe utility — single source of truth for workspace connectivity check.
+ * Used by both `pb init` and the no-args dashboard in `index.ts`.
+ *
+ * Design: lightweight orient call to detect workspace reachability. Returns structured
+ * workspace info on success, null on any failure (network, auth, offline).
+ */
+import { kernelCall } from './client.js';
+/**
+ * Attempt to detect workspace connectivity via a lightweight API call.
+ * Returns workspace info on success, null on any failure.
+ *
+ * Uses resolveWorkspace (registered in http.ts) rather than orient, which is
+ * not exposed on the HTTP gateway — orient is MCP-server-only.
+ */
+export async function probeWorkspace() {
+    try {
+        const result = await kernelCall('resolveWorkspace', {});
+        if (!result)
+            return null;
+        return { name: result.name || 'unknown' };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=workspace-probe.js.map

package/dist/lib/workspace-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-probe.js","sourceRoot":"","sources":["../../src/lib/workspace-probe.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAA0C,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/surfaces/registry.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Surface Capability Registry — WP-310 S0 (FEAT-959)
+ *
+ * Static typed record of per-surface capabilities consumed by E1–E4.
+ * INS-740: Cursor and Copilot had confirmed double-fire risk with Claude Code hooks.
+ * Their hookEvents arrays MUST be empty in v1. Only 'claude' gets hook events by default.
+ */
+export type SurfaceName = 'claude' | 'cursor' | 'copilot' | 'codex';
+export interface SurfaceCapability {
+    rulesFormat: 'markdown' | 'mdc';
+    skillsFormat: 'markdown' | 'none';
+    /** Hook events to project. Empty array = no default hook writes (INS-740 double-fire risk). */
+    hookEvents: string[];
+    /** Path to the surface's personal config file. */
+    hookFilePath: string;
+    personalConfigMechanism: 'settings_json' | 'none';
+    supportsAgentsMd: boolean;
+}
+export declare const SURFACE_REGISTRY: Record<SurfaceName, SurfaceCapability>;
+//# sourceMappingURL=registry.d.ts.map

package/dist/surfaces/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/surfaces/registry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAEpE,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,UAAU,GAAG,KAAK,CAAC;IAChC,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,+FAA+F;IAC/F,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,kDAAkD;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,eAAe,GAAG,MAAM,CAAC;IAClD,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAiCnE,CAAC"}

package/dist/surfaces/registry.js

@@ -0,0 +1,42 @@
+/**
+ * Surface Capability Registry — WP-310 S0 (FEAT-959)
+ *
+ * Static typed record of per-surface capabilities consumed by E1–E4.
+ * INS-740: Cursor and Copilot had confirmed double-fire risk with Claude Code hooks.
+ * Their hookEvents arrays MUST be empty in v1. Only 'claude' gets hook events by default.
+ */
+export const SURFACE_REGISTRY = {
+    claude: {
+        rulesFormat: 'markdown',
+        skillsFormat: 'markdown',
+        hookEvents: ['SessionStart', 'Stop', 'PreCompact'],
+        hookFilePath: '.claude/settings.json',
+        personalConfigMechanism: 'settings_json',
+        supportsAgentsMd: false,
+    },
+    cursor: {
+        rulesFormat: 'mdc',
+        skillsFormat: 'markdown',
+        hookEvents: [], // empty per INS-740 — no default Cursor hook writes
+        hookFilePath: '.cursor/settings.json',
+        personalConfigMechanism: 'none',
+        supportsAgentsMd: false,
+    },
+    copilot: {
+        rulesFormat: 'markdown',
+        skillsFormat: 'none',
+        hookEvents: [], // empty per INS-740
+        hookFilePath: '.github/copilot-instructions.md',
+        personalConfigMechanism: 'none',
+        supportsAgentsMd: false,
+    },
+    codex: {
+        rulesFormat: 'markdown',
+        skillsFormat: 'markdown',
+        hookEvents: [],
+        hookFilePath: 'AGENTS.md',
+        personalConfigMechanism: 'none',
+        supportsAgentsMd: true,
+    },
+};
+//# sourceMappingURL=registry.js.map

package/dist/surfaces/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/surfaces/registry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAeH,MAAM,CAAC,MAAM,gBAAgB,GAA2C;IACtE,MAAM,EAAE;QACN,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,UAAU;QACxB,UAAU,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,CAAC;QAClD,YAAY,EAAE,uBAAuB;QACrC,uBAAuB,EAAE,eAAe;QACxC,gBAAgB,EAAE,KAAK;KACxB;IACD,MAAM,EAAE;QACN,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,UAAU;QACxB,UAAU,EAAE,EAAE,EAAE,oDAAoD;QACpE,YAAY,EAAE,uBAAuB;QACrC,uBAAuB,EAAE,MAAM;QAC/B,gBAAgB,EAAE,KAAK;KACxB;IACD,OAAO,EAAE;QACP,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,MAAM;QACpB,UAAU,EAAE,EAAE,EAAE,oBAAoB;QACpC,YAAY,EAAE,iCAAiC;QAC/C,uBAAuB,EAAE,MAAM;QAC/B,gBAAgB,EAAE,KAAK;KACxB;IACD,KAAK,EAAE;QACL,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,UAAU;QACxB,UAAU,EAAE,EAAE;QACd,YAAY,EAAE,WAAW;QACzB,uBAAuB,EAAE,MAAM;QAC/B,gBAAgB,EAAE,IAAI;KACvB;CACF,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@productbrain/cli",
-  "version": "0.1.0-beta.9",
-  "description": "Product Brain — read-only CLI for Chain knowledge",
+  "version": "0.1.0-beta.90",
+  "description": "Product Brain — Chain knowledge and write-back CLI",
   "type": "module",
   "bin": {
     "pb": "dist/index.js"
@@ -14,23 +14,29 @@
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit",
     "lint": "tsc --noEmit",
-    "test": "vitest run src/__tests__/",
+    "test": "vitest run src/",
     "prepublishOnly": "npm run build",
     "publish:beta": "npm publish --tag=beta",
     "version:prerelease": "npm version prerelease --no-git-tag-version"
   },
   "dependencies": {
+    "@clack/prompts": "^0.10.0",
     "commander": "^12.0.0",
     "glob": "^11.0.0",
+    "ink": "^7.0.0",
+    "ink-text-input": "^6.0.0",
+    "react": "^19.0.0",
     "undici": "^7.24.5"
   },
   "devDependencies": {
     "@types/node": "^25.3.0",
+    "@types/react": "^19.0.0",
     "typescript": "^5.0.0",
     "vitest": "^4.0.18"
   },
   "files": [
     "dist",
+    "templates",
     "README.md"
   ],
   "publishConfig": {

package/templates/archetypes/boundary.md

@@ -0,0 +1,23 @@
+---
+name: chain-boundaries
+description: "{{entry_count}} system boundaries derived from Chain architecture entries"
+autoApply: true
+level: core
+---
+
+# Chain-Derived System Boundaries
+
+These {{entry_count}} architecture and decision entries define system boundaries for this workspace. Do not cross a boundary without understanding the contract it defines.
+
+**Boundary entries:** {{entry_ids}}
+
+{{boundary_summary}}
+
+## What this means
+
+- Boundaries define what a domain owns and what it does not own.
+- Cross-domain changes require explicit negotiation — check the Team APIs in `docs/system/domains/`.
+- Run `pb get <ID>` to read the full boundary entry before touching cross-domain seams.
+- If your change crosses a domain boundary, identify the owning domain first (domain-boundaries rule).
+
+**Source entries (names):** {{entry_names}}

package/templates/archetypes/constraint.md

@@ -0,0 +1,23 @@
+---
+name: chain-constraints
+description: "{{entry_count}} implementation constraints derived from Chain governance entries"
+autoApply: true
+level: core
+---
+
+# Chain-Derived Constraints
+
+These {{entry_count}} governance entries constrain implementation in this workspace. Before writing code that touches any affected domain, check these entries on the Chain.
+
+**Constraint entries:** {{entry_ids}}
+
+{{constraint_summary}}
+
+## What this means
+
+- These standards and rules are non-negotiable. They constrain behavior across all slices.
+- Run `pb get <ID>` to read the full entry before implementing anything in its domain.
+- If your change conflicts with a constraint, capture a tension before proceeding.
+- "I didn't know" is not a valid defense when the constraint is on the Chain.
+
+**Source entries (names):** {{entry_names}}

package/templates/archetypes/convention.md

@@ -0,0 +1,23 @@
+---
+name: chain-conventions
+description: "{{entry_count}} conventions derived from Chain decision and pattern entries"
+autoApply: true
+level: core
+---
+
+# Chain-Derived Conventions
+
+These {{entry_count}} decision and pattern entries establish conventions for this workspace. Follow them unless you have a decision on the Chain that says otherwise.
+
+**Convention entries:** {{entry_ids}}
+
+{{convention_summary}}
+
+## What this means
+
+- Conventions are established patterns, not suggestions. They reduce decision fatigue.
+- Before inventing a new pattern, search the Chain — it may already be a convention.
+- Run `pb get <ID>` to understand the rationale behind a convention before deviating.
+- If you must deviate, capture a DEC on the Chain explaining the new direction.
+
+**Source entries (names):** {{entry_names}}

package/templates/archetypes/policy.md

@@ -0,0 +1,23 @@
+---
+name: chain-policies
+description: "{{entry_count}} operational policies derived from Chain policy and business-rule entries"
+autoApply: true
+level: core
+---
+
+# Chain-Derived Policies
+
+These {{entry_count}} policy and business-rule entries govern workflows and access in this workspace. Policies apply even when they are inconvenient.
+
+**Policy entries:** {{entry_ids}}
+
+{{policy_summary}}
+
+## What this means
+
+- Policies govern who can do what and under what conditions.
+- Security, auth, and access control policies are never optional.
+- Run `pb get <ID>` to read the full policy before implementing anything in its domain.
+- If a policy conflicts with a feature requirement, capture a TEN and escalate — do not quietly violate.
+
+**Source entries (names):** {{entry_names}}

package/templates/archetypes/quality-gate.md

@@ -0,0 +1,23 @@
+---
+name: chain-quality-gates
+description: "{{entry_count}} quality gates derived from Chain standard and business-rule entries"
+autoApply: true
+level: core
+---
+
+# Chain-Derived Quality Gates
+
+These {{entry_count}} standard and business-rule entries define quality gates that must pass before shipping. No exceptions without a documented reason on the Chain.
+
+**Quality gate entries:** {{entry_ids}}
+
+{{quality_summary}}
+
+## What this means
+
+- Quality gates are pass/fail. They are not approximate.
+- Run `npm run build` and `npm run test` before every push — always.
+- Run `pb get <ID>` to read the specific acceptance criteria for a quality gate.
+- If a gate cannot pass due to a legitimate constraint, capture a TEN before shipping.
+
+**Source entries (names):** {{entry_names}}

package/templates/archetypes/workflow.md

@@ -0,0 +1,23 @@
+---
+name: chain-workflows
+description: "{{entry_count}} required process flows derived from Chain flow entries"
+autoApply: true
+level: core
+---
+
+# Chain-Derived Workflows
+
+These {{entry_count}} flow entries define required processes for this workspace. If a workflow entry exists for a process you are about to execute, follow it.
+
+**Workflow entries:** {{entry_ids}}
+
+{{workflow_summary}}
+
+## What this means
+
+- Workflows define the correct sequence of steps for key processes.
+- Skipping a step is not the same as completing the workflow.
+- Run `pb get <ID>` to read the full workflow before executing the process it defines.
+- If the workflow is incomplete or outdated, capture a TEN — do not silently deviate.
+
+**Source entries (names):** {{entry_names}}

package/templates/general/code-integrity.md

@@ -0,0 +1,11 @@
+---
+name: code-integrity
+description: General code quality patterns
+level: core
+---
+
+# Code Integrity
+
+- Derive from the source of truth, don't duplicate
+- Handle errors at boundaries, not everywhere
+- Names should describe what, not how

package/templates/general/getting-started.md

@@ -0,0 +1,12 @@
+---
+name: getting-started
+description: Product Brain onboarding for new workspaces
+level: core
+---
+
+# Getting Started with Product Brain
+
+- Run `pb orient -b` to see your workspace state
+- Run `pb handshake` after changing rules or skills in `.productbrain/`
+- Rules go in `.productbrain/rules/`, skills go in `.productbrain/skills/`
+- The Chain is the single source of truth — use `pb get <ID>` to load any entry

package/templates/method-registry.json

@@ -0,0 +1,16 @@
+{
+  "version": "1.0",
+  "generatedAt": "2026-04-18T00:00:00.000Z",
+  "methods": [
+    { "name": "session start", "usage": "pb session start", "description": "Open a tracked write session before making changes to the Chain." },
+    { "name": "session close", "usage": "pb session close", "description": "Close the current session and prompt for captures." },
+    { "name": "capture", "usage": "pb capture \"TYPE: text\"", "description": "Capture a decision (DEC), tension (TEN), insight (INS), or experiment (EXP) as a draft entry." },
+    { "name": "orient", "usage": "pb orient --task \"<task>\"", "description": "Get task-relevant governance and context before implementation." },
+    { "name": "get", "usage": "pb get <ID>", "description": "Get a full Chain entry by ID (BET, DEC, STD, BR, TEN, etc.)." },
+    { "name": "search", "usage": "pb search <query>", "description": "Search entries across the Chain." },
+    { "name": "handshake", "usage": "pb handshake", "description": "Refresh generated context files from Chain governance." },
+    { "name": "handshake --init", "usage": "pb handshake --init", "description": "Set up Claude Code integration (hooks, permissions, trust level)." },
+    { "name": "update", "usage": "pb update <ID> -f \"field=value\"", "description": "Update a Chain entry field." },
+    { "name": "context", "usage": "pb context <ID>", "description": "Get constellation context for a Chain entry." }
+  ]
+}

package/templates/node-ts/code-integrity.md

@@ -0,0 +1,13 @@
+---
+name: code-integrity
+description: TypeScript code quality patterns
+level: core
+when_stack: typescript
+---
+
+# Code Integrity
+
+- Use strict TypeScript (`strict: true` in tsconfig)
+- Prefer `const` over `let`
+- Use explicit return types on exported functions
+- Handle errors at boundaries, not everywhere

package/templates/node-ts/testing.md

@@ -0,0 +1,12 @@
+---
+name: testing
+description: Testing standards for Node/TypeScript projects
+level: intermediate
+when_stack: typescript
+---
+
+# Testing Standards
+
+- Test behavior, not implementation
+- One assertion per test when possible
+- Use descriptive test names that read as specifications

package/templates/python/code-integrity.md

@@ -0,0 +1,13 @@
+---
+name: code-integrity
+description: Python code quality patterns
+level: core
+when_stack: python
+---
+
+# Code Integrity
+
+- Use type hints on function signatures
+- Prefer f-strings over .format()
+- Handle errors at boundaries, not everywhere
+- Use pathlib over os.path

package/templates/python/testing.md

@@ -0,0 +1,12 @@
+---
+name: testing
+description: Testing standards for Python projects
+level: intermediate
+when_stack: python
+---
+
+# Testing Standards
+
+- Test behavior, not implementation
+- Use pytest fixtures for shared setup
+- Use descriptive test names that read as specifications