@runcofactor/cli 0.52.0 → 0.53.0

package/dist/{scenarios-PVHCKP55.js → scenarios-P2ABU4HK.js}

@@ -1,17 +1,17 @@
 import { createRequire as __cr } from "module"; import { fileURLToPath as __fup } from "url"; import { dirname as __dn } from "path"; const require = __cr(import.meta.url); const __filename = __fup(import.meta.url); const __dirname = __dn(__filename);
 import {
   apiRequest
-} from "./chunk-LL6TSQWV.js";
+} from "./chunk-VKZOHJCE.js";
 import "./chunk-S3Q7MDCS.js";
-import "./chunk-76Z6E7XX.js";
+import "./chunk-4UZN6TVT.js";
 import {
   getArgValue,
   hasFlag,
   resolveConfig
-} from "./chunk-3HI6QC4V.js";
+} from "./chunk-WRBU6TX7.js";
 import {
   writeRawOutput
-} from "./chunk-UEJ2HTKU.js";
+} from "./chunk-MJVUMVLO.js";
 import "./chunk-TOWZAG3I.js";
 
 // src/scenarios.ts
@@ -279,4 +279,4 @@ async function handleReject(argv, apiUrl, token) {
 export {
   runScenarios
 };
-//# sourceMappingURL=scenarios-PVHCKP55.js.map
+//# sourceMappingURL=scenarios-P2ABU4HK.js.map

package/dist/{schedule-DGC7CX23.js → schedule-XLS56NP5.js}

@@ -12,23 +12,23 @@ import {
   handleRuns,
   hasTimingFlags,
   updateRule
-} from "./chunk-QA37WVF6.js";
-import "./chunk-LIEADTEF.js";
-import "./chunk-QTYUM4ZB.js";
+} from "./chunk-OQFCZERZ.js";
+import "./chunk-LJFVRJCA.js";
+import "./chunk-EJ3ZPH5U.js";
 import "./chunk-DEK6B6LX.js";
 import {
   apiRequest
-} from "./chunk-LL6TSQWV.js";
+} from "./chunk-VKZOHJCE.js";
 import "./chunk-S3Q7MDCS.js";
-import "./chunk-76Z6E7XX.js";
+import "./chunk-4UZN6TVT.js";
 import {
   getArgValue,
   hasFlag,
   resolveConfig
-} from "./chunk-3HI6QC4V.js";
+} from "./chunk-WRBU6TX7.js";
 import {
   writeRawOutput
-} from "./chunk-UEJ2HTKU.js";
+} from "./chunk-MJVUMVLO.js";
 import "./chunk-TOWZAG3I.js";
 
 // src/schedule.ts
@@ -335,4 +335,4 @@ async function runSchedule(argv) {
 export {
   runSchedule
 };
-//# sourceMappingURL=schedule-DGC7CX23.js.map
+//# sourceMappingURL=schedule-XLS56NP5.js.map

package/dist/{session-ERGUFDDI.js → session-ACSFC3UB.js}

@@ -2,14 +2,14 @@ import { createRequire as __cr } from "module"; import { fileURLToPath as __fup
 import {
   LocalBrowserHost,
   USER_PAUSED_ERROR
-} from "./chunk-RPJMQBB5.js";
-import "./chunk-DHAGRM2F.js";
+} from "./chunk-QXU4G4YN.js";
+import "./chunk-33U56YGD.js";
 import {
   BrowserToolExecutor,
   PlaywrightClient,
   captureElementAtPoint,
   dispatchBrowserToolWithTimeout
-} from "./chunk-IY3ZK46I.js";
+} from "./chunk-QOVJUSSL.js";
 import "./chunk-JHPFIFRB.js";
 import {
   INTERACTION_CAPTURE_SCRIPT
@@ -42,21 +42,21 @@ import {
   getGuideSectionArg,
   selectCredential,
   uploadStorageState
-} from "./chunk-LL6TSQWV.js";
+} from "./chunk-VKZOHJCE.js";
 import {
   getCanaryTmpDir
 } from "./chunk-S3Q7MDCS.js";
-import "./chunk-76Z6E7XX.js";
+import "./chunk-4UZN6TVT.js";
 import {
   getArgValue,
   hasFlag,
   resolveConfig
-} from "./chunk-3HI6QC4V.js";
+} from "./chunk-WRBU6TX7.js";
 import {
   SESSION_GUIDE_SECTIONS,
   printGuide,
   writeRawOutput
-} from "./chunk-UEJ2HTKU.js";
+} from "./chunk-MJVUMVLO.js";
 import "./chunk-AK7WEGGB.js";
 import "./chunk-NQ7LMSSS.js";
 import {
@@ -2880,4 +2880,4 @@ export {
   buildToolArgs,
   runSession
 };
-//# sourceMappingURL=session-ERGUFDDI.js.map
+//# sourceMappingURL=session-ACSFC3UB.js.map

package/dist/{skill-6QO2E3TB.js → skill-F7I5P6AI.js}

@@ -3,7 +3,7 @@ import {
   brandSkillContentFor,
   brandTextFor,
   command
-} from "./chunk-UEJ2HTKU.js";
+} from "./chunk-MJVUMVLO.js";
 import "./chunk-TOWZAG3I.js";
 
 // src/skill.ts
@@ -310,7 +310,7 @@ Done when every test has passed once on the sandbox and is linked to a capabilit
 ## 4. Nightly schedule and alerts
 Recommend a nightly run with failure alerts. First run \`cofactor teams status\`: leave Teams out of the ask unless it shows Teams enabled. Ask: **"Which Slack channel, Teams channel or email should failures go to? For Slack, approve the connection in the browser page I open; for Teams, run \`cofactor teams install\` in your own terminal and approve it."** Connecting is for organization admins:
 - Slack: run \`cofactor slack connect\` in the background: it opens Settings \u2192 Slack and waits up to 10 minutes for the user's approval. If it connected the wrong workspace, with the user's go-ahead run \`cofactor slack disconnect --yes\`, then connect again. A private channel must add the Cofactor app first (\`/invite\` in that channel).
-- Teams: the user's \`cofactor teams install\` opens the Microsoft consent page; they then add the Cofactor app to the channel, and \`cofactor teams channels\` lists the name to pass to \`--teams\`.
+- Teams: the user's \`cofactor teams install\` opens Settings \u2192 Microsoft Teams in their browser (signing in first if needed), which sends them to the Microsoft consent page and waits for it; they then add the Cofactor app to the channel, and \`cofactor teams channels\` lists the name to pass to \`--teams\`.
 \`\`\`bash
 cofactor test-suite create --name "<App> Nightly"                  # 3b only
 cofactor test-suite set-members <suite> --layer <wf_...,wf_...>    # 3b only
@@ -340,33 +340,46 @@ Rules: neutral example names (Acme, example.com) in tests; never real credential
 // src/skill-templates/cofactor-prove-with-tests.ts
 var cofactorProveWithTestsTemplate = {
   name: "cofactor-prove-with-tests",
-  description: "Prove a change with Cofactor tests. Find existing coverage, edit it through a fork (a new test only when none fits), run it on a sandbox of the change, and list the test with its passed run in the pull request so merging adds it to the regression suite. Use with every user-visible change.",
-  version: "1.0.0",
+  description: "Connect pull request acceptance criteria to passing Cofactor Workflow evidence and configure promotion. Use with every user-visible change.",
+  version: "2.2.0",
   render: () => `---
 name: cofactor-prove-with-tests
-version: 1.0.0
-description: Prove a change with Cofactor tests. Find existing coverage, edit it through a fork (a new test only when none fits), run it on a sandbox of the change, and list the test with its passed run in the pull request so merging adds it to the regression suite. Use with every user-visible change.
-allowed-tools: Bash(cofactor workflow:*), Bash(cofactor sandbox:*), Bash(cofactor proofs:*), Read
+version: 2.2.0
+description: Connect pull request acceptance criteria to passing Cofactor Workflow evidence and configure promotion. Use with every user-visible change.
+allowed-tools: Bash(cofactor workflow:*), Bash(cofactor sandbox:*), Bash(cofactor proofs:*), Bash(cofactor perf guide:*), Read
 ---
 
-# Prove with Tests
-
-Run \`cofactor workflow guide prove-changes\` first. It has the whole loop and the rules.
-
-The failure to avoid is flooding the suite with near-duplicates. **If a test already walks the journey, edit it. Never add a new test for a changed filter, column or field.**
-
-1. **Find coverage first.** \`cofactor workflow list --search "<words>"\`, then \`cofactor workflow get <wf_...> --format markdown\` and read its assertions.
-2. **Choose the change to the suite.**
-   - A test covers the journey: fork it (\`cofactor workflow fork fork <wf_...>\`) and edit the fork, never the original. Add or change the assertion that proves your change.
-   - Nothing covers it, or it needs its own data or role: write a new test (\`cofactor workflow guide write-a-test\`).
-   - No test is possible (nothing a user or API can observe, or the sandbox cannot reach it): say so and say what would make it possible (step 5).
-3. **Prove it on a sandbox of your change.** \`cofactor sandbox claim --application <app> --wait\`, \`cofactor sandbox sync <id> [--build]\`, then \`cofactor workflow run <fork> --sandbox <id> --stream\`. Guide: \`cofactor sandbox guide v2 local\`. Iterate until it passes, then run it once more after your last change: that passing run is your proof, and the command prints its run id (a uuid or \`wrun_...\`; either works).
-4. **Open a draft pull request.**
-5. **List each test with its passed run in the pull request description** (update it once the pull request exists). \`cofactor proofs block <wf_...> <wrun_...> [...]\` checks each pair and prints the block; paste it in. No test possible: \`cofactor proofs block --none "<why; what would make a test possible>"\`.
-   Cofactor does not run the tests again: it checks that each listed run exists, belongs to its test, passed and ran the test as it is now (edit it after the run and the run no longer counts), and reports the \`cofactor / proofs\` check (it does not check which commit the run was against, so run after your last change). When a human merges, new tests are approved and added to suite runs, and forks are merged into their originals, unless the original changed after the fork was taken; then the edit waits for a person. \`cofactor proofs status --application <app> --pr <n>\` shows what the pull request lists.
-6. **Record struggles.** In the pull request description add \`## Proof notes\`: each decision you were unsure about (fork or new, what to assert, what you left uncovered) and why you chose as you did. Tell the user about any missing command or misleading guide you hit.
+# Prove a Change with Tests
+
+Run \`cofactor proofs guide\` for the full procedure. Use with every user-visible change; pass \`--org <org>\` on every write. Performance: \`cofactor perf guide\`.
+
+1. **Find coverage first.** Search with \`cofactor workflow list --search "<words>"\`, inspect with \`cofactor workflow get <wf_...> --format markdown\`, and read assertions. Extend the existing journey; never add near-duplicates for a changed filter, column or field.
+2. **Choose the Workflow.** If an approved test already proves the criterion unchanged (the journey must still work, e.g. after a query change), run it as is and attach its run: it is cited as an existing test, proves it still works, and is never promoted. To change a test, fork approved coverage with \`cofactor workflow fork fork <wf_...> --org <org>\`; never edit the original. Create a draft only when no journey fits or separate data/role is needed (\`cofactor workflow guide write-a-test\`).
+3. **Configure promotion** on a fork/draft (not an existing test) before attaching evidence: \`cofactor workflow set-promotion <workflowId> --promote-on merge|never|deploy:<stage> [--target-suite <suite>]... --org <org>\`; \`never\` archives it at merge, for a proof about the change itself (one-time migration or backfill, flag rollout step, behaviour being removed). Do not choose a layer; curation and suite behavior are in the guide.
+4. **Prove the exact pushed commit.** Commit and push, leave a clean checkout, and use \`git rev-parse HEAD\` as \`<sha>\`. Claim, sync, and run the Workflow (fork, draft or existing test):
+   \`cofactor sandbox claim --application <app> --at <sha> --wait --org <org>\`
+   \`cofactor sandbox sync <sandboxId> [--build] --org <org>\`
+   \`cofactor workflow run <workflowId> --sandbox <sandboxId> --stream --org <org>\`
+   Iterate to passing; after every application or Workflow test change, commit/push application edits, sync, and rerun. Use the final passing run ID; keep the checkout clean. Exact tree/SHA requirements are in the guide.
+5. **Push and open a DRAFT PR.** Commit/push remaining changes; if application or Workflow tests changed, repeat step 4 first. Note PR number \`<n>\` for attach.
+6. **Number observable acceptance criteria.** Supply both \`--text\` and \`--detail\` for each new number; reuse them for additional evidence. Use the most specific node/assertion ID via optional \`--node <id>\` and \`--asserted "Asserted that \u2026"\`. A performance run can prove a criterion: run it at the pushed head SHA, then attach it with \`--perf-run <prun_...>\`. One criterion can mix kinds and carry several items (a query change: a workflow run for behavior and a perf run for speed); every item must pass.
+7. **Attach after the draft PR exists.** Use exactly one subject flag set per command. For E2E evidence, omit optional \`--node\` only if no specific ID exists:
+   \`cofactor proofs attach --pr <n> --application <app> --criterion <n> --text "<criterion>" --detail "<why this matters>" --test <wf_...> --run <wrun_...> [--node <most-specific-id>] --asserted "Asserted that \u2026" --org <org>\`
+   For performance evidence:
+   \`cofactor proofs attach --pr <n> --application <app> --criterion <n> --perf-run <prun_...> --asserted "Asserted that \u2026" --org <org>\`
+   A test containing any \`visual_checkpoint\` node is a UI test, even when it also has other steps. Attaching it runs the same test at the PR base commit and the proof page shows each checkpoint's base, head and diff. Put checkpoints before steps that depend on the new behavior so the base run can reach them.
+   Only for a criterion Cofactor cannot exercise at all (desktop client, hardware, third-party console; never a failing or flaky test), attach manual evidence: \`cofactor proofs attach --pr <n> --application <app> --criterion <n> [--text "<criterion>" --detail "<why>"] --manual --notes <text|@file> [--artifact <https-url>]... --org <org>\`. Say what you did and why Cofactor could not prove it; notes and links are shown to every reader, so redact secrets and customer data and never link signed URLs. It passes, is marked manual, and never promotes; re-attaching replaces it, so repeat every \`--artifact\`.
+8. **Render, check and update.** Replace the PR proof block with all of \`cofactor proofs render --pr <n> --org <org>\`; never hand-format criteria blocks. Check with \`cofactor proofs status --repo <owner/repo> --pr <n> --org <org>\`. Detach a whole criterion with \`cofactor proofs detach --pr <n> --criterion <n> --org <org>\`, or one item with \`--test <wf_...>\` / \`--perf-run <prun_...>\` / \`--manual\`; render again after every attach or detach.
+
+Diagnose with \`cofactor proofs check --pr <n> --sha <head> --body-file <file> --org <org>\` or \`--body -\` for stdin; see the guide for checks/stale evidence. Re-run refreshes stale E2E evidence; performance evidence needs a new run at the current head, an attach, and a detach of the old item; manual evidence is refreshed by attaching it again at the new head. Server and CI own promotion triggers; \`cofactor trigger\` is not your job. No observable acceptance criterion at all (dependency bump, docs-only change)? Hand-type this neutral v2 block, replacing the PR proof block and explaining why:
+
+\`\`\`text
+<!-- cofactor:proof -->
+none: <why this pull request has no criterion to prove>
+<!-- /cofactor:proof -->
+\`\`\`
 
-Rules: use neutral example names in test copy, never a customer's, and never put real credentials in steps. Never approve a test yourself; the human merge is the approval.
+Add concise \`## Proof notes\` explaining uncertain choices, coverage/gaps, and reasons. Use neutral example names; never include customer names, domains, or credentials. A human approves by merging; the agent does not approve Workflows.
 `
 };
 
@@ -439,12 +452,12 @@ Rule: a failure is real only when it reproduces with the same evidence; hand a s
 var cofactorWriteTestTemplate = {
   name: "cofactor-write-test",
   description: "Author a Cofactor end-to-end test directly through the CLI by picking the journey, creating or patching the workflow, running it and returning its URL. Use when the user asks to write, add, extend or fix a test.",
-  version: "2.0.2",
+  version: "2.0.5",
   render: () => `---
 name: cofactor-write-test
-version: 2.0.2
+version: 2.0.5
 description: Author a Cofactor end-to-end test directly through the CLI by picking the journey, creating or patching the workflow, running it and returning its URL. Use when the user asks to write, add, extend or fix a test.
-allowed-tools: Bash(cofactor workflow:*), Bash(cofactor session guide:*), Bash(cofactor login:*), Read
+allowed-tools: Bash(cofactor workflow:*), Bash(cofactor session guide:*), Bash(cofactor perf guide:*), Bash(cofactor login:*), Read
 ---
 
 # Write a Test
@@ -455,6 +468,8 @@ Run \`cofactor workflow guide write-a-test\` first. It covers journey altitude (
 
 For visual regression coverage, read \`cofactor workflow guide visual-checkpoints\` for checkpoint placement, severity, and Playwright attachments.
 
+Performance: \`cofactor perf guide\`
+
 Author directly in the CLI, with no spec files:
 
 \`\`\`bash
@@ -959,4 +974,4 @@ export {
   resolveInstallDir,
   runSkill
 };
-//# sourceMappingURL=skill-6QO2E3TB.js.map
+//# sourceMappingURL=skill-F7I5P6AI.js.map