@shepai/cli 1.170.0-pr513.cff27cb → 1.171.0-pr527.e2ee839

package/dist/packages/core/src/infrastructure/services/spec/spec-initializer.service.d.ts

@@ -7,7 +7,8 @@
  */
 import type { ISpecInitializerService, SpecInitializerResult } from '../../../application/ports/output/services/spec-initializer.interface.js';
 export declare class SpecInitializerService implements ISpecInitializerService {
-    initialize(basePath: string, slug: string, featureNumber: number, description: string, mode?: 'fast' | 'exploration'): Promise<SpecInitializerResult>;
+    initialize(basePath: string, slug: string, featureNumber: number, description: string, mode?: 'fast'): Promise<SpecInitializerResult>;
+    scaffoldSecurityPolicy(repositoryPath: string): Promise<string>;
     /**
      * Scan specs/ for existing NNN-* directories and return the next available number.
      * Uses the DB-derived hint as a minimum, but always respects filesystem state.

package/dist/packages/core/src/infrastructure/services/spec/spec-initializer.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spec-initializer.service.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/infrastructure/services/spec/spec-initializer.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,mEAAmE,CAAC;AA8P3E,qBAAa,sBAAuB,YAAW,uBAAuB;IAC9D,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IAwCjC;;;OAGG;YACW,iBAAiB;CAoBhC"}
+{"version":3,"file":"spec-initializer.service.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/infrastructure/services/spec/spec-initializer.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,mEAAmE,CAAC;AAwT3E,qBAAa,sBAAuB,YAAW,uBAAuB;IAC9D,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC;IAqC3B,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAMrE;;;OAGG;YACW,iBAAiB;CAoBhC"}

package/dist/packages/core/src/infrastructure/services/spec/spec-initializer.service.js

@@ -7,6 +7,7 @@
  */
 import { mkdir, readdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { SECURITY_POLICY_FILENAME } from '../../services/security/security-policy-file-reader.js';
 /**
  * Pad a number to 3 digits with leading zeros.
  */
@@ -239,6 +240,61 @@ const TEMPLATES = [
     { filename: 'tasks.yaml', content: TASKS_YAML },
     { filename: 'feature.yaml', content: FEATURE_YAML },
 ];
+// ─── Security Policy Template ─────────────────────────────────────
+// Baseline shep.security.yaml for new repositories.
+const SECURITY_POLICY_YAML = `# Shep Supply Chain Security Policy
+# This file defines the security posture for this repository.
+# Shep evaluates this policy during agent execution and CI enforcement.
+#
+# Docs: https://shep.bot/docs/security/policy
+
+# Security mode controls enforcement behavior:
+#   Disabled  - Security checks are skipped entirely
+#   Advisory  - Checks run and findings are reported, but nothing is blocked
+#   Enforce   - Checks run and violations block agent actions and CI jobs
+mode: Advisory
+
+# Action dispositions control how the agent handles each action category.
+# Each entry maps a category to a disposition:
+#   Allowed          - Action proceeds without interruption
+#   Denied           - Action is blocked before execution
+#   ApprovalRequired - Action pauses for human approval via HITL gate
+actionDispositions:
+  - category: DependencyInstall
+    disposition: ApprovalRequired
+  - category: PackageScriptExec
+    disposition: ApprovalRequired
+  - category: CiWorkflowModify
+    disposition: ApprovalRequired
+  - category: PublishRelease
+    disposition: Denied
+  - category: SandboxEscalation
+    disposition: Denied
+
+# Dependency risk rules evaluated by "shep security enforce"
+dependencyRules:
+  # Verify lockfile matches package.json (detects phantom dependencies)
+  checkLockfileConsistency: true
+  # Flag packages with risky lifecycle scripts (preinstall, postinstall)
+  checkLifecycleScripts: true
+  # Flag dependencies sourced from git, file, or HTTP instead of registry
+  checkNonRegistrySource: true
+  # Require exact versions (no ^, ~, *, >= ranges)
+  enforceStrictVersionRanges: false
+  # Packages explicitly allowed (empty = allow all registry packages)
+  allowlist: []
+  # Packages explicitly blocked (takes precedence over allowlist)
+  denylist: []
+
+# Release integrity rules for publish-path enforcement
+releaseRules:
+  # Require publishing only from CI (not local machines)
+  requireCiOnlyPublishing: true
+  # Require npm provenance attestation on published packages
+  requireProvenance: true
+  # Check that release workflow has not been tampered with
+  checkWorkflowIntegrity: true
+`;
 export class SpecInitializerService {
     async initialize(basePath, slug, featureNumber, description, mode) {
         // Scan existing specs/ directory for highest NNN prefix to avoid collisions
@@ -254,17 +310,19 @@ export class SpecInitializerService {
         const timestamp = now.toISOString().replace(/\.\d{3}Z$/, 'Z');
         const vars = { nnn, slug, featureNumber: resolvedNumber, date, timestamp, description };
         // In fast mode, write feature.yaml + spec.yaml (spec.yaml stores the user query
-        // which the fast-implement node reads; no research/plan/tasks needed).
-        // In exploration mode, write only feature.yaml (no SDLC spec artifacts).
-        const templates = mode === 'exploration'
-            ? TEMPLATES.filter(({ filename }) => filename === 'feature.yaml')
-            : mode === 'fast'
-                ? TEMPLATES.filter(({ filename }) => filename === 'feature.yaml' || filename === 'spec.yaml')
-                : TEMPLATES;
+        // which the fast-implement node reads; no research/plan/tasks needed)
+        const templates = mode === 'fast'
+            ? TEMPLATES.filter(({ filename }) => filename === 'feature.yaml' || filename === 'spec.yaml')
+            : TEMPLATES;
         // Write template files
         await Promise.all(templates.map(({ filename, content }) => writeFile(join(specDir, filename), applyTemplate(content, vars), 'utf-8')));
         return { specDir, featureNumber: nnn };
     }
+    async scaffoldSecurityPolicy(repositoryPath) {
+        const filePath = join(repositoryPath, SECURITY_POLICY_FILENAME);
+        await writeFile(filePath, SECURITY_POLICY_YAML, 'utf-8');
+        return filePath;
+    }
     /**
      * Scan specs/ for existing NNN-* directories and return the next available number.
      * Uses the DB-derived hint as a minimum, but always respects filesystem state.

package/dist/src/presentation/cli/commands/feat/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/cli/commands/feat/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkBpC;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAkB3C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/cli/commands/feat/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgBpC;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAgB3C"}

package/dist/src/presentation/cli/commands/feat/index.js

@@ -24,8 +24,6 @@ import { createLogsCommand } from './logs.command.js';
 import { createAdoptCommand } from './adopt.command.js';
 import { createArchiveCommand } from './archive.command.js';
 import { createUnarchiveCommand } from './unarchive.command.js';
-import { createFeedbackCommand } from './feedback.command.js';
-import { createPromoteCommand } from './promote.command.js';
 /**
  * Create the feat command group
  */
@@ -44,7 +42,5 @@ export function createFeatCommand() {
         .addCommand(createLogsCommand())
         .addCommand(createAdoptCommand())
         .addCommand(createArchiveCommand())
-        .addCommand(createUnarchiveCommand())
-        .addCommand(createFeedbackCommand())
-        .addCommand(createPromoteCommand());
+        .addCommand(createUnarchiveCommand());
 }

package/dist/src/presentation/cli/commands/feat/new.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"new.command.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/cli/commands/feat/new.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0EpC;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAoL1C"}
+{"version":3,"file":"new.command.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/cli/commands/feat/new.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyEpC;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAsK1C"}

package/dist/src/presentation/cli/commands/feat/new.command.js

@@ -15,7 +15,7 @@ import { existsSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { container } from '../../../../../packages/core/src/infrastructure/di/container.js';
 import { CreateFeatureUseCase } from '../../../../../packages/core/src/application/use-cases/features/create/create-feature.use-case.js';
-import { SdlcLifecycle, FeatureMode } from '../../../../../packages/core/src/domain/generated/output.js';
+import { SdlcLifecycle } from '../../../../../packages/core/src/domain/generated/output.js';
 import { colors, messages, spinner } from '../../ui/index.js';
 import { getCliI18n } from '../../i18n.js';
 import { getShepHomeDir } from '../../../../../packages/core/src/infrastructure/services/filesystem/shep-directory.service.js';
@@ -34,7 +34,7 @@ function getWorkflowDefaults() {
             allowPlan: false,
             allowMerge: false,
             push: false,
-            defaultMode: FeatureMode.Fast,
+            fast: true,
         };
     }
     const settings = getSettings();
@@ -45,7 +45,7 @@ function getWorkflowDefaults() {
         allowPlan: gates.allowPlan,
         allowMerge: gates.allowMerge,
         push: gates.pushOnImplementationComplete,
-        defaultMode: settings.workflow.defaultMode ?? FeatureMode.Fast,
+        fast: settings.workflow.defaultFastMode,
     };
 }
 /**
@@ -68,7 +68,6 @@ export function createNewCommand() {
         .option('--pending', t('cli:commands.feat.new.pendingOption'))
         .option('--fast', t('cli:commands.feat.new.fastOption'))
         .option('--no-fast', t('cli:commands.feat.new.noFastOption'))
-        .option('--explore', t('cli:commands.feat.new.exploreOption'))
         .option('--model <model>', t('cli:commands.feat.new.modelOption'))
         .option('--no-rebase', t('cli:commands.feat.new.noRebaseOption'))
         .option('--inject-skills', t('cli:commands.feat.new.injectSkillsOption'))
@@ -122,19 +121,7 @@ export function createNewCommand() {
                     attachmentPaths.push(resolved);
                 }
             }
-            // Validate mutually exclusive mode flags
-            if (options.explore && options.fast) {
-                messages.error(t('cli:commands.feat.new.exploreAndFastConflict'));
-                process.exitCode = 1;
-                return;
-            }
-            const mode = options.explore
-                ? FeatureMode.Exploration
-                : options.fast
-                    ? FeatureMode.Fast
-                    : options.fast === false
-                        ? FeatureMode.Regular
-                        : defaults.defaultMode;
+            const fast = options.fast ?? defaults.fast;
             const result = await spinner(t('cli:commands.feat.new.spinnerText'), () => useCase.execute({
                 userInput: description,
                 repositoryPath: repoPath,
@@ -143,7 +130,7 @@ export function createNewCommand() {
                 openPr,
                 ...(parentId !== undefined && { parentId }),
                 ...(options.pending && { pending: true }),
-                mode,
+                ...(fast && { fast: true }),
                 ...(options.model !== undefined && { model: options.model }),
                 ...(attachmentPaths.length > 0 && { attachmentPaths }),
                 ...(options.injectSkills !== undefined && { injectSkills: options.injectSkills }),

package/dist/src/presentation/cli/commands/security.command.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Security Command Group
+ *
+ * Top-level security command with subcommands for supply-chain security
+ * policy management and enforcement.
+ *
+ * Usage:
+ *   shep security enforce          Evaluate and enforce security posture
+ *   shep security enforce --output json   Machine-readable output for CI
+ */
+import { Command } from 'commander';
+/**
+ * Create the security command group with all subcommands.
+ */
+export declare function createSecurityCommand(): Command;
+//# sourceMappingURL=security.command.d.ts.map

package/dist/src/presentation/cli/commands/security.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.command.d.ts","sourceRoot":"","sources":["../../../../../src/presentation/cli/commands/security.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAqH/C"}

package/dist/src/presentation/cli/commands/security.command.js

@@ -0,0 +1,118 @@
+/**
+ * Security Command Group
+ *
+ * Top-level security command with subcommands for supply-chain security
+ * policy management and enforcement.
+ *
+ * Usage:
+ *   shep security enforce          Evaluate and enforce security posture
+ *   shep security enforce --output json   Machine-readable output for CI
+ */
+import { Command } from 'commander';
+import { container } from '../../../../packages/core/src/infrastructure/di/container.js';
+import { EnforceSecurityUseCase } from '../../../../packages/core/src/application/use-cases/security/enforce-security.use-case.js';
+import { SecurityMode } from '../../../../packages/core/src/domain/generated/output.js';
+import { colors, fmt, messages } from '../ui/index.js';
+import { OutputFormatter } from '../ui/output.js';
+import { getCliI18n } from '../i18n.js';
+/**
+ * Create the security command group with all subcommands.
+ */
+export function createSecurityCommand() {
+    const t = getCliI18n().t;
+    const security = new Command('security').description(t('cli:commands.security.description'));
+    security
+        .command('enforce')
+        .description(t('cli:commands.security.enforce.description'))
+        .option('-r, --repo <path>', t('cli:commands.security.enforce.repoOption'), process.cwd())
+        .option('-o, --output <format>', t('cli:commands.security.enforce.outputOption'), 'table')
+        .action(async (options) => {
+        try {
+            const useCase = container.resolve(EnforceSecurityUseCase);
+            const result = await useCase.execute({ repositoryPath: options.repo });
+            const outputFormat = options.output;
+            if (outputFormat === 'json' || outputFormat === 'yaml') {
+                // Machine-readable output
+                console.log(OutputFormatter.format(result, outputFormat));
+            }
+            else {
+                // Human-readable table output
+                messages.newline();
+                if (result.mode === SecurityMode.Disabled) {
+                    messages.info(t('cli:commands.security.enforce.disabledNote'));
+                    messages.newline();
+                }
+                else {
+                    // Summary header
+                    console.log(`${fmt.label(t('cli:commands.security.enforce.modeLabel'))}:     ${result.mode}`);
+                    console.log(`${fmt.label(t('cli:commands.security.enforce.sourceLabel'))}:   ${result.policy.source}`);
+                    console.log(`${fmt.label(t('cli:commands.security.enforce.totalFindingsLabel'))}: ${result.totalFindings}`);
+                    messages.newline();
+                    // Dependency findings
+                    if (result.dependencyFindings.length > 0) {
+                        console.log(fmt.heading(t('cli:commands.security.enforce.dependencyFindingsLabel')));
+                        for (const finding of result.dependencyFindings) {
+                            const severityColor = finding.severity === 'Critical' || finding.severity === 'High'
+                                ? colors.error
+                                : colors.warning;
+                            console.log(`  ${severityColor(`[${finding.severity}]`)} ${finding.packageName}: ${finding.message}`);
+                            if (finding.remediation) {
+                                console.log(`    ${colors.muted(finding.remediation)}`);
+                            }
+                        }
+                        messages.newline();
+                    }
+                    // Release integrity
+                    const failedChecks = result.releaseIntegrity.checks.filter((c) => !c.passed);
+                    if (failedChecks.length > 0) {
+                        console.log(fmt.heading(t('cli:commands.security.enforce.releaseIntegrityLabel')));
+                        for (const check of failedChecks) {
+                            const severityColor = check.severity === 'Critical' || check.severity === 'High'
+                                ? colors.error
+                                : colors.warning;
+                            console.log(`  ${severityColor(`[${check.severity}]`)} ${check.message}`);
+                        }
+                        messages.newline();
+                    }
+                    // Governance findings (audit-only)
+                    if (result.governanceFindings.length > 0) {
+                        console.log(fmt.heading(t('cli:commands.security.enforce.governanceFindingsLabel')));
+                        for (const finding of result.governanceFindings) {
+                            const severityColor = finding.severity === 'Critical' || finding.severity === 'High'
+                                ? colors.error
+                                : colors.warning;
+                            console.log(`  ${severityColor(`[${finding.severity}]`)} ${finding.message}`);
+                            if (finding.remediation) {
+                                console.log(`    ${colors.muted(finding.remediation)}`);
+                            }
+                        }
+                        messages.newline();
+                    }
+                    // Result
+                    if (result.totalFindings === 0) {
+                        messages.info(t('cli:commands.security.enforce.noFindings'));
+                    }
+                    if (result.passed) {
+                        messages.success(t('cli:commands.security.enforce.passed'));
+                        if (result.mode === SecurityMode.Advisory && result.totalFindings > 0) {
+                            messages.info(t('cli:commands.security.enforce.advisoryNote'));
+                        }
+                    }
+                    else {
+                        messages.error(t('cli:commands.security.enforce.failed'));
+                    }
+                }
+                messages.newline();
+            }
+            if (!result.passed) {
+                process.exitCode = 1;
+            }
+        }
+        catch (error) {
+            const err = error instanceof Error ? error : new Error(String(error));
+            messages.error(t('cli:commands.security.enforce.failedToEnforce'), err);
+            process.exitCode = 1;
+        }
+    });
+    return security;
+}

package/dist/src/presentation/cli/commands/upgrade.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upgrade.command.d.ts","sourceRoot":"","sources":["../../../../../src/presentation/cli/commands/upgrade.command.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,IAAI,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AAS9E,KAAK,OAAO,GAAG,OAAO,YAAY,CAAC;AA8EnC;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,OAAsB,GAAG,OAAO,CAqE7E"}
+{"version":3,"file":"upgrade.command.d.ts","sourceRoot":"","sources":["../../../../../src/presentation/cli/commands/upgrade.command.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,IAAI,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AAY9E,KAAK,OAAO,GAAG,OAAO,YAAY,CAAC;AA8InC;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,OAAsB,GAAG,OAAO,CA6E7E"}

package/dist/src/presentation/cli/commands/upgrade.command.js

@@ -8,12 +8,16 @@
  */
 import { Command } from 'commander';
 import { spawn as defaultSpawn } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { container } from '../../../../packages/core/src/infrastructure/di/container.js';
 import { messages } from '../ui/index.js';
 import { getCliI18n } from '../i18n.js';
 import { stopDaemon } from './daemon/stop-daemon.js';
 import { startDaemon } from './daemon/start-daemon.js';
 const VERSION_CHECK_TIMEOUT_MS = 10_000;
+const NPM_CACHE_ADD_TIMEOUT_MS = 120_000;
 /** On Windows, npm is a .cmd batch file — spawn() needs shell: true to resolve it. */
 const IS_WINDOWS = process.platform === 'win32';
 /**
@@ -61,13 +65,67 @@ function getLatestVersion(spawnFn) {
         });
     });
 }
+/**
+ * Pre-download the package AND all transitive dependencies into npm's cache.
+ * Uses `npm install --prefix <tmpdir>` which resolves the full dependency tree
+ * and populates the cache. The temp directory is cleaned up afterwards.
+ * Returns true if the pre-download succeeded, false otherwise (fail-open).
+ */
+function preDownloadPackage(spawnFn) {
+    let tmpDir;
+    try {
+        tmpDir = mkdtempSync(join(tmpdir(), 'shep-upgrade-'));
+    }
+    catch {
+        return Promise.resolve(false);
+    }
+    const cleanup = () => {
+        try {
+            rmSync(tmpDir, { recursive: true, force: true });
+        }
+        catch {
+            /* best-effort */
+        }
+    };
+    return new Promise((resolve) => {
+        let settled = false;
+        const child = spawnFn('npm', ['install', '--prefix', tmpDir, '--ignore-scripts', '@shepai/cli@latest'], {
+            stdio: ['ignore', 'ignore', 'pipe'],
+            ...(IS_WINDOWS && { shell: true }),
+        });
+        const timeout = setTimeout(() => {
+            if (!settled) {
+                settled = true;
+                child.kill();
+                cleanup();
+                resolve(false);
+            }
+        }, NPM_CACHE_ADD_TIMEOUT_MS);
+        child.on('close', (code) => {
+            if (!settled) {
+                settled = true;
+                clearTimeout(timeout);
+                cleanup();
+                resolve(code === 0);
+            }
+        });
+        child.on('error', () => {
+            if (!settled) {
+                settled = true;
+                clearTimeout(timeout);
+                cleanup();
+                resolve(false);
+            }
+        });
+    });
+}
 /**
  * Run npm i -g @shepai/cli@latest with inherited stdio.
  * Returns the exit code, or rejects on spawn error.
  */
 function runNpmInstall(spawnFn) {
     return new Promise((resolve, reject) => {
-        const child = spawnFn('npm', ['i', '-g', '@shepai/cli@latest'], {
+        const child = spawnFn('npm', ['i', '-g', '@shepai/cli@latest', '--prefer-offline'], {
             stdio: 'inherit',
             ...(IS_WINDOWS && { shell: true }),
         });
@@ -107,7 +165,14 @@ export function createUpgradeCommand(spawnFn = defaultSpawn) {
             else {
                 messages.info(t('cli:commands.upgrade.upgradingToLatest', { current: currentVersion }));
             }
-            // 4. Check daemon state before install (FR-1)
+            // 4. Pre-download the package into npm cache BEFORE stopping the daemon.
+            //    This minimizes downtime — the actual install will read from cache.
+            messages.info(t('cli:commands.upgrade.downloadingPackage'));
+            const cached = await preDownloadPackage(spawnFn);
+            if (!cached) {
+                messages.warning(t('cli:commands.upgrade.downloadFailed'));
+            }
+            // 5. Check daemon state and stop if running
             const daemonService = container.resolve('IDaemonService');
             const daemonState = await daemonService.read();
             const daemonWasRunning = daemonState !== null && daemonService.isAlive(daemonState.pid);
@@ -116,7 +181,7 @@ export function createUpgradeCommand(spawnFn = defaultSpawn) {
                 messages.info(t('cli:commands.upgrade.stoppingDaemon'));
                 await stopDaemon(daemonService);
             }
-            // 5. Run npm i -g @shepai/cli@latest; always restore daemon in finally (FR-2, FR-3)
+            // 6. Run npm i -g @shepai/cli@latest; always restore daemon in finally
             let installExitCode = 1;
             try {
                 installExitCode = await runNpmInstall(spawnFn);

package/dist/src/presentation/cli/index.js

@@ -42,6 +42,7 @@ import { createIdeOpenCommand } from './commands/ide-open.command.js';
 import { createInstallCommand } from './commands/install.command.js';
 import { createUpgradeCommand } from './commands/upgrade.command.js';
 import { createToolsCommand } from './commands/tools.command.js';
+import { createSecurityCommand } from './commands/security.command.js';
 import { messages } from './ui/index.js';
 // Daemon lifecycle commands
 import { createStartCommand } from './commands/start.command.js';
@@ -121,6 +122,7 @@ async function bootstrap() {
         program.addCommand(createIdeOpenCommand());
         program.addCommand(createInstallCommand());
         program.addCommand(createToolsCommand());
+        program.addCommand(createSecurityCommand());
         program.addCommand(createUpgradeCommand());
         // Daemon lifecycle commands (task-9)
         program.addCommand(createStartCommand());

package/dist/src/presentation/web/app/actions/create-feature.d.ts

@@ -1,5 +1,4 @@
 import type { Feature } from '../../../../../packages/core/src/domain/generated/output.js';
-import { type FeatureMode } from '../../../../../packages/core/src/domain/generated/output.js';
 interface Attachment {
     path: string;
     name: string;
@@ -18,8 +17,8 @@ interface CreateFeatureInput {
     push?: boolean;
     openPr?: boolean;
     parentId?: string;
-    /** Execution mode: Regular (full SDLC), Fast (direct implementation), or Exploration (iterative prototyping). */
-    mode?: FeatureMode;
+    /** When true, skip SDLC phases and implement directly from the prompt. */
+    fast?: boolean;
     /** When true, create the feature in pending state (no agent spawned). */
     pending?: boolean;
     /** Fork repo and create PR to upstream at merge time. */

package/dist/src/presentation/web/app/actions/create-feature.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-feature.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/create-feature.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAC;AACpE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAGxE,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAQD,UAAU,kBAAkB;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC;QAClB,SAAS,EAAE,OAAO,CAAC;QACnB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,CAAC;IACF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iHAAiH;IACjH,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yDAAyD;IACzD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,uFAAuF;IACvF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,uDAAuD;IACvD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,6BAA6B;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,uDAAuD;IACvD,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAoGhD"}
+{"version":3,"file":"create-feature.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/create-feature.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAC;AAGpE,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAQD,UAAU,kBAAkB;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC;QAClB,SAAS,EAAE,OAAO,CAAC;QACnB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,CAAC;IACF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yDAAyD;IACzD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,uFAAuF;IACvF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,uDAAuD;IACvD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,6BAA6B;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,uDAAuD;IACvD,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAoGhD"}

package/dist/src/presentation/web/app/actions/create-feature.js

@@ -2,7 +2,7 @@
 import { resolve } from '../../lib/server-container.js';
 import { composeUserInput } from './compose-user-input.js';
 export async function createFeature(input) {
-    const { description, repositoryPath, attachments, sessionId, approvalGates, push, openPr, parentId, mode, pending, forkAndPr, commitSpecs, ciWatchEnabled, enableEvidence, commitEvidence, agentType, model, rebaseBeforeBranch, injectSkills, } = input;
+    const { description, repositoryPath, attachments, sessionId, approvalGates, push, openPr, parentId, fast, pending, forkAndPr, commitSpecs, ciWatchEnabled, enableEvidence, commitEvidence, agentType, model, rebaseBeforeBranch, injectSkills, } = input;
     if (!description?.trim()) {
         return { error: 'description is required' };
     }
@@ -26,7 +26,7 @@ export async function createFeature(input) {
             openPr: openPr ?? false,
             ...(parentId ? { parentId } : {}),
             description,
-            ...(mode ? { mode } : {}),
+            ...(fast ? { fast } : {}),
             ...(pending ? { pending } : {}),
             ...(forkAndPr != null ? { forkAndPr } : {}),
             ...(commitSpecs != null ? { commitSpecs } : {}),
@@ -48,7 +48,7 @@ export async function createFeature(input) {
             push: push ?? false,
             openPr: openPr ?? false,
             ...(parentId ? { parentId } : {}),
-            ...(mode ? { mode } : {}),
+            ...(fast ? { fast } : {}),
             ...(pending ? { pending } : {}),
             ...(forkAndPr != null ? { forkAndPr } : {}),
             ...(commitSpecs != null ? { commitSpecs } : {}),

package/dist/src/presentation/web/app/actions/get-workflow-defaults.d.ts

@@ -1,4 +1,3 @@
-import { FeatureMode } from '../../../../../packages/core/src/domain/generated/output.js';
 export interface WorkflowDefaults {
     approvalGates: {
         allowPrd: boolean;
@@ -10,7 +9,7 @@ export interface WorkflowDefaults {
     ciWatchEnabled: boolean;
     enableEvidence: boolean;
     commitEvidence: boolean;
-    defaultMode: FeatureMode;
+    fast: boolean;
     injectSkills: boolean;
 }
 export declare function getWorkflowDefaults(): Promise<WorkflowDefaults>;

package/dist/src/presentation/web/app/actions/get-workflow-defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-workflow-defaults.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/get-workflow-defaults.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAEnE,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE;QACb,QAAQ,EAAE,OAAO,CAAC;QAClB,SAAS,EAAE,OAAO,CAAC;QACnB,UAAU,EAAE,OAAO,CAAC;KACrB,CAAC;IACF,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAkBrE"}
+{"version":3,"file":"get-workflow-defaults.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/get-workflow-defaults.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE;QACb,QAAQ,EAAE,OAAO,CAAC;QAClB,SAAS,EAAE,OAAO,CAAC;QACnB,UAAU,EAAE,OAAO,CAAC;KACrB,CAAC;IACF,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAkBrE"}

package/dist/src/presentation/web/app/actions/get-workflow-defaults.js

@@ -1,6 +1,5 @@
 'use server';
 import { getSettings } from '../../../../../packages/core/src/infrastructure/services/settings.service.js';
-import { FeatureMode } from '../../../../../packages/core/src/domain/generated/output.js';
 export async function getWorkflowDefaults() {
     const settings = getSettings();
     const { workflow } = settings;
@@ -15,7 +14,7 @@ export async function getWorkflowDefaults() {
         ciWatchEnabled: workflow.ciWatchEnabled,
         enableEvidence: workflow.enableEvidence,
         commitEvidence: workflow.commitEvidence,
-        defaultMode: workflow.defaultMode ?? FeatureMode.Fast,
+        fast: workflow.defaultFastMode,
         injectSkills: workflow.skillInjection?.enabled ?? false,
     };
 }

package/dist/src/presentation/web/app/actions/security.d.ts

@@ -0,0 +1,28 @@
+import type { SecurityState } from '../../../../../packages/core/src/application/use-cases/security/get-security-state.use-case.js';
+import type { EnforceSecurityResult } from '../../../../../packages/core/src/application/use-cases/security/enforce-security.use-case.js';
+import type { SecurityMode } from '../../../../../packages/core/src/domain/generated/output.js';
+export interface GetSecurityStateResult {
+    state?: SecurityState;
+    error?: string;
+}
+export interface EnforceSecurityActionResult {
+    result?: EnforceSecurityResult;
+    error?: string;
+}
+export interface UpdateSecurityModeResult {
+    success: boolean;
+    error?: string;
+}
+/**
+ * Fetches the current security state for a repository.
+ */
+export declare function getSecurityStateAction(repositoryPath: string): Promise<GetSecurityStateResult>;
+/**
+ * Runs the full security enforcement flow for a repository.
+ */
+export declare function enforceSecurityAction(repositoryPath: string): Promise<EnforceSecurityActionResult>;
+/**
+ * Updates the security mode in settings.
+ */
+export declare function updateSecurityModeAction(mode: SecurityMode): Promise<UpdateSecurityModeResult>;
+//# sourceMappingURL=security.d.ts.map

package/dist/src/presentation/web/app/actions/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/security.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAEV,aAAa,EACd,MAAM,yEAAyE,CAAC;AACjF,OAAO,KAAK,EAEV,qBAAqB,EACtB,MAAM,uEAAuE,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAEzE,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,sBAAsB,CAAC,CASjC;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,2BAA2B,CAAC,CAUtC;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,wBAAwB,CAAC,CAyBnC"}