@shepai/cli 1.170.0-pr513.cff27cb → 1.171.0-pr527.e2ee839

package/dist/packages/core/src/application/ports/output/services/github-repository-service.interface.js

@@ -68,3 +68,12 @@ export class GitHubPermissionError extends Error {
             this.cause = cause;
     }
 }
+/**
+ * Category of a governance audit finding.
+ */
+export var GovernanceFindingCategory;
+(function (GovernanceFindingCategory) {
+    GovernanceFindingCategory["BranchProtection"] = "BranchProtection";
+    GovernanceFindingCategory["Codeowners"] = "Codeowners";
+    GovernanceFindingCategory["WorkflowPermissions"] = "WorkflowPermissions";
+})(GovernanceFindingCategory || (GovernanceFindingCategory = {}));

package/dist/packages/core/src/application/ports/output/services/security-policy-service.interface.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Security Policy Service Interface
+ *
+ * Output port for the central security policy engine.
+ * Implementations handle policy file reading, validation, merging
+ * with persisted settings, and deterministic policy evaluation.
+ *
+ * Following Clean Architecture:
+ * - Application and use-case layers depend on this interface
+ * - Infrastructure layer provides the concrete implementation
+ * - All consumers (CLI, runtime, CI, UI) resolve the same instance via DI
+ */
+import type { EffectivePolicySnapshot, SecurityActionCategory, SecurityActionDisposition } from '../../../../domain/generated/output.js';
+/**
+ * Result of validating a security policy file.
+ */
+export interface PolicyValidationResult {
+    /** Whether the policy file is valid */
+    valid: boolean;
+    /** Per-field validation error messages (empty when valid) */
+    errors: string[];
+}
+/**
+ * Service interface for security policy evaluation.
+ *
+ * Implementations must:
+ * - Read shep.security.yaml from the repository root
+ * - Merge repository policy with persisted settings defaults
+ * - Apply deterministic precedence (global defaults < repo policy)
+ * - Cache effective policy per repository path
+ * - Fail fast on invalid policy files with actionable errors
+ */
+export interface ISecurityPolicyService {
+    /**
+     * Evaluate and compute the effective security policy for a repository.
+     *
+     * Reads the policy file, merges with persisted settings defaults,
+     * validates, and returns a deterministic snapshot. Re-evaluates
+     * on every call (no cache).
+     *
+     * @param repositoryPath - Absolute path to the repository root
+     * @returns Computed effective policy snapshot
+     * @throws Error if the policy file exists but is invalid
+     */
+    evaluatePolicy(repositoryPath: string): Promise<EffectivePolicySnapshot>;
+    /**
+     * Get the effective security policy for a repository.
+     *
+     * Returns a cached snapshot if available, otherwise computes
+     * and caches the result. Use evaluatePolicy() to force re-evaluation.
+     *
+     * @param repositoryPath - Absolute path to the repository root
+     * @returns Cached or freshly computed effective policy snapshot
+     * @throws Error if the policy file exists but is invalid
+     */
+    getEffectivePolicy(repositoryPath: string): Promise<EffectivePolicySnapshot>;
+    /**
+     * Validate a security policy file without computing effective policy.
+     *
+     * Parses and validates the file against the expected schema.
+     * Returns a structured result with per-field error messages.
+     *
+     * @param filePath - Absolute path to the policy file
+     * @returns Validation result with errors array
+     */
+    validatePolicyFile(filePath: string): Promise<PolicyValidationResult>;
+    /**
+     * Look up the enforcement disposition for a specific action category
+     * within a given effective policy snapshot.
+     *
+     * @param policy - The effective policy snapshot to query
+     * @param actionCategory - The action category to look up
+     * @returns The disposition (Allowed, Denied, or ApprovalRequired)
+     */
+    getActionDisposition(policy: EffectivePolicySnapshot, actionCategory: SecurityActionCategory): SecurityActionDisposition;
+}
+//# sourceMappingURL=security-policy-service.interface.d.ts.map

package/dist/packages/core/src/application/ports/output/services/security-policy-service.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy-service.interface.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/ports/output/services/security-policy-service.interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EAC1B,MAAM,wCAAwC,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,uCAAuC;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,6DAA6D;IAC7D,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;OAUG;IACH,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEzE;;;;;;;;;OASG;IACH,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE7E;;;;;;;;OAQG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEtE;;;;;;;OAOG;IACH,oBAAoB,CAClB,MAAM,EAAE,uBAAuB,EAC/B,cAAc,EAAE,sBAAsB,GACrC,yBAAyB,CAAC;CAC9B"}

package/dist/packages/core/src/application/ports/output/services/security-policy-service.interface.js

@@ -0,0 +1,13 @@
+/**
+ * Security Policy Service Interface
+ *
+ * Output port for the central security policy engine.
+ * Implementations handle policy file reading, validation, merging
+ * with persisted settings, and deterministic policy evaluation.
+ *
+ * Following Clean Architecture:
+ * - Application and use-case layers depend on this interface
+ * - Infrastructure layer provides the concrete implementation
+ * - All consumers (CLI, runtime, CI, UI) resolve the same instance via DI
+ */
+export {};

package/dist/packages/core/src/application/ports/output/services/spec-initializer.interface.d.ts

@@ -22,16 +22,26 @@ export interface ISpecInitializerService {
      * - tasks.yaml
      * - feature.yaml
      *
-     * When mode is 'fast', only feature.yaml and spec.yaml are created.
-     * When mode is 'exploration', only feature.yaml is created.
+     * When mode is 'fast', only feature.yaml is created (no spec/research/plan/tasks).
      *
      * @param basePath - Directory to create specs/ in (typically the worktree path)
      * @param slug - Feature slug (kebab-case, e.g., "user-authentication")
      * @param featureNumber - Sequential feature number (will be zero-padded to 3 digits)
      * @param description - Feature description for template substitution
-     * @param mode - Optional mode; controls which template files are created
+     * @param mode - Optional mode; when 'fast', only feature.yaml is created
      * @returns The spec directory path and feature number used
      */
-    initialize(basePath: string, slug: string, featureNumber: number, description: string, mode?: 'fast' | 'exploration'): Promise<SpecInitializerResult>;
+    initialize(basePath: string, slug: string, featureNumber: number, description: string, mode?: 'fast'): Promise<SpecInitializerResult>;
+    /**
+     * Scaffold a baseline shep.security.yaml file at the repository root.
+     *
+     * Creates the security policy file with Advisory mode, default action
+     * dispositions, and dependency/release rules. Includes YAML comments
+     * explaining each section.
+     *
+     * @param repositoryPath - Absolute path to the repository root
+     * @returns The absolute path to the created security policy file
+     */
+    scaffoldSecurityPolicy(repositoryPath: string): Promise<string>;
 }
 //# sourceMappingURL=spec-initializer.interface.d.ts.map

package/dist/packages/core/src/application/ports/output/services/spec-initializer.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spec-initializer.interface.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/ports/output/services/spec-initializer.interface.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,UAAU,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACnC"}
+{"version":3,"file":"spec-initializer.interface.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/ports/output/services/spec-initializer.interface.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;;;;;;;OAkBG;IACH,UAAU,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAElC;;;;;;;;;OASG;IACH,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACjE"}

package/dist/packages/core/src/application/use-cases/agents/approve-agent-run.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approve-agent-run.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/agents/approve-agent-run.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gEAAgE,CAAC;AAC7G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAE1G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAO9E,qBACa,sBAAsB;IAG/B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBANrB,kBAAkB,EAAE,mBAAmB,EAEvC,cAAc,EAAE,2BAA2B,EAE3C,iBAAiB,EAAE,kBAAkB,EAErC,qBAAqB,EAAE,sBAAsB;IAG1D,OAAO,CACX,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CA0GlD"}
+{"version":3,"file":"approve-agent-run.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/agents/approve-agent-run.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gEAAgE,CAAC;AAC7G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAE1G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAQ9E,qBACa,sBAAsB;IAG/B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBANrB,kBAAkB,EAAE,mBAAmB,EAEvC,cAAc,EAAE,2BAA2B,EAE3C,iBAAiB,EAAE,kBAAkB,EAErC,qBAAqB,EAAE,sBAAsB;IAG1D,OAAO,CACX,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CA2GlD"}

package/dist/packages/core/src/application/use-cases/agents/approve-agent-run.use-case.js

@@ -22,9 +22,10 @@ import { injectable, inject } from 'tsyringe';
 import yaml from 'js-yaml';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { AgentRunStatus, FeatureMode } from '../../../domain/generated/output.js';
+import { AgentRunStatus } from '../../../domain/generated/output.js';
 import { writeSpecFileAtomic, safeYamlDump, } from '../../../infrastructure/services/agents/feature-agent/nodes/node-helpers.js';
 import { computeWorktreePath } from '../../../infrastructure/services/ide-launchers/compute-worktree-path.js';
+import { getSettings } from '../../../infrastructure/services/settings.service.js';
 let ApproveAgentRunUseCase = class ApproveAgentRunUseCase {
     agentRunRepository;
     processService;
@@ -119,7 +120,8 @@ let ApproveAgentRunUseCase = class ApproveAgentRunUseCase {
             ...(payload ? { resumePayload: JSON.stringify(payload) } : {}),
             agentType: run.agentType,
             ...(run.modelId ? { model: run.modelId } : {}),
-            ...(feature?.mode && feature.mode !== FeatureMode.Regular ? { mode: feature.mode } : {}),
+            ...(feature?.fast ? { fast: true } : {}),
+            securityMode: getSettings().security?.mode,
         });
         return { approved: true, reason: 'Approved and resumed' };
     }

package/dist/packages/core/src/application/use-cases/agents/reject-agent-run.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reject-agent-run.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/agents/reject-agent-run.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gEAAgE,CAAC;AAC7G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAa1G,qBACa,qBAAqB;IAG9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBANrB,kBAAkB,EAAE,mBAAmB,EAEvC,cAAc,EAAE,2BAA2B,EAE3C,iBAAiB,EAAE,kBAAkB,EAErC,qBAAqB,EAAE,sBAAsB;IAG1D,OAAO,CACX,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC;QACT,QAAQ,EAAE,OAAO,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;CAkIH"}
+{"version":3,"file":"reject-agent-run.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/agents/reject-agent-run.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gEAAgE,CAAC;AAC7G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAc1G,qBACa,qBAAqB;IAG9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBANrB,kBAAkB,EAAE,mBAAmB,EAEvC,cAAc,EAAE,2BAA2B,EAE3C,iBAAiB,EAAE,kBAAkB,EAErC,qBAAqB,EAAE,sBAAsB;IAG1D,OAAO,CACX,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC;QACT,QAAQ,EAAE,OAAO,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;CAmIH"}

package/dist/packages/core/src/application/use-cases/agents/reject-agent-run.use-case.js

@@ -21,10 +21,11 @@ import { injectable, inject } from 'tsyringe';
 import yaml from 'js-yaml';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { AgentRunStatus, FeatureMode } from '../../../domain/generated/output.js';
+import { AgentRunStatus } from '../../../domain/generated/output.js';
 import { writeSpecFileAtomic, safeYamlDump, } from '../../../infrastructure/services/agents/feature-agent/nodes/node-helpers.js';
 import { recordLifecycleEvent } from '../../../infrastructure/services/agents/feature-agent/phase-timing-context.js';
 import { computeWorktreePath } from '../../../infrastructure/services/ide-launchers/compute-worktree-path.js';
+import { getSettings } from '../../../infrastructure/services/settings.service.js';
 let RejectAgentRunUseCase = class RejectAgentRunUseCase {
     agentRunRepository;
     processService;
@@ -135,7 +136,8 @@ let RejectAgentRunUseCase = class RejectAgentRunUseCase {
             resumePayload: JSON.stringify(rejectionPayload),
             agentType: run.agentType,
             ...(run.modelId ? { model: run.modelId } : {}),
-            ...(feature.mode !== FeatureMode.Regular ? { mode: feature.mode } : {}),
+            ...(feature.fast ? { fast: true } : {}),
+            securityMode: getSettings().security?.mode,
         });
         return {
             rejected: true,

package/dist/packages/core/src/application/use-cases/features/adopt-branch.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adopt-branch.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/features/adopt-branch.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAe,MAAM,qCAAqC,CAAC;AAEhF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oEAAoE,CAAC;AAChH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAClG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yDAAyD,CAAC;AAG7F,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;CAClB;AAKD,qBACa,kBAAkB;IAG3B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhC,OAAO,CAAC,QAAQ,CAAC,YAAY;gBANZ,WAAW,EAAE,kBAAkB,EAE/B,cAAc,EAAE,qBAAqB,EAErC,eAAe,EAAE,gBAAgB,EAEjC,YAAY,EAAE,aAAa;IAGxC,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAgGlE;;;;OAIG;YACW,gBAAgB;IAiB9B;;;;OAIG;YACW,iBAAiB;IA4B/B;;;OAGG;YACW,iBAAiB;CAuBhC"}
+{"version":3,"file":"adopt-branch.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/features/adopt-branch.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAe,MAAM,qCAAqC,CAAC;AAEhF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oEAAoE,CAAC;AAChH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAClG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yDAAyD,CAAC;AAG7F,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;CAClB;AAKD,qBACa,kBAAkB;IAG3B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhC,OAAO,CAAC,QAAQ,CAAC,YAAY;gBANZ,WAAW,EAAE,kBAAkB,EAE/B,cAAc,EAAE,qBAAqB,EAErC,eAAe,EAAE,gBAAgB,EAEjC,YAAY,EAAE,aAAa;IAGxC,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA+FlE;;;;OAIG;YACW,gBAAgB;IAiB9B;;;;OAIG;YACW,iBAAiB;IA4B/B;;;OAGG;YACW,iBAAiB;CAuBhC"}

package/dist/packages/core/src/application/use-cases/features/adopt-branch.use-case.js

@@ -23,7 +23,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { injectable, inject } from 'tsyringe';
 import { randomUUID } from 'node:crypto';
-import { SdlcLifecycle, PrStatus, FeatureMode } from '../../../domain/generated/output.js';
+import { SdlcLifecycle, PrStatus } from '../../../domain/generated/output.js';
 import { deriveName, deriveSlug } from './branch-name-utils.js';
 /** Branches that must not be adopted as features. */
 const PROTECTED_BRANCHES = new Set(['main', 'master']);
@@ -89,8 +89,7 @@ let AdoptBranchUseCase = class AdoptBranchUseCase {
             lifecycle,
             messages: [],
             relatedArtifacts: [],
-            mode: FeatureMode.Regular,
-            iterationCount: 0,
+            fast: false,
             push: false,
             openPr: hasOpenPr,
             forkAndPr: false,

package/dist/packages/core/src/application/use-cases/features/check-and-unblock-features.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-and-unblock-features.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/features/check-and-unblock-features.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAGhH,qBACa,8BAA8B;IAET,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE1D,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAFkB,WAAW,EAAE,kBAAkB,EAE7D,YAAY,EAAE,2BAA2B;IAG5D;;;;OAIG;IACG,OAAO,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA4CtD"}
+{"version":3,"file":"check-and-unblock-features.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/features/check-and-unblock-features.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAIhH,qBACa,8BAA8B;IAET,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE1D,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAFkB,WAAW,EAAE,kBAAkB,EAE7D,YAAY,EAAE,2BAA2B;IAG5D;;;;OAIG;IACG,OAAO,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA6CtD"}

package/dist/packages/core/src/application/use-cases/features/check-and-unblock-features.use-case.js

@@ -27,8 +27,9 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { injectable, inject } from 'tsyringe';
-import { SdlcLifecycle, FeatureMode } from '../../../domain/generated/output.js';
+import { SdlcLifecycle } from '../../../domain/generated/output.js';
 import { POST_IMPLEMENTATION } from '../../../domain/lifecycle-gates.js';
+import { getSettings } from '../../../infrastructure/services/settings.service.js';
 let CheckAndUnblockFeaturesUseCase = class CheckAndUnblockFeaturesUseCase {
     featureRepo;
     agentProcess;
@@ -69,7 +70,8 @@ let CheckAndUnblockFeaturesUseCase = class CheckAndUnblockFeaturesUseCase {
                     ciWatchEnabled: child.ciWatchEnabled,
                     enableEvidence: child.enableEvidence,
                     commitEvidence: child.commitEvidence,
-                    ...(child.mode !== FeatureMode.Regular ? { mode: child.mode } : {}),
+                    ...(child.fast ? { fast: true } : {}),
+                    securityMode: getSettings().security?.mode,
                 });
             }
         }

package/dist/packages/core/src/application/use-cases/features/create/create-feature.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-feature.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/use-cases/features/create/create-feature.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wCAAwC,CAAC;AAOtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oEAAoE,CAAC;AAC7G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AACrG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iEAAiE,CAAC;AACnH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gEAAgE,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8DAA8D,CAAC;AAC5G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uEAAuE,CAAC;AACnH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4DAA4D,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2DAA2D,CAAC;AACjG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4DAA4D,CAAC;AAIxG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mEAAmE,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE9F,qBACa,oBAAoB;IAG7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAtBb,WAAW,EAAE,kBAAkB,EAE/B,eAAe,EAAE,gBAAgB,EAEjC,YAAY,EAAE,2BAA2B,EAEzC,aAAa,EAAE,mBAAmB,EAElC,eAAe,EAAE,uBAAuB,EAExC,iBAAiB,EAAE,iBAAiB,EAEpC,YAAY,EAAE,YAAY,EAE1B,cAAc,EAAE,qBAAqB,EAErC,YAAY,EAAE,aAAa,EAE3B,iBAAiB,EAAE,wBAAwB,EAE3C,cAAc,EAAE,eAAe,EAE/B,aAAa,EAAE,qBAAqB;IAGvD;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMtE;;;;OAIG;IACG,YAAY,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiJ1E;;;OAGG;IACG,kBAAkB,CACtB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,kBAAkB,EACzB,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC;CA0K1D"}
+{"version":3,"file":"create-feature.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/use-cases/features/create/create-feature.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wCAAwC,CAAC;AAMtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oEAAoE,CAAC;AAC7G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AACrG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iEAAiE,CAAC;AACnH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gEAAgE,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8DAA8D,CAAC;AAC5G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uEAAuE,CAAC;AACnH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4DAA4D,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2DAA2D,CAAC;AACjG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4DAA4D,CAAC;AAIxG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mEAAmE,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE9F,qBACa,oBAAoB;IAG7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAtBb,WAAW,EAAE,kBAAkB,EAE/B,eAAe,EAAE,gBAAgB,EAEjC,YAAY,EAAE,2BAA2B,EAEzC,aAAa,EAAE,mBAAmB,EAElC,eAAe,EAAE,uBAAuB,EAExC,iBAAiB,EAAE,iBAAiB,EAEpC,YAAY,EAAE,YAAY,EAE1B,cAAc,EAAE,qBAAqB,EAErC,YAAY,EAAE,aAAa,EAE3B,iBAAiB,EAAE,wBAAwB,EAE3C,cAAc,EAAE,eAAe,EAE/B,aAAa,EAAE,qBAAqB;IAGvD;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMtE;;;;OAIG;IACG,YAAY,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAyI1E;;;OAGG;IACG,kBAAkB,CACtB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,kBAAkB,EACzB,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC;CAuK1D"}

package/dist/packages/core/src/application/use-cases/features/create/create-feature.use-case.js

@@ -29,7 +29,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { injectable, inject } from 'tsyringe';
 import { randomUUID } from 'node:crypto';
-import { SdlcLifecycle, AgentRunStatus, FeatureMode, } from '../../../../domain/generated/output.js';
+import { SdlcLifecycle, AgentRunStatus, } from '../../../../domain/generated/output.js';
 import { getSettings } from '../../../../infrastructure/services/settings.service.js';
 import { createDefaultSettings } from '../../../../domain/factories/settings-defaults.factory.js';
 import { POST_IMPLEMENTATION } from '../../../../domain/lifecycle-gates.js';
@@ -78,12 +78,9 @@ let CreateFeatureUseCase = class CreateFeatureUseCase {
      * No AI calls, no git operations — just DB writes.
      */
     async createRecord(input) {
-        const effectiveMode = input.mode ?? FeatureMode.Regular;
-        let initialLifecycle = effectiveMode === FeatureMode.Exploration
-            ? SdlcLifecycle.Exploring
-            : effectiveMode === FeatureMode.Fast
-                ? SdlcLifecycle.Implementation
-                : SdlcLifecycle.Requirements;
+        let initialLifecycle = input.fast
+            ? SdlcLifecycle.Implementation
+            : SdlcLifecycle.Requirements;
         let shouldSpawn = true;
         let effectiveRepoPath = input.repositoryPath.replace(/\\/g, '/');
         // Pending flag takes precedence — user explicitly defers agent execution.
@@ -156,7 +153,7 @@ let CreateFeatureUseCase = class CreateFeatureUseCase {
             lifecycle: initialLifecycle,
             messages: [],
             relatedArtifacts: [],
-            mode: effectiveMode,
+            fast: input.fast ?? false,
             push: input.push ?? false,
             openPr: input.openPr ?? false,
             forkAndPr: input.forkAndPr ?? false,
@@ -170,10 +167,6 @@ let CreateFeatureUseCase = class CreateFeatureUseCase {
                 allowPlan: false,
                 allowMerge: false,
             },
-            iterationCount: 0,
-            ...(effectiveMode === FeatureMode.Exploration && {
-                maxIterations: getSettings().workflow.explorationMaxIterations ?? 10,
-            }),
             agentRunId: runId,
             specPath: '',
             repositoryId: repository.id,
@@ -238,11 +231,7 @@ let CreateFeatureUseCase = class CreateFeatureUseCase {
         const worktreePath = this.worktreeService.getWorktreePath(effectiveRepoPath, branch);
         await this.worktreeService.create(effectiveRepoPath, branch, worktreePath, defaultBranch);
         // Initialize spec directory — full user input goes into spec.yaml as-is
-        const { specDir } = await this.specInitializer.initialize(worktreePath, slug, featureNumber, input.userInput, feature.mode === FeatureMode.Fast
-            ? 'fast'
-            : feature.mode === FeatureMode.Exploration
-                ? 'exploration'
-                : undefined);
+        const { specDir } = await this.specInitializer.initialize(worktreePath, slug, featureNumber, input.userInput, input.fast ? 'fast' : undefined);
         // Commit pending attachments if sessionId was provided (web UI flow)
         let committedAttachments = input.attachments;
         if (input.sessionId) {
@@ -334,9 +323,10 @@ let CreateFeatureUseCase = class CreateFeatureUseCase {
                 ciWatchEnabled: input.ciWatchEnabled ?? true,
                 enableEvidence: input.enableEvidence ?? false,
                 commitEvidence: input.commitEvidence ?? false,
-                ...(feature.mode !== FeatureMode.Regular ? { mode: feature.mode } : {}),
+                ...(input.fast ? { fast: true } : {}),
                 ...(input.agentType ? { agentType: input.agentType } : {}),
                 ...(input.model ? { model: input.model } : {}),
+                securityMode: settings.security?.mode,
             });
         }
         return { warning, updatedFeature };

package/dist/packages/core/src/application/use-cases/features/create/types.d.ts

@@ -1,5 +1,4 @@
 import type { ApprovalGates, Attachment, Feature } from '../../../../domain/generated/output.js';
-import { type FeatureMode } from '../../../../domain/generated/output.js';
 export interface CreateFeatureInput {
     userInput: string;
     repositoryPath: string;
@@ -12,8 +11,8 @@ export interface CreateFeatureInput {
     name?: string;
     /** Pre-supplied description (skips AI metadata extraction for description). */
     description?: string;
-    /** Execution mode: Regular (full SDLC), Fast (direct implementation), or Exploration (iterative prototyping). */
-    mode?: FeatureMode;
+    /** When true, skip SDLC phases and implement directly from the user prompt. */
+    fast?: boolean;
     /** Fork repo and create PR to upstream at merge time (default: false). */
     forkAndPr?: boolean;
     /** Commit specs/evidences into the repo (default: true, auto-false when forkAndPr). */

package/dist/packages/core/src/application/use-cases/features/create/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/use-cases/features/create/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAE1E,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iHAAiH;IACjH,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,uFAAuF;IACvF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wEAAwE;IACxE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,uEAAuE;IACvE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,4FAA4F;IAC5F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,8FAA8F;IAC9F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,oGAAoG;IACpG,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,WAAW,EAAE,OAAO,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/use-cases/features/create/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,wCAAwC,CAAC;AAEjG,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,uFAAuF;IACvF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wEAAwE;IACxE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,uEAAuE;IACvE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,4FAA4F;IAC5F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,8FAA8F;IAC9F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,oGAAoG;IACpG,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,WAAW,EAAE,OAAO,CAAC;CACtB"}

package/dist/packages/core/src/application/use-cases/features/delete-feature.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete-feature.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/features/delete-feature.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAEnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAClG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yDAAyD,CAAC;AAE7F,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,qBACa,oBAAoB;IAEC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAE5D,OAAO,CAAC,QAAQ,CAAC,cAAc;IACA,OAAO,CAAC,QAAQ,CAAC,OAAO;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;gBALP,WAAW,EAAE,kBAAkB,EACjC,eAAe,EAAE,gBAAgB,EAE7D,cAAc,EAAE,2BAA2B,EACZ,OAAO,EAAE,mBAAmB,EAClC,YAAY,EAAE,aAAa;IAGjE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IA8BlF,oGAAoG;YACtF,gBAAgB;IAW9B,0DAA0D;YAC5C,iBAAiB;IAQ/B,6DAA6D;YAC/C,yBAAyB;IAevC,sDAAsD;YACxC,sBAAsB;IAYpC,6EAA6E;YAC/D,oBAAoB;CAyFnC"}
+{"version":3,"file":"delete-feature.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/features/delete-feature.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAEnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAClG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yDAAyD,CAAC;AAE7F,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,qBACa,oBAAoB;IAEC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAE5D,OAAO,CAAC,QAAQ,CAAC,cAAc;IACA,OAAO,CAAC,QAAQ,CAAC,OAAO;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;gBALP,WAAW,EAAE,kBAAkB,EACjC,eAAe,EAAE,gBAAgB,EAE7D,cAAc,EAAE,2BAA2B,EACZ,OAAO,EAAE,mBAAmB,EAClC,YAAY,EAAE,aAAa;IAGjE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IA8BlF,oGAAoG;YACtF,gBAAgB;IAW9B,0DAA0D;YAC5C,iBAAiB;IAQ/B,6DAA6D;YAC/C,yBAAyB;IAevC,sDAAsD;YACxC,sBAAsB;IAYpC,6EAA6E;YAC/D,oBAAoB;CA+EnC"}

package/dist/packages/core/src/application/use-cases/features/delete-feature.use-case.js

@@ -25,9 +25,6 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { injectable, inject } from 'tsyringe';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-import { unlink } from 'node:fs/promises';
 import { AgentRunStatus, PrStatus, SdlcLifecycle } from '../../../domain/generated/output.js';
 let DeleteFeatureUseCase = class DeleteFeatureUseCase {
     featureRepo;
@@ -126,16 +123,6 @@ let DeleteFeatureUseCase = class DeleteFeatureUseCase {
                 }
                 await this.runRepo.updateStatus(run.id, AgentRunStatus.cancelled);
             }
-            // Clean up checkpoint database file (used by LangGraph for state persistence)
-            if (run?.threadId) {
-                const checkpointPath = join(homedir(), '.shep', 'checkpoints', `${run.threadId}.db`);
-                try {
-                    await unlink(checkpointPath);
-                }
-                catch {
-                    // Checkpoint file may not exist or already be removed
-                }
-            }
         }
         // Cleanup worktree and branches directly using the feature data we already
         // have (CleanupFeatureWorktreeUseCase.execute() would fail because

package/dist/packages/core/src/application/use-cases/features/resume-feature.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resume-feature.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/features/resume-feature.use-case.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAQlG,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED,qBACa,oBAAoB;IAG7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,eAAe;gBANf,WAAW,EAAE,kBAAkB,EAE/B,OAAO,EAAE,mBAAmB,EAE5B,cAAc,EAAE,2BAA2B,EAE3C,eAAe,EAAE,gBAAgB;IAG9C,OAAO,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC,mBAAmB,CAAC;CA4GhC"}
+{"version":3,"file":"resume-feature.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/features/resume-feature.use-case.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AASlG,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED,qBACa,oBAAoB;IAG7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,eAAe;gBANf,WAAW,EAAE,kBAAkB,EAE/B,OAAO,EAAE,mBAAmB,EAE5B,cAAc,EAAE,2BAA2B,EAE3C,eAAe,EAAE,gBAAgB;IAG9C,OAAO,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC,mBAAmB,CAAC;CA6GhC"}

package/dist/packages/core/src/application/use-cases/features/resume-feature.use-case.js

@@ -18,7 +18,8 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { injectable, inject } from 'tsyringe';
 import { randomUUID } from 'node:crypto';
-import { AgentRunStatus, FeatureMode } from '../../../domain/generated/output.js';
+import { AgentRunStatus } from '../../../domain/generated/output.js';
+import { getSettings } from '../../../infrastructure/services/settings.service.js';
 const RESUMABLE_STATUSES = new Set([
     AgentRunStatus.interrupted,
     AgentRunStatus.failed,
@@ -115,9 +116,10 @@ let ResumeFeatureUseCase = class ResumeFeatureUseCase {
             enableEvidence: feature.enableEvidence,
             commitEvidence: feature.commitEvidence,
             agentType: lastRun.agentType,
-            ...(feature.mode !== FeatureMode.Regular ? { mode: feature.mode } : {}),
+            ...(feature.fast ? { fast: true } : {}),
             ...(lastRun.modelId ? { model: lastRun.modelId } : {}),
             resumeReason: lastRun.status,
+            securityMode: getSettings().security?.mode,
         });
         return { feature, newRun };
     }

package/dist/packages/core/src/application/use-cases/features/start-feature.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"start-feature.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/features/start-feature.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAGlG,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,qBACa,mBAAmB;IAG5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,eAAe;gBANf,WAAW,EAAE,kBAAkB,EAE/B,OAAO,EAAE,mBAAmB,EAE5B,cAAc,EAAE,2BAA2B,EAE3C,eAAe,EAAE,gBAAgB;IAG9C,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;CA4G9D"}
+{"version":3,"file":"start-feature.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/features/start-feature.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAIlG,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,qBACa,mBAAmB;IAG5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,eAAe;gBANf,WAAW,EAAE,kBAAkB,EAE/B,OAAO,EAAE,mBAAmB,EAE5B,cAAc,EAAE,2BAA2B,EAE3C,eAAe,EAAE,gBAAgB;IAG9C,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;CA0G9D"}

package/dist/packages/core/src/application/use-cases/features/start-feature.use-case.js

@@ -18,8 +18,9 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { injectable, inject } from 'tsyringe';
-import { SdlcLifecycle, FeatureMode } from '../../../domain/generated/output.js';
+import { SdlcLifecycle } from '../../../domain/generated/output.js';
 import { POST_IMPLEMENTATION } from '../../../domain/lifecycle-gates.js';
+import { getSettings } from '../../../infrastructure/services/settings.service.js';
 let StartFeatureUseCase = class StartFeatureUseCase {
     featureRepo;
     runRepo;
@@ -71,9 +72,7 @@ let StartFeatureUseCase = class StartFeatureUseCase {
             }
         }
         // Check parent gate if feature has a parent
-        let targetLifecycle = resolved.mode === FeatureMode.Fast
-            ? SdlcLifecycle.Implementation
-            : SdlcLifecycle.Requirements;
+        let targetLifecycle = resolved.fast ? SdlcLifecycle.Implementation : SdlcLifecycle.Requirements;
         let shouldSpawn = true;
         if (resolved.parentId) {
             const parent = await this.featureRepo.findById(resolved.parentId);
@@ -105,8 +104,9 @@ let StartFeatureUseCase = class StartFeatureUseCase {
                 enableEvidence: resolved.enableEvidence,
                 commitEvidence: resolved.commitEvidence,
                 agentType: agentRun.agentType,
-                ...(resolved.mode !== FeatureMode.Regular ? { mode: resolved.mode } : {}),
+                ...(resolved.fast ? { fast: true } : {}),
                 ...(agentRun.modelId ? { model: agentRun.modelId } : {}),
+                securityMode: getSettings().security?.mode,
             });
         }
         return { feature: updatedFeature, agentRun };

package/dist/packages/core/src/application/use-cases/security/enforce-security.use-case.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Enforce Security Use Case
+ *
+ * Orchestrates the full security enforcement flow:
+ * 1. Evaluate effective policy
+ * 2. Run dependency-risk checks
+ * 3. Run release-integrity checks
+ * 4. Persist findings as security events
+ * 5. Return structured enforcement result
+ *
+ * Supports Advisory (always pass) and Enforce (fail on violations) modes.
+ * Disabled mode returns empty pass result.
+ */
+import { SecurityMode } from '../../../domain/generated/output.js';
+import type { EffectivePolicySnapshot, DependencyFinding, ReleaseIntegrityResult } from '../../../domain/generated/output.js';
+import type { ISecurityPolicyService } from '../../ports/output/services/security-policy-service.interface.js';
+import type { ISecurityEventRepository } from '../../ports/output/repositories/security-event.repository.interface.js';
+import type { ISettingsRepository } from '../../ports/output/repositories/settings.repository.interface.js';
+import type { IGitHubRepositoryService, GovernanceFinding } from '../../ports/output/services/github-repository-service.interface.js';
+import { DependencyRiskEvaluator } from '../../../infrastructure/services/security/dependency-risk-evaluator.js';
+import { ReleaseIntegrityEvaluator } from '../../../infrastructure/services/security/release-integrity-evaluator.js';
+/**
+ * Input for the enforce security use case.
+ */
+export interface EnforceSecurityInput {
+    /** Absolute path to the repository to evaluate */
+    repositoryPath: string;
+}
+/**
+ * Result of the enforcement flow.
+ */
+export interface EnforceSecurityResult {
+    /** Whether all checks passed (Advisory always passes, Enforce fails on violations) */
+    passed: boolean;
+    /** Effective security mode used for evaluation */
+    mode: SecurityMode;
+    /** Effective policy snapshot */
+    policy: EffectivePolicySnapshot;
+    /** Dependency risk findings */
+    dependencyFindings: DependencyFinding[];
+    /** Release integrity result */
+    releaseIntegrity: ReleaseIntegrityResult;
+    /** GitHub governance audit findings (audit-only, do not affect pass/fail) */
+    governanceFindings: GovernanceFinding[];
+    /** Total number of findings (excludes governance — governance is audit-only) */
+    totalFindings: number;
+}
+export declare class EnforceSecurityUseCase {
+    private readonly policyService;
+    private readonly eventRepository;
+    private readonly settingsRepository;
+    private readonly dependencyEvaluator;
+    private readonly releaseEvaluator;
+    private readonly githubService;
+    constructor(policyService: ISecurityPolicyService, eventRepository: ISecurityEventRepository, settingsRepository: ISettingsRepository, dependencyEvaluator: DependencyRiskEvaluator, releaseEvaluator: ReleaseIntegrityEvaluator, githubService: IGitHubRepositoryService);
+    execute(input: EnforceSecurityInput): Promise<EnforceSecurityResult>;
+    /**
+     * Resolve GitHub owner/repo from the repository's git remote and run governance audit.
+     * Returns empty array if the remote cannot be resolved (not a GitHub repo, no remote, etc.).
+     */
+    private runGovernanceAudit;
+    /**
+     * Persist dependency findings, failed release checks, and governance findings as security events.
+     */
+    private persistFindings;
+    /**
+     * Update settings with the latest evaluation timestamp and policy source.
+     */
+    private updateEvaluationTimestamp;
+}
+//# sourceMappingURL=enforce-security.use-case.d.ts.map

package/dist/packages/core/src/application/use-cases/security/enforce-security.use-case.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforce-security.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/security/enforce-security.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,YAAY,EAA0B,MAAM,qCAAqC,CAAC;AAC3F,OAAO,KAAK,EACV,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EAIvB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kEAAkE,CAAC;AAC/G,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wEAAwE,CAAC;AACvH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,KAAK,EACV,wBAAwB,EACxB,iBAAiB,EAClB,MAAM,oEAAoE,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wEAAwE,CAAC;AACjH,OAAO,EAAE,yBAAyB,EAAE,MAAM,0EAA0E,CAAC;AAOrH;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,kDAAkD;IAClD,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,sFAAsF;IACtF,MAAM,EAAE,OAAO,CAAC;IAChB,kDAAkD;IAClD,IAAI,EAAE,YAAY,CAAC;IACnB,gCAAgC;IAChC,MAAM,EAAE,uBAAuB,CAAC;IAChC,+BAA+B;IAC/B,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;IACxC,+BAA+B;IAC/B,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,6EAA6E;IAC7E,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;IACxC,gFAAgF;IAChF,aAAa,EAAE,MAAM,CAAC;CACvB;AAuBD,qBACa,sBAAsB;IAG/B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEjC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAVb,aAAa,EAAE,sBAAsB,EAErC,eAAe,EAAE,wBAAwB,EAEzC,kBAAkB,EAAE,mBAAmB,EAEvC,mBAAmB,EAAE,uBAAuB,EAE5C,gBAAgB,EAAE,yBAAyB,EAE3C,aAAa,EAAE,wBAAwB;IAGpD,OAAO,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA8D1E;;;OAGG;YACW,kBAAkB;IAgBhC;;OAEG;YACW,eAAe;IA6D7B;;OAEG;YACW,yBAAyB;CAgBxC"}