@shepai/cli 1.174.0 → 1.175.0-pr527.9ada632

package/dist/packages/core/src/application/ports/output/services/github-repository-service.interface.d.ts

@@ -35,6 +35,12 @@ export declare class GitHubRepoListError extends Error {
 export declare class GitHubPermissionError extends Error {
     constructor(message: string, cause?: Error);
 }
+/**
+ * Thrown when a fork operation fails.
+ */
+export declare class GitHubForkError extends Error {
+    constructor(message: string, cause?: Error);
+}
 /**
  * A GitHub repository as returned by `gh repo list --json`.
  */
@@ -88,6 +94,48 @@ export interface ParsedGitHubUrl {
     /** Combined owner/repo (e.g. "octocat/my-project") */
     nameWithOwner: string;
 }
+/**
+ * Options for forking a repository.
+ */
+export interface ForkOptions {
+    onProgress?: (message: string) => void;
+}
+/**
+ * Result of checking push access on a repository.
+ */
+export interface PushAccessResult {
+    hasPushAccess: boolean;
+    viewerLogin: string;
+}
+/**
+ * Result of forking a repository.
+ */
+export interface ForkResult {
+    nameWithOwner: string;
+    alreadyExisted: boolean;
+}
+/**
+ * Category of a governance audit finding.
+ */
+export declare enum GovernanceFindingCategory {
+    BranchProtection = "BranchProtection",
+    Codeowners = "Codeowners",
+    WorkflowPermissions = "WorkflowPermissions"
+}
+/**
+ * A single finding from a GitHub governance audit.
+ * Findings are advisory-only — Shep reports gaps but does not mutate remote settings.
+ */
+export interface GovernanceFinding {
+    /** Category of the governance check */
+    category: GovernanceFindingCategory;
+    /** Severity of the finding */
+    severity: 'Low' | 'Medium' | 'High' | 'Critical' | 'Unknown';
+    /** Human-readable description of the finding */
+    message: string;
+    /** Actionable remediation guidance */
+    remediation: string;
+}
 /**
  * Output port for GitHub repository operations.
  *
@@ -151,5 +199,42 @@ export interface IGitHubRepositoryService {
      * @throws {GitHubPermissionError} if the permission check fails (e.g. gh not installed, not authenticated)
      */
     getViewerPermission(repoPath: string): Promise<string>;
+    /**
+     * Get the authenticated GitHub user's login.
+     * @returns The login username
+     * @throws {GitHubAuthError} if not authenticated
+     */
+    getAuthenticatedUser(): Promise<string>;
+    /**
+     * Check if the authenticated user has push access to a repository.
+     * @param nameWithOwner - Full owner/repo identifier
+     * @returns Push access result with viewer login
+     * @throws {GitHubPermissionError} on failure
+     */
+    checkPushAccess(nameWithOwner: string): Promise<PushAccessResult>;
+    /**
+     * Fork a repository to the authenticated user's account.
+     * @param nameWithOwner - Full owner/repo identifier to fork
+     * @param options - Optional progress callback
+     * @returns Fork result with the fork's nameWithOwner
+     * @throws {GitHubForkError} on failure
+     */
+    forkRepository(nameWithOwner: string, options?: ForkOptions): Promise<ForkResult>;
+    /**
+     * Audit repository governance settings via the gh CLI.
+     *
+     * Checks branch protection rules, CODEOWNERS presence, and workflow
+     * permissions. Returns findings with severity and remediation suggestions.
+     * This is audit-only — no remote settings are mutated.
+     *
+     * Handles auth/permission errors gracefully by returning an Unknown-severity
+     * finding instead of throwing.
+     *
+     * @param owner - Repository owner (e.g. "octocat")
+     * @param repo - Repository name (e.g. "my-project")
+     * @param defaultBranch - Branch to check protection for (default: "main")
+     * @returns Array of governance findings (empty if all checks pass)
+     */
+    auditRepositoryGovernance(owner: string, repo: string, defaultBranch?: string): Promise<GovernanceFinding[]>;
 }
 //# sourceMappingURL=github-repository-service.interface.d.ts.map

package/dist/packages/core/src/application/ports/output/services/github-repository-service.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-repository-service.interface.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/ports/output/services/github-repository-service.interface.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAM3C;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAM3C;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAM3C;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAM3C;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAM3C;AAMD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,aAAa,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,SAAS,EAAE,OAAO,CAAC;IACnB,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,4EAA4E;IAC5E,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAC;CACvB;AAMD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3B;;;;;;;OAOG;IACH,eAAe,CACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,OAAO,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAEnF;;;;;OAKG;IACH,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEnD;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAC;IAE7C;;;;;;;;;OASG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACxD"}
+{"version":3,"file":"github-repository-service.interface.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/ports/output/services/github-repository-service.interface.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAM3C;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAM3C;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAM3C;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAM3C;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAM3C;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAM3C;AAMD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,aAAa,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,SAAS,EAAE,OAAO,CAAC;IACnB,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,4EAA4E;IAC5E,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,oBAAY,yBAAyB;IACnC,gBAAgB,qBAAqB;IACrC,UAAU,eAAe;IACzB,mBAAmB,wBAAwB;CAC5C;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,QAAQ,EAAE,yBAAyB,CAAC;IACpC,8BAA8B;IAC9B,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC7D,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;CACrB;AAMD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3B;;;;;;;OAOG;IACH,eAAe,CACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,OAAO,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAEnF;;;;;OAKG;IACH,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEnD;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAC;IAE7C;;;;;;;;;OASG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvD;;;;OAIG;IACH,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAExC;;;;;OAKG;IACH,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAElE;;;;;;OAMG;IACH,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAElF;;;;;;;;;;;;;;OAcG;IACH,yBAAyB,CACvB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;CACjC"}

package/dist/packages/core/src/application/ports/output/services/github-repository-service.interface.js

@@ -68,3 +68,24 @@ export class GitHubPermissionError extends Error {
             this.cause = cause;
     }
 }
+/**
+ * Thrown when a fork operation fails.
+ */
+export class GitHubForkError extends Error {
+    constructor(message, cause) {
+        super(message);
+        this.name = 'GitHubForkError';
+        Object.setPrototypeOf(this, new.target.prototype);
+        if (cause)
+            this.cause = cause;
+    }
+}
+/**
+ * Category of a governance audit finding.
+ */
+export var GovernanceFindingCategory;
+(function (GovernanceFindingCategory) {
+    GovernanceFindingCategory["BranchProtection"] = "BranchProtection";
+    GovernanceFindingCategory["Codeowners"] = "Codeowners";
+    GovernanceFindingCategory["WorkflowPermissions"] = "WorkflowPermissions";
+})(GovernanceFindingCategory || (GovernanceFindingCategory = {}));

package/dist/packages/core/src/application/ports/output/services/security-policy-service.interface.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Security Policy Service Interface
+ *
+ * Output port for the central security policy engine.
+ * Implementations handle policy file reading, validation, merging
+ * with persisted settings, and deterministic policy evaluation.
+ *
+ * Following Clean Architecture:
+ * - Application and use-case layers depend on this interface
+ * - Infrastructure layer provides the concrete implementation
+ * - All consumers (CLI, runtime, CI, UI) resolve the same instance via DI
+ */
+import type { EffectivePolicySnapshot, SecurityActionCategory, SecurityActionDisposition } from '../../../../domain/generated/output.js';
+/**
+ * Result of validating a security policy file.
+ */
+export interface PolicyValidationResult {
+    /** Whether the policy file is valid */
+    valid: boolean;
+    /** Per-field validation error messages (empty when valid) */
+    errors: string[];
+}
+/**
+ * Service interface for security policy evaluation.
+ *
+ * Implementations must:
+ * - Read shep.security.yaml from the repository root
+ * - Merge repository policy with persisted settings defaults
+ * - Apply deterministic precedence (global defaults < repo policy)
+ * - Cache effective policy per repository path
+ * - Fail fast on invalid policy files with actionable errors
+ */
+export interface ISecurityPolicyService {
+    /**
+     * Evaluate and compute the effective security policy for a repository.
+     *
+     * Reads the policy file, merges with persisted settings defaults,
+     * validates, and returns a deterministic snapshot. Re-evaluates
+     * on every call (no cache).
+     *
+     * @param repositoryPath - Absolute path to the repository root
+     * @returns Computed effective policy snapshot
+     * @throws Error if the policy file exists but is invalid
+     */
+    evaluatePolicy(repositoryPath: string): Promise<EffectivePolicySnapshot>;
+    /**
+     * Get the effective security policy for a repository.
+     *
+     * Returns a cached snapshot if available, otherwise computes
+     * and caches the result. Use evaluatePolicy() to force re-evaluation.
+     *
+     * @param repositoryPath - Absolute path to the repository root
+     * @returns Cached or freshly computed effective policy snapshot
+     * @throws Error if the policy file exists but is invalid
+     */
+    getEffectivePolicy(repositoryPath: string): Promise<EffectivePolicySnapshot>;
+    /**
+     * Validate a security policy file without computing effective policy.
+     *
+     * Parses and validates the file against the expected schema.
+     * Returns a structured result with per-field error messages.
+     *
+     * @param filePath - Absolute path to the policy file
+     * @returns Validation result with errors array
+     */
+    validatePolicyFile(filePath: string): Promise<PolicyValidationResult>;
+    /**
+     * Look up the enforcement disposition for a specific action category
+     * within a given effective policy snapshot.
+     *
+     * @param policy - The effective policy snapshot to query
+     * @param actionCategory - The action category to look up
+     * @returns The disposition (Allowed, Denied, or ApprovalRequired)
+     */
+    getActionDisposition(policy: EffectivePolicySnapshot, actionCategory: SecurityActionCategory): SecurityActionDisposition;
+}
+//# sourceMappingURL=security-policy-service.interface.d.ts.map

package/dist/packages/core/src/application/ports/output/services/security-policy-service.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy-service.interface.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/ports/output/services/security-policy-service.interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EAC1B,MAAM,wCAAwC,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,uCAAuC;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,6DAA6D;IAC7D,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;OAUG;IACH,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEzE;;;;;;;;;OASG;IACH,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE7E;;;;;;;;OAQG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEtE;;;;;;;OAOG;IACH,oBAAoB,CAClB,MAAM,EAAE,uBAAuB,EAC/B,cAAc,EAAE,sBAAsB,GACrC,yBAAyB,CAAC;CAC9B"}

package/dist/packages/core/src/application/ports/output/services/security-policy-service.interface.js

@@ -0,0 +1,13 @@
+/**
+ * Security Policy Service Interface
+ *
+ * Output port for the central security policy engine.
+ * Implementations handle policy file reading, validation, merging
+ * with persisted settings, and deterministic policy evaluation.
+ *
+ * Following Clean Architecture:
+ * - Application and use-case layers depend on this interface
+ * - Infrastructure layer provides the concrete implementation
+ * - All consumers (CLI, runtime, CI, UI) resolve the same instance via DI
+ */
+export {};

package/dist/packages/core/src/application/ports/output/services/spec-initializer.interface.d.ts

@@ -32,5 +32,16 @@ export interface ISpecInitializerService {
      * @returns The spec directory path and feature number used
      */
     initialize(basePath: string, slug: string, featureNumber: number, description: string, mode?: 'fast'): Promise<SpecInitializerResult>;
+    /**
+     * Scaffold a baseline shep.security.yaml file at the repository root.
+     *
+     * Creates the security policy file with Advisory mode, default action
+     * dispositions, and dependency/release rules. Includes YAML comments
+     * explaining each section.
+     *
+     * @param repositoryPath - Absolute path to the repository root
+     * @returns The absolute path to the created security policy file
+     */
+    scaffoldSecurityPolicy(repositoryPath: string): Promise<string>;
 }
 //# sourceMappingURL=spec-initializer.interface.d.ts.map

package/dist/packages/core/src/application/ports/output/services/spec-initializer.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spec-initializer.interface.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/ports/output/services/spec-initializer.interface.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;;;;;;;OAkBG;IACH,UAAU,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACnC"}
+{"version":3,"file":"spec-initializer.interface.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/ports/output/services/spec-initializer.interface.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;;;;;;;OAkBG;IACH,UAAU,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAElC;;;;;;;;;OASG;IACH,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACjE"}

package/dist/packages/core/src/application/use-cases/agents/approve-agent-run.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approve-agent-run.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/agents/approve-agent-run.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gEAAgE,CAAC;AAC7G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAE1G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAO9E,qBACa,sBAAsB;IAG/B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBANrB,kBAAkB,EAAE,mBAAmB,EAEvC,cAAc,EAAE,2BAA2B,EAE3C,iBAAiB,EAAE,kBAAkB,EAErC,qBAAqB,EAAE,sBAAsB;IAG1D,OAAO,CACX,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CA0GlD"}
+{"version":3,"file":"approve-agent-run.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/agents/approve-agent-run.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gEAAgE,CAAC;AAC7G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAE1G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAQ9E,qBACa,sBAAsB;IAG/B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBANrB,kBAAkB,EAAE,mBAAmB,EAEvC,cAAc,EAAE,2BAA2B,EAE3C,iBAAiB,EAAE,kBAAkB,EAErC,qBAAqB,EAAE,sBAAsB;IAG1D,OAAO,CACX,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CA2GlD"}

package/dist/packages/core/src/application/use-cases/agents/approve-agent-run.use-case.js

@@ -25,6 +25,7 @@ import { join } from 'node:path';
 import { AgentRunStatus } from '../../../domain/generated/output.js';
 import { writeSpecFileAtomic, safeYamlDump, } from '../../../infrastructure/services/agents/feature-agent/nodes/node-helpers.js';
 import { computeWorktreePath } from '../../../infrastructure/services/ide-launchers/compute-worktree-path.js';
+import { getSettings } from '../../../infrastructure/services/settings.service.js';
 let ApproveAgentRunUseCase = class ApproveAgentRunUseCase {
     agentRunRepository;
     processService;
@@ -120,6 +121,7 @@ let ApproveAgentRunUseCase = class ApproveAgentRunUseCase {
             agentType: run.agentType,
             ...(run.modelId ? { model: run.modelId } : {}),
             ...(feature?.fast ? { fast: true } : {}),
+            securityMode: getSettings().security?.mode,
         });
         return { approved: true, reason: 'Approved and resumed' };
     }

package/dist/packages/core/src/application/use-cases/agents/reject-agent-run.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reject-agent-run.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/agents/reject-agent-run.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gEAAgE,CAAC;AAC7G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAa1G,qBACa,qBAAqB;IAG9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBANrB,kBAAkB,EAAE,mBAAmB,EAEvC,cAAc,EAAE,2BAA2B,EAE3C,iBAAiB,EAAE,kBAAkB,EAErC,qBAAqB,EAAE,sBAAsB;IAG1D,OAAO,CACX,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC;QACT,QAAQ,EAAE,OAAO,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;CAkIH"}
+{"version":3,"file":"reject-agent-run.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/agents/reject-agent-run.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gEAAgE,CAAC;AAC7G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAc1G,qBACa,qBAAqB;IAG9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBANrB,kBAAkB,EAAE,mBAAmB,EAEvC,cAAc,EAAE,2BAA2B,EAE3C,iBAAiB,EAAE,kBAAkB,EAErC,qBAAqB,EAAE,sBAAsB;IAG1D,OAAO,CACX,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC;QACT,QAAQ,EAAE,OAAO,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;CAmIH"}

package/dist/packages/core/src/application/use-cases/agents/reject-agent-run.use-case.js

@@ -25,6 +25,7 @@ import { AgentRunStatus } from '../../../domain/generated/output.js';
 import { writeSpecFileAtomic, safeYamlDump, } from '../../../infrastructure/services/agents/feature-agent/nodes/node-helpers.js';
 import { recordLifecycleEvent } from '../../../infrastructure/services/agents/feature-agent/phase-timing-context.js';
 import { computeWorktreePath } from '../../../infrastructure/services/ide-launchers/compute-worktree-path.js';
+import { getSettings } from '../../../infrastructure/services/settings.service.js';
 let RejectAgentRunUseCase = class RejectAgentRunUseCase {
     agentRunRepository;
     processService;
@@ -136,6 +137,7 @@ let RejectAgentRunUseCase = class RejectAgentRunUseCase {
             agentType: run.agentType,
             ...(run.modelId ? { model: run.modelId } : {}),
             ...(feature.fast ? { fast: true } : {}),
+            securityMode: getSettings().security?.mode,
         });
         return {
             rejected: true,

package/dist/packages/core/src/application/use-cases/features/check-and-unblock-features.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-and-unblock-features.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/features/check-and-unblock-features.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAGhH,qBACa,8BAA8B;IAET,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE1D,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAFkB,WAAW,EAAE,kBAAkB,EAE7D,YAAY,EAAE,2BAA2B;IAG5D;;;;OAIG;IACG,OAAO,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA4CtD"}
+{"version":3,"file":"check-and-unblock-features.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/features/check-and-unblock-features.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAIhH,qBACa,8BAA8B;IAET,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE1D,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAFkB,WAAW,EAAE,kBAAkB,EAE7D,YAAY,EAAE,2BAA2B;IAG5D;;;;OAIG;IACG,OAAO,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA6CtD"}

package/dist/packages/core/src/application/use-cases/features/check-and-unblock-features.use-case.js

@@ -29,6 +29,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { injectable, inject } from 'tsyringe';
 import { SdlcLifecycle } from '../../../domain/generated/output.js';
 import { POST_IMPLEMENTATION } from '../../../domain/lifecycle-gates.js';
+import { getSettings } from '../../../infrastructure/services/settings.service.js';
 let CheckAndUnblockFeaturesUseCase = class CheckAndUnblockFeaturesUseCase {
     featureRepo;
     agentProcess;
@@ -70,6 +71,7 @@ let CheckAndUnblockFeaturesUseCase = class CheckAndUnblockFeaturesUseCase {
                     enableEvidence: child.enableEvidence,
                     commitEvidence: child.commitEvidence,
                     ...(child.fast ? { fast: true } : {}),
+                    securityMode: getSettings().security?.mode,
                 });
             }
         }

package/dist/packages/core/src/application/use-cases/features/create/create-feature-from-remote.use-case.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Create Feature From Remote Use Case
+ *
+ * Composite use case that chains ImportGitHubRepositoryUseCase with
+ * CreateFeatureUseCase. Enables creating a feature on a remote GitHub
+ * repo in a single command — clone (or fork), register, then create feature.
+ *
+ * Provides two execution modes:
+ * - execute(): synchronous full flow for CLI
+ * - createRecord() + initializeAndSpawn(): two-phase for Web UI (fast response + background work)
+ */
+import type { Feature } from '../../../../domain/generated/output.js';
+import type { ApprovalGates, Attachment } from '../../../../domain/generated/output.js';
+import type { CloneOptions, ForkOptions } from '../../../ports/output/services/github-repository-service.interface.js';
+import { ImportGitHubRepositoryUseCase } from '../../repositories/import-github-repository.use-case.js';
+import { CreateFeatureUseCase } from './create-feature.use-case.js';
+import type { CreateFeatureResult, CreateRecordResult } from './types.js';
+export interface CreateFeatureFromRemoteInput {
+    /** GitHub URL or owner/repo shorthand */
+    remoteUrl: string;
+    /** Override clone destination directory */
+    cloneDest?: string;
+    /** Default base directory for clones (from settings) */
+    defaultCloneDir?: string;
+    /** Options for the clone subprocess */
+    cloneOptions?: CloneOptions;
+    /** Options for fork operations */
+    forkOptions?: ForkOptions;
+    userInput: string;
+    approvalGates?: ApprovalGates;
+    push?: boolean;
+    openPr?: boolean;
+    parentId?: string;
+    name?: string;
+    description?: string;
+    fast?: boolean;
+    pending?: boolean;
+    agentType?: string;
+    model?: string;
+    attachments?: Attachment[];
+    sessionId?: string;
+    attachmentPaths?: string[];
+}
+export declare class CreateFeatureFromRemoteUseCase {
+    private readonly importUseCase;
+    private readonly createFeatureUseCase;
+    constructor(importUseCase: ImportGitHubRepositoryUseCase, createFeatureUseCase: CreateFeatureUseCase);
+    /**
+     * Full synchronous execution: import repo then create feature.
+     * Used by the CLI which shows a spinner and needs everything done before returning.
+     */
+    execute(input: CreateFeatureFromRemoteInput): Promise<CreateFeatureResult>;
+    /**
+     * Phase 1 (fast): import repo + create DB record. Returns immediately with real feature ID.
+     * Used by the Web UI for optimistic display.
+     */
+    createRecord(input: CreateFeatureFromRemoteInput): Promise<CreateRecordResult>;
+    /**
+     * Phase 2 (background): metadata generation, worktree, spec, agent spawn.
+     * Fire-and-forget from the Web UI.
+     */
+    initializeAndSpawn(feature: Feature, input: CreateFeatureFromRemoteInput, shouldSpawn: boolean): Promise<{
+        warning?: string;
+        updatedFeature: Feature;
+    }>;
+}
+//# sourceMappingURL=create-feature-from-remote.use-case.d.ts.map

package/dist/packages/core/src/application/use-cases/features/create/create-feature-from-remote.use-case.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-feature-from-remote.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/use-cases/features/create/create-feature-from-remote.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACxF,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACZ,MAAM,uEAAuE,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,yDAAyD,CAAC;AACxG,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE1E,MAAM,WAAW,4BAA4B;IAC3C,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,kCAAkC;IAClC,WAAW,CAAC,EAAE,WAAW,CAAC;IAG1B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,qBACa,8BAA8B;IAGvC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;gBAFpB,aAAa,EAAE,6BAA6B,EAE5C,oBAAoB,EAAE,oBAAoB;IAG7D;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA4BhF;;;OAGG;IACG,YAAY,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA4BpF;;;OAGG;IACG,kBAAkB,CACtB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,4BAA4B,EACnC,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC;CA0B1D"}

package/dist/packages/core/src/application/use-cases/features/create/create-feature-from-remote.use-case.js

@@ -0,0 +1,128 @@
+/**
+ * Create Feature From Remote Use Case
+ *
+ * Composite use case that chains ImportGitHubRepositoryUseCase with
+ * CreateFeatureUseCase. Enables creating a feature on a remote GitHub
+ * repo in a single command — clone (or fork), register, then create feature.
+ *
+ * Provides two execution modes:
+ * - execute(): synchronous full flow for CLI
+ * - createRecord() + initializeAndSpawn(): two-phase for Web UI (fast response + background work)
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { injectable, inject } from 'tsyringe';
+import { ImportGitHubRepositoryUseCase } from '../../repositories/import-github-repository.use-case.js';
+import { CreateFeatureUseCase } from './create-feature.use-case.js';
+let CreateFeatureFromRemoteUseCase = class CreateFeatureFromRemoteUseCase {
+    importUseCase;
+    createFeatureUseCase;
+    constructor(importUseCase, createFeatureUseCase) {
+        this.importUseCase = importUseCase;
+        this.createFeatureUseCase = createFeatureUseCase;
+    }
+    /**
+     * Full synchronous execution: import repo then create feature.
+     * Used by the CLI which shows a spinner and needs everything done before returning.
+     */
+    async execute(input) {
+        const repository = await this.importUseCase.execute({
+            url: input.remoteUrl,
+            dest: input.cloneDest,
+            defaultCloneDir: input.defaultCloneDir,
+            cloneOptions: input.cloneOptions,
+            forkOptions: input.forkOptions,
+        });
+        return this.createFeatureUseCase.execute({
+            userInput: input.userInput,
+            repositoryPath: repository.path,
+            approvalGates: input.approvalGates,
+            push: input.push,
+            openPr: input.openPr,
+            parentId: input.parentId,
+            name: input.name,
+            description: input.description,
+            fast: input.fast,
+            pending: input.pending,
+            agentType: input.agentType,
+            model: input.model,
+            attachments: input.attachments,
+            sessionId: input.sessionId,
+            attachmentPaths: input.attachmentPaths,
+        });
+    }
+    /**
+     * Phase 1 (fast): import repo + create DB record. Returns immediately with real feature ID.
+     * Used by the Web UI for optimistic display.
+     */
+    async createRecord(input) {
+        const repository = await this.importUseCase.execute({
+            url: input.remoteUrl,
+            dest: input.cloneDest,
+            defaultCloneDir: input.defaultCloneDir,
+            cloneOptions: input.cloneOptions,
+            forkOptions: input.forkOptions,
+        });
+        return this.createFeatureUseCase.createRecord({
+            userInput: input.userInput,
+            repositoryPath: repository.path,
+            approvalGates: input.approvalGates,
+            push: input.push,
+            openPr: input.openPr,
+            parentId: input.parentId,
+            name: input.name,
+            description: input.description,
+            fast: input.fast,
+            pending: input.pending,
+            agentType: input.agentType,
+            model: input.model,
+            attachments: input.attachments,
+            sessionId: input.sessionId,
+            attachmentPaths: input.attachmentPaths,
+        });
+    }
+    /**
+     * Phase 2 (background): metadata generation, worktree, spec, agent spawn.
+     * Fire-and-forget from the Web UI.
+     */
+    async initializeAndSpawn(feature, input, shouldSpawn) {
+        return this.createFeatureUseCase.initializeAndSpawn(feature, {
+            userInput: input.userInput,
+            // CreateFeatureUseCase.initializeAndSpawn reads the effective repo path
+            // from feature.repositoryPath, but the interface still requires this
+            // field. Pass the feature's repositoryPath for consistency.
+            repositoryPath: feature.repositoryPath,
+            approvalGates: input.approvalGates,
+            push: input.push,
+            openPr: input.openPr,
+            parentId: input.parentId,
+            name: input.name,
+            description: input.description,
+            fast: input.fast,
+            pending: input.pending,
+            agentType: input.agentType,
+            model: input.model,
+            attachments: input.attachments,
+            sessionId: input.sessionId,
+            attachmentPaths: input.attachmentPaths,
+        }, shouldSpawn);
+    }
+};
+CreateFeatureFromRemoteUseCase = __decorate([
+    injectable(),
+    __param(0, inject(ImportGitHubRepositoryUseCase)),
+    __param(1, inject(CreateFeatureUseCase)),
+    __metadata("design:paramtypes", [ImportGitHubRepositoryUseCase,
+        CreateFeatureUseCase])
+], CreateFeatureFromRemoteUseCase);
+export { CreateFeatureFromRemoteUseCase };

package/dist/packages/core/src/application/use-cases/features/create/create-feature.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-feature.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/use-cases/features/create/create-feature.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wCAAwC,CAAC;AAMtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oEAAoE,CAAC;AAC7G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AACrG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iEAAiE,CAAC;AACnH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gEAAgE,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8DAA8D,CAAC;AAC5G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uEAAuE,CAAC;AACnH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4DAA4D,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2DAA2D,CAAC;AACjG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4DAA4D,CAAC;AAIxG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mEAAmE,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE9F,qBACa,oBAAoB;IAG7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAtBb,WAAW,EAAE,kBAAkB,EAE/B,eAAe,EAAE,gBAAgB,EAEjC,YAAY,EAAE,2BAA2B,EAEzC,aAAa,EAAE,mBAAmB,EAElC,eAAe,EAAE,uBAAuB,EAExC,iBAAiB,EAAE,iBAAiB,EAEpC,YAAY,EAAE,YAAY,EAE1B,cAAc,EAAE,qBAAqB,EAErC,YAAY,EAAE,aAAa,EAE3B,iBAAiB,EAAE,wBAAwB,EAE3C,cAAc,EAAE,eAAe,EAE/B,aAAa,EAAE,qBAAqB;IAGvD;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMtE;;;;OAIG;IACG,YAAY,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAyI1E;;;OAGG;IACG,kBAAkB,CACtB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,kBAAkB,EACzB,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC;CAsK1D"}
+{"version":3,"file":"create-feature.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/use-cases/features/create/create-feature.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wCAAwC,CAAC;AAMtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oEAAoE,CAAC;AAC7G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AACrG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iEAAiE,CAAC;AACnH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gEAAgE,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8DAA8D,CAAC;AAC5G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uEAAuE,CAAC;AACnH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4DAA4D,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2DAA2D,CAAC;AACjG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4DAA4D,CAAC;AAIxG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mEAAmE,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE9F,qBACa,oBAAoB;IAG7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAtBb,WAAW,EAAE,kBAAkB,EAE/B,eAAe,EAAE,gBAAgB,EAEjC,YAAY,EAAE,2BAA2B,EAEzC,aAAa,EAAE,mBAAmB,EAElC,eAAe,EAAE,uBAAuB,EAExC,iBAAiB,EAAE,iBAAiB,EAEpC,YAAY,EAAE,YAAY,EAE1B,cAAc,EAAE,qBAAqB,EAErC,YAAY,EAAE,aAAa,EAE3B,iBAAiB,EAAE,wBAAwB,EAE3C,cAAc,EAAE,eAAe,EAE/B,aAAa,EAAE,qBAAqB;IAGvD;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMtE;;;;OAIG;IACG,YAAY,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAyI1E;;;OAGG;IACG,kBAAkB,CACtB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,kBAAkB,EACzB,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC;CAuK1D"}

package/dist/packages/core/src/application/use-cases/features/create/create-feature.use-case.js

@@ -326,6 +326,7 @@ let CreateFeatureUseCase = class CreateFeatureUseCase {
                 ...(input.fast ? { fast: true } : {}),
                 ...(input.agentType ? { agentType: input.agentType } : {}),
                 ...(input.model ? { model: input.model } : {}),
+                securityMode: settings.security?.mode,
             });
         }
         return { warning, updatedFeature };

package/dist/packages/core/src/application/use-cases/features/resume-feature.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resume-feature.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/features/resume-feature.use-case.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAQlG,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED,qBACa,oBAAoB;IAG7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,eAAe;gBANf,WAAW,EAAE,kBAAkB,EAE/B,OAAO,EAAE,mBAAmB,EAE5B,cAAc,EAAE,2BAA2B,EAE3C,eAAe,EAAE,gBAAgB;IAG9C,OAAO,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC,mBAAmB,CAAC;CA4GhC"}
+{"version":3,"file":"resume-feature.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/features/resume-feature.use-case.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AASlG,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED,qBACa,oBAAoB;IAG7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,eAAe;gBANf,WAAW,EAAE,kBAAkB,EAE/B,OAAO,EAAE,mBAAmB,EAE5B,cAAc,EAAE,2BAA2B,EAE3C,eAAe,EAAE,gBAAgB;IAG9C,OAAO,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC,mBAAmB,CAAC;CA6GhC"}

package/dist/packages/core/src/application/use-cases/features/resume-feature.use-case.js

@@ -19,6 +19,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { injectable, inject } from 'tsyringe';
 import { randomUUID } from 'node:crypto';
 import { AgentRunStatus } from '../../../domain/generated/output.js';
+import { getSettings } from '../../../infrastructure/services/settings.service.js';
 const RESUMABLE_STATUSES = new Set([
     AgentRunStatus.interrupted,
     AgentRunStatus.failed,
@@ -118,6 +119,7 @@ let ResumeFeatureUseCase = class ResumeFeatureUseCase {
             ...(feature.fast ? { fast: true } : {}),
             ...(lastRun.modelId ? { model: lastRun.modelId } : {}),
             resumeReason: lastRun.status,
+            securityMode: getSettings().security?.mode,
         });
         return { feature, newRun };
     }

package/dist/packages/core/src/application/use-cases/features/start-feature.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"start-feature.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/features/start-feature.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAGlG,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,qBACa,mBAAmB;IAG5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,eAAe;gBANf,WAAW,EAAE,kBAAkB,EAE/B,OAAO,EAAE,mBAAmB,EAE5B,cAAc,EAAE,2BAA2B,EAE3C,eAAe,EAAE,gBAAgB;IAG9C,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAyG9D"}
+{"version":3,"file":"start-feature.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/features/start-feature.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6DAA6D,CAAC;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAChH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAIlG,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,qBACa,mBAAmB;IAG5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,eAAe;gBANf,WAAW,EAAE,kBAAkB,EAE/B,OAAO,EAAE,mBAAmB,EAE5B,cAAc,EAAE,2BAA2B,EAE3C,eAAe,EAAE,gBAAgB;IAG9C,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;CA0G9D"}

package/dist/packages/core/src/application/use-cases/features/start-feature.use-case.js

@@ -20,6 +20,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { injectable, inject } from 'tsyringe';
 import { SdlcLifecycle } from '../../../domain/generated/output.js';
 import { POST_IMPLEMENTATION } from '../../../domain/lifecycle-gates.js';
+import { getSettings } from '../../../infrastructure/services/settings.service.js';
 let StartFeatureUseCase = class StartFeatureUseCase {
     featureRepo;
     runRepo;
@@ -105,6 +106,7 @@ let StartFeatureUseCase = class StartFeatureUseCase {
                 agentType: agentRun.agentType,
                 ...(resolved.fast ? { fast: true } : {}),
                 ...(agentRun.modelId ? { model: agentRun.modelId } : {}),
+                securityMode: getSettings().security?.mode,
             });
         }
         return { feature: updatedFeature, agentRun };