@shrkcrft/cli 0.1.0-alpha.2

package/dist/commands/rules.command.js

@@ -0,0 +1,435 @@
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import * as nodePath from 'node:path';
+import { AssetKind, AssetProvenanceOperation, AssetProvenanceSource, buildRuleScaffold, diagnoseRuleQuality, inspectSharkcraft, recordProvenance, renderRuleQualityText, RuleScaffoldKind, } from '@shrkcrft/inspector';
+import { formatRuleCompact, formatRuleFull, formatRulesForAi } from '@shrkcrft/rules';
+import { flagBool, flagNumber, flagString, flagList, resolveCwd, } from "../command-registry.js";
+import { asJson, header } from "../output/format-output.js";
+import { knowledgeAddCommand, knowledgeRemoveCommand, knowledgeUpdateCommand, } from "./knowledge-author.command.js";
+export const rulesListCommand = {
+    name: 'list',
+    description: 'List all rules.',
+    usage: 'shrk rules list [--json]',
+    async run(args) {
+        const inspection = await inspectSharkcraft({ cwd: resolveCwd(args) });
+        const rules = inspection.ruleService.list();
+        if (flagBool(args, 'json')) {
+            process.stdout.write(asJson(rules) + '\n');
+            return 0;
+        }
+        process.stdout.write(header(`Rules (${rules.length})`));
+        for (const r of rules)
+            process.stdout.write(formatRuleCompact(r) + '\n');
+        return 0;
+    },
+};
+export const rulesGetCommand = {
+    name: 'get',
+    description: 'Show full content of one rule.',
+    usage: 'shrk rules get <id> [--json]',
+    async run(args) {
+        const id = args.positional[0];
+        if (!id) {
+            process.stderr.write('Usage: shrk rules get <id>\n');
+            return 2;
+        }
+        const inspection = await inspectSharkcraft({ cwd: resolveCwd(args) });
+        const rule = inspection.ruleService.get(id);
+        if (!rule) {
+            process.stderr.write(`No rule with id "${id}".\n`);
+            return 1;
+        }
+        if (flagBool(args, 'json')) {
+            process.stdout.write(asJson(rule) + '\n');
+            return 0;
+        }
+        process.stdout.write(formatRuleFull(rule) + '\n');
+        return 0;
+    },
+};
+export const rulesRelevantCommand = {
+    name: 'relevant',
+    description: 'Return rules relevant to a task.',
+    usage: 'shrk rules relevant --task "<task>" [--scope x,y] [--limit 10] [--ai] [--json]',
+    async run(args) {
+        const task = flagString(args, 'task');
+        if (!task) {
+            process.stderr.write('Missing --task\n');
+            return 2;
+        }
+        const scope = flagList(args, 'scope');
+        const tags = flagList(args, 'tag');
+        const appliesWhen = flagList(args, 'appliesWhen');
+        const limit = flagNumber(args, 'limit') ?? 10;
+        const inspection = await inspectSharkcraft({ cwd: resolveCwd(args) });
+        const rules = inspection.ruleService.getRelevant(task, {
+            scope: scope.length ? scope : undefined,
+            tags: tags.length ? tags : undefined,
+            appliesWhen: appliesWhen.length ? appliesWhen : undefined,
+            limit,
+        });
+        if (flagBool(args, 'json')) {
+            process.stdout.write(asJson(rules) + '\n');
+            return 0;
+        }
+        if (flagBool(args, 'ai')) {
+            process.stdout.write(formatRulesForAi(rules) + '\n');
+            return 0;
+        }
+        process.stdout.write(header(`Relevant rules for: ${task}`));
+        for (const r of rules)
+            process.stdout.write(formatRuleCompact(r) + '\n');
+        return 0;
+    },
+};
+function parseRuleScaffoldKind(value) {
+    switch ((value ?? '').toLowerCase()) {
+        case 'safety':
+            return RuleScaffoldKind.Safety;
+        case 'architecture':
+            return RuleScaffoldKind.Architecture;
+        case 'style':
+            return RuleScaffoldKind.Style;
+        case 'governance':
+            return RuleScaffoldKind.Governance;
+        case 'migration':
+            return RuleScaffoldKind.Migration;
+        case 'testing':
+            return RuleScaffoldKind.Testing;
+        case 'advisory':
+            return RuleScaffoldKind.Advisory;
+        default:
+            return RuleScaffoldKind.Architecture;
+    }
+}
+export const rulesScaffoldCommand = {
+    name: 'scaffold',
+    description: 'Scaffold a new rule. Preview-only by default — writes nothing. Pass --write-preview to materialise the scaffold under .sharkcraft/fixes/.',
+    usage: 'shrk rules scaffold --id <id> [--kind architecture|safety|style|governance|migration|testing|advisory] [--title <t>] [--rationale <text>] [--owner <name>] [--good <code>] [--bad <code>] [--verification "<cmd>"] [--forbidden "<text>"] [--write-preview] [--json]',
+    async run(args) {
+        const id = flagString(args, 'id');
+        if (!id) {
+            process.stderr.write('Usage: shrk rules scaffold --id <id> [--kind <k>] [--write-preview]\n');
+            return 2;
+        }
+        const kind = parseRuleScaffoldKind(flagString(args, 'kind'));
+        const verification = flagList(args, 'verification');
+        const forbidden = flagList(args, 'forbidden');
+        const result = buildRuleScaffold({
+            id,
+            kind,
+            title: flagString(args, 'title') ?? undefined,
+            rationale: flagString(args, 'rationale') ?? undefined,
+            owner: flagString(args, 'owner') ?? undefined,
+            goodExample: flagString(args, 'good') ?? undefined,
+            badExample: flagString(args, 'bad') ?? undefined,
+            verificationCommands: verification.length > 0 ? verification : undefined,
+            forbiddenActions: forbidden.length > 0 ? forbidden : undefined,
+        });
+        if (flagBool(args, 'json')) {
+            process.stdout.write(asJson(result) + '\n');
+            // Continue to write-preview side effect even in json mode for parity.
+        }
+        else {
+            process.stdout.write(header(`Rule scaffold preview: ${id}`));
+            process.stdout.write(`  kind:       ${result.kind}\n`);
+            process.stdout.write(`  generated:  ${result.generatedAt}\n`);
+            process.stdout.write(`  files:\n`);
+            process.stdout.write(`    ${result.tsScaffold.path}\n`);
+            process.stdout.write(`    ${result.jsonManifest.path}\n`);
+            process.stdout.write(`    ${result.explainer.path}\n`);
+            if (result.warnings.length > 0) {
+                process.stdout.write('\n  warnings:\n');
+                for (const w of result.warnings)
+                    process.stdout.write(`    • ${w}\n`);
+            }
+            process.stdout.write('\n--- TypeScript scaffold ---\n');
+            process.stdout.write(result.tsScaffold.body);
+            process.stdout.write('\n--- Next commands ---\n');
+            for (const c of result.nextCommands)
+                process.stdout.write(`  $ ${c}\n`);
+            if (!flagBool(args, 'write-preview')) {
+                process.stdout.write('\n  (preview only — pass --write-preview to materialise under .sharkcraft/fixes/)\n');
+            }
+        }
+        if (flagBool(args, 'write-preview')) {
+            const cwd = resolveCwd(args);
+            const dir = nodePath.join(cwd, '.sharkcraft', 'fixes');
+            if (!existsSync(dir))
+                mkdirSync(dir, { recursive: true });
+            for (const file of [result.tsScaffold, result.jsonManifest, result.explainer]) {
+                const abs = nodePath.join(cwd, file.path);
+                writeFileSync(abs, file.body, 'utf8');
+            }
+            process.stdout.write(`\nWrote 3 files under ${nodePath.join(cwd, '.sharkcraft', 'fixes')}\n`);
+            // Record provenance for the scaffold.
+            try {
+                const isAgent = Boolean(process.env['SHARKCRAFT_AGENT']) ||
+                    Boolean(process.env['CLAUDE_CODE_SESSION']);
+                recordProvenance({
+                    projectRoot: cwd,
+                    entry: {
+                        operation: AssetProvenanceOperation.Add,
+                        assetKind: AssetKind.Rule,
+                        assetId: id,
+                        source: isAgent ? AssetProvenanceSource.Agent : AssetProvenanceSource.Cli,
+                        previewPath: result.tsScaffold.path,
+                        ...(flagString(args, 'reason') ? { reason: flagString(args, 'reason') } : {}),
+                    },
+                });
+            }
+            catch {
+                // best-effort — failing to record provenance must not break the scaffold.
+            }
+        }
+        return 0;
+    },
+};
+/**
+ * Clone ParsedArgs with a flag override. Used by the rules add/
+ * remove wrappers to force `type='rule'` before delegating to the
+ * knowledge authoring path.
+ */
+function withFlagOverride(args, key, value) {
+    const flags = new Map(args.flags);
+    flags.set(key, value);
+    return {
+        positional: [...args.positional],
+        flags,
+        multiFlags: args.multiFlags,
+        ...(args.globalCwd ? { globalCwd: args.globalCwd } : {}),
+    };
+}
+/**
+ * `shrk rules add`.
+ *
+ * Mirror of `shrk knowledge add` with `type='rule'` forced. Rules in
+ * SharkCraft are knowledge entries with `type='rule'`, so we reuse the
+ * canonical `knowledge add` flow (preview, draft path, provenance) and
+ * just enforce the type at the wrapper. Refuses if `--type` was passed
+ * with a non-rule value.
+ */
+export const rulesAddCommand = {
+    name: 'add',
+    description: 'Preview adding a new rule. Mirror of `knowledge add` with `type=rule` forced. Preview-only — pass --write-preview to materialise under .sharkcraft/authoring/.',
+    usage: 'shrk rules add --id <id> [--title <t>] [--priority critical|high|medium|low] [--summary <s>] [--content <text>] [--scope x,y] [--tag x,y] [--applies-when x,y] [--related a,b] [--reference kind:value[:required]] [--reason <text>] [--allow-overwrite] [--write-preview] [--json]',
+    async run(args) {
+        const id = flagString(args, 'id') ?? args.positional[0];
+        if (!id) {
+            process.stderr.write('Usage: shrk rules add --id <id> [...]\n');
+            return 2;
+        }
+        const requestedType = flagString(args, 'type');
+        if (requestedType && requestedType !== 'rule') {
+            process.stderr.write(`Refused: \`shrk rules add\` forces type='rule'. Got --type ${requestedType}. Use \`shrk knowledge add\` for non-rule types.\n`);
+            return 2;
+        }
+        const next = withFlagOverride(args, 'type', 'rule');
+        return knowledgeAddCommand.run(next);
+    },
+};
+/**
+ * `shrk rules remove <id>`.
+ *
+ * Mirror of `shrk knowledge remove` that first asserts the target id is
+ * a rule (so an accidental `shrk rules remove some-knowledge-id` becomes
+ * a hard refusal instead of silently removing a documentation entry).
+ * Reference-checking is identical to `knowledge remove` — reverse
+ * references refuse the preview unless `--force-preview` is set.
+ */
+export const rulesRemoveCommand = {
+    name: 'remove',
+    description: 'Preview removal of a rule. Asserts type=rule then delegates to `knowledge remove` — same reference-check, same preview path, same provenance.',
+    usage: 'shrk rules remove <id> [--force-preview] [--reason <text>] [--write-preview] [--json]',
+    async run(args) {
+        const id = args.positional[0] ?? flagString(args, 'id');
+        if (!id) {
+            process.stderr.write('Usage: shrk rules remove <id> [--force-preview]\n');
+            return 2;
+        }
+        const cwd = resolveCwd(args);
+        const inspection = await inspectSharkcraft({ cwd });
+        const entry = inspection.knowledgeEntries.find((e) => e.id === id);
+        if (!entry) {
+            process.stderr.write(`Unknown id: ${id}. Use \`shrk rules list\` or \`shrk knowledge list\` to find one.\n`);
+            return 1;
+        }
+        if (entry.type !== 'rule') {
+            process.stderr.write(`Entry "${id}" exists but type=${entry.type}, not "rule". Use \`shrk knowledge remove ${id}\` instead.\n`);
+            return 1;
+        }
+        return knowledgeRemoveCommand.run(args);
+    },
+};
+/**
+ * `shrk rules update <id>`.
+ *
+ * Rules in SharkCraft are stored as knowledge entries with `type='rule'`.
+ * The dedicated `rules update` verb exists so the authoring surface for
+ * rules feels first-class. It asserts the target id is a rule and then
+ * delegates to the knowledge-update flow — same flags, same preview
+ * location (`.sharkcraft/authoring/`), same provenance ledger.
+ *
+ * Provenance: written under `AssetKind.Knowledge` (the underlying data
+ * model). The dedicated `rules scaffold` flow writes under
+ * `AssetKind.Rule` for new rules; updates piggy-back on knowledge.
+ */
+export const rulesUpdateCommand = {
+    name: 'update',
+    description: 'Preview an update to an existing rule. Thin wrapper over `knowledge update` (rules are knowledge entries with type="rule") — same flags, preview-first, provenance recorded.',
+    usage: 'shrk rules update <id> [--summary <s>] [--content <text>] [--priority critical|high|medium|low] [--add-related a,b] [--remove-related a,b] [--reference kind:value[:required]] [--remove-reference kind:value] [--mark-deprecated] [--unmark-deprecated] [--reason <text>] [--write-preview] [--json]',
+    async run(args) {
+        const id = args.positional[0] ?? flagString(args, 'id');
+        if (!id) {
+            process.stderr.write('Usage: shrk rules update <id> [...]\n');
+            return 2;
+        }
+        const cwd = resolveCwd(args);
+        const inspection = await inspectSharkcraft({ cwd });
+        const entry = inspection.knowledgeEntries.find((e) => e.id === id);
+        if (!entry) {
+            process.stderr.write(`Unknown id: ${id}. Use \`shrk rules list\` or \`shrk knowledge list\` to find one.\n`);
+            return 1;
+        }
+        if (entry.type !== 'rule') {
+            process.stderr.write(`Entry "${id}" exists but type=${entry.type}, not "rule". Use \`shrk knowledge update ${id}\` instead.\n`);
+            return 1;
+        }
+        return knowledgeUpdateCommand.run(args);
+    },
+};
+/**
+ * `shrk rules lint` is the lint-style alias of `rules doctor`. It
+ * defaults to strict (warnings + errors fail), supports `--fix-preview`
+ * which materialises a smallest-change patch under
+ * `.sharkcraft/fixes/rules-lint/<rule-id>.patch.md` per finding, and
+ * never mutates source.
+ */
+export const rulesLintCommand = {
+    name: 'lint',
+    description: 'Lint rules — alias of `rules doctor` with lint-style defaults. `--fix-preview` materialises smallest-change patches under .sharkcraft/fixes/rules-lint/ (preview only).',
+    usage: 'shrk rules lint [--id <ruleId>] [--advisory <ruleId,...>] [--fix-preview] [--write-preview] [--json]',
+    async run(args) {
+        const cwd = resolveCwd(args);
+        const inspection = await inspectSharkcraft({ cwd });
+        const rules = inspection.ruleService.list();
+        const knownVerificationIds = new Set((inspection.config?.verificationCommands ?? []).map((c) => c.id));
+        const advisoryFlag = flagList(args, 'advisory');
+        const id = flagString(args, 'id');
+        const report = diagnoseRuleQuality(rules, {
+            ruleId: id ?? undefined,
+            advisoryRuleIds: advisoryFlag.length > 0 ? advisoryFlag : undefined,
+        }, { knownVerificationIds });
+        const wantJson = flagBool(args, 'json');
+        const wantFixPreview = flagBool(args, 'fix-preview');
+        const wantWritePreview = flagBool(args, 'write-preview');
+        const suggestions = [];
+        if (wantFixPreview) {
+            for (const f of report.findings) {
+                const ruleId = f.ruleId ?? 'unknown';
+                const suggestion = buildSmallestRuleFix(f);
+                if (suggestion) {
+                    suggestions.push({ ruleId, finding: f.code, suggestion });
+                }
+            }
+        }
+        if (wantJson) {
+            process.stdout.write(asJson({ report, suggestions }) + '\n');
+        }
+        else {
+            process.stdout.write(header('Rules lint'));
+            process.stdout.write(renderRuleQualityText(report));
+            if (wantFixPreview) {
+                process.stdout.write('\n--- Fix-preview suggestions ---\n');
+                if (suggestions.length === 0) {
+                    process.stdout.write('  (no automatable fixes — review findings manually)\n');
+                }
+                else {
+                    for (const s of suggestions) {
+                        process.stdout.write(`\n  ${s.ruleId} — ${s.finding}\n`);
+                        for (const line of s.suggestion.split('\n')) {
+                            process.stdout.write(`    ${line}\n`);
+                        }
+                    }
+                }
+                if (!wantWritePreview) {
+                    process.stdout.write('\n  (preview only — pass --write-preview to materialise under .sharkcraft/fixes/rules-lint/)\n');
+                }
+            }
+        }
+        if (wantFixPreview && wantWritePreview && suggestions.length > 0) {
+            const dir = nodePath.join(cwd, '.sharkcraft', 'fixes', 'rules-lint');
+            if (!existsSync(dir))
+                mkdirSync(dir, { recursive: true });
+            for (const s of suggestions) {
+                const safeId = s.ruleId.replace(/[^a-z0-9._-]/gi, '_');
+                const out = nodePath.join(dir, `${safeId}.${s.finding}.patch.md`);
+                const body = `# Rules-lint fix preview\n\n` +
+                    `- rule:    ${s.ruleId}\n` +
+                    `- finding: ${s.finding}\n\n` +
+                    `${s.suggestion}\n`;
+                writeFileSync(out, body, 'utf8');
+            }
+            process.stdout.write(`\nWrote ${suggestions.length} preview file(s) under ${nodePath.join(cwd, '.sharkcraft', 'fixes', 'rules-lint')}\n`);
+        }
+        // Lint defaults to strict — warnings and errors both fail.
+        return report.summary.errors + report.summary.warnings > 0 ? 1 : 0;
+    },
+};
+function buildSmallestRuleFix(finding) {
+    // Deterministic, opinionated smallest-change suggestions. We never invent
+    // semantic content — the agent fills it in. The preview shows the shape.
+    switch (finding.code) {
+        case 'missing-owner':
+            return `Add an \`owner\` to this rule:\n\n    owner: 'team-name@example.com'`;
+        case 'missing-verification':
+            return `Add at least one verificationCommand id from sharkcraft.config.ts:\n\n    actionHints: { verificationCommands: ['<id-from-config>'] }`;
+        case 'missing-hints':
+        case 'missing-action-hints':
+            return `Add an \`actionHints\` block:\n\n    actionHints: {\n      commands: [{ command: 'shrk <cmd>' }],\n      verificationCommands: [],\n      forbiddenActions: [],\n    }`;
+        case 'missing-commands-or-mcp':
+            return `Add either \`actionHints.commands\` or \`actionHints.mcpTools\` so agents know which command to run.`;
+        case 'missing-forbidden-actions':
+            return `Add \`actionHints.forbiddenActions: ['<plain-language description>']\` so agents know what NOT to do.`;
+        case 'missing-write-policy':
+            return `Set \`actionHints.writePolicy\` to 'cli-only' | 'plan-first' | 'preview-only'.`;
+        case 'missing-examples':
+            return `Add a paired example to the rule's \`examples\` array:\n\n    examples: [\n      { kind: 'good', code: '<canonical correct sample>' },\n      { kind: 'bad',  code: '<typical mistake>' },\n    ]`;
+        case 'vague-rule':
+            return `Rewrite the rationale as a single, falsifiable sentence ("X must Y because Z").`;
+        case 'advisory-not-marked':
+            return `Either set \`advisory: true\` on the rule, or remove it from the \`--advisory\` list passed to \`rules lint\`.`;
+        case 'advisory-has-unused-verification':
+            return `Advisory rules don't enforce — drop \`actionHints.verificationCommands\`, or unmark advisory if the verification really should run.`;
+        case 'verification-references-unknown-script':
+            return `Either declare this command in \`sharkcraft.config.ts > verificationCommands[]\`, or change the rule to reference an existing one.`;
+        default:
+            return null;
+    }
+}
+export const rulesDoctorCommand = {
+    name: 'doctor',
+    description: 'Rule quality doctor. Surfaces missing actionHints / verificationCommands / examples / owner, vague rules, advisory mismatch.',
+    usage: 'shrk rules doctor [--id <ruleId>] [--advisory <ruleId,...>] [--strict] [--json]',
+    async run(args) {
+        const cwd = resolveCwd(args);
+        const inspection = await inspectSharkcraft({ cwd });
+        const rules = inspection.ruleService.list();
+        const knownVerificationIds = new Set((inspection.config?.verificationCommands ?? []).map((c) => c.id));
+        const advisoryFlag = flagList(args, 'advisory');
+        const id = flagString(args, 'id');
+        const report = diagnoseRuleQuality(rules, {
+            ruleId: id ?? undefined,
+            advisoryRuleIds: advisoryFlag.length > 0 ? advisoryFlag : undefined,
+        }, { knownVerificationIds });
+        if (flagBool(args, 'json')) {
+            process.stdout.write(asJson(report) + '\n');
+        }
+        else {
+            process.stdout.write(renderRuleQualityText(report));
+        }
+        if (flagBool(args, 'strict')) {
+            return report.summary.errors + report.summary.warnings > 0 ? 1 : 0;
+        }
+        return report.summary.errors > 0 ? 1 : 0;
+    },
+};

package/dist/commands/runtime.command.d.ts

@@ -0,0 +1,3 @@
+import { type ICommandHandler } from '../command-registry.js';
+export declare const runtimeDoctorCommand: ICommandHandler;
+//# sourceMappingURL=runtime.command.d.ts.map

package/dist/commands/runtime.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.command.d.ts","sourceRoot":"","sources":["../../src/commands/runtime.command.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,eAAe,EAErB,MAAM,wBAAwB,CAAC;AAKhC,eAAO,MAAM,oBAAoB,EAAE,eAiDlC,CAAC"}

package/dist/commands/runtime.command.js

@@ -0,0 +1,56 @@
+import { existsSync, readFileSync } from 'node:fs';
+import * as nodePath from 'node:path';
+import { flagBool, resolveCwd, } from "../command-registry.js";
+import { asJson, header, kv } from "../output/format-output.js";
+const REPORT_FILE = '.sharkcraft/reports/compat-node-report.json';
+export const runtimeDoctorCommand = {
+    name: 'doctor',
+    description: 'Report runtime info + latest Node-compatibility audit. Read-only; no shell.',
+    usage: 'shrk runtime doctor [--json]',
+    run(args) {
+        const cwd = resolveCwd(args);
+        const reportPath = nodePath.join(cwd, REPORT_FILE);
+        const reportExists = existsSync(reportPath);
+        let report = null;
+        if (reportExists) {
+            try {
+                report = JSON.parse(readFileSync(reportPath, 'utf8'));
+            }
+            catch {
+                report = null;
+            }
+        }
+        // Avoid a direct `Bun.<x>` reference so the compat:node scanner stays
+        // green when this file ships to a pure-Node runtime; read via globalThis
+        // instead. The audit script flags `Bun.<id>` shaped tokens outside
+        // string literals.
+        const g = globalThis;
+        const runtime = {
+            bun: g.Bun?.version ?? null,
+            node: typeof process !== 'undefined' ? process.version : null,
+            platform: process.platform,
+            arch: process.arch,
+        };
+        if (flagBool(args, 'json')) {
+            process.stdout.write(asJson({ runtime, reportFile: reportExists ? reportPath : null, report }) + '\n');
+            return 0;
+        }
+        process.stdout.write(header('Runtime doctor'));
+        process.stdout.write(kv('bun', String(runtime['bun'] ?? '(node)')) + '\n');
+        process.stdout.write(kv('node', String(runtime['node'])) + '\n');
+        process.stdout.write(kv('platform', `${runtime['platform']}-${runtime['arch']}`) + '\n');
+        if (reportExists) {
+            const r = report;
+            process.stdout.write(kv('compat:node report', reportPath) + '\n');
+            if (r) {
+                process.stdout.write(kv('  passed', String(r.passed)) + '\n');
+                process.stdout.write(kv('  bun.* usages', String((r.bunUsage ?? []).length)) + '\n');
+                process.stdout.write(kv('  runtime probes', String((r.runtimeProbes ?? []).length)) + '\n');
+            }
+        }
+        else {
+            process.stdout.write('compat:node report: (none — run `bun run compat:node --runtime --build`)\n');
+        }
+        return 0;
+    },
+};

package/dist/commands/safety.command.d.ts

@@ -0,0 +1,3 @@
+import { type ICommandHandler } from '../command-registry.js';
+export declare const safetyCommand: ICommandHandler;
+//# sourceMappingURL=safety.command.d.ts.map

package/dist/commands/safety.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety.command.d.ts","sourceRoot":"","sources":["../../src/commands/safety.command.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,eAAe,EAErB,MAAM,wBAAwB,CAAC;AAMhC,eAAO,MAAM,aAAa,EAAE,eAmE3B,CAAC"}

package/dist/commands/safety.command.js

@@ -0,0 +1,117 @@
+import { buildSafetyAudit, buildSafetyAuditDeep, inspectSharkcraft, } from '@shrkcrft/inspector';
+import { flagBool, resolveCwd, } from "../command-registry.js";
+import { asJson, header, kv } from "../output/format-output.js";
+import { COMMAND_CATALOG } from "./command-catalog.js";
+const PLAN_SECRET_ENV = 'SHARKCRAFT_PLAN_SECRET';
+export const safetyCommand = {
+    name: 'safety',
+    description: 'Audit the SharkCraft safety model: which commands write source, which run shell, MCP read-only invariant, pack signature status, plan-signing status. Read-only.',
+    usage: 'shrk safety audit [--json]',
+    async run(args) {
+        const sub = args.positional[0];
+        if (sub !== 'audit') {
+            process.stderr.write('Usage: shrk safety audit [--json]\n');
+            return 2;
+        }
+        const cwd = resolveCwd(args);
+        const inspection = await inspectSharkcraft({ cwd });
+        // Lazy-load the MCP tool list to avoid a static import dependency.
+        const mcpToolList = await listMcpTools();
+        const report = buildSafetyAudit({
+            inspection,
+            catalog: COMMAND_CATALOG,
+            mcpTools: mcpToolList,
+            planSecretEnv: PLAN_SECRET_ENV,
+            planSecretConfigured: typeof process.env[PLAN_SECRET_ENV] === 'string',
+        });
+        let deep = null;
+        if (flagBool(args, 'deep')) {
+            deep = await buildSafetyAuditDeep(inspection);
+        }
+        if (flagBool(args, 'json')) {
+            const merged = deep ? { ...report, deep } : report;
+            process.stdout.write(asJson(merged) + '\n');
+            const failed = report.mcp.anyWritable || (deep ? !deep.passed : false);
+            return failed ? 1 : 0;
+        }
+        printSafetyAudit(report);
+        if (deep) {
+            process.stdout.write('\n=== Deep audit ===\n');
+            process.stdout.write(`  passed: ${deep.passed ? 'yes' : 'no'}\n`);
+            process.stdout.write(`  info-only findings: ${deep.infoOnlyFindings}\n`);
+            process.stdout.write(`  report-site external JS: ${deep.reportSiteExternalJs.length}\n`);
+            process.stdout.write(`  demo destructive lines: ${deep.demoDestructiveLines.length}\n`);
+            process.stdout.write(`  CI workflows scanned: ${deep.ciGeneratedWorkflowPermissions.length}\n`);
+            // Dev-signed packs surface as a top-level deep-audit line so it
+            // doesn't get lost in the per-check list.
+            if (deep.devSignedPacks && deep.devSignedPacks.length > 0) {
+                process.stdout.write(`  dev-signed packs: ${deep.devSignedPacks.length}\n`);
+                for (const p of deep.devSignedPacks) {
+                    process.stdout.write(`    • ${p.packageName}@${p.packageVersion}${p.signedAt ? ` (signed-at ${p.signedAt})` : ''}\n`);
+                }
+                // Dev-signed pack findings are info-level by design. The
+                // deep-audit verdict ignores them; release readiness is enforced
+                // elsewhere. Spell that out so `passed: yes` next to a non-empty
+                // dev-signed list stops reading contradictory.
+                process.stdout.write('\n  Dev-signed packs are info-level findings — the deep-audit verdict ignores them.\n' +
+                    '  Release readiness is gated by `shrk packs signature-status --release-readiness`.\n');
+            }
+            if (deep.checks.length > 0) {
+                process.stdout.write('  checks:\n');
+                for (const c of deep.checks)
+                    process.stdout.write(`    [${c.severity}] ${c.id} — ${c.message}\n`);
+            }
+        }
+        const failed = report.mcp.anyWritable || (deep ? !deep.passed : false);
+        return failed ? 1 : 0;
+    },
+};
+async function listMcpTools() {
+    try {
+        const mod = (await import('@shrkcrft/mcp-server'));
+        return [...(mod.ALL_TOOLS ?? [])].map((t) => ({ name: t.name, description: t.description }));
+    }
+    catch {
+        return [];
+    }
+}
+function printSafetyAudit(r) {
+    process.stdout.write(header('SharkCraft safety audit'));
+    process.stdout.write(kv('MCP tools', String(r.mcp.tools.length)) + '\n');
+    process.stdout.write(kv('MCP writable', r.mcp.anyWritable ? 'YES — INVARIANT VIOLATED' : 'no (read-only ✓)') + '\n');
+    process.stdout.write(kv('packs', String(r.packs.discovered)) + '\n');
+    process.stdout.write(kv('pack signatures', `verified=${r.packs.signedAndVerified} not-checked=${r.packs.signedNotVerified} unsigned=${r.packs.unsigned} invalid=${r.packs.invalid}`) + '\n');
+    process.stdout.write(kv('plan signing', r.planSigning.secretConfigured
+        ? `${r.planSigning.secretEnv} configured`
+        : `${r.planSigning.secretEnv} not set`) + '\n');
+    process.stdout.write('\nCommand safety by level:\n');
+    process.stdout.write(`  read-only:       ${r.commands.readOnly.length}\n`);
+    process.stdout.write(`  writes-session:  ${r.commands.writesSession.length}\n`);
+    process.stdout.write(`  writes-drafts:   ${r.commands.writesDrafts.length}\n`);
+    process.stdout.write(`  writes-source:   ${r.commands.writesSource.length}\n`);
+    process.stdout.write(`  runs-shell:      ${r.commands.runsShell.length}\n`);
+    if (r.commands.writesSource.length > 0) {
+        process.stdout.write('\nCommands that write source (require human approval):\n');
+        for (const c of r.commands.writesSource) {
+            process.stdout.write(`  • ${c.command.padEnd(34)} ${c.description}\n`);
+        }
+    }
+    if (r.verifications.untrusted.length > 0) {
+        process.stdout.write('\nLocal verification commands NOT marked trusted:\n');
+        for (const v of r.verifications.untrusted) {
+            process.stdout.write(`  • ${v.id.padEnd(20)} ${v.command}\n`);
+        }
+    }
+    if (r.verifications.pack.length > 0) {
+        process.stdout.write('\nPack-contributed verification commands (NOT auto-run):\n');
+        for (const v of r.verifications.pack) {
+            process.stdout.write(`  • ${v.id.padEnd(20)} (${v.packPackageName ?? '?'})\n`);
+        }
+    }
+    if (r.recommendations.length > 0) {
+        process.stdout.write('\nRecommendations:\n');
+        for (const rec of r.recommendations)
+            process.stdout.write(`  • ${rec}\n`);
+    }
+    process.stdout.write(`\nVerdict: ${r.mcp.anyWritable ? 'MCP INVARIANT VIOLATED' : 'safety model intact ✓'}\n`);
+}

package/dist/commands/scaffolds.command.d.ts

@@ -0,0 +1,5 @@
+import { type ICommandHandler } from '../command-registry.js';
+export declare const scaffoldsListCommand: ICommandHandler;
+export declare const scaffoldsGetCommand: ICommandHandler;
+export declare const scaffoldsDoctorCommand: ICommandHandler;
+//# sourceMappingURL=scaffolds.command.d.ts.map

package/dist/commands/scaffolds.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffolds.command.d.ts","sourceRoot":"","sources":["../../src/commands/scaffolds.command.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,eAAe,EAErB,MAAM,wBAAwB,CAAC;AAGhC,eAAO,MAAM,oBAAoB,EAAE,eA0ClC,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,eAmCjC,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,eAwCpC,CAAC"}