@swarmcraftai/cli 0.2.0 → 0.4.0

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to the SwarmCraft CLI are documented in this file.
 
+## 0.4.0
+
+- Seeds a collaborative plan-first workflow that turns approved phases into SwarmCraft tasks while keeping planning and implementation as explicit, reviewable steps.
+- Adds risk-based security, technical-and-human change management, and high-level testing-posture report contracts to generated SwarmCraft guidance.
+- Guides Deep Discovery users into the expanded report workflow and carries the new report lifecycle through generated repository files.
+- Hardens run and support artifacts with contained workspace paths, atomic resume manifests, shell-free process execution, and recursive secret redaction.
+- Refactors command parsing, workflow execution, and one-shot board synchronization into focused modules without changing the documented command surface.
+
+## 0.3.0
+
+- Completes the clean cutover to tasks across API requests, local run manifests, packet metadata, and sync behavior.
+- Adds task-oriented one-shot options including `--task` and `--task-limit`, and records `taskId` throughout generated run artifacts.
+- Uses the production `/tasks` API and task-board payloads; upgrade the API, CLI, and extension together and regenerate existing packets because legacy compatibility aliases are not retained.
+- Seeds collaborative prototype files and review guidance into Deep Discovery workspaces.
+- Makes Deep Discovery recommendation-led and prototype-first, with explicit handling for owner corrections and known evidence gaps.
+
 ## 0.2.0
 
 - Adds `discovery prepare`, `discovery validate`, and `discovery support-bundle` for the Deep Discovery workflow.

package/README.md

@@ -2,9 +2,9 @@
 
 SwarmCraft CLI prepares a local repository for a SwarmCraft project board and runs packet-based agent workflows from the terminal.
 
-Use it to authenticate with SwarmCraft, list available projects, seed workspace guidance files, materialize ticket packets, run one-shot implementation passes, resume or inspect runs, and create support bundles.
+Use it to authenticate with SwarmCraft, list available projects, seed workspace guidance files, materialize task packets, run one-shot implementation passes, resume or inspect runs, and create support bundles.
 
-Deep Discovery uses the provider-neutral `@swarmcraft/discovery-package-contract` for exact-text packaging, canonical hashing, and local validation. The CLI never asks an AI provider to generate transport JSON or tickets and never contains SwarmCraft's private seven-slice compiler.
+Deep Discovery uses the provider-neutral `@swarmcraft/discovery-package-contract` for exact-text packaging, canonical hashing, and local validation. The CLI never asks an AI provider to generate transport JSON or tasks and never contains SwarmCraft's private seven-slice compiler.
 
 ## Package Shape
 
@@ -15,6 +15,19 @@ Deep Discovery uses the provider-neutral `@swarmcraft/discovery-package-contract
 - Public package contents: bundled CLI runtime, README, package metadata, and license
 - Shared workspace packages are bundled into the CLI artifact; customers do not install `@swarmcraft/packet-workflow` or `@swarmcraft/repo-seed` directly.
 
+## Implemented Module Ownership
+
+- `src/main.ts` is the executable composition root: it dispatches parsed commands, prompts where compatibility requires it, prints outcomes, and selects exit behavior.
+- `src/commands/command-catalog.ts` owns stable command names, usage text, and help lookup; `src/commands/arguments.ts` owns syntax-only argument parsing and repeated option access.
+- `src/apiClient.ts` maps API transport contracts; `src/sessionStore.ts` is the only owner of the owner-only local credential file.
+- `src/workspace.ts` owns workspace validation and contained file/git operations. `src/runtime/workspace-paths.ts` rejects absolute, traversal, escaped run, manifest, log, and support-artifact targets.
+- `src/runtime/process.ts` provides shell-free argument-array execution. Only `runTrustedShellAgentCommand` may invoke a shell for a deliberately supplied custom-agent template; API content and credentials must never be interpolated into it.
+- `src/bootstrap.ts`, `src/discovery.ts`, and `src/oneShot.ts` compose the seed, immutable discovery-package, and packet execution workflows.
+- `src/workflows/agent-execution.ts` owns approved credential injection, trusted template quoting, and optional cost capture. `src/artifacts/run-manifest.ts` owns contained paths and atomic resume-manifest persistence.
+- `src/supportBundle.ts` exposes only allow-listed delegation facts and recursively redacts secret-bearing keys.
+
+All customer run artifacts remain below `.swarmcraft/runs/<run-id>`. Workspace-relative reads, writes, removals, packet paths, discovery sources, logs, manifests, diagnostics, and support bundles are resolved through the containment boundary before access.
+
 ## Distribution
 
 The first public distribution channel is npm:
@@ -53,6 +66,8 @@ pnpm check
 pnpm release:smoke
 ```
 
+`pnpm check` is the package ready-for-review gate and includes lint, type checking, unit tests, a production bundle, and the bundled help smoke. Before release, also run `pnpm release:smoke`; the root `pnpm standards:cli` alias runs both.
+
 ## Current Commands
 
 Core commands:
@@ -72,7 +87,9 @@ swarmcraft status --run <run-id> --workspace <path> --delegation <delegation-id>
 swarmcraft delegation end --delegation <delegation-id>
 ```
 
-`swarmcraft init` validates the workspace git state, seeds the shared SwarmCraft repo guidance files, materializes non-done ticket packets, links those packets back to SwarmCraft, and prints the next commands.
+`swarmcraft init` validates the workspace git state, seeds the shared SwarmCraft repo guidance files, materializes non-done task packets, links those packets back to SwarmCraft, and prints the next commands.
+
+The task contract is a clean cutover from the earlier project-ticket format. Upgrade the API, CLI, and VS Code extension together; old `ticketId` packet files and `--ticket` flags are not accepted. Preserve any owner-authored notes, remove the retired generated packet files, and run `swarmcraft init` again to materialize current `taskId` packets from the board.
 
 `swarmcraft discovery prepare` is projectless and deterministic. It requires the versioned discovery binding, `.swarmcraft/discovery.sources.json`, current selected-source digests, and all nine curated documents to be reviewed or explicitly not applicable. Repeated `--source` arguments must exactly match the aggregate owner-confirmed text projection when supplied by the extension. Empty, draft, unresolved, stale-sidecar, binary, secret-bearing, oversized, or mismatched preparation is blocked before upload.
 
@@ -84,7 +101,7 @@ Run diagnostics contain only schema version, phase, error class, timestamps, cou
 
 `swarmcraft discovery validate` reruns deterministic package and local-staleness checks without launching a provider. Untracked and ignored owner-selected text is preserved and allowed but remains the owner's backup responsibility. A failed run never truncates, summarizes, or silently drops content: correct the reported review/source issue and prepare again.
 
-`swarmcraft one-shot` bootstraps the workspace, runs the doing lane through the selected agent provider, syncs packet updates back to SwarmCraft, writes `.swarmcraft/runs/<run-id>/manifest.json`, streams progress to the terminal, writes agent logs under `.swarmcraft/runs/<run-id>/logs/`, and moves accepted work to `done` by default. Customer one-shots should normally pair this with `--commit-policy done` so each completed ticket creates a local commit. Use `--checking on` or `--reviewing on` only for internal validation runs that deliberately need those extra lanes.
+`swarmcraft one-shot` bootstraps the workspace, runs the doing lane through the selected agent provider, syncs packet updates back to SwarmCraft, writes `.swarmcraft/runs/<run-id>/manifest.json`, streams progress to the terminal, writes agent logs under `.swarmcraft/runs/<run-id>/logs/`, and moves accepted work to `done` by default. Customer one-shots should normally pair this with `--commit-policy done` so each completed task creates a local commit. Use `--checking on` or `--reviewing on` only for internal validation runs that deliberately need those extra lanes.
 
 Useful safety and support commands: