@vibe-agent-toolkit/cli 0.1.41-rc.7 → 0.1.41

package/dist/commands/phase-utils.js

@@ -3,9 +3,58 @@
  */
 import { spawnSync } from 'node:child_process';
 import { safePath } from '@vibe-agent-toolkit/utils';
+import { Option } from 'commander';
+import * as YAML from 'yaml';
 import { createLogger } from '../utils/logger.js';
+import { writeYamlOutput } from '../utils/output.js';
+/**
+ * Declare `--only` on a command that has RETIRED it, solely so the command can
+ * explain itself instead of emitting Commander's bare `error: unknown option
+ * '--only'`.
+ *
+ * This is **not** a backward-compatibility shim — the pre-1.0 policy forbids
+ * those and this obeys it. The flag does not work: {@link rejectRetiredOnly}
+ * fails the run before any phase is selected, so no caller can keep depending
+ * on the old behaviour. What it buys is a diagnosis. An unknown-option error
+ * names the flag and nothing else; the reader cannot tell a typo from a removal
+ * and has no way to learn what replaced it, so the next move is a bug report or
+ * a version pin. Naming the removal, the measurement behind it, and the command
+ * where `--only` still exists turns a dead end into a one-line fix.
+ *
+ * Hidden from `--help` on purpose: a retired flag is not a feature to discover,
+ * and listing it would suggest it still selects something.
+ */
+export function addRetiredOnlyOption(command) {
+    return command.addOption(new Option('--only <phase>', 'Retired — a run is now a whole run.').hideHelp());
+}
+/**
+ * Fail the run when a caller passed the retired `--only`, naming what changed.
+ *
+ * Exit 1, matching both Commander's usage-error convention and the exit code an
+ * unroutable `--only` already produced on these commands, so a CI gate that was
+ * failing on a bad `--only` keeps failing rather than flipping to green.
+ *
+ * @param only - The parsed `--only` value; `undefined` when it was not passed.
+ * @param command - Command name for the message, e.g. `vat validate`.
+ * @param seconds - The measured full-run duration that made the flag not worth
+ *   its coverage risk. Cited so the removal reads as a decision with evidence
+ *   rather than a preference.
+ */
+export function rejectRetiredOnly(only, command, seconds) {
+    if (only === undefined)
+        return;
+    process.stderr.write(`error: '--only' was removed from '${command}'.\n` +
+        `\n` +
+        `  A full run measures ~${seconds}s on a 90-skill project, so the flag saved\n` +
+        `  little while letting a CI gate silently lose coverage: renaming a config\n` +
+        `  key left '--only <that key>' selecting nothing, and the gate stayed green.\n` +
+        `\n` +
+        `  Fix: drop the flag — '${command}' runs every configured surface.\n` +
+        `  Still selective: 'vat build --only <phase>', where a phase is minutes, not seconds.\n`);
+    process.exit(1);
+}
 /** The phase outcome for "we did not learn what this phase would have said". */
-const SYSTEM_ERROR = 'system-error';
+export const SYSTEM_ERROR = 'system-error';
 /**
  * Resolve the absolute path to the vat binary.
  * This file lives in commands/, one level above bin/.
@@ -17,26 +66,168 @@ export function resolveBinPath() {
     return safePath.resolve(safePath.join(import.meta.dirname, '../bin.js'));
 }
 /**
- * Create the shared phase command context: logger, startTime, and validated bin path.
- * Throws if the phases list is empty (indicating an unknown --only value).
- *
- * @param debugFlag - Whether debug logging is enabled
- * @param phases - Pre-built list of phases to validate
- * @param onlyValue - The --only flag value (for the error message)
- * @param validPhaseNames - Human-readable list of valid phase names (for error message)
- * @returns Initialized phase context
- * @throws Error if phases list is empty
+ * Create the shared phase command context: logger, startTime, and bin path.
+ *
+ * It used to THROW when the phase list came out empty — and it was called
+ * before the command's try block, so an unroutable `--only` reached the user as
+ * a raw Node stack trace with zero bytes of stdout and an exit 1 that looked
+ * like "validation errors". `--only` routing is decided by
+ * {@link decidePhaseSelection} and reported by {@link applyPhaseSelection} now,
+ * which emit the command's normal structured document.
  */
-export function createPhaseContext(debugFlag, phases, onlyValue, validPhaseNames) {
-    if (phases.length === 0) {
-        throw new Error(`Unknown phase: ${onlyValue ?? ''}. Valid phases: ${validPhaseNames}`);
-    }
+export function createPhaseContext(debugFlag) {
     return {
         logger: createLogger(debugFlag ? { debug: true } : {}),
         startTime: Date.now(),
         binPath: resolveBinPath(),
     };
 }
+/**
+ * Decide what an orchestrator should do with its `--only` value and the phase
+ * list its config produced.
+ *
+ * Shared by all three orchestrators because they used to disagree: `vat verify`
+ * built its phase list without consulting the config at all, so `vat verify
+ * --only skills` in a project with no `skills:` block exited 0 while `vat
+ * validate --only skills` on the same project exited 1 — opposite verdicts on
+ * the same question. (`vat verify` has since retired `--only` entirely and now
+ * always passes `only: undefined`; `vat validate` and `vat build` still route
+ * their own `--only` through here.)
+ *
+ * There used to be a third option, `emptyIsValid`, which existed solely so
+ * `vat verify --only consistency` could run with an empty SUBPROCESS list
+ * (consistency runs in-process). It was checked BEFORE `unreadableConfig`, so
+ * `vat verify --only consistency` against an unparseable config answered the
+ * confidently-wrong "no skills: block" instead of reporting the config error.
+ * `--only` is gone from verify, `emptyIsValid` went with it, and that ordering
+ * hazard cannot recur: nothing short-circuits ahead of the config-error arm.
+ *
+ * @param unreadableConfig - The config-load error, when the config exists but
+ *   could not be parsed. A broken config is NOT "the phase is unconfigured":
+ *   we do not know what it declares, so we must not answer with a confident
+ *   "not configured". Only `vat verify` passes it, and only defensively — its
+ *   phase builder pushes every subprocess phase when the config is unreadable
+ *   (so the CHILD reports the real error), which makes the list non-empty and
+ *   this arm unreachable by construction today. It is kept because the arm that
+ *   would otherwise catch an empty list is the "not configured" lie.
+ */
+export function decidePhaseSelection(only, phases, vocab, options = {}) {
+    const lower = vocab.noun.toLowerCase();
+    if (only !== undefined && !vocab.validNames.includes(only)) {
+        return {
+            kind: 'fail',
+            message: `Unknown ${lower}: ${only}. Valid ${lower}s: ${vocab.validNames.join(', ')}`,
+        };
+    }
+    if (phases.length > 0) {
+        return { kind: 'run', phases };
+    }
+    if (options.unreadableConfig !== undefined) {
+        return { kind: 'fail', message: options.unreadableConfig };
+    }
+    if (only !== undefined) {
+        return {
+            kind: 'fail',
+            message: `${vocab.noun} '${only}' is not configured in vibe-agent-toolkit.config.yaml — nothing to ${vocab.verb}.`,
+        };
+    }
+    return vocab.noop === undefined
+        ? { kind: 'fail', message: `No ${lower} to ${vocab.verb}.` }
+        : { kind: 'noop', ...vocab.noop };
+}
+/**
+ * Act on a {@link PhaseSelection}: return the phases to run, or emit the
+ * command's normal structured document and exit.
+ *
+ * Both terminal arms go through `writeYamlOutput` deliberately. A `--only`
+ * failure used to be an uncaught throw, so the one output a scripted caller
+ * parses — the YAML document on stdout — was never written at all.
+ */
+export function applyPhaseSelection(selection, logger, startTime) {
+    if (selection.kind === 'run') {
+        return selection.phases;
+    }
+    if (selection.kind === 'fail') {
+        logger.error(selection.message);
+        writeYamlOutput({
+            status: 'error',
+            phases: [],
+            error: selection.message,
+            duration: `${Date.now() - startTime}ms`,
+        });
+        return process.exit(1);
+    }
+    logger.warn(selection.warning);
+    writeYamlOutput({
+        status: 'success',
+        phases: [],
+        note: selection.note,
+        duration: `${Date.now() - startTime}ms`,
+    });
+    return process.exit(0);
+}
+/** Rank used by {@link worseOf}: later wins. */
+const PHASE_STATUS_ORDER = ['success', 'warning', 'error', 'system-error'];
+/** The worse of two phase statuses, per {@link PHASE_STATUS_ORDER}. */
+export function worseOf(a, b) {
+    return PHASE_STATUS_ORDER.indexOf(b) > PHASE_STATUS_ORDER.indexOf(a) ? b : a;
+}
+/** Every value a child may legitimately report as its own `status`. */
+const REPORTABLE_STATUSES = new Set(PHASE_STATUS_ORDER);
+/**
+ * Parse the child's captured stdout into its reported document.
+ *
+ * Takes the LAST non-empty document in the stream: every orchestrated child
+ * writes its summary last, and a child that happens to emit more than one
+ * document must not make the summary unreadable.
+ *
+ * Empty stdout is NOT a failure — `vat skills validate` legitimately exits 0
+ * printing nothing when there is no `skills:` block. Stdout that exists but
+ * cannot be parsed IS a failure: the child crashed mid-answer, and the phase
+ * must degrade to `system-error` rather than throw an unhandled exception out
+ * of the orchestrator.
+ */
+function parseChildReport(name, stdout) {
+    if (stdout === undefined || stdout === null || stdout.trim() === '') {
+        return {};
+    }
+    let documents;
+    try {
+        documents = YAML.parseAllDocuments(stdout);
+    }
+    catch (error) {
+        return { parseError: unparseableMessage(name, error) };
+    }
+    const last = documents.findLast((doc) => doc.contents !== null);
+    if (last === undefined) {
+        return {};
+    }
+    if (last.errors.length > 0) {
+        return { parseError: unparseableMessage(name, last.errors[0]) };
+    }
+    return { report: last.toJS() };
+}
+function unparseableMessage(name, cause) {
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    return `Phase '${name}' wrote unparseable output on stdout: ${detail}`;
+}
+/** The status an exit code alone implies, before the child's report is read. */
+function statusFromExitCode(status) {
+    if (status === 0)
+        return 'success';
+    if (status === 1)
+        return 'error';
+    return SYSTEM_ERROR;
+}
+/** The status the child claimed for itself, when it claimed a recognized one. */
+function statusFromReport(report) {
+    if (typeof report !== 'object' || report === null)
+        return undefined;
+    const claimed = report.status;
+    return typeof claimed === 'string' && REPORTABLE_STATUSES.has(claimed)
+        ? claimed
+        : undefined;
+}
 /**
  * Map a spawn outcome to a phase outcome. The pure core of {@link runPhase}.
  *
@@ -48,9 +239,16 @@ export function createPhaseContext(debugFlag, phases, onlyValue, validPhaseNames
  * | `error` set              | `system-error` | the child never ran                        |
  * | killed by a signal       | `system-error` | the child was cut off mid-answer           |
  * | no exit code, no signal  | `system-error` | there is no answer to read                 |
+ * | stdout not parseable     | `system-error` | the child's answer cannot be read          |
  * | exit 0                   | `success`      | ran, found nothing actionable              |
  * | exit 1                   | `error`        | ran, found validation errors               |
  * | exit 2 (or any other)    | `system-error` | the child itself reported a system error    |
+ *
+ * The exit code is then reconciled with the child's OWN reported `status`,
+ * worst-wins. An exit code has three values and cannot express `warning`, so
+ * `vat skills validate` — which exits 0 while reporting `status: warning` —
+ * was being recorded as `success` by every orchestrator, including the one
+ * VAT's CI dogfoods on VAT itself.
  */
 export function phaseResultFromSpawn(name, outcome) {
     if (outcome.error !== undefined) {
@@ -67,30 +265,53 @@ export function phaseResultFromSpawn(name, outcome) {
     if (outcome.status === null) {
         return { name, status: SYSTEM_ERROR, error: `Phase '${name}' exited without a status code` };
     }
-    if (outcome.status === 0) {
-        return { name, status: 'success', exitCode: 0 };
-    }
-    if (outcome.status === 1) {
-        return { name, status: 'error', exitCode: 1 };
+    const exitCode = outcome.status;
+    const { report, parseError } = parseChildReport(name, outcome.stdout);
+    if (parseError !== undefined) {
+        return { name, status: SYSTEM_ERROR, exitCode, error: parseError };
     }
+    const exitStatus = statusFromExitCode(exitCode);
+    const reported = statusFromReport(report);
+    const status = reported === undefined ? exitStatus : worseOf(exitStatus, reported);
     return {
         name,
-        status: SYSTEM_ERROR,
-        exitCode: outcome.status,
-        error: `Phase '${name}' exited with system-error code ${outcome.status}`,
+        status,
+        exitCode,
+        ...(exitStatus === SYSTEM_ERROR
+            ? { error: `Phase '${name}' exited with system-error code ${exitCode}` }
+            : {}),
+        ...(report === undefined ? {} : { report }),
     };
 }
+/**
+ * Cap on a captured child document, well above the ~2.3 MB a large real project
+ * produces. spawnSync's 1 MB default would set ENOBUFS and hand back a
+ * TRUNCATED (and therefore unparseable) document; exceeding this cap surfaces
+ * as a loud `system-error`, never as a silently shortened report.
+ */
+const MAX_PHASE_STDOUT_BYTES = 256 * 1024 * 1024;
 /**
  * Run a single phase by spawning the vat binary with the phase args.
+ *
+ * stdout is CAPTURED, not inherited: the child's YAML document belongs in this
+ * phase's `report`, and letting it stream onto the parent's stdout is what made
+ * `vat validate`'s output a run of documents with no `---` between them.
+ * stderr stays inherited — progress output is on stderr by design and must keep
+ * streaming live rather than arriving in one lump at the end.
  */
 export function runPhase(binPath, phase) {
     const result = spawnSync(process.execPath, [binPath, ...phase.args], {
-        stdio: ['inherit', 'inherit', 'inherit'],
+        stdio: ['inherit', 'pipe', 'inherit'],
+        encoding: 'utf8',
+        maxBuffer: MAX_PHASE_STDOUT_BYTES,
+    });
+    return phaseResultFromSpawn(phase.name, {
+        status: result.status,
+        signal: result.signal,
+        error: result.error,
+        stdout: result.stdout,
     });
-    return phaseResultFromSpawn(phase.name, result);
 }
-/** Rank used by {@link aggregatePhaseStatus}: later wins. */
-const PHASE_STATUS_ORDER = ['success', 'warning', 'error', 'system-error'];
 /**
  * Worst-wins aggregate across phases. `system-error` outranks `error`: "we could
  * not determine the answer" must never be filed under "we determined it is bad".
@@ -98,12 +319,56 @@ const PHASE_STATUS_ORDER = ['success', 'warning', 'error', 'system-error'];
 export function aggregatePhaseStatus(results) {
     let worst = 'success';
     for (const { status } of results) {
-        if (PHASE_STATUS_ORDER.indexOf(status) > PHASE_STATUS_ORDER.indexOf(worst)) {
-            worst = status;
-        }
+        worst = worseOf(worst, status);
     }
     return worst;
 }
+/**
+ * One phase's per-severity distribution, wherever that phase keeps it.
+ *
+ * An in-process phase holds its own findings and publishes {@link
+ * PhaseResult.issueCounts}. A subprocess phase deliberately does not — the child
+ * owns its findings, and its document rides verbatim in {@link
+ * PhaseResult.report}. Reading only the former is why an orchestrator's header
+ * could report `{0, 0, 0}` over children that had just reported 12 warnings.
+ *
+ * Absent or malformed counts read as zero rather than throwing: a phase that
+ * published no distribution contributes nothing to the total, which is the same
+ * answer as before this function existed — just no longer the answer for phases
+ * that DID publish one.
+ */
+export function phaseIssueCounts(result) {
+    if (result.issueCounts)
+        return result.issueCounts;
+    const counts = result.report?.issueCounts;
+    if (typeof counts !== 'object' || counts === null)
+        return { errors: 0, warnings: 0, info: 0 };
+    const { errors, warnings, info } = counts;
+    return {
+        errors: typeof errors === 'number' ? errors : 0,
+        warnings: typeof warnings === 'number' ? warnings : 0,
+        info: typeof info === 'number' ? info : 0,
+    };
+}
+/**
+ * Sum every phase's distribution, so an orchestrator's header total reconciles
+ * against the phases printed beneath it.
+ *
+ * The companion to {@link aggregatePhaseStatus}: status has always been
+ * worst-wins ACROSS phases, and a header whose `status` can see the children
+ * while its `issueCounts` cannot is the same contradiction in one document —
+ * `status: warning` beside `warnings: 0`.
+ */
+export function aggregatePhaseIssueCounts(results) {
+    const total = { errors: 0, warnings: 0, info: 0 };
+    for (const result of results) {
+        const { errors, warnings, info } = phaseIssueCounts(result);
+        total.errors += errors;
+        total.warnings += warnings;
+        total.info += info;
+    }
+    return total;
+}
 /**
  * The process exit code for a set of phase outcomes, per the exit-code contract
  * every orchestrator's help text documents: 0 pass, 1 validation failure,

package/dist/commands/phase-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"phase-utils.js","sourceRoot":"","sources":["../../src/commands/phase-utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAqBlD,gFAAgF;AAChF,MAAM,YAAY,GAAgB,cAAc,CAAC;AA0BjD;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,4EAA4E;IAC5E,wEAAwE;IACxE,+EAA+E;IAC/E,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAC3E,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAA8B,EAC9B,MAAe,EACf,SAA6B,EAC7B,eAAuB;IAEvB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,IAAI,EAAE,mBAAmB,eAAe,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO;QACL,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,OAAO,EAAE,cAAc,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,OAA0B;IAC3E,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,0BAA0B,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,UAAU,IAAI,0BAA0B,OAAO,CAAC,MAAM,EAAE;SAChE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,IAAI,gCAAgC,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAChD,CAAC;IACD,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,OAAO,CAAC,MAAM;QACxB,KAAK,EAAE,UAAU,IAAI,mCAAmC,OAAO,CAAC,MAAM,EAAE;KACzE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,KAAY;IACpD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE;QACnE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;KACzC,CAAC,CAAC;IACH,OAAO,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,6DAA6D;AAC7D,MAAM,kBAAkB,GAA2B,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AAEnG;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA+B;IAClE,IAAI,KAAK,GAAgB,SAAS,CAAC;IACnC,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACjC,IAAI,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3E,KAAK,GAAG,MAAM,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA+B;IAC/D,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,KAAK,KAAK,YAAY;QAAE,OAAO,CAAC,CAAC;IACrC,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"phase-utils.js","sourceRoot":"","sources":["../../src/commands/phase-utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAgB,MAAM,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAOrD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO,OAAO,CAAC,SAAS,CACtB,IAAI,MAAM,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAC,QAAQ,EAAE,CAC/E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwB,EAAE,OAAe,EAAE,OAAe;IAC1F,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAE/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qCAAqC,OAAO,MAAM;QAChD,IAAI;QACJ,0BAA0B,OAAO,8CAA8C;QAC/E,8EAA8E;QAC9E,gFAAgF;QAChF,IAAI;QACJ,2BAA2B,OAAO,oCAAoC;QACtE,yFAAyF,CAC5F,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAmBD,gFAAgF;AAChF,MAAM,CAAC,MAAM,YAAY,GAAgB,cAAc,CAAC;AAwCxD;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,4EAA4E;IAC5E,wEAAwE;IACxE,+EAA+E;IAC/E,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAC3E,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAA8B;IAC/D,OAAO;QACL,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,OAAO,EAAE,cAAc,EAAE;KAC1B,CAAC;AACJ,CAAC;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAwB,EACxB,MAAe,EACf,KAAsB,EACtB,UAAqD,EAAE;IAEvD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAEvC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,WAAW,KAAK,KAAK,IAAI,WAAW,KAAK,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACtF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IAED,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAC7D,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,sEAAsE,KAAK,CAAC,IAAI,GAAG;SACnH,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS;QAC7B,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,KAAK,CAAC,IAAI,GAAG,EAAE;QAC5D,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAyB,EACzB,MAAuC,EACvC,SAAiB;IAEjB,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,MAAM,CAAC;IAC1B,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAChC,eAAe,CAAC;YACd,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,SAAS,CAAC,OAAO;YACxB,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI;SACxC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,eAAe,CAAC;QACd,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI;KACxC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,gDAAgD;AAChD,MAAM,kBAAkB,GAA2B,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AAEnG,uEAAuE;AACvE,MAAM,UAAU,OAAO,CAAC,CAAc,EAAE,CAAc;IACpD,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,uEAAuE;AACvE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;AAQhE;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAiC;IACvE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,UAAU,EAAE,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;IAChE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,UAAU,EAAE,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAc;IACtD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,UAAU,IAAI,yCAAyC,MAAM,EAAE,CAAC;AACzE,CAAC;AAED,gFAAgF;AAChF,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACjC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,MAAe;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,OAAO,GAAI,MAA+B,CAAC,MAAM,CAAC;IACxD,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;QACpE,CAAC,CAAE,OAAuB;QAC1B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,OAA0B;IAC3E,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,0BAA0B,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,UAAU,IAAI,0BAA0B,OAAO,CAAC,MAAM,EAAE;SAChE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,IAAI,gCAAgC,EAAE,CAAC;IAC/F,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEnF,OAAO;QACL,IAAI;QACJ,MAAM;QACN,QAAQ;QACR,GAAG,CAAC,UAAU,KAAK,YAAY;YAC7B,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,IAAI,mCAAmC,QAAQ,EAAE,EAAE;YACxE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,KAAY;IACpD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE;QACnE,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC;QACrC,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,sBAAsB;KAClC,CAAC,CAAC;IACH,OAAO,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE;QACtC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA+B;IAClE,IAAI,KAAK,GAAgB,SAAS,CAAC;IACnC,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACjC,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAmB;IAClD,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC;IAClD,MAAM,MAAM,GAAI,MAAM,CAAC,MAAgD,EAAE,WAAW,CAAC;IACrF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC9F,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAiC,CAAC;IACrE,OAAO;QACL,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/C,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA+B;IACvE,MAAM,KAAK,GAAmB,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAClE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC5D,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC;QACvB,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAC3B,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA+B;IAC/D,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,KAAK,KAAK,YAAY;QAAE,OAAO,CAAC,CAAC;IACrC,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC"}

package/dist/commands/positional-args.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Rejection of positional arguments on commands that take none.
+ *
+ * Shared by the config-driven top-level orchestrators (`vat verify`,
+ * `vat validate`), which operate on the whole project as the config describes
+ * it and have no path-shaped subject at all.
+ */
+/**
+ * Fail the run when a caller passed a positional argument to a command that
+ * takes none, naming the argument and where to take it instead.
+ *
+ * **Why this is not `.allowExcessArguments(false)`.** That is the Commander
+ * mechanism for the same rejection and it would work, but its message is
+ * `error: too many arguments for 'verify'. Expected 0 arguments but got 1.` —
+ * which tells the reader the argument was wrong without telling them what the
+ * command DOES operate on or where a path is accepted, so the next move is a
+ * guess. The whole point of this fix is diagnosability, so the message is
+ * written by hand and this rejection runs first in the action instead.
+ *
+ * **Why exit 2, not Commander's usage-error 1.** On both of these commands exit
+ * 1 is documented as "validation errors found". A usage error reported as 1
+ * tells a CI gate the project's artifacts are broken when in fact nothing was
+ * inspected — a different wrong answer to the same question, not a fix. Exit 2
+ * is this repo's "the run could not tell you anything about your artifacts",
+ * which is exactly true here. (It therefore diverges from `rejectRetiredOnly`,
+ * which chose 1 to keep a pre-existing failing CI gate failing; there is no
+ * such continuity to preserve for an argument that used to be *accepted*.)
+ *
+ * @param operands - The command's parsed positional operands (`command.args`).
+ * @param command - Command name for the message, e.g. `vat verify`.
+ * @param operatesOn - One clause completing "<command> …", saying what the
+ *   command actually runs against, so the reader learns why a path is
+ *   meaningless rather than merely that it was refused.
+ */
+export declare function rejectPositionalArguments(operands: readonly string[], command: string, operatesOn: string): void;
+//# sourceMappingURL=positional-args.d.ts.map

package/dist/commands/positional-args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"positional-args.d.ts","sourceRoot":"","sources":["../../src/commands/positional-args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,IAAI,CAmBN"}

package/dist/commands/positional-args.js

@@ -0,0 +1,52 @@
+/**
+ * Rejection of positional arguments on commands that take none.
+ *
+ * Shared by the config-driven top-level orchestrators (`vat verify`,
+ * `vat validate`), which operate on the whole project as the config describes
+ * it and have no path-shaped subject at all.
+ */
+/**
+ * Fail the run when a caller passed a positional argument to a command that
+ * takes none, naming the argument and where to take it instead.
+ *
+ * **Why this is not `.allowExcessArguments(false)`.** That is the Commander
+ * mechanism for the same rejection and it would work, but its message is
+ * `error: too many arguments for 'verify'. Expected 0 arguments but got 1.` —
+ * which tells the reader the argument was wrong without telling them what the
+ * command DOES operate on or where a path is accepted, so the next move is a
+ * guess. The whole point of this fix is diagnosability, so the message is
+ * written by hand and this rejection runs first in the action instead.
+ *
+ * **Why exit 2, not Commander's usage-error 1.** On both of these commands exit
+ * 1 is documented as "validation errors found". A usage error reported as 1
+ * tells a CI gate the project's artifacts are broken when in fact nothing was
+ * inspected — a different wrong answer to the same question, not a fix. Exit 2
+ * is this repo's "the run could not tell you anything about your artifacts",
+ * which is exactly true here. (It therefore diverges from `rejectRetiredOnly`,
+ * which chose 1 to keep a pre-existing failing CI gate failing; there is no
+ * such continuity to preserve for an argument that used to be *accepted*.)
+ *
+ * @param operands - The command's parsed positional operands (`command.args`).
+ * @param command - Command name for the message, e.g. `vat verify`.
+ * @param operatesOn - One clause completing "<command> …", saying what the
+ *   command actually runs against, so the reader learns why a path is
+ *   meaningless rather than merely that it was refused.
+ */
+export function rejectPositionalArguments(operands, command, operatesOn) {
+    if (operands.length === 0)
+        return;
+    const listed = operands.map((operand) => `'${operand}'`).join(', ');
+    process.stderr.write(`error: '${command}' does not take a path argument (got: ${listed}).\n` +
+        `\n` +
+        `  '${command}' ${operatesOn}, so there is nothing for a path to scope.\n` +
+        `  The argument used to be accepted and silently DISCARDED: the run went\n` +
+        `  wide over the whole project and still reported success, so an operator\n` +
+        `  who believed they had scoped the scan got a green tick for a scan that\n` +
+        `  never happened.\n` +
+        `\n` +
+        `  Fix: run '${command}' with no arguments, and scope it in\n` +
+        `  vibe-agent-toolkit.config.yaml.\n` +
+        `  To inspect ONE skill or bundle by path, use: vat audit <path>\n`);
+    process.exit(2);
+}
+//# sourceMappingURL=positional-args.js.map

package/dist/commands/positional-args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"positional-args.js","sourceRoot":"","sources":["../../src/commands/positional-args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA2B,EAC3B,OAAe,EACf,UAAkB;IAElB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,WAAW,OAAO,yCAAyC,MAAM,MAAM;QACrE,IAAI;QACJ,MAAM,OAAO,KAAK,UAAU,8CAA8C;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,qBAAqB;QACrB,IAAI;QACJ,eAAe,OAAO,wCAAwC;QAC9D,qCAAqC;QACrC,mEAAmE,CACtE,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/commands/rag/query-command.d.ts

@@ -6,6 +6,46 @@ interface QueryOptions {
     limit?: number;
     debug?: boolean;
 }
+/** The chunk fields this payload republishes. Structural, so tests can pass a literal. */
+interface QueriedChunk {
+    chunkId: string;
+    resourceId: string;
+    filePath: string;
+    headingPath?: string | undefined;
+    headingLevel?: number | undefined;
+    startLine?: number | undefined;
+    endLine?: number | undefined;
+    title?: string | undefined;
+    type?: string | undefined;
+    tags?: string[] | undefined;
+    contentHash: string;
+    tokenCount: number;
+    embeddingModel: string;
+    embeddedAt: Date;
+    previousChunkId?: string | undefined;
+    nextChunkId?: string | undefined;
+    content: string;
+}
+export interface QueryPayloadInput {
+    queryText: string;
+    chunks: readonly QueriedChunk[];
+    stats: unknown;
+    durationMs: number;
+    /** The stated root: the ONE base every reported path is relative to. */
+    root: string;
+}
+/**
+ * Build the query payload.
+ *
+ * `resourceId` is already relative — the registry derives it from the indexing
+ * base — so an absolute `filePath` one line above it put a single record in two
+ * coordinate systems, and leaked `$HOME` into every result. Re-basing happens
+ * once, here, so both identifiers read the same way.
+ *
+ * Fields are ordered deliberately: short ones first, `content` last, so a long
+ * result stays scannable.
+ */
+export declare function buildQueryOutputData(input: QueryPayloadInput): Record<string, unknown>;
 export declare function queryCommand(queryText: string, options: QueryOptions): Promise<void>;
 export {};
 //# sourceMappingURL=query-command.d.ts.map

package/dist/commands/rag/query-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"query-command.d.ts","sourceRoot":"","sources":["../../../src/commands/rag/query-command.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,UAAU,YAAY;IACpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CA+Df"}
+{"version":3,"file":"query-command.d.ts","sourceRoot":"","sources":["../../../src/commands/rag/query-command.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,UAAU,YAAY;IACpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,0FAA0F;AAC1F,UAAU,YAAY;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,IAAI,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2CtF;AAED,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CAmCf"}

package/dist/commands/rag/query-command.js

@@ -1,27 +1,30 @@
 /**
  * RAG query command - search the vector database
  */
+import { safePath } from '@vibe-agent-toolkit/utils';
 import { writeYamlOutput } from '../../utils/output.js';
+import { projectRootOrNull } from '../../utils/project-root-policy.js';
+import { relativizePath } from '../../utils/relativize-paths.js';
 import { executeRagOperation, formatDuration } from './command-helpers.js';
-export async function queryCommand(queryText, options) {
-    const startTime = Date.now();
-    const result = await executeRagOperation(options, async (ragProvider, logger) => {
-        logger.debug(`Querying for: "${queryText}"`);
-        // Execute query
-        const queryResult = await ragProvider.query({
-            text: queryText,
-            limit: options.limit ?? 10,
-        });
-        return queryResult;
-    }, 'Query');
-    const duration = Date.now() - startTime;
-    // Format chunks with explicit field order: short fields first, content last
-    const formattedChunks = result.chunks.map((chunk) => ({
+/**
+ * Build the query payload.
+ *
+ * `resourceId` is already relative — the registry derives it from the indexing
+ * base — so an absolute `filePath` one line above it put a single record in two
+ * coordinate systems, and leaked `$HOME` into every result. Re-basing happens
+ * once, here, so both identifiers read the same way.
+ *
+ * Fields are ordered deliberately: short ones first, `content` last, so a long
+ * result stays scannable.
+ */
+export function buildQueryOutputData(input) {
+    const { queryText, chunks, stats, durationMs, root } = input;
+    const formattedChunks = chunks.map((chunk) => ({
         // Identifiers
         chunkId: chunk.chunkId,
         resourceId: chunk.resourceId,
         // Location metadata (short)
-        filePath: chunk.filePath,
+        filePath: relativizePath(chunk.filePath, root),
         ...(chunk.headingPath ? { headingPath: chunk.headingPath } : {}),
         ...(chunk.headingLevel === undefined ? {} : { headingLevel: chunk.headingLevel }),
         ...(chunk.startLine === undefined ? {} : { startLine: chunk.startLine }),
@@ -41,14 +44,38 @@ export async function queryCommand(queryText, options) {
         // Content (long, last)
         content: chunk.content,
     }));
-    // Output with stats/duration before chunks (short fields first)
-    writeYamlOutput({
+    // Stats/duration before chunks (short fields first)
+    return {
         status: 'success',
+        root,
         query: queryText,
-        stats: result.stats,
-        duration: formatDuration(duration),
+        stats,
+        duration: formatDuration(durationMs),
         chunks: formattedChunks,
-    });
+    };
+}
+export async function queryCommand(queryText, options) {
+    const startTime = Date.now();
+    const result = await executeRagOperation(options, async (ragProvider, logger) => {
+        logger.debug(`Querying for: "${queryText}"`);
+        // Execute query
+        const queryResult = await ragProvider.query({
+            text: queryText,
+            limit: options.limit ?? 10,
+        });
+        return queryResult;
+    }, 'Query');
+    // The index lives under the project (`<projectRoot>/.rag-db` by default) and
+    // its `resourceId`s are already project-relative, so projectRoot is the base
+    // that puts `filePath` in the same coordinate system.
+    const root = projectRootOrNull(process.cwd()) ?? safePath.resolve(process.cwd());
+    writeYamlOutput(buildQueryOutputData({
+        queryText,
+        chunks: result.chunks,
+        stats: result.stats,
+        durationMs: Date.now() - startTime,
+        root,
+    }));
     process.exit(0);
 }
 //# sourceMappingURL=query-command.js.map