@vibecheckai/cli 3.1.6 → 3.2.0

package/bin/registry.js

@@ -1,387 +1,252 @@
 /**
- * Vibecheck CLI Command Registry
- * 
- * Single source of truth for all CLI commands.
- * Tiers match entitlements-v2.js EXACTLY.
- * 
- * @module bin/registry
+ * Vibecheck CLI Command Registry (LOCKED)
+ *
+ * Single source of truth for the public CLI surface.
+ * If it isn't here, it does not exist.
  */
 
 "use strict";
 
-// ═══════════════════════════════════════════════════════════════════════════════
-// COMMAND REGISTRY - The 14-Command Vibecheck CLI
-// Tiers match entitlements-v2.js EXACTLY
-// ═══════════════════════════════════════════════════════════════════════════════
+// ─────────────────────────────────────────────────────────────
+// CORE 17 COMMANDS (locked surface area)
+// ─────────────────────────────────────────────────────────────
+const ALLOWED_COMMANDS = new Set([
+  // FREE (8) - Core functionality to try the product
+  "init",       // one-time setup
+  "doctor",     // health check
+  "watch",      // continuous mode
+  "scan",       // includes --allowlist subcommand
+  "ship",       // verdict engine
+  "login",      // authenticate
+  "logout",     // remove credentials
+  "whoami",     // show current user
+
+  // STARTER (6) - Productivity & automation
+  "fix",        // AI-powered fixes
+  "report",     // generate reports
+  "context",    // generate IDE rules
+  "guard",      // AI guardrails (prompt firewall, hallucination checking)
+  "mcp",        // MCP server
+  "checkpoint", // baseline comparison & hallucination scoring
+
+  // PRO (3) - Advanced proof & AI testing
+  "prove",      // includes --bundle for evidence packs
+  "reality",    // includes --agent for AI testing
+  "polish",     // production polish
+]);
+
+function assertAllowedOnly(obj) {
+  const extras = Object.keys(obj).filter((k) => !ALLOWED_COMMANDS.has(k));
+  if (extras.length) {
+    throw new Error(`Registry contains non-allowed commands: ${extras.join(", ")}`);
+  }
+}
+
+// ─────────────────────────────────────────────────────────────
+// COMMANDS (ALLOWED ONLY)
+// ─────────────────────────────────────────────────────────────
 const COMMANDS = {
-  // ═══════════════════════════════════════════════════════════════════════════════
-  // SETUP COMMANDS (2)
-  // ═══════════════════════════════════════════════════════════════════════════════
-  
-  // 1) init - One-time setup (config + contracts + scripts)
-  init: { 
-    description: "One-time setup (config + contracts + scripts)", 
-    tier: "free", 
-    category: "setup", 
-    aliases: ["setup", "configure"], 
-    runner: () => require("./runners/runInit").runInit 
-  },
-  
-  // 2) doctor - Environment + dependency + config health check
-  doctor: { 
-    description: "Environment + dependency + config health check", 
-    tier: "free", 
-    category: "setup", 
-    aliases: ["health", "diag"], 
-    runner: () => require("./runners/runDoctor").runDoctor 
-  },
-  
-  // ═══════════════════════════════════════════════════════════════════════════════
-  // AI TRUTH LANE (4) - Context engine, guardrails, MDC
-  // ═══════════════════════════════════════════════════════════════════════════════
-  
-  // 3) ctx - Generate/update truthpack (core truth engine)
-  ctx: { 
-    description: "Truthpack generation - core truth engine", 
-    tier: "free", 
-    category: "truth", 
-    aliases: ["truthpack", "tp"], 
-    subcommands: ["build", "diff", "sync", "search"], 
-    runner: () => require("./runners/runCtx").runCtx 
-  },
-  
-  // 4) context - MDC + IDE rules + memory engine outputs
-  context: { 
-    description: "Generate IDE rules (.cursorrules, MDC, Windsurf, Copilot)", 
-    tier: "free", 
-    category: "truth", 
-    aliases: ["rules", "ai-rules", "mdc"], 
-    runner: () => require("./runners/runContext").runContext 
-  },
-  
-  // 5) guard - AI guardrails (prompt firewall, hallucination checking)
-  guard: { 
-    description: "AI guardrails - prompt firewall & hallucination checking", 
-    tier: "free", 
-    category: "truth", 
-    aliases: ["ai-guard", "firewall", "validate"], 
-    runner: () => require("./runners/runGuard").runGuard 
+  // ══════════════════════════════════════════════════════════════
+  // FREE TIER (8 commands) - Core functionality to try the product
+  // ══════════════════════════════════════════════════════════════
+
+  // ── SETUP ───────────────────────────────────────────────────
+  init: {
+    description: "One-time setup (config + contracts + scripts)",
+    tier: "free",
+    category: "setup",
+    aliases: ["setup", "configure"],
+    runner: () => require("./runners/runInit").runInit,
   },
-  
-  // 6) contracts - CI gate for contract drift / invariants
-  contracts: { 
-    description: "CI gate for contract drift / invariants", 
-    tier: "free", 
-    category: "truth", 
-    aliases: ["drift"], 
-    runner: () => require("./runners/runContracts").runContracts 
+
+  doctor: {
+    description: "Environment + dependency + config health check",
+    tier: "free",
+    category: "setup",
+    aliases: ["health", "diag"],
+    runner: () => require("./runners/runDoctor").runDoctor,
   },
-  
-  // ═══════════════════════════════════════════════════════════════════════════════
-  // PROOF LOOP (5) - The main verification commands
-  // ═══════════════════════════════════════════════════════════════════════════════
-  
-  // 7) ship - The only verdict command. Static + (optional) runtime merge
-  ship: { 
-    description: "Verdict engine - SHIP / WARN / BLOCK", 
-    tier: "free", 
-    category: "proof", 
-    aliases: ["verdict", "go"], 
-    caps: "static-only on FREE", 
-    runner: () => require("./runners/runShip").runShip 
+
+  watch: {
+    description: "Continuous mode - re-runs on changes",
+    tier: "free",
+    category: "setup",
+    aliases: ["w", "dev"],
+    runner: () => require("./runners/runWatch").runWatch,
   },
-  
-  // 8) runtime - Everything Playwright / browser-based
-  runtime: { 
-    description: "Browser-based runtime verification", 
-    tier: "free", 
-    category: "proof", 
-    aliases: [], 
-    subcommands: ["crawl", "agent", "record", "play"],
-    caps: "preview mode on FREE (5 pages, no auth)", 
-    runner: () => require("./runners/runRuntime").runRuntime 
+
+  // ── CORE LOOP ───────────────────────────────────────────────
+  scan: {
+    description: "Route integrity & code analysis; use --allowlist for false positive management",
+    tier: "free",
+    category: "proof",
+    aliases: ["s", "check"],
+    runner: () => require("./runners/runScan").runScan,
   },
-  
-  // 9) fix - Mission planning + patching
-  fix: { 
-    description: "AI-powered auto-fix", 
-    tier: "free", 
-    category: "proof", 
-    caps: "--plan-only on FREE", 
-    aliases: ["f", "repair"], 
-    runner: () => require("./runners/runFix").runFix 
+
+  ship: {
+    description: "Verdict engine - SHIP / WARN / BLOCK",
+    tier: "free",
+    category: "proof",
+    aliases: ["verdict", "go"],
+    runner: () => require("./runners/runShip").runShip,
   },
-  
-  // 10) prove - The one command users actually run before launch
-  prove: { 
-    description: "Full proof loop - ctx → runtime → ship → fix", 
-    tier: "pro", 
-    category: "proof", 
-    aliases: ["p", "full", "all"], 
-    runner: () => require("./runners/runProve").runProve 
+
+  // ── ACCOUNT (skipAuth) ────────────────────────────────────
+  login: {
+    description: "Authenticate with API key",
+    tier: "free",
+    category: "account",
+    aliases: ["auth", "signin"],
+    runner: () => require("./runners/runAuth").runLogin,
+    skipAuth: true,
   },
-  
-  // 11) security - AuthZ + IDOR + sensitive security proofs
-  security: { 
-    description: "AuthZ matrix & IDOR detection", 
-    tier: "pro", 
-    category: "proof", 
-    aliases: [], 
-    subcommands: ["model", "matrix", "idor", "prove"],
-    runner: () => require("./runners/runSecurity").runSecurity 
+
+  logout: {
+    description: "Remove stored credentials",
+    tier: "free",
+    category: "account",
+    aliases: ["signout"],
+    runner: () => require("./runners/runAuth").runLogout,
+    skipAuth: true,
   },
-  
-  // ═══════════════════════════════════════════════════════════════════════════════
-  // OUTPUT & AUTOMATION (3)
-  // ═══════════════════════════════════════════════════════════════════════════════
-  
-  // 12) report - Render artifacts (HTML/MD/SARIF/CSV/etc)
-  report: { 
-    description: "Generate HTML/MD/SARIF reports", 
-    tier: "free", 
-    category: "output", 
-    caps: "HTML/MD only on FREE", 
-    aliases: ["html", "artifact"], 
-    runner: () => require("./runners/runReport").runReport 
+
+  whoami: {
+    description: "Show current user and plan",
+    tier: "free",
+    category: "account",
+    aliases: ["me", "user"],
+    runner: () => require("./runners/runAuth").runWhoami,
+    skipAuth: true,
   },
-  
-  // 13) export - Lightweight collab outputs from latest results
-  export: { 
-    description: "Generate collaboration outputs", 
-    tier: "free", 
-    category: "output", 
-    aliases: [], 
-    subcommands: ["pr", "badge", "bundle"],
-    runner: () => require("./runners/runExport").runExport 
+
+  // ══════════════════════════════════════════════════════════════
+  // STARTER TIER (6 commands) - Productivity & automation
+  // ══════════════════════════════════════════════════════════════
+
+  fix: {
+    description: "AI-powered auto-fix for findings",
+    tier: "starter",
+    category: "proof",
+    aliases: ["f", "repair"],
+    runner: () => require("./runners/runFix").runFix,
   },
-  
-  // 14) mcp - Start MCP server for AI IDEs
-  mcp: { 
-    description: "Start MCP server for AI IDEs", 
-    tier: "starter", 
-    category: "automation", 
-    aliases: [], 
-    runner: () => require("./runners/runMcp").runMcp 
+
+  report: {
+    description: "Generate HTML/MD/SARIF reports",
+    tier: "starter",
+    category: "output",
+    aliases: ["html", "artifact"],
+    runner: () => require("./runners/runReport").runReport,
   },
-  
-  // ═══════════════════════════════════════════════════════════════════════════════
-  // BACKWARD COMPATIBILITY ALIASES (old commands still work)
-  // ═══════════════════════════════════════════════════════════════════════════════
-  
-  // install → init --quick
-  install: { 
-    description: "Zero-friction onboarding (alias: init --quick)", 
-    tier: "free", 
-    category: "setup", 
-    aliases: ["i", "bootstrap"], 
-    runner: () => async (args) => {
-      const { runInit } = require("./runners/runInit");
-      return await runInit(["--quick", ...args]);
-    }
+
+  context: {
+    description: "Generate IDE rules (.cursorrules, MDC, Windsurf, Copilot)",
+    tier: "starter",
+    category: "truth",
+    aliases: ["rules", "ai-rules", "mdc"],
+    runner: () => require("./runners/runContext").runContext,
   },
-  
-  // scan - Enhanced route integrity scanner with terminal UI
-  scan: { 
-    description: "Route integrity & code analysis scanner", 
-    tier: "free", 
-    category: "proof", 
-    aliases: ["s", "check"], 
-    runner: () => require("./runners/runScan").runScan
+
+  guard: {
+    description: "AI guardrails - prompt firewall & hallucination checking",
+    tier: "starter",
+    category: "truth",
+    aliases: ["ai-guard", "firewall", "validate"],
+    runner: () => require("./runners/runGuard").runGuard,
   },
-  
-  // gate → ship --ci
-  gate: { 
-    description: "CI/CD gate (alias: ship --ci)", 
-    tier: "starter", 
-    category: "ci", 
-    aliases: ["ci", "block"], 
-    runner: () => async (args) => {
-      const { runShip } = require("./runners/runShip");
-      return await runShip(["--ci", ...args]);
-    }
+
+  mcp: {
+    description: "Start MCP server for AI IDEs",
+    tier: "starter",
+    category: "automation",
+    aliases: [],
+    runner: () => require("./runners/runMcp").runMcp,
   },
-  
-  // reality → runtime crawl
-  reality: { 
-    description: "Runtime proof (alias: runtime crawl)", 
-    tier: "free", 
-    category: "proof", 
-    aliases: ["r", "test", "e2e"], 
-    caps: "preview mode on FREE (5 pages, no auth)", 
-    runner: () => async (args) => {
-      const { runRuntime } = require("./runners/runRuntime");
-      return await runRuntime(["crawl", ...args]);
-    }
+
+  checkpoint: {
+    description: "Compare baseline vs current, hallucination scoring",
+    tier: "starter",
+    category: "analysis",
+    aliases: ["cp", "compare", "diff"],
+    runner: () => require("./runners/runCheckpoint").runCheckpoint,
   },
-  
-  // ai-test → runtime agent
-  "ai-test": { 
-    description: "AI autonomous test (alias: runtime agent)", 
-    tier: "pro", 
-    category: "automation", 
-    aliases: ["ai", "agent"], 
-    runner: () => async (args) => {
+
+  // ══════════════════════════════════════════════════════════════
+  // PRO TIER (3 commands) - Advanced proof & AI testing
+  // ══════════════════════════════════════════════════════════════
+
+  reality: {
+    description: "Runtime proof (browser crawl); use --agent for AI testing",
+    tier: "pro",
+    category: "proof",
+    caps: "--agent for AI autonomous testing",
+    aliases: ["r", "test", "e2e"],
+    runner: () => async (args, ctx) => {
       const { runRuntime } = require("./runners/runRuntime");
-      return await runRuntime(["agent", ...args]);
-    }
-  },
-  
-  // replay → runtime record/play
-  replay: { 
-    description: "Record/replay sessions (alias: runtime record/play)", 
-    tier: "pro", 
-    category: "proof", 
-    aliases: ["record", "playback"], 
-    runner: () => async (args) => {
-      // If first arg is record or play, delegate to runtime
-      if (args[0] === "record" || args[0] === "play") {
-        const { runRuntime } = require("./runners/runRuntime");
-        return await runRuntime(args);
-      }
-      // Otherwise delegate to original replay handler
-      try {
-        const { runReplay } = require("./runners/runReplay");
-        return await runReplay(args);
-      } catch (e) {
-        if (args && (args.includes("--help") || args.includes("-h") || args.length === 0)) {
-          console.log("\n  vibecheck replay - Record and replay user sessions\n\n  Subcommands:\n    record <url>     Record a user session\n    play <capsule>   Replay a recorded session\n    list             List available replay capsules\n    show <id>        Show details of a replay capsule\n    delete <id>      Delete a replay capsule\n    export <id>      Export a replay capsule\n    import <file>    Import a replay capsule\n\n  Note: Requires 'chalk' and 'playwright' dependencies.\n  Install: npm install chalk playwright\n");
-          return 0;
-        }
-        console.error("Replay runner error:", e.message);
-        return 1;
+      // Check if --agent flag is present to route to agent subcommand
+      if (args.includes("--agent") || args.includes("-a")) {
+        const filteredArgs = args.filter(a => a !== "--agent" && a !== "-a");
+        return await runRuntime(["agent", ...filteredArgs], ctx);
       }
-    }
-  },
-  
-  // pr → export pr
-  pr: { 
-    description: "Generate PR comment (alias: export pr)", 
-    tier: "starter", 
-    category: "ci", 
-    aliases: ["pull-request"], 
-    runner: () => async (args) => {
-      const { runExport } = require("./runners/runExport");
-      return await runExport(["pr", ...args]);
-    }
-  },
-  
-  // badge → export badge
-  badge: { 
-    description: "Generate ship badge (alias: export badge)", 
-    tier: "starter", 
-    category: "ci", 
-    aliases: ["b"], 
-    runner: () => async (args) => {
-      const { runExport } = require("./runners/runExport");
-      return await runExport(["badge", ...args]);
-    }
-  },
-  
-  // share → export bundle
-  share: { 
-    description: "Generate share pack (alias: export bundle)", 
-    tier: "pro", 
-    category: "automation", 
-    aliases: [], 
-    runner: () => async (args) => {
-      const { runExport } = require("./runners/runExport");
-      return await runExport(["bundle", ...args]);
-    }
+      return await runRuntime(["crawl", ...args], ctx);
+    },
   },
-  
-  // permissions → security model
-  permissions: { 
-    description: "AuthZ & IDOR (alias: security model)", 
-    tier: "pro", 
-    category: "proof", 
-    aliases: ["authz", "idor"], 
-    runner: () => async (args) => {
-      const { runSecurity } = require("./runners/runSecurity");
-      // If no subcommand, default to "model"
-      if (!args[0] || args[0].startsWith("--")) {
-        return await runSecurity(["model", ...args]);
-      }
-      return await runSecurity(args);
-    }
-  },
-  
-  // ═══════════════════════════════════════════════════════════════════════════════
-  // QUALITY & CHECKPOINT COMMANDS
-  // ═══════════════════════════════════════════════════════════════════════════════
-  
-  // 15) polish - Production polish analyzer
-  polish: { 
-    description: "Production polish analyzer - finds missing essentials", 
-    tier: "free", 
-    category: "quality", 
-    aliases: ["quality", "finalize", "ready"], 
-    runner: () => require("./runners/runPolish").runPolish 
+
+  prove: {
+    description: "One command reality proof - video + network evidence that your app works",
+    tier: "pro",
+    category: "proof",
+    aliases: ["p", "full", "all"],
+    caps: "video, trace, HAR recording; use --bundle for evidence pack",
+    runner: () => require("./runners/runProve").runProve,
   },
-  
-  // 16) checkpoint - Compare baseline vs current
-  checkpoint: {
-    description: "Compare baseline vs current, hallucination scoring",
-    tier: "free",
-    category: "analysis",
-    aliases: ["cp", "compare", "diff"],
-    caps: "basic on FREE, hallucination scoring on PRO",
-    runner: () => require("./runners/runCheckpoint").runCheckpoint
+
+  polish: {
+    description: "Production polish analyzer - finds missing essentials",
+    tier: "pro",
+    category: "quality",
+    aliases: ["quality", "finalize", "ready"],
+    runner: () => require("./runners/runPolish").runPolish,
   },
-  
-  status: { description: "Project health dashboard", tier: "free", category: "setup", aliases: ["st"], runner: () => require("./runners/runStatus").runStatus },
-  watch: { description: "Continuous mode - re-runs on changes", tier: "free", category: "setup", aliases: ["w", "dev"], runner: () => require("./runners/runWatch").runWatch },
-  launch: { description: "Pre-launch checklist wizard", tier: "starter", category: "setup", aliases: ["checklist"], runner: () => require("./runners/runLaunch").runLaunch },
-  preflight: { description: "Deployment validation checks", tier: "free", category: "setup", aliases: ["deploy-check"], runner: () => require("./runners/runPreflight").runPreflight },
-  verify: { description: "Verify AI-generated code output", tier: "free", category: "truth", aliases: ["v", "check-output"], runner: () => require("./runners/runVerify").main },
-  graph: { description: "Reality proof graph visualization", tier: "pro", category: "proof", aliases: ["graphviz", "causal"], runner: () => require("./runners/runGraph").runGraph },
-  
-  // ACCOUNT (always free)
-  login: { description: "Authenticate with API key", tier: "free", category: "account", aliases: ["auth", "signin"], runner: () => require("./runners/runAuth").runLogin, skipAuth: true },
-  logout: { description: "Remove stored credentials", tier: "free", category: "account", aliases: ["signout"], runner: () => require("./runners/runAuth").runLogout, skipAuth: true },
-  whoami: { description: "Show current user and plan", tier: "free", category: "account", aliases: ["me", "user"], runner: () => require("./runners/runAuth").runWhoami, skipAuth: true },
-  
-  // EXTRAS
-  labs: { description: "Experimental features", tier: "free", category: "extras", aliases: ["experimental", "beta"], runner: () => require("./runners/runLabs").runLabs },
 };
 
-// ═══════════════════════════════════════════════════════════════════════════════
-// DERIVED DATA STRUCTURES
-// ═══════════════════════════════════════════════════════════════════════════════
+assertAllowedOnly(COMMANDS);
+
+// ─────────────────────────────────────────────────────────────
+// DERIVED MAPS
+// ─────────────────────────────────────────────────────────────
 const ALIAS_MAP = {};
-for (const [cmd, def] of Object.entries(COMMANDS)) { 
-  for (const alias of def.aliases || []) ALIAS_MAP[alias] = cmd; 
+for (const [cmd, def] of Object.entries(COMMANDS)) {
+  for (const alias of def.aliases || []) ALIAS_MAP[alias] = cmd;
 }
 
-const ALL_COMMANDS = [...Object.keys(COMMANDS), ...Object.values(COMMANDS).flatMap(c => c.aliases || [])];
+const ALL_COMMANDS = [
+  ...Object.keys(COMMANDS),
+  ...Object.values(COMMANDS).flatMap((c) => c.aliases || []),
+];
 
-// ═══════════════════════════════════════════════════════════════════════════════
+// ─────────────────────────────────────────────────────────────
 // RUNNER LOADER
-// ═══════════════════════════════════════════════════════════════════════════════
-/**
- * Get runner function for a command
- * @param {string} cmd - Command name
- * @param {object} styles - Optional styling object with { red, reset, errorSymbol }
- * @returns {Function|null} Runner function or null if not found
- */
+// ─────────────────────────────────────────────────────────────
 function getRunner(cmd, styles = {}) {
   const def = COMMANDS[cmd];
   if (!def) return null;
+
   const red = styles.red || "";
   const reset = styles.reset || "";
   const errorSym = styles.errorSymbol || "✗";
-  try { 
-    return def.runner(); 
-  } catch (e) { 
-    return async () => { 
-      console.error(`${red}${errorSym}${reset} Failed to load ${cmd}: ${e.message}`); 
-      return 1; 
-    }; 
+
+  try {
+    return def.runner();
+  } catch (e) {
+    return async () => {
+      console.error(`${red}${errorSym}${reset} Failed to load ${cmd}: ${e.message}`);
+      return 1;
+    };
   }
 }
 
-// ═══════════════════════════════════════════════════════════════════════════════
-// EXPORTS
-// ═══════════════════════════════════════════════════════════════════════════════
 module.exports = {
   COMMANDS,
   ALIAS_MAP,