@yansirplus/cli 0.5.17 → 0.5.18

package/dist/lib/public-api-model.mjs

@@ -167,6 +167,25 @@ const sourceExportRecordsFromAst = (file, entrypoint, seen) => {
         records.push(
           ...sourceExportRecordsFromAst(resolveRelativeModule(abs, specifier), entrypoint, seen),
         );
+      } else if (
+        statement.exportClause !== undefined &&
+        ts.isNamedExports(statement.exportClause) &&
+        specifier !== null &&
+        specifier.startsWith(".")
+      ) {
+        const target = resolveRelativeModule(abs, specifier);
+        const targetRecords = sourceExportRecordsFromAst(target, entrypoint, new Set(seen));
+        for (const element of statement.exportClause.elements) {
+          const importedName = element.propertyName?.text ?? element.name.text;
+          const exportedName = element.name.text;
+          const targetRecord = targetRecords.find((record) => record.name === importedName);
+          if (targetRecord === undefined) continue;
+          records.push({
+            ...targetRecord,
+            name: exportedName,
+            key: `${entrypoint}:${exportedName}`,
+          });
+        }
       }
       continue;
     }

package/dist/lib/repo-source-files.mjs

@@ -0,0 +1,26 @@
+import fs from "node:fs";
+import path from "node:path";
+
+export const repoSourceIgnoredDirectoryNames = Object.freeze(
+  new Set(["node_modules", "dist", ".wrangler", ".turbo", ".parallel", ".cst", ".git", ".codex"]),
+);
+
+const compare = (left, right) => left.localeCompare(right);
+
+const toRepoPath = (file) => file.split(path.sep).join("/");
+
+export const walkRepoSourceFiles = (repoRoot, relativePath = ".", options = {}) => {
+  const absolutePath = path.join(repoRoot, relativePath);
+  if (!fs.existsSync(absolutePath)) return [];
+  const stat = fs.statSync(absolutePath);
+  if (stat.isFile()) return [toRepoPath(relativePath)];
+  const ignored = options.ignored ?? repoSourceIgnoredDirectoryNames;
+  const files = [];
+  for (const entry of fs.readdirSync(absolutePath, { withFileTypes: true })) {
+    if (entry.isDirectory() && ignored.has(entry.name)) continue;
+    const child = path.join(relativePath, entry.name);
+    if (entry.isDirectory()) files.push(...walkRepoSourceFiles(repoRoot, child, options));
+    if (entry.isFile()) files.push(toRepoPath(child));
+  }
+  return files.sort(compare);
+};

package/dist/lib/ts-module-loader.mjs

@@ -0,0 +1,44 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+import { build } from "esbuild";
+
+const compare = (left, right) => left.localeCompare(right);
+
+export const bundleModuleForNode = async (
+  entryPoint,
+  { define = {}, external = [], prefix = "agentos-ts-module-", tempRoot = os.tmpdir() } = {},
+) => {
+  const outDir = path.join(tempRoot, `${prefix}${randomUUID()}`);
+  const outfile = path.join(outDir, "entry.mjs");
+  await mkdir(outDir, { recursive: true });
+  await build({
+    entryPoints: [entryPoint],
+    outfile,
+    bundle: true,
+    format: "esm",
+    platform: "node",
+    target: "node22",
+    define,
+    external: [...new Set(["esbuild", "cloudflare:*", ...external])].sort(compare),
+    logLevel: "silent",
+  });
+  return {
+    outfile,
+    cleanup: async () => {
+      await rm(outDir, { recursive: true, force: true });
+    },
+  };
+};
+
+export const importBundledModule = async (entryPoint, options = {}) => {
+  const bundled = await bundleModuleForNode(entryPoint, options);
+  try {
+    return await import(`${pathToFileURL(bundled.outfile).href}?agentos=${Date.now()}`);
+  } finally {
+    await bundled.cleanup();
+  }
+};

package/dist/lib/workspace-manifest.mjs

@@ -0,0 +1,77 @@
+import fs from "node:fs";
+import path from "node:path";
+
+import { parse as parseYaml } from "yaml";
+
+const compare = (left, right) => left.localeCompare(right);
+const readJsonFile = (file) => JSON.parse(fs.readFileSync(file, "utf8"));
+
+const workspaceManifestPath = (repoRoot) => path.join(repoRoot, "pnpm-workspace.yaml");
+
+const requireRecord = (value, label) => {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+};
+
+export const readWorkspaceManifest = (repoRoot) => {
+  const file = workspaceManifestPath(repoRoot);
+  if (!fs.existsSync(file)) {
+    throw new Error("pnpm-workspace.yaml is the workspace manifest SSOT and must exist");
+  }
+  const manifest = requireRecord(parseYaml(fs.readFileSync(file, "utf8")), "pnpm-workspace.yaml");
+  return manifest;
+};
+
+export const workspacePackagePatterns = (repoRoot) => {
+  const packages = readWorkspaceManifest(repoRoot).packages;
+  if (!Array.isArray(packages)) {
+    throw new Error("pnpm-workspace.yaml packages must be an array");
+  }
+  return packages.filter((entry) => typeof entry === "string").sort(compare);
+};
+
+export const workspaceCatalog = (repoRoot) => {
+  const catalog = readWorkspaceManifest(repoRoot).catalog;
+  if (catalog === undefined) return {};
+  return requireRecord(catalog, "pnpm-workspace.yaml catalog");
+};
+
+export const workspaceOverrides = (repoRoot) => {
+  const overrides = readWorkspaceManifest(repoRoot).overrides;
+  if (overrides === undefined) return {};
+  return requireRecord(overrides, "pnpm-workspace.yaml overrides");
+};
+
+export const workspacePackagePaths = (repoRoot) => {
+  const paths = new Set();
+  for (const workspace of workspacePackagePatterns(repoRoot)) {
+    if (workspace.endsWith("/*")) {
+      const base = workspace.slice(0, -2);
+      const baseDir = path.join(repoRoot, base);
+      if (!fs.existsSync(baseDir)) continue;
+      for (const entry of fs.readdirSync(baseDir, { withFileTypes: true })) {
+        if (!entry.isDirectory()) continue;
+        const packagePath = `${base}/${entry.name}`;
+        if (fs.existsSync(path.join(repoRoot, packagePath, "package.json"))) {
+          paths.add(packagePath);
+        }
+      }
+      continue;
+    }
+
+    if (fs.existsSync(path.join(repoRoot, workspace, "package.json"))) {
+      paths.add(workspace);
+    }
+  }
+  return [...paths].sort(compare);
+};
+
+export const workspacePackageRecords = (repoRoot) =>
+  workspacePackagePaths(repoRoot)
+    .map((packagePath) => ({
+      name: readJsonFile(path.join(repoRoot, packagePath, "package.json")).name,
+      path: packagePath,
+    }))
+    .sort((left, right) => left.path.localeCompare(right.path));

package/dist/main.mjs

@@ -1,7 +1,16 @@
 #!/usr/bin/env node
 import { spawn } from "node:child_process";
-import { fileURLToPath } from "node:url";
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
+import { bundleModuleForNode } from "./lib/ts-module-loader.mjs";
+import {
+  consumerCheck,
+  consumerStatus,
+  installConsumer,
+  restoreConsumer,
+} from "./consumer-overlay.mjs";
 import {
   algorithmicCheckerAcceptsArgs,
   hasAlgorithmicChecker,
@@ -13,9 +22,27 @@ import {
   runAffectedGates,
 } from "./check/gate-selector.mjs";
 import { runDefaultGate } from "./check/default-gate.mjs";
+import { runEffectScanGate } from "./check/effect-scan-gate.mjs";
 import { listGuards, runGroup, runGuard } from "./runner.mjs";
 
-const version = "0.5.16";
+const packageRootFromMain = () => path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+
+const repoRootFromMain = () => path.dirname(path.dirname(packageRootFromMain()));
+
+const readReleaseVersion = () => {
+  const rootPackagePath = path.join(repoRootFromMain(), "package.json");
+  const packagePath = existsSync(rootPackagePath)
+    ? rootPackagePath
+    : path.join(packageRootFromMain(), "package.json");
+  const packageJson = JSON.parse(readFileSync(packagePath, "utf8"));
+  const version = packageJson.agentOsRelease?.version ?? packageJson.version;
+  if (typeof version !== "string" || version.length === 0) {
+    throw new Error("package.json version must be a non-empty string");
+  }
+  return version;
+};
+
+const version = readReleaseVersion();
 
 const helpText = `agentOS repository CLI ${version}
 
@@ -23,11 +50,21 @@ Usage:
   agentos --help
   agentos --version
   agentos build [--cwd <path>] [--config <path>] [--package-scope <scope>]
+  agentos info [--cwd <path>] [--config <path>] [--json]
+  agentos serve [--cwd <path>] [--config <path>] [--package-scope <scope>] [--host <host>] [--port <port>] [--llm config|test] [--llm-response <text>] [--json]
+  agentos dev [--cwd <path>] [--config <path>] [--package-scope <scope>] [--host <host>] [--port <port>] [--llm config|test] [--llm-response <text>] [--json]
+  agentos eval [--cwd <path>] [--config <path>] [--package-scope <scope>] [--target local|remote] [--base-url <url>] [--header <name=value>] [--llm config|test] [--llm-response <text>] [--json]
+  agentos preflight llm [--cwd <path>] [--config <path>] [--route <binding-ref>] [--json]
+  agentos consumer install /path/to/consumer [--from-manifest <path>] [--no-install] [--skip-pack] [--json]
+  agentos consumer status /path/to/consumer [--json] [--check-npm] [--registry <url>]
+  agentos consumer check /path/to/consumer [--json] [--check-npm] [--registry <url>]
+  agentos consumer restore /path/to/consumer [--no-install] [--json]
   agentos check all
   agentos check default
   agentos check structural
   agentos check affected [--base <ref>] [--head <ref>] [--json] [--explain] [--run]
   agentos check docs
+  agentos check effect-scan [--repo <path>] [--evidence <path>] [--scanner <command>]
   agentos check effect-manifests
   agentos check release
   agentos check site
@@ -50,6 +87,12 @@ const fail = (message) => {
   if (
     message.startsWith("agentos:") ||
     message.startsWith("agentos build:") ||
+    message.startsWith("agentos info:") ||
+    message.startsWith("agentos serve:") ||
+    message.startsWith("agentos dev:") ||
+    message.startsWith("agentos eval:") ||
+    message.startsWith("agentos preflight:") ||
+    message.startsWith("agentos consumer:") ||
     message.startsWith("agentos check:") ||
     message.startsWith("agentos generate:")
   ) {
@@ -64,25 +107,89 @@ const expectNoExtraArgs = (args, command) => {
   }
 };
 
-const runBuild = async (args) => {
+const runBuildRunner = async (command, args) => {
   const runner = fileURLToPath(new URL("./build/build-cli.js", import.meta.url));
-  await new Promise((resolve, reject) => {
-    const child = spawn("bun", [runner, "build", ...args], { stdio: "inherit" });
-    child.on("error", (error) => {
-      reject(new Error(`agentos build: failed to start bun: ${error.message}`));
-    });
-    child.on("exit", (code, signal) => {
-      if (signal !== null) {
-        reject(new Error(`agentos build: build runner terminated by ${signal}`));
-        return;
-      }
-      if (code !== 0) {
-        reject(new Error(`agentos build: build runner failed with exit code ${code ?? 1}`));
-        return;
-      }
-      resolve();
-    });
+  const bundled = await bundleModuleForNode(runner, {
+    prefix: "agentos-build-runner-",
+    tempRoot: path.join(packageRootFromMain(), "node_modules", ".cache", "agentos-build"),
   });
+  try {
+    await new Promise((resolve, reject) => {
+      const child = spawn(process.execPath, [bundled.outfile, command, ...args], {
+        stdio: "inherit",
+      });
+      child.on("error", (error) => {
+        reject(
+          new Error(`agentos ${command}: failed to start node build runner: ${error.message}`),
+        );
+      });
+      child.on("exit", (code, signal) => {
+        if (signal !== null) {
+          reject(new Error(`agentos ${command}: build runner terminated by ${signal}`));
+          return;
+        }
+        if (code !== 0) {
+          process.exitCode = code ?? 1;
+        }
+        resolve();
+      });
+    });
+  } finally {
+    await bundled.cleanup();
+  }
+};
+
+const runBuild = async (args) => runBuildRunner("build", args);
+
+const runInfo = async (args) => runBuildRunner("info", args);
+
+const runServe = async (args) => runBuildRunner("serve", args);
+
+const runDev = async (args) => runBuildRunner("dev", args);
+
+const runEval = async (args) => runBuildRunner("eval", args);
+
+const runPreflight = async (args) => runBuildRunner("preflight", args);
+
+const sourceConsumerProducer = () => {
+  const modulePath = path.join(repoRootFromMain(), "tooling/distribution/pack-check.mjs");
+  const supportPath = path.join(repoRootFromMain(), "tooling/distribution/support.mjs");
+  if (!existsSync(modulePath) || !existsSync(supportPath)) return undefined;
+  return {
+    sourceRoot: repoRootFromMain(),
+    defaultInstallManifestPath: path.join(
+      repoRootFromMain(),
+      "dist/internal-npm/install-manifest.json",
+    ),
+    produceInstallManifest: async () => {
+      const producer = await import(pathToFileURL(modulePath).href);
+      producer.packInternal();
+      return path.join(repoRootFromMain(), "dist/internal-npm/install-manifest.json");
+    },
+  };
+};
+
+const runConsumer = async (args) => {
+  const [command, ...rest] = args;
+  const commandArgs = rest[0] === "--" ? rest.slice(1) : rest;
+  const sourceContext = sourceConsumerProducer() ?? {};
+  const context = { packageRoot: packageRootFromMain(), ...sourceContext };
+  switch (command) {
+    case "install":
+      await installConsumer(commandArgs, context);
+      return;
+    case "status":
+      consumerStatus(commandArgs, context);
+      return;
+    case "check":
+      consumerCheck(commandArgs, context);
+      return;
+    case "restore":
+      restoreConsumer(commandArgs, context);
+      return;
+    default:
+      throw new Error("agentos consumer: choose one of install, status, check, restore");
+  }
 };
 
 const runCheck = async (args) => {
@@ -134,6 +241,9 @@ const runCheck = async (args) => {
       expectNoExtraArgs(rest, "agentos check docs");
       await runGroup("check-docs");
       return;
+    case "effect-scan":
+      runEffectScanGate(rest, { defaultRepoRoot: repoRootFromMain() });
+      return;
     case "effect-manifests":
       expectNoExtraArgs(rest, "agentos check effect-manifests");
       await runGroup("check-effect-manifests");
@@ -170,7 +280,7 @@ const runCheck = async (args) => {
         return;
       }
       throw new Error(
-        "agentos check: choose one of all, default, structural, affected, docs, effect-manifests, release, site, guard-coverage, guard, guards, or an algorithmic checker id",
+        "agentos check: choose one of all, default, structural, affected, docs, effect-scan, effect-manifests, release, site, guard-coverage, guard, guards, or an algorithmic checker id",
       );
   }
 };
@@ -215,6 +325,24 @@ const main = async () => {
     case "build":
       await runBuild(rest);
       return;
+    case "info":
+      await runInfo(rest);
+      return;
+    case "serve":
+      await runServe(rest);
+      return;
+    case "dev":
+      await runDev(rest);
+      return;
+    case "eval":
+      await runEval(rest);
+      return;
+    case "preflight":
+      await runPreflight(rest);
+      return;
+    case "consumer":
+      await runConsumer(rest);
+      return;
     case "check":
       await runCheck(rest);
       return;
@@ -222,7 +350,9 @@ const main = async () => {
       await runGenerate(rest);
       return;
     default:
-      throw new Error("agentos: choose one of build, check, generate");
+      throw new Error(
+        "agentos: choose one of build, info, serve, dev, eval, preflight, consumer, check, generate",
+      );
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yansirplus/cli",
-  "version": "0.5.17",
+  "version": "0.5.18",
   "type": "module",
   "license": "UNLICENSED",
   "publishConfig": {
@@ -19,14 +19,18 @@
   },
   "files": [
     "dist",
+    "agent-catalog",
     "README.md",
     "PUBLIC_API.md"
   ],
   "dependencies": {
-    "@yansirplus/core": "0.5.17",
-    "@yansirplus/runtime": "0.5.17"
+    "@yansirplus/core": "0.5.18",
+    "@yansirplus/evals": "0.5.18",
+    "@yansirplus/runtime": "0.5.18",
+    "esbuild": "0.27.3",
+    "yaml": "2.9.0"
   },
   "peerDependencies": {
-    "effect": "^4.0.0-beta.84"
+    "effect": "4.0.0-beta.84"
   }
 }

package/dist/check/check-coverage.mjs

@@ -1,231 +0,0 @@
-#!/usr/bin/env node
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { listAlgorithmicCheckers } from "./algorithmic-checks.mjs";
-
-const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../../..");
-
-const readJson = (relativePath) =>
-  JSON.parse(fs.readFileSync(path.join(repoRoot, relativePath), "utf8"));
-
-const isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
-
-const failures = [];
-const fail = (message) => failures.push(message);
-
-const coverage = readJson("packages/cli/src/check/check-coverage.source.json");
-const rulesSource = readJson("docs/agent/boundary-rules.source.json");
-const cliPackage = readJson("packages/cli/package.json");
-
-if (coverage.schemaVersion !== 1) fail("check coverage schemaVersion must be 1");
-if (!Array.isArray(coverage.entries) || coverage.entries.length === 0) {
-  fail("check coverage entries must be non-empty");
-}
-
-const rules = new Map((rulesSource.rules ?? []).map((rule) => [rule.id, rule]));
-const algorithmicCheckers = new Set(listAlgorithmicCheckers());
-const coveredRuleIds = new Set();
-const genericPackageNegativeWitness =
-  "package-owned test fails when the owned contract is violated";
-
-const assertProofWitnesses = (label, assertionIndex, assertion) => {
-  const witnesses = assertion.packageWitnesses;
-  if (witnesses === undefined) return;
-  if (!Array.isArray(witnesses) || witnesses.length === 0)
-    fail(`${label}: assertions[${assertionIndex}] packageWitnesses must be non-empty when present`);
-
-  for (const [witnessIndex, witness] of witnesses.entries()) {
-    const witnessLabel = `${label}: assertions[${assertionIndex}].packageWitnesses[${witnessIndex}]`;
-    if (!isRecord(witness)) {
-      fail(`${witnessLabel} must be an object`);
-      continue;
-    }
-    if (typeof witness.file !== "string" || !witness.file.startsWith("packages/")) {
-      fail(`${witnessLabel}.file must be a package test path`);
-      continue;
-    }
-    if (typeof witness.name !== "string" || witness.name.length === 0) {
-      fail(`${witnessLabel}.name must be non-empty`);
-      continue;
-    }
-
-    const absolutePath = path.join(repoRoot, witness.file);
-    if (!fs.existsSync(absolutePath)) {
-      fail(`${witnessLabel}.file does not exist`);
-      continue;
-    }
-    const source = fs.readFileSync(absolutePath, "utf8");
-    const testNamePattern = new RegExp(
-      `\\b(?:describe|it|test)(?:\\.effect)?\\(\\s*(["'\`])${escapeRegExp(witness.name)}\\1`,
-      "u",
-    );
-    if (!testNamePattern.test(source)) {
-      fail(`${witnessLabel}.name was not found as a test or describe name`);
-    }
-  }
-};
-
-for (const [index, entry] of (coverage.entries ?? []).entries()) {
-  const label =
-    isRecord(entry) && typeof entry.ruleId === "string" ? entry.ruleId : `entry[${index}]`;
-  if (!isRecord(entry)) {
-    fail(`${label}: coverage entry must be an object`);
-    continue;
-  }
-  if (!isRecord(entry.source)) fail(`${label}: missing source`);
-  if (!isRecord(entry.target)) fail(`${label}: missing target`);
-  if (!Array.isArray(entry.assertions) || entry.assertions.length === 0) {
-    fail(`${label}: assertions must be non-empty`);
-  } else {
-    for (const [assertionIndex, assertion] of entry.assertions.entries()) {
-      if (!isRecord(assertion)) {
-        fail(`${label}: assertions[${assertionIndex}] must be an object`);
-        continue;
-      }
-      if (
-        typeof assertion.failureCondition !== "string" ||
-        assertion.failureCondition.length === 0
-      ) {
-        fail(`${label}: assertions[${assertionIndex}] missing failureCondition`);
-      }
-      if (typeof assertion.negativeWitness !== "string" || assertion.negativeWitness.length === 0) {
-        fail(`${label}: assertions[${assertionIndex}] missing negativeWitness`);
-      }
-      if (assertion.negativeWitness === genericPackageNegativeWitness) {
-        fail(`${label}: assertions[${assertionIndex}] has generic package negativeWitness`);
-      }
-    }
-  }
-
-  if (typeof entry.ruleId === "string" && entry.ruleId.includes(",")) {
-    for (const ruleId of entry.ruleId.split(",")) coveredRuleIds.add(ruleId);
-  } else if (typeof entry.ruleId === "string") {
-    coveredRuleIds.add(entry.ruleId);
-  }
-
-  if (entry.target?.kind === "algorithmic") {
-    const rule = rules.get(entry.target.ruleId);
-    if (!isRecord(rule)) {
-      fail(`${label}: algorithmic target references unknown rule ${entry.target.ruleId}`);
-    } else if (rule.acceptance?.engine !== "algorithmic") {
-      fail(`${label}: algorithmic target rule must use algorithmic acceptance`);
-    } else if (rule.acceptance.checker !== entry.target.checker) {
-      fail(`${label}: coverage checker ${entry.target.checker} does not match rule acceptance`);
-    }
-    if (!algorithmicCheckers.has(entry.target.checker)) {
-      fail(`${label}: missing algorithmic checker ${entry.target.checker}`);
-    }
-  }
-
-  if (entry.target?.kind === "proofClass") {
-    const rule = rules.get(entry.target.ruleId);
-    if (!isRecord(rule)) {
-      fail(`${label}: proofClass target references unknown rule ${entry.target.ruleId}`);
-    } else if (rule.acceptance?.engine !== "proofClass") {
-      fail(`${label}: proofClass target rule must use proofClass acceptance`);
-    } else {
-      for (const [assertionIndex, assertion] of (entry.assertions ?? []).entries()) {
-        if (isRecord(assertion)) {
-          assertProofWitnesses(label, assertionIndex, assertion);
-        }
-      }
-    }
-  }
-
-  if (entry.target?.kind === "manifestRule") {
-    const rule = rules.get(entry.target.ruleId);
-    if (!isRecord(rule)) {
-      fail(`${label}: manifestRule target references unknown rule ${entry.target.ruleId}`);
-    } else if (rule.acceptance?.engine !== entry.target.engine) {
-      fail(`${label}: manifestRule target engine must match rule acceptance`);
-    }
-  }
-
-  if (typeof entry.ruleId === "string" && !entry.ruleId.includes(",")) {
-    const rule = rules.get(entry.ruleId);
-    if (isRecord(rule) && entry.owner !== rule.owner) {
-      fail(
-        `${label}: coverage owner ${entry.owner} does not match boundary rule owner ${rule.owner}`,
-      );
-    }
-  }
-
-  if (entry.target?.kind === "algorithmic-helper") {
-    for (const checker of entry.target.checkers ?? []) {
-      if (!algorithmicCheckers.has(checker))
-        fail(`${label}: helper references unknown checker ${checker}`);
-    }
-  }
-}
-
-for (const rule of rulesSource.rules ?? []) {
-  if (!coveredRuleIds.has(rule.id)) fail(`${rule.id}: rule lacks check coverage entry`);
-}
-
-const sourceText = fs.readFileSync(
-  path.join(repoRoot, "docs/agent/boundary-rules.source.json"),
-  "utf8",
-);
-if (sourceText.includes("positiveAcceptance")) {
-  fail("docs/agent/boundary-rules.source.json: positiveAcceptance is no longer allowed");
-}
-if (/\s--fix(?:\s|")/u.test(sourceText)) {
-  fail("docs/agent/boundary-rules.source.json: check commands must not include --fix");
-}
-
-const walk = (relativePath) => {
-  const absolutePath = path.join(repoRoot, relativePath);
-  const files = [];
-  for (const entry of fs.readdirSync(absolutePath, { withFileTypes: true })) {
-    const child = path.join(relativePath, entry.name);
-    if (entry.isDirectory()) files.push(...walk(child));
-    if (entry.isFile()) files.push(child.split(path.sep).join("/"));
-  }
-  return files;
-};
-
-const cliMjsFiles = walk("packages/cli/src").filter((file) => file.endsWith(".mjs"));
-const checkMjsFiles = cliMjsFiles.filter((file) => file.startsWith("packages/cli/src/check/"));
-if (cliMjsFiles.length > 19) {
-  fail(`packages/cli/src: expected at most 19 .mjs files; observed ${cliMjsFiles.length}`);
-}
-if (checkMjsFiles.length > 12) {
-  fail(`packages/cli/src/check: expected at most 12 .mjs files; observed ${checkMjsFiles.length}`);
-}
-for (const file of checkMjsFiles) {
-  const content = fs.readFileSync(path.join(repoRoot, file), "utf8");
-  const selfTestFlag = "--" + "self-test";
-  if (content.includes(selfTestFlag)) fail(`${file}: per-checker self-test flag is not allowed`);
-  const harnessPattern = new RegExp(
-    ["mkd" + "te" + "mp", "tm" + "pdir", "Tem" + "por" + "ary", "te" + "mp"].join("|"),
-    "i",
-  );
-  if (file !== "packages/cli/src/check/algorithmic-checks.mjs" && harnessPattern.test(content)) {
-    fail(`${file}: per-checker ad hoc harness is not allowed`);
-  }
-}
-
-const cliDependencies = Object.keys(cliPackage.dependencies ?? {});
-for (const dependency of cliDependencies) {
-  if (
-    dependency === "@effect/cli" ||
-    dependency === "@effect/platform-node" ||
-    dependency === "@effect/printer" ||
-    dependency === "@effect/printer-ansi" ||
-    dependency === "@effect/typeclass"
-  ) {
-    fail(`packages/cli/package.json: removed Effect CLI dependency returned: ${dependency}`);
-  }
-}
-if (cliPackage.dependencies?.effect === "3.21.2") {
-  fail("packages/cli/package.json: Effect v3 CLI dependency returned");
-}
-
-if (failures.length > 0) {
-  console.error(failures.join("\n"));
-  process.exit(1);
-}
-
-console.log("guard coverage passed");