@zivis/cli 0.1.0-alpha.40 → 0.1.0-alpha.41

package/dist/internal/gate-evaluate.d.ts

@@ -0,0 +1,50 @@
+import type { GatePolicy } from "./gate-policy.js";
+export type CheckResult = "pass" | "fail" | "indeterminate";
+export interface GateCheck {
+    type: string;
+    category_id?: string;
+    actual: number | string | boolean | null;
+    required: number | string | boolean;
+    result: CheckResult;
+}
+export interface AssuranceStatusForGate {
+    model: {
+        key: string;
+    };
+    evaluatedAt: string | null;
+    lastEvaluatedGitSha: string | null;
+    overall: {
+        scoreRaw: number | null;
+        coverage: number | null;
+    };
+    categories: Array<{
+        categoryId: string;
+        scoreRaw: number | null;
+        coverage: number | null;
+    }>;
+    risk: {
+        openCritical: number;
+        openHigh: number;
+    };
+}
+export interface MarkForGate {
+    basis: string | null;
+    expired: boolean;
+    revoked: boolean;
+    signature: {
+        verified: boolean;
+    };
+}
+export interface GateEvaluationInput {
+    policy: GatePolicy;
+    status: AssuranceStatusForGate | null;
+    mark: MarkForGate | null;
+    markLookupFailed: boolean;
+    currentGitSha: string | undefined;
+    now: Date;
+}
+export interface GateEvaluationResult {
+    result: "pass" | "fail" | "indeterminate";
+    checks: GateCheck[];
+}
+export declare function evaluateGate(input: GateEvaluationInput): GateEvaluationResult;

package/dist/internal/gate-evaluate.js

@@ -0,0 +1,111 @@
+import { parseDurationMs } from "./gate-policy.js";
+export function evaluateGate(input) {
+    const checks = [];
+    const { policy, status, mark, markLookupFailed, currentGitSha, now } = input;
+    if (!status) {
+        return {
+            result: "indeterminate",
+            checks: [{ type: "assurance_status", actual: null, required: "present", result: "indeterminate" }],
+        };
+    }
+    if (policy.assurance?.overall?.min_score_raw !== undefined) {
+        checks.push(scoreCheck("overall_score", undefined, status.overall.scoreRaw, policy.assurance.overall.min_score_raw));
+    }
+    if (policy.assurance?.overall?.min_coverage !== undefined) {
+        checks.push(scoreCheck("overall_coverage", undefined, status.overall.coverage, policy.assurance.overall.min_coverage));
+    }
+    for (const cat of policy.assurance?.categories ?? []) {
+        const found = status.categories.find((c) => c.categoryId === cat.id);
+        if (cat.min_score_raw !== undefined) {
+            checks.push(scoreCheck("category_score", cat.id, found ? found.scoreRaw : null, cat.min_score_raw));
+        }
+        if (cat.min_coverage !== undefined) {
+            checks.push(scoreCheck("category_coverage", cat.id, found ? found.coverage : null, cat.min_coverage));
+        }
+    }
+    if (policy.risk?.max_open_critical !== undefined) {
+        checks.push(countCeilingCheck("open_critical_risks", status.risk.openCritical, policy.risk.max_open_critical));
+    }
+    if (policy.risk?.max_open_high !== undefined) {
+        checks.push(countCeilingCheck("open_high_risks", status.risk.openHigh, policy.risk.max_open_high));
+    }
+    if (policy.freshness?.max_age !== undefined) {
+        checks.push(freshnessAgeCheck(status.evaluatedAt, policy.freshness.max_age, now));
+    }
+    if (policy.freshness?.require_current_git_sha) {
+        checks.push(freshnessGitShaCheck(status.lastEvaluatedGitSha, currentGitSha));
+    }
+    if (policy.provenance?.allowed_basis !== undefined) {
+        checks.push(provenanceBasisCheck(mark, markLookupFailed, policy.provenance.allowed_basis));
+    }
+    if (policy.provenance?.require_signed_mark) {
+        checks.push(provenanceSignedMarkCheck(mark, markLookupFailed));
+    }
+    const overall = combine(checks);
+    return { result: overall, checks };
+}
+function combine(checks) {
+    if (checks.length === 0)
+        return "pass";
+    if (checks.some((c) => c.result === "indeterminate"))
+        return "indeterminate";
+    if (checks.some((c) => c.result === "fail"))
+        return "fail";
+    return "pass";
+}
+function scoreCheck(type, categoryId, actual, required) {
+    return {
+        type,
+        ...(categoryId ? { category_id: categoryId } : {}),
+        actual,
+        required,
+        result: actual === null ? "indeterminate" : actual >= required ? "pass" : "fail",
+    };
+}
+function countCeilingCheck(type, actual, maxAllowed) {
+    return { type, actual, required: maxAllowed, result: actual <= maxAllowed ? "pass" : "fail" };
+}
+function freshnessAgeCheck(evaluatedAt, maxAge, now) {
+    if (!evaluatedAt) {
+        return { type: "freshness_max_age", actual: null, required: maxAge, result: "indeterminate" };
+    }
+    const maxAgeMs = parseDurationMs(maxAge);
+    if (maxAgeMs === null) {
+        return { type: "freshness_max_age", actual: evaluatedAt, required: maxAge, result: "indeterminate" };
+    }
+    const ageMs = now.getTime() - new Date(evaluatedAt).getTime();
+    return { type: "freshness_max_age", actual: `${Math.round(ageMs / 1000)}s`, required: maxAge, result: ageMs <= maxAgeMs ? "pass" : "indeterminate" };
+}
+function freshnessGitShaCheck(lastEvaluatedGitSha, currentGitSha) {
+    const matches = !!lastEvaluatedGitSha && !!currentGitSha && lastEvaluatedGitSha === currentGitSha;
+    return {
+        type: "freshness_current_git_sha",
+        actual: lastEvaluatedGitSha,
+        required: currentGitSha ?? "HEAD",
+        result: matches ? "pass" : "indeterminate",
+    };
+}
+function provenanceBasisCheck(mark, markLookupFailed, allowedBasis) {
+    if (markLookupFailed) {
+        return { type: "provenance_basis", actual: null, required: allowedBasis.join(","), result: "indeterminate" };
+    }
+    if (!mark || !mark.basis) {
+        return { type: "provenance_basis", actual: null, required: allowedBasis.join(","), result: "fail" };
+    }
+    return {
+        type: "provenance_basis",
+        actual: mark.basis,
+        required: allowedBasis.join(","),
+        result: allowedBasis.includes(mark.basis) ? "pass" : "fail",
+    };
+}
+function provenanceSignedMarkCheck(mark, markLookupFailed) {
+    if (markLookupFailed) {
+        return { type: "provenance_signed_mark", actual: null, required: true, result: "indeterminate" };
+    }
+    if (!mark) {
+        return { type: "provenance_signed_mark", actual: false, required: true, result: "fail" };
+    }
+    const valid = mark.signature.verified && !mark.expired && !mark.revoked;
+    return { type: "provenance_signed_mark", actual: valid, required: true, result: valid ? "pass" : "fail" };
+}

package/dist/internal/gate-policy.d.ts

@@ -0,0 +1,38 @@
+export interface CategoryThreshold {
+    id: string;
+    min_score_raw?: number;
+    min_coverage?: number;
+}
+export interface GatePolicy {
+    source: "current";
+    model: string;
+    scoring_profile?: string;
+    assurance?: {
+        overall?: {
+            min_score_raw?: number;
+            min_coverage?: number;
+        };
+        categories?: CategoryThreshold[];
+    };
+    risk?: {
+        max_open_critical?: number;
+        max_open_high?: number;
+    };
+    freshness?: {
+        max_age?: string;
+        require_current_git_sha?: boolean;
+    };
+    provenance?: {
+        allowed_basis?: string[];
+        require_signed_mark?: boolean;
+    };
+}
+export interface PolicyFile {
+    version: 1;
+    gates: Record<string, GatePolicy>;
+}
+export declare class PolicyValidationError extends Error {
+    constructor(message: string);
+}
+export declare function parsePolicyFile(rawYaml: string): PolicyFile;
+export declare function parseDurationMs(spec: string): number | null;

package/dist/internal/gate-policy.js

@@ -0,0 +1,167 @@
+import * as yaml from "js-yaml";
+export class PolicyValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PolicyValidationError";
+    }
+}
+const TOP_LEVEL_KEYS = new Set(["version", "gates"]);
+const GATE_KEYS = new Set(["source", "model", "scoring_profile", "assurance", "risk", "freshness", "provenance"]);
+const ASSURANCE_KEYS = new Set(["overall", "categories"]);
+const SCORE_KEYS = new Set(["min_score_raw", "min_coverage"]);
+const CATEGORY_KEYS = new Set(["id", "min_score_raw", "min_coverage"]);
+const RISK_KEYS = new Set(["max_open_critical", "max_open_high"]);
+const FRESHNESS_KEYS = new Set(["max_age", "require_current_git_sha"]);
+const PROVENANCE_KEYS = new Set(["allowed_basis", "require_signed_mark"]);
+function rejectUnknown(obj, allowed, where) {
+    for (const key of Object.keys(obj)) {
+        if (!allowed.has(key)) {
+            throw new PolicyValidationError(`Unknown policy field '${where}.${key}' — v1 does not recognize this key.`);
+        }
+    }
+}
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+export function parsePolicyFile(rawYaml) {
+    let doc;
+    try {
+        doc = yaml.load(rawYaml);
+    }
+    catch (err) {
+        throw new PolicyValidationError(`Could not parse policy YAML: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!isPlainObject(doc)) {
+        throw new PolicyValidationError("Policy file must be a YAML mapping at the top level.");
+    }
+    rejectUnknown(doc, TOP_LEVEL_KEYS, "$");
+    if (doc.version !== 1) {
+        throw new PolicyValidationError(`Unsupported policy 'version': ${JSON.stringify(doc.version)} — only version 1 is recognized.`);
+    }
+    if (!isPlainObject(doc.gates)) {
+        throw new PolicyValidationError("Policy file must declare a 'gates' mapping.");
+    }
+    const gates = {};
+    for (const [name, raw] of Object.entries(doc.gates)) {
+        gates[name] = parseGate(name, raw);
+    }
+    return { version: 1, gates };
+}
+function parseGate(name, raw) {
+    if (!isPlainObject(raw)) {
+        throw new PolicyValidationError(`Gate '${name}' must be a YAML mapping.`);
+    }
+    rejectUnknown(raw, GATE_KEYS, `gates.${name}`);
+    if (raw.source !== "current") {
+        throw new PolicyValidationError(`Gate '${name}.source' must be 'current' — only live current-state gates are supported in v1.`);
+    }
+    if (typeof raw.model !== "string" || !raw.model) {
+        throw new PolicyValidationError(`Gate '${name}.model' is required and must be a string.`);
+    }
+    if (raw.scoring_profile !== undefined && typeof raw.scoring_profile !== "string") {
+        throw new PolicyValidationError(`Gate '${name}.scoring_profile' must be a string.`);
+    }
+    const policy = { source: "current", model: raw.model };
+    if (typeof raw.scoring_profile === "string")
+        policy.scoring_profile = raw.scoring_profile;
+    if (raw.assurance !== undefined) {
+        if (!isPlainObject(raw.assurance))
+            throw new PolicyValidationError(`Gate '${name}.assurance' must be a mapping.`);
+        rejectUnknown(raw.assurance, ASSURANCE_KEYS, `gates.${name}.assurance`);
+        policy.assurance = {};
+        if (raw.assurance.overall !== undefined) {
+            if (!isPlainObject(raw.assurance.overall))
+                throw new PolicyValidationError(`Gate '${name}.assurance.overall' must be a mapping.`);
+            rejectUnknown(raw.assurance.overall, SCORE_KEYS, `gates.${name}.assurance.overall`);
+            policy.assurance.overall = parseScoreThreshold(raw.assurance.overall, `${name}.assurance.overall`);
+        }
+        if (raw.assurance.categories !== undefined) {
+            if (!Array.isArray(raw.assurance.categories))
+                throw new PolicyValidationError(`Gate '${name}.assurance.categories' must be a list.`);
+            policy.assurance.categories = raw.assurance.categories.map((c, i) => {
+                if (!isPlainObject(c))
+                    throw new PolicyValidationError(`Gate '${name}.assurance.categories[${i}]' must be a mapping.`);
+                rejectUnknown(c, CATEGORY_KEYS, `gates.${name}.assurance.categories[${i}]`);
+                if (typeof c.id !== "string" || !c.id) {
+                    throw new PolicyValidationError(`Gate '${name}.assurance.categories[${i}].id' is required and must be a string.`);
+                }
+                return { id: c.id, ...parseScoreThreshold(c, `${name}.assurance.categories[${i}]`) };
+            });
+        }
+    }
+    if (raw.risk !== undefined) {
+        if (!isPlainObject(raw.risk))
+            throw new PolicyValidationError(`Gate '${name}.risk' must be a mapping.`);
+        rejectUnknown(raw.risk, RISK_KEYS, `gates.${name}.risk`);
+        policy.risk = {};
+        if (raw.risk.max_open_critical !== undefined)
+            policy.risk.max_open_critical = requireNonNegativeInt(raw.risk.max_open_critical, `${name}.risk.max_open_critical`);
+        if (raw.risk.max_open_high !== undefined)
+            policy.risk.max_open_high = requireNonNegativeInt(raw.risk.max_open_high, `${name}.risk.max_open_high`);
+    }
+    if (raw.freshness !== undefined) {
+        if (!isPlainObject(raw.freshness))
+            throw new PolicyValidationError(`Gate '${name}.freshness' must be a mapping.`);
+        rejectUnknown(raw.freshness, FRESHNESS_KEYS, `gates.${name}.freshness`);
+        policy.freshness = {};
+        if (raw.freshness.max_age !== undefined) {
+            if (typeof raw.freshness.max_age !== "string" || parseDurationMs(raw.freshness.max_age) === null) {
+                throw new PolicyValidationError(`Gate '${name}.freshness.max_age' must be a duration like '14d', '24h', or '30m'.`);
+            }
+            policy.freshness.max_age = raw.freshness.max_age;
+        }
+        if (raw.freshness.require_current_git_sha !== undefined) {
+            if (typeof raw.freshness.require_current_git_sha !== "boolean") {
+                throw new PolicyValidationError(`Gate '${name}.freshness.require_current_git_sha' must be true or false.`);
+            }
+            policy.freshness.require_current_git_sha = raw.freshness.require_current_git_sha;
+        }
+    }
+    if (raw.provenance !== undefined) {
+        if (!isPlainObject(raw.provenance))
+            throw new PolicyValidationError(`Gate '${name}.provenance' must be a mapping.`);
+        rejectUnknown(raw.provenance, PROVENANCE_KEYS, `gates.${name}.provenance`);
+        policy.provenance = {};
+        if (raw.provenance.allowed_basis !== undefined) {
+            if (!Array.isArray(raw.provenance.allowed_basis) || !raw.provenance.allowed_basis.every((b) => typeof b === "string")) {
+                throw new PolicyValidationError(`Gate '${name}.provenance.allowed_basis' must be a list of strings.`);
+            }
+            policy.provenance.allowed_basis = raw.provenance.allowed_basis;
+        }
+        if (raw.provenance.require_signed_mark !== undefined) {
+            if (typeof raw.provenance.require_signed_mark !== "boolean") {
+                throw new PolicyValidationError(`Gate '${name}.provenance.require_signed_mark' must be true or false.`);
+            }
+            policy.provenance.require_signed_mark = raw.provenance.require_signed_mark;
+        }
+    }
+    return policy;
+}
+function parseScoreThreshold(obj, where) {
+    const out = {};
+    if (obj.min_score_raw !== undefined)
+        out.min_score_raw = requireUnitInterval(obj.min_score_raw, `${where}.min_score_raw`);
+    if (obj.min_coverage !== undefined)
+        out.min_coverage = requireUnitInterval(obj.min_coverage, `${where}.min_coverage`);
+    return out;
+}
+function requireUnitInterval(v, where) {
+    if (typeof v !== "number" || Number.isNaN(v) || v < 0 || v > 1) {
+        throw new PolicyValidationError(`'${where}' must be a number between 0.0 and 1.0 (normalized score_raw — never 0-10 or 0-1000).`);
+    }
+    return v;
+}
+function requireNonNegativeInt(v, where) {
+    if (typeof v !== "number" || !Number.isInteger(v) || v < 0) {
+        throw new PolicyValidationError(`'${where}' must be a non-negative integer.`);
+    }
+    return v;
+}
+const DURATION_RE = /^(\d+)(d|h|m)$/;
+const DURATION_UNIT_MS = { d: 86_400_000, h: 3_600_000, m: 60_000 };
+export function parseDurationMs(spec) {
+    const m = DURATION_RE.exec(spec.trim());
+    if (!m)
+        return null;
+    return Number(m[1]) * DURATION_UNIT_MS[m[2]];
+}

package/dist/internal/git-metadata.d.ts

@@ -0,0 +1,8 @@
+export interface GitMetadata {
+    remoteUrl?: string;
+    commitSha?: string;
+    branch?: string;
+}
+export declare function readGitMetadata(rootDir: string): Promise<GitMetadata>;
+export declare function deriveRepoFullNameFromRemote(remoteUrl: string | undefined): string | undefined;
+export declare function deriveRepoNameFromGit(remoteUrl: string | undefined, rootDir: string): string | undefined;

package/dist/internal/git-metadata.js

@@ -0,0 +1,38 @@
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+import * as path from "node:path";
+const execAsync = promisify(exec);
+export async function readGitMetadata(rootDir) {
+    return {
+        remoteUrl: await tryGit(rootDir, "remote get-url origin"),
+        commitSha: await tryGit(rootDir, "rev-parse HEAD"),
+        branch: await tryGit(rootDir, "rev-parse --abbrev-ref HEAD"),
+    };
+}
+async function tryGit(cwd, args) {
+    try {
+        const { stdout } = await execAsync(`git ${args}`, { cwd });
+        const value = stdout.trim();
+        return value || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function deriveRepoFullNameFromRemote(remoteUrl) {
+    if (!remoteUrl)
+        return undefined;
+    const m = /[:/]([^/:]+)\/([^/]+?)(?:\.git)?$/.exec(remoteUrl);
+    if (!m)
+        return undefined;
+    return `${m[1]}/${m[2]}`;
+}
+export function deriveRepoNameFromGit(remoteUrl, rootDir) {
+    if (remoteUrl) {
+        const m = /[/:]([^/:]+?)\/([^/]+?)(?:\.git)?$/.exec(remoteUrl);
+        if (m)
+            return m[2];
+    }
+    const base = path.basename(rootDir);
+    return base && base !== "." ? base : undefined;
+}

package/dist/internal/git.d.ts

@@ -0,0 +1,8 @@
+export interface GitMetadata {
+    remoteUrl?: string;
+    commitSha?: string;
+    branch?: string;
+    dirty?: boolean;
+}
+export declare function readGitMetadata(rootDir?: string): Promise<GitMetadata>;
+export declare function getCurrentGitSha(rootDir?: string): Promise<string | undefined>;

package/dist/internal/git.js

@@ -0,0 +1,30 @@
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+const execAsync = promisify(exec);
+export async function readGitMetadata(rootDir = process.cwd()) {
+    const [remoteUrl, commitSha, branch, statusOutput] = await Promise.all([
+        tryGit(rootDir, "remote get-url origin"),
+        tryGit(rootDir, "rev-parse HEAD"),
+        tryGit(rootDir, "rev-parse --abbrev-ref HEAD"),
+        tryGit(rootDir, "status --porcelain"),
+    ]);
+    return {
+        remoteUrl,
+        commitSha,
+        branch,
+        dirty: statusOutput === undefined ? undefined : statusOutput.length > 0,
+    };
+}
+export async function getCurrentGitSha(rootDir = process.cwd()) {
+    return tryGit(rootDir, "rev-parse HEAD");
+}
+async function tryGit(cwd, args) {
+    try {
+        const { stdout } = await execAsync(`git ${args}`, { cwd });
+        const value = stdout.trim();
+        return value || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/internal/ide-setup.d.ts

@@ -5,6 +5,7 @@ export interface GuidanceOptions {
     client: GuidanceClient;
 }
 export declare function writeGuidance(opts: GuidanceOptions): string[];
+export declare function removeGuidance(opts: GuidanceOptions): string[];
 export declare function detectIdesInRepo(cwd: string): GuidanceClient[];
 export declare function setupCursor(pkg?: Package): Promise<void>;
 export declare function setupCursorWorkspace(pkg?: Package): Promise<void>;

package/dist/internal/ide-setup.js

@@ -27,6 +27,19 @@ function appendBlock(filePath, blockKey, content) {
 function escapeRegex(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function removeBlockFrom(filePath, blockKey) {
+    if (!fs.existsSync(filePath))
+        return false;
+    const begin = `<!-- BEGIN ZIVIS:${blockKey} -->`;
+    const end = `<!-- END ZIVIS:${blockKey} -->`;
+    const blockRegex = new RegExp(`\\n?${escapeRegex(begin)}[\\s\\S]*?${escapeRegex(end)}\\n?`, "g");
+    const existing = fs.readFileSync(filePath, "utf-8");
+    if (!blockRegex.test(existing))
+        return false;
+    const stripped = existing.replace(blockRegex, "\n").replace(/\n{3,}/g, "\n\n");
+    fs.writeFileSync(filePath, stripped);
+    return true;
+}
 function cursorRuleContent() {
     return `---
 description: ZIVIS security guidance — quietly suggest security checks at the right moments
@@ -112,21 +125,14 @@ might break in", "security plan", "categories of attacks".
 <!-- END ZIVIS:guidance -->`;
 }
 function claudeBlockContent() {
-    return `## ZIVIS Security (MCP)
-
-ZIVIS is connected to this project. Use its tools sparingly — only for security-related topics.
+    return `## ZIVIS
 
-**When to use ZIVIS:**
-- User asks "is this secure" / "check for vulnerabilities" / "audit my deps" → call \`zivis_get_started\` first
-- User adds a new npm/pip/go package → offer to call \`zivis_check_repo_trust\` (no auth needed)
-- User adds openai/anthropic/langchain import → offer to call \`zivis_setup_red_team_target\` (target_type=ai_chat)
-- User mentions "launch", "audit", "compliance", "pen test" → call \`zivis_get_started\` with concern=<their phrase>
+ZIVIS is connected to this project via the \`zivis\` CLI — one agent-neutral command surface, not IDE-specific tooling.
 
-**When NOT to use:** refactors, performance, styling, tests, business logic, anything non-security.
-
-**Vocabulary:** Don't use "threat model", "STRIDE", "attack vector", "kill chain" unless user does.
-
-**Slash commands:** /zivis-getting-started  /zivis-secure-my-app  /zivis-audit-dependencies  /zivis-prep-for-launch`;
+- Asked to security test or review this repo → run \`zivis test\` (or \`zivis test <scope>\` for a focused pass; \`zivis test --list\` shows available scopes) and follow the guidance it returns.
+- Asked to threat model this repo → run \`zivis threatmodel\` and follow the guidance it returns.
+- Use your own repo understanding, reasoning, and shell/tools/browser access as needed — these commands are a starting point, not a substitute for judgment.
+- Do not treat their output alone as a confirmed finding; verify before reporting.`;
 }
 function ruleFileContent() {
     return `# ZIVIS Security Guidance
@@ -191,10 +197,8 @@ function writeClaudeBlockGuidance(cwd) {
     appendBlock(claudePath, "zivis-security", claudeBlockContent());
     written.push(claudePath);
     const agentsPath = path.join(cwd, "AGENTS.md");
-    if (fs.existsSync(agentsPath)) {
-        appendBlock(agentsPath, "zivis-security", claudeBlockContent());
-        written.push(agentsPath);
-    }
+    appendBlock(agentsPath, "zivis-security", claudeBlockContent());
+    written.push(agentsPath);
     return written;
 }
 function writeCopilotGuidance(cwd) {
@@ -221,8 +225,14 @@ export function writeGuidance(opts) {
     switch (client) {
         case "cursor": {
             written.push(writeCursorGuidance(cwd));
-            const extraPaths = writeClaudeBlockGuidance(cwd).filter((p) => fs.existsSync(p));
-            written.push(...extraPaths);
+            const claudePath = path.join(cwd, "CLAUDE.md");
+            appendBlock(claudePath, "zivis-security", claudeBlockContent());
+            written.push(claudePath);
+            const agentsPath = path.join(cwd, "AGENTS.md");
+            if (fs.existsSync(agentsPath)) {
+                appendBlock(agentsPath, "zivis-security", claudeBlockContent());
+                written.push(agentsPath);
+            }
             break;
         }
         case "claude-code-cli":
@@ -245,6 +255,53 @@ export function writeGuidance(opts) {
     }
     return written.filter(Boolean);
 }
+export function removeGuidance(opts) {
+    const { cwd, client } = opts;
+    const changed = [];
+    const unlinkIfExists = (p) => {
+        if (fs.existsSync(p)) {
+            fs.unlinkSync(p);
+            changed.push(p);
+        }
+    };
+    switch (client) {
+        case "cursor": {
+            unlinkIfExists(path.join(cwd, ".cursor", "rules", "zivis.mdc"));
+            if (removeBlockFrom(path.join(cwd, "CLAUDE.md"), "zivis-security")) {
+                changed.push(path.join(cwd, "CLAUDE.md"));
+            }
+            if (removeBlockFrom(path.join(cwd, "AGENTS.md"), "zivis-security")) {
+                changed.push(path.join(cwd, "AGENTS.md"));
+            }
+            break;
+        }
+        case "claude-code-cli":
+        case "vscode-claude": {
+            if (removeBlockFrom(path.join(cwd, "CLAUDE.md"), "zivis-security")) {
+                changed.push(path.join(cwd, "CLAUDE.md"));
+            }
+            if (removeBlockFrom(path.join(cwd, "AGENTS.md"), "zivis-security")) {
+                changed.push(path.join(cwd, "AGENTS.md"));
+            }
+            break;
+        }
+        case "vscode-copilot": {
+            if (removeBlockFrom(path.join(cwd, ".github", "copilot-instructions.md"), "zivis-security")) {
+                changed.push(path.join(cwd, ".github", "copilot-instructions.md"));
+            }
+            break;
+        }
+        case "cline": {
+            unlinkIfExists(path.join(cwd, ".clinerules"));
+            break;
+        }
+        case "windsurf": {
+            unlinkIfExists(path.join(cwd, ".windsurfrules"));
+            break;
+        }
+    }
+    return changed;
+}
 export function detectIdesInRepo(cwd) {
     const found = [];
     if (fs.existsSync(path.join(cwd, ".cursor"))) {

package/dist/internal/inventory-sync.d.ts

@@ -0,0 +1,74 @@
+export interface InventorySyncEndpoint {
+    path: string;
+    method: string;
+    summary?: string;
+    description?: string;
+    authRequired?: boolean;
+    tags?: string[];
+    deprecated?: boolean;
+}
+export interface InventorySyncFeature {
+    name: string;
+    description?: string;
+    criticality?: "critical" | "high" | "medium" | "low";
+    endpoints?: string[];
+    tags?: string[];
+}
+export interface InventorySyncInput {
+    endpoints?: InventorySyncEndpoint[];
+    features?: InventorySyncFeature[];
+    technologyStack?: string[];
+}
+export interface InventorySyncProvenance {
+    gitCommitSha?: string | null;
+    repoFullName?: string | null;
+    defaultBranch?: string | null;
+    source: "cli" | "agent";
+}
+export type ValidationResult = {
+    ok: true;
+    value: InventorySyncInput;
+} | {
+    ok: false;
+    errors: string[];
+};
+export declare function validateInventorySyncInput(raw: unknown): ValidationResult;
+export interface EndpointReconcileResult {
+    created: number;
+    updated: number;
+    deprecated: number;
+    total: number;
+}
+export interface FeatureReconcileResult {
+    created: number;
+    updated: number;
+    deprecated: number;
+    endpointsLinked: number;
+    filesLinked: number;
+}
+export interface TechStackResult {
+    id: string;
+    techStack: string[];
+}
+export interface RepoSyncResult {
+    created: boolean;
+    repoFullName: string;
+}
+export interface InventorySyncSummary {
+    endpoints?: EndpointReconcileResult;
+    features?: FeatureReconcileResult;
+    technologyStack?: {
+        count: number;
+    };
+    repo?: RepoSyncResult;
+}
+export interface InventorySyncApi {
+    put<T>(path: string, body: unknown): Promise<T>;
+    post<T>(path: string, body: unknown): Promise<T>;
+}
+export declare function syncApplicationInventory(params: {
+    client: InventorySyncApi;
+    applicationId: string;
+    input: InventorySyncInput;
+    provenance: InventorySyncProvenance;
+}): Promise<InventorySyncSummary>;