activate-agentmd 2.4.0

package/src/commands/telemetry.js

@@ -0,0 +1,82 @@
+/**
+ * telemetry.js (command)
+ *
+ * Handles: agentmd telemetry [--enable|--disable|--status]
+ *
+ * Shows exactly what would be sent, as a rendered example rather than a
+ * promise. "Anonymous usage data" means nothing to a developer deciding
+ * whether to turn it on; the actual JSON means everything.
+ */
+
+"use strict";
+
+const pc = require("picocolors");
+const t = require("../lib/telemetry");
+const { cmd } = require("../lib/invocation");
+
+const A = cmd();
+
+/** The real payload for a real event, built by the real code path. */
+function samplePayload() {
+  return t.sanitise({
+    event: t.EVENTS.COMMAND_RUN,
+    command: "link",
+    ok: true,
+    durationBucket: "<1s",
+    cliVersion: require("../../package.json").version,
+    nodeMajor: process.versions.node.split(".")[0],
+    platform: process.platform,
+    ci: !!process.env.CI,
+    anonymousId: t.readSettings().anonymousId || "3f2a…-generated-on-opt-in",
+    sentAt: new Date().toISOString(),
+    // Deliberately passed and deliberately dropped by the allowlist, to prove
+    // the filter is real rather than a claim in a readme.
+    cwd: process.cwd(),
+    repo: "acme/private-thing",
+  });
+}
+
+function telemetry(args) {
+  args = args || [];
+  const has = (name) => args.includes(`--${name}`);
+
+  if (has("enable")) {
+    const settings = t.enable();
+    console.log(`\n  ${pc.green("✓")} Telemetry on. ${pc.dim(`Anonymous id ${settings.anonymousId.slice(0, 8)}… · ${t.settingsPath()}`)}`);
+    console.log(pc.dim(`     Thank you — it decides which platforms and commands keep getting work.`));
+    console.log(pc.dim(`     Off again any time with '${A} telemetry --disable'.\n`));
+    return;
+  }
+
+  if (has("disable")) {
+    t.disable();
+    console.log(`\n  ${pc.green("✓")} Telemetry off. ${pc.dim("The anonymous id has been deleted, not just disabled.")}\n`);
+    return;
+  }
+
+  const on = t.isEnabled();
+  const envOverride =
+    process.env.DO_NOT_TRACK || process.env.DONT_TRACK ? "DO_NOT_TRACK is set in your environment"
+    : process.env.AGENTMD_TELEMETRY_DISABLED ? "AGENTMD_TELEMETRY_DISABLED is set"
+    : process.env.AGENTMD_TELEMETRY ? `AGENTMD_TELEMETRY=${process.env.AGENTMD_TELEMETRY}` : null;
+
+  console.log(`\n  Telemetry is ${on ? pc.green("on") : pc.white("off")}${envOverride ? pc.dim(` — ${envOverride}`) : ""}`);
+  console.log(pc.dim(`  ${on ? "Opted in" : "Off by default. Nothing has been sent."} · ${t.settingsPath()}`));
+
+  console.log(pc.bold("\n  What one event looks like\n"));
+  for (const line of JSON.stringify(samplePayload(), null, 2).split("\n")) console.log("    " + pc.dim(line));
+
+  console.log(pc.bold("\n  What is never in it\n"));
+  for (const item of [
+    "file paths, repository names, branch names",
+    "package names, standards you installed, diffs, findings",
+    "your license key, email, username or hostname",
+  ]) console.log(`    ${pc.dim("·")} ${pc.dim(item)}`);
+
+  console.log(pc.dim(`\n  The payload is built from an allowlist (${t.ALLOWED_FIELDS.length} fields) in src/lib/telemetry.js —`));
+  console.log(pc.dim("  a field that is not named there cannot be sent, including the two the"));
+  console.log(pc.dim("  sample above tries to pass in.\n"));
+  console.log(pc.dim(`  ${A} telemetry --enable   ·   ${A} telemetry --disable\n`));
+}
+
+module.exports = { telemetry, samplePayload };

package/src/commands/test.js

@@ -0,0 +1,226 @@
+/**
+ * test.js
+ *
+ * `agentmd test` — measures whether a model actually obeys the installed
+ * standards, instead of hoping it does. For each standard: generate a few
+ * tasks a developer would plausibly ask, have the model attempt them with
+ * the standard in its system prompt, then judge each attempt strictly
+ * against the standard's rules.
+ *
+ *   agentmd test                          3 most recently installed standards
+ *   agentmd test Security/jwt API/rest    specific standards
+ *   agentmd test --all --tasks 5          every installed standard, 5 tasks each
+ *   agentmd test --fail-under 80          exit 1 below 80% (CI)
+ *   agentmd test --json                   machine-readable results
+ *
+ * Needs ANTHROPIC_API_KEY (or an `ant auth login` profile). Costs real API
+ * calls: roughly N+2 per standard.
+ */
+
+"use strict";
+
+const fs = require("fs");
+const pc = require("picocolors");
+const { readManifest, resolvePresetPath } = require("../lib/manifest");
+const { cmd } = require("../lib/invocation");
+
+const A = cmd();
+const DEFAULT_MODEL = process.env.AGENTMD_REVIEW_MODEL || "claude-opus-5";
+const CONCURRENCY = 4;
+// ponytail: opus-5 list price; other models will estimate wrong, hence "estimate".
+const PRICE = { input: 5 / 1e6, output: 25 / 1e6 };
+
+function flagValue(args, name) {
+  const withEq = args.find((a) => a.startsWith(`--${name}=`));
+  if (withEq) return withEq.slice(name.length + 3);
+  const i = args.indexOf(`--${name}`);
+  return i !== -1 && args[i + 1] && !args[i + 1].startsWith("--") ? args[i + 1] : null;
+}
+
+/** Positional args: anything that isn't a flag or a flag's value. */
+function positionals(args) {
+  const out = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a.startsWith("--")) {
+      if (!a.includes("=") && ["tasks", "model", "fail-under"].includes(a.slice(2))) i++;
+      continue;
+    }
+    out.push(a);
+  }
+  return out;
+}
+
+function parseJSON(text) {
+  const m = /\{[\s\S]*\}/.exec(text);
+  if (!m) return null;
+  try { return JSON.parse(m[0]); } catch { return null; }
+}
+
+/** Run `fn` over items with at most `limit` in flight. */
+async function pool(items, limit, fn) {
+  const results = new Array(items.length);
+  let next = 0;
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, async () => {
+    while (next < items.length) {
+      const i = next++;
+      results[i] = await fn(items[i], i);
+    }
+  }));
+  return results;
+}
+
+function pickStandards(cwd, manifest, ids, all) {
+  let presets = manifest.presets;
+  if (ids.length) {
+    const want = ids.map((s) => s.toLowerCase());
+    presets = presets.filter((p) => want.includes(`${p.category}/${p.preset}`.toLowerCase()));
+    const missing = ids.filter((id) => !presets.some((p) => `${p.category}/${p.preset}`.toLowerCase() === id.toLowerCase()));
+    if (missing.length) {
+      console.error(pc.red(`Not installed: ${missing.join(", ")}`));
+      console.error(pc.dim(`  See what is installed with '${A} list --installed'.`));
+      process.exit(2);
+    }
+  } else if (!all) {
+    presets = presets.slice().sort((a, b) => String(b.installedAt || "").localeCompare(String(a.installedAt || ""))).slice(0, 3);
+  }
+  return presets.map((p) => {
+    let text = "";
+    try { text = fs.readFileSync(resolvePresetPath(cwd, p.file), "utf-8"); } catch {}
+    return { id: `${p.category}/${p.preset}`, text };
+  }).filter((s) => s.text);
+}
+
+async function test(args) {
+  args = args || [];
+  const cwd = process.cwd();
+  const all = args.includes("--all");
+  const asJson = args.includes("--json");
+  const model = flagValue(args, "model") || DEFAULT_MODEL;
+  const tasksPer = Math.min(6, Math.max(1, parseInt(flagValue(args, "tasks") || "3", 10) || 3));
+  const failUnder = flagValue(args, "fail-under");
+  if (failUnder !== null && !(Number(failUnder) >= 0 && Number(failUnder) <= 100)) {
+    console.error(pc.red("--fail-under must be a percentage between 0 and 100"));
+    process.exit(2);
+  }
+
+  const manifest = readManifest(cwd);
+  if (manifest.presets.length === 0) {
+    console.log(pc.yellow("\nNo packages installed — nothing to test."));
+    console.log(pc.dim(`  Run '${A} init' first.\n`));
+    return;
+  }
+  const standards = pickStandards(cwd, manifest, positionals(args), all);
+  if (standards.length === 0) {
+    console.log(pc.yellow("\nInstalled package files are missing on disk."));
+    console.log(pc.dim(`  Run '${A} update' to restore them.\n`));
+    process.exit(2);
+  }
+
+  let Anthropic;
+  try { Anthropic = require("@anthropic-ai/sdk"); } catch {
+    console.error(pc.red("@anthropic-ai/sdk is not installed — reinstall activate-agentmd."));
+    process.exit(2);
+  }
+  const client = new Anthropic();
+  const usage = { input: 0, output: 0 };
+
+  async function call(systemBlocks, user, maxTokens) {
+    let response;
+    try {
+      response = await client.beta.messages.create({
+        model,
+        max_tokens: maxTokens,
+        betas: ["server-side-fallback-2026-07-01"],
+        fallbacks: "default",
+        system: systemBlocks,
+        messages: [{ role: "user", content: user }],
+      });
+    } catch (e) {
+      if (e instanceof Anthropic.AuthenticationError || /authentication method|api ?key/i.test(e.message)) {
+        console.error(pc.red("No API credentials. Set ANTHROPIC_API_KEY (or run `ant auth login`) and try again."));
+      } else if (e instanceof Anthropic.RateLimitError) console.error(pc.red("Rate limited — retry in a moment."));
+      else console.error(pc.red(`Test failed: ${e.message}`));
+      process.exit(2);
+    }
+    if (response.stop_reason === "refusal") {
+      console.error(pc.red("The model declined a request" + (response.stop_details?.explanation ? `: ${response.stop_details.explanation}` : ".")));
+      process.exit(2);
+    }
+    usage.input += (response.usage?.input_tokens || 0) + (response.usage?.cache_read_input_tokens || 0) + (response.usage?.cache_creation_input_tokens || 0);
+    usage.output += response.usage?.output_tokens || 0;
+    return response.content.filter((b) => b.type === "text").map((b) => b.text).join("\n");
+  }
+
+  if (!asJson) console.log(pc.bold(`\nRule efficacy — ${standards.length} standard${standards.length === 1 ? "" : "s"} × ${tasksPer} task${tasksPer === 1 ? "" : "s"}`) + pc.dim(`  (${model})\n`));
+
+  const report = [];
+  for (const s of standards) {
+    // The standard is the stable prefix across all three phases; cache it.
+    const standardBlock = { type: "text", text: `<standard id="${s.id}">\n${s.text}\n</standard>`, cache_control: { type: "ephemeral" } };
+
+    // a. Tasks a model unaware of the standard would plausibly get wrong.
+    const gen = parseJSON(await call(
+      [{ type: "text", text: "You design tests for coding standards. Given a standard, write short, realistic coding tasks a developer might ask an AI coding agent. Each task must be phrased naturally (no hint that a rule exists) and chosen so that an agent unaware of the standard would plausibly violate one specific rule in it. Reply with JSON only: {\"tasks\":[{\"task\":\"...\",\"targets\":\"exact rule heading\"}]}." }, standardBlock],
+      `Write ${tasksPer} tasks.`, 4000));
+    const tasks = Array.isArray(gen?.tasks) ? gen.tasks.slice(0, tasksPer) : [];
+    if (tasks.length === 0) {
+      report.push({ id: s.id, tasks: [], results: [], error: "could not generate tasks" });
+      if (!asJson) console.log(`  ${pc.yellow("?")} ${pc.white(s.id.padEnd(24))} ${pc.dim("could not generate tasks")}`);
+      continue;
+    }
+
+    // b. Attempts, with the standard exposed exactly as `link` would.
+    const attempts = await pool(tasks, CONCURRENCY, (t) => call(
+      [{ type: "text", text: "You are a coding agent working in this project. Follow the project's engineering standard below. Reply with code and the minimum prose needed." }, standardBlock],
+      t.task, 8000));
+
+    // c. Judge strictly against the standard.
+    const transcript = tasks.map((t, i) => `<task n="${i + 1}" targets="${String(t.targets).replace(/"/g, "'")}">\n${t.task}\n</task>\n<attempt n="${i + 1}">\n${attempts[i]}\n</attempt>`).join("\n\n");
+    const judged = parseJSON(await call(
+      [{ type: "text", text: "You are a strict reviewer. Judge each attempt only against the rules in the standard — not general code quality, not taste. An attempt passes if it does not violate the standard. Reply with JSON only: {\"results\":[{\"task\":1,\"pass\":true,\"rule\":\"exact rule heading\",\"reason\":\"one sentence\"}]}. Cite the rule broken (or, on a pass, the rule most relevant)." }, standardBlock],
+      transcript, 4000));
+    const results = tasks.map((t, i) => {
+      const r = Array.isArray(judged?.results) ? judged.results.find((x) => Number(x.task) === i + 1) : null;
+      return { task: i + 1, prompt: t.task, targets: t.targets, pass: r ? !!r.pass : false, rule: r?.rule || t.targets, reason: r?.reason || "no verdict from judge" };
+    });
+    report.push({ id: s.id, tasks, results });
+
+    if (!asJson) {
+      const passed = results.filter((r) => r.pass).length;
+      const ok = passed === results.length;
+      console.log(`  ${ok ? pc.green("✓") : pc.red("✗")} ${pc.white(s.id.padEnd(24))} ${passed}/${results.length}`);
+      for (const r of results.filter((x) => !x.pass)) {
+        console.log(`  ${" ".repeat(30)}${pc.dim(`task ${r.task}: ignored "${r.rule}" — ${r.reason}`)}`);
+      }
+    }
+  }
+
+  const total = report.reduce((n, r) => n + r.results.length, 0);
+  const passed = report.reduce((n, r) => n + r.results.filter((x) => x.pass).length, 0);
+  const pct = total ? Math.round((passed / total) * 100) : 0;
+  const cost = usage.input * PRICE.input + usage.output * PRICE.output;
+
+  if (asJson) {
+    console.log(JSON.stringify({ model, score: { passed, total, pct }, standards: report, usage, estimatedCostUsd: +cost.toFixed(4) }, null, 2));
+  } else {
+    console.log("");
+    console.log(pc.bold(`Score: ${passed}/${total} (${pct}%)`));
+    for (const r of report) {
+      const failed = r.results.filter((x) => !x.pass);
+      if (!failed.length) continue;
+      const counts = {};
+      for (const f of failed) counts[f.rule] = (counts[f.rule] || 0) + 1;
+      const worst = Object.entries(counts).sort((a, b) => b[1] - a[1])[0][0];
+      console.log(pc.yellow(`  ${r.id}: tighten "${worst}" with an explicit negative constraint (state what must never be done, not only what should).`));
+    }
+    console.log(pc.dim(`\n  ~$${cost.toFixed(2)} estimated (${usage.input} in / ${usage.output} out tokens at ${DEFAULT_MODEL} list price)\n`));
+  }
+
+  if (failUnder !== null && pct < Number(failUnder)) {
+    console.error(pc.red(`  Score ${pct}% is below --fail-under ${failUnder}% — failing.\n`));
+    process.exit(1);
+  }
+}
+
+module.exports = { test };

package/src/commands/update.js

@@ -0,0 +1,115 @@
+/**
+ * update.js
+ *
+ * Handles: agentmd update [--dry] [--force]
+ *
+ * Pulls the current registry content for every installed package.
+ *
+ * Locally edited files are NOT overwritten unless --force. Presets are
+ * instructions a developer may well have tuned for their codebase; silently
+ * replacing that on a routine `update` would be a data-loss bug.
+ */
+
+"use strict";
+
+const fs = require("fs");
+const pc = require("picocolors");
+const { readManifest, writeManifest } = require("../lib/manifest");
+const { checkAll } = require("../lib/status");
+const { formatDiff, stat } = require("../lib/diff");
+const { cmd } = require("../lib/invocation");
+
+/** How the user invoked us — "npx activate-agentmd" or "agentmd". */
+const A = cmd();
+
+async function update(args) {
+  args = args || [];
+  const dry = args.includes("--dry");
+  const force = args.includes("--force");
+
+  const cwd = process.cwd();
+  const manifest = readManifest(cwd);
+
+  if (manifest.presets.length === 0) {
+    console.log(pc.yellow("\nNo packages installed — nothing to update."));
+    console.log(pc.dim(`  Run '${A} init' to get recommendations for this project.\n`));
+    return;
+  }
+
+  // Extracted (local/) packages have no upstream to pull from.
+  const registryPresets = manifest.presets.filter((p) => p.source !== "local");
+  for (const p of manifest.presets.filter((p) => p.source === "local")) console.log(`  ${pc.dim("·")}  ${p.id} — ${pc.dim("local — managed by extract")}`);
+
+  console.log(pc.dim(`\nChecking ${registryPresets.length} package${registryPresets.length === 1 ? "" : "s"}…\n`));
+
+  const results = await checkAll(cwd, registryPresets);
+  const tally = { updated: 0, current: 0, skipped: 0, failed: 0 };
+
+  for (const result of results) {
+    const { entry, state } = result;
+
+    if (state === "current" || state === "modified") {
+      tally.current++;
+      continue;
+    }
+    if (state === "failed" || state === "removed") {
+      console.log(pc.red(`  ✗  ${entry.id} — ${result.error || "no longer in the registry"}`));
+      tally.failed++;
+      continue;
+    }
+    if (state === "conflict" && !force) {
+      console.log(pc.yellow(`  !  ${entry.id} — edited locally and updated upstream; left alone`));
+      // The conflict case is the one where seeing the diff matters most: it is
+      // the only decision `update` cannot make for you.
+      if (dry) {
+        const preview = formatDiff(result.localContent, result.remoteContent);
+        if (preview) console.log(preview + "\n");
+      }
+      tally.skipped++;
+      continue;
+    }
+
+    // outdated, missing, or a forced conflict
+    if (dry) {
+      const { added, removed } = stat(result.localContent || "", result.remoteContent);
+      console.log(
+        pc.yellow(`  ↑  ${entry.id}`) +
+          pc.dim(`  v${entry.version || "?"} → v${result.remote.version}  `) +
+          pc.green(`+${added}`) +
+          " " +
+          pc.red(`-${removed}`) +
+          (state === "missing" ? pc.dim("  (file missing locally)") : "")
+      );
+      const preview = formatDiff(result.localContent || "", result.remoteContent);
+      if (preview) console.log(preview + "\n");
+      tally.updated++;
+      continue;
+    }
+
+    fs.writeFileSync(result.filePath, result.remoteContent, "utf-8");
+    entry.checksum = result.remoteSum;
+    entry.version = result.remote.version;
+    entry.updatedAt = new Date().toISOString();
+    console.log(pc.green(`  ✓  ${entry.id} — updated`));
+    tally.updated++;
+  }
+
+  if (!dry && tally.updated > 0) writeManifest(cwd, manifest);
+
+  console.log("");
+  console.log(
+    pc.bold(`${tally.updated} ${dry ? "would update" : "updated"}`) +
+      pc.dim(`, ${tally.current} current`) +
+      (tally.skipped ? pc.yellow(`, ${tally.skipped} skipped`) : "") +
+      (tally.failed ? pc.red(`, ${tally.failed} failed`) : "")
+  );
+
+  if (dry && tally.updated > 0) console.log(pc.dim(`  Run '${A} update' to apply.`));
+  if (tally.skipped > 0) console.log(pc.dim(`  Overwrite local edits with '${A} update --force'.`));
+  if (!dry && tally.updated > 0) console.log(pc.dim(`  Run '${A} link' to refresh your agent config files.`));
+  console.log("");
+
+  if (tally.failed > 0) process.exitCode = 1;
+}
+
+module.exports = { update };

package/src/commands/validate.js

@@ -0,0 +1,125 @@
+/**
+ * validate.js
+ *
+ * Handles: agentmd validate
+ *
+ * Checks the registry index the CLI ships with for internal consistency, and
+ * checks this project's manifest against it. Offline — no network needed —
+ * so CI can run it on every push.
+ *
+ * Exits non-zero on any error, so it can gate a release.
+ */
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const pc = require("picocolors");
+const { getAllPresets, listModels, listCategories, getCategoryPresets } = require("../lib/registry");
+const { RECOMMENDATIONS, BASELINE } = require("../lib/detect");
+const { getPreset } = require("../lib/registry");
+const { readManifest } = require("../lib/manifest");
+
+const SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9 ._-]*$/;
+
+function validate() {
+  const errors = [];
+  const warnings = [];
+  let checked = 0;
+
+  for (const model of listModels()) {
+    for (const entry of getAllPresets(model)) {
+      checked++;
+
+      if (!SAFE_NAME.test(entry.preset)) errors.push(`${entry.id}: unsafe package name`);
+      if (!SAFE_NAME.test(entry.category)) errors.push(`${entry.id}: unsafe category name`);
+      if (entry.preset !== entry.preset.trim() || entry.category !== entry.category.trim()) {
+        errors.push(`${entry.id}: name has leading or trailing whitespace`);
+      }
+      if (!entry.file || entry.file.includes("/") || entry.file.includes("\\") || entry.file.includes("..")) {
+        errors.push(`${entry.id}: invalid file "${entry.file}"`);
+      }
+      if (!entry.file || !entry.file.toLowerCase().endsWith(".md")) {
+        errors.push(`${entry.id}: file is not markdown`);
+      }
+      if (!entry.version) errors.push(`${entry.id}: missing version`);
+      if (!entry.url.startsWith("https://")) errors.push(`${entry.id}: URL is not HTTPS`);
+      if (!entry.bytes) errors.push(`${entry.id}: empty preset`);
+
+      if (!entry.description) warnings.push(`${entry.id}: no description (hurts search)`);
+    }
+  }
+
+  // Coordinates resolve by normalized form (lowercase, separators stripped) so
+  // the website's slugified URLs work as install commands. That only stays
+  // unambiguous while no two names normalize alike — check it, rather than
+  // assume it holds as packages are added.
+  const normalize = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
+  for (const model of listModels()) {
+    const categories = listCategories(model);
+    const seenCategory = new Map();
+    for (const category of categories) {
+      const key = normalize(category);
+      if (seenCategory.has(key)) {
+        errors.push(`${model}: categories "${category}" and "${seenCategory.get(key)}" are ambiguous once slugified`);
+      }
+      seenCategory.set(key, category);
+
+      const seenPreset = new Map();
+      for (const entry of getCategoryPresets(model, category)) {
+        const presetKey = normalize(entry.preset);
+        if (seenPreset.has(presetKey)) {
+          errors.push(`${entry.id}: ambiguous with "${seenPreset.get(presetKey)}" once slugified`);
+        }
+        seenPreset.set(presetKey, entry.preset);
+      }
+    }
+  }
+
+  // Every recommendation the stack detector can emit must resolve, or `init`
+  // would promise a package that cannot be installed.
+  const referenced = [...new Set(Object.values(RECOMMENDATIONS).flat().concat(BASELINE))];
+  for (const id of referenced) {
+    const [category, preset] = id.split("/");
+    for (const model of listModels()) {
+      if (!getPreset(model, category, preset)) {
+        warnings.push(`detect.js recommends ${id}, which ${model} does not have`);
+      }
+    }
+  }
+
+  // The project manifest, if there is one.
+  const cwd = process.cwd();
+  const manifest = readManifest(cwd);
+  for (const entry of manifest.presets) {
+    if (!getPreset(entry.model, entry.category, entry.preset)) {
+      warnings.push(`installed ${entry.id} is no longer in the registry`);
+    }
+    if (entry.file && !fs.existsSync(path.join(cwd, entry.file))) {
+      warnings.push(`installed ${entry.id} is missing its file (${entry.file})`);
+    }
+  }
+
+  console.log("");
+  console.log(pc.dim(`Validated ${checked} packages across ${listModels().length} models, ${referenced.length} detector mappings.`));
+  console.log("");
+
+  for (const w of warnings) console.log(`  ${pc.yellow("warn")}  ${w}`);
+  for (const e of errors) console.log(`  ${pc.red("error")} ${e}`);
+
+  if (errors.length === 0 && warnings.length === 0) {
+    console.log(pc.green("✓ Registry is valid.\n"));
+    return;
+  }
+
+  console.log("");
+  console.log(
+    (errors.length ? pc.red(`${errors.length} error${errors.length === 1 ? "" : "s"}`) : pc.green("0 errors")) +
+      pc.dim(`, ${warnings.length} warning${warnings.length === 1 ? "" : "s"}`)
+  );
+  console.log("");
+
+  if (errors.length > 0) process.exitCode = 1;
+}
+
+module.exports = { validate };

package/src/config/license-public-keys.json

@@ -0,0 +1,17 @@
+{
+  "$comment": "Trusted Ed25519 public keys for Agent.md Pro licenses. This file is the source of truth; scripts/build-keyset.js validates it and copies it into packages/cli/src/config/ so it ships inside the npm tarball, and CI fails if the two drift. PUBLIC HALVES ONLY — a private key must never appear in this repository. A key may only be listed here once its private half is in the vault named by vaultRef. See docs/license-key-management.md.",
+  "schema": 1,
+  "defaultKid": "agmd-2026-09",
+  "legacyKid": "agmd-2026-09",
+  "keys": [
+    {
+      "kid": "agmd-2026-09",
+      "alg": "ed25519",
+      "status": "active",
+      "publicKey": "MCowBQYDK2VwAyEAOCiLmEn/IwwBcNlMpvJi4twQURdqeEdAPZy+pZqlBh8=",
+      "issuedAt": "2026-09-13",
+      "vaultRef": "op://Engineering/agentmd-signing-2026-09/private",
+      "comment": "First and only signing key. Licenses issued before kid support carry no kid and verify against this one via legacyKid."
+    }
+  ]
+}