agent-bober 0.17.1 → 0.19.0

package/dist/cli/commands/security-audit.js

@@ -0,0 +1,238 @@
+/**
+ * `agent-bober security-audit [target]` — on-demand stack-aware security audit.
+ *
+ * Synthesizes a lightweight SprintContract-shaped descriptor from the target
+ * path (or the working tree when omitted), runs the same `runSecurityAudit`
+ * core the in-pipeline gate uses (with `evaluation=null` for standalone
+ * mode), persists the artifact via `saveSecurityAudit` (called internally by
+ * the core), prints a human-readable findings summary, and exits with a
+ * CI-friendly code driven by `security.standaloneBlockOn`.
+ *
+ * Threshold semantics (sc-4-2) are CLI-local by design: `thresholdVerdict`
+ * lives HERE, never in `security-gate.ts`. The pipeline gate's critical-only
+ * veto (ADR-2) stays structurally untouched — this command reads
+ * `security.standaloneBlockOn` to decide its OWN exit code only.
+ *
+ * Exit codes: 0 = pass, 2 = blocked-by-threshold OR fail-closed (audit threw,
+ * or the auditor's output could not be parsed). 1 is reserved for Commander's
+ * own usage errors and for unexpected errors resolving config/project root.
+ *
+ * Clock discipline: `new Date().toISOString()` is called ONLY at the
+ * `.action()` boundary — never inside `runStandaloneSecurityAudit` — mirrors
+ * `research.ts`'s "stamp wall-clock time at handler boundary" convention.
+ * Hub emission (sprint 6) reuses `deps.now` for the same reason — it is
+ * never re-stamped inside this module.
+ *
+ * Error handling: CLI handlers MUST NOT throw. They set `process.exitCode`
+ * and return on all errors (mirrors `research.ts` / `do.ts`).
+ */
+import chalk from "chalk";
+import { findProjectRoot } from "../../utils/fs.js";
+import { loadConfig } from "../../config/loader.js";
+import { SecuritySectionSchema } from "../../config/schema.js";
+import { runSecurityAudit } from "../../orchestrator/security-auditor-agent.js";
+import { emitSecurityFindings, mapAuditToFindings } from "../../orchestrator/security-hub.js";
+import { ingestFinding } from "../../hub/finding-store.js";
+import { FactStore, factsDbPath, ensureFactsDir } from "../../state/facts.js";
+import { logger } from "../../utils/logger.js";
+// ── Pure threshold (lives HERE, never in security-gate.ts) — sc-4-4 ──
+/**
+ * Decide whether the standalone CLI should block (exit 2) given a review and
+ * the configured `standaloneBlockOn` threshold. Pure function — no I/O.
+ *
+ * `critical` findings always block, regardless of threshold. `important`
+ * findings only block when `standaloneBlockOn === "important"`. `minor`
+ * findings never block. This is intentionally a *superset* of the pipeline
+ * gate's critical-only veto (`deriveVerdict`) — it must never be imported
+ * into `security-gate.ts` or `pipeline.ts` (sc-4-4 is verified structurally).
+ */
+export function thresholdVerdict(review, standaloneBlockOn) {
+    if (review.critical.length > 0)
+        return true;
+    if (standaloneBlockOn === "important" && review.important.length > 0)
+        return true;
+    return false;
+}
+// ── Descriptor synthesis ───────────────────────────────────────────────
+/**
+ * Build a synthetic SprintContract-shaped descriptor for the standalone
+ * audit. The `contractId` is timestamped (`security-audit-<slug>`) so it can
+ * never collide with a pipeline sprint's `sprint-*` contractId, and so the
+ * fs-safe sanitization in `security-audit-state.ts` produces a stable,
+ * readable artifact filename.
+ */
+export function buildAuditDescriptor(target, now) {
+    const slug = now.replace(/[^A-Za-z0-9]/g, "-");
+    const scope = target ?? "working tree";
+    return {
+        contractId: `security-audit-${slug}`,
+        specId: "security-audit-standalone",
+        sprintNumber: 1,
+        title: `Standalone security audit: ${scope}`,
+        description: `On-demand security audit of ${scope}, requested via the standalone bober security-audit CLI.`,
+        status: "in-progress",
+        dependsOn: [],
+        features: [],
+        successCriteria: [
+            {
+                criterionId: "audit",
+                description: "Audit the target for exploitable security vulnerabilities and cite each finding with path:line.",
+                verificationMethod: "manual",
+                required: true,
+            },
+        ],
+        nonGoals: ["This is a standalone on-demand audit — not a pipeline sprint contract."],
+        stopConditions: ["The auditor emits a well-formed ReviewResult JSON."],
+        definitionOfDone: "A cited security review of the target has been produced and persisted.",
+        assumptions: [],
+        outOfScope: [],
+        estimatedFiles: target ? [target] : [],
+        iterationHistory: [],
+        lastEvalId: null,
+    };
+}
+/**
+ * Run a standalone security audit and compute the CI exit code.
+ *
+ * `config.security` may be absent — that is legal for standalone mode (the
+ * explicit CLI invocation IS the opt-in; nonGoals[0]). When absent, the
+ * section is synthesized via `SecuritySectionSchema.parse({})` so the audit
+ * still runs with schema defaults (sc-4-3).
+ *
+ * Fail-closed (sc-4-2): a thrown audit error, or `result.parsed === false`,
+ * always exits 2 — checked BEFORE the threshold, so an empty fallback review
+ * (which `thresholdVerdict` alone would read as "clean") never yields a
+ * false pass.
+ */
+export async function runStandaloneSecurityAudit(deps) {
+    const runAudit = deps.runAudit ?? runSecurityAudit;
+    const security = deps.config.security ?? SecuritySectionSchema.parse({});
+    const runConfig = { ...deps.config, security };
+    const descriptor = buildAuditDescriptor(deps.target, deps.now);
+    let result;
+    try {
+        result = await runAudit(descriptor, null, deps.projectRoot, runConfig);
+    }
+    catch (err) {
+        process.stderr.write(chalk.red(`security-audit failed: ${err instanceof Error ? err.message : String(err)}\n`));
+        return { exitCode: 2 };
+    }
+    if (!result.parsed) {
+        process.stderr.write(chalk.red("security-audit: auditor output could not be parsed — treating as blocked (fail-closed).\n"));
+        printSummary(descriptor, result, security.standaloneBlockOn, true);
+        return { result, exitCode: 2 };
+    }
+    // Best-effort hub emission — AFTER a parseable result, BEFORE computing
+    // this command's own threshold verdict. A hub failure never changes the
+    // exit code (nonGoals[3]); emitSecurityFindings catches and logs
+    // internally. Reuses deps.now — never re-stamps the clock here.
+    await emitFindingsToHub(result, deps.projectRoot, security, deps.now, deps.findingSink);
+    const blocked = thresholdVerdict(result.review, security.standaloneBlockOn);
+    printSummary(descriptor, result, security.standaloneBlockOn, blocked);
+    return { result, exitCode: blocked ? 2 : 0 };
+}
+// ── Hub emission ─────────────────────────────────────────────────────
+/**
+ * Emit a SecurityAuditResult's critical/important findings into the
+ * priority hub. Best-effort: emitSecurityFindings already catches and logs
+ * sink failures internally, so this helper never throws and never affects
+ * the CLI's exit code.
+ *
+ * - `security.hub === false` -> no-op (zero hub writes).
+ * - An injected `findingSink` (tests) is used as-is.
+ * - Otherwise, a FactStore is opened lazily — only when mapAuditToFindings
+ *   produces at least one finding to emit — so a clean audit (or a
+ *   `hub:false` config) never touches the filesystem.
+ */
+async function emitFindingsToHub(result, projectRoot, security, now, findingSink) {
+    if (security.hub === false)
+        return;
+    if (findingSink !== undefined) {
+        await emitSecurityFindings(result, findingSink, logger, now);
+        return;
+    }
+    // Check emptiness BEFORE opening a store — a clean audit (mapAuditToFindings
+    // returns []) never touches the filesystem. mapAuditToFindings is pure and
+    // cheap, so computing it twice (here + inside emitSecurityFindings) is fine.
+    if (mapAuditToFindings(result, now).length === 0)
+        return;
+    // The ENTIRE default-sink sequence (dir creation, store open, emission,
+    // store close) is wrapped in one try/catch/finally: `emitSecurityFindings`
+    // only guards the emission loop itself — it does NOT cover `ensureFactsDir`
+    // or `new FactStore`, so an fs failure there (disk full, EACCES, a
+    // non-directory occupying `.bober`, a locked/corrupt sqlite file) must be
+    // caught here too, or it propagates as an unhandled rejection that the
+    // CLI's outer catch would report as exit 2 for an otherwise clean audit
+    // (sc-6-2 regression fix, iteration 2).
+    let store;
+    try {
+        await ensureFactsDir(projectRoot);
+        const opened = new FactStore(factsDbPath(projectRoot));
+        store = opened;
+        const defaultSink = async (finding) => {
+            await ingestFinding(opened, finding, { now });
+        };
+        await emitSecurityFindings(result, defaultSink, logger, now);
+    }
+    catch (err) {
+        logger.warn(`Security hub emission failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    finally {
+        store?.close();
+    }
+}
+// ── Summary rendering ───────────────────────────────────────────────────
+/** Bound the number of findings printed to the terminal. */
+const MAX_PRINTED_FINDINGS = 20;
+function printSummary(descriptor, result, standaloneBlockOn, blocked) {
+    const { review } = result;
+    const safeId = descriptor.contractId.replace(/[^a-zA-Z0-9_-]/g, "_");
+    const artifactPath = `.bober/security/${safeId}-security-audit.md`;
+    const verdictLine = blocked
+        ? chalk.red(`BLOCKED (threshold: ${standaloneBlockOn})`)
+        : chalk.green("PASS");
+    const lines = [
+        `Security audit: ${verdictLine}`,
+        `Stack: ${result.stack}`,
+        `Findings — critical: ${review.critical.length}, important: ${review.important.length}, minor: ${review.minor.length}`,
+        `Summary: ${review.summary}`,
+    ];
+    const topFindings = [...review.critical, ...review.important].slice(0, MAX_PRINTED_FINDINGS);
+    if (topFindings.length > 0) {
+        lines.push("Top findings:");
+        for (const finding of topFindings) {
+            const evidence = finding.evidence[0];
+            const path = evidence?.path ?? "unknown";
+            const line = evidence?.line ?? 0;
+            lines.push(`  - ${finding.description} at ${path}:${line}`);
+        }
+    }
+    lines.push(`Artifact: ${artifactPath}`);
+    process.stdout.write(lines.join("\n") + "\n");
+}
+export function registerSecurityAuditCommand(program, overrides) {
+    program
+        .command("security-audit [target]")
+        .description("Run an on-demand stack-aware security audit against a local path (or the working tree).")
+        .action(async (target) => {
+        try {
+            const projectRoot = (await findProjectRoot()) ?? process.cwd();
+            // Stamp wall-clock time ONLY here — never inside the DI core.
+            const now = new Date().toISOString();
+            const config = await loadConfig(projectRoot);
+            const { exitCode } = await runStandaloneSecurityAudit({
+                projectRoot,
+                config,
+                target,
+                now,
+                runAudit: overrides?.runAudit,
+            });
+            process.exitCode = exitCode;
+        }
+        catch (err) {
+            process.stderr.write(chalk.red(`security-audit failed: ${err instanceof Error ? err.message : String(err)}\n`));
+            process.exitCode = 2;
+        }
+    });
+}
+//# sourceMappingURL=security-audit.js.map

package/dist/cli/commands/security-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-audit.js","sourceRoot":"","sources":["../../../src/cli/commands/security-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAK/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAC;AAEhF,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,wEAAwE;AAExE;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAoB,EACpB,iBAA2C;IAE3C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,iBAAiB,KAAK,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0EAA0E;AAE1E;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA0B,EAAE,GAAW;IAC1E,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,cAAc,CAAC;IACvC,OAAO;QACL,UAAU,EAAE,kBAAkB,IAAI,EAAE;QACpC,MAAM,EAAE,2BAA2B;QACnC,YAAY,EAAE,CAAC;QACf,KAAK,EAAE,8BAA8B,KAAK,EAAE;QAC5C,WAAW,EAAE,+BAA+B,KAAK,0DAA0D;QAC3G,MAAM,EAAE,aAAa;QACrB,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,EAAE;QACZ,eAAe,EAAE;YACf;gBACE,WAAW,EAAE,OAAO;gBACpB,WAAW,EAAE,iGAAiG;gBAC9G,kBAAkB,EAAE,QAAQ;gBAC5B,QAAQ,EAAE,IAAI;aACf;SACF;QACD,QAAQ,EAAE,CAAC,wEAAwE,CAAC;QACpF,cAAc,EAAE,CAAC,oDAAoD,CAAC;QACtE,gBAAgB,EAAE,wEAAwE;QAC1F,WAAW,EAAE,EAAE;QACf,UAAU,EAAE,EAAE;QACd,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QACtC,gBAAgB,EAAE,EAAE;QACpB,UAAU,EAAE,IAAI;KACjB,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAyB;IAEzB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,SAAS,GAAgB,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC5D,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAE/D,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,CAAC,GAAG,CACP,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC/E,CACF,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,CAAC,GAAG,CACP,2FAA2F,CAC5F,CACF,CAAC;QACF,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACjC,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,iEAAiE;IACjE,gEAAgE;IAChE,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAExF,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC5E,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACtE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,wEAAwE;AAExE;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,iBAAiB,CAC9B,MAA2B,EAC3B,WAAmB,EACnB,QAAyB,EACzB,GAAW,EACX,WAA4C;IAE5C,IAAI,QAAQ,CAAC,GAAG,KAAK,KAAK;QAAE,OAAO;IAEnC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEzD,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,mEAAmE;IACnE,0EAA0E;IAC1E,uEAAuE;IACvE,wEAAwE;IACxE,wCAAwC;IACxC,IAAI,KAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QACvD,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,WAAW,GAAwB,KAAK,EAAE,OAAO,EAAE,EAAE;YACzD,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAChD,CAAC,CAAC;QACF,MAAM,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,KAAK,EAAE,KAAK,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,2EAA2E;AAE3E,4DAA4D;AAC5D,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,SAAS,YAAY,CACnB,UAA0B,EAC1B,MAA2B,EAC3B,iBAA2C,EAC3C,OAAgB;IAEhB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,mBAAmB,MAAM,oBAAoB,CAAC;IAEnE,MAAM,WAAW,GAAG,OAAO;QACzB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,iBAAiB,GAAG,CAAC;QACxD,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAExB,MAAM,KAAK,GAAa;QACtB,mBAAmB,WAAW,EAAE;QAChC,UAAU,MAAM,CAAC,KAAK,EAAE;QACxB,wBAAwB,MAAM,CAAC,QAAQ,CAAC,MAAM,gBAAgB,MAAM,CAAC,SAAS,CAAC,MAAM,YAAY,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;QACtH,YAAY,MAAM,CAAC,OAAO,EAAE;KAC7B,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC7F,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,IAAI,SAAS,CAAC;YACzC,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,WAAW,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,aAAa,YAAY,EAAE,CAAC,CAAC;IAExC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AAChD,CAAC;AAQD,MAAM,UAAU,4BAA4B,CAC1C,OAAgB,EAChB,SAAkC;IAElC,OAAO;SACJ,OAAO,CAAC,yBAAyB,CAAC;SAClC,WAAW,CACV,yFAAyF,CAC1F;SACA,MAAM,CAAC,KAAK,EAAE,MAAe,EAAE,EAAE;QAChC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,CAAC,MAAM,eAAe,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAC/D,8DAA8D;YAC9D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;YAE7C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,0BAA0B,CAAC;gBACpD,WAAW;gBACX,MAAM;gBACN,MAAM;gBACN,GAAG;gBACH,QAAQ,EAAE,SAAS,EAAE,QAAQ;aAC9B,CAAC,CAAC;YACH,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,CAAC,GAAG,CACP,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC/E,CACF,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/sprint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sprint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/sprint.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iGAAiG;IACjG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA0CD,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAqPf"}
+{"version":3,"file":"sprint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/sprint.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iGAAiG;IACjG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA0CD,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAyQf"}

package/dist/cli/commands/sprint.js

@@ -7,6 +7,7 @@ import { runEvaluatorAgent } from "../../orchestrator/evaluator-agent.js";
 import { ensureBoberDir, listContracts, updateContract, loadLatestSpec, appendHistory, } from "../../state/index.js";
 import { getCurrentBranch, getChangedFiles, commitAll } from "../../utils/git.js";
 import { logger } from "../../utils/logger.js";
+import { getOpenClarifications } from "../../contracts/spec.js";
 // ── Helpers ────────────────────────────────────────────────────────
 function findNextPendingSprint(contracts) {
     // Find the first contract that hasn't been completed
@@ -66,10 +67,23 @@ export async function runSprintCommand(projectRoot, options) {
         logger.error("No plan found. Run 'npx agent-bober plan' first.");
         return;
     }
-    // Load contracts
-    const contracts = await listContracts(projectRoot);
+    // Refuse to run sprints against a spec that still needs clarification
+    if (spec.status === "needs-clarification") {
+        const open = getOpenClarifications(spec);
+        logger.error(`Plan "${spec.title}" needs clarification before sprints can run.`);
+        for (const q of open) {
+            logger.info(`  [${q.questionId}] ${q.question}`);
+        }
+        logger.info(`Answer with 'npx agent-bober plan answer ${spec.specId} <questionId> "<answer>"', then re-run.`);
+        return;
+    }
+    // Load contracts, scoped to the active (latest) spec
+    const allContracts = await listContracts(projectRoot);
+    const contracts = allContracts.filter((c) => c.specId === spec.specId);
     if (contracts.length === 0) {
-        logger.error("No sprint contracts found. Run 'npx agent-bober plan' first.");
+        logger.error("No sprint contracts found for the active plan. " +
+            "Run 'npx agent-bober plan' to (re)materialize contracts, " +
+            "or 'npx agent-bober run' to execute the full pipeline.");
         return;
     }
     const projectContext = await buildProjectContext(projectRoot, config);

package/dist/cli/commands/sprint.js.map

@@ -1 +1 @@
-{"version":3,"file":"sprint.js","sourceRoot":"","sources":["../../../src/cli/commands/sprint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EACL,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,EACd,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAW/C,sEAAsE;AAEtE,SAAS,qBAAqB,CAC5B,SAA2B;IAE3B,qDAAqD;IACrD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;QAC9B,UAAU;QACV,aAAa;QACb,QAAQ;QACR,cAAc;KACf,CAAC,CAAC;IAEH,OAAO,CACL,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAC7D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,WAAmB,EACnB,MAAmD;IAEnD,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,EAAE;QACf,aAAa;KACd,CAAC;AACJ,CAAC;AAED,sEAAsE;AAEtE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,OAA6B;IAE7B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,cAAc;IACd,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7E,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,0CAA0C;IAC1C,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,GAAG;YACP,GAAG,MAAM;YACT,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YAC9D,SAAS,EAAE,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;SAC/D,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;IAElC,oBAAoB;IACpB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IAED,iBAAiB;IACjB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAEtE,IAAI,YAAY,GAAG,IAAI,CAAC;IAExB,OAAO,YAAY,EAAE,CAAC;QACpB,2BAA2B;QAC3B,MAAM,UAAU,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;YACzC,MAAM;QACR,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,WAAW,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CACX,UAAU,CAAC,UAAU,EACrB,aAAa,UAAU,CAAC,WAAW,EAAE,CACtC,CAAC;QAEF,wBAAwB;QACxB,MAAM,kBAAkB,GAAG,SAAS,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAC7B,CAAC;QAEF,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC;QACrD,IAAI,eAAe,GAAG,oBAAoB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QACtE,MAAM,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QAEnD,yCAAyC;QACzC,MAAM,aAAa,GAAG,SAAS,CAAC,SAAS,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,CAAC,UAAU,CACnD,CAAC;QACF,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,aAAa,CAAC,GAAG,eAAe,CAAC;QAC7C,CAAC;QAED,IAAI,YAAY,GAAG,KAAK,CAAC;QAEzB,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,IAAI,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC;YAChE,MAAM,CAAC,QAAQ,CACb,SAAS,EACT,aAAa,EACb,aAAa,SAAS,EAAE,CACzB,CAAC;YAEF,gBAAgB;YAChB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,IAAI,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;gBAC/C,EAAE,EAAE,WAAW;gBACf,cAAc;gBACd,IAAI;gBACJ,eAAe;gBACf,aAAa,EAAE,kBAAkB;gBACjC,YAAY,EAAE,qBAAqB,eAAe,CAAC,KAAK,OAAO,eAAe,CAAC,WAAW,EAAE;gBAC5F,MAAM,EAAE,eAAe,CAAC,iBAAiB;oBACvC,CAAC,CAAC,CAAC,eAAe,CAAC,iBAAiB,CAAC;oBACrC,CAAC,CAAC,EAAE;aACP,CAAC,CAAC;YAEH,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAE3D,WAAW;YACX,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACpC,MAAM,aAAa,CAAC,WAAW,EAAE;gBAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE,iBAAiB;gBACxB,KAAK,EAAE,YAAY;gBACnB,QAAQ,EAAE,eAAe,CAAC,UAAU;gBACpC,OAAO,EAAE,EAAE,SAAS,EAAE;aACvB,CAAC,CAAC;YAEH,MAAM,eAAe,GAAG,MAAM,YAAY,CACxC,gBAAgB,EAChB,WAAW,EACX,MAAM,CACP,CAAC;YAEF,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC,qBAAqB,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC1D,eAAe,GAAG;oBAChB,GAAG,eAAe;oBAClB,cAAc,EAAE,eAAe,CAAC,KAAK;iBACtC,CAAC;gBACF,MAAM,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;gBAEnD,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;oBAC9B,SAAS;gBACX,CAAC;gBAED,eAAe,GAAG,oBAAoB,CACpC,eAAe,EACf,cAAc,CACf,CAAC;gBACF,MAAM,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;gBACnD,MAAM;YACR,CAAC;YAED,cAAc;YACd,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;gBAChC,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAC1B,WAAW,EACX,UAAU,eAAe,CAAC,KAAK,WAAW,SAAS,GAAG,CACvD,CAAC;oBACF,MAAM,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;gBACvC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,KAAK,CACV,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC3E,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,WAAW;YACX,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACpC,eAAe,GAAG,oBAAoB,CACpC,eAAe,EACf,YAAY,CACb,CAAC;YACF,MAAM,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;YAEnD,IAAI,YAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY,GAAG,eAAe,CAAC,YAAY,CAAC;YAC9C,CAAC;YAED,MAAM,WAAW,GAAG,aAAa,CAAC;gBAChC,IAAI,EAAE,WAAW;gBACjB,EAAE,EAAE,WAAW;gBACf,cAAc;gBACd,IAAI;gBACJ,eAAe;gBACf,aAAa,EAAE,kBAAkB;gBACjC,YAAY,EAAE,oBAAoB,eAAe,CAAC,KAAK,EAAE;gBACzD,YAAY;aACb,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,iBAAiB,CACxC,WAAW,EACX,WAAW,EACX,MAAM,CACP,CAAC;YAEF,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,CAAC,OAAO,CAAC,yBAAyB,UAAU,CAAC,KAAK,MAAM,CAAC,CAAC;gBAChE,eAAe,GAAG,oBAAoB,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;gBAClE,eAAe,GAAG;oBAChB,GAAG,eAAe;oBAClB,iBAAiB,EAAE,UAAU,CAAC,OAAO;iBACtC,CAAC;gBACF,MAAM,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;gBACnD,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR,CAAC;YAED,SAAS;YACT,MAAM,CAAC,IAAI,CACT,sBAAsB,SAAS,IAAI,aAAa,MAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACzF,CAAC;YACF,eAAe,GAAG;gBAChB,GAAG,eAAe;gBAClB,iBAAiB,EAAE,UAAU,CAAC,OAAO;aACtC,CAAC;YACF,MAAM,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;YAEnD,IAAI,SAAS,IAAI,aAAa,EAAE,CAAC;gBAC/B,eAAe,GAAG,oBAAoB,CACpC,eAAe,EACf,cAAc,CACf,CAAC;gBACF,MAAM,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;gBACnD,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,aAAa,CAAC,GAAG,eAAe,CAAC;QAC7C,CAAC;QAED,iBAAiB;QACjB,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,YAAY;YAC7B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;YACvB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,UAAU,GAAG,CACrF,CAAC;QAEF,IAAI,eAAe,CAAC,cAAc,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;aAAM,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;YACnE,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"sprint.js","sourceRoot":"","sources":["../../../src/cli/commands/sprint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EACL,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,EACd,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAWhE,sEAAsE;AAEtE,SAAS,qBAAqB,CAC5B,SAA2B;IAE3B,qDAAqD;IACrD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;QAC9B,UAAU;QACV,aAAa;QACb,QAAQ;QACR,cAAc;KACf,CAAC,CAAC;IAEH,OAAO,CACL,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAC7D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,WAAmB,EACnB,MAAmD;IAEnD,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,EAAE;QACf,aAAa;KACd,CAAC;AACJ,CAAC;AAED,sEAAsE;AAEtE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,OAA6B;IAE7B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,cAAc;IACd,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7E,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,0CAA0C;IAC1C,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,GAAG;YACP,GAAG,MAAM;YACT,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YAC9D,SAAS,EAAE,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;SAC/D,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;IAElC,oBAAoB;IACpB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CACV,SAAS,IAAI,CAAC,KAAK,+CAA+C,CACnE,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,4CAA4C,IAAI,CAAC,MAAM,yCAAyC,CACjG,CAAC;QACF,OAAO;IACT,CAAC;IAED,qDAAqD;IACrD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;IACvE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,CACV,iDAAiD;YAC/C,2DAA2D;YAC3D,wDAAwD,CAC3D,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAEtE,IAAI,YAAY,GAAG,IAAI,CAAC;IAExB,OAAO,YAAY,EAAE,CAAC;QACpB,2BAA2B;QAC3B,MAAM,UAAU,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;YACzC,MAAM;QACR,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,WAAW,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CACX,UAAU,CAAC,UAAU,EACrB,aAAa,UAAU,CAAC,WAAW,EAAE,CACtC,CAAC;QAEF,wBAAwB;QACxB,MAAM,kBAAkB,GAAG,SAAS,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAC7B,CAAC;QAEF,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC;QACrD,IAAI,eAAe,GAAG,oBAAoB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QACtE,MAAM,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QAEnD,yCAAyC;QACzC,MAAM,aAAa,GAAG,SAAS,CAAC,SAAS,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,CAAC,UAAU,CACnD,CAAC;QACF,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,aAAa,CAAC,GAAG,eAAe,CAAC;QAC7C,CAAC;QAED,IAAI,YAAY,GAAG,KAAK,CAAC;QAEzB,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,IAAI,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC;YAChE,MAAM,CAAC,QAAQ,CACb,SAAS,EACT,aAAa,EACb,aAAa,SAAS,EAAE,CACzB,CAAC;YAEF,gBAAgB;YAChB,MAAM,OAAO,GAAG,aAAa,CAAC;gBAC5B,IAAI,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;gBAC/C,EAAE,EAAE,WAAW;gBACf,cAAc;gBACd,IAAI;gBACJ,eAAe;gBACf,aAAa,EAAE,kBAAkB;gBACjC,YAAY,EAAE,qBAAqB,eAAe,CAAC,KAAK,OAAO,eAAe,CAAC,WAAW,EAAE;gBAC5F,MAAM,EAAE,eAAe,CAAC,iBAAiB;oBACvC,CAAC,CAAC,CAAC,eAAe,CAAC,iBAAiB,CAAC;oBACrC,CAAC,CAAC,EAAE;aACP,CAAC,CAAC;YAEH,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAE3D,WAAW;YACX,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACpC,MAAM,aAAa,CAAC,WAAW,EAAE;gBAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE,iBAAiB;gBACxB,KAAK,EAAE,YAAY;gBACnB,QAAQ,EAAE,eAAe,CAAC,UAAU;gBACpC,OAAO,EAAE,EAAE,SAAS,EAAE;aACvB,CAAC,CAAC;YAEH,MAAM,eAAe,GAAG,MAAM,YAAY,CACxC,gBAAgB,EAChB,WAAW,EACX,MAAM,CACP,CAAC;YAEF,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC,qBAAqB,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC1D,eAAe,GAAG;oBAChB,GAAG,eAAe;oBAClB,cAAc,EAAE,eAAe,CAAC,KAAK;iBACtC,CAAC;gBACF,MAAM,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;gBAEnD,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;oBAC9B,SAAS;gBACX,CAAC;gBAED,eAAe,GAAG,oBAAoB,CACpC,eAAe,EACf,cAAc,CACf,CAAC;gBACF,MAAM,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;gBACnD,MAAM;YACR,CAAC;YAED,cAAc;YACd,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;gBAChC,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAC1B,WAAW,EACX,UAAU,eAAe,CAAC,KAAK,WAAW,SAAS,GAAG,CACvD,CAAC;oBACF,MAAM,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;gBACvC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,KAAK,CACV,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC3E,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,WAAW;YACX,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACpC,eAAe,GAAG,oBAAoB,CACpC,eAAe,EACf,YAAY,CACb,CAAC;YACF,MAAM,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;YAEnD,IAAI,YAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY,GAAG,eAAe,CAAC,YAAY,CAAC;YAC9C,CAAC;YAED,MAAM,WAAW,GAAG,aAAa,CAAC;gBAChC,IAAI,EAAE,WAAW;gBACjB,EAAE,EAAE,WAAW;gBACf,cAAc;gBACd,IAAI;gBACJ,eAAe;gBACf,aAAa,EAAE,kBAAkB;gBACjC,YAAY,EAAE,oBAAoB,eAAe,CAAC,KAAK,EAAE;gBACzD,YAAY;aACb,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,iBAAiB,CACxC,WAAW,EACX,WAAW,EACX,MAAM,CACP,CAAC;YAEF,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,CAAC,OAAO,CAAC,yBAAyB,UAAU,CAAC,KAAK,MAAM,CAAC,CAAC;gBAChE,eAAe,GAAG,oBAAoB,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;gBAClE,eAAe,GAAG;oBAChB,GAAG,eAAe;oBAClB,iBAAiB,EAAE,UAAU,CAAC,OAAO;iBACtC,CAAC;gBACF,MAAM,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;gBACnD,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR,CAAC;YAED,SAAS;YACT,MAAM,CAAC,IAAI,CACT,sBAAsB,SAAS,IAAI,aAAa,MAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACzF,CAAC;YACF,eAAe,GAAG;gBAChB,GAAG,eAAe;gBAClB,iBAAiB,EAAE,UAAU,CAAC,OAAO;aACtC,CAAC;YACF,MAAM,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;YAEnD,IAAI,SAAS,IAAI,aAAa,EAAE,CAAC;gBAC/B,eAAe,GAAG,oBAAoB,CACpC,eAAe,EACf,cAAc,CACf,CAAC;gBACF,MAAM,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;gBACnD,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,aAAa,CAAC,GAAG,eAAe,CAAC;QAC7C,CAAC;QAED,iBAAiB;QACjB,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,YAAY;YAC7B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;YACvB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,CACT,GAAG,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,UAAU,GAAG,CACrF,CAAC;QAEF,IAAI,eAAe,CAAC,cAAc,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;aAAM,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;YACnE,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/cli/commands/task.d.ts

@@ -0,0 +1,64 @@
+/**
+ * `bober task <add>` — zero-friction personal task capture.
+ *
+ * Subcommands:
+ *   add <text>  — Capture a plain task as an open action Finding in the hub pool.
+ *
+ * Error handling: CLI handlers MUST NOT throw. They set process.exitCode=1 and
+ * return on all errors. Pattern mirrors src/cli/commands/facts.ts.
+ */
+import type { Command } from "commander";
+import { FactStore } from "../../state/facts.js";
+import type { Finding } from "../../hub/finding.js";
+import type { GmailMcpLike } from "../../hub/gmail-to-task.js";
+/**
+ * DI core for `task add` — accepts an already-open store + injected `now`
+ * so tests can drive it without spawning the CLI or opening a real DB.
+ *
+ * Never throws: empty input and persistence errors are caught, reported to
+ * stderr, and communicated via process.exitCode=1.
+ */
+export declare function runTaskAdd(store: FactStore, text: string, opts: {
+    domain?: string;
+}, now: string): Promise<void>;
+/**
+ * DI core for `task list`. Default filter: wake-aware visibility (open,
+ * in-progress, or snoozed tasks whose wake time has passed). Never throws.
+ *
+ * `now` is injected at the CLI handler boundary so tests can pass a fixed
+ * clock. No Date.now() or new Date() inside this function.
+ */
+export declare function runTaskList(store: FactStore, opts: {
+    all?: boolean;
+    status?: string;
+}, now: string): void;
+/**
+ * DI core for start/done/drop. Missing id → chalk.yellow + exitCode=1 + return.
+ * Never throws.
+ */
+export declare function runTaskTransition(store: FactStore, id: string, newStatus: Finding["status"], now: string): Promise<void>;
+/**
+ * DI core for `task snooze`. Parses `until` as an ISO date at the boundary
+ * (NaN → chalk.red + exitCode=1 + return), reads the active Finding, strips
+ * any prior snooze-until tag, appends the new one, and transitions to snoozed.
+ *
+ * Never throws: all errors use chalk + process.exitCode=1 + return.
+ */
+export declare function runTaskSnooze(store: FactStore, id: string, until: string, now: string): Promise<void>;
+/**
+ * Parse the raw JSON, ingest it, print the reconcile action. Never throws:
+ * bad JSON or schema-invalid payload → chalk.red + exitCode=1 + return, no write.
+ */
+export declare function runTaskIngest(store: FactStore, raw: string, now: string): Promise<void>;
+/**
+ * DI core for `task from-gmail`. egressAllowed is resolved at the CLI boundary.
+ *
+ * When disabled → opt-in error from fromGmailTask is caught, written to stderr,
+ * exitCode=1, return. When enabled → fromGmailTask runs with the injected mcp.
+ * Connector errors are caught, sanitized (KEY=VALUE stripped), set exitCode=1.
+ *
+ * Never throws. mcp.stop() is always attempted in a finally block.
+ */
+export declare function runTaskFromGmail(store: FactStore, mcp: GmailMcpLike, threadRef: string, egressAllowed: boolean, now: string): Promise<void>;
+export declare function registerTaskCommand(program: Command): void;
+//# sourceMappingURL=task.d.ts.map

package/dist/cli/commands/task.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/task.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,OAAO,EACL,SAAS,EAGV,MAAM,sBAAsB,CAAC;AAS9B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAOpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AA6B/D;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACzB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAoBf;AAID;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACxC,GAAG,EAAE,MAAM,GACV,IAAI,CA8BN;AAID;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,SAAS,EAChB,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,EAC5B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAmBf;AAOD;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,SAAS,EAChB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAkDf;AAuBD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,SAAS,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAoBf;AAID;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,SAAS,EAChB,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,OAAO,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAcf;AAID,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsN1D"}