agentic-workflow-manager 8.3.0 → 8.5.0

package/dist/src/core/dashboard/sanitize.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeDashboardSource = sanitizeDashboardSource;
+const crypto_1 = require("crypto");
+const STATES = new Set(['ok', 'attention', 'missing', 'unavailable', 'not_applicable', 'active', 'blocked']);
+const ALLOWED_KEYS = new Set(['findings', 'label', 'id', 'state', 'detail', 'remediation', 'remediationVerified', 'execution', 'qa', 'retro', 'history', 'lifecycle', 'journal', 'markers', 'tasks', 'total', 'completed', 'qaComplete', 'retroComplete']);
+const CANONICAL_LABELS = new Set([
+    'Preferences', 'Registries', 'Profile', 'Sensors', 'Optional source unavailable',
+    'Extensions', 'Registry pins', 'Active bundles', 'Project context', 'Constitution', 'Static preflight',
+]);
+const CANONICAL_FINDING_IDS = new Set([
+    'machine.preferences.missing', 'machine.registries.stale', 'project.profile.missing',
+    'project.sensors.unavailable', 'project.preflight.degraded', 'planning.source.unavailable', 'execution.source.unavailable',
+]);
+const PROVIDER_FINDING_ID = /^machine\.provider\.(?:claude-code|codex|opencode|cursor|copilot|antigravity)\.(?:binary\.version|skills\.global|agents\.native|workflows\.global|context\.global|hook\.trust|guidance\.project|constitution\.delivery)$/;
+const PROJECT_FINDING_ID = /^project\.(?:profile\.present|extensions\.configured|registry-pins\.present|bundles\.coherent|context\.present|constitution\.present|sensors\.present|preflight\.not_collected)$/;
+const PROVIDER_LABEL = /^Provider (?:claude-code|codex|opencode|cursor|copilot|antigravity): (?:binary\.version|skills\.global|agents\.native|workflows\.global|context\.global|hook\.trust|guidance\.project|constitution\.delivery)$/;
+const DANGEROUS = /(?:ghp_|sk-[A-Za-z]|<|>|\\\\[^\\\s]+\\[^\\\s]+|\/[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*|[A-Za-z]:\\|\b[A-Za-z_][A-Za-z0-9_]*=|token|secret|password)/iu;
+function sanitize(value, key) {
+    if (value === null || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            throw new Error('Dashboard source numbers must be finite');
+        return value;
+    }
+    if (typeof value === 'string') {
+        if (key === 'state' && !STATES.has(value))
+            throw new Error(`Dashboard source state is invalid: ${value}`);
+        // IDs are source-controlled and are rendered into snapshots. Preserve only
+        // the small canonical vocabulary; opaque IDs retain deterministic ordering
+        // without exporting repository names, emails, IPs, or local identifiers.
+        if (key === 'id') {
+            if (value.trim() === '')
+                throw new Error('Dashboard finding id is invalid');
+            return CANONICAL_FINDING_IDS.has(value) || PROVIDER_FINDING_ID.test(value) || PROJECT_FINDING_ID.test(value)
+                ? value : `item-${(0, crypto_1.createHash)('sha256').update(value).digest('hex').slice(0, 16)}`;
+        }
+        if (key === 'label' && !CANONICAL_LABELS.has(value) && !PROVIDER_LABEL.test(value))
+            return '[redacted]';
+        return DANGEROUS.test(value) ? '[redacted]' : value;
+    }
+    if (Array.isArray(value))
+        return value.map((entry) => sanitize(entry));
+    if (!value || typeof value !== 'object')
+        throw new Error('Dashboard source must contain JSON-compatible values');
+    const out = {};
+    for (const [entryKey, entryValue] of Object.entries(value)) {
+        if (!ALLOWED_KEYS.has(entryKey))
+            continue;
+        // Source details are untrusted command/error output. Renderers only receive
+        // canonical details produced after collection (for example lifecycle state).
+        if (entryKey === 'detail')
+            continue;
+        out[entryKey] = sanitize(entryValue, entryKey);
+    }
+    return out;
+}
+/** Removes dynamic credentials, local paths, and hostile markup from source observations. */
+function sanitizeDashboardSource(value) {
+    return sanitize(value);
+}

package/dist/src/core/dashboard/styles.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DASHBOARD_STYLES = void 0;
+/** Inline visual system derived from the approved Stitch dashboard artifacts. */
+exports.DASHBOARD_STYLES = `
+:root { color-scheme: dark; --canvas:#070d16; --surface:#101a29; --surface-raised:#172235; --surface-nav:#202a3b; --ink:#edf3ff; --muted:#b7c2d4; --border:#39455b; --indigo:#aebcff; --cyan:#8cecff; --amber:#ffc06a; --red:#ffb4ac; --green:#77e8be; --radius:4px; }
+* { box-sizing:border-box; }
+html { background:var(--canvas); color:var(--ink); font:14px/1.35 system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif; }
+body { margin:0; background:var(--canvas); }
+.shell { display:grid; grid-template-columns:12rem minmax(0,1fr); min-height:100vh; }
+.shell > nav { background:var(--surface-nav); border-right:1px solid var(--border); padding:.85rem .65rem; }
+.brand { margin:0 0:1rem; font-size:.9rem; font-weight:750; letter-spacing:-.03em; }
+.brand small { display:block; color:var(--muted); font-size:.72rem; font-weight:500; letter-spacing:0; }
+.shell > nav ul { list-style:none; margin:0; padding:0; display:grid; gap:.15rem; }
+.shell > nav li { color:var(--muted); font-size:.78rem; padding:.4rem .45rem; border-left:2px solid transparent; } .shell > nav li.active { background:var(--indigo); color:#101a29; font-weight:750; }
+.shell > nav > button { margin-top:1rem; width:100%; } [data-sidebar-operator-controls] { border-top:1px solid var(--border); color:var(--muted); display:grid; font-size:.72rem; gap:.35rem; margin-top:1rem; padding-top:.75rem; }
+main { min-width:0; padding:0 clamp(.75rem,3vw,2.5rem) 3rem; }
+.dashboard-content { margin:0 auto; width:min(100%,72rem); }
+header { border-bottom:1px solid var(--border); padding-bottom:1.25rem; }
+.dashboard-toolbar { align-items:center; display:flex; flex-wrap:wrap; gap:.45rem; justify-content:space-between; margin:0 calc(clamp(.75rem,3vw,2.5rem) * -1); min-height:2.8rem; padding:.4rem clamp(.75rem,3vw,2.5rem); }
+.toolbar-brand { font-weight:750; letter-spacing:-.025em; margin:0; } .toolbar-brand span { color:var(--muted); font-size:.76rem; font-weight:500; margin-left:.35rem; }
+.dashboard-toolbar form { margin-left:auto; } .dashboard-toolbar input { background:#080e18; border:1px solid var(--border); border-radius:var(--radius); color:var(--muted); min-width:12rem; padding:.4rem .55rem; } .dashboard-toolbar input:disabled { cursor:not-allowed; opacity:.72; }
+.toolbar-actions,.project-header-actions,.closure-actions > div:last-child { display:flex; flex-wrap:wrap; gap:.4rem; }
+button { background:var(--surface-raised); border:1px solid var(--border); border-radius:var(--radius); color:var(--ink); font:inherit; padding:.38rem .55rem; } button:disabled { cursor:not-allowed; opacity:.7; } button:focus-visible,input:focus-visible { outline:3px solid var(--cyan); outline-offset:3px; }
+.page-header { padding:1.35rem 0 .8rem; } .project-header-actions { margin-top:.6rem; }
+h1,h2,p { margin-top:0; } h1 { font-size:clamp(1.45rem,2.4vw,2rem); letter-spacing:-.035em; margin-bottom:.2rem; } h2 { font-size:.88rem; letter-spacing:.035em; margin:0; } h3 { font-size:.8rem; margin:.1rem 0 .45rem; }
+.eyebrow,.status { color:var(--muted); font-family:ui-monospace,SFMono-Regular,Consolas,monospace; font-size:.78rem; }
+.status { display:inline-flex; align-items:center; gap:.4rem; border:1px solid var(--border); border-radius:var(--radius); padding:.2rem .5rem; }
+.status.degraded { color:var(--amber); border-color:#72552e; } .status.healthy { color:var(--green); border-color:#2f6c58; }
+.lede { color:var(--muted); max-width:72ch; }
+section { background:var(--surface); border:1px solid var(--border); border-radius:var(--radius); margin-top:.65rem; overflow:hidden; }
+section > header { align-items:center; background:var(--surface-raised); border:0; display:flex; justify-content:space-between; padding:.55rem .75rem; }
+.section-body { padding:.75rem; }
+.availability { color:var(--muted); font-size:.85rem; margin-bottom:.75rem; } .availability.unavailable { color:var(--amber); }
+table { border-collapse:collapse; width:100%; } th,td { border-bottom:1px solid var(--border); padding:.45rem .4rem; text-align:left; vertical-align:top; } th { color:var(--muted); font-size:.66rem; letter-spacing:.07em; text-transform:uppercase; } tr:last-child td { border-bottom:0; }
+.state { font-weight:650; white-space:nowrap; } .state.ok { color:var(--green); } .state.attention { color:var(--amber); } .state.missing,.state.unavailable { color:var(--red); } .state.not_applicable { color:var(--muted); }
+code { background:#080e18; border:1px solid var(--border); border-radius:2px; color:var(--cyan); font:inherit; padding:.12rem .3rem; white-space:pre-wrap; overflow-wrap:anywhere; }
+.empty { color:var(--muted); margin:0; } footer { color:var(--muted); font-size:.8rem; padding:1.25rem 0; }
+.diagnostic-grid,.timeline,.action-list { display:grid; gap:.45rem; list-style:none; margin:0; padding:0; } .diagnostic-grid { grid-template-columns:repeat(3,minmax(0,1fr)); } .machine-preparation-strip { background:#0b1320; border:1px solid var(--border); margin-bottom:.65rem; padding:.6rem; } .machine-preparation-strip h3 { color:var(--muted); font-size:.68rem; letter-spacing:.07em; text-transform:uppercase; } .diagnostic-grid li { border-right:1px solid var(--border); display:grid; gap:.2rem; padding:0 .5rem; } .diagnostic-grid li:last-child { border-right:0; } .diagnostic-grid strong { font-size:.78rem; } .diagnostic-grid li > span:last-child { color:var(--muted); font: .7rem ui-monospace,SFMono-Regular,Consolas,monospace; }
+.lifecycle-timeline { background:#0b1320; border:1px solid var(--border); margin-bottom:.65rem; padding:.6rem; } .lifecycle-timeline h3 { color:var(--muted); font-size:.68rem; letter-spacing:.07em; text-transform:uppercase; } .timeline { grid-template-columns:repeat(5,minmax(0,1fr)); } .connected-timeline { border-top:1px solid var(--border); margin-top:.4rem; padding-top:.25rem; } .timeline li { background:#0b1320; display:grid; gap:.2rem; padding:.2rem; } .timeline-marker { background:var(--surface-raised); border:1px solid var(--border); border-radius:50%; height:.65rem; width:.65rem; } .timeline .state { font-size:.68rem; } .timeline .state.unavailable { background:#38141c; color:#fff0ed; display:inline-flex; padding:.08rem .25rem; width:max-content; } aside[data-provisional-evidence] { background:#261d10; border-left:3px solid var(--amber); color:var(--ink); display:grid; gap:.15rem; margin-top:.65rem; padding:.6rem .75rem; } aside[data-provisional-evidence] span { color:var(--muted); }
+.privacy-body { align-items:center; display:flex; gap:1rem; justify-content:space-between; } .static-note { color:var(--muted); font-size:.78rem; margin:0; } .static-toggle { align-items:center; background:#0b1320; border:1px solid var(--border); display:flex; flex-wrap:wrap; gap:.5rem; padding:.65rem; } .static-toggle input { accent-color:var(--cyan); } .static-toggle input:disabled { opacity:1; }
+.machine-bento { display:grid; gap:.65rem; grid-template-columns:repeat(3,minmax(0,1fr)); margin-top:.65rem; } .bento-card { background:var(--surface); border:1px solid var(--border); display:grid; gap:.35rem; min-height:8rem; padding:.75rem; } .bento-card h2 { color:var(--muted); font-size:.7rem; letter-spacing:.07em; text-transform:uppercase; } [data-next-actions] { background:var(--surface); border:1px solid var(--border); margin-top:.65rem; padding:.75rem; } [data-next-actions] h2 { margin-bottom:.65rem; } .project-chrome { display:flex; flex-wrap:wrap; gap:.5rem 1rem; justify-content:space-between; } [data-project-nav] { display:flex; gap:.65rem; font-size:.72rem; } [data-project-nav] [aria-current] { color:var(--cyan); font-weight:700; }
+.evidence-grid.compact-composition { display:grid; gap:.65rem; grid-template-columns:repeat(2,minmax(0,1fr)); padding:.65rem; } .evidence-grid h2 { font-size:.9rem; margin-bottom:.4rem; } .plan-card { border:1px solid var(--border); display:grid; gap:.35rem; margin-top:.4rem; padding:.55rem; } .plan-card.active { border-left:3px solid var(--indigo); } .plan-card.blocked { border-left:3px solid var(--red); } .plan-card > div { align-items:center; display:flex; justify-content:space-between; gap:.5rem; } .plan-card p { color:var(--muted); font-size:.72rem; margin:0; }
+.evidence-table { margin-top:.65rem; } .closure-actions { align-items:center; border-top:1px solid var(--border); display:flex; gap:1rem; justify-content:space-between; margin-top:1rem; padding:1rem; } .closure-actions h3 { font-size:.9rem; margin:0 0:.25rem; }
+.action-list li { align-items:center; border-bottom:1px solid var(--border); display:grid; gap:.6rem; grid-template-columns:max-content minmax(8rem,1fr) minmax(10rem,auto) max-content; padding:.65rem 0; } .action-list li:last-child { border-bottom:0; }
+.sr-only { clip:rect(0 0 0 0); clip-path:inset(50%); height:1px; overflow:hidden; position:absolute; white-space:nowrap; width:1px; }
+a:focus-visible { outline:3px solid var(--cyan); outline-offset:3px; }
+@media (max-width: 720px) { .shell { display:block; } nav { border-bottom:1px solid var(--border); border-right:0; } nav ul { grid-template-columns:repeat(2,minmax(0,1fr)); } main { padding:0 1rem 2rem; } .dashboard-toolbar { margin:0 -1rem; padding:.65rem 1rem; } .dashboard-toolbar form { margin-left:0; order:3; width:100%; } .dashboard-toolbar input { width:100%; } .privacy-body,.closure-actions { align-items:stretch; flex-direction:column; } .diagnostic-grid,.timeline,.evidence-grid,.machine-bento { grid-template-columns:1fr; } .action-list li { grid-template-columns:max-content 1fr; } .action-list code,.action-list button { grid-column:1 / -1; } table,thead,tbody,tr,th,td { display:block; } thead { position:absolute; width:1px; height:1px; overflow:hidden; clip:rect(0 0 0 0); } td { border:0; padding:.25rem 0; } tr { border-bottom:1px solid var(--border); padding:.7rem 0; } tr:last-child { border-bottom:0; } td::before { color:var(--muted); content:attr(data-label) ": "; font-size:.72rem; text-transform:uppercase; } }
+@media (prefers-reduced-motion: reduce) { *,*::before,*::after { animation-duration:.01ms !important; animation-iteration-count:1 !important; scroll-behavior:auto !important; transition-duration:.01ms !important; } }
+@media print { :root { color-scheme:light; } body { background:#fff; color:#000; } .shell { display:block; } nav { display:none; } main { max-width:none; padding:0; } section { break-inside:avoid; border-color:#666; } section > header { background:#eee; } .state,.availability,code { color:#000 !important; } }
+`;

package/dist/src/core/dashboard/types.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dashboardSnapshot = dashboardSnapshot;
+const PROJECT_SECTION_IDS = ['machine', 'project', 'planning', 'execution', 'qa', 'retro', 'history'];
+/** Safe, deterministic V1 fixture and renderer input. */
+function dashboardSnapshot(overrides = {}) {
+    const { project: projectOverride, sections: sectionsOverride, ...rest } = overrides;
+    const project = projectOverride ?? { detected: false, label: 'No project detected' };
+    const sections = sectionsOverride ?? (project.detected
+        ? PROJECT_SECTION_IDS.map((id) => ({ id, availability: id === 'machine' ? 'available' : 'not_applicable', items: [] }))
+        : [{ id: 'machine', availability: 'available', items: [] }]);
+    return {
+        schema: 1,
+        generatedAt: '2026-08-22T00:00:00.000Z',
+        overall: 'healthy',
+        project,
+        confidence: 'none',
+        sections,
+        ...rest,
+    };
+}

package/dist/src/core/dashboard/validate.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DashboardValidationError = void 0;
+exports.validateDashboardSnapshotV1 = validateDashboardSnapshotV1;
+const SECTION_ORDER = ['machine', 'project', 'planning', 'execution', 'qa', 'retro', 'history'];
+const ITEM_STATES = ['ok', 'attention', 'missing', 'unavailable', 'not_applicable'];
+const AVAILABILITIES = ['available', 'unavailable', 'not_applicable'];
+const OVERALLS = ['healthy', 'degraded'];
+const CONFIDENCES = ['none', 'provisional', 'observing', 'supported'];
+const ACTIONABLE_STATES = new Set(['attention', 'missing', 'unavailable']);
+class DashboardValidationError extends Error {
+    constructor(message) {
+        super(`Invalid DashboardSnapshotV1: ${message}`);
+        this.name = 'DashboardValidationError';
+    }
+}
+exports.DashboardValidationError = DashboardValidationError;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function assertRecord(value, path) {
+    if (!isRecord(value))
+        throw new DashboardValidationError(`${path} must be an object`);
+}
+function assertOnlyKeys(value, keys, path) {
+    for (const key of Object.keys(value)) {
+        if (!keys.includes(key))
+            throw new DashboardValidationError(`${path}.${key} is not supported`);
+    }
+}
+function assertNonEmptyString(value, path) {
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new DashboardValidationError(`${path} must be a non-empty string`);
+    }
+}
+function assertEnum(value, values, path) {
+    if (typeof value !== 'string' || !values.includes(value)) {
+        throw new DashboardValidationError(`${path} must be one of ${values.join(', ')}`);
+    }
+}
+/** Validates the durable public dashboard boundary without coercing unknown input. */
+function validateDashboardSnapshotV1(value) {
+    assertRecord(value, 'snapshot');
+    assertOnlyKeys(value, ['schema', 'generatedAt', 'overall', 'project', 'confidence', 'sections'], 'snapshot');
+    if (value.schema !== 1)
+        throw new DashboardValidationError('schema must be version 1');
+    assertNonEmptyString(value.generatedAt, 'generatedAt');
+    if (Number.isNaN(Date.parse(value.generatedAt)))
+        throw new DashboardValidationError('generatedAt must be a valid date-time');
+    assertEnum(value.overall, OVERALLS, 'overall');
+    assertEnum(value.confidence, CONFIDENCES, 'confidence');
+    assertRecord(value.project, 'project');
+    assertOnlyKeys(value.project, ['detected', 'label'], 'project');
+    if (typeof value.project.detected !== 'boolean')
+        throw new DashboardValidationError('project.detected must be boolean');
+    assertNonEmptyString(value.project.label, 'project.label');
+    if (!Array.isArray(value.sections))
+        throw new DashboardValidationError('sections must be an array');
+    const sectionIds = new Set();
+    const itemIds = new Set();
+    let previousOrder = -1;
+    for (const [sectionIndex, section] of value.sections.entries()) {
+        const sectionPath = `sections[${sectionIndex}]`;
+        assertRecord(section, sectionPath);
+        assertOnlyKeys(section, ['id', 'availability', 'items'], sectionPath);
+        assertEnum(section.id, SECTION_ORDER, `${sectionPath}.id`);
+        const order = SECTION_ORDER.indexOf(section.id);
+        if (order <= previousOrder)
+            throw new DashboardValidationError('section order must be deterministic');
+        previousOrder = order;
+        if (sectionIds.has(section.id))
+            throw new DashboardValidationError(`duplicate section id ${section.id}`);
+        sectionIds.add(section.id);
+        assertEnum(section.availability, AVAILABILITIES, `${sectionPath}.availability`);
+        if (!Array.isArray(section.items))
+            throw new DashboardValidationError(`${sectionPath}.items must be an array`);
+        for (const [itemIndex, item] of section.items.entries()) {
+            const itemPath = `${sectionPath}.items[${itemIndex}]`;
+            assertRecord(item, itemPath);
+            assertOnlyKeys(item, ['id', 'label', 'state', 'detail', 'remediation'], itemPath);
+            assertNonEmptyString(item.id, `${itemPath}.id`);
+            if (itemIds.has(item.id))
+                throw new DashboardValidationError(`duplicate item id ${item.id}`);
+            itemIds.add(item.id);
+            assertNonEmptyString(item.label, `${itemPath}.label`);
+            assertEnum(item.state, ITEM_STATES, `${itemPath}.state`);
+            if (item.detail !== undefined)
+                assertNonEmptyString(item.detail, `${itemPath}.detail`);
+            if (item.remediation !== undefined)
+                assertNonEmptyString(item.remediation, `${itemPath}.remediation`);
+            if (ACTIONABLE_STATES.has(item.state) && item.remediation === undefined) {
+                throw new DashboardValidationError(`${itemPath}.remediation is required for actionable state`);
+            }
+            if (item.state === 'not_applicable' && item.remediation !== undefined) {
+                throw new DashboardValidationError(`${itemPath}.remediation is forbidden for not_applicable state`);
+            }
+        }
+    }
+    if (!value.project.detected && (value.sections.length !== 1 || value.sections[0].id !== 'machine')) {
+        throw new DashboardValidationError('no project snapshot may contain only the machine section');
+    }
+    if (value.project.detected && sectionIds.size !== SECTION_ORDER.length) {
+        throw new DashboardValidationError('detected project snapshot must contain the canonical lifecycle sections');
+    }
+    return value;
+}

package/dist/src/core/dashboard/write-html.js

@@ -0,0 +1,88 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveHtmlTarget = resolveHtmlTarget;
+exports.writeHtmlAtomically = writeHtmlAtomically;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = require("crypto");
+function resolveHtmlTarget(input, operations = fs_1.default) {
+    if (!input || typeof input.cwd !== 'string' || input.cwd.trim() === '' || input.cwd.includes('\0') || typeof input.target !== 'string' || input.target.trim() === '' || input.target.includes('\0') || input.target.startsWith('--'))
+        throw new Error('--html requires a file target');
+    if (input.force !== undefined && typeof input.force !== 'boolean')
+        throw new Error('--force must be boolean');
+    const target = path_1.default.isAbsolute(input.target) ? path_1.default.normalize(input.target) : path_1.default.resolve(input.cwd, input.target);
+    const parent = path_1.default.dirname(target);
+    if (!operations.existsSync(parent) || !operations.statSync(parent).isDirectory())
+        throw new Error(`HTML parent directory does not exist: ${parent}`);
+    for (let current = parent;; current = path_1.default.dirname(current)) {
+        if (operations.lstatSync(current).isSymbolicLink())
+            throw new Error('HTML parent directory must not contain a symbolic link');
+        if (current === path_1.default.parse(current).root)
+            break;
+    }
+    try {
+        operations.accessSync(parent, fs_1.default.constants.W_OK);
+    }
+    catch {
+        throw new Error(`HTML parent directory is not writable: ${parent}`);
+    }
+    let stat;
+    try {
+        stat = operations.lstatSync(target);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return target;
+        throw error;
+    }
+    if (stat.isSymbolicLink() || !stat.isFile())
+        throw new Error('HTML target must be a regular file');
+    if (!input.force)
+        throw new Error(`HTML target already exists: ${target}; use --force`);
+    return target;
+}
+function writeHtmlAtomically(input, operations = fs_1.default) {
+    if (!input || typeof input.cwd !== 'string' || input.cwd.trim() === '' || input.cwd.includes('\0'))
+        throw new Error('writeHtmlAtomically requires a non-empty cwd');
+    if (typeof input.target !== 'string' || input.target.trim() === '' || !path_1.default.isAbsolute(input.target))
+        throw new Error('writeHtmlAtomically requires a non-empty absolute target');
+    if (input.target.includes('\0'))
+        throw new Error('writeHtmlAtomically target must not contain NUL');
+    if (typeof input.html !== 'string' || input.html.length === 0)
+        throw new Error('writeHtmlAtomically requires non-empty html');
+    if (input.force !== undefined && typeof input.force !== 'boolean')
+        throw new Error('writeHtmlAtomically force must be boolean');
+    if (operations.existsSync(input.target) && !input.force)
+        throw new Error(`HTML target already exists: ${input.target}; use --force`);
+    const platform = input.platform ?? process.platform;
+    if (typeof platform !== 'string' || !/^[a-z0-9]+$/i.test(platform))
+        throw new Error('writeHtmlAtomically platform must be a valid platform');
+    const temp = path_1.default.join(path_1.default.dirname(input.target), `.${path_1.default.basename(input.target)}.${process.pid}.${(0, crypto_1.randomUUID)()}.tmp`);
+    let fd;
+    let tempCreated = false;
+    try {
+        fd = platform === 'win32' ? operations.openSync(temp, 'wx') : operations.openSync(temp, 'wx', 0o600);
+        tempCreated = true;
+        operations.writeFileSync(fd, input.html, 'utf8');
+        operations.fsyncSync(fd);
+        operations.closeSync(fd);
+        fd = undefined;
+        operations.renameSync(temp, input.target);
+    }
+    catch (error) {
+        if (fd !== undefined)
+            try {
+                operations.closeSync(fd);
+            }
+            catch { /* best effort */ }
+        try {
+            if (tempCreated && operations.existsSync(temp))
+                operations.unlinkSync(temp);
+        }
+        catch { /* known temp only */ }
+        throw error;
+    }
+}

package/dist/src/core/diagnostics/context.js

@@ -297,7 +297,7 @@ function gatherProject(root, bundles, agent = 'claude-code') {
         context = { present: true, file: 'AGENTS.md' };
     return {
         root,
-        profile: { present: profilePresent, extensions: profile.extensions },
+        profile: { present: profilePresent, extensions: profile.extensions, registries: profile.registries },
         activeBundles: { expected, linked, broken },
         orphanLinks,
         sensors: { present: fs_1.default.existsSync(path_1.default.join(root, '.awm', 'sensors.json')) },

package/dist/src/core/evidence/capture.js

@@ -0,0 +1,46 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.captureCycleEvidence = captureCycleEvidence;
+const crypto_1 = __importDefault(require("crypto"));
+const types_1 = require("./types");
+const hash = (value) => crypto_1.default.createHash('sha256').update(value).digest('hex');
+const object = (value, name) => { if (!value || typeof value !== 'object' || Array.isArray(value))
+    throw new Error(`${name} must be an object`); return value; };
+const iso = (value, name) => { if (typeof value !== 'string' || Number.isNaN(Date.parse(value)))
+    throw new Error(`${name} must be an ISO timestamp`); return value; };
+const nonNegative = (value, name) => { if (!Number.isSafeInteger(value) || value < 0)
+    throw new Error(`${name} must be a non-negative integer`); return value; };
+function captureCycleEvidence(input) {
+    if (!input || typeof input.root !== 'string' || !input.root)
+        throw new Error('capture root is required');
+    if (typeof input.repositoryIdentity !== 'string' || input.repositoryIdentity.length === 0 || input.repositoryIdentity.length > 4096 || /[\r\n]/.test(input.repositoryIdentity))
+        throw new Error('repository identity is invalid');
+    const repositoryIdentity = hash(input.repositoryIdentity);
+    if (typeof input.planPath !== 'string' || !input.planPath)
+        throw new Error('capture planPath is required');
+    const journal = object(input.journal, 'journal');
+    const cycle = object(journal.cycle, 'journal cycle');
+    const startedAt = iso(cycle.startedAt, 'cycle startedAt');
+    const endedAt = iso(cycle.completedAt ?? journal.controllerHeartbeatAt, 'cycle endedAt');
+    if (cycle.status !== 'COMPLETE' && cycle.status !== 'BLOCKED')
+        throw new Error('journal cycle must be complete or blocked');
+    if (!Array.isArray(journal.tasks) || !Array.isArray(journal.verdicts) || !Array.isArray(journal.fixes) || !Array.isArray(input.gates) || !Array.isArray(input.ledger))
+        throw new Error('capture sources are invalid');
+    const tasks = journal.tasks.map((item, index) => { const task = object(item, `task ${index}`); if (typeof task.id !== 'string')
+        throw new Error('task id is invalid'); const attempts = nonNegative(task.attempts, 'task attempts'); return { id: task.id, attempts, retries: Math.max(attempts - 1, 0) }; });
+    const failures = journal.verdicts.filter((item, index) => { const verdict = object(item, `verdict ${index}`); if (verdict.result !== 'pass' && verdict.result !== 'fail' && verdict.result !== 'inconclusive')
+        throw new Error('verdict result is invalid'); iso(verdict.receivedAt, 'verdict receivedAt'); return verdict.result === 'fail'; });
+    const signatures = failures.map((item) => { const verdict = object(item, 'verdict'); if (typeof verdict.fingerprint !== 'string' || !verdict.fingerprint)
+        throw new Error('verdict fingerprint is required'); return hash(`signature:${verdict.fingerprint}`); });
+    const fixes = journal.fixes.filter((item, index) => { const fix = object(item, `fix ${index}`); if (typeof fix.closed !== 'boolean')
+        throw new Error('fix closed is invalid'); return fix.closed; }).length;
+    const gates = input.gates.map((item, index) => { const gate = object(item, `gate ${index}`); if (typeof gate.required !== 'boolean' || typeof gate.passed !== 'boolean')
+        throw new Error('gate is invalid'); return gate; }).filter((gate) => gate.required === true);
+    const cures = input.ledger.filter((item, index) => { const entry = object(item, `ledger ${index}`); if (typeof entry.signature !== 'string' || (entry.polarity !== 'finding' && entry.polarity !== 'win'))
+        throw new Error('ledger entry is invalid'); iso(entry.ts, 'ledger timestamp'); return entry.polarity === 'win'; }).map((entry) => { const source = object(entry, 'ledger'); return { signature: hash(`signature:${source.signature}`), curedAt: iso(source.ts, 'ledger timestamp') }; });
+    const pr = input.pr === undefined ? undefined : (() => { const raw = object(input.pr, 'pr'); return { provider: raw.provider, number: raw.number }; })();
+    return (0, types_1.validateCycleEvidence)({ schema: 1, cycleId: hash(`${repositoryIdentity}\0${input.planPath}\0${startedAt}`), startedAt, endedAt, durationMs: Date.parse(endedAt) - Date.parse(startedAt), cycleState: cycle.status === 'COMPLETE' ? 'completed' : 'blocked', plan: { ref: input.planPath, state: input.planState ?? (cycle.status === 'BLOCKED' ? 'blocked' : 'executed') }, tasks, qa: { findings: signatures.length, fixes: Math.min(fixes, signatures.length), signatures }, gates: { required: gates.length, firstEvaluationsPassed: gates.map((gate) => gate.passed), firstPass: gates.every((gate) => gate.passed === true) }, cures, ...(pr ? { pr } : {}) });
+}

package/dist/src/core/evidence/history.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.confidenceForCycles = confidenceForCycles;
+exports.classifyCure = classifyCure;
+exports.buildEvidenceHistory = buildEvidenceHistory;
+const types_1 = require("./types");
+function confidenceForCycles(count) {
+    if (!Number.isSafeInteger(count) || count < 0)
+        throw new Error('eligible cycle count must be a non-negative integer');
+    const eligibleCycles = count;
+    if (eligibleCycles === 0)
+        return 'none';
+    if (eligibleCycles === 1)
+        return 'provisional';
+    if (eligibleCycles < 5)
+        return 'observing';
+    return 'supported';
+}
+function classifyCure(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        throw new Error('cure observation must be an object');
+    const value = input;
+    if (Object.keys(value).some((key) => key !== 'laterEligibleCycles' && key !== 'recurred') || !Number.isSafeInteger(value.laterEligibleCycles) || value.laterEligibleCycles < 0 || typeof value.recurred !== 'boolean')
+        throw new Error('cure observation is invalid');
+    const laterEligibleCycles = value.laterEligibleCycles;
+    if (value.recurred)
+        return 'recurred';
+    if (laterEligibleCycles === 0)
+        return 'awaiting_observation';
+    return laterEligibleCycles >= 3 ? 'supported' : 'observing';
+}
+/** Validates, retains, and deterministically orders every eligible local observation. */
+function buildEvidenceHistory(records) {
+    if (!Array.isArray(records))
+        throw new Error('evidence history records must be an array');
+    const valid = records.map((record) => (0, types_1.validateCycleEvidence)(record)).sort((left, right) => left.startedAt.localeCompare(right.startedAt) || left.cycleId.localeCompare(right.cycleId));
+    const completed = valid.filter((cycle) => cycle.cycleState === 'completed');
+    const cycles = valid.map((cycle, index) => ({
+        ...cycle,
+        retries: cycle.tasks.reduce((total, task) => total + task.retries, 0),
+        cureEfficacy: cycle.cures.map((cure) => {
+            const later = valid.slice(index + 1).filter((candidate) => candidate.cycleState === 'completed');
+            return {
+                signature: cure.signature,
+                efficacy: classifyCure({ laterEligibleCycles: later.length, recurred: later.some((candidate) => candidate.qa.signatures.includes(cure.signature)) }),
+            };
+        }),
+    }));
+    return { confidence: confidenceForCycles(completed.length), empty: cycles.length === 0, cycles };
+}

package/dist/src/core/evidence/store.js

@@ -0,0 +1,32 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeCycleEvidence = writeCycleEvidence;
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const atomic_file_1 = require("../atomic-file");
+const types_1 = require("./types");
+function writeCycleEvidence(root, evidence) {
+    if (typeof root !== 'string' || root.length === 0)
+        throw new Error('evidence root must be a non-empty string');
+    const valid = (0, types_1.validateCycleEvidence)(evidence);
+    const safeRoot = safeDirectory(root, 'root');
+    let directory = safeRoot;
+    for (const segment of ['.awm', 'evidence', 'cycles']) {
+        directory = path_1.default.join(directory, segment);
+        if (!fs_1.default.existsSync(directory))
+            fs_1.default.mkdirSync(directory, { mode: 0o700 });
+        directory = safeDirectory(directory, `evidence ${segment}`);
+    }
+    const file = path_1.default.join(directory, `${valid.cycleId}.json`);
+    (0, atomic_file_1.writeFileAtomicDurable)(file, JSON.stringify(valid, null, 2) + '\n', 0o600);
+    return valid;
+}
+function safeDirectory(directory, label) {
+    const stat = fs_1.default.lstatSync(directory);
+    if (stat.isSymbolicLink() || !stat.isDirectory())
+        throw new Error(`unsafe evidence ${label} directory symlink or non-directory`);
+    return fs_1.default.realpathSync(directory);
+}

package/dist/src/core/evidence/types.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLAN_STATES = void 0;
+exports.validateCycleEvidence = validateCycleEvidence;
+exports.PLAN_STATES = ['active', 'blocked', 'qa_pending', 'retro_pending', 'executed', 'legacy_unverifiable'];
+const DIGEST = /^[a-f0-9]{64}$/;
+const SAFE_ID = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+function record(value, label) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`${label} must be an object`);
+    return value;
+}
+function keys(value, label, allowed) {
+    if (Object.keys(value).some((key) => !allowed.includes(key)))
+        throw new Error(`${label} has unsupported fields`);
+}
+function timestamp(value, label) {
+    if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value) || Number.isNaN(Date.parse(value)) || new Date(value).toISOString() !== value)
+        throw new Error(`${label} must be a canonical ISO timestamp`);
+    return value;
+}
+function count(value, label) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0)
+        throw new Error(`${label} must be a non-negative integer`);
+    return value;
+}
+function digest(value, label) {
+    if (typeof value !== 'string' || !DIGEST.test(value))
+        throw new Error(`${label} must be a SHA-256 digest`);
+    return value;
+}
+function relativePlanRef(value) {
+    if (typeof value !== 'string' || !value || value.includes('\\') || value.startsWith('/') || /^[A-Za-z]:/.test(value)
+        || value.split('/').some((part) => part === '' || part === '.' || part === '..'))
+        throw new Error('plan.ref must be repo-relative');
+    return value;
+}
+/** Strict public durable-boundary validator: accepted evidence intentionally has no prose or identities. */
+function validateCycleEvidence(input) {
+    const value = record(input, 'cycle evidence');
+    keys(value, 'cycle evidence', ['schema', 'cycleId', 'startedAt', 'endedAt', 'durationMs', 'cycleState', 'plan', 'tasks', 'qa', 'gates', 'cures', 'pr']);
+    if (value.schema !== 1)
+        throw new Error('cycle evidence schema must be 1');
+    const startedAt = timestamp(value.startedAt, 'startedAt');
+    const endedAt = timestamp(value.endedAt, 'endedAt');
+    const durationMs = count(value.durationMs, 'durationMs');
+    if (Date.parse(endedAt) < Date.parse(startedAt) || durationMs !== Date.parse(endedAt) - Date.parse(startedAt))
+        throw new Error('cycle duration is invalid');
+    if (value.cycleState !== 'completed' && value.cycleState !== 'blocked')
+        throw new Error('cycleState is invalid');
+    const plan = record(value.plan, 'plan');
+    keys(plan, 'plan', ['ref', 'state']);
+    if (typeof plan.state !== 'string' || !exports.PLAN_STATES.includes(plan.state))
+        throw new Error('plan state is invalid');
+    if (!Array.isArray(value.tasks))
+        throw new Error('tasks must be an array');
+    const tasks = value.tasks.map((item, index) => {
+        const task = record(item, `tasks[${index}]`);
+        keys(task, `tasks[${index}]`, ['id', 'attempts', 'retries']);
+        if (typeof task.id !== 'string' || !SAFE_ID.test(task.id))
+            throw new Error('task id is invalid');
+        const attempts = count(task.attempts, 'task attempts');
+        const retries = count(task.retries, 'task retries');
+        if (retries !== Math.max(attempts - 1, 0))
+            throw new Error('task retries must derive from attempts');
+        return { id: task.id, attempts, retries };
+    });
+    const qa = record(value.qa, 'qa');
+    keys(qa, 'qa', ['findings', 'fixes', 'signatures']);
+    if (!Array.isArray(qa.signatures))
+        throw new Error('qa signatures must be an array');
+    const signatures = qa.signatures.map((signature, index) => digest(signature, `qa.signatures[${index}]`));
+    const findings = count(qa.findings, 'qa findings');
+    const fixes = count(qa.fixes, 'qa fixes');
+    if (signatures.length !== findings || fixes > findings)
+        throw new Error('qa counts are inconsistent');
+    const gates = record(value.gates, 'gates');
+    keys(gates, 'gates', ['required', 'firstEvaluationsPassed', 'firstPass']);
+    const required = count(gates.required, 'required gates');
+    if (!Array.isArray(gates.firstEvaluationsPassed) || !gates.firstEvaluationsPassed.every((passed) => typeof passed === 'boolean') || gates.firstEvaluationsPassed.length !== required || typeof gates.firstPass !== 'boolean' || gates.firstPass !== gates.firstEvaluationsPassed.every(Boolean))
+        throw new Error('gate evaluations are inconsistent');
+    if (!Array.isArray(value.cures))
+        throw new Error('cures must be an array');
+    const cures = value.cures.map((item, index) => { const cure = record(item, `cures[${index}]`); keys(cure, `cures[${index}]`, ['signature', 'curedAt']); return { signature: digest(cure.signature, 'cure signature'), curedAt: timestamp(cure.curedAt, 'curedAt') }; });
+    let pr;
+    if (value.pr !== undefined) {
+        const raw = record(value.pr, 'pr');
+        keys(raw, 'pr', ['provider', 'number']);
+        if (raw.provider !== 'github' && raw.provider !== 'gitlab' && raw.provider !== 'other')
+            throw new Error('pr provider is invalid');
+        const number = count(raw.number, 'pr number');
+        if (number < 1)
+            throw new Error('pr number is invalid');
+        pr = { provider: raw.provider, number };
+    }
+    return { schema: 1, cycleId: digest(value.cycleId, 'cycleId'), startedAt, endedAt, durationMs, cycleState: value.cycleState, plan: { ref: relativePlanRef(plan.ref), state: plan.state }, tasks, qa: { findings, fixes, signatures }, gates: { required, firstEvaluationsPassed: [...gates.firstEvaluationsPassed], firstPass: gates.firstPass }, cures, ...(pr ? { pr } : {}) };
+}

package/dist/src/index.js

@@ -41,6 +41,7 @@ const agent_1 = require("./commands/agent");
 const job_1 = require("./commands/job");
 const watch_1 = require("./commands/watch");
 const track_1 = require("./commands/track");
+const evidence_1 = require("./commands/evidence");
 const add_1 = require("./commands/add");
 const sync_1 = require("./commands/sync");
 const update_1 = require("./commands/update");
@@ -733,6 +734,7 @@ miroCmd.command('sync <storyMapPath>')
 (0, job_1.registerJobCommand)(program);
 (0, watch_1.registerWatchCommand)(program);
 (0, track_1.registerTrackCommand)(program);
+(0, evidence_1.registerEvidenceCommand)(program);
 // Commander only waits for async action handlers through parseAsync().  The CLI has
 // async commands (including `sensors coverage`), so returning its promise keeps the
 // process alive until their JSON/output contract has been completed.