ai-sdlc 0.2.0-alpha.20 → 0.2.0-alpha.22

package/dist/cli/commands.d.ts

@@ -1,4 +1,4 @@
-import { Story, ActionType } from '../types/index.js';
+import { Story, ActionType, PreFlightResult } from '../types/index.js';
 /**
  * Initialize the .ai-sdlc folder structure
  */
@@ -26,6 +26,31 @@ export declare function determineWorktreeMode(options: {
 }, worktreeConfig: {
     enabled: boolean;
 }, targetStory: Story | null): boolean;
+/**
+ * Perform pre-flight conflict check before starting work on a story in a worktree.
+ * Warns about potential file conflicts with active stories and prompts for confirmation.
+ *
+ * **Race Condition (TOCTOU):** Multiple users can pass this check simultaneously
+ * before branches are created. This is an accepted risk - the window is small
+ * (~100ms) and git will catch conflicts during merge/PR creation. Adding file
+ * locks would significantly increase complexity for minimal security gain.
+ *
+ * **Security Notes:**
+ * - sdlcRoot is normalized and validated (absolute path, no null bytes, max 1024 chars)
+ * - All display output is sanitized to prevent terminal injection attacks
+ * - Story IDs are validated with sanitizeStoryId() then stripped with sanitizeForDisplay()
+ * - Error messages are generic to prevent information leakage
+ *
+ * @param targetStory - The story to check for conflicts
+ * @param sdlcRoot - Root directory of the .ai-sdlc folder (must be absolute, validated)
+ * @param options - Command options (force flag)
+ * @param options.force - Skip conflict check if true
+ * @returns PreFlightResult indicating whether to proceed and any warnings
+ * @throws Error if sdlcRoot is invalid (not absolute, null bytes, too long)
+ */
+export declare function preFlightConflictCheck(targetStory: Story, sdlcRoot: string, options: {
+    force?: boolean;
+}): Promise<PreFlightResult>;
 /**
  * Run the workflow (process one action or all)
  */

package/dist/cli/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/cli/commands.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,EAAU,UAAU,EAA0H,MAAM,mBAAmB,CAAC;AAiBtL;;GAEG;AACH,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAyB1C;AAED;;GAEG;AACH,wBAAsB,MAAM,CAAC,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAmF1E;AAED;;GAEG;AACH,wBAAsB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBtD;AAsFD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,EAC/B,cAAc,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EACpC,WAAW,EAAE,KAAK,GAAG,IAAI,GACxB,OAAO,CAKT;AAyBD;;GAEG;AACH,wBAAsB,GAAG,CAAC,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+mBvN;AA4PD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,SAAS,GAAG,IAAI,CAiDlF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,KAAK,GAAG;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAgCA;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,MAAM,CAsBtE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAgB3E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAYtD;AA6DD;;GAEG;AACH,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkH7D;AA8GD;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgClG;AAED,wBAAsB,OAAO,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8G7G;AAiFD;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CA8DnD;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyEhE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuElG"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/cli/commands.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,EAAU,UAAU,EAA0H,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAmBvM;;GAEG;AACH,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAyB1C;AAED;;GAEG;AACH,wBAAsB,MAAM,CAAC,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAmF1E;AAED;;GAEG;AACH,wBAAsB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBtD;AAsFD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,EAC/B,cAAc,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EACpC,WAAW,EAAE,KAAK,GAAG,IAAI,GACxB,OAAO,CAKT;AAuDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,KAAK,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,eAAe,CAAC,CA8H1B;AAED;;GAEG;AACH,wBAAsB,GAAG,CAAC,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6nBvN;AAgSD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,SAAS,GAAG,IAAI,CAiDlF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,KAAK,GAAG;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAgCA;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,MAAM,CAsBtE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAgB3E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAYtD;AA6DD;;GAEG;AACH,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkH7D;AA8GD;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgClG;AAED,wBAAsB,OAAO,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8G7G;AAqFD;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CA8DnD;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyEhE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuElG"}

package/dist/cli/commands.js

@@ -3,8 +3,8 @@ import fs from 'fs';
 import path from 'path';
 import * as readline from 'readline';
 import { getSdlcRoot, loadConfig, initConfig, validateWorktreeBasePath, DEFAULT_WORKTREE_CONFIG } from '../core/config.js';
-import { initializeKanban, kanbanExists, assessState, getBoardStats, findStoryBySlug } from '../core/kanban.js';
-import { createStory, parseStory, resetRPIVCycle, isAtMaxRetries, unblockStory, getStory, findStoryById, updateStoryField, writeStory } from '../core/story.js';
+import { initializeKanban, kanbanExists, assessState, getBoardStats, findStoryBySlug, findStoriesByStatus } from '../core/kanban.js';
+import { createStory, parseStory, resetRPIVCycle, isAtMaxRetries, unblockStory, getStory, findStoryById, updateStoryField, writeStory, sanitizeStoryId } from '../core/story.js';
 import { GitWorktreeService } from '../core/worktree.js';
 import { ReviewDecision } from '../types/index.js';
 import { getThemedChalk } from '../core/theme.js';
@@ -15,6 +15,8 @@ import { migrateToFolderPerStory } from './commands/migrate.js';
 import { generateReviewSummary } from '../agents/review.js';
 import { getTerminalWidth } from './formatting.js';
 import { validateGitState } from '../core/git-utils.js';
+import { StoryLogger } from '../core/story-logger.js';
+import { detectConflicts } from '../core/conflict-detector.js';
 /**
  * Initialize the .ai-sdlc folder structure
  */
@@ -256,6 +258,160 @@ function displayGitValidationResult(result, c) {
         }
     }
 }
+// ANSI escape sequence patterns for sanitization
+const ANSI_CSI_PATTERN = /\x1B\[[0-9;]*[a-zA-Z]/g;
+const ANSI_OSC_BEL_PATTERN = /\x1B\][^\x07]*\x07/g;
+const ANSI_OSC_ESC_PATTERN = /\x1B\][^\x1B]*\x1B\\/g;
+const ANSI_SINGLE_CHAR_PATTERN = /\x1B./g;
+const CONTROL_CHARS_PATTERN = /[\x00-\x1F\x7F-\x9F]/g;
+/**
+ * Sanitize a string for safe display in the terminal.
+ * Strips ANSI escape sequences (CSI, OSC, single-char), control characters,
+ * and truncates extremely long strings to prevent DoS attacks.
+ *
+ * This uses the same comprehensive ANSI stripping patterns as sanitizeReasonText
+ * from src/core/story.ts for consistency.
+ *
+ * @param str - The string to sanitize
+ * @returns Sanitized string safe for terminal display (max 500 chars)
+ */
+function sanitizeForDisplay(str) {
+    const cleaned = str
+        .replace(ANSI_CSI_PATTERN, '') // CSI sequences (e.g., \x1B[31m)
+        .replace(ANSI_OSC_BEL_PATTERN, '') // OSC with BEL terminator (e.g., \x1B]...\x07)
+        .replace(ANSI_OSC_ESC_PATTERN, '') // OSC with ESC\ terminator (e.g., \x1B]...\x1B\\)
+        .replace(ANSI_SINGLE_CHAR_PATTERN, '') // Single-char escapes (e.g., \x1BH)
+        .replace(CONTROL_CHARS_PATTERN, ''); // Control characters (0x00-0x1F, 0x7F-0x9F)
+    // Truncate extremely long strings (DoS protection)
+    return cleaned.length > 500 ? cleaned.slice(0, 497) + '...' : cleaned;
+}
+/**
+ * Perform pre-flight conflict check before starting work on a story in a worktree.
+ * Warns about potential file conflicts with active stories and prompts for confirmation.
+ *
+ * **Race Condition (TOCTOU):** Multiple users can pass this check simultaneously
+ * before branches are created. This is an accepted risk - the window is small
+ * (~100ms) and git will catch conflicts during merge/PR creation. Adding file
+ * locks would significantly increase complexity for minimal security gain.
+ *
+ * **Security Notes:**
+ * - sdlcRoot is normalized and validated (absolute path, no null bytes, max 1024 chars)
+ * - All display output is sanitized to prevent terminal injection attacks
+ * - Story IDs are validated with sanitizeStoryId() then stripped with sanitizeForDisplay()
+ * - Error messages are generic to prevent information leakage
+ *
+ * @param targetStory - The story to check for conflicts
+ * @param sdlcRoot - Root directory of the .ai-sdlc folder (must be absolute, validated)
+ * @param options - Command options (force flag)
+ * @param options.force - Skip conflict check if true
+ * @returns PreFlightResult indicating whether to proceed and any warnings
+ * @throws Error if sdlcRoot is invalid (not absolute, null bytes, too long)
+ */
+export async function preFlightConflictCheck(targetStory, sdlcRoot, options) {
+    const config = loadConfig();
+    const c = getThemedChalk(config);
+    // Skip if --force flag
+    if (options.force) {
+        console.log(c.warning('⚠️  Skipping conflict check (--force)'));
+        return { proceed: true, warnings: ['Conflict check skipped'] };
+    }
+    // Validate sdlcRoot parameter (normalize first to prevent bypass attacks)
+    const normalizedPath = path.normalize(sdlcRoot);
+    if (!path.isAbsolute(normalizedPath)) {
+        throw new Error('Invalid project path');
+    }
+    if (normalizedPath.includes('\0')) {
+        throw new Error('Invalid project path');
+    }
+    if (normalizedPath.length > 1024) {
+        throw new Error('Invalid project path');
+    }
+    // Check if target story is already in-progress
+    if (targetStory.frontmatter.status === 'in-progress') {
+        console.log(c.error('❌ Story is already in-progress'));
+        return { proceed: false, warnings: ['Story already in progress'] };
+    }
+    try {
+        // Query for all in-progress stories (excluding target)
+        // Use normalizedPath for all subsequent operations
+        const activeStories = findStoriesByStatus(normalizedPath, 'in-progress')
+            .filter(s => s.frontmatter.id !== targetStory.frontmatter.id);
+        if (activeStories.length === 0) {
+            console.log(c.success('✓ Conflict check: No overlapping files with active stories'));
+            return { proceed: true, warnings: [] };
+        }
+        // Run conflict detection (use normalizedPath)
+        const workingDir = path.dirname(normalizedPath);
+        const result = detectConflicts([targetStory, ...activeStories], workingDir, 'main');
+        // Filter conflicts involving target story
+        const relevantConflicts = result.conflicts.filter(conflict => conflict.storyA === targetStory.frontmatter.id || conflict.storyB === targetStory.frontmatter.id);
+        // Filter out 'none' severity conflicts (keep all displayable conflicts including low)
+        const displayableConflicts = relevantConflicts.filter(conflict => conflict.severity !== 'none');
+        if (displayableConflicts.length === 0) {
+            console.log(c.success('✓ Conflict check: No overlapping files with active stories'));
+            return { proceed: true, warnings: [] };
+        }
+        // Sort conflicts by severity (high -> medium -> low)
+        const severityOrder = { high: 0, medium: 1, low: 2, none: 3 };
+        const sortedConflicts = displayableConflicts.sort((a, b) => severityOrder[a.severity] - severityOrder[b.severity]);
+        // Display conflicts
+        console.log();
+        console.log(c.warning('⚠️  Potential conflicts detected:'));
+        console.log();
+        for (const conflict of sortedConflicts) {
+            const otherStoryId = conflict.storyA === targetStory.frontmatter.id ? conflict.storyB : conflict.storyA;
+            // Two-stage sanitization: validate structure, then strip for display
+            try {
+                const validatedTargetId = sanitizeStoryId(targetStory.frontmatter.id);
+                const validatedOtherId = sanitizeStoryId(otherStoryId);
+                const sanitizedTargetId = sanitizeForDisplay(validatedTargetId);
+                const sanitizedOtherId = sanitizeForDisplay(validatedOtherId);
+                console.log(c.warning(`   ${sanitizedTargetId} may conflict with ${sanitizedOtherId}:`));
+            }
+            catch (error) {
+                // If validation fails, show generic error (defensive)
+                console.log(c.warning(`   Story may have conflicting changes (invalid ID format)`));
+            }
+            // Display shared files
+            for (const file of conflict.sharedFiles) {
+                const severityLabel = conflict.severity === 'high' ? c.error('High') :
+                    conflict.severity === 'medium' ? c.warning('Medium') :
+                        c.info('Low');
+                const sanitizedFile = sanitizeForDisplay(file);
+                console.log(`   - ${severityLabel}: ${sanitizedFile} (both stories modify this file)`);
+            }
+            // Display shared directories
+            for (const dir of conflict.sharedDirectories) {
+                const severityLabel = conflict.severity === 'high' ? c.error('High') :
+                    conflict.severity === 'medium' ? c.warning('Medium') :
+                        c.info('Low');
+                const sanitizedDir = sanitizeForDisplay(dir);
+                console.log(`   - ${severityLabel}: ${sanitizedDir} (both stories modify files in this directory)`);
+            }
+            console.log();
+            const sanitizedRecommendation = sanitizeForDisplay(conflict.recommendation);
+            console.log(c.dim(`   Recommendation: ${sanitizedRecommendation}`));
+            console.log();
+        }
+        // Non-interactive mode: default to declining
+        if (!process.stdin.isTTY) {
+            console.log(c.dim('Non-interactive mode: conflicts require --force to proceed'));
+            return { proceed: false, warnings: ['Conflicts detected'] };
+        }
+        // Interactive mode: prompt user
+        const shouldContinue = await confirmRemoval('Continue anyway?');
+        return {
+            proceed: shouldContinue,
+            warnings: shouldContinue ? ['User confirmed with conflicts'] : ['Conflicts detected']
+        };
+    }
+    catch (error) {
+        // Fail-open: allow proceeding if conflict detection fails
+        console.log(c.warning('⚠️  Conflict detection unavailable'));
+        console.log(c.dim('Proceeding without conflict check...'));
+        return { proceed: true, warnings: ['Conflict detection failed'] };
+    }
+}
 /**
  * Run the workflow (process one action or all)
  */
@@ -537,6 +693,17 @@ export async function run(options) {
         }
     }
     if (shouldUseWorktree && options.story && targetStory) {
+        // PRE-FLIGHT CHECK: Run conflict detection before creating worktree
+        const preFlightResult = await preFlightConflictCheck(targetStory, sdlcRoot, options);
+        if (!preFlightResult.proceed) {
+            console.log(c.error('❌ Aborting. Complete active stories first or use --force.'));
+            return;
+        }
+        // Log warnings if user proceeded despite conflicts (skip internal flag messages)
+        if (preFlightResult.warnings.length > 0 && !preFlightResult.warnings.includes('Conflict check skipped')) {
+            preFlightResult.warnings.forEach(w => console.log(c.dim(`  ⚠ ${w}`)));
+            console.log();
+        }
         const workingDir = path.dirname(sdlcRoot);
         // Check if story already has an existing worktree (resume scenario)
         const existingWorktreePath = targetStory.frontmatter.worktree_path;
@@ -803,61 +970,83 @@ export async function run(options) {
 async function executeAction(action, sdlcRoot) {
     const config = loadConfig();
     const c = getThemedChalk(config);
-    // Resolve story by ID to get current path (handles moves between folders)
-    let resolvedPath;
+    // Initialize per-story logger
+    const maxLogs = config.logging?.maxFiles ?? 5;
+    let logger = null;
+    let spinner = null;
     try {
-        const story = getStory(sdlcRoot, action.storyId);
-        resolvedPath = story.path;
+        logger = new StoryLogger(action.storyId, sdlcRoot, maxLogs);
+        logger.log('INFO', `Starting action: ${action.type} for story ${action.storyId}`);
     }
     catch (error) {
-        console.log(c.error(`Error: Story not found for action "${action.type}"`));
-        console.log(c.dim(`  Story ID: ${action.storyId}`));
-        console.log(c.dim(`  Original path: ${action.storyPath}`));
-        if (error instanceof Error) {
-            console.log(c.dim(`  ${error.message}`));
-        }
-        return { success: false };
+        // If logger initialization fails, continue without logging (console-only)
+        console.warn(`Warning: Failed to initialize logger: ${error instanceof Error ? error.message : String(error)}`);
     }
-    // Update action path if it was stale
-    if (resolvedPath !== action.storyPath) {
-        console.log(c.warning(`Note: Story path updated (file was moved)`));
-        console.log(c.dim(`  From: ${action.storyPath}`));
-        console.log(c.dim(`  To: ${resolvedPath}`));
-        action.storyPath = resolvedPath;
-    }
-    // Store phase completion state BEFORE action execution (to detect transitions)
-    const storyBeforeAction = parseStory(action.storyPath);
-    const prevPhaseState = {
-        research_complete: storyBeforeAction.frontmatter.research_complete,
-        plan_complete: storyBeforeAction.frontmatter.plan_complete,
-        implementation_complete: storyBeforeAction.frontmatter.implementation_complete,
-        reviews_complete: storyBeforeAction.frontmatter.reviews_complete,
-        status: storyBeforeAction.frontmatter.status,
-    };
-    const spinner = ora(formatAction(action, true, c)).start();
-    const baseText = formatAction(action, true, c);
-    // Create agent progress callback for real-time updates
-    const onAgentProgress = (event) => {
-        switch (event.type) {
-            case 'session_start':
-                spinner.text = `${baseText} ${c.dim('(session started)')}`;
-                break;
-            case 'tool_start':
-                // Show which tool is being executed
-                const toolName = event.toolName || 'unknown';
-                const shortName = toolName.replace(/^(mcp__|Mcp)/, '').substring(0, 30);
-                spinner.text = `${baseText} ${c.dim(`→ ${shortName}`)}`;
-                break;
-            case 'tool_end':
-                // Keep showing the action, tool completed
-                spinner.text = baseText;
-                break;
-            case 'completion':
-                spinner.text = `${baseText} ${c.dim('(completing...)')}`;
-                break;
-        }
-    };
     try {
+        // Resolve story by ID to get current path (handles moves between folders)
+        let resolvedPath;
+        try {
+            const story = getStory(sdlcRoot, action.storyId);
+            resolvedPath = story.path;
+        }
+        catch (error) {
+            const errorMsg = `Error: Story not found for action "${action.type}"`;
+            logger?.log('ERROR', errorMsg);
+            logger?.log('ERROR', `  Story ID: ${action.storyId}`);
+            logger?.log('ERROR', `  Original path: ${action.storyPath}`);
+            console.log(c.error(errorMsg));
+            console.log(c.dim(`  Story ID: ${action.storyId}`));
+            console.log(c.dim(`  Original path: ${action.storyPath}`));
+            if (error instanceof Error) {
+                logger?.log('ERROR', `  ${error.message}`);
+                console.log(c.dim(`  ${error.message}`));
+            }
+            return { success: false };
+        }
+        // Update action path if it was stale
+        if (resolvedPath !== action.storyPath) {
+            logger?.log('WARN', `Note: Story path updated (file was moved)`);
+            logger?.log('WARN', `  From: ${action.storyPath}`);
+            logger?.log('WARN', `  To: ${resolvedPath}`);
+            console.log(c.warning(`Note: Story path updated (file was moved)`));
+            console.log(c.dim(`  From: ${action.storyPath}`));
+            console.log(c.dim(`  To: ${resolvedPath}`));
+            action.storyPath = resolvedPath;
+        }
+        // Store phase completion state BEFORE action execution (to detect transitions)
+        const storyBeforeAction = parseStory(action.storyPath);
+        const prevPhaseState = {
+            research_complete: storyBeforeAction.frontmatter.research_complete,
+            plan_complete: storyBeforeAction.frontmatter.plan_complete,
+            implementation_complete: storyBeforeAction.frontmatter.implementation_complete,
+            reviews_complete: storyBeforeAction.frontmatter.reviews_complete,
+            status: storyBeforeAction.frontmatter.status,
+        };
+        spinner = ora(formatAction(action, true, c)).start();
+        const baseText = formatAction(action, true, c);
+        // Create agent progress callback for real-time updates
+        const onAgentProgress = (event) => {
+            if (!spinner)
+                return; // Guard against null spinner
+            switch (event.type) {
+                case 'session_start':
+                    spinner.text = `${baseText} ${c.dim('(session started)')}`;
+                    break;
+                case 'tool_start':
+                    // Show which tool is being executed
+                    const toolName = event.toolName || 'unknown';
+                    const shortName = toolName.replace(/^(mcp__|Mcp)/, '').substring(0, 30);
+                    spinner.text = `${baseText} ${c.dim(`→ ${shortName}`)}`;
+                    break;
+                case 'tool_end':
+                    // Keep showing the action, tool completed
+                    spinner.text = baseText;
+                    break;
+                case 'completion':
+                    spinner.text = `${baseText} ${c.dim('(completing...)')}`;
+                    break;
+            }
+        };
         // Import and run the appropriate agent
         let result;
         switch (action.type) {
@@ -881,6 +1070,8 @@ async function executeAction(action, sdlcRoot) {
                 const { runReviewAgent } = await import('../agents/review.js');
                 result = await runReviewAgent(action.storyPath, sdlcRoot, {
                     onVerificationProgress: (phase, status, message) => {
+                        if (!spinner)
+                            return; // Guard against null spinner
                         const phaseLabel = phase === 'build' ? 'Building' : 'Testing';
                         switch (status) {
                             case 'starting':
@@ -931,15 +1122,19 @@ async function executeAction(action, sdlcRoot) {
         // Check if agent succeeded
         if (result && !result.success) {
             spinner.fail(c.error(`Failed: ${formatAction(action, true, c)}`));
+            logger?.log('ERROR', `Action failed: ${formatAction(action, false, c)}`);
             if (result.error) {
+                logger?.log('ERROR', `  Error: ${result.error}`);
                 console.error(c.error(`  Error: ${result.error}`));
             }
             return { success: false };
         }
         spinner.succeed(c.success(formatAction(action, true, c)));
+        logger?.log('INFO', `Action completed successfully: ${formatAction(action, false, c)}`);
         // Show changes made
         if (result && result.changesMade.length > 0) {
             for (const change of result.changesMade) {
+                logger?.log('INFO', `  → ${change}`);
                 console.log(c.dim(`  → ${change}`));
             }
         }
@@ -995,14 +1190,21 @@ async function executeAction(action, sdlcRoot) {
         return { success: true };
     }
     catch (error) {
-        spinner.fail(c.error(`Failed: ${formatAction(action, true, c)}`));
+        if (spinner) {
+            spinner.fail(c.error(`Failed: ${formatAction(action, true, c)}`));
+        }
+        else {
+            console.error(c.error(`Failed: ${formatAction(action, true, c)}`));
+        }
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        logger?.log('ERROR', `Exception during action execution: ${errorMessage}`);
         console.error(error);
         // Show phase checklist with error indication (if file still exists)
         try {
             const story = parseStory(action.storyPath);
             console.log(c.dim(`  Progress: ${renderPhaseChecklist(story, c)}`));
             // Update story with error
-            story.frontmatter.last_error = error instanceof Error ? error.message : String(error);
+            story.frontmatter.last_error = errorMessage;
         }
         catch {
             // File may have been moved - skip progress display
@@ -1010,6 +1212,10 @@ async function executeAction(action, sdlcRoot) {
         // Don't throw - let the workflow continue if in auto mode
         return { success: false };
     }
+    finally {
+        // Always close logger, even if action fails or throws
+        logger?.close();
+    }
 }
 /**
  * Get phase information for an action type
@@ -1546,12 +1752,15 @@ export async function migrate(options) {
  * Helper function to prompt for removal confirmation
  */
 async function confirmRemoval(message) {
+    // Sanitize message to prevent terminal injection attacks
+    // Use consistent sanitizeForDisplay() for all terminal output
+    const sanitizedMessage = sanitizeForDisplay(message);
     const rl = readline.createInterface({
         input: process.stdin,
         output: process.stdout,
     });
     return new Promise((resolve) => {
-        rl.question(message + ' (y/N): ', (answer) => {
+        rl.question(sanitizedMessage + ' (y/N): ', (answer) => {
             rl.close();
             resolve(answer.toLowerCase() === 'y' || answer.toLowerCase() === 'yes');
         });