aidevops 3.39.52 → 3.39.54

package/README.md

@@ -25,7 +25,7 @@ token efficiency, and quality control built in.**
 [![Maintainability](https://qlty.sh/gh/marcusquinn/projects/aidevops/maintainability.svg)](https://qlty.sh/gh/marcusquinn/projects/aidevops)
 [![Codacy Badge](https://app.codacy.com/project/badge/Grade/2b1adbd66c454dae92234341e801b984)](https://app.codacy.com/gh/marcusquinn/aidevops/dashboard?utm_source=gh&utm_medium=referral&utm_content=&utm_campaign=Badge_grade)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/Version-3.39.52-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
+[![Version](https://img.shields.io/badge/Version-3.39.54-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
 [![npm version](https://img.shields.io/npm/v/aidevops)](https://www.npmjs.com/package/aidevops)
 [![Homebrew](https://img.shields.io/badge/homebrew-marcusquinn%2Ftap-orange)](https://github.com/marcusquinn/homebrew-tap)
 

package/VERSION

@@ -1 +1 @@
-3.39.52
+3.39.54

package/aidevops.sh

@@ -5,7 +5,7 @@
 # AI DevOps Framework CLI
 # Usage: aidevops <command> [options]
 #
-# Version: 3.39.52
+# Version: 3.39.54
 
 set -euo pipefail
 
@@ -1231,7 +1231,7 @@ _help_commands() {
 	echo "  lint [cmd]         Audit/configure native repo lint, format, typecheck, and hooks"
 	echo "  design <cmd>       DESIGN.md detection, scaffolding, and brand guideline exports"
 	echo "  keywords <cmd>     context/keywords.md search targets: scaffold, brief, sync, track, budget"
-	echo "  cleanup <cmd>      Cleanup helpers (remote branch audit/delete)"
+	echo "  cleanup [cmd]      Storage report/reclaim (all --apply) and branch cleanup"
 	echo "  model-accounts-pool OAuth account pool (list/check/diagnose/add/rotate/reset-cooldowns)"
 	echo "  gpt56-context <cmd> Manage the 300K GPT-5.6 OpenCode context cap (enable/disable/status)"
 	echo "  gpt6-context <cmd> Manage the default ~240K GPT-6 Sol/Luna compaction cap (enable/disable/status)"
@@ -1760,8 +1760,55 @@ _main_check_version() {
 	return 0
 }
 
+# Verify advisory metadata only during an explicit full security assessment.
+_security_check_advisories() {
+	local advisories_dir="$HOME/.aidevops/advisories"
+	local dismissed_file="$advisories_dir/dismissed.txt"
+	local tls_helper="tls-trust-helper.sh"
+	local advisory_file adv_id line check status
+	local -a check_args=()
+	for advisory_file in "$advisories_dir"/*.advisory; do
+		[[ -f "$advisory_file" ]] || continue
+		adv_id="${advisory_file##*/}"
+		adv_id="${adv_id%.advisory}"
+		if [[ -f "$dismissed_file" ]] && grep -qxF -- "$adv_id" "$dismissed_file"; then
+			continue
+		fi
+		check=""
+		while IFS= read -r line || [[ -n "$line" ]]; do
+			if [[ "$line" == '# check: '* ]]; then
+				check="${line#\# check: }"
+				break
+			fi
+		done <"$advisory_file"
+		[[ -n "$check" ]] || continue
+		# Split literal whitespace only: no evaluation, expansion or shell quoting.
+		IFS=$' \t' read -r -a check_args <<<"$check"
+		# Allow only the checking subcommand, never help/probe-script (also exit 0).
+		if [[ "${check_args[0]:-}" != tls-trust || "${check_args[1]:-}" != local ]] ||
+			{ [[ ${#check_args[@]} -ne 2 ]] &&
+				! { [[ ${#check_args[@]} -eq 4 && "${check_args[2]:-}" == --canary && "${check_args[3]:-}" != -* ]]; }; }; then
+			printf 'Keeping %s: unsupported advisory check\n' "$adv_id"
+			continue
+		fi
+		status=0
+		_dispatch_helper "$tls_helper" "$tls_helper" "${check_args[@]:1}" || status=$?
+		if [[ "$status" -eq 0 ]]; then
+			if printf '%s\n' "$adv_id" >>"$dismissed_file"; then
+				printf 'auto-dismissed %s: verified clean\n' "$adv_id"
+			else
+				printf 'Keeping %s: could not record dismissal\n' "$adv_id" >&2
+			fi
+		else
+			printf 'Keeping %s: advisory check exited %s\n' "$adv_id" "$status"
+		fi
+	done
+	return 0
+}
+
 # Route 'aidevops security [subcommand]' to appropriate helpers
 _cmd_security() {
+	local tls_helper="tls-trust-helper.sh"
 	case "${1:-}" in
 	"")
 		# No args: run ALL security checks (posture + hygiene + advisories)
@@ -1774,6 +1821,9 @@ _cmd_security() {
 		_dispatch_helper "secret-hygiene-helper.sh" "secret-hygiene-helper.sh" scan || true
 		echo ""
 		_dispatch_helper "supply-chain-advisory-helper.sh" "supply-chain-advisory-helper.sh" scan || true
+		echo ""
+		_dispatch_helper "$tls_helper" "$tls_helper" local || true
+		_security_check_advisories
 		;;
 	scan | scan-secrets | scan-pth | scan-deps)
 		_dispatch_helper "secret-hygiene-helper.sh" "secret-hygiene-helper.sh" "$@"
@@ -1808,6 +1858,11 @@ _cmd_security() {
 		shift || true
 		_dispatch_helper "supply-chain-advisory-helper.sh" "supply-chain-advisory-helper.sh" "${@:-scan}"
 		;;
+	tls-trust)
+		shift || true
+		_dispatch_helper "$tls_helper" "$tls_helper" "${@:-local}"
+		return $?
+		;;
 	*)
 		_dispatch_helper "security-posture-helper.sh" "security-posture-helper.sh" "$@"
 		;;
@@ -2100,7 +2155,8 @@ _main_dispatch() {
 }
 
 _main_dispatch_cleanup() {
-	local cleanup_subcommand="${1:-help}"
+	local cleanup_subcommand="${1:-report}"
+	local storage_helper="storage-cleanup-helper.sh"
 	case "$cleanup_subcommand" in
 	branches | remote-branches)
 		shift || true
@@ -2110,22 +2166,33 @@ _main_dispatch_cleanup() {
 		shift || true
 		_dispatch_helper "local-branch-cleanup-helper.sh" "local-branch-cleanup-helper.sh" "$@"
 		;;
-	help | --help | -h | "")
-		echo "Usage: aidevops cleanup <branches|remote-branches|local-branches> [options]"
+	report | status | all | tmp | worktrees | opencode | observability)
+		# GH#35245: storage stores route to their existing owning cleaners.
+		_dispatch_helper "$storage_helper" "$storage_helper" "$@"
+		return $?
+		;;
+	help | --help | -h)
+		echo "Usage: aidevops cleanup [report|all|<store>|<branch-cmd>] [options]"
+		echo ""
+		echo "Storage (dry-run unless --apply):"
+		echo "  (no args), report Sizes of aidevops-owned stores and their cleaners"
+		echo "  all [--apply]     Preview or clean every store"
+		echo "  tmp|worktrees|opencode|observability [--apply]  One store"
+		echo "  Daily automatic run: routine r922 Storage hygiene (installed by setup)"
 		echo ""
-		echo "Cleanup commands:"
-		echo "  branches          Audit stale remote branches (dry-run default)"
+		echo "Branches (dry-run unless --apply):"
+		echo "  branches          Audit stale remote branches"
 		echo "  remote-branches   Alias for branches"
-		echo "  local-branches    Audit merged local branches (dry-run default)"
+		echo "  local-branches    Audit merged local branches"
 		echo ""
-		echo "Options:"
+		echo "Branch options:"
 		echo "  --repo PATH       Repository path (default: current directory)"
 		echo "  --remote NAME     Remote to audit (default: origin)"
 		echo "  --branch NAME     Single local branch (local-branches only)"
 		echo "  --apply           Delete safe candidates"
 		echo ""
 		;;
-	*) print_error "Unknown cleanup subcommand: $cleanup_subcommand (try branches|remote-branches|local-branches|help)"; return 1 ;;
+	*) print_error "Unknown cleanup subcommand: $cleanup_subcommand (try report|all|tmp|worktrees|opencode|observability|branches|local-branches|help)"; return 1 ;;
 	esac
 	return 0
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aidevops",
-  "version": "3.39.52",
+  "version": "3.39.54",
   "description": "AI DevOps Framework - AI-assisted development workflows, code quality, and deployment automation",
   "type": "module",
   "packageManager": "bun@1.3.11",

package/setup.sh

@@ -17,7 +17,7 @@ fi
 # AI Assistant Server Access Framework Setup Script
 # Helps developers set up the framework for their infrastructure
 #
-# Version: 3.39.52
+# Version: 3.39.54
 #
 # Quick Install:
 #   npm install -g aidevops && aidevops update          (recommended)
@@ -1902,6 +1902,8 @@ _setup_noninteractive_schedulers() {
 	# opencode DB archive/VACUUM (GH#25136). Dedicated low-priority scheduler;
 	# not tied to pulse preflight cadence.
 	_time_step "setup_opencode_db_archive" setup_opencode_db_archive
+	# r922 storage hygiene (GH#35245). Daily owning-cleaner run, Pulse-independent.
+	_time_step "setup_storage_hygiene" setup_storage_hygiene
 	# Migrate cron entries to systemd after schedulers are installed (GH#17695 Finding D)
 	_time_step "migrate_cron_to_systemd" migrate_cron_to_systemd
 	_time_step "$SETUP_STAGE_TABBY" setup_tabby
@@ -1958,6 +1960,7 @@ _setup_post_setup_steps() {
 	setup_oauth_token_refresh
 	setup_opencode_db_maintenance
 	setup_opencode_db_archive
+	setup_storage_hygiene
 	# Migrate cron entries to systemd after schedulers are installed (GH#17695 Finding D)
 	migrate_cron_to_systemd
 	setup_tabby