brainclaw 0.28.0 → 1.5.3

package/dist/commands/accept.js

@@ -55,6 +55,7 @@ export function acceptCandidate(id, by, cwd, byId) {
                     session_id: candidate.session_id,
                     status: 'active',
                     tags: candidate.tags,
+                    plan_id: candidate.plan_id,
                 };
                 state.active_constraints.push(entry);
                 promotedItemId = entryId;
@@ -118,6 +119,8 @@ export function acceptCandidate(id, by, cwd, byId) {
                     session_id: candidate.session_id,
                     status: 'open',
                     tags: candidate.tags,
+                    plan_id: candidate.plan_id,
+                    narrative: candidate.narrative,
                 };
                 state.open_handoffs.push(entry);
                 promotedItemId = entryId;

package/dist/commands/add-step.js

@@ -1,33 +1,18 @@
-import { loadState, persistState } from '../core/state.js';
-import { memoryExists } from '../core/io.js';
-import { generateId, nowISO } from '../core/ids.js';
+import { requireInitialized } from '../core/guards.js';
 import { validateCliInput } from '../core/input-validation.js';
+import { addStep } from '../core/operations/plan.js';
 export function runAddStep(planId, text, options = {}) {
-    if (!memoryExists()) {
-        console.error('Error: .brainclaw/ not found. Run `brainclaw init` first.');
-        process.exit(1);
-    }
+    requireInitialized(process.cwd());
     validateCliInput(text);
-    const state = loadState();
-    const plan = state.plan_items.find((p) => p.id === planId || p.short_label === planId);
-    if (!plan) {
-        console.error(`Error: Plan '${planId}' not found.`);
+    try {
+        const result = addStep({ planId, text, assignee: options.assignee });
+        console.log(`✔ Step added: [${result.stepId}] ${text}`);
+        console.log(`  Plan [${result.planId}] progress: ${result.doneSteps}/${result.totalSteps} steps done`);
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        console.error(`Error: ${msg}`);
         process.exit(1);
     }
-    const step = {
-        id: generateId('plan_steps'),
-        text,
-        status: 'todo',
-        assignee: options.assignee,
-        created_at: nowISO(),
-        updated_at: nowISO(),
-    };
-    plan.steps = [...(plan.steps ?? []), step];
-    plan.updated_at = nowISO();
-    persistState(state);
-    const total = plan.steps.length;
-    const done = plan.steps.filter((s) => s.status === 'done').length;
-    console.log(`✔ Step added: [${step.id}] ${text}`);
-    console.log(`  Plan [${plan.id}] progress: ${done}/${total} steps done`);
 }
 //# sourceMappingURL=add-step.js.map

package/dist/commands/agent-board.js

@@ -1,13 +1,25 @@
 import { buildCoordinationSnapshot } from '../core/coordination.js';
 import { listAgentIdentities } from '../core/agent-registry.js';
 import { memoryExists } from '../core/io.js';
+import { listCandidates } from '../core/candidates.js';
+import { listRuntimeNotes } from '../core/runtime.js';
+import { loadState } from '../core/state.js';
+import { detectStaleness, staleSummary } from '../core/staleness.js';
+import { assessClaimLiveness } from '../core/claims.js';
+/** Tag non-healthy liveness states so operators spot orphaned/stale/never-adopted claims at a glance. */
+function livenessTag(status) {
+    if (status === 'live' || status === 'young')
+        return '';
+    return ` [${status.toUpperCase()}]`;
+}
 export function runAgentBoard(options = {}) {
     if (!memoryExists()) {
         console.error('Error: .brainclaw/ not found. Run `brainclaw init` first.');
         process.exit(1);
     }
     const board = buildCoordinationSnapshot({
-        agent: options.agent,
+        agent: options.allAgents ? undefined : options.agent,
+        skipAgentAutoDetect: options.allAgents,
         project: options.project,
         target: options.for,
         host: options.host,
@@ -15,8 +27,22 @@ export function runAgentBoard(options = {}) {
         includeReputation: options.withReputation,
         includeSessionMeta: options.includeSessionMeta,
     });
+    // Phase 4 Sprint 1 Lane A step 3 (pln#390): surface non-destructive
+    // stale warnings alongside the board so operators see them without
+    // running `doctor` separately. Capped at 5 to keep output lean.
+    let staleReport;
+    try {
+        const state = loadState();
+        const pending = listCandidates('pending');
+        const notes = listRuntimeNotes(undefined);
+        staleReport = detectStaleness(state.plan_items, state.known_traps, state.open_handoffs, pending, Date.now(), notes);
+    }
+    catch { /* non-fatal */ }
     if (options.json) {
-        console.log(JSON.stringify(board, null, 2));
+        console.log(JSON.stringify({
+            ...board,
+            ...(staleReport && staleReport.warnings.length > 0 ? { stale_report: staleReport } : {}),
+        }, null, 2));
         return;
     }
     console.log(`Agent board${board.agent ? ` for ${board.agent}` : ''}${board.project ? ` (${board.project})` : ''}`);
@@ -43,7 +69,34 @@ export function runAgentBoard(options = {}) {
     console.log('');
     console.log(`Active claims: ${board.active_claims.length}`);
     for (const claim of board.active_claims.slice(0, 10)) {
-        console.log(`  [${claim.id}] ${claim.agent} -> ${claim.scope}${claim.plan_id ? ` (plan ${claim.plan_id})` : ''}`);
+        const tag = livenessTag(assessClaimLiveness(claim).status);
+        console.log(`  [${claim.id}] ${claim.agent} -> ${claim.scope}${claim.plan_id ? ` (plan ${claim.plan_id})` : ''}${tag}`);
+    }
+    console.log('');
+    console.log(`Active assignments: ${board.active_assignments.length}`);
+    for (const assignment of board.active_assignments.slice(0, 10)) {
+        console.log(`  [${assignment.id}] ${assignment.agent} (${assignment.status}) -> ${assignment.scope}${assignment.plan_id ? ` (plan ${assignment.plan_id})` : ''}`);
+    }
+    console.log('');
+    console.log(`Active runs: ${board.active_runs.length}`);
+    for (const run of board.active_runs.slice(0, 10)) {
+        console.log(`  [${run.id}] ${run.agent} (${run.status}/${run.transport}) -> ${run.scope}${run.assignment_id ? ` (assignment ${run.assignment_id})` : ''} [attempt ${run.attempt_index}]`);
+    }
+    console.log('');
+    console.log(`Pending actions: ${board.active_actions.length}`);
+    for (const action of board.active_actions.slice(0, 10)) {
+        console.log(`  [${action.id}] ${action.kind} for ${action.agent} (${action.status})${action.assignment_id ? ` [assignment ${action.assignment_id}]` : ''}: ${action.title}`);
+    }
+    console.log('');
+    console.log(`Active sequence: ${board.active_sequence ? `1 (${board.active_sequence.name})` : '0'}`);
+    if (board.active_sequence) {
+        console.log(`  [${board.active_sequence.id}] ${board.active_sequence.name} (${board.active_sequence.status})`);
+        for (const item of board.active_sequence.items.slice(0, 10)) {
+            const lane = item.lane ? ` lane=${item.lane}` : '';
+            const hardAfter = item.hard_after.length ? ` hard_after=${item.hard_after.join(',')}` : '';
+            const softAfter = item.soft_after.length ? ` soft_after=${item.soft_after.join(',')}` : '';
+            console.log(`    #${item.rank} ${item.planId}${lane}${hardAfter}${softAfter}`);
+        }
     }
     console.log('');
     const sessionMetaHint = board.session_meta_hidden > 0 ? ` (+${board.session_meta_hidden} session lifecycle notes hidden — use --include-session-meta to show)` : '';
@@ -102,5 +155,19 @@ export function runAgentBoard(options = {}) {
             }
         }
     }
+    // Stale-memory summary — non-destructive. Shown after the core board
+    // so the signal is visible but does not push the primary state off
+    // the screen.
+    if (staleReport && staleReport.warnings.length > 0) {
+        console.log('');
+        console.log(`⚠ Stale memory: ${staleSummary(staleReport)}`);
+        for (const w of staleReport.warnings.slice(0, 5)) {
+            console.log(`  [${w.entity} ${w.id}] ${w.reason}`);
+            console.log(`    → ${w.suggested_action}`);
+        }
+        if (staleReport.warnings.length > 5) {
+            console.log(`  … and ${staleReport.warnings.length - 5} more (run \`brainclaw doctor\` for the full list).`);
+        }
+    }
 }
 //# sourceMappingURL=agent-board.js.map

package/dist/commands/audit.js

@@ -1,10 +1,15 @@
 import { readAuditLog } from '../core/audit.js';
+import { buildGovernanceReport, renderGovernanceMarkdown } from '../core/governance.js';
 import { memoryExists } from '../core/io.js';
 export function runAuditCommand(options = {}) {
     if (!memoryExists()) {
         console.error('Error: .brainclaw/ not found. Run `brainclaw init` first.');
         process.exit(1);
     }
+    if (options.governance) {
+        runGovernanceReport(options);
+        return;
+    }
     const entries = readAuditLog({
         since: options.since,
         actor: options.actor,
@@ -27,9 +32,23 @@ export function runAuditCommand(options = {}) {
             parts.push(`→ ${entry.item_id}`);
         if (entry.item_type)
             parts.push(`(${entry.item_type})`);
+        if (entry.scope)
+            parts.push(`scope:${entry.scope}`);
         if (entry.reason)
             parts.push(`| ${entry.reason}`);
         console.log(parts.join(' '));
     }
 }
+function runGovernanceReport(options) {
+    const report = buildGovernanceReport({
+        scope: options.scope,
+        agent: options.actor,
+        since: options.since,
+    });
+    if (options.json) {
+        console.log(JSON.stringify(report, null, 2));
+        return;
+    }
+    console.log(renderGovernanceMarkdown(report));
+}
 //# sourceMappingURL=audit.js.map

package/dist/commands/check-policy.js

@@ -0,0 +1,54 @@
+import { memoryExists } from '../core/io.js';
+import { checkPolicy } from '../core/policy.js';
+export function runCheckPolicy(options) {
+    if (!memoryExists(options.cwd)) {
+        console.error('Error: .brainclaw/ not found. Run `brainclaw init` first.');
+        process.exit(1);
+    }
+    const result = checkPolicy({
+        scope: options.scope,
+        agent: options.agent,
+        agentId: options.agentId,
+        action: options.action,
+        cwd: options.cwd,
+    });
+    if (options.json) {
+        console.log(JSON.stringify(result, null, 2));
+        process.exit(result.allowed ? 0 : 1);
+    }
+    printResult(result, options.scope);
+    process.exit(result.allowed ? 0 : 1);
+}
+function printResult(result, scope) {
+    const status = result.allowed ? '✔ ALLOWED' : '✘ BLOCKED';
+    console.log(`\nPolicy check for scope "${scope}": ${status}\n`);
+    if (result.blocks.length > 0) {
+        console.log('Blocks:');
+        for (const b of result.blocks) {
+            console.log(`  ✘ [${b.kind}] ${b.message}`);
+        }
+        console.log('');
+    }
+    if (result.warnings.length > 0) {
+        console.log('Warnings:');
+        for (const w of result.warnings) {
+            const idLabel = w.id ? ` (${w.id})` : '';
+            console.log(`  ⚠ [${w.kind}]${idLabel} ${w.message}`);
+        }
+        console.log('');
+    }
+    if (result.blocks.length === 0 && result.warnings.length === 0) {
+        console.log('  No issues found.');
+        console.log('');
+    }
+    const ctx = result.governance_context;
+    if (ctx.active_instructions.length > 0) {
+        console.log(`Governance context: ${ctx.active_instructions.length} active instruction(s)`);
+        for (const ins of ctx.active_instructions) {
+            const layerLabel = ins.layer === 'global' ? '[global]' : `[${ins.layer}:${ins.scope ?? '*'}]`;
+            console.log(`  ${layerLabel} ${ins.text.slice(0, 120)}${ins.text.length > 120 ? '…' : ''}`);
+        }
+        console.log('');
+    }
+}
+//# sourceMappingURL=check-policy.js.map

package/dist/commands/check-security-mcp.js

@@ -0,0 +1,145 @@
+import { memoryExists, memoryPath } from '../core/io.js';
+import { loadConfig } from '../core/config.js';
+import { SecurityCache } from '../core/security-cache.js';
+import { querySocketScores } from '../core/socket-client.js';
+import { evaluateBatch, worstDecision } from '../core/security-scoring.js';
+import { createTrap } from '../core/operations/memory-write.js';
+export async function handleCheckSecurity(args, cwd) {
+    if (!memoryExists(cwd)) {
+        return { content: [{ type: 'text', text: 'Error: .brainclaw/ not found. Run brainclaw init first.' }] };
+    }
+    const config = loadConfig(cwd);
+    const preinstall = config.security?.preinstall;
+    if (!preinstall?.enabled) {
+        return { content: [{ type: 'text', text: 'Security preinstall checks are not enabled. Set security.preinstall.enabled: true in config.yaml.' }] };
+    }
+    const packagesStr = String(args.packages ?? '').trim();
+    if (!packagesStr) {
+        return { content: [{ type: 'text', text: 'Error: missing required argument: packages' }] };
+    }
+    const ecosystem = (String(args.ecosystem ?? 'npm').trim());
+    const packageNames = packagesStr.split(',').map(p => p.trim()).filter(Boolean);
+    // Build cache
+    const cachePath = memoryPath('security/cache.json', cwd);
+    const cache = new SecurityCache(cachePath, preinstall.cache_ttl_hours);
+    // Separate cached vs uncached
+    const queries = [];
+    const cachedScores = [];
+    for (const name of packageNames) {
+        const [depname, version] = parsePackageName(name);
+        const cached = cache.get(ecosystem, depname, version);
+        if (cached) {
+            cachedScores.push(cached);
+        }
+        else {
+            queries.push({ depname, ecosystem, ...(version !== 'latest' ? { version } : {}) });
+        }
+    }
+    // Fetch uncached from Socket
+    let fetchedScores = [];
+    let fetchError = null;
+    if (queries.length > 0) {
+        try {
+            fetchedScores = await querySocketScores(queries, { endpoint: preinstall.socket_endpoint });
+            for (const s of fetchedScores) {
+                const eco = s.purl.startsWith('pkg:pypi') ? 'pypi' : 'npm';
+                const depname = s.purl.replace(/^pkg:\w+\//, '');
+                cache.set(eco, depname, s.version, s);
+            }
+            cache.flush();
+        }
+        catch (err) {
+            fetchError = err instanceof Error ? err.message : String(err);
+        }
+    }
+    const allScores = [...cachedScores, ...fetchedScores];
+    if (allScores.length === 0 && fetchError) {
+        const fallback = preinstall.fallback_on_error;
+        return {
+            content: [{ type: 'text', text: `Socket MCP error: ${fetchError}\nFallback policy: ${fallback}` }],
+            structuredContent: { error: fetchError, fallback, decision: fallback === 'block' ? 'block' : fallback === 'warn' ? 'warn' : 'pass' },
+        };
+    }
+    const verdicts = evaluateBatch(allScores, preinstall);
+    const worst = worstDecision(verdicts);
+    // Build text output
+    const lines = [];
+    if (fetchError) {
+        lines.push(`\u26A0 Socket MCP partial error: ${fetchError} (${cachedScores.length} results from cache)`);
+        lines.push('');
+    }
+    for (const v of verdicts) {
+        const icon = v.decision === 'pass' ? '\u2705' : v.decision === 'warn' ? '\u26A0\uFE0F' : '\uD83D\uDED1';
+        lines.push(`${icon} ${v.ecosystem}/${v.package}@${v.version} \u2014 composite=${v.composite} [${v.decision.toUpperCase()}]`);
+        lines.push(`   SC=${v.scores.supplyChain} vuln=${v.scores.vulnerability} qual=${v.scores.quality} maint=${v.scores.maintenance} lic=${v.scores.license}`);
+        for (const r of v.reasons) {
+            lines.push(`   \u2192 ${r}`);
+        }
+    }
+    // Auto-create traps for WARN and BLOCK verdicts
+    const trapsCreated = [];
+    for (const v of verdicts) {
+        if (v.decision === 'pass')
+            continue;
+        const severity = v.decision === 'block' ? 'high' : 'medium';
+        const trapText = `Security ${v.decision.toUpperCase()}: ${v.ecosystem}/${v.package}@${v.version} — composite=${v.composite}, SC=${v.scores.supplyChain}, vuln=${v.scores.vulnerability}. ${v.reasons.join('; ')}`;
+        try {
+            const result = createTrap({
+                text: trapText,
+                author: 'brainclaw-security',
+                severity: severity,
+                tags: ['security', 'supply-chain', `decision:${v.decision}`, v.ecosystem],
+                expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString(),
+            }, cwd);
+            trapsCreated.push(result.id);
+        }
+        catch {
+            // Non-critical: trap creation failure should not block the security check
+        }
+    }
+    if (trapsCreated.length > 0) {
+        lines.push('');
+        lines.push(`Created ${trapsCreated.length} security trap(s): ${trapsCreated.join(', ')}`);
+    }
+    lines.push('');
+    lines.push(`Overall decision: ${worst.toUpperCase()}`);
+    return {
+        content: [{ type: 'text', text: lines.join('\n') }],
+        structuredContent: {
+            verdicts: verdicts.map(v => ({
+                package: v.package,
+                ecosystem: v.ecosystem,
+                version: v.version,
+                composite: v.composite,
+                decision: v.decision,
+                reasons: v.reasons,
+                scores: {
+                    supplyChain: v.scores.supplyChain,
+                    vulnerability: v.scores.vulnerability,
+                    quality: v.scores.quality,
+                    maintenance: v.scores.maintenance,
+                    license: v.scores.license,
+                },
+            })),
+            decision: worst,
+            ...(fetchError ? { fetch_error: fetchError } : {}),
+        },
+    };
+}
+function parsePackageName(name) {
+    // Handle scoped packages: @scope/pkg@version
+    if (name.startsWith('@')) {
+        const lastAt = name.lastIndexOf('@', name.length - 1);
+        if (lastAt > 0) {
+            return [name.slice(0, lastAt), name.slice(lastAt + 1)];
+        }
+        return [name, 'latest'];
+    }
+    // Regular: pkg@version
+    if (name.includes('@')) {
+        const [depname, version] = name.split('@');
+        return [depname, version || 'latest'];
+    }
+    return [name, 'latest'];
+}
+//# sourceMappingURL=check-security-mcp.js.map

package/dist/commands/check-security.js

@@ -0,0 +1,106 @@
+import { memoryExists, memoryPath } from '../core/io.js';
+import { loadConfig } from '../core/config.js';
+import { SecurityCache } from '../core/security-cache.js';
+import { querySocketScores } from '../core/socket-client.js';
+import { evaluateBatch, worstDecision } from '../core/security-scoring.js';
+export async function runCheckSecurity(options) {
+    if (!memoryExists(options.cwd)) {
+        console.error('Error: .brainclaw/ not found. Run `brainclaw init` first.');
+        process.exit(1);
+    }
+    const config = loadConfig(options.cwd);
+    const preinstall = config.security?.preinstall;
+    if (!preinstall?.enabled) {
+        console.error('Security preinstall checks are not enabled. Set security.preinstall.enabled: true in config.yaml');
+        process.exit(1);
+    }
+    const ecosystem = options.ecosystem ?? 'npm';
+    const packageNames = options.packages.split(',').map(p => p.trim()).filter(Boolean);
+    if (packageNames.length === 0) {
+        console.error('No packages specified.');
+        process.exit(1);
+    }
+    // Build cache
+    const cachePath = memoryPath('security/cache.json', options.cwd);
+    const cache = new SecurityCache(cachePath, preinstall.cache_ttl_hours);
+    // Separate cached vs uncached
+    const queries = [];
+    const cachedResults = [];
+    for (const name of packageNames) {
+        const [depname, version] = name.includes('@') && !name.startsWith('@')
+            ? name.split('@')
+            : name.startsWith('@')
+                ? [name.slice(0, name.lastIndexOf('@')) || name, name.slice(name.lastIndexOf('@') + 1) || 'latest']
+                : [name, 'latest'];
+        const cached = cache.get(ecosystem, depname, version);
+        const query = { depname, ecosystem, ...(version !== 'latest' ? { version } : {}) };
+        if (cached) {
+            cachedResults.push({ query, scores: cached });
+        }
+        else {
+            queries.push(query);
+        }
+    }
+    // Fetch uncached from Socket
+    let fetchedScores = [];
+    if (queries.length > 0) {
+        try {
+            fetchedScores = await querySocketScores(queries, { endpoint: preinstall.socket_endpoint });
+            // Update cache
+            for (const s of fetchedScores) {
+                const eco = s.purl.startsWith('pkg:pypi') ? 'pypi' : 'npm';
+                const depname = s.purl.replace(/^pkg:\w+\//, '');
+                cache.set(eco, depname, s.version, s);
+            }
+            cache.flush();
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (preinstall.fallback_on_error === 'block') {
+                console.error(`Socket MCP error: ${msg} — blocking (fallback=block)`);
+                process.exit(2);
+            }
+            if (preinstall.fallback_on_error === 'warn') {
+                console.error(`Socket MCP error: ${msg} — allowing with warning (fallback=warn)`);
+            }
+            // fallback=pass: silent continue
+            if (cachedResults.length === 0) {
+                process.exit(preinstall.fallback_on_error === 'warn' ? 1 : 0);
+            }
+        }
+    }
+    // Combine cached + fetched scores
+    const allScores = [
+        ...cachedResults.filter(c => c.scores !== null).map(c => c.scores),
+        ...fetchedScores,
+    ];
+    const verdicts = evaluateBatch(allScores, preinstall);
+    const worst = worstDecision(verdicts);
+    if (options.json) {
+        console.log(JSON.stringify({ verdicts, decision: worst }, null, 2));
+    }
+    else {
+        printVerdicts(verdicts);
+    }
+    // Exit codes: 0=pass, 1=warn, 2=block
+    if (worst === 'block')
+        process.exit(2);
+    if (worst === 'warn')
+        process.exit(1);
+    process.exit(0);
+}
+function printVerdicts(verdicts) {
+    if (verdicts.length === 0) {
+        console.log('No packages to check.');
+        return;
+    }
+    for (const v of verdicts) {
+        const icon = v.decision === 'pass' ? '\u2705' : v.decision === 'warn' ? '\u26A0\uFE0F' : '\uD83D\uDED1';
+        console.log(`${icon} ${v.ecosystem}/${v.package}@${v.version} — composite=${v.composite} [${v.decision.toUpperCase()}]`);
+        console.log(`   SC=${v.scores.supplyChain} vuln=${v.scores.vulnerability} qual=${v.scores.quality} maint=${v.scores.maintenance} lic=${v.scores.license}`);
+        for (const r of v.reasons) {
+            console.log(`   \u2192 ${r}`);
+        }
+    }
+}
+//# sourceMappingURL=check-security.js.map

package/dist/commands/claim-resource.js

@@ -24,6 +24,7 @@ export function runClaimResource(subcommand, args, options) {
             plan: options.plan,
             agent: options.agent,
             cwd: options.cwd,
+            localOnly: options.localOnly,
         });
         return;
     }