clud-bug 0.6.34 → 0.7.0-rc.2

package/dist/cli/agents-md.d.ts

@@ -0,0 +1,16 @@
+export interface RenderBlockOptions {
+    version?: string | undefined;
+    strictMode?: boolean | undefined;
+    skillRelPath?: string | undefined;
+}
+export declare function renderBlock({ version, strictMode, skillRelPath }?: RenderBlockOptions): string;
+export declare function detectSkillRelPath(cwd: string): Promise<string>;
+export declare function upsertBlock(content: string, block: string): string;
+export declare function hasAgentsMdImport(content: unknown): boolean;
+export declare function removeBlock(content: string): string;
+export interface ApplyToRepoResult {
+    touched: string[];
+    created: string[];
+}
+export declare function applyToRepo(cwd: string, blockOpts?: RenderBlockOptions): Promise<ApplyToRepoResult>;
+//# sourceMappingURL=agents-md.d.ts.map

package/dist/cli/agents-md.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents-md.d.ts","sourceRoot":"","sources":["../../src/cli/agents-md.ts"],"names":[],"mappings":"AAiCA,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAuBD,wBAAgB,WAAW,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,GAAE,kBAAuB,GAAG,MAAM,CAyBlG;AAQD,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKrE;AAID,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAWlE;AAQD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAG3D;AASD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASnD;AAMD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAQD,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,GAAE,kBAAuB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkD7G"}

package/dist/cli/agents-md.js

@@ -0,0 +1,226 @@
+import { readFile, writeFile, stat, readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+// Manages a clud-bug-owned section inside AGENTS.md / CLAUDE.md and adjacent
+// agent-instruction files. Mirrors the well-established `<!-- logmind-start -->`
+// pattern: a marked block that other agents can read for collaboration rules,
+// idempotently rewritten on each `clud-bug init` so the content stays current.
+const START_MARKER = '<!-- clud-bug-start -->';
+const END_MARKER = '<!-- clud-bug-end -->';
+// v2 (clud-bug v0.6.6+): trimmed from ~44 lines to ~10. Full collaboration
+// rules moved to the bundled `clud-bug-collaboration` skill (always installed
+// alongside clud-bug), which clud-bug-review loads at review time. AGENTS.md
+// becomes a pointer + the strict-mode toggle (repo-specific, varies per
+// consumer). Compounds across every agent session in every consuming repo.
+const BLOCK_VERSION = 'v2';
+// Files we'll touch when present, plus files we'll create if missing.
+// AGENTS.md is the cross-tool canonical (logmind made it canonical too).
+// CLAUDE.md, GEMINI.md, .cursorrules, .windsurfrules etc. are tool-specific
+// stubs/instructions; we append the same block where they exist but don't
+// create them (logmind already creates the ones it knows about).
+const ALWAYS_TOUCH = ['AGENTS.md']; // create if missing
+const TOUCH_IF_PRESENT = [
+    'CLAUDE.md',
+    'GEMINI.md',
+    '.github/copilot-instructions.md',
+    '.cursorrules',
+    '.windsurfrules',
+    '.clinerules',
+    '.continuerules',
+];
+// Render the clud-bug block. Bundled here rather than in a template file so
+// updates ship with the CLI itself.
+//
+// `strictMode` MUST match the workflow's gate predicate exactly so the block
+// can't lie about repo state. The workflow at `templates/workflow*.yml.tmpl`
+// reads the manifest with `JSON.parse(s).strictMode === true` — meaning the
+// gate fires ONLY on an explicit `true`, and anything else (missing field,
+// `false`, `null`) is advisory. Mirror that here: render "on" only when the
+// caller explicitly passes `true`. Anything else is "off".
+//
+// Why this matters: a v0.3-era install (no `strictMode` field, `lastUpdate`
+// set) is a documented advisory upgrade path — `clud-bug init` deliberately
+// preserves that state. If the block rendered "on" for that case, other
+// agents reading AGENTS.md would get a wrong model of the gate.
+//
+// v0.6.25 (gotcha #2 fix): when the consuming repo IS the publisher of
+// the clud-bug-collaboration skill (skill source lives at
+// `skills/clud-bug-collaboration/SKILL.md` instead of the consumer-install
+// path `.claude/skills/...`), render the LOCAL repo path. Otherwise the
+// link is dead in the publisher repo (this used to require a manual fix
+// every v0.6.* propagation cycle on agent-skills).
+export function renderBlock({ version, strictMode, skillRelPath } = {}) {
+    const versionLine = version ? `_Installed at clud-bug v${version}._` : '';
+    const strictNote = strictMode === true
+        ? '**on** in this repo (workflow check fails on critical findings)'
+        : '**off** in this repo (advisory only)';
+    const skillPath = skillRelPath || '.claude/skills/clud-bug-collaboration/SKILL.md';
+    return `${START_MARKER}
+<!-- clud-bug-block-version: ${BLOCK_VERSION} -->
+## clud-bug — Claude PR review
+
+This repo uses [clud-bug](https://cludbug.dev) for automatic PR reviews.
+Full collaboration rules — fix-push flow, skill structure, comment format,
+strict-mode mechanics, workflow-edit constraint — live in the bundled
+[\`clud-bug-collaboration\` skill](${skillPath}).
+Read that skill before pushing fixes addressing prior review threads.
+
+Strict mode is ${strictNote}. Toggle via \`.claude/skills/.clud-bug.json\`
+(read from PR **base ref**, so PRs can't disable strict-mode on themselves).
+
+For agent invocations of the \`clud-bug\` CLI, prefer \`CLUD_BUG_QUIET=1\`
+(or pass \`--quiet\`) — suppresses progress chatter and emits a single
+\`ok <key-value>\` summary line per command.
+
+${versionLine}
+${END_MARKER}`;
+}
+// v0.6.25 (gotcha #2): detect repos that PUBLISH the
+// clud-bug-collaboration skill (agent-skills is the canonical case).
+// When the skill source exists at `skills/clud-bug-collaboration/SKILL.md`
+// in the working tree, the AGENTS.md link should point there, not at the
+// consumer-install `.claude/skills/...` path that doesn't exist in the
+// publisher repo.
+export async function detectSkillRelPath(cwd) {
+    const publisherPath = 'skills/clud-bug-collaboration/SKILL.md';
+    const consumerPath = '.claude/skills/clud-bug-collaboration/SKILL.md';
+    if (await fileExists(join(cwd, publisherPath)))
+        return publisherPath;
+    return consumerPath;
+}
+// Replace an existing clud-bug block in `content`, OR append if absent.
+// Idempotent: running multiple times leaves a single block.
+export function upsertBlock(content, block) {
+    const startRe = new RegExp(escapeRe(START_MARKER));
+    const endRe = new RegExp(escapeRe(END_MARKER));
+    if (startRe.test(content) && endRe.test(content)) {
+        // Replace from START_MARKER through END_MARKER (greedy multi-line).
+        const re = new RegExp(`${escapeRe(START_MARKER)}[\\s\\S]*?${escapeRe(END_MARKER)}`);
+        return content.replace(re, block);
+    }
+    // Append with a separating blank line, no trailing newline duplication.
+    const sep = content.endsWith('\n') ? '\n' : '\n\n';
+    return `${content}${sep}${block}\n`;
+}
+// 0.0.I.1 (v0.6.X): true if `content` has Claude Code's `@AGENTS.md`
+// @-import — the canonical AGENTS.md content gets eager-loaded.
+//
+// Matches at start-of-line (a literal `@AGENTS.md` mentioned in prose
+// won't fire; only the import directive does). Allows trailing space
+// (some editors trim it; some don't) and optional newline terminator.
+export function hasAgentsMdImport(content) {
+    if (typeof content !== 'string')
+        return false;
+    return /^@AGENTS\.md\s*$/m.test(content);
+}
+// 0.0.I.1: strip a clud-bug block (markers + body) AND the blank line
+// that precedes it, if any. Used when an @AGENTS.md import is detected
+// — the AGENTS.md content covers the block, so keeping it in CLAUDE.md
+// (or any tool stub) is duplication.
+//
+// Returns the cleaned content. If no block exists, returns content
+// unchanged. Idempotent.
+export function removeBlock(content) {
+    if (typeof content !== 'string')
+        return content;
+    // Strip the block. Match \n+ before the marker so we also eat the
+    // preceding blank line — otherwise we'd leave a "stub line + blank
+    // + block" structure as "stub line + blank line".
+    const re = new RegExp(`\\n*${escapeRe(START_MARKER)}[\\s\\S]*?${escapeRe(END_MARKER)}\\n?`);
+    return content.replace(re, '');
+}
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+// Touches all relevant agent-instruction files in `cwd`.
+// Creates AGENTS.md if it doesn't exist (it's the canonical home).
+// Updates other files only if they already exist (don't proliferate stubs;
+// logmind or the user owns those creation decisions).
+//
+// Returns { touched: string[], created: string[] } for the caller to log.
+export async function applyToRepo(cwd, blockOpts = {}) {
+    // v0.6.25 / gotcha #2: detect publisher repo + render local skill path.
+    // Pre-v0.6.25 always rendered the consumer install path → broke
+    // agent-skills' check-links every propagation cycle. Detection runs
+    // before block render so the path is correct from the first write.
+    const skillRelPath = blockOpts.skillRelPath ?? await detectSkillRelPath(cwd);
+    const block = renderBlock({ ...blockOpts, skillRelPath });
+    const touched = [];
+    const created = [];
+    for (const path of ALWAYS_TOUCH) {
+        const full = join(cwd, path);
+        const existed = await fileExists(full);
+        const prior = existed ? await readFile(full, 'utf8') : seedFile(path);
+        const next = upsertBlock(prior, block);
+        if (next !== prior) {
+            await writeFile(full, next);
+            (existed ? touched : created).push(path);
+        }
+    }
+    for (const path of TOUCH_IF_PRESENT) {
+        const full = join(cwd, path);
+        if (!(await fileExists(full)))
+            continue;
+        const prior = await readFile(full, 'utf8');
+        const next = nextContentFor(prior, block);
+        if (next !== prior) {
+            await writeFile(full, next);
+            touched.push(path);
+        }
+    }
+    // .cursor/rules/*.md — append to every file that exists.
+    const cursorRulesDir = join(cwd, '.cursor', 'rules');
+    if (await fileExists(cursorRulesDir)) {
+        let entries = [];
+        try {
+            entries = await readdir(cursorRulesDir);
+        }
+        catch { /* dir missing or unreadable */ }
+        for (const name of entries) {
+            if (!name.endsWith('.md'))
+                continue;
+            const full = join(cursorRulesDir, name);
+            const prior = await readFile(full, 'utf8');
+            const next = nextContentFor(prior, block);
+            if (next !== prior) {
+                await writeFile(full, next);
+                touched.push(`.cursor/rules/${name}`);
+            }
+        }
+    }
+    return { touched, created };
+}
+// 0.0.I.1: decide what content a TOUCH_IF_PRESENT file should have.
+// If it already imports AGENTS.md via Claude Code's @-syntax, skip the
+// block entirely (and clean up any pre-existing block — the content is
+// duplicated via @-import, so the AGENTS.md block is the only authority).
+// Otherwise, upsert as before.
+//
+// AGENTS.md itself is NOT routed through here — it always gets the
+// block (it's the canonical source).
+function nextContentFor(prior, block) {
+    return hasAgentsMdImport(prior) ? removeBlock(prior) : upsertBlock(prior, block);
+}
+function seedFile(name) {
+    // When AGENTS.md doesn't exist (no logmind, no prior tooling), seed with a
+    // minimal canonical header so the clud-bug block has context.
+    if (name === 'AGENTS.md') {
+        return `# AGENTS.md
+
+This file is the canonical instruction file for AI coding agents working in
+this repository. Tools that understand AGENTS.md (Cursor, Codex, Windsurf,
+Claude Code, Cline, Continue, Aider, ...) read it directly.
+
+`;
+    }
+    return '';
+}
+async function fileExists(path) {
+    try {
+        await stat(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=agents-md.js.map

package/dist/cli/agents-md.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents-md.js","sourceRoot":"","sources":["../../src/cli/agents-md.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,6EAA6E;AAC7E,iFAAiF;AACjF,8EAA8E;AAC9E,+EAA+E;AAE/E,MAAM,YAAY,GAAG,yBAAyB,CAAC;AAC/C,MAAM,UAAU,GAAK,uBAAuB,CAAC;AAC7C,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACxE,2EAA2E;AAC3E,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,sEAAsE;AACtE,yEAAyE;AACzE,4EAA4E;AAC5E,0EAA0E;AAC1E,iEAAiE;AACjE,MAAM,YAAY,GAAG,CAAC,WAAW,CAAC,CAAC,CAAyB,oBAAoB;AAChF,MAAM,gBAAgB,GAAG;IACvB,WAAW;IACX,WAAW;IACX,iCAAiC;IACjC,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,gBAAgB;CACjB,CAAC;AAQF,4EAA4E;AAC5E,oCAAoC;AACpC,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,2DAA2D;AAC3D,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AACxE,gEAAgE;AAChE,EAAE;AACF,uEAAuE;AACvE,0DAA0D;AAC1D,2EAA2E;AAC3E,wEAAwE;AACxE,wEAAwE;AACxE,mDAAmD;AACnD,MAAM,UAAU,WAAW,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,KAAyB,EAAE;IACxF,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,2BAA2B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,UAAU,GAAG,UAAU,KAAK,IAAI;QACpC,CAAC,CAAC,iEAAiE;QACnE,CAAC,CAAC,sCAAsC,CAAC;IAC3C,MAAM,SAAS,GAAG,YAAY,IAAI,gDAAgD,CAAC;IACnF,OAAO,GAAG,YAAY;+BACO,aAAa;;;;;;qCAMP,SAAS;;;iBAG7B,UAAU;;;;;;;EAOzB,WAAW;EACX,UAAU,EAAE,CAAC;AACf,CAAC;AAED,qDAAqD;AACrD,qEAAqE;AACrE,2EAA2E;AAC3E,yEAAyE;AACzE,uEAAuE;AACvE,kBAAkB;AAClB,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAClD,MAAM,aAAa,GAAG,wCAAwC,CAAC;IAC/D,MAAM,YAAY,GAAG,gDAAgD,CAAC;IACtE,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAAE,OAAO,aAAa,CAAC;IACrE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,wEAAwE;AACxE,4DAA4D;AAC5D,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,KAAa;IACxD,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACnD,MAAM,KAAK,GAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,oEAAoE;QACpE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,aAAa,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,wEAAwE;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,GAAG,OAAO,GAAG,GAAG,GAAG,KAAK,IAAI,CAAC;AACtC,CAAC;AAED,qEAAqE;AACrE,gEAAgE;AAChE,EAAE;AACF,sEAAsE;AACtE,qEAAqE;AACrE,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,qCAAqC;AACrC,EAAE;AACF,mEAAmE;AACnE,yBAAyB;AACzB,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,kEAAkE;IAClE,mEAAmE;IACnE,kDAAkD;IAClD,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,OAAO,QAAQ,CAAC,YAAY,CAAC,aAAa,QAAQ,CAAC,UAAU,CAAC,MAAM,CACrE,CAAC;IACF,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAOD,yDAAyD;AACzD,mEAAmE;AACnE,2EAA2E;AAC3E,sDAAsD;AACtD,EAAE;AACF,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,YAAgC,EAAE;IAC/E,wEAAwE;IACxE,gEAAgE;IAChE,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,IAAI,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,GAAG,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QACxC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,MAAM,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACrC,IAAI,OAAO,GAAa,EAAE,CAAC;QAC3B,IAAI,CAAC;YAAC,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,+BAA+B,CAAC,CAAC;QAC1F,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAS;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC1C,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,oEAAoE;AACpE,uEAAuE;AACvE,uEAAuE;AACvE,0EAA0E;AAC1E,+BAA+B;AAC/B,EAAE;AACF,mEAAmE;AACnE,qCAAqC;AACrC,SAAS,cAAc,CAAC,KAAa,EAAE,KAAa;IAClD,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,2EAA2E;IAC3E,8DAA8D;IAC9D,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,OAAO;;;;;;CAMV,CAAC;IACA,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAChE,CAAC"}

package/dist/cli/audit.d.ts

@@ -0,0 +1,13 @@
+export interface GitLinesOptions {
+    cwd?: string | undefined;
+    allowFail?: boolean | undefined;
+}
+export declare function gitLines(args: string[], opts?: GitLinesOptions): string[];
+export interface AuditFileSetOptions {
+    since?: string | null;
+    changedIn?: string | null;
+    scopes?: string[];
+    cwd?: string;
+}
+export declare function computeAuditFileSet({ since, changedIn, scopes, cwd }?: AuditFileSetOptions): string[];
+//# sourceMappingURL=audit.d.ts.map

package/dist/cli/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/cli/audit.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,eAAe;IAI9B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAOD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,eAAoB,GAAG,MAAM,EAAE,CAY7E;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAKD,wBAAgB,mBAAmB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAW,EAAE,GAAG,EAAE,GAAE,mBAAwB,GAAG,MAAM,EAAE,CAyB9G"}

package/dist/cli/audit.js

@@ -0,0 +1,90 @@
+// CLI audit helpers — these shell out to git and walk the working tree.
+//
+// Split from lib/audit.js during the v0.7.0 TS migration. Pure helpers
+// (durationToGitSince, renderAuditHeader) live in src/core/audit.ts so the
+// App-side (clud-bug-app) can consume them without dragging child_process
+// in. computeAuditFileSet stays CLI-only — it is only meaningful when run
+// in a checked-out repo.
+import { spawnSync } from 'node:child_process';
+import { durationToGitSince } from '../core/audit.js';
+// Run a git command, return stdout lines split by \n. Throws on non-zero exit
+// unless { allowFail: true }, in which case returns [].
+// Note: under noUncheckedIndexedAccess: true, array element reads are typed
+// `string | undefined`. The return type stays `string[]` (we filter falsy
+// strings out), but callers indexing into the result must keep that in mind.
+export function gitLines(args, opts = {}) {
+    const r = spawnSync('git', args, { encoding: 'utf8', cwd: opts.cwd || process.cwd() });
+    if (r.status !== 0) {
+        if (opts.allowFail)
+            return [];
+        // spawnSync with encoding:'utf8' makes stderr `string | null`; the null
+        // path only happens when the child can't be spawned at all (a different
+        // error path). When status is non-zero we have stderr.
+        const stderr = (r.stderr ?? '').toString().trim();
+        throw new Error(`git ${args.join(' ')} failed (${r.status}): ${stderr}`);
+    }
+    const stdout = (r.stdout ?? '').toString();
+    return stdout.split('\n').filter(Boolean);
+}
+// Returns the file set the audit should consider, in repo-relative paths.
+// Filters: optional --since (git date), optional --changed-in (duration string),
+// optional --scope globs (one or more, repeatable).
+export function computeAuditFileSet({ since, changedIn, scopes = [], cwd } = {}) {
+    const sinceArg = since || (changedIn ? durationToGitSince(changedIn) : null);
+    let files;
+    if (sinceArg) {
+        // Files touched in any commit within the window.
+        files = [...new Set(gitLines(['log', `--since=${sinceArg}`, '--name-only', '--pretty=format:'], { cwd }))];
+        // --diff-filter at the log level only excludes the delete commit; a file
+        // that was modified (and emitted by --name-only) and *later* deleted will
+        // still appear here. Intersect with the current tracked-file set so the
+        // manifest only contains paths we can actually read.
+        const tracked = new Set(gitLines(['ls-files'], { cwd }));
+        files = files.filter((f) => tracked.has(f));
+    }
+    else {
+        files = gitLines(['ls-files'], { cwd });
+    }
+    if (scopes.length) {
+        const matchers = scopes.map(globToRegex);
+        files = files.filter((f) => matchers.some((rx) => rx.test(f)));
+    }
+    // Skip vendor / build artifacts that bloat audits without adding signal.
+    const skip = /(^|\/)(node_modules|dist|build|out|\.next|\.vercel|coverage|target|__pycache__)\//;
+    return files.filter((f) => !skip.test(f)).sort();
+}
+// Minimal glob → RegExp. Supports **, *, ?. Anchors at both ends so that
+// 'src/**/*.ts' matches 'src/lib/foo.ts' but not 'app/src/lib/foo.ts'.
+function globToRegex(glob) {
+    let rx = '';
+    let i = 0;
+    while (i < glob.length) {
+        const ch = glob[i];
+        if (ch === '*' && glob[i + 1] === '*') {
+            // ** = any depth (including zero) of path segments
+            rx += '.*';
+            i += 2;
+            // consume an optional trailing slash so 'src/**/*.ts' works cleanly
+            if (glob[i] === '/')
+                i++;
+        }
+        else if (ch === '*') {
+            rx += '[^/]*';
+            i++;
+        }
+        else if (ch === '?') {
+            rx += '[^/]';
+            i++;
+        }
+        else if (ch !== undefined && /[.+^$|()\[\]{}\\]/.test(ch)) {
+            rx += '\\' + ch;
+            i++;
+        }
+        else {
+            rx += ch;
+            i++;
+        }
+    }
+    return new RegExp(`^${rx}$`);
+}
+//# sourceMappingURL=audit.js.map

package/dist/cli/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/cli/audit.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,0EAA0E;AAC1E,0EAA0E;AAC1E,yBAAyB;AAEzB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAUtD,8EAA8E;AAC9E,wDAAwD;AACxD,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,MAAM,UAAU,QAAQ,CAAC,IAAc,EAAE,OAAwB,EAAE;IACjE,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QAC9B,wEAAwE;QACxE,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,MAAM,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3C,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AASD,0EAA0E;AAC1E,iFAAiF;AACjF,oDAAoD;AACpD,MAAM,UAAU,mBAAmB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,GAAG,EAAE,EAAE,GAAG,KAA0B,EAAE;IAClG,MAAM,QAAQ,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE7E,IAAI,KAAe,CAAC;IACpB,IAAI,QAAQ,EAAE,CAAC;QACb,iDAAiD;QACjD,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,WAAW,QAAQ,EAAE,EAAE,aAAa,EAAE,kBAAkB,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3G,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzD,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,QAAQ,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,yEAAyE;IACzE,MAAM,IAAI,GAAG,mFAAmF,CAAC;IACjG,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,yEAAyE;AACzE,uEAAuE;AACvE,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACtC,mDAAmD;YACnD,EAAE,IAAI,IAAI,CAAC;YACX,CAAC,IAAI,CAAC,CAAC;YACP,oEAAoE;YACpE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;QAC3B,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,EAAE,IAAI,OAAO,CAAC;YACd,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,EAAE,IAAI,MAAM,CAAC;YACb,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,EAAE,KAAK,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5D,EAAE,IAAI,IAAI,GAAG,EAAE,CAAC;YAChB,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,EAAE,CAAC;YACT,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC"}

package/dist/cli/branch-protection.d.ts

@@ -0,0 +1,57 @@
+export interface GhResult {
+    code: number | null;
+    stdout: string;
+    stderr: string;
+}
+export interface GhOptions {
+    stdin?: string | undefined;
+}
+export type GhInvoker = (args: string[], opts?: GhOptions) => Promise<GhResult>;
+export interface DetectRepoOptions {
+    gh?: GhInvoker | undefined;
+}
+export interface DetectedRepo {
+    owner: string;
+    repo: string;
+}
+export declare function detectRepo({ gh }?: DetectRepoOptions): Promise<DetectedRepo>;
+export interface DetectDefaultBranchOptions {
+    owner: string;
+    repo: string;
+    gh?: GhInvoker | undefined;
+}
+export declare function detectDefaultBranch({ owner, repo, gh }: DetectDefaultBranchOptions): Promise<string>;
+export type ProtectionState = {
+    state: 'enabled';
+} | {
+    state: 'disabled';
+} | {
+    state: 'no-protection';
+} | {
+    state: 'forbidden';
+} | {
+    state: 'unknown';
+    reason: string;
+};
+export interface GetProtectionStateOptions {
+    owner: string;
+    repo: string;
+    branch: string;
+    gh?: GhInvoker | undefined;
+}
+export declare function getProtectionState({ owner, repo, branch, gh }: GetProtectionStateOptions): Promise<ProtectionState>;
+export interface EnableConversationResolutionOptions {
+    owner: string;
+    repo: string;
+    branch: string;
+    gh?: GhInvoker | undefined;
+}
+export type EnableResult = {
+    ok: true;
+} | {
+    ok: false;
+    state: 'no-protection' | 'forbidden' | 'unknown';
+    reason: string;
+};
+export declare function enableConversationResolution({ owner, repo, branch, gh }: EnableConversationResolutionOptions): Promise<EnableResult>;
+//# sourceMappingURL=branch-protection.d.ts.map

package/dist/cli/branch-protection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"branch-protection.d.ts","sourceRoot":"","sources":["../../src/cli/branch-protection.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAGD,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAuBhF,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAID,wBAAsB,UAAU,CAAC,EAAE,EAAc,EAAE,GAAE,iBAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAOlG;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CAC5B;AAGD,wBAAsB,mBAAmB,CACvC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAc,EAAE,EAAE,0BAA0B,GAC1D,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GACrB;IAAE,KAAK,EAAE,eAAe,CAAA;CAAE,GAC1B;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,GACtB;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CAC5B;AAaD,wBAAsB,kBAAkB,CACtC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAc,EAAE,EAAE,yBAAyB,GACjE,OAAO,CAAC,eAAe,CAAC,CAmB1B;AAED,MAAM,WAAW,mCAAmC;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,eAAe,GAAG,WAAW,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAMpF,wBAAsB,4BAA4B,CAChD,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAc,EAAE,EAAE,mCAAmC,GAC3E,OAAO,CAAC,YAAY,CAAC,CAiBvB"}

package/dist/cli/branch-protection.js

@@ -0,0 +1,118 @@
+// Helpers for managing `required_conversation_resolution` on the default
+// branch via the `gh` CLI. Factored out so `runInit` can call this without
+// embedding `spawnSync` boilerplate, and so tests can swap a mock for the
+// real `gh` invocation.
+//
+// Why `gh` rather than direct fetch(): clud-bug already depends on `gh`
+// being installed and authenticated (workflows use `gh pr comment`, edit
+// workflows use `gh pr create`). Reusing it inherits the user's auth
+// instead of asking them to set up another token.
+//
+// API endpoints used:
+//   GET /repos/{owner}/{repo}
+//     → .default_branch
+//   GET /repos/{owner}/{repo}/branches/{branch}/protection
+//     → .required_conversation_resolution.enabled (true/false), OR 404 if
+//       the branch has no protection rule at all.
+//   POST /repos/{owner}/{repo}/branches/{branch}/protection/required_conversation_resolution
+//     → enables the single flag without touching other settings. This is
+//       a real single-flag endpoint; we don't have to GET-merge-PUT the
+//       full protection JSON.
+import { spawn } from 'node:child_process';
+// Default `gh` invoker: spawns `gh <args>` and resolves with
+// { code, stdout, stderr }. Tests pass a function with the same shape.
+function defaultGh(args, opts = {}) {
+    const { stdin } = opts;
+    return new Promise((resolve, reject) => {
+        const child = spawn('gh', args, { stdio: ['pipe', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        // Under strict typing, spawn() can return null for stdio pipes when
+        // stdio is configured to ignore the stream. We requested 'pipe' for
+        // all three so the streams are guaranteed; the `!` non-null asserts
+        // make this explicit and keep the runtime semantics identical.
+        child.stdout.on('data', (d) => { stdout += d; });
+        child.stderr.on('data', (d) => { stderr += d; });
+        child.on('error', reject);
+        child.on('close', (code) => resolve({ code, stdout, stderr }));
+        if (stdin)
+            child.stdin.end(stdin);
+        else
+            child.stdin.end();
+    });
+}
+// Returns { owner, repo } from the local git remote. Uses
+// `gh repo view --json owner,name` so it doesn't depend on parsing URLs.
+export async function detectRepo({ gh = defaultGh } = {}) {
+    const { code, stdout, stderr } = await gh(['repo', 'view', '--json', 'owner,name']);
+    if (code !== 0) {
+        throw new Error(`gh repo view failed (${code}): ${stderr.trim() || '(no stderr)'}`);
+    }
+    const parsed = JSON.parse(stdout);
+    return { owner: parsed.owner.login, repo: parsed.name };
+}
+// Returns the default branch name (e.g. "main", "master", "trunk").
+export async function detectDefaultBranch({ owner, repo, gh = defaultGh }) {
+    const { code, stdout, stderr } = await gh(['api', `repos/${owner}/${repo}`, '--jq', '.default_branch']);
+    if (code !== 0) {
+        throw new Error(`Could not read default_branch for ${owner}/${repo}: ${stderr.trim() || stdout.trim()}`);
+    }
+    return stdout.trim();
+}
+// Inspects the current required_conversation_resolution state. Returns
+// one of:
+//   { state: 'enabled' }
+//   { state: 'disabled' }
+//   { state: 'no-protection' }   // branch has no protection rule at all
+//   { state: 'forbidden' }       // user lacks admin perms
+//   { state: 'unknown', reason }  // any other failure mode
+//
+// The reason this returns a discriminated union rather than throwing is
+// that runInit decides what to do based on the state: each value above
+// has a different user-facing message and follow-up action.
+export async function getProtectionState({ owner, repo, branch, gh = defaultGh }) {
+    const { code, stdout, stderr } = await gh([
+        'api',
+        `repos/${owner}/${repo}/branches/${branch}/protection`,
+        '--jq', '.required_conversation_resolution.enabled // false',
+    ]);
+    if (code === 0) {
+        return { state: stdout.trim() === 'true' ? 'enabled' : 'disabled' };
+    }
+    // gh prints HTTP details to stderr. Look for the markers we recognize.
+    // We deliberately key on 403 / 'Forbidden' / 'Resource not accessible'
+    // rather than the bare word 'admin' — gh's error vocabulary can mention
+    // 'admin' in unrelated contexts (administrator@…, admin api endpoint,
+    // future error copy) and we don't want to misclassify those as
+    // permission failures.
+    const blob = `${stdout}\n${stderr}`;
+    if (/404|Branch not protected|Not Found/i.test(blob))
+        return { state: 'no-protection' };
+    if (/403|Forbidden|Resource not accessible/i.test(blob))
+        return { state: 'forbidden' };
+    return { state: 'unknown', reason: stderr.trim() || stdout.trim() || `gh exited ${code}` };
+}
+// Enables the single flag via the dedicated endpoint. Doesn't touch any
+// other protection settings. Returns { ok: true } on success or
+// { ok: false, state, reason } using the same state taxonomy as
+// getProtectionState() so callers can produce a consistent message.
+export async function enableConversationResolution({ owner, repo, branch, gh = defaultGh }) {
+    const { code, stdout, stderr } = await gh([
+        'api', '-X', 'POST',
+        `repos/${owner}/${repo}/branches/${branch}/protection/required_conversation_resolution`,
+    ]);
+    if (code === 0)
+        return { ok: true };
+    // Match the same precise alternatives as getProtectionState — no bare
+    // 'admin' fallback to avoid misclassifying unrelated error messages
+    // that happen to contain the word.
+    const blob = `${stdout}\n${stderr}`;
+    if (/404|Branch not protected|Not Found/i.test(blob)) {
+        return { ok: false, state: 'no-protection', reason: 'Branch has no base protection rule; enable basic branch protection first.' };
+    }
+    if (/403|Forbidden|Resource not accessible/i.test(blob)) {
+        return { ok: false, state: 'forbidden', reason: 'You do not have admin permissions on this repository.' };
+    }
+    return { ok: false, state: 'unknown', reason: stderr.trim() || stdout.trim() || `gh exited ${code}` };
+}
+//# sourceMappingURL=branch-protection.js.map

package/dist/cli/branch-protection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"branch-protection.js","sourceRoot":"","sources":["../../src/cli/branch-protection.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAC1E,wBAAwB;AACxB,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,qEAAqE;AACrE,kDAAkD;AAClD,EAAE;AACF,sBAAsB;AACtB,8BAA8B;AAC9B,wBAAwB;AACxB,2DAA2D;AAC3D,0EAA0E;AAC1E,kDAAkD;AAClD,6FAA6F;AAC7F,yEAAyE;AACzE,wEAAwE;AACxE,8BAA8B;AAE9B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAe3C,6DAA6D;AAC7D,uEAAuE;AACvE,SAAS,SAAS,CAAC,IAAc,EAAE,OAAkB,EAAE;IACrD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACrE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,+DAA+D;QAC/D,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAkB,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAkB,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,KAAK;YAAE,KAAK,CAAC,KAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;;YAC9B,KAAK,CAAC,KAAM,CAAC,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAWD,0DAA0D;AAC1D,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAE,EAAE,GAAG,SAAS,KAAwB,EAAE;IACzE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IACpF,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,aAAa,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA+C,CAAC;IAChF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1D,CAAC;AAQD,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,SAAS,EAA8B;IAE3D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACxG,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAgBD,uEAAuE;AACvE,UAAU;AACV,yBAAyB;AACzB,0BAA0B;AAC1B,yEAAyE;AACzE,2DAA2D;AAC3D,4DAA4D;AAC5D,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,SAAS,EAA6B;IAElE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACxC,KAAK;QACL,SAAS,KAAK,IAAI,IAAI,aAAa,MAAM,aAAa;QACtD,MAAM,EAAE,oDAAoD;KAC7D,CAAC,CAAC;IACH,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IACtE,CAAC;IACD,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,+DAA+D;IAC/D,uBAAuB;IACvB,MAAM,IAAI,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC;IACpC,IAAI,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACxF,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACvF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC;AAC7F,CAAC;AAaD,wEAAwE;AACxE,gEAAgE;AAChE,gEAAgE;AAChE,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,SAAS,EAAuC;IAE5E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACxC,KAAK,EAAE,IAAI,EAAE,MAAM;QACnB,SAAS,KAAK,IAAI,IAAI,aAAa,MAAM,8CAA8C;KACxF,CAAC,CAAC;IACH,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACpC,sEAAsE;IACtE,oEAAoE;IACpE,mCAAmC;IACnC,MAAM,IAAI,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC;IACpC,IAAI,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,2EAA2E,EAAE,CAAC;IACpI,CAAC;IACD,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;IAC5G,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC;AACxG,CAAC"}

package/dist/cli/edit-workflow.d.ts

@@ -0,0 +1,18 @@
+export interface PendingWorkflowEdits {
+    allWorkflow: boolean;
+    files: string[];
+    nonWorkflow: string[];
+}
+export declare function getPendingWorkflowEdits(cwd?: string): PendingWorkflowEdits;
+export declare function isWorkflowFile(path: string): boolean;
+export declare function makeBranchName(date?: Date): string;
+export interface GitOptions {
+    allowFail?: boolean | undefined;
+}
+export interface GitResult {
+    ok: boolean;
+    stdout: string;
+    stderr: string;
+}
+export declare function git(cwd: string, args: string[], opts?: GitOptions): GitResult;
+//# sourceMappingURL=edit-workflow.d.ts.map

package/dist/cli/edit-workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edit-workflow.d.ts","sourceRoot":"","sources":["../../src/cli/edit-workflow.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAsB,GAAG,oBAAoB,CAyBzF;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,cAAc,CAAC,IAAI,GAAE,IAAiB,GAAG,MAAM,CAG9D;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,UAAe,GAAG,SAAS,CAMjF"}

package/dist/cli/edit-workflow.js

@@ -0,0 +1,43 @@
+import { spawnSync } from 'node:child_process';
+export function getPendingWorkflowEdits(cwd = process.cwd()) {
+    // --untracked-files=all so new files in new directories are reported as
+    // individual paths instead of being collapsed to the parent dir (default
+    // 'normal' mode would emit '.github/' for a brand-new clud-bug-review.yml).
+    const r = spawnSync('git', ['status', '--porcelain', '--untracked-files=all'], { cwd, encoding: 'utf8' });
+    if (r.status !== 0) {
+        // r.stderr is `string | null` under strict; safe to coalesce to '' for the
+        // error message — null here means the child failed to spawn entirely.
+        throw new Error(`git status failed: ${(r.stderr ?? '').trim()}`);
+    }
+    const stdout = r.stdout ?? '';
+    const lines = stdout.split('\n').filter(Boolean);
+    if (lines.length === 0)
+        return { allWorkflow: true, files: [], nonWorkflow: [] };
+    const files = [];
+    const nonWorkflow = [];
+    for (const line of lines) {
+        // porcelain format: XY <space> <path> ; rename: XY old -> new
+        // .pop() on a non-empty split always yields a string here, but
+        // noUncheckedIndexedAccess makes TS pessimistic — coalesce + trim.
+        const path = (line.slice(3).split(' -> ').pop() ?? '').trim();
+        files.push(path);
+        if (!isWorkflowFile(path))
+            nonWorkflow.push(path);
+    }
+    return { allWorkflow: nonWorkflow.length === 0, files, nonWorkflow };
+}
+export function isWorkflowFile(path) {
+    return /^\.github\/workflows\/clud-bug-.*\.ya?ml$/.test(path);
+}
+export function makeBranchName(date = new Date()) {
+    const stamp = date.toISOString().replace(/[:.]/g, '-').slice(0, 19);
+    return `clud-bug/edit-workflow-${stamp}`;
+}
+export function git(cwd, args, opts = {}) {
+    const r = spawnSync('git', args, { cwd, encoding: 'utf8' });
+    if (r.status !== 0 && !opts.allowFail) {
+        throw new Error(`git ${args.join(' ')} failed (${r.status}): ${(r.stderr ?? '').trim()}`);
+    }
+    return { ok: r.status === 0, stdout: (r.stdout ?? '').trim(), stderr: (r.stderr ?? '').trim() };
+}
+//# sourceMappingURL=edit-workflow.js.map

package/dist/cli/edit-workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edit-workflow.js","sourceRoot":"","sources":["../../src/cli/edit-workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAe/C,MAAM,UAAU,uBAAuB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACjE,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,uBAAuB,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1G,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAEjF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,8DAA8D;QAC9D,+DAA+D;QAC/D,mEAAmE;QACnE,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAa,IAAI,IAAI,EAAE;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO,0BAA0B,KAAK,EAAE,CAAC;AAC3C,CAAC;AAYD,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,OAAmB,EAAE;IACpE,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAClG,CAAC"}