codebyplan 1.13.65 → 1.13.67

package/dist/lib/check.d.ts

@@ -0,0 +1,178 @@
+/**
+ * Shared check runner — `codebyplan check`.
+ *
+ * Converges the divergent check matrices (round + task scope via cbp-verify,
+ * cbp-merge-main) into ONE whole-repo + baseline runner. The CORE matrix is
+ * identical across scopes so a "round" check can never pass where a "task"
+ * check fails.
+ *
+ * Commands (turbo-native, whole-repo):
+ *   gate6     → `node scripts/check-sibling-identity.mjs`
+ *               ALWAYS hard-fail on non-zero exit; never baselined.
+ *   lint      → `turbo run lint`      whole-repo per-package; diff vs baseline
+ *   typecheck → `turbo run typecheck` whole-repo per-package; diff vs baseline
+ *   tests     → `turbo run test`      whole-repo per-package; diff vs baseline
+ *   audit     → `pnpm audit --json`   task scope only; diff vs baseline GHSA ids
+ *
+ * Per-package pass/fail is derived from the turbo --summarize JSON:
+ *   turbo run <task> --summarize writes a run summary to .turbo/runs/<hash>.json
+ *   The last line of turbo output matching /^Summary:\s+(.+\.json)$/ gives the path.
+ *   Each task entry carries execution.exitCode; non-zero → package failed.
+ *
+ * Baseline file: .check-baseline.json at project root.
+ * A check FAILS (hard-fail) only when a package fails that is NOT in that
+ * check's known_failing[] (a NEW failure), or a GHSA id appears that is NOT
+ * in audit.ghsa_ids[]. gate6 is never in the baseline.
+ *
+ * Strict / absolute-green mode (noBaseline):
+ *   When opts.noBaseline is true the baseline is IGNORED for the verdict — this
+ *   is the WHOLE-REPO ABSOLUTE GREEN tier (zero baseline forgiveness). For
+ *   lint/typecheck/tests the ENTIRE failing set counts as new_failures (not the
+ *   diff-vs-baseline), so ANY red package fails the check; for audit ALL GHSA
+ *   ids count, not just unallowlisted ones. gate6 is unchanged (always hard).
+ *   noBaseline and updateBaseline are mutually exclusive: strict mode is a
+ *   read-only verdict and never writes the baseline — if both are set,
+ *   updateBaseline is ignored with a stderr warning.
+ */
+import { type BaselineFile } from "./check-baseline.js";
+/**
+ * Returned in new_failures[] when the turbo summary file cannot be read or
+ * parsed, OR when turbo exited non-zero but printed no Summary: path.
+ *
+ * The presence of this sentinel makes the check status = 'fail' so the runner
+ * NEVER silently passes when it cannot determine per-package results.
+ */
+export declare const SUMMARY_UNREADABLE = "__summary_unreadable__";
+/**
+ * Returned in new_failures[] when the turbo process was killed by a signal
+ * (spawnResult.status === null) and no summary path was captured.
+ *
+ * Distinct from SUMMARY_UNREADABLE so callers can distinguish OOM/SIGKILL
+ * ("something killed the process") from parse failures ("process ran but
+ * output was unreadable").
+ */
+export declare const SPAWN_KILLED = "__spawn_killed__";
+export type CheckScope = "round" | "task" | "merged";
+export type CheckStatus = "pass" | "fail" | "skipped";
+export interface CheckResult {
+    check: "gate6" | "lint" | "typecheck" | "tests" | "audit";
+    status: CheckStatus;
+    exit_code: number | null;
+    command: string;
+    stdout: string;
+    stderr: string;
+    executed: boolean;
+    /**
+     * NEW failing packages or GHSA IDs vs the baseline.
+     * Empty array → either all failures are baselined, or the check passed/skipped.
+     * undefined → check is not subject to baseline diffing (gate6, audit-skipped).
+     */
+    new_failures?: string[];
+}
+/**
+ * Injectable spawn function for tests.
+ * Default wraps child_process.spawnSync with shell: true.
+ */
+export type SpawnFn = (command: string, opts: {
+    cwd: string;
+}) => {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+};
+export interface RunCheckOpts {
+    scope: CheckScope;
+    /** Defaults to process.cwd(). */
+    projectRoot?: string;
+    /**
+     * When provided, --files was passed on the CLI.
+     * In whole-repo mode this is a NO-OP: a deprecation notice is emitted to
+     * stderr and the value is ignored (turbo always runs whole-repo).
+     * Kept in the API for backwards compatibility.
+     */
+    changedFiles?: string[];
+    /** Defaults to a wrapper around child_process.spawnSync. */
+    spawnFn?: SpawnFn;
+    /**
+     * When true, run checks and WRITE the discovered failing set +
+     * current GHSA ids into .check-baseline.json instead of diffing.
+     * This is how the committed seed is produced.
+     */
+    updateBaseline?: boolean;
+    /**
+     * When true, IGNORE the baseline for the verdict — whole-repo ABSOLUTE GREEN.
+     * Every failing package (lint/typecheck/tests) and every GHSA id (audit)
+     * counts as a failure, so any red fails the check. gate6 is unchanged.
+     * Mutually exclusive with updateBaseline (strict mode never writes the
+     * baseline): if both are set, updateBaseline is ignored with a stderr warning.
+     */
+    noBaseline?: boolean;
+    /**
+     * Caps turbo's task parallelism (`turbo run <task> --concurrency=<n>`). The
+     * whole-repo (`--scope merged`) matrix runs every package's test suite at once
+     * and, at full concurrency, CPU-starves timing-sensitive suites into flaky
+     * timeouts — so the strict CI gate passes `1` to serialize and stay
+     * deterministic. Omitted (the dev-loop default) → turbo's own default.
+     */
+    concurrency?: number;
+    /**
+     * Injectable baseline loader for tests.
+     * Defaults to the real loadBaseline from check-baseline.ts.
+     */
+    loadBaselineFn?: (projectRoot: string) => BaselineFile;
+    /**
+     * Injectable baseline saver for tests.
+     * Defaults to the real saveBaseline from check-baseline.ts.
+     */
+    saveBaselineFn?: (projectRoot: string, baseline: BaselineFile) => void;
+}
+export interface RunCheckResult {
+    results: CheckResult[];
+    /** True when any hard-fail check has status === 'fail'. */
+    any_failed: boolean;
+    /** Names of checks that failed (post-baseline-diff verdict). */
+    hard_fail_checks: string[];
+    /**
+     * True when the run used strict / absolute-green mode (--no-baseline): the
+     * baseline was ignored and EVERY failing package / GHSA id counts as a
+     * failure. Lets JSON consumers tell a strict verdict from a baseline-tolerant
+     * one. Omitted (falsy) for normal baseline-diffed runs.
+     */
+    no_baseline?: boolean;
+    /**
+     * When updateBaseline was true but the write was skipped, reports why.
+     * 'gate6_failed' — gate6 check failed; indeterminate tree must not be baselined.
+     * 'indeterminate' — one or more sentinel values in currentFailing; results unreliable.
+     */
+    baseline_skipped?: "gate6_failed" | "indeterminate";
+    /** When updateBaseline was true, reports what was written. */
+    baseline_written?: {
+        lint_known_failing: string[];
+        typecheck_known_failing: string[];
+        tests_known_failing: string[];
+        audit_ghsa_ids: string[];
+    };
+}
+/**
+ * Resolve the turbo binary path.
+ *
+ * Search order:
+ *   1. projectRoot/node_modules/.bin/turbo  (package-local install)
+ *   2. projectRoot/../../node_modules/.bin/turbo  (monorepo workspace root)
+ *
+ * If turbo is found nowhere, returns a non-executable sentinel string so the
+ * caller's try/catch captures the spawn failure and surfaces an actionable
+ * error ("turbo not found — run pnpm install") rather than silently falling
+ * back to `npx turbo` which may download a possibly-wrong version.
+ *
+ * NOTE: bare "turbo" is intentionally NOT used — it is absent from the
+ * minimal shell PATH when Node spawns child processes (spawnSync shell:true
+ * uses /bin/sh which only has standard system paths).
+ */
+export declare function resolveTurboBin(projectRoot: string): string;
+/**
+ * Run the unified check matrix for a given scope.
+ * Never throws on subprocess failure — all errors are captured and reported.
+ */
+export declare function runCheck(opts: RunCheckOpts): RunCheckResult;
+//# sourceMappingURL=check.d.ts.map

package/dist/lib/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/lib/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAKH,OAAO,EAOL,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAM7B;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,2BAA2B,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,qBAAqB,CAAC;AA6C/C,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AACrD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,OAAO,CAAC;IAC1D,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,KAClB;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,UAAU,CAAC;IAClB,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,YAAY,CAAC;IACvD;;;OAGG;IACH,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAC;CACxE;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,2DAA2D;IAC3D,UAAU,EAAE,OAAO,CAAC;IACpB,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,cAAc,GAAG,eAAe,CAAC;IACpD,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE;QACjB,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC7B,uBAAuB,EAAE,MAAM,EAAE,CAAC;QAClC,mBAAmB,EAAE,MAAM,EAAE,CAAC;QAC9B,cAAc,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC;CACH;AA+GD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAkB3D;AAqED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,cAAc,CAmW3D"}

package/dist/lib/ci-init.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Library for `codebyplan ci init`.
+ *
+ * Detects CI platforms from project file signals, builds a default CiConfig,
+ * and writes it to `.codebyplan/ci.json`. Idempotent — deep-merges newly
+ * detected platforms into an existing config, never overwriting existing platform
+ * keys unless --force is set.
+ *
+ * Platform detection follows the same signals as the testing-matrix reference
+ * (.claude/docs/architecture/testing-matrix.md):
+ *   - next.config.{ts,js,mjs}         → next_js
+ *   - @nestjs/core in package.json     → nestjs
+ *   - tauri.conf.json or src-tauri/    → tauri
+ *   - @types/vscode in devDependencies → vscode
+ *   - expo in dependencies             → expo
+ *   - packages/ subdirectory exists    → package
+ *   - (fallback — none of above)       → package
+ *
+ * Note: Tauri detection is implemented here directly; do NOT call detectTechStack
+ * for platform resolution (tech-detect.ts does not cover Tauri).
+ *
+ * The detection path is reader-driven (RepoReader interface) so tests can inject
+ * an InMemoryRepoReader. Write operations (mkdir, writeJsonAtomic) stay fs-direct.
+ */
+import type { CiConfig, CiPlatformChecks } from "./types.js";
+import { type RepoReader } from "./repo-reader.js";
+/**
+ * Default CI check configurations per platform.
+ *
+ * Commands use generic `pnpm turbo` invocations without `--filter` as defaults.
+ * Callers (ci init, skills) should narrow scope by adjusting the `command` after
+ * writing the config for their specific project layout.
+ *
+ * Lint and e2e always delegate to their sibling config files and carry no
+ * inline `command`.
+ */
+export declare const PLATFORM_COMMAND_MAP: Record<string, CiPlatformChecks>;
+/**
+ * Detect CI platforms using the provided reader.
+ *
+ * `reader` provides async access to project content; it encapsulates its own
+ * project root, so all paths here are repo-root-relative (e.g. `apps`,
+ * `package.json`) and the reader resolves them. This keeps the function source
+ * agnostic (a LocalFsReader or a future GitHub-App-backed reader both work).
+ *
+ * Scans the project root and all direct children of `apps/` (monorepo pattern).
+ * Returns an array of unique platform slugs. The `package` platform is added
+ * when a `packages/` directory with at least one child is found. Falls back to
+ * `["package"]` when no other signals are detected.
+ *
+ * Per the approved design, list(dir) returns the immediate child DIRECTORY
+ * names under dir (loose files are excluded), matching the pre-refactor
+ * readdir({withFileTypes}).filter(isDirectory) behaviour. So scanning apps/*
+ * yields only sub-app directories, and a non-empty packages/ listing means at
+ * least one real sub-package directory exists.
+ */
+export declare function detectPlatforms(reader: RepoReader): Promise<string[]>;
+/**
+ * Build a default CiConfig from a list of detected platform slugs.
+ *
+ * Commands are sourced from PLATFORM_COMMAND_MAP. Unknown platform slugs fall
+ * back to the `package` defaults so all platforms are represented.
+ */
+export declare function buildDefaultCiConfig(platforms: string[]): CiConfig;
+export interface CiInitOptions {
+    /** If true, compute the operation but do NOT write any files. */
+    dryRun?: boolean;
+    /**
+     * If true, overwrite existing platform keys rather than deep-merging.
+     * Without --force, only NEW platforms (not already in the config) are added.
+     */
+    force?: boolean;
+    /**
+     * Override the project root directory (default: process.cwd()).
+     */
+    projectDir?: string;
+    /**
+     * Optional reader for project-content reads. When omitted, a LocalFsReader
+     * constructed with `projectDir` is used. Inject an InMemoryRepoReader in
+     * tests to avoid disk I/O.
+     */
+    reader?: RepoReader;
+}
+export interface CiInitResult {
+    /** `written` — file was created or updated. `skipped` — all platforms already present.
+     *  `dry_run` — computed what would change but wrote nothing. */
+    status: "written" | "skipped" | "dry_run";
+    /** Absolute path to `.codebyplan/ci.json`. */
+    path: string;
+    /**
+     * For `written`/`dry_run` — the detected or newly-added platform slugs.
+     * For `skipped` — the already-present platform slugs (no-op).
+     */
+    platforms: string[];
+}
+/**
+ * Detect platforms in `projectDir` and write (or update) `.codebyplan/ci.json`.
+ *
+ * Idempotent deep-merge: newly detected platforms are added to the existing
+ * config; existing platform keys are left unchanged unless `force` is set.
+ *
+ * Detection reads are reader-driven (see RepoReader). Write operations remain
+ * fs-direct so that the reader interface stays read-only.
+ */
+export declare function runCiInit(opts?: CiInitOptions): Promise<CiInitResult>;
+//# sourceMappingURL=ci-init.d.ts.map

package/dist/lib/ci-init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-init.d.ts","sourceRoot":"","sources":["../../src/lib/ci-init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE7D,OAAO,EAAE,KAAK,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AAMlE;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAiMjE,CAAC;AA+BF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA6D3E;AAMD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,QAAQ,CAsBlE;AAMD,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B;oEACgE;IAChE,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC1C,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAAC,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAqF3E"}

package/dist/lib/ci-resolve.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Library for `codebyplan ci resolve`.
+ *
+ * Resolves the shell command (or delegation pointer) for a CI check category
+ * by reading `.codebyplan/ci.json`. Falls back to PLATFORM_COMMAND_MAP defaults
+ * when ci.json is absent, empty, OR present-but-missing the requested category
+ * for the resolved platform — so a partial / older ci.json still resolves from
+ * the central default map rather than dropping the caller to a hardcoded literal
+ * (which is the duplication this CLI exists to eliminate).
+ *
+ * Resolution order (first usable check wins):
+ *   1. ci.json  — config.platforms[slug][category]
+ *   2. PLATFORM_COMMAND_MAP[slug][category]      — fallback (slug = the resolved platform)
+ *   3. PLATFORM_COMMAND_MAP["package"][category]  — ultimate fallback (unknown slug)
+ *
+ * Where `slug` = opts.platform ?? first ci.json platform key ?? "package".
+ * `not_found` is returned only when no source carries the category — for the
+ * valid CiCategory values this never happens (the package defaults cover all),
+ * so it is a defensive terminal state.
+ */
+import type { CiCategory, CiScope } from "./types.js";
+export type CiResolveStatus = "resolved" | "delegates" | "fallback" | "not_found";
+export interface CiResolveOptions {
+    /** The CI check category to resolve. */
+    category: CiCategory;
+    /** Platform slug to look up (e.g. "next_js", "nestjs"). Optional. */
+    platform?: string;
+    /** Project root directory. Defaults to process.cwd(). */
+    projectDir?: string;
+}
+export interface CiResolveResult {
+    /** How the resolution completed. */
+    status: CiResolveStatus;
+    /** The category that was resolved. */
+    category: CiCategory;
+    /**
+     * The platform slug that was used for resolution.
+     * Null when the platform could not be determined (e.g. unknown platform
+     * with absent ci.json and no PLATFORM_COMMAND_MAP entry).
+     */
+    platform: string | null;
+    /** Shell command to run. Present when status is "resolved" or "fallback". */
+    command?: string;
+    /**
+     * Path to the config file that owns this check category.
+     * Present when status is "delegates".
+     */
+    delegates_to?: string;
+    /** Scope of the check (per_app_changed or full_repo). */
+    scope?: CiScope;
+    /** Whether a failure blocks the PR/merge. */
+    hard_fail?: boolean;
+    /**
+     * True when ci.json was absent or had no platforms — PLATFORM_COMMAND_MAP
+     * defaults were used instead.
+     */
+    fallback_used: boolean;
+}
+export declare function resolveCiCommand(opts: CiResolveOptions): CiResolveResult;
+//# sourceMappingURL=ci-resolve.d.ts.map

package/dist/lib/ci-resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-resolve.d.ts","sourceRoot":"","sources":["../../src/lib/ci-resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAQtD,MAAM,MAAM,eAAe,GACvB,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,CAAC;AAEhB,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,QAAQ,EAAE,UAAU,CAAC;IACrB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,oCAAoC;IACpC,MAAM,EAAE,eAAe,CAAC;IACxB,sCAAsC;IACtC,QAAQ,EAAE,UAAU,CAAC;IACrB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB;AAwDD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,eAAe,CAwCxE"}

package/dist/lib/claude-mode-audit.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Library for auditing the model/effort convention across authoring templates.
+ *
+ * Convention (from templates/skills/cbp-build-cc-mode/SKILL.md):
+ *   Skills:  model: inherit + effort: — both expected. `inherit` signals
+ *            session-model inheritance explicitly. Absent model or a non-inherit
+ *            model value is a gap.
+ *   Agents:  model: <pin> + effort: — both must be pinned. `inherit` is NOT
+ *            permitted for agents.
+ *
+ * Agent default: model: sonnet, effort: xhigh.
+ * Exceptions:    cbp-mechanical-edits → model: haiku, effort: low.
+ *                cbp-map-architecture → model: sonnet, effort: high.
+ *                cbp-e2e-* (5 agents) → model: sonnet, effort: high.
+ *
+ * Valid effort values: low | medium | high | xhigh | max.
+ */
+export interface AuditEntry {
+    path: string;
+    surface: "agent" | "skill";
+    /** Parsed model value, or null if the frontmatter key is absent. */
+    model: string | null;
+    /** Parsed effort value, or null if the frontmatter key is absent. */
+    effort: string | null;
+    /** Human-readable expected value (e.g. "model:sonnet/effort:xhigh"). */
+    expected: string;
+    status: "ok" | "gap";
+    gap_reason?: string;
+}
+/**
+ * Scan `templatesDir/agents/*.md` and `templatesDir/skills/* /SKILL.md`,
+ * apply the model/effort convention, and return one AuditEntry per file.
+ *
+ * Vendored skills (a skill dir with a sibling `PROVENANCE.md`, installed via
+ * `npx skills add …`) are skipped — they follow their upstream author's
+ * frontmatter convention, not CBP's model/effort matrix.
+ *
+ * Read-only — never mutates any file.
+ */
+export declare function auditMode(templatesDir: string): AuditEntry[];
+//# sourceMappingURL=claude-mode-audit.d.ts.map

package/dist/lib/claude-mode-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-mode-audit.d.ts","sourceRoot":"","sources":["../../src/lib/claude-mode-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IAC3B,oEAAoE;IACpE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qEAAqE;IACrE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,IAAI,GAAG,KAAK,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA0ID;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,UAAU,EAAE,CAsC5D"}

package/dist/lib/claude-plan.d.ts

@@ -0,0 +1,34 @@
+import { type ManifestEntry } from "./manifest.js";
+export interface DriftPlan {
+    unchanged: ManifestEntry[];
+    overwriteSafe: Array<{
+        packaged: ManifestEntry;
+        absSrc: string;
+    }>;
+    overwriteHandEdited: Array<{
+        packaged: ManifestEntry;
+        absSrc: string;
+        onDiskContent: Buffer;
+    }>;
+    newOptIn: Array<{
+        packaged: ManifestEntry;
+        absSrc: string;
+    }>;
+    removedFromPackage: ManifestEntry[];
+}
+/**
+ * Classify every file managed by the manifest into one of five buckets:
+ *   - unchanged:           on-disk and templates both match the manifest hash
+ *   - overwriteSafe:       templates changed, on-disk still matches manifest (safe overwrite)
+ *   - overwriteHandEdited: on-disk differs from manifest (user hand-edit)
+ *   - newOptIn:            in templates but NOT in manifest (newly shipped)
+ *   - removedFromPackage:  in manifest but NOT in templates (removed from package)
+ *
+ * Pure read-only — never writes to disk.
+ * Extracted from update.ts `buildPlan` so both `runUpdate` and `runStatus` can
+ * share the same classification logic without duplicating code.
+ */
+export declare function buildDriftPlan(projectDir: string, templatesDir: string, manifest: {
+    files: ManifestEntry[];
+}): DriftPlan;
+//# sourceMappingURL=claude-plan.d.ts.map

package/dist/lib/claude-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-plan.d.ts","sourceRoot":"","sources":["../../src/lib/claude-plan.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,aAAa,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,aAAa,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,mBAAmB,EAAE,KAAK,CAAC;QACzB,QAAQ,EAAE,aAAa,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC;QACf,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IACH,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,aAAa,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,kBAAkB,EAAE,aAAa,EAAE,CAAC;CACrC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE;IAAE,KAAK,EAAE,aAAa,EAAE,CAAA;CAAE,GACnC,SAAS,CA6DX"}

package/dist/lib/commit-scope.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Commit scope helper — computes the set intersection between staged files
+ * and the active task's known files.
+ *
+ * Pure function — no I/O. Takes pre-fetched file lists as parameters.
+ * No top-level side effects.
+ */
+export interface ComputeScopeTaskFilesInput {
+    /** Paths from the active task's files_changed (resolved by the caller via MCP). */
+    taskPaths: string[];
+    /** Paths currently staged in the git index (from `git diff --cached --name-only`). */
+    stagedPaths: string[];
+}
+/**
+ * Returns the sorted set intersection of taskPaths and stagedPaths.
+ *
+ * Both inputs are treated as sets — duplicates within each list are deduplicated
+ * before intersection so the output contains each path at most once.
+ */
+export declare function computeScopeTaskFiles(input: ComputeScopeTaskFilesInput): string[];
+//# sourceMappingURL=commit-scope.d.ts.map

package/dist/lib/commit-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commit-scope.d.ts","sourceRoot":"","sources":["../../src/lib/commit-scope.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,WAAW,0BAA0B;IACzC,mFAAmF;IACnF,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sFAAsF;IACtF,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,0BAA0B,GAChC,MAAM,EAAE,CAaV"}

package/dist/lib/e2e.d.ts

@@ -0,0 +1,157 @@
+/**
+ * Pure lib for E2E deterministic gate verification.
+ *
+ * Codifies the three hard-fails from rules/e2e-mandatory.md and the
+ * context/testing/e2e.md dispatch/eligibility contract.
+ *
+ * No MCP imports, no filesystem side effects at module level.
+ * e2e.json content is passed in as an already-parsed object (or null).
+ * All public functions accept injectable deps so tests never hit real I/O.
+ */
+export interface E2eFrameworkConfig {
+    enabled: boolean;
+    auto_run: boolean;
+    /** App source path (e.g. "apps/web"). Repo root is "" or "." for single-app. */
+    app: string;
+    /** e.g. ["web"] | ["ios","android"] | ["desktop"] */
+    platforms?: string[];
+    credential_vars?: {
+        email?: string | null;
+        password?: string | null;
+    };
+}
+export interface E2eConfig {
+    frameworks?: Record<string, E2eFrameworkConfig>;
+}
+export interface E2eTestResults {
+    passed: number;
+    failed: number;
+    skipped: number;
+}
+export interface E2eCriticalIssue {
+    type: string;
+    spec_path?: string | null;
+    reason: string;
+}
+/** Console/page error captured by the Playwright quality fixture. */
+export interface E2eConsoleError {
+    test_name?: string;
+    type?: "console" | "pageerror" | "requestfailed";
+    text: string;
+}
+/** Aggregated axe accessibility scan summary (Playwright). */
+export interface E2eA11ySummary {
+    scanned_pages?: string[];
+    violations?: Array<{
+        rule?: string;
+        impact?: string;
+        page?: string;
+    }>;
+}
+/** Shape of each entry in round.context.e2e_outputs[framework] */
+export interface E2eOutputEntry {
+    status: "completed" | "failed";
+    tests_run?: boolean;
+    test_results?: E2eTestResults;
+    e2e_gallery?: E2eGalleryEntry[] | null;
+    preflight?: {
+        dev_server?: {
+            ok: boolean;
+            required?: boolean;
+            port?: number | null;
+            notes?: string;
+        };
+        simulator?: {
+            ok: boolean;
+            required?: boolean;
+            device?: string | null;
+            notes?: string;
+        };
+        built_binary?: {
+            ok: boolean;
+            required?: boolean;
+            path?: string | null;
+            notes?: string;
+        };
+        /** Full shape from context/testing/e2e.md: { required: string[], missing: string[], ok: bool } */
+        env_vars?: {
+            ok: boolean;
+            required?: string[];
+            missing?: string[];
+        };
+        auth_probe?: {
+            ok: boolean;
+            ran?: boolean;
+            probe_path?: string | null;
+            error?: string | null;
+        };
+    };
+    critical_issues?: E2eCriticalIssue[];
+    /** Quality-capture fields (rules/e2e-mandatory.md § Quality-Capture Mandates).
+     *  Absent on legacy outputs — absence never fails verification. */
+    console_errors?: E2eConsoleError[] | null;
+    a11y?: E2eA11ySummary | null;
+}
+export interface E2eGalleryEntry {
+    test_name: string;
+    page_or_screen: string;
+    framework: string;
+    committed_path: string;
+    is_new: boolean;
+    baseline_diff_pct: number | null;
+}
+export interface VerifyRoundContext {
+    /** List of eligible framework names (from dispatcher's eligibility calc). */
+    e2e_eligible?: string[];
+    /** Map of framework → specialist output. */
+    e2e_outputs?: Record<string, E2eOutputEntry>;
+    /** Round type — "survey" rounds short-circuit to pass. */
+    round_type?: string;
+}
+export interface VerifyRoundInput {
+    round_context: VerifyRoundContext;
+    /** Paths of files changed in this round. */
+    files_changed: string[];
+    /** Parsed .codebyplan/e2e.json content, or null if absent. */
+    e2e_config: E2eConfig | null;
+}
+export interface FailedCheck {
+    check: "e2e_eligible_skipped" | "zero_assertion_run" | "empty_gallery" | "console_errors_reported" | "a11y_violations_reported";
+    framework: string;
+    detail: string;
+}
+export interface ValidSkip {
+    framework: string;
+    reason: string;
+}
+export interface VerifyRoundResult {
+    pass: boolean;
+    failed_checks: FailedCheck[];
+    skipped_validly: ValidSkip[];
+}
+/**
+ * Verify the three E2E hard-fails for a completed round.
+ *
+ * Hard-fails (per rules/e2e-mandatory.md):
+ *
+ *  1. e2e_eligible_skipped — a framework listed in e2e_eligible[] has no entry
+ *     in e2e_outputs AND no valid skip reason recorded.
+ *
+ *  2. zero_assertion_run — a framework's e2e_outputs[f].test_results has
+ *     passed === 0 && skipped > 0 for touched paths.
+ *
+ *  3. empty_gallery — eligible framework that ran with status "completed" reports
+ *     empty / missing e2e_gallery[] (exception: vscode-test may have empty gallery
+ *     when the extension has no visual surface — but the field MUST be present).
+ *
+ *  4. console_errors_reported — status "completed" but console_errors[] is
+ *     non-empty (quality-capture inconsistency; a completed run must be
+ *     console-clean). Absent/null field never fails (legacy outputs).
+ *
+ *  5. a11y_violations_reported — status "completed" but a11y.violations[] is
+ *     non-empty. Absent/null field never fails (legacy outputs).
+ *
+ * Survey rounds and empty e2e_eligible short-circuit to pass.
+ */
+export declare function verifyRound(input: VerifyRoundInput): VerifyRoundResult;
+//# sourceMappingURL=e2e.d.ts.map

package/dist/lib/e2e.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e.d.ts","sourceRoot":"","sources":["../../src/lib/e2e.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;IACZ,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,CAAC,EAAE;QAChB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CACjD;AAMD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,SAAS,GAAG,WAAW,GAAG,eAAe,CAAC;IACjD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,KAAK,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC,CAAC;CACJ;AAED,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B,WAAW,CAAC,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IACvC,SAAS,CAAC,EAAE;QACV,UAAU,CAAC,EAAE;YACX,EAAE,EAAE,OAAO,CAAC;YACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;YACnB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACrB,KAAK,CAAC,EAAE,MAAM,CAAC;SAChB,CAAC;QACF,SAAS,CAAC,EAAE;YACV,EAAE,EAAE,OAAO,CAAC;YACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;YACnB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACvB,KAAK,CAAC,EAAE,MAAM,CAAC;SAChB,CAAC;QACF,YAAY,CAAC,EAAE;YACb,EAAE,EAAE,OAAO,CAAC;YACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;YACnB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACrB,KAAK,CAAC,EAAE,MAAM,CAAC;SAChB,CAAC;QACF,kGAAkG;QAClG,QAAQ,CAAC,EAAE;YAAE,EAAE,EAAE,OAAO,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QACpE,UAAU,CAAC,EAAE;YACX,EAAE,EAAE,OAAO,CAAC;YACZ,GAAG,CAAC,EAAE,OAAO,CAAC;YACd,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;SACvB,CAAC;KACH,CAAC;IACF,eAAe,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACrC;uEACmE;IACnE,cAAc,CAAC,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAC1C,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;IAChB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAMD,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC7C,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,kBAAkB,CAAC;IAClC,4CAA4C;IAC5C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,8DAA8D;IAC9D,UAAU,EAAE,SAAS,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EACD,sBAAsB,GACtB,oBAAoB,GACpB,eAAe,GACf,yBAAyB,GACzB,0BAA0B,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,aAAa,EAAE,WAAW,EAAE,CAAC;IAC7B,eAAe,EAAE,SAAS,EAAE,CAAC;CAC9B;AAwED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,iBAAiB,CAmKtE"}