cortex-tms 3.0.0 → 3.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (88) hide show
  1. package/README.md +188 -56
  2. package/dist/cli.js +14 -4
  3. package/dist/cli.js.map +1 -1
  4. package/dist/commands/auto-tier.d.ts +4 -0
  5. package/dist/commands/auto-tier.d.ts.map +1 -0
  6. package/dist/commands/auto-tier.js +249 -0
  7. package/dist/commands/auto-tier.js.map +1 -0
  8. package/dist/commands/init.d.ts.map +1 -1
  9. package/dist/commands/init.js +23 -27
  10. package/dist/commands/init.js.map +1 -1
  11. package/dist/commands/migrate.d.ts.map +1 -1
  12. package/dist/commands/migrate.js +26 -7
  13. package/dist/commands/migrate.js.map +1 -1
  14. package/dist/commands/prompt.d.ts.map +1 -1
  15. package/dist/commands/prompt.js +2 -0
  16. package/dist/commands/prompt.js.map +1 -1
  17. package/dist/commands/review.d.ts.map +1 -1
  18. package/dist/commands/review.js +25 -25
  19. package/dist/commands/review.js.map +1 -1
  20. package/dist/commands/status.d.ts.map +1 -1
  21. package/dist/commands/status.js +11 -5
  22. package/dist/commands/status.js.map +1 -1
  23. package/dist/commands/tutorial.js +54 -3
  24. package/dist/commands/tutorial.js.map +1 -1
  25. package/dist/commands/validate.d.ts.map +1 -1
  26. package/dist/commands/validate.js +10 -3
  27. package/dist/commands/validate.js.map +1 -1
  28. package/dist/types/cli.d.ts +8 -0
  29. package/dist/types/cli.d.ts.map +1 -1
  30. package/dist/utils/errors.d.ts +20 -0
  31. package/dist/utils/errors.d.ts.map +1 -0
  32. package/dist/utils/errors.js +54 -0
  33. package/dist/utils/errors.js.map +1 -0
  34. package/dist/utils/git-history.d.ts +11 -0
  35. package/dist/utils/git-history.d.ts.map +1 -0
  36. package/dist/utils/git-history.js +37 -0
  37. package/dist/utils/git-history.js.map +1 -0
  38. package/dist/utils/llm-client.d.ts.map +1 -1
  39. package/dist/utils/llm-client.js +5 -2
  40. package/dist/utils/llm-client.js.map +1 -1
  41. package/dist/utils/sanitize.d.ts +4 -0
  42. package/dist/utils/sanitize.d.ts.map +1 -0
  43. package/dist/utils/sanitize.js +44 -0
  44. package/dist/utils/sanitize.js.map +1 -0
  45. package/dist/utils/templates.d.ts.map +1 -1
  46. package/dist/utils/templates.js +11 -1
  47. package/dist/utils/templates.js.map +1 -1
  48. package/dist/utils/tier-tags.d.ts +4 -0
  49. package/dist/utils/tier-tags.d.ts.map +1 -0
  50. package/dist/utils/tier-tags.js +19 -0
  51. package/dist/utils/tier-tags.js.map +1 -0
  52. package/dist/utils/token-counter.d.ts.map +1 -1
  53. package/dist/utils/token-counter.js +41 -16
  54. package/dist/utils/token-counter.js.map +1 -1
  55. package/dist/utils/validation.d.ts +168 -0
  56. package/dist/utils/validation.d.ts.map +1 -0
  57. package/dist/utils/validation.js +186 -0
  58. package/dist/utils/validation.js.map +1 -0
  59. package/package.json +6 -2
  60. package/templates/CLAUDE.md +1 -1
  61. package/templates/FUTURE-ENHANCEMENTS.md +1 -1
  62. package/templates/NEXT-TASKS.md +1 -1
  63. package/templates/PROMPTS.md +1 -1
  64. package/templates/README.md +1 -1
  65. package/templates/docs/archive/v1.0-CHANGELOG.md +1 -1
  66. package/templates/docs/core/ARCHITECTURE.md +1 -1
  67. package/templates/docs/core/DECISIONS.md +1 -1
  68. package/templates/docs/core/DOMAIN-LOGIC.md +1 -1
  69. package/templates/docs/core/GLOSSARY.md +1 -1
  70. package/templates/docs/core/PATTERNS.md +1 -1
  71. package/templates/docs/core/SCHEMA.md +1 -1
  72. package/templates/docs/core/TROUBLESHOOTING.md +1 -1
  73. package/dist/__tests__/init.test.d.ts +0 -2
  74. package/dist/__tests__/init.test.d.ts.map +0 -1
  75. package/dist/__tests__/init.test.js +0 -173
  76. package/dist/__tests__/init.test.js.map +0 -1
  77. package/dist/__tests__/release.test.d.ts +0 -2
  78. package/dist/__tests__/release.test.d.ts.map +0 -1
  79. package/dist/__tests__/release.test.js +0 -484
  80. package/dist/__tests__/release.test.js.map +0 -1
  81. package/dist/__tests__/utils/temp-dir.d.ts +0 -6
  82. package/dist/__tests__/utils/temp-dir.d.ts.map +0 -1
  83. package/dist/__tests__/utils/temp-dir.js +0 -34
  84. package/dist/__tests__/utils/temp-dir.js.map +0 -1
  85. package/dist/__tests__/validate.test.d.ts +0 -2
  86. package/dist/__tests__/validate.test.d.ts.map +0 -1
  87. package/dist/__tests__/validate.test.js +0 -209
  88. package/dist/__tests__/validate.test.js.map +0 -1
package/README.md CHANGED
@@ -1,14 +1,24 @@
1
- # Cortex TMS 🧠
1
+ <p align="center">
2
+ <img src="website/public/logo.svg" alt="Cortex TMS Logo" width="200"/>
3
+ </p>
2
4
 
3
- **AI Governance Platform - Stop Wasting Tokens. Stop Burning GPU Cycles on Old Docs.**
5
+ <h1 align="center">Cortex TMS</h1>
6
+
7
+ <p align="center">
8
+ <strong>AI Governance Platform - Stop Wasting Tokens. Stop Burning GPU Cycles on Old Docs.</strong>
9
+ </p>
10
+
11
+ ---
4
12
 
5
13
  Cortex TMS is an **AI Governance Platform** built on three pillars:
6
14
 
7
- 1. **šŸ’° Cost Efficiency** - Reduce AI API costs by **40-60%** through intelligent context management
8
- 2. **āœ… Quality** - Prevent hallucinations from outdated docs with semantic validation
9
- 3. **🌱 Sustainability** - Cut compute requirements by **94.5%** with Green Governance
15
+ 1. **šŸ’° Cost Efficiency** - Reduce input tokens by **60-70%** through intelligent context management (works with ANY model)
16
+ 2. **āœ… Quality** - Reduce hallucinations from outdated docs with semantic validation and focused context
17
+ 3. **🌱 Sustainability** - Cut compute requirements by **60-70%** with Green Governance—less energy, greener development
10
18
 
11
- Stop feeding Claude/Copilot/Cursor thousands of outdated lines. **94.5% context reduction** means **10x lower costs**, **zero hallucinations**, and **less compute waste** from reading archived docs.
19
+ Stop feeding your AI coding tool thousands of outdated lines. **60-70% input token reduction** (measured across 47 sessions on Cortex TMS itself) means **lower costs for paid models**, **less compute for free models**, and **fewer hallucinations** from irrelevant context.
20
+
21
+ **Works with any AI coding tool** - Claude Code, Copilot, Cursor, Warp, Augment, you name it. The architecture is model-agnostic. Input token reduction is universal.
12
22
 
13
23
  [![npm version](https://img.shields.io/npm/v/cortex-tms.svg?style=flat-square)](https://www.npmjs.com/package/cortex-tms)
14
24
  [![npm downloads](https://img.shields.io/npm/dm/cortex-tms.svg?style=flat-square)](https://www.npmjs.com/package/cortex-tms)
@@ -22,23 +32,25 @@ Stop feeding Claude/Copilot/Cursor thousands of outdated lines. **94.5% context
22
32
 
23
33
  ## šŸš€ Instant Activation
24
34
 
25
- Get started in under 60 seconds:
35
+ Get started in under 60 seconds (no installation required):
26
36
 
27
37
  ```bash
28
38
  # 1. Initialize your project
29
- npx cortex-tms init
39
+ npx cortex-tms@latest init
30
40
 
31
41
  # 2. Open the Project Cockpit
32
- npx cortex-tms status
42
+ npx cortex-tms@latest status
33
43
 
34
44
  # 3. Activate your AI Agent
35
- npx cortex-tms prompt init-session
45
+ npx cortex-tms@latest prompt init-session
36
46
  # (Copies project-aware prompt to clipboard!)
37
47
 
38
48
  # 4. Check version health
39
- npx cortex-tms migrate
49
+ npx cortex-tms@latest migrate
40
50
  ```
41
51
 
52
+ **Note**: Using `npx` requires no installation. For frequent use, install globally: `npm install -g cortex-tms@latest`
53
+
42
54
  Choose your scope (Nano/Standard/Enterprise) and start building with AI-optimized documentation and intelligent CLI tooling.
43
55
 
44
56
  šŸ“– **New here?** The Essential 7 prompts in `PROMPTS.md` will guide you through the entire development lifecycle.
@@ -51,9 +63,9 @@ Choose your scope (Nano/Standard/Enterprise) and start building with AI-optimize
51
63
 
52
64
  ---
53
65
 
54
- ## šŸ’° The Value: Measurable Cost Savings
66
+ ## šŸ’° The Value: Measurable Efficiency Gains
55
67
 
56
- **Real Numbers from Cortex TMS itself**:
68
+ **Real Numbers from Cortex TMS itself** (TypeScript monorepo, measured across 47 development sessions):
57
69
 
58
70
  ```bash
59
71
  cortex status --tokens -m claude-sonnet-4-5
@@ -61,11 +73,10 @@ cortex status --tokens -m claude-sonnet-4-5
61
73
 
62
74
  | Metric | Value | Impact |
63
75
  | :---------------------- | :------------------- | :---------------------------------------------- |
64
- | **Context Reduction** | 94.5% | Read 3,647 tokens instead of 66,834 |
65
- | **Cost per Session** | $0.01 | vs $0.20 without tiering (Claude Sonnet 4.5) |
66
- | **Cost Comparison** | 10x cheaper | Claude Sonnet vs GPT-4 ($0.01 vs $0.11/session) |
67
- | **Carbon Footprint** | 94.5% lower | Less compute = greener development |
68
- | **Quality Improvement** | 80% fewer violations | Guardian catches pattern drift |
76
+ | **Input Token Reduction** | 60-70% typical | Read 3,647 tokens instead of 66,834 (measured on our project) |
77
+ | **Cost Savings (Paid Models)** | ~60-70% lower costs | Example: Claude Sonnet $0.20 → $0.06/session |
78
+ | **Compute Savings (Free Models)** | ~60-70% less processing | Less GPU cycles = lower electricity + greener development |
79
+ | **Quality Improvement** | Fewer hallucinations | AI reads focused context, not thousands of irrelevant lines |
69
80
 
70
81
  **How?** The HOT/WARM/COLD tier system ensures AI agents only read what matters:
71
82
 
@@ -73,7 +84,33 @@ cortex status --tokens -m claude-sonnet-4-5
73
84
  - **WARM**: Architectural truth (on-demand) - 20,109 tokens
74
85
  - **COLD**: Historical archive (ignored) - 43,078 tokens
75
86
 
76
- **Result**: Your AI assistant stays focused, costs less, and makes fewer mistakes.
87
+ **Result**: Your AI assistant stays focused, costs less (paid models) or uses less compute (free models), and makes fewer mistakes.
88
+
89
+ **Tested Models**: Claude Sonnet/Opus, GPT-4. Architecture is model-agnostic—should work with any AI tool. Input token reduction benefit is universal.
90
+
91
+ ---
92
+
93
+ ## šŸ“Š Measurement & Validation
94
+
95
+ **How We Measured These Numbers**:
96
+
97
+ The 60-70% input token reduction is based on 47 development sessions working on Cortex TMS itself (TypeScript monorepo, ~66K total tokens). We tracked:
98
+ - HOT tier tokens: ~3,647 (what AI actually reads)
99
+ - Full repository: ~66,834 (without TMS)
100
+ - Reduction: ~94.5% when comparing HOT tier vs full repo with archives
101
+
102
+ **Transparency**:
103
+ - Sample: 47 sessions over 24 days (Jan 2026)
104
+ - Project type: TypeScript monorepo (Cortex TMS dogfooding itself)
105
+ - Tools tested: Claude Code, GitHub Copilot (in VS Code)
106
+ - Models tested: Claude Sonnet/Opus, GPT-4, and other Copilot models
107
+ - Your results may vary based on project size, structure, usage patterns, and model choice
108
+ - Read our measurement methodology: [Measuring Context Optimization](website/src/content/blog/measuring-context-optimization.mdx)
109
+
110
+ **Community Feedback Welcome**:
111
+ If you use other models (local LLMs, etc.) and your experience differs, please share! We're building a public benchmark suite to validate findings across diverse projects and models. See [FUTURE-ENHANCEMENTS.md](FUTURE-ENHANCEMENTS.md) for roadmap.
112
+
113
+ **Honest Approach**: These are our real measurements from dogfooding with the models we actually use. Not marketing fluff, not fake data. We invite the community to validate, challenge, and improve these findings.
77
114
 
78
115
  ---
79
116
 
@@ -89,9 +126,28 @@ Traditional repos drown AI agents in thousands of lines of historical tasks and
89
126
 
90
127
  ---
91
128
 
129
+ ## šŸ†• What's New in v3.2 (Upcoming)
130
+
131
+ **Security & Production Readiness** - Making Cortex TMS enterprise-grade:
132
+
133
+ - šŸ›”ļø **Centralized Error Handling** — No more process crashes. All commands use consistent `CLIError` patterns with proper cleanup
134
+ - āœ… **Zod-Based Input Validation** — Runtime type safety for all CLI commands with clear, actionable error messages
135
+ - 🧪 **Comprehensive E2E Tests** — 61 E2E tests covering full CLI workflows (init, validate, migrate, review, auto-tier)
136
+ - šŸ”’ **Path Traversal Protection** — Template operations secured against `../../etc/passwd` attacks with `validateSafePath()`
137
+ - šŸ” **API Key Sanitization** — Guardian automatically redacts Anthropic/OpenAI keys in all error messages and logs
138
+ - šŸ“Š **Automated Security Scanning** — CI pipeline runs `pnpm audit` on every PR to catch dependency vulnerabilities
139
+
140
+ **Test Coverage**: 316 tests (97% pass rate) — up from 269 tests (+17%)
141
+
142
+ **For Developers**: See [Security Testing Guide](docs/guides/SECURITY-TESTING.md) for how to verify security patterns.
143
+
144
+ **Full Details**: [CHANGELOG.md](CHANGELOG.md#320---unreleased)
145
+
146
+ ---
147
+
92
148
  ## šŸ› ļø CLI Commands
93
149
 
94
- Cortex TMS provides 7 production-ready commands (v2.6.1):
150
+ Cortex TMS provides 8 production-ready commands:
95
151
 
96
152
  ### `cortex-tms tutorial`
97
153
 
@@ -146,10 +202,39 @@ cortex-tms status --tokens -m gpt-4 # Cost comparison across models
146
202
  **Token Analysis Features**:
147
203
 
148
204
  - HOT/WARM/COLD tier breakdown with token counts
149
- - Context reduction percentage (e.g., 94.5% reduction)
150
- - Cost estimates per session/day/month
205
+ - Context reduction percentage (typically 60-70%)
206
+ - Cost estimates per session/day/month (for paid models)
151
207
  - Model comparison (Claude Sonnet 4.5, Opus 4.5, GPT-4, etc.)
152
- - Sustainability impact tracking
208
+ - Sustainability impact tracking (compute savings for all models)
209
+
210
+ ### `cortex-tms auto-tier`
211
+
212
+ Git-based automatic tier assignment - reduce manual tier management using file recency as a relevance signal.
213
+
214
+ ```bash
215
+ cortex-tms auto-tier # Apply tier tags based on git history
216
+ cortex-tms auto-tier --dry-run # Preview tier suggestions
217
+ cortex-tms auto-tier --hot 14 --warm 60 # Custom thresholds
218
+ cortex-tms auto-tier --force # Overwrite existing tags
219
+ ```
220
+
221
+ **Community-requested feature**: Built in response to feedback from Reddit users [Illustrious-Report96](https://www.reddit.com/user/Illustrious-Report96/), [pbalIII](https://www.reddit.com/user/pbalIII/), and [durable-racoon](https://www.reddit.com/user/durable-racoon/) who identified manual tier management as a scalability bottleneck and suggested using git history to determine file "heat".
222
+
223
+ **How It Works**:
224
+
225
+ - Analyzes git commit history and file paths to calculate priority scores
226
+ - **Scoring system**: Canonical files (100 pts) > docs/ (40 pts) + recency (15 pts)
227
+ - **Strict cap**: Maximum 10 HOT files (prevents context bloat)
228
+ - **Smart defaults**: `docs/archive/` → COLD, `docs/guides/` → WARM, canonical files always HOT
229
+ - Adds `<!-- @cortex-tms-tier HOT -->` tags to markdown files
230
+ - Respects explicit tier tags unless `--force` is used
231
+
232
+ **Why Auto-Tier?**
233
+
234
+ - **Automates tier management**: No more manual tier decisions
235
+ - **Objective signal**: Git history provides measurable recency data
236
+ - **Aligns with "Lost in the Middle" research**: Recent files (likely relevant) placed at context beginning
237
+ - **Adapts to workflow**: Tiers stay current as project evolves
153
238
 
154
239
  ### `cortex-tms migrate`
155
240
 
@@ -345,21 +430,21 @@ jobs:
345
430
 
346
431
  ---
347
432
 
348
- ## šŸš€ What's New in v2.6.1
433
+ ## šŸš€ What's New in v2.6.1 (Current Published Release)
349
434
 
350
435
  ### Token Counter - Prove Your Savings (GREEN GOVERNANCE)
351
436
 
352
437
  - **Real-Time Token Analysis**: `cortex status --tokens` shows HOT/WARM/COLD breakdown
353
438
  - **Multi-Model Cost Comparison**: Claude Sonnet 4.5, Opus 4.5, GPT-4, and more
354
439
  - **Sustainability Metrics**: Track your sustainability impact from less compute
355
- - **94.5% Context Reduction**: Cortex TMS reads 3,647 tokens instead of 66,834
356
- - **10x Cost Savings**: $0.01/session (Claude Sonnet) vs $0.11/session (GPT-4)
440
+ - **60-70% Input Token Reduction**: Measured on Cortex TMS itself (3,647 vs 66,834 tokens)
441
+ - **Universal Savings**: Lower costs for paid models, less compute for free models
357
442
 
358
443
  ### Guardian Semantic Validation (QUALITY ENFORCEMENT)
359
444
 
360
445
  - **Pattern Enforcement**: `cortex review <file>` validates against PATTERNS.md
361
446
  - **Domain Logic Checker**: Audits code against immutable project rules
362
- - **Zero False Negatives**: Never misses actual violations (65.5% baseline accuracy)
447
+ - **High Accuracy**: 80%+ accuracy target with Safe Mode (from 65.5% baseline)
363
448
  - **LLM-Powered Detection**: Uses Claude/GPT to catch semantic violations, not just syntax
364
449
 
365
450
  ### Integration Test Suite (PRODUCTION QUALITY)
@@ -518,12 +603,20 @@ cortex-tms/
518
603
 
519
604
  ## šŸ¤ Contributing
520
605
 
521
- 1. Read `NEXT-TASKS.md` to see what's being worked on
522
- 2. Check `FUTURE-ENHANCEMENTS.md` for backlog items
523
- 3. Use `cortex-tms prompt` to get project-aware guidance
606
+ We welcome contributions! Please read **[CONTRIBUTING.md](CONTRIBUTING.md)** for detailed guidelines on:
607
+ - How to submit bug reports and feature requests
608
+ - Development setup and workflow
609
+ - Pull request process and quality standards
610
+ - Code style and testing requirements
611
+ - Areas where we need help
612
+
613
+ **Quick Start for Contributors**:
614
+ 1. Read [CONTRIBUTING.md](CONTRIBUTING.md) - **Required for all contributions**
615
+ 2. Check [open issues](https://github.com/cortex-tms/cortex-tms/issues) for `good-first-issue` labels
616
+ 3. For significant changes, open an issue for discussion **before** coding
524
617
  4. Follow patterns in `docs/core/PATTERNS.md`
525
- 5. Verify changes against `docs/core/DOMAIN-LOGIC.md`
526
- 6. Test templates with AI agents before submitting
618
+ 5. Ensure tests pass: `npm test`
619
+ 6. Submit PR with clear description and linked issue
527
620
 
528
621
  ---
529
622
 
@@ -539,27 +632,33 @@ cortex-tms/
539
632
 
540
633
  ## šŸŽÆ Why Cortex TMS? Three Pillars, Measurable Results
541
634
 
542
- ### šŸ’° Cost Efficiency (Pillar 1)
635
+ **Based on 47 development sessions on Cortex TMS itself (TypeScript monorepo) using Claude Code and GitHub Copilot with various models. Your results may vary.**
636
+
637
+ ### šŸ’° Cost Efficiency (Pillar 1) - Input Token Reduction
543
638
 
544
- **Before TMS**: Wasting **$0.19/session** reading 66,834 tokens of old docs
545
- **After TMS**: Paying **$0.01/session** with 94.5% context reduction
546
- **Impact**: **10x cost reduction** - Claude Sonnet 4.5 vs GPT-4 ($0.01 vs $0.11/session)
639
+ **Before TMS**: AI reads entire repository (66,834 tokens in our case)
640
+ **After TMS**: AI reads focused context (3,647 tokens—60-70% reduction)
641
+ **Impact**:
642
+ - **Paid models** (tested: Claude, GPT-4): ~60-70% lower API costs
643
+ - **Free/local models** (untested, but architecturally supported): Should see ~60-70% less compute/electricity
644
+ - **Universal benefit**: Input token reduction works with any AI tool
547
645
 
548
- **How**: HOT/WARM/COLD tiers ensure AI only reads what matters (3,647 vs 66,834 tokens)
646
+ **How**: HOT/WARM/COLD tiers ensure AI only reads what matters (3,647 vs 66,834 tokens measured on our project with Claude/GPT)
549
647
 
550
- ### āœ… Quality (Pillar 2)
648
+ ### āœ… Quality (Pillar 2) - Focused Context Means Fewer Hallucinations
551
649
 
552
- **Before TMS**: **40% pattern violations** from AI reading outdated examples
553
- **After TMS**: **80% fewer violations** with Guardian semantic validation
650
+ **Before TMS**: AI reads thousands of outdated lines, leading to pattern violations
651
+ **After TMS**: AI reads focused, current context—fewer mistakes from irrelevant information
554
652
  **Impact**: Guardian enforces `PATTERNS.md` and `DOMAIN-LOGIC.md` automatically
555
653
 
556
- **How**: LLM-powered review catches semantic drift that grep/regex can't find (**zero false negatives**)
654
+ **How**: LLM-powered semantic review catches drift that grep/regex can't find
557
655
 
558
- ### 🌱 Sustainability (Pillar 3)
656
+ ### 🌱 Sustainability (Pillar 3) - Greener Development Through Efficiency
559
657
 
560
- **Before TMS**: Burning unnecessary GPU cycles on 94.5% noise (archived changelogs, stale tasks)
561
- **After TMS**: **94.5% lower compute requirements** through intelligent tiering
562
- **Impact**: Less compute = greener development + happier planet
658
+ **Before TMS**: Burning GPU cycles on archived changelogs and stale tasks
659
+ **After TMS**: 60-70% lower compute requirements through intelligent tiering
660
+ **Impact**: Less compute = lower electricity costs + greener development
661
+ - Especially important for free/local models where YOU pay the electricity bill
563
662
 
564
663
  **How**: Stop reading COLD files unless explicitly needed
565
664
 
@@ -567,16 +666,49 @@ cortex-tms/
567
666
 
568
667
  - **Instant AI Activation**: Essential 7 prompts in `PROMPTS.md` (no manual prompt writing)
569
668
  - **Signal over Noise**: HOT/WARM/COLD system keeps AI focused
570
- - **Production-Ready**: 111 passing tests, stable 2.6.1 release
669
+ - **Production-Ready**: 316 tests (97% pass rate), enterprise-grade security (v3.2)
670
+ - **Tested With**: Claude Code, GitHub Copilot (in VS Code). Architecture supports any AI tool (Cursor, etc.).
571
671
 
572
672
  ---
573
673
 
574
- ## Contact
674
+ ## šŸ”’ Security
675
+
676
+ Cortex TMS implements enterprise-grade security practices:
677
+
678
+ - **API Key Protection**: Guardian automatically sanitizes API keys in all output (errors, logs, console)
679
+ - **Input Validation**: All CLI commands use Zod schemas for runtime type safety
680
+ - **Path Security**: Template operations protected against directory traversal attacks
681
+ - **Automated Scanning**: CI pipeline includes `pnpm audit` to catch dependency vulnerabilities
682
+
683
+ **Documentation**:
684
+ - [Security Overview](docs/core/SECURITY.md) — Threat model, mitigations, and best practices
685
+ - [Security Testing Guide](docs/guides/SECURITY-TESTING.md) — How to verify security patterns
686
+ - [Security Patterns](docs/core/PATTERNS.md) — Implementation patterns (Error Handling, Input Validation)
687
+
688
+ **Reporting Vulnerabilities**: Use [GitHub Security Advisories](https://github.com/cortex-tms/cortex-tms/security/advisories/new) for responsible disclosure.
689
+
690
+ ---
691
+
692
+ ## šŸ’¬ Community & Support
693
+
694
+ We have an active and growing community! ⭐ **146 stars** and counting.
695
+
696
+ ### Get Help & Connect
697
+ - **[GitHub Discussions](https://github.com/cortex-tms/cortex-tms/discussions)** - Ask questions, share ideas, showcase projects
698
+ - [Q&A](https://github.com/cortex-tms/cortex-tms/discussions/categories/q-a) - Get help from the community
699
+ - [Ideas](https://github.com/cortex-tms/cortex-tms/discussions/categories/ideas) - Suggest features (vote with šŸ‘)
700
+ - [Show and Tell](https://github.com/cortex-tms/cortex-tms/discussions/categories/show-and-tell) - Share what you've built
701
+ - [Announcements](https://github.com/cortex-tms/cortex-tms/discussions/categories/announcements) - Release notes and updates
702
+
703
+ ### Report Issues
704
+ - **[Bug Reports](https://github.com/cortex-tms/cortex-tms/issues/new)** - Found a bug? Let us know!
705
+ - **[Security Issues](https://github.com/cortex-tms/cortex-tms/security/advisories/new)** - Responsible disclosure for security vulnerabilities
706
+
707
+ ### Contributing
708
+ - **[Contributing Guide](CONTRIBUTING.md)** - How to contribute code, docs, or ideas
709
+ - **[Community Guide](docs/COMMUNITY.md)** - Community guidelines and best practices
575
710
 
576
- - **Bug Reports**: [GitHub Issues](https://github.com/cortex-tms/cortex-tms/issues/new) - Report bugs or technical issues
577
- - **Feature Requests**: [GitHub Issues](https://github.com/cortex-tms/cortex-tms/issues/new) - Suggest new features or improvements
578
- - **Questions & Support**: [GitHub Issues](https://github.com/cortex-tms/cortex-tms/issues/new) - Get help and ask questions
579
- - **Security Issues**: [GitHub Security Advisories](https://github.com/cortex-tms/cortex-tms/security/advisories/new) - Responsible disclosure
711
+ **Star us on GitHub** ⭐ if you find Cortex TMS useful!
580
712
 
581
713
  ---
582
714
 
@@ -588,9 +720,9 @@ MIT
588
720
 
589
721
  ## Status
590
722
 
591
- **Version**: 3.0.0 (Stable / Production Ready)
592
- **Last Updated**: 2026-01-23
593
- **Current Sprint**: v2.8 - "Marketing Pivot & Community Launch"
594
- **Completed Sprints**: v2.1, v2.2, v2.3, v2.4, v2.5, v2.6, v2.7 (see `docs/archive/`)
723
+ **Version**: 3.2.0 (Upcoming - Phase 1 Complete)
724
+ **Last Updated**: 2026-01-31
725
+ **Current Sprint**: v3.2 - "Security Hardening + Production Readiness"
726
+ **Recent Sprints**: v3.1 (Git-Based Auto-Tiering), v3.0 (AI-Powered Onboarding) — see [docs/archive/](docs/archive/)
595
727
 
596
- <!-- @cortex-tms-version 3.0.0 -->
728
+ <!-- @cortex-tms-version 3.2.0 -->
package/dist/cli.js CHANGED
@@ -4,6 +4,8 @@ import { readFileSync } from 'fs';
4
4
  import { fileURLToPath } from 'url';
5
5
  import { dirname, join } from 'path';
6
6
  import chalk from 'chalk';
7
+ import { CLIError, ValidationError, formatError } from './utils/errors.js';
8
+ import { sanitizeApiKey } from './utils/sanitize.js';
7
9
  const __filename = fileURLToPath(import.meta.url);
8
10
  const __dirname = dirname(__filename);
9
11
  const packageJson = JSON.parse(readFileSync(join(__dirname, '../package.json'), 'utf-8'));
@@ -23,6 +25,7 @@ import { migrateCommand } from './commands/migrate.js';
23
25
  import { promptCommand } from './commands/prompt.js';
24
26
  import { tutorialCommand } from './commands/tutorial.js';
25
27
  import { reviewCommand } from './commands/review.js';
28
+ import { autoTierCommand } from './commands/auto-tier.js';
26
29
  program.addCommand(initCommand);
27
30
  program.addCommand(validateCommand);
28
31
  program.addCommand(statusCommand);
@@ -30,22 +33,29 @@ program.addCommand(migrateCommand);
30
33
  program.addCommand(promptCommand);
31
34
  program.addCommand(tutorialCommand);
32
35
  program.addCommand(reviewCommand);
36
+ program.addCommand(autoTierCommand);
33
37
  program.on('command:*', () => {
34
- console.error(chalk.red('\nāŒ Invalid command:'), chalk.bold(program.args.join(' ')));
35
- console.log(chalk.gray('\nRun'), chalk.cyan('cortex-tms --help'), chalk.gray('to see available commands.'));
36
- process.exit(1);
38
+ throw new ValidationError('Invalid command', {
39
+ command: program.args.join(' '),
40
+ hint: 'Run "cortex-tms --help" to see available commands',
41
+ });
37
42
  });
38
43
  program.exitOverride();
39
44
  try {
40
45
  await program.parseAsync(process.argv);
41
46
  }
42
47
  catch (error) {
48
+ if (error instanceof CLIError) {
49
+ console.error(chalk.red('\nāŒ Error:'), formatError(error));
50
+ process.exit(error.exitCode);
51
+ }
43
52
  if (error instanceof Error) {
44
53
  if ('code' in error && typeof error.code === 'string') {
45
54
  process.exit(1);
46
55
  }
47
56
  if (!error.message.includes('(outputHelp)')) {
48
- console.error(chalk.red('\nāŒ Error:'), error.message);
57
+ const sanitizedMessage = sanitizeApiKey(error.message);
58
+ console.error(chalk.red('\nāŒ Error:'), sanitizedMessage);
49
59
  }
50
60
  }
51
61
  process.exit(1);
package/dist/cli.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AASA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAGtC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAC5B,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CAC1D,CAAC;AAEF,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAG9B,OAAO;KACJ,IAAI,CAAC,YAAY,CAAC;KAClB,WAAW,CACV,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC;IACzB,IAAI;IACJ,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CACzE;KACA,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,EAAE,4BAA4B,CAAC;KAC3E,UAAU,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;AAGxD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAGlC,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE;IAC3B,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,EACjC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CACnC,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;IAC5G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAGH,OAAO,CAAC,YAAY,EAAE,CAAC;AAGvB,IAAI,CAAC;IACH,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IAEf,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAE3B,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAEtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAGD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAGD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,UAAU,EAAE,CAAC;AACvB,CAAC"}
1
+ {"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AASA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAGtC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAC5B,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CAC1D,CAAC;AAEF,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAG9B,OAAO;KACJ,IAAI,CAAC,YAAY,CAAC;KAClB,WAAW,CACV,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC;IACzB,IAAI;IACJ,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CACzE;KACA,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,EAAE,4BAA4B,CAAC;KAC3E,UAAU,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;AAGxD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AAGpC,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE;IAC3B,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE;QAC3C,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/B,IAAI,EAAE,mDAAmD;KAC1D,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGH,OAAO,CAAC,YAAY,EAAE,CAAC;AAGvB,IAAI,CAAC;IACH,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IAEf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAGD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAEtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAGD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC5C,MAAM,gBAAgB,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAGD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,UAAU,EAAE,CAAC;AACvB,CAAC"}
@@ -0,0 +1,4 @@
1
+ import { Command } from 'commander';
2
+ export declare function createAutoTierCommand(): Command;
3
+ export declare const autoTierCommand: Command;
4
+ //# sourceMappingURL=auto-tier.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"auto-tier.d.ts","sourceRoot":"","sources":["../../src/commands/auto-tier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmHpC,wBAAgB,qBAAqB,IAAI,OAAO,CAe/C;AA4OD,eAAO,MAAM,eAAe,SAA0B,CAAC"}