delimit-cli 3.11.10 → 3.12.0

package/CHANGELOG.md

@@ -1,5 +1,67 @@
 # Changelog
 
+## [3.12.0] - 2026-03-26
+
+### Added
+- Cross-model hook system: session-start, pre-tool, and pre-commit hooks for Claude Code, Codex, and Gemini CLI
+- `delimit export` and `delimit import` commands for shareable governance config
+- `delimit hook <event>` commands for manual hook invocation
+- `delimit uninstall` removes hooks from all AI tools cleanly
+- Pre-push hooks for catching governance violations before remote push
+- Cursor and Codex adapters for native integration
+
+### Changed
+- "Keep Building." success message displayed on lint/diff/doctor pass
+- Zero-config action improvements for smoother CI integration
+
+## [3.11.10] - 2026-03-24
+
+### Added
+- Cursor adapter with `.cursor/rules/delimit.md` support (Cursor 0.45+)
+- Codex adapters: `codex-skill.js` (governance) and `codex-security.js`
+- Setup `--dry-run` previews config changes before writing
+- Uninstall `--dry-run` with backups for all 4 AI assistants
+- Post-install config validation (checks all assistant configs)
+- npm publish workflow with provenance and approval gates
+- Setup matrix tests (13 new tests across all AI assistants)
+
+### Changed
+- Repo renamed to `delimit-ai/delimit-mcp-server`
+- Description: "Unify Claude Code, Codex, Cursor, and Gemini CLI with persistent context, governance, and multi-model debate."
+- Clear Free vs Pro tier boundaries in README
+
+### Security
+- Hardened `.npmignore` (blocks .env, credentials, keys)
+- Supply chain security section in SECURITY.md
+
+## [3.11.9] - 2026-03-23
+
+### Added
+- Auto-detect API keys and CLIs on `delimit init` and `delimit version`
+- `delimit_quickstart` MCP tool (60-second guided first-run)
+- Deliberation cost tracking (estimate + actual per model)
+- Input sanitization: `_sanitize_path`, `_sanitize_subprocess_arg`
+- GitHub Action smoke test workflow
+
+### Fixed
+- Gemini deliberation HTTP 400 (ADC credentials + jamsons project)
+- Deliberation timeout: parallelized round 1 (46% faster)
+- Sensor dedup: titles include repo/issue to prevent duplicates
+- Test-mode guard prevents ledger pollution from tests
+
+### Changed
+- Governance default mode: advisory -> guarded (blocks critical actions)
+- Ledger tools now route through governance loop (113/116 tools)
+- Dialogue deliberation capped at 4 rounds (was 6)
+- Per-model API timeout: 120s -> 45s (fail fast)
+
+## [3.11.8] - 2026-03-23
+
+### Fixed
+- Codex compatibility: 11 type coercion fixes (string->list/dict)
+- CI green: FastMCP fallback, env var injection, mock patterns
+- Dashboard dark/light mode with CSS variables
+
 ## [2.4.0] - 2026-03-15
 
 ### Added

package/README.md

@@ -5,15 +5,21 @@ Unify Claude Code, Codex, Cursor, and Gemini CLI with persistent context, govern
 [![npm](https://img.shields.io/npm/v/delimit-cli)](https://www.npmjs.com/package/delimit-cli)
 [![GitHub Action](https://img.shields.io/badge/GitHub%20Action-v1.6.0-blue)](https://github.com/marketplace/actions/delimit-api-governance)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
-[![delimit MCP server](https://glama.ai/mcp/servers/delimit-ai/delimit/badges/score.svg)](https://glama.ai/mcp/servers/delimit-ai/delimit)
+[![Glama](https://glama.ai/mcp/servers/delimit-ai/delimit-mcp-server/badges/score.svg)](https://glama.ai/mcp/servers/delimit-ai/delimit-mcp-server)
 
-Your tasks, memory, and governance carry between Claude Code, Codex, and Gemini CLI. Persistent ledger, API breaking change detection, security audit, multi-model deliberation — all shared across assistants.
+Persistent ledger, API governance, security orchestration, and multi-model deliberation — all shared across Claude Code, Codex, Cursor, and Gemini CLI.
 
 ---
 
 ## GitHub Action
 
-Add to any repo with an OpenAPI spec:
+Zero-config — auto-detects your OpenAPI spec:
+
+```yaml
+- uses: delimit-ai/delimit-action@v1
+```
+
+Or with full configuration:
 
 ```yaml
 name: API Contract Check

package/bin/delimit-cli.js

@@ -9,6 +9,7 @@ const chalk = require('chalk');
 const inquirer = require('inquirer');
 const DelimitAuthSetup = require('../lib/auth-setup');
 const DelimitHooksInstaller = require('../lib/hooks-installer');
+const crossModelHooks = require('../lib/cross-model-hooks');
 
 const AGENT_URL = `http://127.0.0.1:${process.env.DELIMIT_AGENT_PORT || 7823}`;
 const program = new Command();
@@ -535,6 +536,36 @@ program
             changes.push({ target: '~/.delimit/shims/', action: 'Remove CLI shims directory' });
         }
 
+        // 8. Cross-model governance hooks (LED-202)
+        const claudeSettingsPath = path.join(HOME, '.claude', 'settings.json');
+        if (fs.existsSync(claudeSettingsPath)) {
+            try {
+                const cfg = JSON.parse(fs.readFileSync(claudeSettingsPath, 'utf8'));
+                if (cfg.hooks) {
+                    const hasDelimitHook = Object.values(cfg.hooks).some(arr =>
+                        Array.isArray(arr) && arr.some(h => h.command && h.command.includes('delimit-cli'))
+                    );
+                    if (hasDelimitHook) {
+                        changes.push({ target: '~/.claude/settings.json', action: 'Remove Delimit governance hooks' });
+                    }
+                }
+            } catch (e) {}
+        }
+        const codexInstructions = path.join(HOME, '.codex', 'instructions.md');
+        if (fs.existsSync(codexInstructions)) {
+            const content = fs.readFileSync(codexInstructions, 'utf8');
+            if (content.includes('delimit:hooks-start')) {
+                changes.push({ target: '~/.codex/instructions.md', action: 'Remove Delimit hook instructions' });
+            }
+        }
+        const geminiGovMd = path.join(HOME, '.gemini', 'GEMINI.md');
+        if (fs.existsSync(geminiGovMd)) {
+            const content = fs.readFileSync(geminiGovMd, 'utf8');
+            if (content.includes('Delimit Governance')) {
+                changes.push({ target: '~/.gemini/GEMINI.md', action: 'Remove Delimit governance file' });
+            }
+        }
+
         if (changes.length === 0) {
             console.log(chalk.green('\nNo Delimit integrations found. Nothing to remove.\n'));
             return;
@@ -625,6 +656,14 @@ program
             } catch (e) {}
         }
 
+        // Remove cross-model governance hooks (LED-202)
+        try {
+            const removedFrom = crossModelHooks.removeAllHooks();
+            if (removedFrom.length > 0) {
+                console.log(chalk.green(`✓ Removed governance hooks from: ${removedFrom.join(', ')}`));
+            }
+        } catch (e) { /* cross-model-hooks module not critical */ }
+
         console.log(chalk.green('\n  Delimit has been completely removed.'));
         console.log(chalk.gray(`  Backups saved to: ${backupDir}`));
         console.log(chalk.gray('  Your data in ~/.delimit/ has been preserved.'));
@@ -701,95 +740,86 @@ program
         await proxyAITool(tool, args);
     });
 
-// Hook handler (called by Git hooks)
-program
-    .command('hook <type>')
-    .description('Internal hook handler')
+// ---------------------------------------------------------------------------
+// LED-202: Cross-model hook commands
+// ---------------------------------------------------------------------------
 
-    .action(async (type) => {
-        await ensureAgent();
-        
-        // Gather context
-        const context = {
-            command: type,
-            pwd: process.cwd(),
-            gitBranch: 'unknown',
-            files: [],
-            diff: ''
-        };
-        
-        // Try to get Git info, but don't fail if not in repo
+const hookCmd = program
+    .command('hook <event> [tool_name]')
+    .description('Governance hook handler (session-start | pre-tool | pre-commit)')
+    .action(async (event, toolName) => {
         try {
-            context.gitBranch = execSync('git branch --show-current 2>/dev/null').toString().trim() || 'unknown';
-        } catch (e) {
-            // Not in a Git repo or Git not available
-            context.gitBranch = 'unknown';
-        }
-        
-        if (type === 'pre-commit') {
-            try {
-                context.files = execSync('git diff --cached --name-only 2>/dev/null').toString().split('\n').filter(f => f);
-                context.diff = execSync('git diff --cached 2>/dev/null').toString();
-            } catch (e) {
-                // Not in a Git repo or no staged changes
-                context.files = [];
-                context.diff = '';
-            }
-        } else if (type === 'pre-push') {
-            try {
-                // Get commits to be pushed
-                context.files = execSync('git diff --name-only @{upstream}...HEAD 2>/dev/null').toString().split('\n').filter(f => f);
-                context.diff = execSync('git diff @{upstream}...HEAD 2>/dev/null').toString();
-            } catch (e) {
-                // No upstream or not in repo
-                context.files = [];
-                context.diff = '';
-            }
-        }
-        
-        // Query agent for decision
-        const { data: decision } = await axios.post(`${AGENT_URL}/evaluate`, context);
-        
-        // Display decision
-        if (decision.message) {
-            const color = decision.action === 'block' ? chalk.red :
-                         decision.action === 'prompt' ? chalk.yellow :
-                         chalk.blue;
-            console.log(color(decision.message));
-        }
-        
-        // Handle the decision
-        if (decision.action === 'block') {
-            if (decision.requiresOverride) {
-                console.log(chalk.red('Action blocked. Cannot override in enforce mode.'));
-                process.exit(1);
-            } else {
-                const { override } = await inquirer.prompt([{
-                    type: 'confirm',
-                    name: 'override',
-                    message: 'Override and continue?',
-                    default: false
-                }]);
-                
-                if (!override) {
-                    process.exit(1);
-                }
+            switch (event) {
+                case 'session-start':
+                    await crossModelHooks.hookSessionStart();
+                    break;
+                case 'pre-tool':
+                    await crossModelHooks.hookPreTool(toolName || 'unknown');
+                    break;
+                case 'pre-commit':
+                    await crossModelHooks.hookPreCommit();
+                    break;
+                default:
+                    // Legacy: fall back to agent-based hook evaluation
+                    await ensureAgent();
+                    const context = {
+                        command: event,
+                        pwd: process.cwd(),
+                        gitBranch: 'unknown',
+                        files: [],
+                        diff: ''
+                    };
+                    try {
+                        context.gitBranch = execSync('git branch --show-current 2>/dev/null').toString().trim() || 'unknown';
+                    } catch (e) { context.gitBranch = 'unknown'; }
+
+                    if (event === 'pre-push') {
+                        try {
+                            context.files = execSync('git diff --name-only @{upstream}...HEAD 2>/dev/null').toString().split('\n').filter(f => f);
+                            context.diff = execSync('git diff @{upstream}...HEAD 2>/dev/null').toString();
+                        } catch (e) {
+                            context.files = [];
+                            context.diff = '';
+                        }
+                    }
+
+                    const { data: decision } = await axios.post(`${AGENT_URL}/evaluate`, context);
+                    if (decision.message) {
+                        const color = decision.action === 'block' ? chalk.red :
+                                     decision.action === 'prompt' ? chalk.yellow :
+                                     chalk.blue;
+                        console.log(color(decision.message));
+                    }
+                    if (decision.action === 'block') {
+                        if (decision.requiresOverride) {
+                            console.log(chalk.red('Action blocked. Cannot override in enforce mode.'));
+                            process.exit(1);
+                        } else {
+                            const { override } = await inquirer.prompt([{
+                                type: 'confirm',
+                                name: 'override',
+                                message: 'Override and continue?',
+                                default: false
+                            }]);
+                            if (!override) process.exit(1);
+                        }
+                    } else if (decision.action === 'prompt') {
+                        const { proceed } = await inquirer.prompt([{
+                            type: 'confirm',
+                            name: 'proceed',
+                            message: 'Continue with this action?',
+                            default: false
+                        }]);
+                        if (!proceed) process.exit(1);
+                    }
+                    process.exit(0);
             }
-        } else if (decision.action === 'prompt') {
-            const { proceed } = await inquirer.prompt([{
-                type: 'confirm',
-                name: 'proceed',
-                message: 'Continue with this action?',
-                default: false
-            }]);
-            
-            if (!proceed) {
-                process.exit(1);
+        } catch (err) {
+            // Hooks must never block the AI tool -- fail open
+            if (process.env.DELIMIT_DEBUG) {
+                process.stderr.write(`[Delimit] Hook error: ${err.message}\n`);
             }
         }
-        
-        // Action allowed
-        process.exit(0);
     });
 
 // ═══════════════════════════════════════════════════════════════════════
@@ -1135,6 +1165,7 @@ program
         console.log('');
         if (fail === 0 && warn === 0) {
             console.log(chalk.green.bold('  All checks passed! Ready to lint.\n'));
+            console.log('Keep Building.\n');
         } else if (fail === 0) {
             console.log(chalk.yellow.bold(`  ${ok} passed, ${warn} warning(s). Setup looks good.\n`));
         } else {
@@ -1263,6 +1294,10 @@ program
                 console.log('');
             }
 
+            if (decision === 'pass') {
+                console.log('Keep Building.\n');
+            }
+
             process.exit(result.exit_code || 0);
         } catch (err) {
             console.error(chalk.red(`Error: ${err.message}`));
@@ -1295,6 +1330,10 @@ program
                 console.log(`  ${tag} ${c.message}`);
             });
             console.log('');
+
+            if (result.breaking_changes === 0) {
+                console.log('Keep Building.\n');
+            }
         } catch (err) {
             console.error(chalk.red(`Error: ${err.message}`));
             process.exit(1);
@@ -1428,6 +1467,187 @@ program
         console.log(chalk.dim('Tier: pro'));
     });
 
+// ---------------------------------------------------------------------------
+// LED-187: Export governance config as shareable JSON
+// ---------------------------------------------------------------------------
+
+/**
+ * Build a governance config bundle from the current project directory.
+ * Returns a plain object ready for JSON serialization.
+ */
+function buildConfigBundle(cwd) {
+    const bundle = {
+        delimit_config_version: 1,
+        created_at: new Date().toISOString(),
+        project: path.basename(cwd),
+        policies: null,
+        workflow: null,
+    };
+
+    // Read delimit.yml or .delimit/policies.yml
+    const candidates = [
+        path.join(cwd, 'delimit.yml'),
+        path.join(cwd, '.delimit.yml'),
+        path.join(cwd, '.delimit', 'policies.yml'),
+    ];
+    for (const p of candidates) {
+        if (fs.existsSync(p)) {
+            const raw = fs.readFileSync(p, 'utf-8');
+            bundle.policies = { path: path.relative(cwd, p), content: raw };
+            break;
+        }
+    }
+
+    // Read GitHub Action workflow if it exists
+    const workflowPath = path.join(cwd, '.github', 'workflows', 'api-governance.yml');
+    if (fs.existsSync(workflowPath)) {
+        bundle.workflow = {
+            path: '.github/workflows/api-governance.yml',
+            content: fs.readFileSync(workflowPath, 'utf-8'),
+        };
+    }
+
+    return bundle;
+}
+
+program
+    .command('export')
+    .description('Export governance config as shareable JSON')
+    .option('-o, --output <file>', 'Write to file instead of stdout')
+    .option('--url', 'Generate a delimit.ai/import share URL')
+    .action(async (options) => {
+        const cwd = process.cwd();
+        const bundle = buildConfigBundle(cwd);
+
+        if (!bundle.policies) {
+            console.error(chalk.red('No governance config found. Run "delimit init" first.'));
+            process.exit(1);
+        }
+
+        const json = JSON.stringify(bundle, null, 2);
+
+        if (options.url) {
+            const encoded = Buffer.from(json).toString('base64');
+            const shareUrl = `https://delimit.ai/import?config=${encoded}`;
+            console.log(chalk.green('Share URL:\n'));
+            console.log(shareUrl);
+            return;
+        }
+
+        if (options.output) {
+            fs.writeFileSync(options.output, json);
+            console.log(chalk.green(`Exported config to ${options.output}`));
+        } else {
+            console.log(json);
+        }
+    });
+
+// ---------------------------------------------------------------------------
+// LED-187: Import governance config from file, URL, or base64 string
+// ---------------------------------------------------------------------------
+
+/**
+ * Parse a config bundle from various sources: file path, base64 string,
+ * or a delimit.ai/import?config=... URL.
+ */
+function parseConfigSource(source) {
+    // URL form — extract base64 from query param
+    if (source.startsWith('http://') || source.startsWith('https://')) {
+        const url = new URL(source);
+        const encoded = url.searchParams.get('config');
+        if (!encoded) {
+            throw new Error('URL does not contain a config= parameter');
+        }
+        return JSON.parse(Buffer.from(encoded, 'base64').toString('utf-8'));
+    }
+
+    // File path
+    if (fs.existsSync(source)) {
+        return JSON.parse(fs.readFileSync(source, 'utf-8'));
+    }
+
+    // Assume base64
+    try {
+        return JSON.parse(Buffer.from(source, 'base64').toString('utf-8'));
+    } catch {
+        throw new Error('Could not parse source as file path, URL, or base64');
+    }
+}
+
+program
+    .command('import <source>')
+    .description('Import governance config from file, URL, or base64 string')
+    .option('--action', 'Also write the GitHub Action workflow')
+    .option('--yes', 'Skip confirmation prompt')
+    .action(async (source, options) => {
+        let bundle;
+        try {
+            bundle = parseConfigSource(source);
+        } catch (err) {
+            console.error(chalk.red(`Failed to parse config: ${err.message}`));
+            process.exit(1);
+        }
+
+        if (!bundle.policies || !bundle.policies.content) {
+            console.error(chalk.red('Invalid config bundle: missing policies'));
+            process.exit(1);
+        }
+
+        const cwd = process.cwd();
+        const policyDest = path.join(cwd, bundle.policies.path || 'delimit.yml');
+
+        // Show what will change
+        console.log(chalk.blue.bold('\nConfig Import Preview\n'));
+        console.log(`  Project: ${chalk.bold(bundle.project || 'unknown')}`);
+        console.log(`  Created: ${bundle.created_at || 'unknown'}`);
+        console.log(`  Policy file: ${chalk.bold(policyDest)}`);
+        if (options.action && bundle.workflow) {
+            console.log(`  Workflow: ${chalk.bold(path.join(cwd, bundle.workflow.path))}`);
+        }
+
+        // Show diff if policy file already exists
+        if (fs.existsSync(policyDest)) {
+            const existing = fs.readFileSync(policyDest, 'utf-8');
+            if (existing === bundle.policies.content) {
+                console.log(chalk.yellow('\n  No changes -- imported config matches current config.'));
+                return;
+            }
+            console.log(chalk.yellow('\n  Policy file already exists and will be overwritten.'));
+        }
+
+        console.log('');
+
+        if (!options.yes) {
+            const { confirm } = await inquirer.prompt([{
+                type: 'confirm',
+                name: 'confirm',
+                message: 'Apply this config?',
+                default: false,
+            }]);
+            if (!confirm) {
+                console.log(chalk.red('Import cancelled'));
+                return;
+            }
+        }
+
+        // Write policy file
+        const policyDir = path.dirname(policyDest);
+        fs.mkdirSync(policyDir, { recursive: true });
+        fs.writeFileSync(policyDest, bundle.policies.content);
+        console.log(chalk.green(`  Created ${policyDest}`));
+
+        // Optionally write workflow
+        if (options.action && bundle.workflow && bundle.workflow.content) {
+            const workflowDest = path.join(cwd, bundle.workflow.path);
+            const wfDir = path.dirname(workflowDest);
+            fs.mkdirSync(wfDir, { recursive: true });
+            fs.writeFileSync(workflowDest, bundle.workflow.content);
+            console.log(chalk.green(`  Created ${workflowDest}`));
+        }
+
+        console.log(chalk.green('\nConfig imported successfully.'));
+    });
+
 // Version subcommand alias (users type 'delimit version' not 'delimit -V')
 program
     .command('version')

package/bin/delimit-setup.js

@@ -54,7 +54,7 @@ async function main() {
     log(blue('  / / / / __/ / /    / // /|_/ // /  / /   '));
     log(blue(' / /_/ / /___/ /____/ // /  / // /  / /    '));
     log(blue('/_____/_____/_____/___/_/  /_/___/ /_/     '));
-    log(dim('  One workspace for every AI coding assistant'));
+    log(dim('  Unify all AI coding assistants'));
     log('');
 
     // Step 1: Check prerequisites
@@ -567,8 +567,56 @@ echo "[Delimit] ${toolName} not found" >&2; exit 127
     }
     log('');
 
-    // Step 7: Local dashboard API server
-    step(7, 'Local dashboard API...');
+    // Step 7: Install cross-model governance hooks (LED-202)
+    step(7, 'Installing AI assistant hooks...');
+
+    try {
+        const crossModelHooks = require('../lib/cross-model-hooks');
+        const hookConfig = crossModelHooks.loadHookConfig();
+        const detected = crossModelHooks.detectAITools();
+
+        if (detected.length === 0) {
+            log(`  ${dim('  No AI assistants detected -- hooks will be installed when tools are found')}`);
+        } else {
+            log(`  ${dim('  Detected: ' + detected.map(t => t.name).join(', '))}`);
+
+            // Install hooks (auto-accept in non-interactive or prompt if TTY)
+            let installHooks = true;
+            const inq = (() => { try { return require('inquirer'); } catch { return null; } })();
+            if (inq && process.stdin.isTTY) {
+                try {
+                    const answer = await inq.prompt([{
+                        type: 'confirm',
+                        name: 'install',
+                        message: `Install governance hooks for ${detected.map(t => t.name).join(', ')}?`,
+                        default: true,
+                    }]);
+                    installHooks = answer.install;
+                } catch {
+                    installHooks = true;
+                }
+            }
+
+            if (installHooks) {
+                for (const tool of detected) {
+                    const result = crossModelHooks.installHooksForTool(tool, hookConfig);
+                    if (result.changes.length > 0) {
+                        log(`  ${green('✓')} ${tool.name}: ${result.changes.join(', ')}`);
+                    } else {
+                        log(`  ${dim('  ' + tool.name + ': hooks already installed')}`);
+                    }
+                }
+            } else {
+                log(`  ${dim('  Skipped. Install later: delimit hook install')}`);
+            }
+        }
+    } catch (e) {
+        log(`  ${dim('  Hook installation skipped: ' + e.message)}`);
+    }
+    log('');
+
+    // Step 8: Local dashboard API server
+    step(8, 'Local dashboard API...');
 
     const localServerPath = path.join(DELIMIT_HOME, 'server', 'ai', 'local_server.py');
     if (fs.existsSync(localServerPath)) {
@@ -580,8 +628,8 @@ echo "[Delimit] ${toolName} not found" >&2; exit 127
     }
     log('');
 
-    // Step 8: Post-install config validation (LED-098)
-    step(8, 'Validating config integrity...');
+    // Step 9: Post-install config validation (LED-098)
+    step(9, 'Validating config integrity...');
 
     let validationIssues = 0;
     const configFiles = [
@@ -670,7 +718,7 @@ echo "[Delimit] ${toolName} not found" >&2; exit 127
     log('');
 
     // Step 9: Done
-    step(9, 'Done!');
+    step(10, 'Done!');
     log('');
     log(`  ${green('Delimit is installed.')} Your AI now has persistent memory and governance.`);
     log('');
@@ -707,7 +755,7 @@ function getDelimitSection() {
     return `<!-- delimit:start v${version} -->
 # Delimit
 
-One workspace for every AI coding assistant.
+Unify all AI coding assistants with persistent context, governance, and multi-model debate.
 
 ## On every session start:
 1. Call \`delimit_ledger_context\` to check for open tasks
@@ -756,7 +804,7 @@ Add breaking change detection to any repo:
 
 ## Links
 - Docs: https://delimit.ai/docs
-- GitHub: https://github.com/delimit-ai/delimit
+- GitHub: https://github.com/delimit-ai/delimit-mcp-server
 - Action: https://github.com/marketplace/actions/delimit-api-governance
 <!-- delimit:end -->`;
 }