delimit-cli 4.1.25 → 4.1.27

package/bin/delimit-cli.js

@@ -2560,6 +2560,183 @@ program
         }
     });
 
+// PR review command — review any GitHub PR for breaking API changes
+program
+    .command('pr <url>')
+    .description('Review a GitHub PR for breaking API changes')
+    .action(async (url) => {
+        console.log(chalk.bold('\n  Delimit PR Review\n'));
+
+        // Parse GitHub PR URL: owner/repo#number or full URL
+        let owner, repo, prNumber;
+        const urlMatch = url.match(/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/);
+        const shortMatch = url.match(/^([^/]+)\/([^#]+)#(\d+)$/);
+        if (urlMatch) {
+            [, owner, repo, prNumber] = urlMatch;
+        } else if (shortMatch) {
+            [, owner, repo, prNumber] = shortMatch;
+        } else if (/^\d+$/.test(url)) {
+            // Just a number — try current repo
+            try {
+                const remote = execSync('git remote get-url origin 2>/dev/null', { encoding: 'utf-8' }).trim();
+                const remoteMatch = remote.match(/github\.com[:/]([^/]+)\/([^/.]+)/);
+                if (remoteMatch) {
+                    [, owner, repo] = remoteMatch;
+                    prNumber = url;
+                }
+            } catch {}
+        }
+
+        if (!owner || !repo || !prNumber) {
+            console.log(chalk.red('  Could not parse PR URL.'));
+            console.log(chalk.gray('  Usage: npx delimit-cli pr owner/repo#123'));
+            console.log(chalk.gray('         npx delimit-cli pr https://github.com/owner/repo/pull/123'));
+            console.log(chalk.gray('         npx delimit-cli pr 123  (in a git repo)\n'));
+            return;
+        }
+
+        console.log(chalk.gray(`  Reviewing ${owner}/${repo}#${prNumber}...\n`));
+
+        // Get PR changed files
+        try {
+            const filesJson = execSync(
+                `gh api repos/${owner}/${repo}/pulls/${prNumber}/files --paginate 2>/dev/null`,
+                { encoding: 'utf-8', timeout: 15000 }
+            );
+            const files = JSON.parse(filesJson);
+            const specPatterns = ['openapi', 'swagger', 'api-spec', 'api_spec'];
+            const specExts = ['.yaml', '.yml', '.json'];
+            const specFiles = files.filter(f => {
+                const name = f.filename.toLowerCase();
+                return specExts.some(ext => name.endsWith(ext)) &&
+                       specPatterns.some(p => name.includes(p));
+            });
+
+            if (specFiles.length === 0) {
+                console.log(chalk.gray('  No OpenAPI/Swagger spec changes found in this PR.'));
+                console.log(chalk.gray('  Delimit reviews PRs that modify API spec files.\n'));
+                // Show what files were changed
+                const apiFiles = files.filter(f => f.filename.includes('api') || f.filename.includes('spec'));
+                if (apiFiles.length > 0) {
+                    console.log(chalk.gray('  API-related files changed:'));
+                    apiFiles.slice(0, 5).forEach(f => console.log(chalk.gray(`    ${f.filename} (+${f.additions}/-${f.deletions})`)));
+                    console.log('');
+                }
+                return;
+            }
+
+            console.log(`  ${chalk.green('✓')} Found ${specFiles.length} spec file(s) changed:\n`);
+            specFiles.forEach(f => {
+                console.log(`    ${chalk.cyan(f.filename)} (+${f.additions}/-${f.deletions})`);
+            });
+            console.log('');
+
+            // Fetch base and head versions of the first spec
+            const specFile = specFiles[0];
+            const tmpDir = path.join(os.tmpdir(), `delimit-pr-${Date.now()}`);
+            fs.mkdirSync(tmpDir, { recursive: true });
+
+            // Get PR details for base/head refs
+            const prJson = execSync(
+                `gh api repos/${owner}/${repo}/pulls/${prNumber} 2>/dev/null`,
+                { encoding: 'utf-8', timeout: 10000 }
+            );
+            const pr = JSON.parse(prJson);
+            const baseSha = pr.base.sha;
+            const headSha = pr.head.sha;
+
+            // Fetch both versions
+            const basePath = path.join(tmpDir, 'base.yaml');
+            const headPath = path.join(tmpDir, 'head.yaml');
+
+            try {
+                const baseContent = execSync(
+                    `gh api repos/${owner}/${repo}/contents/${specFile.filename}?ref=${baseSha} -q '.content' 2>/dev/null`,
+                    { encoding: 'utf-8', timeout: 10000 }
+                );
+                fs.writeFileSync(basePath, Buffer.from(baseContent.trim(), 'base64').toString());
+            } catch {
+                console.log(chalk.yellow('  New spec file (no base version). Cannot diff.\n'));
+                fs.rmSync(tmpDir, { recursive: true, force: true });
+                return;
+            }
+
+            try {
+                const headContent = execSync(
+                    `gh api repos/${owner}/${repo}/contents/${specFile.filename}?ref=${headSha} -q '.content' 2>/dev/null`,
+                    { encoding: 'utf-8', timeout: 10000 }
+                );
+                fs.writeFileSync(headPath, Buffer.from(headContent.trim(), 'base64').toString());
+            } catch {
+                console.log(chalk.red('  Could not fetch head version of spec.\n'));
+                fs.rmSync(tmpDir, { recursive: true, force: true });
+                return;
+            }
+
+            // Run lint
+            console.log(chalk.gray('  Running governance pipeline...\n'));
+            const bundledGateway = path.join(__dirname, '..', 'gateway');
+            const serverDir = (continuityContext.serverDir && fs.existsSync(continuityContext.serverDir))
+                ? continuityContext.serverDir
+                : fs.existsSync(bundledGateway) ? bundledGateway : null;
+
+            if (!serverDir) {
+                console.log(chalk.yellow('  Gateway not available. Run: npx delimit-cli setup\n'));
+                fs.rmSync(tmpDir, { recursive: true, force: true });
+                return;
+            }
+
+            try {
+                const result = execSync(
+                    `python3 -c "
+import sys,json,yaml
+sys.path.insert(0,'${serverDir}')
+from core.diff_engine_v2 import OpenAPIDiffEngine
+old=yaml.safe_load(open('${basePath}'))
+new=yaml.safe_load(open('${headPath}'))
+engine=OpenAPIDiffEngine()
+changes=engine.compare(old,new)
+print(json.dumps({'changes':[{'type':c.type.value if hasattr(c.type,'value') else str(c.type),'path':c.path,'breaking':c.severity in ('high','critical','error'),'detail':c.message or c.details or ''} for c in changes]}))
+"`,
+                    { encoding: 'utf-8', timeout: 15000, cwd: serverDir }
+                );
+                const diff = JSON.parse(result);
+                const breaking = (diff.changes || []).filter(c => c.breaking);
+                const nonBreaking = (diff.changes || []).filter(c => !c.breaking);
+
+                if (breaking.length > 0) {
+                    console.log(chalk.red.bold(`  ${breaking.length} BREAKING change(s) detected\n`));
+                    breaking.forEach(c => {
+                        console.log(`  ${chalk.red('BREAK')} ${c.type}: ${c.path || ''}`);
+                        if (c.detail) console.log(chalk.gray(`        ${c.detail}`));
+                    });
+                } else {
+                    console.log(chalk.green.bold('  No breaking changes detected'));
+                }
+
+                if (nonBreaking.length > 0) {
+                    console.log(chalk.gray(`\n  ${nonBreaking.length} non-breaking change(s)`));
+                }
+
+                // Semver classification
+                const bump = breaking.length > 0 ? 'MAJOR' : nonBreaking.length > 0 ? 'MINOR' : 'NONE';
+                console.log(`\n  Semver: ${chalk.bold(bump)}`);
+                console.log(`  Total: ${(diff.changes || []).length} changes (${breaking.length} breaking, ${nonBreaking.length} compatible)\n`);
+
+                console.log(chalk.bold('  Add to your repo:'));
+                console.log(chalk.green(`    npx delimit-cli init`));
+                console.log(chalk.gray('    Catches this on every PR automatically.\n'));
+            } catch (e) {
+                console.log(chalk.red(`  Diff failed: ${e.message.split('\n')[0]}\n`));
+            }
+
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        } catch (e) {
+            console.log(chalk.red(`  Error: ${e.message.split('\n')[0]}`));
+            console.log(chalk.gray('  Make sure gh CLI is authenticated: gh auth login\n'));
+        }
+    });
+
 // Try command — zero-risk demo with Markdown report artifact (LED-264)
 program
     .command('try')
@@ -3133,23 +3310,56 @@ program
             process.exit(1);
         }
 
+        console.log(chalk.gray('  Validating license key...'));
+
+        // Validate against Lemon Squeezy API
+        let validated = false;
+        let licenseId = null;
+        let customerEmail = '';
+        try {
+            const resp = await axios.post('https://api.lemonsqueezy.com/v1/licenses/validate', {
+                license_key: key,
+            }, {
+                headers: { 'Accept': 'application/json' },
+                timeout: 10000,
+            });
+            if (resp.data && resp.data.valid) {
+                validated = true;
+                licenseId = resp.data.license_key?.id;
+                customerEmail = resp.data.meta?.customer_email || '';
+                console.log(chalk.green('  License valid.'));
+            } else {
+                console.log(chalk.red(`  License invalid: ${resp.data?.error || 'unknown error'}`));
+                process.exit(1);
+            }
+        } catch (err) {
+            // If API unreachable, accept locally (grace period)
+            console.log(chalk.yellow('  Could not reach license server. Activating locally (7-day grace).'));
+            validated = true;
+        }
+
         // Write license file
         const crypto = require('crypto');
         const machineHash = crypto.createHash('sha256').update(os.homedir()).digest('hex').slice(0, 16);
         const licenseData = {
             key: key,
             tier: 'pro',
-            valid: true,
+            valid: validated,
+            license_id: licenseId,
+            customer_email: customerEmail,
             activated_at: Date.now() / 1000,
             machine_hash: machineHash,
+            validated_at: Date.now() / 1000,
         };
 
         if (!fs.existsSync(licenseDir)) {
             fs.mkdirSync(licenseDir, { recursive: true });
         }
         fs.writeFileSync(licensePath, JSON.stringify(licenseData, null, 2));
-        console.log(chalk.green('License activated successfully.'));
-        console.log(chalk.dim('Tier: pro'));
+        console.log(chalk.green('\n  License activated successfully.'));
+        console.log(chalk.dim(`  Tier: pro`));
+        if (customerEmail) console.log(chalk.dim(`  Email: ${customerEmail}`));
+        console.log('');
     });
 
 // ---------------------------------------------------------------------------

package/gateway/ai/server.py

@@ -5756,16 +5756,108 @@ def delimit_quickstart(project_path: str = ".") -> Dict[str, Any]:
         "models": enabled_models,
     })
 
+    # Step 6: First Governance Run -- show value with bundled example specs
+    demo_result: Dict[str, Any] = {"skipped": False}
+    examples_dir = Path(__file__).resolve().parent.parent / "examples"
+    petstore_v1 = examples_dir / "petstore-v1.yaml"
+    petstore_v2 = examples_dir / "petstore-v2.yaml"
+    if petstore_v1.is_file() and petstore_v2.is_file():
+        from backends.gateway_core import run_lint as _qs_run_lint, run_spec_health as _qs_run_spec_health
+
+        # 6a: Lint petstore v1 vs v2 to show breaking change detection
+        try:
+            lint_demo = _qs_run_lint(
+                old_spec=str(petstore_v1),
+                new_spec=str(petstore_v2),
+            )
+            breaking_count = len(lint_demo.get("breaking", lint_demo.get("violations", [])))
+            total_changes = lint_demo.get("total_changes", 0)
+            demo_result["lint"] = {
+                "breaking_changes": breaking_count,
+                "total_changes": total_changes,
+                "status": lint_demo.get("status", "unknown"),
+                "sample_violations": [
+                    v.get("message", v.get("type", "unknown"))
+                    for v in lint_demo.get("breaking", lint_demo.get("violations", []))[:3]
+                ],
+            }
+        except Exception as e:
+            demo_result["lint"] = {"error": str(e)}
+
+        # 6b: Spec health score on petstore v1
+        try:
+            health_demo = _qs_run_spec_health(spec_path=str(petstore_v1))
+            demo_result["spec_health"] = {
+                "score": health_demo.get("score", health_demo.get("overall_score")),
+                "grade": health_demo.get("grade", health_demo.get("letter_grade")),
+                "dimensions": {
+                    k: v for k, v in health_demo.get("dimensions", {}).items()
+                } if health_demo.get("dimensions") else {},
+                "recommendations_count": len(health_demo.get("recommendations", [])),
+            }
+        except Exception as e:
+            demo_result["spec_health"] = {"error": str(e)}
+    else:
+        demo_result["skipped"] = True
+        demo_result["reason"] = "Example specs not found"
+
+    steps_completed.append({
+        "step": 6,
+        "name": "First Governance Run (Demo)",
+        "result": demo_result,
+    })
+
+    # Step 7: Project Spec Discovery -- check if this project has OpenAPI specs
+    project_specs: List[str] = []
+    project_lint_result: Optional[Dict[str, Any]] = None
+    spec_patterns = [
+        "**/openapi.yaml", "**/openapi.yml", "**/openapi.json",
+        "**/swagger.yaml", "**/swagger.yml", "**/swagger.json",
+    ]
+    for pattern in spec_patterns:
+        for match in p.glob(pattern):
+            rel = str(match.relative_to(p))
+            if "node_modules" not in rel and ".next" not in rel and "venv" not in rel:
+                project_specs.append(str(match))
+    project_specs = list(set(project_specs))[:5]
+
+    if project_specs:
+        # Run spec_health on the first discovered spec
+        try:
+            from backends.gateway_core import run_spec_health as _qs_health
+            proj_health = _qs_health(spec_path=project_specs[0])
+            project_lint_result = {
+                "spec": project_specs[0],
+                "score": proj_health.get("score", proj_health.get("overall_score")),
+                "grade": proj_health.get("grade", proj_health.get("letter_grade")),
+            }
+        except Exception as e:
+            project_lint_result = {"spec": project_specs[0], "error": str(e)}
+
+    steps_completed.append({
+        "step": 7,
+        "name": "Project Spec Discovery",
+        "specs_found": len(project_specs),
+        "spec_files": project_specs,
+        "health_result": project_lint_result,
+    })
+
     # Build suggested next actions based on findings
     next_actions = []
-    if scan_result.get("findings"):
-        for f in scan_result["findings"]:
-            if f.get("type") == "openapi_specs":
-                next_actions.append("Run `delimit_lint` on your OpenAPI spec to check for breaking changes")
-            if f.get("type") == "security_concerns":
-                next_actions.append("Run `delimit_security_scan` to audit for vulnerabilities")
-            if f.get("type") == "tests_found":
-                next_actions.append("Run `delimit_test_smoke` to verify tests pass")
+    if project_specs:
+        next_actions.append(f"Run `delimit_spec_health` on {project_specs[0]} to see your full quality report")
+        if len(project_specs) > 1:
+            next_actions.append(f"You have {len(project_specs)} OpenAPI specs -- run `delimit_lint` to compare versions")
+        next_actions.append("Add the Delimit GitHub Action to catch breaking changes on every PR")
+    else:
+        if scan_result.get("findings"):
+            for f in scan_result["findings"]:
+                if f.get("type") == "openapi_specs":
+                    next_actions.append("Run `delimit_lint` on your OpenAPI spec to check for breaking changes")
+                if f.get("type") == "security_concerns":
+                    next_actions.append("Run `delimit_security_scan` to audit for vulnerabilities")
+                if f.get("type") == "tests_found":
+                    next_actions.append("Run `delimit_test_smoke` to verify tests pass")
 
     if not deliberation_ready:
         next_actions.append("Add more AI models for multi-model deliberation: say 'configure delimit models'")
@@ -5773,16 +5865,54 @@ def delimit_quickstart(project_path: str = ".") -> Dict[str, Any]:
     next_actions.append("Say 'add to ledger: [task]' to start tracking work across sessions")
     next_actions.append("Say 'deliberate [question]' to get AI consensus on a decision")
 
+    # Build the "wow moment" summary
+    wow_moment: Dict[str, Any] = {}
+    lint_data = demo_result.get("lint", {})
+    health_data = demo_result.get("spec_health", {})
+    if lint_data and not lint_data.get("error"):
+        wow_moment["breaking_changes_caught"] = lint_data.get("breaking_changes", 0)
+        wow_moment["total_api_changes"] = lint_data.get("total_changes", 0)
+        wow_moment["sample_catches"] = lint_data.get("sample_violations", [])
+    if health_data and not health_data.get("error"):
+        wow_moment["spec_health_grade"] = health_data.get("grade")
+        wow_moment["spec_health_score"] = health_data.get("score")
+    wow_moment["governance_gates"] = [
+        "Breaking change detection (CI/CD)",
+        "Spec health scoring (quality)",
+        "Policy enforcement (custom rules)",
+        "Semver classification (automated)",
+        "Contract ledger (audit trail)",
+    ]
+    if project_specs:
+        wow_moment["your_project"] = {
+            "specs_found": len(project_specs),
+            "ready_to_govern": True,
+        }
+        if project_lint_result and not project_lint_result.get("error"):
+            wow_moment["your_project"]["health_grade"] = project_lint_result.get("grade")
+            wow_moment["your_project"]["health_score"] = project_lint_result.get("score")
+
+    bc = wow_moment.get("breaking_changes_caught", 0)
+    grade = wow_moment.get("spec_health_grade", "N/A")
+    msg_parts = [
+        f"Quickstart complete! {len(steps_completed)} steps run.",
+        f"Demo: {bc} breaking changes caught, spec health grade: {grade}.",
+        f"5 governance gates ready.",
+    ]
+    if project_specs:
+        msg_parts.append(f"Found {len(project_specs)} OpenAPI spec(s) in your project -- ready to govern.")
+
     return _with_next_steps("quickstart", {
         "tool": "quickstart",
         "status": "complete",
         "project": str(p),
         "steps": steps_completed,
+        "wow_moment": wow_moment,
         "environment": environment,
         "scan_findings": scan_result.get("findings", []),
         "scan_suggestions": scan_result.get("suggestions", []),
         "next_actions": next_actions,
-        "message": f"Quickstart complete! {len(steps_completed)} steps run. {len(next_actions)} suggested next actions.",
+        "message": " ".join(msg_parts),
     })
 
 
@@ -6817,7 +6947,7 @@ def delimit_build_loop(action: str = "run", session_id: str = "") -> Dict[str, A
     """Execute the governed continuous build loop (LED-239).
 
     Requirements:
-    - root ledger in ~/.delimit is authoritative
+    - root ledger in /root/.delimit is authoritative
     - select only build-safe open items
     - resolve venture + repo before dispatch
     - use Delimit swarm/governance as control plane

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "delimit-cli",
   "mcpName": "io.github.delimit-ai/delimit-mcp-server",
-  "version": "4.1.25",
+  "version": "4.1.27",
   "description": "Unify Claude Code, Codex, Cursor, and Gemini CLI with persistent context, governance, and multi-model debate.",
   "main": "index.js",
   "files": [