devflow-kit 1.8.3 → 2.0.1

package/dist/cli/commands/rules.js

@@ -0,0 +1,334 @@
+import { Command } from 'commander';
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import * as p from '@clack/prompts';
+import color from 'picocolors';
+import { getClaudeDirectory, getDevFlowDirectory } from '../../targets/claude-code/claude-paths.js';
+import { DEVFLOW_PLUGINS, buildRulesMap, getAllRuleNames, FEATURE_OWNED_RULES } from '../../core/plugins.js';
+import { readManifest, writeManifest } from '../../core/manifest.js';
+import { rulesDir } from '../../core/assets.js';
+import { installAllRules, validateRuleShadow } from '../../targets/claude-code/installer.js';
+import { convergeFromManifest } from '../../targets/claude-code/compliance-install.js';
+/**
+ * Check whether a rule has a user shadow file at ~/.devflow/rules/{name}.md.
+ */
+export async function hasRuleShadow(ruleName, devflowDir) {
+    const dir = devflowDir ?? getDevFlowDirectory();
+    try {
+        await fs.access(path.join(dir, 'rules', `${ruleName}.md`));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * List all rule shadow names (bare basenames without .md) from ~/.devflow/rules/.
+ * Returns [] when the directory does not exist.
+ */
+export async function listShadowedRules(devflowDir) {
+    const dir = devflowDir ?? getDevFlowDirectory();
+    const shadowsRoot = path.join(dir, 'rules');
+    try {
+        const entries = await fs.readdir(shadowsRoot);
+        return entries
+            .filter(e => e.endsWith('.md'))
+            .map(e => path.basename(e, '.md'));
+    }
+    catch {
+        return [];
+    }
+}
+/** Render the shadow-state tag for a rule — shared by formatRuleRow and printRulesList. Exhaustive switch catches new states at compile time. */
+function buildRuleShadowTag(shadowState) {
+    switch (shadowState) {
+        case 'valid':
+            return ' ' + color.green('shadowed');
+        case 'empty-shadow-file':
+            return ' ' + color.yellow('shadowed — invalid: empty file');
+        case 'not-a-file':
+            return ' ' + color.yellow('shadowed — invalid: not a file');
+        case 'none':
+            return '';
+        default: {
+            const _exhaustive = shadowState;
+            void _exhaustive;
+            return '';
+        }
+    }
+}
+/**
+ * Resolve the short owner label for a rule.
+ * Plugin-owned rules strip the 'devflow-' prefix; feature-owned rules (e.g. compliance)
+ * have no plugin entry — they return 'feature'; unrecognised rules return 'unknown'.
+ */
+function resolveRuleOwner(name, ownerMap) {
+    return ownerMap.get(name)?.replace('devflow-', '') ??
+        (FEATURE_OWNED_RULES.includes(name) ? 'feature' : 'unknown');
+}
+/**
+ * Format a single rule row for display.
+ * Shared by --status (no installed tag) and printRulesList (with installed tag).
+ */
+function formatRuleRow(name, shortOwner, shadowState, installedTag = '') {
+    return `  ${color.cyan(name.padEnd(16))} ${color.dim(shortOwner)}${installedTag}${buildRuleShadowTag(shadowState)}`;
+}
+/**
+ * Build and print the enriched rules list (used by both `rules list` and `rules --list`).
+ */
+async function printRulesList(claudeDir, devflowDir) {
+    const rulesTarget = path.join(claudeDir, 'rules', 'devflow');
+    // Union FEATURE_OWNED_RULES (compliance) so list covers feature-managed rules
+    // that left the plugin registry but still live in src/assets/rules/ (step 1.5).
+    const allRules = [...getAllRuleNames(), ...FEATURE_OWNED_RULES];
+    let installedNames = [];
+    try {
+        const entries = await fs.readdir(rulesTarget);
+        installedNames = entries.filter(f => f.endsWith('.md')).map(f => path.basename(f, '.md'));
+    }
+    catch { /* dir doesn't exist */ }
+    const installedSet = new Set(installedNames);
+    const knownRuleSet = new Set(allRules);
+    const ownerMap = buildRulesMap(DEVFLOW_PLUGINS);
+    // Known rules rows — collect shadow state for the header count
+    const knownResults = await Promise.all(allRules.map(async (name) => {
+        const installedTag = installedSet.has(name) ? color.green(' ✓') : color.dim(' ✗');
+        const shadowFile = path.join(devflowDir, 'rules', `${name}.md`);
+        const shadowState = await validateRuleShadow(shadowFile);
+        const owner = resolveRuleOwner(name, ownerMap);
+        return { row: formatRuleRow(name, owner, shadowState, installedTag), shadowState };
+    }));
+    const rows = knownResults.map(r => r.row);
+    const shadowedCount = knownResults.filter(r => r.shadowState !== 'none').length;
+    // Orphan shadows: in ~/.devflow/rules/ but not a known rule — mirroring skills list behavior
+    const allShadowedNames = await listShadowedRules(devflowDir);
+    for (const name of allShadowedNames) {
+        if (!knownRuleSet.has(name)) {
+            rows.push(`  ${color.yellow(name.padEnd(16))} ${color.yellow('unknown rule')}`);
+        }
+    }
+    p.note(rows.join('\n'), `Rules (${allRules.length} known, ${shadowedCount} shadowed)`);
+}
+/**
+ * Seed a rule shadow file from the installed rule or the built plugin source.
+ * Returns which tier seeded: 'installed' | 'source' | 'none'.
+ * Creates the shadow directory before copying.
+ *
+ * D35 — seedRuleShadow tiers (applies ADR-010):
+ *   Tier 1 — installed rule at rulesTarget/{name}.md (fastest path when rules are enabled).
+ *             SKIPPED for FEATURE_OWNED_RULES: the installed file is already stamped
+ *             (${DEVFLOW_COMPLIANCE_FRAMEWORKS} replaced with label text), so seeding from
+ *             it destroys the placeholder and silently disables framework stamping forever.
+ *   Tier 2 — flat source at src/assets/rules/{name}.md (always used for FEATURE_OWNED_RULES;
+ *             fallback for plugin-owned rules when Tier 1 is absent).
+ *   Tier 3 — 'none': caller emits a manual-create instruction.
+ */
+export async function seedRuleShadow(name, shadowFile, rulesTarget, devflowDir) {
+    await fs.mkdir(path.join(devflowDir, 'rules'), { recursive: true });
+    // Tier 1: seed from installed rule — skipped for FEATURE_OWNED_RULES because the installed
+    // file is already stamped (placeholder replaced), which would permanently disable framework
+    // stamping when the shadow is subsequently applied via convergeComplianceArtifacts.
+    if (!FEATURE_OWNED_RULES.includes(name)) {
+        try {
+            await fs.copyFile(path.join(rulesTarget, `${name}.md`), shadowFile);
+            return 'installed';
+        }
+        catch { /* not present — try flat source */ }
+    }
+    // Tier 2: seed from flat rules source (canonical, with placeholder for templated rules)
+    try {
+        await fs.copyFile(path.join(rulesDir(), `${name}.md`), shadowFile);
+        return 'source';
+    }
+    catch { /* source not found */ }
+    return 'none';
+}
+async function handleRuleShadow(name, allRules, devflowDir, rulesTarget) {
+    if (!name) {
+        p.log.error('Rule name required. Usage: devflow rules shadow <name>');
+        p.log.info(`Available rules: ${allRules.join(', ')}`);
+        process.exit(1);
+    }
+    if (!allRules.includes(name)) {
+        p.log.error(`Unknown rule: ${name}`);
+        p.log.info(`Available rules: ${allRules.join(', ')}`);
+        process.exit(1);
+    }
+    const shadowFile = path.join(devflowDir, 'rules', `${name}.md`);
+    if (await hasRuleShadow(name, devflowDir)) {
+        p.log.info(`${name} is already shadowed at ${color.dim(shadowFile)}`);
+        return;
+    }
+    const tier = await seedRuleShadow(name, shadowFile, rulesTarget, devflowDir);
+    if (tier !== 'none') {
+        p.log.success(`Shadowed ${color.cyan(name)}`);
+        p.log.info(`Edit ${color.dim(shadowFile)} then run devflow rules --enable or devflow init to apply.`);
+    }
+    else {
+        p.log.warn(`Could not seed shadow for ${name} (no installed or source file found)`);
+        p.log.info(`Create ${color.dim(shadowFile)} manually then run devflow rules --enable to apply.`);
+    }
+}
+async function handleRuleUnshadow(name, allRules, devflowDir) {
+    if (!name) {
+        p.log.error('Rule name required. Usage: devflow rules unshadow <name>');
+        process.exit(1);
+    }
+    // Mirror the shadow guard: reject unknown names before building the shadow path
+    if (!allRules.includes(name)) {
+        p.log.error(`Unknown rule: ${name}`);
+        p.log.info(`Available rules: ${allRules.join(', ')}`);
+        process.exit(1);
+    }
+    const shadowFile = path.join(devflowDir, 'rules', `${name}.md`);
+    if (!await hasRuleShadow(name, devflowDir)) {
+        p.log.info(`${name} is not shadowed`);
+        return;
+    }
+    await fs.rm(shadowFile, { force: true });
+    p.log.success(`Unshadowed ${color.cyan(name)}`);
+    p.log.info('Run devflow rules --enable or devflow init to restore Devflow\'s version.');
+}
+/**
+ * Install rules from the manifest plugins and converge compliance artifacts.
+ *
+ * Single production caller: the rules --enable handler (options.enable in the command action).
+ * Extracted as a named export for independent unit testing.
+ *
+ * Compliance convergence runs unconditionally — convergeComplianceArtifacts handles the
+ * disabled case by removing stale artifacts, so no enabled-gate is needed here. Running
+ * converge regardless of the rules-install outcome ensures that a rules-install failure
+ * cannot leave compliance artifacts in a half-converged state (avoids PF-015 violation).
+ *
+ * Applies PF-009: warn-not-throw on per-item compliance convergence failure.
+ */
+export async function runRulesEnable(claudeDir, devflowDir) {
+    const rulesTarget = path.join(claudeDir, 'rules', 'devflow');
+    const manifest = await readManifest(devflowDir);
+    if (!manifest) {
+        p.log.error('No manifest found. Run devflow init first.');
+        process.exit(1);
+    }
+    const installedPlugins = DEVFLOW_PLUGINS.filter(pl => manifest.plugins.includes(pl.name));
+    const rulesMap = buildRulesMap(installedPlugins);
+    // Wipe stale rules from previously uninstalled plugins before re-installing.
+    await fs.rm(rulesTarget, { recursive: true, force: true });
+    await fs.mkdir(rulesTarget, { recursive: true });
+    let outcomes = [];
+    let installFailed = false;
+    try {
+        outcomes = await installAllRules(rulesMap, devflowDir, rulesTarget);
+    }
+    catch (err) {
+        p.log.error(`Rules installation failed — rules directory has been cleared: ${err instanceof Error ? err.message : String(err)}`);
+        installFailed = true;
+    }
+    if (!installFailed) {
+        const shadowedCount = outcomes.filter(o => o.outcome === 'shadow').length;
+        const shadowSuffix = shadowedCount > 0 ? ` (${shadowedCount} shadowed)` : '';
+        for (const { ruleName, outcome } of outcomes) {
+            if (outcome === 'source-invalid-shadow:empty-shadow-file' ||
+                outcome === 'source-invalid-shadow:not-a-file') {
+                p.log.warn(`Shadow for rule:${ruleName} is invalid — Devflow's version was installed`);
+            }
+        }
+        manifest.features.rules = true;
+        manifest.updatedAt = new Date().toISOString();
+        await writeManifest(devflowDir, manifest);
+        p.log.success(`Installed ${rulesMap.size} rule(s) to ${color.dim(rulesTarget)}${shadowSuffix}`);
+    }
+    // Converge compliance artifacts unconditionally — convergeFromManifest handles the
+    // disabled case itself (removes stale artifacts). Running this regardless of installFailed
+    // prevents a rules-install failure from leaving the compliance rule in a stale state.
+    // rulesEnabledOverride reflects the actual settled state: false when install failed so the
+    // compliance rule is not installed into a wiped, rules-disabled directory (avoids PF-015).
+    try {
+        await convergeFromManifest({
+            claudeDir,
+            devflowDir,
+            manifest,
+            warn: (msg) => p.log.warn(msg),
+            rulesEnabledOverride: !installFailed,
+        });
+    }
+    catch (err) {
+        // PF-009: warn-not-abort — compliance convergence failure does not undo rules install
+        p.log.warn(`Compliance rule convergence failed — rules installed but compliance rule may be stale: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+export const rulesCommand = new Command('rules')
+    .description('Manage Devflow rules')
+    .argument('[action]', 'Action: shadow, unshadow, or list')
+    .argument('[name]', 'Rule name (required for shadow/unshadow)')
+    .option('--enable', 'Enable rules (install from manifest plugins)')
+    .option('--disable', 'Disable rules (remove rules directory)')
+    .option('--status', 'Show installed rules with source and shadow status')
+    .option('--list', 'List all available rules with install status and shadow state')
+    .action(async (action, name, options) => {
+    const claudeDir = getClaudeDirectory();
+    const devflowDir = getDevFlowDirectory();
+    const rulesTarget = path.join(claudeDir, 'rules', 'devflow');
+    // Positional actions dispatch first — flags are not checked when action is given
+    if (action) {
+        // Union FEATURE_OWNED_RULES (compliance) so shadow/unshadow/list cover feature-managed
+        // rules that left the plugin registry but still live in src/assets/rules/ (step 1.5).
+        const allRules = [...getAllRuleNames(), ...FEATURE_OWNED_RULES];
+        if (action === 'shadow') {
+            await handleRuleShadow(name, allRules, devflowDir, rulesTarget);
+        }
+        else if (action === 'unshadow') {
+            await handleRuleUnshadow(name, allRules, devflowDir);
+        }
+        else if (action === 'list') {
+            await printRulesList(claudeDir, devflowDir);
+        }
+        else {
+            p.log.error(`Unknown action: ${action}`);
+            p.log.info('Usage: devflow rules <shadow|unshadow|list> [name]');
+            process.exit(1);
+        }
+        return;
+    }
+    // No positional action — fall through to flag-based handling
+    if (options.enable) {
+        await runRulesEnable(claudeDir, devflowDir);
+    }
+    else if (options.disable) {
+        await fs.rm(rulesTarget, { recursive: true, force: true });
+        const manifest = await readManifest(devflowDir);
+        if (manifest) {
+            manifest.features.rules = false;
+            manifest.updatedAt = new Date().toISOString();
+            await writeManifest(devflowDir, manifest);
+        }
+        p.log.success('Rules disabled — removed rules directory');
+    }
+    else if (options.status) {
+        let installedFiles = [];
+        try {
+            const entries = await fs.readdir(rulesTarget);
+            installedFiles = entries.filter(f => f.endsWith('.md'));
+        }
+        catch { /* dir doesn't exist */ }
+        if (installedFiles.length === 0) {
+            p.log.info('No rules installed. Run devflow rules --enable to install.');
+            return;
+        }
+        const ownerMap = buildRulesMap(DEVFLOW_PLUGINS);
+        const lines = await Promise.all(installedFiles.map(async (file) => {
+            const n = path.basename(file, '.md');
+            const shortOwner = resolveRuleOwner(n, ownerMap);
+            const shadowFile = path.join(devflowDir, 'rules', `${n}.md`);
+            const shadowState = await validateRuleShadow(shadowFile);
+            return formatRuleRow(n, shortOwner, shadowState);
+        }));
+        p.note(lines.join('\n'), `Installed rules (${installedFiles.length})`);
+    }
+    else if (options.list) {
+        await printRulesList(claudeDir, devflowDir);
+    }
+    else {
+        p.log.info('Usage: devflow rules <shadow|unshadow|list> | --enable | --disable | --status | --list');
+    }
+});
+//# sourceMappingURL=rules.js.map

package/dist/cli/commands/safe-delete.js

@@ -0,0 +1,140 @@
+import { Command } from 'commander';
+import * as p from '@clack/prompts';
+import color from 'picocolors';
+import { detectPlatform, detectShell, getProfilePath, getSafeDeleteInfo, hasSafeDelete, } from '../../core/safe-delete.js';
+import { generateSafeDeleteBlock, installToProfile, removeFromProfile, getInstalledVersion, SAFE_DELETE_BLOCK_VERSION, } from '../../core/safe-delete-install.js';
+/**
+ * Determine the current safe-delete install status and resolved profile path.
+ * Returns { status, profilePath } — profilePath may be null on unsupported platforms.
+ *
+ * Wrapped in try/catch so callers never crash regardless of environment.
+ */
+export async function getSafeDeleteStatus() {
+    try {
+        const shell = detectShell();
+        const profilePath = getProfilePath(shell);
+        if (shell === 'unknown' || profilePath === null) {
+            return { status: 'unknown', profilePath: null };
+        }
+        const version = await getInstalledVersion(profilePath);
+        if (version === 0) {
+            return { status: 'absent', profilePath };
+        }
+        if (version < SAFE_DELETE_BLOCK_VERSION) {
+            return { status: 'outdated', profilePath };
+        }
+        return { status: 'installed', profilePath };
+    }
+    catch {
+        return { status: 'unknown', profilePath: null };
+    }
+}
+export const safeDeleteCommand = new Command('safe-delete')
+    .description('Enable or disable the safe-delete shell function (routes rm → trash)')
+    .option('--enable', 'Install safe-delete shell function')
+    .option('--disable', 'Remove safe-delete shell function')
+    .option('--status', 'Show current safe-delete state')
+    .action(async (options) => {
+    const hasFlag = options.enable || options.disable || options.status;
+    if (!hasFlag) {
+        // No flag → show usage (matches ambient/memory/hud/decisions pattern)
+        p.note(`${color.cyan('devflow safe-delete --enable')}   Install safe-delete shell function\n` +
+            `${color.cyan('devflow safe-delete --disable')}  Remove safe-delete shell function\n` +
+            `${color.cyan('devflow safe-delete --status')}   Show current safe-delete state`, 'Usage');
+        return;
+    }
+    if (options.status) {
+        // --status → tri-state report
+        const { status, profilePath } = await getSafeDeleteStatus();
+        let statusLabel;
+        switch (status) {
+            case 'installed':
+                statusLabel = color.green('installed');
+                break;
+            case 'outdated':
+                statusLabel = color.yellow('outdated (upgrade available)');
+                break;
+            case 'absent':
+                statusLabel = color.dim('absent');
+                break;
+            case 'unknown':
+                statusLabel = color.dim('unknown');
+                break;
+            default: {
+                const _exhaustive = status;
+                statusLabel = color.dim(_exhaustive);
+            }
+        }
+        p.log.info(`Safe-delete: ${statusLabel}`);
+        if (profilePath) {
+            p.log.info(`Profile: ${color.dim(profilePath)}`);
+        }
+        else {
+            p.log.info(`Profile: ${color.dim('unknown (unsupported platform or $SHELL not set)')}`);
+        }
+        if (status === 'outdated') {
+            p.log.info(color.dim('Run devflow safe-delete --enable to upgrade to the current version'));
+        }
+        return;
+    }
+    if (options.enable) {
+        const platform = detectPlatform();
+        const shell = detectShell();
+        const profilePath = getProfilePath(shell);
+        if (shell === 'unknown' || profilePath === null) {
+            p.log.warn('Cannot determine shell profile path — $SHELL not set or platform not supported');
+            p.log.info(color.dim('Set $SHELL and retry, or add the safe-delete function manually'));
+            return;
+        }
+        // Check trash CLI availability (Windows always has Recycle Bin)
+        if (platform !== 'windows' && !hasSafeDelete(platform)) {
+            const info = getSafeDeleteInfo(platform);
+            p.log.warn(`safe-delete requires a trash CLI — not found`);
+            p.log.info(color.dim(`Install with: ${info.installHint ?? 'see your package manager'}`));
+            p.log.info(color.dim('Then retry: devflow safe-delete --enable'));
+            return;
+        }
+        const info = getSafeDeleteInfo(platform);
+        const block = generateSafeDeleteBlock(shell, process.platform, info.command);
+        if (!block) {
+            p.log.warn(`Shell '${shell}' is not supported for safe-delete`);
+            return;
+        }
+        // Upgrade-in-place if an outdated block exists; idempotent if already current
+        const installedVersion = await getInstalledVersion(profilePath);
+        if (installedVersion === SAFE_DELETE_BLOCK_VERSION) {
+            p.log.info('Safe-delete already installed at the current version — no change');
+            return;
+        }
+        if (installedVersion > 0) {
+            // Outdated block — remove then reinstall (upgrade in place, no duplicate)
+            await removeFromProfile(profilePath);
+            await installToProfile(profilePath, block);
+            p.log.success(`Safe-delete upgraded to v${SAFE_DELETE_BLOCK_VERSION} in ${color.dim(profilePath)}`);
+        }
+        else {
+            // Not installed — append
+            await installToProfile(profilePath, block);
+            p.log.success(`Safe-delete installed in ${color.dim(profilePath)}`);
+        }
+        p.log.info(color.dim('Restart your shell or run: source ' + profilePath));
+        return;
+    }
+    if (options.disable) {
+        const shell = detectShell();
+        const profilePath = getProfilePath(shell);
+        if (shell === 'unknown' || profilePath === null) {
+            p.log.warn('Cannot determine shell profile path — $SHELL not set or platform not supported');
+            return;
+        }
+        const removed = await removeFromProfile(profilePath);
+        if (removed) {
+            p.log.success(`Safe-delete removed from ${color.dim(profilePath)}`);
+        }
+        else {
+            p.log.info('Safe-delete is not installed — nothing to remove');
+        }
+        return;
+    }
+});
+//# sourceMappingURL=safe-delete.js.map

package/dist/cli/commands/security.js

@@ -0,0 +1,179 @@
+import { Command } from 'commander';
+import * as path from 'path';
+import * as p from '@clack/prompts';
+import color from 'picocolors';
+import { getClaudeDirectory, getDevFlowDirectory, getManagedSettingsPath } from '../../targets/claude-code/claude-paths.js';
+import { readManifest, syncManifestFeature } from '../../core/manifest.js';
+import { mergeDenyList, stripUserDenyList, detectDenyState, DEVFLOW_HISTORICAL_DENY, removeManagedSettings, installManagedSettings, loadTemplateDenyEntries, stripUserSecurityDenyList, } from '../../targets/claude-code/post-install.js';
+import { writeFileAtomicExclusive } from '../../core/fs-atomic.js';
+import { promises as fs } from 'fs';
+import { getPackageRoot } from '../../core/paths.js';
+// ─── Pure helpers ─────────────────────────────────────────────────────────────
+/**
+ * Count deny entries in a parsed settings JSON string.
+ * Returns 0 on parse error or when no deny array is present.
+ */
+export function countDenyEntries(settingsJson) {
+    try {
+        const obj = JSON.parse(settingsJson);
+        const rawDeny = obj.permissions?.deny;
+        return Array.isArray(rawDeny) ? rawDeny.length : 0;
+    }
+    catch {
+        return 0;
+    }
+}
+// ─── Command ──────────────────────────────────────────────────────────────────
+export const securityCommand = new Command('security')
+    .description('Manage the security deny list (permissions.deny in Claude Code settings)')
+    .option('--status', 'Show current deny list state and entry counts')
+    .option('--enable', 'Install the deny list (use --managed or --user to select location)')
+    .option('--managed', 'Target system-level managed settings (requires sudo on some platforms)')
+    .option('--user', 'Target ~/.claude/settings.json (default)')
+    .option('--disable', 'Remove the deny list from all locations')
+    .addHelpText('after', '\nExamples:\n  $ devflow security --status\n  $ devflow security --enable\n  $ devflow security --enable --managed\n  $ devflow security --disable')
+    .action(async (options) => {
+    const claudeDir = getClaudeDirectory();
+    const devflowDir = getDevFlowDirectory();
+    const userSettingsPath = path.join(claudeDir, 'settings.json');
+    const rootDir = getPackageRoot();
+    // ── Load current state ──────────────────────────────────────────────────
+    let userSettingsJson = null;
+    try {
+        userSettingsJson = await fs.readFile(userSettingsPath, 'utf-8');
+    }
+    catch { /* absent */ }
+    let managedPath = null;
+    let managedExists = false;
+    let managedContentJson = null;
+    try {
+        managedPath = getManagedSettingsPath();
+        managedContentJson = await fs.readFile(managedPath, 'utf-8');
+        managedExists = true;
+    }
+    catch { /* absent or unsupported platform */ }
+    const detected = detectDenyState(userSettingsJson, managedExists, managedContentJson);
+    // Default (no flag) → show Usage note (mirrors memory.ts:242-253 incumbent pattern)
+    if (!options.enable && !options.disable && !options.status) {
+        p.note(`${color.cyan('devflow security --status')}           Show current deny list state\n` +
+            `${color.cyan('devflow security --enable')}           Install deny list (user settings)\n` +
+            `${color.cyan('devflow security --enable --managed')} Install deny list (managed settings)\n` +
+            `${color.cyan('devflow security --disable')}          Remove the deny list from all locations`, 'Usage');
+        return;
+    }
+    // ── --status ────────────────────────────────────────────────────────────
+    if (options.status) {
+        const both = detected.user && detected.managed;
+        if (!detected.user && !detected.managed) {
+            p.log.info('Security deny list: ' + color.dim('none (not installed)'));
+        }
+        else {
+            if (detected.user) {
+                const count = userSettingsJson ? countDenyEntries(userSettingsJson) : 0;
+                p.log.info(`Security deny list: ${color.green('installed')} in user settings (${count} entries)`);
+                p.log.info(`  Location: ${color.dim(userSettingsPath)}`);
+            }
+            if (detected.managed && managedPath) {
+                const count = managedContentJson ? countDenyEntries(managedContentJson) : 0;
+                p.log.info(`Security deny list: ${color.green('installed')} in managed settings (${count} entries)`);
+                p.log.info(`  Location: ${color.dim(managedPath)}`);
+            }
+            if (both) {
+                p.log.warn('Deny list found in BOTH locations. Run --disable and --enable to consolidate.');
+            }
+        }
+        if (detected.unknown) {
+            p.log.warn('User settings.json is present but unparseable — cannot determine entry count');
+        }
+        // Show manifest mode if available
+        const manifest = await readManifest(devflowDir);
+        if (manifest?.features.security) {
+            p.log.info(`Manifest mode: ${color.dim(manifest.features.security)}`);
+        }
+        return;
+    }
+    // ── --enable ────────────────────────────────────────────────────────────
+    if (options.enable) {
+        const useManaged = options.managed === true;
+        const targetMode = useManaged ? 'managed' : 'user';
+        const templateDeny = await loadTemplateDenyEntries(rootDir);
+        if (templateDeny.length === 0) {
+            p.log.error('Could not load deny list template — no entries to install');
+            return;
+        }
+        if (targetMode === 'managed') {
+            // Add to managed first, verify, then strip from user
+            const managed = await installManagedSettings(rootDir, true);
+            if (!managed) {
+                p.log.error('Managed settings write failed — re-run without --managed to use user settings');
+                return;
+            }
+            p.log.success('Security deny list written to managed settings');
+            // Strip from user settings (self-heal) — adopts canonical stripUserSecurityDenyList (SF9)
+            const stripResult = await stripUserSecurityDenyList(userSettingsPath);
+            if (stripResult && stripResult.removed.length > 0) {
+                p.log.info(`Removed ${stripResult.removed.length} entries from user settings (now in managed)`);
+            }
+        }
+        else {
+            // User mode: merge into ~/.claude/settings.json
+            let existing;
+            try {
+                existing = await fs.readFile(userSettingsPath, 'utf-8');
+            }
+            catch {
+                existing = '{}';
+            }
+            const merged = mergeDenyList(existing, templateDeny);
+            await writeFileAtomicExclusive(userSettingsPath, merged);
+            const count = countDenyEntries(merged);
+            p.log.success(`Security deny list applied to user settings (${count} entries)`);
+            p.log.info(`  Location: ${color.dim(userSettingsPath)}`);
+        }
+        await syncManifestFeature(devflowDir, 'security', targetMode);
+        return;
+    }
+    // ── --disable ───────────────────────────────────────────────────────────
+    if (options.disable) {
+        // User settings: must be parseable to strip — hard fail if not
+        if (userSettingsJson !== null) {
+            try {
+                JSON.parse(userSettingsJson);
+            }
+            catch {
+                p.log.error('settings.json is unparseable — cannot safely remove the deny list. ' +
+                    'Fix the JSON syntax manually and re-run.');
+                process.exit(1);
+            }
+            const { json: stripped, removed } = stripUserDenyList(userSettingsJson, DEVFLOW_HISTORICAL_DENY);
+            if (removed.length > 0) {
+                await writeFileAtomicExclusive(userSettingsPath, stripped);
+                p.log.success(`Removed ${removed.length} entries from user settings:`);
+                for (const entry of removed) {
+                    p.log.info(`  ${color.dim(entry)}`);
+                }
+            }
+            else {
+                p.log.info('No Devflow deny entries found in user settings');
+            }
+        }
+        // Managed settings: gate on detected.managed (parse-safe signal from detectDenyState),
+        // not raw managedExists — avoids raw JSON.parse crash inside removeManagedSettings
+        // when the managed file exists but is corrupt JSON. (SF5 — applies engineering.md
+        // "never throw in business logic"; avoids PF partial-failure: user settings already
+        // stripped but manifest sync would be skipped on uncaught throw.)
+        if (detected.managed) {
+            await removeManagedSettings(rootDir, true);
+        }
+        else if (managedExists && !detected.managed) {
+            // File exists but is unparseable or contains no Devflow entries — warn and skip.
+            p.log.warn('Managed settings file exists but contains no Devflow deny entries — skipping');
+        }
+        else {
+            p.log.info('No managed settings to remove');
+        }
+        await syncManifestFeature(devflowDir, 'security', 'none');
+        return;
+    }
+});
+//# sourceMappingURL=security.js.map