devflow-kit 2.3.0 → 2.5.0

package/dist/cli/commands/agents.js

@@ -373,7 +373,12 @@ export const agentsCommand = new Command('agents')
     }
     const mapping = mappingResult.value;
     const proxyEnabled = await isProxyEnabled(devflowDir);
-    const shippedDefaults = await loadShippedDefaults();
+    // An agent with no shipped default renders a blank DEFAULT column and can
+    // never be reverted off an external model; surface the gap rather than
+    // letting the table imply the agent simply ships without one.
+    const shippedDefaults = await loadShippedDefaults(undefined, {
+        onWarning: (msg) => p.log.warn(msg),
+    });
     // ── --list ──────────────────────────────────────────────────────────────
     if (options.list) {
         const agentNames = getAllAgentNames().sort();

package/dist/cli/commands/attribution-prompts.js

@@ -0,0 +1,144 @@
+/**
+ * Attribution prompt helpers for devflow init.
+ *
+ * CLI-layer module (ADR-013): prompt-rendering logic lives in src/cli/commands/,
+ * core business logic stays in src/core/.
+ *
+ * Applies PF-029: the gate is an exported pure predicate with an explicit isTTY guard,
+ * so --recommended (flag, no prompt) and the non-TTY fallback keep their promptless
+ * contracts and the reachability rule is unit-testable without a terminal.
+ * Applies PF-014: runAttributionStep never calls process.exit() or throws — callers
+ * own the cancel idiom (p.cancel + process.exit(0)), keeping try/finally cleanup safe.
+ *
+ * D27: suppress-attribution flag — gates Claude Code's AI-attribution injection.
+ * The question is ADVANCED-ONLY; Recommended never asks. See shouldRunAttributionStep.
+ *
+ * Shared DI seam (PromptOutcome, WizardPromptIO, clackNote, clackSelect) lives in
+ * prompt-io.ts — one definition, both wizard modules import from there.
+ */
+import { clackNote, clackSelect } from './prompt-io.js';
+// ── Gate predicate ─────────────────────────────────────────────────────────────
+/**
+ * Determines whether the attribution wizard step should run for a given init invocation.
+ *
+ * D27 — ADVANCED-ONLY. The attribution question is reachable from the Advanced path
+ * and nowhere else. This DIVERGES DELIBERATELY from shouldRunComplianceStep, which also
+ * runs on interactive Recommended: attribution rewrites the user's git history metadata,
+ * so Recommended stays a zero-question path and silently applies the seeded value
+ * (fresh install: off). Do not "restore symmetry" with the compliance gate.
+ *
+ * Gate table:
+ *
+ *   --advanced flag / re-init (banner path) / prompt → Advanced   → yes
+ *   Interactive mode-prompt → Recommended                         → NO (D27 divergence)
+ *   --recommended flag                                            → no
+ *   !isTTY (any mode)                                             → no
+ *
+ * Gating on the mode name is sound here because 'advanced' is only ever resolved on an
+ * interactive path (the Advanced branch exit-1s on non-TTY), and the explicit isTTY guard
+ * keeps the promptless contracts of --recommended and the non-TTY fallback pinned
+ * regardless (PF-029).
+ *
+ * There is no CLI override for attribution — it is toggled post-install via
+ * `devflow flags --enable/--disable suppress-attribution`.
+ *
+ * Pure predicate — no side effects, fully testable without a TTY.
+ */
+export function shouldRunAttributionStep(input) {
+    if (!input.isTTY)
+        return false;
+    return input.mode === 'advanced';
+}
+/**
+ * Build the real (clack) AttributionPromptIO adapter.
+ * Delegates to the shared clackNote / clackSelect adapters (prompt-io.ts).
+ */
+export function buildClackAttributionPrompts() {
+    return {
+        note: clackNote,
+        select: (opts) => clackSelect(opts),
+    };
+}
+// ── Seed / apply helpers ───────────────────────────────────────────────────────
+/**
+ * Derive the boolean seed for the attribution prompt from the current FlagsRecord.
+ *
+ * Returns true only when `suppress-attribution` is explicitly set to the boolean
+ * true — undefined, null, and false all map to false, giving `p.select` a real
+ * boolean rather than an unchecked cast (PF-018: non-vacuous path).
+ *
+ * Pure function — no side effects, fully testable without a TTY.
+ */
+export function attributionSeedFrom(flags) {
+    return flags['suppress-attribution'] === true;
+}
+/**
+ * Apply the resolved wizard answer back onto the FlagsRecord.
+ *
+ * Returns a new record with `suppress-attribution` updated to outcome.suppress.
+ * Never mutates the input (immutability principle). The caller replaces its local
+ * enabledFlags binding with the return value.
+ *
+ * D27: this is the single merge site for the wizard answer; init.ts must not
+ * duplicate the spread inline.
+ *
+ * Pure function — no side effects, fully testable without a TTY.
+ */
+export function applyAttributionAnswer(flags, outcome) {
+    return { ...flags, 'suppress-attribution': outcome.suppress };
+}
+/**
+ * Run the attribution wizard step.
+ *
+ * Flow:
+ *   1. Note — "Current setting: …" header with context about what the flag does.
+ *   2. Enable select — labeled Yes / No with hints (seeded from prior state);
+ *      p.select is immune to Enter-through muscle memory while still preserving
+ *      the seeded value (ambient-prompt style — per PF-029).
+ *
+ * Returns:
+ *   {kind:'resolved', suppress, messages} — step completed; `suppress` is the chosen
+ *     boolean; `messages` are emitted by the caller.
+ *   {kind:'cancelled'} — user pressed Escape; caller runs p.cancel + process.exit(0).
+ *
+ * Invariants (PF-014):
+ *   - Never calls process.exit(), never throws.
+ *   - All I/O is routed through the `prompts` parameter (injectable for tests).
+ */
+export async function runAttributionStep(opts) {
+    const { seed, prompts } = opts;
+    const currentStr = seed ? 'suppressed' : 'shown (default)';
+    // security-02: name the destructive branch (Yes) BEFORE the user consents.
+    // ADR-024 corollary (b): turning the flag ON replaces any existing attribution
+    // value, including a custom one — this is deliberate. Only the exact
+    // devflow-managed shape {"commit":"","pr":""} is removed on disable.
+    // security-04: surface the org AI-disclosure-policy dimension as a note (not a gate).
+    prompts.note(`Current setting: ${currentStr}\n\n` +
+        'Choosing Yes REPLACES any existing \`attribution\` value in settings.json,\n' +
+        'including a custom one, with {"commit":"","pr":""}.\n' +
+        'Choosing No leaves a custom value untouched — only the exact\n' +
+        'devflow-managed block is ever removed on disable.\n' +
+        'Some organisations require machine-readable AI-authorship disclosure\n' +
+        '— check your policy before enabling.\n\n' +
+        'Toggle any time with: devflow flags --enable suppress-attribution', 'AI Attribution');
+    const enableOutcome = await prompts.select({
+        message: 'Suppress AI attribution in commits and PRs?',
+        options: [
+            { value: true, label: 'Yes', hint: 'hides Claude attribution labels in git history' },
+            { value: false, label: 'No', hint: 'keeps Claude attribution labels (default)' },
+        ],
+        initialValue: seed,
+    });
+    if (enableOutcome.kind === 'cancel')
+        return { kind: 'cancelled' };
+    const suppress = enableOutcome.value;
+    const text = suppress
+        ? 'Attribution: suppressed — disable with devflow flags --disable suppress-attribution'
+        : 'Attribution: shown (default)';
+    return {
+        kind: 'resolved',
+        suppress,
+        messages: [{ level: suppress ? 'success' : 'info', text }],
+    };
+}
+//# sourceMappingURL=attribution-prompts.js.map

package/dist/cli/commands/compliance-prompts.js

@@ -9,9 +9,13 @@
  * no prompt) and the non-TTY fallback preserve their promptless contracts.
  * Applies PF-014: runComplianceStep never calls process.exit() or throws — callers
  * own the cancel idiom (p.cancel + process.exit(0)), keeping try/finally cleanup safe.
+ *
+ * Shared DI seam (PromptOutcome, WizardPromptIO, clackNote, clackSelect) lives in
+ * prompt-io.ts — one definition, both wizard modules import from there.
  */
 import * as p from '@clack/prompts';
 import { COMPLIANCE_FRAMEWORKS } from '../../core/compliance.js';
+import { clackNote, clackSelect } from './prompt-io.js';
 // ── Shared prompt content ──────────────────────────────────────────────────────
 /** Message shown on the compliance framework multiselect prompt. */
 export const FRAMEWORK_SELECT_MESSAGE = 'Select compliance frameworks (Enter to skip — generic controls only)';
@@ -75,21 +79,13 @@ export function shouldRunComplianceStep(input) {
 }
 /**
  * Build the real (clack) CompliancePromptIO adapter.
+ * Delegates the shared note + select to the shared adapters (prompt-io.ts).
  * Translates clack's cancel symbol into the PromptOutcome discriminated union.
  */
 export function buildClackCompliancePrompts() {
     return {
-        note: (message, title) => p.note(message, title),
-        select: async (opts) => {
-            const result = await p.select({
-                message: opts.message,
-                options: opts.options,
-                initialValue: opts.initialValue,
-            });
-            if (p.isCancel(result))
-                return { kind: 'cancel' };
-            return { kind: 'value', value: result };
-        },
+        note: clackNote,
+        select: (opts) => clackSelect(opts),
         multiselect: async (opts) => {
             const result = await p.multiselect({
                 message: opts.message,

package/dist/cli/commands/compliance.js

@@ -6,6 +6,9 @@
  * Applies ADR-001: compliance is manifest-group (like proxy), not config.json-gated.
  * Avoids PF-009: per-artifact failures are warn-not-throw.
  * Avoids PF-015: enable/disable each converge BOTH artifacts unconditionally.
+ * The evidence-policy lines (--status, and the --enable/--set suggestion) come
+ *   from src/core/evidence-policy.ts, the seam onto the package's own resolver;
+ *   the CLI prints .devflow/policy.json and never writes it (applies ADR-024).
  */
 import { Command } from 'commander';
 import { promises as fs } from 'fs';
@@ -15,6 +18,7 @@ import color from 'picocolors';
 import { ALWAYS_PRESENT_REFS, COMPLIANCE_FRAMEWORKS, normalizeFrameworks, parseFrameworkList, } from '../../core/compliance.js';
 import { frameworkChoices, FRAMEWORK_SELECT_MESSAGE } from './compliance-prompts.js';
 import { COMPLIANCE_SKILL_TOKENS } from '../../core/compliance-compose.js';
+import { evidencePolicyStatusLine, evidencePolicySuggestion, formatEvidencePolicyUnavailable, loadEvidencePolicyModule, } from '../../core/evidence-policy.js';
 import { readManifest, writeManifest } from '../../core/manifest.js';
 import { convergeFromManifest } from '../../targets/claude-code/compliance-install.js';
 import { validateRuleShadow, validateSkillShadow } from '../../targets/claude-code/installer.js';
@@ -177,7 +181,7 @@ export const complianceCommand = new Command('compliance')
     .description('Enable, disable, or configure the compliance feature')
     .option('--enable', 'Enable compliance (restores previously selected frameworks)')
     .option('--disable', 'Disable compliance (artifacts removed; frameworks remembered for re-enable)')
-    .option('--status', 'Show compliance state: manifest, installed artifacts, and shadow presence')
+    .option('--status', 'Show compliance state: manifest, installed artifacts, shadow presence, and the evidence policy for the current repository')
     .option('--set <list>', 'Set active frameworks (comma-separated IDs); enables compliance. Use --set "" for zero frameworks (generic controls only)')
     .action(async (options) => {
     const claudeDir = getClaudeDirectory();
@@ -247,6 +251,11 @@ export const complianceCommand = new Command('compliance')
                     ? color.yellow(' (withheld — rules disabled)')
                     : '') +
                 (isRuleShadowed ? color.green(' [shadowed]') : ''),
+            '',
+            // The repository in cwd, resolved by the package's own resolver with the
+            // compliance state already read above (D-POLICY-CJS-SEAM). Bounded: at most
+            // two `gh` calls, each with a timeout, so offline degrades to a flagged line.
+            evidencePolicyStatusLine(loadEvidencePolicyModule(), { dir: process.cwd(), compliance: current }),
         ];
         if (driftInstalled.length > 0 || validMissing.length > 0 || invalidIds.length > 0) {
             lines.push('');
@@ -333,5 +342,18 @@ export const complianceCommand = new Command('compliance')
         p.log.info(color.dim('Note: compliance rule withheld (rules disabled) — ' +
             'run `devflow rules --enable` to install the stamped rule'));
     }
+    // Suggest the team policy file compliance now implies. Printed, never written:
+    // .devflow/policy.json is team-owned (D-POLICY-NO-WRITE, applies ADR-024).
+    if (resolved.nextState.enabled) {
+        const policyModule = loadEvidencePolicyModule();
+        if (!policyModule.ok) {
+            p.log.warn(formatEvidencePolicyUnavailable(policyModule.error));
+        }
+        else {
+            const suggestion = evidencePolicySuggestion(resolved.nextState, policyModule.value);
+            if (suggestion !== null)
+                p.note(suggestion, 'Evidence policy');
+        }
+    }
 });
 //# sourceMappingURL=compliance.js.map

package/dist/cli/commands/init-seed.js

@@ -3,7 +3,6 @@
  *
  * Computes the initial state (seed) for init prompts from:
  * - The existing manifest (from a prior install)
- * - The project feature config (.devflow/config.json)
  * - The current settings.json snapshot (for view-mode resolution)
  * - The plugin registry
  *
@@ -13,8 +12,9 @@
  * beside init.ts in src/cli/commands/ rather than in src/core/ (which holds
  * agent-neutral, target-agnostic utilities).
  */
-import { resolveExistingViewMode, FLAG_REGISTRY, defaultValueOf, readViewMode, } from '../../core/flags.js';
+import { resolveExistingViewMode, settingHoldsManagedShape, FLAG_REGISTRY, defaultValueOf, readViewMode, } from '../../core/flags.js';
 import { partitionSelectablePlugins } from '../../core/plugins.js';
+import { DEFAULT_TRACKER_PROVIDER } from '../../core/tracker.js';
 /** Registry defaults — all features enabled except proxy (advanced-only, off by default). */
 export const FEATURE_DEFAULTS = {
     ambient: true,
@@ -25,24 +25,21 @@ export const FEATURE_DEFAULTS = {
     rules: true,
     proxy: false,
     compliance: { enabled: false, frameworks: [] },
+    tracker: { provider: DEFAULT_TRACKER_PROVIDER },
 };
 // ── Helpers ───────────────────────────────────────────────────────────────────
 /**
- * Resolve feature booleans for the init seed.
+ * Resolve feature booleans for the init seed: every feature comes from
+ * manifest.features, with registry defaults when the manifest is absent.
  *
- * - memory / learning / knowledge come from projectConfig WHENEVER present,
- *   independent of whether a manifest exists (covers config-present /
- *   manifest-missing cases such as a fresh project with a prior learning run).
- * - ambient / hud / rules come from manifest.features; registry defaults
- *   (all true) are used when the manifest is absent.
- *
- * Applies ADR-001: .devflow/config.json is the source of truth for
- * memory/learning/knowledge; manifest reflects the last install choices for
- * the remaining toggles.
+ * D-FEATURES-MACHINE-WIDE (src/core/feature-switch.ts): memory, learning and
+ * knowledge are machine-wide, recorded in the manifest alone, so the seed takes
+ * no per-repo input at all. Seeding from whatever repo init happens to run in
+ * would flip the switch for EVERY repo as a side effect — a stale per-repo
+ * `true` would silently re-enable a feature the user turned off. ADR-014's
+ * state-aware re-init preserves the prior machine-wide choice, the manifest's.
  */
-export function resolveSeedFeatures(manifest, projectConfig) {
-    // ambient/hud/rules/proxy/compliance: manifest is the source; fall back to registry defaults.
-    // proxy and compliance follow the manifest group (like ambient) per ADR-001 — NOT config.json-gated.
+export function resolveSeedFeatures(manifest) {
     const ambient = manifest?.features.ambient ?? FEATURE_DEFAULTS.ambient;
     const hud = manifest?.features.hud ?? FEATURE_DEFAULTS.hud;
     const rules = manifest?.features.rules ?? FEATURE_DEFAULTS.rules;
@@ -52,15 +49,15 @@ export function resolveSeedFeatures(manifest, projectConfig) {
     // the module-level default by reference — downstream mutation would corrupt it process-wide.
     const rawCompliance = manifest?.features.compliance ?? FEATURE_DEFAULTS.compliance;
     const compliance = { ...rawCompliance, frameworks: [...rawCompliance.frameworks] };
-    // memory/learning/knowledge: projectConfig wins whenever present (ADR-001).
-    // Helper eliminates the repeated projectConfig !== null ternary pattern.
-    const fromConfig = (key) => projectConfig !== null
-        ? projectConfig[key]
-        : (manifest?.features[key] ?? FEATURE_DEFAULTS[key]);
-    const memory = fromConfig('memory');
-    const knowledge = fromConfig('knowledge');
-    const learning = fromConfig('learning');
-    return { ambient, memory, hud, knowledge, learning, rules, proxy, compliance };
+    // Same defensive spread, same reason: `?? FEATURE_DEFAULTS.tracker` alone would
+    // return the module-level default BY REFERENCE and downstream mutation would
+    // corrupt it process-wide.
+    const rawTracker = manifest?.features.tracker ?? FEATURE_DEFAULTS.tracker;
+    const tracker = { ...rawTracker };
+    const memory = manifest?.features.memory ?? FEATURE_DEFAULTS.memory;
+    const knowledge = manifest?.features.knowledge ?? FEATURE_DEFAULTS.knowledge;
+    const learning = manifest?.features.learning ?? FEATURE_DEFAULTS.learning;
+    return { ambient, memory, hud, knowledge, learning, rules, proxy, compliance, tracker };
 }
 /**
  * Resolve the flag record for the init seed.
@@ -161,17 +158,41 @@ export function resolveSeedPlugins(manifestPlugins, knownPlugins, allPlugins) {
     return { workflowPlugins, languagePlugins };
 }
 /**
- * Compose the full init seed from manifest, project config, settings, and registry.
+ * Extract the attribution suppression state from a settings JSON string.
+ *
+ * Returns `true` when the exact devflow-managed attribution shape is present —
+ * delegating to `settingHoldsManagedShape('suppress-attribution')`, which is the
+ * single place that decides "on-disk value equals the managed shape" (consistency-01).
+ * Returns `undefined` when the block is absent, holds a custom value, or JSON is
+ * malformed — callers fall through to the manifest FlagsRecord entry or the registry
+ * default.
+ *
+ * Return type is `true | undefined` (typescript-06): settings.json can signal ON or
+ * nothing — never explicitly OFF. That asymmetry is load-bearing for seeding priority:
+ * `undefined` lets the manifest entry or the registry default win, while `true` is an
+ * unambiguous "this key was devflow-managed and active".
+ *
+ * Mirrors resolveExistingViewMode: returns undefined on malformed JSON, absent key,
+ * or any non-devflow attribution value.
+ *
+ * Pure function — no I/O, no side effects.
+ */
+export function resolveExistingAttributionSuppression(settingsJson) {
+    return settingHoldsManagedShape(settingsJson, 'suppress-attribution') ? true : undefined;
+}
+/**
+ * Compose the full init seed from manifest, settings, and registry.
  *
  * view-mode priority: existing settings.json (non-default) → manifest → 'default'.
- * The resolved view mode is encoded into flags['view-mode'] so all flag state lives
- * in one FlagsRecord (applying PF-015: fold before strip — the fold happens here).
+ * suppress-attribution priority: settings.json exact devflow shape → manifest → false.
+ * All flag overrides are encoded into flags so all flag state lives in one FlagsRecord
+ * (applying PF-015: fold before strip — the fold happens here).
  *
  * This is the single composition point; callers (init.ts hoist block) call this
  * once and pass `seed` down to prompt wiring.
  */
-export function resolveInitSeed(seedManifest, seedConfig, settingsSnapshot, plugins) {
-    const features = resolveSeedFeatures(seedManifest, seedConfig);
+export function resolveInitSeed(seedManifest, settingsSnapshot, plugins) {
+    const features = resolveSeedFeatures(seedManifest);
     // features.flags is FlagsRecord; null for fresh install (no manifest).
     // seedManifest?.features.flags may be absent at runtime on very old manifests not yet
     // healed — ?? null collapses to fresh-install behavior (all flags at registry defaults).
@@ -194,9 +215,26 @@ export function resolveInitSeed(seedManifest, seedConfig, settingsSnapshot, plug
     else {
         resolvedViewMode = 'default'; // fall back to neutral
     }
+    // Encode resolved attribution suppression (D27) into flags['suppress-attribution'].
+    // Priority: settings.json exact devflow shape → manifest FlagsRecord entry → false.
+    // resolveExistingAttributionSuppression returns true only for the exact managed shape
+    // {"commit":"","pr":""}; custom values return undefined so the manifest entry wins.
+    const existingAttr = resolveExistingAttributionSuppression(settingsSnapshot);
+    const resolvedSuppressAttr = existingAttr !== undefined
+        ? existingAttr // settings.json exact shape wins
+        : flags['suppress-attribution'] === true; // manifest or registry default
     // Return a fresh spread rather than mutating flags in place — keeps this function pure
     // per the module docblock and avoids aliasing if the caller inspects seed.flags.
-    return { features, flags: { ...flags, 'view-mode': resolvedViewMode }, workflowPlugins, languagePlugins };
+    return {
+        features,
+        flags: {
+            ...flags,
+            'view-mode': resolvedViewMode,
+            'suppress-attribution': resolvedSuppressAttr,
+        },
+        workflowPlugins,
+        languagePlugins,
+    };
 }
 /**
  * Resolve the three seed inputs under the --reset gate.
@@ -239,6 +277,7 @@ export function applyCliToggles(base, toggles) {
         rules: toggles.rules ?? base.rules,
         proxy: toggles.proxy ?? base.proxy,
         compliance: toggles.compliance ?? base.compliance,
+        tracker: toggles.tracker ?? base.tracker,
     };
 }
 //# sourceMappingURL=init-seed.js.map