fullstackgtm 0.48.0 → 0.49.0

package/CHANGELOG.md

@@ -7,6 +7,44 @@ The path to 1.0 is planned in [docs/roadmap-to-1.0.md](https://github.com/fullst
 
 ## [Unreleased]
 
+## [0.49.0] — 2026-07-10
+
+### Security
+
+- MCP apply now accepts only store-backed, HMAC-approved plan ids; external
+  plan paths and caller-supplied approvals/value overrides are rejected.
+- Apply uses an atomic single-owner claim and durable attempt journal.
+  Uncertain attempts remain fail-closed until an operator acknowledges provider
+  state; recovery clears every approval and never replays writes automatically.
+- Salesforce credential-bearing endpoints are restricted to canonical HTTPS
+  Salesforce origins and redirects are handled without forwarding credentials.
+- Executable rule packages require explicit CLI trust and are disabled entirely
+  in MCP. Implicit repository configuration cannot activate plugins.
+- Sensitive local files use atomic no-follow writes and verified no-follow
+  reads; symlinked credential, plan, and managed-home paths are refused.
+- Market capture/sourcing uses DNS-pinned public-only HTTP with per-hop redirect
+  validation, bounded responses, and cross-origin credential stripping.
+- Provider HTTP failures expose typed status metadata without raw response
+  bodies, reflected secrets, or PII.
+
+### Changed
+
+- **Breaking pre-1.0 plan-store contract:** `PlanStore` implementations now
+  participate in apply claims, attempt recovery, and claim-bound run recording;
+  `ApprovalStatus` includes `applying`. Custom stores must implement the new
+  lifecycle before upgrading.
+- Public mirror generation is commit-derived, allowlisted, secret-scanned, and
+  fail-closed. npm publishing uses pinned actions/npm plus a protected release
+  environment and provenance verification.
+- Package CI now validates Node 20/22, Linux/macOS/Windows compiled runtimes,
+  and actual installed tarballs with and without optional MCP peers.
+
+### Fixed
+
+- `bulk-update --help` and `-h` now return focused help before parsing an object
+  type or touching configuration, credentials, disk, or network.
+- Installation guidance no longer pins a brittle exact demo finding count.
+
 ## [0.48.0] — 2026-07-08
 
 ### Added

package/CONTRIBUTING.md

@@ -44,6 +44,21 @@ node --experimental-strip-types --test tests/fullstackgtm*.test.ts   # from the
 node packages/fullstackgtm/src/bin.ts doctor                  # run the CLI locally
 ```
 
+Before a release-facing change, verify the artifact rather than only its source
+tree:
+
+```bash
+cd packages/fullstackgtm
+npm run build
+node scripts/verify-packed-install.mjs              # isolated install, optional peers absent
+node scripts/verify-packed-install.mjs --with-peers # isolated install, MCP peers present
+```
+
+The verifier creates the real npm tarball, enforces required/prohibited paths,
+imports the public export, checks its declaration entrypoint, and runs both
+installed binaries. CI repeats compiled-runtime checks on Node 20 and 22 across
+Linux, macOS, and Windows; source-level tests remain on Node 22.6+.
+
 > **Tests live at the monorepo root `tests/`, not in the package.** Running
 > `npm test` *inside* `packages/fullstackgtm` deliberately fails with a pointer
 > (a `pretest` guard) rather than silently passing with zero tests. On the
@@ -78,13 +93,17 @@ the development monorepo). From the monorepo:
 
 1. Bump `packages/fullstackgtm/package.json` version + add a `CHANGELOG.md`
    entry; merge to `main`.
-2. `scripts/sync-oss.sh --push` (builds a fresh `dist/`, mirrors the package +
-   rewritten tests to `fullstackgtm/core`).
+2. Run `scripts/sync-oss.sh` to export an allowlisted mirror from the full
+   source commit, build `dist/`, scan for secrets, and inspect the complete
+   staged diff. Then rerun with `--push` after review. Clone failures stop the
+   release; only a genuine first publication may use the separately confirmed
+   `--initialize-public-repo` mode.
 3. Re-check the mirror's `package.json` version, then tag `vX.Y.Z` on the mirror
    and push the tag.
 4. GitHub Actions (`release.yml`) publishes to npm via **OIDC trusted
-   publishing** — no tokens. It rebuilds from source and refuses to publish if
-   the committed `dist/` differs from a fresh build (supply-chain gate).
+   publishing** — no tokens. The protected `npm-production` environment must
+   require an independent reviewer. The workflow rebuilds from source and
+   refuses to publish if committed `dist/` differs (supply-chain gate).
 
 **Access a new co-maintainer needs to cut a release:** write access to
 `github.com/fullstackgtm/core` (for `sync-oss.sh --push` and the tag push). No

package/DATA-FLOWS.md

@@ -10,7 +10,8 @@ is no fullstackgtm-operated server in the data path for the open package.**
 
 - CRM snapshots, patch plans, approvals, apply-run records, market captures and
   observations, enrich run state, and the signing/credential stores all live
-  under `$FSGTM_HOME` (default `~/.fullstackgtm`), `0600`/`0700`. Nothing is
+  under `$FSGTM_HOME` (default `~/.fullstackgtm`), `0600`/`0700`, using atomic
+  no-follow file I/O. Nothing is
   uploaded to Full Stack GTM.
 - No telemetry, analytics, or phone-home. The core package has zero runtime
   dependencies; the only network calls are the ones listed below, all to
@@ -23,12 +24,16 @@ is no fullstackgtm-operated server in the data path for the open package.**
 | `snapshot`, `audit`, `apply`, `resolve`, `bulk-update`, `dedupe`, `reassign`, `fix`, `enrich` (writeback) | **Your CRM** (HubSpot / Salesforce / Stripe API) | Reads: your CRM records. Writes: only approved patch operations. | Your CRM token (env / stored / broker) |
 | `call parse`, `call score`, `market classify`, `market refresh` | **Your LLM provider** (api.anthropic.com or api.openai.com) | The call transcript / captured competitor page text you point at, plus the extraction prompt | Your `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` (BYO) |
 | `enrich append --source apollo`, `enrich refresh` | **Apollo** (api.apollo.io) | The company domain / contact email being enriched | Your `APOLLO_API_KEY` (BYO) |
-| `market capture`, `market refresh` | **Public vendor websites** you list in `market.config.json` | An HTTP GET (no data sent beyond the request); SSRF-guarded to public hosts only | none |
+| `market capture`, `market refresh` | **Public vendor websites** you list in `market.config.json` | A bounded HTTP GET; DNS answers are validated and pinned, mixed/private/reserved answers are refused, and every redirect is revalidated | none |
 | `login --via <url>` (optional) | **Your hosted deployment's broker** | A pairing handshake; the broker mints short-lived CRM tokens | broker pairing token |
 
 Commands not listed (`plans`, `rules`, `doctor`, `schedule`, `audit-log`,
 `diff`, `merge`, report rendering) make **no network calls**.
 
+Provider HTTP failures persist only typed provider/operation/status/retryability
+metadata. Raw third-party response bodies—which may reflect credentials,
+filters, or PII—are not written to run records or normal CLI/MCP errors.
+
 ## Avoiding third-party data egress
 
 - **LLM verbs are optional.** `call parse --deterministic` uses a free,

package/INSTALL_FOR_AGENTS.md

@@ -33,9 +33,11 @@ machine — that is normal and does not block the next step.
 fullstackgtm audit --demo --json
 ```
 
-Expect a JSON patch plan with `dryRun: true` and 110 findings/110 operations over a generated,
-deliberately messy CRM. Deterministic per seed: `--seed 7` is the default, so
-two runs produce identical finding and operation ids. Exit code 0.
+Expect a JSON patch plan with `dryRun: true`, a non-empty `findings` array, and
+matching proposed operations over a generated, deliberately messy CRM. The
+exact count can grow as built-in rules are added; the stable contract is
+determinism per release and seed. `--seed 7` is the default, so two runs on the
+same version produce identical finding and operation ids. Exit code 0.
 
 This proves the whole pipeline (snapshot → audit → plan) without any account.
 
@@ -133,10 +135,16 @@ works from inside existing projects too.
 Tools exposed over stdio — read-only: `fullstackgtm_audit`,
 `fullstackgtm_capabilities`, `fullstackgtm_rules`, `fullstackgtm_suggest`,
 `fullstackgtm_call_parse`, `fullstackgtm_resolve`, `fullstackgtm_market_worksheet`. Gated:
-`fullstackgtm_apply` (requires explicit `approvedOperationIds`),
+`fullstackgtm_apply` (stored `planId` only; approvals and values must already be
+human-approved and HMAC-signed in the local plan store),
 `fullstackgtm_market_observe` (every quoted span is verified against the
 stored captures before anything is appended).
 
+MCP cannot execute rule packages, apply external plan files, or supply its own
+approvals/value overrides. For an interrupted apply, reconcile provider state,
+then run `fullstackgtm plans recover <id> --acknowledge-uncertain-writes`; this
+replays nothing and clears approvals so a fresh review is required.
+
 ## Troubleshooting
 
 | Symptom | Fix |
@@ -145,3 +153,4 @@ stored captures before anything is appended).
 | `No HubSpot credentials` (exit 1) | Set `HUBSPOT_ACCESS_TOKEN` or have a human run `fullstackgtm login hubspot --hosted` |
 | MCP server prints peer-dependency help | Install `@modelcontextprotocol/sdk` and `zod` (see step 6) |
 | Need machine state for orchestration | `fullstackgtm doctor --json` |
+| Plan is `applying` after an interrupted request | Reconcile provider state, then run `fullstackgtm plans recover <id> --acknowledge-uncertain-writes`; review and approve again |

package/README.md

@@ -373,6 +373,12 @@ fullstackgtm logout hubspot   # or: salesforce | broker
 
 BYO direct credentials always win over a hosted broker pairing, so an operator can override the team default. First-party app secrets never ship in the npm package; hosted login stores a local broker token and mints provider tokens server-side. HubSpot does not support the device-authorization grant or secretless public clients, which is why the bring-your-own-app OAuth path requires client credentials; they are stored locally for silent refresh, the same model as `gcloud` and `aws` CLI profiles.
 
+Salesforce credential-bearing URLs are restricted to canonical HTTPS
+Salesforce-owned production, sandbox, and My Domain origins. Lookalike hosts,
+userinfo, paths/query/fragment, nonstandard ports, unsafe token-response
+instance URLs, and credential-forwarding redirects are refused both when the
+credential is stored and every time it is used.
+
 ## Connect your CRM
 
 What each provider actually requires before `audit --provider <name>` works on your data.
@@ -539,10 +545,15 @@ Nine tools are exposed over stdio.
 
 **Read-only:** `fullstackgtm_audit` (sample, demo, file, or live provider sources with optional rule scoping), `fullstackgtm_capabilities` (server/tool capability manifest), `fullstackgtm_rules` (rule discovery), `fullstackgtm_suggest` (deterministic placeholder values with confidence + reasons), `fullstackgtm_call_parse` (transcripts → provenance-marked segments, insights, and evidence), `fullstackgtm_resolve` (the create gate: exists / ambiguous / safe_to_create), and `fullstackgtm_market_worksheet` (the classification packet for one vendor: claims, judging rules, captured page texts).
 
-**Gated:** `fullstackgtm_apply` (requires explicit `approvedOperationIds`; placeholders still need value overrides) and `fullstackgtm_market_observe` (verifies every quoted span against the stored captures before appending — nothing is stored unless the whole set passes).
+**Gated:** `fullstackgtm_apply` (accepts only a stored plan id; approvals and values must already be human-approved and HMAC-signed in the plan store) and `fullstackgtm_market_observe` (verifies every quoted span against the stored captures before appending — nothing is stored unless the whole set passes).
 
 Tokens stored via `fullstackgtm login` are picked up automatically — the env var is only needed when no stored login exists.
 
+Rule packages are executable JavaScript and are disabled by default. In the CLI,
+review the modules and use `--config <path> --allow-plugins`; use `--no-plugins`
+to apply only declarative config. MCP never executes rule packages: mutable
+tool-call paths are not a durable code-trust boundary.
+
 ## Safety model
 
 1. Reads are safe by default; audits never mutate anything.

package/SECURITY.md

@@ -21,7 +21,10 @@ newest version, not backported (the project is pre-1.0).
 **Credentials.** API tokens are never accepted as command-line arguments
 (they would leak into the process table and shell history); they come from an
 environment variable or stdin only, and are stored `0600` under a `0700` home
-(`$FSGTM_HOME`, default `~/.fullstackgtm`), re-tightened on read. This is the
+(`$FSGTM_HOME`, default `~/.fullstackgtm`). Writes use exclusive temporary
+files, fsync, and atomic rename; reads require regular files opened without
+following symlinks. Managed-home, credential, and plan-store symlink paths are
+refused before chmod/read/write. This is the
 same custody model as the `gcloud`/`aws` CLIs. The hosted broker
 (`login --via`) exists so a team can connect a CRM once, server-side, and hand
 laptops only a revocable pairing token instead of a long-lived super-admin key;
@@ -57,13 +60,34 @@ approved on one machine cannot be applied on another (the key does not travel).
 Documented boundary: this defends the plan file, not an attacker who already
 holds the signing key (same directory and permissions as the credential store).
 
+**Single-owner apply and recovery.** Store-backed CLI and MCP writes atomically
+claim an approved plan and journal the provider, caller surface, and attempt
+state before provider I/O. A second process cannot apply the same approval.
+Failures after provider I/O remain `applying`/uncertain because a timeout cannot
+prove no remote write landed. Recovery never auto-replays: after reconciling CRM
+state, `plans recover <id> --acknowledge-uncertain-writes` clears every approval
+and signature and requires a fresh human review.
+
+**Executable configuration.** `rulePackages` are arbitrary JavaScript. An
+implicitly discovered repository config cannot activate them; CLI execution
+requires explicit `--config <path> --allow-plugins` (`--no-plugins` disables
+them). MCP never executes rule packages or accepts external plans/caller
+approvals.
+
+**Credential origins.** Salesforce access and refresh tokens are sent only to
+canonical HTTPS Salesforce-owned origins. Userinfo, paths/query/fragment,
+nonstandard ports, lookalike domains, unsafe token-response instance URLs, and
+credential-preserving redirects are refused at input, storage, and use.
+
 **Scheduling never auto-approves.** Scheduled (cron) runs are restricted to a
 read/plan-side allowlist plus `apply --plan-id` whose approved status and
 signatures are re-checked at every firing. Arbitrary shell is not schedulable.
 
 **Untrusted input.** Competitor pages fetched by `market capture` are guarded
-against SSRF (scheme allowlist; private/loopback/link-local/metadata addresses
-refused; redirects re-validated). LLM-extracted call insights and market
+against SSRF: every DNS answer must be globally routable, validated answers are
+pinned into socket creation, mixed/private/reserved answers are refused, every
+redirect is revalidated, sensitive headers are stripped cross-origin, and
+time/body/redirect limits are enforced. LLM-extracted call insights and market
 classifications are mechanically verified verbatim against the source text
 before they can drive a writeback, so a prompt-injected transcript or page
 cannot fabricate a grounded-looking change. CSV/formula-injection in ingested

package/dist/cli/audit.js

@@ -2,7 +2,7 @@
 import { readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { auditSnapshot, defaultPolicy } from "../audit.js";
-import { loadConfig, mergePolicy, resolveConfiguredRules } from "../config.js";
+import { loadConfig, mergePolicy, resolveConfiguredRules, rulePackageTrustFromCli } from "../config.js";
 import { getCredential, resolveHubspotConnection } from "../credentials.js";
 import { patchPlanToMarkdown } from "../format.js";
 import { appendHealthEntry, computeHealth, healthToMarkdown, readHealthTimeline, saveWorkspaceSnapshot, summarizeHealth, activeWorkspaceProfile } from "../health.js";
@@ -169,8 +169,9 @@ async function registerHubspotWithBroker() {
 }
 export async function audit(args) {
     const threshold = failOnThreshold(args);
-    const loaded = loadConfig(option(args, "--config") ?? undefined);
-    const rules = selectedRules(args, await resolveConfiguredRules(loaded));
+    const explicitConfig = option(args, "--config") ?? undefined;
+    const loaded = loadConfig(explicitConfig);
+    const rules = selectedRules(args, await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig)));
     const snapshot = await readSnapshot(args);
     const policy = mergePolicy(defaultPolicy(), loaded?.config);
     const today = option(args, "--today");
@@ -326,8 +327,9 @@ function shortDay(at) {
  * re-fetching (useful for a plan produced earlier or by another machine).
  */
 export async function reportCommand(args) {
-    const loaded = loadConfig(option(args, "--config") ?? undefined);
-    const configuredRules = await resolveConfiguredRules(loaded);
+    const explicitConfig = option(args, "--config") ?? undefined;
+    const loaded = loadConfig(explicitConfig);
+    const configuredRules = await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig));
     let plan;
     let snapshot;
     const planPath = option(args, "--plan");
@@ -375,8 +377,9 @@ export async function reportCommand(args) {
     }
 }
 export async function rulesCommand(args) {
-    const loaded = loadConfig(option(args, "--config") ?? undefined);
-    const rules = await resolveConfiguredRules(loaded);
+    const explicitConfig = option(args, "--config") ?? undefined;
+    const loaded = loadConfig(explicitConfig);
+    const rules = await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig));
     if (args.includes("--json")) {
         console.log(JSON.stringify(rules.map(({ id, title, description, category }) => ({
             id,

package/dist/cli/auth.js

@@ -2,7 +2,7 @@
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { DEFAULT_LOOPBACK_PORT, openInBrowser, runHubspotLoopbackLogin, validateHubspotToken } from "../connectors/hubspotAuth.js";
-import { pollSalesforceDeviceLogin, startSalesforceDeviceLogin, validateSalesforceToken } from "../connectors/salesforceAuth.js";
+import { pollSalesforceDeviceLogin, startSalesforceDeviceLogin, validateSalesforceOrigin, validateSalesforceToken } from "../connectors/salesforceAuth.js";
 import { activeProfile, credentialsPath, DEFAULT_PROFILE, deleteCredential, getCredential, storeCredential } from "../credentials.js";
 import { activeWorkspaceProfile, readHealthTimeline, summarizeHealth } from "../health.js";
 import { resolveLlmCredential, validateLlmKey } from "../llm.js";
@@ -229,7 +229,10 @@ async function salesforceLogin(args) {
             await guidedProviderLogin("salesforce", args, "--device requires --client-id (the consumer key of a Connected App with device flow enabled).");
             return;
         }
-        const loginUrl = option(args, "--login-url") ?? undefined;
+        const loginUrlInput = option(args, "--login-url") ?? undefined;
+        const loginUrl = loginUrlInput
+            ? validateSalesforceOrigin(loginUrlInput, "Salesforce --login-url")
+            : undefined;
         const authorization = await startSalesforceDeviceLogin({ clientId, loginUrl });
         console.error(`\nPairing code: ${authorization.userCode}\n\nConfirm this code at:\n\n  ${authorization.verificationUri}\n`);
         void openInBrowser(authorization.verificationUri);
@@ -254,11 +257,12 @@ async function salesforceLogin(args) {
         console.log("Tokens refresh silently; no further browser interaction is needed.");
         return;
     }
-    const instanceUrl = option(args, "--instance-url");
-    if (!instanceUrl) {
+    const instanceUrlInput = option(args, "--instance-url");
+    if (!instanceUrlInput) {
         await guidedProviderLogin("salesforce", args, "Salesforce login needs hosted OAuth, --device --client-id <consumer key>, or --instance-url <https://yourorg.my.salesforce.com> with the access token piped on stdin.");
         return;
     }
+    const instanceUrl = validateSalesforceOrigin(instanceUrlInput, "Salesforce --instance-url");
     const token = await readSecret("Salesforce access token");
     if (!token)
         throw new Error("No access token provided.");

package/dist/cli/fix.js

@@ -2,10 +2,11 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { auditSnapshot, defaultPolicy } from "../audit.js";
-import { loadConfig, mergePolicy, resolveConfiguredRules } from "../config.js";
+import { loadConfig, mergePolicy, resolveConfiguredRules, rulePackageTrustFromCli } from "../config.js";
 import { applyPatchPlan } from "../connector.js";
 import { patchPlanToMarkdown } from "../format.js";
 import { createFilePlanStore } from "../planStore.js";
+import { verifyApprovalDigests } from "../integrity.js";
 import { resolveRecord } from "../resolve.js";
 import { parseAssignmentPolicy } from "../assign.js";
 import { buildLeadRoutePlan } from "../route.js";
@@ -197,8 +198,9 @@ export async function fixCommand(args) {
         throw new Error("--min-confidence must be high or low");
     }
     const includeCreates = args.includes("--include-creates");
-    const loaded = loadConfig(option(args, "--config") ?? undefined);
-    const configured = await resolveConfiguredRules(loaded);
+    const explicitConfig = option(args, "--config") ?? undefined;
+    const loaded = loadConfig(explicitConfig);
+    const configured = await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig));
     const rule = configured.find((candidate) => candidate.id === ruleId);
     if (!rule) {
         throw new Error(`Unknown rule: ${ruleId}. Available rules: ${configured.map((r) => r.id).join(", ")}`);
@@ -266,22 +268,33 @@ export async function fixCommand(args) {
         return;
     }
     const connector = await connectorFor(provider, args);
+    const claimed = await store.claimApply(plan.id, { provider, source: "fix" });
+    const { claimId } = claimed;
+    const claimedVerification = verifyApprovalDigests(claimed.stored.plan.operations, claimed.stored.approvedOperationIds, claimed.stored.valueOverrides, claimed.stored.approvalDigests);
+    if (!claimedVerification.ok) {
+        await store.abortApplyPreflight(plan.id, claimId, "Approval integrity verification failed after the claim and before provider I/O.");
+        throw new Error(`Refusing to apply plan ${plan.id}: approval changed while acquiring the apply claim.`);
+    }
     // Live apply board on interactive terminals (stderr; inert otherwise); the
     // same emitter streams heartbeats to the paired hosted app on long runs.
     const renderer = createProgressRenderer(APPLY_STAGES);
     const progress = createProgressEmitter(composeListeners(renderer.listener, progressReporter()));
     let run;
     try {
-        run = await applyPatchPlan(connector, plan, {
-            approvedOperationIds: approvedIds,
-            valueOverrides: overrides,
+        run = await applyPatchPlan(connector, claimed.stored.plan, {
+            approvedOperationIds: claimed.stored.approvedOperationIds,
+            valueOverrides: claimed.stored.valueOverrides,
             progress,
         });
     }
+    catch (error) {
+        await store.markApplyUncertain(plan.id, claimId);
+        throw error;
+    }
     finally {
         renderer.done();
     }
-    await store.recordRun(plan.id, run);
+    await store.recordRun(plan.id, run, claimId);
     const counts = { applied: 0, conflict: 0, skipped: 0, failed: 0 };
     for (const result of run.results)
         counts[result.status] = (counts[result.status] ?? 0) + 1;

package/dist/cli/help.js

@@ -179,6 +179,7 @@ Usage:
   fullstackgtm plans list [--status <s>] | show <id> | reject <id>
   fullstackgtm plans approve <id> --operations <ids|all> [--value <opId>=<v>]
   fullstackgtm plans approve <id> --values-from <suggestions.json> [--min-confidence high|low] [--include-creates]
+  fullstackgtm plans recover <id> --acknowledge-uncertain-writes
   fullstackgtm apply --plan-id <id> --provider <name>
   fullstackgtm apply --plan-id <id> --channel outbox          (render approved openers; transmits nothing)
   fullstackgtm apply --plan <path> --provider <name> --approve <ids|all> [options]
@@ -226,6 +227,8 @@ Audit options:
   --config <path>        Config file (default: ./fullstackgtm.config.json if present)
                          { "policy": {...}, "rules": {"enabled":[],"disabled":[]},
                            "rulePackages": ["./team-rules.mjs"] }
+  --allow-plugins        Execute rulePackages from an explicit --config path after review
+  --no-plugins           Ignore rulePackages; use declarative config and built-in rules only
   --rules <ids>          Comma-separated rule ids to run (default: all; see \`rules\`)
   --json                 Print the JSON patch plan instead of markdown
   --out <path>           Also write the JSON patch plan to a file
@@ -498,6 +501,7 @@ export const HELP = {
             "fullstackgtm plans list [--status <s>] | show <id> | reject <id>",
             "fullstackgtm plans approve <id> --operations <ids|all> [--value <opId>=<v>]",
             "fullstackgtm plans approve <id> --values-from <suggestions.json> [--min-confidence high|low]",
+            "fullstackgtm plans recover <id> --acknowledge-uncertain-writes",
         ],
         detail: "Approval is explicit and per-operation; placeholders need a concrete --value or a suggestion to be approvable.",
         seeAlso: ["audit", "suggest", "apply"],
@@ -585,11 +589,11 @@ export const HELP = {
 };
 // Verbs that print their own richer multi-subcommand help; runCli routes their
 // `--help` to themselves, so commandHelp() only renders these via `help <verb>`.
-export const BESPOKE_HELP = ["init", "call", "market", "tam", "enrich", "bulk-update", "schedule", "signals", "icp", "draft"];
+export const BESPOKE_HELP = ["init", "call", "market", "tam", "enrich", "schedule", "signals", "icp", "draft"];
 export const GLOBAL_FLAGS = ["--help", "--full"];
 export const GLOBAL_SHORT_FLAGS = ["-h"];
 export const SOURCE_FLAGS = ["--provider", "--token-env", "--input", "--demo", "--sample", "--seed", "--today"];
-export const AUDIT_FLAGS = ["--config", "--rules", "--stale-days", "--fail-on", "--save", "--dry-run", "--json", "--out", "--full"];
+export const AUDIT_FLAGS = ["--config", "--allow-plugins", "--no-plugins", "--rules", "--stale-days", "--fail-on", "--save", "--dry-run", "--json", "--out", "--full"];
 // Complete per-command flag registry used by runCli's fail-closed flag
 // validation. Keep this next to HELP so focused help, machine capabilities,
 // and the parser safety gate have one command inventory to reconcile against.
@@ -605,13 +609,13 @@ export const COMMAND_FLAGS = {
     snapshot: [...SOURCE_FLAGS, "--since", "--out", "--archive"],
     audit: [...SOURCE_FLAGS, ...AUDIT_FLAGS],
     report: [...SOURCE_FLAGS, ...AUDIT_FLAGS, "--plan", "--client", "--title", "--prepared-by", "--format", "--max-examples"],
-    diff: ["--before", "--after", "--config", "--stale-days", "--today", "--json", "--fail-on-new-findings"],
-    rules: ["--config", "--json"],
+    diff: ["--before", "--after", "--config", "--allow-plugins", "--no-plugins", "--stale-days", "--today", "--json", "--fail-on-new-findings"],
+    rules: ["--config", "--allow-plugins", "--no-plugins", "--json"],
     resolve: [...SOURCE_FLAGS, "--name", "--domain", "--email", "--account-id", "--json"],
     hierarchy: [...SOURCE_FLAGS, "--json", "--out"],
     relationships: [...SOURCE_FLAGS, "--account-id", "--domain", "--json", "--out"],
     route: [...SOURCE_FLAGS, "--match", "--no-inherit-owner", "--reassign-owned", "--policy", "--reason", "--max-operations", "--save", "--dry-run", "--json", "--out"],
-    fix: [...SOURCE_FLAGS, "--config", "--rule", "--provider", "--min-confidence", "--include-creates", "--yes", "--confirm", "--dry-run"],
+    fix: [...SOURCE_FLAGS, "--config", "--allow-plugins", "--no-plugins", "--rule", "--provider", "--min-confidence", "--include-creates", "--yes", "--confirm", "--dry-run"],
     "bulk-update": [...SOURCE_FLAGS, "--where", "--set", "--guard", "--require", "--create-task", "--archive", "--force-archive-duplicates", "--reason", "--max-operations", "--save", "--dry-run", "--json", "--out"],
     dedupe: [...SOURCE_FLAGS, "--key", "--keep", "--reason", "--max-operations", "--save", "--dry-run", "--json", "--out"],
     reassign: [...SOURCE_FLAGS, "--from", "--assign-unowned", "--to", "--objects", "--where", "--except-deal-stage", "--include-closed-deals", "--reason", "--max-operations", "--save", "--dry-run", "--json", "--out"],
@@ -619,7 +623,7 @@ export const COMMAND_FLAGS = {
     enrich: [...SOURCE_FLAGS, "--config", "--source", "--icp", "--input", "--provider", "--stale-days", "--assign-owner", "--objects", "--max", "--staged-run", "--run-label", "--label", "--runs", "--save", "--dry-run", "--json", "--out"],
     call: [...SOURCE_FLAGS, "--transcript", "--title", "--source", "--model", "--deterministic", "--heuristics", "--llm", "--json", "--ndjson", "--out", "--call", "--call-type", "--rubric", "--list", "--list-rubrics", "--attendees", "--domain", "--deal", "--save", "--dry-run"],
     suggest: [...SOURCE_FLAGS, "--plan-id", "--plan", "--json", "--out"],
-    plans: ["--status", "--operations", "--value", "--values-from", "--min-confidence", "--include-creates", "--json"],
+    plans: ["--status", "--operations", "--value", "--values-from", "--min-confidence", "--include-creates", "--acknowledge-uncertain-writes", "--json"],
     apply: ["--plan", "--plan-id", "--provider", "--channel", "--token-env", "--approve", "--value", "--json", "--config"],
     "audit-log": ["--in", "--out", "--json"],
     merge: ["--input", "--out", "--json"],