glirastes 0.4.0 → 0.5.1

package/dist/cli/index.js

@@ -1,4 +1,24 @@
-import { generateEndpointRegistry, generateUiRegistry, generateActionIdRegistry, generateModuleRegistry, validateAiTools, formatValidationReport, checkAiCoverage, formatCoverageReport, scaffoldAiTool, formatScaffoldResult, generateAgentSkills, generateMcpServer, recommendOutputFormat, syncAssetToGlirastes, } from '../codegen/index.js';
+import { readFileSync, mkdirSync, writeFileSync, existsSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { createInterface } from 'node:readline/promises';
+import { AppSetupArtifactSchema } from '../contracts/app-setup.js';
+import { discoverFoundationExecutions, FoundationExecutionInventorySchema, } from '../codegen/execution-inventory.js';
+import { writeNextAppRouteScan } from '../codegen/route-scanner.js';
+import { buildManifests, validateWorkspace, } from './commands/validate-build.js';
+import { AppSetupClient } from '../sync/app-setup-client.js';
+import { installSkills, } from './commands/install-skills.js';
+import { parseLocalExecutionInventory, RuntimeSetupClient, } from '../sync/runtime-setup-client.js';
+import { defaultWizardDependencies, isWizardInvocation, runSetupWizard, WizardStopped, } from './commands/setup-wizard.js';
+import { FoundationDiagnosticError } from '../diagnostics/index.js';
+import { assertSetupPlanConfirmation, createSetupPlan, } from './commands/setup-plan.js';
+import { applySetupPlan } from './commands/apply-setup-plan.js';
+import { createDoctorReport, formatDoctorReport, } from './commands/doctor.js';
+import { runConnect, } from './commands/connect.js';
+import { runSync } from './commands/sync.js';
+import { inspectSetupProject, formatSetupProjectInspection } from './commands/project-inspection.js';
+import { runAgentSetup } from './commands/agent-setup.js';
+import { writeCiWorkflow } from './commands/ci-workflow.js';
+import { runToolsCommand } from './commands/tools/index.js';
 function getFlagValue(args, flag) {
     const index = args.indexOf(flag);
     return index >= 0 ? args[index + 1] : undefined;
@@ -6,629 +26,593 @@ function getFlagValue(args, flag) {
 function hasFlag(args, flag) {
     return args.includes(flag);
 }
+/** The command overview printed by `glirastes --help`. */
+export const CLI_USAGE = 'Usage: glirastes init [--agent codex|claude] [--root] [--dry-run] [--json]\n'
+    + '         start integration with your existing coding agent\n'
+    + '       glirastes init --ci github [--enrich-on <branch,...>] [--enrich-on-main] [--ci-environment <name>] [--force] [--root] [--json]\n'
+    + '         write the GitHub workflow: model-free tool check, Pro managed tool job\n'
+    + '       glirastes setup [--dry-run] [--managed] [--json]\n'
+    + '         detect, validate and atomically install local artifacts\n'
+    + '       glirastes connect [--base-url <url>] [--json]\n'
+    + '         pair an existing local setup with the Platform (--base-url or GLIRASTES_CONTROL_PLANE_URL only for self-hosted)\n'
+    + '       glirastes sync [--json]\n'
+    + '         upload the current local setup without reassessment\n'
+    + '       glirastes setup guided [options]\n'
+    + '         run the legacy interactive setup interview\n'
+    + '       glirastes setup inspect [--root] [--json]\n'
+    + '         inspect local manifests before app integration\n'
+    + '       glirastes setup <scan|sync|status> [options]\n'
+    + '         the same steps, one at a time\n'
+    + '       glirastes scan [--output] [--sync] [--execution-inventory]\n'
+    + '       glirastes install [--host a,b] [--symlink] [--force] '
+    + '[--dry-run]\n'
+    + '       glirastes validate [--root] [--app-id]\n'
+    + '       glirastes doctor [--root] [--managed] [--json] [--verbose]\n'
+    + '       glirastes build [--root] [--app-id] [--output]\n'
+    + '       glirastes tools <refresh|check|status|resolve|describe|eval|policy|verify|enrich> [options]\n'
+    + '         derive chat tools from the code, check them, show them and print agent work lists\n';
+const HELP_FLAGS = new Set(['--help', '-h', 'help']);
+/** The usage entries of one command, cut out of the overview (an entry is its line plus indented notes). */
+function commandUsage(command) {
+    const entries = [];
+    for (const line of CLI_USAGE.trimEnd().split('\n')) {
+        if (/^(Usage:|\s{7})\s*glirastes /.test(line))
+            entries.push([line]);
+        else
+            entries.at(-1)?.push(line);
+    }
+    const mine = entries.filter((entry) => new RegExp(`glirastes ${command}( |$)`).test(entry[0]));
+    return mine.flat().map((line) => line.replace(/^Usage: /, '')).join('\n');
+}
+const VERSION_FLAGS = new Set(['--version', '-v']);
+/** Version of the installed glirastes package (src/cli and dist/cli both sit two levels below it). */
+function packageVersion() {
+    const manifest = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8'));
+    return manifest.version;
+}
 function parseCommand(args) {
     const [command, ...rest] = args;
-    const validCommands = [
-        'generate',
-        'validate',
-        'generate-tools',
-        'generate-endpoint-tools',
-        'generate-ui-tools',
-        'generate-modules',
-        'generate-skills',
-        'generate-mcp-server',
-        'generate-auto',
-        'install-skills',
-        'validate-tools',
-        'coverage',
-        'scaffold',
-        'test',
-        'check-upgrade',
-        'sync',
-    ];
-    if (!command || !validCommands.includes(command)) {
-        throw new Error(`Usage: glirastes <command> [options]\n\nCommands:\n` +
-            `  generate              Generate endpoint tools from OpenAPI spec\n` +
-            `  validate              Validate OpenAPI spec\n` +
-            `  generate-tools        Generate all registries (endpoint + UI + modules)\n` +
-            `  generate-endpoint-tools  Generate endpoint tool registry\n` +
-            `  generate-ui-tools     Generate UI tool registry + action IDs\n` +
-            `  generate-modules      Generate module registry\n` +
-            `  generate-skills       Generate agent skill files (Claude Code / Codex) [--sync] [--remote]\n` +
-            `  generate-mcp-server   Generate MCP server project from tool definitions [--sync] [--remote]\n` +
-            `  generate-auto         Auto-detect best output format and generate\n` +
-            `  install-skills        Install bundled agent skills (default: ./.claude/skills) [-g/--global ~/.claude/skills] [--target <dir>] [--stack nextjs|nestjs|nextjs+nestjs|all] [--symlink] [--force] [--dry-run]\n` +
-            `  validate-tools        Validate AI tool configuration\n` +
-            `  coverage              Check AI tool coverage\n` +
-            `  scaffold              Scaffold ai-tool.ts from route.ts\n` +
-            `  test                  Scaffold AI behavior test file\n` +
-            `  check-upgrade         Analyze upgrade gaps from release notes (--from-version)\n` +
-            `  sync                  Sync tool schemas to Glirastes platform\n`);
-    }
-    return { command: command, rest };
-}
-export async function runCli(args) {
-    const { command, rest } = parseCommand(args);
-    // OpenAPI commands — lazy-load openapi-gen to avoid requiring it at startup
-    if (command === 'validate') {
-        const { validateOpenApiFile } = await import('../openapi/index.js');
-        const inputPath = getFlagValue(rest, '--input');
-        if (!inputPath)
-            throw new Error('--input is required.');
-        const validation = await validateOpenApiFile({ inputPath });
-        for (const warning of validation.warnings)
-            console.warn(warning);
-        if (validation.errors.length > 0) {
-            throw new Error(`OpenAPI validation failed:\n${validation.errors.join('\n')}`);
-        }
-        console.log(`OpenAPI valid. Enabled AI tools: ${validation.enabledTools}. Warnings: ${validation.warnings.length}.`);
-        return;
+    if (command === undefined || HELP_FLAGS.has(command))
+        return { command: 'help', rest };
+    if (VERSION_FLAGS.has(command))
+        return { command: 'version', rest };
+    if (command !== 'init'
+        && command !== 'scan'
+        && command !== 'setup'
+        && command !== 'connect'
+        && command !== 'sync'
+        && command !== 'doctor'
+        && command !== 'install'
+        && command !== 'validate'
+        && command !== 'build'
+        && command !== 'tools') {
+        throw new FoundationDiagnosticError({
+            code: 'E-SETUP-030',
+            operation: 'cli',
+            message: `Unknown command '${command}'.`,
+            remediation: 'Run glirastes --help to list the commands.',
+        });
     }
-    if (command === 'generate') {
-        const { generateFromOpenApiFile } = await import('../openapi/index.js');
-        const inputPath = getFlagValue(rest, '--input');
-        const outputPath = getFlagValue(rest, '--output');
-        if (!inputPath)
-            throw new Error('--input is required.');
-        if (!outputPath)
-            throw new Error('--output is required for generate.');
-        const validation = await generateFromOpenApiFile({ inputPath, outputPath });
-        for (const warning of validation.warnings)
-            console.warn(warning);
-        console.log(`Generated endpoint tools at ${outputPath}`);
-        console.log(`Enabled AI tools: ${validation.enabledTools}. Warnings: ${validation.warnings.length}.`);
-        return;
+    return { command, rest };
+}
+async function terminalAsk(question) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new Error('Interactive input is unavailable. Pass --with-setup-skills or '
+            + '--without-setup-skills and --host when required.');
     }
-    // Project-based commands — need rootDir
-    const rootDir = getFlagValue(rest, '--root') ?? process.cwd();
-    const quiet = hasFlag(rest, '--quiet');
-    const ci = hasFlag(rest, '--ci');
-    // Read glirastes config from package.json (supports monorepo scan/output config)
-    const { readFileSync, existsSync } = await import('node:fs');
-    const { join } = await import('node:path');
-    const pkgJsonPath = join(rootDir, 'package.json');
-    let glirastesConfig = {};
+    const prompt = createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
     try {
-        const pkg = JSON.parse(readFileSync(pkgJsonPath, 'utf-8'));
-        glirastesConfig = (pkg.glirastes ?? {});
+        return await prompt.question(question);
     }
-    catch {
-        // No package.json or no glirastes field — use defaults
+    finally {
+        prompt.close();
     }
-    // Derive nestjsDirs from scan config: dirs that contain NestJS controllers
-    const nestjsDirs = (glirastesConfig.scan ?? [])
-        .map(d => join(rootDir, d))
-        .filter(d => existsSync(d));
-    const options = {
-        rootDir,
-        quiet,
-        outputDir: glirastesConfig.output,
-        apiDir: glirastesConfig.apiDir,
-        componentsDir: glirastesConfig.componentsDir,
-        nestjsDirs: nestjsDirs.length > 0 ? nestjsDirs : undefined,
-        nestjsApiPrefix: glirastesConfig.nestjsApiPrefix,
-    };
-    if (command === 'generate-tools') {
-        const metaPath = getFlagValue(rest, '--meta');
-        const generateOpts = options;
-        await generateEndpointRegistry(generateOpts);
-        await generateUiRegistry(generateOpts);
-        await generateActionIdRegistry(generateOpts);
-        // Only generate modules if there are tools with module metadata
-        try {
-            await generateModuleRegistry(generateOpts, metaPath);
-        }
-        catch {
-            if (!quiet)
-                console.log('\u2139 Module generation skipped (no module metadata found)');
+}
+function parseHost(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === 'codex' || value === 'claude' || value === 'gemini') {
+        return value;
+    }
+    throw new Error('Choose a host: codex, claude, or gemini.');
+}
+/** `--host claude,codex` — several agent hosts share one install. */
+function parseHosts(value) {
+    if (value === undefined)
+        return undefined;
+    const hosts = value
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter(Boolean)
+        .map((entry) => {
+        const parsed = parseHost(entry);
+        if (!parsed)
+            throw new Error('Choose a host: codex, claude, or gemini.');
+        return parsed;
+    });
+    return hosts.length > 0 ? [...new Set(hosts)] : undefined;
+}
+async function runInstall(rest, dependencies) {
+    if (hasFlag(rest, '--with-setup-skills')
+        && hasFlag(rest, '--without-setup-skills')) {
+        throw new Error('Choose either --with-setup-skills or --without-setup-skills.');
+    }
+    const ask = dependencies.ask ?? terminalAsk;
+    let includeSetupSkills = hasFlag(rest, '--with-setup-skills');
+    if (!includeSetupSkills
+        && !hasFlag(rest, '--without-setup-skills')) {
+        const consent = (await ask('Install the optional local Glirastes setup skills? [y/N] ')).trim().toLowerCase();
+        if (!['y', 'yes', 'n', 'no', ''].includes(consent)) {
+            throw new Error('Answer yes or no for setup skills.');
         }
-        // Run coverage and validation
-        const report = await checkAiCoverage(generateOpts);
-        console.log(formatCoverageReport(report, { quiet }));
-        const validation = await validateAiTools(generateOpts);
-        if (validation.issues.length > 0) {
-            console.log(formatValidationReport(validation, { quiet }));
+        includeSetupSkills = consent === 'y' || consent === 'yes';
+    }
+    let hosts = parseHosts(getFlagValue(rest, '--host'));
+    if (includeSetupSkills && !hosts) {
+        hosts = parseHosts((await ask('Choose the setup hosts (codex, claude, gemini; comma-separated): ')).trim().toLowerCase());
+    }
+    await installSkills({
+        rootDir: getFlagValue(rest, '--root') ?? process.cwd(),
+        target: getFlagValue(rest, '--target'),
+        global: hasFlag(rest, '--global'),
+        symlink: hasFlag(rest, '--symlink'),
+        force: hasFlag(rest, '--force'),
+        dryRun: hasFlag(rest, '--dry-run'),
+        includeSetupSkills,
+        hosts,
+    });
+}
+function setupConnection(rest) {
+    const baseUrl = getFlagValue(rest, '--base-url')
+        ?? process.env.GLIRASTES_CONTROL_PLANE_URL;
+    const appId = getFlagValue(rest, '--app-id')
+        ?? process.env.GLIRASTES_APP_ID;
+    // One key, one variable: GLIRASTES_API_KEY.
+    const setupApiKey = process.env.GLIRASTES_API_KEY;
+    if (!baseUrl) {
+        throw new FoundationDiagnosticError({
+            code: 'E-SETUP-001',
+            operation: 'setup.connection',
+            message: 'GLIRASTES_CONTROL_PLANE_URL is not configured for setup.',
+            remediation: 'configure-control-plane-url',
+        });
+    }
+    if (!appId) {
+        throw new FoundationDiagnosticError({
+            code: 'E-SCOPE-001',
+            operation: 'setup.connection',
+            message: 'GLIRASTES_APP_ID is not configured for setup.',
+            remediation: 'configure-app-id',
+        });
+    }
+    if (!setupApiKey) {
+        throw new FoundationDiagnosticError({
+            code: 'E-SETUP-002',
+            operation: 'setup.connection',
+            message: 'GLIRASTES_API_KEY is not configured for setup.',
+            remediation: 'configure-app-api-key',
+        });
+    }
+    return { baseUrl, appId, setupApiKey };
+}
+/**
+ * Explicit `glirastes setup guided` legacy interview. It delegates to the same
+ * steps the subcommands expose and adds no second implementation of them.
+ */
+async function runSetupWizardCommand(rest) {
+    const rootDir = resolve(getFlagValue(rest, '--root') ?? process.cwd());
+    try {
+        const artifactPath = artifactPathFrom(rest);
+        if (existsSync(join(rootDir, artifactPath))) {
+            const plan = await createSetupPlan({
+                rootDir,
+                artifactPath,
+                previousArtifactPath: getFlagValue(rest, '--previous-artifact'),
+            });
+            assertSetupPlanConfirmation(plan, {
+                confirmLoosening: hasFlag(rest, '--confirm-loosening'),
+                planDigest: getFlagValue(rest, '--plan-digest'),
+            });
         }
-        if (ci && !validation.passed) {
-            process.exit(1);
+        await runSetupWizard({
+            rootDir,
+            io: {
+                isInteractive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+                log: (message) => { console.log(message); },
+                ask: terminalAsk,
+            },
+            hosts: parseHosts(getFlagValue(rest, '--host')),
+            assessmentMode: parseAssessmentMode(getFlagValue(rest, '--assessment')),
+            deps: {
+                ...defaultWizardDependencies(),
+                discover: async (root) => {
+                    await runSetup(['scan', '--root', root, '--quiet']);
+                    const discovery = JSON.parse(readFileSync(join(root, '.glirastes/setup-discovery.json'), 'utf8'));
+                    return { executionCount: discovery.executions?.length ?? 0 };
+                },
+                assessmentArtifactExists: async (root) => existsSync(join(root, artifactPathFrom(rest))),
+                validate: async (root) => {
+                    const appId = getFlagValue(rest, '--app-id');
+                    if (!appId) {
+                        throw new Error('--app-id is required to validate the workspace.');
+                    }
+                    await validateWorkspace({ rootDir: root, appId });
+                },
+                sync: async (root) => {
+                    const run = await syncExplicitSetupArtifact(root, [
+                        ...rest,
+                        '--artifact', artifactPathFrom(rest),
+                    ]);
+                    return { runId: run.runId };
+                },
+            },
+        });
+    }
+    catch (error) {
+        if (error instanceof WizardStopped) {
+            process.exitCode = 1;
+            return;
         }
-        return;
+        throw error;
     }
-    if (command === 'generate-endpoint-tools') {
-        await generateEndpointRegistry(options);
-        return;
+}
+/** Preserve the guided interview's explicit assessed-artifact upload path. */
+async function syncExplicitSetupArtifact(rootDir, options) {
+    const artifactPath = getFlagValue(options, '--artifact');
+    if (!artifactPath) {
+        throw new Error('--artifact is required for setup sync.');
     }
-    if (command === 'generate-ui-tools') {
-        await generateUiRegistry(options);
-        await generateActionIdRegistry(options);
-        return;
+    const artifact = AppSetupArtifactSchema.parse(JSON.parse(readFileSync(resolve(rootDir, artifactPath), 'utf8')));
+    const connection = setupConnection(options);
+    if (artifact.appId !== connection.appId) {
+        throw new Error('App setup artifact targets a different app');
+    }
+    const client = new AppSetupClient(connection);
+    await client.createRun({
+        runId: artifact.runId,
+        assessmentMode: artifact.assessmentMode,
+        discoveryDigest: artifact.discoveryDigest,
+    });
+    return client.uploadArtifact(artifact);
+}
+function artifactPathFrom(rest) {
+    return getFlagValue(rest, '--artifact')
+        ?? '.glirastes/app-setup-artifact.json';
+}
+function parseAssessmentMode(value) {
+    if (value === undefined)
+        return undefined;
+    if (value !== 'interview'
+        && value !== 'autonomous'
+        && value !== 'manual') {
+        throw new Error(`Unknown --assessment value: '${value}'. `
+            + 'Use interview, autonomous, or manual.');
     }
-    if (command === 'generate-modules') {
-        const metaPath = getFlagValue(rest, '--meta');
-        await generateModuleRegistry(options, metaPath);
+    return value;
+}
+async function runSetup(rest, dependencies = {}) {
+    if (rest[0] === 'inspect') {
+        const inspection = await inspectSetupProject(getFlagValue(rest, '--root') ?? process.cwd());
+        console.log(hasFlag(rest, '--json')
+            ? JSON.stringify(inspection)
+            : formatSetupProjectInspection(inspection));
         return;
     }
-    if (command === 'generate-skills') {
-        const appName = getFlagValue(rest, '--app-name');
-        const baseUrl = getFlagValue(rest, '--base-url');
-        const authType = getFlagValue(rest, '--auth') ?? 'bearer';
-        const tokenEnvVar = getFlagValue(rest, '--token-env') ?? 'API_TOKEN';
-        const format = getFlagValue(rest, '--format'); // markdown, json, or both (default)
-        const outputDir = getFlagValue(rest, '--output-dir');
-        if (!appName)
-            throw new Error('--app-name is required for generate-skills.');
-        if (!baseUrl)
-            throw new Error('--base-url is required for generate-skills.');
-        const authStrategy = buildAuthStrategy(authType, tokenEnvVar, rest);
-        const formats = format === 'markdown' ? ['markdown'] :
-            format === 'json' ? ['json'] :
-                ['markdown', 'json'];
-        const skillConfig = { appName, baseUrl, auth: authStrategy };
-        const result = await generateAgentSkills({
-            ...options,
-            skillConfig,
-            formats,
-            skillOutputDir: outputDir,
+    if (hasFlag(rest, '--dry-run')) {
+        const rootDir = resolve(getFlagValue(rest, '--root') ?? process.cwd());
+        const plan = await createSetupPlan({
+            rootDir,
+            artifactPath: getFlagValue(rest, '--artifact'),
+            previousArtifactPath: getFlagValue(rest, '--previous-artifact'),
+            inventoryPath: getFlagValue(rest, '--execution-inventory'),
+            promptBundlePath: getFlagValue(rest, '--prompt-bundle'),
+            managed: hasFlag(rest, '--managed'),
         });
-        const remote = hasFlag(rest, '--remote');
-        const shouldSync = rest.includes('--sync') || remote;
-        if (shouldSync) {
-            const apiKey = getFlagValue(rest, '--glirastes-key') ?? process.env.GLIRASTES_API_KEY;
-            const glirasterUrl = getFlagValue(rest, '--glirastes-url') ?? process.env.GLIRASTES_URL ?? 'https://api.glirastes.chainmatics.io';
-            if (!apiKey) {
-                console.warn('⚠ --sync/--remote requires GLIRASTES_API_KEY or --glirastes-key');
-            }
-            else {
-                const syncResult = await syncAssetToGlirastes({
-                    apiKey,
-                    glirasterUrl,
-                    name: appName,
-                    type: 'skill',
-                    version: '1.0.0',
-                    toolCount: result.toolCount,
-                    config: { appName, baseUrl, auth: authStrategy },
-                    toolManifest: { tools: result.tools },
-                });
-                console.log(`✓ Synced to Glirastes: skill "${appName}" (${syncResult.action})`);
-                if (remote) {
-                    const generateRes = await fetch(`${glirasterUrl}/v1/registry/assets/${syncResult.assetId}/generate`, {
-                        method: 'POST',
-                        headers: { 'x-api-key': apiKey, 'Content-Type': 'application/json' },
-                    });
-                    if (!generateRes.ok) {
-                        console.warn(`⚠ Remote generation failed (${generateRes.status})`);
-                    }
-                    else {
-                        const genResult = await generateRes.json();
-                        console.log(`✓ Remote generation complete: v${genResult.version}, ${genResult.files.length} files`);
-                    }
-                }
-            }
+        if (hasFlag(rest, '--json')) {
+            console.log(JSON.stringify(plan));
         }
-        if (remote) {
-            console.log(`✓ Remote generation triggered for skill "${appName}"`);
-            return;
+        else {
+            console.log(`Setup plan ${plan.planDigest}: ${plan.operations.length} operations, `
+                + `${plan.counts.tools} tools, confirmation `
+                + `${plan.requiresConfirmation ? 'required' : 'not required'}.`);
         }
         return;
     }
-    if (command === 'generate-mcp-server') {
-        const { writeFile, mkdir } = await import('node:fs/promises');
-        const { join, dirname } = await import('node:path');
-        const appName = getFlagValue(rest, '--app-name');
-        const baseUrl = getFlagValue(rest, '--base-url');
-        const authType = getFlagValue(rest, '--auth') ?? 'bearer';
-        const tokenEnvVar = getFlagValue(rest, '--token-env') ?? 'API_TOKEN';
-        const outputDir = getFlagValue(rest, '--output-dir') ?? 'mcp-server';
-        if (!appName)
-            throw new Error('--app-name is required for generate-mcp-server.');
-        if (!baseUrl)
-            throw new Error('--base-url is required for generate-mcp-server.');
-        const authStrategy = buildAuthStrategy(authType, tokenEnvVar, rest);
-        const result = await generateMcpServer({
-            ...options,
-            skillConfig: { appName, baseUrl, auth: authStrategy },
-            mcpOutputDir: outputDir,
+    if (isWizardInvocation(rest)) {
+        await runSetupWizardCommand(rest.slice(1));
+        return;
+    }
+    if (rest[0] === undefined || rest[0]?.startsWith('--')) {
+        const rootDir = resolve(getFlagValue(rest, '--root') ?? process.cwd());
+        const plan = await createSetupPlan({
+            rootDir,
+            artifactPath: getFlagValue(rest, '--artifact'),
+            previousArtifactPath: getFlagValue(rest, '--previous-artifact'),
+            inventoryPath: getFlagValue(rest, '--execution-inventory'),
+            promptBundlePath: getFlagValue(rest, '--prompt-bundle'),
+            managed: hasFlag(rest, '--managed'),
+        });
+        assertSetupPlanConfirmation(plan, {
+            confirmLoosening: hasFlag(rest, '--confirm-loosening'),
+            planDigest: getFlagValue(rest, '--plan-digest'),
+        });
+        const applied = await applySetupPlan({
+            rootDir,
+            plan,
+            artifactPath: getFlagValue(rest, '--artifact'),
+            previousArtifactPath: getFlagValue(rest, '--previous-artifact'),
+            inventoryPath: getFlagValue(rest, '--execution-inventory'),
+            promptBundlePath: getFlagValue(rest, '--prompt-bundle'),
         });
-        const remote = hasFlag(rest, '--remote');
-        // Write generated files to disk (skip when --remote)
-        if (!remote) {
-            for (const file of result.files) {
-                const fullPath = join(rootDir, file.path);
-                await mkdir(dirname(fullPath), { recursive: true });
-                await writeFile(fullPath, file.content, 'utf-8');
-                if (!quiet)
-                    console.log(`  wrote ${file.path}`);
-            }
-            if (!quiet) {
-                console.log(`\nMCP server generated: ${result.toolCount} tools across ${result.modulesUsed.length} modules`);
-            }
+        if (applied.mode === 'managed') {
+            await runSync({ rootDir, quiet: true }, dependencies.sync);
         }
-        const shouldSync = rest.includes('--sync') || remote;
-        if (shouldSync) {
-            const apiKey = getFlagValue(rest, '--glirastes-key') ?? process.env.GLIRASTES_API_KEY;
-            const glirasterUrl = getFlagValue(rest, '--glirastes-url') ?? process.env.GLIRASTES_URL ?? 'https://api.glirastes.chainmatics.io';
-            if (!apiKey) {
-                console.warn('⚠ --sync/--remote requires GLIRASTES_API_KEY or --glirastes-key');
-            }
-            else {
-                const syncResult = await syncAssetToGlirastes({
-                    apiKey,
-                    glirasterUrl,
-                    name: appName,
-                    type: 'mcp-server',
-                    version: '1.0.0',
-                    toolCount: result.toolCount,
-                    config: { appName, baseUrl, auth: authStrategy },
-                    toolManifest: { tools: result.tools, modules: result.modulesUsed },
-                });
-                console.log(`✓ Synced to Glirastes: mcp-server "${appName}" (${syncResult.action})`);
-                if (remote) {
-                    const generateRes = await fetch(`${glirasterUrl}/v1/registry/assets/${syncResult.assetId}/generate`, {
-                        method: 'POST',
-                        headers: { 'x-api-key': apiKey, 'Content-Type': 'application/json' },
-                    });
-                    if (!generateRes.ok) {
-                        console.warn(`⚠ Remote generation failed (${generateRes.status})`);
-                    }
-                    else {
-                        const genResult = await generateRes.json();
-                        console.log(`✓ Remote generation complete: v${genResult.version}, ${genResult.files.length} files`);
-                    }
-                }
-            }
+        if (hasFlag(rest, '--json')) {
+            console.log(JSON.stringify({ schemaVersion: 1, ...applied }));
         }
-        if (remote) {
-            console.log(`✓ Remote generation triggered for mcp-server "${appName}"`);
+        else {
+            console.log('Glirastes setup');
+            console.log(`  ${applied.toolCount} tools validated`);
+            console.log(`  ${applied.mode === 'standalone' ? 'Standalone' : 'Managed'} artifacts installed`);
+            console.log('  Security policy unchanged');
+            console.log('');
+            console.log('Restart the application, then run: glirastes doctor');
         }
         return;
     }
-    if (command === 'generate-auto') {
-        const { writeFile, mkdir } = await import('node:fs/promises');
-        const { join, dirname } = await import('node:path');
-        const appName = getFlagValue(rest, '--app-name');
-        const baseUrl = getFlagValue(rest, '--base-url');
-        const authType = getFlagValue(rest, '--auth') ?? 'bearer';
-        const tokenEnvVar = getFlagValue(rest, '--token-env') ?? 'API_TOKEN';
-        const skillOutputDir = getFlagValue(rest, '--skill-output-dir');
-        const mcpOutputDir = getFlagValue(rest, '--mcp-output-dir') ?? 'mcp-server';
-        if (!appName)
-            throw new Error('--app-name is required for generate-auto.');
-        if (!baseUrl)
-            throw new Error('--base-url is required for generate-auto.');
-        const authStrategy = buildAuthStrategy(authType, tokenEnvVar, rest);
-        const hasStreaming = hasFlag(rest, '--streaming');
-        const hasWebSocket = hasFlag(rest, '--websocket');
-        const multiAgentAccess = hasFlag(rest, '--multi-agent');
-        const toolCountStr = getFlagValue(rest, '--tool-count');
-        const toolCount = toolCountStr ? parseInt(toolCountStr, 10) : undefined;
-        const recommendation = recommendOutputFormat({
-            auth: authStrategy,
-            hasStreaming,
-            hasWebSocket,
-            multiAgentAccess,
-            toolCount,
+    const [subcommand, ...options] = rest;
+    const rootDir = getFlagValue(options, '--root') ?? process.cwd();
+    const quiet = hasFlag(options, '--quiet');
+    if (subcommand === 'scan') {
+        const inventoryPath = resolve(rootDir, getFlagValue(options, '--execution-inventory')
+            ?? '.glirastes/local-execution-inventory.v2.json');
+        const inventory = FoundationExecutionInventorySchema.parse(JSON.parse(readFileSync(inventoryPath, 'utf8')));
+        const discovery = await discoverFoundationExecutions({
+            rootDir,
+            inventory,
         });
+        const outputPath = resolve(rootDir, getFlagValue(options, '--output')
+            ?? '.glirastes/setup-discovery.json');
+        mkdirSync(dirname(outputPath), { recursive: true });
+        writeFileSync(outputPath, `${JSON.stringify(discovery, null, 2)}\n`, 'utf8');
         if (!quiet) {
-            console.log(`Auto-detected format: ${recommendation.format}`);
-            console.log(`  Reason: ${recommendation.reason}`);
-            console.log('');
-        }
-        const skillConfig = { appName, baseUrl, auth: authStrategy };
-        if (recommendation.format === 'skill' || recommendation.format === 'both') {
-            await generateAgentSkills({
-                ...options,
-                skillConfig,
-                formats: ['markdown', 'json'],
-                skillOutputDir,
-            });
-        }
-        if (recommendation.format === 'mcp' || recommendation.format === 'both') {
-            const result = await generateMcpServer({
-                ...options,
-                skillConfig,
-                mcpOutputDir,
-            });
-            // Write generated MCP files to disk
-            for (const file of result.files) {
-                const fullPath = join(rootDir, file.path);
-                await mkdir(dirname(fullPath), { recursive: true });
-                await writeFile(fullPath, file.content, 'utf-8');
-                if (!quiet)
-                    console.log(`  wrote ${file.path}`);
-            }
+            console.log(`Discovered ${discovery.executions.length} local executions to `
+                + outputPath);
         }
         return;
     }
-    if (command === 'validate-tools') {
-        const showFix = hasFlag(rest, '--fix');
-        const validation = await validateAiTools(options);
-        console.log(formatValidationReport(validation, { quiet, showFix }));
-        if (ci && !validation.passed) {
-            process.exit(1);
-        }
+    if (subcommand === 'sync') {
+        await runSync({
+            rootDir,
+            json: hasFlag(options, '--json'),
+            quiet,
+        }, dependencies.sync);
         return;
     }
-    if (command === 'coverage') {
-        const report = await checkAiCoverage(options);
-        console.log(formatCoverageReport(report, { quiet }));
-        if (ci) {
-            const hasIssues = report.routeCoveragePercent < 100 ||
-                report.componentCoveragePercent < 100 ||
-                report.missingHandlers.length > 0;
-            if (hasIssues)
-                process.exit(1);
+    const connection = setupConnection(options);
+    const client = new AppSetupClient(connection);
+    if (subcommand === 'status') {
+        const runId = getFlagValue(options, '--run-id');
+        if (!runId) {
+            throw new Error('--run-id is required for setup status.');
+        }
+        const run = await client.getRun(runId);
+        if (!quiet) {
+            console.log(`Setup run ${run.runId}: ${run.status}`);
         }
         return;
     }
-    if (command === 'scaffold') {
-        const routeFile = getFlagValue(rest, '--route');
-        if (!routeFile)
-            throw new Error('--route is required for scaffold.');
-        const force = hasFlag(rest, '--force');
-        const dryRun = hasFlag(rest, '--dry-run');
-        const result = await scaffoldAiTool({
-            routeFile,
-            rootDir,
-            force,
-            dryRun,
+    const run = await syncExplicitSetupArtifact(rootDir, options);
+    if (!quiet) {
+        console.log(`Synced setup run ${run.runId}: ${run.status}`);
+    }
+}
+async function runLegacyScan(rest) {
+    const rootDir = getFlagValue(rest, '--root') ?? process.cwd();
+    const quiet = hasFlag(rest, '--quiet');
+    let config = {};
+    try {
+        const packageJson = JSON.parse(readFileSync(resolve(rootDir, 'package.json'), 'utf8'));
+        config = packageJson.glirastes ?? {};
+    }
+    catch {
+        // The scanner defaults cover projects without package metadata.
+    }
+    const artifact = await writeNextAppRouteScan({
+        rootDir,
+        apiDir: config.apiDir,
+        outputPath: getFlagValue(rest, '--output'),
+    });
+    if (!quiet) {
+        console.log(`Scanned ${artifact.result.candidates.length} route operations to `
+            + artifact.outputPath);
+    }
+    if (!hasFlag(rest, '--sync'))
+        return;
+    if (artifact.result.findings?.length) {
+        throw new FoundationDiagnosticError({
+            code: 'E-INVENTORY-001',
+            operation: 'scan.sync',
+            message: 'Route scan is incomplete. Review findings in the local scan artifact before syncing.',
+            remediation: 'resolve-route-scan-findings',
         });
-        console.log(formatScaffoldResult(result, { dryRun, rootDir }));
+    }
+    const baseUrl = getFlagValue(rest, '--base-url')
+        ?? process.env.GLIRASTES_CONTROL_PLANE_URL;
+    const appId = getFlagValue(rest, '--app-id')
+        ?? process.env.GLIRASTES_APP_ID;
+    const environmentId = getFlagValue(rest, '--environment-id')
+        ?? process.env.GLIRASTES_ENVIRONMENT_ID;
+    const apiKey = process.env.GLIRASTES_SETUP_API_KEY;
+    if (!baseUrl) {
+        throw new Error('--base-url or GLIRASTES_CONTROL_PLANE_URL is required for scan --sync.');
+    }
+    if (!appId) {
+        throw new Error('--app-id or GLIRASTES_APP_ID is required for scan --sync.');
+    }
+    if (!environmentId) {
+        throw new Error('--environment-id or GLIRASTES_ENVIRONMENT_ID is required for scan --sync.');
+    }
+    if (!apiKey) {
+        throw new Error('GLIRASTES_SETUP_API_KEY is required for scan --sync.');
+    }
+    const scan = JSON.parse(readFileSync(artifact.outputPath, 'utf8'));
+    const executionInventoryPath = getFlagValue(rest, '--execution-inventory');
+    if (executionInventoryPath) {
+        scan.executions = parseLocalExecutionInventory(JSON.parse(readFileSync(resolve(rootDir, executionInventoryPath), 'utf8'))).executions;
+    }
+    const imported = await new RuntimeSetupClient({
+        baseUrl,
+        apiKey,
+        appId,
+        environmentId,
+    }).importRouteScan(scan);
+    const bindingsOutput = resolve(rootDir, getFlagValue(rest, '--bindings-output')
+        ?? '.glirastes/platform-tool-bindings.json');
+    mkdirSync(dirname(bindingsOutput), { recursive: true });
+    writeFileSync(bindingsOutput, `${JSON.stringify({
+        schemaVersion: 1,
+        targetAppId: appId,
+        environmentId,
+        bindings: [...imported.bindings].sort((left, right) => (left.stableKey.localeCompare(right.stableKey))),
+    }, null, 2)}\n`, 'utf8');
+    if (!quiet) {
+        console.log(`Imported ${imported.createdDrafts} review drafts; `
+            + `${imported.unchanged} unchanged; `
+            + `${imported.tombstoneCandidates.length} tombstone candidates.`);
+        console.log(`Wrote authoritative tool bindings to ${bindingsOutput}.`);
+    }
+}
+async function runValidate(rest) {
+    const rootDir = getFlagValue(rest, '--root') ?? process.cwd();
+    const appId = getFlagValue(rest, '--app-id') ?? process.env.GLIRASTES_APP_ID;
+    if (!appId) {
+        throw new FoundationDiagnosticError({
+            code: 'E-SCOPE-001',
+            operation: 'validate.scope',
+            message: 'GLIRASTES_APP_ID is not configured for validation.',
+            remediation: 'configure-app-id',
+        });
+    }
+    const workspace = await validateWorkspace({
+        rootDir,
+        appId,
+        inventoryPath: getFlagValue(rest, '--execution-inventory'),
+        promptBundlePath: getFlagValue(rest, '--prompt-bundle'),
+    });
+    if (!hasFlag(rest, '--quiet')) {
+        console.log(`Validated ${workspace.executions.length} executions and the local `
+            + 'prompt bundle without network access.');
+    }
+}
+async function runBuild(rest) {
+    const rootDir = getFlagValue(rest, '--root') ?? process.cwd();
+    const appId = getFlagValue(rest, '--app-id') ?? process.env.GLIRASTES_APP_ID;
+    if (!appId) {
+        throw new Error('--app-id or GLIRASTES_APP_ID is required for build.');
+    }
+    const built = await buildManifests({
+        rootDir,
+        appId,
+        outputDir: getFlagValue(rest, '--output'),
+        inventoryPath: getFlagValue(rest, '--execution-inventory'),
+        promptBundlePath: getFlagValue(rest, '--prompt-bundle'),
+    });
+    if (!hasFlag(rest, '--quiet')) {
+        console.log(`Runtime manifest ${built.runtimeDigest}`);
+        console.log(`Prompt manifest  ${built.promptDigest}`);
+    }
+}
+export async function runCli(args, dependencies = {}) {
+    const { command, rest } = parseCommand(args);
+    if (command === 'help') {
+        console.log(CLI_USAGE.trimEnd());
         return;
     }
-    if (command === 'test') {
-        const { scaffoldTestFile } = await import('./commands/test.js');
-        const outputPath = getFlagValue(rest, '--output');
-        const force = hasFlag(rest, '--force');
-        const dryRun = hasFlag(rest, '--dry-run');
-        await scaffoldTestFile({ rootDir, outputPath, force, dryRun });
+    if (command === 'version') {
+        console.log(packageVersion());
         return;
     }
-    if (command === 'check-upgrade') {
-        const { checkUpgrade } = await import('./commands/check-upgrade.js');
-        const fromVersion = getFlagValue(rest, '--from-version');
-        await checkUpgrade({ rootDir, fromVersion });
+    if (rest.some((arg) => arg === '--help' || arg === '-h')) {
+        // Every command answers --help/-h before it parses or writes anything.
+        console.log(commandUsage(command));
         return;
     }
-    if (command === 'install-skills') {
-        const { installSkills } = await import('./commands/install-skills.js');
-        const target = getFlagValue(rest, '--target');
-        const stackRaw = getFlagValue(rest, '--stack') ?? 'all';
-        const validStacks = ['nextjs', 'nestjs', 'nextjs+nestjs', 'all'];
-        if (!validStacks.includes(stackRaw)) {
-            throw new Error(`Invalid --stack value '${stackRaw}'. Use one of: ${validStacks.join(' | ')}.`);
+    if (command === 'init') {
+        const ci = getFlagValue(rest, '--ci');
+        if (ci !== undefined) {
+            // CI setup is its own step: the workflow lands once the app is set up.
+            const written = await writeCiWorkflow({
+                root: resolve(getFlagValue(rest, '--root') ?? process.cwd()),
+                provider: ci,
+                enrichOnMain: hasFlag(rest, '--enrich-on-main'),
+                enrichOn: (getFlagValue(rest, '--enrich-on') ?? '').split(',').map((branch) => branch.trim()).filter(Boolean),
+                ...(getFlagValue(rest, '--ci-environment') !== undefined ? { environment: getFlagValue(rest, '--ci-environment') } : {}),
+                force: hasFlag(rest, '--force'),
+            });
+            console.log(hasFlag(rest, '--json') ? JSON.stringify(written) : `${written.path}: ${written.status}`);
+            return;
         }
-        const globalMode = hasFlag(rest, '--global') || hasFlag(rest, '-g');
-        const symlinkMode = hasFlag(rest, '--symlink');
-        const force = hasFlag(rest, '--force');
-        const dryRun = hasFlag(rest, '--dry-run');
-        await installSkills({
-            target,
-            global: globalMode,
-            stack: stackRaw,
-            symlink: symlinkMode,
-            force,
-            dryRun,
-            rootDir,
-        });
+        await runAgentSetup({
+            rootDir: getFlagValue(rest, '--root') ?? process.cwd(),
+            agent: getFlagValue(rest, '--agent'), dryRun: hasFlag(rest, '--dry-run'),
+            json: hasFlag(rest, '--json'), managed: hasFlag(rest, '--managed'),
+        }, { ask: terminalAsk, ...dependencies.init });
+        return;
+    }
+    if (command === 'tools') {
+        const exitCode = await runToolsCommand(rest, dependencies.tools);
+        if (exitCode !== 0)
+            process.exitCode = exitCode;
+        return;
+    }
+    if (command === 'connect') {
+        await runConnect({
+            rootDir: resolve(getFlagValue(rest, '--root') ?? process.cwd()),
+            baseUrl: getFlagValue(rest, '--base-url'),
+            json: hasFlag(rest, '--json'),
+        }, dependencies.connect);
         return;
     }
-    // Sync tool schemas to Glirastes platform
     if (command === 'sync') {
-        const apiKey = getFlagValue(rest, '--api-key') ?? process.env.GLIRASTES_API_KEY ?? process.env.CHAINMATICS_API_KEY;
-        const baseUrl = getFlagValue(rest, '--url') ?? process.env.GLIRASTES_URL ?? 'https://api.glirastes.chainmatics.io';
-        if (!apiKey) {
-            throw new Error('API key required. Use --api-key or set GLIRASTES_API_KEY env var.');
-        }
-        const { scanEndpointTools, scanUiTools } = await import('../codegen/index.js');
-        const { readFile } = await import('fs/promises');
-        // Collect all tools (endpoint + UI)
-        const tools = [];
-        // --- Endpoint tools ---
-        const scanResult = await scanEndpointTools(options);
-        for (const file of scanResult.files) {
-            const content = await readFile(file.absolutePath, 'utf-8');
-            // Match defineEndpointTool({ id: '...' }) or defineAiEndpointTool({ id: '...' })
-            const idMatches = content.matchAll(/define(?:Ai)?EndpointTool\(\s*\{[^}]*?id:\s*['"]([^'"]+)['"]/gs);
-            for (const match of idMatches) {
-                const toolId = match[1];
-                // Try to extract description
-                const descMatch = content.match(new RegExp(`id:\\s*['"]${toolId}['"][^}]*?description:\\s*['"]([^'"]+)['"]`, 's'));
-                // Try to extract allowedRoles array
-                const allowedRoles = extractAllowedRoles(content);
-                // Try to extract module
-                const moduleMatch = content.match(/module:\s*['"]([^'"]+)['"]/);
-                tools.push({
-                    toolId,
-                    version: '1.0.0',
-                    type: 'endpoint',
-                    schema: {},
-                    moduleId: moduleMatch?.[1] ?? undefined,
-                    metadata: {
-                        description: descMatch?.[1] ?? '',
-                        sourceFile: file.relativePath,
-                        allowedRoles,
-                    },
-                });
-            }
-            // Also match single tool: defineEndpointTool({ ... }) with withAiTool pattern
-            if (tools.length === 0 && file.exportType === 'single') {
-                const singleId = content.match(/id:\s*['"]([^'"]+)['"]/);
-                if (singleId) {
-                    const allowedRoles = extractAllowedRoles(content);
-                    const moduleMatch = content.match(/module:\s*['"]([^'"]+)['"]/);
-                    tools.push({
-                        toolId: singleId[1],
-                        version: '1.0.0',
-                        type: 'endpoint',
-                        schema: {},
-                        moduleId: moduleMatch?.[1] ?? undefined,
-                        metadata: {
-                            sourceFile: file.relativePath,
-                            allowedRoles,
-                        },
-                    });
-                }
-            }
-        }
-        // --- UI tools ---
-        const uiScanResult = await scanUiTools(options);
-        for (const file of uiScanResult.files) {
-            const content = await readFile(file.absolutePath, 'utf-8');
-            // Extract each toolName from defineUiTool / defineAiUiTool blocks
-            const toolNameMatches = content.matchAll(/toolName\s*:\s*['"]([^'"]+)['"]/g);
-            for (const match of toolNameMatches) {
-                const toolName = match[1];
-                const descMatch = content.match(/description\s*:\s*`([^`]+)`/s) ??
-                    content.match(/description\s*:\s*['"]([^'"]+)['"]/);
-                const allowedRoles = extractAllowedRoles(content);
-                const moduleMatch = content.match(/module:\s*['"]([^'"]+)['"]/);
-                tools.push({
-                    toolId: toolName,
-                    version: '1.0.0',
-                    type: 'ui',
-                    schema: {},
-                    moduleId: moduleMatch?.[1] ?? undefined,
-                    metadata: {
-                        description: descMatch?.[1]?.trim().slice(0, 200) ?? '',
-                        sourceFile: file.relativePath,
-                        allowedRoles,
-                    },
-                });
-            }
-        }
-        // --- NestJS @AiTool decorated controllers ---
-        if (options.nestjsDirs && options.nestjsDirs.length > 0) {
-            const { scanNestControllers } = await import('../codegen/index.js');
-            const nestResult = await scanNestControllers(options.nestjsDirs, options.nestjsApiPrefix ?? '/api');
-            for (const tool of nestResult.tools) {
-                tools.push({
-                    toolId: tool.name,
-                    version: '1.0.0',
-                    type: 'endpoint',
-                    schema: {},
-                    moduleId: tool.module ?? undefined,
-                    metadata: {
-                        description: tool.description?.slice(0, 200) ?? '',
-                        sourceFile: tool.controllerFile,
-                        allowedRoles: tool.allowedRoles ?? [],
-                        ...(tool.needsApproval ? { needsApproval: true } : {}),
-                    },
-                });
-            }
-        }
-        if (tools.length === 0) {
-            console.log('No tools found. Run "glirastes generate-tools" first.');
-            return;
-        }
-        const endpointCount = tools.filter(t => t.type === 'endpoint').length;
-        const uiCount = tools.filter(t => t.type === 'ui').length;
-        // POST to Glirastes Registry
-        console.log(`Syncing ${tools.length} tools (${endpointCount} endpoint, ${uiCount} UI) to ${baseUrl}...`);
-        const response = await fetch(`${baseUrl}/v1/registry/sync`, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                Authorization: `Bearer ${apiKey}`,
-            },
-            body: JSON.stringify({ tools }),
+        await runSync({
+            rootDir: resolve(getFlagValue(rest, '--root') ?? process.cwd()),
+            json: hasFlag(rest, '--json'),
+            quiet: hasFlag(rest, '--quiet'),
+        }, dependencies.sync);
+        return;
+    }
+    if (command === 'doctor') {
+        const report = await createDoctorReport({
+            rootDir: resolve(getFlagValue(rest, '--root') ?? process.cwd()),
+            managed: hasFlag(rest, '--managed'),
         });
-        if (!response.ok) {
-            const body = await response.text();
-            throw new Error(`Sync failed (${response.status}): ${body}`);
-        }
-        const result = await response.json();
-        console.log(`Synced ${tools.length} tools to Glirastes:`);
-        if (result.added.length > 0)
-            console.log(`  Added: ${result.added.join(', ')}`);
-        if (result.updated.length > 0)
-            console.log(`  Updated: ${result.updated.join(', ')}`);
-        if (result.unchanged.length > 0)
-            console.log(`  Unchanged: ${result.unchanged.length} tools`);
-        // Sync module prompts as baseline overrides (optional --meta flag)
-        const metaPath = getFlagValue(rest, '--meta');
-        if (metaPath) {
-            const { readFile } = await import('fs/promises');
-            const { resolve } = await import('path');
-            const metaFile = resolve(rootDir, metaPath);
-            try {
-                const metaContent = await readFile(metaFile, 'utf-8');
-                // Extract systemPrompt per module from metadata file
-                const modulePrompts = [];
-                // Match patterns like: moduleId: { ... systemPrompt: `...` }
-                const moduleBlocks = metaContent.matchAll(/(\w+)\s*:\s*\{[^}]*systemPrompt\s*:\s*`([^`]+)`/gs);
-                for (const match of moduleBlocks) {
-                    modulePrompts.push({
-                        moduleId: match[1],
-                        systemPrompt: match[2].trim(),
-                    });
-                }
-                if (modulePrompts.length > 0) {
-                    console.log(`\nSyncing ${modulePrompts.length} module prompt baselines...`);
-                    for (const mp of modulePrompts) {
-                        const promptRes = await fetch(`${baseUrl}/v1/primus/modules/${encodeURIComponent(mp.moduleId)}/prompt`, {
-                            method: 'PUT',
-                            headers: {
-                                'Content-Type': 'application/json',
-                                Authorization: `Bearer ${apiKey}`,
-                            },
-                            body: JSON.stringify({
-                                mode: 'replace',
-                                systemPrompt: mp.systemPrompt,
-                            }),
-                        });
-                        if (promptRes.ok) {
-                            console.log(`  Synced prompt for module: ${mp.moduleId}`);
-                        }
-                        else {
-                            console.warn(`  Failed to sync prompt for module: ${mp.moduleId} (${promptRes.status})`);
-                        }
-                    }
-                }
-            }
-            catch {
-                // Meta file not found or unreadable — skip prompt sync silently
-            }
-        }
+        console.log(hasFlag(rest, '--json')
+            ? JSON.stringify(report)
+            : formatDoctorReport(report, { verbose: hasFlag(rest, '--verbose') }));
+        if (report.status === 'fail')
+            process.exitCode = 1;
         return;
     }
-}
-/**
- * Extract allowedRoles array from tool source file content.
- * Matches patterns like: allowedRoles: ['admin', 'manager']
- */
-function extractAllowedRoles(content) {
-    const match = content.match(/allowedRoles:\s*\[([^\]]*)\]/);
-    if (!match)
-        return [];
-    const inner = match[1];
-    const roles = [];
-    const roleMatches = inner.matchAll(/['"]([^'"]+)['"]/g);
-    for (const m of roleMatches) {
-        roles.push(m[1]);
-    }
-    return roles;
-}
-function buildAuthStrategy(authType, tokenEnvVar, args) {
-    switch (authType) {
-        case 'api-key':
-            return {
-                type: 'api-key',
-                headerName: getFlagValue(args, '--header-name') ?? 'X-API-Key',
-                keyEnvVar: tokenEnvVar,
-            };
-        case 'oauth2':
-            return {
-                type: 'oauth2',
-                tokenUrl: getFlagValue(args, '--token-url') ?? '',
-                clientIdEnvVar: getFlagValue(args, '--client-id-env') ?? 'OAUTH_CLIENT_ID',
-                clientSecretEnvVar: getFlagValue(args, '--client-secret-env') ?? 'OAUTH_CLIENT_SECRET',
-                scopes: getFlagValue(args, '--scopes')?.split(','),
-            };
-        case 'cookie':
-            return { type: 'cookie' };
-        case 'bearer':
-        default:
-            return { type: 'bearer', tokenEnvVar };
+    if (command === 'validate') {
+        await runValidate(rest);
+        return;
+    }
+    if (command === 'build') {
+        await runBuild(rest);
+        return;
+    }
+    if (command === 'install') {
+        await runInstall(rest, dependencies);
+        return;
+    }
+    if (command === 'setup') {
+        await runSetup(rest, dependencies);
+        return;
     }
+    await runLegacyScan(rest);
 }
 //# sourceMappingURL=index.js.map