javi-forge 1.6.0 → 1.7.0

package/dist/cli/help.d.ts

@@ -0,0 +1,127 @@
+/**
+ * CLI metadata: help text and meow flags schema.
+ *
+ * Pure data module — no runtime imports. Consumed by `src/index.tsx`
+ * when constructing the `meow` parser.
+ */
+/**
+ * Help banner shown by meow when `--help` is passed or invalid args are supplied.
+ * Multi-line template literal — preserve exact formatting (whitespace is significant).
+ */
+export declare const HELP_TEXT = "\n  Usage\n    $ javi-forge [command] [options]\n\n  Commands\n    init              Bootstrap a new project (default)\n    ci                Run CI simulation (lint + compile + test + security + ghagga)\n    tdd init          Install TDD-enforcing pre-commit hook (auto-detects stack)\n    tdd pipeline      Install TDD pipeline pre-push hook (--mode strict|warn)\n    analyze           Run repoforge skills analysis\n    doctor            Show health report\n    workflow show     Render a workflow graph as ASCII (--template <name> or file path)\n    workflow validate Validate project state against a workflow graph\n    workflow list     List available workflows and built-in templates\n    plugin add        Install a plugin from GitHub (org/repo)\n    plugin remove     Remove an installed plugin\n    plugin list       List installed plugins\n    plugin search     Search the plugin registry\n    plugin validate   Validate a local plugin directory\n    plugin sync       Auto-detect and wire installed plugins\n    plugin export     Export plugin to Agent Skills spec format (skills.json)\n    plugin export     --codex: Export plugin to Codex-compatible TOML subagent files\n    plugin export-skills  Generate aggregated skills.json from all installed plugins\n    plugin export-skills global  Generate global skills.json from all globally installed plugins\n    plugin import     Import an Agent Skills spec package as a javi-forge plugin\n    skills doctor     Show skills health report (add --deep for conflict detection)\n    skills budget     Show token cost of loaded skills (add -b N for custom budget)\n    skills score      Score a skill on quality dimensions (completeness, clarity, testability, token-efficiency)\n    skills benchmark  Benchmark a skill with structural quality checks\n    skills auto       Auto-detect project stack and suggest/install matching AI skills\n    skills auto-install  Alias for skills auto\n    skill publish     Package a skill directory for marketplace distribution (generates plugin.json)\n    security baseline   Create security baseline from current audit findings\n    security check      Check for regressions against baseline (exits non-zero if found)\n    security update     Re-snapshot baseline (acknowledge current vulns)\n    security allowlist  Add all current findings to the allowlist (suppress in future checks)\n    llms-txt          Generate AI-friendly llms.txt for current project\n\n  Options\n    --dry-run       Preview changes without writing files\n    --stack         Project stack (node, python, go, rust, java-gradle, java-maven, elixir)\n    --ci            CI provider (github, gitlab, woodpecker)\n    --memory        Memory module (engram, obsidian-brain, memory-simple, none)\n    --project-name  Project name (skips name prompt)\n    --ghagga        Enable GHAGGA review system\n    --mock          Enable mock-first mode (no real API keys needed)\n    --local-ai      Include local AI dev stack (Ollama + Docker Compose)\n    --batch         Non-interactive mode (auto-proceed, no keyboard input)\n    --deep          Enable deep analysis (conflict + duplicate detection)\n    --budget, -b    Token budget limit for skills (default: 8000)\n    --skills-dir    Custom skills directory path\n    --author        Author name for skill publish\n    --repo          Repository URL for skill publish\n    --version       Show version\n    --help          Show this help\n\n  CI options (javi-forge ci)\n    --quick         Lint + compile only (fast, for pre-commit)\n    --shell         Open interactive shell in CI container\n    --detect        Show detected stack and exit\n    --config PATH   Load ordered CI runners from a versioned config file\n                    (default discovery: .javi-forge/ci.yaml)\n    --stack STACK   Force a single explicit stack (single-stack repos only \u2014\n                    insufficient for hybrid repos; use --config instead)\n    --no-docker     Run commands natively (no Docker)\n    --no-ci-ghagga  Skip GHAGGA review\n    --no-security   Skip Semgrep security scan\n    --timeout N     Per-step timeout in seconds (default: 600)\n\n  CI hooks (javi-forge ci init)\n    Install git hooks that call javi-forge ci.\n    No files copied \u2014 hooks reference the global CLI.\n\n  Examples\n    $ javi-forge\n    $ javi-forge init --dry-run\n    $ javi-forge init --stack node --ci github\n    $ javi-forge ci\n    $ javi-forge ci init\n    $ javi-forge tdd init\n    $ javi-forge ci --quick\n    $ javi-forge ci --no-ci-ghagga --no-security\n    $ javi-forge ci --no-docker\n    $ javi-forge ci --shell\n    $ javi-forge ci --config .javi-forge/ci.yaml\n    $ javi-forge analyze\n    $ javi-forge doctor\n    $ javi-forge plugin add mapbox/agent-skills\n    $ javi-forge plugin list\n";
+export declare const FLAGS_SCHEMA: {
+    readonly dryRun: {
+        readonly type: "boolean";
+        readonly default: false;
+    };
+    readonly stack: {
+        readonly type: "string";
+        readonly default: "";
+    };
+    readonly ci: {
+        readonly type: "string";
+        readonly default: "";
+    };
+    readonly memory: {
+        readonly type: "string";
+        readonly default: "";
+    };
+    readonly projectName: {
+        readonly type: "string";
+        readonly default: "";
+    };
+    readonly ghagga: {
+        readonly type: "boolean";
+        readonly default: false;
+    };
+    readonly mock: {
+        readonly type: "boolean";
+        readonly default: false;
+    };
+    readonly localAi: {
+        readonly type: "boolean";
+        readonly default: false;
+    };
+    readonly batch: {
+        readonly type: "boolean";
+        readonly default: false;
+    };
+    readonly quick: {
+        readonly type: "boolean";
+        readonly default: false;
+    };
+    readonly shell: {
+        readonly type: "boolean";
+        readonly default: false;
+    };
+    readonly detect: {
+        readonly type: "boolean";
+        readonly default: false;
+    };
+    readonly config: {
+        readonly type: "string";
+        readonly default: "";
+    };
+    readonly docker: {
+        readonly type: "boolean";
+        readonly default: true;
+    };
+    readonly ciGhagga: {
+        readonly type: "boolean";
+        readonly default: true;
+    };
+    readonly security: {
+        readonly type: "boolean";
+        readonly default: true;
+    };
+    readonly timeout: {
+        readonly type: "number";
+        readonly default: 600;
+    };
+    readonly minSeverity: {
+        readonly type: "string";
+        readonly default: "low";
+    };
+    readonly staleDays: {
+        readonly type: "number";
+        readonly default: 30;
+    };
+    readonly json: {
+        readonly type: "boolean";
+        readonly default: false;
+    };
+    readonly codex: {
+        readonly type: "boolean";
+        readonly default: false;
+    };
+    readonly deep: {
+        readonly type: "boolean";
+        readonly default: false;
+    };
+    readonly budget: {
+        readonly type: "number";
+        readonly shortFlag: "b";
+        readonly default: 8000;
+    };
+    readonly skillsDir: {
+        readonly type: "string";
+        readonly default: "";
+    };
+    readonly author: {
+        readonly type: "string";
+        readonly default: "";
+    };
+    readonly repo: {
+        readonly type: "string";
+        readonly default: "";
+    };
+    readonly template: {
+        readonly type: "string";
+        readonly default: "";
+    };
+    readonly mode: {
+        readonly type: "string";
+        readonly default: "strict";
+    };
+};
+//# sourceMappingURL=help.d.ts.map

package/dist/cli/help.js

@@ -0,0 +1,138 @@
+/**
+ * CLI metadata: help text and meow flags schema.
+ *
+ * Pure data module — no runtime imports. Consumed by `src/index.tsx`
+ * when constructing the `meow` parser.
+ */
+/**
+ * Help banner shown by meow when `--help` is passed or invalid args are supplied.
+ * Multi-line template literal — preserve exact formatting (whitespace is significant).
+ */
+export const HELP_TEXT = `
+  Usage
+    $ javi-forge [command] [options]
+
+  Commands
+    init              Bootstrap a new project (default)
+    ci                Run CI simulation (lint + compile + test + security + ghagga)
+    tdd init          Install TDD-enforcing pre-commit hook (auto-detects stack)
+    tdd pipeline      Install TDD pipeline pre-push hook (--mode strict|warn)
+    analyze           Run repoforge skills analysis
+    doctor            Show health report
+    workflow show     Render a workflow graph as ASCII (--template <name> or file path)
+    workflow validate Validate project state against a workflow graph
+    workflow list     List available workflows and built-in templates
+    plugin add        Install a plugin from GitHub (org/repo)
+    plugin remove     Remove an installed plugin
+    plugin list       List installed plugins
+    plugin search     Search the plugin registry
+    plugin validate   Validate a local plugin directory
+    plugin sync       Auto-detect and wire installed plugins
+    plugin export     Export plugin to Agent Skills spec format (skills.json)
+    plugin export     --codex: Export plugin to Codex-compatible TOML subagent files
+    plugin export-skills  Generate aggregated skills.json from all installed plugins
+    plugin export-skills global  Generate global skills.json from all globally installed plugins
+    plugin import     Import an Agent Skills spec package as a javi-forge plugin
+    skills doctor     Show skills health report (add --deep for conflict detection)
+    skills budget     Show token cost of loaded skills (add -b N for custom budget)
+    skills score      Score a skill on quality dimensions (completeness, clarity, testability, token-efficiency)
+    skills benchmark  Benchmark a skill with structural quality checks
+    skills auto       Auto-detect project stack and suggest/install matching AI skills
+    skills auto-install  Alias for skills auto
+    skill publish     Package a skill directory for marketplace distribution (generates plugin.json)
+    security baseline   Create security baseline from current audit findings
+    security check      Check for regressions against baseline (exits non-zero if found)
+    security update     Re-snapshot baseline (acknowledge current vulns)
+    security allowlist  Add all current findings to the allowlist (suppress in future checks)
+    llms-txt          Generate AI-friendly llms.txt for current project
+
+  Options
+    --dry-run       Preview changes without writing files
+    --stack         Project stack (node, python, go, rust, java-gradle, java-maven, elixir)
+    --ci            CI provider (github, gitlab, woodpecker)
+    --memory        Memory module (engram, obsidian-brain, memory-simple, none)
+    --project-name  Project name (skips name prompt)
+    --ghagga        Enable GHAGGA review system
+    --mock          Enable mock-first mode (no real API keys needed)
+    --local-ai      Include local AI dev stack (Ollama + Docker Compose)
+    --batch         Non-interactive mode (auto-proceed, no keyboard input)
+    --deep          Enable deep analysis (conflict + duplicate detection)
+    --budget, -b    Token budget limit for skills (default: 8000)
+    --skills-dir    Custom skills directory path
+    --author        Author name for skill publish
+    --repo          Repository URL for skill publish
+    --version       Show version
+    --help          Show this help
+
+  CI options (javi-forge ci)
+    --quick         Lint + compile only (fast, for pre-commit)
+    --shell         Open interactive shell in CI container
+    --detect        Show detected stack and exit
+    --config PATH   Load ordered CI runners from a versioned config file
+                    (default discovery: .javi-forge/ci.yaml)
+    --stack STACK   Force a single explicit stack (single-stack repos only —
+                    insufficient for hybrid repos; use --config instead)
+    --no-docker     Run commands natively (no Docker)
+    --no-ci-ghagga  Skip GHAGGA review
+    --no-security   Skip Semgrep security scan
+    --timeout N     Per-step timeout in seconds (default: 600)
+
+  CI hooks (javi-forge ci init)
+    Install git hooks that call javi-forge ci.
+    No files copied — hooks reference the global CLI.
+
+  Examples
+    $ javi-forge
+    $ javi-forge init --dry-run
+    $ javi-forge init --stack node --ci github
+    $ javi-forge ci
+    $ javi-forge ci init
+    $ javi-forge tdd init
+    $ javi-forge ci --quick
+    $ javi-forge ci --no-ci-ghagga --no-security
+    $ javi-forge ci --no-docker
+    $ javi-forge ci --shell
+    $ javi-forge ci --config .javi-forge/ci.yaml
+    $ javi-forge analyze
+    $ javi-forge doctor
+    $ javi-forge plugin add mapbox/agent-skills
+    $ javi-forge plugin list
+`;
+export const FLAGS_SCHEMA = {
+    dryRun: { type: "boolean", default: false },
+    stack: { type: "string", default: "" },
+    ci: { type: "string", default: "" },
+    memory: { type: "string", default: "" },
+    projectName: { type: "string", default: "" },
+    ghagga: { type: "boolean", default: false },
+    mock: { type: "boolean", default: false },
+    localAi: { type: "boolean", default: false },
+    batch: { type: "boolean", default: false },
+    // CI flags
+    quick: { type: "boolean", default: false },
+    shell: { type: "boolean", default: false },
+    detect: { type: "boolean", default: false },
+    config: { type: "string", default: "" },
+    docker: { type: "boolean", default: true },
+    ciGhagga: { type: "boolean", default: true },
+    security: { type: "boolean", default: true },
+    timeout: { type: "number", default: 600 },
+    // Security check flags
+    minSeverity: { type: "string", default: "low" },
+    staleDays: { type: "number", default: 30 },
+    json: { type: "boolean", default: false },
+    // Plugin flags
+    codex: { type: "boolean", default: false },
+    // Skills flags
+    deep: { type: "boolean", default: false },
+    budget: { type: "number", shortFlag: "b", default: 8000 },
+    skillsDir: { type: "string", default: "" },
+    // Skill publish flags
+    author: { type: "string", default: "" },
+    repo: { type: "string", default: "" },
+    // Workflow flags
+    template: { type: "string", default: "" },
+    // TDD flags
+    mode: { type: "string", default: "strict" },
+};
+//# sourceMappingURL=help.js.map

package/dist/cli/runtime.d.ts

@@ -0,0 +1,16 @@
+/** Detects whether the CLI is running in a non-interactive / CI context. */
+export declare function detectCI(flags: {
+    batch?: boolean;
+}): boolean;
+/**
+ * Returns a stdin stream suitable for Ink. When stdin is a TTY, the real
+ * `process.stdin` is returned; otherwise a `PassThrough` stand-in is supplied
+ * so Ink does not crash trying to enable raw mode on a non-TTY pipe.
+ */
+export declare function createInkStdin(): NodeJS.ReadStream;
+/** Schedules a non-blocking background update check (cached for 24h). */
+export declare function setupUpdateNotifier(pkg: {
+    name: string;
+    version: string;
+}): void;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/cli/runtime.js

@@ -0,0 +1,38 @@
+/**
+ * Runtime adapters for the CLI entry point:
+ *   - CI environment detection
+ *   - TTY-aware stdin shim for Ink
+ *   - update-notifier bootstrap
+ *
+ * Kept dependency-light: only `node:stream` and `update-notifier`.
+ * Heavy command modules (`./commands/*.js`) remain lazy-loaded from the
+ * dispatch handlers themselves. `react`, `ink`, and `meow` are eagerly
+ * imported at the CLI entry script (`src/index.tsx`) — not here.
+ *
+ * Pure-data validator constants live in `./validators.js` (separated to
+ * keep runtime adapters and data tables apart).
+ */
+import { PassThrough } from "node:stream";
+import updateNotifier from "update-notifier";
+/** Detects whether the CLI is running in a non-interactive / CI context. */
+export function detectCI(flags) {
+    return (flags.batch === true || process.env.CI === "1" || process.env.CI === "true");
+}
+/**
+ * Returns a stdin stream suitable for Ink. When stdin is a TTY, the real
+ * `process.stdin` is returned; otherwise a `PassThrough` stand-in is supplied
+ * so Ink does not crash trying to enable raw mode on a non-TTY pipe.
+ */
+export function createInkStdin() {
+    const isTTY = process.stdin.isTTY === true;
+    if (isTTY)
+        return process.stdin;
+    const fakeStdin = new PassThrough();
+    Object.defineProperty(fakeStdin, "isTTY", { value: false });
+    return fakeStdin;
+}
+/** Schedules a non-blocking background update check (cached for 24h). */
+export function setupUpdateNotifier(pkg) {
+    updateNotifier({ pkg, updateCheckInterval: 1000 * 60 * 60 * 24 }).notify();
+}
+//# sourceMappingURL=runtime.js.map

package/dist/cli/validators.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Validator constants for `init` command flags.
+ *
+ * Pure-data module (no runtime imports) — separated from `runtime.ts` which
+ * holds runtime adapters (CI detection, Ink stdin shim, update-notifier).
+ * Consumed by dispatch handlers to validate `--stack`, `--ci`, and `--memory`
+ * flag values before constructing preset props for the Ink UI.
+ */
+/** Valid `--stack` values accepted by the `init` command. */
+export declare const VALID_STACKS: string[];
+/** Valid `--ci` provider values accepted by the `init` command. */
+export declare const VALID_CI: string[];
+/** Valid `--memory` module values accepted by the `init` command. */
+export declare const VALID_MEMORY: string[];
+/** Valid action values accepted by the `security` command. */
+export declare const VALID_SECURITY_ACTIONS: string[];
+//# sourceMappingURL=validators.d.ts.map

package/dist/cli/validators.js

@@ -0,0 +1,35 @@
+/**
+ * Validator constants for `init` command flags.
+ *
+ * Pure-data module (no runtime imports) — separated from `runtime.ts` which
+ * holds runtime adapters (CI detection, Ink stdin shim, update-notifier).
+ * Consumed by dispatch handlers to validate `--stack`, `--ci`, and `--memory`
+ * flag values before constructing preset props for the Ink UI.
+ */
+/** Valid `--stack` values accepted by the `init` command. */
+export const VALID_STACKS = [
+    "node",
+    "python",
+    "go",
+    "rust",
+    "java-gradle",
+    "java-maven",
+    "elixir",
+];
+/** Valid `--ci` provider values accepted by the `init` command. */
+export const VALID_CI = ["github", "gitlab", "woodpecker"];
+/** Valid `--memory` module values accepted by the `init` command. */
+export const VALID_MEMORY = [
+    "engram",
+    "obsidian-brain",
+    "memory-simple",
+    "none",
+];
+/** Valid action values accepted by the `security` command. */
+export const VALID_SECURITY_ACTIONS = [
+    "baseline",
+    "check",
+    "update",
+    "allowlist",
+];
+//# sourceMappingURL=validators.js.map

package/dist/commands/analyze.d.ts

@@ -1,4 +1,4 @@
-import type { InitStep } from '../types/index.js';
+import type { InitStep } from "../types/index.js";
 type StepCallback = (step: InitStep) => void;
 /**
  * Run repoforge skills analysis on a project directory.

package/dist/commands/analyze.js

@@ -1,13 +1,11 @@
-import { execFile } from 'child_process';
-import { promisify } from 'util';
-const execFileAsync = promisify(execFile);
+import { execFileAsync } from "../lib/exec.js";
 function report(onStep, id, label, status, detail) {
     onStep({ id, label, status, detail });
 }
 /** Check if a binary is available in PATH */
 async function which(bin) {
     try {
-        await execFileAsync('which', [bin]);
+        await execFileAsync("which", [bin]);
         return true;
     }
     catch {
@@ -19,37 +17,37 @@ async function which(bin) {
  * This is a thin wrapper that delegates to the repoforge CLI.
  */
 export async function runAnalyze(projectDir, dryRun, onStep) {
-    const stepId = 'analyze-repoforge';
-    report(onStep, stepId, 'Run repoforge skills analysis', 'running');
+    const stepId = "analyze-repoforge";
+    report(onStep, stepId, "Run repoforge skills analysis", "running");
     try {
         // Check if repoforge is installed
-        const hasRepoforge = await which('repoforge');
+        const hasRepoforge = await which("repoforge");
         if (!hasRepoforge) {
-            report(onStep, stepId, 'Run repoforge skills analysis', 'error', 'repoforge not found. Install with: pip install repoforge');
+            report(onStep, stepId, "Run repoforge skills analysis", "error", "repoforge not found. Install with: pip install repoforge");
             return;
         }
-        const args = ['skills', '-w', projectDir];
+        const args = ["skills", "-w", projectDir];
         if (dryRun) {
-            args.push('--dry-run');
+            args.push("--dry-run");
         }
-        const { stdout, stderr } = await execFileAsync('repoforge', args, {
+        const { stdout, stderr } = await execFileAsync("repoforge", args, {
             cwd: projectDir,
             timeout: 300_000, // 5 min — analysis can take a while on large repos
         });
         if (stdout) {
-            report(onStep, stepId, 'Run repoforge skills analysis', 'done', stdout.trim().split('\n').pop() ?? 'complete');
+            report(onStep, stepId, "Run repoforge skills analysis", "done", stdout.trim().split("\n").pop() ?? "complete");
         }
         else {
-            report(onStep, stepId, 'Run repoforge skills analysis', 'done', dryRun ? 'dry-run complete' : 'complete');
+            report(onStep, stepId, "Run repoforge skills analysis", "done", dryRun ? "dry-run complete" : "complete");
         }
         if (stderr) {
-            const warnId = 'analyze-warnings';
-            report(onStep, warnId, 'Analysis warnings', 'skipped', stderr.trim().split('\n').pop() ?? '');
+            const warnId = "analyze-warnings";
+            report(onStep, warnId, "Analysis warnings", "skipped", stderr.trim().split("\n").pop() ?? "");
         }
     }
     catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
-        report(onStep, stepId, 'Run repoforge skills analysis', 'error', msg);
+        report(onStep, stepId, "Run repoforge skills analysis", "error", msg);
     }
 }
 //# sourceMappingURL=analyze.js.map

package/dist/commands/ci.d.ts

@@ -1,5 +1,5 @@
-import type { Stack } from '../types/index.js';
-export type CIMode = 'full' | 'quick' | 'shell' | 'detect';
+import type { Stack } from "../types/index.js";
+export type CIMode = "full" | "quick" | "shell" | "detect";
 export interface CIOptions {
     projectDir?: string;
     mode?: CIMode;
@@ -11,8 +11,12 @@ export interface CIOptions {
     noSecurity?: boolean;
     /** Timeout in seconds for each Docker step (default: 600) */
     timeout?: number;
+    /** Explicit CI config path (--config). Default: .javi-forge/ci.yaml if present */
+    config?: string;
+    /** Explicit single-stack override (--stack). Insufficient for hybrid repos */
+    stack?: string;
 }
-export type CIStepStatus = 'pending' | 'running' | 'done' | 'error' | 'skipped';
+export type CIStepStatus = "pending" | "running" | "done" | "error" | "skipped";
 export interface CIStep {
     id: string;
     label: string;
@@ -29,6 +33,49 @@ export interface CIStackInfo {
     testCmd: string | null;
 }
 export declare function detectCIStack(projectDir: string): Promise<CIStackInfo>;
+/**
+ * Immutable runner produced by resolveCIRunners(). Later stages (Docker
+ * execution, required-tool checks) receive this object and must not
+ * re-detect anything from filesystem markers.
+ */
+export interface ResolvedRunner {
+    name: string;
+    stack: Stack;
+    buildTool: string;
+    javaVersion: string;
+    /** Working directory relative to the project root */
+    directory: string;
+    /** Explicit container image (skips the default per-stack image) */
+    image?: string;
+    /** Docker build context directory (execution lands in Slice B) */
+    buildContext?: string;
+    setupCmds: readonly string[];
+    lintCmds: readonly string[];
+    compileCmds: readonly string[];
+    testCmds: readonly string[];
+    securityCmds: readonly string[];
+    requiredTools: readonly string[];
+}
+export type RunnerSource = "auto" | "config" | "stack-override";
+export interface ResolvedRunners {
+    readonly source: RunnerSource;
+    readonly runners: readonly ResolvedRunner[];
+}
+export interface ResolveRunnerOptions {
+    /** Explicit config path (--config). Wins over default discovery */
+    config?: string;
+    /** Explicit single-stack override (--stack) */
+    stack?: string;
+}
+/**
+ * Resolve the ordered runner list exactly once per CI run.
+ *
+ * Precedence (fail closed on ambiguity):
+ *   1. --config <path> (or discovered .javi-forge/ci.yaml) → configured runners
+ *   2. --stack <stack> → single explicit runner (single-stack repos only)
+ *   3. otherwise → single auto-detected runner (zero-config default)
+ */
+export declare function resolveCIRunners(projectDir: string, options?: ResolveRunnerOptions): Promise<ResolvedRunners>;
 export declare function runCI(options: CIOptions, onStep: CIStepCallback): Promise<void>;
 export declare function installCIHooks(projectDir: string): Promise<{
     installed: string[];