jev-affected 0.1.0

package/.env.example

@@ -0,0 +1,3 @@
+# Copy this file to .env and replace the placeholder.
+# .env is ignored by Git. Never commit a real API key.
+TYPESAFE_API_KEY=replace_with_your_typesafe_api_key

package/CHANGELOG.md

@@ -0,0 +1,8 @@
+# Changelog
+
+## 0.1.0
+
+- YAML semantic task conditions, deterministic globs and protected tasks.
+- Jev Noul analysis, inspectable plans, JSON output and safe fallback.
+- CLI initialization, execution, diagnostics and fixture evaluation.
+- Pinned-model cache, privacy exclusions, offline tests and CI matrix.

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,7 @@
+# Code of conduct
+
+We welcome contributors of every background and experience level. Be respectful, give constructive feedback, and focus criticism on work rather than people.
+
+Harassment, discrimination, threats, sexualized conduct and disclosure of private information are unacceptable. Maintainers may remove content or restrict participation for violations, proportionately and with an explanation when appropriate.
+
+Report concerns privately to the repository maintainers through an established channel. Maintainers will protect reporter privacy and avoid retaliation. This policy applies in project spaces and when representing the project publicly.

package/CONTRIBUTING.md

@@ -0,0 +1,16 @@
+# Contributing
+
+Use Node.js 20+ and pnpm 10.11.0.
+
+```sh
+pnpm install
+pnpm typecheck
+pnpm lint
+pnpm test
+pnpm build
+pnpm smoke
+```
+
+Include tests for routing, privacy and execution behavior. Prefer offline fixtures; identify synthetic responses explicitly and never present them as live model measurements. Live evaluation is optional locally and mandatory before release. Never submit credentials or private code.
+
+Use `pnpm exec changeset` for user-visible changes. Keep changes within the v0.1 CLI scope. Follow CODE_OF_CONDUCT.md.

package/EVALUATION.md

@@ -0,0 +1,77 @@
+# Evaluation
+
+`jev-affected` is designed around one primary safety risk: skipping a task that a
+change actually requires. The evaluation suite therefore treats every false skip
+as a gate failure.
+
+## Method
+
+Seven curated Git-diff fixtures cover session lifetime changes, public API fields,
+comments, logging, database schema, performance-sensitive code, and documentation.
+Each fixture declares the tasks that must run. The evaluator asks Jev the same
+questions used by the planner, applies the configured `skipBelow` threshold, and
+compares the resulting plan with those expectations.
+
+The live evaluation passes only when all of these conditions hold:
+
+- false skips: `0`
+- invalid or missing model answers: `0`
+- fixture cases with at least one skipped task: `>= 2`
+- overall task reduction: `>= 25%`
+
+Provider errors remain fail-safe in ordinary planning: affected candidate tasks
+run. A live evaluation instead fails on invalid answers so it can expose provider
+or integration problems.
+
+## Latest live result
+
+Run on 2026-09-21 with `jev-1.13.0` and `skipBelow: 0.10`:
+
+| Metric | Result |
+| --- | ---: |
+| Cases | 7 |
+| Task decisions | 28 |
+| False skips | 0 |
+| Invalid cases | 0 |
+| Cases with reduction | 6 |
+| Task reduction | 46.43% |
+| Unnecessary-run rate | 45.83% |
+| API calls | 7 |
+| Total latency | 2,139 ms |
+| Input tokens | 2,882 |
+| Output tokens | 476 |
+
+Selected tasks by fixture:
+
+| Fixture | Selected |
+| --- | ---: |
+| API field | 3 / 4 |
+| Authentication | 4 / 4 |
+| Comment | 1 / 4 |
+| Database schema | 3 / 4 |
+| Documentation | 0 / 4 |
+| Logging | 1 / 4 |
+| Performance | 3 / 4 |
+
+## Reproduce
+
+Build first, then run either evaluation:
+
+```sh
+pnpm build
+pnpm eval
+pnpm eval:live
+```
+
+`pnpm eval` uses deterministic synthetic answers and verifies evaluation and
+decision plumbing without making a network request. `pnpm eval:live` reads
+`TYPESAFE_API_KEY` from the process environment or a local `.env` file and sends
+the fixture inputs to Jev.
+
+## Limits
+
+The fixtures are small, curated, and specific to this task taxonomy. The latest
+result is evidence for this release and threshold; it is not a general accuracy
+claim. Live model results can vary between versions and runs. Repositories should
+protect mandatory checks with `always: true` or `allowSkip: false`, keep conditions
+specific, and maintain their own representative evaluation cases.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 jammaru
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,6 @@
+jev-affected
+Copyright 2026 jammaru
+
+Independent open-source software. Not affiliated with or endorsed by TypeSafe AI.
+jev-affected is distributed under the MIT License.
+The TypeSafe JavaScript SDK is distributed separately under its MIT license.

package/README.md

@@ -0,0 +1,201 @@
+<p align="center"><img src="assets/logo-wordmark.svg" width="480" alt="jev-affected"></p>
+
+<p align="center"><strong>Semantic task routing for software development.</strong></p>
+<p align="center">Run tasks based on what changed, not where it changed.</p>
+<p align="center">v0.1.0 Public Beta · Node.js 20+ · TypeScript · MIT · Jev-powered</p>
+
+![Illustrative offline fixture demo, not live Jev output](assets/demo.gif)
+
+Run the reproducible offline demonstration with `pnpm demo` after building. [MP4 version](assets/demo.mp4).
+
+## What is jev-affected?
+
+Define the conditions under which tasks matter in natural language. Jev evaluates those conditions against a Git diff. Code turns the probabilities into a safe, inspectable task plan for your existing test runner, build system, CI, or coding agent.
+
+## Why?
+
+A session lifetime change can affect login behavior without changing the public API. File dependencies alone do not express that distinction. Semantic conditions supplement your existing dependency graph.
+
+## Quick start
+
+```sh
+pnpm add -D jev-affected
+pnpm exec jev-affected init
+```
+
+With npm:
+
+```sh
+npm install -D jev-affected
+npx jev-affected init
+```
+
+Create `.env` in the repository root. The CLI loads it automatically:
+
+```dotenv
+TYPESAFE_API_KEY=your_api_key_here
+```
+
+`.env` is ignored by this repository's generated `.gitignore`. Never put the key in `jev-affected.yml` or commit it. An existing process environment value takes precedence over `.env`. You can also set it for the current shell:
+
+```powershell
+$env:TYPESAFE_API_KEY = "your_api_key_here"
+```
+
+```sh
+export TYPESAFE_API_KEY="your_api_key_here"
+```
+
+Configure your own trusted commands, commit your changes on a feature branch, then:
+
+```sh
+npx jev-affected inspect --base main
+npx jev-affected plan --base main
+npx jev-affected run --base main
+```
+
+`plan` performs analysis but never executes task commands. `run` executes configured commands. **Only committed changes are included**: default head is `HEAD`, not the working tree. Commit agent edits before planning.
+
+## How it works
+
+```mermaid
+flowchart TD
+  A[Git diff] --> B[Deterministic candidate tasks]
+  B --> C[Jev Noul questions]
+  C --> D[Semantic task plan]
+  D --> E[Tests]
+  D --> F[Build]
+  D --> G[Code generation]
+```
+
+Jev supplies `P(condition = true)`. A task is skipped only when its valid probability is **strictly below** `skipBelow`. Equality means RUN. No model-generated commands or explanations are used.
+
+## Configuration
+
+Only YAML is supported. Unknown keys and unsafe policies are rejected.
+
+```yaml
+version: 1
+model: jev-latest
+defaults:
+  skipBelow: 0.10
+policy:
+  uncertain: run
+  onError: run
+analysis:
+  maxDiffBytes: 100000
+  timeoutMs: 10000
+  exclude: ["**/*.pem", "**/*.key"]
+execution:
+  parallel: false
+  concurrency: 4
+tasks:
+  auth-e2e:
+    command: npm run test:auth
+    when: Could authentication, sessions, cookies or login behavior change?
+  sdk:
+    command: npm run generate:sdk
+    when: Could the public API contract change?
+  typecheck:
+    command: npm run typecheck
+    always: true
+```
+
+`threshold` is a compatibility alias for `skipBelow`; specifying both in the same scope is an error. Task values override defaults. `allowSkip: false` protects a task just like `always: true`.
+
+Optional task `include` globs select candidates; task `ignore` and global `ignore` remove matches. Both rename paths are checked. **These are hard dependency rules supplied by you**: overly narrow globs can miss required tasks. Protected tasks bypass them. See [examples/basic](examples/basic/jev-affected.yml).
+
+## Safety
+
+- Missing credentials, timeout, provider error, missing actual model version or invalid probability → RUN for semantic candidates.
+- Sensitive file changes, unreadable/oversized patches, binary changes or submodules → RUN all tasks, with no semantic request.
+- No matching changes → SKIP, except protected tasks.
+- Task commands come exclusively from your configuration and run through your platform shell. Only run configurations you trust.
+
+Low model probabilities are estimates, not a guarantee that a task is unnecessary. Use protected tasks for checks that must always run.
+
+## CLI
+
+| Command | Purpose |
+| --- | --- |
+| `init` | Create config without overwriting an existing file |
+| `plan [--json]` | Produce a plan; never execute tasks |
+| `run [--parallel] [--concurrency 4]` | Execute RUN tasks; sequential by default |
+| `why <task>` | Show condition, probability, threshold, files and model |
+| `inspect` | Preview sanitized analysis inputs locally; no request |
+| `doctor` | Check Node, config, Git base, API key and models endpoint |
+| `eval [--live]` | Evaluate fixture decisions and false-skip rate |
+
+Common flags: `--base`, `--head`, `--config`, `--no-cache`, `--json`, `--help`, `--version`. JSON task output includes a stable `version: 1`. During `run --json`, child output goes to stderr, keeping stdout parseable.
+
+Exit codes: `0` success; `1` failed executed task or failed evaluation gate; `2` config/argument/base or doctor check error; `3` internal/I/O failure. API failures do not fail a normal plan or run by themselves.
+
+Base priority: CLI → config → GitHub PR base branch → `origin/main` → `main` → `master`. The comparison starts at the merge-base with head. Explicit invalid bases fail instead of silently choosing another branch. Fetch full history in CI.
+
+## CI
+
+```yaml
+- uses: actions/checkout@v4
+  with:
+    fetch-depth: 0
+- run: npx jev-affected run --base origin/main
+  env:
+    TYPESAFE_API_KEY: ${{ secrets.TYPESAFE_API_KEY }}
+```
+
+Install dependencies first. Do not expose credentials to untrusted PR code. Nx, Turbo and other runners can be invoked as configured commands; no plugins are required.
+
+## Agents
+
+After committing edits, run `jev-affected plan --json` and execute all tasks whose `decision` is `run`, or use `jev-affected run`. `inspect` lets you review what could leave the repository first.
+
+The package includes a reusable agent skill at [`skills/jev-affected`](skills/jev-affected). Point a compatible coding agent at that directory, or copy it into the agent's skills directory, to give it the safe planning and execution workflow.
+
+## Architecture and library API
+
+Modules separate configuration, Git collection, provider access, planning, execution and reporting. Jev is the only supported production provider. The provider interface supports offline test doubles.
+
+```ts
+import { loadConfig, createPlan } from 'jev-affected';
+const config = await loadConfig('jev-affected.yml');
+const plan = await createPlan({ config, base: 'main' });
+```
+
+Automatic caches store probabilities and model metadata in `.git/jev-affected/cache` (including Git worktree support). Keys include state, questions, configuration and pinned actual model version. Corrupt cache entries fall back to RUN. **Moving aliases such as `jev-latest` bypass caching**, because an alias cannot safely establish its current actual version without another request. Pin an actual `jev-x.y.z` version to enable reuse. Neither patches nor API keys are stored in cache payloads. Cache writes are the only local side effect of `plan`; `--no-cache` disables them.
+
+## Evaluation
+
+```sh
+pnpm eval
+pnpm eval:live
+```
+
+Seven fixtures cover session TTL, API fields, comments, logging, schema, performance and docs. Offline responses are **synthetic, not recorded model answers**. Zero false skips on those responses verifies decision plumbing, not Jev accuracy. Live evaluation fails unless it receives valid model answers, produces zero false skips, reduces tasks in at least two cases, and achieves at least 25% task reduction. It prints the actual model, task probabilities, latency and token usage. Cost is `null` because no pricing assumptions are embedded.
+
+See [EVALUATION.md](EVALUATION.md) for the methodology, release gates, latest live result and limitations.
+
+## Privacy
+
+No backend and no telemetry. Data is read locally; semantic inputs go directly to TypeSafe through its SDK. By default, `.env*`, PEM/key files, and names containing `credentials`, `secret` or `token` are withheld. Custom exclusions add to these defaults. Filename exclusions cannot find every secret embedded in arbitrary source files: inspect inputs and use appropriate repository practices. SDK logging is explicitly disabled.
+
+`TYPESAFE_BASE_URL` is honored by the official SDK; inspect this environment setting before use. Review [TypeSafe's data-processing terms](https://typesafe.ai/legal/mca) for your organization.
+
+## FAQ
+
+**Does this replace my build system?** No. It produces a plan and invokes your commands.
+
+**Does `why` generate an explanation?** No. It displays decision evidence. With a moving model alias it can make a fresh request; it is not a historical plan lookup.
+
+**What if Jev is down?** Candidate tasks run. Deterministic rules and protected tasks still apply.
+
+**Are uncommitted files included?** No, v0.1 compares commits. Explicit refs make the input reproducible.
+
+## Roadmap
+
+v0.1 focuses on inspectable semantic dependencies and safe task plans. Later candidates: working-tree mode, historical evaluations, watch mode, task groups and Nx/Turbo adapters. No GUI, SaaS, MCP server or autonomous command generation is included.
+
+## Contributing and license
+
+See [CONTRIBUTING.md](CONTRIBUTING.md), [SECURITY.md](SECURITY.md), and the [MIT LICENSE](LICENSE).
+
+jev-affected is an independent open-source project and is not affiliated with or endorsed by TypeSafe AI.

package/SECURITY.md

@@ -0,0 +1,21 @@
+# Security
+
+## Supported versions
+
+The current 0.1.x line receives security fixes.
+
+## Reporting a vulnerability
+
+Do not post secrets or exploit details in a public issue. Once the public repository is configured, use its GitHub private vulnerability reporting feature. Until then, contact the repository owner privately using an established channel. Enabling private reporting is a release gate.
+
+## Secret handling
+
+Set TYPESAFE_API_KEY through your environment or CI secret store. The application disables SDK logging and does not emit provider error bodies. Exclusion globs are additive; they cannot detect every embedded secret. Inspect your inputs before enabling remote analysis.
+
+## External API calls
+
+Diffs, changed paths, commit identifiers and questions are sent to the TypeSafe SDK endpoint. `inspect` is local. `doctor` contacts the models endpoint without uploading repository data. `eval --live` uploads fixture states. No telemetry is collected.
+
+## Execution trust
+
+Commands use a shell. Treat configuration as executable code. Do not run commands from untrusted checkouts with credentials or elevated privileges. The model never supplies commands. Local cache contents are trusted like the checkout itself.

package/assets/README.md

@@ -0,0 +1,5 @@
+# Brand assets
+
+Original geometric graph mark. Black and white variants are monochrome; the lime accent is reserved for supporting material. SVGs are the editable sources. `scripts/brand.py` regenerates marks and the 1200×630 social card (Pillow required).
+
+`demo.gif` and `demo.mp4` are a 20-second illustrative offline fixture animation. They are explicitly not live Jev output. Reproduce their decision content with `pnpm demo`.

package/assets/favicon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="jev-affected semantic graph"><g fill="none" stroke="#161a17" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"><path opacity=".25" d="M32 10L10 35M32 10L54 35"/><path d="M32 10V54"/></g><g fill="#161a17"><circle cx="32" cy="10" r="6"/><circle cx="32" cy="35" r="6"/><circle cx="32" cy="54" r="6"/><circle opacity=".25" cx="10" cy="35" r="5"/><circle opacity=".25" cx="54" cy="35" r="5"/></g></svg>

package/assets/logo-dark.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="jev-affected semantic graph"><g fill="none" stroke="#f1f5f0" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"><path opacity=".25" d="M32 10L10 35M32 10L54 35"/><path d="M32 10V54"/></g><g fill="#f1f5f0"><circle cx="32" cy="10" r="6"/><circle cx="32" cy="35" r="6"/><circle cx="32" cy="54" r="6"/><circle opacity=".25" cx="10" cy="35" r="5"/><circle opacity=".25" cx="54" cy="35" r="5"/></g></svg>

package/assets/logo-mark.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="jev-affected semantic graph"><g fill="none" stroke="#161a17" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"><path opacity=".25" d="M32 10L10 35M32 10L54 35"/><path d="M32 10V54"/></g><g fill="#161a17"><circle cx="32" cy="10" r="6"/><circle cx="32" cy="35" r="6"/><circle cx="32" cy="54" r="6"/><circle opacity=".25" cx="10" cy="35" r="5"/><circle opacity=".25" cx="54" cy="35" r="5"/></g></svg>

package/assets/logo-wordmark.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 560 96" role="img" aria-label="jev-affected"><rect width="560" height="96" rx="12" fill="#101713"/><g transform="translate(20 16)"><g fill="none" stroke="#f1f5f0" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"><path opacity=".25" d="M32 10L10 35M32 10L54 35"/><path d="M32 10V54"/></g><g fill="#f1f5f0"><circle cx="32" cy="10" r="6"/><circle cx="32" cy="35" r="6"/><circle cx="32" cy="54" r="6"/><circle opacity=".25" cx="10" cy="35" r="5"/><circle opacity=".25" cx="54" cy="35" r="5"/></g></g><text x="108" y="62" fill="#f1f5f0" font-family="ui-monospace,Consolas,monospace" font-size="46" font-weight="600">jev-affected</text></svg>

package/assets/logo.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="jev-affected semantic graph"><g fill="none" stroke="#161a17" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"><path opacity=".25" d="M32 10L10 35M32 10L54 35"/><path d="M32 10V54"/></g><g fill="#161a17"><circle cx="32" cy="10" r="6"/><circle cx="32" cy="35" r="6"/><circle cx="32" cy="54" r="6"/><circle opacity=".25" cx="10" cy="35" r="5"/><circle opacity=".25" cx="54" cy="35" r="5"/></g></svg>

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,214 @@
+#!/usr/bin/env node
+import { readFile, writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+import { TypeSafeClient } from "@typesafe-ai/sdk";
+import { config as loadEnvFile } from "dotenv";
+import { ConfigError, loadConfig, template } from "./config.js";
+import { evaluate } from "./eval.js";
+import { executePlan } from "./executor.js";
+import { collectChanges, matches } from "./git.js";
+import { createPlan } from "./planner.js";
+loadEnvFile({ quiet: true });
+function render(plan) {
+    return [
+        `jev-affected\n\nBase ${plan.base}\nHead ${plan.head}\nModel ${plan.model ?? "not analyzed"}`,
+        ...plan.warnings.map((w) => `Warning: ${w}`),
+        "",
+        ...plan.tasks.map((t) => `${t.decision.toUpperCase().padEnd(5)} ${t.id.padEnd(22)} ${t.probability?.toFixed(3) ?? "—"}  ${t.reason}`),
+        "",
+        `${plan.tasks.filter((t) => t.decision === "run").length} / ${plan.tasks.length} tasks selected`,
+    ].join("\n");
+}
+async function main() {
+    let args;
+    try {
+        args = parseArgs({
+            allowPositionals: true,
+            options: {
+                base: { type: "string" },
+                head: { type: "string" },
+                config: { type: "string" },
+                json: { type: "boolean" },
+                parallel: { type: "boolean" },
+                concurrency: { type: "string" },
+                help: { type: "boolean", short: "h" },
+                version: { type: "boolean", short: "v" },
+                "no-cache": { type: "boolean" },
+                fixtures: { type: "string" },
+                live: { type: "boolean" },
+            },
+        });
+    }
+    catch {
+        throw new ConfigError("Invalid arguments. See --help.");
+    }
+    const { values: v, positionals } = args;
+    const command = positionals[0];
+    if (v.version) {
+        console.log(JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8")).version);
+        return;
+    }
+    if (v.help || !command) {
+        console.log(`jev-affected — Semantic task routing, powered by Jev.
+
+Usage: jev-affected <command> [options]
+Commands: init, plan, run, why <task>, inspect, doctor, eval
+Options:
+  --base <ref>       Compare from merge-base(ref, head)
+  --head <ref>       Head commit (default HEAD; committed changes only)
+  --config <file>    YAML configuration
+  --json            Machine-readable output
+  --no-cache        Bypass the local decision cache
+  --parallel        Execute selected commands concurrently
+  --concurrency <n>  Maximum parallel commands
+  --fixtures <dir>  Evaluation fixtures (default evals/fixtures)
+  --live            Evaluate using the real Jev API
+  --help, --version
+
+inspect never sends requests. plan never executes task commands.`);
+        return;
+    }
+    if (!["init", "plan", "run", "why", "inspect", "doctor", "eval"].includes(command))
+        throw new ConfigError("Unknown command. See --help.");
+    if (positionals.length > (command === "why" ? 2 : 1))
+        throw new ConfigError("Unexpected positional arguments.");
+    const emit = (x) => console.log(JSON.stringify(x, null, 2));
+    if (command === "init") {
+        try {
+            await writeFile(String(v.config ?? "jev-affected.yml"), template, {
+                flag: "wx",
+            });
+        }
+        catch {
+            throw new ConfigError("Cannot create config: file already exists or directory is not writable.");
+        }
+        if (v.json)
+            emit({ created: v.config ?? "jev-affected.yml" });
+        else
+            console.log("Created jev-affected.yml\n\nNext:\n  1. Set TYPESAFE_API_KEY\n  2. Define semantic task conditions\n  3. Run: jev-affected plan");
+        return;
+    }
+    if (command === "eval") {
+        const result = await evaluate(v.fixtures
+            ? resolve(String(v.fixtures))
+            : fileURLToPath(new URL("../evals/fixtures", import.meta.url)), !!v.live);
+        emit(result);
+        if (!result.passed)
+            process.exitCode = 1;
+        return;
+    }
+    const config = await loadConfig(String(v.config ?? "jev-affected.yml"));
+    const opts = {
+        config,
+        base: typeof v.base === "string" ? v.base : undefined,
+        head: typeof v.head === "string" ? v.head : undefined,
+        cache: !v["no-cache"],
+    };
+    if (command === "why" &&
+        (!positionals[1] || !Object.hasOwn(config.tasks, positionals[1])))
+        throw new ConfigError("Specify a configured task: why <task>.");
+    if (command === "inspect") {
+        const state = await collectChanges(config, opts);
+        const questions = Object.fromEntries(Object.entries(config.tasks)
+            .filter(([, t]) => !state.incomplete &&
+            !t.always &&
+            t.allowSkip &&
+            state.files.some((f) => [f.path, ...(f.oldPath ? [f.oldPath] : [])].some((p) => (!t.include || matches(p, t.include)) &&
+                !matches(p, t.ignore))))
+            .map(([id, t]) => [id, { type: "noul", instructions: t.when }]));
+        emit({
+            state,
+            model: config.model,
+            questions,
+            providerRequest: Object.keys(questions).length
+                ? {
+                    model: config.model,
+                    state: {
+                        base: state.base,
+                        head: state.head,
+                        files: state.files,
+                        diff: state.diff,
+                    },
+                    questions,
+                }
+                : null,
+            requestSent: false,
+            note: "No request was sent. Incomplete states use safe fallback.",
+        });
+        return;
+    }
+    if (command === "doctor") {
+        const checks = {
+            node: Number(process.versions.node.split(".")[0]) >= 20,
+            config: true,
+            tasks: Object.keys(config.tasks).length.toString(),
+            apiKey: !!process.env.TYPESAFE_API_KEY?.trim(),
+        };
+        try {
+            await collectChanges(config, opts);
+            checks.gitBase = true;
+        }
+        catch {
+            checks.gitBase = false;
+        }
+        if (checks.apiKey) {
+            try {
+                await new TypeSafeClient({
+                    logLevel: "off",
+                    timeout: config.analysis.timeoutMs,
+                    retry: { maxRetries: 0 },
+                }).models.list();
+                checks.apiReachable = true;
+            }
+            catch {
+                checks.apiReachable = false;
+            }
+        }
+        else
+            checks.apiReachable = false;
+        emit(checks);
+        if (Object.values(checks).includes(false))
+            process.exitCode = 2;
+        return;
+    }
+    const plan = await createPlan(opts);
+    if (command === "why") {
+        const task = plan.tasks.find((t) => t.id === positionals[1]);
+        emit({
+            task,
+            model: plan.model,
+            base: plan.base,
+            head: plan.head,
+            warnings: plan.warnings,
+        });
+        return;
+    }
+    if (command === "run") {
+        const n = v.concurrency === undefined
+            ? config.execution.concurrency
+            : Number(v.concurrency);
+        if (!Number.isInteger(n) || n < 1 || n > 64)
+            throw new ConfigError("concurrency must be an integer from 1 to 64");
+        if (!v.json)
+            console.log(render(plan));
+        process.exitCode = await executePlan(plan, {
+            concurrency: v.parallel || config.execution.parallel ? n : 1,
+            json: !!v.json,
+        });
+        if (v.json)
+            emit({ plan, exitCode: process.exitCode });
+        return;
+    }
+    if (v.json)
+        emit(plan);
+    else
+        console.log(render(plan));
+}
+main().catch((error) => {
+    console.error(error instanceof ConfigError
+        ? error.message
+        : "Operation failed. Check Git, paths and file permissions.");
+    process.exitCode = error instanceof ConfigError ? 2 : 3;
+});