kibi-cli 1.0.1 → 2.1.0

package/dist/commands/doctor.js

@@ -20,9 +20,22 @@ import { existsSync, readFileSync, statSync } from "node:fs";
 import { createRequire } from "node:module";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
+import { bootstrapKibiEnvironment, secretSourceFromBootstrap, } from "../env/bootstrap.js";
+import { describeConfiguredCapabilityPlugins, readProjectKibiConfig, } from "../plugins/project-config.js";
 import { buildMigrationPlan, migrationAction, } from "../public/operations/migration-plan.js";
 import { readKbManifestStatus } from "../utils/kb-manifest.js";
 import { planLegacyStorageMigration } from "./legacy-storage-migration.js";
+/**
+ * First-party plugin diagnostics known without importing the package.
+ * Generic third-party plugins report package/capability/mode/declared only.
+ */
+// implements REQ-kibi-env-bootstrap, REQ-capability-plugin-configuration-v1
+const FIRST_PARTY_PLUGIN_SECRETS = {
+    "kibi-plugin-jev": ["TYPESAFE_API_KEY"],
+};
+/** Static Jev defaults — must stay aligned with kibi-plugin-jev (no import). */
+const JEV_DEFAULT_MODEL = "jev-latest";
+const JEV_MAX_TIMEOUT_MS = 120_000;
 // implements REQ-003
 export async function doctorCommand(options = {}) {
     const checks = [
@@ -58,8 +71,15 @@ export async function doctorCommand(options = {}) {
             name: "post-rewrite hook",
             check: checkPostRewriteHook,
         },
+        {
+            name: "Capability plugins",
+            check: checkCapabilityPlugins,
+        },
     ];
-    const results = checks.map(({ name, check }) => ({ name, ...check() }));
+    const results = [];
+    for (const { name, check } of checks) {
+        results.push({ name, ...(await check()) });
+    }
     const allPassed = results.every((result) => result.passed);
     const runtime = await runtimeProvenance();
     const packageActions = await packageMigrationActions(runtime);
@@ -97,7 +117,16 @@ export async function doctorCommand(options = {}) {
     console.log("Some checks failed. Please address the issues above.");
     return { exitCode: 1 };
 }
-async function packageMigrationActions(runtime) {
+export async function detectExecuteApplyPlanExport(load = () => import("../public/operations/index.js")) {
+    try {
+        const operations = await load();
+        return typeof operations.executeApplyPlan === "function";
+    }
+    catch {
+        return false;
+    }
+}
+export async function packageMigrationActions(runtime) {
     const actions = [];
     const versions = ["cliVersion", "coreVersion", "mcpVersion"].filter((key) => runtime[key] === "unresolved" || runtime[key] === "unknown");
     if (versions.length > 0) {
@@ -175,15 +204,7 @@ async function runtimeProvenance() {
     }
     const core = resolveInstalledPackageInfo("kibi-core");
     const mcp = resolveInstalledPackageInfo("kibi-mcp");
-    let executeApplyPlanExported;
-    try {
-        const operations = await import("../public/operations/index.js");
-        executeApplyPlanExported =
-            typeof operations.executeApplyPlan === "function";
-    }
-    catch {
-        executeApplyPlanExported = false;
-    }
+    const executeApplyPlanExported = await detectExecuteApplyPlanExport();
     return {
         cliVersion: typeof cli.version === "string" ? cli.version : "unknown",
         coreVersion: core.version,
@@ -226,9 +247,13 @@ function packageInfoFromManifest(manifestPath) {
             : undefined,
     };
 }
-function nearestNamedPackageManifest(startDir, name) {
+export function nextAncestorDirectory(current) {
+    const parent = path.dirname(current);
+    return parent === current ? undefined : parent;
+}
+export function nearestNamedPackageManifest(startDir, name) {
     let current = startDir;
-    while (true) {
+    while (current !== undefined) {
         const candidate = path.join(current, "package.json");
         try {
             const metadata = JSON.parse(readFileSync(candidate, "utf8"));
@@ -238,11 +263,9 @@ function nearestNamedPackageManifest(startDir, name) {
         catch {
             // Keep walking; an unrelated or absent manifest is not a match.
         }
-        const parent = path.dirname(current);
-        if (parent === current)
-            return undefined;
-        current = parent;
+        current = nextAncestorDirectory(current);
     }
+    return undefined;
 }
 function resolveInstalledPackageInfo(name) {
     const require = createRequire(import.meta.url);
@@ -326,6 +349,107 @@ function checkSWIProlog() {
         };
     }
 }
+/**
+ * Read-only view of package.json plugin activation.
+ * Does not import or execute plugin packages (no loadPluginPackage / dynamic import).
+ */
+// implements REQ-capability-plugin-configuration-v1, REQ-kibi-env-bootstrap
+function checkCapabilityPlugins() {
+    try {
+        const bootstrap = bootstrapKibiEnvironment();
+        const workspaceRoot = bootstrap.workspaceRoot;
+        const rows = describeConfiguredCapabilityPlugins(workspaceRoot);
+        if (rows.length === 0) {
+            return {
+                passed: true,
+                message: "None configured; builtin providers only",
+            };
+        }
+        const parts = rows.map((row) => `${row.package} ${row.capability} ${row.mode} declared=${row.declared ? "yes" : "no"}`);
+        if (rows.some((row) => !row.declared)) {
+            return {
+                passed: false,
+                message: parts.join("; "),
+                remediation: "Add the configured plugin package to dependencies, devDependencies, or optionalDependencies, or remove the kibi.plugins activation entry.",
+            };
+        }
+        const config = readProjectKibiConfig(workspaceRoot);
+        const packages = [
+            ...new Set((config.plugins ?? []).map((plugin) => plugin.package)),
+        ];
+        const missingSecrets = [];
+        const legacySecrets = [];
+        for (const packageName of packages) {
+            const secrets = FIRST_PARTY_PLUGIN_SECRETS[packageName] ?? [];
+            for (const secret of secrets) {
+                const source = formatSecretSourcePart(secret, bootstrap);
+                parts.push(`${secret}=${source}`);
+                if (source === "missing")
+                    missingSecrets.push(secret);
+                if (source === "legacy_env")
+                    legacySecrets.push(secret);
+            }
+            if (packageName === "kibi-plugin-jev") {
+                parts.push(...formatJevStaticConfigParts());
+            }
+        }
+        const message = parts.join("; ");
+        if (missingSecrets.length > 0) {
+            const jevMissing = missingSecrets.includes("TYPESAFE_API_KEY");
+            return {
+                passed: false,
+                message,
+                remediation: jevMissing
+                    ? "Set `TYPESAFE_API_KEY` in `~/.config/kibi/env` (user-wide) or `<workspace>/.env.kibi` (project override), then restart long-running Kibi MCP/host processes."
+                    : `Set missing plugin secret(s) (${missingSecrets.join(", ")}) in ~/.config/kibi/env or <workspace>/.env.kibi, then restart long-running Kibi MCP/host processes.`,
+            };
+        }
+        if (legacySecrets.length > 0) {
+            return {
+                passed: true,
+                message,
+                remediation: `Migrate ${legacySecrets.join(", ")} from legacy \`.env\` to \`~/.config/kibi/env\` or \`<workspace>/.env.kibi\`, then restart long-running Kibi MCP/host processes.`,
+            };
+        }
+        return {
+            passed: true,
+            message,
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            passed: false,
+            message,
+            remediation: "Fix package.json kibi.plugins, then restart long-running Kibi MCP or client processes.",
+        };
+    }
+}
+function formatSecretSourcePart(secret, bootstrap) {
+    return secretSourceFromBootstrap(secret, bootstrap);
+}
+/**
+ * Static first-party Jev diagnostics — mirrors plugin resolve helpers without importing.
+ */
+// implements REQ-kibi-env-bootstrap, REQ-capability-plugin-configuration-v1
+function formatJevStaticConfigParts(env = process.env) {
+    const model = env.KIBI_JEV_MODEL?.trim() || JEV_DEFAULT_MODEL;
+    const raw = env.KIBI_JEV_TIMEOUT_MS;
+    if (raw === undefined || raw.trim() === "") {
+        return [`jev.model=${model}`, "jev.timeoutMs=default"];
+    }
+    const trimmed = raw.trim();
+    if (!/^[1-9]\d*$/.test(trimmed)) {
+        return [`jev.model=${model}`, "jev.timeoutMs=invalid"];
+    }
+    const timeoutMs = Number(trimmed);
+    if (!Number.isSafeInteger(timeoutMs) ||
+        timeoutMs < 1 ||
+        timeoutMs > JEV_MAX_TIMEOUT_MS) {
+        return [`jev.model=${model}`, "jev.timeoutMs=invalid"];
+    }
+    return [`jev.model=${model}`, `jev.timeoutMs=${String(timeoutMs)}`];
+}
 function checkKbDirectory() {
     const kbDir = path.join(process.cwd(), ".kb");
     if (!existsSync(kbDir)) {
@@ -468,8 +592,13 @@ function checkPreCommitHook() {
         const preCommitExecutable = (preCommitStats.mode & 0o111) !== 0;
         // Read hook content to determine whether it's using the new staged check
         const content = readFileSync(preCommitPath, "utf-8");
-        const usesKibi = content.includes("kibi check");
-        const usesStaged = content.includes("kibi check --staged");
+        // Current templates resolve the kibi binary into KIBI_BIN before invoking
+        // it (git hooks do not get node_modules/.bin on PATH); legacy templates
+        // invoked bare `kibi`.
+        const resolvesKibi = content.includes("KIBI_BIN=");
+        const usesKibi = resolvesKibi || content.includes("kibi check");
+        const usesStaged = content.includes('"$KIBI_BIN" check --staged') ||
+            content.includes("kibi check --staged");
         if (!usesKibi) {
             // Fail if hook doesn't invoke kibi at all
             return {
@@ -480,15 +609,24 @@ function checkPreCommitHook() {
         }
         if (preCommitExecutable) {
             if (usesStaged) {
+                if (!resolvesKibi) {
+                    // Functional template that invokes bare `kibi`: it fails whenever
+                    // kibi is installed only as a project dependency.
+                    return {
+                        passed: true,
+                        message: "Installed and executable (legacy template without kibi CLI resolution — run 'kibi init' to regenerate so hooks work with local installs)",
+                        remediation: "Run: kibi init to update git hooks to the latest template",
+                    };
+                }
                 return {
                     passed: true,
-                    message: "Installed and executable (uses 'kibi check --staged')",
+                    message: "Installed and executable (resolves kibi CLI; uses 'kibi check --staged')",
                 };
             }
             // Warn but pass if using legacy kibi check without --staged
             return {
                 passed: true,
-                message: "Installed and executable (uses legacy 'kibi check' — consider running 'kibi init' to update hooks to use '--staged')",
+                message: "Installed and executable (uses legacy 'kibi check' — consider running 'kibi init' to update hooks to use '--staged' with CLI resolution)",
                 remediation: "Run: kibi init to update git hooks to the latest template",
             };
         }
@@ -529,9 +667,11 @@ function checkPostRewriteHook() {
     try {
         const postRewriteStats = statSync(postRewritePath);
         const postRewriteExecutable = (postRewriteStats.mode & 0o111) !== 0;
-        // Read hook content to verify it invokes kibi
+        // Read hook content to verify it invokes kibi. Current templates invoke
+        // the resolved KIBI_BIN; legacy templates invoked bare `kibi sync`.
         const content = readFileSync(postRewritePath, "utf-8");
-        const usesKibi = content.includes("kibi sync");
+        const usesKibi = content.includes('"$KIBI_BIN" sync') || content.includes("kibi sync");
+        const resolvesKibi = content.includes("KIBI_BIN=");
         if (!usesKibi) {
             return {
                 passed: false,
@@ -540,6 +680,13 @@ function checkPostRewriteHook() {
             };
         }
         if (postRewriteExecutable) {
+            if (!resolvesKibi) {
+                return {
+                    passed: true,
+                    message: "Installed and executable (legacy template without kibi CLI resolution — run 'kibi init' to regenerate so hooks work with local installs)",
+                    remediation: "Run: kibi init to update git hooks to the latest template",
+                };
+            }
             return {
                 passed: true,
                 message: "Installed and executable",

package/dist/commands/engine.d.ts

@@ -1,6 +1,18 @@
 export declare function engineStatusCommand(): Promise<void>;
 export declare function engineStopCommand(): Promise<void>;
 export declare function storageStatusCommand(): Promise<void>;
+export interface EngineJanitorOptions {
+    readonly all?: boolean;
+    readonly apply?: boolean;
+    readonly format?: string;
+}
+/**
+ * Classify and (optionally) clean stale engine daemons and branch-store
+ * locks: crashed engines leave ownership journals behind, worktree removals
+ * strand live daemons, dead daemons leave sockets. Report-only by default;
+ `--apply` executes the clean actions.
+ */
+export declare function engineJanitorCommand(options: EngineJanitorOptions): Promise<void>;
 export declare function storageCompactCommand(): Promise<void>;
 export declare function storageExportCommand(options: {
     output: string;

package/dist/commands/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/commands/engine.ts"],"names":[],"mappings":"AAkCA,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CA4BzD;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAWvD;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAE1D;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAkB3D;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/commands/engine.ts"],"names":[],"mappings":"AAkCA,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CA4BzD;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAWvD;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAE1D;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AAEH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,IAAI,CAAC,CA2Cf;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAkB3D;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB"}

package/dist/commands/engine.js

@@ -69,6 +69,48 @@ export async function engineStopCommand() {
 export async function storageStatusCommand() {
     await engineStatusCommand();
 }
+/**
+ * Classify and (optionally) clean stale engine daemons and branch-store
+ * locks: crashed engines leave ownership journals behind, worktree removals
+ * strand live daemons, dead daemons leave sockets. Report-only by default;
+ `--apply` executes the clean actions.
+ */
+// implements REQ-core-journaled-engine-persistence
+export async function engineJanitorCommand(options) {
+    const { runtimeDirectory } = await import("../engine.js");
+    const { runJanitor } = await import("../prolog/janitor.js");
+    const findings = runJanitor({
+        workspaceRoot: workspaceRoot(),
+        runtimeDirectory: runtimeDirectory(),
+        all: options.all === true,
+        apply: options.apply === true,
+    });
+    const cleanable = findings.filter((f) => f.action !== "keep").length;
+    const cleaned = options.apply === true ? cleanable : 0;
+    if (options.format === "json") {
+        console.log(JSON.stringify({ findings, cleaned, cleanable, total: findings.length }));
+        return;
+    }
+    if (findings.length === 0) {
+        console.log("No engine or lock artifacts found.");
+        return;
+    }
+    for (const finding of findings) {
+        const holder = "pid" in finding && finding.pid !== undefined
+            ? ` pid=${finding.pid}`
+            : "";
+        const workspace = finding.kind === "store-lock" && finding.workspaceRoot !== undefined
+            ? ` workspace=${finding.workspaceRoot}`
+            : "";
+        const scope = finding.kind === "store-lock"
+            ? `store ${finding.storePath}`
+            : `socket ${finding.socketPath}`;
+        console.log(`[${finding.action}] ${scope}${holder}${workspace} holder=${finding.holderState}`);
+    }
+    console.log(options.apply === true
+        ? `${findings.length} finding(s), ${cleaned} cleaned`
+        : `${findings.length} finding(s), ${cleanable} cleanable (report only; re-run with --apply)`);
+}
 export async function storageCompactCommand() {
     const root = workspaceRoot();
     const attachment = resolveBranchAttachment(root);

package/dist/commands/github-init.d.ts

@@ -53,4 +53,5 @@ export declare function resolveGitHubRepo(remotes: readonly GitRemote[]): GitHub
 export declare function writeGitHubWorkflow(cwd: string, kind: GitHubWorkflowKind, template: string): WorkflowWriteStatus;
 export declare function ensureKibiReportGitIgnore(cwd: string): GitIgnoreWriteStatus;
 export declare function scaffoldGitHubIntegration(options: GitHubScaffoldOptions, deps?: GitHubInitDeps): GitHubScaffoldResult;
+export declare function skipBlankLines(lines: readonly string[], start: number): number;
 //# sourceMappingURL=github-init.d.ts.map

package/dist/commands/github-init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-init.d.ts","sourceRoot":"","sources":["../../src/commands/github-init.ts"],"names":[],"mappings":"AA0BA,eAAO,MAAM,8BAA8B,sCACN,CAAC;AACtC,eAAO,MAAM,6BAA6B,qCAAqC,CAAC;AAChF,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AACpD,eAAO,MAAM,cAAc,4BAA4B,CAAC;AACxD,eAAO,MAAM,oBAAoB,gGAC8D,CAAC;AAChG,eAAO,MAAM,iBAAiB,UAAU,CAAC;AACzC,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAM7C,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEpD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,CAAC;AACvE,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,WAAW,GACX,SAAS,GACT,sBAAsB,CAAC;AAC3B,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,WAAW,CAAC;AAE3D,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC;IACpC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;IAC3C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC;CAC9B,CAAC,CAAC;AAGH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,kBAAkB,GACvB,MAAM,CAER;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAS3E;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CA+BrE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,eAAe,CAUjE;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,MAAM,CAER;AAED,wBAAgB,oBAAoB,IAAI,eAAe,CAKtD;AAED,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAMnE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQhE;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,MAAM,CAuBR;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,CAiBvD;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,SAAS,SAAS,EAAE,GAC5B,UAAU,GAAG,SAAS,CASxB;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,MAAM,GACf,mBAAmB,CAcrB;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAa3E;AAGD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,qBAAqB,EAC9B,IAAI,GAAE,cAAmB,GACxB,oBAAoB,CAsDtB"}
+{"version":3,"file":"github-init.d.ts","sourceRoot":"","sources":["../../src/commands/github-init.ts"],"names":[],"mappings":"AA0BA,eAAO,MAAM,8BAA8B,sCACN,CAAC;AACtC,eAAO,MAAM,6BAA6B,qCAAqC,CAAC;AAChF,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AACpD,eAAO,MAAM,cAAc,4BAA4B,CAAC;AACxD,eAAO,MAAM,oBAAoB,gGAC8D,CAAC;AAChG,eAAO,MAAM,iBAAiB,UAAU,CAAC;AACzC,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAM7C,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEpD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,CAAC;AACvE,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,WAAW,GACX,SAAS,GACT,sBAAsB,CAAC;AAC3B,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,WAAW,CAAC;AAE3D,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC;IACpC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;IAC3C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC;CAC9B,CAAC,CAAC;AAGH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,kBAAkB,GACvB,MAAM,CAER;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAS3E;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CA+BrE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,eAAe,CAUjE;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,MAAM,CAER;AAED,wBAAgB,oBAAoB,IAAI,eAAe,CAKtD;AAED,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAMnE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQhE;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,MAAM,CAuBR;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,CAiBvD;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,SAAS,SAAS,EAAE,GAC5B,UAAU,GAAG,SAAS,CASxB;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,MAAM,GACf,mBAAmB,CAcrB;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAa3E;AAGD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,qBAAqB,EAC9B,IAAI,GAAE,cAAmB,GACxB,oBAAoB,CAsDtB;AAsDD,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,MAAM,GACZ,MAAM,CAMR"}

package/dist/commands/github-init.js

@@ -50,7 +50,7 @@ export function parseGitHubRemote(url) {
         return undefined;
     }
     const patterns = [
-        /^https?:\/\/(?:www\.)?github\.com\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/i,
+        /^https?:\/\/(?:[^/@]+@)?(?:www\.)?github\.com\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/i,
         /^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?\/?$/i,
         /^ssh:\/\/(?:git@)?github\.com(?::\d+)?\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/i,
         /^git:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/i,
@@ -264,6 +264,13 @@ function normalizeNewlines(value) {
     const unix = value.replace(/\r\n/g, "\n");
     return unix.endsWith("\n") ? unix : `${unix}\n`;
 }
+export function skipBlankLines(lines, start) {
+    let peek = start;
+    while (peek < lines.length && (lines[peek] ?? "").trim() === "") {
+        peek += 1;
+    }
+    return peek;
+}
 function findBadgeClusterEnd(lines, start) {
     let index = start;
     while (index < lines.length && (lines[index] ?? "").trim() === "") {
@@ -279,10 +286,7 @@ function findBadgeClusterEnd(lines, start) {
             continue;
         }
         if (line.trim() === "") {
-            let peek = index + 1;
-            while (peek < lines.length && (lines[peek] ?? "").trim() === "") {
-                peek += 1;
-            }
+            const peek = skipBlankLines(lines, index + 1);
             if (peek < lines.length && BADGE_OR_IMAGE_LINE.test(lines[peek] ?? "")) {
                 index = peek;
                 continue;

package/dist/commands/init-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init-helpers.d.ts","sourceRoot":"","sources":["../../src/commands/init-helpers.ts"],"names":[],"mappings":"AAgGA,wBAAsB,gBAAgB,CACpC,GAAG,GAAE,MAAsB,GAC1B,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,IAAI,CAUN;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAGtD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CA6BjD;AAiDD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAU3D;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAYf;AASD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAkCnE;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAiBpD"}
+{"version":3,"file":"init-helpers.d.ts","sourceRoot":"","sources":["../../src/commands/init-helpers.ts"],"names":[],"mappings":"AAuIA,wBAAsB,gBAAgB,CACpC,GAAG,GAAE,MAAsB,GAC1B,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,IAAI,CAUN;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAGtD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CA6BjD;AAkDD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAU3D;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAYf;AASD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAkCnE;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAiBpD"}

package/dist/commands/init-helpers.js

@@ -23,6 +23,31 @@ import { ensureBranchStoreManifest } from "../utils/branch-store-locator.js";
 import { defaultKbManifest, writeKbManifest } from "../utils/kb-manifest.js";
 import { ENTITY_LANES, KB_PATHS } from "../utils/kb-paths.js";
 import { SYMBOLS_MANIFEST_COMMENT_BLOCK } from "./sync/manifest.js";
+// Git executes hooks with the caller's PATH, which does not include
+// node_modules/.bin, so a locally installed kibi CLI would not resolve.
+// Each hook resolves the binary up front: PATH first (global installs),
+// then a walk up from the repository root (git runs hooks from the top of
+// the working tree) for local npm/bun dependencies.
+const KIBI_BIN_RESOLVER = `KIBI_BIN="$(command -v kibi 2>/dev/null || true)"
+if [ -z "$KIBI_BIN" ]; then
+  kibi_dir="$PWD"
+  while [ -n "$kibi_dir" ] && [ "$kibi_dir" != "/" ]; do
+    if [ -x "$kibi_dir/node_modules/.bin/kibi" ]; then
+      KIBI_BIN="$kibi_dir/node_modules/.bin/kibi"
+      break
+    fi
+    kibi_parent="\${kibi_dir%/*}"
+    if [ -z "$kibi_parent" ]; then
+      kibi_parent="/"
+    fi
+    kibi_dir="$kibi_parent"
+  done
+fi
+if [ -z "$KIBI_BIN" ]; then
+  echo "kibi: cannot locate the kibi CLI (checked PATH and node_modules/.bin)." >&2
+  echo "Install kibi globally or as a project dependency, then re-run 'kibi init'." >&2
+  exit 1
+fi`;
 const POST_CHECKOUT_HOOK = `#!/bin/sh
 # post-checkout hook for kibi
 # Parameters: old_ref new_ref branch_flag
@@ -36,11 +61,17 @@ old_ref=$1
 new_ref=$2
 branch_flag=$3
 
-if [ "$branch_flag" = "1" ]; then
-  # Branch stores are derived from the checked-out tracked sources. Never copy
-  # the old branch's compiled store during checkout.
-  kibi sync
+# File checkouts never refresh the KB; skip binary resolution so sandboxed
+# test workspaces without an installed kibi CLI can restore tracked files.
+if [ "$branch_flag" != "1" ]; then
+  exit 0
 fi
+
+${KIBI_BIN_RESOLVER}
+
+# Branch stores are derived from the checked-out tracked sources. Never copy
+# the old branch's compiled store during checkout.
+"$KIBI_BIN" sync
 `;
 const POST_MERGE_HOOK = `#!/bin/sh
 # post-merge hook for kibi
@@ -49,7 +80,9 @@ const POST_MERGE_HOOK = `#!/bin/sh
 # Uses default non-coordinate-writing sync to avoid writing
 # committed symbol artifacts during automatic hook execution.
 
-kibi sync
+${KIBI_BIN_RESOLVER}
+
+"$KIBI_BIN" sync
 `;
 const POST_REWRITE_HOOK = `#!/bin/sh
 # post-rewrite hook for kibi
@@ -60,8 +93,10 @@ const POST_REWRITE_HOOK = `#!/bin/sh
 
 rewrite_type=$1
 
+${KIBI_BIN_RESOLVER}
+
 if [ "$rewrite_type" = "rebase" ]; then
-  kibi sync
+  "$KIBI_BIN" sync
 fi
 `;
 const PRE_COMMIT_HOOK = `#!/bin/sh
@@ -71,12 +106,15 @@ const PRE_COMMIT_HOOK = `#!/bin/sh
 # Behavior-changing source edits require staged Kibi impact evidence
 # (KB entity docs under .kb/, authored symbols metadata, or refreshed
 # symbol coordinates). Test-only and docs-only edits are exempt.
-# Refresh with:
-#   kibi sync --refresh-symbol-coordinates && git add .kb/symbol-coordinates.yaml .kb/symbols.yaml
+# Generated manifests are checked against the exact staged snapshot before
+# traceability validation. The check never stages files on the user's behalf.
 
 set -e
 
-kibi check --staged
+${KIBI_BIN_RESOLVER}
+
+"$KIBI_BIN" check-generated --staged --changed-only
+"$KIBI_BIN" check --staged
 `;
 export async function getCurrentBranch(cwd = process.cwd()) {
     const result = resolveActiveBranch(cwd);
@@ -131,10 +169,11 @@ export function updateGitIgnore(cwd) {
 const CANONICAL_DERIVED_GITIGNORE_ENTRIES = [
     ".kb/branches/",
     ".kb/recovery/",
-    ".kb/verification/",
+    ".kb/proof/runs/",
     ".kb/briefs/",
     ".kb/migrations/",
     ".kb/usage.log",
+    ".env.kibi",
 ];
 /**
  * Pre-canonical Kibi init wrote a blanket `.kb/` fence and then

package/dist/commands/migrate.d.ts

@@ -9,6 +9,10 @@ interface MigrateOptions {
     /** Internal migration-plan executor: create only the canonical baseline manifest. */
     initializeMissingConfig?: boolean;
 }
+export declare function formatSchemaVersion(rawSchemaVersion: unknown, normalized: number | null): string;
+export declare function warnMigrationRequiredWithoutYes(): {
+    exitCode: number;
+};
 export declare function migrateCommand(options?: MigrateOptions): Promise<{
     exitCode: number;
 }>;

package/dist/commands/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AAgDA,UAAU,cAAc;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qFAAqF;IACrF,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AA4WD,wBAAsB,cAAc,CAClC,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAuO/B"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AAgDA,UAAU,cAAc;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qFAAqF;IACrF,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AA0ID,wBAAgB,mBAAmB,CACjC,gBAAgB,EAAE,OAAO,EACzB,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,MAAM,CAUR;AAoND,wBAAgB,+BAA+B,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAKtE;AAGD,wBAAsB,cAAc,CAClC,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgO/B"}

package/dist/commands/migrate.js

@@ -98,7 +98,7 @@ function writeTextAtomically(filePath, content) {
     writeFileSync(tempPath, content, "utf8");
     renameSync(tempPath, filePath);
 }
-function formatSchemaVersion(rawSchemaVersion, normalized) {
+export function formatSchemaVersion(rawSchemaVersion, normalized) {
     if (normalized === null) {
         if (rawSchemaVersion === undefined) {
             return "missing";
@@ -261,6 +261,12 @@ function migrateSymbolGranularity(options) {
     }
     return { count, manifestPath };
 }
+export function warnMigrationRequiredWithoutYes() {
+    printWarning("Migration required for this repository.");
+    console.log("No changes applied.");
+    console.log("Use --dry-run to preview or --yes to apply the migration.");
+    return { exitCode: 0 };
+}
 // implements REQ-003
 export async function migrateCommand(options = {}) {
     if (options.applySafe === true ||
@@ -359,12 +365,6 @@ export async function migrateCommand(options = {}) {
         console.log("Re-run with --yes to apply these changes.");
         return { exitCode: 0 };
     }
-    if (!options.yes) {
-        printWarning("Migration required for this repository.");
-        console.log("No changes applied.");
-        console.log("Use --dry-run to preview or --yes to apply the migration.");
-        return { exitCode: 0 };
-    }
     // One-way storage cutover first: files must reach the canonical layout
     // before the manifest records the new schema generation.
     if (needsStorageMigration) {

package/dist/commands/proof-explain.d.ts

@@ -0,0 +1,10 @@
+export type ProofExplainOptions = Readonly<{
+    id?: string;
+    requirement?: string;
+    symbol?: string;
+    json?: boolean;
+}>;
+export declare function proofExplainCommand(options: ProofExplainOptions): Promise<{
+    exitCode: number;
+}>;
+//# sourceMappingURL=proof-explain.d.ts.map

package/dist/commands/proof-explain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-explain.d.ts","sourceRoot":"","sources":["../../src/commands/proof-explain.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC,CAAC;AAGH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAuC/B"}

package/dist/commands/proof-explain.js

@@ -0,0 +1,45 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+ */
+import { classifyExplainTarget, executeProofExplain, renderProofExplain, } from "../operations/proof/explain.js";
+import { createCliRuntime } from "../runtime/cli-runtime.js";
+// implements REQ-kibi-verification-evidence-contract
+export async function proofExplainCommand(options) {
+    const target = classifyExplainTarget(options.id, {
+        ...(options.requirement === undefined
+            ? {}
+            : { requirement: options.requirement }),
+        ...(options.symbol === undefined ? {} : { symbol: options.symbol }),
+    });
+    const runtime = createCliRuntime();
+    const context = await runtime.open({
+        name: "kibi_proof_explain",
+        effects: [],
+        requiresProlog: true,
+        execute: async () => undefined,
+    }, {});
+    let completed = false;
+    try {
+        const { view } = await executeProofExplain(target, context);
+        if (options.json) {
+            process.stdout.write(`${JSON.stringify(view, null, 2)}\n`);
+        }
+        else {
+            process.stdout.write(renderProofExplain(view));
+        }
+        completed = true;
+        await runtime.afterSuccess({ name: "kibi_proof_explain" }, context);
+        return { exitCode: 0 };
+    }
+    finally {
+        await runtime.close(context, completed
+            ? { status: "success", result: 0 }
+            : { status: "error", error: 1 });
+    }
+}

package/dist/commands/proof-impact.d.ts

@@ -0,0 +1,7 @@
+export type ProofImpactOptions = Readonly<{
+    json?: boolean;
+}>;
+export declare function proofImpactCommand(options: ProofImpactOptions): Promise<{
+    exitCode: number;
+}>;
+//# sourceMappingURL=proof-impact.d.ts.map

package/dist/commands/proof-impact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-impact.d.ts","sourceRoot":"","sources":["../../src/commands/proof-impact.ts"],"names":[],"mappings":"AAiBA,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC,CAAC;AAGH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA8B/B"}