mandrel 1.57.0

package/.agents/scripts/analyze-execution.js

@@ -0,0 +1,369 @@
+#!/usr/bin/env node
+
+/**
+ * analyze-execution.js — single writer of the structured perf-summary
+ * comments (Epic #1030 / Story #1123).
+ *
+ * Reads NDJSON from `temp/epic-<eid>/stories/story-<sid>/signals.ndjson` and
+ * upserts one of two structured comments:
+ *
+ *   - `--story <sid> --epic <eid>` (Story mode): posts
+ *     `<!-- structured:story-perf-summary -->` on the Story ticket. The
+ *     payload combines the Story's NDJSON signals with the timing
+ *     summary written by `post-merge-close.js` to
+ *     `temp/epic-<eid>/stories/story-<sid>/phase-timings.json` (path overridable
+ *     via `--phase-timings <path>`).
+ *
+ *   - `--epic <eid>` (Epic mode): rolls up every Story under the Epic by
+ *     fetching each `story-perf-summary` structured comment from the
+ *     ticketing provider. Posts the
+ *     `<!-- structured:epic-perf-report -->` comment on the Epic ticket.
+ *     Run from the retro composer / `/epic-deliver` Phase 6.0.
+ *
+ * Both modes are idempotent: `upsertStructuredComment` deletes the prior
+ * marker before posting the new one.
+ *
+ * Exit code is `0` on success, `0` on tolerated soft failures (missing
+ * NDJSON for a Story, no children for an Epic) so the close pipelines
+ * never block on observability output. Hard failures (bad CLI args,
+ * provider error, schema-violating payload) exit non-zero — the call
+ * sites in post-merge-pipeline / `/epic-deliver` Phase 5 treat that
+ * as a non-fatal warning.
+ *
+ * This file is a thin CLI: it wires the I/O readers from
+ * `lib/observability/perf-report-readers.js` to the pure renderers in
+ * `lib/observability/perf-report-render.js` inside `runStoryMode` /
+ * `runEpicMode`, then parses argv and dispatches. The report-formatting
+ * and signal-reading logic live in those two modules so report formatting
+ * is unit-testable without fixtures (Story #3350).
+ *
+ * Usage:
+ *   node .agents/scripts/analyze-execution.js --story <sid> --epic <eid> \
+ *       [--phase-timings <path>]
+ *   node .agents/scripts/analyze-execution.js --epic <eid>
+ *
+ * @see docs/data-dictionary.md §StoryPerfSummary, §EpicPerfReport
+ */
+
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { parseArgs } from 'node:util';
+import { runAsCli } from './lib/cli-utils.js';
+import { signalsFile } from './lib/config/temp-paths.js';
+import { PROJECT_ROOT, resolveConfig } from './lib/config-resolver.js';
+import { Logger } from './lib/Logger.js';
+import { computeBaselineRefreshRate } from './lib/observability/baseline-refresh-rate.js';
+import {
+  computeEpicPerfReport,
+  computeStoryPerfSummary,
+} from './lib/observability/perf-aggregator.js';
+import {
+  aggregateBaselineFrictionFromSignals,
+  collectStorySummaries,
+  gatherEpicCommitsFromGit,
+  readEpicLifecycleEvents,
+  readGhSpawnCount,
+  readPhaseTimings,
+  readStorySignals,
+} from './lib/observability/perf-report-readers.js';
+import {
+  EPIC_PERF_TYPE,
+  renderEpicBody,
+  renderStoryBody,
+  STORY_PERF_TYPE,
+} from './lib/observability/perf-report-render.js';
+import { upsertStructuredComment } from './lib/orchestration/ticketing.js';
+import { createProvider } from './lib/provider-factory.js';
+
+// Re-exported so existing importers (tests, retro composer) keep a stable
+// entry point after the read/render split (Story #3350).
+export { extractStoryPerfSummaryFromComment } from './lib/observability/perf-report-render.js';
+
+/**
+ * Resolve the wave-execution concurrency cap from the resolved config
+ * (`delivery.deliverRunner.concurrencyCap`), falling back to the
+ * dispatcher's safe default of 2. Story #3025 / Task #3030.
+ */
+function resolveConcurrencyCap(config) {
+  const cap = config?.delivery?.deliverRunner?.concurrencyCap;
+  return Number.isInteger(cap) && cap >= 1 ? cap : 2;
+}
+
+/**
+ * Resolve the verify-results concurrency cap from the resolved config
+ * (`delivery.deliverRunner.verifyConcurrencyCap`), falling back to 4.
+ * Story #3025 / Task #3030.
+ */
+function resolveVerifyConcurrencyCap(config) {
+  const cap = config?.delivery?.deliverRunner?.verifyConcurrencyCap;
+  return Number.isInteger(cap) && cap >= 1 ? cap : 4;
+}
+
+/**
+ * Story mode: read NDJSON + phase-timings, build the payload, upsert.
+ *
+ * @param {{
+ *   storyId: number,
+ *   epicId: number,
+ *   phaseTimingsPath?: string|null,
+ *   provider: object,
+ *   config: object,
+ *   logger?: object,
+ *   now?: () => Date,
+ * }} ctx
+ * @returns {Promise<{ commentId: number, payload: object }>}
+ */
+export async function runStoryMode(ctx) {
+  const { storyId, epicId, provider, config } = ctx;
+  const logger = ctx.logger ?? Logger;
+  const now = ctx.now ?? (() => new Date());
+
+  logger.info?.(
+    `[analyze-execution] story-mode story=#${storyId} epic=#${epicId}`,
+  );
+
+  const events = await readStorySignals(epicId, storyId, config);
+  const phaseTiming = await readPhaseTimings(
+    epicId,
+    storyId,
+    config,
+    ctx.phaseTimingsPath ?? null,
+  );
+  const ghSpawnCount = await readGhSpawnCount(epicId, storyId, config);
+
+  const payload = computeStoryPerfSummary(events, {
+    storyId,
+    epicId,
+    closedAt: now().toISOString(),
+    phaseTiming,
+  });
+  if (ghSpawnCount !== null) {
+    // Throw-away measurement field (Story #1795). Surfaces the in-process
+    // `gh-exec.getSpawnCount()` snapshot captured at the end of close
+    // validation so the Story-close structured comment can be diffed
+    // against the baseline recorded under `temp/epic-1788/` for the
+    // "≥100 fewer spawns" acceptance criterion.
+    payload.ghSpawnCount = ghSpawnCount;
+  }
+
+  const body = renderStoryBody(payload);
+  const result = await upsertStructuredComment(
+    provider,
+    storyId,
+    STORY_PERF_TYPE,
+    body,
+  );
+  logger.info?.(
+    `[analyze-execution] story-perf-summary upserted on Story #${storyId} (commentId=${result.commentId})`,
+  );
+  return { commentId: result.commentId, payload };
+}
+
+/**
+ * Epic mode: collect every Story's perf summary, roll them up, upsert
+ * the epic-perf-report comment.
+ *
+ * @param {{
+ *   epicId: number,
+ *   provider: object,
+ *   config?: object,
+ *   cwd?: string,
+ *   windowDays?: number,
+ *   logger?: object,
+ *   now?: () => Date,
+ *   collectSummariesFn?: typeof collectStorySummaries,
+ *   gatherEpicCommitsFn?: typeof gatherEpicCommitsFromGit,
+ *   aggregateFrictionFn?: typeof aggregateBaselineFrictionFromSignals,
+ * }} ctx
+ * @returns {Promise<{ commentId: number, payload: object, baselineRefreshRate: object | null, qualityGateFriction: object | null }>}
+ */
+export async function runEpicMode(ctx) {
+  const { epicId, provider } = ctx;
+  const logger = ctx.logger ?? Logger;
+  const now = ctx.now ?? (() => new Date());
+  const windowDays =
+    Number.isFinite(ctx.windowDays) && ctx.windowDays > 0
+      ? Math.floor(ctx.windowDays)
+      : 28;
+  const collectFn = ctx.collectSummariesFn ?? collectStorySummaries;
+  const gatherCommitsFn = ctx.gatherEpicCommitsFn ?? gatherEpicCommitsFromGit;
+  const aggregateFrictionFn =
+    ctx.aggregateFrictionFn ?? aggregateBaselineFrictionFromSignals;
+
+  logger.info?.(`[analyze-execution] epic-mode epic=#${epicId}`);
+
+  const summaries = await collectFn(provider, epicId, logger);
+
+  // Story #3025 / Task #3030 — forward lifecycle events to the
+  // aggregator so the report's `waveParallelism` array is populated
+  // (the analyzer used to omit the field, leaving the report at `[]`).
+  const readLifecycleEventsFn =
+    ctx.readLifecycleEventsFn ?? readEpicLifecycleEvents;
+  const lifecycleEvents = ctx.config
+    ? await readLifecycleEventsFn(epicId, ctx.config, logger)
+    : [];
+  const concurrencyCap = resolveConcurrencyCap(ctx.config);
+  const verifyConcurrencyCap = resolveVerifyConcurrencyCap(ctx.config);
+
+  // Only forward `events` when we actually have something — passing an
+  // empty array suppresses the friction-from-summaries fallback in
+  // `computeEpicPerfReport.buildSignalCounts`, which would zero the
+  // counts for callers that have summaries but no lifecycle stream
+  // (e.g. legacy/test paths without a `config`).
+  const reportOpts = {
+    epicId,
+    generatedAt: now().toISOString(),
+    concurrencyCap,
+    verifyConcurrencyCap,
+  };
+  if (lifecycleEvents.length > 0) {
+    reportOpts.events = lifecycleEvents;
+  }
+
+  const payload = computeEpicPerfReport(summaries, reportOpts);
+
+  // Story #1400 / Task #1427 — baseline-refresh-rate row. Pure reporter
+  // operates on a fixture of git-log records gathered by the injected
+  // `gatherEpicCommitsFn`. A spawn failure surfaces as `[]` and degrades
+  // to the "no Story merges in window" line in the rendered body.
+  let baselineRefreshRate = null;
+  try {
+    const commits = await gatherCommitsFn({
+      epicId,
+      windowDays,
+      cwd: ctx.cwd ?? process.cwd(),
+      logger,
+    });
+    baselineRefreshRate = computeBaselineRefreshRate(commits, {
+      windowDays,
+      now,
+    });
+  } catch (err) {
+    logger.warn?.(
+      `[analyze-execution] baseline-refresh-rate gather failed (non-fatal): ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    );
+  }
+
+  // Story #1400 / Task #1429 — Quality gate friction block. Aggregates
+  // `baseline-refresh-regression` records from the existing
+  // signals.ndjson stream (no new file format).
+  let qualityGateFriction = null;
+  if (ctx.config) {
+    try {
+      const storyIds = (summaries ?? [])
+        .map((s) => s?.storyId)
+        .filter((n) => Number.isInteger(n) && n > 0);
+      qualityGateFriction = await aggregateFrictionFn({
+        epicId,
+        storyIds,
+        config: ctx.config,
+        windowDays,
+        now,
+      });
+    } catch (err) {
+      logger.warn?.(
+        `[analyze-execution] quality-gate-friction aggregate failed (non-fatal): ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      );
+    }
+  }
+
+  const body = renderEpicBody(payload, {
+    baselineRefreshRate,
+    qualityGateFriction,
+  });
+  const result = await upsertStructuredComment(
+    provider,
+    epicId,
+    EPIC_PERF_TYPE,
+    body,
+  );
+  logger.info?.(
+    `[analyze-execution] epic-perf-report upserted on Epic #${epicId} (commentId=${result.commentId}, stories=${summaries.length})`,
+  );
+  return {
+    commentId: result.commentId,
+    payload,
+    baselineRefreshRate,
+    qualityGateFriction,
+  };
+}
+
+function parseCli(argv) {
+  const { values } = parseArgs({
+    args: argv,
+    options: {
+      story: { type: 'string' },
+      epic: { type: 'string' },
+      'phase-timings': { type: 'string' },
+      'window-days': { type: 'string' },
+      cwd: { type: 'string' },
+    },
+    strict: false,
+  });
+  const story = values.story != null ? Number.parseInt(values.story, 10) : null;
+  const epic = values.epic != null ? Number.parseInt(values.epic, 10) : null;
+  const windowDays =
+    values['window-days'] != null
+      ? Number.parseInt(values['window-days'], 10)
+      : null;
+  return {
+    storyId: Number.isInteger(story) && story > 0 ? story : null,
+    epicId: Number.isInteger(epic) && epic > 0 ? epic : null,
+    phaseTimingsPath: values['phase-timings'] ?? null,
+    windowDays:
+      Number.isInteger(windowDays) && windowDays > 0 ? windowDays : null,
+    cwd: values.cwd ?? null,
+  };
+}
+
+async function main(argv = process.argv.slice(2)) {
+  const args = parseCli(argv);
+
+  if (!args.epicId) {
+    throw new Error(
+      'Usage: analyze-execution.js --epic <eid> [--story <sid>] [--phase-timings <path>]',
+    );
+  }
+
+  const cwd = path.resolve(args.cwd ?? PROJECT_ROOT);
+  const config = resolveConfig({ cwd });
+  const provider = createProvider(config);
+
+  if (args.storyId) {
+    // Existence guard: surface a clear log when the Story has no signals
+    // yet, but still post the comment with empty arrays so the marker
+    // exists for idempotence checks downstream.
+    const sigPath = signalsFile(args.epicId, args.storyId, config);
+    try {
+      await fs.access(sigPath);
+    } catch {
+      Logger.info?.(
+        `[analyze-execution] no signals.ndjson at ${sigPath} — posting empty story-perf-summary`,
+      );
+    }
+    const result = await runStoryMode({
+      storyId: args.storyId,
+      epicId: args.epicId,
+      phaseTimingsPath: args.phaseTimingsPath,
+      provider,
+      config,
+    });
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    return;
+  }
+
+  const result = await runEpicMode({
+    epicId: args.epicId,
+    provider,
+    config,
+    cwd,
+    windowDays: args.windowDays ?? undefined,
+  });
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+
+runAsCli(import.meta.url, main, { source: 'analyze-execution' });

package/.agents/scripts/assert-branch.js

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+
+/* node:coverage ignore file */
+
+/**
+ * assert-branch.js — Pre-commit Branch Guard
+ *
+ * Exits non-zero if the current git branch does not match `--expected`.
+ * Intended to be invoked immediately before `git add`/`git commit` in any
+ * workflow where multiple agents share a working directory. Prevents the
+ * parallel-story contention bug where one agent's `git add` sweeps another
+ * agent's WIP after a concurrent `git checkout`.
+ *
+ * Usage:
+ *   node .agents/scripts/assert-branch.js --expected <branch-name>
+ *
+ * Exit codes:
+ *   0 — Current branch matches expected.
+ *   1 — Mismatch (stderr explains) or invocation error.
+ */
+
+import { fileURLToPath } from 'node:url';
+
+import { PROJECT_ROOT } from './lib/config-resolver.js';
+import { gitSpawn } from './lib/git-utils.js';
+
+import { Logger } from './lib/Logger.js';
+export function assertBranch(expected, { cwd = PROJECT_ROOT } = {}) {
+  if (!expected || typeof expected !== 'string') {
+    return { ok: false, reason: 'missing --expected <branch>' };
+  }
+  const result = gitSpawn(cwd, 'branch', '--show-current');
+  if (result.status !== 0) {
+    return {
+      ok: false,
+      reason: `git branch --show-current failed: ${result.stderr}`,
+    };
+  }
+  const actual = result.stdout;
+  if (actual !== expected) {
+    return {
+      ok: false,
+      reason: `branch mismatch — expected "${expected}", on "${actual}". Another agent may have switched the working directory. STOP: do not commit.`,
+      actual,
+      expected,
+    };
+  }
+  return { ok: true, actual, expected };
+}
+
+const FLAG_SPEC = {
+  expected: { type: 'string' },
+  cwd: { type: 'string' },
+};
+
+function parseArgs(argv) {
+  const out = { expected: null, cwd: null };
+  for (const [name, def] of Object.entries(FLAG_SPEC)) {
+    const idx = argv.indexOf(`--${name}`);
+    if (idx >= 0 && idx + 1 < argv.length && def.type === 'string') {
+      out[name] = argv[idx + 1];
+    }
+  }
+  return out;
+}
+
+// cli-opt-out: synchronous CLI with bespoke main-guard; runAsCli's async-main pattern doesn't fit.
+const isMain = process.argv[1] === fileURLToPath(import.meta.url);
+if (isMain) {
+  const { expected, cwd: flagCwd } = parseArgs(process.argv.slice(2));
+  // Worktree-aware: hooks invoked inside a per-story worktree must guard the
+  // worktree's HEAD, not the main checkout. Resolution precedence:
+  //   --cwd <path>  >  AGENT_WORKTREE_ROOT env  >  PROJECT_ROOT (main checkout)
+  // Flag wins so operators can override even when the env var leaked from a
+  // parent shell.
+  const cwd = flagCwd || process.env.AGENT_WORKTREE_ROOT || PROJECT_ROOT;
+  const result = assertBranch(expected, { cwd });
+  if (!result.ok) {
+    Logger.error(`[assert-branch] ${result.reason}`);
+    process.exit(1);
+  }
+  Logger.info(`[assert-branch] ✅ on ${result.actual}`);
+}

package/.agents/scripts/audit-labels-bootstrap.js

@@ -0,0 +1,253 @@
+/**
+ * audit-labels-bootstrap.js — Idempotently create the `audit::<dimension>`
+ * label taxonomy in the configured GitHub repo.
+ *
+ * Run this once per repo before `/audit-to-stories` opens its first
+ * Story. Re-runs are safe — existing labels are skipped, only missing
+ * ones are created. Story #2583 acceptance criterion #6.
+ *
+ * The dimension list mirrors the 12 audit-* workflows in
+ * `.agents/workflows/`. Adding a new audit-* workflow should also add a
+ * corresponding entry below.
+ *
+ * Delegates to `gh label create` so the script works without any
+ * provider plumbing — `gh auth status` is the only prerequisite. Per
+ * .agents/rules/orchestration-error-handling.md, the CLI surface throws
+ * rather than calling Logger.fatal.
+ */
+
+import process from 'node:process';
+import { parseArgs } from 'node:util';
+
+import { runAsCli } from './lib/cli-utils.js';
+import { resolveConfig } from './lib/config-resolver.js';
+import { gh as defaultGh, GhExecError } from './lib/gh-exec.js';
+
+const DIMENSIONS = Object.freeze([
+  {
+    name: 'architecture',
+    color: '6f42c1',
+    description: 'Audit-sourced finding: architectural concerns',
+  },
+  {
+    name: 'clean-code',
+    color: '0e8a16',
+    description: 'Audit-sourced finding: clean-code / maintainability',
+  },
+  {
+    name: 'dependencies',
+    color: 'd4c5f9',
+    description: 'Audit-sourced finding: dependencies / supply chain',
+  },
+  {
+    name: 'devops',
+    color: 'fbca04',
+    description: 'Audit-sourced finding: DevOps / CI / CD',
+  },
+  {
+    name: 'lighthouse',
+    color: 'c5def5',
+    description: 'Audit-sourced finding: Lighthouse score regressions',
+  },
+  {
+    name: 'performance',
+    color: 'b60205',
+    description: 'Audit-sourced finding: performance / latency',
+  },
+  {
+    name: 'privacy',
+    color: 'fef2c0',
+    description: 'Audit-sourced finding: privacy / data handling',
+  },
+  {
+    name: 'quality',
+    color: '0052cc',
+    description: 'Audit-sourced finding: test quality / coverage gaps',
+  },
+  {
+    name: 'security',
+    color: 'b60205',
+    description: 'Audit-sourced finding: security / OWASP',
+  },
+  {
+    name: 'seo',
+    color: 'fbca04',
+    description: 'Audit-sourced finding: SEO / discoverability',
+  },
+  {
+    name: 'sre',
+    color: '0052cc',
+    description: 'Audit-sourced finding: SRE / observability / reliability',
+  },
+  {
+    name: 'ux-ui',
+    color: 'd4c5f9',
+    description: 'Audit-sourced finding: UX / UI concerns',
+  },
+]);
+
+async function labelExists(gh, owner, repo, name) {
+  try {
+    const list = await gh.label.list(
+      ['--repo', `${owner}/${repo}`, '--limit', '200'],
+      ['name'],
+    );
+    return Array.isArray(list) && list.some((l) => l?.name === name);
+  } catch (_) {
+    return false;
+  }
+}
+
+async function createLabel(
+  gh,
+  owner,
+  repo,
+  { name, color, description },
+  { force },
+) {
+  const flags = [
+    '--repo',
+    `${owner}/${repo}`,
+    '--color',
+    color,
+    '--description',
+    description,
+  ];
+  if (force) flags.push('--force');
+  try {
+    await gh.label.create(name, flags);
+    return { ok: true, stderr: '' };
+  } catch (err) {
+    const stderr =
+      err instanceof GhExecError && typeof err.stderr === 'string'
+        ? err.stderr.trim()
+        : String(err?.message ?? err).trim();
+    return { ok: false, stderr };
+  }
+}
+
+export async function bootstrapAuditLabels({
+  owner,
+  repo,
+  force = false,
+  dryRun = false,
+  gh = defaultGh,
+} = {}) {
+  if (typeof owner !== 'string' || owner.length === 0) {
+    throw new Error('bootstrapAuditLabels: owner is required');
+  }
+  if (typeof repo !== 'string' || repo.length === 0) {
+    throw new Error('bootstrapAuditLabels: repo is required');
+  }
+
+  const created = [];
+  const skipped = [];
+  const failed = [];
+
+  for (const dim of DIMENSIONS) {
+    const labelName = `audit::${dim.name}`;
+    const candidate = { ...dim, name: labelName };
+
+    if (dryRun) {
+      created.push(labelName);
+      continue;
+    }
+
+    if (!force && (await labelExists(gh, owner, repo, labelName))) {
+      skipped.push(labelName);
+      continue;
+    }
+
+    const result = await createLabel(gh, owner, repo, candidate, { force });
+    if (result.ok) {
+      created.push(labelName);
+    } else if (/already exists/i.test(result.stderr)) {
+      skipped.push(labelName);
+    } else {
+      failed.push({ label: labelName, reason: result.stderr });
+    }
+  }
+
+  return { created, skipped, failed, total: DIMENSIONS.length };
+}
+
+/**
+ * Resolve `{ owner, repo }` from parsed CLI flags, falling back to the
+ * `github.{owner,repo}` config keys. Throws when neither source supplies
+ * both values. Pulled out of `main` so the resolution + guard is a single
+ * testable unit.
+ *
+ * @param {{ owner?: string, repo?: string }} values
+ * @param {{ github?: { owner?: string, repo?: string } }} [config]
+ * @returns {{ owner: string, repo: string }}
+ */
+export function resolveOwnerRepo(values, config) {
+  const owner = values.owner ?? config?.github?.owner;
+  const repo = values.repo ?? config?.github?.repo;
+  if (!owner || !repo) {
+    throw new Error(
+      'audit-labels-bootstrap: --owner and --repo are required (or set them in .agentrc.json under github.{owner,repo}).',
+    );
+  }
+  return { owner, repo };
+}
+
+/**
+ * Render the operator-facing summary lines for a bootstrap result. Pure:
+ * returns `{ stdout, stderr }` strings rather than writing, so `main` owns
+ * the single write site and the formatting stays unit-testable.
+ *
+ * @param {{ created: string[], skipped: string[], failed: Array<{label: string, reason: string}>, total: number }} result
+ * @returns {{ stdout: string, stderr: string }}
+ */
+export function formatBootstrapReport(result) {
+  const lines = [
+    `audit-labels-bootstrap: ${result.created.length} created, ${result.skipped.length} skipped, ${result.failed.length} failed (of ${result.total}).`,
+  ];
+  if (result.created.length > 0) {
+    lines.push(`  created: ${result.created.join(', ')}`);
+  }
+  if (result.skipped.length > 0) {
+    lines.push(`  skipped: ${result.skipped.join(', ')}`);
+  }
+  const stderr = result.failed
+    .map((f) => `  FAILED ${f.label}: ${f.reason}`)
+    .join('\n');
+  return {
+    stdout: `${lines.join('\n')}\n`,
+    stderr: stderr ? `${stderr}\n` : '',
+  };
+}
+
+export const __testing = { DIMENSIONS };
+
+async function main() {
+  const { values } = parseArgs({
+    args: process.argv.slice(2),
+    options: {
+      owner: { type: 'string' },
+      repo: { type: 'string' },
+      force: { type: 'boolean' },
+      'dry-run': { type: 'boolean' },
+    },
+    strict: false,
+  });
+
+  const { owner, repo } = resolveOwnerRepo(values, resolveConfig());
+
+  const result = await bootstrapAuditLabels({
+    owner,
+    repo,
+    force: !!values.force,
+    dryRun: !!values['dry-run'],
+  });
+
+  const report = formatBootstrapReport(result);
+  process.stdout.write(report.stdout);
+  if (report.stderr) process.stderr.write(report.stderr);
+  if (result.failed.length > 0) {
+    throw new Error(`${result.failed.length} label(s) failed to create`);
+  }
+}
+
+runAsCli(import.meta.url, main, { source: 'audit-labels-bootstrap' });