mustflow 1.18.16 → 1.31.0

package/README.md

@@ -2,9 +2,9 @@
 
 Languages: [English](README.md) · [한국어](docs/i18n/ko/README.md) · [中文](docs/i18n/zh/README.md) · [Español](docs/i18n/es/README.md) · [Français](docs/i18n/fr/README.md) · [हिन्दी](docs/i18n/hi/README.md)
 
-mustflow is a workflow CLI designed for LLM coding agents. It guides agents to enter a repository, understand the correct operating context, run only authorized commands, and verify their work without guessing.
+mustflow is a repository-local work contract and verification CLI for LLM coding agents. It keeps agents inside explicit read, command, and verification boundaries without replacing the host agent's sandbox, approval, checkpoint, model, or tool policies.
 
-The core concept is straightforward: place `AGENTS.md` at the project root and keep detailed workflows under `.mustflow/`. Agents start from `AGENTS.md` and then follow the command contract, skills, project context, and verification rules in sequence.
+The core concept is straightforward: place `AGENTS.md` at the project root and keep detailed workflows under `.mustflow/`. Agents start from `AGENTS.md`, then follow the repository command contract, skills, project context, and verification rules in sequence.
 
 - Documentation site: <https://0disoft.github.io/mustflow/>
 - Human-readable project examples: [`examples/`](examples/)
@@ -106,13 +106,16 @@ mustflow installs and validates an agent workflow for user projects.
 - Installs `AGENTS.md` and `.mustflow/**` workflow files.
 - Declares runnable command rules in `.mustflow/config/commands.toml`.
 - Checks installation health and configuration structure with `mf check` and `mf doctor`.
+- Reports host adapter compatibility with `mf adapters status` without generating host-specific files or treating them as command authority.
 - Classifies changed files, public surfaces, and validation reasons with `mf classify`.
-- Prints execution-free verification plans with `mf verify --plan-only --json`, including read-only local-index lock explanations when available.
+- Prints execution-free verification plans with `mf verify --plan-only --json`, including a machine-readable verification decision graph and read-only local-index lock explanations when available.
 - Runs only allowed one-shot commands within a timeout via `mf run <intent>` or `mf verify` when the selected intent is runnable.
 - Writes command receipts to `.mustflow/state/runs/latest.json`.
 - Generates a concise repository navigation map, `REPO_MAP.md`, with `mf map`.
-- Indexes and searches mustflow docs, skills, skill routes, command rules, command-effect locks, file fingerprints, and opt-in source anchor metadata with SQLite via `mf index` and `mf search`. The local SQLite file is a rebuildable lookup cache, not a memory store, audit log, command transcript store, or source-content database.
+- Indexes and searches mustflow docs, skills, skill routes, command rules, command-effect locks, file fingerprints, and opt-in source anchor metadata with SQLite via `mf index` and `mf search`. The local SQLite file is a rebuildable lookup cache, not a memory store, audit log, command transcript store, command-authority source, or source-content database.
 - Tracks agent-created or agent-modified documentation needing prose review with `mf docs review`.
+- Validates restricted work-item or handoff JSON records with `mf handoff validate` without creating backlog files, storing transcripts, or granting command authority.
+- Exports bounded static dashboard reports with `mf dashboard --export-json <path>` or `mf dashboard --export <path>` for pull requests and continuous integration artifacts. The export includes a `harness_report` summary for install state, changed surfaces, verification decisions, latest receipt metadata, document-review status, and remaining risks without raw command-output tails or mutation controls.
 - Previews and applies bundled template updates safely with `mf update`.
 - Publishes JSON Schemas for automation-facing reports and command contracts in `schemas/`.
 
@@ -173,6 +176,8 @@ your-project/
       │  └─ SKILL.md
       ├─ external-prompt-injection-defense/
       │  └─ SKILL.md
+      ├─ external-skill-intake/
+      │  └─ SKILL.md
       ├─ failure-triage/
       │  └─ SKILL.md
       ├─ instruction-conflict-scope-check/
@@ -207,6 +212,8 @@ your-project/
       │  └─ SKILL.md
       ├─ test-maintenance/
       │  └─ SKILL.md
+      ├─ vertical-slice-tdd/
+      │  └─ SKILL.md
       ├─ ui-quality-gate/
       │  └─ SKILL.md
       ├─ visual-review-artifact/
@@ -261,6 +268,14 @@ npx mf update --dry-run
 npx mf update --apply
 ```
 
+After updating the mustflow package, `mf upgrade` combines the package freshness check with the safe project-file update step. It does not install packages by itself; update npm, pnpm, or Bun first.
+
+```sh
+bun update -g mustflow
+mf upgrade --dry-run
+mf upgrade
+```
+
 Agents should prefer the configured update intents so the repository receives a run receipt.
 
 ```sh
@@ -278,6 +293,7 @@ mf run mustflow_update_apply
 | `mf init --force` | Back up conflicting files, then overwrite them. |
 | `mf check` | Validate mustflow files, TOML configuration, and skill document shape. |
 | `mf check --strict` | Run additional safety checks for document identity, authority/lifecycle metadata, skill index/body alignment, skill metadata, command boundaries, version-source discovery, retention policy, output limits, raw logs, and secret-like context. |
+| `mf adapters status` | Inspect existing host-specific instruction and adapter files without generating adapter files or granting command authority. |
 | `mf classify --changed` | Classify changed paths, public surfaces, and validation reasons without modifying files. |
 | `mf contract-lint` | Inspect `.mustflow/config/commands.toml` for command-contract errors and warnings without running commands. |
 | `mf doctor` | Inspect the current mustflow root without writing files. |
@@ -285,17 +301,21 @@ mf run mustflow_update_apply
 | `mf docs review add <path>` | Add or refresh a document review queue entry. |
 | `mf docs review comment <path>` | Add multiline review guidance to an existing queue entry. |
 | `mf docs review approve <path>` | Mark review complete and hide the document from the default queue. |
+| `mf handoff validate <path>` | Validate a restricted work-item or handoff JSON record without writing files. |
 | `mf context --json` | Print read order, command rules, available capabilities, and recent run summary as JSON. |
 | `mf map --stdout` | Print the current mustflow root map to stdout. |
 | `mf map --write` | Create or update `REPO_MAP.md`. |
 | `mf run <intent>` | Run an allowed one-shot command. |
+| `mf run <intent> --dry-run --json` | Preview whether an intent is runnable and what command metadata would be used, without executing it. |
 | `mf index` | Build a SQLite index for mustflow docs, skill routes, command rules, command-effect locks, and file fingerprints. Use `--incremental` to reuse a compatible fresh index without rewriting it. |
 | `mf search <query>` | Search docs, skills, skill routes, command rules, and command-effect locks in the SQLite index. |
 | `mf status` | Inspect installed state and changed or missing files. |
 | `mf update --dry-run` | Calculate a template update plan without writing files. |
 | `mf update --apply` | Apply template updates when nothing is blocked. |
+| `mf upgrade` | Check package freshness, then apply safe bundled template updates when the package is current. |
+| `mf upgrade --dry-run` | Check package freshness and print the safe project update plan without writing files. |
 | `mf help <topic>` | Show installed mustflow help. |
-| `mf dashboard` | Start a local inspection dashboard for status, verification recommendations, release/version-source status, template update readiness, latest run receipt, skill routes, safe preferences, and documentation review. It does not execute commands or apply fixes. |
+| `mf dashboard` | Start a local inspection dashboard for status, verification recommendations, release/version-source status, template update readiness, latest run receipt, skill routes, safe preferences, and documentation review. Use `--export-json <path>` or `--export <path>` for a bounded static report. It does not execute commands or apply fixes. |
 | `mf version` | Print the installed mustflow package version. |
 | `mf version --check` | Compare the installed package version with the latest npm release and print an update command if a newer version exists. |
 | `mf version-sources` | Inspect detected package, template, and declared version sources without modifying files. |
@@ -322,9 +342,9 @@ Runnable work is declared in `.mustflow/config/commands.toml` so agents do not g
 
 Development servers, watch modes, browser UIs, interactive commands, and background processes do not run directly.
 
-Use `mf verify --reason <event> --plan-only --json` to inspect matching verification intents and missing runnable coverage without executing commands. When `.mustflow/cache/mustflow.sqlite` is fresh, scheduled entries include read-only `effectGraph` metadata for write locks and lock conflicts.
+Use `mf verify --reason <event> --plan-only --json` to inspect matching verification intents, command eligibility, remaining gaps, and missing runnable coverage without executing commands. Use `mf run <intent> --dry-run --json` to inspect one resolved command intent without spawning a process or writing a run receipt. Plan-only verification includes a `decision_graph` that connects changed surfaces, classification reasons, command candidates, eligibility checks, effects, and gaps. When `.mustflow/cache/mustflow.sqlite` is fresh, scheduled entries also include read-only `effectGraph` metadata for write locks and lock conflicts. These graph rows are marked `explanation_only` and never grant command authority; `.mustflow/config/commands.toml` remains the only runnable command source.
 
-Each command run writes the latest run record to `.mustflow/state/runs/latest.json`. The record includes the intent name, working directory, timeout, exit code, timeout status, and the tail of stdout and stderr.
+Each executed command run writes the latest run record to `.mustflow/state/runs/latest.json`. The record includes the intent name, working directory, timeout, exit code, timeout status, and the tail of stdout and stderr.
 
 ## Language and profiles
 
@@ -377,7 +397,7 @@ Versioned contract specifications live in `docs/spec/`. The documentation site l
 These are ideas not yet officially supported:
 
 - Community skill registry and skill pack installs
-- Optional `.mustflow/work-items/`
+- Optional `.mustflow/work-items/` writers and lifecycle commands
 - `mf orient`, `mf refresh`
 - Tool-specific adapters
 

package/dist/cli/commands/adapters.js

@@ -0,0 +1,90 @@
+import { inspectAdapterCompatibility } from '../../core/adapter-compatibility.js';
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+export function getAdaptersHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf adapters status [options]',
+        summary: t(lang, 'adapters.help.summary'),
+        options: [
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: ['mf adapters status', 'mf adapters status --json'],
+        exitCodes: [
+            { label: '0', description: t(lang, 'adapters.help.exit.ok') },
+            { label: '1', description: t(lang, 'adapters.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseAdaptersArgs(args, lang) {
+    const [action, ...rest] = args;
+    const json = rest.includes('--json');
+    const supported = new Set(['--json']);
+    const unsupported = rest.find((arg) => arg.startsWith('-') && !supported.has(arg));
+    if (!action) {
+        return {
+            action: 'status',
+            json,
+            error: t(lang, 'adapters.error.missingAction'),
+        };
+    }
+    if (action !== 'status') {
+        return {
+            action: 'status',
+            json,
+            error: t(lang, 'adapters.error.unknownAction', { action }),
+        };
+    }
+    if (unsupported) {
+        return { action, json, error: t(lang, 'cli.error.unknownOption', { option: unsupported }) };
+    }
+    if (rest.some((arg) => !arg.startsWith('-'))) {
+        const unexpected = rest.find((arg) => !arg.startsWith('-'));
+        return { action, json, error: t(lang, 'cli.error.unexpectedArgument', { argument: unexpected }) };
+    }
+    return { action, json };
+}
+function renderAdapterReport(report, lang) {
+    const lines = [
+        t(lang, 'adapters.title'),
+        `${t(lang, 'label.mustflowRoot')}: ${report.mustflow_root}`,
+        `${t(lang, 'adapters.label.agents')}: ${report.agents_file.present ? t(lang, 'value.yes') : t(lang, 'value.no')}`,
+        `${t(lang, 'adapters.label.hostInstructionFiles')}: ${report.summary.host_instruction_files}`,
+        `${t(lang, 'adapters.label.adapterSurfaces')}: ${report.summary.adapter_surfaces_present}`,
+        `${t(lang, 'adapters.label.compatibilityNotes')}: ${report.summary.compatibility_notes}`,
+        `${t(lang, 'adapters.label.requiredChanges')}: ${report.summary.required_changes}`,
+        `${t(lang, 'adapters.label.commandAuthority')}: ${report.boundaries.command_authority}`,
+    ];
+    if (report.required_changes.length > 0) {
+        lines.push('', t(lang, 'adapters.label.requiredChanges'));
+        for (const finding of report.required_changes) {
+            lines.push(`- [${finding.severity}] ${finding.path ?? '-'}: ${finding.message}`);
+        }
+    }
+    if (report.compatibility_notes.length > 0) {
+        lines.push('', t(lang, 'adapters.label.compatibilityNotes'));
+        for (const finding of report.compatibility_notes) {
+            lines.push(`- [${finding.severity}] ${finding.path ?? '-'}: ${finding.message}`);
+        }
+    }
+    return lines.join('\n');
+}
+export function runAdapters(args, reporter, lang = 'en') {
+    if (args.includes('--help') || args.includes('-h')) {
+        reporter.stdout(getAdaptersHelp(lang));
+        return 0;
+    }
+    const options = parseAdaptersArgs(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf adapters --help', getAdaptersHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectAdapterCompatibility(resolveMustflowRoot());
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return 0;
+    }
+    reporter.stdout(renderAdapterReport(report, lang));
+    return 0;
+}

package/dist/cli/commands/classify.js

@@ -40,9 +40,8 @@ function parseClassifyArgs(args) {
     }
     return { json, changed, paths };
 }
-function getClassifyOutput(projectRoot, parsed) {
-    const source = parsed.changed ? 'changed' : 'paths';
-    const files = parsed.changed ? readGitChangedFiles(projectRoot) : parsed.paths;
+export function createClassifyOutput(projectRoot, source, paths) {
+    const files = source === 'changed' ? readGitChangedFiles(projectRoot) : paths;
     return {
         schema_version: CLASSIFY_SCHEMA_VERSION,
         command: 'classify',
@@ -94,7 +93,7 @@ export function runClassify(args, reporter, lang = 'en') {
         printUsageError(reporter, t(lang, 'classify.error.missingInput'), 'mf classify --help', getClassifyHelp(lang), lang);
         return 1;
     }
-    const output = getClassifyOutput(resolveMustflowRoot(), parsed);
+    const output = createClassifyOutput(resolveMustflowRoot(), parsed.changed ? 'changed' : 'paths', parsed.paths);
     if (parsed.json) {
         reporter.stdout(JSON.stringify(output, null, 2));
         return 0;

package/dist/cli/commands/contract-lint.js

@@ -1,5 +1,9 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
 import { lintCommandContract } from '../../core/contract-lint.js';
-import { readCommandContract } from '../../core/config-loading.js';
+import { readCommandContract, isRecord } from '../../core/config-loading.js';
+import { readTomlFile } from '../../core/toml.js';
+import { releaseVersioningIsEnabled } from '../../core/version-sources.js';
 import { printUsageError, renderHelp } from '../lib/cli-output.js';
 import { t } from '../lib/i18n.js';
 import { resolveMustflowRoot } from '../lib/project-root.js';
@@ -9,22 +13,35 @@ export function getContractLintHelp(lang = 'en') {
         usage: 'mf contract-lint [options]',
         summary: t(lang, 'contractLint.help.summary'),
         options: [
+            { label: '--coverage', description: t(lang, 'contractLint.help.option.coverage') },
             { label: '--json', description: t(lang, 'cli.option.json') },
             { label: '-h, --help', description: t(lang, 'cli.option.help') },
         ],
-        examples: ['mf contract-lint', 'mf contract-lint --json'],
+        examples: ['mf contract-lint', 'mf contract-lint --coverage', 'mf contract-lint --coverage --json'],
         exitCodes: [
             { label: '0', description: t(lang, 'contractLint.help.exit.ok') },
             { label: '1', description: t(lang, 'contractLint.help.exit.fail') },
         ],
     }, lang);
 }
-function createContractLintOutput(projectRoot) {
+function readPreferences(projectRoot) {
+    const preferencesPath = path.join(projectRoot, '.mustflow', 'config', 'preferences.toml');
+    if (!existsSync(preferencesPath)) {
+        return undefined;
+    }
+    const preferences = readTomlFile(preferencesPath);
+    return isRecord(preferences) ? preferences : undefined;
+}
+function createContractLintOutput(projectRoot, coverage) {
     return {
         schema_version: CONTRACT_LINT_SCHEMA_VERSION,
         command: 'contract-lint',
         mustflow_root: projectRoot,
-        report: lintCommandContract(readCommandContract(projectRoot)),
+        report: lintCommandContract(readCommandContract(projectRoot), {
+            coverage,
+            projectRoot,
+            releaseVersioningEnabled: releaseVersioningIsEnabled(readPreferences(projectRoot)),
+        }),
     };
 }
 function renderContractLintOutput(output, lang) {
@@ -43,6 +60,9 @@ function renderContractLintOutput(output, lang) {
         t(lang, 'contractLint.label.sourceFiles'),
         ...output.report.sourceFiles.map((sourceFile) => `- ${sourceFile}`),
     ];
+    if (output.report.coverage) {
+        lines.push('', t(lang, 'contractLint.label.coverage'), `${t(lang, 'contractLint.label.classificationReasons')}: ${output.report.coverage.knownClassificationReasons.length}`, `${t(lang, 'contractLint.label.requiredAfterReasons')}: ${output.report.coverage.requiredAfterReasons.length}`, `${t(lang, 'contractLint.label.runnableReasons')}: ${output.report.coverage.runnableReasons.length}`, `${t(lang, 'contractLint.label.coverageFindings')}: ${output.report.coverage.findings.length}`);
+    }
     if (output.report.issues.length > 0) {
         lines.push('', t(lang, 'contractLint.label.issues'));
         for (const issue of output.report.issues) {
@@ -57,13 +77,13 @@ export function runContractLint(args, reporter, lang = 'en') {
         reporter.stdout(getContractLintHelp(lang));
         return 0;
     }
-    const supported = new Set(['--json']);
+    const supported = new Set(['--coverage', '--json']);
     const unsupported = args.filter((arg) => !supported.has(arg));
     if (unsupported.length > 0) {
         printUsageError(reporter, t(lang, 'cli.error.unknownOption', { option: unsupported[0] }), 'mf contract-lint --help', getContractLintHelp(lang), lang);
         return 1;
     }
-    const output = createContractLintOutput(resolveMustflowRoot());
+    const output = createContractLintOutput(resolveMustflowRoot(), args.includes('--coverage'));
     if (args.includes('--json')) {
         reporter.stdout(JSON.stringify(output, null, 2));
     }

package/dist/cli/commands/dashboard.js

@@ -5,7 +5,9 @@ import path from 'node:path';
 import { openPathInFileManager, openUrlInBrowser } from '../lib/browser-open.js';
 import { printUsageError, renderHelp } from '../lib/cli-output.js';
 import { renderDashboardHtml, } from '../lib/dashboard-html.js';
+import { DashboardExportPathError, writeDashboardExport, } from '../lib/dashboard-export.js';
 import { DASHBOARD_VERIFICATION_MAX_FILE_MATCHES, createDashboardVerificationSnapshot, } from '../../core/dashboard-verification.js';
+import { redactSecretLikeText } from '../../core/secret-redaction.js';
 import { parseSkillIndexRoutes } from '../../core/skill-route-alignment.js';
 import { getAgentContext } from '../lib/agent-context.js';
 import { readGitChangedFiles } from '../lib/git-changes.js';
@@ -79,9 +81,18 @@ export function getDashboardHelp(lang = 'en') {
             { label: '--open', description: t(lang, 'dashboard.help.option.open') },
             { label: '--no-open', description: t(lang, 'dashboard.help.option.noOpen') },
             { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '--export <path>', description: t(lang, 'dashboard.help.option.export') },
+            { label: '--export-json <path>', description: t(lang, 'dashboard.help.option.exportJson') },
             { label: '-h, --help', description: t(lang, 'cli.option.help') },
         ],
-        examples: ['mf dashboard', 'mf dashboard --open', 'mf dashboard --port 4173', 'mf dashboard --json'],
+        examples: [
+            'mf dashboard',
+            'mf dashboard --open',
+            'mf dashboard --port 4173',
+            'mf dashboard --json',
+            'mf dashboard --export .mustflow/state/artifacts/dashboard.html',
+            'mf dashboard --export-json .mustflow/state/artifacts/dashboard.json',
+        ],
         exitCodes: [
             {
                 label: '0',
@@ -99,6 +110,9 @@ function parseDashboardOptions(args, lang) {
     let port = DEFAULT_DASHBOARD_PORT;
     let json = false;
     let openBrowser = false;
+    let exportPath;
+    let exportFormat;
+    let serverOptionUsed = false;
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
         if (!arg) {
@@ -107,14 +121,17 @@ function parseDashboardOptions(args, lang) {
         if (arg === '--json') {
             json = true;
             openBrowser = false;
+            serverOptionUsed = true;
             continue;
         }
         if (arg === '--open') {
             openBrowser = true;
+            serverOptionUsed = true;
             continue;
         }
         if (arg === '--no-open') {
             openBrowser = false;
+            serverOptionUsed = true;
             continue;
         }
         if (arg === '--host') {
@@ -123,11 +140,13 @@ function parseDashboardOptions(args, lang) {
                 return { error: t(lang, 'cli.error.missingValue', { option: '--host' }) };
             }
             host = value;
+            serverOptionUsed = true;
             index += 1;
             continue;
         }
         if (arg.startsWith('--host=')) {
             host = arg.slice('--host='.length);
+            serverOptionUsed = true;
             continue;
         }
         if (arg === '--port') {
@@ -140,6 +159,7 @@ function parseDashboardOptions(args, lang) {
                 return { error: t(lang, 'dashboard.error.invalidPort', { port: value }) };
             }
             port = parsedPort;
+            serverOptionUsed = true;
             index += 1;
             continue;
         }
@@ -150,6 +170,42 @@ function parseDashboardOptions(args, lang) {
                 return { error: t(lang, 'dashboard.error.invalidPort', { port: value }) };
             }
             port = parsedPort;
+            serverOptionUsed = true;
+            continue;
+        }
+        if (arg === '--export' || arg === '--export-json') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('-')) {
+                return { error: t(lang, 'cli.error.missingValue', { option: arg }) };
+            }
+            if (exportPath) {
+                return { error: t(lang, 'dashboard.error.conflictingExportModes') };
+            }
+            exportPath = value;
+            exportFormat = arg === '--export-json' ? 'json' : 'html';
+            index += 1;
+            continue;
+        }
+        if (arg.startsWith('--export=')) {
+            if (exportPath) {
+                return { error: t(lang, 'dashboard.error.conflictingExportModes') };
+            }
+            exportPath = arg.slice('--export='.length);
+            exportFormat = 'html';
+            if (!exportPath) {
+                return { error: t(lang, 'cli.error.missingValue', { option: '--export' }) };
+            }
+            continue;
+        }
+        if (arg.startsWith('--export-json=')) {
+            if (exportPath) {
+                return { error: t(lang, 'dashboard.error.conflictingExportModes') };
+            }
+            exportPath = arg.slice('--export-json='.length);
+            exportFormat = 'json';
+            if (!exportPath) {
+                return { error: t(lang, 'cli.error.missingValue', { option: '--export-json' }) };
+            }
             continue;
         }
         if (arg.startsWith('-')) {
@@ -157,6 +213,12 @@ function parseDashboardOptions(args, lang) {
         }
         return { error: t(lang, 'cli.error.unexpectedArgument', { argument: arg }) };
     }
+    if (exportPath && serverOptionUsed) {
+        return { error: t(lang, 'dashboard.error.exportServerOptions') };
+    }
+    if (exportPath) {
+        return { options: { host, port, json: false, openBrowser: false, exportPath, exportFormat: exportFormat ?? 'html' } };
+    }
     if (!LOCAL_DASHBOARD_HOSTS.has(host)) {
         return { error: t(lang, 'dashboard.error.nonLocalHost', { host }) };
     }
@@ -282,6 +344,9 @@ function readDashboardCommandContract(projectRoot) {
 function toDashboardCommandEffectGraphStatus(graph) {
     return {
         source: graph.source,
+        authority: graph.authority,
+        command_authority: graph.commandAuthority,
+        grants_command_authority: graph.grantsCommandAuthority,
         status: graph.status,
         database_path: graph.databasePath,
         index_fresh: graph.indexFresh,
@@ -466,12 +531,22 @@ function renderUpdateResponse(projectRoot) {
 }
 function readRunOutput(value) {
     if (!isRecord(value)) {
-        return { bytes: 0, truncated: false, tail: '' };
+        return { bytes: 0, truncated: false, tail: '', redacted: false, redaction_count: 0, redaction_kinds: [] };
     }
+    const rawTail = typeof value.tail === 'string' ? value.tail : '';
+    const tailRedaction = redactSecretLikeText(rawTail);
+    const storedKinds = Array.isArray(value.redaction_kinds)
+        ? value.redaction_kinds.filter((entry) => typeof entry === 'string')
+        : [];
+    const redactionKinds = [...new Set([...storedKinds, ...tailRedaction.redactionKinds])].sort();
+    const storedRedactionCount = typeof value.redaction_count === 'number' ? value.redaction_count : 0;
     return {
         bytes: typeof value.bytes === 'number' ? value.bytes : 0,
         truncated: value.truncated === true,
-        tail: typeof value.tail === 'string' ? value.tail : '',
+        tail: tailRedaction.text,
+        redacted: value.redacted === true || tailRedaction.redacted,
+        redaction_count: storedRedactionCount + tailRedaction.redactionCount,
+        redaction_kinds: redactionKinds,
     };
 }
 function readNumberArray(value) {
@@ -493,6 +568,7 @@ function renderRunHistoryResponse(projectRoot) {
         const mode = typeof receipt.mode === 'string' ? receipt.mode : '';
         const argv = Array.isArray(receipt.argv) ? receipt.argv.filter((entry) => typeof entry === 'string') : [];
         const cmd = typeof receipt.cmd === 'string' && receipt.cmd.length > 0 ? [receipt.cmd] : [];
+        const commandLine = (mode === 'shell' ? cmd : argv).map((entry) => redactSecretLikeText(entry).text);
         return {
             path: LATEST_RUN_RELATIVE_PATH,
             exists: true,
@@ -507,7 +583,7 @@ function renderRunHistoryResponse(projectRoot) {
             lifecycle: typeof receipt.lifecycle === 'string' ? receipt.lifecycle : '',
             run_policy: typeof receipt.run_policy === 'string' ? receipt.run_policy : '',
             mode,
-            command_line: mode === 'shell' ? cmd : argv,
+            command_line: commandLine,
             timeout_seconds: typeof receipt.timeout_seconds === 'number' ? receipt.timeout_seconds : 0,
             max_output_bytes: typeof receipt.max_output_bytes === 'number' ? receipt.max_output_bytes : 0,
             success_exit_codes: readNumberArray(receipt.success_exit_codes),
@@ -580,6 +656,29 @@ export async function runDashboard(args, reporter, lang = 'en') {
     }
     const options = parsed.options;
     const projectRoot = resolveMustflowRoot();
+    if (options.exportPath) {
+        try {
+            const result = writeDashboardExport({
+                projectRoot,
+                outputPath: options.exportPath,
+                format: options.exportFormat ?? 'html',
+                preferences: readDashboardPreferences(projectRoot),
+                status: await renderStatusResponse(projectRoot),
+                docsReview: renderDocReviewResponse(projectRoot, new URL('/api/docs/review', 'http://localhost')),
+            });
+            reporter.stdout(t(lang, 'dashboard.export.wrote', { path: result.relativePath, bytes: result.bytes }));
+            return 0;
+        }
+        catch (error) {
+            const message = error instanceof DashboardExportPathError
+                ? t(lang, 'dashboard.error.exportPathOutsideRoot', { path: error.targetPath })
+                : error instanceof Error
+                    ? error.message
+                    : String(error);
+            printUsageError(reporter, message, 'mf dashboard --help', getDashboardHelp(lang), lang);
+            return 1;
+        }
+    }
     const token = randomBytes(18).toString('base64url');
     const initialSnapshot = readDashboardPreferences(projectRoot);
     const server = http.createServer(async (request, response) => {