mustflow 2.103.16 → 2.103.21

package/dist/cli/commands/run.js

@@ -1,261 +1,11 @@
-import { createHash } from 'node:crypto';
-import { performance } from 'node:perf_hooks';
-import { ACTIVE_RUN_LOCK_ID_ENV, acquireActiveRunLock } from '../../core/active-run-locks.js';
-import { createCommandEnv } from '../../core/command-env.js';
-import { createCorrelationId } from '../../core/correlation-id.js';
-import { printUsageError, renderCliError, renderHelp } from '../lib/cli-output.js';
-import { readCommandContract, readMustflowConfigIfExists } from '../../core/config-loading.js';
-import { resolveRunReceiptRetentionPolicy } from '../../core/retention-policy.js';
+import { printUsageError } from '../lib/cli-output.js';
 import { t } from '../lib/i18n.js';
-import { formatCliOptionParseError, getParsedCliStringOption, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
-import { resolveMustflowRoot } from '../lib/project-root.js';
-import { ALLOW_UNTRUSTED_ROOT_OPTION, assessRunRootTrust } from '../lib/run-root-trust.js';
-import { createRunPlan, createRunPreview, renderRunPreviewText, } from '../lib/run-plan.js';
-import { writeRunReceipt, } from '../../core/run-receipt.js';
-import { recordRunPerformanceHistory } from '../../core/run-performance-history.js';
-import { RunProfiler } from '../../core/run-profile.js';
-import { finishRunWriteTracking, startRunWriteTracking } from '../../core/run-write-drift.js';
-import { getRunStatus, runArgvCommandStreaming, runShellCommandStreaming } from './run/executor.js';
-import { emitOutput, isOutputLimitExceededError } from './run/output.js';
-import { createPendingTimeoutTermination, getKillMethod, terminateProcessTree } from './run/process-tree.js';
-import { assembleRunReceipt } from './run/receipt.js';
-const DEFAULT_ACTIVE_LOCK_WAIT_TIMEOUT_SECONDS = 300;
-const ACTIVE_LOCK_WAIT_POLL_MS = 1_000;
-const RUN_OPTIONS = [
-    { name: '--json', kind: 'boolean' },
-    { name: '--dry-run', kind: 'boolean' },
-    { name: '--plan-only', kind: 'boolean' },
-    { name: '--wait', kind: 'boolean' },
-    { name: ALLOW_UNTRUSTED_ROOT_OPTION, kind: 'boolean' },
-    { name: '--wait-timeout', kind: 'string' },
-];
-function delay(milliseconds) {
-    return new Promise((resolve) => {
-        setTimeout(resolve, milliseconds);
-    });
-}
-function getRunPlanDetail(plan, lang, fallbackKey) {
-    return plan.detail ?? t(lang, fallbackKey);
-}
-function reportRunPlanFailure(plan, reporter, lang) {
-    let message;
-    switch (plan.reasonCode) {
-        case 'status_not_configured':
-            message = t(lang, 'run.error.statusNotConfigured', { intent: plan.intentName, status: plan.intentStatus ?? 'unknown' });
-            break;
-        case 'lifecycle_not_oneshot':
-            message = t(lang, 'run.error.lifecycleNotOneshot', { intent: plan.intentName, lifecycle: plan.lifecycle ?? 'unknown' });
-            break;
-        case 'run_policy_not_agent_allowed':
-            message = t(lang, 'run.error.runPolicy', { intent: plan.intentName });
-            break;
-        case 'stdin_not_closed':
-            message = t(lang, 'run.error.stdin', { intent: plan.intentName });
-            break;
-        case 'agent_shell_requires_allow':
-            message = t(lang, 'run.error.agentShellRequiresAllow', { intent: plan.intentName });
-            break;
-        case 'missing_timeout':
-            message = t(lang, 'run.error.timeout', { intent: plan.intentName });
-            break;
-        case 'missing_command_source':
-            message = t(lang, 'run.error.commandSource', { intent: plan.intentName });
-            break;
-        case 'unsafe_intent_name':
-            message = t(lang, 'run.error.unsafeIntent', {
-                intent: plan.intentName,
-                detail: getRunPlanDetail(plan, lang, 'run.error.unsafeIntentDetail'),
-            });
-            break;
-        case 'blocked_shell_background_pattern':
-            message = t(lang, 'run.error.blockedShellBackground', {
-                intent: plan.intentName,
-                detail: getRunPlanDetail(plan, lang, 'run.error.blockedShellBackgroundDetail'),
-            });
-            break;
-        case 'blocked_long_running_command_pattern':
-            message = t(lang, 'run.error.blockedLongRunningCommand', {
-                intent: plan.intentName,
-                detail: getRunPlanDetail(plan, lang, 'run.error.blockedLongRunningCommandDetail'),
-            });
-            break;
-        case 'network_requires_approval':
-        case 'destructive_requires_approval':
-        case 'approval_policy_unreadable':
-            message = t(lang, 'run.error.approvalRequired', {
-                intent: plan.intentName,
-                detail: getRunPlanDetail(plan, lang, 'run.error.approvalRequiredDetail'),
-            });
-            break;
-        case 'cwd_outside_project':
-            message = t(lang, 'run.error.cwdOutsideProject', {
-                intent: plan.intentName,
-                detail: getRunPlanDetail(plan, lang, 'run.error.cwdOutsideProjectDetail'),
-            });
-            break;
-        case 'invalid_test_target':
-            message = t(lang, 'run.error.invalidTestTarget', {
-                intent: plan.intentName,
-                detail: getRunPlanDetail(plan, lang, 'run.error.invalidTestTargetDetail'),
-            });
-            break;
-        case 'max_output_bytes_exceeds_limit':
-            message = t(lang, 'run.error.maxOutputBytes', {
-                intent: plan.intentName,
-                detail: getRunPlanDetail(plan, lang, 'run.error.maxOutputBytesDetail'),
-            });
-            break;
-        case 'intent_not_table':
-        default:
-            message = t(lang, 'run.error.unknownIntent', { intent: plan.intentName });
-            break;
-    }
-    if (plan.suggestedIntentSnippet) {
-        message = `${message}\n\n${t(lang, 'run.label.suggestedIntentSnippet')}:\n${plan.suggestedIntentSnippet}`;
-    }
-    reporter.stderr(renderCliError(message, 'mf help commands', lang));
-}
-function writeLatestProfile(profiler, options, input) {
-    if (options.writeLatestProfile === false) {
-        return;
-    }
-    profiler.writeLatest(input);
-}
-function createPlanCommandHash(plan) {
-    const payload = {
-        mode: plan.mode,
-        cwd: plan.relativeCwd,
-        argv: plan.commandArgv ?? null,
-        cmd: plan.shellCommand ?? null,
-    };
-    return `sha256:${createHash('sha256').update(JSON.stringify(payload)).digest('hex')}`;
-}
-function renderActiveLockConflictMessage(intentName, conflicts, lang) {
-    const [first] = conflicts;
-    const detail = first
-        ? t(lang, 'run.error.activeLockConflictDetail', {
-            lock: first.lock,
-            intent: first.conflictsWithIntent,
-            pid: first.conflictsWithPid,
-        })
-        : t(lang, 'run.error.activeLockConflictUnknown');
-    return t(lang, 'run.error.activeLockConflict', { intent: intentName, detail });
-}
-function parseRunArguments(args) {
-    const parsed = parseCliOptions(args, RUN_OPTIONS, { allowPositionals: true });
-    let waitTimeoutSeconds = DEFAULT_ACTIVE_LOCK_WAIT_TIMEOUT_SECONDS;
-    if (parsed.error) {
-        const [intentName, ...extra] = parsed.positionals;
-        return {
-            json: hasParsedCliOption(parsed, '--json'),
-            dryRun: hasParsedCliOption(parsed, '--dry-run'),
-            planOnly: hasParsedCliOption(parsed, '--plan-only'),
-            allowUntrustedRoot: hasParsedCliOption(parsed, ALLOW_UNTRUSTED_ROOT_OPTION),
-            wait: hasParsedCliOption(parsed, '--wait'),
-            waitTimeoutSeconds,
-            intentName: intentName ?? null,
-            extra,
-            error: parsed.error,
-        };
-    }
-    const waitTimeoutValue = getParsedCliStringOption(parsed, '--wait-timeout');
-    let error = null;
-    if (waitTimeoutValue !== null) {
-        const parsedWaitTimeout = Number(waitTimeoutValue);
-        if (!Number.isInteger(parsedWaitTimeout) || parsedWaitTimeout <= 0) {
-            error = 'invalid_wait_timeout';
-        }
-        else {
-            waitTimeoutSeconds = parsedWaitTimeout;
-        }
-    }
-    const [intentName, ...extra] = parsed.positionals;
-    return {
-        json: hasParsedCliOption(parsed, '--json'),
-        dryRun: hasParsedCliOption(parsed, '--dry-run'),
-        planOnly: hasParsedCliOption(parsed, '--plan-only'),
-        allowUntrustedRoot: hasParsedCliOption(parsed, ALLOW_UNTRUSTED_ROOT_OPTION),
-        wait: hasParsedCliOption(parsed, '--wait'),
-        waitTimeoutSeconds,
-        intentName: intentName ?? null,
-        extra,
-        error,
-    };
-}
-async function acquireActiveRunLockWithOptionalWait(input) {
-    const startedAt = Date.now();
-    let reportedWait = false;
-    while (true) {
-        const result = acquireActiveRunLock(input.projectRoot, input.contract, input.intentName, { commandHash: input.commandHash });
-        if (result.ok || !input.enabled || result.conflicts.length === 0) {
-            return result;
-        }
-        if (!input.json && !reportedWait) {
-            const [first] = result.conflicts;
-            input.reporter.stderr(t(input.lang, 'run.progress.waitingForActiveLock', {
-                intent: input.intentName,
-                activeIntent: first?.conflictsWithIntent ?? 'unknown',
-                seconds: input.waitTimeoutSeconds,
-            }));
-            reportedWait = true;
-        }
-        if (Date.now() - startedAt >= input.waitTimeoutSeconds * 1000) {
-            return result;
-        }
-        await delay(Math.min(ACTIVE_LOCK_WAIT_POLL_MS, Math.max(1, input.waitTimeoutSeconds * 1000 - (Date.now() - startedAt))));
-    }
-}
-function createRunProgressReporter(input) {
-    if (!input.enabled) {
-        return () => undefined;
-    }
-    input.reporter.stderr(t(input.lang, 'run.progress.started', { intent: input.intentName, seconds: input.timeoutSeconds }));
-    const timers = [];
-    for (const ratio of [0.5, 0.8]) {
-        const delayMs = Math.max(1, Math.floor(input.timeoutSeconds * 1000 * ratio));
-        const elapsedSeconds = Math.max(1, Math.round(input.timeoutSeconds * ratio));
-        const timer = setTimeout(() => {
-            input.reporter.stderr(t(input.lang, 'run.progress.timeoutWarning', {
-                intent: input.intentName,
-                seconds: elapsedSeconds,
-                percent: Math.round(ratio * 100),
-            }));
-        }, delayMs);
-        timer.unref?.();
-        timers.push(timer);
-    }
-    return () => {
-        for (const timer of timers) {
-            clearTimeout(timer);
-        }
-    };
-}
-export function getRunHelp(lang = 'en') {
-    return renderHelp({
-        usage: 'mf run <intent> [options]',
-        summary: t(lang, 'run.help.summary'),
-        options: [
-            { label: '--dry-run', description: t(lang, 'run.help.option.dryRun') },
-            { label: '--plan-only', description: t(lang, 'run.help.option.planOnly') },
-            { label: '--json', description: t(lang, 'run.help.option.json') },
-            { label: '--wait', description: t(lang, 'run.help.option.wait') },
-            { label: '--wait-timeout <seconds>', description: t(lang, 'run.help.option.waitTimeout') },
-            { label: ALLOW_UNTRUSTED_ROOT_OPTION, description: t(lang, 'run.help.option.allowUntrustedRoot') },
-            { label: '-h, --help', description: t(lang, 'cli.option.help') },
-        ],
-        examples: ['mf run test', 'mf run lint --json', 'mf run mustflow_check --dry-run --json'],
-        exitCodes: [
-            {
-                label: '0',
-                description: t(lang, 'run.help.exit.ok'),
-            },
-            {
-                label: '1',
-                description: t(lang, 'run.help.exit.fail'),
-            },
-        ],
-    }, lang);
-}
+import { formatCliOptionParseError } from '../lib/option-parser.js';
+import { getRunHelp, hasRunHelpOption, parseRunArguments } from './run/args.js';
+import { executeRunCommand } from './run/execution.js';
+import { executeRunPreviewCommand, getRunPreviewMode } from './run/preview.js';
+export { getRunHelp } from './run/args.js';
+export { executeRunCommand } from './run/execution.js';
 /**
  * mf:anchor cli.run.intent-contract
  * purpose: Enforce command intent eligibility before executing a configured oneshot command.
@@ -264,9 +14,7 @@ export function getRunHelp(lang = 'en') {
  * risk: config, security, state
  */
 export async function runRun(args, reporter, lang = 'en', options = {}) {
-    const executorStartedAtMs = performance.now();
-    const profiler = new RunProfiler();
-    if (hasCliOptionToken(args, '--help', ['-h'])) {
+    if (hasRunHelpOption(args)) {
         reporter.stdout(getRunHelp(lang));
         return 0;
     }
@@ -287,7 +35,7 @@ export async function runRun(args, reporter, lang = 'en', options = {}) {
     const dryRun = parsedArgs.dryRun;
     const planOnly = parsedArgs.planOnly;
     const allowUntrustedRoot = parsedArgs.allowUntrustedRoot;
-    const previewMode = dryRun ? 'dry-run' : planOnly ? 'plan-only' : null;
+    const previewMode = getRunPreviewMode({ dryRun, planOnly });
     if (dryRun && planOnly) {
         printUsageError(reporter, t(lang, 'run.error.conflictingPreviewModes'), 'mf run --help', getRunHelp(lang), lang);
         return 1;
@@ -306,169 +54,15 @@ export async function runRun(args, reporter, lang = 'en', options = {}) {
         printUsageError(reporter, t(lang, 'cli.error.unexpectedArgument', { argument: extra[0] }), 'mf run --help', getRunHelp(lang), lang);
         return 1;
     }
-    const projectRoot = profiler.measure('root_detection', () => resolveMustflowRoot());
-    const rootTrust = profiler.measure('root_trust', () => assessRunRootTrust(projectRoot));
-    if (!previewMode && !allowUntrustedRoot && !rootTrust.trusted) {
-        const message = rootTrust.reason === 'manifest_lock_invalid'
-            ? t(lang, 'run.error.untrustedRootInvalid', { detail: rootTrust.detail ?? rootTrust.manifestLockPath })
-            : t(lang, 'run.error.untrustedRootMissing', { path: rootTrust.detail ?? rootTrust.manifestLockPath });
-        reporter.stderr(renderCliError(message, 'mf run --help', lang));
-        return 1;
-    }
-    const contract = profiler.measure('command_contract', () => readCommandContract(projectRoot));
-    const plan = profiler.measure('plan_creation', () => createRunPlan(projectRoot, contract, intentName, { testTargets: options.testTargets }));
-    if (previewMode) {
-        profiler.measure('preview_render', () => {
-            if (json) {
-                reporter.stdout(JSON.stringify(createRunPreview(plan, previewMode), null, 2));
-            }
-            else {
-                reporter.stdout(renderRunPreviewText(plan, previewMode, lang));
-            }
-        });
-        writeLatestProfile(profiler, options, {
-            projectRoot,
-            intent: intentName,
-            status: plan.ok ? 'previewed' : 'blocked',
-            previewMode,
-        });
-        return plan.ok ? 0 : 1;
-    }
-    if (!plan.ok) {
-        if (json) {
-            reporter.stdout(JSON.stringify(createRunPreview(plan, 'plan-only'), null, 2));
-        }
-        reportRunPlanFailure(plan, reporter, lang);
-        writeLatestProfile(profiler, options, {
-            projectRoot,
-            intent: intentName,
-            status: 'blocked',
-            previewMode: null,
-        });
-        return 1;
-    }
-    const activeRunLock = await profiler.measureAsync('active_lock_acquire', () => acquireActiveRunLockWithOptionalWait({
-        enabled: parsedArgs.wait,
-        waitTimeoutSeconds: parsedArgs.waitTimeoutSeconds,
-        projectRoot,
-        contract,
-        intentName,
-        commandHash: createPlanCommandHash(plan),
-        json,
-        reporter,
-        lang,
-    }));
-    if (!activeRunLock.ok) {
-        reporter.stderr(renderCliError(renderActiveLockConflictMessage(intentName, activeRunLock.conflicts, lang), 'mf run --dry-run --json', lang));
-        writeLatestProfile(profiler, options, {
-            projectRoot,
-            intent: intentName,
-            status: 'blocked',
-            previewMode: null,
-        });
-        return 1;
-    }
-    try {
-        const runReceiptPolicy = profiler.measure('retention_policy', () => resolveRunReceiptRetentionPolicy(readMustflowConfigIfExists(projectRoot)));
-        const env = profiler.measure('environment', () => createCommandEnv(projectRoot, { policy: plan.envPolicy, allowlist: plan.envAllowlist }));
-        env[ACTIVE_RUN_LOCK_ID_ENV] = activeRunLock.handle.record.run_id;
-        const writeTracker = profiler.measure('write_drift_before', () => startRunWriteTracking(projectRoot, contract, intentName, {
-            additionalDeclaredPaths: options.additionalDeclaredWritePaths,
-            env,
-        }));
-        const stdoutTailBytes = Math.min(runReceiptPolicy.stdoutTailBytes, plan.maxOutputBytes);
-        const stderrTailBytes = Math.min(runReceiptPolicy.stderrTailBytes, plan.maxOutputBytes);
-        let streamedOutput = false;
-        const childStartedAtMs = performance.now();
-        const startedAt = new Date();
-        const stopRunProgress = createRunProgressReporter({
-            enabled: !json && Boolean(reporter.writeStderr),
+    if (!previewMode) {
+        const result = await executeRunCommand({
             intentName,
-            timeoutSeconds: plan.timeoutSeconds,
-            reporter,
-            lang,
-        });
-        const result = await profiler.measureAsync('child_command', async () => {
-            try {
-                if (plan.commandArgv) {
-                    streamedOutput = !json;
-                    return runArgvCommandStreaming(plan.argvCommand, plan.cwd, env, plan.timeoutSeconds, plan.killAfterSeconds, plan.maxOutputBytes, stdoutTailBytes, stderrTailBytes, reporter, !json, true);
-                }
-                streamedOutput = !json;
-                return runShellCommandStreaming(plan.shellCommand, plan.cwd, env, plan.timeoutSeconds, plan.killAfterSeconds, plan.maxOutputBytes, stdoutTailBytes, stderrTailBytes, reporter, !json, true);
-            }
-            finally {
-                stopRunProgress();
-            }
-        });
-        const childDurationMs = performance.now() - childStartedAtMs;
-        const finishedAt = new Date();
-        const writeDrift = profiler.measure('write_drift_after', () => finishRunWriteTracking(writeTracker));
-        const exitCode = typeof result.status === 'number' ? result.status : null;
-        const runStatus = getRunStatus(result.error, exitCode, plan.successExitCodes);
-        let killMethod = null;
-        let termination = null;
-        if (runStatus === 'timed_out') {
-            termination = result.termination ?? createPendingTimeoutTermination(getKillMethod());
-            killMethod = termination.method;
-            if (!result.termination && result.pid) {
-                terminateProcessTree(result.pid);
-            }
-        }
-        const receipt = profiler.measure('receipt_create', () => assembleRunReceipt({
-            correlationId: options.correlationId ?? createCorrelationId('run'),
-            intentName,
-            runStatus,
-            startedAt,
-            finishedAt,
-            projectRoot,
-            plan,
-            result,
-            exitCode,
-            killMethod,
-            termination,
-            writeDrift,
-            executorOverheadMs: Math.max(0, Math.round((performance.now() - executorStartedAtMs - childDurationMs) * 1000) / 1000),
-            phaseTimings: profiler.getReceiptPhases(),
-            stdoutTailBytes: runReceiptPolicy.stdoutTailBytes,
-            stderrTailBytes: runReceiptPolicy.stderrTailBytes,
-        }));
-        if (options.writeLatestReceipt !== false) {
-            profiler.measure('receipt_write', () => writeRunReceipt(projectRoot, receipt));
-        }
-        if (options.recordPerformanceHistory !== false) {
-            profiler.measure('performance_history_write', () => recordRunPerformanceHistory(projectRoot, receipt));
-        }
-        writeLatestProfile(profiler, options, {
-            projectRoot,
-            intent: intentName,
-            status: runStatus,
-            previewMode: null,
-        });
-        if (json) {
-            reporter.stdout(JSON.stringify(receipt, null, 2));
-            return runStatus === 'passed' ? 0 : 1;
-        }
-        if (!streamedOutput) {
-            emitOutput(reporter, result.stdout, 'stdout');
-            emitOutput(reporter, result.stderr, 'stderr');
-        }
-        if (result.error) {
-            const errorWithCode = result.error;
-            if (errorWithCode.code === 'ETIMEDOUT') {
-                reporter.stderr(t(lang, 'run.error.timedOut', { intent: intentName, seconds: plan.timeoutSeconds }));
-                return 1;
-            }
-            if (isOutputLimitExceededError(result.error)) {
-                reporter.stderr(t(lang, 'run.error.outputLimitExceeded', { intent: intentName, message: result.error.message }));
-                return 1;
-            }
-            reporter.stderr(t(lang, 'run.error.startFailed', { intent: intentName, message: result.error.message }));
-            return 1;
-        }
-        return runStatus === 'passed' ? 0 : 1;
-    }
-    finally {
-        activeRunLock.handle.release();
-    }
+            outputMode: json ? 'json' : 'text',
+            allowUntrustedRoot,
+            wait: parsedArgs.wait,
+            waitTimeoutSeconds: parsedArgs.waitTimeoutSeconds,
+        }, reporter, lang, options);
+        return result.exitCode;
+    }
+    return executeRunPreviewCommand({ intentName, json, previewMode }, reporter, lang, options);
 }

package/dist/cli/commands/script-pack.js

@@ -64,6 +64,7 @@ export function getScriptPackHelp(lang = 'en') {
             'mf script-pack run code/outline scan src --json',
             'mf script-pack run code/dependency-graph scan src/cli/index.ts --json',
             'mf script-pack run code/import-cycle check src --json',
+            'mf script-pack run code/module-boundary check src --json',
             'mf script-pack run code/change-impact analyze --base HEAD --json',
             'mf script-pack run code/symbol-read read src/cli/index.ts --start-line 25 --json',
             'mf script-pack run code/route-outline scan src/cli/index.ts --json',

package/dist/cli/commands/verify.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { runRun } from './run.js';
+import { executeRunCommand } from './run/execution.js';
 import { createChangeVerificationReport, } from '../../core/change-verification.js';
 import { createCorrelationId } from '../../core/correlation-id.js';
 import { readUtf8FileInsideWithoutSymlinks, writeJsonFileInsideWithoutSymlinks } from '../../core/safe-filesystem.js';
@@ -51,6 +51,9 @@ function createBufferedOutput() {
         },
     };
 }
+function toVerificationReceipt(receipt) {
+    return receipt ? { ...receipt } : null;
+}
 export function getVerifyHelp(lang = 'en') {
     return renderHelp({
         usage: 'mf verify --reason <event> [options] | mf verify --from-classification <path> [options] | mf verify --changed [options]',
@@ -152,7 +155,13 @@ function testTargetsByScheduledIntent(report) {
 }
 async function runVerificationIntent(intent, lang, verificationPlanId, correlationId, testTargets = [], additionalDeclaredWritePaths = []) {
     const output = createBufferedOutput();
-    const exitCode = await runRun([intent, '--json'], output.reporter, lang, {
+    const runResult = await executeRunCommand({
+        intentName: intent,
+        outputMode: 'silent',
+        allowUntrustedRoot: false,
+        wait: false,
+        waitTimeoutSeconds: 1,
+    }, output.reporter, lang, {
         correlationId,
         writeLatestReceipt: false,
         writeLatestProfile: false,
@@ -160,23 +169,11 @@ async function runVerificationIntent(intent, lang, verificationPlanId, correlati
         testTargets,
         additionalDeclaredWritePaths,
     });
-    const rawStdout = output.stdout().trim();
-    let receipt = null;
+    const exitCode = runResult.exitCode;
+    const receipt = toVerificationReceipt(runResult.receipt);
     let status = exitCode === 0 ? 'passed' : 'failed';
-    try {
-        const parsed = JSON.parse(rawStdout);
-        receipt = parsed;
-        const receiptStatus = parsed.status;
-        if (receiptStatus === 'passed' ||
-            receiptStatus === 'failed' ||
-            receiptStatus === 'timed_out' ||
-            receiptStatus === 'start_failed' ||
-            receiptStatus === 'output_limit_exceeded') {
-            status = receiptStatus;
-        }
-    }
-    catch {
-        status = 'failed';
+    if (runResult.receipt) {
+        status = runResult.receipt.status;
     }
     return {
         intent,

package/dist/cli/i18n/en.js

@@ -777,6 +777,7 @@ Read these files before working:
     "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
     "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
     "scriptPack.script.codeImportCycle.summary": "Detect relative TypeScript and JavaScript import cycles with line evidence",
+    "scriptPack.script.codeModuleBoundary.summary": "Check configured module boundary import rules and shared budgets",
     "scriptPack.script.codeChangeImpact.summary": "Analyze changed files for impact, script-pack, and verification hints",
     "scriptPack.script.codeSymbolRead.summary": "Read a bounded source snippet by source anchor, symbol line, or explicit line range",
     "scriptPack.script.codeRouteOutline.summary": "Scan Hono, Elysia, Axum, and NestJS route methods, paths, handlers, and lifecycle chains",
@@ -978,6 +979,32 @@ Read these files before working:
     "importCycle.error.unknownAction": "Unknown import-cycle action: {action}",
     "importCycle.error.missingPath": "Provide at least one path to check",
     "importCycle.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "moduleBoundary.help.summary": "Check configured module boundary rules against TypeScript and JavaScript import graph evidence.",
+    "moduleBoundary.help.option.config": "Module boundary TOML config path. Default: .mustflow/config/module-boundaries.toml",
+    "moduleBoundary.help.option.maxDepth": "Maximum dependency depth from target files. Default: 20",
+    "moduleBoundary.help.option.maxFiles": "Maximum number of source files to scan. Default: 1000",
+    "moduleBoundary.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
+    "moduleBoundary.help.option.maxNodes": "Maximum number of graph nodes to inspect. Default: 300",
+    "moduleBoundary.help.option.maxEdges": "Maximum number of graph edges to inspect. Default: 800",
+    "moduleBoundary.help.option.maxCycles": "Maximum number of import cycles to report. Default: 50",
+    "moduleBoundary.help.option.maxSharedFiles": "Maximum number of shared-budget source files to count. Default: 1000",
+    "moduleBoundary.help.exit.ok": "No blocking module boundary findings were detected",
+    "moduleBoundary.help.exit.fail": "A module boundary rule, cycle, invalid input, unreadable path, or scan limit failed",
+    "moduleBoundary.title": "mustflow module boundary",
+    "moduleBoundary.label.config": "Config",
+    "moduleBoundary.label.targets": "Targets",
+    "moduleBoundary.label.edges": "Edges",
+    "moduleBoundary.label.rules": "Rules",
+    "moduleBoundary.label.findings": "Findings",
+    "moduleBoundary.label.truncated": "Truncated",
+    "moduleBoundary.label.findingList": "Module boundary findings",
+    "moduleBoundary.label.sharedMetrics": "Shared budget metrics",
+    "moduleBoundary.label.issues": "Issues",
+    "moduleBoundary.clean": "No module boundary findings were found.",
+    "moduleBoundary.error.missingAction": "Specify a module-boundary action: check",
+    "moduleBoundary.error.unknownAction": "Unknown module-boundary action: {action}",
+    "moduleBoundary.error.missingPath": "Provide at least one path to check",
+    "moduleBoundary.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "changeImpact.help.summary": "Analyze git changes and return bounded file-impact, script-pack, and verification hints.",
     "changeImpact.help.option.base": "Git base ref to compare from. Default: HEAD",
     "changeImpact.help.option.head": "Git head ref to compare to. Omit to compare the base with the working tree.",

package/dist/cli/i18n/es.js

@@ -777,6 +777,7 @@ Lee estos archivos antes de trabajar:
     "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
     "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
     "scriptPack.script.codeImportCycle.summary": "Detect relative TypeScript and JavaScript import cycles with line evidence",
+    "scriptPack.script.codeModuleBoundary.summary": "Check configured module boundary import rules and shared budgets",
     "scriptPack.script.codeChangeImpact.summary": "Analyze changed files for impact, script-pack, and verification hints",
     "scriptPack.script.codeSymbolRead.summary": "Read a bounded source snippet by source anchor, symbol line, or explicit line range",
     "scriptPack.script.codeRouteOutline.summary": "Scan Hono, Elysia, Axum, and NestJS route methods, paths, handlers, and lifecycle chains",
@@ -978,6 +979,32 @@ Lee estos archivos antes de trabajar:
     "importCycle.error.unknownAction": "Unknown import-cycle action: {action}",
     "importCycle.error.missingPath": "Provide at least one path to check",
     "importCycle.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "moduleBoundary.help.summary": "Check configured module boundary rules against TypeScript and JavaScript import graph evidence.",
+    "moduleBoundary.help.option.config": "Module boundary TOML config path. Default: .mustflow/config/module-boundaries.toml",
+    "moduleBoundary.help.option.maxDepth": "Maximum dependency depth from target files. Default: 20",
+    "moduleBoundary.help.option.maxFiles": "Maximum number of source files to scan. Default: 1000",
+    "moduleBoundary.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
+    "moduleBoundary.help.option.maxNodes": "Maximum number of graph nodes to inspect. Default: 300",
+    "moduleBoundary.help.option.maxEdges": "Maximum number of graph edges to inspect. Default: 800",
+    "moduleBoundary.help.option.maxCycles": "Maximum number of import cycles to report. Default: 50",
+    "moduleBoundary.help.option.maxSharedFiles": "Maximum number of shared-budget source files to count. Default: 1000",
+    "moduleBoundary.help.exit.ok": "No blocking module boundary findings were detected",
+    "moduleBoundary.help.exit.fail": "A module boundary rule, cycle, invalid input, unreadable path, or scan limit failed",
+    "moduleBoundary.title": "mustflow module boundary",
+    "moduleBoundary.label.config": "Config",
+    "moduleBoundary.label.targets": "Targets",
+    "moduleBoundary.label.edges": "Edges",
+    "moduleBoundary.label.rules": "Rules",
+    "moduleBoundary.label.findings": "Findings",
+    "moduleBoundary.label.truncated": "Truncated",
+    "moduleBoundary.label.findingList": "Module boundary findings",
+    "moduleBoundary.label.sharedMetrics": "Shared budget metrics",
+    "moduleBoundary.label.issues": "Issues",
+    "moduleBoundary.clean": "No module boundary findings were found.",
+    "moduleBoundary.error.missingAction": "Specify a module-boundary action: check",
+    "moduleBoundary.error.unknownAction": "Unknown module-boundary action: {action}",
+    "moduleBoundary.error.missingPath": "Provide at least one path to check",
+    "moduleBoundary.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "changeImpact.help.summary": "Analyze git changes and return bounded file-impact, script-pack, and verification hints.",
     "changeImpact.help.option.base": "Git base ref to compare from. Default: HEAD",
     "changeImpact.help.option.head": "Git head ref to compare to. Omit to compare the base with the working tree.",