mustflow 2.108.0 → 2.108.3

package/dist/cli/script-packs/repo-automation-surface.js

@@ -0,0 +1,88 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { inspectRepoAutomationSurface, REPO_AUTOMATION_SURFACE_SCRIPT_REF, } from '../../core/repo-automation-surface.js';
+const REPO_AUTOMATION_SURFACE_OPTIONS = [{ name: '--json', kind: 'boolean' }];
+export function getRepoAutomationSurfaceHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run repo/automation-surface inspect [options]',
+        summary: t(lang, 'automationSurface.help.summary'),
+        options: [
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run repo/automation-surface inspect',
+            'mf script-pack run repo/automation-surface inspect --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'automationSurface.help.exit.ok') },
+            { label: '1', description: t(lang, 'automationSurface.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseRepoAutomationSurfaceOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, REPO_AUTOMATION_SURFACE_OPTIONS, { allowPositionals: false });
+    const json = hasParsedCliOption(parsed, '--json');
+    if (action !== 'inspect') {
+        return {
+            action: 'inspect',
+            json,
+            error: action
+                ? t(lang, 'automationSurface.error.unknownAction', { action })
+                : t(lang, 'automationSurface.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return { action, json, error: formatCliOptionParseError(parsed.error, lang) };
+    }
+    return { action, json };
+}
+function renderRepoAutomationSurfaceSummary(report, lang) {
+    const lines = [
+        t(lang, 'automationSurface.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${REPO_AUTOMATION_SURFACE_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'automationSurface.label.surfaces')}: ${report.summary.surface_count}`,
+        `${t(lang, 'automationSurface.label.risky')}: ${report.summary.risky_surface_count}`,
+        `${t(lang, 'automationSurface.label.findings')}: ${report.findings.length}`,
+    ];
+    if (report.surfaces.length > 0) {
+        lines.push(t(lang, 'automationSurface.label.surfaceDetails'));
+        for (const surface of report.surfaces.slice(0, 30)) {
+            const location = surface.line === null ? surface.path : `${surface.path}:${surface.line}`;
+            const mapped = surface.mapped_intent === null ? 'unmapped' : `intent ${surface.mapped_intent}`;
+            lines.push(`- ${surface.name} (${surface.category}, ${surface.kind}, ${mapped}) at ${location}`);
+        }
+    }
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'automationSurface.label.findings'));
+        for (const finding of report.findings) {
+            lines.push(`- ${finding.path}: ${finding.code} (${finding.message})`);
+        }
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'automationSurface.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    return lines.join('\n');
+}
+export function runRepoAutomationSurfaceScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getRepoAutomationSurfaceHelp(lang));
+        return 0;
+    }
+    const options = parseRepoAutomationSurfaceOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run repo/automation-surface --help', getRepoAutomationSurfaceHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectRepoAutomationSurface(resolveMustflowRoot());
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderRepoAutomationSurfaceSummary(report, lang));
+    return report.ok ? 0 : 1;
+}

package/dist/cli/script-packs/repo-dependency-surface.js

@@ -0,0 +1,87 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { inspectRepoDependencySurface, REPO_DEPENDENCY_SURFACE_SCRIPT_REF, } from '../../core/repo-dependency-surface.js';
+const REPO_DEPENDENCY_SURFACE_OPTIONS = [{ name: '--json', kind: 'boolean' }];
+export function getRepoDependencySurfaceHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run repo/dependency-surface inspect [options]',
+        summary: t(lang, 'dependencySurface.help.summary'),
+        options: [
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run repo/dependency-surface inspect',
+            'mf script-pack run repo/dependency-surface inspect --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'dependencySurface.help.exit.ok') },
+            { label: '1', description: t(lang, 'dependencySurface.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseRepoDependencySurfaceOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, REPO_DEPENDENCY_SURFACE_OPTIONS, { allowPositionals: false });
+    const json = hasParsedCliOption(parsed, '--json');
+    if (action !== 'inspect') {
+        return {
+            action: 'inspect',
+            json,
+            error: action
+                ? t(lang, 'dependencySurface.error.unknownAction', { action })
+                : t(lang, 'dependencySurface.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return { action, json, error: formatCliOptionParseError(parsed.error, lang) };
+    }
+    return { action, json };
+}
+function renderRepoDependencySurfaceSummary(report, lang) {
+    const lines = [
+        t(lang, 'dependencySurface.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${REPO_DEPENDENCY_SURFACE_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'dependencySurface.label.surfaces')}: ${report.summary.surface_count}`,
+        `${t(lang, 'dependencySurface.label.ecosystems')}: ${report.summary.ecosystem_count}`,
+        `${t(lang, 'dependencySurface.label.findings')}: ${report.summary.finding_count}`,
+    ];
+    if (report.surfaces.length > 0) {
+        lines.push(t(lang, 'dependencySurface.label.surfaceDetails'));
+        for (const surface of report.surfaces) {
+            const location = surface.line === null ? surface.path : `${surface.path}:${surface.line}`;
+            lines.push(`- ${surface.ecosystem} ${surface.kind} ${surface.name} at ${location}`);
+        }
+    }
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'dependencySurface.label.findings'));
+        for (const finding of report.findings) {
+            lines.push(`- ${finding.path}: ${finding.code} (${finding.message})`);
+        }
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'dependencySurface.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    return lines.join('\n');
+}
+export function runRepoDependencySurfaceScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getRepoDependencySurfaceHelp(lang));
+        return 0;
+    }
+    const options = parseRepoDependencySurfaceOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run repo/dependency-surface --help', getRepoDependencySurfaceHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectRepoDependencySurface(resolveMustflowRoot());
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderRepoDependencySurfaceSummary(report, lang));
+    return report.ok ? 0 : 1;
+}

package/dist/cli/script-packs/repo-toolchain-provenance.js

@@ -0,0 +1,90 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { inspectRepoToolchainProvenance, REPO_TOOLCHAIN_PROVENANCE_SCRIPT_REF, } from '../../core/repo-toolchain-provenance.js';
+const REPO_TOOLCHAIN_PROVENANCE_OPTIONS = [{ name: '--json', kind: 'boolean' }];
+export function getRepoToolchainProvenanceHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run repo/toolchain-provenance inspect [options]',
+        summary: t(lang, 'toolchainProvenance.help.summary'),
+        options: [
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run repo/toolchain-provenance inspect',
+            'mf script-pack run repo/toolchain-provenance inspect --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'toolchainProvenance.help.exit.ok') },
+            { label: '1', description: t(lang, 'toolchainProvenance.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseRepoToolchainProvenanceOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, REPO_TOOLCHAIN_PROVENANCE_OPTIONS, { allowPositionals: false });
+    const json = hasParsedCliOption(parsed, '--json');
+    if (action !== 'inspect') {
+        return {
+            action: 'inspect',
+            json,
+            error: action
+                ? t(lang, 'toolchainProvenance.error.unknownAction', { action })
+                : t(lang, 'toolchainProvenance.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return { action, json, error: formatCliOptionParseError(parsed.error, lang) };
+    }
+    return { action, json };
+}
+function renderRepoToolchainProvenanceSummary(report, lang) {
+    const lines = [
+        t(lang, 'toolchainProvenance.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${REPO_TOOLCHAIN_PROVENANCE_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'toolchainProvenance.label.sources')}: ${report.summary.source_count}`,
+        `${t(lang, 'toolchainProvenance.label.lockfiles')}: ${report.summary.lockfile_count}`,
+        `${t(lang, 'toolchainProvenance.label.findings')}: ${report.summary.finding_count}`,
+    ];
+    if (report.sources.length > 0) {
+        lines.push(t(lang, 'toolchainProvenance.label.sourceDetails'));
+        for (const source of report.sources) {
+            const location = source.line === null ? source.path : `${source.path}:${source.line}`;
+            lines.push(`- ${source.kind} ${source.key}=${source.value} (${source.source_kind}, ${location})`);
+        }
+    }
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'toolchainProvenance.label.findings'));
+        for (const finding of report.findings) {
+            lines.push(`- ${finding.path}: ${finding.code} (${finding.message})`);
+        }
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'toolchainProvenance.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    if (report.sources.length === 0 && report.findings.length === 0 && report.issues.length === 0) {
+        lines.push(t(lang, 'toolchainProvenance.clean'));
+    }
+    return lines.join('\n');
+}
+export function runRepoToolchainProvenanceScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getRepoToolchainProvenanceHelp(lang));
+        return 0;
+    }
+    const options = parseRepoToolchainProvenanceOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run repo/toolchain-provenance --help', getRepoToolchainProvenanceHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectRepoToolchainProvenance(resolveMustflowRoot());
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderRepoToolchainProvenanceSummary(report, lang));
+    return report.ok ? 0 : 1;
+}

package/dist/core/public-json-contracts.js

@@ -527,6 +527,33 @@ const PUBLIC_JSON_SCHEMA_CONTRACTS = [
         installedCommand: ['mf', 'script-pack', 'run', 'repo/version-source', 'inspect', '--json'],
         expectedExitCodes: [0, 1],
     },
+    {
+        id: 'repo-toolchain-provenance-report',
+        schemaFile: 'repo-toolchain-provenance-report.schema.json',
+        producer: 'mf script-pack run repo/toolchain-provenance inspect --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'script-pack', 'run', 'repo/toolchain-provenance', 'inspect', '--json'],
+        expectedExitCodes: [0, 1],
+    },
+    {
+        id: 'repo-automation-surface-report',
+        schemaFile: 'repo-automation-surface-report.schema.json',
+        producer: 'mf script-pack run repo/automation-surface inspect --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'script-pack', 'run', 'repo/automation-surface', 'inspect', '--json'],
+        expectedExitCodes: [0, 1],
+    },
+    {
+        id: 'repo-dependency-surface-report',
+        schemaFile: 'repo-dependency-surface-report.schema.json',
+        producer: 'mf script-pack run repo/dependency-surface inspect --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'script-pack', 'run', 'repo/dependency-surface', 'inspect', '--json'],
+        expectedExitCodes: [0, 1],
+    },
     {
         id: 'repo-approval-gate-report',
         schemaFile: 'repo-approval-gate-report.schema.json',

package/dist/core/repo-automation-surface.js

@@ -0,0 +1,376 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { isRecord, readMustflowOwnedTomlFile } from './config-loading.js';
+export const REPO_AUTOMATION_SURFACE_PACK_ID = 'repo';
+export const REPO_AUTOMATION_SURFACE_SCRIPT_ID = 'automation-surface';
+export const REPO_AUTOMATION_SURFACE_SCRIPT_REF = `${REPO_AUTOMATION_SURFACE_PACK_ID}/${REPO_AUTOMATION_SURFACE_SCRIPT_ID}`;
+const DEFAULT_MAX_FILE_BYTES = 256 * 1024;
+const COMMANDS_PATH = '.mustflow/config/commands.toml';
+const WORKFLOW_DIR = '.github/workflows';
+function sha256(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function normalizeRelativePath(value) {
+    return value.replace(/\\/gu, '/').replace(/^\.\/+/u, '');
+}
+function lineForOffset(content, offset) {
+    let line = 1;
+    for (let index = 0; index < offset; index += 1) {
+        if (content.charCodeAt(index) === 10) {
+            line += 1;
+        }
+    }
+    return line;
+}
+function safeReadText(root, relativePath, scannedPaths, issues) {
+    const normalized = normalizeRelativePath(relativePath);
+    scannedPaths.add(normalized);
+    const absolute = path.join(root, ...normalized.split('/'));
+    try {
+        const stats = statSync(absolute);
+        if (!stats.isFile()) {
+            return null;
+        }
+        if (stats.size > DEFAULT_MAX_FILE_BYTES) {
+            issues.push(`${normalized} exceeds max_file_bytes (${stats.size} > ${DEFAULT_MAX_FILE_BYTES}).`);
+            return null;
+        }
+        return readFileSync(absolute, 'utf8');
+    }
+    catch (error) {
+        if (!existsSync(absolute)) {
+            return null;
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        issues.push(`Could not read ${normalized}: ${message}`);
+        return null;
+    }
+}
+function firstLine(content, pattern) {
+    const match = pattern.exec(content);
+    return match && match.index >= 0 ? lineForOffset(content, match.index) : null;
+}
+function uniqueStrings(values) {
+    return [...new Set([...values].filter((value) => value.trim().length > 0))].sort((left, right) => left.localeCompare(right));
+}
+function classifyCategory(name, command) {
+    const value = `${name} ${command ?? ''}`.toLowerCase();
+    if (/\bdoctor|health|diagnose/u.test(value))
+        return 'doctor';
+    if (/\bbootstrap|setup|install|init\b/u.test(value))
+        return 'bootstrap';
+    if (/\bcheck|verify|lint|typecheck|fmt --check|format-check/u.test(value))
+        return 'check';
+    if (/\btest|vitest|jest|pytest|cargo test|go test/u.test(value))
+        return 'test';
+    if (/\bfix|format|prettier --write|eslint .*--fix|ruff .*--fix/u.test(value))
+        return 'fix';
+    if (/\bclean|rm -rf|rimraf/u.test(value))
+        return 'clean';
+    if (/\bsmoke|healthcheck/u.test(value))
+        return 'smoke';
+    if (/\bdeps?|dependency|renovate|dependabot|update\b/u.test(value))
+        return 'deps';
+    if (/\bdb:|database|migrate|seed|backup|restore|reset-dev/u.test(value))
+        return 'db';
+    if (/\brelease|publish|version|tag\b/u.test(value))
+        return 'release';
+    if (/\bdeploy|wrangler|vercel|netlify|pages\b/u.test(value))
+        return 'deploy';
+    if (/\bdev|serve|start|preview\b/u.test(value))
+        return 'dev_server';
+    if (/\bwatch\b/u.test(value))
+        return 'watch';
+    if (/\bworkflow|mustflow|docs|map|flow/u.test(value))
+        return 'workflow';
+    return 'unknown';
+}
+function classifyRisks(name, command, category) {
+    const value = `${name} ${command ?? ''}`.toLowerCase();
+    const risks = [];
+    if (category === 'dev_server' || category === 'watch' || /\b(?:serve|preview|--watch|watch)\b/u.test(value))
+        risks.push('long_running');
+    if (category === 'release' || category === 'deploy' || /\bpublish|gh release|git tag|npm version\b/u.test(value))
+        risks.push('release');
+    if (/\b(?:install|update|upgrade|audit|curl|wget|docker pull|git fetch|git push|npm publish|bun publish)\b/u.test(value))
+        risks.push('network');
+    if (/\b(?:rm -rf|rimraf|drop database|migrate reset|docker compose down -v|git reset|git clean)\b/u.test(value))
+        risks.push('destructive');
+    if (/\b(?:git commit|git push|git tag|gh release)\b/u.test(value))
+        risks.push('git_state');
+    if (/\b(?:secret|token|key|login|auth)\b/u.test(value))
+        risks.push('secret');
+    if (/\b(?:--yes|-y|write|build|dist|codegen|generate|migrate|seed|format|fix)\b/u.test(value))
+        risks.push('writes');
+    if (/\b(?:read -p|select |prompt|confirm|pause)\b/u.test(value))
+        risks.push('interactive');
+    return uniqueStrings(risks);
+}
+function candidateIntentName(name, category) {
+    const normalized = name
+        .toLowerCase()
+        .replace(/^scripts?:/u, '')
+        .replace(/[^a-z0-9]+/gu, '_')
+        .replace(/^_+|_+$/gu, '');
+    return normalized || (category === 'unknown' ? null : category);
+}
+function addSurface(surfaces, input, intents) {
+    const category = classifyCategory(input.name, input.command_hint);
+    const risks = classifyRisks(input.name, input.command_hint, category);
+    const mappedName = candidateIntentName(input.name, category);
+    const intent = mappedName ? intents.get(mappedName) : undefined;
+    const agentAllowed = intent ? intent.status === 'configured' && intent.runPolicy === 'agent_allowed' : null;
+    surfaces.push({
+        id: `${input.kind}:${input.path}:${input.line ?? 0}:${input.name}`,
+        ...input,
+        category,
+        risks,
+        mapped_intent: intent ? mappedName : null,
+        agent_allowed: agentAllowed,
+    });
+}
+function readCommandIntents(root, scannedPaths, issues) {
+    scannedPaths.add(COMMANDS_PATH);
+    const intents = new Map();
+    if (!existsSync(path.join(root, ...COMMANDS_PATH.split('/')))) {
+        return intents;
+    }
+    try {
+        const parsed = readMustflowOwnedTomlFile(root, COMMANDS_PATH);
+        const table = isRecord(parsed) ? parsed : {};
+        const intentTable = isRecord(table.intents) ? table.intents : {};
+        for (const [name, value] of Object.entries(intentTable)) {
+            if (!isRecord(value)) {
+                continue;
+            }
+            intents.set(name, {
+                status: typeof value.status === 'string' ? value.status : null,
+                runPolicy: typeof value.run_policy === 'string' ? value.run_policy : null,
+            });
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        issues.push(`Could not read ${COMMANDS_PATH}: ${message}`);
+    }
+    return intents;
+}
+function scanPackageJson(root, scannedPaths, surfaces, intents, issues) {
+    const content = safeReadText(root, 'package.json', scannedPaths, issues);
+    if (content === null) {
+        return;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        issues.push(`Could not parse package.json: ${message}`);
+        return;
+    }
+    const scripts = isRecord(parsed) && isRecord(parsed.scripts) ? parsed.scripts : {};
+    for (const [name, value] of Object.entries(scripts)) {
+        if (typeof value !== 'string') {
+            continue;
+        }
+        addSurface(surfaces, {
+            kind: 'package_script',
+            path: 'package.json',
+            line: firstLine(content, new RegExp(`"${name.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&')}"\\s*:`, 'u')),
+            name,
+            command_hint: value,
+        }, intents);
+    }
+}
+function scanMakefile(root, scannedPaths, surfaces, intents, issues) {
+    for (const relativePath of ['Makefile', 'makefile']) {
+        const content = safeReadText(root, relativePath, scannedPaths, issues);
+        if (content === null)
+            continue;
+        for (const [index, line] of content.split(/\r?\n/u).entries()) {
+            const match = /^([A-Za-z0-9_.:-]+)\s*:(?:\s|$)/u.exec(line);
+            if (!match || match[1].startsWith('.'))
+                continue;
+            addSurface(surfaces, { kind: 'make_target', path: relativePath, line: index + 1, name: match[1], command_hint: null }, intents);
+        }
+    }
+}
+function scanTaskLikeFile(root, scannedPaths, surfaces, intents, issues) {
+    for (const relativePath of ['Taskfile.yml', 'Taskfile.yaml']) {
+        const content = safeReadText(root, relativePath, scannedPaths, issues);
+        if (content === null)
+            continue;
+        for (const [index, line] of content.split(/\r?\n/u).entries()) {
+            const match = /^\s{2}([A-Za-z0-9_.:-]+):\s*$/u.exec(line);
+            if (!match)
+                continue;
+            addSurface(surfaces, { kind: 'taskfile_task', path: relativePath, line: index + 1, name: match[1], command_hint: null }, intents);
+        }
+    }
+}
+function scanMiseTasks(root, scannedPaths, surfaces, intents, issues) {
+    for (const relativePath of ['mise.toml', '.mise.toml']) {
+        const content = safeReadText(root, relativePath, scannedPaths, issues);
+        if (content === null)
+            continue;
+        for (const [index, line] of content.split(/\r?\n/u).entries()) {
+            const match = /^\s*\[tasks\.([^\]]+)\]\s*$/u.exec(line) ?? /^\s*([A-Za-z0-9_.:-]+)\s*=\s*["'][^"']+["']\s*$/u.exec(line);
+            if (!match)
+                continue;
+            addSurface(surfaces, { kind: 'mise_task', path: relativePath, line: index + 1, name: match[1], command_hint: line.trim() }, intents);
+        }
+    }
+}
+function scanWorkflows(root, scannedPaths, surfaces, intents, issues) {
+    const workflowRoot = path.join(root, ...WORKFLOW_DIR.split('/'));
+    if (!existsSync(workflowRoot)) {
+        scannedPaths.add(WORKFLOW_DIR);
+        return;
+    }
+    let entries = [];
+    try {
+        entries = readdirSync(workflowRoot)
+            .filter((name) => /\.(?:yml|yaml)$/u.test(name))
+            .map((name) => `${WORKFLOW_DIR}/${name}`)
+            .sort((left, right) => left.localeCompare(right));
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        issues.push(`Could not list ${WORKFLOW_DIR}: ${message}`);
+        return;
+    }
+    for (const relativePath of entries) {
+        const content = safeReadText(root, relativePath, scannedPaths, issues);
+        if (content === null)
+            continue;
+        const name = /name:\s*([^\n]+)/u.exec(content)?.[1]?.trim() ?? path.basename(relativePath);
+        addSurface(surfaces, {
+            kind: 'ci_workflow',
+            path: relativePath,
+            line: firstLine(content, /^name:/mu),
+            name,
+            command_hint: content.includes('workflow_dispatch') ? 'workflow_dispatch' : content.includes('push:') ? 'push' : null,
+        }, intents);
+    }
+}
+function addMustflowIntentSurfaces(surfaces, intents) {
+    for (const [name, intent] of intents.entries()) {
+        const category = classifyCategory(name, null);
+        surfaces.push({
+            id: `mustflow_intent:${name}`,
+            kind: 'mustflow_intent',
+            path: COMMANDS_PATH,
+            line: null,
+            name,
+            command_hint: null,
+            category,
+            risks: classifyRisks(name, null, category),
+            mapped_intent: name,
+            agent_allowed: intent.status === 'configured' && intent.runPolicy === 'agent_allowed',
+        });
+    }
+}
+function createFindings(surfaces) {
+    const findings = [];
+    for (const surface of surfaces) {
+        if (surface.kind !== 'mustflow_intent' && surface.mapped_intent === null && surface.category !== 'unknown') {
+            findings.push({
+                code: 'raw_command_without_mustflow_intent',
+                severity: surface.risks.length > 0 ? 'medium' : 'low',
+                path: surface.path,
+                message: `${surface.name} appears to be a ${surface.category} automation surface without a mapped mustflow intent.`,
+                json_pointer: null,
+                metric: null,
+                actual: null,
+                expected: null,
+            });
+        }
+        if (surface.risks.includes('long_running')) {
+            findings.push({
+                code: 'long_running_automation_surface',
+                severity: 'medium',
+                path: surface.path,
+                message: `${surface.name} looks long-running and should remain manual or explicitly bounded.`,
+                json_pointer: null,
+                metric: null,
+                actual: null,
+                expected: null,
+            });
+        }
+        if (surface.risks.some((risk) => ['destructive', 'release', 'secret', 'git_state'].includes(risk))) {
+            findings.push({
+                code: 'dangerous_automation_surface',
+                severity: 'high',
+                path: surface.path,
+                message: `${surface.name} touches a high-risk automation category: ${surface.risks.join(', ')}.`,
+                json_pointer: null,
+                metric: null,
+                actual: null,
+                expected: null,
+            });
+        }
+        if (surface.kind === 'mustflow_intent' && surface.agent_allowed === false) {
+            findings.push({
+                code: 'mustflow_intent_manual_boundary',
+                severity: 'low',
+                path: surface.path,
+                message: `${surface.name} is present in the command contract but is not agent-allowed.`,
+                json_pointer: null,
+                metric: null,
+                actual: null,
+                expected: null,
+            });
+        }
+    }
+    return findings;
+}
+function createSummary(surfaces) {
+    return {
+        surface_count: surfaces.length,
+        mustflow_intent_count: surfaces.filter((surface) => surface.kind === 'mustflow_intent').length,
+        raw_surface_count: surfaces.filter((surface) => surface.kind !== 'mustflow_intent').length,
+        agent_allowed_intent_count: surfaces.filter((surface) => surface.kind === 'mustflow_intent' && surface.agent_allowed === true).length,
+        manual_only_intent_count: surfaces.filter((surface) => surface.kind === 'mustflow_intent' && surface.agent_allowed === false).length,
+        risky_surface_count: surfaces.filter((surface) => surface.risks.length > 0).length,
+        long_running_surface_count: surfaces.filter((surface) => surface.risks.includes('long_running')).length,
+    };
+}
+export function inspectRepoAutomationSurface(projectRoot) {
+    const root = path.resolve(projectRoot);
+    const issues = [];
+    const scannedPaths = new Set();
+    const intents = readCommandIntents(root, scannedPaths, issues);
+    const surfaces = [];
+    scanPackageJson(root, scannedPaths, surfaces, intents, issues);
+    scanMakefile(root, scannedPaths, surfaces, intents, issues);
+    scanTaskLikeFile(root, scannedPaths, surfaces, intents, issues);
+    scanMiseTasks(root, scannedPaths, surfaces, intents, issues);
+    scanWorkflows(root, scannedPaths, surfaces, intents, issues);
+    addMustflowIntentSurfaces(surfaces, intents);
+    const sortedSurfaces = surfaces.sort((left, right) => left.path.localeCompare(right.path) || left.name.localeCompare(right.name));
+    const findings = createFindings(sortedSurfaces);
+    const summary = createSummary(sortedSurfaces);
+    const status = issues.length > 0 ? 'error' : findings.some((finding) => finding.severity === 'high') ? 'failed' : 'passed';
+    return {
+        schema_version: '1',
+        command: 'script-pack',
+        pack_id: REPO_AUTOMATION_SURFACE_PACK_ID,
+        script_id: REPO_AUTOMATION_SURFACE_SCRIPT_ID,
+        script_ref: REPO_AUTOMATION_SURFACE_SCRIPT_REF,
+        action: 'inspect',
+        status,
+        ok: status === 'passed',
+        mustflow_root: root,
+        input: {
+            scanned_paths: uniqueStrings(scannedPaths),
+            max_file_bytes: DEFAULT_MAX_FILE_BYTES,
+        },
+        input_hash: sha256(JSON.stringify({ summary, surfaces: sortedSurfaces, findings, issues })),
+        summary,
+        surfaces: sortedSurfaces,
+        findings,
+        issues,
+    };
+}