mustflow 2.84.0 → 2.85.4

package/dist/cli/i18n/zh.js

@@ -774,6 +774,8 @@ export const zhMessages = {
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
     "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
+    "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
+    "scriptPack.script.codeChangeImpact.summary": "Analyze changed files for impact, script-pack, and verification hints",
     "scriptPack.script.codeSymbolRead.summary": "Read a bounded source snippet by source anchor, symbol line, or explicit line range",
     "scriptPack.script.codeRouteOutline.summary": "Scan Hono, Elysia, Axum, and NestJS route methods, paths, handlers, and lifecycle chains",
     "scriptPack.script.codeExportDiff.summary": "Compare exported source signatures and return metadata across git refs",
@@ -912,6 +914,48 @@ export const zhMessages = {
     "generatedBoundary.error.missingAction": "Specify a generated-boundary action: check",
     "generatedBoundary.error.unknownAction": "Unknown generated-boundary action: {action}",
     "generatedBoundary.error.missingPath": "Provide at least one path to check",
+    "dependencyGraph.help.summary": "Trace bounded relative import, export, require, and dynamic import edges for TypeScript and JavaScript source files.",
+    "dependencyGraph.help.option.maxDepth": "Maximum dependency depth from target files. Default: 2",
+    "dependencyGraph.help.option.maxFiles": "Maximum number of source files to scan. Default: 1000",
+    "dependencyGraph.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
+    "dependencyGraph.help.option.maxNodes": "Maximum number of graph nodes to report. Default: 300",
+    "dependencyGraph.help.option.maxEdges": "Maximum number of graph edges to report. Default: 800",
+    "dependencyGraph.help.exit.ok": "The dependency graph completed without input or scan-limit findings",
+    "dependencyGraph.help.exit.fail": "The dependency graph found invalid input, unreadable paths, or scan limits",
+    "dependencyGraph.title": "mustflow dependency graph",
+    "dependencyGraph.label.targets": "Targets",
+    "dependencyGraph.label.nodes": "Nodes",
+    "dependencyGraph.label.edges": "Edges",
+    "dependencyGraph.label.cycles": "Cycles",
+    "dependencyGraph.label.truncated": "Truncated",
+    "dependencyGraph.label.cycleList": "Cycle hints",
+    "dependencyGraph.label.findings": "Findings",
+    "dependencyGraph.label.issues": "Issues",
+    "dependencyGraph.clean": "No relative dependency edges were found.",
+    "dependencyGraph.error.missingAction": "Specify a dependency-graph action: scan",
+    "dependencyGraph.error.unknownAction": "Unknown dependency-graph action: {action}",
+    "dependencyGraph.error.missingPath": "Provide at least one path to scan",
+    "dependencyGraph.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "changeImpact.help.summary": "Analyze git changes and return bounded file-impact, script-pack, and verification hints.",
+    "changeImpact.help.option.base": "Git base ref to compare from. Default: HEAD",
+    "changeImpact.help.option.head": "Git head ref to compare to. Omit to compare the base with the working tree.",
+    "changeImpact.help.option.maxFiles": "Maximum number of changed files to inspect. Default: 200",
+    "changeImpact.help.option.maxImpacts": "Maximum number of impact candidates to report. Default: 300",
+    "changeImpact.help.option.maxFileBytes": "Maximum bytes to read from each source file while tracing dependencies. Default: 262144",
+    "changeImpact.help.exit.ok": "The change-impact analysis completed without input or scan-limit findings",
+    "changeImpact.help.exit.fail": "The change-impact analysis found invalid git input or scan limits",
+    "changeImpact.title": "mustflow change impact",
+    "changeImpact.label.changedFiles": "Changed files",
+    "changeImpact.label.impacts": "Impacts",
+    "changeImpact.label.truncated": "Truncated",
+    "changeImpact.label.scriptHints": "Script hints",
+    "changeImpact.label.verificationHints": "Verification hints",
+    "changeImpact.label.findings": "Findings",
+    "changeImpact.label.issues": "Issues",
+    "changeImpact.clean": "No changed files were found for the selected git range.",
+    "changeImpact.error.missingAction": "Specify a change-impact action: analyze",
+    "changeImpact.error.unknownAction": "Unknown change-impact action: {action}",
+    "changeImpact.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "relatedFiles.help.summary": "Map direct imports, importers, sibling files, and nearby config boundaries for source-oriented repository navigation.",
     "relatedFiles.help.option.maxFiles": "Maximum number of source or related files to scan. Default: 1000",
     "relatedFiles.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
@@ -948,6 +992,41 @@ export const zhMessages = {
     "configChain.error.unknownAction": "Unknown config-chain action: {action}",
     "configChain.error.missingPath": "Provide at least one path to inspect",
     "configChain.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.envContract.summary": "Scan repository environment-variable contracts without reading secret values",
+    "envContract.help.summary": "Scan code, CI, docs, config, and env examples for environment variable contract drift without printing env values.",
+    "envContract.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "envContract.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "envContract.help.option.maxKeys": "Maximum number of env keys to report. Default: 300",
+    "envContract.help.exit.ok": "The env contract scan completed without blocking findings",
+    "envContract.help.exit.fail": "The env contract scan found invalid input, unreadable files, or contract findings",
+    "envContract.title": "mustflow env contract",
+    "envContract.label.files": "Files",
+    "envContract.label.keys": "Keys",
+    "envContract.label.findings": "Findings",
+    "envContract.label.truncated": "Truncated",
+    "envContract.label.issues": "Issues",
+    "envContract.clean": "No environment variable references were found.",
+    "envContract.error.missingAction": "Specify an env-contract action: scan",
+    "envContract.error.unknownAction": "Unknown env-contract action: {action}",
+    "envContract.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.secretRiskScan.summary": "Scan repository files for plausible secrets without printing secret values",
+    "secretRiskScan.help.summary": "Scan code, docs, config, CI, and examples for plausible hardcoded secrets without printing secret values.",
+    "secretRiskScan.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "secretRiskScan.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "secretRiskScan.help.option.maxFindings": "Maximum number of findings to report. Default: 200",
+    "secretRiskScan.help.exit.ok": "The secret-risk scan completed without blocking findings",
+    "secretRiskScan.help.exit.fail": "The secret-risk scan found invalid input, unreadable files, or secret-risk findings",
+    "secretRiskScan.title": "mustflow secret risk scan",
+    "secretRiskScan.label.files": "Files",
+    "secretRiskScan.label.findings": "Findings",
+    "secretRiskScan.label.highOrCritical": "High or critical",
+    "secretRiskScan.label.skippedSecretFiles": "Skipped secret files",
+    "secretRiskScan.label.truncated": "Truncated",
+    "secretRiskScan.label.issues": "Issues",
+    "secretRiskScan.clean": "No plausible hardcoded secrets were found.",
+    "secretRiskScan.error.missingAction": "Specify a secret-risk-scan action: scan",
+    "secretRiskScan.error.unknownAction": "Unknown secret-risk-scan action: {action}",
+    "secretRiskScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "run.help.summary": "从 .mustflow/config/commands.toml 运行已配置的一次性命令。",
     "run.help.option.dryRun": "输出命令计划但不执行",
     "run.help.option.planOnly": "--dry-run 的别名",

package/dist/cli/lib/repo-map.js

@@ -661,7 +661,7 @@ function renderSourceQuality(gitLsFilesStatus) {
         '',
     ];
 }
-export function generateRepoMap(projectRoot, options = {}) {
+function createRepoMapRenderModel(projectRoot, options = {}) {
     const depth = options.depth ?? DEFAULT_DEPTH;
     const config = getRepoMapConfig(projectRoot);
     const configuredPriorityPaths = config.priorityPaths;
@@ -675,10 +675,6 @@ export function generateRepoMap(projectRoot, options = {}) {
     const anchorDiscovery = discoverAnchors(projectRoot, depth, priorityPathSet, nestedRepositories, workspaceRootPrefixes);
     const anchors = anchorDiscovery.anchors;
     const gitLsFilesStatus = anchorDiscovery.gitLsFilesStatus;
-    const priorityAnchors = configuredPriorityPaths
-        .map((relativePath) => anchors.find((anchor) => anchor.relativePath === relativePath))
-        .filter((anchor) => Boolean(anchor));
-    const otherAnchors = anchors.filter((anchor) => !priorityPathSet.has(anchor.relativePath));
     const anchorCount = anchors.length + nestedRepositories.reduce((total, repository) => total + countNestedEntrypoints(repository), 0);
     const sourceFingerprint = getRepoMapSourceFingerprint({
         depth,
@@ -688,8 +684,33 @@ export function generateRepoMap(projectRoot, options = {}) {
         anchors,
         nestedRepositories,
     });
+    return {
+        configuredPriorityPaths,
+        priorityPathSet,
+        mapConfig,
+        nestedRepositories,
+        anchors,
+        gitLsFilesStatus,
+        anchorCount,
+        sourceFingerprint,
+    };
+}
+export function getExpectedRepoMapSourceFingerprint(projectRoot, options = {}) {
+    return createRepoMapRenderModel(projectRoot, options).sourceFingerprint;
+}
+export function generateRepoMap(projectRoot, options = {}) {
+    const model = createRepoMapRenderModel(projectRoot, options);
+    const configuredPriorityPaths = model.configuredPriorityPaths;
+    const priorityPathSet = model.priorityPathSet;
+    const nestedRepositories = model.nestedRepositories;
+    const anchors = model.anchors;
+    const gitLsFilesStatus = model.gitLsFilesStatus;
+    const priorityAnchors = configuredPriorityPaths
+        .map((relativePath) => anchors.find((anchor) => anchor.relativePath === relativePath))
+        .filter((anchor) => Boolean(anchor));
+    const otherAnchors = anchors.filter((anchor) => !priorityPathSet.has(anchor.relativePath));
     return [
-        ...renderRepoMapFrontmatter(anchorCount, sourceFingerprint, gitLsFilesStatus),
+        ...renderRepoMapFrontmatter(model.anchorCount, model.sourceFingerprint, gitLsFilesStatus),
         '# REPO_MAP.md',
         '',
         'This file is an agent navigation map for the current mustflow root. It is not a full file listing.',

package/dist/cli/lib/run-root-trust.js

@@ -1,4 +1,5 @@
 import { MANIFEST_LOCK_RELATIVE_PATH, inspectManifestLock } from './manifest-lock.js';
+import { readCommandContractIncludePaths } from '../../core/config-loading.js';
 export const ALLOW_UNTRUSTED_ROOT_OPTION = '--allow-untrusted-root';
 const REQUIRED_RUN_TRUST_LOCK_PATHS = [
     'AGENTS.md',
@@ -17,7 +18,20 @@ export function assessRunRootTrust(projectRoot) {
             };
         }
         const trackedPaths = new Set(readResult.lock.files.map((file) => file.relativePath));
-        const missingRequiredPath = REQUIRED_RUN_TRUST_LOCK_PATHS.find((relativePath) => !trackedPaths.has(relativePath));
+        let requiredPaths = REQUIRED_RUN_TRUST_LOCK_PATHS;
+        try {
+            requiredPaths = [...REQUIRED_RUN_TRUST_LOCK_PATHS, ...readCommandContractIncludePaths(projectRoot)];
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return {
+                trusted: false,
+                reason: 'manifest_lock_invalid',
+                manifestLockPath: readResult.lockPath,
+                detail: message,
+            };
+        }
+        const missingRequiredPath = requiredPaths.find((relativePath) => !trackedPaths.has(relativePath));
         if (missingRequiredPath) {
             return {
                 trusted: false,

package/dist/cli/lib/script-pack-registry.js

@@ -36,6 +36,64 @@ export const SCRIPT_PACKS = [
                 reportSchemaFile: 'code-outline-report.schema.json',
                 loadRunner: async () => (await import('../script-packs/code-outline.js')).runCodeOutlineScript,
             },
+            {
+                packId: 'code',
+                id: 'dependency-graph',
+                ref: scriptRef('code', 'dependency-graph'),
+                usage: 'mf script-pack run code/dependency-graph scan <path...> [options]',
+                summaryKey: 'scriptPack.script.codeDependencyGraph.summary',
+                actions: ['scan'],
+                useWhen: [
+                    'Trace relative TypeScript and JavaScript import, export, require, and dynamic import edges before changing a module.',
+                    'Build a bounded dependency graph with nodes, edges, depth, importer counts, import counts, and cycle hints for source impact orientation.',
+                ],
+                phases: ['before_change', 'during_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['path', 'max_files', 'max_file_bytes', 'max_depth', 'max_nodes', 'max_edges'],
+                outputs: ['human_summary', 'json_report', 'dependency_graph', 'cycle_hints'],
+                relatedSkills: [
+                    'change-blast-radius-review',
+                    'codebase-orientation',
+                    'javascript-code-change',
+                    'module-boundary-review',
+                    'typescript-code-change',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'dependency-graph-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/code-dependency-graph.js')).runCodeDependencyGraphScript,
+            },
+            {
+                packId: 'code',
+                id: 'change-impact',
+                ref: scriptRef('code', 'change-impact'),
+                usage: 'mf script-pack run code/change-impact analyze [path...] [options]',
+                summaryKey: 'scriptPack.script.codeChangeImpact.summary',
+                actions: ['analyze'],
+                useWhen: [
+                    'Analyze current git changes and produce bounded file, script-pack, and verification hints after a change.',
+                    'Classify changed source, test, docs, schema, package, template, and workflow surfaces before choosing follow-up checks.',
+                ],
+                phases: ['after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['path', 'base_ref', 'head_ref', 'max_files', 'max_impacts', 'max_file_bytes'],
+                outputs: ['human_summary', 'json_report', 'changed_files', 'impact_candidates', 'verification_hints'],
+                relatedSkills: [
+                    'change-blast-radius-review',
+                    'completion-evidence-gate',
+                    'javascript-code-change',
+                    'public-json-contract-change',
+                    'typescript-code-change',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'change-impact-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/code-change-impact.js')).runCodeChangeImpactScript,
+            },
             {
                 packId: 'code',
                 id: 'symbol-read',
@@ -229,6 +287,62 @@ export const SCRIPT_PACKS = [
                 reportSchemaFile: 'config-chain-report.schema.json',
                 loadRunner: async () => (await import('../script-packs/repo-config-chain.js')).runRepoConfigChainScript,
             },
+            {
+                packId: 'repo',
+                id: 'env-contract',
+                ref: scriptRef('repo', 'env-contract'),
+                usage: 'mf script-pack run repo/env-contract scan [path...] [options]',
+                summaryKey: 'scriptPack.script.envContract.summary',
+                actions: ['scan'],
+                useWhen: [
+                    'Scan code, CI, docs, and env example files for environment variable contract drift without reading real secret env files.',
+                    'Review env keys that are used in code, declared in examples, referenced in CI, documented, missing from examples, or public-prefix secret-like names.',
+                ],
+                phases: ['before_change', 'during_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['path', 'max_files', 'max_file_bytes', 'max_keys'],
+                outputs: ['human_summary', 'json_report', 'env_keys', 'env_contract_findings'],
+                relatedSkills: [
+                    'config-env-change',
+                    'public-json-contract-change',
+                    'security-privacy-review',
+                    'typescript-code-change',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'env-contract-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-env-contract.js')).runRepoEnvContractScript,
+            },
+            {
+                packId: 'repo',
+                id: 'secret-risk-scan',
+                ref: scriptRef('repo', 'secret-risk-scan'),
+                usage: 'mf script-pack run repo/secret-risk-scan scan [path...] [options]',
+                summaryKey: 'scriptPack.script.secretRiskScan.summary',
+                actions: ['scan'],
+                useWhen: [
+                    'Scan code, docs, config, CI, and examples for plausible hardcoded secrets without printing secret values.',
+                    'Review provider token prefixes, Bearer tokens, private key markers, secret-like assignments, and realistic env-example values.',
+                ],
+                phases: ['before_change', 'during_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['path', 'max_files', 'max_file_bytes', 'max_findings'],
+                outputs: ['human_summary', 'json_report', 'secret_risk_findings', 'redacted_fingerprints'],
+                relatedSkills: [
+                    'config-env-change',
+                    'public-json-contract-change',
+                    'security-privacy-review',
+                    'typescript-code-change',
+                ],
+                riskLevel: 'medium',
+                cost: 'low',
+                reportSchemaFile: 'secret-risk-scan-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-secret-risk-scan.js')).runRepoSecretRiskScanScript,
+            },
             {
                 packId: 'repo',
                 id: 'generated-boundary',

package/dist/cli/lib/validation/index.js

@@ -11,7 +11,7 @@ import { validateSourceAnchorsInProject } from '../../../core/source-anchor-vali
 import { listFilesRecursive, toPosixPath } from '../filesystem.js';
 import { readGitChangedFiles } from '../git-changes.js';
 import { inspectManifestLock } from '../manifest-lock.js';
-import { generateRepoMap } from '../repo-map.js';
+import { getExpectedRepoMapSourceFingerprint } from '../repo-map.js';
 import { parseTomlText, readMustflowTomlFile } from '../toml.js';
 import { MUSTFLOW_JSON_MAX_BYTES } from '../mustflow-read.js';
 import { getContractModelDefinitions, validateCandidateContractModelConfig, } from '../../../core/contract-models.js';
@@ -1464,7 +1464,7 @@ function validateStrictRepoMap(projectRoot, issues) {
     }
     else {
         const currentSourceFingerprint = frontmatter.source_fingerprint;
-        const expectedSourceFingerprint = parseSimpleFrontmatter(generateRepoMap(projectRoot)).source_fingerprint;
+        const expectedSourceFingerprint = getExpectedRepoMapSourceFingerprint(projectRoot);
         if (expectedSourceFingerprint && currentSourceFingerprint !== expectedSourceFingerprint) {
             pushStrictIssue(issues, 'REPO_MAP.md source_fingerprint is stale; regenerate with mf map --write');
         }

package/dist/cli/lib/validation/primitives.js

@@ -2,6 +2,7 @@ import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { isRecord } from '../command-contract.js';
 import { readMustflowTomlFile } from '../toml.js';
+import { COMMANDS_CONFIG_RELATIVE_PATH, readResolvedCommandContractToml, } from '../../../core/config-loading.js';
 import { REQUIRED_FILES, } from './constants.js';
 import { TECHNOLOGY_CONFIG_RELATIVE_PATH } from '../../../core/technology-preferences.js';
 import { VERSIONING_CONFIG_PATH } from '../../../core/version-sources.js';
@@ -43,7 +44,9 @@ export function validateToml(projectRoot, issues) {
             continue;
         }
         try {
-            const parsed = readMustflowTomlFile(projectRoot, relativePath);
+            const parsed = relativePath === COMMANDS_CONFIG_RELATIVE_PATH
+                ? readResolvedCommandContractToml(projectRoot)
+                : readMustflowTomlFile(projectRoot, relativePath);
             if (!isRecord(parsed)) {
                 issues.push({ message: `${relativePath} must contain a TOML table` });
                 continue;

package/dist/cli/script-packs/code-change-impact.js

@@ -0,0 +1,172 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, getParsedCliStringOption, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { CHANGE_IMPACT_SCRIPT_REF, inspectChangeImpact } from '../../core/change-impact.js';
+const CHANGE_IMPACT_OPTIONS = [
+    { name: '--json', kind: 'boolean' },
+    { name: '--base', kind: 'string' },
+    { name: '--head', kind: 'string' },
+    { name: '--max-files', kind: 'string' },
+    { name: '--max-impacts', kind: 'string' },
+    { name: '--max-file-bytes', kind: 'string' },
+];
+function parsePositiveInteger(value, option, lang) {
+    if (value === null) {
+        return { value: null };
+    }
+    if (!/^[1-9]\d*$/u.test(value)) {
+        return { value: null, error: t(lang, 'changeImpact.error.invalidPositiveInteger', { option, value }) };
+    }
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed)) {
+        return { value: null, error: t(lang, 'changeImpact.error.invalidPositiveInteger', { option, value }) };
+    }
+    return { value: parsed };
+}
+export function getCodeChangeImpactHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run code/change-impact analyze [path...] [options]',
+        summary: t(lang, 'changeImpact.help.summary'),
+        options: [
+            { label: '--base <ref>', description: t(lang, 'changeImpact.help.option.base') },
+            { label: '--head <ref>', description: t(lang, 'changeImpact.help.option.head') },
+            { label: '--max-files <count>', description: t(lang, 'changeImpact.help.option.maxFiles') },
+            { label: '--max-impacts <count>', description: t(lang, 'changeImpact.help.option.maxImpacts') },
+            { label: '--max-file-bytes <bytes>', description: t(lang, 'changeImpact.help.option.maxFileBytes') },
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run code/change-impact analyze --base HEAD --json',
+            'mf script-pack run code/change-impact analyze src --base main --head HEAD --json',
+            'mf script-pack run code/change-impact analyze src/core --max-impacts 80 --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'changeImpact.help.exit.ok') },
+            { label: '1', description: t(lang, 'changeImpact.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseChangeImpactOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, CHANGE_IMPACT_OPTIONS, { allowPositionals: true });
+    const json = hasParsedCliOption(parsed, '--json');
+    const baseRef = getParsedCliStringOption(parsed, '--base');
+    const headRef = getParsedCliStringOption(parsed, '--head');
+    const maxFiles = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-files'), '--max-files', lang);
+    const maxImpacts = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-impacts'), '--max-impacts', lang);
+    const maxFileBytes = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-file-bytes'), '--max-file-bytes', lang);
+    const positiveOptions = [maxFiles, maxImpacts, maxFileBytes];
+    if (action !== 'analyze') {
+        return {
+            action: 'analyze',
+            json,
+            baseRef,
+            headRef,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxImpacts: maxImpacts.value,
+            maxFileBytes: maxFileBytes.value,
+            error: action ? t(lang, 'changeImpact.error.unknownAction', { action }) : t(lang, 'changeImpact.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return {
+            action,
+            json,
+            baseRef,
+            headRef,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxImpacts: maxImpacts.value,
+            maxFileBytes: maxFileBytes.value,
+            error: formatCliOptionParseError(parsed.error, lang),
+        };
+    }
+    for (const candidate of positiveOptions) {
+        if (candidate.error) {
+            return {
+                action,
+                json,
+                baseRef,
+                headRef,
+                paths: parsed.positionals,
+                maxFiles: maxFiles.value,
+                maxImpacts: maxImpacts.value,
+                maxFileBytes: maxFileBytes.value,
+                error: candidate.error,
+            };
+        }
+    }
+    return {
+        action,
+        json,
+        baseRef,
+        headRef,
+        paths: parsed.positionals,
+        maxFiles: maxFiles.value,
+        maxImpacts: maxImpacts.value,
+        maxFileBytes: maxFileBytes.value,
+    };
+}
+function renderChangeImpactSummary(report, lang) {
+    const lines = [
+        t(lang, 'changeImpact.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${CHANGE_IMPACT_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'changeImpact.label.changedFiles')}: ${report.changed_files.length}`,
+        `${t(lang, 'changeImpact.label.impacts')}: ${report.impacts.length}`,
+        `${t(lang, 'changeImpact.label.truncated')}: ${report.truncated ? t(lang, 'value.yes') : t(lang, 'value.no')}`,
+    ];
+    for (const impact of report.impacts.slice(0, 40)) {
+        lines.push(`- ${impact.path}: ${impact.relationship} (${impact.reason})`);
+    }
+    if (report.script_hints.length > 0) {
+        lines.push(t(lang, 'changeImpact.label.scriptHints'));
+        for (const hint of report.script_hints) {
+            lines.push(`- ${hint.script_ref}: ${hint.command}`);
+        }
+    }
+    if (report.verification_hints.length > 0) {
+        lines.push(t(lang, 'changeImpact.label.verificationHints'));
+        for (const hint of report.verification_hints) {
+            lines.push(`- ${hint.intent}: ${hint.reason}`);
+        }
+    }
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'changeImpact.label.findings'), ...report.findings.map((finding) => `- ${finding.path}: ${finding.code} (${finding.message})`));
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'changeImpact.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    if (report.changed_files.length === 0 && report.findings.length === 0 && report.issues.length === 0) {
+        lines.push(t(lang, 'changeImpact.clean'));
+    }
+    return lines.join('\n');
+}
+export function runCodeChangeImpactScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getCodeChangeImpactHelp(lang));
+        return 0;
+    }
+    const options = parseChangeImpactOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run code/change-impact --help', getCodeChangeImpactHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectChangeImpact(resolveMustflowRoot(), {
+        baseRef: options.baseRef ?? undefined,
+        headRef: options.headRef,
+        paths: options.paths,
+        maxFiles: options.maxFiles ?? undefined,
+        maxImpacts: options.maxImpacts ?? undefined,
+        maxFileBytes: options.maxFileBytes ?? undefined,
+    });
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderChangeImpactSummary(report, lang));
+    return report.ok ? 0 : 1;
+}