mustflow 2.84.0 → 2.99.0

package/dist/cli/lib/script-pack-registry.js

@@ -36,6 +36,93 @@ export const SCRIPT_PACKS = [
                 reportSchemaFile: 'code-outline-report.schema.json',
                 loadRunner: async () => (await import('../script-packs/code-outline.js')).runCodeOutlineScript,
             },
+            {
+                packId: 'code',
+                id: 'dependency-graph',
+                ref: scriptRef('code', 'dependency-graph'),
+                usage: 'mf script-pack run code/dependency-graph scan <path...> [options]',
+                summaryKey: 'scriptPack.script.codeDependencyGraph.summary',
+                actions: ['scan'],
+                useWhen: [
+                    'Trace relative TypeScript and JavaScript import, export, require, and dynamic import edges before changing a module.',
+                    'Build a bounded dependency graph with nodes, edges, depth, importer counts, import counts, and cycle hints for source impact orientation.',
+                ],
+                phases: ['before_change', 'during_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['path', 'max_files', 'max_file_bytes', 'max_depth', 'max_nodes', 'max_edges'],
+                outputs: ['human_summary', 'json_report', 'dependency_graph', 'cycle_hints'],
+                relatedSkills: [
+                    'change-blast-radius-review',
+                    'codebase-orientation',
+                    'javascript-code-change',
+                    'module-boundary-review',
+                    'typescript-code-change',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'dependency-graph-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/code-dependency-graph.js')).runCodeDependencyGraphScript,
+            },
+            {
+                packId: 'code',
+                id: 'import-cycle',
+                ref: scriptRef('code', 'import-cycle'),
+                usage: 'mf script-pack run code/import-cycle check <path...> [options]',
+                summaryKey: 'scriptPack.script.codeImportCycle.summary',
+                actions: ['check'],
+                useWhen: [
+                    'Detect bounded relative TypeScript and JavaScript import cycles before changing module boundaries.',
+                    'Review exact cycle paths and import line evidence after dependency graph orientation finds cycle hints.',
+                ],
+                phases: ['before_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['path', 'max_files', 'max_file_bytes', 'max_depth', 'max_nodes', 'max_edges', 'max_cycles'],
+                outputs: ['human_summary', 'json_report', 'import_cycles', 'cycle_edge_evidence'],
+                relatedSkills: [
+                    'change-blast-radius-review',
+                    'codebase-orientation',
+                    'javascript-code-change',
+                    'module-boundary-review',
+                    'typescript-code-change',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'import-cycle-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/code-import-cycle.js')).runCodeImportCycleScript,
+            },
+            {
+                packId: 'code',
+                id: 'change-impact',
+                ref: scriptRef('code', 'change-impact'),
+                usage: 'mf script-pack run code/change-impact analyze [path...] [options]',
+                summaryKey: 'scriptPack.script.codeChangeImpact.summary',
+                actions: ['analyze'],
+                useWhen: [
+                    'Analyze current git changes and produce bounded file, script-pack, and verification hints after a change.',
+                    'Classify changed source, test, docs, schema, package, template, and workflow surfaces before choosing follow-up checks.',
+                ],
+                phases: ['after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['path', 'base_ref', 'head_ref', 'max_files', 'max_impacts', 'max_file_bytes'],
+                outputs: ['human_summary', 'json_report', 'changed_files', 'impact_candidates', 'script_hints', 'verification_hints'],
+                relatedSkills: [
+                    'change-blast-radius-review',
+                    'completion-evidence-gate',
+                    'javascript-code-change',
+                    'public-json-contract-change',
+                    'typescript-code-change',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'change-impact-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/code-change-impact.js')).runCodeChangeImpactScript,
+            },
             {
                 packId: 'code',
                 id: 'symbol-read',
@@ -194,6 +281,87 @@ export const SCRIPT_PACKS = [
                 reportSchemaFile: 'reference-drift-report.schema.json',
                 loadRunner: async () => (await import('../script-packs/docs-reference-drift.js')).runDocsReferenceDriftScript,
             },
+            {
+                packId: 'docs',
+                id: 'link-integrity',
+                ref: scriptRef('docs', 'link-integrity'),
+                usage: 'mf script-pack run docs/link-integrity check [path...] [options]',
+                summaryKey: 'scriptPack.script.linkIntegrity.summary',
+                actions: ['check'],
+                useWhen: [
+                    'Check Markdown and MDX inline links for local file and anchor drift without fetching external URLs.',
+                    'Review docs after moving, renaming, or retitling documentation files before claiming navigation links still resolve.',
+                ],
+                phases: ['after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['path', 'max_files', 'max_file_bytes'],
+                outputs: ['human_summary', 'json_report', 'link_integrity', 'missing_link_findings'],
+                relatedSkills: [
+                    'cli-output-contract-review',
+                    'docs-prose-review',
+                    'docs-update',
+                    'public-json-contract-change',
+                    'readme-authoring',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'link-integrity-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/docs-link-integrity.js')).runDocsLinkIntegrityScript,
+            },
+        ],
+    },
+    {
+        id: 'test',
+        summaryKey: 'scriptPack.pack.test.summary',
+        scripts: [
+            {
+                packId: 'test',
+                id: 'performance-report',
+                ref: scriptRef('test', 'performance-report'),
+                usage: 'mf script-pack run test/performance-report summarize [options]',
+                summaryKey: 'scriptPack.script.testPerformanceReport.summary',
+                actions: ['summarize'],
+                useWhen: [
+                    'Summarize retained mf run performance evidence, selected-test fallbacks, slow intents, timeout pressure, and phase bottlenecks.',
+                    'Review local verification-loop performance before changing test scheduling, profiling, caching, or command-contract timeout policy.',
+                ],
+                phases: ['after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['max_samples', 'max_intents', 'max_test_files', 'max_findings', 'slow_ms', 'timeout_ratio', 'phase_ms'],
+                outputs: ['human_summary', 'json_report', 'performance_samples', 'intent_timings', 'phase_timings', 'test_file_timings'],
+                relatedSkills: ['test-suite-performance-review', 'test-maintenance', 'completion-evidence-gate'],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'test-performance-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/test-performance-report.js')).runTestPerformanceReportScript,
+            },
+            {
+                packId: 'test',
+                id: 'regression-selector',
+                ref: scriptRef('test', 'regression-selector'),
+                usage: 'mf script-pack run test/regression-selector select [path...] [options]',
+                summaryKey: 'scriptPack.script.testRegressionSelector.summary',
+                actions: ['select'],
+                useWhen: [
+                    'Select likely regression tests from changed files while reporting unsafe surfaces that require fallback verification.',
+                    'Review source, test, package, schema, workflow, and config changes before relying on a related-test shortcut.',
+                ],
+                phases: ['after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['path', 'base_ref', 'head_ref', 'max_files', 'max_tests'],
+                outputs: ['human_summary', 'json_report', 'changed_files', 'selected_tests', 'fallbacks'],
+                relatedSkills: ['test-suite-performance-review', 'test-maintenance', 'change-blast-radius-review'],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'test-regression-selector-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/test-regression-selector.js')).runTestRegressionSelectorScript,
+            },
         ],
     },
     {
@@ -229,6 +397,62 @@ export const SCRIPT_PACKS = [
                 reportSchemaFile: 'config-chain-report.schema.json',
                 loadRunner: async () => (await import('../script-packs/repo-config-chain.js')).runRepoConfigChainScript,
             },
+            {
+                packId: 'repo',
+                id: 'env-contract',
+                ref: scriptRef('repo', 'env-contract'),
+                usage: 'mf script-pack run repo/env-contract scan [path...] [options]',
+                summaryKey: 'scriptPack.script.envContract.summary',
+                actions: ['scan'],
+                useWhen: [
+                    'Scan code, CI, docs, and env example files for environment variable contract drift without reading real secret env files.',
+                    'Review env keys that are used in code, declared in examples, referenced in CI, documented, missing from examples, or public-prefix secret-like names.',
+                ],
+                phases: ['before_change', 'during_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['path', 'max_files', 'max_file_bytes', 'max_keys'],
+                outputs: ['human_summary', 'json_report', 'env_keys', 'env_contract_findings'],
+                relatedSkills: [
+                    'config-env-change',
+                    'public-json-contract-change',
+                    'security-privacy-review',
+                    'typescript-code-change',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'env-contract-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-env-contract.js')).runRepoEnvContractScript,
+            },
+            {
+                packId: 'repo',
+                id: 'secret-risk-scan',
+                ref: scriptRef('repo', 'secret-risk-scan'),
+                usage: 'mf script-pack run repo/secret-risk-scan scan [path...] [options]',
+                summaryKey: 'scriptPack.script.secretRiskScan.summary',
+                actions: ['scan'],
+                useWhen: [
+                    'Scan code, docs, config, CI, and examples for plausible hardcoded secrets without printing secret values.',
+                    'Review provider token prefixes, Bearer tokens, private key markers, secret-like assignments, and realistic env-example values.',
+                ],
+                phases: ['before_change', 'during_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['path', 'max_files', 'max_file_bytes', 'max_findings'],
+                outputs: ['human_summary', 'json_report', 'secret_risk_findings', 'redacted_fingerprints'],
+                relatedSkills: [
+                    'config-env-change',
+                    'public-json-contract-change',
+                    'security-privacy-review',
+                    'typescript-code-change',
+                ],
+                riskLevel: 'medium',
+                cost: 'low',
+                reportSchemaFile: 'secret-risk-scan-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-secret-risk-scan.js')).runRepoSecretRiskScanScript,
+            },
             {
                 packId: 'repo',
                 id: 'generated-boundary',
@@ -258,6 +482,179 @@ export const SCRIPT_PACKS = [
                 reportSchemaFile: 'generated-boundary-report.schema.json',
                 loadRunner: async () => (await import('../script-packs/repo-generated-boundary.js')).runRepoGeneratedBoundaryScript,
             },
+            {
+                packId: 'repo',
+                id: 'merge-conflict-scan',
+                ref: scriptRef('repo', 'merge-conflict-scan'),
+                usage: 'mf script-pack run repo/merge-conflict-scan check [path...] [options]',
+                summaryKey: 'scriptPack.script.mergeConflictScan.summary',
+                actions: ['check'],
+                useWhen: [
+                    'Scan changed files or explicit paths for Git merge conflict markers without printing surrounding file content.',
+                    'Review dirty worktrees before final verification, packaging, commit preparation, or handoff to avoid shipping unresolved conflict markers.',
+                ],
+                phases: ['after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['path', 'max_files', 'max_file_bytes'],
+                outputs: ['human_summary', 'json_report', 'merge_conflict_markers', 'marker_findings'],
+                relatedSkills: [
+                    'cli-output-contract-review',
+                    'completion-evidence-gate',
+                    'public-json-contract-change',
+                    'test-maintenance',
+                    'typescript-code-change',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'repo-merge-conflict-scan-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-merge-conflict-scan.js')).runRepoMergeConflictScanScript,
+            },
+            {
+                packId: 'repo',
+                id: 'git-ignore-audit',
+                ref: scriptRef('repo', 'git-ignore-audit'),
+                usage: 'mf script-pack run repo/git-ignore-audit audit [path...] [options]',
+                summaryKey: 'scriptPack.script.gitIgnoreAudit.summary',
+                actions: ['audit'],
+                useWhen: [
+                    'Inspect explicit paths or changed files against .gitignore, .git/info/exclude, core.excludesFile, and config visibility evidence.',
+                    'Review ignored, untracked, missing, and tracked-but-ignored paths before assuming Git visibility, package contents, or generated output coverage.',
+                ],
+                phases: ['before_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['path', 'max_paths'],
+                outputs: ['human_summary', 'json_report', 'ignore_sources', 'ignored_path_evidence'],
+                relatedSkills: [
+                    'cli-output-contract-review',
+                    'completion-evidence-gate',
+                    'file-path-cross-platform-change',
+                    'public-json-contract-change',
+                    'test-maintenance',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'repo-git-ignore-audit-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-git-ignore-audit.js')).runRepoGitIgnoreAuditScript,
+            },
+            {
+                packId: 'repo',
+                id: 'manifest-lock-drift',
+                ref: scriptRef('repo', 'manifest-lock-drift'),
+                usage: 'mf script-pack run repo/manifest-lock-drift check [path...] [options]',
+                summaryKey: 'scriptPack.script.manifestLockDrift.summary',
+                actions: ['check'],
+                useWhen: [
+                    'Compare .mustflow/config/manifest.lock.toml entries with the current repository files without rewriting the lock.',
+                    'Review missing, unsafe, unreadable, invalid-hash, and content-hash mismatch evidence before trusting template update or install state.',
+                ],
+                phases: ['before_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['path', 'max_entries'],
+                outputs: ['human_summary', 'json_report', 'manifest_lock_entries', 'hash_mismatch_findings'],
+                relatedSkills: [
+                    'cli-output-contract-review',
+                    'completion-evidence-gate',
+                    'contract-sync-check',
+                    'file-path-cross-platform-change',
+                    'public-json-contract-change',
+                    'template-install-surface-sync',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'repo-manifest-lock-drift-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-manifest-lock-drift.js')).runRepoManifestLockDriftScript,
+            },
+            {
+                packId: 'repo',
+                id: 'skill-route-audit',
+                ref: scriptRef('repo', 'skill-route-audit'),
+                usage: 'mf script-pack run repo/skill-route-audit audit [options]',
+                summaryKey: 'scriptPack.script.skillRouteAudit.summary',
+                actions: ['audit'],
+                useWhen: [
+                    'Audit source skill files, route metadata, skill index entries, default template skill copies, manifest profiles, and i18n metadata for drift.',
+                    'Review mustflow skill-route surfaces after adding, refreshing, or synchronizing skills before relying on installed template coverage.',
+                ],
+                phases: ['before_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: [],
+                outputs: ['human_summary', 'json_report', 'skill_route_findings', 'template_drift', 'manifest_drift', 'i18n_drift'],
+                relatedSkills: [
+                    'contract-sync-check',
+                    'public-json-contract-change',
+                    'skill-authoring',
+                    'skill-refresh',
+                    'template-install-surface-sync',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'skill-route-audit-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-skill-route-audit.js')).runRepoSkillRouteAuditScript,
+            },
+            {
+                packId: 'repo',
+                id: 'version-source',
+                ref: scriptRef('repo', 'version-source'),
+                usage: 'mf script-pack run repo/version-source inspect [options]',
+                summaryKey: 'scriptPack.script.versionSource.summary',
+                actions: ['inspect'],
+                useWhen: [
+                    'Inspect detected version source files before editing package, template, release, or versioning metadata.',
+                    'Review whether enabled release versioning preferences have at least one detected version source.',
+                ],
+                phases: ['before_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: [],
+                outputs: ['human_summary', 'json_report', 'version_sources', 'versioning_findings'],
+                relatedSkills: [
+                    'completion-evidence-gate',
+                    'public-json-contract-change',
+                    'release-publish-change',
+                    'version-freshness-check',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'repo-version-source-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-version-source.js')).runRepoVersionSourceScript,
+            },
+            {
+                packId: 'repo',
+                id: 'approval-gate',
+                ref: scriptRef('repo', 'approval-gate'),
+                usage: 'mf script-pack run repo/approval-gate check --action <type> [options]',
+                summaryKey: 'scriptPack.script.approvalGate.summary',
+                actions: ['check'],
+                useWhen: [
+                    'Check planned action types against .mustflow/config/mustflow.toml [approval].required_for before proceeding.',
+                    'Review whether git, dependency, network, database, destructive, secret, release, or cross-repository actions require human approval.',
+                ],
+                phases: ['before_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['action_type'],
+                outputs: ['human_summary', 'json_report', 'approval_decisions', 'approval_findings'],
+                relatedSkills: [
+                    'command-contract-authoring',
+                    'completion-evidence-gate',
+                    'public-json-contract-change',
+                    'release-publish-change',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'repo-approval-gate-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-approval-gate.js')).runRepoApprovalGateScript,
+            },
             {
                 packId: 'repo',
                 id: 'related-files',

package/dist/cli/lib/validation/index.js

@@ -11,7 +11,7 @@ import { validateSourceAnchorsInProject } from '../../../core/source-anchor-vali
 import { listFilesRecursive, toPosixPath } from '../filesystem.js';
 import { readGitChangedFiles } from '../git-changes.js';
 import { inspectManifestLock } from '../manifest-lock.js';
-import { generateRepoMap } from '../repo-map.js';
+import { getExpectedRepoMapSourceFingerprint } from '../repo-map.js';
 import { parseTomlText, readMustflowTomlFile } from '../toml.js';
 import { MUSTFLOW_JSON_MAX_BYTES } from '../mustflow-read.js';
 import { getContractModelDefinitions, validateCandidateContractModelConfig, } from '../../../core/contract-models.js';
@@ -1464,7 +1464,7 @@ function validateStrictRepoMap(projectRoot, issues) {
     }
     else {
         const currentSourceFingerprint = frontmatter.source_fingerprint;
-        const expectedSourceFingerprint = parseSimpleFrontmatter(generateRepoMap(projectRoot)).source_fingerprint;
+        const expectedSourceFingerprint = getExpectedRepoMapSourceFingerprint(projectRoot);
         if (expectedSourceFingerprint && currentSourceFingerprint !== expectedSourceFingerprint) {
             pushStrictIssue(issues, 'REPO_MAP.md source_fingerprint is stale; regenerate with mf map --write');
         }

package/dist/cli/lib/validation/primitives.js

@@ -2,6 +2,7 @@ import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { isRecord } from '../command-contract.js';
 import { readMustflowTomlFile } from '../toml.js';
+import { COMMANDS_CONFIG_RELATIVE_PATH, readResolvedCommandContractToml, } from '../../../core/config-loading.js';
 import { REQUIRED_FILES, } from './constants.js';
 import { TECHNOLOGY_CONFIG_RELATIVE_PATH } from '../../../core/technology-preferences.js';
 import { VERSIONING_CONFIG_PATH } from '../../../core/version-sources.js';
@@ -43,7 +44,9 @@ export function validateToml(projectRoot, issues) {
             continue;
         }
         try {
-            const parsed = readMustflowTomlFile(projectRoot, relativePath);
+            const parsed = relativePath === COMMANDS_CONFIG_RELATIVE_PATH
+                ? readResolvedCommandContractToml(projectRoot)
+                : readMustflowTomlFile(projectRoot, relativePath);
             if (!isRecord(parsed)) {
                 issues.push({ message: `${relativePath} must contain a TOML table` });
                 continue;

package/dist/cli/script-packs/code-change-impact.js

@@ -0,0 +1,178 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, getParsedCliStringOption, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { CHANGE_IMPACT_SCRIPT_REF, inspectChangeImpact } from '../../core/change-impact.js';
+const CHANGE_IMPACT_OPTIONS = [
+    { name: '--json', kind: 'boolean' },
+    { name: '--base', kind: 'string' },
+    { name: '--head', kind: 'string' },
+    { name: '--max-files', kind: 'string' },
+    { name: '--max-impacts', kind: 'string' },
+    { name: '--max-file-bytes', kind: 'string' },
+];
+function parsePositiveInteger(value, option, lang) {
+    if (value === null) {
+        return { value: null };
+    }
+    if (!/^[1-9]\d*$/u.test(value)) {
+        return { value: null, error: t(lang, 'changeImpact.error.invalidPositiveInteger', { option, value }) };
+    }
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed)) {
+        return { value: null, error: t(lang, 'changeImpact.error.invalidPositiveInteger', { option, value }) };
+    }
+    return { value: parsed };
+}
+export function getCodeChangeImpactHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run code/change-impact analyze [path...] [options]',
+        summary: t(lang, 'changeImpact.help.summary'),
+        options: [
+            { label: '--base <ref>', description: t(lang, 'changeImpact.help.option.base') },
+            { label: '--head <ref>', description: t(lang, 'changeImpact.help.option.head') },
+            { label: '--max-files <count>', description: t(lang, 'changeImpact.help.option.maxFiles') },
+            { label: '--max-impacts <count>', description: t(lang, 'changeImpact.help.option.maxImpacts') },
+            { label: '--max-file-bytes <bytes>', description: t(lang, 'changeImpact.help.option.maxFileBytes') },
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run code/change-impact analyze --base HEAD --json',
+            'mf script-pack run code/change-impact analyze src --base main --head HEAD --json',
+            'mf script-pack run code/change-impact analyze src/core --max-impacts 80 --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'changeImpact.help.exit.ok') },
+            { label: '1', description: t(lang, 'changeImpact.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseChangeImpactOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, CHANGE_IMPACT_OPTIONS, { allowPositionals: true });
+    const json = hasParsedCliOption(parsed, '--json');
+    const baseRef = getParsedCliStringOption(parsed, '--base');
+    const headRef = getParsedCliStringOption(parsed, '--head');
+    const maxFiles = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-files'), '--max-files', lang);
+    const maxImpacts = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-impacts'), '--max-impacts', lang);
+    const maxFileBytes = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-file-bytes'), '--max-file-bytes', lang);
+    const positiveOptions = [maxFiles, maxImpacts, maxFileBytes];
+    if (action !== 'analyze') {
+        return {
+            action: 'analyze',
+            json,
+            baseRef,
+            headRef,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxImpacts: maxImpacts.value,
+            maxFileBytes: maxFileBytes.value,
+            error: action ? t(lang, 'changeImpact.error.unknownAction', { action }) : t(lang, 'changeImpact.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return {
+            action,
+            json,
+            baseRef,
+            headRef,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxImpacts: maxImpacts.value,
+            maxFileBytes: maxFileBytes.value,
+            error: formatCliOptionParseError(parsed.error, lang),
+        };
+    }
+    for (const candidate of positiveOptions) {
+        if (candidate.error) {
+            return {
+                action,
+                json,
+                baseRef,
+                headRef,
+                paths: parsed.positionals,
+                maxFiles: maxFiles.value,
+                maxImpacts: maxImpacts.value,
+                maxFileBytes: maxFileBytes.value,
+                error: candidate.error,
+            };
+        }
+    }
+    return {
+        action,
+        json,
+        baseRef,
+        headRef,
+        paths: parsed.positionals,
+        maxFiles: maxFiles.value,
+        maxImpacts: maxImpacts.value,
+        maxFileBytes: maxFileBytes.value,
+    };
+}
+function renderChangeImpactSummary(report, lang) {
+    const lines = [
+        t(lang, 'changeImpact.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${CHANGE_IMPACT_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'changeImpact.label.changedFiles')}: ${report.changed_files.length}`,
+        `${t(lang, 'changeImpact.label.impacts')}: ${report.impacts.length}`,
+        `${t(lang, 'changeImpact.label.truncated')}: ${report.truncated ? t(lang, 'value.yes') : t(lang, 'value.no')}`,
+    ];
+    for (const impact of report.impacts.slice(0, 40)) {
+        lines.push(`- ${impact.path}: ${impact.relationship} (${impact.reason})`);
+    }
+    if (report.script_hints.length > 0) {
+        lines.push(t(lang, 'changeImpact.label.scriptHints'));
+        for (const hint of report.script_hints) {
+            lines.push(`- ${hint.script_ref}: ${hint.command}`);
+            if (hint.related_intents && hint.related_intents.length > 0) {
+                lines.push(`  related intents: ${hint.related_intents.join(', ')}`);
+            }
+            if (hint.expected_fallback_reasons && hint.expected_fallback_reasons.length > 0) {
+                lines.push(`  expected fallback reasons: ${hint.expected_fallback_reasons.join(', ')}`);
+            }
+        }
+    }
+    if (report.verification_hints.length > 0) {
+        lines.push(t(lang, 'changeImpact.label.verificationHints'));
+        for (const hint of report.verification_hints) {
+            lines.push(`- ${hint.intent}: ${hint.reason}`);
+        }
+    }
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'changeImpact.label.findings'), ...report.findings.map((finding) => `- ${finding.path}: ${finding.code} (${finding.message})`));
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'changeImpact.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    if (report.changed_files.length === 0 && report.findings.length === 0 && report.issues.length === 0) {
+        lines.push(t(lang, 'changeImpact.clean'));
+    }
+    return lines.join('\n');
+}
+export function runCodeChangeImpactScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getCodeChangeImpactHelp(lang));
+        return 0;
+    }
+    const options = parseChangeImpactOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run code/change-impact --help', getCodeChangeImpactHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectChangeImpact(resolveMustflowRoot(), {
+        baseRef: options.baseRef ?? undefined,
+        headRef: options.headRef,
+        paths: options.paths,
+        maxFiles: options.maxFiles ?? undefined,
+        maxImpacts: options.maxImpacts ?? undefined,
+        maxFileBytes: options.maxFileBytes ?? undefined,
+    });
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderChangeImpactSummary(report, lang));
+    return report.ok ? 0 : 1;
+}