mustflow 2.84.0 → 2.99.0

package/dist/cli/script-packs/repo-env-contract.js

@@ -0,0 +1,156 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, getParsedCliStringOption, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { ENV_CONTRACT_SCRIPT_REF, inspectEnvContract } from '../../core/env-contract.js';
+const ENV_CONTRACT_OPTIONS = [
+    { name: '--json', kind: 'boolean' },
+    { name: '--max-files', kind: 'string' },
+    { name: '--max-file-bytes', kind: 'string' },
+    { name: '--max-keys', kind: 'string' },
+];
+function parsePositiveInteger(value, option, lang) {
+    if (value === null) {
+        return { value: null };
+    }
+    if (!/^[1-9]\d*$/u.test(value)) {
+        return { value: null, error: t(lang, 'envContract.error.invalidPositiveInteger', { option, value }) };
+    }
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed)) {
+        return { value: null, error: t(lang, 'envContract.error.invalidPositiveInteger', { option, value }) };
+    }
+    return { value: parsed };
+}
+export function getRepoEnvContractHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run repo/env-contract scan [path...] [options]',
+        summary: t(lang, 'envContract.help.summary'),
+        options: [
+            { label: '--max-files <count>', description: t(lang, 'envContract.help.option.maxFiles') },
+            { label: '--max-file-bytes <bytes>', description: t(lang, 'envContract.help.option.maxFileBytes') },
+            { label: '--max-keys <count>', description: t(lang, 'envContract.help.option.maxKeys') },
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run repo/env-contract scan --json',
+            'mf script-pack run repo/env-contract scan src .env.example --json',
+            'mf script-pack run repo/env-contract scan .github/workflows README.md --max-keys 120 --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'envContract.help.exit.ok') },
+            { label: '1', description: t(lang, 'envContract.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseEnvContractOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, ENV_CONTRACT_OPTIONS, { allowPositionals: true });
+    const json = hasParsedCliOption(parsed, '--json');
+    const maxFiles = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-files'), '--max-files', lang);
+    const maxFileBytes = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-file-bytes'), '--max-file-bytes', lang);
+    const maxKeys = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-keys'), '--max-keys', lang);
+    if (action !== 'scan') {
+        return {
+            action: 'scan',
+            json,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxFileBytes: maxFileBytes.value,
+            maxKeys: maxKeys.value,
+            error: action ? t(lang, 'envContract.error.unknownAction', { action }) : t(lang, 'envContract.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return {
+            action,
+            json,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxFileBytes: maxFileBytes.value,
+            maxKeys: maxKeys.value,
+            error: formatCliOptionParseError(parsed.error, lang),
+        };
+    }
+    for (const candidate of [maxFiles, maxFileBytes, maxKeys]) {
+        if (candidate.error) {
+            return {
+                action,
+                json,
+                paths: parsed.positionals,
+                maxFiles: maxFiles.value,
+                maxFileBytes: maxFileBytes.value,
+                maxKeys: maxKeys.value,
+                error: candidate.error,
+            };
+        }
+    }
+    return {
+        action,
+        json,
+        paths: parsed.positionals,
+        maxFiles: maxFiles.value,
+        maxFileBytes: maxFileBytes.value,
+        maxKeys: maxKeys.value,
+    };
+}
+function renderEnvContractSummary(report, lang) {
+    const lines = [
+        t(lang, 'envContract.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${ENV_CONTRACT_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'envContract.label.files')}: ${report.summary.file_count}`,
+        `${t(lang, 'envContract.label.keys')}: ${report.summary.key_count}`,
+        `${t(lang, 'envContract.label.findings')}: ${report.findings.length}`,
+        `${t(lang, 'envContract.label.truncated')}: ${report.truncated ? t(lang, 'value.yes') : t(lang, 'value.no')}`,
+    ];
+    for (const entry of report.keys.slice(0, 40)) {
+        const flags = [
+            entry.used_in_code ? 'code' : null,
+            entry.declared_in_example ? 'example' : null,
+            entry.documented ? 'docs' : null,
+            entry.referenced_in_ci ? 'ci' : null,
+            entry.secret_like ? 'secret-like' : null,
+            entry.public_like ? 'public-like' : null,
+        ].filter((flag) => flag !== null);
+        lines.push(`- ${entry.key}: ${flags.join(', ') || t(lang, 'value.none')} (${entry.source_count})`);
+    }
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'envContract.label.findings'));
+        for (const finding of report.findings.slice(0, 40)) {
+            const key = finding.key ? ` ${finding.key}` : '';
+            lines.push(`- ${finding.path}:${key} ${finding.code} (${finding.message})`);
+        }
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'envContract.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    if (report.keys.length === 0 && report.findings.length === 0 && report.issues.length === 0) {
+        lines.push(t(lang, 'envContract.clean'));
+    }
+    return lines.join('\n');
+}
+export function runRepoEnvContractScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getRepoEnvContractHelp(lang));
+        return 0;
+    }
+    const options = parseEnvContractOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run repo/env-contract --help', getRepoEnvContractHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectEnvContract(resolveMustflowRoot(), {
+        paths: options.paths,
+        maxFiles: options.maxFiles ?? undefined,
+        maxFileBytes: options.maxFileBytes ?? undefined,
+        maxKeys: options.maxKeys ?? undefined,
+    });
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderEnvContractSummary(report, lang));
+    return report.ok ? 0 : 1;
+}

package/dist/cli/script-packs/repo-git-ignore-audit.js

@@ -0,0 +1,119 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, getParsedCliStringOption, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { auditRepoGitIgnore, REPO_GIT_IGNORE_AUDIT_SCRIPT_REF, } from '../../core/repo-git-ignore-audit.js';
+const REPO_GIT_IGNORE_AUDIT_OPTIONS = [
+    { name: '--json', kind: 'boolean' },
+    { name: '--max-paths', kind: 'string' },
+];
+export function getRepoGitIgnoreAuditHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run repo/git-ignore-audit audit [path...] [options]',
+        summary: t(lang, 'gitIgnoreAudit.help.summary'),
+        options: [
+            { label: '--max-paths <n>', description: t(lang, 'gitIgnoreAudit.help.option.maxPaths') },
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run repo/git-ignore-audit audit --json',
+            'mf script-pack run repo/git-ignore-audit audit .env.local dist/app.js --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'gitIgnoreAudit.help.exit.ok') },
+            { label: '1', description: t(lang, 'gitIgnoreAudit.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parsePositiveInteger(value, label, lang) {
+    if (value === undefined) {
+        return undefined;
+    }
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+        return t(lang, 'gitIgnoreAudit.error.invalidPositiveInteger', { option: label });
+    }
+    return parsed;
+}
+function parseRepoGitIgnoreAuditOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, REPO_GIT_IGNORE_AUDIT_OPTIONS, { allowPositionals: true });
+    const json = hasParsedCliOption(parsed, '--json');
+    if (action !== 'audit') {
+        return {
+            action: 'audit',
+            paths: parsed.positionals,
+            json,
+            error: action
+                ? t(lang, 'gitIgnoreAudit.error.unknownAction', { action })
+                : t(lang, 'gitIgnoreAudit.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return { action, paths: parsed.positionals, json, error: formatCliOptionParseError(parsed.error, lang) };
+    }
+    const maxPaths = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-paths') ?? undefined, '--max-paths', lang);
+    if (typeof maxPaths === 'string') {
+        return { action, paths: parsed.positionals, json, error: maxPaths };
+    }
+    return {
+        action,
+        paths: parsed.positionals,
+        json,
+        maxPaths,
+    };
+}
+function renderRepoGitIgnoreAuditSummary(report, lang) {
+    const lines = [
+        t(lang, 'gitIgnoreAudit.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${REPO_GIT_IGNORE_AUDIT_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'gitIgnoreAudit.label.pathsChecked')}: ${report.summary.paths_checked}`,
+        `${t(lang, 'gitIgnoreAudit.label.ignoredPaths')}: ${report.summary.ignored_paths}`,
+        `${t(lang, 'gitIgnoreAudit.label.ignoreSources')}: ${report.summary.ignore_sources}`,
+    ];
+    if (report.paths.length > 0) {
+        lines.push(t(lang, 'gitIgnoreAudit.label.paths'));
+        for (const entry of report.paths) {
+            const evidence = entry.source_path && entry.source_line
+                ? ` (${entry.source_path}:${entry.source_line} ${entry.pattern ?? ''})`
+                : '';
+            lines.push(`- ${entry.path}: ${entry.status}${evidence}`);
+        }
+    }
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'gitIgnoreAudit.label.findings'));
+        for (const finding of report.findings) {
+            lines.push(`- ${finding.path}: ${finding.code} (${finding.message})`);
+        }
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'gitIgnoreAudit.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    if (report.paths.length === 0 && report.findings.length === 0 && report.issues.length === 0) {
+        lines.push(t(lang, 'gitIgnoreAudit.clean'));
+    }
+    return lines.join('\n');
+}
+export function runRepoGitIgnoreAuditScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getRepoGitIgnoreAuditHelp(lang));
+        return 0;
+    }
+    const options = parseRepoGitIgnoreAuditOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run repo/git-ignore-audit --help', getRepoGitIgnoreAuditHelp(lang), lang);
+        return 1;
+    }
+    const report = auditRepoGitIgnore(resolveMustflowRoot(), {
+        paths: options.paths,
+        maxPaths: options.maxPaths,
+    });
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderRepoGitIgnoreAuditSummary(report, lang));
+    return report.ok ? 0 : 1;
+}

package/dist/cli/script-packs/repo-manifest-lock-drift.js

@@ -0,0 +1,122 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, getParsedCliStringOption, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { checkRepoManifestLockDrift, REPO_MANIFEST_LOCK_DRIFT_SCRIPT_REF, } from '../../core/repo-manifest-lock-drift.js';
+const REPO_MANIFEST_LOCK_DRIFT_OPTIONS = [
+    { name: '--json', kind: 'boolean' },
+    { name: '--max-entries', kind: 'string' },
+];
+export function getRepoManifestLockDriftHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run repo/manifest-lock-drift check [path...] [options]',
+        summary: t(lang, 'manifestLockDrift.help.summary'),
+        options: [
+            { label: '--max-entries <n>', description: t(lang, 'manifestLockDrift.help.option.maxEntries') },
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run repo/manifest-lock-drift check --json',
+            'mf script-pack run repo/manifest-lock-drift check AGENTS.md .mustflow/config/commands.toml --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'manifestLockDrift.help.exit.ok') },
+            { label: '1', description: t(lang, 'manifestLockDrift.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parsePositiveInteger(value, label, lang) {
+    if (value === undefined) {
+        return undefined;
+    }
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+        return t(lang, 'manifestLockDrift.error.invalidPositiveInteger', { option: label });
+    }
+    return parsed;
+}
+function parseRepoManifestLockDriftOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, REPO_MANIFEST_LOCK_DRIFT_OPTIONS, { allowPositionals: true });
+    const json = hasParsedCliOption(parsed, '--json');
+    if (action !== 'check') {
+        return {
+            action: 'check',
+            paths: parsed.positionals,
+            json,
+            error: action
+                ? t(lang, 'manifestLockDrift.error.unknownAction', { action })
+                : t(lang, 'manifestLockDrift.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return { action, paths: parsed.positionals, json, error: formatCliOptionParseError(parsed.error, lang) };
+    }
+    const maxEntries = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-entries') ?? undefined, '--max-entries', lang);
+    if (typeof maxEntries === 'string') {
+        return { action, paths: parsed.positionals, json, error: maxEntries };
+    }
+    return {
+        action,
+        paths: parsed.positionals,
+        json,
+        maxEntries,
+    };
+}
+function renderRepoManifestLockDriftSummary(report, lang) {
+    const lines = [
+        t(lang, 'manifestLockDrift.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${REPO_MANIFEST_LOCK_DRIFT_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'manifestLockDrift.label.entriesChecked')}: ${report.summary.entries_checked}`,
+        `${t(lang, 'manifestLockDrift.label.hashMismatches')}: ${report.summary.hash_mismatches}`,
+        `${t(lang, 'manifestLockDrift.label.missingEntries')}: ${report.summary.missing_entries}`,
+    ];
+    if (report.entries.length > 0) {
+        lines.push(t(lang, 'manifestLockDrift.label.entries'));
+        for (const entry of report.entries) {
+            if (entry.status === 'skipped') {
+                continue;
+            }
+            const evidence = entry.lock_hash && entry.actual_hash && entry.lock_hash !== entry.actual_hash
+                ? ` (${entry.lock_hash} != ${entry.actual_hash})`
+                : '';
+            lines.push(`- ${entry.path}: ${entry.status}${evidence}`);
+        }
+    }
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'manifestLockDrift.label.findings'));
+        for (const finding of report.findings) {
+            lines.push(`- ${finding.path}: ${finding.code} (${finding.message})`);
+        }
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'manifestLockDrift.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    if (report.findings.length === 0 && report.issues.length === 0) {
+        lines.push(t(lang, 'manifestLockDrift.clean'));
+    }
+    return lines.join('\n');
+}
+export function runRepoManifestLockDriftScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getRepoManifestLockDriftHelp(lang));
+        return 0;
+    }
+    const options = parseRepoManifestLockDriftOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run repo/manifest-lock-drift --help', getRepoManifestLockDriftHelp(lang), lang);
+        return 1;
+    }
+    const report = checkRepoManifestLockDrift(resolveMustflowRoot(), {
+        paths: options.paths,
+        maxEntries: options.maxEntries,
+    });
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderRepoManifestLockDriftSummary(report, lang));
+    return report.ok ? 0 : 1;
+}

package/dist/cli/script-packs/repo-merge-conflict-scan.js

@@ -0,0 +1,123 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, getParsedCliStringOption, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { checkRepoMergeConflictScan, REPO_MERGE_CONFLICT_SCAN_SCRIPT_REF, } from '../../core/repo-merge-conflict-scan.js';
+const REPO_MERGE_CONFLICT_SCAN_OPTIONS = [
+    { name: '--json', kind: 'boolean' },
+    { name: '--max-files', kind: 'string' },
+    { name: '--max-file-bytes', kind: 'string' },
+];
+export function getRepoMergeConflictScanHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run repo/merge-conflict-scan check [path...] [options]',
+        summary: t(lang, 'mergeConflictScan.help.summary'),
+        options: [
+            { label: '--max-files <n>', description: t(lang, 'mergeConflictScan.help.option.maxFiles') },
+            { label: '--max-file-bytes <n>', description: t(lang, 'mergeConflictScan.help.option.maxFileBytes') },
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run repo/merge-conflict-scan check --json',
+            'mf script-pack run repo/merge-conflict-scan check src README.md --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'mergeConflictScan.help.exit.ok') },
+            { label: '1', description: t(lang, 'mergeConflictScan.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parsePositiveInteger(value, label, lang) {
+    if (value === undefined) {
+        return undefined;
+    }
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+        return t(lang, 'mergeConflictScan.error.invalidPositiveInteger', { option: label });
+    }
+    return parsed;
+}
+function parseRepoMergeConflictScanOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, REPO_MERGE_CONFLICT_SCAN_OPTIONS, { allowPositionals: true });
+    const json = hasParsedCliOption(parsed, '--json');
+    if (action !== 'check') {
+        return {
+            action: 'check',
+            paths: parsed.positionals,
+            json,
+            error: action
+                ? t(lang, 'mergeConflictScan.error.unknownAction', { action })
+                : t(lang, 'mergeConflictScan.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return { action, paths: parsed.positionals, json, error: formatCliOptionParseError(parsed.error, lang) };
+    }
+    const maxFiles = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-files') ?? undefined, '--max-files', lang);
+    if (typeof maxFiles === 'string') {
+        return { action, paths: parsed.positionals, json, error: maxFiles };
+    }
+    const maxFileBytes = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-file-bytes') ?? undefined, '--max-file-bytes', lang);
+    if (typeof maxFileBytes === 'string') {
+        return { action, paths: parsed.positionals, json, error: maxFileBytes };
+    }
+    return {
+        action,
+        paths: parsed.positionals,
+        json,
+        maxFiles,
+        maxFileBytes,
+    };
+}
+function renderRepoMergeConflictScanSummary(report, lang) {
+    const lines = [
+        t(lang, 'mergeConflictScan.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${REPO_MERGE_CONFLICT_SCAN_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'mergeConflictScan.label.filesChecked')}: ${report.summary.files_checked}`,
+        `${t(lang, 'mergeConflictScan.label.markersFound')}: ${report.summary.markers_found}`,
+    ];
+    if (report.markers.length > 0) {
+        lines.push(t(lang, 'mergeConflictScan.label.markers'));
+        for (const marker of report.markers) {
+            lines.push(`- ${marker.path}:${marker.line}:${marker.column} ${marker.marker}`);
+        }
+    }
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'mergeConflictScan.label.findings'));
+        for (const finding of report.findings) {
+            lines.push(`- ${finding.path}: ${finding.code} (${finding.message})`);
+        }
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'mergeConflictScan.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    if (report.markers.length === 0 && report.issues.length === 0) {
+        lines.push(t(lang, 'mergeConflictScan.clean'));
+    }
+    return lines.join('\n');
+}
+export function runRepoMergeConflictScanScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getRepoMergeConflictScanHelp(lang));
+        return 0;
+    }
+    const options = parseRepoMergeConflictScanOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run repo/merge-conflict-scan --help', getRepoMergeConflictScanHelp(lang), lang);
+        return 1;
+    }
+    const report = checkRepoMergeConflictScan(resolveMustflowRoot(), {
+        paths: options.paths,
+        maxFiles: options.maxFiles,
+        maxFileBytes: options.maxFileBytes,
+    });
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderRepoMergeConflictScanSummary(report, lang));
+    return report.ok ? 0 : 1;
+}

package/dist/cli/script-packs/repo-secret-risk-scan.js

@@ -0,0 +1,147 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, getParsedCliStringOption, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { inspectSecretRiskScan, SECRET_RISK_SCAN_SCRIPT_REF } from '../../core/secret-risk-scan.js';
+const SECRET_RISK_SCAN_OPTIONS = [
+    { name: '--json', kind: 'boolean' },
+    { name: '--max-files', kind: 'string' },
+    { name: '--max-file-bytes', kind: 'string' },
+    { name: '--max-findings', kind: 'string' },
+];
+function parsePositiveInteger(value, option, lang) {
+    if (value === null) {
+        return { value: null };
+    }
+    if (!/^[1-9]\d*$/u.test(value)) {
+        return { value: null, error: t(lang, 'secretRiskScan.error.invalidPositiveInteger', { option, value }) };
+    }
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed)) {
+        return { value: null, error: t(lang, 'secretRiskScan.error.invalidPositiveInteger', { option, value }) };
+    }
+    return { value: parsed };
+}
+export function getRepoSecretRiskScanHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run repo/secret-risk-scan scan [path...] [options]',
+        summary: t(lang, 'secretRiskScan.help.summary'),
+        options: [
+            { label: '--max-files <count>', description: t(lang, 'secretRiskScan.help.option.maxFiles') },
+            { label: '--max-file-bytes <bytes>', description: t(lang, 'secretRiskScan.help.option.maxFileBytes') },
+            { label: '--max-findings <count>', description: t(lang, 'secretRiskScan.help.option.maxFindings') },
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run repo/secret-risk-scan scan --json',
+            'mf script-pack run repo/secret-risk-scan scan src README.md --json',
+            'mf script-pack run repo/secret-risk-scan scan .env.example docs --max-findings 50 --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'secretRiskScan.help.exit.ok') },
+            { label: '1', description: t(lang, 'secretRiskScan.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseSecretRiskScanOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, SECRET_RISK_SCAN_OPTIONS, { allowPositionals: true });
+    const json = hasParsedCliOption(parsed, '--json');
+    const maxFiles = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-files'), '--max-files', lang);
+    const maxFileBytes = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-file-bytes'), '--max-file-bytes', lang);
+    const maxFindings = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-findings'), '--max-findings', lang);
+    if (action !== 'scan') {
+        return {
+            action: 'scan',
+            json,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxFileBytes: maxFileBytes.value,
+            maxFindings: maxFindings.value,
+            error: action ? t(lang, 'secretRiskScan.error.unknownAction', { action }) : t(lang, 'secretRiskScan.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return {
+            action,
+            json,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxFileBytes: maxFileBytes.value,
+            maxFindings: maxFindings.value,
+            error: formatCliOptionParseError(parsed.error, lang),
+        };
+    }
+    for (const candidate of [maxFiles, maxFileBytes, maxFindings]) {
+        if (candidate.error) {
+            return {
+                action,
+                json,
+                paths: parsed.positionals,
+                maxFiles: maxFiles.value,
+                maxFileBytes: maxFileBytes.value,
+                maxFindings: maxFindings.value,
+                error: candidate.error,
+            };
+        }
+    }
+    return {
+        action,
+        json,
+        paths: parsed.positionals,
+        maxFiles: maxFiles.value,
+        maxFileBytes: maxFileBytes.value,
+        maxFindings: maxFindings.value,
+    };
+}
+function renderSecretRiskScanSummary(report, lang) {
+    const lines = [
+        t(lang, 'secretRiskScan.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${SECRET_RISK_SCAN_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'secretRiskScan.label.files')}: ${report.summary.file_count}`,
+        `${t(lang, 'secretRiskScan.label.findings')}: ${report.summary.finding_count}`,
+        `${t(lang, 'secretRiskScan.label.highOrCritical')}: ${report.summary.high_or_critical_count}`,
+        `${t(lang, 'secretRiskScan.label.skippedSecretFiles')}: ${report.summary.skipped_secret_file_count}`,
+        `${t(lang, 'secretRiskScan.label.truncated')}: ${report.truncated ? t(lang, 'value.yes') : t(lang, 'value.no')}`,
+    ];
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'secretRiskScan.label.findings'));
+        for (const finding of report.findings.slice(0, 40)) {
+            const line = finding.line ? `:${finding.line}` : '';
+            const detector = finding.detector ? ` ${finding.detector}` : '';
+            lines.push(`- ${finding.path}${line}: ${finding.code}${detector} (${finding.message})`);
+        }
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'secretRiskScan.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    if (report.findings.length === 0 && report.issues.length === 0) {
+        lines.push(t(lang, 'secretRiskScan.clean'));
+    }
+    return lines.join('\n');
+}
+export function runRepoSecretRiskScanScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getRepoSecretRiskScanHelp(lang));
+        return 0;
+    }
+    const options = parseSecretRiskScanOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run repo/secret-risk-scan --help', getRepoSecretRiskScanHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectSecretRiskScan(resolveMustflowRoot(), {
+        paths: options.paths,
+        maxFiles: options.maxFiles ?? undefined,
+        maxFileBytes: options.maxFileBytes ?? undefined,
+        maxFindings: options.maxFindings ?? undefined,
+    });
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderSecretRiskScanSummary(report, lang));
+    return report.ok ? 0 : 1;
+}