nexarch 0.13.7 → 0.14.0

package/dist/commands/init-agent.js

@@ -344,7 +344,8 @@ export function canonicalTargetKey(filePath) {
  * consent from the dry-run result before calling again with `dryRun: false`
  * to actually write — see the ADR-0112 note at the call site.
  */
-function injectAgentConfigs(registry, runtimeCodes, dryRun) {
+/** Exported for regression coverage of the empty-return bug documented at its tail. */
+export function injectAgentConfigs(registry, runtimeCodes, dryRun) {
     const templateByCode = new Map(registry.instructionTemplates.map((t) => [t.code, t]));
     const sortedTargets = [...registry.instructionTargets]
         .filter((target) => target.matchMode === "exact")
@@ -437,7 +438,17 @@ function injectAgentConfigs(registry, runtimeCodes, dryRun) {
         if (perRuntimeResults.length > 0)
             return [...existingResults, ...perRuntimeResults.filter((result, index, arr) => arr.findIndex((item) => canonicalTargetKey(item.path) === canonicalTargetKey(result.path)) === index)];
     }
-    return [];
+    // Not `[]`. When every runtime's target was already collected into
+    // `existingMatches` — which is the steady state once a repo has been set up
+    // once — the per-runtime loop `continue`s on all of them and
+    // `perRuntimeResults` comes back empty. Returning [] here threw away the
+    // results already computed above, the caller read that as "no instruction
+    // files" and fell back to injectGenericAgentConfig, and from then on only
+    // the generic target (AGENTS.md) was ever seen. Paul's CLAUDE.md and
+    // .cursorrules were invisible to staleness checking and attestation refresh
+    // from the second setup run onward, which is how they kept an expired
+    // `instruction_injection` block while the handshake reported all green.
+    return existingResults;
 }
 function trustAttestationStaleness(path) {
     if (!existsSync(path))
@@ -507,6 +518,45 @@ export function instructionInjectionDetail(registrationOk, staleAttestationTarge
         return `updated ${agentConfigResults.length} instruction target file(s)`;
     return "no runtime instruction target matched this repository (non-fatal; create AGENTS.md/CLAUDE.md or configure a generic target)";
 }
+/**
+ * Every instruction file the registry recognises that actually exists in this
+ * repo, deduplicated the way the rest of this module keys paths.
+ *
+ * This is the denominator for the coverage guard below. It is deliberately
+ * computed straight from the registry and the filesystem rather than from
+ * whatever the injection path happened to return, because the bug it guards
+ * against was the injection path silently returning fewer files than exist.
+ */
+export function existingInstructionFilePaths(registry) {
+    const seen = new Set();
+    const paths = [];
+    for (const target of registry.instructionTargets) {
+        if (target.matchMode !== "exact")
+            continue;
+        const filePath = join(process.cwd(), target.filePathPattern);
+        const key = canonicalTargetKey(filePath);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        if (existsSync(filePath))
+            paths.push(filePath);
+    }
+    return paths;
+}
+/**
+ * Instruction files that exist on disk but were never evaluated for staleness.
+ *
+ * "already current (no refresh needed)" is only honest about files somebody
+ * looked at. When the injection path under-reports its targets, the attestation
+ * check evaluates a subset and reports green for the whole repo — which is
+ * exactly how two of Paul's three files kept an expired, wrongly-scoped block
+ * through a clean setup run. A non-empty result here fails the check rather
+ * than letting it speak for files it never opened.
+ */
+export function unevaluatedInstructionFiles(onDisk, evaluated) {
+    const evaluatedKeys = new Set(evaluated.map((result) => canonicalTargetKey(result.path)));
+    return onDisk.filter((path) => !evaluatedKeys.has(canonicalTargetKey(path)));
+}
 /**
  * Summarises the per-target attestation writes into the check's ok/detail.
  *
@@ -1481,6 +1531,9 @@ export async function initAgent(args) {
                 : identityCapture.detail,
     });
     const instructionsAlreadyConfigured = agentConfigResults.length > 0 && agentConfigResults.every((r) => r.status === "already_present");
+    const uncoveredInstructionFiles = registration.ok
+        ? unevaluatedInstructionFiles(existingInstructionFilePaths(registry), agentConfigResults)
+        : [];
     const attestationSummary = summariseAttestationOutcomes(attestationOutcomes);
     /** Renewed means every attested target verified on disk, not that one mint succeeded. */
     const attestationRenewed = attestationOutcomes.length > 0 && attestationSummary.ok;
@@ -1492,23 +1545,26 @@ export async function initAgent(args) {
     checks.push({
         name: "agent.trust.attestation",
         ok: !registration.ok || (unsafeReattestationTargetCount === 0
+            && uncoveredInstructionFiles.length === 0
             && attestationSummary.ok
             && ((staleAttestationTargetCount === 0 && !trustAttestationAttempted) || Boolean(trustAttestation?.ok))),
         detail: !registration.ok
             ? "skipped (registration failed)"
-            : unsafeReattestationTargetCount > 0
-                ? "managed section does not match the published template; re-run with --allow-instruction-write"
-                : staleAttestationTargetCount > 0 && !attestationWriteAllowed
-                    ? `${mismatchedAttestationTargetCount > 0 ? "mismatched" : "stale"}; re-run with --reattest`
-                    : instructionsAlreadyConfigured && !attestationWriteAllowed
-                        ? "skipped (already configured)"
-                        : !attestationWriteAllowed
-                            ? "skipped (consent not granted)"
-                            : !trustAttestationAttempted
-                                ? agentConfigResults.length > 0
-                                    ? "already current (no refresh needed)"
-                                    : "skipped (no instruction target written)"
-                                : attestationSummary.detail,
+            : uncoveredInstructionFiles.length > 0
+                ? `${uncoveredInstructionFiles.length} instruction file(s) on disk were never evaluated (${uncoveredInstructionFiles.map((path) => basename(path)).join(", ")}); their attestations are unverified`
+                : unsafeReattestationTargetCount > 0
+                    ? "managed section does not match the published template; re-run with --allow-instruction-write"
+                    : staleAttestationTargetCount > 0 && !attestationWriteAllowed
+                        ? `${mismatchedAttestationTargetCount > 0 ? "mismatched" : "stale"}; re-run with --reattest`
+                        : instructionsAlreadyConfigured && !attestationWriteAllowed
+                            ? "skipped (already configured)"
+                            : !attestationWriteAllowed
+                                ? "skipped (consent not granted)"
+                                : !trustAttestationAttempted
+                                    ? agentConfigResults.length > 0
+                                        ? "already current (no refresh needed)"
+                                        : "skipped (no instruction target written)"
+                                    : attestationSummary.detail,
     });
     checks.push({
         name: "technology.components",

package/dist/commands/login.js

@@ -24,15 +24,15 @@ async function promptCapabilityProfile() {
     return selectFromList("Select a capability profile for this credential:", PROFILE_CHOICES, "worker");
 }
 function printLoginBanner() {
-    const logo = String.raw `
-        ######        ######
-        #######      ######
-       #########   ######    ##
-      ##################   #####
-     #####   ##########     ######
-   ######     #######        ######
-  #####         ####   #############
-######           ##   ###############
+    const logo = String.raw `
+        ######        ######
+        #######      ######
+       #########   ######    ##
+      ##################   #####
+     #####   ##########     ######
+   ######     #######        ######
+  #####         ####   #############
+######           ##   ###############
 `;
     console.log(logo);
     console.log("NEXARCH CLI login\n");
@@ -95,10 +95,10 @@ function waitForCallback(port, expectedState) {
             const companyName = url.searchParams.get("companyName") ?? undefined;
             const companyCode = url.searchParams.get("companyCode") ?? undefined;
             const error = url.searchParams.get("error");
-            const html = (message) => `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Nexarch CLI</title>
-        <style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f8fafc}
-        .card{background:#fff;border:1px solid #e2e8f0;border-radius:12px;padding:2rem;max-width:400px;text-align:center}
-        h1{font-size:1.25rem;margin:0 0 .5rem;color:#0f172a}p{color:#64748b;font-size:.9rem;margin:.5rem 0}</style></head>
+            const html = (message) => `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Nexarch CLI</title>
+        <style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f8fafc}
+        .card{background:#fff;border:1px solid #e2e8f0;border-radius:12px;padding:2rem;max-width:400px;text-align:center}
+        h1{font-size:1.25rem;margin:0 0 .5rem;color:#0f172a}p{color:#64748b;font-size:.9rem;margin:.5rem 0}</style></head>
         <body><div class="card"><h1>Nexarch CLI</h1><p>${message}</p></div></body></html>`;
             if (state !== expectedState) {
                 res.writeHead(400, { "Content-Type": "text/html" });
@@ -247,6 +247,7 @@ export async function login(args) {
         companyCode: companyCode ?? undefined,
         companyId,
         expiresAt: expiresAt.toISOString(),
+        source: "interactive",
     });
     try {
         const identityDir = join(homedir(), ".nexarch");

package/dist/commands/policy-audit-template.js

@@ -37,24 +37,24 @@ export async function policyAuditTemplate(args) {
     const defaultResult = (parseOptionValue(args, "--default-result") ?? "fail").toLowerCase();
     const selectedControlIds = new Set(parseMultiOptionValues(args, "--control-id"));
     if (parseFlag(args, "--help") || parseFlag(args, "-h")) {
-        console.log(`
-Usage:
-  nexarch policy-audit-template --entity <application:key> [options]
-
-Options:
-  --entity <key>                 Required (e.g. application:bad-driving)
-  --control-id <uuid>            Optional repeatable filter (selected controls only)
-  --default-result <value>       pass|partial|fail (default: fail)
-  --output, --out <path.json>    Write findings array to file
-  --json                         Print JSON to stdout
-
-Output shape is ready for:
-  nexarch policy-audit-submit --findings-file <path.json>
-
-Each entry includes empty severity/effort/exploitability/confidence/fileRefs
-placeholders. Fill them in for every partial/fail finding -- they decide how
-findings get ranked and reported. Leave a field blank/empty rather than
-guess; policy-audit-submit drops anything that isn't a valid value.
+        console.log(`
+Usage:
+  nexarch policy-audit-template --entity <application:key> [options]
+
+Options:
+  --entity <key>                 Required (e.g. application:bad-driving)
+  --control-id <uuid>            Optional repeatable filter (selected controls only)
+  --default-result <value>       pass|partial|fail (default: fail)
+  --output, --out <path.json>    Write findings array to file
+  --json                         Print JSON to stdout
+
+Output shape is ready for:
+  nexarch policy-audit-submit --findings-file <path.json>
+
+Each entry includes empty severity/effort/exploitability/confidence/fileRefs
+placeholders. Fill them in for every partial/fail finding -- they decide how
+findings get ranked and reported. Leave a field blank/empty rather than
+guess; policy-audit-submit drops anything that isn't a valid value.
 `);
         return;
     }

package/dist/commands/status.js

@@ -5,8 +5,8 @@ import { callMcpTool } from "../lib/mcp.js";
 export async function status(_args) {
     const creds = requireCredentials();
     const selectedCompanyId = creds.companyId;
-    const expiresAt = new Date(creds.expiresAt);
-    const daysLeft = Math.ceil((expiresAt.getTime() - Date.now()) / (1000 * 60 * 60 * 24));
+    const expiresAt = creds.expiresAt ? new Date(creds.expiresAt) : null;
+    const daysLeft = expiresAt ? Math.ceil((expiresAt.getTime() - Date.now()) / (1000 * 60 * 60 * 24)) : null;
     const lease = loadCheckInLease();
     const leaseState = lease && lease.companyId === selectedCompanyId ? getCheckInLeaseState(lease) : { status: "missing", expiresInSeconds: null };
     process.stdout.write("Connecting to mcp.nexarch.ai… ");
@@ -28,6 +28,15 @@ export async function status(_args) {
     if (creds.email) {
         console.log(`  Signed in as:   ${creds.email}`);
     }
+    else if (creds.source === "agent") {
+        console.log("  Authentication: Hermes agent enrollment");
+        if (creds.agentRef) {
+            console.log(`  Agent:          ${creds.agentRef}`);
+        }
+    }
+    else if (creds.source === "service") {
+        console.log("  Authentication: service credential");
+    }
     if (creds.company) {
         console.log(`  Workspace:      ${creds.company}`);
     }
@@ -53,7 +62,7 @@ export async function status(_args) {
     else {
         console.log(`  Latest snapshot:     none published yet`);
     }
-    console.log(`\n  Token expires:  ${expiresAt.toLocaleDateString()} (${daysLeft} days)`);
+    console.log(`\n  Token expires:  ${expiresAt ? `${expiresAt.toLocaleDateString()} (${daysLeft} days)` : "not reported"}`);
     if (leaseState.status === "valid" && lease) {
         console.log(`  Check-in lease: ${new Date(lease.leaseExpiresAt).toLocaleString()} (${Math.ceil((leaseState.expiresInSeconds ?? 0) / 3600)}h left)`);
     }
@@ -63,7 +72,7 @@ export async function status(_args) {
     else {
         console.log("  Check-in lease: none stored");
     }
-    if (daysLeft <= 14) {
+    if (daysLeft !== null && daysLeft <= 14) {
         console.log(`\n  ⚠  Your token expires soon. Run \`nexarch login\` to renew.`);
     }
     if (leaseState.status !== "valid") {

package/dist/lib/credentials.js

@@ -4,6 +4,9 @@ import { readFileSync, writeFileSync, mkdirSync, existsSync, rmSync } from "fs";
 function credentialsPath() {
     return join(homedir(), ".nexarch", "credentials.json");
 }
+function agentCredentialPath() {
+    return join(homedir(), ".nexarch", "agent-credential.json");
+}
 /**
  * Credentials supplied by the environment, for CI.
  *
@@ -27,24 +30,49 @@ function credentialsFromEnvironment() {
         company: "",
         companyId: process.env.NEXARCH_COMPANY_ID?.trim() ?? "",
         expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
+        source: "service",
     };
 }
+function credentialsFromAgentManifest() {
+    const path = agentCredentialPath();
+    if (!existsSync(path))
+        return null;
+    try {
+        const manifest = JSON.parse(readFileSync(path, "utf-8"));
+        const token = typeof manifest.credential?.token === "string" ? manifest.credential.token.trim() : "";
+        const companyId = typeof manifest.workspace?.id === "string" ? manifest.workspace.id : "";
+        if (!token || !companyId)
+            return null;
+        return {
+            token,
+            email: "",
+            company: typeof manifest.workspace?.name === "string" ? manifest.workspace.name : "",
+            companyId,
+            expiresAt: typeof manifest.credential?.expiresAt === "string" ? manifest.credential.expiresAt : null,
+            source: "agent",
+            agentRef: typeof manifest.agent?.ref === "string" ? manifest.agent.ref : undefined,
+        };
+    }
+    catch {
+        return null;
+    }
+}
 export function loadCredentials() {
     const fromEnv = credentialsFromEnvironment();
     if (fromEnv)
         return fromEnv;
     const path = credentialsPath();
     if (!existsSync(path))
-        return null;
+        return credentialsFromAgentManifest();
     try {
         const raw = readFileSync(path, "utf-8");
         const creds = JSON.parse(raw);
         if (!creds.token)
-            return null;
-        return creds;
+            return credentialsFromAgentManifest();
+        return { ...creds, source: "interactive" };
     }
     catch {
-        return null;
+        return credentialsFromAgentManifest();
     }
 }
 export function saveCredentials(creds) {
@@ -63,13 +91,13 @@ export function removeCredentials() {
 export function requireCredentials() {
     const creds = loadCredentials();
     if (!creds) {
-        throw new Error("Not logged in. Run `nexarch login` to authenticate, or set NEXARCH_TOKEN for unattended use.");
+        throw new Error("No Nexarch credential found. Run `nexarch login` for interactive CLI access, or `nexarch enroll` for headless agent access.");
     }
     // Environment-supplied service credentials are validated by the gateway, not
     // by this process; only the stored interactive session carries a local expiry.
     if (process.env.NEXARCH_TOKEN?.trim())
         return creds;
-    if (new Date(creds.expiresAt) < new Date()) {
+    if (creds.expiresAt && new Date(creds.expiresAt) < new Date()) {
         throw new Error("Your session has expired. Run `nexarch login` to re-authenticate.");
     }
     return creds;

package/package.json

@@ -1,39 +1,39 @@
-{
-  "name": "nexarch",
-  "version": "0.13.7",
-  "description": "Your architecture workspace for AI delivery.",
-  "keywords": [
-    "nexarch",
-    "mcp",
-    "architecture",
-    "ai"
-  ],
-  "license": "MIT",
-  "author": "Nexarch <hello@nexarch.ai>",
-  "homepage": "https://nexarch.ai",
-  "engines": {
-    "node": ">=18"
-  },
-  "type": "module",
-  "bin": {
-    "nexarch": "dist/index.js"
-  },
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "build": "tsc",
-    "prepublishOnly": "tsc",
-    "dev": "tsx src/index.ts",
-    "typecheck": "tsc --noEmit",
-    "test": "tsx scripts/test-mcp-proxy-response.ts && tsx scripts/test-trust-reattest.ts && tsx scripts/test-similar-applications.ts && tsx scripts/test-iac-tool.ts && tsx scripts/test-ansible.ts && tsx scripts/test-reference-sightings.ts && tsx scripts/test-search-icons.ts && tsx scripts/test-paste-login.ts"
-  },
-  "devDependencies": {
-    "@types/node": "^22",
-    "tsx": "^4",
-    "typescript": "^5"
-  },
-  "dependencies": {
-    "yaml": "^2.9.0"
-  }
-}
+{
+  "name": "nexarch",
+  "version": "0.14.0",
+  "description": "Your architecture workspace for AI delivery.",
+  "keywords": [
+    "nexarch",
+    "mcp",
+    "architecture",
+    "ai"
+  ],
+  "license": "MIT",
+  "author": "Nexarch <hello@nexarch.ai>",
+  "homepage": "https://nexarch.ai",
+  "engines": {
+    "node": ">=18"
+  },
+  "type": "module",
+  "bin": {
+    "nexarch": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "tsc",
+    "dev": "tsx src/index.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "tsx scripts/test-mcp-proxy-response.ts && tsx scripts/test-trust-reattest.ts && tsx scripts/test-similar-applications.ts && tsx scripts/test-iac-tool.ts && tsx scripts/test-ansible.ts && tsx scripts/test-reference-sightings.ts && tsx scripts/test-search-icons.ts && tsx scripts/test-paste-login.ts && tsx scripts/test-credentials-resolution.ts"
+  },
+  "devDependencies": {
+    "@types/node": "^22",
+    "tsx": "^4",
+    "typescript": "^5"
+  },
+  "dependencies": {
+    "yaml": "^2.9.0"
+  }
+}