novahiz 0.3.2 → 0.3.3

package/dist/commands/context.js

@@ -0,0 +1,167 @@
+import { existsSync, mkdirSync, readFileSync, readdirSync, chmodSync, readSync } from "node:fs";
+import { resolve as resolvePath, join } from "node:path";
+import { homedir } from "node:os";
+import { fileURLToPath } from "node:url";
+export function parse(argv) {
+    const flags = {};
+    const positionals = [];
+    for (let index = 0; index < argv.length; index += 1) {
+        const arg = argv[index];
+        if (!arg.startsWith("--")) {
+            positionals.push(arg);
+            continue;
+        }
+        const equals = arg.indexOf("=");
+        if (equals !== -1) {
+            flags[arg.slice(2, equals)] = arg.slice(equals + 1);
+            continue;
+        }
+        const next = argv[index + 1];
+        if (next !== undefined && !next.startsWith("--")) {
+            flags[arg.slice(2)] = next;
+            index += 1;
+        }
+        else {
+            flags[arg.slice(2)] = true;
+        }
+    }
+    return { positionals, flags };
+}
+export function asString(value) {
+    if (value === undefined || value === null)
+        return "";
+    if (typeof value === "string")
+        return value;
+    return String(value);
+}
+export function splitList(value) {
+    if (typeof value !== "string" || value.length === 0)
+        return [];
+    return value.split(",").map((v) => v.trim()).filter(Boolean);
+}
+export function print(output) {
+    const record = (typeof output === "object" && output !== null ? output : {});
+    if (typeof record.name === "string" && Array.isArray(record.commands)) {
+        console.log(record.name);
+        for (const cmd of record.commands)
+            console.log("  " + cmd);
+    }
+    else {
+        process.stdout.write(JSON.stringify(output) + "\n");
+    }
+}
+export function flagOn(parsed, name) {
+    const value = parsed.flags[name];
+    if (value === true)
+        return true;
+    if (value === false)
+        return false;
+    if (typeof value === "string" && value.length > 0)
+        return true;
+    return false;
+}
+export function humanMode(parsed) {
+    process.stdout.write("Plan mode: read-only. No application files will be written.\n");
+    return true;
+}
+export function emit(parsed, value, textFn) {
+    const format = String(parsed.flags.format ?? "").toLowerCase();
+    const asJson = format === "json" || parsed.flags.json === true;
+    if (asJson) {
+        process.stdout.write(JSON.stringify(value, null, 2) + "\n");
+    }
+    else {
+        process.stdout.write(textFn() + "\n");
+    }
+}
+// P2-C (LOW): stdin.read() returns null on a TTY (stream not in flowing
+// mode), which made every confirmation silently answer "no". Read a line
+// from fd 0 directly instead; parse stays pure so tests cover it without a
+// terminal.
+export function parseAnswer(line) {
+    const answer = line.trim().toLowerCase();
+    return answer === "y" || answer === "yes" || answer === "o" || answer === "oui";
+}
+const MAX_ANSWER_BYTES = 1024;
+function readAnswerLine() {
+    const buffer = Buffer.alloc(MAX_ANSWER_BYTES);
+    let total = 0;
+    try {
+        while (total < MAX_ANSWER_BYTES) {
+            const read = readSync(0, buffer, total, 1, null);
+            if (read <= 0)
+                break;
+            const byte = buffer[total];
+            total += 1;
+            if (byte === 0x0a)
+                break; // \n — consume the whole line, stop at newline
+        }
+    }
+    catch {
+        // stdin unavailable (closed pipe, no console): treat as empty answer
+    }
+    return buffer.toString("utf8", 0, total);
+}
+export function confirm(question) {
+    process.stdout.write(question + " [y/N] ");
+    return parseAnswer(readAnswerLine());
+}
+// The name promises safety: malformed input returns [] instead of throwing.
+export function safeJsonArray(value) {
+    try {
+        const parsed = JSON.parse(value);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+export function dbPathFor(root, spec) {
+    return resolvePath(root, spec.config.dbPath);
+}
+const MAX_STDIN_BYTES = 1024 * 1024; // 1 MiB: JSON payloads never need more
+export function readStdin() {
+    // A single synchronous stdin read races with pipe delivery and can return null even when input was provided.
+    if (process.stdin.isTTY)
+        return "";
+    try {
+        // P2-C (LOW): bounded read — readFileSync(0) had no size limit, so a huge
+        // pipe reached JSON.parse in full. Stop at the cap; oversized input gets
+        // truncated (and then fails to parse) instead of being loaded whole.
+        const buffer = Buffer.alloc(MAX_STDIN_BYTES);
+        let total = 0;
+        while (total < MAX_STDIN_BYTES) {
+            const read = readSync(0, buffer, total, MAX_STDIN_BYTES - total, null);
+            if (read <= 0)
+                break;
+            total += read;
+        }
+        return buffer.toString("utf8", 0, total);
+    }
+    catch {
+        return "";
+    }
+}
+export function numberFlag(parsed, name, opts = {}) {
+    const raw = parsed.flags[name];
+    if (raw === undefined || raw === false)
+        return undefined;
+    const label = opts.label ?? name;
+    const num = Number(raw);
+    if (Number.isNaN(num)) {
+        process.stderr.write(`Invalid value for --${label}: "${raw}" is not a number.\n`);
+        process.exitCode = 1;
+        return undefined;
+    }
+    if (opts.integer && !Number.isInteger(num)) {
+        process.stderr.write(`Invalid value for --${label}: an integer is required, not "${raw}".\n`);
+        process.exitCode = 1;
+        return undefined;
+    }
+    if (opts.min !== undefined && num < opts.min) {
+        process.stderr.write(`Invalid value for --${label}: ${num} is below the minimum limit of ${opts.min}.\n`);
+        process.exitCode = 1;
+        return undefined;
+    }
+    return num;
+}

package/dist/commands/doctor.js

@@ -0,0 +1,221 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { dbPathFor, emit } from "./context.js";
+import { loadSpec, NovahizHome } from "../spec.js";
+import { openDb, SCHEMA_VERSION } from "../db.js";
+import { loadInstalledSkills } from "../catalog.js";
+import { evaluateGate } from "../gate.js";
+import { DEFAULT_LIMIT_CHARS, DEFAULT_LIMIT_LINES, MEMORY_DIR } from "../memory.js";
+import * as ui from "../render.js";
+const SKILL_CLI = {};
+function hasCommand(name) {
+    const probe = process.platform === "win32" ? "where" : "which";
+    const result = spawnSync(probe, [name], { encoding: "utf8", shell: false });
+    return result.status === 0;
+}
+export function grantsQuestionIn(agentFile) {
+    return /^\s*question:\s*allow\s*$/m.test(agentFile);
+}
+function referencedSkills(spec) {
+    const ids = new Set();
+    for (const category of spec.categories) {
+        for (const skill of category.defaultSkills ?? [])
+            ids.add(skill);
+        for (const step of category.roadmap?.steps ?? []) {
+            for (const skill of step.requireSkills ?? [])
+                ids.add(skill);
+        }
+    }
+    for (const rule of spec.rules)
+        for (const skill of rule.require)
+            ids.add(skill);
+    // Skill packs (kind: "skill") are delivery mechanisms, not index entries:
+    // their id ("flutter-skills", "expo-skills") never matches a SKILL.md name,
+    // so adding it made this check permanently red. Pack skills land in the
+    // index individually and are referenced through categories and rules above.
+    return [...ids].sort();
+}
+export function commandDoctor(parsed) {
+    const root = NovahizHome();
+    const spec = loadSpec(root);
+    const checks = [];
+    const parts = process.versions.node.split(".").map((value) => Number(value));
+    const nodeOk = parts[0] > 22 || (parts[0] === 22 && parts[1] >= 18);
+    checks.push({ id: "node", label: "Node 22.18+", ok: nodeOk, detail: `v${process.versions.node}`, blocking: true });
+    checks.push({ id: "npx", label: "npx available", ok: hasCommand("npx"), detail: "required by MCP providers", blocking: true });
+    const index = loadInstalledSkills(spec);
+    checks.push({
+        id: "index",
+        label: "Skills index",
+        ok: index.available,
+        detail: index.available ? `${index.skills.size} skills` : "build/installed-skills.json unreadable, run novahiz sync",
+        blocking: true
+    });
+    const referenced = referencedSkills(spec);
+    const absent = index.available ? referenced.filter((id) => !index.skills.has(id)) : [];
+    checks.push({
+        id: "referenced",
+        label: "Referenced skills",
+        ok: absent.length === 0,
+        detail: absent.length === 0 ? `${referenced.length} present` : `missing from index: ${absent.join(", ")}`,
+        blocking: absent.length > 0
+    });
+    // SKILL_CLI is intentionally empty: novahiz-web-extract replaced the external
+    // defuddle CLI on the research roadmap (see MEMORY.md). Keep the check so a
+    // future external dependency is wired here again.
+    const cliEntries = Object.entries(SKILL_CLI);
+    const missingCli = cliEntries
+        .filter(([skill]) => referenced.includes(skill) && !hasCommand(skill))
+        .map(([, cli]) => cli);
+    checks.push({
+        id: "cli",
+        label: "Required external CLI",
+        ok: missingCli.length === 0,
+        detail: missingCli.length > 0
+            ? `not found: ${missingCli.join(", ")}`
+            : cliEntries.length === 0
+                ? "none required (web-extract replaced defuddle)"
+                : "all present",
+        blocking: missingCli.length > 0
+    });
+    // Two probes, one per live enforcement layer, both deterministic against the
+    // current ruleset (the old single probe fed README.md with empty categories,
+    // which matches no rule since the prose content rules were removed):
+    // - path probe: R13/R14 match a style file through pathGlobs alone.
+    // - category probe: R6 matches a classified code prompt; tier is set
+    //   explicitly because probe text is file content, not a prompt, and
+    //   determineTier would call it trivial and skip R6.
+    const probeInput = {
+        tool: "edit",
+        content: "",
+        categories: [],
+        loadedSkills: [],
+        installedSkills: index.skills,
+        installedIndexAvailable: index.available,
+        spec
+    };
+    const pathProbe = evaluateGate({ ...probeInput, filePath: "src/hero.css" });
+    const classProbe = evaluateGate({
+        ...probeInput,
+        filePath: "README.md",
+        categories: ["code"],
+        tier: "full"
+    });
+    const blocked = (r) => r.allow === false && r.missingSkills.length > 0;
+    const gateOk = spec.rules.length === 0 || (blocked(pathProbe) && blocked(classProbe));
+    const probeSkills = [...new Set([...pathProbe.missingSkills, ...classProbe.missingSkills])];
+    checks.push({
+        id: "gate",
+        label: "Operational gate",
+        ok: gateOk,
+        detail: gateOk ? `blocks a write without a loaded skill (${probeSkills.join(", ")})` : "did not block a write without a loaded skill",
+        blocking: true
+    });
+    const dbFile = dbPathFor(root, spec);
+    let dbOk = false;
+    let dbDetail = "missing";
+    try {
+        const size = statSync(dbFile).size;
+        const db = openDb(dbFile);
+        db.prepare("SELECT COUNT(*) AS n FROM enforcement_log").get();
+        db.close();
+        dbOk = true;
+        dbDetail = ui.bytes(size);
+    }
+    catch (error) {
+        dbDetail = `unreadable: ${error.message}`;
+    }
+    checks.push({ id: "db", label: "Registry database", ok: dbOk, detail: dbDetail, blocking: false });
+    // Informational only: openDb migrates on open, so the stored version always
+    // matches by the time this reads it. The value is read so a future migration
+    // has something to branch on, and so a database from an older build shows up.
+    let schemaDetail = "database unreadable";
+    try {
+        const db = openDb(dbFile);
+        const row = db.prepare("PRAGMA user_version").get();
+        const version = Number(row?.user_version ?? 0);
+        db.close();
+        schemaDetail = `version ${version} (expected ${SCHEMA_VERSION})`;
+    }
+    catch (error) {
+        schemaDetail = `unreadable: ${error.message}`;
+    }
+    checks.push({ id: "schema", label: "Schema version", ok: true, detail: schemaDetail, blocking: false });
+    const adapterSource = join(root, "adapters", "opencode", "novahiz.ts");
+    const opencodeDir = process.env.OPENCODE_CONFIG_DIR && process.env.OPENCODE_CONFIG_DIR.length > 0
+        ? process.env.OPENCODE_CONFIG_DIR
+        : join(homedir(), ".config", "opencode");
+    const adapterInstalled = join(opencodeDir, "plugins", "novahiz.ts");
+    let adapterOk = true;
+    let adapterDetail = "no installed copy";
+    if (existsSync(adapterSource) && existsSync(adapterInstalled)) {
+        adapterOk = readFileSync(adapterSource, "utf8") === readFileSync(adapterInstalled, "utf8");
+        adapterDetail = adapterOk ? "plugin harness copy up to date" : "plugin harness copy outdated, rerun installer then restart opencode";
+    }
+    checks.push({ id: "adapter", label: "Plugin harness copy", ok: adapterOk, detail: adapterDetail, blocking: false });
+    const memoryModule = join(root, "src", "memory.ts");
+    const memoryOk = existsSync(memoryModule) && DEFAULT_LIMIT_CHARS === 8000 && DEFAULT_LIMIT_LINES === 200;
+    checks.push({
+        id: "memory",
+        label: "Memory module",
+        ok: memoryOk,
+        detail: memoryOk
+            ? `${MEMORY_DIR}/ slots ${DEFAULT_LIMIT_CHARS} chars / ${DEFAULT_LIMIT_LINES} lines`
+            : "src/memory.ts missing or limits changed",
+        blocking: false
+    });
+    const mcpEntry = join(root, "mcp", "novahiz-tools", "index.mjs");
+    let memoryToolsOk = false;
+    let memoryToolsDetail = "mcp entry missing";
+    if (existsSync(mcpEntry)) {
+        const source = readFileSync(mcpEntry, "utf8");
+        const tools = ["memory_write", "memory_list", "memory_get", "memory_init", "memory_rebuild"];
+        const missing = tools.filter((name) => !source.includes(`"${name}"`));
+        memoryToolsOk = missing.length === 0;
+        memoryToolsDetail = memoryToolsOk ? "5 memory_* tools registered" : `missing: ${missing.join(", ")}`;
+    }
+    checks.push({ id: "memory-tools", label: "MCP memory tools", ok: memoryToolsOk, detail: memoryToolsDetail, blocking: false });
+    const agentSource = join(root, "adapters", "opencode", "agent", "novahiz.md");
+    const agentInstalled = join(opencodeDir, "agent", "novahiz.md");
+    let agentOk = true;
+    let agentDetail = "no installed copy";
+    if (existsSync(agentSource) && existsSync(agentInstalled)) {
+        const installed = readFileSync(agentInstalled, "utf8");
+        const inSync = installed === readFileSync(agentSource, "utf8");
+        const grantsQuestion = grantsQuestionIn(installed);
+        agentOk = inSync && grantsQuestion;
+        agentDetail = !inSync
+            ? "agent harness copy outdated, rerun installer then restart opencode"
+            : grantsQuestion
+                ? "agent harness copy up to date, question allowed"
+                : "agent harness copy does not allow question: pipeline cannot query";
+    }
+    checks.push({ id: "agent", label: "Agent harness copy", ok: agentOk, detail: agentDetail, blocking: false });
+    const failing = checks.filter((check) => !check.ok);
+    const blocking = failing.filter((check) => check.blocking);
+    const value = {
+        home: root,
+        node: process.versions.node,
+        platform: process.platform,
+        checks,
+        failing: failing.map((check) => check.id),
+        blocking: blocking.map((check) => check.id)
+    };
+    emit(parsed, value, () => [
+        ui.heading("Novahiz doctor"),
+        ui.kv([
+            ["Maison", root],
+            ["Plateforme", process.platform]
+        ]),
+        "",
+        ui.table(["check", "status", "detail"], checks.map((check) => [check.label, check.ok ? ui.status(true) : ui.status(false), check.detail])),
+        "",
+        blocking.length > 0
+            ? ui.style("red", `${blocking.length} blocking anomaly/anomalies: ${blocking.map((check) => check.id).join(", ")}`)
+            : ui.style("green", "No blocking anomaly.")
+    ].join("\n"));
+    if (blocking.length > 0)
+        process.exitCode = 1;
+}

package/dist/commands/gate.js

@@ -0,0 +1,218 @@
+import { join } from "node:path";
+import { asString, dbPathFor, parse, print, readStdin, splitList } from "./context.js";
+import { loadSpec, NovahizHome } from "../spec.js";
+import { openDb } from "../db.js";
+import { loadInstalledSkills } from "../catalog.js";
+import { changeText } from "../content.js";
+import { enforceLedgerChecks, evaluateGate } from "../gate.js";
+import { extractTargetPaths } from "../targets.js";
+export function commandGate(parsed) {
+    const root = NovahizHome();
+    let spec;
+    try {
+        spec = loadSpec(root);
+    }
+    catch (error) {
+        // C-Gate: fail-closed when spec is corrupt — returning allow:true is a
+        // security boundary violation. Structured JSON on stderr for callers that
+        // need to distinguish corruption from normal block.
+        const msg = `loadSpec failed: ${String(error).slice(0, 200)}`;
+        process.stderr.write(`novahiz: ${msg}\n`);
+        print({ allow: false, error: msg, tool: asString(parsed.flags.tool) || "edit", missingSkills: [], reasons: [msg] });
+        process.exitCode = 2;
+        return;
+    }
+    const gateConfig = spec.config.gate;
+    // MINEUR#5: normalize case — the plugin lowercases tool names (adapters
+    // novahiz.ts), so a case-sensitive check here would treat "EDIT" as
+    // un-gated and silently allow the call.
+    const tool = (asString(parsed.flags.tool) || "edit").toLowerCase();
+    const categories = splitList(parsed.flags.categories);
+    let loaded = splitList(parsed.flags.loaded);
+    const session = asString(parsed.flags.session);
+    if (loaded.length === 0 && session.length > 0) {
+        let db = null;
+        try {
+            db = openDb(dbPathFor(root, spec));
+            const rows = db.prepare("SELECT skill FROM skill_invocations WHERE session_id = ?").all(session);
+            loaded = rows.map((row) => row.skill);
+        }
+        catch (error) {
+            process.stderr.write(`novahiz: session DB open failed: ${String(error).slice(0, 200)}\n`);
+            print({ allow: false, error: `session DB error`, tool, missingSkills: [], reasons: [`session DB open failed`] });
+            process.exitCode = 2;
+            return;
+        }
+        finally {
+            db?.close();
+        }
+    }
+    // C2: a project-writable config must not silently switch enforcement off.
+    // enabled:false is ignored on purpose; the only kill-switch is the external
+    // env var NOVAHIZ_GATE (same philosophy as the hardcoded envEscape, H3/C5).
+    if (gateConfig.enabled === false) {
+        process.stderr.write('novahiz: gate.enabled=false in novahiz.config.json is ignored; enforcement stays active. Use NOVAHIZ_GATE=off to disable the gate.\n');
+    }
+    // H3: always use NOVAHIZ_GATE (legacy: NOVAHIZ_GATE) — ignore configurable
+    // envEscape to prevent a writable config from redirecting the kill-switch.
+    const escapeValue = (process.env.NOVAHIZ_GATE || "").toLowerCase();
+    if (["off", "0", "false", "no", "disabled"].includes(escapeValue)) {
+        print({ allow: true, disabled: true });
+        return;
+    }
+    const gated = gateConfig.tools.includes(tool);
+    if (!gated) {
+        print({ allow: true, tool, reason: "tool is not gated" });
+        return;
+    }
+    const single = asString(parsed.flags.file);
+    let content = asString(parsed.flags.content);
+    // C1: the prompt that triggered the edit drives the complexity tier.
+    const prompt = asString(parsed.flags.prompt);
+    let paths;
+    if (single.length > 0) {
+        paths = [single];
+    }
+    else if (parsed.flags["args-stdin"]) {
+        let args = {};
+        const raw = readStdin().trim();
+        if (raw.length > 0) {
+            try {
+                args = JSON.parse(raw);
+            }
+            catch {
+                process.stderr.write("novahiz: invalid JSON on stdin for --args-stdin\n");
+                process.exitCode = 1;
+                return;
+            }
+        }
+        paths = extractTargetPaths(tool, args);
+        if (content.length === 0)
+            content = changeText(tool, args);
+    }
+    else {
+        process.stderr.write("novahiz: gate requires --file <path> or --args-stdin\n");
+        process.exitCode = 1;
+        return;
+    }
+    const pathless = paths.length === 0;
+    if (pathless) {
+        const writeTools = ["edit", "write", "patch", "apply_patch"];
+        if (writeTools.includes(tool)) {
+            // MINEUR#6: warn/audit never exit non-zero — report the pass with a
+            // wouldBlock marker instead of a contradictory allow:false + exit 0.
+            const enforced = gateConfig.mode === "block";
+            print({
+                allow: !enforced,
+                ...(enforced ? {} : { wouldBlock: true }),
+                tool,
+                targets: [],
+                requiredSkills: [],
+                missingSkills: [],
+                reasons: ["no target path for a write tool"]
+            });
+            if (enforced)
+                process.exitCode = 2;
+            return;
+        }
+        // MAJEUR l.135: bash/shell/cron with no target path no longer pass
+        // unconditionally — they fall through to a pathless evaluation so
+        // prompt-scoped rules (supabase, browser, security, ...) still apply
+        // to commands like `python -e`, `curl -o` or `git apply`.
+    }
+    const index = loadInstalledSkills(spec);
+    const evalInput = {
+        tool,
+        content,
+        prompt,
+        categories,
+        loadedSkills: loaded,
+        installedSkills: index.skills,
+        installedIndexAvailable: index.available,
+        spec
+    };
+    const results = pathless
+        ? [{ path: "", ...evaluateGate({ ...evalInput, filePath: "", pathless: true }) }]
+        : paths.map((filePath) => ({ path: filePath, ...evaluateGate({ ...evalInput, filePath }) }));
+    const reasons = [];
+    let reviewWarning = "";
+    const requiredSkills = [...new Set(results.flatMap((entry) => entry.requiredSkills))];
+    const missingSkills = [...new Set(results.flatMap((entry) => entry.missingSkills))];
+    const unmatchedRequired = [...new Set(results.flatMap((entry) => entry.unmatchedRequired))];
+    const indexMissing = results.some((entry) => entry.indexMissing);
+    // H4: single DB connection for trace, ledger checks, AND enforcement logging
+    let db = null;
+    let dbFailure = "";
+    try {
+        db = openDb(dbPathFor(root, spec));
+    }
+    catch (error) {
+        dbFailure = String(error).slice(0, 200);
+        process.stderr.write(`novahiz: DB open failed: ${dbFailure}\n`);
+        if (gateConfig.mode === "block") {
+            // block mode keeps fail-closed behaviour: no enforcement trace, no edits.
+            print({ allow: false, error: `DB open failed`, tool, missingSkills: [], reasons: [`DB open failed`] });
+            process.exitCode = 2;
+            return;
+        }
+        // MINEUR#7: warn/audit are advisory — degrade gracefully instead of
+        // locking every gated tool out; ledger checks are skipped and reported.
+    }
+    try {
+        if (db) {
+            // Shared with the MCP novahiz_gate tool (src/gate.ts enforceLedgerChecks)
+            // so the two entry points enforce trace + ledger + the log identically.
+            const enforced = enforceLedgerChecks(db, { session, tool, paths, categories, results, spec, gateConfig });
+            reasons.push(...enforced.reasons);
+            reviewWarning = enforced.reviewWarning;
+        }
+    }
+    finally {
+        db?.close();
+    }
+    const warnings = [];
+    if (dbFailure.length > 0 && gateConfig.mode !== "block") {
+        warnings.push(`enforcement trace unavailable (DB open failed): continuing without ledger checks in ${gateConfig.mode} mode.`);
+    }
+    if (reviewWarning.length > 0)
+        warnings.push(reviewWarning);
+    if (unmatchedRequired.length > 0) {
+        warnings.push(`required skills missing from index, therefore not applied: ` + unmatchedRequired.join(", ") + `. Restart novahiz sync to realign the index.`);
+    }
+    if (indexMissing) {
+        warnings.push("skills index unreadable: all required skills are enforced.");
+    }
+    const blocked = results.some((entry) => !entry.allow);
+    const enforced = gateConfig.mode === "block";
+    // MINEUR#6: allow mirrors the exit contract — warn/audit never block, so a
+    // failing evaluation is reported as allow:true + wouldBlock:true (exit 0)
+    // instead of a contradictory allow:false + exit 0.
+    const allow = !blocked || !enforced;
+    print({
+        allow,
+        ...(blocked && !enforced ? { wouldBlock: true } : {}),
+        tool,
+        mode: gateConfig.mode,
+        indexMissing,
+        requiredSkills,
+        missingSkills,
+        unmatchedRequired,
+        warnings,
+        reasons,
+        targets: results.map((entry) => ({
+            path: entry.path,
+            fileClass: entry.fileClass,
+            tier: entry.tier,
+            ignored: entry.ignored,
+            roadmap: entry.roadmap,
+            requiredSkills: entry.requiredSkills,
+            missingSkills: entry.missingSkills,
+            unmatchedRequired: entry.unmatchedRequired,
+            placeholder: entry.placeholder,
+            reasons: entry.reasons,
+            matchedRules: entry.matchedRules
+        }))
+    });
+    if (!allow && gateConfig.mode === "block")
+        process.exitCode = 2;
+}