openspecpm 0.1.0-alpha.0 → 1.0.0

package/cli/bin/openspecpm.js

@@ -1,198 +1,201 @@
-#!/usr/bin/env node
-import { Command } from 'commander';
-import { audited } from '../src/audit.js';
-import { runInit } from '../src/commands/init.js';
-import { runDoctor } from '../src/commands/doctor.js';
-import { runPropose } from '../src/commands/propose.js';
-import { runDecompose } from '../src/commands/decompose.js';
-import { runSync } from '../src/commands/sync.js';
-import { runComment } from '../src/commands/comment.js';
-import { runReconcile } from '../src/commands/reconcile.js';
-import { runStatus } from '../src/commands/status.js';
-import { runStandup } from '../src/commands/standup.js';
-import { runNext } from '../src/commands/next.js';
-import { runBlocked } from '../src/commands/blocked.js';
-import { runValidate } from '../src/commands/validate.js';
-import { runSearch } from '../src/commands/search.js';
-import { runFanOut } from '../src/commands/fan-out.js';
-import { runBugReport } from '../src/commands/bug-report.js';
-import { runShip } from '../src/commands/ship.js';
-import { runHelp } from '../src/commands/help.js';
-import { runAssign } from '../src/commands/assign.js';
-import { runSyncAll, runShipAllReady } from '../src/commands/bulk.js';
-import { runWatch } from '../src/commands/watch.js';
-
-const program = new Command();
-
-program
-  .name('openspecpm')
-  .description('Spec-driven, BDD-shaped project management for AI agents.')
-  .version('0.1.0-alpha.0');
-
-program
-  .command('init')
-  .description('Interactive wizard: pick a PM tool and write .openspecpm/config.json')
-  .option('--non-interactive', 'Fail instead of prompting when input is required')
-  .action((opts) => audited('init', runInit)(opts).catch(fatal));
-
-program
-  .command('doctor [adapter]')
-  .description('Check auth + tooling health for one or all adapters')
-  .option('--install', 'Print OS-specific install commands for missing CLIs')
-  .option('--setup-auth', 'Print PAT/token URLs and required scopes')
-  .action((adapter, opts) => audited('doctor', runDoctor)({ adapter, install: opts.install, setupAuth: opts.setupAuth }).catch(fatal));
-
-program
-  .command('propose <feature>')
-  .description('Create an OpenSpec proposal (proposal.md, design.md, tasks.md, specs/) for <feature>')
-  .option('-p, --prompt <text>', 'One-line description for the AI to seed the proposal')
-  .option('-t, --type <type>', 'Change type: feature | bug | refactor | incident', 'feature')
-  .option('--offline', 'Scaffold from templates without calling the openspec CLI')
-  .action((feature, opts) => audited('propose', runPropose)({ feature, prompt: opts.prompt, type: opts.type, offline: opts.offline }).catch(fatal));
-
-program
-  .command('decompose <feature>')
-  .description('Extract tasks from proposal + BDD scenarios into tasks.md')
-  .option('--force', 'Merge into an existing tasks.md instead of refusing')
-  .action((feature, opts) => audited('decompose', runDecompose)({ feature, force: opts.force }).catch(fatal));
-
-program
-  .command('sync [feature]')
-  .description('Push an OpenSpec change to the configured PM tool (idempotent; BDD-linted)')
-  .option('--all', 'Sync every change under openspec/changes/')
-  .option('--dry-run', 'Print the call plan without making remote changes')
-  .option('--force', 'Bypass BDD lint errors')
-  .option('--diff', 'Show the call plan in detail')
-  .option('-y, --yes', 'Skip the confirmation prompt for --all')
-  .action((feature, opts) => {
-    if (opts.all) {
-      return audited('sync-all', runSyncAll)({ dryRun: opts.dryRun, force: opts.force, yes: opts.yes }).catch(fatal);
-    }
-    if (!feature) {
-      process.stderr.write('error: provide a <feature> or pass --all\n');
-      process.exit(1);
-    }
-    return audited('sync', runSync)({ feature, dryRun: opts.dryRun, force: opts.force, diff: opts.diff }).catch(fatal);
-  });
-
-program
-  .command('comment <feature> <task>')
-  .description('Post a progress comment to the PM tool work item')
-  .option('-m, --message <text>', 'Inline message (otherwise reads from local progress.md)')
-  .option('--dry-run', 'Print the comment instead of posting')
-  .action((feature, task, opts) =>
-    audited('comment', runComment)({ feature, task, message: opts.message, dryRun: opts.dryRun }).catch(fatal),
-  );
-
-program
-  .command('reconcile <feature>')
-  .description('Pull remote state back into local task frontmatter')
-  .option('--dry-run', 'Show drift without writing local changes')
-  .action((feature, opts) => audited('reconcile', runReconcile)({ feature, dryRun: opts.dryRun }).catch(fatal));
-
-program
-  .command('status')
-  .description('Local snapshot: configured adapter + per-change task counts')
-  .action(() => audited('status', runStatus)().catch(fatal));
-
-program
-  .command('standup')
-  .description('Show progress updates within a recent window')
-  .option('--since <window>', 'Time window: e.g. 12h, 2d, 1w', '24h')
-  .option('--broadcast', 'Also POST to configured Slack/Teams/generic webhooks')
-  .action((opts) => audited('standup', runStandup)({ since: opts.since, broadcast: opts.broadcast }).catch(fatal));
-
-program
-  .command('next')
-  .description('List tasks ready to start (no unmet dependencies)')
-  .option('-l, --limit <n>', 'Max items to show', (v) => parseInt(v, 10), 5)
-  .action((opts) => audited('next', runNext)({ limit: opts.limit }).catch(fatal));
-
-program
-  .command('blocked')
-  .description('List tasks waiting on unmet dependencies')
-  .action(() => audited('blocked', runBlocked)().catch(fatal));
-
-program
-  .command('validate')
-  .description('Schema + dependency + BDD-lint sweep across every change')
-  .action(() => audited('validate', runValidate)().catch(fatal));
-
-program
-  .command('search <query>')
-  .description('Grep across proposals, specs, tasks, and progress notes')
-  .option('-l, --limit <n>', 'Max matches to show', (v) => parseInt(v, 10), 50)
-  .option('--case-sensitive', 'Match case')
-  .action((query, opts) =>
-    audited('search', runSearch)({ query, limit: opts.limit, caseSensitive: opts.caseSensitive }).catch(fatal),
-  );
-
-program
-  .command('fan-out <feature>')
-  .description('Emit ready-to-paste agent prompts for parallel:true tasks')
-  .option('-l, --limit <n>', 'Max prompts to emit', (v) => parseInt(v, 10), 5)
-  .action((feature, opts) => audited('fan-out', runFanOut)({ feature, limit: opts.limit }).catch(fatal));
-
-program
-  .command('bug-report <feature> <task>')
-  .description('File a regression bug linked to a shipped task')
-  .option('-t, --title <text>', 'Bug title (required)')
-  .option('-b, --body <text>', 'Bug body')
-  .action((feature, task, opts) =>
-    audited('bug-report', runBugReport)({ feature, task, title: opts.title, body: opts.body }).catch(fatal),
-  );
-
-program
-  .command('assign <feature> <task>')
-  .description('Set assignee / sprint / iteration / area / story-points on a synced task')
-  .option('--assignee <id>', 'Assignee id (backend-specific)')
-  .option('--sprint <id>', 'Sprint / cycle / milestone id (whichever the backend supports)')
-  .option('--iteration <path>', 'Iteration path (Azure DevOps; alias for --sprint elsewhere)')
-  .option('--area <path>', 'Area path (Azure DevOps)')
-  .option('--story-points <n>', 'Story points / estimate / weight')
-  .action((feature, task, opts) =>
-    audited('assign', runAssign)({
-      feature, task,
-      assignee: opts.assignee, sprint: opts.sprint, iteration: opts.iteration,
-      area: opts.area, storyPoints: opts.storyPoints,
-    }).catch(fatal),
-  );
-
-program
-  .command('ship [feature]')
-  .description('Close all work items for <feature> and archive the OpenSpec change')
-  .option('--all-ready', 'Ship every change whose tasks are all synced (no pending/failed)')
-  .option('-y, --yes', 'Skip the confirmation prompt')
-  .option('--skip-archive', 'Close work items but leave openspec/changes/<feature>/ in place')
-  .action((feature, opts) => {
-    if (opts.allReady) {
-      return audited('ship-all-ready', runShipAllReady)({ yes: opts.yes, skipArchive: opts.skipArchive }).catch(fatal);
-    }
-    if (!feature) {
-      process.stderr.write('error: provide a <feature> or pass --all-ready\n');
-      process.exit(1);
-    }
-    return audited('ship', runShip)({ feature, yes: opts.yes, skipArchive: opts.skipArchive }).catch(fatal);
-  });
-
-program
-  .command('watch [feature]')
-  .description('Re-lint on file change. Use --all to validate the whole project on every change.')
-  .option('--all', 'Validate every change instead of linting one feature')
-  .option('--debounce <ms>', 'Debounce window in milliseconds', (v) => parseInt(v, 10), 300)
-  .action((feature, opts) =>
-    audited('watch', runWatch)({ feature, allChanges: opts.all, debounceMs: opts.debounce }).catch(fatal),
-  );
-
-program
-  .command('help-table [topic]')
-  .description('Context-aware help grouped by workflow phase')
-  .action((topic) => { runHelp({ topic }); });
-
-program.parseAsync(process.argv);
-
-function fatal(err) {
-  process.stderr.write(`\n✖ ${err.message}\n`);
-  if (err.remediation) process.stderr.write(`  → ${err.remediation}\n`);
-  process.exit(1);
-}
+#!/usr/bin/env node
+import { Command } from 'commander';
+import { audited } from '../src/audit.js';
+import { runInit } from '../src/commands/init.js';
+import { runDoctor } from '../src/commands/doctor.js';
+import { runPropose } from '../src/commands/propose.js';
+import { runDecompose } from '../src/commands/decompose.js';
+import { runSync } from '../src/commands/sync.js';
+import { runComment } from '../src/commands/comment.js';
+import { runReconcile } from '../src/commands/reconcile.js';
+import { runStatus } from '../src/commands/status.js';
+import { runStandup } from '../src/commands/standup.js';
+import { runNext } from '../src/commands/next.js';
+import { runBlocked } from '../src/commands/blocked.js';
+import { runValidate } from '../src/commands/validate.js';
+import { runSearch } from '../src/commands/search.js';
+import { runFanOut } from '../src/commands/fan-out.js';
+import { runBugReport } from '../src/commands/bug-report.js';
+import { runShip } from '../src/commands/ship.js';
+import { runHelp } from '../src/commands/help.js';
+import { runAssign } from '../src/commands/assign.js';
+import { runSyncAll, runShipAllReady } from '../src/commands/bulk.js';
+import { runWatch } from '../src/commands/watch.js';
+
+const program = new Command();
+
+program
+  .name('openspecpm')
+  .description('Spec-driven, BDD-shaped project management for AI agents.')
+  .version('0.1.0-alpha.0');
+
+program
+  .command('init')
+  .description('Interactive wizard: pick a PM tool and write .openspecpm/config.json')
+  .option('--non-interactive', 'Fail instead of prompting when input is required')
+  .action((opts) => audited('init', runInit)(opts).catch(fatal));
+
+program
+  .command('doctor [adapter]')
+  .description('Check auth + tooling health for one or all adapters')
+  .option('--install', 'Print OS-specific install commands for missing CLIs')
+  .option('--setup-auth', 'Print PAT/token URLs and required scopes')
+  .action((adapter, opts) => audited('doctor', runDoctor)({ adapter, install: opts.install, setupAuth: opts.setupAuth }).catch(fatal));
+
+program
+  .command('propose <feature>')
+  .description('Create an OpenSpec proposal (proposal.md, design.md, tasks.md, specs/) for <feature>')
+  .option('-p, --prompt <text>', 'One-line description for the AI to seed the proposal')
+  .option('-t, --type <type>', 'Change type: feature | bug | refactor | incident', 'feature')
+  .option('--offline', 'Scaffold from templates without calling the openspec CLI')
+  .option('--llm', 'Augment BDD soft-lint with the LLM judge (requires ANTHROPIC_API_KEY)')
+  .action((feature, opts) => audited('propose', runPropose)({ feature, prompt: opts.prompt, type: opts.type, offline: opts.offline, llm: opts.llm }).catch(fatal));
+
+program
+  .command('decompose <feature>')
+  .description('Extract tasks from proposal + BDD scenarios into tasks.md')
+  .option('--force', 'Merge into an existing tasks.md instead of refusing')
+  .action((feature, opts) => audited('decompose', runDecompose)({ feature, force: opts.force }).catch(fatal));
+
+program
+  .command('sync [feature]')
+  .description('Push an OpenSpec change to the configured PM tool (idempotent; BDD-linted)')
+  .option('--all', 'Sync every change under openspec/changes/')
+  .option('--dry-run', 'Print the call plan without making remote changes')
+  .option('--force', 'Bypass BDD lint errors')
+  .option('--diff', 'Show the call plan in detail')
+  .option('--llm', 'Augment BDD hard-lint with the LLM judge (requires ANTHROPIC_API_KEY)')
+  .option('-y, --yes', 'Skip the confirmation prompt for --all')
+  .action((feature, opts) => {
+    if (opts.all) {
+      return audited('sync-all', runSyncAll)({ dryRun: opts.dryRun, force: opts.force, yes: opts.yes }).catch(fatal);
+    }
+    if (!feature) {
+      process.stderr.write('error: provide a <feature> or pass --all\n');
+      process.exit(1);
+    }
+    return audited('sync', runSync)({ feature, dryRun: opts.dryRun, force: opts.force, diff: opts.diff, llm: opts.llm }).catch(fatal);
+  });
+
+program
+  .command('comment <feature> <task>')
+  .description('Post a progress comment to the PM tool work item')
+  .option('-m, --message <text>', 'Inline message (otherwise reads from local progress.md)')
+  .option('--dry-run', 'Print the comment instead of posting')
+  .action((feature, task, opts) =>
+    audited('comment', runComment)({ feature, task, message: opts.message, dryRun: opts.dryRun }).catch(fatal),
+  );
+
+program
+  .command('reconcile <feature>')
+  .description('Pull remote state back into local task frontmatter')
+  .option('--dry-run', 'Show drift without writing local changes')
+  .action((feature, opts) => audited('reconcile', runReconcile)({ feature, dryRun: opts.dryRun }).catch(fatal));
+
+program
+  .command('status')
+  .description('Local snapshot: configured adapter + per-change task counts')
+  .action(() => audited('status', runStatus)().catch(fatal));
+
+program
+  .command('standup')
+  .description('Show progress updates within a recent window')
+  .option('--since <window>', 'Time window: e.g. 12h, 2d, 1w', '24h')
+  .option('--broadcast', 'Also POST to configured Slack/Teams/generic webhooks')
+  .action((opts) => audited('standup', runStandup)({ since: opts.since, broadcast: opts.broadcast }).catch(fatal));
+
+program
+  .command('next')
+  .description('List tasks ready to start (no unmet dependencies)')
+  .option('-l, --limit <n>', 'Max items to show', (v) => parseInt(v, 10), 5)
+  .action((opts) => audited('next', runNext)({ limit: opts.limit }).catch(fatal));
+
+program
+  .command('blocked')
+  .description('List tasks waiting on unmet dependencies')
+  .action(() => audited('blocked', runBlocked)().catch(fatal));
+
+program
+  .command('validate')
+  .description('Schema + dependency + BDD-lint sweep across every change')
+  .option('--llm', 'Augment BDD lint with the LLM judge (requires ANTHROPIC_API_KEY)')
+  .action((opts) => audited('validate', runValidate)({ llm: opts.llm }).catch(fatal));
+
+program
+  .command('search <query>')
+  .description('Grep across proposals, specs, tasks, and progress notes')
+  .option('-l, --limit <n>', 'Max matches to show', (v) => parseInt(v, 10), 50)
+  .option('--case-sensitive', 'Match case')
+  .action((query, opts) =>
+    audited('search', runSearch)({ query, limit: opts.limit, caseSensitive: opts.caseSensitive }).catch(fatal),
+  );
+
+program
+  .command('fan-out <feature>')
+  .description('Emit ready-to-paste agent prompts for parallel:true tasks')
+  .option('-l, --limit <n>', 'Max prompts to emit', (v) => parseInt(v, 10), 5)
+  .action((feature, opts) => audited('fan-out', runFanOut)({ feature, limit: opts.limit }).catch(fatal));
+
+program
+  .command('bug-report <feature> <task>')
+  .description('File a regression bug linked to a shipped task')
+  .option('-t, --title <text>', 'Bug title (required)')
+  .option('-b, --body <text>', 'Bug body')
+  .action((feature, task, opts) =>
+    audited('bug-report', runBugReport)({ feature, task, title: opts.title, body: opts.body }).catch(fatal),
+  );
+
+program
+  .command('assign <feature> <task>')
+  .description('Set assignee / sprint / iteration / area / story-points on a synced task')
+  .option('--assignee <id>', 'Assignee id (backend-specific)')
+  .option('--sprint <id>', 'Sprint / cycle / milestone id (whichever the backend supports)')
+  .option('--iteration <path>', 'Iteration path (Azure DevOps; alias for --sprint elsewhere)')
+  .option('--area <path>', 'Area path (Azure DevOps)')
+  .option('--story-points <n>', 'Story points / estimate / weight')
+  .action((feature, task, opts) =>
+    audited('assign', runAssign)({
+      feature, task,
+      assignee: opts.assignee, sprint: opts.sprint, iteration: opts.iteration,
+      area: opts.area, storyPoints: opts.storyPoints,
+    }).catch(fatal),
+  );
+
+program
+  .command('ship [feature]')
+  .description('Close all work items for <feature> and archive the OpenSpec change')
+  .option('--all-ready', 'Ship every change whose tasks are all synced (no pending/failed)')
+  .option('-y, --yes', 'Skip the confirmation prompt')
+  .option('--skip-archive', 'Close work items but leave openspec/changes/<feature>/ in place')
+  .action((feature, opts) => {
+    if (opts.allReady) {
+      return audited('ship-all-ready', runShipAllReady)({ yes: opts.yes, skipArchive: opts.skipArchive }).catch(fatal);
+    }
+    if (!feature) {
+      process.stderr.write('error: provide a <feature> or pass --all-ready\n');
+      process.exit(1);
+    }
+    return audited('ship', runShip)({ feature, yes: opts.yes, skipArchive: opts.skipArchive }).catch(fatal);
+  });
+
+program
+  .command('watch [feature]')
+  .description('Re-lint on file change. Use --all to validate the whole project on every change.')
+  .option('--all', 'Validate every change instead of linting one feature')
+  .option('--debounce <ms>', 'Debounce window in milliseconds', (v) => parseInt(v, 10), 300)
+  .action((feature, opts) =>
+    audited('watch', runWatch)({ feature, allChanges: opts.all, debounceMs: opts.debounce }).catch(fatal),
+  );
+
+program
+  .command('help-table [topic]')
+  .description('Context-aware help grouped by workflow phase')
+  .action((topic) => { runHelp({ topic }); });
+
+program.parseAsync(process.argv);
+
+function fatal(err) {
+  process.stderr.write(`\n✖ ${err.message}\n`);
+  if (err.remediation) process.stderr.write(`  → ${err.remediation}\n`);
+  process.exit(1);
+}

package/cli/src/audit.js

@@ -9,7 +9,7 @@ export function auditPath(cwd = process.cwd()) {
   return join(cwd, DIR, FILE);
 }
 
-export async function record({ command, args = {}, result = null, error = null, cwd = process.cwd() } = {}) {
+export async function record({ command, args = {}, result = null, error = null, meta = null, cwd = process.cwd() } = {}) {
   if (!command) return;
   const path = auditPath(cwd);
   await mkdir(dirname(path), { recursive: true });
@@ -20,6 +20,7 @@ export async function record({ command, args = {}, result = null, error = null,
     result: result ? truncate(result, 500) : null,
     error: error ? truncate(typeof error === 'string' ? error : error.message ?? String(error), 500) : null,
   };
+  if (meta && typeof meta === 'object') entry.meta = scrub(meta);
   await appendFile(path, JSON.stringify(entry) + '\n', 'utf8');
 }
 
@@ -33,14 +34,22 @@ export async function tail(n = 50, cwd = process.cwd()) {
   });
 }
 
-const SECRET_KEYS = /token|secret|password|pat|api[_-]?key|auth|credential/i;
+const SECRET_SEGMENTS = new Set(['token', 'secret', 'password', 'pat', 'auth', 'credential']);
+
+function isSecretKey(k) {
+  if (/api[_-]?key/i.test(k)) return true;
+  for (const seg of k.toLowerCase().split(/[^a-z]+/)) {
+    if (seg && SECRET_SEGMENTS.has(seg)) return true;
+  }
+  return false;
+}
 
 function scrub(obj) {
   if (!obj || typeof obj !== 'object') return obj;
   if (Array.isArray(obj)) return obj.map(scrub);
   const out = {};
   for (const [k, v] of Object.entries(obj)) {
-    if (SECRET_KEYS.test(k)) {
+    if (isSecretKey(k)) {
       out[k] = '<redacted>';
     } else if (v && typeof v === 'object') {
       out[k] = scrub(v);