oxe-cc 1.12.0 → 1.16.0

package/bin/lib/oxe-dashboard.cjs

@@ -152,69 +152,69 @@ function parseVerify(md) {
   return { criteria, mentionedCriteria: Array.from(new Set((md.match(/\bA\d+\b/g) || []).map((x) => x.toUpperCase()))), failed: /\b(verify_failed|falhou|falha|reprovad)\b/i.test(md), passed: /\b(verify_complete|aprovad|passou|sucesso)\b/i.test(md) };
 }
 
-function confidenceBand(confidence, threshold) {
-  const normalizedThreshold = health.normalizePlanConfidenceThreshold(threshold);
-  if (confidence == null) return 'unknown';
-  if (health.isExecutablePlanConfidence(confidence, normalizedThreshold)) return 'ready';
-  if (confidence >= Math.max(80, normalizedThreshold - 10)) return 'rational_but_not_ready';
-  if (confidence >= 50) return 'needs_refinement';
-  return 'do_not_execute';
-}
-
-function computeReadiness(ctx, threshold) {
-  if (ctx.workspaceMode === 'product_package' && ctx.releaseReadiness) {
-    const blockers = Array.isArray(ctx.releaseReadiness.blockers) ? ctx.releaseReadiness.blockers.slice() : [];
-    const warnings = Array.isArray(ctx.releaseReadiness.warnings) ? ctx.releaseReadiness.warnings.slice() : [];
-    return {
-      go: Boolean(ctx.releaseReadiness.ok),
-      decision: ctx.releaseReadiness.ok ? 'go' : 'no-go',
-      threshold: health.normalizePlanConfidenceThreshold(threshold),
-      confidence: ctx.plan && ctx.plan.selfEvaluation ? ctx.plan.selfEvaluation.confidence : null,
-      confidenceBand: confidenceBand(ctx.plan && ctx.plan.selfEvaluation ? ctx.plan.selfEvaluation.confidence : null, threshold),
-      checkpointPending: false,
-      blockers,
-      warnings,
-    };
-  }
-  const normalizedThreshold = health.normalizePlanConfidenceThreshold(threshold);
-  const blockers = [];
-  const warnings = [...ctx.diagnostics.reviewWarnings, ...ctx.diagnostics.runtimeWarnings, ...ctx.diagnostics.planWarnings];
-  if (!ctx.plan.selfEvaluation || !ctx.plan.selfEvaluation.hasSection) blockers.push('self_evaluation:missing');
-  if (ctx.plan.selfEvaluation && Array.isArray(ctx.plan.selfEvaluation.warnings) && ctx.plan.selfEvaluation.warnings.length) {
-    blockers.push(`self_evaluation:warnings:${ctx.plan.selfEvaluation.warnings.length}`);
-  }
-  if (ctx.planReviewStatus !== 'approved') blockers.push(`review_status:${ctx.planReviewStatus || 'draft'}`);
-  if (ctx.plan.selfEvaluation.bestPlan === 'não') blockers.push('best_plan:no');
-  if (ctx.plan.selfEvaluation.confidence == null) blockers.push('confidence:missing');
-  else if (!health.isExecutablePlanConfidence(ctx.plan.selfEvaluation.confidence, normalizedThreshold)) {
-    blockers.push(`confidence:${ctx.plan.selfEvaluation.confidence}%<=${normalizedThreshold}%`);
-  }
-  if (!ctx.executionRationality || !ctx.executionRationality.implementationPackReady) {
-    blockers.push('implementation_pack:not_ready');
-  }
-  if (!ctx.executionRationality || !ctx.executionRationality.referenceAnchorsReady) {
-    blockers.push('reference_anchors:not_ready');
-  }
-  if (!ctx.executionRationality || !ctx.executionRationality.fixturePackReady) {
-    blockers.push('fixture_pack:not_ready');
-  }
-  if (ctx.checkpoints.parsed.some((x) => /pending_approval/i.test(x.status))) blockers.push('checkpoint:pending_approval');
-  if (ctx.runtime.parsed.status === 'blocked') blockers.push('runtime:blocked');
-  if (ctx.spec.uncoveredCriteria.length) warnings.push(`${ctx.spec.uncoveredCriteria.length} critérios sem cobertura no plano`);
-  if (ctx.executionRationality && Array.isArray(ctx.executionRationality.criticalExecutionGaps)) {
-    warnings.push(...ctx.executionRationality.criticalExecutionGaps);
-  }
-  return {
-    go: blockers.length === 0,
-    decision: blockers.length === 0 ? 'go' : 'no-go',
-    threshold: normalizedThreshold,
-    confidence: ctx.plan.selfEvaluation.confidence,
-    confidenceBand: confidenceBand(ctx.plan.selfEvaluation.confidence, normalizedThreshold),
-    checkpointPending: blockers.includes('checkpoint:pending_approval'),
-    blockers,
-    warnings,
-  };
-}
+function confidenceBand(confidence, threshold) {
+  const normalizedThreshold = health.normalizePlanConfidenceThreshold(threshold);
+  if (confidence == null) return 'unknown';
+  if (health.isExecutablePlanConfidence(confidence, normalizedThreshold)) return 'ready';
+  if (confidence >= Math.max(80, normalizedThreshold - 10)) return 'rational_but_not_ready';
+  if (confidence >= 50) return 'needs_refinement';
+  return 'do_not_execute';
+}
+
+function computeReadiness(ctx, threshold) {
+  if (ctx.workspaceMode === 'product_package' && ctx.releaseReadiness) {
+    const blockers = Array.isArray(ctx.releaseReadiness.blockers) ? ctx.releaseReadiness.blockers.slice() : [];
+    const warnings = Array.isArray(ctx.releaseReadiness.warnings) ? ctx.releaseReadiness.warnings.slice() : [];
+    return {
+      go: Boolean(ctx.releaseReadiness.ok),
+      decision: ctx.releaseReadiness.ok ? 'go' : 'no-go',
+      threshold: health.normalizePlanConfidenceThreshold(threshold),
+      confidence: ctx.plan && ctx.plan.selfEvaluation ? ctx.plan.selfEvaluation.confidence : null,
+      confidenceBand: confidenceBand(ctx.plan && ctx.plan.selfEvaluation ? ctx.plan.selfEvaluation.confidence : null, threshold),
+      checkpointPending: false,
+      blockers,
+      warnings,
+    };
+  }
+  const normalizedThreshold = health.normalizePlanConfidenceThreshold(threshold);
+  const blockers = [];
+  const warnings = [...ctx.diagnostics.reviewWarnings, ...ctx.diagnostics.runtimeWarnings, ...ctx.diagnostics.planWarnings];
+  if (!ctx.plan.selfEvaluation || !ctx.plan.selfEvaluation.hasSection) blockers.push('self_evaluation:missing');
+  if (ctx.plan.selfEvaluation && Array.isArray(ctx.plan.selfEvaluation.warnings) && ctx.plan.selfEvaluation.warnings.length) {
+    blockers.push(`self_evaluation:warnings:${ctx.plan.selfEvaluation.warnings.length}`);
+  }
+  if (ctx.planReviewStatus !== 'approved') blockers.push(`review_status:${ctx.planReviewStatus || 'draft'}`);
+  if (ctx.plan.selfEvaluation.bestPlan === 'não') blockers.push('best_plan:no');
+  if (ctx.plan.selfEvaluation.confidence == null) blockers.push('confidence:missing');
+  else if (!health.isExecutablePlanConfidence(ctx.plan.selfEvaluation.confidence, normalizedThreshold)) {
+    blockers.push(`confidence:${ctx.plan.selfEvaluation.confidence}%<=${normalizedThreshold}%`);
+  }
+  if (!ctx.executionRationality || !ctx.executionRationality.implementationPackReady) {
+    blockers.push('implementation_pack:not_ready');
+  }
+  if (!ctx.executionRationality || !ctx.executionRationality.referenceAnchorsReady) {
+    blockers.push('reference_anchors:not_ready');
+  }
+  if (!ctx.executionRationality || !ctx.executionRationality.fixturePackReady) {
+    blockers.push('fixture_pack:not_ready');
+  }
+  if (ctx.checkpoints.parsed.some((x) => /pending_approval/i.test(x.status))) blockers.push('checkpoint:pending_approval');
+  if (ctx.runtime.parsed.status === 'blocked') blockers.push('runtime:blocked');
+  if (ctx.spec.uncoveredCriteria.length) warnings.push(`${ctx.spec.uncoveredCriteria.length} critérios sem cobertura no plano`);
+  if (ctx.executionRationality && Array.isArray(ctx.executionRationality.criticalExecutionGaps)) {
+    warnings.push(...ctx.executionRationality.criticalExecutionGaps);
+  }
+  return {
+    go: blockers.length === 0,
+    decision: blockers.length === 0 ? 'go' : 'no-go',
+    threshold: normalizedThreshold,
+    confidence: ctx.plan.selfEvaluation.confidence,
+    confidenceBand: confidenceBand(ctx.plan.selfEvaluation.confidence, normalizedThreshold),
+    checkpointPending: blockers.includes('checkpoint:pending_approval'),
+    blockers,
+    warnings,
+  };
+}
 
 function buildCoverageMatrix(spec, plan, verify) {
   const taskMap = new Map();
@@ -236,27 +236,27 @@ function buildCoverageMatrix(spec, plan, verify) {
   }));
 }
 
-function computeCalibration(phase, confidence, verify, threshold) {
-  const normalizedThreshold = health.normalizePlanConfidenceThreshold(threshold);
-  if (confidence == null) return { status: 'pending', summary: 'Calibração indisponível antes do verify.' };
-  const low = String(phase || '').toLowerCase();
-  const completed = low === 'verify_complete' || verify.passed;
-  const failed = low === 'verify_failed' || verify.failed;
-  if (!completed && !failed) return { status: 'pending', summary: 'Calibração só fecha após verify.' };
-  if (health.isExecutablePlanConfidence(confidence, normalizedThreshold) && failed) {
-    return { status: 'overconfident', summary: `Confiança ${confidence}% acima do gate executável, mas o verify falhou.` };
-  }
-  if (!health.isExecutablePlanConfidence(confidence, normalizedThreshold) && failed) {
-    return { status: 'calibrated-risk', summary: `O plano já sinalizava risco (${confidence}%) abaixo do gate executável e o verify confirmou a fragilidade.` };
-  }
-  if (!health.isExecutablePlanConfidence(confidence, normalizedThreshold) && completed) {
-    return { status: 'underconfident', summary: `O resultado final foi melhor que a confiança inicial (${confidence}%), mas o plano ainda não superava o gate executável.` };
-  }
-  if (health.isExecutablePlanConfidence(confidence, normalizedThreshold) && completed) {
-    return { status: 'well-calibrated', summary: `Alta confiança executável (${confidence}%) e verify coerente com a expectativa.` };
-  }
-  return { status: 'acceptable', summary: `Confiança ${confidence}% e verify dentro da faixa esperada.` };
-}
+function computeCalibration(phase, confidence, verify, threshold) {
+  const normalizedThreshold = health.normalizePlanConfidenceThreshold(threshold);
+  if (confidence == null) return { status: 'pending', summary: 'Calibração indisponível antes do verify.' };
+  const low = String(phase || '').toLowerCase();
+  const completed = low === 'verify_complete' || verify.passed;
+  const failed = low === 'verify_failed' || verify.failed;
+  if (!completed && !failed) return { status: 'pending', summary: 'Calibração só fecha após verify.' };
+  if (health.isExecutablePlanConfidence(confidence, normalizedThreshold) && failed) {
+    return { status: 'overconfident', summary: `Confiança ${confidence}% acima do gate executável, mas o verify falhou.` };
+  }
+  if (!health.isExecutablePlanConfidence(confidence, normalizedThreshold) && failed) {
+    return { status: 'calibrated-risk', summary: `O plano já sinalizava risco (${confidence}%) abaixo do gate executável e o verify confirmou a fragilidade.` };
+  }
+  if (!health.isExecutablePlanConfidence(confidence, normalizedThreshold) && completed) {
+    return { status: 'underconfident', summary: `O resultado final foi melhor que a confiança inicial (${confidence}%), mas o plano ainda não superava o gate executável.` };
+  }
+  if (health.isExecutablePlanConfidence(confidence, normalizedThreshold) && completed) {
+    return { status: 'well-calibrated', summary: `Alta confiança executável (${confidence}%) e verify coerente com a expectativa.` };
+  }
+  return { status: 'acceptable', summary: `Confiança ${confidence}% e verify dentro da faixa esperada.` };
+}
 
 function readRepositoryContext(codebaseDir) {
   const names = ['OVERVIEW.md', 'STACK.md', 'STRUCTURE.md', 'TESTING.md', 'CONCERNS.md', 'INTEGRATIONS.md'];
@@ -363,7 +363,7 @@ function loadDashboardContext(projectRoot, opts = {}) {
   const activeSession = opts.activeSession === undefined ? health.parseActiveSession(stateText) : opts.activeSession;
   const p = reviewPaths(projectRoot, activeSession || null);
   const rootScoped = reviewPaths(projectRoot, null);
-  const report = health.buildHealthReport(projectRoot);
+  const report = health.buildHealthReport(projectRoot);
   const specText = readScopedText(p.spec, rootScoped.spec);
   const planText = readScopedText(p.plan, rootScoped.plan);
   const verifyText = readScopedText(p.verify, rootScoped.verify);
@@ -387,24 +387,24 @@ function loadDashboardContext(projectRoot, opts = {}) {
   const sessions = parseSessionsIndex(sessionsRaw);
   const sessionPath = activeSession ? path.join(projectRoot, '.oxe', activeSession, 'SESSION.md') : null;
   const sessionRaw = sessionPath ? readTextIfExists(sessionPath) || '' : '';
-  const ctx = {
-    projectRoot: path.resolve(projectRoot),
-    workspaceMode: report.workspaceMode || 'oxe_project',
-    releaseReadiness: report.releaseReadiness || null,
-    activeSession: activeSession || null,
+  const ctx = {
+    projectRoot: path.resolve(projectRoot),
+    workspaceMode: report.workspaceMode || 'oxe_project',
+    releaseReadiness: report.releaseReadiness || null,
+    activeSession: activeSession || null,
     phase: report.phase || health.parseStatePhase(stateText),
     healthStatus: report.healthStatus,
     nextStep: report.next,
     planReviewStatus: report.planReviewStatus || 'draft',
     state: { path: globalPaths.state, raw: stateText, parsed: { phase: health.parseStatePhase(stateText), activeSession, runtimeStatus: firstMatch(stateText, /\*\*runtime_status:\*\*\s*([^\n]+)/i) } },
     spec: { path: p.spec, raw: specText, objective: spec.objective, criteria: spec.criteria, uncoveredCriteria: spec.criteria.filter((c) => !plan.tasks.some((t) => (t.aceite || []).includes(c.id))) },
-    plan: { path: p.plan, raw: planText, tasks: plan.tasks, waves: plan.waves, totalTasks: plan.totalTasks, selfEvaluation: report.planSelfEvaluation },
-    executionRationality: report.executionRationality || null,
-    runtime: { path: p.runtime, raw: runtimeText, summary: summarizeText(runtimeText, 800), parsed: runtime },
+    plan: { path: p.plan, raw: planText, tasks: plan.tasks, waves: plan.waves, totalTasks: plan.totalTasks, selfEvaluation: report.planSelfEvaluation },
+    executionRationality: report.executionRationality || null,
+    runtime: { path: p.runtime, raw: runtimeText, summary: summarizeText(runtimeText, 800), parsed: runtime },
     activeRun: activeRunState,
     runtimeCanonical: activeRunState && activeRunState.canonical_state ? activeRunState.canonical_state : null,
     compiledGraph: activeRunState && activeRunState.compiled_graph ? activeRunState.compiled_graph : null,
-    enterprise: {
+    enterprise: {
       runtimeMode: report.runtimeMode || null,
       fallbackMode: report.fallbackMode || null,
       verificationSummary: report.verificationSummary || null,
@@ -420,14 +420,14 @@ function loadDashboardContext(projectRoot, opts = {}) {
       promotionReadiness: report.promotionReadiness || null,
       recoveryState: report.recoveryState || null,
       multiAgent: report.multiAgent || null,
-      providerCatalog: report.providerCatalog || null,
-      implementationPackReady: report.implementationPackReady,
-      referenceAnchorsReady: report.referenceAnchorsReady,
-      fixturePackReady: report.fixturePackReady,
-      executionRationalityReady: report.executionRationalityReady,
-      criticalExecutionGaps: report.criticalExecutionGaps || [],
-      warnings: report.enterpriseWarn || [],
-    },
+      providerCatalog: report.providerCatalog || null,
+      implementationPackReady: report.implementationPackReady,
+      referenceAnchorsReady: report.referenceAnchorsReady,
+      fixturePackReady: report.fixturePackReady,
+      executionRationalityReady: report.executionRationalityReady,
+      criticalExecutionGaps: report.criticalExecutionGaps || [],
+      warnings: report.enterpriseWarn || [],
+    },
     tracing: { path: operational.operationalPaths(projectRoot, activeSession || null).events, events: traceEvents, summary: traceSummary },
     checkpoints: { path: p.checkpoints, raw: checkpointsText, parsed: checkpoints },
     verify: { path: p.verify, raw: verifyText, summary: summarizeText(verifyText, 800), parsed: verify },
@@ -473,44 +473,44 @@ function loadDashboardContext(projectRoot, opts = {}) {
       summary: `login=${ctx.azure.authStatus && ctx.azure.authStatus.login_active ? 'ativo' : 'ausente'} · subscription=${ctx.azure.profile && (ctx.azure.profile.subscription_name || ctx.azure.profile.subscription_id) || '—'} · total=${inventorySummary.total} · sb=${inventorySummary.servicebus || 0} · eg=${inventorySummary.eventgrid || 0} · sql=${inventorySummary.sql || 0}`,
     };
   }
-  ctx.readiness = computeReadiness(ctx, report.planConfidenceThreshold || 90);
-  ctx.coverage = buildCoverageMatrix(ctx.spec, ctx.plan, verify);
-  ctx.calibration = computeCalibration(ctx.phase, ctx.plan.selfEvaluation.confidence, verify, ctx.readiness.threshold);
-  ctx.visual = {
-    flow: { nodes: [{ label: 'STATE', status: 'done' }, { label: 'SPEC', status: ctx.spec.raw ? 'done' : 'pending' }, { label: 'PLAN', status: ctx.plan.raw ? 'done' : 'pending' }, { label: 'REVIEW', status: ctx.planReviewStatus === 'approved' ? 'done' : /(rejected|needs_revision)/i.test(ctx.planReviewStatus) ? 'blocked' : 'active' }, { label: 'EXECUTE', status: ctx.runtime.parsed.status === 'running' ? 'active' : ctx.runtime.raw ? 'done' : 'pending' }, { label: 'CHECKPOINTS', status: ctx.readiness.checkpointPending ? 'active' : ctx.checkpoints.parsed.length ? 'done' : 'pending' }, { label: 'VERIFY', status: ctx.verify.raw ? 'done' : 'pending' }, { label: 'LESSONS', status: 'pending' }] },
-    artifactGraph: [
-      { id: 'state', label: 'STATE', path: ctx.state.path, detail: ctx.phase || 'índice global', status: 'done' },
-      { id: 'spec', label: 'SPEC', path: ctx.spec.path, detail: ctx.spec.objective || 'contrato', status: ctx.spec.raw ? 'done' : 'pending' },
-      { id: 'plan', label: 'PLAN', path: ctx.plan.path, detail: `${ctx.plan.totalTasks} tarefas`, status: ctx.plan.raw ? 'done' : 'pending' },
-      {
-        id: 'implementation-pack',
-        label: 'IMPLEMENTATION PACK',
-        path: ctx.executionRationality && ctx.executionRationality.implementationPack ? ctx.executionRationality.implementationPack.path : '—',
-        detail: ctx.executionRationality && ctx.executionRationality.implementationPack ? `${ctx.executionRationality.implementationPack.taskCount || 0} contratos` : 'sem contrato',
-        status: ctx.executionRationality && ctx.executionRationality.implementationPackReady ? 'done' : 'blocked',
-      },
-      {
-        id: 'reference-anchors',
-        label: 'REFERENCE ANCHORS',
-        path: ctx.executionRationality && ctx.executionRationality.referenceAnchors ? ctx.executionRationality.referenceAnchors.path : '—',
-        detail: ctx.executionRationality && ctx.executionRationality.referenceAnchors ? `${ctx.executionRationality.referenceAnchors.anchors ? ctx.executionRationality.referenceAnchors.anchors.length : 0} âncoras` : 'sem âncoras',
-        status: ctx.executionRationality && ctx.executionRationality.referenceAnchorsReady ? 'done' : 'blocked',
-      },
-      {
-        id: 'fixture-pack',
-        label: 'FIXTURE PACK',
-        path: ctx.executionRationality && ctx.executionRationality.fixturePack ? ctx.executionRationality.fixturePack.path : '—',
-        detail: ctx.executionRationality && ctx.executionRationality.fixturePack ? `${ctx.executionRationality.fixturePack.fixtureCount || 0} fixtures` : 'sem fixtures',
-        status: ctx.executionRationality && ctx.executionRationality.fixturePackReady ? 'done' : 'blocked',
-      },
-      { id: 'review', label: 'PLAN REVIEW', path: ctx.review.markdownPath, detail: ctx.planReviewStatus, status: ctx.planReviewStatus === 'approved' ? 'done' : 'active' },
-      { id: 'runtime', label: 'RUNTIME', path: ctx.runtime.path, detail: ctx.runtime.parsed.status || 'sem status', status: ctx.runtime.raw ? 'active' : 'pending' },
-      { id: 'active-run', label: 'ACTIVE RUN', path: operational.operationalPaths(projectRoot, activeSession || null).activeRun, detail: ctx.activeRun && ctx.activeRun.run_id ? `${ctx.activeRun.run_id} · ${ctx.activeRun.status}` : 'sem run ativo', status: ctx.activeRun ? 'active' : 'pending' },
-      { id: 'events', label: 'TRACE', path: operational.operationalPaths(projectRoot, activeSession || null).events, detail: `${ctx.tracing.summary.total} evento(s)`, status: ctx.tracing.summary.total ? 'done' : 'pending' },
-      { id: 'checkpoints', label: 'CHECKPOINTS', path: ctx.checkpoints.path, detail: `${ctx.checkpoints.parsed.length} gates`, status: ctx.readiness.checkpointPending ? 'active' : 'pending' },
-      { id: 'verify', label: 'VERIFY', path: ctx.verify.path, detail: ctx.calibration.status, status: ctx.verify.raw ? 'done' : 'pending' },
-    ],
-  };
+  ctx.readiness = computeReadiness(ctx, report.planConfidenceThreshold || 90);
+  ctx.coverage = buildCoverageMatrix(ctx.spec, ctx.plan, verify);
+  ctx.calibration = computeCalibration(ctx.phase, ctx.plan.selfEvaluation.confidence, verify, ctx.readiness.threshold);
+  ctx.visual = {
+    flow: { nodes: [{ label: 'STATE', status: 'done' }, { label: 'SPEC', status: ctx.spec.raw ? 'done' : 'pending' }, { label: 'PLAN', status: ctx.plan.raw ? 'done' : 'pending' }, { label: 'REVIEW', status: ctx.planReviewStatus === 'approved' ? 'done' : /(rejected|needs_revision)/i.test(ctx.planReviewStatus) ? 'blocked' : 'active' }, { label: 'EXECUTE', status: ctx.runtime.parsed.status === 'running' ? 'active' : ctx.runtime.raw ? 'done' : 'pending' }, { label: 'CHECKPOINTS', status: ctx.readiness.checkpointPending ? 'active' : ctx.checkpoints.parsed.length ? 'done' : 'pending' }, { label: 'VERIFY', status: ctx.verify.raw ? 'done' : 'pending' }, { label: 'LESSONS', status: 'pending' }] },
+    artifactGraph: [
+      { id: 'state', label: 'STATE', path: ctx.state.path, detail: ctx.phase || 'índice global', status: 'done' },
+      { id: 'spec', label: 'SPEC', path: ctx.spec.path, detail: ctx.spec.objective || 'contrato', status: ctx.spec.raw ? 'done' : 'pending' },
+      { id: 'plan', label: 'PLAN', path: ctx.plan.path, detail: `${ctx.plan.totalTasks} tarefas`, status: ctx.plan.raw ? 'done' : 'pending' },
+      {
+        id: 'implementation-pack',
+        label: 'IMPLEMENTATION PACK',
+        path: ctx.executionRationality && ctx.executionRationality.implementationPack ? ctx.executionRationality.implementationPack.path : '—',
+        detail: ctx.executionRationality && ctx.executionRationality.implementationPack ? `${ctx.executionRationality.implementationPack.taskCount || 0} contratos` : 'sem contrato',
+        status: ctx.executionRationality && ctx.executionRationality.implementationPackReady ? 'done' : 'blocked',
+      },
+      {
+        id: 'reference-anchors',
+        label: 'REFERENCE ANCHORS',
+        path: ctx.executionRationality && ctx.executionRationality.referenceAnchors ? ctx.executionRationality.referenceAnchors.path : '—',
+        detail: ctx.executionRationality && ctx.executionRationality.referenceAnchors ? `${ctx.executionRationality.referenceAnchors.anchors ? ctx.executionRationality.referenceAnchors.anchors.length : 0} âncoras` : 'sem âncoras',
+        status: ctx.executionRationality && ctx.executionRationality.referenceAnchorsReady ? 'done' : 'blocked',
+      },
+      {
+        id: 'fixture-pack',
+        label: 'FIXTURE PACK',
+        path: ctx.executionRationality && ctx.executionRationality.fixturePack ? ctx.executionRationality.fixturePack.path : '—',
+        detail: ctx.executionRationality && ctx.executionRationality.fixturePack ? `${ctx.executionRationality.fixturePack.fixtureCount || 0} fixtures` : 'sem fixtures',
+        status: ctx.executionRationality && ctx.executionRationality.fixturePackReady ? 'done' : 'blocked',
+      },
+      { id: 'review', label: 'PLAN REVIEW', path: ctx.review.markdownPath, detail: ctx.planReviewStatus, status: ctx.planReviewStatus === 'approved' ? 'done' : 'active' },
+      { id: 'runtime', label: 'RUNTIME', path: ctx.runtime.path, detail: ctx.runtime.parsed.status || 'sem status', status: ctx.runtime.raw ? 'active' : 'pending' },
+      { id: 'active-run', label: 'ACTIVE RUN', path: operational.operationalPaths(projectRoot, activeSession || null).activeRun, detail: ctx.activeRun && ctx.activeRun.run_id ? `${ctx.activeRun.run_id} · ${ctx.activeRun.status}` : 'sem run ativo', status: ctx.activeRun ? 'active' : 'pending' },
+      { id: 'events', label: 'TRACE', path: operational.operationalPaths(projectRoot, activeSession || null).events, detail: `${ctx.tracing.summary.total} evento(s)`, status: ctx.tracing.summary.total ? 'done' : 'pending' },
+      { id: 'checkpoints', label: 'CHECKPOINTS', path: ctx.checkpoints.path, detail: `${ctx.checkpoints.parsed.length} gates`, status: ctx.readiness.checkpointPending ? 'active' : 'pending' },
+      { id: 'verify', label: 'VERIFY', path: ctx.verify.path, detail: ctx.calibration.status, status: ctx.verify.raw ? 'done' : 'pending' },
+    ],
+  };
   if (ctx.azure) {
     ctx.visual.artifactGraph.push(
       {

package/bin/lib/oxe-manifest.cjs

@@ -51,26 +51,26 @@ function writeFileManifest(home, files, version) {
  * Before overwriting with --force, backup files that diverged from last manifest.
  * @param {string} home
  * @param {Record<string, string>} prevManifest
- * @param {{ dryRun: boolean, force: boolean }} opts
- * @param {{ yellow: string, cyan: string, dim: string, reset: string }} colors
- * @param {{ scopeRoots?: string[] }} [scope]
- * @returns {string[]} modified paths
- */
-function backupModifiedFromManifest(home, prevManifest, opts, colors, scope = {}) {
-  const { yellow, cyan, dim, reset } = colors;
-  if (!opts.force || opts.dryRun) return [];
-  const normalizedRoots = Array.isArray(scope.scopeRoots)
-    ? scope.scopeRoots.map((root) => path.resolve(root))
-    : [];
-  const modified = [];
-  for (const [absPath, oldHash] of Object.entries(prevManifest)) {
-    if (normalizedRoots.length > 0 && !normalizedRoots.some((root) => absPath === root || absPath.startsWith(`${root}${path.sep}`))) {
-      continue;
-    }
-    if (!fs.existsSync(absPath)) continue;
-    let now;
-    try {
-      now = sha256File(absPath);
+ * @param {{ dryRun: boolean, force: boolean }} opts
+ * @param {{ yellow: string, cyan: string, dim: string, reset: string }} colors
+ * @param {{ scopeRoots?: string[] }} [scope]
+ * @returns {string[]} modified paths
+ */
+function backupModifiedFromManifest(home, prevManifest, opts, colors, scope = {}) {
+  const { yellow, cyan, dim, reset } = colors;
+  if (!opts.force || opts.dryRun) return [];
+  const normalizedRoots = Array.isArray(scope.scopeRoots)
+    ? scope.scopeRoots.map((root) => path.resolve(root))
+    : [];
+  const modified = [];
+  for (const [absPath, oldHash] of Object.entries(prevManifest)) {
+    if (normalizedRoots.length > 0 && !normalizedRoots.some((root) => absPath === root || absPath.startsWith(`${root}${path.sep}`))) {
+      continue;
+    }
+    if (!fs.existsSync(absPath)) continue;
+    let now;
+    try {
+      now = sha256File(absPath);
     } catch {
       continue;
     }

package/bin/lib/oxe-npm-version.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
-const { spawnSync } = require('child_process');
 const semver = require('semver');
+const { runPackageManagerSync } = require('./oxe-process.cjs');
 
 /**
  * Extrai versão semver do stdout de `npm view <pkg> version`.
@@ -41,11 +41,13 @@ function isNewerThan(latest, current) {
  * @returns {{ ok: true, version: string } | { ok: false, error: string }}
  */
 function syncNpmViewVersion(packageName, spawnOpts = {}) {
-  const r = spawnSync('npm', ['view', packageName, 'version'], {
+  const run = spawnOpts.runPackageManagerSync || runPackageManagerSync;
+  const options = { ...spawnOpts };
+  delete options.runPackageManagerSync;
+  const r = run('npm', ['view', packageName, 'version'], {
     encoding: 'utf8',
     env: process.env,
-    shell: process.platform === 'win32',
-    ...spawnOpts,
+    ...options,
   });
   if (r.error) return { ok: false, error: r.error.message || String(r.error) };
   if (r.status !== 0 && r.status !== null) {

package/bin/lib/oxe-plugin-cli.cjs

@@ -0,0 +1,95 @@
+'use strict';
+
+const path = require('path');
+const oxePlugins = require('./oxe-plugins.cjs');
+
+const DEFAULT_COLORS = Object.freeze({
+  green: '\x1b[32m',
+  yellow: '\x1b[33m',
+  dim: '\x1b[2m',
+  red: '\x1b[31m',
+  reset: '\x1b[0m',
+});
+
+function defaultUseAnsiColors() {
+  if (process.env.NO_COLOR) return false;
+  if (process.env.FORCE_COLOR === '0') return false;
+  return process.stdout.isTTY === true;
+}
+
+/**
+ * Executa o subcomando `plugins` sem acoplar parsing e rendering ao CLI principal.
+ * @param {string[]} argv
+ * @param {{
+ *   plugins?: typeof oxePlugins,
+ *   cwd?: string,
+ *   colors?: typeof DEFAULT_COLORS,
+ *   useAnsiColors?: () => boolean,
+ *   log?: (...args: unknown[]) => void,
+ *   error?: (...args: unknown[]) => void,
+ * }} [options]
+ * @returns {number} exit code
+ */
+function runPluginCommand(argv, options = {}) {
+  const plugins = options.plugins || oxePlugins;
+  const colors = options.colors || DEFAULT_COLORS;
+  const useAnsiColors = options.useAnsiColors || defaultUseAnsiColors;
+  const log = options.log || console.log;
+  const error = options.error || console.error;
+
+  let pluginsDir = options.cwd || process.cwd();
+  const pluginsArgv = argv.slice();
+  for (let i = 0; i < pluginsArgv.length; i++) {
+    if (pluginsArgv[i] === '--dir' && pluginsArgv[i + 1]) {
+      pluginsDir = path.resolve(pluginsArgv[i + 1]);
+      pluginsArgv.splice(i, 2);
+      i--;
+    }
+  }
+
+  const c = useAnsiColors();
+  const subCmd = pluginsArgv[0] || 'list';
+  const pluginTarget = pluginsArgv[1] || '';
+
+  if (subCmd === 'list') {
+    const result = plugins.loadPlugins(pluginsDir);
+    log(`\n  ${c ? colors.green : ''}Plugins carregados:${c ? colors.reset : ''} ${result.plugins.length}`);
+    for (const plugin of result.plugins) {
+      log(`    • ${plugin.name}${plugin.version ? ` (${plugin.version})` : ''} — hooks: ${Object.keys(plugin.hooks).join(', ')}`);
+    }
+    if (result.errors.length) {
+      log(`\n  ${c ? colors.yellow : ''}Erros:${c ? colors.reset : ''}`);
+      for (const pluginError of result.errors) {
+        log(`    ✗ ${pluginError.file}: ${pluginError.error}`);
+      }
+    }
+    return 0;
+  }
+
+  if (subCmd === 'install' && pluginTarget) {
+    const src = pluginTarget.startsWith('npm:') ? pluginTarget.slice(4) : pluginTarget;
+    const version = pluginsArgv[2] || '';
+    log(`  Instalando plugin: ${src}${version ? `@${version}` : ''}...`);
+    const result = plugins.installNpmPlugin(pluginsDir, src, version || undefined);
+    if (result.ok) {
+      log(`  ${c ? colors.green : ''}✓${c ? colors.reset : ''} Instalado em: ${result.path}`);
+      log(`  ${c ? colors.dim : ''}Adicione ao .oxe/config.json: "plugins": [{ "source": "npm:${src}" }]${c ? colors.reset : ''}`);
+      return 0;
+    }
+    error(`  ${c ? colors.red : ''}✗ Falha:${c ? colors.reset : ''} ${result.error}`);
+    return 1;
+  }
+
+  if (subCmd === 'remove' && pluginTarget) {
+    log(`  ${c ? colors.yellow : ''}Remove "${pluginTarget}" de .oxe/config.json → plugins[] manualmente.${c ? colors.reset : ''}`);
+    log(`  ${c ? colors.dim : ''}Arquivos npm: rm -rf .oxe/plugins/_npm/node_modules/${pluginTarget}${c ? colors.reset : ''}`);
+    return 0;
+  }
+
+  log(`  ${c ? colors.yellow : ''}Uso: oxe-cc plugins list | install <npm-package> [version] | remove <id>${c ? colors.reset : ''}`);
+  return 0;
+}
+
+module.exports = {
+  runPluginCommand,
+};

package/bin/lib/oxe-plugins.cjs

@@ -42,6 +42,68 @@
 
 const fs = require('fs');
 const path = require('path');
+const {
+  resolvePackageManagerInvocation,
+  runPackageManagerSync,
+} = require('./oxe-process.cjs');
+
+const MAX_NPM_PACKAGE_NAME_LENGTH = 214;
+const MAX_NPM_VERSION_LENGTH = 128;
+const NPM_NAME_PART = /^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$/;
+const NPM_VERSION_SPEC = /^[0-9A-Za-z*+._~^<>=-]+$/;
+
+/**
+ * Valida um nome de pacote npm sem aceitar URLs, paths ou option injection.
+ * @param {unknown} pkgName
+ * @returns {{ valid: boolean, error: string }}
+ */
+function validateNpmPackageName(pkgName) {
+  if (typeof pkgName !== 'string' || pkgName.length === 0) {
+    return { valid: false, error: 'Nome do pacote npm é obrigatório' };
+  }
+  if (pkgName !== pkgName.trim() || pkgName.length > MAX_NPM_PACKAGE_NAME_LENGTH) {
+    return { valid: false, error: 'Nome do pacote npm inválido' };
+  }
+
+  const parts = pkgName.startsWith('@')
+    ? pkgName.slice(1).split('/')
+    : [pkgName];
+  if (parts.length !== (pkgName.startsWith('@') ? 2 : 1) || parts.some((part) => !NPM_NAME_PART.test(part))) {
+    return { valid: false, error: 'Nome do pacote npm inválido' };
+  }
+  return { valid: true, error: '' };
+}
+
+/**
+ * Valida seletores npm usuais (versão exata, range sem espaços ou dist-tag).
+ * @param {unknown} version
+ * @returns {{ valid: boolean, error: string }}
+ */
+function validateNpmVersion(version) {
+  if (version === undefined || version === null || version === '') {
+    return { valid: true, error: '' };
+  }
+  if (
+    typeof version !== 'string' ||
+    version !== version.trim() ||
+    version.length > MAX_NPM_VERSION_LENGTH ||
+    version.startsWith('-') ||
+    !NPM_VERSION_SPEC.test(version)
+  ) {
+    return { valid: false, error: 'Versão ou tag npm inválida' };
+  }
+  return { valid: true, error: '' };
+}
+
+/**
+ * No Windows, scripts `.cmd` exigem shell. Para manter `shell: false`, executa
+ * diretamente o npm-cli.js com o processo Node atual.
+ * @param {{ platform?: string, env?: NodeJS.ProcessEnv, nodeExecutable?: string }} [options]
+ * @returns {{ command: string, argsPrefix: string[] }}
+ */
+function resolveNpmInvocation(options = {}) {
+  return resolvePackageManagerInvocation('npm', options);
+}
 
 /**
  * @typedef {{
@@ -316,15 +378,41 @@ function resolvePluginSources(projectRoot, pluginsSources) {
  * @param {string} [version]
  * @returns {{ ok: boolean, path: string, error: string }}
  */
-function installNpmPlugin(projectRoot, pkgName, version) {
+function installNpmPlugin(projectRoot, pkgName, version, options = {}) {
+  const packageValidation = validateNpmPackageName(pkgName);
+  if (!packageValidation.valid) {
+    return { ok: false, path: '', error: packageValidation.error };
+  }
+  const versionValidation = validateNpmVersion(version);
+  if (!versionValidation.valid) {
+    return { ok: false, path: '', error: versionValidation.error };
+  }
+
   const npmDir = path.join(projectRoot, '.oxe', 'plugins', '_npm');
   try {
     if (!fs.existsSync(npmDir)) {
       fs.mkdirSync(npmDir, { recursive: true });
     }
     const spec = version ? `${pkgName}@${version}` : pkgName;
-    const { execSync } = require('child_process');
-    execSync(`npm install --prefix "${npmDir}" ${spec}`, { stdio: 'pipe', timeout: 60000 });
+    const run = options.runPackageManagerSync || runPackageManagerSync;
+    const runOptions = { ...options };
+    delete runOptions.runPackageManagerSync;
+    const child = run('npm', [
+      'install',
+      '--prefix',
+      npmDir,
+      '--',
+      spec,
+    ], {
+      stdio: 'pipe',
+      timeout: 60000,
+      ...runOptions,
+    });
+    if (child.error) throw child.error;
+    if (child.status !== 0) {
+      const stderr = child.stderr ? String(child.stderr).trim() : '';
+      throw new Error(stderr || `npm install terminou com código ${child.status}`);
+    }
     return { ok: true, path: path.join(npmDir, 'node_modules', pkgName), error: '' };
   } catch (e) {
     return { ok: false, path: '', error: e.message || String(e) };
@@ -338,4 +426,7 @@ module.exports = {
   initPluginsDir,
   resolvePluginSources,
   installNpmPlugin,
+  validateNpmPackageName,
+  validateNpmVersion,
+  resolveNpmInvocation,
 };