prismalens 0.1.1 → 0.3.0

package/README.md

@@ -5,7 +5,7 @@ published on npm as the unscoped [`prismalens`](https://www.npmjs.com/package/pr
 
 Per **ADR-0010**, the engine *is* a CLI: the desktop app and web API drive it
 rather than embedding it. The CLI is a thin **Tier-1 supervisor** that rents a
-**Tier-2 agent harness** (ADR-0008) to do the read-only legwork, then reduces the
+**Tier-2 agent harness** (ADR-0008) to do the investigative legwork, then reduces the
 harness's canonical event stream into an **ordered-evidence report** (ADR-0002 —
 hypotheses ranked most-to-least plausible, with supporting/contradicting
 evidence; no numeric confidence scores).
@@ -18,8 +18,27 @@ evidence; no numeric confidence scores).
   - `claude-code` — driven over the **Claude Agent SDK**,
   - `codex` — **stubbed** (not implemented; selecting it throws).
 
-The harness investigates **read-only**. Provider credentials are **BYO-key**
-(ADR-0006) and come from the environment — never hard-bound in the CLI.
+## How the harness is contained
+
+By default prismalens removes the harness's edit tools (`Edit`, `Write`,
+`MultiEdit`, `NotebookEdit`). That is a **guardrail, not a security boundary**
+(ADR-0017): the shell is untouched, so writes remain possible via `Bash`. It is
+there to stop a *helpful* agent from editing the repo it was asked to investigate
+— it will not stop a determined one.
+
+**Without a sandbox, the harness runs as you** — your machine, your credentials,
+your shell — exactly as if you had invoked the agent CLI yourself. prismalens
+makes no safety claim in this mode, and none of the above should be read as one.
+
+The **only** real boundary is an enforced sandbox (`--sandbox srt` or `e2b`,
+ADR-0020): an OS-level box in which your host and credentials are read-only, the
+harness gets a read-write **workspace**, and network egress is **allowlisted**.
+Note that this is *confined writes*, not "read-only" — an investigation has to be
+able to clone a repo and download artifacts. `--sandbox auto` is not yet an
+enforced default; it can degrade to an unenforced floor.
+
+Provider credentials are **BYO-key** (ADR-0006), resolved from the environment or
+the local auth store — never hard-bound in the CLI.
 
 Every run is persisted to a durable workspace under `~/.prismalens/runs/<runId>/`
 (`events.jsonl` + `report.json` + `session.json`), regardless of how it was
@@ -83,6 +102,7 @@ prismalens <command> [flags]      # alias: pl
   serve         Run the JSON-RPC 2.0 server over stdio (the LIVE channel for apps).
   doctor        Preflight-check the investigation environment.
   init          Scaffold a prismalens.config.yaml in the current directory.
+  auth          Manage stored BYO-key credentials for providers.
 ```
 
 ### `investigate`
@@ -138,8 +158,11 @@ Preflight checklist that gates a run. Prints pass/fail per check; exits non-zero
   `claude-code` → `claude`, `codex` → `codex` (for the harness from config).
 - **HARD — an LLM credential:** any of `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` /
   `GOOGLE_API_KEY` / `OLLAMA_API_KEY` / `GROQ_API_KEY` / `CUSTOM_LLM_API_KEY`,
-  or, for `claude-code`, a signed-in `~/.claude/.credentials.json`. (Performs a live provider model ping by default, while `--no-ping` skips it.)
-- **SOFT — workspace writable:** `workspace.base_dir` can be created/written.
+  a credential stored via `pl auth login` (`auth.json`), or, for `claude-code`,
+  a signed-in `~/.claude/.credentials.json`. Doctor reports which layer supplied
+  the credential (`source: env | file | stored | none`). (Performs a live
+  provider model ping by default, while `--no-ping` skips it.)
+- **SOFT — workspace writable:** `workspace.dir` can be created/written.
 
 ### `init`
 
@@ -210,7 +233,19 @@ stdout).
 ```
 
 **`investigate`** — `params`: `{ alert?: FiringAlert, query?: string, repo?: string,
-harness?: string, model?: string, config?: string }`.
+harness?: string, model?: string, config?: string, service?: string, mode?: string,
+dangerouslySkipPermissions?: boolean, sandbox?: string, maxTurns?: number }`.
+
+CLI-parity params (each falls back to config when absent):
+
+- `sandbox` — the isolation boundary (ADR-0020), the CLI's `--sandbox`: one of
+  `auto` | `process` | `srt` | `e2b`. Absent ⇒ `agent.sandbox` from config. A
+  supplied value that is not a known mode (or a mode the resolved harness cannot
+  honour, e.g. `srt` on a non-ACP harness) is a `-32602` error — never a silent
+  fall-back to the cooperative floor.
+- `maxTurns` — per-run turn ceiling, the CLI's `--max-turns`: a positive integer.
+  A supplied zero, negative, fractional, or non-numeric value is a `-32602` error —
+  never a silently-removed cap.
 
 Streams a **notification per canonical event** (including the terminal `report`
 event), then **resolves the request** with `{ runId, report }`:
@@ -240,7 +275,7 @@ concurrently and interleave their notifications — each notification carries it
 | `-32700` | Parse error (invalid JSON on a line). |
 | `-32600` | Invalid request (not a well-formed JSON-RPC 2.0 request). |
 | `-32601` | Method not found. |
-| `-32602` | Invalid params (includes `resolveInvestigation` input errors — e.g. no alert/query, unknown or unbuilt harness). |
+| `-32602` | Invalid params (includes an invalid `sandbox` mode or `maxTurns` value, and `resolveInvestigation` input errors — e.g. no alert/query, unknown or unbuilt harness). |
 | `-32603` | Internal error (mid-stream failure; `data` carries `{ runId }`). |
 | `-32000` | No evidence — the harness branch failed and produced no report (`data` carries `{ runId }`). |
 
@@ -269,7 +304,8 @@ var is an error).
 # Tier-2 harness backend the supervisor rents (ADR-0008).
 agent:
   default: deepagents            # deepagents | claude-code | codex
-  # model: openai:gpt-oss:120b   # provider-prefixed; omit to let the harness default
+  # model: gpt-oss:120b          # bare id — the harness applies its own provider
+                                 # prefix; omit to let the harness default
   sandbox: auto                  # auto | process | srt — isolation boundary (ADR-0020).
                                  # auto (default): srt (enforced OS boundary) WHEN its
                                  # egress bridge is healthy (a self-check catches WSL
@@ -278,19 +314,19 @@ agent:
 
 # Read-only telemetry + app endpoints the harness may query.
 telemetry:
-  prometheusUrl: http://localhost:9090
-  alertmanagerUrl: http://localhost:9093
-  apiUrl: http://localhost:3000
+  prometheus_url: http://localhost:9090
+  alertmanager_url: http://localhost:9093
+  api_url: http://localhost:3000
 
 # Where runs, events, and reports are stored.
 workspace:
-  base_dir: ~/.prismalens
+  dir: ~/.prismalens
 
 # Per-harness native passthrough (ADR-0017) — untyped, forwarded straight to the
 # rented harness. For `deepagents` (the npm `deepagents-acp` binary, driven over
 # ACP), `args` is appended verbatim to the CLI invocation. The binary has no
-# shell-allowlist or sandbox flags — read-only is cooperative until the Sandbox
-# port's enforced providers land (ADR-0020/B.1).
+# shell-allowlist or sandbox flags — so the harness is unsandboxed (runs as you)
+# until the Sandbox port's enforced providers land (ADR-0020/B.1).
 harnesses:
   deepagents:
     native:
@@ -298,10 +334,13 @@ harnesses:
 ```
 
 Notes:
-- `agent.model` in config is a **provider-prefixed** id (e.g. `openai:gpt-oss:120b`).
-  The `--model` flag passes a **bare** id (e.g. `gpt-oss:120b`); for `deepagents` the
-  CLI prefixes it with `openai:`.
-- `telemetry.*` defaults to host-local URLs when unset.
+- `agent.model` sets the **Tier-2 harness** model only (a bare id, e.g. `gpt-oss:120b`;
+  each harness applies its own provider prefix). `--model` overrides it.
+- `synth.model` sets the **Tier-1 reduce** (report-synthesis) model — a separate call
+  to a separate provider (ADR-0013/0016). `agent.model` never feeds it, so a harness on
+  one provider (e.g. `claude-code`) can't misroute the reduce call to another (ollama).
+- `telemetry.*` keys are snake_case (`prometheus_url`, `alertmanager_url`, `api_url`)
+  and default to host-local URLs when unset.
 - There is currently no `agent.timeout_ms`, `budget.*`, or `logging.*` config —
   an overall per-run wall-clock budget and a Tier-1 reduce token/retry budget are
   planned alongside the Phase B.1 Sandbox port's resource limits (ADR-0020), not
@@ -309,7 +348,16 @@ Notes:
 
 ### BYO-key environment (ADR-0006)
 
-Credentials are read from the environment, never stored by the CLI.
+Credentials are BYO-key and never hard-bound in the CLI. They can be read from the environment or stored locally via the `auth` command.
+
+The resolution precedence for any credential is: **env** (`PROVIDER_API_KEY`) → **_FILE** (`PROVIDER_API_KEY_FILE`) → **stored** (from `auth.json`) → **none**.
+
+**Auth commands:**
+- `pl auth login <provider> [--api-key <key>]` — save a credential (prompts securely if `--api-key` is omitted).
+- `pl auth list` — view saved providers.
+- `pl auth logout <provider>` — remove a saved credential.
+
+Stored credentials live in `auth.json` inside the app-data dir (`~/.prismalens` by default, honors `PRISMALENS_WORKSPACE_DIR`), enforced to mode `0600`.
 
 - **Tier-1 reduce + the `deepagents` harness** use an OpenAI-compatible endpoint:
   - `OLLAMA_API_KEY` or `OPENAI_API_KEY` (the API key),
@@ -318,5 +366,5 @@ Credentials are read from the environment, never stored by the CLI.
 - **The `claude-code` harness** uses your signed-in `~/.claude` session, or
   `ANTHROPIC_API_KEY`.
 
-If no `OLLAMA_API_KEY` / `OPENAI_API_KEY` is set, the reduce (synthesis) call will
+If no matching credential is found across the resolution chain, the reduce (synthesis) call will
 likely fail — `investigate` warns up front, and `doctor` checks for a credential.

package/dist/bin/prismalens.js

@@ -6,22 +6,22 @@
  * app + API drive it). Command bodies live in ../src/cli/* and are loaded lazily so
  * a fast `--help` doesn't pull in the engine. Bodies are implemented separately.
  */
-import { defineCommand, runMain } from "citty";
+import { defineCommand, runMain, showUsage } from "citty";
+import consola from "consola";
 import { cliVersion } from "../src/version.js";
 // The AI SDK's one-time "AI SDK Warning System" banner prints via console.info
 // (STDOUT) mid-run — noise in the live timeline and corruption in piped JSON.
 // Off for the whole CLI; real per-warning notices still reach stderr via
 // process.emitWarning.
 globalThis.AI_SDK_LOG_WARNINGS = false;
-const originalWarningListeners = process.listeners("warning");
-process.removeAllListeners("warning");
-process.on("warning", (warning) => {
-    if (warning.name === "ExperimentalWarning" &&
-        warning.message.includes("SQLite"))
-        return;
-    for (const listener of originalWarningListeners) {
-        listener(warning);
+const originalEmit = process.emit;
+process.emit = ((name, ...args) => {
+    if (name === "warning" &&
+        args[0]?.name === "ExperimentalWarning" &&
+        args[0]?.message?.includes("SQLite")) {
+        return false;
     }
+    return originalEmit.apply(process, [name, ...args]);
 });
 /** Lazily import a command body's default export from src/cli. */
 const lazy = (name) => () => import(`../src/cli/${name}.js`).then((m) => m.default);
@@ -39,7 +39,21 @@ const main = defineCommand({
         init: lazy("init"),
         status: lazy("status"),
         report: lazy("report"),
+        auth: lazy("auth"),
+    },
+});
+runMain(main, {
+    showUsage: async (cmd, parent) => {
+        const rawArgs = process.argv.slice(2);
+        if (rawArgs.includes("--help") ||
+            rawArgs.includes("-h") ||
+            rawArgs.length === 0) {
+            await showUsage(cmd, parent);
+        }
+        else {
+            const cmdName = `pl${rawArgs[0] && !rawArgs[0].startsWith("-") ? ` ${rawArgs[0]}` : ""}`;
+            consola.info(`Run \`${cmdName} --help\` for usage.`);
+        }
     },
 });
-runMain(main);
 //# sourceMappingURL=prismalens.js.map

package/dist/bin/prismalens.js.map

@@ -1 +1 @@
-{"version":3,"file":"prismalens.js","sourceRoot":"","sources":["../../bin/prismalens.ts"],"names":[],"mappings":";AACA,sCAAsC;AACtC,6BAA6B;AAE7B;;;;GAIG;AACH,OAAO,EAAmB,aAAa,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,+EAA+E;AAC/E,8EAA8E;AAC9E,yEAAyE;AACzE,uBAAuB;AACtB,UAAgD,CAAC,mBAAmB,GAAG,KAAK,CAAC;AAE9E,MAAM,wBAAwB,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;AAC9D,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;AACtC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAc,EAAE,EAAE;IACxC,IACC,OAAO,CAAC,IAAI,KAAK,qBAAqB;QACtC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAElC,OAAO;IACR,KAAK,MAAM,QAAQ,IAAI,wBAAwB,EAAE,CAAC;QACjD,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;AACF,CAAC,CAAC,CAAC;AAEH,kEAAkE;AAClE,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAwB,EAAE,CACxD,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAqB,CAAC,CAAC;AAEtE,MAAM,IAAI,GAAG,aAAa,CAAC;IAC1B,IAAI,EAAE;QACL,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,UAAU,EAAE;QACrB,WAAW,EACV,mFAAmF;KACpF;IACD,WAAW,EAAE;QACZ,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;QAChC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;QACtB,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;QACpB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;QACtB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;QACtB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;KACtB;CACD,CAAC,CAAC;AAEH,OAAO,CAAC,IAAI,CAAC,CAAC"}
+{"version":3,"file":"prismalens.js","sourceRoot":"","sources":["../../bin/prismalens.ts"],"names":[],"mappings":";AACA,sCAAsC;AACtC,6BAA6B;AAE7B;;;;GAIG;AACH,OAAO,EAAmB,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAC3E,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,+EAA+E;AAC/E,8EAA8E;AAC9E,yEAAyE;AACzE,uBAAuB;AACtB,UAAgD,CAAC,mBAAmB,GAAG,KAAK,CAAC;AAE9E,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;AAClC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,IAAY,EAAE,GAAG,IAAe,EAAE,EAAE;IACpD,IACC,IAAI,KAAK,SAAS;QACjB,IAAI,CAAC,CAAC,CAAW,EAAE,IAAI,KAAK,qBAAqB;QACjD,IAAI,CAAC,CAAC,CAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAC9C,CAAC;QACF,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,CAEhD,CAAC,CAAC;AACJ,CAAC,CAAwB,CAAC;AAE1B,kEAAkE;AAClE,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAwB,EAAE,CACxD,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAqB,CAAC,CAAC;AAEtE,MAAM,IAAI,GAAG,aAAa,CAAC;IAC1B,IAAI,EAAE;QACL,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,UAAU,EAAE;QACrB,WAAW,EACV,mFAAmF;KACpF;IACD,WAAW,EAAE;QACZ,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;QAChC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;QACtB,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;QACpB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;QACtB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;QACtB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;QACtB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;KAClB;CACD,CAAC,CAAC;AAEH,OAAO,CAAC,IAAI,EAAE;IACb,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAChC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtC,IACC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YACtB,OAAO,CAAC,MAAM,KAAK,CAAC,EACnB,CAAC;YACF,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACP,MAAM,OAAO,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACzF,OAAO,CAAC,IAAI,CAAC,SAAS,OAAO,sBAAsB,CAAC,CAAC;QACtD,CAAC;IACF,CAAC;CACD,CAAC,CAAC"}

package/dist/src/cli/auth.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("citty").CommandDef<import("citty").ArgsDef>;
+export default _default;
+//# sourceMappingURL=auth.d.ts.map

package/dist/src/cli/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/auth.ts"],"names":[],"mappings":";AA+GA,wBAUG"}

package/dist/src/cli/auth.js

@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Sumit Patel
+import { removeStoredCredential, setStoredCredential, } from "@prismalens/config/auth";
+import { resolveCredentials } from "@prismalens/config/credentials";
+import { LLM_PROVIDERS } from "@prismalens/config/llm";
+import { defineCommand } from "citty";
+import consola from "consola";
+const login = defineCommand({
+    meta: {
+        name: "login",
+        description: "Log in to a model provider",
+    },
+    args: {
+        provider: {
+            type: "positional",
+            description: "Provider ID (e.g. openai, anthropic)",
+            required: true,
+        },
+        "api-key": {
+            type: "string",
+            description: "API key",
+        },
+    },
+    async run({ args }) {
+        const provider = args.provider;
+        if (!Object.hasOwn(LLM_PROVIDERS, provider)) {
+            consola.error(`Unknown provider: ${provider}`);
+            process.exit(1);
+        }
+        let apiKey = args["api-key"];
+        if (!apiKey) {
+            if (process.stdin.isTTY) {
+                apiKey = (await consola.prompt(`Enter API key for ${LLM_PROVIDERS[provider].name}:`, {
+                    // @ts-expect-error type password passes through to clack
+                    type: "password",
+                }));
+            }
+            else {
+                consola.error("--api-key is required in non-interactive mode");
+                process.exit(1);
+            }
+        }
+        if (!apiKey || typeof apiKey !== "string" || !apiKey.trim()) {
+            consola.error("API key is required");
+            process.exit(1);
+        }
+        setStoredCredential(provider, apiKey.trim());
+        consola.success(`Saved credential for ${LLM_PROVIDERS[provider].name}`);
+    },
+});
+const list = defineCommand({
+    meta: {
+        name: "list",
+        description: "List configured providers",
+    },
+    async run() {
+        for (const provider of Object.values(LLM_PROVIDERS)) {
+            const creds = resolveCredentials(provider.id);
+            if (creds.source !== "none") {
+                const key = creds.apiKey ?? "";
+                const masked = key.length > 4 ? `...${key.slice(-4)}` : "<set>";
+                consola.log(`${provider.name} (${provider.id})`);
+                consola.log(`  Source: ${creds.source}`);
+                consola.log(`  Key:    ${masked}`);
+                consola.log("");
+            }
+            else {
+                consola.log(`${provider.name} (${provider.id})`);
+                consola.log(`  Source: none`);
+                consola.log("");
+            }
+        }
+    },
+});
+const logout = defineCommand({
+    meta: {
+        name: "logout",
+        description: "Remove stored credential",
+    },
+    args: {
+        provider: {
+            type: "positional",
+            description: "Provider ID",
+            required: true,
+        },
+    },
+    async run({ args }) {
+        const provider = args.provider;
+        if (!Object.hasOwn(LLM_PROVIDERS, provider)) {
+            consola.error(`Unknown provider: ${provider}`);
+            process.exit(1);
+        }
+        removeStoredCredential(provider);
+        consola.success(`Removed stored credential for ${LLM_PROVIDERS[provider].name}`);
+    },
+});
+export default defineCommand({
+    meta: {
+        name: "auth",
+        description: "Manage provider credentials",
+    },
+    subCommands: {
+        login,
+        list,
+        logout,
+    },
+});
+//# sourceMappingURL=auth.js.map

package/dist/src/cli/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/cli/auth.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,6BAA6B;AAE7B,OAAO,EACN,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAsB,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,MAAM,KAAK,GAAG,aAAa,CAAC;IAC3B,IAAI,EAAE;QACL,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,4BAA4B;KACzC;IACD,IAAI,EAAE;QACL,QAAQ,EAAE;YACT,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,sCAAsC;YACnD,QAAQ,EAAE,IAAI;SACd;QACD,SAAS,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,SAAS;SACtB;KACD;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAyB,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAC7B,qBAAqB,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,EACpD;oBACC,yDAAyD;oBACzD,IAAI,EAAE,UAAU;iBAChB,CACD,CAAsB,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;QACF,CAAC;QAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QAED,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,OAAO,CAAC,wBAAwB,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;CACD,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,aAAa,CAAC;IAC1B,IAAI,EAAE;QACL,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,2BAA2B;KACxC;IACD,KAAK,CAAC,GAAG;QACR,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;gBAChE,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;gBACjD,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;gBACjD,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;QACF,CAAC;IACF,CAAC;CACD,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,aAAa,CAAC;IAC5B,IAAI,EAAE;QACL,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0BAA0B;KACvC;IACD,IAAI,EAAE;QACL,QAAQ,EAAE;YACT,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,aAAa;YAC1B,QAAQ,EAAE,IAAI;SACd;KACD;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAyB,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QAED,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,CAAC,OAAO,CACd,iCAAiC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAC/D,CAAC;IACH,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,aAAa,CAAC;IAC5B,IAAI,EAAE;QACL,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,6BAA6B;KAC1C;IACD,WAAW,EAAE;QACZ,KAAK;QACL,IAAI;QACJ,MAAM;KACN;CACD,CAAC,CAAC"}

package/dist/src/cli/doctor.d.ts

@@ -5,6 +5,7 @@ interface Check {
     detail: string;
     hard: boolean;
 }
+export declare function checkCredential(config: PlConfig, noPing: boolean): Promise<Check>;
 export declare function checkListenToken(config: PlConfig): Check;
 declare const _default: import("citty").CommandDef<{
     readonly ping: {

package/dist/src/cli/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../../src/cli/doctor.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAMpD,UAAU,KAAK;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACd;AA8HD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,KAAK,CAgBxD;;;;;;;;AAED,wBAoDG"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../../src/cli/doctor.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAMpD,UAAU,KAAK;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACd;AAmCD,wBAAsB,eAAe,CACpC,MAAM,EAAE,QAAQ,EAChB,MAAM,EAAE,OAAO,GACb,OAAO,CAAC,KAAK,CAAC,CAiEhB;AAuBD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,KAAK,CAgBxD;;;;;;;;AAED,wBAoDG"}

package/dist/src/cli/doctor.js

@@ -10,7 +10,7 @@
  *  - HARD: an LLM credential is present
  *      (any provider credential env var from LLM_PROVIDERS, or, for claude-code,
  *       a signed-in ~/.claude/.credentials.json)
- *  - SOFT: workspace.base_dir is writable
+ *  - SOFT: workspace.dir is writable
  *
  * Prints pass/fail per check; exits non-zero iff a HARD check fails. No tinyexec /
  * check-tool helper here — availability is a dependency-free PATH scan.
@@ -59,7 +59,7 @@ function checkHarness(harness) {
         hard: true,
     };
 }
-async function checkCredential(config, noPing) {
+export async function checkCredential(config, noPing) {
     let providerId = config.synth.provider;
     let creds;
     if (providerId) {
@@ -118,7 +118,7 @@ async function checkCredential(config, noPing) {
     }
 }
 async function checkWorkspace(config) {
-    const baseDir = resolveBaseDir(config.workspace.base_dir);
+    const baseDir = resolveBaseDir(config.workspace.dir);
     try {
         await mkdir(baseDir, { recursive: true });
         await access(baseDir, fsConstants.W_OK);

package/dist/src/cli/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,6BAA6B;AAE7B;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EACN,wBAAwB,EACxB,aAAa,GAEb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAW9C,SAAS,QAAQ,CAAC,GAAW;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,IAAI,GACT,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC3B,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAC3D,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC;gBACJ,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;gBACnD,OAAO,IAAI,CAAC;YACb,CAAC;YAAC,MAAM,CAAC;gBACR,eAAe;YAChB,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB;IACrC,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO;QACN,IAAI,EAAE,gBAAgB;QACtB,IAAI;QACJ,MAAM,EAAE,IAAI;YACX,CAAC,CAAC,GAAG,MAAM,4BAA4B,OAAO,GAAG;YACjD,CAAC,CAAC,GAAG,MAAM,qCAAqC,OAAO,WAAW;QACnE,IAAI,EAAE,IAAI;KACV,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,MAAgB,EAChB,MAAe;IAEf,IAAI,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;IACvC,IAAI,KAAwD,CAAC;IAE7D,IAAI,UAAU,EAAE,CAAC;QAChB,KAAK,GAAG,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACP,KAAK,MAAM,EAAE,IAAI,wBAAwB,EAAE,CAAC;YAC3C,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAChE,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACjC,UAAU,GAAG,EAAE,CAAC;gBAChB,KAAK,GAAG,SAAS,CAAC;gBAClB,MAAM;YACP,CAAC;QACF,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,KAAK,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACjD,UAAU,GAAG,QAAQ,CAAC;QACvB,CAAC;IACF,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,gEAAgE;YACxE,IAAI,EAAE,KAAK;SACX,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,aAAa,CAAC,UAA2B,CAAC,CAAC,IAAI,CAAC;IAErE,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,YAAY,aAAa,KAAK,CAAC,MAAM,kBAAkB;YAClE,IAAI,EAAE,KAAK;SACX,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAC3B,UAA2B,EAC3B,MAAM,CAAC,KAAK,CAAC,KAAK,EAClB;QACC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;KACtB,CACD,CAAC;IAEF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,YAAY,aAAa,KAAK,CAAC,MAAM,aAAa;YAC7D,IAAI,EAAE,KAAK;SACX,CAAC;IACH,CAAC;SAAM,CAAC;QACP,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,YAAY,aAAa,KAAK,CAAC,MAAM,oBAAoB,IAAI,CAAC,KAAK,EAAE;YAChF,IAAI,EAAE,IAAI;SACV,CAAC;IACH,CAAC;AACF,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAAgB;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,OAAO,cAAc;YAChC,IAAI,EAAE,KAAK;SACX,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,OAAO,6CAA6C;YAC/D,IAAI,EAAE,KAAK;SACX,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAgB;IAChD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO;YACN,IAAI,EAAE,eAAe;YACrB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,sDAAsD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YAClF,IAAI,EAAE,KAAK;SACX,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,KAAK;QACX,MAAM,EACL,uGAAuG;QACxG,IAAI,EAAE,KAAK;KACX,CAAC;AACH,CAAC;AAED,eAAe,aAAa,CAAC;IAC5B,IAAI,EAAE;QACL,IAAI,EAAE,QAAQ;QACd,WAAW,EACV,qFAAqF;KACtF;IACD,IAAI,EAAE;QACL,uEAAuE;QACvE,uCAAuC;QACvC,IAAI,EAAE;YACL,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,uDAAuD;YACpE,OAAO,EAAE,IAAI;SACb;KACD;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;QACtB,IAAI,CAAC;YACJ,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAE5B,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;YACrC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAE1B,MAAM,MAAM,GAAY;gBACvB,YAAY,CAAC,OAAO,CAAC;gBACrB,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC;gBACrC,MAAM,cAAc,CAAC,MAAM,CAAC;gBAC5B,gBAAgB,CAAC,MAAM,CAAC;aACxB,CAAC;YAEF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC9C,IAAI,KAAK,CAAC,IAAI;oBAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;qBACjC,IAAI,KAAK,CAAC,IAAI;oBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;;oBACpC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEhB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,KAAK,CACZ,GAAG,YAAY,CAAC,MAAM,iEAAiE,CACvF,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACF,CAAC;CACD,CAAC,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,6BAA6B;AAE7B;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EACN,wBAAwB,EACxB,aAAa,GAEb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAW9C,SAAS,QAAQ,CAAC,GAAW;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,IAAI,GACT,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC3B,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAC3D,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC;gBACJ,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;gBACnD,OAAO,IAAI,CAAC;YACb,CAAC;YAAC,MAAM,CAAC;gBACR,eAAe;YAChB,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB;IACrC,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO;QACN,IAAI,EAAE,gBAAgB;QACtB,IAAI;QACJ,MAAM,EAAE,IAAI;YACX,CAAC,CAAC,GAAG,MAAM,4BAA4B,OAAO,GAAG;YACjD,CAAC,CAAC,GAAG,MAAM,qCAAqC,OAAO,WAAW;QACnE,IAAI,EAAE,IAAI;KACV,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,MAAgB,EAChB,MAAe;IAEf,IAAI,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;IACvC,IAAI,KAAwD,CAAC;IAE7D,IAAI,UAAU,EAAE,CAAC;QAChB,KAAK,GAAG,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACP,KAAK,MAAM,EAAE,IAAI,wBAAwB,EAAE,CAAC;YAC3C,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAChE,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACjC,UAAU,GAAG,EAAE,CAAC;gBAChB,KAAK,GAAG,SAAS,CAAC;gBAClB,MAAM;YACP,CAAC;QACF,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,KAAK,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACjD,UAAU,GAAG,QAAQ,CAAC;QACvB,CAAC;IACF,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,gEAAgE;YACxE,IAAI,EAAE,KAAK;SACX,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,aAAa,CAAC,UAA2B,CAAC,CAAC,IAAI,CAAC;IAErE,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,YAAY,aAAa,KAAK,CAAC,MAAM,kBAAkB;YAClE,IAAI,EAAE,KAAK;SACX,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAC3B,UAA2B,EAC3B,MAAM,CAAC,KAAK,CAAC,KAAK,EAClB;QACC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;KACtB,CACD,CAAC;IAEF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,YAAY,aAAa,KAAK,CAAC,MAAM,aAAa;YAC7D,IAAI,EAAE,KAAK;SACX,CAAC;IACH,CAAC;SAAM,CAAC;QACP,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,YAAY,aAAa,KAAK,CAAC,MAAM,oBAAoB,IAAI,CAAC,KAAK,EAAE;YAChF,IAAI,EAAE,IAAI;SACV,CAAC;IACH,CAAC;AACF,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAAgB;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,OAAO,cAAc;YAChC,IAAI,EAAE,KAAK;SACX,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,OAAO,6CAA6C;YAC/D,IAAI,EAAE,KAAK;SACX,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAgB;IAChD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO;YACN,IAAI,EAAE,eAAe;YACrB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,sDAAsD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YAClF,IAAI,EAAE,KAAK;SACX,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,KAAK;QACX,MAAM,EACL,uGAAuG;QACxG,IAAI,EAAE,KAAK;KACX,CAAC;AACH,CAAC;AAED,eAAe,aAAa,CAAC;IAC5B,IAAI,EAAE;QACL,IAAI,EAAE,QAAQ;QACd,WAAW,EACV,qFAAqF;KACtF;IACD,IAAI,EAAE;QACL,uEAAuE;QACvE,uCAAuC;QACvC,IAAI,EAAE;YACL,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,uDAAuD;YACpE,OAAO,EAAE,IAAI;SACb;KACD;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;QACtB,IAAI,CAAC;YACJ,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAE5B,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;YACrC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAE1B,MAAM,MAAM,GAAY;gBACvB,YAAY,CAAC,OAAO,CAAC;gBACrB,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC;gBACrC,MAAM,cAAc,CAAC,MAAM,CAAC;gBAC5B,gBAAgB,CAAC,MAAM,CAAC;aACxB,CAAC;YAEF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC9C,IAAI,KAAK,CAAC,IAAI;oBAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;qBACjC,IAAI,KAAK,CAAC,IAAI;oBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;;oBACpC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEhB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,KAAK,CACZ,GAAG,YAAY,CAAC,MAAM,iEAAiE,CACvF,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACF,CAAC;CACD,CAAC,CAAC"}

package/dist/src/cli/flags.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flags.d.ts","sourceRoot":"","sources":["../../../src/cli/flags.ts"],"names":[],"mappings":"AASA,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,QAmB3E"}
+{"version":3,"file":"flags.d.ts","sourceRoot":"","sources":["../../../src/cli/flags.ts"],"names":[],"mappings":"AAaA,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,QAuB3E"}

package/dist/src/cli/flags.js

@@ -4,6 +4,9 @@ import consola from "consola";
 function kebabToCamel(str) {
     return str.replace(/-([a-z])/g, (_, g) => g.toUpperCase());
 }
+function camelToKebab(str) {
+    return str.replace(/([a-z])([A-Z])/g, "$1-$2").toLowerCase();
+}
 export function assertKnownFlags(args, cmd) {
     const declaredArgs = cmd?.args || {};
     const allowedKeys = new Set(["_"]);
@@ -11,12 +14,16 @@ export function assertKnownFlags(args, cmd) {
         if (Object.hasOwn(declaredArgs, key)) {
             allowedKeys.add(key);
             allowedKeys.add(kebabToCamel(key));
+            allowedKeys.add(camelToKebab(key));
         }
     }
     for (const key in args) {
         if (Object.hasOwn(args, key)) {
             if (!allowedKeys.has(key)) {
                 consola.error(`Unknown option: --${key}`);
+                const rawArgs = process.argv.slice(2);
+                const cmdName = `pl${rawArgs[0] && !rawArgs[0].startsWith("-") ? ` ${rawArgs[0]}` : ""}`;
+                consola.info(`Run \`${cmdName} --help\` for usage.`);
                 process.exit(1);
             }
         }

package/dist/src/cli/flags.js.map

@@ -1 +1 @@
-{"version":3,"file":"flags.js","sourceRoot":"","sources":["../../../src/cli/flags.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,6BAA6B;AAE7B,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,SAAS,YAAY,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAA6B,EAAE,GAAY;IAC3E,MAAM,YAAY,GAAI,GAA0C,EAAE,IAAI,IAAI,EAAE,CAAC;IAC7E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3C,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC;YACtC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,CAAC;IACF,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"flags.js","sourceRoot":"","sources":["../../../src/cli/flags.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,6BAA6B;AAE7B,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,SAAS,YAAY,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAA6B,EAAE,GAAY;IAC3E,MAAM,YAAY,GAAI,GAA0C,EAAE,IAAI,IAAI,EAAE,CAAC;IAC7E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3C,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC;YACtC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;YACnC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,CAAC;IACF,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;gBAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtC,MAAM,OAAO,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACzF,OAAO,CAAC,IAAI,CAAC,SAAS,OAAO,sBAAsB,CAAC,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/src/cli/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../src/cli/init.ts"],"names":[],"mappings":";AAiFA,wBA8BG"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../src/cli/init.ts"],"names":[],"mappings":";AAkFA,wBA8BG"}

package/dist/src/cli/init.js

@@ -41,9 +41,9 @@ agent:
 # Read-only telemetry + app endpoints the harness may query. Point these at your
 # stack; defaults assume a local dev setup.
 telemetry:
-  prometheusUrl: ${INVESTIGATION_DEFAULTS.telemetry.prometheusUrl}
-  alertmanagerUrl: ${INVESTIGATION_DEFAULTS.telemetry.alertmanagerUrl}
-  apiUrl: ${INVESTIGATION_DEFAULTS.telemetry.apiUrl}
+  prometheus_url: ${INVESTIGATION_DEFAULTS.telemetry.prometheusUrl}
+  alertmanager_url: ${INVESTIGATION_DEFAULTS.telemetry.alertmanagerUrl}
+  api_url: ${INVESTIGATION_DEFAULTS.telemetry.apiUrl}
 
 # Read-only log-query system the harness may curl (Loki, Elasticsearch, …).
 # logs:
@@ -61,11 +61,12 @@ telemetry:
 
 # Where runs, events, and reports are stored.
 workspace:
-  base_dir: ${d.workspace.base_dir}
+  dir: ${d.workspace.dir}
 
 # \`pl listen\` — token-authed local webhook intake (Alertmanager). The token is
-# REQUIRED to start listening; keep it out of the file via env interpolation.
+# REQUIRED to start listening regardless of bind address; keep it out of the file via env interpolation.
 # listen:
+#   host: ${d.listen.host}
 #   port: ${d.listen.port}
 #   token: "\${PRISMALENS_LISTEN_TOKEN}"
 #   max_pending: ${d.listen.max_pending}
@@ -74,7 +75,7 @@ workspace:
 export default defineCommand({
     meta: {
         name: "init",
-        description: `Scaffold a ${CONFIG_FILENAME} in the current directory`,
+        description: `Scaffold a ${CONFIG_FILENAME} in the current directory\n\nExamples:\n  $ pl init\n  $ pl init --force`,
     },
     async run({ args, cmd }) {
         try {

package/dist/src/cli/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/cli/init.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,6BAA6B;AAE7B;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EACN,iBAAiB,EAEjB,cAAc,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAEjD,oFAAoF;AACpF,SAAS,mBAAmB,CAAC,CAAW;IACvC,MAAM,cAAc,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO;SACpD,aAAa,EAAE;SACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,OAAO;;;;;;;;;;mCAU2B,cAAc;aACpC,CAAC,CAAC,KAAK,CAAC,OAAO;;;;;;;;mBAQT,sBAAsB,CAAC,SAAS,CAAC,aAAa;qBAC5C,sBAAsB,CAAC,SAAS,CAAC,eAAe;YACzD,sBAAsB,CAAC,SAAS,CAAC,MAAM;;;;;;;;;;;;;;;;;;cAkBrC,CAAC,CAAC,SAAS,CAAC,QAAQ;;;;;YAKtB,CAAC,CAAC,MAAM,CAAC,IAAI;;mBAEN,CAAC,CAAC,MAAM,CAAC,WAAW;CACtC,CAAC;AACF,CAAC;AAED,eAAe,aAAa,CAAC;IAC5B,IAAI,EAAE;QACL,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,cAAc,eAAe,2BAA2B;KACrE;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;QACtB,IAAI,CAAC;YACJ,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;YAC3D,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CACX,GAAG,eAAe,sBAAsB,UAAU,0BAA0B,CAC5E,CAAC;gBACF,OAAO;YACR,CAAC;YAED,2EAA2E;YAC3E,iEAAiE;YACjE,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1C,MAAM,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;YAEpE,OAAO,CAAC,OAAO,CAAC,WAAW,UAAU,EAAE,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CACX,kFAAkF,CAClF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACF,CAAC;CACD,CAAC,CAAC"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/cli/init.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,6BAA6B;AAE7B;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EACN,iBAAiB,EAEjB,cAAc,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAEjD,oFAAoF;AACpF,SAAS,mBAAmB,CAAC,CAAW;IACvC,MAAM,cAAc,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO;SACpD,aAAa,EAAE;SACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,OAAO;;;;;;;;;;mCAU2B,cAAc;aACpC,CAAC,CAAC,KAAK,CAAC,OAAO;;;;;;;;oBAQR,sBAAsB,CAAC,SAAS,CAAC,aAAa;sBAC5C,sBAAsB,CAAC,SAAS,CAAC,eAAe;aACzD,sBAAsB,CAAC,SAAS,CAAC,MAAM;;;;;;;;;;;;;;;;;;SAkB3C,CAAC,CAAC,SAAS,CAAC,GAAG;;;;;YAKZ,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,MAAM,CAAC,IAAI;;mBAEN,CAAC,CAAC,MAAM,CAAC,WAAW;CACtC,CAAC;AACF,CAAC;AAED,eAAe,aAAa,CAAC;IAC5B,IAAI,EAAE;QACL,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,cAAc,eAAe,0EAA0E;KACpH;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;QACtB,IAAI,CAAC;YACJ,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;YAC3D,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CACX,GAAG,eAAe,sBAAsB,UAAU,0BAA0B,CAC5E,CAAC;gBACF,OAAO;YACR,CAAC;YAED,2EAA2E;YAC3E,iEAAiE;YACjE,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1C,MAAM,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;YAEpE,OAAO,CAAC,OAAO,CAAC,WAAW,UAAU,EAAE,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CACX,kFAAkF,CAClF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACF,CAAC;CACD,CAAC,CAAC"}

package/dist/src/cli/investigate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"investigate.d.ts","sourceRoot":"","sources":["../../../src/cli/investigate.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE9E,OAAO,KAAK,EACX,cAAc,EAKd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAIN,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWpD,wBAyQG;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,EAAE,CA0BhE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,SAAS,EAClB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,QAAQ,GACd,OAAO,CAAC;IACV,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACnC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gFAAgF;IAChF,eAAe,EAAE,OAAO,CAAC;CACzB,CAAC,CAyBD;AA2BD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,SAAS,EAClB,IAAI,EAAE,WAAW,GACf;IAAE,YAAY,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAI7C;AAMD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAkBtE"}
+{"version":3,"file":"investigate.d.ts","sourceRoot":"","sources":["../../../src/cli/investigate.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE9E,OAAO,KAAK,EACX,cAAc,EAKd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAIN,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWpD,wBAyQG;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,EAAE,CA0BhE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,SAAS,EAClB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,QAAQ,GACd,OAAO,CAAC;IACV,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACnC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gFAAgF;IAChF,eAAe,EAAE,OAAO,CAAC;CACzB,CAAC,CAyBD;AA2BD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,SAAS,EAClB,IAAI,EAAE,WAAW,GACf;IAAE,YAAY,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAI7C;AAMD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAkBtE"}

package/dist/src/cli/investigate.js

@@ -3,15 +3,16 @@
 /**
  * `prismalens investigate` — the core investigation command (ADR-0008/0010).
  *
- * Seeds a read-only root-cause investigation from a firing alert (piped on stdin
+ * Seeds a root-cause investigation from a firing alert (piped on stdin
  * as a FiringAlert JSON, or synthesized from `--query`), rents a Tier-2 harness
  * (deepagents over ACP, or Claude Code over the Agent SDK), drives the Tier-1
  * supervisor LIVE via the shared conductor (`conductRun`, ADR-0018), and renders
  * the ordered-evidence report (ADR-0002).
  *
  * BYO-key (ADR-0006): provider creds come from the environment
- * (OLLAMA_ / OPENAI_ vars), never hard-bound here. The harness investigates
- * READ-ONLY.
+ * (OLLAMA_ / OPENAI_ vars), never hard-bound here. The `read-only` posture is a
+ * GUARDRAIL (edit tools removed), not a boundary — Bash writes remain possible.
+ * The only real boundary is an enforced sandbox (ADR-0017 Amdt 3 / ADR-0020).
  *
  * LIVE (ADR-0007/0010): `conductRun` fans each CanonicalEvent to a file-session
  * STORE (append) and a terminal-line SINK, then this command renders the
@@ -36,7 +37,7 @@ import { assertKnownFlags } from "./flags.js";
 export default defineCommand({
     meta: {
         name: "investigate",
-        description: "Run a read-only root-cause investigation of a firing alert (two-tier engine, ADR-0008).\n\nExamples:\n  $ pl investigate -q 'Why did the database crash?' --max-turns 30",
+        description: "Run a root-cause investigation of a firing alert (two-tier engine, ADR-0008).\n\nExamples:\n  $ pl investigate -q 'Why did the database crash?' --max-turns 30",
     },
     args: {
         repo: {
@@ -191,10 +192,10 @@ export default defineCommand({
                 if (!synth.configured) {
                     info("No Tier-1 provider configured (checked env + _FILE for: ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_API_KEY, GROQ_API_KEY, OLLAMA_API_KEY) — reports will be RAW harness pass-through (un-synthesized). This is supported.");
                 }
-                // (2) Create the run workspace + session under workspace.base_dir, wrapped as
+                // (2) Create the run workspace + session under workspace.dir, wrapped as
                 // a conductRun store adapter (ADR-0018).
                 const runId = randomUUID();
-                const sessions = createSessionManager(config.workspace.base_dir);
+                const sessions = createSessionManager(config.workspace.dir);
                 const fileSession = createFileSessionStore(sessions, {
                     runId,
                     alertname: primaryAlert.alertname,
@@ -274,11 +275,11 @@ export function collectAllowedDomains(config) {
         INVESTIGATION_DEFAULTS.synth.baseURL;
     const urls = [
         llmBaseUrl,
-        config.telemetry.prometheusUrl ??
+        config.telemetry.prometheus_url ??
             INVESTIGATION_DEFAULTS.telemetry.prometheusUrl,
-        config.telemetry.alertmanagerUrl ??
+        config.telemetry.alertmanager_url ??
             INVESTIGATION_DEFAULTS.telemetry.alertmanagerUrl,
-        config.telemetry.apiUrl ?? INVESTIGATION_DEFAULTS.telemetry.apiUrl,
+        config.telemetry.api_url ?? INVESTIGATION_DEFAULTS.telemetry.apiUrl,
         config.logs.url,
     ];
     const hosts = new Set();
@@ -337,9 +338,9 @@ export async function resolveRunSandbox(harness, mode, config) {
  */
 function firstProbeUrl(config) {
     const urls = [
-        config.telemetry.prometheusUrl,
-        config.telemetry.alertmanagerUrl,
-        config.telemetry.apiUrl,
+        config.telemetry.prometheus_url,
+        config.telemetry.alertmanager_url,
+        config.telemetry.api_url,
         config.logs.url,
     ];
     for (const url of urls) {