project-athena 0.2.1 → 0.4.0

package/dist/program-CWJNGCTZ.js

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+import {
+  c,
+  dim,
+  getInterruptMessage,
+  isJson,
+  json,
+  line,
+  setOutputMode,
+  sym
+} from "./chunk-Z6QWMJLK.js";
+import {
+  ATHENA_VERSION
+} from "./chunk-2R6PXY6Z.js";
+import {
+  AthenaError,
+  EXIT
+} from "./chunk-AD4OZCU2.js";
+
+// src/cli/program.ts
+import { Command, Option } from "commander";
+var controller = new AbortController();
+var interrupted = false;
+function onSignal() {
+  if (interrupted) process.exit(EXIT.INTERRUPTED);
+  interrupted = true;
+  controller.abort(new Error("Interrupted"));
+  if (process.stdout.isTTY) process.stdout.write("\x1B[?25h");
+  if (!isJson()) process.stderr.write(`
+${c.yellow("Interrupted.")} ${dim(getInterruptMessage())}
+`);
+}
+process.stdout.on("error", (err) => {
+  if (err.code === "EPIPE") {
+    if (process.env.ATHENA_DEBUG) process.stderr.write("athena: stdout was closed by the reader (EPIPE); exiting quietly\n");
+    process.exit(0);
+  }
+  throw err;
+});
+process.on("SIGINT", onSignal);
+process.on("SIGTERM", onSignal);
+var PLANNED = [];
+function globals(cmd) {
+  return cmd.optsWithGlobals();
+}
+function run(fn) {
+  return async (...args) => {
+    const cmd = args[args.length - 1];
+    const g = globals(cmd);
+    setOutputMode({ json: g.json, quiet: g.quiet });
+    const code = await fn(...args);
+    if (typeof code === "number") process.exitCode = code;
+  };
+}
+function buildProgram() {
+  const program = new Command();
+  program.name("athena").description("Athena \u2014 local-first project intelligence for AI coding agents").version(ATHENA_VERSION, "-v, --version", "Print the Athena version").addOption(new Option("-C, --cwd <dir>", "Run as if started in <dir>")).option("--json", "Machine-readable JSON output").option("-q, --quiet", "Only print warnings, errors and results").option("--no-color", "Disable colors (also respects NO_COLOR)").showHelpAfterError("(run `athena --help` for usage)").configureHelp({ sortSubcommands: false });
+  program.command("init").description("Analyze the project and create .athena/ knowledge").option("--agents <list>", 'Agents to configure: comma-separated ids (claude-code, cursor, codex, copilot, gemini-cli, antigravity, windsurf, cline, agents-md), "all" or "none". Default: detected agents + AGENTS.md').option("--no-agents", "Do not configure any agent integration").option("--dry-run", "Analyze and show what would be written, without writing").action(
+    run(async (cmdOpts, cmd) => {
+      const g = globals(cmd);
+      await (await import("./init-WQCAOJ2R.js")).initCommand({ ...g, agents: typeof cmdOpts.agents === "string" ? cmdOpts.agents : void 0, noAgents: cmdOpts.agents === false, dryRun: cmdOpts.dryRun, signal: controller.signal });
+    })
+  );
+  program.command("analyze").description("Re-analyze the project and refresh generated knowledge (developer edits are preserved)").option("--force", "Regenerate sections even if they were edited by hand").option("--agents <list>", "Reconfigure these agent integrations").action(run(async (o, cmd) => (await import("./analyze-ZY3MXBOI.js")).analyzeCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  program.command("sync").description("Review and apply knowledge updates for changes since the last analysis").option("-y, --yes", "Apply without asking").option("--dry-run", "Show the plan without writing").option("--check", "Exit with code 1 if knowledge is out of date (for CI/hooks)").option("--staged", "With --check: check the staged knowledge against the staged code (the index), ignoring untracked and unstaged changes").option("--diff", "Print full diffs of proposed document changes").option("--force", "Also regenerate sections that were edited by hand").action(run(async (o, cmd) => (await import("./sync-KFJANRXF.js")).syncCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  program.command("watch").description("Watch the project and propose knowledge updates as files change").option("--auto-apply", "Apply updates automatically instead of proposing them").option("--debounce <ms>", "Quiet period before checking changes (default 1500)").action(run(async (o, cmd) => (await import("./watch-CY7QHIYN.js")).watchCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  program.command("context <task>").description("Show which knowledge an agent should read for a task (deterministic)").option("--full", "Print the full context an agent would receive").option("--max-chars <n>", "Character budget for selected sections").action(run(async (task, o, cmd) => (await import("./context-PLPCAPCO.js")).contextCommand(task, { ...globals(cmd), ...o, signal: controller.signal })));
+  program.command("graph").description("Inspect the project graph (packages, files, routes, entities and their relationships)").option("--build", "Rebuild the graph from the current code").option("--node <id>", "Show one node and its relationships").option("--kind <kind>", "Filter by node kind (package, file, route, entity, framework, command, infra)").option("--search <term>", "Filter nodes by name or path").action(run(async (o, cmd) => (await import("./context-PLPCAPCO.js")).graphCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  program.command("architecture").description("Summarize the project graph").action(run(async (_o, cmd) => (await import("./context-PLPCAPCO.js")).architectureCommand({ ...globals(cmd), signal: controller.signal })));
+  program.command("mcp").description("Serve Athena project intelligence over MCP (stdio) for AI agents").option("--allow-write", "Permit the update_knowledge tool to apply changes (read-only by default)").option("--no-memory-write", "Disable the remember tool (agents cannot record unreviewed memories)").action(run(async (o, cmd) => (await import("./mcp-U7EPH43L.js")).mcpCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  const ai = program.command("ai").description("Optional AI provider integration (never required)");
+  ai.command("status", { isDefault: true }).description("Show configured and available AI providers").action(run(async (_o, cmd) => (await import("./ai-ASL4FFQ7.js")).aiStatusCommand(globals(cmd))));
+  ai.command("enrich").description("Ask the configured provider for INFERRED suggestions based on your knowledge documents").option("--docs <list>", "Documents to send (default: project,architecture,database,api)").option("--consent", "Consent to sending redacted knowledge to a remote provider for this run").option("--dry-run", "Show exactly what would be sent, and send nothing").action(run(async (o, cmd) => (await import("./ai-ASL4FFQ7.js")).aiEnrichCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  program.command("security").description("Scan dependencies with the audit tools installed for this project, and report secret findings").option("--no-audit", "Skip dependency audits (report secrets only)").option("--fail-on <severity>", "Exit 1 when a finding at or above this severity exists (critical, high, moderate, low)").option("--last", "Show the last scan instead of running a new one").option("--unrated <policy>", 'With --fail-on: "fail" (default) also fails on findings the tool did not rate (pip-audit, govulncheck); "warn" only reports them', "fail").action(run(async (o, cmd) => (await import("./security-LME3XFL3.js")).securityCommand({ ...globals(cmd), noAudit: o.audit === false, failOn: o.failOn, unrated: o.unrated, last: o.last, signal: controller.signal })));
+  program.command("review").description("Check the current diff for facts worth reviewing, and list the project rules and checklist").option("--base <ref>", "Compare against this Git ref instead of the working tree").option("--staged", "Review only what is staged for commit (used by the pre-commit hook)").option("--no-sync", "Skip the knowledge freshness check").option("--no-fail", "Always exit 0, even when blockers are found").action(run(async (o, cmd) => (await import("./review-OOKXSYMP.js")).reviewCommand({ ...globals(cmd), base: o.base, staged: o.staged, noSync: o.sync === false, noFail: o.fail === false, signal: controller.signal })));
+  program.command("status").description("Show knowledge health and changes since the last analysis").action(run(async (_o, cmd) => (await import("./status-RR57ZNGI.js")).statusCommand({ ...globals(cmd), signal: controller.signal })));
+  program.command("doctor").description("Check the Athena installation, project and integrations").action(run(async (_o, cmd) => (await import("./doctor-BX677KRE.js")).doctorCommand(globals(cmd))));
+  const rules = program.command("rules").description("List and edit project rules (.athena/rules.md)");
+  rules.command("list", { isDefault: true }).description("List rules with their numbers").action(run(async (_o, cmd) => (await import("./rules-4FXJUCXB.js")).rulesListCommand(globals(cmd))));
+  rules.command("add <text>").description("Add a rule").option("-s, --section <name>", "Section heading", "General").action(run(async (text, o, cmd) => (await import("./rules-4FXJUCXB.js")).rulesAddCommand(text, { ...globals(cmd), ...o })));
+  rules.command("edit <number> <text>").description("Replace the text of a rule").action(run(async (n, text, _o, cmd) => (await import("./rules-4FXJUCXB.js")).rulesEditCommand(n, text, globals(cmd))));
+  rules.command("enable <number>").description("Enable a rule").action(run(async (n, _o, cmd) => (await import("./rules-4FXJUCXB.js")).rulesEnableCommand(n, globals(cmd))));
+  rules.command("disable <number>").description("Disable a rule without deleting it").action(run(async (n, _o, cmd) => (await import("./rules-4FXJUCXB.js")).rulesDisableCommand(n, globals(cmd))));
+  rules.command("remove <number>").description("Delete a rule").action(run(async (n, _o, cmd) => (await import("./rules-4FXJUCXB.js")).rulesRemoveCommand(n, globals(cmd))));
+  const repeat = (value, prev = []) => [...prev, ...value.split(",").map((s) => s.trim()).filter(Boolean)];
+  const mem = () => import("./memory-VSVNLEJC.js");
+  const memory = program.command("memory").description("Record, review and recall project memory (.athena/memory/)");
+  memory.command("list", { isDefault: true }).description("List memory entries with their label (FACT/INFERRED), status and staleness").option("--kind <kind>", "Only this kind (decision, gotcha, bug, convention, todo, fact)").option("--status <status>", "Only this status (unreviewed, confirmed, superseded)").option("--stale", "Only entries whose linked files changed since").action(run(async (o, cmd) => (await mem()).memoryListCommand({ ...globals(cmd), ...o })));
+  memory.command("show <id>").description("Show one entry in full: files, tags, evidence, staleness, warnings").action(run(async (id, _o, cmd) => (await mem()).memoryShowCommand(id, globals(cmd))));
+  memory.command("add").description("Record a memory as the developer (confirmed, FACT)").option("--kind <kind>", "decision, gotcha, bug, convention, todo or fact").option("--title <title>", "One-line summary").option("--details <text>", 'Longer explanation ("-" reads it from stdin)').option("--file <path>", "Linked project file (repeatable); the entry goes stale when it changes", repeat).option("--tag <tag>", "Tag (repeatable)", repeat).option("--evidence <text>", "Where this was observed (commit, issue, test, log)").option("--supersedes <id>", "Older memory this one replaces").action(run(async (o, cmd) => (await mem()).memoryAddCommand({ ...globals(cmd), ...o })));
+  memory.command("search <query>").description("Find entries whose title, details, tags or files contain the text").action(run(async (q, _o, cmd) => (await mem()).memorySearchCommand(q, globals(cmd))));
+  memory.command("recall <task...>").description("Rank the memory relevant to a task (what an agent would be given), with reasons").option("--file <path>", "File you are about to work on (repeatable)", repeat).option("--tag <tag>", "Tag to match (repeatable)", repeat).option("-n, --limit <count>", "Maximum entries (default 8)").action(run(async (task, o, cmd) => (await mem()).memoryRecallCommand(task, { ...globals(cmd), ...o })));
+  memory.command("confirm <ids...>").description("Confirm entries as FACT (and re-anchor them to the current files)").action(run(async (ids, _o, cmd) => (await mem()).memoryConfirmCommand(ids, globals(cmd))));
+  memory.command("supersede <id>").description("Mark an entry as replaced by a newer one (kept as history)").option("--by <id>", "The newer memory").action(run(async (id, o, cmd) => (await mem()).memorySupersedeCommand(id, { ...globals(cmd), ...o })));
+  memory.command("forget <ids...>").description("Delete entries").option("-y, --yes", "Skip confirmation").action(run(async (ids, o, cmd) => (await mem()).memoryForgetCommand(ids, { ...globals(cmd), ...o })));
+  memory.command("edit <id>").description("Change an entry (fields you pass replace the old values)").option("--title <title>", "New title").option("--details <text>", 'New details ("-" reads them from stdin)').option("--file <path>", "Linked files (repeatable; replaces the list)", repeat).option("--tag <tag>", "Tags (repeatable; replaces the list)", repeat).option("--evidence <text>", "New evidence").action(run(async (id, o, cmd) => (await mem()).memoryEditCommand(id, { ...globals(cmd), ...o })));
+  memory.command("stale").description("Entries whose linked files changed since they were recorded or confirmed").action(run(async (_o, cmd) => (await mem()).memoryStaleCommand(globals(cmd))));
+  memory.command("review").description("Walk through unreviewed (agent-written) entries: confirm, forget or skip").action(run(async (_o, cmd) => (await mem()).memoryReviewCommand(globals(cmd))));
+  const agents = program.command("agents").description("Manage AI agent integrations");
+  agents.command("list", { isDefault: true }).description("Show supported agents and integration status").action(run(async (_o, cmd) => (await import("./agents-DFSNEOP5.js")).agentsListCommand(globals(cmd))));
+  agents.command("add <agents...>").description('Configure integrations (claude-code, cursor, codex, copilot, gemini-cli, antigravity, windsurf, cline, agents-md, or "all")').action(run(async (names, _o, cmd) => (await import("./agents-DFSNEOP5.js")).agentsAddCommand(names, globals(cmd))));
+  agents.command("remove <agents...>").description("Remove Athena-managed integration files/blocks").action(run(async (names, _o, cmd) => (await import("./agents-DFSNEOP5.js")).agentsRemoveCommand(names, globals(cmd))));
+  const gitHook = program.command("git-hook").description("Install a Git pre-commit hook that blocks commits when knowledge is out of date");
+  gitHook.command("status", { isDefault: true }).description("Show whether the Athena pre-commit hook is installed").action(run(async (_o, cmd) => (await import("./git-hook-YZNZGAAP.js")).gitHookStatusCommand(globals(cmd))));
+  gitHook.command("install").description("Add the Athena pre-commit hook (existing hooks are kept; Athena adds a marked block)").option("--review", "Also run `athena review` and block commits with possible secrets or env files").action(run(async (o, cmd) => (await import("./git-hook-YZNZGAAP.js")).gitHookInstallCommand({ ...globals(cmd), review: o.review })));
+  gitHook.command("uninstall").description("Remove Athena's pre-commit hook or block").action(run(async (_o, cmd) => (await import("./git-hook-YZNZGAAP.js")).gitHookUninstallCommand(globals(cmd))));
+  program.command("open").description("Start (or reuse) the local web UI and open it in your browser").option("-p, --port <port>", "Port to bind (default: first free port from 7432)").option("--host <host>", "Interface to bind (default: 127.0.0.1)").option("--allow-remote", "Allow binding to a non-loopback interface").option("--no-open", "Do not launch a browser").option("--no-watch", "Do not watch the project for changes").action(run(async (o, cmd) => (await import("./open-UJZRYF4E.js")).openCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  program.command("activity").description("Show AI agent activity observed through hooks").option("-n, --limit <count>", "Number of events to show (default 30)").option("--agent <id>", "Only show events from this agent").action(run(async (o, cmd) => (await import("./activity-BKW7G4I5.js")).activityCommand({ ...globals(cmd), ...o })));
+  program.command("event").description("Record an agent hook event (called by AI coding agents, reads JSON on stdin)").option("--agent <id>", "Agent that fired the hook").option("--hook <name>", "Hook event name").option("--athena-hook", "Marker used to identify Athena-managed hook entries").option("--verbose-errors", "Print errors to stderr (hooks stay silent by default)").action(
+    run(async (o, cmd) => {
+      const g = globals(cmd);
+      await (await import("./event-TNT6CQZR.js")).eventCommand({ agent: o.agent, hook: o.hook, cwd: g.cwd, verbose: o.verboseErrors });
+    })
+  );
+  program.command("clean").description("Remove .athena/ and Athena agent integrations").option("-y, --yes", "Skip confirmation").option("--keep-agents", "Keep agent integration files/blocks").action(run(async (o, cmd) => (await import("./clean-MDBYH62P.js")).cleanCommand({ ...globals(cmd), ...o })));
+  program.command("version").description("Print the Athena version").action(run(async (_o, cmd) => {
+    if (globals(cmd).json) json({ version: ATHENA_VERSION, node: process.versions.node, platform: process.platform });
+    else line(ATHENA_VERSION);
+  }));
+  for (const p of PLANNED) {
+    program.command(p.name).description(`${p.description} ${dim(`(planned \u2014 Phase ${p.phase})`)}`).allowUnknownOption().allowExcessArguments().action(
+      run(async (_o, cmd) => {
+        if (globals(cmd).json) json({ available: false, command: p.name, plannedPhase: p.phase });
+        else line(`${c.yellow("Not available yet")} \u2014 \`athena ${p.name}\` is planned for Phase ${p.phase}.`);
+        return EXIT.NOT_AVAILABLE;
+      })
+    );
+  }
+  return program;
+}
+async function main() {
+  const program = buildProgram();
+  try {
+    await program.parseAsync(process.argv);
+  } catch (err) {
+    if (process.stdout.isTTY) process.stdout.write("\x1B[?25h");
+    if (controller.signal.aborted) {
+      process.exitCode = EXIT.INTERRUPTED;
+      return;
+    }
+    if (err instanceof AthenaError) {
+      if (isJson()) json({ error: err.message, hint: err.hint });
+      else {
+        process.stderr.write(`${c.red(`${sym.err} ${err.message}`)}
+`);
+        if (err.hint) process.stderr.write(`  ${dim(err.hint)}
+`);
+      }
+      process.exitCode = err.exitCode;
+      return;
+    }
+    process.stderr.write(`${c.red(`${sym.err} Unexpected error: ${err.message}`)}
+`);
+    if (process.env.ATHENA_DEBUG) process.stderr.write(`${err.stack}
+`);
+    else process.stderr.write(`  ${dim("Set ATHENA_DEBUG=1 for a stack trace. Please report this issue.")}
+`);
+    process.exitCode = EXIT.ERROR;
+  }
+}
+export {
+  buildProgram,
+  main
+};
+//# sourceMappingURL=program-CWJNGCTZ.js.map

package/dist/review-OOKXSYMP.js

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+import {
+  hasBlockers,
+  reviewChanges
+} from "./chunk-FVCDMQUQ.js";
+import "./chunk-3IS2X2Z7.js";
+import {
+  c,
+  dim,
+  heading,
+  isJson,
+  json,
+  line,
+  ok,
+  spinner,
+  sym
+} from "./chunk-Z6QWMJLK.js";
+import {
+  requireProjectRoot
+} from "./chunk-XFN7UZCS.js";
+import "./chunk-KBO7XRBW.js";
+import {
+  planSync,
+  staleForCheck
+} from "./chunk-KHMBNT66.js";
+import "./chunk-WVQC2EGO.js";
+import "./chunk-GR4DL2VM.js";
+import "./chunk-GGXPG6OE.js";
+import "./chunk-MPG3IEGB.js";
+import "./chunk-ELKFRTZT.js";
+import "./chunk-2R6PXY6Z.js";
+import "./chunk-PVCIGUIT.js";
+import "./chunk-OLPSEQS5.js";
+import "./chunk-SVTEJYMS.js";
+import "./chunk-QCC4VJUH.js";
+import "./chunk-JCGDR4UV.js";
+import "./chunk-YRIS7ZS6.js";
+import "./chunk-GHFRQAYT.js";
+import "./chunk-INT3IGMQ.js";
+import "./chunk-673EPYYH.js";
+import "./chunk-FQEGEVLY.js";
+import "./chunk-2DY4PUR4.js";
+import "./chunk-IQQBAWSM.js";
+import {
+  EXIT
+} from "./chunk-AD4OZCU2.js";
+import "./chunk-XW3MLHI2.js";
+import "./chunk-EUPETUWA.js";
+
+// src/cli/commands/review.ts
+var LEVEL = {
+  blocker: { icon: () => c.red(sym.err), label: "blocker" },
+  warning: { icon: () => c.yellow(sym.warn), label: "warning" },
+  info: { icon: () => c.cyan(sym.info), label: "info" }
+};
+async function reviewCommand(opts) {
+  const root = await requireProjectRoot(opts);
+  const sp = spinner("Reviewing changes...");
+  let result;
+  try {
+    result = await reviewChanges(root, {
+      base: opts.base,
+      staged: opts.staged,
+      signal: opts.signal,
+      checkSync: opts.noSync ? void 0 : async (r) => staleForCheck(await planSync(r, { signal: opts.signal })).length === 0
+    });
+    sp.stop();
+  } catch (err) {
+    sp.stop();
+    throw err;
+  }
+  if (isJson()) {
+    json(result);
+    return !opts.noFail && hasBlockers(result) ? 1 : EXIT.OK;
+  }
+  heading("Athena Review");
+  line();
+  if (!result.changedFiles.length) {
+    line(dim(opts.base ? `No changes between ${opts.base} and HEAD.` : opts.staged ? "No staged changes." : "No uncommitted changes."));
+    return EXIT.OK;
+  }
+  line(`${result.stats.files} file${result.stats.files === 1 ? "" : "s"} changed ${dim(`(${c.green(`+${result.stats.added}`)} ${c.red(`\u2212${result.stats.removed}`)}${opts.base ? ` vs ${opts.base}` : opts.staged ? " staged" : " in the working tree"})`)}`);
+  line();
+  if (result.findings.length) {
+    heading("Automated checks");
+    for (const f of result.findings) {
+      line(`${LEVEL[f.level].icon()} ${c.bold(f.message)} ${dim(`[${f.check}]`)}`);
+      for (const file of f.files.slice(0, 6)) line(`    ${dim(file)}`);
+      if (f.files.length > 6) line(dim(`    +${f.files.length - 6} more`));
+      if (f.hint) line(`    ${dim(f.hint)}`);
+    }
+  } else if (!result.incomplete) {
+    ok("Automated checks found nothing to flag.");
+  }
+  if (result.rules.length) {
+    line();
+    heading("Project rules to verify (from rules.md)");
+    for (const r of result.rules.slice(0, 20)) line(`  ${dim("[ ]")} ${r.text} ${dim(`(${r.section})`)}`);
+    if (result.rules.length > 20) line(dim(`  +${result.rules.length - 20} more`));
+  }
+  if (result.checklist.length) {
+    line();
+    heading("Review checklist (from code-review.md)");
+    for (const c2 of result.checklist.slice(0, 12)) line(`  ${dim("[ ]")} ${c2}`);
+    if (result.checklist.length > 12) line(dim(`  +${result.checklist.length - 12} more`));
+  }
+  line();
+  line(dim("Athena checks facts about the diff. Rules and checklist items are for you or your agent to apply \u2014 Athena does not judge whether they are met."));
+  const blockers = result.findings.filter((f) => f.level === "blocker").length;
+  if (blockers) line(c.red(`
+${blockers} blocker${blockers === 1 ? "" : "s"} found.`));
+  return !opts.noFail && hasBlockers(result) ? 1 : EXIT.OK;
+}
+export {
+  reviewCommand
+};
+//# sourceMappingURL=review-OOKXSYMP.js.map

package/dist/rules-4FXJUCXB.js

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+import {
+  getRules,
+  mutateRules
+} from "./chunk-LEMPCNAY.js";
+import {
+  addRule,
+  removeRule,
+  updateRule
+} from "./chunk-3IS2X2Z7.js";
+import {
+  dim,
+  heading,
+  isJson,
+  json,
+  line,
+  ok
+} from "./chunk-Z6QWMJLK.js";
+import {
+  requireProjectRoot
+} from "./chunk-XFN7UZCS.js";
+import "./chunk-KBO7XRBW.js";
+import "./chunk-OLPSEQS5.js";
+import "./chunk-JCGDR4UV.js";
+import "./chunk-673EPYYH.js";
+import "./chunk-FQEGEVLY.js";
+import "./chunk-2DY4PUR4.js";
+import "./chunk-IQQBAWSM.js";
+import {
+  AthenaError
+} from "./chunk-AD4OZCU2.js";
+import "./chunk-EUPETUWA.js";
+
+// src/cli/commands/rules.ts
+function parseIndex(raw) {
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 1) throw new AthenaError(`Invalid rule number: ${raw}`, "Use `athena rules list` to see rule numbers.");
+  return n;
+}
+async function mutate(opts, fn, message) {
+  const root = await requireProjectRoot(opts);
+  const view = await mutateRules(root, void 0, fn);
+  if (isJson()) json({ ok: true, rules: view.rules });
+  else ok(message);
+}
+async function rulesListCommand(opts) {
+  const root = await requireProjectRoot(opts);
+  const { rules } = await getRules(root);
+  if (isJson()) {
+    json(rules);
+    return;
+  }
+  if (!rules.length) {
+    line(dim('No rules defined. Add one with `athena rules add "<rule>" --section <name>`.'));
+    return;
+  }
+  let section = "";
+  for (const r of rules) {
+    if (r.section !== section) {
+      section = r.section;
+      line();
+      heading(section);
+    }
+    const num = dim(`${String(r.index).padStart(3)}.`);
+    line(r.enabled ? `${num} ${r.text}` : `${num} ${dim(`[disabled] ${r.text}`)}`);
+  }
+  line();
+  line(dim(`${rules.filter((r) => r.enabled).length} enabled \xB7 ${rules.filter((r) => !r.enabled).length} disabled \xB7 source: .athena/rules.md`));
+}
+var rulesAddCommand = (text, opts) => mutate(opts, (d) => addRule(d, opts.section ?? "General", text), `Rule added to "${opts.section ?? "General"}".`);
+var rulesEnableCommand = (n, opts) => mutate(opts, (d) => updateRule(d, parseIndex(n), { enabled: true }), `Rule ${n} enabled.`);
+var rulesDisableCommand = (n, opts) => mutate(opts, (d) => updateRule(d, parseIndex(n), { enabled: false }), `Rule ${n} disabled.`);
+var rulesEditCommand = (n, text, opts) => mutate(opts, (d) => updateRule(d, parseIndex(n), { text }), `Rule ${n} updated.`);
+var rulesRemoveCommand = (n, opts) => mutate(opts, (d) => removeRule(d, parseIndex(n)), `Rule ${n} removed.`);
+export {
+  rulesAddCommand,
+  rulesDisableCommand,
+  rulesEditCommand,
+  rulesEnableCommand,
+  rulesListCommand,
+  rulesRemoveCommand
+};
+//# sourceMappingURL=rules-4FXJUCXB.js.map

package/dist/security-LME3XFL3.js

@@ -0,0 +1,177 @@
+#!/usr/bin/env node
+import {
+  runSecurityScan
+} from "./chunk-SJ4DQFIJ.js";
+import "./chunk-VSYBC3VY.js";
+import {
+  c,
+  dim,
+  heading,
+  isJson,
+  json,
+  line,
+  ok,
+  relativeTime,
+  spinner,
+  sym,
+  warn
+} from "./chunk-Z6QWMJLK.js";
+import {
+  requireProjectRoot
+} from "./chunk-XFN7UZCS.js";
+import "./chunk-KBO7XRBW.js";
+import {
+  projectSession
+} from "./chunk-WVQC2EGO.js";
+import {
+  RATED_SEVERITIES,
+  SEVERITY_ORDER,
+  analyzeProject,
+  meetsThreshold,
+  saveScan,
+  unratedFindings
+} from "./chunk-MPG3IEGB.js";
+import "./chunk-ELKFRTZT.js";
+import "./chunk-PVCIGUIT.js";
+import "./chunk-OLPSEQS5.js";
+import "./chunk-SVTEJYMS.js";
+import "./chunk-QCC4VJUH.js";
+import "./chunk-JCGDR4UV.js";
+import "./chunk-2DY4PUR4.js";
+import "./chunk-IQQBAWSM.js";
+import {
+  AthenaError,
+  EXIT
+} from "./chunk-AD4OZCU2.js";
+import "./chunk-XW3MLHI2.js";
+import "./chunk-EUPETUWA.js";
+
+// src/cli/commands/security.ts
+var TONE = {
+  critical: c.red,
+  high: c.red,
+  moderate: c.yellow,
+  low: c.cyan,
+  unrated: c.magenta
+};
+async function loadModel(root, signal) {
+  return await projectSession(root).model() ?? (await analyzeProject(root, { signal })).model;
+}
+var toolLabel = (t) => t.target ? `${t.tool} (${t.target})` : t.tool;
+function printScan(scan, model) {
+  heading("Secrets");
+  if (scan.secrets.count) {
+    warn(`${scan.secrets.count} potential hardcoded secret(s) in ${scan.secrets.files.length} file(s)`);
+    for (const f of scan.secrets.files.slice(0, 8)) line(`  ${dim(f)}`);
+    line(dim("  Values are never stored. See .athena/security.md for types and locations."));
+  } else {
+    ok("No likely secrets matched Athena's patterns in scanned files");
+    line(dim("  Gitignored and oversized files are not scanned \u2014 this is not proof that none exist."));
+  }
+  if (scan.secrets.skippedLongLines) line(dim(`  Generic keyword patterns were not applied to ${scan.secrets.skippedLongLines} line(s) longer than 4096 characters.`));
+  if (scan.secrets.truncated) warn("Secret scan stopped early after too many findings.");
+  line();
+  heading("Dependency audit");
+  if (!scan.tools.length) {
+    line(dim("  No auditable ecosystems detected (no lockfiles or supported manifests)."));
+  }
+  for (const t of scan.tools) {
+    if (t.status !== "ok") {
+      line(`${c.dim(sym.ring)} ${toolLabel(t)} ${dim(`\u2014 ${t.status}: ${t.message ?? ""}`)}`);
+      continue;
+    }
+    if (!t.findings.length) {
+      ok(`${toolLabel(t)} ${dim(`\u2014 no known vulnerable dependencies (${(t.durationMs / 1e3).toFixed(1)}s)`)}`);
+      continue;
+    }
+    const bySeverity = SEVERITY_ORDER.map((s) => [s, t.findings.filter((f) => f.severity === s).length]).filter(([, n]) => n > 0);
+    warn(`${toolLabel(t)} \u2014 ${t.findings.length} finding(s): ${bySeverity.map(([s, n]) => TONE[s](`${n} ${s}`)).join(", ")}`);
+    for (const f of t.findings.slice(0, 12)) {
+      line(`  ${TONE[f.severity](f.severity.padEnd(8))} ${c.bold(f.package)} ${dim(f.title.slice(0, 70))}${f.fixAvailable ? c.green(" (fix available)") : ""}`);
+    }
+    if (t.findings.length > 12) line(dim(`  +${t.findings.length - 12} more \u2014 see .athena/security-scan.json`));
+  }
+  if (scan.tools.some((t) => t.status === "ok" && t.findings.some((f) => f.severity === "unrated"))) {
+    line(dim('  "unrated": the tool reports vulnerabilities without a severity. Treat them as unreviewed, not as low.'));
+  }
+  line();
+  heading("Declared security controls");
+  line(model.security.controls.length ? `  ${model.security.controls.map((c2) => c2.name).join(", ")}` : dim("  None detected"));
+  line(dim(`  Security tooling: ${model.security.tooling.length ? [...new Set(model.security.tooling.map((t) => t.name))].join(", ") : "none detected"}`));
+  line();
+  line(dim("Findings come from the tools above. Athena has no vulnerability database of its own, and a clean audit is not proof that the project is secure."));
+}
+var explain = (s) => process.stderr.write(`${s}
+`);
+async function securityCommand(opts) {
+  const root = await requireProjectRoot(opts);
+  let level = null;
+  if (opts.failOn) {
+    const raw = opts.failOn.toLowerCase();
+    const normalized = raw === "unknown" ? "unrated" : raw;
+    if (!SEVERITY_ORDER.includes(normalized)) throw new AthenaError(`Invalid --fail-on value: ${opts.failOn}`, `Use one of: ${RATED_SEVERITIES.join(", ")}`);
+    level = normalized;
+  }
+  const unratedPolicy = (opts.unrated ?? "fail").toLowerCase();
+  if (unratedPolicy !== "fail" && unratedPolicy !== "warn") throw new AthenaError(`Invalid --unrated value: ${opts.unrated}`, "Use one of: fail, warn");
+  let scan = null;
+  let model;
+  if (opts.last) {
+    scan = await projectSession(root).scan();
+    if (!scan) throw new AthenaError("No previous scan found.", "Run `athena security` to scan now.");
+    model = await loadModel(root, opts.signal);
+  } else {
+    const sp = spinner("Analyzing project...");
+    try {
+      model = await loadModel(root, opts.signal);
+      sp.update("Scanning files for secrets...");
+      scan = await runSecurityScan(root, model, { signal: opts.signal, skipAudit: opts.noAudit, onTool: (tool) => sp.update(`Running ${tool}...`) });
+      sp.succeed(`Security scan finished in ${(scan.durationMs / 1e3).toFixed(1)}s`);
+    } catch (err) {
+      sp.stop();
+      throw err;
+    }
+    await saveScan(root, scan);
+  }
+  if (isJson()) json(scan);
+  else {
+    heading("Athena Security");
+    line(dim(`Scanned ${relativeTime(scan.scannedAt)}${opts.last ? " (cached result)" : ""}`));
+    line();
+    printScan(scan, model);
+    if (!opts.last) line(dim("\nRun `athena sync` to record these results in .athena/security.md."));
+  }
+  if (level) {
+    const unrated = unratedFindings(scan);
+    const ratedHit = meetsThreshold(scan, level, { unrated: "warn" });
+    if (scan.secrets.count > 0) {
+      explain(`athena security: failing (--fail-on ${level}): ${scan.secrets.count} potential secret(s) found.`);
+      return 1;
+    }
+    if (ratedHit) {
+      explain(`athena security: failing (--fail-on ${level}): findings at or above ${level}.`);
+      return 1;
+    }
+    if (unrated.length) {
+      const tools = [...new Set(scan.tools.filter((t) => t.findings.some((f) => f.severity === "unrated")).map((t) => t.tool))].join(", ");
+      if (unratedPolicy === "fail") {
+        explain(`athena security: failing (--fail-on ${level}): ${unrated.length} unrated finding(s) from ${tools}. These tools do not report severity, so the finding may be at or above ${level}. Pass --unrated warn to not fail on unrated findings.`);
+        return 1;
+      }
+      explain(`athena security: warning: ${unrated.length} unrated finding(s) from ${tools} were not counted toward --fail-on ${level} (--unrated warn).`);
+    }
+    const broken = scan.tools.filter((t) => t.status === "failed" || t.status === "timeout");
+    if (broken.length) {
+      explain(`athena security: failing (--fail-on ${level}): ${broken.map((t) => `${t.tool} ${t.status}`).join(", ")}, so those dependencies were not checked.`);
+      return 1;
+    }
+    const missing = scan.tools.filter((t) => t.status === "unavailable");
+    if (missing.length) explain(`athena security: note: not checked because the tool is unavailable: ${missing.map((t) => t.tool).join(", ")}.`);
+  }
+  return EXIT.OK;
+}
+export {
+  printScan,
+  securityCommand
+};
+//# sourceMappingURL=security-LME3XFL3.js.map