simt-dev 0.6.0 → 0.6.3

package/src/commands/doctor.mjs

@@ -0,0 +1,367 @@
+// `simt doctor [--fix] [--yes] [--json]`
+//
+// Step 3 of the implementation sequence: classify a repo from marker files alone.
+// Deliberately shipped early — it needs no registry, no rules and no projection,
+// and it makes the tool useful before any content exists.
+//
+// Plan 0003 R47 adds the findings table and `--fix`. Every finding carries its
+// remedy and whether that remedy is flagged safe, and `--fix` applies only the
+// safe ones while listing the rest with the reason each needs a human:
+//
+//   - safe means local, idempotent and journaled (the R49 journal is the undo).
+//     `sync`'s manifest repair, a hooks install over routing this tool already
+//     owns, and the journal's own .gitignore entry all qualify.
+//   - safe is necessary but not sufficient: the fix must also be a REPAIR, not
+//     an ADOPTION. `init` on a manifest-less repo is local, idempotent and
+//     journaled, and still flagged unsafe — adopting a repo chooses its rules,
+//     regions and CI, and the preview of that choice is what the operator must
+//     read before approving it. So is taking over hooks git did not route here:
+//     the bytes are journaled but the decision belongs to a human.
+//
+// Unsafe findings are never applied, under any flag combination. `--fix` without
+// `--yes` previews: it names what it would apply and lists the rest.
+
+import { join } from 'node:path';
+import { EXIT, emit, emitJson, fail, isJson, note, writeMode } from '../output/index.mjs';
+import { CLI, MANIFEST_FILE } from '../name.mjs';
+import { fingerprint } from '../resolve/fingerprint.mjs';
+import { resolveWorkspace } from '../workspace.mjs';
+import { sharedWarning } from './shared.mjs';
+import { diffField, emitDiffs, readBefore } from '../diff.mjs';
+import { manifestPath, readManifest, writeManifest } from '../projection/manifest.mjs';
+import { planManifestRepair } from './sync.mjs';
+import { provenanceDigest } from '../projection/project.mjs';
+import { applyHooksInstall, plannedDiffs, planHooksInstall } from './hooks.mjs';
+import { fileFor } from '../hooks/shim.mjs';
+import { commitJournal, ignoreJournal, journalHygiene, journalIgnoreNext } from '../journal.mjs';
+
+/**
+ * One config-health finding: what is wrong, how to fix it, and whether
+ * `doctor --fix` may apply that fix on its own.
+ *
+ * `apply`, when present, performs the repair into the caller's journal. Only
+ * findings with `safe: true` carry one; an unsafe finding is a report and a
+ * manual remedy, never a function waiting for a flag.
+ */
+// `withDiffs` previews the safe fixes as `--diff` pairs (plan 0003 R50). Read at
+// finding creation, before any fix is applied, so the before side is true in
+// preview and in apply alike. Only safe findings carry pairs: an unsafe finding
+// is never applied, so there is no write to preview.
+async function collectFindings(root, { result, ws, shared, withDiffs = false }) {
+  const findings = [];
+  if (result.error) {
+    // Nothing else can be asked: classification failed, so every check built on
+    // it would be a guess. The run fails upstream; this entry is for the JSON.
+    findings.push({
+      id: 'fingerprint',
+      severity: 'error',
+      detail: result.error,
+      remedy: null,
+      why: null,
+      safe: false,
+    });
+    return findings;
+  }
+
+  const { manifest, exists, error: manifestError } = await readManifest(root);
+  if (manifestError !== null) {
+    // An unreadable manifest is a hand-edit, not a repair: re-rendering it
+    // would destroy whatever the other tool was saying.
+    findings.push({
+      id: 'manifest-unreadable',
+      severity: 'warning',
+      detail: `${MANIFEST_FILE}: ${manifestError}`,
+      remedy: `fix ${MANIFEST_FILE} by hand, or restore it from version control`,
+      why: 'only a human knows which bytes were intended',
+      safe: false,
+    });
+  } else if (!exists) {
+    // A repair restores intended state; an adoption chooses it. See the module
+    // header: `init` qualifies mechanically and is still listed, not applied.
+    findings.push({
+      id: 'manifest-absent',
+      severity: 'warning',
+      detail: `no ${MANIFEST_FILE}; this repository was never adopted`,
+      remedy: `run: ${CLI} init --root ${root} --yes`,
+      why: 'adoption chooses the rules; a fix only restores them',
+      safe: false,
+    });
+  } else {
+    const sha = await provenanceDigest();
+    const repair = await planManifestRepair(root, result.stack, sha);    if (repair !== null) {
+        const staleBefore = withDiffs ? await readBefore(await manifestPath(root)) : null;
+        findings.push({
+          id: 'manifest-stale',
+          severity: 'warning',
+          detail: `generated field(s) ${repair.stale.join(', ')} do not match what this simt-dev writes`,
+          remedy: `run: ${CLI} sync --root ${root} --yes`,
+          why: null,
+          safe: true,
+          diffs: withDiffs ? [{ path: MANIFEST_FILE, before: staleBefore, after: repair.text }] : [],
+          apply: async (rt, journal) => {
+            await writeManifest(rt, repair.manifest, journal);
+          },
+        });
+      }
+
+    const planned = await planHooksInstall(root, { manifest, exists });
+    if (planned.takeover) {
+      const foreign = planned.state.foreign
+        .map((f) => `${f.event} runs ${f.path} (${f.bytes} bytes)`)
+        .join('; ');
+      findings.push({
+        id: 'hooks-takeover',
+        severity: 'warning',
+        detail:
+          foreign !== ''
+            ? `git runs hooks this tool did not write: ${foreign}`
+            : `git routes hooks at ${planned.current}, not at the hooks directory`,
+        remedy: `inspect the existing hooks, then run: ${CLI} hooks install --root ${root} --yes`,
+        why: 'replacing live hooks needs a human who read them first',
+        safe: false,
+      });
+    } else {
+      const bits = [...planned.state.problems];
+      for (const h of planned.obsolete) {
+        bits.push(`${fileFor(h.event)} enforces nothing and is still routed; reinstall removes it`);
+      }
+      const evidenceMismatch =
+        planned.evidenceDeclared && planned.evidenceSource !== planned.evidenceExisting;
+      if (evidenceMismatch) bits.push('commit-msg claim check differs from this simt-dev; reinstall refreshes it');
+      if (bits.length > 0) {
+        const hooksPairs = withDiffs ? await plannedDiffs(root, planned) : [];
+        findings.push({
+          id: 'hooks-incomplete',
+          severity: 'warning',
+          detail: bits.join('; '),
+          remedy: `run: ${CLI} hooks install --root ${root} --yes`,
+          why: null,
+          safe: true,
+          diffs: hooksPairs,
+          apply: async (rt, journal) => {
+            await applyHooksInstall(rt, planned, journal);
+          },
+        });
+      }
+    }
+
+    const hygiene = await journalHygiene(root);
+    if (!hygiene.ignored) {
+      const ignoreBefore = withDiffs ? await readBefore(join(root, '.gitignore')) : null;
+      const ignoreAfter = withDiffs ? journalIgnoreNext(ignoreBefore ?? '') : null;
+      findings.push({
+        id: 'journal-unignored',
+        severity: 'warning',
+        detail: `${hygiene.sets.length} journal set(s) on disk, but .gitignore does not ignore them; the next commit would share local undo state`,
+        remedy: 'ignore the journal directory (what --fix applies)',
+        why: null,
+        safe: true,
+        diffs: ignoreAfter === null ? [] : [{ path: '.gitignore', before: ignoreBefore, after: ignoreAfter }],
+        apply: async (rt, journal) => {
+          await ignoreJournal(rt, journal);
+        },
+      });
+    }
+  }
+
+  if (shared.declared && shared.state !== 'current') {
+    // The copy lives outside the repository (a reader's home directory), which
+    // R49 deliberately leaves unjournaled: `undo` must never reach past the
+    // repo root, so a fix with no undo path is listed, never applied.
+    findings.push({
+      id: 'shared-copy',
+      severity: 'warning',
+      detail: shared.detail,
+      remedy: shared.state === 'absent' || shared.state === 'stale' ? `run: ${CLI} shared install --yes` : null,
+      why: 'the copy lives outside this repository, past what undo can restore',
+      safe: false,
+    });
+  }
+
+  if (ws.error) {
+    findings.push({
+      id: 'workspace-config',
+      severity: 'error',
+      detail: `workspace config ${ws.detail}: ${ws.error}`,
+      remedy: 'fix the JSON, or remove the file',
+      why: 'only a human knows which workspace was intended',
+      safe: false,
+    });
+  }
+  return findings;
+}
+
+async function applySafeFixes(root, findings) {
+  const journal = [];
+  const fixed = [];
+  const failed = [];
+  for (const finding of findings) {
+    if (!finding.safe) continue;
+    try {
+      await finding.apply(root, journal);
+      finding.fixed = true;
+      fixed.push(finding.id);
+    } catch (error) {
+      failed.push({ id: finding.id, error: error.message ?? String(error) });
+    }
+  }
+  if (fixed.length > 0) await commitJournal(root, 'doctor --fix', journal);
+  return { applied: true, fixed, failed };
+}
+
+function findingLines(findings, { fixMode, applying }) {
+  return findings.flatMap((finding) => {
+    const head = `finding  ${finding.id}  ${finding.detail}`;
+    if (finding.fixed === true) return [head, `         fixed  ${finding.remedy ?? 'applied'}`];
+    if (finding.remedy === null) return [head, '         manual: no command repairs this; read the detail above'];
+    if (!finding.safe) {
+      return [head, `         remedy: ${finding.remedy}`, `         manual: not applied by --fix (${finding.why})`];
+    }
+    if (!fixMode) return [head, `         remedy: ${finding.remedy}`, '         safe: apply with --fix --yes'];
+    if (!applying) return [head, `         remedy: ${finding.remedy}`, '         would fix; re-run with --yes to apply'];
+    return [head, `         remedy: ${finding.remedy}`];
+  });
+}
+
+// --- core: the config health both the CLI and the MCP `doctor` tool answer from (Q15)
+//
+// The MCP tool returned the fingerprint alone: stack, facts and manifest, and none
+// of the findings the command reports. The command below renders these facts for
+// terminals; the tool returns them as JSON. The CLI keeps its field names; the
+// tool adopts them.
+//
+// See the module header: classification first, because everything else is a guess without it.
+export async function diagnose(root, args = {}) {
+  const result = await fingerprint(root);
+  // Which source answered the workspace question, and where it looked. A tool
+  // that silently fell back to the wrong directory would make every downstream
+  // answer confidently wrong, so the answer is reported rather than inferred
+  // (ADR-014).
+  const ws = await resolveWorkspace(args);
+  // The shared file this repository hands rules to (ADR-084). Asked here and nowhere else
+  // because it is the one thing about a repository that is true of the reader's machine
+  // rather than of the tree: `check` must not read `$HOME`, so `doctor` is the only command
+  // that can notice a region that dropped rules into a file nobody has. Reported, never
+  // blocking — the region is correct either way, and what is wrong is the reader's machine.
+  const shared = await sharedWarning(root, result.manifest ?? null, args);
+
+  const withDiffs = args.fix === true && args.diff === true;
+  const findings = await collectFindings(root, { result, ws, shared, withDiffs });
+  // Under `--json` the document is the whole report, so it has to carry both
+  // failures the text path reports AND the workspace answer the text prints.
+  const failure = result.error
+    ? { error: `${root}: ${result.error}`, remedy: null }
+    : ws.error
+      ? {
+          error: `workspace config ${ws.detail}: ${ws.error}`,
+          remedy: 'fix the JSON, or remove the file',
+        }
+      : null;
+  const code = failure ? EXIT.CONFIG : EXIT.OK;
+  return { result, ws, shared, findings, failure, code };
+}
+
+/** The findings as JSON-safe data: drops the `apply` closures only `--fix` uses. */
+export function serialisedFindings(findings) {
+  return findings.map(({ id, severity, detail, remedy, why, safe, fixed }) => ({
+    id,
+    severity,
+    detail,
+    remedy,
+    // Null for safe findings: there is no human needed to explain.
+    why: why ?? null,
+    safe,
+    fixed: fixed === true,
+  }));
+}
+
+export async function runDoctor(positional, flags) {
+  const root = flags.root ?? positional[0] ?? process.cwd();
+  const { result, ws, shared, findings, failure, code: diagnosisCode } = await diagnose(root, flags);
+
+  const fixMode = flags.fix === true;
+  const mode = writeMode(flags);
+  let fix = { requested: fixMode, applied: false, fixed: [], failed: [] };
+  if (fixMode && mode.apply) {
+    fix = { requested: true, ...(await applySafeFixes(root, findings)) };
+  }
+  const failedFix = fix.failed.length > 0;
+
+  // A scripted consumer has only this document to go on, so `ok` is derived from
+  // the exit code rather than written as a constant (S10). A failed fix is a
+  // failure of this run on top of the diagnosis.
+  const code = failedFix ? EXIT.FAIL : diagnosisCode;
+
+  // The findings travel in both modes: a script reads the array, a terminal
+  // reads the lines, and neither may learn about a different set of problems.
+  const serialised = serialisedFindings(findings);
+
+  if (isJson(flags)) {
+    emitJson({
+      ok: code === EXIT.OK,
+      command: 'doctor',
+      root,
+      ...result,
+      // The workspace answer is a fact about which directory the tool would
+      // act on next (ADR-014). It is printed in the text report; leaving it
+      // out of the JSON meant a machine-readable caller could not see it at
+      // all, which is the one-question-two-answers defect again.
+      workspace: {
+        root: ws.root ?? null,
+        source: ws.source,
+        detail: ws.detail,
+        error: ws.error ?? null,
+      },
+      shared,
+      findings: serialised,
+      fix,
+      ...diffField(fixMode && flags.diff === true ? findings.flatMap((f) => f.diffs ?? []) : [], flags),
+      ...(failure ?? {}),
+    });
+    return code;
+  }
+  if (result.error) {
+    return fail(`${root}: ${result.error}`, EXIT.CONFIG);
+  }
+  emit(
+    [
+      `root     ${root}`,
+      `stack    ${result.stack.length > 0 ? result.stack.join(', ') : '(undetected)'}`,
+      `evidence ${result.evidence.length > 0 ? result.evidence.join(' ') : '(none)'}`,
+      // Facts are what a profile selects on when it wants to survive the
+      // framework being replaced, so they are reported with the path that proved
+      // each one rather than as a bare list (ADR-013).
+      `facts    ${
+        result.facts.length > 0
+          ? result.facts.map((f) => `${f}(${result.factEvidence[f] ?? '?'})`).join(' ')
+          : '(none)'
+      }`,
+      `manifest ${result.manifest ? (result.manifest.error ?? result.manifest.id ?? 'present') : '(absent)'}`,
+      `workspace ${ws.root ?? '(none)'}  (${ws.source}: ${ws.detail})`,
+      // Printed only when this repository declares shared rules to a workspace copy: a line in
+      // every `doctor` is a line in every reader's terminal, and the reader who has
+      // nothing to install is not served by one (ADR-084).
+      ...(shared.declared ? [`shared    ${shared.state}  ${shared.detail}`] : []),
+      ...findingLines(findings, { fixMode, applying: mode.apply }),
+    ].join('\n'),
+    { maxBytes: flags.maxBytes ?? 0 },
+  );
+  // After the report: the report says what, the diff shows it (R50). Only the
+  // fix plan is diffed, so without --fix there is nothing to show.
+  if (fixMode && flags.diff === true) emitDiffs(findings.flatMap((f) => f.diffs ?? []), flags);
+  if (failedFix) {
+    return fail(
+      `doctor --fix applied ${fix.fixed.length} remedie(s) and ${fix.failed.length} failed: ${fix.failed.map((f) => `${f.id} (${f.error})`).join('; ')}`,
+      EXIT.FAIL,
+    );
+  }
+  // An unconfigured workspace is a fact, not a failure: a single repo with no
+  // workspace around it is a normal, supported case. A config file that EXISTS and
+  // does not parse is a real mistake, and that does fail - with the parse error,
+  // because naming the file without saying what is wrong with it sends the reader
+  // to the file and gives them nothing to look for.
+  if (ws.error) {
+    return fail(`workspace config ${ws.detail}: ${ws.error}`, EXIT.CONFIG, 'fix the JSON, or remove the file');
+  }
+  return EXIT.OK;
+}

package/src/commands/explain.mjs

@@ -0,0 +1,52 @@
+// simt explain <CODE> [--json]
+//
+// The last mile of the contract work is a reader: every status `simt check`
+// can emit gets a plain-language entry — what it means, why the gate reports
+// it, how to fix it, and a concrete trigger — either as text or as the same
+// JSON envelope every command answers in. The lookup is case-insensitive and
+// folds the `-`/`_` split, so DRIFT, Drift and drift are one question; an
+// unknown code is a usage error that lists the known codes rather than a guess.
+
+import { EXIT, emit, emitJson, fail, isJson } from '../output/index.mjs';
+import { EXPLAIN_CODES } from '../explain.mjs';
+
+export const EXPLAIN_ALIASES = { drifted: 'drift' };
+
+function fold(raw) {
+  const folded = String(raw ?? '').toLowerCase().replace(/_/g, '-');
+  return EXPLAIN_ALIASES[folded] ?? folded;
+}
+
+export function listExplainCodes() {
+  return Object.keys(EXPLAIN_CODES).sort();
+}
+
+export async function explainCommand(positional, flags) {
+  const raw = positional[0];
+  if (!raw) {
+    return fail(
+      'explain needs a code',
+      EXIT.USAGE,
+      `one of: ${listExplainCodes().join(', ')}`,
+    );
+  }
+  const code = fold(raw);
+  const row = EXPLAIN_CODES[code];
+  if (!row) {
+    return fail(
+      `unknown finding code \`${raw}\``,
+      EXIT.USAGE,
+      `one of: ${listExplainCodes().join(', ')}`,
+    );
+  }
+
+  if (isJson(flags)) {
+    emitJson({ ok: true, command: 'explain', code, ...row });
+    return EXIT.OK;
+  }
+  emit(
+    [`code     ${code}`, '', row.what, '', `Why: ${row.why}`, '', `Fix: ${row.fix}`, '', `Example: ${row.example}`].join('\n'),
+    { maxBytes: flags.maxBytes ?? 0 },
+  );
+  return EXIT.OK;
+}

package/src/commands/help.mjs

@@ -1,13 +1,18 @@
-import { emit } from '../output/index.mjs';
-import { parse } from '../argv.mjs';
-import { CLI, MANIFEST_FILE } from '../name.mjs';
+import { emit, fail, jsonFailMode } from '../output/index.mjs';
+import { parse, rawJsonFlag } from '../argv.mjs';
+import { CLI, MANIFEST_FILE, STATE_DIR } from '../name.mjs';
+import { SESSION_ENV } from '../agenthooks/policy.mjs';
 import { DEFAULT_DIRECTORIES, DEFAULT_TEMPLATE } from '../plan/template.mjs';
 
 const COMMANDS = `${CLI} init [path]            adopt or scaffold a repo into the ecosystem
                            (dry-run unless --yes; conflicts block without
                            --accept-conflicts; in place unless --backup;
                            never commits or pushes)
-${CLI} doctor                 classify a repo and check config health
+${CLI} doctor [--fix]        classify a repo and check config health (with --fix:
+                           apply the remedies flagged safe and list the rest;
+                           dry-run unless --yes)
+${CLI} status --line         one line from the last check, for prompts and tmux
+                           (as of the last check; STALE after new commits)
 ${CLI} check                  the gate: projection drift, manifest validity, policy
 ${CLI} sync [--yes]           regenerate the projection (idempotent)
                            (prints the plan and exits 1 on drift without --yes,
@@ -58,20 +63,41 @@ ${CLI} agent-hooks install     write this repo's policies into the harnesses tha
                             key it does not own; Codex needs the hook trusted)
 ${CLI} agent-hooks status      what each harness will run, and what is not trusted yet
 ${CLI} plugin <claude|gemini|cursor>  generate a harness package from the same tables
-                            (dry-run unless --yes; writes a self-contained runtime, the
-                            hooks and MCP registration, and for cursor the kernel rules;
-                            the skill registry is workspace data and is not shipped)
+                           (dry-run unless --yes; writes a self-contained runtime, the
+                           hooks and MCP registration, and for cursor the kernel rules;
+                           the skill registry is workspace data and is not shipped)
+${CLI} completions <shell>    print a bash, zsh or fish completion script
+                           (generated from the command registry, so every command
+                           completes; deterministic bytes; stdout only - redirect
+                           or source it)
 ${CLI} plan status             count tracker rows
                            (${MANIFEST_FILE} key plans when set, otherwise
                            the ${DEFAULT_TEMPLATE} template:
                            ${DEFAULT_DIRECTORIES.join(' and ')})
 ${CLI} plan next [<id>]        one ready slice's section, or the one named; ~1 KB
 ${CLI} plan done <id> [<sha>]  mark one row; dry-run unless --yes
+${CLI} slice start <id>     give a slice its own worktree and branch, preload the
+                           brief, and mark the row In progress (dry-run unless
+                           --yes; the worktree is ${STATE_DIR}/worktrees/<id> on
+                           branch slice/<id>, the brief ${STATE_DIR}/brief.md in it)
+${CLI} slice finish <id>    run the pre-commit gates, commit what is staged with a
+                           Conventional subject from the row's title, then record
+                           the SHA and the --test command on the row (dry-run
+                           unless --yes; --type picks the type, default feat)
+${CLI} lease [<paths>...]    claim files for one session and a TTL, or list the
+                           claims (dry-run unless --yes; the session is --session
+                           <id> or ${SESSION_ENV}; a pre-edit hook refuses an edit
+                           to a path another session holds — ADR-101)
 ${CLI} graph lint              check the skill registry against the skills on disk
                            (byte counts, dangling edges, unresolvable variants)
 ${CLI} ci                     simt-dev's own .github files: create or refresh them
                            (dry-run unless --yes; refreshes the templates' own copies
                             and no repository else's)
+${CLI} ignore [--yes]         render the one .simtignore list into .cursorignore,
+                           .aiderignore, .geminiignore and Claude's
+                           permissions.deny Read(...) entries (dry-run unless
+                           --yes; --diff prints the plan as unified diffs; the
+                           Claude settings file is merged, never replaced)
 ${CLI} compare                org-wide matrix across every sibling repo
                            (read-only; exits non-zero on defects, not on
                            repos that have not adopted yet)
@@ -93,6 +119,11 @@ ${CLI} map [--task "<text>"] [--level outline|names|signatures]
                            --budget bytes (default 2048; 0 is unlimited). outline
                            is paths, names adds exports, signatures adds the line.
                            --recall reports gold-file recall@10 on mined tasks
+${CLI} pr-body [--base <ref>]  a pull request body: the evidence block for this tree,
+                           the decision records the diff touches, the gate
+                           state from the last check, and the residual risk
+                           in ADR-008 vocabulary (read-only; the exit code
+                           never carries the verdict)
 ${CLI} evidence                the runs recorded against the tree on disk
 ${CLI} evidence check <file>   a commit message that claims a run this tree does not
                            have: a warning, or a block when gates.evidence is "block"
@@ -100,10 +131,17 @@ ${CLI} lessons list            deterministic lesson candidates in .simt/lessons.
                            and promoted lessons in docs/lessons/*.md
 ${CLI} lessons review [<id>]   promote a lesson candidate to docs/lessons/NNNN-<slug>.md
                            (dry-run unless --yes; writes Appendix A frontmatter)
+${CLI} explain <CODE>        what a check finding means: the decision behind it, how
+                           to fix it, and a concrete trigger (DRIFT, UNMANAGED,
+                           PACK-DIGEST-MISMATCH, ...; case-insensitive)
 ${CLI} decide [<title>]        scaffold an ADR with the next free number, a Status: line,
                            a rulings skeleton, and structured simt-affects +
                            simt-supersedes frontmatter (dry-run unless --yes;
                            --check lints ADRs for prose-only partial supersessions)
+${CLI} undo                  restore the last journaled set of writes, but only
+                           when every file in it is untouched since (dry-run
+                           unless --yes; a touched file refuses the whole undo
+                           and nothing is restored)
 ${CLI} local doctor            probe configured local model endpoints (chat and embed)
                            (reads local in ${MANIFEST_FILE}; opens no socket when
                            unset; refuses non-loopback URLs without --allow-remote)
@@ -192,6 +230,9 @@ const FLAGS = `--json                 structured output (compact; one document,
 --task "<text>"         the task text used for capability resolution
 --paths <globs>         comma-separated path globs used for path resolution
 --root <path>           repository root (default: cwd)
+--base <ref>           pr-body: the ref the body diffs against
+                        (default: origin/main, then main; falls back to the
+                        worktree diff against HEAD when neither exists)
 --out <path>            plugin: where the generated package lands (required)
 --surfaces <ids>        comma-separated editors to write rule files for;
                          "" means AGENTS.md only (default: every surface,
@@ -202,6 +243,13 @@ const FLAGS = `--json                 structured output (compact; one document,
 --dry-run               report what would change, change nothing
 --yes                   assume yes; required in automation, never prompts
 --check                 report drift and write nothing (sync, ci)
+--diff                  print the plan as unified diffs (every writer;
+                        changes nothing about what the run writes)
+--line                  status: print the one-line gate summary from the last
+                        check (the only mode status has)
+--fix                   doctor: apply the remedies flagged safe (local,
+                        idempotent, journaled); list the rest (dry-run
+                        unless --yes)
 --frozen                check: the lock must match this projection; an output
                         change no input change explains fails the gate
 --explain               sync: name each line dropped as already inferable, with
@@ -238,8 +286,10 @@ const FLAGS = `--json                 structured output (compact; one document,
 --reps <n>              bench run: repetitions per task and arm (default: 3)
 --regrade <run>         bench run: re-grade a stored run from its archived agent patch
 --compare <a> <b>       bench report: compare two arms with deltas and p-values
---test <cmd>            plan done: the test command that closes the row
+--test <cmd>            plan done / slice finish: the test command that closes the row
 --state <name>          plan done: target state (default: Complete)
+--type <name>           slice finish: the Conventional Commits type (default: feat)
+--ttl <seconds>         lease: how long a claim lasts (default: 3600)
 --level <name>          map: detail level (outline, names, signatures)
 --supersedes <spec>     decide: superseded ADR or ruling (ADR-NNN or ADR-NNN:<ruling>[:<kind>]; repeatable)
 --source <spec>         pack new: where the pack's bytes come from
@@ -268,9 +318,12 @@ const PRINCIPLES = `design rules:
   bounded output      one fact per line, fixed field order, explicit TRUNCATED lines`;
 
 export async function help(argv) {
-  const { ok, value } = parse(argv);
-  if (!ok) return value.code;
-  const { flags } = value;
+  const parsed = parse(argv);
+  if (!parsed.ok) {
+    jsonFailMode(rawJsonFlag(argv));
+    return fail(parsed.error.message, parsed.error.code);
+  }
+  const { flags } = parsed.value;
   if (flags.version) {
     emit((await version()).trim());
     return 0;
@@ -300,10 +353,6 @@ export async function help(argv) {
 }
 
 async function version() {
-  const { readFile } = await import('node:fs/promises');
-  const { fileURLToPath } = await import('node:url');
-  const { dirname, join } = await import('node:path');
-  const root = join(dirname(fileURLToPath(import.meta.url)), '..');
-  const pkg = JSON.parse(await readFile(join(root, '..', 'package.json'), 'utf8'));
-  return `simt-dev ${pkg.version}\n`;
+  const { describeVersion } = await import('../package-version.mjs');
+  return `${describeVersion()}\n`;
 }