voidforge-build 23.9.1

package/dist/wizard/lib/frontmatter.js

@@ -0,0 +1,99 @@
+/**
+ * Minimal YAML frontmatter parser for PRD documents.
+ * Handles the simple key: value format used in PRD frontmatter blocks.
+ */
+export function parseFrontmatter(content) {
+    // Try ```yaml ... ``` block first (markdown code fence)
+    const yamlBlockMatch = content.match(/```yaml\s*\n([\s\S]*?)```/);
+    // Then try --- ... --- block (standard YAML frontmatter)
+    const dashBlockMatch = !yamlBlockMatch ? content.match(/^---\s*\n([\s\S]*?)\n---/) : null;
+    const match = yamlBlockMatch ?? dashBlockMatch;
+    if (!match) {
+        return { frontmatter: {}, body: content };
+    }
+    const yamlStr = match[1];
+    const frontmatter = {};
+    for (const line of yamlStr.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const match = trimmed.match(/^(\w+):\s*(.+)$/);
+        if (match) {
+            const key = match[1];
+            let value = match[2].trim();
+            // Track whether the original value was quoted
+            const wasQuoted = (value.startsWith('"') && value.endsWith('"')) ||
+                (value.startsWith("'") && value.endsWith("'"));
+            // Strip quotes
+            if (wasQuoted) {
+                value = value.slice(1, -1);
+            }
+            // Strip inline comments — but only if the value was NOT quoted
+            // (a `#` inside a quoted value is literal, not a comment)
+            if (!wasQuoted) {
+                const commentIdx = value.indexOf('#');
+                if (commentIdx > 0) {
+                    value = value.slice(0, commentIdx).trim();
+                }
+            }
+            frontmatter[key] = value;
+        }
+    }
+    return { frontmatter, body: content };
+}
+export function generateFrontmatterBlock(fm) {
+    const lines = ['```yaml'];
+    if (fm.name)
+        lines.push(`name: "${fm.name}"`);
+    if (fm.type)
+        lines.push(`type: "${fm.type}"`);
+    lines.push('');
+    if (fm.framework)
+        lines.push(`framework: "${fm.framework}"`);
+    if (fm.database)
+        lines.push(`database: "${fm.database}"`);
+    if (fm.cache)
+        lines.push(`cache: "${fm.cache}"`);
+    if (fm.styling)
+        lines.push(`styling: "${fm.styling}"`);
+    lines.push('');
+    if (fm.auth)
+        lines.push(`auth: ${fm.auth}`);
+    if (fm.payments)
+        lines.push(`payments: ${fm.payments}`);
+    if (fm.workers)
+        lines.push(`workers: ${fm.workers}`);
+    if (fm.admin)
+        lines.push(`admin: ${fm.admin}`);
+    if (fm.marketing)
+        lines.push(`marketing: ${fm.marketing}`);
+    if (fm.email)
+        lines.push(`email: ${fm.email}`);
+    lines.push('');
+    if (fm.deploy)
+        lines.push(`deploy: "${fm.deploy}"`);
+    if (fm.instance_type)
+        lines.push(`instance_type: "${fm.instance_type}"`);
+    if (fm.hostname)
+        lines.push(`hostname: "${fm.hostname}"`);
+    lines.push('```');
+    return lines.join('\n');
+}
+const VALID_TYPES = ['full-stack', 'api-only', 'static-site', 'prototype'];
+const VALID_DEPLOY = ['vps', 'vercel', 'railway', 'cloudflare', 'static', 'docker'];
+const VALID_INSTANCE_TYPES = ['t3.micro', 't3.small', 't3.medium', 't3.large'];
+export function validateFrontmatter(fm) {
+    const errors = [];
+    if (!fm.name)
+        errors.push('Missing required field: name');
+    if (fm.type && !VALID_TYPES.includes(fm.type)) {
+        errors.push(`Invalid type: "${fm.type}". Must be one of: ${VALID_TYPES.join(', ')}`);
+    }
+    if (fm.deploy && !VALID_DEPLOY.includes(fm.deploy)) {
+        errors.push(`Invalid deploy: "${fm.deploy}". Must be one of: ${VALID_DEPLOY.join(', ')}`);
+    }
+    if (fm.instance_type && !VALID_INSTANCE_TYPES.includes(fm.instance_type)) {
+        errors.push(`Invalid instance_type: "${fm.instance_type}". Must be one of: ${VALID_INSTANCE_TYPES.join(', ')}`);
+    }
+    return errors;
+}

package/dist/wizard/lib/gap-analysis.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Seven's Gap Analysis Engine — 5-dimension project scoring (v12.1).
+ *
+ * Analyzes a project across: feature completeness, quality, performance,
+ * growth readiness, and revenue potential. Produces a scored situation model
+ * that drives Tuvok's campaign proposals.
+ *
+ * PRD Reference: ROADMAP v12.1 deliverables, DEEP_CURRENT.md ANALYZE step
+ */
+import type { SituationModel, DimensionScore } from './deep-current.js';
+/**
+ * Score feature completeness by diffing PRD requirements against codebase.
+ * Uses a simplified heuristic: count PRD sections vs implemented routes/components.
+ */
+export declare function scoreFeatureCompleteness(projectDir: string): Promise<DimensionScore>;
+/**
+ * Score quality from gauntlet findings, field reports, and test presence.
+ */
+export declare function scoreQuality(projectDir: string): Promise<DimensionScore>;
+/**
+ * Score revenue potential from treasury setup, payment integrations, and pricing presence.
+ */
+export declare function scoreRevenuePotential(projectDir: string): Promise<DimensionScore>;
+/**
+ * Run Seven's full gap analysis across all 5 dimensions.
+ * Performance and growthReadiness come from Torres's site scan (already in the model).
+ * Feature completeness, quality, and revenue potential are analyzed here.
+ */
+export declare function analyzeGaps(model: SituationModel, projectDir: string): Promise<SituationModel>;
+/**
+ * Find the weakest dimension — this drives the next campaign proposal.
+ */
+export declare function findWeakestDimension(model: SituationModel): {
+    name: string;
+    score: number;
+    gaps: string[];
+};

package/dist/wizard/lib/gap-analysis.js

@@ -0,0 +1,218 @@
+/**
+ * Seven's Gap Analysis Engine — 5-dimension project scoring (v12.1).
+ *
+ * Analyzes a project across: feature completeness, quality, performance,
+ * growth readiness, and revenue potential. Produces a scored situation model
+ * that drives Tuvok's campaign proposals.
+ *
+ * PRD Reference: ROADMAP v12.1 deliverables, DEEP_CURRENT.md ANALYZE step
+ */
+import { existsSync } from 'node:fs';
+import { readFile, readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+// ── Feature Completeness Dimension ────────────────────
+/**
+ * Score feature completeness by diffing PRD requirements against codebase.
+ * Uses a simplified heuristic: count PRD sections vs implemented routes/components.
+ */
+export async function scoreFeatureCompleteness(projectDir) {
+    const gaps = [];
+    let score = 50; // base — assumes halfway done if we can't fully analyze
+    // Read PRD if exists
+    const prdPaths = [join(projectDir, 'docs', 'PRD.md'), join(projectDir, 'PRD.md')];
+    let prdContent = '';
+    for (const p of prdPaths) {
+        if (existsSync(p)) {
+            prdContent = await readFile(p, 'utf-8');
+            break;
+        }
+    }
+    if (!prdContent) {
+        return { score: 0, gaps: ['No PRD found — cannot assess feature completeness'], lastUpdated: new Date().toISOString() };
+    }
+    // Count PRD feature sections (## headers that look like features)
+    const featureSections = (prdContent.match(/^#{2,3}\s+(?!Frontmatter|Version|Status)/gm) || []).length;
+    // Count source files as a proxy for implementation
+    let sourceFileCount = 0;
+    try {
+        const srcDirs = ['src', 'app', 'pages', 'components', 'lib', 'services', 'wizard/lib', 'wizard/ui'];
+        for (const dir of srcDirs) {
+            const fullDir = join(projectDir, dir);
+            if (existsSync(fullDir)) {
+                const files = await readdir(fullDir, { recursive: true });
+                sourceFileCount += files.filter(f => /\.(ts|tsx|js|jsx|py|rb)$/.test(String(f))).length;
+            }
+        }
+    }
+    catch { /* can't read dirs */ }
+    // Heuristic scoring
+    if (featureSections > 0 && sourceFileCount > 0) {
+        const ratio = Math.min(sourceFileCount / featureSections, 3); // cap at 3 files/section
+        score = Math.min(100, Math.round(ratio / 3 * 100));
+    }
+    if (score < 30)
+        gaps.push(`Only ${sourceFileCount} source files for ${featureSections} PRD sections`);
+    if (score < 60)
+        gaps.push('Feature implementation appears incomplete');
+    // Check for campaign state — completed campaigns boost the score
+    const campaignStatePath = join(projectDir, 'logs', 'campaign-state.md');
+    if (existsSync(campaignStatePath)) {
+        const campaignContent = await readFile(campaignStatePath, 'utf-8');
+        const completedMissions = (campaignContent.match(/COMPLETE/g) || []).length;
+        score = Math.min(100, score + completedMissions * 3);
+    }
+    return { score: Math.min(100, score), gaps, lastUpdated: new Date().toISOString() };
+}
+// ── Quality Dimension ─────────────────────────────────
+/**
+ * Score quality from gauntlet findings, field reports, and test presence.
+ */
+export async function scoreQuality(projectDir) {
+    const gaps = [];
+    let score = 50;
+    // Check for test files
+    let testFileCount = 0;
+    const testDirs = ['__tests__', 'tests', 'test', 'spec'];
+    for (const dir of testDirs) {
+        const fullDir = join(projectDir, dir);
+        if (existsSync(fullDir)) {
+            const files = await readdir(fullDir, { recursive: true });
+            testFileCount += files.filter(f => /\.(test|spec)\.(ts|tsx|js|jsx|py)$/.test(String(f))).length;
+        }
+    }
+    // Also check for test files alongside source
+    try {
+        const srcDir = join(projectDir, 'src');
+        if (existsSync(srcDir)) {
+            const files = await readdir(srcDir, { recursive: true });
+            testFileCount += files.filter(f => /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(String(f))).length;
+        }
+    }
+    catch { /* can't read */ }
+    if (testFileCount === 0) {
+        gaps.push('No test files found');
+        score -= 20;
+    }
+    else if (testFileCount < 5) {
+        gaps.push(`Only ${testFileCount} test files — coverage likely low`);
+        score -= 10;
+    }
+    else {
+        score += 15;
+    }
+    // Check gauntlet state for unfixed findings
+    const gauntletPath = join(projectDir, 'logs', 'gauntlet-state.md');
+    if (existsSync(gauntletPath)) {
+        const content = await readFile(gauntletPath, 'utf-8');
+        if (content.includes('COMPLETE') && content.includes('SIGN OFF')) {
+            score += 20;
+        }
+        const criticalCount = (content.match(/Critical/gi) || []).length;
+        if (criticalCount > 5) {
+            gaps.push(`${criticalCount} Critical mentions in gauntlet state`);
+            score -= 10;
+        }
+    }
+    else {
+        gaps.push('No gauntlet history — project has not been reviewed');
+        score -= 15;
+    }
+    // Check for LESSONS.md (learning from mistakes = quality signal)
+    if (existsSync(join(projectDir, 'docs', 'LESSONS.md')))
+        score += 5;
+    return { score: Math.max(0, Math.min(100, score)), gaps, lastUpdated: new Date().toISOString() };
+}
+// ── Revenue Potential Dimension ───────────────────────
+/**
+ * Score revenue potential from treasury setup, payment integrations, and pricing presence.
+ */
+export async function scoreRevenuePotential(projectDir) {
+    const gaps = [];
+    let score = 20; // base — most projects start without revenue infrastructure
+    // Check for treasury vault (Cultivation installed)
+    const treasuryVault = join(homedir(), '.voidforge', 'treasury', 'vault.enc');
+    if (existsSync(treasuryVault)) {
+        score += 25;
+    }
+    else {
+        gaps.push('No treasury set up — no revenue tracking');
+    }
+    // Check for payment integration in code
+    const paymentIndicators = ['stripe', 'paddle', 'lemon', 'paypal', 'checkout'];
+    let paymentFound = false;
+    try {
+        const envPath = join(projectDir, '.env');
+        if (existsSync(envPath)) {
+            const envContent = await readFile(envPath, 'utf-8');
+            for (const indicator of paymentIndicators) {
+                if (envContent.toLowerCase().includes(indicator)) {
+                    paymentFound = true;
+                    break;
+                }
+            }
+        }
+    }
+    catch { /* can't read .env */ }
+    if (paymentFound) {
+        score += 20;
+    }
+    else {
+        gaps.push('No payment integration detected');
+    }
+    // Check for pricing page indicators in source
+    try {
+        const srcDir = join(projectDir, 'src');
+        if (existsSync(srcDir)) {
+            const files = await readdir(srcDir, { recursive: true });
+            const pricingFiles = files.filter(f => /pric/i.test(String(f)));
+            if (pricingFiles.length > 0) {
+                score += 15;
+            }
+            else {
+                gaps.push('No pricing page or component found');
+            }
+        }
+    }
+    catch { /* can't read */ }
+    // Check for heartbeat daemon (revenue monitoring)
+    if (existsSync(join(homedir(), '.voidforge', 'heartbeat.json'))) {
+        score += 15;
+    }
+    else {
+        gaps.push('Heartbeat daemon not running — no revenue monitoring');
+    }
+    return { score: Math.max(0, Math.min(100, score)), gaps, lastUpdated: new Date().toISOString() };
+}
+// ── Full Analysis ─────────────────────────────────────
+/**
+ * Run Seven's full gap analysis across all 5 dimensions.
+ * Performance and growthReadiness come from Torres's site scan (already in the model).
+ * Feature completeness, quality, and revenue potential are analyzed here.
+ */
+export async function analyzeGaps(model, projectDir) {
+    // Feature completeness
+    model.dimensions.featureCompleteness = await scoreFeatureCompleteness(projectDir);
+    // Quality
+    model.dimensions.quality = await scoreQuality(projectDir);
+    // Revenue potential
+    model.dimensions.revenuePotential = await scoreRevenuePotential(projectDir);
+    // Performance and growthReadiness are updated by Torres's SENSE step (site scanner)
+    // If they haven't been scanned yet, keep their current values
+    return model;
+}
+/**
+ * Find the weakest dimension — this drives the next campaign proposal.
+ */
+export function findWeakestDimension(model) {
+    const dims = model.dimensions;
+    const entries = [
+        { name: 'Feature Completeness', ...dims.featureCompleteness },
+        { name: 'Quality', ...dims.quality },
+        { name: 'Performance', ...dims.performance },
+        { name: 'Growth Readiness', ...dims.growthReadiness },
+        { name: 'Revenue Potential', ...dims.revenuePotential },
+    ];
+    entries.sort((a, b) => a.score - b.score);
+    return entries[0];
+}

package/dist/wizard/lib/github.d.ts

@@ -0,0 +1,22 @@
+/**
+ * GitHub integration — create repo, git init + remote + push.
+ * Runs as a pre-provision step (ADR-011) so platforms can link to the repo.
+ * Uses exec.ts for git operations (ADR-013). No npm dependencies.
+ */
+import type { ProvisionEmitter } from './provisioners/types.js';
+export interface GitHubResult {
+    success: boolean;
+    repoUrl?: string;
+    owner?: string;
+    repoName?: string;
+    error?: string;
+}
+/**
+ * Full GitHub pre-provision flow:
+ * 1. Validate git binary exists
+ * 2. Determine owner (from vault or token)
+ * 3. Create repo via API (or use existing)
+ * 4. Ensure .gitignore has .ssh/ and .env
+ * 5. git init + remote + push
+ */
+export declare function prepareGithub(runId: string, token: string, owner: string | null, projectName: string, projectDir: string, emit: ProvisionEmitter, abortSignal?: AbortSignal, framework?: string, deployTarget?: string): Promise<GitHubResult>;

package/dist/wizard/lib/github.js

@@ -0,0 +1,261 @@
+/**
+ * GitHub integration — create repo, git init + remote + push.
+ * Runs as a pre-provision step (ADR-011) so platforms can link to the repo.
+ * Uses exec.ts for git operations (ADR-013). No npm dependencies.
+ */
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { writeFile, readFile } from 'node:fs/promises';
+import { execCommand, validateBinaries } from './exec.js';
+import { httpsPost, httpsGet, safeJsonParse, slugify } from './provisioners/http-client.js';
+import { recordResourcePending, recordResourceCreated } from './provision-manifest.js';
+import { generateCIWorkflows } from './ci-generator.js';
+const GH_API = 'api.github.com';
+const GH_API_VERSION = '2022-11-28';
+function ghHeaders(token) {
+    return {
+        'Authorization': `Bearer ${token}`,
+        'User-Agent': 'VoidForge',
+        'X-GitHub-Api-Version': GH_API_VERSION,
+        'Content-Type': 'application/json',
+        'Accept': 'application/vnd.github+json',
+    };
+}
+/**
+ * Full GitHub pre-provision flow:
+ * 1. Validate git binary exists
+ * 2. Determine owner (from vault or token)
+ * 3. Create repo via API (or use existing)
+ * 4. Ensure .gitignore has .ssh/ and .env
+ * 5. git init + remote + push
+ */
+export async function prepareGithub(runId, token, owner, projectName, projectDir, emit, abortSignal, framework, deployTarget) {
+    const repoName = slugify(projectName);
+    const headers = ghHeaders(token);
+    // Step 1: Validate git binary
+    emit({ step: 'github-validate', status: 'started', message: 'Checking for git binary' });
+    const missing = await validateBinaries(['git']);
+    if (missing.length > 0) {
+        emit({ step: 'github-validate', status: 'error', message: 'git is not installed. Install git to enable GitHub integration.' });
+        return { success: false, error: 'git binary not found' };
+    }
+    emit({ step: 'github-validate', status: 'done', message: 'git found' });
+    // Step 2: Determine owner
+    emit({ step: 'github-owner', status: 'started', message: 'Determining GitHub owner' });
+    let resolvedOwner = owner;
+    const ownerIsExplicit = !!owner;
+    if (!resolvedOwner) {
+        try {
+            const res = await httpsGet(GH_API, '/user', headers);
+            if (res.status !== 200) {
+                emit({ step: 'github-owner', status: 'error', message: 'Failed to fetch GitHub user', detail: `API returned ${res.status}` });
+                return { success: false, error: `GitHub API returned ${res.status}` };
+            }
+            const data = safeJsonParse(res.body);
+            resolvedOwner = data?.login ?? '';
+            if (!resolvedOwner) {
+                emit({ step: 'github-owner', status: 'error', message: 'Could not determine GitHub username from token' });
+                return { success: false, error: 'No GitHub username in token response' };
+            }
+        }
+        catch (err) {
+            emit({ step: 'github-owner', status: 'error', message: 'GitHub API connection failed', detail: err.message });
+            return { success: false, error: err.message };
+        }
+    }
+    // Validate owner format (Kenobi: prevent path traversal in API calls)
+    if (!/^[a-zA-Z0-9_.-]+$/.test(resolvedOwner)) {
+        emit({ step: 'github-owner', status: 'error', message: `Invalid GitHub owner format: "${resolvedOwner}"` });
+        return { success: false, error: 'Invalid GitHub owner format' };
+    }
+    emit({ step: 'github-owner', status: 'done', message: `GitHub owner: ${resolvedOwner}` });
+    // Step 3: Create repo (or detect existing)
+    emit({ step: 'github-repo', status: 'started', message: `Creating repository ${resolvedOwner}/${repoName}` });
+    try {
+        await recordResourcePending(runId, 'github-repo', `${resolvedOwner}/${repoName}`, 'global');
+        // Check if repo already exists
+        const checkRes = await httpsGet(GH_API, `/repos/${resolvedOwner}/${repoName}`, headers);
+        if (checkRes.status === 200) {
+            emit({ step: 'github-repo', status: 'done', message: `Repository ${resolvedOwner}/${repoName} already exists — will push to it` });
+            await recordResourceCreated(runId, 'github-repo', `${resolvedOwner}/${repoName}`, 'global');
+        }
+        else {
+            // Create new repo — use org endpoint if owner was explicitly set (may be an org)
+            const body = JSON.stringify({
+                name: repoName,
+                private: true,
+                auto_init: false,
+                description: `Created by VoidForge`,
+            });
+            const createPath = ownerIsExplicit
+                ? `/orgs/${resolvedOwner}/repos`
+                : '/user/repos';
+            let createRes = await httpsPost(GH_API, createPath, headers, body);
+            // If org endpoint returned 404, the owner is a user, not an org — fall back
+            if (createRes.status === 404 && ownerIsExplicit) {
+                createRes = await httpsPost(GH_API, '/user/repos', headers, body);
+            }
+            if (createRes.status === 201) {
+                await recordResourceCreated(runId, 'github-repo', `${resolvedOwner}/${repoName}`, 'global');
+                emit({ step: 'github-repo', status: 'done', message: `Repository ${resolvedOwner}/${repoName} created (private)` });
+            }
+            else if (createRes.status === 422) {
+                // Repo already exists (race condition or name conflict)
+                const errData = safeJsonParse(createRes.body);
+                const detail = errData?.errors?.[0]?.message || errData?.message || 'Repository name already exists';
+                emit({ step: 'github-repo', status: 'done', message: `Repository exists — ${detail}` });
+                await recordResourceCreated(runId, 'github-repo', `${resolvedOwner}/${repoName}`, 'global');
+            }
+            else {
+                const errData = safeJsonParse(createRes.body);
+                throw new Error(errData?.message || `GitHub API returned ${createRes.status}`);
+            }
+        }
+    }
+    catch (err) {
+        emit({ step: 'github-repo', status: 'error', message: 'Failed to create GitHub repository', detail: err.message });
+        return { success: false, error: err.message };
+    }
+    // Step 4: Ensure .gitignore protects secrets
+    emit({ step: 'github-gitignore', status: 'started', message: 'Checking .gitignore' });
+    try {
+        const gitignorePath = join(projectDir, '.gitignore');
+        let gitignore = '';
+        try {
+            gitignore = await readFile(gitignorePath, 'utf-8');
+        }
+        catch { /* new file */ }
+        const requiredEntries = ['.env', '.env.*', '.ssh/', 'node_modules/'];
+        const existingLines = gitignore.split('\n').map(l => l.trim());
+        const missing = requiredEntries.filter(entry => !existingLines.includes(entry));
+        if (missing.length > 0) {
+            const addition = (gitignore ? '\n' : '') + '# VoidForge — protect secrets\n' + missing.join('\n') + '\n';
+            await writeFile(gitignorePath, gitignore + addition, 'utf-8');
+            emit({ step: 'github-gitignore', status: 'done', message: `Added ${missing.length} entries to .gitignore` });
+        }
+        else {
+            emit({ step: 'github-gitignore', status: 'done', message: '.gitignore already has required entries' });
+        }
+    }
+    catch (err) {
+        emit({ step: 'github-gitignore', status: 'error', message: 'Failed to update .gitignore', detail: err.message });
+        // Non-fatal
+    }
+    // Step 5: git init + remote + add + commit + push
+    emit({ step: 'github-push', status: 'started', message: 'Pushing code to GitHub' });
+    try {
+        const gitOpts = { cwd: projectDir, timeout: 30_000, abortSignal };
+        const repoUrl = `https://github.com/${resolvedOwner}/${repoName}.git`;
+        // Init if needed
+        if (!existsSync(join(projectDir, '.git'))) {
+            await execCommand('git', ['init'], gitOpts);
+            await execCommand('git', ['branch', '-M', 'main'], gitOpts);
+        }
+        // Set remote (idempotent)
+        try {
+            await execCommand('git', ['remote', 'add', 'origin', repoUrl], gitOpts);
+        }
+        catch {
+            // Remote exists — update URL
+            await execCommand('git', ['remote', 'set-url', 'origin', repoUrl], gitOpts);
+        }
+        // Verify .gitignore protects secrets before staging (defense in depth)
+        try {
+            const currentGitignore = await readFile(join(projectDir, '.gitignore'), 'utf-8');
+            const lines = currentGitignore.split('\n').map(l => l.trim());
+            if (!lines.includes('.env') || !lines.includes('.ssh/')) {
+                emit({ step: 'github-push', status: 'error', message: 'Cannot push — .gitignore is missing .env or .ssh/ entries' });
+                return { success: false, error: '.gitignore missing required entries' };
+            }
+        }
+        catch {
+            emit({ step: 'github-push', status: 'error', message: 'Cannot push — .gitignore not found' });
+            return { success: false, error: '.gitignore not found' };
+        }
+        // Stage all files
+        await execCommand('git', ['add', '-A'], gitOpts);
+        // Commit (may fail if nothing to commit — that's fine)
+        try {
+            await execCommand('git', ['commit', '-m', 'Initial commit — VoidForge'], {
+                ...gitOpts,
+                env: {
+                    GIT_AUTHOR_NAME: 'VoidForge',
+                    GIT_AUTHOR_EMAIL: 'voidforge@localhost',
+                    GIT_COMMITTER_NAME: 'VoidForge',
+                    GIT_COMMITTER_EMAIL: 'voidforge@localhost',
+                },
+            });
+        }
+        catch {
+            // Nothing to commit — existing repo with no changes
+        }
+        // Push using http.extraheader to avoid token in URL/reflog (Kenobi: git reflog token persistence)
+        await execCommand('git', ['push', '-u', 'origin', 'main'], {
+            ...gitOpts,
+            timeout: 120_000, // Longer timeout for push
+            env: {
+                GIT_TERMINAL_PROMPT: '0',
+                GIT_CONFIG_COUNT: '1',
+                GIT_CONFIG_KEY_0: 'http.https://github.com/.extraheader',
+                GIT_CONFIG_VALUE_0: `Authorization: Basic ${Buffer.from(`x-access-token:${token}`).toString('base64')}`,
+            },
+        });
+        emit({ step: 'github-push', status: 'done', message: `Code pushed to ${resolvedOwner}/${repoName}` });
+        // ── CI/CD workflow generation (ADR-017) ────────────────────────
+        if (framework && deployTarget) {
+            emit({ step: 'github-ci', status: 'started', message: 'Generating GitHub Actions CI/CD workflows' });
+            try {
+                const ciResult = await generateCIWorkflows(projectDir, framework, deployTarget);
+                if (ciResult.success && ciResult.files.length > 0) {
+                    // Commit and push the workflow files
+                    await execCommand('git', ['add', ...ciResult.files], gitOpts);
+                    try {
+                        await execCommand('git', ['commit', '-m', 'Add CI/CD workflows — VoidForge (ADR-017)'], {
+                            ...gitOpts,
+                            env: {
+                                GIT_AUTHOR_NAME: 'VoidForge',
+                                GIT_AUTHOR_EMAIL: 'voidforge@localhost',
+                                GIT_COMMITTER_NAME: 'VoidForge',
+                                GIT_COMMITTER_EMAIL: 'voidforge@localhost',
+                            },
+                        });
+                        await execCommand('git', ['push', 'origin', 'main'], {
+                            ...gitOpts,
+                            timeout: 120_000,
+                            env: {
+                                GIT_TERMINAL_PROMPT: '0',
+                                GIT_CONFIG_COUNT: '1',
+                                GIT_CONFIG_KEY_0: 'http.https://github.com/.extraheader',
+                                GIT_CONFIG_VALUE_0: `Authorization: Basic ${Buffer.from(`x-access-token:${token}`).toString('base64')}`,
+                            },
+                        });
+                        emit({ step: 'github-ci', status: 'done', message: `Generated ${ciResult.files.join(', ')} — CI/CD enabled` });
+                    }
+                    catch {
+                        emit({ step: 'github-ci', status: 'done', message: 'Workflows generated locally (push separately if needed)' });
+                    }
+                }
+            }
+            catch (ciErr) {
+                emit({ step: 'github-ci', status: 'error', message: 'Failed to generate CI/CD workflows', detail: ciErr.message });
+                // Non-fatal — project was still pushed
+            }
+        }
+        return {
+            success: true,
+            repoUrl: `https://github.com/${resolvedOwner}/${repoName}`,
+            owner: resolvedOwner,
+            repoName,
+        };
+    }
+    catch (err) {
+        // Sanitize error — strip token from git error messages
+        const rawError = err.message;
+        const safeError = rawError
+            .replace(/x-access-token:[^@]+@/g, 'x-access-token:***@')
+            .replace(/Authorization: Basic [A-Za-z0-9+/=]+/g, 'Authorization: Basic ***')
+            .replace(/GIT_CONFIG_VALUE_0=[^\s]+/g, 'GIT_CONFIG_VALUE_0=***');
+        emit({ step: 'github-push', status: 'error', message: 'Failed to push to GitHub', detail: safeError });
+        return { success: false, error: safeError };
+    }
+}

package/dist/wizard/lib/headless-deploy.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Headless deploy — runs the same provisioner pipeline as Haku,
+ * but outputs progress to stdout instead of SSE to a browser.
+ * Called by: `npx voidforge deploy --headless`
+ * Used by: /build Phase 12 (Kusanagi)
+ */
+/**
+ * Env-only deploy — write vault credentials to .env without provisioning infrastructure.
+ * Reads PRD frontmatter to identify required env vars, pulls matching values from the vault,
+ * and appends them to the project's .env file.
+ * Called by: `npx voidforge deploy --env-only`
+ */
+export declare function envOnlyDeploy(projectDir?: string): Promise<void>;
+export declare function headlessDeploy(projectDir?: string): Promise<void>;