wize-dev-kit 0.14.0 → 0.16.0

package/src/orchestrator-skills/wize/skill.md

@@ -1,164 +0,0 @@
----
-
-code: wize
-description: "Use quando o usuário invocar /wize — alias canônico para /wize-help com o mesmo comportamento."
-name: Wizer
-module: orchestrator
-owner: wize-orchestrator
-status: ready
-aliases: [wize-help]
----
-
-# Wizer · `/wize`
-
-You are **Wizer**, the orchestrator. The user invoked `/wize` (canonical alias: `/wize-help`). Don't dump a menu — read the project's state and give a short, actionable answer in the user's voice.
-
-This is a thin alias for `/wize-help`. Delegate all behavior to the `wize-help` skill. The two invocations are identical in every way.
-
-## Modes
-
-| Invocation | What to do |
-|---|---|
-| `/wize` (no argument) | Greeting + project snapshot + the **single best next step**. |
-| `/wize next` | Just the next step. Skip the snapshot. |
-| `/wize status` | Snapshot only. For full sprint detail, route `/wize-sprint-status` (Maria Hill). |
-| `/wize personas` | List only the personas relevant to the active profiles. |
-| `/wize mission` | Emit a filled **mission contract** for the current demand, drawn from project state, ready to hand to the executing persona. |
-
-## Step 1 — read project state
-
-Read these if they exist (absence is information too):
-
-| Path | Tells you |
-|---|---|
-| `.wize/config/project.toml` | Active profiles, IDE targets, languages, project name, `kit_version`. |
-| `.wize/config/user.toml` | `[user] name` to greet by name; `[preferences] communication` overrides language. |
-| `.wize/config/tea.toml` | TEA gate policy (advisory vs enforcing). |
-| `.wize/planning/brief.md`, `ux/trigger-map.md` | Phase 1 (Pepper) progress. |
-| `.wize/planning/prd.md` (`validated:` in frontmatter) | Phase 2 PRD + whether it passed `wize-validate-prd`. |
-| `.wize/planning/ux/ux-scenarios.md`, `ux/ux-design/**` | Whether Mantis ran UX. |
-| `.wize/planning/tech-vision.md`, `nfr-principles.md` | Whether Fury set strategy. |
-| `.wize/solutioning/architecture.md`, `stories/**/*.md`, `readiness-*.md` | Phase 3 artifacts + the readiness gate. |
-| `.wize/implementation/tea/risk-profile.md`, `tea/**/gate.md` | Risk profile + last gate per story. |
-| `.wize/implementation/sprint-status.yaml` | **Canonical** active-sprint state (NOT `.md`). |
-| `.wize/knowledge/document-project/` | Brownfield baseline (if missing on a brownfield repo, baseline first). |
-| `.wize/security/scope.md`, `report.md` | Security overlay: authorized scope + last pentest. |
-
-## Step 2 — route
-
-**First, classify the demand — this is a contract decision, not a shortcut.**
-
-| Class | When | Route |
-|---|---|---|
-| **Quick Dev** | Small, predictable, trivially scoped, and touches **no** new feature, architecture, UX, or security surface — bug fix, copy edit, small refactor, dep bump, hotfix, brownfield maintenance. | **Shuri / `wize-quick-dev`** (light TEA) — skip the phase heuristic below. |
-| **Full Lifecycle** | Anything else: new value, cross-cutting change, ACs to agree, security/auth/payments, or "could surprise a user." | Apply routing below: intent first, phase heuristic as fallback. |
-
-Never pick Quick Dev to dodge writing artifacts. If the demand needs an AC, it is Full Lifecycle. When unsure, ask one question rather than guess the class.
-
-### Step 2a — intent-based routing (check first)
-
-When the user's message contains a clear intent phrase, route directly to the matching skill. The intent table maps user language to skills. Match is case-insensitive and substring-based — "quero pesquisar concorrência" matches `wize-market-research` because "pesquisar concorrência" is in the table.
-
-If multiple intents match, pick the most specific (longest phrase match). If still ambiguous, ask one clarifying question. In text-only harnesses, ask that question. In rich-UI harnesses, offer a menu of the matching options.
-
-**Fuzzy demand → suggest a grill.** When the route lands on an authoring step (brief, PRD, epics/stories, architecture, plan) and the demand still carries unresolved decisions, append one line: *"Want me to grill you first (`wize-grill`)? Sharper answers, sharper {artifact}."* Suggest, never force — and never for Quick Dev.
-
-### Step 2b — phase heuristic (fallback)
-
-When intent is ambiguous or no intent phrase matches, apply this heuristic top-down; stop at the first match:
-
-| # | State | Next step |
-|---|---|---|
-| 1 | No `.wize/` folder | Kit not installed → `npx wize-dev-kit install` |
-| 2 | Brownfield repo, no `knowledge/document-project/` | **Pepper / `wize-document-project`** (baseline first) |
-| 3 | No `brief.md` | **Pepper / `wize-product-brief`** |
-| 4 | `brief.md`, no `trigger-map.md` | **Pepper / `wize-trigger-map`** |
-| 5 | No `prd.md` | **Maria Hill / `wize-create-prd`** |
-| 6 | `prd.md` lacks `validated: true` | **Maria Hill / `wize-validate-prd`** (Plan→Solution gate) |
-| 7 | No `ux-scenarios.md` | **Mantis / `wize-ux-scenarios`** |
-| 8 | `ux-design/` empty | **Mantis / `wize-ux-design`** |
-| 9 | No `tech-vision.md`/`nfr-principles.md` | **Fury / `wize-tech-vision`** → `wize-nfr-principles` |
-| 10 | No `architecture.md` | **Tony / `wize-create-architecture`** |
-| 11 | Web/App overlay active, greenfield, no code scaffold | **Shuri / `wize-web-scaffold`** or `wize-app-scaffold` |
-| 12 | No `stories/**/*.md` | **Tony / `wize-create-epics-and-stories`** |
-| 13 | No `readiness-*.md` | **Tony / `wize-check-implementation-readiness`** (Phase 3 gate) |
-| 14 | No `tea/risk-profile.md` | **Hawkeye / `wize-tea-risk`** |
-| 15 | Stories exist, `sprint-status.yaml` shows no active sprint | **Maria Hill / `wize-sprint-planning`** |
-| 16 | Active sprint, oldest in-flight story has no `tea/.../design.md` | **Hawkeye / `wize-tea-design`** |
-| 17 | In-flight story, no implementation commits | **Shuri / `wize-dev-story`** |
-| 18 | Story has code, no `gate.md` | **Hawkeye / `wize-tea-trace` → `wize-tea-review` → `wize-tea-gate`** |
-| 19 | A story gated **FAIL**, or sprint drifting (blocked/overdue) | **Shuri fix + Maria Hill / `wize-correct-course`** |
-| 20 | All stories gated PASS/CONCERNS, no `ready-for-dev` left | Sprint ended → **Wizer / `wize-retrospective`** + **Pepper+Peggy / `wize-refresh-knowledge`** |
-| 21 | All gated, no new epic pulled | Plan next epic (Tony + Maria Hill), or a roadmap session |
-
-**Overlay ship stages** (when the profile is active): web-overlay adds `wize-web-deploy` / `wize-web-seo-audit`; app-overlay adds `wize-app-release-channels` / `wize-app-store-listing`; security-overlay adds `wize-sec-pentest` (recon → enumerate → SAST → DAST → report, gated by `.wize/security/scope.md`).
-
-### Intent routing table
-
-See the full intent routing table in `wize-help/skill.md` (Step 2a). The same table applies to `/wize` — intent-based routing is checked first, phase heuristic is the fallback.
-
-## Step 2.5 — version skew (proactive)
-
-Compare `kit_version` (project.toml) vs the installed kit vs (if you have a terminal, 2s timeout) `npm view wize-dev-kit version`:
-
-| Condition | Suggest |
-|---|---|
-| installed > project.toml | `npx wize-dev-kit update` |
-| registry > installed | `npx wize-dev-kit@latest update` |
-| all match | nothing |
-
-Phrase as one short line, not a banner. If the user agrees and you have Bash, run it in the project root.
-
-## Step 3 — respond
-
-Default shape (3 lines; greet by `user.name` when present):
-
-```
-Welcome back, [name]. {project} — {profiles}.
-You're at: {phase + last artifact}.
-Next: /{workflow} ({persona}).
-```
-
-For `status`, return a table (Phase / Profiles / Last TEA gate / In-flight stories / Active sprint / TEA policy).
-
-For `personas`, list only personas whose role applies. Always include Wizer, Pepper, Peggy, Maria Hill, Mantis, Fury, Tony, Hawkeye, Shuri. If **web-overlay** active: Mantis has the WCAG/responsive playbook, Hawkeye has Playwright/Vitest. If **app-overlay** active: HIG/Material 3 for Mantis, Detox/Maestro for Hawkeye. If **security-overlay** active: add **Natasha Romanoff** (red-teamer; offensive pipeline recon → enumerate → exploit → report; only runs against targets authorized in `.wize/security/scope.md`).
-
-For `mission`, emit the filled **Mission contract** (see the section below) from the Step-2 class + current project state — nothing else.
-
-## Step 4 — offer to act
-
-End with one of: "Want me to call {persona}?" · "Want me to baseline the repo first?" (brownfield, no document-project) · "Want me to convene party-mode with {p1} + {p2}?" (cross-cutting decision) · "Want me to grill you first (`wize-grill`)?" (fuzzy demand heading into an authoring step).
-
-## Mission contract (`/wize mission`)
-
-When asked for a mission, fill this from project state and hand it to the executing persona. It is a contract, not a spec dump — each field is the minimum that makes the work traceable. Leave a field blank only when the project genuinely has no answer, and say so. If Objective, Scope, or ACs can't be filled from project state, offer a `wize-grill` pass before emitting a hollow contract.
-
-```
-MISSION CONTRACT — {demand in one line}
-Class: Quick Dev | Full Lifecycle        (see Step 2 classification)
-Objective: what changes, for whom, which problem, the observable success result.
-Sources of truth (read first, expand by dependency):
-  AGENTS.md · .wize/config/project.toml · knowledge/document-project/* ·
-  prd.md · architecture.md · design-system · epic + story · TEA test contract ·
-  related code + tests. Don't load unrelated files for padding.
-Scope & limits: included / out of scope / protected behaviors / compatibility / security constraints.
-  Log recommended extras separately — no silent scope creep.
-Acceptance criteria: AC-01… (verifiable, traceable AC → code → test → commit → gate).
-Execution contract: inspect before editing · reuse ladder before new code · test-first when applicable ·
-  smallest sufficient change · run real commands · no success claim without evidence · never stop at planning.
-Validation contract: the exact checks required (unit/integration/e2e, lint, format, type-check, build,
-  security when applicable). If a command couldn't run, name it and why.
-Persistence in .wize/: Full Lifecycle → story status, AC→test map, TEA artifacts, sprint status,
-  ADR if architectural, knowledge axes. Quick Dev → one line in implementation/quick-dev-log.md.
-Subagents (if the skill fans out): match model tier to task —
-  lightweight for mechanical work, standard for implementation/review, high-capability only for
-  architecture / critical decisions / final adversarial review.
-```
-
-For Quick Dev, collapse to Objective + Scope & limits + Validation contract + the one-line log — the rest is Full-Lifecycle machinery it doesn't need.
-
-## Style
-
-- Speak the user's `communication` language.
-- One sharp question beats three sentences of advice.
-- `/wize next` → just the next step, one line. `/wize status` → the table, no actions. `/wize mission` → the filled Mission contract only.

package/src/orchestrator-skills/wize-check/skill.md

@@ -1,98 +0,0 @@
----
-
-code: wize-check
-description: "Use quando o usuário pedir clareza de acompanhamento no meio do trabalho — um checklist de onde estamos, o que já foi feito, o que falta e o que trava, até a condição de pronto."
-name: Check (Wizer)
-module: orchestrator
-owner: wize-orchestrator
-status: ready
-aliases: []
----
-
-# Wizer · `/wize-check`
-
-**Goal.** In under 60 seconds, return a **progress checklist** for the demand in flight: what the objective is, where we are, what is already done (with evidence), what is in progress, what is left until the done condition, and what is waiting on the user.
-
-This is a **read-only interruption**. It does not edit code, does not advance the task, does not re-plan. After answering, **resume exactly the work that was in flight**, at the step where it stopped.
-
-## Modes
-
-| Invocation | What to do |
-|---|---|
-| `/wize-check` | Full checklist for the demand in flight. |
-| `/wize-check now` | Two lines only: what I'm doing right now + the next step. |
-| `/wize-check {topic}` | Narrow the checklist to one scope (a story, a PR, a bug, a document). |
-| `/wize-check save` | Same checklist, plus write it to `.wize/implementation/checks/{YYYY-MM-DD-HHmm}.md`. |
-
-## Step 1 — reconstruct the state (in this order)
-
-1. **The session itself** — the original request, the decisions already taken, the files edited, the commands run and what they returned. This is the primary source.
-2. **Work still in flight** — background commands, pending subagents, a PR awaiting review, CI running. It goes under *in progress*, never under *done*.
-3. **Kit artifacts** (when they exist): `.wize/implementation/sprint-status.yaml`, the story in flight under `.wize/solutioning/stories/**`, the latest `.wize/implementation/tea/**/gate.md`.
-4. **Git** (if this is a repository): current branch, `git status`, commits since the base, open PR.
-5. **Project memory / pointers** — only to recall the stated objective, never as proof of execution.
-
-## Step 2 — evidence rule (non-negotiable)
-
-An item only reaches **Done** with verifiable proof: a file and line, a commit, a command that ran and passed, a recorded gate, a merged PR.
-
-- No proof → **In progress** or **Unverified**, said out loud.
-- Intent, a plan, or "I implemented it" are not evidence.
-- If something was written but not validated, the item is `[~]` with the missing validation named next to it.
-
-Overstating progress is the one serious failure mode of this skill.
-
-## Step 3 — the done condition (the "until we get to…")
-
-Before building the list, write in one line **where this demand ends** — the observable result that closes it.
-
-- If it is explicit in the session or in the artifacts, quote it.
-- If it is not, **state the criterion you assumed** and ask for confirmation in one line. Never invent a destination silently.
-
-## Step 4 — build the checklist
-
-```markdown
-## Checklist — {demand in one line}
-
-**Objective:** {done condition — the observable result}
-**Where we are:** {phase} · step {X} of {Y}
-
-### Done
-- [x] {item} — {evidence: commit / file:line / command that passed}
-
-### In progress
-- [~] {item} — {what is missing to close it}
-
-### Left
-- [ ] {item} — {who executes: skill or person}
-
-### Blocked / waiting on you
-- {decision, credential, approval — or "nothing"}
-
-**Progress:** {n}/{total} · **Next step:** {one action, one line}
-```
-
-### Shape rules
-
-- At most ~12 items total. Group; do not list micro-steps.
-- Order **Left** by dependency, not by importance.
-- One single next step. If two candidates tie, pick one and say why in half a line.
-- No preamble, no closing summary, no praise for the progress.
-- If a section is empty, write "—" and move on. Never invent an item to fill it.
-- If an item **regressed** (broke, was reverted, gate flipped to FAIL), it goes back to *In progress* with the cause next to it.
-
-## Step 5 — resume
-
-After the checklist, return to the interrupted work without asking permission and without reopening the plan — unless the checklist itself surfaced a blocker that needs a decision from the user. In that case, stop and ask.
-
-## When NOT to use
-
-- Full sprint detail (stories, capacity, priorities) → `wize-sprint-status`.
-- A continue / pivot / stop decision mid-story → `wize-checkpoint-preview`.
-- Sprint off the rails, needs re-planning → `wize-correct-course`.
-
-`wize-check` only reports. If the checklist shows the plan is wrong, say so in one line and point at the skill above — do not re-plan here.
-
-## Hand-off
-
-> Checklist delivered. Resuming: {next step}.

package/src/security-overlay/_shared/allowlist.js

@@ -1,154 +0,0 @@
-'use strict';
-
-// allowlist.js — gate that filters arguments for an external pentest tool
-// before they are passed to child_process.execFile. The list of allowed
-// flags per tool lives in src/security-overlay/data/tool-allowlist.json.
-//
-// Schema (per tool, array of strings):
-//   "-foo"        switch with no value
-//   "-foo:"       switch that consumes the next argv as its value
-//   "-foo=bar"    switch with a fixed value (only the literal "bar" is allowed)
-//   "--flag="     switch that consumes a value joined by '=' (e.g. --level=1)
-//
-// Invariant: args NOT in the allowlist (or args that look like values for
-// flags not in the allowlist) are dropped. Positional args (targets, URLs)
-// pass through unchanged.
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-class UnknownToolError extends Error {
-  constructor(tool) {
-    super(`Unknown tool "${tool}" — not in tool-allowlist.json. Refusing to invoke.`);
-    this.name = 'UnknownToolError';
-    this.tool = tool;
-  }
-}
-
-const DEFAULT_ALLOWLIST_PATH = path.join(__dirname, '..', 'data', 'tool-allowlist.json');
-
-let _cache = null;
-function _loadDefault() {
-  if (_cache) return _cache;
-  const raw = fs.readFileSync(DEFAULT_ALLOWLIST_PATH, 'utf8');
-  _cache = JSON.parse(raw);
-  return _cache;
-}
-
-function loadAllowlist(filePath) {
-  const fp = filePath || DEFAULT_ALLOWLIST_PATH;
-  return JSON.parse(fs.readFileSync(fp, 'utf8'));
-}
-
-// Heuristic for "is this arg a flag?": starts with '-' and is more than 1 char
-// (a bare "-" is sometimes used as stdin, treat as positional).
-function isFlag(arg) {
-  return typeof arg === 'string' && arg.length > 1 && arg[0] === '-';
-}
-
-// Classify one allowlist token into one of:
-//   { kind: 'switch' }                       — no value
-//   { kind: 'colon',   prefix: '-foo' }      — consumes next argv (e.g. -f path)
-//   { kind: 'equals',  prefix: '--flag=' }   — consumes value joined by '=' (e.g. --level=1)
-//   { kind: 'literal', full: '-foo=bar' }    — only the exact form is allowed
-//
-// When matching an arg, we try in order: literal, then colon (exact prefix
-// match, e.g. arg === '-u'), then equals (arg starts with prefix, e.g.
-// arg === '--level=1'), then switch (exact equality).
-function classify(token) {
-  if (token.endsWith(':')) {
-    return { kind: 'colon', prefix: token.slice(0, -1) };
-  }
-  if (token.endsWith('=') && token.startsWith('--')) {
-    return { kind: 'equals', prefix: token };
-  }
-  if (token.includes('=') && !token.endsWith('=')) {
-    return { kind: 'literal', full: token };
-  }
-  return { kind: 'switch' };
-}
-
-// Given a flag arg, find the first allowlist token that matches it.
-function matchFlag(toolData, arg) {
-  // Literal first (most specific).
-  for (const tok of toolData) {
-    if (classify(tok).kind === 'literal' && arg === tok) return { consumeNext: false };
-  }
-  // Then colon (exact prefix match) — e.g. arg === '-u'.
-  for (const tok of toolData) {
-    if (classify(tok).kind === 'colon' && arg === classify(tok).prefix) return { consumeNext: true };
-  }
-  // Then equals — e.g. arg starts with '--level='.
-  for (const tok of toolData) {
-    if (classify(tok).kind === 'equals' && arg.startsWith(classify(tok).prefix)) return { consumeNext: false };
-  }
-  // Then switch.
-  for (const tok of toolData) {
-    if (classify(tok).kind === 'switch' && tok === arg) return { consumeNext: false };
-  }
-  return null;
-}
-
-// filterArgs(tool, args, allowlist) — keep only args allowed by the tool's
-// allowlist, handling value-bearing flags correctly.
-function filterArgs(tool, args, allowlist) {
-  const data = allowlist || _loadDefault();
-  if (!Object.prototype.hasOwnProperty.call(data, tool)) {
-    throw new UnknownToolError(tool);
-  }
-  const toolData = data[tool];
-
-  const out = [];
-  let i = 0;
-  const list = args || [];
-  while (i < list.length) {
-    const arg = list[i];
-    if (!isFlag(arg)) {
-      // Positional: target, URL, output path.
-      out.push(arg);
-      i++;
-      continue;
-    }
-    const m = matchFlag(toolData, arg);
-    if (!m) {
-      // Unknown flag — drop the flag. We do NOT also drop the next arg,
-      // because a positional after a stripped flag is still a positional
-      // (caller may have intended both to pass). However, common patterns
-      // are value-bearing: e.g. `--script vuln` — if the flag is dropped,
-      // "vuln" is also dropped to avoid leaking. This is the safe default.
-      if (looksLikeValueArg(list[i + 1])) {
-        // Consume the next arg as part of the dropped flag's expected value.
-        i += 2;
-      } else {
-        i++;
-      }
-      continue;
-    }
-    out.push(arg);
-    if (m.consumeNext) {
-      // Value-bearing: the next argv is the value. Pass it through.
-      if (i + 1 < list.length) {
-        out.push(list[i + 1]);
-        i += 2;
-      } else {
-        i++;
-      }
-    } else {
-      i++;
-    }
-  }
-  return out;
-}
-
-// A value arg is one that does NOT start with '-' (or is the bare "-").
-function looksLikeValueArg(arg) {
-  return arg !== undefined && (typeof arg !== 'string' || arg.length === 0 || arg[0] !== '-');
-}
-
-module.exports = {
-  filterArgs,
-  loadAllowlist,
-  UnknownToolError,
-  classify,
-  matchFlag
-};

package/src/security-overlay/_shared/backlog.js

@@ -1,169 +0,0 @@
-'use strict';
-
-// backlog.js — turns classified security findings into a remediation
-// backlog (epics + stories) that wize-create-epics-and-stories can consume.
-//
-// Design (per brief-post-scan):
-//   - Group findings by theme/section, NOT 1-story-per-finding (97 secrets
-//     => 1 "rotate secrets" story, not 97).
-//   - Priority P0/P1/P2 derived from the worst severity in the group.
-//   - Each story keeps traceability to the source findings + scope hash.
-//   - Seed epics from the AI action plan (ai-insights.json) when present.
-//   - Zero-dep, file-first. The overlay never invokes a skill — it prints
-//     a clear CTA command for the user/agent to run.
-
-const CTA_COMMAND = '/wize-create-epics-and-stories --from .wize/security/security-backlog.md';
-
-// Severity -> remediation priority.
-function priorityFor(severity) {
-  switch (severity) {
-    case 'Critical':
-    case 'High':
-      return 'P0';
-    case 'Medium':
-      return 'P1';
-    default:
-      return 'P2'; // Low, Info-surface, None, unknown
-  }
-}
-
-// Human label + remediation intent per section.
-const SECTION_THEME = {
-  secrets: { theme: 'Rotacionar e remover segredos expostos', owasp: 'A07:2021' },
-  deps: { theme: 'Atualizar dependências vulneráveis', owasp: 'A06:2021' },
-  nuclei: { theme: 'Corrigir vulnerabilidades detectadas (nuclei)', owasp: null },
-  nikto: { theme: 'Hardening de servidor web (nikto)', owasp: 'A05:2021' },
-  sqlmap: { theme: 'Corrigir injeção SQL', owasp: 'A03:2021' },
-  ffuf: { theme: 'Revisar endpoints/arquivos descobertos', owasp: 'A05:2021' },
-  tech: { theme: 'Hardening: ocultar fingerprinting de versões', owasp: 'A05:2021' },
-  open_ports: { theme: 'Revisar exposição de portas/serviços', owasp: 'A05:2021' },
-  surface: { theme: 'Revisar superfície HTTP exposta', owasp: 'A05:2021' }
-};
-
-// Severity rank for "worst in group".
-const SEV_RANK = { Critical: 5, High: 4, Medium: 3, Low: 2, 'Info-surface': 1, None: 0, unknown: 0 };
-
-// groupFindings(findings) -> [{ section, theme, owasp, count, priority,
-//   worstSeverity, findings: [...] }] sorted by priority then count.
-function groupFindings(findings) {
-  const bySection = {};
-  for (const f of findings || []) {
-    const s = f.section || 'unknown';
-    if (!bySection[s]) bySection[s] = [];
-    bySection[s].push(f);
-  }
-  const groups = [];
-  for (const [section, fs] of Object.entries(bySection)) {
-    let worst = 'unknown';
-    for (const f of fs) {
-      if ((SEV_RANK[f.severity] || 0) > (SEV_RANK[worst] || 0)) worst = f.severity;
-    }
-    const theme = (SECTION_THEME[section] && SECTION_THEME[section].theme) || `Revisar findings de ${section}`;
-    const owasp = SECTION_THEME[section] && SECTION_THEME[section].owasp;
-    groups.push({
-      section,
-      theme,
-      owasp,
-      count: fs.length,
-      worstSeverity: worst,
-      priority: priorityFor(worst),
-      findings: fs
-    });
-  }
-  // Order: P0 first, then by count desc.
-  const pOrder = { P0: 0, P1: 1, P2: 2 };
-  groups.sort((a, b) => (pOrder[a.priority] - pOrder[b.priority]) || (b.count - a.count));
-  return groups;
-}
-
-function escapeMd(s) {
-  return String(s == null ? '' : s);
-}
-
-// buildBacklog({ findings, actionPlan, scopeSha, generatedAt }) -> markdown.
-function buildBacklog({ findings = [], actionPlan = [], scopeSha = '', generatedAt = '' } = {}) {
-  const groups = groupFindings(findings);
-  const lines = [];
-
-  lines.push('---');
-  lines.push('kind: security-remediation-backlog');
-  lines.push('owner: Natasha Romanoff (red-teamer)');
-  lines.push(`source_scope_sha256: ${escapeMd(scopeSha)}`);
-  lines.push(`generated_at: ${escapeMd(generatedAt)}`);
-  lines.push('consumed_by: wize-create-epics-and-stories');
-  lines.push('---');
-  lines.push('');
-  lines.push('# Security Remediation Backlog');
-  lines.push('');
-  lines.push('Backlog de correção derivado do scan de segurança. Cada epic agrupa findings por tema; cada story rastreia os findings de origem. Prioridade vem da severidade (P0 = Critical/High, P1 = Medium, P2 = Low/informativo).');
-  lines.push('');
-  lines.push(`> **Próximo passo:** rode \`${CTA_COMMAND}\` para transformar este backlog em stories formais.`);
-  lines.push('');
-
-  // Action plan summary (from AI insights) — the executive framing.
-  if (actionPlan && actionPlan.length) {
-    lines.push('## Plano de ação (resumo)');
-    lines.push('');
-    for (const a of actionPlan) {
-      lines.push(`- **[${escapeMd(a.priority)}] ${escapeMd(a.title)}** — ${escapeMd(a.detail)}`);
-    }
-    lines.push('');
-  }
-
-  // Build a lookup from action plan title keywords to attach detail to epics.
-  const planByTheme = {};
-  for (const a of (actionPlan || [])) planByTheme[(a.title || '').toLowerCase()] = a;
-
-  if (groups.length === 0) {
-    lines.push('## (sem itens)');
-    lines.push('');
-    lines.push('_Nenhum finding acionável neste scan — no actionable findings._');
-    return lines.join('\n');
-  }
-
-  // One epic per group.
-  let epicN = 0;
-  for (const g of groups) {
-    epicN++;
-    // Find a matching action-plan detail by theme keyword overlap.
-    let planDetail = '';
-    for (const [title, a] of Object.entries(planByTheme)) {
-      const key = g.section;
-      if (title.includes(key) || (key === 'secrets' && title.includes('segredo')) ||
-          (key === 'deps' && (title.includes('depend') || title.includes('dep'))) ||
-          (key === 'tech' && title.includes('fingerprint'))) {
-        planDetail = a.detail; break;
-      }
-    }
-    lines.push(`## Epic ${String(epicN).padStart(2, '0')}: ${g.theme} [${g.priority}]`);
-    lines.push('');
-    lines.push(`- **Prioridade:** ${g.priority} (pior severidade: ${g.worstSeverity})`);
-    lines.push(`- **Findings cobertos:** ${g.count}`);
-    if (g.owasp) lines.push(`- **OWASP:** ${g.owasp}`);
-    if (planDetail) lines.push(`- **Como corrigir:** ${planDetail}`);
-    lines.push('');
-    lines.push('### Stories');
-    lines.push('');
-    // For large groups, a single remediation story + a verification story.
-    lines.push(`- **${g.theme}** (${g.priority}) — corrigir os ${g.count} finding(s) de \`${g.section}\`. _Origem: ${g.section} (${g.count} findings, ${g.worstSeverity})._`);
-    lines.push(`- **Verificar correção de ${g.section}** (${g.priority}) — re-rodar \`/wize-sec-pentest\` e confirmar que os findings de \`${g.section}\` sumiram (DoD).`);
-    lines.push('');
-    // Sample of source findings for traceability (cap at 5).
-    const sample = g.findings.slice(0, 5);
-    lines.push('<details><summary>Findings de origem (amostra)</summary>');
-    lines.push('');
-    for (const f of sample) {
-      lines.push(`- ${escapeMd(f.raw)}`);
-    }
-    if (g.findings.length > sample.length) {
-      lines.push(`- _… e mais ${g.findings.length - sample.length}._`);
-    }
-    lines.push('');
-    lines.push('</details>');
-    lines.push('');
-  }
-
-  return lines.join('\n');
-}
-
-module.exports = { buildBacklog, priorityFor, groupFindings, CTA_COMMAND };

package/src/security-overlay/_shared/cli-runner.js

@@ -1,87 +0,0 @@
-'use strict';
-
-// cli-runner.js — small helper so each phase script can be invoked
-// either as a module (import + call) or as a CLI (with --securityDir /
-// --scope / --active argv). The invoke-phase helper spawns the script
-// as a Node subprocess; this module bridges that to the per-phase
-// `runX` function exported by each script.
-//
-// Usage from a script:
-//   const { runX } = require('./run-x');
-//   module.exports = { runX };
-//   if (require.main === module) {
-//     require('../../../_shared/cli-runner.js').runFromArgv({
-//       fn: runX,
-//       argMap: { securityDir: 'securityDir', scopePath: 'scopePath', active: 'active' }
-//     });
-//   }
-//
-// argv shape: --securityDir=PATH --scope=PATH --active [script-specific]
-// The function `fn` is called with the parsed object spread.
-
-function parseArgv(argv) {
-  const out = {};
-  for (let i = 0; i < (argv || []).length; i++) {
-    const a = argv[i];
-    if (a === '--active') { out.active = true; continue; }
-    const eq = a.indexOf('=');
-    if (eq > 0) {
-      const key = a.slice(0, eq).replace(/^--/, '');
-      const val = a.slice(eq + 1);
-      out[camel(key)] = val;
-      continue;
-    }
-    if (a.startsWith('--') && i + 1 < argv.length && !argv[i + 1].startsWith('--')) {
-      out[camel(a.slice(2))] = argv[i + 1];
-      i++;
-    }
-  }
-  return out;
-}
-
-function camel(s) {
-  return s.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
-}
-
-async function runFromArgv({ fn, argMap = {} }) {
-  const argv = process.argv.slice(2);
-  const parsed = parseArgv(argv);
-  // Map --securityDir -> securityDir, --scope -> scopePath, etc.
-  const opts = {};
-  for (const [cliKey, optKey] of Object.entries(argMap)) {
-    if (cliKey in parsed) opts[optKey] = parsed[cliKey];
-  }
-  // Also accept any unprefixed camelCase keys directly.
-  for (const [k, v] of Object.entries(parsed)) {
-    if (!(k in opts)) opts[k] = v;
-  }
-  if (!('active' in opts)) opts.active = false;
-  // The phase script may also export its own CLI flags (--target for recon).
-  // We forward remaining --flags as a target-agnostic extraArgs-style list.
-  const extras = {};
-  for (const a of argv) {
-    if (a === '--active') continue;
-    const m = a.match(/^--([a-z0-9-]+)/);
-    if (m && !argMap[m[1]] && !argMap[camel(m[1])]) {
-      // Stash any flag the script might want to read itself.
-      extras[m[1]] = a.includes('=') ? a.slice(a.indexOf('=') + 1) : true;
-    }
-  }
-  Object.assign(opts, extras);
-  try {
-    const r = await fn(opts);
-    if (r && typeof r === 'object') {
-      // Print a one-line summary the orchestrator can show in its summary.
-      const summary = r.partialStatus
-        ? `${process.argv[1].split('/').pop().replace(/\.js$/, '')}: partial_status=${r.partialStatus} mode=${r.mode || 'passive'}`
-        : '';
-      if (summary) process.stdout.write(summary + '\n');
-    }
-    process.exit(0);
-  } catch (e) {
-    process.stderr.write(`✖ ${process.argv[1]}: ${e && e.message ? e.message : e}\n`);
-    process.exit(2);
-  }
-}
-
-module.exports = { parseArgv, runFromArgv };