yadflow 4.0.0 → 4.1.0

package/bin/commands.mjs

@@ -35,6 +35,7 @@ export { runRepo } from '../cli/repo.mjs';
 export { runRiskMap } from '../cli/riskmap-command.mjs';
 export { runCodeowners } from '../cli/codeowners-command.mjs';
 export { runDocs } from '../cli/docs.mjs';
+export { runDetect } from '../cli/detect.mjs';
 export { runDoctor } from '../cli/doctor.mjs';
 export { runMigrate, warnIfProjectAhead } from '../cli/migrate.mjs';
 export { runNext } from '../cli/next.mjs';

package/bin/yad.mjs

@@ -116,6 +116,10 @@ ${c.bold('Where am I / what next')}
                                        Bind a step to a skill of your own. Several skills run in
                                        the order given, one after another — each costs tokens
   yad skill unbind <step>              Drop the binding; the step goes back to the engine's default
+  yad detect [--json] [--dir <folder>] Which skills, agents, MCP servers and plugins are installed
+                                       for the agents that work here — in this folder and in your
+                                       home folder, and which agents read each place. Read-only;
+                                       MCP servers are named, never their commands or settings
   yad skip <epic> <step> --reason <text>   Mark an optional step N/A for this epic. Which steps
                                        those are comes from the epic's lifecycle route — on classic
                                        and analysis-first, ui-design: a backend/API/data epic with no
@@ -553,12 +557,12 @@ async function main() {
   // A project written by a newer yadflow is warned about before any command reads it (docs/migrations/
   // shape-8.md). Not on `hook` — its stderr is the channel a block reason reaches a model on — and not
   // where the command reports the same thing itself (doctor, migrate) or runs before a project exists.
-  if (!['hook', 'doctor', 'migrate', 'setup', 'report', 'new', 'init', 'join'].includes(cmd)) commands.warnIfProjectAhead(o.dir || process.cwd());
+  if (!['hook', 'doctor', 'migrate', 'setup', 'report', 'detect', 'new', 'init', 'join'].includes(cmd)) commands.warnIfProjectAhead(o.dir || process.cwd());
   // E122: the Product's settings (or an epic's PR ledger) under two names that say different things.
   // Every command refuses rather than pick one — whichever it picked, somebody's edit would be silently
   // ignored. Not `doctor` (it reports the drift), `migrate` (it ends it) or `report` (it files a bug
   // about a broken flow, and reads nothing it could get wrong). `hook` returned above: it guards.
-  if (!['doctor', 'migrate', 'report'].includes(cmd)) {
+  if (!['doctor', 'migrate', 'report', 'detect'].includes(cmd)) {
     // Both the folder the command runs on and, for a code-repo command, the Product it reads.
     for (const root of new Set([o.dir || process.cwd(), o.product].filter(Boolean))) {
       const drift = commands.productDriftError(root);
@@ -619,6 +623,13 @@ async function main() {
     case 'migrate':
       result = await commands.runMigrate(o.dir, { apply: o.apply, json: o.json, keep: o.keep ?? null });
       break;
+    case 'detect': {
+      // E50. Reads the folder and the home folder; writes nothing.
+      const [, extra] = o._;
+      if (extra) { refuse(`yad detect takes no words (got: ${extra})`, 'usage: yad detect [--json] [--dir <folder>]'); break; }
+      result = commands.runDetect(o.dir || process.cwd(), { json: o.json });
+      break;
+    }
     case 'report':
       result = await commands.runReport(o.dir, { message: o.message });
       break;
@@ -948,7 +959,7 @@ main()
   })
   .catch(async (err) => {
     // Under --json every failure is still one object on stdout (E1) — a refusal from the parser, a
-    // thrown YadError, a bug. The `code` is the `YAD-` code README "Troubleshooting" is keyed on.
+    // thrown YadError, a bug. The `code` is the `YAD-` code the docs/CLI.md "Error codes" table is keyed on.
     // If the command had already answered, stdout holds its object, and the failure goes to stderr.
     if (inJSON() && !jsonEmitted()) {
       if (err?.parsedCmd !== undefined && runningCmd === null) beginJSON(commandName(err.parsedWords ?? []));
@@ -959,7 +970,7 @@ main()
     const code = err?.code && /^YAD-/.test(err.code) ? ` [${err.code}]` : '';
     log(c.red(`\nyad failed${code}: ${err?.message || err}`));
     if (err?.hint) log(c.yellow(`  → ${err.hint}`));
-    if (code) log(c.dim('  (see README "Troubleshooting" for this code, or run `yad doctor`)'));
+    if (code) log(c.dim('  (see the error codes in https://github.com/abdelrahmannasr/yadflow/blob/main/docs/CLI.md#error-codes, or run `yad doctor`)'));
     process.exitCode = 1;
     // Offer to report the failure — but only interactively (never in CI), and opt-out via
     // YAD_NO_REPORT. `report` failing on its own would land here, so never re-offer for it.
@@ -990,7 +1001,8 @@ main()
       // block reason travels on — an update banner there would land in front of a model.
       // Resolved the way main() resolves it, NOT from argv[2]: that is the first raw argument, so
       // `yad --dir <path> hook ledger-guard` puts `--dir` there and the banner slips through.
-      if (parseArgs(process.argv.slice(2))._[0] !== 'hook') {
+      // Nor `detect` (E50): it promises no network and no file written, and the check does both.
+      if (!['hook', 'detect'].includes(parseArgs(process.argv.slice(2))._[0])) {
         const { maybeNotifyUpdate } = await import('./commands.mjs');
         await maybeNotifyUpdate();
       }

package/cli/capture.mjs

@@ -319,7 +319,7 @@ export async function runCapture(root, { hook = false, noPush = false, now = Dat
     // secret captured by mistake, say) is not continued from a stale copy (E43 review 3). This prune clears
     // every stale copy on the hand path; a LOCAL branch is still pushed back, and the hook, which never
     // fetches, still reads a copy another fetch left. Removing one for good means `git branch -D` and
-    // `git branch -dr origin/…` on every machine too (README). The same
+    // `git branch -dr origin/…` on every machine too (docs/CLI.md, Background capture). The same
     // low-speed limit as the push, so a stalled HTTPS connection gives up instead of holding the capture.
     spawnSync('git', ['-c', 'http.lowSpeedLimit=1000', '-c', 'http.lowSpeedTime=20', 'fetch', '--quiet', '--prune', '--no-tags', 'origin', `+refs/heads/${WIP_PREFIX}/${name}/*:refs/remotes/origin/${WIP_PREFIX}/${name}/*`],
       { cwd: root, stdio: 'ignore', timeout: 30_000, env: { ...env, ...pushEnv(env) } });

package/cli/claims.mjs

@@ -22,7 +22,7 @@
 // may lose the race in silence. Nothing reads those copies while the local branch exists, and a capture by
 // hand fetches (with prune) before it relies on them.
 //
-// LIMITS, said in the README: capture off, or offline, is invisible; the push runs at most every 5 minutes;
+// LIMITS, said in docs/CLI.md (claims): capture off, or offline, is invisible; the push runs at most every 5 minutes;
 // two people with one git name share branches, so they never see each other; clocks are the committer's.
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';