DEN-3944: classify legacy tarzan CLI before flags-2-env/Zed migration

[ORESoftware]

Recovery finding

This production CLI has been untouched since 2026-07-16 (>10 days), is not archived, and has no open issue tracking its future. The current package still exposes tarzan/trbl through a shell dispatcher, runs an npm postinstall script, carries legacy CI files, has no root AGENTS.md, and directly shells into Git/GitHub-oriented subcommands.

Do not reanimate or publish the current package unchanged.

Decision gate

Choose and record one outcome before implementation:

1. Retire/archive: mark the npm/GitHub package superseded, document the replacement, disable new publishing, and archive after consumers are identified; or
2. Migrate: replace the shell dispatcher with a maintained CLI runtime, preserve only required commands, and publish through the authenticated Zed package workflow.

Migration requirements

• Add a repository-local AGENTS.md consistent with ORESoftware/my-ai/AGENTS.md.
• Model init, use, add, get, view, fetch, push, repair, remove, and remove-all in root .cli-flags.toml.
• Make flags-2-env/flags-2-env@0.3.0 the single argv parsing/coercion boundary; reject unknown flags/errors/extras.
• Keep GitHub credentials, SSH keys, repository tokens, and remote URLs containing credentials out of CLI defaults, logs, and package metadata.
• Remove or justify install-time side effects. Installation must not clone repositories, mutate shell profiles, or access credentials.
• Add canonical .zpkg.toml, dependency lock/receipt, non-interactive smoke tests, and GitHub Actions replacing legacy Travis/Circle assumptions.
• Add tests around path traversal, symlinks, remote URL validation, command injection, concurrent writes, interrupted Git operations, and redacted diagnostics.
• Determine whether this functionality belongs in zed-pkg, an artifact-storage client, or a dedicated maintained repository before duplicating package-upload behavior.

Completion gate

Do not close for adding manifests alone. Close only with an approved retire/archive receipt or a runtime migration with green CI, reproducible packaging, consumer evidence, and a published release receipt.

Linear: DEN-3944. Recovery controller: DEN-3179.

[linear-code]

DEN-3944

[ORESoftware]

Implementation update — 2026-09-03

Draft PR #2 removes the immediate npm install/release hazards while preserving migration evidence:

• marks the package private;
• removes the postinstall hook that invoked a home-directory write;
• blocks publication fail-closed;
• adds repository agent/credential guardrails;
• declares all ten legacy command names in .cli-flags.toml with unknown options rejected and dry-run as the intended default;
• documents consumer inventory, flags-2-env wiring, effect/security, Zed ownership, adversarial tests, packaging, migration/retirement, rollback, and closure gates.

This issue remains open. The shell dispatcher is not yet replaced, flags-2-env is not yet the runtime parser, consumers are not yet inventoried, .zpkg.toml is not yet authorized, and no release or archive action was performed.