@amityco/social-plus-vise 1.7.0 → 1.8.0

package/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to `@amityco/social-plus-vise` are documented in this file.
 
 The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 1.8.0 — 2026-07-10
+
+### Added
+- **Complete-scan receipts and gates.** Project inspection and platform validators now report bounded scan coverage. A truncated inventory cannot initialize a compliance sidecar, select sensors, or produce a green `vise check`; large monorepos must select the concrete app surface.
+- **Pre-launch release contracts.** Hosted CI now smokes the declared Node 20 minimum, release metadata/docs are regression-tested, and tag publishing uses npm trusted publishing with OIDC, a modern npm CLI, main-ancestry validation, and no long-lived token fallback.
+- **Critical regression coverage.** New tests lock scan truncation, mixed-platform inventory detection, strict sensor selection, bounded command output, descendant cleanup on timeout, block mount proof, and the release workflow contract.
+
+### Changed
+- **CI covers finished work by default.** `vise check --ci` now runs the active gate plus every recorded engagement re-verdict. A previously completed surface that drifted exits `11` even when the active engagement is green; explicit `--all-engagements` remains valid with `--ci`.
+- **Block capabilities require a live mount.** The blocks sidecar is reset to `2026-07-10.vise-blocks-sidecar.v2`. `blocks add --apply` records `pending-mount`; `vise check` counts `providesCapabilities` only while the dependency, touched files, package import, and actual block-symbol usage remain present. `blocks validate` persists `verified` or `invalid` and exits non-zero on failure.
+- **Explicit sensor selection is strict.** A requested `--include` name that does not match a detected sensor returns `invalid-selection` and exits non-zero. Sensor stdout/stderr is bounded, and timeouts terminate the command process group rather than leaving descendants running.
+- **Node.js 20 is the minimum supported runtime.** Package metadata, `vise doctor`, release documentation, and hosted compatibility proof now agree.
+- **The compatibility corpus is reset to the 1.8.0 launch contract.** Experimental pre-launch sidecars are not grandfathered; future published versions must remain backward-readable from this baseline.
+
+### Fixed
+- **Ducati dogfood false positives.** Built-in `{ text }` shorthand payloads no longer look like undeclared custom post types, and comment modules that carry a bare `postId` no longer look like post cards missing their body.
+- **Engagement-aware evidence hygiene.** Matching attestations retained by completed engagement contracts are no longer reported as generic stale files. Off-contract attestations with changed source fingerprints are identified explicitly.
+- **Flutter hosted block dependencies.** Hosted constraints now render as `social_plus_blocks: ^0.1.0`; only local sources render a nested `path:` dependency.
+- **Fixture-symmetry parsing.** The supplementary symmetry gate parses only `failingFixturesByFinding`, so later no-fire maps cannot overwrite the failing fixture associated with a rule.
+
+### Compatibility
+- This is an intentional pre-launch contract hardening release. The stricter scan, sensor, block-mount, Node, CI, and sidecar behaviors differ from the experimental 1.7.0 line, but Vise and Blocks have not launched and have no customer contract to migrate. The release version remains 1.8.0 as requested; the new sidecar schema keeps its independent `.v2` schema identifier.
+
 ## 1.7.0 — 2026-07-09
 
 ### Added

package/dist/server.js

@@ -369,7 +369,7 @@ async function handleCli(args) {
                 surfacePath: flagValue(args, "surface") ?? flagValue(args, "surface-path"),
             });
             const status = toolResultStatus(printed);
-            if (status === "failed" || status === "timed-out") {
+            if (status === "failed" || status === "timed-out" || status === "invalid-selection" || status === "incomplete-analysis") {
                 process.exitCode = 1;
             }
             return "exit";
@@ -461,12 +461,16 @@ async function handleCli(args) {
             if (sub === "validate") {
                 assertOnlyKnownFlags(subArgs, ["block", "surface", "surface-path", "registry", "format"], "blocks validate");
                 assertJsonFormat(subArgs, "blocks validate");
-                console.log(JSON.stringify(await validateBlockInstall({
+                const validation = await validateBlockInstall({
                     repoPath: positionalRepoPath(subArgs),
                     blockId: flagValue(subArgs, "block"),
                     registryPath: requiredFlagValue(subArgs, "registry", "blocks validate requires --registry."),
                     surfacePath: flagValue(subArgs, "surface") ?? flagValue(subArgs, "surface-path"),
-                }), null, 2));
+                });
+                console.log(JSON.stringify(validation, null, 2));
+                if (validation.validationStatus === "failed" || validation.status === "needs-review") {
+                    process.exitCode = 1;
+                }
                 return "exit";
             }
             console.error(`Unknown blocks subcommand: ${sub ?? "(none)"}. Expected "list", "plan", "add", or "validate".`);
@@ -526,17 +530,15 @@ async function handleCli(args) {
                 process.exitCode = typeof reVerdict.exitCode === "number" ? reVerdict.exitCode : 0;
                 return "exit";
             }
-            if (hasFlag(args, "all-engagements")) {
-                if (hasFlag(args, "ci")) {
-                    throw new Error("--all-engagements cannot combine with --ci (the CI shape covers the active engagement only).");
-                }
+            const ciMode = hasFlag(args, "ci");
+            if (hasFlag(args, "all-engagements") || ciMode) {
                 const combined = await checkAllEngagements(positionalRepoPath(args.slice(1)), { newOnly: hasFlag(args, "new-only"), allowProofWaiver: hasFlag(args, "allow-proof-waiver") });
-                emitResult("check", combined, args);
+                emitResult("check", ciMode ? ciCheckResult(combined) : combined, args);
                 process.exitCode = typeof combined.exitCode === "number" ? combined.exitCode : 0;
                 return "exit";
             }
             const result = await checkCompliance(positionalRepoPath(args.slice(1)), { newOnly: hasFlag(args, "new-only"), allowProofWaiver: hasFlag(args, "allow-proof-waiver") });
-            emitResult("check", hasFlag(args, "ci") ? ciCheckResult(result) : result, args);
+            emitResult("check", result, args);
             process.exitCode = result.exitCode;
             return "exit";
         }
@@ -984,7 +986,9 @@ Usage:
   vise blocks validate <repoPath> [--block comments] --registry <path> --format json
 
 Safety:
-  Dry-run is the default. Apply mode only edits package manifests, explicit source anchors, and sp-vise/blocks.json.`;
+  Dry-run is the default. Apply mode only edits package manifests, explicit source anchors, and sp-vise/blocks.json.
+  Apply records pending-mount. A block capability counts only after the imported symbol is mounted/used;
+  run blocks validate after mounting it to persist verified evidence.`;
     }
     if (command === "init") {
         return `${packageName} init
@@ -1001,6 +1005,7 @@ Usage:
         return `${packageName} check
 
 Check the current source and recorded attestations against the compliance contract. Read-only.
+--ci also re-verdicts every recorded engagement and exits 11 if completed work drifted.
 
 Usage:
   vise check [repoPath] [--ci] [--format human]
@@ -2588,8 +2593,11 @@ function ciCheckResult(result) {
                 "needs-attestation",
                 "completeness-gap",
                 "selected-capability-failures",
+                "engagement-drift",
             ],
-            message: result.exitCode === 0 ? "Compliance green for CI." : `Compliance failed for CI with status: ${result.status}.`,
+            message: result.exitCode === 0
+                ? "Active and recorded engagement compliance is green for CI."
+                : `Compliance failed for CI with status: ${result.status}.`,
         },
     };
 }
@@ -2791,7 +2799,7 @@ function doctorResult() {
         packageRoot,
         status: nodeMajor >= 18 ? "ok" : "unsupported-node",
         node: process.versions.node,
-        requiredNodeMajor: ">=18",
+        requiredNodeMajor: ">=20",
         docsSource: process.env.SOCIAL_PLUS_DOCS_ROOT ? "local" : "hosted",
         docsRoot: process.env.SOCIAL_PLUS_DOCS_ROOT,
         docsBaseUrl: process.env.SOCIAL_PLUS_DOCS_BASE_URL ?? "https://learn.social.plus",

package/dist/tools/blocks.js

@@ -5,7 +5,7 @@ import { packageVersion } from "../version.js";
 import { inspectProject } from "./project.js";
 import { detectCommandSensors } from "./harness.js";
 import { readDesignContract } from "./design.js";
-const blocksSidecarSchemaVersion = "2026-06-10.vise-blocks-sidecar.v1";
+const blocksSidecarSchemaVersion = "2026-07-10.vise-blocks-sidecar.v2";
 const registryPlatformByVisePlatform = {
     typescript: "react",
     "react-native": "react-native",
@@ -74,11 +74,21 @@ export async function validateBlockInstall(options) {
         if (installed.length === 0) {
             findings.push({
                 ruleId: "blocks.sidecar.installed",
-                severity: "warning",
+                severity: "error",
                 message: "No installed block sidecar entries exist.",
                 recommendation: "Run `vise blocks add <repoPath> --block <id> --registry <path> --apply` after reviewing the dry-run plan.",
             });
         }
+        for (const entry of installed) {
+            if (!(await installedEntryLocallyValid(repoPath, entry))) {
+                findings.push({
+                    ruleId: "blocks.install.verified",
+                    severity: "error",
+                    message: `Installed block ${entry.blockId} is not currently verified: its dependency, touched files, or live mount evidence is missing.`,
+                    recommendation: `Run \`vise blocks validate <repoPath> --block ${entry.blockId} --registry <path>\` and resolve every reported error.`,
+                });
+            }
+        }
         return {
             status: findings.some((finding) => finding.severity === "error") ? "needs-review" : "ready",
             mode: "validate",
@@ -96,7 +106,7 @@ export async function validateBlockInstall(options) {
     if (installed.length === 0) {
         findings.push({
             ruleId: "blocks.sidecar.installed",
-            severity: "warning",
+            severity: "error",
             message: options.blockId ? `No sidecar entry exists for block ${options.blockId}.` : "No installed block sidecar entries exist.",
             recommendation: "Run `vise blocks add <repoPath> --block <id> --registry <path> --apply` after reviewing the dry-run plan.",
         });
@@ -119,12 +129,30 @@ export async function validateBlockInstall(options) {
             });
         }
     }
+    const mountEvidence = await findBlockMountEvidence(repoPath, {
+        platform: plan.registryPlatform,
+        publicEntrypoint: plan.package.publicEntrypoint,
+        importName: plan.package.importName,
+        mountFiles: plan.targetFiles.map((targetFile) => targetFile.path),
+    });
+    if (!mountEvidence) {
+        findings.push({
+            ruleId: "blocks.mount.present",
+            severity: "error",
+            message: `Block ${plan.block.id} is installed but ${plan.package.importName} is not mounted in the target source.`,
+            recommendation: `Render or invoke ${plan.package.importName} in ${plan.targetFiles.map((targetFile) => targetFile.path).join(", ")}, then re-run block validation. An import alone does not deliver the block capability.`,
+        });
+    }
     const hasError = findings.some((finding) => finding.severity === "error");
+    await updateBlockValidationState(repoPath, plan.block.id, hasError ? "invalid" : "verified", mountEvidence);
+    const updatedSidecar = await readSidecar(repoPath);
+    const updatedInstalled = (updatedSidecar?.installed ?? []).filter((entry) => entry.blockId === options.blockId);
     return {
         ...plan,
         status: hasError ? "needs-review" : plan.status,
         validationStatus: hasError ? "failed" : "passed",
-        sidecarInstalled: installed,
+        mountEvidence,
+        sidecarInstalled: updatedInstalled,
         findings,
     };
 }
@@ -319,10 +347,13 @@ async function writeBlocksSidecar(repoPath, plan, packageSource, filesTouched) {
         packageSource,
         dependencyName: plan.package.dependencyName,
         providesCapabilities: plan.providesCapabilities,
+        publicEntrypoint: plan.package.publicEntrypoint,
+        importName: plan.package.importName,
+        mountFiles: plan.targetFiles.map((targetFile) => targetFile.path),
         filesTouched,
         designContractDigest: designContract?.digest,
         sdkFactsVersion: plan.block.version,
-        validationStatus: "installed",
+        validationStatus: "pending-mount",
     };
     sidecar.schemaVersion = blocksSidecarSchemaVersion;
     sidecar.viseVersion = packageVersion;
@@ -376,7 +407,46 @@ async function installedEntryLocallyValid(repoRoot, entry) {
             return false;
         }
     }
-    return true;
+    return Boolean(await findBlockMountEvidence(repoRoot, entry));
+}
+async function findBlockMountEvidence(repoRoot, entry) {
+    if (!entry.publicEntrypoint || !entry.importName || !Array.isArray(entry.mountFiles) || entry.mountFiles.length === 0) {
+        return undefined;
+    }
+    for (const relativeFile of entry.mountFiles) {
+        if (typeof relativeFile !== "string" || relativeFile.trim() === "") {
+            continue;
+        }
+        const source = await readFile(path.join(repoRoot, relativeFile), "utf8").catch(() => "");
+        if (!source.includes(entry.publicEntrypoint) || !blockUsagePresent(source, entry.platform, entry.importName)) {
+            continue;
+        }
+        return { file: relativeFile, kind: "source-usage", importName: entry.importName };
+    }
+    return undefined;
+}
+function blockUsagePresent(source, platform, importName) {
+    const name = escapeRegExp(importName);
+    if (platform === "flutter") {
+        return new RegExp(`\\b${name}\\s*\\(`).test(source);
+    }
+    return [
+        new RegExp(`<\\s*${name}(?:\\s|/|>)`),
+        new RegExp(`(?:React\\.)?createElement\\s*\\(\\s*${name}\\b`),
+        new RegExp(`\\b${name}\\s*\\(`),
+    ].some((pattern) => pattern.test(source));
+}
+async function updateBlockValidationState(repoRoot, blockId, validationStatus, mountEvidence) {
+    const sidecar = await readSidecar(repoRoot);
+    const entry = sidecar?.installed.find((item) => item.blockId === blockId);
+    if (!sidecar || !entry) {
+        return;
+    }
+    entry.validationStatus = validationStatus;
+    entry.mountEvidence = mountEvidence;
+    sidecar.viseVersion = packageVersion;
+    sidecar.generatedAt = new Date().toISOString();
+    await writeFile(path.join(repoRoot, "sp-vise", "blocks.json"), `${JSON.stringify(sidecar, null, 2)}\n`, "utf8");
 }
 async function blockDependencyDeclared(repoRoot, entry) {
     const dependencyName = entry.dependencyName;
@@ -433,12 +503,15 @@ function insertBlockSnippet(source, plan) {
     return source;
 }
 function addPubspecDependency(source, dependencyName, value) {
+    const dependencyLines = value.startsWith("file:")
+        ? [`  ${dependencyName}:`, `    path: ${value.replace(/^file:/, "")}`]
+        : [`  ${dependencyName}: ${value}`];
     if (!source.includes("dependencies:")) {
-        return `${source.trimEnd()}\n\ndependencies:\n  ${dependencyName}:\n    path: ${value.replace(/^file:/, "")}\n`;
+        return `${source.trimEnd()}\n\ndependencies:\n${dependencyLines.join("\n")}\n`;
     }
     const lines = source.split(/\r?\n/);
     const insertIndex = lines.findIndex((line) => line.trim() === "dependencies:") + 1;
-    lines.splice(insertIndex, 0, `  ${dependencyName}:`, `    path: ${value.replace(/^file:/, "")}`);
+    lines.splice(insertIndex, 0, ...dependencyLines);
     return `${lines.join("\n").trimEnd()}\n`;
 }
 async function readPackageJson(filePath) {

package/dist/tools/compliance.js

@@ -16,7 +16,7 @@ import { packageVersion } from "../version.js";
 import { readFlowState } from "../flow.js";
 import { DESIGN_CONTRACT_CONFIRMATION_ANSWER_ID, buildDesignBrief, designContractConfirmationFromAnswers, designPreviewPath, readDesignContract, } from "./design.js";
 import { installedBlockProvidedCapabilities } from "./blocks.js";
-import { inspectProject, validateSetup } from "./project.js";
+import { inspectProject, validateSetupWithCoverage, } from "./project.js";
 import { readCreativeSelection } from "./creative.js";
 import { readRuntimeProofWaiver, hasExecutableSmokeMarker } from "./smoke.js";
 import { assessUxHarness, buildExperienceReport, buildUxHarness, readUxHarness, } from "./uxHarness.js";
@@ -326,6 +326,18 @@ function designReviewFor(repoRoot, contract, answers) {
 export async function initCompliance(repoPath, request, surfacePath, answers = {}, options = {}) {
     const repoRoot = path.resolve(repoPath);
     const inspection = await inspectProject(repoRoot, surfacePath);
+    if (!inspection.scanCoverage.complete) {
+        const truncated = inspection.scanCoverage.scans.filter((scan) => scan.truncated);
+        return {
+            status: "needs-clarification",
+            exitCode: 7,
+            reason: `Vise could not inspect the complete project inventory: ${truncated
+                .map((scan) => `${scan.scope} reached its ${scan.limit}-file limit under ${scan.root}`)
+                .join("; ")}.`,
+            instruction: "Select the specific app/workspace surface before initializing a compliance contract; an incomplete platform inventory cannot be baked into a greenable sidecar.",
+            nextStep: "Re-run `vise init` with --surface <app-path> (or --surface-path <app-path>) after narrowing the project.",
+        };
+    }
     const outcome = resolveOutcome(request, answers);
     const platform = preferredPlatform(inspection.platforms);
     const capabilityAvailability = await platformCapabilityAvailability(outcome, platform);
@@ -931,8 +943,23 @@ export async function checkCompliance(repoPath, options = {}) {
         }
     }
     const { canonicalPlatform } = await import("./sdkFacts.js");
-    const allFindings = await Promise.all(platforms.map((p) => validateSetup(inspection.effectiveRoot, p)));
-    const findings = allFindings.flat();
+    const validations = await Promise.all(platforms.map((p) => validateSetupWithCoverage(inspection.effectiveRoot, p)));
+    const findings = validations.flatMap((validation) => validation.findings);
+    const scanCoverage = {
+        complete: inspection.scanCoverage.complete && validations.every((validation) => validation.scanCoverage.complete),
+        scans: [...inspection.scanCoverage.scans, ...validations.flatMap((validation) => validation.scanCoverage.scans)],
+    };
+    if (!inspection.scanCoverage.complete && !findings.some((finding) => finding.ruleId === "project.scan.complete")) {
+        const truncated = inspection.scanCoverage.scans.filter((scan) => scan.truncated);
+        findings.push({
+            ruleId: "project.scan.complete",
+            severity: "error",
+            message: `Vise could not inspect the complete project inventory: ${truncated
+                .map((scan) => `${scan.scope} reached its ${scan.limit}-file limit under ${scan.root}`)
+                .join("; ")}.`,
+            recommendation: "Point Vise at the specific app with --surface/--surface-path and re-run init/check.",
+        });
+    }
     const findingsById = new Map();
     const findingsByIdAll = new Map();
     for (const finding of findings) {
@@ -944,7 +971,7 @@ export async function checkCompliance(repoPath, options = {}) {
         }
     }
     const attestations = await readAttestations(repoRoot);
-    const attestationHygiene = await readAttestationHygiene(repoRoot, compliance);
+    const attestationHygiene = await readAttestationHygiene(repoRoot, inspection.effectiveRoot, compliance);
     const results = [];
     for (const ref of compliance.rules) {
         const rule = rules.get(ref.rule_id);
@@ -1138,6 +1165,18 @@ export async function checkCompliance(repoPath, options = {}) {
             ...(baseStatus === "attestation-needed" && rule.enforcement.attestation.allowed && attestHint(rule, compliance)),
         });
     }
+    const incompleteScanFinding = findings.find((finding) => finding.ruleId === "project.scan.complete");
+    if (incompleteScanFinding) {
+        results.push({
+            ruleId: incompleteScanFinding.ruleId,
+            title: "Complete source scan",
+            severity: "error",
+            status: "deterministic-fail",
+            reason: incompleteScanFinding.message,
+            finding: incompleteScanFinding,
+            recommendation: incompleteScanFinding.recommendation,
+        });
+    }
     const driftStale = await surfaceDriftStale(compliance);
     if (driftStale.size > 0) {
         for (const result of results) {
@@ -1232,7 +1271,7 @@ export async function checkCompliance(repoPath, options = {}) {
     const { status, exitCode } = deriveGate({
         hasNoPlatform: detectedPlatforms.length === 0,
         hasBlocked: gatedResults.some((result) => result.status === "blocked"),
-        hasDeterministicFailure: gatedResults.some((result) => result.status === "deterministic-fail"),
+        hasDeterministicFailure: !scanCoverage.complete || gatedResults.some((result) => result.status === "deterministic-fail"),
         needsAttestation: gatedResults.some((result) => result.status === "attestation-needed" || result.status === "stale"),
         hasCompletenessGap,
         hasSelectedOptionalFailures,
@@ -1264,6 +1303,7 @@ export async function checkCompliance(repoPath, options = {}) {
         surfacePath: compliance.surface?.path,
         summary,
         rules: results,
+        scanCoverage,
         ...(evidenceBasis ? { evidence_basis: evidenceBasis } : {}),
         ...(evidenceBasisNote ? { evidence_basis_note: evidenceBasisNote } : {}),
         ...(completeness && (completeness.missing.length > 0 || completeness.optedOut.length > 0 || completeness.present.length > 0) ? { completeness } : {}),
@@ -2327,7 +2367,8 @@ async function liveSensorContradiction(repoRoot, compliance, rule) {
     if (platforms.length === 0) {
         return { violatorFiles: [] };
     }
-    const allFindings = await Promise.all(platforms.map((platform) => validateSetup(inspection.effectiveRoot, platform)));
+    const validations = await Promise.all(platforms.map((platform) => validateSetupWithCoverage(inspection.effectiveRoot, platform)));
+    const allFindings = validations.map((validation) => validation.findings);
     const findingsById = new Map();
     const findingsByIdAll = new Map();
     for (const finding of allFindings.flat()) {
@@ -2340,6 +2381,19 @@ async function liveSensorContradiction(repoRoot, compliance, rule) {
     }
     const finding = deterministicFinding(rule, findingsById);
     if (!finding) {
+        const incomplete = allFindings.flat().find((item) => item.ruleId === "project.scan.complete");
+        if (incomplete) {
+            return {
+                warning: {
+                    message: "The live deterministic sensor could not inspect the complete source surface. This attestation overrides an incomplete analysis; narrow the surface and re-check before relying on it.",
+                    sensor_finding: {
+                        ruleId: incomplete.ruleId,
+                        recommendation: incomplete.recommendation,
+                    },
+                },
+                violatorFiles: [],
+            };
+        }
         return { violatorFiles: [] };
     }
     const violatorFiles = await ruleViolatorFiles(repoRoot, sourceRootForCompliance(repoRoot, compliance), rule, findingsByIdAll);
@@ -2760,9 +2814,24 @@ async function readAttestations(repoRoot) {
     }
     return result;
 }
-async function readAttestationHygiene(repoRoot, compliance) {
+async function recordedEngagementRuleIds(repoRoot) {
+    const ruleIds = new Set();
+    const entries = await readdir(engagementsDir(repoRoot), { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+        if (!entry.isDirectory()) {
+            continue;
+        }
+        const contract = await readJsonIfExists(path.join(engagementsDir(repoRoot), entry.name, "contract.json"));
+        for (const rule of contract?.rules ?? []) {
+            ruleIds.add(rule.rule_id);
+        }
+    }
+    return ruleIds;
+}
+async function readAttestationHygiene(repoRoot, sourceRoot, compliance) {
     const dir = attestationsDir(repoRoot);
     const activeRuleIds = new Set(compliance.rules.map((rule) => rule.rule_id));
+    const recordedRuleIds = await recordedEngagementRuleIds(repoRoot);
     const ignored = [];
     const invalid = [];
     let entries = [];
@@ -2783,10 +2852,24 @@ async function readAttestationHygiene(repoRoot, compliance) {
             continue;
         }
         if (!activeRuleIds.has(candidate.attestation.rule_id)) {
+            const sourceFingerprintStatus = await checkSourceFingerprints(repoRoot, sourceRoot, candidate.attestation.source_fingerprints ?? []);
+            const staleFingerprints = sourceFingerprintStatus.filter((item) => item.status !== "match");
+            if (staleFingerprints.length > 0) {
+                ignored.push({
+                    file: rel,
+                    rule_id: candidate.attestation.rule_id,
+                    reason: "Attestation is outside the active contract and its recorded source fingerprints changed or disappeared. Refresh or remove it before relying on the evidence trail.",
+                    source_fingerprint_status: sourceFingerprintStatus,
+                });
+                continue;
+            }
+            if (recordedRuleIds.has(candidate.attestation.rule_id)) {
+                continue;
+            }
             ignored.push({
                 file: rel,
                 rule_id: candidate.attestation.rule_id,
-                reason: "Attestation rule_id is not in the current compliance contract. It may be stale, off-platform, or from a previous sidecar scope; it is ignored by vise check.",
+                reason: "Attestation rule_id is not in the active or recorded engagement contracts. It may be stale or off-platform and is ignored by vise check.",
             });
         }
     }
@@ -2797,7 +2880,7 @@ async function readAttestationHygiene(repoRoot, compliance) {
         status: "needs-review",
         ignored,
         invalid,
-        nextStep: "Review ignored/invalid attestation files before using the evidence trail for handoff. Remove stale files only when you are sure they are unrelated, or re-run vise init/check/sync for the intended scope.",
+        nextStep: "Review fingerprint-stale, orphaned, or invalid attestation files before handoff. Matching evidence retained by a recorded engagement is checked through the engagement ledger and is not reported as stale.",
     };
 }
 async function readAttestationCandidate(filePath) {

package/dist/tools/project.js

@@ -39,7 +39,7 @@ export async function inspectProject(repoPath, surfacePath) {
     const surfaces = await detectProjectSurfaces(repoRoot);
     const effectiveRoot = resolveSurfaceRoot(repoRoot, surfacePath);
     const selectedSurface = surfacePath ? await surfaceForPath(repoRoot, effectiveRoot) : surfaceMatchingRoot(surfaces, repoRoot);
-    const { platforms, signals, designSignals } = await inspectRoot(effectiveRoot);
+    const { platforms, signals, designSignals, scanCoverage } = await inspectRoot(effectiveRoot);
     return {
         repoRoot,
         effectiveRoot,
@@ -48,6 +48,7 @@ export async function inspectProject(repoPath, surfacePath) {
         signals,
         designSignals,
         surfaces,
+        scanCoverage,
     };
 }
 function resolveSurfaceRoot(repoRoot, surfacePath) {
@@ -63,6 +64,7 @@ function resolveSurfaceRoot(repoRoot, surfacePath) {
 }
 async function inspectRoot(root) {
     const signals = [];
+    const scanContext = { validationRoot: root, scans: [] };
     const candidates = [
         ["android", "settings.gradle", "Gradle project settings"],
         ["android", "settings.gradle.kts", "Gradle Kotlin project settings"],
@@ -100,7 +102,7 @@ async function inspectRoot(root) {
     }
     const hasJsSignal = signals.some((signal) => signal.platform === "typescript" || signal.platform === "react-native");
     if (!hasJsSignal) {
-        const sourceSignal = await detectSdkSignalFromSource(root);
+        const sourceSignal = await detectSdkSignalFromSource(root, scanContext);
         if (sourceSignal) {
             signals.push(sourceSignal);
         }
@@ -113,10 +115,18 @@ async function inspectRoot(root) {
         : hasAndroid
             ? rawPlatforms.filter((p) => p !== "typescript")
             : rawPlatforms;
-    return { platforms, signals, designSignals: await detectDesignSignals(root) };
+    return {
+        platforms,
+        signals,
+        designSignals: await detectDesignSignals(root),
+        scanCoverage: {
+            complete: scanContext.scans.every((scan) => !scan.truncated),
+            scans: scanContext.scans,
+        },
+    };
 }
-async function detectSdkSignalFromSource(root) {
-    const sourceFiles = await findFiles(root, [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".html", ".htm"], 500);
+async function detectSdkSignalFromSource(root, scanContext) {
+    const sourceFiles = await findFiles(root, [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".html", ".htm"], 500, scanContext, "platform-detection.javascript-source");
     if (sourceFiles.length === 0) {
         return null;
     }
@@ -269,7 +279,25 @@ async function installedBlockEntryStillValid(root, entry) {
             return false;
         }
     }
-    return true;
+    const publicEntrypoint = typeof entry.publicEntrypoint === "string" ? entry.publicEntrypoint : "";
+    const importName = typeof entry.importName === "string" ? entry.importName : "";
+    const mountFiles = Array.isArray(entry.mountFiles) ? entry.mountFiles : [];
+    if (!publicEntrypoint || !importName || mountFiles.length === 0) {
+        return false;
+    }
+    const usagePattern = platform === "flutter"
+        ? new RegExp(`\\b${escapeRegExp(importName)}\\s*\\(`)
+        : new RegExp(`<\\s*${escapeRegExp(importName)}(?:\\s|/|>)|(?:React\\.)?createElement\\s*\\(\\s*${escapeRegExp(importName)}\\b|\\b${escapeRegExp(importName)}\\s*\\(`);
+    for (const mountFile of mountFiles) {
+        if (typeof mountFile !== "string" || mountFile.trim() === "") {
+            continue;
+        }
+        const source = await readIfExists(path.join(root, mountFile));
+        if (source.includes(publicEntrypoint) && usagePattern.test(source)) {
+            return true;
+        }
+    }
+    return false;
 }
 async function sidecarOutcomeInScope(root, outcome) {
     const dir = sidecarDir(root);
@@ -354,29 +382,56 @@ export const validateSetupTool = {
         const repoPath = stringField(args, "repoPath");
         const inspection = await inspectProject(repoPath, optionalStringField(args, "surfacePath"));
         const platform = optionalStringField(args, "platform") ?? inspection.platforms[0] ?? "unknown";
-        const findings = await validateSetup(inspection.effectiveRoot, platform);
+        const validation = await validateSetupWithCoverage(inspection.effectiveRoot, platform);
+        const platformWasExplicit = optionalStringField(args, "platform") !== undefined;
+        const scanCoverage = platformWasExplicit
+            ? validation.scanCoverage
+            : {
+                complete: inspection.scanCoverage.complete && validation.scanCoverage.complete,
+                scans: [...inspection.scanCoverage.scans, ...validation.scanCoverage.scans],
+            };
+        const findings = [...validation.findings];
+        if (!platformWasExplicit && !inspection.scanCoverage.complete && !findings.some((finding) => finding.ruleId === "project.scan.complete")) {
+            findings.push(incompleteInspectionFinding(inspection.scanCoverage));
+        }
         return textResult({
             platform,
             surfacePath: inspection.selectedSurface?.path,
             status: statusForFindings(findings),
             findings,
+            scanCoverage,
         });
     },
 };
 export async function validateSetup(repoPath, platform) {
+    return (await validateSetupWithCoverage(repoPath, platform)).findings;
+}
+function incompleteInspectionFinding(scanCoverage) {
+    const truncated = scanCoverage.scans.filter((scan) => scan.truncated);
+    return {
+        ruleId: "project.scan.complete",
+        severity: "error",
+        message: `Vise could not inspect the complete project inventory: ${truncated
+            .map((scan) => `${scan.scope} reached its ${scan.limit}-file limit under ${scan.root}`)
+            .join("; ")}.`,
+        recommendation: "Point Vise at the specific app with --surface/--surface-path before planning, initializing, validating, or selecting sensors.",
+    };
+}
+export async function validateSetupWithCoverage(repoPath, platform) {
     const root = path.resolve(repoPath);
     const findings = [];
+    const scanContext = { validationRoot: root, scans: [] };
     if (platform === "android") {
-        findings.push(...(await validateAndroid(root)));
+        findings.push(...(await validateAndroid(root, scanContext)));
     }
     if (platform === "flutter") {
-        findings.push(...(await validateFlutter(root)));
+        findings.push(...(await validateFlutter(root, scanContext)));
     }
     if (platform === "typescript" || platform === "react-native") {
-        findings.push(...(await validateTypeScript(root, platform)));
+        findings.push(...(await validateTypeScript(root, platform, scanContext)));
     }
     if (platform === "ios") {
-        findings.push(...(await validateIos(root)));
+        findings.push(...(await validateIos(root, scanContext)));
     }
     if (platform === "unknown") {
         findings.push({
@@ -386,21 +441,38 @@ export async function validateSetup(repoPath, platform) {
             recommendation: "Point repoPath at the app root or provide a platform override.",
         });
     }
-    return findings;
+    const truncatedScans = scanContext.scans.filter((scan) => scan.truncated);
+    if (truncatedScans.length > 0) {
+        findings.push({
+            ruleId: "project.scan.complete",
+            severity: "error",
+            message: `Vise could not inspect the complete source surface: ${truncatedScans
+                .map((scan) => `${scan.scope} reached its ${scan.limit}-file limit under ${scan.root}`)
+                .join("; ")}.`,
+            recommendation: "Point Vise at the specific app with --surface/--surface-path, remove generated or vendored source from that surface, or raise the governed scan limit before relying on absence-based validation.",
+        });
+    }
+    return {
+        findings,
+        scanCoverage: {
+            complete: truncatedScans.length === 0,
+            scans: scanContext.scans,
+        },
+    };
 }
-async function validateAndroid(root) {
+async function validateAndroid(root, scanContext) {
     const findings = [];
     const manifestPath = "app/src/main/AndroidManifest.xml";
     const manifest = await readIfExists(path.join(root, manifestPath));
-    const gradleScripts = (await findFiles(root, [".gradle", ".kts"], 200)).filter((f) => /(?:^|[\\/])(?:build|settings)\.gradle(?:\.kts)?$/.test(f));
+    const gradleScripts = (await findFiles(root, [".gradle", ".kts"], 200, scanContext, "android.gradle-manifests")).filter((f) => /(?:^|[\\/])(?:build|settings)\.gradle(?:\.kts)?$/.test(f));
     const buildFiles = [...new Set([
             ...(await existingFiles(root, ["app/build.gradle", "app/build.gradle.kts", "build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts"])),
             ...gradleScripts,
         ])];
-    const versionCatalogFiles = (await findFiles(root, [".toml"], 50)).filter((f) => /(?:^|[\\/])gradle[\\/].*\.versions\.toml$/.test(f));
+    const versionCatalogFiles = (await findFiles(root, [".toml"], 50, scanContext, "android.version-catalogs")).filter((f) => /(?:^|[\\/])gradle[\\/].*\.versions\.toml$/.test(f));
     const buildContent = await readMany(buildFiles);
     const versionCatalogContent = await readMany(versionCatalogFiles);
-    const sourceFiles = await findFiles(root, [".kt", ".java"], 300);
+    const sourceFiles = await findFiles(root, [".kt", ".java"], 300, scanContext, "android.source");
     const sourceContent = await readMany(sourceFiles);
     const setupFiles = filesMatching(sourceContent, [/AmityCoreClient\s*\.\s*setup/, /AmityClient\s*\.\s*setup/, /AmityUIKit\d*Manager\s*\.\s*setup/]);
     const coreLoginFiles = filesMatching(sourceContent, [/AmityCoreClient\s*\.\s*login/, /AmityClient\s*\.\s*login/]);
@@ -518,11 +590,11 @@ async function validateAndroid(root) {
     findings.push(...(await validateEnvSecretHygiene(root, "android", sourceContent)));
     return findings;
 }
-async function validateFlutter(root) {
+async function validateFlutter(root, scanContext) {
     const findings = [];
     const pubspec = await readIfExists(path.join(root, "pubspec.yaml"));
     const pubspecLock = await readIfExists(path.join(root, "pubspec.lock"));
-    const dartFiles = await findFiles(path.join(root, "lib"), [".dart"], 300);
+    const dartFiles = await findFiles(path.join(root, "lib"), [".dart"], 300, scanContext, "flutter.source");
     const dartContent = await readMany(dartFiles);
     const setupFiles = filesMatching(dartContent, [/AmityCoreClient\s*\.\s*setup/, /AmityUIKit\d*Manager\s*\.\s*setup/]);
     const coreLoginFiles = filesMatching(dartContent, [/AmityCoreClient\s*\.\s*login/]);
@@ -643,10 +715,10 @@ async function validateFlutter(root) {
     findings.push(...(await validateEnvSecretHygiene(root, "flutter", dartContent)));
     return findings;
 }
-async function validateTypeScript(root, platform) {
+async function validateTypeScript(root, platform, scanContext) {
     const findings = [];
     const packageJson = await readIfExists(path.join(root, "package.json"));
-    const sourceFiles = await findFiles(root, [".ts", ".tsx", ".js", ".jsx"], 500);
+    const sourceFiles = await findFiles(root, [".ts", ".tsx", ".js", ".jsx"], 500, scanContext, `${platform}.source`);
     const sourceContent = await readMany(sourceFiles);
     const setupFiles = filesMatching(sourceContent, [/Client\s*\.\s*createClient/, /Client\s*\.\s*create\s*\(/, /createClient\s*\(/, /Amity(?:UIKit|UiKit)Provider/]);
     const rawLoginFiles = filesMatching(sourceContent, [/Client\s*\.\s*login/, /\.login\s*\(/]);
@@ -3252,7 +3324,7 @@ function iosAmitySdkIsFloating(s) {
         return true;
     return false;
 }
-async function validateIos(root) {
+async function validateIos(root, scanContext) {
     const findings = [];
     const joinExisting = async (names) => [...(await readMany(await existingFiles(root, names))).values()].join("\n");
     const podText = await joinExisting(["Podfile"]);
@@ -3277,7 +3349,7 @@ async function validateIos(root) {
     ];
     const manifestCombined = [podText, pkgSwiftText, projectYmlText, pbxprojText].join("\n");
     const hasManifest = manifestCombined.trim().length > 0;
-    const swiftFiles = await findFiles(root, [".swift", ".xcconfig", ".plist"], 400);
+    const swiftFiles = await findFiles(root, [".swift", ".xcconfig", ".plist"], 400, scanContext, "ios.source");
     const swiftContent = await readMany(swiftFiles);
     const setupFiles = filesMatching(swiftContent, [/AmityClient\s*\(/, /AmityClient\s*\.\s*setup/, /AmityUIKit\d*Manager\s*\.\s*setup/]);
     const coreLoginFiles = filesMatching(swiftContent, [/\.login\s*\(/, /client\.login\s*\(/]);
@@ -3603,10 +3675,11 @@ function inferDesignKind(relativePath) {
     }
     return "theme";
 }
-async function findFiles(root, extensions, maxFiles) {
+async function findFiles(root, extensions, maxFiles, scanContext, scope = "source") {
     const found = [];
+    let truncated = false;
     async function walk(directory) {
-        if (found.length >= maxFiles) {
+        if (truncated) {
             return;
         }
         let entries;
@@ -3616,8 +3689,8 @@ async function findFiles(root, extensions, maxFiles) {
         catch {
             return;
         }
-        for (const entry of entries) {
-            if (found.length >= maxFiles) {
+        for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+            if (truncated) {
                 return;
             }
             if (shouldSkipDirectory(entry.name)) {
@@ -3628,11 +3701,25 @@ async function findFiles(root, extensions, maxFiles) {
                 await walk(entryPath);
             }
             else if (extensions.some((extension) => entry.name.endsWith(extension))) {
+                if (found.length >= maxFiles) {
+                    truncated = true;
+                    return;
+                }
                 found.push(entryPath);
             }
         }
     }
     await walk(root);
+    if (scanContext) {
+        scanContext.scans.push({
+            scope,
+            root: path.relative(scanContext.validationRoot, root) || ".",
+            extensions: [...extensions],
+            scanned: found.length,
+            limit: maxFiles,
+            truncated,
+        });
+    }
     return found;
 }
 async function readMany(files) {
@@ -4151,7 +4238,7 @@ function validateCustomPostTypeDataTypeDeclared(root, platform, sourceContent) {
         if (!matches)
             continue;
         for (const match of matches) {
-            if (/data\s*[:=(]\s*[\{\[]\s*['"]?text['"]?\s*:/i.test(match))
+            if (/data\s*[:=(]\s*[\{\[]\s*['"]?text['"]?\s*(?::|[,}])/i.test(match))
                 continue;
             if (!/dataType\s*[:=\(]/i.test(match)) {
                 findings.push(finding(ruleId, "warning", `File ${rel} creates a custom data post but does not declare a dataType.`, rel, `When creating a post with a custom data payload, the 'dataType' tag must be explicitly provided so the SDK can route it correctly. If missing, it defaults to a text post, which stringifies the payload.`));
@@ -4221,8 +4308,8 @@ function validatePostBodyRendered(root, platform, sourceContent) {
         android: /\b(?:Text\s*\(|TextView|\.text\s*=|setText\s*\()/,
     };
     const postSummaryPat = {
-        typescript: /\bpost\s*\??\.\s*(?:postId|commentsCount|reactionsCount)\b|\bpostId\b/,
-        "react-native": /\bpost\s*\??\.\s*(?:postId|commentsCount|reactionsCount)\b|\bpostId\b/,
+        typescript: /\bpost\s*\??\.\s*(?:postId|commentsCount|reactionsCount)\b/,
+        "react-native": /\bpost\s*\??\.\s*(?:postId|commentsCount|reactionsCount)\b/,
         flutter: /\b(?:post|_posts\s*\[[^\]]+\])\s*\.\s*(?:postId|commentsCount|reactionsCount)\b/,
         ios: /\bpost\s*\.\s*(?:postId|commentsCount|reactionsCount)\b/,
         android: /\bpost\s*\.\s*(?:postId|commentsCount|reactionsCount|getPostId|getCommentCount|getReactionCount)\b/,

package/dist/tools/sensors.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { objectInput, optionalNumberField, optionalStringField, stringField, textResult } from "../types.js";
 import { detectCommandSensors } from "./harness.js";
 import { inspectProject } from "./project.js";
+const maxCapturedOutputChars = 8000;
 export const runSensorsTool = {
     name: "run_sensors",
     description: "Run detected project command sensors, such as build/typecheck/test, with a timeout and structured results.",
@@ -48,8 +49,29 @@ export const runSensorsTool = {
         const include = stringArrayField(args, "include");
         const root = path.resolve(repoPath);
         const inspection = await inspectProject(root, optionalStringField(args, "surfacePath"));
+        if (!inspection.scanCoverage.complete) {
+            return textResult({
+                status: "incomplete-analysis",
+                surfacePath: inspection.selectedSurface?.path,
+                targetPlatforms: inspection.platforms,
+                scanCoverage: inspection.scanCoverage,
+                reason: "Vise could not inspect the complete project inventory, so detected sensors may be incomplete. Narrow the run with --surface/--surface-path.",
+            });
+        }
         const detectedSensors = await detectCommandSensors(inspection.effectiveRoot, inspection.platforms);
         const selectedSensors = include.length > 0 ? detectedSensors.filter((sensor) => include.includes(sensor.name)) : detectedSensors;
+        const unmatched = include.filter((requestedName) => !detectedSensors.some((sensor) => sensor.name === requestedName));
+        if (unmatched.length > 0) {
+            return textResult({
+                status: "invalid-selection",
+                surfacePath: inspection.selectedSurface?.path,
+                targetPlatforms: inspection.platforms,
+                requested: include,
+                unmatched,
+                available: detectedSensors.map((sensor) => sensor.name),
+                reason: `No detected sensor matched: ${unmatched.join(", ")}. Explicit --include selections are strict.`,
+            });
+        }
         if (dryRun) {
             return textResult({
                 status: "dry-run",
@@ -91,35 +113,56 @@ async function runSensor(cwd, sensor, timeoutMs) {
         };
     }
     return new Promise((resolve) => {
-        let stdout = "";
-        let stderr = "";
+        const stdout = { value: "", omitted: 0 };
+        const stderr = { value: "", omitted: 0 };
+        let environmentProbeTail = "";
+        let matchedEnvironmentSkip;
         let settled = false;
         const child = spawn(command, args, {
             cwd,
             shell: false,
             env: process.env,
+            detached: process.platform !== "win32",
         });
+        const observeEnvironmentOutput = (chunk) => {
+            if (!matchedEnvironmentSkip && sensor.environmentSkips?.length) {
+                const probe = `${environmentProbeTail}${chunk}`;
+                matchedEnvironmentSkip = sensor.environmentSkips.find(({ pattern }) => {
+                    try {
+                        return new RegExp(pattern, "i").test(probe);
+                    }
+                    catch {
+                        return false;
+                    }
+                });
+                environmentProbeTail = probe.slice(-4096);
+            }
+        };
         const timeout = setTimeout(() => {
             if (settled) {
                 return;
             }
             settled = true;
-            child.kill("SIGTERM");
+            terminateProcessTree(child);
             resolve({
                 name: sensor.name,
                 command: sensor.command,
                 status: "timed-out",
                 durationMs: Date.now() - startedAt,
-                stdout: truncate(stdout),
-                stderr: truncate(stderr),
+                stdout: capturedOutput(stdout),
+                stderr: capturedOutput(stderr),
                 reason: sensor.timeoutReason ?? `Timed out after ${timeoutMs}ms.`,
             });
         }, timeoutMs);
         child.stdout?.on("data", (chunk) => {
-            stdout += chunk.toString("utf8");
+            const text = chunk.toString("utf8");
+            captureOutput(stdout, text);
+            observeEnvironmentOutput(text);
         });
         child.stderr?.on("data", (chunk) => {
-            stderr += chunk.toString("utf8");
+            const text = chunk.toString("utf8");
+            captureOutput(stderr, text);
+            observeEnvironmentOutput(text);
         });
         child.on("error", (error) => {
             if (settled) {
@@ -127,12 +170,13 @@ async function runSensor(cwd, sensor, timeoutMs) {
             }
             settled = true;
             clearTimeout(timeout);
+            captureOutput(stderr, error.message);
             resolve({
                 name: sensor.name,
                 command: sensor.command,
                 status: "failed",
                 durationMs: Date.now() - startedAt,
-                stderr: truncate(error.message),
+                stderr: capturedOutput(stderr),
                 reason: "Failed to start sensor command.",
             });
         });
@@ -142,29 +186,18 @@ async function runSensor(cwd, sensor, timeoutMs) {
             }
             settled = true;
             clearTimeout(timeout);
-            if (exitCode !== 0 && sensor.environmentSkips?.length) {
-                const combinedOutput = `${stdout}\n${stderr}`;
-                const environmentSkip = sensor.environmentSkips.find(({ pattern }) => {
-                    try {
-                        return new RegExp(pattern, "i").test(combinedOutput);
-                    }
-                    catch {
-                        return false;
-                    }
+            if (exitCode !== 0 && matchedEnvironmentSkip) {
+                resolve({
+                    name: sensor.name,
+                    command: sensor.command,
+                    status: "skipped",
+                    exitCode,
+                    durationMs: Date.now() - startedAt,
+                    stdout: capturedOutput(stdout),
+                    stderr: capturedOutput(stderr),
+                    reason: matchedEnvironmentSkip.reason,
                 });
-                if (environmentSkip) {
-                    resolve({
-                        name: sensor.name,
-                        command: sensor.command,
-                        status: "skipped",
-                        exitCode,
-                        durationMs: Date.now() - startedAt,
-                        stdout: truncate(stdout),
-                        stderr: truncate(stderr),
-                        reason: environmentSkip.reason,
-                    });
-                    return;
-                }
+                return;
             }
             resolve({
                 name: sensor.name,
@@ -172,8 +205,8 @@ async function runSensor(cwd, sensor, timeoutMs) {
                 status: exitCode === 0 ? "passed" : "failed",
                 exitCode,
                 durationMs: Date.now() - startedAt,
-                stdout: truncate(stdout),
-                stderr: truncate(stderr),
+                stdout: capturedOutput(stdout),
+                stderr: capturedOutput(stderr),
             });
         });
     });
@@ -209,9 +242,42 @@ function stringArrayField(input, field) {
     }
     return value.filter((item) => typeof item === "string" && item.trim() !== "");
 }
-function truncate(value, maxLength = 8000) {
-    if (value.length <= maxLength) {
-        return value;
+function captureOutput(output, chunk) {
+    const remaining = Math.max(0, maxCapturedOutputChars - output.value.length);
+    output.value += chunk.slice(0, remaining);
+    output.omitted += Math.max(0, chunk.length - remaining);
+}
+function capturedOutput(output) {
+    if (output.omitted === 0) {
+        return output.value;
     }
-    return `${value.slice(0, maxLength)}\n[truncated ${value.length - maxLength} chars]`;
+    return `${output.value}\n[truncated ${output.omitted} chars]`;
+}
+function terminateProcessTree(child) {
+    if (!child.pid) {
+        child.kill("SIGTERM");
+        return;
+    }
+    if (process.platform === "win32") {
+        const killer = spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+            stdio: "ignore",
+            windowsHide: true,
+        });
+        killer.unref();
+        return;
+    }
+    try {
+        process.kill(-child.pid, "SIGTERM");
+    }
+    catch {
+        child.kill("SIGTERM");
+    }
+    const forceKill = setTimeout(() => {
+        try {
+            process.kill(-child.pid, "SIGKILL");
+        }
+        catch {
+        }
+    }, 1000);
+    forceKill.unref();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amityco/social-plus-vise",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Skill-guided deterministic CLI for social.plus SDK integration assistance.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -22,7 +22,7 @@
     "ai-coding"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "publishConfig": {
     "access": "public"