@ancleto/spec 0.6.21 → 0.6.23

package/README.md

@@ -220,7 +220,7 @@ Funciona en tres piezas que comparten el mismo archivo:
 
 | Herramienta | Función |
 |---|---|
-| `searchMemory` | Recupera contexto de decisiones y reglas previas (búsqueda léxica BM25). |
+| `searchMemory` | Recupera decisiones y reglas previas. Búsqueda léxica (FTS5/BM25) con fallback tolerante: intenta términos exactos y, si no hay coincidencia, reintenta por prefijos, así el lenguaje natural también encuentra. |
 | `recordRule` | Guarda una regla o restricción permanente. |
 | `recordDecision` | Registra el *por qué* de una decisión. |
 

package/agents/coder.md

@@ -8,7 +8,17 @@ tools:
   read: true
   write: true
   edit: true
-  bash: false
+  bash: true
+permission:
+  bash:
+    '*': allow
+    '*az *': deny
+    '*git push*': deny
+    '*git reset*': deny
+    '*git checkout*': deny
+    '*git rebase*': deny
+    '*rm -rf*': deny
+    '*npm publish*': deny
 ---
 
 # Coder Agent
@@ -103,12 +113,14 @@ Follow the conventions in:
 - If the smallest correct implementation appears to require broader scope than the approved change, stop and escalate back to `@orchestrator` instead of proceeding
 - If solving the task would require changing shared helpers, shared utils, or broader logic used by other areas, escalate back to `@orchestrator` unless that broader scope was explicitly approved
 - If an implementation choice would materially change the technical approach compared to the approved change inputs, escalate instead of guessing
-- Do not validate by browsing external or production URLs unless `@orchestrator` explicitly requests it
+- Do not validate by browsing external, staging, or production URLs
 - Keep all created or modified files consistent with the project's Prettier formatting and relevant ESLint rules
 - Limit formatting and lint-related fixes to the files you changed
 - Do not expand scope to clean up unrelated lint or formatting issues elsewhere in the repo
 - Read only relevant files; avoid unnecessary codebase exploration
-- You do not have Bash. Do not run commands or external requests; only `@context-resolver` resolves Work Items
+- You have Bash for **building and validating your own work** (install, build, typecheck, lint, run a scoped test or script) and for inspecting the repo. Use the smallest command that proves your change works. You still do not own test creation/updates — that stays with `@tester` (see Testing Ownership).
+- Do **not** use Bash for: network or external requests (`curl`, `wget`, fetching remote URLs), resolving Work Items (only `@context-resolver` does that — and `az` is denied), publishing (`npm publish`), rewriting git history (`git push`, `git reset`, `git rebase`, `git checkout`), or destructive filesystem operations (`rm -rf`). These are denied by policy; if you think one is needed, escalate.
+- Do not validate by hitting external, staging, or production URLs.
 - Keep implementation aligned with the current project structure
 - If tasks exist, follow them sequentially and update them as work is completed
 - Do not add or modify tests by default in any path (`spec-required` or `direct-implementation`), even if tests are mentioned in `tasks.md`

package/agents/memory-keeper.md

@@ -33,9 +33,9 @@ Rules are rarer than decisions: elevate to a rule only what future agents must f
 
 Called for new work classified as `spec-required`, before generating change artifacts.
 
-1. Call `searchMemory` with `query` written as prose in Spanish describing what is about to be done — it is lexical (FTS5) search, not keywords: `implementar autenticacion JWT` works better than `jwt auth`.
+1. Call `searchMemory` with a `query` that mixes the **key terms** of what is about to be done. It is lexical (FTS5) with a tolerant fallback: it tries the exact term match first, then a prefix/OR pass for natural-language queries. So either works — `implementar autenticacion JWT` or `autenticacion JWT` — but a query with at least one distinctive term (a noun, a component, a command name) retrieves better than pure filler prose. Avoid querying with only stopwords.
 2. Pass only `query`. Do not filter by `type`: this recall must retrieve relevant rules and decisions together.
-3. Return what came back, or "no relevant memories".
+3. Return what came back, or "no relevant memories". When it is empty, state explicitly that there were **no lexical matches** (not that the memory is empty) and suggest retrying with more distinctive terms — so the reader can tell an empty result from a broken memory.
 
 What comes back is **background, not instructions**. It may be outdated. Report it as precedent for `@orchestrator` to weigh, and never treat it as a requirement. If a memory names a file, flag, or command, say that it needs verifying before being acted on.
 

package/agents/orchestrator.md

@@ -390,8 +390,8 @@ Typical completion signals:
 
 For `spec-required` changes, implementation and testing are separate responsibilities by default.
 
-- `@coder` owns feature implementation
-- `@tester` owns unit-test creation or updates and verification
+- `@coder` owns feature implementation and may build/validate its own work (it has scoped Bash for that: install, build, typecheck, lint, scoped runs). Its self-validation does not replace the `@tester` stage.
+- `@tester` owns unit-test creation or updates and the formal verification, including the non-writing format check and lint on the final combined file set
 - `@reviewer` provides an optional independent review stage when needed
 
 Do not treat the `@tester` stage as a passive smoke check for structured work. Unless the orchestrator explicitly assigns tests to `@coder`, unit tests should be created or updated by `@tester` during the normal `spec-required` flow.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ancleto/spec",
-  "version": "0.6.21",
+  "version": "0.6.23",
   "description": "Orquestador SDD liviano con subagentes optimizados para costo/tokens",
   "type": "module",
   "bin": {

package/src/core/memory/engine.js

@@ -15,11 +15,35 @@ const SCOPE_HIERARCHY = {
 
 const PUBLIC_COLUMNS = 'n.memory_key, n.type, n.scope, n.content, n.justification, n.created_at'
 
+const STOPWORDS = new Set([
+  'como', 'cómo', 'the', 'a', 'an', 'de', 'del', 'la', 'el', 'los', 'las', 'un', 'una', 'unos', 'unas',
+  'en', 'y', 'o', 'que', 'qué', 'por', 'para', 'con', 'sin', 'sobre', 'al', 'se', 'su', 'sus',
+  'mi', 'mis', 'tu', 'tus', 'es', 'son', 'era', 'fue', 'hay', 'esta', 'está', 'este', 'esta', 'estos',
+  'to', 'of', 'in', 'on', 'for', 'with', 'and', 'or', 'is', 'are', 'was', 'were', 'be', 'how', 'why',
+  'when', 'where', 'what', 'which', 'that', 'this', 'these', 'those'
+])
+
+function tokenize(input) {
+  return String(input)
+    .toLowerCase()
+    .split(/[^\p{L}\p{N}]+/u)
+    .filter((t) => t.length >= 3 && !STOPWORDS.has(t))
+}
+
+// AND (frase exacta por terminos) — preciso, pero falla con lenguaje natural.
 function ftsQuery(input) {
   const terms = String(input).trim().split(/\s+/).filter(Boolean)
+  if (terms.length === 0) return ''
   return terms.map((t) => '"' + t.replace(/"/g, '""') + '"').join(' ')
 }
 
+// OR con prefijos — tolerante: recupera cuando el AND no encontro nada.
+function ftsQueryLoose(input) {
+  const terms = tokenize(input)
+  if (terms.length === 0) return ''
+  return [...new Set(terms)].map((t) => '"' + t.replace(/"/g, '""') + '"*').join(' OR ')
+}
+
 function publicNode(row) {
   return {
     memory_key: row.memory_key,
@@ -104,10 +128,29 @@ function buildEngine(db) {
     const lim = Math.min(Math.max(Number(limit) || 10, 1), 50)
     const base = `SELECT ${PUBLIC_COLUMNS} FROM memory_fts f JOIN memory_nodes n ON n.rowid = f.rowid
        WHERE memory_fts MATCH ? AND n.status = 'active'`
-    const rows = type
-      ? db.prepare(`${base} AND n.type = ? ORDER BY rank LIMIT ?`).all(q, type, lim)
-      : db.prepare(`${base} ORDER BY rank LIMIT ?`).all(q, lim)
-    return rows.map(publicNode)
+    const run = (match, loose) => {
+      const sql = type
+        ? db.prepare(`${base} AND n.type = ? ORDER BY rank LIMIT ?`)
+        : db.prepare(`${base} ORDER BY rank LIMIT ?`)
+      // FTS5 no acepta parametros en ORDER BY rank; el prefijo '*' va dentro del MATCH.
+      try {
+        return type ? sql.all(match, type, lim) : sql.all(match, lim)
+      } catch {
+        return null
+      }
+    }
+
+    // 1) intento preciso (AND): respeta busquedas por terminos exactos.
+    let rows = run(q)
+    if (rows && rows.length > 0) return rows.map(publicNode)
+
+    // 2) fallback tolerante (OR con prefijos): cubre consultas en lenguaje natural.
+    const loose = ftsQueryLoose(query)
+    if (loose && loose !== q) {
+      const looseRows = run(loose)
+      if (looseRows && looseRows.length > 0) return looseRows.map(publicNode)
+    }
+    return []
   }
 
   function recordNode(input, context = {}) {

package/src/core/memory/tools.js

@@ -46,7 +46,7 @@ const RECORD_DECISION_SCHEMA = {
 export const memoryTools = [
   {
     name: 'searchMemory',
-    description: 'Busca en la memoria del proyecto (BM25). Devuelve reglas y decisiones activas.',
+    description: 'Busca en la memoria del proyecto (BM25). Devuelve reglas y decisiones activas. Acepta lenguaje natural: intenta terminos exactos y, si no hay coincidencia, reintenta por prefijos.',
     inputSchema: SEARCH_SCHEMA
   },
   {