@bossmissing/agent-meta 0.1.0 → 0.2.0

package/dist/templates/index.js

@@ -25,19 +25,25 @@ const AGENTS_MD = `# AGENTS.md
 
 - Read the nearest applicable \`AGENTS.md\` before modifying files.
 - Read related domain documentation before changing business behavior.
+- Do not modify third-party or vendored code (\`node_modules/\`, \`vendor/\`, \`third_party/\`, \`patches/\`). Wrap or extend it instead; if patching is unavoidable, record an ADR first.
+- Do not use user-level (global) skills, plugins, or MCP tools unless the human explicitly asks for them. Prefer tools, scripts, and skills defined inside this repository.
+- Never violate declared hard constraints (\`docs/domain/*/rules.md\` 硬限制 sections and \`docs/engineering/constraints.md\`). If a limit is not declared, ask the human instead of assuming it is negotiable.
+- If you are guessing, fabricating, or cannot verify a conclusion, stop and ask the human.
 - Do not duplicate domain rules in this file.
 - Update OpenSpec specs when externally observable behavior changes.
 - Add or update tests for behavior changes.
 - Do not mix unrelated refactors into a feature change.
-
+{{extra_rules}}
 ## High-Risk Areas
 
-Before changing payment, order, commission, settlement, withdrawal, permissions, webhooks, inventory, or audit logging, read the applicable documentation under \`docs/domain/\`.
+Before changing payment, order, commission, settlement, withdrawal, permissions, webhooks, inventory, or audit logging, read the applicable documentation under \`docs/domain/\`. Hard constraints for these areas are declared in each domain's \`rules.md\` under 硬限制（不可违反）.
 
 ## Definition of Done
 
 - Relevant tests pass.
 - Type checking and lint pass where configured.
+- A human has reviewed the change.
+- All declared hard constraints hold.
 - Behavior changes include documentation or specification updates where applicable.
 - High-risk changes include rollback and failure-path consideration.
 `;
@@ -98,14 +104,21 @@ applies_to: []
 
 <!-- 仅列出该领域特有术语；通用术语应放到 docs/domain/glossary.md。 -->
 
-## 不变量
+## 硬限制（不可违反）
 
-<!-- 无论何时都必须成立的规则。 -->
+<!-- 安全、数据一致性、API 契约、性能预算、兼容性、合规。 -->
+<!-- 没写在这里的限制，AI 会当成可协商的。 -->
 
 -
 -
 -
 
+## 软限制（可权衡）
+
+<!-- 代码风格偏好、非关键路径的实现细节、可后续优化的部分。 -->
+
+-
+
 ## 权限规则
 
 | 角色 | 可执行操作 | 限制 |
@@ -119,11 +132,6 @@ applies_to: []
 ## 审计与追踪
 
 <!-- 是否需要审计日志、操作人、时间、状态变更原因等。 -->
-
-## 禁止行为
-
--
--
 `;
 const DOMAIN_STATE_MACHINE = `---
 title: {{domain_title}}状态机
@@ -413,6 +421,109 @@ applies_to: []
 
 ## 工具与命令
 `;
+const CHANGE_PROPOSAL = `# {{change_title}}
+
+## Why
+
+<!-- 为什么要做这个变更？解决什么问题？ -->
+
+## What Changes
+
+<!-- 变更内容概述：新增/修改/移除哪些能力。 -->
+
+## Impact
+
+- Affected domains: {{domain}}
+- Affected specs:
+- Affected code:
+`;
+const CHANGE_DESIGN = `# {{change_title}} — Design
+
+## Context
+
+<!-- 现状与约束。 -->
+
+## Goals / Non-Goals
+
+- Goals:
+- Non-Goals:
+
+## Decisions
+
+<!-- 关键技术决策；长期决策请沉淀为 ADR（meta new-adr）。 -->
+
+## Hard Constraints（硬限制核对）
+
+<!-- 列出本变更涉及的已声明硬限制与核对结论。 -->
+<!-- 来源：docs/domain/<domain>/rules.md 硬限制章节、docs/engineering/constraints.md。 -->
+
+| 硬限制 | 来源 | 核对结论 |
+|---|---|---|
+|  |  |  |
+
+## Risks / Trade-offs
+
+<!-- 风险与权衡。 -->
+`;
+const CHANGE_TASKS = `# {{change_title}} — Tasks
+
+## 1. Implementation
+
+- [ ] 1.1
+- [ ] 1.2
+
+## 2. Validation
+
+- [ ] 2.1 Tests updated
+- [ ] 2.2 \`meta check\` passes
+`;
+const CHANGE_RISK_REVIEW = `# {{change_title}} — Risk Review
+
+- Related domain: {{domain}}
+- Date: {{date}}
+
+## Checklist
+
+- [ ] Money representation（金额表示与精度）
+- [ ] Idempotency（幂等）
+- [ ] Retry behavior（重试行为）
+- [ ] Callback deduplication（回调去重）
+- [ ] Audit logging（审计日志）
+- [ ] Permission boundaries（权限边界）
+- [ ] Rollback plan（回滚方案）
+- [ ] Declared hard constraints checked（已声明的硬限制全部核对）
+
+## Notes
+
+<!-- 每项勾选前写清结论或“不适用”的原因。 -->
+`;
+const ENGINEERING_CONSTRAINTS = `---
+title: 项目级硬限制
+status: draft
+owner: {{owner}}
+last_reviewed: {{date}}
+source_of_truth: true
+applies_to: []
+---
+
+# 项目级硬限制
+
+<!-- 跨领域的硬限制放这里；单个领域的硬限制放 docs/domain/<domain>/rules.md。 -->
+
+## 硬限制（不可违反）
+
+<!-- 类别参考：安全、数据一致性、API 契约、性能预算、兼容性、合规。 -->
+<!-- 没写在这里的限制，AI 会当成可协商的。 -->
+
+-
+-
+
+## 软限制（可权衡）
+
+<!-- 代码风格偏好、非关键路径的实现细节、可后续优化的部分。 -->
+
+-
+`;
 const RUNBOOKS_README = `---
 title: Runbooks
 status: draft
@@ -441,5 +552,10 @@ export const BUILTIN_TEMPLATES = {
     "system-overview.md": SYSTEM_OVERVIEW,
     "api-conventions.md": API_CONVENTIONS,
     "engineering-testing.md": ENGINEERING_TESTING,
+    "engineering-constraints.md": ENGINEERING_CONSTRAINTS,
     "runbooks-readme.md": RUNBOOKS_README,
+    "change-proposal.md": CHANGE_PROPOSAL,
+    "change-design.md": CHANGE_DESIGN,
+    "change-tasks.md": CHANGE_TASKS,
+    "change-risk-review.md": CHANGE_RISK_REVIEW,
 };

package/dist/validators/domain-validator.js

@@ -1,6 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
-import { parseDocFile, hasSection } from "../core/frontmatter.js";
+import { parseDocFile, hasSection, sectionHasContent, HARD_CONSTRAINT_HEADINGS, } from "../core/frontmatter.js";
 import { matchRiskKeywords } from "../core/risk.js";
 export function listDomainDirs(root, domainDocs) {
     const abs = path.join(root, domainDocs);
@@ -99,6 +99,20 @@ export function validateDomains(ctx) {
             }
         }
         if (riskHits.length > 0) {
+            // Hard constraints must be declared; undeclared limits get treated as
+            // negotiable by AI agents.
+            if (fs.existsSync(rulesAbs)) {
+                const rules = parseDocFile(rulesAbs);
+                if (!sectionHasContent(rules.content, HARD_CONSTRAINT_HEADINGS)) {
+                    issues.push({
+                        code: "HIGH_RISK_DOMAIN_MISSING_HARD_CONSTRAINTS",
+                        severity: "warning",
+                        file: path.join(relDir, "rules.md"),
+                        message: `High-risk domain '${domain}' declares no hard constraints`,
+                        suggestion: 'Fill the "## 硬限制（不可违反）" section in rules.md (security, data consistency, API contracts, performance budgets, compatibility, compliance).',
+                    });
+                }
+            }
             if (!fs.existsSync(rulesAbs)) {
                 issues.push({
                     code: "HIGH_RISK_DOMAIN_MISSING_RULES",
@@ -126,6 +140,21 @@ export function validateDomains(ctx) {
                     suggestion: `Run \`meta new-domain ${domain} --force --with-state-machine\`.`,
                 });
             }
+            // High-risk domains should link the ADRs backing their key decisions.
+            const docs = [readmeAbs, rulesAbs].filter((abs) => fs.existsSync(abs));
+            const referencesAdr = docs.some((abs) => {
+                const body = fs.readFileSync(abs, "utf8").replace(/<!--[\s\S]*?-->/g, "");
+                return /adr\//i.test(body) || /ADR-\d/.test(body);
+            });
+            if (docs.length > 0 && !referencesAdr) {
+                issues.push({
+                    code: "DOMAIN_NO_ADR_REFERENCE",
+                    severity: "warning",
+                    file: relDir,
+                    message: `High-risk domain '${domain}' does not reference any ADR`,
+                    suggestion: `Record key decisions with \`meta new-adr ${domain}-idempotency\` and link them from the domain README.`,
+                });
+            }
         }
     }
     return { issues, checkedFiles };

package/dist/validators/openspec-validator.js

@@ -1,5 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
+import { matchRiskKeywords } from "../core/risk.js";
+import { listDomainDirs } from "./domain-validator.js";
 export function validateOpenSpec(ctx) {
     const issues = [];
     const { root, config } = ctx;
@@ -53,24 +55,51 @@ export function validateOpenSpec(ctx) {
             });
         }
     }
-    // Each change directory should contain at least a proposal or tasks file.
+    // Each change directory must contain the core change files.
     const changesAbs = path.join(openspecAbs, "changes");
     if (fs.existsSync(changesAbs)) {
         for (const entry of fs.readdirSync(changesAbs, { withFileTypes: true })) {
             if (!entry.isDirectory())
                 continue;
+            // OpenSpec keeps completed changes under changes/archive/.
+            if (entry.name === "archive")
+                continue;
             checkedFiles++;
             const changeDir = path.join(changesAbs, entry.name);
-            const hasCore = ["proposal.md", "tasks.md", "design.md"].some((f) => fs.existsSync(path.join(changeDir, f)));
-            if (!hasCore) {
+            const missing = ["proposal.md", "tasks.md"].filter((f) => !fs.existsSync(path.join(changeDir, f)));
+            if (missing.length > 0) {
                 issues.push({
                     code: "OPENSPEC_CHANGE_INCOMPLETE",
                     severity: "warning",
                     file: path.join(openspecRel, "changes", entry.name),
-                    message: "Change directory has none of proposal.md / design.md / tasks.md",
+                    message: `Change directory is missing: ${missing.join(", ")}`,
+                    suggestion: `Run \`meta new-change ${entry.name}\` to create the missing files.`,
                 });
             }
         }
     }
+    // High-risk domain docs should reference OpenSpec specs or changes.
+    for (const domain of listDomainDirs(root, config.paths.domain_docs)) {
+        const riskHits = matchRiskKeywords(domain, config.risk_keywords);
+        if (riskHits.length === 0)
+            continue;
+        const domainRel = path.join(config.paths.domain_docs, domain);
+        const docs = ["README.md", "rules.md"]
+            .map((f) => path.join(root, domainRel, f))
+            .filter((abs) => fs.existsSync(abs));
+        if (docs.length === 0)
+            continue;
+        checkedFiles += docs.length;
+        const referencesOpenspec = docs.some((abs) => /openspec/i.test(fs.readFileSync(abs, "utf8").replace(/<!--[\s\S]*?-->/g, "")));
+        if (!referencesOpenspec) {
+            issues.push({
+                code: "HIGH_RISK_DOMAIN_NO_OPENSPEC_REFERENCE",
+                severity: "warning",
+                file: domainRel,
+                message: `High-risk domain '${domain}' does not reference any OpenSpec specs or changes`,
+                suggestion: `Link the relevant openspec/specs/ or openspec/changes/ entries from ${domainRel}/README.md.`,
+            });
+        }
+    }
     return { issues, checkedFiles };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bossmissing/agent-meta",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Agent Meta CLI - manage AI agent collaboration metadata (AGENTS.md, domain docs, ADRs, frontmatter checks)",
   "keywords": [
     "cli",
@@ -22,6 +22,7 @@
   "types": "./dist/index.d.ts",
   "files": [
     "dist",
+    "assets",
     "README.md",
     "LICENSE"
   ],
@@ -32,14 +33,6 @@
   "engines": {
     "node": ">=20"
   },
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "dev": "tsx src/cli.ts",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "prepublishOnly": "pnpm build"
-  },
   "dependencies": {
     "@inquirer/prompts": "^7.0.0",
     "commander": "^12.1.0",
@@ -55,10 +48,11 @@
     "typescript": "^5.5.0",
     "vitest": "^2.1.0"
   },
-  "packageManager": "pnpm@10.0.0",
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild"
-    ]
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "dev": "tsx src/cli.ts",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit"
   }
-}
+}