npm - @deftai/directive-content - Versions diffs - 0.75.0 → 0.77.0 - Mend

@deftai/directive-content 0.75.0 → 0.77.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (24) hide show

package/Taskfile.yml +7 -1
package/UPGRADING.md +30 -4
package/coding/coding.md +1 -1
package/commands.md +13 -2
package/context/context.md +2 -0
package/meta/security.md +9 -0
package/package.json +1 -1
package/packs/rules/rules-pack-0.1.json +81 -81
package/packs/skills/skills-pack-0.1.json +5 -5
package/patterns/llm-app.md +7 -0
package/skills/deft-directive-build/SKILL.md +4 -0
package/skills/deft-directive-pre-pr/SKILL.md +14 -0
package/skills/deft-directive-review-cycle/SKILL.md +12 -0
package/skills/deft-directive-swarm/SKILL.md +7 -0
package/skills/deft-directive-triage/SKILL.md +6 -1
package/tasks/engine-invoke.cjs +113 -0
package/tasks/engine.yml +10 -6
package/tasks/plan-sequence.yml +47 -0
package/tasks/vbrief.yml +1 -1
package/tasks/verify.yml +10 -0
package/tasks/xbrief.yml +20 -0
package/templates/agent-prompt-preamble.md +22 -0
package/templates/agents-entry.md +24 -114
package/tools/package-manager-network.md +2 -2

package/tools/package-manager-network.md CHANGED Viewed

@@ -13,8 +13,8 @@ Directive runs against arbitrary repositories, including private monorepos with
 ## Rules
 - ! Read-only, session-start, and session-ritual flows (`deft session:start`, `deft verify:session-ritual`, `deft verify:tools`) MUST perform no npm/pnpm registry access. Tool-presence probes MUST use PATH lookups (`which`/`accessSync`) or `--version` checks, never a subcommand that can resolve dependencies or query a registry.
-- ! `deft doctor` MUST default to an OFFLINE tier: no check in the default run may contact an npm/pnpm registry. The one check that can (`payload-staleness`, which resolves the latest framework version via `git ls-remote` and falls back to `npm view <package> version`) is gated behind the explicit `--network` flag and is skipped by default with a pointer to that flag.
-- ! Before a network-gated check runs, `deft doctor --network` MUST print a disclosure line naming the tool and registry class it may contact (e.g. "may contact your git remote and, as a fallback, the npm registry") BEFORE any network call is attempted.
+- ! `deft doctor` MUST default to an OFFLINE tier: no check in the default run may contact an npm/pnpm registry. The one check that can (`payload-staleness`, which uses `git ls-remote` to verify the installed pin and `npm view <package> version` to compare a release-tag install with the latest stable package) is gated behind the explicit `--network` flag and is skipped by default with a pointer to that flag.
+- ! Before a network-gated check runs, `deft doctor --network` MUST print a disclosure line naming the tool and registry class it may contact (for example, "may contact your git remote and the npm registry") BEFORE any network call is attempted.
 - ! Any future doctor check, session step, or read-only command that needs to invoke `npm`/`pnpm` in a way that can reach a registry MUST follow the same pattern: explicit flag or subcommand, disclosed registry class before the call, and offline by default.
 - ~ Where a package-manager operation is unavoidable in an explicitly-invoked flow (e.g. a release or install workflow that legitimately needs to fetch packages), prefer offline/frozen modes (`--offline`, `--prefer-offline`, `--frozen-lockfile`) when the operation only needs to validate local state rather than resolve fresh metadata.
 - ⊗ MUST NOT invoke `npm`/`pnpm` subcommands that can contact a registry from any code path reachable by `session:start`, `verify:session-ritual`, `verify:tools`, or the default `deft doctor` invocation.