@fenglimg/fabric-cli 2.0.0-rc.26 → 2.0.0-rc.27

package/dist/{chunk-AXKII55Y.js → chunk-XEGXQOOJ.js}

@@ -513,9 +513,83 @@ async function copyTextIdempotent(step, source, target) {
   await atomicWriteText2(target, source);
   return { step, path: target, status: "written" };
 }
+var FABRIC_HOOK_SCRIPT_BASENAMES = /* @__PURE__ */ new Set([
+  "fabric-hint.cjs",
+  "knowledge-hint-broad.cjs",
+  "knowledge-hint-narrow.cjs",
+  // rc.5 TASK-010 rename — old hook scripts that pre-upgrade workspaces
+  // may still have registered. Sweeping them prevents the double-fire
+  // documented in audit §2.6.
+  "archive-hint.cjs"
+]);
+function commandBasename(command) {
+  const trimmed = command.trim().replace(/^"+|"+$/g, "");
+  const match = /([^/\\]+\.cjs)$/u.exec(trimmed);
+  return match === null ? null : match[1];
+}
+function stripStaleHookEntries(existing, arrayAppendPaths) {
+  const swept = JSON.parse(JSON.stringify(existing));
+  let removed = 0;
+  for (const dottedPath of arrayAppendPaths) {
+    const segments = dottedPath.split(".");
+    let cursor = swept;
+    for (let i = 0; i < segments.length - 1; i++) {
+      const seg = segments[i];
+      if (cursor === null || typeof cursor !== "object" || Array.isArray(cursor)) {
+        cursor = void 0;
+        break;
+      }
+      cursor = cursor[seg];
+    }
+    if (cursor === null || cursor === void 0 || typeof cursor !== "object" || Array.isArray(cursor)) {
+      continue;
+    }
+    const finalSeg = segments[segments.length - 1];
+    const arr = cursor[finalSeg];
+    if (!Array.isArray(arr)) continue;
+    const filtered = [];
+    for (const item of arr) {
+      if (item === null || typeof item !== "object") {
+        filtered.push(item);
+        continue;
+      }
+      const entry = item;
+      const hooks = entry.hooks;
+      let isFabricOwned = false;
+      if (Array.isArray(hooks)) {
+        for (const h of hooks) {
+          if (h !== null && typeof h === "object") {
+            const cmd = h.command;
+            if (typeof cmd === "string") {
+              const base = commandBasename(cmd);
+              if (base !== null && FABRIC_HOOK_SCRIPT_BASENAMES.has(base)) {
+                isFabricOwned = true;
+                break;
+              }
+            }
+          }
+        }
+      }
+      if (!isFabricOwned && typeof entry.command === "string") {
+        const base = commandBasename(entry.command);
+        if (base !== null && FABRIC_HOOK_SCRIPT_BASENAMES.has(base)) {
+          isFabricOwned = true;
+        }
+      }
+      if (isFabricOwned) {
+        removed += 1;
+      } else {
+        filtered.push(item);
+      }
+    }
+    cursor[finalSeg] = filtered;
+  }
+  return { swept, removed };
+}
 async function mergeJsonIdempotent(step, target, fragment, arrayAppendPaths) {
   const existing = await readJsonObjectOrEmpty(target);
-  const merged = deepMerge(existing, fragment, { arrayAppendPaths });
+  const { swept } = stripStaleHookEntries(existing, arrayAppendPaths);
+  const merged = deepMerge(swept, fragment, { arrayAppendPaths });
   if (jsonEqual(existing, merged)) {
     return { step, path: target, status: "skipped", message: "up-to-date" };
   }

package/dist/index.js

@@ -11,12 +11,12 @@ import { defineCommand, runMain } from "citty";
 
 // src/commands/index.ts
 var allCommands = {
-  install: () => import("./install-3MWBW6N7.js").then((module) => module.default),
+  install: () => import("./install-UJOFZUYF.js").then((module) => module.default),
   doctor: () => import("./doctor-ZIQXN2T2.js").then((module) => module.default),
   serve: () => import("./serve-U3TPWDOB.js").then((module) => module.default),
-  uninstall: () => import("./uninstall-SUSIZHGL.js").then((module) => module.default),
+  uninstall: () => import("./uninstall-O3PXESM2.js").then((module) => module.default),
   config: () => import("./config-5CH4EJQ2.js").then((module) => module.default),
-  "plan-context-hint": () => import("./plan-context-hint-KPGOW3QC.js").then((module) => module.default),
+  "plan-context-hint": () => import("./plan-context-hint-CXTLNVSV.js").then((module) => module.default),
   // v2.0.0-rc.23 TASK-014 (F8c): S5 onboard-slot coverage. Used by the
   // fabric-archive Skill's first-run phase to detect unclaimed slots.
   "onboard-coverage": () => import("./onboard-coverage-JJ5NGU7I.js").then((module) => module.default)
@@ -26,7 +26,7 @@ var allCommands = {
 var main = defineCommand({
   meta: {
     name: "fabric",
-    version: "2.0.0-rc.26",
+    version: "2.0.0-rc.27",
     description: t("cli.main.description")
   },
   subCommands: allCommands

package/dist/{install-3MWBW6N7.js → install-UJOFZUYF.js}

@@ -18,7 +18,7 @@ import {
   writeCodexBootstrapManagedBlock,
   writeCursorBootstrapManagedBlock,
   writeFabricAgentsSnapshot
-} from "./chunk-AXKII55Y.js";
+} from "./chunk-XEGXQOOJ.js";
 import {
   detectClientSupports
 } from "./chunk-MF3OTILQ.js";
@@ -1348,7 +1348,7 @@ function readProjectName(target) {
   return basename(target);
 }
 function getCliVersion() {
-  return true ? "2.0.0-rc.26" : "unknown";
+  return true ? "2.0.0-rc.27" : "unknown";
 }
 function sortRecord(record) {
   return Object.fromEntries(Object.entries(record).sort(([left], [right]) => left.localeCompare(right)));

package/dist/{plan-context-hint-KPGOW3QC.js → plan-context-hint-CXTLNVSV.js}

@@ -70,14 +70,29 @@ async function runPlanContextHint(opts) {
     id: item.stable_id,
     type: item.type ?? item.description.knowledge_type ?? "",
     maturity: item.maturity ?? item.description.maturity ?? "",
-    summary: item.description.summary
+    summary: item.description.summary,
+    // v2.0.0-rc.27 TASK-002 (§2.5/§2.7): forward the server-side scope.
+    // RuleDescriptionIndexItem already carries this field — knowledge-meta-
+    // builder defaults to "broad" for entries without an explicit
+    // relevance_scope frontmatter, so this read is total and never undefined.
+    relevance_scope: item.relevance_scope ?? "broad"
   }));
+  let narrow_count = 0;
+  let broad_only_count = 0;
+  for (const e of entries) {
+    if (e.relevance_scope === "narrow") narrow_count += 1;
+    else broad_only_count += 1;
+  }
   const output = {
     version: 2,
     revision_hash: result.revision_hash,
     target_paths: targetPaths,
     entries,
-    broad_count: sharedIndex.length
+    // Legacy field — preserved for v2 consumers that haven't migrated. Value
+    // semantics unchanged from rc.18 (sharedIndex total).
+    broad_count: sharedIndex.length,
+    narrow_count,
+    broad_only_count
   };
   if (result.auto_healed === true) {
     output.auto_healed = true;

package/dist/{uninstall-SUSIZHGL.js → uninstall-O3PXESM2.js}

@@ -7,7 +7,7 @@ import {
   HOOK_SCRIPT_DESTINATIONS,
   SKILL_DESTINATIONS,
   fabricAgentsSnapshotPath
-} from "./chunk-AXKII55Y.js";
+} from "./chunk-XEGXQOOJ.js";
 import {
   detectClientSupports,
   resolveClients

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fenglimg/fabric-cli",
-  "version": "2.0.0-rc.26",
+  "version": "2.0.0-rc.27",
   "type": "module",
   "bin": {
     "fab": "dist/index.js",
@@ -20,8 +20,8 @@
     "tree-sitter-javascript": "^0.25.0",
     "tree-sitter-typescript": "^0.23.2",
     "web-tree-sitter": "^0.26.8",
-    "@fenglimg/fabric-server": "2.0.0-rc.26",
-    "@fenglimg/fabric-shared": "2.0.0-rc.26"
+    "@fenglimg/fabric-server": "2.0.0-rc.27",
+    "@fenglimg/fabric-shared": "2.0.0-rc.27"
   },
   "devDependencies": {
     "@types/node": "^22.15.0",

package/templates/hooks/fabric-hint.cjs

@@ -477,14 +477,49 @@ function getTopEditedDirectories(projectRoot, topN, anchorTs) {
       // any leading "./". POSIX-style only — the hook ships under POSIX
       // path conventions even on Windows (the project doesn't currently
       // ship a CRLF/backslash test matrix for the sidecar).
-      const norm = p.replace(/\\/g, "/").replace(/^\.\//, "");
+      //
+      // v2.0.0-rc.27 TASK-005 (audit §2.8 leak surface): absolute paths
+      // already accumulated in legacy sidecars start with `/`. We strip
+      // the leading slash and also reject buckets that resolve to user-home
+      // segments (`Users/<name>/...`, `home/<name>/...`) so historical
+      // pollution from absolute-path writes doesn't surface the user's
+      // $HOME in the archive banner. The rc.27 appendEditCounter no longer
+      // writes such paths, but the sidecar is append-only so old lines
+      // persist until rotation.
+      let norm = p.replace(/\\/g, "/").replace(/^\.\//, "");
+      // Strip leading `/` so a stale absolute entry doesn't generate a leak.
+      while (norm.startsWith("/")) norm = norm.slice(1);
       const segs = norm.split("/").filter((s) => s.length > 0);
+      // Reject any bucket whose top segments look like a host-system home
+      // prefix. The pattern is `<top>/<user>/...` where top ∈ Users|home|root.
+      // This silently drops legacy absolute-path entries from $HOME without
+      // mangling the buckets for legitimate project-relative `Users/...`
+      // (unlikely but possible) — the heuristic favours $HOME leak prevention
+      // over false-positive bucketing of project paths named after Unix
+      // conventions.
+      if (segs.length >= 2 && (segs[0] === "Users" || segs[0] === "home" || segs[0] === "root")) {
+        continue;
+      }
+      // v2.0.0-rc.27 TASK-005 (audit §2.8 file-as-dir): when segs[1] looks
+      // like a file (contains a dot-extension at the end), surface segs[0]
+      // alone instead of `segs[0]/segs[1]/` — a 2-seg path of the form
+      // `assets/foo.ts` would otherwise render as "assets/foo.ts/" which
+      // misleads the operator about whether they're seeing a file or a
+      // directory. The extension regex is permissive: any `.X` where X is
+      // 1-8 alphanumerics counts. README.md / package.json / foo.ts all
+      // match; "v1.2" or "dotted.module" do too — acceptable false-positive
+      // rate, since the worst outcome is over-aggregation to the parent.
+      const looksLikeFile = (segment) => /\.[A-Za-z0-9]{1,8}$/u.test(segment);
       let bucket;
       if (segs.length >= 2) {
-        // Leading 2 segments: "packages/cli", "docs/decisions", etc. We
-        // trail with "/" so the banner reads "packages/cli/" — clearly a
-        // directory rather than a file basename.
-        bucket = `${segs[0]}/${segs[1]}/`;
+        if (looksLikeFile(segs[1])) {
+          bucket = `${segs[0]}/`;
+        } else {
+          // Leading 2 segments: "packages/cli", "docs/decisions", etc. We
+          // trail with "/" so the banner reads "packages/cli/" — clearly a
+          // directory rather than a file basename.
+          bucket = `${segs[0]}/${segs[1]}/`;
+        }
       } else if (segs.length === 1) {
         // Single segment — treat the basename as its own bucket. Bare
         // root-level files (README.md, package.json) get some signal too.
@@ -653,13 +688,25 @@ function decide(events, now, pendingStats, underseedStats, editCounterStats, thr
     //   - "<editCount> 次编辑"
     //   - "阈值 <N>"
     //   - "fabric-archive"
+    // v2.0.0-rc.27 TASK-005 (audit §2.17): parts now assembled per-variant
+    // via banner-i18n's archivePartsHours / archivePartsEdits so en mode
+    // gets fully-English fragments instead of mixed-language output. zh-CN
+    // / zh-CN-hybrid still render the original substring contract verbatim.
     const parts = [];
     if (triggerByHours) {
-      parts.push(`已过 ${hoursElapsed.toFixed(1)}h（阈值 ${archiveHintHours}h）`);
+      parts.push(
+        renderBanner("archivePartsHours", variant, {
+          hoursFixed: hoursElapsed.toFixed(1),
+          threshold: archiveHintHours,
+        }),
+      );
     }
     if (triggerByEdits) {
       parts.push(
-        `累计 ${editStats.editsSinceLastProposed} 次编辑（阈值 ${editStats.threshold}）`,
+        renderBanner("archivePartsEdits", variant, {
+          count: editStats.editsSinceLastProposed,
+          threshold: editStats.threshold,
+        }),
       );
     }
     // rc.16 TASK-002: 5-banner i18n via lib/banner-i18n.cjs. Substring
@@ -1236,11 +1283,21 @@ function summarizeTranscript(transcriptPath) {
     if (envelope === null || typeof envelope !== "object") continue;
     envelopeIndex += 1;
 
-    // User text message — Claude Code shape: { role: "user", content: [...] }
-    // OR nested under `message.role`. Be generous.
-    const role = envelope.role || (envelope.message && envelope.message.role);
+    // v2.0.0-rc.27 TASK-009 (audit §2.16): Codex CLI uses a different
+    // envelope shape — { type:"response_item", payload:{ type:"message",
+    // role, content:[{type:"input_text"|"output_text", text}] } } — vs Claude
+    // Code's { type:"user", message:{ role, content } }. Resolve role +
+    // content from whichever shape is present; without this, every Codex
+    // session's digest came out empty (audit §2.16 — fixed here).
+    const role =
+      envelope.role ||
+      (envelope.message && envelope.message.role) ||
+      (envelope.payload && envelope.payload.role);
     if (role === "user") {
-      const content = envelope.content || (envelope.message && envelope.message.content);
+      const content =
+        envelope.content ||
+        (envelope.message && envelope.message.content) ||
+        (envelope.payload && envelope.payload.content);
       if (typeof content === "string") {
         out.user_messages.push(content);
       } else if (Array.isArray(content)) {
@@ -1257,7 +1314,10 @@ function summarizeTranscript(transcriptPath) {
     // entry per assistant envelope (even when no KB: line) so downstream can
     // distinguish "turn observed, no KB" (kb_line_raw=null) from "no turn".
     if (role === "assistant") {
-      const content = envelope.content || (envelope.message && envelope.message.content);
+      const content =
+        envelope.content ||
+        (envelope.message && envelope.message.content) ||
+        (envelope.payload && envelope.payload.content);
       let firstText = null;
       if (typeof content === "string") {
         firstText = content;
@@ -1277,6 +1337,17 @@ function summarizeTranscript(transcriptPath) {
       // with cite_ids). Sentinel `KB: none` contributes a `cite_tags=["none"]`
       // entry but no commitment — matches the parseCiteLine index contract.
       let citeCommitments = [];
+      // v2.0.0-rc.27 TASK-009: Codex assistant blocks carry text under
+      // `type:"output_text"` (not `type:"text"`). Fall back when no text-typed
+      // block matched but a typed output_text block exists.
+      if (firstText === null && Array.isArray(content)) {
+        for (const block of content) {
+          if (block && typeof block === "object" && block.type === "output_text" && typeof block.text === "string") {
+            firstText = block.text;
+            break;
+          }
+        }
+      }
       if (typeof firstText === "string" && firstText.length > 0) {
         // First non-empty line.
         const linesOfText = firstText.split(/\r?\n/);
@@ -1342,6 +1413,27 @@ function summarizeTranscript(transcriptPath) {
         }
       }
     }
+
+    // v2.0.0-rc.27 TASK-009 (audit §2.16): Codex apply_patch path. Codex
+    // emits one response_item envelope per file-edit invocation with payload
+    // shape { type:"custom_tool_call", name:"apply_patch", input:<patch
+    // string> }. The patch body lists target files via `*** Update File:`,
+    // `*** Add File:`, `*** Delete File:` directives — harvest those.
+    if (
+      envelope.type === "response_item" &&
+      envelope.payload &&
+      envelope.payload.type === "custom_tool_call" &&
+      envelope.payload.name === "apply_patch" &&
+      typeof envelope.payload.input === "string"
+    ) {
+      const patchInput = envelope.payload.input;
+      const fileDirectiveRe = /^\*\*\*\s+(?:Update|Add|Delete)\s+File:\s+(.+?)\s*$/gm;
+      let m;
+      while ((m = fileDirectiveRe.exec(patchInput)) !== null) {
+        const fp = m[1].trim();
+        if (fp.length > 0) out.edit_paths.push(fp);
+      }
+    }
   }
   // 1-line title = first non-empty user message (trimmed). Falls back to "".
   if (out.user_messages.length > 0) {

package/templates/hooks/knowledge-hint-narrow.cjs

@@ -267,8 +267,34 @@ function appendEditCounter(projectRoot, now, paths) {
       mkdirSync(dir, { recursive: true });
     }
     const iso = now instanceof Date ? now.toISOString() : new Date(now).toISOString();
+    // v2.0.0-rc.27 TASK-005 (audit §2.8): normalize every path to a
+    // project-relative form BEFORE persistence. rc.26 wrote whatever the
+    // tool_input handed in — frequently absolute paths like
+    // `/Users/wepie/.../foo.ts` — which then leaked into the archive banner's
+    // "recent activity centered on: Users/wepie/" prose (the dirname pass
+    // stripped the leading `/` but produced a $HOME-prefix surface). The
+    // normalize-on-write keeps the sidecar containing only project-internal
+    // paths so downstream banner rendering can't accidentally surface
+    // host-system paths.
+    //
+    // Strategy: for each path, attempt path.relative(projectRoot, abs). When
+    // the result starts with `..` (path is outside the project tree) we
+    // silently drop the entry — out-of-tree edits are not meaningful
+    // activity for THIS project's banner. Bare relative paths (already in
+    // canonical form) round-trip through relative() unchanged.
+    const { isAbsolute: pathIsAbsolute, relative: pathRelative } = require("node:path");
     const pathList = Array.isArray(paths)
-      ? paths.filter((p) => typeof p === "string" && p.length > 0)
+      ? paths
+          .filter((p) => typeof p === "string" && p.length > 0)
+          .map((p) => {
+            if (pathIsAbsolute(p)) {
+              const rel = pathRelative(projectRoot, p);
+              // path.relative returns `..` segments when p escapes projectRoot.
+              return rel.startsWith("..") ? null : rel;
+            }
+            return p;
+          })
+          .filter((p) => typeof p === "string" && p.length > 0)
       : [];
     const line = JSON.stringify({ ts: iso, paths: pathList });
     appendFileSync(file, `${line}\n`, "utf8");
@@ -723,7 +749,20 @@ function main(env, stdio) {
     if (cliPayload === null || cliPayload === undefined) return;
 
     // Protocol v2 (rc.18 TASK-005): wire field is `entries`, no v1 shim.
-    const narrow = Array.isArray(cliPayload.entries) ? cliPayload.entries : [];
+    //
+    // v2.0.0-rc.27 TASK-005 (audit §2.5/§2.7): filter to entries whose
+    // `relevance_scope === "narrow"` so broad cross-cutting entries do NOT
+    // pollute the PreToolUse banner. rc.26 emitted broad + narrow as a
+    // single list — every Edit fired a hint even for paths the entry never
+    // anchored against (audit §2.5 reproduction). Broad entries are already
+    // surfaced once per session by the SessionStart hook so the PreToolUse
+    // surface should be narrow-only by design.
+    //
+    // Defensive default: when the CLI omits `relevance_scope` (older server
+    // / malformed item) we treat it as broad and skip — pre-rc.27 entries
+    // without the field are exactly the broad-leak surface §2.5 calls out.
+    const allEntries = Array.isArray(cliPayload.entries) ? cliPayload.entries : [];
+    const narrow = allEntries.filter((entry) => entry && entry.relevance_scope === "narrow");
     if (narrow.length === 0) {
       // rc.6 TASK-023 (E6): silence-counter — matched-narrow == 0. The CLI
       // had a chance to match against the extracted paths but came back

package/templates/hooks/lib/banner-i18n.cjs

@@ -116,12 +116,39 @@ const STRINGS = {
   // ---- Signal A: archive ----------------------------------------------------
   // Source (zh-CN): fabric-hint.cjs:614  `📋 Fabric: 距上次归档 ${parts}。`
   // params: { parts } where parts is pre-joined `已过 25.0h（阈值 24h）` etc.
+  //
+  // v2.0.0-rc.27 TASK-005 (audit §2.17): `parts` is now constructed by the
+  // sibling archivePartsHours / archivePartsEdits keys (also per-variant) so
+  // the caller never hardcodes Chinese into the en banner. The substring
+  // contract on "25.0h" / "阈值 N" / "次编辑" is preserved per-variant but
+  // each variant gets a coherent monolingual rendering — pre-rc.27 produced
+  // mixed-language output like `📋 Fabric: 已过 25.0h since last archive.`
+  // (audit §2.17 reproduction).
   archiveLine1: {
     "zh-CN": (p) => `📋 Fabric: 距上次归档 ${p.parts}。`,
     en: (p) => `📋 Fabric: ${p.parts} since last archive.`,
     "zh-CN-hybrid": (p) => `📋 Fabric: 距上次归档 ${p.parts}。`,
   },
 
+  // v2.0.0-rc.27 TASK-005 (audit §2.17): per-variant assembly of the
+  // hours-trigger fragment. zh-CN tightens to the original substring
+  // contract (`已过 25.0h（阈值 24h）`); en variant translates the prose
+  // while preserving the numeric tokens; hybrid mirrors zh-CN.
+  // params: { hoursFixed: string (already toFixed(1)), threshold: number }
+  archivePartsHours: {
+    "zh-CN": (p) => `已过 ${p.hoursFixed}h（阈值 ${p.threshold}h）`,
+    en: (p) => `${p.hoursFixed}h elapsed (threshold ${p.threshold}h)`,
+    "zh-CN-hybrid": (p) => `已过 ${p.hoursFixed}h（阈值 ${p.threshold}h）`,
+  },
+
+  // v2.0.0-rc.27 TASK-005 (audit §2.17): edits-trigger fragment.
+  // params: { count: number, threshold: number }
+  archivePartsEdits: {
+    "zh-CN": (p) => `累计 ${p.count} 次编辑（阈值 ${p.threshold}）`,
+    en: (p) => `${p.count} edits since last archive (threshold ${p.threshold})`,
+    "zh-CN-hybrid": (p) => `累计 ${p.count} 次编辑（阈值 ${p.threshold}）`,
+  },
+
   // Source (zh-CN): fabric-hint.cjs:619  `   最近活动集中在: ${activity}。`
   // params: { activity }
   archiveActivity: {

package/templates/hooks/lib/cite-line-parser.cjs

@@ -28,8 +28,11 @@
 
 const ID_RE = /^K[TP]-[A-Z]+-\d+$/;
 const SENTINEL_RE = /^KB:\s*none\b\s*(?:\[[^\]]*\])?\s*$/i;
+// v2.0.0-rc.27 TASK-003 (audit §2.18): multi-id citations supported via
+// comma-separated ID group. Mirrors packages/shared/src/cite-line-parser.ts.
 const FULL_RE =
-  /^KB:\s+(K[TP]-[A-Z]+-\d+)(?:\s+\(([^)]*)\))?(?:\s+\[([^\]]+)\])?(?:\s+→\s*(.+))?\s*$/;
+  /^KB:\s+(K[TP]-[A-Z]+-\d+(?:\s*,\s*K[TP]-[A-Z]+-\d+)*)(?:\s+\(([^)]*)\))?(?:\s+\[([^\]]+)\])?(?:\s+→\s*(.+))?\s*$/;
+const CHAINED_FROM_ID_RE = /chained-from\s+(K[TP]-[A-Z]+-\d+)/i;
 
 const ALLOWED_TAGS = new Set([
   "planned",
@@ -80,15 +83,32 @@ function parseLine(line) {
   const trimmed = line.trim();
   if (trimmed.length === 0) return null;
   if (SENTINEL_RE.test(trimmed)) {
-    return { id: null, tag: "none", commitment: null };
+    return { ids: [], tag: "none", commitment: null };
   }
   const fullMatch = trimmed.match(FULL_RE);
   if (fullMatch) {
-    const id = fullMatch[1];
-    if (!ID_RE.test(id)) return null;
+    // v2.0.0-rc.27 TASK-003 (audit §2.18): split + revalidate each id;
+    // capture chained-from tail id when present.
+    const primaryIds = fullMatch[1]
+      .split(",")
+      .map((part) => part.trim())
+      .filter((part) => part.length > 0);
+    if (primaryIds.some((id) => !ID_RE.test(id))) return null;
+
+    const rawTag = fullMatch[3];
+    const tag = parseTag(rawTag);
+
+    const chainedIds = [];
+    if (rawTag) {
+      const chained = CHAINED_FROM_ID_RE.exec(rawTag);
+      if (chained && ID_RE.test(chained[1])) {
+        chainedIds.push(chained[1]);
+      }
+    }
+
     return {
-      id,
-      tag: parseTag(fullMatch[3]),
+      ids: primaryIds.concat(chainedIds),
+      tag,
       commitment: parseContractTail(fullMatch[4]),
     };
   }
@@ -99,6 +119,10 @@ function parseLine(line) {
  * Parse one or more newline-separated `KB:` cite lines into structured arrays
  * matching the assistant_turn_observed event-ledger fields. Tolerates
  * whitespace, CR/LF, blank lines, interleaved prose. Never throws.
+ *
+ * v2.0.0-rc.27 TASK-003 (audit §2.18): supports multi-id citations
+ * (`KB: KT-DEC-0001, KT-PIT-0005 ...`) and surfaces `chained-from <id>`'s
+ * embedded id as an additional cite_id. cite_tags carries one tag per LINE.
  */
 function parseCiteLine(raw) {
   const result = { cite_ids: [], cite_tags: [], cite_commitments: [] };
@@ -107,9 +131,19 @@ function parseCiteLine(raw) {
     const parsed = parseLine(line);
     if (!parsed) continue;
     result.cite_tags.push(parsed.tag);
-    if (parsed.id !== null) result.cite_ids.push(parsed.id);
+    for (const id of parsed.ids) {
+      result.cite_ids.push(id);
+    }
     if (parsed.commitment !== null) {
-      result.cite_commitments.push(parsed.commitment);
+      // v2.0.0-rc.27.1 (Codex review fix): cite_commitments MUST be index-
+      // aligned with cite_ids per the schema doc on event-ledger.ts:428.
+      // Multi-id citations share ONE parsed contract — propagate it across
+      // every id slot so downstream consumers (`doctor.ts` per-cite walk +
+      // `cite-contract-reminder.cjs`) can look up `commitments[i]` for any
+      // valid `i < cite_ids.length` without falling into an undefined slot.
+      for (let i = 0; i < parsed.ids.length; i += 1) {
+        result.cite_commitments.push(parsed.commitment);
+      }
     }
   }
   return result;

package/templates/skills/fabric-archive/SKILL.md

@@ -269,10 +269,11 @@ following 5 categories MUST be rendered in the resolved language:
 3. **Confirmation prompts** — the per-candidate `Confirm? (Y to accept,
    edit … inline, N to skip)` line in the batch review template. zh-CN
    ↔ en mirror.
-4. **Dry-run table headers** — fabric-archive does not currently expose
-   a dry-run mode; this slot is reserved for parity with fabric-import.
-   IF a future revision adds dry-run, the table header MUST be
-   bilingualized per this policy. zh-CN ↔ en mirror.
+4. **Dry-run table headers** — v2.0.0-rc.27 TASK-007 added a dry-run
+   override path (see Phase 2.5 "dry-run") so users can preview the
+   archive proposal without writing pending entries. The dry-run summary
+   header and per-candidate preview labels MUST be bilingualized per
+   this policy. zh-CN ↔ en mirror.
 5. **AskUserQuestion** — `header` + `question` fields (NOT `options[]`).
    zh-CN ↔ en mirror. fabric-archive itself does not surface
    AskUserQuestion in the current contract (Phase 1 batch review is a
@@ -1095,6 +1096,20 @@ If the skill needs to record a genuinely separate observation in the same sessio
 
 MANDATORY closing step on every skill invocation — runs AFTER Phase 2 (success path) AND on every early-exit path (Phase 0.0 dropped-all, Phase 0.5 gate-FAIL silent-skip or user-active, Phase 1 batch user-dismissed). Drives the Q3.4 outcome state machine + cross-session digest rescan filter.
 
+#### Dry-run override (v2.0.0-rc.27 TASK-007 / audit §2.25)
+
+When the user's invocation explicitly carries a dry-run intent — the prompt or `/fabric-archive` invocation contains a literal `--dry-run`, `dry-run`, `dry_run`, or `预览` token — the skill MUST skip Phase 2.5's ledger write. The mandatory contract above is suspended only in this single case; every other early-exit path still emits the event.
+
+Rationale: pre-rc.27 the spec read as "MANDATORY on every invocation" which created an irreconcilable conflict when the user explicitly requested a no-mutation preview (audit §2.25). The dry-run override resolves the deadlock by treating dry-run as an entry-context override that disables the ledger side-effect while preserving the rest of the skill's read-side machinery (Phase 0.0 digest collection, Phase 0.5 viability gate, Phase 1 candidate preview render). The user sees what WOULD have happened without the audit trail recording an attempt that never produced a pending entry.
+
+Detection rule (substring match, case-insensitive): if the originating prompt contains `--dry-run` | `dry-run` | `dry_run` | `预览` as a standalone token, set `dry_run = true` for the entire skill run and skip the Phase 2.5 event emission. All other phases run normally; their user-facing output should prefix `[DRY-RUN]` to make the mode visible.
+
+When `dry_run = true`:
+- Phase 1 batch review header MUST include `[DRY-RUN — no writes will occur]`
+- Phase 2 candidate emission is REPLACED with a "would write N pending entries" preview rendered as a numbered table (`would-write` shape — same columns as the real Phase 1 review)
+- Phase 2.5 event emission is SKIPPED entirely (the rationale above)
+- No `fab_extract_knowledge` MCP call is issued (dry-run is purely read-side)
+
 #### What to emit
 
 For EACH `session_id` in the run's scope (multi-session E4 runs emit MULTIPLE events — one per session_id; single-session E1/E2/E3/E5 runs emit ONE event), append ONE `session_archive_attempted` line to `.fabric/events.jsonl`: