@fenglimg/fabric-cli 2.0.0-rc.27 → 2.0.0-rc.29

package/dist/{chunk-XEGXQOOJ.js → chunk-PNRWNUFX.js}

@@ -148,6 +148,7 @@ async function installFabricArchiveSkill(projectRoot, _options = {}) {
   for (const target of targets) {
     results.push(await copyTextIdempotent("skill", source, target));
   }
+  results.push(...await installSkillRefFiles(projectRoot, "fabric-archive"));
   return results;
 }
 async function installFabricReviewSkill(projectRoot, _options = {}) {
@@ -157,6 +158,7 @@ async function installFabricReviewSkill(projectRoot, _options = {}) {
   for (const target of targets) {
     results.push(await copyTextIdempotent("skill-review", source, target));
   }
+  results.push(...await installSkillRefFiles(projectRoot, "fabric-review"));
   return results;
 }
 async function installFabricImportSkill(projectRoot, _options = {}) {
@@ -166,6 +168,67 @@ async function installFabricImportSkill(projectRoot, _options = {}) {
   for (const target of targets) {
     results.push(await copyTextIdempotent("skill-import", source, target));
   }
+  results.push(...await installSkillRefFiles(projectRoot, "fabric-import"));
+  return results;
+}
+async function installSkillRefFiles(projectRoot, skillSlug) {
+  let refTemplateDir;
+  try {
+    refTemplateDir = findTemplatePath(`skills/${skillSlug}/ref`);
+  } catch {
+    return [
+      {
+        step: "skill-ref",
+        path: `skills/${skillSlug}/ref`,
+        status: "skipped",
+        message: `no-ref-dir: ${skillSlug}`
+      }
+    ];
+  }
+  let refFiles;
+  try {
+    refFiles = readdirSync(refTemplateDir).filter((name) => name.endsWith(".md"));
+  } catch {
+    return [
+      {
+        step: "skill-ref",
+        path: refTemplateDir,
+        status: "skipped",
+        message: `no-ref-files: ${skillSlug}`
+      }
+    ];
+  }
+  if (refFiles.length === 0) {
+    return [
+      {
+        step: "skill-ref",
+        path: refTemplateDir,
+        status: "skipped",
+        message: `no-ref-files: ${skillSlug}`
+      }
+    ];
+  }
+  const clientPrefixes = [".claude", ".codex"];
+  const results = [];
+  for (const refFile of refFiles) {
+    const sourcePath = join2(refTemplateDir, refFile);
+    let source;
+    try {
+      source = readFileSync2(sourcePath, "utf8");
+    } catch (error) {
+      results.push({
+        step: "skill-ref",
+        path: sourcePath,
+        status: "error",
+        message: error instanceof Error ? error.message : String(error)
+      });
+      continue;
+    }
+    for (const prefix of clientPrefixes) {
+      const target = join2(projectRoot, prefix, "skills", skillSlug, "ref", refFile);
+      results.push(await copyTextIdempotent("skill-ref", source, target));
+    }
+  }
   return results;
 }
 async function installArchiveHintHook(projectRoot, _options = {}) {

package/dist/{doctor-ZIQXN2T2.js → doctor-TTDTKOFJ.js}

@@ -145,6 +145,15 @@ var doctorCommand = defineCommand({
     const citeCoverage = args["cite-coverage"] === true;
     const enrichDesc = args["enrich-descriptions"] === true;
     const archiveHistory = args["archive-history"] === true;
+    if (args.since !== void 0) {
+      try {
+        parseSinceDuration(args.since);
+      } catch {
+        writeStderr(dt("cli.doctor.errors.invalid-since", { input: args.since }));
+        process.exitCode = 1;
+        return;
+      }
+    }
     if (archiveHistory) {
       if (fix || fixKnowledge || citeCoverage || enrichDesc) {
         writeStderr(dt("cli.doctor.errors.archive-history-mutex"));
@@ -300,6 +309,22 @@ function renderHumanReport(report, dt) {
   writeIssueSection(dt("doctor.section.fixable"), report.fixable_errors);
   writeIssueSection(dt("doctor.section.manual"), report.manual_errors);
   writeIssueSection(dt("doctor.section.warnings"), report.warnings);
+  renderPayloadLimits(report, dt);
+}
+function renderPayloadLimits(report, dt) {
+  const limits = report.summary.payload_limits;
+  if (limits === void 0) {
+    return;
+  }
+  writeStdout("");
+  writeStdout(dt("doctor.section.payload-limits"));
+  writeStdout(
+    `- ${dt("doctor.payload-limits.line", {
+      warnKb: String(Math.round(limits.warn_bytes / 1024)),
+      hardKb: String(Math.round(limits.hard_bytes / 1024)),
+      source: limits.source
+    })}`
+  );
 }
 function renderFixKnowledgeMutations(fixKnowledgeReport, dt) {
   if (fixKnowledgeReport.mutations.length === 0) {

package/dist/index.js

@@ -11,22 +11,22 @@ import { defineCommand, runMain } from "citty";
 
 // src/commands/index.ts
 var allCommands = {
-  install: () => import("./install-UJOFZUYF.js").then((module) => module.default),
-  doctor: () => import("./doctor-ZIQXN2T2.js").then((module) => module.default),
-  serve: () => import("./serve-U3TPWDOB.js").then((module) => module.default),
-  uninstall: () => import("./uninstall-O3PXESM2.js").then((module) => module.default),
+  install: () => import("./install-ODEKSJDS.js").then((module) => module.default),
+  doctor: () => import("./doctor-TTDTKOFJ.js").then((module) => module.default),
+  serve: () => import("./serve-43JTEM3U.js").then((module) => module.default),
+  uninstall: () => import("./uninstall-VLLJG7JT.js").then((module) => module.default),
   config: () => import("./config-5CH4EJQ2.js").then((module) => module.default),
   "plan-context-hint": () => import("./plan-context-hint-CXTLNVSV.js").then((module) => module.default),
   // v2.0.0-rc.23 TASK-014 (F8c): S5 onboard-slot coverage. Used by the
   // fabric-archive Skill's first-run phase to detect unclaimed slots.
-  "onboard-coverage": () => import("./onboard-coverage-JJ5NGU7I.js").then((module) => module.default)
+  "onboard-coverage": () => import("./onboard-coverage-6MN3CYHT.js").then((module) => module.default)
 };
 
 // src/index.ts
 var main = defineCommand({
   meta: {
     name: "fabric",
-    version: "2.0.0-rc.27",
+    version: "2.0.0-rc.29",
     description: t("cli.main.description")
   },
   subCommands: allCommands

package/dist/{install-UJOFZUYF.js → install-ODEKSJDS.js}

@@ -18,7 +18,7 @@ import {
   writeCodexBootstrapManagedBlock,
   writeCursorBootstrapManagedBlock,
   writeFabricAgentsSnapshot
-} from "./chunk-XEGXQOOJ.js";
+} from "./chunk-PNRWNUFX.js";
 import {
   detectClientSupports
 } from "./chunk-MF3OTILQ.js";
@@ -1348,7 +1348,7 @@ function readProjectName(target) {
   return basename(target);
 }
 function getCliVersion() {
-  return true ? "2.0.0-rc.27" : "unknown";
+  return true ? "2.0.0-rc.29" : "unknown";
 }
 function sortRecord(record) {
   return Object.fromEntries(Object.entries(record).sort(([left], [right]) => left.localeCompare(right)));

package/dist/{onboard-coverage-JJ5NGU7I.js → onboard-coverage-6MN3CYHT.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  t
+} from "./chunk-PWLW3B57.js";
 
 // src/commands/onboard-coverage.ts
 import { existsSync, readdirSync, readFileSync } from "fs";
@@ -169,7 +172,11 @@ function renderHumanReadable(report) {
 var onboardCoverageCommand = defineCommand({
   meta: {
     name: "onboard-coverage",
-    description: "Report S5 onboard-slot coverage for the workspace. Used by the fabric-archive Skill's first-run phase to detect unclaimed project-tone slots.",
+    // v2.0.0-rc.29 TASK-008 (BUG-L2): route description strings through t()
+    // (mirrors serve.ts pattern). Previously this command was English-only
+    // even when the rest of `fab --help` rendered zh-CN, so Chinese-locale
+    // users saw an isolated English block under --help.
+    description: t("cli.onboard-coverage.description"),
     // Mirrors `plan-context-hint`: hidden from `fab --help` so the top-level
     // banner stays focused on install/doctor/serve/config. The command stays
     // callable directly from Skills via `fab onboard-coverage --json`.
@@ -178,12 +185,12 @@ var onboardCoverageCommand = defineCommand({
   args: {
     json: {
       type: "boolean",
-      description: "Emit machine-readable JSON to stdout instead of the human table.",
+      description: t("cli.onboard-coverage.args.json.description"),
       default: false
     },
     target: {
       type: "string",
-      description: "Override the project root (defaults to cwd)."
+      description: t("cli.onboard-coverage.args.target.description")
     }
   },
   async run({ args }) {

package/dist/{serve-U3TPWDOB.js → serve-43JTEM3U.js}

@@ -41,6 +41,12 @@ var serveCommand = defineCommand({
       type: "boolean",
       description: t("cli.serve.args.debug.description"),
       default: false
+    },
+    // v2.0.0-rc.29 TASK-002 (BUG-K1): default-deny strict-auth.
+    "allow-loopback-no-auth": {
+      type: "boolean",
+      description: t("cli.serve.args.allow-loopback-no-auth.description"),
+      default: false
     }
   },
   async run({ args }) {
@@ -50,7 +56,8 @@ var serveCommand = defineCommand({
     const port = parsePort(args.port);
     const requestedHost = parseHost(args.host);
     const authToken = readAuthTokenFromEnv();
-    const host = validateHost(requestedHost, authToken);
+    const allowLoopbackNoAuth = args["allow-loopback-no-auth"] === true;
+    const host = validateHost(requestedHost, authToken, allowLoopbackNoAuth);
     const projectRoot = resolution.target;
     try {
       acquireLock(projectRoot);
@@ -73,7 +80,8 @@ var serveCommand = defineCommand({
         port,
         projectRoot,
         host,
-        authToken
+        authToken,
+        allowLoopbackNoAuth
       });
     } catch (error) {
       if (isNodeError(error) && error.code === "EADDRINUSE") {
@@ -105,7 +113,7 @@ function readAuthTokenFromEnv() {
   const token = process.env.FABRIC_AUTH_TOKEN;
   return token === void 0 || token.length === 0 ? void 0 : token;
 }
-function validateHost(host, authToken) {
+function validateHost(host, authToken, allowLoopbackNoAuth) {
   if (authToken !== void 0) {
     return host;
   }
@@ -115,6 +123,11 @@ function validateHost(host, authToken) {
     );
     return "127.0.0.1";
   }
+  if (!allowLoopbackNoAuth) {
+    console.error(
+      `${symbol.warn} ${paint.warn(t("cli.serve.warning.loopback-deny-default"))}`
+    );
+  }
   return host;
 }
 function isLoopbackHost(host) {

package/dist/{uninstall-O3PXESM2.js → uninstall-VLLJG7JT.js}

@@ -7,7 +7,7 @@ import {
   HOOK_SCRIPT_DESTINATIONS,
   SKILL_DESTINATIONS,
   fabricAgentsSnapshotPath
-} from "./chunk-XEGXQOOJ.js";
+} from "./chunk-PNRWNUFX.js";
 import {
   detectClientSupports,
   resolveClients

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fenglimg/fabric-cli",
-  "version": "2.0.0-rc.27",
+  "version": "2.0.0-rc.29",
   "type": "module",
   "bin": {
     "fab": "dist/index.js",
@@ -20,8 +20,8 @@
     "tree-sitter-javascript": "^0.25.0",
     "tree-sitter-typescript": "^0.23.2",
     "web-tree-sitter": "^0.26.8",
-    "@fenglimg/fabric-server": "2.0.0-rc.27",
-    "@fenglimg/fabric-shared": "2.0.0-rc.27"
+    "@fenglimg/fabric-server": "2.0.0-rc.29",
+    "@fenglimg/fabric-shared": "2.0.0-rc.29"
   },
   "devDependencies": {
     "@types/node": "^22.15.0",

package/templates/hooks/fabric-hint.cjs

@@ -1079,7 +1079,20 @@ function tryReadStdinJson() {
     const parsed = JSON.parse(buf);
     if (parsed === null || typeof parsed !== "object") return null;
     return parsed;
-  } catch {
+  } catch (e) {
+    // v2.0.0-rc.29 TASK-008 (BUG-L1): hook used to silent-swallow JSON.parse
+    // errors which masked real client-side payload bugs (e.g. CLI hosts that
+    // stopped emitting Stop-hook JSON envelopes). Log a single best-effort
+    // diagnostic line so operators see WHY the hook went quiet; keep returning
+    // null so downstream behaviour (graceful exit 0, no rule render) is
+    // unchanged.
+    try {
+      const message = (e && typeof e === "object" && "message" in e) ? String(e.message) : String(e);
+      process.stderr.write(`[fabric-hint] malformed input: ${message}\n`);
+    } catch {
+      // stderr write failed (very unusual — sandbox / closed fd). The
+      // hook contract still requires we never throw upward.
+    }
     return null;
   }
 }

package/templates/hooks/knowledge-hint-broad.cjs

@@ -227,12 +227,16 @@ function shouldRecommendImport(projectRoot) {
 // CONSTANTS
 // -----------------------------------------------------------------------------
 
-// Per-type truncation triggers when total narrow entries > 30. The threshold
-// was originally aligned with the rc.5 plan-context degenerate-mode cutoff,
-// which is now retired (rc.7 T9 — see docs/decisions/rc5-a3-superseded.md).
-// We keep 30 here as a stable rendering boundary independent of that protocol
-// change: it's a UI-density choice, not a wire-shape one.
-const TRUNCATION_THRESHOLD = 30;
+// Per-type truncation triggers when total broad-scope entries > N.
+// v2.0.0-rc.29 TASK-007 (BUG-F1): lowered from 30 → 12. SessionStart hint
+// should bias toward "is there anything relevant?" rather than "exhaustive
+// index" — at 30, the banner consumed several terminal screens on
+// well-seeded repos and operators reported scroll fatigue. 12 keeps a
+// dense-enough scan (still fits "top hits per type" in 1-2 screenfuls)
+// without prompting the user to mentally truncate themselves. The constant
+// stays a stable rendering boundary; downstream consumers (banner-i18n.cjs,
+// truncation summary lines) consume it as a single source of truth.
+const TRUNCATION_THRESHOLD = 12;
 
 // `fabric plan-context-hint` is a thin wrapper over planContext(); on a
 // well-seeded repo it returns in ~100ms. Two-second cap is defensive — any

package/templates/hooks/knowledge-hint-narrow.cjs

@@ -142,7 +142,19 @@ function readPayload(rawStdin) {
       return null;
     }
     return parsed;
-  } catch {
+  } catch (e) {
+    // v2.0.0-rc.29 REVIEW (codex LOW-1): apply BUG-L1's malformed-input
+    // diagnostic uniformly across hook scripts. fabric-hint.cjs got the stderr
+    // trace in TASK-008; without this matching write here, a broken Codex /
+    // Cursor host payload silently kills the narrow hint with no operator
+    // signal at all. Best-effort: a failed stderr write must not throw upward
+    // (hook contract — never crash the host's edit pipeline).
+    try {
+      const message = (e && typeof e === "object" && "message" in e) ? String(e.message) : String(e);
+      process.stderr.write(`[fabric-knowledge-hint-narrow] malformed input: ${message}\n`);
+    } catch {
+      // stderr write itself failed (sandbox / closed fd) — accept silence.
+    }
     return null;
   }
 }