@harness-engineering/cli 2.3.1 → 2.4.0

package/dist/agents/skills/claude-code/harness-compliance/SKILL.md

@@ -123,6 +123,25 @@
 
 ---
 
+### Phase 3.5: INTERNAL COMPLIANCE -- Project Conventions
+
+1. **Verify branch naming convention.** Before creating a branch and again before
+   opening a PR, run `harness verify` (or `harness verify --json` for parsable
+   output) and act on the result -- do not just describe the rule to the user.
+   - Default prefixes: `feat/`, `fix/`, `chore/`, `docs/`, `refactor/`, `test/`, `perf/`
+   - Default slug format: strict `kebab-case` (lowercase, single hyphens, no
+     leading/trailing hyphen), max 60 chars after the prefix
+   - Optional ticket form: `prefix/PROJ-123-short-desc`
+   - Projects may override via `compliance.branching` in `harness.config.json`
+     (`prefixes`, `enforceKebabCase`, `customRegex`, `ignore`, `maxLength`). If
+     `customRegex` is set, it fully replaces the prefix/kebab/length checks --
+     read the project config before suggesting a branch name.
+   - On a non-compliant branch, surface the suggested fix from `harness verify`
+     to the user and offer to rename (`git branch -m <new-name>`) before
+     continuing. Do not push or open a PR from a non-compliant branch.
+
+---
+
 ### Phase 4: REPORT -- Generate Gap Analysis and Remediation Plan
 
 1. **Score compliance posture per framework.** For each applicable framework:

package/dist/agents/skills/codex/harness-compliance/SKILL.md

@@ -123,6 +123,25 @@
 
 ---
 
+### Phase 3.5: INTERNAL COMPLIANCE -- Project Conventions
+
+1. **Verify branch naming convention.** Before creating a branch and again before
+   opening a PR, run `harness verify` (or `harness verify --json` for parsable
+   output) and act on the result -- do not just describe the rule to the user.
+   - Default prefixes: `feat/`, `fix/`, `chore/`, `docs/`, `refactor/`, `test/`, `perf/`
+   - Default slug format: strict `kebab-case` (lowercase, single hyphens, no
+     leading/trailing hyphen), max 60 chars after the prefix
+   - Optional ticket form: `prefix/PROJ-123-short-desc`
+   - Projects may override via `compliance.branching` in `harness.config.json`
+     (`prefixes`, `enforceKebabCase`, `customRegex`, `ignore`, `maxLength`). If
+     `customRegex` is set, it fully replaces the prefix/kebab/length checks --
+     read the project config before suggesting a branch name.
+   - On a non-compliant branch, surface the suggested fix from `harness verify`
+     to the user and offer to rename (`git branch -m <new-name>`) before
+     continuing. Do not push or open a PR from a non-compliant branch.
+
+---
+
 ### Phase 4: REPORT -- Generate Gap Analysis and Remediation Plan
 
 1. **Score compliance posture per framework.** For each applicable framework:

package/dist/agents/skills/cursor/harness-compliance/SKILL.md

@@ -123,6 +123,25 @@
 
 ---
 
+### Phase 3.5: INTERNAL COMPLIANCE -- Project Conventions
+
+1. **Verify branch naming convention.** Before creating a branch and again before
+   opening a PR, run `harness verify` (or `harness verify --json` for parsable
+   output) and act on the result -- do not just describe the rule to the user.
+   - Default prefixes: `feat/`, `fix/`, `chore/`, `docs/`, `refactor/`, `test/`, `perf/`
+   - Default slug format: strict `kebab-case` (lowercase, single hyphens, no
+     leading/trailing hyphen), max 60 chars after the prefix
+   - Optional ticket form: `prefix/PROJ-123-short-desc`
+   - Projects may override via `compliance.branching` in `harness.config.json`
+     (`prefixes`, `enforceKebabCase`, `customRegex`, `ignore`, `maxLength`). If
+     `customRegex` is set, it fully replaces the prefix/kebab/length checks --
+     read the project config before suggesting a branch name.
+   - On a non-compliant branch, surface the suggested fix from `harness verify`
+     to the user and offer to rename (`git branch -m <new-name>`) before
+     continuing. Do not push or open a PR from a non-compliant branch.
+
+---
+
 ### Phase 4: REPORT -- Generate Gap Analysis and Remediation Plan
 
 1. **Score compliance posture per framework.** For each applicable framework:

package/dist/agents/skills/gemini-cli/harness-compliance/SKILL.md

@@ -123,6 +123,25 @@
 
 ---
 
+### Phase 3.5: INTERNAL COMPLIANCE -- Project Conventions
+
+1. **Verify branch naming convention.** Before creating a branch and again before
+   opening a PR, run `harness verify` (or `harness verify --json` for parsable
+   output) and act on the result -- do not just describe the rule to the user.
+   - Default prefixes: `feat/`, `fix/`, `chore/`, `docs/`, `refactor/`, `test/`, `perf/`
+   - Default slug format: strict `kebab-case` (lowercase, single hyphens, no
+     leading/trailing hyphen), max 60 chars after the prefix
+   - Optional ticket form: `prefix/PROJ-123-short-desc`
+   - Projects may override via `compliance.branching` in `harness.config.json`
+     (`prefixes`, `enforceKebabCase`, `customRegex`, `ignore`, `maxLength`). If
+     `customRegex` is set, it fully replaces the prefix/kebab/length checks --
+     read the project config before suggesting a branch name.
+   - On a non-compliant branch, surface the suggested fix from `harness verify`
+     to the user and offer to rename (`git branch -m <new-name>`) before
+     continuing. Do not push or open a PR from a non-compliant branch.
+
+---
+
 ### Phase 4: REPORT -- Generate Gap Analysis and Remediation Plan
 
 1. **Score compliance posture per framework.** For each applicable framework:

package/dist/{agents-md-5JG3AE5A.js → agents-md-ROTDQOXM.js}

@@ -1,7 +1,7 @@
 import {
   generateAgentsMd
-} from "./chunk-IYA3NS5P.js";
-import "./chunk-YNG7BWGB.js";
+} from "./chunk-FJJYQWUP.js";
+import "./chunk-GDJ2MRYH.js";
 import "./chunk-RL4VMEXL.js";
 import "./chunk-XPRGWHBL.js";
 import "./chunk-KFQGP6VL.js";

package/dist/{architecture-544ISXDI.js → architecture-I2G7PNQB.js}

@@ -1,11 +1,11 @@
 import {
   checkDependenciesDefinition,
   handleCheckDependencies
-} from "./chunk-J4MX5DIA.js";
-import "./chunk-2564TBT6.js";
+} from "./chunk-NGCM4B4V.js";
+import "./chunk-OFMQEUYN.js";
 import "./chunk-EPUKTTJZ.js";
 import "./chunk-W6Y7ZW3Y.js";
-import "./chunk-YNG7BWGB.js";
+import "./chunk-GDJ2MRYH.js";
 import "./chunk-RL4VMEXL.js";
 import "./chunk-XPRGWHBL.js";
 import "./chunk-KFQGP6VL.js";

package/dist/{assess-project-PBO6XFJC.js → assess-project-LO6NCLE7.js}

@@ -1,7 +1,7 @@
 import {
   assessProjectDefinition,
   handleAssessProject
-} from "./chunk-TIJXG4UB.js";
+} from "./chunk-WY2J54IZ.js";
 import "./chunk-W6Y7ZW3Y.js";
 import "./chunk-KFQGP6VL.js";
 export {

package/dist/bin/harness-mcp.js

@@ -1,27 +1,27 @@
 #!/usr/bin/env node
 import {
   startServer
-} from "../chunk-A36MGB3V.js";
-import "../chunk-LYMPKO6N.js";
-import "../chunk-TIJXG4UB.js";
+} from "../chunk-Q43LM7CO.js";
+import "../chunk-RZASDABE.js";
+import "../chunk-WY2J54IZ.js";
 import "../chunk-IOW3MW2K.js";
-import "../chunk-R6GLLMRZ.js";
-import "../chunk-EMJFHTPZ.js";
+import "../chunk-4XB37LST.js";
+import "../chunk-GN2CSZC6.js";
 import "../chunk-TIQU5VY7.js";
-import "../chunk-QZ67TDLJ.js";
-import "../chunk-J4MX5DIA.js";
-import "../chunk-2564TBT6.js";
-import "../chunk-22OKI5QI.js";
-import "../chunk-YI6NTL72.js";
-import "../chunk-KJR4Z2YC.js";
+import "../chunk-2L2A6W6I.js";
+import "../chunk-NGCM4B4V.js";
+import "../chunk-OFMQEUYN.js";
+import "../chunk-MQRKPF46.js";
+import "../chunk-27EHWQPK.js";
+import "../chunk-U4XK4BB3.js";
 import "../chunk-EPUKTTJZ.js";
 import "../chunk-W6Y7ZW3Y.js";
 import "../chunk-27AJKSQY.js";
-import "../chunk-DBJC4ULT.js";
+import "../chunk-KPWUZSHL.js";
 import "../chunk-3ISINLYT.js";
 import "../chunk-6B6UN6SG.js";
 import "../chunk-ZCZD7FHU.js";
-import "../chunk-YNG7BWGB.js";
+import "../chunk-GDJ2MRYH.js";
 import "../chunk-RL4VMEXL.js";
 import "../chunk-XPRGWHBL.js";
 import "../chunk-HIK6OEUF.js";

package/dist/bin/harness.js

@@ -3,43 +3,43 @@ import {
   createProgram,
   installCommandTelemetry,
   printFirstRunWelcome
-} from "../chunk-N6DVSOLZ.js";
-import "../chunk-WMZKZCCE.js";
-import "../chunk-IYA3NS5P.js";
-import "../chunk-DHWFOHPX.js";
-import "../chunk-T2ZMHXCX.js";
-import "../chunk-JMACX5FN.js";
+} from "../chunk-TCR5PKMU.js";
+import "../chunk-TVJZX53C.js";
+import "../chunk-FJJYQWUP.js";
+import "../chunk-DJRRTZGD.js";
+import "../chunk-MSBVH6ER.js";
+import "../chunk-54JTO4NZ.js";
 import "../chunk-CQ553GZO.js";
 import "../chunk-GISMXMVL.js";
 import "../chunk-WWACIIBA.js";
 import "../chunk-TEFCFC4H.js";
-import "../chunk-U2SF3KAQ.js";
-import "../chunk-LBYGGNEZ.js";
+import "../chunk-5YOHXTK3.js";
+import "../chunk-RYVL76ZF.js";
 import "../chunk-KET4QQZB.js";
-import "../chunk-KT5PWWWO.js";
+import "../chunk-JGPOQJ73.js";
 import "../chunk-7BNK4M23.js";
 import {
   dispatchSkillsFromGit
-} from "../chunk-A36MGB3V.js";
-import "../chunk-LYMPKO6N.js";
-import "../chunk-TIJXG4UB.js";
+} from "../chunk-Q43LM7CO.js";
+import "../chunk-RZASDABE.js";
+import "../chunk-WY2J54IZ.js";
 import "../chunk-IOW3MW2K.js";
-import "../chunk-R6GLLMRZ.js";
-import "../chunk-EMJFHTPZ.js";
+import "../chunk-4XB37LST.js";
+import "../chunk-GN2CSZC6.js";
 import "../chunk-TIQU5VY7.js";
-import "../chunk-QZ67TDLJ.js";
-import "../chunk-J4MX5DIA.js";
-import "../chunk-2564TBT6.js";
-import "../chunk-22OKI5QI.js";
-import "../chunk-YI6NTL72.js";
-import "../chunk-KJR4Z2YC.js";
+import "../chunk-2L2A6W6I.js";
+import "../chunk-NGCM4B4V.js";
+import "../chunk-OFMQEUYN.js";
+import "../chunk-MQRKPF46.js";
+import "../chunk-27EHWQPK.js";
+import "../chunk-U4XK4BB3.js";
 import "../chunk-EPUKTTJZ.js";
 import "../chunk-W6Y7ZW3Y.js";
 import "../chunk-27AJKSQY.js";
 import {
   findConfigFile,
   loadConfig
-} from "../chunk-DBJC4ULT.js";
+} from "../chunk-KPWUZSHL.js";
 import "../chunk-3ISINLYT.js";
 import "../chunk-6B6UN6SG.js";
 import "../chunk-ZCZD7FHU.js";
@@ -53,7 +53,7 @@ import {
   readCheckState,
   shouldRunCheck,
   spawnBackgroundCheck
-} from "../chunk-YNG7BWGB.js";
+} from "../chunk-GDJ2MRYH.js";
 import "../chunk-RL4VMEXL.js";
 import "../chunk-XPRGWHBL.js";
 import "../chunk-ZP5E7YET.js";

package/dist/{check-phase-gate-BZU4DGF3.js → check-phase-gate-52SQFNJB.js}

@@ -1,10 +1,10 @@
 import {
   createCheckPhaseGateCommand,
   runCheckPhaseGate
-} from "./chunk-U2SF3KAQ.js";
-import "./chunk-DBJC4ULT.js";
+} from "./chunk-5YOHXTK3.js";
+import "./chunk-KPWUZSHL.js";
 import "./chunk-ZCZD7FHU.js";
-import "./chunk-YNG7BWGB.js";
+import "./chunk-GDJ2MRYH.js";
 import "./chunk-RL4VMEXL.js";
 import "./chunk-XPRGWHBL.js";
 import "./chunk-EBJQ6N4M.js";

package/dist/{chunk-YI6NTL72.js → chunk-27EHWQPK.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-W6Y7ZW3Y.js";
 import {
   init_dist
-} from "./chunk-YNG7BWGB.js";
+} from "./chunk-GDJ2MRYH.js";
 import {
   Ok
 } from "./chunk-RL4VMEXL.js";
@@ -127,7 +127,7 @@ function buildSummaryResponse(report) {
 }
 async function handleDetectEntropy(input) {
   try {
-    const { EntropyAnalyzer } = await import("./dist-ZS3Y3YWP.js");
+    const { EntropyAnalyzer } = await import("./dist-ZJGFXGIB.js");
     const typeFilter = input.type ?? "all";
     const analyzer = new EntropyAnalyzer({
       rootDir: sanitizePath(input.path),
@@ -146,7 +146,7 @@ async function handleDetectEntropy(input) {
       return resultToMcpResponse(result);
     }
     if (!result.ok) return resultToMcpResponse(result);
-    const { createFixes, applyFixes, generateSuggestions } = await import("./dist-ZS3Y3YWP.js");
+    const { createFixes, applyFixes, generateSuggestions } = await import("./dist-ZJGFXGIB.js");
     const report = result.value;
     const deadCode = report.deadCode;
     const fixTypesConfig = input.fixTypes ? { fixTypes: input.fixTypes } : void 0;

package/dist/{chunk-QZ67TDLJ.js → chunk-2L2A6W6I.js}

@@ -1,6 +1,6 @@
 import {
   resolveProjectConfig
-} from "./chunk-2564TBT6.js";
+} from "./chunk-OFMQEUYN.js";
 import {
   sanitizePath
 } from "./chunk-W6Y7ZW3Y.js";
@@ -49,7 +49,7 @@ async function handleValidateProject(input) {
   checks.config = "pass";
   const config = configResult.value;
   try {
-    const core = await import("./dist-ZS3Y3YWP.js");
+    const core = await import("./dist-ZJGFXGIB.js");
     if (typeof core.validateFileStructure === "function" && Array.isArray(config.conventions)) {
       const conventions = config.conventions;
       const structureResult = await core.validateFileStructure(projectPath, conventions);
@@ -68,7 +68,7 @@ async function handleValidateProject(input) {
   } catch {
   }
   try {
-    const core = await import("./dist-ZS3Y3YWP.js");
+    const core = await import("./dist-ZJGFXGIB.js");
     if (typeof core.validateAgentsMap === "function") {
       const agentsMapPath = path.join(projectPath, "AGENTS.md");
       const agentsResult = await core.validateAgentsMap(agentsMapPath);

package/dist/{chunk-R6GLLMRZ.js → chunk-4XB37LST.js}

@@ -33,7 +33,7 @@ var createSelfReviewDefinition = {
 };
 async function handleCreateSelfReview(input) {
   try {
-    const { parseDiff, createSelfReview } = await import("./dist-ZS3Y3YWP.js");
+    const { parseDiff, createSelfReview } = await import("./dist-ZJGFXGIB.js");
     const parseResult = parseDiff(input.diff);
     if (!parseResult.ok) {
       return resultToMcpResponse(parseResult);
@@ -119,7 +119,7 @@ var analyzeDiffDefinition = {
 };
 async function handleAnalyzeDiff(input) {
   try {
-    const { parseDiff, analyzeDiff } = await import("./dist-ZS3Y3YWP.js");
+    const { parseDiff, analyzeDiff } = await import("./dist-ZJGFXGIB.js");
     const parseResult = parseDiff(input.diff);
     if (!parseResult.ok) {
       return resultToMcpResponse(parseResult);
@@ -195,7 +195,7 @@ var requestPeerReviewDefinition = {
 };
 async function handleRequestPeerReview(input) {
   try {
-    const { parseDiff, requestPeerReview } = await import("./dist-ZS3Y3YWP.js");
+    const { parseDiff, requestPeerReview } = await import("./dist-ZJGFXGIB.js");
     const parseResult = parseDiff(input.diff);
     if (!parseResult.ok) {
       return resultToMcpResponse(parseResult);

package/dist/{chunk-JMACX5FN.js → chunk-54JTO4NZ.js}

@@ -1,6 +1,6 @@
 import {
   init_dist
-} from "./chunk-YNG7BWGB.js";
+} from "./chunk-GDJ2MRYH.js";
 import {
   Err,
   Ok

package/dist/{chunk-U2SF3KAQ.js → chunk-5YOHXTK3.js}

@@ -1,9 +1,9 @@
 import {
   resolveConfig
-} from "./chunk-DBJC4ULT.js";
+} from "./chunk-KPWUZSHL.js";
 import {
   init_dist
-} from "./chunk-YNG7BWGB.js";
+} from "./chunk-GDJ2MRYH.js";
 import {
   Ok
 } from "./chunk-RL4VMEXL.js";

package/dist/{chunk-DHWFOHPX.js → chunk-DJRRTZGD.js}

@@ -1,6 +1,6 @@
 import {
   init_dist
-} from "./chunk-YNG7BWGB.js";
+} from "./chunk-GDJ2MRYH.js";
 import {
   Err,
   Ok

package/dist/{chunk-IYA3NS5P.js → chunk-FJJYQWUP.js}

@@ -1,6 +1,6 @@
 import {
   init_dist
-} from "./chunk-YNG7BWGB.js";
+} from "./chunk-GDJ2MRYH.js";
 import {
   Err,
   Ok

package/dist/{chunk-YNG7BWGB.js → chunk-GDJ2MRYH.js}

@@ -3263,6 +3263,7 @@ __export(dist_exports, {
   validateAgentConfigs: () => validateAgentConfigs,
   validateAgentsMap: () => validateAgentsMap,
   validateBoundaries: () => validateBoundaries,
+  validateBranchName: () => validateBranchName,
   validateCommitMessage: () => validateCommitMessage,
   validateConfig: () => validateConfig,
   validateDependencies: () => validateDependencies,
@@ -3320,6 +3321,7 @@ import { join as join12 } from "path";
 import * as fs3 from "fs";
 import * as path3 from "path";
 import { minimatch as minimatch2 } from "minimatch";
+import { minimatch as minimatch22 } from "minimatch";
 import { basename as basename2 } from "path";
 import { join as join14, basename as basename3 } from "path";
 import { basename as basename4, dirname as dirname42 } from "path";
@@ -3327,11 +3329,11 @@ import { z as z3 } from "zod";
 import * as fs4 from "fs/promises";
 import * as fs5 from "fs/promises";
 import { resolve as resolve5 } from "path";
-import { minimatch as minimatch22 } from "minimatch";
+import { minimatch as minimatch3 } from "minimatch";
 import { join as join15, resolve as resolve42 } from "path";
 import { dirname as dirname5, resolve as resolve6 } from "path";
 import { dirname as dirname6, extname as extname2, resolve as resolve7 } from "path";
-import { minimatch as minimatch3 } from "minimatch";
+import { minimatch as minimatch4 } from "minimatch";
 import { readdirSync, statSync as statSync2 } from "fs";
 import { join as join16 } from "path";
 import * as fs6 from "fs";
@@ -3396,7 +3398,7 @@ import * as fs26 from "fs";
 import * as path23 from "path";
 import { z as z9 } from "zod";
 import * as fs28 from "fs/promises";
-import { minimatch as minimatch4 } from "minimatch";
+import { minimatch as minimatch5 } from "minimatch";
 import { z as z10 } from "zod";
 import * as fs27 from "fs";
 import * as path24 from "path";
@@ -4807,6 +4809,75 @@ function validateRoadmapMode(config, projectRoot) {
   }
   return Ok(void 0);
 }
+function validateBranchName(branchName, config) {
+  for (const pattern of config.ignore) {
+    if (minimatch2(branchName, pattern)) {
+      return { valid: true, branchName };
+    }
+  }
+  if (config.customRegex) {
+    const regex = new RegExp(config.customRegex);
+    if (!regex.test(branchName)) {
+      return {
+        valid: false,
+        branchName,
+        message: `Branch name "${branchName}" does not match the custom regex: ${config.customRegex}`
+      };
+    }
+    return { valid: true, branchName };
+  }
+  const parts = branchName.split("/");
+  if (parts.length < 2) {
+    return {
+      valid: false,
+      branchName,
+      message: `Branch name "${branchName}" must have a prefix followed by a slash (e.g., "feat/my-feature").`,
+      suggestion: `Try renaming to "feat/${branchName}" or "fix/${branchName}".`
+    };
+  }
+  const prefix = parts[0];
+  const slug = parts.slice(1).join("/");
+  if (!config.prefixes.includes(prefix)) {
+    return {
+      valid: false,
+      branchName,
+      message: `Prefix "${prefix}" is not allowed.`,
+      suggestion: `Allowed prefixes: ${config.prefixes.join(", ")}.`
+    };
+  }
+  if (config.enforceKebabCase) {
+    for (const part of slug.split("/")) {
+      const ticketMatch = part.match(TICKET_ID);
+      if (ticketMatch) {
+        const rest = ticketMatch[2];
+        if (rest && !KEBAB_CASE.test(rest)) {
+          return {
+            valid: false,
+            branchName,
+            message: `Branch slug part "${part}" does not follow kebab-case after the ticket ID.`,
+            suggestion: `Ensure the description after "${ticketMatch[1]}" uses kebab-case (lowercase, single hyphens, no leading/trailing hyphen).`
+          };
+        }
+      } else if (!KEBAB_CASE.test(part)) {
+        return {
+          valid: false,
+          branchName,
+          message: `Branch slug part "${part}" must be in kebab-case (lowercase, single hyphens, no leading/trailing hyphen).`,
+          suggestion: `Change "${part}" to match the convention.`
+        };
+      }
+    }
+  }
+  if (typeof config.maxLength === "number" && config.maxLength > 0 && slug.length > config.maxLength) {
+    return {
+      valid: false,
+      branchName,
+      message: `Branch slug is ${slug.length} characters; max allowed is ${config.maxLength}.`,
+      suggestion: `Shorten the description after "${prefix}/" to ${config.maxLength} characters or fewer.`
+    };
+  }
+  return { valid: true, branchName };
+}
 function determineImportance(filePath) {
   const name = basename2(filePath).toLowerCase();
   if (name === "index.ts" || name === "index.js" || name === "main.ts") {
@@ -4848,7 +4919,7 @@ async function checkDocCoverage(domain, options = {}) {
     const filteredSourceFiles = sourceFiles.filter((file) => {
       const relativePath = relativePosix(sourceDir, file);
       return !excludePatterns.some((pattern) => {
-        return minimatch2(relativePath, pattern, { dot: true }) || minimatch2(file, pattern, { dot: true });
+        return minimatch22(relativePath, pattern, { dot: true }) || minimatch22(file, pattern, { dot: true });
       });
     });
     const docFiles = await findFiles("**/*.md", docsDir);
@@ -6293,7 +6364,7 @@ async function buildSnapshot2(config) {
   }
   sourceFilePaths = sourceFilePaths.filter((f) => {
     const rel = relativePosix(rootDir, f);
-    return !excludePatterns.some((p) => minimatch22(rel, p));
+    return !excludePatterns.some((p) => minimatch3(rel, p));
   });
   const files = [];
   for (const filePath of sourceFilePaths) {
@@ -6884,7 +6955,7 @@ async function detectDeadCode(snapshot, graphDeadCodeData, protectedRegions) {
 }
 function fileMatchesPattern(filePath, pattern, rootDir) {
   const relativePath = relativePosix(rootDir, filePath);
-  return minimatch3(relativePath, pattern);
+  return minimatch4(relativePath, pattern);
 }
 function checkMustExport(rule, file, message) {
   if (rule.type !== "must-export") return [];
@@ -15596,7 +15667,7 @@ function assembleCandidateReport(input) {
   }
   return lines.join("\n");
 }
-var WHATWG_BAD_PORTS, BAD_PORT_SET, VALID_TYPES, CONVENTIONAL_PATTERN, LOOKBACK_PATTERN, PulseDbSourceSchema, PulseSourcesSchema, PulseConfigSchema, BUG_TRACK_CATEGORIES, KNOWLEDGE_TRACK_CATEGORIES, ALL_SOLUTION_CATEGORIES, ISO_DATE, BugTrackSchema, KnowledgeTrackSchema, BaseFrontmatter, SolutionDocFrontmatterSchema, TRACK_CATEGORIES, DEFAULT_AGNIX_TIMEOUT_MS, HARNESS_AGNIX_DISABLE, HARNESS_AGNIX_BIN, CLAUDE_MD_WARN_BYTES, CLAUDE_MD_ERROR_BYTES, CONTEXT_FILES, MIN_DESCRIPTION_LENGTH, SETTINGS_PATHS, KNOWN_HOOK_EVENTS, MCP_SETTINGS_FILES, REQUIRED_SECTIONS, SETTINGS_FILES, KNOWN_AGNIX_TOOLS, DEFAULT_SECTIONS, DEFAULT_RATIOS, NODE_TYPE_TO_CATEGORY, SECTION_LEVEL_MAP, DEFAULT_LEVEL, DEFAULT_BUDGET, DEFAULT_LOADER_CONFIG, LEVEL_FRACTIONS, PHASE_PRIORITIES, ManifestSchema, BundleConstraintsSchema, BundleSchema, ContributionsSchema, LockfilePackageSchema, LockfileSchema, SharableLayerSchema, SharableForbiddenImportSchema, SharableBoundaryConfigSchema, SharableSecurityRulesSchema, VALID_SCOPES, LINE_PATTERN, START_PATTERN, END_PATTERN, TS_HINTS, TS_CONVENTIONS, PYTHON_HINTS, PYTHON_CONVENTIONS, DEFAULT_INCLUDE_PATTERNS, CODE_BLOCK_LANGUAGES, DEFAULT_DRIFT_CONFIG, JS_EXT_FALLBACKS2, FILE_TYPES, EXPORT_TYPES, CONVENTION_DESCRIPTIONS, RULE_CHECKERS, EntropyAnalyzer, readFile62, writeFile32, unlink22, mkdir22, copyFile2, DEFAULT_FIX_CONFIG, EXPORT_TYPE_KEYWORD, ALWAYS_UNSAFE_TYPES, idCounter, DEAD_CODE_FIX_ACTIONS, MustExportRuleSchema, MustExportDefaultRuleSchema, NoExportRuleSchema, MustImportRuleSchema, NoImportRuleSchema, NamingRuleSchema, MaxExportsRuleSchema, MaxLinesRuleSchema, RequireJSDocRuleSchema, RuleSchema, ConfigPatternSchema, PatternConfigSchema, DriftConfigSchema, DeadCodeConfigSchema, EntropyConfigSchema, BaselineManager, BenchmarkRunner, RegressionDetector, SOURCE_EXTENSIONS, FUNCTION_DECL_RE, CONST_DECL_RE, CriticalPathResolver, NoOpTelemetryAdapter, NoOpExecutor, ConsoleSink, feedbackConfig, ChecklistBuilder, AgentActionEmitter, globalEmitter, FileSink, NoOpSink, CategorySnapshotSchema, TimelineSnapshotSchema, TimelineFileSchema, TrendLineSchema, TrendResultSchema, DEFAULT_STABILITY_THRESHOLDS, ALL_CATEGORIES, TimelineManager, ConfidenceTierSchema, RegressionResultSchema, DirectionSchema, CategoryForecastSchema, SpecImpactSignalsSchema, SpecImpactEstimateSchema, ContributingFeatureSchema, AdjustedForecastSchema, PredictionWarningSchema, StabilityForecastSchema, PredictionResultSchema, PredictionOptionsSchema, VALID_STATUSES, EM_DASH, VALID_PRIORITIES, ALL_CATEGORIES2, DIRECTION_THRESHOLD, PredictionEngine, DEFAULT_COEFFICIENTS, SpecImpactEstimator, EMPTY_HISTORY, ViolationHistoryManager, NORMALIZERS, MAX_SAMPLES, DEFAULT_WINDOW_WEEKS, DEFAULT_MIN_OCCURRENCES, FailureEntrySchema, HandoffSchema, GateCheckSchema, GateResultSchema, GateConfigSchema, HarnessStateSchema, DEFAULT_STATE, StreamInfoSchema, StreamIndexSchema, DEFAULT_STREAM_INDEX, HARNESS_DIR, STATE_FILE, LEARNINGS_FILE, FAILURES_FILE, HANDOFF_FILE, GATE_CONFIG_FILE, INDEX_FILE, SESSIONS_DIR, SESSION_INDEX_FILE, SUMMARY_FILE, SESSION_STATE_FILE, ARCHIVE_DIR, CONTENT_HASHES_FILE, EVENTS_FILE, STREAMS_DIR, STREAM_NAME_REGEX, branchCache, BRANCH_CACHE_TTL_MS, STATE_FILES, MAX_CACHE_ENTRIES, learningsCacheMap, WEIGHTS, LOCK_RETRIES, LOCK_BACKOFFS, PROMOTABLE_OUTCOMES, failuresCacheMap, FAILURE_LINE_REGEX, SAFE_GATE_COMMAND, SkillEventSchema, knownHashesCache, EVENT_FORMATTERS, RuleRegistry, DEFAULT_SECURITY_CONFIG, RuleOverrideSchema, SecurityConfigSchema, secretRules, injectionRules, xssRules, cryptoRules, pathTraversalRules, networkRules, deserializationRules, agentConfigRules, mcpRules, insecureDefaultsRules, sharpEdgesRules, nodeRules, expressRules, reactRules, goRules, SecurityScanner, hiddenUnicodePatterns, reRolingPatterns, permissionEscalationPatterns, encodedPayloadPatterns, indirectInjectionPatterns, contextManipulationPatterns, socialEngineeringPatterns, suspiciousPatterns, ALL_PATTERNS, DESTRUCTIVE_BASH, TAINT_DURATION_MS, DEFAULT_SESSION_ID, SecurityCategorySnapshotSchema, SupplyChainSnapshotSchema, SecurityTimelineSnapshotSchema, FindingLifecycleSchema, SecurityTimelineFileSchema, DirectionSchema2, SecurityTrendLineSchema, TrendAttributionSchema, SecurityTrendResultSchema, TimeToFixStatsSchema, TimeToFixResultSchema, EMPTY_SUPPLY_CHAIN, SecurityTimelineManager, ALL_CHECKS, STATUS_ICONS, CINotifier, ExclusionSet, PREFIX_PATTERNS, TEST_FILE_PATTERN, MD_FILE_PATTERN, ALL_DOMAINS, SECURITY_PATTERNS, JS_EXT_FALLBACKS22, SEVERITY_RANK, SEVERITY_ORDER, SEVERITY_LABELS, VALIDATED_BY_RANK, VALIDATION_SCORES, DOMAIN_BASELINES, FACTOR_WEIGHTS, EVIDENCE_SATURATION, CORROBORATED_AGREEMENT, STANDALONE_AGREEMENT, AGREEMENT_LINE_GAP, COMPLIANCE_DESCRIPTOR, EXPORT_RE, BUG_DETECTION_DESCRIPTOR, SECURITY_DESCRIPTOR, EVAL_PATTERN, SECRET_PATTERNS, SQL_CONCAT_PATTERN, SHELL_EXEC_PATTERN, ARCHITECTURE_DESCRIPTOR, LARGE_FILE_THRESHOLD, VIOLATION_FILE_RE, LEARNINGS_DESCRIPTOR, RELEVANCE_THRESHOLD, AGENT_DESCRIPTORS, AGENT_RUNNERS, DOWNGRADE_MAP, DEFAULT_PROVIDER_TIERS, SMALL_SUGGESTION_LINE_LIMIT, FILE_LINE_RANGE_PATTERN, FILE_LINE_PATTERN, FILE_ONLY_PATTERN, SECURITY_SENSITIVE_PATH, MIGRATION_PATH, TEST_PATH, CONFIG_PATH, STAGE_DOMAINS, EM_DASH2, STATUS_RANK, RETRY_DEFAULTS, GitHubIssuesSyncAdapter, syncMutex, PRIORITY_RANK, PRIORITY_RANK2, POSITION_WEIGHT, DEPENDENTS_WEIGHT, AFFINITY_WEIGHT, ConflictError, DEFAULTS, GitHubHttp, ETagStore, START_MARKER, END_MARKER, SERIALIZER_FIELDS, GitHubIssuesTrackerAdapter, migrate_exports, HASH_RE, InteractionTypeSchema, QuestionSchema, ConfirmationSchema, TransitionSchema, EmitInteractionInputSchema, ProjectScanner, SHELL_TEMPLATE, STYLES, SCRIPTS, MockLLMService, llmService, ContentPipeline, BlueprintGenerator, TOKENS_PER_MILLION, fallback_default, LITELLM_PRICING_URL, CACHE_TTL_MS, STALENESS_WARNING_DAYS, MICRODOLLARS_PER_DOLLAR, TOKENS_PER_MILLION2, StructuralStrategy, DEFAULT_TOKEN_BUDGET, CHARS_PER_TOKEN, TRUNCATION_MARKER, TruncationStrategy, CompactionPipeline, STABILITY_LOOKUP, TIER_ORDER, AnthropicCacheAdapter, TIER_ORDER2, OpenAICacheAdapter, TIER_ORDER3, CACHED_CONTENT_MARKER, GeminiCacheAdapter, VERSION, POSTHOG_BATCH_URL, MAX_ATTEMPTS, TIMEOUT_MS, CompoundLockHeldError, KNOWN_CATEGORIES, ALLOWED_FIELD_KEYS, PII_TOKENS, PII_FIELD_DENYLIST, PII_LINE_RE, ALLOWED_SET, PulseAdapterAlreadyRegisteredError, REGISTRY, MOCK_ADAPTER_NAME, ALLOWED_FIELD_SET, adapter, LOOKBACK_RE, MAX_LINES, INLINE_TEMPLATE, TRUNCATION_MARKER2, execFileAsync, FIX_RE, EMPTY_REPO_RE, execFileAsync2, TRACK_CATEGORIES2, STOPWORDS, KEYWORD_TO_CATEGORY;
+var WHATWG_BAD_PORTS, BAD_PORT_SET, VALID_TYPES, CONVENTIONAL_PATTERN, LOOKBACK_PATTERN, PulseDbSourceSchema, PulseSourcesSchema, PulseConfigSchema, BUG_TRACK_CATEGORIES, KNOWLEDGE_TRACK_CATEGORIES, ALL_SOLUTION_CATEGORIES, ISO_DATE, BugTrackSchema, KnowledgeTrackSchema, BaseFrontmatter, SolutionDocFrontmatterSchema, TRACK_CATEGORIES, DEFAULT_AGNIX_TIMEOUT_MS, HARNESS_AGNIX_DISABLE, HARNESS_AGNIX_BIN, CLAUDE_MD_WARN_BYTES, CLAUDE_MD_ERROR_BYTES, CONTEXT_FILES, MIN_DESCRIPTION_LENGTH, SETTINGS_PATHS, KNOWN_HOOK_EVENTS, MCP_SETTINGS_FILES, REQUIRED_SECTIONS, SETTINGS_FILES, KNOWN_AGNIX_TOOLS, KEBAB_CASE, TICKET_ID, DEFAULT_SECTIONS, DEFAULT_RATIOS, NODE_TYPE_TO_CATEGORY, SECTION_LEVEL_MAP, DEFAULT_LEVEL, DEFAULT_BUDGET, DEFAULT_LOADER_CONFIG, LEVEL_FRACTIONS, PHASE_PRIORITIES, ManifestSchema, BundleConstraintsSchema, BundleSchema, ContributionsSchema, LockfilePackageSchema, LockfileSchema, SharableLayerSchema, SharableForbiddenImportSchema, SharableBoundaryConfigSchema, SharableSecurityRulesSchema, VALID_SCOPES, LINE_PATTERN, START_PATTERN, END_PATTERN, TS_HINTS, TS_CONVENTIONS, PYTHON_HINTS, PYTHON_CONVENTIONS, DEFAULT_INCLUDE_PATTERNS, CODE_BLOCK_LANGUAGES, DEFAULT_DRIFT_CONFIG, JS_EXT_FALLBACKS2, FILE_TYPES, EXPORT_TYPES, CONVENTION_DESCRIPTIONS, RULE_CHECKERS, EntropyAnalyzer, readFile62, writeFile32, unlink22, mkdir22, copyFile2, DEFAULT_FIX_CONFIG, EXPORT_TYPE_KEYWORD, ALWAYS_UNSAFE_TYPES, idCounter, DEAD_CODE_FIX_ACTIONS, MustExportRuleSchema, MustExportDefaultRuleSchema, NoExportRuleSchema, MustImportRuleSchema, NoImportRuleSchema, NamingRuleSchema, MaxExportsRuleSchema, MaxLinesRuleSchema, RequireJSDocRuleSchema, RuleSchema, ConfigPatternSchema, PatternConfigSchema, DriftConfigSchema, DeadCodeConfigSchema, EntropyConfigSchema, BaselineManager, BenchmarkRunner, RegressionDetector, SOURCE_EXTENSIONS, FUNCTION_DECL_RE, CONST_DECL_RE, CriticalPathResolver, NoOpTelemetryAdapter, NoOpExecutor, ConsoleSink, feedbackConfig, ChecklistBuilder, AgentActionEmitter, globalEmitter, FileSink, NoOpSink, CategorySnapshotSchema, TimelineSnapshotSchema, TimelineFileSchema, TrendLineSchema, TrendResultSchema, DEFAULT_STABILITY_THRESHOLDS, ALL_CATEGORIES, TimelineManager, ConfidenceTierSchema, RegressionResultSchema, DirectionSchema, CategoryForecastSchema, SpecImpactSignalsSchema, SpecImpactEstimateSchema, ContributingFeatureSchema, AdjustedForecastSchema, PredictionWarningSchema, StabilityForecastSchema, PredictionResultSchema, PredictionOptionsSchema, VALID_STATUSES, EM_DASH, VALID_PRIORITIES, ALL_CATEGORIES2, DIRECTION_THRESHOLD, PredictionEngine, DEFAULT_COEFFICIENTS, SpecImpactEstimator, EMPTY_HISTORY, ViolationHistoryManager, NORMALIZERS, MAX_SAMPLES, DEFAULT_WINDOW_WEEKS, DEFAULT_MIN_OCCURRENCES, FailureEntrySchema, HandoffSchema, GateCheckSchema, GateResultSchema, GateConfigSchema, HarnessStateSchema, DEFAULT_STATE, StreamInfoSchema, StreamIndexSchema, DEFAULT_STREAM_INDEX, HARNESS_DIR, STATE_FILE, LEARNINGS_FILE, FAILURES_FILE, HANDOFF_FILE, GATE_CONFIG_FILE, INDEX_FILE, SESSIONS_DIR, SESSION_INDEX_FILE, SUMMARY_FILE, SESSION_STATE_FILE, ARCHIVE_DIR, CONTENT_HASHES_FILE, EVENTS_FILE, STREAMS_DIR, STREAM_NAME_REGEX, branchCache, BRANCH_CACHE_TTL_MS, STATE_FILES, MAX_CACHE_ENTRIES, learningsCacheMap, WEIGHTS, LOCK_RETRIES, LOCK_BACKOFFS, PROMOTABLE_OUTCOMES, failuresCacheMap, FAILURE_LINE_REGEX, SAFE_GATE_COMMAND, SkillEventSchema, knownHashesCache, EVENT_FORMATTERS, RuleRegistry, DEFAULT_SECURITY_CONFIG, RuleOverrideSchema, SecurityConfigSchema, secretRules, injectionRules, xssRules, cryptoRules, pathTraversalRules, networkRules, deserializationRules, agentConfigRules, mcpRules, insecureDefaultsRules, sharpEdgesRules, nodeRules, expressRules, reactRules, goRules, SecurityScanner, hiddenUnicodePatterns, reRolingPatterns, permissionEscalationPatterns, encodedPayloadPatterns, indirectInjectionPatterns, contextManipulationPatterns, socialEngineeringPatterns, suspiciousPatterns, ALL_PATTERNS, DESTRUCTIVE_BASH, TAINT_DURATION_MS, DEFAULT_SESSION_ID, SecurityCategorySnapshotSchema, SupplyChainSnapshotSchema, SecurityTimelineSnapshotSchema, FindingLifecycleSchema, SecurityTimelineFileSchema, DirectionSchema2, SecurityTrendLineSchema, TrendAttributionSchema, SecurityTrendResultSchema, TimeToFixStatsSchema, TimeToFixResultSchema, EMPTY_SUPPLY_CHAIN, SecurityTimelineManager, ALL_CHECKS, STATUS_ICONS, CINotifier, ExclusionSet, PREFIX_PATTERNS, TEST_FILE_PATTERN, MD_FILE_PATTERN, ALL_DOMAINS, SECURITY_PATTERNS, JS_EXT_FALLBACKS22, SEVERITY_RANK, SEVERITY_ORDER, SEVERITY_LABELS, VALIDATED_BY_RANK, VALIDATION_SCORES, DOMAIN_BASELINES, FACTOR_WEIGHTS, EVIDENCE_SATURATION, CORROBORATED_AGREEMENT, STANDALONE_AGREEMENT, AGREEMENT_LINE_GAP, COMPLIANCE_DESCRIPTOR, EXPORT_RE, BUG_DETECTION_DESCRIPTOR, SECURITY_DESCRIPTOR, EVAL_PATTERN, SECRET_PATTERNS, SQL_CONCAT_PATTERN, SHELL_EXEC_PATTERN, ARCHITECTURE_DESCRIPTOR, LARGE_FILE_THRESHOLD, VIOLATION_FILE_RE, LEARNINGS_DESCRIPTOR, RELEVANCE_THRESHOLD, AGENT_DESCRIPTORS, AGENT_RUNNERS, DOWNGRADE_MAP, DEFAULT_PROVIDER_TIERS, SMALL_SUGGESTION_LINE_LIMIT, FILE_LINE_RANGE_PATTERN, FILE_LINE_PATTERN, FILE_ONLY_PATTERN, SECURITY_SENSITIVE_PATH, MIGRATION_PATH, TEST_PATH, CONFIG_PATH, STAGE_DOMAINS, EM_DASH2, STATUS_RANK, RETRY_DEFAULTS, GitHubIssuesSyncAdapter, syncMutex, PRIORITY_RANK, PRIORITY_RANK2, POSITION_WEIGHT, DEPENDENTS_WEIGHT, AFFINITY_WEIGHT, ConflictError, DEFAULTS, GitHubHttp, ETagStore, START_MARKER, END_MARKER, SERIALIZER_FIELDS, GitHubIssuesTrackerAdapter, migrate_exports, HASH_RE, InteractionTypeSchema, QuestionSchema, ConfirmationSchema, TransitionSchema, EmitInteractionInputSchema, ProjectScanner, SHELL_TEMPLATE, STYLES, SCRIPTS, MockLLMService, llmService, ContentPipeline, BlueprintGenerator, TOKENS_PER_MILLION, fallback_default, LITELLM_PRICING_URL, CACHE_TTL_MS, STALENESS_WARNING_DAYS, MICRODOLLARS_PER_DOLLAR, TOKENS_PER_MILLION2, StructuralStrategy, DEFAULT_TOKEN_BUDGET, CHARS_PER_TOKEN, TRUNCATION_MARKER, TruncationStrategy, CompactionPipeline, STABILITY_LOOKUP, TIER_ORDER, AnthropicCacheAdapter, TIER_ORDER2, OpenAICacheAdapter, TIER_ORDER3, CACHED_CONTENT_MARKER, GeminiCacheAdapter, VERSION, POSTHOG_BATCH_URL, MAX_ATTEMPTS, TIMEOUT_MS, CompoundLockHeldError, KNOWN_CATEGORIES, ALLOWED_FIELD_KEYS, PII_TOKENS, PII_FIELD_DENYLIST, PII_LINE_RE, ALLOWED_SET, PulseAdapterAlreadyRegisteredError, REGISTRY, MOCK_ADAPTER_NAME, ALLOWED_FIELD_SET, adapter, LOOKBACK_RE, MAX_LINES, INLINE_TEMPLATE, TRUNCATION_MARKER2, execFileAsync, FIX_RE, EMPTY_REPO_RE, execFileAsync2, TRACK_CATEGORIES2, STOPWORDS, KEYWORD_TO_CATEGORY;
 var init_dist3 = __esm({
   "../core/dist/index.mjs"() {
     init_chunk_4UI65RLE();
@@ -15826,6 +15897,8 @@ var init_dist3 = __esm({
       "kiro",
       "windsurf"
     ]);
+    KEBAB_CASE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+    TICKET_ID = /^([A-Z0-9]+-[0-9]+)-(.*)$/;
     DEFAULT_SECTIONS = [
       {
         name: "Documentation",
@@ -19005,7 +19078,7 @@ var init_dist3 = __esm({
         const applicableRules = this.activeRules.filter((rule) => {
           if (!rule.fileGlob) return true;
           const globs = rule.fileGlob.split(",").map((g) => g.trim());
-          return globs.some((glob5) => minimatch4(filePath, glob5, { dot: true }));
+          return globs.some((glob5) => minimatch5(filePath, glob5, { dot: true }));
         });
         return this.scanLinesWithRules(lines, applicableRules, filePath, startLine);
       }
@@ -21637,6 +21710,7 @@ export {
   validateAgentConfigs,
   getRoadmapMode,
   validateRoadmapMode,
+  validateBranchName,
   checkDocCoverage,
   validateKnowledgeMap,
   generateAgentsMap,

package/dist/{chunk-EMJFHTPZ.js → chunk-GN2CSZC6.js}

@@ -27,7 +27,7 @@ var runSecurityScanDefinition = {
 };
 async function handleRunSecurityScan(input) {
   try {
-    const core = await import("./dist-ZS3Y3YWP.js");
+    const core = await import("./dist-ZJGFXGIB.js");
     const projectRoot = sanitizePath(input.path);
     let configData = {};
     try {
@@ -114,7 +114,7 @@ var getSecurityTrendsDefinition = {
 };
 async function handleGetSecurityTrends(input) {
   try {
-    const core = await import("./dist-ZS3Y3YWP.js");
+    const core = await import("./dist-ZJGFXGIB.js");
     const projectRoot = sanitizePath(input.path);
     const manager = new core.SecurityTimelineManager(projectRoot);
     const trendOptions = {};

package/dist/{chunk-KT5PWWWO.js → chunk-JGPOQJ73.js}

@@ -1,6 +1,6 @@
 import {
   init_dist
-} from "./chunk-YNG7BWGB.js";
+} from "./chunk-GDJ2MRYH.js";
 import {
   Err,
   Ok