@holmes-lab/holmes-kit 0.1.3 → 0.1.4

package/CHANGELOG.md

@@ -5,6 +5,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.4] - 2026-08-18
+
+### Documentation
+- **Supported Languages & Environments Matrix**: Added comprehensive compatibility tables in `README.md` covering 7 AST/CPG supported languages (TypeScript/JS, Python, Go, Rust, Java, C/C++, C#) and tier-based OS environments (macOS, Linux, Windows/WSL2).
+
 ## [0.1.3] - 2026-08-18
 
 ### Added

package/README.md

@@ -88,6 +88,33 @@ If you prefer to configure MCP manually or integrate with other IDEs, add the fo
 
 ---
 
+## 🌐 Supported Languages & Environments
+
+Holmes-Kit embeds native AST & Code Property Graph (D-CPG) analyzers to track causal relationships and anchor implementations across diverse technology stacks.
+
+### 💻 Supported Programming Languages
+| Language | CPG Parser | Anchor Syntax | Dataflow Taint & RTM |
+| :--- | :--- | :--- | :---: |
+| **TypeScript / JavaScript** | Tree-sitter TypeScript/JS | `// @implements A-SPEC-XXX` | ✅ Full Support |
+| **Python** | Tree-sitter Python | `# @implements A-SPEC-XXX` | ✅ Full Support |
+| **Go** | Tree-sitter Go | `// @implements A-SPEC-XXX` | ✅ Full Support |
+| **Rust** | Tree-sitter Rust | `// @implements A-SPEC-XXX` | ✅ Full Support |
+| **Java** | Tree-sitter Java | `// @implements A-SPEC-XXX` | ✅ Full Support |
+| **C / C++** | Tree-sitter C/C++ | `// @implements A-SPEC-XXX` | ✅ Full Support |
+| **C# (.NET)** | Tree-sitter C# | `// @implements A-SPEC-XXX` | ✅ Full Support |
+
+### 🖥️ Supported Operating Systems & Runtimes
+| OS / Platform | Architecture | Status | Notes |
+| :--- | :--- | :---: | :--- |
+| **macOS** | Apple Silicon (arm64) / Intel (x64) | ✅ Tier 1 | macOS 12+ (Full hook enforcement) |
+| **Linux** | x86_64 / arm64 | ✅ Tier 1 | Ubuntu, Debian, Fedora, Arch, RHEL |
+| **Windows (WSL2)** | x86_64 | ✅ Tier 1 | WSL2 Ubuntu/Debian recommended |
+| **Windows Native** | x86_64 | ✅ Tier 2 | Windows 10/11 (Node.js 20+ with C++ build tools) |
+
+> **Runtime Requirement**: Node.js `>= 20.0.0` (LTS recommended)
+
+---
+
 ## 🏛️ Key Capabilities
 
 - **Deterministic Hook Enforcement**: Gating is enforced via OS-level PreToolUse & Stop hooks, not easily bypassed prompts.

package/dist/.build-id

@@ -1 +1 @@
-09e6af7-msxtsdgq
+acd8a7b-msxveq6c

package/dist/holmes/hooks/stop.js

@@ -51,6 +51,7 @@ const test_evidence_1 = require("../review/test-evidence");
 const pre_tool_use_1 = require("./pre-tool-use");
 const governance_history_1 = require("../guardrail/governance-history");
 const constitution_debt_1 = require("../governance/constitution-debt");
+const root_1 = require("../project/root");
 /**
  * @implements A-SPEC-175
  * The turn-boundary answer to "this project is governed but its specs are gone".
@@ -339,7 +340,7 @@ if (require.main === module) {
             // stale record can never vouch for changed code. Absent/stale -> syntactic fallback.
             let executedByAspec;
             try {
-                const head = (0, node_child_process_1.execFileSync)('git', ['rev-parse', 'HEAD'], { cwd: stopProjectRoot(), stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim();
+                const head = (0, node_child_process_1.execFileSync)('git', ['rev-parse', 'HEAD'], { cwd: stopProjectRoot(), stdio: ['ignore', 'pipe', 'ignore'], env: (0, root_1.cleanSubprocessEnv)() }).toString().trim();
                 const ev = (0, test_evidence_1.readTestEvidence)(stopProjectRoot());
                 if ((0, test_evidence_1.isFresh)(ev, head))
                     executedByAspec = ev.executedByAspec;

package/dist/holmes/mcp/handlers.js

@@ -53,6 +53,7 @@ const spec_types_1 = require("../spec/spec-types");
 const legacy_format_1 = require("../spec/legacy-format");
 const cpg_scanner_1 = require("../cpg/cpg-scanner");
 const scan_cache_1 = require("../cpg/scan-cache");
+const root_1 = require("../project/root");
 // N7: every whole-tree scan goes through the file-key incremental cache under the PROJECT root's
 // .ax/cpg_cache — unchanged files (content-hash hit) skip the tree-sitter parse entirely.
 // The cache lives under the RESOLVED project root, not the raw scan root: scanning a SUBDIRECTORY
@@ -65,7 +66,7 @@ const scan_cache_1 = require("../cpg/scan-cache");
 // left open on the scan path. When the store is bound, the cache is the bound project's; otherwise
 // only an anchored answer may be written to, and an unanchored one falls back to a temp cache.
 const cacheDirFor = (root) => {
-    const r = (0, root_1.resolveProjectRoot)(root);
+    const r = (0, root_2.resolveProjectRoot)(root);
     if (r.marker !== 'given')
         return path.join(r.root, '.ax', 'cpg_cache');
     if (fs.existsSync(path.join(r.root, '.ax')))
@@ -126,7 +127,7 @@ function isHandlerRefusal(e) {
     return !!e && typeof e === 'object' && e.holmesRefusal === true;
 }
 // @implements A-SPEC-128
-const root_1 = require("../project/root");
+const root_2 = require("../project/root");
 const change_source_1 = require("../project/change-source");
 const baseline_1 = require("../project/baseline");
 const ignore_1 = require("../project/ignore");
@@ -146,7 +147,7 @@ const anchor_1 = require("../reverse/anchor");
 // yields top-level-relative paths while scan(root, root) tags root-relative ones, so a disagreement
 // silently produces wrong impact sets. `GitChangeSource` now enforces exactly that, and only there.
 function projectRootOf(root) {
-    return (0, root_1.resolveProjectRoot)(root).root;
+    return (0, root_2.resolveProjectRoot)(root).root;
 }
 // @implements A-SPEC-191 §10 — WHERE a single-use approval is spent must not be a caller's choice.
 // r8 measured all three escapes at once: a second `root`, a `root` naming a subdirectory, and an
@@ -1190,7 +1191,7 @@ function makeRawHandlers(store) {
             const executedByAspec = (0, test_evidence_1.computeExecutedByAspec)(result.executedByFile ?? {}, anchors);
             let head = '';
             try {
-                head = (0, node_child_process_1.execFileSync)('git', ['-C', root, 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();
+                head = (0, node_child_process_1.execFileSync)('git', ['-C', root, 'rev-parse', 'HEAD'], { encoding: 'utf8', env: (0, root_1.cleanSubprocessEnv)() }).trim();
             }
             catch { /* non-git */ }
             // Record ONLY an actually-executed, GREEN run (review C4/C7): a red suite must not stand as
@@ -1828,7 +1829,7 @@ function makeRawHandlers(store) {
             return { ...plan, ...applied, blockers };
         },
         async spec_slice_init(a) {
-            const root = a.root ? (0, root_1.resolveProjectRoot)(a.root).root : process.cwd();
+            const root = a.root ? (0, root_2.resolveProjectRoot)(a.root).root : process.cwd();
             const specsDir = path.join(root, '.ax', 'specs');
             const existing = await store.list();
             let maxId = 200;
@@ -1990,7 +1991,7 @@ depends_on:
             return { ok: true, specsCreated: [reqId, hspecId, aspecId, tspecId] };
         },
         async spec_slice_approve(a) {
-            const root = a.root ? (0, root_1.resolveProjectRoot)(a.root).root : process.cwd();
+            const root = a.root ? (0, root_2.resolveProjectRoot)(a.root).root : process.cwd();
             const rawStore = new spec_store_1.LocalMarkdownRepository(path.join(root, '.ax', 'specs'));
             const specs = await rawStore.list();
             const inSlice = specs.filter((s) => {
@@ -2030,7 +2031,7 @@ depends_on:
             return { ok: true, approvedSpecs };
         },
         async spec_remediate(a) {
-            const root = a.root ? (0, root_1.resolveProjectRoot)(a.root).root : process.cwd();
+            const root = a.root ? (0, root_2.resolveProjectRoot)(a.root).root : process.cwd();
             const actionsTaken = [];
             if (a.targetFile && a.aspecId) {
                 const fullPath = path.isAbsolute(a.targetFile) ? a.targetFile : path.join(root, a.targetFile);

package/dist/holmes/project/root.js

@@ -36,15 +36,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MARKER = void 0;
 exports.cleanSubprocessEnv = cleanSubprocessEnv;
 exports.resolveProjectRoot = resolveProjectRoot;
+// @implements A-SPEC-205
 // @implements A-SPEC-128
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const node_child_process_1 = require("node:child_process");
 // @implements A-SPEC-194
 // @implements A-SPEC-196
+// @implements A-SPEC-205
 function cleanSubprocessEnv(env = process.env) {
     const cleaned = { ...env };
-    const SCRUB_KEYS = new Set(['HOLMES_APPROVAL', 'HOLMES_LEDGER_KEY']);
+    const SCRUB_KEYS = new Set(['HOLMES_APPROVAL', 'HOLMES_LEDGER_KEY', 'HOLMES_ROLE', 'HOLMES_ENV_CHANNEL']);
     for (const k of Object.keys(cleaned)) {
         if (SCRUB_KEYS.has(k.toUpperCase())) {
             delete cleaned[k];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holmes-lab/holmes-kit",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Holmes-Kit — deterministic Agentic Software Engineering (ASE) harness with causal traceability (spec chain + D-CPG + RTM + phase guardrail)",
   "main": "dist/holmes/mcp/server.js",
   "bin": {