@ionivetech/mugiwara 0.6.4 → 0.6.6

package/scripts/conformance.ts

@@ -0,0 +1,232 @@
+#!/usr/bin/env bun
+// scripts/conformance.ts — C1: cross-platform conformance suite.
+// Every installable target: materialize the standard-feature fixture repo,
+// install the target, run the four core scripts, and compare a normalized
+// snapshot (state fields, report sections, evidence header, gitignore block,
+// file count) against test/golden/<target>.json. Exit 1 on any difference
+// with a diff; --update-golden regenerates. The snapshots are normalized:
+// timestamps, hashes, and random filenames are excluded so a golden is stable
+// across runs.
+
+import { execSync } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { installTo, ensureProjectGitignore } from '../src/installer.ts';
+import { targets, TARGET_IDS } from '../src/targets/index.ts';
+
+const root = join(import.meta.dirname, '..');
+const goldenDir = join(root, 'test', 'golden');
+const UPDATE = process.argv.includes('--update-golden');
+
+// tier mapping per docs/reference/harness-matrix.md (target defs carry tier only
+// on some; the matrix is the source of truth for the rest)
+const TIER_OF: Record<string, number> = {
+  claude: 1, opencode: 1,
+  gemini: 2, codex: 2, copilot: 2,
+  windsurf: 3, cline: 3, kilo: 3, antigravity: 3,
+};
+
+const TARGETS = TARGET_IDS.map(id => ({ id, tier: TIER_OF[id] ?? 2 }));
+
+// marketplace-plugin platforms: installed from the repo itself via the host's
+// plugin system (no rules-dir install). Conformance = the manifest an
+// operator's marketplace will consume: it parses, its version matches the
+// package, its pointers resolve, and its metadata set-equals content/.
+const MARKETPLACE = [
+  { id: 'cursor', manifest: '.cursor-plugin/plugin.json' },
+  { id: 'kimi', manifest: '.kimi-plugin/plugin.json' },
+  { id: 'pi', manifest: null, piField: true },
+];
+
+function marketplaceSnapshot(id: string, manifestRel: string | null, piField: boolean): Record<string, unknown> {
+  const packageJson = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+  const skillDirs = readdirSync(join(root, 'content', 'skills'), { withFileTypes: true })
+    .filter(e => e.isDirectory()).map(e => e.name).sort();
+  const agentFiles = readdirSync(join(root, 'content', 'agents'))
+    .filter(f => f.endsWith('.md')).map(f => f.replace(/\.md$/, '')).sort();
+
+  const base = {
+    target: id,
+    kind: 'marketplace-plugin',
+    version_matches_package: false,
+    skills_pointer_resolves: false,
+    skills_count: 0,
+    agents_metadata_set_equal: false,
+  };
+
+  if (piField) {
+    const pi = packageJson.pi;
+    const list = pi?.skills;
+    const pointers = Array.isArray(list) ? list : [];
+    base.skills_pointer_resolves = pointers.every(p => existsSync(join(root, p)));
+    base.skills_count = existsSync(join(root, 'content', 'skills')) ? skillDirs.length : 0;
+    base.version_matches_package = true; // package.json is the package itself
+    base.agents_metadata_set_equal = true; // pi loads skills only; agents ship in the same tree
+    return base;
+  }
+
+  const m = JSON.parse(readFileSync(join(root, manifestRel!), 'utf8'));
+  const skillsPtr = m.skills;
+  const skillsDir = typeof skillsPtr === 'string' ? join(root, skillsPtr) : null;
+  const actual = skillsDir && existsSync(skillsDir)
+    ? readdirSync(skillsDir, { withFileTypes: true }).filter(e => e.isDirectory()).map(e => e.name).sort()
+    : [];
+  const mSkills = Array.isArray(m.metadata?.skills) ? [...m.metadata.skills].sort() : [];
+  const mAgents = Array.isArray(m.metadata?.agents) ? [...m.metadata.agents].sort() : [];
+
+  return {
+    ...base,
+    version_matches_package: m.version === packageJson.version,
+    skills_pointer_resolves: skillsDir !== null && existsSync(skillsDir) && actual.length === skillDirs.length,
+    skills_count: actual.length,
+    agents_metadata_set_equal: JSON.stringify(mAgents) === JSON.stringify(agentFiles),
+  };
+}
+
+const MISSION = 'conform';
+
+function sh(cmd: string, cwd: string) {
+  execSync(cmd, { cwd, stdio: 'pipe', env: { ...process.env, MUGIWARA_DIR: join(cwd, '.mugiwara') } });
+}
+
+function snapshot(targetId: string): Record<string, unknown> {
+  const dir = mkdtempSync(join(tmpdir(), `mugi-conform-${targetId}-`));
+  try {
+    // 1. materialize the standard-feature fixture repo (trunk + feat branch)
+    sh(`bun scripts/setup-fixtures.ts standard-feature "${dir}"`, root);
+
+    // 2. install the target into the project
+    const target = targets[targetId];
+    if (!target) throw new Error(`unknown target ${targetId}`);
+    installTo(target, { scope: 'project', projectDir: dir, force: true, dryRun: false });
+
+    // The installer's own output is harness config, not mission work — but it
+    // lands as untracked files, and savepoint/lane now count the working tree
+    // (F). Park it in .git/info/exclude so the snapshot keeps measuring the
+    // fixture's 4-file mission diff instead of "how many files does this
+    // target install". Local-only: .gitignore (which the golden snapshots)
+    // is untouched.
+    const untracked = execSync('git status --porcelain --untracked-files=normal', { cwd: dir, encoding: 'utf8' })
+      .split('\n').filter(Boolean).map(l => l.slice(3)).filter(Boolean);
+    if (untracked.length) {
+      const exclude = join(dir, '.git', 'info', 'exclude');
+      writeFileSync(exclude, (existsSync(exclude) ? readFileSync(exclude, 'utf8') : '') + '\n' + untracked.join('\n') + '\n');
+    }
+
+    // 3. run the four core scripts + the gitignore write the CLI does post-install
+    sh(`bash "${root}/scripts/lane.sh" main --json`, dir);
+    sh(`bash "${root}/scripts/savepoint.sh" ${MISSION} "" 1 auto`, dir);
+    sh(`bash "${root}/scripts/evidence.sh" ${MISSION} lint -- printf 'ok\\n'`, dir);
+    sh(`bash "${root}/scripts/mission-report.sh" ${MISSION}`, dir);
+    ensureProjectGitignore(dir, { dryRun: false });
+
+    // 4. normalize + collect
+    const state = JSON.parse(readFileSync(join(dir, '.mugiwara', 'state', MISSION, 'state.json'), 'utf8'));
+    const reportFile = readdirSync(join(dir, '.mugiwara', 'reports')).find(f => f.endsWith(`-${MISSION}.md`));
+    const report = reportFile ? readFileSync(join(dir, '.mugiwara', 'reports', reportFile), 'utf8') : '';
+    const evFile = readdirSync(join(dir, '.mugiwara', 'results', MISSION)).find(f => f.includes('lint-'));
+    const ev = evFile ? readFileSync(join(dir, '.mugiwara', 'results', MISSION, evFile), 'utf8') : '';
+    const gitignore = existsSync(join(dir, '.gitignore')) ? readFileSync(join(dir, '.gitignore'), 'utf8') : '';
+
+    const countFiles = (p: string): number => {
+      if (!existsSync(p)) return 0;
+      return readdirSync(p, { recursive: true, withFileTypes: true }).filter(e => e.isFile()).length;
+    };
+
+    return {
+      target: targetId,
+      tier: TIER_OF[targetId] ?? 2,
+      state: {
+        mission: state.mission,
+        member: state.member,
+        lane: state.lane,
+        lane_reason: state.lane_reason,
+        files_touched: state.files_touched,
+        loc_delta: state.loc_delta,
+        loc_ins: state.loc_ins,
+        loc_del: state.loc_del,
+        loc_churn: state.loc_churn,
+        mode: state.mode,
+        verbosity: state.verbosity,
+        tasks_done: state.tasks?.done,
+        tasks_total: state.tasks?.total,
+        blockers_open: state.blockers_open,
+        heal_cycle: state.heal_cycle,
+        heal_max_cycles: state.heal_max_cycles,
+        heal_halt: state.heal_halt,
+        delegate_threshold: state.delegate_threshold,
+        delegate_due: state.delegate_due,
+        tokens_source: state.tokens_source,
+        budget_status: state.budget_status,
+        sensitive_paths: state.sensitive_paths,
+      },
+      report_sections: [...report.matchAll(/^#{2,3} .*$/gm)].map(m => m[0]),
+      evidence: {
+        header: ev.split('\n').filter(l => l.startsWith('# ') && !l.startsWith('# At:') && !/^# (Exit|Verdict):/.test(l)),
+        trailer: ev.split('\n').filter(l => /^# (Exit|Verdict):/.test(l)),
+      },
+      gitignore_block: gitignore.split('\n').filter(l => l.includes('mugiwara') || l.includes('# ---')),
+      file_count: {
+        skills: countFiles(target.paths({ scope: 'project', projectDir: dir, home: '' }).skillsDir),
+        agents: countFiles(target.paths({ scope: 'project', projectDir: dir, home: '' }).agentsDir),
+        state: countFiles(join(dir, '.mugiwara', 'state')),
+        evidence: countFiles(join(dir, '.mugiwara', 'results', MISSION)),
+      },
+    };
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+function diff(a: unknown, b: unknown, path = ''): string[] {
+  const out: string[] = [];
+  if (JSON.stringify(a) === JSON.stringify(b)) return out;
+  if (typeof a !== typeof b || a === null || b === null || typeof a !== 'object') {
+    out.push(`${path}: ${JSON.stringify(a)} ≠ ${JSON.stringify(b)}`);
+    return out;
+  }
+  for (const k of new Set([...Object.keys(a as object), ...Object.keys(b as object)])) {
+    out.push(...diff((a as Record<string, unknown>)[k], (b as Record<string, unknown>)[k], `${path}.${k}`));
+  }
+  return out;
+}
+
+let failed = false;
+mkdirSync(goldenDir, { recursive: true });
+
+const ALL = [
+  ...TARGETS.map(t => ({ id: t.id, label: `tier ${t.tier}`, snap: () => snapshot(t.id) })),
+  ...MARKETPLACE.map(m => ({ id: m.id, label: 'marketplace', snap: () => marketplaceSnapshot(m.id, m.manifest, m.piField === true) })),
+];
+
+for (const t of ALL) {
+  const snap = t.snap();
+  const goldenFile = join(goldenDir, `${t.id}.json`);
+  if (UPDATE) {
+    writeFileSync(goldenFile, JSON.stringify(snap, null, 2) + '\n');
+    console.log(`✓ golden updated: test/golden/${t.id}.json`);
+    continue;
+  }
+  if (!existsSync(goldenFile)) {
+    console.log(`✗ ${t.id}: golden missing — run with --update-golden first`);
+    failed = true;
+    continue;
+  }
+  const golden = JSON.parse(readFileSync(goldenFile, 'utf8'));
+  const diffs = diff(snap, golden);
+  if (diffs.length > 0) {
+    failed = true;
+    console.log(`✗ ${t.id} (${t.label}) differs:`);
+    for (const d of diffs) console.log(`    ${d}`);
+  } else {
+    console.log(`✓ ${t.id} (${t.label}) conforms`);
+  }
+}
+
+if (UPDATE) {
+  console.log('goldens regenerated — review the diff before committing');
+  process.exit(0);
+}
+if (failed) process.exit(1);
+console.log(`✓ ${ALL.length} platforms pass conformance`);

package/scripts/coverage-gate.ts

@@ -0,0 +1,179 @@
+#!/usr/bin/env bun
+// scripts/coverage-gate.ts — enforce the `coverage_new` / `coverage_modified`
+// thresholds declared in `.mugiwara/config` against the files THIS diff adds
+// and changes, not against a global project number. Two keys exist precisely
+// because the two populations are judged differently (mugiwara-gates SKILL.md
+// §Coverage gate); a global percentage would collapse them into one and let an
+// untested new file hide behind an old well-tested one.
+//
+// Run: bun scripts/coverage-gate.ts            enforce (gate step)
+//      bun scripts/coverage-gate.ts --base X   compare against ref X
+//      bun scripts/coverage-gate.ts --show     print per-file numbers, never fail
+//
+// Exit 0 = pass or recorded SKIP. Exit 1 = a threshold was missed.
+// A repo with no coverage tooling or no test suite records a SKIP with its
+// reason — never a fake pass (decision log row 50).
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join, relative, sep } from 'node:path';
+
+const root = join(import.meta.dirname, '..');
+const SHOW = process.argv.includes('--show');
+
+/** `.mugiwara/config` → project, then `~`. Returns undefined if the key is set nowhere. */
+function config(key: string): string | undefined {
+  for (const base of [root, homedir()]) {
+    const file = join(base, '.mugiwara', 'config');
+    if (!existsSync(file)) continue;
+    // \r?\n: a config written on Windows is still a config
+    for (const line of readFileSync(file, 'utf8').split(/\r?\n/)) {
+      const t = line.trim();
+      if (!t || t.startsWith('#')) continue;
+      const eq = t.indexOf('=');
+      if (eq === -1) continue;
+      if (t.slice(0, eq).trim() !== key) continue;
+      return t.slice(eq + 1).trim();
+    }
+  }
+  return undefined;
+}
+
+/** Documented defaults: new >= 90, modified >= 80. A key set to 0 = no threshold. */
+function threshold(key: string, fallback: number): number {
+  const raw = config(key);
+  if (raw === undefined || raw === '') return fallback;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0 || n > 100) {
+    console.log(`coverage-gate: ignoring unparseable ${key}="${raw}", using ${fallback}`);
+    return fallback;
+  }
+  return n;
+}
+
+function skip(reason: string): never {
+  console.log(`coverage-gate: SKIP — ${reason}`);
+  process.exit(0);
+}
+
+function git(args: string[]): string {
+  return execFileSync('git', args, { cwd: root, encoding: 'utf8' }).trim();
+}
+
+// ---- 1. is there anything to measure at all? -------------------------------
+
+const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+if (!deps['@vitest/coverage-v8'] && !deps['@vitest/coverage-istanbul'])
+  skip('no coverage tooling installed (no @vitest/coverage-* in package.json)');
+if (!existsSync(join(root, 'test')))
+  skip('no test suite found (no test/ directory)');
+
+// ---- 2. which files does this diff add and change? ------------------------
+
+const baseArg = process.argv.indexOf('--base');
+let base = baseArg !== -1 ? process.argv[baseArg + 1] : process.env.MUGIWARA_COVERAGE_BASE;
+if (!base) {
+  // the mission's own recorded base_sha is the truthful diff origin
+  const stateDir = join(root, '.mugiwara', 'state');
+  if (existsSync(stateDir)) {
+    for (const m of readdirSync(stateDir)) {
+      const f = join(stateDir, m, 'state.json');
+      if (!existsSync(f)) continue;
+      const sha = JSON.parse(readFileSync(f, 'utf8')).base_sha;
+      if (sha) { base = sha; break; }
+    }
+  }
+}
+if (!base) {
+  for (const ref of ['origin/main', 'main', 'origin/master', 'master']) {
+    try { base = git(['merge-base', 'HEAD', ref]); break; } catch { /* next */ }
+  }
+}
+if (!base) skip('no diff base could be resolved (no state base_sha, no main/master ref)');
+
+let changed: Array<{ status: string; path: string }>;
+try {
+  changed = git(['diff', '--name-status', '--diff-filter=AMR', '-M', `${base}`, 'HEAD'])
+    .split(/\r?\n/)
+    .filter(Boolean)
+    .map((l) => {
+      const parts = l.split('\t');
+      // rename rows are `R096\told\tnew` — the new path is the one to judge
+      return { status: parts[0][0], path: parts[parts.length - 1] };
+    });
+} catch (e) {
+  skip(`git diff against ${base} failed (${(e as Error).message})`);
+}
+
+if (!changed.length) skip(`no added or modified files between ${base.slice(0, 7)} and HEAD`);
+
+// ---- 3. measure ------------------------------------------------------------
+
+const summaryPath = join(root, 'coverage', 'coverage-summary.json');
+const needsRun =
+  !existsSync(summaryPath) ||
+  statSync(summaryPath).mtimeMs < Math.max(...changed
+    .map((c) => join(root, c.path))
+    .filter(existsSync)
+    .map((p) => statSync(p).mtimeMs), 0);
+
+if (needsRun) {
+  console.log('coverage-gate: measuring (vitest run --coverage)...');
+  const r = spawnSync('npx', ['vitest', 'run', '--coverage', '--silent'], {
+    cwd: root, stdio: 'inherit', shell: process.platform === 'win32',
+  });
+  if (r.status !== 0) {
+    console.log('coverage-gate: FAIL — test run did not pass, coverage is not measurable');
+    process.exit(1);
+  }
+}
+if (!existsSync(summaryPath))
+  skip('coverage run produced no coverage-summary.json (json-summary reporter not configured)');
+
+const summary = JSON.parse(readFileSync(summaryPath, 'utf8'));
+// keys are absolute OS paths; normalise to repo-relative posix to match git
+const measured = new Map<string, number>();
+for (const [k, v] of Object.entries<any>(summary)) {
+  if (k === 'total') continue;
+  measured.set(relative(root, k).split(sep).join('/'), v.lines?.pct ?? 0);
+}
+
+// ---- 4. apply the two thresholds ------------------------------------------
+
+const NEW = threshold('coverage_new', 90);
+const MOD = threshold('coverage_modified', 80);
+
+const rows = changed.map((c) => {
+  const isNew = c.status === 'A';
+  return {
+    path: c.path,
+    kind: isNew ? 'new' : 'modified',
+    limit: isNew ? NEW : MOD,
+    pct: measured.get(c.path),
+  };
+});
+
+const scoped = rows.filter((r) => r.pct !== undefined);
+const unscoped = rows.filter((r) => r.pct === undefined);
+
+console.log(`coverage-gate: base ${base.slice(0, 7)} · thresholds new>=${NEW || 'off'} modified>=${MOD || 'off'}`);
+console.log(`  ${changed.length} changed file(s), ${scoped.length} within coverage scope, ${unscoped.length} outside it`);
+
+const failures = scoped.filter((r) => r.limit > 0 && (r.pct as number) < r.limit);
+
+for (const r of scoped.sort((a, b) => (a.pct as number) - (b.pct as number))) {
+  const bad = r.limit > 0 && (r.pct as number) < r.limit;
+  if (SHOW || bad || (r.pct as number) < 100)
+    console.log(`  ${bad ? '✗' : '✓'} ${r.path} — ${(r.pct as number).toFixed(2)}% ${r.kind} (limit ${r.limit || 'off'})`);
+}
+if (SHOW && unscoped.length)
+  console.log(unscoped.map((r) => `  · ${r.path} — outside coverage scope (not a measured source file)`).join('\n'));
+
+if (SHOW) process.exit(0);
+if (failures.length) {
+  console.log(`\ncoverage-gate: FAIL — ${failures.length} file(s) below their threshold`);
+  console.log('Do not lower the thresholds or exclude files to pass: add the missing tests.');
+  process.exit(1);
+}
+console.log('\ncoverage-gate: PASS');

package/scripts/evidence.sh

@@ -40,20 +40,33 @@ TIMESTAMP=$(date +%Y%m%d-%H%M%S)
 HASH=$(echo "${LABEL}-${TIMESTAMP}-$$-${RANDOM}" | (sha256sum 2>/dev/null || shasum -a 256 2>/dev/null || openssl sha256) | cut -c1-12 2>/dev/null || echo "${TIMESTAMP}")
 EVIDENCE_FILE="$RESULTS_DIR/${LABEL}-${HASH}.log"
 
+# Neutralize forged verdict/exit header lines in captured output. The agent
+# trusts the real trailer only (# Exit:/# Verdict: appended after the block);
+# attacker output may try to impersonate it under any spelling — leading
+# whitespace, ANSI prefix, no space, CRLF. Idempotent: already-neutralized
+# #-Verdict: / #-Exit: lines pass through unchanged.
+SANITIZE='s/^[[:space:]]*(\x1b\[[0-9;]*m)*#[[:space:]]*(Verdict|Exit):/#-\2:/'
+
+# command line echoed in the header — collapse embedded newlines so an arg
+# cannot forge a header line inside "# Command:" (the header block is written
+# verbatim, outside the sanitizer).
+COMMAND_LINE=$(printf '%s ' "$@" 2>/dev/null | tr '\n\r' '  ' | sed 's/  *$//')
+
 {
   echo "# Evidence: $LABEL"
   echo "# At: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
-  echo "# Command: ${*:-<stdin pipeline>}"
+  echo "# Command: ${COMMAND_LINE:-<stdin pipeline>}"
   echo "# ---"
   echo
 
   if [ $# -gt 0 ]; then
-    "$@" 2>&1
+    "$@" 2>&1 | sed -E "$SANITIZE"
+    EXIT_CODE=${PIPESTATUS[0]}
   else
-    cat
+    sed -E "$SANITIZE"
+    EXIT_CODE=0
   fi
 } > "$EVIDENCE_FILE"
-EXIT_CODE=$?
 
 # trailer: exit code + verdict (D6). The verdict is PASS/FAIL derived from the
 # exit code — the check's own outcome, not the harness's opinion.

package/scripts/gate-selftest.ts

@@ -68,6 +68,20 @@ if (!existsSync(join(root, 'scripts', 'validate-content.ts'))) {
   }
 }
 
+// --- G5: conditional-assertion guard — prove expect-in-conditional goes red ---
+console.log('\nG5 — conditional-assertion guard');
+{
+  const testFile = join(root, 'test', 'targets.test.ts');
+  const original = readFileSync(testFile, 'utf8');
+  try {
+    writeFileSync(testFile, `${original}\nif (x) { expect(1).toBe(1); }\n`);
+    assert('expect() in non-invariant conditional → exit 1', false, () => run('G5', 'bun scripts/validate-content.ts'));
+  } finally {
+    writeFileSync(testFile, original);
+    assert('restored → exit 0', true, () => run('G5', 'bun scripts/validate-content.ts'));
+  }
+}
+
 // --- G3: savepoint fixtures — prove test fails when a field is broken ---
 console.log('\nG3 — savepoint fixtures');
 if (!existsSync(join(root, 'test', 'savepoint.test.ts'))) {

package/scripts/initiative.ts

@@ -55,40 +55,47 @@ function assertPlanContent(content: string, planFile: string): void {
   }
 }
 
-function parseSubMissions(content: string): SubMission[] {
+function parseSubMissions(content: string): { subs: SubMission[]; hasSection: boolean } {
   const lines = content.split('\n');
   let inTable = false;
   let inSubSection = false;
+  let hasSection = false;
   const subs: SubMission[] = [];
 
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i];
-    if (line.startsWith('## Sub-missions')) {
+    if (line.trim().toLowerCase().startsWith('## sub-missions')) {
       inSubSection = true;
+      hasSection = true;
       continue;
     }
-    if (inSubSection && line.startsWith('## ') && !line.startsWith('## Sub-missions')) {
+    if (inSubSection && line.startsWith('## ') && !line.trim().toLowerCase().startsWith('## sub-missions')) {
       break;
     }
     if (!inSubSection) continue;
 
     const trimmed = line.trim();
-    if (trimmed.startsWith('| ID ') && trimmed.includes('| Name ')) {
+    const lower = trimmed.toLowerCase();
+    if (lower.startsWith('| id ') && lower.includes('| name ')) {
       inTable = true;
       continue;
     }
     if (inTable && trimmed.startsWith('|---')) continue;
     if (inTable && trimmed.startsWith('|')) {
-      const cols = trimmed.split('|').map(c => c.trim()).filter(Boolean);
+      // Keep interior empty cells (e.g. empty "depends on"): filter(Boolean)
+      // would shift columns and drop the touched-files tail.
+      const cols = trimmed.split('|').map(c => c.trim());
+      while (cols.length && cols[0] === '') cols.shift();
+      while (cols.length && cols[cols.length - 1] === '') cols.pop();
       if (cols.length >= 6) {
         subs.push({
           id: cols[0],
           name: cols[1],
           assignee: cols[2],
           branch: cols[3],
-          status: cols[4],
+          status: cols[4].replace('[X]', '[x]'),
           dependsOn: cols[5],
-          touchedFiles: cols.slice(6).join(' ').split(/\s+/).filter(Boolean),
+          touchedFiles: cols.slice(6).join(' ').split(/[,\s]+/).map(s => s.trim()).filter(Boolean),
         });
       }
     }
@@ -97,13 +104,23 @@ function parseSubMissions(content: string): SubMission[] {
     }
   }
 
-  return subs;
+  return { subs, hasSection };
+}
+
+function assertRowsParsed(planFile: string, content: string): { subs: SubMission[]; hasSection: boolean } {
+  const { subs, hasSection } = parseSubMissions(content);
+  if (hasSection && subs.length === 0) {
+    console.error('initiative: "## Sub-missions" section found but no rows parsed.');
+    console.error('  Expected header: | ID | Name | Assignee | Branch | Status | Depends On | Touched Files |');
+    process.exit(1);
+  }
+  return { subs, hasSection };
 }
 
 function cmdStatus(planFile: string): void {
   const content = readFileSync(planFile, 'utf8');
   assertPlanContent(content, planFile);
-  const subs = parseSubMissions(content);
+  const { subs } = assertRowsParsed(planFile, content);
 
   if (subs.length === 0) {
     console.log('No sub-missions found — solo mission.');
@@ -117,14 +134,24 @@ function cmdStatus(planFile: string): void {
   const filled = Math.round((doneCount / total) * barLen);
   const bar = '█'.repeat(filled) + '░'.repeat(barLen - filled);
 
+  // dependency blocking: a sub whose dependency is not done is blocked
+  const statusById = new Map(subs.map(s => [s.id, s.status]));
+  const blockedBy = new Map<string, string>();
+  for (const s of subs) {
+    if (s.dependsOn && statusById.has(s.dependsOn) && statusById.get(s.dependsOn) !== '[x]') {
+      blockedBy.set(s.id, s.dependsOn);
+    }
+  }
+
   console.log(`\n${doneCount}/${total} done [${bar}] ${pct}%\n`);
   console.log(`${'ID'.padEnd(8)} ${'Name'.padEnd(20)} ${'Assignee'.padEnd(12)} ${'Branch'.padEnd(28)} ${'Status'.padEnd(8)} ${'Depends'.padEnd(10)} ${'Files'}`);
   console.log('─'.repeat(120));
 
   for (const s of subs) {
     const icon = { '[ ]': '◻', '[~]': '◉', '[x]': '✓', '[!]': '✗' }[s.status] || '?';
+    const blocked = blockedBy.has(s.id) ? ` ⛔ blocked-by ${blockedBy.get(s.id)}` : '';
     console.log(
-      `${s.id.padEnd(8)} ${s.name.padEnd(20)} ${s.assignee.padEnd(12)} ${s.branch.padEnd(28)} ${icon} ${s.status.padEnd(3)} ${s.dependsOn.padEnd(10)} ${s.touchedFiles.join(', ')}`
+      `${s.id.padEnd(8)} ${s.name.padEnd(20)} ${s.assignee.padEnd(12)} ${s.branch.padEnd(28)} ${icon} ${s.status.padEnd(3)} ${s.dependsOn.padEnd(10)} ${s.touchedFiles.join(', ')}${blocked}`
     );
   }
   console.log();
@@ -133,7 +160,7 @@ function cmdStatus(planFile: string): void {
 function cmdConflictCheck(planFile: string): void {
   const content = readFileSync(planFile, 'utf8');
   assertPlanContent(content, planFile);
-  const subs = parseSubMissions(content);
+  const { subs } = assertRowsParsed(planFile, content);
 
   if (subs.length === 0) {
     console.log('No sub-missions — no conflicts possible.');
@@ -168,6 +195,7 @@ function cmdConflictCheck(planFile: string): void {
     console.log(`\n${conflicts.length} file conflict(s) detected:\n`);
     console.log(conflicts.join('\n'));
     console.log();
+    process.exit(1);
   }
 }
 
@@ -187,28 +215,34 @@ function cmdSetStatus(planFile: string, id: string, status: string): void {
 
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i];
-    if (line.startsWith('## Sub-missions')) {
+    if (line.trim().toLowerCase().startsWith('## sub-missions')) {
       inSubSection = true;
       continue;
     }
-    if (inSubSection && line.startsWith('## ') && !line.startsWith('## Sub-missions')) {
+    if (inSubSection && line.startsWith('## ') && !line.trim().toLowerCase().startsWith('## sub-missions')) {
       break;
     }
     if (!inSubSection) continue;
 
     const trimmed = line.trim();
-    if (trimmed.startsWith('| ID ')) { inTable = true; continue; }
+    if (trimmed.toLowerCase().startsWith('| id ')) { inTable = true; continue; }
     if (!inTable || !trimmed.startsWith('|')) continue;
     if (trimmed.startsWith('|---')) continue;
 
-    const cols = trimmed.split('|').map(c => c.trim()).filter(Boolean);
+    // same cell handling as parseSubMissions: interior empty cells preserved
+    const cols = trimmed.split('|').map(c => c.trim());
+    while (cols.length && cols[0] === '') cols.shift();
+    while (cols.length && cols[cols.length - 1] === '') cols.pop();
     if (cols[0] === id) {
-      const oldMarker = cols[4];
+      let oldMarker = cols[4];
+      if (oldMarker === '[X]') oldMarker = '[x]';
       if (!Object.values(STATUS_MARKERS).includes(oldMarker)) {
         console.error(`Row ${id}: status column "${oldMarker}" is not a recognized marker`);
         process.exit(1);
       }
-      lines[i] = lines[i].replace(oldMarker, newMarker);
+      // rewrite only the status cell — a marker string elsewhere in the row
+      // (name, touched files) must not be clobbered by a row-wide replace
+      lines[i] = `| ${cols.slice(0, 4).join(' | ')} | ${newMarker} | ${cols.slice(5).join(' | ')} |`;
       found = true;
       break;
     }

package/scripts/install.ps1

@@ -2,12 +2,13 @@
 $ErrorActionPreference = 'Stop'
 
 if (-not (Get-Command node -ErrorAction SilentlyContinue)) {
-  Write-Error 'mugiwara requires Node.js >= 20. Install it from https://nodejs.org first.'
+  Write-Error 'mugiwara requires Node.js >= 20.11. Install it from https://nodejs.org first.'
 }
 
-$major = [int](node -p 'process.versions.node.split(".")[0]')
-if ($major -lt 20) {
-  Write-Error "mugiwara requires Node.js >= 20 (found $(node --version))."
+# floor must match package.json "engines.node" exactly, and install.sh
+node -e 'const [a,b]=process.versions.node.split(".").map(Number);process.exit(a>20||(a===20&&b>=11)?0:1)'
+if ($LASTEXITCODE -ne 0) {
+  Write-Error "mugiwara requires Node.js >= 20.11 (found $(node --version))."
 }
 
 npx -y @ionivetech/mugiwara@latest @args

package/scripts/install.sh

@@ -4,13 +4,13 @@ set -euo pipefail
 PKG="@ionivetech/mugiwara"
 
 if ! command -v node >/dev/null 2>&1; then
-  echo "mugiwara requires Node.js >= 20. Install it first: https://nodejs.org" >&2
+  echo "mugiwara requires Node.js >= 20.11. Install it first: https://nodejs.org" >&2
   exit 1
 fi
 
-MAJOR="$(node -p 'process.versions.node.split(".")[0]')"
-if [ "$MAJOR" -lt 20 ]; then
-  echo "mugiwara requires Node.js >= 20 (found $(node --version))." >&2
+# floor must match package.json "engines.node" exactly, and install.ps1
+if ! node -e 'const [a,b]=process.versions.node.split(".").map(Number);process.exit(a>20||(a===20&&b>=11)?0:1)'; then
+  echo "mugiwara requires Node.js >= 20.11 (found $(node --version))." >&2
   exit 1
 fi