@lousy-agents/cli 5.13.0 → 5.13.2

package/api/copilot-with-fastify/.devcontainer/devcontainer.json

@@ -10,7 +10,7 @@
         },
         "ghcr.io/devcontainers/features/copilot-cli:1.0.0": {},
         "ghcr.io/anthropics/devcontainer-features/claude-code:1": {
-            "version": "v2.1.126"
+            "version": "v2.1.131"
         },
         "ghcr.io/rocker-org/devcontainer-features/apt-packages:1.0.2": {
             "packages": "yamllint, shellcheck",

package/api/copilot-with-fastify/package-lock.json

@@ -14,15 +14,15 @@
                 "kysely": "0.28.17",
                 "pino": "10.3.1",
                 "postgres": "3.4.9",
-                "zod": "4.4.2"
+                "zod": "4.4.3"
             },
             "devDependencies": {
                 "@biomejs/biome": "2.4.14",
-                "@lousy-agents/mcp": "5.12.2",
+                "@lousy-agents/mcp": "5.13.1",
                 "@modelcontextprotocol/server-sequential-thinking": "2025.12.18",
                 "@testcontainers/postgresql": "11.14.0",
                 "@types/node": "24.12.2",
-                "@upstash/context7-mcp": "2.2.3",
+                "@upstash/context7-mcp": "2.2.4",
                 "chance": "1.1.13",
                 "testcontainers": "11.14.0",
                 "tsx": "4.21.0",
@@ -956,15 +956,15 @@
             }
         },
         "node_modules/@lousy-agents/mcp": {
-            "version": "5.12.2",
-            "resolved": "https://registry.npmjs.org/@lousy-agents/mcp/-/mcp-5.12.2.tgz",
-            "integrity": "sha512-b4Ox1tB/gH/MFaXT+jS92mx2qtQKw1DK7oycLMSGbrKyBA4xXMK9ayvfMTdvx/zcFQc4URmuM5pSKa2Ng2PwCQ==",
+            "version": "5.13.1",
+            "resolved": "https://registry.npmjs.org/@lousy-agents/mcp/-/mcp-5.13.1.tgz",
+            "integrity": "sha512-hzkNWfxl7YwOhjA//v7xJTuEQtWw+jhECGy6n36leuMGlqSgMJnKmQqQe7YvpE1kyQNrXkW1MxvO8xKKjkdEUg==",
             "dev": true,
             "license": "BSD-2-Clause-Patent",
             "dependencies": {
                 "@modelcontextprotocol/sdk": "1.29.0",
                 "yaml": "2.8.4",
-                "zod": "4.4.2"
+                "zod": "4.4.3"
             },
             "bin": {
                 "lousy-agents-mcp": "dist/mcp-server.js"
@@ -1649,9 +1649,9 @@
             "license": "MIT"
         },
         "node_modules/@upstash/context7-mcp": {
-            "version": "2.2.3",
-            "resolved": "https://registry.npmjs.org/@upstash/context7-mcp/-/context7-mcp-2.2.3.tgz",
-            "integrity": "sha512-AZoARvwR1MA6TeMAXFDXg0LnA0DWdEervrrJxEXb3X8I2LAFRIdGWZG7keawHz5FYwFZ4M8oyuvtnoRemRb0SQ==",
+            "version": "2.2.4",
+            "resolved": "https://registry.npmjs.org/@upstash/context7-mcp/-/context7-mcp-2.2.4.tgz",
+            "integrity": "sha512-6kpjAxif2w+HhxSPmyi+SUsVPgFKBi+xtFgKRc9f0fhLpZGTBX1QKWFmleAIZ4T69Ykynzxc4nHGEDrr219noA==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
@@ -6009,9 +6009,9 @@
             }
         },
         "node_modules/zod": {
-            "version": "4.4.2",
-            "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.2.tgz",
-            "integrity": "sha512-IynmDyxsEsb9RKzO3J9+4SxXnl2FTFSzNBaKKaMV6tsSk0rw9gYw9gs+JFCq/qk2LCZ78KDwyj+Z289TijSkUw==",
+            "version": "4.4.3",
+            "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+            "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
             "license": "MIT",
             "funding": {
                 "url": "https://github.com/sponsors/colinhacks"

package/api/copilot-with-fastify/package.json

@@ -22,18 +22,18 @@
         "kysely": "0.28.17",
         "pino": "10.3.1",
         "postgres": "3.4.9",
-        "zod": "4.4.2"
+        "zod": "4.4.3"
     },
     "overrides": {
-        "zod": "4.4.2"
+        "zod": "4.4.3"
     },
     "devDependencies": {
         "@biomejs/biome": "2.4.14",
-        "@lousy-agents/mcp": "5.12.2",
+        "@lousy-agents/mcp": "5.13.1",
         "@modelcontextprotocol/server-sequential-thinking": "2025.12.18",
         "@testcontainers/postgresql": "11.14.0",
         "@types/node": "24.12.2",
-        "@upstash/context7-mcp": "2.2.3",
+        "@upstash/context7-mcp": "2.2.4",
         "chance": "1.1.13",
         "testcontainers": "11.14.0",
         "tsx": "4.21.0",

package/cli/copilot-with-citty/.devcontainer/devcontainer.json

@@ -10,7 +10,7 @@
         },
         "ghcr.io/devcontainers/features/copilot-cli:1.0.0": {},
         "ghcr.io/anthropics/devcontainer-features/claude-code:1": {
-            "version": "v2.1.126"
+            "version": "v2.1.131"
         },
         "ghcr.io/rocker-org/devcontainer-features/apt-packages:1.0.2": {
             "packages": "yamllint, shellcheck",

package/cli/copilot-with-citty/package.json

@@ -16,14 +16,14 @@
     "dependencies": {
         "citty": "0.2.2",
         "consola": "3.4.2",
-        "zod": "4.4.2"
+        "zod": "4.4.3"
     },
     "devDependencies": {
         "@biomejs/biome": "2.4.14",
-        "@lousy-agents/mcp": "5.12.2",
+        "@lousy-agents/mcp": "5.13.1",
         "@modelcontextprotocol/server-sequential-thinking": "2025.12.18",
         "@types/node": "24.12.2",
-        "@upstash/context7-mcp": "2.2.3",
+        "@upstash/context7-mcp": "2.2.4",
         "chance": "1.1.13",
         "tsx": "4.21.0",
         "typescript": "6.0.3",

package/dist/27.js

@@ -7,10 +7,10 @@ __webpack_require__.r(__webpack_exports__);
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
+  FSWatcher: () => (/* binding */ FSWatcher),
   WatchHelper: () => (/* binding */ WatchHelper),
   "default": () => (/* binding */ chokidar),
-  watch: () => (/* binding */ watch),
-  FSWatcher: () => (/* binding */ FSWatcher)
+  watch: () => (/* binding */ watch)
 });
 
 // EXTERNAL MODULE: external "node:events"

package/dist/653.js

@@ -720,7 +720,7 @@ __webpack_require__.d(__webpack_exports__, {
   downloadTemplate: () => (/* reexport */ downloadTemplate)
 });
 
-// UNUSED EXPORTS: startShell, registryProvider
+// UNUSED EXPORTS: registryProvider, startShell
 
 // EXTERNAL MODULE: ../../node_modules/giget/dist/_chunks/libs/nypm.mjs
 var nypm = __webpack_require__(292);

package/dist/962.js

@@ -8,7 +8,7 @@ __webpack_require__.d(__webpack_exports__, {
   digest: () => (/* reexport */ node_digest)
 });
 
-// UNUSED EXPORTS: isEqual, serialize, hash
+// UNUSED EXPORTS: hash, isEqual, serialize
 
 // EXTERNAL MODULE: external "node:crypto"
 var external_node_crypto_ = __webpack_require__(7598);

package/dist/index.js

@@ -567,7 +567,7 @@ module.exports = webpackEmptyAsyncContext;
 
 
 },
-1792(__unused_rspack_module, __unused_rspack___webpack_exports__, __webpack_require__) {
+2091(__unused_rspack_module, __unused_rspack___webpack_exports__, __webpack_require__) {
 // NAMESPACE OBJECT: ../../node_modules/micromark/lib/constructs.js
 var constructs_namespaceObject = {};
 __webpack_require__.r(constructs_namespaceObject);
@@ -5685,7 +5685,7 @@ const safeDecodeAsync = /* @__PURE__*/ _safeDecodeAsync($ZodRealError);
 const versions_version = {
     major: 4,
     minor: 4,
-    patch: 2,
+    patch: 3,
 };
 
 ;// CONCATENATED MODULE: ../../node_modules/zod/v4/core/schemas.js
@@ -7408,6 +7408,7 @@ const $ZodFile = /*@__PURE__*/ (/* unused pure expression or super */ null && (c
 })));
 const $ZodTransform = /*@__PURE__*/ $constructor("$ZodTransform", (inst, def) => {
     $ZodType.init(inst, def);
+    inst._zod.optin = "optional";
     inst._zod.parse = (payload, ctx) => {
         if (ctx.direction === "backward") {
             throw new $ZodEncodeError(inst.constructor.name);
@@ -7417,6 +7418,7 @@ const $ZodTransform = /*@__PURE__*/ $constructor("$ZodTransform", (inst, def) =>
             const output = _out instanceof Promise ? _out : Promise.resolve(_out);
             return output.then((output) => {
                 payload.value = output;
+                payload.fallback = true;
                 return payload;
             });
         }
@@ -7424,11 +7426,12 @@ const $ZodTransform = /*@__PURE__*/ $constructor("$ZodTransform", (inst, def) =>
             throw new $ZodAsyncError();
         }
         payload.value = _out;
+        payload.fallback = true;
         return payload;
     };
 });
 function handleOptionalResult(result, input) {
-    if (result.issues.length && input === undefined) {
+    if (input === undefined && (result.issues.length || result.fallback)) {
         return { issues: [], value: undefined };
     }
     return result;
@@ -7446,10 +7449,11 @@ const $ZodOptional = /*@__PURE__*/ $constructor("$ZodOptional", (inst, def) => {
     });
     inst._zod.parse = (payload, ctx) => {
         if (def.innerType._zod.optin === "optional") {
+            const input = payload.value;
             const result = def.innerType._zod.run(payload, ctx);
             if (result instanceof Promise)
-                return result.then((r) => handleOptionalResult(r, payload.value));
-            return handleOptionalResult(result, payload.value);
+                return result.then((r) => handleOptionalResult(r, input));
+            return handleOptionalResult(result, input);
         }
         if (payload.value === undefined) {
             return payload;
@@ -7576,7 +7580,7 @@ const $ZodSuccess = /*@__PURE__*/ (/* unused pure expression or super */ null &&
 })));
 const $ZodCatch = /*@__PURE__*/ $constructor("$ZodCatch", (inst, def) => {
     $ZodType.init(inst, def);
-    defineLazy(inst._zod, "optin", () => def.innerType._zod.optin);
+    inst._zod.optin = "optional";
     defineLazy(inst._zod, "optout", () => def.innerType._zod.optout);
     defineLazy(inst._zod, "values", () => def.innerType._zod.values);
     inst._zod.parse = (payload, ctx) => {
@@ -7597,6 +7601,7 @@ const $ZodCatch = /*@__PURE__*/ $constructor("$ZodCatch", (inst, def) => {
                         input: payload.value,
                     });
                     payload.issues = [];
+                    payload.fallback = true;
                 }
                 return payload;
             });
@@ -7611,6 +7616,7 @@ const $ZodCatch = /*@__PURE__*/ $constructor("$ZodCatch", (inst, def) => {
                 input: payload.value,
             });
             payload.issues = [];
+            payload.fallback = true;
         }
         return payload;
     };
@@ -7657,7 +7663,7 @@ function handlePipeResult(left, next, ctx) {
         left.aborted = true;
         return left;
     }
-    return next._zod.run({ value: left.value, issues: left.issues }, ctx);
+    return next._zod.run({ value: left.value, issues: left.issues, fallback: left.fallback }, ctx);
 }
 const $ZodCodec = /*@__PURE__*/ (/* unused pure expression or super */ null && (core.$constructor("$ZodCodec", (inst, def) => {
     $ZodType.init(inst, def);
@@ -7715,8 +7721,6 @@ function handleCodecTxResult(left, value, nextSchema, ctx) {
 }
 const $ZodPreprocess = /*@__PURE__*/ (/* unused pure expression or super */ null && (core.$constructor("$ZodPreprocess", (inst, def) => {
     $ZodPipe.init(inst, def);
-    util.defineLazy(inst._zod, "optin", () => def.out._zod.optin);
-    util.defineLazy(inst._zod, "optout", () => def.out._zod.optout);
 })));
 const $ZodReadonly = /*@__PURE__*/ $constructor("$ZodReadonly", (inst, def) => {
     $ZodType.init(inst, def);
@@ -8914,7 +8918,7 @@ function _promise(Class, innerType) {
 }
 // @__NO_SIDE_EFFECTS__
 function _custom(Class, fn, _params) {
-    const norm = util.normalizeParams(_params);
+    const norm = normalizeParams(_params);
     norm.abort ?? (norm.abort = true); // default to abort:false
     const schema = new Class({
         type: "custom",
@@ -11303,10 +11307,12 @@ const ZodTransform = /*@__PURE__*/ $constructor("ZodTransform", (inst, def) => {
         if (output instanceof Promise) {
             return output.then((output) => {
                 payload.value = output;
+                payload.fallback = true;
                 return payload;
             });
         }
         payload.value = output;
+        payload.fallback = true;
         return payload;
     };
 });
@@ -11553,7 +11559,7 @@ function schemas_check(fn) {
     return ch;
 }
 function custom(fn, _params) {
-    return core._custom(ZodCustom, fn ?? (() => true), _params);
+    return _custom(ZodCustom, fn ?? (() => true), _params);
 }
 function refine(fn, _params = {}) {
     return _refine(ZodCustom, fn, _params);
@@ -11817,6 +11823,26 @@ var compat_ZodFirstPartyTypeKind;
     setupActionPatterns: DEFAULT_SETUP_ACTION_PATTERNS,
     packageManagers: DEFAULT_PACKAGE_MANAGERS
 };
+/**
+ * Gets a version type to action name mapping from config.
+ * Returns a partial record as not all types may be configured.
+ */ function getVersionTypeToActionMap(config) {
+    const map = {};
+    for (const action of config.setupActions){
+        map[action.type] = action.action;
+    }
+    return map;
+}
+/**
+ * Gets a version file type to config key mapping from config.
+ * Returns a partial record as not all types may be configured.
+ */ function getVersionFileConfigKeyMap(config) {
+    const map = {};
+    for (const action of config.setupActions){
+        map[action.type] = action.versionFileKey;
+    }
+    return map;
+}
 
 ;// CONCATENATED MODULE: ../core/src/lib/copilot-setup-config.ts
 /**
@@ -11944,29 +11970,8 @@ const CopilotSetupConfigSchema = schemas_object({
  *
  * This function is retained for backwards compatibility but is a no-op
  * because configuration is no longer cached at module scope.
- */ function resetCopilotSetupConfigCache() {
-// no in-memory cache to reset
-}
-/**
- * Gets a version file type to action mapping from config.
- * Returns a partial record as not all types may be configured.
- */ function getVersionTypeToActionMap(config) {
-    const map = {};
-    for (const action of config.setupActions){
-        map[action.type] = action.action;
-    }
-    return map;
-}
-/**
- * Gets a version file type to config key mapping from config.
- * Returns a partial record as not all types may be configured.
- */ function getVersionFileConfigKeyMap(config) {
-    const map = {};
-    for (const action of config.setupActions){
-        map[action.type] = action.versionFileKey;
-    }
-    return map;
-}
+ */ function resetCopilotSetupConfigCache() {}
+
 /**
  * Gets a filename to version type mapping from config.
  */ function getVersionFilenameToTypeMap(config) {
@@ -16512,15 +16517,12 @@ function defaultExec(command, args, options) {
  * File system implementation of instruction analysis gateway
  */ class FileSystemInstructionAnalysisGateway {
     async analyzeCoverage(targetDir, scripts, tools) {
-        // Find all instruction files
         const instructionFiles = await this.findInstructionFiles(targetDir);
-        // Read and search instruction content
         const references = [];
         const documentedTargets = new Set();
         for (const file of instructionFiles){
             const content = await readFile(file, "utf-8");
             const lines = content.split("\n");
-            // Check for script references (e.g., "npm test", "npm run build")
             for (const script of scripts){
                 const scriptRefs = this.findReferencesInContent(script.name, content, lines, file, targetDir);
                 if (scriptRefs.length > 0) {
@@ -16528,7 +16530,6 @@ function defaultExec(command, args, options) {
                     documentedTargets.add(script.name);
                 }
             }
-            // Check for tool references (e.g., "mise run test", "biome check")
             for (const tool of tools){
                 const toolRefs = this.findReferencesInContent(tool.name, content, lines, file, targetDir);
                 if (toolRefs.length > 0) {
@@ -16537,14 +16538,12 @@ function defaultExec(command, args, options) {
                 }
             }
         }
-        // Filter mandatory scripts/tools
         const mandatoryScripts = scripts.filter((s)=>s.isMandatory);
         const mandatoryTools = tools.filter((t)=>t.isMandatory);
         const allMandatory = [
             ...mandatoryScripts,
             ...mandatoryTools
         ];
-        // Categorize as missing or documented
         const missingInInstructions = allMandatory.filter((item)=>!documentedTargets.has(item.name));
         const documentedInInstructions = allMandatory.filter((item)=>documentedTargets.has(item.name));
         const totalMandatory = allMandatory.length;
@@ -16563,12 +16562,10 @@ function defaultExec(command, args, options) {
     }
     async findInstructionFiles(targetDir) {
         const files = [];
-        // Check for .github/copilot-instructions.md
         const copilotInstructions = join(targetDir, ".github", "copilot-instructions.md");
         if (await fileExists(copilotInstructions)) {
             files.push(copilotInstructions);
         }
-        // Check for .github/instructions/*.md
         const instructionsDir = join(targetDir, ".github", "instructions");
         if (await fileExists(instructionsDir)) {
             try {
@@ -16578,31 +16575,20 @@ function defaultExec(command, args, options) {
                         files.push(join(instructionsDir, file));
                     }
                 }
-            } catch  {
-            // Skip directory if we can't read it (e.g., permissions issues)
-            // Similar to how workflow parsing errors are handled
-            }
+            } catch  {}
         }
         return files;
     }
     findReferencesInContent(target, content, lines, file, targetDir) {
         const references = [];
-        // Build a case-insensitive, word-boundary-aware pattern for the target.
-        // This reduces false positives from simple substring matches like
-        // "test" in "testing" or "latest", while still matching common
-        // separators such as spaces, punctuation, etc.
         const escapedTarget = target.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
         const targetPattern = new RegExp(`(?:^|[^\\w])(${escapedTarget})(?=$|[^\\w])`, "i");
-        // Fast path: skip line-by-line processing if the target pattern
-        // never appears in the full content.
         if (!targetPattern.test(content)) {
             return references;
         }
-        // Find line numbers where target appears
         for(let i = 0; i < lines.length; i++){
             const line = lines[i];
             if (targetPattern.test(line)) {
-                // Get context (line before and after if available)
                 const contextLines = [];
                 if (i > 0) contextLines.push(lines[i - 1]);
                 contextLines.push(line);
@@ -18314,47 +18300,78 @@ const MAX_NPMRC_BYTES = 64 * 1024;
 
 
 
+
+// 1 MB — covers even the largest real-world manifests
+const MAX_PACKAGE_JSON_BYTES = 1024 * 1024;
+const PackageJsonSchema = schemas_object({
+    scripts: record(schemas_string(), schemas_string()).optional()
+});
 /**
  * File system implementation of script discovery gateway
  */ class FileSystemScriptDiscoveryGateway {
+    constructor(logger){
+        this.logger = logger ?? consola;
+    }
+    logger;
     async discoverScripts(targetDir) {
         const packageJsonPath = (0,external_node_path_.join)(targetDir, "package.json");
-        if (!await file_system_utils_fileExists(packageJsonPath)) {
+        let content;
+        try {
+            content = await readFileNoFollow(packageJsonPath, MAX_PACKAGE_JSON_BYTES);
+        } catch (error) {
+            const code = error instanceof Error && "code" in error ? error.code : undefined;
+            if (code !== "ENOENT") {
+                this.logger.warn(`script-discovery: could not read ${JSON.stringify(packageJsonPath)}: ${JSON.stringify(error instanceof Error ? error.message : String(error))}`);
+            }
             return [];
         }
+        let parsed;
         try {
-            const content = await (0,promises_.readFile)(packageJsonPath, "utf-8");
-            const packageJson = JSON.parse(content);
-            if (!packageJson.scripts) {
+            parsed = JSON.parse(content);
+        } catch (e) {
+            if (e instanceof SyntaxError) {
+                this.logger.warn(`script-discovery: ${JSON.stringify(packageJsonPath)} contains invalid JSON — ${JSON.stringify(e.message)}`);
                 return [];
             }
-            const scripts = [];
-            for (const [name, command] of Object.entries(packageJson.scripts)){
-                const phase = feedback_loop_determineScriptPhase(name, command);
-                const isMandatory = feedback_loop_isScriptMandatory(phase);
-                scripts.push({
-                    name,
-                    command,
-                    phase,
-                    isMandatory
-                });
-            }
-            return scripts;
-        } catch  {
-            // If package.json is malformed or cannot be parsed, return empty array
+            throw e;
+        }
+        const parseResult = PackageJsonSchema.safeParse(parsed);
+        if (!parseResult.success) {
+            this.logger.warn(`script-discovery: ${JSON.stringify(packageJsonPath)} has an unexpected structure — scripts field must be a record of strings`);
+            return [];
+        }
+        if (!parseResult.data.scripts) {
             return [];
         }
+        const scripts = [];
+        for (const [name, command] of Object.entries(parseResult.data.scripts)){
+            const phase = feedback_loop_determineScriptPhase(name, command);
+            const isMandatory = feedback_loop_isScriptMandatory(phase);
+            scripts.push({
+                name,
+                command,
+                phase,
+                isMandatory
+            });
+        }
+        return scripts;
     }
 }
 /**
  * Creates and returns the default script discovery gateway
- */ function createScriptDiscoveryGateway() {
-    return new FileSystemScriptDiscoveryGateway();
+ */ function createScriptDiscoveryGateway(logger) {
+    return new FileSystemScriptDiscoveryGateway(logger);
 }
 /**
  * Creates a FeedbackLoopCommandsGateway that discovers mandatory commands from package.json scripts.
- */ function createFeedbackLoopCommandsGateway(scriptGateway) {
-    const gateway = scriptGateway ?? createScriptDiscoveryGateway();
+ *
+ * @param scriptGateway - Optional gateway implementation. If omitted, a default
+ *   `FileSystemScriptDiscoveryGateway` is created using `logger`.
+ * @param logger - Optional logger for the default gateway. Only used when
+ *   `scriptGateway` is omitted; if a custom `scriptGateway` is supplied, its
+ *   own logger configuration applies and this parameter is ignored.
+ */ function createFeedbackLoopCommandsGateway(scriptGateway, logger) {
+    const gateway = scriptGateway ?? createScriptDiscoveryGateway(logger);
     return {
         async getMandatoryCommands (targetDir) {
             const scripts = await gateway.discoverScripts(targetDir);
@@ -18573,9 +18590,7 @@ var dist = __webpack_require__(3519);
                 const workflow = parseYaml(content);
                 const tools = this.extractToolsFromWorkflow(workflow, file);
                 allTools.push(...tools);
-            } catch  {
-            // Skip files that can't be parsed as valid YAML
-            }
+            } catch  {}
         }
         return this.deduplicateTools(allTools);
     }
@@ -18603,7 +18618,6 @@ var dist = __webpack_require__(3519);
                 const stepObj = step;
                 const run = stepObj.run;
                 if (typeof run === "string") {
-                    // Extract tools from run commands
                     const extractedTools = this.extractToolsFromRunCommand(run, sourceFile);
                     tools.push(...extractedTools);
                 }
@@ -18613,35 +18627,24 @@ var dist = __webpack_require__(3519);
     }
     extractToolsFromRunCommand(runCommand, sourceFile) {
         const tools = [];
-        // Split by newlines and pipe tokens with surrounding whitespace to handle
-        // multi-line and piped commands without breaking on constructs like "cmd || true"
         const commands = runCommand.split(/\n|\s\|\s/).map((c)=>c.trim()).filter((c)=>c.length > 0 && !c.startsWith("#"));
         for (const command of commands){
-            // Extract the base command (first word)
             const parts = command.split(/\s+/);
             const baseCommand = parts[0];
-            // Skip shell built-ins and common utilities
             if (this.isShellBuiltin(baseCommand)) {
                 continue;
             }
-            // Determine tool name and full command
             let toolName;
             const fullCommand = command;
-            // Handle special cases like "npm run", "mise run", etc.
             if (parts.length >= 2 && (baseCommand === "npm" || baseCommand === "mise") && parts[1] === "run") {
                 if (parts.length >= 3 && parts[2]) {
-                    // "npm run test" -> name: "npm run test"
                     toolName = parts.slice(0, 3).join(" ");
                 } else {
-                    // Handle commands like "npm run" without a script name
                     toolName = parts.slice(0, 2).join(" ");
                 }
             } else if (parts.length >= 2) {
-                // For most tools, include the subcommand for better specificity
-                // e.g., "npm test", "npx biome", "pnpm lint"
                 toolName = parts.slice(0, 2).join(" ");
             } else {
-                // Fallback to the base command if no subcommand is present
                 toolName = baseCommand;
             }
             const phase = this.determineToolPhase(toolName, fullCommand);
@@ -18680,13 +18683,11 @@ var dist = __webpack_require__(3519);
         return builtins.includes(command);
     }
     determineToolPhase(toolName, fullCommand) {
-        // Use the same logic as script phase determination
         return determineScriptPhase(toolName, fullCommand);
     }
     deduplicateTools(tools) {
         const seen = new Map();
         for (const tool of tools){
-            // Use full command as key for deduplication
             const key = tool.fullCommand;
             if (!seen.has(key)) {
                 seen.set(key, tool);
@@ -18943,9 +18944,7 @@ class FileSystemWorkflowGateway {
                 const workflow = (0,dist/* .parse */.qg)(content);
                 const candidates = extractSetupStepsFromWorkflow(workflow, config.setupActionPatterns);
                 allCandidates.push(...candidates);
-            } catch  {
-            // Skip unreadable or malformed YAML workflow files while continuing scan.
-            }
+            } catch  {}
         }
         return deduplicateCandidates(allCandidates);
     }
@@ -18982,8 +18981,7 @@ function createWorkflowGateway(cwd) {
 ;// CONCATENATED MODULE: ../core/src/gateways/workflow-gateway.ts
 /**
  * Gateway interface for GitHub Actions workflow operations.
- */ // Re-export implementation and factory from the implementation file
-
+ */ 
 
 ;// CONCATENATED MODULE: ../core/src/gateways/index.ts
 /**
@@ -19169,7 +19167,6 @@ function isCopilotCodeScanningRule(rule) {
  * This module handles the logic of determining which GitHub Actions
  * setup steps should be added based on detected version files and package managers.
  */ 
-
 /**
  * Creates an ActionVersionPort backed by a static version map.
  */ function createActionVersionPort(versionMap) {
@@ -42031,16 +42028,14 @@ function hasFrontmatterDelimiters(content) {
     return false;
 }
 
-;// CONCATENATED MODULE: ../lint/src/validate-directory.ts
+;// CONCATENATED MODULE: ../lint/src/lint-errors.ts
 /**
- * Directory path validation for the public lint API.
+ * Public lint API error types.
  *
- * Validates user-supplied directory paths by rejecting unsafe inputs
- * (control characters, path traversal, null bytes) and canonicalizing
- * the path via `realpath()` for cross-platform compatibility.
- */ 
-
-/**
+ * Kept separate from filesystem-backed validation internals so the public
+ * package barrel can export stable error contracts without depending on
+ * implementation modules.
+ */ /**
  * Thrown when user-supplied directory input fails validation.
  *
  * Consumers can catch this type to distinguish user-input errors
@@ -42051,6 +42046,17 @@ function hasFrontmatterDelimiters(content) {
         this.name = "LintValidationError";
     }
 }
+
+;// CONCATENATED MODULE: ../lint/src/validate-directory.ts
+/**
+ * Directory path validation for the public lint API.
+ *
+ * Validates user-supplied directory paths by rejecting unsafe inputs
+ * (control characters, path traversal, null bytes) and canonicalizing
+ * the path via `realpath()` for cross-platform compatibility.
+ */ 
+
+
 function isControlCharacter(code) {
     if (code >= 0x00 && code <= 0x1f) return true;
     if (code === 0x7f) return true;
@@ -42071,8 +42077,17 @@ function containsControlCharacters(value) {
 function sanitizeForErrorMessage(value) {
     return JSON.stringify(value);
 }
-function hasPathTraversalSegment(directory) {
-    return directory.split(/[\\/]/).includes("..");
+/**
+ * Detects path traversal segments in a user-supplied directory string.
+ *
+ * On Windows, both '/' and '\' are path separators, so the check splits on
+ * both. On POSIX, '\' is a valid filename character (not a separator), so only
+ * '/' is used as the split boundary to avoid false-rejecting legitimate paths
+ * whose names contain backslashes. Any `platform` value other than `'win32'`
+ * is treated as POSIX.
+ */ function hasPathTraversalSegment(directory, platform = process.platform) {
+    const separator = platform === "win32" ? /[\\/]/ : "/";
+    return directory.split(separator).includes("..");
 }
 /**
  * Validates a user-supplied directory path for safety and existence.
@@ -42083,9 +42098,14 @@ function hasPathTraversalSegment(directory) {
  * the canonicalized absolute path (all symlinks resolved) so downstream
  * code always operates on real paths.
  *
+ * @param directory - The path to validate.
+ * @param platform - The platform identifier used for path-separator detection.
+ *   Defaults to `process.platform`. Only `'win32'` uses `\` as a separator;
+ *   all other values are treated as POSIX. Overridable for cross-platform unit
+ *   tests so that both branches can be exercised on any host OS.
  * @throws {LintValidationError} If the path is empty, contains control
  *   characters, traversal segments, does not exist, or is not a directory.
- */ async function validateDirectory(directory) {
+ */ async function validateDirectory(directory, platform = process.platform) {
     if (directory.length === 0) {
         throw new LintValidationError("directory must not be empty");
     }
@@ -42093,7 +42113,7 @@ function hasPathTraversalSegment(directory) {
     if (containsControlCharacters(directory)) {
         throw new LintValidationError(`Invalid directory path (contains control characters): ${safeDir}`);
     }
-    if (hasPathTraversalSegment(directory)) {
+    if (hasPathTraversalSegment(directory, platform)) {
         throw new LintValidationError(`Invalid directory path (path traversal detected): ${safeDir}`);
     }
     const resolved = (0,external_node_path_.resolve)(directory);
@@ -42147,6 +42167,7 @@ function hasPathTraversalSegment(directory) {
 
 
 
+
 const LintTargetsSchema = schemas_object({
     skills: schemas_boolean().optional(),
     agents: schemas_boolean().optional(),
@@ -42155,7 +42176,14 @@ const LintTargetsSchema = schemas_object({
 }).strict().optional();
 const LintOptionsSchema = schemas_object({
     directory: schemas_string().min(1, "directory must not be empty"),
-    targets: LintTargetsSchema
+    targets: LintTargetsSchema,
+    // logger is a runtime object — `z.custom` validates its structural contract
+    // at the boundary; TypeScript enforces it further at compile time.
+    // `v === undefined` is NOT needed here: ZodOptional intercepts undefined
+    // before the predicate is invoked, so the guard would be dead code.
+    logger: custom((v)=>v !== null && typeof v === "object" && typeof v.warn === "function", {
+        message: "logger must be an object with a .warn method"
+    }).optional()
 }).strict();
 /** Converts a use-case lint output to the unified LintOutput shape. */ function toLintOutput(output, target, totalFiles) {
     const diagnostics = [];
@@ -42208,10 +42236,10 @@ async function lintHooks(targetDir) {
     });
     return toLintOutput(output, "hook", output.totalFiles);
 }
-async function lintInstructions(targetDir) {
+async function lintInstructions(targetDir, logger) {
     const discoveryGateway = createInstructionFileDiscoveryGateway();
     const astGateway = createMarkdownAstGateway();
-    const commandsGateway = createFeedbackLoopCommandsGateway();
+    const commandsGateway = createFeedbackLoopCommandsGateway(undefined, logger);
     const useCase = new AnalyzeInstructionQualityUseCase(discoveryGateway, astGateway, commandsGateway);
     const output = await useCase.execute({
         targetDir
@@ -42230,24 +42258,6 @@ async function lintInstructions(targetDir) {
         }
     };
 }
-const LINT_TARGETS = [
-    {
-        key: "skills",
-        execute: lintSkills
-    },
-    {
-        key: "agents",
-        execute: lintAgents
-    },
-    {
-        key: "hooks",
-        execute: lintHooks
-    },
-    {
-        key: "instructions",
-        execute: lintInstructions
-    }
-];
 function isTargetEnabled(key, targets) {
     if (!targets) return true;
     const hasAnyEnabled = Object.values(targets).some(Boolean);
@@ -42291,7 +42301,25 @@ function isTargetEnabled(key, targets) {
         }
         throw error;
     }
-    const enabledTargets = LINT_TARGETS.filter((t)=>isTargetEnabled(t.key, parsed.targets));
+    const lintTargets = [
+        {
+            key: "skills",
+            execute: lintSkills
+        },
+        {
+            key: "agents",
+            execute: lintAgents
+        },
+        {
+            key: "hooks",
+            execute: lintHooks
+        },
+        {
+            key: "instructions",
+            execute: (dir)=>lintInstructions(dir, parsed.logger)
+        }
+    ];
+    const enabledTargets = lintTargets.filter((t)=>isTargetEnabled(t.key, parsed.targets));
     const outputs = [];
     for (const target of enabledTargets){
         const rawOutput = await target.execute(targetDir);
@@ -42321,9 +42349,7 @@ function isTargetEnabled(key, targets) {
  *   console.error(formatter.format(result.outputs));
  * }
  * ```
- */ // ── Instruction quality result types (returned in LintOutput) ────────
-
-// ── Output formatters ────────────────────────────────────────────────
+ */ 
 
 
 
@@ -42574,7 +42600,6 @@ You are a ${normalizedName} agent specialized in {domain/responsibility}.
      * @param agentName The name of the agent to create
      * @returns Result of the operation
      */ async execute(targetDir, agentName) {
-        // Validate the agent name using Zod schema
         const validationResult = AgentNameSchema.safeParse(agentName);
         if (!validationResult.success) {
             const errorMessage = validationResult.error.issues[0]?.message ?? "Invalid agent name";
@@ -42583,18 +42608,14 @@ You are a ${normalizedName} agent specialized in {domain/responsibility}.
                 error: errorMessage
             };
         }
-        // Normalize the agent name
         const normalizedName = normalizeAgentName(validationResult.data);
-        // Validate that the normalized name is not empty (handles whitespace-only input)
         if (!normalizedName) {
             return {
                 success: false,
                 error: "Agent name is required"
             };
         }
-        // Get the file path
         const filePath = this.gateway.getAgentFilePath(targetDir, normalizedName);
-        // Check if the file already exists
         if (await this.gateway.agentFileExists(targetDir, normalizedName)) {
             return {
                 success: false,
@@ -42602,11 +42623,8 @@ You are a ${normalizedName} agent specialized in {domain/responsibility}.
                 filePath
             };
         }
-        // Ensure the directory exists
         await this.gateway.ensureAgentsDirectory(targetDir);
-        // Generate the content
         const content = generateAgentContent(normalizedName);
-        // Write the file
         await this.gateway.writeAgentFile(targetDir, normalizedName, content);
         return {
             success: true,
@@ -42702,7 +42720,6 @@ Copilot should use this skill when:
      * @param skillName The name of the skill to create
      * @returns Result of the operation
      */ async execute(targetDir, skillName) {
-        // Validate the skill name using Zod schema
         const validationResult = SkillNameSchema.safeParse(skillName);
         if (!validationResult.success) {
             const errorMessage = validationResult.error.issues[0]?.message ?? "Invalid skill name";
@@ -42711,19 +42728,15 @@ Copilot should use this skill when:
                 error: errorMessage
             };
         }
-        // Normalize the skill name
         const normalizedName = normalizeSkillName(validationResult.data);
-        // Validate that the normalized name is not empty (handles whitespace-only input)
         if (!normalizedName) {
             return {
                 success: false,
                 error: "Skill name is required"
             };
         }
-        // Get the paths
         const skillDirectoryPath = this.gateway.getSkillDirectoryPath(targetDir, normalizedName);
         const skillFilePath = this.gateway.getSkillFilePath(targetDir, normalizedName);
-        // Check if the skill directory already exists
         if (await this.gateway.skillDirectoryExists(targetDir, normalizedName)) {
             return {
                 success: false,
@@ -42731,11 +42744,8 @@ Copilot should use this skill when:
                 skillDirectoryPath
             };
         }
-        // Ensure the skill directory exists
         await this.gateway.ensureSkillDirectory(targetDir, normalizedName);
-        // Generate the content
         const content = generateSkillContent(normalizedName);
-        // Write the SKILL.md file
         await this.gateway.writeSkillFile(targetDir, normalizedName, content);
         return {
             success: true,
@@ -51678,4 +51688,4 @@ if (installedChunkData !== 0) { // 0 means "already installed".'
 // module factories are used so entry inlining is disabled
 // startup
 // Load entry module and return exports
-var __webpack_exports__ = __webpack_require__(1792);
+var __webpack_exports__ = __webpack_require__(2091);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@lousy-agents/cli",
-    "version": "5.13.0",
+    "version": "5.13.2",
     "description": "CLI scaffolding tool that sets up projects with structure, instructions, and feedback loops for AI coding assistants",
     "type": "module",
     "repository": {
@@ -45,7 +45,7 @@
         "citty": "0.2.2",
         "consola": "3.4.2",
         "eta": "4.6.0",
-        "zod": "4.4.2"
+        "zod": "4.4.3"
     },
     "devDependencies": {
         "@lousy-agents/core": "*",

package/ui/copilot-with-react/.devcontainer/devcontainer.json

@@ -10,7 +10,7 @@
         },
         "ghcr.io/devcontainers/features/copilot-cli:1.0.0": {},
         "ghcr.io/anthropics/devcontainer-features/claude-code:1": {
-            "version": "v2.1.126"
+            "version": "v2.1.131"
         },
         "ghcr.io/rocker-org/devcontainer-features/apt-packages:1.0.2": {
             "packages": "libnss3, libnspr4, libatk1.0-0t64, libatk-bridge2.0-0t64, libcups2t64, libdrm2, libdbus-1-3, libatspi2.0-0t64, libxcomposite1, libxdamage1, libxfixes3, libxrandr2, libgbm1, libxkbcommon0, libasound2t64, yamllint, shellcheck",

package/ui/copilot-with-react/package.json

@@ -17,20 +17,20 @@
         "@mui/material": "9.0.0",
         "@mui/material-nextjs": "9.0.0",
         "next": "16.2.4",
-        "react": "19.2.5",
-        "react-dom": "19.2.5"
+        "react": "19.2.6",
+        "react-dom": "19.2.6"
     },
     "devDependencies": {
         "@biomejs/biome": "2.4.14",
         "@eslint/eslintrc": "3.3.5",
-        "@lousy-agents/mcp": "5.12.2",
+        "@lousy-agents/mcp": "5.13.1",
         "@modelcontextprotocol/server-sequential-thinking": "2025.12.18",
         "@testing-library/jest-dom": "6.9.1",
         "@testing-library/react": "16.3.2",
         "@types/node": "24.12.2",
         "@types/react": "19.2.14",
         "@types/react-dom": "19.2.3",
-        "@upstash/context7-mcp": "2.2.3",
+        "@upstash/context7-mcp": "2.2.4",
         "@vitejs/plugin-react": "6.0.1",
         "@vitest/ui": "4.1.5",
         "eslint": "10.3.0",