@massu/core 0.9.2 → 1.1.0

package/src/detect/source-dir-detector.ts

@@ -0,0 +1,264 @@
+// Copyright (c) 2026 Massu. All rights reserved.
+// Licensed under BSL 1.1 - see LICENSE file for details.
+
+/**
+ * Source Directory Detector (P1-003)
+ * ==================================
+ *
+ * For each detected language, glob files of that type repo-wide (honoring
+ * .gitignore and a hard-coded ignore set), then cluster by common prefix
+ * directory and pick the directory with the highest file density.
+ *
+ * Handles:
+ *   - Colocated tests (src/**​/*.test.ts next to source). Sets `colocated: true`
+ *     on the language entry when test files are <30% of a dir's file count
+ *     AND no dedicated tests/__tests__/ dir exists.
+ *   - Top-level `tests/` or `__tests__/` directories (honored as test_dirs).
+ *   - Monorepo packages/apps/services/libs/modules subtrees (each treated as
+ *     a workspace root).
+ *
+ * Security (CR-3, CR-9):
+ *   - Glob roots strictly inside projectRoot. Symlinks escaping projectRoot
+ *     are rejected.
+ *   - Secret-ish files (.env*, *.pem, *.key, .aws/, .ssh/, credentials.json)
+ *     are excluded from globs.
+ *   - Only the filename is ever read — never file contents.
+ *
+ * Usage:
+ * ```ts
+ * import { detectSourceDirs } from './detect/source-dir-detector.ts';
+ * const map = detectSourceDirs('/repo', ['python', 'typescript']);
+ * ```
+ */
+
+import { realpathSync } from 'fs';
+import { resolve } from 'path';
+import fg from 'fast-glob';
+import type { SupportedLanguage } from './package-detector.ts';
+
+export interface SourceDirInfo {
+  /** Source directories (relative to projectRoot, forward-slash). */
+  source_dirs: string[];
+  /** Test directories (relative to projectRoot, forward-slash). */
+  test_dirs: string[];
+  /** True when tests live next to source (no dedicated tests/ dir). */
+  colocated: boolean;
+  /** Number of source files detected for this language. */
+  file_count: number;
+}
+
+export type SourceDirMap = Partial<Record<SupportedLanguage, SourceDirInfo>>;
+
+const IGNORE_PATTERNS: string[] = [
+  '**/node_modules/**',
+  '**/.venv/**',
+  '**/venv/**',
+  '**/__pycache__/**',
+  '**/dist/**',
+  '**/build/**',
+  '**/.build/**',
+  '**/target/**',
+  '**/.next/**',
+  '**/.nuxt/**',
+  '**/coverage/**',
+  '**/.git/**',
+  '**/.massu/**',
+  '**/.turbo/**',
+  '**/.cache/**',
+  '**/.pytest_cache/**',
+  '**/.mypy_cache/**',
+  '**/DerivedData/**',
+  '**/Pods/**',
+  // Secret-ish patterns
+  '**/.env',
+  '**/.env.*',
+  '**/*.pem',
+  '**/*.key',
+  '**/.aws/**',
+  '**/.ssh/**',
+  '**/credentials.json',
+  '**/*.p12',
+  '**/*.pfx',
+];
+
+const EXTENSIONS: Record<SupportedLanguage, string[]> = {
+  python: ['py'],
+  typescript: ['ts', 'tsx'],
+  javascript: ['js', 'jsx', 'mjs', 'cjs'],
+  rust: ['rs'],
+  swift: ['swift'],
+  go: ['go'],
+  java: ['java', 'kt'],
+  ruby: ['rb'],
+};
+
+const TEST_FILE_PATTERNS: Record<SupportedLanguage, RegExp[]> = {
+  python: [/_test\.py$/, /test_[^/]*\.py$/],
+  typescript: [/\.test\.tsx?$/, /\.spec\.tsx?$/],
+  javascript: [/\.test\.[mc]?jsx?$/, /\.spec\.[mc]?jsx?$/],
+  rust: [/tests\/.*\.rs$/],
+  swift: [/Tests\//],
+  go: [/_test\.go$/],
+  java: [/Test[^/]*\.(java|kt)$/, /[^/]*Test\.(java|kt)$/],
+  ruby: [/_spec\.rb$/, /_test\.rb$/],
+};
+
+const TEST_DIR_KEYWORDS = ['tests', 'test', '__tests__', 'spec', 'specs'];
+
+function extsFor(language: SupportedLanguage): string[] {
+  return EXTENSIONS[language] ?? [];
+}
+
+function isTestPath(language: SupportedLanguage, path: string): boolean {
+  // Any dedicated test-dir keyword in the path segments
+  const segments = path.split('/');
+  for (const seg of segments) {
+    if (TEST_DIR_KEYWORDS.includes(seg)) return true;
+  }
+  const patterns = TEST_FILE_PATTERNS[language] ?? [];
+  return patterns.some((re) => re.test(path));
+}
+
+/** Get the top-level directory segment of a relative path (or '.' for root). */
+function topSegment(rel: string): string {
+  const parts = rel.split('/');
+  return parts.length > 1 ? parts[0] : '.';
+}
+
+/**
+ * Check that a path (after realpath) is inside the projectRoot.
+ * Symlinks escaping the tree are rejected.
+ */
+function isInsideRoot(root: string, candidate: string): boolean {
+  try {
+    const realRoot = realpathSync(root);
+    const realCand = realpathSync(resolve(root, candidate));
+    return realCand === realRoot || realCand.startsWith(realRoot + '/');
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Detect source and test directories per language.
+ *
+ * @param projectRoot absolute path to repo root
+ * @param languages   list of languages to probe (derived from P1-001 manifests)
+ */
+export function detectSourceDirs(
+  projectRoot: string,
+  languages: SupportedLanguage[]
+): SourceDirMap {
+  const out: SourceDirMap = {};
+  for (const lang of languages) {
+    const exts = extsFor(lang);
+    if (exts.length === 0) continue;
+    const patterns = exts.map((e) => `**/*.${e}`);
+    let files: string[];
+    try {
+      files = fg.sync(patterns, {
+        cwd: projectRoot,
+        dot: false,
+        ignore: IGNORE_PATTERNS,
+        followSymbolicLinks: false,
+        suppressErrors: true,
+      });
+    } catch {
+      files = [];
+    }
+
+    // Drop any file whose resolved realpath escapes the root (defence in depth).
+    files = files.filter((f) => isInsideRoot(projectRoot, f));
+
+    if (files.length === 0) {
+      continue;
+    }
+
+    // Split into source vs test files.
+    const sourceFiles: string[] = [];
+    const testFiles: string[] = [];
+    for (const f of files) {
+      if (isTestPath(lang, f)) testFiles.push(f);
+      else sourceFiles.push(f);
+    }
+
+    // Cluster by top segment.
+    const srcCluster = new Map<string, number>();
+    for (const f of sourceFiles) {
+      const k = topSegment(f);
+      srcCluster.set(k, (srcCluster.get(k) ?? 0) + 1);
+    }
+    const testCluster = new Map<string, number>();
+    for (const f of testFiles) {
+      const k = topSegment(f);
+      testCluster.set(k, (testCluster.get(k) ?? 0) + 1);
+    }
+
+    const source_dirs: string[] = [];
+    const test_dirs: string[] = [];
+
+    // Any top segment with at least one source file counts.
+    // Sort by density desc, then name asc for determinism.
+    const srcSorted = [...srcCluster.entries()].sort((a, b) => {
+      if (b[1] !== a[1]) return b[1] - a[1];
+      return a[0].localeCompare(b[0]);
+    });
+    for (const [seg] of srcSorted) source_dirs.push(seg);
+
+    // Test dirs: any top-level dir named in TEST_DIR_KEYWORDS that accrued files,
+    // plus any top segment with test files.
+    const testSet = new Set<string>();
+    for (const [seg] of testCluster.entries()) {
+      if (TEST_DIR_KEYWORDS.includes(seg)) testSet.add(seg);
+    }
+    // Also pick up "tests/" under each source dir — e.g. apps/ai-service/tests/
+    // Glob again just for test dirs this language may have.
+    let testDirHits: string[] = [];
+    try {
+      testDirHits = fg.sync(
+        TEST_DIR_KEYWORDS.map((k) => `**/${k}/**/*.${exts[0]}`),
+        {
+          cwd: projectRoot,
+          dot: false,
+          ignore: IGNORE_PATTERNS,
+          followSymbolicLinks: false,
+          suppressErrors: true,
+        }
+      );
+    } catch {
+      testDirHits = [];
+    }
+    const testPrefixes = new Set<string>();
+    for (const f of testDirHits) {
+      // Keep the prefix up to and including the test keyword dir
+      const segs = f.split('/');
+      for (let i = 0; i < segs.length; i++) {
+        if (TEST_DIR_KEYWORDS.includes(segs[i])) {
+          testPrefixes.add(segs.slice(0, i + 1).join('/'));
+          break;
+        }
+      }
+    }
+    for (const p of testPrefixes) testSet.add(p);
+    for (const seg of testSet) test_dirs.push(seg);
+    test_dirs.sort();
+
+    // Colocated if test_dirs set is empty AND test files exist AND testFiles/(src+test) < 0.3
+    const totalFiles = sourceFiles.length + testFiles.length;
+    const testRatio = totalFiles === 0 ? 0 : testFiles.length / totalFiles;
+    const hasDedicatedTestDir = test_dirs.length > 0;
+    const colocated =
+      !hasDedicatedTestDir && testFiles.length > 0 && testRatio < 0.3;
+    if (colocated) {
+      for (const s of source_dirs) if (!test_dirs.includes(s)) test_dirs.push(s);
+    }
+
+    out[lang] = {
+      source_dirs,
+      test_dirs,
+      colocated,
+      file_count: files.length,
+    };
+  }
+  return out;
+}

package/src/detect/vr-command-map.ts

@@ -0,0 +1,167 @@
+// Copyright (c) 2026 Massu. All rights reserved.
+// Licensed under BSL 1.1 - see LICENSE file for details.
+
+/**
+ * VR Command Map (P1-005)
+ * =======================
+ *
+ * Given a language + framework info + workspace directory, produce the
+ * verification command set (VR-TEST, VR-TYPE, VR-BUILD, VR-SYNTAX, VR-LINT)
+ * that the skill runners should invoke.
+ *
+ * User overrides from `massu.config.yaml` `verification.<language>.*` take
+ * precedence over the built-in mapping.
+ *
+ * Usage:
+ * ```ts
+ * import { getVRCommands } from './detect/vr-command-map.ts';
+ * const cmds = getVRCommands('python', { test_framework: 'pytest', ... }, 'apps/ai-service');
+ * // => { test: 'cd apps/ai-service && python3 -m pytest -q', ... }
+ * ```
+ */
+
+import type { SupportedLanguage } from './package-detector.ts';
+import type { FrameworkInfo } from './framework-detector.ts';
+
+export interface VRCommandSet {
+  /** VR-TEST command. */
+  test: string | null;
+  /** VR-TYPE command. */
+  type: string | null;
+  /** VR-BUILD command. */
+  build: string | null;
+  /** VR-SYNTAX command. */
+  syntax: string | null;
+  /** VR-LINT command. */
+  lint: string | null;
+}
+
+/** Shape read from `config.verification[<language>]`. */
+export interface UserVerificationEntry {
+  type?: string;
+  test?: string;
+  syntax?: string;
+  lint?: string;
+  build?: string;
+}
+
+function prefix(dir: string, cmd: string): string {
+  if (!dir || dir === '.') return cmd;
+  return `cd ${dir} && ${cmd}`;
+}
+
+function defaultsFor(
+  language: SupportedLanguage,
+  fw: FrameworkInfo,
+  dir: string
+): VRCommandSet {
+  switch (language) {
+    case 'python': {
+      const testFw = fw.test_framework ?? 'pytest';
+      return {
+        test:
+          testFw === 'unittest'
+            ? prefix(dir, 'python3 -m unittest')
+            : prefix(dir, 'python3 -m pytest -q'),
+        type: prefix(dir, 'python3 -m mypy .'),
+        build: null,
+        syntax: prefix(dir, 'python3 -m py_compile'),
+        lint: prefix(dir, 'python3 -m ruff check .'),
+      };
+    }
+    case 'typescript': {
+      const testFw = fw.test_framework ?? 'vitest';
+      // Test command uses npm test (respecting package.json script); fallback mapping
+      // is fine because npm test routes through whatever runner is wired.
+      return {
+        test: prefix(dir, 'npm test'),
+        type: prefix(dir, 'npx tsc --noEmit'),
+        build: prefix(dir, 'npm run build'),
+        syntax: null,
+        lint: prefix(dir, 'npx eslint .'),
+        // testFw currently only affects defaults; npm test is runner-agnostic
+        ...(testFw === 'mocha'
+          ? { test: prefix(dir, 'npx mocha') }
+          : {}),
+      };
+    }
+    case 'javascript': {
+      return {
+        test: prefix(dir, 'npm test'),
+        type: null,
+        build: prefix(dir, 'npm run build'),
+        syntax: null,
+        lint: prefix(dir, 'npx eslint .'),
+      };
+    }
+    case 'rust': {
+      return {
+        test: prefix(dir, 'cargo test'),
+        type: prefix(dir, 'cargo check'),
+        build: prefix(dir, 'cargo build'),
+        syntax: null,
+        lint: prefix(dir, 'cargo clippy -- -D warnings'),
+      };
+    }
+    case 'swift': {
+      return {
+        test: prefix(dir, 'swift test'),
+        type: prefix(dir, 'swift build'),
+        build: prefix(dir, 'xcodebuild build'),
+        syntax: null,
+        lint: prefix(dir, 'swiftlint'),
+      };
+    }
+    case 'go': {
+      return {
+        test: prefix(dir, 'go test ./...'),
+        type: prefix(dir, 'go vet ./...'),
+        build: prefix(dir, 'go build ./...'),
+        syntax: null,
+        lint: prefix(dir, 'golangci-lint run'),
+      };
+    }
+    case 'java': {
+      return {
+        test: prefix(dir, 'mvn test'),
+        type: prefix(dir, 'mvn compile'),
+        build: prefix(dir, 'mvn package'),
+        syntax: null,
+        lint: null,
+      };
+    }
+    case 'ruby': {
+      return {
+        test: prefix(dir, 'bundle exec rspec'),
+        type: null,
+        build: null,
+        syntax: prefix(dir, 'ruby -c'),
+        lint: prefix(dir, 'bundle exec rubocop'),
+      };
+    }
+    default:
+      return { test: null, type: null, build: null, syntax: null, lint: null };
+  }
+}
+
+/**
+ * Produce the VR command set for a language.
+ *
+ * User-provided entries (if any) override built-ins key-by-key.
+ */
+export function getVRCommands(
+  language: SupportedLanguage,
+  framework: FrameworkInfo,
+  dir: string,
+  userOverrides?: UserVerificationEntry
+): VRCommandSet {
+  const built = defaultsFor(language, framework, dir);
+  if (!userOverrides) return built;
+  return {
+    test: userOverrides.test ?? built.test,
+    type: userOverrides.type ?? built.type,
+    build: userOverrides.build ?? built.build,
+    syntax: userOverrides.syntax ?? built.syntax,
+    lint: userOverrides.lint ?? built.lint,
+  };
+}

package/src/hooks/auto-learning-pipeline.ts

@@ -17,7 +17,7 @@
 // ============================================================
 
 import { execSync } from 'child_process';
-import { existsSync, readFileSync, unlinkSync, readdirSync } from 'fs';
+import { existsSync, readFileSync, unlinkSync, readdirSync, statSync } from 'fs';
 import { tmpdir } from 'os';
 import { join } from 'path';
 import { getProjectRoot, getConfig } from '../config.ts';
@@ -172,7 +172,7 @@ function cleanup(flagPath: string): void {
       for (const file of readdirSync(dir)) {
         const fullPath = join(dir, file);
         try {
-          const stat = require('fs').statSync(fullPath);
+          const stat = statSync(fullPath);
           if (now - stat.mtimeMs > 86400000) {
             unlinkSync(fullPath);
           }

package/src/hooks/classify-failure.ts

@@ -20,7 +20,7 @@
 // Must complete in <1000ms.
 // ============================================================
 
-import { existsSync, readFileSync, readdirSync, unlinkSync } from 'fs';
+import { existsSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from 'fs';
 import { tmpdir } from 'os';
 import { join, basename } from 'path';
 import { getProjectRoot, getConfig } from '../config.ts';
@@ -166,7 +166,7 @@ async function main(): Promise<void> {
 
     // Mark that we've classified this file
     try {
-      require('fs').writeFileSync(dedupeMarker, '1');
+      writeFileSync(dedupeMarker, '1');
     } catch { /* ignore */ }
 
     // Score against failure taxonomy in database

package/src/hooks/fix-detector.ts

@@ -15,7 +15,7 @@
 // ============================================================
 
 import { execSync } from 'child_process';
-import { existsSync, appendFileSync, mkdirSync } from 'fs';
+import { existsSync, appendFileSync, mkdirSync, readFileSync } from 'fs';
 import { tmpdir } from 'os';
 import { join } from 'path';
 import { getProjectRoot, getConfig } from '../config.ts';
@@ -158,7 +158,7 @@ async function main(): Promise<void> {
     appendFileSync(flagPath, JSON.stringify(signal) + '\n');
 
     // Count total fixes this session
-    const lines = require('fs').readFileSync(flagPath, 'utf-8').split('\n').filter(Boolean);
+    const lines = readFileSync(flagPath, 'utf-8').split('\n').filter(Boolean);
     if (lines.length === 1) {
       // First fix detected — output advisory
       console.log(

package/src/hooks/session-start.ts

@@ -11,8 +11,11 @@
 import { getMemoryDb, getSessionSummaries, getRecentObservations, getFailedAttempts, getCrossTaskProgress, autoDetectTaskId, linkSessionToTask, createSession } from '../memory-db.ts';
 import { getConfig, getResolvedPaths } from '../config.ts';
 import { readFileSync, existsSync } from 'fs';
-import { join } from 'path';
+import { join, resolve } from 'path';
+import { parse as parseYaml } from 'yaml';
 import type Database from 'better-sqlite3';
+import { runDetection } from '../detect/index.ts';
+import { computeFingerprint } from '../detect/drift.ts';
 
 interface HookInput {
   session_id: string;
@@ -52,7 +55,7 @@ async function main(): Promise<void> {
         process.stdout.write(
           '=== MASSU AI: Active ===\n' +
           'Session memory, code intelligence, and governance are now active.\n' +
-          `15 hooks monitoring this session. Type "${getConfig().toolPrefix ?? 'massu'}_sync" to index your codebase.\n` +
+          `11 hooks monitoring this session. Type "${getConfig().toolPrefix ?? 'massu'}_sync" to index your codebase.\n` +
           '=== END MASSU ===\n\n'
         );
       }
@@ -63,6 +66,12 @@ async function main(): Promise<void> {
       if (context.trim()) {
         process.stdout.write(context);
       }
+
+      // P5-001: drift banner (runs after memory context, independent of it).
+      const driftBanner = await buildDriftBanner();
+      if (driftBanner) {
+        process.stdout.write(driftBanner);
+      }
     } finally {
       db.close();
     }
@@ -244,6 +253,38 @@ function readStdin(): Promise<string> {
   });
 }
 
+/**
+ * P5-001: compare the fingerprint stored in massu.config.yaml (detection.fingerprint,
+ * stamped by init/refresh/upgrade) against a freshly-computed fingerprint. If they
+ * disagree, return a plain-text banner. Returns '' on any error or when the
+ * config has no fingerprint (back-compat with v1 configs).
+ */
+async function buildDriftBanner(): Promise<string> {
+  try {
+    const configPath = resolve(process.cwd(), 'massu.config.yaml');
+    if (!existsSync(configPath)) return '';
+    const content = readFileSync(configPath, 'utf-8');
+    const parsed = parseYaml(content) as Record<string, unknown> | null;
+    if (!parsed || typeof parsed !== 'object') return '';
+    const det = parsed.detection as Record<string, unknown> | undefined;
+    const storedFp = typeof det?.fingerprint === 'string' ? (det.fingerprint as string) : null;
+    if (!storedFp) return '';
+    const detection = await runDetection(process.cwd());
+    const currentFp = computeFingerprint(detection);
+    if (currentFp === storedFp) return '';
+    return (
+      '=== Massu Config Drift ===\n' +
+      'Detected stack has changed since last config refresh.\n' +
+      `Fingerprint:  ${storedFp.slice(0, 16)}  ->  ${currentFp.slice(0, 16)}\n` +
+      'Run: npx massu config refresh\n' +
+      '=== END ===\n'
+    );
+  } catch (_e) {
+    // Never block session start on drift-check failure.
+    return '';
+  }
+}
+
 function safeParseJson(json: string): Record<string, string> | null {
   try {
     return JSON.parse(json);

package/src/hooks/user-prompt.ts

@@ -8,9 +8,7 @@
 // ============================================================
 
 import { getMemoryDb, createSession, addUserPrompt, linkSessionToTask, autoDetectTaskId, addObservation } from '../memory-db.ts';
-import { existsSync, writeFileSync } from 'fs';
-import { tmpdir } from 'os';
-import { join } from 'path';
+import { existsSync } from 'fs';
 import { getResolvedPaths } from '../config.ts';
 
 interface HookInput {
@@ -109,24 +107,6 @@ async function main(): Promise<void> {
       } catch (_memoryNagErr) {
         // Best-effort: never block prompt capture
       }
-
-      // 7. Failure context markers: write detected failure keywords to temp file
-      //    so classify-failure.ts can use them for scoring
-      try {
-        const failureKeywords = [
-          'bug', 'broken', 'crash', 'error', 'fail', 'fix', 'wrong', 'missing',
-          'undefined', 'null', 'exception', 'stack trace', 'regression', 'revert',
-          'doesn\'t work', 'not working', 'stopped working', 'broke',
-        ];
-        const promptLower = prompt.toLowerCase();
-        const matched = failureKeywords.filter(kw => promptLower.includes(kw));
-        if (matched.length > 0) {
-          const contextFile = join(tmpdir(), `massu-failure-context-${session_id.slice(0, 8)}-${Date.now()}`);
-          writeFileSync(contextFile, matched.join(' '), 'utf-8');
-        }
-      } catch {
-        // Best-effort: never block prompt capture
-      }
     } finally {
       db.close();
     }

package/src/knowledge-indexer.ts

@@ -599,7 +599,7 @@ export function indexAllKnowledge(db: Database.Database): IndexStats {
       // Parse plan documents for structured metadata
       if (category === 'plan') {
         // Extract plan items (P1-001, P2-001, etc.)
-        const planItemRegex = /^###\s+(P[-A-Z]*\d*-?\w+):\s+(.+)$/gm;
+        const planItemRegex = /^###\s+(P\d+-\d+):\s+(.+)$/gm;
         let planMatch;
         while ((planMatch = planItemRegex.exec(content)) !== null) {
           insertChunk.run(docId, 'pattern', planMatch[1], `${planMatch[1]}: ${planMatch[2]}`, null, null, JSON.stringify({ plan_item_id: planMatch[1] }));

package/src/license.ts

@@ -54,7 +54,7 @@ export function tierLevel(tier: ToolTier): number {
  * Enterprise: audit, security, dependency
  */
 export const TOOL_TIER_MAP: Record<string, ToolTier> = {
-  // --- Free tier (13 tools: core navigation + basic memory + regression + license) ---
+  // --- Free tier (12 tools: core navigation + basic memory + regression + license) ---
   sync: 'free',
   context: 'free',
   impact: 'free',
@@ -64,7 +64,6 @@ export const TOOL_TIER_MAP: Record<string, ToolTier> = {
   coupling_check: 'free',
   memory_search: 'free',
   memory_ingest: 'free',
-  memory_backfill: 'free',
   regression_risk: 'free',
   feature_health: 'free',
   license_status: 'free',

package/src/memory-db.ts

@@ -1509,11 +1509,6 @@ export interface FailureClassMatch {
 /**
  * Score all failure classes against provided match text, file path, and prompt context.
  * Returns the best match with its score.
- *
- * Scoring:
- *   +diffPatternWeight (default 3) per diff_pattern match
- *   +filePatternWeight (default 2) per file_pattern match
- *   +promptKeywordWeight (default 2) per prompt_keyword match
  */
 export function scoreFailureClasses(
   db: Database.Database,

package/src/memory-file-ingest.ts

@@ -11,6 +11,7 @@
 import type Database from 'better-sqlite3';
 import { readFileSync, existsSync, readdirSync } from 'fs';
 import { join } from 'path';
+import { parse as parseYaml } from 'yaml';
 import { addObservation } from './memory-db.ts';
 
 export type IngestResult = 'inserted' | 'updated' | 'skipped';
@@ -41,21 +42,13 @@ export function ingestMemoryFile(
 
   if (frontmatterMatch) {
     try {
-      // Simple key: value parser for memory file frontmatter
-      // (avoids importing yaml library — frontmatter is flat key-value pairs)
-      const fm: Record<string, string> = {};
-      for (const line of frontmatterMatch[1].split('\n')) {
-        const sep = line.indexOf(':');
-        if (sep > 0) {
-          fm[line.slice(0, sep).trim()] = line.slice(sep + 1).trim();
-        }
-      }
-      name = fm.name ?? basename;
-      description = fm.description ?? '';
-      type = fm.type ?? 'discovery';
+      const fm = parseYaml(frontmatterMatch[1]) as Record<string, unknown>;
+      name = (fm.name as string) ?? basename;
+      description = (fm.description as string) ?? '';
+      type = (fm.type as string) ?? 'discovery';
       confidence = fm.confidence != null ? Number(fm.confidence) : undefined;
     } catch {
-      // Use defaults if frontmatter parsing fails
+      // Use defaults if YAML parsing fails
     }
   }