@massu/core 1.15.5 → 1.15.7

package/dist/cli.js

@@ -4132,11 +4132,15 @@ var init_permissions = __esm({
 // src/commands/install-commands.ts
 var install_commands_exports = {};
 __export(install_commands_exports, {
+  MASSU_OWNED_PATHS: () => MASSU_OWNED_PATHS,
   buildTemplateVars: () => buildTemplateVars,
+  canonicalizeOwned: () => canonicalizeOwned,
   hashContent: () => hashContent,
   installAll: () => installAll,
   installCommands: () => installCommands,
+  isMassuOwned: () => isMassuOwned,
   loadManifest: () => loadManifest,
+  massuOwnedSourceIsValid: () => massuOwnedSourceIsValid,
   pickVariant: () => pickVariant,
   resolveAssetDir: () => resolveAssetDir,
   resolveCommandsDir: () => resolveCommandsDir,
@@ -4155,25 +4159,51 @@ import {
 import { resolve as resolve6, dirname as dirname7, join as join6 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { createHash as createHash3 } from "crypto";
+function dirHoldsAssets(dir) {
+  if (!existsSync9(dir)) return false;
+  try {
+    return readdirSync3(dir).some(
+      (e2) => e2.endsWith(".md") || statSync2(resolve6(dir, e2)).isDirectory()
+    );
+  } catch {
+    return false;
+  }
+}
 function resolveAssetDir(assetName) {
   const cwd = process.cwd();
-  const nodeModulesPath = resolve6(cwd, "node_modules/@massu/core", assetName);
-  if (existsSync9(nodeModulesPath)) {
-    return nodeModulesPath;
-  }
-  const distRelPath = resolve6(__dirname, "..", assetName);
-  if (existsSync9(distRelPath)) {
-    return distRelPath;
-  }
-  const srcRelPath = resolve6(__dirname, "../..", assetName);
-  if (existsSync9(srcRelPath)) {
-    return srcRelPath;
+  const candidates = [
+    // 1. npm-installed: node_modules/@massu/core/{assetName}
+    resolve6(cwd, "node_modules/@massu/core", assetName),
+    // 2. Relative to compiled dist/cli.js → ../{assetName}
+    resolve6(__dirname, "..", assetName),
+    // 3. Relative to source src/commands/ → ../../{assetName}
+    resolve6(__dirname, "../..", assetName)
+  ];
+  for (const c2 of candidates) {
+    if (dirHoldsAssets(c2)) return c2;
   }
   return null;
 }
 function resolveCommandsDir() {
   return resolveAssetDir("commands");
 }
+function isMassuOwned(manifestKey) {
+  return MASSU_OWNED_PATHS.includes(manifestKey);
+}
+function canonicalizeOwned(content) {
+  return content.replace(/\r\n/g, "\n").split("\n").map((l2) => l2.replace(/\s+$/, "")).join("\n").trim();
+}
+function massuOwnedSourceIsValid(resolvedSourcePath, content) {
+  const sidecar = `${resolvedSourcePath}.sha256`;
+  if (!existsSync9(sidecar)) return false;
+  let expected;
+  try {
+    expected = readFileSync6(sidecar, "utf-8").trim();
+  } catch {
+    return false;
+  }
+  return hashContent(canonicalizeOwned(content)) === expected;
+}
 function hashContent(content) {
   return createHash3("sha256").update(content, "utf-8").digest("hex");
 }
@@ -4349,13 +4379,38 @@ function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPre
     const manifestKey = manifestKeyPrefix === "" ? targetFilename : `${manifestKeyPrefix}/${targetFilename}`;
     const lastInstalledHash = manifest.entries[manifestKey];
     if (existsSync9(targetPath)) {
-      const existingContent = readFileSync6(targetPath, "utf-8");
+      let existingContent;
+      try {
+        if (!statSync2(targetPath).isFile()) throw new Error("not a regular file");
+        existingContent = readFileSync6(targetPath, "utf-8");
+      } catch (err) {
+        process.stderr.write(
+          `massu: skipping ${manifestKey}: target is not a readable file (${err instanceof Error ? err.message : String(err)}). Remove it and re-install.
+`
+        );
+        stats.skipped++;
+        continue;
+      }
       const existingHash = hashContent(existingContent);
       if (existingHash === sourceHash) {
         manifest.entries[manifestKey] = sourceHash;
         stats.skipped++;
         continue;
       }
+      if (isMassuOwned(manifestKey)) {
+        if (!massuOwnedSourceIsValid(resolvedSourcePath, sourceContent)) {
+          process.stderr.write(
+            `massu: REFUSING to overwrite massu-owned ${manifestKey} \u2014 the source failed its integrity hash (${resolvedSourcePath}.sha256 missing or mismatched). Your installed @massu/core may be stale or tampered; run \`npm i @massu/core@latest\` and re-install. Kept the existing file.
+`
+          );
+          stats.kept++;
+          continue;
+        }
+        atomicWriteFile(targetPath, sourceContent);
+        manifest.entries[manifestKey] = sourceHash;
+        stats.updated++;
+        continue;
+      }
       if (lastInstalledHash === void 0) {
         process.stderr.write(
           `First-install: keeping existing ${targetPath} (differs from upstream, and massu has no record of writing it).
@@ -4531,7 +4586,7 @@ async function runInstallCommands() {
   console.log("  Restart your Claude Code session to use them.");
   console.log("");
 }
-var __filename, __dirname, ASSET_TYPES, MANIFEST_VERSION, MANIFEST_RELPATH, PASSTHROUGH_LANG_KEYS;
+var __filename, __dirname, ASSET_TYPES, MANIFEST_VERSION, MANIFEST_RELPATH, MASSU_OWNED_PATHS, PASSTHROUGH_LANG_KEYS;
 var init_install_commands = __esm({
   "src/commands/install-commands.ts"() {
     "use strict";
@@ -4550,6 +4605,7 @@ var init_install_commands = __esm({
     ];
     MANIFEST_VERSION = 1;
     MANIFEST_RELPATH = join6(".massu", "install-manifest.json");
+    MASSU_OWNED_PATHS = ["commands/_verification-laws.md"];
     PASSTHROUGH_LANG_KEYS = [
       "typescript",
       "javascript",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@massu/core",
-  "version": "1.15.5",
+  "version": "1.15.7",
   "type": "module",
   "description": "AI Engineering Governance MCP Server - Session memory, knowledge system, feature registry, code intelligence, rule enforcement, tiered tooling (12 free / 73 total), 56 workflow commands, 11 agents, 20+ patterns",
   "main": "./dist/cli.js",
@@ -24,14 +24,15 @@
     "start": "npx tsx src/server.ts",
     "test": "vitest run",
     "build": "tsc --noEmit && npm run build:cli && npm run build:hooks && npm run build:assets && npm run build:adapter-types && npm run build:adapter-subpath && npm run build:bundle-adapters",
-    "build:assets": "node scripts/copy-embedder-assets.mjs",
+    "build:assets": "node scripts/gen-owned-sidecars.mjs && node scripts/copy-embedder-assets.mjs",
     "build:adapter-types": "tsc -p tsconfig.adapter-types.json",
     "build:adapter-subpath": "tsx scripts/bundle-adapters.ts --subpath-only",
     "build:bundle-adapters": "tsx scripts/bundle-adapters.ts",
     "build:cli": "esbuild --bundle --platform=node --format=esm --outfile=dist/cli.js src/cli.ts --external:better-sqlite3 --external:yaml --external:zod --external:chokidar --external:proper-lockfile --external:fsevents --external:web-tree-sitter --external:tweetnacl --external:tar --external:smol-toml --external:vscode-languageserver-protocol --external:onnxruntime-web --external:@massu/adapter-rails --external:@massu/adapter-spring --banner:js='#!/usr/bin/env node\nimport{createRequire as __cr}from\"module\";const require=__cr(import.meta.url);'",
     "build:hooks": "esbuild --bundle --platform=node --format=esm --outdir=dist/hooks src/hooks/*.ts --external:better-sqlite3 --external:yaml --external:zod --external:chokidar --external:proper-lockfile --external:fsevents --external:web-tree-sitter --external:tweetnacl --external:tar --external:smol-toml --external:vscode-languageserver-protocol --external:onnxruntime-web --external:@massu/adapter-rails --external:@massu/adapter-spring --banner:js='import{createRequire as __cr}from\"module\";const require=__cr(import.meta.url);'",
     "prepublishOnly": "bash ../../scripts/prepublish-check.sh && node ../../scripts/bundle-pubkey.mjs && node ../../scripts/bundle-license-pubkey.mjs && node ../../scripts/bundle-promotion-pubkey.mjs && node ../../scripts/bundle-audit-export-pubkey.mjs && cp ../../CHANGELOG.md ./CHANGELOG.md && npm run build && bash ../../scripts/npm-publish-guard.sh",
-    "bench:watch": "tsx test/perf/watch-benchmark.ts"
+    "bench:watch": "tsx test/perf/watch-benchmark.ts",
+    "build:owned-sidecars": "node scripts/gen-owned-sidecars.mjs"
   },
   "dependencies": {
     "@clack/prompts": "^0.9.1",

package/patterns/build-patterns.md

@@ -1,5 +1,7 @@
 # Build Patterns
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Patterns for resolving build issues in Next.js applications with Prisma, native modules, and Edge Runtime.
 
 **When to Read**: When encountering build errors, hangs, or warnings. Before adding heavy dependencies.

package/patterns/component-patterns.md

@@ -1,5 +1,7 @@
 # Component Patterns
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Standard patterns for UI components, forms, search inputs, and common interactive elements.
 
 **When to Read**: Before creating or modifying UI components.

package/patterns/display-patterns.md

@@ -1,5 +1,7 @@
 # Display Patterns
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Centralized formatting functions and display conventions for data presentation.
 
 **When to Read**: Before displaying formatted data (currency, phone numbers, dates, names, file sizes).

package/patterns/form-patterns.md

@@ -1,5 +1,7 @@
 # Form Field Patterns
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Form patterns for semantic TextField types, PhoneInputField, AddressForm, react-hook-form + Zod setup, register() vs Controller, edit forms, submission patterns.
 
 **When to Read**: Before creating or modifying forms.

package/patterns/integration-testing-checklist.md

@@ -1,5 +1,7 @@
 # Integration Testing Checklist
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Router contract verification, pre-test writing steps, test templates, common anti-patterns, prevention system.
 
 **When to Read**: Before writing integration tests.

package/patterns/security-patterns.md

@@ -1,5 +1,7 @@
 # Security Patterns
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Security patterns for credential management, authentication, and code safety.
 
 **When to Read**: Before handling secrets, authentication, or security-sensitive code.

package/patterns/testing-patterns.md

@@ -1,5 +1,7 @@
 # Testing Patterns
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Testing pyramid, patterns, and best practices for unit, integration, and E2E tests.
 
 **When to Read**: Before writing tests, setting up test infrastructure, or debugging test failures.

package/patterns/tool-routing.md

@@ -1,5 +1,7 @@
 # Tool Routing Patterns
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Decision trees for selecting the correct tool/MCP for browser automation, Google services, and code search.
 
 **When to Read**: Before using any browser automation, Google service, or code search tool.

package/patterns/ui-patterns.md

@@ -1,5 +1,7 @@
 # UI Patterns
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Layout, theming, component selection, and UI quality standards.
 
 **When to Read**: Before creating or modifying UI components, pages, or styles.

package/protocols/plan-implementation.md

@@ -1,5 +1,7 @@
 # Plan Implementation Protocol
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Unified protocol for implementing and auditing multi-step plans. Merges Plan Implementation, Plan Audit, and Pre-Completion protocols.
 
 **When to Read**: When implementing any multi-step plan, before claiming a plan is complete.

package/protocols/recovery.md

@@ -1,5 +1,7 @@
 # Post-Compaction Recovery Protocol
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Restore context after session compaction. Execute IMMEDIATELY when compaction summary appears.
 
 **When to Read**: Automatically after any session compaction.

package/protocols/verification.md

@@ -1,5 +1,7 @@
 # Verification Protocol - Unified
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Single source of truth for all verification requirements. Referenced by CR-1 (Canonical Rule 1).
 
 **When to Read**: Before claiming ANY task is complete, before any database operation, before any commit.

package/reference/cr-rules-reference.md

@@ -1,5 +1,7 @@
 # Canonical Rules (CR) — Full Reference
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 All CR rules with verification types and reference links.
 
 | ID | Rule | Verification Type | Reference |

package/reference/hook-execution-order.md

@@ -1,5 +1,7 @@
 # Hook Execution Order Reference
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Authoritative reference for hook execution ordering across all event types in `.claude/settings.json`.
 
 **Scope**: Project hooks only (`.claude/settings.json`). User hooks (`~/.claude/settings.json`) run in a separate pipeline and are not covered here.

package/reference/lessons-learned.md

@@ -1,5 +1,7 @@
 # Lessons Learned & Accountability
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Part of Prime Directive** | [Back to Main](../CLAUDE.md)
 
 ---

package/reference/patterns-quickref.md

@@ -1,5 +1,7 @@
 # Pattern Quick Reference
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Condensed pattern reference. Full patterns with code examples in `patterns/*.md`.
 
 **When to Read**: Quick lookup during implementation. For full details, read the linked pattern file.

package/reference/standards.md

@@ -1,5 +1,7 @@
 # Code Quality & Communication Standards
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Part of Prime Directive** | [Back to Main](../CLAUDE.md)
 
 ---

package/reference/subagents-reference.md

@@ -1,5 +1,7 @@
 # Subagent Reference
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Subagents**: Use the Task tool for spawning agents. **One task per agent** (Principle #20). Use for exploration to keep main context clean.
 
 | Agent | Focus | Trigger |

package/reference/vr-verification-reference.md

@@ -1,5 +1,7 @@
 # VR-* Verification Reference
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Master reference for ALL verification types used across massu commands. Every verification prevents a specific class of bugs from reaching production.
 
 **When to Read**: Before claiming ANY work is complete. During massu command execution. After any audit failure.