@memnexus-ai/mx-agent-cli 0.1.180 → 0.1.182

package/dist/__tests__/config-mirror-integrity.test.js

@@ -153,6 +153,14 @@ const MIRROR_PAIRS = [
         '.claude/hooks/coordination-brief.sh',
         'mx-agent-system/agent-config/hooks/coordination-brief.sh',
     ],
+    // The co-located hook test suite. Not part of the shipped config surface
+    // (bundled-config excludes *.test.sh), but both dev copies are edited in
+    // lockstep — enforce byte-identity so the slug-validation tests can't drift
+    // (v2.40 QA finding, KI-COORDMT-HOOK-EXPORT-ROBUSTNESS).
+    [
+        '.claude/hooks/coordination-brief.test.sh',
+        'mx-agent-system/agent-config/hooks/coordination-brief.test.sh',
+    ],
     // NOTE: agent-config/settings.json is intentionally NOT a mirror pair — the
     // worktree .claude/settings.json is COMPOSED/merged from the source, not a
     // byte-identical copy, so its SessionStart wiring is verified by composition,

package/dist/__tests__/config-mirror-integrity.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-mirror-integrity.test.js","sourceRoot":"","sources":["../../src/__tests__/config-mirror-integrity.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACzE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4DAA4D,KAAK,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAE1C,+EAA+E;AAC/E,MAAM,YAAY,GAA6C;IAC7D;QACE,+CAA+C;QAC/C,oEAAoE;KACrE;IACD;QACE,oDAAoD;QACpD,yEAAyE;KAC1E;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,mEAAmE;IACnE;QACE,qCAAqC;QACrC,0DAA0D;KAC3D;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD;QACE,oCAAoC;QACpC,yDAAyD;KAC1D;IACD;QACE,gCAAgC;QAChC,qDAAqD;KACtD;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E;QACE,uCAAuC;QACvC,4DAA4D;KAC7D;IACD;QACE,iCAAiC;QACjC,sDAAsD;KACvD;IACD;QACE,sCAAsC;QACtC,2DAA2D;KAC5D;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD,sEAAsE;IACtE,2EAA2E;IAC3E,wEAAwE;IACxE,+DAA+D;IAC/D;QACE,2CAA2C;QAC3C,gEAAgE;KACjE;IACD;QACE,gDAAgD;QAChD,qEAAqE;KACtE;IACD;QACE,4CAA4C;QAC5C,iEAAiE;KAClE;IACD;QACE,8BAA8B;QAC9B,mDAAmD;KACpD;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E;QACE,sCAAsC;QACtC,2DAA2D;KAC5D;IACD;QACE,2CAA2C;QAC3C,gEAAgE;KACjE;IACD,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,gEAAgE;IAChE;QACE,kCAAkC;QAClC,uDAAuD;KACxD;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD;QACE,wCAAwC;QACxC,6DAA6D;KAC9D;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD;QACE,4CAA4C;QAC5C,iEAAiE;KAClE;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,wCAAwC;IACxC;QACE,qCAAqC;QACrC,0DAA0D;KAC3D;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,qBAAqB;CACtB,CAAC;AAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,KAAK,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,YAAY,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAEvD,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,EAAE,CAAC,IAAI,CAAC,GAAG,SAAS,MAAM,cAAc,cAAc,SAAS,2BAA2B,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtG,SAAS;QACX,CAAC;QAED,EAAE,CAAC,GAAG,SAAS,yBAAyB,cAAc,EAAE,EAAE,GAAG,EAAE;YAC7D,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,gBAAgB,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;YACtD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"config-mirror-integrity.test.js","sourceRoot":"","sources":["../../src/__tests__/config-mirror-integrity.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACzE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4DAA4D,KAAK,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAE1C,+EAA+E;AAC/E,MAAM,YAAY,GAA6C;IAC7D;QACE,+CAA+C;QAC/C,oEAAoE;KACrE;IACD;QACE,oDAAoD;QACpD,yEAAyE;KAC1E;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,mEAAmE;IACnE;QACE,qCAAqC;QACrC,0DAA0D;KAC3D;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD;QACE,oCAAoC;QACpC,yDAAyD;KAC1D;IACD;QACE,gCAAgC;QAChC,qDAAqD;KACtD;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E;QACE,uCAAuC;QACvC,4DAA4D;KAC7D;IACD;QACE,iCAAiC;QACjC,sDAAsD;KACvD;IACD;QACE,sCAAsC;QACtC,2DAA2D;KAC5D;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD,sEAAsE;IACtE,2EAA2E;IAC3E,wEAAwE;IACxE,+DAA+D;IAC/D;QACE,2CAA2C;QAC3C,gEAAgE;KACjE;IACD;QACE,gDAAgD;QAChD,qEAAqE;KACtE;IACD;QACE,4CAA4C;QAC5C,iEAAiE;KAClE;IACD;QACE,8BAA8B;QAC9B,mDAAmD;KACpD;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E;QACE,sCAAsC;QACtC,2DAA2D;KAC5D;IACD;QACE,2CAA2C;QAC3C,gEAAgE;KACjE;IACD,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,gEAAgE;IAChE;QACE,kCAAkC;QAClC,uDAAuD;KACxD;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD;QACE,wCAAwC;QACxC,6DAA6D;KAC9D;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD;QACE,4CAA4C;QAC5C,iEAAiE;KAClE;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,wCAAwC;IACxC;QACE,qCAAqC;QACrC,0DAA0D;KAC3D;IACD,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,yDAAyD;IACzD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,qBAAqB;CACtB,CAAC;AAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,KAAK,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,YAAY,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAEvD,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,EAAE,CAAC,IAAI,CAAC,GAAG,SAAS,MAAM,cAAc,cAAc,SAAS,2BAA2B,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtG,SAAS;QACX,CAAC;QAED,EAAE,CAAC,GAAG,SAAS,yBAAyB,cAAc,EAAE,EAAE,GAAG,EAAE;YAC7D,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,gBAAgB,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;YACtD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/__tests__/coordination-brief-pin.test.d.ts

@@ -0,0 +1,20 @@
+/**
+ * KI-COORDMT-HOOK-EXPORT-ROBUSTNESS — publish-side sha pin for the session-start
+ * coordination-brief hook (Red Team v2.41 Step-6 Major).
+ *
+ * WHY HERE (defense in depth): the CLI publish workflow (mx-agent-cli-publish.yml)
+ * triggers on agent-config/** and BUNDLES agent-config/hooks/coordination-brief.sh
+ * into the published package (scripts/bundle-config.mjs). Its test gate is the CLI
+ * `npm test` suite. Without a pin assertion IN THIS SUITE, a PR that edits only the
+ * hook could ship an un-vetted hook in a new CLI even if someone later loosens the
+ * coordination-service workflow's path filters. This test makes that impossible:
+ * the CLI cannot go green — and therefore cannot publish — with a drifted hook.
+ *
+ * THREE PIN SITES MUST BUMP TOGETHER when coordination-brief.sh changes:
+ *   1. coordination-service/src/__tests__/coordination-brief-drift.test.ts  (PINNED_SHA256)
+ *   2. cli/src/__tests__/coordination-brief-pin.test.ts                     (this file)
+ *   3. spearmint-private .github/workflows/coordination-hook-pin.yml        (PINNED_SHA256)
+ * See the drift-test header for the full re-distribution procedure.
+ */
+export {};
+//# sourceMappingURL=coordination-brief-pin.test.d.ts.map

package/dist/__tests__/coordination-brief-pin.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordination-brief-pin.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/coordination-brief-pin.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/__tests__/coordination-brief-pin.test.js

@@ -0,0 +1,37 @@
+/**
+ * KI-COORDMT-HOOK-EXPORT-ROBUSTNESS — publish-side sha pin for the session-start
+ * coordination-brief hook (Red Team v2.41 Step-6 Major).
+ *
+ * WHY HERE (defense in depth): the CLI publish workflow (mx-agent-cli-publish.yml)
+ * triggers on agent-config/** and BUNDLES agent-config/hooks/coordination-brief.sh
+ * into the published package (scripts/bundle-config.mjs). Its test gate is the CLI
+ * `npm test` suite. Without a pin assertion IN THIS SUITE, a PR that edits only the
+ * hook could ship an un-vetted hook in a new CLI even if someone later loosens the
+ * coordination-service workflow's path filters. This test makes that impossible:
+ * the CLI cannot go green — and therefore cannot publish — with a drifted hook.
+ *
+ * THREE PIN SITES MUST BUMP TOGETHER when coordination-brief.sh changes:
+ *   1. coordination-service/src/__tests__/coordination-brief-drift.test.ts  (PINNED_SHA256)
+ *   2. cli/src/__tests__/coordination-brief-pin.test.ts                     (this file)
+ *   3. spearmint-private .github/workflows/coordination-hook-pin.yml        (PINNED_SHA256)
+ * See the drift-test header for the full re-distribution procedure.
+ */
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { join, dirname } from 'node:path';
+const here = dirname(fileURLToPath(import.meta.url));
+// cli/src/__tests__ → mx-agent-system/agent-config/hooks/coordination-brief.sh
+const HOOK_FILE = join(here, '..', '..', '..', 'agent-config', 'hooks', 'coordination-brief.sh');
+// Mirror of the platform PINNED_SHA256 (coordination-brief-drift.test.ts). Bump in
+// lockstep with the other two pin sites named in the header above.
+const PINNED_SHA256 = '3c636034e87f89efdb4d4b2cb270e73b2769710dde42651cdd9ee7d865028962';
+describe('coordination-brief hook pin — publish-side gate (KI-COORDMT-HOOK-EXPORT-ROBUSTNESS)', () => {
+    it('the bundled hook matches its pinned sha256 (else the CLI must not publish)', () => {
+        const bytes = readFileSync(HOOK_FILE);
+        const actual = createHash('sha256').update(bytes).digest('hex');
+        expect(actual).toBe(PINNED_SHA256);
+    });
+});
+//# sourceMappingURL=coordination-brief-pin.test.js.map

package/dist/__tests__/coordination-brief-pin.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordination-brief-pin.test.js","sourceRoot":"","sources":["../../src/__tests__/coordination-brief-pin.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,+EAA+E;AAC/E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;AAEjG,mFAAmF;AACnF,mEAAmE;AACnE,MAAM,aAAa,GAAG,kEAAkE,CAAC;AAEzF,QAAQ,CAAC,qFAAqF,EAAE,GAAG,EAAE;IACnG,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/agent-config/hooks/coordination-brief.sh

@@ -95,8 +95,33 @@ PROJECT="${MX_PRODUCT_SLUG:-}"
 if [ -z "$PROJECT" ] && [ -f "${WORKTREE}/mx-agent.config.json" ]; then
   PROJECT="$(node -e 'try{const c=require(process.argv[1]);const s=(c.projectSlug||(c.project&&c.project.slug)||"");process.stdout.write(String(s).trim())}catch(e){}' "${WORKTREE}/mx-agent.config.json" 2>/dev/null || true)"
 fi
+# Unset/empty → default memnexus (unchanged behavior). A set-but-INVALID slug is
+# NEVER coerced to memnexus — that would silently run the wrong tenant's brief.
 [ -z "$PROJECT" ] && PROJECT="$DEFAULT_PROJECT"
 
+# ── KI-COORDMT-HOOK-EXPORT-ROBUSTNESS: validate the resolved slug fail-closed. ─
+# Mirror coordination-service isValidSlug (types.ts): base regex
+# ^[a-z][a-z0-9-]{0,48}[a-z0-9]$, NO '--' substring (KV name parse-safety), and
+# NOT the reserved word 'all'. A resolved-but-invalid PROJECT skips the brief with
+# a one-line stderr warning (fail-closed) — it is never coerced to a default and
+# never flows into the az secret-name / roster lookup below. "$PROJECT" is quoted.
+is_valid_slug() {
+  local s="$1"
+  case "$s" in
+    *--*) return 1 ;;      # no '--' (double-hyphen is the KV name separator)
+    all) return 1 ;;       # reserved broadcast slug
+  esac
+  # Base regex, WHOLE-STRING: bash `[[ =~ ]]` anchors ^/$ to the string ends, so a
+  # multiline value (e.g. $'memnexus\nevil') fails — unlike `grep -Eq`, which
+  # matches line-by-line and would accept an embedded newline. Starts lowercase
+  # alpha, then [a-z0-9-], ends alnum; 2..50 chars.
+  [[ "$s" =~ ^[a-z][a-z0-9-]{0,48}[a-z0-9]$ ]]
+}
+if ! is_valid_slug "$PROJECT"; then
+  echo "coordination brief: resolved project slug \"$PROJECT\" is invalid — skipping (fail-closed)" >&2
+  exit 0
+fi
+
 # ── SF-2: per-project roster-membership validation before any az call. ───────
 # The roster is read from the OFFLINE generated file (ND-2), with the builtin
 # memnexus roster as an offline fallback. NEVER a live GET /roster.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memnexus-ai/mx-agent-cli",
-  "version": "0.1.180",
+  "version": "0.1.182",
   "description": "CLI for creating and managing AI agent teams",
   "type": "module",
   "bin": {