@mrciphersmith/keryx 0.2.130 → 0.2.131

package/dist/cli.js

@@ -24338,6 +24338,49 @@ var init_trusted_wrap_up = __esm(() => {
   consumed = new WeakSet;
 });
 
+// src/sac/workspace-reference.ts
+function requireWorkspaceReference(raw) {
+  const normalized = normalizeWorkspaceReference(raw);
+  if (!normalized.ok)
+    throw new Error(normalized.reason);
+  return normalized.uri;
+}
+function normalizeWorkspaceReference(raw) {
+  const trimmed = raw.trim();
+  if (trimmed.length === 0) {
+    return { ok: false, reason: 'a workspace reference must be a non-empty workspace-relative path, e.g. "./src/harness/search"' };
+  }
+  if (UNSAFE_ABSOLUTE.test(trimmed) || UNSAFE_SCHEME.test(trimmed) || trimmed.includes("\\")) {
+    return {
+      ok: false,
+      reason: `"${trimmed}" is not a workspace-relative path \u2014 an absolute path, a URL and a Windows path are all refused. Use a path inside the project, e.g. "./src/harness/search".`
+    };
+  }
+  const withoutDotSlash = trimmed.startsWith("./") ? trimmed.slice(2) : trimmed;
+  const withoutTrailingSlash = withoutDotSlash.replace(/\/+$/, "");
+  if (withoutTrailingSlash.length === 0) {
+    return { ok: false, reason: `"${trimmed}" names the project root rather than a path inside it \u2014 name a directory or file, e.g. "./src/harness/search".` };
+  }
+  const segments = withoutTrailingSlash.split("/");
+  if (segments.includes("..") || segments.includes(".")) {
+    return { ok: false, reason: `"${trimmed}" contains a "." or ".." path segment \u2014 a workspace reference must stay inside the project.` };
+  }
+  const uri = `./${withoutTrailingSlash}`;
+  if (!WORKSPACE_REFERENCE_PATTERN.test(uri)) {
+    return {
+      ok: false,
+      reason: `"${trimmed}" is not a usable workspace reference. The stored form is "${uri}" if the characters are the problem: ` + 'each path segment may contain only letters, digits, ".", "_" and "-", and no ".." segment is allowed.'
+    };
+  }
+  return { ok: true, uri };
+}
+var WORKSPACE_REFERENCE_PATTERN, UNSAFE_ABSOLUTE, UNSAFE_SCHEME;
+var init_workspace_reference = __esm(() => {
+  WORKSPACE_REFERENCE_PATTERN = /^\.\/(?!(?:.*\/)?\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+  UNSAFE_ABSOLUTE = /^[/\\]/;
+  UNSAFE_SCHEME = /^[a-z][a-z0-9+.-]*:/i;
+});
+
 // src/sac/index.ts
 import { access as access2, readFile as readFile50, realpath as realpath6 } from "fs/promises";
 import { createHash as createHash18 } from "crypto";
@@ -25085,11 +25128,12 @@ async function evaluateStrictSacGuard(input) {
 }
 var idPattern, subjectPattern, revisionPattern, correlationPattern, workspacePathPattern, receiptHashPattern, utcPattern, forbiddenPayloadKeys, normativeSchemaFiles, normativeSchemas, NORMATIVE_SCHEMA_DIR, SacReferenceError, trustedActors, roleRank;
 var init_sac = __esm(() => {
+  init_workspace_reference();
   idPattern = /^[a-z][a-z0-9-]{2,63}$/;
   subjectPattern = /^(?:user|team|service|agent):[a-z0-9][a-z0-9._-]{0,127}$/;
   revisionPattern = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
   correlationPattern = /^[A-Za-z0-9][A-Za-z0-9._:-]{15,255}$/;
-  workspacePathPattern = /^\.\/(?!.*(?:^|\/)\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+  workspacePathPattern = WORKSPACE_REFERENCE_PATTERN;
   receiptHashPattern = /^[a-f0-9]{64}$/;
   utcPattern = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?Z$/;
   forbiddenPayloadKeys = new Set(["prompt", "transcript", "hiddenReasoning", "secret", "secrets", "rawContent"]);
@@ -51085,7 +51129,7 @@ import path47 from "path";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.130",
+  version: "0.2.131",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -78293,6 +78337,7 @@ function toMcpTools(ops = METAPROJECT_OPERATIONS, adapterFor = (cwd) => createMe
 }
 
 // src/sac/fwk-service.ts
+init_workspace_reference();
 init_assembly();
 init_sac();
 init_workspace_service();
@@ -78303,6 +78348,7 @@ import { appendFile as appendFile7, mkdir as mkdir59, open as open2, readFile as
 import path174 from "path";
 
 // src/sac/policy-experiment.ts
+init_workspace_reference();
 import { createHash as createHash34, createHmac as createHmac2 } from "crypto";
 
 // src/sac/receipt-integrity.ts
@@ -78366,7 +78412,7 @@ function stableValue(value) {
 }
 var stableJson2 = (value) => JSON.stringify(stableValue(value));
 var sha2564 = (value) => createHash34("sha256").update(stableJson2(value), "utf8").digest("hex");
-var workspacePathPattern2 = /^\.\/(?!.*(?:^|\/)\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+var workspacePathPattern2 = WORKSPACE_REFERENCE_PATTERN;
 var trustedOutcomes = new WeakMap;
 var trustedSandboxEvidence = new WeakMap;
 var trustedSandboxExecutions = new WeakMap;
@@ -78458,7 +78504,7 @@ var metadataOnly = (value) => {
 var nowIso2 = (now) => now().toISOString();
 var reportHashPattern = /^[a-f0-9]{64}$/;
 var immutableVersionPattern = /(?:^|[-_.:])(?:latest|next|head|main|develop)(?:$|[-_.:])/i;
-var workspacePathPattern3 = /^\.\/(?!.*(?:^|\/)\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+var workspacePathPattern3 = WORKSPACE_REFERENCE_PATTERN;
 var policyExperimentConfigPath = [".metaproject", "context-operations", "policy-experiment", "config.json"];
 var stableValue2 = (value) => {
   if (Array.isArray(value))
@@ -79333,6 +79379,7 @@ async function reclaimStaleExternalSlates(cwd, now = () => new Date) {
 init_slate();
 init_workspace_resolve();
 init_redact();
+init_workspace_reference();
 
 // src/mcp/tools.ts
 import { randomUUID as randomUUID19 } from "crypto";
@@ -79545,7 +79592,8 @@ function buildToolRegistry() {
         const title = stringParam2(params, "title")?.trim() ?? "";
         if (title.length === 0)
           throw new Error("sac.workspaceCreate requires a non-empty 'title'");
-        const component = stringParam2(params, "component");
+        const rawComponent = stringParam2(params, "component");
+        const component = rawComponent === undefined ? undefined : requireWorkspaceReference(rawComponent);
         const workspace = await sacWorkspaceService(cwd).create({ request: undefined, requestCorrelationId: randomUUID19(), id: newWorkspaceId(), title, ...component ? { component: { kind: "component", uri: component } } : {} });
         return workspace;
       }
@@ -87467,7 +87515,12 @@ function workspaceCreateTool(cwd, getSessionDir) {
       const title = typeof input.title === "string" ? input.title.trim() : "";
       if (title.length === 0)
         return { output: "workspace_create requires a non-empty 'title'", isError: true };
-      const component = typeof input.component === "string" && input.component.length > 0 ? input.component : undefined;
+      const rawComponent = typeof input.component === "string" && input.component.length > 0 ? input.component : undefined;
+      const normalizedComponent = rawComponent === undefined ? undefined : normalizeWorkspaceReference(rawComponent);
+      if (normalizedComponent !== undefined && !normalizedComponent.ok) {
+        return { output: "workspace_create: " + normalizedComponent.reason, isError: true };
+      }
+      const component = normalizedComponent?.ok === true ? normalizedComponent.uri : undefined;
       try {
         const workspace = await service5(cwd).create({
           request: undefined,
@@ -93273,14 +93326,25 @@ async function classifySession(session) {
         sessionId: session.id,
         ...workspaceId !== undefined ? { workspaceId } : {},
         lastSeenAt: session.updatedAt,
+        reason: "wrap-up-failed",
         wrapUpOutcome: { trigger: wrapUpOutcome.trigger, generatedAt: wrapUpOutcome.generatedAt, groups: wrapUpOutcome.groups }
       }
     };
   }
   if (!await isSlateEngaged(dir))
     return;
-  const workspaceId = (await safeReadSlate(dir))?.workspaceId;
-  return { kind: "unknown", item: { type: "unknown", sessionId: session.id, ...workspaceId !== undefined ? { workspaceId } : {}, lastSeenAt: session.updatedAt } };
+  const slateRead = await readSlateState(dir);
+  const workspaceId = slateRead.state === "ok" ? slateRead.slate.workspaceId : undefined;
+  return {
+    kind: "unknown",
+    item: {
+      type: "unknown",
+      sessionId: session.id,
+      ...workspaceId !== undefined ? { workspaceId } : {},
+      lastSeenAt: session.updatedAt,
+      reason: slateRead.state === "unreadable" ? "slate-unreadable" : "no-resolution-recorded"
+    }
+  };
 }
 async function readExternalUnboundCandidates(cwd) {
   const extDir = externalSlatesDir(cwd);
@@ -93533,6 +93597,17 @@ async function isSlateEngaged(dir) {
     return false;
   }
 }
+async function readSlateState(dir) {
+  try {
+    const slate = await readSlate(dir);
+    return slate === undefined ? { state: "absent" } : { state: "ok", slate };
+  } catch (error) {
+    return isNotFound2(error) ? { state: "absent" } : { state: "unreadable" };
+  }
+}
+function isNotFound2(error) {
+  return typeof error === "object" && error !== null && error.code === "ENOENT";
+}
 async function safeReadSlate(dir) {
   try {
     return await readSlate(dir);
@@ -94498,7 +94573,7 @@ function summarizeReviewItem(item) {
     case "unbound-candidate":
       return `${item.sessionId} \u2014 ${item.summary}`;
     case "unknown":
-      return `${item.sessionId} \u2014 last seen ${item.lastSeenAt}`;
+      return `${item.sessionId} \u2014 ${unknownReasonLabel(item.reason)} (last seen ${item.lastSeenAt})`;
   }
 }
 function formatReviewListLines(items, selected) {
@@ -94510,6 +94585,26 @@ function formatReviewListLines(items, selected) {
     return `${mark} ${TYPE_LABEL[item.type].padEnd(8)} ${summarizeReviewItem(item)}`;
   });
 }
+function unknownReasonLabel(reason) {
+  switch (reason) {
+    case "wrap-up-failed":
+      return "wrap-up failed";
+    case "slate-unreadable":
+      return "slate.json unreadable";
+    case "no-resolution-recorded":
+      return "no resolution recorded";
+  }
+}
+function unknownReasonDetail(reason) {
+  switch (reason) {
+    case "wrap-up-failed":
+      return "a wrap-up dispatch ran and every group failed - the per-kind reasons are above where recorded; re-run wrap-up after fixing them.";
+    case "slate-unreadable":
+      return "this session's slate.json exists but could not be read. Its record is DAMAGED, not absent: inspect the file before assuming nothing happened.";
+    case "no-resolution-recorded":
+      return "Slate engagement with no proposal, terminal state, unbound-candidate or wrap-up-outcome artifact recorded.";
+  }
+}
 function describeReviewItem(item) {
   switch (item.type) {
     case "proposal":
@@ -94551,7 +94646,7 @@ function describeReviewItem(item) {
       ] : [
         `Session    ${item.sessionId}${item.workspaceId !== undefined ? `  (workspace ${item.workspaceId})` : ""}`,
         `Last seen  ${item.lastSeenAt}`,
-        "No proposal, terminal state, or unbound-candidate artifact recorded.",
+        "Why unknown: " + unknownReasonDetail(item.reason),
         "",
         `Investigate: keryx sessions list / keryx shell -r ${item.sessionId}`
       ];
@@ -115928,7 +116023,8 @@ async function workspaceCommand(args) {
     if (subcommand === "create") {
       rejectUnknownOptions(args.slice(1), new Set(["--title", "--component"]));
       const title = optionValue(args, "--title");
-      const component = optionValue(args, "--component");
+      const rawComponent = optionValue(args, "--component");
+      const component = rawComponent === undefined ? undefined : requireWorkspaceReference(rawComponent);
       if (!title)
         throw new Error("Usage: keryx workspace create --title <title> [--component <workspace-relative-ref>]");
       const workspace = await service6().create({ request: undefined, requestCorrelationId: randomUUID40(), id: newWorkspaceId(), title, ...component ? { component: { kind: "component", uri: component } } : {} });
@@ -115957,11 +116053,11 @@ async function workspaceCommand(args) {
       rejectUnknownOptions(args.slice(2), new Set(["--kind", "--uri", "--revision"]));
       const workspaceId = args[1];
       const kind = optionValue(args, "--kind");
-      const uri = optionValue(args, "--uri");
+      const rawUri = optionValue(args, "--uri");
       const revision = optionValue(args, "--revision");
-      if (!workspaceId || !kind || !uri)
+      if (!workspaceId || !kind || !rawUri)
         throw new Error("Usage: keryx workspace add-resource <workspace-id> --kind <kind> --uri <workspace-relative-ref> [--revision <revision>]");
-      console.log(JSON.stringify(await service6().addResource({ request: undefined, requestCorrelationId: randomUUID40(), workspaceId, resource: { kind, uri, ...revision ? { revision } : {} } }), null, 2));
+      console.log(JSON.stringify(await service6().addResource({ request: undefined, requestCorrelationId: randomUUID40(), workspaceId, resource: { kind, uri: requireWorkspaceReference(rawUri), ...revision ? { revision } : {} } }), null, 2));
       return;
     }
     if (subcommand === "archive") {
@@ -116235,7 +116331,7 @@ function renderCatchUp(report, includeLifecycleFlags = true) {
   sections.push(renderSection("Pending proposals", report.proposals, (item) => `- Accept, reject, or dismiss ${item.kind} proposal ${item.proposalId} in workspace ${item.workspaceId}` + `${item.note !== undefined ? `: "${item.note}"` : ""}? ` + `Recommendation: ${item.fresh ? "evidence is fresh \u2014 review now (`keryx workspace review " + item.workspaceId + " " + item.proposalId + " --decision <accepted|rejected|dismissed>`)" : "evidence has drifted since this proposal was created \u2014 treat as stale, re-run wrap-up before deciding"}.`));
   sections.push(renderSection("Blocked sessions (stopped unattended)", report.blocked, (item) => `- Session ${item.sessionId} stopped unattended (${item.terminalState.reason}) at ${item.terminalState.occurredAt}. Resume it, or archive and move on? ` + `Recommendation: \`keryx shell -r ${item.sessionId}\` to resume and unblock it.`));
   sections.push(renderSection("Unbound candidates (wrap-up ran, no workspace bound)", report.unboundCandidates, (item) => `- Session ${item.sessionId} produced untriaged seeds with no workspace bound (${item.summary}). Bind to a workspace and propose, or discard? ` + `Recommendation: pick a workspace, then \`keryx workspace propose <workspace-id> --kind <kind> --session ${item.sessionId}\` (evidence: ${item.evidencePath}).`));
-  sections.push(renderSection("Unknown (no resolution recorded)", report.unknown, (item) => `- Session ${item.sessionId} was last seen ${item.lastSeenAt} with no proposal, terminal state, or unbound-candidate artifact recorded. Investigate, or ignore? ` + `Recommendation: \`keryx sessions list\` / \`keryx shell -r ${item.sessionId}\` to see what happened.`));
+  sections.push(renderSection("Unknown (no resolution recorded)", report.unknown, (item) => `- Session ${item.sessionId} was last seen ${item.lastSeenAt}: ${describeUnknownReason(item)}. Investigate, or ignore? ` + `Recommendation: \`keryx sessions list\` / \`keryx shell -r ${item.sessionId}\` to see what happened.`));
   sections.push(renderSection("Unreviewed SAC-owned changes (no proposal on record)", report.unreviewedPaths, (item) => `- Session ${item.sessionId} changed ${item.owner} path \`${item.path}\`${item.status !== undefined ? ` (Status: ${item.status})` : ""} at ${item.changedAt} with NO SAC proposal/receipt behind it \u2014 this looks like it bypassed review. Was this reviewed some other way, or should it be? ` + `Recommendation: \`keryx shell -r ${item.sessionId}\` to see what happened; if the content is good, route it through a real proposal (\`keryx workspace propose ...\`) before trusting it as durable knowledge.`));
   if (includeLifecycleFlags) {
     sections.push(renderSection("Lifecycle flags (component no longer in the graph)", report.lifecycleFlags, (item) => `- ${item.kind} \`${item.ref}\` scopes to \`${item.missingComponent}\`, which is no longer in the code graph (flagged ${item.flaggedAt}). Still relevant, or safe to clean up? ` + `Recommendation: this is report-only \u2014 nothing was archived/edited/removed automatically; ${item.kind === "workspace" ? "`keryx workspace archive " + item.ref + "`" : item.kind === "memory-entry" ? "`keryx memory supersede` or edit the entry directly" : "edit or remove the wiki page directly"} if you decide it's actually stale.`));
@@ -116244,6 +116340,16 @@ function renderCatchUp(report, includeLifecycleFlags = true) {
 
 `);
 }
+function describeUnknownReason(item) {
+  switch (item.reason) {
+    case "wrap-up-failed":
+      return "a wrap-up dispatch ran and every group failed (re-run it after fixing credentials/conflicts)";
+    case "slate-unreadable":
+      return "its slate.json is present but could not be read - the session's own record is damaged, not merely unrecorded";
+    case "no-resolution-recorded":
+      return "it has Slate engagement but no proposal, terminal state, unbound-candidate or wrap-up-outcome artifact";
+  }
+}
 function renderSection(title, items, describe) {
   const lines = [`== ${title} ==`];
   if (items.length === 0)

package/dist/core.js

@@ -20387,10 +20387,12 @@ __export(exports_service9, {
   normalizeCollaborationResult: () => normalizeCollaborationResult,
   normalizeFwkResult: () => normalizeFwkResult,
   normalizeProposalLifecycleResult: () => normalizeProposalLifecycleResult,
+  normalizeWorkspaceReference: () => normalizeWorkspaceReference,
   proposalNotePath: () => proposalNotePath,
   readExternalSlate: () => readExternalSlate,
   reclaimStaleExternalSlates: () => reclaimStaleExternalSlates,
   redactSensitiveText: () => redactSensitiveText,
+  requireWorkspaceReference: () => requireWorkspaceReference,
   resolveOrCreateWorkspace: () => resolveOrCreateWorkspace,
   resolvePolicyExperiment: () => resolvePolicyExperiment,
   rollbackPolicyExperiment: () => rollbackPolicyExperiment,
@@ -20401,8 +20403,50 @@ __export(exports_service9, {
 });
 
 // src/sac/fwk-service.ts
-init_assembly();
 import { createHash as createHash15, randomUUID as randomUUID4 } from "crypto";
+
+// src/sac/workspace-reference.ts
+var WORKSPACE_REFERENCE_PATTERN = /^\.\/(?!(?:.*\/)?\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+var UNSAFE_ABSOLUTE = /^[/\\]/;
+var UNSAFE_SCHEME = /^[a-z][a-z0-9+.-]*:/i;
+function requireWorkspaceReference(raw) {
+  const normalized = normalizeWorkspaceReference(raw);
+  if (!normalized.ok)
+    throw new Error(normalized.reason);
+  return normalized.uri;
+}
+function normalizeWorkspaceReference(raw) {
+  const trimmed = raw.trim();
+  if (trimmed.length === 0) {
+    return { ok: false, reason: 'a workspace reference must be a non-empty workspace-relative path, e.g. "./src/harness/search"' };
+  }
+  if (UNSAFE_ABSOLUTE.test(trimmed) || UNSAFE_SCHEME.test(trimmed) || trimmed.includes("\\")) {
+    return {
+      ok: false,
+      reason: `"${trimmed}" is not a workspace-relative path \u2014 an absolute path, a URL and a Windows path are all refused. Use a path inside the project, e.g. "./src/harness/search".`
+    };
+  }
+  const withoutDotSlash = trimmed.startsWith("./") ? trimmed.slice(2) : trimmed;
+  const withoutTrailingSlash = withoutDotSlash.replace(/\/+$/, "");
+  if (withoutTrailingSlash.length === 0) {
+    return { ok: false, reason: `"${trimmed}" names the project root rather than a path inside it \u2014 name a directory or file, e.g. "./src/harness/search".` };
+  }
+  const segments = withoutTrailingSlash.split("/");
+  if (segments.includes("..") || segments.includes(".")) {
+    return { ok: false, reason: `"${trimmed}" contains a "." or ".." path segment \u2014 a workspace reference must stay inside the project.` };
+  }
+  const uri = `./${withoutTrailingSlash}`;
+  if (!WORKSPACE_REFERENCE_PATTERN.test(uri)) {
+    return {
+      ok: false,
+      reason: `"${trimmed}" is not a usable workspace reference. The stored form is "${uri}" if the characters are the problem: ` + 'each path segment may contain only letters, digits, ".", "_" and "-", and no ".." segment is allowed.'
+    };
+  }
+  return { ok: true, uri };
+}
+
+// src/sac/fwk-service.ts
+init_assembly();
 import { appendFile as appendFile5, mkdir as mkdir28, open as open2, readFile as readFile40, rename as rename6, rm as rm5, stat as stat9, writeFile as writeFile21 } from "fs/promises";
 import path78 from "path";
 
@@ -20415,7 +20459,7 @@ var idPattern = /^[a-z][a-z0-9-]{2,63}$/;
 var subjectPattern = /^(?:user|team|service|agent):[a-z0-9][a-z0-9._-]{0,127}$/;
 var revisionPattern = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
 var correlationPattern = /^[A-Za-z0-9][A-Za-z0-9._:-]{15,255}$/;
-var workspacePathPattern = /^\.\/(?!.*(?:^|\/)\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+var workspacePathPattern = WORKSPACE_REFERENCE_PATTERN;
 var receiptHashPattern = /^[a-f0-9]{64}$/;
 var utcPattern = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?Z$/;
 var forbiddenPayloadKeys = new Set(["prompt", "transcript", "hiddenReasoning", "secret", "secrets", "rawContent"]);
@@ -21661,7 +21705,7 @@ var stableJson2 = (value) => JSON.stringify(stableValue(value));
 var sha2562 = (value) => createHash14("sha256").update(stableJson2(value), "utf8").digest("hex");
 var sha256Content = (value) => createHash14("sha256").update(value).digest("hex");
 var pseudonym = (key, value) => createHmac2("sha256", key).update(value, "utf8").digest("hex");
-var workspacePathPattern2 = /^\.\/(?!.*(?:^|\/)\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+var workspacePathPattern2 = WORKSPACE_REFERENCE_PATTERN;
 var trustedOutcomes = new WeakMap;
 var trustedSandboxEvidence = new WeakMap;
 var trustedSandboxExecutions = new WeakMap;
@@ -22138,7 +22182,7 @@ var metadataOnly = (value) => {
 var nowIso = (now) => now().toISOString();
 var reportHashPattern = /^[a-f0-9]{64}$/;
 var immutableVersionPattern = /(?:^|[-_.:])(?:latest|next|head|main|develop)(?:$|[-_.:])/i;
-var workspacePathPattern3 = /^\.\/(?!.*(?:^|\/)\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+var workspacePathPattern3 = WORKSPACE_REFERENCE_PATTERN;
 var policyExperimentConfigPath = [".metaproject", "context-operations", "policy-experiment", "config.json"];
 var stableValue2 = (value) => {
   if (Array.isArray(value))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.2.130",
+  "version": "0.2.131",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {