@mrciphersmith/keryx 0.2.130 → 0.2.132

package/dist/cli.js

@@ -24338,6 +24338,49 @@ var init_trusted_wrap_up = __esm(() => {
   consumed = new WeakSet;
 });
 
+// src/sac/workspace-reference.ts
+function requireWorkspaceReference(raw) {
+  const normalized = normalizeWorkspaceReference(raw);
+  if (!normalized.ok)
+    throw new Error(normalized.reason);
+  return normalized.uri;
+}
+function normalizeWorkspaceReference(raw) {
+  const trimmed = raw.trim();
+  if (trimmed.length === 0) {
+    return { ok: false, reason: 'a workspace reference must be a non-empty workspace-relative path, e.g. "./src/harness/search"' };
+  }
+  if (UNSAFE_ABSOLUTE.test(trimmed) || UNSAFE_SCHEME.test(trimmed) || trimmed.includes("\\")) {
+    return {
+      ok: false,
+      reason: `"${trimmed}" is not a workspace-relative path \u2014 an absolute path, a URL and a Windows path are all refused. Use a path inside the project, e.g. "./src/harness/search".`
+    };
+  }
+  const withoutDotSlash = trimmed.startsWith("./") ? trimmed.slice(2) : trimmed;
+  const withoutTrailingSlash = withoutDotSlash.replace(/\/+$/, "");
+  if (withoutTrailingSlash.length === 0) {
+    return { ok: false, reason: `"${trimmed}" names the project root rather than a path inside it \u2014 name a directory or file, e.g. "./src/harness/search".` };
+  }
+  const segments = withoutTrailingSlash.split("/");
+  if (segments.includes("..") || segments.includes(".")) {
+    return { ok: false, reason: `"${trimmed}" contains a "." or ".." path segment \u2014 a workspace reference must stay inside the project.` };
+  }
+  const uri = `./${withoutTrailingSlash}`;
+  if (!WORKSPACE_REFERENCE_PATTERN.test(uri)) {
+    return {
+      ok: false,
+      reason: `"${trimmed}" is not a usable workspace reference. The stored form is "${uri}" if the characters are the problem: ` + 'each path segment may contain only letters, digits, ".", "_" and "-", and no ".." segment is allowed.'
+    };
+  }
+  return { ok: true, uri };
+}
+var WORKSPACE_REFERENCE_PATTERN, UNSAFE_ABSOLUTE, UNSAFE_SCHEME;
+var init_workspace_reference = __esm(() => {
+  WORKSPACE_REFERENCE_PATTERN = /^\.\/(?!(?:.*\/)?\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+  UNSAFE_ABSOLUTE = /^[/\\]/;
+  UNSAFE_SCHEME = /^[a-z][a-z0-9+.-]*:/i;
+});
+
 // src/sac/index.ts
 import { access as access2, readFile as readFile50, realpath as realpath6 } from "fs/promises";
 import { createHash as createHash18 } from "crypto";
@@ -25085,11 +25128,12 @@ async function evaluateStrictSacGuard(input) {
 }
 var idPattern, subjectPattern, revisionPattern, correlationPattern, workspacePathPattern, receiptHashPattern, utcPattern, forbiddenPayloadKeys, normativeSchemaFiles, normativeSchemas, NORMATIVE_SCHEMA_DIR, SacReferenceError, trustedActors, roleRank;
 var init_sac = __esm(() => {
+  init_workspace_reference();
   idPattern = /^[a-z][a-z0-9-]{2,63}$/;
   subjectPattern = /^(?:user|team|service|agent):[a-z0-9][a-z0-9._-]{0,127}$/;
   revisionPattern = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
   correlationPattern = /^[A-Za-z0-9][A-Za-z0-9._:-]{15,255}$/;
-  workspacePathPattern = /^\.\/(?!.*(?:^|\/)\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+  workspacePathPattern = WORKSPACE_REFERENCE_PATTERN;
   receiptHashPattern = /^[a-f0-9]{64}$/;
   utcPattern = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?Z$/;
   forbiddenPayloadKeys = new Set(["prompt", "transcript", "hiddenReasoning", "secret", "secrets", "rawContent"]);
@@ -51085,7 +51129,7 @@ import path47 from "path";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.130",
+  version: "0.2.132",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -59054,7 +59098,7 @@ init_provenance();
 
 // src/sync/diff.ts
 init_provenance();
-var CODE_EXT2 = /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|java|rb|php|c|h|cc|cpp|hpp|cs|swift|kt|scala|sh|vue|svelte)$/;
+var CODE_EXT2 = /\.(ts|tsx|mts|cts|js|jsx|mjs|cjs|py|go|rs|java|rb|php|c|h|cc|cpp|hpp|cs|swift|kt|scala|sh|vue|svelte)$/;
 function isCodeFile(file) {
   return CODE_EXT2.test(file);
 }
@@ -59176,7 +59220,22 @@ On git pull / branch switch, they run 'keryx sync' (advisory report). Run 'keryx
     }
     const code = codeOnly(diff);
     if (totalChanges(code) === 0) {
-      console.log(`  up to date (built at ${provenance.commit.slice(0, 8)})`);
+      if (apply && provenance.commit !== head.commit) {
+        if (module === "gdwiki") {
+          const gate = await resolveWikiSourceGate(cwd, HEAD_NOT_REQUESTED);
+          if (gate.status !== "fresh") {
+            printApplyOutcome({ recorded: false, gate }, "", `  up to date (built at ${provenance.commit.slice(0, 8)}); HEAD moved to ${head.commit.slice(0, 8)} with no code changes, but provenance NOT advanced`);
+            console.log("");
+            continue;
+          }
+        }
+        await recordProvenance(cwd, module, at);
+        console.log(`  up to date (built at ${provenance.commit.slice(0, 8)}); no code changed \u2014 provenance advanced to ${head.commit.slice(0, 8)}`);
+      } else if (provenance.commit !== head.commit) {
+        console.log(`  up to date (built at ${provenance.commit.slice(0, 8)}); HEAD moved to ${head.commit.slice(0, 8)} with no code changes \u2014 run \`keryx sync --apply\` to advance provenance`);
+      } else {
+        console.log(`  up to date (built at ${provenance.commit.slice(0, 8)})`);
+      }
       console.log("");
       continue;
     }
@@ -78293,6 +78352,7 @@ function toMcpTools(ops = METAPROJECT_OPERATIONS, adapterFor = (cwd) => createMe
 }
 
 // src/sac/fwk-service.ts
+init_workspace_reference();
 init_assembly();
 init_sac();
 init_workspace_service();
@@ -78303,6 +78363,7 @@ import { appendFile as appendFile7, mkdir as mkdir59, open as open2, readFile as
 import path174 from "path";
 
 // src/sac/policy-experiment.ts
+init_workspace_reference();
 import { createHash as createHash34, createHmac as createHmac2 } from "crypto";
 
 // src/sac/receipt-integrity.ts
@@ -78366,7 +78427,7 @@ function stableValue(value) {
 }
 var stableJson2 = (value) => JSON.stringify(stableValue(value));
 var sha2564 = (value) => createHash34("sha256").update(stableJson2(value), "utf8").digest("hex");
-var workspacePathPattern2 = /^\.\/(?!.*(?:^|\/)\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+var workspacePathPattern2 = WORKSPACE_REFERENCE_PATTERN;
 var trustedOutcomes = new WeakMap;
 var trustedSandboxEvidence = new WeakMap;
 var trustedSandboxExecutions = new WeakMap;
@@ -78458,7 +78519,7 @@ var metadataOnly = (value) => {
 var nowIso2 = (now) => now().toISOString();
 var reportHashPattern = /^[a-f0-9]{64}$/;
 var immutableVersionPattern = /(?:^|[-_.:])(?:latest|next|head|main|develop)(?:$|[-_.:])/i;
-var workspacePathPattern3 = /^\.\/(?!.*(?:^|\/)\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+var workspacePathPattern3 = WORKSPACE_REFERENCE_PATTERN;
 var policyExperimentConfigPath = [".metaproject", "context-operations", "policy-experiment", "config.json"];
 var stableValue2 = (value) => {
   if (Array.isArray(value))
@@ -79333,6 +79394,7 @@ async function reclaimStaleExternalSlates(cwd, now = () => new Date) {
 init_slate();
 init_workspace_resolve();
 init_redact();
+init_workspace_reference();
 
 // src/mcp/tools.ts
 import { randomUUID as randomUUID19 } from "crypto";
@@ -79545,7 +79607,8 @@ function buildToolRegistry() {
         const title = stringParam2(params, "title")?.trim() ?? "";
         if (title.length === 0)
           throw new Error("sac.workspaceCreate requires a non-empty 'title'");
-        const component = stringParam2(params, "component");
+        const rawComponent = stringParam2(params, "component");
+        const component = rawComponent === undefined ? undefined : requireWorkspaceReference(rawComponent);
         const workspace = await sacWorkspaceService(cwd).create({ request: undefined, requestCorrelationId: randomUUID19(), id: newWorkspaceId(), title, ...component ? { component: { kind: "component", uri: component } } : {} });
         return workspace;
       }
@@ -87467,7 +87530,12 @@ function workspaceCreateTool(cwd, getSessionDir) {
       const title = typeof input.title === "string" ? input.title.trim() : "";
       if (title.length === 0)
         return { output: "workspace_create requires a non-empty 'title'", isError: true };
-      const component = typeof input.component === "string" && input.component.length > 0 ? input.component : undefined;
+      const rawComponent = typeof input.component === "string" && input.component.length > 0 ? input.component : undefined;
+      const normalizedComponent = rawComponent === undefined ? undefined : normalizeWorkspaceReference(rawComponent);
+      if (normalizedComponent !== undefined && !normalizedComponent.ok) {
+        return { output: "workspace_create: " + normalizedComponent.reason, isError: true };
+      }
+      const component = normalizedComponent?.ok === true ? normalizedComponent.uri : undefined;
       try {
         const workspace = await service5(cwd).create({
           request: undefined,
@@ -93273,14 +93341,25 @@ async function classifySession(session) {
         sessionId: session.id,
         ...workspaceId !== undefined ? { workspaceId } : {},
         lastSeenAt: session.updatedAt,
+        reason: "wrap-up-failed",
         wrapUpOutcome: { trigger: wrapUpOutcome.trigger, generatedAt: wrapUpOutcome.generatedAt, groups: wrapUpOutcome.groups }
       }
     };
   }
   if (!await isSlateEngaged(dir))
     return;
-  const workspaceId = (await safeReadSlate(dir))?.workspaceId;
-  return { kind: "unknown", item: { type: "unknown", sessionId: session.id, ...workspaceId !== undefined ? { workspaceId } : {}, lastSeenAt: session.updatedAt } };
+  const slateRead = await readSlateState(dir);
+  const workspaceId = slateRead.state === "ok" ? slateRead.slate.workspaceId : undefined;
+  return {
+    kind: "unknown",
+    item: {
+      type: "unknown",
+      sessionId: session.id,
+      ...workspaceId !== undefined ? { workspaceId } : {},
+      lastSeenAt: session.updatedAt,
+      reason: slateRead.state === "unreadable" ? "slate-unreadable" : "no-resolution-recorded"
+    }
+  };
 }
 async function readExternalUnboundCandidates(cwd) {
   const extDir = externalSlatesDir(cwd);
@@ -93533,6 +93612,17 @@ async function isSlateEngaged(dir) {
     return false;
   }
 }
+async function readSlateState(dir) {
+  try {
+    const slate = await readSlate(dir);
+    return slate === undefined ? { state: "absent" } : { state: "ok", slate };
+  } catch (error) {
+    return isNotFound2(error) ? { state: "absent" } : { state: "unreadable" };
+  }
+}
+function isNotFound2(error) {
+  return typeof error === "object" && error !== null && error.code === "ENOENT";
+}
 async function safeReadSlate(dir) {
   try {
     return await readSlate(dir);
@@ -94498,7 +94588,7 @@ function summarizeReviewItem(item) {
     case "unbound-candidate":
       return `${item.sessionId} \u2014 ${item.summary}`;
     case "unknown":
-      return `${item.sessionId} \u2014 last seen ${item.lastSeenAt}`;
+      return `${item.sessionId} \u2014 ${unknownReasonLabel(item.reason)} (last seen ${item.lastSeenAt})`;
   }
 }
 function formatReviewListLines(items, selected) {
@@ -94510,6 +94600,26 @@ function formatReviewListLines(items, selected) {
     return `${mark} ${TYPE_LABEL[item.type].padEnd(8)} ${summarizeReviewItem(item)}`;
   });
 }
+function unknownReasonLabel(reason) {
+  switch (reason) {
+    case "wrap-up-failed":
+      return "wrap-up failed";
+    case "slate-unreadable":
+      return "slate.json unreadable";
+    case "no-resolution-recorded":
+      return "no resolution recorded";
+  }
+}
+function unknownReasonDetail(reason) {
+  switch (reason) {
+    case "wrap-up-failed":
+      return "a wrap-up dispatch ran and every group failed - the per-kind reasons are above where recorded; re-run wrap-up after fixing them.";
+    case "slate-unreadable":
+      return "this session's slate.json exists but could not be read. Its record is DAMAGED, not absent: inspect the file before assuming nothing happened.";
+    case "no-resolution-recorded":
+      return "Slate engagement with no proposal, terminal state, unbound-candidate or wrap-up-outcome artifact recorded.";
+  }
+}
 function describeReviewItem(item) {
   switch (item.type) {
     case "proposal":
@@ -94551,7 +94661,7 @@ function describeReviewItem(item) {
       ] : [
         `Session    ${item.sessionId}${item.workspaceId !== undefined ? `  (workspace ${item.workspaceId})` : ""}`,
         `Last seen  ${item.lastSeenAt}`,
-        "No proposal, terminal state, or unbound-candidate artifact recorded.",
+        "Why unknown: " + unknownReasonDetail(item.reason),
         "",
         `Investigate: keryx sessions list / keryx shell -r ${item.sessionId}`
       ];
@@ -115928,7 +116038,8 @@ async function workspaceCommand(args) {
     if (subcommand === "create") {
       rejectUnknownOptions(args.slice(1), new Set(["--title", "--component"]));
       const title = optionValue(args, "--title");
-      const component = optionValue(args, "--component");
+      const rawComponent = optionValue(args, "--component");
+      const component = rawComponent === undefined ? undefined : requireWorkspaceReference(rawComponent);
       if (!title)
         throw new Error("Usage: keryx workspace create --title <title> [--component <workspace-relative-ref>]");
       const workspace = await service6().create({ request: undefined, requestCorrelationId: randomUUID40(), id: newWorkspaceId(), title, ...component ? { component: { kind: "component", uri: component } } : {} });
@@ -115957,11 +116068,11 @@ async function workspaceCommand(args) {
       rejectUnknownOptions(args.slice(2), new Set(["--kind", "--uri", "--revision"]));
       const workspaceId = args[1];
       const kind = optionValue(args, "--kind");
-      const uri = optionValue(args, "--uri");
+      const rawUri = optionValue(args, "--uri");
       const revision = optionValue(args, "--revision");
-      if (!workspaceId || !kind || !uri)
+      if (!workspaceId || !kind || !rawUri)
         throw new Error("Usage: keryx workspace add-resource <workspace-id> --kind <kind> --uri <workspace-relative-ref> [--revision <revision>]");
-      console.log(JSON.stringify(await service6().addResource({ request: undefined, requestCorrelationId: randomUUID40(), workspaceId, resource: { kind, uri, ...revision ? { revision } : {} } }), null, 2));
+      console.log(JSON.stringify(await service6().addResource({ request: undefined, requestCorrelationId: randomUUID40(), workspaceId, resource: { kind, uri: requireWorkspaceReference(rawUri), ...revision ? { revision } : {} } }), null, 2));
       return;
     }
     if (subcommand === "archive") {
@@ -116235,7 +116346,7 @@ function renderCatchUp(report, includeLifecycleFlags = true) {
   sections.push(renderSection("Pending proposals", report.proposals, (item) => `- Accept, reject, or dismiss ${item.kind} proposal ${item.proposalId} in workspace ${item.workspaceId}` + `${item.note !== undefined ? `: "${item.note}"` : ""}? ` + `Recommendation: ${item.fresh ? "evidence is fresh \u2014 review now (`keryx workspace review " + item.workspaceId + " " + item.proposalId + " --decision <accepted|rejected|dismissed>`)" : "evidence has drifted since this proposal was created \u2014 treat as stale, re-run wrap-up before deciding"}.`));
   sections.push(renderSection("Blocked sessions (stopped unattended)", report.blocked, (item) => `- Session ${item.sessionId} stopped unattended (${item.terminalState.reason}) at ${item.terminalState.occurredAt}. Resume it, or archive and move on? ` + `Recommendation: \`keryx shell -r ${item.sessionId}\` to resume and unblock it.`));
   sections.push(renderSection("Unbound candidates (wrap-up ran, no workspace bound)", report.unboundCandidates, (item) => `- Session ${item.sessionId} produced untriaged seeds with no workspace bound (${item.summary}). Bind to a workspace and propose, or discard? ` + `Recommendation: pick a workspace, then \`keryx workspace propose <workspace-id> --kind <kind> --session ${item.sessionId}\` (evidence: ${item.evidencePath}).`));
-  sections.push(renderSection("Unknown (no resolution recorded)", report.unknown, (item) => `- Session ${item.sessionId} was last seen ${item.lastSeenAt} with no proposal, terminal state, or unbound-candidate artifact recorded. Investigate, or ignore? ` + `Recommendation: \`keryx sessions list\` / \`keryx shell -r ${item.sessionId}\` to see what happened.`));
+  sections.push(renderSection("Unknown (no resolution recorded)", report.unknown, (item) => `- Session ${item.sessionId} was last seen ${item.lastSeenAt}: ${describeUnknownReason(item)}. Investigate, or ignore? ` + `Recommendation: \`keryx sessions list\` / \`keryx shell -r ${item.sessionId}\` to see what happened.`));
   sections.push(renderSection("Unreviewed SAC-owned changes (no proposal on record)", report.unreviewedPaths, (item) => `- Session ${item.sessionId} changed ${item.owner} path \`${item.path}\`${item.status !== undefined ? ` (Status: ${item.status})` : ""} at ${item.changedAt} with NO SAC proposal/receipt behind it \u2014 this looks like it bypassed review. Was this reviewed some other way, or should it be? ` + `Recommendation: \`keryx shell -r ${item.sessionId}\` to see what happened; if the content is good, route it through a real proposal (\`keryx workspace propose ...\`) before trusting it as durable knowledge.`));
   if (includeLifecycleFlags) {
     sections.push(renderSection("Lifecycle flags (component no longer in the graph)", report.lifecycleFlags, (item) => `- ${item.kind} \`${item.ref}\` scopes to \`${item.missingComponent}\`, which is no longer in the code graph (flagged ${item.flaggedAt}). Still relevant, or safe to clean up? ` + `Recommendation: this is report-only \u2014 nothing was archived/edited/removed automatically; ${item.kind === "workspace" ? "`keryx workspace archive " + item.ref + "`" : item.kind === "memory-entry" ? "`keryx memory supersede` or edit the entry directly" : "edit or remove the wiki page directly"} if you decide it's actually stale.`));
@@ -116244,6 +116355,16 @@ function renderCatchUp(report, includeLifecycleFlags = true) {
 
 `);
 }
+function describeUnknownReason(item) {
+  switch (item.reason) {
+    case "wrap-up-failed":
+      return "a wrap-up dispatch ran and every group failed (re-run it after fixing credentials/conflicts)";
+    case "slate-unreadable":
+      return "its slate.json is present but could not be read - the session's own record is damaged, not merely unrecorded";
+    case "no-resolution-recorded":
+      return "it has Slate engagement but no proposal, terminal state, unbound-candidate or wrap-up-outcome artifact";
+  }
+}
 function renderSection(title, items, describe) {
   const lines = [`== ${title} ==`];
   if (items.length === 0)

package/dist/core.js

@@ -20387,10 +20387,12 @@ __export(exports_service9, {
   normalizeCollaborationResult: () => normalizeCollaborationResult,
   normalizeFwkResult: () => normalizeFwkResult,
   normalizeProposalLifecycleResult: () => normalizeProposalLifecycleResult,
+  normalizeWorkspaceReference: () => normalizeWorkspaceReference,
   proposalNotePath: () => proposalNotePath,
   readExternalSlate: () => readExternalSlate,
   reclaimStaleExternalSlates: () => reclaimStaleExternalSlates,
   redactSensitiveText: () => redactSensitiveText,
+  requireWorkspaceReference: () => requireWorkspaceReference,
   resolveOrCreateWorkspace: () => resolveOrCreateWorkspace,
   resolvePolicyExperiment: () => resolvePolicyExperiment,
   rollbackPolicyExperiment: () => rollbackPolicyExperiment,
@@ -20401,8 +20403,50 @@ __export(exports_service9, {
 });
 
 // src/sac/fwk-service.ts
-init_assembly();
 import { createHash as createHash15, randomUUID as randomUUID4 } from "crypto";
+
+// src/sac/workspace-reference.ts
+var WORKSPACE_REFERENCE_PATTERN = /^\.\/(?!(?:.*\/)?\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+var UNSAFE_ABSOLUTE = /^[/\\]/;
+var UNSAFE_SCHEME = /^[a-z][a-z0-9+.-]*:/i;
+function requireWorkspaceReference(raw) {
+  const normalized = normalizeWorkspaceReference(raw);
+  if (!normalized.ok)
+    throw new Error(normalized.reason);
+  return normalized.uri;
+}
+function normalizeWorkspaceReference(raw) {
+  const trimmed = raw.trim();
+  if (trimmed.length === 0) {
+    return { ok: false, reason: 'a workspace reference must be a non-empty workspace-relative path, e.g. "./src/harness/search"' };
+  }
+  if (UNSAFE_ABSOLUTE.test(trimmed) || UNSAFE_SCHEME.test(trimmed) || trimmed.includes("\\")) {
+    return {
+      ok: false,
+      reason: `"${trimmed}" is not a workspace-relative path \u2014 an absolute path, a URL and a Windows path are all refused. Use a path inside the project, e.g. "./src/harness/search".`
+    };
+  }
+  const withoutDotSlash = trimmed.startsWith("./") ? trimmed.slice(2) : trimmed;
+  const withoutTrailingSlash = withoutDotSlash.replace(/\/+$/, "");
+  if (withoutTrailingSlash.length === 0) {
+    return { ok: false, reason: `"${trimmed}" names the project root rather than a path inside it \u2014 name a directory or file, e.g. "./src/harness/search".` };
+  }
+  const segments = withoutTrailingSlash.split("/");
+  if (segments.includes("..") || segments.includes(".")) {
+    return { ok: false, reason: `"${trimmed}" contains a "." or ".." path segment \u2014 a workspace reference must stay inside the project.` };
+  }
+  const uri = `./${withoutTrailingSlash}`;
+  if (!WORKSPACE_REFERENCE_PATTERN.test(uri)) {
+    return {
+      ok: false,
+      reason: `"${trimmed}" is not a usable workspace reference. The stored form is "${uri}" if the characters are the problem: ` + 'each path segment may contain only letters, digits, ".", "_" and "-", and no ".." segment is allowed.'
+    };
+  }
+  return { ok: true, uri };
+}
+
+// src/sac/fwk-service.ts
+init_assembly();
 import { appendFile as appendFile5, mkdir as mkdir28, open as open2, readFile as readFile40, rename as rename6, rm as rm5, stat as stat9, writeFile as writeFile21 } from "fs/promises";
 import path78 from "path";
 
@@ -20415,7 +20459,7 @@ var idPattern = /^[a-z][a-z0-9-]{2,63}$/;
 var subjectPattern = /^(?:user|team|service|agent):[a-z0-9][a-z0-9._-]{0,127}$/;
 var revisionPattern = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
 var correlationPattern = /^[A-Za-z0-9][A-Za-z0-9._:-]{15,255}$/;
-var workspacePathPattern = /^\.\/(?!.*(?:^|\/)\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+var workspacePathPattern = WORKSPACE_REFERENCE_PATTERN;
 var receiptHashPattern = /^[a-f0-9]{64}$/;
 var utcPattern = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?Z$/;
 var forbiddenPayloadKeys = new Set(["prompt", "transcript", "hiddenReasoning", "secret", "secrets", "rawContent"]);
@@ -21661,7 +21705,7 @@ var stableJson2 = (value) => JSON.stringify(stableValue(value));
 var sha2562 = (value) => createHash14("sha256").update(stableJson2(value), "utf8").digest("hex");
 var sha256Content = (value) => createHash14("sha256").update(value).digest("hex");
 var pseudonym = (key, value) => createHmac2("sha256", key).update(value, "utf8").digest("hex");
-var workspacePathPattern2 = /^\.\/(?!.*(?:^|\/)\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+var workspacePathPattern2 = WORKSPACE_REFERENCE_PATTERN;
 var trustedOutcomes = new WeakMap;
 var trustedSandboxEvidence = new WeakMap;
 var trustedSandboxExecutions = new WeakMap;
@@ -22138,7 +22182,7 @@ var metadataOnly = (value) => {
 var nowIso = (now) => now().toISOString();
 var reportHashPattern = /^[a-f0-9]{64}$/;
 var immutableVersionPattern = /(?:^|[-_.:])(?:latest|next|head|main|develop)(?:$|[-_.:])/i;
-var workspacePathPattern3 = /^\.\/(?!.*(?:^|\/)\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+var workspacePathPattern3 = WORKSPACE_REFERENCE_PATTERN;
 var policyExperimentConfigPath = [".metaproject", "context-operations", "policy-experiment", "config.json"];
 var stableValue2 = (value) => {
   if (Array.isArray(value))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.2.130",
+  "version": "0.2.132",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {

package/src/gdgraph/staleness.ts

@@ -128,6 +128,27 @@ export async function checkGraphStaleness(cwd: string): Promise<StalenessCheck>
   let gitFailed = false;
 
   // --- new commit -----------------------------------------------------------
+  //
+  // Flow 280 (the graph-provenance stall): this comparison is intentionally a
+  // bare commit-hash check, and it stays one. The disagreement that flow
+  // fixed — a `.metaproject/`-only commit left `keryx sync` saying "nothing
+  // to rebuild" while THIS check said "stale" forever, because nothing ever
+  // advanced the provenance commit this reads — was not a defect in this
+  // comparison. `checkGraphStaleness` has no notion of "since provenance was
+  // last recorded" and no per-commit diff to reason from; it only ever sees
+  // the two endpoints (`provenance.commit`, `head.commit`). Rederiving "did
+  // any code file change between them" here would mean re-running the same
+  // diff `../sync/diff.ts` already computes, in a module whose contract is a
+  // cheap, dependency-light freshness probe (staleness.test.ts, AFC-10) —
+  // and would leave that diff computed twice, once here and once in sync's
+  // own loop, with the two free to drift. The fix instead makes the ONE place
+  // that already has the diff (`../commands/sync.ts`'s per-module loop)
+  // advance provenance to HEAD when that diff is empty, so this check's
+  // simple "did the commit move" question starts answering "no" again — which
+  // is also why it is correct for this to stay a hard equality check: once
+  // provenance is honestly advanced, an ADVANCING mismatch here really does
+  // mean the graph predates HEAD, and this is exactly the check the wiki gate
+  // (`../wiki/staleness.ts`) needs to keep trusting for that.
   const head = await gitHead(cwd);
   if (head === null) {
     gitFailed = true;