@mrciphersmith/keryx 0.2.74 → 0.2.75

package/dist/cli.js

@@ -16448,7 +16448,13 @@ function writeJsonl(file, history, ts) {
 function redactHistory(history) {
   return history.map((message) => ({
     ...message,
-    content: redactSensitiveText(message.content)
+    content: redactSensitiveText(message.content),
+    ...message.toolCalls === undefined ? {} : {
+      toolCalls: message.toolCalls.map((call) => ({
+        ...call,
+        arguments: redactSensitiveText(call.arguments)
+      }))
+    }
   }));
 }
 function readJsonl2(file) {
@@ -17613,6 +17619,9 @@ async function createProjectSkill(projectRoot, options) {
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run: keryx init");
   }
+  if (!isRoutableSkillTarget(options.target)) {
+    throw new Error(`keryx skills create: target ${JSON.stringify(options.target)} reads as prose, not a routing key. ` + 'A target is what `keryx skills route` matches against \u2014 a concept ("auth flow"), a symbol (`IResultDqReport`), ' + "or a path (`src/dq/DqScoreCard.tsx`). A sentence matches nothing and verifies as permanently stale.");
+  }
   const moduleName = slugify3(options.module ?? inferModule(options.target));
   const skillName = slugify3(options.name ?? inferSkillName(options.target));
   const format = options.format ?? "auto";
@@ -18605,6 +18614,23 @@ function authorityFor(manifest, subject) {
 function normalizeProposalLifecycleResult(value) {
   return JSON.parse(JSON.stringify(value));
 }
+async function readProposalSecurityGate(cwd, workspaceId, proposalId) {
+  const file = path86.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile44(file, "utf8"));
+  } catch {
+    return;
+  }
+  if (typeof parsed !== "object" || parsed === null)
+    return;
+  const record = parsed;
+  const gate = record.security?.gate;
+  if (gate !== "pass" && gate !== "needs-approval")
+    return;
+  const evidenceRefs = Array.isArray(record.evidence) ? record.evidence.map((entry) => typeof entry === "object" && entry !== null ? entry.uri : undefined).filter((uri) => typeof uri === "string") : [];
+  return { gate, evidenceRefs };
+}
 var ProposalLifecycleError;
 var init_proposal_lifecycle = __esm(() => {
   init_fs();
@@ -18788,13 +18814,16 @@ async function digestLedgerPrefix(handle, byteLength) {
     return digest2;
   const buffer = Buffer.alloc(Math.min(ledgerDigestChunkBytes, byteLength));
   let position = 0;
-  while (position < byteLength) {
+  const maxChunks = Math.ceil(byteLength / buffer.length);
+  for (let chunk = 0;chunk < maxChunks && position < byteLength; chunk += 1) {
     const result = await handle.read(buffer, 0, Math.min(buffer.length, byteLength - position), position);
     if (result.bytesRead === 0)
       return;
     digest2.update(buffer.subarray(0, result.bytesRead));
     position += result.bytesRead;
   }
+  if (position < byteLength)
+    return;
   return digest2;
 }
 function parseCheckpoint(value) {
@@ -33530,6 +33559,28 @@ async function validateValue(value, schema, valuePath, errors, rootSchema, schem
       message: `Expected array length >= ${schema.minItems}`
     });
   }
+  if (Array.isArray(value) && schema.maxItems !== undefined && value.length > schema.maxItems) {
+    errors.push({
+      path: valuePath,
+      message: `Expected array length <= ${schema.maxItems}`
+    });
+  }
+  if (typeof value === "number" && schema.exclusiveMinimum !== undefined && value <= schema.exclusiveMinimum) {
+    errors.push({
+      path: valuePath,
+      message: `Expected number > ${schema.exclusiveMinimum}`
+    });
+  }
+  if (schema.not !== undefined) {
+    const negated = [];
+    await validateValue(value, schema.not, valuePath, negated, rootSchema, schemaCache);
+    if (negated.length === 0) {
+      errors.push({
+        path: valuePath,
+        message: "Expected value NOT to match the prohibited subschema"
+      });
+    }
+  }
   if (typeof value === "string") {
     if (schema.minLength !== undefined && value.length < schema.minLength) {
       errors.push({
@@ -40350,7 +40401,7 @@ ${renderUntrackedFiles(untracked, config)}
 ` : ""}
 ## Risk Hints
 
-${renderRiskHints(risky, shape)}
+${renderRiskHints(risky, shape, shape.files)}
 
 ## Hunks
 
@@ -40723,13 +40774,19 @@ function renderDiffCounts(file) {
   }
   return file.changed !== undefined ? `: ~${file.changed} changed` : "";
 }
-function renderRiskHints(risky, shape) {
+function renderRiskHints(risky, shape, files) {
   const hints = risky.map((file) => `- ${file.path}`);
   if (shape.pathsAbbreviated) {
     hints.push("- (paths are abbreviated by `--stat`; risk matching is unreliable \u2014 re-run with `--numstat` or `--name-only` to check)");
   }
   if (hints.length === 0) {
-    return shape.mode === "unenumerable" ? "- unknown: no file list in this output shape" : "- none";
+    if (shape.mode === "unenumerable") {
+      return "- unknown: no file list in this output shape";
+    }
+    if (files.length === 0 && (shape.reportedFileCount ?? 0) > 0) {
+      return `- unknown: ${shape.reportedFileCount} file(s) changed but this output shape lists no per-file rows \u2014 nothing was checked. Re-run with \`--numstat\` or \`--name-only\`.`;
+    }
+    return "- none";
   }
   return hints.join(`
 `);
@@ -49574,8 +49631,11 @@ init_project_skills();
 import { readFile as readFile72, readdir as readdir24 } from "fs/promises";
 import path135 from "path";
 var PROJECT_REVIEWER_MODULE = "review";
+function escapeRegexLiteral(literal) {
+  return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 function metadataLine(content, label) {
-  const match = content.match(new RegExp(`^${label.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\\\$&")}:\\s*(.+)$`, "m"));
+  const match = content.match(new RegExp(`^${escapeRegexLiteral(label)}:\\s*(.+)$`, "m"));
   return match?.[1]?.trim();
 }
 async function skillDirs(root) {
@@ -63322,7 +63382,7 @@ import { spawnSync as spawnSync2 } from "child_process";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.74",
+  version: "0.2.75",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -82895,13 +82955,26 @@ async function workspaceCommand(args2) {
       return;
     }
     if (subcommand === "confirm-review") {
-      rejectUnknownOptions(args2.slice(3), new Set);
+      rejectUnknownOptions(args2.slice(3), new Set(["--acknowledge-security"]));
       const workspaceId = args2[1];
       const proposalId = args2[2];
       if (!workspaceId || !proposalId)
-        throw new Error("Usage: keryx workspace confirm-review <workspace-id> <proposal-id>");
-      const { token, expiresAt } = await mintConfirmToken(process.cwd(), workspaceId, proposalId, { securityAcknowledged: true });
-      console.log(JSON.stringify({ token, expiresAt }, null, 2));
+        throw new Error("Usage: keryx workspace confirm-review <workspace-id> <proposal-id> [--acknowledge-security]");
+      const security = await readProposalSecurityGate(process.cwd(), workspaceId, proposalId);
+      if (!security)
+        throw new Error(`keryx workspace confirm-review: cannot read proposal ${proposalId} in workspace ${workspaceId} \u2014 refusing to mint a token for a proposal whose security gate is unknown`);
+      const acknowledgeSecurity = booleanFlag(args2, "--acknowledge-security");
+      if (security.gate === "needs-approval" && !acknowledgeSecurity) {
+        throw new Error([
+          `keryx workspace confirm-review: proposal ${proposalId} is gated \`needs-approval\` \u2014 its evidence tripped the security scan.`,
+          ...security.evidenceRefs.length > 0 ? [`Evidence: ${security.evidenceRefs.join(", ")}`] : [],
+          "Read the evidence, then re-run with --acknowledge-security to state that you have.",
+          "Accepting without reading it is the thing this gate exists to prevent."
+        ].join(`
+`));
+      }
+      const { token, expiresAt } = await mintConfirmToken(process.cwd(), workspaceId, proposalId, { securityAcknowledged: security.gate === "needs-approval" && acknowledgeSecurity });
+      console.log(JSON.stringify({ token, expiresAt, securityGate: security.gate, securityAcknowledged: security.gate === "needs-approval" && acknowledgeSecurity }, null, 2));
       return;
     }
     if (subcommand === "review") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.2.74",
+  "version": "0.2.75",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {