@mrciphersmith/keryx 0.3.21 → 0.3.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.3.21",
+  "version": "0.3.24",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {
@@ -45,7 +45,7 @@
     "typecheck": "tsc --noEmit",
     "typecheck:scripts": "tsc --project tsconfig.scripts.json --noEmit",
     "test": "bun test",
-    "test:core": "bun test src/cli src/core src/shell-source-audits.test.ts src/acp/ src/assets/ src/bundle/ src/capability/ src/commands/ src/contracts/ src/ctx/ src/eval/ src/flow/ src/forgetting/ src/gdgraph/ src/gdskills/ src/governance/ src/health/ src/integrations/ src/job/ src/learning/ src/lib/ src/mcp/ src/memory/ src/metrics/ src/retention/ src/review/ src/rules/ src/sac/ src/security/ src/stack/ src/standard/ src/sync/ src/testing/ src/trigger/ src/wiki/",
+    "test:core": "bun test src/cli src/core src/impact-evidence/ src/shell-source-audits.test.ts src/acp/ src/assets/ src/bundle/ src/capability/ src/commands/ src/contracts/ src/ctx/ src/eval/ src/flow/ src/forgetting/ src/gdgraph/ src/gdskills/ src/governance/ src/health/ src/integrations/ src/job/ src/learning/ src/lib/ src/mcp/ src/memory/ src/metrics/ src/retention/ src/review/ src/rules/ src/sac/ src/security/ src/stack/ src/standard/ src/sync/ src/testing/ src/trigger/ src/wiki/",
     "test:client:terminal": "bun test src/tui/ src/commands/shell",
     "test:client:streaming": "bun test src/harness/provider/",
     "test:client:cancel-resume": "bun test src/harness/run/ src/harness/resume/ src/harness/session/ src/session/ src/bus/ src/commands/sessions",

package/src/gdgraph/query.ts

@@ -72,7 +72,20 @@ export function getFilesDescribedBy(graph: GraphData, pageId: string): string[]
   return [...files].sort();
 }
 
-export function getOrphans(graph: GraphData): string[] {
+/**
+ * `roots` (A-8, flow 356): files reached OUT OF BAND — never by any `import`
+ * statement this graph's builder can see, so they carry no inbound OR
+ * outbound edge and would otherwise report as orphans. `src/lib/
+ * test-preload.ts` is the motivating case: `bunfig.toml`'s `[test].preload`
+ * loads it before any test module runs, which is a real caller this scan
+ * simply cannot see (it is not written as an `import`). Reporting it dead is
+ * a false positive, not a finding — `bunfigPreloadRoots` below is the one
+ * caller (`commands/gdgraph.ts`, `gdgraph/service.ts`) resolves and passes
+ * in; a caller that does not know about a project's `bunfig.toml` (e.g. this
+ * module's own unit tests, `forgetting/propagation.ts`) omits it and gets
+ * the previous, unfiltered behaviour.
+ */
+export function getOrphans(graph: GraphData, roots: ReadonlySet<string> = new Set()): string[] {
   const inbound = new Set(
     graph.edges.filter((edge) => edge.kind !== "unresolved").map((edge) => edge.to),
   );
@@ -81,10 +94,97 @@ export function getOrphans(graph: GraphData): string[] {
   );
   return graph.nodes
     .map((node) => node.path)
-    .filter((file) => !inbound.has(file) && !outbound.has(file))
+    .filter((file) => !inbound.has(file) && !outbound.has(file) && !roots.has(file))
     .sort();
 }
 
+/**
+ * `bunfig.toml`'s declared `preload` entries, resolved to graph-relative
+ * paths (forward-slash, relative to `projectRoot` — the same shape
+ * `GraphNode.path` uses) — the roots {@link getOrphans} excludes (A-8).
+ *
+ * Handles the two shapes Bun actually reads a `preload` array from: a
+ * top-level `preload = […]` (`bun run`/`bunx`) and a table-scoped one
+ * (`[test]\npreload = […]`, this repository's own `bunfig.toml`). Not a
+ * general TOML parser — narrow on purpose, one array key, matching this
+ * repository's own `mcp-servers/compat.ts` precedent of a small reader over
+ * a dependency for one config shape. An absent or unreadable `bunfig.toml`
+ * yields no roots rather than an error: most projects this graph runs
+ * against have none at all.
+ */
+/**
+ * Strip `#`-to-end-of-line comments from `text`, leaving string literals
+ * (single- or double-quoted, double-quoted honoring a `\"` escape) alone —
+ * a `#` inside a string is content, not a comment start. Review round 1,
+ * L3: without this, a commented-out `# preload = […]` line still matched
+ * {@link bunfigPreloadRoots}'s array pattern, since that pattern searched
+ * the raw text with no comment awareness.
+ */
+function stripTomlComments(text: string): string {
+  let result = "";
+  let quote: '"' | "'" | undefined;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (quote !== undefined) {
+      result += ch;
+      if (ch === "\\" && quote === '"' && i + 1 < text.length) {
+        result += text[i + 1];
+        i++;
+        continue;
+      }
+      if (ch === quote) {
+        quote = undefined;
+      }
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      result += ch;
+      continue;
+    }
+    if (ch === "#") {
+      const newlineIndex = text.indexOf("\n", i);
+      if (newlineIndex === -1) {
+        break;
+      }
+      i = newlineIndex - 1;
+      continue;
+    }
+    result += ch;
+  }
+  return result;
+}
+
+export async function bunfigPreloadRoots(projectRoot: string): Promise<Set<string>> {
+  const roots = new Set<string>();
+  let text: string;
+  try {
+    text = await readFile(path.join(projectRoot, "bunfig.toml"), "utf8");
+  } catch {
+    return roots;
+  }
+  // Review round 1, L3: strip `#` comments (outside string literals) before
+  // matching, and anchor the key to a line start — a commented-out
+  // `# preload = […]` line must never contribute a root, and a key that
+  // merely ENDS in "preload" mid-line must never match either.
+  const stripped = stripTomlComments(text);
+  const arrayPattern = /^[ \t]*preload\s*=\s*\[([^\]]*)\]/gm;
+  const stringPattern = /"((?:[^"\\]|\\.)*)"|'([^']*)'/g;
+  for (const arrayMatch of stripped.matchAll(arrayPattern)) {
+    const body = arrayMatch[1] ?? "";
+    for (const stringMatch of body.matchAll(stringPattern)) {
+      const raw = stringMatch[1] ?? stringMatch[2] ?? "";
+      if (raw.length === 0) {
+        continue;
+      }
+      const absolute = path.resolve(projectRoot, raw);
+      const relative = path.relative(projectRoot, absolute).split(path.sep).join("/");
+      roots.add(relative);
+    }
+  }
+  return roots;
+}
+
 export function getAffected(
   graph: GraphData,
   target: string,

package/src/gdgraph/service.ts

@@ -8,7 +8,7 @@
 import { buildGraph } from "./build";
 import { computeAffected, type AffectedOptions, type AffectedResult } from "./affected";
 import { loadGdgraphConfig } from "./config";
-import { getCycles, getOrphans, loadGraph } from "./query";
+import { bunfigPreloadRoots, getCycles, getOrphans, loadGraph } from "./query";
 import { writeRepomap, type RepomapOptions, type RepomapResult } from "./repomap";
 import type { GraphData } from "./types";
 
@@ -90,7 +90,13 @@ export function createGdgraphService(): GdgraphService {
 
     async query(cwd, q) {
       const graph = await loadGraph(cwd);
-      return q === "cycles" ? getCycles(graph) : getOrphans(graph);
+      if (q === "cycles") {
+        return getCycles(graph);
+      }
+      // A-8 (flow 356): same roots as `commands/gdgraph.ts` — a `bunfig.toml`
+      // `preload` entry is a real caller this graph's scan cannot see.
+      const roots = await bunfigPreloadRoots(cwd);
+      return getOrphans(graph, roots);
     },
   };
 }

package/src/gdskills/bundled/skills/review/review-orchestrator/SKILL.md

@@ -1587,10 +1587,12 @@ Fix: <concrete>
 - <what was checked> — <how>
 
 ### How this review was run
-- **Run by:** @<gh-login> with `review-orchestrator`
+- **Workflow:** `review-orchestrator`
 - **Scope:** `<base>..<head>`, round N, PR #N
-- **Orchestrator:** `review-orchestrator`
-- **<actual model name>:** <reviewers on that model>
+- **Models:** <actual models and reviewers, or not recorded>
+- **Tools:** <tools actually invoked, or not recorded>
+- **Skills:** <skills actually used, or not recorded>
+- **Subagents:** <dispatched reviewers and models, or none when confirmed; otherwise not recorded>
 - **Not run:** <reviewer — reason>
 - **Verification:** <mode>; confirmed N, refuted N, unverifiable N, unverified N
 ```
@@ -1663,17 +1665,15 @@ Automation values, names unchanged:
 
 Default is do not publish. No resolvable PR number means skip and say so.
 
-The comment is the report rendered from `templates/review-report.md`, English, with the domain file chosen above (`templates/pr-comment-frontend.md` / `templates/pr-comment-backend.md`) — never a summary written freehand. It does not use a tool heading, a finding table, or a meta table. It does not carry a co-author line, a `Generated with` trailer, or any sentence that names a vendor or a product as the author. Say who ran the orchestrator and which reviewers ran; do not sign the comment as them.
+The comment is the report rendered from `templates/review-report.md`, English, with the domain file chosen above (`templates/pr-comment-frontend.md` / `templates/pr-comment-backend.md`) — never a summary written freehand. It does not use a tool heading, a finding table, or a meta table. It does not carry a co-author line, a `Generated with` trailer, or any sentence that names a vendor or a product as the author. Name the workflow and reviewers that actually ran, with models, tools, skills and subagents. Never identify the operator from `gh auth status`, git config or a credential; do not sign the comment as a person, reviewer or model.
 
 The follow-up file path and the metadata rules (real model names, Run vs Not run, no `adaptive` in the model slot) live in that same template. Write the body to a temp file and post with `gh pr comment <n> --body-file <file>`.
 
 **No GitHub write without an approved draft.** Before ANY write — the comment, a thread reply, `keryx review comments reply`, a review — show the user the rendered body and wait for explicit approval of that body.
 Picking A or B above chooses *whether* to publish, not *what*; a comment is public and cannot be unsent. With no user to answer (a dispatched run), do not write: hand the rendered body back to the caller.
 
-Re-read head and the thread immediately before posting. If head moved, re-check
-the findings against the new head and name the commits that were not reviewed.
-Do not post a finding another reviewer already filed on this head; if yours
-extends theirs, cite theirs.
+Re-read head and thread before posting. If head moved, re-check findings
+and name unchecked commits. Do not duplicate findings; cite extended ones.
 
 ## Job Context Awareness
 

package/src/gdskills/bundled/skills/review/review-orchestrator/templates/review-report.md

@@ -95,14 +95,19 @@ Do not list a checklist item that was not checked. Do not praise.
 
 ## How this review was run
 
-A list, not a meta table. Keep every fact the old Meta table carried.
+A factual run inventory, not an author or account signature. List only steps
+confirmed by the run record; never infer an operator identity from `gh auth`,
+git config, a credential or a PR author. Use `not recorded` when evidence for
+a tool, skill or model is unavailable; use `none` only when the run proves none.
 
 ```markdown
 ### How this review was run
-- **Run by:** @<gh-login> with `review-orchestrator`. Severity and lanes per the repository review rules, else the canonical rubric in this skill.
+- **Workflow:** `review-orchestrator`; severity and lanes per the repository review rules, else the canonical rubric in this skill.
 - **Scope:** `<base>..<head>`, round N, PR #N. Unchecked commits: <list or none>.
-- **Orchestrator:** `review-orchestrator`
-- **<actual model name>:** <reviewers dispatched on it, comma-separated>
+- **Models:** <actual model names and the reviewers that ran on each; or not recorded>.
+- **Tools:** <tools actually invoked for this review and their roles; or not recorded>.
+- **Skills:** <skills actually loaded or executed and their roles; or not recorded>.
+- **Subagents:** <dispatched subagents, their reviewer roles and actual models; or none when confirmed, otherwise not recorded>.
 - **Fallback:** <reviewer> via `general-purpose` because <native agent type unavailable | no bundled agent>. Or `none`.
 - **Not run:** <reviewer> — <short reason>. Or `none`.
 - **Selection:** <auto-detected scope | explicit flags | optional groups the user picked>
@@ -118,8 +123,8 @@ Model rules, unchanged from the old metadata table:
 - Name the model that actually ran. Never write `adaptive`, `inherit`,
   `unsupported`, or `current-session` in the model slot.
 - Group reviewers under the model they ran on. One bullet per model.
-- `Model strategy` (`ask` or `adaptive`) goes on the Run by line or under
-  Selection, not in place of a model name.
+- `Model strategy` (`ask` or `adaptive`) goes under Selection, never in
+  place of an actual model name.
 - Keep **Run** complete. If Not run is long, group it with counts and notable
   names; the full list belongs in the follow-up file.