@mrciphersmith/keryx 0.3.51 → 0.3.53

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.3.51",
+  "version": "0.3.53",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {

package/src/gdskills/bundled/skills/core/reviewer-skill-creator/SKILL.detail.md

@@ -171,9 +171,10 @@ Read three things off it before running for real:
   the reviewer will cite a rule the project will not have. `differs` means a
   file already answers that reference with other content.
 
-A dry-run does not run the security gate that a real run applies to every file
-it writes, so a `would-…` status can be optimistic: the real run may still block
-a package, or report a rule as `unresolved` with `blocked by the security gate`.
+A dry-run runs the same security gate a real run does, on the text that would
+be written, so a `would-…` status already says what the gate would do. A file
+the gate would refuse is `would-refuse`, and a file it would change or flag
+carries the reason on its row (section 3, "The security gate on import").
 
 ### 3. The real run, and what it writes
 
@@ -202,14 +203,14 @@ imported: 3 overwritten: 0 updated: 0 skipped: 1 would-import: 0 would-overwrite
 
 A reviewer that cites `<dir>/<name>.mdc` reads `.metaproject/rules/project/<dir>/<name>.mdc` when that file exists,
 and `.metaproject/rules/<dir>/<name>.mdc` otherwise. `keryx init`, `keryx update` and `keryx skills install` overwrite
-rules/core with keryx's own rules and leave rules/project alone. `keryx review reviewers` lists each such reference
-under `shadowedRules`.
+rules/core with keryx's own rules (the manifest form of `skills install` skips files it has no record of) and leave
+rules/project alone. `keryx review reviewers` lists each such reference under `shadowedRules`.
 
 Reviewers: `keryx review reviewers` must list every imported review/* name. That is the same call review-orchestrator makes.
 ```
 
-The note's "`keryx skills install` overwrite rules/core" is true of one of its
-two forms. **`keryx init`, `keryx update` and the legacy-profile form of
+The note's "`keryx skills install` overwrite rules/core" is true of the legacy
+profile form; the manifest form skips files it has no record of (below). **`keryx init`, `keryx update` and the legacy-profile form of
 `keryx skills install`** (`--profile minimal|recommended|full|custom` with no
 manifest flag) copy keryx's rules over `rules/core`. The manifest form with
 `--target keryx-shell` also writes `rules/core`, but skips an existing file its
@@ -280,7 +281,8 @@ reports one status:
   and the project has no file for yet; the overlay's goes to
   `.metaproject/rules/project/core/<name>.mdc` rather than to `rules/core`,
   because `keryx init`, `keryx update` and the legacy-profile
-  `keryx skills install` overwrite `rules/core` with keryx's own rules.
+  `keryx skills install` overwrite `rules/core` with keryx's own rules (the
+  manifest form skips files it has no record of).
 - `unresolved` — no `rules/` directory beside the source has it. Add the file by
   hand, or the reviewer keeps citing a rule the project lacks.
 
@@ -305,6 +307,107 @@ to overwrite`, and the rule rows are re-resolved — `present` for both files
 written above, the second with `the reviewer reads
 .metaproject/rules/project/core/error-handling.mdc`.
 
+**The security gate on import.** `keryx skills import`, `keryx review import`
+and `keryx skills update` pass every `SKILL.md` and rule through the security
+gate on the final text, while planning, so a dry run reports it too. The gate
+does not write silently:
+
+- A secret is masked in what is written, and the row says so: `redacted by the
+  security gate (…)`. On a dry run, `would be redacted by the security gate (…)`.
+- Any other finding follows the project's security mode and is reported on the
+  row as `flagged by the security gate (…)`.
+- A **prompt-injection** finding refuses the file in every security mode. The row
+  status is `refused` (`would-refuse` on a dry run), the reason is the gate's own
+  leak-safe summary (policy ids and counts, never the matched text), nothing is
+  written and no scaffold is left. The other packages and rules go on.
+- **With the security module disabled** the guard reports nothing, so the import
+  runs the deterministic prompt-injection detector itself and refuses on a match
+  exactly as above; the row reason says `the security module is disabled, so the
+  import ran its own injection check`. A secret is still masked by the floor
+  redaction; clean text imports as usual.
+- A rule cited **only** by refused (`would-refuse`) packages is not written. Its
+  row reads `skipped — cited only by a refused package`, on a dry run and a real
+  run alike; a rule an imported package also cites is handled as before.
+- **Exit code.** A real run that produced any `refused` row prints every row (text
+  or `--json`) and then exits 1. A dry run, whose rows say `would-refuse`, exits 0.
+- The file is gated once, before anything is written, and the text written is the
+  text gated: a refusal leaves no scaffold, registry entry or catalog row, and
+  never overwrites an installed `SKILL.md` on `--force` or update.
+- `--allow-flagged` writes a prompt-injection-flagged file anyway, after you have
+  read it. The row then reads `flagged by the security gate (…), written because
+  --allow-flagged` (`would be written because --allow-flagged` on a dry run). It
+  never overrides a block by the project's security mode: under mode `enforced`
+  a secret is refused with or without the flag.
+
+The flag belongs to all three commands: `keryx skills import … [--allow-flagged]`,
+`keryx review import … [--allow-flagged]`, `keryx skills update … [--allow-flagged]`.
+The summary line gains `refused: N` (`would-refuse: N` on a dry run) only when
+N is above zero, and the note under it names `--allow-flagged` only when a refused
+row carries a prompt-injection finding (the flag cannot change any other
+refusal). This is the output for an overlay with two reviewers, one whose
+body tries to override the agent's instructions and asks it to disclose its
+own context, and one that holds the AWS documentation placeholder access key:
+
+```
+$ keryx review import --from ./ov --only 'review-acme-*' --dry-run
+# skills import
+
+from: ./ov
+dry-run: yes
+force: no
+imported: 0 overwritten: 0 updated: 0 skipped: 0 would-import: 1 would-overwrite: 0 would-refuse: 1
+…
+## packages
+
+- review/review-acme-inj: would-refuse — [security] pass: 2 finding(s) (prompt-injection:2)
+- review/review-acme-key: would-import — would be redacted by the security gate ([security] fail: 1 finding(s) (secret:1)) — review-orchestrator will dispatch this after `keryx review reviewers` lists it
+
+A refused file was not written. A prompt-injection refusal can be overridden after you read the file: run the command again with --allow-flagged.
+…
+
+$ keryx review import --from ./ov --only 'review-acme-*'
+…
+imported: 1 overwritten: 0 updated: 0 skipped: 0 would-import: 0 would-overwrite: 0 refused: 1
+
+- review/review-acme-inj: refused — [security] pass: 2 finding(s) (prompt-injection:2)
+- review/review-acme-key: imported — redacted by the security gate ([security] fail: 1 finding(s) (secret:1)) — review-orchestrator will dispatch this after `keryx review reviewers` lists it
+…
+
+$ keryx review import --from ./ov --only 'review-acme-inj' --dry-run --allow-flagged
+…
+- review/review-acme-inj: would-import — flagged by the security gate ([security] pass: 2 finding(s) (prompt-injection:2)), would be written because --allow-flagged — review-orchestrator will dispatch this after `keryx review reviewers` lists it
+…
+```
+
+Row statuses, with the gate in them: `imported`, `overwritten`, `updated`,
+`skipped`, `would-import`, `would-overwrite`, `refused`, `would-refuse`.
+
+In `--json` a row carries a `security` object when the gate had something to say
+about it, and none otherwise. The refused row above, trimmed:
+
+```json
+{
+  "name": "review-acme-inj",
+  "module": "review",
+  "status": "would-refuse",
+  "reason": "[security] pass: 2 finding(s) (prompt-injection:2)",
+  "security": {
+    "action": "warn",
+    "findings": [
+      { "policyId": "prompt-injection.ignore-instructions", "category": "prompt-injection", "action": "warn" },
+      …
+    ],
+    "redacted": false,
+    "refused": true
+  }
+}
+```
+
+`security.redacted` is true when the gate changed the bytes that are, or would
+be, written; `security.refused` is true when the file was not (or would not be)
+written. A caller that used to read `status` alone must now treat `refused` and
+`would-refuse` as failures to import that exit 0.
+
 ### 4. Reading `keryx review reviewers`
 
 ```
@@ -572,10 +675,11 @@ $ keryx review reviewers
 - review-acme-api: `vendor/acme-overlay/skills/review-acme-api/SKILL.md` changed since 2026-09-30T15:49:48.204Z
 …
 $ keryx skills update review/review-acme-api --dry-run
+# skills update
 …
-## would import (1) — dry run, nothing written
+## would update (1) — dry run, nothing written
 
-- review/review-acme-api (overwrites the existing one)
+- review/review-acme-api
 …
 $ keryx skills update review/review-acme-api
 …

package/src/gdskills/bundled/skills/core/reviewer-skill-creator/SKILL.md

@@ -17,7 +17,6 @@ triggers:
   - "make a reviewer from this profile"
   - "создай ревьюера"
   - "создай нового ревьюера на основании"
-  - "import vantage reviewers"
   - "import overlay reviewers"
 metadata:
   author: "MrCipherSmith"

package/src/gdskills/bundled/skills/orchestration/flow-orchestrator/SKILL.md

@@ -631,7 +631,7 @@ keryx flow complete <id>
 
 Completion is allowed only after the PR merge has been confirmed. The merge
 target must be the base branch captured when the flow was created; do not
-silently retarget or close against another branch. Flows created since the owner gate fail completion while no owner is set (`keryx flow owner set <id> --owner "<name>" --reason "<why>"`); `ac confirm` and `flow complete` append a signature — `--signed-by "<name>"` names the signer, otherwise `KERYX_ACTOR` or the local git identity is recorded, as a claim. A flow created with `--require-confirmation` needs one more gate — `--confirm-token <token>` from `keryx flow confirm <id>`, a short-lived single-use token minted by a typed challenge in a terminal; it proves an interactive step ran outside the agent's tool roster, not that a human ran it. A flow left stuck in `completing` by a crash or interrupted attempt (never a normal gate failure) recovers with `keryx flow recover <id> --reason "<why>"`.
+silently retarget or close against another branch. The flow folder is committed in the same PR as the code; the commit at closing is a rule to follow, not one the gate checks. `flow complete` fails the `folder-committed` gate while the flow's `flow.json` is not in `HEAD` (flows created from 0.3.53 on; commit it with `git add .metaproject/flows/<dir> && git commit`, then run `flow complete` again). `flow init` and `flow renumber` avoid numbers used on known remote branches, and `keryx flow check` reports a clash with a remote branch (repair with `keryx flow renumber <dir> --to <free id> --reason "<why>"`) and warns about a folder that is not committed. Flows created since the owner gate fail completion while no owner is set (`keryx flow owner set <id> --owner "<name>" --reason "<why>"`); `ac confirm` and `flow complete` append a signature — `--signed-by "<name>"` names the signer, otherwise `KERYX_ACTOR` or the local git identity is recorded, as a claim. A flow created with `--require-confirmation` needs one more gate — `--confirm-token <token>` from `keryx flow confirm <id>`, a short-lived single-use token minted by a typed challenge in a terminal; it proves an interactive step ran outside the agent's tool roster, not that a human ran it. A flow left stuck in `completing` by a crash or interrupted attempt (never a normal gate failure) recovers with `keryx flow recover <id> --reason "<why>"`.
 
 If gates fail, the CLI returns the flow to `in-progress`. Add a journal note,
 create fix tasks, and repeat Phase 2.

package/src/gdskills/bundled/skills/review/review-orchestrator/SKILL.detail.md

@@ -240,10 +240,9 @@ What to expect from the exit code:
   skills catalog and gdskills module manifest for the `full` profile. It sets
   exit 1 only when `.metaproject/` is absent; a destination it will not write
   through (a symlink, a non-directory) is listed under `Warnings` with exit 0.
-- **The dry-run's `Apply this plan:` hint is not the whole command.** It prints
-  only `--profile` and `--target`, so after a dry-run with
-  `--with capability:mobx` the hinted command installs the profile without
-  `code-mobx-store-review`. Re-type the command you dry-ran, minus `--dry-run`.
+- **The dry-run's `Apply this plan:` hint is the whole command.** It repeats
+  every plan-shaping flag (`--with`, `--without`, `--include-deprecated`,
+  `--target`, `--profile`), so run it as printed.
 
 Run `keryx review reviewers --json` again afterwards and dispatch from what it
 returns.