@mrciphersmith/keryx 0.3.67 → 0.3.73

package/dist/core.js

@@ -6592,6 +6592,40 @@ var init_read_source = __esm(() => {
   init_contained_path();
 });
 
+// src/security/secret-shape.ts
+function isIdentifier(run) {
+  const parts = run.match(RUN_PARTS) ?? [];
+  if (parts.join("") !== run)
+    return false;
+  if (parts.filter((part) => /\d/.test(part)).length > 2)
+    return false;
+  return parts.every((part, index) => {
+    if (/\d/.test(part))
+      return part.length <= 3;
+    if (/[-_]/.test(part))
+      return true;
+    return part.length >= 3 || /\d/.test(parts[index + 1] ?? "");
+  });
+}
+function isSecretRun(run) {
+  return /[a-z]/.test(run) && /[A-Z]/.test(run) && /\d/.test(run) && !isIdentifier(run);
+}
+function looksLikeSecret(text) {
+  if (BOT_TOKEN_SHAPE.test(text))
+    return true;
+  for (const run of text.match(TOKEN_RUN) ?? []) {
+    if (isSecretRun(run))
+      return true;
+  }
+  return false;
+}
+var BOT_TOKEN_SHAPE, TOKEN_RUN, RUN_PARTS;
+var init_secret_shape = __esm(() => {
+  BOT_TOKEN_SHAPE = /\d{6,}:[A-Za-z0-9_-]{30,}/;
+  TOKEN_RUN = /[A-Za-z0-9_-]{32,}|[A-Za-z0-9+/]{40,}={0,2}/g;
+  RUN_PARTS = /[A-Z][a-z]+|[a-z]+|[A-Z]+(?![a-z])|\d+|[-_]/g;
+});
+
 // src/security/credential-shape.ts
 function isDeniedForMcpChild(name, value) {
   if (value !== undefined && CREDENTIAL_IN_VALUE_RE.test(value))
@@ -9817,7 +9851,7 @@ var init_skill_length_ceilings = __esm(() => {
     "planning/docpack-orchestrator": 172,
     "planning/docpack-review": 92,
     "planning/interview": 209,
-    "planning/interviewer": 131,
+    "planning/interviewer": 129,
     "planning/patterns-researcher": 254,
     "planning/planner": 208,
     "planning/prd-creator": 210,
@@ -15814,6 +15848,7 @@ __export(exports_service, {
   isDeniedForMcpChild: () => isDeniedForMcpChild,
   isEntropyBackendEnabled: () => isEntropyBackendEnabled,
   loadSecurityConfig: () => loadSecurityConfig,
+  looksLikeSecret: () => looksLikeSecret,
   looksSecretShaped: () => looksSecretShaped,
   looksSecretShapedIn: () => looksSecretShapedIn,
   memoizeResolved: () => memoizeResolved,
@@ -16077,6 +16112,7 @@ var init_service2 = __esm(() => {
   init_secrets();
   init_entropy();
   init_incidents();
+  init_secret_shape();
   init_entropy_gate();
   init_credential_shape();
   init_audit_harness();
@@ -28951,7 +28987,8 @@ __export(exports_service5, {
   UnknownGraphTargetError: () => UnknownGraphTargetError,
   buildAffectedReport: () => buildAffectedReport,
   checkGraphStaleness: () => checkGraphStaleness,
-  createGdgraphService: () => createGdgraphService
+  createGdgraphService: () => createGdgraphService,
+  estimateTokens: () => estimateTokens2
 });
 
 // src/gdgraph/build.ts
@@ -37391,7 +37428,7 @@ function normalizeFwkResult(result) {
 // src/sac/proposal-lifecycle.ts
 init_fs();
 import { createHash as createHash30, randomUUID as randomUUID7 } from "crypto";
-import { appendFile as appendFile8, mkdir as mkdir35, readdir as readdir20, readFile as readFile64 } from "fs/promises";
+import { appendFile as appendFile8, mkdir as mkdir35, readdir as readdir21, readFile as readFile64 } from "fs/promises";
 import path121 from "path";
 
 // src/sac/trusted-wrap-up.ts
@@ -37541,7 +37578,7 @@ function sessionDir(projectPath, sessionId, dataDir) {
 // src/session/slate.ts
 init_fs();
 init_assembly();
-import { mkdir as mkdir33, readFile as readFile56, rm as rm7 } from "fs/promises";
+import { mkdir as mkdir33, readFile as readFile56, readdir as readdir19, rm as rm7, stat as stat16 } from "fs/promises";
 import path113 from "path";
 init_redact();
 var SLATE_SEED_KINDS = [
@@ -37766,6 +37803,9 @@ function readJsonl2(file) {
         ...o.isError === true ? { isError: true } : {},
         ...typeof o.spillPath === "string" && o.spillPath.length > 0 ? { spillPath: o.spillPath } : {},
         ...o.collapsed === true ? { collapsed: true } : {},
+        ...typeof o.trailStep === "number" && Number.isInteger(o.trailStep) && o.trailStep > 0 ? { trailStep: o.trailStep } : {},
+        ...o.packed === true ? { packed: true } : {},
+        ...o.slateFrame === true ? { slateFrame: true } : {},
         ...typeof o.ts === "string" && o.ts.length > 0 ? { ts: o.ts } : {},
         ...reasoning !== undefined ? { reasoning } : {}
       });
@@ -38136,7 +38176,7 @@ async function consumeConfirmToken(cwd, workspaceId, proposalId, idempotencyKey,
 init_dedup();
 init_store();
 init_config();
-import { readFile as readFile59, readdir as readdir19 } from "fs/promises";
+import { readFile as readFile59, readdir as readdir20 } from "fs/promises";
 import { randomUUID as randomUUID6 } from "crypto";
 import path118 from "path";
 
@@ -38369,7 +38409,7 @@ async function collectWikiDecisionEntries(cwd) {
   const dir = path118.join(cwd, ".metaproject", "wiki", "decisions");
   let files;
   try {
-    files = (await readdir19(dir)).filter((name) => name.endsWith(".md"));
+    files = (await readdir20(dir)).filter((name) => name.endsWith(".md"));
   } catch {
     return [];
   }
@@ -38720,7 +38760,7 @@ init_json();
 init_guard();
 import { createHash as createHash29 } from "crypto";
 import { homedir as homedir2 } from "os";
-import { readFile as readFile62, stat as stat16 } from "fs/promises";
+import { readFile as readFile62, stat as stat17 } from "fs/promises";
 import path120 from "path";
 var VERSION = "0.1.0";
 var PROJECT_SKILLS_DIR = ".metaproject/project-skills";
@@ -38897,7 +38937,7 @@ async function classifyTarget(absoluteTarget, targetExists) {
   if (!targetExists) {
     return "symbol-or-concept";
   }
-  const stats = await stat16(absoluteTarget);
+  const stats = await stat17(absoluteTarget);
   return stats.isDirectory() ? "directory" : "file";
 }
 async function existingRelativePaths(projectRoot, candidates) {
@@ -39420,7 +39460,7 @@ class ProposalLifecycleService {
     const proposalsDir = path121.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals");
     let entries;
     try {
-      entries = (await readdir20(proposalsDir)).filter((name) => name.endsWith(".json"));
+      entries = (await readdir21(proposalsDir)).filter((name) => name.endsWith(".json"));
     } catch (error) {
       if (isNotFound(error))
         return [];
@@ -39930,7 +39970,7 @@ function normalizeCollaborationResult(value) {
 }
 // src/session/external-slate.ts
 init_fs();
-import { mkdir as mkdir38, readdir as readdir21, readFile as readFile66 } from "fs/promises";
+import { mkdir as mkdir38, readdir as readdir22, readFile as readFile66 } from "fs/promises";
 import path124 from "path";
 
 // src/sac/machine-wrap-up.ts
@@ -40398,7 +40438,7 @@ async function writeExternalSlate(cwd, externalSessionId, update) {
 }
 async function listExternalSlateIds(cwd) {
   try {
-    const entries = await readdir21(externalSlatesDir(cwd));
+    const entries = await readdir22(externalSlatesDir(cwd));
     return entries.filter((name) => name.endsWith(".json")).map((name) => name.slice(0, -".json".length));
   } catch (error) {
     if (isNotFound(error))
@@ -41133,6 +41173,18 @@ var HELP_GROUPS = [
     group: "Working in keryx shell",
     summary: "Compact model context \u2014 /compact [focus] (archive kept)."
   },
+  {
+    kind: "slash",
+    name: "/trail",
+    group: "Working in keryx shell",
+    summary: "The tool calls this session recorded (what stays when older rounds leave the request) \u2014 /trail [count] [tool=NAME] [file=TEXT] [from=STEP] [to=STEP]."
+  },
+  {
+    kind: "slash",
+    name: "/notes",
+    group: "Working in keryx shell",
+    summary: "The notes the model keeps for itself (the facts that survive older rounds) \u2014 /notes [key]."
+  },
   {
     kind: "slash",
     name: "/rewind",
@@ -41329,6 +41381,12 @@ var HELP_GROUPS = [
     group: "Automation",
     summary: "Pending remote approvals: list them, allow or deny one call, once (the local answer path of keryx serve)."
   },
+  {
+    kind: "cli",
+    name: "permissions",
+    group: "Automation",
+    summary: "The saved shell rules an Always answer leaves behind: list them (honoured or not, with the reason) and remove one."
+  },
   {
     kind: "cli",
     name: "governance",
@@ -41339,7 +41397,7 @@ var HELP_GROUPS = [
     kind: "cli",
     name: "decisions",
     group: "Automation",
-    summary: "Recommendation journal: record each agent question with options and its recommendation, the human's choice, and report how often they agree (a third are asked blind)."
+    summary: `Recommendation journal: record each agent question with options and its recommendation, the human's choice, and report how often they agree (a third are asked blind). A question also takes your own text: the last row "\u0421\u0432\u043E\u0439 \u043E\u0442\u0432\u0435\u0442\u2026" in the shell, the "\u270D \u0421\u0432\u043E\u0439 \u043E\u0442\u0432\u0435\u0442" button in Telegram, and Tab after an option adds a typed reason.`
   },
   {
     kind: "cli",
@@ -41383,6 +41441,12 @@ var HELP_GROUPS = [
     group: "Automation",
     summary: "Pending remote approvals with scope, consequence and expiry \u2014 allow or deny one call, once."
   },
+  {
+    kind: "slash",
+    name: "/permissions",
+    group: "Automation",
+    summary: "The saved shell rules (what Always remembered): honoured or not, session grants \u2014 remove one."
+  },
   {
     kind: "slash",
     name: "/external-diff",
@@ -41399,7 +41463,7 @@ var HELP_GROUPS = [
     kind: "slash",
     name: "/decisions",
     group: "Automation",
-    summary: "Recommendation journal report: match share by mode and stage, and the deviations with their reasons."
+    summary: "Recommendation journal report: match share by mode and stage, the deviations with their reasons, and your own answers and typed reasons in full (marked \u270D in the sidebar row)."
   },
   {
     kind: "slash",
@@ -41417,7 +41481,13 @@ var HELP_GROUPS = [
     kind: "slash",
     name: "/remote-control",
     group: "Automation",
-    summary: "Drive this session from a Telegram topic: send lines, get replies, answer approvals. Off by default; [name|off|status]."
+    summary: 'Drive this session from a Telegram topic: send lines, get replies, answer approvals and questions (an option button, or "\u270D \u0421\u0432\u043E\u0439 \u043E\u0442\u0432\u0435\u0442" and a reply with your own text). Off by default; [name|off|status].'
+  },
+  {
+    kind: "slash",
+    name: "/history",
+    group: "Automation",
+    summary: "Post the last messages of this session to the Telegram topic, oldest first. [N], 1 to 20; 10 by default."
   },
   {
     kind: "slash",
@@ -41431,6 +41501,12 @@ var HELP_GROUPS = [
     group: "Automation",
     summary: "How Telegram replies are written: tables and lists as rich messages or HTML, with a fallback. [auto|rich|html|plain]."
   },
+  {
+    kind: "slash",
+    name: "/remote-policy",
+    group: "Automation",
+    summary: "Telegram defaults for a turn started there: mode ask|trust, run limit, approval wait. Never changes the shell's /mode."
+  },
   {
     kind: "cli",
     name: "acp",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.3.67",
+  "version": "0.3.73",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {

package/src/gdgraph/service.ts

@@ -25,6 +25,11 @@ export { buildAffectedReport, type AffectedReport, type AffectedReportOptions }
 // `buildAffectedReport` above already follows).
 export { checkGraphStaleness, type StalenessCheck, type StalenessStatus } from "./staleness";
 
+// Flow 393: the shared token estimator, re-exported so session code that sizes the
+// slate frame goes through this facade instead of a direct edge into
+// `gdgraph/repomap.ts`.
+export { estimateTokens } from "./repomap";
+
 export interface GdgraphService {
   build(cwd: string): Promise<{ nodes: number; edges: number; summaryPath: string }>;
   loadGraph(cwd: string): Promise<GraphData>;

package/src/gdskills/bundled/skills/planning/interviewer/SKILL.md

@@ -87,22 +87,20 @@ blockers?: string[]       — unresolved critical unknowns
 - **Max 8 questions** — stop when enough context is gathered
 - **Confirm before proceeding** — summarize gathered context, state the summary's own confidence (the weakest of the answers it rests on), and ask if correct
 
-## Question Bank by Goal Type
+## Host or no host
+
+Before the first question, check whether a host can show it: the `ask_user` tool is available in this run.
 
-### For implementation goals
-- What is the expected input/output?
-- What are the edge cases that must be handled?
-- What is the performance/scale requirement?
-- What should NOT be changed (constraints)?
+- **Host present:** ask every question through `ask_user`, one per call, with the A/B/C/D options as its options.
+- **No host:** ask NO question, not even in plain text; nobody is there to answer it. Return `status: "NEEDS_CONTEXT"` with the `assumptions` you would have asked about (question, assumption, `confidence: "assumption"`), `ready_to_proceed: false`. The caller decides.
+- A cancelled or empty `ask_user` answer is not an answer: record it as an assumption and stop asking.
+- Each `ask_user` question is recorded in the recommendation journal by the tool itself (source, arm, recommendation, answer); you do not record it. `src/decisions/interviewer-path.test.ts` pins this path through the agent's real tool roster.
 
-### For review goals
-- What specific concerns should the review focus on?
-- What is the acceptance criteria?
+## Question Bank by Goal Type
 
-### For architecture/design goals
-- What are the hard constraints (performance, compat, timeline)?
-- What are you most worried about?
-- Who else is affected by this decision?
+- **Implementation:** expected input/output, edge cases that must be handled, performance or scale requirement, what must NOT change.
+- **Review:** which concerns the review should focus on, the acceptance criteria.
+- **Architecture/design:** hard constraints (performance, compat, timeline), what worries you most, who else is affected.
 
 ## Red Flags