@mstar-harness/dsh 3.1.2 → 3.2.0

package/dist/index.js

@@ -1106,7 +1106,7 @@ var require_lib2 = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-import { existsSync as existsSync21, readFileSync as readFileSync18, readdirSync as readdirSync14 } from "node:fs";
+import { existsSync as existsSync22, readFileSync as readFileSync18, readdirSync as readdirSync14 } from "node:fs";
 import { join as join23 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import {
@@ -1136,9 +1136,9 @@ import { execFileSync as execFileSync3 } from "node:child_process";
 import { mkdirSync as mkdirSync5, readdirSync as readdirSync3, readFileSync as readFileSync5, realpathSync as realpathSync3, statSync as statSync4, writeFileSync as writeFileSync3 } from "node:fs";
 import { basename as basename3, dirname as dirname6, isAbsolute as isAbsolute5, join as join7, resolve as resolve7 } from "node:path";
 import { existsSync as existsSync5, readdirSync as readdirSync4, readFileSync as readFileSync6 } from "node:fs";
-import { existsSync as existsSync7, readdirSync as readdirSync8, readFileSync as readFileSync10 } from "node:fs";
-import { basename as basename4, isAbsolute as isAbsolute7, join as join12, relative as relative4, resolve as resolve10, sep as sep3 } from "node:path";
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync8, readdirSync as readdirSync8, readFileSync as readFileSync10 } from "node:fs";
+import { basename as basename5, isAbsolute as isAbsolute7, join as join12, relative as relative4, resolve as resolve10, sep as sep4 } from "node:path";
+import { existsSync as existsSync9 } from "node:fs";
 import { join as join13 } from "node:path";
 var SEVERITY_ORDER = ["critical", "high", "medium", "low", "nit"];
 function applyEnforcement(gate, opts) {
@@ -2080,7 +2080,7 @@ function validateStatusV2(docOrPath, opts = {}) {
         violations.push(violation4("medium", "status.workflow.mismatched-type", `workflows[] entry ${JSON.stringify(label)} type ${JSON.stringify(entry.type)} does not match its snapshot type ${JSON.stringify(snapshot.type)} — the root entry mirrors the snapshot; align them`));
       }
       if (typeof entry.started_at === "string" && typeof snapshot.started_at === "string" && entry.started_at !== snapshot.started_at) {
-        violations.push(violation4("medium", "status.workflow.mismatched-started-at", `workflows[] entry ${JSON.stringify(label)} started_at ${JSON.stringify(entry.started_at)} does not match its snapshot started_at ${JSON.stringify(snapshot.started_at)} — the root entry mirrors the snapshot; align them`));
+        violations.push(violation4("medium", "status.workflow.mismatched-started-at", `workflows[] entry ${JSON.stringify(label)} started_at ${JSON.stringify(entry.started_at)} does not match its snapshot started_at ${JSON.stringify(snapshot.started_at)} — workflow ${JSON.stringify(label)} collided with another writer (e.g. a concurrent/re-run \`audit promote\` with the same workflow id rewrote the snapshot); the root entry mirrors the snapshot — align them or remove the colliding workflow`));
       }
     }
   }
@@ -3217,14 +3217,14 @@ function validateAuditStatusBlocks(planText) {
   const violations = [];
   const blocks = parseStatusBlocks(planText);
   if (blocks.length === 0) {
-    violations.push(violation9("medium", "audit.status.missing-block", "no `## Status` block found — audit plan files carry the Status block fields (mstar-audit SKILL § Plan files)", "add a `## Status` block with Priority, Effort, Risk, Depends on, Category, Planned at"));
+    violations.push(violation9("medium", "audit.status.missing-block", "no `## Status` block found — audit plan files carry the Status block fields (mstar-audit SKILL.md § Plan output)", "add a `## Status` block with Priority, Effort, Risk, Depends on, Category, Planned at"));
     return { ok: false, violations };
   }
   blocks.forEach((block, index) => {
     const label = blocks.length > 1 ? ` #${index + 1}` : "";
     for (const field of AUDIT_STATUS_FIELDS) {
       if (!block.fields.has(field)) {
-        violations.push(violation9("medium", "audit.status.missing-field", `Status block${label} missing required field "${field}" (mstar-audit SKILL § Plan files)`, `add \`- **${field}**: <value>\` to the Status block`));
+        violations.push(violation9("medium", "audit.status.missing-field", `Status block${label} missing required field "${field}" (mstar-audit SKILL.md § Plan output)`, `add \`- **${field}**: <value>\` to the Status block`));
       }
     }
     const check = (field, pattern, code, expected) => {
@@ -3232,7 +3232,7 @@ function validateAuditStatusBlocks(planText) {
       if (value === undefined)
         return;
       if (!pattern.test(value)) {
-        violations.push(violation9("medium", code, `Status block${label} "${field}" = "${value}" — expected ${expected} (mstar-audit SKILL § Plan files)`, `fix \`- **${field}**:\` to one of: ${expected}`));
+        violations.push(violation9("medium", code, `Status block${label} "${field}" = "${value}" — expected ${expected} (mstar-audit SKILL.md § Plan output)`, `fix \`- **${field}**:\` to one of: ${expected}`));
       }
     };
     check("Priority", /^P[123]$/, "audit.status.invalid-priority", "P1 | P2 | P3");
@@ -3244,74 +3244,6 @@ function validateAuditStatusBlocks(planText) {
   });
   return { ok: violations.length === 0, violations };
 }
-var WHOLE_MATCH_PATTERNS = [
-  { type: "private-key", re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/g },
-  { type: "aws-access-key", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
-  { type: "github-token", re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g },
-  { type: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
-  { type: "jwt", re: /\beyJ[A-Za-z0-9_-]{10,1024}\.[A-Za-z0-9_-]{10,1024}\.[A-Za-z0-9_-]{10,1024}\b/g },
-  { type: "api-secret-key", re: /\bsk-[A-Za-z0-9-]{20,}\b/g }
-];
-var VALUE_PATTERNS = [
-  {
-    typeOf: (key) => key.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase().replace(/[_-]+/g, "-"),
-    re: /(["']?)\b(password|passwd|api[_-]?key|access[_-]?token|auth[_-]?token|secret|token)\b(["']?)(\s*[:=]\s*)("[^"\n]{8,}"|'[^'\n]{8,}'|[A-Za-z0-9_./+\-=]{16,})/gi
-  }
-];
-function buildLineStarts(text) {
-  const starts = [0];
-  for (let i = 0;i < text.length; i++) {
-    if (text[i] === `
-`)
-      starts.push(i + 1);
-  }
-  return starts;
-}
-function lineAt(starts, index) {
-  let lo = 0;
-  let hi = starts.length - 1;
-  while (lo < hi) {
-    const mid = lo + hi + 1 >> 1;
-    if (starts[mid] <= index)
-      lo = mid;
-    else
-      hi = mid - 1;
-  }
-  return lo + 1;
-}
-function redactSecrets(text, filePath) {
-  const starts = buildLineStarts(text);
-  const marker = (type, index) => `[REDACTED ${type}@${lineAt(starts, index)}${filePath === undefined ? "" : ` in ${filePath}`}]`;
-  const replacements = [];
-  const findings = [];
-  for (const pattern of WHOLE_MATCH_PATTERNS) {
-    for (const match of text.matchAll(pattern.re)) {
-      if (match.index === undefined)
-        continue;
-      replacements.push({ index: match.index, length: match[0].length, text: marker(pattern.type, match.index) });
-      findings.push({ line: lineAt(starts, match.index), type: pattern.type });
-    }
-  }
-  for (const pattern of VALUE_PATTERNS) {
-    for (const match of text.matchAll(pattern.re)) {
-      if (match.index === undefined)
-        continue;
-      const type = pattern.typeOf(match[2]);
-      const replacement = `${match[1]}${match[2]}${match[3]}${match[4]}${marker(type, match.index)}`;
-      replacements.push({ index: match.index, length: match[0].length, text: replacement });
-      findings.push({ line: lineAt(starts, match.index), type });
-    }
-  }
-  replacements.sort((a, b) => b.index - a.index);
-  let out = text;
-  for (const r of replacements)
-    out = out.slice(0, r.index) + r.text + out.slice(r.index + r.length);
-  const deduped = new Map;
-  for (const f of findings)
-    deduped.set(`${f.line}:${f.type}`, f);
-  const sorted = [...deduped.values()].sort((a, b) => a.line - b.line || a.type.localeCompare(b.type));
-  return { text: out, findings: sorted };
-}
 function violation10(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
 }
@@ -3606,7 +3538,7 @@ function referenceExists(repoRoot, docText) {
   for (const { ref, isSymbol, module } of refs) {
     if (!isSymbol || module === undefined) {
       const candidate = ref.replace(LINE_SUFFIX_RE, "").replace(ANCHOR_RE, "");
-      if (existsSync7(resolve10(repoRoot, candidate))) {
+      if (existsSync8(resolve10(repoRoot, candidate))) {
         checked++;
       } else {
         violations.push(violation10("medium", "compound.reference.missing-file", `referenced path \`${ref}\` does not exist under ${repoRoot} (compound-refresh Phase 2: referenced code still exists?)`, "update the doc to reference an existing path, or delete the stale reference"));
@@ -3637,7 +3569,7 @@ function collectKnowledgeDocs(dir) {
       if (entry.isDirectory()) {
         stack.push(full);
       } else if (entry.name.endsWith(".md") && entry.name !== "README.md" && entry.name !== "index.md") {
-        docs.push(relative4(dir, full).split(sep3).join("/"));
+        docs.push(relative4(dir, full).split(sep4).join("/"));
       }
     }
   }
@@ -3654,7 +3586,7 @@ function normalizeIndexRef(cell) {
 function assertIndexRows(knowledgeDir) {
   const violations = [];
   const readmePath = join12(knowledgeDir, "README.md");
-  if (!existsSync7(readmePath)) {
+  if (!existsSync8(readmePath)) {
     violations.push(violation10("medium", "compound.index.missing-readme", `missing ${readmePath} — the knowledge index is required (mstar-compound Phase 6: every doc gets a README.md row)`, "create knowledge/README.md with a Document / Source Plan / Description / Status table"));
     return { ok: false, violations };
   }
@@ -3678,7 +3610,7 @@ function assertIndexRows(knowledgeDir) {
   return { ok: violations.length === 0, violations };
 }
 function isFileLikeRoot(root) {
-  return /^[^.]*\.[A-Za-z0-9]{1,10}$/.test(basename4(root));
+  return /^[^.]*\.[A-Za-z0-9]{1,10}$/.test(basename5(root));
 }
 function scopeGuard(path, allowedRoots) {
   const resolved = resolve10(path);
@@ -3687,7 +3619,7 @@ function scopeGuard(path, allowedRoots) {
     if (isFileLikeRoot(r)) {
       if (resolved === r)
         return { ok: true, violations: [] };
-    } else if (resolved === r || resolved.startsWith(r + sep3)) {
+    } else if (resolved === r || resolved.startsWith(r + sep4)) {
       return { ok: true, violations: [] };
     }
   }
@@ -3841,7 +3773,7 @@ function validateRoleMapping(rolesDir, options = {}) {
   const violations = [];
   const referenceById = new Map(mapping.map((m) => [m.agentId, m.reference]));
   for (const { agentId, reference } of mapping) {
-    if (!existsSync8(join13(rolesDir, reference))) {
+    if (!existsSync9(join13(rolesDir, reference))) {
       violations.push(violation12("medium", "roles.mapping.reference.missing", `role "${agentId}" maps to ${reference} which does not exist under ${rolesDir} (mstar-roles § Role Reference Mapping)`, `create ${join13(rolesDir, reference)} or fix the mapping row`));
     }
   }
@@ -4194,21 +4126,21 @@ function skillLocalConfig(config) {
 }
 
 // src/gates/catalog.ts
-import { existsSync as existsSync13, readFileSync as readFileSync9, readdirSync as readdirSync7 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync9, readdirSync as readdirSync7 } from "node:fs";
 import { join as join11 } from "node:path";
 import { createUserMessage } from "@deepseek-ai/dsh-llm";
 
 // src/gates/agent-flow.ts
-import { appendFileSync, closeSync, existsSync as existsSync12, mkdirSync as mkdirSync3, openSync, readFileSync as readFileSync7, readSync, renameSync as renameSync2, rmdirSync, statSync as statSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { appendFileSync, closeSync, existsSync as existsSync13, mkdirSync as mkdirSync3, openSync, readFileSync as readFileSync7, readSync, renameSync as renameSync2, rmdirSync, statSync as statSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join10 } from "node:path";
 
 // src/gates/dispatch.ts
-import { existsSync as existsSync11 } from "node:fs";
-import { basename as basename5, join as join8, resolve as resolve11 } from "node:path";
+import { existsSync as existsSync12 } from "node:fs";
+import { basename as basename4, join as join8, resolve as resolve11 } from "node:path";
 
 // src/gates/workflow-selection.ts
-import { existsSync as existsSync9, readdirSync as readdirSync5, statSync as statSync3 } from "node:fs";
-import { join as join5, relative as relative3 } from "node:path";
+import { existsSync as existsSync10, readdirSync as readdirSync5, statSync as statSync3 } from "node:fs";
+import { dirname as dirname7, join as join5, relative as relative3 } from "node:path";
 var TERMINAL_STATUS_CACHE_MAX = 64;
 var terminalStatusCache = new Map;
 function terminalStatusOf(snapshotPath) {
@@ -4216,6 +4148,7 @@ function terminalStatusOf(snapshotPath) {
   try {
     mtimeMs = statSync3(snapshotPath).mtimeMs;
   } catch {
+    terminalStatusCache.delete(snapshotPath);
     return;
   }
   const cached = terminalStatusCache.get(snapshotPath);
@@ -4241,7 +4174,7 @@ function terminalStatusOf(snapshotPath) {
 }
 function resolveActiveWorkflow(harnessDir) {
   const statusPath = join5(harnessDir, STATUS_FILE);
-  if (!existsSync9(statusPath)) {
+  if (!existsSync10(statusPath)) {
     return {
       kind: "error",
       code: "status.missing",
@@ -4299,7 +4232,7 @@ function resolveReadWorkflow(harnessDir) {
   if (active.kind === "error" && active.code !== "workflow.selection.no-active")
     return active;
   const workflowsDir = resolveWorkflowDir(harnessDir, { harnessDir });
-  if (!existsSync9(workflowsDir)) {
+  if (!existsSync10(workflowsDir)) {
     return {
       kind: "error",
       code: "workflow.selection.no-snapshot",
@@ -4321,8 +4254,10 @@ function resolveReadWorkflow(harnessDir) {
     if (!entry.isDirectory())
       continue;
     const snapshotPath = join5(workflowsDir, entry.name, WORKFLOW_SNAPSHOT_FILE);
-    if (!existsSync9(snapshotPath))
+    if (!existsSync10(snapshotPath)) {
+      terminalStatusCache.delete(snapshotPath);
       continue;
+    }
     const verdict = terminalStatusOf(snapshotPath);
     if (verdict === undefined || !verdict.terminal)
       continue;
@@ -4330,6 +4265,11 @@ function resolveReadWorkflow(harnessDir) {
       best = { workflowId: entry.name, dir: join5(relative3(harnessDir, workflowsDir), entry.name), mtimeMs: verdict.mtimeMs };
     }
   }
+  for (const cachedPath of terminalStatusCache.keys()) {
+    if (!existsSync10(join5(dirname7(cachedPath), WORKFLOW_SNAPSHOT_FILE))) {
+      terminalStatusCache.delete(cachedPath);
+    }
+  }
   if (best === undefined) {
     return {
       kind: "error",
@@ -4489,12 +4429,12 @@ function isNaValue(value) {
 function planIdOf(headerRegion) {
   const planPath = assignmentHeaderValue(headerRegion, "Plan Path");
   if (!isNaValue(planPath)) {
-    const id = basename5(firstToken(planPath) ?? "");
+    const id = basename4(firstToken(planPath) ?? "");
     return id.endsWith(".md") ? id.slice(0, -3) : id;
   }
   const sddDir = assignmentHeaderValue(headerRegion, "SDD dir");
   if (!isNaValue(sddDir)) {
-    const id = basename5(firstToken(sddDir) ?? "");
+    const id = basename4(firstToken(sddDir) ?? "");
     return id === "" ? undefined : id;
   }
   const planId = assignmentHeaderValue(headerRegion, "plan_id");
@@ -4524,7 +4464,7 @@ function leaseGateViolations(harnessDir, exec, writable, prompt) {
     return [leaseViolation("lease.dispatch.unverifiable", `${join8(harnessDir, STATUS_FILE)}: ${selection.kind === "error" ? selection.message : "no active workflow"} — the plan's execution_lease state is unverifiable; STOP before writable dispatch`, "create a valid v2 status.json registering an active workflow (first implement dispatch requires a plan row + lease)")];
   }
   const snapshotPath = join8(harnessDir, selection.dir, WORKFLOW_SNAPSHOT_FILE);
-  if (!existsSync11(snapshotPath)) {
+  if (!existsSync12(snapshotPath)) {
     if (!sdd)
       return [];
     return [leaseViolation("lease.dispatch.unverifiable", `${snapshotPath} is missing — the plan's execution_lease state is unverifiable; STOP before writable dispatch`, "create a valid workflow snapshot registering the plan row (first implement dispatch requires a plan row)")];
@@ -4598,7 +4538,7 @@ function worktreeL2Violations(header) {
   return violations;
 }
 function activeSnapshotRows(harnessDir) {
-  if (!existsSync11(join8(harnessDir, STATUS_FILE)))
+  if (!existsSync12(join8(harnessDir, STATUS_FILE)))
     return { rows: null, controlWorktreePath: undefined, unreadable: false };
   const selection = resolveActiveWorkflow(harnessDir);
   if (selection.kind !== "active") {
@@ -4609,7 +4549,7 @@ function activeSnapshotRows(harnessDir) {
     };
   }
   const snapshotPath = join8(harnessDir, selection.dir, WORKFLOW_SNAPSHOT_FILE);
-  if (!existsSync11(snapshotPath))
+  if (!existsSync12(snapshotPath))
     return { rows: null, controlWorktreePath: undefined, unreadable: true };
   let doc;
   try {
@@ -5339,7 +5279,7 @@ function ledgerContent(file, n) {
 }
 function readAgentFlow(workflowDir, limit) {
   const file = join10(workflowDir, AGENT_FLOW_FILE);
-  if (!existsSync12(file)) {
+  if (!existsSync13(file)) {
     return { events: [], summary: [] };
   }
   const n = limit === undefined ? AGENT_FLOW_DEFAULT_LIMIT : Math.max(0, Math.floor(limit));
@@ -5594,7 +5534,7 @@ function harnessStateSource(harnessDir) {
   if (harnessDir === null)
     return null;
   const statusPath = join11(harnessDir, STATUS_FILE);
-  if (!existsSync13(statusPath))
+  if (!existsSync14(statusPath))
     return null;
   try {
     const selection = resolveReadWorkflow(harnessDir);
@@ -5615,7 +5555,7 @@ function harnessStateSource(harnessDir) {
     }
     const snapshotPath = join11(harnessDir, selection.dir, WORKFLOW_SNAPSHOT_FILE);
     let snapshot;
-    if (!existsSync13(snapshotPath)) {
+    if (!existsSync14(snapshotPath)) {
       return selectionErrorState({
         kind: "error",
         code: "workflow.selection.snapshot-unreadable",
@@ -5707,7 +5647,7 @@ function selectionErrorState(selection, rollup, harnessDir, compass) {
 function projectRollupSource(harnessDir, residuals) {
   const milestones = [];
   const projectsDir = resolveProjectDir(harnessDir, { harnessDir });
-  if (existsSync13(projectsDir)) {
+  if (existsSync14(projectsDir)) {
     let entries;
     try {
       entries = readdirSync7(projectsDir, { withFileTypes: true });
@@ -5718,7 +5658,7 @@ function projectRollupSource(harnessDir, residuals) {
       if (!entry.isDirectory())
         continue;
       const roadmapPath = join11(projectsDir, entry.name, PROJECT_ROADMAP_FILE);
-      if (!existsSync13(roadmapPath))
+      if (!existsSync14(roadmapPath))
         continue;
       try {
         const doc = parseCompassFrontmatterText(readFileSync9(roadmapPath, "utf8"), roadmapPath);
@@ -5783,7 +5723,7 @@ function residualRollup(harnessDir) {
 }
 function projectRegisters(harnessDir) {
   const projectsDir = resolveProjectDir(harnessDir, { harnessDir });
-  if (!existsSync13(projectsDir))
+  if (!existsSync14(projectsDir))
     return [];
   let entries;
   try {
@@ -5796,7 +5736,7 @@ function projectRegisters(harnessDir) {
     if (!entry.isDirectory())
       continue;
     const registerPath = join11(projectsDir, entry.name, PROJECT_REGISTER_FILE);
-    if (!existsSync13(registerPath))
+    if (!existsSync14(registerPath))
       continue;
     try {
       registers.push({ projectId: entry.name, doc: readJson(registerPath) });
@@ -5808,7 +5748,7 @@ function projectRegisters(harnessDir) {
 }
 function knowledgeDigest(harnessDir) {
   const indexPath = join11(harnessDir, "knowledge", "README.md");
-  if (!existsSync13(indexPath))
+  if (!existsSync14(indexPath))
     return null;
   try {
     const categories = new Set;
@@ -5853,7 +5793,7 @@ function compassDirection(compassPath) {
 }
 function steeringCompassPath(harnessDir) {
   const iterationsDir = resolveIterationDir(harnessDir);
-  if (!existsSync13(iterationsDir))
+  if (!existsSync14(iterationsDir))
     return;
   let entries;
   try {
@@ -5865,7 +5805,7 @@ function steeringCompassPath(harnessDir) {
     if (!entry.isDirectory())
       continue;
     const compassPath = join11(iterationsDir, entry.name, "delivery-compass.md");
-    if (!existsSync13(compassPath))
+    if (!existsSync14(compassPath))
       continue;
     let content;
     try {
@@ -5884,7 +5824,7 @@ function iterationGateSource(harnessDir) {
   if (harnessDir === null)
     return;
   const statusPath = join11(harnessDir, STATUS_FILE);
-  if (!existsSync13(statusPath))
+  if (!existsSync14(statusPath))
     return;
   const compass = steeringCompassPath(harnessDir);
   if (compass === undefined)
@@ -5946,12 +5886,12 @@ function agentDigestKey(agent, cwd) {
 }
 
 // src/gates/status.ts
-import { existsSync as existsSync14, readdirSync as readdirSync9 } from "node:fs";
-import { basename as basename7, join as join14, relative as relative5, resolve as resolve13 } from "node:path";
+import { existsSync as existsSync15, readdirSync as readdirSync9 } from "node:fs";
+import { basename as basename6, join as join14, relative as relative5, resolve as resolve13 } from "node:path";
 var LOGGER_NAME = "mstar/status-gate";
 function harnessDocKindOfTarget(harnessDir, targetPath) {
   const resolved = resolve13(targetPath);
-  const name = basename7(resolved);
+  const name = basename6(resolved);
   if (name !== STATUS_FILE && name !== WORKFLOW_SNAPSHOT_FILE && name !== PROJECT_REGISTER_FILE)
     return null;
   const rel = relative5(harnessDir, resolved);
@@ -6029,7 +5969,7 @@ function projectRegisterDocs(harnessDir) {
     if (!entry.isDirectory())
       continue;
     const registerPath = join14(projectsDir, entry.name, PROJECT_REGISTER_FILE);
-    if (!existsSync14(registerPath))
+    if (!existsSync15(registerPath))
       continue;
     try {
       registers.push({ projectId: entry.name, doc: readJson(registerPath) });
@@ -6082,7 +6022,11 @@ ${verdict.violations.map(formatViolation).join(`
   } catch (error) {
     ctx.logger(LOGGER_NAME).error(`status gate degraded to allow: ${error.message}`);
     try {
-      ctx.emit("mstar/status-gate", { operation, target: target.displayPath, result: { ok: true, violations: [] }, hard: false, degraded: true });
+      let hard = false;
+      try {
+        hard = harnessDir !== null && resolveHard(harnessDir, config);
+      } catch {}
+      ctx.emit("mstar/status-gate", { operation, target: target.displayPath, result: { ok: true, violations: [] }, hard, degraded: true });
     } catch (emitError) {
       ctx.logger(LOGGER_NAME).error(`status gate degraded advisory emit failed: ${emitError.message}`);
     }
@@ -6098,8 +6042,8 @@ async function editIntentListener(ctx, resolver, config, adapter, target, actor,
 }
 
 // src/gates/skill-lint.ts
-import { existsSync as existsSync15, readFileSync as readFileSync11 } from "node:fs";
-import { basename as basename8, dirname as dirname7, resolve as resolve14, sep as sep2 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync11 } from "node:fs";
+import { basename as basename7, dirname as dirname9, resolve as resolve14, sep as sep2 } from "node:path";
 var SKILL_LINT_LOGGER = "mstar/skill-lint";
 
 class SkillLintVetoError extends Error {
@@ -6160,13 +6104,13 @@ function skillRootsOf(config) {
   return roots.map((root) => root.trim()).filter((root) => root !== "");
 }
 function isSkillTarget(roots, target) {
-  if (basename8(target.displayPath) !== "SKILL.md")
+  if (basename7(target.displayPath) !== "SKILL.md")
     return false;
   const resolvedPath = resolve14(target.displayPath);
   return roots.some((root) => resolvedPath.startsWith(resolve14(root) + sep2));
 }
 function skillNameOf(target) {
-  return basename8(dirname7(target.displayPath));
+  return basename7(dirname9(target.displayPath));
 }
 function skillCanonicalForm(target) {
   return resolveSkillRoot("dsh", { skill: skillNameOf(target), rel: "SKILL.md" });
@@ -6179,7 +6123,7 @@ function gateSkillIntent(ctx, harnessDir, config, target) {
     if (!isSkillTarget(roots, target))
       return;
     const skillPath = resolve14(target.displayPath);
-    if (!existsSync15(skillPath))
+    if (!existsSync16(skillPath))
       return;
     let doc;
     try {
@@ -6230,8 +6174,130 @@ async function skillWriteIntentListener(ctx, resolver, config, target, actor, ne
 }
 
 // src/gates/seams.ts
-import { existsSync as existsSync16, readFileSync as readFileSync13, readdirSync as readdirSync11 } from "node:fs";
-import { basename as basename9, dirname as dirname9, join as join16, resolve as resolve15, sep as sep4 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync13, readdirSync as readdirSync11 } from "node:fs";
+import { basename as basename8, dirname as dirname10, join as join16, resolve as resolve15, sep as sep3 } from "node:path";
+
+// ../engine/dist/audit.js
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var DATE_PART2 = String.raw`\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])`;
+var RFC3339_Z_RE2 = new RegExp(String.raw`^${DATE_PART2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$`);
+var DATE_ONLY_RE2 = new RegExp(String.raw`^${DATE_PART2}$`);
+var heldLockDirs2 = new AsyncLocalStorage2;
+var MSTARC_HARNESS_DIR_KEY2 = "harness_dir";
+var MSTARC_PLAN_DIR_KEY2 = "plan_dir";
+var MSTARC_SDD_DIR_KEY2 = "sdd_dir";
+var MSTARC_ITERATION_DIR_KEY2 = "iteration_dir";
+var MSTARC_KNOWLEDGE_DIR_KEY2 = "knowledge_dir";
+var MSTARC_SPECS_DIR_KEY2 = "specs_dir";
+var MSTARC_WORKFLOW_DIR_KEY2 = "workflow_dir";
+var MSTARC_PROJECT_DIR_KEY2 = "project_dir";
+var MSTARC_ENFORCEMENT_KEY2 = "enforcement";
+var CONFIG_KEYS2 = {
+  [MSTARC_HARNESS_DIR_KEY2]: "harnessDir",
+  [MSTARC_PLAN_DIR_KEY2]: "planDir",
+  [MSTARC_SDD_DIR_KEY2]: "sddDir",
+  [MSTARC_ITERATION_DIR_KEY2]: "iterationDir",
+  [MSTARC_KNOWLEDGE_DIR_KEY2]: "knowledgeDir",
+  [MSTARC_SPECS_DIR_KEY2]: "specsDir",
+  [MSTARC_WORKFLOW_DIR_KEY2]: "workflowDir",
+  [MSTARC_PROJECT_DIR_KEY2]: "projectDir",
+  [MSTARC_ENFORCEMENT_KEY2]: "enforcement"
+};
+var GITIGNORE_SNIPPET2 = `# Morning Star harness (.mstar/)
+# Principle: process stays local; results are shared with the team.
+# Default-ignore everything under .mstar/, then re-include the tracked results.
+.mstar/**
+!.mstar/AGENTS.md
+!.mstar/knowledge/
+!.mstar/knowledge/**
+!.mstar/specs/
+!.mstar/specs/**
+# .mstarc — repo-local harness config (may declare [config] harness_dir=<name>)
+.mstarc
+`;
+var GITIGNORE_SNIPPET_AGENTS2 = `# Morning Star harness (.agents/) — legacy
+# Default-ignore everything under .agents/, then re-include the tracked results.
+.agents/**
+!.agents/AGENTS.md
+!.agents/knowledge/
+!.agents/knowledge/**
+!.agents/specs/
+!.agents/specs/**
+`;
+var GITIGNORE_PROCESS_ENTRIES2 = GITIGNORE_SNIPPET2.split(`
+`).filter((line) => line.startsWith(".mstar/") || line.startsWith("!.mstar/")).map((line) => line.trim());
+var GITIGNORE_PROCESS_ENTRIES_AGENTS2 = GITIGNORE_SNIPPET_AGENTS2.split(`
+`).filter((line) => line.startsWith(".agents/") || line.startsWith("!.agents/")).map((line) => line.trim());
+var WHOLE_MATCH_PATTERNS = [
+  { type: "private-key", re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/g },
+  { type: "aws-access-key", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+  { type: "github-token", re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g },
+  { type: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+  { type: "jwt", re: /\beyJ[A-Za-z0-9_-]{10,1024}\.[A-Za-z0-9_-]{10,1024}\.[A-Za-z0-9_-]{10,1024}\b/g },
+  { type: "api-secret-key", re: /\bsk-[A-Za-z0-9-]{20,}\b/g }
+];
+var VALUE_PATTERNS = [
+  {
+    typeOf: (key) => key.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase().replace(/[_-]+/g, "-"),
+    re: /(["']?)\b(password|passwd|api[_-]?key|access[_-]?token|auth[_-]?token|secret|token)\b(["']?)(\s*[:=]\s*)("[^"\n]{8,}"|'[^'\n]{8,}'|[A-Za-z0-9_./+\-=]{16,})/gi
+  }
+];
+function buildLineStarts(text) {
+  const starts = [0];
+  for (let i = 0;i < text.length; i++) {
+    if (text[i] === `
+`)
+      starts.push(i + 1);
+  }
+  return starts;
+}
+function lineAt(starts, index) {
+  let lo = 0;
+  let hi = starts.length - 1;
+  while (lo < hi) {
+    const mid = lo + hi + 1 >> 1;
+    if (starts[mid] <= index)
+      lo = mid;
+    else
+      hi = mid - 1;
+  }
+  return lo + 1;
+}
+function redactSecrets(text, filePath) {
+  const starts = buildLineStarts(text);
+  const marker = (type, index) => `[REDACTED ${type}@${lineAt(starts, index)}${filePath === undefined ? "" : ` in ${filePath}`}]`;
+  const replacements = [];
+  const findings = [];
+  for (const pattern of WHOLE_MATCH_PATTERNS) {
+    for (const match of text.matchAll(pattern.re)) {
+      if (match.index === undefined)
+        continue;
+      replacements.push({ index: match.index, length: match[0].length, text: marker(pattern.type, match.index) });
+      findings.push({ line: lineAt(starts, match.index), type: pattern.type });
+    }
+  }
+  for (const pattern of VALUE_PATTERNS) {
+    for (const match of text.matchAll(pattern.re)) {
+      if (match.index === undefined)
+        continue;
+      const type = pattern.typeOf(match[2]);
+      const replacement = `${match[1]}${match[2]}${match[3]}${match[4]}${marker(type, match.index)}`;
+      replacements.push({ index: match.index, length: match[0].length, text: replacement });
+      findings.push({ line: lineAt(starts, match.index), type });
+    }
+  }
+  replacements.sort((a, b) => b.index - a.index);
+  let out = text;
+  for (const r of replacements)
+    out = out.slice(0, r.index) + r.text + out.slice(r.index + r.length);
+  const deduped = new Map;
+  for (const f of findings)
+    deduped.set(`${f.line}:${f.type}`, f);
+  const sorted = [...deduped.values()].sort((a, b) => a.line - b.line || a.type.localeCompare(b.type));
+  return { text: out, findings: sorted };
+}
+
+// src/gates/seams.ts
 var SEAM_LOGGERS = {
   "design-md": "mstar/design-md-lint",
   audit: "mstar/audit-lint",
@@ -6239,7 +6305,7 @@ var SEAM_LOGGERS = {
   roles: "mstar/roles-lint"
 };
 function isIndexFile(path) {
-  const base = basename9(path);
+  const base = basename8(path);
   return base === "README.md" || base === "index.md";
 }
 function isMarkdownDoc(path) {
@@ -6248,7 +6314,7 @@ function isMarkdownDoc(path) {
 function isAuditPlanTarget(path) {
   if (!isMarkdownDoc(path))
     return false;
-  const segments = resolve15(path).split(sep4);
+  const segments = resolve15(path).split(sep3);
   for (let i = 0;i < segments.length; i++) {
     if (segments[i] !== "plans")
       continue;
@@ -6259,7 +6325,7 @@ function isAuditPlanTarget(path) {
   return false;
 }
 function isRolesTarget(path) {
-  const segments = resolve15(path).split(sep4);
+  const segments = resolve15(path).split(sep3);
   const idx = segments.indexOf("mstar-roles");
   if (idx === -1)
     return false;
@@ -6269,17 +6335,17 @@ function isRolesTarget(path) {
   return rest[0] === "SKILL.md" || rest[0] === "references" && rest[rest.length - 1].endsWith(".md");
 }
 function rolesDirOf(path) {
-  const segments = resolve15(path).split(sep4);
+  const segments = resolve15(path).split(sep3);
   const idx = segments.indexOf("mstar-roles");
   if (idx === -1)
-    return dirname9(path);
-  return idx === 0 ? sep4 : join16(sep4, ...segments.slice(1, idx + 1));
+    return dirname10(path);
+  return idx === 0 ? sep3 : join16(sep3, ...segments.slice(1, idx + 1));
 }
 function isSeamTarget(seam, harnessDir, target) {
   const path = resolve15(target.displayPath);
   switch (seam) {
     case "design-md": {
-      const base = basename9(path);
+      const base = basename8(path);
       return base === "DESIGN.md" || base === "DESIGN.dark.md";
     }
     case "audit":
@@ -6287,7 +6353,7 @@ function isSeamTarget(seam, harnessDir, target) {
     case "compound": {
       if (harnessDir === null)
         return false;
-      return path.startsWith(resolve15(join16(harnessDir, "knowledge")) + sep4) && isMarkdownDoc(path);
+      return path.startsWith(resolve15(join16(harnessDir, "knowledge")) + sep3) && isMarkdownDoc(path);
     }
     case "roles":
       return isRolesTarget(path);
@@ -6304,9 +6370,9 @@ function auditSecretsViolations(findings, file) {
 }
 function validateDesignDoc(doc, path) {
   const violations = [...validateDesignTokenFrontmatter(doc).violations];
-  const isDark = basename9(path) === "DESIGN.dark.md";
-  const sibling = join16(dirname9(path), isDark ? "DESIGN.md" : "DESIGN.dark.md");
-  if (existsSync16(sibling)) {
+  const isDark = basename8(path) === "DESIGN.dark.md";
+  const sibling = join16(dirname10(path), isDark ? "DESIGN.md" : "DESIGN.dark.md");
+  if (existsSync17(sibling)) {
     const light = isDark ? readFileSync13(sibling, "utf8") : doc;
     const dark = isDark ? doc : readFileSync13(sibling, "utf8");
     violations.push(...assertLightDarkParity(light, dark).violations);
@@ -6322,18 +6388,18 @@ function validateAuditDoc(doc, path) {
 function validateCompoundDoc(doc, _path, harnessDir) {
   const violations = [...validateSchemaYaml(doc).violations];
   if (harnessDir !== null) {
-    violations.push(...referenceExists(dirname9(harnessDir), doc).violations);
+    violations.push(...referenceExists(dirname10(harnessDir), doc).violations);
   }
   return violations.length === 0 ? { ok: true, violations } : { ok: false, violations };
 }
-function validateRolesState(rolesDir, skillsRoot = dirname9(rolesDir)) {
+function validateRolesState(rolesDir, skillsRoot = dirname10(rolesDir)) {
   const violations = [...validateRoleMapping(rolesDir).violations];
   const skillTexts = {};
   for (const entry of readdirSync11(skillsRoot, { withFileTypes: true })) {
     if (!entry.isDirectory() || !entry.name.startsWith("mstar-"))
       continue;
     const skillFile = join16(skillsRoot, entry.name, "SKILL.md");
-    if (!existsSync16(skillFile))
+    if (!existsSync17(skillFile))
       continue;
     try {
       skillTexts[entry.name] = readFileSync13(skillFile, "utf8");
@@ -6367,7 +6433,7 @@ function gateSeamIntent(ctx, harnessDir, config, seam, target) {
     if (!isSeamTarget(seam, harnessDir, target))
       return;
     const path = resolve15(target.displayPath);
-    if (!existsSync16(path))
+    if (!existsSync17(path))
       return;
     let doc;
     try {
@@ -6383,12 +6449,12 @@ function gateSeamIntent(ctx, harnessDir, config, seam, target) {
     const hard = resolveSeamHard(harnessDir, config);
     const verdict = applyEnforcement(result, { hard });
     if (verdict.hardBlocked) {
-      logger.error(`${basename9(path)} write to ${target.displayPath} ALLOWED as repair (Enforcement: hard; the current on-disk document is already invalid — the intent carries no incoming content, so the vetoable signal is only the pre-write state):
+      logger.error(`${basename8(path)} write to ${target.displayPath} ALLOWED as repair (Enforcement: hard; the current on-disk document is already invalid — the intent carries no incoming content, so the vetoable signal is only the pre-write state):
 ${verdict.violations.map(formatViolation).join(`
 `)}`);
       emitSeamAdvisory(ctx, seam, target.displayPath, verdict, hard, { repair: true });
     } else {
-      logger.warn(`${basename9(path)} write to ${target.displayPath} (advisory):
+      logger.warn(`${basename8(path)} write to ${target.displayPath} (advisory):
 ${verdict.violations.map(formatViolation).join(`
 `)}`);
       emitSeamAdvisory(ctx, seam, target.displayPath, verdict, hard);
@@ -6437,7 +6503,7 @@ function lintRolesWrite(doc, options) {
 }
 
 // src/gates/tools.ts
-import { existsSync as existsSync17, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync14 } from "node:fs";
 import { join as join17, resolve as resolve16 } from "node:path";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 var ITERATION_VIOLATION_SCHEMA = {
@@ -6603,9 +6669,9 @@ function registerSddIterationTools(ctx, resolver) {
       presentResult: (_args, _result) => ({ card: "generic", title: "Iteration gate evaluation" }),
       isConcurrencySafe: () => false,
       async execute(args) {
-        if (!existsSync17(args.snapshot_path))
+        if (!existsSync18(args.snapshot_path))
           throw new Error(`workflow snapshot not found: ${args.snapshot_path}`);
-        if (!existsSync17(args.compass_path))
+        if (!existsSync18(args.compass_path))
           throw new Error(`compass file not found: ${args.compass_path}`);
         const snapshotDoc = readJson(args.snapshot_path);
         const compassDoc = parseCompassFrontmatter(args.compass_path);
@@ -6660,7 +6726,7 @@ function registerSeamTools(ctx, resolver) {
       async execute(args) {
         const abs = resolve16(args.dir);
         const lightPath = join17(abs, "DESIGN.md");
-        if (!existsSync17(lightPath))
+        if (!existsSync18(lightPath))
           throw new Error(`design file not found: ${lightPath}`);
         const light = readFileSync14(lightPath, "utf8");
         const result = validateDesignDoc(light, lightPath);
@@ -6713,7 +6779,7 @@ function registerSeamTools(ctx, resolver) {
       isConcurrencySafe: () => false,
       async execute(args) {
         const abs = resolve16(args.plan_path);
-        if (!existsSync17(abs))
+        if (!existsSync18(abs))
           throw new Error(`plan file not found: ${abs}`);
         const text = readFileSync14(abs, "utf8");
         const result = validateAuditDoc(text, abs);
@@ -6753,7 +6819,7 @@ function registerSeamTools(ctx, resolver) {
       isConcurrencySafe: () => false,
       async execute(args, exec) {
         const abs = resolve16(args.doc_path);
-        if (!existsSync17(abs))
+        if (!existsSync18(abs))
           throw new Error(`knowledge doc not found: ${abs}`);
         const text = readFileSync14(abs, "utf8");
         const base = validateCompoundDoc(text, abs, args.repo_root !== undefined ? null : resolver.forAgent(exec.agent));
@@ -6798,7 +6864,7 @@ function registerSeamTools(ctx, resolver) {
       isConcurrencySafe: () => false,
       async execute(args) {
         const rolesDir = resolve16(args.roles_dir);
-        if (!existsSync17(join17(rolesDir, "SKILL.md")))
+        if (!existsSync18(join17(rolesDir, "SKILL.md")))
           throw new Error(`roles dir not found: ${rolesDir}`);
         const result = validateRolesState(rolesDir, args.skills_root !== undefined ? resolve16(args.skills_root) : undefined);
         return { ok: result.ok, violations: result.violations.map(iterationViolationView) };
@@ -6808,7 +6874,7 @@ function registerSeamTools(ctx, resolver) {
 }
 
 // src/gates/adapter.ts
-import { existsSync as existsSync18 } from "node:fs";
+import { existsSync as existsSync19 } from "node:fs";
 import { join as join18 } from "node:path";
 import { Service as Service2 } from "@deepseek-ai/cordis";
 var HOST_LOGGER = "mstar/host-adapter";
@@ -6845,7 +6911,7 @@ class DshHostAdapter extends Service2 {
     this.logSink(level, msg);
   }
   statusGate(path, kind, harnessDir) {
-    if (!existsSync18(path))
+    if (!existsSync19(path))
       return { ok: true, violations: [] };
     return validateStatusDoc(path, kind, harnessDir);
   }
@@ -6927,7 +6993,7 @@ class DshHostAdapter extends Service2 {
 
 // src/gates/agent-personas.ts
 import { readFileSync as readFileSync15, readdirSync as readdirSync12, statSync as statSync6 } from "node:fs";
-import { join as join19, resolve as resolve17, sep as sep6 } from "node:path";
+import { join as join19, resolve as resolve17, sep as sep5 } from "node:path";
 var ROLE_ID_PATTERN = /^[a-z0-9-]{1,32}$/;
 var defaultCache = new Map;
 function personaFor(roleId, lookup, warn) {
@@ -6970,7 +7036,7 @@ function defaultFromMirror(agentsDir, roleId, warn) {
     return;
   const root = resolve17(agentsDir);
   const file = resolve17(agentsDir, `${roleId}.md`);
-  if (!file.startsWith(root + sep6))
+  if (!file.startsWith(root + sep5))
     return;
   let stat;
   try {
@@ -7457,7 +7523,7 @@ function registerWorkflowLedger(ctx, resolver, workflowAskCache) {
 }
 
 // src/gates/goal-bridge.ts
-import { existsSync as existsSync19, readFileSync as readFileSync17, readdirSync as readdirSync13 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync17, readdirSync as readdirSync13 } from "node:fs";
 import { join as join21 } from "node:path";
 var GOAL_BRIDGE_LOGGER = "mstar/goal-bridge";
 var DEFAULT_MAX_GOAL_ROUNDS = 256;
@@ -7486,7 +7552,7 @@ function projectRegisterPointer(harnessDir) {
       if (!entry.isDirectory())
         continue;
       const registerPath = join21(projectsDir, entry.name, PROJECT_REGISTER_FILE);
-      if (existsSync19(registerPath))
+      if (existsSync20(registerPath))
         return registerPath;
     }
   } catch {}
@@ -7501,7 +7567,7 @@ function iterationGoalObjective(iterationId) {
 }
 function steeringCompass(harnessDir) {
   const iterationsDir = resolveIterationDir(harnessDir);
-  if (!existsSync19(iterationsDir))
+  if (!existsSync20(iterationsDir))
     return;
   let entries;
   try {
@@ -7513,7 +7579,7 @@ function steeringCompass(harnessDir) {
     if (!entry.isDirectory())
       continue;
     const compassPath = join21(iterationsDir, entry.name, "delivery-compass.md");
-    if (!existsSync19(compassPath))
+    if (!existsSync20(compassPath))
       continue;
     let content;
     try {
@@ -7693,7 +7759,7 @@ function registerGoalBridge(ctx, resolver, config) {
 }
 
 // src/gates/plan-mode-bridge.ts
-import { existsSync as existsSync20 } from "node:fs";
+import { existsSync as existsSync21 } from "node:fs";
 import { join as join22 } from "node:path";
 var PLAN_MODE_BRIDGE_LOGGER = "mstar/plan-mode-bridge";
 var PLAN_STATUS_TODO = "Todo";
@@ -7711,7 +7777,7 @@ function errorMessage5(error) {
 }
 function hasPrepareWindow(harnessDir) {
   const statusPath = join22(harnessDir, STATUS_FILE);
-  if (!existsSync20(statusPath))
+  if (!existsSync21(statusPath))
     return false;
   const selection = resolveReadWorkflow(harnessDir);
   if (selection.kind === "error")
@@ -8170,7 +8236,7 @@ var inject = ["loader"];
 function packagedCommandsDir() {
   try {
     const dir = fileURLToPath3(new URL("../harness-commands", import.meta.url));
-    return existsSync21(dir) ? dir : undefined;
+    return existsSync22(dir) ? dir : undefined;
   } catch {
     return;
   }