@nerviq/cli 1.29.0 → 1.30.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (93) hide show
  1. package/CHANGELOG.md +1764 -1493
  2. package/README.md +568 -538
  3. package/SECURITY.md +78 -82
  4. package/bin/cli.js +2838 -2558
  5. package/docs/api-reference.md +356 -356
  6. package/docs/audit-fix.md +109 -0
  7. package/docs/autofix.md +3 -62
  8. package/docs/getting-started.md +1 -1
  9. package/docs/index.html +592 -592
  10. package/docs/integration-contracts.md +287 -287
  11. package/docs/maintenance.md +128 -128
  12. package/docs/new-platform-guide.md +202 -202
  13. package/docs/release-process.md +63 -0
  14. package/docs/shallow-risk.md +244 -244
  15. package/docs/why-nerviq.md +82 -82
  16. package/package.json +75 -67
  17. package/sdk/README.md +12 -3
  18. package/sdk/examples/langchain-integration.md +128 -0
  19. package/sdk/examples/self-governing-agent.js +135 -0
  20. package/sdk/index.d.ts +115 -0
  21. package/sdk/index.js +94 -0
  22. package/sdk/package.json +11 -0
  23. package/src/activity.js +13 -0
  24. package/src/aider/activity.js +226 -226
  25. package/src/aider/context.js +162 -162
  26. package/src/aider/freshness.js +123 -123
  27. package/src/aider/techniques.js +3465 -3465
  28. package/src/audit/layers.js +180 -180
  29. package/src/audit.js +1133 -1032
  30. package/src/auto-suggest.js +9 -2
  31. package/src/behavioral-drift.js +37 -2
  32. package/src/benchmark.js +299 -299
  33. package/src/codex/activity.js +324 -324
  34. package/src/codex/freshness.js +149 -142
  35. package/src/codex/techniques.js +4895 -4895
  36. package/src/context.js +326 -326
  37. package/src/continuous-ops.js +11 -1
  38. package/src/convert.js +340 -340
  39. package/src/copilot/config-parser.js +280 -280
  40. package/src/copilot/context.js +218 -218
  41. package/src/copilot/freshness.js +184 -177
  42. package/src/copilot/patch.js +238 -238
  43. package/src/copilot/techniques.js +3578 -3578
  44. package/src/cursor/freshness.js +194 -194
  45. package/src/cursor/patch.js +243 -243
  46. package/src/cursor/techniques.js +3735 -3735
  47. package/src/doctor.js +201 -201
  48. package/src/fix-engine.js +511 -8
  49. package/src/formatters/csv.js +86 -86
  50. package/src/formatters/junit.js +123 -123
  51. package/src/formatters/markdown.js +164 -164
  52. package/src/formatters/otel.js +151 -151
  53. package/src/freshness.js +163 -156
  54. package/src/gemini/activity.js +402 -402
  55. package/src/gemini/context.js +290 -290
  56. package/src/gemini/freshness.js +188 -188
  57. package/src/gemini/patch.js +229 -229
  58. package/src/gemini/techniques.js +3811 -3811
  59. package/src/governance.js +533 -533
  60. package/src/harmony/audit.js +306 -306
  61. package/src/i18n.js +63 -63
  62. package/src/insights.js +119 -119
  63. package/src/integrations.js +134 -134
  64. package/src/locales/en.json +33 -33
  65. package/src/locales/es.json +33 -33
  66. package/src/migrate.js +354 -354
  67. package/src/opencode/activity.js +286 -286
  68. package/src/opencode/freshness.js +137 -137
  69. package/src/opencode/techniques.js +3450 -3450
  70. package/src/safe-glyph.js +97 -0
  71. package/src/setup/analysis.js +12 -12
  72. package/src/setup.js +13 -6
  73. package/src/shallow-risk/index.js +113 -56
  74. package/src/shallow-risk/patterns/agent-config-cross-platform-drift.js +51 -50
  75. package/src/shallow-risk/patterns/agent-config-dangerous-autoapprove.js +47 -46
  76. package/src/shallow-risk/patterns/agent-config-deprecated-keys.js +47 -46
  77. package/src/shallow-risk/patterns/agent-config-framework-version-mismatch.js +138 -0
  78. package/src/shallow-risk/patterns/agent-config-missing-file.js +318 -317
  79. package/src/shallow-risk/patterns/agent-config-script-not-in-package-json.js +108 -0
  80. package/src/shallow-risk/patterns/agent-config-secret-literal.js +52 -49
  81. package/src/shallow-risk/patterns/agent-config-stack-contradiction.js +35 -34
  82. package/src/shallow-risk/patterns/hook-script-missing.js +71 -70
  83. package/src/shallow-risk/patterns/mcp-server-no-allowlist.js +53 -52
  84. package/src/shallow-risk/shared.js +653 -648
  85. package/src/source-urls.js +295 -295
  86. package/src/state-paths.js +85 -85
  87. package/src/supplemental-checks.js +805 -805
  88. package/src/telemetry.js +160 -160
  89. package/src/watch.js +46 -0
  90. package/src/windsurf/context.js +359 -359
  91. package/src/windsurf/freshness.js +194 -194
  92. package/src/windsurf/patch.js +231 -231
  93. package/src/windsurf/techniques.js +3779 -3779
@@ -1,280 +1,280 @@
1
- /**
2
- * Copilot config parser.
3
- *
4
- * Copilot uses JSON for .vscode/settings.json and .vscode/mcp.json,
5
- * plus YAML frontmatter in *.instructions.md and *.prompt.md files.
6
- * This module handles both formats with unified value extraction.
7
- */
8
-
9
- // ─── JSON parsing ────────────────────────────────────────────────────────────
10
-
11
- function tryParseJson(content) {
12
- try {
13
- const data = JSON.parse(content);
14
- return { ok: true, data, error: null };
15
- } catch (error) {
16
- // VS Code settings.json and mcp.json are JSONC: they officially permit
17
- // // and /* */ comments plus trailing commas. Re-try after stripping
18
- // these before reporting the file as invalid JSON.
19
- try {
20
- const stripped = stripJsonc(content);
21
- const data = JSON.parse(stripped);
22
- return { ok: true, data, error: null, jsonc: true };
23
- } catch (_jsoncError) {
24
- return { ok: false, data: null, error: error.message };
25
- }
26
- }
27
- }
28
-
29
- function stripJsonc(input) {
30
- if (typeof input !== 'string') return input;
31
- let out = '';
32
- let i = 0;
33
- let inString = false;
34
- let stringChar = '';
35
- while (i < input.length) {
36
- const ch = input[i];
37
- const next = input[i + 1];
38
- if (inString) {
39
- out += ch;
40
- if (ch === '\\' && i + 1 < input.length) {
41
- out += next;
42
- i += 2;
43
- continue;
44
- }
45
- if (ch === stringChar) inString = false;
46
- i++;
47
- continue;
48
- }
49
- if (ch === '"' || ch === "'") {
50
- inString = true;
51
- stringChar = ch;
52
- out += ch;
53
- i++;
54
- continue;
55
- }
56
- if (ch === '/' && next === '/') {
57
- // Line comment
58
- const end = input.indexOf('\n', i);
59
- i = end === -1 ? input.length : end;
60
- continue;
61
- }
62
- if (ch === '/' && next === '*') {
63
- const end = input.indexOf('*/', i + 2);
64
- i = end === -1 ? input.length : end + 2;
65
- continue;
66
- }
67
- out += ch;
68
- i++;
69
- }
70
- // Remove trailing commas before } or ]
71
- return out.replace(/,(\s*[}\]])/g, '$1');
72
- }
73
-
74
- // ─── YAML frontmatter parsing ────────────────────────────────────────────────
75
-
76
- /**
77
- * Extract YAML frontmatter from a markdown file.
78
- * Frontmatter is delimited by --- at the start of the file.
79
- * Returns { frontmatter: object|null, body: string, raw: string|null }
80
- */
81
- function extractFrontmatter(content) {
82
- if (!content || typeof content !== 'string') {
83
- return { frontmatter: null, body: content || '', raw: null };
84
- }
85
-
86
- const trimmed = content.trimStart();
87
- if (!trimmed.startsWith('---')) {
88
- return { frontmatter: null, body: content, raw: null };
89
- }
90
-
91
- const endIdx = trimmed.indexOf('---', 3);
92
- if (endIdx === -1) {
93
- return { frontmatter: null, body: content, raw: null };
94
- }
95
-
96
- const raw = trimmed.slice(3, endIdx).trim();
97
- const body = trimmed.slice(endIdx + 3).trim();
98
- const frontmatter = parseSimpleYaml(raw);
99
-
100
- return { frontmatter, body, raw };
101
- }
102
-
103
- /**
104
- * Minimal YAML parser for frontmatter fields.
105
- * Handles: key: value, key: [item1, item2], key: "quoted", booleans, numbers.
106
- * Does NOT handle nested objects or multi-line values (use a full YAML parser for those).
107
- */
108
- function parseSimpleYaml(yamlStr) {
109
- if (!yamlStr || typeof yamlStr !== 'string') return {};
110
-
111
- const result = {};
112
- const lines = yamlStr.split(/\r?\n/);
113
-
114
- for (const line of lines) {
115
- const trimmedLine = line.trim();
116
- if (!trimmedLine || trimmedLine.startsWith('#')) continue;
117
-
118
- const colonIdx = trimmedLine.indexOf(':');
119
- if (colonIdx === -1) continue;
120
-
121
- const key = trimmedLine.slice(0, colonIdx).trim();
122
- let value = trimmedLine.slice(colonIdx + 1).trim();
123
-
124
- if (!key) continue;
125
-
126
- // Parse value
127
- if (value === '') {
128
- result[key] = null;
129
- } else if (value.startsWith('[') && value.endsWith(']')) {
130
- // Inline array: [item1, item2]
131
- const inner = value.slice(1, -1).trim();
132
- if (!inner) {
133
- result[key] = [];
134
- } else {
135
- result[key] = inner.split(',').map(item => {
136
- const t = item.trim();
137
- return stripQuotes(t);
138
- });
139
- }
140
- } else if ((value.startsWith('"') && value.endsWith('"')) ||
141
- (value.startsWith("'") && value.endsWith("'"))) {
142
- result[key] = value.slice(1, -1);
143
- } else if (value === 'true') {
144
- result[key] = true;
145
- } else if (value === 'false') {
146
- result[key] = false;
147
- } else if (/^-?\d+$/.test(value)) {
148
- result[key] = parseInt(value, 10);
149
- } else if (/^-?\d+\.\d+$/.test(value)) {
150
- result[key] = parseFloat(value);
151
- } else {
152
- result[key] = value;
153
- }
154
- }
155
-
156
- return result;
157
- }
158
-
159
- function stripQuotes(str) {
160
- if ((str.startsWith('"') && str.endsWith('"')) ||
161
- (str.startsWith("'") && str.endsWith("'"))) {
162
- return str.slice(1, -1);
163
- }
164
- return str;
165
- }
166
-
167
- // ─── Value extraction ────────────────────────────────────────────────────────
168
-
169
- function getValueByPath(obj, dottedPath) {
170
- if (!obj) return undefined;
171
- const parts = dottedPath.split('.').filter(Boolean);
172
- let cursor = obj;
173
- for (const part of parts) {
174
- if (cursor == null || typeof cursor !== 'object' || !(part in cursor)) {
175
- return undefined;
176
- }
177
- cursor = cursor[part];
178
- }
179
- return cursor;
180
- }
181
-
182
- // ─── Validation ──────────────────────────────────────────────────────────────
183
-
184
- const KNOWN_COPILOT_SETTINGS_KEYS = new Set([
185
- 'github.copilot.chat.agent.enabled',
186
- 'github.copilot.chat.codeGeneration.instructions',
187
- 'github.copilot.chat.reviewSelection.instructions',
188
- 'github.copilot.chat.commitMessageGeneration.instructions',
189
- 'github.copilot.chat.pullRequestDescriptionGeneration.instructions',
190
- 'chat.instructionsFilesLocations',
191
- 'chat.tools.terminal.sandbox.enabled',
192
- 'chat.agent.autoApproval.terminalCommands',
193
- 'chat.agent.autoApproval.tools',
194
- 'github.copilot.enable',
195
- 'github.copilot.advanced',
196
- ]);
197
-
198
- const DEPRECATED_COPILOT_KEYS = new Map([
199
- ['github.copilot.chat.codeGeneration.instructions', 'Deprecated since VS Code 1.102. Use .github/instructions/*.instructions.md instead.'],
200
- ]);
201
-
202
- /**
203
- * Validate VS Code settings.json keys for Copilot-specific settings.
204
- * @param {object} data - Parsed settings object.
205
- * @returns {{ unknown: string[], deprecated: Array<{key: string, message: string}>, copilotKeys: string[] }}
206
- */
207
- function validateCopilotSettingsKeys(data) {
208
- if (!data || typeof data !== 'object') {
209
- return { unknown: [], deprecated: [], copilotKeys: [] };
210
- }
211
-
212
- const copilotKeys = [];
213
- const deprecated = [];
214
-
215
- function walk(obj, prefix) {
216
- for (const key of Object.keys(obj)) {
217
- const fullKey = prefix ? `${prefix}.${key}` : key;
218
-
219
- // Only track copilot-related keys
220
- if (fullKey.startsWith('github.copilot') || fullKey.startsWith('chat.')) {
221
- copilotKeys.push(fullKey);
222
- }
223
-
224
- if (DEPRECATED_COPILOT_KEYS.has(fullKey)) {
225
- deprecated.push({ key: fullKey, message: DEPRECATED_COPILOT_KEYS.get(fullKey) });
226
- }
227
-
228
- if (obj[key] && typeof obj[key] === 'object' && !Array.isArray(obj[key])) {
229
- walk(obj[key], fullKey);
230
- }
231
- }
232
- }
233
-
234
- walk(data, '');
235
- return { unknown: [], deprecated, copilotKeys };
236
- }
237
-
238
- /**
239
- * Validate .prompt.md frontmatter for required fields.
240
- * Valid fields: description, agent, model, tools, mode.
241
- */
242
- function validatePromptFrontmatter(frontmatter) {
243
- if (!frontmatter) return { valid: false, errors: ['No frontmatter found'] };
244
-
245
- const errors = [];
246
- const VALID_PROMPT_FIELDS = new Set(['description', 'agent', 'model', 'tools', 'mode']);
247
-
248
- for (const key of Object.keys(frontmatter)) {
249
- if (!VALID_PROMPT_FIELDS.has(key)) {
250
- errors.push(`Unknown prompt frontmatter field: "${key}"`);
251
- }
252
- }
253
-
254
- return { valid: errors.length === 0, errors };
255
- }
256
-
257
- /**
258
- * Validate .instructions.md frontmatter for required applyTo field.
259
- */
260
- function validateInstructionFrontmatter(frontmatter) {
261
- if (!frontmatter) return { valid: false, errors: ['No frontmatter found'] };
262
-
263
- const errors = [];
264
-
265
- if (!frontmatter.applyTo) {
266
- errors.push('Missing required "applyTo" glob pattern in frontmatter');
267
- }
268
-
269
- return { valid: errors.length === 0, errors };
270
- }
271
-
272
- module.exports = {
273
- tryParseJson,
274
- extractFrontmatter,
275
- parseSimpleYaml,
276
- getValueByPath,
277
- validateCopilotSettingsKeys,
278
- validatePromptFrontmatter,
279
- validateInstructionFrontmatter,
280
- };
1
+ /**
2
+ * Copilot config parser.
3
+ *
4
+ * Copilot uses JSON for .vscode/settings.json and .vscode/mcp.json,
5
+ * plus YAML frontmatter in *.instructions.md and *.prompt.md files.
6
+ * This module handles both formats with unified value extraction.
7
+ */
8
+
9
+ // ─── JSON parsing ────────────────────────────────────────────────────────────
10
+
11
+ function tryParseJson(content) {
12
+ try {
13
+ const data = JSON.parse(content);
14
+ return { ok: true, data, error: null };
15
+ } catch (error) {
16
+ // VS Code settings.json and mcp.json are JSONC: they officially permit
17
+ // // and /* */ comments plus trailing commas. Re-try after stripping
18
+ // these before reporting the file as invalid JSON.
19
+ try {
20
+ const stripped = stripJsonc(content);
21
+ const data = JSON.parse(stripped);
22
+ return { ok: true, data, error: null, jsonc: true };
23
+ } catch (_jsoncError) {
24
+ return { ok: false, data: null, error: error.message };
25
+ }
26
+ }
27
+ }
28
+
29
+ function stripJsonc(input) {
30
+ if (typeof input !== 'string') return input;
31
+ let out = '';
32
+ let i = 0;
33
+ let inString = false;
34
+ let stringChar = '';
35
+ while (i < input.length) {
36
+ const ch = input[i];
37
+ const next = input[i + 1];
38
+ if (inString) {
39
+ out += ch;
40
+ if (ch === '\\' && i + 1 < input.length) {
41
+ out += next;
42
+ i += 2;
43
+ continue;
44
+ }
45
+ if (ch === stringChar) inString = false;
46
+ i++;
47
+ continue;
48
+ }
49
+ if (ch === '"' || ch === "'") {
50
+ inString = true;
51
+ stringChar = ch;
52
+ out += ch;
53
+ i++;
54
+ continue;
55
+ }
56
+ if (ch === '/' && next === '/') {
57
+ // Line comment
58
+ const end = input.indexOf('\n', i);
59
+ i = end === -1 ? input.length : end;
60
+ continue;
61
+ }
62
+ if (ch === '/' && next === '*') {
63
+ const end = input.indexOf('*/', i + 2);
64
+ i = end === -1 ? input.length : end + 2;
65
+ continue;
66
+ }
67
+ out += ch;
68
+ i++;
69
+ }
70
+ // Remove trailing commas before } or ]
71
+ return out.replace(/,(\s*[}\]])/g, '$1');
72
+ }
73
+
74
+ // ─── YAML frontmatter parsing ────────────────────────────────────────────────
75
+
76
+ /**
77
+ * Extract YAML frontmatter from a markdown file.
78
+ * Frontmatter is delimited by --- at the start of the file.
79
+ * Returns { frontmatter: object|null, body: string, raw: string|null }
80
+ */
81
+ function extractFrontmatter(content) {
82
+ if (!content || typeof content !== 'string') {
83
+ return { frontmatter: null, body: content || '', raw: null };
84
+ }
85
+
86
+ const trimmed = content.trimStart();
87
+ if (!trimmed.startsWith('---')) {
88
+ return { frontmatter: null, body: content, raw: null };
89
+ }
90
+
91
+ const endIdx = trimmed.indexOf('---', 3);
92
+ if (endIdx === -1) {
93
+ return { frontmatter: null, body: content, raw: null };
94
+ }
95
+
96
+ const raw = trimmed.slice(3, endIdx).trim();
97
+ const body = trimmed.slice(endIdx + 3).trim();
98
+ const frontmatter = parseSimpleYaml(raw);
99
+
100
+ return { frontmatter, body, raw };
101
+ }
102
+
103
+ /**
104
+ * Minimal YAML parser for frontmatter fields.
105
+ * Handles: key: value, key: [item1, item2], key: "quoted", booleans, numbers.
106
+ * Does NOT handle nested objects or multi-line values (use a full YAML parser for those).
107
+ */
108
+ function parseSimpleYaml(yamlStr) {
109
+ if (!yamlStr || typeof yamlStr !== 'string') return {};
110
+
111
+ const result = {};
112
+ const lines = yamlStr.split(/\r?\n/);
113
+
114
+ for (const line of lines) {
115
+ const trimmedLine = line.trim();
116
+ if (!trimmedLine || trimmedLine.startsWith('#')) continue;
117
+
118
+ const colonIdx = trimmedLine.indexOf(':');
119
+ if (colonIdx === -1) continue;
120
+
121
+ const key = trimmedLine.slice(0, colonIdx).trim();
122
+ let value = trimmedLine.slice(colonIdx + 1).trim();
123
+
124
+ if (!key) continue;
125
+
126
+ // Parse value
127
+ if (value === '') {
128
+ result[key] = null;
129
+ } else if (value.startsWith('[') && value.endsWith(']')) {
130
+ // Inline array: [item1, item2]
131
+ const inner = value.slice(1, -1).trim();
132
+ if (!inner) {
133
+ result[key] = [];
134
+ } else {
135
+ result[key] = inner.split(',').map(item => {
136
+ const t = item.trim();
137
+ return stripQuotes(t);
138
+ });
139
+ }
140
+ } else if ((value.startsWith('"') && value.endsWith('"')) ||
141
+ (value.startsWith("'") && value.endsWith("'"))) {
142
+ result[key] = value.slice(1, -1);
143
+ } else if (value === 'true') {
144
+ result[key] = true;
145
+ } else if (value === 'false') {
146
+ result[key] = false;
147
+ } else if (/^-?\d+$/.test(value)) {
148
+ result[key] = parseInt(value, 10);
149
+ } else if (/^-?\d+\.\d+$/.test(value)) {
150
+ result[key] = parseFloat(value);
151
+ } else {
152
+ result[key] = value;
153
+ }
154
+ }
155
+
156
+ return result;
157
+ }
158
+
159
+ function stripQuotes(str) {
160
+ if ((str.startsWith('"') && str.endsWith('"')) ||
161
+ (str.startsWith("'") && str.endsWith("'"))) {
162
+ return str.slice(1, -1);
163
+ }
164
+ return str;
165
+ }
166
+
167
+ // ─── Value extraction ────────────────────────────────────────────────────────
168
+
169
+ function getValueByPath(obj, dottedPath) {
170
+ if (!obj) return undefined;
171
+ const parts = dottedPath.split('.').filter(Boolean);
172
+ let cursor = obj;
173
+ for (const part of parts) {
174
+ if (cursor == null || typeof cursor !== 'object' || !(part in cursor)) {
175
+ return undefined;
176
+ }
177
+ cursor = cursor[part];
178
+ }
179
+ return cursor;
180
+ }
181
+
182
+ // ─── Validation ──────────────────────────────────────────────────────────────
183
+
184
+ const KNOWN_COPILOT_SETTINGS_KEYS = new Set([
185
+ 'github.copilot.chat.agent.enabled',
186
+ 'github.copilot.chat.codeGeneration.instructions',
187
+ 'github.copilot.chat.reviewSelection.instructions',
188
+ 'github.copilot.chat.commitMessageGeneration.instructions',
189
+ 'github.copilot.chat.pullRequestDescriptionGeneration.instructions',
190
+ 'chat.instructionsFilesLocations',
191
+ 'chat.tools.terminal.sandbox.enabled',
192
+ 'chat.agent.autoApproval.terminalCommands',
193
+ 'chat.agent.autoApproval.tools',
194
+ 'github.copilot.enable',
195
+ 'github.copilot.advanced',
196
+ ]);
197
+
198
+ const DEPRECATED_COPILOT_KEYS = new Map([
199
+ ['github.copilot.chat.codeGeneration.instructions', 'Deprecated since VS Code 1.102. Use .github/instructions/*.instructions.md instead.'],
200
+ ]);
201
+
202
+ /**
203
+ * Validate VS Code settings.json keys for Copilot-specific settings.
204
+ * @param {object} data - Parsed settings object.
205
+ * @returns {{ unknown: string[], deprecated: Array<{key: string, message: string}>, copilotKeys: string[] }}
206
+ */
207
+ function validateCopilotSettingsKeys(data) {
208
+ if (!data || typeof data !== 'object') {
209
+ return { unknown: [], deprecated: [], copilotKeys: [] };
210
+ }
211
+
212
+ const copilotKeys = [];
213
+ const deprecated = [];
214
+
215
+ function walk(obj, prefix) {
216
+ for (const key of Object.keys(obj)) {
217
+ const fullKey = prefix ? `${prefix}.${key}` : key;
218
+
219
+ // Only track copilot-related keys
220
+ if (fullKey.startsWith('github.copilot') || fullKey.startsWith('chat.')) {
221
+ copilotKeys.push(fullKey);
222
+ }
223
+
224
+ if (DEPRECATED_COPILOT_KEYS.has(fullKey)) {
225
+ deprecated.push({ key: fullKey, message: DEPRECATED_COPILOT_KEYS.get(fullKey) });
226
+ }
227
+
228
+ if (obj[key] && typeof obj[key] === 'object' && !Array.isArray(obj[key])) {
229
+ walk(obj[key], fullKey);
230
+ }
231
+ }
232
+ }
233
+
234
+ walk(data, '');
235
+ return { unknown: [], deprecated, copilotKeys };
236
+ }
237
+
238
+ /**
239
+ * Validate .prompt.md frontmatter for required fields.
240
+ * Valid fields: description, agent, model, tools, mode.
241
+ */
242
+ function validatePromptFrontmatter(frontmatter) {
243
+ if (!frontmatter) return { valid: false, errors: ['No frontmatter found'] };
244
+
245
+ const errors = [];
246
+ const VALID_PROMPT_FIELDS = new Set(['description', 'agent', 'model', 'tools', 'mode']);
247
+
248
+ for (const key of Object.keys(frontmatter)) {
249
+ if (!VALID_PROMPT_FIELDS.has(key)) {
250
+ errors.push(`Unknown prompt frontmatter field: "${key}"`);
251
+ }
252
+ }
253
+
254
+ return { valid: errors.length === 0, errors };
255
+ }
256
+
257
+ /**
258
+ * Validate .instructions.md frontmatter for required applyTo field.
259
+ */
260
+ function validateInstructionFrontmatter(frontmatter) {
261
+ if (!frontmatter) return { valid: false, errors: ['No frontmatter found'] };
262
+
263
+ const errors = [];
264
+
265
+ if (!frontmatter.applyTo) {
266
+ errors.push('Missing required "applyTo" glob pattern in frontmatter');
267
+ }
268
+
269
+ return { valid: errors.length === 0, errors };
270
+ }
271
+
272
+ module.exports = {
273
+ tryParseJson,
274
+ extractFrontmatter,
275
+ parseSimpleYaml,
276
+ getValueByPath,
277
+ validateCopilotSettingsKeys,
278
+ validatePromptFrontmatter,
279
+ validateInstructionFrontmatter,
280
+ };