@paths.design/caws-cli 10.0.1 → 10.1.0

package/dist/validation/spec-validation.js

@@ -6,10 +6,42 @@
 
 const fs = require('fs');
 const path = require('path');
-const { deriveBudget, checkBudgetCompliance } = require('../budget-derivation');
+const { deriveBudgetSync, checkBudgetCompliance } = require('../budget-derivation');
 const { execSync } = require('child_process');
 const { createValidator, getSchemaPath } = require('../utils/schema-validator');
 
+/**
+ * CAWSFIX-10: Canonical regex for valid spec IDs.
+ *
+ * Accepts:
+ *   - Single-segment: FEAT-001, EVLOG-002, CAWSFIX-06 (legacy shape)
+ *   - Multi-segment:  P03-IMPL-01, ALG-001A-HARDEN-01, CAWS-FIX-03
+ *
+ * Rejects:
+ *   - lowercase (feat-001)
+ *   - leading digit (01-FEAT)
+ *   - missing number suffix (FEAT-)
+ *   - trailing hyphen (FEAT-01-)
+ *   - leading/double hyphen (--FEAT-01, FEAT--001)
+ *   - empty string
+ *
+ * Grammar: [PREFIX](-[SEGMENT])*-NUMBER
+ *   - PREFIX  = [A-Z] followed by zero+ [A-Z0-9]
+ *   - SEGMENT = one+ [A-Z0-9]  (alphanumeric, uppercase only)
+ *   - NUMBER  = one+ digits
+ *
+ * Defined once per A4 invariant; referenced by both the basic validator
+ * (line ~125 pre-fix) and the enhanced validator (line ~307 pre-fix).
+ */
+const SPEC_ID_PATTERN = /^[A-Z][A-Z0-9]*(-[A-Z0-9]+)*-\d+$/;
+
+/**
+ * User-facing error message for bad spec IDs (CAWSFIX-10 A5).
+ * Kept as a module constant so the message stays in sync with the pattern.
+ */
+const SPEC_ID_ERROR_MESSAGE =
+  'Project ID should be in format: PREFIX-NUMBER or PREFIX-SEGMENT-NUMBER (e.g., FEAT-001, P03-IMPL-01)';
+
 /**
  * Get actual budget statistics from git history
  * Analyzes changes since last tag or initial commit
@@ -66,6 +98,42 @@ function getActualBudgetStats(specDir) {
   }
 }
 
+/**
+ * Alias the modern `acceptance_criteria` key into `acceptance` so the semantic
+ * validator (which historically keys off `acceptance`) accepts both shapes.
+ *
+ * Precedence (per CAWSFIX-09 A3 invariant):
+ *   - If `acceptance` is present (legacy shape: {id,given,when,then}), it wins.
+ *   - Otherwise `acceptance_criteria` (modern shape: {id,description,test_nodeids,status})
+ *     is copied into `acceptance`.
+ *
+ * IMPORTANT: this function mutates the spec in place. The existing validator
+ * also mutates in place (risk_tier string→number coercion at line ~141; auto-fix
+ * writes via `current[pathParts[...]] = fix.value`). Callers of
+ * `validateWorkingSpecWithSuggestions({...}, {autoFix:true})` observe those
+ * mutations on the object they passed in — see `Multiple Auto-Fixes` tests.
+ * Returning a clone here would silently break that contract.
+ *
+ * @param {Object} spec - Raw spec object (mutated in place)
+ * @returns {Object} Same spec reference
+ */
+function aliasAcceptanceCriteria(spec) {
+  if (!spec || typeof spec !== 'object') return spec;
+
+  const hasLegacy = Array.isArray(spec.acceptance) && spec.acceptance.length > 0;
+  const hasModern =
+    Array.isArray(spec.acceptance_criteria) && spec.acceptance_criteria.length > 0;
+
+  // Only alias when: legacy is absent AND modern has content.
+  // (Legacy wins when both present; empty modern arrays do not satisfy the
+  // required-field check — see edge-case tests in acceptance-criteria-alias.test.js.)
+  if (!hasLegacy && hasModern) {
+    spec.acceptance = spec.acceptance_criteria;
+  }
+
+  return spec;
+}
+
 /**
  * Basic validation of working spec
  * @param {Object} spec - Working spec object
@@ -74,6 +142,11 @@ function getActualBudgetStats(specDir) {
  */
 const validateWorkingSpec = (spec, _options = {}) => {
   try {
+    // CAWSFIX-09: Alias `acceptance_criteria` -> `acceptance` before any
+    // semantic checks so specs using the modern shape don't trigger
+    // "Missing required field: acceptance" false negatives.
+    aliasAcceptanceCriteria(spec);
+
     // First pass: AJV schema validation (non-blocking — results collected as warnings)
     let schemaWarnings = [];
     try {
@@ -121,14 +194,14 @@ const validateWorkingSpec = (spec, _options = {}) => {
       }
     }
 
-    // Validate specific field formats
-    if (!/^[A-Z]+-\d+$/.test(spec.id)) {
+    // Validate specific field formats (CAWSFIX-10: DRY regex via SPEC_ID_PATTERN)
+    if (!SPEC_ID_PATTERN.test(spec.id)) {
       return {
         valid: false,
         errors: [
           {
             instancePath: '/id',
-            message: 'Project ID should be in format: PREFIX-NUMBER (e.g., FEAT-1234)',
+            message: SPEC_ID_ERROR_MESSAGE,
           },
         ],
       };
@@ -252,6 +325,12 @@ function validateWorkingSpecWithSuggestions(spec, options = {}) {
   const { autoFix = false, checkBudget = false, projectRoot } = options;
 
   try {
+    // CAWSFIX-09: Alias `acceptance_criteria` -> `acceptance` so the
+    // required-field check and the "No acceptance criteria defined" warning
+    // recognize the modern shape as valid. Mutates in place to preserve the
+    // existing auto-fix contract (callers observe fixes on their object).
+    aliasAcceptanceCriteria(spec);
+
     let errors = [];
     let warnings = [];
     let fixes = [];
@@ -303,12 +382,12 @@ function validateWorkingSpecWithSuggestions(spec, options = {}) {
 
     // Semantic checks that AJV can't express
 
-    // Validate specific field formats
-    if (spec.id && !/^[A-Z]+-\d+$/.test(spec.id)) {
+    // Validate specific field formats (CAWSFIX-10: DRY regex via SPEC_ID_PATTERN)
+    if (spec.id && !SPEC_ID_PATTERN.test(spec.id)) {
       errors.push({
         instancePath: '/id',
-        message: 'Project ID should be in format: PREFIX-NUMBER (e.g., FEAT-1234)',
-        suggestion: 'Use format like: PROJ-001, FEAT-002, FIX-003',
+        message: SPEC_ID_ERROR_MESSAGE,
+        suggestion: 'Use format like: PROJ-001, FEAT-002, P03-IMPL-01, ALG-001A-HARDEN-01',
         canAutoFix: false,
       });
     }
@@ -646,10 +725,18 @@ function validateWorkingSpecWithSuggestions(spec, options = {}) {
     }
 
     // Derive and check budget if requested
+    //
+    // CAWSFIX-07: use `deriveBudgetSync` here. The async `deriveBudget`
+    // returns a Promise; this synchronous function previously passed the
+    // Promise straight into `checkBudgetCompliance`, which then read
+    // `derivedBudget.effective.max_files` on an undefined `.effective` and
+    // threw "Cannot read properties of undefined (reading 'max_files')" —
+    // surfaced as the "Budget derivation failed" warning on every
+    // schema-compliant spec.
     let budgetCheck = null;
     if (checkBudget && projectRoot) {
       try {
-        const derivedBudget = deriveBudget(spec, projectRoot);
+        const derivedBudget = deriveBudgetSync(spec, projectRoot);
 
         // Get actual stats from git history
         const actualStats = getActualBudgetStats(projectRoot) || {
@@ -828,4 +915,7 @@ module.exports = {
   canAutoFixField,
   calculateComplianceScore,
   getComplianceGrade,
+  // CAWSFIX-10: exported so init.js and tests reference the same regex
+  SPEC_ID_PATTERN,
+  SPEC_ID_ERROR_MESSAGE,
 };

package/dist/waivers-manager.js

@@ -275,6 +275,90 @@ class WaiversManager {
     return activeWaivers;
   }
 
+  /**
+   * Enumerate individual waiver files (WV-XXXX.yaml) on disk and return
+   * their parsed contents. These files are the source of truth per the
+   * CAWSFIX-04 invariants; active-waivers.yaml is an aggregate index.
+   *
+   * @returns {Array<{id: string, path: string, data: object}>}
+   */
+  enumerateWaiverFiles() {
+    const out = [];
+    if (!fs.existsSync(this.waiversDir)) return out;
+
+    const files = fs.readdirSync(this.waiversDir);
+    for (const file of files) {
+      const match = file.match(/^(WV-\d{4})\.yaml$/);
+      if (!match) continue;
+
+      const filePath = path.join(this.waiversDir, file);
+      let data;
+      try {
+        data = yaml.load(fs.readFileSync(filePath, 'utf8'));
+      } catch (err) {
+        // Skip unparseable files; do not swallow — warn the caller.
+        console.warn(`Warning: could not parse ${file}: ${err.message}`);
+        continue;
+      }
+      if (data && typeof data === 'object') {
+        out.push({ id: match[1], path: filePath, data });
+      }
+    }
+    return out;
+  }
+
+  /**
+   * Identify waivers that are candidates for expiry-based pruning.
+   * A waiver is prunable iff `status === 'active'` AND
+   * `expires_at < now`. Already-expired or revoked waivers are skipped
+   * (their status is correct; pruning wouldn't change anything).
+   *
+   * @param {Date} [nowOverride] — inject clock for tests
+   * @returns {Array<{id: string, path: string, expires_at: string}>}
+   */
+  findExpiredWaivers(nowOverride) {
+    const now = nowOverride instanceof Date ? nowOverride : new Date();
+    const records = this.enumerateWaiverFiles();
+    const candidates = [];
+
+    for (const rec of records) {
+      const w = rec.data;
+      const status = w.status;
+      // Only active waivers are prunable. Waivers with no status field are
+      // treated as active (matches existing loadActiveWaivers() assumption).
+      if (status && status !== 'active') continue;
+      if (!w.expires_at) continue;
+
+      const expiresAt = new Date(w.expires_at);
+      if (!Number.isFinite(expiresAt.getTime())) continue; // malformed date
+      if (expiresAt < now) {
+        candidates.push({
+          id: rec.id,
+          path: rec.path,
+          expires_at: w.expires_at,
+        });
+      }
+    }
+    return candidates;
+  }
+
+  /**
+   * Transition a single waiver file from `status: active` to
+   * `status: expired` in place. The file is rewritten with its existing
+   * field order where possible; a `status` field is added or replaced.
+   *
+   * @param {string} filePath
+   * @returns {object} the updated waiver object
+   */
+  markWaiverExpired(filePath) {
+    const raw = fs.readFileSync(filePath, 'utf8');
+    const data = yaml.load(raw) || {};
+    data.status = 'expired';
+    data.expired_at = new Date().toISOString();
+    fs.writeFileSync(filePath, yaml.dump(data, { lineWidth: -1 }), 'utf8');
+    return data;
+  }
+
   /**
    * Revoke a waiver
    */

package/dist/worktree/worktree-manager.js

@@ -27,6 +27,59 @@ function findFeatureSpecPath(root, specId) {
   return candidates.find((candidate) => fs.existsSync(candidate)) || null;
 }
 
+function writeSpecWithWorktree(filePath, worktreeName) {
+  const yaml = require('js-yaml');
+  const content = fs.readFileSync(filePath, 'utf8');
+  const parsed = yaml.load(content);
+  if (!parsed || typeof parsed !== 'object') {
+    return content;
+  }
+
+  parsed.worktree = worktreeName;
+  return yaml.dump(parsed, { lineWidth: 120, noRefs: true });
+}
+
+function hasPathChanges(root, relativePath) {
+  try {
+    const output = execFileSync(
+      'git',
+      ['status', '--porcelain', '--', relativePath],
+      { cwd: root, encoding: 'utf8', stdio: 'pipe' }
+    ).trim();
+    return output.length > 0;
+  } catch {
+    return false;
+  }
+}
+
+function ensureCanonicalSpecCommitted(root, specPath, specId, worktreeName) {
+  const relativeSpecPath = path.relative(root, specPath);
+  const nextContent = writeSpecWithWorktree(specPath, worktreeName);
+  const currentContent = fs.readFileSync(specPath, 'utf8');
+
+  if (currentContent !== nextContent) {
+    fs.writeFileSync(specPath, nextContent);
+  }
+
+  if (!hasPathChanges(root, relativeSpecPath)) {
+    return false;
+  }
+
+  execFileSync('git', ['add', '--', relativeSpecPath], {
+    cwd: root,
+    stdio: 'pipe',
+  });
+  execFileSync(
+    'git',
+    ['commit', '-m', `chore(caws): bind spec ${specId} to worktree ${worktreeName}`, '--', relativeSpecPath],
+    {
+      cwd: root,
+      stdio: 'pipe',
+    }
+  );
+  return true;
+}
+
 function materializeWorktreeSpec(root, cawsDest, specId, worktreeName, scope) {
   if (!specId) return;
 
@@ -46,14 +99,14 @@ function materializeWorktreeSpec(root, cawsDest, specId, worktreeName, scope) {
 
     // Keep a canonical feature-spec copy inside the worktree and align
     // working-spec.yaml to that exact content for legacy-compatible commands.
-    const specContent = fs.readFileSync(canonicalSpecPath, 'utf8');
+    const specContent = writeSpecWithWorktree(canonicalSpecPath, worktreeName);
     fs.writeFileSync(destSpecPath, specContent);
     fs.writeFileSync(workingSpecPath, specContent);
     return;
   }
 
   const { generateWorkingSpec } = require('../generators/working-spec');
-  const specContent = generateWorkingSpec({
+  let specContent = generateWorkingSpec({
     projectId: specId,
     projectTitle: `Worktree: ${worktreeName}`,
     projectDescription: `Isolated worktree for ${worktreeName}`,
@@ -86,10 +139,84 @@ function materializeWorktreeSpec(root, cawsDest, specId, worktreeName, scope) {
     complexityFactors: '',
   });
 
+  try {
+    const yaml = require('js-yaml');
+    const parsed = yaml.load(specContent);
+    if (parsed && typeof parsed === 'object') {
+      parsed.worktree = worktreeName;
+      specContent = yaml.dump(parsed, { lineWidth: 120, noRefs: true });
+    }
+  } catch {
+    // Keep generated spec content if augmentation fails.
+  }
+
   fs.ensureDirSync(path.dirname(workingSpecPath));
   fs.writeFileSync(workingSpecPath, specContent);
 }
 
+function parseSpecIdFromYamlFile(filePath) {
+  try {
+    const yaml = require('js-yaml');
+    const doc = yaml.load(fs.readFileSync(filePath, 'utf8'));
+    if (doc && typeof doc.id === 'string' && doc.id.trim()) {
+      return doc.id.trim();
+    }
+  } catch {
+    // Ignore malformed YAML during inference
+  }
+  return null;
+}
+
+/**
+ * Scan .caws/specs/ for a spec that declares `worktree: <name>`.
+ * Returns the spec's id if found, null otherwise.
+ * This enables auto-binding: when a spec already names the worktree
+ * it expects, the registry entry gets the specId automatically.
+ * @param {string} root - Repository root
+ * @param {string} worktreeName - Worktree name to match
+ * @returns {string|null} Spec ID or null
+ */
+function findSpecByWorktreeName(root, worktreeName) {
+  const yaml = require('js-yaml');
+  const specsDir = path.join(root, '.caws', 'specs');
+  if (!fs.existsSync(specsDir)) return null;
+
+  const specFiles = fs.readdirSync(specsDir)
+    .filter((name) => name.endsWith('.yaml') || name.endsWith('.yml'));
+
+  for (const specFile of specFiles) {
+    try {
+      const doc = yaml.load(fs.readFileSync(path.join(specsDir, specFile), 'utf8'));
+      if (doc && doc.worktree === worktreeName && typeof doc.id === 'string') {
+        return doc.id.trim();
+      }
+    } catch {
+      // Skip malformed spec files
+    }
+  }
+  return null;
+}
+
+function inferSpecIdForWorktree(worktreePath) {
+  if (!worktreePath) return null;
+
+  const specsDir = path.join(worktreePath, '.caws', 'specs');
+  if (fs.existsSync(specsDir)) {
+    const specFiles = fs.readdirSync(specsDir)
+      .filter((name) => name.endsWith('.yaml') || name.endsWith('.yml'))
+      .sort();
+
+    for (const specFile of specFiles) {
+      const inferred = parseSpecIdFromYamlFile(path.join(specsDir, specFile));
+      if (inferred) {
+        return inferred;
+      }
+    }
+  }
+
+  return parseSpecIdFromYamlFile(path.join(worktreePath, '.caws', 'working-spec.yaml'));
+}
+
 /**
  * Get the last commit info for a branch
  * @param {string} branch - Branch name
@@ -356,7 +483,7 @@ function autoRegisterWorktree(root, registry, discovered) {
     branch: discovered.branch,
     baseBranch,
     scope: null,
-    specId: null,
+    specId: inferSpecIdForWorktree(discovered.path),
     owner: null,
     createdAt: new Date().toISOString(),
     status: 'active',
@@ -423,6 +550,7 @@ function createWorktree(name, options = {}) {
   const worktreePath = path.join(root, WORKTREES_DIR, name);
   const branchName = BRANCH_PREFIX + name;
   const base = baseBranch || getCurrentBranch();
+  const canonicalSpecPath = findFeatureSpecPath(root, specId);
 
   // Check if the branch already exists in git (even if not in registry)
   // This catches cases where another agent created the branch outside CAWS
@@ -449,6 +577,10 @@ function createWorktree(name, options = {}) {
   // Create the worktree directory
   fs.ensureDirSync(path.dirname(worktreePath));
 
+  if (canonicalSpecPath) {
+    ensureCanonicalSpecCommitted(root, canonicalSpecPath, specId, name);
+  }
+
   // Create git worktree with new branch
   try {
     execFileSync('git', ['worktree', 'add', '-b', branchName, worktreePath, base], {
@@ -510,15 +642,26 @@ function createWorktree(name, options = {}) {
     }
   }
 
+  // Auto-bind specId: if no explicit --spec-id was passed, scan .caws/specs/
+  // for a spec that declares `worktree: <name>`. This establishes the mutual
+  // reference that the scope guard uses to treat one spec as authoritative.
+  let resolvedSpecId = specId || null;
+  if (!resolvedSpecId) {
+    resolvedSpecId = findSpecByWorktreeName(root, name);
+    if (resolvedSpecId) {
+      console.log(chalk.gray(`   Auto-bound spec: ${resolvedSpecId}`));
+    }
+  }
+
   // Materialize a worktree-local working spec. Prefer the canonical feature
   // spec when it exists so isolated worktrees stay aligned with the main
   // registry/resolver model.
-  if (specId) {
+  if (resolvedSpecId) {
     try {
-      materializeWorktreeSpec(root, cawsDest, specId, name, scope);
+      materializeWorktreeSpec(root, cawsDest, resolvedSpecId, name, scope);
     } catch (error) {
       console.warn(
-        chalk.yellow(`Could not materialize spec '${specId}' for worktree '${name}': ${error.message}`)
+        chalk.yellow(`Could not materialize spec '${resolvedSpecId}' for worktree '${name}': ${error.message}`)
       );
       // Non-fatal: spec generation is optional
     }
@@ -531,7 +674,7 @@ function createWorktree(name, options = {}) {
     branch: branchName,
     baseBranch: base,
     scope: scope || null,
-    specId: specId || null,
+    specId: resolvedSpecId,
     owner: options.owner || getAgentSessionId(root) || null,
     createdAt: new Date().toISOString(),
     status: 'fresh',
@@ -892,9 +1035,31 @@ function destroyWorktree(name, options = {}) {
   }
 
   // Update registry
+  const wasAlreadyDestroyed = registry.worktrees[name].status === 'destroyed';
   registry.worktrees[name].status = 'destroyed';
   registry.worktrees[name].destroyedAt = new Date().toISOString();
   saveRegistry(root, registry);
+
+  // CAWSFIX-18: auto-commit the registry so the working tree stays clean
+  if (!wasAlreadyDestroyed) {
+    try {
+      const status = execFileSync('git', ['status', '--porcelain', '.caws/worktrees.json'], {
+        cwd: root, stdio: ['pipe', 'pipe', 'pipe'],
+      }).toString().trim();
+      if (status) {
+        const otherActive = Object.values(registry.worktrees || {}).some(
+          (e) => e.status === 'active' || e.status === 'fresh'
+        );
+        const prefix = otherActive ? 'wip(checkpoint)' : 'chore(worktree)';
+        execFileSync('git', ['add', '.caws/worktrees.json'], { cwd: root, stdio: 'pipe' });
+        execFileSync('git', ['commit', '-m', `${prefix}: record destroyed ${name}`], {
+          cwd: root, stdio: 'pipe',
+        });
+      }
+    } catch (err) {
+      console.warn(chalk.yellow(`   Warning: could not auto-commit .caws/worktrees.json: ${err.message}`));
+    }
+  }
 }
 
 /**
@@ -1055,13 +1220,50 @@ function mergeWorktree(name, options = {}) {
     }
   }
 
-  const mergeResult = { name, branch: entry.branch, baseBranch, merged: true, conflicts: [] };
+  // Auto-close the bound spec if one exists. A worktree merge is the
+  // lifecycle signal that the spec's work is done; leaving the spec
+  // `active` after merge accumulates stale-active entries (D6). Direct
+  // YAML status flip bypasses the ownership + worktree-reference checks
+  // in `closeSpec` — the caller has already proven authority by merging.
+  let autoClosedSpecId = null;
+  if (entry.specId) {
+    autoClosedSpecId = autoCloseBoundSpec(root, entry.specId);
+  }
+
+  const mergeResult = {
+    name, branch: entry.branch, baseBranch, merged: true, conflicts: [],
+    specId: entry.specId || null, autoClosedSpecId,
+  };
   try {
     lifecycle.emit(EVENTS.MERGE_POST, { ...mergeResult, timestamp: new Date().toISOString() });
   } catch { /* non-fatal */ }
   return mergeResult;
 }
 
+/**
+ * Flip a spec's status to `closed` by rewriting just the `status:` line.
+ * Idempotent: no-op when the spec is already closed or the file is missing.
+ * Returns the spec ID on success, null if skipped or failed.
+ * @param {string} root - Repo root
+ * @param {string} specId - Spec identifier (e.g. CAWSFIX-14)
+ * @returns {string|null}
+ */
+function autoCloseBoundSpec(root, specId) {
+  try {
+    const specPath = findFeatureSpecPath(root, specId);
+    if (!specPath || !fs.existsSync(specPath)) return null;
+    const original = fs.readFileSync(specPath, 'utf8');
+    // Idempotent: already closed → no-op, no write, no diff.
+    if (/^status:\s*closed\s*$/m.test(original)) return specId;
+    const patched = original.replace(/^status:\s*active\s*$/m, 'status: closed');
+    if (patched === original) return null; // status was e.g. draft/archived
+    fs.writeFileSync(specPath, patched, 'utf8');
+    return specId;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Prune stale worktree entries
  * @param {Object} options - Prune options
@@ -1149,10 +1351,12 @@ module.exports = {
   listWorktrees,
   destroyWorktree,
   mergeWorktree,
+  autoCloseBoundSpec,
   pruneWorktrees,
   repairWorktrees,
   reconcileRegistry,
   loadRegistry,
+  saveRegistry,
   getRepoRoot,
   getLastCommitInfo,
   isBranchMerged,
@@ -1165,4 +1369,6 @@ module.exports = {
   BRANCH_PREFIX,
   findFeatureSpecPath,
   materializeWorktreeSpec,
+  inferSpecIdForWorktree,
+  findSpecByWorktreeName,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paths.design/caws-cli",
-  "version": "10.0.1",
+  "version": "10.1.0",
   "description": "CAWS CLI - Coding Agent Workflow System command-line tools for spec management, quality gates, and AI-assisted development",
   "main": "dist/index.js",
   "bin": {
@@ -32,7 +32,7 @@
     "lint:staged": "npx eslint src/**/*.js tests/**/*.js",
     "format": "prettier --write src/**/*.js tests/**/*.js",
     "validate": "echo 'CLI package validation not required'",
-    "caws:validate": "node ../../.caws/validate.js ../../.caws/working-spec.yaml",
+    "caws:validate": "node dist/index.js validate",
     "clean": "rm -rf dist test-caws-project .agent && npm run test:cleanup",
     "prepare": "husky >/dev/null 2>&1 || true"
   },
@@ -61,7 +61,9 @@
     "fs-extra": "^11.0.0",
     "inquirer": "8.2.7",
     "ajv": "8.17.1",
-    "js-yaml": "4.1.0"
+    "js-yaml": "4.1.0",
+    "micromatch": "4.0.8",
+    "minimatch": "^10.0.1"
   },
   "devDependencies": {
     "@eslint/js": "^9.0.0",
@@ -78,7 +80,6 @@
     "husky": "9.1.7",
     "jest": "30.1.3",
     "lint-staged": "15.5.2",
-    "micromatch": "4.0.8",
     "prettier": "^3.0.0",
     "semantic-release": "25.0.0-beta.6",
     "typescript": "^5.0.0"