@ryuenn3123/agentic-senior-core 1.9.5 → 2.0.0

package/.agent-context/state/onboarding-report.json

@@ -1,13 +1,13 @@
 {
-  "cliVersion": "1.9.5",
-  "generatedAt": "2026-04-08T03:45:54.099Z",
+  "cliVersion": "2.0.0",
+  "generatedAt": "2026-04-08T03:56:54.149Z",
   "operationMode": "upgrade",
   "selectedProfile": "beginner",
   "selectedProfilePack": null,
   "selectedStack": "typescript.md",
   "selectedBlueprint": "api-nextjs.md",
   "ciGuardrailsEnabled": true,
-  "setupDurationMs": 105,
+  "setupDurationMs": 86,
   "selectedSkillDomains": [],
   "autoDetection": {
     "recommendedStack": "typescript.md",

package/.cursorrules

@@ -1,7 +1,7 @@
 # AGENTIC-SENIOR-CORE DYNAMIC GOVERNANCE RULESET
 
-Generated by Agentic-Senior-Core CLI v1.9.5
-Timestamp: 2026-04-08T03:45:54.030Z
+Generated by Agentic-Senior-Core CLI v2.0.0
+Timestamp: 2026-04-08T03:56:54.094Z
 Selected profile: beginner
 Selected policy file: .agent-context/policies/llm-judge-threshold.json
 

package/.windsurfrules

@@ -1,7 +1,7 @@
 # AGENTIC-SENIOR-CORE DYNAMIC GOVERNANCE RULESET
 
-Generated by Agentic-Senior-Core CLI v1.9.5
-Timestamp: 2026-04-08T03:45:54.030Z
+Generated by Agentic-Senior-Core CLI v2.0.0
+Timestamp: 2026-04-08T03:56:54.094Z
 Selected profile: beginner
 Selected policy file: .agent-context/policies/llm-judge-threshold.json
 

package/README.md

@@ -206,6 +206,7 @@ Our documentation has shifted into dedicated tracks to keep this README light:
 - **Codebase Intelligence:** `.agent-context/state/` gives architecture/dependency boundaries so the agent understands high-risk areas.
 - **Override System:** `.agent-override.md` allows controlled enterprise exceptions without forking core rules.
 - **Automated Guardrails:** CI blueprints include LLM-as-a-Judge flow using `pr-checklist.md`.
+- **Pre-Publish Safety:** Built-in forbidden content checks detect hardcoded secrets and stray debugger artifacts before hitting the NPM registry.
 - **Machine-Readable CI Output:** LLM Judge emits `JSON_REPORT` payloads and writes `.agent-context/state/llm-judge-report.json` for PR/MR annotation tooling.
 - **MCP Self-Healing Loop:** `mcp.json` defines diagnostics + fix proposal workflow when lint/CI fails.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ryuenn3123/agentic-senior-core",
-  "version": "1.9.5",
+  "version": "2.0.0",
   "type": "module",
   "description": "Force your AI Agent to code like a Staff Engineer, not a Junior.",
   "bin": {
@@ -43,7 +43,8 @@
   "scripts": {
     "init": "node ./bin/agentic-senior-core.js init",
     "audit:frontend-usability": "node ./scripts/frontend-usability-audit.mjs",
-    "gate:release": "node ./scripts/release-gate.mjs",
+    "gate:release": "node ./scripts/release-gate.mjs && node ./scripts/forbidden-content-check.mjs",
+    "prepublishOnly": "npm run gate:release",
     "sbom:generate": "node ./scripts/generate-sbom.mjs",
     "benchmark:detection": "node ./scripts/detection-benchmark.mjs",
     "benchmark:gate": "node ./scripts/benchmark-gate.mjs",

package/scripts/forbidden-content-check.mjs

@@ -0,0 +1,123 @@
+import { readFileSync, statSync, readdirSync } from 'node:fs';
+import { join, relative } from 'node:path';
+
+const ROOT_DIR = process.cwd();
+
+// Directories to aggressively scan before NPM publish
+const SCAN_DIRECTORIES = [
+  'lib',
+  'bin',
+  'scripts',
+  '.agent-context'
+];
+
+const FORBIDDEN_PATTERNS = [
+  {
+    name: 'Hardcoded API Key',
+    regex: /api_?key\s*[:=]\s*['"][a-zA-Z0-9_\-]{16,}['"]/i,
+    suggestion: 'API Keys must be provided via environment variables (process.env) or config files, never hardcoded.'
+  },
+  {
+    name: 'Hardcoded Password',
+    regex: /password\s*[:=]\s*['"][^'"]+['"]/i,
+    suggestion: 'Passwords must be injected via secret managers or environment variables.'
+  },
+  {
+    name: 'Absolute Local Desktop Path',
+    regex: /file:\/\/\/?([c-zC-Z]:|\/Users\/|\/home\/)/,
+    suggestion: 'Do not commit local absolute file paths (e.g. file:///C:/Users). Use relative paths or process.cwd().'
+  },
+  {
+    name: 'Stray Breakpoint (debugger)',
+    regex: /\bdebugger\s*;?/,
+    suggestion: 'Remove debug breakpoints before publishing to production.'
+  }
+];
+
+function scanFile(filePath) {
+  const content = readFileSync(filePath, 'utf8');
+  const lines = content.split('\n');
+  const violations = [];
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+
+    for (const pattern of FORBIDDEN_PATTERNS) {
+      if (pattern.regex.test(line)) {
+        violations.push({
+          line: i + 1,
+          content: line.trim().substring(0, 80), // truncate long lines
+          rule: pattern.name,
+          suggestion: pattern.suggestion
+        });
+      }
+    }
+  }
+
+  return violations;
+}
+
+function walkDirectory(dir, filePaths = []) {
+  try {
+    const entries = readdirSync(dir, { withFileTypes: true });
+
+    for (const entry of entries) {
+      const fullPath = join(dir, entry.name);
+
+      if (entry.isDirectory()) {
+        walkDirectory(fullPath, filePaths);
+      } else if (entry.isFile()) {
+        // Only scan source/docs, exclude markdown as it contains example anti-patterns
+        if (/\.(js|mjs|cjs|ts|json|yml|yaml)$/i.test(entry.name) && entry.name !== 'forbidden-content-check.mjs') {
+          filePaths.push(fullPath);
+        }
+      }
+    }
+  } catch (err) {
+    if (err.code !== 'ENOENT') {
+      console.error(`Error reading ${dir}: ${err.message}`);
+    }
+  }
+  return filePaths;
+}
+
+async function runCheck() {
+  console.log('Scanning for forbidden content (Publish Gate)...\n');
+
+  let totalViolations = 0;
+  const filesScanned = [];
+
+  for (const dirName of SCAN_DIRECTORIES) {
+    const targetDir = join(ROOT_DIR, dirName);
+    const files = walkDirectory(targetDir);
+
+    for (const file of files) {
+      filesScanned.push(file);
+      const violations = scanFile(file);
+
+      if (violations.length > 0) {
+        const relPath = relative(ROOT_DIR, file);
+        console.error(`\n❌ FORBIDDEN CONTENT DETECTED IN: ${relPath}`);
+
+        for (const v of violations) {
+          console.error(`   Line ${v.line}: [${v.rule}]`);
+          console.error(`   > ${v.content}`);
+          console.error(`   Action required: ${v.suggestion}`);
+          totalViolations++;
+        }
+      }
+    }
+  }
+
+  console.log(`\nScanned ${filesScanned.length} files across ${SCAN_DIRECTORIES.length} source directories.`);
+
+  if (totalViolations > 0) {
+    console.error(`\n✖ PUBLISH ABORTED: Found ${totalViolations} forbidden content violation(s).`);
+    process.exit(1);
+  } else {
+    console.log('✔ Clean. No forbidden content detected.');
+    process.exit(0);
+  }
+}
+
+runCheck();