@ryuenn3123/agentic-senior-core 1.9.5 → 2.0.1

package/.agent-context/state/onboarding-report.json

@@ -1,13 +1,13 @@
 {
-  "cliVersion": "1.9.5",
-  "generatedAt": "2026-04-08T03:45:54.099Z",
+  "cliVersion": "2.0.1",
+  "generatedAt": "2026-04-08T14:58:53.636Z",
   "operationMode": "upgrade",
   "selectedProfile": "beginner",
   "selectedProfilePack": null,
   "selectedStack": "typescript.md",
   "selectedBlueprint": "api-nextjs.md",
   "ciGuardrailsEnabled": true,
-  "setupDurationMs": 105,
+  "setupDurationMs": 106,
   "selectedSkillDomains": [],
   "autoDetection": {
     "recommendedStack": "typescript.md",

package/.cursorrules

@@ -1,7 +1,7 @@
 # AGENTIC-SENIOR-CORE DYNAMIC GOVERNANCE RULESET
 
-Generated by Agentic-Senior-Core CLI v1.9.5
-Timestamp: 2026-04-08T03:45:54.030Z
+Generated by Agentic-Senior-Core CLI v2.0.1
+Timestamp: 2026-04-08T14:58:53.570Z
 Selected profile: beginner
 Selected policy file: .agent-context/policies/llm-judge-threshold.json
 

package/.windsurfrules

@@ -1,7 +1,7 @@
 # AGENTIC-SENIOR-CORE DYNAMIC GOVERNANCE RULESET
 
-Generated by Agentic-Senior-Core CLI v1.9.5
-Timestamp: 2026-04-08T03:45:54.030Z
+Generated by Agentic-Senior-Core CLI v2.0.1
+Timestamp: 2026-04-08T14:58:53.570Z
 Selected profile: beginner
 Selected policy file: .agent-context/policies/llm-judge-threshold.json
 

package/README.md

@@ -103,7 +103,7 @@ If you have an existing project and want to infuse it with Staff-level context:
 npx @ryuenn3123/agentic-senior-core init
 ```
 
-Use team defaults (V1.8 track) with profile packs:
+Use team defaults (V2.0 track) with profile packs:
 
 ```bash
 npx @ryuenn3123/agentic-senior-core init --profile-pack startup
@@ -170,7 +170,7 @@ Use the stack that matches the project you are actually starting:
 ### Option 4: Clone and Play
 Want to poke around under the hood? Just clone the repo and `npx @ryuenn3123/agentic-senior-core init` locally. No runtime dependencies needed — everything uses native Node.js!
 
-### Upgrade Existing Governance Packs (V1.8)
+### Upgrade Existing Governance Packs (V1.x to V2.x)
 
 Yes, the upgrade flow still works. Use `--dry-run` first to preview changes, then apply with `--yes` when you are ready.
 
@@ -201,11 +201,13 @@ Our documentation has shifted into dedicated tracks to keep this README light:
 
 ## Core Capabilities
 
-- **Delivery Engine (CLI):** Interactive setup via GitHub source, bootstrap scripts, or `npx` after publish.
+- **Delivery Engine (CLI):** Interactive setup via GitHub source, bootstrap scripts, or `npx` after publish. Supported by a robust transactional installer with rollback protection.
+- **Verified Skill Marketplace:** Distribute and validate plugins securely with automated 4-dimension Trust Scoring and Evidence Bundles constraint validation.
 - **Dynamic Context Compiler:** Merges universal rules + selected stack + selected blueprint + optional CI guardrails into one dense, indexed rule file.
 - **Codebase Intelligence:** `.agent-context/state/` gives architecture/dependency boundaries so the agent understands high-risk areas.
 - **Override System:** `.agent-override.md` allows controlled enterprise exceptions without forking core rules.
 - **Automated Guardrails:** CI blueprints include LLM-as-a-Judge flow using `pr-checklist.md`.
+- **Pre-Publish Safety:** Built-in forbidden content checks detect hardcoded secrets and stray debugger artifacts before hitting the NPM registry.
 - **Machine-Readable CI Output:** LLM Judge emits `JSON_REPORT` payloads and writes `.agent-context/state/llm-judge-report.json` for PR/MR annotation tooling.
 - **MCP Self-Healing Loop:** `mcp.json` defines diagnostics + fix proposal workflow when lint/CI fails.
 

package/lib/cli/commands/init.mjs

@@ -142,6 +142,14 @@ export function parseInitArguments(commandArguments) {
 
 export async function runInitCommand(targetDirectoryArgument, initOptions = {}) {
   const resolvedTargetDirectoryPath = path.resolve(targetDirectoryArgument || '.');
+
+  if (resolvedTargetDirectoryPath.toLowerCase() === 'c:\\windows' || resolvedTargetDirectoryPath.toLowerCase() === 'c:\\windows\\system32') {
+    console.error('\n[FATAL] Target directory resolved to a Windows system folder (C:\\Windows).');
+    console.error('If you are running Windows npm from inside WSL, this is caused by cmd.exe lacking UNC path support.');
+    console.error('Please install and use a native Linux Node.js/npm directly inside WSL to setup your project.');
+    process.exit(1);
+  }
+
   const setupStartedAt = Date.now();
   await ensureDirectory(resolvedTargetDirectoryPath);
 

package/lib/cli/commands/rollback.mjs

@@ -15,6 +15,13 @@ export async function runRollbackCommand(commandArguments) {
   }
 
   const resolvedTargetDirectoryPath = path.resolve(targetDirectoryArgument);
+
+  if (resolvedTargetDirectoryPath.toLowerCase() === 'c:\\windows' || resolvedTargetDirectoryPath.toLowerCase() === 'c:\\windows\\system32') {
+    console.error('\n[FATAL] Target directory resolved to a Windows system folder (C:\\Windows).');
+    console.error('If you are running Windows npm from inside WSL, this is caused by cmd.exe lacking UNC path support.');
+    console.error('Please install and use a native Linux Node.js/npm directly inside WSL to setup your project.');
+    process.exit(1);
+  }
   
   try {
       await ensureDirectory(resolvedTargetDirectoryPath);

package/lib/cli/commands/upgrade.mjs

@@ -69,6 +69,14 @@ export function parseUpgradeArguments(commandArguments) {
 
 export async function runUpgradeCommand(targetDirectoryArgument, upgradeOptions = {}) {
   const resolvedTargetDirectoryPath = path.resolve(targetDirectoryArgument || '.');
+
+  if (resolvedTargetDirectoryPath.toLowerCase() === 'c:\\windows' || resolvedTargetDirectoryPath.toLowerCase() === 'c:\\windows\\system32') {
+    console.error('\n[FATAL] Target directory resolved to a Windows system folder (C:\\Windows).');
+    console.error('If you are running Windows npm from inside WSL, this is caused by cmd.exe lacking UNC path support.');
+    console.error('Please install and use a native Linux Node.js/npm directly inside WSL to setup your project.');
+    process.exit(1);
+  }
+
   const setupStartedAt = Date.now();
   await ensureDirectory(resolvedTargetDirectoryPath);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ryuenn3123/agentic-senior-core",
-  "version": "1.9.5",
+  "version": "2.0.1",
   "type": "module",
   "description": "Force your AI Agent to code like a Staff Engineer, not a Junior.",
   "bin": {
@@ -43,7 +43,8 @@
   "scripts": {
     "init": "node ./bin/agentic-senior-core.js init",
     "audit:frontend-usability": "node ./scripts/frontend-usability-audit.mjs",
-    "gate:release": "node ./scripts/release-gate.mjs",
+    "gate:release": "node ./scripts/release-gate.mjs && node ./scripts/forbidden-content-check.mjs",
+    "prepublishOnly": "npm run gate:release",
     "sbom:generate": "node ./scripts/generate-sbom.mjs",
     "benchmark:detection": "node ./scripts/detection-benchmark.mjs",
     "benchmark:gate": "node ./scripts/benchmark-gate.mjs",

package/scripts/forbidden-content-check.mjs

@@ -0,0 +1,123 @@
+import { readFileSync, statSync, readdirSync } from 'node:fs';
+import { join, relative } from 'node:path';
+
+const ROOT_DIR = process.cwd();
+
+// Directories to aggressively scan before NPM publish
+const SCAN_DIRECTORIES = [
+  'lib',
+  'bin',
+  'scripts',
+  '.agent-context'
+];
+
+const FORBIDDEN_PATTERNS = [
+  {
+    name: 'Hardcoded API Key',
+    regex: /api_?key\s*[:=]\s*['"][a-zA-Z0-9_\-]{16,}['"]/i,
+    suggestion: 'API Keys must be provided via environment variables (process.env) or config files, never hardcoded.'
+  },
+  {
+    name: 'Hardcoded Password',
+    regex: /password\s*[:=]\s*['"][^'"]+['"]/i,
+    suggestion: 'Passwords must be injected via secret managers or environment variables.'
+  },
+  {
+    name: 'Absolute Local Desktop Path',
+    regex: /file:\/\/\/?([c-zC-Z]:|\/Users\/|\/home\/)/,
+    suggestion: 'Do not commit local absolute file paths (e.g. file:///C:/Users). Use relative paths or process.cwd().'
+  },
+  {
+    name: 'Stray Breakpoint (debugger)',
+    regex: /\bdebugger\s*;?/,
+    suggestion: 'Remove debug breakpoints before publishing to production.'
+  }
+];
+
+function scanFile(filePath) {
+  const content = readFileSync(filePath, 'utf8');
+  const lines = content.split('\n');
+  const violations = [];
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+
+    for (const pattern of FORBIDDEN_PATTERNS) {
+      if (pattern.regex.test(line)) {
+        violations.push({
+          line: i + 1,
+          content: line.trim().substring(0, 80), // truncate long lines
+          rule: pattern.name,
+          suggestion: pattern.suggestion
+        });
+      }
+    }
+  }
+
+  return violations;
+}
+
+function walkDirectory(dir, filePaths = []) {
+  try {
+    const entries = readdirSync(dir, { withFileTypes: true });
+
+    for (const entry of entries) {
+      const fullPath = join(dir, entry.name);
+
+      if (entry.isDirectory()) {
+        walkDirectory(fullPath, filePaths);
+      } else if (entry.isFile()) {
+        // Only scan source/docs, exclude markdown as it contains example anti-patterns
+        if (/\.(js|mjs|cjs|ts|json|yml|yaml)$/i.test(entry.name) && entry.name !== 'forbidden-content-check.mjs') {
+          filePaths.push(fullPath);
+        }
+      }
+    }
+  } catch (err) {
+    if (err.code !== 'ENOENT') {
+      console.error(`Error reading ${dir}: ${err.message}`);
+    }
+  }
+  return filePaths;
+}
+
+async function runCheck() {
+  console.log('Scanning for forbidden content (Publish Gate)...\n');
+
+  let totalViolations = 0;
+  const filesScanned = [];
+
+  for (const dirName of SCAN_DIRECTORIES) {
+    const targetDir = join(ROOT_DIR, dirName);
+    const files = walkDirectory(targetDir);
+
+    for (const file of files) {
+      filesScanned.push(file);
+      const violations = scanFile(file);
+
+      if (violations.length > 0) {
+        const relPath = relative(ROOT_DIR, file);
+        console.error(`\n❌ FORBIDDEN CONTENT DETECTED IN: ${relPath}`);
+
+        for (const v of violations) {
+          console.error(`   Line ${v.line}: [${v.rule}]`);
+          console.error(`   > ${v.content}`);
+          console.error(`   Action required: ${v.suggestion}`);
+          totalViolations++;
+        }
+      }
+    }
+  }
+
+  console.log(`\nScanned ${filesScanned.length} files across ${SCAN_DIRECTORIES.length} source directories.`);
+
+  if (totalViolations > 0) {
+    console.error(`\n✖ PUBLISH ABORTED: Found ${totalViolations} forbidden content violation(s).`);
+    process.exit(1);
+  } else {
+    console.log('✔ Clean. No forbidden content detected.');
+    process.exit(0);
+  }
+}
+
+runCheck();