@skill-map/cli 0.22.0 → 0.23.1

package/dist/kernel/index.js

@@ -100,7 +100,7 @@ import cl100k_base from "js-tiktoken/ranks/cl100k_base";
 // package.json
 var package_default = {
   name: "@skill-map/cli",
-  version: "0.22.0",
+  version: "0.23.1",
   description: "skill-map reference implementation \u2014 kernel + CLI + adapters.",
   license: "MIT",
   type: "module",
@@ -167,16 +167,16 @@ var package_default = {
   },
   dependencies: {
     "@hono/node-server": "2.0.1",
-    "@skill-map/spec": "0.22.0",
+    "@skill-map/spec": "0.23.0",
     ajv: "8.18.0",
     "ajv-formats": "3.0.1",
     chokidar: "5.0.0",
     clipanion: "4.0.0-rc.4",
-    hono: "4.12.16",
+    hono: "4.12.18",
     ignore: "7.0.5",
     "js-tiktoken": "1.0.21",
     "js-yaml": "4.1.1",
-    kysely: "0.28.16",
+    kysely: "0.28.17",
     semver: "7.7.4",
     typanion: "3.14.0",
     ws: "8.20.0"
@@ -271,8 +271,8 @@ import { Ajv2020 as Ajv20202 } from "ajv/dist/2020.js";
 
 // kernel/i18n/plugin-store.texts.ts
 var PLUGIN_STORE_TEXTS = {
-  kvValidationFailed: "plugin '{{pluginId}}' ctx.store.set('{{key}}', value): value violates declared schema ({{schemaPath}}) \u2014 {{errors}}",
-  dedicatedValidationFailed: "plugin '{{pluginId}}' ctx.store.write('{{table}}', row): row violates declared schema ({{schemaPath}}) \u2014 {{errors}}"
+  kvValidationFailed: "plugin '{{pluginId}}' ctx.store.set('{{key}}', value): value violates declared schema ({{schemaPath}}): {{errors}}",
+  dedicatedValidationFailed: "plugin '{{pluginId}}' ctx.store.write('{{table}}', row): row violates declared schema ({{schemaPath}}): {{errors}}"
 };
 
 // kernel/adapters/plugin-store.ts
@@ -360,6 +360,27 @@ import { readFileSync as readFileSync3 } from "fs";
 import { dirname, resolve as resolve4 } from "path";
 import { createRequire as createRequire2 } from "module";
 import { Ajv2020 as Ajv20203 } from "ajv/dist/2020.js";
+
+// kernel/types/view-catalog.ts
+var ALL_SLOT_NAMES = [
+  "card.title.right",
+  "card.subtitle.left",
+  "card.footer.left",
+  "card.footer.right",
+  "graph.node.alert",
+  "inspector.header.badge.counter",
+  "inspector.header.badge.tag",
+  "inspector.body.panel.breakdown",
+  "inspector.body.panel.records",
+  "inspector.body.panel.tree",
+  "inspector.body.panel.key-values",
+  "inspector.body.panel.link-list",
+  "inspector.body.panel.markdown",
+  "topbar.nav.start"
+];
+var KNOWN_SLOT_NAMES = new Set(ALL_SLOT_NAMES);
+
+// kernel/adapters/schema-validators.ts
 var SCHEMA_FILES = {
   node: "schemas/node.schema.json",
   link: "schemas/link.schema.json",
@@ -427,24 +448,8 @@ function buildSchemaValidators() {
   });
   const contributionValidators = /* @__PURE__ */ new Map();
   const VIEW_SLOTS_ID = "https://skill-map.dev/spec/v0/view-slots.schema.json";
-  const KNOWN_SLOTS = /* @__PURE__ */ new Set([
-    "card.title.right",
-    "card.subtitle.left",
-    "card.footer.left",
-    "card.footer.right",
-    "graph.node.alert",
-    "inspector.header.badge.counter",
-    "inspector.header.badge.tag",
-    "inspector.body.panel.breakdown",
-    "inspector.body.panel.records",
-    "inspector.body.panel.tree",
-    "inspector.body.panel.key-values",
-    "inspector.body.panel.link-list",
-    "inspector.body.panel.markdown",
-    "topbar.nav.start"
-  ]);
   function getContributionValidator(slot) {
-    if (!KNOWN_SLOTS.has(slot)) return null;
+    if (!KNOWN_SLOT_NAMES.has(slot)) return null;
     const existing = contributionValidators.get(slot);
     if (existing) return existing;
     const ref = `${VIEW_SLOTS_ID}#/$defs/payloads/${slot}`;
@@ -542,7 +547,7 @@ function resolveSpecRoot() {
     return dirname(indexPath);
   } catch {
     throw new Error(
-      "@skill-map/spec not resolvable \u2014 ensure the workspace is linked or the package is installed."
+      "@skill-map/spec not resolvable: ensure the workspace is linked or the package is installed."
     );
   }
 }
@@ -675,13 +680,14 @@ function buildHookContext(_hook, trigger, event) {
 // kernel/i18n/orchestrator.texts.ts
 var ORCHESTRATOR_TEXTS = {
   frontmatterInvalid: "Frontmatter for {{path}} ({{kind}}) failed schema validation: {{errors}}",
-  frontmatterMalformedPasteWithIndent: "Frontmatter fence in {{path}} appears indented; YAML frontmatter MUST start with `---` at column 0. The file was scanned as body-only \u2014 the metadata block was silently lost. Move the `---` lines to the start of the line.",
+  frontmatterMalformedPasteWithIndent: "Frontmatter fence in {{path}} appears indented; YAML frontmatter MUST start with `---` at column 0. The file was scanned as body-only; the metadata block was silently lost. Move the `---` lines to the start of the line.",
   frontmatterMalformedByteOrderMark: "Frontmatter fence in {{path}} is preceded by a UTF-8 byte-order mark (BOM); the file was scanned as body-only. Re-save the file as UTF-8 without BOM. The metadata block was silently lost.",
-  frontmatterMalformedMissingClose: "Frontmatter in {{path}} opens with `---` but never closes \u2014 no matching `---` line at column 0 was found. The file was scanned as body-only and every metadata field was silently lost. Add a closing `---` line below the metadata block.",
+  frontmatterMalformedMissingClose: "Frontmatter in {{path}} opens with `---` but never closes (no matching `---` line at column 0 was found). The file was scanned as body-only and every metadata field was silently lost. Add a closing `---` line below the metadata block.",
   extensionErrorLinkKindNotDeclared: 'Extractor "{{extractorId}}" emitted a link of kind "{{linkKind}}" outside its declared `emitsLinkKinds` set [{{declaredKinds}}]. Link dropped.',
   extensionErrorIssueInvalidSeverity: `Rule "{{analyzerId}}" emitted an issue with invalid severity {{severity}} (allowed: 'error' | 'warn' | 'info'). Issue dropped.`,
   extensionErrorContributionUnknownId: 'Extractor "{{extractorId}}" emitted contribution "{{contributionId}}" on {{nodePath}} but did not declare it in its `viewContributions` map. Contribution dropped.',
   extensionErrorContributionPayloadInvalid: 'Extractor "{{extractorId}}" emitted contribution "{{contributionId}}" on {{nodePath}}; payload failed the "{{slot}}" schema: {{errors}}. Contribution dropped.',
+  extensionErrorRecommendedActionMissing: 'Analyzer "{{analyzerId}}" declares recommendedAction "{{actionId}}" but no Action is registered under that qualified id. The analyzer stays registered; the recommendation will not surface in the inspector.',
   runScanRootEmptyArray: "runScan: roots must contain at least one path (spec requires minItems: 1)",
   runScanRootMissing: "runScan: root path '{{root}}' does not exist or is not a directory"
 };
@@ -870,10 +876,11 @@ function isExternalUrlLink(link) {
 }
 
 // kernel/orchestrator/analyzers.ts
-async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sidecarRoots, annotationContributions, viewContributions, orphanJobFiles, referenceablePaths, cwd, emitter, hookDispatcher) {
+async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sidecarRoots, annotationContributions, viewContributions, orphanJobFiles, referenceablePaths, cwd, registeredActionIds, emitter, hookDispatcher) {
   const issues = [];
   const contributions = [];
   const validators = loadSchemaValidators();
+  validateRecommendedActions(analyzers, registeredActionIds, emitter);
   const analyzerOrphans = orphanSidecars.map((o) => ({
     relativePath: o.relativePath,
     expectedMdPath: o.expectedMdPath
@@ -945,6 +952,27 @@ async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sid
   }
   return { issues, contributions };
 }
+function validateRecommendedActions(analyzers, registeredActionIds, emitter) {
+  for (const analyzer of analyzers) {
+    const refs = analyzer.recommendedActions;
+    if (refs === void 0 || refs.length === 0) continue;
+    const analyzerId = qualifiedExtensionId(analyzer.pluginId, analyzer.id);
+    for (const actionId of refs) {
+      if (registeredActionIds.has(actionId)) continue;
+      emitter.emit(
+        makeEvent("extension.error", {
+          kind: "recommended-action-missing",
+          extensionId: analyzerId,
+          actionId,
+          message: tx(ORCHESTRATOR_TEXTS.extensionErrorRecommendedActionMissing, {
+            analyzerId,
+            actionId
+          })
+        })
+      );
+    }
+  }
+}
 function validateIssue(analyzer, issue, emitter) {
   const severity = issue.severity;
   if (severity !== "error" && severity !== "warn" && severity !== "info") {
@@ -994,9 +1022,20 @@ function indexPriorLinks(links, priorNodePaths, byOriginating) {
     else byOriginating.set(key, [link]);
   }
 }
+var FRONTMATTER_ISSUE_ANALYZERS = /* @__PURE__ */ new Set([
+  "frontmatter-invalid",
+  "frontmatter-malformed",
+  // Audit L1: parser parse-error is emitted by
+  // `buildFreshNodeAndValidateFrontmatter` from `raw.parseIssues`. The
+  // raw.parseIssues only flows through the non-cache path; a cached
+  // node skips the rebuild, so the prior issue MUST survive the
+  // incremental scan or the warning silently disappears on a clean
+  // re-scan of an unchanged file.
+  "frontmatter-parse-error"
+]);
 function indexPriorFrontmatterIssues(issues, byNode) {
   for (const issue of issues) {
-    if (issue.analyzerId !== "frontmatter-invalid" && issue.analyzerId !== "frontmatter-malformed") continue;
+    if (!FRONTMATTER_ISSUE_ANALYZERS.has(issue.analyzerId)) continue;
     if (issue.nodeIds.length !== 1) continue;
     const path = issue.nodeIds[0];
     const list = byNode.get(path);
@@ -1195,7 +1234,7 @@ function flagAmbiguousRenames(opts) {
         analyzerId: "auto-rename-ambiguous",
         severity: "warn",
         nodeIds: [toPath],
-        message: `Auto-rename ambiguous: ${toPath} matches ${remaining.length} prior frontmatters \u2014 pick one with \`sm orphans undo-rename ${toPath} --from <old.path>\`.`,
+        message: `Auto-rename ambiguous: ${toPath} matches ${remaining.length} prior frontmatters; pick one with \`sm orphans undo-rename ${toPath} --from <old.path>\`.`,
         data: { to: toPath, candidates: remaining }
       });
     }
@@ -1252,7 +1291,7 @@ function detectRenamesAndOrphans(prior, current, issues) {
 }
 
 // kernel/scan/walk-content.ts
-import { readFile, readdir, stat } from "fs/promises";
+import { readFile, readdir, lstat } from "fs/promises";
 import { join as join2, relative as relative2, sep } from "path";
 
 // kernel/scan/ignore.ts
@@ -1310,8 +1349,30 @@ function readDefaultsFromDisk() {
 
 // built-in-plugins/parsers/frontmatter-yaml/index.ts
 import yaml from "js-yaml";
+
+// kernel/util/strip-prototype-pollution.ts
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+function stripPrototypePollution(value) {
+  return strip(value);
+}
+function strip(value) {
+  if (value === null || value === void 0) return value;
+  if (typeof value !== "object") return value;
+  if (Array.isArray(value)) return value.map(strip);
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    if (FORBIDDEN_KEYS.has(k)) continue;
+    out[k] = strip(v);
+  }
+  return out;
+}
+
+// built-in-plugins/parsers/frontmatter-yaml/index.ts
 var FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
-var FORBIDDEN_FRONTMATTER_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 var frontmatterYamlParser = {
   id: "frontmatter-yaml",
   parse(raw, _path) {
@@ -1319,20 +1380,30 @@ var frontmatterYamlParser = {
     if (!match) return { frontmatterRaw: "", frontmatter: {}, body: raw };
     const frontmatterRaw = match[1];
     const body = match[2];
-    const parsed = {};
+    let parsed = {};
+    const issues = [];
     try {
       const doc = yaml.load(frontmatterRaw, { schema: yaml.JSON_SCHEMA });
       if (doc && typeof doc === "object" && !Array.isArray(doc)) {
-        for (const [k, v] of Object.entries(doc)) {
-          if (FORBIDDEN_FRONTMATTER_KEYS.has(k)) continue;
-          parsed[k] = v;
-        }
+        parsed = stripPrototypePollution(doc);
       }
-    } catch {
+    } catch (err) {
+      issues.push({
+        code: "frontmatter-parse-error",
+        message: sanitiseParseErrorMessage(err)
+      });
     }
-    return { frontmatterRaw, frontmatter: parsed, body };
+    const out = { frontmatterRaw, frontmatter: parsed, body };
+    if (issues.length > 0) {
+      return { ...out, issues };
+    }
+    return out;
   }
 };
+function sanitiseParseErrorMessage(err) {
+  const raw = err instanceof Error ? err.message : String(err);
+  return raw.replace(/[-]+/g, " ").replace(/\s+/g, " ").trim();
+}
 
 // built-in-plugins/parsers/plain/index.ts
 var plainParser = {
@@ -1378,7 +1449,12 @@ async function* walkContent(roots, options) {
         path: relPath,
         body: parsed.body,
         frontmatterRaw: parsed.frontmatterRaw,
-        frontmatter: parsed.frontmatter
+        frontmatter: parsed.frontmatter,
+        // Audit L1: forward parser diagnostics (e.g. malformed YAML)
+        // through the IRawNode surface so the orchestrator can
+        // convert them into warn-level kernel `Issue` rows. Omitted
+        // when the parser reported no issues (happy path).
+        ...parsed.issues && parsed.issues.length > 0 ? { parseIssues: parsed.issues } : {}
       };
     }
   }
@@ -1400,7 +1476,7 @@ async function* walkRoot(root, current, filter, extensions) {
       yield* walkRoot(root, full, filter, extensions);
     } else if (entry.isFile() && hasMatchingExtension(name, extensions)) {
       try {
-        const s = await stat(full);
+        const s = await lstat(full);
         if (s.isFile()) yield full;
       } catch {
       }
@@ -1466,6 +1542,7 @@ function readSidecarFor(mdAbsolutePath) {
       issues: [{ message: `malformed YAML in ${sidecarPath}: ${err.message}` }]
     };
   }
+  parsedYaml = stripPrototypePollution(parsedYaml);
   if (!isPlainObject(parsedYaml)) {
     return {
       parsed: null,
@@ -1531,7 +1608,7 @@ function resolveSpecRoot2() {
     return dirname3(indexPath);
   } catch {
     throw new Error(
-      "@skill-map/spec not resolvable \u2014 sidecar reader cannot load schemas."
+      "@skill-map/spec not resolvable: sidecar reader cannot load schemas."
     );
   }
 }
@@ -1588,17 +1665,32 @@ function safeIsFile(path) {
 }
 
 // kernel/sidecar/store.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8, renameSync as renameSync2, writeFileSync as writeFileSync2, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
 import { dirname as dirname5, resolve as resolve9 } from "path";
 import { createRequire as createRequire4 } from "module";
 import { Ajv2020 as Ajv20205 } from "ajv/dist/2020.js";
 import yaml3 from "js-yaml";
 
+// core/config/atomic-write.ts
+import {
+  closeSync,
+  constants as fsConstants,
+  existsSync as existsSync5,
+  mkdirSync,
+  openSync,
+  readFileSync as readFileSync6,
+  renameSync,
+  unlinkSync,
+  writeSync
+} from "fs";
+import { randomBytes } from "crypto";
+import { dirname as dirname4 } from "path";
+
 // core/config/helper.ts
 import { isAbsolute as isAbsolute2, resolve as resolve8 } from "path";
 
 // kernel/config/loader.ts
-import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
 
 // kernel/util/skill-map-paths.ts
 import { join as join5 } from "path";
@@ -1614,17 +1706,6 @@ var GITIGNORE_ENTRIES = [
   `${SKILL_MAP_DIR}/${DB_FILENAME}`
 ];
 
-// core/config/atomic-write.ts
-import {
-  existsSync as existsSync6,
-  mkdirSync,
-  readFileSync as readFileSync7,
-  renameSync,
-  unlinkSync,
-  writeFileSync
-} from "fs";
-import { dirname as dirname4 } from "path";
-
 // kernel/orchestrator/node-build.ts
 import { createHash } from "crypto";
 import { existsSync as existsSync8 } from "fs";
@@ -1773,11 +1854,11 @@ function resolveSidecarOverlay(relativePath, nodePathForIssue, roots, liveBodyHa
     liveFrontmatterHash
   });
   return {
-    // R15 closure (2026-05-07) — surface the full parsed root on the
+    // R15 closure (2026-05-07), surface the full parsed root on the
     // overlay so BFF consumers (UI inspector audit / plugin-contributions
     // / debug panels) can read `for.*`, `audit.*`, `settings.*`, and
     // plugin-namespaced sub-keys without re-reading the file. The
-    // `annotations` field above stays — it duplicates `root.annotations`
+    // `annotations` field above stays, it duplicates `root.annotations`
     // by design so existing consumers keep working unchanged.
     overlay: {
       present: true,
@@ -1821,6 +1902,16 @@ function buildFreshNodeAndValidateFrontmatter(opts) {
     encoder: opts.encoder
   });
   const frontmatterIssues = [];
+  if (opts.raw.parseIssues && opts.raw.parseIssues.length > 0) {
+    for (const pi of opts.raw.parseIssues) {
+      frontmatterIssues.push({
+        analyzerId: pi.code,
+        severity: opts.strict ? "error" : "warn",
+        nodeIds: [opts.raw.path],
+        message: pi.message
+      });
+    }
+  }
   if (opts.raw.frontmatterRaw.length > 0) {
     const fmIssue = validateFrontmatter(
       opts.providerFrontmatter,
@@ -1847,10 +1938,9 @@ function mergeNodeWithEnrichments(node, enrichments, opts = {}) {
   }
   return base;
 }
-var FORBIDDEN_MERGE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function assignSafe(target, source) {
-  for (const [k, v] of Object.entries(source)) {
-    if (FORBIDDEN_MERGE_KEYS.has(k)) continue;
+  const safe = stripPrototypePollution(source);
+  for (const [k, v] of Object.entries(safe)) {
     target[k] = v;
   }
 }
@@ -2129,6 +2219,9 @@ async function runScanInternal(_kernel, options) {
   recomputeLinkCounts(walked.nodes, walked.internalLinks);
   recomputeExternalRefsCount(walked.nodes, walked.externalLinks, walked.cachedPaths);
   await dispatchExtractorCompleted(exts.extractors, emitter, hookDispatcher);
+  const registeredActionIds = new Set(
+    _kernel.registry.all("action").map((a) => qualifiedExtensionId(a.pluginId, a.id))
+  );
   const analyzerResult = await runAnalyzers(
     exts.analyzers,
     walked.nodes,
@@ -2140,6 +2233,7 @@ async function runScanInternal(_kernel, options) {
     options.orphanJobFiles ?? [],
     options.referenceablePaths,
     options.cwd,
+    registeredActionIds,
     emitter,
     hookDispatcher
   );
@@ -2261,7 +2355,8 @@ function createChokidarWatcher(opts) {
   const watcher = chokidar.watch(absRoots, {
     ignoreInitial: true,
     persistent: true,
-    ...ignored ? { ignored } : {}
+    ...ignored ? { ignored } : {},
+    ...opts.depth !== void 0 ? { depth: opts.depth } : {}
   });
   let pending = [];
   let timer = null;