@viloforge/vfkb 0.2.2 → 0.2.3

package/dist/bundles/vfkb-mcp.mjs

@@ -31940,7 +31940,7 @@ function queryExplained(opts = {}) {
 }
 
 // src/version.ts
-var ENGINE_VERSION = true ? "0.2.2" : ownPackageVersion();
+var ENGINE_VERSION = true ? "0.2.3" : ownPackageVersion();
 
 // src/mcp-server.ts
 var SEARCH_DEFAULT_LIMIT = 25;

package/dist/bundles/vfkb.mjs

@@ -16346,8 +16346,8 @@ import { dirname as dirname3, join as join9 } from "node:path";
 
 // src/version.ts
 var SCHEMA_VERSION = 1;
-var ENGINE_VERSION = true ? "0.2.2" : ownPackageVersion();
-var ENGINE_COMMIT = true ? "046120c" : "dev";
+var ENGINE_VERSION = true ? "0.2.3" : ownPackageVersion();
+var ENGINE_COMMIT = true ? "21adfd7" : "dev";
 
 // src/manifest.ts
 function manifestPath(brainDir2) {

package/dist/gating.js

@@ -3,6 +3,14 @@
 // writer, D4a; keeps the index/freshness invariants and the no-secrets lint).
 // Harness-agnostic: handles Claude Code ('Write'/'Edit'/'MultiEdit') and Pi
 // ('write'/'edit') tool names + their path aliases.
+//
+// SCOPE (issue #151): this gates direct FILE-WRITE tools only. An exec/shell
+// tool (`bash`) is root-equivalent — `echo > brain` cannot be reliably stopped
+// by inspecting tool inputs, and a heuristic command-string filter would be
+// trivially evadable (against the deterministic-Brake doctrine). So exec tools
+// are OUT OF SCOPE by design; the guarantee is "the write/edit tools can't clobber
+// the brain," not "no tool can." Harnesses that must contain an untrusted agent
+// restrict the toolset (e.g. the L4 tool-gating scenario allows only write/edit).
 import { resolve } from 'node:path';
 import { brainDir } from './storage.js';
 const WRITE_TOOLS = new Set([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viloforge/vfkb",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "ViloForge KnowledgeBase (vfkb) — per-project knowledge substrate for the ViloForge software factory. Greenfield TypeScript.",
   "type": "module",
   "main": "dist/engine.js",