agentsmesh 0.38.0 → 0.40.0

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## 0.40.0
+
+### Minor Changes
+
+- 4fbf6a6: **Fixed — lessons over MCP no longer require an initialized project.** `lessons_query` and the other lessons tools rejected every call in a directory without `agentsmesh.yaml` with `NO_PROJECT`, while the CLI did the opposite: `agentsmesh lessons query` printed a setup hint and exited 0, and `lessons add` created the graph. Since MCP is the documented path for an agent with no shell — and the only path a Claude Code plugin has — the feature was unreachable for exactly the callers it was meant to serve. All five lessons tools now fall back to the working directory. Config tools such as `generate` still require a project and still report `NO_PROJECT`.
+
+### Patch Changes
+
+- 5989d1f: **Fixed — a slash command in prose is no longer rewritten as a path.** `/plugin`, `/config`, `/memory` and friends are indistinguishable from a one-segment root-absolute path, and reference resolution is existence-gated, so the corruption appeared only once a repository grew a directory of that name: a repo with `plugin/` saw every `/plugin` in its skills and rules silently rewritten to `plugin` on the next `generate`. Directory names like `config`, `docs`, `test` and `build` make this likely in an ordinary project, and agent-facing documentation is full of slash commands.
+
+  A root-absolute token now has to look like a path to be treated as one — a further segment, a file extension, or a trailing slash. `/docs/x.md`, `/AGENTS.md` and `/docs/` still rewrite; `/docs` is left alone. Write `/docs/` or `docs/` when you mean the directory.
+
+- 5e8ef3b: **Added — the recall log records which action it was for.** `lessons stats` reports a held-rate and correctly calls it a weak upper bound, because a delivery with no recorded repeat is not proof of prevention. The missing piece was exposure: the log proved a recall happened but not for which action, so occurrences per action could not be counted and no before/after rate was computable.
+
+  Each recall record now carries the normalized `contextKey` the outcome log already stores (`file:src/x.ts`, `cmd:git commit`, or `none` for a keyword-only query), so this adds no content the logs did not already hold and never records a raw command. Telemetry remains opt-in and off by default. Records written before this change have no key and are reported as such rather than silently skewing an average.
+
+- ead5625: AgentsMesh can now be listed in the official MCP registry. The published package declares `mcpName`, the field the registry reads to confirm that the npm package and the registry entry share an owner — without it a submission is rejected outright. The registry manifest `server.json` also stops pinning an npm version, so it can no longer advertise a release that has been superseded, and its remaining version field is written by `changeset version` instead of by hand.
+
+## 0.39.0
+
+### Minor Changes
+
+- 8205c68: **Changed — `init` enables the tools you use, not every tool it supports.** A non-interactive `agentsmesh init` in a repo with no tool config enabled all 32 starter targets, so the next `generate` wrote 47 files and roughly thirty dot-directories into a project that had asked for none of them. That is a poor first impression and a real foot-gun for scripted and CI adoption. Target selection now follows evidence of intent, strongest first: `--targets a,b`, then `--all-targets`, then tool config found in the project, then tools installed on this machine, then a minimal set of `claude-code`, `cursor` and `copilot`. The same empty repo now produces 9 files. Unless you passed a flag, `init` prints how many targets it enabled, which rule chose them, and the flag that changes them.
+
+  Machine detection reuses each target's own global detection paths (`~/.claude/`, `~/.cursor/`, `~/.config/zed/`, …), so a new target participates by declaring its descriptor rather than by being added to a list. Nothing is ever imported out of your home directory; the paths only inform which targets to enable. A target that opts out of bulk scaffolding via `excludeFromStarterInit` is never auto-enabled by `--all-targets` or by machine detection, but naming it in `--targets` or committing its config in the project still enables it.
+
+  **Added — `agentsmesh init --targets <csv>` and `agentsmesh init --all-targets`.** `--targets` enables exactly the listed IDs and rejects an unknown one instead of silently narrowing the run. `--all-targets` restores the previous full-starter-set behavior in one flag.
+
+  **Changed — the interactive wizard pre-selects the same targets** the non-interactive path would have chosen, instead of starting from an empty selection. Both entry points now agree on what a sensible default looks like, and the choice is still entirely the user's to change.
+
+- 15bd2c4: **Changed — the generation-contract block is 56% shorter.** The managed block agentsmesh injects into every target's root instruction ran to 85 words, enumerating every canonical filename (`rules/_root.md`, `commands/*.md`, `skills/*/SKILL.md`, …) and most of the CLI surface (`init`, `import`, `install`, `diff`, `lint`, `check`, `watch`, `matrix`, `merge`, `refresh`). That text is projected into `CLAUDE.md`, `AGENTS.md`, `.cursor/rules/`, `.github/copilot-instructions.md` and every other root file, so every agent in every tool re-read all of it on every turn — a cost paid per session, per tool, per developer.
+
+  It now carries only the part an agent cannot infer for itself: generated files are not the source, edit `.agentsmesh` (or `agentsmesh.yaml` for targets and features), then run `agentsmesh generate`. Canonical filenames are discoverable by listing the directory, and the command surface by `--help`.
+
+  The previous wording joins the legacy ladder, so an existing root file is upgraded in place on the next `generate` and stripped correctly on import — no duplicate contract blocks and no stale text left behind.
+
+- 95032aa: **Fixed — the recurrence gate could not tell one recurring problem from unrelated failures.** It escalated with `RECURRENT FAILURE: this exact action has failed N× before`, but the action key is deliberately a class: `cat a.txt` and `cat b.txt` are both `cmd:cat`. Six unrelated errors under one program therefore looked identical to the same error six times, which is how an ordinary read came to be announced as a recurring defect.
+
+  The gate was designed around a coarse error signature to prevent exactly this, and the signature had never worked. Harnesses report a failed call in different places: some send a plain `tool_error` string, while Claude Code sends a structured `tool_response`. The extractor accepted only a plain string, so every failure this project has ever recorded carried no error class at all. Failure text is now read from either shape, trying conventional fields (`stderr`, `error`, `message`, `stdout`) in specificity order rather than per harness.
+
+  With a signature available, escalation requires the **same error** to have recurred, not merely the same program. Where the harness reports no error text, nothing is claimed and the gate stays silent, because without a signature there is no evidence that one problem repeated. The message now states what was measured.
+
+  **Fixed — the truncation notice named a setting that could not help.** Hook recall injects at most five rules per call, a ceiling that overrides the configured recall limit, so on any sizeable graph the count is what truncates. The notice nevertheless told the reader to raise `recallMaxTokens`, which changes nothing in that case. It now names whichever cap actually bound.
+
+- a5460c9: **Fixed — a second tool's root rule no longer erases the first.** `.agentsmesh/rules/_root.md` is the one canonical slot every target's root instruction collapses into, and it was last-import-wins like every other path. On the most common adoption path — a repo holding both `CLAUDE.md` and an always-apply `.cursor/rules/*.mdc`, then `agentsmesh init --yes` — both imports were reported as successful while only the second survived, and the next `generate` wrote that survivor back over the user's own `CLAUDE.md`. Root-rule bodies now accumulate: the second import appends instead of replacing, and `import` and `init` both say the root rule was merged so the combination is never silent. Every other canonical path (commands, agents, skills, hooks, permissions, ignore) keeps last-import-wins, because a name collision there means two descriptions of the same entity, while two tools' root rules are different rules that merely share a destination.
+
+  The merge is content-addressed, so repeated imports stay stable: re-importing unchanged content changes nothing, and re-importing a source that gained lines upstream replaces the shorter body rather than appending a near-duplicate. The placeholder `init` scaffolds into an empty root rule is treated as unwritten, so the first real import replaces it instead of keeping it above every imported rule. Content removed from a tool's root file upstream is the one case the importer cannot resolve — it is kept, because deleting canonical rules on a guess is worse than leaving a line to delete by hand.
+
+### Patch Changes
+
+- a583963: **Corrected — the comparison table overstated what is unique to AgentsMesh.** Every row was re-verified against each project's own source and documentation on 2026-09-19, and two claims were wrong: rulesync ships a self-serve MCP server and a documented programmatic API with a global `--json` envelope, both of which the table marked as absent or partial. It also credited Ruler and rulesync with tool counts neither project advertises. Those rows are fixed, the counts are now counted from source and labelled as such, and the table says plainly that rulesync supports more tools than AgentsMesh and releases more often.
+
+  The rows that survived verification are stated more precisely: cross-file link rewriting (no tool in the category does it), a lossless round-trip across every feature rather than one target's permissions, a lockfile-verified drift gate with git-merge recovery, target plugins, and lessons. "Plugins" is now "target plugins" throughout, because the Agent Plugins specification has since claimed the bare word for a bundle of skills and MCP servers. Two newer adjacent projects, capa and Sentry's dotagents, are named with an accurate description of what they actually do instead of being scored against a grid built for config transpilers.
+
+- b483bb1: **Changed — the package description says what this is before it says what it does.** The `agentsmesh` name collides in search with an unrelated AI agent platform, so the description now opens with "AI coding config sync CLI" rather than leading with the mechanism. Same content otherwise.
+- f32a5e2: **Changed — removed ~2,700 lines of duplicated and dead code.** A repo-wide over-engineering pass collapsed machinery that had drifted into copies of itself, with no change to the published API surface. The canonical `.agentsmesh/` layout is now declared once in `src/core/canonical-paths.ts` instead of 163 per-target constants holding 9 distinct literals; 24 byte-identical target rule linters, 32 no-op generator stubs, 35 duplicate `{ path, content }` output interfaces, 26 capability-gap lint functions and 11 identical embedded-root-rule generators now route through one shared helper each. Helpers that had been copy-pasted across the tree — `isRecord` (14×), `emptyCanonical` (4×), `canonicalDocument` (6×), `toStringArray`, `stringList`, `todayIso`, `union`, `shortHash` — collapsed to single exports. Dead code removed: the legacy `TargetGenerators` registry, the unused plugin link-format override registry, `logger.table`, `auditReachability`, `TARGET_CATALOG`, and the `src/lessons/recurrence/` retrieval-eval harness (moved to `tests/harness/`, it had no production importer).
+
+  **Removed — the `repairTriggers` lessons config key.** Capture-time trigger repair was opt-in, defaulted to `false`, and was never enabled outside its own tests; the warn-only capture guardrails it enforced are unchanged. Setting `repairTriggers` in `.agentsmesh/lessons/config.json` is now ignored, and the `NARROWED_GLOB`, `KEYWORD_VARIANT_ADDED` and `DROPPED_KEYWORD` capture warnings no longer occur.
+
+  **Changed — rule `globs:` matching now uses standard glob semantics.** The hand-rolled glob-to-regex engine was replaced by `picomatch`, already a runtime dependency. Two degenerate patterns change meaning to match bash and every other glob implementation: a comma outside a brace group is now a literal (`a,b` matches the file `a,b`, not `a` or `b`), and a single-element brace group is a literal (`{foo}` matches `{foo}`, not `foo`). Ordinary patterns — `**`, `*`, `?`, character classes and multi-element brace groups like `src/*.{ts,tsx}` — are unaffected.
+
 ## 0.38.0
 
 ### Minor Changes

package/README.md

@@ -20,7 +20,11 @@ Every AI coding assistant reads its own config: `CLAUDE.md`, `AGENTS.md`, `.curs
 
 **AgentsMesh makes `.agentsmesh/` the one source.** Write rules, commands, agents, skills, MCP servers, hooks, ignore patterns, and permissions once. `agentsmesh generate` writes every tool's native files, `agentsmesh import` pulls existing configs back in without loss, and `agentsmesh check` fails CI when anything drifts.
 
-**Your agents learn from your repo.** [Lessons](#teach-your-agents-lessons) give every agent, in every tool, one git-tracked memory: capture a rule after a failure, recall it before the next edit. Same mistake, never twice.
+**Your agents learn from your repo.** [Lessons](#teach-your-agents-lessons) give every agent, in every tool, one git-tracked memory: capture a rule after a failure, recall it before the next edit. Same mistake, never twice. No other config-sync tool has this.
+
+<div align="center">
+  <img src="https://raw.githubusercontent.com/sampleXbro/agentsmesh/master/assets/lessons-demo.gif" alt="an AI agent captures a lesson after a failure, then recalls it before editing the same file" width="100%" />
+</div>
 
 > [!NOTE]
 > Full documentation, guides, and the per-tool reference: **[samplexbro.github.io/agentsmesh](https://samplexbro.github.io/agentsmesh/)**
@@ -47,13 +51,15 @@ Binaries with SHA-256 checksums are on [GitHub Releases](https://github.com/samp
 ## 60-second quickstart
 
 ```bash
-agentsmesh init       # detect and import existing tool configs, or scaffold fresh
+agentsmesh init       # detect the tools you use, import their configs, or scaffold fresh
 agentsmesh generate   # write each tool's native config from the one source
 agentsmesh check      # CI drift gate against .agentsmesh/.lock
 ```
 
 On a terminal, `init` runs a short wizard: pick targets, import detected configs (`.cursor/`, `.claude/`, `.github/copilot-instructions.md`, and more), enable lessons, and optionally generate right away. Nothing is written until you finish. Use `--yes` for the non-interactive default, `--global` for your user-level config under `~/.agentsmesh/`, and `npx agentsmesh` if you installed it as a dev dependency.
 
+`init` enables the tools you actually use, not all of them: whatever this project already has config for, else whatever is installed on your machine, else a minimal set of Claude Code, Cursor and Copilot. It prints what it picked. Pass `--targets a,b` to choose, or `--all-targets` for everything.
+
 > [!TIP]
 > Commit both `.agentsmesh/` and the generated tool files, like a lockfile: the tools read the generated files directly, and `agentsmesh check` keeps the two from drifting.
 
@@ -93,11 +99,7 @@ AGENTS.md
 
 ## Teach your agents: lessons
 
-No other config-sync tool has this. Lessons are a memory of past mistakes that every agent reads before it acts and writes after something goes wrong, so a lesson one agent learns today helps every teammate's agent tomorrow, in any tool.
-
-<div align="center">
-  <img src="https://raw.githubusercontent.com/sampleXbro/agentsmesh/master/assets/lessons-demo.gif" alt="an AI agent captures a lesson after a failure, then recalls it before editing the same file" width="100%" />
-</div>
+Lessons are a memory of past mistakes that every agent reads before it acts and writes after something goes wrong, so a lesson one agent learns today helps every teammate's agent tomorrow, in any tool.
 
 The memory is one git-tracked file, `.agentsmesh/lessons/lessons.json`, driven by two commands:
 
@@ -117,23 +119,25 @@ Full walkthrough: [Teach your AI agents with lessons](https://samplexbro.github.
 
 ## How AgentsMesh compares
 
-Most sync tools stop at copying rule files into each assistant's folder. AgentsMesh also round-trips losslessly, rebases cross-tool links, lints before a tool would silently drop content, and lets anyone add a new tool as a plugin.
+[Ruler](https://github.com/intellectronica/ruler) and [rulesync](https://github.com/dyoshikawa/rulesync) both cover the common ground well, and rulesync supports more tools than AgentsMesh does. What is left to differentiate is what survives translation: links rewritten per target, a round-trip that loses nothing, a lockfile-backed drift gate, new tools addable without a core release, and a memory that learns.
 
-| Capability | AgentsMesh | [Ruler](https://github.com/intellectronica/ruler) | [rulesync](https://github.com/dyoshikawa/rulesync) |
+| Capability | AgentsMesh | Ruler | rulesync |
 |---|:---:|:---:|:---:|
 | Generate native config for many tools | ✅ | ✅ | ✅ |
+| Tools supported (counted from source) | 33 | ~31 | ~50 |
 | Import existing tool config back to source | ✅ | — | ✅ |
-| **Lossless round-trip** (re-import restores originals) | ✅ | — | partial |
 | Convert one tool's config directly to another | ✅ | — | ✅ |
-| **Automatic cross-tool link rebasing** | ✅ | — | — |
+| CI drift gate (non-zero exit on drift) | ✅ | partial | ✅ |
+| Lint before a target silently drops content | ✅ | partial | partial |
+| Self-serve MCP server (agent-operable config) | ✅ | — | ✅ |
+| `--json` output + typed programmatic API | ✅ | — | ✅ |
+| **Lossless round-trip** (re-import restores originals) | ✅ | — | partial |
+| **Cross-file links rewritten per target** | ✅ | — | — |
+| **Lockfile-verified drift + git-merge recovery** | ✅ | — | — |
+| **Target plugins: add a tool without a core release** | ✅ | — | — |
 | **Lessons: a shared agent memory that learns** | ✅ | — | — |
-| **Plugins: add a target without a release** | ✅ | — | — |
-| Cross-target lint (warn before silent data loss) | ✅ | — | — |
-| CI drift gate + git-merge recovery | ✅ | partial | partial |
-| Self-serve MCP server (agent-operable config) | ✅ | — | — |
-| `--json` output + typed programmatic API | ✅ | — | partial |
 
-<sub>Reflects the public projects as of June 2026. Sources and detail in the [alternatives guide](https://samplexbro.github.io/agentsmesh/reference/alternatives/); corrections welcome.</sub>
+<sub>Verified against each project's source and docs on 2026-09-19. Tool counts are counted from source, not marketing claims, and differ by how variants are tallied. Two newer projects solve adjacent problems rather than this one: [capa](https://github.com/infragate/capa) is a package manager and MCP gateway, and [Sentry's dotagents](https://github.com/getsentry/dotagents) manages skill and MCP dependencies without emitting instruction files. Detail and sources in the [alternatives guide](https://samplexbro.github.io/agentsmesh/reference/alternatives/); corrections welcome.</sub>
 
 Built to be depended on: 12,000+ tests on Linux, macOS, and Windows CI, JSON-Schema-validated configs, npm releases with [provenance](https://docs.npmjs.com/generating-provenance-statements), and a per-file coverage floor in the test gate.
 
@@ -141,14 +145,14 @@ Built to be depended on: 12,000+ tests on Linux, macOS, and Windows CI, JSON-Sch
 
 - **Lossless two-way sync.** When a tool has no native slot for a feature, it is embedded with round-trip metadata instead of dropped. [Managed embedding](https://samplexbro.github.io/agentsmesh/reference/managed-embedding/)
 - **Automatic link rebasing.** `.agentsmesh/skills/api-gen/template.hbs` becomes `.claude/skills/...` or `.cursor/skills/...` in each generated file. [Generation pipeline](https://samplexbro.github.io/agentsmesh/reference/generation-pipeline/)
-- **Safe adoption.** `import`, then `diff`, then `generate`, then `check`; nothing is overwritten blind. [Existing-project guide](https://samplexbro.github.io/agentsmesh/guides/existing-project/)
+- **Safe adoption.** `import`, then `diff`, then `generate`, then `check`; nothing is overwritten blind. When several tools have a root rule, they are merged into one `_root.md` rather than the last one winning. [Existing-project guide](https://samplexbro.github.io/agentsmesh/guides/existing-project/)
 - **Output directory safety.** `generate` and `convert` reject output directories that resolve outside the project (or home directory with `--global`), checked before any write and under `--dry-run` too. Stale-file cleanup enforces the same boundary.
 - **Safe updates.** Explicitly empty Claude permission, hook, and MCP configurations clear their generated entries. MCP edits preserve untouched server fields and reject malformed files; skill updates validate supporting files before writing.
 - **Migrate between tools.** `convert --from <a> --to <b>` rewrites one tool's config directly into another's. [convert](https://samplexbro.github.io/agentsmesh/cli/convert/)
 - **Global mode.** `~/.agentsmesh/` syncs personal config to `~/.claude/`, `~/.cursor/`, `~/.codex/`, and more; config commands accept `--global`. [Global paths](https://samplexbro.github.io/agentsmesh/reference/supported-tools/#global-mode)
 - **CI-ready.** `check` gates drift, `diff` previews, `merge` rebuilds the lock after a Git conflict, and `lint` warns about content a tool would mishandle. [check](https://samplexbro.github.io/agentsmesh/cli/check/) · [lint](https://samplexbro.github.io/agentsmesh/cli/lint/)
 - **Community packs and `extends`.** Install rules, skills, agents, and commands from any git repo; hooks, permissions, and MCP from remote sources stay off until you opt in. [install](https://samplexbro.github.io/agentsmesh/cli/install/)
-- **Plugins.** Ship a new tool as an npm package with full parity to built-in targets. [Build a plugin](https://samplexbro.github.io/agentsmesh/guides/building-plugins/)
+- **Target plugins.** Ship a new tool as an npm package with full parity to built-in targets. [Build a plugin](https://samplexbro.github.io/agentsmesh/guides/building-plugins/)
 - **Schema-validated configs.** Every config ships a JSON Schema for editor autocomplete. [JSON schemas](https://samplexbro.github.io/agentsmesh/reference/json-schemas/)
 - **Scriptable.** A typed API for `generate`, `import`, `lint`, `diff`, and `check`, `--json` envelopes on every command except `watch`, and an MCP server so agents can operate the config themselves. [API](https://samplexbro.github.io/agentsmesh/reference/programmatic-api/) · [MCP server](https://samplexbro.github.io/agentsmesh/reference/mcp-server/)
 
@@ -187,6 +191,9 @@ AgentsMesh generates native config for every major AI coding assistant, plus plu
 
 ### Project scope (`agentsmesh generate`)
 
+<details>
+<summary>Per-feature support for all 33 tools</summary>
+
 <!-- agentsmesh:support-matrix:project -->
 | Feature | Aider | Amazon Q Developer | Amp | Antigravity | Augment Code | Claude Code | Cline | Codebuff | Codex CLI | Continue | GitHub Copilot | Crush | Cursor | Deep Agents CLI | Factory Droid | Gemini CLI | Goose | Jules | Junie | Kilo Code | Kimi Code CLI | Kiro | OpenCode | OpenHands | Pi Agent | Qwen Code | Replit Agent | Roo Code | Rovo Dev | Trae | Warp | Windsurf | Zed |
 |---|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|
@@ -201,8 +208,13 @@ AgentsMesh generates native config for every major AI coding assistant, plus plu
 | Permissions | Partial | Embedded | Partial | Partial | Native | Native | Partial | Partial | Native | — | — | Native | Native | Partial | Native | Partial | Partial | Partial | Partial | Native | Partial | Embedded | Native | Partial | Native | Native | Partial | Native | — | — | Partial | Partial | — |
 <!-- /agentsmesh:support-matrix:project -->
 
+</details>
+
 ### Global scope (`agentsmesh generate --global`)
 
+<details>
+<summary>Per-feature support for all 33 tools in global mode</summary>
+
 <!-- agentsmesh:support-matrix:global -->
 | Feature | Aider | Amazon Q Developer | Amp | Antigravity | Augment Code | Claude Code | Cline | Codebuff | Codex CLI | Continue | GitHub Copilot | Crush | Cursor | Deep Agents CLI | Factory Droid | Gemini CLI | Goose | Jules | Junie | Kilo Code | Kimi Code CLI | Kiro | OpenCode | OpenHands | Pi Agent | Qwen Code | Replit Agent | Roo Code | Rovo Dev | Trae | Warp | Windsurf | Zed |
 |---|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|
@@ -217,6 +229,8 @@ AgentsMesh generates native config for every major AI coding assistant, plus plu
 | Permissions | Partial | Embedded | Partial | Native | Native | Native | Partial | Partial | Native | Native | Partial | Native | Native | Embedded | Native | Native | Native | — | Native | Native | Native | Native | Native | Partial | Native | Native | — | Partial | Native | Partial | Native | Partial | Native |
 <!-- /agentsmesh:support-matrix:global -->
 
+</details>
+
 ## Documentation
 
 - [Getting started](https://samplexbro.github.io/agentsmesh/getting-started/installation/): install and first run