arkgate 2.13.0 → 3.0.0

package/bin/lib/field-install.mjs

@@ -21,6 +21,68 @@ function arkPackageVersion() {
   }
 }
 
+function matchingBrace(text, openIndex) {
+  let depth = 0;
+  let quoted = false;
+  let escaped = false;
+  for (let index = openIndex; index < text.length; index += 1) {
+    const char = text[index];
+    if (quoted) {
+      if (escaped) escaped = false;
+      else if (char === '\\') escaped = true;
+      else if (char === '"') quoted = false;
+      continue;
+    }
+    if (char === '"') quoted = true;
+    else if (char === '{') depth += 1;
+    else if (char === '}' && --depth === 0) return index;
+  }
+  return -1;
+}
+
+function addDevDependencyPreservingFormat(source, version) {
+  const multiline = /\r?\n/.test(source);
+  const eol = source.includes('\r\n') ? '\r\n' : '\n';
+  const rootPropertyIndent = source.match(/\r?\n([ \t]+)"[^"\n]+"\s*:/)?.[1] ?? '  ';
+  const indentUnit = rootPropertyIndent;
+  const encoded = JSON.stringify(version);
+  const devMatch = /"devDependencies"\s*:\s*\{/.exec(source);
+
+  if (devMatch) {
+    const open = source.indexOf('{', devMatch.index);
+    const close = matchingBrace(source, open);
+    if (close === -1) throw new Error('Unbalanced devDependencies object');
+    const body = source.slice(open + 1, close);
+    if (!multiline) {
+      const addition = body.trim() ? `,"arkgate":${encoded}` : `"arkgate":${encoded}`;
+      return `${source.slice(0, close)}${addition}${source.slice(close)}`;
+    }
+    const beforeClose = source.slice(0, close);
+    const trailing = beforeClose.match(/\s*$/)?.[0] ?? '';
+    const contentEnd = close - trailing.length;
+    const closingIndent = trailing.slice(trailing.lastIndexOf('\n') + 1);
+    const propertyIndent = `${closingIndent}${indentUnit}`;
+    const addition = body.trim()
+      ? `,${eol}${propertyIndent}"arkgate": ${encoded}`
+      : `${propertyIndent}"arkgate": ${encoded}`;
+    return `${source.slice(0, contentEnd)}${addition}${eol}${closingIndent}${source.slice(close)}`;
+  }
+
+  const rootClose = source.lastIndexOf('}');
+  if (rootClose === -1) throw new Error('Unbalanced package.json object');
+  const rootBody = source.slice(0, rootClose);
+  if (!multiline) {
+    const separator = rootBody.trim().endsWith('{') ? '' : ',';
+    return `${rootBody}${separator}"devDependencies":{"arkgate":${encoded}}${source.slice(rootClose)}`;
+  }
+  const trailing = rootBody.match(/\s*$/)?.[0] ?? '';
+  const contentEnd = rootClose - trailing.length;
+  const rootClosingIndent = trailing.slice(trailing.lastIndexOf('\n') + 1);
+  const separator = source.slice(0, contentEnd).trimEnd().endsWith('{') ? '' : ',';
+  const addition = `${separator}${eol}${rootPropertyIndent}"devDependencies": {${eol}${rootPropertyIndent}${indentUnit}"arkgate": ${encoded}${eol}${rootPropertyIndent}}`;
+  return `${source.slice(0, contentEnd)}${addition}${eol}${rootClosingIndent}${source.slice(rootClose)}`;
+}
+
 /**
  * Ensure a check command string includes `--baseline <file>`.
  * Only touches strings that already invoke ark-check / arkgate-check.
@@ -150,16 +212,15 @@ export function pinArkgateDevDependency(root, opts = {}) {
     return { changed: false, reason: 'no-package-json' };
   }
   let pkg;
+  let source;
   try {
-    pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+    source = fs.readFileSync(pkgPath, 'utf8');
+    pkg = JSON.parse(source);
   } catch {
     return { changed: false, reason: 'unreadable-package-json' };
   }
   const deps = pkg.dependencies && typeof pkg.dependencies === 'object' ? pkg.dependencies : {};
-  const dev =
-    pkg.devDependencies && typeof pkg.devDependencies === 'object'
-      ? { ...pkg.devDependencies }
-      : {};
+  const dev = pkg.devDependencies && typeof pkg.devDependencies === 'object' ? pkg.devDependencies : {};
   if (typeof deps.arkgate === 'string' || typeof dev.arkgate === 'string') {
     return {
       changed: false,
@@ -174,12 +235,8 @@ export function pinArkgateDevDependency(root, opts = {}) {
       : shipped
         ? `^${shipped}`
         : 'latest';
-  dev.arkgate = version;
   if (opts.write !== false) {
-    fs.writeFileSync(
-      pkgPath,
-      `${JSON.stringify({ ...pkg, devDependencies: dev }, null, 2)}\n`
-    );
+    fs.writeFileSync(pkgPath, addDevDependencyPreservingFormat(source, version));
   }
   return { changed: true, reason: 'added', version };
 }

package/bin/lib/gate-files.mjs

@@ -119,6 +119,40 @@ export const REQUIRED_GATE_FILES = [
   '.mcp.json',
 ];
 const REQUIRED_GATE_WORKFLOW = '.github/workflows/*.yml running ark-check';
+const COMPACT_ROUTER = /<!--\s*arkgate:compact-router host=([a-z]+)\s*-->/;
+
+const COMPACT_HOST_FILES = {
+  claude: ['.claude/settings.json'],
+  grok: ['.grok/config.toml', '.grok/hooks/ark-write-gate.json'],
+  cursor: ['.cursor/mcp.json'],
+  codex: ['.codex/hooks.json'],
+  windsurf: ['.windsurf/rules/ark.md'],
+  cline: ['.clinerules/ark.md'],
+  copilot: ['.github/copilot-instructions.md'],
+  kiro: ['.kiro/steering/ark.md'],
+  roo: ['.roo/rules/ark.md'],
+  continue: ['.continue/rules/ark.md'],
+  gemini: ['GEMINI.md'],
+};
+
+export function compactRouterHost(root) {
+  try {
+    const agents = fs.readFileSync(path.join(root, 'AGENTS.md'), 'utf8');
+    return agents.match(COMPACT_ROUTER)?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export function isCompactRouterAgentsContent(text) {
+  return typeof text === 'string' && COMPACT_ROUTER.test(text);
+}
+
+function hasCompactHostRegistration(root, host) {
+  if (host === 'none') return fs.existsSync(path.join(root, '.mcp.json'));
+  const files = COMPACT_HOST_FILES[host];
+  return Boolean(files) && files.every((relativePath) => fs.existsSync(path.join(root, relativePath)));
+}
 
 export function hasArkWorkflow(root) {
   const workflowsDir = path.join(root, '.github', 'workflows');
@@ -141,9 +175,14 @@ export function hasArkWorkflow(root) {
 }
 
 export function missingGates(root) {
-  const missing = REQUIRED_GATE_FILES.filter(
-    (relativePath) => !fs.existsSync(path.join(root, relativePath))
-  );
+  const compactHost = compactRouterHost(root);
+  const required = compactHost
+    ? REQUIRED_GATE_FILES.filter((relativePath) => relativePath !== '.mcp.json')
+    : REQUIRED_GATE_FILES;
+  const missing = required.filter((relativePath) => !fs.existsSync(path.join(root, relativePath)));
+  if (compactHost && !hasCompactHostRegistration(root, compactHost)) {
+    missing.push(`compact host registration (${compactHost})`);
+  }
   if (!hasArkWorkflow(root)) missing.push(REQUIRED_GATE_WORKFLOW);
   return missing;
 }

package/bin/lib/graph-cycles.mjs

@@ -1,56 +1,6 @@
-/**
- * Import-graph cycle detection (Tarjan) for ark-check.
- * Extracted from ark-check entry (R3).
- */
-export function detectCycles(graph) {
-  let index = 0;
-  const indices = new Map();
-  const low = new Map();
-  const onStack = new Set();
-  const stack = [];
-  const components = [];
-
-  // ponytail: recursive Tarjan; make it iterative only if a real repo blows the stack.
-  const strongconnect = (v) => {
-    indices.set(v, index);
-    low.set(v, index);
-    index += 1;
-    stack.push(v);
-    onStack.add(v);
-    for (const w of [...(graph.get(v) ?? [])].sort()) {
-      if (!graph.has(w)) continue;
-      if (!indices.has(w)) {
-        strongconnect(w);
-        low.set(v, Math.min(low.get(v), low.get(w)));
-      } else if (onStack.has(w)) {
-        low.set(v, Math.min(low.get(v), indices.get(w)));
-      }
-    }
-    if (low.get(v) === indices.get(v)) {
-      const comp = [];
-      let w;
-      do {
-        w = stack.pop();
-        onStack.delete(w);
-        comp.push(w);
-      } while (w !== v);
-      if (comp.length > 1) components.push(comp.sort());
-    }
-  };
+/** Compatibility adapter; canonical Tarjan evaluation lives in the bundled Kernel engine. */
+import { detectArchitectureCycles } from './analysis-engine.mjs';
 
-  for (const v of [...graph.keys()].sort()) {
-    if (!indices.has(v)) strongconnect(v);
-  }
-
-  return components
-    .sort((a, b) => a[0].localeCompare(b[0]))
-    .map((members) => ({
-      ruleId: 'CIRCULAR_DEPENDENCY',
-      file: members[0],
-      line: 1,
-      target: members.join(' → '),
-      message: `Circular dependency among ${members.length} files: ${members.join(' → ')} → ${members[0]}.`,
-      // Graph is value/runtime edges only (type-only imports omitted).
-      cycleKind: 'value',
-    }));
+export function detectCycles(graph) {
+  return detectArchitectureCycles(graph);
 }

package/bin/lib/hook-templates.mjs

@@ -1,5 +1,5 @@
 /**
- * Host hook / MCP project templates for agent-gate install (Claude, Grok).
+ * Host hook / MCP project templates for agent-gate install (Claude, Grok, Codex).
  * Kept out of agent-gates.mjs so install orchestration stays scannable (explore gap #5).
  */
 import { execCommandParts, execRunner } from '../ark-shared.mjs';
@@ -41,6 +41,38 @@ export function claudeSettings(root) {
   }, null, 2)}\n`;
 }
 
+export function codexHooks(root) {
+  const runner = execRunner(root);
+  const codexRoot = '${CODEX_PROJECT_DIR:-${PWD:-.}}';
+  return `${JSON.stringify({
+    hooks: {
+      SessionStart: [
+        {
+          hooks: [
+            {
+              type: 'command',
+              timeout: 30,
+              command: `${runner} ${PREFERRED_MCP_BIN} --session-context --root "${codexRoot}" --config ark.config.json`,
+            },
+          ],
+        },
+      ],
+      PreToolUse: [
+        {
+          matcher: 'ApplyPatch|apply_patch|Write|Edit|MultiEdit',
+          hooks: [
+            {
+              type: 'command',
+              timeout: 30,
+              command: `${runner} ${PREFERRED_MCP_BIN} --hook --hook-repair --root "${codexRoot}" --config ark.config.json`,
+            },
+          ],
+        },
+      ],
+    },
+  }, null, 2)}\n`;
+}
+
 // Grok Build project config: MCP registration (commit-friendly relative paths — unlike
 // Codex's global config.toml, Grok loads .grok/config.toml from the project).
 export function grokProjectConfig(root) {

package/bin/lib/host-support-matrix.mjs

@@ -36,7 +36,13 @@ export const HOST_SUPPORT_MATRIX = Object.freeze({
     true
   ),
   cursor: hostProfile('Cursor', null, null, false, false),
-  codex: hostProfile('OpenAI Codex', null, null, false, false),
+  codex: hostProfile(
+    'OpenAI Codex',
+    '.codex/hooks.json',
+    'Best-effort PreToolUse `apply_patch`; Code Mode hosts may bypass the event',
+    false,
+    false
+  ),
 });
 
 export const HOST_SUPPORT_HOSTS = Object.freeze(Object.keys(HOST_SUPPORT_MATRIX));

package/bin/lib/install-migrate.mjs

@@ -20,12 +20,14 @@ import {
 import {
   PREFERRED_MCP_BIN,
   claudeSettings,
+  codexHooks,
   grokHooks,
   grokProjectConfig,
 } from './hook-templates.mjs';
 import {
   hasCheckArchitectureScript,
   ensureTypecheckScript,
+  compactRouterHost,
   writeTemplate,
 } from './gate-files.mjs';
 import {
@@ -36,6 +38,7 @@ import {
   detectCiNode,
   cursorRule,
   instructionRule,
+  compactAgentInstructions,
   codexTomlSnippet,
   arkCheckCommand,
   checkArchitectureScriptSnippet,
@@ -215,12 +218,21 @@ export function runInstallAgentGates(args) {
   }
   const pm = packageManager(root);
   const hasCheckScript = hasCheckArchitectureScript(root);
-  const { tools, source } = resolveTools(args);
+  const { tools, source } = args.compact && args.tools == null
+    ? { tools: new Set(), source: 'compact-none' }
+    : resolveTools(args);
+  if (args.compact && tools.size > 1) {
+    console.error('--compact accepts exactly one selected host. Pass --tools <host>.');
+    process.exitCode = 2;
+    return;
+  }
   const toolSource =
     source === 'explicit'
       ? 'from --tools'
       : source === 'detected'
         ? 'auto-detected from config dirs'
+        : source === 'compact-none'
+          ? 'no active host detected'
         : 'default set — no agent config dirs found';
   console.log(`Agent gates for: ${[...tools].sort().join(', ')} (${toolSource})`);
   const templates = [];
@@ -231,15 +243,21 @@ export function runInstallAgentGates(args) {
   // Do not mutate package.json under --skills-only (typecheck bootstrap is gates/CI).
   if (!args.skillsOnly) {
     // Bootstrap typecheck before CI template so generated workflow includes the step.
-    const typecheckBootstrap = ensureTypecheckScript(root, { write: true });
-    if (typecheckBootstrap.changed && !args.json) {
+    const typecheckBootstrap = ensureTypecheckScript(root, { write: !args.compact });
+    if (typecheckBootstrap.changed && !args.compact && !args.json) {
       console.log(
         `Added package.json script "typecheck": "${typecheckBootstrap.script}" (tsconfig present; local/CI parity).`
       );
     }
     // Base gates: tool-agnostic contract + CI backstop, always written.
-    templates.push(['AGENTS.md', agentInstructions(root)]);
-    templates.push(['.mcp.json', mcpJson(root)]);
+    const compactHost = args.compact ? [...tools][0] ?? null : null;
+    templates.push([
+      'AGENTS.md',
+      args.compact ? compactAgentInstructions(root, compactHost) : agentInstructions(root),
+    ]);
+    if (!args.compact || !compactHost || compactHost === 'claude') {
+      templates.push(['.mcp.json', mcpJson(root)]);
+    }
     templates.push([
       '.github/workflows/ark-check.yml',
       (() => {
@@ -252,13 +270,14 @@ export function runInstallAgentGates(args) {
     ]);
     if (tools.has('cursor')) {
       templates.push(['.cursor/mcp.json', mcpJson(root)]);
-      templates.push(['.cursor/rules/ark.mdc', cursorRule(root)]);
+      if (!args.compact) templates.push(['.cursor/rules/ark.mdc', cursorRule(root)]);
     }
     if (tools.has('claude')) {
       templates.push(['.claude/settings.json', claudeSettings(root)]);
     }
     if (tools.has('codex')) {
-      templates.push(['docs/ark-codex-config.toml', codexTomlSnippet(root)]);
+      templates.push(['.codex/hooks.json', codexHooks(root)]);
+      if (!args.compact) templates.push(['docs/ark-codex-config.toml', codexTomlSnippet(root)]);
     }
     if (tools.has('grok')) {
       templates.push(['.grok/config.toml', grokProjectConfig(root)]);
@@ -296,18 +315,37 @@ export function runInstallAgentGates(args) {
   const version = arkPackageVersion();
   const skills = skillTemplates().map(([name, content]) => [name, stampSkill(content, version)]);
   const skillPaths = new Set();
-  for (const tool of tools) {
-    const target = SKILL_TOOL_TARGETS[tool];
-    if (!target) continue;
-    for (const [name, content] of skills) {
-      const relativePath = target(name);
-      skillPaths.add(relativePath);
-      templates.push([relativePath, content]);
+  if (!args.compact) {
+    for (const tool of tools) {
+      const target = SKILL_TOOL_TARGETS[tool];
+      if (!target) continue;
+      for (const [name, content] of skills) {
+        const relativePath = target(name);
+        skillPaths.add(relativePath);
+        templates.push([relativePath, content]);
+      }
+    }
+  }
+
+  // A compact router can be moved back from an explicit host removal. Delete the
+  // generic MCP file only when it exactly matches Ark's generated artifact.
+  const priorCompactHost = compactRouterHost(root);
+  if (args.compact && priorCompactHost === 'none' && [...tools][0]) {
+    const genericMcp = path.join(root, '.mcp.json');
+    try {
+      if (fs.readFileSync(genericMcp, 'utf8') === mcpJson(root)) fs.rmSync(genericMcp);
+    } catch {
+      // Missing or customized user MCP configuration is deliberately retained.
     }
   }
 
   const results = templates.map(([relativePath, content]) =>
-    writeTemplate(root, relativePath, content, args.force)
+    writeTemplate(
+      root,
+      relativePath,
+      content,
+      args.force || (args.compact && relativePath === 'AGENTS.md' && priorCompactHost !== null)
+    )
   );
 
   console.log('Ark agent gate templates:');
@@ -397,7 +435,7 @@ export function runInstallAgentGates(args) {
   // developer's real config. A genuinely redirected CODEX_HOME or explicit
   // --codex-home still wires as requested.
   let codexMcp = null;
-  const wantCodexWire = tools.has('codex') || args.codexHome;
+  const wantCodexWire = !args.compact && (tools.has('codex') || args.codexHome);
   const skipHomeWire =
     wantCodexWire &&
     isTempOrUpgradeRoot(root) &&

package/bin/lib/presets.mjs

@@ -5,6 +5,7 @@ import {
   applyFrameworkLayoutOverlays,
   createElevenLayerConfig,
   DEFAULT_DOMAIN_FORBIDDEN_GLOBALS,
+  discoverRepoUnits,
   DEFAULT_INTENT_PREFIXES,
   resolveIncludeRoots,
 } from '../ark-shared.mjs';
@@ -203,12 +204,41 @@ export const ARCHITECTURE_PRESETS = {
   monorepo: (includeDirs, root) => {
     let include =
       includeDirs && includeDirs.length > 0 ? [...includeDirs] : [];
+    let units = [];
     if (root) {
       const resolved = resolveIncludeRoots(root);
       if (resolved.length > 0) include = resolved;
+      units = discoverRepoUnits(root);
+      const nonProductRoots = new Set(
+        units
+          .filter((unit) => ['docs', 'example', 'test'].includes(unit.role))
+          .map((unit) => unit.root)
+      );
+      include = include.filter((entry) => !nonProductRoots.has(entry));
     }
     // Turborepo: apps/ + packages/; Nx enterprise: apps/ + libs/ (+ packages/).
     if (include.length === 0) include = ['packages', 'apps', 'libs'];
+    // Established workspaces often have flat package source roots rather than a
+    // directory named domain/application. The package manifest supplies a real,
+    // reviewable role signal: a published library is a domain surface; an app or
+    // CLI package coordinates work. This is deliberately limited to package roots
+    // Ark already discovered, never a catch-all **/src/** fallback.
+    const packagePatterns = (roles) => {
+      if (!root) return [];
+      return units
+        .filter((unit) => roles.includes(unit.role))
+        .flatMap((unit) => unit.sourceRoots.map((sourceRoot) => {
+          const base = unit.root === '.'
+            ? sourceRoot
+            : sourceRoot === '.'
+              ? unit.root
+              : `${unit.root}/${sourceRoot}`;
+          return base === '.' ? null : `${base}/**`;
+        }))
+        .filter(Boolean);
+    };
+    const librarySourcePatterns = packagePatterns(['library']);
+    const applicationSourcePatterns = packagePatterns(['application', 'cli']);
     return presetWithOverlays(
       {
         include,
@@ -219,14 +249,24 @@ export const ARCHITECTURE_PRESETS = {
               'Pure business rules and entities, in any package. No I/O, no framework, no ambient globals.',
             // Domain by intentional folders only — NOT bare **/types.ts (that mis-classifies
             // application bags like frontend/src/core/**/types.ts as Domain and creates false edges).
-            patterns: ['**/domain/**', '**/entities/**', '**/cinematic/types.ts'],
+            patterns: [
+              '**/domain/**',
+              '**/entities/**',
+              '**/cinematic/types.ts',
+              ...librarySourcePatterns,
+            ],
             forbiddenGlobals: DEFAULT_DOMAIN_FORBIDDEN_GLOBALS,
             optional: true,
           },
           {
             name: 'ApplicationOrchestration',
             description: 'Use cases and services that coordinate the domain through ports.',
-            patterns: ['**/application/**', '**/use-cases/**', '**/services/**'],
+            patterns: [
+              '**/application/**',
+              '**/use-cases/**',
+              '**/services/**',
+              ...applicationSourcePatterns,
+            ],
             optional: true,
           },
           {

package/bin/lib/safety-diagnostics.mjs

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 
 import { globToRegExp } from '../ark-shared.mjs';
+import { extractSemanticDependencies } from './analysis-engine.mjs';
 import { lineOf } from './ast-scan.mjs';
 import { normalize } from './scan-files.mjs';
 
@@ -104,9 +105,26 @@ export function collectSafetyDiagnostics(ts, root, config, files) {
 
   for (const file of files) {
     const source = fs.readFileSync(file, 'utf8');
+    // Most source files cannot contain a safety finding. Avoid parsing a second AST when the
+    // lexical markers for every supported diagnostic are absent; a match only opts into the
+    // existing exact AST analysis, so this cannot suppress a finding.
+    if (!/@ts-(?:ignore|nocheck)\b|\bany\b|\b(?:import|require)\s*\(|\barkgate(?:\/runtime)?\b/.test(source)) {
+      continue;
+    }
     const sourceFile = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true);
     const relFile = normalize(path.relative(root, file));
 
+    if (!matchesAny(relFile, dynamicAllowlist)) {
+      for (const dependency of extractSemanticDependencies(ts, sourceFile)) {
+        if (!dependency.unresolved) continue;
+        report.nonLiteralDynamicImports.push({
+          file: relFile,
+          line: dependency.line,
+          kind: dependency.kind === 'require' ? 'require' : 'import',
+        });
+      }
+    }
+
     for (const position of tsSuppressionPositions(sourceFile, source)) {
       report.tsSuppressions.push({
         file: relFile,
@@ -146,23 +164,6 @@ export function collectSafetyDiagnostics(ts, root, config, files) {
         });
       }
 
-      if (ts.isCallExpression(node)) {
-        const dynamicImport = node.expression?.kind === ts.SyntaxKind.ImportKeyword;
-        const directRequire =
-          ts.isIdentifier(node.expression) && node.expression.text === 'require';
-        const argument = node.arguments[0];
-        const unresolved =
-          (dynamicImport || directRequire) &&
-          (!argument || !ts.isStringLiteralLike(argument));
-        if (unresolved && !matchesAny(relFile, dynamicAllowlist)) {
-          report.nonLiteralDynamicImports.push({
-            file: relFile,
-            line: lineOf(sourceFile, node.getStart(sourceFile)),
-            kind: directRequire ? 'require' : 'import',
-          });
-        }
-      }
-
       if (!allowInMemory && !isProvider && ts.isImportDeclaration(node)) {
         const specifier = node.moduleSpecifier;
         const fromArk = ts.isStringLiteralLike(specifier) && /^arkgate(?:\/runtime)?$/.test(specifier.text);

package/bin/lib/scan-files.mjs

@@ -12,7 +12,7 @@ export const SOURCE_FILE_NAME = /\.[cm]?[tj]sx?$/;
  *  to production code (*.spec.ts). Counting them as ungoverned forces false
  *  CONFIG_UNCLASSIFIED_FILES under --strict-config on every starter. */
 export const TEST_FILE_NAME =
-  /\.(spec|test)\.(tsx?|jsx?|mts|cts)$/i;
+  /(^test(?:[-_.]).*|\.(spec|test)(?:-d)?\.)(tsx?|jsx?|mjsx?|cjsx?|mts|cts)$/i;
 
 export function isGovernableSourceFile(name) {
   return SOURCE_FILE_NAME.test(name) && !name.endsWith('.d.ts') && !TEST_FILE_NAME.test(name);
@@ -23,6 +23,17 @@ export function isSkippedSourceDir(name) {
     name === 'node_modules' ||
     name === 'dist' ||
     name === 'coverage' ||
+    name === 'bench' ||
+    name === 'benches' ||
+    name === 'benchmark' ||
+    name === 'benchmarks' ||
+    name === 'docs' ||
+    name === 'documentation' ||
+    name === 'example' ||
+    name === 'examples' ||
+    name === 'fixture' ||
+    name === 'fixtures' ||
+    name === 'playground' ||
     name === '__tests__' ||
     name === '__mocks__' ||
     name === 'e2e' ||

package/bin/lib/skill-install.mjs

@@ -4,7 +4,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { codexPromptsDir } from './codex-home.mjs';
-import { __packageRoot, readJson } from './gate-files.mjs';
+import { __packageRoot, isCompactRouterAgentsContent, readJson } from './gate-files.mjs';
 
 export function normalizeToolsList(tools) {
   if (tools == null) return [];
@@ -284,6 +284,13 @@ export function detectCodexHomeGap(root) {
 
 export function detectSkillGaps(root) {
   if (!fs.existsSync(path.join(root, 'AGENTS.md'))) return [];
+  try {
+    if (isCompactRouterAgentsContent(fs.readFileSync(path.join(root, 'AGENTS.md'), 'utf8'))) {
+      return [];
+    }
+  } catch {
+    // Continue with the ordinary missing-skill detection below.
+  }
   // The Ark source tree keeps the skill templates at templates/skills/ — it's the
   // producer, not a consumer, so it must not nag itself to "install" its own skills.
   if (fs.existsSync(path.join(root, 'templates', 'skills'))) return [];

package/bin/lib/source-policy.mjs

@@ -0,0 +1,36 @@
+/**
+ * GENERATED FILE — do not edit by hand.
+ *
+ * Canonical algorithm: src/domain/sourcePolicy.ts
+ * Regenerate: node scripts/generate-cli-pure.mjs
+ * Drift check: node scripts/generate-cli-pure.mjs --check
+ *
+ * Pure CLI helper (bin/lib/source-policy.mjs). Zero Node I/O.
+ */
+
+export const SOURCE_POLICY_MESSAGES = {
+    RAW_EVENT_PUBLISH: 'Publish through a registered intent creator; raw event objects or intent strings bypass Ark contracts and tooling.',
+    PUBLISH_MISSING_SOURCE: 'Strict Ark publish calls must include metadata.source.',
+};
+export function looksLikeArkIntent(value) {
+    return /^(Domain|Application|Adapter|Workflow|Job|Presentation|Reporting|Metadata|Security|Audit|Observability|Kernel)\.[A-Za-z0-9_.]+$/.test(value);
+}
+export function classifyPublishFacts(facts) {
+    if (!facts.publishCall)
+        return [];
+    const findings = [];
+    if ((facts.rawIntentName !== undefined && looksLikeArkIntent(facts.rawIntentName)) ||
+        facts.objectHasIntent) {
+        findings.push({
+            ruleId: 'RAW_EVENT_PUBLISH',
+            message: SOURCE_POLICY_MESSAGES.RAW_EVENT_PUBLISH,
+        });
+    }
+    if (facts.arkPublishCandidate && !facts.hasSource) {
+        findings.push({
+            ruleId: 'PUBLISH_MISSING_SOURCE',
+            message: SOURCE_POLICY_MESSAGES.PUBLISH_MISSING_SOURCE,
+        });
+    }
+    return findings;
+}