ast-mcp-server 0.12.0 → 0.13.1

package/dist/services/runtime-policy.js

@@ -1,4 +1,5 @@
 import path from "node:path";
+import packageMetadata from "../../package.json" with { type: "json" };
 export const RUNTIME_POLICY_ENV_KEYS = Object.freeze([
     "AST_MAX_PROJECT_SESSIONS",
     "AST_MAX_QUEUED_OPERATIONS_PER_PROJECT",
@@ -7,6 +8,8 @@ export const RUNTIME_POLICY_ENV_KEYS = Object.freeze([
     "AST_SHUTDOWN_DRAIN_TIMEOUT_MS",
     "AST_COMPILER_WORKER_MODE",
     "AST_COMPILER_WORKER_IDLE_TTL_MS",
+    "AST_MCP_APPLY_GUARD",
+    "AST_MCP_TEXT_PROJECTION",
 ]);
 function parseBoundedInteger(rawValue, defaultValue, minimum, maximum) {
     if (rawValue === undefined)
@@ -26,8 +29,8 @@ function parseBoundedInteger(rawValue, defaultValue, minimum, maximum) {
 export function parseRuntimePolicy(environment) {
     const maxProjectSessions = parseBoundedInteger(environment.AST_MAX_PROJECT_SESSIONS, 8, 1, 32);
     const maxQueuedOperationsPerProject = parseBoundedInteger(environment.AST_MAX_QUEUED_OPERATIONS_PER_PROJECT, 32, 1, 256);
-    const queueWaitTimeoutMs = parseBoundedInteger(environment.AST_QUEUE_WAIT_TIMEOUT_MS, 30_000, 100, 300_000);
-    const operationDeadlineMs = parseBoundedInteger(environment.AST_OPERATION_DEADLINE_MS, 120_000, 1_000, 900_000);
+    const queueWaitTimeoutMs = parseBoundedInteger(environment.AST_QUEUE_WAIT_TIMEOUT_MS, packageMetadata.deepseekHarness.timeoutBudget.queueWaitMs, 100, 300_000);
+    const operationDeadlineMs = parseBoundedInteger(environment.AST_OPERATION_DEADLINE_MS, packageMetadata.deepseekHarness.timeoutBudget.executionDeadlineMs, 1_000, 900_000);
     const shutdownDrainTimeoutMs = parseBoundedInteger(environment.AST_SHUTDOWN_DRAIN_TIMEOUT_MS, 10_000, 100, 60_000);
     const rawWorkerMode = environment.AST_COMPILER_WORKER_MODE;
     const compilerWorkerMode = rawWorkerMode === "supervised" ? "supervised" : "in_process";
@@ -37,6 +40,22 @@ export function parseRuntimePolicy(environment) {
             ? "configured"
             : "invalid_mode";
     const compilerWorkerIdleTtlMs = parseBoundedInteger(environment.AST_COMPILER_WORKER_IDLE_TTL_MS, 60_000, 0, 86_400_000);
+    const rawApplyGuard = environment.AST_MCP_APPLY_GUARD;
+    // Fail-closed: only an explicit `allow` permits the apply-effect MCP tool on
+    // this surface. A missing value, `deny`, or any invalid value denies apply.
+    const denyApply = rawApplyGuard !== "allow";
+    const applyGuardReason = rawApplyGuard === undefined
+        ? "default"
+        : rawApplyGuard === "allow" || rawApplyGuard === "deny"
+            ? "configured"
+            : "invalid_mode";
+    const rawTextProjection = environment.AST_MCP_TEXT_PROJECTION;
+    const projectStructuredContentAsText = rawTextProjection === "canonical_json";
+    const textProjectionReason = rawTextProjection === undefined
+        ? "default"
+        : projectStructuredContentAsText
+            ? "configured"
+            : "invalid_mode";
     const reasons = Object.freeze({
         AST_MAX_PROJECT_SESSIONS: maxProjectSessions.reason,
         AST_MAX_QUEUED_OPERATIONS_PER_PROJECT: maxQueuedOperationsPerProject.reason,
@@ -45,6 +64,8 @@ export function parseRuntimePolicy(environment) {
         AST_SHUTDOWN_DRAIN_TIMEOUT_MS: shutdownDrainTimeoutMs.reason,
         AST_COMPILER_WORKER_MODE: compilerWorkerModeReason,
         AST_COMPILER_WORKER_IDLE_TTL_MS: compilerWorkerIdleTtlMs.reason,
+        AST_MCP_APPLY_GUARD: applyGuardReason,
+        AST_MCP_TEXT_PROJECTION: textProjectionReason,
     });
     return Object.freeze({
         maxProjectSessions: maxProjectSessions.value,
@@ -54,6 +75,8 @@ export function parseRuntimePolicy(environment) {
         shutdownDrainTimeoutMs: shutdownDrainTimeoutMs.value,
         compilerWorkerMode,
         compilerWorkerIdleTtlMs: compilerWorkerIdleTtlMs.value,
+        denyApply,
+        projectStructuredContentAsText,
         reasons,
     });
 }
@@ -64,6 +87,46 @@ const WORKER_ENV_KEYS = [
     "AST_SYMBOL_INDEX_BUSY_TIMEOUT_MS",
 ];
 const MAX_WORKER_ENV_VALUE_LENGTH = 4096;
+function parseClosedFixtureRecord(raw, expectedKeys) {
+    if (typeof raw !== "string" || raw.length > 1024 || raw.includes("\0"))
+        return undefined;
+    try {
+        const value = JSON.parse(raw);
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return undefined;
+        const record = value;
+        return Object.keys(record).sort().join(",") === expectedKeys ? record : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function parseH03FixtureDescriptor(raw) {
+    const record = parseClosedFixtureRecord(raw, "controlDirectory,generation,nonce");
+    if (!record)
+        return undefined;
+    const { controlDirectory, nonce, generation } = record;
+    if (typeof controlDirectory !== "string" ||
+        controlDirectory.length > MAX_WORKER_ENV_VALUE_LENGTH ||
+        !path.isAbsolute(controlDirectory) ||
+        path.normalize(controlDirectory) !== controlDirectory ||
+        typeof nonce !== "string" ||
+        !/^[A-Za-z0-9_-]{16,64}$/.test(nonce) ||
+        !Number.isSafeInteger(generation) ||
+        generation < 1)
+        return undefined;
+    return Object.freeze({ controlDirectory, nonce, generation: generation });
+}
+export function parseH05FixtureDescriptor(raw) {
+    const record = parseClosedFixtureRecord(raw, "controlDirectory,generation,nonce,ownerToken");
+    if (!record)
+        return undefined;
+    const { ownerToken, ...baseValue } = record;
+    if (typeof ownerToken !== "string" || !/^[A-Za-z0-9_-]{16,64}$/.test(ownerToken))
+        return undefined;
+    const base = parseH03FixtureDescriptor(JSON.stringify(baseValue));
+    return base ? Object.freeze({ ...base, ownerToken }) : undefined;
+}
 function validEnvironmentString(value) {
     return (typeof value === "string" &&
         value.length <= MAX_WORKER_ENV_VALUE_LENGTH &&
@@ -88,6 +151,20 @@ export function createCompilerWorkerSpawnSpec(workerEntryPath, environment) {
         }
         projected[key] = value;
     }
+    const fixture = environment.AST_H03_FIXTURE;
+    if (fixture !== undefined) {
+        const descriptor = parseH03FixtureDescriptor(fixture);
+        if (!descriptor)
+            return { ok: false, reason: "invalid_environment" };
+        projected.AST_H03_FIXTURE = JSON.stringify(descriptor);
+    }
+    const lifecycleFixture = environment.AST_H05_FIXTURE;
+    if (lifecycleFixture !== undefined) {
+        const descriptor = parseH05FixtureDescriptor(lifecycleFixture);
+        if (!descriptor)
+            return { ok: false, reason: "invalid_environment" };
+        projected.AST_H05_FIXTURE = JSON.stringify(descriptor);
+    }
     const policy = parseRuntimePolicy(environment);
     Object.assign(projected, {
         AST_MAX_PROJECT_SESSIONS: String(policy.maxProjectSessions),
@@ -95,6 +172,10 @@ export function createCompilerWorkerSpawnSpec(workerEntryPath, environment) {
         AST_QUEUE_WAIT_TIMEOUT_MS: String(policy.queueWaitTimeoutMs),
         AST_OPERATION_DEADLINE_MS: String(policy.operationDeadlineMs),
         AST_SHUTDOWN_DRAIN_TIMEOUT_MS: String(policy.shutdownDrainTimeoutMs),
+        // Forward the parent's resolved apply-guard policy so the supervised worker
+        // registers the same tool surface (deny-by-default fail-closed, allow opt-in).
+        AST_MCP_APPLY_GUARD: policy.denyApply ? "deny" : "allow",
+        ...(policy.projectStructuredContentAsText ? { AST_MCP_TEXT_PROJECTION: "canonical_json" } : {}),
     });
     return {
         ok: true,

package/dist/tools/catalog.js

@@ -54,9 +54,12 @@ export function defineToolCatalog(input) {
             apply: names((item) => item.effect === "apply"),
         }),
         directToon: names((item) => item.directOutputFormats.length === 2),
-        registerAll(server) {
-            for (const descriptor of descriptors)
+        registerAll(server, options = {}) {
+            for (const descriptor of descriptors) {
+                if (options.denyApply === true && descriptor.effect === "apply")
+                    continue;
                 descriptor.register(server);
+            }
         },
     });
 }

package/dist/tools/explore.js

@@ -17,7 +17,7 @@ const CallSpinesInputSchema = z.object({
     max_nodes: z.number().int().min(1).max(MAX_IMPACT_NODES).default(DEFAULT_IMPACT_MAX_NODES),
     max_edges: z.number().int().min(1).max(MAX_IMPACT_EDGES).default(DEFAULT_IMPACT_MAX_EDGES),
 });
-const ExploreInputSchema = z
+const ExploreInputObjectSchema = z
     .object({
     project_root: z
         .string()
@@ -65,7 +65,8 @@ const ExploreInputSchema = z
         .default(EXPLORE_DEFAULT_OMISSION_DETAIL_LIMIT)
         .describe("Maximum deterministic omission detail records; exact counts are always retained."),
 })
-    .refine((input) => Boolean(input.query || input.file_path), {
+    .strip();
+const ExploreInputSchema = ExploreInputObjectSchema.refine((input) => Boolean(input.query || input.file_path), {
     message: "Provide query, file_path, or both file_path and symbol_path.",
     path: ["query"],
 })
@@ -204,7 +205,7 @@ export function registerExplore(server) {
     server.registerTool(TOOL_NAME, {
         title: "Explore project context",
         description: "Composes bounded structural search, exact selectors, source evidence and compiler references without weakening the primitive AST tools. Returns bounded session freshness metadata for fresh, pending, stale, rebuilding or degraded state.",
-        inputSchema: ExploreInputSchema,
+        inputSchema: ExploreInputObjectSchema,
         outputSchema: ExploreOutputSchema,
         annotations: {
             readOnlyHint: true,
@@ -215,6 +216,7 @@ export function registerExplore(server) {
     }, async ({ project_root, query, file_path, symbol_path, kinds, file_filter, detail, include_source, include_references, reference_detail, reference_limit, offset, limit, max_bytes, call_spines, omission_detail_limit, }, extra) => {
         const requestContext = createRequestContext(extra.signal);
         try {
+            ExploreInputSchema.parse({ project_root, query, file_path, symbol_path, call_spines });
             const output = await withProject(project_root, (context, operationContext) => buildExploreContext(context, {
                 query,
                 filePath: file_path,

package/dist/tools/get_impact.js

@@ -73,7 +73,6 @@ export function registerGetImpact(server) {
         title: "Get bounded compiler-backed impact",
         description: "Traverses exact compiler-backed relationships around a symbol with explicit direction, depth, node and edge budgets. Returns bounded session freshness metadata and fails closed when exact relationships are not fresh. Read-only evidence only; it never prepares or applies mutations.",
         inputSchema: AstGetImpactInputSchema,
-        outputSchema: ImpactOutputSchema,
         annotations: {
             readOnlyHint: true,
             destructiveHint: false,

package/dist/tools/result.js

@@ -2,10 +2,15 @@ import { Buffer } from "node:buffer";
 import { isDeepStrictEqual } from "node:util";
 import { decode, encode } from "@toon-format/toon";
 import { z } from "zod";
+import { COMPILER_WORKER_MAX_RESULT_BYTES, fitsCompilerWorkerResponseResult, } from "../services/compiler-worker-protocol.js";
 import { createProjectIdentity } from "../services/project-status.js";
 import { renderPublicError } from "../services/public-errors.js";
 import { emitToolFailureEvent } from "../services/runtime-logger.js";
 export const MAX_TOON_RESULT_BYTES = 10 * 1024 * 1024;
+// Leave room for the unchanged structured value plus JSON-RPC framing under
+// the supervised worker's 256 KiB line limit.
+export const MAX_TEXT_PROJECTION_BYTES = 112 * 1024;
+export const MAX_PROJECTED_RESULT_BYTES = COMPILER_WORKER_MAX_RESULT_BYTES;
 export const ToolOutputFormatSchema = z.enum(["json", "toon"]).default("json");
 export const ToolOutputFormatInputSchema = {
     output_format: ToolOutputFormatSchema.describe("Result representation. TOON wraps one compact encoded value in structuredContent."),
@@ -24,6 +29,49 @@ export function createToolErrorContext(toolName, projectRoot) {
         return { toolName };
     }
 }
+/**
+ * Add a deterministic model-visible JSON projection without replacing the
+ * canonical structured value. Existing content wins, and oversized values get
+ * an explicit bounded marker when the complete framed result has room for it;
+ * otherwise the unchanged structured-only result remains authoritative.
+ */
+export function projectStructuredContentAsText(result, enabled, maxBytes = MAX_TEXT_PROJECTION_BYTES) {
+    if (!enabled ||
+        result.isError === true ||
+        result.content.length > 0 ||
+        result.structuredContent === undefined) {
+        return result;
+    }
+    let text;
+    try {
+        text =
+            JSON.stringify(result.structuredContent) ??
+                "(structured result is not JSON-serializable for model-visible projection)";
+    }
+    catch {
+        text = "(structured result is not JSON-serializable for model-visible projection)";
+    }
+    const byteLength = Buffer.byteLength(text, "utf8");
+    if (byteLength > maxBytes) {
+        text = `(structured result exceeds the ${maxBytes}-byte model-visible projection limit; canonical structuredContent remains available)`;
+    }
+    let projected = {
+        ...result,
+        content: [{ type: "text", text }],
+    };
+    if (fitsCompilerWorkerResponseResult(projected))
+        return projected;
+    projected = {
+        ...result,
+        content: [
+            {
+                type: "text",
+                text: `(structured result exceeds the ${MAX_PROJECTED_RESULT_BYTES}-byte complete projection limit; canonical structuredContent remains available)`,
+            },
+        ],
+    };
+    return fitsCompilerWorkerResponseResult(projected) ? projected : result;
+}
 export function structuredResult(structuredContent) {
     return { content: [], structuredContent };
 }

package/dist/worker-runtime.js

@@ -14,11 +14,16 @@ export async function runStdioServer(options = {}) {
     prepareProjectRuntimeForStartup();
     const runtimeActivity = options.runtimeActivity ?? new RuntimeActivityTracker();
     runtimeActivity.prepareForStartup();
-    const server = options.server ?? createServer({ runtimeActivity });
+    const runtimePolicy = options.runtimePolicy ?? readRuntimePolicy();
+    const server = options.server ??
+        createServer({
+            runtimeActivity,
+            denyApply: runtimePolicy.denyApply,
+            projectStructuredContentAsText: runtimePolicy.projectStructuredContentAsText,
+        });
     const transport = options.transport ?? new StdioServerTransport();
     const send = transport.send.bind(transport);
     transport.send = (message, sendOptions) => runtimeActivity.trackSend(() => send(message, sendOptions));
-    const runtimePolicy = options.runtimePolicy ?? readRuntimePolicy();
     const installProcessHandlers = options.installProcessHandlers ?? true;
     const exit = options.exit ?? ((code) => process.exit(code));
     const protocol = server.server;

package/docs/support.md

@@ -1,20 +1,20 @@
 # Support policy
 
-This document defines the supported platform, runtime, persistence, and operational boundary for published `ast-mcp-server` v0.11.2 and the local `0.12.0` release candidate.
+This document defines the supported platform, runtime, persistence, and operational boundary for published `ast-mcp-server` v0.12.0.
 
 ## Supported release target
 
 | Environment                                                                   | Status      | Contract                                                                                      |
 | ----------------------------------------------------------------------------- | ----------- | --------------------------------------------------------------------------------------------- |
 | Linux x64 with required GNU coreutils and procfs, Node.js 22.5.0              | Historical  | Immutable v0.8.1 release evidence; not the runtime floor of the published or candidate lines. |
-| Linux x64 with required GNU coreutils and procfs, exact Node.js 22.13.0       | Supported   | Published v0.11.2 and local 0.12.0 matrices, each bound to its own package and tree bytes.    |
-| Linux x64 with required GNU coreutils and procfs, current Node.js 24 line     | Supported   | Published v0.11.2 and local 0.12.0 matrices, each bound to its own package and tree bytes.    |
+| Linux x64 with required GNU coreutils and procfs, exact Node.js 22.13.0       | Supported   | Published v0.12.0 matrix bound to its immutable package and tree bytes.                       |
+| Linux x64 with required GNU coreutils and procfs, current Node.js 24 line     | Supported   | Published v0.12.0 matrix bound to its immutable package and tree bytes.                       |
 | Other Linux architectures or systems without the required filesystem features | Unverified  | Not supported until equivalent architecture, mutation, and filesystem-publication gates pass. |
 | macOS                                                                         | Unverified  | Not supported until equivalent filesystem, process, package, mutation, and canary gates pass. |
 | Windows                                                                       | Unverified  | Not supported until equivalent filesystem, process, package, mutation, and canary gates pass. |
 | Remote, untrusted, or multi-tenant service use                                | Unsupported | No network authentication, sandbox, or tenant-isolation boundary is provided.                 |
 
-The local `0.12.0` release candidate requires Node.js `>=22.13.0`; its matrix targets exact Node.js 22.13.0 and the governed Node.js 24 major. Published v0.11.2 retains its immutable `>=22.13.0` metadata and exact Node.js 22.13.0/24 release evidence. The earlier v0.8.1 Node.js 22.5.0/24 matrix remains historical evidence for those bytes only. A future runtime satisfying an engine range is not automatically a verified release target.
+Published v0.12.0 requires Node.js `>=22.13.0`; its immutable matrix targets exact Node.js 22.13.0 and the governed Node.js 24 major. The earlier v0.8.1 Node.js 22.5.0/24 matrix remains historical evidence for those bytes only. A future runtime satisfying an engine range is not automatically a verified release target.
 
 The checked-evidence freezer requires GNU coreutils 9.7 `mv` with `--update=none-fail`, `--no-copy`, and `--no-target-directory`. Managed setup-file mutation additionally requires that same `mv` with `--exchange`, GNU coreutils `ln -L -T`, procfs descriptor paths at `/proc/self/fd`, `O_DIRECTORY`, and `O_NOFOLLOW`. It fails closed when any verified Linux primitive is unavailable. Equivalent publication, exchange, descriptor-link, and descriptor-relative mutation semantics have not been verified on other operating systems or architectures.
 
@@ -50,7 +50,7 @@ The scoped Linux evidence passed on exact Node.js 22.13.0 and the governed Node.
 
 ## Symbol-index persistence
 
-Published v0.11.2 and the local `0.12.0` release candidate select native SQLite when the persistence setting is absent or explicitly `enabled`; operators requiring no persistent index state must set `disabled` explicitly:
+Published v0.12.0 selects native SQLite when the persistence setting is absent or explicitly `enabled`; operators requiring no persistent index state must set `disabled` explicitly:
 
 ```bash
 AST_SYMBOL_INDEX_PERSISTENCE=disabled \
@@ -76,11 +76,11 @@ ast-tool cache inspect
 ast-tool cache clear --yes
 ```
 
-Both commands are bounded and path-free. Clear preflights the tree, refuses unsafe or active SQLite artifacts, rechecks identity before unlink and preserves unknown regular files/directories. There is no automatic garbage collection in this candidate.
+Both commands are bounded and path-free. Clear preflights the tree, refuses unsafe or active SQLite artifacts, rechecks identity before unlink and preserves unknown regular files/directories. There is no automatic garbage collection in this release.
 
 ## Production-readiness acceptance
 
-The four retained Linux x64 production-readiness reports cover `ast-mcp-server` and `x-scraper` under Node.js 22.5.0 and Node.js 24 for package version 0.6.0, commit `2d0b21bbb80fae1acfca6a85d5891d87e68b59c1`, and tree `af931d49769fabdf06f623965a6cfe1f9afb8a81`. They are historical integration evidence only: they are not reattributed to v0.8.1, published-next v0.9.0 or v0.9.1, the local 0.9.2 candidate, published v0.10.0, published-next v0.11.0 or v0.11.1, published v0.11.2, or the local v0.12.0 release candidate. The exact 0.9.0 and 0.9.1 release matrices remain historical evidence for their immutable published-next bytes, the exact 0.9.2 matrix remains historical local-candidate evidence, the exact 0.10.0 matrix remains historical published-release evidence, the exact 0.11.0 and 0.11.1 matrices remain historical evidence for their immutable published-next bytes before public-registry verification exposed their distinct verifier defects, and the exact 0.11.2 matrix remains historical published-release evidence. A separate exact 0.12.0 release matrix is the release-candidate gate for current repository bytes under both supported runtime lines, including bounded diagnostic aggregates, catalog-derived tool capability projections, and their independent release oracles; none of these matrices rebinds the older retained reports. MCP-PROD-404 remains normative for admission:
+The four retained Linux x64 production-readiness reports cover `ast-mcp-server` and `x-scraper` under Node.js 22.5.0 and Node.js 24 for package version 0.6.0, commit `2d0b21bbb80fae1acfca6a85d5891d87e68b59c1`, and tree `af931d49769fabdf06f623965a6cfe1f9afb8a81`. They are historical integration evidence only: they are not reattributed to v0.8.1, published-next v0.9.0 or v0.9.1, the local 0.9.2 candidate, published v0.10.0, published-next v0.11.0 or v0.11.1, published v0.11.2, or published v0.12.0. The exact 0.9.0 and 0.9.1 release matrices remain historical evidence for their immutable published-next bytes, the exact 0.9.2 matrix remains historical local-candidate evidence, the exact 0.10.0 matrix remains historical published-release evidence, the exact 0.11.0 and 0.11.1 matrices remain historical evidence for their immutable published-next bytes before public-registry verification exposed their distinct verifier defects, and the exact 0.11.2 matrix remains historical published-release evidence. The exact 0.12.0 matrix is current published-release evidence under both supported runtime lines, including bounded diagnostic aggregates, catalog-derived tool capability projections, and their independent release oracles; none of these matrices rebinds the older retained reports. MCP-PROD-404 remains normative for admission:
 
 - zero semantic mismatches across disabled, cold, warm, restart, and rollback reads;
 - byte-identical real-repository status and worktree trees;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ast-mcp-server",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "description": "Structural code MCP server and batch CLI for compact TypeScript/JavaScript reads and hash-bound AST edits.",
   "keywords": [
     "mcp",
@@ -26,6 +26,22 @@
   },
   "type": "module",
   "packageManager": "yarn@4.15.0",
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "deepseekHarness": {
+    "revision": "cd5ef8148158c3a752a658978873241fdf8e2bbc",
+    "tag": "dsh-v0.1.2-alpha.1",
+    "mcpClientVersion": "0.1.2-alpha.1",
+    "timeoutBudget": {
+      "queueWaitMs": 30000,
+      "executionDeadlineMs": 120000,
+      "marginMs": 15000,
+      "outerToolCallMs": 180000
+    }
+  },
   "main": "dist/index.js",
   "bin": {
     "ast-mcp-server": "dist/index.js",
@@ -34,6 +50,7 @@
   "files": [
     "dist",
     "skills",
+    "cordis.patch.yml",
     "README.md",
     "CHANGELOG.md",
     "SECURITY.md",
@@ -56,6 +73,7 @@
     "test:cli": "yarn build && node scripts/cli-smoke.mjs",
     "test:errors": "yarn build && node scripts/public-error-smoke.mjs",
     "test:package": "node scripts/package-smoke.mjs",
+    "test:dsh-adapter": "node scripts/dsh-adapter-smoke.mjs",
     "test:local-registry": "node scripts/local-registry-consumer-smoke.mjs",
     "test:installed-agents": "yarn build && node scripts/installed-agent-guidance-smoke.mjs",
     "test:agent-fixtures": "node scripts/admit-agent-fixtures.mjs --check",
@@ -95,7 +113,8 @@
     "prettier": "^3.9.6",
     "typescript": "^5.6.0",
     "typescript-eslint": "^8.65.0",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.10",
+    "yaml": "^2.9.0"
   },
-  "gitHead": "3991d0a74e672c6c4d3fbd1c8bbb1a60009515ec"
+  "gitHead": "27b80a3da169b473a3b5c5dfea69ed52903ed4c7"
 }

package/skills/structural-code-editing/SKILL.md

@@ -18,7 +18,7 @@ Cargar este skill antes de navegar semánticamente, analizar impacto o referenci
 
 No forzar un roundtrip AST para Markdown, configuración, comentarios ni una edición textual trivial en un archivo ya conocido. Si las tools `ast_*` no están disponibles, declarar el fallback y no presentar búsquedas textuales como evidencia compiler-backed.
 
-The local 0.12.0 release candidate requires Node.js `>=22.13.0` and is verified with exact Node.js 22.13.0 plus the governed Node.js 24 line. Published v0.11.2 retains its immutable Node.js 22.13.0/24 release evidence.
+Published v0.12.0 requires Node.js `>=22.13.0` and retains immutable release evidence from exact Node.js 22.13.0 plus the governed Node.js 24 line.
 
 ## Hard Rules
 

package/skills/structural-code-editing/releases.json

@@ -6,7 +6,7 @@
     "files": [
       {
         "path": "SKILL.md",
-        "sha256": "d0048ffd9a585d00791540c6fa5e0bec91ff95b1448479678f85702e6b09be8a"
+        "sha256": "df2ebc3f3903cf5abf4eb6612da527cad97a92f29f1a9a475ea6e8b4cf47abfb"
       },
       {
         "path": "references/operations.md",
@@ -94,6 +94,11 @@
       "version": "4.5.0",
       "sha256": "18132b4b747d135e4ccfbca9e2190a9afb41e144cc06c31c5e6bc0f1571e11da",
       "npm_versions": ["0.11.2"]
+    },
+    {
+      "version": "4.6.0",
+      "sha256": "d0048ffd9a585d00791540c6fa5e0bec91ff95b1448479678f85702e6b09be8a",
+      "npm_versions": ["0.12.0"]
     }
   ]
 }