atris 3.16.0 → 3.17.0

package/commands/verify.js

@@ -1,6 +1,7 @@
 const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
+const escapeRegExp = require('../lib/escape-regexp');
 
 /**
  * atris verify [task] - Validate work is actually done
@@ -354,7 +355,8 @@ function checkDocsVsChanges(cwd, atrisDir) {
  */
 function findTaskInContent(content, taskId) {
   // Try exact ID match (T1, T2, etc.)
-  const idPattern = new RegExp(`### (T${taskId}|Task ${taskId})[:\\s]([\\s\\S]*?)(?=\\n###|\\n##|$)`, 'i');
+  const safeId = escapeRegExp(taskId);
+  const idPattern = new RegExp(`### (T${safeId}|Task ${safeId})[:\\s]([\\s\\S]*?)(?=\\n###|\\n##|$)`, 'i');
   let match = content.match(idPattern);
 
   if (match) {
@@ -506,7 +508,7 @@ function verifyRubric(slug, section, opts = {}) {
   const content = fs.readFileSync(validateFile, 'utf8');
   // Match "## <section>" (case-insensitive, anchored), skipping optional
   // prose until the first ```bash or ```sh fence. Extract until the closing ```.
-  const escaped = section.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const escaped = escapeRegExp(section);
   const pattern = new RegExp(
     `^##\\s+${escaped}\\s*$[\\s\\S]*?\\n\`\`\`(?:bash|sh)?\\s*\\n([\\s\\S]*?)\\n\`\`\``,
     'mi'
@@ -531,5 +533,7 @@ function verifyRubric(slug, section, opts = {}) {
 
 module.exports = {
   verifyAtris,
-  verifyRubric
+  verifyRubric,
+  findTaskInContent,
+  escapeRegExp
 };

package/lib/activity-stream.js

@@ -0,0 +1,166 @@
+'use strict';
+
+// Activity stream: normalize the workspace's receipt channels into ONE
+// time-ordered feed of what the agent actually did, plus a heartbeat summary.
+// The task board shows a static inventory of tasks; this turns the same data
+// into "what happened, in order" — the stream you watch for hours.
+
+const TS_KEYS = ['ts', 'at', 'created_at', 'accepted_at', 'timestamp', 'updated_at'];
+
+function pickTs(row) {
+  for (const k of TS_KEYS) {
+    if (row && row[k]) {
+      const ms = Date.parse(row[k]);
+      if (Number.isFinite(ms)) return { iso: String(row[k]), ms };
+    }
+  }
+  return { iso: null, ms: 0 };
+}
+
+function clip(value, n = 100) {
+  const t = String(value == null ? '' : value).replace(/\s+/g, ' ').trim();
+  return t.length > n ? `${t.slice(0, n - 1)}…` : t;
+}
+
+function num(v) {
+  return v == null || v === '' || Number.isNaN(Number(v)) ? null : Number(v);
+}
+
+// --- per-channel normalizers (each returns a uniform event or null) ---
+
+function normalizePulse(row) {
+  if (!row || row.phase !== 'finished') return null; // only completed ticks are events
+  const { iso, ms } = pickTs(row);
+  const reward = num(row.reward);
+  return {
+    ts: iso, ms,
+    source: 'pulse',
+    kind: row.actor === 'autopilot' ? 'autopilot' : 'heartbeat',
+    title: clip(row.what || `pulse tick #${row.tick_index}`),
+    detail: row.verify_passed == null ? '' : (row.verify_passed ? 'verify pass' : 'verify FAIL'),
+    status: row.verify_passed === false ? 'bad' : (reward > 0 ? 'good' : 'neutral'),
+    reward,
+  };
+}
+
+function normalizeScorecard(row) {
+  if (!row) return null;
+  const { iso, ms } = pickTs(row);
+  const reward = num(row.reward);
+  return {
+    ts: iso, ms,
+    source: 'reward',
+    kind: row.source || row.member || 'tick',
+    title: clip(row.what_shipped || 'tick scored'),
+    detail: reward == null ? '' : `reward ${reward}`,
+    status: reward != null && reward > 0 ? 'good' : (reward != null && reward < 0 ? 'bad' : 'neutral'),
+    reward,
+  };
+}
+
+function normalizeTaskEpisode(row) {
+  if (!row) return null;
+  const { iso, ms } = pickTs(row);
+  const state = row.state || {};
+  const action = row.action || state.status || 'updated';
+  const reward = num(row.reward);
+  return {
+    ts: iso, ms,
+    source: 'task',
+    kind: state.status || action,
+    title: clip(state.title || row.task_id),
+    detail: row.lesson ? clip(`lesson: ${row.lesson}`, 70) : clip(action, 24),
+    status: reward != null && reward < 0 ? 'bad' : (state.status === 'review' ? 'review' : 'neutral'),
+    reward,
+  };
+}
+
+function normalizeXp(row) {
+  if (!row) return null;
+  const { iso, ms } = pickTs(row);
+  return {
+    ts: iso, ms,
+    source: 'xp',
+    kind: row.outcome || 'accepted',
+    title: clip(row.title || 'work accepted'),
+    detail: `+${row.xp || 0} XP${row.actor ? ` · ${row.actor}` : ''}`,
+    status: 'good',
+    reward: num(row.reward),
+  };
+}
+
+function normalizeMissionEvent(row) {
+  if (!row) return null;
+  const { iso, ms } = pickTs(row);
+  const type = row.type || 'event';
+  const p = row.payload || {};
+  return {
+    ts: iso, ms,
+    source: 'mission',
+    kind: type,
+    title: clip(p.summary || p.objective || p.reason || p.next_action || type),
+    detail: clip(row.actor || '', 24),
+    status: /error|fail|halt|stop|paused/i.test(type) ? 'bad' : 'neutral',
+    reward: null,
+  };
+}
+
+// --- the feed ---
+
+function buildActivityStream(sources = {}, opts = {}) {
+  const limit = opts.limit || 60;
+  const events = [];
+  const push = (rows, fn) => {
+    for (const r of rows || []) {
+      const e = fn(r);
+      if (e && e.ms) events.push(e);
+    }
+  };
+  push(sources.pulseReceipts, normalizePulse);
+  push(sources.scorecards, normalizeScorecard);
+  push(sources.taskEpisodes, normalizeTaskEpisode);
+  push(sources.xpReceipts, normalizeXp);
+  push(sources.missionEvents, normalizeMissionEvent);
+  events.sort((a, b) => (b.ms - a.ms) || a.source.localeCompare(b.source)); // newest first, stable
+  return events.slice(0, limit);
+}
+
+// --- heartbeat: is the agent alive, and what did it just do ---
+
+function buildHeartbeat(pulseReceipts, now = Date.now()) {
+  const { summarizePulse } = require('./pulse');
+  const s = summarizePulse(pulseReceipts || [], now);
+  const lastMs = s.last_tick_ts ? Date.parse(s.last_tick_ts) : null;
+  const ageMin = Number.isFinite(lastMs) ? Math.max(0, Math.round((now - lastMs) / 60000)) : null;
+  const finished = (pulseReceipts || []).filter((r) => r && r.phase === 'finished');
+  const last = finished.length ? finished[finished.length - 1] : null;
+  let state = 'idle';
+  if (s.stale.stale) state = 'stale';
+  else if (s.total_ticks > 0) state = 'alive';
+  return {
+    state, // 'alive' | 'stale' | 'idle'
+    alive: state === 'alive',
+    stale_reason: s.stale.stale ? s.stale.reason : null,
+    last_tick_ts: s.last_tick_ts,
+    last_tick_age_min: ageMin,
+    last_what: last ? last.what : null,
+    last_reward: last ? num(last.reward) : null,
+    total_ticks: s.total_ticks,
+    reward_sum: s.reward_sum,
+    verify_pass: s.verify_pass,
+    verify_fail: s.verify_fail,
+    orphan_ticks: s.orphan_ticks,
+  };
+}
+
+module.exports = {
+  pickTs,
+  clip,
+  normalizePulse,
+  normalizeScorecard,
+  normalizeTaskEpisode,
+  normalizeXp,
+  normalizeMissionEvent,
+  buildActivityStream,
+  buildHeartbeat,
+};

package/lib/auto-accept-certified.js

@@ -54,6 +54,28 @@ function safeNodePathArgs(args) {
   return args.every(token => safeRelativePathToken(token));
 }
 
+function safeNodeTestArgs(args) {
+  let expectPattern = false;
+  for (const token of args) {
+    if (expectPattern) {
+      if (!safeVerifyToken(token) || hasUnsafePathSegment(token)) return false;
+      expectPattern = false;
+      continue;
+    }
+    if (token === '--test-name-pattern') {
+      expectPattern = true;
+      continue;
+    }
+    if (String(token || '').startsWith('--test-name-pattern=')) {
+      const pattern = String(token).slice('--test-name-pattern='.length);
+      if (!pattern || !safeVerifyToken(pattern) || hasUnsafePathSegment(pattern)) return false;
+      continue;
+    }
+    if (!safeRelativePathToken(token)) return false;
+  }
+  return !expectPattern;
+}
+
 function safeGitDiffCheckArgs(args) {
   return args.length === 0 || (args.length <= 2 && args.every(safeGitRevToken));
 }
@@ -182,7 +204,7 @@ function parseVerifyCommand(verify) {
     || (first === 'run' && Boolean(second) && !second.startsWith('-') && argv.length === 3)
   ))
     || (bin === 'node' && (
-      (first === '--test' && safeNodePathArgs(argv.slice(2)))
+      (first === '--test' && safeNodeTestArgs(argv.slice(2)))
       || (first === '--check' && argv.length === 3 && safeRelativePathToken(second))
       || (/^scripts\/[a-zA-Z0-9_./-]+$/.test(first || '') && safeNodePathArgs(argv.slice(1)))
     ))

package/lib/context-gatherer.js

@@ -0,0 +1,170 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const PROFILE_REL_PATH = path.join('.atris', 'state', 'context_profile.json');
+
+function profilePath(root = process.cwd()) {
+  return path.join(root, PROFILE_REL_PATH);
+}
+
+function loadContextProfile(root = process.cwd()) {
+  const target = profilePath(root);
+  if (!fs.existsSync(target)) return null;
+  try {
+    const parsed = JSON.parse(fs.readFileSync(target, 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function hasContextProfile(root = process.cwd()) {
+  const profile = loadContextProfile(root);
+  return Boolean(profile && String(profile.first_answer || '').trim());
+}
+
+function compactText(value, max = 160) {
+  const text = String(value || '').replace(/\s+/g, ' ').trim();
+  if (!text) return '';
+  return text.length > max ? `${text.slice(0, Math.max(0, max - 3)).trim()}...` : text;
+}
+
+function inferDomain(answer) {
+  const text = String(answer || '').toLowerCase();
+  if (/college|application|essay|common app|school/.test(text)) return 'school';
+  if (/code|coding|program|website|app|project/.test(text)) return 'building';
+  if (/week|schedule|calendar|plan|homework/.test(text)) return 'planning';
+  return 'general';
+}
+
+function normalizeQuestionText(value) {
+  return String(value || '')
+    .toLowerCase()
+    .replace(/[^\w\s']/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+function isAtrisMetaQuestion(value) {
+  const text = normalizeQuestionText(value);
+  if (!text) return false;
+
+  const taskVerb = /\b(add|audit|build|change|create|debug|deploy|edit|fix|implement|make|patch|refactor|remove|review|run|ship|test|update|write)\b/;
+  if (taskVerb.test(text)) return false;
+
+  return [
+    /^(what'?s|what is|what are|who is|who are)\s+(atris|you|this)\b/,
+    /^what\s+atris\s+is\b/,
+    /^(what|how)\s+(does|do|can)\s+(atris|you|this)\b/,
+    /^(explain|describe|define)\s+(atris|this)\b/,
+    /^tell me\s+(about|what)\s+(atris|this)\b/,
+    /^why\s+atris\b/,
+  ].some((pattern) => pattern.test(text));
+}
+
+function starterTaskTitle(answer) {
+  const summary = compactText(answer, 80) || 'first useful path';
+  return `First useful step: ${summary}`;
+}
+
+function saveContextProfile(root, answer, { source = 'first_contact' } = {}) {
+  const text = compactText(answer, 500);
+  if (!text) return null;
+  const target = profilePath(root);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  const existing = loadContextProfile(root) || {};
+  const profile = {
+    schema: 'atris.context_profile.v1',
+    created_at: existing.created_at || new Date().toISOString(),
+    updated_at: new Date().toISOString(),
+    source,
+    first_answer: text,
+    inferred_domain: inferDomain(text),
+  };
+  fs.writeFileSync(target, `${JSON.stringify(profile, null, 2)}\n`, 'utf8');
+  return profile;
+}
+
+function createStarterTask(root, answer) {
+  const atrisDir = path.join(root, 'atris');
+  if (!fs.existsSync(atrisDir)) return null;
+  try {
+    const taskDb = require('./task-db');
+    const db = taskDb.open();
+    const workspaceRoot = taskDb.workspaceRoot(root);
+    const title = starterTaskTitle(answer);
+    const sourceKey = taskDb.sourceKey('context-gatherer:first-task', title);
+    const added = taskDb.addTask(db, {
+      title,
+      tag: 'onboarding',
+      workspaceRoot,
+      sourceKey,
+      metadata: {
+        source: 'context_gatherer',
+        first_answer: compactText(answer, 500),
+      },
+    });
+    const rows = taskDb.listTasks(db, { workspaceRoot });
+    const displayRows = taskDb.withTaskDisplayRefs(rows);
+    const task = displayRows.find(row => row.id === added.id) || null;
+    try {
+      const todoPath = path.join(root, 'atris', 'TODO.md');
+      fs.writeFileSync(todoPath, taskDb.renderTodoMarkdown(rows, { title: 'TODO.md' }), 'utf8');
+    } catch {}
+    return {
+      id: added.id,
+      inserted: added.inserted,
+      display_id: task && task.display_id || null,
+      title,
+    };
+  } catch (error) {
+    return {
+      error: error && error.message ? error.message : String(error),
+      title: starterTaskTitle(answer),
+    };
+  }
+}
+
+function shouldGatherContext({
+  root = process.cwd(),
+  userInput = '',
+  mapStatus = 'ready',
+  liveMissionsCount = 0,
+  wipCount = 0,
+  backlogCount = 0,
+  inboxCount = 0,
+} = {}) {
+  if (hasContextProfile(root)) return false;
+  if (String(userInput || '').trim()) return true;
+  if (mapStatus !== 'ready') return true;
+  if (liveMissionsCount > 0 || wipCount > 0 || backlogCount > 0 || inboxCount > 0) return false;
+  return true;
+}
+
+function renderPrompt({ projectName = 'this workspace' } = {}) {
+  return [
+    '',
+    'Context gatherer',
+    '----------------',
+    `Hi. I am Atris, and I want to understand ${projectName} before I suggest a path.`,
+    '',
+    'What are you trying to make easier right now: school, college apps, coding, a personal project, or something else?',
+    'Answer in one sentence. I will turn it into the first useful step.',
+  ].join('\n');
+}
+
+module.exports = {
+  PROFILE_REL_PATH,
+  profilePath,
+  loadContextProfile,
+  hasContextProfile,
+  isAtrisMetaQuestion,
+  saveContextProfile,
+  createStarterTask,
+  shouldGatherContext,
+  renderPrompt,
+  starterTaskTitle,
+  inferDomain,
+};

package/lib/escape-regexp.js

@@ -0,0 +1,13 @@
+'use strict';
+
+// Canonical regex-metacharacter escaper. Embedding unescaped data (user input,
+// task ids, member names, section headings) into `new RegExp(`...${x}...`)` is a
+// recurring crash/mismatch bug in this codebase (CLI-257, CLI-258): a value like
+// "(" throws an uncaught SyntaxError, and "a.b" silently wildcard-matches "aXb".
+// Always wrap data-derived interpolations with this before building a RegExp.
+// (Interpolating a hardcoded regex *fragment* is fine and does not need escaping.)
+function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+module.exports = escapeRegExp;

package/lib/file-ops.js

@@ -1,5 +1,6 @@
 const fs = require('fs');
 const path = require('path');
+const escapeRegExp = require('./escape-regexp');
 
 /**
  * Get the path components for a journal log file.
@@ -61,7 +62,6 @@ function createLogFile(logFile, dateFormatted) {
       if (fs.existsSync(prevLogFile)) {
         const prevContent = fs.readFileSync(prevLogFile, 'utf8');
 
-        const escapeRegExp = (str) => str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
         const sectionBody = (headingLine) => {
           const regex = new RegExp(
             `## ${escapeRegExp(headingLine)}\\n([\\s\\S]*?)(?=\\n---|\\n## |$)`
@@ -89,7 +89,10 @@ function createLogFile(logFile, dateFormatted) {
 
 // Inbox operations
 function parseInboxItems(content) {
-  const match = content.match(/## Inbox\n([\s\S]*?)(?=\n##|\n---|$)/);
+  // \r?\n so a CRLF-line-ending journal (Windows-edited / round-tripped) still
+  // parses; without it the section never matched, IDs reset to 1, and a second
+  // "## Inbox" section was appended on the next add (duplicate-section corruption).
+  const match = content.match(/## Inbox\r?\n([\s\S]*?)(?=\r?\n##|\r?\n---|$)/);
   if (!match) {
     return [];
   }
@@ -111,7 +114,7 @@ function parseInboxItems(content) {
 }
 
 function replaceInboxSection(content, items) {
-  const regex = /(## Inbox\n)([\s\S]*?)(\n---|\n##|$)/;
+  const regex = /(## Inbox\r?\n)([\s\S]*?)(\r?\n---|\r?\n##|$)/;
   if (!regex.test(content)) {
     const lines = items.length ? items.map((item) => item.line).join('\n') : '(Empty - inbox zero achieved)';
     return `${content}\n\n## Inbox\n\n${lines}\n`;

package/lib/journal.js

@@ -3,6 +3,7 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const { spawnSync } = require('child_process');
+const escapeRegExp = require('./escape-regexp');
 
 /**
  * Check if two timestamps are effectively the same (within 5ms).
@@ -235,7 +236,6 @@ function createLogFile(logFile, dateFormatted) {
       if (fs.existsSync(prevLogFile)) {
         const prevContent = fs.readFileSync(prevLogFile, 'utf8');
 
-        const escapeRegExp = (str) => str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
         const sectionBody = (headingLine) => {
           const regex = new RegExp(
             `## ${escapeRegExp(headingLine)}\\n([\\s\\S]*?)(?=\\n---|\\n## |$)`

package/lib/lesson-contradiction.js

@@ -0,0 +1,113 @@
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * Detect contradictions in lessons.md and lessons.json.
+ *
+ * Returns array of contradictions:
+ * - P1: same slug, opposite outcome at later date
+ * - P2: lesson applies_to file no longer exists, skipping [resolved]/observed/attempted>=3
+ *
+ * @param {string} cwd - workspace root
+ * @returns {Array} array of {type, slug, evidence, remediation}
+ */
+function detectLessonContradictions(cwd) {
+  const lessonsMdPath = path.join(cwd, 'atris', 'lessons.md');
+  const lessonsJsonPath = path.join(cwd, 'atris', 'lessons.json');
+
+  const contradictions = [];
+
+  // Parse lessons.md
+  const lessonsMdContent = fs.existsSync(lessonsMdPath)
+    ? fs.readFileSync(lessonsMdPath, 'utf8')
+    : '';
+
+  // Format: - **[YYYY-MM-DD] slug** — pass|fail — prose
+  const lessonRegex = /^-\s+\*\*\[(\d{4}-\d{2}-\d{2})\]\s+([a-z0-9-]+)\*\*\s*—\s*(pass|fail)\s*—\s*(\[resolved\])?\s*(.+)$/m;
+  const lines = lessonsMdContent.split('\n');
+
+  const lessonsBySlug = new Map(); // slug -> [{ date, outcome, lineNum, resolved }]
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const match = line.match(lessonRegex);
+    if (!match) continue;
+
+    const [, date, slug, outcome, resolved, prose] = match;
+    if (!lessonsBySlug.has(slug)) {
+      lessonsBySlug.set(slug, []);
+    }
+    lessonsBySlug.get(slug).push({
+      date,
+      outcome,
+      lineNum: i + 1,
+      resolved: !!resolved,
+      prose: prose.trim(),
+    });
+  }
+
+  // P1: same slug with opposite outcomes at later dates
+  for (const [slug, entries] of lessonsBySlug) {
+    // Sort by date
+    const sorted = [...entries].sort((a, b) => a.date.localeCompare(b.date));
+
+    for (let i = 0; i < sorted.length - 1; i++) {
+      const curr = sorted[i];
+      const next = sorted[i + 1];
+
+      // Skip if either is [resolved]
+      if (curr.resolved || next.resolved) continue;
+
+      // Opposite outcomes?
+      if (curr.outcome !== next.outcome) {
+        contradictions.push({
+          type: 'P1_opposite_outcomes',
+          slug,
+          evidence: `${curr.outcome} on line ${curr.lineNum} (${curr.date}), then ${next.outcome} on later entry (${next.date})`,
+        });
+      }
+    }
+  }
+
+  // P2: applies_to files that no longer exist
+  if (fs.existsSync(lessonsJsonPath)) {
+    let lessonsJson = {};
+    try {
+      lessonsJson = JSON.parse(fs.readFileSync(lessonsJsonPath, 'utf8'));
+    } catch {
+      // invalid JSON, skip
+    }
+
+    for (const [slug, entry] of Object.entries(lessonsJson)) {
+      if (!entry.applies_to || !Array.isArray(entry.applies_to)) continue;
+
+      // Skip if [resolved], observed, or attempted >= 3
+      const status = entry.status || '';
+      if (status === 'resolved' || status === 'observed') continue;
+
+      const attempts = entry.attempts || 0;
+      if (attempts >= 3) continue;
+
+      // Check if files exist
+      for (const filePath of entry.applies_to) {
+        const fullPath = path.isAbsolute(filePath)
+          ? filePath
+          : path.join(cwd, filePath);
+
+        if (!fs.existsSync(fullPath)) {
+          contradictions.push({
+            type: 'P2_missing_file',
+            slug,
+            evidence: `applies_to file no longer exists: ${filePath}`,
+          });
+        }
+      }
+    }
+  }
+
+  return contradictions;
+}
+
+module.exports = {
+  detectLessonContradictions,
+};

package/lib/policy-lessons.js

@@ -10,6 +10,7 @@
 const fs = require('fs');
 const path = require('path');
 const { RECEIPT_PATH_PATTERN, extractReceiptEvidence } = require('./receipt-evidence');
+const escapeRegExp = require('./escape-regexp');
 
 const POLICY_LESSONS_FILE = path.join('.atris', 'state', 'policy_lessons.json');
 const CAREER_XP_RECEIPTS_FILE = path.join('.atris', 'state', 'career_xp_receipts.jsonl');
@@ -20,7 +21,7 @@ const SCORECARDS_FILE = path.join('.atris', 'state', 'scorecards.jsonl');
 // two: agent self-review churn and human accept/bounce are different signals.
 const AGENT_ACTOR_PATTERN = /review|validator|certifier|auto|codex|claude|devin|droid|improver|second-pass|agent|bot/i;
 // "Names a runnable verify command" — the check a reviewer could replay.
-const VERIFY_COMMAND_PATTERN = /\b(npm (run )?test|node --test|node --check|node bin\/|pytest|cargo test|go test|make test|atris verify|grep -q|git diff --check|diff -u|test -[fs])\b|--verify\b|\bverify:\s/;
+const VERIFY_COMMAND_PATTERN = /\b(npm (run )?test|node --test|node --check|node bin\/|pytest|cargo test|go test|make test|atris verify|grep\s+-[A-Za-z]*q[A-Za-z]*|rg\s+(?:-\S+\s+)*(?:"[^"]+"|'[^']+'|\S+)\s+(?:\.{0,2}\/|~\/|\/|[\w.-]+\/|[\w.-]+\.[A-Za-z0-9]|\b(?:atris|bin|commands|lib|scripts|src|test)\b)|git diff --(?:check|exit-code|quiet)|diff (?:-u|--brief)|cmp -s|test -[fs])\b|--verify\b|\bverify:\s/;
 const COMMIT_REF_PATTERN = /\bcommit\s+[0-9a-f]{7,40}\b/i;
 
 function readJsonlFile(filePath) {
@@ -254,7 +255,7 @@ function syncLessonsMd(root, mined) {
   }
   const written = [];
   for (const { id, line } of lines) {
-    const marker = new RegExp(`^- \\*\\*\\[\\d{4}-\\d{2}-\\d{2}\\] policy-${id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\*\\*.*$`, 'm');
+    const marker = new RegExp(`^- \\*\\*\\[\\d{4}-\\d{2}-\\d{2}\\] policy-${escapeRegExp(id)}\\*\\*.*$`, 'm');
     if (marker.test(content)) {
       content = content.replace(marker, line);
     } else {