claudeos-core 1.2.1 → 1.2.3

package/manifest-generator/index.js

@@ -6,7 +6,7 @@
  * Role: Generate 4 types of metadata JSON + initialize stale-report
  * Output (claudeos-core/generated/):
  *   - rule-manifest.json   : rules/standard/skills/guide file list + frontmatter
- *   - import-graph.json    : @import dependency graph (nodes + edges)
+ *   - import-graph.json    : (deprecated — kept for backward compatibility, @import removed)
  *   - sync-map.json        : plan/ <file> block → file path mapping
  *   - plan-manifest.json   : plan/ file list + <file> block count
  *   - stale-report.json    : initialized (each verification tool appends results)
@@ -54,25 +54,6 @@ function frontmatter(f) {
   }
 }
 
-function extractImports(f) {
-  const content = fs.readFileSync(f, "utf-8");
-  const result = [];
-  let inCodeFence = false;
-  for (const line of content.split("\n")) {
-    if (/^```/.test(line)) { inCodeFence = !inCodeFence; continue; }
-    if (inCodeFence) continue;
-    const m = line.match(/^@(\.\.?\/[^\s]+)/);
-    if (m) {
-      const target = path.resolve(path.dirname(f), m[1]);
-      result.push({
-        raw: m[0],
-        resolved: rel(target),
-        exists: fs.existsSync(target),
-      });
-    }
-  }
-  return result;
-}
 
 function extractFileBlocks(f) {
   if (!fs.existsSync(f)) return [];
@@ -136,34 +117,16 @@ async function main() {
   fs.writeFileSync(path.join(GEN, "rule-manifest.json"), JSON.stringify(mf, null, 2));
   console.log(`  ✅ rule-manifest.json — ${mf.summary.total} files indexed`);
 
-  // ─── import-graph.json ─────────────────────────────────
-  const gr = { generatedAt: new Date().toISOString(), nodes: [], edges: [], errors: [] };
-  const ns = new Set();
-
-  const importScanDirs = [DIRS.rules, DIRS.standard, DIRS.skills, DIRS.guide, DIRS.database, DIRS.mcpGuide].filter(Boolean);
-  for (const scanDir of importScanDirs) {
-    if (!fs.existsSync(scanDir)) continue;
-    for (const f of await glob("**/*.md", { cwd: scanDir, absolute: true })) {
-      const r = rel(f);
-      ns.add(r);
-      for (const i of extractImports(f)) {
-        ns.add(i.resolved);
-        gr.edges.push({ from: r, to: i.resolved, exists: i.exists });
-        if (!i.exists) {
-          gr.errors.push({ type: "broken_import", file: r, target: i.resolved });
-        }
-      }
-    }
-  }
-
-  gr.nodes = Array.from(ns).sort();
-  gr.summary = {
-    totalNodes: gr.nodes.length,
-    totalEdges: gr.edges.length,
-    brokenImports: gr.errors.length,
+  // ─── import-graph.json (deprecated — @import removed) ──
+  const gr = {
+    generatedAt: new Date().toISOString(),
+    deprecated: true,
+    note: "@import is not a Claude Code feature and has been removed. Rules now use paths: [\"**/*\"] frontmatter.",
+    nodes: [], edges: [], errors: [],
+    summary: { totalNodes: 0, totalEdges: 0, brokenImports: 0 },
   };
   fs.writeFileSync(path.join(GEN, "import-graph.json"), JSON.stringify(gr, null, 2));
-  console.log(`  ✅ import-graph.json — ${gr.summary.totalEdges} edges, ${gr.summary.brokenImports} broken`);
+  console.log("  ✅ import-graph.json — deprecated (no @imports)");
 
   // ─── sync-map.json ─────────────────────────────────────
   const sm = { generatedAt: new Date().toISOString(), mappings: [] };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudeos-core",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "Auto-generate Claude Code documentation from your actual source code — Standards, Rules, Skills, and Guides tailored to your project",
   "main": "bin/cli.js",
   "bin": {
@@ -10,7 +10,6 @@
     "bin/",
     "content-validator/",
     "health-checker/",
-    "import-linter/",
     "manifest-generator/",
     "pass-json-validator/",
     "pass-prompts/",

package/pass-json-validator/index.js

@@ -215,9 +215,9 @@ async function main() {
       const normalizedKeys = keys.map(normalize);
       for (const section of sectionsToCheck) {
         const sectionNorm = normalize(section);
-        // Exact normalized match first, then containment (only for names >= 6 chars to avoid false positives)
+        // Exact normalized match first, then check if any key contains the section name (one-direction only to avoid false positives)
         const found = normalizedKeys.some(k => k === sectionNorm)
-          || (sectionNorm.length >= 6 && normalizedKeys.some(k => k.includes(sectionNorm) || sectionNorm.includes(k)));
+          || (sectionNorm.length >= 6 && normalizedKeys.some(k => k.includes(sectionNorm)));
         if (!found) {
           warnings.push({
             file: "pass2-merged.json",

package/pass-prompts/templates/java-spring/pass3.md

@@ -39,15 +39,52 @@ Generation targets:
    - Key rules summary table
 
 3. .claude/rules/ (active domains only)
-   - Each rule file must include paths: frontmatter (matching this project's package paths)
-   - Write 5-10 lines of key rules directly
-   - Reference detailed standards via @import (path: @../../claudeos-core/standard/...)
-   - Reference skills orchestrator via @import
+   - Every rule file MUST include `paths: ["**/*"]` in YAML frontmatter — this ensures Claude Code always loads the rule regardless of which file is being edited
+   - Write the full rule content directly in each file (self-contained, no external references)
+   - Include 5-15 lines of key rules with concrete examples
+   - Do NOT use @import — it is not a Claude Code feature and does not work
+   - MUST generate `.claude/rules/00.core/00.standard-reference.md` — a mandatory rule file that instructs Claude Code to Read the standard documents before coding. Structure it as:
+     ```
+     ---
+     paths:
+       - "**/*"
+     ---
+     # Required Standard Documents
+     Before writing or modifying code, you MUST Read the relevant standard files below using the Read tool.
+     ## Core (always read)
+     - claudeos-core/standard/00.core/01.project-overview.md
+     - claudeos-core/standard/00.core/02.architecture.md
+     - claudeos-core/standard/00.core/03.naming-conventions.md
+     ## Backend API
+     - claudeos-core/standard/10.backend-api/01.controller-patterns.md
+     - claudeos-core/standard/10.backend-api/02.service-patterns.md
+     - claudeos-core/standard/10.backend-api/03.data-access-patterns.md
+     - claudeos-core/standard/10.backend-api/04.response-exception.md
+     - claudeos-core/standard/10.backend-api/05.dto-validation.md
+     - claudeos-core/standard/10.backend-api/06.interceptor-filter-aop.md
+     ## Security & DB
+     - claudeos-core/standard/30.security-db/01.security-auth.md
+     - claudeos-core/standard/30.security-db/02.database-schema.md
+     - claudeos-core/standard/30.security-db/03.common-utilities.md
+     ## Infra & Verification
+     - claudeos-core/standard/40.infra/01.environment-config.md
+     - claudeos-core/standard/40.infra/02.logging-monitoring.md
+     - claudeos-core/standard/40.infra/03.cicd-deployment.md
+     - claudeos-core/standard/50.verification/01.development-verification.md
+     - claudeos-core/standard/50.verification/02.testing-strategy.md
+     ## DO NOT Read (context waste)
+     - claudeos-core/plan/ — Master Plan backup files. Never read during coding.
+     - claudeos-core/generated/ — Build metadata. Not for coding reference.
+     - claudeos-core/guide/ — Onboarding/usage guides for humans. Not for coding reference.
+     - claudeos-core/mcp-guide/ — MCP server integration docs. Not for coding reference.
+     ```
+     List only the standard files that were actually generated above. Include frontend standards only if frontend was detected.
 
-4. .claude/rules/50.sync/ (3 sync rules)
-   - 01.standard-sync.md — Auto-update plan/10 when standard is modified
-   - 02.rules-sync.md — Auto-update plan/20 when rules are modified
-   - 03.skills-sync.md — Auto-update plan/30 when skills are modified
+4. .claude/rules/50.sync/ (3 sync rules — AI fallback reminders)
+   - NOTE: These rules remind AI to run `npx claudeos-core refresh` after modifying standard/rules/skills files.
+   - 01.standard-sync.md — Remind AI to update plan/10 when standard is modified
+   - 02.rules-sync.md — Remind AI to update plan/20 when rules are modified
+   - 03.skills-sync.md — Remind AI to update plan/30 when skills are modified
 
 5. claudeos-core/skills/ (active domains only)
    - 10.backend-crud/01.scaffold-crud-feature.md (orchestrator)

package/pass-prompts/templates/kotlin-spring/pass3.md

@@ -42,16 +42,55 @@ Generation targets:
    - Key rules summary table
 
 3. .claude/rules/ (active domains only)
-   - Each rule file must include paths: frontmatter (matching this project's module paths, e.g., servers/command/**/*)
-   - Write 5-10 lines of key rules directly
-   - Reference detailed standards via @import (path: @../../claudeos-core/standard/...)
-   - Reference skills orchestrator via @import
-   - CQRS-specific rules: separate rule files for command/* and query/* paths
+   - Every rule file MUST include `paths: ["**/*"]` in YAML frontmatter — this ensures Claude Code always loads the rule regardless of which file is being edited
+   - Write the full rule content directly in each file (self-contained, no external references)
+   - Include 5-15 lines of key rules with concrete examples
+   - Do NOT use @import — it is not a Claude Code feature and does not work
+   - CQRS-specific rules: include command/query separation rules directly in the rule file content
+   - MUST generate `.claude/rules/00.core/00.standard-reference.md` — a mandatory rule file that instructs Claude Code to Read the standard documents before coding. Structure it as:
+     ```
+     ---
+     paths:
+       - "**/*"
+     ---
+     # Required Standard Documents
+     Before writing or modifying code, you MUST Read the relevant standard files below using the Read tool.
+     ## Core (always read)
+     - claudeos-core/standard/00.core/01.project-overview.md
+     - claudeos-core/standard/00.core/02.architecture.md
+     - claudeos-core/standard/00.core/03.naming-conventions.md
+     ## Backend API
+     - claudeos-core/standard/10.backend-api/01.controller-patterns.md
+     - claudeos-core/standard/10.backend-api/02.service-patterns.md
+     - claudeos-core/standard/10.backend-api/03.data-access-patterns.md
+     - claudeos-core/standard/10.backend-api/04.response-exception.md
+     - claudeos-core/standard/10.backend-api/05.dto-vo-validation.md
+     - claudeos-core/standard/10.backend-api/06.aggregate-patterns.md (if generated)
+     - claudeos-core/standard/10.backend-api/07.bff-feign-patterns.md (if generated)
+     - claudeos-core/standard/10.backend-api/08.inter-module-communication.md (if generated)
+     ## Security & DB
+     - claudeos-core/standard/30.security-db/01.security-auth.md
+     - claudeos-core/standard/30.security-db/02.database-schema.md
+     - claudeos-core/standard/30.security-db/03.common-utilities.md
+     ## Infra & Verification
+     - claudeos-core/standard/40.infra/01.environment-config.md
+     - claudeos-core/standard/40.infra/02.logging-monitoring.md
+     - claudeos-core/standard/40.infra/03.cicd-deployment.md
+     - claudeos-core/standard/50.verification/01.development-verification.md
+     - claudeos-core/standard/50.verification/02.testing-strategy.md
+     ## DO NOT Read (context waste)
+     - claudeos-core/plan/ — Master Plan backup files. Never read during coding.
+     - claudeos-core/generated/ — Build metadata. Not for coding reference.
+     - claudeos-core/guide/ — Onboarding/usage guides for humans. Not for coding reference.
+     - claudeos-core/mcp-guide/ — MCP server integration docs. Not for coding reference.
+     ```
+     List only the standard files that were actually generated above. Include frontend standards only if frontend was detected.
 
-4. .claude/rules/50.sync/ (3 sync rules)
-   - 01.standard-sync.md — Auto-update plan/10 when standard is modified
-   - 02.rules-sync.md — Auto-update plan/20 when rules is modified
-   - 03.skills-sync.md — Auto-update plan/30 when skills is modified
+4. .claude/rules/50.sync/ (3 sync rules — AI fallback reminders)
+   - NOTE: These rules remind AI to run `npx claudeos-core refresh` after modifying standard/rules/skills files.
+   - 01.standard-sync.md — Remind AI to update plan/10 when standard is modified
+   - 02.rules-sync.md — Remind AI to update plan/20 when rules is modified
+   - 03.skills-sync.md — Remind AI to update plan/30 when skills is modified
 
 5. claudeos-core/skills/ (active domains only)
    - 10.backend-crud/01.scaffold-crud-feature.md (orchestrator — CQRS-aware: creates both command and query modules)

package/pass-prompts/templates/node-express/pass3.md

@@ -38,14 +38,52 @@ Generation targets:
    - Key rules summary table
 
 3. .claude/rules/ (active domains only)
-   - Each rule file must include paths: frontmatter
-   - Write 5-10 lines of key rules directly
-   - Reference detailed standards via @import (path: @../../claudeos-core/standard/...)
+   - Every rule file MUST include `paths: ["**/*"]` in YAML frontmatter — this ensures Claude Code always loads the rule regardless of which file is being edited
+   - Write the full rule content directly in each file (self-contained, no external references)
+   - Include 5-15 lines of key rules with concrete examples
+   - Do NOT use @import — it is not a Claude Code feature and does not work
+   - MUST generate `.claude/rules/00.core/00.standard-reference.md` — a mandatory rule file that instructs Claude Code to Read the standard documents before coding. Structure it as:
+     ```
+     ---
+     paths:
+       - "**/*"
+     ---
+     # Required Standard Documents
+     Before writing or modifying code, you MUST Read the relevant standard files below using the Read tool.
+     ## Core (always read)
+     - claudeos-core/standard/00.core/01.project-overview.md
+     - claudeos-core/standard/00.core/02.architecture.md
+     - claudeos-core/standard/00.core/03.naming-conventions.md
+     ## Backend API
+     - claudeos-core/standard/10.backend-api/01.router-controller-patterns.md
+     - claudeos-core/standard/10.backend-api/02.service-patterns.md
+     - claudeos-core/standard/10.backend-api/03.data-access-patterns.md
+     - claudeos-core/standard/10.backend-api/04.response-exception.md
+     - claudeos-core/standard/10.backend-api/05.validation-dto.md
+     - claudeos-core/standard/10.backend-api/06.middleware-interceptor.md
+     ## Security & DB
+     - claudeos-core/standard/30.security-db/01.security-auth.md
+     - claudeos-core/standard/30.security-db/02.database-schema.md
+     - claudeos-core/standard/30.security-db/03.common-utilities.md
+     ## Infra & Verification
+     - claudeos-core/standard/40.infra/01.environment-config.md
+     - claudeos-core/standard/40.infra/02.logging-monitoring.md
+     - claudeos-core/standard/40.infra/03.cicd-deployment.md
+     - claudeos-core/standard/50.verification/01.development-verification.md
+     - claudeos-core/standard/50.verification/02.testing-strategy.md
+     ## DO NOT Read (context waste)
+     - claudeos-core/plan/ — Master Plan backup files. Never read during coding.
+     - claudeos-core/generated/ — Build metadata. Not for coding reference.
+     - claudeos-core/guide/ — Onboarding/usage guides for humans. Not for coding reference.
+     - claudeos-core/mcp-guide/ — MCP server integration docs. Not for coding reference.
+     ```
+     List only the standard files that were actually generated above.
 
-4. .claude/rules/50.sync/ (3 sync rules)
-   - 01.standard-sync.md — Auto-update plan/10 when standard is modified
-   - 02.rules-sync.md — Auto-update plan/20 when rules is modified
-   - 03.skills-sync.md — Auto-update plan/30 when skills is modified
+4. .claude/rules/50.sync/ (3 sync rules — AI fallback reminders)
+   - NOTE: These rules remind AI to run `npx claudeos-core refresh` after modifying standard/rules/skills files.
+   - 01.standard-sync.md — Remind AI to update plan/10 when standard is modified
+   - 02.rules-sync.md — Remind AI to update plan/20 when rules is modified
+   - 03.skills-sync.md — Remind AI to update plan/30 when skills is modified
 
 5. claudeos-core/skills/ (active domains only)
    - 10.backend-crud/01.scaffold-crud-feature.md (orchestrator)

package/pass-prompts/templates/node-nextjs/pass3.md

@@ -36,14 +36,51 @@ Generation targets:
    - Key rules summary table
 
 3. .claude/rules/ (active domains only)
-   - Each rule file must include paths: frontmatter
-   - Write 5-10 lines of key rules directly
-   - Reference detailed standards via @import (path: @../../claudeos-core/standard/...)
+   - Every rule file MUST include `paths: ["**/*"]` in YAML frontmatter — this ensures Claude Code always loads the rule regardless of which file is being edited
+   - Write the full rule content directly in each file (self-contained, no external references)
+   - Include 5-15 lines of key rules with concrete examples
+   - Do NOT use @import — it is not a Claude Code feature and does not work
+   - MUST generate `.claude/rules/00.core/00.standard-reference.md` — a mandatory rule file that instructs Claude Code to Read the standard documents before coding. Structure it as:
+     ```
+     ---
+     paths:
+       - "**/*"
+     ---
+     # Required Standard Documents
+     Before writing or modifying code, you MUST Read the relevant standard files below using the Read tool.
+     ## Core (always read)
+     - claudeos-core/standard/00.core/01.project-overview.md
+     - claudeos-core/standard/00.core/02.architecture.md
+     - claudeos-core/standard/00.core/03.naming-conventions.md
+     ## Frontend UI
+     - claudeos-core/standard/20.frontend-ui/01.component-patterns.md
+     - claudeos-core/standard/20.frontend-ui/02.page-routing-patterns.md
+     - claudeos-core/standard/20.frontend-ui/03.data-fetching.md
+     - claudeos-core/standard/20.frontend-ui/04.state-management.md
+     - claudeos-core/standard/20.frontend-ui/05.styling-patterns.md
+     ## Backend API
+     - claudeos-core/standard/10.backend-api/01.api-routes.md
+     ## Security & DB
+     - claudeos-core/standard/30.security-db/01.security-auth.md
+     ## Infra & Verification
+     - claudeos-core/standard/40.infra/01.environment-config.md
+     - claudeos-core/standard/40.infra/02.logging-monitoring.md
+     - claudeos-core/standard/40.infra/03.cicd-deployment.md
+     - claudeos-core/standard/50.verification/01.development-verification.md
+     - claudeos-core/standard/50.verification/02.testing-strategy.md
+     ## DO NOT Read (context waste)
+     - claudeos-core/plan/ — Master Plan backup files. Never read during coding.
+     - claudeos-core/generated/ — Build metadata. Not for coding reference.
+     - claudeos-core/guide/ — Onboarding/usage guides for humans. Not for coding reference.
+     - claudeos-core/mcp-guide/ — MCP server integration docs. Not for coding reference.
+     ```
+     List only the standard files that were actually generated above.
 
-4. .claude/rules/50.sync/ (3 sync rules)
-   - 01.standard-sync.md
-   - 02.rules-sync.md
-   - 03.skills-sync.md
+4. .claude/rules/50.sync/ (3 sync rules — AI fallback reminders)
+   - NOTE: These rules remind AI to run `npx claudeos-core refresh` after modifying standard/rules/skills files.
+   - 01.standard-sync.md — Remind AI to update plan/10 when standard is modified
+   - 02.rules-sync.md — Remind AI to update plan/20 when rules is modified
+   - 03.skills-sync.md — Remind AI to update plan/30 when skills is modified
 
 5. claudeos-core/skills/ (active domains only)
    - 20.frontend-page/01.scaffold-page-feature.md (orchestrator)

package/pass-prompts/templates/python-django/pass3.md

@@ -38,14 +38,52 @@ Generation targets:
    - Key rules summary table
 
 3. .claude/rules/ (active domains only)
-   - Each rule file must include paths: frontmatter
-   - Write 5-10 lines of key rules directly
-   - Reference detailed standards via @import
+   - Every rule file MUST include `paths: ["**/*"]` in YAML frontmatter — this ensures Claude Code always loads the rule regardless of which file is being edited
+   - Write the full rule content directly in each file (self-contained, no external references)
+   - Include 5-15 lines of key rules with concrete examples
+   - Do NOT use @import — it is not a Claude Code feature and does not work
+   - MUST generate `.claude/rules/00.core/00.standard-reference.md` — a mandatory rule file that instructs Claude Code to Read the standard documents before coding. Structure it as:
+     ```
+     ---
+     paths:
+       - "**/*"
+     ---
+     # Required Standard Documents
+     Before writing or modifying code, you MUST Read the relevant standard files below using the Read tool.
+     ## Core (always read)
+     - claudeos-core/standard/00.core/01.project-overview.md
+     - claudeos-core/standard/00.core/02.architecture.md
+     - claudeos-core/standard/00.core/03.naming-conventions.md
+     ## Backend API
+     - claudeos-core/standard/10.backend-api/01.view-patterns.md
+     - claudeos-core/standard/10.backend-api/02.serializer-patterns.md
+     - claudeos-core/standard/10.backend-api/03.model-patterns.md
+     - claudeos-core/standard/10.backend-api/04.response-exception.md
+     - claudeos-core/standard/10.backend-api/05.business-logic.md
+     - claudeos-core/standard/10.backend-api/06.admin-patterns.md
+     ## Security & DB
+     - claudeos-core/standard/30.security-db/01.security-auth.md
+     - claudeos-core/standard/30.security-db/02.database-schema.md
+     - claudeos-core/standard/30.security-db/03.common-utilities.md
+     ## Infra & Verification
+     - claudeos-core/standard/40.infra/01.environment-config.md
+     - claudeos-core/standard/40.infra/02.logging-monitoring.md
+     - claudeos-core/standard/40.infra/03.cicd-deployment.md
+     - claudeos-core/standard/50.verification/01.development-verification.md
+     - claudeos-core/standard/50.verification/02.testing-strategy.md
+     ## DO NOT Read (context waste)
+     - claudeos-core/plan/ — Master Plan backup files. Never read during coding.
+     - claudeos-core/generated/ — Build metadata. Not for coding reference.
+     - claudeos-core/guide/ — Onboarding/usage guides for humans. Not for coding reference.
+     - claudeos-core/mcp-guide/ — MCP server integration docs. Not for coding reference.
+     ```
+     List only the standard files that were actually generated above.
 
-4. .claude/rules/50.sync/ (3 sync rules)
-   - 01.standard-sync.md
-   - 02.rules-sync.md
-   - 03.skills-sync.md
+4. .claude/rules/50.sync/ (3 sync rules — AI fallback reminders)
+   - NOTE: These rules remind AI to run `npx claudeos-core refresh` after modifying standard/rules/skills files.
+   - 01.standard-sync.md — Remind AI to update plan/10 when standard is modified
+   - 02.rules-sync.md — Remind AI to update plan/20 when rules is modified
+   - 03.skills-sync.md — Remind AI to update plan/30 when skills is modified
 
 5. claudeos-core/skills/ (active domains only)
    - 10.backend-crud/01.scaffold-crud-feature.md (orchestrator)

package/pass-prompts/templates/python-fastapi/pass3.md

@@ -38,14 +38,52 @@ Generation targets:
    - Key rules summary table
 
 3. .claude/rules/ (active domains only)
-   - Each rule file must include paths: frontmatter
-   - Write 5-10 lines of key rules directly
-   - Reference detailed standards via @import
+   - Every rule file MUST include `paths: ["**/*"]` in YAML frontmatter — this ensures Claude Code always loads the rule regardless of which file is being edited
+   - Write the full rule content directly in each file (self-contained, no external references)
+   - Include 5-15 lines of key rules with concrete examples
+   - Do NOT use @import — it is not a Claude Code feature and does not work
+   - MUST generate `.claude/rules/00.core/00.standard-reference.md` — a mandatory rule file that instructs Claude Code to Read the standard documents before coding. Structure it as:
+     ```
+     ---
+     paths:
+       - "**/*"
+     ---
+     # Required Standard Documents
+     Before writing or modifying code, you MUST Read the relevant standard files below using the Read tool.
+     ## Core (always read)
+     - claudeos-core/standard/00.core/01.project-overview.md
+     - claudeos-core/standard/00.core/02.architecture.md
+     - claudeos-core/standard/00.core/03.naming-conventions.md
+     ## Backend API
+     - claudeos-core/standard/10.backend-api/01.router-endpoint-patterns.md
+     - claudeos-core/standard/10.backend-api/02.schema-pydantic-patterns.md
+     - claudeos-core/standard/10.backend-api/03.data-access-patterns.md
+     - claudeos-core/standard/10.backend-api/04.response-exception.md
+     - claudeos-core/standard/10.backend-api/05.dependency-injection.md
+     - claudeos-core/standard/10.backend-api/06.middleware-patterns.md
+     ## Security & DB
+     - claudeos-core/standard/30.security-db/01.security-auth.md
+     - claudeos-core/standard/30.security-db/02.database-schema.md
+     - claudeos-core/standard/30.security-db/03.common-utilities.md
+     ## Infra & Verification
+     - claudeos-core/standard/40.infra/01.environment-config.md
+     - claudeos-core/standard/40.infra/02.logging-monitoring.md
+     - claudeos-core/standard/40.infra/03.cicd-deployment.md
+     - claudeos-core/standard/50.verification/01.development-verification.md
+     - claudeos-core/standard/50.verification/02.testing-strategy.md
+     ## DO NOT Read (context waste)
+     - claudeos-core/plan/ — Master Plan backup files. Never read during coding.
+     - claudeos-core/generated/ — Build metadata. Not for coding reference.
+     - claudeos-core/guide/ — Onboarding/usage guides for humans. Not for coding reference.
+     - claudeos-core/mcp-guide/ — MCP server integration docs. Not for coding reference.
+     ```
+     List only the standard files that were actually generated above.
 
-4. .claude/rules/50.sync/ (3 sync rules)
-   - 01.standard-sync.md
-   - 02.rules-sync.md
-   - 03.skills-sync.md
+4. .claude/rules/50.sync/ (3 sync rules — AI fallback reminders)
+   - NOTE: These rules remind AI to run `npx claudeos-core refresh` after modifying standard/rules/skills files.
+   - 01.standard-sync.md — Remind AI to update plan/10 when standard is modified
+   - 02.rules-sync.md — Remind AI to update plan/20 when rules is modified
+   - 03.skills-sync.md — Remind AI to update plan/30 when skills is modified
 
 5. claudeos-core/skills/ (active domains only)
    - 10.backend-crud/01.scaffold-crud-feature.md (orchestrator)

package/plan-installer/index.js

@@ -197,7 +197,7 @@ async function detectStack() {
     let pkg;
     try { pkg = JSON.parse(fs.readFileSync(path.join(ROOT, "package.json"), "utf-8")); }
     catch { console.warn("    ⚠️  package.json parse error — skipping Node.js detection"); pkg = null; }
-    if (!pkg) return stack;
+    if (pkg) {
     stack.detected.push("package.json");
     const deps = { ...pkg.dependencies, ...pkg.devDependencies };
 
@@ -231,6 +231,7 @@ async function detectStack() {
       : fs.existsSync(path.join(ROOT, "yarn.lock")) ? "yarn" : "npm";
 
     if (pkg.engines && pkg.engines.node && !stack.languageVersion) stack.languageVersion = pkg.engines.node;
+    } // end if (pkg)
   }
 
   // ── Python ──
@@ -1374,4 +1375,10 @@ async function main() {
   console.log("  ✅ Plan Installer complete\n");
 }
 
-main().catch(e => { console.error(e); process.exit(1); });
+main().catch(e => {
+  console.error(`\n  ❌ Plan Installer failed: ${e.message || e}`);
+  if (e.code === "EACCES" || e.code === "EPERM") {
+    console.error("  Check file/directory permissions.");
+  }
+  process.exit(1);
+});

package/plan-validator/index.js

@@ -126,6 +126,12 @@ async function main() {
       total++;
       const abs = path.join(ROOT, b.path);
 
+      // Block path traversal attempts
+      if (!path.resolve(abs).startsWith(path.resolve(ROOT))) {
+        console.log(`     ⚠️  SKIPPED: ${b.path} (path traversal blocked)`);
+        continue;
+      }
+
       // File does not exist
       if (!fs.existsSync(abs)) {
         if (mode === "--execute") {

package/sync-checker/index.js

@@ -76,7 +76,10 @@ async function main() {
   // ─── [2/2] Plan → Disk: detect orphaned files ───────────────
   console.log("  [2/2] Plan → Disk...");
   for (const m of sm.mappings) {
-    if (!fs.existsSync(path.join(ROOT, m.sourcePath))) {
+    const abs = path.join(ROOT, m.sourcePath);
+    // Skip path traversal attempts
+    if (!path.resolve(abs).startsWith(path.resolve(ROOT))) continue;
+    if (!fs.existsSync(abs)) {
       issues.orphan.push({ path: m.sourcePath, plan: m.planFile });
     }
   }