claudeos-core 2.4.3 → 2.5.0

package/bin/commands/init.js

@@ -615,6 +615,42 @@ async function runPass3Split(ctx) {
     },
   });
 
+  // v2.5.0 — Deterministic allowlist injection ("LLMs guess, code confirms").
+  // The `## Allowed Source Paths` section is the single most important
+  // anti-hallucination input for 3b/3c/3d, yet until now it reached
+  // pass3a-facts.md only if the LLM faithfully hand-copied up to 500 paths
+  // out of pass3-context.json — and the 3a validator only checked file
+  // length. Node now writes that section itself from project-analysis.json
+  // (replacing any LLM-written version), so the allowlist is byte-exact
+  // every run, including resumed runs where 3a was skipped.
+  {
+    const { injectAllowedPathsSection } = require("../../plan-installer/source-paths");
+    let collected = null;
+    try {
+      const pa = JSON.parse(readFile(path.join(GENERATED_DIR, "project-analysis.json")));
+      collected = pa && pa.allowedSourcePaths;
+    } catch (_e) { /* tolerated — fallback line is written instead */ }
+    const before = readFileSafe(factsFile, "");
+    if (before.replace(/^\uFEFF/, "").trim().length === 0) {
+      // 3a is marked complete in the marker but the facts file is missing/empty
+      // (deleted by hand, or a crash between validate and marker write). Do not
+      // fabricate a facts file that contains only the allowlist — 3b would run
+      // against an empty fact sheet. Surface it and let the user resume/--force.
+      throw new InitError(
+        "pass3a-facts.md is missing or empty although Pass 3a is marked complete.\n" +
+        "    Delete claudeos-core/generated/pass3-complete.json to re-run Pass 3a, or use `init --force`."
+      );
+    }
+    const after = injectAllowedPathsSection(before, collected);
+    if (after !== before) {
+      if (!writeFileSafe(factsFile, after)) {
+        throw new InitError("Failed to write the Allowed Source Paths section into pass3a-facts.md.");
+      }
+      const n = collected && Array.isArray(collected.paths) ? collected.paths.length : 0;
+      log(`    📎 Allowed Source Paths section written by orchestrator (${n} ${collected && collected.mode === "rollup" ? "dirs" : "paths"})`);
+    }
+  }
+
   // ═══ Stage 3b: CLAUDE.md + standard/ + .claude/rules/ ═══════════
   //
   // Single batch (domains ≤ 15): keep legacy "3b" marker (backward-compatible).
@@ -699,8 +735,16 @@ async function runPass3Split(ctx) {
           }
         }
         // For every batch, confirm rules/ was generated (at least one staged-rules move must succeed).
+        // Count ONLY claudeos-core-managed categories (`NN.` prefix). Since v2.5.0
+        // --force/fresh preserve user-authored entries under .claude/rules/, so a
+        // plain recursive count could be >0 even when Pass 3 produced nothing.
         const rulesDir = path.join(PROJECT_ROOT, ".claude/rules");
-        const rulesCount = countFilesRecursive(rulesDir);
+        let rulesCount = 0;
+        try {
+          for (const e of fs.readdirSync(rulesDir, { withFileTypes: true })) {
+            if (e.isDirectory() && /^\d{2}\./.test(e.name)) rulesCount += countFilesRecursive(path.join(rulesDir, e.name));
+          }
+        } catch (_e) { rulesCount = 0; }
         if (rulesCount === 0) {
           problems.push(".claude/rules/ has 0 files (staging-override may have been ignored)");
         }
@@ -855,7 +899,7 @@ function checkPrerequisites() {
   );
   if (!hasProjectMarker) {
     log(`\n  ⚠️  Warning: ${PROJECT_ROOT} does not look like a project root.`);
-    log("  No .git, package.json, build.gradle, or pom.xml found.");
+    log("  No .git, package.json, build.gradle(.kts), pom.xml, or pyproject.toml found.");
     log("  Run this command from your project directory.\n");
   }
 
@@ -910,6 +954,28 @@ async function resolveLanguage(parsedArgs) {
   return lang;
 }
 
+// Remove only the rule categories claudeos-core generates (`NN.` prefixed:
+// 00.core, 10.backend, …, 90.optional). Files/dirs the user authored under
+// .claude/rules/ without that prefix are left untouched. Returns the number
+// of entries removed.
+function wipeManagedRuleCategories(rulesDir) {
+  if (!fileExists(rulesDir)) return 0;
+  let removed = 0;
+  let entries;
+  try { entries = fs.readdirSync(rulesDir, { withFileTypes: true }); }
+  catch (_e) { return 0; }
+  for (const e of entries) {
+    // Managed entries are category DIRECTORIES (00.core/, 10.backend/, …).
+    // claudeos-core never writes a `NN.`-prefixed FILE at the rules root, so
+    // such a file (`.claude/rules/01.team-style.md`) is user-authored — keep it.
+    // Guard 2 (zero-rules detection) counts with the same predicate.
+    if (!e.isDirectory() || !/^\d{2}\./.test(e.name)) continue;
+    fs.rmSync(path.join(rulesDir, e.name), { recursive: true, force: true });
+    removed++;
+  }
+  return removed;
+}
+
 // ─── Stage 3: Resume/Fresh selection ──────────────────────────────
 // Returns { wasFreshClean: boolean } — the caller uses this to gate the
 // v1.7.x migration backfill in dispatchPass3.
@@ -930,14 +996,15 @@ async function applyResumeMode(parsedArgs, lang) {
     // (only .json/.md are unlinked above; directories aren't touched).
     const stagedDir = path.join(GENERATED_DIR, ".staged-rules");
     if (fileExists(stagedDir)) fs.rmSync(stagedDir, { recursive: true, force: true });
-    // Also wipe .claude/rules/ so Guard 2 (zero-rules detection) can't
-    // false-negative on stale rules from a previous run when the fresh
-    // Pass 3 run fails silently (e.g. Claude ignores staging-override).
-    // Step [2] recreates the subdirs from scratch. Any manual edits the
-    // user made to rule files are lost — acceptable under --force
-    // ("truly fresh start").
-    const rulesDir = path.join(PROJECT_ROOT, ".claude/rules");
-    if (fileExists(rulesDir)) fs.rmSync(rulesDir, { recursive: true, force: true });
+    // Also wipe the claudeos-core-managed categories under .claude/rules/
+    // so Guard 2 (zero-rules detection) can't false-negative on stale rules
+    // from a previous run when the fresh Pass 3 run fails silently (e.g.
+    // Claude ignores staging-override). Step [2] recreates the subdirs.
+    // Manual edits to GENERATED rule files are lost — acceptable under
+    // --force ("truly fresh start"). Anything the user placed under
+    // .claude/rules/ that is NOT a claudeos-core category (no `NN.` prefix)
+    // is preserved — it was never ours to delete.
+    wipeManagedRuleCategories(path.join(PROJECT_ROOT, ".claude/rules"));
     wasFreshClean = true;
     log("  🔄 Previous results deleted (--force)\n");
     return { wasFreshClean };
@@ -993,11 +1060,9 @@ async function applyResumeMode(parsedArgs, lang) {
     // Clean .staged-rules/ leftover from a prior crashed run (same reason as --force branch).
     const stagedDir = path.join(GENERATED_DIR, ".staged-rules");
     if (fileExists(stagedDir)) fs.rmSync(stagedDir, { recursive: true, force: true });
-    // Wipe .claude/rules/ for the same Guard 2 false-negative reason as
-    // the --force branch. Step [2] recreates the subdirs; any manual
-    // edits are lost — acceptable under an explicit "fresh" choice.
-    const rulesDir = path.join(PROJECT_ROOT, ".claude/rules");
-    if (fileExists(rulesDir)) fs.rmSync(rulesDir, { recursive: true, force: true });
+    // Wipe managed rule categories for the same Guard 2 false-negative
+    // reason as the --force branch (user-owned, non-`NN.` entries survive).
+    wipeManagedRuleCategories(path.join(PROJECT_ROOT, ".claude/rules"));
     wasFreshClean = true;
   } else if (mode === "continue" && existingPass1.length === 0 && pass2Exists) {
     // pass2 exists but no pass1 → pass2 is stale, force re-run
@@ -1078,7 +1143,7 @@ function ensureDirectories() {
 }
 
 // ─── Stage 5: Load & validate domain-groups.json ──────────────────
-function loadDomainGroups() {
+function loadDomainGroups({ wasFreshClean = false } = {}) {
   let domainGroups;
   try {
     domainGroups = JSON.parse(
@@ -1089,6 +1154,34 @@ function loadDomainGroups() {
   }
   const totalGroups = domainGroups.totalGroups;
   if (!totalGroups || typeof totalGroups !== "number" || totalGroups < 1) {
+    if (totalGroups === 0) {
+      let stackLine = "";
+      try {
+        const pa = JSON.parse(readFile(path.join(GENERATED_DIR, "project-analysis.json")));
+        const st = pa.stack || {};
+        stackLine = `    Detected stack: language=${st.language || "none"} framework=${st.framework || "none"} frontend=${st.frontend || "none"}\n`;
+      } catch (_e) { /* best effort */ }
+      throw new InitError(
+        "No domains were found in this project, so there is nothing for Pass 1-3 to analyze.\n" +
+        stackLine +
+        "    The scanner recognizes layouts such as:\n" +
+        "      Java/Kotlin  src/main/java/<pkg>/<domain>/controller/*.java, <pkg>/controller/<domain>/*.java,\n" +
+        "                   <pkg>/controller/*Controller.java, <pkg>/<domain>/adapter/in/web/*.java,\n" +
+        "                   <pkg>/<feature>/*Controller.kt, <module>/src/main/java/... (Gradle/Maven multi-module)\n" +
+        "      Node         src/<domain>/*.ts, src/modules/<domain>/, src/{controllers,routes,services}/<domain>.*\n" +
+        "      Python       app/<domain>/, app/{routers,routes}/<domain>.py, Django apps with models.py\n" +
+        "      Frontend     app/<route>/page.tsx (incl. (group)/), pages/<route>/, src/components/<name>/, src/features/<name>/\n" +
+        "    If your layout differs, open an issue with your directory tree, or check claudeos-core/generated/project-analysis.json\n" +
+        "    to see what was detected. " +
+        (wasFreshClean
+          // --force / "fresh" already wiped the managed rule categories and
+          // generated/*.json|*.md before the scanner ran — say so, do not
+          // claim nothing was touched.
+          ? "CLAUDE.md was not modified, but --force / fresh had already removed the previously generated\n" +
+            "    .claude/rules/NN.* categories and claudeos-core/generated/ pass files before this check. Restore them from version control if needed."
+          : "Nothing was written to CLAUDE.md or .claude/rules/.")
+      );
+    }
     throw new InitError(`domain-groups.json has invalid totalGroups: ${totalGroups}\n    Re-run plan-installer or check claudeos-core/generated/`);
   }
   if (!domainGroups.groups || totalGroups !== domainGroups.groups.length) {
@@ -1564,7 +1657,8 @@ async function runPass4(opts) {
       // Note: master plan files are no longer generated (previously this
       // included "claudeos-core/plan/50.memory-master.md"). The marker schema
       // still accepts an optional planFiles field for backward compatibility.
-      claudeMdAppended: true,
+      // v2.3.0+: CLAUDE.md is never touched by Pass 4 (Pass 3 §8 is authoritative).
+      claudeMdAppended: false,
     }, null, 2);
     return writeFileSafe(pass4Marker, markerBody);
   }
@@ -1625,7 +1719,7 @@ async function runPass4(opts) {
     pass4Label = "Pass 4 already present";
   } else if (!fileExists(pass4PromptFile)) {
     log("    ⚠️  pass4-prompt.md not found — falling back to static scaffold");
-    if (applyStaticFallback()) { log("    ✅ Memory/Rules/Plans scaffolded + CLAUDE.md appended (static fallback)"); pass4Label = "Pass 4 (static fallback)"; }
+    if (applyStaticFallback()) { log("    ✅ Memory/Rules/Standard scaffolded (static fallback)"); pass4Label = "Pass 4 (static fallback)"; }
     else { log("    ❌ Static fallback failed to write marker"); pass4Label = "Pass 4 fallback failed"; }
   } else {
     let prompt4 = injectProjectRoot(readFile(pass4PromptFile));
@@ -1675,7 +1769,7 @@ async function runPass4(opts) {
 
     if (!ok4 || !isValidPass4Marker(pass4Marker)) {
       log("    ⚠️  Pass 4 did not produce a valid pass4-memory.json — using static fallback");
-      if (applyStaticFallback()) { log("    ✅ Memory/Rules/Plans scaffolded + CLAUDE.md appended (static fallback)"); pass4Label = `Pass 4 (static fallback, ${formatElapsed(elapsed4)})`; }
+      if (applyStaticFallback()) { log("    ✅ Memory/Rules/Standard scaffolded (static fallback)"); pass4Label = `Pass 4 (static fallback, ${formatElapsed(elapsed4)})`; }
       else { log("    ❌ Static fallback failed to write marker"); pass4Label = "Pass 4 fallback failed"; }
     } else {
       // Claude-driven Pass 4 succeeded. Ensure memory + rules + plans + standard + CLAUDE.md append exist
@@ -1744,8 +1838,11 @@ async function runPass4(opts) {
 // ─── Stage 11: Run external verification tools ────────────────────
 function runVerificationTools() {
   const verifyTools = [
-    { name: "manifest-generator", script: path.join(TOOLS_DIR, "manifest-generator/index.js") },
-    { name: "health-checker",     script: path.join(TOOLS_DIR, "health-checker/index.js") },
+    // --sync-skills: only `init` is allowed to let manifest-generator patch
+    // CLAUDE.md §6 / MANIFEST.md (post-generation reconciliation). `health`
+    // runs the same tool without the flag and stays read-only.
+    { name: "manifest-generator", script: path.join(TOOLS_DIR, "manifest-generator/index.js"), args: " --sync-skills" },
+    { name: "health-checker",     script: path.join(TOOLS_DIR, "health-checker/index.js"),     args: "" },
   ];
 
   for (const t of verifyTools) {
@@ -1753,7 +1850,7 @@ function runVerificationTools() {
       log(`    ⏭️  ${t.name} — not found, skipping`);
       continue;
     }
-    const ok = run(`node "${t.script}"`, { ignoreError: true });
+    const ok = run(`node "${t.script}"${t.args}`, { ignoreError: true });
     if (!ok) {
       log(`    ⚠️  ${t.name} reported issues (non-fatal)`);
     }
@@ -1914,7 +2011,7 @@ async function cmdInit(parsedArgs) {
 
   // ─── [4] Pass 1: Deep analysis per domain group ────────────
   header("[4] Pass 1 — Deep analysis per domain group...");
-  const { domainGroups, totalGroups } = loadDomainGroups();
+  const { domainGroups, totalGroups } = loadDomainGroups({ wasFreshClean });
   const pass1Prompts = loadPass1Prompts();
 
   // Progress tracking: Pass 1 (N groups) + Pass 2 + Pass 3 + Pass 4 = totalSteps
@@ -1976,4 +2073,4 @@ async function cmdInit(parsedArgs) {
   printCompletionBanner({ lang, totalGroups, totalStart });
 }
 
-module.exports = { cmdInit, InitError };
+module.exports = { cmdInit, InitError, wipeManagedRuleCategories };

package/bin/commands/lint.js

@@ -32,6 +32,8 @@ Checks:
   - Section 6 has exactly 3 ### sub-sections
   - Section 8 has exactly 2 ### sub-sections + 2 #### headings
   - Each L4 memory file appears in exactly 1 table row (inside Section 8)
+  - Each \`## N.\` heading contains its English canonical token (T1)
+  - Each section has non-trivial body content (S2, warning)
 
 Exit codes:
   0 — structure valid

package/bin/commands/memory.js

@@ -2,7 +2,7 @@
  * ClaudeOS-Core — Memory command (L4 memory)
  *
  * Subcommands:
- *   memory compact         — apply 4-stage compaction to decision-log.md / failure-patterns.md
+ *   memory compact         — apply 4-stage compaction to failure-patterns.md (decision-log.md is append-only)
  *   memory score           — recompute importance of failure-patterns.md entries
  *   memory propose-rules   — analyze failure patterns, append suggestions to auto-rule-update.md
  */
@@ -247,7 +247,13 @@ function cmdCompact() {
   ensureDir(MEMORY_DIR);
   const activeRulePaths = loadActiveRulePaths();
 
-  const files = ["decision-log.md", "failure-patterns.md"];
+  // decision-log.md is EXCLUDED from compaction. Its contract (rules/60.memory/
+  // 01.decision-log.md, CLAUDE.md §8) is "permanent, append-only". Stage 1
+  // summarization dropped the Context/Options/Decision/Consequences body of
+  // every entry older than 30 days — i.e. exactly the "why" the file exists
+  // to preserve. Only failure-patterns.md carries the frequency/importance
+  // metadata the 4-stage policy is designed around.
+  const files = ["failure-patterns.md"];
   const summaries = [];
   for (const f of files) {
     const r = compactFile(path.join(MEMORY_DIR, f), activeRulePaths);
@@ -255,6 +261,7 @@ function cmdCompact() {
     if (r.changed) log(`  ✅ ${f}: ${r.before} → ${r.after} entries`);
     else log(`  ⏭️  ${f}: ${r.reason}`);
   }
+  log("  ⏭️  decision-log.md: append-only, never compacted");
 
   // Update compaction.md "Last Compaction" section.
   // Replace ONLY the "## Last Compaction" section (up to next `##` heading or EOF).
@@ -411,7 +418,7 @@ function showHelp() {
 Usage: npx claudeos-core memory <subcommand>
 
 Subcommands:
-  compact            Apply 4-stage compaction to decision-log.md and failure-patterns.md
+  compact            Apply 4-stage compaction to failure-patterns.md (decision-log.md is append-only, never compacted)
   score              Recompute importance of failure-patterns.md entries (frequency × recency)
   propose-rules      Analyze failure patterns, append rule update suggestions to auto-rule-update.md
 `);

package/content-validator/index.js

@@ -423,10 +423,35 @@ async function main() {
   // check covers both. No natural-language matching involved.
   console.log("  [10/10] path-claim verification (hallucination + MANIFEST drift)...");
 
-  // Regex: matches `src/...` paths to TS/TSX/JS/JSX files, not inside
-  // inline code already fenced. We still strip fenced blocks first so
-  // example blocks inside ```...``` don't produce false positives.
-  const SRC_PATH_RE = /\bsrc\/[\w\-./]+\.(?:ts|tsx|js|jsx)\b/g;
+  // Regex: matches `src/...` paths to source files, not inside inline code
+  // already fenced. We still strip fenced blocks first so example blocks
+  // inside ```...``` don't produce false positives.
+  //
+  // v2.5.0 — extension list widened. Pre-v2.5.0 only ts/tsx/js/jsx were
+  // checked, so Java/Kotlin/Python projects (and MyBatis mapper XML, the
+  // single most-hallucinated path class on Spring projects) got zero
+  // path-claim coverage despite "no invented paths" being the headline
+  // guarantee. Config extensions (yml/properties/json) are deliberately
+  // NOT included: those are cited as illustrative profile names
+  // (`application-{profile}.yml`) far more often than as path claims.
+  //
+  // An optional module prefix (`api/src/…`, `apps/web/src/…`,
+  // `servers/query/x/src/…`) is captured as part of the claim. A prefixed
+  // claim is checked at that exact location only — citing `core/src/…` for a
+  // file that lives under `api/` is a wrong-module claim and must be flagged,
+  // which the bare-`src/` module search below would otherwise hide.
+  //
+  // Two alternatives, each with its own left boundary:
+  //   (1) `<module>/…/src/…` — the prefix may not start right after a word
+  //       char, `.`, `/` or `@`, so `@acme/ui/src/Button.tsx` (a package
+  //       import, not a repo path) is NOT captured as module `acme/ui`;
+  //   (2) bare `src/…` — may be preceded by `/` (so the `src/Button.tsx`
+  //       tail of that import is still checked via the module search) but
+  //       not by a word char, so `libsrc/x.ts` never yields `src/x.ts`.
+  // Dependency paths (`node_modules/<pkg>/src/…`) are skipped below.
+  // `:` is excluded before a prefix so a dev-server URL (`localhost:5173/src/main.tsx`)
+  // does not yield the module `5173`; its `src/main.tsx` tail is still checked.
+  const SRC_PATH_RE = /(?:(?<![\w\-./@:])[\w\-][\w\-.]*\/(?:[\w\-][\w\-.]*\/)*src\/|(?<![\w\-.@])src\/)[\w\-./]+\.(?:ts|tsx|js|jsx|mjs|cjs|vue|svelte|java|kt|kts|py|xml|sql)\b/g;
 
   // Placeholder paths are scaffold templates / teaching examples, not
   // real path claims. We skip them. Three patterns qualify:
@@ -541,18 +566,59 @@ async function main() {
   // The monorepo fallback only fires for paths starting with `src/`,
   // which is the conventional workspace-relative form. Non-`src/` paths
   // (e.g., `claudeos-core/skills/...`) are checked direct-only.
+  // Directories that are never application modules even when they contain a
+  // `src/` child: virtualenvs (pip editable installs default to `<venv>/src`),
+  // vendored code, docs, tooling, test fixtures.
+  //
+  // Two tiers: HARD names are never modules at any depth (build output,
+  // dependencies, virtualenvs). SOFT names (`docs`, `tools`, `scripts`,
+  // `test(s)`, `fixtures`) are skipped only at the project root — inside a
+  // workspace container (`apps/docs`, `packages/tools`) they are legitimate
+  // packages, and skipping them there produced false STALE_PATH advisories on
+  // the default Turborepo layout.
+  const MODULE_SCAN_SKIP = new Set(["node_modules", ".git", ".claude", "claudeos-core", "build", "target", "dist", "out", ".gradle", ".idea", "coverage", ".next",
+    "venv", ".venv", "env", "virtualenv", "site-packages", "__pycache__", "vendor", "tmp", "temp"]);
+  const MODULE_SCAN_SKIP_ROOT_ONLY = new Set(["docs", "doc", "tools", "scripts", "test", "tests", "__tests__", "fixtures"]);
+  const WORKSPACE_CONTAINERS = new Set(["apps", "packages", "libs", "services", "servers", "modules"]);
+  function listModuleDirs(dir, { root = false, parentName = "" } = {}) {
+    let entries;
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
+    catch (_e) { return []; }
+    const inWorkspace = WORKSPACE_CONTAINERS.has(parentName);
+    return entries
+      .filter(e => e.isDirectory() && !MODULE_SCAN_SKIP.has(e.name) && !e.name.startsWith(".")
+        && !((root || !inWorkspace) && MODULE_SCAN_SKIP_ROOT_ONLY.has(e.name)))
+      .map(e => path.join(dir, e.name));
+  }
+  // Memoized once per run: every directory up to three levels deep that
+  // contains a `src/` folder (JS workspaces `apps/x`, Gradle modules `api`,
+  // and the nested Kotlin CQRS layout `servers/query/x` the scanner itself
+  // supports). Computed lazily on the first `src/...` miss so projects with
+  // zero misses pay nothing.
+  let moduleSrcRoots = null;
+  function getModuleSrcRoots(ROOT) {
+    if (moduleSrcRoots) return moduleSrcRoots;
+    moduleSrcRoots = [];
+    const walk = (dir, depth) => {
+      for (const child of listModuleDirs(dir, { root: depth === 1, parentName: path.basename(dir) })) {
+        if (fs.existsSync(path.join(child, "src"))) moduleSrcRoots.push(child);
+        if (depth < 3) walk(child, depth + 1);
+      }
+    };
+    walk(ROOT, 1);
+    return moduleSrcRoots;
+  }
   function resolvePathClaim(ROOT, claimed) {
     if (fs.existsSync(path.join(ROOT, claimed))) return true;
     if (!claimed.startsWith("src/")) return false;
-    for (const workspace of ["apps", "packages"]) {
-      const wsDir = path.join(ROOT, workspace);
-      let entries;
-      try { entries = fs.readdirSync(wsDir, { withFileTypes: true }); }
-      catch (_e) { continue; }
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue;
-        if (fs.existsSync(path.join(wsDir, entry.name, claimed))) return true;
-      }
+    // v2.4.0: JS monorepo workspaces (apps/*, packages/*).
+    // v2.5.0: any first- or second-level module directory — Gradle/Maven
+    // multi-module (`api/src/main/java/...`, `servers/query/x/src/main/kotlin/...`)
+    // cite `src/...` relative to the module, exactly like JS workspaces do.
+    // Without this, widening SRC_PATH_RE to .java/.kt/.py would have turned
+    // every valid multi-module citation into a STALE_PATH false positive.
+    for (const moduleRoot of getModuleSrcRoots(ROOT)) {
+      if (fs.existsSync(path.join(moduleRoot, claimed))) return true;
     }
     return false;
   }
@@ -608,6 +674,9 @@ async function main() {
         if (seen.has(claimed)) continue;
         seen.add(claimed);
         if (hasPlaceholder(claimed)) continue;
+        // A dependency path is a reference to a library, not a claim about
+        // this repository's source tree.
+        if (/(^|\/)node_modules\//.test(claimed)) continue;
         pathClaimsChecked++;
         if (!resolvePathClaim(ROOT, claimed)) {
           pathClaimErrors++;

package/lib/env-parser.js

@@ -247,28 +247,65 @@ function isSensitiveVarName(name) {
   return SENSITIVE_VAR_PATTERNS.some(re => re.test(name));
 }
 
+/**
+ * Mask the userinfo component of a URL-shaped value:
+ *   postgres://app:s3cret@db.internal:5432/app  →  postgres://***:***@db.internal:5432/app
+ * Scheme, host, port, path and query are preserved so consumers can still
+ * identify the DB engine / host. Non-URL values pass through unchanged.
+ */
+function maskUrlCredentials(value) {
+  if (typeof value !== "string") return value;
+  // Scheme may itself contain `:` (`jdbc:postgresql://`, `jdbc:mysql://`).
+  // Userinfo is everything between `://` and the LAST `@` of the authority
+  // part, so a password containing `@` (`p@ss`) is masked whole. It may NOT
+  // contain `/`, `?` or `#`: an `@` that appears after the first `/` belongs
+  // to the path or query (`https://cdn.example.com/npm/@scope/pkg`,
+  // `/users/@me`, `?redirect=user@host`) and must never be rewritten —
+  // masking it would replace the real host with a path fragment. A raw `/`
+  // inside a password is not a valid URL and is deliberately left alone.
+  // Credentials carried as connection PARAMETERS rather than userinfo:
+  //   jdbc:postgresql://db/app?user=app&password=s3cret
+  //   mongodb://host/db?authSource=admin&password=x
+  //   sqlserver://host;databaseName=app;user=sa;password=x
+  // The parameter NAME is kept, the value becomes `***`.
+  const PARAM_RE = /([?&;](?:password|passwd|pwd|pass|secret|token|access[_-]?key|secret[_-]?key|api[_-]?key|sas|signature)=)[^&;\s]*/gi;
+  if (/^[a-z][a-z0-9+.:-]*:\/\//i.test(value)) {
+    return value
+      .replace(/^([a-z][a-z0-9+.:-]*:\/\/)([^/?#\s]*)@([^@/?#\s]+)/i, "$1***:***@$3")
+      .replace(PARAM_RE, "$1***");
+  }
+  // Scheme-less credentials are recognized ONLY in the Go/MySQL DSN shape
+  // (`user:pw@tcp(host:3306)/db`, `user:pw@unix(/path)/db`); the password may
+  // itself contain `@` (`p@ss`) — everything up to the `@` before `tcp(`/`unix(`
+  // is userinfo. A generic `a:b@c` rule would corrupt `mailto:ops@example.com`
+  // or `0:30@daily`.
+  return value
+    .replace(/^([^:@/\s]+):(.*)@(?=(?:tcp|unix)\()/, "***:***@")
+    .replace(PARAM_RE, "$1***");
+}
+
 /**
  * Redacts sensitive values in an env vars map. Returns a new object;
  * original is not mutated. Preserves keys so "variable exists" signal
  * is kept, but replaces values with a sentinel string.
  *
- * Whitelist exception: DATABASE_URL is kept as-is because stack-detector's
- * db-identification path has always used it and existing project-analysis
- * consumers depend on reading it. (The DB URL contains credentials, but
- * this has been the established behavior since v1.x and changing it would
- * be a breaking change. Downstream consumers that write CLAUDE.md content
- * from vars should still redact it at their layer.)
+ * v2.5.0 — the former DATABASE_URL whitelist is gone. Its stated
+ * justification ("stack-detector's db-identification path depends on it")
+ * was stale: stack-detector scans the raw .env text with includes() and
+ * never reads envInfo.vars. Meanwhile the unredacted value — typically
+ * `postgres://user:password@host/db` — landed verbatim in
+ * project-analysis.json, which Pass 3/4 prompts instruct the LLM to read.
+ * Every URL-shaped value (DATABASE_URL, REDIS_URL, MONGO_URI, AMQP_URL, …)
+ * now has its userinfo masked while keeping scheme/host/path intact.
  */
 function redactSensitiveVars(vars) {
   if (!vars || typeof vars !== "object") return vars;
   const out = {};
   for (const [k, v] of Object.entries(vars)) {
-    if (k === "DATABASE_URL") {
-      out[k] = v;  // documented whitelist for stack-detector back-compat
-    } else if (isSensitiveVarName(k)) {
+    if (isSensitiveVarName(k)) {
       out[k] = "***REDACTED***";
     } else {
-      out[k] = v;
+      out[k] = maskUrlCredentials(v);
     }
   }
   return out;
@@ -293,8 +330,8 @@ function readStackEnvInfo(root) {
     source: file,
     vars: redactSensitiveVars(vars),
     port: extractPort(vars),
-    host: extractHost(vars),
-    apiTarget: extractApiTarget(vars),
+    host: maskUrlCredentials(extractHost(vars)),
+    apiTarget: maskUrlCredentials(extractApiTarget(vars)),
   };
 }
 
@@ -308,6 +345,7 @@ module.exports = {
   readStackEnvInfo,
   isSensitiveVarName,
   redactSensitiveVars,
+  maskUrlCredentials,
   // Exported for test visibility:
   ENV_FILE_ORDER,
   PORT_VAR_KEYS,