claudeos-core 2.4.4 → 2.5.1

package/lib/env-parser.js

@@ -220,6 +220,54 @@ function extractApiTarget(vars) {
 const SENSITIVE_VAR_PATTERNS = [
   /password/i,
   /passwd/i,
+  // Abbreviated form (`DB_PASS`, `MYSQL_PASS`, bare `PASS`). Anchored to a
+  // name-segment boundary (start / `_` / `-`) rather than a bare substring,
+  // so `BYPASS_AUTH`, `PASSENGER_NAME` and `COMPASS_URL` are NOT swept up.
+  // maskUrlCredentials' PARAM_RE has accepted `pass` as a connection
+  // parameter name since v2.5.0; this closes the same gap on the env-key
+  // side, where the value is copied verbatim into project-analysis.json.
+  //
+  // KNOWN, ACCEPTED OVER-MATCH: a leading `PASS_` segment also matches
+  // benign names such as `PASS_RATE`. Narrowing to a trailing segment
+  // (`/(^|[_-])pass$/i`) would fix that but drop `DB_PASS_2` / `PASS_FILE`.
+  // The two failure modes are not symmetric — over-redaction costs one
+  // config fact in project-analysis.json, under-redaction writes a live
+  // credential into a file the Pass 3/4 prompts tell the model to read — so
+  // the broader rule stands. Do not narrow it without re-reading this.
+  /(^|[_-])pass([_-]|$)/i,
+  // Same segment-anchored treatment for the `PW` abbreviation
+  // (`DB_PW`, `ADMIN_PW`, `ROOT_PW`).
+  /(^|[_-])pw([_-]|$)/i,
+  /passphrase/i,
+  // Trailing-segment only: `PASSWORD_PEPPER` / `PEPPER` are the secret,
+  // `PEPPER_ROUNDS` is a cost parameter.
+  /(^|[_-])pepper$/i,
+  // Anchored so `SSH_KEYSCAN_HOSTS` (a host list) is not swept up, while
+  // `SSH_KEY` / `SSH_KEY_PATH` still are.
+  /ssh[_-]?key([_-]|$)/i,
+  /sign(ing)?[_-]?key([_-]|$)/i,
+  // Specific well-known secret-bearing `*_KEY` names. Deliberately NOT a
+  // blanket `/(^|[_-])key([_-]|$)/i`: that would also redact `ROUTING_KEY`,
+  // `PARTITION_KEY`, `SORT_KEY`, `IDEMPOTENCY_KEY` and `FOREIGN_KEY_CHECKS`,
+  // which are architecture facts this tool exists to document. Each name is
+  // anchored at its trailing boundary so `MASTER_KEYSPACE` (Cassandra) and
+  // `SERVER_KEYSTORE_PATH` are not swept up.
+  //
+  // This is a curated list and will always trail real-world naming. If a
+  // leak is found, add the specific name here rather than widening to a
+  // blanket `key` rule.
+  /master[_-]?key([_-]|$)/i,
+  /deploy[_-]?key([_-]|$)/i,
+  /license[_-]?key([_-]|$)/i,
+  /server[_-]?key([_-]|$)/i,
+  // Bare `SERVICE_ACCOUNT` (the JSON blob itself) and its secret-bearing
+  // suffixes only. `SERVICE_ACCOUNT_EMAIL` / `_NAME` / `_ID` identify the
+  // account, they do not authenticate as it — those are config facts.
+  // Two patterns, not one with an optional group: an optional group matches
+  // empty and the trailing `[_-]` then swallows the separator, which makes
+  // `SERVICE_ACCOUNT_EMAIL` match after all.
+  /service[_-]?account$/i,
+  /service[_-]?account[_-](keys?|json|file|secret|token|creds?|credentials?)([_-]|$)/i,
   /secret/i,
   /api[_-]?key/i,
   /access[_-]?key/i,
@@ -247,28 +295,65 @@ function isSensitiveVarName(name) {
   return SENSITIVE_VAR_PATTERNS.some(re => re.test(name));
 }
 
+/**
+ * Mask the userinfo component of a URL-shaped value:
+ *   postgres://app:s3cret@db.internal:5432/app  →  postgres://***:***@db.internal:5432/app
+ * Scheme, host, port, path and query are preserved so consumers can still
+ * identify the DB engine / host. Non-URL values pass through unchanged.
+ */
+function maskUrlCredentials(value) {
+  if (typeof value !== "string") return value;
+  // Scheme may itself contain `:` (`jdbc:postgresql://`, `jdbc:mysql://`).
+  // Userinfo is everything between `://` and the LAST `@` of the authority
+  // part, so a password containing `@` (`p@ss`) is masked whole. It may NOT
+  // contain `/`, `?` or `#`: an `@` that appears after the first `/` belongs
+  // to the path or query (`https://cdn.example.com/npm/@scope/pkg`,
+  // `/users/@me`, `?redirect=user@host`) and must never be rewritten —
+  // masking it would replace the real host with a path fragment. A raw `/`
+  // inside a password is not a valid URL and is deliberately left alone.
+  // Credentials carried as connection PARAMETERS rather than userinfo:
+  //   jdbc:postgresql://db/app?user=app&password=s3cret
+  //   mongodb://host/db?authSource=admin&password=x
+  //   sqlserver://host;databaseName=app;user=sa;password=x
+  // The parameter NAME is kept, the value becomes `***`.
+  const PARAM_RE = /([?&;](?:password|passwd|pwd|pass|secret|token|access[_-]?key|secret[_-]?key|api[_-]?key|sas|signature)=)[^&;\s]*/gi;
+  if (/^[a-z][a-z0-9+.:-]*:\/\//i.test(value)) {
+    return value
+      .replace(/^([a-z][a-z0-9+.:-]*:\/\/)([^/?#\s]*)@([^@/?#\s]+)/i, "$1***:***@$3")
+      .replace(PARAM_RE, "$1***");
+  }
+  // Scheme-less credentials are recognized ONLY in the Go/MySQL DSN shape
+  // (`user:pw@tcp(host:3306)/db`, `user:pw@unix(/path)/db`); the password may
+  // itself contain `@` (`p@ss`) — everything up to the `@` before `tcp(`/`unix(`
+  // is userinfo. A generic `a:b@c` rule would corrupt `mailto:ops@example.com`
+  // or `0:30@daily`.
+  return value
+    .replace(/^([^:@/\s]+):(.*)@(?=(?:tcp|unix)\()/, "***:***@")
+    .replace(PARAM_RE, "$1***");
+}
+
 /**
  * Redacts sensitive values in an env vars map. Returns a new object;
  * original is not mutated. Preserves keys so "variable exists" signal
  * is kept, but replaces values with a sentinel string.
  *
- * Whitelist exception: DATABASE_URL is kept as-is because stack-detector's
- * db-identification path has always used it and existing project-analysis
- * consumers depend on reading it. (The DB URL contains credentials, but
- * this has been the established behavior since v1.x and changing it would
- * be a breaking change. Downstream consumers that write CLAUDE.md content
- * from vars should still redact it at their layer.)
+ * v2.5.0 — the former DATABASE_URL whitelist is gone. Its stated
+ * justification ("stack-detector's db-identification path depends on it")
+ * was stale: stack-detector scans the raw .env text with includes() and
+ * never reads envInfo.vars. Meanwhile the unredacted value — typically
+ * `postgres://user:password@host/db` — landed verbatim in
+ * project-analysis.json, which Pass 3/4 prompts instruct the LLM to read.
+ * Every URL-shaped value (DATABASE_URL, REDIS_URL, MONGO_URI, AMQP_URL, …)
+ * now has its userinfo masked while keeping scheme/host/path intact.
  */
 function redactSensitiveVars(vars) {
   if (!vars || typeof vars !== "object") return vars;
   const out = {};
   for (const [k, v] of Object.entries(vars)) {
-    if (k === "DATABASE_URL") {
-      out[k] = v;  // documented whitelist for stack-detector back-compat
-    } else if (isSensitiveVarName(k)) {
+    if (isSensitiveVarName(k)) {
       out[k] = "***REDACTED***";
     } else {
-      out[k] = v;
+      out[k] = maskUrlCredentials(v);
     }
   }
   return out;
@@ -293,8 +378,8 @@ function readStackEnvInfo(root) {
     source: file,
     vars: redactSensitiveVars(vars),
     port: extractPort(vars),
-    host: extractHost(vars),
-    apiTarget: extractApiTarget(vars),
+    host: maskUrlCredentials(extractHost(vars)),
+    apiTarget: maskUrlCredentials(extractApiTarget(vars)),
   };
 }
 
@@ -308,6 +393,7 @@ module.exports = {
   readStackEnvInfo,
   isSensitiveVarName,
   redactSensitiveVars,
+  maskUrlCredentials,
   // Exported for test visibility:
   ENV_FILE_ORDER,
   PORT_VAR_KEYS,

package/lib/memory-scaffold.js

@@ -10,6 +10,7 @@
 
 const path = require("path");
 const fs = require("fs");
+const crypto = require("crypto");
 const { ensureDir, existsSafe, writeFileSafe, readFileSafe } = require("./safe-fs");
 
 // ─── Language labels — single source of truth: lib/language-config.js ──
@@ -58,6 +59,18 @@ function writeCache(cacheFile, cache) {
   } catch (_e) { /* best-effort */ }
 }
 
+// v2.5.0 — Cache entries are keyed by content name AND a hash of the English
+// source. Pre-v2.5.0 the key was the bare name (`MEMORY_FILES.compaction.md`),
+// so whenever a static-fallback text changed between releases, a project that
+// already had `fallback-cache-<lang>.json` kept serving the translation of the
+// OLD English text forever. Hashing the source makes a text change a cache
+// miss automatically; stale entries under the old key shape are simply never
+// read again.
+function cacheKeyFor(contentKey, englishContent) {
+  const h = crypto.createHash("sha1").update(String(englishContent), "utf8").digest("hex").slice(0, 12);
+  return `${contentKey}@${h}`;
+}
+
 // Translate English static content to the requested language via Claude CLI.
 //
 // Behavior contract:
@@ -81,6 +94,15 @@ function translateIfNeeded(englishContent, lang, contentKey, cacheFile) {
     );
   }
 
+  // Cache hit → return immediately. Checked BEFORE the env-skip below: a hit
+  // never shells out, so the skip has nothing to prevent, and this keeps the
+  // cache path unit-testable under CLAUDEOS_SKIP_TRANSLATION=1.
+  const cache = readCache(cacheFile);
+  const key = cacheKeyFor(contentKey, englishContent);
+  if (cache[key] && typeof cache[key] === "string" && cache[key].trim().length > 0) {
+    return cache[key];
+  }
+
   // M2: CI / deterministic-test escape hatch. When
   // CLAUDEOS_SKIP_TRANSLATION=1 is set, throw instead of shelling out to
   // `claude -p`. This makes the "translation fails without real Claude CLI"
@@ -95,12 +117,6 @@ function translateIfNeeded(englishContent, lang, contentKey, cacheFile) {
     );
   }
 
-  // Cache hit → return immediately
-  const cache = readCache(cacheFile);
-  if (cache[contentKey] && typeof cache[contentKey] === "string" && cache[contentKey].trim().length > 0) {
-    return cache[contentKey];
-  }
-
   // Lazy-load CLI utils to avoid a circular dependency at module-load time.
   let runClaudeCapture;
   try {
@@ -256,8 +272,9 @@ Translate now. Output only the translated document.`;
     );
   }
 
-  // Success — save to cache for future init runs
-  cache[contentKey] = cleaned;
+  // Success — save to cache for future init runs (content-hashed key; must
+  // be recomputed here — this function does not share translateIfNeeded's scope).
+  cache[cacheKeyFor(contentKey, englishContent)] = cleaned;
   writeCache(cacheFile, cache);
 
   const elapsed = ((Date.now() - t0) / 1000).toFixed(1);
@@ -282,7 +299,7 @@ _Format: \`## <pattern-id>\` with Frequency / Last Seen / Importance / Fix._
 
   "compaction.md": `# Compaction Strategy
 
-_4-stage compaction rules for \`decision-log.md\` and \`failure-patterns.md\`._
+_4-stage compaction rules for \`failure-patterns.md\`. \`decision-log.md\` is append-only and never compacted._
 _Run via \`npx claudeos-core memory compact\`._
 
 ## Preservation Priority
@@ -431,8 +448,8 @@ Before analysis or evaluation, review this table and do not repeat these pattern
 | 8 | Making quantitative judgments based on unverified numbers, then reversing when challenged | No speculation-based quantitative claims |
 | 9 | Judging a standard document as "low practical value" without reading it | No judgment before verification |
 | 10 | Proposing to merge/reduce same-layer intentional duplication | Different perspectives on the same topic in different files is intentional. Rule accessibility > token saving |
-| 11 | Suggesting an import or package name without verifying it exists in the dependency manifest | Hallucinated module/named export. Verify by reading \`package.json\` / \`pom.xml\` / \`build.gradle\` / \`pyproject.toml\` / \`requirements.txt\` before recommending an import |
-| 12 | Mixing API signatures from different major versions of the same library | Verify by checking the manifest AND lockfile for the exact installed version (lockfile pins the truth): \`package-lock.json\`/\`pnpm-lock.yaml\`/\`yarn.lock\`, \`gradle.lockfile\`/\`gradle/libs.versions.toml\`, \`poetry.lock\`/\`Pipfile.lock\`/\`uv.lock\`, or fall back to the manifest (\`pom.xml\`/\`build.gradle\`/\`package.json\`/\`pyproject.toml\`) |
+| 11 | Suggesting an import or package name without verifying it exists in the dependency manifest | Hallucinated module/named export. Verify by reading \`package.json\` / \`pom.xml\` / \`build.gradle\` / \`build.gradle.kts\` / \`pyproject.toml\` / \`requirements.txt\` before recommending an import |
+| 12 | Mixing API signatures from different major versions of the same library | Verify by checking the manifest AND lockfile for the exact installed version (lockfile pins the truth): \`package-lock.json\`/\`pnpm-lock.yaml\`/\`yarn.lock\`, \`gradle.lockfile\`/\`gradle/libs.versions.toml\`, \`poetry.lock\`/\`Pipfile.lock\`/\`uv.lock\`, or fall back to the manifest (\`pom.xml\`/\`build.gradle\`/\`build.gradle.kts\`/\`package.json\`/\`pyproject.toml\`) |
 | 13 | Editing one environment config file without checking sibling parity | Verify by \`Glob\` for the config family before a partial edit. Backend: \`.env*\`, \`application-*.yml/.properties\`, \`*settings.py\`. Frontend: \`environment*.ts\` (Angular), \`next.config.*\`, \`vite.config.*\`, \`nuxt.config.*\`, \`.env.local\`/\`.env.production\` |
 | 14 | Mixing server/client component boundaries (SSR frameworks) — using client-only APIs (\`useState\`, \`useEffect\`, \`window\`, \`localStorage\`) in a server component, or server-only operations (DB access, secret reads, filesystem) in a client component | Read the file's boundary directive before adding code: Next.js App Router (\`"use client"\` opt-in), Nuxt (server vs client composables), Remix (\`loader\`/\`action\` exports). N/A for pure SPA or pure backend projects |
 | 15 | Inventing component prop names or function arguments without reading the target's interface | Read the target's prop type definition (\`interface Props\`, \`defineProps<>\`, function signature) or method signature before invoking. Hallucinated props may compile in loose-TS code and crash at runtime |
@@ -450,9 +467,8 @@ Before analysis or evaluation, review this table and do not repeat these pattern
 - **Do not modify onboarding/guide documents (\`claudeos-core/guide/\`) unless specifically requested.**
 - Do not clean up surrounding code during bug fixes, or add unnecessary refactoring during feature additions.
 - **Empty directories may be intentional placeholders — verify markers before flagging or removing.** Markers of intent: a \`.gitkeep\` / \`KEEP_EMPTY.md\` file inside, the directory listed in CLAUDE.md as planned, or referenced by an active plan/standard/skills document. If none of these exist, an empty directory may be neglect — ask the user before deleting.
-- **\`plan/\` master documents are internal sync management tools.** Do not suggest removing them. "DO NOT Read" means "AI should not read directly", not "the file is unnecessary".
 - **Do not duplicate into memory what is already directly verifiable in code, config files, or rule documents.** Configuration values, paths, and names already recorded in CLAUDE.md, rules, or standard must not be redundantly stored in memory. Examples — backend: port numbers, pool sizes, handler names, transaction propagation modes; frontend: dev server port, build output dir, env var prefix (\`VITE_\`/\`NEXT_PUBLIC_\`/\`REACT_APP_\`), route definitions, bundle size budgets.
-- **Do not directly read internal document directories (\`guide/\`, \`plan/\`, \`generated/\`, \`mcp-guide/\`) for routine context loading.** \`.claude/rules/\` and \`claudeos-core/standard/\` already contain the essential content. *Exception: read directly when the user explicitly asks about these contents, or when debugging an issue requires inspecting them.*
+- **Do not directly read internal document directories (\`guide/\`, \`generated/\`, \`mcp-guide/\`) for routine context loading.** \`.claude/rules/\` and \`claudeos-core/standard/\` already contain the essential content. *Exception: read directly when the user explicitly asks about these contents, or when debugging an issue requires inspecting them.*
 - **Established codebase conventions take precedence over textbook-ideal patterns.** Propose modernization, refactoring, or "current best practices" migration ONLY when the user explicitly requests it (e.g., "modernize", "migrate to v3", "refactor to current best practices"). Otherwise, follow the existing pattern even if you would write it differently in a greenfield project.
 
 ## Project Architecture — Hands Off
@@ -464,7 +480,7 @@ This project uses the CLAUDE.md → rules → standard 3-layer architecture, plu
 - **Memory (\`claudeos-core/memory/\`, on-demand) and Rules (\`.claude/rules/\`, auto-loaded by path match) are never simultaneously loaded by default.** Similar content between them is NOT duplication. Do not propose "memory cleanup", "dedupe memory vs rules", or "consolidate memory into rules" — they have different roles (on-demand history/context vs auto-loaded enforcement).
 - **Multi-rule load provides reinforcement.** Do not label co-loaded defensive rules as "redundant" — the reinforcement effect is intentional and the context cost is negligible.
 - **Rules \`paths: ["**/*"]\` — do not propose conditional path conversion for core rules.** When developing new features (no matching files exist yet), conditional paths would prevent rules from loading, risking non-standard code generation.
-- **\`00.standard-reference.md\` index additions — avoid unless specifically requested.** Each rules file already links to its corresponding standard via the \`## Reference\` section. Adding paths to the index only consumes additional tokens per conversation.
+- **\`00.standard-reference.md\` is a paths-only index of \`claudeos-core/standard/\`.** When a standard file is added, add its path there (one line, no description). Do not add rule files, skill files, memory files, or "DO NOT Read" lists to it — those belong elsewhere, and every extra line is reloaded on every edit.
 - **Minor wording or item count differences across layers are NOT "inconsistency risks".** If no information is missing, trivial expression differences are not a problem.
 
 ## Planned References — No "Missing" Judgment
@@ -577,8 +593,8 @@ paths:
 
 # Compaction Strategy (\`memory/compaction.md\`)
 
-Reference document defining the 4-stage compaction policy.
-Executed by \`npx claudeos-core memory compact\`.
+Reference document defining the 4-stage compaction policy for \`failure-patterns.md\`.
+Executed by \`npx claudeos-core memory compact\`. \`decision-log.md\` is never compacted (append-only).
 
 ## Rules
 
@@ -1055,4 +1071,7 @@ module.exports = {
   scaffoldMasterPlans,
   scaffoldDocWritingGuide,
   scaffoldSkillsManifest,
+  // Exported for test visibility (v2.5.0: content-hashed translation cache).
+  translateIfNeeded,
+  _cacheKeyFor: cacheKeyFor,
 };

package/manifest-generator/index.js

@@ -166,10 +166,21 @@ async function main() {
   // Deterministically reconcile MANIFEST.md ↔ CLAUDE.md §6 cross-references
   // that LLM stages routinely drift on. Failure here is logged but not
   // fatal — manifest-generator's primary outputs above are already on disk.
-  try {
-    syncSkillsCatalog(ROOT);
-  } catch (e) {
-    console.log(`  ⚠️  skills-sync: unexpected error (${e.message || e})`);
+  //
+  // OPT-IN ONLY. This step WRITES to CLAUDE.md and MANIFEST.md. It must not
+  // run from `npx claudeos-core health` (documented as a read-only gate that
+  // users wire into CI / pre-commit) — a health check that dirties the
+  // working tree is a trap. `init` passes `--sync-skills` after Pass 3/4;
+  // everything else gets a pure metadata generation run. The flag is the ONLY
+  // switch — an environment variable would be inherited by `health`'s child
+  // process and silently re-enable writes from a shell that exported it.
+  const syncRequested = process.argv.includes("--sync-skills");
+  if (syncRequested) {
+    try {
+      syncSkillsCatalog(ROOT);
+    } catch (e) {
+      console.log(`  ⚠️  skills-sync: unexpected error (${e.message || e})`);
+    }
   }
 
   // ─── Initialize stale-report.json (preserve existing sub-tool results) ──

package/package.json

@@ -1,92 +1,92 @@
-{
-  "name": "claudeos-core",
-  "version": "2.4.4",
-  "description": "Auto-generate Claude Code documentation from your actual source code — Standards, Rules, Skills, and Guides tailored to your project",
-  "main": "bin/cli.js",
-  "bin": {
-    "claudeos-core": "bin/cli.js"
-  },
-  "files": [
-    "bin/",
-    "lib/",
-    "claude-md-validator/",
-    "content-validator/",
-    "health-checker/",
-    "manifest-generator/",
-    "pass-json-validator/",
-    "pass-prompts/",
-    "plan-installer/",
-    "plan-validator/",
-    "sync-checker/",
-    "bootstrap.sh",
-    "README.md",
-    "README.ko.md",
-    "LICENSE",
-    "CHANGELOG.md",
-    "CONTRIBUTING.md",
-    "CODE_OF_CONDUCT.md",
-    "SECURITY.md",
-    "README.zh-CN.md",
-    "README.ja.md",
-    "README.es.md",
-    "README.vi.md",
-    "README.hi.md",
-    "README.ru.md",
-    "README.fr.md",
-    "README.de.md"
-  ],
-  "scripts": {
-    "init": "node bin/cli.js init",
-    "lint": "node bin/cli.js lint",
-    "health": "node bin/cli.js health",
-    "validate": "node bin/cli.js validate",
-    "refresh": "node bin/cli.js refresh",
-    "restore": "node bin/cli.js restore",
-    "pretest": "node -e \"try{require('glob')}catch(e){process.exit(1)}\" || npm install",
-    "test": "node scripts/run-tests.js",
-    "test:health": "node health-checker/index.js"
-  },
-  "keywords": [
-    "claude-code",
-    "automation",
-    "code-analysis",
-    "CLAUDE.md",
-    "standards",
-    "rules",
-    "skills",
-    "scaffolding",
-    "i18n",
-    "multi-language",
-    "spring-boot",
-    "kotlin",
-    "exposed",
-    "jooq",
-    "cqrs",
-    "bff",
-    "multi-module",
-    "monorepo",
-    "nextjs",
-    "express",
-    "fastify",
-    "angular",
-    "django",
-    "fastapi"
-  ],
-  "author": "claudeos-core <claudeoscore@gmail.com> (https://github.com/claudeos-core)",
-  "license": "ISC",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/claudeos-core/claudeos-core.git"
-  },
-  "homepage": "https://github.com/claudeos-core/claudeos-core#readme",
-  "bugs": {
-    "url": "https://github.com/claudeos-core/claudeos-core/issues"
-  },
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "dependencies": {
-    "glob": "^13.0.6",
-    "gray-matter": "^4.0.3"
-  }
-}
+{
+  "name": "claudeos-core",
+  "version": "2.5.1",
+  "description": "Auto-generate Claude Code documentation from your actual source code — Standards, Rules, Skills, and Guides tailored to your project",
+  "main": "bin/cli.js",
+  "bin": {
+    "claudeos-core": "bin/cli.js"
+  },
+  "files": [
+    "bin/",
+    "lib/",
+    "claude-md-validator/",
+    "content-validator/",
+    "health-checker/",
+    "manifest-generator/",
+    "pass-json-validator/",
+    "pass-prompts/",
+    "plan-installer/",
+    "plan-validator/",
+    "sync-checker/",
+    "bootstrap.sh",
+    "README.md",
+    "README.ko.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "CONTRIBUTING.md",
+    "CODE_OF_CONDUCT.md",
+    "SECURITY.md",
+    "README.zh-CN.md",
+    "README.ja.md",
+    "README.es.md",
+    "README.vi.md",
+    "README.hi.md",
+    "README.ru.md",
+    "README.fr.md",
+    "README.de.md"
+  ],
+  "scripts": {
+    "init": "node bin/cli.js init",
+    "lint": "node bin/cli.js lint",
+    "health": "node bin/cli.js health",
+    "validate": "node bin/cli.js validate",
+    "refresh": "node bin/cli.js refresh",
+    "restore": "node bin/cli.js restore",
+    "pretest": "node -e \"try{require('glob')}catch(e){process.exit(1)}\" || npm install",
+    "test": "node scripts/run-tests.js",
+    "test:health": "node health-checker/index.js"
+  },
+  "keywords": [
+    "claude-code",
+    "automation",
+    "code-analysis",
+    "CLAUDE.md",
+    "standards",
+    "rules",
+    "skills",
+    "scaffolding",
+    "i18n",
+    "multi-language",
+    "spring-boot",
+    "kotlin",
+    "exposed",
+    "jooq",
+    "cqrs",
+    "bff",
+    "multi-module",
+    "monorepo",
+    "nextjs",
+    "express",
+    "fastify",
+    "angular",
+    "django",
+    "fastapi"
+  ],
+  "author": "claudeos-core <claudeoscore@gmail.com> (https://github.com/claudeos-core)",
+  "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/claudeos-core/claudeos-core.git"
+  },
+  "homepage": "https://github.com/claudeos-core/claudeos-core#readme",
+  "bugs": {
+    "url": "https://github.com/claudeos-core/claudeos-core/issues"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "glob": "^13.0.6",
+    "gray-matter": "^4.0.3"
+  }
+}

package/pass-json-validator/index.js

@@ -228,7 +228,7 @@ async function main() {
           const framework = paData.stack?.framework;
           const language = paData.stack?.language;
           const architecture = paData.stack?.architecture;
-          isBackend = !frontend || ["express", "nestjs", "fastify", "django", "fastapi", "flask", "spring-boot"].includes(framework);
+          isBackend = !frontend || ["express", "nestjs", "fastify", "django", "fastapi", "flask", "spring-boot", "spring-framework"].includes(framework);
           isKotlin = language === "kotlin";
           isKotlinCqrs = isKotlin && (architecture === "cqrs" || paData.stack?.multiModule);
         } catch (_e) { /* If project-analysis parsing fails, conservatively assume backend */ }

package/pass-prompts/templates/angular/pass3.md

@@ -85,6 +85,7 @@ Generation targets:
      - `60.memory/*` rules: forward reference — Pass 4 will generate 4 files (01.decision-log, 02.failure-patterns, 03.compaction, 04.auto-rule-update), each with file-specific `paths`. Pass 3 must STILL list ```.claude/rules/60.memory/*``` as a row in CLAUDE.md Section 6 Rules table so developers/Claude see the category exists.
      - `70.domains/*` rules (multi-domain projects only): per-domain rules at `.claude/rules/70.domains/{type}/{domain}-rules.md` (where `{type}` is `backend` or `frontend`, ALWAYS present even in single-stack projects for uniform layout + zero-migration future-proofing), each with a `paths:` glob scoped to that domain's source directories so the rule auto-loads only when editing files within the relevant domain. Folder name is PLURAL (`domains/`) — collection of N per-domain files — and each file inside uses the SINGULAR domain name (`{domain}-rules.md`). DO NOT use `60.domains/` (collides with `60.memory/`) and DO NOT skip the `{type}/` sub-folder. See pass3-footer.md "Per-domain folder convention" for the full rationale.
    - MUST generate `.claude/rules/00.core/00.standard-reference.md` as a directory of all standard files
+     (paths only, grouped by category). Include the FORWARD REFERENCE `claudeos-core/standard/00.core/04.doc-writing-guide.md` under `## Core` — Pass 4 generates it; omitting it leaves an index gap the moment Pass 4 runs. Do NOT add a "DO NOT Read" section here — CLAUDE.md Section 7 is the single source of truth.
 
 4. .claude/rules/50.sync/ (2 sync rules)
    - 01.doc-sync.md — Bidirectional standard ↔ rules sync reminder (both directions in ONE rule).
@@ -94,7 +95,7 @@ Generation targets:
    - 02.skills-sync.md — Remind AI to update MANIFEST.md when skills are modified
 
 5. claudeos-core/skills/ (active domains only)
-   - 20.frontend-page/01.scaffold-feature-module.md (orchestrator — Angular feature module scaffolding)
+   - 20.frontend-page/01.scaffold-page-feature.md (orchestrator — Angular feature module scaffolding; stem MUST match the `scaffold-page-feature/` sub-folder so content-validator pairs them)
    - 20.frontend-page/scaffold-page-feature/01~08 (sub-skills: module, component, service, routing, template, test, style, index)
    - 00.shared/MANIFEST.md (skill registry)
 

package/pass-prompts/templates/common/claude-md-scaffold.md

@@ -277,7 +277,7 @@ Unlike rules that auto-load via `paths` glob, this layer is referenced **on-dema
 2. **Skim recent decisions**: Skim recent entries in `decision-log.md` to avoid overwriting architectural decisions that have already been agreed upon.
 3. **Record new decisions**: When making a significant design decision (choosing between competing patterns, adopting or rejecting a library, fixing a convention, etc.), append to `decision-log.md`.
 4. **Record repeated errors**: If the same error occurs ≥2 times and the root cause is non-obvious, register it in `failure-patterns.md` with a new pattern-id.
-5. **Periodic compaction**: When a memory file approaches 400 lines or has not been tidied up for over a month, run `npx claudeos-core memory compact`.
+5. **Periodic compaction**: When `failure-patterns.md` approaches 400 lines or has not been tidied up for over a month, run `npx claudeos-core memory compact` (`decision-log.md` is append-only and is never compacted).
 6. **Review rule-update proposals**: Review proposals in `auto-rule-update.md` with confidence ≥ 0.70. When accepting, edit the corresponding rule file and log the decision in `decision-log.md`.
 
 **Session Resume (after auto-compact or restart)**: Claude Code's auto-compact feature may truncate session context mid-work, and a restarted session starts with a fresh context window. When resuming work:

package/pass-prompts/templates/common/pass3a-facts.md

@@ -125,11 +125,15 @@ IMPORT, not redefine.
 - ...
 - ...
 
-## Allowed Source Paths (v2.3.x+ — MANDATORY)
+## Allowed Source Paths (v2.5.0+ — WRITTEN BY THE ORCHESTRATOR)
 
-Copy the **entire** `allowedSourcePaths` section from `pass3-context.json`
-verbatim into this pass3a-facts.md. Do NOT summarize it, do NOT truncate
-it, do NOT reword it. The shape to copy:
+**Do NOT write this section yourself.** After you finish, the Node.js
+orchestrator appends `## Allowed Source Paths` to this file directly from
+`project-analysis.json` — byte-exact, every run. Anything you write under
+that heading will be replaced. Skip it and save the tokens.
+
+The remainder of this section documents the shape the orchestrator emits,
+so Pass 3b/3c/3d know what to expect:
 
 - Header: whether the list is in `full` mode (individual file paths) or
   `rollup` mode (parent directories, used when the project exceeds the
@@ -175,11 +179,9 @@ fall back to pass2-merged.json verification per file)` instead.
 3. **Exact values only.** Every class name, method name, package path, and
    file path must be verbatim from the analysis data. If a value is not
    captured in the analysis, write `(not in analysis)` — do NOT guess.
-4. **Allowed Source Paths section is COPIED, not extracted.** Do not apply
-   judgment, ranking, or "relevance filtering" to the allowlist. The
-   whole point is that Pass 3b/3c/3d get the complete enumeration; any
-   path you drop here becomes a path they can fabricate later without
-   the downstream validator catching it until after Pass 3 completes.
+4. **Do not write the `## Allowed Source Paths` section.** The orchestrator
+   injects it verbatim from `project-analysis.json` once this step ends
+   (v2.5.0+). It is deterministic by design — no LLM copying involved.
 5. **Do NOT write any other files.** CLAUDE.md, standard/, rules/, etc.
    come in later Pass 3 steps. Writing them here is a bug.
 6. **Do NOT read source code.** All information comes from the three JSON

package/pass-prompts/templates/common/pass4.md

@@ -191,7 +191,7 @@ Baseline template (translate per above, then append the project-specific section
 ```markdown
 # Compaction Strategy
 
-_4-stage compaction rules for `decision-log.md` and `failure-patterns.md`._
+_4-stage compaction rules for `failure-patterns.md`. `decision-log.md` is append-only and never compacted._
 _Run via `npx claudeos-core memory compact`._
 
 ## Preservation Priority
@@ -266,7 +266,7 @@ Body (write in **{{LANG_NAME}}**) must cover:
 Frontmatter: `name: AI Work Rules`, `paths: ["**/*"]`
 Body (write in **{{LANG_NAME}}**) must cover:
 - Accuracy over token saving; verify before claiming
-- 13 hallucination prevention patterns (see memory-scaffold static fallback for reference list)
+- 17 hallucination prevention patterns (see memory-scaffold static fallback `RULE_FILES_00["52.ai-work-rules.md"]` for the reference table)
 - No unsolicited suggestions; ask when unsure
 - Memory vs Rules — no duplication judgment (Memory is on-demand, Rules are auto-loaded)
 - Planned references — no "missing" judgment
@@ -374,7 +374,7 @@ After all files are written, create:
   "standardFiles": [
     "claudeos-core/standard/00.core/XX.doc-writing-guide.md"
   ],
-  "claudeMdAppended": true,
+  "claudeMdAppended": false,
   "seededDecisions": <integer count of seed entries written to decision-log.md>
 }
 ```

package/pass-prompts/templates/java-spring/pass1.md

@@ -21,8 +21,16 @@ Required reads (if the file exists):
      the variable inside `ext { ... }` or `<properties>`. Record the
      ACTUAL Java version — do NOT infer "Java 17+" from the Spring
      Boot version.
-   - Spring Boot version: verify it matches `project-analysis.json`'s
-     frameworkVersion field; if they disagree, trust the build file.
+   - Spring version: verify it matches `project-analysis.json`'s
+     frameworkVersion field (Spring Boot, or the Spring Framework line when
+     `framework` is `"spring-framework"` — a pre-Boot project); if they
+     disagree, trust the build file. For a non-Boot project, also read
+     `WEB-INF/web.xml` and the Spring XML configs it references
+     (`applicationContext*.xml`, `*-servlet.xml`, `*.properties`) — they
+     hold what `application.yml` holds in a Boot project, and step 2 below
+     will find no `application.yml`. Do NOT describe Boot features
+     (auto-configuration, starters, actuator, `@SpringBootApplication`)
+     for a project that does not declare Boot.
    - Dependencies that indicate specific patterns (MyBatis/iBatis/JPA,
      multiple DB drivers, Jasypt, JWT library, Logback extras).