clckernel 1.2.6 → 1.2.8

package/src/adapters/agent-os.js

@@ -0,0 +1,183 @@
+/**
+ * CLC Kernel — Agent-OS & Domain Workflows Stack Adapter
+ * Supports AI Agent Operating Systems (Marketing OS, Content Ops, Research OS)
+ * featuring Dual-Layer Governance and Domain Integrity Safeguards.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const BaseAdapter = require('./base');
+
+class AgentOSAdapter extends BaseAdapter {
+  constructor() {
+    super('Agent-OS (Domain & AI Workflows)', 'agent-os', 'Playbook / Contract Test');
+  }
+
+  detect(targetDir) {
+    // 1. package.json check
+    const pkgPath = path.join(targetDir, 'package.json');
+    if (fs.existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+        const name = (pkg.name || '').toLowerCase();
+        const desc = (pkg.description || '').toLowerCase();
+        const keywords = Array.isArray(pkg.keywords) ? pkg.keywords.map(k => k.toLowerCase()) : [];
+        if (
+          name.includes('agent-os') || name.includes('marketing-os') || name.includes('laila-mos') ||
+          desc.includes('agent-os') || desc.includes('marketing operating system') ||
+          keywords.includes('agent-os') || keywords.includes('marketing-os') || keywords.includes('ai-agents')
+        ) {
+          return true;
+        }
+      } catch {}
+    }
+
+    // 2. skills/ or .agents/skills/ directory check
+    const skillsDir = path.join(targetDir, 'skills');
+    const agentSkillsDir = path.join(targetDir, '.agents', 'skills');
+    if (fs.existsSync(skillsDir) || fs.existsSync(agentSkillsDir)) {
+      const dirToCheck = fs.existsSync(skillsDir) ? skillsDir : agentSkillsDir;
+      try {
+        const files = fs.readdirSync(dirToCheck);
+        if (files.some(f => f.endsWith('.md'))) {
+          return true;
+        }
+      } catch {}
+    }
+
+    // 3. brand/ or templates/ check alongside README referencing agents/workflows
+    const brandPath = path.join(targetDir, 'brand');
+    const templatesPath = path.join(targetDir, 'templates');
+    const readmePath = path.join(targetDir, 'README.md');
+    if ((fs.existsSync(brandPath) || fs.existsSync(templatesPath)) && fs.existsSync(readmePath)) {
+      try {
+        const readme = fs.readFileSync(readmePath, 'utf-8').toLowerCase();
+        if (readme.includes('subagent') || readme.includes('operating system') || readme.includes('agent')) {
+          return true;
+        }
+      } catch {}
+    }
+
+    return false;
+  }
+
+  getSafeguards() {
+    return [
+      'Dual-Layer Architecture: Layer 1 (Engineering) & Layer 2 (Domain Runtime)',
+      'Mandatory Human-in-the-Loop (HITL) Checkpoints',
+      'Symlink Interoperability (.cursorrules, CLAUDE.md, GEMINI.md, .windsurfrules)',
+      'Domain Data Integrity & Clean Creation State (No Hallucinated Metrics)',
+      'Single Source of Truth (SSOT) Memory Primacy',
+      'Local-only Spec Driven Development (sdds/)'
+    ];
+  }
+
+  getTools() {
+    return [
+      {
+        name: 'check_symlinks',
+        language: 'node',
+        path: 'tools/check_symlinks.js',
+        command: 'node tools/check_symlinks.js',
+        description: 'AI IDE symlinks and rule mirror verification'
+      },
+      {
+        name: 'check_hitl',
+        language: 'node',
+        path: 'tools/check_hitl.js',
+        command: 'node tools/check_hitl.js',
+        description: 'Human-in-the-Loop review checkpoint validator'
+      },
+      {
+        name: 'check_domain_data',
+        language: 'node',
+        path: 'tools/check_domain_data.js',
+        command: 'node tools/check_domain_data.js',
+        description: 'Domain deliverables schema and clean state integrity'
+      },
+      {
+        name: 'scan_secrets',
+        language: 'node',
+        path: 'tools/scan_secrets.js',
+        command: 'node tools/scan_secrets.js',
+        description: 'Security & API key leak scanner'
+      }
+    ];
+  }
+
+  provision(targetDir, config) {
+    // 1. Create docs/, sdds/, and tools/
+    super.provision(targetDir, config);
+
+    // 2. Write Dual-Layer AGENTS.md
+    const dualLayerAgents = `# Standard Operating Procedure (SOP) — AGENTS
+Governed by **CLC Kernel: The Universal AI Agent Governance Engine**.
+Target System: **${this.name}**
+
+---
+
+## 🛠️ Layer 1: Development & Maintenance Governance (Engineering)
+All AI Agents (Antigravity, OpenCode, Claude Code, Cursor, Windsurf, Copilot) developing or maintaining this codebase MUST adhere to strict engineering standards:
+
+> 🚨 **RULE #0: MANDATORY EXECUTION OVERRIDE RULE (UNBYPASSABLE)**
+> Even when the user issues a direct or urgent fix request ("fix this bug", "fix this error", "quick fix"):
+> YOU ARE STRICTLY FORBIDDEN from modifying source code or workflows directly without completing the full quality harness:
+> 1. **Research & Root Cause Analysis:** Investigate tracebacks and affected files before editing.
+> 2. **SDD Specification:** Document non-trivial changes in \`sdds/{change-name}/01-spec.md\` (gitignored).
+> 3. **Verification (Red Phase):** Write a failing test or contract validation first.
+> 4. **Clean Implementation (Green Phase):** Make tests pass maintaining strict layer isolation.
+> 5. **Mandatory Audit Gate:** Execute \`node tools/audit.js\` and output summary to stdout.
+
+### Engineering Rules
+1. **Conventional Commits Only**: Commits must use Conventional Commits (e.g. \`feat(...): ...\`, \`fix(...): ...\`). NEVER add \`Co-Authored-By\` or AI attribution.
+2. **Mirror Links Interoperability**: \`CLAUDE.md\`, \`GEMINI.md\`, \`.cursorrules\`, and \`.windsurfrules\` must remain valid symlinks to \`AGENTS.md\`.
+3. **No Superficial Symptom Patches**: Always address root causes.
+
+---
+
+## 🚀 Layer 2: Domain Runtime Directives (Agent Workflows & Operations)
+When operating as domain agents for end-users and non-technical operators:
+
+1. **Non-Technical Operator Friendly**: Interact naturally with the operator. Guide step-by-step through conversational prompts without technical jargon.
+2. **Mandatory Human-in-the-Loop (HITL) Checkpoints**: Always pause phase-by-phase during multi-step pipelines. Present draft output and WAIT for explicit user confirmation before executing irreversible steps.
+3. **SSOT Memory Primacy**: Always read from and persist to designated single-source-of-truth memory files (e.g. \`brand/client-profile.md\` or \`docs/\`).
+4. **Clean Creation State (No Hallucinated Data)**: When new records, calendars, or deliverables are drafted, metric fields must initialize as \`null\` / empty. Never invent fictional stats.
+5. **Deterministic Output Standard**: Outputs must strictly follow valid Markdown, JSON schema, or domain templates.
+
+---
+
+## 🛡️ Core AI Safeguards
+${this.getSafeguards().map(s => `- ${s}`).join('\n')}
+`;
+
+    fs.writeFileSync(path.join(targetDir, 'AGENTS.md'), dualLayerAgents, 'utf-8');
+
+    // 3. Create AI IDE mirror symlinks
+    const mirrors = ['CLAUDE.md', 'GEMINI.md', '.cursorrules', '.windsurfrules'];
+    for (const mirror of mirrors) {
+      const mirrorPath = path.join(targetDir, mirror);
+      try {
+        if (!fs.existsSync(mirrorPath)) {
+          fs.symlinkSync('AGENTS.md', mirrorPath);
+        }
+      } catch {}
+    }
+
+    // 4. Copy domain guard tools into tools/
+    const srcToolsDir = path.join(__dirname, '..', '..', 'tools');
+    const targetToolsDir = path.join(targetDir, 'tools');
+    const toolsToCopy = ['check_symlinks.js', 'check_hitl.js', 'check_domain_data.js', 'scan_secrets.js', 'audit.js'];
+
+    for (const toolFile of toolsToCopy) {
+      const srcFile = path.join(srcToolsDir, toolFile);
+      const destFile = path.join(targetToolsDir, toolFile);
+      if (fs.existsSync(srcFile) && !fs.existsSync(destFile)) {
+        try {
+          fs.copyFileSync(srcFile, destFile);
+        } catch {}
+      }
+    }
+  }
+}
+
+module.exports = AgentOSAdapter;

package/src/catalog.js

@@ -110,6 +110,21 @@ const SAFEGUARD_CATALOG = [
     applies_when: 'docker', severity: 'error', gate_mode: 'hard', config_keys: ['scope', 'exclude_paths'],
     phase: 'audit', file: 'docker_guard.py', manifest: true, planned: false },
 
+  { name: 'check_symlinks', labels: ['check_symlinks', 'check_symlinks.js'],
+    checks: 'AI IDE symlinks and rule mirror verification', verify: ['verify_symlinks', 'verify_rule_mirrors'],
+    applies_when: 'agent-os', severity: 'error', gate_mode: 'hard', config_keys: ['scope'],
+    phase: 'audit', file: 'check_symlinks.js', manifest: true, planned: false },
+
+  { name: 'check_hitl', labels: ['check_hitl', 'check_hitl.js'],
+    checks: 'Human-in-the-Loop review checkpoint validator in subagent skills', verify: ['verify_hitl', 'verify_human_review_checkpoints'],
+    applies_when: 'agent-os', severity: 'error', gate_mode: 'hard', config_keys: ['scope'],
+    phase: 'audit', file: 'check_hitl.js', manifest: true, planned: false },
+
+  { name: 'check_domain_data', labels: ['check_domain_data', 'check_domain_data.js'],
+    checks: 'Domain deliverables schema and clean state integrity', verify: ['verify_domain_data', 'verify_clean_state_metrics'],
+    applies_when: 'agent-os', severity: 'error', gate_mode: 'hard', config_keys: ['scope'],
+    phase: 'audit', file: 'check_domain_data.js', manifest: true, planned: false },
+
   { name: 'ruff', labels: ['ruff'],
     checks: 'Python AST linter (external CLI)', verify: ['verify_python_lint'],
     applies_when: 'backend', severity: 'warning', gate_mode: 'advisory', config_keys: [],
@@ -172,6 +187,7 @@ const VALID_PHASES = ['audit', 'test', 'review', 'handover'];
 const VALID_APPLIES_WHEN = [
   'always', 'frontend', 'backend', 'fastapi', 'django', 'django|sqlalchemy',
   'celery', 'redis', 'postgresql', 'docker', 'frontend,backend', 'backend,fastapi,django',
+  'agent-os',
 ];
 
 /** Normalize an input label for catalog lookup. */

package/src/detector.js

@@ -15,9 +15,11 @@ const RailsAdapter = require('./adapters/rails');
 const GoAdapter = require('./adapters/go');
 const RustAdapter = require('./adapters/rust');
 const LaravelAdapter = require('./adapters/laravel');
+const AgentOSAdapter = require('./adapters/agent-os');
 const { TechnologyDetector } = require('./technologies/detector');
 
 const adapters = [
+  new AgentOSAdapter(),
   new NextjsAdapter(),
   new FastApiAdapter(),
   new DjangoAdapter(),

package/src/index.js

@@ -43,8 +43,19 @@ async function runCli() {
   const finalConfig = await promptOptions(detected);
 
   // 5. Generate Harness & Safeguards
+  let s;
+  if (Boolean(process.stdin.isTTY) && !process.env.CI) {
+    const p = require('@clack/prompts');
+    s = p.spinner();
+    s.start('Configurando salvaguardas y motor de gobernanza...');
+  }
+
   generateHarness(targetDir, finalConfig);
 
+  if (s) {
+    s.stop('Salvaguardas y motor de gobernanza configurados.');
+  }
+
   // 6. Render Pro Success Card
   printSuccess(targetDir, finalConfig.projectType === 'frontend', finalConfig);
 }

package/src/ui.js

@@ -3,7 +3,7 @@
  * Brand Identity: The AI Agent Governance & Quality Engineering Engine
  */
 
-const readline = require('readline');
+const p = require('@clack/prompts');
 
 // ANSI Color Palette
 const colors = {
@@ -33,7 +33,7 @@ function printBanner() {
   ╚██████╗███████╗╚██████╗     ██║ ╚██╗███████╗██║  ██║██║ ╚████║███████╗███████╗
    ╚═════╝╚══════╝ ╚═════╝     ╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝╚═╝  ╚═══╝╚══════╝╚══════╝
 ${colors.reset}`);
-  console.log(`  ${colors.bgCyan} CLC KERNEL ${colors.reset} ${colors.bold}The AI Agent Governance & Quality Engineering Engine${colors.reset} ${colors.gray}v1.2.4${colors.reset}\n`);
+  console.log(`  ${colors.bgCyan} CLC KERNEL ${colors.reset} ${colors.bold}The AI Agent Governance & Quality Engineering Engine${colors.reset} ${colors.gray}v1.2.6${colors.reset}\n`);
 }
 
 function printBox(title, items) {
@@ -52,44 +52,88 @@ function printBox(title, items) {
   console.log(`${colors.dim}└${'─'.repeat(width)}┘${colors.reset}\n`);
 }
 
-function promptOptions(detected) {
-  return new Promise((resolve) => {
-    const rl = readline.createInterface({
-      input: process.stdin,
-      output: process.stdout
-    });
-
-    console.log(`${colors.bold}   \x1b[32m[1]\x1b[0m Confirmar e Instalar CLC Kernel ${colors.dim}(Recomendado)${colors.reset}`);
-    console.log(`   \x1b[33m[2]\x1b[0m Forzar modo FRONTEND`);
-    console.log(`   \x1b[33m[3]\x1b[0m Forzar modo BACKEND`);
-    console.log(`   \x1b[90m[4] Cancelar${colors.reset}\n`);
-
-    rl.question(`${colors.cyan}${colors.bold}➔ Seleccioná una opción [1]: ${colors.reset}`, (answer) => {
-      const choice = answer.trim() || '1';
-      rl.close();
-
-      if (choice === '1') {
-        resolve(detected);
-      } else if (choice === '2') {
-        detected.projectType = 'frontend';
-        resolve(detected);
-      } else if (choice === '3') {
-        detected.projectType = 'backend';
-        resolve(detected);
-      } else {
-        console.log(`\n${colors.red}❌ Instalación de CLC Kernel cancelada.${colors.reset}`);
-        process.exit(0);
+async function promptOptions(detected) {
+  const isInteractive = Boolean(process.stdin.isTTY) &&
+    !process.env.CI &&
+    !process.argv.includes('--yes') &&
+    !process.argv.includes('-y');
+
+  if (!isInteractive) {
+    return detected;
+  }
+
+  p.intro(`${colors.cyan}${colors.bold}CLC Kernel Setup${colors.reset}`);
+
+  const choice = await p.select({
+    message: '¿Cómo deseas inicializar CLC Kernel en este proyecto?',
+    initialValue: 'confirm',
+    options: [
+      {
+        value: 'confirm',
+        label: 'Confirmar e Instalar CLC Kernel',
+        hint: `Recomendado (${detected.projectType.toUpperCase()} - ${detected.framework})`
+      },
+      {
+        value: 'frontend',
+        label: 'Forzar modo FRONTEND',
+        hint: 'Salvaguardas A11y, Zod, Next/Image, UI Reuse'
+      },
+      {
+        value: 'backend',
+        label: 'Forzar modo BACKEND',
+        hint: 'Salvaguardas TDD, Clean Arch, N+1, Secrets'
+      },
+      {
+        value: 'agent-os',
+        label: 'Forzar modo AGENT-OS',
+        hint: 'Salvaguardas HITL, Symlinks, Schemas, Memoria SSOT'
+      },
+      {
+        value: 'cancel',
+        label: 'Cancelar',
+        hint: 'Salir sin realizar cambios'
       }
-    });
+    ]
   });
+
+  if (p.isCancel(choice) || choice === 'cancel') {
+    p.cancel('Instalación de CLC Kernel cancelada.');
+    process.exit(0);
+  }
+
+  if (choice === 'frontend') {
+    detected.projectType = 'frontend';
+  } else if (choice === 'backend') {
+    detected.projectType = 'backend';
+  } else if (choice === 'agent-os') {
+    detected.projectType = 'agent-os';
+  }
+
+  return detected;
 }
 
 function printSuccess(targetDir, isFront, config) {
-  console.log(`\n${colors.bgEmerald} SUCCESS ${colors.reset} ${colors.bold}${colors.emerald}¡CLC Kernel instalado exitosamente!${colors.reset}\n`);
-  console.log(` 🔨 ${colors.bold}Proyecto Inicializado:${colors.reset} ${colors.cyan}${targetDir}${colors.reset}`);
-  console.log(` 🛡️  ${colors.bold}Salvaguardas:${colors.reset} ${isFront ? `${colors.emerald}10 Guardias Frontend (A11y, Zod, Next/Image, UI Reuse, Storybook)` : `${colors.violet}7 Guardias Backend (TDD, Architecture, Scope, Secret Scan)`}${colors.reset}`);
-  console.log(` 📝 ${colors.bold}Leyes & SDD:${colors.reset} AGENTS.md, sdds/, docs/Journal/ precargados`);
-  console.log(` 🔒 ${colors.bold}Git Hooks:${colors.reset} Configurados en ${colors.amber}${config.gitHooks === 'husky' ? '.husky/pre-commit' : '.githooks/pre-commit'}${colors.reset}\n`);
+  const isAgentOS = config.projectType === 'agent-os';
+  const guardsDesc = isAgentOS
+    ? `${colors.cyan}6 Guardias Agent-OS (HITL, Symlinks, Schemas, Memoria, Secrets)${colors.reset}`
+    : isFront
+    ? `${colors.emerald}10 Guardias Frontend (A11y, Zod, Image, UI Reuse, Storybook)${colors.reset}`
+    : `${colors.violet}7 Guardias Backend (TDD, Architecture, Scope, Secret Scan)${colors.reset}`;
+
+  const summary = [
+    `🔨 ${colors.bold}Proyecto Inicializado:${colors.reset} ${colors.cyan}${targetDir}${colors.reset}`,
+    `🛡️  ${colors.bold}Salvaguardas:${colors.reset} ${guardsDesc}`,
+    `📝 ${colors.bold}Leyes & SDD:${colors.reset} AGENTS.md, sdds/, docs/Journal/ precargados`,
+    `🔒 ${colors.bold}Git Hooks:${colors.reset} Configurados en ${colors.amber}${config.gitHooks === 'husky' ? '.husky/pre-commit' : '.githooks/pre-commit'}${colors.reset}`
+  ].join('\n');
+
+  if (p.note && p.outro) {
+    p.note(summary, '🚀 Resumen de Instalación');
+    p.outro(`${colors.emerald}${colors.bold}¡CLC Kernel instalado exitosamente!${colors.reset}`);
+  } else {
+    console.log(`\n${colors.bgEmerald} SUCCESS ${colors.reset} ${colors.bold}${colors.emerald}¡CLC Kernel instalado exitosamente!${colors.reset}\n`);
+    console.log(summary + '\n');
+  }
 }
 
 module.exports = {

package/tools/check_domain_data.js

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+/**
+ * Domain Data Integrity & Clean State Guard
+ * Validates domain deliverables (content.json, calendar.json, voc.json)
+ * to ensure valid JSON structure and clean creation state (no fake hallucinated metrics on pending posts).
+ * Self-contained: uses only Node.js built-ins.
+ *
+ * @param {string} targetDir - Directory to scan (defaults to cwd)
+ * @returns {{ exitCode: number, skipped: boolean, name: string, data: object }}
+ */
+const check = async function checkDomainData(targetDir) {
+  const fs = require('fs');
+  const path = require('path');
+
+  const dir = targetDir || process.cwd();
+  const searchDirs = [
+    dir,
+    path.join(dir, 'output'),
+    path.join(dir, 'content-calendar'),
+    path.join(dir, 'data')
+  ];
+
+  const jsonFiles = [];
+  for (const sDir of searchDirs) {
+    if (fs.existsSync(sDir)) {
+      try {
+        const files = fs.readdirSync(sDir);
+        for (const file of files) {
+          if (file.endsWith('.json') && !file.includes('package') && !file.includes('tsconfig')) {
+            jsonFiles.push(path.join(sDir, file));
+          }
+        }
+      } catch {}
+    }
+  }
+
+  if (jsonFiles.length === 0) {
+    return {
+      exitCode: 0,
+      skipped: true,
+      name: 'check_domain_data',
+      data: { violations: [], message: 'No domain data JSON files to validate' }
+    };
+  }
+
+  const violations = [];
+  for (const file of jsonFiles) {
+    try {
+      const raw = fs.readFileSync(file, 'utf-8');
+      const data = JSON.parse(raw);
+
+      // Clean Creation State Check: If array of posts/calendar entries
+      const entries = Array.isArray(data) ? data : (data.posts || data.items || data.calendar || []);
+      if (Array.isArray(entries)) {
+        for (let i = 0; i < entries.length; i++) {
+          const item = entries[i];
+          if (item && (item.status === 'pending' || item.status === 'draft')) {
+            // Check if metrics are falsely pre-filled with non-null numbers
+            if (item.metrics && typeof item.metrics === 'object') {
+              const fakeMetrics = Object.entries(item.metrics).filter(([_, val]) => typeof val === 'number' && val > 0);
+              if (fakeMetrics.length > 0) {
+                violations.push({
+                  file: path.relative(dir, file),
+                  message: `Entry #${i + 1} (${item.title || item.id || 'draft'}) has pre-filled fake metrics on pending/draft post`
+                });
+              }
+            }
+          }
+        }
+      }
+    } catch (err) {
+      violations.push({
+        file: path.relative(dir, file),
+        message: `JSON syntax or structural error: ${err.message}`
+      });
+    }
+  }
+
+  const exitCode = violations.length > 0 ? 1 : 0;
+  return {
+    exitCode,
+    skipped: false,
+    name: 'check_domain_data',
+    data: {
+      violations,
+      message: violations.length > 0
+        ? `${violations.length} domain data integrity violation(s) found`
+        : 'All domain deliverables & state data verified'
+    }
+  };
+};
+
+module.exports = check;
+
+if (require.main === module) {
+  check(process.argv[2]).then(result => {
+    console.log(JSON.stringify(result, null, 2));
+    process.exit(result.exitCode);
+  });
+}

package/tools/check_hitl.js

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+/**
+ * Human-in-the-Loop (HITL) Checkpoint Guard
+ * Ensures subagent playbooks and workflows in skills/ or .agents/skills/
+ * define mandatory user review or approval checkpoints before final output.
+ * Self-contained: uses only Node.js built-ins.
+ *
+ * @param {string} targetDir - Directory to scan (defaults to cwd)
+ * @returns {{ exitCode: number, skipped: boolean, name: string, data: object }}
+ */
+const check = async function checkHitl(targetDir) {
+  const fs = require('fs');
+  const path = require('path');
+
+  const dir = targetDir || process.cwd();
+  const searchDirs = [
+    path.join(dir, 'skills'),
+    path.join(dir, '.agents', 'skills')
+  ];
+
+  const skillFiles = [];
+  for (const sDir of searchDirs) {
+    if (fs.existsSync(sDir)) {
+      try {
+        const files = fs.readdirSync(sDir);
+        for (const file of files) {
+          if (file.endsWith('.md')) {
+            skillFiles.push(path.join(sDir, file));
+          }
+        }
+      } catch {}
+    }
+  }
+
+  if (skillFiles.length === 0) {
+    return {
+      exitCode: 0,
+      skipped: true,
+      name: 'check_hitl',
+      data: { violations: [], message: 'No skills/ or subagent playbook files found' }
+    };
+  }
+
+  const hitlKeywords = [
+    /human[- ]in[- ]the[- ]loop/i,
+    /hitl/i,
+    /checkpoint/i,
+    /approval/i,
+    /confirm/i,
+    /review/i,
+    /pausa/i,
+    /aprobaci[oó]n/i,
+    /esperar/i,
+    /validaci[oó]n/i
+  ];
+
+  const violations = [];
+  for (const file of skillFiles) {
+    try {
+      const content = fs.readFileSync(file, 'utf-8');
+      const hasHitl = hitlKeywords.some(kw => kw.test(content));
+
+      if (!hasHitl) {
+        violations.push({
+          file: path.relative(dir, file),
+          message: 'Skill/Playbook missing mandatory Human-in-the-Loop (HITL) review checkpoint'
+        });
+      }
+    } catch {}
+  }
+
+  const exitCode = violations.length > 0 ? 1 : 0;
+  return {
+    exitCode,
+    skipped: false,
+    name: 'check_hitl',
+    data: {
+      violations,
+      message: violations.length > 0
+        ? `${violations.length} skill(s) missing mandatory Human-in-the-Loop checkpoints`
+        : 'All subagent skills include mandatory Human-in-the-Loop (HITL) checkpoints'
+    }
+  };
+};
+
+module.exports = check;
+
+if (require.main === module) {
+  check(process.argv[2]).then(result => {
+    console.log(JSON.stringify(result, null, 2));
+    process.exit(result.exitCode);
+  });
+}

package/tools/check_seo.js

@@ -90,7 +90,7 @@ const check = async function checkSeo(targetDir) {
       }
 
       // Check for Hero / Banner images without priority (Core Web Vitals / LCP)
-      if (/(?:hero|banner|cover|hero-image|heroImage|HeroBanner)/i.test(line) && /<(?:img|Image)\b/i.test(line)) {
+      if (/\b(?:hero|banner|hero-image|heroImage|heroBanner)\b/i.test(line) && /<(?:img|Image)\b/i.test(line)) {
         if (!/priority|fetchpriority|loading\s*=\s*['"]eager['"]/i.test(line)) {
           fileViolations.push({
             lineNo: i + 1,