crbro-memory 2.10.0 → 2.11.0

package/dist/sync/validate.js

@@ -0,0 +1,204 @@
+"use strict";
+// ─── CRBRO Shared Memory: what comes from outside ────────────────
+//
+// Space names, remotes and branches come from a tool call (so possibly from
+// text the model was shown); neuron directories and ops come from teammates'
+// pushes. Each of them used to be joined into a path, passed to git or written
+// into a neuron as it came. These checks are the one place that says what
+// shapes are accepted (G1, G5, G16).
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NEURON_DIR_RE = exports.SPACE_NAME_RE = void 0;
+exports.spaceNameProblem = spaceNameProblem;
+exports.safeSpaceDir = safeSpaceDir;
+exports.remoteProblem = remoteProblem;
+exports.branchProblem = branchProblem;
+exports.cleanAuthor = cleanAuthor;
+exports.sanitizeIncomingOps = sanitizeIncomingOps;
+const node_path_1 = __importDefault(require("node:path"));
+const secrets_js_1 = require("../engine/secrets.js");
+const WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i;
+/** A space name is a folder under shared/: a short slug, nothing that walks. */
+exports.SPACE_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+function spaceNameProblem(name) {
+    if (typeof name !== 'string' || !exports.SPACE_NAME_RE.test(name)) {
+        return 'Space names are 1-64 letters, digits, "-" or "_", starting with a letter or digit (e.g. "equipo").';
+    }
+    if (WINDOWS_RESERVED.test(name))
+        return `"${name}" is a reserved device name on Windows.`;
+    return null;
+}
+/** Throws unless `name` is a valid space name whose folder stays inside `sharedRoot`. */
+function safeSpaceDir(sharedRoot, name) {
+    const problem = spaceNameProblem(name);
+    if (problem)
+        throw new Error(`Invalid space name. ${problem}`);
+    const root = node_path_1.default.resolve(sharedRoot);
+    const dir = node_path_1.default.resolve(root, name);
+    const rel = node_path_1.default.relative(root, dir);
+    if (!rel || rel.startsWith('..') || node_path_1.default.isAbsolute(rel) || rel.includes(node_path_1.default.sep) || rel.includes('/')) {
+        throw new Error('Invalid space name: it must name a folder directly inside shared/.');
+    }
+    return dir;
+}
+/**
+ * A remote: a git URL or a local path. Never an option ("-…"), never with a
+ * password or token inside (it would be stored in .git/config in clear and
+ * echoed back in messages), never with control characters.
+ */
+function remoteProblem(remote) {
+    if (typeof remote !== 'string' || !remote.trim())
+        return 'A remote is required.';
+    if (remote.length > 2048)
+        return 'That remote is too long.';
+    if (remote.startsWith('-'))
+        return 'A remote cannot start with "-".';
+    if (/[\u0000-\u001f\u007f]/.test(remote))
+        return 'A remote cannot contain control characters.';
+    const url = /^([a-z][a-z0-9+.-]*):\/\/([^/?#]*)/i.exec(remote);
+    if (url) {
+        const scheme = url[1].toLowerCase();
+        const authority = url[2];
+        const at = authority.lastIndexOf('@');
+        if (at !== -1) {
+            const userinfo = authority.slice(0, at);
+            if (scheme === 'http' || scheme === 'https' || userinfo.includes(':')) {
+                return 'The remote carries credentials (user:password@ or token@). Remove them: use an SSH URL or a credential helper. ' +
+                    'A URL with a credential would be written in clear to .git/config.';
+            }
+        }
+    }
+    if ((0, secrets_js_1.secretKinds)(remote).length > 0)
+        return 'The remote looks like it contains a credential. Remove it from the URL.';
+    return null;
+}
+/** git check-ref-format rules, the subset a branch name here needs. */
+function branchProblem(branch) {
+    if (typeof branch !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._/-]{0,99}$/.test(branch) ||
+        branch.includes('..') || branch.includes('//') || branch.endsWith('/') || branch.endsWith('.') ||
+        branch.endsWith('.lock') || branch.includes('@{') || /\/\./.test(branch)) {
+        return 'Branch names are letters, digits, ".", "_", "-" or "/", starting with a letter or digit (e.g. "main").';
+    }
+    return null;
+}
+/** A neuron folder name in a space: what CRBRO itself would have written. */
+exports.NEURON_DIR_RE = /^[a-z0-9][a-z0-9_-]{0,159}$/;
+const KNOWN_OPS = new Set(['neuron', 'fact', 'status', 'decision', 'pattern', 'tag', 'error', 'map', 'purge', 'debt', 'verify']);
+const NEURON_TYPES = new Set(['project', 'tech', 'lang', 'person', 'domain', 'process', 'protocol']);
+const MAX_TEXT = 20_000;
+const MAX_ID = 128;
+function cleanText(v, max = MAX_TEXT) {
+    if (typeof v !== 'string')
+        return null;
+    return (0, secrets_js_1.redact)(v.length > max ? v.slice(0, max) : v).text;
+}
+function cleanId(v) {
+    return typeof v === 'string' && v.length > 0 && v.length <= MAX_ID ? v : null;
+}
+/** Same charset as getIdentity, 32 characters: `by` ends up in `origin` labels. */
+function cleanAuthor(v) {
+    const s = typeof v === 'string' ? v.toLowerCase().replace(/[^a-z0-9_-]/g, '').slice(0, 32) : '';
+    return s || 'unknown';
+}
+/**
+ * Ops read from a teammate's log for the folder `nid`, made safe to merge:
+ * an op that names another neuron is dropped (the folder decides, so a planted
+ * `nid` cannot steer where a neuron is written); text is capped and passed
+ * through the secret filter; authors, ids, confidences and kinds are checked.
+ * Returns the ops kept and how many were dropped.
+ */
+function sanitizeIncomingOps(nid, ops) {
+    const out = [];
+    let dropped = 0;
+    for (const raw of ops) {
+        const op = raw;
+        if (!op || typeof op !== 'object' || op['nid'] !== nid || typeof op['op'] !== 'string' || !KNOWN_OPS.has(op['op'])) {
+            dropped++;
+            continue;
+        }
+        const at = typeof op['at'] === 'string' && op['at'].length <= 40 ? op['at'] : '';
+        const base = { ...op, nid, by: cleanAuthor(op['by']), at };
+        let kept = null;
+        switch (op['op']) {
+            case 'neuron': {
+                const name = cleanText(op['name'], 200);
+                kept = {
+                    ...base,
+                    name: name ?? nid,
+                    ntype: typeof op['ntype'] === 'string' && NEURON_TYPES.has(op['ntype']) ? op['ntype'] : 'project',
+                    domain: typeof op['domain'] === 'string' ? op['domain'].toLowerCase().replace(/[^a-z0-9_-]/g, '').slice(0, 60) || 'general' : 'general',
+                };
+                break;
+            }
+            case 'fact': {
+                const text = cleanText(op['text']);
+                const fid = cleanId(op['fid']);
+                if (text === null || !fid)
+                    break;
+                const conf = typeof op['conf'] === 'number' && Number.isFinite(op['conf']) ? Math.min(1, Math.max(0, op['conf'])) : 1;
+                const keys = Array.isArray(op['keys'])
+                    ? op['keys'].filter((k) => typeof k === 'string').slice(0, 8).map(k => (0, secrets_js_1.redact)(k.slice(0, 120)).text)
+                    : undefined;
+                kept = { ...base, text, fid, conf, ...(keys ? { keys } : {}),
+                    ...(typeof op['src'] === 'string' ? { src: op['src'].slice(0, 60) } : {}) };
+                if (!keys)
+                    delete kept['keys'];
+                break;
+            }
+            case 'status': {
+                const fid = cleanId(op['fid']);
+                if (!fid || (op['to'] !== 'superseded' && op['to'] !== 'retracted'))
+                    break;
+                const why = op['why'] === undefined ? undefined : cleanText(op['why'], 2_000) ?? undefined;
+                kept = { ...base, fid, why };
+                if (why === undefined)
+                    delete kept['why'];
+                break;
+            }
+            case 'decision': {
+                const text = cleanText(op['text']);
+                const did = cleanId(op['did']);
+                if (text === null || !did)
+                    break;
+                const why = op['why'] === undefined ? undefined : cleanText(op['why'], 4_000) ?? undefined;
+                kept = { ...base, text, did, why };
+                if (why === undefined)
+                    delete kept['why'];
+                break;
+            }
+            case 'pattern':
+            case 'tag':
+            case 'error':
+            case 'debt':
+            case 'map': {
+                const text = cleanText(op['text'], op['op'] === 'tag' ? 200 : MAX_TEXT);
+                if (text === null)
+                    break;
+                kept = { ...base, text };
+                break;
+            }
+            case 'purge': {
+                const key = cleanId(op['key']);
+                if (!key)
+                    break;
+                kept = { ...base, key };
+                break;
+            }
+            case 'verify': {
+                const eid = cleanId(op['eid']);
+                if (!eid || (op['ekind'] !== 'fact' && op['ekind'] !== 'entry'))
+                    break;
+                kept = { ...base, eid };
+                break;
+            }
+        }
+        if (kept)
+            out.push(kept);
+        else
+            dropped++;
+    }
+    return { ops: out, dropped };
+}
+//# sourceMappingURL=validate.js.map

package/dist/utils/budget.js

@@ -87,13 +87,20 @@ function fitToBudget(payload, opts = {}) {
             }
         }
     };
+    // The block a path belongs to: "open_items[3].text" → "open_items".
+    const topKey = (p) => p.split(/[.[]/)[0];
+    const order = opts.dropFirst ?? [];
+    const rank = (p) => {
+        const i = order.indexOf(topKey(p));
+        return i === -1 ? order.length : i;
+    };
     let guard = 0;
     while (size(copy) > budget && guard++ < 200) {
         const found = [];
         arraysOf(copy, '', found);
         const biggest = found
             .filter(a => a.arr.length > 1)
-            .sort((a, b) => size(b.arr) - size(a.arr))[0];
+            .sort((a, b) => rank(a.path) - rank(b.path) || size(b.arr) - size(a.arr))[0];
         if (!biggest)
             break;
         const total = dropped[biggest.path]?.total ?? biggest.arr.length;
@@ -116,7 +123,13 @@ function fitToBudget(payload, opts = {}) {
     }
     if (Object.keys(dropped).length)
         report.entries_dropped = dropped;
-    if (opts.howToGetMore)
+    if (report.returned_chars > budget)
+        report.over_budget_after_cuts = true;
+    const cutKeys = [...new Set([...Object.keys(shortened), ...Object.keys(dropped)].map(topKey))];
+    const doors = opts.moreByKey ? cutKeys.map(k => opts.moreByKey[k]).filter(Boolean) : [];
+    if (doors.length)
+        report.how_to_get_more = [...new Set(doors)].join(' ');
+    else if (opts.howToGetMore)
         report.how_to_get_more = opts.howToGetMore;
     copy.truncated = report;
     return copy;

package/dist/utils/fs.js

@@ -5,6 +5,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CorruptJSONError = void 0;
+exports.stripBOM = stripBOM;
 exports.readJSON = readJSON;
 exports.writeJSON = writeJSON;
 exports.fileExists = fileExists;
@@ -19,20 +21,52 @@ exports.now = now;
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
 const lock_js_1 = require("./lock.js");
+/**
+ * A file that exists and cannot be parsed. Its own class so a reader that
+ * walks the whole cortex can skip it, say which file and move on, instead of
+ * letting one bad neuron take recall, maintenance and consolidate down with it.
+ * The message keeps the 2.x wording ("Corrupted JSON at <path>").
+ */
+class CorruptJSONError extends Error {
+    path;
+    reason;
+    constructor(path, reason) {
+        super(`CRBRO: Corrupted JSON at ${path}: ${reason}`);
+        this.path = path;
+        this.reason = reason;
+        this.name = 'CorruptJSONError';
+    }
+}
+exports.CorruptJSONError = CorruptJSONError;
+/**
+ * Text of a JSON file without a leading byte-order mark. Windows PowerShell
+ * 5.1 (`Set-Content -Encoding utf8`, `Out-File`) writes one, and JSON.parse
+ * rejects it: a neuron edited by hand that way became "corrupted" for every
+ * reader although every byte of its content was fine.
+ */
+function stripBOM(text) {
+    return text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+}
 /**
  * Safely read and parse a JSON file. Returns null if file doesn't exist.
- * Never throws on missing file — only on corrupted JSON.
+ * Never throws on missing file — only on corrupted JSON (CorruptJSONError).
  */
 async function readJSON(filePath) {
+    let content;
     try {
-        const content = await node_fs_1.promises.readFile(filePath, 'utf-8');
-        return JSON.parse(content);
+        content = await node_fs_1.promises.readFile(filePath, 'utf-8');
     }
     catch (err) {
         if (err instanceof Error && 'code' in err && err.code === 'ENOENT') {
             return null;
         }
-        throw new Error(`CRBRO: Corrupted JSON at ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
+        throw new CorruptJSONError(filePath, err instanceof Error ? err.message : String(err));
+    }
+    try {
+        return JSON.parse(stripBOM(content));
+    }
+    catch (err) {
+        throw new CorruptJSONError(filePath, err instanceof Error ? err.message : String(err));
     }
 }
 /**
@@ -88,13 +122,13 @@ async function fileExists(filePath) {
  *
  * The mutator returns the value to write, or null to leave the file alone.
  */
-async function updateJSON(filePath, mutate) {
+async function updateJSON(filePath, mutate, options) {
     return (0, lock_js_1.withLock)(filePath, async () => {
         const current = await readJSON(filePath);
         const next = await mutate(current);
         if (next === null)
             return current;
-        await writeJSON(filePath, next);
+        await writeJSON(filePath, next, options);
         return next;
     });
 }

package/dist/utils/ids.js

@@ -3,13 +3,16 @@
 // Generate and validate neuron/synapse IDs
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.toSnakeCase = toSnakeCase;
+exports.slugCandidates = slugCandidates;
 exports.legacySnakeCase = legacySnakeCase;
 exports.neuronId = neuronId;
+exports.typeOfIdShape = typeOfIdShape;
 exports.synapseId = synapseId;
 exports.sessionId = sessionId;
 exports.isValidNeuronId = isValidNeuronId;
 exports.techKeywordIn = techKeywordIn;
 exports.inferNeuronType = inferNeuronType;
+const node_crypto_1 = require("node:crypto");
 const TYPE_PREFIXES = {
     project: 'project_',
     tech: 'tech_',
@@ -20,10 +23,52 @@ const TYPE_PREFIXES = {
     protocol: 'protocol_',
 };
 /**
- * Convert a string to a valid snake_case ID.
- * "OctoChat Plugin" → "octochat_plugin"
+ * Names whose punctuation IS the identity. Without this, "C", "C++" and "C#"
+ * all slugged to "c" and shared one neuron. Applied before anything else, as
+ * whole words only, so "c++ tips" maps and "abc++" does not.
  */
-function toSnakeCase(str) {
+const SYMBOL_WORDS = [
+    [/(^|[^\p{L}\p{N}])c\+\+(?![\p{L}\p{N}])/giu, '$1cpp'],
+    [/(^|[^\p{L}\p{N}])c#(?![\p{L}\p{N}])/giu, '$1csharp'],
+    [/(^|[^\p{L}\p{N}])f#(?![\p{L}\p{N}])/giu, '$1fsharp'],
+];
+function mapSymbolWords(str) {
+    let out = str;
+    for (const [re, to] of SYMBOL_WORDS)
+        out = out.replace(re, to);
+    return out;
+}
+/** Latin letters NFD does not decompose: they used to vanish ("Straße" → "strae"). */
+const LATIN_EXTRA = {
+    'ß': 'ss', 'ẞ': 'ss', 'ø': 'o', 'Ø': 'o', 'ł': 'l', 'Ł': 'l', 'đ': 'd', 'Đ': 'd', 'ð': 'd', 'Ð': 'd',
+    'þ': 'th', 'Þ': 'th', 'æ': 'ae', 'Æ': 'ae', 'œ': 'oe', 'Œ': 'oe', 'ı': 'i', 'ħ': 'h', 'Ħ': 'h',
+};
+/** Trivial one-to-one transliteration: Greek and Cyrillic. Anything else is hashed. */
+const TRANSLIT = (() => {
+    const t = {};
+    const cyr = 'а:a б:b в:v г:g д:d е:e ё:e ж:zh з:z и:i й:y к:k л:l м:m н:n о:o п:p р:r с:s т:t у:u ф:f х:kh ц:ts ч:ch ш:sh щ:shch ъ: ы:y ь: э:e ю:yu я:ya і:i ї:yi є:ye ґ:g ў:u';
+    const gre = 'α:a β:v γ:g δ:d ε:e ζ:z η:i θ:th ι:i κ:k λ:l μ:m ν:n ξ:x ο:o π:p ρ:r σ:s ς:s τ:t υ:y φ:f χ:ch ψ:ps ω:o';
+    for (const pair of `${cyr} ${gre}`.split(' ')) {
+        const [k, v] = pair.split(':');
+        t[k] = v;
+    }
+    return t;
+})();
+function transliterate(str) {
+    let out = '';
+    for (const ch of str) {
+        const lower = ch.toLowerCase();
+        if (LATIN_EXTRA[ch] !== undefined)
+            out += LATIN_EXTRA[ch];
+        else if (TRANSLIT[lower] !== undefined)
+            out += TRANSLIT[lower];
+        else
+            out += ch;
+    }
+    return out;
+}
+/** The 2.10 algorithm, kept as a lookup fallback: neurons created by it live under its slugs. */
+function slug210(str) {
     return str
         .normalize('NFD') // Split accents off their letters...
         .replace(/[\u0300-\u036f]/g, '') // ...and drop the accents, keeping the letter
@@ -34,6 +79,55 @@ function toSnakeCase(str) {
         .replace(/_+/g, '_') // Collapse multiple underscores
         .replace(/^_|_$/g, ''); // Trim leading/trailing underscores
 }
+/**
+ * Convert a string to a valid snake_case ID.
+ * "OctoChat Plugin" → "octochat_plugin"
+ *
+ * Never empty for a name that has any character in it: a name whose letters
+ * are not Latin (and not trivially transliterable) gets a short stable hash of
+ * the whole name, so "東京" and "大阪" are two neurons, not one called
+ * "project_" that every such topic fell into.
+ */
+function toSnakeCase(str) {
+    return slugOf(str).slug;
+}
+function slugOf(str) {
+    const raw = (str || '').trim();
+    if (!raw)
+        return { slug: '', hashed: false };
+    const folded = mapSymbolWords(raw).normalize('NFD').replace(/[\u0300-\u036f]/g, '').normalize('NFC');
+    const prepared = transliterate(folded);
+    const base = slug210(prepared);
+    // Letters or digits that are still not a-z/0-9 were dropped by slug210:
+    // their information must not be lost, or two names differing only there
+    // would collide.
+    const lost = /[^\x00-\x7f]/.test(prepared.replace(/[^\p{L}\p{N}]/gu, ''));
+    if (base && !lost)
+        return { slug: base, hashed: false };
+    const hash = (0, node_crypto_1.createHash)('sha1').update(raw.normalize('NFC').toLowerCase(), 'utf8').digest('hex').slice(0, 8);
+    return { slug: base ? `${base}_u${hash}` : `u${hash}`, hashed: true };
+}
+/**
+ * Every slug an existing neuron for this name may be filed under, newest rule
+ * first: the current one, the 2.10 one, and the pre-1.x accent-mangling one.
+ * The older two are computed on the symbol-mapped name, so "C++" never falls
+ * back to the "c" that 2.10 gave it — that fallback is exactly the merge the
+ * new rule exists to stop. Nor does a name the new rule had to hash: 2.10
+ * dropped its letters, so its old slug is shared by unrelated names.
+ */
+function slugCandidates(name) {
+    const out = [];
+    const add = (s) => { if (s && !out.includes(s))
+        out.push(s); };
+    const actual = slugOf(name);
+    add(actual.slug);
+    if (actual.hashed)
+        return out;
+    const mapped = mapSymbolWords((name || '').trim());
+    add(slug210(mapped));
+    add(legacySnakeCase(mapped));
+    return out;
+}
 /**
  * How ids were built before accents were folded: the accented letter was
  * deleted whole, so "búsqueda" became "bsqueda" and "técnico" became "tcnico".
@@ -57,9 +151,21 @@ function legacySnakeCase(str) {
  */
 function neuronId(name, type) {
     const prefix = TYPE_PREFIXES[type];
-    const slug = toSnakeCase(name);
+    let slug = toSnakeCase(name);
+    // A name that already is an id of this type ("project_x") keeps its one
+    // prefix: it used to become "project_project_x".
+    if (slug.startsWith(prefix) && slug.length > prefix.length)
+        slug = slug.slice(prefix.length);
     return `${prefix}${slug}`;
 }
+/** The type an id-shaped slug names ("tech_react" → tech), or null. */
+function typeOfIdShape(slug) {
+    for (const [type, prefix] of Object.entries(TYPE_PREFIXES)) {
+        if (slug.startsWith(prefix) && slug.length > prefix.length)
+            return type;
+    }
+    return null;
+}
 /**
  * Generate a synapse ID from two neuron IDs.
  * ("project_octochat", "tech_firebase") → "syn_octochat__firebase"
@@ -99,27 +205,35 @@ function techKeywordIn(text) {
 /**
  * Infer neuron type from topic name using simple heuristics.
  * Falls back to 'project' if unsure.
+ *
+ * Whole words only (accents folded). Substrings sent "Juego Onoris Lanista"
+ * to lang_ ("go "), "PAGO UNICO" too, and anything "digital" to tech_ ("git").
+ * The type is the id prefix, so a wrong guess is a wrong identity.
  */
 function inferNeuronType(topic) {
-    const lower = topic.toLowerCase();
+    const folded = (topic || '').normalize('NFD').replace(/[\u0300-\u036f]/g, '').toLowerCase().trim();
+    const words = new Set(folded.split(/[^a-z0-9]+/).filter(Boolean));
+    const has = (kw) => words.has(kw);
     // Tech keywords
-    if (TECH_KEYWORDS.some(kw => lower.includes(kw)))
+    if (TECH_KEYWORDS.some(has))
         return 'tech';
     // Language keywords
-    const langKeywords = ['python', 'javascript', 'typescript', 'php', 'rust', 'go', 'java', 'swift', 'kotlin', 'css', 'html', 'sql'];
-    if (langKeywords.some(kw => lower === kw || lower.includes(` ${kw}`) || lower.includes(`${kw} `)))
+    const langKeywords = ['python', 'javascript', 'typescript', 'php', 'rust', 'go', 'golang', 'java', 'swift', 'kotlin', 'css', 'html', 'sql'];
+    if (langKeywords.some(has))
         return 'lang';
     // Process keywords
-    const processKeywords = ['deploy', 'migration', 'workflow', 'pipeline', 'ci/cd', 'backup', 'setup', 'install'];
-    if (processKeywords.some(kw => lower.includes(kw)))
+    const processKeywords = ['deploy', 'migration', 'workflow', 'pipeline', 'backup', 'setup', 'install'];
+    if (processKeywords.some(has) || /(^|[^a-z0-9])ci\/cd([^a-z0-9]|$)/.test(folded))
         return 'process';
     // Domain keywords
     const domainKeywords = ['seo', 'marketing', 'trading', 'crypto', 'design', 'security', 'devops', 'data', 'analytics'];
-    if (domainKeywords.some(kw => lower === kw))
+    if (domainKeywords.some(kw => folded === kw))
         return 'domain';
-    // Protocol keywords
-    const protocolKeywords = ['protocol', 'directive', 'rule', 'enforcement', 'behavioral'];
-    if (protocolKeywords.some(kw => lower.includes(kw)))
+    // Protocol keywords. "protocolo" keeps working: a Spanish protocol neuron
+    // is injected at boot, and the substring rule always caught it.
+    const protocolKeywords = ['protocol', 'protocols', 'protocolo', 'protocolos', 'directive', 'directives', 'directiva', 'directivas',
+        'rule', 'rules', 'enforcement', 'behavioral'];
+    if (protocolKeywords.some(has))
         return 'protocol';
     // Default to project
     return 'project';