cyber-sdd 0.6.1 → 0.7.1

package/skills/check-retired-terms/SKILL.md

@@ -13,8 +13,7 @@ retires a path, directory, or naming convention, and records it once in
 `.agents/sdd/retired-terms.toml`. This engine guards that the retirement holds: it scans every
 git-tracked file in the repo — not only the node someone happened to touch — for a literal,
 case-sensitive occurrence of a registered term, and reports every survivor as `file:line:term` with
-the replacement to use. It carries a self-contained `.mts` script (the repo's node-≥23.6 / no-deps
-convention), parsing the registry with the same minimal hand-rolled TOML subset `discover-specs`
+the replacement to use. It carries a self-contained `.mjs` script (compiled from `src/`; no runtime deps, Node ≥22.11), parsing the registry with the same minimal hand-rolled TOML subset `discover-specs`
 already uses for `spec-anchors.toml`.
 
 It is the corpus-wide, declared-data sibling of `check:metaphor-free`
@@ -56,8 +55,8 @@ allow = [                                       # optional: sanctioned occurrenc
 ## Run the scan
 
 ```bash
-node "<skill>/scripts/check-retired-terms.mts" [--root .]         # the verify-time sweep
-node "<skill>/scripts/check-retired-terms.mts" [--root .] --list  # what is registered
+node "<skill>/scripts/check-retired-terms.mjs" [--root .]         # the verify-time sweep
+node "<skill>/scripts/check-retired-terms.mjs" [--root .] --list  # what is registered
 ```
 
 - Default `--root` is the current directory.
@@ -67,7 +66,7 @@ node "<skill>/scripts/check-retired-terms.mts" [--root .] --list  # what is regi
   non-zero, because the registry *is* the check.
 - **`--list`** prints each registered term with its `since` and `replacement`, and exits 0. With no
   registry, it states plainly that nothing is registered — a definitive empty state, not silence.
-- Wired into `check:specs` (`node …/check-retired-terms.mts --root .`), so it runs on every
+- Wired into `check:specs` (`node …/check-retired-terms.mjs --root .`), so it runs on every
   `pnpm verify` and in CI.
 
 When `node` is absent, an agent performs the same derivation by hand: read

package/skills/check-retired-terms/scripts/check-retired-terms.mjs

@@ -0,0 +1,186 @@
+#!/usr/bin/env node
+// Compiled by `universal-plugin plugin build` from src/check-retired-terms/check-retired-terms.mts. Edit the source, not this file.
+globalThis.__SKILL_SCRIPT__ = {"package":null,"bin":null,"version":"0.7.1","entry":"skills/check-retired-terms/scripts/check-retired-terms.mjs","commands":{}};
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+//#region src/check-retired-terms/check-retired-terms.mts
+var RegistryParseError = class extends Error {};
+const REGISTRY_PATH = ".agents/sdd/retired-terms.toml";
+function isBlankOrComment(line) {
+	const t = line.trim();
+	return t === "" || t.startsWith("#");
+}
+function extractString(block, key) {
+	const m = new RegExp(`(^|\\n)\\s*${key}\\s*=\\s*"([^"]*)"[^\\n]*`).exec(block);
+	if (!m) throw new RegistryParseError(`[[retired]] entry is missing a string "${key}"`);
+	return m[2];
+}
+function extractArray(block, key) {
+	const openMatch = new RegExp(`(^|\\n)\\s*${key}\\s*=\\s*\\[`).exec(block);
+	if (!openMatch) return [];
+	const openIdx = openMatch.index + openMatch[0].length - 1;
+	const closeIdx = block.indexOf("]", openIdx);
+	if (closeIdx === -1) throw new RegistryParseError(`"${key}" array is never closed with "]"`);
+	const arrText = block.slice(openIdx, closeIdx);
+	const out = [];
+	for (const q of arrText.matchAll(/"([^"]*)"/g)) out.push(q[1]);
+	return out;
+}
+/** Parses the registry's minimal TOML subset: an array of `[[retired]]` tables carrying string
+* keys (term/since/replacement, all required) and optional string-array keys (scope/allow). Throws
+* `RegistryParseError` on anything that does not fit that shape — an absent registry is handled by
+* the caller (`readRegistry`), not here; an empty/comment-only file parses to `[]`. */
+function parseRegistryToml(text) {
+	const marker = "[[retired]]";
+	const firstIdx = text.indexOf(marker);
+	if (firstIdx === -1) {
+		if (text.split("\n").every(isBlankOrComment)) return [];
+		throw new RegistryParseError("no [[retired]] table found and the file is not empty/comment-only");
+	}
+	if (!text.slice(0, firstIdx).split("\n").every(isBlankOrComment)) throw new RegistryParseError("content found before the first [[retired]] table header");
+	return text.slice(firstIdx).split(marker).slice(1).map((block) => {
+		const term = extractString(block, "term");
+		const since = extractString(block, "since");
+		const replacement = extractString(block, "replacement");
+		const scope = extractArray(block, "scope");
+		const allow = extractArray(block, "allow");
+		const entry = {
+			term,
+			since,
+			replacement
+		};
+		if (scope.length) entry.scope = scope;
+		if (allow.length) entry.allow = allow;
+		return entry;
+	});
+}
+/** Reads and parses the registry at `<root>/.agents/sdd/retired-terms.toml`. An absent file yields
+* `[]` (an "an absent registry sweeps clean" registry, not an error). A present-but-malformed file
+* throws `RegistryParseError` — the caller must surface that loudly and exit non-zero. */
+function readRegistry(root) {
+	const file = join(root, REGISTRY_PATH);
+	if (!existsSync(file)) return [];
+	return parseRegistryToml(readFileSync(file, "utf8"));
+}
+const DEFAULT_BUILTIN_EXCLUDED_FILES = [
+	REGISTRY_PATH,
+	"plugins/sdd/src/check-retired-terms/check-retired-terms.mts",
+	"plugins/sdd/src/check-retired-terms/check-retired-terms.test.mts",
+	".agents/specs/sdd/corpus/retired-terms/README.md",
+	".agents/specs/sdd/corpus/retired-terms/retired-terms.feature"
+];
+const DEFAULT_BUILTIN_EXCLUDED_PREFIXES = [".agents/plans/"];
+function isUnderLedgerDir(relPath) {
+	return relPath.split("/").slice(0, -1).includes("ledger");
+}
+function isBuiltinExcluded(relPath, excludedFiles, excludedPrefixes) {
+	if (excludedFiles.includes(relPath)) return true;
+	if (excludedPrefixes.some((p) => relPath.startsWith(p))) return true;
+	if (isUnderLedgerDir(relPath)) return true;
+	return false;
+}
+function inScope(relPath, scope) {
+	if (!scope || scope.length === 0) return true;
+	return scope.some((prefix) => relPath.startsWith(prefix));
+}
+function parseAllowEntry(raw) {
+	const idx = raw.indexOf("::");
+	if (idx === -1) return { file: raw.trim() };
+	return {
+		file: raw.slice(0, idx).trim(),
+		substring: raw.slice(idx + 2).trim()
+	};
+}
+function isAllowed(relPath, lineText, allow) {
+	if (!allow) return false;
+	for (const raw of allow) {
+		const parsed = parseAllowEntry(raw);
+		if (parsed.file !== relPath) continue;
+		if (parsed.substring === void 0) return true;
+		if (lineText.includes(parsed.substring)) return true;
+	}
+	return false;
+}
+/** The git-tracked file set, repo-relative, one per line. An untracked file is outside the sweep
+* by construction — it is never in this list. */
+function listTrackedFiles(root) {
+	return execFileSync("git", ["ls-files"], {
+		cwd: root,
+		encoding: "utf8"
+	}).split("\n").filter((l) => l !== "");
+}
+/** Sweeps `root` for survivors of every entry in `entries`. `options` lets callers (tests)
+* substitute fixture-scoped config — the tracked-file source and the built-in exclusion lists —
+* in place of the real repo and the real defaults, mirroring `findMetaphorViolations`'s
+* `ScanOptions` (packages/cyberlegion/src/metaphor-free.ts). */
+function sweep(root, entries, options = {}) {
+	const listFiles = options.listTrackedFiles ?? listTrackedFiles;
+	const excludedFiles = options.builtinExcludedFiles ?? DEFAULT_BUILTIN_EXCLUDED_FILES;
+	const excludedPrefixes = options.builtinExcludedPrefixes ?? DEFAULT_BUILTIN_EXCLUDED_PREFIXES;
+	const violations = [];
+	for (const relPath of listFiles(root)) {
+		if (isBuiltinExcluded(relPath, excludedFiles, excludedPrefixes)) continue;
+		let text;
+		try {
+			text = readFileSync(join(root, relPath), "utf8");
+		} catch {
+			continue;
+		}
+		const lines = text.split("\n");
+		for (const entry of entries) {
+			if (!inScope(relPath, entry.scope)) continue;
+			lines.forEach((lineText, i) => {
+				if (!lineText.includes(entry.term)) return;
+				if (isAllowed(relPath, lineText, entry.allow)) return;
+				violations.push({
+					file: relPath,
+					line: i + 1,
+					term: entry.term,
+					replacement: entry.replacement
+				});
+			});
+		}
+	}
+	return violations.sort((a, b) => a.file !== b.file ? a.file < b.file ? -1 : 1 : a.line - b.line);
+}
+/** Renders `--list` output: one line per registered term with its `since` and `replacement`, or a
+* definitive empty-state line when nothing is registered — never silence. */
+function formatList(entries) {
+	if (entries.length === 0) return "check-retired-terms: no term is registered\n";
+	return entries.map((e) => `${e.term}  (since ${e.since})  -> ${e.replacement}\n`).join("");
+}
+/** Renders the sweep report: `file:line:term` plus the declared replacement, one per survivor
+* (every survivor, not just the first), then a count summary. */
+function formatViolations(violations) {
+	const lines = violations.map((v) => `${v.file}:${v.line}:${v.term} — replace with: ${v.replacement}\n`);
+	lines.push(`check-retired-terms: ${violations.length} survivor(s) found\n`);
+	return lines.join("");
+}
+function main(argv) {
+	const root = argv.includes("--root") ? argv[argv.indexOf("--root") + 1] ?? "." : ".";
+	const list = argv.includes("--list");
+	let entries;
+	try {
+		entries = readRegistry(root);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		process.stderr.write(`check-retired-terms: malformed registry — ${message}\n`);
+		return 1;
+	}
+	if (list) {
+		process.stdout.write(formatList(entries));
+		return 0;
+	}
+	const violations = sweep(root, entries);
+	if (violations.length === 0) {
+		process.stdout.write("check-retired-terms: clean — no survivors found\n");
+		return 0;
+	}
+	process.stdout.write(formatViolations(violations));
+	return 1;
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) process.exit(main(process.argv.slice(2)));
+//#endregion
+export { RegistryParseError, formatList, formatViolations, listTrackedFiles, main, parseRegistryToml, readRegistry, sweep };

package/skills/check-scenario-overlap/README.md

@@ -6,8 +6,8 @@ one node's `.feature`**, for the formation Warden: the intra-project **spec-leve
 collision ladder, and the cross-node sibling of `check-spec-structure` (intra-node node-shape).
 
 ```bash
-node scripts/check-scenario-overlap.mts --spec-dir <spec>          # audit (TOON candidate set)
-node scripts/check-scenario-overlap.mts --spec-dir <spec> --check  # CI guard (fails on exact-duplicate)
+node scripts/check-scenario-overlap.mjs --spec-dir <spec>          # audit (TOON candidate set)
+node scripts/check-scenario-overlap.mjs --spec-dir <spec> --check  # CI guard (fails on exact-duplicate)
 ```
 
 Two deterministic candidate kinds — **exact-duplicate** (blocking: two nodes share an identical

package/skills/check-scenario-overlap/SKILL.md

@@ -12,8 +12,7 @@ The concrete engine for **cross-node scenario-overlap detection** — the intra-
 SSA** partner of the code-side collision ladder. It audits **across the nodes** of one project spec
 and returns the candidates where the **same behavior lives in more than one node's `.feature`**, for
 the formation **Warden**. It is the **cross-node** sibling of `check-spec-structure` (intra-node
-node-shape), whose per-node scope leaves this cross-node axis uncovered. Self-contained `.mts` (the
-repo's node-≥23.6 / no-deps convention).
+node-shape), whose per-node scope leaves this cross-node axis uncovered. Self-contained `.mjs` (compiled from `src/`; no runtime deps, Node ≥22.11).
 
 ## Why this rung exists
 
@@ -48,7 +47,7 @@ only**: a scenario duplicated **within one node** raises no candidate, and a sce
 ## Run the scan
 
 ```bash
-node "<skill>/scripts/check-scenario-overlap.mts" [--spec-dir <spec>] [--check] [--format toon|json]
+node "<skill>/scripts/check-scenario-overlap.mjs" [--spec-dir <spec>] [--check] [--format toon|json]
 ```
 
 - Default `--spec-dir` is the current directory; default `--format` is **TOON** (the token-efficient

package/{dist/check-scenario-overlap/scripts/check-scenario-overlap.js → skills/check-scenario-overlap/scripts/check-scenario-overlap.mjs}

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
+// Compiled by `universal-plugin plugin build` from src/check-scenario-overlap/check-scenario-overlap.mts. Edit the source, not this file.
+globalThis.__SKILL_SCRIPT__ = {"package":null,"bin":null,"version":"0.7.1","entry":"skills/check-scenario-overlap/scripts/check-scenario-overlap.mjs","commands":{}};
 import { readFileSync, readdirSync, realpathSync } from "node:fs";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
-//#region skills/check-scenario-overlap/scripts/check-scenario-overlap.mts
+//#region src/check-scenario-overlap/check-scenario-overlap.mts
 const SKIP_DIRS = /* @__PURE__ */ new Set([
 	"node_modules",
 	".git",

package/skills/check-spec-references/README.md

@@ -5,7 +5,7 @@ Internal SDD skill — the concrete engine for the **spec-reference resolution c
 directory, and reports the ones that resolve to nothing.
 
 ```bash
-node scripts/check-spec-references.mts --spec-dir <specDir>
+node scripts/check-spec-references.mjs --spec-dir <specDir>
 ```
 
 Exits non-zero on any unresolved reference, reporting each as `file:line: <ref> -> <resolved path>` — naming the resolved path is the

package/skills/check-spec-references/SKILL.md

@@ -12,8 +12,8 @@ The concrete engine for the **spec-reference resolution check**. It walks every
 project spec, extracts each **explicitly-relative** reference, resolves it **against the file's own
 directory**, and fails on every one that resolves to nothing. Read-only, deterministic, and — unlike
 its `check-spec-structure` sibling — single-severity: a reference that does not resolve is always a
-defect, so there is one mode, not a report mode and a gate mode. It carries a self-contained `.mts`
-script (the repo's node-≥23.6 / no-deps convention).
+defect, so there is one mode, not a report mode and a gate mode. It carries a self-contained `.mjs`
+script (compiled from `src/`; no runtime deps, Node ≥22.11).
 
 It closes a failure **review cannot catch**: a consistent off-by-one reads as entirely plausible —
 right filename, right-looking depth, wrong level — so re-reading a reference by eye is not a check
@@ -70,7 +70,7 @@ from **outside the code spans**, so a line that merely quotes the marker keeps i
 ## Run the check
 
 ```bash
-node "<skill>/scripts/check-spec-references.mts" --spec-dir <specDir>
+node "<skill>/scripts/check-spec-references.mjs" --spec-dir <specDir>
 ```
 
 - Exits **zero** on a spec whose every reference resolves, printing a definitive clean line.

package/{dist/check-spec-references/scripts/check-spec-references.js → skills/check-spec-references/scripts/check-spec-references.mjs}

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
+// Compiled by `universal-plugin plugin build` from src/check-spec-references/check-spec-references.mts. Edit the source, not this file.
+globalThis.__SKILL_SCRIPT__ = {"package":null,"bin":null,"version":"0.7.1","entry":"skills/check-spec-references/scripts/check-spec-references.mjs","commands":{}};
 import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
-//#region skills/check-spec-references/scripts/check-spec-references.mts
+//#region src/check-spec-references/check-spec-references.mts
 /** Suppresses every reference on the line it appears on. Matched as a COMPLETE html comment, not
 * as a substring: a marker whose name merely starts with this one's (a typo, a future sibling)
 * must not silently inherit its power to hide a reference. The optional `: reason` is convention,

package/skills/check-spec-structure/README.md

@@ -5,8 +5,8 @@ internal node-shape and emits a finding set for the formation Warden: the intra-
 retired cross-spec `dedupe-specs`/`split-spec` tools, now that one project is one spec.
 
 ```bash
-node scripts/check-spec-structure.mts --spec-dir <spec>          # audit (TOON finding set)
-node scripts/check-spec-structure.mts --spec-dir <spec> --check  # CI guard (fails on blocking)
+node scripts/check-spec-structure.mjs --spec-dir <spec>          # audit (TOON finding set)
+node scripts/check-spec-structure.mjs --spec-dir <spec> --check  # CI guard (fails on blocking)
 ```
 
 Three deterministic checks — **untagged-node** (blocking: a spec-typed node with no `concept:`),

package/skills/check-spec-structure/SKILL.md

@@ -11,8 +11,7 @@ metadata:
 The concrete engine for **spec-structure checking**.
 It audits the **internal node-shape** of one project spec and returns a finding set for the
 formation **Warden** — the **intra-spec** successor to the retired cross-spec `dedupe-specs`/`split-spec`
-tools, now that one project is **one spec**. It carries a self-contained `.mts` script (the repo's
-node-≥23.6 / no-deps convention). It is the **node-shape** sibling of `align-spec` (prose↔suite
+tools, now that one project is **one spec**. It carries a self-contained `.mjs` script (compiled from `src/`; no runtime deps, Node ≥22.11). It is the **node-shape** sibling of `align-spec` (prose↔suite
 alignment) and `concept-index` (the by-concept view).
 
 ## The three deterministic checks (and two judgment arms)
@@ -42,7 +41,7 @@ alignment) and `concept-index` (the by-concept view).
 ## Run the scan
 
 ```bash
-node "<skill>/scripts/check-spec-structure.mts" [--spec-dir <spec>] [--check] [--max-scenarios <n>] [--format toon|json]
+node "<skill>/scripts/check-spec-structure.mjs" [--spec-dir <spec>] [--check] [--max-scenarios <n>] [--format toon|json]
 ```
 
 - Default `--spec-dir` is the current directory; default `--format` is **TOON** (the token-efficient

package/{dist/check-spec-structure/scripts/check-spec-structure.js → skills/check-spec-structure/scripts/check-spec-structure.mjs}

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
+// Compiled by `universal-plugin plugin build` from src/check-spec-structure/check-spec-structure.mts. Edit the source, not this file.
+globalThis.__SKILL_SCRIPT__ = {"package":null,"bin":null,"version":"0.7.1","entry":"skills/check-spec-structure/scripts/check-spec-structure.mjs","commands":{}};
 import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
-//#region skills/check-spec-structure/scripts/check-spec-structure.mts
+//#region src/check-spec-structure/check-spec-structure.mts
 const SKIP_DIRS = /* @__PURE__ */ new Set([
 	"node_modules",
 	".git",

package/skills/collision-ladder/README.md

@@ -11,6 +11,6 @@ cyberplace repository, not shipped in this package) carries the authoritative be
 and the frozen 18-scenario contract.
 
 - **Skill contract:** [`SKILL.md`](./SKILL.md)
-- **Script:** [`scripts/collision-ladder.mts`](./scripts/collision-ladder.mts)
-- **Tests:** [`scripts/collision-ladder.test.mts`](./scripts/collision-ladder.test.mts)
+- **Script:** [`scripts/collision-ladder.mjs`](./scripts/collision-ladder.mjs)
+- **Tests:** [`src/collision-ladder/collision-ladder.test.mts`](../../src/collision-ladder/collision-ladder.test.mts)
   (`node:test`) — one test per frozen scenario, titled `scenario: <verbatim frozen scenario name>`.

package/skills/collision-ladder/SKILL.md

@@ -57,10 +57,10 @@ engine's composition.
 
 ```bash
 # constructed input (a ClassifyInput JSON) — the primary, tested path:
-node "<skill>/scripts/collision-ladder.mts" --input <file|-> [--format toon|json]
+node "<skill>/scripts/collision-ladder.mjs" --input <file|-> [--format toon|json]
 
 # sourced from two mission git ranges for one colliding node:
-node "<skill>/scripts/collision-ladder.mts" --from-git --node <project/capability> \
+node "<skill>/scripts/collision-ladder.mjs" --from-git --node <project/capability> \
   --x <base..head> --y <base..head> [--root .] \
   [--layout 'sdd:.agents/specs/sdd,plugins/sdd/skills']... \
   [--shared-thin-threshold 3] [--format toon|json]