cyber-sdd 0.7.0 → 0.7.2

package/skills/discover-specs/scripts/discover-specs.mjs

@@ -1,12 +1,321 @@
-// Launcher for the engine of the same name. Run it as `node <skill>/scripts/<engine>.mjs`.
-// A checkout runs the .mts source. An npm install keeps the skill under node_modules, where Node
-// will not strip types, so it runs the self-contained bundle built for the package.
-import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-
-const self = fileURLToPath(import.meta.url)
-const installed = /[\\/]node_modules[\\/]/.test(self)
-const target = self.replace(/\.mjs$/, installed ? '.bundle.mjs' : '.mts')
-const run = spawnSync(process.execPath, [...process.execArgv, target, ...process.argv.slice(2)], { stdio: 'inherit' })
-if (run.error) throw run.error
-process.exitCode = run.status ?? 1
+#!/usr/bin/env node
+// Compiled by `universal-plugin plugin build` from src/discover-specs/discover-specs.mts. Edit the source, not this file.
+globalThis.__SKILL_SCRIPT__ = {"package":null,"bin":null,"version":"0.7.2","entry":"skills/discover-specs/scripts/discover-specs.mjs","commands":{}};
+import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+//#region src/discover-specs/discover-specs.mts
+const LIFECYCLE_STATUSES = /* @__PURE__ */ new Set([
+	"draft",
+	"approved",
+	"implemented",
+	"deprecated"
+]);
+const ROOT_PROJECT_NAME = "repo";
+const SKIP_DIRS = /* @__PURE__ */ new Set([
+	"node_modules",
+	".git",
+	"dist",
+	".turbo",
+	".next",
+	"coverage"
+]);
+/**
+* A directory that is itself a checkout is a DIFFERENT repository's tree, not part of this corpus.
+*
+* A name blocklist cannot express this: it can only say "this is called X", never "this is a
+* boundary". `SKIP_DIRS` already holds `.git`, so the walk skipped the METADATA directory while
+* descending straight into the checkout that directory marks — one level off from where the guard
+* was needed. Agent-harness worktree isolation checks this repo out inside itself, and the scan then
+* found the whole corpus once per worktree: 38 spec files where 10 exist, and every corpus-wide
+* guard silently auditing a tree nobody has.
+*
+* `.git` is a DIRECTORY in a clone and a FILE in a worktree or submodule, so both forms count.
+*/
+function isNestedCheckout(abs) {
+	return existsSync(join(abs, ".git"));
+}
+const ANCHORS_CONFIG = ".agents/sdd/spec-anchors.toml";
+function parseFrontmatter(text) {
+	const m = /^---\r?\n([\s\S]*?)\r?\n---\s*(?:\r?\n|$)/.exec(text);
+	if (!m) return null;
+	const fm = { approval: {} };
+	let gate = null;
+	for (const raw of m[1].split("\n")) {
+		const line = raw.replace(/\r$/, "");
+		if (line.trim() === "" || line.trim().startsWith("#")) continue;
+		const indent = line.length - line.trimStart().length;
+		const [key, ...rest] = line.trim().split(":");
+		const value = rest.join(":").trim();
+		if (indent === 0) {
+			gate = null;
+			if (key === "status") fm.status = unquote(value);
+			else if (key === "project-path") fm.projectPath = unquote(value);
+			else if (key === "name") fm.name = unquote(value);
+			else if (key === "approval") gate = null;
+		} else if (indent === 2 && value === "" && insideApproval(m[1], line)) gate = key;
+		else if (indent >= 4 && key === "verdict" && gate) fm.approval[gate] = unquote(value);
+	}
+	return fm;
+}
+function insideApproval(block, line) {
+	const lines = block.split("\n");
+	const idx = lines.indexOf(line);
+	for (let i = idx - 1; i >= 0; i--) {
+		const l = lines[i].replace(/\r$/, "");
+		if (l.trim() === "" || l.trim().startsWith("#")) continue;
+		if (l.length - l.trimStart().length === 0) return l.trim().replace(/:.*$/, "") === "approval";
+	}
+	return false;
+}
+function unquote(v) {
+	return v.replace(/^["']|["']$/g, "");
+}
+function classifyLocation(relPath) {
+	const p = relPath.replace(/\\/g, "/");
+	if (p === ".agents/spec/spec.md") return {
+		pattern: "root-single",
+		locationDir: ""
+	};
+	const multi = /^\.agents\/specs\/([^/]+)\/spec\.md$/.exec(p);
+	if (multi) return {
+		pattern: "root-multi",
+		locationDir: multi[1]
+	};
+	const nested = /^(.+)\/\.agents\/spec\/spec\.md$/.exec(p);
+	if (nested) return {
+		pattern: "nested",
+		locationDir: nested[1]
+	};
+	return null;
+}
+function deriveName(loc, fm) {
+	if (fm.name) return {
+		name: fm.name,
+		nameSource: "declared"
+	};
+	if (loc.pattern === "root-single") return {
+		name: ROOT_PROJECT_NAME,
+		nameSource: "derived"
+	};
+	if (loc.pattern === "root-multi") return {
+		name: loc.locationDir,
+		nameSource: "derived"
+	};
+	if (loc.pattern === "extra" && loc.capturedName) return {
+		name: loc.capturedName,
+		nameSource: "derived"
+	};
+	return {
+		name: loc.locationDir.split("/").pop() ?? loc.locationDir,
+		nameSource: "guessed"
+	};
+}
+function discoverSpecFiles(root) {
+	const found = [];
+	const walk = (relDir) => {
+		let entries;
+		try {
+			entries = readdirSync(join(root, relDir), { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const e of entries) {
+			if (!e.isDirectory() || SKIP_DIRS.has(e.name)) continue;
+			const childRel = relDir ? `${relDir}/${e.name}` : e.name;
+			if (isNestedCheckout(join(root, childRel))) continue;
+			if (e.name === ".agents") {
+				probeAgents(root, childRel, found);
+				continue;
+			}
+			walk(childRel);
+		}
+	};
+	walk("");
+	return found;
+}
+function probeAgents(root, agentsRel, found) {
+	const single = `${agentsRel}/spec/spec.md`;
+	if (existsSync(join(root, single))) found.push(single);
+	if (agentsRel === ".agents") {
+		const specsDir = join(root, ".agents", "specs");
+		let projects;
+		try {
+			projects = readdirSync(specsDir, { withFileTypes: true });
+		} catch {
+			projects = [];
+		}
+		for (const p of projects) {
+			if (!p.isDirectory()) continue;
+			const rel = `.agents/specs/${p.name}/spec.md`;
+			if (existsSync(join(root, rel))) found.push(rel);
+		}
+	}
+}
+function parseAnchorsToml(text) {
+	const m = /(^|\n)\s*anchors\s*=\s*\[([\s\S]*?)\]/.exec(text);
+	if (!m) return [];
+	const out = [];
+	for (const q of m[2].matchAll(/"([^"]*)"|'([^']*)'/g)) out.push((q[1] ?? q[2]).trim());
+	return out.filter((s) => s !== "");
+}
+function readAnchors(root) {
+	const file = join(root, ANCHORS_CONFIG);
+	if (!existsSync(file)) return [];
+	try {
+		return parseAnchorsToml(readFileSync(file, "utf8"));
+	} catch {
+		process.stderr.write(`discover-specs: ignoring unreadable ${ANCHORS_CONFIG}\n`);
+		return [];
+	}
+}
+function collectDescendants(root, startDir) {
+	const out = [startDir];
+	let entries;
+	try {
+		entries = readdirSync(join(root, startDir), { withFileTypes: true });
+	} catch {
+		return out;
+	}
+	for (const e of entries) {
+		if (!e.isDirectory() || SKIP_DIRS.has(e.name)) continue;
+		const childRel = startDir ? `${startDir}/${e.name}` : e.name;
+		if (isNestedCheckout(join(root, childRel))) continue;
+		out.push(...collectDescendants(root, childRel));
+	}
+	return out;
+}
+function expandAnchor(root, pattern) {
+	const segs = pattern.replace(/\\/g, "/").replace(/^\/+|\/+$/g, "").split("/").filter(Boolean);
+	let frontier = [{ dir: "" }];
+	for (const seg of segs) {
+		const next = [];
+		if (seg === "**") {
+			for (const node of frontier) for (const dir of collectDescendants(root, node.dir)) next.push({
+				dir,
+				capturedName: node.capturedName
+			});
+			frontier = next;
+			continue;
+		}
+		const isGlob = seg === "*" || seg === "<project>";
+		for (const node of frontier) if (isGlob) {
+			let entries;
+			try {
+				entries = readdirSync(join(root, node.dir), { withFileTypes: true });
+			} catch {
+				continue;
+			}
+			for (const e of entries) {
+				if (!e.isDirectory() || SKIP_DIRS.has(e.name)) continue;
+				const childRel = node.dir ? `${node.dir}/${e.name}` : e.name;
+				if (isNestedCheckout(join(root, childRel))) continue;
+				next.push({
+					dir: childRel,
+					capturedName: seg === "<project>" ? e.name : node.capturedName
+				});
+			}
+		} else next.push({
+			dir: node.dir ? `${node.dir}/${seg}` : seg,
+			capturedName: node.capturedName
+		});
+		frontier = next;
+	}
+	const out = [];
+	for (const node of frontier) {
+		const rel = node.dir ? `${node.dir}/spec.md` : "spec.md";
+		if (existsSync(join(root, rel))) out.push({
+			rel,
+			capturedName: node.capturedName
+		});
+	}
+	return out;
+}
+function recordFor(root, rel, loc) {
+	let fm;
+	try {
+		fm = parseFrontmatter(readFileSync(join(root, rel), "utf8"));
+	} catch {
+		return null;
+	}
+	if (!fm?.status || !LIFECYCLE_STATUSES.has(fm.status)) return null;
+	const { name, nameSource } = deriveName(loc, fm);
+	return {
+		path: rel.replace(/\/spec\.md$/, ""),
+		name,
+		nameSource,
+		status: fm.status,
+		projectPath: fm.projectPath ?? "",
+		approvals: Object.entries(fm.approval).map(([gate, verdict]) => `${gate}:${verdict}`).join(";")
+	};
+}
+function collectSpecs(root) {
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const rel of discoverSpecFiles(root)) {
+		const loc = classifyLocation(rel);
+		if (!loc) continue;
+		const rec = recordFor(root, rel, loc);
+		if (rec) {
+			out.push(rec);
+			seen.add(rel);
+		}
+	}
+	for (const pattern of readAnchors(root)) for (const { rel, capturedName } of expandAnchor(root, pattern)) {
+		if (seen.has(rel)) continue;
+		const rec = recordFor(root, rel, {
+			pattern: "extra",
+			locationDir: rel.replace(/\/spec\.md$/, ""),
+			capturedName
+		});
+		if (rec) {
+			out.push(rec);
+			seen.add(rel);
+		}
+	}
+	return out.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+}
+function resolveByName(specs, name) {
+	const want = name.trim().toLowerCase();
+	const hits = specs.filter((s) => s.name.toLowerCase() === want);
+	if (hits.length === 0) return { kind: "none" };
+	if (hits.length === 1) return {
+		kind: "match",
+		spec: hits[0]
+	};
+	return {
+		kind: "ambiguous",
+		candidates: hits
+	};
+}
+const COLUMNS = [
+	"path",
+	"name",
+	"nameSource",
+	"status",
+	"projectPath",
+	"approvals"
+];
+function toonField(v) {
+	if (v === "" || /[",]/.test(v) || v !== v.trim()) return `"${v.replace(/"/g, "\"\"")}"`;
+	return v;
+}
+function toToon(specs) {
+	return [`specs[${specs.length}]{${COLUMNS.join(",")}}:`, ...specs.map((s) => `  ${COLUMNS.map((c) => toonField(s[c])).join(",")}`)].join("\n");
+}
+function main(argv) {
+	const root = argv.includes("--root") ? argv[argv.indexOf("--root") + 1] ?? "." : ".";
+	const format = argv.includes("--format") ? argv[argv.indexOf("--format") + 1] : "toon";
+	let specs = collectSpecs(root);
+	if (argv.includes("--resolve")) {
+		const name = argv[argv.indexOf("--resolve") + 1] ?? "";
+		const r = resolveByName(specs, name);
+		specs = r.kind === "match" ? [r.spec] : r.kind === "ambiguous" ? r.candidates : [];
+	}
+	const out = format === "json" ? JSON.stringify(specs, null, 2) : toToon(specs);
+	process.stdout.write(`${out}\n`);
+	return 0;
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) process.exit(main(process.argv.slice(2)));
+//#endregion
+export { LIFECYCLE_STATUSES, classifyLocation, collectSpecs, deriveName, discoverSpecFiles, expandAnchor, main, parseAnchorsToml, parseFrontmatter, readAnchors, resolveByName, toToon };

package/skills/doctrine-loop/SKILL.md

@@ -58,7 +58,7 @@ recorded as distilled).
 **Determine distilled-ness by a structured JSONL parse, never a substring or regex text match.**
 The ledger shards are JSONL (one JSON object per line). **Reuse the existing parse contract** rather
 than hand-rolling one: run the exported **`distilledCrRefs`** engine from
-`../plan-retirement/scripts/retire-plans.mts` (its `--distilled` flag) over the project `ledger/` directory and membership-test
+`../plan-retirement/scripts/retire-plans.mjs` (its `--distilled` flag) over the project `ledger/` directory and membership-test
 the mission's `<cr-ref>` against the set it returns, e.g.
 
 ```

package/skills/gate-validation-governance/SKILL.md

@@ -13,7 +13,7 @@ conductor's autonomy bar (baked into `start-mission`), a hard floor + a three-di
 
 ## Legal-state tuples
 
-The mechanical authority is `spec-gate/scripts/check-spec-state.mts` — run it
+The mechanical authority is `spec-gate/scripts/check-spec-state.mjs` — run it
 (`node <skill>/scripts/check-spec-state.mjs`) to enforce; if `node` is unavailable, apply the same
 rules by reading frontmatter. The `(status, markers, .feature, approval)` tuple of the root
 `spec.md` — plus the durable gate lines globbed from its sibling `ledger/` shards (a legacy `ledger.jsonl` still counts) — is **illegal** when:

package/skills/init/README.md

@@ -7,8 +7,8 @@ mission runs. A user-invocable setup skill (sibling to `start-mission` / `manage
 and invokes no gate.
 
 - **Skill contract:** [`SKILL.md`](./SKILL.md)
-- **Script:** [`scripts/wire-statusline.mts`](./scripts/wire-statusline.mts)
-- **Tests:** [`scripts/wire-statusline.test.mts`](./scripts/wire-statusline.test.mts) (`node:test`)
+- **Script:** [`scripts/wire-statusline.mjs`](./scripts/wire-statusline.mjs)
+- **Tests:** [`src/init/wire-statusline.test.mts`](../../src/init/wire-statusline.test.mts) (`node:test`)
 
 ```bash
 node scripts/wire-statusline.mjs --root . --detect

package/skills/init/scripts/wire-statusline.mjs

@@ -1,12 +1,168 @@
-// Launcher for the engine of the same name. Run it as `node <skill>/scripts/<engine>.mjs`.
-// A checkout runs the .mts source. An npm install keeps the skill under node_modules, where Node
-// will not strip types, so it runs the self-contained bundle built for the package.
-import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-
-const self = fileURLToPath(import.meta.url)
-const installed = /[\\/]node_modules[\\/]/.test(self)
-const target = self.replace(/\.mjs$/, installed ? '.bundle.mjs' : '.mts')
-const run = spawnSync(process.execPath, [...process.execArgv, target, ...process.argv.slice(2)], { stdio: 'inherit' })
-if (run.error) throw run.error
-process.exitCode = run.status ?? 1
+#!/usr/bin/env node
+// Compiled by `universal-plugin plugin build` from src/init/wire-statusline.mts. Edit the source, not this file.
+globalThis.__SKILL_SCRIPT__ = {"package":null,"bin":null,"version":"0.7.2","entry":"skills/init/scripts/wire-statusline.mjs","commands":{}};
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
+//#region src/init/wire-statusline.mts
+const STATUS_FILE = ".agents/sdd/statusline";
+const SETTINGS_FILE = ".claude/settings.json";
+const GITIGNORE_FILE = ".gitignore";
+const GLOBAL_SETTINGS_FILE = join(homedir(), ".claude", "settings.json");
+const MARKER_BEGIN = "# sdd-statusline:begin";
+const MARKER_END = "# sdd-statusline:end";
+const MODE_PREFIX = "# sdd-statusline:mode:";
+const ORIG_OPEN = "__sdd_orig() {";
+const ORIG_CLOSE = "}";
+const NO_BASE = ":";
+function buildCommand(base, mode) {
+	const origBody = base && base.trim() !== "" ? base : NO_BASE;
+	const render = mode === "own-line" ? `if [ -s "$__sdd_file" ]; then\n  __sdd_val="$(cat "$__sdd_file")"\n  printf '%s\\n%s\\n' "$__sdd_base" "$__sdd_val"\nelse\n  printf '%s\\n' "$__sdd_base"\nfi` : `if [ -s "$__sdd_file" ]; then\n  __sdd_val="$(cat "$__sdd_file")"\n  printf '%s | %s\\n' "$__sdd_base" "$__sdd_val"\nelse\n  printf '%s\\n' "$__sdd_base"\nfi`;
+	return [
+		MARKER_BEGIN,
+		`${MODE_PREFIX}${mode}`,
+		ORIG_OPEN,
+		origBody,
+		ORIG_CLOSE,
+		"__sdd_base=\"$(__sdd_orig 2>/dev/null)\"",
+		`__sdd_file="${STATUS_FILE}"`,
+		render,
+		MARKER_END
+	].join("\n");
+}
+function parseCommand(command) {
+	if (!command?.includes(MARKER_BEGIN)) return { wired: false };
+	const modeMatch = new RegExp(`${MODE_PREFIX}(own-line|same-line)`).exec(command);
+	const origMatch = /__sdd_orig\(\) \{\n([\s\S]*?)\n\}/.exec(command);
+	const mode = modeMatch?.[1] ?? "own-line";
+	const origBody = origMatch?.[1] ?? NO_BASE;
+	return {
+		wired: true,
+		base: origBody === NO_BASE ? void 0 : origBody,
+		mode
+	};
+}
+function baseToWrap(existingCommand) {
+	const parsed = parseCommand(existingCommand);
+	return parsed.wired ? parsed.base : existingCommand;
+}
+function readSettingsFile(file) {
+	if (!existsSync(file)) return {};
+	try {
+		return JSON.parse(readFileSync(file, "utf8"));
+	} catch {
+		return {};
+	}
+}
+function readSettings(root) {
+	return readSettingsFile(join(root, SETTINGS_FILE));
+}
+function readStatusLineCommand(file) {
+	const command = readSettingsFile(file).statusLine?.command;
+	if (typeof command !== "string" || command.trim() === "") return void 0;
+	return command;
+}
+function writeSettings(root, settings) {
+	const file = join(root, SETTINGS_FILE);
+	mkdirSync(dirname(file), { recursive: true });
+	writeFileSync(file, `${JSON.stringify(settings, null, 2)}\n`);
+}
+function composeStatusLine(root, mode, globalCommand) {
+	const settings = readSettings(root);
+	const existing = settings.statusLine?.command;
+	const hasProjectStatusLine = typeof existing === "string" && existing.trim() !== "";
+	const globalBaseComposed = !hasProjectStatusLine && globalCommand !== void 0;
+	const command = buildCommand(hasProjectStatusLine ? baseToWrap(existing) : globalCommand, mode);
+	if (existing === command) return {
+		changed: false,
+		command,
+		globalBaseComposed: false
+	};
+	settings.statusLine = {
+		...settings.statusLine,
+		type: "command",
+		command
+	};
+	writeSettings(root, settings);
+	return {
+		changed: true,
+		command,
+		globalBaseComposed
+	};
+}
+function isGitRepo(root) {
+	return existsSync(join(root, ".git"));
+}
+function splitLines(text) {
+	const lines = text.split("\n");
+	if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+	return lines;
+}
+function addGitignoreEntry(root) {
+	const file = join(root, GITIGNORE_FILE);
+	const lines = existsSync(file) ? splitLines(readFileSync(file, "utf8")) : [];
+	if (lines.some((l) => l.trim() === ".agents/sdd/statusline")) return { changed: false };
+	const next = [...lines, STATUS_FILE];
+	writeFileSync(file, `${next.join("\n")}\n`);
+	return { changed: true };
+}
+function detectStatusLines(root, globalSettingsFile) {
+	const projectCommand = readStatusLineCommand(join(root, SETTINGS_FILE));
+	const project = projectCommand === void 0 ? "absent" : parseCommand(projectCommand).wired ? "wired" : "foreign";
+	const global = readStatusLineCommand(globalSettingsFile ?? GLOBAL_SETTINGS_FILE) !== void 0 ? "present" : "absent";
+	return {
+		project,
+		global,
+		shadow: project === "absent" && global === "present"
+	};
+}
+function wireStatusline(root, mode, opts) {
+	return {
+		settings: composeStatusLine(root, mode, opts?.globalBase ?? true ? readStatusLineCommand(opts?.globalSettingsFile ?? GLOBAL_SETTINGS_FILE) : void 0),
+		gitignore: isGitRepo(root) ? {
+			...addGitignoreEntry(root),
+			skipped: false
+		} : {
+			changed: false,
+			skipped: true
+		}
+	};
+}
+function flag(argv, name) {
+	const i = argv.indexOf(name);
+	return i === -1 ? void 0 : argv[i + 1];
+}
+function main(argv) {
+	const root = flag(argv, "--root") ?? ".";
+	const globalSettingsFile = flag(argv, "--global-settings");
+	const w = (s) => process.stdout.write(`${s}\n`);
+	if (argv.includes("--detect")) {
+		const result = detectStatusLines(root, globalSettingsFile);
+		w(`project statusLine: ${result.project}`);
+		w(`global statusLine: ${result.global}`);
+		w(result.shadow ? "shadow risk: yes — wiring would shadow the global statusline; compose it as the base (default) or pass --no-global-base to shadow deliberately" : "shadow risk: no");
+		return 0;
+	}
+	if (argv.includes("--wire")) {
+		const mode = flag(argv, "--mode");
+		if (mode !== "own-line" && mode !== "same-line") {
+			w("refused: --mode must be own-line or same-line");
+			return 1;
+		}
+		const result = wireStatusline(root, mode, {
+			globalSettingsFile,
+			globalBase: !argv.includes("--no-global-base")
+		});
+		w(result.settings.changed ? `wired statusLine (${mode})` : "statusLine already wired (unchanged)");
+		if (result.settings.globalBaseComposed) w("composed the global statusLine command as the wrapped base");
+		if (result.gitignore.skipped) w("not a git repo — gitignore skipped");
+		else w(result.gitignore.changed ? `added ${STATUS_FILE} to .gitignore` : ".gitignore already up to date");
+		return 0;
+	}
+	w("usage: wire-statusline --root <dir> --wire --mode own-line|same-line [--global-settings <file>] [--no-global-base]\n       wire-statusline --root <dir> --detect [--global-settings <file>]");
+	return 0;
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) process.exit(main(process.argv.slice(2)));
+//#endregion
+export { GITIGNORE_FILE, GLOBAL_SETTINGS_FILE, SETTINGS_FILE, STATUS_FILE, addGitignoreEntry, buildCommand, composeStatusLine, detectStatusLines, isGitRepo, main, parseCommand, readStatusLineCommand, wireStatusline };

package/skills/manage-ignore/README.md

@@ -2,13 +2,13 @@
 
 The concrete engine for `.agents/sdd/.sddignore` — the optional gitignore-syntax file
 `resolve-tracking` reads to decide whether an artifact is tracked or ignored. A non-user-invocable
-skill, loaded in-session by the `manage` gateway (Housekeeping), carrying a self-contained `.mts`
+skill, loaded in-session by the `manage` gateway (Housekeeping), carrying a self-contained `.mjs`
 script that lists / adds / removes / induces / previews the ignore rules so users never hand-edit the
 file. Order is meaningful (last-match-wins), so rules are never re-sorted.
 
 - **Skill contract:** [`SKILL.md`](./SKILL.md)
-- **Script:** [`scripts/manage-ignore.mts`](./scripts/manage-ignore.mts)
-- **Tests:** [`scripts/manage-ignore.test.mts`](./scripts/manage-ignore.test.mts) (`node:test`)
+- **Script:** [`scripts/manage-ignore.mjs`](./scripts/manage-ignore.mjs)
+- **Tests:** [`src/manage-ignore/manage-ignore.test.mts`](../../src/manage-ignore/manage-ignore.test.mts) (`node:test`)
 
 ```bash
 node scripts/manage-ignore.mjs --list

package/skills/manage-ignore/SKILL.md

@@ -12,8 +12,7 @@ The concrete engine for `.agents/sdd/.sddignore` — the optional gitignore-synt
 `resolve-tracking` consults to decide whether an artifact is **tracked** or **ignored**. It is the
 **write** side of the ignore file (`resolve-tracking` is the read side). It exists so a user curates
 the ignore rules through a clean interface instead of hand-editing the file. Loaded **in-session** by
-the `manage` gateway (Housekeeping group); it carries a self-contained `.mts` script (the repo's
-node-≥23.6 / no-deps convention).
+the `manage` gateway (Housekeeping group); it carries a self-contained `.mjs` script (compiled from `src/`; no runtime deps, Node ≥22.11).
 
 ## The file it curates