etymd 0.10.0 → 0.12.0

package/dist/{init-YYGRFIHQ.js → init-EKQ33WYS.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
-import { applyFiles } from './chunk-EF6BPBG6.js';
-import { planWorkflow } from './chunk-R6CVJ5D7.js';
-import './chunk-YVGC3E6U.js';
+import { applyFiles } from './chunk-GWGKEPRX.js';
+import { planWorkflow } from './chunk-HRJJQCMT.js';
+import './chunk-DWL2IKZH.js';
 import { theme, renderFacts, print, renderPlan, section, glyph } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-WTD2EIMN.js';
-import { VERSION } from './chunk-K34AVLDP.js';
-import { writeCachedFacts, deriveProfile, writeBaseline, CACHE_DIR } from './chunk-C7LBUFNU.js';
-import { PACK_VERSION } from './chunk-OIYNP6Y6.js';
-import { git, readText } from './chunk-IV3FYVTS.js';
-import { promises } from 'node:fs';
-import path from 'node:path';
+import { scanProject } from './chunk-MTVEJ33D.js';
+import { VERSION } from './chunk-YFNRDXUY.js';
+import { writeCachedFacts, deriveProfile, writeBaseline, CACHE_DIR } from './chunk-JHZ2BN4U.js';
+import { PACK_VERSION } from './chunk-LSZGCKIQ.js';
+import { git, readText } from './chunk-4VPBP6K6.js';
+import { promises } from 'fs';
+import path from 'path';
 import { intro, spinner, select, confirm, outro, isCancel, cancel } from '@clack/prompts';
 
 function bail() {

package/dist/ledger-4FOZ5HAB.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+export { accept, dismiss, list } from './chunk-2VLNI3L2.js';
+import './chunk-3E2IPCRY.js';
+import './chunk-5BVKFJWM.js';
+import './chunk-4VPBP6K6.js';

package/dist/scan-N4BKVL5F.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+export { scanProject } from './chunk-MTVEJ33D.js';
+import './chunk-YFNRDXUY.js';
+import './chunk-LSZGCKIQ.js';
+import './chunk-4VPBP6K6.js';

package/dist/{scan-VO776GM7.js → scan-XS4JPS7J.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { print, renderFacts, theme } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-WTD2EIMN.js';
-import './chunk-K34AVLDP.js';
-import { writeCachedFacts } from './chunk-C7LBUFNU.js';
-import './chunk-OIYNP6Y6.js';
-import './chunk-IV3FYVTS.js';
+import { scanProject } from './chunk-MTVEJ33D.js';
+import './chunk-YFNRDXUY.js';
+import { writeCachedFacts } from './chunk-JHZ2BN4U.js';
+import './chunk-LSZGCKIQ.js';
+import './chunk-4VPBP6K6.js';
 
 // src/commands/scan.ts
 async function run(opts) {

package/dist/{screen-MOQP6XC7.js → screen-UF7VZ26C.js}

@@ -1,21 +1,76 @@
 #!/usr/bin/env node
 import { print, glyph, theme, section } from './chunk-5BVKFJWM.js';
-import { git, readText, pathExists } from './chunk-IV3FYVTS.js';
-import { promises } from 'node:fs';
-import path from 'node:path';
+import { git, readText, pathExists } from './chunk-4VPBP6K6.js';
+import { promises } from 'fs';
+import path from 'path';
 
+var CLASS_DIRECTIVE = /^#[ \t]*class:[ \t]*(secret|vocabulary)\b/i;
 var MACHINE_PATH_RE = /\/(?:Users|home)\/[A-Za-z0-9._-]+\//;
 var ALLOW_MARKER = "allow-published-string";
 var ALLOW_FILE = ".etymd-screen-allow";
 var LEGACY_ALLOW_FILE = ".artifact-check-allow";
-function compile(raw) {
-  return raw.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#")).map((l) => {
-    try {
-      return new RegExp(l, "i");
-    } catch {
-      return new RegExp(l.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i");
+var LABELED_LINE = /^(pattern|reason|date|author)[ \t]+(.*)$/;
+function compileAllow(raw) {
+  const entries = [];
+  let current = null;
+  const close = () => {
+    if (current) entries.push(current);
+    current = null;
+  };
+  for (const rawLine of raw.split("\n")) {
+    const l = rawLine.trim();
+    if (!l || l.startsWith("#")) continue;
+    const labeled = LABELED_LINE.exec(l);
+    if (labeled) {
+      const [, label = "", value = ""] = labeled;
+      if (label === "pattern") {
+        close();
+        current = makeAllowEntry(value);
+      } else if (current) {
+        if (label === "reason") current.reason = value.trim();
+        else if (label === "date") current.date = value.trim();
+        else current.author = value.trim();
+      }
+    } else {
+      close();
+      current = makeAllowEntry(l);
     }
-  });
+  }
+  close();
+  return entries;
+}
+function makeAllowEntry(patternStr) {
+  try {
+    return { pattern: new RegExp(patternStr, "i"), isSelfName: false };
+  } catch {
+    return {
+      pattern: new RegExp(patternStr.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i"),
+      isSelfName: false
+    };
+  }
+}
+function compileOnePattern(l) {
+  try {
+    return new RegExp(l, "i");
+  } catch {
+    return new RegExp(l.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i");
+  }
+}
+function compilePatterns(raw) {
+  const out = [];
+  let cls = "secret";
+  for (const rawLine of raw.split("\n")) {
+    const l = rawLine.trim();
+    if (!l) continue;
+    const dir = CLASS_DIRECTIVE.exec(l);
+    if (dir) {
+      cls = dir[1].toLowerCase();
+      continue;
+    }
+    if (l.startsWith("#")) continue;
+    out.push({ re: compileOnePattern(l), cls });
+  }
+  return out;
 }
 var META = ".[]*^$+?(){}|";
 function patternLiteral(source) {
@@ -61,13 +116,17 @@ async function selfIdentities(cwd) {
   names.delete("");
   return [...names];
 }
-function screenText(text, file, patterns, allow = []) {
+function screenText(text, file, patterns, allow = [], skipVocabulary = false) {
+  const classed = patterns.map(
+    (p) => p instanceof RegExp ? { re: p, cls: "secret" } : p
+  );
+  const active = skipVocabulary ? classed.filter((p) => p.cls === "secret") : classed;
   const hits = [];
   const lines = text.split("\n");
   for (const [i, line] of lines.entries()) {
     if (line.includes(ALLOW_MARKER)) continue;
-    if (allow.some((re) => re.test(line))) continue;
-    for (const re of patterns) {
+    if (allow.some((entry) => entry.pattern.test(line))) continue;
+    for (const { re } of active) {
       if (re.test(line)) {
         hits.push({ file, line: i + 1, text: line.trim().slice(0, 160), reason: String(re) });
         break;
@@ -84,6 +143,30 @@ function screenText(text, file, patterns, allow = []) {
   }
   return hits;
 }
+async function collectUpstreamBlobs(cwd, remote) {
+  const refsRaw = await git(cwd, ["for-each-ref", "--format=%(refname)", `refs/remotes/${remote}/`]);
+  const refs = (refsRaw ?? "").split("\n").filter(Boolean);
+  if (!refs.length) return null;
+  const blobs = /* @__PURE__ */ new Set();
+  for (const ref of refs) {
+    const tree = await git(cwd, ["ls-tree", "-r", ref]);
+    if (tree === null) continue;
+    for (const line of tree.split("\n")) {
+      const m = /^\d+ blob ([0-9a-f]+)\t/.exec(line);
+      if (m) blobs.add(m[1]);
+    }
+  }
+  return blobs.size ? blobs : null;
+}
+async function stagedBlobShas(cwd) {
+  const raw = await git(cwd, ["ls-files", "-s"]);
+  const map = /* @__PURE__ */ new Map();
+  for (const line of (raw ?? "").split("\n")) {
+    const m = /^\d+ ([0-9a-f]+) \d+\t(.+)$/.exec(line);
+    if (m) map.set(m[2], m[1]);
+  }
+  return map;
+}
 async function walk(dir, out, depth = 0) {
   if (depth > 12) return;
   let entries;
@@ -122,15 +205,60 @@ async function run(opts) {
     );
     return;
   }
-  const patterns = compile(rawPatterns);
+  const patterns = compilePatterns(rawPatterns);
   if (!patterns.length) {
     print(`  ${glyph.partial} ${theme.dim(`${patternPath} has no active patterns \u2014 skipping.`)}`);
     return;
   }
-  const allowRaw = await readText(path.join(opts.cwd, ALLOW_FILE)) ?? await readText(path.join(opts.cwd, LEGACY_ALLOW_FILE));
-  const allow = allowRaw ? compile(allowRaw) : [];
+  const usingLegacy = !await pathExists(path.join(opts.cwd, ALLOW_FILE)) && await pathExists(path.join(opts.cwd, LEGACY_ALLOW_FILE));
+  const allowRaw = usingLegacy ? await readText(path.join(opts.cwd, LEGACY_ALLOW_FILE)) : await readText(path.join(opts.cwd, ALLOW_FILE));
+  const allowEntries = allowRaw ? compileAllow(allowRaw) : [];
   const selves = await selfIdentities(opts.cwd);
-  const active = selves.length ? patterns.filter((re) => !isSelfName(re, selves)) : patterns;
+  const validatedEntries = allowEntries.filter((entry) => {
+    if (entry.isSelfName) return true;
+    if (isSelfName(entry.pattern, selves)) {
+      entry.isSelfName = true;
+      return true;
+    }
+    if (!entry.reason || !entry.date || !entry.author) {
+      print(
+        `  ${glyph.partial} ${theme.warn(`Missing provenance for exemption pattern`)} ${theme.dim(String(entry.pattern))}`
+      );
+      print(
+        `    ${theme.dim("Format: a `pattern` line, then `reason`, `date`, `author` lines \u2014 a bare pattern line is a self-name exemption")}`
+      );
+      return false;
+    }
+    return true;
+  });
+  const allow = validatedEntries;
+  const active = selves.length ? patterns.filter((p) => !isSelfName(p.re, selves)) : patterns;
+  const hasVocab = active.some((p) => p.cls === "vocabulary");
+  const upstreamRemote = hasVocab && (opts.scope === "staged" || opts.scope === "tree") ? opts.upstream ?? await git(opts.cwd, ["config", "--get", "etymd.upstream"]) ?? void 0 : void 0;
+  let upstreamBlobs = null;
+  let blobByPath = /* @__PURE__ */ new Map();
+  let upstreamNote = "";
+  if (upstreamRemote) {
+    upstreamBlobs = await collectUpstreamBlobs(opts.cwd, upstreamRemote);
+    if (upstreamBlobs === null) {
+      upstreamNote = `upstream ref '${upstreamRemote}' unavailable \u2014 vocabulary exemption off, screening every pattern`;
+    } else {
+      blobByPath = await stagedBlobShas(opts.cwd);
+    }
+  }
+  const isUpstreamOwned = (rel) => {
+    if (!upstreamBlobs) return false;
+    const sha = blobByPath.get(rel);
+    return !!sha && upstreamBlobs.has(sha);
+  };
+  if (usingLegacy) {
+    print(
+      `  ${glyph.partial} ${theme.warn(`Using legacy ${LEGACY_ALLOW_FILE} file \u2014 rename to ${ALLOW_FILE} and add provenance`)}`
+    );
+    print(
+      `    ${theme.dim("New format: a `pattern` line, then `reason`, `date`, `author` lines per entry")}`
+    );
+  }
   const hits = [];
   let scanned = 0;
   let skippedBinary = 0;
@@ -171,15 +299,21 @@ async function run(opts) {
         continue;
       }
       scanned++;
-      hits.push(...screenText(raw, rel, active, allow));
+      hits.push(...screenText(raw, rel, active, allow, isUpstreamOwned(rel)));
     }
   }
-  if (!hits.length) return;
+  if (upstreamNote) {
+    print(`  ${glyph.partial} ${theme.warn(upstreamNote)}`);
+  }
   section(
     `Content screen ${theme.dim(
       `\xB7 ${opts.scope} \xB7 ${scanned} file(s)${skippedBinary ? ` \xB7 ${skippedBinary} binary skipped` : ""}`
     )}`
   );
+  if (!hits.length) {
+    print(`  ${glyph.ok} ${theme.dim("clean")}`);
+    return;
+  }
   for (const h of hits) {
     print(`  ${theme.warn(h.file)}${theme.dim(`:${h.line}`)}  ${theme.dim(`(${h.reason})`)}`);
     print(`    ${h.text}`);
@@ -194,4 +328,4 @@ async function run(opts) {
   if (!opts.advisory) process.exitCode = 1;
 }
 
-export { isSelfName, patternLiteral, readScreenable, run, screenText, selfIdentities };
+export { collectUpstreamBlobs, compileAllow, compilePatterns, isSelfName, patternLiteral, readScreenable, run, screenText, selfIdentities, stagedBlobShas };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "etymd",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Keep your agent instructions true — verify AGENTS.md, CLAUDE.md, rules & skills against the actual repo, with drift caught over time and a regression ledger.",
   "keywords": [
     "cli",
@@ -69,12 +69,12 @@
     "yaml": "2.9.0"
   },
   "devDependencies": {
-    "@changesets/cli": "2.27.11",
+    "@changesets/cli": "2.31.1",
     "@types/node": "22.10.2",
     "prettier": "3.4.2",
-    "tsup": "8.3.5",
+    "tsup": "8.5.1",
     "typescript": "5.7.2",
-    "vitest": "2.1.8"
+    "vitest": "4.1.10"
   },
   "publishConfig": {
     "access": "public"

package/dist/audit-FGDX2AYS.js

@@ -1,12 +0,0 @@
-#!/usr/bin/env node
-export { run } from './chunk-SGW7OPHZ.js';
-import './chunk-KQMQJJZK.js';
-import './chunk-IPOAD67U.js';
-import './chunk-OAFYLBVG.js';
-import './chunk-YVGC3E6U.js';
-import './chunk-5BVKFJWM.js';
-import './chunk-WTD2EIMN.js';
-import './chunk-K34AVLDP.js';
-import './chunk-C7LBUFNU.js';
-import './chunk-OIYNP6Y6.js';
-import './chunk-IV3FYVTS.js';

package/dist/config-TPK5LYDM.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-export { CONFIG_FILE, DEFAULT_CONFIG, configPath, readConfig } from './chunk-YVGC3E6U.js';
-import './chunk-C7LBUFNU.js';
-import './chunk-IV3FYVTS.js';

package/dist/doctor-W3UZK7KS.js

@@ -1,19 +0,0 @@
-#!/usr/bin/env node
-import { run } from './chunk-SGW7OPHZ.js';
-import './chunk-KQMQJJZK.js';
-import './chunk-IPOAD67U.js';
-import './chunk-OAFYLBVG.js';
-import './chunk-YVGC3E6U.js';
-import './chunk-5BVKFJWM.js';
-import './chunk-WTD2EIMN.js';
-import './chunk-K34AVLDP.js';
-import './chunk-C7LBUFNU.js';
-import './chunk-OIYNP6Y6.js';
-import './chunk-IV3FYVTS.js';
-
-// src/commands/doctor.ts
-async function run2(opts) {
-  await run({ cwd: opts.cwd, json: opts.json, truth: true });
-}
-
-export { run2 as run };

package/dist/generate-NLHGTRZB.js

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-export { deriveFailOn, derivedCommands, planWorkflow, riskReachability } from './chunk-R6CVJ5D7.js';
-import './chunk-YVGC3E6U.js';
-import './chunk-C7LBUFNU.js';
-import './chunk-OIYNP6Y6.js';
-import './chunk-IV3FYVTS.js';

package/dist/ledger-B2XGANTH.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-export { accept, dismiss, list } from './chunk-V2SOHPXF.js';
-import './chunk-OAFYLBVG.js';
-import './chunk-5BVKFJWM.js';
-import './chunk-IV3FYVTS.js';

package/dist/scan-PJSZGUG7.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-export { scanProject } from './chunk-WTD2EIMN.js';
-import './chunk-K34AVLDP.js';
-import './chunk-OIYNP6Y6.js';
-import './chunk-IV3FYVTS.js';