etymd 0.16.0 → 0.19.0

package/dist/{init-Z5O2WVRJ.js → init-7HWVHZMF.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { applyFiles } from './chunk-GWGKEPRX.js';
-import { planWorkflow } from './chunk-OKJ3RGJB.js';
+import { planWorkflow } from './chunk-EZRK4MV3.js';
+import './chunk-HSRHOVII.js';
 import { theme, renderFacts, print, renderPlan, section, glyph } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-EJM47PIF.js';
-import { VERSION } from './chunk-UYCGP5BS.js';
+import { scanProject } from './chunk-DLHC7QON.js';
+import { VERSION } from './chunk-L4KIIKXI.js';
 import { writeCachedFacts, deriveProfile, writeBaseline, CACHE_DIR } from './chunk-P6ATKV2R.js';
-import { PACK_VERSION } from './chunk-YQZDYDAK.js';
+import { PACK_VERSION } from './chunk-U7BCBJIH.js';
 import { git, readText } from './chunk-4VPBP6K6.js';
 import { promises } from 'fs';
 import path from 'path';

package/dist/{premise-4QRU7LRI.js → premise-U6JIB2QG.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { parseFailOnTier, meetsFailOn, buildTruthEnv, emptyCounters, checkTextClaims, checkDocRefs, loadDecisionLedger, checkDecisionRefs, rankFindings, PATH_TOKEN_RE, KNOWN_EXTENSIONS, NAMESPACE_IDENT, NAMESPACE_STOP } from './chunk-Y4E6ERCM.js';
+import { parseFailOnTier, meetsFailOn, buildTruthEnv, emptyCounters, checkTextClaims, checkDocRefs, loadDecisionLedger, checkDecisionRefs, rankFindings, PATH_TOKEN_RE, HOSTNAME_RE, KNOWN_EXTENSIONS, NAMESPACE_IDENT, NAMESPACE_STOP } from './chunk-EYUW3UJU.js';
 import { print, section, theme, renderFindings } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-EJM47PIF.js';
-import './chunk-UYCGP5BS.js';
+import { scanProject } from './chunk-DLHC7QON.js';
+import './chunk-L4KIIKXI.js';
 import { ETYMD_DIR } from './chunk-P6ATKV2R.js';
-import './chunk-YQZDYDAK.js';
+import './chunk-U7BCBJIH.js';
 import { readText, pathExists } from './chunk-4VPBP6K6.js';
 import path from 'path';
 import { promises } from 'fs';
@@ -21,7 +21,6 @@ var STOP_WORDS = new Set(
 );
 var WRAP_RE = /^([([{"']*)(.*?)([.,;:!?)\]}"']*)$/;
 var TRAIL_RE = /[.,;:!?)\]}"']*$/;
-var HOSTNAME_RE = /^[a-z0-9-]+(?:\.[a-z0-9-]+)*\.([a-z]{2,})$/i;
 function promoteBareTokens(text, ctx) {
   const skips = {
     bareInvocations: 0,
@@ -209,6 +208,11 @@ async function runPremise(opts) {
       `${counters.prospectiveSkipped} path(s) sit in create-this prose (the task says to create them) \u2014 forward-looking, not missing; skipped.`
     );
   }
+  if (counters.fetchedSkipped) {
+    disclosures.push(
+      `${counters.fetchedSkipped} path(s) are named beside the URL they are fetched from \u2014 another tree, not this repo; skipped, not flagged.`
+    );
+  }
   if (counters.placeholderSkipped) {
     disclosures.push(
       `${counters.placeholderSkipped} path(s) are naming stand-ins (e.g. \`my-feature\`) rather than real references; skipped.`

package/dist/{propose-IKE4CUIM.js → propose-NZMEPZIL.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { sweepFleet, loadFleetManifest, FLEET_JSON_SCHEMA } from './chunk-ANXGT7V3.js';
-import './chunk-UV3YIBDW.js';
-import './chunk-Y4E6ERCM.js';
+import { sweepFleet, loadFleetManifest, FLEET_JSON_SCHEMA } from './chunk-ZCOIZVSM.js';
+import './chunk-KIPD3N77.js';
+import './chunk-EYUW3UJU.js';
 import './chunk-3E2IPCRY.js';
 import { print, section, theme, renderFleetNotes } from './chunk-HI7NWPRA.js';
-import './chunk-EJM47PIF.js';
-import './chunk-UYCGP5BS.js';
+import './chunk-DLHC7QON.js';
+import './chunk-L4KIIKXI.js';
 import './chunk-P6ATKV2R.js';
-import './chunk-YQZDYDAK.js';
+import './chunk-U7BCBJIH.js';
 import { readText } from './chunk-4VPBP6K6.js';
 import path from 'path';
 

package/dist/{scan-H3NF5IV5.js → scan-DLKYG5BB.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { print, renderFacts, theme } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-EJM47PIF.js';
-import './chunk-UYCGP5BS.js';
+import { scanProject } from './chunk-DLHC7QON.js';
+import './chunk-L4KIIKXI.js';
 import { writeCachedFacts } from './chunk-P6ATKV2R.js';
-import './chunk-YQZDYDAK.js';
+import './chunk-U7BCBJIH.js';
 import './chunk-4VPBP6K6.js';
 
 // src/commands/scan.ts

package/dist/scan-V53PGAQ6.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+export { scanProject } from './chunk-DLHC7QON.js';
+import './chunk-L4KIIKXI.js';
+import './chunk-U7BCBJIH.js';
+import './chunk-4VPBP6K6.js';

package/dist/{screen-E4FC7W5N.js → screen-S736DXQ5.js}

@@ -6,17 +6,28 @@ import { promises } from 'fs';
 import path from 'path';
 
 var CLASS_DIRECTIVE = /^#[ \t]*class:[ \t]*(secret|vocabulary)\b/i;
-var MACHINE_PATH_RE = /\/(?:Users|home)\/[A-Za-z0-9._-]+\//;
+var MACHINE_PATH_RE = /(?:^|[\s"'=(\[:])\/(?:Users|home)\/[A-Za-z0-9._-]+\//;
 var ALLOW_MARKER = "allow-published-string";
 var ALLOW_FILE = ".etymd-screen-allow";
 var LEGACY_ALLOW_FILE = ".artifact-check-allow";
-var LABELED_LINE = /^(pattern|reason|date|author)[ \t]+(.*)$/;
+var LABELED_LINE = /^(pattern|generated|reason|date|author)[ \t]+(.*)$/;
+function compileLooseRegex(source) {
+  try {
+    return new RegExp(source, "i");
+  } catch {
+    return new RegExp(source.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i");
+  }
+}
 function compileAllow(raw) {
-  const entries = [];
+  const lines = [];
+  const generated = [];
   let current = null;
+  let currentGen = null;
   const close = () => {
-    if (current) entries.push(current);
+    if (current) lines.push(current);
+    if (currentGen) generated.push(currentGen);
     current = null;
+    currentGen = null;
   };
   for (const rawLine of raw.split("\n")) {
     const l = rawLine.trim();
@@ -26,29 +37,26 @@ function compileAllow(raw) {
       const [, label = "", value = ""] = labeled;
       if (label === "pattern") {
         close();
-        current = makeAllowEntry(value);
+        current = { pattern: compileLooseRegex(value), isSelfName: false };
+      } else if (label === "generated") {
+        close();
+        currentGen = { path: compileLooseRegex(value) };
       } else if (current) {
         if (label === "reason") current.reason = value.trim();
         else if (label === "date") current.date = value.trim();
         else current.author = value.trim();
+      } else if (currentGen) {
+        if (label === "reason") currentGen.reason = value.trim();
+        else if (label === "date") currentGen.date = value.trim();
+        else currentGen.author = value.trim();
       }
     } else {
       close();
-      current = makeAllowEntry(l);
+      current = { pattern: compileLooseRegex(l), isSelfName: false };
     }
   }
   close();
-  return entries;
-}
-function makeAllowEntry(patternStr) {
-  try {
-    return { pattern: new RegExp(patternStr, "i"), isSelfName: false };
-  } catch {
-    return {
-      pattern: new RegExp(patternStr.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i"),
-      isSelfName: false
-    };
-  }
+  return { lines, generated };
 }
 function compileOnePattern(l) {
   try {
@@ -117,11 +125,11 @@ async function selfIdentities(cwd) {
   names.delete("");
   return [...names];
 }
-function screenText(text, file, patterns, allow = [], upstreamOwned = false) {
+function screenText(text, file, patterns, allow = [], upstreamOwned = false, generatedData = false) {
   const classed = patterns.map(
     (p) => p instanceof RegExp ? { re: p, cls: "secret" } : p
   );
-  const active = upstreamOwned ? classed.filter((p) => p.cls === "secret") : classed;
+  const active = upstreamOwned || generatedData ? classed.filter((p) => p.cls === "secret") : classed;
   const hits = [];
   const lines = text.split("\n");
   for (const [i, line] of lines.entries()) {
@@ -213,9 +221,9 @@ async function run(opts) {
   }
   const usingLegacy = !await pathExists(path.join(opts.cwd, ALLOW_FILE)) && await pathExists(path.join(opts.cwd, LEGACY_ALLOW_FILE));
   const allowRaw = usingLegacy ? await readText(path.join(opts.cwd, LEGACY_ALLOW_FILE)) : await readText(path.join(opts.cwd, ALLOW_FILE));
-  const allowEntries = allowRaw ? compileAllow(allowRaw) : [];
+  const allowFile = allowRaw ? compileAllow(allowRaw) : { lines: [], generated: [] };
   const selves = await selfIdentities(opts.cwd);
-  const validatedEntries = allowEntries.filter((entry) => {
+  const validatedEntries = allowFile.lines.filter((entry) => {
     if (entry.isSelfName) return true;
     if (isSelfName(entry.pattern, selves)) {
       entry.isSelfName = true;
@@ -233,6 +241,17 @@ async function run(opts) {
     return true;
   });
   const allow = validatedEntries;
+  const generatedPaths = allowFile.generated.filter((entry) => {
+    if (entry.reason && entry.date && entry.author) return true;
+    print(
+      `  ${glyph.partial} ${theme.warn(`Missing provenance for generated-path exemption`)} ${theme.dim(String(entry.path))}`
+    );
+    print(
+      `    ${theme.dim("Format: a `generated` line, then `reason`, `date`, `author` lines \u2014 all four required")}`
+    );
+    return false;
+  });
+  const isGenerated = (rel) => generatedPaths.some((e) => e.path.test(rel));
   const active = selves.length ? patterns.filter((p) => !isSelfName(p.re, selves)) : patterns;
   const hasVocab = active.some((p) => p.cls === "vocabulary");
   const upstreamRemote = hasVocab && (opts.scope === "staged" || opts.scope === "tree") ? opts.upstream ?? await git(opts.cwd, ["config", "--get", "etymd.upstream"]) ?? void 0 : void 0;
@@ -263,6 +282,7 @@ async function run(opts) {
   const hits = [];
   let scanned = 0;
   let skippedBinary = 0;
+  const generatedExempted = [];
   if (opts.scope === "message") {
     const file = opts.target;
     if (!file) throw new Error("--message needs the message file path (the commit-msg hook's $1)");
@@ -284,7 +304,10 @@ async function run(opts) {
         continue;
       }
       scanned++;
-      hits.push(...screenText(raw, path.relative(dir, f), active, allow));
+      const rel = path.relative(dir, f);
+      const gen = isGenerated(rel);
+      if (gen) generatedExempted.push(rel);
+      hits.push(...screenText(raw, rel, active, allow, false, gen));
     }
   } else {
     const listing = opts.scope === "tree" ? await git(opts.cwd, ["ls-files"]) : await git(opts.cwd, ["diff", "--cached", "--name-only", "--diff-filter=ACM"]);
@@ -300,7 +323,9 @@ async function run(opts) {
         continue;
       }
       scanned++;
-      hits.push(...screenText(raw, rel, active, allow, isUpstreamOwned(rel)));
+      const gen = isGenerated(rel);
+      if (gen) generatedExempted.push(rel);
+      hits.push(...screenText(raw, rel, active, allow, isUpstreamOwned(rel), gen));
     }
   }
   if (upstreamNote) {
@@ -308,9 +333,16 @@ async function run(opts) {
   }
   section(
     `Content screen ${theme.dim(
-      `\xB7 ${opts.scope} \xB7 ${scanned} file(s)${skippedBinary ? ` \xB7 ${skippedBinary} binary skipped` : ""}`
+      `\xB7 ${opts.scope} \xB7 ${scanned} file(s)${skippedBinary ? ` \xB7 ${skippedBinary} binary skipped` : ""}${generatedExempted.length ? ` \xB7 ${generatedExempted.length} generated exempt` : ""}`
     )}`
   );
+  if (generatedExempted.length) {
+    print(
+      `  ${glyph.partial} ${theme.dim(
+        `generated data, vocabulary-class dropped (secret-class and machine paths still screened): ${generatedExempted.join(", ")}`
+      )}`
+    );
+  }
   if (!hits.length) {
     print(`  ${glyph.ok} ${theme.dim("clean")}`);
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "etymd",
-  "version": "0.16.0",
+  "version": "0.19.0",
   "description": "Keep your agent instructions true — verify AGENTS.md, CLAUDE.md, rules, skills, and the task you hand an agent against the actual repo, with drift caught over time and a regression ledger.",
   "keywords": [
     "cli",
@@ -74,7 +74,7 @@
     "prettier": "3.4.2",
     "tsup": "8.5.1",
     "typescript": "5.7.2",
-    "vitest": "4.1.10"
+    "vitest": "4.1.11"
   },
   "publishConfig": {
     "access": "public"

package/dist/audit-HBNXNGD6.js

@@ -1,11 +0,0 @@
-#!/usr/bin/env node
-export { run } from './chunk-FKDT4RBP.js';
-import './chunk-UV3YIBDW.js';
-import './chunk-Y4E6ERCM.js';
-import './chunk-3E2IPCRY.js';
-import './chunk-HI7NWPRA.js';
-import './chunk-EJM47PIF.js';
-import './chunk-UYCGP5BS.js';
-import './chunk-P6ATKV2R.js';
-import './chunk-YQZDYDAK.js';
-import './chunk-4VPBP6K6.js';

package/dist/scan-64Z6SNYF.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-export { scanProject } from './chunk-EJM47PIF.js';
-import './chunk-UYCGP5BS.js';
-import './chunk-YQZDYDAK.js';
-import './chunk-4VPBP6K6.js';