javi-forge 1.25.1 → 1.27.0

package/dist/commands/skills/parsing.js

@@ -1,7 +1,8 @@
 import path from "node:path";
 import fs from "fs-extra";
 import { parseFrontmatter } from "../../lib/frontmatter.js";
-import { CHARS_PER_TOKEN } from "./constants.js";
+import { describeSafeReadFailure, safeReadFile, } from "../../lib/safe-read.js";
+import { CHARS_PER_TOKEN, MAX_SKILL_BYTES } from "./constants.js";
 // ── Helpers ──────────────────────────────────────────────────────────────────
 /** Estimate token count from a string */
 export function estimateTokens(text) {
@@ -11,7 +12,24 @@ export function estimateTokens(text) {
 export async function parseSkillFile(skillPath) {
     if (!(await fs.pathExists(skillPath)))
         return null;
-    const raw = await fs.readFile(skillPath, "utf-8");
+    const read = await safeReadFile(skillPath, {
+        hardRejectOverBytes: MAX_SKILL_BYTES,
+    });
+    if (!read.ok) {
+        // A path that vanished between the existence check and the read is the
+        // same "no such skill" case the caller already handles with null.
+        if (read.reason === "not-found" || read.reason === "not-a-file")
+            return null;
+        return {
+            name: path.basename(path.dirname(skillPath)),
+            rules: [],
+            rawContent: "",
+            triggers: [],
+            skip: { reason: read.reason, message: describeSafeReadFailure(read) },
+            truncated: false,
+        };
+    }
+    const raw = read.content;
     const fm = parseFrontmatter(raw);
     const rawName = fm?.data?.name;
     const name = typeof rawName === "string"
@@ -23,7 +41,15 @@ export async function parseSkillFile(skillPath) {
     const rawDesc = fm?.data?.description;
     const description = typeof rawDesc === "string" ? rawDesc : "";
     const triggers = extractTriggers(description);
-    return { name, rules, rawContent: raw, triggers };
+    // rawContent is the kept text, so token estimates reflect what was analysed.
+    return {
+        name,
+        rules,
+        rawContent: raw,
+        triggers,
+        skip: null,
+        truncated: read.truncated,
+    };
 }
 /** Extract critical rules from markdown content */
 export function extractCriticalRules(content) {

package/dist/commands/skills/scoring.d.ts

@@ -1,10 +1,11 @@
 import type { SkillGrade, SkillRegistryGateResult, SkillScore } from "../../types/index.js";
-type ParsedSkill = {
-    name: string;
-    rules: string[];
-    rawContent: string;
-    triggers: string[];
-};
+import { type ParsedSkillFile } from "./parsing.js";
+/**
+ * The fields the dimension scorers read. Derived from `ParsedSkillFile` with
+ * `Pick` (not a hand-copied shape) so the `skip` field can never be silently
+ * dropped: a skipped parse is caught in `scoreSkill` before it reaches a scorer.
+ */
+type ParsedSkill = Pick<ParsedSkillFile, "name" | "rules" | "rawContent" | "triggers">;
 /**
  * Score completeness (0-100): frontmatter fields, critical rules, structure.
  */

package/dist/commands/skills/scoring.js

@@ -1,5 +1,5 @@
 import { DEFAULT_REGISTRY_THRESHOLD, DEFAULT_THRESHOLD } from "./constants.js";
-import { estimateTokens, parseSkillFile } from "./parsing.js";
+import { estimateTokens, parseSkillFile, } from "./parsing.js";
 import { ACTION_VERBS, VAGUE_TERMS } from "./rules.js";
 // ── Dangerous content patterns (private to scoreSafety) ─────────────────────
 /** Dangerous patterns in skill content that indicate safety risks */
@@ -243,6 +243,26 @@ export async function scoreSkill(skillPath, threshold = DEFAULT_THRESHOLD) {
     const parsed = await parseSkillFile(skillPath);
     if (!parsed)
         return null;
+    // A file that could not be read is NOT a zero-content skill. Scoring it would
+    // invent a grade over an empty string — worse, `scoreSafety` starts at 100
+    // and finds no dangerous patterns in nothing, so an unreadable file would
+    // report perfect safety. Represent it as unread and fail closed instead.
+    if (parsed.skip) {
+        return {
+            skillName: parsed.name,
+            completeness: 0,
+            clarity: 0,
+            testability: 0,
+            tokenEfficiency: 0,
+            safety: 0,
+            agentReadiness: 0,
+            overall: 0,
+            grade: "F",
+            threshold,
+            passing: false,
+            unread: parsed.skip.message,
+        };
+    }
     const completeness = scoreCompleteness(parsed);
     const clarity = scoreClarity(parsed);
     const testability = scoreTestability(parsed);
@@ -279,6 +299,16 @@ export async function registryGate(skillPath, threshold = DEFAULT_REGISTRY_THRES
     const score = await scoreSkill(skillPath, threshold);
     if (!score)
         return null;
+    // An unread skill can never be accepted into the registry: it was not scored,
+    // so it cannot clear any threshold. Reject it with an explicit reason.
+    if (score.unread) {
+        return {
+            skillName: score.skillName,
+            score,
+            accepted: false,
+            reason: `Rejected: could not read skill (${score.unread}) — not scored`,
+        };
+    }
     const accepted = score.passing;
     let reason;
     if (!accepted) {

package/dist/constants.d.ts

@@ -37,7 +37,12 @@ export declare const STACK_CONTEXT_MAP: Record<string, StackContextEntry>;
 export declare const DEPLOY_TEMPLATE_MAP: Record<string, string>;
 /** Deploy destination path mapping (per CI provider) */
 export declare const DEPLOY_DESTINATION_MAP: Record<string, string>;
-/** Hook reliability profile definitions */
+/**
+ * Hook security-preset definitions (hook-consolidation S4). The selected
+ * profile drives WHICH `hooks:` security sections get merged into
+ * `.javi-forge/ci.yaml` (see src/commands/init/steps/security.ts PROFILE_PRESET).
+ * `hooks` lists the enabled dispatcher sections for display only.
+ */
 export declare const HOOK_PROFILES: Record<HookProfile, {
     label: string;
     description: string;

package/dist/constants.js

@@ -186,22 +186,27 @@ export const DEPLOY_DESTINATION_MAP = {
     gitlab: ".gitlab-ci-deploy.yml",
     woodpecker: ".woodpecker/deploy.yml",
 };
-/** Hook reliability profile definitions */
+/**
+ * Hook security-preset definitions (hook-consolidation S4). The selected
+ * profile drives WHICH `hooks:` security sections get merged into
+ * `.javi-forge/ci.yaml` (see src/commands/init/steps/security.ts PROFILE_PRESET).
+ * `hooks` lists the enabled dispatcher sections for display only.
+ */
 export const HOOK_PROFILES = {
     minimal: {
         label: "Minimal",
-        description: "pre-commit only: lint + format check",
-        hooks: ["pre-commit"],
+        description: "CI gate only — no security scans",
+        hooks: ["ci"],
     },
     standard: {
         label: "Standard",
-        description: "pre-commit + pre-push + CI gate check",
-        hooks: ["pre-commit", "pre-push", "ci-gate"],
+        description: "secret scan + dependency audit",
+        hooks: ["secrets", "deps", "ci"],
     },
     strict: {
         label: "Strict",
-        description: "all standard + commit-msg validation + security scan on every push",
-        hooks: ["pre-commit", "pre-push", "ci-gate", "commit-msg", "security-scan"],
+        description: "secret scan + permission checks + dependency audit",
+        hooks: ["secrets", "permissions", "deps", "ci"],
     },
 };
 /** Stack-to-CI template filename mapping */

package/dist/lib/context.d.ts

@@ -1,9 +1,28 @@
 import type { InitOptions, StackContextEntry } from "../types/index.js";
 export declare function buildIndexMd(projectName: string, stackCtx: StackContextEntry, ciProvider: string, memory: string): string;
 export declare function buildSummaryMd(projectName: string, stack: string, ciProvider: string, memory: string, modules: string[], dependencies?: string[]): string;
+/**
+ * Dependency detection outcome. `warnings` explains every manifest that could
+ * not be read or parsed, so a failure is distinguishable from "no dependencies"
+ * instead of being swallowed by a blanket catch.
+ */
+export interface DependencyDetection {
+    dependencies: string[];
+    warnings: string[];
+}
+/**
+ * Detect top-level dependencies from project manifest files, reporting why a
+ * manifest was skipped. Returns up to 10 dependency names (key deps only).
+ */
+export declare function detectDependenciesDetailed(projectDir: string, stack: string): Promise<DependencyDetection>;
 /**
  * Detect top-level dependencies from project manifest files.
  * Returns up to 10 dependency names (key deps only, not devDeps).
+ *
+ * List-returning convenience over `detectDependenciesDetailed`. It DISCARDS the
+ * read/parse warnings — an unreadable manifest is indistinguishable from an
+ * honest empty list through this function. Callers that must tell those two
+ * apart (like `refreshContextDir`) call `detectDependenciesDetailed` directly.
  */
 export declare function detectDependencies(projectDir: string, stack: string): Promise<string[]>;
 /**
@@ -23,5 +42,8 @@ export declare function refreshContextDir(projectDir: string): Promise<{
     index: string;
     summary: string;
     updated: boolean;
+    /** Manifest read/parse warnings — surfaced so an unreadable manifest is not
+     * silently reported as a project with no dependencies. */
+    warnings: string[];
 } | null>;
 //# sourceMappingURL=context.d.ts.map

package/dist/lib/context.js

@@ -1,6 +1,7 @@
 import path from "node:path";
 import fs from "fs-extra";
 import { STACK_CONTEXT_MAP } from "../constants.js";
+import { describeSafeReadFailure, safeReadFile } from "./safe-read.js";
 // =============================================================================
 // Internal helpers
 // =============================================================================
@@ -53,95 +54,135 @@ ${stack}-based project scaffolded with javi-forge.
 // =============================================================================
 // Dependency detection
 // =============================================================================
+const MAX_DEPS = 10;
 /**
- * Detect top-level dependencies from project manifest files.
- * Returns up to 10 dependency names (key deps only, not devDeps).
+ * Byte ceiling for a dependency manifest. A package.json or go.mod past this is
+ * not a manifest we can learn anything useful from — it is generated noise.
  */
-export async function detectDependencies(projectDir, stack) {
-    const MAX_DEPS = 10;
-    try {
-        switch (stack) {
-            case "node": {
-                const pkgPath = path.join(projectDir, "package.json");
-                if (!(await fs.pathExists(pkgPath)))
-                    return [];
-                const pkg = await fs.readJson(pkgPath).catch(() => ({}));
-                const deps = Object.keys(pkg.dependencies ?? {});
-                return deps.slice(0, MAX_DEPS);
+const MAX_MANIFEST_BYTES = 512 * 1024;
+/** Read a manifest under a byte budget; returns null and a warning on failure. */
+async function readManifest(manifestPath, warnings) {
+    const read = await safeReadFile(manifestPath, {
+        hardRejectOverBytes: MAX_MANIFEST_BYTES,
+    });
+    if (!read.ok) {
+        warnings.push(`${path.basename(manifestPath)}: ${describeSafeReadFailure(read)}`);
+        return null;
+    }
+    if (read.truncated) {
+        warnings.push(`${path.basename(manifestPath)}: truncated at ${read.bytesRead} of ${read.totalBytes} bytes`);
+    }
+    return read.content;
+}
+/**
+ * Detect top-level dependencies from project manifest files, reporting why a
+ * manifest was skipped. Returns up to 10 dependency names (key deps only).
+ */
+export async function detectDependenciesDetailed(projectDir, stack) {
+    const warnings = [];
+    switch (stack) {
+        case "node": {
+            const pkgPath = path.join(projectDir, "package.json");
+            if (!(await fs.pathExists(pkgPath)))
+                return { dependencies: [], warnings };
+            const content = await readManifest(pkgPath, warnings);
+            if (content === null)
+                return { dependencies: [], warnings };
+            let pkg;
+            try {
+                pkg = JSON.parse(content);
             }
-            case "python": {
-                const pyprojectPath = path.join(projectDir, "pyproject.toml");
-                if (await fs.pathExists(pyprojectPath)) {
-                    const content = await fs.readFile(pyprojectPath, "utf-8");
-                    const match = content.match(/dependencies\s*=\s*\[([\s\S]*?)\]/);
-                    if (match?.[1]) {
-                        const deps = match[1]
-                            .split("\n")
-                            .map((l) => l.replace(/[",]/g, "").trim())
-                            .filter((l) => l.length > 0 && !l.startsWith("#"))
-                            .map((l) => l.split(/[>=<~!]/)[0].trim())
-                            .filter(Boolean);
-                        return deps.slice(0, MAX_DEPS);
-                    }
-                }
-                const reqPath = path.join(projectDir, "requirements.txt");
-                if (await fs.pathExists(reqPath)) {
-                    const content = await fs.readFile(reqPath, "utf-8");
-                    const deps = content
+            catch (err) {
+                warnings.push(`package.json: invalid JSON (${err instanceof Error ? err.message : String(err)})`);
+                return { dependencies: [], warnings };
+            }
+            const deps = Object.keys(pkg?.dependencies ?? {});
+            return { dependencies: deps.slice(0, MAX_DEPS), warnings };
+        }
+        case "python": {
+            const pyprojectPath = path.join(projectDir, "pyproject.toml");
+            if (await fs.pathExists(pyprojectPath)) {
+                const content = await readManifest(pyprojectPath, warnings);
+                const match = content?.match(/dependencies\s*=\s*\[([\s\S]*?)\]/);
+                if (match?.[1]) {
+                    const deps = match[1]
                         .split("\n")
-                        .map((l) => l.trim())
-                        .filter((l) => l.length > 0 && !l.startsWith("#") && !l.startsWith("-"))
+                        .map((l) => l.replace(/[",]/g, "").trim())
+                        .filter((l) => l.length > 0 && !l.startsWith("#"))
                         .map((l) => l.split(/[>=<~!]/)[0].trim())
                         .filter(Boolean);
-                    return deps.slice(0, MAX_DEPS);
+                    return { dependencies: deps.slice(0, MAX_DEPS), warnings };
                 }
-                return [];
             }
-            case "go": {
-                const goModPath = path.join(projectDir, "go.mod");
-                if (!(await fs.pathExists(goModPath)))
-                    return [];
-                const content = await fs.readFile(goModPath, "utf-8");
-                const requireBlock = content.match(/require\s*\(([\s\S]*?)\)/);
-                if (requireBlock?.[1]) {
-                    const deps = requireBlock[1]
-                        .split("\n")
-                        .map((l) => l.trim())
-                        .filter((l) => l.length > 0 && !l.startsWith("//"))
-                        .map((l) => {
-                        const parts = l.split(/\s+/);
-                        const mod = parts[0] ?? "";
-                        return mod.split("/").pop() ?? mod;
-                    })
-                        .filter(Boolean);
-                    return deps.slice(0, MAX_DEPS);
-                }
-                return [];
+            const reqPath = path.join(projectDir, "requirements.txt");
+            if (await fs.pathExists(reqPath)) {
+                const content = await readManifest(reqPath, warnings);
+                if (content === null)
+                    return { dependencies: [], warnings };
+                const deps = content
+                    .split("\n")
+                    .map((l) => l.trim())
+                    .filter((l) => l.length > 0 && !l.startsWith("#") && !l.startsWith("-"))
+                    .map((l) => l.split(/[>=<~!]/)[0].trim())
+                    .filter(Boolean);
+                return { dependencies: deps.slice(0, MAX_DEPS), warnings };
             }
-            case "rust": {
-                const cargoPath = path.join(projectDir, "Cargo.toml");
-                if (!(await fs.pathExists(cargoPath)))
-                    return [];
-                const content = await fs.readFile(cargoPath, "utf-8");
-                const depsSection = content.match(/\[dependencies\]([\s\S]*?)(?=\n\[|$)/);
-                if (depsSection?.[1]) {
-                    const deps = depsSection[1]
-                        .split("\n")
-                        .map((l) => l.trim())
-                        .filter((l) => l.length > 0 && !l.startsWith("#"))
-                        .map((l) => l.split(/\s*=/)[0].trim())
-                        .filter(Boolean);
-                    return deps.slice(0, MAX_DEPS);
-                }
-                return [];
+            return { dependencies: [], warnings };
+        }
+        case "go": {
+            const goModPath = path.join(projectDir, "go.mod");
+            if (!(await fs.pathExists(goModPath)))
+                return { dependencies: [], warnings };
+            const content = await readManifest(goModPath, warnings);
+            const requireBlock = content?.match(/require\s*\(([\s\S]*?)\)/);
+            if (requireBlock?.[1]) {
+                const deps = requireBlock[1]
+                    .split("\n")
+                    .map((l) => l.trim())
+                    .filter((l) => l.length > 0 && !l.startsWith("//"))
+                    .map((l) => {
+                    const parts = l.split(/\s+/);
+                    const mod = parts[0] ?? "";
+                    return mod.split("/").pop() ?? mod;
+                })
+                    .filter(Boolean);
+                return { dependencies: deps.slice(0, MAX_DEPS), warnings };
             }
-            default:
-                return [];
+            return { dependencies: [], warnings };
         }
+        case "rust": {
+            const cargoPath = path.join(projectDir, "Cargo.toml");
+            if (!(await fs.pathExists(cargoPath)))
+                return { dependencies: [], warnings };
+            const content = await readManifest(cargoPath, warnings);
+            const depsSection = content?.match(/\[dependencies\]([\s\S]*?)(?=\n\[|$)/);
+            if (depsSection?.[1]) {
+                const deps = depsSection[1]
+                    .split("\n")
+                    .map((l) => l.trim())
+                    .filter((l) => l.length > 0 && !l.startsWith("#"))
+                    .map((l) => l.split(/\s*=/)[0].trim())
+                    .filter(Boolean);
+                return { dependencies: deps.slice(0, MAX_DEPS), warnings };
+            }
+            return { dependencies: [], warnings };
+        }
+        default:
+            return { dependencies: [], warnings };
     }
-    catch {
-        return [];
-    }
+}
+/**
+ * Detect top-level dependencies from project manifest files.
+ * Returns up to 10 dependency names (key deps only, not devDeps).
+ *
+ * List-returning convenience over `detectDependenciesDetailed`. It DISCARDS the
+ * read/parse warnings — an unreadable manifest is indistinguishable from an
+ * honest empty list through this function. Callers that must tell those two
+ * apart (like `refreshContextDir`) call `detectDependenciesDetailed` directly.
+ */
+export async function detectDependencies(projectDir, stack) {
+    const { dependencies } = await detectDependenciesDetailed(projectDir, stack);
+    return dependencies;
 }
 // =============================================================================
 // Public API
@@ -190,7 +231,7 @@ export async function refreshContextDir(projectDir) {
         return null;
     }
     const stackCtx = getStackContext(manifest.stack);
-    const dependencies = await detectDependencies(projectDir, manifest.stack);
+    const { dependencies, warnings } = await detectDependenciesDetailed(projectDir, manifest.stack);
     const index = buildIndexMd(manifest.projectName, stackCtx, manifest.ciProvider, manifest.memory);
     const summary = buildSummaryMd(manifest.projectName, manifest.stack, manifest.ciProvider, manifest.memory, manifest.modules, dependencies);
     // Write updated files
@@ -199,6 +240,6 @@ export async function refreshContextDir(projectDir) {
     // Update manifest timestamp
     manifest.updatedAt = new Date().toISOString();
     await fs.writeJson(manifestPath, manifest, { spaces: 2 });
-    return { index, summary, updated: true };
+    return { index, summary, updated: true, warnings };
 }
 //# sourceMappingURL=context.js.map

package/dist/lib/safe-read.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Bounded, non-throwing file reads.
+ *
+ * Every whole-file read in this CLI used to be an unguarded
+ * `fs.readFile(path, "utf-8")`: a 400 MB log, a minified bundle or a binary
+ * blob under a scanned directory could exhaust memory or stall a scan. This
+ * module is the single guarded entry point — it caps bytes during the read,
+ * rejects binaries by content sniffing, clamps pathological single lines, and
+ * returns a discriminated union instead of throwing for expected conditions.
+ *
+ * Deliberately NOT included: no path allow/block list. This is a local CLI
+ * operating on the user's own repository, so any path they can name they can
+ * already `cat`; a blocklist would add friction without adding a boundary.
+ */
+/** Default byte budget for a single read (1 MiB). */
+export declare const DEFAULT_MAX_BYTES: number;
+/** Default per-line character clamp — catches minified bundles and data URIs. */
+export declare const DEFAULT_MAX_LINE_LENGTH = 10000;
+export interface SafeReadOptions {
+    /** Maximum bytes kept. Anything beyond is dropped and `truncated` is set. */
+    maxBytes?: number;
+    /** Per-line character clamp. Use `0` or `Infinity` to disable. */
+    maxLineLength?: number;
+    /**
+     * If the file is larger than this, fail with `too-large` instead of
+     * truncating. Off by default — truncation is the normal behavior.
+     */
+    hardRejectOverBytes?: number;
+}
+export type SafeReadFailureReason = "not-found" | "not-a-file" | "binary" | "too-large" | "io-error";
+export interface SafeReadSuccess {
+    ok: true;
+    content: string;
+    /** True when the file had more bytes than the budget allowed. */
+    truncated: boolean;
+    /** Bytes actually decoded into `content` (before BOM stripping). */
+    bytesRead: number;
+    /** File size reported by `stat` at the time of the read. */
+    totalBytes: number;
+    /** True when at least one line hit the per-line clamp. */
+    longLinesClamped: boolean;
+}
+export interface SafeReadFailure {
+    ok: false;
+    reason: SafeReadFailureReason;
+    detail?: string;
+}
+export type SafeReadResult = SafeReadSuccess | SafeReadFailure;
+/**
+ * Read a text file with a byte budget, binary rejection and line clamping.
+ *
+ * Never throws for expected conditions (missing file, directory, binary,
+ * oversized, permission denied) — inspect `result.ok` and branch on `reason`.
+ *
+ * Newlines are returned verbatim: CRLF is NOT normalized, because the callers
+ * migrated to this helper already tolerate `\r` (they `trim()` split lines) and
+ * silently rewriting bytes would make reported offsets diverge from the file.
+ */
+export declare function safeReadFile(filePath: string, opts?: SafeReadOptions): Promise<SafeReadResult>;
+/** Human-readable one-liner for a failed read — for CLI notes and findings. */
+export declare function describeSafeReadFailure(failure: SafeReadFailure): string;
+//# sourceMappingURL=safe-read.d.ts.map