ma-agents 3.15.0-beta.1 → 3.15.0-beta.2

package/lib/bmad-extension-plugin/.claude-plugin/marketplace.json

@@ -37,7 +37,7 @@
       "name": "ma-skills",
       "source": "./",
       "description": "ma-agents extension module providing enterprise SDLC personas and operational workflow skills.",
-      "version": "3.15.0-beta.1",
+      "version": "3.15.0-beta.2",
       "author": {
         "name": "Alon Mayaffit"
       },

package/lib/knowledge-atlas/dist/atlas.cjs

@@ -2005,11 +2005,11 @@ var require_lunr = __commonJS({
 });
 
 // lib/knowledge-atlas/src/cli.ts
-var path11 = __toESM(require("path"));
+var path12 = __toESM(require("path"));
 
 // lib/knowledge-atlas/src/generate.ts
 var fs11 = __toESM(require("fs"));
-var path10 = __toESM(require("path"));
+var path11 = __toESM(require("path"));
 
 // lib/knowledge-atlas/src/scan/scanner.ts
 var fs2 = __toESM(require("fs"));
@@ -5635,7 +5635,7 @@ function mergeRecords(unchanged, reprocessed, removed) {
 
 // lib/knowledge-atlas/src/render/site.ts
 var fs7 = __toESM(require("fs"));
-var path6 = __toESM(require("path"));
+var path7 = __toESM(require("path"));
 
 // lib/knowledge-atlas/src/render/design-system.ts
 var DESIGN_SYSTEM_CSS = `/* Knowledge Atlas \u2014 design system (Story 29.3) */
@@ -6301,7 +6301,7 @@ ${scripts.join("\n")}` : "";
 
 // lib/knowledge-atlas/src/render/document.ts
 var fs6 = __toESM(require("fs"));
-var path5 = __toESM(require("path"));
+var path6 = __toESM(require("path"));
 
 // node_modules/markdown-it/lib/common/utils.mjs
 var utils_exports = {};
@@ -11694,6 +11694,7 @@ function renderBacklinksHtml(backlinks, manifest, fromRel = "docs/page.html") {
 }
 
 // lib/knowledge-atlas/src/render/linkify.ts
+var path5 = __toESM(require("path"));
 var ENTITY_PATTERNS = [
   /\bNFR\d+\b/g,
   // NFR62, NFR12, etc.
@@ -11822,6 +11823,63 @@ function linkifyText(text2, manifest, currentFileId, docFileIds, slugMap) {
   result += text2.slice(last);
   return result;
 }
+function decodeHrefEntities(value) {
+  return value.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#0?39;/g, "'");
+}
+function encodeHrefForAttr(value) {
+  return value.replace(/&/g, "&amp;");
+}
+function resolveAuthoredHref(href, currentFileId, fileIdLookup, slugMap) {
+  const trimmed = href.trim();
+  if (trimmed === "") return null;
+  if (/^(?:[a-zA-Z][a-zA-Z0-9+.-]*:|#|\/\/)/.test(trimmed)) return null;
+  if (trimmed.startsWith("/")) return null;
+  const hashIdx = trimmed.indexOf("#");
+  const rawPath = hashIdx === -1 ? trimmed : trimmed.slice(0, hashIdx);
+  const fragment = hashIdx === -1 ? "" : trimmed.slice(hashIdx);
+  if (rawPath === "") return null;
+  let decodedPath;
+  try {
+    decodedPath = decodeURIComponent(rawPath);
+  } catch {
+    decodedPath = rawPath;
+  }
+  const currentDir = path5.posix.dirname(currentFileId);
+  const joined = currentDir === "." ? decodedPath : `${currentDir}/${decodedPath}`;
+  const resolved = path5.posix.normalize(joined).replace(/\/+$/, "");
+  if (resolved === ".." || resolved.startsWith("../")) return null;
+  const matchedFileId = fileIdLookup.get(resolved.toLowerCase());
+  if (!matchedFileId) return null;
+  const targetSlug = slugMap.get(matchedFileId);
+  if (!targetSlug) return null;
+  if (matchedFileId === currentFileId) {
+    return fragment || "#";
+  }
+  return `${targetSlug}.html${fragment}`;
+}
+function rewriteAuthoredLinks(html, manifest, currentFileId) {
+  if (!html) return html;
+  const fileIds = manifest.files.map((f) => f.path);
+  if (fileIds.length === 0) return html;
+  const slugMap = buildSlugMap(fileIds);
+  const fileIdLookup = /* @__PURE__ */ new Map();
+  for (const id of fileIds) {
+    const key = id.toLowerCase();
+    if (!fileIdLookup.has(key)) fileIdLookup.set(key, id);
+  }
+  return html.replace(/<a\b[^>]*>/gi, (tag) => {
+    const hrefMatch = tag.match(/\bhref\s*=\s*(?:"([^"]*)"|'([^']*)')/i);
+    if (!hrefMatch) return tag;
+    const usesDoubleQuote = hrefMatch[1] !== void 0;
+    const rawAttrValue = usesDoubleQuote ? hrefMatch[1] : hrefMatch[2];
+    const decoded = decodeHrefEntities(rawAttrValue);
+    const rewritten = resolveAuthoredHref(decoded, currentFileId, fileIdLookup, slugMap);
+    if (rewritten === null) return tag;
+    const quote = usesDoubleQuote ? '"' : "'";
+    const newAttr = `href=${quote}${encodeHrefForAttr(rewritten)}${quote}`;
+    return tag.slice(0, hrefMatch.index) + newAttr + tag.slice(hrefMatch.index + hrefMatch[0].length);
+  });
+}
 var ALLOWED_TAGS = /* @__PURE__ */ new Set([
   "p",
   "a",
@@ -12053,7 +12111,7 @@ function getFileNodes(fileId, nodes) {
   return nodes.filter((n) => n.fileId === fileId);
 }
 function renderDocumentPage(fileRec, manifest, projectRoot, navFlags, resolveAbsPath) {
-  const absPath = resolveAbsPath?.(fileRec.path) ?? path5.join(projectRoot, fileRec.path);
+  const absPath = resolveAbsPath?.(fileRec.path) ?? path6.join(projectRoot, fileRec.path);
   const title = fileTitle(fileRec.path);
   let rawContent = "";
   try {
@@ -12077,6 +12135,7 @@ function renderDocumentPage(fileRec, manifest, projectRoot, navFlags, resolveAbs
   renderedHtml = addHeadingAnchors(renderedHtml);
   const { html: mermaidHtml } = processMermaidFences(renderedHtml);
   renderedHtml = mermaidHtml;
+  renderedHtml = rewriteAuthoredLinks(renderedHtml, manifest, fileRec.path);
   renderedHtml = linkifyHtml(renderedHtml, manifest, fileRec.path);
   renderedHtml = sanitizeHtml(renderedHtml);
   const fileIds = manifest.files.map((f) => f.path);
@@ -12334,7 +12393,7 @@ function esc6(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 function writeHtml(filePath, content) {
-  fs7.mkdirSync(path6.dirname(filePath), { recursive: true });
+  fs7.mkdirSync(path7.dirname(filePath), { recursive: true });
   fs7.writeFileSync(filePath, content.replace(/\r\n/g, "\n"), { encoding: "utf-8" });
 }
 function renderHomePage(manifest, navFlags) {
@@ -12473,34 +12532,34 @@ function renderSite(manifest, outDir, resolveAbsPath) {
   const written = [];
   const docBodies = /* @__PURE__ */ new Map();
   fs7.mkdirSync(outDir, { recursive: true });
-  fs7.mkdirSync(path6.join(outDir, "docs"), { recursive: true });
+  fs7.mkdirSync(path7.join(outDir, "docs"), { recursive: true });
   const fileIds = manifest.files.map((f) => f.path);
   const slugMap = buildSlugMap(fileIds);
   const navFlags = {
-    hasGraphPage: fs7.existsSync(path6.join(outDir, "graph.html")),
-    hasDiagramsPage: fs7.existsSync(path6.join(outDir, "diagrams.html")),
-    hasOrphansPage: fs7.existsSync(path6.join(outDir, "orphans.html"))
+    hasGraphPage: fs7.existsSync(path7.join(outDir, "graph.html")),
+    hasDiagramsPage: fs7.existsSync(path7.join(outDir, "diagrams.html")),
+    hasOrphansPage: fs7.existsSync(path7.join(outDir, "orphans.html"))
   };
   for (const file of manifest.files) {
     const slug = slugMap.get(file.path) ?? filePathToSlug(file.path);
     const { html, articleText } = renderDocumentPage(file, manifest, manifest.projectRoot, navFlags, resolveAbsPath);
     const relPath = `docs/${slug}.html`;
-    writeHtml(path6.join(outDir, relPath), html);
+    writeHtml(path7.join(outDir, relPath), html);
     written.push(relPath);
     docBodies.set(file.path, articleText);
   }
   const searchHtml = renderSearchPageHtml(manifest, docBodies, navFlags);
-  writeHtml(path6.join(outDir, "search.html"), searchHtml);
+  writeHtml(path7.join(outDir, "search.html"), searchHtml);
   written.push("search.html");
   const indexHtml = renderHomePage(manifest, navFlags);
-  writeHtml(path6.join(outDir, "index.html"), indexHtml);
+  writeHtml(path7.join(outDir, "index.html"), indexHtml);
   written.push("index.html");
   return written.sort();
 }
 
 // lib/knowledge-atlas/src/render/graph.ts
 var fs8 = __toESM(require("fs"));
-var path7 = __toESM(require("path"));
+var path8 = __toESM(require("path"));
 
 // lib/knowledge-atlas/src/render/force-graph-umd.ts
 var FORCE_GRAPH_UMD = `// Version 1.51.4 force-graph - https://github.com/vasturiano/force-graph
@@ -12963,7 +13022,7 @@ function renderGraphPage(manifest, outDir) {
     ""
     // trailing newline
   ].join("\n");
-  const outPath = path7.join(outDir, "graph.html");
+  const outPath = path8.join(outDir, "graph.html");
   fs8.mkdirSync(outDir, { recursive: true });
   fs8.writeFileSync(outPath, html.replace(/\r\n/g, "\n"), { encoding: "utf-8" });
   return ["graph.html"];
@@ -13217,7 +13276,7 @@ function buildAppScript() {
 
 // lib/knowledge-atlas/src/render/diagrams.ts
 var fs9 = __toESM(require("fs"));
-var path8 = __toESM(require("path"));
+var path9 = __toESM(require("path"));
 function esc8(s) {
   return (s ?? "").toString().replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
@@ -13784,7 +13843,7 @@ function renderDiagrams(manifest, outDir) {
     ""
     // trailing newline
   ].join("\n");
-  const outPath = path8.join(outDir, "diagrams.html");
+  const outPath = path9.join(outDir, "diagrams.html");
   fs9.mkdirSync(outDir, { recursive: true });
   fs9.writeFileSync(outPath, html.replace(/\r\n/g, "\n"), { encoding: "utf-8" });
   return ["diagrams.html"];
@@ -13792,7 +13851,7 @@ function renderDiagrams(manifest, outDir) {
 
 // lib/knowledge-atlas/src/render/orphan.ts
 var fs10 = __toESM(require("fs"));
-var path9 = __toESM(require("path"));
+var path10 = __toESM(require("path"));
 function esc9(s) {
   return (s ?? "").toString().replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
@@ -14154,7 +14213,7 @@ function renderOrphanPage(manifest, outDir) {
     ""
     // trailing newline
   ].join("\n");
-  const outPath = path9.join(outDir, "orphans.html");
+  const outPath = path10.join(outDir, "orphans.html");
   fs10.mkdirSync(outDir, { recursive: true });
   fs10.writeFileSync(outPath, html.replace(/\r\n/g, "\n"), { encoding: "utf-8" });
   return ["orphans.html"];
@@ -14163,7 +14222,7 @@ function renderOrphanPage(manifest, outDir) {
 // lib/knowledge-atlas/src/generate.ts
 var MANIFEST_VERSION = 2;
 function normPath(p) {
-  return path10.resolve(p).replace(/[\\/]+$/, "");
+  return path11.resolve(p).replace(/[\\/]+$/, "");
 }
 function pathsEqual(a, b) {
   return normPath(a) === normPath(b);
@@ -14171,7 +14230,7 @@ function pathsEqual(a, b) {
 function isUnder(parent, child) {
   const p = normPath(parent);
   const c = normPath(child);
-  return c.startsWith(p + path10.sep);
+  return c.startsWith(p + path11.sep);
 }
 var MAX_TIME_VALUE_MS = 864e13;
 function resolveTimestamp(now) {
@@ -14212,7 +14271,7 @@ function isoSecond(d) {
   return d.toISOString().replace(/\.\d{3}Z$/, "Z");
 }
 function deriveProjectTitle(projectRoot) {
-  const pkgPath = path10.join(projectRoot, "package.json");
+  const pkgPath = path11.join(projectRoot, "package.json");
   try {
     if (fs11.existsSync(pkgPath)) {
       const raw = fs11.readFileSync(pkgPath, "utf-8");
@@ -14223,7 +14282,7 @@ function deriveProjectTitle(projectRoot) {
     }
   } catch {
   }
-  const base = path10.basename(projectRoot).trim();
+  const base = path11.basename(projectRoot).trim();
   return base.length > 0 ? base : "Unknown Project";
 }
 function extractFileRecord(absPath, fileId, docType, contentHash2) {
@@ -14285,7 +14344,7 @@ function generate(opts) {
   if (!projectRoot || typeof projectRoot !== "string") {
     throw new Error("generate: projectRoot is required and must be a non-empty string");
   }
-  if (!path10.isAbsolute(projectRoot)) {
+  if (!path11.isAbsolute(projectRoot)) {
     throw new Error(`generate: projectRoot must be an absolute path (got: ${projectRoot})`);
   }
   const rootStat = fs11.statSync(projectRoot, { throwIfNoEntry: false });
@@ -14293,11 +14352,11 @@ function generate(opts) {
     throw new Error(`generate: projectRoot does not exist or is not a directory: ${projectRoot}`);
   }
   const { sources, outputFolder, outputOverlap } = resolveKnowledgeSources(projectRoot);
-  const bmadOutputDir = path10.join(projectRoot, outputFolder);
-  const defaultOutDir = path10.join(bmadOutputDir, "knowledge-site");
+  const bmadOutputDir = path11.join(projectRoot, outputFolder);
+  const defaultOutDir = path11.join(bmadOutputDir, "knowledge-site");
   const outDir = outDirOverride ?? defaultOutDir;
-  const rel = path10.relative(projectRoot, outDir);
-  if (rel.startsWith("..") || path10.isAbsolute(rel)) {
+  const rel = path11.relative(projectRoot, outDir);
+  if (rel.startsWith("..") || path11.isAbsolute(rel)) {
     throw new Error(`generate: outDir escapes projectRoot: ${outDir}`);
   }
   const generatedAt = resolveTimestamp(opts.now);
@@ -14332,7 +14391,7 @@ function generate(opts) {
   const extraFileCount = graphFiles.length + diagramFiles.length + orphanFiles.length;
   const written = renderSite(manifest, outDir, resolveAbsPath);
   writeManifest(outDir, manifest);
-  const indexPath = path10.join(outDir, "index.html");
+  const indexPath = path11.join(outDir, "index.html");
   return {
     outDir,
     indexPath,
@@ -14353,7 +14412,7 @@ function main() {
     usage();
     process.exit(args.length === 0 ? 1 : 0);
   }
-  const projectRoot = path11.resolve(args[0]);
+  const projectRoot = path12.resolve(args[0]);
   let outDir;
   const outIdx = args.indexOf("--out");
   if (outIdx !== -1) {
@@ -14361,7 +14420,7 @@ function main() {
       process.stderr.write("[atlas] ERROR: --out requires a directory argument\n");
       process.exit(1);
     }
-    outDir = path11.resolve(args[outIdx + 1]);
+    outDir = path12.resolve(args[outIdx + 1]);
   }
   try {
     const result = generate({ projectRoot, outDir });

package/lib/knowledge-atlas/src/render/document.ts

@@ -36,7 +36,7 @@ import { headingToSlug } from '../extract/slug.js';
 import { pageShell } from './layout.js';
 import type { NavFlags } from './layout.js';
 import { gatherBacklinks, renderBacklinksHtml } from './backlinks.js';
-import { linkifyHtml, sanitizeHtml } from './linkify.js';
+import { linkifyHtml, sanitizeHtml, rewriteAuthoredLinks } from './linkify.js';
 import { resolveSlug } from './paths.js';
 import type { FileRecord, KnowledgeManifest, GraphNode } from '../types.js';
 
@@ -262,6 +262,12 @@ export function renderDocumentPage(
   const { html: mermaidHtml } = processMermaidFences(renderedHtml);
   renderedHtml = mermaidHtml;
 
+  // Rewrite AUTHORED relative markdown cross-links (e.g. `[x](roadmap.md)`)
+  // to the RENDERED sibling doc page — bug fix (see render/linkify.ts for
+  // the full writeup). Must run before linkifyHtml/sanitizeHtml so the
+  // resolved href is what the safe-URL allowlist evaluates.
+  renderedHtml = rewriteAuthoredLinks(renderedHtml, manifest, fileRec.path);
+
   // Linkify entity tokens (now that HTML structure is stable)
   renderedHtml = linkifyHtml(renderedHtml, manifest, fileRec.path);
 

package/lib/knowledge-atlas/src/render/linkify.ts

@@ -8,6 +8,7 @@
  *   sanitizeHtml()  — strip dangerous HTML from rendered markdown output
  */
 
+import * as path from 'path';
 import type { KnowledgeManifest } from '../types.js';
 import { filePathToSlug, buildSlugMap } from './paths.js';
 
@@ -240,6 +241,173 @@ function linkifyText(
   return result;
 }
 
+// ---------------------------------------------------------------------------
+// rewriteAuthoredLinks — bug fix: authored relative `.md` cross-links
+// ---------------------------------------------------------------------------
+//
+// CONFIRMED BUG (real Prophesys project, 18 broken links): reading-view docs
+// contain AUTHORED markdown cross-links to sibling source docs, e.g. in
+// `prd.md`: `[roadmap](roadmap.md#7-development-timetable)`. markdown-it
+// renders these as plain `<a href="roadmap.md#...">` and `linkifyHtml` above
+// only rewrites bare ENTITY TOKENS (FR26, Story 1.2, …) found in TEXT nodes —
+// it never touches an href that already lives inside an authored `<a>` tag.
+// Every reading view is written FLAT at `docs/<slug>.html` (render/paths.ts),
+// so from `docs/prd.html` a raw `href="roadmap.md"` resolves to the
+// non-existent `docs/roadmap.md` instead of the real `docs/roadmap.html`.
+//
+// This pass resolves the authored href against the SOURCE document's
+// directory (not the rendered docs/ directory), looks the resolved path up
+// in the SAME collision-free slug map every other renderer uses, and — only
+// when it matches an actual scanned document — rewrites it to the sibling
+// docs/-relative page. Anything that doesn't resolve to a scanned document
+// (external URL, mailto:, in-page anchor, or a genuinely non-scanned file) is
+// left byte-for-byte untouched: this pass never invents a target.
+
+/**
+ * Decode the HTML character references markdown-it's link renderer can
+ * introduce into an href attribute value (notably `&amp;` for a literal `&`
+ * in the authored URL). Narrow by design — just enough to recover the
+ * original authored URL text for filesystem-path resolution; the decoded
+ * scheme/path is never emitted as-is (only a freshly-built `<slug>.html`
+ * href is written back), so there is no injection surface here.
+ */
+function decodeHrefEntities(value: string): string {
+  return value
+    .replace(/&amp;/g, '&')
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"')
+    .replace(/&#0?39;/g, '\'');
+}
+
+/** Re-escape `&` for safe embedding back into an HTML attribute value. */
+function encodeHrefForAttr(value: string): string {
+  return value.replace(/&/g, '&amp;');
+}
+
+/**
+ * Resolve a single authored href (already HTML-entity-decoded) against the
+ * SOURCE document's directory. Returns the rewritten docs/-relative href
+ * (`<slug>.html[#fragment]`, since every doc page lives flat under `docs/`)
+ * or `null` when the href should be left untouched:
+ *   - external / scheme'd links (`http:`, `mailto:`, `javascript:`, …),
+ *   - protocol-relative (`//host/...`) and in-page (`#frag`) links,
+ *   - site-root-absolute paths (`/x`) — not this bug's shape,
+ *   - anything that normalizes outside the scanned tree (`../../../etc`),
+ *   - anything that does not resolve (case-insensitively) to a fileId
+ *     actually present in the manifest — a genuinely non-scanned target;
+ *     never invent a link for it.
+ */
+function resolveAuthoredHref(
+  href: string,
+  currentFileId: string,
+  fileIdLookup: Map<string, string>,
+  slugMap: Map<string, string>,
+): string | null {
+  const trimmed = href.trim();
+  if (trimmed === '') return null;
+
+  // External schemes (http:, https:, mailto:, tel:, javascript:, vbscript:,
+  // data:, ...), in-page fragments, and protocol-relative URLs are never
+  // authored-doc cross-links — leave them exactly as authored/sanitized.
+  if (/^(?:[a-zA-Z][a-zA-Z0-9+.-]*:|#|\/\/)/.test(trimmed)) return null;
+  // Site-root-absolute path — not the relative-link shape this bug covers.
+  if (trimmed.startsWith('/')) return null;
+
+  const hashIdx = trimmed.indexOf('#');
+  const rawPath = hashIdx === -1 ? trimmed : trimmed.slice(0, hashIdx);
+  const fragment = hashIdx === -1 ? '' : trimmed.slice(hashIdx);
+  if (rawPath === '') return null; // defensive: pure-fragment already caught above
+
+  // URL-decode so `%20` (space), `%2E` etc. match the real on-disk filename.
+  let decodedPath: string;
+  try {
+    decodedPath = decodeURIComponent(rawPath);
+  } catch {
+    decodedPath = rawPath; // malformed percent-escape — fall back to raw text
+  }
+
+  // Resolve RELATIVE TO THE SOURCE DOC'S DIRECTORY (the authored-link base),
+  // never the rendered docs/ directory the page happens to live under.
+  const currentDir = path.posix.dirname(currentFileId);
+  const joined = currentDir === '.' ? decodedPath : `${currentDir}/${decodedPath}`;
+  const resolved = path.posix.normalize(joined).replace(/\/+$/, '');
+
+  // Escaped above the scanned root — cannot be a scanned fileId.
+  if (resolved === '..' || resolved.startsWith('../')) return null;
+
+  // Case-insensitive match (`.md` vs `.MD`, mixed-case filenames) against the
+  // ACTUAL scanned fileIds — the same identity space every other renderer
+  // (linkifyHtml, backlinks, search) resolves against.
+  const matchedFileId = fileIdLookup.get(resolved.toLowerCase());
+  if (!matchedFileId) return null; // not a scanned document — leave unchanged
+
+  const targetSlug = slugMap.get(matchedFileId);
+  if (!targetSlug) return null;
+
+  // Self-link (authored link back to its own file): collapse to an in-page
+  // anchor, mirroring resolveHref()'s same-page handling above, instead of a
+  // full-page href to the page it's already on.
+  if (matchedFileId === currentFileId) {
+    return fragment || '#';
+  }
+
+  return `${targetSlug}.html${fragment}`;
+}
+
+/**
+ * Rewrite AUTHORED relative markdown cross-links — `[x](roadmap.md)`,
+ * `[x](sub/y.md#anchor)`, `[x](../z.MD)`, spaces/`%20`, mixed-case
+ * `.md`/`.MD` — so they point at the RENDERED sibling doc page instead of
+ * the raw source-relative path markdown-it passed through verbatim.
+ *
+ * Only touches `href` attributes on `<a>` tags already present in `html`
+ * (i.e. AUTHORED links); it never invents new links from plain text — that
+ * remains `linkifyHtml`'s job. Must run BEFORE `sanitizeHtml` so the
+ * rewritten href is what the safe-URL allowlist evaluates (a relative
+ * `<slug>.html[#frag]` href always passes it, matching prior behavior for
+ * already-relative authored links — no new unsafe-URL surface is created).
+ * Order relative to `linkifyHtml` does not matter: that pass only touches
+ * bare text nodes, never existing `<a>` attributes.
+ */
+export function rewriteAuthoredLinks(
+  html: string,
+  manifest: KnowledgeManifest,
+  currentFileId: string,
+): string {
+  if (!html) return html;
+
+  const fileIds = manifest.files.map(f => f.path);
+  if (fileIds.length === 0) return html;
+
+  const slugMap = buildSlugMap(fileIds);
+
+  // Case-insensitive fileId lookup. First-encountered (sorted-order) wins on
+  // a case-fold collision — deterministic, matching the scanner's own
+  // first-wins dedup semantics.
+  const fileIdLookup = new Map<string, string>();
+  for (const id of fileIds) {
+    const key = id.toLowerCase();
+    if (!fileIdLookup.has(key)) fileIdLookup.set(key, id);
+  }
+
+  return html.replace(/<a\b[^>]*>/gi, (tag) => {
+    const hrefMatch = tag.match(/\bhref\s*=\s*(?:"([^"]*)"|'([^']*)')/i);
+    if (!hrefMatch) return tag;
+
+    const usesDoubleQuote = hrefMatch[1] !== undefined;
+    const rawAttrValue = usesDoubleQuote ? hrefMatch[1]! : hrefMatch[2]!;
+    const decoded = decodeHrefEntities(rawAttrValue);
+
+    const rewritten = resolveAuthoredHref(decoded, currentFileId, fileIdLookup, slugMap);
+    if (rewritten === null) return tag;
+
+    const quote = usesDoubleQuote ? '"' : '\'';
+    const newAttr = `href=${quote}${encodeHrefForAttr(rewritten)}${quote}`;
+    return tag.slice(0, hrefMatch.index!) + newAttr + tag.slice(hrefMatch.index! + hrefMatch[0].length);
+  });
+}
+
 // ---------------------------------------------------------------------------
 // sanitizeHtml
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ma-agents",
-  "version": "3.15.0-beta.1",
+  "version": "3.15.0-beta.2",
   "description": "NPX tool to install skills for AI coding agents (Claude Code, Gemini, Copilot, Kilocode, Cline, Cursor, Roo Code)",
   "main": "index.js",
   "bin": {

package/skills/git-workflow-skill/skill.json

@@ -1,21 +1,21 @@
-{
-  "name": "Git Workflow",
-  "description": "MANDATORY worktree-based workflow for ALL file-changing activities. Enforces isolated feature branches, conventional commits, and PR-based merging.",
-  "version": "2.1.0",
-  "author": "AI Agent Skills",
-  "tags": [
-    "git",
-    "worktrees",
-    "workflow",
-    "branching",
-    "conventional-commits",
-    "pull-requests",
-    "multi-agent"
-  ],
-  "applies_when": [
-    "committing changes",
-    "creating branches or PRs",
-    "any code writing or modification task"
-  ],
-  "always_load": true
-}
+{
+  "name": "Git Workflow",
+  "description": "MANDATORY worktree-based workflow for ALL file-changing activities. Enforces isolated feature branches, conventional commits, and PR-based merging.",
+  "version": "2.1.0",
+  "author": "AI Agent Skills",
+  "tags": [
+    "git",
+    "worktrees",
+    "workflow",
+    "branching",
+    "conventional-commits",
+    "pull-requests",
+    "multi-agent"
+  ],
+  "applies_when": [
+    "committing changes",
+    "creating branches or PRs",
+    "any code writing or modification task"
+  ],
+  "always_load": true
+}