memorix 1.2.0 → 1.2.1

package/docs/API_REFERENCE.md

@@ -120,6 +120,8 @@ The built-in Lite provider indexes common code files with lightweight file, symb
 ```bash
 memorix knowledge init --mode local
 memorix knowledge status
+memorix knowledge claims
+memorix knowledge review --id <claim-id> --review approved --detail "checked current source evidence"
 memorix knowledge compile
 memorix knowledge lint
 memorix knowledge apply --proposal <id>
@@ -128,7 +130,7 @@ memorix knowledge workflow select --task "prepare a release"
 memorix knowledge workflow preview --id <workflow-id> --agent codex
 ```
 
-The advanced MCP action tool is `memorix_knowledge`. It is registered only in the `team` and `full` tool profiles so normal agents keep the compact micro/lite tool surface. Its actions are `workspace_init`, `status`, `compile`, `lint`, `proposal_apply`, `workflow_import`, `workflow_list`, `workflow_select`, `workflow_preview`, `workflow_apply`, and `workflow_run`. Use it only when an agent is explicitly managing the reviewable Knowledge Workspace; ordinary coding work should stay on `memorix_project_context`.
+The advanced MCP action tool is `memorix_knowledge`. It is registered only in the `team` and `full` tool profiles so normal agents keep the compact micro/lite tool surface. Its actions are `workspace_init`, `status`, `claim_list`, `claim_review`, `compile`, `lint`, `proposal_apply`, `workflow_import`, `workflow_list`, `workflow_select`, `workflow_preview`, `workflow_apply`, and `workflow_run`. Explicit agent observations become `needs-review` claim candidates: check their source evidence, then use `claim_review` with a reason to approve or reject them. Only approved claims can be compiled into publishable Knowledge Workspace pages. Ordinary coding work should stay on `memorix_project_context`.
 
 ### Cross-Agent Handoff Receipt
 

package/docs/DEVELOPMENT.md

@@ -271,6 +271,10 @@ to make sure provenance diagnostics match runtime behavior.
 
 ## 9. Release Workflow
 
+The repository's canonical workflow is [Memorix release](knowledge/workflows/memorix-release.md).
+It is the versioned source for agents and maintainers; its checks supplement,
+rather than replace, the explicit maintainer approval required to publish.
+
 Recommended release flow:
 
 1. update docs and version metadata

package/docs/SETUP.md

@@ -276,12 +276,18 @@ Manual stdio shape:
   "mcpServers": {
     "memorix": {
       "command": "memorix",
-      "args": ["serve"]
+      "args": ["serve"],
+      "alwaysLoad": true
     }
   }
 }
 ```
 
+Keep `alwaysLoad: true` for a manually managed Claude Code entry so its small
+Memorix tool set is available during print-mode startup. `memorix doctor agents
+--agent claude` reports a missing eager-load setting, and `memorix repair agents
+--agent claude` restores it without replacing unrelated MCP servers.
+
 ### Cursor
 
 Project config: `.cursor/mcp.json`

package/docs/knowledge/workflows/memorix-release.md

@@ -0,0 +1,57 @@
+---
+id: memorix-release
+title: Memorix release
+description: Prepare a Memorix release with evidence, package verification, and explicit maintainer approval.
+status: active
+version: 1
+taskLenses: [release]
+triggers: [release, publish, npm, version, changelog]
+allowedAgents: [codex, claude-code, cursor, windsurf, copilot, antigravity, gemini-cli, openclaw, hermes, omp, kiro, opencode, trae]
+verificationGates:
+  - Version and changelog match the release scope
+  - npm run lint passes
+  - npm run build passes
+  - npm test passes
+  - Focused live MCP smoke passes when server behavior changed
+  - Package smoke passes
+  - CI passes on the release commit
+  - Maintainer approval is explicit before publishing
+---
+
+## Inspect
+
+Read the current version, changelog, Git state, open release risks, and the
+diff that will ship. Do not treat a release tag, an old test run, or a local
+token as proof that this exact commit is ready.
+
+## Prepare
+
+Update version metadata, changelog, and user-facing documentation only for
+changes that are actually included. Keep package workspace visibility and npm
+access settings unchanged unless the release specifically changes them.
+
+## Verify
+
+Run `npm run lint`, `npm run build`, and `npm test`. Run focused tests for the
+changed surface. When MCP behavior changed, use a real isolated stdio client to
+exercise the affected tool path. Inspect `npm pack --dry-run --json` and run a
+package smoke from the packed artifact when packaging changed.
+
+## Review
+
+Record what passed, what was not run, and any remaining risk. Confirm that the
+release commit has passing CI. A workflow may prepare evidence, but publishing
+requires explicit maintainer approval.
+
+## Publish
+
+After explicit maintainer approval, publish through the approved release path.
+Never put credentials in the repository, release notes, workflow files, or
+command output. Verify the published package version without exposing tokens.
+
+## Follow Up
+
+Check a fresh install or `npx` invocation, create or update the GitHub release
+if appropriate, and reply to affected issue reporters with the concrete fix and
+version. Store the verification evidence as project knowledge rather than an
+unstructured chat note.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memorix",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Local-first shared memory layer for AI coding agents across MCP clients, Git history, reasoning context, and project sessions.",
   "type": "module",
   "sideEffects": false,

package/plugins/codex/memorix/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "memorix",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Shared workspace memory for Codex and other AI coding agents.",
   "author": {
     "name": "AVIDS2",

package/src/cli/commands/codegraph.ts

@@ -3,7 +3,7 @@ import { CodeGraphStore } from '../../codegraph/store.js';
 import { refreshProjectLite } from '../../codegraph/lite-provider.js';
 import { assembleContextPackForTask, attachTaskWorkset, buildContextPackPrompt } from '../../codegraph/context-pack.js';
 import { backfillMissingObservationCodeRefs } from '../../codegraph/binder.js';
-import { collectCurrentProjectFacts } from '../../codegraph/current-facts.js';
+import { collectCurrentProjectFacts, formatGitFact } from '../../codegraph/current-facts.js';
 import { resolveTaskLens } from '../../codegraph/task-lens.js';
 import { getExternalCodeGraphContext, inspectExternalCodeGraph } from '../../codegraph/external-provider.js';
 import type { CodeGraphProviderQuality } from '../../codegraph/types.js';
@@ -71,8 +71,7 @@ function compactFacts(project: { rootPath: string }): { facts: string[]; dirty:
     facts.push('Latest changelog: ' + current.latestChangelog.version
       + (current.latestChangelog.date ? ' (' + current.latestChangelog.date + ')' : ''));
   }
-  facts.push('Git: ' + (current.git.branch ? 'branch ' + current.git.branch + ', ' : '')
-    + (current.git.dirty ? 'dirty worktree' : 'clean worktree'));
+  facts.push(formatGitFact(current.git));
   return { facts, dirty: current.git.dirty };
 }
 

package/src/cli/commands/knowledge.ts

@@ -1,6 +1,7 @@
 import { defineCommand } from 'citty';
 import { CodeGraphStore } from '../../codegraph/store.js';
 import { ClaimStore } from '../../knowledge/claim-store.js';
+import { reviewClaim } from '../../knowledge/claims.js';
 import { applyKnowledgeProposal, compileKnowledgeWorkspace, lintKnowledgeWorkspace } from '../../knowledge/wiki.js';
 import { initializeKnowledgeWorkspace, loadKnowledgeWorkspace } from '../../knowledge/workspace.js';
 import { KnowledgeWorkspaceStore } from '../../knowledge/workspace-store.js';
@@ -28,6 +29,8 @@ function usage(): string {
     '  memorix knowledge init [--mode local]',
     '  memorix knowledge init --mode versioned --path C:\\project\\docs\\knowledge',
     '  memorix knowledge status',
+    '  memorix knowledge claims',
+    '  memorix knowledge review --id <claim-id> --review approved --detail "checked current source evidence"',
     '  memorix knowledge compile',
     '  memorix knowledge lint',
     '  memorix knowledge apply --proposal <id> [--force]',
@@ -57,6 +60,11 @@ function workflowVerdict(value: unknown): 'passed' | 'failed' | 'not-run' | unde
   throw new Error('workflow verdict must be passed, failed, or not-run');
 }
 
+function claimReviewState(value: unknown): 'approved' | 'rejected' {
+  if (value === 'approved' || value === 'rejected') return value;
+  throw new Error('claim review must be approved or rejected');
+}
+
 function evidenceList(value: unknown): string[] {
   if (typeof value !== 'string' || !value.trim()) return [];
   return [...new Set(value.split(',').map(item => item.trim()).filter(Boolean))];
@@ -81,6 +89,8 @@ export default defineCommand({
     failure: { type: 'string', description: 'Sanitized failure reason for a workflow run' },
     snapshot: { type: 'string', description: 'Starting code snapshot id for a workflow run' },
     evidence: { type: 'string', description: 'Comma-separated evidence ids selected for a workflow run' },
+    review: { type: 'string', description: 'Claim review verdict: approved or rejected' },
+    detail: { type: 'string', description: 'Evidence check performed for a claim review' },
     json: { type: 'boolean', description: 'Emit machine-readable JSON output' },
   },
   run: async ({ args }) => {
@@ -120,6 +130,36 @@ export default defineCommand({
       const workspaceStore = new KnowledgeWorkspaceStore();
       await workspaceStore.init(dataDir);
 
+      if (action === 'claims') {
+        const claims = claimStore.listClaims(project.id, { limit: 100 });
+        emitResult(
+          { project, workspace, claims },
+          'Claims: ' + claims.length + ' total, ' + claims.filter(claim => claim.reviewState === 'needs-review').length + ' awaiting review.',
+          asJson,
+        );
+        return;
+      }
+
+      if (action === 'review') {
+        const claimId = requiredText(args.id, 'claim id');
+        const existing = claimStore.getClaim(claimId);
+        if (!existing || existing.projectId !== project.id) {
+          emitError('Claim was not found for this knowledge workspace.', asJson);
+          return;
+        }
+        const claim = reviewClaim(claimStore, {
+          claimId,
+          reviewState: claimReviewState(args.review),
+          detail: requiredText(args.detail, 'review detail'),
+        });
+        emitResult(
+          { project, workspace, claim },
+          'Claim ' + claim.id + ' marked ' + claim.reviewState + '.',
+          asJson,
+        );
+        return;
+      }
+
       if (action === 'workflow') {
         const workflowAction = (positional[1] || 'list').toLowerCase();
         const workflowStore = new WorkflowStore();

package/src/cli/commands/serve-http.ts

@@ -23,6 +23,7 @@ import { defineCommand } from 'citty';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { ObservationStore } from '../../store/obs-store.js';
 import { resolveToolProfile } from '../../server/tool-profile.js';
+import { scopeKnowledgeGraphToProject } from '../../memory/graph-scope.js';
 
 export const DEFAULT_SESSION_TIMEOUT_MS = 30 * 60 * 1000;
 
@@ -764,6 +765,7 @@ export default defineCommand({
             source?: string;
             commitHash?: string;
             filesModified?: string[];
+            relatedEntities?: string[];
             status?: string;
             importance?: number;
             accessCount?: number;
@@ -860,12 +862,7 @@ export default defineCommand({
           } catch { /* best effort */ }
 
           // Project-scoped graph counts (must match /graph and /export)
-          const projectEntityNames = new Set(
-            observations.filter(o => o.entityName).map(o => o.entityName!)
-          );
-          const projectEntities = graph.entities.filter((e: any) => projectEntityNames.has(e.name));
-          const projectEntitySet = new Set(projectEntities.map((e: any) => e.name));
-          const projectRelations = graph.relations.filter((r: any) => projectEntitySet.has(r.from) && projectEntitySet.has(r.to));
+          const projectGraph = scopeKnowledgeGraphToProject(graph, observations);
 
           let maintenance = { total: 0, pending: 0, running: 0, retrying: 0, completed: 0, failed: 0 };
           let lifecycle: unknown;
@@ -877,8 +874,8 @@ export default defineCommand({
           } catch { /* optional maintenance diagnostics */ }
 
           sendJson({
-            entities: projectEntities.length,
-            relations: projectRelations.length,
+            entities: projectGraph.entities.length,
+            relations: projectGraph.relations.length,
             observations: observations.length,
             nextId,
             typeCounts,
@@ -930,19 +927,9 @@ export default defineCommand({
           await initGraphStore(graphDataDir);
           const fullGraph = { entities: getGraphStore().loadEntities(), relations: getGraphStore().loadRelations() };
 
-          // Project-scope the graph: only include entities that have observations in this project
-          const allObs = await loadDashboardProjectObservations(graphDataDir, graphProjectId, 'active') as Array<{ entityName?: string }>;
-          const projectEntityNames = new Set(
-            allObs
-              .filter(o => o.entityName)
-              .map(o => o.entityName!)
-          );
-
-          const entities = fullGraph.entities.filter(e => projectEntityNames.has(e.name));
-          const entityNameSet = new Set(entities.map(e => e.name));
-          const relations = fullGraph.relations.filter(r => entityNameSet.has(r.from) && entityNameSet.has(r.to));
-
-          sendJson({ entities, relations });
+          const allObs = await loadDashboardProjectObservations(graphDataDir, graphProjectId, 'active');
+          const scoped = scopeKnowledgeGraphToProject(fullGraph, allObs);
+          sendJson({ entities: scoped.entities, relations: scoped.relations });
           return;
         }
 
@@ -1012,24 +999,15 @@ export default defineCommand({
           const allObs = await loadDashboardProjectObservations(kgDataDir, kgProjectId, 'active');
           const skills = await getMiniSkillStore().loadByProject(kgProjectId);
 
-          // Project-scope graph store (same logic as /api/graph)
           const fullGraph = { entities: getGraphStore().loadEntities(), relations: getGraphStore().loadRelations() };
-          const graphObs = await loadDashboardProjectObservations(kgDataDir, kgProjectId, 'active') as Array<{ entityName?: string }>;
-          const projectEntityNames = new Set(
-            graphObs
-              .filter(o => o.entityName)
-              .map(o => o.entityName!)
-          );
-          const scopedEntities = fullGraph.entities.filter(e => projectEntityNames.has(e.name));
-          const scopedEntityNameSet = new Set(scopedEntities.map(e => e.name));
-          const scopedRelations = fullGraph.relations.filter(r => scopedEntityNameSet.has(r.from) && scopedEntityNameSet.has(r.to));
+          const scoped = scopeKnowledgeGraphToProject(fullGraph, allObs);
 
           const graph = generateKnowledgeGraph({
             projectId: kgProjectId,
             observations: allObs,
             miniSkills: skills,
-            graphEntities: scopedEntities,
-            graphRelations: scopedRelations,
+            graphEntities: scoped.entities,
+            graphRelations: scoped.relations,
           });
 
           sendJson(graph);
@@ -1369,19 +1347,14 @@ export default defineCommand({
           const { initGraphStore, getGraphStore } = await import('../../store/graph-store.js');
           await initGraphStore(expDataDir);
           const fullGraph = { entities: getGraphStore().loadEntities(), relations: getGraphStore().loadRelations() };
-          const observations = await loadDashboardProjectObservations(expDataDir, expProjectId, 'active') as Array<{ entityName?: string }>;
+          const observations = await loadDashboardProjectObservations(expDataDir, expProjectId, 'active');
           const expStore = await getDashboardObservationStore(expDataDir);
           const nextId = await expStore.loadIdCounter();
-          const exportEntityNames = new Set(
-            observations.filter(o => o.entityName).map(o => o.entityName!),
-          );
-          const exportEntities = fullGraph.entities.filter((e: any) => exportEntityNames.has(e.name));
-          const exportEntitySet = new Set(exportEntities.map((e: any) => e.name));
-          const exportRelations = fullGraph.relations.filter((r: any) => exportEntitySet.has(r.from) && exportEntitySet.has(r.to));
+          const scoped = scopeKnowledgeGraphToProject(fullGraph, observations);
           const exportData = {
             project: { id: expProjectId, name: expProjectName },
             exportedAt: new Date().toISOString(),
-            graph: { entities: exportEntities, relations: exportRelations },
+            graph: { entities: scoped.entities, relations: scoped.relations },
             observations,
             nextId,
           };

package/src/cli/commands/setup.ts

@@ -1062,7 +1062,7 @@ function tryInstallOmpPackage(packagePath: string): { ok: boolean; message: stri
   };
 }
 
-async function installAgentSetup(agent: AgentName, plan: SetupPlan, global: boolean): Promise<void> {
+export async function installAgentSetup(agent: AgentName, plan: SetupPlan, global: boolean): Promise<void> {
   const { installAgentGuidance, installHooks } = await import('../../hooks/installers/index.js');
   const targetRoot = global ? homedir() : process.cwd();
   const hasPluginPackage = plan.actions.includes('plugin-package') && PLUGIN_PACKAGE_AGENTS.has(agent);
@@ -1200,13 +1200,19 @@ async function installAgentSetup(agent: AgentName, plan: SetupPlan, global: bool
   } else if (hasOmpPackage) {
     p.log.info(`${agent}: extension command, hook events, and skills are bundled in the Oh-my-Pi package`);
   } else if (hasExtensionPackage) {
-    if (plan.actions.includes('hooks') || plan.actions.includes('project-guidance')) {
+    if (plan.actions.includes('hooks')) {
       const result = await installHooks(agent, targetRoot, global);
       p.log.success(`${agent}: integration files -> ${result.configPath}`);
+    } else if (plan.actions.includes('project-guidance')) {
+      const rulesPath = await installAgentGuidance(agent, targetRoot, global);
+      p.log.success(`${agent}: guidance -> ${rulesPath}`);
     }
-  } else if (agent === 'opencode' || plan.actions.includes('hooks') || plan.actions.includes('project-guidance')) {
+  } else if (plan.actions.includes('hooks')) {
     const result = await installHooks(agent, targetRoot, global);
     p.log.success(`${agent}: integration files -> ${result.configPath}`);
+  } else if (plan.actions.includes('project-guidance')) {
+    const rulesPath = await installAgentGuidance(agent, targetRoot, global);
+    p.log.success(`${agent}: guidance -> ${rulesPath}`);
   }
 
   if (agent === 'pi') {

package/src/codegraph/auto-context.ts

@@ -4,7 +4,7 @@ import { getResolvedConfig } from '../config/resolved-config.js';
 import { buildTaskWorkset, type TaskWorkset, type WorksetCaution } from '../knowledge/workset.js';
 import type { ProjectInfo } from '../types.js';
 import { backfillMissingObservationCodeRefs, type CodeRefBackfillResult } from './binder.js';
-import { collectCurrentProjectFacts, type CurrentProjectFacts } from './current-facts.js';
+import { collectCurrentProjectFacts, formatGitFact, type CurrentProjectFacts } from './current-facts.js';
 import { refreshProjectLite } from './lite-provider.js';
 import {
   getExternalCodeGraphContext,
@@ -430,15 +430,7 @@ function formatCurrentFactsLines(facts: CurrentProjectFacts): string[] {
     lines.push(`- Latest changelog: ${facts.latestChangelog.version}${facts.latestChangelog.date ? ` (${facts.latestChangelog.date})` : ''}`);
   }
 
-  const gitParts: string[] = [];
-  if (facts.git.detached) {
-    gitParts.push('detached HEAD');
-  } else if (facts.git.branch) {
-    gitParts.push(`branch ${facts.git.branch}`);
-  }
-  if (facts.git.commit) gitParts.push(`commit ${facts.git.commit}`);
-  gitParts.push(facts.git.dirty ? 'dirty worktree' : 'clean worktree');
-  lines.push(`- Git: ${gitParts.join(', ')}`);
+  lines.push('- ' + formatGitFact(facts.git));
   if (facts.git.latestCommit) lines.push(`- Latest commit: ${facts.git.latestCommit}`);
   lines.push('- Current facts above outrank progress/dev-log files when they conflict.');
 
@@ -464,11 +456,7 @@ function worksetFactLines(facts: CurrentProjectFacts): string[] {
     lines.push('Latest changelog: ' + facts.latestChangelog.version
       + (facts.latestChangelog.date ? ' (' + facts.latestChangelog.date + ')' : ''));
   }
-  const gitParts: string[] = [];
-  if (facts.git.branch) gitParts.push('branch ' + facts.git.branch);
-  if (facts.git.commit) gitParts.push('commit ' + facts.git.commit);
-  gitParts.push(facts.git.dirty ? 'dirty worktree' : 'clean worktree');
-  lines.push('Git: ' + gitParts.join(', '));
+  lines.push(formatGitFact(facts.git));
   for (const note of facts.staleNotes.slice(0, 1)) {
     lines.push(
       'Historical note: ' + note.path

package/src/codegraph/current-facts.ts

@@ -10,6 +10,7 @@ export interface CurrentProjectFacts {
     date?: string;
   };
   git: {
+    available: boolean;
     branch?: string;
     commit?: string;
     latestCommit?: string;
@@ -72,11 +73,18 @@ function runGit(rootPath: string, args: string[]): string | undefined {
 }
 
 function readGitFacts(rootPath: string): CurrentProjectFacts['git'] {
-  const branch = runGit(rootPath, ['branch', '--show-current']);
+  const available = runGit(rootPath, ['rev-parse', '--is-inside-work-tree']) === 'true';
+  if (!available) {
+    return { available: false, dirty: false, detached: false };
+  }
+
+  const branch = runGit(rootPath, ['symbolic-ref', '--quiet', '--short', 'HEAD'])
+    ?? runGit(rootPath, ['branch', '--show-current']);
   const commit = runGit(rootPath, ['rev-parse', '--short', 'HEAD']);
   const latestCommit = runGit(rootPath, ['log', '-1', '--pretty=%s']);
   const dirty = Boolean(runGit(rootPath, ['status', '--porcelain']));
   return {
+    available: true,
     ...(branch ? { branch } : {}),
     ...(commit ? { commit } : {}),
     ...(latestCommit ? { latestCommit } : {}),
@@ -85,6 +93,16 @@ function readGitFacts(rootPath: string): CurrentProjectFacts['git'] {
   };
 }
 
+export function formatGitFact(git: CurrentProjectFacts['git']): string {
+  if (!git.available) return 'Git: unavailable';
+  const parts: string[] = [];
+  if (git.detached) parts.push('detached HEAD');
+  else if (git.branch) parts.push('branch ' + git.branch);
+  if (git.commit) parts.push('commit ' + git.commit);
+  parts.push(git.dirty ? 'dirty worktree' : 'clean worktree');
+  return 'Git: ' + parts.join(', ');
+}
+
 function parseProgressNote(content: string): Pick<ProjectStaleNote, 'lastUpdated' | 'branchHint'> {
   const lastUpdated = content.match(/Last updated\*\*:\s*(\d{4}-\d{2}-\d{2})/i)
     ?? content.match(/Last updated:\s*(\d{4}-\d{2}-\d{2})/i);

package/src/codegraph/task-lens.ts

@@ -115,6 +115,7 @@ const KEYWORDS: Record<Exclude<TaskLensId, 'general'>, string[]> = {
   bugfix: [
     'bug',
     'crash',
+    'incident',
     'debug',
     'error',
     'fail',
@@ -125,6 +126,7 @@ const KEYWORDS: Record<Exclude<TaskLensId, 'general'>, string[]> = {
     'repro',
     '报错',
     '崩溃',
+    '故障',
     '失败',
     '修复',
     '问题',
@@ -157,11 +159,53 @@ function tokenize(text: string): string[] {
     .filter(token => token.length > 1 && !STOP_WORDS.has(token));
 }
 
-function containsKeyword(text: string, keyword: string): boolean {
-  if (/^[a-z0-9_-]+$/i.test(keyword)) {
-    return new RegExp(`(^|[^a-z0-9_-])${keyword.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}([^a-z0-9_-]|$)`, 'i').test(text);
+/**
+ * Match a task keyword only when the task states it as an action or intent,
+ * rather than prohibiting that action. Workflow selection shares this rule so
+ * a safety constraint cannot reintroduce an intent rejected by task routing.
+ */
+export function containsTaskKeyword(text: string, keyword: string): boolean {
+  const matcher = /^[a-z0-9_-]+$/i.test(keyword)
+    ? new RegExp(`(^|[^a-z0-9_-])${keyword.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?=[^a-z0-9_-]|$)`, 'gi')
+    : new RegExp(keyword.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'gi');
+  let match: RegExpExecArray | null;
+  while ((match = matcher.exec(text)) !== null) {
+    const keywordIndex = match.index + (match[1]?.length ?? 0);
+    if (!isNegatedTaskKeyword(text, keywordIndex)) return true;
   }
-  return text.includes(keyword);
+  return false;
+}
+
+/**
+ * Task text often carries safety constraints such as "do not publish". Those
+ * constraints must not route a debugging task into the release workflow.
+ * Keep this deliberately small and local: it only suppresses a keyword inside
+ * the same sentence when the sentence explicitly negates an action.
+ */
+function isNegatedTaskKeyword(text: string, keywordIndex: number): boolean {
+  const boundary = Math.max(
+    text.lastIndexOf('.', keywordIndex - 1),
+    text.lastIndexOf('!', keywordIndex - 1),
+    text.lastIndexOf('?', keywordIndex - 1),
+    text.lastIndexOf(';', keywordIndex - 1),
+    text.lastIndexOf('\n', keywordIndex - 1),
+    text.lastIndexOf('\u3002', keywordIndex - 1),
+    text.lastIndexOf('\uff01', keywordIndex - 1),
+    text.lastIndexOf('\uff1f', keywordIndex - 1),
+    text.lastIndexOf('\uff1b', keywordIndex - 1),
+  );
+  let prefix = text.slice(boundary + 1, keywordIndex).toLowerCase();
+  const contrast = /(?:,|\uff0c)\s*(?:but|however|instead|yet|\u4f46\u662f|\u4f46|\u800c\u662f)\s*/gi;
+  let contrastMatch: RegExpExecArray | null;
+  let contrastEnd = -1;
+  while ((contrastMatch = contrast.exec(prefix)) !== null) contrastEnd = contrast.lastIndex;
+  if (contrastEnd >= 0) prefix = prefix.slice(contrastEnd);
+  if (/\b(?:do|does|did|should|must|can|could|will|would|may|might)\s+not\b/.test(prefix)) return true;
+  if (/\b(?:don't|dont|never|without|avoid|skip)\b/.test(prefix)) return true;
+  if (/(?:^|[\s,])no\s+(?:[a-z0-9_-]+\s*){0,4}$/i.test(prefix)) return true;
+  const chineseClauseStart = Math.max(prefix.lastIndexOf(','), prefix.lastIndexOf('\uff0c'), prefix.lastIndexOf('\u3001'));
+  const chineseClause = prefix.slice(chineseClauseStart + 1);
+  return /(?:\u4e0d\u8981|\u4e0d\u5e94|\u4e0d\u53ef|\u4e0d\u80fd|\u4e0d\u4f1a|\u7981\u6b62|\u52ff|\u4e0d)\s*(?:\u7acb\u5373|\u76f4\u63a5|\u518d|\u73b0\u5728|\u64c5\u81ea|\u5148)?\s*$/.test(chineseClause);
 }
 
 export function resolveTaskLens(task?: string): TaskLens {
@@ -175,7 +219,7 @@ export function resolveTaskLens(task?: string): TaskLens {
   };
 
   for (const id of LENS_PRIORITY) {
-    const score = KEYWORDS[id].reduce((sum, keyword) => sum + (containsKeyword(normalized, keyword) ? 1 : 0), 0);
+    const score = KEYWORDS[id].reduce((sum, keyword) => sum + (containsTaskKeyword(normalized, keyword) ? 1 : 0), 0);
     const priority = LENS_PRIORITY.indexOf(id);
     if (score > best.score || (score === best.score && score > 0 && priority < best.priority)) {
       best = { id, score, priority };