memory-journal-mcp 6.1.2 → 6.2.1

package/dist/{chunk-HCEWINSB.js → chunk-N6EBIDN7.js}

@@ -1,13 +1,14 @@
-import { setDefaultSandboxMode, logger, getTools, callTool, ConfigurationError, sendProgress, ResourceNotFoundError, ConnectionError, QueryError, assertNoPathTraversal, ValidationError, execQuery, transformEntryRow, resolveGitHubRepo, isResourceError, milestoneCompletionPct, MemoryJournalMcpError, validateDateFormatPattern, DEFAULT_BRIEFING_CONFIG } from './chunk-X4SWFATC.js';
+import { setDefaultSandboxMode, logger, getTools, callTool, ConfigurationError, sendProgress, ResourceNotFoundError, ConnectionError, QueryError, assertNoPathTraversal, ValidationError, execQuery, transformEntryRow, resolveGitHubRepo, isResourceError, milestoneCompletionPct, MemoryJournalMcpError, validateDateFormatPattern, DEFAULT_BRIEFING_CONFIG } from './chunk-BI4ZNSKA.js';
 import { createRequire } from 'module';
 import { McpServer, ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import DatabaseAdapter from 'better-sqlite3';
 import * as fs2 from 'fs';
-import * as path from 'path';
+import * as path4 from 'path';
 import { Octokit } from '@octokit/rest';
 import { graphql } from '@octokit/graphql';
 import * as simpleGitImport from 'simple-git';
+import { fileURLToPath } from 'url';
 import express from 'express';
 import { timingSafeEqual, randomUUID } from 'crypto';
 import { AsyncLocalStorage } from 'async_hooks';
@@ -369,7 +370,7 @@ var NativeConnectionManager = class {
   }
   async initialize() {
     if (this.initialized) return;
-    const dir = path.dirname(this.dbPath);
+    const dir = path4.dirname(this.dbPath);
     if (dir && !fs2.existsSync(dir)) {
       await fs2.promises.mkdir(dir, { recursive: true });
     }
@@ -533,7 +534,7 @@ var NativeConnectionManager = class {
     return this.dbPath;
   }
   getBackupsDir() {
-    return path.join(path.dirname(this.dbPath), "backups");
+    return path4.join(path4.dirname(this.dbPath), "backups");
   }
   closeDbBeforeRestore() {
     this.close();
@@ -1327,7 +1328,7 @@ var BackupManager = class {
     const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
     const sanitizedName = backupName ? backupName.replace(/[/\\:*?"<>|]/g, "_").slice(0, MAX_BACKUP_NAME_LENGTH) : `backup_${timestamp}`;
     const filename = `${sanitizedName}.db`;
-    const backupPath = path.join(backupsDir, filename);
+    const backupPath = path4.join(backupsDir, filename);
     try {
       this.ctx.pragma("wal_checkpoint(TRUNCATE)");
     } catch (checkpointErr) {
@@ -1355,7 +1356,7 @@ var BackupManager = class {
     const backups = [];
     for (const filename of files) {
       if (!filename.endsWith(".db")) continue;
-      const filePath = path.join(backupsDir, filename);
+      const filePath = path4.join(backupsDir, filename);
       try {
         const stats = fs2.statSync(filePath);
         if (stats.isFile()) {
@@ -1397,7 +1398,7 @@ var BackupManager = class {
   async restoreFromFile(filename) {
     assertNoPathTraversal(filename);
     const backupsDir = this.ctx.getBackupsDir();
-    const backupPath = path.join(backupsDir, filename);
+    const backupPath = path4.join(backupsDir, filename);
     if (!fs2.existsSync(backupPath)) {
       throw new ResourceNotFoundError("Backup", filename);
     }
@@ -3568,7 +3569,7 @@ function buildRulesFileInfo(rulesFilePath) {
     const agoStr = ageDays > 0 ? `${String(ageDays)}d ago` : ageHours > 0 ? `${String(ageHours)}h ago` : "just now";
     return {
       path: rulesFilePath,
-      name: path.basename(rulesFilePath),
+      name: path4.basename(rulesFilePath),
       sizeKB: Math.round(stat.size / 1024),
       lastModified: agoStr
     };
@@ -3849,65 +3850,18 @@ function buildQuickAccess(groups) {
   return table;
 }
 var CODE_MODE_NAMESPACE_ROWS = [
-  {
-    group: "core",
-    label: "Core",
-    namespace: "`mj.core.*`",
-    example: '`mj.core.createEntry("Implemented feature X")`'
-  },
-  {
-    group: "search",
-    label: "Search",
-    namespace: "`mj.search.*`",
-    example: '`mj.search.searchEntries("performance")`'
-  },
-  {
-    group: "analytics",
-    label: "Analytics",
-    namespace: "`mj.analytics.*`",
-    example: "`mj.analytics.getStatistics()`"
-  },
-  {
-    group: "relationships",
-    label: "Relationships",
-    namespace: "`mj.relationships.*`",
-    example: '`mj.relationships.linkEntries(1, 2, "implements")`'
-  },
-  {
-    group: "export",
-    label: "Export",
-    namespace: "`mj.export.*`",
-    example: '`mj.export.exportEntries("json")`'
-  },
-  {
-    group: "admin",
-    label: "Admin",
-    namespace: "`mj.admin.*`",
-    example: "`mj.admin.rebuildVectorIndex()`"
-  },
-  {
-    group: "github",
-    label: "GitHub",
-    namespace: "`mj.github.*`",
-    example: '`mj.github.getGithubIssues({ state: "open" })`'
-  },
-  {
-    group: "backup",
-    label: "Backup",
-    namespace: "`mj.backup.*`",
-    example: "`mj.backup.backupJournal()`"
-  },
-  {
-    group: "team",
-    label: "Team",
-    namespace: "`mj.team.*`",
-    example: '`mj.team.teamCreateEntry("Team update")`'
-  }
+  { group: "core", label: "Core", namespace: "`mj.core.*`", example: '`mj.core.createEntry("Implemented feature X")`' },
+  { group: "search", label: "Search", namespace: "`mj.search.*`", example: '`mj.search.searchEntries("performance")`' },
+  { group: "analytics", label: "Analytics", namespace: "`mj.analytics.*`", example: "`mj.analytics.getStatistics()`" },
+  { group: "relationships", label: "Relationships", namespace: "`mj.relationships.*`", example: '`mj.relationships.linkEntries(1, 2, "implements")`' },
+  { group: "export", label: "Export", namespace: "`mj.export.*`", example: '`mj.export.exportEntries("json")`' },
+  { group: "admin", label: "Admin", namespace: "`mj.admin.*`", example: "`mj.admin.rebuildVectorIndex()`" },
+  { group: "github", label: "GitHub", namespace: "`mj.github.*`", example: '`mj.github.getGithubIssues({ state: "open" })`' },
+  { group: "backup", label: "Backup", namespace: "`mj.backup.*`", example: "`mj.backup.backupJournal()`" },
+  { group: "team", label: "Team", namespace: "`mj.team.*`", example: '`mj.team.teamCreateEntry("Team update")`' }
 ];
 function buildCodeModeInstructions(groups) {
-  const rows = CODE_MODE_NAMESPACE_ROWS.filter((r) => groups.has(r.group)).map(
-    (r) => `| ${r.label.padEnd(13)} | ${r.namespace.padEnd(20)} | ${r.example.padEnd(50)} |`
-  ).join("\n");
+  const rows = CODE_MODE_NAMESPACE_ROWS.filter((r) => groups.has(r.group)).map((r) => `| ${r.label.padEnd(13)} | ${r.namespace.padEnd(20)} | ${r.example.padEnd(50)} |`).join("\n");
   const fullSection = CODE_MODE_FULL_TEXT;
   const tableStart = fullSection.indexOf("| Group");
   const tableEnd = fullSection.indexOf("\n\n**Features**");
@@ -3946,13 +3900,13 @@ This executes JavaScript in a sandboxed environment with all tools available as
 \`\`\`js
 // \u2705 Correct
 const result = await mj.core.recent({ limit: 5 })
-return result.entries.map(e => e.id)
+return result.entries.map((e) => e.id)
 
 // \u274C Wrong \u2014 returns a Promise object, not the entries
 const result = mj.core.recent({ limit: 5 })
 
 // \u2705 Discovery
-const help = await mj.help()           // { groups, totalMethods, usage }
+const help = await mj.help() // { groups, totalMethods, usage }
 const groupHelp = await mj.core.help() // { group, methods }
 \`\`\`
 
@@ -3960,7 +3914,7 @@ const groupHelp = await mj.core.help() // { group, methods }
 
 \`\`\`js
 const { entries, count } = await mj.core.recent({ limit: 10 })
-return entries.map(e => ({ id: e.id, content: e.content.slice(0, 50) }))
+return entries.map((e) => ({ id: e.id, content: e.content.slice(0, 50) }))
 \`\`\`
 `;
 var GITHUB_INSTRUCTIONS = `
@@ -4047,7 +4001,7 @@ var GOTCHAS_CONTENT = `# memory-journal-mcp \u2014 Field Notes & Gotchas
 
 - **Team cross-database search**: \`search_entries\` and \`search_by_date_range\` automatically merge team DB results when \`TEAM_DB_PATH\` is configured. Results include a \`source\` field ("personal" or "team").
 - **Team vector search**: Team has its own isolated vector index. Use \`team_rebuild_vector_index\` if the team index drifts. \`team_semantic_search\` works identically to personal \`semantic_search\`.
-- **Team tools without \`TEAM_DB_PATH\`**: All 20 team tools return \`{ success: false, error: "Team collaboration is not configured..." }\` \u2014 no crash, no partial results.
+- **Team tools without \`TEAM_DB_PATH\`**: All ${TOOL_GROUPS.team.length} team tools return \`{ success: false, error: "Team collaboration is not configured..." }\` \u2014 no crash, no partial results.
 `;
 function generateInstructions(enabledTools, prompts, latestEntry, level = "standard", enabledGroups) {
   const groups = enabledGroups ?? getEnabledGroups(enabledTools);
@@ -4965,67 +4919,100 @@ var workflowsResource = {
 };
 var cachedSkills = null;
 var lastScanTime = 0;
+var lastScanDirs = null;
 var SKILLS_CACHE_TTL_MS = 5 * 60 * 1e3;
+function getShippedSkillsDir() {
+  try {
+    const thisFile = fileURLToPath(import.meta.url);
+    let dir = path4.dirname(thisFile);
+    while (true) {
+      const pkgJsonPath = path4.join(dir, "package.json");
+      if (fs2.existsSync(pkgJsonPath)) {
+        const shipped = path4.join(dir, "skills");
+        return fs2.existsSync(shipped) ? shipped : void 0;
+      }
+      const parent = path4.dirname(dir);
+      if (parent === dir) {
+        break;
+      }
+      dir = parent;
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function scanSkillsDir(dir, source) {
+  if (!fs2.existsSync(dir)) return [];
+  const entries = fs2.readdirSync(dir, { withFileTypes: true });
+  const skills = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const skillMdPath = path4.join(dir, entry.name, "SKILL.md");
+    if (!fs2.existsSync(skillMdPath)) continue;
+    const content = fs2.readFileSync(skillMdPath, "utf8");
+    const lines = content.split("\n");
+    const excerptLine = lines.find(
+      (l) => l.trim().length > 0 && !l.startsWith("#") && !l.startsWith("---")
+    );
+    const excerpt = excerptLine ? excerptLine.trim().slice(0, 160) : "";
+    skills.push({ name: entry.name, path: skillMdPath, excerpt, source });
+  }
+  return skills;
+}
 var skillsResource = {
   uri: "memory://skills",
   name: "Skills",
   title: "Agent Skills Index",
-  description: "Index of available agent skills from the configured SKILLS_DIR_PATH",
+  description: "Index of available agent skills (shipped + user-configured via SKILLS_DIR_PATH)",
   mimeType: "application/json",
   icons: [ICON_BRIEFING],
   annotations: { ...MEDIUM_PRIORITY, audience: ["assistant"] },
   handler: (_uri, _context) => {
-    const skillsDir = process.env["SKILLS_DIR_PATH"];
-    if (!skillsDir) {
+    const userSkillsDir = process.env["SKILLS_DIR_PATH"];
+    const shippedSkillsDir = getShippedSkillsDir();
+    const hasAnySource = !!userSkillsDir || !!shippedSkillsDir;
+    if (!hasAnySource) {
       return {
         data: {
           configured: false,
-          message: "SKILLS_DIR_PATH is not configured. Set this env var to index skills."
+          message: "No skills available. Set SKILLS_DIR_PATH to index user skills."
         }
       };
     }
     try {
-      if (!fs2.existsSync(skillsDir)) {
+      const currentDirs = `${userSkillsDir ?? ""}|${shippedSkillsDir ?? ""}`;
+      if (cachedSkills && Date.now() - lastScanTime < SKILLS_CACHE_TTL_MS && lastScanDirs === currentDirs) {
         return {
           data: {
             configured: true,
-            error: `Skills directory not found: ${skillsDir}`,
-            skills: [],
-            count: 0
-          }
-        };
-      }
-      if (cachedSkills && Date.now() - lastScanTime < SKILLS_CACHE_TTL_MS) {
-        return {
-          data: {
-            configured: true,
-            skillsDir,
+            ...userSkillsDir ? { skillsDir: userSkillsDir } : {},
+            ...shippedSkillsDir ? { shippedSkillsDir } : {},
             skills: cachedSkills,
             count: cachedSkills.length
           }
         };
       }
-      const entries = fs2.readdirSync(skillsDir, { withFileTypes: true });
-      const skills = [];
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue;
-        const skillMdPath = path.join(skillsDir, entry.name, "SKILL.md");
-        if (!fs2.existsSync(skillMdPath)) continue;
-        const content = fs2.readFileSync(skillMdPath, "utf8");
-        const lines = content.split("\n");
-        const excerptLine = lines.find(
-          (l) => l.trim().length > 0 && !l.startsWith("#") && !l.startsWith("---")
-        );
-        const excerpt = excerptLine ? excerptLine.trim().slice(0, 160) : "";
-        skills.push({ name: entry.name, path: skillMdPath, excerpt });
+      const skillMap = /* @__PURE__ */ new Map();
+      if (shippedSkillsDir) {
+        for (const skill of scanSkillsDir(shippedSkillsDir, "shipped")) {
+          skillMap.set(skill.name, skill);
+        }
+      }
+      if (userSkillsDir) {
+        for (const skill of scanSkillsDir(userSkillsDir, "user")) {
+          skillMap.set(skill.name, skill);
+        }
       }
-      skills.sort((a, b) => a.name.localeCompare(b.name));
+      const skills = [...skillMap.values()].sort((a, b) => a.name.localeCompare(b.name));
       cachedSkills = skills;
       lastScanTime = Date.now();
+      lastScanDirs = currentDirs;
       return {
         data: {
           configured: true,
-          skillsDir,
+          ...userSkillsDir ? { skillsDir: userSkillsDir } : {},
+          ...shippedSkillsDir ? { shippedSkillsDir } : {},
           skills,
           count: skills.length
         }
@@ -6054,7 +6041,7 @@ function getHelpResourceDefinitions() {
 var toolIndexModule = null;
 async function getAllToolDefinitionsAsync(context) {
   try {
-    toolIndexModule ??= await import('./tools-T4U5A3X4.js');
+    toolIndexModule ??= await import('./tools-WPRY5MJ6.js');
     if (toolIndexModule === null) return [];
     const tools = toolIndexModule.getTools(context.db, null);
     return tools.map((t) => ({
@@ -7806,7 +7793,17 @@ async function createServer(options) {
       toolOptions["title"] = tool.title;
     }
     if (tool.inputSchema !== void 0) {
-      toolOptions["inputSchema"] = tool.inputSchema;
+      const schema = tool.inputSchema;
+      if (typeof schema === "object" && schema !== null && "partial" in schema && typeof schema.partial === "function") {
+        try {
+          const relaxed = schema.partial();
+          toolOptions["inputSchema"] = typeof relaxed.passthrough === "function" ? relaxed.passthrough() : schema;
+        } catch {
+          toolOptions["inputSchema"] = schema;
+        }
+      } else {
+        toolOptions["inputSchema"] = schema;
+      }
     }
     if (tool.outputSchema !== void 0) {
       toolOptions["outputSchema"] = tool.outputSchema;

package/dist/cli.js

@@ -1,5 +1,5 @@
-import { VERSION, createServer } from './chunk-HCEWINSB.js';
-import { logger } from './chunk-X4SWFATC.js';
+import { VERSION, createServer } from './chunk-N6EBIDN7.js';
+import { logger } from './chunk-BI4ZNSKA.js';
 import './chunk-OKOVZ5QE.js';
 import { Command } from 'commander';
 import * as fs from 'fs';

package/dist/index.js

@@ -1,5 +1,5 @@
-export { META_GROUPS, TOOL_GROUPS, VERSION, calculateTokenSavings, createServer, filterTools, getAllToolNames, getFilterSummary, getToolFilterFromEnv, getToolGroup, isToolEnabled, parseToolFilter } from './chunk-HCEWINSB.js';
-export { logger } from './chunk-X4SWFATC.js';
+export { META_GROUPS, TOOL_GROUPS, VERSION, calculateTokenSavings, createServer, filterTools, getAllToolNames, getFilterSummary, getToolFilterFromEnv, getToolGroup, isToolEnabled, parseToolFilter } from './chunk-N6EBIDN7.js';
+export { logger } from './chunk-BI4ZNSKA.js';
 import './chunk-OKOVZ5QE.js';
 
 // src/types/index.ts

package/dist/tools-WPRY5MJ6.js

@@ -0,0 +1,2 @@
+export { callTool, getTools } from './chunk-BI4ZNSKA.js';
+import './chunk-OKOVZ5QE.js';

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "memory-journal-mcp",
-    "version": "6.1.2",
+    "version": "6.2.1",
     "description": "Project context management for AI-assisted development - Persistent knowledge graphs and intelligent context recall across fragmented AI threads",
     "type": "module",
     "main": "dist/index.js",
@@ -8,6 +8,12 @@
     "bin": {
         "memory-journal-mcp": "dist/cli.js"
     },
+    "files": [
+        "dist/",
+        "skills/",
+        "LICENSE",
+        "README.md"
+    ],
     "scripts": {
         "build": "tsup",
         "dev": "tsc --watch",
@@ -66,6 +72,7 @@
     },
     "devDependencies": {
         "@eslint/js": "^10.0.1",
+        "esbuild": "^0.25.0",
         "@playwright/test": "^1.58.2",
         "@types/better-sqlite3": "^7.6.13",
         "@types/express": "^5.0.6",
@@ -82,6 +89,8 @@
         "axios": "^1.13.6",
         "brace-expansion": "^2.0.2",
         "glob": "^11.1.0",
+        "onnxruntime-web": "npm:empty-npm-package@1.0.0",
+        "sharp": "npm:empty-npm-package@1.0.0",
         "zod": "$zod",
         "minimatch": "10.2.4",
         "tar": "7.5.11",

package/skills/github-commander/SKILL.md

@@ -0,0 +1,151 @@
+---
+name: github-commander
+description: |
+  Structured workflows for triaging GitHub issues, reviewing PRs, sprinting
+  through milestones, and running security/quality/performance audits — with
+  configurable validation gates, auto-detected security scanning, journal audit
+  trails, and human-in-the-loop checkpoints. Use this skill whenever you are
+  working on a GitHub issue, reviewing or submitting a PR, running any kind of
+  code audit, updating dependencies, or working through a milestone. Also use
+  when the user mentions issue numbers, PR numbers, milestone names, or
+  asks you to "fix", "triage", "audit", "review", or "update deps".
+---
+
+# GitHub Commander
+
+Structured, configurable workflows that teach AI agents to triage GitHub issues,
+review PRs, and sprint through milestones. Every action is journaled for full
+audit trails, and human-in-the-loop checkpoints keep you in control.
+
+The reason every step journals its results is that it creates a searchable audit
+trail — future sessions can find exactly what was tried, what passed, and what
+failed, without the human needing to remember or repeat context.
+
+## When to Load
+
+Load this skill when any of these apply:
+
+- You are assigned or asked to fix a GitHub issue
+- You need to review or submit a pull request
+- You need to work through issues in a milestone
+- You want to run dependency updates, security audits, or code quality audits
+- The user mentions an issue number (e.g., "fix #42") or PR number
+- The user says "triage", "audit", "review", "update deps", or similar
+- You are about to push code and want a structured validation pipeline
+
+## Quick Reference
+
+| Workflow                | File                              | Purpose                                     |
+| ----------------------- | --------------------------------- | ------------------------------------------- |
+| **Issue Triage**        | `workflows/issue-triage.md`       | Fix a single GitHub issue end-to-end        |
+| **PR Review**           | `workflows/pr-review.md`          | Review a PR with validation pipeline        |
+| **Milestone Sprint**    | `workflows/milestone-sprint.md`   | Work through milestone issues sequentially  |
+| **Update Dependencies** | `workflows/update-deps.md`        | Dependency update with audit trail          |
+| **Security Audit**      | `workflows/security-audit.md`     | Auto-detected security scanning             |
+| **Code Quality Audit**  | `workflows/code-quality-audit.md` | Static code quality analysis                |
+| **Performance Audit**   | `workflows/perf-audit.md`         | Build, bundle, runtime, test speed analysis |
+| **Full Audit**          | `workflows/full-audit.md`         | Unified quality + perf + security audit     |
+
+## Prerequisites
+
+- `gh` CLI authenticated (`gh auth status`)
+- `GITHUB_TOKEN` set for API access
+- `GITHUB_REPO_PATH` set for repo auto-detection
+- Project repo cloned locally
+
+## Configuration
+
+All commands are configurable via environment variables. Defaults assume a
+Node.js project. Override for other ecosystems (Python, Rust, Go, etc.).
+
+| Variable                        | Default             | Description                         |
+| ------------------------------- | ------------------- | ----------------------------------- |
+| `PROJECT_LINT_CMD`              | `npm run lint`      | Lint command                        |
+| `PROJECT_TYPECHECK_CMD`         | `npm run typecheck` | Type-check command (empty = skip)   |
+| `PROJECT_BUILD_CMD`             | `npm run build`     | Build command (empty = skip)        |
+| `PROJECT_TEST_CMD`              | `npm run test`      | Unit/integration test command       |
+| `PROJECT_E2E_CMD`               | _(empty = skip)_    | E2E test command                    |
+| `PROJECT_PACKAGE_MANAGER`       | _(auto-detect)_     | `npm`, `yarn`, `pnpm`, or `bun`     |
+| `PROJECT_HAS_DOCKERFILE`        | _(auto-detect)_     | `true` to enable Docker audit steps |
+| `COMMANDER_HITL_FILE_THRESHOLD` | `10`                | HITL if changes touch > N files     |
+| `COMMANDER_SECURITY_TOOLS`      | _(auto-detect)_     | Comma-separated override list       |
+| `COMMANDER_BRANCH_PREFIX`       | `fix`               | Branch naming prefix                |
+
+### Package Manager Auto-Detection
+
+If `PROJECT_PACKAGE_MANAGER` is not set, detect by lockfile:
+
+1. `bun.lockb` or `bun.lock` → `bun`
+2. `pnpm-lock.yaml` → `pnpm`
+3. `yarn.lock` → `yarn`
+4. `package-lock.json` → `npm`
+5. Fallback → `npm`
+
+### Security Tool Auto-Detection
+
+When `COMMANDER_SECURITY_TOOLS` is not set, each tool is detected independently:
+
+| Tool           | Detection                       | What It Scans                 |
+| -------------- | ------------------------------- | ----------------------------- |
+| `npm-audit`    | Always (Node.js project)        | Dependency vulnerabilities    |
+| `codeql`       | `codeql` CLI or `gh codeql`     | Static analysis (SAST)        |
+| `trivy`        | `trivy --version` succeeds      | Container images, filesystems |
+| `docker-scout` | `docker scout version` succeeds | Docker image CVEs             |
+| `gitleaks`     | `gitleaks version` succeeds     | Secrets in git history        |
+| `trufflehog`   | `trufflehog --version` succeeds | Secrets (verified only)       |
+
+Missing tools are skipped with a journal note — never a failure.
+
+## Core Concepts
+
+### Validation Gates
+
+Every workflow uses sequential validation gates. Each gate must pass before the
+next runs. On failure, the agent attempts to auto-fix (lint/type errors). If
+auto-fix fails after 2 attempts, the agent requests human input.
+
+```
+Gate 1: Lint + Typecheck  →  Gate 2: Build  →  Gate 3: Tests  →  Gate 4: E2E  →  Gate 5: Security
+```
+
+Gates configured with empty commands are skipped automatically.
+
+### Journal Audit Trail
+
+Every significant action creates a journal entry with structured tags:
+
+- **`commander`** — all entries from this skill
+- **`triage`** / **`review`** / **`milestone`** — workflow type
+- **`gate-pass`** / **`gate-fail`** — validation results
+- **`security`** — security scan findings
+
+Entries link to issues/PRs via `issue_number` and `pr_number` fields, connecting
+to the knowledge graph automatically.
+
+### Human-in-the-Loop Checkpoints
+
+The agent pauses and requests human approval when:
+
+1. **Before `git push`** — present diff summary, files changed
+2. **Critical security findings** — any critical/high severity scan result
+3. **Unfixable test failures** — after 2 auto-fix attempts
+4. **Large changesets** — changes touch more files than `COMMANDER_HITL_FILE_THRESHOLD`
+5. **Between milestone issues** — in milestone-sprint workflow
+
+## Shipped Entry Types
+
+These entry types are used by Commander workflows for structured audit trails:
+
+| Type                     | Used By          | Purpose                                     |
+| ------------------------ | ---------------- | ------------------------------------------- |
+| `triage`                 | issue-triage     | Issue context gathered, analysis complete   |
+| `implementation`         | issue-triage     | Fix implemented                             |
+| `gate_pass`              | all              | Validation gate passed                      |
+| `gate_fail`              | all              | Validation gate failed (with error details) |
+| `security_finding`       | security-audit   | Security scan finding                       |
+| `pr_submitted`           | issue-triage     | PR created and pushed                       |
+| `review_start`           | pr-review        | PR review initiated                         |
+| `review_complete`        | pr-review        | PR review completed                         |
+| `milestone_sprint_start` | milestone-sprint | Sprint started                              |
+| `deps_update`            | update-deps      | Dependency update completed                 |
+| `audit_finding`          | all audits       | Code quality or perf finding                |

package/skills/github-commander/config/project-config.example.md

@@ -0,0 +1,125 @@
+# GitHub Commander — Project Configuration
+
+This file documents all environment variables used by the GitHub Commander skill.
+Copy the relevant variables to your MCP server configuration.
+
+## Quick Start (Node.js — defaults work out of the box)
+
+```json
+{
+  "mcpServers": {
+    "memory-journal-mcp": {
+      "command": "memory-journal-mcp",
+      "env": {
+        "GITHUB_TOKEN": "ghp_your_token",
+        "GITHUB_REPO_PATH": "/path/to/your/repo"
+      }
+    }
+  }
+}
+```
+
+No additional configuration needed — all defaults are Node.js with npm.
+
+## Full Configuration Reference
+
+### Project Commands
+
+These define what commands the agent runs during validation gates.
+Set any of them to an empty string to skip that gate.
+
+```bash
+# Lint command (default: "npm run lint")
+PROJECT_LINT_CMD="npm run lint"
+
+# Type-check command (default: "npm run typecheck")
+# Set empty to skip: PROJECT_TYPECHECK_CMD=""
+PROJECT_TYPECHECK_CMD="npm run typecheck"
+
+# Build command (default: "npm run build")
+# Set empty to skip: PROJECT_BUILD_CMD=""
+PROJECT_BUILD_CMD="npm run build"
+
+# Unit/integration test command (default: "npm run test")
+PROJECT_TEST_CMD="npm run test"
+
+# E2E test command (default: empty = skip)
+PROJECT_E2E_CMD="npm run test:e2e"
+```
+
+### Package Manager
+
+```bash
+# Auto-detected from lockfile if not set
+# Options: npm, yarn, pnpm, bun
+PROJECT_PACKAGE_MANAGER="npm"
+```
+
+### Docker Support
+
+```bash
+# Auto-detected from Dockerfile presence if not set
+# Set explicitly to enable Docker-specific audit steps
+PROJECT_HAS_DOCKERFILE="true"
+```
+
+### Commander Behavior
+
+```bash
+# HITL checkpoint if changes touch more than this many files (default: 10)
+COMMANDER_HITL_FILE_THRESHOLD="10"
+
+# Override auto-detected security tools (comma-separated)
+# Options: npm-audit, codeql, trivy, docker-scout, gitleaks, trufflehog
+# Default: auto-detect all available tools
+COMMANDER_SECURITY_TOOLS="npm-audit,trivy,gitleaks"
+
+# Branch naming prefix (default: "fix")
+# Produces branches like: fix/issue-123
+COMMANDER_BRANCH_PREFIX="fix"
+```
+
+## Example: Python Project
+
+```json
+{
+  "env": {
+    "PROJECT_LINT_CMD": "ruff check .",
+    "PROJECT_TYPECHECK_CMD": "mypy .",
+    "PROJECT_BUILD_CMD": "",
+    "PROJECT_TEST_CMD": "pytest",
+    "PROJECT_E2E_CMD": "",
+    "PROJECT_PACKAGE_MANAGER": "pip"
+  }
+}
+```
+
+## Example: Rust Project
+
+```json
+{
+  "env": {
+    "PROJECT_LINT_CMD": "cargo clippy -- -D warnings",
+    "PROJECT_TYPECHECK_CMD": "",
+    "PROJECT_BUILD_CMD": "cargo build",
+    "PROJECT_TEST_CMD": "cargo test",
+    "PROJECT_E2E_CMD": "",
+    "PROJECT_PACKAGE_MANAGER": "cargo"
+  }
+}
+```
+
+## Example: Go Project
+
+```json
+{
+  "env": {
+    "PROJECT_LINT_CMD": "golangci-lint run",
+    "PROJECT_TYPECHECK_CMD": "",
+    "PROJECT_BUILD_CMD": "go build ./...",
+    "PROJECT_TEST_CMD": "go test ./...",
+    "PROJECT_E2E_CMD": "",
+    "PROJECT_PACKAGE_MANAGER": "go"
+  }
+}
+```