mustflow 2.103.3 → 2.103.10

package/dist/cli/commands/run.js

@@ -79,6 +79,14 @@ function reportRunPlanFailure(plan, reporter, lang) {
                 detail: getRunPlanDetail(plan, lang, 'run.error.blockedLongRunningCommandDetail'),
             });
             break;
+        case 'network_requires_approval':
+        case 'destructive_requires_approval':
+        case 'approval_policy_unreadable':
+            message = t(lang, 'run.error.approvalRequired', {
+                intent: plan.intentName,
+                detail: getRunPlanDetail(plan, lang, 'run.error.approvalRequiredDetail'),
+            });
+            break;
         case 'cwd_outside_project':
             message = t(lang, 'run.error.cwdOutsideProject', {
                 intent: plan.intentName,
@@ -327,6 +335,9 @@ export async function runRun(args, reporter, lang = 'en', options = {}) {
         return plan.ok ? 0 : 1;
     }
     if (!plan.ok) {
+        if (json) {
+            reporter.stdout(JSON.stringify(createRunPreview(plan, 'plan-only'), null, 2));
+        }
         reportRunPlanFailure(plan, reporter, lang);
         writeLatestProfile(profiler, options, {
             projectRoot,

package/dist/cli/i18n/en.js

@@ -1238,6 +1238,8 @@ Read these files before working:
     "run.error.blockedShellBackgroundDetail": "Shell commands must not spawn background work.",
     "run.error.blockedLongRunningCommand": 'Intent "{intent}" is blocked. {detail}',
     "run.error.blockedLongRunningCommandDetail": "Command argv must describe a finite one-shot command, not a development server, watcher, shell wrapper, interpreter loop, or background process.",
+    "run.error.approvalRequired": 'Intent "{intent}" requires approval. {detail}',
+    "run.error.approvalRequiredDetail": "The repository approval policy requires explicit approval before this command intent can run.",
     "run.error.cwdOutsideProject": 'Command "{intent}" has an invalid cwd: {detail}',
     "run.error.cwdOutsideProjectDetail": "Intent cwd must stay inside the current root.",
     "run.error.invalidTestTarget": 'Command "{intent}" received an invalid test target. {detail}',

package/dist/cli/i18n/es.js

@@ -1238,6 +1238,8 @@ Lee estos archivos antes de trabajar:
     "run.error.blockedShellBackgroundDetail": "Los comandos de shell no deben iniciar trabajo en segundo plano.",
     "run.error.blockedLongRunningCommand": 'La intención "{intent}" está bloqueada. {detail}',
     "run.error.blockedLongRunningCommandDetail": "argv debe describir un comando finito de una sola ejecución, no un servidor de desarrollo, watcher, envoltorio de shell, bucle de intérprete o proceso en segundo plano.",
+    "run.error.approvalRequired": 'La intención "{intent}" requiere aprobación. {detail}',
+    "run.error.approvalRequiredDetail": "La política de aprobación del repositorio requiere aprobación explícita antes de ejecutar esta intención de comando.",
     "run.error.cwdOutsideProject": 'El comando "{intent}" tiene un cwd no válido: {detail}',
     "run.error.cwdOutsideProjectDetail": "El cwd de la intención debe permanecer dentro de la raíz actual.",
     "run.error.invalidTestTarget": 'El comando "{intent}" recibió un objetivo de prueba no válido. {detail}',

package/dist/cli/i18n/fr.js

@@ -1238,6 +1238,8 @@ Lisez ces fichiers avant de travailler :
     "run.error.blockedShellBackgroundDetail": "Les commandes shell ne doivent pas lancer de travail en arrière-plan.",
     "run.error.blockedLongRunningCommand": 'L’intention "{intent}" est bloquée. {detail}',
     "run.error.blockedLongRunningCommandDetail": "argv doit décrire une commande ponctuelle finie, pas un serveur de développement, un watcher, un wrapper shell, une boucle d'interpréteur ou un processus en arrière-plan.",
+    "run.error.approvalRequired": 'L’intention "{intent}" nécessite une approbation. {detail}',
+    "run.error.approvalRequiredDetail": "La politique d’approbation du dépôt exige une approbation explicite avant d’exécuter cette intention de commande.",
     "run.error.cwdOutsideProject": 'La commande "{intent}" a un cwd non valide : {detail}',
     "run.error.cwdOutsideProjectDetail": "Le cwd de l’intention doit rester dans la racine actuelle.",
     "run.error.invalidTestTarget": 'La commande "{intent}" a reçu une cible de test invalide. {detail}',

package/dist/cli/i18n/hi.js

@@ -1238,6 +1238,8 @@ export const hiMessages = {
     "run.error.blockedShellBackgroundDetail": "Shell commands background work शुरू नहीं कर सकतीं।",
     "run.error.blockedLongRunningCommand": 'इंटेंट "{intent}" अवरुद्ध है। {detail}',
     "run.error.blockedLongRunningCommandDetail": "argv में finite one-shot command होना चाहिए, development server, watcher, shell wrapper, interpreter loop, या background process नहीं।",
+    "run.error.approvalRequired": 'इंटेंट "{intent}" को approval चाहिए। {detail}',
+    "run.error.approvalRequiredDetail": "Repository approval policy के अनुसार इस command intent को चलाने से पहले explicit approval चाहिए।",
     "run.error.cwdOutsideProject": 'कमांड "{intent}" का cwd अमान्य है: {detail}',
     "run.error.cwdOutsideProjectDetail": "Intent cwd current root के अंदर रहना चाहिए।",
     "run.error.invalidTestTarget": 'कमांड "{intent}" को अमान्य test target मिला। {detail}',

package/dist/cli/i18n/ko.js

@@ -1238,6 +1238,8 @@ export const koMessages = {
     "run.error.blockedShellBackgroundDetail": "셸 명령은 백그라운드 작업을 시작하면 안 됩니다.",
     "run.error.blockedLongRunningCommand": '명령 의도 "{intent}"가 차단되었습니다. {detail}',
     "run.error.blockedLongRunningCommandDetail": "argv는 개발 서버, 감시 명령, 셸 래퍼, 인터프리터 반복 작업, 백그라운드 프로세스가 아니라 끝나는 단발성 명령이어야 합니다.",
+    "run.error.approvalRequired": '명령 의도 "{intent}"는 승인이 필요합니다. {detail}',
+    "run.error.approvalRequiredDetail": "저장소 승인 정책상 이 명령 의도를 실행하기 전에 명시적 승인이 필요합니다.",
     "run.error.cwdOutsideProject": '명령 "{intent}"의 실행 위치(cwd)가 올바르지 않습니다: {detail}',
     "run.error.cwdOutsideProjectDetail": "명령 실행 위치(cwd)는 현재 루트 안에 있어야 합니다.",
     "run.error.invalidTestTarget": '명령 "{intent}"에 올바르지 않은 테스트 대상이 전달되었습니다. {detail}',

package/dist/cli/i18n/zh.js

@@ -1238,6 +1238,8 @@ export const zhMessages = {
     "run.error.blockedShellBackgroundDetail": "Shell 命令不得启动后台工作。",
     "run.error.blockedLongRunningCommand": '意图 "{intent}" 已被阻止。{detail}',
     "run.error.blockedLongRunningCommandDetail": "argv 必须描述会结束的单次命令，而不是开发服务器、监听命令、shell 包装器、解释器循环或后台进程。",
+    "run.error.approvalRequired": '意图 "{intent}" 需要审批。{detail}',
+    "run.error.approvalRequiredDetail": "仓库审批策略要求在运行此命令意图前获得明确审批。",
     "run.error.cwdOutsideProject": '命令 "{intent}" 的 cwd 无效：{detail}',
     "run.error.cwdOutsideProjectDetail": "意图 cwd 必须位于当前根目录内。",
     "run.error.invalidTestTarget": '命令 "{intent}" 收到无效测试目标。{detail}',

package/dist/cli/lib/external-skill-import.js

@@ -1,4 +1,4 @@
-import { existsSync } from 'node:fs';
+import { existsSync, renameSync, rmSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { ensureFileTargetInsideWithoutSymlinks, writeJsonFileInsideWithoutSymlinks, writeUtf8FileInsideWithoutSymlinks, } from '../../core/safe-filesystem.js';
@@ -185,6 +185,52 @@ function validateImportRelativeFilePath(relativePath) {
 function normalizeTextContent(content) {
     return content.replace(/\r\n?/gu, '\n');
 }
+function readFrontmatterParts(content) {
+    if (!content.startsWith('---')) {
+        return {
+            name: null,
+            description: null,
+            body: content,
+        };
+    }
+    const firstLineEnd = content.indexOf('\n');
+    const end = firstLineEnd >= 0 ? content.indexOf('\n---', firstLineEnd + 1) : -1;
+    if (firstLineEnd < 0 || end < 0) {
+        return {
+            name: null,
+            description: null,
+            body: content,
+        };
+    }
+    const frontmatter = content.slice(firstLineEnd + 1, end).split(/\r?\n/u);
+    const bodyStart = content.indexOf('\n', end + 1);
+    return {
+        name: readFrontmatterScalar(content, 'name'),
+        description: readFrontmatterScalar(content, 'description'),
+        body: bodyStart >= 0 ? content.slice(bodyStart + 1) : '',
+    };
+}
+function renderYamlScalar(key, value) {
+    return `${key}: ${JSON.stringify(value)}`;
+}
+function sanitizeExternalSkillMarkdown(content) {
+    const frontmatter = readFrontmatterParts(content);
+    const lines = [
+        '---',
+        ...(frontmatter.name ? [renderYamlScalar('name', frontmatter.name)] : []),
+        ...(frontmatter.description ? [renderYamlScalar('description', frontmatter.description)] : []),
+        'external_authority: untrusted',
+        '---',
+        frontmatter.body,
+    ];
+    return lines.join('\n');
+}
+function normalizeImportedSkillFiles(files) {
+    return files.map((file) => ({
+        ...file,
+        content: file.relativePath === 'SKILL.md' ? sanitizeExternalSkillMarkdown(file.content) : file.content,
+    }));
+}
 function hashContent(content) {
     return `sha256:${createHash('sha256').update(content).digest('hex')}`;
 }
@@ -314,21 +360,38 @@ function createTarget(skillName) {
     };
 }
 function writeImportedSkillFiles(projectRoot, target, source, files, fileReport, warnings) {
-    const skillPath = path.join(projectRoot, ...target.skill_dir.split('/'), 'SKILL.md');
-    if (existsSync(skillPath)) {
+    const targetPath = path.join(projectRoot, ...target.skill_dir.split('/'));
+    const skillPath = path.join(targetPath, 'SKILL.md');
+    if (existsSync(targetPath)) {
         throw new Error(`External skill already exists: ${target.skill_dir}`);
     }
     ensureFileTargetInsideWithoutSymlinks(projectRoot, skillPath, { allowMissingLeaf: true });
-    for (const file of files) {
-        writeUtf8FileInsideWithoutSymlinks(projectRoot, path.join(projectRoot, ...target.skill_dir.split('/'), ...file.relativePath.split('/')), file.content);
+    const tempSkillDir = `${EXTERNAL_SKILL_ROOT}/.${target.skill_name}.tmp-${process.pid}-${Date.now()}`;
+    const tempTarget = {
+        ...target,
+        skill_dir: tempSkillDir,
+        provenance_path: `${tempSkillDir}/${PROVENANCE_FILE}`,
+    };
+    const tempPath = path.join(projectRoot, ...tempTarget.skill_dir.split('/'));
+    const tempSkillPath = path.join(tempPath, 'SKILL.md');
+    ensureFileTargetInsideWithoutSymlinks(projectRoot, tempSkillPath, { allowMissingLeaf: true });
+    try {
+        for (const file of files) {
+            writeUtf8FileInsideWithoutSymlinks(projectRoot, path.join(projectRoot, ...tempTarget.skill_dir.split('/'), ...file.relativePath.split('/')), file.content);
+        }
+        writeJsonFileInsideWithoutSymlinks(projectRoot, path.join(projectRoot, ...tempTarget.provenance_path.split('/')), {
+            schema_version: '1',
+            kind: 'external_skill_source',
+            source,
+            files: fileReport,
+            warnings,
+        });
+        renameSync(tempPath, targetPath);
+    }
+    catch (error) {
+        rmSync(tempPath, { recursive: true, force: true });
+        throw error;
     }
-    writeJsonFileInsideWithoutSymlinks(projectRoot, path.join(projectRoot, ...target.provenance_path.split('/')), {
-        schema_version: '1',
-        kind: 'external_skill_source',
-        source,
-        files: fileReport,
-        warnings,
-    });
 }
 function rejectionReport(mode, issue) {
     return {
@@ -355,10 +418,11 @@ export async function createExternalSkillImportReport(projectRoot, inputUrl, opt
         if (typeof fetchImpl !== 'function') {
             throw new Error('This runtime does not provide fetch.');
         }
-        const files = await loadExternalSkillFiles(fetchImpl, parsed);
-        const skillName = targetNameForSkill(files, parsed, options.name);
+        const sourceFiles = await loadExternalSkillFiles(fetchImpl, parsed);
+        const skillName = targetNameForSkill(sourceFiles, parsed, options.name);
         const target = createTarget(skillName);
         const source = externalSkillSourceFromParsed(inputUrl, parsed);
+        const files = normalizeImportedSkillFiles(sourceFiles);
         const reports = fileReports(files);
         const warnings = [
             ...(reports.some((file) => file.kind === 'script')

package/dist/cli/lib/local-index/sql.js

@@ -1,5 +1,6 @@
 import { createRequire } from 'node:module';
-export async function loadSqlJs() {
+let sqlJsPromise = null;
+async function initializeSqlJs() {
     const require = createRequire(import.meta.url);
     const wasmPath = require.resolve('sql.js/dist/sql-wasm.wasm');
     const sqlJsModule = (await import('sql.js'));
@@ -13,3 +14,10 @@ export async function loadSqlJs() {
         },
     });
 }
+export async function loadSqlJs() {
+    sqlJsPromise ??= initializeSqlJs().catch((error) => {
+        sqlJsPromise = null;
+        throw error;
+    });
+    return sqlJsPromise;
+}

package/dist/cli/lib/run-plan.js

@@ -7,6 +7,7 @@ import { evaluateCommandIntentEligibility, } from '../../core/command-intent-eli
 import { inspectActiveRunLocks, } from '../../core/active-run-locks.js';
 import { isRecord, readPositiveInteger, readString, readStringArray, } from '../../core/config-loading.js';
 import { DEFAULT_COMMAND_MAX_OUTPUT_BYTES, COMMAND_OUTPUT_LIMIT_SCOPE, } from '../../core/command-output-limits.js';
+import { checkRepoApprovalGate } from '../../core/repo-approval-gate.js';
 import { normalizeSuccessExitCodes } from '../../core/success-exit-codes.js';
 import { normalizeSafeTestTargetPath, TEST_TARGET_PATH_ERROR } from '../../core/test-target-paths.js';
 import { evaluateCommandPreconditions, } from '../../core/command-preconditions.js';
@@ -124,6 +125,38 @@ function readRunIntentMetadata(contract, intent) {
         relatedOneshotChecks: readStringArray(intent, 'related_oneshot_checks') ?? [],
     };
 }
+function createApprovalBlock(projectRoot, metadata) {
+    const actionTypes = [];
+    if (metadata.network === true) {
+        actionTypes.push('network_access');
+    }
+    if (metadata.destructive === true) {
+        actionTypes.push('destructive_command');
+    }
+    if (actionTypes.length === 0) {
+        return null;
+    }
+    const approvalReport = checkRepoApprovalGate(projectRoot, actionTypes);
+    if (approvalReport.issues.length > 0) {
+        return {
+            reasonCode: 'approval_policy_unreadable',
+            detail: `Could not evaluate ${approvalReport.input.policy_path}: ${approvalReport.issues.join(' ')}`,
+        };
+    }
+    const requiredActions = approvalReport.decisions
+        .filter((decision) => decision.approval_required)
+        .map((decision) => decision.action_type);
+    if (requiredActions.length === 0) {
+        return null;
+    }
+    const reasonCode = requiredActions.includes('destructive_command')
+        ? 'destructive_requires_approval'
+        : 'network_requires_approval';
+    return {
+        reasonCode,
+        detail: `Action ${requiredActions.map((action) => JSON.stringify(action)).join(', ')} requires explicit approval before mf run can execute this intent.`,
+    };
+}
 function createBlockedRunPlan(contract, intentName, intent, eligibility, reasonCode, detail, preconditions = []) {
     const metadata = intent ? readRunIntentMetadata(contract, intent) : null;
     return {
@@ -177,6 +210,10 @@ export function createRunPlan(projectRoot, contract, intentName, options = {}) {
         return createBlockedRunPlan(contract, intentName, rawIntent, eligibility, eligibility.code, eligibility.detail, preconditions);
     }
     const metadata = readRunIntentMetadata(contract, rawIntent);
+    const approvalBlock = createApprovalBlock(projectRoot, metadata);
+    if (approvalBlock) {
+        return createBlockedRunPlan(contract, intentName, rawIntent, eligibility, approvalBlock.reasonCode, approvalBlock.detail, preconditions);
+    }
     const maxOutputBytesLimitDetail = getCommandMaxOutputBytesLimitDetail(contract, rawIntent);
     if (maxOutputBytesLimitDetail) {
         return createBlockedRunPlan(contract, intentName, rawIntent, eligibility, 'max_output_bytes_exceeds_limit', maxOutputBytesLimitDetail, preconditions);

package/dist/core/change-impact.js

@@ -195,6 +195,13 @@ function addDependencyImpacts(root, changedFiles, impacts, policy, findings, iss
             issues.push(`dependency-graph: ${issue}`);
         }
     }
+    for (const dependencyFinding of dependencyReport.findings) {
+        const mappedFinding = mapDependencyGraphTruncationFinding(dependencyFinding);
+        if (mappedFinding === null) {
+            continue;
+        }
+        findings.push(mappedFinding);
+    }
     const changedPathSet = new Set(sourcePaths);
     for (const edge of dependencyReport.edges) {
         if (!changedPathSet.has(edge.target_path) || changedPathSet.has(edge.source_path)) {
@@ -209,6 +216,15 @@ function addDependencyImpacts(root, changedFiles, impacts, policy, findings, iss
         }, policy, findings, issues);
     }
 }
+function mapDependencyGraphTruncationFinding(finding) {
+    if (finding.code === 'dependency_graph_max_files_exceeded') {
+        return makeFinding('change_impact_max_files_exceeded', 'high', finding.path, `Dependency graph input was truncated while computing change impact: ${finding.message}`);
+    }
+    if (finding.code === 'dependency_graph_max_nodes_exceeded' || finding.code === 'dependency_graph_max_edges_exceeded') {
+        return makeFinding('change_impact_max_impacts_exceeded', 'high', finding.path, `Dependency graph impact expansion was truncated while computing change impact: ${finding.message}`);
+    }
+    return null;
+}
 function createScriptHints(changedFiles) {
     const sourcePaths = changedFiles.filter((file) => file.surface === 'source').map((file) => file.path);
     const selectorRelevantFiles = changedFiles.filter((file) => ['source', 'test', 'schema', 'config', 'package', 'template', 'workflow', 'unknown'].includes(file.surface));

package/dist/core/code-outline.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 import { listSourceAnchorFiles, parseSourceAnchorsInContent, sourceAnchorTextContainsSecretLike, splitSourceAnchorList, } from './source-anchors.js';
 export const CODE_PACK_ID = 'code';
@@ -19,17 +20,7 @@ const SVELTE_EXTENSIONS = ['.svelte'];
 const GO_EXTENSIONS = ['.go'];
 const RUST_EXTENSIONS = ['.rs'];
 const PYTHON_EXTENSIONS = ['.py'];
-const IGNORED_DIRECTORIES = [
-    '.git',
-    '.mustflow/cache',
-    '.mustflow/state',
-    'node_modules',
-    'dist',
-    'build',
-    'coverage',
-    '.next',
-    '.turbo',
-];
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_OUTLINE_CODES = new Set([
     'code_outline_path_outside_root',
     'code_outline_unreadable_path',
@@ -97,8 +88,7 @@ export function languageForPath(filePath) {
     return languageAdapterForPath(filePath)?.languageForPath(filePath) ?? null;
 }
 function isIgnoredDirectory(relativePath) {
-    const normalized = normalizeRelativePath(relativePath);
-    return IGNORED_DIRECTORIES.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`));
+    return isIgnoredDirectoryPath(normalizeRelativePath(relativePath), IGNORED_DIRECTORIES);
 }
 function makeOutlineFinding(code, severity, pathValue, message) {
     return { code, severity, path: pathValue, message };

package/dist/core/config-chain.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 export const CONFIG_CHAIN_PACK_ID = 'repo';
 export const CONFIG_CHAIN_SCRIPT_ID = 'config-chain';
@@ -37,17 +38,7 @@ const CONFIG_FILE_NAMES = [
     '.mustflow/config/commands.toml',
     '.mustflow/config/mustflow.toml',
 ];
-const IGNORED_DIRECTORIES = [
-    '.git',
-    '.mustflow/cache',
-    '.mustflow/state',
-    'node_modules',
-    'dist',
-    'build',
-    'coverage',
-    '.next',
-    '.turbo',
-];
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_CODES = new Set([
     'config_chain_path_outside_root',
     'config_chain_unreadable_path',
@@ -133,8 +124,7 @@ function isConfigFile(relativePath) {
         /^tsconfig(?:\..*)?\.json$/u.test(name));
 }
 function isIgnoredDirectory(relativePath) {
-    const normalized = normalizeRelativePath(relativePath);
-    return IGNORED_DIRECTORIES.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`));
+    return isIgnoredDirectoryPath(normalizeRelativePath(relativePath), IGNORED_DIRECTORIES);
 }
 function normalizeTargetPath(projectRoot, targetPath) {
     const absolutePath = path.resolve(process.cwd(), targetPath);

package/dist/core/dependency-graph.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 export const DEPENDENCY_GRAPH_PACK_ID = 'code';
 export const DEPENDENCY_GRAPH_SCRIPT_ID = 'dependency-graph';
@@ -14,17 +15,7 @@ const MAX_ISSUES = 50;
 const MAX_CYCLES = 20;
 const SOURCE_EXTENSIONS = ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs'];
 const RESOLVE_EXTENSIONS = [...SOURCE_EXTENSIONS, '.json'];
-const IGNORED_DIRECTORIES = [
-    '.git',
-    '.mustflow/cache',
-    '.mustflow/state',
-    'node_modules',
-    'dist',
-    'build',
-    'coverage',
-    '.next',
-    '.turbo',
-];
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_CODES = new Set([
     'dependency_graph_path_outside_root',
     'dependency_graph_unreadable_path',
@@ -64,8 +55,7 @@ function isSourceLanguage(language) {
     return language !== 'json' && language !== 'other';
 }
 function isIgnoredDirectory(relativePath) {
-    const normalized = normalizeRelativePath(relativePath);
-    return IGNORED_DIRECTORIES.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`));
+    return isIgnoredDirectoryPath(normalizeRelativePath(relativePath), IGNORED_DIRECTORIES);
 }
 function makeFinding(code, severity, pathValue, message) {
     return { code, severity, path: pathValue, message };

package/dist/core/docs-link-integrity.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 export const LINK_INTEGRITY_PACK_ID = 'docs';
 export const LINK_INTEGRITY_SCRIPT_ID = 'link-integrity';
@@ -11,7 +12,7 @@ const MAX_ISSUES = 50;
 const DEFAULT_PATHS = ['README.md', 'schemas/README.md', 'docs-site/src/content/docs'];
 const PATH_FILTERS = ['*.md', '*.mdx'];
 const CHECKED_LINK_KINDS = ['local_file', 'local_anchor'];
-const IGNORED_DIRECTORIES = new Set(['.git', 'node_modules', 'dist', 'build', 'coverage', '.astro']);
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_CODES = new Set([
     'link_integrity_path_outside_root',
     'link_integrity_unreadable_path',
@@ -59,7 +60,7 @@ function addCandidate(candidates, findings, issues, policy, candidate) {
 }
 function collectDocumentsFromDirectory(projectRoot, absoluteDirectory, candidates, findings, issues, policy) {
     const relativeDirectory = normalizeRelativePath(path.relative(projectRoot, absoluteDirectory));
-    if (IGNORED_DIRECTORIES.has(path.basename(relativeDirectory)) || [...IGNORED_DIRECTORIES].some((entry) => relativeDirectory.startsWith(`${entry}/`))) {
+    if (isIgnoredDirectoryPath(relativeDirectory, IGNORED_DIRECTORIES)) {
         return;
     }
     let entries;
@@ -173,9 +174,26 @@ function splitTarget(target) {
     const anchor = rawAnchor === undefined ? null : decodeUriComponentSafe(rawAnchor);
     return { pathPart, anchor };
 }
+function stripHtmlTagText(value) {
+    let result = '';
+    let tagDepth = 0;
+    for (const char of value) {
+        if (char === '<') {
+            tagDepth += 1;
+            continue;
+        }
+        if (char === '>') {
+            tagDepth = Math.max(0, tagDepth - 1);
+            continue;
+        }
+        if (tagDepth === 0) {
+            result += char;
+        }
+    }
+    return result;
+}
 function slugHeading(value) {
-    return value
-        .replace(/<[^>]+>/gu, '')
+    return stripHtmlTagText(value)
         .replace(/[`*_~]/gu, '')
         .replace(/\[([^\]]+)\]\([^)]+\)/gu, '$1')
         .toLocaleLowerCase()
@@ -369,6 +387,7 @@ export function checkLinkIntegrity(projectRoot, options) {
         max_file_bytes: options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES,
         default_paths: [...DEFAULT_PATHS],
         path_filters: [...PATH_FILTERS],
+        ignored_directories: [...IGNORED_DIRECTORIES],
         checked_link_kinds: [...CHECKED_LINK_KINDS],
     };
     const findings = [];

package/dist/core/env-contract.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 export const ENV_CONTRACT_PACK_ID = 'repo';
 export const ENV_CONTRACT_SCRIPT_ID = 'env-contract';
@@ -36,17 +37,7 @@ const ENV_EXAMPLE_NAMES = [
     '.dev.vars.example',
 ];
 const SECRET_ENV_NAMES = ['.env', '.env.local', '.env.production', '.env.development', '.dev.vars'];
-const IGNORED_DIRECTORIES = [
-    '.git',
-    '.mustflow/cache',
-    '.mustflow/state',
-    'node_modules',
-    'dist',
-    'build',
-    'coverage',
-    '.next',
-    '.turbo',
-];
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_CODES = new Set([
     'env_contract_path_outside_root',
     'env_contract_unreadable_path',
@@ -66,8 +57,7 @@ function pushIssue(issues, issue) {
     }
 }
 function isIgnoredDirectory(relativePath) {
-    const normalized = normalizeRelativePath(relativePath);
-    return IGNORED_DIRECTORIES.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`));
+    return isIgnoredDirectoryPath(normalizeRelativePath(relativePath), IGNORED_DIRECTORIES);
 }
 function isEnvExampleFile(relativePath) {
     const name = path.basename(relativePath).toLowerCase();

package/dist/core/export-diff.js

@@ -3,6 +3,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import { extractSymbols, languageForPath } from './code-outline.js';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 export const CODE_EXPORT_DIFF_SCRIPT_ID = 'export-diff';
 export const CODE_EXPORT_DIFF_SCRIPT_REF = `code/${CODE_EXPORT_DIFF_SCRIPT_ID}`;
@@ -10,7 +11,7 @@ const DEFAULT_BASE_REF = 'HEAD';
 const DEFAULT_MAX_FILES = 100;
 const DEFAULT_MAX_FILE_BYTES = 1024 * 1024;
 const SUPPORTED_EXTENSIONS = ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs'];
-const IGNORED_DIRECTORIES = ['.git', 'node_modules', 'dist', 'build', 'coverage', '.mustflow/cache', '.mustflow/state'];
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_CODES = new Set([
     'export_diff_git_unavailable',
     'export_diff_invalid_ref',
@@ -46,8 +47,7 @@ function makeFinding(code, severity, pathValue, message) {
     return { code, severity, path: pathValue, message };
 }
 function isIgnoredPath(relativePath) {
-    const normalized = normalizeRelativePath(relativePath);
-    return IGNORED_DIRECTORIES.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`));
+    return isIgnoredDirectoryPath(normalizeRelativePath(relativePath), IGNORED_DIRECTORIES);
 }
 function isSupportedPath(relativePath) {
     return SUPPORTED_EXTENSIONS.includes(path.extname(relativePath).toLowerCase());

package/dist/core/ignored-directories.js

@@ -0,0 +1,40 @@
+export const DEFAULT_IGNORED_DIRECTORIES = [
+    '.git',
+    '.mustflow/cache',
+    '.mustflow/state',
+    'node_modules',
+    'dist',
+    'build',
+    'coverage',
+    '.next',
+    '.turbo',
+    '.astro',
+];
+function normalizeDirectoryPath(value) {
+    return value.replace(/\\/gu, '/').replace(/^\.\/+/u, '').replace(/\/+$/u, '') || '.';
+}
+function containsSegmentSequence(segments, sequence) {
+    if (sequence.length === 0 || sequence.length > segments.length) {
+        return false;
+    }
+    for (let index = 0; index <= segments.length - sequence.length; index += 1) {
+        if (sequence.every((segment, offset) => segments[index + offset] === segment)) {
+            return true;
+        }
+    }
+    return false;
+}
+export function isIgnoredDirectoryPath(relativePath, ignoredDirectories = DEFAULT_IGNORED_DIRECTORIES) {
+    const normalized = normalizeDirectoryPath(relativePath);
+    if (normalized === '.') {
+        return false;
+    }
+    const segments = normalized.split('/').filter((segment) => segment.length > 0);
+    return ignoredDirectories.some((entry) => {
+        const ignoredSegments = normalizeDirectoryPath(entry).split('/').filter((segment) => segment.length > 0);
+        if (ignoredSegments.length === 1) {
+            return segments.includes(ignoredSegments[0] ?? '');
+        }
+        return containsSegmentSequence(segments, ignoredSegments);
+    });
+}

package/dist/core/reference-drift.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 export const REFERENCE_DRIFT_PACK_ID = 'docs';
 export const REFERENCE_DRIFT_SCRIPT_ID = 'reference-drift';
@@ -16,7 +17,7 @@ const CHECKED_REFERENCE_KINDS = [
     'schema_file',
     'repo_path',
 ];
-const IGNORED_DIRECTORIES = new Set(['.git', 'node_modules', 'dist', 'build', 'coverage', '.astro']);
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_CODES = new Set([
     'reference_drift_path_outside_root',
     'reference_drift_unreadable_path',
@@ -64,7 +65,7 @@ function addCandidate(candidates, findings, issues, policy, candidate) {
 }
 function collectDocumentsFromDirectory(projectRoot, absoluteDirectory, candidates, findings, issues, policy) {
     const relativeDirectory = normalizeRelativePath(path.relative(projectRoot, absoluteDirectory));
-    if (IGNORED_DIRECTORIES.has(path.basename(relativeDirectory)) || [...IGNORED_DIRECTORIES].some((entry) => relativeDirectory.startsWith(`${entry}/`))) {
+    if (isIgnoredDirectoryPath(relativeDirectory, IGNORED_DIRECTORIES)) {
         return;
     }
     let entries;
@@ -318,6 +319,7 @@ export function checkReferenceDrift(projectRoot, options) {
         max_file_bytes: options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES,
         default_paths: [...DEFAULT_PATHS],
         path_filters: [...PATH_FILTERS],
+        ignored_directories: [...IGNORED_DIRECTORIES],
         checked_reference_kinds: [...CHECKED_REFERENCE_KINDS],
     };
     const commandNames = new Set(options.commandNames);