mustflow 2.103.3 → 2.103.12

package/dist/cli/lib/script-pack-registry.js

@@ -453,6 +453,35 @@ export const SCRIPT_PACKS = [
                 reportSchemaFile: 'secret-risk-scan-report.schema.json',
                 loadRunner: async () => (await import('../script-packs/repo-secret-risk-scan.js')).runRepoSecretRiskScanScript,
             },
+            {
+                packId: 'repo',
+                id: 'security-pattern-scan',
+                ref: scriptRef('repo', 'security-pattern-scan'),
+                usage: 'mf script-pack run repo/security-pattern-scan scan [path...] [options]',
+                summaryKey: 'scriptPack.script.securityPatternScan.summary',
+                actions: ['scan'],
+                useWhen: [
+                    'Scan source, CI, and config files for high-signal security code patterns without printing matched source lines or secret values.',
+                    'Review filesystem, command, injection, browser, token, session, parser, logging, access-control, and transport-security pattern leads before source-to-sink review.',
+                ],
+                phases: ['before_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['path', 'max_files', 'max_file_bytes', 'max_findings'],
+                outputs: ['human_summary', 'json_report', 'security_pattern_findings', 'review_focus'],
+                relatedSkills: [
+                    'api-access-control-review',
+                    'file-upload-security-review',
+                    'security-flow-review',
+                    'security-privacy-review',
+                    'security-regression-tests',
+                ],
+                riskLevel: 'medium',
+                cost: 'low',
+                reportSchemaFile: 'security-pattern-scan-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-security-pattern-scan.js')).runRepoSecurityPatternScanScript,
+            },
             {
                 packId: 'repo',
                 id: 'generated-boundary',
@@ -655,6 +684,34 @@ export const SCRIPT_PACKS = [
                 reportSchemaFile: 'repo-approval-gate-report.schema.json',
                 loadRunner: async () => (await import('../script-packs/repo-approval-gate.js')).runRepoApprovalGateScript,
             },
+            {
+                packId: 'repo',
+                id: 'deploy-surface',
+                ref: scriptRef('repo', 'deploy-surface'),
+                usage: 'mf script-pack run repo/deploy-surface inspect [options]',
+                summaryKey: 'scriptPack.script.deploySurface.summary',
+                actions: ['inspect'],
+                useWhen: [
+                    'Inspect local workflows, package metadata, package scripts, and deploy config files before claiming push, tag, release, or deploy follow-up is available.',
+                    'Review detected deploy surfaces with trigger, required verification, and manual gate evidence after repository changes.',
+                ],
+                phases: ['before_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: [],
+                outputs: ['human_summary', 'json_report', 'deploy_surfaces', 'required_verification', 'manual_gates'],
+                relatedSkills: [
+                    'completion-evidence-gate',
+                    'deployment-rollout-safety-review',
+                    'public-json-contract-change',
+                    'release-publish-change',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'repo-deploy-surface-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-deploy-surface.js')).runRepoDeploySurfaceScript,
+            },
             {
                 packId: 'repo',
                 id: 'related-files',

package/dist/cli/script-packs/repo-deploy-surface.js

@@ -0,0 +1,98 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { inspectRepoDeploySurface, REPO_DEPLOY_SURFACE_SCRIPT_REF, } from '../../core/repo-deploy-surface.js';
+const REPO_DEPLOY_SURFACE_OPTIONS = [{ name: '--json', kind: 'boolean' }];
+export function getRepoDeploySurfaceHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run repo/deploy-surface inspect [options]',
+        summary: t(lang, 'deploySurface.help.summary'),
+        options: [
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run repo/deploy-surface inspect',
+            'mf script-pack run repo/deploy-surface inspect --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'deploySurface.help.exit.ok') },
+            { label: '1', description: t(lang, 'deploySurface.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseRepoDeploySurfaceOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, REPO_DEPLOY_SURFACE_OPTIONS, { allowPositionals: false });
+    const json = hasParsedCliOption(parsed, '--json');
+    if (action !== 'inspect') {
+        return {
+            action: 'inspect',
+            json,
+            error: action
+                ? t(lang, 'deploySurface.error.unknownAction', { action })
+                : t(lang, 'deploySurface.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return { action, json, error: formatCliOptionParseError(parsed.error, lang) };
+    }
+    return { action, json };
+}
+function renderRepoDeploySurfaceSummary(report, lang) {
+    const lines = [
+        t(lang, 'deploySurface.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${REPO_DEPLOY_SURFACE_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'deploySurface.label.deploySurface')}: ${report.has_deploy_surface ? t(lang, 'value.yes') : t(lang, 'value.no')}`,
+        `${t(lang, 'deploySurface.label.surfaces')}: ${report.summary.surface_count}`,
+        `${t(lang, 'deploySurface.label.requiredVerification')}: ${report.summary.required_verification_count}`,
+        `${t(lang, 'deploySurface.label.manualGates')}: ${report.summary.manual_gate_count}`,
+    ];
+    if (report.surfaces.length > 0) {
+        lines.push(t(lang, 'deploySurface.label.surfaceDetails'));
+        for (const surface of report.surfaces) {
+            const location = surface.line === null ? surface.path : `${surface.path}:${surface.line}`;
+            const trigger = surface.trigger === null ? '' : `, trigger ${surface.trigger}`;
+            lines.push(`- ${surface.surface_type} (${surface.kind}) at ${location}${trigger}`);
+        }
+    }
+    if (report.required_verification.length > 0) {
+        lines.push(t(lang, 'deploySurface.label.requiredVerification'));
+        for (const verification of report.required_verification) {
+            lines.push(`- ${verification}`);
+        }
+    }
+    if (report.manual_gates.length > 0) {
+        lines.push(t(lang, 'deploySurface.label.manualGates'));
+        for (const gate of report.manual_gates) {
+            lines.push(`- ${gate}`);
+        }
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'deploySurface.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    if (!report.has_deploy_surface && report.issues.length === 0) {
+        lines.push(t(lang, 'deploySurface.noSurfaces'));
+    }
+    return lines.join('\n');
+}
+export function runRepoDeploySurfaceScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getRepoDeploySurfaceHelp(lang));
+        return 0;
+    }
+    const options = parseRepoDeploySurfaceOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run repo/deploy-surface --help', getRepoDeploySurfaceHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectRepoDeploySurface(resolveMustflowRoot());
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderRepoDeploySurfaceSummary(report, lang));
+    return report.ok ? 0 : 1;
+}

package/dist/cli/script-packs/repo-security-pattern-scan.js

@@ -0,0 +1,150 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, getParsedCliStringOption, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { inspectSecurityPatternScan, SECURITY_PATTERN_SCAN_SCRIPT_REF, } from '../../core/security-pattern-scan.js';
+const SECURITY_PATTERN_SCAN_OPTIONS = [
+    { name: '--json', kind: 'boolean' },
+    { name: '--max-files', kind: 'string' },
+    { name: '--max-file-bytes', kind: 'string' },
+    { name: '--max-findings', kind: 'string' },
+];
+function parsePositiveInteger(value, option, lang) {
+    if (value === null) {
+        return { value: null };
+    }
+    if (!/^[1-9]\d*$/u.test(value)) {
+        return { value: null, error: t(lang, 'securityPatternScan.error.invalidPositiveInteger', { option, value }) };
+    }
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed)) {
+        return { value: null, error: t(lang, 'securityPatternScan.error.invalidPositiveInteger', { option, value }) };
+    }
+    return { value: parsed };
+}
+export function getRepoSecurityPatternScanHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run repo/security-pattern-scan scan [path...] [options]',
+        summary: t(lang, 'securityPatternScan.help.summary'),
+        options: [
+            { label: '--max-files <count>', description: t(lang, 'securityPatternScan.help.option.maxFiles') },
+            { label: '--max-file-bytes <bytes>', description: t(lang, 'securityPatternScan.help.option.maxFileBytes') },
+            { label: '--max-findings <count>', description: t(lang, 'securityPatternScan.help.option.maxFindings') },
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run repo/security-pattern-scan scan --json',
+            'mf script-pack run repo/security-pattern-scan scan src .github/workflows --json',
+            'mf script-pack run repo/security-pattern-scan scan src/server.ts --max-findings 50 --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'securityPatternScan.help.exit.ok') },
+            { label: '1', description: t(lang, 'securityPatternScan.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseSecurityPatternScanOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, SECURITY_PATTERN_SCAN_OPTIONS, { allowPositionals: true });
+    const json = hasParsedCliOption(parsed, '--json');
+    const maxFiles = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-files'), '--max-files', lang);
+    const maxFileBytes = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-file-bytes'), '--max-file-bytes', lang);
+    const maxFindings = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-findings'), '--max-findings', lang);
+    if (action !== 'scan') {
+        return {
+            action: 'scan',
+            json,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxFileBytes: maxFileBytes.value,
+            maxFindings: maxFindings.value,
+            error: action
+                ? t(lang, 'securityPatternScan.error.unknownAction', { action })
+                : t(lang, 'securityPatternScan.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return {
+            action,
+            json,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxFileBytes: maxFileBytes.value,
+            maxFindings: maxFindings.value,
+            error: formatCliOptionParseError(parsed.error, lang),
+        };
+    }
+    for (const candidate of [maxFiles, maxFileBytes, maxFindings]) {
+        if (candidate.error) {
+            return {
+                action,
+                json,
+                paths: parsed.positionals,
+                maxFiles: maxFiles.value,
+                maxFileBytes: maxFileBytes.value,
+                maxFindings: maxFindings.value,
+                error: candidate.error,
+            };
+        }
+    }
+    return {
+        action,
+        json,
+        paths: parsed.positionals,
+        maxFiles: maxFiles.value,
+        maxFileBytes: maxFileBytes.value,
+        maxFindings: maxFindings.value,
+    };
+}
+function renderSecurityPatternScanSummary(report, lang) {
+    const lines = [
+        t(lang, 'securityPatternScan.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${SECURITY_PATTERN_SCAN_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'securityPatternScan.label.files')}: ${report.summary.file_count}`,
+        `${t(lang, 'securityPatternScan.label.findings')}: ${report.summary.finding_count}`,
+        `${t(lang, 'securityPatternScan.label.categories')}: ${report.summary.category_count}`,
+        `${t(lang, 'securityPatternScan.label.highOrCritical')}: ${report.summary.high_or_critical_count}`,
+        `${t(lang, 'securityPatternScan.label.truncated')}: ${report.truncated ? t(lang, 'value.yes') : t(lang, 'value.no')}`,
+    ];
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'securityPatternScan.label.findings'));
+        for (const finding of report.findings.slice(0, 40)) {
+            const line = finding.line ? `:${finding.line}` : '';
+            const detector = finding.detector ? ` ${finding.detector}` : '';
+            const focus = finding.review_focus ? ` ${t(lang, 'securityPatternScan.label.reviewFocus')}: ${finding.review_focus}` : '';
+            lines.push(`- ${finding.path}${line}: ${finding.code}${detector} (${finding.message})${focus}`);
+        }
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'securityPatternScan.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    if (report.findings.length === 0 && report.issues.length === 0) {
+        lines.push(t(lang, 'securityPatternScan.clean'));
+    }
+    return lines.join('\n');
+}
+export function runRepoSecurityPatternScanScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getRepoSecurityPatternScanHelp(lang));
+        return 0;
+    }
+    const options = parseSecurityPatternScanOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run repo/security-pattern-scan --help', getRepoSecurityPatternScanHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectSecurityPatternScan(resolveMustflowRoot(), {
+        paths: options.paths,
+        maxFiles: options.maxFiles ?? undefined,
+        maxFileBytes: options.maxFileBytes ?? undefined,
+        maxFindings: options.maxFindings ?? undefined,
+    });
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderSecurityPatternScanSummary(report, lang));
+    return report.ok ? 0 : 1;
+}

package/dist/core/change-impact.js

@@ -195,6 +195,13 @@ function addDependencyImpacts(root, changedFiles, impacts, policy, findings, iss
             issues.push(`dependency-graph: ${issue}`);
         }
     }
+    for (const dependencyFinding of dependencyReport.findings) {
+        const mappedFinding = mapDependencyGraphTruncationFinding(dependencyFinding);
+        if (mappedFinding === null) {
+            continue;
+        }
+        findings.push(mappedFinding);
+    }
     const changedPathSet = new Set(sourcePaths);
     for (const edge of dependencyReport.edges) {
         if (!changedPathSet.has(edge.target_path) || changedPathSet.has(edge.source_path)) {
@@ -209,6 +216,15 @@ function addDependencyImpacts(root, changedFiles, impacts, policy, findings, iss
         }, policy, findings, issues);
     }
 }
+function mapDependencyGraphTruncationFinding(finding) {
+    if (finding.code === 'dependency_graph_max_files_exceeded') {
+        return makeFinding('change_impact_max_files_exceeded', 'high', finding.path, `Dependency graph input was truncated while computing change impact: ${finding.message}`);
+    }
+    if (finding.code === 'dependency_graph_max_nodes_exceeded' || finding.code === 'dependency_graph_max_edges_exceeded') {
+        return makeFinding('change_impact_max_impacts_exceeded', 'high', finding.path, `Dependency graph impact expansion was truncated while computing change impact: ${finding.message}`);
+    }
+    return null;
+}
 function createScriptHints(changedFiles) {
     const sourcePaths = changedFiles.filter((file) => file.surface === 'source').map((file) => file.path);
     const selectorRelevantFiles = changedFiles.filter((file) => ['source', 'test', 'schema', 'config', 'package', 'template', 'workflow', 'unknown'].includes(file.surface));

package/dist/core/code-outline.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 import { listSourceAnchorFiles, parseSourceAnchorsInContent, sourceAnchorTextContainsSecretLike, splitSourceAnchorList, } from './source-anchors.js';
 export const CODE_PACK_ID = 'code';
@@ -19,17 +20,7 @@ const SVELTE_EXTENSIONS = ['.svelte'];
 const GO_EXTENSIONS = ['.go'];
 const RUST_EXTENSIONS = ['.rs'];
 const PYTHON_EXTENSIONS = ['.py'];
-const IGNORED_DIRECTORIES = [
-    '.git',
-    '.mustflow/cache',
-    '.mustflow/state',
-    'node_modules',
-    'dist',
-    'build',
-    'coverage',
-    '.next',
-    '.turbo',
-];
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_OUTLINE_CODES = new Set([
     'code_outline_path_outside_root',
     'code_outline_unreadable_path',
@@ -97,8 +88,7 @@ export function languageForPath(filePath) {
     return languageAdapterForPath(filePath)?.languageForPath(filePath) ?? null;
 }
 function isIgnoredDirectory(relativePath) {
-    const normalized = normalizeRelativePath(relativePath);
-    return IGNORED_DIRECTORIES.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`));
+    return isIgnoredDirectoryPath(normalizeRelativePath(relativePath), IGNORED_DIRECTORIES);
 }
 function makeOutlineFinding(code, severity, pathValue, message) {
     return { code, severity, path: pathValue, message };

package/dist/core/command-env.js

@@ -1,4 +1,4 @@
-import { existsSync } from 'node:fs';
+import { existsSync, realpathSync } from 'node:fs';
 import path from 'node:path';
 import { readString, readStringArray } from './config-loading.js';
 export const COMMAND_ENV_POLICIES = new Set(['inherit', 'minimal', 'allowlist']);
@@ -31,12 +31,30 @@ export const DEFAULT_PROJECT_LOCAL_BIN_BARE_EXECUTABLE_ALLOWLIST = new Set(['mf'
 function getPathEnvKey(env) {
     return Object.keys(env).find((key) => key.toLowerCase() === 'path') ?? 'PATH';
 }
-function sameResolvedPath(left, right) {
-    const resolvedLeft = path.resolve(left);
-    const resolvedRight = path.resolve(right);
-    return process.platform === 'win32'
-        ? resolvedLeft.toLowerCase() === resolvedRight.toLowerCase()
-        : resolvedLeft === resolvedRight;
+function normalizePathForComparison(value) {
+    const resolved = path.resolve(value);
+    if (!existsSync(resolved)) {
+        return resolved;
+    }
+    try {
+        return realpathSync.native(resolved);
+    }
+    catch {
+        return resolved;
+    }
+}
+function pathsEqual(left, right) {
+    return process.platform === 'win32' ? left.toLowerCase() === right.toLowerCase() : left === right;
+}
+function pathEntryCandidates(entry, projectRoot) {
+    if (path.isAbsolute(entry)) {
+        return [entry];
+    }
+    return [path.resolve(projectRoot, entry), path.resolve(entry)];
+}
+function sameResolvedPath(left, right, projectRoot) {
+    const resolvedRight = normalizePathForComparison(right);
+    return pathEntryCandidates(left, projectRoot).some((candidate) => pathsEqual(normalizePathForComparison(candidate), resolvedRight));
 }
 function uniqueEnvNames(values) {
     return [...new Set(values.map((value) => value.trim()).filter((value) => value.length > 0))].sort((left, right) => left.localeCompare(right));
@@ -112,7 +130,7 @@ function removeProjectLocalBinFromPath(env, projectRoot) {
         ...env,
         [pathKey]: currentPath
             .split(path.delimiter)
-            .filter((entry) => entry.length > 0 && !sameResolvedPath(entry, localBinPath))
+            .filter((entry) => entry.length > 0 && !sameResolvedPath(entry, localBinPath, projectRoot))
             .join(path.delimiter),
     };
 }

package/dist/core/config-chain.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 export const CONFIG_CHAIN_PACK_ID = 'repo';
 export const CONFIG_CHAIN_SCRIPT_ID = 'config-chain';
@@ -37,17 +38,7 @@ const CONFIG_FILE_NAMES = [
     '.mustflow/config/commands.toml',
     '.mustflow/config/mustflow.toml',
 ];
-const IGNORED_DIRECTORIES = [
-    '.git',
-    '.mustflow/cache',
-    '.mustflow/state',
-    'node_modules',
-    'dist',
-    'build',
-    'coverage',
-    '.next',
-    '.turbo',
-];
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_CODES = new Set([
     'config_chain_path_outside_root',
     'config_chain_unreadable_path',
@@ -133,8 +124,7 @@ function isConfigFile(relativePath) {
         /^tsconfig(?:\..*)?\.json$/u.test(name));
 }
 function isIgnoredDirectory(relativePath) {
-    const normalized = normalizeRelativePath(relativePath);
-    return IGNORED_DIRECTORIES.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`));
+    return isIgnoredDirectoryPath(normalizeRelativePath(relativePath), IGNORED_DIRECTORIES);
 }
 function normalizeTargetPath(projectRoot, targetPath) {
     const absolutePath = path.resolve(process.cwd(), targetPath);

package/dist/core/dependency-graph.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 export const DEPENDENCY_GRAPH_PACK_ID = 'code';
 export const DEPENDENCY_GRAPH_SCRIPT_ID = 'dependency-graph';
@@ -14,17 +15,7 @@ const MAX_ISSUES = 50;
 const MAX_CYCLES = 20;
 const SOURCE_EXTENSIONS = ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs'];
 const RESOLVE_EXTENSIONS = [...SOURCE_EXTENSIONS, '.json'];
-const IGNORED_DIRECTORIES = [
-    '.git',
-    '.mustflow/cache',
-    '.mustflow/state',
-    'node_modules',
-    'dist',
-    'build',
-    'coverage',
-    '.next',
-    '.turbo',
-];
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_CODES = new Set([
     'dependency_graph_path_outside_root',
     'dependency_graph_unreadable_path',
@@ -64,8 +55,7 @@ function isSourceLanguage(language) {
     return language !== 'json' && language !== 'other';
 }
 function isIgnoredDirectory(relativePath) {
-    const normalized = normalizeRelativePath(relativePath);
-    return IGNORED_DIRECTORIES.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`));
+    return isIgnoredDirectoryPath(normalizeRelativePath(relativePath), IGNORED_DIRECTORIES);
 }
 function makeFinding(code, severity, pathValue, message) {
     return { code, severity, path: pathValue, message };

package/dist/core/docs-link-integrity.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 export const LINK_INTEGRITY_PACK_ID = 'docs';
 export const LINK_INTEGRITY_SCRIPT_ID = 'link-integrity';
@@ -11,7 +12,7 @@ const MAX_ISSUES = 50;
 const DEFAULT_PATHS = ['README.md', 'schemas/README.md', 'docs-site/src/content/docs'];
 const PATH_FILTERS = ['*.md', '*.mdx'];
 const CHECKED_LINK_KINDS = ['local_file', 'local_anchor'];
-const IGNORED_DIRECTORIES = new Set(['.git', 'node_modules', 'dist', 'build', 'coverage', '.astro']);
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_CODES = new Set([
     'link_integrity_path_outside_root',
     'link_integrity_unreadable_path',
@@ -59,7 +60,7 @@ function addCandidate(candidates, findings, issues, policy, candidate) {
 }
 function collectDocumentsFromDirectory(projectRoot, absoluteDirectory, candidates, findings, issues, policy) {
     const relativeDirectory = normalizeRelativePath(path.relative(projectRoot, absoluteDirectory));
-    if (IGNORED_DIRECTORIES.has(path.basename(relativeDirectory)) || [...IGNORED_DIRECTORIES].some((entry) => relativeDirectory.startsWith(`${entry}/`))) {
+    if (isIgnoredDirectoryPath(relativeDirectory, IGNORED_DIRECTORIES)) {
         return;
     }
     let entries;
@@ -173,9 +174,26 @@ function splitTarget(target) {
     const anchor = rawAnchor === undefined ? null : decodeUriComponentSafe(rawAnchor);
     return { pathPart, anchor };
 }
+function stripHtmlTagText(value) {
+    let result = '';
+    let tagDepth = 0;
+    for (const char of value) {
+        if (char === '<') {
+            tagDepth += 1;
+            continue;
+        }
+        if (char === '>') {
+            tagDepth = Math.max(0, tagDepth - 1);
+            continue;
+        }
+        if (tagDepth === 0) {
+            result += char;
+        }
+    }
+    return result;
+}
 function slugHeading(value) {
-    return value
-        .replace(/<[^>]+>/gu, '')
+    return stripHtmlTagText(value)
         .replace(/[`*_~]/gu, '')
         .replace(/\[([^\]]+)\]\([^)]+\)/gu, '$1')
         .toLocaleLowerCase()
@@ -369,6 +387,7 @@ export function checkLinkIntegrity(projectRoot, options) {
         max_file_bytes: options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES,
         default_paths: [...DEFAULT_PATHS],
         path_filters: [...PATH_FILTERS],
+        ignored_directories: [...IGNORED_DIRECTORIES],
         checked_link_kinds: [...CHECKED_LINK_KINDS],
     };
     const findings = [];

package/dist/core/env-contract.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 export const ENV_CONTRACT_PACK_ID = 'repo';
 export const ENV_CONTRACT_SCRIPT_ID = 'env-contract';
@@ -36,17 +37,7 @@ const ENV_EXAMPLE_NAMES = [
     '.dev.vars.example',
 ];
 const SECRET_ENV_NAMES = ['.env', '.env.local', '.env.production', '.env.development', '.dev.vars'];
-const IGNORED_DIRECTORIES = [
-    '.git',
-    '.mustflow/cache',
-    '.mustflow/state',
-    'node_modules',
-    'dist',
-    'build',
-    'coverage',
-    '.next',
-    '.turbo',
-];
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_CODES = new Set([
     'env_contract_path_outside_root',
     'env_contract_unreadable_path',
@@ -66,8 +57,7 @@ function pushIssue(issues, issue) {
     }
 }
 function isIgnoredDirectory(relativePath) {
-    const normalized = normalizeRelativePath(relativePath);
-    return IGNORED_DIRECTORIES.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`));
+    return isIgnoredDirectoryPath(normalizeRelativePath(relativePath), IGNORED_DIRECTORIES);
 }
 function isEnvExampleFile(relativePath) {
     const name = path.basename(relativePath).toLowerCase();

package/dist/core/export-diff.js

@@ -3,6 +3,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import { extractSymbols, languageForPath } from './code-outline.js';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 export const CODE_EXPORT_DIFF_SCRIPT_ID = 'export-diff';
 export const CODE_EXPORT_DIFF_SCRIPT_REF = `code/${CODE_EXPORT_DIFF_SCRIPT_ID}`;
@@ -10,7 +11,7 @@ const DEFAULT_BASE_REF = 'HEAD';
 const DEFAULT_MAX_FILES = 100;
 const DEFAULT_MAX_FILE_BYTES = 1024 * 1024;
 const SUPPORTED_EXTENSIONS = ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs'];
-const IGNORED_DIRECTORIES = ['.git', 'node_modules', 'dist', 'build', 'coverage', '.mustflow/cache', '.mustflow/state'];
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_CODES = new Set([
     'export_diff_git_unavailable',
     'export_diff_invalid_ref',
@@ -46,8 +47,7 @@ function makeFinding(code, severity, pathValue, message) {
     return { code, severity, path: pathValue, message };
 }
 function isIgnoredPath(relativePath) {
-    const normalized = normalizeRelativePath(relativePath);
-    return IGNORED_DIRECTORIES.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`));
+    return isIgnoredDirectoryPath(normalizeRelativePath(relativePath), IGNORED_DIRECTORIES);
 }
 function isSupportedPath(relativePath) {
     return SUPPORTED_EXTENSIONS.includes(path.extname(relativePath).toLowerCase());