mustflow 2.107.0 → 2.107.3

package/README.md

@@ -369,6 +369,9 @@ commands when a repository uses another runner or has a faster related-test entr
 - `lifecycle = "oneshot"`
 - `run_policy = "agent_allowed"`
 - `stdin = "closed"`
+- `timeout_seconds` is a positive integer
+- a command is declared with `argv`, or with `mode = "shell"` plus `cmd` and `allow_shell = true`
+- `cwd` resolves inside the current mustflow root
 
 Development servers, watch modes, browser UIs, interactive commands, and background processes do not run directly. `mf run` also rejects obvious long-running `argv` shapes, such as shell-wrapper background payloads, interpreter loops, package-manager development scripts, watchers, and development servers declared as one-shot commands. If a bounded one-shot command has a name that matches a common long-running pattern, the intent can explicitly acknowledge that with `allow_long_running_command_patterns = true`; background shell patterns remain blocked.
 
@@ -468,6 +471,7 @@ mf run docs_validate_fast
 mf run docs_validate
 mf run mustflow_check
 mf run release_npm_version_available
+mf run release_npm_publish
 mf run release_npm_published_verify
 ```
 
@@ -481,7 +485,7 @@ Run the full release check before publishing:
 bun run release:check
 ```
 
-`release:check` validates the CLI, builds the documentation site, packs the npm tarball, installs it into a temporary project, and runs the public `mf` workflow. Maintainer npm publishing uses the `Publish npm package` GitHub Actions workflow from a published GitHub Release. The release tag must match the `package.json` version, with an optional leading `v`. Run `mf run release_npm_version_available` before creating the tag and `mf run release_npm_published_verify` after the publish workflow completes. npm Trusted Publishing must be configured for the workflow before maintainers publish through it.
+`release:check` validates the CLI, builds the documentation site, packs the npm tarball, installs it into a temporary project, and runs the public `mf` workflow. Maintainer npm publishing uses the `Publish npm package` GitHub Actions workflow from a release tag. The release tag must match the `package.json` version, with an optional leading `v`. Run `mf run release_npm_version_available` before creating the tag, `mf run release_npm_publish` to push the release tag that triggers trusted publishing and GitHub Release creation, and `mf run release_npm_published_verify` after the publish workflow completes. npm Trusted Publishing must be configured for the workflow before maintainers publish through it.
 
 ## Documentation site
 

package/dist/cli/lib/local-index/source-index.js

@@ -78,8 +78,18 @@ function hashIndexedFileMetadataRecord(projectRoot, metadata) {
         contentHash: sha256Bytes(readFileSync(path.join(projectRoot, ...metadata.path.split('/')))),
     };
 }
+function tryHashIndexedFileMetadataRecord(projectRoot, metadata) {
+    try {
+        return hashIndexedFileMetadataRecord(projectRoot, metadata);
+    }
+    catch {
+        return null;
+    }
+}
 export function hashIndexedFileMetadataRecords(projectRoot, metadataRecords) {
-    return metadataRecords.map((metadata) => hashIndexedFileMetadataRecord(projectRoot, metadata));
+    return metadataRecords
+        .map((metadata) => tryHashIndexedFileMetadataRecord(projectRoot, metadata))
+        .filter((record) => Boolean(record));
 }
 export function readIndexedFileMetadataRecord(projectRoot, relativePath, sourceScope) {
     const fullPath = path.join(projectRoot, ...relativePath.split('/'));
@@ -91,6 +101,14 @@ export function readIndexedFileMetadataRecord(projectRoot, relativePath, sourceS
         mtimeMs: Math.round(stats.mtimeMs),
     };
 }
+function tryReadIndexedFileRecord(projectRoot, relativePath, sourceScope, contentHash = null) {
+    try {
+        return readIndexedFileRecord(projectRoot, relativePath, sourceScope, contentHash);
+    }
+    catch {
+        return null;
+    }
+}
 export function collectIndexedFileRecords(projectRoot, documents, sourceAnchors, sourceAnchorCandidatePaths = []) {
     const records = new Map();
     for (const document of documents) {
@@ -99,11 +117,17 @@ export function collectIndexedFileRecords(projectRoot, documents, sourceAnchors,
     const sourcePaths = new Set([...sourceAnchorCandidatePaths, ...sourceAnchors.map((anchor) => anchor.path)]);
     for (const anchorPath of [...sourcePaths].sort((left, right) => left.localeCompare(right))) {
         if (!records.has(anchorPath)) {
-            records.set(anchorPath, readIndexedFileRecord(projectRoot, anchorPath, 'source_anchor'));
+            const record = tryReadIndexedFileRecord(projectRoot, anchorPath, 'source_anchor');
+            if (record) {
+                records.set(anchorPath, record);
+            }
         }
     }
     if (existsSync(path.join(projectRoot, ...LATEST_RUN_STATE_RELATIVE_PATH.split('/')))) {
-        records.set(LATEST_RUN_STATE_RELATIVE_PATH, readIndexedFileRecord(projectRoot, LATEST_RUN_STATE_RELATIVE_PATH, 'state'));
+        const record = tryReadIndexedFileRecord(projectRoot, LATEST_RUN_STATE_RELATIVE_PATH, 'state');
+        if (record) {
+            records.set(LATEST_RUN_STATE_RELATIVE_PATH, record);
+        }
     }
     return [...records.values()].sort((left, right) => left.path.localeCompare(right.path));
 }

package/dist/core/source-anchor-status.js

@@ -217,10 +217,16 @@ export function collectSourceAnchorIndexRecords(projectRoot, previousSnapshots =
     const currentRecords = [];
     for (const relativePath of listSourceAnchorFiles(projectRoot, fileOptions)) {
         const filePath = path.join(projectRoot, ...relativePath.split('/'));
-        if (!existsSync(filePath) || !statSync(filePath).isFile()) {
+        let content;
+        try {
+            if (!existsSync(filePath) || !statSync(filePath).isFile()) {
+                continue;
+            }
+            content = readFileSync(filePath, 'utf8');
+        }
+        catch {
             continue;
         }
-        const content = readFileSync(filePath, 'utf8');
         for (const anchor of parseSourceAnchorsInContent(relativePath, content)) {
             if (!anchor.idValid || sourceAnchorTextContainsSecretLike(anchor.rawText)) {
                 continue;

package/dist/core/source-anchors.js

@@ -37,6 +37,7 @@ export const SOURCE_ANCHOR_DEFAULT_EXCLUDED_PATH_PARTS = new Set([
     'tmp',
     'vendor',
 ]);
+export const SOURCE_ANCHOR_DEFAULT_EXCLUDED_PATH_PREFIXES = ['.tmp-agent-', 'tmp-agent-'];
 export const SOURCE_ANCHOR_GENERATED_PATH_PARTS = new Set([
     '.astro',
     '.next',
@@ -111,6 +112,10 @@ function fileIsWithinSizeLimit(filePath, maxFileBytes) {
         return false;
     }
 }
+function sourceAnchorPathPartIsIgnored(part, ignoredDirectoryNames) {
+    return (ignoredDirectoryNames.has(part) ||
+        SOURCE_ANCHOR_DEFAULT_EXCLUDED_PATH_PREFIXES.some((prefix) => part.startsWith(prefix)));
+}
 function listFilesRecursive(root, options, current = root, depth = 0) {
     if (!existsSync(current)) {
         return [];
@@ -118,16 +123,29 @@ function listFilesRecursive(root, options, current = root, depth = 0) {
     if (depth > MAX_SOURCE_ANCHOR_DIRECTORY_DEPTH) {
         return [];
     }
-    const currentRealPath = realpathSync(current);
+    let currentRealPath;
+    try {
+        currentRealPath = realpathSync(current);
+    }
+    catch {
+        return [];
+    }
     if (!pathIsInsideRoot(options.rootRealPath, currentRealPath) || options.visitedRealDirectories.has(currentRealPath)) {
         return [];
     }
     options.visitedRealDirectories.add(currentRealPath);
     const files = [];
-    const entries = readdirSync(current, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
+    let entries;
+    try {
+        entries = readdirSync(current, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    entries.sort((left, right) => left.name.localeCompare(right.name));
     for (const entry of entries) {
         const entryPath = path.join(current, entry.name);
-        if (options.ignoredDirectoryNames.has(entry.name)) {
+        if (sourceAnchorPathPartIsIgnored(entry.name, options.ignoredDirectoryNames)) {
             continue;
         }
         if (entry.isDirectory()) {
@@ -296,7 +314,8 @@ export function sourceAnchorPathIsGeneratedOrVendor(relativePath) {
     if (normalized.endsWith('.min.js') || normalized.endsWith('.min.css')) {
         return true;
     }
-    return parts.some((part) => SOURCE_ANCHOR_GENERATED_PATH_PARTS.has(part));
+    return parts.some((part) => SOURCE_ANCHOR_GENERATED_PATH_PARTS.has(part) ||
+        SOURCE_ANCHOR_DEFAULT_EXCLUDED_PATH_PREFIXES.some((prefix) => part.startsWith(prefix)));
 }
 export function sourceAnchorTextContainsSecretLike(value) {
     return textContainsSecretLike(value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-  "version": "2.107.0",
+  "version": "2.107.3",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",

package/templates/default/i18n.toml

@@ -40,7 +40,7 @@ translations.hi = { path = "locales/hi/.mustflow/context/PROJECT.md", source_rev
 [documents."docs.agent-workflow"]
 source = "locales/en/.mustflow/docs/agent-workflow.md"
 source_locale = "en"
-revision = 25
+revision = 27
 translations.ko = { path = "locales/ko/.mustflow/docs/agent-workflow.md", source_revision = 23, status = "needs_review" }
 translations.zh = { path = "locales/zh/.mustflow/docs/agent-workflow.md", source_revision = 18, status = "needs_review" }
 translations.es = { path = "locales/es/.mustflow/docs/agent-workflow.md", source_revision = 18, status = "needs_review" }

package/templates/default/locales/en/.mustflow/docs/agent-workflow.md

@@ -2,7 +2,7 @@
 mustflow_doc: docs.agent-workflow
 locale: en
 canonical: true
-revision: 25
+revision: 27
 lifecycle: mustflow-owned
 authority: workflow-policy
 ---
@@ -233,12 +233,12 @@ A command intent is eligible for agent use only when all of these are true:
 - `run_policy = "agent_allowed"`
 - `stdin = "closed"`
 - `timeout_seconds` is a positive integer
-- A command is declared with `argv`, or with `mode = "shell"` and `cmd`
+- A command is declared with `argv`, or with `mode = "shell"`, `cmd`, and `allow_shell = true`
 - `cwd` remains inside the current mustflow root
 
 `manual_only` is a status for new configurations. `run_policy = "manual_only"` may be read for older configs, but new templates should use `status = "manual_only"` instead.
 
-Prefer `mf run <intent>` so the project receives a concise run record in `.mustflow/state/runs/latest.json`.
+Prefer `mf run <intent>` so the project receives a concise run record in `.mustflow/state/runs/latest.json` and a retained run index in `.mustflow/state/runs/latest.index.json`.
 
 Run `mf run` command intents serially. Do not start a second `mf run` while another configured intent is still running. Intents that declare non-empty `writes` are exclusive verification phases; wait for them to finish before running any other `mf run`. This is especially important when an intent rewrites package output such as `dist/`, because the local `mf` executable may load from that output.
 
@@ -268,6 +268,7 @@ Generated files should be refreshed by tools:
 - `REPO_MAP.md` through `mf map --write`
 - `.mustflow/cache/mustflow.sqlite` through `mf index`
 - `.mustflow/state/runs/latest.json` through `mf run <intent>`
+- `.mustflow/state/runs/latest.index.json` through `mf run <intent>`
 
 ## Verification
 

package/templates/default/manifest.toml

@@ -1,6 +1,6 @@
 id = "default"
 name = "default"
-version = "2.107.0"
+version = "2.107.3"
 description = "Minimal workflow for LLM agents to read, edit, and verify their work in a repository."
 common_root = "common"
 locales_root = "locales"