mustflow 2.107.9 → 2.108.2

package/dist/cli/commands/api/serve.js

@@ -1,10 +1,10 @@
-import { createInterface } from 'node:readline';
 import { apiReportActionSpec, isApiReportAction } from './actions.js';
 import { printUsageError } from '../../lib/cli-output.js';
 import { formatCliOptionParseError, hasParsedCliOption, parseCliOptions, } from '../../lib/option-parser.js';
 import { isRecord } from '../../lib/command-contract.js';
 import { t } from '../../lib/i18n.js';
 const API_SERVE_SCHEMA_VERSION = '1';
+const API_SERVE_MAX_LINE_CHARS = 1024 * 1024;
 const API_SERVE_OPTIONS = [
     { name: '--stdio', kind: 'boolean' },
     { name: '--help', kind: 'boolean', aliases: ['-h'] },
@@ -53,6 +53,15 @@ function readApiServeId(request) {
     }
     return null;
 }
+function readApiServeChanged(request, id) {
+    if (!Object.hasOwn(request, 'changed')) {
+        return undefined;
+    }
+    if (typeof request.changed === 'boolean') {
+        return request.changed;
+    }
+    return createApiServeError(id, 'invalid_request', 'Request field "changed" must be a boolean when provided.');
+}
 function parseApiServeRequestLine(line) {
     let parsed;
     try {
@@ -72,11 +81,18 @@ function parseApiServeRequestLine(line) {
             error: createApiServeError(id, 'invalid_request', 'Request must be a JSON object.'),
         };
     }
+    const changed = readApiServeChanged(parsed, id);
+    if (typeof changed !== 'boolean' && changed !== undefined) {
+        return {
+            request: null,
+            error: changed,
+        };
+    }
     return {
         request: {
             id,
             action: parsed.action,
-            changed: parsed.changed,
+            changed,
         },
         error: null,
     };
@@ -99,8 +115,8 @@ function createApiServeResponse(request, runtime) {
     try {
         return createApiServeSuccess(id, runtime.createReport(request.action));
     }
-    catch (error) {
-        return createApiServeError(id, 'report_unavailable', error instanceof Error ? error.message : String(error));
+    catch {
+        return createApiServeError(id, 'report_unavailable', 'Report is unavailable for this action.');
     }
 }
 function writeApiServeResponse(response, reporter) {
@@ -111,6 +127,53 @@ function writeApiServeResponse(response, reporter) {
     }
     reporter.stdout(line.trimEnd());
 }
+async function* readApiServeInputLines(input) {
+    input.setEncoding('utf8');
+    let buffer = '';
+    let discardingOversizedLine = false;
+    for await (const chunk of input) {
+        const text = typeof chunk === 'string' ? chunk : String(chunk);
+        let start = 0;
+        while (start < text.length) {
+            const newlineIndex = text.indexOf('\n', start);
+            const segmentEnd = newlineIndex === -1 ? text.length : newlineIndex;
+            const segment = text.slice(start, segmentEnd);
+            if (discardingOversizedLine) {
+                if (newlineIndex !== -1) {
+                    yield { oversized: true };
+                    discardingOversizedLine = false;
+                }
+            }
+            else if (buffer.length + segment.length > API_SERVE_MAX_LINE_CHARS) {
+                buffer = '';
+                if (newlineIndex === -1) {
+                    discardingOversizedLine = true;
+                }
+                else {
+                    yield { oversized: true };
+                }
+            }
+            else {
+                buffer += segment;
+                if (newlineIndex !== -1) {
+                    yield { line: buffer.endsWith('\r') ? buffer.slice(0, -1) : buffer };
+                    buffer = '';
+                }
+            }
+            if (newlineIndex === -1) {
+                break;
+            }
+            start = newlineIndex + 1;
+        }
+    }
+    if (discardingOversizedLine) {
+        yield { oversized: true };
+        return;
+    }
+    if (buffer.length > 0) {
+        yield { line: buffer.endsWith('\r') ? buffer.slice(0, -1) : buffer };
+    }
+}
 export async function runApiServe(args, reporter, lang, runtime) {
     const parsed = parseCliOptions(args, API_SERVE_OPTIONS);
     if (hasParsedCliOption(parsed, '--help')) {
@@ -125,12 +188,12 @@ export async function runApiServe(args, reporter, lang, runtime) {
         printUsageError(reporter, t(lang, 'api.error.serveRequiresStdio'), 'mf api --help', runtime.getHelp(lang), lang);
         return 1;
     }
-    const input = createInterface({
-        input: process.stdin,
-        crlfDelay: Infinity,
-    });
-    for await (const rawLine of input) {
-        const line = rawLine.trim();
+    for await (const inputLine of readApiServeInputLines(process.stdin)) {
+        if (inputLine.oversized) {
+            writeApiServeResponse(createApiServeError(null, 'request_too_large', `Request line exceeds ${API_SERVE_MAX_LINE_CHARS} characters.`), reporter);
+            continue;
+        }
+        const line = inputLine.line?.trim() ?? '';
         if (line.length === 0) {
             continue;
         }

package/dist/core/run-receipt-state.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { ensureInside, writeJsonFileInsideWithoutSymlinks } from './safe-filesystem.js';
 const RUN_RECEIPT_SCHEMA_VERSION = '1';
 const RUN_RECEIPT_DIR = path.join('.mustflow', 'state', 'runs');
+const RUN_RECEIPT_DIR_POSIX = '.mustflow/state/runs';
 const LATEST_RUN_RECEIPT_INDEX = 'latest.index.json';
 const STATE_DIR_PREFIXES = ['run-', 'verify-'];
 const MIN_RETAINED_RUN_DIRS = 1;
@@ -131,6 +132,24 @@ function stringField(value) {
 function stringArrayField(value) {
     return Array.isArray(value) && value.every((entry) => typeof entry === 'string') ? value : undefined;
 }
+function resolveReceiptPathInsideRunsDir(runsDir, receiptPath) {
+    if (path.isAbsolute(receiptPath)) {
+        return null;
+    }
+    const normalizedReceiptPath = receiptPath.replace(/\\/gu, '/');
+    const runsPrefix = `${RUN_RECEIPT_DIR_POSIX}/`;
+    if (!normalizedReceiptPath.startsWith(runsPrefix)) {
+        return null;
+    }
+    const relativeToRunsDir = normalizedReceiptPath.slice(runsPrefix.length);
+    const parts = relativeToRunsDir.split('/');
+    if (parts.length === 0 || parts.some((part) => part.length === 0 || part === '.' || part === '..')) {
+        return null;
+    }
+    const receiptAbsolutePath = path.resolve(runsDir, ...parts);
+    ensureInside(runsDir, receiptAbsolutePath);
+    return receiptAbsolutePath;
+}
 function createRunEntry(directory) {
     const receipt = readJsonObject(path.join(directory.absolutePath, 'receipt.json'));
     if (!receipt || receipt.command !== 'run' || typeof receipt.receipt_path !== 'string') {
@@ -154,8 +173,10 @@ function readVerifyIntentEntry(directory, manifest, manifestPath, manifestReceip
         return null;
     }
     const runsDir = path.dirname(directory.absolutePath);
-    const receiptAbsolutePath = path.resolve(runsDir, ...receiptPath.split('/').slice(3));
-    ensureInside(runsDir, receiptAbsolutePath);
+    const receiptAbsolutePath = resolveReceiptPathInsideRunsDir(runsDir, receiptPath);
+    if (!receiptAbsolutePath) {
+        return null;
+    }
     const receipt = readJsonObject(receiptAbsolutePath);
     return {
         command: 'verify',

package/dist/core/secret-redaction.js

@@ -8,9 +8,14 @@ const SECRET_REDACTION_RULES = [
     },
     {
         kind: 'secret_token',
-        pattern: /\b(?:sk-[A-Za-z0-9]{16,}|ghp_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|AKIA[0-9A-Z]{16})\b/gu,
+        pattern: /\b(?:sk-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|AKIA[0-9A-Z]{16})\b/gu,
         replace: () => REDACTED_SECRET_MARKER,
     },
+    {
+        kind: 'secret_bearer_token',
+        pattern: /\b(Bearer\s+)([A-Za-z0-9._~+/=-]{24,})\b/gu,
+        replace: (_match, prefix) => `${prefix}${REDACTED_SECRET_MARKER}`,
+    },
 ];
 export const SECRET_LIKE_PATTERNS = SECRET_REDACTION_RULES.map((rule) => {
     const flags = rule.pattern.flags.replace('g', '');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-  "version": "2.107.9",
+  "version": "2.108.2",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",

package/schemas/api-serve-response.schema.json

@@ -56,6 +56,7 @@
           "enum": [
             "invalid_json",
             "invalid_request",
+            "request_too_large",
             "unknown_action",
             "action_requires_changed",
             "action_does_not_accept_changed",

package/templates/default/i18n.toml

@@ -40,7 +40,7 @@ translations.hi = { path = "locales/hi/.mustflow/context/PROJECT.md", source_rev
 [documents."docs.agent-workflow"]
 source = "locales/en/.mustflow/docs/agent-workflow.md"
 source_locale = "en"
-revision = 27
+revision = 28
 translations.ko = { path = "locales/ko/.mustflow/docs/agent-workflow.md", source_revision = 23, status = "needs_review" }
 translations.zh = { path = "locales/zh/.mustflow/docs/agent-workflow.md", source_revision = 18, status = "needs_review" }
 translations.es = { path = "locales/es/.mustflow/docs/agent-workflow.md", source_revision = 18, status = "needs_review" }
@@ -62,7 +62,7 @@ translations = {}
 [documents."skills.index"]
 source = "locales/en/.mustflow/skills/INDEX.md"
 source_locale = "en"
-revision = 200
+revision = 207
 translations = {}
 
 [documents."skill.adapter-boundary"]
@@ -152,7 +152,7 @@ translations = {}
 [documents."skill.payment-integrity-review"]
 source = "locales/en/.mustflow/skills/payment-integrity-review/SKILL.md"
 source_locale = "en"
-revision = 3
+revision = 4
 translations = {}
 
 [documents."skill.credit-ledger-integrity-review"]
@@ -161,6 +161,24 @@ source_locale = "en"
 revision = 1
 translations = {}
 
+[documents."skill.notification-delivery-integrity-review"]
+source = "locales/en/.mustflow/skills/notification-delivery-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.admin-control-plane-safety-review"]
+source = "locales/en/.mustflow/skills/admin-control-plane-safety-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.small-service-platform-architecture-review"]
+source = "locales/en/.mustflow/skills/small-service-platform-architecture-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
 [documents."skill.api-misuse-resistance-review"]
 source = "locales/en/.mustflow/skills/api-misuse-resistance-review/SKILL.md"
 source_locale = "en"
@@ -224,7 +242,7 @@ translations = {}
 [documents."skill.ci-pipeline-triage"]
 source = "locales/en/.mustflow/skills/ci-pipeline-triage/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.auth-flow-triage"]
@@ -323,10 +341,16 @@ source_locale = "en"
 revision = 1
 translations = {}
 
+[documents."skill.frontend-component-library-review"]
+source = "locales/en/.mustflow/skills/frontend-component-library-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
 [documents."skill.frontend-localization-review"]
 source = "locales/en/.mustflow/skills/frontend-localization-review/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.website-task-friction-review"]
@@ -398,13 +422,13 @@ translations = {}
 [documents."skill.deployment-rollout-safety-review"]
 source = "locales/en/.mustflow/skills/deployment-rollout-safety-review/SKILL.md"
 source_locale = "en"
-revision = 2
+revision = 3
 translations = {}
 
 [documents."skill.cloud-cost-guardrail-review"]
 source = "locales/en/.mustflow/skills/cloud-cost-guardrail-review/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.rate-limit-integrity-review"]
@@ -464,13 +488,13 @@ translations = {}
 [documents."skill.database-change-safety"]
 source = "locales/en/.mustflow/skills/database-change-safety/SKILL.md"
 source_locale = "en"
-revision = 16
+revision = 17
 translations = {}
 
 [documents."skill.database-migration-change"]
 source = "locales/en/.mustflow/skills/database-migration-change/SKILL.md"
 source_locale = "en"
-revision = 3
+revision = 4
 translations = {}
 
 [documents."skill.database-query-bottleneck-review"]
@@ -619,7 +643,7 @@ translations = {}
 [documents."skill.auth-permission-change"]
 source = "locales/en/.mustflow/skills/auth-permission-change/SKILL.md"
 source_locale = "en"
-revision = 3
+revision = 4
 translations = {}
 
 [documents."skill.security-flow-review"]
@@ -799,13 +823,13 @@ translations = {}
 [documents."skill.tauri-code-change"]
 source = "locales/en/.mustflow/skills/tauri-code-change/SKILL.md"
 source_locale = "en"
-revision = 3
+revision = 4
 translations = {}
 
 [documents."skill.wails-code-change"]
 source = "locales/en/.mustflow/skills/wails-code-change/SKILL.md"
 source_locale = "en"
-revision = 1
+revision = 2
 translations = {}
 
 [documents."skill.typescript-code-change"]
@@ -1167,6 +1191,12 @@ source_locale = "en"
 revision = 2
 translations = {}
 
+[documents."skill.ai-product-readiness-review"]
+source = "locales/en/.mustflow/skills/ai-product-readiness-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
 [documents."skill.prompt-contract-quality-review"]
 source = "locales/en/.mustflow/skills/prompt-contract-quality-review/SKILL.md"
 source_locale = "en"
@@ -1197,6 +1227,12 @@ source_locale = "en"
 revision = 1
 translations = {}
 
+[documents."skill.browser-automation-reliability-review"]
+source = "locales/en/.mustflow/skills/browser-automation-reliability-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
 [documents."skill.agent-eval-integrity-review"]
 source = "locales/en/.mustflow/skills/agent-eval-integrity-review/SKILL.md"
 source_locale = "en"

package/templates/default/locales/en/.mustflow/docs/agent-workflow.md

@@ -2,7 +2,7 @@
 mustflow_doc: docs.agent-workflow
 locale: en
 canonical: true
-revision: 27
+revision: 28
 lifecycle: mustflow-owned
 authority: workflow-policy
 ---
@@ -68,6 +68,29 @@ When multiple skills apply, follow the most specific skill for each affected sco
 
 When a skill is used, report the skill name and selection reason briefly in the next user-facing update or final report. When files were created or modified, the final report must include a concise skill-selection note: list the skills used, say that no matching installed skill was found, or report that a plausible skill is missing from the installed profile. Do not create a versioned worklog solely to record skill selection.
 
+### Script-Pack Selection
+
+Script-pack suggestions are optional evidence helpers, not skill procedures or command authority.
+Skills remain the primary procedure owner: select and read the matching `SKILL.md` first, then use
+script-pack metadata only to decide whether a bounded helper would improve orientation,
+synchronization, or review evidence.
+
+When the command contract exposes `script_pack_list`, use it for catalog discovery only. When the
+command contract exposes `script_pack_suggest_changed`, use it after changed files exist to get
+optional helper suggestions from current path evidence. These discovery commands do not run helper
+scripts, authorize new commands, or replace the skill-selection gate.
+
+Prefer helper candidates whose `related_skills` include the selected skill, whose `phases` match the
+current phase (`before_change`, `during_change`, `after_change`, or `review`), and whose `use_when`
+matches the changed paths and risk. Discard a candidate when `read_only` is false, `mutates` is true,
+network, destructive, interactive, or long-running behavior appears, required inputs are unavailable,
+the phase does not match, or no configured oneshot command intent authorizes that exact action.
+
+Script-pack output can focus what to inspect, but it does not replace reading `SKILL.md`, relevant
+source files, configured verification intents, documentation review requirements, or final completion
+evidence. Suggested helpers are not mandatory. Report skipped useful suggestions only when they were
+relevant to the current risk but not run.
+
 ## Input Stability
 
 Treat user instructions, local files, command contracts, and generated reports as distinct sources. Avoid conflating these sources.