mustflow 2.22.4 → 2.22.9

package/dist/cli/i18n/es.js

@@ -583,6 +583,8 @@ Lee estos archivos antes de trabajar:
     "init.error.invalidPreference": "Anulación de preferencia de inicio no válida: {value}",
     "init.error.invalidPreferenceValue": "Valor no valido para {key}: {value}",
     "init.error.unsupportedPreference": "Ajuste de preferencia de inicio no admitido: {key}",
+    "init.error.promptInputTooLarge": "La entrada estándar de init interactivo es demasiado grande; se esperaban como máximo {maxBytes} bytes.",
+    "init.error.promptInputTooManyResponses": "La entrada estándar de init interactivo tiene demasiadas respuestas; se esperaban como máximo {maxResponses} líneas.",
     "init.prompt.locale": "¿Qué idioma deben usar los documentos mustflow?",
     "init.prompt.profile": "¿Qué perfil de proyecto debe usar mustflow?",
     "init.prompt.agentLang": "¿Qué idioma deben usar los agentes en los informes finales?",
@@ -650,6 +652,7 @@ Lee estos archivos antes de trabajar:
     "run.help.option.dryRun": "Imprime un plan de comando sin ejecutarlo",
     "run.help.option.planOnly": "Alias de --dry-run",
     "run.help.option.json": "Imprime el registro de ejecución o el plan de comando como JSON",
+    "run.help.option.allowUntrustedRoot": "Permite una ejecución desde una raíz con bloqueo de manifiesto ausente o inválido tras revisión manual",
     "run.help.exit.ok": "El comando se completo con un codigo de salida permitido",
     "run.help.exit.fail": "El comando no era válido, fue rechazado, agotó el tiempo o falló",
     "run.label.suggestedIntentSnippet": "Snippet sugerido para el contrato de comandos",
@@ -672,6 +675,8 @@ Lee estos archivos antes de trabajar:
     "run.error.maxOutputBytes": 'El comando "{intent}" tiene max_output_bytes no válido. {detail}',
     "run.error.maxOutputBytesDetail": "El límite de salida debe permanecer dentro del máximo permitido.",
     "run.error.conflictingPreviewModes": "Usa --dry-run o --plan-only, no ambos",
+    "run.error.untrustedRootMissing": "Se rechazó ejecutar comandos porque falta {path}. Ejecuta mf init/update para instalar el flujo, o usa --allow-untrusted-root tras revisar AGENTS.md y .mustflow/config/commands.toml.",
+    "run.error.untrustedRootInvalid": "Se rechazó ejecutar comandos porque el bloqueo de manifiesto no es válido: {detail}. Restáuralo o regenéralo, o usa --allow-untrusted-root tras revisar AGENTS.md y .mustflow/config/commands.toml.",
     "run.error.timedOut": 'El comando "{intent}" agotó el tiempo después de {seconds} segundos',
     "run.error.outputLimitExceeded": 'El comando "{intent}" superó max_output_bytes: {message}',
     "run.error.startFailed": 'No se pudo iniciar el comando "{intent}": {message}',

package/dist/cli/i18n/fr.js

@@ -583,6 +583,8 @@ Lisez ces fichiers avant de travailler :
     "init.error.invalidPreference": "Remplacement de préférence d'initialisation non valide : {value}",
     "init.error.invalidPreferenceValue": "Valeur non valide pour {key} : {value}",
     "init.error.unsupportedPreference": "Paramètre de préférence d'initialisation non pris en charge : {key}",
+    "init.error.promptInputTooLarge": "L'entrée standard de l'init interactif est trop volumineuse ; {maxBytes} octets maximum sont attendus.",
+    "init.error.promptInputTooManyResponses": "L'entrée standard de l'init interactif contient trop de réponses ; {maxResponses} lignes maximum sont attendues.",
     "init.prompt.locale": "Quelle langue les documents mustflow doivent-ils utiliser ?",
     "init.prompt.profile": "Quel profil de projet mustflow doit-il utiliser ?",
     "init.prompt.agentLang": "Quelle langue les agents doivent-ils utiliser pour les rapports finaux ?",
@@ -650,6 +652,7 @@ Lisez ces fichiers avant de travailler :
     "run.help.option.dryRun": "Imprime un plan de commande sans l'exécuter",
     "run.help.option.planOnly": "Alias de --dry-run",
     "run.help.option.json": "Imprime l'enregistrement d'exécution ou le plan de commande en JSON",
+    "run.help.option.allowUntrustedRoot": "Autorise une seule exécution depuis une racine sans verrou de manifeste valide après revue manuelle",
     "run.help.exit.ok": "La commande s'est terminée avec un code de sortie autorisé",
     "run.help.exit.fail": "La commande était non valide, refusée, expirée ou a échoué",
     "run.label.suggestedIntentSnippet": "Extrait suggéré de contrat de commande",
@@ -672,6 +675,8 @@ Lisez ces fichiers avant de travailler :
     "run.error.maxOutputBytes": 'La commande "{intent}" a une valeur max_output_bytes non valide. {detail}',
     "run.error.maxOutputBytesDetail": "La limite de sortie doit rester dans le maximum autorisé.",
     "run.error.conflictingPreviewModes": "Utilisez --dry-run ou --plan-only, pas les deux",
+    "run.error.untrustedRootMissing": "Exécution refusée car {path} est absent. Lancez mf init/update pour installer le workflow, ou ajoutez --allow-untrusted-root après avoir relu AGENTS.md et .mustflow/config/commands.toml.",
+    "run.error.untrustedRootInvalid": "Exécution refusée car le verrou de manifeste est invalide : {detail}. Restaurez-le ou régénérez-le, ou ajoutez --allow-untrusted-root après avoir relu AGENTS.md et .mustflow/config/commands.toml.",
     "run.error.timedOut": 'La commande "{intent}" a expiré après {seconds} secondes',
     "run.error.outputLimitExceeded": 'La commande "{intent}" a dépassé max_output_bytes : {message}',
     "run.error.startFailed": 'Impossible de démarrer la commande "{intent}" : {message}',

package/dist/cli/i18n/hi.js

@@ -583,6 +583,8 @@ export const hiMessages = {
     "init.error.invalidPreference": "अमान्य init preference override: {value}",
     "init.error.invalidPreferenceValue": "{key} के लिए अमान्य मान: {value}",
     "init.error.unsupportedPreference": "असमर्थित init preference setting: {key}",
+    "init.error.promptInputTooLarge": "Interactive init stdin input बहुत बड़ा है; अधिकतम {maxBytes} bytes अपेक्षित हैं।",
+    "init.error.promptInputTooManyResponses": "Interactive init stdin input में बहुत अधिक responses हैं; अधिकतम {maxResponses} lines अपेक्षित हैं।",
     "init.prompt.locale": "mustflow दस्तावेज़ कौन सी भाषा उपयोग करें?",
     "init.prompt.profile": "mustflow कौन सा project profile उपयोग करे?",
     "init.prompt.agentLang": "एजेंट final reports के लिए कौन सी भाषा उपयोग करें?",
@@ -650,6 +652,7 @@ export const hiMessages = {
     "run.help.option.dryRun": "कमांड चलाए बिना उसका plan प्रिंट करें",
     "run.help.option.planOnly": "--dry-run का alias",
     "run.help.option.json": "Run record या command plan को JSON के रूप में प्रिंट करें",
+    "run.help.option.allowUntrustedRoot": "Manual review के बाद missing या invalid manifest lock वाली root से एक execution allow करें",
     "run.help.exit.ok": "कमांड अनुमत exit code के साथ पूरी हुई",
     "run.help.exit.fail": "कमांड अमान्य थी, अस्वीकार हुई, timed out हुई या विफल हुई",
     "run.label.suggestedIntentSnippet": "Suggested command contract snippet",
@@ -672,6 +675,8 @@ export const hiMessages = {
     "run.error.maxOutputBytes": 'कमांड "{intent}" में max_output_bytes अमान्य है। {detail}',
     "run.error.maxOutputBytesDetail": "Output limit अनुमत maximum के अंदर रहनी चाहिए।",
     "run.error.conflictingPreviewModes": "--dry-run या --plan-only में से एक इस्तेमाल करें, दोनों नहीं",
+    "run.error.untrustedRootMissing": "{path} missing है, इसलिए commands execute करने से मना किया गया। Workflow install करने के लिए mf init/update चलाएँ, या AGENTS.md और .mustflow/config/commands.toml review करने के बाद --allow-untrusted-root पास करें।",
+    "run.error.untrustedRootInvalid": "Manifest lock invalid है, इसलिए commands execute करने से मना किया गया: {detail}. इसे restore या regenerate करें, या AGENTS.md और .mustflow/config/commands.toml review करने के बाद --allow-untrusted-root पास करें।",
     "run.error.timedOut": 'कमांड "{intent}" {seconds} सेकंड बाद time out हुई',
     "run.error.outputLimitExceeded": 'कमांड "{intent}" ने max_output_bytes सीमा पार की: {message}',
     "run.error.startFailed": 'कमांड "{intent}" शुरू नहीं हो सकी: {message}',

package/dist/cli/i18n/ko.js

@@ -583,6 +583,8 @@ export const koMessages = {
     "init.error.invalidPreference": "초기 설정 항목 형식이 올바르지 않습니다: {value}",
     "init.error.invalidPreferenceValue": "{key}에 사용할 수 없는 값입니다: {value}",
     "init.error.unsupportedPreference": "지원하지 않는 초기 설정 항목입니다: {key}",
+    "init.error.promptInputTooLarge": "대화형 init 표준입력이 너무 큽니다. 최대 {maxBytes}바이트까지만 허용됩니다.",
+    "init.error.promptInputTooManyResponses": "대화형 init 표준입력 응답이 너무 많습니다. 최대 {maxResponses}줄까지만 허용됩니다.",
     "init.prompt.locale": "mustflow 문서는 어떤 언어로 설치할까요?",
     "init.prompt.profile": "이 저장소에는 어떤 프로젝트 유형을 사용할까요?",
     "init.prompt.agentLang": "에이전트 최종 응답은 어떤 언어로 받을까요?",
@@ -650,6 +652,7 @@ export const koMessages = {
     "run.help.option.dryRun": "실행하지 않고 명령 계획을 출력합니다",
     "run.help.option.planOnly": "--dry-run과 같은 동작입니다",
     "run.help.option.json": "실행 결과 또는 명령 계획을 JSON으로 출력합니다",
+    "run.help.option.allowUntrustedRoot": "잠금 파일이 없거나 올바르지 않은 루트에서 수동 검토 후 이번 실행만 허용합니다",
     "run.help.exit.ok": "명령이 허용된 종료 코드로 완료되었습니다",
     "run.help.exit.fail": "명령이 잘못되었거나, 거부되었거나, 시간 초과되었거나, 실패했습니다",
     "run.label.suggestedIntentSnippet": "제안 명령 계약 조각",
@@ -672,6 +675,8 @@ export const koMessages = {
     "run.error.maxOutputBytes": '명령 "{intent}"의 max_output_bytes 값이 올바르지 않습니다. {detail}',
     "run.error.maxOutputBytesDetail": "출력 상한은 허용된 최댓값 안에 있어야 합니다.",
     "run.error.conflictingPreviewModes": "--dry-run과 --plan-only 중 하나만 사용하세요",
+    "run.error.untrustedRootMissing": "{path}이 없어 명령 실행을 거부했습니다. mf init/update로 워크플로우를 설치하거나, AGENTS.md와 .mustflow/config/commands.toml을 검토한 뒤 --allow-untrusted-root를 붙이세요.",
+    "run.error.untrustedRootInvalid": "잠금 파일이 올바르지 않아 명령 실행을 거부했습니다: {detail}. 파일을 복구하거나 다시 생성하거나, AGENTS.md와 .mustflow/config/commands.toml을 검토한 뒤 --allow-untrusted-root를 붙이세요.",
     "run.error.timedOut": '명령 "{intent}"가 {seconds}초 뒤 시간 초과되었습니다',
     "run.error.outputLimitExceeded": '명령 "{intent}"가 max_output_bytes 제한을 넘었습니다: {message}',
     "run.error.startFailed": '명령 "{intent}"를 시작하지 못했습니다: {message}',

package/dist/cli/i18n/zh.js

@@ -583,6 +583,8 @@ export const zhMessages = {
     "init.error.invalidPreference": "无效的初始化偏好覆盖：{value}",
     "init.error.invalidPreferenceValue": "{key} 的值无效：{value}",
     "init.error.unsupportedPreference": "不支持的初始化偏好设置：{key}",
+    "init.error.promptInputTooLarge": "交互式 init 的标准输入过大；最多允许 {maxBytes} 字节。",
+    "init.error.promptInputTooManyResponses": "交互式 init 的标准输入响应过多；最多允许 {maxResponses} 行。",
     "init.prompt.locale": "mustflow 文档应使用哪种语言？",
     "init.prompt.profile": "mustflow 应使用哪个项目配置？",
     "init.prompt.agentLang": "代理最终报告应使用哪种语言？",
@@ -650,6 +652,7 @@ export const zhMessages = {
     "run.help.option.dryRun": "输出命令计划但不执行",
     "run.help.option.planOnly": "--dry-run 的别名",
     "run.help.option.json": "将运行记录或命令计划输出为 JSON",
+    "run.help.option.allowUntrustedRoot": "人工复核后，允许从缺失或无效清单锁的根目录执行一次命令",
     "run.help.exit.ok": "命令已以允许的退出码完成",
     "run.help.exit.fail": "命令无效、被拒绝、超时或失败",
     "run.label.suggestedIntentSnippet": "建议的命令契约片段",
@@ -672,6 +675,8 @@ export const zhMessages = {
     "run.error.maxOutputBytes": '命令 "{intent}" 的 max_output_bytes 无效。{detail}',
     "run.error.maxOutputBytesDetail": "输出限制必须保持在允许的最大值内。",
     "run.error.conflictingPreviewModes": "只能使用 --dry-run 或 --plan-only，不能同时使用",
+    "run.error.untrustedRootMissing": "已拒绝执行命令，因为缺少 {path}。请运行 mf init/update 安装工作流，或在检查 AGENTS.md 和 .mustflow/config/commands.toml 后传入 --allow-untrusted-root。",
+    "run.error.untrustedRootInvalid": "已拒绝执行命令，因为清单锁无效：{detail}。请恢复或重新生成它，或在检查 AGENTS.md 和 .mustflow/config/commands.toml 后传入 --allow-untrusted-root。",
     "run.error.timedOut": '命令 "{intent}" 在 {seconds} 秒后超时',
     "run.error.outputLimitExceeded": '命令 "{intent}" 超过 max_output_bytes：{message}',
     "run.error.startFailed": '命令 "{intent}" 启动失败：{message}',

package/dist/cli/lib/agent-context.js

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { isRecord, readPositiveInteger, readString, readStringArray, } from './command-contract.js';
@@ -6,7 +6,8 @@ import { readRetentionStore } from '../../core/retention-policy.js';
 import { toPosixPath } from './filesystem.js';
 import { readLocalIndexPromptContext } from './local-index.js';
 import { inspectManifestLock } from './manifest-lock.js';
-import { readTomlFile } from './toml.js';
+import { MUSTFLOW_JSON_MAX_BYTES, readMustflowTextFile, readMustflowTextFileIfExists, } from './mustflow-read.js';
+import { readMustflowTomlFile } from './toml.js';
 const CONTEXT_SCHEMA_VERSION = '1';
 const COMMANDS_RELATIVE_PATH = '.mustflow/config/commands.toml';
 const MUSTFLOW_RELATIVE_PATH = '.mustflow/config/mustflow.toml';
@@ -49,20 +50,14 @@ function safeExists(projectRoot, relativePath) {
     return existsSync(resolved);
 }
 function safeRead(projectRoot, relativePath) {
-    const resolved = path.resolve(projectRoot, ...relativePath.split('/'));
-    const root = path.resolve(projectRoot);
-    const relative = path.relative(root, resolved);
-    if (relative.startsWith('..') || path.isAbsolute(relative) || !existsSync(resolved)) {
-        return null;
-    }
-    return readFileSync(resolved, 'utf8');
+    return readMustflowTextFileIfExists(projectRoot, relativePath);
 }
 function readTomlTableIfExists(projectRoot, relativePath) {
     const filePath = path.join(projectRoot, ...relativePath.split('/'));
     if (!existsSync(filePath)) {
         return undefined;
     }
-    const parsed = readTomlFile(filePath);
+    const parsed = readMustflowTomlFile(projectRoot, relativePath);
     return isRecord(parsed) ? parsed : undefined;
 }
 function readNestedTable(table, key) {
@@ -194,7 +189,7 @@ function readLatestRunContext(projectRoot) {
         };
     }
     try {
-        const parsed = JSON.parse(readFileSync(latestPath, 'utf8'));
+        const parsed = JSON.parse(readMustflowTextFile(projectRoot, LATEST_RUN_RELATIVE_PATH, { maxBytes: MUSTFLOW_JSON_MAX_BYTES }));
         if (!isRecord(parsed)) {
             throw new Error('latest run receipt must contain a JSON object');
         }

package/dist/cli/lib/dashboard-export.js

@@ -1,6 +1,7 @@
 import { Buffer } from 'node:buffer';
 import path from 'node:path';
 import { createDashboardCompletionVerdict } from '../../core/completion-verdict.js';
+import { createCorrelationId } from '../../core/correlation-id.js';
 import { createDashboardEvidenceModel } from '../../core/verification-evidence.js';
 import { redactSecretLikeText } from '../../core/secret-redaction.js';
 import { ensureFileTargetInsideWithoutSymlinks, ensureInside, toPosixPath, writeUtf8FileInsideWithoutSymlinks, } from './filesystem.js';
@@ -487,6 +488,7 @@ export function createDashboardExportSnapshot(input) {
     const snapshot = {
         schema_version: '1',
         command: 'dashboard export',
+        correlation_id: createCorrelationId('dashboard'),
         format: input.format,
         generated_at: new Date().toISOString(),
         mustflow_root: input.projectRoot,

package/dist/cli/lib/dashboard-mutations.js

@@ -0,0 +1,79 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { openPathInFileManager } from './browser-open.js';
+import { updateDashboardPreferences, } from './dashboard-preferences.js';
+import { isReviewerKind, markDocReviewEntry, } from './doc-review-ledger.js';
+const DOC_REVIEW_BULK_PAYLOAD_FIELDS = ['paths', 'documents', 'entries'];
+function readPreferenceUpdatePayload(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new Error('Request body must be a JSON object.');
+    }
+    const updates = value.updates;
+    if (!Array.isArray(updates)) {
+        throw new Error('Request body must include an updates array.');
+    }
+    return updates.map((entry) => {
+        if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+            throw new Error('Each update must be a JSON object.');
+        }
+        const update = entry;
+        if (typeof update.id !== 'string' || update.id.trim().length === 0) {
+            throw new Error('Each update must include an id.');
+        }
+        return { id: update.id, value: update.value };
+    });
+}
+function readOptionalStringField(value, key) {
+    const field = value[key];
+    return typeof field === 'string' && field.trim().length > 0 ? field.trim() : undefined;
+}
+function readRequiredStringField(value, key) {
+    const field = readOptionalStringField(value, key);
+    if (!field) {
+        throw new Error(`${key} is required.`);
+    }
+    return field;
+}
+function readDocReviewPayload(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new Error('Request body must be a JSON object.');
+    }
+    const payload = value;
+    for (const field of DOC_REVIEW_BULK_PAYLOAD_FIELDS) {
+        if (field in payload) {
+            throw new Error('Bulk documentation review updates require a separate confirmed flow.');
+        }
+    }
+    const status = readRequiredStringField(payload, 'status');
+    if (status !== 'approved' && status !== 'needs_human' && status !== 'ignored') {
+        throw new Error('status must be approved, needs_human, or ignored.');
+    }
+    const reviewerKind = readRequiredStringField(payload, 'reviewerKind');
+    if (!isReviewerKind(reviewerKind)) {
+        throw new Error('reviewerKind must be human, llm, tool, or external.');
+    }
+    return {
+        path: readRequiredStringField(payload, 'path'),
+        status,
+        reviewerKind,
+        reviewerId: readRequiredStringField(payload, 'reviewerId'),
+        reviewerLabel: readOptionalStringField(payload, 'reviewerLabel'),
+        reviewerProvider: readOptionalStringField(payload, 'reviewerProvider'),
+        reviewerModel: readOptionalStringField(payload, 'reviewerModel'),
+        reviewerCommandIntent: readOptionalStringField(payload, 'reviewerCommandIntent'),
+        summary: readOptionalStringField(payload, 'summary'),
+    };
+}
+export function updateDashboardPreferencesFromPayload(projectRoot, payload) {
+    return updateDashboardPreferences(projectRoot, readPreferenceUpdatePayload(payload));
+}
+export function markDashboardDocReviewFromPayload(projectRoot, payload) {
+    markDocReviewEntry(projectRoot, readDocReviewPayload(payload));
+}
+export function openDashboardMustflowFolder(projectRoot) {
+    const mustflowPath = path.join(projectRoot, '.mustflow');
+    if (!existsSync(mustflowPath)) {
+        return 'missing';
+    }
+    return openPathInFileManager(mustflowPath) ? 'opened' : 'unavailable';
+}

package/dist/cli/lib/local-index/command-effect-index.js

@@ -0,0 +1,25 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { isRecord, readCommandContract, readString } from '../command-contract.js';
+import { normalizeCommandEffects } from '../../../core/command-effects.js';
+export function collectCommandIntents(projectRoot) {
+    if (!existsSync(path.join(projectRoot, '.mustflow', 'config', 'commands.toml'))) {
+        return [];
+    }
+    const contract = readCommandContract(projectRoot);
+    const intents = [];
+    for (const [name, intent] of Object.entries(contract.intents).sort(([left], [right]) => left.localeCompare(right))) {
+        if (!isRecord(intent)) {
+            continue;
+        }
+        intents.push({
+            name,
+            status: readString(intent, 'status') ?? 'unknown',
+            lifecycle: readString(intent, 'lifecycle') ?? null,
+            runPolicy: readString(intent, 'run_policy') ?? null,
+            description: readString(intent, 'description') ?? null,
+            effects: normalizeCommandEffects(projectRoot, contract, name),
+        });
+    }
+    return intents;
+}

package/dist/cli/lib/local-index/hashing.js

@@ -0,0 +1,7 @@
+import { createHash } from 'node:crypto';
+export function sha256Text(content) {
+    return `sha256:${createHash('sha256').update(content).digest('hex')}`;
+}
+export function sha256Bytes(content) {
+    return `sha256:${createHash('sha256').update(content).digest('hex')}`;
+}