mustflow 2.39.1 → 2.58.0

package/dist/core/command-contract-validation.js

@@ -546,6 +546,6 @@ export function validateCommandContractStrictDefaults(projectRoot, commandsToml)
     issues.push(...validateCommandEnvInheritanceWarnings(commandsToml));
     issues.push(...validateProjectLocalBinWarnings(projectRoot, commandsToml));
     issues.push(...validateCommandEffects(projectRoot, commandsToml));
-    issues.push(...validateCommandEffectLockWarnings(commandsToml));
+    issues.push(...validateCommandEffectLockWarnings(projectRoot, commandsToml));
     return issues;
 }

package/dist/core/command-cwd.js

@@ -13,10 +13,21 @@ export function resolveSafeProjectCwd(projectRoot, rawCwd) {
     const cwd = rawCwd ?? '.';
     const resolved = path.resolve(projectRoot, cwd);
     const rootRealPath = realpathSync.native(projectRoot);
-    if (!existsSync(resolved) || !statSync(resolved).isDirectory()) {
+    try {
+        if (!existsSync(resolved) || !statSync(resolved).isDirectory()) {
+            throw new Error();
+        }
+    }
+    catch {
+        throw new Error(`Intent cwd must stay inside the current root and resolve to an existing directory: ${cwd}`);
+    }
+    let cwdRealPath;
+    try {
+        cwdRealPath = realpathSync.native(resolved);
+    }
+    catch {
         throw new Error(`Intent cwd must stay inside the current root and resolve to an existing directory: ${cwd}`);
     }
-    const cwdRealPath = realpathSync.native(resolved);
     if (!isInsideOrEqual(rootRealPath, cwdRealPath)) {
         throw new Error(`Intent cwd must stay inside the current root and resolve to an existing directory: ${cwd}`);
     }

package/dist/core/command-effects.js

@@ -161,11 +161,16 @@ export function validateCommandEffects(projectRoot, commandsToml) {
     }
     return issues;
 }
-export function validateCommandEffectLockWarnings(commandsToml) {
+export function validateCommandEffectLockWarnings(projectRoot, commandsToml) {
     const issues = [];
     if (!commandsToml || !isRecord(commandsToml.intents)) {
         return issues;
     }
+    const commandContract = {
+        defaults: isRecord(commandsToml.defaults) ? commandsToml.defaults : {},
+        intents: commandsToml.intents,
+        resources: isRecord(commandsToml.resources) ? commandsToml.resources : {},
+    };
     const lockToIntents = new Map();
     for (const [intentName, intent] of Object.entries(commandsToml.intents)) {
         if (!isRecord(intent)) {
@@ -177,9 +182,22 @@ export function validateCommandEffectLockWarnings(commandsToml) {
             Array.isArray(intent.effects)) {
             continue;
         }
-        for (const rawPath of readStringArray(intent, 'writes') ?? []) {
-            const lock = pathLockKey(rawPath);
-            lockToIntents.set(lock, [...(lockToIntents.get(lock) ?? []), intentName]);
+        let effects;
+        try {
+            effects = normalizeCommandEffects(projectRoot, commandContract, intentName).filter((effect) => effect.source === 'writes');
+        }
+        catch {
+            continue;
+        }
+        for (const effect of effects) {
+            const lock = effect.lock;
+            const intents = lockToIntents.get(lock);
+            if (intents) {
+                intents.push(intentName);
+            }
+            else {
+                lockToIntents.set(lock, [intentName]);
+            }
         }
     }
     for (const [lock, intents] of lockToIntents) {

package/dist/core/command-env.js

@@ -105,14 +105,16 @@ function removeProjectLocalBinFromPath(env, projectRoot) {
     const pathKey = getPathEnvKey(env);
     const currentPath = env[pathKey];
     if (!currentPath) {
-        return env;
+        return { ...env };
     }
     const localBinPath = path.join(projectRoot, 'node_modules', '.bin');
-    env[pathKey] = currentPath
-        .split(path.delimiter)
-        .filter((entry) => entry.length > 0 && !sameResolvedPath(entry, localBinPath))
-        .join(path.delimiter);
-    return env;
+    return {
+        ...env,
+        [pathKey]: currentPath
+            .split(path.delimiter)
+            .filter((entry) => entry.length > 0 && !sameResolvedPath(entry, localBinPath))
+            .join(path.delimiter),
+    };
 }
 export function resolveCommandEnv(contract, intent) {
     const policy = readEnvPolicy(intent) ?? readEnvPolicy(contract.defaults) ?? DEFAULT_COMMAND_ENV_POLICY;

package/dist/core/command-preconditions.js

@@ -84,6 +84,10 @@ function globToRegExp(pattern) {
             expression += '[^/]*';
             continue;
         }
+        if (character === '?') {
+            expression += '[^/]';
+            continue;
+        }
         expression += escapeRegExp(character);
     }
     return new RegExp(`${expression}$`, 'u');
@@ -219,10 +223,32 @@ function evaluateArtifactFreshness(projectRoot, declaration, satisfyIntent, cont
             satisfyIntent,
         };
     }
-    const artifactMtime = statSync(artifactPath).mtimeMs;
+    let artifactMtime;
+    try {
+        artifactMtime = statSync(artifactPath).mtimeMs;
+    }
+    catch {
+        return {
+            kind: declaration.kind,
+            label: declaration.label,
+            status: 'missing',
+            detail: `artifact "${artifact}" is missing.`,
+            path: null,
+            artifact,
+            sources: declaration.sources,
+            newestSource: null,
+            satisfyIntent,
+        };
+    }
     let newest = null;
     for (const source of sourceFiles) {
-        const mtime = statSync(path.join(projectRoot, ...source.split('/'))).mtimeMs;
+        let mtime;
+        try {
+            mtime = statSync(path.join(projectRoot, ...source.split('/'))).mtimeMs;
+        }
+        catch {
+            continue;
+        }
         if (!newest || mtime > newest.mtime) {
             newest = { source, mtime };
         }

package/dist/core/completion-verdict.js

@@ -219,7 +219,7 @@ export function createVerifyCompletionVerdict(input) {
             failed_intents: normalizedInput.failedIntents,
             skipped_intents: normalizedInput.skippedIntents,
             receipt_count: normalizedInput.receiptCount,
-            gap_count: normalizedInput.skippedIntents,
+            gap_count: normalizedInput.gapCount ?? 0,
             source_anchor_risk_count: normalizedInput.sourceAnchorRiskCount ?? 0,
             scope_diff_risk_count: normalizedInput.scopeDiffRiskCount ?? 0,
             repeated_failure_count: normalizedInput.repeatedFailureCount ?? 0,

package/dist/core/line-endings.js

@@ -21,6 +21,7 @@ function gitList(projectRoot, args) {
         encoding: 'buffer',
         env: createCommandEnv(projectRoot, { policy: 'minimal', allowlist: [] }),
         stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: 30_000,
         windowsHide: true,
     });
     if (result.status !== 0) {
@@ -71,19 +72,22 @@ function detectLineEnding(buffer) {
     return crlfCount === lfCount ? 'crlf' : 'mixed';
 }
 function normalizeLf(buffer) {
-    const bytes = [];
+    const bytes = Buffer.allocUnsafe(buffer.length);
+    let writeIndex = 0;
     for (let index = 0; index < buffer.length; index += 1) {
         const byte = buffer[index];
         if (byte === 0x0d) {
-            bytes.push(0x0a);
+            bytes[writeIndex] = 0x0a;
+            writeIndex += 1;
             if (buffer[index + 1] === 0x0a) {
                 index += 1;
             }
             continue;
         }
-        bytes.push(byte);
+        bytes[writeIndex] = byte;
+        writeIndex += 1;
     }
-    return Buffer.from(bytes);
+    return bytes.subarray(0, writeIndex);
 }
 export function inspectLineEndings(projectRoot, mode, options = {}) {
     const root = path.resolve(projectRoot);

package/dist/core/safe-filesystem.js

@@ -14,7 +14,15 @@ function tempFilePath(targetPath) {
     return path.join(path.dirname(targetPath), `.${path.basename(targetPath)}.${suffix}.tmp`);
 }
 function sleep(milliseconds) {
-    Atomics.wait(WRITE_SLEEP_BUFFER, 0, 0, milliseconds);
+    try {
+        Atomics.wait(WRITE_SLEEP_BUFFER, 0, 0, milliseconds);
+    }
+    catch {
+        const end = Date.now() + milliseconds;
+        while (Date.now() < end) {
+            // Fall back only for short retry delays when Atomics.wait is unavailable on this runtime.
+        }
+    }
 }
 function isRetryableWindowsRenameError(error) {
     if (process.platform !== 'win32' || !error || typeof error !== 'object' || !('code' in error)) {

package/dist/core/source-anchor-validation.js

@@ -131,7 +131,13 @@ export function validateSourceAnchorsInProject(projectRoot) {
     const anchorsById = new Map();
     for (const relativePath of sourceFiles) {
         const absolutePath = path.join(projectRoot, ...relativePath.split('/'));
-        const content = readFileSync(absolutePath, 'utf8');
+        let content;
+        try {
+            content = readFileSync(absolutePath, 'utf8');
+        }
+        catch {
+            continue;
+        }
         const anchors = parseSourceAnchorsInContent(relativePath, content);
         issues.push(...validateSourceAnchorDensity(relativePath, content, anchors));
         for (const anchor of anchors) {

package/dist/core/source-anchors.js

@@ -321,10 +321,16 @@ export function collectSourceAnchorSummaries(projectRoot) {
     const anchors = [];
     for (const relativePath of listSourceAnchorFiles(projectRoot)) {
         const filePath = path.join(projectRoot, ...relativePath.split('/'));
-        if (!existsSync(filePath) || !statSync(filePath).isFile()) {
+        let content;
+        try {
+            if (!existsSync(filePath) || !statSync(filePath).isFile()) {
+                continue;
+            }
+            content = readFileSync(filePath, 'utf8');
+        }
+        catch {
             continue;
         }
-        const content = readFileSync(filePath, 'utf8');
         for (const anchor of parseSourceAnchorsInContent(relativePath, content)) {
             if (!anchor.idValid || sourceAnchorTextContainsSecretLike(anchor.rawText)) {
                 continue;

package/dist/core/verification-scheduler.js

@@ -19,12 +19,18 @@ function toScheduleEffect(effect) {
 function isObject(value) {
     return !!value && typeof value === 'object';
 }
+function isMissingPathError(error) {
+    return error instanceof Error && 'code' in error && error.code === 'ENOENT';
+}
 function readJsonFile(projectRoot, filePath) {
     try {
         return JSON.parse(readUtf8FileInsideWithoutSymlinks(projectRoot, filePath, { maxBytes: MUSTFLOW_JSON_MAX_BYTES }));
     }
-    catch {
-        return null;
+    catch (error) {
+        if (isMissingPathError(error)) {
+            return null;
+        }
+        throw error;
     }
 }
 function getUndeclaredWriteIntent(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-  "version": "2.39.1",
+  "version": "2.58.0",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",

package/templates/default/i18n.toml

@@ -62,7 +62,7 @@ translations = {}
 [documents."skills.index"]
 source = "locales/en/.mustflow/skills/INDEX.md"
 source_locale = "en"
-revision = 109
+revision = 167
 translations = {}
 
 [documents."skill.adapter-boundary"]
@@ -116,6 +116,270 @@ translations = {}
 [documents."skill.ai-generated-code-hardening"]
 source = "locales/en/.mustflow/skills/ai-generated-code-hardening/SKILL.md"
 source_locale = "en"
+revision = 2
+translations = {}
+
+[documents."skill.module-boundary-review"]
+source = "locales/en/.mustflow/skills/module-boundary-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.change-blast-radius-review"]
+source = "locales/en/.mustflow/skills/change-blast-radius-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.business-rule-leakage-review"]
+source = "locales/en/.mustflow/skills/business-rule-leakage-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.payment-integrity-review"]
+source = "locales/en/.mustflow/skills/payment-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.credit-ledger-integrity-review"]
+source = "locales/en/.mustflow/skills/credit-ledger-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.api-misuse-resistance-review"]
+source = "locales/en/.mustflow/skills/api-misuse-resistance-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.api-access-control-review"]
+source = "locales/en/.mustflow/skills/api-access-control-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.file-upload-security-review"]
+source = "locales/en/.mustflow/skills/file-upload-security-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.error-message-integrity-review"]
+source = "locales/en/.mustflow/skills/error-message-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.memory-lifetime-review"]
+source = "locales/en/.mustflow/skills/memory-lifetime-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.desktop-memory-footprint-review"]
+source = "locales/en/.mustflow/skills/desktop-memory-footprint-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.hot-path-performance-review"]
+source = "locales/en/.mustflow/skills/hot-path-performance-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.api-request-performance-review"]
+source = "locales/en/.mustflow/skills/api-request-performance-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.web-render-performance-review"]
+source = "locales/en/.mustflow/skills/web-render-performance-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.core-web-vitals-field-review"]
+source = "locales/en/.mustflow/skills/core-web-vitals-field-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.image-delivery-performance-review"]
+source = "locales/en/.mustflow/skills/image-delivery-performance-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.client-bundle-pruning-review"]
+source = "locales/en/.mustflow/skills/client-bundle-pruning-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.frame-render-performance-review"]
+source = "locales/en/.mustflow/skills/frame-render-performance-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.app-startup-performance-review"]
+source = "locales/en/.mustflow/skills/app-startup-performance-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.desktop-background-process-stability-review"]
+source = "locales/en/.mustflow/skills/desktop-background-process-stability-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.desktop-auto-update-safety-review"]
+source = "locales/en/.mustflow/skills/desktop-auto-update-safety-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.low-end-device-support-review"]
+source = "locales/en/.mustflow/skills/low-end-device-support-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.mobile-energy-efficiency-review"]
+source = "locales/en/.mustflow/skills/mobile-energy-efficiency-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.frontend-state-ownership-review"]
+source = "locales/en/.mustflow/skills/frontend-state-ownership-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.frontend-stress-layout-review"]
+source = "locales/en/.mustflow/skills/frontend-stress-layout-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.frontend-accessibility-tree-review"]
+source = "locales/en/.mustflow/skills/frontend-accessibility-tree-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.frontend-localization-review"]
+source = "locales/en/.mustflow/skills/frontend-localization-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.cache-integrity-review"]
+source = "locales/en/.mustflow/skills/cache-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.quadratic-scan-review"]
+source = "locales/en/.mustflow/skills/quadratic-scan-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.type-state-modeling-review"]
+source = "locales/en/.mustflow/skills/type-state-modeling-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.race-condition-review"]
+source = "locales/en/.mustflow/skills/race-condition-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.concurrency-invariant-review"]
+source = "locales/en/.mustflow/skills/concurrency-invariant-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.failure-integrity-review"]
+source = "locales/en/.mustflow/skills/failure-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.backend-log-evidence-review"]
+source = "locales/en/.mustflow/skills/backend-log-evidence-review/SKILL.md"
+source_locale = "en"
+revision = 2
+translations = {}
+
+[documents."skill.observability-debuggability-review"]
+source = "locales/en/.mustflow/skills/observability-debuggability-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.incident-triage-review"]
+source = "locales/en/.mustflow/skills/incident-triage-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.deployment-rollout-safety-review"]
+source = "locales/en/.mustflow/skills/deployment-rollout-safety-review/SKILL.md"
+source_locale = "en"
+revision = 2
+translations = {}
+
+[documents."skill.cloud-cost-guardrail-review"]
+source = "locales/en/.mustflow/skills/cloud-cost-guardrail-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.rate-limit-integrity-review"]
+source = "locales/en/.mustflow/skills/rate-limit-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.idempotency-integrity-review"]
+source = "locales/en/.mustflow/skills/idempotency-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.retry-policy-integrity-review"]
+source = "locales/en/.mustflow/skills/retry-policy-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.queue-processing-integrity-review"]
+source = "locales/en/.mustflow/skills/queue-processing-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.transaction-boundary-integrity-review"]
+source = "locales/en/.mustflow/skills/transaction-boundary-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.testability-boundary-review"]
+source = "locales/en/.mustflow/skills/testability-boundary-review/SKILL.md"
+source_locale = "en"
 revision = 1
 translations = {}
 
@@ -140,6 +404,29 @@ translations = {}
 [documents."skill.database-migration-change"]
 source = "locales/en/.mustflow/skills/database-migration-change/SKILL.md"
 source_locale = "en"
+revision = 2
+translations = {}
+
+[documents."skill.database-query-bottleneck-review"]
+source = "locales/en/.mustflow/skills/database-query-bottleneck-review/SKILL.md"
+source_locale = "en"
+revision = 2
+translations = {}
+
+[documents."skill.database-json-modeling-review"]
+source = "locales/en/.mustflow/skills/database-json-modeling-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.deletion-lifecycle-review"]
+source = "locales/en/.mustflow/skills/deletion-lifecycle-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+[documents."skill.database-lock-contention-review"]
+source = "locales/en/.mustflow/skills/database-lock-contention-review/SKILL.md"
+source_locale = "en"
 revision = 1
 translations = {}
 
@@ -227,6 +514,12 @@ source_locale = "en"
 revision = 2
 translations = {}
 
+[documents."skill.security-flow-review"]
+source = "locales/en/.mustflow/skills/security-flow-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
 [documents."skill.config-env-change"]
 source = "locales/en/.mustflow/skills/config-env-change/SKILL.md"
 source_locale = "en"
@@ -670,6 +963,42 @@ source_locale = "en"
 revision = 2
 translations = {}
 
+[documents."skill.prompt-contract-quality-review"]
+source = "locales/en/.mustflow/skills/prompt-contract-quality-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.llm-hallucination-control-review"]
+source = "locales/en/.mustflow/skills/llm-hallucination-control-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.llm-token-cost-control-review"]
+source = "locales/en/.mustflow/skills/llm-token-cost-control-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.llm-response-latency-review"]
+source = "locales/en/.mustflow/skills/llm-response-latency-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.agent-execution-control-review"]
+source = "locales/en/.mustflow/skills/agent-execution-control-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
+[documents."skill.agent-eval-integrity-review"]
+source = "locales/en/.mustflow/skills/agent-eval-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 1
+translations = {}
+
 [documents."skill.ui-quality-gate"]
 source = "locales/en/.mustflow/skills/ui-quality-gate/SKILL.md"
 source_locale = "en"