mustflow 2.39.1 → 2.58.1

package/dist/cli/commands/run/executor.js

@@ -3,7 +3,23 @@ import { BoundedOutputBuffer } from '../../../core/bounded-output.js';
 import { createPendingTimeoutTermination, forceTerminateProcessTree, getKillMethod, terminateProcessTree, } from './process-tree.js';
 import { createOutputLimitError, isOutputLimitExceededError, writeOutputLimitTerminationMarker, writeStreamChunk, writeStreamChunkPrefix, } from './output.js';
 const TERMINATION_CONFIRMATION_FALLBACK_MS = 1000;
+function createEmptyOutputSnapshot(maxBytes) {
+    return new BoundedOutputBuffer(maxBytes).toSnapshot();
+}
+function createInvalidExecutableError() {
+    return Object.assign(new Error('Command executable must not be empty'), { code: 'EINVAL' });
+}
 function runSpawnedCommandStreaming(command, cwd, env, timeoutSeconds, killAfterSeconds, maxOutputBytes, stdoutTailBytes, stderrTailBytes, reporter, streamOutput, enforceOutputLimit) {
+    if (command.executable.trim().length === 0) {
+        return Promise.resolve({
+            status: null,
+            signal: null,
+            error: createInvalidExecutableError(),
+            stdout: createEmptyOutputSnapshot(stdoutTailBytes),
+            stderr: createEmptyOutputSnapshot(stderrTailBytes),
+            termination: null,
+        });
+    }
     return new Promise((resolve) => {
         const stdout = new BoundedOutputBuffer(stdoutTailBytes);
         const stderr = new BoundedOutputBuffer(stderrTailBytes);

package/dist/cli/commands/run/process-tree.js

@@ -1,10 +1,13 @@
 import { spawn, spawnSync } from 'node:child_process';
+function windowsTaskkillArgs(pid, signal) {
+    return signal === 'SIGKILL' ? ['/PID', String(pid), '/T', '/F'] : ['/PID', String(pid), '/T'];
+}
 function signalProcessTree(pid, signal) {
     if (!pid || pid <= 0) {
         return;
     }
     if (process.platform === 'win32') {
-        spawnSync('taskkill', ['/PID', String(pid), '/T', '/F'], {
+        spawnSync('taskkill', windowsTaskkillArgs(pid, signal), {
             stdio: 'ignore',
             windowsHide: true,
         });
@@ -35,7 +38,7 @@ function signalProcessTreeNonBlocking(pid, signal) {
         return;
     }
     if (process.platform === 'win32') {
-        const killer = spawn('taskkill', ['/PID', String(pid), '/T', '/F'], {
+        const killer = spawn('taskkill', windowsTaskkillArgs(pid, signal), {
             stdio: 'ignore',
             windowsHide: true,
             detached: true,
@@ -76,7 +79,7 @@ export function forceTerminateProcessTreeNonBlocking(pid) {
     signalProcessTreeNonBlocking(pid, 'SIGKILL');
 }
 export function getKillMethod() {
-    return process.platform === 'win32' ? 'taskkill_process_tree_forced' : 'process_group_sigterm';
+    return process.platform === 'win32' ? 'taskkill_process_tree' : 'process_group_sigterm';
 }
 export function createPendingTimeoutTermination(method, forcedKillAttempted = false) {
     return {

package/dist/cli/commands/tech.js

@@ -3,6 +3,7 @@ import { printUsageError, renderCliError, renderHelp } from '../lib/cli-output.j
 import { writeUtf8FileInsideWithoutSymlinks } from '../lib/filesystem.js';
 import { isRecord } from '../lib/command-contract.js';
 import { t } from '../lib/i18n.js';
+import { checkNpmPackageExists } from '../lib/npm-version-check.js';
 import { formatCliOptionParseError, getParsedCliStringOption, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
 import { resolveMustflowRoot } from '../lib/project-root.js';
 import { readMustflowTomlFile } from '../lib/toml.js';
@@ -14,6 +15,7 @@ const TECH_OPTIONS = [
     { name: '--status', kind: 'string' },
     { name: '--ecosystem', kind: 'string' },
     { name: '--package', kind: 'string' },
+    { name: '--verify', kind: 'boolean' },
     { name: '--why', kind: 'string' },
     { name: '--constraint', kind: 'string' },
 ];
@@ -40,13 +42,14 @@ export function getTechHelp(lang = 'en') {
             { label: '--status <status>', description: `Preference status: ${TECHNOLOGY_STATUSES.join(', ')}` },
             { label: '--ecosystem <ecosystem>', description: 'Package ecosystem or platform, such as npm, cargo, pip, go, or deno' },
             { label: '--package <package>', description: 'Package name to associate with the preference. Repeatable.' },
+            { label: '--verify', description: 'Verify listed npm packages exist before writing the preference' },
             { label: '--why <text>', description: 'Short rationale for the preference' },
             { label: '--constraint <text>', description: 'Guardrail agents must keep in mind. Repeatable.' },
             { label: '-h, --help', description: t(lang, 'cli.option.help') },
         ],
         examples: [
             'mf tech list',
-            'mf tech add framework nextjs --scope frontend --ecosystem npm --package next --package react --why "Preferred React app framework"',
+            'mf tech add framework nextjs --scope frontend --ecosystem npm --package next --package react --verify --why "Preferred React app framework"',
             'mf tech add language rust --scope backend --status preferred --why "Use for correctness-critical engines"',
             'mf tech add library jquery --scope frontend --status avoid --why "Avoid new usage"',
             'mf tech suggest --scope frontend',
@@ -71,6 +74,7 @@ function parseTechOptions(args, lang) {
             status: null,
             ecosystem: null,
             packages: [],
+            verify: false,
             why: null,
             constraints: [],
             error: actionToken ? `Unknown tech action: ${actionToken}` : 'Specify a tech action: list, add, remove, or suggest',
@@ -87,6 +91,7 @@ function parseTechOptions(args, lang) {
             status: null,
             ecosystem: null,
             packages: [],
+            verify: hasParsedCliOption(parsed, '--verify'),
             why: null,
             constraints: [],
             error: formatCliOptionParseError(parsed.error, lang),
@@ -109,6 +114,7 @@ function parseTechOptions(args, lang) {
         status,
         ecosystem: getParsedCliStringOption(parsed, '--ecosystem'),
         packages: getRepeatedStringOptions(parsed.occurrences, '--package'),
+        verify: hasParsedCliOption(parsed, '--verify'),
         why: getParsedCliStringOption(parsed, '--why'),
         constraints: getRepeatedStringOptions(parsed.occurrences, '--constraint'),
     };
@@ -123,6 +129,7 @@ function invalidParsed(action, positionals, json, error) {
         status: null,
         ecosystem: null,
         packages: [],
+        verify: false,
         why: null,
         constraints: [],
         error,
@@ -239,7 +246,44 @@ function findExistingIndex(preferences, candidate) {
         return preference.kind === candidate.kind && normalizeTechnologyKey(preference.name) === normalizeTechnologyKey(candidate.name);
     });
 }
-function runAdd(projectRoot, options, reporter) {
+async function verifyNpmPackages(options, reporter) {
+    if (!options.verify) {
+        return [];
+    }
+    if (options.action !== 'add') {
+        reporter.stderr(renderCliError('--verify is only supported with mf tech add', 'mf tech --help'));
+        return null;
+    }
+    if (options.packages.length === 0) {
+        reporter.stderr(renderCliError('--verify requires at least one --package value', 'mf tech --help'));
+        return null;
+    }
+    if (options.ecosystem !== 'npm') {
+        reporter.stderr(renderCliError('--verify currently supports --ecosystem npm only', 'mf tech --help'));
+        return null;
+    }
+    const checks = [];
+    for (const packageName of options.packages) {
+        try {
+            const check = await checkNpmPackageExists(packageName);
+            if (!check.exists) {
+                reporter.stderr(renderCliError(`npm package not found: ${packageName}`, 'mf tech --help'));
+                return null;
+            }
+            checks.push(check);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            reporter.stderr(renderCliError(`Could not verify npm package ${packageName}: ${message}`, 'mf tech --help'));
+            return null;
+        }
+    }
+    return checks;
+}
+function renderVerifiedPackageNames(checks) {
+    return checks.map((check) => check.resolvedName ?? check.packageName).join(', ');
+}
+async function runAdd(projectRoot, options, reporter) {
     const [kindToken, nameToken] = options.positionals;
     if (!isTechnologyKind(kindToken ?? null)) {
         reporter.stderr(renderCliError('Missing or unsupported technology kind', 'mf tech --help'));
@@ -277,6 +321,10 @@ function runAdd(projectRoot, options, reporter) {
     const preferences = [...file.preferences];
     const existingIndex = findExistingIndex(preferences, candidate);
     const action = existingIndex === -1 ? 'created' : 'updated';
+    const verifiedPackages = await verifyNpmPackages(options, reporter);
+    if (verifiedPackages === null) {
+        return 1;
+    }
     if (existingIndex === -1) {
         preferences.push(candidate);
     }
@@ -285,9 +333,17 @@ function runAdd(projectRoot, options, reporter) {
     }
     writeTechnologyPreferences(projectRoot, preferences);
     if (options.json) {
-        reporter.stdout(JSON.stringify({ action, preference: candidate, path: TECHNOLOGY_CONFIG_RELATIVE_PATH }, null, 2));
+        reporter.stdout(JSON.stringify({
+            action,
+            preference: candidate,
+            path: TECHNOLOGY_CONFIG_RELATIVE_PATH,
+            verified_packages: verifiedPackages,
+        }, null, 2));
         return 0;
     }
+    if (verifiedPackages.length > 0) {
+        reporter.stdout(`Verified npm packages: ${renderVerifiedPackageNames(verifiedPackages)}`);
+    }
     reporter.stdout(`${action === 'created' ? 'Created' : 'Updated'} ${candidate.id} in ${TECHNOLOGY_CONFIG_RELATIVE_PATH}`);
     return 0;
 }
@@ -322,7 +378,7 @@ function runRemove(projectRoot, options, reporter) {
     reporter.stdout(`Removed ${removed.id} from ${TECHNOLOGY_CONFIG_RELATIVE_PATH}`);
     return 0;
 }
-export function runTech(args, reporter, lang = 'en') {
+export async function runTech(args, reporter, lang = 'en') {
     if (hasCliOptionToken(args, '--help', ['-h'])) {
         reporter.stdout(getTechHelp(lang));
         return 0;

package/dist/cli/commands/verify.js

@@ -206,10 +206,11 @@ async function runVerificationEntriesInParallelChunks(projectRoot, entries, para
         const chunk = entries.slice(index, index + parallelism);
         const batchTracker = startRunWriteBatchTracking(projectRoot, createCommandEnv(projectRoot, { policy: 'minimal', allowlist: [] }));
         const chunkResults = await Promise.all(chunk.map((entry) => runVerificationIntent(entry.intent, lang, verificationPlanId, correlationId, scheduledTestTargets.get(entry.intent) ?? [])));
+        const chunkResultsByIntent = new Map(chunkResults.map((result) => [result.intent, result]));
         const writeDriftByIntent = finishRunWriteBatchTracking(batchTracker, chunk.map((entry) => ({
             intentName: entry.intent,
             declaredPaths: declaredWritePathsForScheduleEntry(entry),
-            observedPaths: observedWriteDriftPaths(chunkResults.find((result) => result.intent === entry.intent)),
+            observedPaths: observedWriteDriftPaths(chunkResultsByIntent.get(entry.intent)),
         })));
         results.push(...chunkResults.map((result) => applyParallelChunkWriteDrift(result, writeDriftByIntent)));
     }
@@ -493,6 +494,7 @@ function createCompletionVerdictForResults(input) {
         failedIntents: input.summary.failed,
         skippedIntents: input.summary.skipped,
         receiptCount: input.results.filter((result) => result.receipt !== null).length,
+        gapCount: input.report.gaps.length,
         sourceAnchorRiskCount: input.sourceAnchorRiskCount,
         scopeDiffRiskCount: input.scopeDiffRiskCount,
         repeatedFailureCount: input.repeatedFailureRisks.length,

package/dist/cli/lib/git-changes.js

@@ -33,7 +33,17 @@ export function readGitChangedFiles(projectRoot) {
             stderr,
         };
     }
-    return { ok: true, files: parseGitStatusOutput(result.stdout) };
+    try {
+        return { ok: true, files: parseGitStatusOutput(result.stdout) };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            message: error instanceof Error ? error.message : String(error),
+            status: result.status,
+            stderr: '',
+        };
+    }
 }
 export function requireGitChangedFiles(projectRoot) {
     const result = readGitChangedFiles(projectRoot);

package/dist/cli/lib/i18n.js

@@ -24,7 +24,7 @@ function interpolate(template, params) {
     });
 }
 export function t(lang, key, params = {}) {
-    return interpolate(MESSAGE_CATALOGS[lang][key] ?? enMessages[key], params);
+    return interpolate(MESSAGE_CATALOGS[lang][key] ?? enMessages[key] ?? key, params);
 }
 export function localeMessage(locale, key, params = {}) {
     return t(isCliLang(locale) ? locale : DEFAULT_CLI_LANG, key, params);

package/dist/cli/lib/local-index/index.js

@@ -310,10 +310,14 @@ export async function createLocalIndex(projectRoot, options = {}) {
     }
     if (!dryRun && !reusedExisting) {
         const database = new SQL.Database();
-        createSchema(database, capabilities);
-        populateDatabase(database, capabilities, documents, skills, skillRoutes, commandIntents, sourceAnchors, indexedFiles, verificationEvidence, indexMode, sourceScopeHash, includeSource, new Date().toISOString());
-        writeFileInsideWithoutSymlinks(projectRoot, databasePath, database.export());
-        database.close();
+        try {
+            createSchema(database, capabilities);
+            populateDatabase(database, capabilities, documents, skills, skillRoutes, commandIntents, sourceAnchors, indexedFiles, verificationEvidence, indexMode, sourceScopeHash, includeSource, new Date().toISOString());
+            writeFileInsideWithoutSymlinks(projectRoot, databasePath, database.export());
+        }
+        finally {
+            database.close();
+        }
     }
     return {
         schema_version: LOCAL_INDEX_SCHEMA_VERSION,

package/dist/cli/lib/local-index/populate.js

@@ -46,11 +46,25 @@ function populatePathSurfaceReadModel(database) {
         insertPathSurfaceReasons(database, rule.id, 'drift_check', rule.surface.driftChecks);
     }
 }
+function readDocumentTermsByPath(database) {
+    const termsByPath = new Map();
+    for (const row of queryRows(database, 'SELECT document_path, term FROM document_terms ORDER BY document_path, term')) {
+        const documentPath = toSearchString(row.document_path);
+        const term = toSearchString(row.term);
+        const terms = termsByPath.get(documentPath);
+        if (terms) {
+            terms.push(term);
+        }
+        else {
+            termsByPath.set(documentPath, [term]);
+        }
+    }
+    return termsByPath;
+}
 function populateSearchTables(database, capabilities, documents, skills, skillRoutes, commandIntents, sourceAnchors) {
+    const documentTermsByPath = readDocumentTermsByPath(database);
     for (const document of documents) {
-        const documentTerms = queryRows(database, 'SELECT term FROM document_terms WHERE document_path = ? ORDER BY term', [
-            document.path,
-        ]).map((row) => toSearchString(row.term));
+        const documentTerms = documentTermsByPath.get(document.path) ?? [];
         insertSearchNgrams(database, 'document', document.path, [
             document.path,
             document.type,

package/dist/cli/lib/local-index/search-read-model.js

@@ -299,6 +299,7 @@ function collectBoundedDirectSearchDocuments(projectRoot) {
 }
 function searchLocalWorkflowFilesDirectly(projectRoot, databasePath, normalizedQuery, limit, scope) {
     const cacheLayers = readCacheLayerSets(projectRoot);
+    const querySnippetNgrams = buildSearchNgrams([normalizedQuery]);
     const results = [];
     if (scope === 'workflow' || scope === 'all') {
         const documents = collectBoundedDirectSearchDocuments(projectRoot);
@@ -322,7 +323,7 @@ function searchLocalWorkflowFilesDirectly(projectRoot, databasePath, normalizedQ
                 title: document.title,
                 document_type: document.type,
                 ...workflowAuthorityForDocument(document.type),
-                match: getMatchSnippet(fields, normalizedQuery),
+                match: getMatchSnippet(fields, normalizedQuery, querySnippetNgrams),
                 score: scoreMatch(primaryFields, secondaryFields, normalizedQuery),
             }, cacheLayers));
         }
@@ -337,7 +338,7 @@ function searchLocalWorkflowFilesDirectly(projectRoot, databasePath, normalizedQ
                 path: skill.path,
                 title: skill.title,
                 ...skillAuthority(),
-                match: getMatchSnippet(fields, normalizedQuery),
+                match: getMatchSnippet(fields, normalizedQuery, querySnippetNgrams),
                 score: scoreMatch(fields, [], normalizedQuery),
             }, cacheLayers));
         }
@@ -393,6 +394,7 @@ export async function searchLocalIndex(projectRoot, query, options = {}) {
         const stalePaths = getStalePaths(projectRoot, database);
         capabilities = readStoredSearchCapabilities(database);
         const indexedMatches = getIndexedSearchMatches(database, normalizedQuery);
+        const querySnippetNgrams = buildSearchNgrams([normalizedQuery]);
         if (stalePaths.length > 0) {
             throw new Error(`Local mustflow index is stale: ${stalePaths.join(', ')}. Run \`mf index\` before searching. Refresh command: mf index`);
         }
@@ -419,7 +421,7 @@ export async function searchLocalIndex(projectRoot, query, options = {}) {
                     title,
                     document_type: typeValue,
                     ...workflowAuthorityForDocument(typeValue),
-                    match: getMatchSnippet(fields, normalizedQuery),
+                    match: getMatchSnippet(fields, normalizedQuery, querySnippetNgrams),
                     score: scoreIndexedOrTableScan(primaryFields, secondaryFields, normalizedQuery, indexedMatches, indexedMatches.documents, pathValue),
                 }, cacheLayers));
             }
@@ -437,7 +439,7 @@ export async function searchLocalIndex(projectRoot, query, options = {}) {
                     path: pathValue,
                     title,
                     ...skillAuthority(),
-                    match: getMatchSnippet(fields, normalizedQuery),
+                    match: getMatchSnippet(fields, normalizedQuery, querySnippetNgrams),
                     score: scoreIndexedOrTableScan([name, pathValue, title], [], normalizedQuery, indexedMatches, indexedMatches.skills, name),
                 }, cacheLayers));
             }
@@ -468,7 +470,7 @@ export async function searchLocalIndex(projectRoot, query, options = {}) {
                     route_risk: risk,
                     verification_intents: verificationIntents,
                     ...skillAuthority(),
-                    match: getMatchSnippet(fields, normalizedQuery),
+                    match: getMatchSnippet(fields, normalizedQuery, querySnippetNgrams),
                     score: indexedRouteMatch
                         ? Math.max(scoreMatch(primaryFields, secondaryFields, normalizedQuery), 20)
                         : scoreMatch(primaryFields, secondaryFields, normalizedQuery),
@@ -502,7 +504,7 @@ export async function searchLocalIndex(projectRoot, query, options = {}) {
                     effect_paths: effectPaths,
                     effect_modes: effectModes,
                     ...commandIntentAuthority(),
-                    match: getMatchSnippet(fields, normalizedQuery),
+                    match: getMatchSnippet(fields, normalizedQuery, querySnippetNgrams),
                     score: scoreIndexedOrTableScan(primaryFields, secondaryFields, normalizedQuery, indexedMatches, indexedMatches.commandIntents, name),
                 }, cacheLayers));
             }
@@ -532,7 +534,7 @@ export async function searchLocalIndex(projectRoot, query, options = {}) {
                     ...sourceAnchorAuthority(),
                     stale_status: toSearchString(row.status),
                     stale_confidence: Number(row.confidence),
-                    match: getMatchSnippet(fields, normalizedQuery),
+                    match: getMatchSnippet(fields, normalizedQuery, querySnippetNgrams),
                     score: scoreIndexedOrTableScan(primaryFields, secondaryFields, normalizedQuery, indexedMatches, indexedMatches.sourceAnchors, id),
                 }, cacheLayers));
             }

package/dist/cli/lib/local-index/search-text.js

@@ -28,13 +28,13 @@ export function buildSearchNgrams(values) {
     }
     return [...grams].sort((left, right) => left.localeCompare(right));
 }
-export function getMatchSnippet(fields, query) {
+export function getMatchSnippet(fields, query, queryNgrams = buildSearchNgrams([query])) {
     const normalized = normalizeSearchText(fields.join(' '));
     const lower = normalized.toLowerCase();
     let start = lower.indexOf(query.toLowerCase());
     let matchLength = query.length;
     if (start === -1) {
-        const [firstGram] = buildSearchNgrams([query]).filter((gram) => lower.includes(gram));
+        const firstGram = queryNgrams.find((gram) => lower.includes(gram));
         if (!firstGram) {
             return truncateSearchMatchSnippet(normalized);
         }

package/dist/cli/lib/local-index/workflow-documents.js

@@ -65,12 +65,27 @@ function parseFrontmatter(content) {
     if (!content.startsWith('---')) {
         return {};
     }
-    const end = content.indexOf('\n---', 3);
+    const firstLineEnd = content.indexOf('\n');
+    if (firstLineEnd === -1) {
+        return {};
+    }
+    let end = -1;
+    let lineStart = firstLineEnd + 1;
+    while (lineStart < content.length) {
+        const lineEnd = content.indexOf('\n', lineStart);
+        const nextLineStart = lineEnd === -1 ? content.length : lineEnd + 1;
+        const line = content.slice(lineStart, lineEnd === -1 ? content.length : lineEnd).replace(/\r$/u, '');
+        if (line.trim() === '---') {
+            end = lineStart;
+            break;
+        }
+        lineStart = nextLineStart;
+    }
     if (end === -1) {
         return {};
     }
     const result = {};
-    const rawFrontmatter = content.slice(3, end);
+    const rawFrontmatter = content.slice(firstLineEnd + 1, end);
     for (const line of rawFrontmatter.split(/\r?\n/)) {
         const separatorIndex = line.indexOf(':');
         if (separatorIndex === -1) {

package/dist/cli/lib/mustflow-read.js

@@ -5,7 +5,13 @@ export const MUSTFLOW_TEXT_MAX_BYTES = 1024 * 1024;
 export const MUSTFLOW_TOML_MAX_BYTES = 256 * 1024;
 export const MUSTFLOW_JSON_MAX_BYTES = 1024 * 1024;
 export function mustflowProjectPath(projectRoot, relativePath) {
-    return path.join(projectRoot, ...relativePath.split('/'));
+    const normalizedRoot = path.resolve(projectRoot);
+    const resolvedPath = path.resolve(normalizedRoot, ...relativePath.split('/'));
+    const relative = path.relative(normalizedRoot, resolvedPath);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`Path escapes mustflow project root: ${relativePath}`);
+    }
+    return resolvedPath;
 }
 function missingPath(error) {
     return error instanceof Error && 'code' in error && error.code === 'ENOENT';
@@ -14,7 +20,13 @@ export function readMustflowTextFile(projectRoot, relativePath, options = {}) {
     return readUtf8FileInsideWithoutSymlinks(projectRoot, mustflowProjectPath(projectRoot, relativePath), { maxBytes: options.maxBytes ?? MUSTFLOW_TEXT_MAX_BYTES });
 }
 export function readMustflowTextFileResult(projectRoot, relativePath, options = {}) {
-    const filePath = mustflowProjectPath(projectRoot, relativePath);
+    let filePath;
+    try {
+        filePath = mustflowProjectPath(projectRoot, relativePath);
+    }
+    catch (error) {
+        return { ok: false, exists: false, error: error instanceof Error ? error.message : String(error) };
+    }
     if (!existsSync(filePath)) {
         return { ok: false, exists: false, error: null };
     }

package/dist/cli/lib/npm-version-check.js

@@ -150,6 +150,42 @@ function buildLatestPackageUrl(registryUrl, packageName) {
         : encodeURIComponent(packageName);
     return `${trimmedRegistryUrl}/${encodedPackageName}/latest`;
 }
+function buildPackageMetadataUrl(registryUrl, packageName) {
+    const trimmedRegistryUrl = registryUrl.replace(/\/+$/u, '');
+    const encodedPackageName = packageName.startsWith('@')
+        ? `@${encodeURIComponent(packageName.slice(1))}`
+        : encodeURIComponent(packageName);
+    return `${trimmedRegistryUrl}/${encodedPackageName}`;
+}
+export async function checkNpmPackageExists(packageName) {
+    const registryUrl = getRegistryUrl();
+    const response = await fetch(buildPackageMetadataUrl(registryUrl, packageName), {
+        headers: { accept: 'application/json' },
+        signal: AbortSignal.timeout(getTimeoutMs()),
+    });
+    if (response.status === 404) {
+        return {
+            packageName,
+            registryUrl,
+            exists: false,
+            resolvedName: null,
+        };
+    }
+    if (!response.ok) {
+        throw new Error(`npm registry returned HTTP ${response.status}`);
+    }
+    const body = await response.json();
+    const resolvedName = isRecord(body) && typeof body.name === 'string' ? body.name : null;
+    if (!resolvedName) {
+        throw new Error('npm registry response did not include a package name');
+    }
+    return {
+        packageName,
+        registryUrl,
+        exists: true,
+        resolvedName,
+    };
+}
 export async function checkNpmLatestVersion(metadata) {
     const registryUrl = getRegistryUrl();
     const response = await fetch(buildLatestPackageUrl(registryUrl, metadata.name), {

package/dist/cli/lib/repo-map.js

@@ -193,6 +193,14 @@ const EXACT_ANCHOR_DESCRIPTIONS = new Map([
     ['.mustflow/docs/agent-workflow.md', 'Shared workflow policy for agent work.'],
     ['.mustflow/skills/INDEX.md', 'Index of available procedural skills.'],
 ]);
+function spawnGitLsFiles(command, args, options) {
+    const result = spawnSync(command, [...args], options);
+    return {
+        status: result.status,
+        error: result.error,
+        stdout: result.stdout,
+    };
+}
 function getStringArray(value) {
     return Array.isArray(value) ? value.filter((entry) => typeof entry === 'string') : [];
 }
@@ -250,8 +258,7 @@ function classifyGitLsFilesFailure(result) {
     return 'error';
 }
 export function discoverGitFilesForRepoMap(projectRoot, options = {}) {
-    const spawnGit = options.spawnGit ??
-        ((command, args, spawnOptions) => spawnSync(command, [...args], spawnOptions));
+    const spawnGit = options.spawnGit ?? spawnGitLsFiles;
     const result = spawnGit('git', ['ls-files', '-z'], {
         cwd: projectRoot,
         encoding: 'utf8',
@@ -413,7 +420,13 @@ function renderDirectoryAnchors(anchors) {
     return lines;
 }
 function hasGitMarker(directoryPath) {
-    return existsSync(path.join(directoryPath, '.git'));
+    try {
+        const marker = lstatSync(path.join(directoryPath, '.git'));
+        return marker.isDirectory() || marker.isFile();
+    }
+    catch {
+        return false;
+    }
 }
 function isRealPathInside(parentRealPath, childRealPath) {
     const relative = path.relative(parentRealPath, childRealPath);

package/dist/cli/lib/templates.js

@@ -304,11 +304,12 @@ export function getTemplateFiles(template, locale = template.manifest.defaultLoc
         const commonPath = path.join(commonRoot, ...relativePath.split('/'));
         const localizedPath = localePath && existsSync(localePath) ? localePath : undefined;
         const fallbackLocalePath = sourceLocalePath && existsSync(sourceLocalePath) ? sourceLocalePath : undefined;
-        const indexSourcePath = localizedPath ?? fallbackLocalePath ?? commonPath;
-        const content = relativePath === '.mustflow/skills/INDEX.md'
-            ? filterSkillIndexContent(readFileSync(indexSourcePath, 'utf8'), selectedSkills)
-            : relativePath === '.mustflow/skills/routes.toml'
-                ? filterSkillRouteMetadataContent(readFileSync(indexSourcePath, 'utf8'), selectedSkills)
+        const commonSourcePath = existsSync(commonPath) ? commonPath : undefined;
+        const selectedSourcePath = localizedPath ?? fallbackLocalePath ?? commonSourcePath;
+        const content = selectedSourcePath && relativePath === '.mustflow/skills/INDEX.md'
+            ? filterSkillIndexContent(readFileSync(selectedSourcePath, 'utf8'), selectedSkills)
+            : selectedSourcePath && relativePath === '.mustflow/skills/routes.toml'
+                ? filterSkillRouteMetadataContent(readFileSync(selectedSourcePath, 'utf8'), selectedSkills)
                 : undefined;
         if (localizedPath) {
             return {
@@ -326,10 +327,10 @@ export function getTemplateFiles(template, locale = template.manifest.defaultLoc
                 content,
             };
         }
-        if (existsSync(commonPath)) {
+        if (commonSourcePath) {
             return {
                 relativePath,
-                sourcePath: commonPath,
+                sourcePath: commonSourcePath,
                 sourceKind: template.manifest.localesRoot ? 'common' : 'legacy',
                 content,
             };

package/dist/cli/lib/validation/constants.js

@@ -172,7 +172,7 @@ export const ALLOWED_TRANSLATION_POLICIES = new Set([
     'update_source_mark_targets_stale',
     'machine_translate_requires_review',
 ]);
-export const RAW_COMMAND_FENCE_PATTERN = /```(?:sh|bash|shell|zsh|powershell|ps1|cmd)\s+[\s\S]*?```/giu;
+export const RAW_COMMAND_FENCE_PATTERN = /```(?:sh|bash|shell|zsh|powershell|ps1|cmd)\s+[\s\S]*?```/iu;
 export const SKILL_COMMAND_PERMISSION_CLAIM_PATTERNS = [
     /\b(?:this\s+skill|skill\s+documents?|skills?)\s+(?:authorizes?|grants?|allows?|permits?)\s+(?:agents?\s+)?(?:to\s+)?(?:run|execute)\b/iu,
     /\b(?:agents?\s+)?(?:may|can|are\s+allowed\s+to|is\s+allowed\s+to|is\s+permitted\s+to|have\s+permission\s+to)\s+(?:run|execute)\s+(?:raw\s+)?(?:shell\s+)?commands?\b/iu,