mustflow 2.75.2 → 2.85.4

package/README.md

@@ -127,8 +127,16 @@ mustflow installs and validates an agent workflow for user projects.
 - Reports a read-only complexity budget in `mf api diff-risk --changed --json`, `mf verify`
   evidence, and dashboard exports so agents justify new dependencies, helper-style surfaces,
   config/schema churn, and broad structural changes before treating added complexity as free.
-- Lists and runs bundled utility scripts through `mf script-pack`, including `core/text-budget` for
-  exact file and JSON-field length budgets, so future checks do not sprawl into top-level commands.
+- Lists, suggests, and runs bundled read-only utility scripts through `mf script-pack`, including
+  `code/outline` for source symbol maps, `code/dependency-graph` for bounded relative import graphs,
+  `code/change-impact` for git-diff impact and verification hints, `code/symbol-read` for focused source snippets,
+  `code/route-outline` for Hono, Elysia, Axum, and NestJS route maps, `docs/reference-drift` for stale
+  documentation references, `repo/config-chain` for nearby config inheritance,
+  `repo/env-contract` for environment-variable contract drift,
+  `repo/secret-risk-scan` for plausible hardcoded-secret findings without printing values,
+  `repo/generated-boundary` for candidate path safety checks, and `core/text-budget`
+  for exact file and JSON-field length budgets, so future checks do not sprawl into top-level
+  commands.
 - Prints context trust metadata in `mf context --json` and prompt-cache bundles so agents can distinguish binding instructions, command contracts, contextual hints, generated evidence, and volatile runtime data before using them.
 - Runs only allowed one-shot commands within a timeout via `mf run <intent>` or `mf verify` when the selected intent is runnable.
 - Records blockers, contradictions, verification gaps, and remaining risks as a structured conflict ledger in verify, evidence, and dashboard reports.
@@ -283,7 +291,22 @@ mf run mustflow_update_apply
 | `mf map --write` | Create or update `REPO_MAP.md`. |
 | `mf quality check` | Inspect changed files for quality-gaming patterns without writing files. |
 | `mf quality check --all` | Inspect every tracked text file for quality-gaming patterns. |
-| `mf script-pack list` | List bundled script packs and script refs such as `core/text-budget`. |
+| `mf script-pack list` | List bundled script packs, script refs, routing hints, side-effect flags, input/output labels, and JSON schema files. |
+| `mf script-pack suggest --changed --json` | Rank optional read-only helpers for current changed files without running those helpers or granting command authority. |
+| `mf script-pack suggest --path <path> --phase before_change` | Rank helpers for an explicit path and workflow phase before deciding which script to run. |
+| `mf script-pack run code/outline scan <path...> --json` | Scan supported source files for symbol headers, line ranges, source anchors, return metadata, and content hashes. |
+| `mf script-pack run code/dependency-graph scan <path...> --json` | Trace bounded relative import, export, require, and dynamic import edges for TypeScript and JavaScript source files. |
+| `mf script-pack run code/change-impact analyze --base HEAD --json` | Analyze changed files and return bounded impact candidates, script-pack hints, and verification intent hints. |
+| `mf script-pack run code/symbol-read read <path> --start-line <line> --json` | Read the focused symbol range or bounded source snippet after `code/outline` identifies the relevant location. |
+| `mf script-pack run code/symbol-read read --anchor <id> --json` | Read the conservative target symbol for a structured `mf:anchor` source marker. |
+| `mf script-pack run code/route-outline scan <path...> --json` | Scan Hono, Elysia, Axum, and NestJS files for route methods, paths, handlers, lifecycle chains, line ranges, and content hashes. |
+| `mf script-pack run code/export-diff compare --base HEAD --json` | Compare exported TypeScript or JavaScript declarations, return metadata, and package surface hints against a git base. |
+| `mf script-pack run docs/reference-drift check [path...] --json` | Check documentation references to `mf` commands, script-pack refs, schema files, and repository paths against current local surfaces. |
+| `mf script-pack run repo/config-chain inspect <path...> --json` | Inspect nearby package, TypeScript, ESLint, Vite, Tailwind, test, and mustflow config files plus static inheritance edges without executing dynamic config code. |
+| `mf script-pack run repo/env-contract scan [path...] --json` | Scan code, CI, docs, config, and env examples for environment-variable contract drift without reading or printing real secret env values. |
+| `mf script-pack run repo/secret-risk-scan scan [path...] --json` | Scan code, docs, config, CI, and examples for plausible hardcoded secrets while reporting only redacted fingerprints. |
+| `mf script-pack run repo/generated-boundary check <path...> --json` | Check whether candidate paths cross generated, ignored, protected, vendor, or cache boundaries before or after edits. |
+| `mf script-pack run repo/related-files map <path...> --json` | Map direct imports, importers, same-basename siblings, and nearby config or package boundaries for source navigation. |
 | `mf script-pack run core/text-budget check <path...> --max <count>` | Check exact text length budgets for files using grapheme counts by default. |
 | `mf script-pack run core/text-budget check package.json --json-pointer /description --max <count> --json` | Check a JSON string field and print the stable report schema. |
 | `mf run <intent>` | Run an allowed one-shot command. |
@@ -311,6 +334,20 @@ mf run mustflow_update_apply
 
 Automation and agents should use `--json` output or `mf api serve --stdio` JSONL responses instead of parsing human-facing text. Published JSON Schemas for stable outputs live in `schemas/`.
 
+For script-pack helper selection, start with `mf script-pack suggest --changed --json` or an
+explicit `--path`. The suggestion report is only a ranking aid: it does not run scripts, prove
+verification, or bypass `.mustflow/config/commands.toml`. A common source-orientation flow is
+`code/outline` first, `code/dependency-graph` for relative import impact, then `code/symbol-read`
+for the chosen symbol line or source anchor. After a local diff exists, use `code/change-impact`
+to summarize changed surfaces, likely related files, optional helper scripts, and verification hints. After
+public-ish TypeScript or JavaScript changes, use `code/export-diff` to review exported signatures
+and return metadata against a git base. After docs, schema, CLI, or script-pack surface changes, use
+`docs/reference-drift` to catch stale references before treating docs as synchronized. For
+config-sensitive source or test work, use `repo/config-chain` before assuming effective inherited
+rules. For generated or protected paths, use `repo/generated-boundary` before editing or when
+reviewing a changed-file set. See the full
+[`mf script-pack` documentation](https://0disoft.github.io/mustflow/commands/script-pack/).
+
 `core/text-budget` counts `line` units by splitting text on line breaks; a trailing line break
 therefore contributes an empty final line.
 

package/dist/cli/commands/docs.js

@@ -3,11 +3,13 @@ import path from 'node:path';
 import { printUsageError, renderCliError, renderHelp } from '../lib/cli-output.js';
 import { DOC_REVIEW_LEDGER_RELATIVE_PATH, DOC_REVIEW_STATUSES, REVIEWER_KINDS, addDocReviewEntry, commentDocReviewEntry, isReviewerKind, listDocReviewEntries, markDocReviewEntry, } from '../lib/doc-review-ledger.js';
 import { ensureInside, readUtf8FileInsideWithoutSymlinks } from '../lib/filesystem.js';
+import { GitChangedFilesError, requireGitChangedFiles } from '../lib/git-changes.js';
 import { t } from '../lib/i18n.js';
 import { getParsedCliStringOption, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
 import { resolveMustflowRoot } from '../lib/project-root.js';
 const LIST_FLAGS = new Set(['--json', '--all']);
 const LIST_VALUE_OPTIONS = new Set(['--status']);
+const ADD_FLAGS = new Set(['--changed']);
 const ADD_VALUE_OPTIONS = new Set(['--reason', '--origin', '--actor-kind', '--actor-id', '--comment', '--comment-file']);
 const COMMENT_VALUE_OPTIONS = new Set(['--comment', '--comment-file', '--actor-kind', '--actor-id']);
 const REVIEW_VALUE_OPTIONS = new Set([
@@ -27,6 +29,7 @@ export function getDocsHelp(lang = 'en') {
             { label: '--json', description: t(lang, 'cli.option.json') },
             { label: '--all', description: t(lang, 'docs.help.option.all') },
             { label: '--status <status>', description: t(lang, 'docs.help.option.status') },
+            { label: '--changed', description: t(lang, 'docs.help.option.changed') },
             { label: '--reason <text>', description: t(lang, 'docs.help.option.reason') },
             { label: '--origin <value>', description: t(lang, 'docs.help.option.origin') },
             { label: '--actor-kind <kind>', description: t(lang, 'docs.help.option.actorKind') },
@@ -41,6 +44,7 @@ export function getDocsHelp(lang = 'en') {
         examples: [
             'mf docs review list',
             'mf docs review add docs/guide.md --reason llm_modified --actor-kind llm --actor-id codex',
+            'mf docs review add --changed --actor-kind llm --actor-id codex',
             'mf docs review comment docs/guide.md --comment-file review-note.md --actor-kind human --actor-id cherr',
             'mf docs review approve docs/guide.md --reviewer-kind llm --reviewer-id opencode --summary "Rewritten for natural tone."',
         ],
@@ -183,6 +187,19 @@ function renderEntries(entries, lang) {
 function renderEntryAction(action, path, lang) {
     return `${t(lang, 'docs.review.wrote')}: ${DOC_REVIEW_LEDGER_RELATIVE_PATH}\n${action}: ${path}`;
 }
+function renderChangedAddAction(paths, lang) {
+    if (paths.length === 0) {
+        return t(lang, 'docs.review.changed.none');
+    }
+    const lines = [
+        `${t(lang, 'docs.review.wrote')}: ${DOC_REVIEW_LEDGER_RELATIVE_PATH}`,
+        t(lang, 'docs.review.changed.added', { count: paths.length }),
+    ];
+    for (const path of paths) {
+        lines.push(`- ${path}`);
+    }
+    return lines.join('\n');
+}
 function getMarkedAction(status, lang) {
     if (status === 'approved') {
         return t(lang, 'docs.review.marked.approved');
@@ -196,6 +213,43 @@ function usageError(reporter, message, lang) {
     printUsageError(reporter, message, 'mf docs --help', getDocsHelp(lang), lang);
     return 1;
 }
+function normalizeChangedDocumentPath(relativePath) {
+    return relativePath.replace(/\\/gu, '/').replace(/^\.\//u, '');
+}
+function isChangedDocReviewPath(relativePath) {
+    const normalized = normalizeChangedDocumentPath(relativePath);
+    if (['AGENTS.md', 'CHANGELOG.md', 'README.md'].includes(normalized)) {
+        return true;
+    }
+    if (normalized === 'schemas/README.md') {
+        return true;
+    }
+    if (/^\.mustflow\/(?:context|docs)\/.+\.md$/u.test(normalized)) {
+        return true;
+    }
+    if (/^\.mustflow\/skills\/(?:INDEX\.md|[^/]+\/SKILL\.md)$/u.test(normalized)) {
+        return true;
+    }
+    if (/^docs-site\/src\/content\/docs\/.+\.md$/u.test(normalized)) {
+        return true;
+    }
+    if (/^templates\/default\/locales\/[^/]+\/AGENTS\.md$/u.test(normalized)) {
+        return true;
+    }
+    if (/^templates\/default\/locales\/[^/]+\/\.mustflow\/(?:context|docs)\/.+\.md$/u.test(normalized)) {
+        return true;
+    }
+    if (/^templates\/default\/locales\/[^/]+\/\.mustflow\/skills\/(?:INDEX\.md|[^/]+\/SKILL\.md)$/u.test(normalized)) {
+        return true;
+    }
+    if (/^templates\/default\/common\/\.mustflow\/(?:context|docs)\/.+\.md$/u.test(normalized)) {
+        return true;
+    }
+    if (/^tests\/fixtures\/.+\.md$/u.test(normalized)) {
+        return true;
+    }
+    return false;
+}
 function runReviewList(args, reporter, lang) {
     const parsed = parseOptions(args, LIST_VALUE_OPTIONS, LIST_FLAGS);
     if (parsed.error) {
@@ -236,15 +290,22 @@ function runReviewList(args, reporter, lang) {
  * risk: state, data_consistency
  */
 function runReviewAdd(args, reporter, lang) {
-    const parsed = parseOptions(args, ADD_VALUE_OPTIONS, new Set());
+    const parsed = parseOptions(args, ADD_VALUE_OPTIONS, ADD_FLAGS);
     if (parsed.error) {
         const message = parsed.error.missingValue
             ? t(lang, 'cli.error.missingValue', { option: parsed.error.option })
             : t(lang, 'cli.error.unknownOption', { option: parsed.error.option });
         return usageError(reporter, message, lang);
     }
+    const addChanged = parsed.flags.has('--changed');
     const [documentPath, unexpected] = parsed.positionals;
-    if (!documentPath) {
+    if (addChanged && documentPath) {
+        return usageError(reporter, t(lang, 'docs.error.changedPathConflict'), lang);
+    }
+    if (addChanged && (parsed.values.has('--comment') || parsed.values.has('--comment-file'))) {
+        return usageError(reporter, t(lang, 'docs.error.changedCommentConflict'), lang);
+    }
+    if (!addChanged && !documentPath) {
         return usageError(reporter, t(lang, 'docs.error.missingPath'), lang);
     }
     if (unexpected) {
@@ -255,6 +316,29 @@ function runReviewAdd(args, reporter, lang) {
         return usageError(reporter, t(lang, 'docs.error.invalidReviewerKind', { kinds: REVIEWER_KINDS.join(', ') }), lang);
     }
     const projectRoot = resolveMustflowRoot();
+    if (addChanged) {
+        let changedPaths;
+        try {
+            changedPaths = requireGitChangedFiles(projectRoot);
+        }
+        catch (error) {
+            if (error instanceof GitChangedFilesError) {
+                reporter.stderr(renderCliError(t(lang, 'docs.error.changedFilesUnavailable', { message: error.result.message }), 'mf docs --help', lang));
+                return 1;
+            }
+            throw error;
+        }
+        const reviewPaths = changedPaths.map(normalizeChangedDocumentPath).filter(isChangedDocReviewPath);
+        const entries = reviewPaths.map((changedPath) => addDocReviewEntry(projectRoot, {
+            path: changedPath,
+            reason: parsed.values.get('--reason'),
+            origin: parsed.values.get('--origin'),
+            actorKind,
+            actorId: parsed.values.get('--actor-id'),
+        }));
+        reporter.stdout(renderChangedAddAction(entries.map((entry) => entry.path), lang));
+        return 0;
+    }
     const commentResult = readReviewComment(projectRoot, parsed, lang);
     if (commentResult.error) {
         return usageError(reporter, commentResult.error, lang);

package/dist/cli/commands/script-pack.js

@@ -62,9 +62,18 @@ export function getScriptPackHelp(lang = 'en') {
             'mf script-pack suggest --path src/cli/index.ts --phase before_change',
             'mf script-pack suggest --changed --phase after_change --json',
             'mf script-pack run code/outline scan src --json',
+            'mf script-pack run code/dependency-graph scan src/cli/index.ts --json',
+            'mf script-pack run code/change-impact analyze --base HEAD --json',
             'mf script-pack run code/symbol-read read src/cli/index.ts --start-line 25 --json',
+            'mf script-pack run code/route-outline scan src/cli/index.ts --json',
+            'mf script-pack run code/export-diff compare --base HEAD~1 --head HEAD --json',
             'mf script-pack run core/text-budget check README.md --max 5000',
+            'mf script-pack run docs/reference-drift check README.md schemas/README.md --json',
+            'mf script-pack run repo/config-chain inspect src/cli/index.ts --json',
+            'mf script-pack run repo/env-contract scan --json',
+            'mf script-pack run repo/secret-risk-scan scan src README.md --json',
             'mf script-pack run repo/generated-boundary check src/cli/index.ts --json',
+            'mf script-pack run repo/related-files map src/cli/index.ts --json',
             'mf script-pack run core/text-budget --help',
         ],
         exitCodes: [

package/dist/cli/i18n/en.js

@@ -585,6 +585,7 @@ export const enMessages = {
     "docs.help.summary": "Track documents that need prose review after LLM creation or modification.",
     "docs.help.option.all": "Include approved and ignored documents",
     "docs.help.option.status": "Filter by review status",
+    "docs.help.option.changed": "Add all currently changed documentation review candidates from git status",
     "docs.help.option.reason": "Record why the document needs review",
     "docs.help.option.origin": "Record the source of the review need, such as llm_modified",
     "docs.help.option.actorKind": "Record who changed the document: human, llm, tool, or external",
@@ -600,6 +601,8 @@ export const enMessages = {
     "docs.review.empty": "No documents require review.",
     "docs.review.wrote": "Wrote",
     "docs.review.added": "Added",
+    "docs.review.changed.none": "No changed documents require review.",
+    "docs.review.changed.added": "Added changed documents: {count}",
     "docs.review.commented": "Commented",
     "docs.review.marked.approved": "Approved",
     "docs.review.marked.needs_human": "Marked as needs_human",
@@ -612,6 +615,9 @@ export const enMessages = {
     "docs.error.emptyComment": "Review comment must not be empty",
     "docs.error.commentSourceConflict": "Use either --comment or --comment-file, not both",
     "docs.error.commentFileIsDocument": "--comment-file must not point to the document being reviewed",
+    "docs.error.changedPathConflict": "Use --changed without a document path",
+    "docs.error.changedCommentConflict": "Use --changed without --comment or --comment-file",
+    "docs.error.changedFilesUnavailable": "Could not inspect changed files with git status: {message}",
     "docs.error.invalidStatus": "Invalid review status. Use one of: {statuses}",
     "docs.error.invalidReviewerKind": "Invalid reviewer kind. Use one of: {kinds}",
     "docs.error.missingReviewerKind": "Missing --reviewer-kind. Use one of: {kinds}",
@@ -765,11 +771,19 @@ Read these files before working:
     "scriptPack.suggest.empty": "No script-pack suggestions matched the supplied paths, skills, or phases.",
     "scriptPack.pack.code.summary": "Source-code orientation utility scripts",
     "scriptPack.pack.core.summary": "Core built-in utility scripts",
+    "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
     "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
-    "scriptPack.script.codeSymbolRead.summary": "Read a bounded source snippet by symbol line or explicit line range",
+    "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
+    "scriptPack.script.codeChangeImpact.summary": "Analyze changed files for impact, script-pack, and verification hints",
+    "scriptPack.script.codeSymbolRead.summary": "Read a bounded source snippet by source anchor, symbol line, or explicit line range",
+    "scriptPack.script.codeRouteOutline.summary": "Scan Hono, Elysia, Axum, and NestJS route methods, paths, handlers, and lifecycle chains",
+    "scriptPack.script.codeExportDiff.summary": "Compare exported source signatures and return metadata across git refs",
     "scriptPack.script.textBudget.summary": "Check exact text length budgets for files or JSON string fields",
+    "scriptPack.script.referenceDrift.summary": "Check documented command, script-pack, schema, and path references for drift",
+    "scriptPack.script.configChain.summary": "Inspect nearby config files and static config inheritance",
     "scriptPack.script.generatedBoundary.summary": "Check whether candidate paths cross generated, ignored, protected, vendor, or cache boundaries",
+    "scriptPack.script.relatedFiles.summary": "Map likely related files for source-oriented repository navigation",
     "scriptPack.label.script": "Script",
     "scriptPack.label.actions": "actions",
     "scriptPack.label.schema": "schema",
@@ -796,7 +810,8 @@ Read these files before working:
     "codeOutline.error.missingPath": "Provide at least one source file or directory to scan",
     "codeOutline.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "codeOutline.error.invalidNonNegativeInteger": "{option} must be a non-negative safe integer: {value}",
-    "codeSymbolRead.help.summary": "Read a bounded TypeScript or JavaScript source snippet from a symbol line or explicit line range.",
+    "codeSymbolRead.help.summary": "Read a bounded TypeScript or JavaScript source snippet from a source anchor, symbol line, or explicit line range.",
+    "codeSymbolRead.help.option.anchor": "Source anchor id to resolve to its target symbol",
     "codeSymbolRead.help.option.startLine": "1-based source line to resolve to a symbol or range",
     "codeSymbolRead.help.option.endLine": "Optional explicit 1-based end line; when omitted, the containing outline symbol is read",
     "codeSymbolRead.help.option.contextLines": "Number of surrounding context lines to include. Default: 0",
@@ -813,6 +828,56 @@ Read these files before working:
     "codeSymbolRead.error.missingPath": "Provide exactly one source file to read",
     "codeSymbolRead.error.tooManyPaths": "Provide only one source file to read",
     "codeSymbolRead.error.missingStartLine": "Provide --start-line <line>",
+    "codeSymbolRead.error.anchorConflict": "Use either --anchor <id> or <path> with --start-line/--end-line, not both",
+    "codeRouteOutline.help.summary": "Scan Hono, Elysia, Axum, and NestJS route source files for method, path, handler, lifecycle, and line metadata.",
+    "codeRouteOutline.help.option.maxFiles": "Maximum number of source files to scan. Default: 200",
+    "codeRouteOutline.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 1048576",
+    "codeRouteOutline.help.exit.ok": "The route outline was scanned without findings",
+    "codeRouteOutline.help.exit.fail": "The route outline found invalid input, unreadable files, unsupported files, or scan limits",
+    "codeRouteOutline.title": "mustflow route outline",
+    "codeRouteOutline.label.files": "Files",
+    "codeRouteOutline.label.routes": "Routes",
+    "codeRouteOutline.label.findings": "Findings",
+    "codeRouteOutline.label.outline": "Route outline",
+    "codeRouteOutline.label.issues": "Issues",
+    "codeRouteOutline.clean": "No Hono, Elysia, Axum, or NestJS routes were found.",
+    "codeRouteOutline.error.missingAction": "Specify a route-outline action: scan",
+    "codeRouteOutline.error.unknownAction": "Unknown route-outline action: {action}",
+    "codeRouteOutline.error.missingPath": "Provide at least one source file or directory to scan",
+    "codeRouteOutline.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "exportDiff.help.summary": "Compare exported TS/JS signatures, return metadata, and package surface hints across a git base and head.",
+    "exportDiff.help.option.base": "Git base ref to compare from. Default: HEAD",
+    "exportDiff.help.option.head": "Git head ref to compare to. Omit to compare the base with the working tree.",
+    "exportDiff.help.option.maxFiles": "Maximum number of changed source files to inspect. Default: 100",
+    "exportDiff.help.option.maxFileBytes": "Maximum bytes to read from each source file snapshot. Default: 1048576",
+    "exportDiff.help.exit.ok": "The export diff completed without input errors",
+    "exportDiff.help.exit.fail": "The export diff could not read git input or exceeded configured limits",
+    "exportDiff.title": "mustflow export diff",
+    "exportDiff.label.files": "Files",
+    "exportDiff.label.added": "Added",
+    "exportDiff.label.removed": "Removed",
+    "exportDiff.label.changed": "Changed",
+    "exportDiff.label.exports": "Exports",
+    "exportDiff.label.findings": "Findings",
+    "exportDiff.label.issues": "Issues",
+    "exportDiff.clean": "No exported TypeScript or JavaScript declaration changes were found.",
+    "exportDiff.error.missingAction": "Specify an export-diff action: compare",
+    "exportDiff.error.unknownAction": "Unknown export-diff action: {action}",
+    "exportDiff.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "referenceDrift.help.summary": "Check documentation references against current mf commands, script-pack refs, schema files, and repository paths.",
+    "referenceDrift.help.option.maxFiles": "Maximum number of document files to inspect. Default: 200",
+    "referenceDrift.help.option.maxFileBytes": "Maximum bytes to read from each document file. Default: 524288",
+    "referenceDrift.help.exit.ok": "All checked documentation references resolved against current repository surfaces",
+    "referenceDrift.help.exit.fail": "A documentation reference was stale, missing, unknown, unreadable, or over a configured limit",
+    "referenceDrift.title": "mustflow reference drift",
+    "referenceDrift.label.files": "Files",
+    "referenceDrift.label.references": "References",
+    "referenceDrift.label.findings": "Findings",
+    "referenceDrift.label.issues": "Issues",
+    "referenceDrift.clean": "No documentation references were found.",
+    "referenceDrift.error.missingAction": "Specify a reference-drift action: check",
+    "referenceDrift.error.unknownAction": "Unknown reference-drift action: {action}",
+    "referenceDrift.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "textBudget.help.summary": "Check exact text length budgets for files or JSON string fields using grapheme counts by default.",
     "textBudget.help.option.min": "Require at least this many units",
     "textBudget.help.option.max": "Require at most this many units",
@@ -849,6 +914,119 @@ Read these files before working:
     "generatedBoundary.error.missingAction": "Specify a generated-boundary action: check",
     "generatedBoundary.error.unknownAction": "Unknown generated-boundary action: {action}",
     "generatedBoundary.error.missingPath": "Provide at least one path to check",
+    "dependencyGraph.help.summary": "Trace bounded relative import, export, require, and dynamic import edges for TypeScript and JavaScript source files.",
+    "dependencyGraph.help.option.maxDepth": "Maximum dependency depth from target files. Default: 2",
+    "dependencyGraph.help.option.maxFiles": "Maximum number of source files to scan. Default: 1000",
+    "dependencyGraph.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
+    "dependencyGraph.help.option.maxNodes": "Maximum number of graph nodes to report. Default: 300",
+    "dependencyGraph.help.option.maxEdges": "Maximum number of graph edges to report. Default: 800",
+    "dependencyGraph.help.exit.ok": "The dependency graph completed without input or scan-limit findings",
+    "dependencyGraph.help.exit.fail": "The dependency graph found invalid input, unreadable paths, or scan limits",
+    "dependencyGraph.title": "mustflow dependency graph",
+    "dependencyGraph.label.targets": "Targets",
+    "dependencyGraph.label.nodes": "Nodes",
+    "dependencyGraph.label.edges": "Edges",
+    "dependencyGraph.label.cycles": "Cycles",
+    "dependencyGraph.label.truncated": "Truncated",
+    "dependencyGraph.label.cycleList": "Cycle hints",
+    "dependencyGraph.label.findings": "Findings",
+    "dependencyGraph.label.issues": "Issues",
+    "dependencyGraph.clean": "No relative dependency edges were found.",
+    "dependencyGraph.error.missingAction": "Specify a dependency-graph action: scan",
+    "dependencyGraph.error.unknownAction": "Unknown dependency-graph action: {action}",
+    "dependencyGraph.error.missingPath": "Provide at least one path to scan",
+    "dependencyGraph.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "changeImpact.help.summary": "Analyze git changes and return bounded file-impact, script-pack, and verification hints.",
+    "changeImpact.help.option.base": "Git base ref to compare from. Default: HEAD",
+    "changeImpact.help.option.head": "Git head ref to compare to. Omit to compare the base with the working tree.",
+    "changeImpact.help.option.maxFiles": "Maximum number of changed files to inspect. Default: 200",
+    "changeImpact.help.option.maxImpacts": "Maximum number of impact candidates to report. Default: 300",
+    "changeImpact.help.option.maxFileBytes": "Maximum bytes to read from each source file while tracing dependencies. Default: 262144",
+    "changeImpact.help.exit.ok": "The change-impact analysis completed without input or scan-limit findings",
+    "changeImpact.help.exit.fail": "The change-impact analysis found invalid git input or scan limits",
+    "changeImpact.title": "mustflow change impact",
+    "changeImpact.label.changedFiles": "Changed files",
+    "changeImpact.label.impacts": "Impacts",
+    "changeImpact.label.truncated": "Truncated",
+    "changeImpact.label.scriptHints": "Script hints",
+    "changeImpact.label.verificationHints": "Verification hints",
+    "changeImpact.label.findings": "Findings",
+    "changeImpact.label.issues": "Issues",
+    "changeImpact.clean": "No changed files were found for the selected git range.",
+    "changeImpact.error.missingAction": "Specify a change-impact action: analyze",
+    "changeImpact.error.unknownAction": "Unknown change-impact action: {action}",
+    "changeImpact.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "relatedFiles.help.summary": "Map direct imports, importers, sibling files, and nearby config boundaries for source-oriented repository navigation.",
+    "relatedFiles.help.option.maxFiles": "Maximum number of source or related files to scan. Default: 1000",
+    "relatedFiles.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
+    "relatedFiles.help.option.maxCandidates": "Maximum number of related-file candidates to report. Default: 200",
+    "relatedFiles.help.exit.ok": "The related-file map completed without input or scan-limit findings",
+    "relatedFiles.help.exit.fail": "The related-file map found invalid input, unreadable paths, or scan limits",
+    "relatedFiles.title": "mustflow related files",
+    "relatedFiles.label.targets": "Targets",
+    "relatedFiles.label.candidates": "Candidates",
+    "relatedFiles.label.truncated": "Truncated",
+    "relatedFiles.label.related": "Related files",
+    "relatedFiles.label.confidence": "confidence",
+    "relatedFiles.label.findings": "Findings",
+    "relatedFiles.label.issues": "Issues",
+    "relatedFiles.clean": "No related-file candidates were found.",
+    "relatedFiles.error.missingAction": "Specify a related-files action: map",
+    "relatedFiles.error.unknownAction": "Unknown related-files action: {action}",
+    "relatedFiles.error.missingPath": "Provide at least one path to map",
+    "relatedFiles.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "configChain.help.summary": "Inspect nearby config files, static inheritance, workspace hints, and dynamic config boundaries.",
+    "configChain.help.option.maxConfigs": "Maximum number of config files to inspect. Default: 120",
+    "configChain.help.option.maxFileBytes": "Maximum bytes to read from each config file. Default: 262144",
+    "configChain.help.exit.ok": "The config chain was inspected without blocking findings",
+    "configChain.help.exit.fail": "The config chain found invalid input, unreadable files, parse errors, or scan limits",
+    "configChain.title": "mustflow config chain",
+    "configChain.label.targets": "Targets",
+    "configChain.label.configs": "Configs",
+    "configChain.label.edges": "Edges",
+    "configChain.label.findings": "Findings",
+    "configChain.label.dynamic": "dynamic",
+    "configChain.label.issues": "Issues",
+    "configChain.clean": "No nearby config files were found.",
+    "configChain.error.missingAction": "Specify a config-chain action: inspect",
+    "configChain.error.unknownAction": "Unknown config-chain action: {action}",
+    "configChain.error.missingPath": "Provide at least one path to inspect",
+    "configChain.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.envContract.summary": "Scan repository environment-variable contracts without reading secret values",
+    "envContract.help.summary": "Scan code, CI, docs, config, and env examples for environment variable contract drift without printing env values.",
+    "envContract.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "envContract.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "envContract.help.option.maxKeys": "Maximum number of env keys to report. Default: 300",
+    "envContract.help.exit.ok": "The env contract scan completed without blocking findings",
+    "envContract.help.exit.fail": "The env contract scan found invalid input, unreadable files, or contract findings",
+    "envContract.title": "mustflow env contract",
+    "envContract.label.files": "Files",
+    "envContract.label.keys": "Keys",
+    "envContract.label.findings": "Findings",
+    "envContract.label.truncated": "Truncated",
+    "envContract.label.issues": "Issues",
+    "envContract.clean": "No environment variable references were found.",
+    "envContract.error.missingAction": "Specify an env-contract action: scan",
+    "envContract.error.unknownAction": "Unknown env-contract action: {action}",
+    "envContract.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.secretRiskScan.summary": "Scan repository files for plausible secrets without printing secret values",
+    "secretRiskScan.help.summary": "Scan code, docs, config, CI, and examples for plausible hardcoded secrets without printing secret values.",
+    "secretRiskScan.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "secretRiskScan.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "secretRiskScan.help.option.maxFindings": "Maximum number of findings to report. Default: 200",
+    "secretRiskScan.help.exit.ok": "The secret-risk scan completed without blocking findings",
+    "secretRiskScan.help.exit.fail": "The secret-risk scan found invalid input, unreadable files, or secret-risk findings",
+    "secretRiskScan.title": "mustflow secret risk scan",
+    "secretRiskScan.label.files": "Files",
+    "secretRiskScan.label.findings": "Findings",
+    "secretRiskScan.label.highOrCritical": "High or critical",
+    "secretRiskScan.label.skippedSecretFiles": "Skipped secret files",
+    "secretRiskScan.label.truncated": "Truncated",
+    "secretRiskScan.label.issues": "Issues",
+    "secretRiskScan.clean": "No plausible hardcoded secrets were found.",
+    "secretRiskScan.error.missingAction": "Specify a secret-risk-scan action: scan",
+    "secretRiskScan.error.unknownAction": "Unknown secret-risk-scan action: {action}",
+    "secretRiskScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "run.help.summary": "Run a configured oneshot command from .mustflow/config/commands.toml.",
     "run.help.option.dryRun": "Print a non-executing command plan",
     "run.help.option.planOnly": "Alias for --dry-run",