mustflow 2.75.2 → 2.85.4

package/dist/cli/i18n/zh.js

@@ -585,6 +585,7 @@ export const zhMessages = {
     "docs.help.summary": "跟踪由 LLM 创建或修改后需要文字审阅的文档。",
     "docs.help.option.all": "包含已批准和已忽略的文档",
     "docs.help.option.status": "按审阅状态过滤",
+    "docs.help.option.changed": "从 git status 添加所有已更改的文档审阅候选项",
     "docs.help.option.reason": "记录文档需要审阅的原因",
     "docs.help.option.origin": "记录审阅来源，例如 llm_modified",
     "docs.help.option.actorKind": "记录谁修改了文档：human、llm、tool 或 external",
@@ -600,6 +601,8 @@ export const zhMessages = {
     "docs.review.empty": "没有需要审阅的文档。",
     "docs.review.wrote": "写入",
     "docs.review.added": "已添加",
+    "docs.review.changed.none": "没有已更改的文档需要审阅。",
+    "docs.review.changed.added": "已添加更改文档：{count}",
     "docs.review.commented": "已添加评论",
     "docs.review.marked.approved": "已批准",
     "docs.review.marked.needs_human": "已标记为 needs_human",
@@ -612,6 +615,9 @@ export const zhMessages = {
     "docs.error.emptyComment": "审核评论不能为空",
     "docs.error.commentSourceConflict": "只能使用 --comment 或 --comment-file 其中一个",
     "docs.error.commentFileIsDocument": "--comment-file 不能指向正在审核的文档",
+    "docs.error.changedPathConflict": "使用 --changed 时不要提供文档路径",
+    "docs.error.changedCommentConflict": "使用 --changed 时不要提供 --comment 或 --comment-file",
+    "docs.error.changedFilesUnavailable": "无法通过 git status 检查更改文件：{message}",
     "docs.error.invalidStatus": "无效审阅状态。请使用：{statuses}",
     "docs.error.invalidReviewerKind": "无效审阅者类型。请使用：{kinds}",
     "docs.error.missingReviewerKind": "缺少 --reviewer-kind。请使用：{kinds}",
@@ -765,11 +771,19 @@ export const zhMessages = {
     "scriptPack.suggest.empty": "No script-pack suggestions matched the supplied paths, skills, or phases.",
     "scriptPack.pack.code.summary": "Source-code orientation utility scripts",
     "scriptPack.pack.core.summary": "Core built-in utility scripts",
+    "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
     "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
-    "scriptPack.script.codeSymbolRead.summary": "Read a bounded source snippet by symbol line or explicit line range",
+    "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
+    "scriptPack.script.codeChangeImpact.summary": "Analyze changed files for impact, script-pack, and verification hints",
+    "scriptPack.script.codeSymbolRead.summary": "Read a bounded source snippet by source anchor, symbol line, or explicit line range",
+    "scriptPack.script.codeRouteOutline.summary": "Scan Hono, Elysia, Axum, and NestJS route methods, paths, handlers, and lifecycle chains",
+    "scriptPack.script.codeExportDiff.summary": "Compare exported source signatures and return metadata across git refs",
     "scriptPack.script.textBudget.summary": "Check exact text length budgets for files or JSON string fields",
+    "scriptPack.script.referenceDrift.summary": "Check documented command, script-pack, schema, and path references for drift",
+    "scriptPack.script.configChain.summary": "Inspect nearby config files and static config inheritance",
     "scriptPack.script.generatedBoundary.summary": "Check whether candidate paths cross generated, ignored, protected, vendor, or cache boundaries",
+    "scriptPack.script.relatedFiles.summary": "Map likely related files for source-oriented repository navigation",
     "scriptPack.label.script": "Script",
     "scriptPack.label.actions": "actions",
     "scriptPack.label.schema": "schema",
@@ -796,7 +810,8 @@ export const zhMessages = {
     "codeOutline.error.missingPath": "Provide at least one source file or directory to scan",
     "codeOutline.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "codeOutline.error.invalidNonNegativeInteger": "{option} must be a non-negative safe integer: {value}",
-    "codeSymbolRead.help.summary": "Read a bounded TypeScript or JavaScript source snippet from a symbol line or explicit line range.",
+    "codeSymbolRead.help.summary": "Read a bounded TypeScript or JavaScript source snippet from a source anchor, symbol line, or explicit line range.",
+    "codeSymbolRead.help.option.anchor": "Source anchor id to resolve to its target symbol",
     "codeSymbolRead.help.option.startLine": "1-based source line to resolve to a symbol or range",
     "codeSymbolRead.help.option.endLine": "Optional explicit 1-based end line; when omitted, the containing outline symbol is read",
     "codeSymbolRead.help.option.contextLines": "Number of surrounding context lines to include. Default: 0",
@@ -813,6 +828,56 @@ export const zhMessages = {
     "codeSymbolRead.error.missingPath": "Provide exactly one source file to read",
     "codeSymbolRead.error.tooManyPaths": "Provide only one source file to read",
     "codeSymbolRead.error.missingStartLine": "Provide --start-line <line>",
+    "codeSymbolRead.error.anchorConflict": "Use either --anchor <id> or <path> with --start-line/--end-line, not both",
+    "codeRouteOutline.help.summary": "Scan Hono, Elysia, Axum, and NestJS route source files for method, path, handler, lifecycle, and line metadata.",
+    "codeRouteOutline.help.option.maxFiles": "Maximum number of source files to scan. Default: 200",
+    "codeRouteOutline.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 1048576",
+    "codeRouteOutline.help.exit.ok": "The route outline was scanned without findings",
+    "codeRouteOutline.help.exit.fail": "The route outline found invalid input, unreadable files, unsupported files, or scan limits",
+    "codeRouteOutline.title": "mustflow route outline",
+    "codeRouteOutline.label.files": "Files",
+    "codeRouteOutline.label.routes": "Routes",
+    "codeRouteOutline.label.findings": "Findings",
+    "codeRouteOutline.label.outline": "Route outline",
+    "codeRouteOutline.label.issues": "Issues",
+    "codeRouteOutline.clean": "No Hono, Elysia, Axum, or NestJS routes were found.",
+    "codeRouteOutline.error.missingAction": "Specify a route-outline action: scan",
+    "codeRouteOutline.error.unknownAction": "Unknown route-outline action: {action}",
+    "codeRouteOutline.error.missingPath": "Provide at least one source file or directory to scan",
+    "codeRouteOutline.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "exportDiff.help.summary": "Compare exported TS/JS signatures, return metadata, and package surface hints across a git base and head.",
+    "exportDiff.help.option.base": "Git base ref to compare from. Default: HEAD",
+    "exportDiff.help.option.head": "Git head ref to compare to. Omit to compare the base with the working tree.",
+    "exportDiff.help.option.maxFiles": "Maximum number of changed source files to inspect. Default: 100",
+    "exportDiff.help.option.maxFileBytes": "Maximum bytes to read from each source file snapshot. Default: 1048576",
+    "exportDiff.help.exit.ok": "The export diff completed without input errors",
+    "exportDiff.help.exit.fail": "The export diff could not read git input or exceeded configured limits",
+    "exportDiff.title": "mustflow export diff",
+    "exportDiff.label.files": "Files",
+    "exportDiff.label.added": "Added",
+    "exportDiff.label.removed": "Removed",
+    "exportDiff.label.changed": "Changed",
+    "exportDiff.label.exports": "Exports",
+    "exportDiff.label.findings": "Findings",
+    "exportDiff.label.issues": "Issues",
+    "exportDiff.clean": "No exported TypeScript or JavaScript declaration changes were found.",
+    "exportDiff.error.missingAction": "Specify an export-diff action: compare",
+    "exportDiff.error.unknownAction": "Unknown export-diff action: {action}",
+    "exportDiff.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "referenceDrift.help.summary": "Check documentation references against current mf commands, script-pack refs, schema files, and repository paths.",
+    "referenceDrift.help.option.maxFiles": "Maximum number of document files to inspect. Default: 200",
+    "referenceDrift.help.option.maxFileBytes": "Maximum bytes to read from each document file. Default: 524288",
+    "referenceDrift.help.exit.ok": "All checked documentation references resolved against current repository surfaces",
+    "referenceDrift.help.exit.fail": "A documentation reference was stale, missing, unknown, unreadable, or over a configured limit",
+    "referenceDrift.title": "mustflow reference drift",
+    "referenceDrift.label.files": "Files",
+    "referenceDrift.label.references": "References",
+    "referenceDrift.label.findings": "Findings",
+    "referenceDrift.label.issues": "Issues",
+    "referenceDrift.clean": "No documentation references were found.",
+    "referenceDrift.error.missingAction": "Specify a reference-drift action: check",
+    "referenceDrift.error.unknownAction": "Unknown reference-drift action: {action}",
+    "referenceDrift.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "textBudget.help.summary": "Check exact text length budgets for files or JSON string fields using grapheme counts by default.",
     "textBudget.help.option.min": "Require at least this many units",
     "textBudget.help.option.max": "Require at most this many units",
@@ -849,6 +914,119 @@ export const zhMessages = {
     "generatedBoundary.error.missingAction": "Specify a generated-boundary action: check",
     "generatedBoundary.error.unknownAction": "Unknown generated-boundary action: {action}",
     "generatedBoundary.error.missingPath": "Provide at least one path to check",
+    "dependencyGraph.help.summary": "Trace bounded relative import, export, require, and dynamic import edges for TypeScript and JavaScript source files.",
+    "dependencyGraph.help.option.maxDepth": "Maximum dependency depth from target files. Default: 2",
+    "dependencyGraph.help.option.maxFiles": "Maximum number of source files to scan. Default: 1000",
+    "dependencyGraph.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
+    "dependencyGraph.help.option.maxNodes": "Maximum number of graph nodes to report. Default: 300",
+    "dependencyGraph.help.option.maxEdges": "Maximum number of graph edges to report. Default: 800",
+    "dependencyGraph.help.exit.ok": "The dependency graph completed without input or scan-limit findings",
+    "dependencyGraph.help.exit.fail": "The dependency graph found invalid input, unreadable paths, or scan limits",
+    "dependencyGraph.title": "mustflow dependency graph",
+    "dependencyGraph.label.targets": "Targets",
+    "dependencyGraph.label.nodes": "Nodes",
+    "dependencyGraph.label.edges": "Edges",
+    "dependencyGraph.label.cycles": "Cycles",
+    "dependencyGraph.label.truncated": "Truncated",
+    "dependencyGraph.label.cycleList": "Cycle hints",
+    "dependencyGraph.label.findings": "Findings",
+    "dependencyGraph.label.issues": "Issues",
+    "dependencyGraph.clean": "No relative dependency edges were found.",
+    "dependencyGraph.error.missingAction": "Specify a dependency-graph action: scan",
+    "dependencyGraph.error.unknownAction": "Unknown dependency-graph action: {action}",
+    "dependencyGraph.error.missingPath": "Provide at least one path to scan",
+    "dependencyGraph.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "changeImpact.help.summary": "Analyze git changes and return bounded file-impact, script-pack, and verification hints.",
+    "changeImpact.help.option.base": "Git base ref to compare from. Default: HEAD",
+    "changeImpact.help.option.head": "Git head ref to compare to. Omit to compare the base with the working tree.",
+    "changeImpact.help.option.maxFiles": "Maximum number of changed files to inspect. Default: 200",
+    "changeImpact.help.option.maxImpacts": "Maximum number of impact candidates to report. Default: 300",
+    "changeImpact.help.option.maxFileBytes": "Maximum bytes to read from each source file while tracing dependencies. Default: 262144",
+    "changeImpact.help.exit.ok": "The change-impact analysis completed without input or scan-limit findings",
+    "changeImpact.help.exit.fail": "The change-impact analysis found invalid git input or scan limits",
+    "changeImpact.title": "mustflow change impact",
+    "changeImpact.label.changedFiles": "Changed files",
+    "changeImpact.label.impacts": "Impacts",
+    "changeImpact.label.truncated": "Truncated",
+    "changeImpact.label.scriptHints": "Script hints",
+    "changeImpact.label.verificationHints": "Verification hints",
+    "changeImpact.label.findings": "Findings",
+    "changeImpact.label.issues": "Issues",
+    "changeImpact.clean": "No changed files were found for the selected git range.",
+    "changeImpact.error.missingAction": "Specify a change-impact action: analyze",
+    "changeImpact.error.unknownAction": "Unknown change-impact action: {action}",
+    "changeImpact.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "relatedFiles.help.summary": "Map direct imports, importers, sibling files, and nearby config boundaries for source-oriented repository navigation.",
+    "relatedFiles.help.option.maxFiles": "Maximum number of source or related files to scan. Default: 1000",
+    "relatedFiles.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
+    "relatedFiles.help.option.maxCandidates": "Maximum number of related-file candidates to report. Default: 200",
+    "relatedFiles.help.exit.ok": "The related-file map completed without input or scan-limit findings",
+    "relatedFiles.help.exit.fail": "The related-file map found invalid input, unreadable paths, or scan limits",
+    "relatedFiles.title": "mustflow related files",
+    "relatedFiles.label.targets": "Targets",
+    "relatedFiles.label.candidates": "Candidates",
+    "relatedFiles.label.truncated": "Truncated",
+    "relatedFiles.label.related": "Related files",
+    "relatedFiles.label.confidence": "confidence",
+    "relatedFiles.label.findings": "Findings",
+    "relatedFiles.label.issues": "Issues",
+    "relatedFiles.clean": "No related-file candidates were found.",
+    "relatedFiles.error.missingAction": "Specify a related-files action: map",
+    "relatedFiles.error.unknownAction": "Unknown related-files action: {action}",
+    "relatedFiles.error.missingPath": "Provide at least one path to map",
+    "relatedFiles.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "configChain.help.summary": "Inspect nearby config files, static inheritance, workspace hints, and dynamic config boundaries.",
+    "configChain.help.option.maxConfigs": "Maximum number of config files to inspect. Default: 120",
+    "configChain.help.option.maxFileBytes": "Maximum bytes to read from each config file. Default: 262144",
+    "configChain.help.exit.ok": "The config chain was inspected without blocking findings",
+    "configChain.help.exit.fail": "The config chain found invalid input, unreadable files, parse errors, or scan limits",
+    "configChain.title": "mustflow config chain",
+    "configChain.label.targets": "Targets",
+    "configChain.label.configs": "Configs",
+    "configChain.label.edges": "Edges",
+    "configChain.label.findings": "Findings",
+    "configChain.label.dynamic": "dynamic",
+    "configChain.label.issues": "Issues",
+    "configChain.clean": "No nearby config files were found.",
+    "configChain.error.missingAction": "Specify a config-chain action: inspect",
+    "configChain.error.unknownAction": "Unknown config-chain action: {action}",
+    "configChain.error.missingPath": "Provide at least one path to inspect",
+    "configChain.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.envContract.summary": "Scan repository environment-variable contracts without reading secret values",
+    "envContract.help.summary": "Scan code, CI, docs, config, and env examples for environment variable contract drift without printing env values.",
+    "envContract.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "envContract.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "envContract.help.option.maxKeys": "Maximum number of env keys to report. Default: 300",
+    "envContract.help.exit.ok": "The env contract scan completed without blocking findings",
+    "envContract.help.exit.fail": "The env contract scan found invalid input, unreadable files, or contract findings",
+    "envContract.title": "mustflow env contract",
+    "envContract.label.files": "Files",
+    "envContract.label.keys": "Keys",
+    "envContract.label.findings": "Findings",
+    "envContract.label.truncated": "Truncated",
+    "envContract.label.issues": "Issues",
+    "envContract.clean": "No environment variable references were found.",
+    "envContract.error.missingAction": "Specify an env-contract action: scan",
+    "envContract.error.unknownAction": "Unknown env-contract action: {action}",
+    "envContract.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.secretRiskScan.summary": "Scan repository files for plausible secrets without printing secret values",
+    "secretRiskScan.help.summary": "Scan code, docs, config, CI, and examples for plausible hardcoded secrets without printing secret values.",
+    "secretRiskScan.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "secretRiskScan.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "secretRiskScan.help.option.maxFindings": "Maximum number of findings to report. Default: 200",
+    "secretRiskScan.help.exit.ok": "The secret-risk scan completed without blocking findings",
+    "secretRiskScan.help.exit.fail": "The secret-risk scan found invalid input, unreadable files, or secret-risk findings",
+    "secretRiskScan.title": "mustflow secret risk scan",
+    "secretRiskScan.label.files": "Files",
+    "secretRiskScan.label.findings": "Findings",
+    "secretRiskScan.label.highOrCritical": "High or critical",
+    "secretRiskScan.label.skippedSecretFiles": "Skipped secret files",
+    "secretRiskScan.label.truncated": "Truncated",
+    "secretRiskScan.label.issues": "Issues",
+    "secretRiskScan.clean": "No plausible hardcoded secrets were found.",
+    "secretRiskScan.error.missingAction": "Specify a secret-risk-scan action: scan",
+    "secretRiskScan.error.unknownAction": "Unknown secret-risk-scan action: {action}",
+    "secretRiskScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "run.help.summary": "从 .mustflow/config/commands.toml 运行已配置的一次性命令。",
     "run.help.option.dryRun": "输出命令计划但不执行",
     "run.help.option.planOnly": "--dry-run 的别名",

package/dist/cli/lib/repo-map.js

@@ -661,7 +661,7 @@ function renderSourceQuality(gitLsFilesStatus) {
         '',
     ];
 }
-export function generateRepoMap(projectRoot, options = {}) {
+function createRepoMapRenderModel(projectRoot, options = {}) {
     const depth = options.depth ?? DEFAULT_DEPTH;
     const config = getRepoMapConfig(projectRoot);
     const configuredPriorityPaths = config.priorityPaths;
@@ -675,10 +675,6 @@ export function generateRepoMap(projectRoot, options = {}) {
     const anchorDiscovery = discoverAnchors(projectRoot, depth, priorityPathSet, nestedRepositories, workspaceRootPrefixes);
     const anchors = anchorDiscovery.anchors;
     const gitLsFilesStatus = anchorDiscovery.gitLsFilesStatus;
-    const priorityAnchors = configuredPriorityPaths
-        .map((relativePath) => anchors.find((anchor) => anchor.relativePath === relativePath))
-        .filter((anchor) => Boolean(anchor));
-    const otherAnchors = anchors.filter((anchor) => !priorityPathSet.has(anchor.relativePath));
     const anchorCount = anchors.length + nestedRepositories.reduce((total, repository) => total + countNestedEntrypoints(repository), 0);
     const sourceFingerprint = getRepoMapSourceFingerprint({
         depth,
@@ -688,8 +684,33 @@ export function generateRepoMap(projectRoot, options = {}) {
         anchors,
         nestedRepositories,
     });
+    return {
+        configuredPriorityPaths,
+        priorityPathSet,
+        mapConfig,
+        nestedRepositories,
+        anchors,
+        gitLsFilesStatus,
+        anchorCount,
+        sourceFingerprint,
+    };
+}
+export function getExpectedRepoMapSourceFingerprint(projectRoot, options = {}) {
+    return createRepoMapRenderModel(projectRoot, options).sourceFingerprint;
+}
+export function generateRepoMap(projectRoot, options = {}) {
+    const model = createRepoMapRenderModel(projectRoot, options);
+    const configuredPriorityPaths = model.configuredPriorityPaths;
+    const priorityPathSet = model.priorityPathSet;
+    const nestedRepositories = model.nestedRepositories;
+    const anchors = model.anchors;
+    const gitLsFilesStatus = model.gitLsFilesStatus;
+    const priorityAnchors = configuredPriorityPaths
+        .map((relativePath) => anchors.find((anchor) => anchor.relativePath === relativePath))
+        .filter((anchor) => Boolean(anchor));
+    const otherAnchors = anchors.filter((anchor) => !priorityPathSet.has(anchor.relativePath));
     return [
-        ...renderRepoMapFrontmatter(anchorCount, sourceFingerprint, gitLsFilesStatus),
+        ...renderRepoMapFrontmatter(model.anchorCount, model.sourceFingerprint, gitLsFilesStatus),
         '# REPO_MAP.md',
         '',
         'This file is an agent navigation map for the current mustflow root. It is not a full file listing.',

package/dist/cli/lib/run-root-trust.js

@@ -1,4 +1,5 @@
 import { MANIFEST_LOCK_RELATIVE_PATH, inspectManifestLock } from './manifest-lock.js';
+import { readCommandContractIncludePaths } from '../../core/config-loading.js';
 export const ALLOW_UNTRUSTED_ROOT_OPTION = '--allow-untrusted-root';
 const REQUIRED_RUN_TRUST_LOCK_PATHS = [
     'AGENTS.md',
@@ -17,7 +18,20 @@ export function assessRunRootTrust(projectRoot) {
             };
         }
         const trackedPaths = new Set(readResult.lock.files.map((file) => file.relativePath));
-        const missingRequiredPath = REQUIRED_RUN_TRUST_LOCK_PATHS.find((relativePath) => !trackedPaths.has(relativePath));
+        let requiredPaths = REQUIRED_RUN_TRUST_LOCK_PATHS;
+        try {
+            requiredPaths = [...REQUIRED_RUN_TRUST_LOCK_PATHS, ...readCommandContractIncludePaths(projectRoot)];
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return {
+                trusted: false,
+                reason: 'manifest_lock_invalid',
+                manifestLockPath: readResult.lockPath,
+                detail: message,
+            };
+        }
+        const missingRequiredPath = requiredPaths.find((relativePath) => !trackedPaths.has(relativePath));
         if (missingRequiredPath) {
             return {
                 trusted: false,