mustflow 2.85.4 → 2.99.0

package/dist/core/repo-merge-conflict-scan.js

@@ -0,0 +1,335 @@
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { existsSync, lstatSync, readdirSync } from 'node:fs';
+import path from 'node:path';
+import { ensureInsideWithoutSymlinks, readUtf8FileInsideWithoutSymlinks } from './safe-filesystem.js';
+export const REPO_MERGE_CONFLICT_SCAN_PACK_ID = 'repo';
+export const REPO_MERGE_CONFLICT_SCAN_SCRIPT_ID = 'merge-conflict-scan';
+export const REPO_MERGE_CONFLICT_SCAN_SCRIPT_REF = `${REPO_MERGE_CONFLICT_SCAN_PACK_ID}/${REPO_MERGE_CONFLICT_SCAN_SCRIPT_ID}`;
+const DEFAULT_MAX_FILES = 1000;
+const DEFAULT_MAX_FILE_BYTES = 512 * 1024;
+const MARKER_PATTERNS = [
+    { prefix: '<<<<<<<', marker: 'start' },
+    { prefix: '|||||||', marker: 'base' },
+    { prefix: '=======', marker: 'separator' },
+    { prefix: '>>>>>>>', marker: 'end' },
+];
+const SKIPPED_DIRECTORY_NAMES = new Set([
+    '.git',
+    'node_modules',
+    'vendor',
+    'third_party',
+    'dist',
+    'build',
+    'coverage',
+    '.mustflow/cache',
+    '.mustflow/state',
+]);
+function normalizeRelativePath(value) {
+    return value.replace(/\\/gu, '/').replace(/^\.\/+/u, '').replace(/\/+$/u, '') || '.';
+}
+function sha256(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function positiveInteger(value, fallback) {
+    return typeof value === 'number' && Number.isInteger(value) && value > 0 ? value : fallback;
+}
+function runGit(root, args) {
+    const result = spawnSync('git', [...args], {
+        cwd: root,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        windowsHide: true,
+        maxBuffer: 16 * 1024 * 1024,
+    });
+    return {
+        ok: result.status === 0,
+        stdout: result.stdout ?? '',
+        stderr: result.stderr ?? '',
+    };
+}
+function isInsideGitWorktree(root) {
+    const result = runGit(root, ['rev-parse', '--is-inside-work-tree']);
+    return result.ok && result.stdout.trim() === 'true';
+}
+function parseGitPaths(stdout) {
+    const paths = [];
+    const seen = new Set();
+    for (const line of stdout.split(/\r?\n/u)) {
+        const relativePath = normalizeRelativePath(line.trim());
+        if (!relativePath || relativePath === '.' || seen.has(relativePath)) {
+            continue;
+        }
+        seen.add(relativePath);
+        paths.push(relativePath);
+    }
+    return paths.sort((left, right) => left.localeCompare(right));
+}
+function collectGitChangedFiles(root, issues, findings) {
+    if (!isInsideGitWorktree(root)) {
+        const message = 'Git worktree is unavailable; provide explicit paths to scan.';
+        issues.push(message);
+        findings.push(makeFinding('merge_conflict_scan_git_unavailable', 'low', '.', message, null, null));
+        return [];
+    }
+    const tracked = runGit(root, ['diff', '--name-only', '--diff-filter=ACMRTUXB', 'HEAD', '--']);
+    const untracked = runGit(root, ['ls-files', '--others', '--exclude-standard', '--']);
+    const paths = new Set();
+    if (tracked.ok) {
+        for (const entry of parseGitPaths(tracked.stdout)) {
+            paths.add(entry);
+        }
+    }
+    else {
+        issues.push(`Could not inspect changed tracked files: ${tracked.stderr.trim() || 'git diff failed'}`);
+    }
+    if (untracked.ok) {
+        for (const entry of parseGitPaths(untracked.stdout)) {
+            paths.add(entry);
+        }
+    }
+    else {
+        issues.push(`Could not inspect untracked files: ${untracked.stderr.trim() || 'git ls-files failed'}`);
+    }
+    return [...paths].sort((left, right) => left.localeCompare(right));
+}
+function shouldSkipDirectory(relativePath) {
+    const normalized = normalizeRelativePath(relativePath);
+    const firstSegment = normalized.split('/')[0] ?? normalized;
+    return SKIPPED_DIRECTORY_NAMES.has(normalized) || SKIPPED_DIRECTORY_NAMES.has(firstSegment);
+}
+function isLikelyTextFile(relativePath) {
+    const extension = path.posix.extname(relativePath).toLowerCase();
+    if (!extension) {
+        return true;
+    }
+    return ![
+        '.png',
+        '.jpg',
+        '.jpeg',
+        '.gif',
+        '.webp',
+        '.ico',
+        '.pdf',
+        '.zip',
+        '.gz',
+        '.tgz',
+        '.wasm',
+        '.sqlite',
+        '.db',
+        '.lockb',
+    ].includes(extension);
+}
+function listFilesUnder(root, relativePath, findings, issues) {
+    const absolutePath = path.join(root, ...relativePath.split('/'));
+    let entries;
+    try {
+        ensureInsideWithoutSymlinks(root, absolutePath);
+        entries = readdirSync(absolutePath, { withFileTypes: true });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        issues.push(`${relativePath}: ${message}`);
+        findings.push(makeFinding('merge_conflict_scan_unreadable_path', 'high', relativePath, message, null, null));
+        return [];
+    }
+    const files = [];
+    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+        const child = normalizeRelativePath(relativePath === '.' ? entry.name : `${relativePath}/${entry.name}`);
+        if (entry.isDirectory()) {
+            if (!shouldSkipDirectory(child)) {
+                files.push(...listFilesUnder(root, child, findings, issues));
+            }
+            continue;
+        }
+        if (entry.isFile() && isLikelyTextFile(child)) {
+            files.push(child);
+        }
+    }
+    return files;
+}
+function resolveInputFiles(root, inputPaths, policy, findings, issues) {
+    const files = [];
+    const seen = new Set();
+    for (const inputPath of inputPaths) {
+        const absolutePath = path.resolve(root, inputPath);
+        let relativePath;
+        try {
+            ensureInsideWithoutSymlinks(root, absolutePath);
+            relativePath = normalizeRelativePath(path.relative(root, absolutePath));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            issues.push(`${inputPath}: ${message}`);
+            findings.push(makeFinding('merge_conflict_scan_path_outside_root', 'high', inputPath, message, null, null));
+            continue;
+        }
+        if (!existsSync(absolutePath)) {
+            continue;
+        }
+        let stats;
+        try {
+            stats = lstatSync(absolutePath);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            issues.push(`${relativePath}: ${message}`);
+            findings.push(makeFinding('merge_conflict_scan_unreadable_path', 'high', relativePath, message, null, null));
+            continue;
+        }
+        const candidates = stats.isDirectory()
+            ? listFilesUnder(root, relativePath, findings, issues)
+            : stats.isFile() && isLikelyTextFile(relativePath)
+                ? [relativePath]
+                : [];
+        for (const candidate of candidates) {
+            if (seen.has(candidate)) {
+                continue;
+            }
+            if (files.length >= policy.max_files) {
+                const message = `Merge-conflict scan reached max_files ${policy.max_files}; remaining files were skipped.`;
+                issues.push(message);
+                findings.push(makeFinding('merge_conflict_scan_max_files_exceeded', 'high', candidate, message, null, null));
+                return files;
+            }
+            seen.add(candidate);
+            files.push(candidate);
+        }
+    }
+    return files.sort((left, right) => left.localeCompare(right));
+}
+function markerForLine(line) {
+    const trimmedStart = line.trimStart();
+    for (const pattern of MARKER_PATTERNS) {
+        if (trimmedStart.startsWith(pattern.prefix)) {
+            return { marker: pattern.marker, markerLength: pattern.prefix.length };
+        }
+    }
+    return null;
+}
+function makeFinding(code, severity, pathValue, message, line, marker) {
+    return {
+        code,
+        severity,
+        path: pathValue,
+        line,
+        marker,
+        message,
+        json_pointer: null,
+        metric: null,
+        actual: null,
+        expected: null,
+    };
+}
+function scanFile(root, relativePath, policy, findings, issues) {
+    let content;
+    try {
+        content = readUtf8FileInsideWithoutSymlinks(root, path.join(root, ...relativePath.split('/')), {
+            maxBytes: policy.max_file_bytes,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const code = message.includes('exceeds maximum size')
+            ? 'merge_conflict_scan_file_too_large'
+            : 'merge_conflict_scan_unreadable_path';
+        const severity = code === 'merge_conflict_scan_file_too_large' ? 'medium' : 'high';
+        issues.push(`${relativePath}: ${message}`);
+        findings.push(makeFinding(code, severity, relativePath, message, null, null));
+        return { file: null, markers: [] };
+    }
+    const fileMarkers = [];
+    const lines = content.split(/\r\n|\n|\r/u);
+    for (const [index, line] of lines.entries()) {
+        const marker = markerForLine(line);
+        if (!marker) {
+            continue;
+        }
+        const column = line.length - line.trimStart().length + 1;
+        const lineNumber = index + 1;
+        fileMarkers.push({
+            path: relativePath,
+            line: lineNumber,
+            column,
+            marker: marker.marker,
+            marker_length: marker.markerLength,
+        });
+        findings.push(makeFinding('merge_conflict_marker_detected', 'high', relativePath, `Merge conflict marker "${marker.marker}" detected at ${relativePath}:${lineNumber}.`, lineNumber, marker.marker));
+    }
+    return {
+        file: {
+            path: relativePath,
+            sha256: sha256(content),
+            bytes: Buffer.byteLength(content, 'utf8'),
+            markers: fileMarkers.length,
+        },
+        markers: fileMarkers,
+    };
+}
+function summarize(files, markers, issues) {
+    return {
+        files_checked: files.length,
+        markers_found: markers.length,
+        files_with_markers: files.filter((file) => file.markers > 0).length,
+        issues: issues.length,
+    };
+}
+function createInputHash(reportInput) {
+    return sha256(JSON.stringify(reportInput));
+}
+export function checkRepoMergeConflictScan(projectRoot, options) {
+    const root = path.resolve(projectRoot);
+    const inputPaths = options.paths.length > 0 ? [...options.paths] : [];
+    const findings = [];
+    const issues = [];
+    const policy = {
+        input_mode: inputPaths.length > 0 ? 'explicit_paths' : 'git_changed_files',
+        marker_prefixes: MARKER_PATTERNS.map((pattern) => pattern.prefix),
+        max_files: positiveInteger(options.maxFiles, DEFAULT_MAX_FILES),
+        max_file_bytes: positiveInteger(options.maxFileBytes, DEFAULT_MAX_FILE_BYTES),
+        skipped_directories: [...SKIPPED_DIRECTORY_NAMES].sort((left, right) => left.localeCompare(right)),
+    };
+    const effectivePaths = inputPaths.length > 0 ? inputPaths : collectGitChangedFiles(root, issues, findings);
+    const scanTargets = resolveInputFiles(root, effectivePaths, policy, findings, issues);
+    const files = [];
+    const markers = [];
+    for (const target of scanTargets) {
+        const result = scanFile(root, target, policy, findings, issues);
+        if (result.file) {
+            files.push(result.file);
+        }
+        markers.push(...result.markers);
+    }
+    if (effectivePaths.length === 0 && issues.length === 0) {
+        const message = 'No input files were available for merge-conflict scanning.';
+        findings.push(makeFinding('merge_conflict_scan_no_input_files', 'low', '.', message, null, null));
+    }
+    const summary = summarize(files, markers, issues);
+    const hasHighFinding = findings.some((finding) => finding.severity === 'high' || finding.severity === 'critical');
+    const status = findings.some((finding) => finding.code === 'merge_conflict_scan_path_outside_root')
+        ? 'error'
+        : hasHighFinding
+            ? 'failed'
+            : 'passed';
+    return {
+        schema_version: '1',
+        command: 'script-pack',
+        pack_id: REPO_MERGE_CONFLICT_SCAN_PACK_ID,
+        script_id: REPO_MERGE_CONFLICT_SCAN_SCRIPT_ID,
+        script_ref: REPO_MERGE_CONFLICT_SCAN_SCRIPT_REF,
+        action: 'check',
+        status,
+        ok: status === 'passed',
+        mustflow_root: root,
+        input: {
+            paths: inputPaths,
+        },
+        policy,
+        input_hash: createInputHash({ inputPaths, policy, files, markers, findings, issues }),
+        summary,
+        files,
+        markers,
+        findings,
+        issues,
+    };
+}

package/dist/core/repo-version-source.js

@@ -0,0 +1,82 @@
+import { createHash } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { isRecord, readMustflowOwnedTomlFile } from './config-loading.js';
+import { detectVersionSources, releaseVersioningIsEnabled, VERSIONING_CONFIG_PATH, } from './version-sources.js';
+export const REPO_VERSION_SOURCE_PACK_ID = 'repo';
+export const REPO_VERSION_SOURCE_SCRIPT_ID = 'version-source';
+export const REPO_VERSION_SOURCE_SCRIPT_REF = `${REPO_VERSION_SOURCE_PACK_ID}/${REPO_VERSION_SOURCE_SCRIPT_ID}`;
+export const REPO_VERSION_SOURCE_PREFERENCES_PATH = '.mustflow/config/preferences.toml';
+function sha256(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function readPreferences(projectRoot, issues) {
+    const preferencesPath = path.join(projectRoot, ...REPO_VERSION_SOURCE_PREFERENCES_PATH.split('/'));
+    if (!existsSync(preferencesPath)) {
+        return undefined;
+    }
+    try {
+        const parsed = readMustflowOwnedTomlFile(projectRoot, REPO_VERSION_SOURCE_PREFERENCES_PATH);
+        return isRecord(parsed) ? parsed : undefined;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        issues.push(`Could not read ${REPO_VERSION_SOURCE_PREFERENCES_PATH}: ${message}`);
+        return undefined;
+    }
+}
+function countSources(sources) {
+    return {
+        sources: sources.length,
+        declared_sources: sources.filter((source) => source.declared === true).length,
+        source_authority_sources: sources.filter((source) => source.authority === 'source').length,
+        derived_authority_sources: sources.filter((source) => source.authority === 'derived').length,
+        unclassified_authority_sources: sources.filter((source) => source.authority === undefined).length,
+    };
+}
+function createInputHash(reportInput) {
+    return sha256(JSON.stringify(reportInput));
+}
+export function inspectRepoVersionSource(projectRoot) {
+    const root = path.resolve(projectRoot);
+    const issues = [];
+    const preferences = readPreferences(root, issues);
+    const versioningEnabled = releaseVersioningIsEnabled(preferences);
+    const sources = detectVersionSources(root);
+    const findings = [];
+    if (versioningEnabled && sources.length === 0) {
+        findings.push({
+            code: 'versioning_enabled_without_sources',
+            severity: 'high',
+            path: REPO_VERSION_SOURCE_PREFERENCES_PATH,
+            message: 'Release versioning preferences are enabled, but no version source was detected.',
+            json_pointer: null,
+            metric: null,
+            actual: 0,
+            expected: 1,
+        });
+    }
+    const counts = countSources(sources);
+    const status = issues.length > 0 ? 'error' : findings.length > 0 ? 'failed' : 'passed';
+    return {
+        schema_version: '1',
+        command: 'script-pack',
+        pack_id: REPO_VERSION_SOURCE_PACK_ID,
+        script_id: REPO_VERSION_SOURCE_SCRIPT_ID,
+        script_ref: REPO_VERSION_SOURCE_SCRIPT_REF,
+        action: 'inspect',
+        status,
+        ok: status === 'passed',
+        mustflow_root: root,
+        input: {
+            preferences_path: REPO_VERSION_SOURCE_PREFERENCES_PATH,
+            declared_sources_path: VERSIONING_CONFIG_PATH,
+        },
+        input_hash: createInputHash({ versioningEnabled, counts, sources, findings, issues }),
+        versioning_enabled: versioningEnabled,
+        counts,
+        sources,
+        findings,
+        issues,
+    };
+}

package/dist/core/script-pack-suggestions.js

@@ -3,13 +3,14 @@ import path from 'node:path';
 const CODE_NAVIGATION_SCRIPT_REFS = new Set([
     'code/outline',
     'code/dependency-graph',
+    'code/import-cycle',
     'code/symbol-read',
     'code/route-outline',
     'code/export-diff',
     'repo/related-files',
 ]);
 const CONFIG_CHAIN_SURFACES = new Set(['config', 'package', 'source', 'test']);
-const CONFIG_FILE_PATTERN = /(?:^|\/)(?:\.env\.(?:example|sample|template|defaults)|\.dev\.vars\.example|tsconfig(?:\..*)?\.json|eslint\.config\.[cm]?[jt]s|\.eslintrc(?:\.json)?|\.prettierrc(?:\.json)?|prettier\.config\.[cm]?[jt]s|vite\.config\.[cm]?[jt]s|vitest\.config\.[cm]?[jt]s|tailwind\.config\.[cm]?[jt]s|jest\.config\.[cm]?[jt]s|playwright\.config\.[cm]?[jt]s|astro\.config\.mjs|svelte\.config\.js)$/u;
+const CONFIG_FILE_PATTERN = /(?:^|\/)(?:\.gitignore|\.env\.(?:example|sample|template|defaults)|\.dev\.vars\.example|tsconfig(?:\..*)?\.json|eslint\.config\.[cm]?[jt]s|\.eslintrc(?:\.json)?|\.prettierrc(?:\.json)?|prettier\.config\.[cm]?[jt]s|vite\.config\.[cm]?[jt]s|vitest\.config\.[cm]?[jt]s|tailwind\.config\.[cm]?[jt]s|jest\.config\.[cm]?[jt]s|playwright\.config\.[cm]?[jt]s|astro\.config\.mjs|svelte\.config\.js)$/u;
 export function isScriptPackSuggestionPhase(value) {
     return ['before_change', 'during_change', 'after_change', 'review'].includes(value);
 }
@@ -122,7 +123,13 @@ function surfacesForScript(script) {
     addIf('generated', /generated|protected|vendor|cache|boundary/u);
     addIf('config', /config|command/u);
     addIf('package', /package|release/u);
+    addIf('test', /test|suite|fixture|coverage|selection|timing|performance/u);
     addIf('source', /code|source|symbol/u);
+    if (script.ref === 'repo/manifest-lock-drift') {
+        surfaces.add('config');
+        surfaces.add('generated');
+        surfaces.add('template');
+    }
     return uniqueSortedSurfaces(surfaces);
 }
 function confidenceForScore(score) {
@@ -140,6 +147,10 @@ function pathsWithSurface(analyzedPaths, surface) {
 function hasPathWithSurface(analyzedPaths, surface) {
     return analyzedPaths.some((entry) => entry.surfaces.includes(surface));
 }
+function isGitIgnoreAuditPriorityPath(relativePath) {
+    const normalized = relativePath.replace(/\\/gu, '/').replace(/^\.\/+/u, '');
+    return normalized === '.gitignore' || normalized.endsWith('/.gitignore') || normalized === '.git/info/exclude';
+}
 function firstAvailablePath(analyzedPaths, preferredSurfaces) {
     for (const surface of preferredSurfaces) {
         const [candidate] = pathsWithSurface(analyzedPaths, surface);
@@ -171,6 +182,10 @@ function createRunHint(script, analyzedPaths) {
         const sourcePaths = pathsWithSurface(analyzedPaths, 'source');
         return createConcretePathHint('mf script-pack run code/dependency-graph scan', sourcePaths, script.usage);
     }
+    if (script.ref === 'code/import-cycle') {
+        const sourcePaths = pathsWithSurface(analyzedPaths, 'source');
+        return createConcretePathHint('mf script-pack run code/import-cycle check', sourcePaths, script.usage);
+    }
     if (script.ref === 'code/change-impact') {
         return 'mf script-pack run code/change-impact analyze --base HEAD --json';
     }
@@ -199,9 +214,46 @@ function createRunHint(script, analyzedPaths) {
             .map((entry) => entry.path);
         return createConcretePathHint('mf script-pack run docs/reference-drift check', docsPaths, script.usage);
     }
+    if (script.ref === 'docs/link-integrity') {
+        const docsPaths = analyzedPaths
+            .filter((entry) => entry.surfaces.some((surface) => surface === 'docs' || surface === 'schema'))
+            .map((entry) => entry.path);
+        return createConcretePathHint('mf script-pack run docs/link-integrity check', docsPaths, script.usage);
+    }
+    if (script.ref === 'test/performance-report') {
+        return 'mf script-pack run test/performance-report summarize --json';
+    }
+    if (script.ref === 'test/regression-selector') {
+        const testSelectionPaths = analyzedPaths
+            .filter((entry) => entry.surfaces.some((surface) => surface === 'source' || surface === 'test'))
+            .map((entry) => entry.path);
+        const pathPart = testSelectionPaths.length > 0 ? ` ${testSelectionPaths.map(quoteCliArg).join(' ')}` : '';
+        return `mf script-pack run test/regression-selector select${pathPart} --base HEAD --json`;
+    }
     if (script.ref === 'repo/generated-boundary') {
         return createConcretePathHint('mf script-pack run repo/generated-boundary check', analyzedPaths.map((entry) => entry.path), script.usage);
     }
+    if (script.ref === 'repo/merge-conflict-scan') {
+        return createConcretePathHint('mf script-pack run repo/merge-conflict-scan check', analyzedPaths.map((entry) => entry.path), 'mf script-pack run repo/merge-conflict-scan check --json');
+    }
+    if (script.ref === 'repo/git-ignore-audit') {
+        return createConcretePathHint('mf script-pack run repo/git-ignore-audit audit', analyzedPaths.map((entry) => entry.path), 'mf script-pack run repo/git-ignore-audit audit --json');
+    }
+    if (script.ref === 'repo/manifest-lock-drift') {
+        const manifestPaths = analyzedPaths
+            .filter((entry) => entry.surfaces.some((surface) => surface === 'config' || surface === 'template' || surface === 'generated'))
+            .map((entry) => entry.path);
+        return createConcretePathHint('mf script-pack run repo/manifest-lock-drift check', manifestPaths, 'mf script-pack run repo/manifest-lock-drift check --json');
+    }
+    if (script.ref === 'repo/skill-route-audit') {
+        return 'mf script-pack run repo/skill-route-audit audit --json';
+    }
+    if (script.ref === 'repo/version-source') {
+        return 'mf script-pack run repo/version-source inspect --json';
+    }
+    if (script.ref === 'repo/approval-gate') {
+        return 'mf script-pack run repo/approval-gate check --action <action_type> --json';
+    }
     if (script.ref === 'repo/config-chain') {
         const configPaths = analyzedPaths
             .filter((entry) => entry.surfaces.some((surface) => CONFIG_CHAIN_SURFACES.has(surface)))
@@ -280,6 +332,30 @@ export function createScriptPackSuggestionReport(mustflowRoot, options) {
             score += 2;
             reasons.push('Prioritizes generated-boundary checks for generated paths.');
         }
+        if (script.ref === 'repo/merge-conflict-scan' && requestedSurfaces.size > 0) {
+            score += 1;
+            reasons.push('Prioritizes merge-conflict marker scans for changed repository paths.');
+        }
+        if (script.ref === 'repo/git-ignore-audit' &&
+            analyzedPaths.some((entry) => isGitIgnoreAuditPriorityPath(entry.path))) {
+            score += 1;
+            reasons.push('Prioritizes Git ignore evidence for explicit ignore-control paths.');
+        }
+        if (script.ref === 'repo/skill-route-audit' &&
+            (requestedSurfaces.has('skill') || requestedSurfaces.has('template') || requestedSurfaces.has('config'))) {
+            score += 3;
+            reasons.push('Prioritizes skill-route audits for skill, template, and workflow metadata surfaces.');
+        }
+        if (script.ref === 'repo/version-source' &&
+            (requestedSurfaces.has('package') || requestedSurfaces.has('template') || requestedSurfaces.has('config'))) {
+            score += 2;
+            reasons.push('Prioritizes version-source inspection for package, template, and versioning metadata surfaces.');
+        }
+        if (script.ref === 'repo/approval-gate' &&
+            (requestedSurfaces.has('config') || requestedSurfaces.has('package') || requestedSurfaces.has('template'))) {
+            score += 2;
+            reasons.push('Prioritizes approval-gate checks for approval-sensitive workflow and release surfaces.');
+        }
         if (score === 0) {
             return null;
         }