mustflow 2.99.2 → 2.103.10

package/dist/cli/lib/external-skill-import.js

@@ -0,0 +1,455 @@
+import { existsSync, renameSync, rmSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import { ensureFileTargetInsideWithoutSymlinks, writeJsonFileInsideWithoutSymlinks, writeUtf8FileInsideWithoutSymlinks, } from '../../core/safe-filesystem.js';
+const EXTERNAL_SKILL_ROOT = '.mustflow/external-skills';
+const PROVENANCE_FILE = 'mustflow-skill-source.json';
+const DEFAULT_GITHUB_REF = 'HEAD';
+const MAX_IMPORTED_FILES = 40;
+const MAX_TOTAL_BYTES = 512 * 1024;
+const MAX_FILE_BYTES = 256 * 1024;
+const ALLOWED_SUPPORT_DIRECTORIES = new Set(['assets', 'references', 'scripts']);
+const SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
+const GITHUB_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/u;
+function normalizeRef(ref) {
+    return ref?.trim() || DEFAULT_GITHUB_REF;
+}
+function toPosixPath(value) {
+    return value.replace(/\\/gu, '/').replace(/^\/+/u, '').replace(/\/+$/u, '');
+}
+function encodeGitHubPath(value) {
+    return toPosixPath(value)
+        .split('/')
+        .filter(Boolean)
+        .map((segment) => encodeURIComponent(segment))
+        .join('/');
+}
+function validateGitHubName(value, label) {
+    if (!value || !GITHUB_NAME_PATTERN.test(value) || value === '.' || value === '..') {
+        throw new Error(`Invalid GitHub ${label}: ${value}`);
+    }
+}
+function validateRelativeImportPath(value) {
+    const normalized = toPosixPath(value);
+    if (!normalized || normalized.includes('\0')) {
+        throw new Error(`Invalid external skill path: ${value}`);
+    }
+    const segments = normalized.split('/');
+    if (segments.some((segment) => segment === '.' || segment === '..' || segment.length === 0)) {
+        throw new Error(`External skill path must not contain traversal segments: ${value}`);
+    }
+    return normalized;
+}
+function skillDirectoryPathForBlobPath(blobPath) {
+    const normalized = validateRelativeImportPath(blobPath);
+    if (!normalized.endsWith('SKILL.md')) {
+        throw new Error('Blob and raw GitHub URLs must point to a SKILL.md file.');
+    }
+    return normalized.split('/').slice(0, -1).join('/');
+}
+function parseGitHubUrl(inputUrl, refOverride) {
+    let url;
+    try {
+        url = new URL(inputUrl);
+    }
+    catch {
+        throw new Error(`Unsupported external skill URL: ${inputUrl}`);
+    }
+    if (url.protocol !== 'https:') {
+        throw new Error('External skill imports require an HTTPS GitHub URL.');
+    }
+    const pathParts = url.pathname.split('/').filter(Boolean);
+    if (url.hostname === 'github.com') {
+        const [owner, repo, mode, ref, ...rest] = pathParts;
+        const ownerName = owner ?? '';
+        const repoName = repo ?? '';
+        validateGitHubName(ownerName, 'owner');
+        validateGitHubName(repoName, 'repo');
+        if (!mode) {
+            const selectedRef = normalizeRef(refOverride);
+            return {
+                host: 'github.com',
+                owner: ownerName,
+                repo: repoName,
+                ref: selectedRef,
+                skillPath: '',
+                sourceUrl: `https://github.com/${ownerName}/${repoName}`,
+            };
+        }
+        if ((mode === 'tree' || mode === 'blob') && ref) {
+            const selectedRef = normalizeRef(refOverride ?? ref);
+            const sourcePath = rest.join('/');
+            const skillPath = mode === 'blob' ? skillDirectoryPathForBlobPath(sourcePath) : validateRelativeImportPath(sourcePath);
+            return {
+                host: 'github.com',
+                owner: ownerName,
+                repo: repoName,
+                ref: selectedRef,
+                skillPath,
+                sourceUrl: `https://github.com/${ownerName}/${repoName}/${mode}/${ref}/${sourcePath}`,
+            };
+        }
+    }
+    if (url.hostname === 'raw.githubusercontent.com') {
+        const [owner, repo, ref, ...rest] = pathParts;
+        const ownerName = owner ?? '';
+        const repoName = repo ?? '';
+        validateGitHubName(ownerName, 'owner');
+        validateGitHubName(repoName, 'repo');
+        if (!ref) {
+            throw new Error('Raw GitHub URLs must include a ref.');
+        }
+        const rawPath = rest.join('/');
+        const selectedRef = normalizeRef(refOverride ?? ref);
+        return {
+            host: 'raw.githubusercontent.com',
+            owner: ownerName,
+            repo: repoName,
+            ref: selectedRef,
+            skillPath: skillDirectoryPathForBlobPath(rawPath),
+            sourceUrl: `https://raw.githubusercontent.com/${ownerName}/${repoName}/${ref}/${rawPath}`,
+        };
+    }
+    throw new Error('Only github.com and raw.githubusercontent.com skill URLs are supported.');
+}
+function externalSkillSourceFromParsed(inputUrl, parsed) {
+    return {
+        input_url: inputUrl,
+        host: parsed.host,
+        owner: parsed.owner,
+        repo: parsed.repo,
+        ref: parsed.ref,
+        skill_path: parsed.skillPath,
+        source_url: parsed.sourceUrl,
+    };
+}
+function sanitizeSkillName(value) {
+    return value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/gu, '-')
+        .replace(/^-+|-+$/gu, '')
+        .replace(/-{2,}/gu, '-');
+}
+function readFrontmatterScalar(content, key) {
+    if (!content.startsWith('---')) {
+        return null;
+    }
+    const firstLineEnd = content.indexOf('\n');
+    const end = firstLineEnd >= 0 ? content.indexOf('\n---', firstLineEnd + 1) : -1;
+    if (firstLineEnd < 0 || end < 0) {
+        return null;
+    }
+    for (const line of content.slice(firstLineEnd + 1, end).split(/\r?\n/u)) {
+        const match = /^([a-zA-Z0-9_]+):\s*(.*)$/u.exec(line);
+        if (match?.[1] === key) {
+            return match[2].trim().replace(/^["']|["']$/gu, '') || null;
+        }
+    }
+    return null;
+}
+function targetNameForSkill(files, parsed, nameOverride) {
+    const candidate = nameOverride?.trim()
+        ?? readFrontmatterScalar(files.find((file) => file.relativePath === 'SKILL.md')?.content ?? '', 'name')
+        ?? parsed.skillPath.split('/').filter(Boolean).pop()
+        ?? parsed.repo;
+    const sanitized = sanitizeSkillName(candidate);
+    if (!SLUG_PATTERN.test(sanitized)) {
+        throw new Error(`External skill name cannot be converted to a safe slug: ${candidate}`);
+    }
+    return sanitized;
+}
+function kindForRelativePath(relativePath) {
+    if (relativePath === 'SKILL.md') {
+        return 'skill';
+    }
+    const [topLevel] = relativePath.split('/');
+    if (topLevel === 'scripts') {
+        return 'script';
+    }
+    if (topLevel === 'assets') {
+        return 'asset';
+    }
+    return 'reference';
+}
+function validateImportRelativeFilePath(relativePath) {
+    const normalized = validateRelativeImportPath(relativePath);
+    const [topLevel] = normalized.split('/');
+    if (normalized === 'SKILL.md') {
+        return normalized;
+    }
+    if (!ALLOWED_SUPPORT_DIRECTORIES.has(topLevel)) {
+        throw new Error(`External skill import rejected unsupported file path: ${relativePath}`);
+    }
+    return normalized;
+}
+function normalizeTextContent(content) {
+    return content.replace(/\r\n?/gu, '\n');
+}
+function readFrontmatterParts(content) {
+    if (!content.startsWith('---')) {
+        return {
+            name: null,
+            description: null,
+            body: content,
+        };
+    }
+    const firstLineEnd = content.indexOf('\n');
+    const end = firstLineEnd >= 0 ? content.indexOf('\n---', firstLineEnd + 1) : -1;
+    if (firstLineEnd < 0 || end < 0) {
+        return {
+            name: null,
+            description: null,
+            body: content,
+        };
+    }
+    const frontmatter = content.slice(firstLineEnd + 1, end).split(/\r?\n/u);
+    const bodyStart = content.indexOf('\n', end + 1);
+    return {
+        name: readFrontmatterScalar(content, 'name'),
+        description: readFrontmatterScalar(content, 'description'),
+        body: bodyStart >= 0 ? content.slice(bodyStart + 1) : '',
+    };
+}
+function renderYamlScalar(key, value) {
+    return `${key}: ${JSON.stringify(value)}`;
+}
+function sanitizeExternalSkillMarkdown(content) {
+    const frontmatter = readFrontmatterParts(content);
+    const lines = [
+        '---',
+        ...(frontmatter.name ? [renderYamlScalar('name', frontmatter.name)] : []),
+        ...(frontmatter.description ? [renderYamlScalar('description', frontmatter.description)] : []),
+        'external_authority: untrusted',
+        '---',
+        frontmatter.body,
+    ];
+    return lines.join('\n');
+}
+function normalizeImportedSkillFiles(files) {
+    return files.map((file) => ({
+        ...file,
+        content: file.relativePath === 'SKILL.md' ? sanitizeExternalSkillMarkdown(file.content) : file.content,
+    }));
+}
+function hashContent(content) {
+    return `sha256:${createHash('sha256').update(content).digest('hex')}`;
+}
+function isGitHubNotFoundError(error) {
+    return error instanceof Error && /\(404\)/u.test(error.message);
+}
+async function readResponseText(response, url) {
+    if (!response.ok) {
+        throw new Error(`GitHub request failed (${response.status}) for ${url}`);
+    }
+    const text = await response.text();
+    if (Buffer.byteLength(text, 'utf8') > MAX_FILE_BYTES) {
+        throw new Error(`External skill file exceeds ${MAX_FILE_BYTES} bytes: ${url}`);
+    }
+    return normalizeTextContent(text);
+}
+async function fetchJson(fetchImpl, url) {
+    const response = await fetchImpl(url, {
+        headers: {
+            accept: 'application/vnd.github+json',
+            'user-agent': 'mustflow-external-skill-import',
+        },
+    });
+    if (!response.ok) {
+        throw new Error(`GitHub request failed (${response.status}) for ${url}`);
+    }
+    return response.json();
+}
+function apiContentsUrl(parsed, relativePath) {
+    const fullPath = [parsed.skillPath, relativePath].filter(Boolean).join('/');
+    const encodedPath = encodeGitHubPath(fullPath);
+    const pathSuffix = encodedPath ? `/${encodedPath}` : '';
+    return `https://api.github.com/repos/${parsed.owner}/${parsed.repo}/contents${pathSuffix}?ref=${encodeURIComponent(parsed.ref)}`;
+}
+function decodeGitHubFileContent(entry) {
+    if (entry.encoding !== 'base64' || typeof entry.content !== 'string') {
+        throw new Error(`GitHub content API response did not include base64 content for ${entry.path}`);
+    }
+    return normalizeTextContent(Buffer.from(entry.content.replace(/\s+/gu, ''), 'base64').toString('utf8'));
+}
+function assertGitHubContentEntry(value) {
+    if (!value || typeof value !== 'object') {
+        throw new Error('Unexpected GitHub contents API response.');
+    }
+    const record = value;
+    if (typeof record.type !== 'string' || typeof record.name !== 'string' || typeof record.path !== 'string') {
+        throw new Error('Unexpected GitHub contents API entry shape.');
+    }
+    return record;
+}
+async function loadGitHubFile(fetchImpl, parsed, relativePath) {
+    const normalizedRelativePath = validateImportRelativeFilePath(relativePath);
+    const apiUrl = apiContentsUrl(parsed, normalizedRelativePath);
+    const entry = assertGitHubContentEntry(await fetchJson(fetchImpl, apiUrl));
+    if (entry.type !== 'file') {
+        throw new Error(`Expected a file in GitHub contents API response: ${normalizedRelativePath}`);
+    }
+    const content = entry.download_url
+        ? await readResponseText(await fetchImpl(entry.download_url), entry.download_url)
+        : decodeGitHubFileContent(entry);
+    return {
+        relativePath: normalizedRelativePath,
+        kind: kindForRelativePath(normalizedRelativePath),
+        content,
+    };
+}
+async function listGitHubDirectory(fetchImpl, parsed, relativePath) {
+    const apiUrl = apiContentsUrl(parsed, relativePath);
+    const value = await fetchJson(fetchImpl, apiUrl);
+    if (!Array.isArray(value)) {
+        throw new Error(`Expected a directory in GitHub contents API response: ${relativePath || '.'}`);
+    }
+    return value.map(assertGitHubContentEntry);
+}
+async function loadSupportDirectory(fetchImpl, parsed, directory) {
+    let entries;
+    try {
+        entries = await listGitHubDirectory(fetchImpl, parsed, directory);
+    }
+    catch (error) {
+        if (isGitHubNotFoundError(error)) {
+            return [];
+        }
+        throw error;
+    }
+    const files = [];
+    const pending = entries
+        .filter((entry) => entry.type === 'file')
+        .map((entry) => `${directory}/${entry.name}`)
+        .sort((left, right) => left.localeCompare(right));
+    for (const relativePath of pending) {
+        files.push(await loadGitHubFile(fetchImpl, parsed, relativePath));
+    }
+    return files;
+}
+async function loadExternalSkillFiles(fetchImpl, parsed) {
+    const files = [
+        await loadGitHubFile(fetchImpl, parsed, 'SKILL.md'),
+        ...(await loadSupportDirectory(fetchImpl, parsed, 'assets')),
+        ...(await loadSupportDirectory(fetchImpl, parsed, 'references')),
+        ...(await loadSupportDirectory(fetchImpl, parsed, 'scripts')),
+    ].sort((left, right) => left.relativePath.localeCompare(right.relativePath));
+    if (files.length > MAX_IMPORTED_FILES) {
+        throw new Error(`External skill import exceeds ${MAX_IMPORTED_FILES} files.`);
+    }
+    const totalBytes = files.reduce((total, file) => total + Buffer.byteLength(file.content, 'utf8'), 0);
+    if (totalBytes > MAX_TOTAL_BYTES) {
+        throw new Error(`External skill import exceeds ${MAX_TOTAL_BYTES} bytes.`);
+    }
+    return files;
+}
+function fileReports(files) {
+    return files.map((file) => ({
+        relative_path: file.relativePath,
+        kind: file.kind,
+        bytes: Buffer.byteLength(file.content, 'utf8'),
+        sha256: hashContent(file.content),
+    }));
+}
+function createTarget(skillName) {
+    const skillDir = `${EXTERNAL_SKILL_ROOT}/${skillName}`;
+    return {
+        root: EXTERNAL_SKILL_ROOT,
+        skill_name: skillName,
+        skill_dir: skillDir,
+        provenance_path: `${skillDir}/${PROVENANCE_FILE}`,
+    };
+}
+function writeImportedSkillFiles(projectRoot, target, source, files, fileReport, warnings) {
+    const targetPath = path.join(projectRoot, ...target.skill_dir.split('/'));
+    const skillPath = path.join(targetPath, 'SKILL.md');
+    if (existsSync(targetPath)) {
+        throw new Error(`External skill already exists: ${target.skill_dir}`);
+    }
+    ensureFileTargetInsideWithoutSymlinks(projectRoot, skillPath, { allowMissingLeaf: true });
+    const tempSkillDir = `${EXTERNAL_SKILL_ROOT}/.${target.skill_name}.tmp-${process.pid}-${Date.now()}`;
+    const tempTarget = {
+        ...target,
+        skill_dir: tempSkillDir,
+        provenance_path: `${tempSkillDir}/${PROVENANCE_FILE}`,
+    };
+    const tempPath = path.join(projectRoot, ...tempTarget.skill_dir.split('/'));
+    const tempSkillPath = path.join(tempPath, 'SKILL.md');
+    ensureFileTargetInsideWithoutSymlinks(projectRoot, tempSkillPath, { allowMissingLeaf: true });
+    try {
+        for (const file of files) {
+            writeUtf8FileInsideWithoutSymlinks(projectRoot, path.join(projectRoot, ...tempTarget.skill_dir.split('/'), ...file.relativePath.split('/')), file.content);
+        }
+        writeJsonFileInsideWithoutSymlinks(projectRoot, path.join(projectRoot, ...tempTarget.provenance_path.split('/')), {
+            schema_version: '1',
+            kind: 'external_skill_source',
+            source,
+            files: fileReport,
+            warnings,
+        });
+        renameSync(tempPath, targetPath);
+    }
+    catch (error) {
+        rmSync(tempPath, { recursive: true, force: true });
+        throw error;
+    }
+}
+function rejectionReport(mode, issue) {
+    return {
+        schema_version: '1',
+        kind: 'skill_import_report',
+        command: 'skill',
+        action: 'import',
+        ok: false,
+        mode,
+        status: 'rejected',
+        source: null,
+        target: null,
+        files: [],
+        warnings: [],
+        issues: [issue],
+        wrote_files: false,
+    };
+}
+export async function createExternalSkillImportReport(projectRoot, inputUrl, options) {
+    const mode = options.mode;
+    try {
+        const parsed = parseGitHubUrl(inputUrl, options.ref);
+        const fetchImpl = options.fetch ?? globalThis.fetch;
+        if (typeof fetchImpl !== 'function') {
+            throw new Error('This runtime does not provide fetch.');
+        }
+        const sourceFiles = await loadExternalSkillFiles(fetchImpl, parsed);
+        const skillName = targetNameForSkill(sourceFiles, parsed, options.name);
+        const target = createTarget(skillName);
+        const source = externalSkillSourceFromParsed(inputUrl, parsed);
+        const files = normalizeImportedSkillFiles(sourceFiles);
+        const reports = fileReports(files);
+        const warnings = [
+            ...(reports.some((file) => file.kind === 'script')
+                ? ['Imported scripts are inert reference files; mustflow does not grant command authority for external scripts.']
+                : []),
+            'External skills are untrusted until the agent reads and evaluates the selected SKILL.md.',
+        ];
+        if (mode === 'install') {
+            writeImportedSkillFiles(projectRoot, target, source, files, reports, warnings);
+        }
+        return {
+            schema_version: '1',
+            kind: 'skill_import_report',
+            command: 'skill',
+            action: 'import',
+            ok: true,
+            mode,
+            status: mode === 'install' ? 'installed' : 'preview',
+            source,
+            target,
+            files: reports,
+            warnings,
+            issues: [],
+            wrote_files: mode === 'install',
+        };
+    }
+    catch (error) {
+        return rejectionReport(mode, error instanceof Error ? error.message : String(error));
+    }
+}

package/dist/cli/lib/local-index/index.js

@@ -158,6 +158,10 @@ function indexedFilesMatch(database, currentFiles) {
     }
     return true;
 }
+const INDEXED_FILE_MTIME_TOLERANCE_MS = 1;
+function indexedFileMtimeMsEqual(storedMtimeMs, currentMtimeMs) {
+    return storedMtimeMs !== null && Math.abs(storedMtimeMs - currentMtimeMs) <= INDEXED_FILE_MTIME_TOLERANCE_MS;
+}
 function indexedFileMetadataMatch(database, currentFiles) {
     const rows = queryRows(database, 'SELECT path, source_scope, size_bytes, mtime_ms, parser_version FROM indexed_files ORDER BY path');
     if (rows.length !== currentFiles.length) {
@@ -172,7 +176,7 @@ function indexedFileMetadataMatch(database, currentFiles) {
         }
         if (normalizeIndexedFileSourceScope(toSearchString(row.source_scope)) !== current.sourceScope ||
             toNullableNumber(row.size_bytes) !== current.sizeBytes ||
-            toNullableNumber(row.mtime_ms) !== current.mtimeMs ||
+            !indexedFileMtimeMsEqual(toNullableNumber(row.mtime_ms), current.mtimeMs) ||
             toSearchString(row.parser_version) !== LOCAL_INDEX_PARSER_VERSION) {
             return false;
         }

package/dist/cli/lib/local-index/sql.js

@@ -1,5 +1,6 @@
 import { createRequire } from 'node:module';
-export async function loadSqlJs() {
+let sqlJsPromise = null;
+async function initializeSqlJs() {
     const require = createRequire(import.meta.url);
     const wasmPath = require.resolve('sql.js/dist/sql-wasm.wasm');
     const sqlJsModule = (await import('sql.js'));
@@ -13,3 +14,10 @@ export async function loadSqlJs() {
         },
     });
 }
+export async function loadSqlJs() {
+    sqlJsPromise ??= initializeSqlJs().catch((error) => {
+        sqlJsPromise = null;
+        throw error;
+    });
+    return sqlJsPromise;
+}

package/dist/cli/lib/run-plan.js

@@ -7,6 +7,7 @@ import { evaluateCommandIntentEligibility, } from '../../core/command-intent-eli
 import { inspectActiveRunLocks, } from '../../core/active-run-locks.js';
 import { isRecord, readPositiveInteger, readString, readStringArray, } from '../../core/config-loading.js';
 import { DEFAULT_COMMAND_MAX_OUTPUT_BYTES, COMMAND_OUTPUT_LIMIT_SCOPE, } from '../../core/command-output-limits.js';
+import { checkRepoApprovalGate } from '../../core/repo-approval-gate.js';
 import { normalizeSuccessExitCodes } from '../../core/success-exit-codes.js';
 import { normalizeSafeTestTargetPath, TEST_TARGET_PATH_ERROR } from '../../core/test-target-paths.js';
 import { evaluateCommandPreconditions, } from '../../core/command-preconditions.js';
@@ -124,6 +125,38 @@ function readRunIntentMetadata(contract, intent) {
         relatedOneshotChecks: readStringArray(intent, 'related_oneshot_checks') ?? [],
     };
 }
+function createApprovalBlock(projectRoot, metadata) {
+    const actionTypes = [];
+    if (metadata.network === true) {
+        actionTypes.push('network_access');
+    }
+    if (metadata.destructive === true) {
+        actionTypes.push('destructive_command');
+    }
+    if (actionTypes.length === 0) {
+        return null;
+    }
+    const approvalReport = checkRepoApprovalGate(projectRoot, actionTypes);
+    if (approvalReport.issues.length > 0) {
+        return {
+            reasonCode: 'approval_policy_unreadable',
+            detail: `Could not evaluate ${approvalReport.input.policy_path}: ${approvalReport.issues.join(' ')}`,
+        };
+    }
+    const requiredActions = approvalReport.decisions
+        .filter((decision) => decision.approval_required)
+        .map((decision) => decision.action_type);
+    if (requiredActions.length === 0) {
+        return null;
+    }
+    const reasonCode = requiredActions.includes('destructive_command')
+        ? 'destructive_requires_approval'
+        : 'network_requires_approval';
+    return {
+        reasonCode,
+        detail: `Action ${requiredActions.map((action) => JSON.stringify(action)).join(', ')} requires explicit approval before mf run can execute this intent.`,
+    };
+}
 function createBlockedRunPlan(contract, intentName, intent, eligibility, reasonCode, detail, preconditions = []) {
     const metadata = intent ? readRunIntentMetadata(contract, intent) : null;
     return {
@@ -177,6 +210,10 @@ export function createRunPlan(projectRoot, contract, intentName, options = {}) {
         return createBlockedRunPlan(contract, intentName, rawIntent, eligibility, eligibility.code, eligibility.detail, preconditions);
     }
     const metadata = readRunIntentMetadata(contract, rawIntent);
+    const approvalBlock = createApprovalBlock(projectRoot, metadata);
+    if (approvalBlock) {
+        return createBlockedRunPlan(contract, intentName, rawIntent, eligibility, approvalBlock.reasonCode, approvalBlock.detail, preconditions);
+    }
     const maxOutputBytesLimitDetail = getCommandMaxOutputBytesLimitDetail(contract, rawIntent);
     if (maxOutputBytesLimitDetail) {
         return createBlockedRunPlan(contract, intentName, rawIntent, eligibility, 'max_output_bytes_exceeds_limit', maxOutputBytesLimitDetail, preconditions);

package/dist/core/change-impact.js

@@ -195,6 +195,13 @@ function addDependencyImpacts(root, changedFiles, impacts, policy, findings, iss
             issues.push(`dependency-graph: ${issue}`);
         }
     }
+    for (const dependencyFinding of dependencyReport.findings) {
+        const mappedFinding = mapDependencyGraphTruncationFinding(dependencyFinding);
+        if (mappedFinding === null) {
+            continue;
+        }
+        findings.push(mappedFinding);
+    }
     const changedPathSet = new Set(sourcePaths);
     for (const edge of dependencyReport.edges) {
         if (!changedPathSet.has(edge.target_path) || changedPathSet.has(edge.source_path)) {
@@ -209,6 +216,15 @@ function addDependencyImpacts(root, changedFiles, impacts, policy, findings, iss
         }, policy, findings, issues);
     }
 }
+function mapDependencyGraphTruncationFinding(finding) {
+    if (finding.code === 'dependency_graph_max_files_exceeded') {
+        return makeFinding('change_impact_max_files_exceeded', 'high', finding.path, `Dependency graph input was truncated while computing change impact: ${finding.message}`);
+    }
+    if (finding.code === 'dependency_graph_max_nodes_exceeded' || finding.code === 'dependency_graph_max_edges_exceeded') {
+        return makeFinding('change_impact_max_impacts_exceeded', 'high', finding.path, `Dependency graph impact expansion was truncated while computing change impact: ${finding.message}`);
+    }
+    return null;
+}
 function createScriptHints(changedFiles) {
     const sourcePaths = changedFiles.filter((file) => file.surface === 'source').map((file) => file.path);
     const selectorRelevantFiles = changedFiles.filter((file) => ['source', 'test', 'schema', 'config', 'package', 'template', 'workflow', 'unknown'].includes(file.surface));

package/dist/core/code-outline.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 import { listSourceAnchorFiles, parseSourceAnchorsInContent, sourceAnchorTextContainsSecretLike, splitSourceAnchorList, } from './source-anchors.js';
 export const CODE_PACK_ID = 'code';
@@ -19,17 +20,7 @@ const SVELTE_EXTENSIONS = ['.svelte'];
 const GO_EXTENSIONS = ['.go'];
 const RUST_EXTENSIONS = ['.rs'];
 const PYTHON_EXTENSIONS = ['.py'];
-const IGNORED_DIRECTORIES = [
-    '.git',
-    '.mustflow/cache',
-    '.mustflow/state',
-    'node_modules',
-    'dist',
-    'build',
-    'coverage',
-    '.next',
-    '.turbo',
-];
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_OUTLINE_CODES = new Set([
     'code_outline_path_outside_root',
     'code_outline_unreadable_path',
@@ -97,8 +88,7 @@ export function languageForPath(filePath) {
     return languageAdapterForPath(filePath)?.languageForPath(filePath) ?? null;
 }
 function isIgnoredDirectory(relativePath) {
-    const normalized = normalizeRelativePath(relativePath);
-    return IGNORED_DIRECTORIES.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`));
+    return isIgnoredDirectoryPath(normalizeRelativePath(relativePath), IGNORED_DIRECTORIES);
 }
 function makeOutlineFinding(code, severity, pathValue, message) {
     return { code, severity, path: pathValue, message };

package/dist/core/config-chain.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 export const CONFIG_CHAIN_PACK_ID = 'repo';
 export const CONFIG_CHAIN_SCRIPT_ID = 'config-chain';
@@ -37,17 +38,7 @@ const CONFIG_FILE_NAMES = [
     '.mustflow/config/commands.toml',
     '.mustflow/config/mustflow.toml',
 ];
-const IGNORED_DIRECTORIES = [
-    '.git',
-    '.mustflow/cache',
-    '.mustflow/state',
-    'node_modules',
-    'dist',
-    'build',
-    'coverage',
-    '.next',
-    '.turbo',
-];
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_CODES = new Set([
     'config_chain_path_outside_root',
     'config_chain_unreadable_path',
@@ -133,8 +124,7 @@ function isConfigFile(relativePath) {
         /^tsconfig(?:\..*)?\.json$/u.test(name));
 }
 function isIgnoredDirectory(relativePath) {
-    const normalized = normalizeRelativePath(relativePath);
-    return IGNORED_DIRECTORIES.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`));
+    return isIgnoredDirectoryPath(normalizeRelativePath(relativePath), IGNORED_DIRECTORIES);
 }
 function normalizeTargetPath(projectRoot, targetPath) {
     const absolutePath = path.resolve(process.cwd(), targetPath);