nexarch 0.13.7 → 0.13.8

package/dist/commands/init-agent.js

@@ -344,7 +344,8 @@ export function canonicalTargetKey(filePath) {
  * consent from the dry-run result before calling again with `dryRun: false`
  * to actually write — see the ADR-0112 note at the call site.
  */
-function injectAgentConfigs(registry, runtimeCodes, dryRun) {
+/** Exported for regression coverage of the empty-return bug documented at its tail. */
+export function injectAgentConfigs(registry, runtimeCodes, dryRun) {
     const templateByCode = new Map(registry.instructionTemplates.map((t) => [t.code, t]));
     const sortedTargets = [...registry.instructionTargets]
         .filter((target) => target.matchMode === "exact")
@@ -437,7 +438,17 @@ function injectAgentConfigs(registry, runtimeCodes, dryRun) {
         if (perRuntimeResults.length > 0)
             return [...existingResults, ...perRuntimeResults.filter((result, index, arr) => arr.findIndex((item) => canonicalTargetKey(item.path) === canonicalTargetKey(result.path)) === index)];
     }
-    return [];
+    // Not `[]`. When every runtime's target was already collected into
+    // `existingMatches` — which is the steady state once a repo has been set up
+    // once — the per-runtime loop `continue`s on all of them and
+    // `perRuntimeResults` comes back empty. Returning [] here threw away the
+    // results already computed above, the caller read that as "no instruction
+    // files" and fell back to injectGenericAgentConfig, and from then on only
+    // the generic target (AGENTS.md) was ever seen. Paul's CLAUDE.md and
+    // .cursorrules were invisible to staleness checking and attestation refresh
+    // from the second setup run onward, which is how they kept an expired
+    // `instruction_injection` block while the handshake reported all green.
+    return existingResults;
 }
 function trustAttestationStaleness(path) {
     if (!existsSync(path))
@@ -507,6 +518,45 @@ export function instructionInjectionDetail(registrationOk, staleAttestationTarge
         return `updated ${agentConfigResults.length} instruction target file(s)`;
     return "no runtime instruction target matched this repository (non-fatal; create AGENTS.md/CLAUDE.md or configure a generic target)";
 }
+/**
+ * Every instruction file the registry recognises that actually exists in this
+ * repo, deduplicated the way the rest of this module keys paths.
+ *
+ * This is the denominator for the coverage guard below. It is deliberately
+ * computed straight from the registry and the filesystem rather than from
+ * whatever the injection path happened to return, because the bug it guards
+ * against was the injection path silently returning fewer files than exist.
+ */
+export function existingInstructionFilePaths(registry) {
+    const seen = new Set();
+    const paths = [];
+    for (const target of registry.instructionTargets) {
+        if (target.matchMode !== "exact")
+            continue;
+        const filePath = join(process.cwd(), target.filePathPattern);
+        const key = canonicalTargetKey(filePath);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        if (existsSync(filePath))
+            paths.push(filePath);
+    }
+    return paths;
+}
+/**
+ * Instruction files that exist on disk but were never evaluated for staleness.
+ *
+ * "already current (no refresh needed)" is only honest about files somebody
+ * looked at. When the injection path under-reports its targets, the attestation
+ * check evaluates a subset and reports green for the whole repo — which is
+ * exactly how two of Paul's three files kept an expired, wrongly-scoped block
+ * through a clean setup run. A non-empty result here fails the check rather
+ * than letting it speak for files it never opened.
+ */
+export function unevaluatedInstructionFiles(onDisk, evaluated) {
+    const evaluatedKeys = new Set(evaluated.map((result) => canonicalTargetKey(result.path)));
+    return onDisk.filter((path) => !evaluatedKeys.has(canonicalTargetKey(path)));
+}
 /**
  * Summarises the per-target attestation writes into the check's ok/detail.
  *
@@ -1481,6 +1531,9 @@ export async function initAgent(args) {
                 : identityCapture.detail,
     });
     const instructionsAlreadyConfigured = agentConfigResults.length > 0 && agentConfigResults.every((r) => r.status === "already_present");
+    const uncoveredInstructionFiles = registration.ok
+        ? unevaluatedInstructionFiles(existingInstructionFilePaths(registry), agentConfigResults)
+        : [];
     const attestationSummary = summariseAttestationOutcomes(attestationOutcomes);
     /** Renewed means every attested target verified on disk, not that one mint succeeded. */
     const attestationRenewed = attestationOutcomes.length > 0 && attestationSummary.ok;
@@ -1492,23 +1545,26 @@ export async function initAgent(args) {
     checks.push({
         name: "agent.trust.attestation",
         ok: !registration.ok || (unsafeReattestationTargetCount === 0
+            && uncoveredInstructionFiles.length === 0
             && attestationSummary.ok
             && ((staleAttestationTargetCount === 0 && !trustAttestationAttempted) || Boolean(trustAttestation?.ok))),
         detail: !registration.ok
             ? "skipped (registration failed)"
-            : unsafeReattestationTargetCount > 0
-                ? "managed section does not match the published template; re-run with --allow-instruction-write"
-                : staleAttestationTargetCount > 0 && !attestationWriteAllowed
-                    ? `${mismatchedAttestationTargetCount > 0 ? "mismatched" : "stale"}; re-run with --reattest`
-                    : instructionsAlreadyConfigured && !attestationWriteAllowed
-                        ? "skipped (already configured)"
-                        : !attestationWriteAllowed
-                            ? "skipped (consent not granted)"
-                            : !trustAttestationAttempted
-                                ? agentConfigResults.length > 0
-                                    ? "already current (no refresh needed)"
-                                    : "skipped (no instruction target written)"
-                                : attestationSummary.detail,
+            : uncoveredInstructionFiles.length > 0
+                ? `${uncoveredInstructionFiles.length} instruction file(s) on disk were never evaluated (${uncoveredInstructionFiles.map((path) => basename(path)).join(", ")}); their attestations are unverified`
+                : unsafeReattestationTargetCount > 0
+                    ? "managed section does not match the published template; re-run with --allow-instruction-write"
+                    : staleAttestationTargetCount > 0 && !attestationWriteAllowed
+                        ? `${mismatchedAttestationTargetCount > 0 ? "mismatched" : "stale"}; re-run with --reattest`
+                        : instructionsAlreadyConfigured && !attestationWriteAllowed
+                            ? "skipped (already configured)"
+                            : !attestationWriteAllowed
+                                ? "skipped (consent not granted)"
+                                : !trustAttestationAttempted
+                                    ? agentConfigResults.length > 0
+                                        ? "already current (no refresh needed)"
+                                        : "skipped (no instruction target written)"
+                                    : attestationSummary.detail,
     });
     checks.push({
         name: "technology.components",

package/dist/commands/policy-audit-template.js

@@ -37,24 +37,24 @@ export async function policyAuditTemplate(args) {
     const defaultResult = (parseOptionValue(args, "--default-result") ?? "fail").toLowerCase();
     const selectedControlIds = new Set(parseMultiOptionValues(args, "--control-id"));
     if (parseFlag(args, "--help") || parseFlag(args, "-h")) {
-        console.log(`
-Usage:
-  nexarch policy-audit-template --entity <application:key> [options]
-
-Options:
-  --entity <key>                 Required (e.g. application:bad-driving)
-  --control-id <uuid>            Optional repeatable filter (selected controls only)
-  --default-result <value>       pass|partial|fail (default: fail)
-  --output, --out <path.json>    Write findings array to file
-  --json                         Print JSON to stdout
-
-Output shape is ready for:
-  nexarch policy-audit-submit --findings-file <path.json>
-
-Each entry includes empty severity/effort/exploitability/confidence/fileRefs
-placeholders. Fill them in for every partial/fail finding -- they decide how
-findings get ranked and reported. Leave a field blank/empty rather than
-guess; policy-audit-submit drops anything that isn't a valid value.
+        console.log(`
+Usage:
+  nexarch policy-audit-template --entity <application:key> [options]
+
+Options:
+  --entity <key>                 Required (e.g. application:bad-driving)
+  --control-id <uuid>            Optional repeatable filter (selected controls only)
+  --default-result <value>       pass|partial|fail (default: fail)
+  --output, --out <path.json>    Write findings array to file
+  --json                         Print JSON to stdout
+
+Output shape is ready for:
+  nexarch policy-audit-submit --findings-file <path.json>
+
+Each entry includes empty severity/effort/exploitability/confidence/fileRefs
+placeholders. Fill them in for every partial/fail finding -- they decide how
+findings get ranked and reported. Leave a field blank/empty rather than
+guess; policy-audit-submit drops anything that isn't a valid value.
 `);
         return;
     }

package/package.json

@@ -1,39 +1,39 @@
-{
-  "name": "nexarch",
-  "version": "0.13.7",
-  "description": "Your architecture workspace for AI delivery.",
-  "keywords": [
-    "nexarch",
-    "mcp",
-    "architecture",
-    "ai"
-  ],
-  "license": "MIT",
-  "author": "Nexarch <hello@nexarch.ai>",
-  "homepage": "https://nexarch.ai",
-  "engines": {
-    "node": ">=18"
-  },
-  "type": "module",
-  "bin": {
-    "nexarch": "dist/index.js"
-  },
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "build": "tsc",
-    "prepublishOnly": "tsc",
-    "dev": "tsx src/index.ts",
-    "typecheck": "tsc --noEmit",
-    "test": "tsx scripts/test-mcp-proxy-response.ts && tsx scripts/test-trust-reattest.ts && tsx scripts/test-similar-applications.ts && tsx scripts/test-iac-tool.ts && tsx scripts/test-ansible.ts && tsx scripts/test-reference-sightings.ts && tsx scripts/test-search-icons.ts && tsx scripts/test-paste-login.ts"
-  },
-  "devDependencies": {
-    "@types/node": "^22",
-    "tsx": "^4",
-    "typescript": "^5"
-  },
-  "dependencies": {
-    "yaml": "^2.9.0"
-  }
-}
+{
+  "name": "nexarch",
+  "version": "0.13.8",
+  "description": "Your architecture workspace for AI delivery.",
+  "keywords": [
+    "nexarch",
+    "mcp",
+    "architecture",
+    "ai"
+  ],
+  "license": "MIT",
+  "author": "Nexarch <hello@nexarch.ai>",
+  "homepage": "https://nexarch.ai",
+  "engines": {
+    "node": ">=18"
+  },
+  "type": "module",
+  "bin": {
+    "nexarch": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "tsc",
+    "dev": "tsx src/index.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "tsx scripts/test-mcp-proxy-response.ts && tsx scripts/test-trust-reattest.ts && tsx scripts/test-similar-applications.ts && tsx scripts/test-iac-tool.ts && tsx scripts/test-ansible.ts && tsx scripts/test-reference-sightings.ts && tsx scripts/test-search-icons.ts && tsx scripts/test-paste-login.ts"
+  },
+  "devDependencies": {
+    "@types/node": "^22",
+    "tsx": "^4",
+    "typescript": "^5"
+  },
+  "dependencies": {
+    "yaml": "^2.9.0"
+  }
+}