vgxness 1.11.0 → 1.12.0

package/dist/mcp/validation.js

@@ -537,7 +537,7 @@ function validateMemorySearchInput(input, tool) {
         return type;
     if (type.value !== undefined)
         result.type = type.value;
-    const topicKey = readOptionalTopicKey(record.value, tool);
+    const topicKey = readOptionalSearchTopicKey(record.value, tool);
     if (!topicKey.ok)
         return topicKey;
     if (topicKey.value !== undefined)
@@ -1239,6 +1239,18 @@ function readOptionalTopicKey(record, tool) {
         return validationFailure('topicKey must contain only letters, numbers, dots, underscores, slashes, or hyphens', tool);
     return topicKey;
 }
+function readOptionalSearchTopicKey(record, tool) {
+    if (record.topicKey === undefined)
+        return { ok: true, value: undefined };
+    const topicKey = readLimitedNonEmptyString(record, 'topicKey', tool, maxMemoryTopicKeyLength);
+    if (!topicKey.ok)
+        return topicKey;
+    if (topicKey.value === '*')
+        return topicKey;
+    if (!validMemoryTopicKeyPattern.test(topicKey.value))
+        return validationFailure('topicKey must be * or contain only letters, numbers, dots, underscores, slashes, or hyphens', tool);
+    return topicKey;
+}
 function readMemorySearchLimit(record, tool) {
     return readBoundedLimit(record, tool);
 }

package/dist/memory/repositories/observations.js

@@ -84,7 +84,6 @@ export class ObservationRepository {
                 ['project', 'project'],
                 ['scope', 'scope'],
                 ['type', 'type'],
-                ['topicKey', 'topic_key'],
             ]) {
                 const value = filters[key];
                 if (value) {
@@ -92,6 +91,18 @@ export class ObservationRepository {
                     params[key] = value;
                 }
             }
+            if (filters.topicKey) {
+                const topicKeyFilter = normalizeTopicKeySearchFilter(filters.topicKey);
+                if (topicKeyFilter.kind === 'exact') {
+                    where.push('o.topic_key=@topicKey');
+                    params.topicKey = topicKeyFilter.value;
+                }
+                else if (topicKeyFilter.kind === 'prefix') {
+                    where.push(`(o.topic_key=@topicKey OR o.topic_key LIKE @topicKeyPrefix ESCAPE '\\')`);
+                    params.topicKey = topicKeyFilter.value;
+                    params.topicKeyPrefix = `${escapeLike(topicKeyFilter.value)}/%`;
+                }
+            }
             const rows = this.db.connection
                 .prepare(`SELECT o.* FROM ${from} ${where.length ? `WHERE ${where.join(' AND ')}` : ''} ORDER BY o.updated_at DESC LIMIT @limit`)
                 .all(params);
@@ -138,6 +149,16 @@ export class ObservationRepository {
         });
     }
 }
+function normalizeTopicKeySearchFilter(topicKey) {
+    if (topicKey === '*')
+        return { kind: 'all' };
+    if (!topicKey.includes('/'))
+        return { kind: 'prefix', value: topicKey };
+    return { kind: 'exact', value: topicKey };
+}
+function escapeLike(value) {
+    return value.replace(/[\\%_]/g, (match) => `\\${match}`);
+}
 function map(row) {
     const value = {
         id: row.id,

package/dist/permissions/policy-evaluator.js

@@ -2,6 +2,7 @@ import { existsSync, realpathSync } from 'node:fs';
 import { dirname, isAbsolute, resolve, sep } from 'node:path';
 import { classifyOperationRisk } from '../governance/risk-classifier.js';
 import { isSddPhase, sddPhases } from '../sdd/schema.js';
+import { commandAllowlistIds } from '../workflows/command-allowlist-adapter.js';
 export { isRiskyPermissionCategory, permissionCategories, riskyPermissionCategories } from './schema.js';
 export const permissionDecisions = ['allow', 'ask', 'deny'];
 export const permissionModes = ['allow', 'audit', 'require-preflight', 'deny'];
@@ -94,6 +95,9 @@ export function evaluatePermission(request, policy = defaultPermissionPolicy) {
     const workspaceEscape = workspaceEscapeDecision(request);
     if (workspaceEscape !== undefined)
         return workspaceEscape;
+    const verifyAllowlistedCommand = verifyAllowlistedCommandDecision(request, risk);
+    if (verifyAllowlistedCommand !== undefined)
+        return verifyAllowlistedCommand;
     const sddPhaseDecision = phaseMatrixDecision(request);
     if (sddPhaseDecision !== undefined && sddPhaseDecision.mode !== 'allow' && sddPhaseDecision.mode !== 'audit')
         return sddPhaseDecision;
@@ -214,6 +218,28 @@ function phaseMatrixDecision(request) {
         ...(mode === 'audit' ? { warnings: ['opencode-native-tools-audit-only'] } : {}),
     });
 }
+function verifyAllowlistedCommandDecision(request, risk) {
+    if (!isSddManagedWorkflow(request.workflow) || request.phase !== 'verify' || request.category !== 'shell')
+        return undefined;
+    const commandId = parseKnownCommandAllowlistOperation(request.operation);
+    if (commandId === undefined)
+        return undefined;
+    return result(request, 'allow', 'allowlisted_command', `SDD verify allows known command allowlist operation ${commandId} as audit-only.`, {
+        mode: 'audit',
+        auditOnly: true,
+        matrixVersion: sddPhasePermissionMatrixVersion,
+        auditEvidence: [...risk.evidence, `commandAllowlistId:${commandId}`],
+    }, risk);
+}
+function parseKnownCommandAllowlistOperation(operation) {
+    const match = /^command-allowlist:([A-Za-z0-9._/-]+)$/.exec(operation);
+    if (match === null)
+        return undefined;
+    const commandId = match[1];
+    if (commandId === undefined)
+        return undefined;
+    return commandAllowlistIds().includes(commandId) ? commandId : undefined;
+}
 function isSddManagedWorkflow(workflow) {
     if (workflow === undefined)
         return false;

package/docs/mcp.md

@@ -37,7 +37,7 @@ All tools:
 | `vgxness_memory_get` | Read one observation by id. | `id` |
 | `vgxness_memory_update` | Patch an existing observation. | `id`; optional `type`, `title`, `content`, `topicKey` |
 
-`topicKey` is the durable upsert key: re-saving with the same key updates the existing observation rather than creating a duplicate.
+`topicKey` is the durable upsert key: re-saving with the same key updates the existing observation rather than creating a duplicate. For `vgxness_memory_search` only, `topicKey: "*"` searches across all topic keys, and a top-level key such as `"release"` also matches observations under that prefix, for example `release/...`.
 
 ## Sessions (5)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vgxness",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "description": "CLI and MCP control plane for guided AI-agent workflows, SDD, memory, and OpenCode setup.",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {