mapify-cli 3.13.1__tar.gz → 3.15.0__tar.gz

{mapify_cli-3.13.1 → mapify_cli-3.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mapify-cli
-Version: 3.13.1
+Version: 3.15.0
 Summary: MAP Framework installer - Modular Agentic Planner for Claude Code
 Project-URL: Homepage, https://github.com/azalio/map-framework
 Project-URL: Repository, https://github.com/azalio/map-framework.git
@@ -201,7 +201,7 @@ These flows maintain branch-scoped artifacts under `.map/<branch>/` — `bluepri
 - **Daily-driver speed** — optimized for repeated use, not occasional demo workflows. Structured enough to prevent chaos, lightweight enough to keep token and time cost under control.
 - **Reviewable diffs** — `/map-plan` and `/map-efficient` require per-subtask size, concern, and constraint metadata, then validate `blueprint.json` *before* implementation, so oversized or mixed-concern plans fail early instead of surprising reviewers later.
 - **Gates that check the plan, not vibes** — `/map-check` and `/map-review` validate against the spec, tests, and diff instead of asking whether code "looks fine".
-- **Clean-room review** — `/map-review` auto-bundles spec, plan, tests, verification, and coverage evidence into a single durable input (`.map/<branch>/review-bundle.json`); `--detached` opens a read-only worktree for inspection without touching your branch.
+- **Clean-room review** — `/map-review` auto-bundles spec, plan, tests, verification, and coverage evidence into a single durable input (`.map/<branch>/review-bundle.json`); `--detached` opens a read-only worktree for inspection without touching your branch. With `minimality` enabled, review also runs an advisory what-to-delete lens for over-engineering cuts.
 - **Project memory** — `/map-learn` turns hard-won fixes and gotchas into reusable context, so the next session doesn't relearn them.
 
 <details>
@@ -249,7 +249,7 @@ MAP is inspired by the [MAP cognitive architecture](https://github.com/Shanka123
 minimality: lite   # new installs default to lite; existing repos without the key stay off
 ```
 
-Allowed values: `off`, `lite`, `full`, `ultra`. Phase 1 ships conservative `lite` defaults: Actor prefers the fewest moving parts, Monitor blocks scope drift only when it affects required behavior, and Evaluator scores simplicity without letting it hide missing required work.
+Allowed values: `off`, `lite`, `full`, `ultra`. Phase 1 ships conservative `lite` defaults: Actor prefers the fewest moving parts, Monitor blocks scope drift only when it affects required behavior, and Evaluator scores simplicity without letting it hide missing required work. `/map-review` also adds an advisory what-to-delete lens when minimality is not `off`; its `net: -N` estimate is informational, not a gate.
 
 **Context-compression policy** (controls the `/compact` nudge; default `never` — opt-in):
 

{mapify_cli-3.13.1 → mapify_cli-3.15.0}/README.md

@@ -157,7 +157,7 @@ These flows maintain branch-scoped artifacts under `.map/<branch>/` — `bluepri
 - **Daily-driver speed** — optimized for repeated use, not occasional demo workflows. Structured enough to prevent chaos, lightweight enough to keep token and time cost under control.
 - **Reviewable diffs** — `/map-plan` and `/map-efficient` require per-subtask size, concern, and constraint metadata, then validate `blueprint.json` *before* implementation, so oversized or mixed-concern plans fail early instead of surprising reviewers later.
 - **Gates that check the plan, not vibes** — `/map-check` and `/map-review` validate against the spec, tests, and diff instead of asking whether code "looks fine".
-- **Clean-room review** — `/map-review` auto-bundles spec, plan, tests, verification, and coverage evidence into a single durable input (`.map/<branch>/review-bundle.json`); `--detached` opens a read-only worktree for inspection without touching your branch.
+- **Clean-room review** — `/map-review` auto-bundles spec, plan, tests, verification, and coverage evidence into a single durable input (`.map/<branch>/review-bundle.json`); `--detached` opens a read-only worktree for inspection without touching your branch. With `minimality` enabled, review also runs an advisory what-to-delete lens for over-engineering cuts.
 - **Project memory** — `/map-learn` turns hard-won fixes and gotchas into reusable context, so the next session doesn't relearn them.
 
 <details>
@@ -205,7 +205,7 @@ MAP is inspired by the [MAP cognitive architecture](https://github.com/Shanka123
 minimality: lite   # new installs default to lite; existing repos without the key stay off
 ```
 
-Allowed values: `off`, `lite`, `full`, `ultra`. Phase 1 ships conservative `lite` defaults: Actor prefers the fewest moving parts, Monitor blocks scope drift only when it affects required behavior, and Evaluator scores simplicity without letting it hide missing required work.
+Allowed values: `off`, `lite`, `full`, `ultra`. Phase 1 ships conservative `lite` defaults: Actor prefers the fewest moving parts, Monitor blocks scope drift only when it affects required behavior, and Evaluator scores simplicity without letting it hide missing required work. `/map-review` also adds an advisory what-to-delete lens when minimality is not `off`; its `net: -N` estimate is informational, not a gate.
 
 **Context-compression policy** (controls the `/compact` nudge; default `never` — opt-in):
 

{mapify_cli-3.13.1 → mapify_cli-3.15.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mapify-cli"
-version = "3.13.1"
+version = "3.15.0"
 description = "MAP Framework installer - Modular Agentic Planner for Claude Code"
 authors = [{ name = "MAP Framework Contributors" }]
 readme = "README.md"

{mapify_cli-3.13.1 → mapify_cli-3.15.0}/src/mapify_cli/__init__.py

@@ -23,7 +23,7 @@ Or install globally:
     mapify check
 """
 
-__version__ = "3.13.1"
+__version__ = "3.15.0"
 
 import os
 import subprocess

{mapify_cli-3.13.1 → mapify_cli-3.15.0}/src/mapify_cli/templates/codex/agents/researcher.toml

@@ -8,40 +8,46 @@ You are a research agent. Your job is to explore the codebase and gather actiona
 findings for downstream agents (decomposer, actor). You do NOT implement anything.
 You observe, summarize, and report.
 
-## OUTPUT FORMAT
+## OUTPUT FORMAT (STRICT JSON)
 
-Write ONLY to the findings file specified in your task.
-Structure findings exactly as follows:
+Write ONLY one JSON object to the findings file specified in your task. Do not
+wrap it in markdown or prose. The downstream `validate_research` gate rejects
+malformed JSON, missing confidence, missing line ranges, unsafe paths, and more
+than 5 locations.
 
 ```
-## Findings: <topic>
-
-### Relevant Files
-- path/to/file.py:L10-L50 — description of what's there
-- path/to/other.py:L3-L20 — description
-
-### Key Patterns
-- Pattern name: how it works, where it's used
-- Pattern name: how it works, where it's used
-
-### Dependencies
-- External: list of external deps relevant to the task
-- Internal: list of internal modules that interact
-
-### Constraints Discovered
-- Constraint 1: description
-- Constraint 2: description
-
-### Recommendations
-- Recommendation for implementation approach
+{
+  "confidence": 0.85,
+  "status": "OK",
+  "search_method": "glob_grep",
+  "search_stats": {
+    "files_scanned": 50,
+    "total_matches_found": 23,
+    "results_truncated": true
+  },
+  "executive_summary": "One paragraph summary, max 100 words",
+  "relevant_locations": [
+    {
+      "path": "src/auth/service.py",
+      "lines": [45, 67],
+      "signature": "def validate_token(token: str) -> User",
+      "relevance": "Core JWT validation with expiry check",
+      "relevance_score": 0.95,
+      "has_intent": true
+    }
+  ],
+  "patterns_discovered": ["JWT with HS256", "decorator-based auth"]
+}
 ```
 
+Status values: `OK`, `PARTIAL_RESULTS`, `NO_RESULTS`, `SEARCH_FAILED`.
+
 ## RULES
 
 1. Target: under 1500 tokens in the findings file.
-2. Include: file paths, line ranges, function signatures, import patterns.
-3. Exclude: raw search output, full file contents, speculation.
-4. Use shell commands (find, rg/grep, cat) to search the codebase.
+2. Include: safe relative file paths, inclusive line ranges, function signatures, import patterns.
+3. Exclude: raw search output, full file contents, markdown fences, speculation.
+4. Return at most 5 `relevant_locations`, prioritized by relevance.
 5. Read files to understand patterns — do not guess.
 6. Focus on WHAT EXISTS, not what should be built.
 7. If the task mentions external libraries, note their current usage patterns in the codebase.

{mapify_cli-3.13.1 → mapify_cli-3.15.0}/src/mapify_cli/templates/codex/hooks/workflow-gate.py

@@ -390,8 +390,10 @@ def is_editing_phase(branch: str) -> tuple[bool, Optional[str]]:
             "Required:\n"
             f"  1. echo '<findings>' | python3 .map/scripts/map_step_runner.py \\\n"
             f"       save_research <branch> {subtask}  # default kind=actor\n"
-            f"  2. python3 .map/scripts/map_orchestrator.py validate_step 2.2\n"
-            "  3. Then Edit/Write opens (ACTOR phase).\n"
+            f"  2. python3 .map/scripts/map_step_runner.py validate_research \\\n"
+            f"       <branch> {subtask}\n"
+            f"  3. python3 .map/scripts/map_orchestrator.py validate_step 2.2\n"
+            "  4. Then Edit/Write opens (ACTOR phase).\n"
             "\n"
             f"Note: this block is scoped to {subtask}'s affected_files. Edits to\n"
             "files OUTSIDE that surface (orthogonal hotfixes, repo-root config,\n"

{mapify_cli-3.13.1 → mapify_cli-3.15.0}/src/mapify_cli/templates/codex/skills/map-efficient/SKILL.md

@@ -160,12 +160,14 @@ fi
 ### RESEARCH
 
 Use `researcher` when independent exploration is useful; otherwise research in
-the current session. Persist concise findings before Actor work:
+the current session. Persist concise strict-JSON findings, validate the research
+contract, then close RESEARCH before Actor work:
 
 ```bash
 SUBTASK_ID=$(jq -r '.current_subtask_id' ".map/${BRANCH}/step_state.json")
 printf '%s' "$RESEARCH_FINDINGS" | \
   python3 .map/scripts/map_step_runner.py save_research "$BRANCH" "$SUBTASK_ID"
+python3 .map/scripts/map_step_runner.py validate_research "$BRANCH" "$SUBTASK_ID"
 python3 .map/scripts/map_orchestrator.py validate_step "$STEP_ID"
 ```
 

{mapify_cli-3.13.1 → mapify_cli-3.15.0}/src/mapify_cli/templates/hooks/safety-guardrails.py

@@ -14,9 +14,7 @@ Exit codes:
 
 import json
 import os
-import re
 import sys
-from pathlib import Path
 
 # =============================================================================
 # Default constants (overridable via .map/config.yaml → safe_path_prefixes)
@@ -36,6 +34,19 @@ _DEFAULT_DANGEROUS_FILE_PATTERNS = [
     r"tokens?\.(json|ya?ml|toml|txt)$",  # token files, not any file with "token" in path
 ]
 
+_DEFAULT_DANGEROUS_FILE_MARKERS = (
+    ".env",
+    "credential",
+    "private",
+    "key",
+    ".pem",
+    "secret",
+    "id_rsa",
+    "id_ed25519",
+    "password",
+    "token",
+)
+
 # Dangerous bash command patterns
 _DEFAULT_DANGEROUS_COMMANDS = [
     # Block `rm -rf /` (bare root), `rm -rf /etc`, `rm -rf /home/user`, etc.,
@@ -81,14 +92,14 @@ def _load_config_overrides() -> dict:
     Reads safe_path_prefixes from project config to allow customization.
     Falls back to defaults when config is missing or unreadable.
     """
-    project_dir = Path(os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd()))
-    config_path = project_dir / ".map" / "config.yaml"
-    if not config_path.exists():
+    project_dir = os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())
+    config_path = os.path.join(project_dir, ".map", "config.yaml")
+    if not os.path.exists(config_path):
         return {}
     try:
         import yaml  # type: ignore[import-untyped]
 
-        with open(config_path) as f:
+        with open(config_path, encoding="utf-8") as f:
             data = yaml.safe_load(f)
         return data if isinstance(data, dict) else {}
     except Exception:
@@ -121,6 +132,13 @@ def check_file_safety(path: str) -> tuple[bool, str]:
 
     # Check dangerous patterns
     path_lower = path.lower()
+    if DANGEROUS_FILE_PATTERNS == _DEFAULT_DANGEROUS_FILE_PATTERNS and not any(
+        marker in path_lower for marker in _DEFAULT_DANGEROUS_FILE_MARKERS
+    ):
+        return True, ""
+
+    import re
+
     for pattern in DANGEROUS_FILE_PATTERNS:
         if re.search(pattern, path_lower, re.IGNORECASE):
             return (
@@ -136,6 +154,8 @@ def check_command_safety(command: str) -> tuple[bool, str]:
     if not command:
         return True, ""
 
+    import re
+
     for pattern in DANGEROUS_COMMANDS:
         if re.search(pattern, command, re.IGNORECASE):
             return False, f"Blocked: Dangerous command pattern detected: {pattern}"

{mapify_cli-3.13.1 → mapify_cli-3.15.0}/src/mapify_cli/templates/hooks/workflow-gate.py

@@ -390,8 +390,10 @@ def is_editing_phase(branch: str) -> tuple[bool, Optional[str]]:
             "Required:\n"
             f"  1. echo '<findings>' | python3 .map/scripts/map_step_runner.py \\\n"
             f"       save_research <branch> {subtask}  # default kind=actor\n"
-            f"  2. python3 .map/scripts/map_orchestrator.py validate_step 2.2\n"
-            "  3. Then Edit/Write opens (ACTOR phase).\n"
+            f"  2. python3 .map/scripts/map_step_runner.py validate_research \\\n"
+            f"       <branch> {subtask}\n"
+            f"  3. python3 .map/scripts/map_orchestrator.py validate_step 2.2\n"
+            "  4. Then Edit/Write opens (ACTOR phase).\n"
             "\n"
             f"Note: this block is scoped to {subtask}'s affected_files. Edits to\n"
             "files OUTSIDE that surface (orthogonal hotfixes, repo-root config,\n"

{mapify_cli-3.13.1 → mapify_cli-3.15.0}/src/mapify_cli/templates/map/scripts/map_orchestrator.py

@@ -1333,22 +1333,34 @@ def validate_step(
                 "recommendation": normalized_rec,
             }
     # RESEARCH (2.2) is documented MANDATORY for every subtask — enforce that
-    # save_research wrote something before letting Actor proceed. Without this
-    # check, "MANDATORY" was prompt-text only and could be silently skipped.
+    # save_research wrote a machine-checkable artifact before letting Actor
+    # proceed. Without this check, "MANDATORY" was prompt-text only and
+    # malformed markdown could be silently passed downstream.
     if step_id == "2.2" and state.current_subtask_id:
-        research_dir = Path(f".map/{branch}/research")
-        # Accept any kind of research artifact for this subtask.
-        if not research_dir.is_dir() or not any(
-            research_dir.glob(f"{state.current_subtask_id}__*.md")
-        ):
+        try:
+            from map_step_runner import validate_research  # pyright: ignore[reportMissingImports]
+            research_report = validate_research(branch, state.current_subtask_id)
+        except ImportError:
+            research_report = {
+                "valid": False,
+                "errors": ["map_step_runner.validate_research could not be imported"],
+            }
+        if not research_report.get("valid"):
+            research_errors = research_report.get("errors")
+            if isinstance(research_errors, list) and research_errors:
+                detail = "; ".join(str(err) for err in research_errors[:3])
+            else:
+                detail = "research artifact is missing or invalid"
             return {
                 "valid": False,
                 "message": (
-                    f"RESEARCH not persisted for {state.current_subtask_id}. "
+                    f"RESEARCH artifact invalid for {state.current_subtask_id}: "
+                    f"{detail}. "
                     f"Run: python3 .map/scripts/map_step_runner.py save_research "
                     f"<branch> {state.current_subtask_id} (defaults kind=actor) "
-                    "before validate_step 2.2."
+                    "then validate_research before validate_step 2.2."
                 ),
+                "research_report": research_report,
             }
         # Auto-snapshot per-subtask baseline at RESEARCH-complete so the
         # MONITOR-side validate_mutation_boundary check only flags files