fix: MPI cycle — CLI 0.19 docs, brace-expansion audit, AGENTS refresh (#217)

* fix: align CLI 0.19.0 docs, clear brace-expansion audit, refresh counts

- Override brace-expansion to 5.0.8 (CVE-2026-14257 / GHSA-mh99-v99m-4gvg)
- Recommend Patchloom CLI 0.19.0; document already_exists create/rename recovery
- Unit test formatCliOutput for already_exists JSON envelopes
- Refresh AGENTS.md unit test counts (patchloomCli 39, initializeProject 30)

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

* chore: refresh @types/vscode lock to 1.125.0

Keep package.json range at ^1.90.0 so vsce package stays compatible with
engines.vscode, while resolving newer typings for local compile.

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

* docs: list verifyMcp.ts and release-merge guard in AGENTS structure

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

---------

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

Author: SebTardif

AGENTS.md

@@ -37,6 +37,7 @@ src/
     batchApply.ts        Batch Apply command: atomic multi-operation plan via JSON
     setupWorkspace.ts     Setup Workspace command: guided readiness walkthrough
     showStatus.ts         Show Status command: diagnostics display
+    verifyMcp.ts         Verify MCP Server command: JSON-RPC initialize probe
     autoUpdate.ts        Auto-update check on activation: compare installed vs latest release
   install/managed.ts     Managed install safety: checksum, staging, promotion, rollback, persistence
   logging/outputChannel.ts  Output channel wrapper: log, logCommand, logResult, show, dispose
@@ -50,11 +51,11 @@ test/
     batchApply.test.ts   Batch template and operation count parsing (15 tests)
     binary.test.ts       Binary discovery, managed install, compatibility, workspace env (59 tests)
     binaryDiscovery.test.ts  Real executable discovery on PATH (13 tests)
-    initializeProject.test.ts  Status display, agents file classification, formatError (29 tests)
+    initializeProject.test.ts  Status display, agents file classification, formatError (30 tests)
     managedLifecycle.test.ts   Managed install with real file I/O (22 tests)
     mcpConfig.test.ts    MCP config with real temp directories (9 tests)
     outputChannel.test.ts Output channel logging wrapper (10 tests)
-    patchloomCli.test.ts Patchloom CLI integration with real binary + managed install e2e MCP (37 tests incl. e2e)
+    patchloomCli.test.ts Patchloom CLI integration with real binary + managed install e2e MCP (39 tests incl. e2e)
     propertyBased.test.ts  Property-based tests with fast-check (13 tests)
     quickActions.test.ts Quick action command building, path containment, patch merge (57 tests)
     verifyMcp.test.ts    MCP server verify and JSON-RPC response parsing (15 tests)
@@ -66,6 +67,7 @@ test/
     extension.test.ts    ExTester UI tests (status bar, command palette)
 scripts/
   hide-test-vscode.sh   macOS: patch test VS Code to suppress window activation
+  guard-no-release-merge.sh  Hard abort if agent tries to merge a release PR without approval
 .github/
   CODEOWNERS               Owner for all files
   copilot-instructions.md  Pointer to AGENTS.md for GitHub Copilot

README.md

@@ -170,14 +170,17 @@ The extension detects outdated CLI builds and warns with upgrade guidance. It re
 Set `patchloom.path` in settings, or add the CLI to your `PATH`.
 
 **CLI compatibility warning**
-Run `Patchloom: Open Releases` to download the latest release. The extension requires 0.3.0 or newer; 0.18.0 is recommended.
+Run `Patchloom: Open Releases` to download the latest release. The extension requires 0.3.0 or newer; 0.19.0 is recommended.
 
 **Path rejected by workspace guard**
 Quick Actions and Batch Apply pass `--contain` so paths stay inside the open workspace folder. On CLI 0.18+, sandbox escapes report `error_kind: guard_rejected` (not a generic `invalid_input`). Keep targets under the workspace root, or open the folder that owns the files.
 
 **Batch replace shape**
 Batch lines use `replace PATH OLD NEW` (and optional flags such as `--fuzzy`). Do not paste CLI form `replace OLD --new NEW path` into a batch plan; CLI 0.18+ returns a clear parse error with the PATH OLD NEW hint.
 
+**Create or rename destination already exists**
+On CLI 0.19+, create/rename conflicts report `error_kind: already_exists` (not a generic `invalid_input`). Use the force flag when overwriting is intentional, or pick a free destination path.
+
 **MCP config not injected**
 Run `Patchloom: Configure MCP` and select the target editor config.
 
@@ -211,7 +214,7 @@ File bugs and feature requests at [patchloom/patchloom-vscode/issues](https://gi
 ## Requirements
 
 - VS Code 1.90 or newer (or compatible editors: Cursor, Windsurf, VSCodium)
-- [Patchloom CLI](https://github.com/patchloom/patchloom) 0.3.0 or newer (0.18.0+ recommended for structured `guard_rejected` on `--contain` failures, clearer batch `replace PATH OLD NEW` parse hints, multi-doc `doc merge --selector`, line-oriented `insert_before`/`insert_after`, 56 MCP tools, JSON `applied` honesty, and agent-facing `error_kind` envelopes)
+- [Patchloom CLI](https://github.com/patchloom/patchloom) 0.3.0 or newer (0.19.0+ recommended for stable `error_kind` peels including `already_exists` / `not_found` / `guard_rejected`, clearer create/rename force hints, multi-doc `doc merge --selector`, line-oriented `insert_before`/`insert_after`, batch `replace PATH OLD NEW` parse hints, 56 MCP tools, JSON `applied` honesty, and agent-facing envelopes)
 
 ## Contributing
 

package-lock.json

@@ -253,6 +253,7 @@
     "check": "npm run test && npm run test:coverage && npm run package"
   },
   "overrides": {
+    "brace-expansion": "5.0.8",
     "mocha": {
       "diff": "^8.0.3",
       "serialize-javascript": "^7.0.5"

package.json

@@ -85,6 +85,19 @@ test("formatCliOutput prefers JSON error over noisy stderr", () => {
   );
 });
 
+test("formatCliOutput surfaces already_exists kind (CLI 0.19+)", () => {
+  const stdout = JSON.stringify({
+    ok: false,
+    error: "destination already exists: src/out.ts",
+    error_kind: "already_exists",
+    applied: false
+  });
+  assert.equal(
+    formatCliOutput({ exitCode: 1, stdout, stderr: "" }),
+    "already_exists: destination already exists: src/out.ts"
+  );
+});
+
 test("classifyAgentsFile returns missing when AGENTS.md does not exist", () => {
   assert.equal(classifyAgentsFile(undefined, "# Rules\n"), "missing");
 });