release: config-first sources, doc cleanup, audio skill, dist gitignore

.gitignore

@@ -12,7 +12,6 @@ private/**
 *.tgz
 release-artifacts/
 *.pid
-*dist
 
 packages/ragmir-core/dist/
 packages/ragmir-tts/dist/

AGENTS.md

@@ -33,8 +33,9 @@
   repairs. `ragmir init`, `ragmir install-skill`, and `ragmir ingest` remain available as explicit
   lower-level commands.
 - Keep monorepo source onboarding simple: the `sources` array in `.ragmir/config.json` accepts paths,
-  glob patterns, and `!` exclusions. The legacy `.ragmir/sources.txt` file (managed by `ragmir sources
-  add/list`) is still read and merged when present, but `ragmir init` no longer creates it.
+  glob patterns, and `!` exclusions, and `ragmir sources add/list` read and write that array. The
+  legacy `.ragmir/sources.txt` file is still read (read-only) and merged when present, but it is never
+  created or written anymore; `ragmir init` no longer creates it.
 - Keep product documentation canonical in the root `README.md`. Package README files under
   `packages/*/README.md` are intentionally minimal npm entrypoints and must link clearly to the
   GitHub root README because npm displays package README files separately.
@@ -263,8 +264,9 @@ General principles (KISS, DRY, YAGNI, SOLID) as applied in this codebase. Match
 - `packages/ragmir-core/src/defaults.ts` owns shared default paths, provider defaults, and generated-state ignore
   constants. Keep config/init/security/gitignore aligned through this module instead of copying
   literals.
-- `packages/ragmir-core/src/sources.ts` owns the `.ragmir/sources.txt` management API used by
-  `ragmir sources add/list`; file discovery itself remains in `files.ts`.
+- `packages/ragmir-core/src/sources.ts` owns the `sources` array management API used by
+  `ragmir sources add/list` (reads/writes `.ragmir/config.json`); file discovery itself remains in
+  `files.ts`.
 - `packages/ragmir-core/src/skill.ts` owns agent skill installation and the per-agent
   `agentHelpers`/MCP config generation (`AgentHelperFile`) behind `ragmir setup` and
   `ragmir install-skill`/`install-agent`. Add a new agent target through `SUPPORTED_AGENT_TARGETS`

CHANGELOG.md

@@ -1,16 +1,21 @@
 # Changelog
 
+> Historical note: earlier 0.x releases used the `kb` binary name and `.kb/` state
+> directory. `kb` remains a legacy alias for `ragmir`, and `.kb/` is still recognized
+> for backward compatibility. The entries below are rewritten with the current
+> `ragmir` command name for clarity.
+
 ## 0.4.2 - 2026-06-29
 
-- Add `kb doctor` to diagnose initialization, index freshness, security posture, and next steps.
-- Make `kb audio` and `ragmir-tts` default to the offline/confidential Transformers.js WAV path;
+- Add `ragmir doctor` to diagnose initialization, index freshness, security posture, and next steps.
+- Make `ragmir audio` and `ragmir-tts` default to the offline/confidential Transformers.js WAV path;
   Edge MP3 now requires an explicit `--engine edge` command.
-- Stop indexing the generated `private/README.md` helper file created by `kb init`.
-- Improve onboarding output from `kb init` and `kb install-skill`.
+- Stop indexing the generated `private/README.md` helper file created by `ragmir init`.
+- Improve onboarding output from `ragmir init` and `ragmir install-skill`.
 
 ## 0.4.1 - 2026-06-29
 
-- Add an Edge-compatible Ragmir TTS engine so `kb audio` can match the global Voice Forge quality
+- Add an Edge-compatible Ragmir TTS engine so `ragmir audio` can match the global Voice Forge quality
   path with `edge-tts`, `fr-FR-DeniseNeural`, and MP3 output.
 - Keep Transformers.js WAV rendering as the explicit offline/confidential path.
 - Remove duplicated governance documents from package directories; root project docs are the single
@@ -21,35 +26,35 @@
 - Reposition Ragmir as sovereign local RAG for confidential datasets and AI agents.
 - Expand default ingestion to common text, Office/OpenDocument, data, config, log, and source-code
   file types.
-- Add `includeExtensions` / `KB_INCLUDE_EXTENSIONS` for custom UTF-8 text file extensions.
+- Add `includeExtensions` / `RAGMIR_INCLUDE_EXTENSIONS` (legacy alias `KB_INCLUDE_EXTENSIONS`) for custom UTF-8 text file extensions.
 - Add the optional `ragmir-audio-summary` bundled skill for confidential audio summaries.
-- Install both the main Ragmir skill and optional audio-summary skill with `kb install-skill`.
+- Install both the main Ragmir skill and optional audio-summary skill with `ragmir install-skill`.
 - Improve agent guidance for deep multi-query retrieval before synthesis.
-- Make Ragmir core retrieval-only: `kb ask` now returns cited context for external agents or LLMs
+- Make Ragmir core retrieval-only: `ragmir ask` now returns cited context for external agents or LLMs
   instead of generating answers internally.
 - Add optional Transformers.js semantic embeddings through `embeddingProvider: "transformers"`.
 - Remove Ollama providers and keep `embeddingProvider: "local-hash"` as the no-model default.
 - Move the repository to a simple pnpm workspace monorepo without adding Turbo.
 - Move the core `@jcode.labs/ragmir` package into `packages/ragmir-core`.
 - Add `@jcode.labs/ragmir-tts` for plug-and-play JS/ONNX WAV rendering without Python or ffmpeg.
-- Add `kb audio` and update the audio-summary skill to use Ragmir TTS before advanced fallback
+- Add `ragmir audio` and update the audio-summary skill to use Ragmir TTS before advanced fallback
   engines.
 
 ## 0.3.0 - 2026-06-28
 
 - Add confidentiality hardening defaults: built-in redaction before indexing, metadata-only access
   logs, and bounded MCP retrieval.
-- Add `kb security-audit` for zero-telemetry, provider, redaction, gitignore, storage, and
+- Add `ragmir security-audit` for zero-telemetry, provider, redaction, gitignore, storage, and
   MCP posture checks.
-- Add `kb destroy-index --yes` to remove generated vector indexes.
+- Add `ragmir destroy-index --yes` to remove generated vector indexes.
 - Add release verification artifacts: npm tarball, SHA256 checksums, SBOM, and manifest.
 - Document air-gapped operation, threat model, MCP hardening, and secure deletion limits.
 
 ## 0.2.1 - 2026-06-28
 
 - Add GitHub Sponsors funding metadata and document suggested sponsor tiers.
 - Add maintainer positioning for Jean-Baptiste Thery and JCode Labs in the README.
-- Make `kb init` and `kb install-skill` automatically keep `.kb/` and `.ragmir/`
+- Make `ragmir init` and `ragmir install-skill` automatically keep `.ragmir/` (and legacy `.kb/`)
   ignored by Git.
 
 ## 0.2.0 - 2026-06-28

README.md

@@ -870,10 +870,21 @@ Each entry is one of:
 - a **glob** pattern — any entry containing `*`, `?`, `[`, or `{`;
 - an **exclusion** — starts with `!` and filters the glob matches.
 
-> **Legacy `sources.txt`.** Paths listed one per line in `.ragmir/sources.txt` are still read when the
-> file exists, and `ragmir sources add` / `ragmir sources list` continue to manage it. Entries from both
-> the `sources` array and `sources.txt` are merged, so existing projects keep working unchanged. New
-> projects should prefer the `sources` array — `ragmir init` no longer creates a `sources.txt`.
+```mermaid
+flowchart LR
+  Raw["rawDir<br/>.ragmir/raw/"] --> Merge["Source merge"]
+  Cfg["sources[]<br/>in config.json"] --> Merge
+  Legacy["legacy sources.txt<br/>(read-only, optional)"] -.-> Merge
+  Merge --> Discover["file discovery"]
+  Discover --> Index["LanceDB index"]
+```
+
+> **Legacy `sources.txt`.** `ragmir sources add` and `ragmir sources list` read and write the `sources`
+> array in `.ragmir/config.json` — this is the canonical location. A pre-existing `.ragmir/sources.txt`
+> is still read (read-only) and merged with the config array, so existing projects keep working
+> unchanged; nothing writes to it anymore. New projects never get a `sources.txt`.
+
+Environment overrides:
 
 Environment overrides:
 

SECURITY-HARDENING.md

@@ -46,13 +46,13 @@ unencrypted disk.
 ## At-Rest Encryption
 
 Native encrypted LanceDB storage is not implemented yet. For sensitive environments, put the
-repository and `.kb/` on an encrypted volume:
+repository and `.ragmir/` on an encrypted volume:
 
 - macOS: FileVault or an encrypted APFS volume.
 - Linux: LUKS, fscrypt, or an encrypted VM disk.
-- Containers/VMs: mount `.kb/` on an encrypted host volume.
+- Containers/VMs: mount `.ragmir/` on an encrypted host volume.
 
-`kb destroy-index --yes` removes generated index files, but secure deletion on SSDs and copy-on-write
+`ragmir destroy-index --yes` removes generated index files, but secure deletion on SSDs and copy-on-write
 filesystems cannot be guaranteed without encrypted storage and key destruction.
 
 ## Air-Gapped Operation
@@ -128,7 +128,7 @@ assuming a dossier was fully indexed.
 Built-in redaction is enabled by default for common secret and identifier shapes: private keys,
 JWTs, API tokens, emails, IBANs, and card-like numbers.
 
-Custom patterns can be added in `.kb/config.json`:
+Custom patterns can be added in `.ragmir/config.json`:
 
 ```json
 {

SECURITY.md

@@ -18,5 +18,5 @@ or private document disclosure.
 ## Data Boundary
 
 Ragmir is designed to index local project documents. Raw project documents,
-`.kb/`, `.ragmir/`, environment files, credentials, customer records, and commercial validation notes
+`.ragmir/` (and legacy `.kb/` where present), environment files, credentials, customer records, and commercial validation notes
 must remain outside commits.

docs/cli-reference.md

@@ -16,8 +16,8 @@ Ragmir ships two CLIs:
 | `ragmir doctor --fix` | Create missing scaffolding, install skills/MCP config, and update stale indexes when safe. |
 | `ragmir models pull` | Download the configured Transformers.js embedding model into `embeddingModelPath`. |
 | `ragmir models pull --enable` | Download the embedding model and switch Ragmir config to safe Transformers embeddings. |
-| `ragmir sources add "../apps/*/docs/**/*.md"` | Add source paths, glob patterns, or `!` exclusions to `.ragmir/sources.txt`. |
-| `ragmir sources list` | List active extra source entries from `.ragmir/sources.txt`. |
+| `ragmir sources add "../apps/*/docs/**/*.md"` | Add source paths, glob patterns, or `!` exclusions to the `sources` array in `.ragmir/config.json`. |
+| `ragmir sources list` | List active extra source entries (merged from `config.json` and any legacy `sources.txt`). |
 | `ragmir ingest` | Parse changed source files, redact, chunk, embed, and update the local LanceDB index. |
 | `ragmir ingest --rebuild` | Force a full re-index, required after switching embedding provider or model. |
 | `ragmir audit` | Check whether supported source files are missing from or stale in the index. |