@0xcraft/powershot 1.0.0

package/dist/session.js

@@ -0,0 +1,140 @@
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+const DIR = '.powershot/sessions';
+/**
+ * How many runs to keep. Sessions hold source frames, so an unbounded directory grows
+ * with the repository it is reviewing and nothing ever removes it.
+ */
+const KEEP = 50;
+function prune(dir) {
+    try {
+        // ids are hashes, so the filename says nothing about age — the clock does
+        const files = readdirSync(dir)
+            .filter((n) => n.endsWith('.json'))
+            .map((name) => ({ name, at: statSync(join(dir, name)).mtimeMs }))
+            .sort((a, b) => a.at - b.at);
+        for (const { name } of files.slice(0, Math.max(0, files.length - KEEP + 1))) {
+            rmSync(join(dir, name), { force: true });
+        }
+    }
+    catch {
+        // housekeeping must never be the reason a review does not start
+    }
+}
+/** Only judge results are kept: the deterministic half is free and re-runs, which
+ *  keeps a resumed review honest about the current state of the files. */
+export class Session {
+    file;
+    data;
+    constructor(file, data) {
+        this.file = file;
+        this.data = data;
+    }
+    static create(root, target, asked) {
+        const id = createHash('sha1').update(target + ':' + Date.now()).digest('hex').slice(0, 8);
+        const dir = join(root, DIR);
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        prune(dir);
+        return new Session(join(dir, id + '.json'), {
+            id,
+            started: new Date().toISOString(),
+            target,
+            asked,
+            done: {},
+        });
+    }
+    /** Whether this session's answers came from who is being asked now. */
+    askedBy(provider, model) {
+        if (!this.data.asked)
+            return true; // recorded before this was stored; nothing to check
+        return this.data.asked.provider === provider && this.data.asked.model === model;
+    }
+    get asked() {
+        return this.data.asked;
+    }
+    static open(root, id) {
+        const file = join(root, DIR, id + '.json');
+        if (!existsSync(file))
+            return undefined;
+        try {
+            return new Session(file, JSON.parse(readFileSync(file, 'utf8')));
+        }
+        catch {
+            return undefined; // a corrupt session is not worth failing a review over
+        }
+    }
+    static list(root) {
+        const dir = join(root, DIR);
+        if (!existsSync(dir))
+            return [];
+        const out = [];
+        for (const name of readdirSync(dir)) {
+            if (!name.endsWith('.json'))
+                continue;
+            try {
+                const d = JSON.parse(readFileSync(join(dir, name), 'utf8'));
+                out.push({ id: d.id, started: d.started, target: d.target, done: Object.keys(d.done).length });
+            }
+            catch {
+                // skip anything unreadable rather than refusing to list the rest
+            }
+        }
+        return out.sort((a, b) => b.started.localeCompare(a.started));
+    }
+    get id() {
+        return this.data.id;
+    }
+    /**
+     * The content fingerprint distinguishes an edited bundle from the old question;
+     * hashing also keeps path-derived keys bounded and stable.
+     */
+    static key(judge, unit, fingerprint) {
+        return judge + '|' + createHash('sha1').update(unit + '\0' + fingerprint).digest('hex').slice(0, 20);
+    }
+    get(judge, unit, fingerprint) {
+        return this.data.done[Session.key(judge, unit, fingerprint)];
+    }
+    record(judge, unit, fingerprint, findings) {
+        this.data.done[Session.key(judge, unit, fingerprint)] = findings;
+        this.save();
+    }
+    saveReport(findings, verdict) {
+        this.data.report = {
+            findings,
+            verified: findings.filter((f) => f.class === 'verified').length,
+            judged: findings.filter((f) => f.class === 'judged').length,
+            state: verdict.state,
+            notLookedAt: verdict.notLookedAt,
+        };
+        this.save();
+    }
+    get report() {
+        return this.data.report;
+    }
+    get target() {
+        return this.data.target;
+    }
+    get started() {
+        return this.data.started;
+    }
+    /** What moved between two reviews. */
+    static compare(before, after) {
+        if (before.report?.state !== 'complete' || after.report?.state !== 'complete') {
+            throw new Error('only complete review sessions can be compared');
+        }
+        const key = (f) => f.check + '|' + f.file + '|' + f.title;
+        const was = new Map((before.report?.findings ?? []).map((f) => [key(f), f]));
+        const is = new Map((after.report?.findings ?? []).map((f) => [key(f), f]));
+        return {
+            fixed: [...was].filter(([k]) => !is.has(k)).map(([, f]) => f),
+            introduced: [...is].filter(([k]) => !was.has(k)).map(([, f]) => f),
+            remaining: [...is].filter(([k]) => was.has(k)).map(([, f]) => f),
+        };
+    }
+    save() {
+        // written after every unit, so an interrupted run keeps everything already paid for
+        writeFileSync(this.file, JSON.stringify(this.data, null, 2), { mode: 0o600 });
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/snapshot.js

@@ -0,0 +1,101 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdtempSync, rmSync, symlinkSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { git } from './git.js';
+export function targetRef(range) {
+    if (range.commit)
+        return range.commit;
+    if (range.from)
+        return range.to ?? 'HEAD';
+    return undefined;
+}
+/**
+ * True when the working tree already *is* the target, so there is nothing to check
+ * out. This is the ordinary CI case — a runner checks the head out and reviews it —
+ * and skipping the copy there keeps the common path as fast as it was.
+ */
+function treeIsTarget(root, ref) {
+    try {
+        if (git(root, ['rev-parse', ref]).trim() !== git(root, ['rev-parse', 'HEAD']).trim())
+            return false;
+        return git(root, ['status', '--porcelain']).trim() === '';
+    }
+    catch {
+        return false;
+    }
+}
+/** A worktree holds tracked files only, so a checkout has no node_modules and every
+ *  dependency import becomes unresolvable — a type-aware review of imaginary findings. */
+function linkDependencies(repo, tree) {
+    const manifests = git(repo, ['ls-files', '*package.json', 'package.json'])
+        .split('\n')
+        .filter(Boolean)
+        .map((p) => dirname(p));
+    for (const dir of new Set(['.', ...manifests])) {
+        const from = join(repo, dir, 'node_modules');
+        const to = join(tree, dir, 'node_modules');
+        if (!existsSync(from) || existsSync(to) || !existsSync(dirname(to)))
+            continue;
+        try {
+            symlinkSync(from, to, 'junction');
+        }
+        catch {
+            // a link we cannot make degrades resolution for that package only
+        }
+    }
+}
+/**
+ * A checkout of exactly the version under review.
+ *
+ * One thing it cannot restore: the dependencies of that version. `node_modules` is
+ * linked from the current install, because the old lockfile's tree is not on disk.
+ * Type resolution therefore reflects today's dependencies — which is why a replay is
+ * a precision signal about the checks and not a reproduction of the original review.
+ */
+export function openTargetTree(repo, ref) {
+    // a run killed mid-checkout leaves a registration behind; git's own answer is one
+    // command, and running it here is what keeps `git worktree list` honest over time
+    try {
+        git(repo, ['worktree', 'prune']);
+    }
+    catch {
+        // an older git, or a repository that has never had one — nothing to clean
+    }
+    const parent = mkdtempSync(join(tmpdir(), 'powershot-'));
+    const dir = join(parent, 'tree');
+    git(repo, ['worktree', 'add', '--detach', '--quiet', dir, ref]);
+    linkDependencies(repo, dir);
+    return {
+        dir,
+        checkout(next) {
+            execFileSync('git', ['checkout', '--detach', '--quiet', '--force', next], {
+                cwd: dir,
+                stdio: ['ignore', 'ignore', 'pipe'],
+            });
+        },
+        close() {
+            try {
+                git(repo, ['worktree', 'remove', '--force', dir]);
+            }
+            catch {
+                // the temp directory goes either way; a stale entry is pruned by git itself
+            }
+            rmSync(parent, { recursive: true, force: true });
+        },
+    };
+}
+/** Run something against the exact target version, cleaning up whatever it took. */
+export async function withTargetTree(repo, range, fn) {
+    const ref = targetRef(range);
+    if (!ref || treeIsTarget(repo, ref))
+        return fn(repo);
+    const tree = openTargetTree(repo, ref);
+    try {
+        return await fn(tree.dir);
+    }
+    finally {
+        tree.close();
+    }
+}
+//# sourceMappingURL=snapshot.js.map

package/dist/text.js

@@ -0,0 +1,50 @@
+/** Reading source that was not written on the reviewer's machine. */
+/** Split on either line ending, so a CRLF checkout does not leave `\r` on every line. */
+export function lines(text) {
+    return text.split(/\r?\n/);
+}
+/** Strip a single trailing carriage return, for text already split on `\n`. */
+export function stripCR(line) {
+    return line.endsWith('\r') ? line.slice(0, -1) : line;
+}
+const BOMS = [
+    [Buffer.from([0xef, 0xbb, 0xbf]), 'utf-8'],
+    [Buffer.from([0xff, 0xfe]), 'utf-16le'],
+    [Buffer.from([0xfe, 0xff]), 'utf-16be'],
+];
+/**
+ * Decode bytes to text, honouring a byte-order mark and falling back rather than
+ * throwing. `latin1` is the last resort precisely because it cannot fail: every byte
+ * maps to a character, so a file in an encoding we cannot name still parses as code
+ * instead of taking the whole review down with it.
+ */
+export function decode(buf) {
+    for (const [bom, encoding] of BOMS) {
+        if (buf.length >= bom.length && buf.subarray(0, bom.length).equals(bom)) {
+            return new TextDecoder(encoding).decode(buf.subarray(bom.length));
+        }
+    }
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(buf);
+    }
+    catch {
+        return buf.toString('latin1');
+    }
+}
+/**
+ * A path, made safe for every renderer that interpolates one.
+ *
+ * `stripControl` keeps tabs and newlines because a code frame is layout. A path is
+ * not layout: one carrying a newline ended the markdown heading that held it and
+ * turned everything after into the attacker's own document.
+ */
+export function stripPath(text) {
+    return stripControl(text).replace(/[\t\r\n]/g, ' ').trim();
+}
+export function stripControl(text) {
+    return text
+        .replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, '') // OSC, terminated by BEL or ST
+        .replace(/\x1b[@-_][0-?]*[ -/]*[@-~]/g, '') // CSI and the other escape families
+        .replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f]/g, '');
+}
+//# sourceMappingURL=text.js.map

package/dist/types.js

@@ -0,0 +1,2 @@
+export const SEVERITIES = ['info', 'low', 'medium', 'high', 'critical'];
+//# sourceMappingURL=types.js.map

package/dist/verifiers/assertion-drift.js

@@ -0,0 +1,137 @@
+import { Node, SyntaxKind } from 'ts-morph';
+import { locate, relPath } from '#app/ground.js';
+const TEST_FILE = /(\.(test|spec)\.[cm]?[jt]sx?$)|(__tests__\/)/;
+const TEST_FN = /^(it|test)(\.(only|each|concurrent|skip))?$/;
+const NODE_ASSERT = /^(assert|t)\.(equal|strictEqual|deepEqual|deepStrictEqual|is|deepIs)$/;
+/**
+ * Walk left through a matcher chain (`expect(x).not.toBe`) back to the
+ * `expect(...)` call, so the subject is found regardless of modifiers.
+ */
+function expectSubjectOf(callee) {
+    let node = callee;
+    while (node && Node.isPropertyAccessExpression(node))
+        node = node.getExpression();
+    if (!node || !Node.isCallExpression(node))
+        return undefined;
+    if (node.getExpression().getText() !== 'expect')
+        return undefined;
+    return node.getArguments()[0]?.getText() ?? '';
+}
+/** The enclosing it()/test() call, which is how an assertion is matched across versions. */
+function enclosingTest(node) {
+    let current = node;
+    while (current) {
+        if (Node.isCallExpression(current) && TEST_FN.test(current.getExpression().getText()))
+            return current;
+        current = current.getParent();
+    }
+    return undefined;
+}
+/** The test with its expected value blanked out and whitespace collapsed. */
+function contextOf(test, expectedNode) {
+    // masked by position, never by text: `expect(withVat(1000)).toBe(1000)` would
+    // otherwise blank both occurrences and make every such test look rewritten
+    const text = test.getText();
+    const start = expectedNode.getStart() - test.getStart();
+    const end = start + expectedNode.getWidth();
+    if (start < 0 || end > text.length)
+        return text.replace(/\s+/g, ' ').trim();
+    return (text.slice(0, start) + '\u0000' + text.slice(end)).replace(/\s+/g, ' ').trim();
+}
+/**
+ * Key an assertion by what it is asserting *about*, never by its expected value —
+ * the whole point is to detect the expected value moving underneath a stable subject.
+ */
+function assertionsIn(sf) {
+    const out = new Map();
+    for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+        const calleeText = call.getExpression().getText();
+        let subject;
+        let matcher;
+        let expectedNode;
+        if (Node.isPropertyAccessExpression(call.getExpression())) {
+            subject = expectSubjectOf(call.getExpression());
+            matcher = call.getExpression().getName();
+            expectedNode = call.getArguments()[0];
+        }
+        else {
+            matcher = '';
+            expectedNode = undefined;
+        }
+        if (subject === undefined && NODE_ASSERT.test(calleeText)) {
+            subject = call.getArguments()[0]?.getText();
+            matcher = calleeText;
+            expectedNode = call.getArguments()[1];
+        }
+        if (subject === undefined || expectedNode === undefined)
+            continue;
+        const expected = expectedNode.getText();
+        const test = enclosingTest(call);
+        const title = test?.getArguments()[0]?.getText();
+        if (test === undefined || title === undefined)
+            continue;
+        out.set(title + '|' + subject + '|' + matcher, {
+            expected,
+            line: call.getStartLineNumber(),
+            subject,
+            span: locate(sf, call.getStart(), call.getWidth()).span,
+            context: contextOf(test, expectedNode),
+        });
+    }
+    return out;
+}
+/** An expected value edited to match new output, rather than the code being fixed. */
+export const assertionDrift = {
+    name: 'assertion-drift',
+    needs: ['syntax', 'base'],
+    run(g) {
+        const findings = [];
+        // The modules this change actually edited, by basename. Whether *some* source
+        // moved is the wrong question — a large change can edit one module and bend an
+        // unrelated test. What matters is whether the module a given test covers moved.
+        const changedModules = new Set(g.files
+            .map(({ sf }) => relPath(sf, g.root))
+            .filter((p) => !TEST_FILE.test(p))
+            .map((p) => (p.split('/').pop() ?? '').replace(/\.[cm]?[jt]sx?$/, '')));
+        for (const { sf, before } of g.files) {
+            if (!before)
+                continue;
+            const file = relPath(sf, g.root);
+            if (!TEST_FILE.test(file))
+                continue;
+            // An expectation moving alongside a change to the module it covers is what an
+            // intentional behaviour change looks like. Only the giveaway survives: the
+            // expectation moved and the thing it measures did not.
+            const subject = (file.split('/').pop() ?? '').replace(/\.(test|spec)\.[cm]?[jt]sx?$/, '');
+            if (changedModules.has(subject))
+                continue;
+            const now = assertionsIn(sf);
+            for (const [key, was] of assertionsIn(before)) {
+                const is = now.get(key);
+                if (!is || is.expected === was.expected)
+                    continue;
+                // everything but the expected value must be untouched, or this is a rewrite
+                if (is.context !== was.context)
+                    continue;
+                findings.push({
+                    id: '',
+                    class: 'verified',
+                    check: 'assertion-drift',
+                    severity: 'high',
+                    confidence: 'firm',
+                    file,
+                    line: is.line,
+                    span: is.span,
+                    title: 'Expected value for `' + is.subject + '` changed from ' + was.expected + ' to ' + is.expected,
+                    evidence: {
+                        oracle: 'pre/post test AST',
+                        detail: 'the module this test covers did not change — the expectation moved with nothing it measures',
+                    },
+                    fix: 'Confirm the new value is correct behaviour, not the test being bent to fit the code',
+                });
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=assertion-drift.js.map

package/dist/verifiers/contract-drift.js

@@ -0,0 +1,140 @@
+import { Node, SyntaxKind } from 'ts-morph';
+import { locate, relPath } from '#app/ground.js';
+/**
+ * Parameters read syntactically so the same extraction works on the base-ref project,
+ * which is parsed without type information.
+ */
+function signatureOf(name, node) {
+    const fn = Node.isFunctionDeclaration(node)
+        ? node
+        : Node.isVariableDeclaration(node)
+            ? node.getInitializerIfKind(SyntaxKind.ArrowFunction) ?? node.getInitializerIfKind(SyntaxKind.FunctionExpression)
+            : undefined;
+    if (!fn)
+        return undefined;
+    const params = fn.getParameters().map((p) => ({
+        name: p.getName(),
+        type: p.getTypeNode()?.getText() ?? '',
+        // a parameter with `?`, a default, or a rest spread is not required of the caller
+        optional: p.hasQuestionToken() || p.hasInitializer() || p.isRestParameter(),
+    }));
+    return {
+        name,
+        params,
+        required: params.filter((p) => !p.optional).length,
+        returns: fn.getReturnTypeNode()?.getText() ?? '',
+    };
+}
+/** Top-level functions and exported arrow/function consts, by name. */
+function signatures(sf) {
+    const out = new Map();
+    for (const fn of sf.getFunctions()) {
+        const name = fn.getName();
+        if (!name)
+            continue;
+        const sig = signatureOf(name, fn);
+        if (sig)
+            out.set(name, sig);
+    }
+    for (const v of sf.getVariableDeclarations()) {
+        const sig = signatureOf(v.getName(), v);
+        if (sig)
+            out.set(v.getName(), sig);
+    }
+    return out;
+}
+/**
+ * Only changes that actually cost a caller something are reported. Adding an optional
+ * parameter or widening a name is invisible from the outside, so it stays silent.
+ */
+function breakingChange(before, after) {
+    if (after.required > before.required) {
+        return {
+            detail: 'now requires ' + after.required + ' argument(s), was ' + before.required,
+            proven: true, // every existing call site is now short an argument
+        };
+    }
+    if (after.params.length < before.params.length) {
+        return {
+            detail: 'takes ' + after.params.length + ' parameter(s), was ' + before.params.length,
+            proven: true,
+        };
+    }
+    for (let i = 0; i < Math.min(before.params.length, after.params.length); i++) {
+        const b = before.params[i];
+        const a = after.params[i];
+        if (b.type !== '' && a.type !== '' && b.type !== a.type) {
+            return { detail: 'parameter `' + a.name + '` changed from ' + b.type + ' to ' + a.type, proven: false };
+        }
+    }
+    if (before.returns !== '' && after.returns !== '' && before.returns !== after.returns) {
+        return { detail: 'returns ' + after.returns + ', was ' + before.returns, proven: false };
+    }
+    return undefined;
+}
+/**
+ * A signature changed and callers outside the change were left behind.
+ *
+ * This is the blast radius `phantom-api` cannot see: that check only reports on lines
+ * the diff touched, so a call site broken in a file nobody edited is invisible to it.
+ * Here the reference graph is the oracle — the callers either exist or they do not.
+ */
+export const contractDrift = {
+    name: 'contract-drift',
+    needs: ['syntax', 'base', 'references'],
+    run(g) {
+        const findings = [];
+        const changedPaths = new Set(g.changed.map((c) => c.path));
+        for (const { sf, before } of g.files) {
+            if (!before)
+                continue;
+            const file = relPath(sf, g.root);
+            const now = signatures(sf);
+            for (const [name, was] of signatures(before)) {
+                const is = now.get(name);
+                if (!is)
+                    continue; // removed entirely — a different finding
+                const broke = breakingChange(was, is);
+                if (!broke)
+                    continue;
+                // the declaration node, both to position the finding and to walk references
+                const decl = sf.getFunction(name) ?? sf.getVariableDeclaration(name);
+                if (!decl)
+                    continue;
+                let callers = [];
+                try {
+                    callers = [
+                        ...new Set(decl
+                            .findReferencesAsNodes()
+                            .map((ref) => relPath(ref.getSourceFile(), g.root))
+                            .filter((path) => path !== file && !changedPaths.has(path) && !path.includes('node_modules'))),
+                    ];
+                }
+                catch {
+                    // the language service can decline on a malformed project; no references
+                    // found is not the same as none existing, so stay silent rather than guess
+                    continue;
+                }
+                if (callers.length === 0)
+                    continue;
+                const shown = callers.slice(0, 3).join(', ') + (callers.length > 3 ? ' +' + (callers.length - 3) + ' more' : '');
+                const nameNode = Node.isFunctionDeclaration(decl) ? decl.getNameNode() : decl.getNameNode();
+                findings.push({
+                    id: '',
+                    class: 'verified',
+                    check: 'contract-drift',
+                    severity: broke.proven ? 'high' : 'medium',
+                    confidence: broke.proven ? 'proven' : 'firm',
+                    file,
+                    line: decl.getStartLineNumber(),
+                    span: nameNode ? locate(sf, nameNode.getStart(), nameNode.getWidth()).span : undefined,
+                    title: name + '() ' + broke.detail + ', but ' + callers.length + ' call site(s) outside this change were not updated',
+                    evidence: { oracle: 'reference graph', detail: 'callers in ' + shown },
+                    fix: 'Update the call sites, or keep the old shape working (optional parameter, overload)',
+                });
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=contract-drift.js.map

package/dist/verifiers/copy-paste-drift.js

@@ -0,0 +1,106 @@
+import { ts, Node } from 'ts-morph';
+import { locate, relPath } from '#app/ground.js';
+/** Below this a coincidental shape match means nothing. */
+const MIN_TOKENS = 8;
+function tokenize(code) {
+    const scanner = ts.createScanner(ts.ScriptTarget.Latest, true, ts.LanguageVariant.Standard, code);
+    const out = [];
+    let token = scanner.scan();
+    for (let i = 0; token !== ts.SyntaxKind.EndOfFileToken && i < 20_000; i++) {
+        out.push({ kind: token, text: scanner.getTokenText() });
+        token = scanner.scan();
+    }
+    return out;
+}
+function missedRename(a, b) {
+    if (a.length !== b.length || a.length < MIN_TOKENS)
+        return undefined;
+    const mapping = new Map();
+    let renamedSomething = false;
+    for (let i = 0; i < a.length; i++) {
+        const x = a[i];
+        const y = b[i];
+        if (x.kind !== y.kind)
+            return undefined; // different shape — not a clone
+        if (x.kind !== ts.SyntaxKind.Identifier) {
+            // literals and punctuation must match exactly, or the blocks simply differ
+            if (x.text !== y.text)
+                return undefined;
+            continue;
+        }
+        if (x.text !== y.text)
+            renamedSomething = true;
+        const targets = mapping.get(x.text) ?? new Set();
+        targets.add(y.text);
+        mapping.set(x.text, targets);
+    }
+    if (!renamedSomething)
+        return undefined; // an exact duplicate is a different concern
+    for (const [name, targets] of mapping) {
+        // The signature of a missed rename is that one occurrence changed and another
+        // stayed behind, so the original name must be among the targets. Two different
+        // things that merely share a name — a local `tests` beside a member `.tests` —
+        // map to two *new* names, which is not a rename anyone forgot. Found by running
+        // this check over its own repository.
+        if (targets.size > 1 && targets.has(name))
+            return { name, became: [...targets] };
+    }
+    return undefined;
+}
+function statementLists(sf) {
+    const lists = [sf.getStatements()];
+    for (const block of sf.getDescendantsOfKind(ts.SyntaxKind.Block))
+        lists.push(block.getStatements());
+    return lists;
+}
+/** A block copied from the one above it with one identifier left behind. */
+export const copyPasteDrift = {
+    name: 'copy-paste-drift',
+    needs: ['syntax'],
+    run(g) {
+        const findings = [];
+        for (const { sf, changed } of g.files) {
+            const file = relPath(sf, g.root);
+            for (const statements of statementLists(sf)) {
+                for (let i = 1; i < statements.length; i++) {
+                    const prev = statements[i - 1];
+                    const curr = statements[i];
+                    const line = curr.getStartLineNumber();
+                    if (!changed.added.has(line))
+                        continue;
+                    if (Node.isEmptyStatement(prev) || Node.isEmptyStatement(curr))
+                        continue;
+                    // Consecutive imports from the same package share a shape by nature — a
+                    // list of what a file uses is not a block anyone copied and half-renamed.
+                    if (Node.isImportDeclaration(curr) || Node.isExportDeclaration(curr))
+                        continue;
+                    const miss = missedRename(tokenize(prev.getText()), tokenize(curr.getText()));
+                    if (!miss)
+                        continue;
+                    findings.push({
+                        id: '',
+                        class: 'verified',
+                        check: 'copy-paste-drift',
+                        severity: 'high',
+                        confidence: 'firm',
+                        file,
+                        line,
+                        span: locate(sf, curr.getStart(), Math.min(curr.getWidth(), 120)).span,
+                        title: 'Copied from the statement above with `' +
+                            miss.name +
+                            '` renamed inconsistently — it became ' +
+                            miss.became.map((t) => '`' + t + '`').join(' in one place and ') +
+                            ' in another',
+                        evidence: {
+                            oracle: 'token stream',
+                            detail: 'both statements have identical shape and literals, so one identifier was left un-renamed',
+                        },
+                        fix: 'Rename the remaining `' + miss.name + '`, or extract the shared shape into a function',
+                    });
+                }
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=copy-paste-drift.js.map