@0xcraft/powershot 1.1.1 → 1.1.2

package/dist/report/terminal.js

@@ -106,12 +106,18 @@ export function terminal(findings, opts) {
     out.push(' ' + bold('PowerShot') + dim('  ·  ' + opts.subtitle));
     out.push(rule);
     const incomplete = opts.state !== 'complete';
+    const portable = !incomplete && opts.coverage === 'portable';
     if (findings.length === 0) {
         out.push('', incomplete
             ? ' ' + yellow('!') + '  No findings — but this review is ' + opts.state + ', not a verdict.'
-            : ' ' + steel('✔') + '  No findings.');
+            : ' ' + steel('✔') + (portable ? '  No findings in portable coverage.' : '  No findings.'));
         for (const reason of opts.notLookedAt)
             out.push(dim('    ' + reason));
+        if (portable) {
+            out.push(dim('    Portable coverage: self-contained oracles ran; enriched semantic depth was unavailable.'));
+            for (const reason of opts.unavailableCoverage ?? [])
+                out.push(dim('    ' + reason));
+        }
         out.push('');
         return out.join('\n');
     }
@@ -146,6 +152,11 @@ export function terminal(findings, opts) {
         for (const reason of opts.notLookedAt)
             out.push(dim('   ' + reason));
     }
+    else if (portable) {
+        out.push(' ' + steel('◇ portable coverage') + dim(' · enriched semantic depth was unavailable'));
+        for (const reason of opts.unavailableCoverage ?? [])
+            out.push(dim('   ' + reason));
+    }
     out.push('');
     return out.join('\n');
 }

package/dist/report/viewer.js

@@ -2,12 +2,19 @@ const escape = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/
 export function viewer(findings, meta) {
     const verified = findings.filter((f) => f.class === 'verified').length;
     const incomplete = meta.state !== 'complete';
+    const portable = !incomplete && meta.coverage === 'portable';
     const warning = incomplete
         ? '<div class="warning"><strong>This review is ' + escape(meta.state) + ' — not a verdict.</strong>' +
             (meta.notLookedAt.length > 0
                 ? '<ul>' + meta.notLookedAt.map((reason) => '<li>' + escape(reason) + '</li>').join('') + '</ul>'
                 : '') + '</div>'
         : '';
+    const coverage = portable
+        ? '<div class="coverage"><strong>Portable coverage.</strong> Self-contained oracles ran; enriched semantic depth was unavailable.' +
+            ((meta.unavailableCoverage?.length ?? 0) > 0
+                ? '<ul>' + meta.unavailableCoverage.map((reason) => '<li>' + escape(reason) + '</li>').join('') + '</ul>'
+                : '') + '</div>'
+        : '';
     const rows = findings
         .map((f) => {
         const frame = f.frame
@@ -70,6 +77,8 @@ export function viewer(findings, meta) {
   .none { color:var(--muted); }
   .warning { border:1px solid var(--amber); border-radius:6px; padding:10px 14px; margin:0 0 18px; }
   .warning ul { margin:6px 0 0; }
+  .coverage { border:1px solid var(--steel); border-radius:6px; padding:10px 14px; margin:0 0 18px; }
+  .coverage ul { margin:6px 0 0; }
   .f.put-away { opacity:.4; }
   .f.put-away .title { text-decoration:line-through; }
   .act { margin-left:8px; }
@@ -82,6 +91,7 @@ export function viewer(findings, meta) {
   <p class="meta">${escape(meta.target)} · ${escape(meta.started.slice(0, 19).replace('T', ' '))} · session ${escape(meta.id)}<br>
     ${findings.length} finding(s) — ${verified} verified, ${findings.length - verified} judged</p>
   ${warning}
+  ${coverage}
   <div class="bar">
     <button data-filter="all" aria-pressed="true">all</button>
     <button data-filter="verified" aria-pressed="false">verified</button>
@@ -89,7 +99,7 @@ export function viewer(findings, meta) {
     <button id="show-away" aria-pressed="false">show put away</button>
   </div>
   ${findings.length === 0
-        ? '<p class="none">' + (incomplete ? 'No findings from what completed.' : 'No findings.') + '</p>'
+        ? '<p class="none">' + (incomplete ? 'No findings from what completed.' : portable ? 'No findings in portable coverage.' : 'No findings.') + '</p>'
         : rows}
 </div>
 <script>

package/dist/review.js

@@ -2,7 +2,6 @@ import { buildGround } from './ground.js';
 import { baseRefOf, collectChanges, statedIntent } from './git.js';
 import { bundle, bundleName, reviewables, uncovered } from './bundle.js';
 import { attachFrames, positionable } from './position.js';
-import { skippedLanguages } from './lang/packs.js';
 import { JudgeCache } from './cache.js';
 import { Dismissals, rememberReport } from './dismissed.js';
 import { renderChanges } from './judges/judge.js';
@@ -16,7 +15,6 @@ import { Budget } from './budget.js';
 import { packFor } from './lang/packs.js';
 import { SEVERITIES } from './types.js';
 import { stripControl, stripPath } from './text.js';
-const packOf = (path) => packFor(path)?.name ?? 'other';
 export function atLeast(severity, min) {
     return SEVERITIES.indexOf(severity) >= SEVERITIES.indexOf(min);
 }
@@ -33,20 +31,24 @@ export function titleOverlap(a, b) {
             shared++;
     return shared / Math.min(left.size, right.size);
 }
+const PORTABLE_OPTIONAL = new Set(['types', 'references', 'python-types']);
 /**
  * Files this verifier can actually answer for, with unavailable oracles kept per
- * file. `base` is applicability rather than a missing capability: a before/after
- * check has no question to ask about a newly created file.
+ * file. A before/after check has no question to ask about a newly created file;
+ * when an existing file has a base snapshot that cannot be parsed, `base` is a real
+ * missing capability and remains verdict-blocking in every coverage profile.
  */
 function verifierTargets(v, g, have) {
     if (v.domain === 'typescript') {
         return g.files
-            .filter((file) => !v.needs.includes('base') || file.before !== undefined)
+            .filter((file) => !v.needs.includes('base') || file.changed.before !== undefined)
             .map((file) => ({
             kind: 'typescript',
             path: file.changed.path,
             file,
             missing: v.needs.filter((need) => {
+                if (need === 'base')
+                    return file.before === undefined;
                 if (need === 'types' || need === 'references')
                     return !file.typed;
                 if (need === 'python-types')
@@ -59,12 +61,14 @@ function verifierTargets(v, g, have) {
         return g.foreign
             .filter((file) => v.domain !== 'python' || file.pack.name === 'python')
             .filter((file) => !v.supports || v.supports(file))
-            .filter((file) => !v.needs.includes('base') || file.beforeTree !== undefined)
+            .filter((file) => !v.needs.includes('base') || file.changed.before !== undefined)
             .map((file) => ({
             kind: 'foreign',
             path: file.path,
             file,
             missing: v.needs.filter((need) => {
+                if (need === 'base')
+                    return file.beforeTree === undefined;
                 if (need === 'python-types')
                     return file.pack.name !== 'python' || !have.has('python-types');
                 if (need === 'types' || need === 'references')
@@ -142,6 +146,7 @@ export async function review(opts) {
         return { findings: [], stats: { files: 0, verified: 0, judged: 0, dismissed: 0 }, failures, plan };
     }
     const skipped = new Map();
+    const unavailable = new Map();
     const budget = opts.budget ?? new Budget();
     const manifest = opts.manifest;
     const groundDone = stage('ground');
@@ -166,27 +171,33 @@ export async function review(opts) {
             targets.set(verifier, files);
     }
     const selectedVerifiers = [...targets.keys()];
+    // Naming a check explicitly is a request for that oracle, even under the portable
+    // default. Strict policy makes the same promise for every configured verifier.
+    const requireEnrichedOracles = config.coverage === 'strict' || opts.checks !== undefined;
     // a file the change touched that no parser produced a tree for was not reviewed,
     // whatever the summary says about the ones that were
     const grounded = new Set([...g.files.map((f) => f.changed.path), ...g.foreign.map((f) => f.path)]);
     for (const c of changed) {
-        if (!grounded.has(c.path))
+        if (grounded.has(c.path))
+            continue;
+        if (packFor(c.path))
+            plan.fail(c.path, 'declared language parser unavailable');
+        else
             plan.waive(c.path, 'no parser for this language');
     }
     // Capabilities belong to files, not runs. A typed file beside one excluded from
     // tsconfig must not make the latter look checked, and an old Ruby file must not
     // make a new Python file eligible for a before/after oracle.
     for (const files of targets.values()) {
-        for (const file of files)
-            plan.limit(file.path, file.missing);
-    }
-    if (skippedLanguages.length > 0) {
-        for (const c of changed) {
-            if (!grounded.has(c.path) && skippedLanguages.includes(packOf(c.path))) {
-                plan.fail(c.path, 'grammar budget reached');
-            }
+        for (const file of files) {
+            const required = file.missing.filter((capability) => !PORTABLE_OPTIONAL.has(capability));
+            const enriched = file.missing.filter((capability) => PORTABLE_OPTIONAL.has(capability));
+            plan.limit(file.path, required);
+            if (requireEnrichedOracles)
+                plan.limit(file.path, enriched);
+            else
+                plan.noteUnavailable(file.path, enriched);
         }
-        failures.push('not reviewed, grammar budget reached: ' + skippedLanguages.join(', '));
     }
     for (const line of plan.summary())
         say('selection ' + line);
@@ -201,8 +212,14 @@ export async function review(opts) {
         const files = targets.get(v);
         const eligible = files.filter((file) => file.missing.length === 0);
         const missing = [...new Set(files.flatMap((file) => file.missing))];
+        const check = v.id ?? v.name;
+        const onlyEnrichedMissing = missing.every((capability) => PORTABLE_OPTIONAL.has(capability));
+        if (missing.length > 0 && !requireEnrichedOracles && onlyEnrichedMissing) {
+            unavailable.set(check, missing.join(', '));
+        }
         if (missing.length > 0 && eligible.length === 0) {
-            skipped.set(v.id ?? v.name, missing.join(', '));
+            if (requireEnrichedOracles || !onlyEnrichedMissing)
+                skipped.set(check, missing.join(', '));
             continue;
         }
         // a scan spends most of its time here, so Ctrl-C has to reach this half
@@ -211,7 +228,6 @@ export async function review(opts) {
             break;
         }
         ran++;
-        const check = v.id ?? v.name;
         manifest?.ran(check);
         for (const file of eligible)
             plan.checked(file.path, check);
@@ -227,6 +243,10 @@ export async function review(opts) {
         const names = [...skipped].map(([n, why]) => n + ' (no ' + why + ')');
         say('skipped   ' + names.join(', '));
     }
+    if (unavailable.size > 0) {
+        const names = [...unavailable].map(([n, why]) => n + ' (no ' + why + ')');
+        say('coverage  portable · enriched checks unavailable: ' + names.join(', '));
+    }
     // --checks overrides the config rather than filtering it
     const isGated = range.from !== undefined || range.commit !== undefined;
     const judgeCache = opts.cache === false || verifyOnly ? undefined : JudgeCache.open(repo, isGated);
@@ -348,6 +368,7 @@ export async function review(opts) {
         failures,
         plan,
         skippedChecks: [...skipped].map(([check, missing]) => ({ check, missing })),
+        unavailableChecks: [...unavailable].map(([check, missing]) => ({ check, missing })),
         usage: budget.finish(),
         budgetStop,
         cancelled: opts.signal?.aborted ?? false,

package/dist/selftest.js

@@ -31,13 +31,13 @@ import { ProviderError, redact } from './judges/llm.js';
 import { VERIFIERS } from './verifiers/index.js';
 import { existsSync, mkdtempSync, readFileSync, writeFileSync, mkdirSync, readdirSync, rmSync, symlinkSync, realpathSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join, sep } from 'node:path';
+import { dirname, join, sep } from 'node:path';
 import { runTool } from './judges/tools.js';
 import { codeQuality } from './report/codequality.js';
 import { viewer } from './report/viewer.js';
 import { absorbDelegated, delegateBrief } from './delegate.js';
 import { TARGETS, findTarget } from './agents.js';
-import { packFor } from './lang/packs.js';
+import { PACKS, packFor, parseIsolated } from './lang/packs.js';
 import { isPhantom, pythonManifest, localModules } from './lang/python-deps.js';
 import { isPhantomGem, rubyManifest } from './lang/ruby-deps.js';
 import { pyrightAvailable } from './lang/pyright.js';
@@ -433,6 +433,35 @@ check('files are routed to the right language pack', () => {
     assert.equal(packFor('src/a.ts'), undefined); // TypeScript keeps its own oracle
     assert.equal(packFor('README.md'), undefined);
 });
+await checkAsync('isolated trees preserve Unicode offsets and grammar fields', async () => {
+    const pack = PACKS.find((candidate) => candidate.name === 'python');
+    const source = 'label = "é"\ndef answer(value: str) -> str:\n    return value\n';
+    const [tree] = await parseIsolated(pack, [source]);
+    assert.ok(tree);
+    const signature = pack.signatures?.(tree.rootNode).get('answer');
+    assert.ok(signature);
+    assert.equal(signature.node.text, 'def answer(value: str) -> str:\n    return value');
+    assert.deepEqual(signature.params, ['value: str']);
+});
+await checkAsync('language worker batching preserves every file past the 128-file boundary', async () => {
+    const dir = realpathSync(mkdtempSync(join(tmpdir(), 'psh-foreign-batches-')));
+    try {
+        const changes = [];
+        for (let index = 0; index < 129; index++) {
+            const path = 'python/module_' + index + '.py';
+            mkdirSync(dirname(join(dir, path)), { recursive: true });
+            writeFileSync(join(dir, path), 'value = ' + index + '\n');
+            changes.push({ path, added: new Set([1]), before: 'value = -1\n' });
+        }
+        const grounded = await buildGround(dir, changes);
+        assert.equal(grounded.foreign.length, changes.length);
+        assert.deepEqual(grounded.foreign.map((file) => file.path), changes.map((file) => file.path));
+        assert.ok(grounded.foreign.every((file) => file.beforeTree !== undefined));
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
 // Per-language pack checks live in langtest.ts, one process each: eleven wasm
 // grammars cannot share a process without exhausting it. `npm test` runs both.
 console.log('\neditor and provider surface');
@@ -462,7 +491,7 @@ check('compact defaults the column when a finding has no span', () => {
 });
 check('each provider reads its own key', () => {
     const base = { model: 'm', verifiers: ['*'], judges: ['*'], minSeverity: 'low',
-        ignore: [], promptCache: true };
+        ignore: [], coverage: 'portable', promptCache: true };
     const saved = { a: process.env.ANTHROPIC_API_KEY, o: process.env.OPENAI_API_KEY,
         g: process.env.GEMINI_API_KEY, gg: process.env.GOOGLE_API_KEY };
     process.env.ANTHROPIC_API_KEY = 'a';
@@ -556,6 +585,30 @@ check('a review that did not complete never renders as clean', () => {
     assert.match(partial, /partial, not a verdict/);
     assert.match(partial, /outside\.ts \(no types\)/);
 });
+check('portable coverage is a verdict, but never masquerades as full semantic coverage', () => {
+    const unavailable = [
+        '1 file(s) without enriched semantic coverage: web/app.ts (types, references)',
+        '2 enriched check(s) unavailable: phantom-api (no types), contract-drift (no references)',
+    ];
+    const out = terminal([], {
+        subtitle: 'workspace', verified: 0, judged: 0, state: 'complete', notLookedAt: [],
+        coverage: 'portable', unavailableCoverage: unavailable,
+    });
+    assert.match(out, /No findings in portable coverage\./);
+    assert.match(out, /web\/app\.ts \(types, references\)/);
+    assert.doesNotMatch(out, /not a verdict/);
+    const md = markdown([], {
+        state: 'complete', notLookedAt: [], coverage: 'portable',
+        files: [{ path: 'web/app.ts', unavailable: ['types', 'references'] }],
+        checks: { unavailable: [
+                { check: 'phantom-api', missing: 'types' },
+                { check: 'contract-drift', missing: 'references' },
+            ] },
+    });
+    assert.match(md, /\*\*Portable coverage\.\*\*/);
+    assert.match(md, /No findings in portable coverage\./);
+    assert.doesNotMatch(md, /^No findings\.$/m);
+});
 check('findings are still shown when a stage failed, with the warning kept', () => {
     const f = { id: 'F1', class: 'verified', check: 'phantom-dep', severity: 'high',
         confidence: 'proven', file: 'a.ts', line: 1, title: 'missing dep' };
@@ -616,6 +669,23 @@ check('no manifest means nothing to be wrong about', () => {
     assert.equal(pythonManifest('/definitely/not/a/repo'), undefined);
     assert.deepEqual(localModules('/definitely/not/a/repo'), new Set());
 });
+check('local Python modules are discovered from the changed package, not the whole monorepo', () => {
+    const dir = realpathSync(mkdtempSync(join(tmpdir(), 'psh-py-local-')));
+    try {
+        const app = join(dir, 'services', 'api', 'src', 'app.py');
+        mkdirSync(join(dir, 'services', 'api', 'src', 'localpkg'), { recursive: true });
+        mkdirSync(join(dir, 'unrelated', 'hiddenpkg'), { recursive: true });
+        writeFileSync(app, 'from localpkg import value\n');
+        writeFileSync(join(dir, 'services', 'api', 'src', 'localpkg', '__init__.py'), 'value = 1\n');
+        writeFileSync(join(dir, 'unrelated', 'hiddenpkg', '__init__.py'), 'value = 2\n');
+        const local = localModules(dir, dirname(app));
+        assert.equal(local.has('localpkg'), true);
+        assert.equal(local.has('hiddenpkg'), false);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
 console.log('\nruby gems');
 const gems = { names: new Set(['rails', 'httparty', 'sidekiq']) };
 const rbLocal = new Set(['helpers', 'models']);
@@ -892,7 +962,7 @@ check('self-review publishes machine findings only for a complete verdict', () =
     const workflow = readFileSync(join(process.cwd(), '.github', 'workflows', 'review.yml'), 'utf8');
     assert.equal(workflow.match(/node "\$PSH" review/g)?.length, 1);
     assert.match(workflow, /name: Check out the untrusted review target[\s\S]+allow-unsafe-pr-checkout: true/);
-    assert.match(workflow, /name: Install the target type environment[\s\S]+working-directory: target[\s\S]+npm ci --ignore-scripts/);
+    assert.doesNotMatch(workflow, /working-directory: target[\s\S]{0,120}npm ci/);
     assert.match(workflow, /steps\.review\.outputs\.status == '0' \|\| steps\.review\.outputs\.status == '1'/);
     assert.match(workflow, /sarif_file: powershot\.sarif\s+checkout_path: target\s+ref: refs\/pull\/\$\{\{ github\.event\.pull_request\.number \}\}\/head\s+sha: \$\{\{ github\.event\.pull_request\.head\.sha \}\}/);
 });
@@ -906,6 +976,10 @@ check('the public action persists judge answers and publishes only a verdict', (
     assert.match(action, /inline-comments:\s*\n\s+description: [^\n]+\n\s+default: 'false'/);
     assert.match(action, /Post inline comments[\s\S]+inputs\.inline-comments == 'true'[\s\S]+steps\.review\.outputs\.complete == 'true'/);
     assert.match(action, /node "\$GITHUB_ACTION_PATH\/dist\/github\/inline-comments\.js"/);
+    assert.match(action, /--report manifest=powershot\.manifest\.json/);
+    assert.match(action, /coverage=\$COVERAGE/);
+    assert.match(action, /m\.coverage === "full" \|\| m\.coverage === "portable" \? m\.coverage : "unknown"/);
+    assert.match(action, /Approve a clean review[\s\S]+steps\.review\.outputs\.coverage == 'full'/);
 });
 check('published CI examples preserve one verdict and its exit status', () => {
     const action = readFileSync(join(process.cwd(), 'examples', 'github-actions', 'action.yml'), 'utf8');
@@ -914,12 +988,13 @@ check('published CI examples preserve one verdict and its exit status', () => {
     assert.match(action, /upload-sarif: 'true'/);
     assert.match(action, /inline-comments: 'true'/);
     assert.match(action, /runs-on: ubuntu-24\.04/);
-    assert.match(action, /npm ci --ignore-scripts[\s\S]+uses: xcrft\/powershot@v1/);
-    assert.match(github, /npm install --global --ignore-scripts @0xcraft\/powershot@1\.1\.1/);
+    assert.doesNotMatch(action, /npm ci|NPM_AUTH_TOKEN|NODE_AUTH_TOKEN/);
+    assert.match(action, /uses: xcrft\/powershot@v1/);
+    assert.match(github, /npm install --global --ignore-scripts @0xcraft\/powershot@1\.1\.2/);
     assert.equal(github.match(/psh review/g)?.length, 1);
     assert.match(github, /--report markdown=powershot\.md[\s\S]+--report sarif=powershot\.sarif/);
     assert.match(github, /\|\| STATUS=\$\?[\s\S]+case "\$STATUS"/);
-    assert.match(gitlab, /npm install --global --ignore-scripts @0xcraft\/powershot@1\.1\.1/);
+    assert.match(gitlab, /npm install --global --ignore-scripts @0xcraft\/powershot@1\.1\.2/);
     assert.equal(gitlab.match(/psh review/g)?.length, 1);
     assert.match(gitlab, /--format codequality > gl-code-quality-report\.json \|\| STATUS=\$\?/);
     assert.match(gitlab, /test "\$STATUS" -le 1 \|\| exit "\$STATUS"/);
@@ -940,6 +1015,15 @@ check('the viewer is one self-contained page', () => {
     assert.equal(/<(script|link|img)[^>]+(src|href)="http/.test(html), false); // no network needed
     assert.equal((html.match(/class="f /g) ?? []).length, 2);
 });
+check('the viewer labels a complete portable session', () => {
+    const html = viewer([], {
+        id: 'portable', target: 'workspace', started: '2026-01-01T10:00:00Z',
+        state: 'complete', notLookedAt: [], coverage: 'portable',
+        unavailableCoverage: ['1 file(s) without enriched semantic coverage: app.ts (types)'],
+    });
+    assert.match(html, /Portable coverage\./);
+    assert.match(html, /No findings in portable coverage\./);
+});
 check('the viewer escapes content rather than rendering it', () => {
     const nasty = [{ ...sample[0], title: '<img src=x onerror=alert(1)>' }];
     const html = viewer(nasty, {
@@ -967,7 +1051,7 @@ check('delegated output distinguishes an empty verdict from malformed data', ()
 check('delegate --checks selects only the requested judging brief', () => {
     const cfg = {
         provider: 'anthropic', model: 'm', verifiers: ['*'], judges: ['*'],
-        minSeverity: 'low', ignore: [], promptCache: true,
+        minSeverity: 'low', ignore: [], coverage: 'portable', promptCache: true,
     };
     const brief = delegateBrief(ground([{ path: 'a.ts', after: 'export const a = 1\n' }]), cfg, {
         checks: ['intent'], intent: 'add a',
@@ -1736,6 +1820,12 @@ check('judges accept both the plain list and the { enable } form', () => {
     assert.equal(validateConfig({ judges: { enable: ['securty'] } }, KNOWN).length, 1);
     assert.equal(validateConfig({ judges: 'security' }, KNOWN).length, 1); // not a list at all
 });
+check('coverage is portable by default and strict only when requested', () => {
+    assert.equal(loadConfig(process.cwd()).coverage, 'portable');
+    assert.deepEqual(validateConfig({ coverage: 'portable' }, KNOWN), []);
+    assert.deepEqual(validateConfig({ coverage: 'strict' }, KNOWN), []);
+    assert.match(validateConfig({ coverage: 'complete' }, KNOWN)[0], /not one of: portable, strict/);
+});
 console.log('\nsession safety');
 check('a session will not be resumed by a different model than answered it', () => {
     const dir = mkdtempSync(join(tmpdir(), 'psh-ses-'));
@@ -1997,6 +2087,32 @@ check('the manifest accounts for everything it selected', () => {
     // and a failure anywhere means the run is not a verdict
     assert.equal(m2.build({ ...base, failures: ['judge died'] }).state, 'failed');
 });
+check('portable oracle gaps stay visible without turning the run into a partial verdict', () => {
+    const manifest = new RunManifest('portable');
+    manifest.ran('swallowed-error');
+    const record = manifest.build({
+        operation: 'review', target: { requested: {} },
+        policy: { source: 'base', hash: 'h' },
+        engine: { version: '0', tools: false, verifyOnly: true },
+        files: [{
+                path: 'web/app.ts', disposition: 'selected', bytes: 1, addedLines: 1,
+                language: 'typescript', checks: ['swallowed-error'], unavailable: ['types', 'references'],
+            }],
+        skippedChecks: [],
+        unavailableChecks: [
+            { check: 'phantom-api', missing: 'types' },
+            { check: 'contract-drift', missing: 'references' },
+        ],
+        findings: { total: 0, verified: 0, judged: 0, dismissed: 0, droppedPosition: 0 },
+        usage: { requests: 0, inputTokens: 0, outputTokens: 0, toolCalls: 0, elapsedMs: 0, units: 0 },
+        failures: [],
+    });
+    assert.equal(record.state, 'complete');
+    assert.deepEqual(record.notLookedAt, []);
+    assert.deepEqual(record.files[0].unavailable, ['types', 'references']);
+    assert.equal(record.checks.unavailable?.length, 2);
+    assert.deepEqual(coverageProblems(record), []);
+});
 check('a manifest that hides an unreached unit is caught as our bug', () => {
     const broken = {
         schema: SCHEMA, id: 'x', operation: 'review', started: '', ended: '',
@@ -2145,6 +2261,7 @@ await checkAsync('per-file limits follow the checks the caller actually selected
             operation: 'scan', target: { requested: {} }, policy: { source: 'default', hash: 'h' },
             engine: { version: '0', tools: false, verifyOnly: true }, files: result.plan?.items() ?? [],
             skippedChecks: result.skippedChecks ?? [],
+            unavailableChecks: result.unavailableChecks ?? [],
             findings: { total: result.findings.length, verified: result.stats.verified, judged: result.stats.judged,
                 dismissed: result.stats.dismissed, droppedPosition: 0 },
             usage: result.usage, failures: result.failures,
@@ -2162,6 +2279,131 @@ await checkAsync('per-file limits follow the checks the caller actually selected
         rmSync(dir, { recursive: true, force: true });
     }
 });
+await checkAsync('portable coverage reviews every declared language together without repository installs', async () => {
+    const dir = realpathSync(mkdtempSync(join(tmpdir(), 'psh-portable-mixed-')));
+    try {
+        const sources = {
+            python: { path: 'services/api/app.py', source: 'def answer() -> int:\n    try:\n        risky()\n    except Exception:\n        pass\n    return 42\n' },
+            go: { path: 'services/agent/main.go', source: 'package agent\nfunc answer() int {\n  if err := risky(); err != nil {\n  }\n  return 42\n}\n' },
+            java: { path: 'services/jvm/App.java', source: 'class App { int answer() { try { risky(); } catch (Exception e) { } return 42; } }\n' },
+            rust: { path: 'crates/worker/src/lib.rs', source: 'pub fn answer() -> i32 { match risky() { Err(_) => {}, Ok(v) => v }; 42 }\n' },
+            cpp: { path: 'native/app.cpp', source: 'int answer() { try { risky(); } catch (...) { } return 42; }\n' },
+            c: { path: 'native/app.c', source: 'int answer(void) { return 42; }\n' },
+            'c#': { path: 'dotnet/App.cs', source: 'class App { int Answer() { try { Risky(); } catch (Exception e) { } return 42; } }\n' },
+            php: { path: 'php/app.php', source: '<?php function answer() { try { risky(); } catch (Exception $e) { } return 42; }\n' },
+            kotlin: { path: 'android/App.kt', source: 'fun answer(): Int { try { risky() } catch (e: Exception) {} ; return 42 }\n' },
+            ruby: { path: 'ruby/app.rb', source: 'def answer\n  begin\n    risky\n  rescue => e\n  end\n  42\nend\n' },
+            solidity: { path: 'contracts/App.sol', source: 'contract App { function answer() public returns (uint) { try this.risky() { } catch { } return 42; } function risky() external {} }\n' },
+        };
+        assert.deepEqual(Object.keys(sources).sort(), PACKS.map((pack) => pack.name).sort());
+        const native = [
+            { path: 'web/app.ts', source: 'export const answer = 42\n' },
+            { path: 'web/legacy.js', source: 'export const legacyAnswer = 42\n' },
+        ];
+        const all = [...native, ...Object.values(sources)];
+        for (const file of all) {
+            mkdirSync(dirname(join(dir, file.path)), { recursive: true });
+            writeFileSync(join(dir, file.path), file.source);
+        }
+        const changes = all.map((file) => ({
+            path: file.path,
+            added: new Set(file.source.split('\n').slice(0, -1).map((_, line) => line + 1)),
+            before: file.source.replace('42', '41'),
+        }));
+        const manifest = new RunManifest('portable-mixed');
+        const result = await review({
+            root: dir, range: {}, changes, config: loadConfig(dir), verifyOnly: true, manifest,
+        });
+        const record = manifest.build({
+            operation: 'review', target: { requested: {} }, policy: { source: 'default', hash: 'h' },
+            engine: { version: '0', tools: false, verifyOnly: true }, files: result.plan.items(),
+            skippedChecks: result.skippedChecks ?? [], unavailableChecks: result.unavailableChecks ?? [],
+            findings: { total: result.findings.length, verified: result.stats.verified, judged: result.stats.judged,
+                dismissed: result.stats.dismissed, droppedPosition: result.droppedPosition ?? 0 },
+            usage: result.usage, failures: result.failures,
+        });
+        assert.equal(record.state, 'complete');
+        assert.deepEqual(record.notLookedAt, []);
+        assert.equal(record.files.length, all.length);
+        assert.ok(record.files.every((file) => file.disposition === 'selected'), 'a declared language cannot be waived');
+        assert.ok(record.files.every((file) => file.checks.length > 0), 'every declared language needs baseline checks');
+        const swallowed = new Set(result.findings.filter((finding) => finding.check === 'swallowed-error').map((finding) => finding.file));
+        for (const [language, file] of Object.entries(sources)) {
+            if (language !== 'c')
+                assert.equal(swallowed.has(file.path), true, language + ' isolated AST must drive its oracle');
+        }
+        assert.deepEqual(record.files.find((file) => file.path === 'web/app.ts')?.unavailable, ['types', 'references']);
+        assert.ok(record.checks.unavailable?.some((check) => check.check === 'phantom-api' && check.missing === 'types'));
+        assert.deepEqual(coverageProblems(record), []);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+await checkAsync('strict coverage keeps missing semantic oracles verdict-blocking', async () => {
+    const dir = realpathSync(mkdtempSync(join(tmpdir(), 'psh-strict-')));
+    try {
+        writeFileSync(join(dir, 'app.ts'), 'export const answer = 42\n');
+        const manifest = new RunManifest('strict');
+        const result = await review({
+            root: dir,
+            range: {},
+            changes: [{ path: 'app.ts', added: new Set([1]), before: 'export const answer = 41\n' }],
+            config: { ...loadConfig(dir), coverage: 'strict' },
+            verifyOnly: true,
+            manifest,
+        });
+        const record = manifest.build({
+            operation: 'review', target: { requested: {} }, policy: { source: 'default', hash: 'h' },
+            engine: { version: '0', tools: false, verifyOnly: true }, files: result.plan.items(),
+            skippedChecks: result.skippedChecks ?? [], unavailableChecks: result.unavailableChecks ?? [],
+            findings: { total: result.findings.length, verified: result.stats.verified, judged: result.stats.judged,
+                dismissed: result.stats.dismissed, droppedPosition: result.droppedPosition ?? 0 },
+            usage: result.usage, failures: result.failures,
+        });
+        assert.equal(record.state, 'partial');
+        assert.deepEqual(record.files[0].missing, ['types', 'references']);
+        assert.deepEqual(record.files[0].unavailable, undefined);
+        assert.ok(record.checks.skipped.some((check) => check.check === 'phantom-api' && check.missing === 'types'));
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+await checkAsync('portable coverage still blocks when an existing foreign base cannot be parsed', async () => {
+    const dir = realpathSync(mkdtempSync(join(tmpdir(), 'psh-foreign-base-limit-')));
+    try {
+        writeFileSync(join(dir, 'app.py'), 'def answer():\n    return 42\n');
+        const manifest = new RunManifest('foreign-base-limit');
+        const result = await review({
+            root: dir,
+            range: {},
+            changes: [{
+                    path: 'app.py',
+                    added: new Set([1, 2]),
+                    before: 'value = 1\n'.repeat(60_000),
+                }],
+            config: loadConfig(dir),
+            verifyOnly: true,
+            manifest,
+        });
+        const record = manifest.build({
+            operation: 'review', target: { requested: {} }, policy: { source: 'default', hash: 'h' },
+            engine: { version: '0', tools: false, verifyOnly: true }, files: result.plan.items(),
+            skippedChecks: result.skippedChecks ?? [], unavailableChecks: result.unavailableChecks ?? [],
+            findings: { total: result.findings.length, verified: result.stats.verified, judged: result.stats.judged,
+                dismissed: result.stats.dismissed, droppedPosition: result.droppedPosition ?? 0 },
+            usage: result.usage, failures: result.failures,
+        });
+        assert.equal(record.state, 'partial');
+        assert.ok(record.files[0].missing?.includes('base'));
+        assert.ok(record.checks.skipped.some((check) => check.missing.includes('base')));
+        assert.deepEqual(coverageProblems(record), []);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
 await checkAsync('foreign checks advertise only files their language pack can inspect', async () => {
     const dir = realpathSync(mkdtempSync(join(tmpdir(), 'psh-pack-coverage-')));
     try {

package/dist/session.js

@@ -106,6 +106,8 @@ export class Session {
             judged: findings.filter((f) => f.class === 'judged').length,
             state: verdict.state,
             notLookedAt: verdict.notLookedAt,
+            coverage: verdict.coverage,
+            unavailableCoverage: verdict.unavailableCoverage,
         };
         this.save();
     }

package/dist/verifiers/foreign-phantom-dep.js

@@ -47,13 +47,19 @@ function pythonFindings(g) {
     const python = g.foreign.filter((f) => f.pack.name === 'python');
     if (python.length === 0)
         return [];
-    const local = localModules(g.root);
     const findings = [];
+    const modules = new Map();
     for (const file of python) {
         // the manifests governing this file, not just the repository's own
-        const manifest = pythonManifest(g.root, dirname(join(g.root, file.path)));
+        const fileDir = dirname(join(g.root, file.path));
+        const manifest = pythonManifest(g.root, fileDir);
         if (!manifest)
             continue;
+        let local = modules.get(fileDir);
+        if (!local) {
+            local = localModules(g.root, fileDir);
+            modules.set(fileDir, local);
+        }
         for (const imported of file.pack.imports?.(file.tree.rootNode) ?? []) {
             const line = imported.node.startPosition.row + 1;
             if (!file.changed.added.has(line))