@agentvibes/guardrails 0.1.0 → 0.2.0

package/README.md

@@ -84,7 +84,14 @@ Workspaces that reach outside their repo (`link:../<repo>/...` overrides,
 `sibling_repos: "owner/repo owner2/repo2"`: the gate then checks the main
 repo out at `repos/<org>/<repo>` depth and shallow-clones each sibling at its
 own `repos/<owner>/<name>`, reproducing a `gits/<org>/<repo>` disk layout so
-the relative escapes resolve. Private siblings additionally need
+the relative escapes resolve. **Each sibling path is removed and re-cloned on
+every run.** A self-hosted runner keeps its `_work` directory between jobs and
+`actions/checkout` cleans only its own path, so the leftovers used to make the
+step exit 128 on every run after the first — before install, so the ratchet
+showed as `skipped` rather than as not-run (is-8774fe0e). Re-cloning also keeps
+the sibling current: gating against last week's sibling is a wrong answer, not
+a cheap one. Listing the repo under test in `sibling_repos` is refused — that
+path holds the run's own checkout. Private siblings additionally need
 `secrets: { sibling_token: <PAT with read on them> }` — the default job token
 cannot reach other repos. `@v0` is a
 moving tag that follows validated releases, actions-style; pin `@<commit-sha>`
@@ -187,6 +194,40 @@ that this package contains none.
 { "extends": "@agentvibes/guardrails/tsconfig" }
 ```
 
+### One biome config per repo, and it is the preset
+
+The biome preset is a preset, not a starting point. `guardrails verify` and
+`guardrails doctor` check the repo for drift and name the offending keys in one
+line. Three things count as drift:
+
+| | what | why |
+|---|---|---|
+| a | `biome.json` does not list `@agentvibes/guardrails/biome` in `extends` | it is not using the preset at all |
+| b | it extends the preset and then carries its own `formatter`, `javascript.formatter`, `json.formatter`, `linter` or `assist` | those are the preset's decisions, restated locally so they can drift |
+| c | a second `biome.json` / `biome.jsonc` exists in the tree (outside `node_modules`, `dist`, `.claude` and the other skipped dirs) | two configs means two answers |
+
+Two things stay legal, because they scope rather than restyle: `files` (a repo
+decides which of ITS paths are linted) and an `overrides` entry that only turns
+`suspicious.noConsole` off for some paths (a CLI has to print).
+
+**Enforcement is opt-in per repo, for now.** Add
+
+```toml
+# .agentvibes/project.toml
+[biome]
+preset = "enforced"
+```
+
+and `verify` exits 2 on drift, `doctor` exits 1. Without it both still SAY the
+drift — `verify` prints it as a note, `doctor` as a `biome preset` line — and
+neither changes its exit code. The reason is sequencing, not softness: epic
+is-a70a5963 is migrating 37 configs, and 5 of the 7 repos running this gate do
+not conform yet. Each migration adds the line as its last step; when the last
+one lands, the default flips to enforced.
+
+The reusable gate workflow runs `verify-diff`, not `verify`, so a repo that opts
+in should add a `guardrails verify` (or `doctor`) step to its own CI.
+
 ## Rules and fixtures
 
 - `rules/` — the canon. Stable ids, each message is a mini-manual (why + fix).
@@ -202,6 +243,42 @@ that this package contains none.
   `rules/`; the eight that remain are repo-local by decision, with the reason
   for each recorded in `candidates/README.md`. Still loaded nowhere.
 
+### Scopes — the repo states a fact, the canon says which rules stand down
+
+Some rules cannot be scoped by a glob inside the rule file, because the layout
+they need to know about is the repo's, not the canon's. Those facts go in
+`.agentvibes/project.toml` under `[verify]`:
+
+```toml
+[verify]
+screens    = "^src/screens/"   # these paths ARE screens
+kit_source = "^src/"           # this tree IS @agentvibes/kit
+```
+
+Each key states a fact about the repo — not a suppression. Which rules stop
+applying is the canon's business, declared in the rule itself:
+
+```yaml
+metadata:
+  appliesTo: not-screens      # direct-store-import
+  appliesTo: not-kit-source   # no-local-kit-clone, + its tsx twin
+```
+
+`screens` exists because a screen owns its page store and must import the class
+`direct-store-import` bans in a component; `kit_source` because
+`no-local-kit-clone` is error-tier and fires on the six canonical declarations
+inside `@agentvibes/kit` itself — the definitions it tells everyone else to
+import.
+
+Absent key = absent behaviour: a repo that says nothing is scanned exactly as it
+was. A pattern that is not a valid regular expression exits 2 with the reason
+rather than being dropped — a scope the gate cannot honour must fail loudly. The
+scope registry is closed (`SCOPES` in `src/screenScope.ts`); a free-form
+per-rule path map in user config would be the growing allowlist this refuses.
+`pnpm test:screens` asserts both directions of each scope AND that every
+registered scope has at least one rule carrying its marker — a scope nothing
+declares filters nothing while looking like it works.
+
 Per-repo severity RAISE: a repo that held a rule stricter than the canon keeps
 its gate via `[severity]` in `.agentvibes/project.toml`
 (`zod-optional-nullable = "error"`) — applied through ast-grep's native
@@ -211,6 +288,37 @@ are refused (exit 2); weakening has its own sanctioned homes (warn-tier biome
 deviation, `[verify] exclude` for vendored trees, justified per-line
 `ast-grep-ignore`).
 
+## Rule twins — one rule, two ids
+
+ast-grep's `typescript` and `tsx` languages are **disjoint, not nested**: a rule
+declared `language: typescript` reads `.ts` and never `.tsx`, and vice versa.
+There is no way to say "both" — `language: [typescript, tsx]` fails to parse,
+`languageGlobs` reassigns `.ts` to the tsx language and blinds every remaining
+`typescript` rule (measured corpus-wide: 5 rules dark, 6,094 findings lost
+against 334 gained), and two files sharing an id are refused outright.
+
+So a rule that must run on both is **two files with two ids**: `catch-empty.yml`
+and `catch-empty-tsx.yml`. The trailing `-tsx` is what you suppress with in a
+`.tsx` file, and the finding prints the id, so copying from the output is always
+right. A handful of pairs are spelled the other way round — the tsx arm came
+first and the `.ts` half is the `-ts` suffix (`demo-mode-by-default` +
+`demo-mode-by-default-ts`). Both spellings are one family.
+
+The two arms are one rule wearing two ids, so their `severity`, `files`,
+`ignores`, `utils` and `rule` blocks must stay byte-identical; only `id`,
+`language` and the message differ (the twin names its own suppression id).
+
+**This is enforced, not documented-and-hoped:** `pnpm test:twins`
+(`src/twinCoverageTest.ts`, part of `pnpm check`) fails when a rule family has
+only one arm and no entry in its `EXCEPTIONS` table, and when two arms that do
+exist have drifted apart. Each exception says *why* — either the missing arm is
+impossible (the rule matches JSX nodes, or its `files:` globs name only one
+extension) or it is a real gap, and then the entry carries the measurement and
+the issue that owns it. The failure this prevents is specific and has happened:
+a rule pointed at a language it cannot match reports zero, which is exactly what
+a correct rule with nothing to find reports. `test:rules` catches that for every
+rule it asserts; `test:twins` catches the arm that was never written.
+
 ## Repo-local extra rules
 
 A rule that encodes ONE repo's convention does not belong in the canon — but it
@@ -224,9 +332,26 @@ ruleDirs:
   - .ast-grep/rules          # repo-local extras
 ```
 
-Both directories load together and findings print their own rule id, so a local
-rule suppresses under its own name. Verified: a canon rule and a repo-local rule
-firing side by side in one `ast-grep scan -c sgconfig.yml` run.
+`guardrails verify` and `verify-diff` scan with **both** configs — the bundled
+canon and, when the working directory has one, the repo's own `sgconfig.yml` —
+and merge the findings, deduped by rule + file + line (the repo config almost
+always lists the canon `ruleDir` too, so every canon finding otherwise arrives
+twice). Two directions matter and both are pinned by `pnpm test:repo-rules`:
+
+- Repo-local rules run under `verify`, gate on error tier, and print their own
+  rule id, so a local rule suppresses under its own name. In 0.1.0 they did
+  not run at all — `verify` read only the package's config, and the intranet and
+  DataSpool each added a bare `ast-grep scan -c sgconfig.yml` as a second gate
+  stage to work around it.
+- A repo whose `sgconfig.yml` forgets the canon `ruleDir` does **not** lose the
+  canon. The canon is always scanned; the repo's config is additive.
+
+A repo `sgconfig.yml` that ast-grep cannot load (unreadable `ruleDir`, unparsable
+YAML) exits 2 with ast-grep's own reason. It never reads as "no findings" — a
+rule set that failed to load reports exactly what a rule set with nothing to find
+reports, and that silence is the failure this package exists to remove.
+`guardrails doctor` lists the `ruleDirs` the repo config declares, so a repo that
+believes it has local rules can see whether the config actually names them.
 
 Keep local ids distinct from canon ids — ast-grep refuses to load two rules with
 the same id, and a repo-local override of a canon rule is a silent fork rather
@@ -235,5 +360,6 @@ with fixtures instead of copying it into a second repo.
 
 ## Development
 
-`pnpm check` = build (tsc) + biome + fixture harness + gate-can-go-red test.
+`pnpm check` = build (tsc) + biome + fixture harness + twin coverage +
+gate-can-go-red test + metrics/init/severity/screens/hooks/iterate/leaks.
 CI runs exactly that, blocking.

package/dist/astGrep.d.ts

@@ -1,4 +1,7 @@
 import type { Finding, Severity } from "./findings.js";
+/** ast-grep could not load a config, so nothing was scanned with it. */
+export declare class AstGrepConfigError extends Error {
+}
 export interface AstGrepRow {
     ruleId: string;
     file: string;

package/dist/astGrep.js

@@ -1,5 +1,8 @@
 import { spawnSync } from "node:child_process";
 import { resolveTool } from "./toolResolve.js";
+/** ast-grep could not load a config, so nothing was scanned with it. */
+export class AstGrepConfigError extends Error {
+}
 /** Run `ast-grep scan -c <config> --json` and return structured matches. */
 export function scan(configPath, targets, extraArgs = []) {
     const tool = resolveTool("ast-grep");
@@ -13,8 +16,18 @@ export function scan(configPath, targets, extraArgs = []) {
     if (res.error)
         throw res.error;
     const out = res.stdout.trim();
-    if (out === "")
-        return [];
+    // Exit 0 = clean scan, 1 = the scan ran and found error-tier matches (stdout
+    // carries them either way). Everything else means ast-grep never scanned:
+    // 6 is an unreadable ruleDir, 8 an unparsable config. Returning [] there
+    // would report "no findings" for a rule set that never loaded — the exact
+    // silence this package exists to remove. Measured against ast-grep 0.45.2.
+    const status = res.status ?? -1;
+    if (out === "") {
+        if (status === 0)
+            return [];
+        throw new AstGrepConfigError(`ast-grep exited ${status} and scanned nothing with config ${configPath}. ` +
+            `Its output:\n${res.stderr.trim().slice(0, 2000)}`);
+    }
     let parsed;
     try {
         parsed = JSON.parse(out);

package/dist/astGrep.js.map

@@ -1 +1 @@
-{"version":3,"file":"astGrep.js","sourceRoot":"","sources":["../src/astGrep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAuB/C,4EAA4E;AAC5E,MAAM,UAAU,IAAI,CAClB,UAAkB,EAClB,OAAiB,EACjB,YAAsB,EAAE;IAExB,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,SAAS,CACnB,GAAG,EACH,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,EACzE;QACE,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;KAC7B,CACF,CAAC;IACF,IAAI,GAAG,CAAC,KAAK;QAAE,MAAM,GAAG,CAAC,KAAK,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC1B,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2CAA2C,GAAG,CAAC,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;QACjC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;QACpD,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI;KAClE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAC1B,UAAkB,EAClB,OAAiB,EACjB,YAAsB,EAAE;IAExB,OAAO,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC;SACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC;SACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,CAAC,CAAC,MAAM;QACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,SAAS;QACjB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,UAAmB;KAC5B,CAAC,CAAC,CAAC;AACR,CAAC"}
+{"version":3,"file":"astGrep.js","sourceRoot":"","sources":["../src/astGrep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAW/C,wEAAwE;AACxE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;CAAG;AAchD,4EAA4E;AAC5E,MAAM,UAAU,IAAI,CAClB,UAAkB,EAClB,OAAiB,EACjB,YAAsB,EAAE;IAExB,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,SAAS,CACnB,GAAG,EACH,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,EACzE;QACE,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;KAC7B,CACF,CAAC;IACF,IAAI,GAAG,CAAC,KAAK;QAAE,MAAM,GAAG,CAAC,KAAK,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,MAAM,oCAAoC,UAAU,IAAI;YACzE,gBAAgB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2CAA2C,GAAG,CAAC,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;QACjC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;QACpD,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI;KAClE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAC1B,UAAkB,EAClB,OAAiB,EACjB,YAAsB,EAAE;IAExB,OAAO,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC;SACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC;SACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,CAAC,CAAC,MAAM;QACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,SAAS;QACjB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,UAAmB;KAC5B,CAAC,CAAC,CAAC;AACR,CAAC"}

package/dist/doctor.js

@@ -2,6 +2,8 @@ import { createHash } from "node:crypto";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { packageRoot, rulesDir, structureRulesDir } from "./packagePaths.js";
+import { driftMessage, presetDrift, presetEnforced } from "./presetDrift.js";
+import { declaredRuleDirs } from "./repoRules.js";
 import { pinnedVersion, tryResolveTool } from "./toolResolve.js";
 function reportTool(name) {
     const pin = pinnedVersion(name);
@@ -42,7 +44,18 @@ export function rulesetSha() {
 function discoverConfigs(cwd) {
     const found = {};
     const sg = join(cwd, "sgconfig.yml");
-    found["sgconfig.yml"] = existsSync(sg) ? "present" : "absent";
+    if (existsSync(sg)) {
+        // Name the ruleDirs, not just the file. `verify` scans with this config IN
+        // ADDITION to the canon (is-f58cd6b4), so what it lists is what the repo
+        // adds on top — and a repo that thinks it has local rules can see here
+        // whether the config actually declares the directory holding them.
+        const dirs = declaredRuleDirs(sg);
+        found["sgconfig.yml"] =
+            dirs.length > 0 ? `present, ruleDirs: ${dirs.join(", ")}` : "present, no ruleDirs declared";
+    }
+    else {
+        found["sgconfig.yml"] = "absent";
+    }
     const biomePath = join(cwd, "biome.json");
     if (existsSync(biomePath)) {
         const extendsPreset = readFileSync(biomePath, "utf8").includes("@agentvibes/guardrails/biome");
@@ -76,6 +89,15 @@ export function runDoctor(json) {
         },
         rulesetSha: rulesetSha(),
         configDiscovery: discoverConfigs(process.cwd()),
+        // Preset drift (is-9c7a78d7). `doctor` REPORTS it wherever it exists —
+        // seeing it is the point of this command — and exits non-zero only where
+        // the repo has opted in with `[biome] preset = "enforced"`, the same switch
+        // `verify` reads. Reporting everywhere and gating on the flag is what lets
+        // the epic migrate 37 configs without reddening 5 gates on day one.
+        presetDrift: {
+            enforced: presetEnforced(process.cwd()),
+            findings: presetDrift(process.cwd()),
+        },
     };
     if (json) {
         console.log(JSON.stringify(result, null, 2));
@@ -95,8 +117,22 @@ export function runDoctor(json) {
         for (const [k, v] of Object.entries(result.configDiscovery)) {
             console.log(`  ${k.padEnd(28)} ${v}`);
         }
+        if (result.presetDrift.findings.length === 0) {
+            console.log("biome preset  no drift");
+        }
+        else {
+            console.log(`biome preset  ${result.presetDrift.enforced ? "DRIFT (enforced here)" : "drift (not enforced here yet)"}`);
+            for (const f of result.presetDrift.findings)
+                console.log(`  ${f.detail}`);
+            if (!result.presetDrift.enforced) {
+                console.log('  Add [biome] preset = "enforced" to .agentvibes/project.toml once this repo is migrated (epic is-a70a5963).');
+            }
+        }
     }
     const allFound = result.tools["ast-grep"].found && result.tools.biome.found;
-    return allFound ? 0 : 1;
+    const drifted = result.presetDrift.enforced && result.presetDrift.findings.length > 0;
+    if (drifted && !json)
+        console.error(`guardrails doctor: ${driftMessage(result.presetDrift.findings)}`);
+    return allFound && !drifted ? 0 : 1;
 }
 //# sourceMappingURL=doctor.js.map

package/dist/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAUjE,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,IAAI,EAAE,eAAe,IAAI,IAAI,GAAG,IAAI,QAAQ,EAAE;SAC/C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC;aAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACjC,IAAI,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACrC,KAAK,CAAC,cAAc,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;QAC/F,KAAK,CAAC,YAAY,CAAC,GAAG,aAAa;YACjC,CAAC,CAAC,+CAA+C;YACjD,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC;IACjC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IAC1D,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,KAAK,CAAC,0BAA0B,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAChG,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,0BAA0B,CAAC,GAAG,QAAQ,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,OAAO,GACX,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CACnE,CAAC,OAAO,CAAC;IACV,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE;QACvE,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,KAAK,EAAE;YACL,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;YAC1B,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,SAAS;SAC3C;QACD,UAAU,EAAE,UAAU,EAAE;QACxB,eAAe,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;KAChD,CAAC;IAEF,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,0BAA0B,OAAO,KAAK,WAAW,GAAG,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,CAAU,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CACT,CAAC,CAAC,KAAK;gBACL,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;gBAChG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,IAAI,EAAE,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;IAC5E,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAUjE,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,IAAI,EAAE,eAAe,IAAI,IAAI,GAAG,IAAI,QAAQ,EAAE;SAC/C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC;aAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACjC,IAAI,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACrC,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAClC,KAAK,CAAC,cAAc,CAAC;YACnB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,+BAA+B,CAAC;IAChG,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,cAAc,CAAC,GAAG,QAAQ,CAAC;IACnC,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;QAC/F,KAAK,CAAC,YAAY,CAAC,GAAG,aAAa;YACjC,CAAC,CAAC,+CAA+C;YACjD,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC;IACjC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IAC1D,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,KAAK,CAAC,0BAA0B,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAChG,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,0BAA0B,CAAC,GAAG,QAAQ,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,OAAO,GACX,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CACnE,CAAC,OAAO,CAAC;IACV,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE;QACvE,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,KAAK,EAAE;YACL,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;YAC1B,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,SAAS;SAC3C;QACD,UAAU,EAAE,UAAU,EAAE;QACxB,eAAe,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/C,uEAAuE;QACvE,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,oEAAoE;QACpE,WAAW,EAAE;YACX,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACvC,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;SACrC;KACF,CAAC;IAEF,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,0BAA0B,OAAO,KAAK,WAAW,GAAG,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,CAAU,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CACT,CAAC,CAAC,KAAK;gBACL,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;gBAChG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,IAAI,EAAE,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,iBAAiB,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,+BAA+B,EAAE,CAC3G,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CACT,8GAA8G,CAC/G,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACtF,IAAI,OAAO,IAAI,CAAC,IAAI;QAClB,OAAO,CAAC,KAAK,CAAC,sBAAsB,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,QAAQ,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC"}

package/dist/hookPostedit.js

@@ -1,6 +1,7 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, relative } from "node:path";
+import { AstGrepConfigError } from "./astGrep.js";
 import { formatFinding } from "./findings.js";
 import { addedLines, gitRoot, resolveMergeBase } from "./gitDiff.js";
 import { severityRaiseArgs } from "./severity.js";
@@ -81,7 +82,23 @@ export function runHookPostedit() {
     catch {
         severityArgs = [];
     }
-    let findings = collectVerifyFindings([file], severityArgs);
+    // The repo root, not the hook's cwd, is what decides which `sgconfig.yml`
+    // adds repo-local rules — an agent editing a monorepo package is rarely
+    // sitting at the root the config belongs to.
+    let findings;
+    try {
+        findings = collectVerifyFindings([file], severityArgs, repoRoot ?? dirname(file));
+    }
+    catch (err) {
+        if (err instanceof AstGrepConfigError) {
+            // Same self-defect rule as the [severity] table above: a repo config
+            // ast-grep cannot load must not fail the edit. It is reported once here
+            // and fails loudly in verify/verify-diff, which is where it gates.
+            console.error(`guardrails hook-postedit: ${err.message}`);
+            return 0;
+        }
+        throw err;
+    }
     const lines = changedLines(tool, file);
     if (lines !== undefined) {
         // An EMPTY set is a real answer (a revert git already collapsed) — there

package/dist/hookPostedit.js.map

@@ -1 +1 @@
-{"version":3,"file":"hookPostedit.js","sourceRoot":"","sources":["../src/hookPostedit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAgB,aAAa,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AA2BlD,MAAM,QAAQ,GACZ,2MAA2M,CAAC;AAE9M,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY;IAC3C,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;QACpF,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,mFAAmF;AACnF,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,sFAAsF;AACtF,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,KAAgB,CAAC;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAc,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,CAAC;IAC/C,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC/C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC9F,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,CAAC;IAC9D,iNAAiN;IACjN,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAEhC,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,IACE,QAAQ,KAAK,SAAS;QACtB,eAAe,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAClE,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,gEAAgE;IAChE,IAAI,YAAY,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,YAAY,GAAG,iBAAiB,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC;IACD,IAAI,QAAQ,GAAc,qBAAqB,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IAEtE,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,yEAAyE;QACzE,uEAAuE;QACvE,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5B,CAAC,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;YACjF,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAkB,EAAE;YACxC,CAAC,CAAC,CAAC,CACN,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;IAE3C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;YACb,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,kDAAkD,IAAI,QAAQ,QAAQ,oCAAoC,QAAQ,8FAA8F;SACzN,CAAC,CACH,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;YACb,kBAAkB,EAAE;gBAClB,aAAa,EAAE,aAAa;gBAC5B,iBAAiB,EAAE,uCAAuC,IAAI,QAAQ,QAAQ,wEAAwE,QAAQ,EAAE;aACjK;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"hookPostedit.js","sourceRoot":"","sources":["../src/hookPostedit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAgB,aAAa,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AA2BlD,MAAM,QAAQ,GACZ,2MAA2M,CAAC;AAE9M,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY;IAC3C,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;QACpF,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,mFAAmF;AACnF,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,sFAAsF;AACtF,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,KAAgB,CAAC;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAc,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,CAAC;IAC/C,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC/C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC9F,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,CAAC;IAC9D,iNAAiN;IACjN,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAEhC,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,IACE,QAAQ,KAAK,SAAS;QACtB,eAAe,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAClE,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,gEAAgE;IAChE,IAAI,YAAY,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,YAAY,GAAG,iBAAiB,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC;IACD,0EAA0E;IAC1E,wEAAwE;IACxE,6CAA6C;IAC7C,IAAI,QAAmB,CAAC;IACxB,IAAI,CAAC;QACH,QAAQ,GAAG,qBAAqB,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;YACtC,qEAAqE;YACrE,wEAAwE;YACxE,mEAAmE;YACnE,OAAO,CAAC,KAAK,CAAC,6BAA6B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,yEAAyE;QACzE,uEAAuE;QACvE,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5B,CAAC,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;YACjF,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAkB,EAAE;YACxC,CAAC,CAAC,CAAC,CACN,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;IAE3C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;YACb,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,kDAAkD,IAAI,QAAQ,QAAQ,oCAAoC,QAAQ,8FAA8F;SACzN,CAAC,CACH,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;YACb,kBAAkB,EAAE;gBAClB,aAAa,EAAE,aAAa;gBAC5B,iBAAiB,EAAE,uCAAuC,IAAI,QAAQ,QAAQ,wEAAwE,QAAQ,EAAE;aACjK;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/presetDrift.d.ts

@@ -0,0 +1,31 @@
+/** The package specifier a consuming repo must extend. */
+export declare const PRESET_SPECIFIER = "@agentvibes/guardrails/biome";
+export interface DriftFinding {
+    /** What is wrong, keyed for the one-line message. */
+    key: string;
+    detail: string;
+}
+/** Every biome config in the tree, repo-root-relative, excluding SKIP_DIRS. */
+export declare function findBiomeConfigs(root: string): string[];
+/**
+ * Everything wrong with `root`'s biome configuration; [] when it conforms.
+ * `root` is the repo being checked, not this package.
+ */
+export declare function presetDrift(root: string): DriftFinding[];
+/**
+ * Whether drift GATES in this repo, from `[biome] preset = "enforced"` in
+ * `.agentvibes/project.toml`.
+ *
+ * Opt-in per repo, then flipped (owner, 2026-09-06). Failing every repo the day
+ * this shipped would have turned 5 of the 7 repos that run this gate red —
+ * SiteCraftMonorepo, faceless-photo-lib, agent-session-observatory, tg-gallery,
+ * merkle-substrate — before the migration issue for each was worked, blocking
+ * unrelated work in all five. Each child of epic is-a70a5963 adds the line as
+ * its last step; when the last child lands, this default flips to enforced.
+ *
+ * Unenforced is NOT silent: `verify` prints the drift as a note and `doctor`
+ * always reports it. What the flag decides is the exit code, not the message.
+ */
+export declare function presetEnforced(cwd: string): boolean;
+/** The one-line message the gate prints; "" when there is no drift. */
+export declare function driftMessage(findings: DriftFinding[]): string;

package/dist/presetDrift.js

@@ -0,0 +1,226 @@
+import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { packageRoot } from "./packagePaths.js";
+import { readTomlTable } from "./tomlTable.js";
+// Preset-drift guard (is-9c7a78d7). The migration epic is-a70a5963 collapses 37
+// hand-rolled biome configs into one preset; nothing stopped a repo from
+// re-growing its own the week after. Owner's rule, 2026-09-03: «we should only
+// use agentvibes … no need to have many biome configs». So the tool is the
+// enforcement, not the convention.
+//
+// Three ways a repo drifts:
+//   a. its `biome.json` does not extend `@agentvibes/guardrails/biome`,
+//   b. it extends the preset and then restates the preset's own decisions —
+//      a top-level `formatter`, `javascript.formatter`, `json.formatter`,
+//      `linter` or `assist` key,
+//   c. a second `biome.json` / `biome.jsonc` sits somewhere in the tree.
+//
+// What stays legal, because it is scoping rather than style: `files` (a repo
+// decides which of ITS paths are linted) and an `overrides` entry that only
+// turns `noConsole` off for some paths (a CLI has to print).
+//
+// A repo with no biome config at all is not drifting and reports nothing —
+// there is no config to have re-grown. `guardrails doctor` still shows it as
+// absent, and `guardrails init` writes one.
+/** The package specifier a consuming repo must extend. */
+export const PRESET_SPECIFIER = "@agentvibes/guardrails/biome";
+/** Top-level keys the preset owns; a repo restating them has forked it. */
+const PRESET_OWNED = ["formatter", "linter", "assist"];
+/** Nested `<section>.formatter` keys the preset owns. */
+const PRESET_OWNED_NESTED = ["javascript", "json"];
+/** Keys an override may carry besides its rule content — path scoping only. */
+const OVERRIDE_SCOPING = new Set(["includes", "files", "ignore"]);
+const SKIP_DIRS = new Set([
+    "node_modules",
+    "dist",
+    "build",
+    ".next",
+    ".git",
+    "coverage",
+    ".turbo",
+    ".claude",
+]);
+/** Every biome config in the tree, repo-root-relative, excluding SKIP_DIRS. */
+export function findBiomeConfigs(root) {
+    const out = [];
+    const visit = (dir) => {
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (SKIP_DIRS.has(entry))
+                continue;
+            const path = join(dir, entry);
+            let st;
+            try {
+                st = lstatSync(path);
+            }
+            catch {
+                continue;
+            }
+            if (st.isDirectory()) {
+                visit(path);
+                continue;
+            }
+            if (st.isFile() && (entry === "biome.json" || entry === "biome.jsonc")) {
+                out.push(relative(root, path));
+            }
+        }
+    };
+    visit(root);
+    return out.sort();
+}
+function readConfig(path) {
+    try {
+        // biome.jsonc allows comments; strip line comments before parsing rather
+        // than adding a JSONC dependency for a check that only reads a few keys.
+        const raw = readFileSync(path, "utf8").replace(/^\s*\/\/.*$/gm, "");
+        const parsed = JSON.parse(raw);
+        return typeof parsed === "object" && parsed !== null ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function extendsList(config) {
+    const e = config.extends;
+    if (typeof e === "string")
+        return [e];
+    if (Array.isArray(e))
+        return e.filter((x) => typeof x === "string");
+    return [];
+}
+/**
+ * True when this repo IS the package that publishes the preset. Its root config
+ * extends `./configs/biome.json` by path (the specifier would resolve through
+ * node_modules to itself), and `configs/biome.json` is the preset SOURCE, not a
+ * competing config — so both are exempt from (a) and (c).
+ */
+function isPresetSource(root) {
+    return resolve(root) === resolve(packageRoot);
+}
+/** Overrides that do more than turn `noConsole` off for some paths. */
+function offendingOverrides(config) {
+    const overrides = config.overrides;
+    // ast-grep-ignore: silent-default-return -- "no overrides key" and "overrides is not a list" both mean the config has no override to object to; [] is the real answer, not a swallowed failure
+    if (!Array.isArray(overrides))
+        return [];
+    const bad = [];
+    overrides.forEach((entry, i) => {
+        if (typeof entry !== "object" || entry === null)
+            return;
+        const o = entry;
+        for (const key of Object.keys(o)) {
+            if (OVERRIDE_SCOPING.has(key))
+                continue;
+            if (key !== "linter") {
+                bad.push(`overrides[${i}].${key}`);
+                continue;
+            }
+            // A linter override is allowed if the ONLY rule it touches is noConsole.
+            const rules = o.linter?.rules;
+            const groups = typeof rules === "object" && rules !== null ? rules : {};
+            const groupNames = Object.keys(groups);
+            const onlySuspicious = groupNames.length === 1 && groupNames[0] === "suspicious";
+            const suspicious = groups.suspicious;
+            const ruleNames = typeof suspicious === "object" && suspicious !== null ? Object.keys(suspicious) : [];
+            const onlyNoConsole = ruleNames.length === 1 && ruleNames[0] === "noConsole";
+            if (!onlySuspicious || !onlyNoConsole) {
+                bad.push(`overrides[${i}].linter.rules (only suspicious.noConsole may be overridden)`);
+            }
+        }
+    });
+    return bad;
+}
+/**
+ * Everything wrong with `root`'s biome configuration; [] when it conforms.
+ * `root` is the repo being checked, not this package.
+ */
+export function presetDrift(root) {
+    const configs = findBiomeConfigs(root);
+    if (configs.length === 0)
+        return [];
+    const findings = [];
+    const source = isPresetSource(root);
+    // (c) One config, at the root. The preset source itself carries a second one
+    // — `configs/biome.json` IS the preset — and that is not drift.
+    const extras = configs.filter((c) => c !== "biome.json" && !(source && c === join("configs", "biome.json")));
+    if (extras.length > 0) {
+        findings.push({
+            key: "extra-config",
+            detail: `${extras.length} biome config(s) besides the root one: ${extras.join(", ")}`,
+        });
+    }
+    const rootPath = join(root, "biome.json");
+    if (!existsSync(rootPath)) {
+        findings.push({
+            key: "no-root-config",
+            detail: `biome config(s) present (${configs.join(", ")}) but no root biome.json extending ${PRESET_SPECIFIER}`,
+        });
+        return findings;
+    }
+    const config = readConfig(rootPath);
+    if (config === undefined) {
+        findings.push({ key: "unreadable", detail: "biome.json is not readable JSON" });
+        return findings;
+    }
+    // (a) Extends the preset. The preset source extends its own file by path.
+    const ext = extendsList(config);
+    const conforms = source
+        ? ext.some((e) => e.endsWith("configs/biome.json"))
+        : ext.includes(PRESET_SPECIFIER);
+    if (!conforms) {
+        findings.push({
+            key: "extends",
+            detail: ext.length === 0
+                ? `biome.json has no "extends" — it must extend ${PRESET_SPECIFIER}`
+                : `biome.json extends ${ext.join(", ")} — it must extend ${PRESET_SPECIFIER}`,
+        });
+    }
+    // (b) Does not restate what the preset decides.
+    const owned = PRESET_OWNED.filter((k) => config[k] !== undefined);
+    const nested = PRESET_OWNED_NESTED.filter((k) => config[k]?.formatter !== undefined).map((k) => `${k}.formatter`);
+    const restated = [...owned, ...nested];
+    if (restated.length > 0) {
+        findings.push({
+            key: "own-keys",
+            detail: `biome.json carries its own ${restated.join(", ")} — the preset owns these`,
+        });
+    }
+    const badOverrides = offendingOverrides(config);
+    if (badOverrides.length > 0) {
+        findings.push({
+            key: "overrides",
+            detail: `${badOverrides.join(", ")} — an override may only scope paths and turn suspicious.noConsole off`,
+        });
+    }
+    return findings;
+}
+/**
+ * Whether drift GATES in this repo, from `[biome] preset = "enforced"` in
+ * `.agentvibes/project.toml`.
+ *
+ * Opt-in per repo, then flipped (owner, 2026-09-06). Failing every repo the day
+ * this shipped would have turned 5 of the 7 repos that run this gate red —
+ * SiteCraftMonorepo, faceless-photo-lib, agent-session-observatory, tg-gallery,
+ * merkle-substrate — before the migration issue for each was worked, blocking
+ * unrelated work in all five. Each child of epic is-a70a5963 adds the line as
+ * its last step; when the last child lands, this default flips to enforced.
+ *
+ * Unenforced is NOT silent: `verify` prints the drift as a note and `doctor`
+ * always reports it. What the flag decides is the exit code, not the message.
+ */
+export function presetEnforced(cwd) {
+    return readTomlTable(join(cwd, ".agentvibes", "project.toml"), "biome").preset === "enforced";
+}
+/** The one-line message the gate prints; "" when there is no drift. */
+export function driftMessage(findings) {
+    if (findings.length === 0)
+        return "";
+    return `biome preset drift: ${findings.map((f) => f.detail).join("; ")}. One preset everywhere — extend ${PRESET_SPECIFIER} and delete the local copy (epic is-a70a5963).`;
+}
+//# sourceMappingURL=presetDrift.js.map