@agentvibes/guardrails 0.1.0

package/dist/cli.js

@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+import { fileURLToPath } from "node:url";
+import { match } from "ts-pattern";
+import { runDeploy } from "./deploy.js";
+import { runDoctor } from "./doctor.js";
+import { runHookPostedit } from "./hookPostedit.js";
+import { runHookStop } from "./hookStop.js";
+import { runInit } from "./init.js";
+import { runIterate } from "./iterate.js";
+import { runLeaks } from "./leaks.js";
+import { runMetrics } from "./metrics.js";
+import { ToolMissingError } from "./toolResolve.js";
+import { runVerify } from "./verify.js";
+import { runVerifyDiff } from "./verifyDiff.js";
+const USAGE = `guardrails — verification toolkit that makes agents write simple code
+
+Usage:
+  guardrails verify [paths...]        scan with the bundled rule canon (+ text
+                                      greps + react structure); exit 1 on any
+                                      error-tier finding
+  guardrails verify-diff [--base R]   added-lines ratchet vs merge-base; exit 1
+                                      only on error-tier findings your diff added
+  guardrails doctor                   tool versions, ruleset SHA, config discovery
+  guardrails init                     write repo stubs: sgconfig.yml, biome.json,
+                                      [stack] in .agentvibes/project.toml
+  guardrails metrics [paths...]       per-component/file/project metrics; with
+                                      --check compares GATED metrics against the
+                                      committed baseline (.guardrails/metrics.json)
+                                      and exits 1 on any regression;
+                                      --update-baseline [--force] tightens the
+                                      baseline (2% hysteresis); --snapshot appends
+                                      a JSONL trend row; --baseline <path> overrides
+
+  guardrails leaks [paths]            public/private boundary gate: scan for
+                                      private-infrastructure markers and token
+                                      patterns (+ gitleaks when available);
+                                      exit 1 on any hit
+  guardrails deploy [args...]         hand off to the project's deploy plugin
+                                      (guardrails-plugin-* dep, or [deploy]
+                                      plugin= in .agentvibes/project.toml);
+                                      the public CLI carries no topology
+  guardrails hook-postedit            Claude Code PostToolUse hook: reads hook
+                                      JSON on stdin, scans the edited .ts/.tsx
+                                      file on its changed lines; blocks on
+                                      error-tier findings
+  guardrails hook-stop                Claude Code Stop hook: verify-diff over
+                                      the session's changed files; blocks
+                                      "done" over new error-tier findings
+                                      (max 3 blocks/session, then loud skip)
+  guardrails iterate --task T --cmd C iterate-until-pass harness: run agent
+                                      command, run the gate, feed findings
+                                      back, repeat to green or --max (6)
+
+All subcommands accept --json.
+Exit codes: 0 ok · 1 findings/regression · 2 usage, missing tool, or missing baseline
+`;
+async function main(argv) {
+    const args = [...argv];
+    const json = args.includes("--json");
+    const filtered = args.filter((a) => a !== "--json");
+    const command = filtered.shift();
+    if (command === undefined || command === "--help" || command === "-h" || command === "help") {
+        console.log(USAGE);
+        return command === undefined ? 2 : 0;
+    }
+    const takeValueFlag = (flag) => {
+        const idx = filtered.indexOf(flag);
+        if (idx < 0)
+            return undefined;
+        const value = filtered[idx + 1];
+        // ast-grep-ignore: silent-default-return -- deliberate tri-state, not a fallback: null means "flag present but value missing" and every caller turns it into a usage error
+        if (value === undefined)
+            return null;
+        filtered.splice(idx, 2);
+        return value;
+    };
+    const takeBoolFlag = (flag) => {
+        const idx = filtered.indexOf(flag);
+        if (idx < 0)
+            return false;
+        filtered.splice(idx, 1);
+        return true;
+    };
+    const base = takeValueFlag("--base");
+    if (base === null) {
+        console.error("guardrails: --base requires a ref argument");
+        return 2;
+    }
+    const baselinePath = takeValueFlag("--baseline");
+    if (baselinePath === null) {
+        console.error("guardrails: --baseline requires a path argument");
+        return 2;
+    }
+    const patternsFile = takeValueFlag("--patterns") ?? undefined;
+    const task = takeValueFlag("--task") ?? undefined;
+    const cmd = takeValueFlag("--cmd") ?? undefined;
+    const gateCmd = takeValueFlag("--gate") ?? undefined;
+    const max = takeValueFlag("--max") ?? undefined;
+    const check = takeBoolFlag("--check");
+    const updateBaseline = takeBoolFlag("--update-baseline");
+    const force = takeBoolFlag("--force");
+    const snapshot = takeBoolFlag("--snapshot");
+    // ast-grep-ignore: non-exhaustive-match -- `command` is arbitrary CLI input (open string), not a closed union; the otherwise arm IS the unknown-subcommand error path
+    return match(command)
+        .with("verify", () => runVerify(filtered, json))
+        .with("verify-diff", () => runVerifyDiff(base, json))
+        .with("doctor", () => runDoctor(json))
+        .with("init", () => runInit(json))
+        .with("metrics", () => runMetrics({ targets: filtered, json, check, updateBaseline, force, snapshot, baselinePath }))
+        .with("leaks", () => runLeaks(filtered, json, patternsFile))
+        .with("deploy", () => runDeploy(filtered, json))
+        .with("hook-postedit", () => runHookPostedit())
+        .with("hook-stop", () => runHookStop())
+        .with("iterate", () => runIterate({
+        task,
+        cmd,
+        gate: gateCmd,
+        max: Number(max ?? 6),
+        json,
+        cliPath: fileURLToPath(import.meta.url),
+    }))
+        .otherwise(() => {
+        console.error(`guardrails: unknown subcommand '${command}'\n`);
+        console.error(USAGE);
+        return 2;
+    });
+}
+try {
+    process.exit(await main(process.argv.slice(2)));
+}
+catch (err) {
+    if (err instanceof ToolMissingError) {
+        console.error(`guardrails: ${err.message}`);
+        process.exit(2);
+    }
+    throw err;
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCb,CAAC;AAEF,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;IAEjC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC5F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,IAAY,EAA6B,EAAE;QAChE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAChC,2KAA2K;QAC3K,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACrC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE;QAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;IAC9D,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IAClD,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IACrD,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IAChD,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,cAAc,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAE5C,sKAAsK;IACtK,OAAO,KAAK,CAAC,OAAO,CAAC;SAClB,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;SAC/C,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;SACpD,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;SACrC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SACjC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CACpB,UAAU,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAC9F;SACA,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;SAC3D,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;SAC/C,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC;SAC9C,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;SACtC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CACpB,UAAU,CAAC;QACT,IAAI;QACJ,GAAG;QACH,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QACrB,IAAI;QACJ,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACxC,CAAC,CACH;SACA,SAAS,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,KAAK,CAAC,mCAAmC,OAAO,KAAK,CAAC,CAAC;QAC/D,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACP,CAAC;AAED,IAAI,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC"}

package/dist/deploy.d.ts

@@ -0,0 +1 @@
+export declare function runDeploy(args: string[], json: boolean): Promise<number>;

package/dist/deploy.js

@@ -0,0 +1,34 @@
+import { join } from "node:path";
+import { loadPlugin, PluginResolutionError, resolvePluginName } from "./pluginResolve.js";
+import { readTomlTable } from "./tomlTable.js";
+const DOC = "See README 'Deploy plugins': install a guardrails-plugin-* package (or set `plugin = \"<npm name>\"` under [deploy] in .agentvibes/project.toml). The public CLI carries no deploy topology of its own.";
+export async function runDeploy(args, json) {
+    const cwd = process.cwd();
+    const deployConfig = readTomlTable(join(cwd, ".agentvibes", "project.toml"), "deploy");
+    let pluginName;
+    try {
+        pluginName = resolvePluginName(cwd);
+    }
+    catch (err) {
+        console.error(`guardrails deploy: ${err instanceof Error ? err.message : String(err)}`);
+        return 2;
+    }
+    if (pluginName === undefined) {
+        console.error(`guardrails deploy: no deploy plugin found in this project. ${DOC}`);
+        return 2;
+    }
+    let plugin;
+    try {
+        plugin = await loadPlugin(cwd, pluginName);
+    }
+    catch (err) {
+        if (err instanceof PluginResolutionError) {
+            console.error(`guardrails deploy: ${err.message} ${DOC}`);
+            return 2;
+        }
+        throw err;
+    }
+    const context = { cwd, deployConfig, json };
+    return await plugin.deploy(args, context);
+}
+//# sourceMappingURL=deploy.js.map

package/dist/deploy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,MAAM,GAAG,GACP,yMAAyM,CAAC;AAE5M,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAc,EAAE,IAAa;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,cAAc,CAAC,EAAE,QAAQ,CAAC,CAAC;IAEvF,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,8DAA8D,GAAG,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAA8C,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;YACzC,OAAO,CAAC,KAAK,CAAC,sBAAsB,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAkB,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC3D,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC"}

package/dist/doctor.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Stable digest of every bundled rule file (canon + structure marker), so two
+ * hosts can compare "which ruleset did your gate actually run" by one string.
+ */
+export declare function rulesetSha(): string;
+export declare function runDoctor(json: boolean): number;

package/dist/doctor.js

@@ -0,0 +1,102 @@
+import { createHash } from "node:crypto";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { packageRoot, rulesDir, structureRulesDir } from "./packagePaths.js";
+import { pinnedVersion, tryResolveTool } from "./toolResolve.js";
+function reportTool(name) {
+    const pin = pinnedVersion(name);
+    const resolved = tryResolveTool(name);
+    if (resolved === undefined) {
+        return {
+            found: false,
+            ...(pin !== undefined ? { pin } : {}),
+            hint: `mise use -g ${name}@${pin ?? "latest"}`,
+        };
+    }
+    return {
+        found: true,
+        version: resolved.version,
+        via: resolved.via,
+        ...(pin !== undefined ? { pin } : {}),
+    };
+}
+/**
+ * Stable digest of every bundled rule file (canon + structure marker), so two
+ * hosts can compare "which ruleset did your gate actually run" by one string.
+ */
+export function rulesetSha() {
+    const hash = createHash("sha256");
+    for (const dir of [rulesDir, structureRulesDir]) {
+        const files = readdirSync(dir)
+            .filter((f) => f.endsWith(".yml"))
+            .sort();
+        for (const f of files) {
+            hash.update(f);
+            hash.update("\0");
+            hash.update(readFileSync(join(dir, f)));
+            hash.update("\0");
+        }
+    }
+    return hash.digest("hex");
+}
+function discoverConfigs(cwd) {
+    const found = {};
+    const sg = join(cwd, "sgconfig.yml");
+    found["sgconfig.yml"] = existsSync(sg) ? "present" : "absent";
+    const biomePath = join(cwd, "biome.json");
+    if (existsSync(biomePath)) {
+        const extendsPreset = readFileSync(biomePath, "utf8").includes("@agentvibes/guardrails/biome");
+        found["biome.json"] = extendsPreset
+            ? "present, extends @agentvibes/guardrails/biome"
+            : "present";
+    }
+    else {
+        found["biome.json"] = "absent";
+    }
+    const tomlPath = join(cwd, ".agentvibes", "project.toml");
+    if (existsSync(tomlPath)) {
+        const hasStack = /^\[stack\]/m.test(readFileSync(tomlPath, "utf8"));
+        found[".agentvibes/project.toml"] = hasStack ? "present, has [stack]" : "present, no [stack]";
+    }
+    else {
+        found[".agentvibes/project.toml"] = "absent";
+    }
+    return found;
+}
+export function runDoctor(json) {
+    const version = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8")).version;
+    const result = {
+        command: "doctor",
+        package: { name: "@agentvibes/guardrails", version, root: packageRoot },
+        node: process.version,
+        tools: {
+            "ast-grep": reportTool("ast-grep"),
+            biome: reportTool("biome"),
+            mise: tryResolveTool("mise") !== undefined,
+        },
+        rulesetSha: rulesetSha(),
+        configDiscovery: discoverConfigs(process.cwd()),
+    };
+    if (json) {
+        console.log(JSON.stringify(result, null, 2));
+    }
+    else {
+        console.log(`@agentvibes/guardrails ${version} (${packageRoot})`);
+        console.log(`node       ${result.node}`);
+        for (const name of ["ast-grep", "biome"]) {
+            const t = result.tools[name];
+            console.log(t.found
+                ? `${name.padEnd(10)} ${t.version} (via ${t.via}${t.pin !== undefined ? `, pin ${t.pin}` : ""})`
+                : `${name.padEnd(10)} MISSING — install: ${t.hint}`);
+        }
+        console.log(`mise       ${result.tools.mise ? "present" : "absent"}`);
+        console.log(`ruleset    sha256:${result.rulesetSha.slice(0, 16)}…`);
+        console.log(`config discovery in ${process.cwd()}:`);
+        for (const [k, v] of Object.entries(result.configDiscovery)) {
+            console.log(`  ${k.padEnd(28)} ${v}`);
+        }
+    }
+    const allFound = result.tools["ast-grep"].found && result.tools.biome.found;
+    return allFound ? 0 : 1;
+}
+//# sourceMappingURL=doctor.js.map

package/dist/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAUjE,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,IAAI,EAAE,eAAe,IAAI,IAAI,GAAG,IAAI,QAAQ,EAAE;SAC/C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC;aAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACjC,IAAI,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACrC,KAAK,CAAC,cAAc,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;QAC/F,KAAK,CAAC,YAAY,CAAC,GAAG,aAAa;YACjC,CAAC,CAAC,+CAA+C;YACjD,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC;IACjC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IAC1D,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,KAAK,CAAC,0BAA0B,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAChG,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,0BAA0B,CAAC,GAAG,QAAQ,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,OAAO,GACX,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CACnE,CAAC,OAAO,CAAC;IACV,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE;QACvE,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,KAAK,EAAE;YACL,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;YAC1B,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,SAAS;SAC3C;QACD,UAAU,EAAE,UAAU,EAAE;QACxB,eAAe,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;KAChD,CAAC;IAEF,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,0BAA0B,OAAO,KAAK,WAAW,GAAG,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,CAAU,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CACT,CAAC,CAAC,KAAK;gBACL,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;gBAChG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,IAAI,EAAE,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;IAC5E,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}

package/dist/fileWalk.d.ts

@@ -0,0 +1,2 @@
+/** Expand file/dir targets into the contained files matching `exts`. Does not follow symlinks. */
+export declare function collectFiles(targets: string[], exts: string[]): string[];

package/dist/fileWalk.js

@@ -0,0 +1,45 @@
+import { lstatSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+// `.claude` is agent workspace, not product source — and in the wild it holds
+// symlinked git worktrees of OTHER repos (observed in observatory), which is
+// also why the walker lstats and never follows symlinks: a symlinked foreign
+// tree must not leak into this project's metrics or scans.
+const SKIP_DIRS = new Set([
+    "node_modules",
+    "dist",
+    "build",
+    ".next",
+    ".git",
+    "coverage",
+    ".turbo",
+    ".claude",
+]);
+/** Expand file/dir targets into the contained files matching `exts`. Does not follow symlinks. */
+export function collectFiles(targets, exts) {
+    const out = [];
+    const visit = (path) => {
+        let st;
+        try {
+            st = lstatSync(path);
+        }
+        catch {
+            return;
+        }
+        if (st.isFile()) {
+            if (exts.some((e) => path.endsWith(e)))
+                out.push(path);
+            return;
+        }
+        if (!st.isDirectory())
+            return;
+        for (const entry of readdirSync(path)) {
+            if (SKIP_DIRS.has(entry))
+                continue;
+            visit(join(path, entry));
+        }
+    };
+    for (const t of targets)
+        visit(t);
+    return out;
+}
+//# sourceMappingURL=fileWalk.js.map

package/dist/fileWalk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileWalk.js","sourceRoot":"","sources":["../src/fileWalk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,2DAA2D;AAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc;IACd,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,UAAU;IACV,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AAEH,kGAAkG;AAClG,MAAM,UAAU,YAAY,CAAC,OAAiB,EAAE,IAAc;IAC5D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,IAAY,EAAQ,EAAE;QACnC,IAAI,EAAgC,CAAC;QACrC,IAAI,CAAC;YACH,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YAChB,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;YAAE,OAAO;QAC9B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YACnC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/findings.d.ts

@@ -0,0 +1,12 @@
+export type Severity = "error" | "warning" | "info" | "hint";
+export type FindingSource = "ast-grep" | "text-grep" | "structure";
+export interface Finding {
+    rule: string;
+    severity: Severity;
+    file: string;
+    line: number;
+    message: string;
+    source: FindingSource;
+}
+export declare function formatFinding(f: Finding): string;
+export declare function hasErrors(findings: Finding[]): boolean;

package/dist/findings.js

@@ -0,0 +1,8 @@
+export function formatFinding(f) {
+    const firstLine = f.message.split("\n")[0] ?? "";
+    return `${f.severity}[${f.rule}]: ${f.file}:${f.line}\n  ${firstLine}`;
+}
+export function hasErrors(findings) {
+    return findings.some((f) => f.severity === "error");
+}
+//# sourceMappingURL=findings.js.map

package/dist/findings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.js","sourceRoot":"","sources":["../src/findings.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,OAAO,SAAS,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAmB;IAC3C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;AACtD,CAAC"}

package/dist/gateRed.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gateRed.js

@@ -0,0 +1,93 @@
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { packageRoot } from "./packagePaths.js";
+// The gate-can-go-red test. A CI step that only ever sees green input proves
+// nothing — `|| echo warning` gates and no-op lint scripts stay green forever,
+// and that anti-pattern is what this package exists to kill. So `pnpm check`
+// runs the verifier against a deliberately bad file and FAILS unless the
+// verifier fails, then against a clean file and fails unless it passes.
+const BAD_SOURCE = `interface Payload { id: string }
+export function decode(raw: unknown): Payload {
+  return raw as any;
+}
+`;
+const GOOD_SOURCE = `export function double(n: number): number {
+  return n * 2;
+}
+`;
+function verify(target) {
+    const res = spawnSync("node", [join(packageRoot, "dist", "cli.js"), "verify", target], {
+        encoding: "utf8",
+    });
+    if (res.error)
+        throw res.error;
+    return res.status ?? -1;
+}
+// The `[verify] exclude` vendored-tree carve-out, both directions: a bad file
+// INSIDE the excluded tree must not gate verify-diff, and the same bad file
+// outside it must — otherwise the carve-out would be indistinguishable from a
+// broken gate.
+function excludeCarveOut(base) {
+    const repo = join(base, "excludeRepo");
+    mkdirSync(join(repo, "vendored"), { recursive: true });
+    mkdirSync(join(repo, ".agentvibes"), { recursive: true });
+    const git = (...args) => {
+        const r = spawnSync("git", ["-C", repo, ...args], { encoding: "utf8" });
+        if (r.status !== 0)
+            throw new Error(`git ${args.join(" ")}: ${r.stderr}`);
+    };
+    git("init", "-q");
+    writeFileSync(join(repo, ".agentvibes", "project.toml"), '[verify]\nexclude = "^vendored/"\n');
+    writeFileSync(join(repo, "clean.ts"), GOOD_SOURCE);
+    git("add", "-A");
+    git("-c", "user.email=t@t", "-c", "user.name=t", "commit", "-qm", "init");
+    const run = () => {
+        const res = spawnSync("node", [join(packageRoot, "dist", "cli.js"), "verify-diff"], {
+            cwd: repo,
+            encoding: "utf8",
+        });
+        return res.status ?? -1;
+    };
+    writeFileSync(join(repo, "vendored", "upstreamCopy.ts"), BAD_SOURCE);
+    if (run() !== 0) {
+        console.error("FAIL gate-red: excluded vendored file gated verify-diff — carve-out inert");
+        return 1;
+    }
+    console.log("  ok  gate-red: bad file under [verify] exclude → verify-diff exit 0 (carve-out)");
+    writeFileSync(join(repo, "notVendored.ts"), BAD_SOURCE);
+    if (run() !== 1) {
+        console.error("FAIL gate-red: bad file OUTSIDE the exclude did not gate — exclude too broad");
+        return 1;
+    }
+    console.log("  ok  gate-red: same bad file outside the exclude → verify-diff exit 1");
+    return 0;
+}
+function main() {
+    const dir = mkdtempSync(join(tmpdir(), "guardrails-gate-red-"));
+    try {
+        const badFile = join(dir, "deliberatelyBad.ts");
+        writeFileSync(badFile, BAD_SOURCE);
+        const badExit = verify(badFile);
+        if (badExit !== 1) {
+            console.error(`FAIL gate-red: verify on a file containing \`as any\` exited ${badExit}, expected 1 — the gate cannot go red`);
+            return 1;
+        }
+        console.log("  ok  gate-red: deliberately bad file → verify exit 1 (gate goes red)");
+        const goodFile = join(dir, "deliberatelyGood.ts");
+        writeFileSync(goodFile, GOOD_SOURCE);
+        const goodExit = verify(goodFile);
+        if (goodExit !== 0) {
+            console.error(`FAIL gate-red: verify on a clean file exited ${goodExit}, expected 0`);
+            return 1;
+        }
+        console.log("  ok  gate-red: clean file → verify exit 0 (gate goes green)");
+        return excludeCarveOut(dir);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+process.exit(main());
+//# sourceMappingURL=gateRed.js.map

package/dist/gateRed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateRed.js","sourceRoot":"","sources":["../src/gateRed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AACzE,wEAAwE;AAExE,MAAM,UAAU,GAAG;;;;CAIlB,CAAC;AAEF,MAAM,WAAW,GAAG;;;CAGnB,CAAC;AAEF,SAAS,MAAM,CAAC,MAAc;IAC5B,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;QACrF,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,KAAK;QAAE,MAAM,GAAG,CAAC,KAAK,CAAC;IAC/B,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,eAAe;AACf,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACvC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,CAAC,GAAG,IAAc,EAAQ,EAAE;QACtC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC;IACF,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClB,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,cAAc,CAAC,EAAE,oCAAoC,CAAC,CAAC;IAC/F,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;IACnD,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjB,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAE1E,MAAM,GAAG,GAAG,GAAW,EAAE;QACvB,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,aAAa,CAAC,EAAE;YAClF,GAAG,EAAE,IAAI;YACT,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC;IAEF,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,iBAAiB,CAAC,EAAE,UAAU,CAAC,CAAC;IACrE,IAAI,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;IAEhG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,UAAU,CAAC,CAAC;IACxD,IAAI,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;QAC9F,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,IAAI;IACX,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QAChD,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CACX,gEAAgE,OAAO,uCAAuC,CAC/G,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;QAErF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAClD,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,KAAK,CAAC,gDAAgD,QAAQ,cAAc,CAAC,CAAC;YACtF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;QAC5E,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC"}

package/dist/gitDiff.d.ts

@@ -0,0 +1,18 @@
+export declare function gitRoot(cwd: string): string | undefined;
+/**
+ * The base-ref ladder, ported from defensive-errors hook-postedit.sh.
+ * `origin/HEAD` first because it names the remote's real default branch. A
+ * LOCAL branch whose merge-base is HEAD itself is rejected: on a repo with no
+ * remote, checked out on `main`, the ref `main` IS HEAD — the diff would
+ * degenerate to `git diff HEAD` and committing mid-session would launder the
+ * findings. A remote ref in the same position is fine: it does not move on a
+ * local commit, so the degenerate case self-heals on the next commit.
+ */
+export declare function resolveMergeBase(root: string, explicitBase?: string): string | undefined;
+/** Changed (ACMR) tracked .ts/.tsx files vs the merge base, plus untracked ones. Absolute paths. */
+export declare function changedFiles(root: string, mergeBase: string): {
+    tracked: string[];
+    untracked: string[];
+};
+/** 1-based line numbers ADDED in the working tree vs mergeBase for one file. */
+export declare function addedLines(root: string, mergeBase: string, file: string): Set<number>;

package/dist/gitDiff.js

@@ -0,0 +1,90 @@
+import { spawnSync } from "node:child_process";
+import { isAbsolute, join } from "node:path";
+function git(root, args) {
+    const res = spawnSync("git", root === undefined ? args : ["-C", root, ...args], {
+        encoding: "utf8",
+        maxBuffer: 256 * 1024 * 1024,
+    });
+    if (res.status !== 0 || res.error)
+        return undefined;
+    return res.stdout;
+}
+export function gitRoot(cwd) {
+    return git(cwd, ["rev-parse", "--show-toplevel"])?.trim();
+}
+/**
+ * The base-ref ladder, ported from defensive-errors hook-postedit.sh.
+ * `origin/HEAD` first because it names the remote's real default branch. A
+ * LOCAL branch whose merge-base is HEAD itself is rejected: on a repo with no
+ * remote, checked out on `main`, the ref `main` IS HEAD — the diff would
+ * degenerate to `git diff HEAD` and committing mid-session would launder the
+ * findings. A remote ref in the same position is fine: it does not move on a
+ * local commit, so the degenerate case self-heals on the next commit.
+ */
+export function resolveMergeBase(root, explicitBase) {
+    const headOid = git(root, ["rev-parse", "HEAD"])?.trim();
+    if (headOid === undefined)
+        return undefined;
+    const originHead = git(root, [
+        "symbolic-ref",
+        "-q",
+        "--short",
+        "refs/remotes/origin/HEAD",
+    ])?.trim();
+    const candidates = explicitBase !== undefined
+        ? [explicitBase]
+        : [
+            originHead,
+            "origin/main",
+            "origin/master",
+            "upstream/main",
+            "upstream/master",
+            "main",
+            "master",
+        ];
+    for (const ref of candidates) {
+        if (ref === undefined || ref === "")
+            continue;
+        if (git(root, ["rev-parse", "-q", "--verify", `${ref}^{commit}`]) === undefined)
+            continue;
+        const mb = git(root, ["merge-base", "HEAD", ref])?.trim();
+        if (mb === undefined || mb === "")
+            continue;
+        const isRemote = ref.includes("/");
+        if (!isRemote && mb === headOid && explicitBase === undefined)
+            continue;
+        return mb;
+    }
+    return undefined;
+}
+/** Changed (ACMR) tracked .ts/.tsx files vs the merge base, plus untracked ones. Absolute paths. */
+export function changedFiles(root, mergeBase) {
+    const abs = (f) => (isAbsolute(f) ? f : join(root, f));
+    const tracked = (git(root, ["diff", "--name-only", "--diff-filter=ACMR", mergeBase, "--", "*.ts", "*.tsx"]) ?? "")
+        .split("\n")
+        .filter((f) => f !== "")
+        .map(abs);
+    const untracked = (git(root, ["ls-files", "--others", "--exclude-standard", "--", "*.ts", "*.tsx"]) ?? "")
+        .split("\n")
+        .filter((f) => f !== "")
+        .map(abs);
+    return { tracked, untracked };
+}
+/** 1-based line numbers ADDED in the working tree vs mergeBase for one file. */
+export function addedLines(root, mergeBase, file) {
+    const out = git(root, ["diff", "-U0", mergeBase, "--", file]) ?? "";
+    const lines = new Set();
+    for (const line of out.split("\n")) {
+        if (!line.startsWith("@@"))
+            continue;
+        const m = line.match(/\+(\d+)(?:,(\d+))?/);
+        if (m === null)
+            continue;
+        const start = Number(m[1]);
+        const len = m[2] === undefined ? 1 : Number(m[2]);
+        for (let i = 0; i < len; i++)
+            lines.add(start + i);
+    }
+    return lines;
+}
+//# sourceMappingURL=gitDiff.js.map

package/dist/gitDiff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitDiff.js","sourceRoot":"","sources":["../src/gitDiff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE7C,SAAS,GAAG,CAAC,IAAwB,EAAE,IAAc;IACnD,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE;QAC9E,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;KAC7B,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,OAAO,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,YAAqB;IAClE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE5C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE;QAC3B,cAAc;QACd,IAAI;QACJ,SAAS;QACT,0BAA0B;KAC3B,CAAC,EAAE,IAAI,EAAE,CAAC;IACX,MAAM,UAAU,GACd,YAAY,KAAK,SAAS;QACxB,CAAC,CAAC,CAAC,YAAY,CAAC;QAChB,CAAC,CAAC;YACE,UAAU;YACV,aAAa;YACb,eAAe;YACf,eAAe;YACf,iBAAiB;YACjB,MAAM;YACN,QAAQ;SACT,CAAC;IAER,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QAC9C,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,GAAG,WAAW,CAAC,CAAC,KAAK,SAAS;YAAE,SAAS;QAC1F,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1D,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,IAAI,EAAE,KAAK,OAAO,IAAI,YAAY,KAAK,SAAS;YAAE,SAAS;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,SAAiB;IAEjB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,CACd,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CACjG;SACE,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;SACvB,GAAG,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,SAAS,GAAG,CAChB,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CACvF;SACE,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;SACvB,GAAG,CAAC,GAAG,CAAC,CAAC;IACZ,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAiB,EAAE,IAAY;IACtE,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/hookPostedit.d.ts

@@ -0,0 +1 @@
+export declare function runHookPostedit(): number;