@agentvibes/guardrails 0.1.0

package/dist/textGrep.js

@@ -0,0 +1,52 @@
+import { readFileSync } from "node:fs";
+import { collectFiles } from "./fileWalk.js";
+// Ported from defensive-errors scan.sh — patterns that don't express cleanly
+// in ast-grep. Warning tier always: text greps never block a gate.
+const TEXT_RULES = [
+    {
+        id: "ts-suppression",
+        pattern: /@ts-nocheck|@ts-ignore|@ts-expect-error/,
+        exts: [".ts", ".tsx"],
+        excludePath: /__tests__/,
+        message: "TypeScript suppression comment hides a real type error. Fix the type at the source instead.",
+    },
+    {
+        id: "jsx-cond-and-textgrep",
+        pattern: /\{[A-Za-z_!][A-Za-z0-9_.!?]* && </,
+        exts: [".tsx", ".jsx"],
+        excludePath: /__tests__|\/ai-elements\//,
+        message: "JSX `{cond && <...>}` silently drops the !cond branch. Use match(cond).with(true, ...).with(false, () => null).exhaustive() so both arms are visible.",
+    },
+];
+export function textGrepFindings(targets) {
+    const findings = [];
+    for (const rule of TEXT_RULES) {
+        for (const file of collectFiles(targets, rule.exts)) {
+            if (rule.excludePath.test(file))
+                continue;
+            let text;
+            try {
+                text = readFileSync(file, "utf8");
+            }
+            catch {
+                continue;
+            }
+            const lines = text.split("\n");
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                if (line !== undefined && rule.pattern.test(line)) {
+                    findings.push({
+                        rule: rule.id,
+                        severity: "warning",
+                        file,
+                        line: i + 1,
+                        message: rule.message,
+                        source: "text-grep",
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=textGrep.js.map

package/dist/textGrep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"textGrep.js","sourceRoot":"","sources":["../src/textGrep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAW7C,6EAA6E;AAC7E,mEAAmE;AACnE,MAAM,UAAU,GAAe;IAC7B;QACE,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,yCAAyC;QAClD,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,WAAW;QACxB,OAAO,EACL,6FAA6F;KAChG;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,OAAO,EAAE,mCAAmC;QAC5C,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,2BAA2B;QACxC,OAAO,EACL,uJAAuJ;KAC1J;CACF,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,OAAiB;IAChD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1C,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClD,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,IAAI,CAAC,EAAE;wBACb,QAAQ,EAAE,SAAS;wBACnB,IAAI;wBACJ,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,MAAM,EAAE,WAAW;qBACpB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/tomlTable.d.ts

@@ -0,0 +1,2 @@
+/** Raw key = "value" pairs of one TOML table; enough for [deploy]/[leaks] lookup. */
+export declare function readTomlTable(path: string, table: string): Record<string, string>;

package/dist/tomlTable.js

@@ -0,0 +1,26 @@
+import { existsSync, readFileSync } from "node:fs";
+/** Raw key = "value" pairs of one TOML table; enough for [deploy]/[leaks] lookup. */
+export function readTomlTable(path, table) {
+    if (!existsSync(path))
+        return {};
+    const out = {};
+    let inTable = false;
+    for (const raw of readFileSync(path, "utf8").split("\n")) {
+        const line = raw.trim();
+        if (line.startsWith("[")) {
+            inTable = line === `[${table}]`;
+            continue;
+        }
+        if (!inTable || line === "" || line.startsWith("#"))
+            continue;
+        // bare or quoted key ('zod-optional-nullable' is a valid bare key, but
+        // quoted spellings must read identically)
+        const m = line.match(/^(?:"([^"]+)"|([A-Za-z0-9_-]+))\s*=\s*"([^"]*)"/);
+        const key = m?.[1] ?? m?.[2];
+        const value = m?.[3];
+        if (key !== undefined && value !== undefined)
+            out[key] = value;
+    }
+    return out;
+}
+//# sourceMappingURL=tomlTable.js.map

package/dist/tomlTable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tomlTable.js","sourceRoot":"","sources":["../src/tomlTable.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAa;IACvD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,GAAG,IAAI,KAAK,IAAI,KAAK,GAAG,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9D,uEAAuE;QACvE,0CAA0C;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/toolResolve.d.ts

@@ -0,0 +1,18 @@
+export interface ResolvedTool {
+    /** argv prefix to run the tool, e.g. ["ast-grep"] or ["mise", "x", "ast-grep@0.45.2", "--", "ast-grep"]. */
+    argv: string[];
+    via: "path" | "mise";
+    version: string;
+}
+export declare class ToolMissingError extends Error {
+    constructor(tool: string, hint: string);
+}
+/** Version pins live in mise.toml only — one source of truth for CLI, CI, and hosts. */
+export declare function pinnedVersion(tool: string): string | undefined;
+/**
+ * PATH first, `mise x <tool>@<pin>` as the fallback, one-line install hint as
+ * the failure — the opt-hook.sh philosophy: never hard-require a specific
+ * install route, never silently continue without the tool either.
+ */
+export declare function resolveTool(tool: string): ResolvedTool;
+export declare function tryResolveTool(tool: string): ResolvedTool | undefined;

package/dist/toolResolve.js

@@ -0,0 +1,50 @@
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { miseToml } from "./packagePaths.js";
+export class ToolMissingError extends Error {
+    constructor(tool, hint) {
+        super(`${tool} not found on PATH and mise is unavailable. Install it: ${hint}`);
+        this.name = "ToolMissingError";
+    }
+}
+/** Version pins live in mise.toml only — one source of truth for CLI, CI, and hosts. */
+export function pinnedVersion(tool) {
+    const text = readFileSync(miseToml, "utf8");
+    const m = text.match(new RegExp(`^${tool.replace(/[-]/g, "\\-")}\\s*=\\s*"([^"]+)"`, "m"));
+    return m?.[1];
+}
+function probe(argv) {
+    const [cmd, ...args] = argv;
+    if (cmd === undefined)
+        return undefined;
+    const res = spawnSync(cmd, [...args, "--version"], { encoding: "utf8" });
+    if (res.status !== 0 || res.error)
+        return undefined;
+    return res.stdout.trim().split("\n")[0];
+}
+/**
+ * PATH first, `mise x <tool>@<pin>` as the fallback, one-line install hint as
+ * the failure — the opt-hook.sh philosophy: never hard-require a specific
+ * install route, never silently continue without the tool either.
+ */
+export function resolveTool(tool) {
+    const direct = probe([tool]);
+    if (direct !== undefined)
+        return { argv: [tool], via: "path", version: direct };
+    const pin = pinnedVersion(tool);
+    const spec = pin === undefined ? tool : `${tool}@${pin}`;
+    const viaMise = probe(["mise", "x", spec, "--", tool]);
+    if (viaMise !== undefined) {
+        return { argv: ["mise", "x", spec, "--", tool], via: "mise", version: viaMise };
+    }
+    throw new ToolMissingError(tool, `mise use -g ${tool}@${pin ?? "latest"}`);
+}
+export function tryResolveTool(tool) {
+    try {
+        return resolveTool(tool);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=toolResolve.js.map

package/dist/toolResolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolResolve.js","sourceRoot":"","sources":["../src/toolResolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAS7C,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,IAAY,EAAE,IAAY;QACpC,KAAK,CAAC,GAAG,IAAI,2DAA2D,IAAI,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,wFAAwF;AACxF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3F,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,IAAc;IAC3B,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAEhF,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,IAAI,gBAAgB,CAAC,IAAI,EAAE,eAAe,IAAI,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/verify.d.ts

@@ -0,0 +1,3 @@
+import { type Finding } from "./findings.js";
+export declare function collectVerifyFindings(targets: string[], severityArgs?: string[]): Finding[];
+export declare function runVerify(targets: string[], json: boolean): number;

package/dist/verify.js

@@ -0,0 +1,49 @@
+import { scanFindings } from "./astGrep.js";
+import { formatFinding, hasErrors } from "./findings.js";
+import { rulesConfig } from "./packagePaths.js";
+import { dropScreenExempt, ScreenScopeError, screenExemptRuleIds, screensPattern, } from "./screenScope.js";
+import { SeverityConfigError, severityRaiseArgs } from "./severity.js";
+import { structureFindings } from "./structure.js";
+import { textGrepFindings } from "./textGrep.js";
+export function collectVerifyFindings(targets, severityArgs = []) {
+    const findings = [
+        ...scanFindings(rulesConfig, targets, severityArgs),
+        ...textGrepFindings(targets),
+        ...structureFindings(targets),
+    ];
+    // Applied HERE rather than in `runVerify`, so verify-diff and the hooks get
+    // the same scoping: a screen that is legal under `verify` must not be gated
+    // by `verify-diff` on the same line.
+    return dropScreenExempt(findings, screensPattern(process.cwd()), screenExemptRuleIds());
+}
+export function runVerify(targets, json) {
+    const paths = targets.length > 0 ? targets : ["."];
+    // Both manifest sections are resolved here so a config the gate cannot honour
+    // exits 2 with the reason — never a stack trace, and never silently dropped.
+    let findings;
+    try {
+        findings = collectVerifyFindings(paths, severityRaiseArgs(process.cwd()));
+    }
+    catch (err) {
+        if (err instanceof SeverityConfigError || err instanceof ScreenScopeError) {
+            console.error(`guardrails verify: ${err.message}`);
+            return 2;
+        }
+        throw err;
+    }
+    const errors = findings.filter((f) => f.severity === "error").length;
+    const warnings = findings.filter((f) => f.severity === "warning").length;
+    if (json) {
+        console.log(JSON.stringify({ command: "verify", targets: paths, errors, warnings, findings }, null, 2));
+    }
+    else {
+        for (const f of findings)
+            console.log(formatFinding(f));
+        console.log(`guardrails verify: ${errors} error(s), ${warnings} warning(s) in ${paths.join(" ")}`);
+        if (errors > 0) {
+            console.log("Fix these, or suppress a genuine false positive with a justified comment on the line above:\n  // ast-grep-ignore: <rule-id> -- <why this is legitimate>");
+        }
+    }
+    return hasErrors(findings) ? 1 : 0;
+}
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAgB,aAAa,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,UAAU,qBAAqB,CAAC,OAAiB,EAAE,eAAyB,EAAE;IAClF,MAAM,QAAQ,GAAG;QACf,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,EAAE,YAAY,CAAC;QACnD,GAAG,gBAAgB,CAAC,OAAO,CAAC;QAC5B,GAAG,iBAAiB,CAAC,OAAO,CAAC;KAC9B,CAAC;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,qCAAqC;IACrC,OAAO,gBAAgB,CAAC,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAiB,EAAE,IAAa;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnD,8EAA8E;IAC9E,6EAA6E;IAC7E,IAAI,QAAmB,CAAC;IACxB,IAAI,CAAC;QACH,QAAQ,GAAG,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;YAC1E,OAAO,CAAC,KAAK,CAAC,sBAAsB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACrE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAEzE,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAC3F,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CACT,sBAAsB,MAAM,cAAc,QAAQ,kBAAkB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACtF,CAAC;QACF,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CACT,0JAA0J,CAC3J,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC"}

package/dist/verifyDiff.d.ts

@@ -0,0 +1,18 @@
+import { type Finding } from "./findings.js";
+/**
+ * `[verify] exclude = "<regex>"` in .agentvibes/project.toml — a VENDORED-tree
+ * carve-out, ported from merkle's check-diff.sh: a verbatim copy of somebody
+ * else's package must not be held to this repo's rules (editing it to satisfy
+ * them would turn the next upstream re-sync into a merge conflict and falsify
+ * the byte-identical provenance that is the reason to vendor). The regex tests
+ * the file path relative to the repo root.
+ */
+export declare function verifyExcludeRe(cwd: string): RegExp | undefined;
+export interface VerifyDiffResult {
+    rungLabel: string;
+    filesScanned: number;
+    violations: Finding[];
+}
+/** The verify-diff computation without reporting — shared by the CLI command and hook-stop. */
+export declare function runVerifyDiffCollect(cwd: string, base: string | undefined): VerifyDiffResult;
+export declare function runVerifyDiff(base: string | undefined, json: boolean): number;

package/dist/verifyDiff.js

@@ -0,0 +1,126 @@
+import { join, relative } from "node:path";
+import { match } from "ts-pattern";
+import { scanFindings } from "./astGrep.js";
+import { formatFinding } from "./findings.js";
+import { addedLines, changedFiles, gitRoot, resolveMergeBase } from "./gitDiff.js";
+import { rulesConfig } from "./packagePaths.js";
+import { SeverityConfigError, severityRaiseArgs } from "./severity.js";
+import { structureFindings } from "./structure.js";
+import { readTomlTable } from "./tomlTable.js";
+/**
+ * `[verify] exclude = "<regex>"` in .agentvibes/project.toml — a VENDORED-tree
+ * carve-out, ported from merkle's check-diff.sh: a verbatim copy of somebody
+ * else's package must not be held to this repo's rules (editing it to satisfy
+ * them would turn the next upstream re-sync into a merge conflict and falsify
+ * the byte-identical provenance that is the reason to vendor). The regex tests
+ * the file path relative to the repo root.
+ */
+export function verifyExcludeRe(cwd) {
+    const raw = readTomlTable(join(cwd, ".agentvibes", "project.toml"), "verify").exclude;
+    if (raw === undefined || raw === "")
+        return undefined;
+    return new RegExp(raw);
+}
+function resolveRung(cwd, base) {
+    const root = gitRoot(cwd);
+    if (root === undefined)
+        return { kind: "whole-tree" };
+    const mb = resolveMergeBase(root, base);
+    if (mb === undefined)
+        return { kind: "whole-file", root };
+    return { kind: "added-lines", root, mergeBase: mb };
+}
+function planFor(rung) {
+    return match(rung)
+        .with({ kind: "whole-tree" }, () => ({
+        rungLabel: "whole-tree (not a git repository — nothing to diff against, gating everything)",
+        files: undefined,
+        keep: () => true,
+    }))
+        .with({ kind: "whole-file" }, ({ root }) => {
+        const { tracked, untracked } = changedFiles(root, "HEAD");
+        return {
+            rungLabel: "whole-file (no resolvable base ref — gating every line of changed/untracked files)",
+            files: [...new Set([...tracked, ...untracked])],
+            keep: () => true,
+        };
+    })
+        .with({ kind: "added-lines" }, ({ root, mergeBase }) => {
+        const { tracked, untracked } = changedFiles(root, mergeBase);
+        const untrackedSet = new Set(untracked);
+        const addedByFile = new Map();
+        return {
+            rungLabel: `added-lines vs merge-base ${mergeBase.slice(0, 12)}`,
+            files: [...new Set([...tracked, ...untracked])],
+            keep: (f) => {
+                if (untrackedSet.has(f.file))
+                    return true;
+                let added = addedByFile.get(f.file);
+                if (added === undefined) {
+                    added = addedLines(root, mergeBase, f.file);
+                    addedByFile.set(f.file, added);
+                }
+                return added.has(f.line);
+            },
+        };
+    })
+        .exhaustive();
+}
+/** The verify-diff computation without reporting — shared by the CLI command and hook-stop. */
+export function runVerifyDiffCollect(cwd, base) {
+    const severityArgs = severityRaiseArgs(cwd);
+    const plan = planFor(resolveRung(cwd, base));
+    const exclude = verifyExcludeRe(cwd);
+    if (exclude !== undefined && plan.files !== undefined) {
+        // changedFiles yields absolute paths; the exclude regex (donor precedent:
+        // '^packages/site-chrome/') is written against repo-root-relative ones.
+        plan.files = plan.files.filter((f) => !exclude.test(relative(cwd, f)));
+    }
+    if (plan.files !== undefined && plan.files.length === 0) {
+        return { rungLabel: plan.rungLabel, filesScanned: 0, violations: [] };
+    }
+    const targets = plan.files ?? ["."];
+    const violations = [
+        ...scanFindings(rulesConfig, targets, severityArgs),
+        ...structureFindings(targets),
+    ]
+        .filter((f) => f.severity === "error")
+        .filter(plan.keep);
+    return { rungLabel: plan.rungLabel, filesScanned: plan.files?.length ?? -1, violations };
+}
+export function runVerifyDiff(base, json) {
+    let result;
+    try {
+        result = runVerifyDiffCollect(process.cwd(), base);
+    }
+    catch (err) {
+        if (err instanceof SeverityConfigError) {
+            console.error(`guardrails verify-diff: ${err.message}`);
+            return 2;
+        }
+        throw err;
+    }
+    const { rungLabel, filesScanned, violations: gated } = result;
+    if (filesScanned === 0) {
+        report(json, rungLabel, 0, [], "no changed .ts/.tsx files — nothing to gate");
+        return 0;
+    }
+    report(json, rungLabel, filesScanned, gated, gated.length === 0
+        ? "OK — no new error-tier findings"
+        : `${gated.length} new ERROR-tier finding(s)`);
+    return gated.length === 0 ? 0 : 1;
+}
+function report(json, rung, files, gated, summary) {
+    if (json) {
+        console.log(JSON.stringify({ command: "verify-diff", rung, filesScanned: files, violations: gated, summary }, null, 2));
+        return;
+    }
+    console.log(`guardrails verify-diff — ${rung}`);
+    for (const f of gated)
+        console.log(formatFinding(f));
+    console.log(`guardrails verify-diff: ${summary}`);
+    if (gated.length > 0) {
+        console.log("Fix these, or suppress a genuine false positive with a justified comment on the line above:\n  // ast-grep-ignore: <rule-id> -- <why this is legitimate>");
+    }
+}
+//# sourceMappingURL=verifyDiff.js.map

package/dist/verifyDiff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyDiff.js","sourceRoot":"","sources":["../src/verifyDiff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAgB,aAAa,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AA6B/C;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,cAAc,CAAC,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC;IACtF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACtD,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,IAAwB;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACtD,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,OAAO,CAAC,IAAU;IACzB,OAAO,KAAK,CAAC,IAAI,CAAC;SACf,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACnC,SAAS,EAAE,gFAAgF;QAC3F,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI;KACjB,CAAC,CAAC;SACF,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;QACzC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO;YACL,SAAS,EACP,oFAAoF;YACtF,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;YAC/C,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI;SACjB,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;QACrD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;QACnD,OAAO;YACL,SAAS,EAAE,6BAA6B,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YAChE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC,CAAU,EAAE,EAAE;gBACnB,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC1C,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;oBAC5C,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACjC,CAAC;gBACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;SACD,UAAU,EAAE,CAAC;AAClB,CAAC;AAQD,+FAA+F;AAC/F,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,IAAwB;IACxE,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACtD,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG;QACjB,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,EAAE,YAAY,CAAC;QACnD,GAAG,iBAAiB,CAAC,OAAO,CAAC;KAC9B;SACE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;SACrC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAwB,EAAE,IAAa;IACnE,IAAI,MAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CAAC,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAC9D,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,6CAA6C,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CACJ,IAAI,EACJ,SAAS,EACT,YAAY,EACZ,KAAK,EACL,KAAK,CAAC,MAAM,KAAK,CAAC;QAChB,CAAC,CAAC,iCAAiC;QACnC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,4BAA4B,CAChD,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,MAAM,CACb,IAAa,EACb,IAAY,EACZ,KAAa,EACb,KAAgB,EAChB,OAAe;IAEf,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EACjF,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CACT,0JAA0J,CAC3J,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/workspaces.d.ts

@@ -0,0 +1,6 @@
+export interface WorkspacePackage {
+    name: string;
+    dir: string;
+    deps: Record<string, string>;
+}
+export declare function listWorkspacePackages(cwd: string): WorkspacePackage[];

package/dist/workspaces.js

@@ -0,0 +1,84 @@
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { basename, join } from "node:path";
+function workspaceGlobs(cwd) {
+    const pnpmPath = join(cwd, "pnpm-workspace.yaml");
+    if (existsSync(pnpmPath)) {
+        const globs = [];
+        let inPackages = false;
+        for (const raw of readFileSync(pnpmPath, "utf8").split("\n")) {
+            const line = raw.replace(/#.*$/, "").trimEnd();
+            if (/^packages:\s*$/.test(line)) {
+                inPackages = true;
+                continue;
+            }
+            if (inPackages) {
+                const m = line.match(/^\s+-\s+["']?([^"']+)["']?\s*$/);
+                if (m?.[1] !== undefined)
+                    globs.push(m[1]);
+                else if (!/^\s/.test(line) && line !== "")
+                    inPackages = false;
+            }
+        }
+        if (globs.length > 0)
+            return globs;
+    }
+    const pkgPath = join(cwd, "package.json");
+    // ast-grep-ignore: silent-default-return -- no package.json means no workspaces to enumerate; the caller falls back to root-only detection
+    if (!existsSync(pkgPath))
+        return [];
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+    if (Array.isArray(pkg.workspaces))
+        return pkg.workspaces;
+    return pkg.workspaces?.packages ?? [];
+}
+/** Expand a workspace glob. Supports literal dirs and a trailing `*` segment (`packages/*`). */
+function expandGlob(cwd, glob) {
+    const clean = glob.replace(/\/$/, "");
+    if (clean.startsWith("!"))
+        return [];
+    if (!clean.includes("*"))
+        return [join(cwd, clean)];
+    const starAt = clean.indexOf("*");
+    const parent = join(cwd, clean.slice(0, starAt).replace(/\/$/, ""));
+    let entries;
+    try {
+        entries = readdirSync(parent);
+    }
+    catch {
+        return [];
+    }
+    return entries
+        .map((e) => join(parent, e))
+        .filter((p) => {
+        try {
+            return statSync(p).isDirectory();
+        }
+        catch {
+            return false;
+        }
+    });
+}
+export function listWorkspacePackages(cwd) {
+    const out = [];
+    for (const glob of workspaceGlobs(cwd)) {
+        for (const dir of expandGlob(cwd, glob)) {
+            const pkgPath = join(dir, "package.json");
+            if (!existsSync(pkgPath))
+                continue;
+            let pkg;
+            try {
+                pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+            }
+            catch {
+                continue;
+            }
+            out.push({
+                name: pkg.name ?? basename(dir),
+                dir,
+                deps: { ...pkg.dependencies, ...pkg.devDependencies },
+            });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=workspaces.js.map

package/dist/workspaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaces.js","sourceRoot":"","sources":["../src/workspaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAe3C,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC/C,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,UAAU,GAAG,IAAI,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBACvD,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;qBACtC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE;oBAAE,UAAU,GAAG,KAAK,CAAC;YAChE,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACrC,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,2IAA2I;IAC3I,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAEnD,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC;IACzD,OAAO,GAAG,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,gGAAgG;AAChG,SAAS,UAAU,CAAC,GAAW,EAAE,IAAY;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IACpE,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAC1C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,SAAS;YACnC,IAAI,GAIH,CAAC;YACF,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAe,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC;gBAC/B,GAAG;gBACH,IAAI,EAAE,EAAE,GAAG,GAAG,CAAC,YAAY,EAAE,GAAG,GAAG,CAAC,eAAe,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/mise.toml

@@ -0,0 +1,9 @@
+# Pinned toolchain for @agentvibes/guardrails. The CLI resolves ast-grep and
+# biome from PATH first and falls back to `mise x <tool>@<pin>` using these
+# pins, so every host (and CI via jdx/mise-action) runs the same versions.
+[tools]
+node = "25.9.0"
+pnpm = "10.12.1"
+ast-grep = "0.45.2"
+biome = "2.5.10"
+gitleaks = "8.30.1"

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@agentvibes/guardrails",
+  "version": "0.1.0",
+  "description": "Verification toolkit that makes agents write simple code: ast-grep rule canon, diff ratchet, biome/tsconfig presets, one CLI.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AgentVibes/guardrails.git"
+  },
+  "type": "module",
+  "bin": {
+    "guardrails": "dist/cli.js"
+  },
+  "exports": {
+    "./biome": "./configs/biome.json",
+    "./tsconfig": "./configs/tsconfig.base.json",
+    "./sgconfig": "./sgconfig.yml",
+    "./package.json": "./package.json",
+    "./plugin": "./dist/pluginApi.js"
+  },
+  "files": [
+    "dist",
+    "rules",
+    "structure",
+    "candidates",
+    "configs",
+    "sgconfig.yml",
+    "mise.toml"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepare": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "lint": "biome check .",
+    "format": "biome check --write .",
+    "test:rules": "node dist/testRules.js",
+    "test:gate": "node dist/gateRed.js",
+    "check": "pnpm build && pnpm lint && pnpm test:rules && pnpm test:gate && pnpm test:metrics && pnpm test:init && pnpm test:severity && pnpm test:screens && pnpm test:hooks && pnpm test:iterate && pnpm test:leaks && pnpm leaks",
+    "test:metrics": "node dist/metricsCycle.js",
+    "leaks": "node dist/cli.js leaks .",
+    "test:leaks": "node dist/leaksRed.js",
+    "test:init": "node dist/initTest.js",
+    "test:severity": "node dist/severityTest.js",
+    "test:hooks": "node dist/hookStopTest.js",
+    "test:iterate": "node dist/iterateTest.js",
+    "test:screens": "node dist/screenScopeTest.js"
+  },
+  "dependencies": {
+    "ts-pattern": "^5.6.2",
+    "typescript": "^5.7.3"
+  },
+  "devDependencies": {
+    "@types/node": "^22.13.0"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "packageManager": "pnpm@10.12.1",
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/rules/__fixtures__/as-any-escape/bad.ts

@@ -0,0 +1,8 @@
+// Every cast here MUST be reported by `as-any-escape`.
+export const a = payload as any
+export const b = payload as unknown as User
+// ADDED BY THE WAVE-2 UPGRADE: a surface `pattern:` is compared at `smart`
+// strictness, which also compares interleaved comment nodes, so this slipped
+// straight through the old body.
+export const c = payload as /* legacy shim */ any
+export const d = payload as /* boundary */ unknown as User

package/rules/__fixtures__/as-any-escape/good.ts

@@ -0,0 +1,14 @@
+// NOTHING in this file may be reported by `as-any-escape`.
+import { UserSchema } from "./schema"
+
+// The fix: validate at the boundary.
+export const a = UserSchema.parse(payload)
+
+// Widening to `unknown` alone is fine — it FORCES the caller to narrow, which
+// is the behaviour we want. Only the double-cast that lands back on a concrete
+// type is an escape hatch.
+export const b = payload as unknown
+
+// Ordinary, checked casts.
+export const c = "idle" as const
+export const d = value as never

package/rules/__fixtures__/catch-empty/bad.ts

@@ -0,0 +1,7 @@
+// Every catch here MUST be reported by `catch-empty`.
+export function a() { try { work() } catch { } }
+export function b() { try { work() } catch (e) { } }
+// ADDED BY THE WAVE-2 UPGRADE: the type annotation is an extra named node, so
+// the old `catch ($_) { }` pattern did not cover either of these.
+export function c() { try { work() } catch (e: unknown) { } }
+export function d() { try { work() } catch (e: any) { } }

package/rules/__fixtures__/catch-empty/good.ts

@@ -0,0 +1,14 @@
+// NOTHING in this file may be reported by `catch-empty`.
+export function a() {
+  try { work() } catch (e) { logger.error("work failed", e); throw e }
+}
+export function b(): Result {
+  try { return { status: "ok", value: work() } }
+  catch (e: unknown) { return { status: "error", message: String(e) } }
+}
+// A catch that deliberately does nothing must SAY so — the comment is the
+// difference between a decision and an oversight, and ast-grep-ignore records it.
+export function c() {
+  // ast-grep-ignore: catch-empty -- idempotent mkdir, "already exists" is expected
+  try { mkdir(p) } catch (e) { }
+}

package/rules/__fixtures__/direct-store-import/bad.tsx

@@ -0,0 +1,23 @@
+// Every import in this file MUST be reported by `direct-store-import`.
+
+// A store CLASS pulled into a component file — the component now constructs or
+// type-switches on the implementation instead of receiving a model.
+import { GalleryStore } from "../../stores/galleryStore"
+
+// A slice-store singleton. `rootStore` at a screen is legal (decision D1);
+// reaching past it for one slice is not.
+import { galleryStore } from "../../stores/galleryStore"
+
+// Same, from a barrel.
+import { authStore } from "../../stores"
+
+// Aliased — the local binding is what the file actually uses.
+import { galleryStore as gallery } from "../../store/gallery"
+
+// Default-exported store instance.
+import photoStore from "../../stores/photoStore"
+
+// Mixed: `rootStore` alone would be fine, the slice next to it is not.
+import { rootStore, uiStore } from "../../stores/rootStore"
+
+export const X = () => <div>{GalleryStore.name}{galleryStore.count}{authStore.id}{gallery.n}{photoStore.n}{rootStore.n}{uiStore.tab}</div>