@alex-dbs/coderuler 1.4.0 → 1.5.0

package/dist/adapter/git/changes.js

@@ -1,23 +1,310 @@
 import { spawn } from 'node:child_process';
+import { createReadStream } from 'node:fs';
+import { lstat } from 'node:fs/promises';
+import { join } from 'node:path';
 import { traversablePath } from '../filesystem/project.js';
-async function git(root, args, consume, env) {
-    await new Promise((resolve, reject) => {
-        const child = spawn('git', [...args], { cwd: root, env, stdio: ['ignore', 'pipe', 'pipe'] });
-        let stderr = '';
-        child.stdout.setEncoding('utf8');
-        child.stderr.setEncoding('utf8');
-        child.stdout.on('data', consume);
-        child.stderr.on('data', (chunk) => { stderr += chunk; });
-        child.on('error', error => reject(new Error(`Cannot run Git: ${error.message}`, { cause: error })));
-        child.on('close', (code, signal) => {
-            if (code === 0)
-                resolve();
-            else
-                reject(new Error(`Git ${args[0]} failed: ${stderr.trim() || signal || `exit ${code}`}`));
-        });
+const INVALID_DIFF = 'Cannot collect changed lines: invalid Git diff output.';
+const CONFLICTS = 'Cannot collect changed lines: resolve Git conflicts first.';
+async function git(root, args, consume, env, stdin) {
+    const { promise, resolve, reject } = Promise.withResolvers();
+    const child = spawn('git', [...args], {
+        cwd: root,
+        env,
+        stdio: [stdin === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe'],
+    });
+    let stderr = '';
+    let parserError;
+    let stdinError;
+    let settled = false;
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (chunk) => {
+        if (parserError !== undefined)
+            return;
+        try {
+            consume(chunk);
+        }
+        catch (error) {
+            parserError = error;
+        }
+    });
+    child.stderr.on('data', (chunk) => { stderr += chunk; });
+    child.stdin?.on('error', error => { stdinError = error; });
+    child.on('error', error => {
+        if (settled)
+            return;
+        settled = true;
+        reject(new Error(`Cannot run Git: ${error.message}`, { cause: error }));
     });
+    child.on('close', (code, signal) => {
+        if (settled)
+            return;
+        settled = true;
+        if (parserError !== undefined)
+            reject(parserError);
+        else if (stdinError !== undefined)
+            reject(new Error(`Cannot write to Git stdin: ${stdinError.message}`, { cause: stdinError }));
+        else if (code === 0)
+            resolve();
+        else
+            reject(new Error(`Git ${args[0]} failed: ${stderr.trim() || signal || `exit ${code}`}`));
+    });
+    if (stdin !== undefined)
+        child.stdin.end(stdin);
+    return promise;
+}
+function invalidDiff() {
+    return new Error(INVALID_DIFF);
 }
-export async function changedFiles(root, base, env) {
+class DiffParser {
+    phase = 'metadata';
+    records = [];
+    pendingMode;
+    nulPending = '';
+    patchPending = '';
+    expectedBlocks = 0;
+    currentBlock;
+    selectedBlocks = [];
+    rawIndex = 0;
+    blockIndex = 0;
+    typeDelete = false;
+    consume(chunk) {
+        let rest = chunk;
+        if (this.phase !== 'patch') {
+            const patch = this.consumeRaw(rest);
+            if (patch === undefined)
+                return;
+            rest = patch;
+        }
+        const text = this.patchPending + rest;
+        let lineStart = 0;
+        let newline;
+        while ((newline = text.indexOf('\n', lineStart)) !== -1) {
+            this.consumePatchLine(text.slice(lineStart, newline).replace(/\r$/, ''));
+            lineStart = newline + 1;
+        }
+        this.patchPending = text.slice(lineStart);
+    }
+    finish() {
+        if (this.phase === 'metadata' && this.nulPending !== '' || this.phase === 'path')
+            throw invalidDiff();
+        if (this.phase === 'metadata' && this.records.length === 0 && this.nulPending === '')
+            return [];
+        if (this.phase !== 'patch')
+            throw invalidDiff();
+        if (this.patchPending !== '') {
+            this.consumePatchLine(this.patchPending.replace(/\r$/, ''));
+            this.patchPending = '';
+        }
+        this.finishBlock();
+        if (this.blockIndex !== this.expectedBlocks) {
+            throw invalidDiff();
+        }
+        if (this.rawIndex !== this.records.length || this.typeDelete)
+            throw invalidDiff();
+        return this.selectedBlocks;
+    }
+    get rawRecords() { return this.records; }
+    consumeRaw(chunk) {
+        this.nulPending += chunk;
+        let nul;
+        while ((nul = this.nulPending.indexOf('\0')) !== -1) {
+            const value = this.nulPending.slice(0, nul);
+            this.nulPending = this.nulPending.slice(nul + 1);
+            if (this.phase === 'metadata') {
+                if (value === '') {
+                    this.expectedBlocks = this.records.reduce((count, record) => count + (record.status === 'T' ? 2 : 1), 0);
+                    this.phase = 'patch';
+                    const patch = this.nulPending;
+                    this.nulPending = '';
+                    return patch;
+                }
+                const match = /^:([0-7]{6}) ([0-7]{6}) ([0-9a-f]+) ([0-9a-f]+) ([A-Z])(?:[0-9]+)?$/.exec(value);
+                if (match === null)
+                    throw invalidDiff();
+                this.pendingMode = { oldMode: match[1], newMode: match[2], status: match[5] };
+                this.phase = 'path';
+            }
+            else if (this.phase === 'path') {
+                if (value === '' || this.pendingMode === undefined)
+                    throw invalidDiff();
+                this.records.push({ ...this.pendingMode, path: value });
+                this.pendingMode = undefined;
+                this.phase = 'metadata';
+            }
+            else
+                throw invalidDiff();
+        }
+        return undefined;
+    }
+    consumePatchLine(line) {
+        if (line.startsWith('diff --git ')) {
+            this.finishBlock();
+            if (this.blockIndex >= this.expectedBlocks)
+                throw invalidDiff();
+            this.currentBlock = { ranges: [], binary: false, hunk: undefined };
+            return;
+        }
+        if (this.currentBlock === undefined) {
+            if (line !== '')
+                throw invalidDiff();
+            return;
+        }
+        if (line.startsWith('Binary files ') && line.endsWith(' differ') || line === 'GIT binary patch') {
+            this.currentBlock.binary = true;
+            return;
+        }
+        const hunk = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(?:.*)$/.exec(line);
+        if (hunk === null && line.startsWith('@@'))
+            throw invalidDiff();
+        if (hunk !== null) {
+            const newStart = Number(hunk[3]);
+            const newCount = hunk[4] === undefined ? 1 : Number(hunk[4]);
+            this.currentBlock.hunk = {
+                oldExpected: hunk[2] === undefined ? 1 : Number(hunk[2]),
+                newExpected: newCount,
+                oldSeen: 0,
+                newSeen: 0,
+            };
+            if (newCount > 0) {
+                const range = { start: newStart, end: newStart + newCount - 1 };
+                const previous = this.currentBlock.ranges.at(-1);
+                if (previous !== undefined && range.start <= previous.end + 1) {
+                    this.currentBlock.ranges[this.currentBlock.ranges.length - 1] = {
+                        start: previous.start,
+                        end: Math.max(previous.end, range.end),
+                    };
+                }
+                else
+                    this.currentBlock.ranges.push(range);
+            }
+            this.finishHunkIfComplete();
+            return;
+        }
+        if (line.startsWith('\'))
+            return;
+        const active = this.currentBlock.hunk;
+        if (active !== undefined) {
+            const marker = line[0];
+            if (marker === ' ') {
+                active.oldSeen++;
+                active.newSeen++;
+            }
+            else if (marker === '+')
+                active.newSeen++;
+            else if (marker === '-')
+                active.oldSeen++;
+            else
+                throw invalidDiff();
+            if (active.oldSeen > active.oldExpected || active.newSeen > active.newExpected)
+                throw invalidDiff();
+            this.finishHunkIfComplete();
+        }
+    }
+    finishHunk() {
+        const hunk = this.currentBlock?.hunk;
+        if (hunk !== undefined && (hunk.oldSeen !== hunk.oldExpected || hunk.newSeen !== hunk.newExpected)) {
+            throw invalidDiff();
+        }
+        if (this.currentBlock !== undefined)
+            this.currentBlock.hunk = undefined;
+    }
+    finishHunkIfComplete() {
+        const hunk = this.currentBlock?.hunk;
+        if (hunk !== undefined && hunk.oldSeen === hunk.oldExpected && hunk.newSeen === hunk.newExpected) {
+            this.currentBlock.hunk = undefined;
+        }
+    }
+    finishBlock() {
+        if (this.currentBlock === undefined)
+            return;
+        this.finishHunk();
+        const record = this.records[this.rawIndex];
+        if (record === undefined)
+            throw invalidDiff();
+        if (record.status === 'T') {
+            if (this.typeDelete) {
+                this.selectedBlocks.push(this.currentBlock);
+                this.typeDelete = false;
+                this.rawIndex++;
+            }
+            else
+                this.typeDelete = true;
+        }
+        else {
+            this.selectedBlocks.push(this.currentBlock);
+            this.rawIndex++;
+        }
+        this.blockIndex++;
+        this.currentBlock = undefined;
+    }
+}
+async function collectNulPaths(root, args, env) {
+    let pending = '';
+    const paths = [];
+    await git(root, args, chunk => {
+        const records = (pending + chunk).split('\0');
+        pending = records.pop();
+        for (const path of records)
+            if (path !== '')
+                paths.push(path);
+    }, env);
+    if (pending !== '')
+        throw invalidDiff();
+    return paths;
+}
+async function readAttributes(root, paths, env) {
+    const attributed = new Map();
+    if (paths.length === 0)
+        return attributed;
+    let pending = '';
+    const fields = [];
+    await git(root, ['check-attr', '-z', '--stdin', 'filter', 'working-tree-encoding'], chunk => {
+        const records = (pending + chunk).split('\0');
+        pending = records.pop();
+        fields.push(...records);
+    }, env, `${paths.join('\0')}\0`);
+    if (pending !== '' || fields.length % 3 !== 0)
+        throw invalidDiff();
+    for (let index = 0; index < fields.length; index += 3) {
+        const path = fields[index];
+        const attribute = fields[index + 1];
+        const value = fields[index + 2];
+        if (attribute !== 'filter' && attribute !== 'working-tree-encoding')
+            throw invalidDiff();
+        if (value !== 'unspecified' && value !== 'unset')
+            attributed.set(path, true);
+    }
+    return attributed;
+}
+async function untrackedLines(absolute) {
+    const stats = await lstat(absolute);
+    if (!stats.isFile())
+        return undefined;
+    let prefixBytes = 0;
+    let binary = false;
+    let byteCount = 0;
+    let lfCount = 0;
+    let lastByte = -1;
+    for await (const chunk of createReadStream(absolute)) {
+        const bytes = chunk;
+        const inspectCount = Math.min(bytes.length, Math.max(0, 8000 - prefixBytes));
+        if (!binary && bytes.subarray(0, inspectCount).includes(0))
+            binary = true;
+        prefixBytes += inspectCount;
+        byteCount += bytes.length;
+        for (const byte of bytes)
+            if (byte === 0x0a)
+                lfCount++;
+        if (bytes.length > 0)
+            lastByte = bytes[bytes.length - 1];
+    }
+    if (binary)
+        return undefined;
+    const lineCount = byteCount === 0 ? 0 : lfCount + (lastByte === 0x0a ? 0 : 1);
+    return lineCount === 0 ? [] : [{ start: 1, end: lineCount }];
+}
+export async function collectChanges(root, base, env) {
     let tree = '';
     try {
         await git(root, ['rev-parse', '--verify', '--end-of-options', `${base}^{tree}`], chunk => {
@@ -29,26 +316,73 @@ export async function changedFiles(root, base, env) {
             cause: error,
         });
     }
-    const paths = new Set();
-    const collectPaths = async (args) => {
-        let pending = '';
-        await git(root, args, chunk => {
-            const records = (pending + chunk).split('\0');
-            pending = records.pop();
-            for (const path of records)
-                paths.add(path);
-        }, env);
-    };
-    await collectPaths([
-        'diff', '--relative', '--name-only', '-z', '--no-renames', '--no-ext-diff', '--no-textconv',
+    let conflicts = false;
+    await git(root, ['ls-files', '--unmerged', '-z', '--', '.'], () => { conflicts = true; }, env);
+    if (conflicts)
+        throw new Error(CONFLICTS);
+    const inherited = env ?? process.env;
+    const diffEnv = { ...inherited };
+    delete diffEnv.GIT_DIFF_OPTS;
+    const parser = new DiffParser();
+    await git(root, [
+        'diff', '--relative', '--raw', '-z', '--patch', '--unified=0', '--inter-hunk-context=0',
+        '--no-renames', '--no-ext-diff', '--no-textconv', '--no-color', '--submodule=short', '-O/dev/null',
+        '--output-indicator-new=+', '--output-indicator-old=-', '--output-indicator-context= ',
         tree.trim(), '--', '.',
-    ]);
-    await collectPaths(['ls-files', '--others', '--exclude-standard', '-z', '--', '.']);
-    const changed = new Set();
-    for (const path of paths) {
+    ], chunk => parser.consume(chunk), diffEnv);
+    const blocks = parser.finish();
+    const records = parser.rawRecords;
+    const trackedPaths = records.filter(record => record.newMode.startsWith('100')).map(record => record.path);
+    const attributes = await readAttributes(root, trackedPaths, env);
+    const changedFiles = new Set();
+    const lineResults = new Map();
+    let selectedBlock = 0;
+    for (const record of records) {
+        const physical = await traversablePath(root, record.path);
+        const currentBlock = blocks[selectedBlock++];
+        if (physical === undefined)
+            continue;
+        changedFiles.add(physical);
+        const isCurrent = record.newMode !== '000000';
+        if (!isCurrent) {
+            if (!lineResults.has(physical))
+                lineResults.set(physical, []);
+            continue;
+        }
+        if (!record.newMode.startsWith('100')) {
+            lineResults.set(physical, undefined);
+        }
+        else if (currentBlock === undefined || currentBlock.binary) {
+            lineResults.set(physical, undefined);
+        }
+        else if (currentBlock.ranges.length === 0) {
+            lineResults.set(physical, []);
+        }
+        else if (attributes.get(record.path) === true) {
+            lineResults.set(physical, undefined);
+        }
+        else {
+            lineResults.set(physical, currentBlock.ranges);
+        }
+    }
+    const untracked = await collectNulPaths(root, ['ls-files', '--others', '--exclude-standard', '-z', '--', '.'], env);
+    for (const path of untracked) {
         const physical = await traversablePath(root, path);
-        if (physical !== undefined)
-            changed.add(physical);
+        if (physical === undefined)
+            continue;
+        const lines = await untrackedLines(join(root, ...path.split('/')));
+        changedFiles.add(physical);
+        if (lines === undefined) {
+            lineResults.set(physical, undefined);
+        }
+        else {
+            lineResults.set(physical, lines);
+        }
+    }
+    const changedLines = new Map();
+    for (const [path, ranges] of lineResults) {
+        if (ranges !== undefined)
+            changedLines.set(path, ranges);
     }
-    return changed;
+    return { changedFiles, changedLines };
 }

package/dist/adapter/git/rules.d.ts

@@ -0,0 +1,5 @@
+export interface RuleRepositoryCheckout {
+    readonly root: string;
+    cleanup(): Promise<void>;
+}
+export declare function createRuleRepositoryCheckout(env: Readonly<Record<string, string | undefined>>): (selector: string) => Promise<RuleRepositoryCheckout | undefined>;

package/dist/adapter/git/rules.js

@@ -0,0 +1,126 @@
+import { spawn } from 'node:child_process';
+import { mkdtemp, realpath, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { isolatedGitEnvironment } from './environment.js';
+const invalidRepositoryUrl = 'Invalid rule repository URL; use HTTPS or SSH with Git credentials.';
+function parseRuleRepositorySelector(selector) {
+    const schemeMatch = /^([a-z][a-z\d+.-]*):\/\//i.exec(selector);
+    const schemePrefix = /^([a-z][a-z\d+.-]*):/i.exec(selector);
+    const windowsDrivePath = /^[a-z]:[\\/]/i.test(selector);
+    const malformedUrl = schemeMatch === null
+        && schemePrefix !== null
+        && !windowsDrivePath
+        && (/^(?:https?|ssh|file|ftp|git(?:\+(?:https?|ssh))?):/i.test(selector)
+            || /^[\\/]/.test(selector.slice(schemePrefix[0].length))
+            || selector.slice(schemePrefix[0].length).includes('@'));
+    const looksLikeUrl = schemeMatch !== null || malformedUrl;
+    const looksLikeScp = /^[^/@:\s]*@[^/:\s]*:/.test(selector);
+    if (!looksLikeUrl && !looksLikeScp)
+        return undefined;
+    const separator = selector.indexOf('#');
+    const transport = separator === -1 ? selector : selector.slice(0, separator);
+    const revision = separator === -1 ? undefined : selector.slice(separator + 1);
+    if (revision === '')
+        throw new Error('Rule repository revision must not be empty.');
+    if (looksLikeUrl) {
+        if (schemeMatch === null)
+            throw new Error(invalidRepositoryUrl);
+        let url;
+        try {
+            url = new URL(transport);
+        }
+        catch {
+            throw new Error(invalidRepositoryUrl);
+        }
+        if ((url.protocol !== 'https:' && url.protocol !== 'ssh:')
+            || url.hostname === ''
+            || url.search !== ''
+            || transport.includes('?')
+            || (url.protocol === 'https:' && (url.username !== '' || url.password !== ''))
+            || (url.protocol === 'ssh:' && hasSshPassword(transport, url))) {
+            throw new Error(invalidRepositoryUrl);
+        }
+    }
+    else {
+        const match = /^([^/@:\s]+)@([^/:\s]+):(.+)$/.exec(transport);
+        if (match === null)
+            throw new Error(invalidRepositoryUrl);
+    }
+    return { transport, revision };
+}
+function hasSshPassword(transport, url) {
+    if (url.password !== '')
+        return true;
+    const authorityStart = transport.indexOf('://') + 3;
+    const authorityEnd = transport.slice(authorityStart).search(/[/?#]/);
+    const authority = authorityEnd === -1
+        ? transport.slice(authorityStart)
+        : transport.slice(authorityStart, authorityStart + authorityEnd);
+    const userInfoEnd = authority.lastIndexOf('@');
+    return userInfoEnd !== -1 && authority.slice(0, userInfoEnd).includes(':');
+}
+export function createRuleRepositoryCheckout(env) {
+    const isolatedEnv = isolatedGitEnvironment(env);
+    const runGit = (cwd, args, allowedExitCodes = [0]) => {
+        const { promise, resolve, reject } = Promise.withResolvers();
+        const child = spawn('git', [...args], {
+            cwd,
+            env: isolatedEnv,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.setEncoding('utf8');
+        child.stderr.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => { stdout += chunk; });
+        child.stderr.on('data', (chunk) => { stderr += chunk; });
+        child.on('error', error => reject(new Error(`Cannot run Git: ${error.message}`, {
+            cause: error,
+        })));
+        child.on('close', (code, signal) => {
+            if (code !== null && allowedExitCodes.includes(code))
+                resolve({ stdout, code });
+            else
+                reject(new Error(`Git ${args[0]} failed: ${stderr.trim() || signal || `exit ${code}`}`));
+        });
+        return promise;
+    };
+    return async (selector) => {
+        const parsed = parseRuleRepositorySelector(selector);
+        if (parsed === undefined)
+            return undefined;
+        const workspace = await mkdtemp(join(await realpath(tmpdir()), 'coderuler-rules-'));
+        const root = join(workspace, 'repository');
+        const cleanup = () => rm(workspace, { recursive: true, force: true });
+        try {
+            await runGit(workspace, ['init', root]);
+            const worktree = await runGit(root, ['config', '--null', '--get-all', 'core.worktree'], [0, 1]);
+            if (worktree.code === 0) {
+                throw new Error('Rule repository checkout requires Git core.worktree to be unset; remove the inherited repository-location override.');
+            }
+            if (parsed.revision !== undefined) {
+                if (parsed.revision.startsWith('+')
+                    && !parsed.revision.startsWith('refs/heads/+')) {
+                    throw new Error('Invalid rule repository revision.');
+                }
+                const result = await runGit(root, [
+                    'check-ref-format',
+                    `refs/coderuler/${parsed.revision}`,
+                ], [0, 1]);
+                if (result.code !== 0)
+                    throw new Error('Invalid rule repository revision.');
+            }
+            await runGit(root, ['remote', 'add', 'origin', parsed.transport]);
+            await runGit(root, [
+                'fetch', '--depth=1', '--no-tags', '--', 'origin', `${parsed.revision ?? 'HEAD'}:`,
+            ]);
+            await runGit(root, ['checkout', '--detach', 'FETCH_HEAD']);
+            return { root, cleanup };
+        }
+        catch (error) {
+            await cleanup();
+            throw error;
+        }
+    };
+}

package/dist/adapter/github/pull-request.d.ts

@@ -1,3 +1,4 @@
+import type { LineRange } from '../../app/rule.js';
 export interface PullRequest {
     readonly repository: string;
     readonly number: number;
@@ -7,6 +8,7 @@ export interface PullRequestCheckout {
     readonly root: string;
     readonly rulesRoot: string;
     readonly changedFiles: ReadonlySet<string>;
+    readonly changedLines: ReadonlyMap<string, readonly LineRange[]>;
     readonly pullRequest: PullRequest;
     cleanup(): Promise<void>;
 }

package/dist/adapter/github/pull-request.js

@@ -2,7 +2,7 @@ import { spawn } from 'node:child_process';
 import { mkdtemp, realpath, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { changedFiles } from '../git/changes.js';
+import { collectChanges } from '../git/changes.js';
 import { isolatedGitEnvironment } from '../git/environment.js';
 import { createGithubApi, mapping } from './api.js';
 export function repositoryName(value) {
@@ -127,9 +127,15 @@ export function createPullRequestCheckout(cwd, env) {
             const head = (await runGit(root, ['rev-parse', 'HEAD'])).stdout.trim();
             await runGit(root, ['worktree', 'add', '--detach', rulesRoot, 'refs/coderuler/base']);
             const mergeBase = (await runGit(root, ['merge-base', 'refs/coderuler/base', 'refs/coderuler/head'])).stdout.trim();
-            const files = await changedFiles(root, mergeBase, isolatedEnv);
+            const changes = await collectChanges(root, mergeBase, isolatedEnv);
             await assertNoWorktreeOverride(rulesRoot);
-            return { root, rulesRoot, changedFiles: files, pullRequest: { ...pullRequest, head }, cleanup };
+            return {
+                root,
+                rulesRoot,
+                ...changes,
+                pullRequest: { ...pullRequest, head },
+                cleanup,
+            };
         }
         catch (error) {
             await cleanup();

package/dist/app/execute.js

@@ -32,6 +32,7 @@ export async function executeRules(rules, context) {
         context.emit?.(event);
     };
     const changedFiles = context.changedFiles;
+    const changedLines = context.changedLines;
     const changedPaths = changedFiles === undefined
         ? undefined
         : [...changedFiles].filter(filepath => isEligibleRelativePath(filepath) && context.isTarget(filepath));
@@ -44,9 +45,11 @@ export async function executeRules(rules, context) {
             ...(details === undefined ? {} : { details }),
         });
     };
-    const projectContextFor = (name) => ({
+    const projectContextFor = (name, evaluationId) => ({
         project: context.project,
-        trace: traceFor(name),
+        ...(changedFiles === undefined ? {} : { changedFiles }),
+        ...(changedLines === undefined ? {} : { changedLines }),
+        trace: traceFor(name, evaluationId),
     });
     const fail = (name, stage, error, evaluationId) => {
         const message = error instanceof Error ? error.message : String(error);
@@ -106,7 +109,7 @@ export async function executeRules(rules, context) {
             const source = await context.project.readText(filepath);
             const matches = scope === undefined
                 ? wholeFileScope({ filepath, source })
-                : (await scope({ filepath, source }));
+                : (await scope({ filepath, source }, projectContextFor(name, evaluationId)));
             if (!Array.isArray(matches)) {
                 throw new Error(`Rule "${name}" scope selector must return an array of scopes`);
             }
@@ -123,8 +126,7 @@ export async function executeRules(rules, context) {
         return collected.flat();
     };
     const selectionContextFor = (name, changedOnly) => ({
-        project: context.project,
-        trace: traceFor(name),
+        ...projectContextFor(name),
         select: selection => selectFromRule(name, selection, undefined, changedOnly),
     });
     const runtimeOf = (plan) => {
@@ -139,7 +141,6 @@ export async function executeRules(rules, context) {
         plan.evaluationStartedAt ??= performance.now();
         const { name, rule } = plan;
         emit({ type: 'evaluation', evaluationId, name, subject });
-        const trace = traceFor(name, evaluationId);
         let trackedUsage;
         let pendingAi;
         let accountingFailure;
@@ -180,12 +181,11 @@ export async function executeRules(rules, context) {
             }
         };
         const checkContext = {
-            project: context.project,
+            ...projectContextFor(name, evaluationId),
             ruleName: name,
-            trace,
             select: selection => selectFromRule(name, selection, evaluationId),
             ai: options => {
-                const call = evaluateAi(subject, options, { project: context.project, ruleName: name, trace }, runtimeOf(plan), observer);
+                const call = evaluateAi(subject, options, { ...projectContextFor(name, evaluationId), ruleName: name }, runtimeOf(plan), observer);
                 const pending = pendingAi ??= new Set();
                 pending.add(call);
                 // Observe both outcomes immediately; the check still receives the original promise.

package/dist/app/ports.d.ts

@@ -1,4 +1,8 @@
-import type { AiUsage, CheckResult, GroupSubject, JsonValue, Rule, RuleSettings, ScopeSubject, Subject, TokenPricing, TokenUsage } from './rule.js';
+import type { AiUsage, CheckResult, GroupSubject, JsonValue, LineRange, Rule, RuleSettings, ScopeSubject, Subject, TokenPricing, TokenUsage } from './rule.js';
+export interface DiffChanges {
+    readonly changedFiles: ReadonlySet<string>;
+    readonly changedLines: ReadonlyMap<string, readonly LineRange[]>;
+}
 export interface Project {
     readonly root: string;
     glob(patterns: string | readonly string[]): Promise<readonly string[]>;
@@ -72,6 +76,7 @@ export interface RunContext {
     readonly project: Project;
     readonly isTarget: (filepath: string) => boolean;
     readonly changedFiles?: ReadonlySet<string>;
+    readonly changedLines?: ReadonlyMap<string, readonly LineRange[]>;
     readonly concurrency: number;
     readonly resolveDecision: (settings: RuleSettings) => DecisionRuntime;
     readonly emit?: (event: RunEvent) => void;