@basou/core 0.37.0 → 0.39.0

package/dist/index.d.ts

@@ -107,21 +107,12 @@ declare function removeStopHook(settings: unknown): StopHookRemoval;
 declare function findBasouStopHookCommand(settings: unknown): string | null;
 
 /**
- * Schema for `.basou/manifest.yaml`. The minimal manifest carries
- * schema_version, basou_version, workspace metadata, project info, enabled
- * capabilities, approval policy, adapter config, and git policy. The
- * `adapters."claude-code"` key uses a hyphen; downstream code accesses it
- * via bracket notation.
- *
- * Every object here is `looseObject` (NOT the default strip), so unknown keys
- * at every level survive parse. The manifest is the declarative source of truth
- * and is git-tracked and read-modify-written by `basou project` commands; with
- * the default strip, a field this basou does not recognize — a newer version's
- * additive field, a future adapter under `adapters`, a hand-added key — would be
- * silently dropped on the next write. Preserving them keeps basou from destroying
- * config it does not understand (forward-compatible), while known fields are still
- * fully type-checked and validated. {@link unknownManifestKeys} surfaces the
- * unrecognized top-level keys so preservation is not silent.
+ * The manifest, plus one guard the loose object cannot express: a TOP-LEVEL
+ * `confidential` is refused. It belongs under `policies`, and because the
+ * object is loose, a stray top-level spelling would otherwise parse fine and be
+ * silently ignored — an operator would believe the workspace is protected while
+ * the face is still written. A safety key that is not honoured must fail
+ * loudly, not quietly.
  */
 declare const ManifestSchema: z.ZodObject<{
     schema_version: z.ZodString;
@@ -197,6 +188,12 @@ declare const ManifestSchema: z.ZodObject<{
             self: "self";
         }>>;
     }, z.core.$loose>>>;
+    channels: z.ZodOptional<z.ZodObject<{
+        codex: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    policies: z.ZodOptional<z.ZodObject<{
+        confidential: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
 }, z.core.$loose>;
 /** Inferred runtime type for {@link ManifestSchema}. */
 type Manifest = z.infer<typeof ManifestSchema>;
@@ -422,9 +419,9 @@ declare const SessionImportPayloadSchema: z.ZodObject<{
         source: z.ZodString;
         prev_hash: z.ZodOptional<z.ZodString>;
         type: z.ZodLiteral<"command_executed">;
-        command: z.ZodString;
+        command: z.ZodNullable<z.ZodString>;
         args: z.ZodArray<z.ZodString>;
-        cwd: z.ZodString;
+        cwd: z.ZodNullable<z.ZodString>;
         exit_code: z.ZodNullable<z.ZodNumber>;
         signal: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         received_signal: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -669,8 +666,10 @@ type ClaudeTranscriptToPayloadOptions = {
  * than mapping one-to-one:
  *
  * - `session_started` / `session_ended` from the first / last timestamped record.
- * - `command_executed` from each `Bash` tool use, recorded as `bash -c "<cmd>"`
- *   (the transcript carries the shell line, not a parsed argv).
+ * - `command_executed` from each `Bash` tool use, recorded as `["-c", <cmd>]`
+ *   with a NULL executor and a NULL outcome: the transcript carries the shell
+ *   line and nothing about what ran it or how it ended (#191). Only `<cmd>`
+ *   was observed; the `-c` is basou's framing of "this is a shell program".
  * - `file_changed` from each `Edit` / `Write` / `NotebookEdit` tool use.
  * - `decision_recorded` from each `AskUserQuestion` tool use, but ONLY when the
  *   recorded answer is a confirmed SELECTION — it exactly matches an option the
@@ -860,7 +859,10 @@ type CodexRolloutToPayloadOptions = {
  * provenance-level events from the rollout's message-level records:
  *
  * - `session_started` / `session_ended` from the first / last timestamped record.
- * - `command_executed` from each shell execution, recorded as `bash -c "<cmd>"`.
+ * - `command_executed` from each shell execution, recorded as `["-c", <cmd>]`
+ *   with a NULL executor: the rollout carries the shell line, never what ran
+ *   it, and codex in fact runs through `/bin/zsh -lc` (#191). The `-c` is
+ *   basou's framing of "this is a shell program"; only `<cmd>` was observed.
  *   Codex has written these two different ways, and BOTH are read (an operator's
  *   `~/.codex/sessions` holds a mix across a CLI upgrade):
  *     - one `function_call` named `exec_command` per command, with JSON
@@ -1153,9 +1155,9 @@ declare const CommandExecutedEventSchema: z.ZodObject<{
     source: z.ZodString;
     prev_hash: z.ZodOptional<z.ZodString>;
     type: z.ZodLiteral<"command_executed">;
-    command: z.ZodString;
+    command: z.ZodNullable<z.ZodString>;
     args: z.ZodArray<z.ZodString>;
-    cwd: z.ZodString;
+    cwd: z.ZodNullable<z.ZodString>;
     exit_code: z.ZodNullable<z.ZodNumber>;
     signal: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     received_signal: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -1463,9 +1465,9 @@ declare const EventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     source: z.ZodString;
     prev_hash: z.ZodOptional<z.ZodString>;
     type: z.ZodLiteral<"command_executed">;
-    command: z.ZodString;
+    command: z.ZodNullable<z.ZodString>;
     args: z.ZodArray<z.ZodString>;
-    cwd: z.ZodString;
+    cwd: z.ZodNullable<z.ZodString>;
     exit_code: z.ZodNullable<z.ZodNumber>;
     signal: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     received_signal: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -6051,6 +6053,15 @@ type ReviewGapUnit = {
      * a self-reported gap is still a gap.
      */
     selfReports: SelfReportedReview[];
+    /**
+     * How many of this unit's commits ran with no recorded exit code, so that the
+     * commit landing is assumed rather than observed.
+     *
+     * A caveat, never an input to `verdict`: lowering the count would mean an
+     * unverifiable commit could quietly leave the report, which is the same hole
+     * a self-report must not open. `commitCount` still counts every commit.
+     */
+    commitsWithUnobservedOutcome: number;
 };
 /** Recorded reviews that reached no unit of work, broken down by cause. */
 type UnattachedSelfReports = {

package/dist/index.js

@@ -471,7 +471,7 @@ function claudeTranscriptToImportPayload(records, options) {
         cachedInputTokens += readNonNegInt(usage.cache_read_input_tokens);
       }
     }
-    const cwd = readString3(record.cwd) ?? workingDir ?? ".";
+    const cwd = readString3(record.cwd) ?? workingDir ?? null;
     for (const item of toolUses(record)) {
       const name = readString3(item.name);
       const input = isObject3(item.input) ? item.input : void 0;
@@ -581,9 +581,20 @@ function commandExecutedEvent(occurredAt, sessionId, command, cwd) {
   return {
     ...baseEvent(occurredAt, sessionId),
     type: "command_executed",
-    command: "bash",
+    // The transcript records the Bash tool's command STRING and nothing about
+    // what ran it. `command: "bash"` used to be written here, which put an
+    // unobserved executor inside the hash chain; null says what is true. `-c`
+    // is kept so the line still reads as a shell program rather than an argv,
+    // which is the one bit readers need (#191).
+    command: null,
     args: ["-c", command],
     cwd,
+    // UNKNOWN rather than a signal termination or a success. NOT because the
+    // transcript is silent about the outcome -- it is not. A failed Bash tool
+    // result carries `is_error: true` and its text begins `Exit code N`, so the
+    // code is recoverable for the commands that failed (measured: 66 of 2,636
+    // tool results across twelve transcripts). Reading it is its own change and
+    // has not been made, so nothing is claimed here yet.
     exit_code: null,
     duration_ms: 0
   };
@@ -717,7 +728,7 @@ function codexRolloutToImportPayload(records, options) {
             ts,
             placeholderSessionId,
             command2.cmd,
-            command2.workdir ?? workingDir ?? ".",
+            scriptedCommandCwd(command2.workdir, workingDir),
             {
               exitCode: null,
               durationMs
@@ -731,7 +742,7 @@ function codexRolloutToImportPayload(records, options) {
     if (readString4(payload2.name) !== "exec_command") continue;
     const command = readExecCommand(payload2.arguments);
     if (command === void 0) continue;
-    const cwd = command.workdir ?? workingDir ?? ".";
+    const cwd = scriptedCommandCwd(command.workdir, workingDir);
     const output = readCallId(payload2.call_id, outputsByCallId);
     const execTsMs = Date.parse(ts);
     if (Number.isFinite(execTsMs)) engagementTsMs.push(execTsMs);
@@ -832,7 +843,14 @@ function commandExecutedEvent2(occurredAt, sessionId, command, cwd, outcome) {
   return {
     ...baseEvent2(occurredAt, sessionId),
     type: "command_executed",
-    command: "bash",
+    // `command: "bash"` used to be written here and was WRONG, not merely
+    // unobserved: codex runs its commands through `/bin/zsh -lc`. The rollout
+    // carries no per-call shell to read, and the environment block's
+    // `environments.local.shell` describes the environment rather than what ran
+    // a given command — so writing `zsh` would be a better-informed guess, not
+    // an observation. null is what was actually observed about the executor
+    // (#191). `-c` is kept so the line still reads as a shell program.
+    command: null,
     args: ["-c", command],
     cwd,
     exit_code: outcome.exitCode,
@@ -990,6 +1008,9 @@ function findObjectEnd(script, start) {
 }
 function readExecArguments(literal) {
   const values = /* @__PURE__ */ new Map();
+  let workdirUnreadable = false;
+  const survivesSpread = { cmd: false, workdir: false };
+  let sawSpread = false;
   let i = 1;
   while (i < literal.length) {
     const at = skipWhitespaceAndComments(literal, i);
@@ -1000,7 +1021,15 @@ function readExecArguments(literal) {
       i = at + 1;
       continue;
     }
-    if (literal.startsWith("...", at)) return void 0;
+    if (literal.startsWith("...", at)) {
+      sawSpread = true;
+      survivesSpread.cmd = false;
+      survivesSpread.workdir = false;
+      const next2 = skipToPropertyEnd(literal, at);
+      if (next2 === -1) return void 0;
+      i = next2;
+      continue;
+    }
     let key;
     let afterKey;
     if (ch === '"' || ch === "'") {
@@ -1016,7 +1045,8 @@ function readExecArguments(literal) {
     const colon = skipWhitespaceAndComments(literal, afterKey);
     if (colon === -1) return void 0;
     if (literal[colon] !== ":") {
-      if (key === "cmd" || key === "workdir") return void 0;
+      if (key === "cmd") return void 0;
+      if (key === "workdir") workdirUnreadable = true;
       i = colon;
       const next2 = skipToPropertyEnd(literal, colon);
       if (next2 === -1) return void 0;
@@ -1039,23 +1069,42 @@ function readExecArguments(literal) {
       if (terminator === "," || terminator === "}") {
         value = decoded.length > 0 ? decoded : void 0;
         afterValue = after;
-      } else if (key === "cmd" || key === "workdir") {
+      } else if (key === "cmd") {
         return void 0;
+      } else if (key === "workdir") {
+        workdirUnreadable = true;
       }
-    } else if (key === "cmd" || key === "workdir") {
+    } else if (key === "cmd") {
       return void 0;
+    } else if (key === "workdir") {
+      workdirUnreadable = true;
     }
     if (key === "cmd" || key === "workdir") {
-      if (values.has(key)) return void 0;
-      values.set(key, value);
+      if (values.has(key)) {
+        if (key === "cmd") return void 0;
+        workdirUnreadable = true;
+      } else {
+        values.set(key, value);
+        if (value !== void 0) survivesSpread[key] = true;
+      }
     }
     const next = skipToPropertyEnd(literal, afterValue);
     if (next === -1) return void 0;
     i = next;
   }
   const cmd = values.get("cmd");
-  if (cmd === void 0) return void 0;
-  return { cmd, workdir: values.get("workdir") };
+  if (cmd === void 0 || !survivesSpread.cmd) return void 0;
+  return { cmd, workdir: resolveScriptedWorkdir() };
+  function resolveScriptedWorkdir() {
+    if (workdirUnreadable) return null;
+    if (values.has("workdir") && survivesSpread.workdir) return values.get("workdir");
+    if (sawSpread) return null;
+    return void 0;
+  }
+}
+function scriptedCommandCwd(workdir, sessionCwd) {
+  if (workdir === null) return null;
+  return workdir ?? sessionCwd ?? null;
 }
 function skipToPropertyEnd(literal, at) {
   let i = at;
@@ -1422,9 +1471,9 @@ var ApprovalExpiredEventSchema = BaseEventSchema.extend({
 });
 var CommandExecutedEventSchema = BaseEventSchema.extend({
   type: z3.literal("command_executed"),
-  command: z3.string(),
+  command: z3.string().nullable(),
   args: z3.array(z3.string()),
-  cwd: z3.string(),
+  cwd: z3.string().nullable(),
   exit_code: z3.number().int().nullable(),
   signal: z3.string().nullable().optional(),
   received_signal: z3.string().nullable().optional(),
@@ -1733,7 +1782,35 @@ var WorkspaceMetaSchema = z4.looseObject({
    */
   view: SourceRootSchema.optional()
 });
-var ManifestSchema = z4.looseObject({
+var ChannelsSchema = z4.looseObject({
+  /**
+   * Render this workspace's orientation into `~/.codex/AGENTS.md` on `basou
+   * refresh` / `basou run codex`. A boolean today; if a face ever needs
+   * per-block control this widens to `boolean | object`, which existing
+   * manifests keep parsing — so the boolean does not foreclose that.
+   */
+  codex: z4.boolean().optional().meta({
+    description: "Opt in to rendering this workspace's orientation into the user-global ~/.codex/AGENTS.md on `basou refresh` and `basou run codex`. Off when absent: that file is auto-loaded by Codex for every project on the machine, so nothing is written there unless the workspace says so."
+  })
+});
+var PoliciesSchema = z4.looseObject({
+  /**
+   * This workspace's provenance must not persist where another workspace's
+   * tool reads it. That is the GOAL the key states; what it gates today is one
+   * thing: rendering the orientation into the user-global `~/.codex/AGENTS.md`
+   * (`basou refresh` / `basou run codex`) — never, regardless of `channels`, so
+   * a confidential workspace cannot be re-enabled by a second declaration in
+   * the same file. It does not yet govern `basou protocol sync` (a global
+   * render, not a per-workspace one), and it gates writing only: it cannot keep
+   * another workspace's block out of this workspace's tool (see `basou channel
+   * clear`). Stated as a goal rather than as "never write" so that a transient
+   * render removed before anyone else can read it remains permissible.
+   */
+  confidential: z4.boolean().optional().meta({
+    description: "This workspace's provenance must not persist where another workspace's tool reads it. Today this means its orientation is never rendered into the user-global ~/.codex/AGENTS.md by `basou refresh` or `basou run codex`, regardless of `channels`. It does not yet govern `basou protocol sync`, and it gates writing only \u2014 it cannot keep another workspace's block out of this workspace's tool."
+  })
+});
+var ManifestObjectSchema = z4.looseObject({
   schema_version: SchemaVersionSchema,
   // Same forward-compatible format gate as schema_version (accept 0.x.y, gate a
   // higher major with an upgrade error) rather than a hard literal. `basou_version`
@@ -1747,9 +1824,20 @@ var ManifestSchema = z4.looseObject({
   adapters: AdaptersSchema,
   git: GitConfigSchema,
   import: ImportConfigSchema.optional(),
-  repos: z4.array(RepoEntrySchema).min(1).optional()
+  repos: z4.array(RepoEntrySchema).min(1).optional(),
+  channels: ChannelsSchema.optional(),
+  policies: PoliciesSchema.optional()
 });
-var KNOWN_TOP_LEVEL_KEYS = new Set(Object.keys(ManifestSchema.shape));
+var ManifestSchema = ManifestObjectSchema.superRefine((manifest, ctx) => {
+  if ("confidential" in manifest) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["confidential"],
+      message: "`confidential` is declared under `policies` (policies.confidential: true). A top-level `confidential` is not honoured, so it is rejected rather than ignored."
+    });
+  }
+});
+var KNOWN_TOP_LEVEL_KEYS = new Set(Object.keys(ManifestObjectSchema.shape));
 function unknownManifestKeys(manifest) {
   return Object.keys(manifest).filter((k) => !KNOWN_TOP_LEVEL_KEYS.has(k)).sort();
 }
@@ -2484,8 +2572,10 @@ var SessionSourceSchema = z5.looseObject({
 var InvocationSchema = z5.looseObject({
   command: z5.string().min(1),
   args: z5.array(z5.string()).default([]),
-  // Nullable to record signal-terminated runs where the child has no exit
-  // code; the same nullability is mirrored in CommandExecutedEventSchema.
+  // Nullable because the outcome may be UNKNOWN: a signal-terminated run has no
+  // exit code, and an imported session's source may never record one. Unknown
+  // is not success. The same nullability and the same meaning are mirrored in
+  // CommandExecutedEventSchema.
   exit_code: z5.number().int().nullable()
 });
 var SessionMetricsSchema = z5.looseObject({
@@ -7577,9 +7667,13 @@ var CHDIR_OPTIONS = /* @__PURE__ */ new Map([
   ["just", /* @__PURE__ */ new Set(["-d", "--working-directory"])]
 ]);
 function deriveCommandWorkdir(command, args, cwd) {
+  const script = args.length === 2 && args[0] === "-c" ? args[1] : void 0;
+  if (command === null) {
+    if (script === void 0) return ambiguous("unsupported_invocation");
+    return readShellProgram(script, cwd);
+  }
   const program = basename3(command);
   if (SHELLS.has(program)) {
-    const script = args.length === 2 && args[0] === "-c" ? args[1] : void 0;
     if (script === void 0) return ambiguous("unsupported_invocation");
     return readShellProgram(script, cwd);
   }
@@ -7900,7 +7994,7 @@ function readCdTarget(operands, cwd) {
     else return ambiguous("tilde_user");
   }
   if (!isAbsolute2(target)) {
-    if (!isAbsolute2(cwd)) return ambiguous("unresolvable_relative");
+    if (cwd === null || !isAbsolute2(cwd)) return ambiguous("unresolvable_relative");
     target = resolve3(cwd, target);
   }
   return { kind: "target", path: target };
@@ -8008,8 +8102,9 @@ function commandRepoPath(command, args, cwd) {
 function commandRepo(command, args, cwd) {
   return normalizeRepoPath(commandRepoPath(command, args, cwd));
 }
-function commandFailed(exitCode) {
-  return exitCode !== null && exitCode !== 0;
+function commandOutcome(exitCode) {
+  if (exitCode === null) return "unknown";
+  return exitCode === 0 ? "succeeded" : "failed";
 }
 function commitFiles(args) {
   const a = args.join(" ");
@@ -8065,7 +8160,8 @@ async function findReviewGaps(input) {
           continue;
         }
         if (ev.type !== "command_executed") continue;
-        if (commandFailed(ev.exit_code)) continue;
+        const outcome = commandOutcome(ev.exit_code);
+        if (outcome === "failed") continue;
         const at = Date.parse(ev.occurred_at);
         if (isReview) {
           const repo2 = commandRepo(ev.command, ev.args, ev.cwd);
@@ -8092,7 +8188,13 @@ async function findReviewGaps(input) {
         }
         const byRepo = workUnits.get(entry.sessionId) ?? /* @__PURE__ */ new Map();
         const list = byRepo.get(repo) ?? [];
-        list.push({ repo, at, files: commitFiles(ev.args), keyResolved });
+        list.push({
+          repo,
+          at,
+          files: commitFiles(ev.args),
+          keyResolved,
+          outcomeObserved: outcome === "succeeded"
+        });
         byRepo.set(repo, list);
         workUnits.set(entry.sessionId, byRepo);
       }
@@ -8154,6 +8256,7 @@ async function findReviewGaps(input) {
         // Attached after the verdict is computed, and deliberately not an input
         // to it: a record must never move a unit out of `gaps`.
         selfReports: selfBound.map((r) => toSelfReportedReview(r, r.at > earliest)),
+        commitsWithUnobservedOutcome: commits.filter((c) => !c.outcomeObserved).length,
         reviews: cited.map((r) => ({
           sessionId: r.sessionId,
           examinedDiff: r.repos.get(repoPath)?.examinedDiff ?? false,
@@ -8179,7 +8282,10 @@ async function findReviewGaps(input) {
       verdict: "unknown",
       reviews: [],
       // No repo key, so nothing a record's `repos` could bind to.
-      selfReports: []
+      selfReports: [],
+      // These commits were never placed in a repository, so the per-commit
+      // outcome is not tracked for them; the unit is already a caveat.
+      commitsWithUnobservedOutcome: 0
     });
   }
   const missed = selfReports.filter((r) => !attachedSelfReports.has(r.eventId));
@@ -9088,7 +9194,7 @@ function derivedEventContentKey(event) {
   const base = `${event.type}\0${event.occurred_at}`;
   switch (event.type) {
     case "command_executed":
-      return `${base}\0${event.command}\0${event.args.join("
")}\0${event.cwd}`;
+      return `${base} ${event.args.join("")} ${event.cwd}`;
     case "file_changed":
       return `${base}\0${event.path}\0${event.change_type}`;
     case "decision_recorded":