@beignet/cli 0.0.51 → 0.0.53

package/src/app-map.ts

@@ -6,6 +6,10 @@ import {
   isImportedContractDeclaration,
 } from "./analysis/contract-factories.js";
 import { analyzePortWiring } from "./analysis/port-wiring.js";
+import {
+  isAnalysisSourceFile,
+  stripSourceFileExtension,
+} from "./analysis/source-files.js";
 import {
   createSourceIndex,
   exportedVariableDeclarations,
@@ -19,7 +23,10 @@ import {
 import {
   type AnalysisWorkspace,
   createAnalysisWorkspace,
+  projectPath,
+  projectSource,
 } from "./analysis/workspace.js";
+import { workspaceRouteContracts } from "./analysis/workspace-routes.js";
 import type { AppMapNodeKind } from "./app-map-schema.js";
 import { directoryPath } from "./config.js";
 import {
@@ -29,6 +36,11 @@ import {
 } from "./inspect.js";
 import { type LintDiagnostic, lintApp } from "./lint.js";
 import { auditProviders } from "./provider-audit.js";
+import {
+  appTestRoots,
+  isAppTestFile,
+  isWithinAppTestRoots,
+} from "./test-discovery.js";
 
 export type { AppMapNodeKind } from "./app-map-schema.js";
 export { appMapNodeKinds } from "./app-map-schema.js";
@@ -206,8 +218,8 @@ export async function mapApp(
   const definitions = new Map<string, DefinitionRecord>();
   const definitionBySource = new Map<string, string>();
   const registries: RegistryRecord[] = [];
-  const featuresPath = directoryPath(workspace.config.paths.features);
-  const featureNames = discoverFeatureNames(workspace, featuresPath);
+  const features = discoverFeatures(workspace);
+  const featureNames = [...features.keys()];
 
   const addNode = (node: AppMapNode) => {
     const existing = nodes.get(node.id);
@@ -225,11 +237,9 @@ export async function mapApp(
   };
   const addEdge = (edge: AppMapEdge) => edges.push(edge);
 
-  for (const feature of featureNames) {
-    const featureFiles = filesForFeature(
-      workspace.files,
-      featuresPath,
-      feature,
+  for (const [feature, featurePath] of features) {
+    const featureFiles = workspace.files.filter((file) =>
+      file.startsWith(`${featurePath}/`),
     );
     const roles = summarizeFeatureFiles(featureFiles);
     addNode({
@@ -237,21 +247,31 @@ export async function mapApp(
       kind: "feature",
       name: feature,
       feature,
-      source: { file: `${featuresPath}/${feature}` },
+      source: { file: featurePath },
       status: "declared",
       details: roles,
     });
+  }
 
-    for (const file of featureFiles.filter(isTestFile)) {
-      const id = `test:${file}`;
-      addNode({
-        id,
-        kind: "test",
-        name: path.posix.basename(file),
-        feature,
-        source: { file },
-        status: "declared",
-      });
+  for (const file of workspace.files.filter(
+    (candidate) =>
+      isAppTestFile(candidate) &&
+      isWithinAppTestRoots(
+        projectSource(workspace, candidate).file,
+        appTestRoots(projectSource(workspace, candidate).project.config.paths),
+      ),
+  )) {
+    const id = `test:${file}`;
+    const feature = featureForFile(file, workspace);
+    addNode({
+      id,
+      kind: "test",
+      name: path.posix.basename(file),
+      ...(feature ? { feature } : {}),
+      source: { file },
+      status: "declared",
+    });
+    if (feature) {
       addEdge(exactEdge("contains-test", featureId(feature), id, file));
     }
   }
@@ -260,7 +280,7 @@ export async function mapApp(
   const contractIdsByExport = new Map<string, string[]>();
   for (const contract of inspection.contracts) {
     const id = `contract:${contract.file}#${contract.exportName}`;
-    const feature = featureForFile(contract.file, featuresPath);
+    const feature = featureForFile(contract.file, workspace);
     contractIds.set(symbolKey(contract.file, contract.exportName), id);
     const exports = contractIdsByExport.get(contract.exportName) ?? [];
     exports.push(id);
@@ -305,8 +325,8 @@ export async function mapApp(
       id,
       kind: "route",
       name: `${route.method} ${route.path}`,
-      ...(featureForFile(route.file, featuresPath)
-        ? { feature: featureForFile(route.file, featuresPath) }
+      ...(featureForFile(route.file, workspace)
+        ? { feature: featureForFile(route.file, workspace) }
         : {}),
       source: {
         file: route.handlerFile ?? route.file,
@@ -345,7 +365,7 @@ export async function mapApp(
       details: { type: "server" },
     });
   }
-  const sourceFiles = workspace.files.filter(isTypeScriptSource);
+  const sourceFiles = workspace.files.filter(isAnalysisSourceFile);
   for (const file of sourceFiles) {
     const sourceFile = await workspace.readSourceFile(file);
     for (const { exportName, declaration } of exportedVariableDeclarations(
@@ -359,7 +379,7 @@ export async function mapApp(
         const runtimeName = literalText(useCaseCall.arguments[0]);
         if (runtimeName) {
           const kind = callMemberName(useCaseCall) as "command" | "query";
-          const feature = featureForFile(file, featuresPath);
+          const feature = featureForFile(file, workspace);
           const id = `use-case:${runtimeName}`;
           const node: AppMapNode = {
             id,
@@ -402,7 +422,7 @@ export async function mapApp(
           : undefined;
         const runtimeName = definitionRuntimeName(call, definitionCall);
         if (kind && runtimeName) {
-          const feature = featureForFile(file, featuresPath);
+          const feature = featureForFile(file, workspace);
           const id = `${kind}:${runtimeName}`;
           const status = definitionStatus(
             kind,
@@ -442,7 +462,7 @@ export async function mapApp(
 
       const policyCall = findCall(initializer, new Set(["definePolicy"]));
       if (policyCall && ts.isObjectLiteralExpression(policyCall.arguments[0])) {
-        const feature = featureForFile(file, featuresPath);
+        const feature = featureForFile(file, workspace);
         const policyId = `policy:${file}#${exportName}`;
         addNode({
           id: policyId,
@@ -660,8 +680,11 @@ export async function mapApp(
     contractIdsByExport,
     routeIds,
     definitionBySource,
-    featuresPath,
     diagnostics: inspection.diagnostics,
+    registeredGroups:
+      workspace.projects.length > 1
+        ? (await workspaceRouteContracts(workspace)).groups
+        : undefined,
   });
 
   await addOpenApiSurface({
@@ -695,7 +718,6 @@ export async function mapApp(
   await addUnresolvedLocalImports({ workspace, unresolved });
   await addFeatureDependencies({
     workspace,
-    featuresPath,
     addEdge,
     featureNames: new Set(featureNames),
   });
@@ -912,13 +934,14 @@ async function addRouteGroups(args: {
   contractIdsByExport: Map<string, string[]>;
   routeIds: Map<string, string>;
   definitionBySource: Map<string, string>;
-  featuresPath: string;
+  registeredGroups?: Set<string>;
   diagnostics: InspectDiagnostic[];
 }): Promise<void> {
   const routeFiles = args.workspace.files.filter(
     (file) =>
-      featureForFile(file, args.featuresPath) !== undefined &&
-      file.endsWith("/routes.ts"),
+      featureForFile(file, args.workspace) !== undefined &&
+      isAnalysisSourceFile(file) &&
+      stripSourceFileExtension(file).endsWith("/routes"),
   );
 
   for (const file of routeFiles) {
@@ -932,17 +955,20 @@ async function addRouteGroups(args: {
       const options = call?.arguments[0];
       if (!call || !options || !ts.isObjectLiteralExpression(options)) continue;
 
-      const feature = featureForFile(file, args.featuresPath);
+      const feature = featureForFile(file, args.workspace);
       const groupName = literalText(
         propertyAssignment(options, "name")?.initializer,
       );
       const id = `route-group:${file}#${exportName}`;
-      const missing = args.diagnostics.some(
-        (diagnostic) =>
-          diagnostic.code === "BEIGNET_ROUTE_GROUP_UNREGISTERED" &&
-          diagnostic.subject?.file === file &&
-          diagnostic.subject.exportName === exportName,
-      );
+      const missing =
+        (args.registeredGroups !== undefined &&
+          !args.registeredGroups.has(`${file}#${exportName}`)) ||
+        args.diagnostics.some(
+          (diagnostic) =>
+            diagnostic.code === "BEIGNET_ROUTE_GROUP_UNREGISTERED" &&
+            diagnostic.subject?.file === file &&
+            diagnostic.subject.exportName === exportName,
+        );
       args.addNode({
         id,
         kind: "route-group",
@@ -1063,8 +1089,10 @@ async function addPorts(args: {
 }): Promise<void> {
   const portsFile = args.workspace.config.paths.ports;
   if (!args.workspace.fileSet.has(portsFile)) return;
-  const sourceFile = await args.workspace.readSourceFile(portsFile);
-  const analysis = await analyzePortWiring(args.workspace);
+  const analysis = await analyzePortWiring(
+    args.workspace,
+    args.workspace.projects.length > 1 ? args.sourceIndex : undefined,
+  );
   if (analysis.declarationIndeterminate) {
     args.unresolved.push({
       code: "app_ports_declaration_unresolved",
@@ -1081,11 +1109,12 @@ async function addPorts(args: {
   }
   for (const name of analysis.declared) {
     const property = analysis.properties.get(name);
+    const propertyFile = analysis.propertyFiles.get(name) ?? portsFile;
     const feature = property
       ? await portFeature(
           property.type,
-          portsFile,
-          args.workspace.config.paths.features,
+          propertyFile,
+          args.workspace,
           args.sourceIndex,
         )
       : undefined;
@@ -1096,7 +1125,7 @@ async function addPorts(args: {
       name,
       ...(feature ? { feature } : {}),
       source: property
-        ? await args.sourceIndex.sourceLocation(portsFile, property)
+        ? await args.sourceIndex.sourceLocation(propertyFile, property)
         : { file: args.workspace.config.paths.portWiring },
       status:
         analysis.bound.has(name) || analysis.deferred.has(name)
@@ -1108,7 +1137,7 @@ async function addPorts(args: {
           : analysis.deferred.has(name)
             ? "deferred"
             : "unresolved",
-        ...(property?.type ? { type: property.type.getText(sourceFile) } : {}),
+        ...(property?.type ? { type: property.type.getText() } : {}),
       },
     });
     if (feature) {
@@ -1192,8 +1221,8 @@ async function addOutboxDeliveryGraph(args: {
   ]);
   for (const file of args.workspace.files) {
     if (
-      !isTypeScriptSource(file) ||
-      isTestFile(file) ||
+      !isAnalysisSourceFile(file) ||
+      isAppTestFile(file) ||
       ![...runtimeDirectories].some(
         (directory) =>
           directory === "." ||
@@ -1276,9 +1305,10 @@ function isProviderLifecycleSource(
   file: string,
   sourceFile: ts.SourceFile,
 ): boolean {
+  const sourcePath = stripSourceFileExtension(file);
   if (
-    /(^|\/)provider(s)?\.ts$/.test(file) ||
-    /(^|\/)[^/]*provider[^/]*\.ts$/.test(file) ||
+    /(^|\/)provider(s)?$/.test(sourcePath) ||
+    /(^|\/)[^/]*provider[^/]*$/.test(sourcePath) ||
     /(^|\/)providers?\//.test(file)
   ) {
     return true;
@@ -1390,7 +1420,7 @@ async function addTables(args: {
   const schemaPrefix = `${infraDir}/db/schema/`;
   const files = args.workspace.files.filter(
     (file) =>
-      isTypeScriptSource(file) &&
+      isAnalysisSourceFile(file) &&
       (file.startsWith(schemaPrefix) ||
         schemaSources.some((source) =>
           file.startsWith(staticPathPrefix(source)),
@@ -1429,7 +1459,6 @@ async function addTables(args: {
 
 async function addFeatureDependencies(args: {
   workspace: AnalysisWorkspace;
-  featuresPath: string;
   addEdge(edge: AppMapEdge): void;
   featureNames: Set<string>;
 }): Promise<void> {
@@ -1447,12 +1476,12 @@ async function addFeatureDependencies(args: {
     }
   >();
 
-  for (const file of args.workspace.files.filter(isTypeScriptSource)) {
-    const from = featureForFile(file, args.featuresPath);
+  for (const file of args.workspace.files.filter(isAnalysisSourceFile)) {
+    const from = featureForFile(file, args.workspace);
     if (!from || !args.featureNames.has(from)) continue;
     for (const reference of await localImportReferences(args.workspace, file)) {
       if (!reference.resolvedFile) continue;
-      const to = featureForFile(reference.resolvedFile, args.featuresPath);
+      const to = featureForFile(reference.resolvedFile, args.workspace);
       if (!to || to === from || !args.featureNames.has(to)) continue;
       const key = `${from}->${to}`;
       const current = dependencies.get(key) ?? {
@@ -1496,7 +1525,7 @@ async function addUnresolvedLocalImports(args: {
   workspace: AnalysisWorkspace;
   unresolved: AppMapUnresolvedReference[];
 }): Promise<void> {
-  for (const file of args.workspace.files.filter(isTypeScriptSource)) {
+  for (const file of args.workspace.files.filter(isAnalysisSourceFile)) {
     for (const reference of await localImportReferences(args.workspace, file)) {
       if (reference.resolvedFile) continue;
       args.unresolved.push({
@@ -1551,20 +1580,21 @@ async function addUnresolvedContractDeclarations(args: {
 }
 
 function appMapContractSourceFiles(workspace: AnalysisWorkspace): string[] {
-  const contractsPath = directoryPath(workspace.config.paths.contracts);
-  const featureOwned =
-    contractsPath === directoryPath(workspace.config.paths.features);
-
   return workspace.files.filter((file) => {
-    if (!file.endsWith(".ts") || file.endsWith(".test.ts")) return false;
+    if (!isAnalysisSourceFile(file) || isAppTestFile(file)) return false;
+    const source = projectSource(workspace, file);
+    const contractsPath = directoryPath(source.project.config.paths.contracts);
+    const featureOwned =
+      contractsPath === directoryPath(source.project.config.paths.features);
+    const sourcePath = stripSourceFileExtension(source.file);
     if (featureOwned) {
       const prefix = `${contractsPath}/`;
-      if (!file.startsWith(prefix)) return false;
-      const parts = file.slice(prefix.length).split("/");
-      return parts.length === 2 && parts[1] === "contracts.ts";
+      if (!source.file.startsWith(prefix)) return false;
+      const parts = sourcePath.slice(prefix.length).split("/");
+      return parts.length === 2 && parts[1] === "contracts";
     }
     return (
-      file === `${contractsPath}.ts` || file.startsWith(`${contractsPath}/`)
+      sourcePath === contractsPath || sourcePath.startsWith(`${contractsPath}/`)
     );
   });
 }
@@ -1580,10 +1610,7 @@ async function registryRecord(args: {
   if (!initializer) return undefined;
   const registry = registryValues(initializer, args.exportName);
   if (!registry) return undefined;
-  const feature = featureForFile(
-    args.file,
-    directoryPath(args.workspace.config.paths.features),
-  );
+  const feature = featureForFile(args.file, args.workspace);
   return {
     file: args.file,
     declaration: args.declaration,
@@ -1795,27 +1822,19 @@ function arrayExpressions(array: ts.ArrayLiteralExpression): ts.Expression[] {
   });
 }
 
-function discoverFeatureNames(
-  workspace: AnalysisWorkspace,
-  featuresPath: string,
-): string[] {
-  const names = new Set<string>();
-  const prefix = `${featuresPath}/`;
+function discoverFeatures(workspace: AnalysisWorkspace): Map<string, string> {
+  const features = new Map<string, string>();
   for (const file of workspace.files) {
-    if (!file.startsWith(prefix)) continue;
-    const feature = file.slice(prefix.length).split("/")[0];
-    if (feature && feature !== "shared") names.add(feature);
+    const feature = featureForFile(file, workspace);
+    if (!feature) continue;
+    const source = projectSource(workspace, file);
+    const root = directoryPath(source.project.config.paths.features);
+    const name = source.file.slice(`${root}/`.length).split("/")[0];
+    features.set(feature, projectPath(source.project, `${root}/${name}`));
   }
-  return [...names].sort();
-}
-
-function filesForFeature(
-  files: string[],
-  featuresPath: string,
-  feature: string,
-): string[] {
-  const prefix = `${featuresPath}/${feature}/`;
-  return files.filter((file) => file.startsWith(prefix));
+  return new Map(
+    [...features].sort(([left], [right]) => left.localeCompare(right)),
+  );
 }
 
 function summarizeFeatureFiles(files: string[]): Record<string, number> {
@@ -1824,24 +1843,26 @@ function summarizeFeatureFiles(files: string[]): Record<string, number> {
     client: files.filter((file) => file.includes("/client/")).length,
     components: files.filter((file) => file.includes("/components/")).length,
     domain: files.filter((file) => file.includes("/domain/")).length,
-    tests: files.filter(isTestFile).length,
+    tests: files.filter(isAppTestFile).length,
   };
 }
 
 function featureForFile(
   file: string,
-  featuresPath: string,
+  workspace: AnalysisWorkspace,
 ): string | undefined {
-  const prefix = `${featuresPath}/`;
-  if (!file.startsWith(prefix)) return undefined;
-  const feature = file.slice(prefix.length).split("/")[0];
-  return feature && feature !== "shared" ? feature : undefined;
+  const source = projectSource(workspace, file);
+  const prefix = `${directoryPath(source.project.config.paths.features)}/`;
+  if (!source.file.startsWith(prefix)) return undefined;
+  const feature = source.file.slice(prefix.length).split("/")[0];
+  if (!feature || feature === "shared") return undefined;
+  return source.project.prefix ? `${source.project.name}:${feature}` : feature;
 }
 
 async function portFeature(
   type: ts.TypeNode | undefined,
   file: string,
-  featuresPath: string,
+  workspace: AnalysisWorkspace,
   sourceIndex: ReturnType<typeof createSourceIndex>,
 ): Promise<string | undefined> {
   if (
@@ -1852,9 +1873,7 @@ async function portFeature(
     return undefined;
   }
   const target = await sourceIndex.resolveName(file, type.typeName.text);
-  return target
-    ? featureForFile(target.file, directoryPath(featuresPath))
-    : undefined;
+  return target ? featureForFile(target.file, workspace) : undefined;
 }
 
 function definitionStatus(
@@ -2017,14 +2036,6 @@ function sourceNodeEdge(
   };
 }
 
-function isTestFile(file: string): boolean {
-  return /\.(test|spec)\.(ts|tsx|mts|cts)$/.test(file);
-}
-
-function isTypeScriptSource(file: string): boolean {
-  return /\.(ts|tsx|mts|cts)$/.test(file) && !file.endsWith(".d.ts");
-}
-
 function staticPathPrefix(pattern: string): string {
   const wildcard = pattern.search(/[?*[{]/);
   return wildcard === -1 ? pattern : pattern.slice(0, wildcard);

package/src/check.ts

@@ -1,7 +1,11 @@
-import { readdir, readFile, stat } from "node:fs/promises";
+import { readdir, readFile, realpath, stat } from "node:fs/promises";
 import path from "node:path";
 import { createPainter } from "./ansi.js";
 import { detectPackageManager, spawnCommand } from "./db.js";
+import {
+  type GitSourceSnapshot,
+  readGitSourceSnapshot,
+} from "./git-changes.js";
 import {
   applyDoctorFixes,
   formatDoctor,
@@ -33,6 +37,14 @@ export type CheckAppResult = {
   ok: boolean;
   fixes: InspectFix[];
   steps: CheckStep[];
+  provenance: CheckProvenance;
+};
+
+/** Source-state evidence captured around one complete check run. */
+export type CheckProvenance = {
+  status: "current" | "stale" | "unavailable";
+  start: GitSourceSnapshot;
+  end: GitSourceSnapshot;
 };
 
 export type CheckAppOptions = {
@@ -74,19 +86,34 @@ const defaultMaxOutputBytes = 64 * 1024;
 export async function checkApp(
   options: CheckAppOptions = {},
 ): Promise<CheckAppResult> {
-  const targetDir = path.resolve(options.cwd ?? process.cwd());
-  const scripts = await readAppPackageScripts(targetDir);
-  const runner = await detectPackageManager(targetDir);
+  options.signal?.throwIfAborted();
+  const targetDir = await resolveCheckTargetDir(options.cwd ?? process.cwd());
+  options.signal?.throwIfAborted();
+  // Validate the app root before fixes may write; reload execution metadata
+  // after the provenance baseline so the selected scripts are covered by it.
+  await readAppPackageScripts(targetDir);
+  options.signal?.throwIfAborted();
+  const fixes = options.fix
+    ? await applyDoctorFixes({ cwd: targetDir, strict: true })
+    : [];
+  options.signal?.throwIfAborted();
   const steps: CheckStep[] = [];
   const record = (step: CheckStep): void => {
     steps.push(step);
     options.onStep?.(step);
   };
 
+  const start = await readGitSourceSnapshot({
+    cwd: targetDir,
+    signal: options.signal,
+  });
+  options.signal?.throwIfAborted();
+  const scripts = await readAppPackageScripts(targetDir);
+  const runner = await detectPackageManager(targetDir);
   options.signal?.throwIfAborted();
   record(await lintStep(targetDir, options));
   options.signal?.throwIfAborted();
-  const { step: doctorStep, fixes } = await runDoctorStep(targetDir, options);
+  const doctorStep = await runDoctorStep(targetDir, options, fixes);
   record(doctorStep);
 
   if (options.preflight || options.preflightConnect) {
@@ -105,16 +132,38 @@ export async function checkApp(
     record(await scriptStep(targetDir, runner, script, scripts, options));
   }
 
+  options.signal?.throwIfAborted();
+  const end = await readGitSourceSnapshot({
+    cwd: targetDir,
+    signal: options.signal,
+  });
+  options.signal?.throwIfAborted();
+  const provenance = checkProvenance(start, end);
+
   return {
     schemaVersion: 1,
     targetDir,
     runner,
-    ok: steps.every((step) => step.status !== "failed"),
+    ok:
+      steps.every((step) => step.status !== "failed") &&
+      provenance.status !== "stale",
     fixes,
     steps,
+    provenance,
   };
 }
 
+async function resolveCheckTargetDir(cwd: string): Promise<string> {
+  const targetDir = path.resolve(cwd);
+  try {
+    return await realpath(targetDir);
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException).code;
+    if (code === "ENOENT" || code === "ENOTDIR") return targetDir;
+    throw error;
+  }
+}
+
 /**
  * Format a completed step as a single status line, with the failing step's
  * output indented underneath.
@@ -161,9 +210,35 @@ export function formatCheckSummary(
   const parts = [`${counts.passed} passed`];
   if (counts.failed > 0) parts.push(paint(`${counts.failed} failed`, "red"));
   if (counts.skipped > 0) parts.push(`${counts.skipped} skipped`);
+  if (result.provenance.status === "stale") {
+    parts.push(paint("source state stale", "red"));
+  }
   return parts.join(", ");
 }
 
+/** Format the source state captured before and after validation. */
+export function formatCheckProvenance(
+  result: CheckAppResult,
+  options: { color?: boolean } = {},
+): string {
+  const paint = createPainter(options.color);
+  const { provenance } = result;
+  if (provenance.status === "unavailable") {
+    return `${paint("-", "cyan")} Source provenance unavailable (not a Git worktree)`;
+  }
+  if (provenance.status === "stale") {
+    return `${paint("✗", "red")} Source state changed while checks were running; rerun beignet check`;
+  }
+  const snapshot = provenance.end;
+  if (snapshot.kind !== "git") {
+    throw new Error("Current check provenance must contain a Git snapshot.");
+  }
+  const head = snapshot.comparison.head
+    ? `HEAD ${snapshot.comparison.head.slice(0, 8)}`
+    : "unborn Git repository";
+  return `${paint("✓", "green")} Source state current (${head}, ${shortHash(snapshot.repositoryChangeHash)})`;
+}
+
 /**
  * Format a full result at once (JSON-free callers and tests).
  */
@@ -172,6 +247,7 @@ export function formatCheck(
   options: { color?: boolean } = {},
 ): string {
   const lines = result.steps.map((step) => formatCheckStep(step, options));
+  lines.push(formatCheckProvenance(result, options));
   return `${lines.join("\n")}\n\n${formatCheckSummary(result, options)}`;
 }
 
@@ -195,11 +271,9 @@ async function lintStep(
 async function runDoctorStep(
   targetDir: string,
   options: CheckAppOptions,
-): Promise<{ step: CheckStep; fixes: InspectFix[] }> {
+  fixes: InspectFix[],
+): Promise<CheckStep> {
   const startedAt = Date.now();
-  const fixes = options.fix
-    ? await applyDoctorFixes({ cwd: targetDir, strict: true })
-    : [];
   const result = await inspectApp({ cwd: targetDir, strict: true });
   result.fixes = fixes;
   const failed = result.diagnostics.some(
@@ -208,24 +282,40 @@ async function runDoctorStep(
   );
 
   return {
-    step: {
-      name: "beignet doctor --strict",
-      command: "beignet doctor --strict",
-      status: failed ? "failed" : "passed",
-      ...(fixes.length > 0
-        ? {
-            detail: `${fixes.length} ${fixes.length === 1 ? "fix" : "fixes"} applied`,
-          }
-        : {}),
-      ...(failed
-        ? { output: formatDoctor(result, { color: options.color }) }
-        : {}),
-      durationMs: Date.now() - startedAt,
-    },
-    fixes,
+    name: "beignet doctor --strict",
+    command: "beignet doctor --strict",
+    status: failed ? "failed" : "passed",
+    ...(fixes.length > 0
+      ? {
+          detail: `${fixes.length} ${fixes.length === 1 ? "fix" : "fixes"} applied`,
+        }
+      : {}),
+    ...(failed
+      ? { output: formatDoctor(result, { color: options.color }) }
+      : {}),
+    durationMs: Date.now() - startedAt,
   };
 }
 
+function checkProvenance(
+  start: GitSourceSnapshot,
+  end: GitSourceSnapshot,
+): CheckProvenance {
+  if (start.kind === "unavailable" && end.kind === "unavailable") {
+    return { status: "unavailable", start, end };
+  }
+  const current =
+    start.kind === "git" &&
+    end.kind === "git" &&
+    start.repositoryRoot === end.repositoryRoot &&
+    start.repositoryChangeHash === end.repositoryChangeHash;
+  return { status: current ? "current" : "stale", start, end };
+}
+
+function shortHash(hash: string): string {
+  return `${hash.slice(0, 15)}…`;
+}
+
 async function scriptStep(
   targetDir: string,
   runner: string,