@cairn-tool/cairn 2.0.0

package/dist/archive/sets.js

@@ -0,0 +1,344 @@
+/**
+ * What each provider leaves on disk that is worth keeping.
+ *
+ * This is data the archiver reads, exactly as `src/agent/targets/*.ts` is for
+ * the renderer and `ProviderCapabilities` is for the usage reports.
+ * `src/commands/archive.ts` must never branch on a provider name: a provider
+ * that stores plans somewhere unusual says so here, and adding a fourth
+ * assistant is a new entry in this list plus the usage provider it names.
+ *
+ * Selection is an **allowlist of directories**, not a filter over a whole home
+ * directory, and that is the design. `~/.claude` alone holds 340 MB of plugin
+ * payloads, a 71 MB downloaded binary, and a `jobs/` tree that on this machine
+ * was 343 MB of Rust build output — none of it conversation data, all of it
+ * things a blocklist would eventually fail to exclude. Walking only what is
+ * named here cannot pick them up by accident.
+ */
+export const ARTIFACT_CLASSES = ["plan", "artifact", "transcript", "log"];
+/** The classes `archive run` takes when `--include` is not given. */
+export const DEFAULT_CLASSES = ["plan", "artifact"];
+const isMarkdown = (relative) => relative.endsWith(".md");
+const segments = (relative) => relative.split("/");
+const under = (relative, directory) => segments(relative).includes(directory);
+/**
+ * Claude Code, under `~/.claude`.
+ *
+ * Note what is *not* here: `plugins/`, `downloads/`, `backups/`, `file-history/`
+ * and `jobs/`. The first four are re-downloadable or derived, and `jobs/` is a
+ * scratch tree for background work that on a real machine is dominated by
+ * compiler output.
+ */
+const CLAUDE_CODE = {
+    provider: "claude-code",
+    sets: [
+        {
+            id: "plans",
+            class: "plan",
+            description: "Plan documents written in plan mode",
+            root: "plans",
+            recursive: false,
+            match: isMarkdown,
+        },
+        {
+            id: "tool-results",
+            class: "artifact",
+            description: "Files tools produced: fetched PDFs, rendered pages, saved output",
+            root: "projects",
+            // Depth seven on a real corpus, which is deeper than the usage provider's
+            // own discovery walks — it descends only into `subagents/`.
+            recursive: true,
+            match: (relative) => under(relative, "tool-results"),
+        },
+        {
+            id: "memory",
+            class: "artifact",
+            description: "Per-project memory files",
+            root: "projects",
+            recursive: true,
+            match: (relative) => under(relative, "memory") && isMarkdown(relative),
+        },
+        {
+            id: "transcripts",
+            class: "transcript",
+            description: "Session and subagent transcripts",
+            root: "projects",
+            recursive: true,
+            match: (relative) => relative.endsWith(".jsonl") ||
+                (relative.endsWith(".meta.json") && segments(relative).at(-1).startsWith("agent-")),
+        },
+        {
+            id: "history",
+            class: "log",
+            description: "Prompt history and the daemon log",
+            root: "",
+            recursive: false,
+            match: (relative) => relative === "history.jsonl" || relative === "daemon.log",
+        },
+        {
+            id: "shell-snapshots",
+            class: "log",
+            description: "Captured shell environments",
+            root: "shell-snapshots",
+            recursive: false,
+            match: (relative) => relative.endsWith(".sh"),
+        },
+    ],
+};
+/** Codex, under `~/.codex`. Codex writes no plans. */
+const CODEX = {
+    provider: "codex",
+    sets: [
+        {
+            id: "computer-use",
+            class: "artifact",
+            description: "Screenshots and captures from computer-use sessions",
+            root: "computer-use",
+            recursive: true,
+            match: () => true,
+        },
+        {
+            id: "transcripts",
+            class: "transcript",
+            description: "Rollout transcripts",
+            root: "sessions",
+            recursive: true,
+            match: (relative) => segments(relative).at(-1).startsWith("rollout-") && relative.endsWith(".jsonl"),
+        },
+        {
+            id: "history",
+            class: "log",
+            description: "Prompt history",
+            root: "",
+            recursive: false,
+            match: (relative) => relative === "history.jsonl",
+        },
+        {
+            id: "databases",
+            class: "log",
+            description: "Thread history and log databases",
+            root: "",
+            recursive: false,
+            match: (relative) => relative.endsWith(".sqlite"),
+            snapshot: "sqlite",
+        },
+    ],
+};
+/**
+ * Antigravity, under `~/.gemini/antigravity-cli`.
+ *
+ * A conversation's `brain/<id>/` holds `.system_generated/` — the machinery — and,
+ * at its top level, whatever the session actually produced:
+ * `implementation_plan.md`, `walkthrough.md`, `task.md`, generated scripts. The
+ * two are told apart by that one directory name, which is why every set here
+ * tests for it rather than listing filenames.
+ */
+const ANTIGRAVITY = {
+    provider: "antigravity",
+    sets: [
+        {
+            id: "plans",
+            class: "plan",
+            description: "Implementation plans, walkthroughs, and task notes",
+            root: "brain",
+            recursive: true,
+            match: (relative) => !under(relative, ".system_generated") && isMarkdown(relative),
+        },
+        {
+            id: "outputs",
+            class: "artifact",
+            description: "Other files a conversation produced",
+            root: "brain",
+            recursive: true,
+            match: (relative) => !under(relative, ".system_generated") && !isMarkdown(relative),
+        },
+        {
+            id: "transcripts",
+            class: "transcript",
+            description: "Conversation transcripts",
+            root: "brain",
+            recursive: true,
+            // `transcript_full.jsonl` shares this schema and differs only in whether
+            // long strings are truncated, so archiving both would store the same
+            // conversation twice for no extra structural fact.
+            match: (relative) => relative.endsWith("/logs/transcript.jsonl"),
+        },
+        {
+            id: "history",
+            class: "log",
+            description: "Prompt history",
+            root: "",
+            recursive: false,
+            match: (relative) => relative === "history.jsonl",
+        },
+        {
+            id: "logs",
+            class: "log",
+            description: "CLI logs",
+            root: "log",
+            recursive: false,
+            match: (relative) => relative.endsWith(".log"),
+        },
+        {
+            id: "conversations",
+            class: "log",
+            description: "Conversation databases",
+            root: "conversations",
+            recursive: false,
+            // `-wal` and `-shm` are the live sidecars of the file next to them; the
+            // backup API folds their contents into the snapshot it produces.
+            match: (relative) => relative.endsWith(".db"),
+            snapshot: "sqlite",
+        },
+    ],
+};
+/**
+ * Gemini CLI, under `~/.gemini`.
+ *
+ * Every set is rooted at `tmp`, and that confinement is the point. `~/.gemini`
+ * is a shared tree: `antigravity-cli/` belongs to the other provider rooted
+ * here and would otherwise be archived twice, `antigravity/` is the IDE's store
+ * and is encrypted at rest, and `oauth_creds.json` is a credential. None of
+ * them is reachable from `tmp`.
+ *
+ * There is deliberately no catch-all under `tmp` either: the CLI downloads
+ * helper binaries into `tmp/bin/` — a 3.2 MB `rg` on this machine — beside the
+ * projects. Every matcher below requires a named directory segment, so nothing
+ * that is not conversation data can match one.
+ */
+const GEMINI_CLI = {
+    provider: "gemini-cli",
+    sets: [
+        {
+            id: "plans",
+            class: "plan",
+            description: "Plan documents",
+            root: "tmp",
+            recursive: true,
+            // <slug>/<session uuid>/plans/<name>.md — the directory name is the whole
+            // distinction, exactly as `.system_generated` is for Antigravity.
+            match: (relative) => under(relative, "plans") && isMarkdown(relative),
+        },
+        {
+            id: "tool-outputs",
+            class: "artifact",
+            description: "Captured tool output",
+            root: "tmp",
+            recursive: true,
+            match: (relative) => under(relative, "tool-outputs"),
+        },
+        {
+            id: "transcripts",
+            class: "transcript",
+            description: "Session and subagent chat transcripts",
+            root: "tmp",
+            recursive: true,
+            match: (relative) => under(relative, "chats") && relative.endsWith(".jsonl"),
+        },
+        {
+            id: "history",
+            class: "log",
+            description: "Prompt and slash-command history",
+            root: "tmp",
+            recursive: true,
+            // Depth-checked rather than matched on the basename, so that a `logs.json`
+            // written deeper in a project cannot be swept in as project history.
+            match: (relative) => segments(relative).length === 2 && segments(relative)[1] === "logs.json",
+        },
+    ],
+};
+/**
+ * OpenCode, under `$XDG_DATA_HOME/opencode` (default `~/.local/share/opencode`).
+ *
+ * The first provider whose entire transcript corpus lives inside a single
+ * `log`-class file: there is no per-session transcript to select, because the
+ * conversations are rows in `opencode.db`. Archiving the database archives them
+ * all, which is why that set is opt-in like every other transcript source.
+ */
+const OPENCODE = {
+    provider: "opencode",
+    sets: [
+        {
+            id: "session-diffs",
+            class: "artifact",
+            description: "Per-session file diffs",
+            root: "storage",
+            recursive: true,
+            match: (relative) => relative.endsWith(".json"),
+        },
+        {
+            id: "logs",
+            class: "log",
+            description: "CLI logs",
+            root: "log",
+            recursive: false,
+            match: (relative) => relative.endsWith(".log"),
+        },
+        {
+            id: "snapshots",
+            class: "log",
+            description: "Bare git repositories holding pre-edit file snapshots",
+            root: "snapshot",
+            recursive: true,
+            // Class `log` rather than `artifact`: this is an object store mirroring
+            // the working tree, the same category as Claude Code's `file-history/`,
+            // which is excluded outright. It is the only record of pre-edit state, so
+            // it is kept — but it must never land in a default run.
+            match: () => true,
+        },
+        {
+            id: "database",
+            class: "log",
+            description: "The session store: sessions, messages, parts, and projects",
+            root: "",
+            recursive: false,
+            // Exact equality, so the live `-wal` and `-shm` sidecars are never matched
+            // on their own; the backup API folds their contents into the snapshot.
+            match: (relative) => relative === "opencode.db",
+            snapshot: "sqlite",
+        },
+    ],
+};
+export const ARCHIVE_PROFILES = [
+    CLAUDE_CODE,
+    CODEX,
+    ANTIGRAVITY,
+    GEMINI_CLI,
+    OPENCODE,
+];
+export function profileFor(provider) {
+    return ARCHIVE_PROFILES.find((profile) => profile.provider === provider);
+}
+/** Parses `--include plans,transcripts` into the classes it names. */
+export function parseClasses(value) {
+    if (value === undefined)
+        return [...DEFAULT_CLASSES];
+    const names = value
+        .split(",")
+        .map((part) => part.trim())
+        .filter(Boolean);
+    if (names.length === 0)
+        throw new Error("--include needs at least one class");
+    // Plural spellings are what the classes are called on the command line, and
+    // singular is what a row reports, so both are accepted rather than making the
+    // caller remember which surface they are on.
+    const aliases = {
+        plan: "plan",
+        plans: "plan",
+        artifact: "artifact",
+        artifacts: "artifact",
+        transcript: "transcript",
+        transcripts: "transcript",
+        log: "log",
+        logs: "log",
+    };
+    const chosen = new Set();
+    for (const name of names) {
+        const resolved = aliases[name.toLowerCase()];
+        if (!resolved) {
+            throw new Error(`Invalid --include value: ${name} (expected ${ARTIFACT_CLASSES.map((c) => `${c}s`).join(", ")})`);
+        }
+        chosen.add(resolved);
+    }
+    return ARTIFACT_CLASSES.filter((name) => chosen.has(name));
+}
+//# sourceMappingURL=sets.js.map

package/dist/archive/sets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sets.js","sourceRoot":"","sources":["../../src/archive/sets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAYH,MAAM,CAAC,MAAM,gBAAgB,GAA6B,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;AAEpG,qEAAqE;AACrE,MAAM,CAAC,MAAM,eAAe,GAA6B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AA8B9E,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3E,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAY,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACrE,MAAM,KAAK,GAAG,CAAC,QAAgB,EAAE,SAAiB,EAAW,EAAE,CAC7D,QAAQ,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,WAAW,GAAmB;IAClC,QAAQ,EAAE,aAAa;IACvB,IAAI,EAAE;QACJ;YACE,EAAE,EAAE,OAAO;YACX,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,qCAAqC;YAClD,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,UAAU;SAClB;QACD;YACE,EAAE,EAAE,cAAc;YAClB,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,kEAAkE;YAC/E,IAAI,EAAE,UAAU;YAChB,0EAA0E;YAC1E,4DAA4D;YAC5D,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,CAAC;SACrD;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,0BAA0B;YACvC,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC;SACvE;QACD;YACE,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,YAAY;YACnB,WAAW,EAAE,kCAAkC;YAC/C,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAClB,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC3B,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;SACvF;QACD;YACE,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,mCAAmC;YAChD,IAAI,EAAE,EAAE;YACR,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,eAAe,IAAI,QAAQ,KAAK,YAAY;SAC/E;QACD;YACE,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,6BAA6B;YAC1C,IAAI,EAAE,iBAAiB;YACvB,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;SAC9C;KACF;CACF,CAAC;AAEF,sDAAsD;AACtD,MAAM,KAAK,GAAmB;IAC5B,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE;QACJ;YACE,EAAE,EAAE,cAAc;YAClB,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,qDAAqD;YAClE,IAAI,EAAE,cAAc;YACpB,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI;SAClB;QACD;YACE,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,YAAY;YACnB,WAAW,EAAE,qBAAqB;YAClC,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAClB,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACnF;QACD;YACE,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,gBAAgB;YAC7B,IAAI,EAAE,EAAE;YACR,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,eAAe;SAClD;QACD;YACE,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,kCAAkC;YAC/C,IAAI,EAAE,EAAE;YACR,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;YACjD,QAAQ,EAAE,QAAQ;SACnB;KACF;CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAmB;IAClC,QAAQ,EAAE,aAAa;IACvB,IAAI,EAAE;QACJ;YACE,EAAE,EAAE,OAAO;YACX,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,oDAAoD;YACjE,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,mBAAmB,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC;SACnF;QACD;YACE,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,qCAAqC;YAClD,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;SACpF;QACD;YACE,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,YAAY;YACnB,WAAW,EAAE,0BAA0B;YACvC,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI;YACf,yEAAyE;YACzE,qEAAqE;YACrE,mDAAmD;YACnD,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,wBAAwB,CAAC;SACjE;QACD;YACE,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,gBAAgB;YAC7B,IAAI,EAAE,EAAE;YACR,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,eAAe;SAClD;QACD;YACE,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,UAAU;YACvB,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC/C;QACD;YACE,EAAE,EAAE,eAAe;YACnB,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,wBAAwB;YACrC,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,KAAK;YAChB,wEAAwE;YACxE,iEAAiE;YACjE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC7C,QAAQ,EAAE,QAAQ;SACnB;KACF;CACF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,GAAmB;IACjC,QAAQ,EAAE,YAAY;IACtB,IAAI,EAAE;QACJ;YACE,EAAE,EAAE,OAAO;YACX,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,gBAAgB;YAC7B,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,IAAI;YACf,0EAA0E;YAC1E,kEAAkE;YAClE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC;SACtE;QACD;YACE,EAAE,EAAE,cAAc;YAClB,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,sBAAsB;YACnC,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,CAAC;SACrD;QACD;YACE,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,YAAY;YACnB,WAAW,EAAE,uCAAuC;YACpD,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC7E;QACD;YACE,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,kCAAkC;YAC/C,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,IAAI;YACf,2EAA2E;YAC3E,qEAAqE;YACrE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW;SAC9F;KACF;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,QAAQ,GAAmB;IAC/B,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE;QACJ;YACE,EAAE,EAAE,eAAe;YACnB,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,wBAAwB;YACrC,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;SAChD;QACD;YACE,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,UAAU;YACvB,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC/C;QACD;YACE,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,uDAAuD;YACpE,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,IAAI;YACf,wEAAwE;YACxE,wEAAwE;YACxE,0EAA0E;YAC1E,wDAAwD;YACxD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI;SAClB;QACD;YACE,EAAE,EAAE,UAAU;YACd,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,4DAA4D;YACzE,IAAI,EAAE,EAAE;YACR,SAAS,EAAE,KAAK;YAChB,2EAA2E;YAC3E,uEAAuE;YACvE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,aAAa;YAC/C,QAAQ,EAAE,QAAQ;SACnB;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAA8B;IACzD,WAAW;IACX,KAAK;IACL,WAAW;IACX,UAAU;IACV,QAAQ;CACT,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,KAAyB;IACpD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,KAAK;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAE9E,4EAA4E;IAC5E,8EAA8E;IAC9E,6CAA6C;IAC7C,MAAM,OAAO,GAAkC;QAC7C,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,UAAU;QACrB,UAAU,EAAE,YAAY;QACxB,WAAW,EAAE,YAAY;QACzB,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,KAAK;KACZ,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,cAAc,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjG,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/dist/archive/tar-read.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Reading a ustar archive.
+ *
+ * The counterpart to `src/agent/package/tar.ts`, which has only ever written.
+ * Kept in a separate module because an archive that can be read back is what
+ * makes the artifact store an archive rather than a write-only pile: `archive
+ * extract` and `archive verify --deep` both go through here.
+ *
+ * Only the ustar features the writer emits are handled — regular files,
+ * directories, and the `prefix` split for long paths. A PAX or GNU long-name
+ * header is reported rather than guessed at, because this reader's whole job is
+ * to say exactly what a segment contains.
+ */
+export interface TarMember {
+    /** Path inside the archive, with the `prefix` field rejoined. */
+    path: string;
+    mode: number;
+    size: number;
+    /** Byte offset of the member's *data* within the uncompressed archive. */
+    offset: number;
+    directory: boolean;
+}
+export declare class TarFormatError extends Error {
+    constructor(message: string);
+}
+/**
+ * Lists what an uncompressed archive holds, without copying any file data.
+ *
+ * The offsets this returns are what the archive index stores, so a later
+ * extraction can decompress a segment and slice straight to one member rather
+ * than walking every header again.
+ */
+export declare function listMembers(tar: Buffer): TarMember[];
+/** The bytes of one member, from the uncompressed archive it was listed in. */
+export declare function readMember(tar: Buffer, member: TarMember): Buffer;

package/dist/archive/tar-read.js

@@ -0,0 +1,90 @@
+/**
+ * Reading a ustar archive.
+ *
+ * The counterpart to `src/agent/package/tar.ts`, which has only ever written.
+ * Kept in a separate module because an archive that can be read back is what
+ * makes the artifact store an archive rather than a write-only pile: `archive
+ * extract` and `archive verify --deep` both go through here.
+ *
+ * Only the ustar features the writer emits are handled — regular files,
+ * directories, and the `prefix` split for long paths. A PAX or GNU long-name
+ * header is reported rather than guessed at, because this reader's whole job is
+ * to say exactly what a segment contains.
+ */
+const BLOCK = 512;
+export class TarFormatError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "TarFormatError";
+    }
+}
+function cstring(block, start, length) {
+    const slice = block.subarray(start, start + length);
+    const end = slice.indexOf(0);
+    return slice.subarray(0, end === -1 ? slice.length : end).toString("utf8");
+}
+function octal(block, start, length) {
+    const text = cstring(block, start, length).trim();
+    if (!text)
+        return 0;
+    const value = Number.parseInt(text, 8);
+    if (!Number.isFinite(value))
+        throw new TarFormatError(`Malformed octal field: ${text}`);
+    return value;
+}
+function isZero(block) {
+    for (const byte of block)
+        if (byte !== 0)
+            return false;
+    return true;
+}
+/**
+ * Lists what an uncompressed archive holds, without copying any file data.
+ *
+ * The offsets this returns are what the archive index stores, so a later
+ * extraction can decompress a segment and slice straight to one member rather
+ * than walking every header again.
+ */
+export function listMembers(tar) {
+    const members = [];
+    let position = 0;
+    while (position + BLOCK <= tar.length) {
+        const header = tar.subarray(position, position + BLOCK);
+        if (isZero(header))
+            break; // End-of-archive marker.
+        const magic = cstring(header, 257, 6);
+        if (magic !== "ustar") {
+            throw new TarFormatError(`Not a ustar header at offset ${position}: magic ${magic || "(none)"}`);
+        }
+        const type = cstring(header, 156, 1) || "0";
+        if (type !== "0" && type !== "" && type !== "5") {
+            throw new TarFormatError(`Unsupported ustar entry type ${type} at offset ${position}`);
+        }
+        const name = cstring(header, 0, 100);
+        const prefix = cstring(header, 345, 155);
+        const size = octal(header, 124, 12);
+        const directory = type === "5";
+        const joined = prefix ? `${prefix}/${name}` : name;
+        members.push({
+            // The writer appends a slash to a directory entry's name; drop it so the
+            // path matches what an entry list would have called it.
+            path: directory ? joined.replace(/\/+$/, "") : joined,
+            mode: octal(header, 100, 8),
+            size,
+            offset: position + BLOCK,
+            directory,
+        });
+        const padded = Math.ceil(size / BLOCK) * BLOCK;
+        position += BLOCK + (directory ? 0 : padded);
+    }
+    return members;
+}
+/** The bytes of one member, from the uncompressed archive it was listed in. */
+export function readMember(tar, member) {
+    const end = member.offset + member.size;
+    if (end > tar.length) {
+        throw new TarFormatError(`Member ${member.path} runs past the end of the archive (${end} > ${tar.length})`);
+    }
+    return tar.subarray(member.offset, end);
+}
+//# sourceMappingURL=tar-read.js.map

package/dist/archive/tar-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar-read.js","sourceRoot":"","sources":["../../src/archive/tar-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,KAAK,GAAG,GAAG,CAAC;AAYlB,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,KAAa,EAAE,MAAc;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,KAAK,CAAC,KAAa,EAAE,KAAa,EAAE,MAAc;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC;IACpB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,OAAO,QAAQ,GAAG,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,yBAAyB;QAEpD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CACtB,gCAAgC,QAAQ,WAAW,KAAK,IAAI,QAAQ,EAAE,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC;QAC5C,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAChD,MAAM,IAAI,cAAc,CAAC,gCAAgC,IAAI,cAAc,QAAQ,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,KAAK,GAAG,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAEnD,OAAO,CAAC,IAAI,CAAC;YACX,yEAAyE;YACzE,wDAAwD;YACxD,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM;YACrD,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3B,IAAI;YACJ,MAAM,EAAE,QAAQ,GAAG,KAAK;YACxB,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;QAC/C,QAAQ,IAAI,KAAK,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,MAAiB;IACvD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IACxC,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,cAAc,CACtB,UAAU,MAAM,CAAC,IAAI,sCAAsC,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC"}

package/dist/audit-baseline.d.ts

@@ -0,0 +1,66 @@
+import type { Issue } from "./types.js";
+/** The discriminator every document this module writes carries. */
+export declare const BASELINE_FORMAT = "cairn-md-audit-baseline";
+/** The pre-rename discriminator, still accepted on committed baselines. */
+export declare const LEGACY_BASELINE_FORMAT = "claude-cli-md-audit-baseline";
+/** True for a document either spelling of this tool wrote. */
+export declare function isBaselineFormat(value: unknown): boolean;
+/** The structure version of the baseline document, not the package version. */
+export declare const BASELINE_VERSION = "1";
+export interface BaselineEntry {
+    checker: string;
+    /** Workspace-relative, with `/` separators. */
+    file: string;
+    message: string;
+    /** How many times the finding was recorded, so a new duplicate still fails. */
+    count: number;
+}
+export interface BaselineDocument {
+    baselineFormat?: string;
+    version?: string;
+    generator?: {
+        name: string;
+        version: string;
+    };
+    entries?: BaselineEntry[];
+}
+export interface BaselineApplication {
+    kept: Issue[];
+    suppressed: number;
+    matched: number;
+    /** Entries that matched nothing, reported but never blocking. */
+    stale: BaselineEntry[];
+    /** True when the document is not one this tool wrote. */
+    foreign: boolean;
+}
+/**
+ * Workspace-relative, `/`-separated.
+ *
+ * A baseline holding absolute paths would match nothing after a checkout into
+ * a different directory, which is the normal case in CI.
+ */
+export declare function baselinePath(file: string, root: string): string;
+/**
+ * Reads a baseline document.
+ *
+ * A missing or unparseable file throws, matching how `agent audit --baseline`
+ * treats a path that is not there. A *foreign* document is reported as a
+ * finding by `applyBaseline` instead, because guessing at another tool's schema
+ * would produce suppression nobody can trust.
+ */
+export declare function readBaseline(file: string): BaselineDocument;
+/** Builds the document `--write-baseline` records. */
+export declare function buildBaseline(findings: readonly Issue[], root: string, generator: {
+    name: string;
+    version: string;
+}): BaselineDocument;
+/**
+ * Partitions findings into those the baseline already recorded and those it did
+ * not.
+ *
+ * Findings are consumed in the order given, so with a baseline `count` of one
+ * and two matching findings the first is suppressed and the second reported.
+ */
+export declare function applyBaseline(findings: readonly Issue[], document: BaselineDocument, root: string): BaselineApplication;
+/** Writes a baseline document, replacing any existing one. */
+export declare function writeBaseline(file: string, document: BaselineDocument): void;