@claude-flow/cli 3.7.0-alpha.8 → 3.7.0-alpha.81

package/dist/src/commands/benchmark-verify.js

@@ -0,0 +1,202 @@
+/**
+ * ADR-121 Phase 25 — `ruflo benchmark verify` CLI subcommand.
+ *
+ * Makes the Phase 15-24 witness story end-user-accessible. Anyone
+ * publishing benchmark numbers with a witness manifest (single
+ * `.json`) or a chained ledger (`bench-witness/ledger.json`) can
+ * tell consumers:
+ *
+ *   npx ruflo benchmark verify ./ledger.json
+ *
+ * The command auto-detects whether the input is a single witness or
+ * a ledger (presence of `version` + `entries[]` → ledger), runs the
+ * appropriate verifier, and prints a human-readable or JSON report.
+ *
+ * For Phase 24 multi-signer entries, pass `--threshold N` to require
+ * N or more valid signatures per entry.
+ */
+import { promises as fs } from 'node:fs';
+import { resolve } from 'node:path';
+import { output } from '../output.js';
+function isLedger(parsed) {
+    return typeof parsed.version === 'number' && Array.isArray(parsed.entries);
+}
+function isWrappedWitness(parsed) {
+    return parsed.witness !== undefined && typeof parsed.witness === 'object';
+}
+function isRawWitness(parsed) {
+    return typeof parsed.contentHash === 'string' && typeof parsed.signature === 'string';
+}
+export const benchmarkVerifyCommand = {
+    name: 'verify',
+    description: 'Verify a benchmark witness manifest or chained ledger via the published @claude-flow/embeddings cryptographic primitives',
+    options: [
+        {
+            name: 'threshold',
+            short: 't',
+            type: 'number',
+            description: 'Phase 24 M-of-N: minimum signatures required per entry. Default 1.',
+            default: '1',
+        },
+        {
+            name: 'json',
+            type: 'boolean',
+            description: 'Output JSON instead of human-readable',
+            default: 'false',
+        },
+    ],
+    examples: [
+        { command: 'ruflo benchmark verify ./bench-witness/ledger.json', description: 'Verify a chained ledger' },
+        { command: 'ruflo benchmark verify ./bench-witness/rag-real-text-*.json', description: 'Verify a single witness manifest' },
+        { command: 'ruflo benchmark verify ledger.json --threshold 3', description: 'Require ≥3 signatures per entry (M-of-N)' },
+        { command: 'ruflo benchmark verify ledger.json --json', description: 'Machine-readable output for CI gating' },
+    ],
+    action: async (ctx) => {
+        const pathArg = ctx.args[0];
+        const threshold = Number(ctx.flags.threshold ?? 1);
+        const asJson = ctx.flags.json === true || ctx.flags.json === 'true';
+        if (!pathArg || typeof pathArg !== 'string') {
+            const err = 'usage: ruflo benchmark verify <path-to-ledger.json-or-witness.json> [--threshold N] [--json]';
+            if (asJson)
+                output.printJson({ ok: false, error: err });
+            else
+                output.printError(err);
+            return { success: false, exitCode: 1 };
+        }
+        if (!Number.isFinite(threshold) || threshold < 1) {
+            const err = `--threshold must be a positive integer, got: ${ctx.flags.threshold}`;
+            if (asJson)
+                output.printJson({ ok: false, error: err });
+            else
+                output.printError(err);
+            return { success: false, exitCode: 1 };
+        }
+        const absPath = resolve(process.cwd(), pathArg);
+        let raw;
+        try {
+            raw = await fs.readFile(absPath, 'utf8');
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (asJson)
+                output.printJson({ ok: false, error: `cannot read ${absPath}: ${msg}` });
+            else
+                output.printError(`Cannot read ${absPath}: ${msg}`);
+            return { success: false, exitCode: 1 };
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (asJson)
+                output.printJson({ ok: false, error: `not valid JSON: ${msg}` });
+            else
+                output.printError(`Not valid JSON: ${msg}`);
+            return { success: false, exitCode: 1 };
+        }
+        // Lazy-import the embeddings verifiers so the CLI startup stays fast
+        // when this command isn't used.
+        const { verify } = await import('@claude-flow/embeddings/witness');
+        const { verifyLedger, verifyEntry } = await import('@claude-flow/embeddings/witness-ledger');
+        // === Path 1: chained ledger ===
+        if (isLedger(parsed)) {
+            const ledger = parsed;
+            const result = verifyLedger(ledger, { minSignatures: threshold });
+            if (asJson) {
+                output.printJson({
+                    ok: result.valid,
+                    kind: 'ledger',
+                    entryCount: result.entryCount,
+                    firstFailureAt: result.firstFailureAt,
+                    reason: result.reason,
+                    threshold,
+                    path: absPath,
+                });
+                return { success: result.valid, exitCode: result.valid ? 0 : 1 };
+            }
+            output.writeln();
+            output.writeln(output.bold(`Ledger verification (${absPath})`));
+            output.writeln(output.dim('─'.repeat(60)));
+            output.writeln(`  entries:        ${result.entryCount}`);
+            output.writeln(`  threshold:      minSignatures = ${threshold}`);
+            output.writeln(`  verifyLedger(): ${result.valid ? output.success('TRUE') : output.error('FALSE')}`);
+            if (!result.valid) {
+                output.writeln(`  failure at:     entry ${result.firstFailureAt}`);
+                output.writeln(`  reason:         ${result.reason}`);
+            }
+            // Per-entry summary table
+            const entries = ledger.entries;
+            output.writeln();
+            output.writeln('  per-entry:');
+            for (const e of entries) {
+                const cosigCount = Array.isArray(e.cosignatures) ? e.cosignatures.length : 0;
+                const ok = verifyEntry(e, { minSignatures: threshold });
+                const verdict = ok ? output.success('✓') : output.error('✗');
+                const hashShort = e.contentHash.slice(0, 12) + '…';
+                output.writeln(`    [${String(e.sequence).padStart(2)}] ${e.benchmark.padEnd(28)} sigs=${1 + cosigCount}  ${hashShort}  ${verdict}`);
+            }
+            output.writeln();
+            return { success: result.valid, exitCode: result.valid ? 0 : 1 };
+        }
+        // === Path 2: wrapped single witness (the bench scripts' output shape) ===
+        if (isWrappedWitness(parsed)) {
+            const w = parsed.witness;
+            const ok = verify(w);
+            if (asJson) {
+                output.printJson({
+                    ok,
+                    kind: 'witness',
+                    benchmark: w.benchmark,
+                    contentHash: w.contentHash,
+                    path: absPath,
+                });
+                return { success: ok, exitCode: ok ? 0 : 1 };
+            }
+            output.writeln();
+            output.writeln(output.bold(`Witness verification (${absPath})`));
+            output.writeln(output.dim('─'.repeat(60)));
+            output.writeln(`  benchmark:    ${w.benchmark}`);
+            output.writeln(`  contentHash:  ${w.contentHash}`);
+            output.writeln(`  signature:    ${w.signature.slice(0, 32)}...`);
+            output.writeln(`  publicKey:    ${w.publicKey.slice(0, 32)}...`);
+            output.writeln(`  algorithm:    ${w.signatureAlgorithm}`);
+            output.writeln(`  verify():     ${ok ? output.success('TRUE') : output.error('FALSE')}`);
+            output.writeln();
+            return { success: ok, exitCode: ok ? 0 : 1 };
+        }
+        // === Path 3: raw single witness (top-level fields, no wrapper) ===
+        if (isRawWitness(parsed)) {
+            const w = parsed;
+            const ok = verify(w);
+            if (asJson) {
+                output.printJson({
+                    ok,
+                    kind: 'witness-raw',
+                    benchmark: w.benchmark,
+                    contentHash: w.contentHash,
+                    path: absPath,
+                });
+                return { success: ok, exitCode: ok ? 0 : 1 };
+            }
+            output.writeln();
+            output.writeln(output.bold(`Witness verification (${absPath})`));
+            output.writeln(output.dim('─'.repeat(60)));
+            output.writeln(`  benchmark:    ${w.benchmark}`);
+            output.writeln(`  contentHash:  ${w.contentHash}`);
+            output.writeln(`  verify():     ${ok ? output.success('TRUE') : output.error('FALSE')}`);
+            output.writeln();
+            return { success: ok, exitCode: ok ? 0 : 1 };
+        }
+        // === Path 4: unknown shape ===
+        const err = `unrecognized file shape — expected a benchmark ledger ({version, entries}), a wrapped witness ({witness: {...}}), or a raw witness ({contentHash, signature, publicKey})`;
+        if (asJson)
+            output.printJson({ ok: false, error: err, path: absPath });
+        else
+            output.printError(err);
+        return { success: false, exitCode: 1 };
+    },
+};
+export default benchmarkVerifyCommand;
+//# sourceMappingURL=benchmark-verify.js.map

package/dist/src/commands/benchmark-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"benchmark-verify.js","sourceRoot":"","sources":["../../../src/commands/benchmark-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAyBtC,SAAS,QAAQ,CAAC,MAAiB;IACjC,OAAO,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC7E,CAAC;AACD,SAAS,gBAAgB,CAAC,MAAiB;IACzC,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC;AAC5E,CAAC;AACD,SAAS,YAAY,CAAC,MAAiB;IACrC,OAAO,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC;AACxF,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAY;IAC7C,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,0HAA0H;IACvI,OAAO,EAAE;QACP;YACE,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,GAAG;YACV,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,oEAAoE;YACjF,OAAO,EAAE,GAAG;SACb;QACD;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,uCAAuC;YACpD,OAAO,EAAE,OAAO;SACjB;KACF;IACD,QAAQ,EAAE;QACR,EAAE,OAAO,EAAE,oDAAoD,EAAE,WAAW,EAAE,yBAAyB,EAAE;QACzG,EAAE,OAAO,EAAE,6DAA6D,EAAE,WAAW,EAAE,kCAAkC,EAAE;QAC3H,EAAE,OAAO,EAAE,kDAAkD,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACxH,EAAE,OAAO,EAAE,2CAA2C,EAAE,WAAW,EAAE,uCAAuC,EAAE;KAC/G;IACD,MAAM,EAAE,KAAK,EAAE,GAAmB,EAA0B,EAAE;QAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;QAEpE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,8FAA8F,CAAC;YAC3G,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;;gBACnD,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,gDAAgD,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAClF,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;;gBACnD,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;QAEhD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,OAAO,KAAK,GAAG,EAAE,EAAE,CAAC,CAAC;;gBAChF,MAAM,CAAC,UAAU,CAAC,eAAe,OAAO,KAAK,GAAG,EAAE,CAAC,CAAC;YACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzC,CAAC;QAED,IAAI,MAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,GAAG,EAAE,EAAE,CAAC,CAAC;;gBACxE,MAAM,CAAC,UAAU,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;YACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzC,CAAC;QAED,qEAAqE;QACrE,gCAAgC;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QACnE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,wCAAwC,CAAC,CAAC;QAE7F,iCAAiC;QACjC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,CAAC;YACtB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAe,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;YAC3E,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,SAAS,CAAC;oBACf,EAAE,EAAE,MAAM,CAAC,KAAK;oBAChB,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,SAAS;oBACT,IAAI,EAAE,OAAO;iBACd,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,OAAO,GAAG,CAAC,CAAC,CAAC;YAChE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,OAAO,CAAC,qBAAqB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YACzD,MAAM,CAAC,OAAO,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACrG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,CAAC,OAAO,CAAC,2BAA2B,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;gBACnE,MAAM,CAAC,OAAO,CAAC,qBAAqB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACvD,CAAC;YACD,0BAA0B;YAC1B,MAAM,OAAO,GAAI,MAAM,CAAC,OAAyG,CAAC;YAClI,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7E,MAAM,EAAE,GAAG,WAAW,CAAC,CAAU,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;gBACjE,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;gBACnD,MAAM,CAAC,OAAO,CAAC,QAAQ,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,UAAU,KAAK,SAAS,KAAK,OAAO,EAAE,CAAC,CAAC;YACvI,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,CAAC;QAED,2EAA2E;QAC3E,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAQ,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAU,CAAC,CAAC;YAC9B,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,SAAS,CAAC;oBACf,EAAE;oBACF,IAAI,EAAE,SAAS;oBACf,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,IAAI,EAAE,OAAO;iBACd,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,OAAO,GAAG,CAAC,CAAC,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACjD,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACnD,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC;YAC1D,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACzF,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,CAAC;QAED,oEAAoE;QACpE,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAyC,CAAC;YACpD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAU,CAAC,CAAC;YAC9B,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,SAAS,CAAC;oBACf,EAAE;oBACF,IAAI,EAAE,aAAa;oBACnB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,IAAI,EAAE,OAAO;iBACd,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,OAAO,GAAG,CAAC,CAAC,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACjD,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACnD,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACzF,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,CAAC;QAED,gCAAgC;QAChC,MAAM,GAAG,GAAG,0KAA0K,CAAC;QACvL,IAAI,MAAM;YAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;;YAClE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzC,CAAC;CACF,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/src/commands/daemon.d.ts

@@ -3,6 +3,26 @@
  * Manages background worker daemon (Node.js-based, similar to shell helpers)
  */
 import type { Command } from '../types.js';
+/**
+ * #1914: Resolve the `--workspace` flag to an absolute path, or return null
+ * if it is absent / not a usable string. Rejects values with null bytes or
+ * shell metacharacters (defence-in-depth — the value is later embedded in a
+ * forked child's argv and compared against `ps`/`tasklist` output).
+ */
+export declare function resolveWorkspaceFlag(raw: unknown): string | null;
+/**
+ * #1914: True when a process command line (from `ps -eo command` on POSIX or
+ * the tasklist Window Title column on Windows) belongs to a daemon started
+ * for `workspaceRoot`. The launcher (`startBackgroundDaemon`) always appends
+ * `--workspace <root>` as the FINAL argv entry, so an exact trailing match
+ * after stripping trailing whitespace/quotes is unambiguous — even for
+ * workspace paths containing spaces — and never a bare path-prefix match,
+ * so workspace `/a/proj` does not reap `/a/proj-other`'s daemon. A daemon
+ * whose argv puts `--workspace` mid-list (only possible via a hand-rolled
+ * invocation) simply won't be auto-reaped — `daemon stop` still handles it
+ * via the PID file.
+ */
+export declare function daemonCommandLineBelongsToWorkspace(commandLine: string, workspaceRoot: string): boolean;
 export declare const daemonCommand: Command;
 export default daemonCommand;
 //# sourceMappingURL=daemon.d.ts.map

package/dist/src/commands/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../../src/commands/daemon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAiC,MAAM,aAAa,CAAC;AAyuB1E,eAAO,MAAM,aAAa,EAAE,OA6D3B,CAAC;AAEF,eAAe,aAAa,CAAC"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../../src/commands/daemon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAiC,MAAM,aAAa,CAAC;AA2O1E;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAMhE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mCAAmC,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAEvG;AAq0BD,eAAO,MAAM,aAAa,EAAE,OA+D3B,CAAC;AAEF,eAAe,aAAa,CAAC"}