@codyswann/lisa 4.17.5 → 4.17.7

package/dist/core/reconciliation-report.d.ts

@@ -0,0 +1,100 @@
+/** Directory-relative location of the report, for messages and gitignores. */
+export declare const RECONCILIATION_REPORT_DISPLAY_PATH = ".lisa/reconciliation-report.json";
+/**
+ * Report schema version. Bump only alongside a reader change — an unknown
+ * version is treated as no report at all rather than being misread.
+ */
+export declare const RECONCILIATION_REPORT_SCHEMA_VERSION = 1;
+/**
+ * What the reconciliation ended up doing.
+ *
+ * The two non-terminal values are the load-bearing ones. `scheduled` is written
+ * by the parent apply before the spawn; `started` is written by the detached
+ * child as its very first act. A report that never advances past `scheduled`
+ * means the child never ran; one stuck at `started` means it ran and died. Both
+ * used to look identical to success.
+ */
+export type ReconciliationOutcome = 
+/** Parent recorded the intent; no child has reported yet. */
+"scheduled"
+/** The detached child is alive and waiting for the package manager to exit. */
+ | "started"
+/** The parent apply could not spawn the child at all. */
+ | "spawn-failed"
+/** The child gave up waiting for the package manager and deliberately did not re-apply. */
+ | "parent-wait-timed-out"
+/** The child ran and found package.json matching its pre-apply baseline: no lockfile can be stale. */
+ | "not-needed"
+/** Every detected lockfile was regenerated successfully. */
+ | "regenerated"
+/** The child started but did not finish: a regen command failed, or it aborted. */
+ | "failed";
+/** Outcomes that mean the reconciliation finished and nothing is outstanding. */
+export declare const SETTLED_RECONCILIATION_OUTCOMES: readonly ReconciliationOutcome[];
+/** Outcomes that mean a child has not yet reported a terminal result. */
+export declare const PENDING_RECONCILIATION_OUTCOMES: readonly ReconciliationOutcome[];
+/** The persisted `.lisa/reconciliation-report.json` shape. */
+export interface ReconciliationReport {
+    readonly schema_version: number;
+    /** Lisa version whose apply scheduled the reconciliation. */
+    readonly lisa_version: string;
+    /** Where the reconciliation got to. */
+    readonly outcome: ReconciliationOutcome;
+    /** ISO timestamp of the parent apply that scheduled it. */
+    readonly scheduled_at: string;
+    /** ISO timestamp of the most recent write — the age that makes a stall visible. */
+    readonly updated_at: string;
+    /** Package managers whose lockfiles the child regenerated (or tried to). */
+    readonly package_managers: readonly string[];
+    /** One operator-readable sentence about this outcome. */
+    readonly detail: string;
+}
+/**
+ * Resolve the single path every reader and writer uses.
+ * @param root - Project root
+ * @returns Absolute path to the report
+ */
+export declare function resolveReconciliationReportPath(root: string): string;
+/**
+ * Read the report, returning null when it is missing, unparseable, or written
+ * by a schema this build does not understand.
+ * @param root - Project root
+ * @returns The report, or null when there is no usable one
+ */
+export declare function readReconciliationReport(root: string): Promise<ReconciliationReport | null>;
+/**
+ * Write a report.
+ *
+ * Written atomically (temp file plus rename) so a reader never sees a partial
+ * document, and never throws: a report that could not be written must not turn
+ * a successful install into a failed one. That is the same trade the apply
+ * receipt makes, and for the same reason — the cost of a missing record is one
+ * doctor blind spot, the cost of throwing here is breaking installs.
+ * @param root - Project root being reconciled
+ * @param report - The record to persist
+ * @returns True when the report was persisted
+ */
+export declare function writeReconciliationReport(root: string, report: ReconciliationReport): Promise<boolean>;
+/**
+ * Record that a reconciliation is about to be spawned.
+ *
+ * Written by the PARENT apply, before the spawn, precisely so that a spawn which
+ * never produces a child still leaves a trace. Without this write there is
+ * nothing on disk at all when the trampoline fails to launch, which is one of
+ * the two failure modes #2750 could not tell apart.
+ * @param root - Project root being reconciled
+ * @param lisaVersion - Lisa version running the apply
+ * @param now - Clock, injectable for tests
+ * @returns True when the report was persisted
+ */
+export declare function recordReconciliationScheduled(root: string, lisaVersion: string, now?: () => Date): Promise<boolean>;
+/**
+ * Record that the parent apply could not spawn the reconciliation child.
+ * @param root - Project root being reconciled
+ * @param lisaVersion - Lisa version running the apply
+ * @param message - The spawn error, verbatim
+ * @param now - Clock, injectable for tests
+ * @returns True when the report was persisted
+ */
+export declare function recordReconciliationSpawnFailure(root: string, lisaVersion: string, message: string, now?: () => Date): Promise<boolean>;
+//# sourceMappingURL=reconciliation-report.d.ts.map

package/dist/core/reconciliation-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconciliation-report.d.ts","sourceRoot":"","sources":["../../src/core/reconciliation-report.ts"],"names":[],"mappings":"AAiCA,8EAA8E;AAC9E,eAAO,MAAM,kCAAkC,qCACX,CAAC;AAErC;;;GAGG;AACH,eAAO,MAAM,oCAAoC,IAAI,CAAC;AAEtD;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB;AAC/B,6DAA6D;AAC3D,WAAW;AACb,+EAA+E;GAC7E,SAAS;AACX,yDAAyD;GACvD,cAAc;AAChB,2FAA2F;GACzF,uBAAuB;AACzB,sGAAsG;GACpG,YAAY;AACd,4DAA4D;GAC1D,aAAa;AACf,mFAAmF;GACjF,QAAQ,CAAC;AAEb,iFAAiF;AACjF,eAAO,MAAM,+BAA+B,EAAE,SAAS,qBAAqB,EAC7C,CAAC;AAEhC,yEAAyE;AACzE,eAAO,MAAM,+BAA+B,EAAE,SAAS,qBAAqB,EAClD,CAAC;AAY3B,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAyBD;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAuBtC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,MAAM,IAAuB,GACjC,OAAO,CAAC,OAAO,CAAC,CAalB;AAED;;;;;;;GAOG;AACH,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,MAAM,IAAuB,GACjC,OAAO,CAAC,OAAO,CAAC,CAWlB"}

package/dist/core/reconciliation-report.js

@@ -0,0 +1,178 @@
+/**
+ * The durable record of what the lockfile-reconciliation trampoline actually did.
+ *
+ * `lisa apply` runs from a host project's `postinstall`, which means bun (and
+ * every other package manager) writes the lockfile BEFORE apply rewrites
+ * package.json. The detached trampoline exists to close that gap: it waits for
+ * the package manager to exit, re-applies, and regenerates the lockfiles.
+ *
+ * It runs with `stdio: "ignore"` — it has to, because it outlives the terminal
+ * that started it — and its regen step swallows failures on purpose, because a
+ * missing package-manager binary must never cascade into a failed install. Both
+ * are correct, and together they made the control indistinguishable from its own
+ * failure: a trampoline that never spawned, one that died on arrival, and one
+ * that ran and correctly did nothing all produced exactly the same evidence,
+ * which is none (CodySwannGT/lisa#2750). The only signal anyone could use was
+ * the apply receipt, and only because it happens to be written for an unrelated
+ * reason.
+ *
+ * So the trampoline now reports. The parent records `scheduled` before it
+ * spawns; the child records `started` as its first act, which is what separates
+ * "never spawned" from "spawned and died"; and the child records a terminal
+ * outcome naming what it regenerated or why it could not. A report still sitting
+ * at `scheduled` or `started` long after it was written is a reconciliation that
+ * never landed, and `lisa doctor` says so (see `cli/doctor-reconciliation`).
+ *
+ * Machine-local and gitignored for the same reason as the apply receipt: it
+ * describes this checkout's last install, not the project.
+ * @module core/reconciliation-report
+ */
+import { mkdir, rename, writeFile } from "node:fs/promises";
+import * as path from "node:path";
+import { readJsonOrNull } from "../utils/json-utils.js";
+/** Directory-relative location of the report, for messages and gitignores. */
+export const RECONCILIATION_REPORT_DISPLAY_PATH = ".lisa/reconciliation-report.json";
+/**
+ * Report schema version. Bump only alongside a reader change — an unknown
+ * version is treated as no report at all rather than being misread.
+ */
+export const RECONCILIATION_REPORT_SCHEMA_VERSION = 1;
+/** Outcomes that mean the reconciliation finished and nothing is outstanding. */
+export const SETTLED_RECONCILIATION_OUTCOMES = ["not-needed", "regenerated"];
+/** Outcomes that mean a child has not yet reported a terminal result. */
+export const PENDING_RECONCILIATION_OUTCOMES = ["scheduled", "started"];
+const KNOWN_OUTCOMES = [
+    "scheduled",
+    "started",
+    "spawn-failed",
+    "parent-wait-timed-out",
+    "not-needed",
+    "regenerated",
+    "failed",
+];
+/**
+ * Narrow a persisted outcome, treating anything unrecognised as `scheduled`.
+ *
+ * Deliberately the most alarming reading rather than the most reassuring one: a
+ * report this build cannot interpret is exactly the case where claiming the
+ * reconciliation succeeded would restore the silence this file exists to end.
+ * @param value - Raw value from the report
+ * @returns A known outcome
+ */
+function toOutcome(value) {
+    return KNOWN_OUTCOMES.find(outcome => outcome === value) ?? "scheduled";
+}
+/**
+ * Narrow the recorded package-manager list, dropping anything non-string.
+ * @param value - Raw value from the report
+ * @returns The recorded managers, or an empty list
+ */
+function toPackageManagers(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((entry) => typeof entry === "string");
+}
+/**
+ * Resolve the single path every reader and writer uses.
+ * @param root - Project root
+ * @returns Absolute path to the report
+ */
+export function resolveReconciliationReportPath(root) {
+    return path.join(root, ".lisa", "reconciliation-report.json");
+}
+/**
+ * Read the report, returning null when it is missing, unparseable, or written
+ * by a schema this build does not understand.
+ * @param root - Project root
+ * @returns The report, or null when there is no usable one
+ */
+export async function readReconciliationReport(root) {
+    const parsed = await readJsonOrNull(resolveReconciliationReportPath(root));
+    if (parsed?.schema_version !== RECONCILIATION_REPORT_SCHEMA_VERSION ||
+        typeof parsed.lisa_version !== "string" ||
+        typeof parsed.scheduled_at !== "string") {
+        return null;
+    }
+    return {
+        schema_version: parsed.schema_version,
+        lisa_version: parsed.lisa_version,
+        outcome: toOutcome(parsed.outcome),
+        scheduled_at: parsed.scheduled_at,
+        updated_at: typeof parsed.updated_at === "string"
+            ? parsed.updated_at
+            : parsed.scheduled_at,
+        package_managers: toPackageManagers(parsed.package_managers),
+        detail: typeof parsed.detail === "string" ? parsed.detail : "",
+    };
+}
+/**
+ * Write a report.
+ *
+ * Written atomically (temp file plus rename) so a reader never sees a partial
+ * document, and never throws: a report that could not be written must not turn
+ * a successful install into a failed one. That is the same trade the apply
+ * receipt makes, and for the same reason — the cost of a missing record is one
+ * doctor blind spot, the cost of throwing here is breaking installs.
+ * @param root - Project root being reconciled
+ * @param report - The record to persist
+ * @returns True when the report was persisted
+ */
+export async function writeReconciliationReport(root, report) {
+    const reportPath = resolveReconciliationReportPath(root);
+    try {
+        await mkdir(path.dirname(reportPath), { recursive: true });
+        const tempPath = `${reportPath}.tmp`;
+        await writeFile(tempPath, `${JSON.stringify(report, null, 2)}\n`, "utf8");
+        await rename(tempPath, reportPath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Record that a reconciliation is about to be spawned.
+ *
+ * Written by the PARENT apply, before the spawn, precisely so that a spawn which
+ * never produces a child still leaves a trace. Without this write there is
+ * nothing on disk at all when the trampoline fails to launch, which is one of
+ * the two failure modes #2750 could not tell apart.
+ * @param root - Project root being reconciled
+ * @param lisaVersion - Lisa version running the apply
+ * @param now - Clock, injectable for tests
+ * @returns True when the report was persisted
+ */
+export async function recordReconciliationScheduled(root, lisaVersion, now = () => new Date()) {
+    const timestamp = now().toISOString();
+    return writeReconciliationReport(root, {
+        schema_version: RECONCILIATION_REPORT_SCHEMA_VERSION,
+        lisa_version: lisaVersion,
+        outcome: "scheduled",
+        scheduled_at: timestamp,
+        updated_at: timestamp,
+        package_managers: [],
+        detail: "Lisa's apply changed package.json and scheduled a detached lockfile " +
+            "reconciliation. Nothing has reported back yet.",
+    });
+}
+/**
+ * Record that the parent apply could not spawn the reconciliation child.
+ * @param root - Project root being reconciled
+ * @param lisaVersion - Lisa version running the apply
+ * @param message - The spawn error, verbatim
+ * @param now - Clock, injectable for tests
+ * @returns True when the report was persisted
+ */
+export async function recordReconciliationSpawnFailure(root, lisaVersion, message, now = () => new Date()) {
+    const timestamp = now().toISOString();
+    return writeReconciliationReport(root, {
+        schema_version: RECONCILIATION_REPORT_SCHEMA_VERSION,
+        lisa_version: lisaVersion,
+        outcome: "spawn-failed",
+        scheduled_at: timestamp,
+        updated_at: timestamp,
+        package_managers: [],
+        detail: `Could not spawn the lockfile reconciliation: ${message}`,
+    });
+}
+//# sourceMappingURL=reconciliation-report.js.map

package/dist/core/reconciliation-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconciliation-report.js","sourceRoot":"","sources":["../../src/core/reconciliation-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAC7C,kCAAkC,CAAC;AAErC;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC;AA2BtD,iFAAiF;AACjF,MAAM,CAAC,MAAM,+BAA+B,GAC1C,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AAEhC,yEAAyE;AACzE,MAAM,CAAC,MAAM,+BAA+B,GAC1C,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAE3B,MAAM,cAAc,GAAqC;IACvD,WAAW;IACX,SAAS;IACT,cAAc;IACd,uBAAuB;IACvB,YAAY;IACZ,aAAa;IACb,QAAQ;CACT,CAAC;AAmBF;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,WAAW,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAAY;IAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,4BAA4B,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,+BAA+B,CAAC,IAAI,CAAC,CACtC,CAAC;IACF,IACE,MAAM,EAAE,cAAc,KAAK,oCAAoC;QAC/D,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;QACvC,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EACvC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;QAClC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EACR,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACnC,CAAC,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,MAAM,CAAC,YAAY;QACzB,gBAAgB,EAAE,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAC5D,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAY,EACZ,MAA4B;IAE5B,MAAM,UAAU,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,GAAG,UAAU,MAAM,CAAC;QACrC,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,IAAY,EACZ,WAAmB,EACnB,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAElC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,yBAAyB,CAAC,IAAI,EAAE;QACrC,cAAc,EAAE,oCAAoC;QACpD,YAAY,EAAE,WAAW;QACzB,OAAO,EAAE,WAAW;QACpB,YAAY,EAAE,SAAS;QACvB,UAAU,EAAE,SAAS;QACrB,gBAAgB,EAAE,EAAE;QACpB,MAAM,EACJ,sEAAsE;YACtE,gDAAgD;KACnD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,IAAY,EACZ,WAAmB,EACnB,OAAe,EACf,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAElC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,yBAAyB,CAAC,IAAI,EAAE;QACrC,cAAc,EAAE,oCAAoC;QACpD,YAAY,EAAE,WAAW;QACzB,OAAO,EAAE,cAAc;QACvB,YAAY,EAAE,SAAS;QACvB,UAAU,EAAE,SAAS;QACrB,gBAAgB,EAAE,EAAE;QACpB,MAAM,EAAE,gDAAgD,OAAO,EAAE;KAClE,CAAC,CAAC;AACL,CAAC"}

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAs6EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAgtPjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA46EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA6tPjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -2,7 +2,7 @@
 /** Generated by scripts/generate-upstream-evidence-manifest.mjs. Do not edit. */
 export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "all/copy-contents/.gitattributes": "b23282f829ee514a25d8e334b31597851c1d89c1c58f119787eb4c99ecdc8407",
-    "all/copy-contents/gitignore": "06fc4bca36fabe2abc81e60b3e3886dcb9a0eacb4ae9d670beb2125a4eb4f850",
+    "all/copy-contents/gitignore": "3c3ce0693a6bf0531c7e080aef16103c5cfa6aeb0f897ffaba730966c103ffb6",
     "all/copy-overwrite/scripts/check-conflict-markers.mjs": "d7a689bcc122af7f38d1c536924fc2f3dcb503b09658ffc6035ccbe720d14d6b",
     "all/copy-overwrite/scripts/check-state-classification.mjs": "a72910f9885629dd6d8a739b900f5603e4b53d68ece64100a2a5647016b58e1e",
     "all/copy-overwrite/scripts/lib/bounded-spawn.mjs": "72e277ada531914d7bc51c3cb8dc67b8881aa817d96fa2f9f4d81668a3d3bbc1",
@@ -1088,6 +1088,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/check-required-check-promotions.mjs": "ae7a3d80beb98d8069af12d2d588e76f73f7a329b1f883ddbe1818bb1b5cafa9",
     "scripts/check-rules-pairing.sh": "4d4a0d9e8d36794a22020f419c879d7336b1c5bfe883acdcc826d26764560c7a",
     "scripts/check-security-floors.mjs": "6122404ea247c7d70718472e44bb007c0c5dad2fcc064c8a2d797cd9d0f85b29",
+    "scripts/check-shell-guard-refusal-coverage.mjs": "d6b056c4311ea612e85d16ae565a57c5e10c822e87e21d689e12a6cc89dfda3f",
     "scripts/check-state-classification.mjs": "26baaa85c0758fa41f1f66257f7d3a31ea4dd5cf17a9c0acaa3e89caaaf6265a",
     "scripts/check-template-workflow-refs.mjs": "f784a822ae82f41b7501d61e45a1badeecb84f118083f4c53c66402d6c50ffa2",
     "scripts/check-whole-output-guards.mjs": "bb3c959fe67a6f481a9b8442a5a9a51a49599b4efd8fbefe3329fdf5c96b9c02",
@@ -1128,6 +1129,8 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/lib/plugin-cache-resolution.mjs": "47a564e2f9d46c0a955defe8eb924f86d7a273098e6ccb118e10f9eeecf3950c",
     "scripts/lib/reusable-workflow-contract.d.mts": "791f01b55dd7a6b5d9a5f4cb9c44167caa146c2fc3c31a2ae4c2d8a350adc2f1",
     "scripts/lib/reusable-workflow-contract.mjs": "134ee2a327290f066f1eb318b5ed53c711557c3e10ed462c00ff5c97cfb20863",
+    "scripts/lib/shell-guard-refusal-coverage.mjs": "6fb20aa010d8d1b339f3047135301e4a23c87dfdfe4fdc85240f38b061f9d07d",
+    "scripts/lib/shell-guard-trace.mjs": "cb38f7b938bc2932e52ce2abefec8466b2c3edde97292e1e7b5a0f7c6464d4b5",
     "scripts/lib/upstream-manifest-staleness.mjs": "c69fc5ba10228b7f4f8d0068db27ee8a289143094fa8718b14af83f4af31f76d",
     "scripts/lib/workflow-contract-probe.mjs": "e51e2872bfc074fccd27cb814d2a4b14e45b3981290a98300b415beecc2b1ec8",
     "scripts/lisa-assert-eas-profile.mjs": "624e40d7f33ca17208fc6b7a19320a785cff19da5d2ff8062b67a432b2a34022",
@@ -7103,6 +7106,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "scripts/check-required-check-promotions.mjs": true,
     "scripts/check-rules-pairing.sh": true,
     "scripts/check-security-floors.mjs": true,
+    "scripts/check-shell-guard-refusal-coverage.mjs": true,
     "scripts/check-state-classification.mjs": true,
     "scripts/check-template-workflow-refs.mjs": true,
     "scripts/check-whole-output-guards.mjs": true,
@@ -7143,6 +7147,8 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "scripts/lib/plugin-cache-resolution.mjs": true,
     "scripts/lib/reusable-workflow-contract.d.mts": true,
     "scripts/lib/reusable-workflow-contract.mjs": true,
+    "scripts/lib/shell-guard-refusal-coverage.mjs": true,
+    "scripts/lib/shell-guard-trace.mjs": true,
     "scripts/lib/upstream-manifest-staleness.mjs": true,
     "scripts/lib/workflow-contract-probe.mjs": true,
     "scripts/lisa-assert-eas-profile.mjs": true,
@@ -7235,6 +7241,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/cli/doctor-readiness-workflows.ts": true,
     "src/cli/doctor-readiness-workspaces.ts": true,
     "src/cli/doctor-readiness.ts": true,
+    "src/cli/doctor-reconciliation.ts": true,
     "src/cli/doctor-render.ts": true,
     "src/cli/doctor-reusable-workflow-refs.ts": true,
     "src/cli/doctor-serialize-legs-contract.ts": true,
@@ -7448,6 +7455,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/core/override-floors.ts": true,
     "src/core/project-config-kane.ts": true,
     "src/core/project-config.ts": true,
+    "src/core/reconciliation-report.ts": true,
     "src/core/self-apply.ts": true,
     "src/core/sonar-integration.ts": true,
     "src/core/template-ownership.ts": true,
@@ -7578,6 +7586,8 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/utils/package-manager-detect.ts": true,
     "src/utils/path-utils.ts": true,
     "src/utils/pm-env.ts": true,
+    "src/utils/postinstall-trampoline-report-source.ts": true,
+    "src/utils/postinstall-trampoline-source.ts": true,
     "src/utils/postinstall-trampoline.ts": true,
     "src/utils/usage-accounting-rollup.ts": true,
     "src/utils/usage-accounting.ts": true,
@@ -7784,6 +7794,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/integration/playwright-caller-template.test.ts": true,
     "tests/integration/playwright-e2e-workflow.test.ts": true,
     "tests/integration/postinstall-safe-reports-stale-root-configs.test.ts": true,
+    "tests/integration/postinstall-trampoline-regen.test.ts": true,
     "tests/integration/pre-tool-refusal-equivalence.test.ts": true,
     "tests/integration/pre-tool-refusal-inventory.test.ts": true,
     "tests/integration/pre-tool-refusal-scripts-resolve-gates.test.ts": true,
@@ -7819,6 +7830,8 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/integration/review-evidence-gate.test.ts": true,
     "tests/integration/security-floors-gate.test.ts": true,
     "tests/integration/seeded-gates-preserve-hook-outcomes.test.ts": true,
+    "tests/integration/shell-guard-allow-controls.test.ts": true,
+    "tests/integration/shell-guard-refusals.test.ts": true,
     "tests/integration/skipped-required-checks-gate-fail-closed.test.ts": true,
     "tests/integration/standards-proof-fixture.ts": true,
     "tests/integration/standards-proof-rails.test.ts": true,
@@ -7833,6 +7846,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/integration/support/pre-tool-refusal-harness.ts": true,
     "tests/integration/support/rails-learnings-budget-gate.ts": true,
     "tests/integration/support/reusable-workflow-scopes.ts": true,
+    "tests/integration/support/shell-guard-refusal-fixture.ts": true,
     "tests/integration/threshold-ratchet-gate-fail-closed.test.ts": true,
     "tests/integration/tracked-source-nul-bytes.test.ts": true,
     "tests/support/git-executable.ts": true,
@@ -7893,6 +7907,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/cli/doctor-readiness-tracking.test.ts": true,
     "tests/unit/cli/doctor-readiness-workflows.test.ts": true,
     "tests/unit/cli/doctor-readiness.test.ts": true,
+    "tests/unit/cli/doctor-reconciliation.test.ts": true,
     "tests/unit/cli/doctor-render.test.ts": true,
     "tests/unit/cli/doctor-reusable-workflow-refs.test.ts": true,
     "tests/unit/cli/doctor-serialize-legs-contract.test.ts": true,
@@ -8310,6 +8325,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/scripts/check-learnings-budget.test.ts": true,
     "tests/unit/scripts/check-orphan-test-processes.test.ts": true,
     "tests/unit/scripts/check-pipeline-status-reads.test.ts": true,
+    "tests/unit/scripts/check-shell-guard-refusal-coverage.test.ts": true,
     "tests/unit/scripts/check-template-workflow-refs.test.ts": true,
     "tests/unit/scripts/check-whole-output-guards.test.ts": true,
     "tests/unit/scripts/check-workflow-package-contracts.test.ts": true,