@codyswann/lisa 4.21.5 → 4.22.0

package/dist/cli/doctor-nightly-e2e-guard-io.js

@@ -0,0 +1,239 @@
+/**
+ * @file doctor-nightly-e2e-guard-io.ts
+ * @description Bounded no-follow reads for hostile workflow and target paths
+ * @module cli/doctor-nightly-e2e-guard-io
+ */
+import { constants } from "node:fs";
+import { lstat, open, readdir, realpath } from "node:fs/promises";
+import * as path from "node:path";
+import { NightlyGuardDeadlineError, nightlyGuardRemaining, withinNightlyGuardDeadline, } from "./doctor-nightly-e2e-guard-deadline.js";
+const errorCode = (error) => error.code;
+const displayError = (error) => error instanceof Error ? error.message : String(error);
+const rethrowDeadline = (error) => {
+    if (error instanceof NightlyGuardDeadlineError)
+        throw error;
+};
+const identity = (stats) => ({
+    device: stats.dev,
+    inode: stats.ino,
+});
+const sameIdentity = (left, right) => left.device === right.device && left.inode === right.inode;
+const byteLimit = (bytes) => bytes === 1024 * 1024 ? "1 MiB" : `${bytes} byte`;
+const safeParts = (relativePath) => {
+    if (path.isAbsolute(relativePath))
+        return undefined;
+    const parts = relativePath.split(/[\\/]/u);
+    return parts.length > 0 &&
+        parts.every(part => part !== "" && part !== "." && part !== "..")
+        ? parts
+        : undefined;
+};
+const unavailable = (reason) => ({
+    state: "unavailable",
+    reason,
+});
+/**
+ * Walk every project-relative component with lstat, rejecting symlinks before
+ * any directory or file operation can follow them.
+ * @param projectRoot - Logical project containment root
+ * @param relativePath - Validated relative path
+ * @param deadline - Shared whole-operation deadline
+ * @returns Final component identity or an exact refusal
+ */
+async function inspectComponents(projectRoot, relativePath, deadline) {
+    const parts = safeParts(relativePath);
+    if (!parts)
+        return unavailable("path escapes the project root");
+    const inspect = async (index) => {
+        const current = path.join(projectRoot, ...parts.slice(0, index + 1));
+        if (nightlyGuardRemaining(deadline) <= 0) {
+            throw new NightlyGuardDeadlineError(deadline.reason);
+        }
+        const inspected = await withinNightlyGuardDeadline(deadline, () => lstat(current)).catch(error => {
+            rethrowDeadline(error);
+            const code = errorCode(error);
+            return code === "ENOENT"
+                ? { state: "missing", reason: `${relativePath} is missing` }
+                : unavailable(`${relativePath} is unreadable (${code ?? displayError(error)})`);
+        });
+        if ("state" in inspected)
+            return inspected;
+        const stats = inspected;
+        if (stats.isSymbolicLink()) {
+            return unavailable(`${parts.slice(0, index + 1).join("/")} is a symlink`);
+        }
+        if (index < parts.length - 1 && !stats.isDirectory()) {
+            return unavailable(`${parts.slice(0, index + 1).join("/")} is not a directory`);
+        }
+        return index === parts.length - 1
+            ? { state: "ok", final: stats }
+            : await inspect(index + 1);
+    };
+    return await inspect(0);
+}
+const isContained = (root, target) => {
+    const relative = path.relative(root, target);
+    return (relative !== "" &&
+        relative !== ".." &&
+        !relative.startsWith(`..${path.sep}`) &&
+        !path.isAbsolute(relative));
+};
+/**
+ * Verify the opened inode is still the contained, non-symlink path immediately
+ * before its bytes become proof evidence.
+ * @param projectRoot - Logical containment root
+ * @param relativePath - Path whose components are rechecked
+ * @param opened - Inode identity captured from the file descriptor
+ * @param deadline - Shared deadline
+ * @returns Reverified component result
+ */
+async function verifyIdentity(projectRoot, relativePath, opened, deadline) {
+    const inspected = await inspectComponents(projectRoot, relativePath, deadline);
+    if (inspected.state !== "ok")
+        return inspected;
+    if (!sameIdentity(opened, identity(inspected.final))) {
+        return unavailable(`${relativePath} changed identity while it was read`);
+    }
+    try {
+        const [physicalRoot, physicalTarget] = await withinNightlyGuardDeadline(deadline, () => Promise.all([
+            realpath(projectRoot),
+            realpath(path.join(projectRoot, relativePath)),
+        ]));
+        return isContained(physicalRoot, physicalTarget)
+            ? inspected
+            : unavailable(`${relativePath} is not contained by the project root`);
+    }
+    catch (error) {
+        rethrowDeadline(error);
+        return unavailable(`${relativePath} containment is unreadable (${errorCode(error) ?? displayError(error)})`);
+    }
+}
+/**
+ * Read at most `maxBytes + 1` through an already no-follow file descriptor.
+ * @param handle - Open no-follow file descriptor
+ * @param maxBytes - Hard content ceiling
+ * @param deadline - Shared deadline
+ * @returns Bounded bytes, including one overflow sentinel byte when present
+ */
+async function readBounded(handle, maxBytes, deadline) {
+    const buffer = Buffer.alloc(maxBytes + 1);
+    const readAt = async (offset) => {
+        if (offset >= buffer.length)
+            return offset;
+        if (nightlyGuardRemaining(deadline) <= 0) {
+            throw new NightlyGuardDeadlineError(deadline.reason);
+        }
+        const { bytesRead } = await withinNightlyGuardDeadline(deadline, () => handle.read(buffer, offset, buffer.length - offset, offset));
+        return bytesRead === 0 ? offset : await readAt(offset + bytesRead);
+    };
+    const used = await readAt(0);
+    return buffer.subarray(0, used);
+}
+const openNightlyGuardFile = async (projectRoot, relativePath, deadline) => await withinNightlyGuardDeadline(deadline, () => open(path.join(projectRoot, relativePath), constants.O_RDONLY | constants.O_NOFOLLOW)).then(handle => ({ state: "ok", handle }), error => {
+    rethrowDeadline(error);
+    const code = errorCode(error);
+    return code === "ENOENT"
+        ? { state: "missing", reason: `${relativePath} is missing` }
+        : {
+            state: "unavailable",
+            reason: `${relativePath} is unreadable (${code ?? displayError(error)})`,
+        };
+});
+/**
+ * Read one regular file without following any path component.
+ * @param projectRoot - Containment root
+ * @param relativePath - Project-relative path
+ * @param maxBytes - Hard byte ceiling
+ * @param deadline - Shared deadline
+ * @returns Bounded bytes or a precise availability class
+ */
+export async function readNightlyGuardFile(projectRoot, relativePath, maxBytes, deadline) {
+    const inspected = await inspectComponents(projectRoot, relativePath, deadline);
+    if (inspected.state !== "ok")
+        return inspected;
+    if (!inspected.final.isFile()) {
+        return {
+            state: "unavailable",
+            reason: `${relativePath} is not a regular file`,
+        };
+    }
+    if (inspected.final.size > maxBytes) {
+        return {
+            state: "unavailable",
+            reason: `${relativePath} exceeds the ${byteLimit(maxBytes)} file limit`,
+        };
+    }
+    const opened = await openNightlyGuardFile(projectRoot, relativePath, deadline);
+    if (opened.state !== "ok")
+        return opened;
+    const handle = opened.handle;
+    try {
+        const stats = await withinNightlyGuardDeadline(deadline, () => handle.stat());
+        if (!stats.isFile()) {
+            return {
+                state: "unavailable",
+                reason: `${relativePath} is not a regular file`,
+            };
+        }
+        const bytes = await readBounded(handle, maxBytes, deadline);
+        if (bytes.length > maxBytes) {
+            return {
+                state: "unavailable",
+                reason: `${relativePath} exceeds the ${byteLimit(maxBytes)} file limit`,
+            };
+        }
+        const verified = await verifyIdentity(projectRoot, relativePath, identity(stats), deadline);
+        return verified.state === "ok" ? { state: "ok", bytes } : verified;
+    }
+    catch (error) {
+        rethrowDeadline(error);
+        return {
+            state: "unavailable",
+            reason: `${relativePath} is unreadable (${errorCode(error) ?? displayError(error)})`,
+        };
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * List a directory only when every component and its identity remain safe.
+ * @param projectRoot - Containment root
+ * @param relativePath - Project-relative directory
+ * @param deadline - Shared deadline
+ * @returns Directory entries or an availability refusal
+ */
+export async function readNightlyGuardDirectory(projectRoot, relativePath, deadline) {
+    const before = await inspectComponents(projectRoot, relativePath, deadline);
+    if (before.state !== "ok")
+        return before;
+    if (!before.final.isDirectory()) {
+        return {
+            state: "unavailable",
+            reason: `${relativePath} is not a directory`,
+        };
+    }
+    try {
+        const names = await withinNightlyGuardDeadline(deadline, () => readdir(path.join(projectRoot, relativePath)));
+        const after = await inspectComponents(projectRoot, relativePath, deadline);
+        if (after.state !== "ok")
+            return after;
+        return sameIdentity(identity(before.final), identity(after.final))
+            ? { state: "ok", names }
+            : {
+                state: "unavailable",
+                reason: `${relativePath} changed identity while it was listed`,
+            };
+    }
+    catch (error) {
+        rethrowDeadline(error);
+        const code = errorCode(error);
+        return code === "ENOENT"
+            ? { state: "missing", reason: `${relativePath} is missing` }
+            : {
+                state: "unavailable",
+                reason: `${relativePath} is unreadable (${code ?? displayError(error)})`,
+            };
+    }
+}
+//# sourceMappingURL=doctor-nightly-e2e-guard-io.js.map

package/dist/cli/doctor-nightly-e2e-guard-io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-io.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-io.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAc,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EAErB,0BAA0B,GAC3B,MAAM,wCAAwC,CAAC;AA0BhD,MAAM,SAAS,GAAG,CAAC,KAAc,EAAsB,EAAE,CACtD,KAA+B,CAAC,IAAI,CAAC;AACxC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAU,EAAE,CAC9C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,MAAM,eAAe,GAAG,CAAC,KAAc,EAAQ,EAAE;IAC/C,IAAI,KAAK,YAAY,yBAAyB;QAAE,MAAM,KAAK,CAAC;AAC9D,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,KAAY,EAAgB,EAAE,CAAC,CAAC;IAChD,MAAM,EAAE,KAAK,CAAC,GAAG;IACjB,KAAK,EAAE,KAAK,CAAC,GAAG;CACjB,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,CAAC,IAAkB,EAAE,KAAmB,EAAW,EAAE,CACxE,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;AAC7D,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAC1C,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC;AAEpD,MAAM,SAAS,GAAG,CAAC,YAAoB,EAAiC,EAAE;IACxE,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC;QACrB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QACjE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,MAAc,EAAmB,EAAE,CAAC,CAAC;IACxD,KAAK,EAAE,aAAa;IACpB,MAAM;CACP,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAC9B,WAAmB,EACnB,YAAoB,EACpB,QAA8B;IAE9B,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAEhE,MAAM,OAAO,GAAG,KAAK,EAAE,KAAa,EAA4B,EAAE;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,SAAS,GAA4B,MAAM,0BAA0B,CACzE,QAAQ,EACR,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CACrB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACd,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,IAAI,KAAK,QAAQ;gBACtB,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,aAAa,EAAE;gBAC5D,CAAC,CAAC,WAAW,CACT,GAAG,YAAY,mBAAmB,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CACjE,CAAC;QACR,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,KAAK,GAAG,SAAS,CAAC;QACxB,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,OAAO,WAAW,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACrD,OAAO,WAAW,CAChB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAC5D,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;YAC/B,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;YAC/B,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,OAAO,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,MAAc,EAAW,EAAE;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,QAAQ,KAAK,IAAI;QACjB,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACrC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAC3B,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAC3B,WAAmB,EACnB,YAAoB,EACpB,MAAoB,EACpB,QAA8B;IAE9B,MAAM,SAAS,GAAG,MAAM,iBAAiB,CACvC,WAAW,EACX,YAAY,EACZ,QAAQ,CACT,CAAC;IACF,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO,WAAW,CAAC,GAAG,YAAY,qCAAqC,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,GAAG,MAAM,0BAA0B,CACrE,QAAQ,EACR,GAAG,EAAE,CACH,OAAO,CAAC,GAAG,CAAC;YACV,QAAQ,CAAC,WAAW,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;SAC/C,CAAC,CACL,CAAC;QACF,OAAO,WAAW,CAAC,YAAY,EAAE,cAAc,CAAC;YAC9C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW,CAAC,GAAG,YAAY,uCAAuC,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,WAAW,CAChB,GAAG,YAAY,+BAA+B,SAAS,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CACxB,MAAwC,EACxC,QAAgB,EAChB,QAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,EAAE,MAAc,EAAmB,EAAE;QACvD,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC;QAC3C,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC,QAAQ,EAAE,GAAG,EAAE,CACpE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,CAC5D,CAAC;QACF,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACrE,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,oBAAoB,GAAG,KAAK,EAChC,WAAmB,EACnB,YAAoB,EACpB,QAA8B,EAC9B,EAAE,CACF,MAAM,0BAA0B,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC9C,IAAI,CACF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EACpC,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAC1C,CACF,CAAC,IAAI,CACJ,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAa,EAAE,MAAM,EAAE,CAAC,EAC5C,KAAK,CAAC,EAAE;IACN,eAAe,CAAC,KAAK,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,EAAE,KAAK,EAAE,SAAkB,EAAE,MAAM,EAAE,GAAG,YAAY,aAAa,EAAE;QACrE,CAAC,CAAC;YACE,KAAK,EAAE,aAAsB;YAC7B,MAAM,EAAE,GAAG,YAAY,mBAAmB,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG;SACzE,CAAC;AACR,CAAC,CACF,CAAC;AAEJ;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,YAAoB,EACpB,QAAgB,EAChB,QAA8B;IAE9B,MAAM,SAAS,GAAG,MAAM,iBAAiB,CACvC,WAAW,EACX,YAAY,EACZ,QAAQ,CACT,CAAC;IACF,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,GAAG,YAAY,wBAAwB;SAChD,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,GAAG,YAAY,gBAAgB,SAAS,CAAC,QAAQ,CAAC,aAAa;SACxE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACvC,WAAW,EACX,YAAY,EACZ,QAAQ,CACT,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC5D,MAAM,CAAC,IAAI,EAAE,CACd,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpB,OAAO;gBACL,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,GAAG,YAAY,wBAAwB;aAChD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC5B,OAAO;gBACL,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,GAAG,YAAY,gBAAgB,SAAS,CAAC,QAAQ,CAAC,aAAa;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,WAAW,EACX,YAAY,EACZ,QAAQ,CAAC,KAAK,CAAC,EACf,QAAQ,CACT,CAAC;QACF,OAAO,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,GAAG,YAAY,mBAAmB,SAAS,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG;SACrF,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAAmB,EACnB,YAAoB,EACpB,QAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAChC,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,GAAG,YAAY,qBAAqB;SAC7C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAC9C,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC3E,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;YACxB,CAAC,CAAC;gBACE,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,GAAG,YAAY,uCAAuC;aAC/D,CAAC;IACR,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,KAAK,QAAQ;YACtB,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,aAAa,EAAE;YAC5D,CAAC,CAAC;gBACE,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,GAAG,YAAY,mBAAmB,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG;aACzE,CAAC;IACR,CAAC;AACH,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-job.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @file doctor-nightly-e2e-guard-job.ts
+ * @description Executable-field parsing for one reachable workflow job
+ * @module cli/doctor-nightly-e2e-guard-job
+ */
+import { type NightlyGuardScanFailure, type NightlyGuardWorkflowRecord } from "./doctor-nightly-e2e-guard-contract.js";
+/** Supported active target resolved from one job. */
+export interface NightlyGuardJobCaller {
+    /** Direct Node invocation or Lisa's exact official reusable endpoint. */
+    readonly kind: "official-reusable" | "direct";
+    /** Literal normalized target path. */
+    readonly target: string;
+}
+/** Executable interpretation of one reachable job. */
+export interface NightlyGuardJobInspection {
+    /** Guard caller when this job directly invokes one. */
+    readonly caller?: NightlyGuardJobCaller;
+    /** Local reusable basename when this job calls one. */
+    readonly local?: string;
+    /** Fail-closed ambiguity or unsupported syntax. */
+    readonly failure?: NightlyGuardScanFailure;
+}
+/**
+ * Interpret one reachable executable job without scanning prose or comments.
+ * @param workflow - Parsed workflow containing the job
+ * @param jobId - Stable job mapping key
+ * @param job - Parsed job mapping
+ * @returns Direct caller, local edge, or an explicit refusal
+ */
+export declare function inspectNightlyGuardJob(workflow: NightlyGuardWorkflowRecord, jobId: string, job: Readonly<Record<string, unknown>>): NightlyGuardJobInspection;
+//# sourceMappingURL=doctor-nightly-e2e-guard-job.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-job.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-job.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-job.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAIhC,MAAM,wCAAwC,CAAC;AAchD,qDAAqD;AACrD,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,GAAG,QAAQ,CAAC;IAC9C,sCAAsC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sDAAsD;AACtD,MAAM,WAAW,yBAAyB;IACxC,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IACxC,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC;CAC5C;AA4MD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,0BAA0B,EACpC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACrC,yBAAyB,CAmB3B"}

package/dist/cli/doctor-nightly-e2e-guard-job.js

@@ -0,0 +1,156 @@
+/**
+ * @file doctor-nightly-e2e-guard-job.ts
+ * @description Executable-field parsing for one reachable workflow job
+ * @module cli/doctor-nightly-e2e-guard-job
+ */
+import { NIGHTLY_GUARD_CANONICAL_TARGET, nightlyGuardObject, nightlyGuardText, normalizeNightlyGuardTarget, } from "./doctor-nightly-e2e-guard-contract.js";
+import { bypassBearingMapping, hasAnyNightlyGuardBypassEvidence, inspectNightlyGuardJobEvidence, } from "./doctor-nightly-e2e-guard-evidence.js";
+const OFFICIAL_PREFIX = "CodySwannGT/lisa/.github/workflows/nightly-e2e-health.yml@";
+const OFFICIAL_REF = /^[^\s${}]+$/u;
+const LOCAL = /^\.\/\.github\/workflows\/([A-Za-z0-9._-]+\.ya?ml)$/u;
+const failure = (workflow, reason) => ({ workflow: workflow.file, reason });
+const indirectReusableBypassEvidence = (evidence) => evidence.inheritedEnvironment || evidence.stepEnvironment || evidence.run;
+const inspectOfficial = (workflow, jobId, job, evidence) => {
+    const uses = nightlyGuardText(job.uses);
+    if (!uses.startsWith(OFFICIAL_PREFIX))
+        return undefined;
+    if (evidence.condition) {
+        return {
+            failure: failure(workflow, `${jobId}: executable if bypass-label logic can skip the guard and is unsupported`),
+        };
+    }
+    if (indirectReusableBypassEvidence(evidence)) {
+        return {
+            failure: failure(workflow, `${jobId}: indirect bypass environment or run logic around the official reusable is unsupported`),
+        };
+    }
+    const reference = uses.slice(OFFICIAL_PREFIX.length);
+    if (!OFFICIAL_REF.test(reference)) {
+        return {
+            failure: failure(workflow, `${jobId}: official reusable reference is not a static literal`),
+        };
+    }
+    const input = nightlyGuardObject(job.with)?.guard_script;
+    const candidate = input === undefined
+        ? NIGHTLY_GUARD_CANONICAL_TARGET
+        : nightlyGuardText(input);
+    const target = normalizeNightlyGuardTarget(candidate);
+    return target
+        ? { caller: { kind: "official-reusable", target } }
+        : {
+            failure: failure(workflow, `${jobId}: with.guard_script must be one literal contained relative ASCII JavaScript path`),
+        };
+};
+const conditionalFailure = (workflow, jobId, evidence) => evidence.condition &&
+    (evidence.hasNode ||
+        evidence.inheritedEnvironment ||
+        evidence.stepEnvironment)
+    ? failure(workflow, `${jobId}: executable if bypass-label logic can skip the guard and is unsupported`)
+    : undefined;
+const runBypassFailure = (workflow, jobId, evidence) => {
+    if (!evidence.run || !evidence.hasNode)
+        return undefined;
+    const guard = evidence.analyses.findIndex(analysis => analysis.target);
+    const bypassAnalysis = evidence.analyses.find((analysis, index) => analysis.bypassEvidence &&
+        !(guard >= 0 &&
+            index > guard &&
+            (analysis.commandFileWrites?.length ?? 0) > 0));
+    if (!bypassAnalysis)
+        return undefined;
+    return failure(workflow, bypassAnalysis.bypassWiring === "GITHUB_ENV"
+        ? `${jobId}: indirect GITHUB_ENV bypass wiring is unsupported; use a literal YAML env mapping`
+        : `${jobId}: executable run bypass wiring is unsupported; use a literal YAML env mapping`);
+};
+const commandFileFailure = (workflow, jobId, evidence) => {
+    const guard = evidence.analyses.findIndex(analysis => analysis.target);
+    if (guard < 0)
+        return undefined;
+    const write = evidence.analyses
+        .slice(0, guard)
+        .flatMap(analysis => analysis.commandFileWrites ?? [])
+        .find(candidate => candidate.safety !== "safe");
+    return write
+        ? failure(workflow, write.file === "GITHUB_PATH"
+            ? `${jobId}: ${write.safety} GITHUB_PATH write can change command resolution before guard execution`
+            : `${jobId}: ${write.safety} GITHUB_ENV write cannot prove a safe environment before guard execution`)
+        : undefined;
+};
+const directResult = (workflow, jobId, relevant) => {
+    const refused = relevant.find(item => item.reason)?.reason;
+    if (refused)
+        return { failure: failure(workflow, `${jobId}: ${refused}`) };
+    const targets = relevant.flatMap(item => (item.target ? [item.target] : []));
+    if (targets.length === 1) {
+        return { caller: { kind: "direct", target: targets[0] ?? "" } };
+    }
+    if (targets.length === 0 && relevant.every(step => step.reportingOnly)) {
+        return {};
+    }
+    return {
+        failure: failure(workflow, targets.length === 0
+            ? `${jobId}: bypass-bearing job has no supported literal Node guard target`
+            : `${jobId}: multiple Node guard targets are ambiguous`),
+    };
+};
+const inspectDirect = (workflow, jobId, evidence) => {
+    const condition = conditionalFailure(workflow, jobId, evidence);
+    if (condition)
+        return { failure: condition };
+    if (evidence.withMapping && evidence.hasNode) {
+        return {
+            failure: failure(workflow, `${jobId}: bypass-bearing with inputs on a direct job are unsupported`),
+        };
+    }
+    const commandFile = commandFileFailure(workflow, jobId, evidence);
+    if (commandFile)
+        return { failure: commandFile };
+    const runBypass = runBypassFailure(workflow, jobId, evidence);
+    if (runBypass)
+        return { failure: runBypass };
+    const relevant = evidence.analyses.filter((_analysis, index) => evidence.inheritedEnvironment ||
+        bypassBearingMapping(evidence.steps[index]?.env));
+    return relevant.length === 0 ? {} : directResult(workflow, jobId, relevant);
+};
+const inspectLocal = (workflow, jobId, uses, evidence) => {
+    if (evidence.condition ||
+        evidence.withMapping ||
+        indirectReusableBypassEvidence(evidence)) {
+        return {
+            failure: failure(workflow, evidence.condition
+                ? `${jobId}: executable if bypass logic around a local reusable is unsupported`
+                : `${jobId}: indirect bypass logic around a local reusable is unsupported`),
+        };
+    }
+    const local = LOCAL.exec(uses)?.[1];
+    return local
+        ? { local }
+        : {
+            failure: failure(workflow, `${jobId}: local reusable path is unsupported or escapes .github/workflows`),
+        };
+};
+/**
+ * Interpret one reachable executable job without scanning prose or comments.
+ * @param workflow - Parsed workflow containing the job
+ * @param jobId - Stable job mapping key
+ * @param job - Parsed job mapping
+ * @returns Direct caller, local edge, or an explicit refusal
+ */
+export function inspectNightlyGuardJob(workflow, jobId, job) {
+    const evidence = inspectNightlyGuardJobEvidence(workflow, job);
+    const official = inspectOfficial(workflow, jobId, job, evidence);
+    if (official)
+        return official;
+    const uses = nightlyGuardText(job.uses);
+    if (uses.startsWith("./")) {
+        return inspectLocal(workflow, jobId, uses, evidence);
+    }
+    if (uses.length > 0) {
+        return hasAnyNightlyGuardBypassEvidence(evidence)
+            ? {
+                failure: failure(workflow, `${jobId}: bypass evidence on an unsupported remote reusable is unavailable`),
+            }
+            : {};
+    }
+    return inspectDirect(workflow, jobId, evidence);
+}
+//# sourceMappingURL=doctor-nightly-e2e-guard-job.js.map

package/dist/cli/doctor-nightly-e2e-guard-job.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-job.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-job.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,8BAA8B,EAG9B,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,8BAA8B,GAE/B,MAAM,wCAAwC,CAAC;AAGhD,MAAM,eAAe,GACnB,4DAA4D,CAAC;AAC/D,MAAM,YAAY,GAAG,cAAc,CAAC;AACpC,MAAM,KAAK,GAAG,sDAAsD,CAAC;AAoBrE,MAAM,OAAO,GAAG,CACd,QAAoC,EACpC,MAAc,EACW,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAEpE,MAAM,8BAA8B,GAAG,CACrC,QAAiC,EACxB,EAAE,CACX,QAAQ,CAAC,oBAAoB,IAAI,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,GAAG,CAAC;AAE5E,MAAM,eAAe,GAAG,CACtB,QAAoC,EACpC,KAAa,EACb,GAAsC,EACtC,QAAiC,EACM,EAAE;IACzC,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,OAAO,EAAE,OAAO,CACd,QAAQ,EACR,GAAG,KAAK,0EAA0E,CACnF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,8BAA8B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE,OAAO,CACd,QAAQ,EACR,GAAG,KAAK,wFAAwF,CACjG;SACF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,OAAO,EAAE,OAAO,CACd,QAAQ,EACR,GAAG,KAAK,uDAAuD,CAChE;SACF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IACzD,MAAM,SAAS,GACb,KAAK,KAAK,SAAS;QACjB,CAAC,CAAC,8BAA8B;QAChC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,MAAM;QACX,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,EAAE;QACnD,CAAC,CAAC;YACE,OAAO,EAAE,OAAO,CACd,QAAQ,EACR,GAAG,KAAK,kFAAkF,CAC3F;SACF,CAAC;AACR,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CACzB,QAAoC,EACpC,KAAa,EACb,QAAiC,EACI,EAAE,CACvC,QAAQ,CAAC,SAAS;IAClB,CAAC,QAAQ,CAAC,OAAO;QACf,QAAQ,CAAC,oBAAoB;QAC7B,QAAQ,CAAC,eAAe,CAAC;IACzB,CAAC,CAAC,OAAO,CACL,QAAQ,EACR,GAAG,KAAK,0EAA0E,CACnF;IACH,CAAC,CAAC,SAAS,CAAC;AAEhB,MAAM,gBAAgB,GAAG,CACvB,QAAoC,EACpC,KAAa,EACb,QAAiC,EACI,EAAE;IACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAC3C,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAClB,QAAQ,CAAC,cAAc;QACvB,CAAC,CACC,KAAK,IAAI,CAAC;YACV,KAAK,GAAG,KAAK;YACb,CAAC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAC9C,CACJ,CAAC;IACF,IAAI,CAAC,cAAc;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,OAAO,CACZ,QAAQ,EACR,cAAc,CAAC,YAAY,KAAK,YAAY;QAC1C,CAAC,CAAC,GAAG,KAAK,oFAAoF;QAC9F,CAAC,CAAC,GAAG,KAAK,+EAA+E,CAC5F,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CACzB,QAAoC,EACpC,KAAa,EACb,QAAiC,EACI,EAAE;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvE,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ;SAC5B,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;SACf,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,iBAAiB,IAAI,EAAE,CAAC;SACrD,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAClD,OAAO,KAAK;QACV,CAAC,CAAC,OAAO,CACL,QAAQ,EACR,KAAK,CAAC,IAAI,KAAK,aAAa;YAC1B,CAAC,CAAC,GAAG,KAAK,KAAK,KAAK,CAAC,MAAM,yEAAyE;YACpG,CAAC,CAAC,GAAG,KAAK,KAAK,KAAK,CAAC,MAAM,0EAA0E,CACxG;QACH,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,QAAoC,EACpC,KAAa,EACb,QAA8C,EACnB,EAAE;IAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAC3D,IAAI,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC,EAAE,CAAC;IAC3E,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,CACd,QAAQ,EACR,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,CAAC,GAAG,KAAK,iEAAiE;YAC3E,CAAC,CAAC,GAAG,KAAK,6CAA6C,CAC1D;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,QAAoC,EACpC,KAAa,EACb,QAAiC,EACN,EAAE;IAC7B,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAChE,IAAI,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC7C,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE,OAAO,CACd,QAAQ,EACR,GAAG,KAAK,8DAA8D,CACvE;SACF,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9D,IAAI,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CACvC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CACnB,QAAQ,CAAC,oBAAoB;QAC7B,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CACnD,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,QAAoC,EACpC,KAAa,EACb,IAAY,EACZ,QAAiC,EACN,EAAE;IAC7B,IACE,QAAQ,CAAC,SAAS;QAClB,QAAQ,CAAC,WAAW;QACpB,8BAA8B,CAAC,QAAQ,CAAC,EACxC,CAAC;QACD,OAAO;YACL,OAAO,EAAE,OAAO,CACd,QAAQ,EACR,QAAQ,CAAC,SAAS;gBAChB,CAAC,CAAC,GAAG,KAAK,qEAAqE;gBAC/E,CAAC,CAAC,GAAG,KAAK,gEAAgE,CAC7E;SACF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,KAAK;QACV,CAAC,CAAC,EAAE,KAAK,EAAE;QACX,CAAC,CAAC;YACE,OAAO,EAAE,OAAO,CACd,QAAQ,EACR,GAAG,KAAK,mEAAmE,CAC5E;SACF,CAAC;AACR,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAoC,EACpC,KAAa,EACb,GAAsC;IAEtC,MAAM,QAAQ,GAAG,8BAA8B,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,gCAAgC,CAAC,QAAQ,CAAC;YAC/C,CAAC,CAAC;gBACE,OAAO,EAAE,OAAO,CACd,QAAQ,EACR,GAAG,KAAK,oEAAoE,CAC7E;aACF;YACH,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IACD,OAAO,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-proof.d.ts

@@ -0,0 +1,42 @@
+import type { HashLedger } from "../core/lisa-owned-provenance.js";
+import { type NightlyGuardProbeResult } from "./doctor-nightly-e2e-guard-contract.js";
+import { type NightlyGuardDeadline } from "./doctor-nightly-e2e-guard-deadline.js";
+/** One digest whose actual Lisa package handler passed the behavior suite. */
+export interface NightlyGuardBehaviorCertificate {
+    /** Major-1 contract emitted by the behavior-proven handler. */
+    readonly contractVersion: string;
+}
+/** Exact digest lookup; target paths never broaden certificate authority. */
+export type NightlyGuardBehaviorCertificates = Readonly<Record<string, NightlyGuardBehaviorCertificate>>;
+/** Optional proof collaborators for ledger and deadline bite controls. */
+export interface NightlyGuardProofDependencies {
+    /** Behavior-proven exact digests; tests may inject a precise certificate. */
+    readonly certificates?: NightlyGuardBehaviorCertificates;
+    /** Legacy compatibility seam; generic ownership hashes grant no authority. */
+    readonly ledger?: HashLedger;
+    /** Whole-operation deadline, narrowed to the target ceiling here. */
+    readonly deadline?: NightlyGuardDeadline;
+    /** Standalone target ceiling override for deterministic tests. */
+    readonly timeoutMs?: number;
+    /** Monotonic clock for standalone proof tests. */
+    readonly now?: () => number;
+}
+/**
+ * Lower-case sha256 used as non-executing shipped provenance.
+ * @param bytes - Safely captured target bytes
+ * @returns Lower-case SHA-256 hex digest
+ */
+export declare const digestNightlyGuardBytes: (bytes: Buffer) => string;
+/**
+ * Prove a target by bounded no-follow hash and an exact behavior certificate.
+ *
+ * The target is deliberately never imported, spawned, or evaluated. A caller
+ * can therefore retain direct invocation while doctor itself grants untrusted
+ * bytes no filesystem, process, environment, or network capability.
+ * @param projectRoot - Project root forming the containment boundary
+ * @param target - Literal project-relative JavaScript file
+ * @param dependencies - Optional ledger/deadline collaborators
+ * @returns Compatible major-1 version, or an explicit failed proof
+ */
+export declare function proveNightlyE2eGuardTarget(projectRoot: string, target: string, dependencies?: NightlyGuardProofDependencies): Promise<NightlyGuardProbeResult>;
+//# sourceMappingURL=doctor-nightly-e2e-guard-proof.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-proof.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-proof.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,wCAAwC,CAAC;AAKhD,8EAA8E;AAC9E,MAAM,WAAW,+BAA+B;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,6EAA6E;AAC7E,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CACrD,MAAM,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAChD,CAAC;AAEF,0EAA0E;AAC1E,MAAM,WAAW,6BAA6B;IAC5C,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,CAAC,EAAE,gCAAgC,CAAC;IACzD,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IACzC,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAAI,OAAO,MAAM,KAAG,MACN,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,uBAAuB,CAAC,CA8ClC"}

package/dist/cli/doctor-nightly-e2e-guard-proof.js

@@ -0,0 +1,57 @@
+/**
+ * @file doctor-nightly-e2e-guard-proof.ts
+ * @description Non-executing provenance and contract proof for active targets
+ * @module cli/doctor-nightly-e2e-guard-proof
+ */
+import { createHash } from "node:crypto";
+import { NIGHTLY_E2E_GUARD_BEHAVIOR_CERTIFICATES, NIGHTLY_E2E_GUARD_CERTIFICATE_SCHEMA_VERSION, } from "../core/nightly-e2e-guard-behavior-certificate.js";
+import { MAX_NIGHTLY_GUARD_FILE_BYTES, NIGHTLY_GUARD_TARGET_TIMEOUT_MS, } from "./doctor-nightly-e2e-guard-contract.js";
+import { createNightlyGuardDeadline, limitNightlyGuardDeadline, nightlyGuardTargetDeadlineReason, } from "./doctor-nightly-e2e-guard-deadline.js";
+import { readNightlyGuardFile } from "./doctor-nightly-e2e-guard-io.js";
+const VERSION = /^1\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/u;
+/**
+ * Lower-case sha256 used as non-executing shipped provenance.
+ * @param bytes - Safely captured target bytes
+ * @returns Lower-case SHA-256 hex digest
+ */
+export const digestNightlyGuardBytes = (bytes) => createHash("sha256").update(bytes).digest("hex");
+/**
+ * Prove a target by bounded no-follow hash and an exact behavior certificate.
+ *
+ * The target is deliberately never imported, spawned, or evaluated. A caller
+ * can therefore retain direct invocation while doctor itself grants untrusted
+ * bytes no filesystem, process, environment, or network capability.
+ * @param projectRoot - Project root forming the containment boundary
+ * @param target - Literal project-relative JavaScript file
+ * @param dependencies - Optional ledger/deadline collaborators
+ * @returns Compatible major-1 version, or an explicit failed proof
+ */
+export async function proveNightlyE2eGuardTarget(projectRoot, target, dependencies = {}) {
+    const outer = dependencies.deadline ??
+        createNightlyGuardDeadline(dependencies.now, dependencies.timeoutMs ?? NIGHTLY_GUARD_TARGET_TIMEOUT_MS, nightlyGuardTargetDeadlineReason(dependencies.timeoutMs ?? NIGHTLY_GUARD_TARGET_TIMEOUT_MS));
+    const deadline = dependencies.deadline
+        ? limitNightlyGuardDeadline(outer, dependencies.timeoutMs ?? NIGHTLY_GUARD_TARGET_TIMEOUT_MS)
+        : outer;
+    const read = await readNightlyGuardFile(projectRoot, target, MAX_NIGHTLY_GUARD_FILE_BYTES, deadline);
+    if (read.state !== "ok") {
+        return { state: "failure", reason: read.reason };
+    }
+    const digest = digestNightlyGuardBytes(read.bytes);
+    const certificates = dependencies.certificates ?? NIGHTLY_E2E_GUARD_BEHAVIOR_CERTIFICATES;
+    const certificate = certificates[digest];
+    if (certificate === undefined) {
+        return {
+            state: "failure",
+            reason: "target bytes are not in Lisa's nightly guard behavior certificate; doctor refuses to execute untrusted JavaScript—upgrade Lisa and apply its exact guard",
+        };
+    }
+    if (NIGHTLY_E2E_GUARD_CERTIFICATE_SCHEMA_VERSION !== 1 ||
+        !VERSION.test(certificate.contractVersion)) {
+        return {
+            state: "failure",
+            reason: "nightly guard behavior certificate is malformed or incompatible",
+        };
+    }
+    return { state: "compatible", version: certificate.contractVersion };
+}
+//# sourceMappingURL=doctor-nightly-e2e-guard-proof.js.map

package/dist/cli/doctor-nightly-e2e-guard-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-proof.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-proof.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,uCAAuC,EACvC,4CAA4C,GAC7C,MAAM,mDAAmD,CAAC;AAE3D,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,GAEhC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,GAEjC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE,MAAM,OAAO,GAAG,kCAAkC,CAAC;AA2BnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAa,EAAU,EAAE,CAC/D,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB,EACnB,MAAc,EACd,eAA8C,EAAE;IAEhD,MAAM,KAAK,GACT,YAAY,CAAC,QAAQ;QACrB,0BAA0B,CACxB,YAAY,CAAC,GAAG,EAChB,YAAY,CAAC,SAAS,IAAI,+BAA+B,EACzD,gCAAgC,CAC9B,YAAY,CAAC,SAAS,IAAI,+BAA+B,CAC1D,CACF,CAAC;IACJ,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ;QACpC,CAAC,CAAC,yBAAyB,CACvB,KAAK,EACL,YAAY,CAAC,SAAS,IAAI,+BAA+B,CAC1D;QACH,CAAC,CAAC,KAAK,CAAC;IACV,MAAM,IAAI,GAAG,MAAM,oBAAoB,CACrC,WAAW,EACX,MAAM,EACN,4BAA4B,EAC5B,QAAQ,CACT,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,YAAY,GAChB,YAAY,CAAC,YAAY,IAAI,uCAAuC,CAAC;IACvE,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,MAAM,EACJ,0JAA0J;SAC7J,CAAC;IACJ,CAAC;IACD,IACE,4CAA4C,KAAK,CAAC;QAClD,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,EAC1C,CAAC;QACD,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,iEAAiE;SAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,CAAC,eAAe,EAAE,CAAC;AACvE,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-remediation.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @file doctor-nightly-e2e-guard-remediation.ts
+ * @description Provenance-aware repair guidance for nightly guard findings
+ * @module cli/doctor-nightly-e2e-guard-remediation
+ */
+import { type HashLedger } from "../core/lisa-owned-provenance.js";
+import { type NightlyGuardCaller } from "./doctor-nightly-e2e-guard-contract.js";
+import type { NightlyGuardDeadline } from "./doctor-nightly-e2e-guard-deadline.js";
+import { type NightlyGuardBehaviorCertificates } from "./doctor-nightly-e2e-guard-proof.js";
+/** Inputs shared by every caller-specific remediation decision. */
+export interface NightlyGuardRemediationInput {
+    /** Host project under inspection. */
+    readonly projectRoot: string;
+    /** Installed Lisa package root. */
+    readonly lisaRoot: string;
+    /** Active caller whose target failed proof. */
+    readonly caller: NightlyGuardCaller;
+    /** Shared whole-operation deadline. */
+    readonly deadline: NightlyGuardDeadline;
+    /** Optional shipped provenance fixture. */
+    readonly ledger?: HashLedger;
+    /** Optional exact behavior-certificate fixture. */
+    readonly certificates?: NightlyGuardBehaviorCertificates;
+}
+/**
+ * Produce exact repair guidance without collapsing missing, unreadable, stale,
+ * and deliberately modified files into the same destructive instruction.
+ * @param input - Caller, package, provenance, and deadline context
+ * @returns One bounded operator-readable remediation
+ */
+export declare function nightlyGuardRemediation(input: NightlyGuardRemediationInput): Promise<string>;
+//# sourceMappingURL=doctor-nightly-e2e-guard-remediation.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-remediation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-remediation.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-remediation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAEL,KAAK,UAAU,EAChB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAEnF,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,qCAAqC,CAAC;AAO7C,mEAAmE;AACnE,MAAM,WAAW,4BAA4B;IAC3C,qCAAqC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,gCAAgC,CAAC;CAC1D;AAOD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,MAAM,CAAC,CAmDjB"}