@davesheffer/hunch 1.45.2 → 1.47.0

package/dist/cli/invocation.d.ts

@@ -11,6 +11,7 @@ export interface ResolvedInvocation {
      * or npx cache), never from a source checkout. */
     installed: boolean;
 }
+/** Faint (dim) ANSI styling. */
 export declare function dim(s: string): string;
 /** Portable invocation written into committed MCP/provider configuration.
  * Keep it independently testable so the distribution pin cannot silently
@@ -20,20 +21,14 @@ export declare function publishedMcpInvocation(): Invocation;
  *  PowerShell can execute the first token; paths and other unsafe tokens use
  *  JSON string quoting, which is accepted by PowerShell, cmd, and POSIX sh. */
 export declare function shellInvocation(inv: Invocation): string;
-/** The doctor command's synthesis-status line(s) for a resolved provider.
- *  Exported for testing — the previous version (a bare provider-name switch,
- *  before the resolveSynthesisProvider preference system existed) had zero
- *  test coverage, which is how issue #8 (openai-compat misreported as "no
- *  assistant CLI found") shipped unnoticed through three review passes. That
- *  bug resurfaces here for the same reason: resolution.statuses carries a
- *  `subscription` field for the CLI providers but openai-compat's is null (it
- *  isn't a subscription), so it must be special-cased explicitly rather than
- *  falling through to the "no assistant CLI" branch. */
+/** Render doctor's synthesis status lines. Exported for testing: an earlier,
+ *  untested version reported openai-compat as "no assistant CLI found". Statuses
+ *  carry a `subscription` for CLI providers but openai-compat's is null, so it is
+ *  special-cased explicitly. */
 export declare function synthesisStatusLines(resolution: ProviderResolution, env: NodeJS.ProcessEnv): string[];
-/** Gate + fetch the Ollama context-window advisory (issue #11): only relevant
- *  for the openai-compat provider, so every other provider is a no-op. Kept
- *  separate from synthesisStatusLines (sync, already fully covered) because
- *  this one makes a best-effort network call. */
+/** Gate + fetch the Ollama context-window advisory. Only openai-compat is
+ *  relevant; kept apart from the sync status lines because it makes a
+ *  best-effort network call. */
 export declare function maybeWarnOllamaContext(providerName: string, env: NodeJS.ProcessEnv): Promise<string | null>;
 /** Classify the entry path without faking import.meta.url in tests. */
 export declare function classifyEntry(entry: string): {
@@ -41,3 +36,17 @@ export declare function classifyEntry(entry: string): {
     installed: boolean;
 };
 export declare function resolveInvocation(): ResolvedInvocation;
+/** The command prefix for the git merge drivers. git runs a driver with the
+ *  repository being merged as its cwd, so the dev-mode `npx tsx <entry>` would
+ *  resolve tsx from THAT repo (or fetch it from the registry), not from Hunch's
+ *  own checkout (#492). In dev mode, launch the absolute node binary against
+ *  this checkout's tsx cli.mjs, the same shape selfBuildInvocation gives the
+ *  git hooks (src/integrations/hooks.ts); every other invocation (published,
+ *  dist, or a caller-supplied one) passes through unchanged. */
+export declare function mergeDriverShell(invShell: string): string;
+/** Filesystem paths, never a file URL: git expands `%`-escapes in the driver
+ *  command, so a percent-encoded URL (any non-ASCII checkout path) would be
+ *  corrupted. POSIX single quotes keep `$`, backticks and `"` literal under the
+ *  /bin/sh git runs drivers with on every platform, and a literal `%` in a path
+ *  is doubled so git expands it back to one. */
+export declare function devMergeDriverShell(execPath: string, tsxCli: string, entry: string): string;

package/dist/cli/invocation.js

@@ -1,12 +1,15 @@
-/** Side-effect-free shared CLI logic — safe for any module (including tests)
- *  to import, unlike src/cli/index.ts, which runs the whole program at
- *  import time. Holds: how to re-invoke this CLI from a git hook / .mcp.json
- *  (working both when running the built dist and in dev via tsx), plus small
- *  formatting helpers (dim(), doctor's synthesisStatusLines()) that need the
- *  same import-safety to be unit-testable. */
+/**
+ * Shared CLI logic that is free of import-time side effects, so any module
+ * (tests included) can import it safely, unlike src/cli/index.ts which runs the
+ * program as soon as it loads. It holds how to re-invoke this CLI from a git hook
+ * or `.mcp.json` (from a built dist and in dev via tsx), plus small formatting
+ * helpers (`dim()`, doctor's `synthesisStatusLines()`) that need the same import
+ * safety to be unit-testable.
+ */
 import { fileURLToPath } from "node:url";
 import { probeOllamaNumCtx } from "../synthesis/provider.js";
 import { HUNCH_NPX_PACKAGE_SPEC } from "../core/version.js";
+/** Faint (dim) ANSI styling. */
 export function dim(s) {
     return `\x1b[2m${s}\x1b[0m`;
 }
@@ -23,15 +26,10 @@ export function shellInvocation(inv) {
     const token = (part) => /^[A-Za-z0-9_@:=+.,/-]+$/.test(part) ? part : JSON.stringify(part);
     return [inv.command, ...inv.args].map(token).join(" ");
 }
-/** The doctor command's synthesis-status line(s) for a resolved provider.
- *  Exported for testing — the previous version (a bare provider-name switch,
- *  before the resolveSynthesisProvider preference system existed) had zero
- *  test coverage, which is how issue #8 (openai-compat misreported as "no
- *  assistant CLI found") shipped unnoticed through three review passes. That
- *  bug resurfaces here for the same reason: resolution.statuses carries a
- *  `subscription` field for the CLI providers but openai-compat's is null (it
- *  isn't a subscription), so it must be special-cased explicitly rather than
- *  falling through to the "no assistant CLI" branch. */
+/** Render doctor's synthesis status lines. Exported for testing: an earlier,
+ *  untested version reported openai-compat as "no assistant CLI found". Statuses
+ *  carry a `subscription` for CLI providers but openai-compat's is null, so it is
+ *  special-cased explicitly. */
 export function synthesisStatusLines(resolution, env) {
     const provider = resolution.provider;
     if (resolution.source === "unavailable-initiator") {
@@ -43,39 +41,38 @@ export function synthesisStatusLines(resolution, env) {
     if (resolution.source === "initiator") {
         return [`            ↳ agent calls remain with ${resolution.initiator}, using that CLI's configured authentication.`];
     }
-    const selected = resolution.statuses.find((s) => s.name === provider.name);
-    if (selected?.subscription) {
-        return [`            ↳ LLM synthesis uses your ${selected.subscription}; provider API credentials are not used.`];
+    const status = resolution.statuses.find((s) => s.name === provider.name);
+    if (status?.subscription) {
+        return [`            ↳ LLM synthesis uses your ${status.subscription}; provider API credentials are not used.`];
     }
     if (provider.name === "openai-compat") {
-        const base = env.HUNCH_SYNTH_BASE_URL ?? "(unset)";
-        const model = env.HUNCH_SYNTH_MODEL ?? "(unset)";
+        const base = env.HUNCH_SYNTH_BASE_URL || "(unset)";
+        const model = env.HUNCH_SYNTH_MODEL || "(unset)";
         const keyNote = env.HUNCH_SYNTH_API_KEY ? " (HUNCH_SYNTH_API_KEY set)" : " (no API key)";
         return [`            ↳ LLM synthesis via local/self-hosted endpoint ${base} (model: ${model})${keyNote}`];
     }
     if (resolution.source === "ambiguous") {
-        const names = resolution.statuses.filter((s) => s.name !== "deterministic" && s.available).map((s) => s.name);
+        const names = resolution.statuses.filter((s) => s.available && s.name !== "deterministic").map((s) => s.name);
         return [
             dim(`            ↳ ${names.join(", ")} are available; Hunch will not guess which provider to use.`),
-            dim(`              choose one locally: ${names.map((name) => `hunch provider ${name}`).join("  or  ")}`),
+            dim(`              choose one locally: ${names.map((n) => `hunch provider ${n}`).join("  or  ")}`),
         ];
     }
     if (resolution.source === "unavailable-preference") {
         return [dim(`            ↳ ${resolution.preference} was selected but is unavailable; using the offline heuristic.`)];
     }
     return [
-        dim(`            ↳ no assistant CLI found — synthesis uses the offline heuristic (advisory, low-confidence).`),
-        dim(`              install or log into Claude Code, Codex, or Cursor; then select one with \`hunch provider <name>\`.`),
+        dim("            ↳ no assistant CLI found — synthesis uses the offline heuristic (advisory, low-confidence)."),
+        dim("              install or log into Claude Code, Codex, or Cursor; then select one with `hunch provider <name>`."),
     ];
 }
-/** Gate + fetch the Ollama context-window advisory (issue #11): only relevant
- *  for the openai-compat provider, so every other provider is a no-op. Kept
- *  separate from synthesisStatusLines (sync, already fully covered) because
- *  this one makes a best-effort network call. */
+/** Gate + fetch the Ollama context-window advisory. Only openai-compat is
+ *  relevant; kept apart from the sync status lines because it makes a
+ *  best-effort network call. */
 export async function maybeWarnOllamaContext(providerName, env) {
     if (providerName !== "openai-compat")
         return null;
-    return probeOllamaNumCtx(env.HUNCH_SYNTH_BASE_URL ?? "", env.HUNCH_SYNTH_MODEL ?? "");
+    return probeOllamaNumCtx(env.HUNCH_SYNTH_BASE_URL || "", env.HUNCH_SYNTH_MODEL || "");
 }
 /** Classify the entry path without faking import.meta.url in tests. */
 export function classifyEntry(entry) {
@@ -125,4 +122,27 @@ export function resolveInvocation() {
         installed,
     };
 }
+/** The command prefix for the git merge drivers. git runs a driver with the
+ *  repository being merged as its cwd, so the dev-mode `npx tsx <entry>` would
+ *  resolve tsx from THAT repo (or fetch it from the registry), not from Hunch's
+ *  own checkout (#492). In dev mode, launch the absolute node binary against
+ *  this checkout's tsx cli.mjs, the same shape selfBuildInvocation gives the
+ *  git hooks (src/integrations/hooks.ts); every other invocation (published,
+ *  dist, or a caller-supplied one) passes through unchanged. */
+export function mergeDriverShell(invShell) {
+    const inv = resolveInvocation();
+    if (inv.installed || !inv.shell.startsWith("npx tsx ") || invShell !== inv.shell)
+        return invShell;
+    const entry = fileURLToPath(import.meta.url).replace(/invocation\.ts$/, "index.ts");
+    return devMergeDriverShell(process.execPath, fileURLToPath(import.meta.resolve("tsx/cli")), entry);
+}
+/** Filesystem paths, never a file URL: git expands `%`-escapes in the driver
+ *  command, so a percent-encoded URL (any non-ASCII checkout path) would be
+ *  corrupted. POSIX single quotes keep `$`, backticks and `"` literal under the
+ *  /bin/sh git runs drivers with on every platform, and a literal `%` in a path
+ *  is doubled so git expands it back to one. */
+export function devMergeDriverShell(execPath, tsxCli, entry) {
+    const quote = (s) => `'${s.replace(/'/g, "'\\''")}'`.replace(/%/g, "%%");
+    return [execPath, tsxCli, entry].map(quote).join(" ");
+}
 //# sourceMappingURL=invocation.js.map

package/dist/cli/verify.d.ts

@@ -0,0 +1,28 @@
+import type { Command } from "commander";
+import { type ImpactMap } from "../core/testSelection.js";
+export declare const DEFAULT_IMPACT_MAP = ".hunch-cache/test-impact.json";
+/** Split a command template into argv tokens; double/single quotes group. */
+export declare function tokenize(template: string): string[];
+/** The runner argv (never a shell). A configured template wins (`{files}` expands
+ *  to one argv entry per file); otherwise this repo's runner when present, else
+ *  `npm test` (full) / `npm test -- <files>`. */
+export declare function runnerArgv(root: string, template: string | undefined, files: string[], extra: string[], full: boolean): string[];
+/** Run each test in its own runner process under NODE_V8_COVERAGE (inherited
+ *  by spawned CLI/MCP children) and record the repo files each executed. An
+ *  entry is `complete` only when the test file passed and produced coverage;
+ *  failing tests still record their (partial) files. `only` merges into the
+ *  old map, keeping each untouched entry's own commit stamp. */
+export declare function refreshImpactMap(opts: {
+    root: string;
+    tests: string[];
+    files: string[];
+    template?: string;
+    mapPath: string;
+    only?: string[];
+    concurrency?: number;
+    log?: (line: string) => void;
+}): Promise<{
+    map: ImpactMap;
+    failed: string[];
+}>;
+export declare function registerVerifyCommand(program: Command): void;

package/dist/cli/verify.js

@@ -0,0 +1,265 @@
+import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { availableParallelism, tmpdir } from "node:os";
+import { dirname, isAbsolute, join, relative } from "node:path";
+import { readConfig } from "../core/config.js";
+import { writeFileAtomic } from "../core/io.js";
+import { hunchPaths } from "../core/paths.js";
+import { buildImportGraph, changedFiles, coverageFiles, discoverTests, listRepoFiles, loadImpactMap, selectTests, testDependencyModel, } from "../core/testSelection.js";
+export const DEFAULT_IMPACT_MAP = ".hunch-cache/test-impact.json";
+function testScript(root) {
+    try {
+        const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+        return typeof pkg.scripts?.test === "string" ? pkg.scripts.test : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Split a command template into argv tokens; double/single quotes group. */
+export function tokenize(template) {
+    const out = [];
+    for (const m of template.matchAll(/"([^"]*)"|'([^']*)'|(\S+)/g))
+        out.push(m[1] ?? m[2] ?? m[3]);
+    return out;
+}
+/** npm without a shell: run npm-cli.js under this Node; POSIX may exec `npm`. */
+function npmArgv(args) {
+    const dir = dirname(process.execPath);
+    for (const cli of [join(dir, "node_modules/npm/bin/npm-cli.js"), join(dir, "../lib/node_modules/npm/bin/npm-cli.js")]) {
+        if (existsSync(cli))
+            return [process.execPath, cli, ...args];
+    }
+    if (process.platform === "win32")
+        throw new Error("cannot locate npm-cli.js; set verify.command in .hunch/config.json");
+    return ["npm", ...args];
+}
+/** The runner argv (never a shell). A configured template wins (`{files}` expands
+ *  to one argv entry per file); otherwise this repo's runner when present, else
+ *  `npm test` (full) / `npm test -- <files>`. */
+export function runnerArgv(root, template, files, extra, full) {
+    if (template) {
+        const tokens = tokenize(template);
+        const argv = tokens.includes("{files}") ? tokens.flatMap((t) => t === "{files}" ? files : [t]) : [...tokens, ...files];
+        if (argv[0] === "node")
+            argv[0] = process.execPath;
+        return [...argv, ...extra];
+    }
+    if (full && testScript(root))
+        return npmArgv(["test", ...(extra.length ? ["--", ...extra] : [])]);
+    if (existsSync(join(root, "tooling/run-tests.mjs")))
+        return [process.execPath, "tooling/run-tests.mjs", ...files, ...extra];
+    return npmArgv(["test", "--", ...files, ...extra]);
+}
+const display = (argv) => argv.map((a, i) => i === 0 && a === process.execPath ? "node" : /\s/.test(a) ? JSON.stringify(a) : a).join(" ");
+function printSelection(sel, total, note, hasMap) {
+    for (const line of note)
+        console.log(`  note: ${line}`);
+    if (sel.mode === "none") {
+        console.log("✓ no tests selected — nothing the changes can affect.");
+        return;
+    }
+    if (sel.mode === "full") {
+        console.log(`▶ FULL suite (${total} tests): ${sel.fullReason}`);
+        if (sel.unattributed.length)
+            console.log(`  unattributed: ${sel.unattributed.join(", ")}`);
+        // Only trusted map entries narrow spawning tests; triggers, non-code and unattributed changes stay FULL.
+        const spawnWide = /^selection too broad/.test(sel.fullReason ?? "") && Object.values(sel.reasons).some((r) => r.some((why) => why.includes("whole program")));
+        if (!hasMap && spawnWide)
+            console.log("  Run `hunch verify --refresh-map` once to enable narrow selection for CLI/MCP tests.");
+        return;
+    }
+    console.log(`▶ ${sel.tests.length} of ${total} tests selected:`);
+    for (const test of sel.tests)
+        console.log(`  ${test}  ← ${sel.reasons[test].join("; ")}`);
+}
+function headSha(root) {
+    try {
+        return execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8", windowsHide: true, stdio: ["ignore", "pipe", "pipe"] }).trim();
+    }
+    catch {
+        return "";
+    }
+}
+function readCoverageDir(dir) {
+    if (!existsSync(dir))
+        return [];
+    const reports = [];
+    for (const name of readdirSync(dir)) {
+        if (!name.endsWith(".json"))
+            continue;
+        try {
+            reports.push(JSON.parse(readFileSync(join(dir, name), "utf8")));
+        }
+        catch { /* partial write → skip */ }
+    }
+    return reports;
+}
+/** Run each test in its own runner process under NODE_V8_COVERAGE (inherited
+ *  by spawned CLI/MCP children) and record the repo files each executed. An
+ *  entry is `complete` only when the test file passed and produced coverage;
+ *  failing tests still record their (partial) files. `only` merges into the
+ *  old map, keeping each untouched entry's own commit stamp. */
+export async function refreshImpactMap(opts) {
+    const { root, mapPath } = opts;
+    const log = opts.log ?? console.log;
+    const run = opts.only?.length ? opts.only.map((t) => t.replace(/\\/g, "/").replace(/^\.\//, "")) : opts.tests;
+    let previous = null;
+    if (opts.only?.length) {
+        try {
+            previous = loadImpactMap(mapPath);
+        }
+        catch {
+            previous = null;
+        }
+    }
+    const repoFiles = new Set(opts.files);
+    const commit = headSha(root);
+    const { closureHash } = testDependencyModel(root, opts.files, buildImportGraph(root, opts.files));
+    const covDir = mkdtempSync(join(tmpdir(), "hunch-verify-cov-"));
+    const map = { ...(previous?.map ?? {}) };
+    const failed = [];
+    const width = Math.max(1, opts.concurrency ?? availableParallelism() - 1);
+    const env = { ...process.env };
+    delete env.NODE_TEST_CONTEXT; // a parent test runner must not turn the child into a reporter
+    let next = 0;
+    const worker = async () => {
+        while (next < run.length) {
+            const index = next++;
+            const test = run[index];
+            const dir = join(covDir, String(index));
+            const argv = runnerArgv(root, opts.template, [test], [], false);
+            const status = await new Promise((done) => {
+                const child = spawn(argv[0], argv.slice(1), { cwd: root, stdio: "ignore", windowsHide: true, env: { ...env, NODE_V8_COVERAGE: dir } });
+                child.on("error", () => done(1));
+                child.on("close", (code) => done(code ?? 1));
+            });
+            const reports = readCoverageDir(dir);
+            if (status !== 0)
+                failed.push(test);
+            const files = coverageFiles(reports, root, repoFiles).filter((f) => f !== test);
+            map[test] = { files, complete: status === 0 && reports.length > 0, commit, closureHash };
+            log(`  ${status === 0 ? "✓" : "✗"} ${test}  (${files.length} files)`);
+        }
+    };
+    try {
+        await Promise.all(Array.from({ length: Math.min(width, run.length) }, worker));
+    }
+    finally {
+        // Coverage is scratch; a straggling child holding a handle must not fail the refresh.
+        try {
+            rmSync(covDir, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 });
+        }
+        catch { /* best effort */ }
+    }
+    const sortedMap = {};
+    for (const test of Object.keys(map).sort())
+        sortedMap[test] = map[test];
+    const result = { version: 2, commit, generatedAt: new Date().toISOString(), closureHash, map: sortedMap };
+    mkdirSync(dirname(mapPath), { recursive: true });
+    writeFileAtomic(mapPath, JSON.stringify(result, null, 2) + "\n");
+    return { map: result, failed: failed.sort() };
+}
+export function registerVerifyCommand(program) {
+    program
+        .command("verify")
+        .description("Run only the tests the current change can affect (fail-closed: anything unattributed runs the full suite).")
+        .argument("[runnerArgs...]", "extra arguments for the test runner (after --)")
+        .option("--staged", "select from staged changes only")
+        .option("--base <ref>", "select from merge-base(<ref>, HEAD)..HEAD plus the working tree")
+        .option("--list", "print the selection with reasons; run nothing")
+        .option("--full", "run the full suite")
+        .option("--ci", "run the full suite (CI)")
+        .option("--json", "print the selection as JSON; run nothing")
+        .option("--map <path>", `test impact map (default ${DEFAULT_IMPACT_MAP})`)
+        .option("--refresh-map", "rebuild the impact map: run each test under V8 coverage")
+        .option("--only <tests...>", "with --refresh-map: refresh only these tests, merging into the existing map")
+        .action(async (runnerArgs, opts) => {
+        let root;
+        try {
+            root = execFileSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", windowsHide: true, stdio: ["ignore", "pipe", "pipe"] }).trim();
+        }
+        catch {
+            console.error("hunch verify must run inside a git repository");
+            process.exitCode = 1;
+            return;
+        }
+        const config = readConfig(hunchPaths(root)).verify ?? {};
+        const files = listRepoFiles(root);
+        const allTests = discoverTests(files, typeof config.tests === "string" ? config.tests : undefined);
+        const template = typeof config.command === "string" ? config.command : undefined;
+        const mapPath = opts.map ? (isAbsolute(opts.map) ? opts.map : join(root, opts.map)) : join(root, DEFAULT_IMPACT_MAP);
+        if (opts.refreshMap) {
+            const total = opts.only?.length ?? allTests.length;
+            console.log(`▶ refreshing impact map: ${total} test file(s) under V8 coverage`);
+            const { map, failed } = await refreshImpactMap({ root, tests: allTests, files, template, mapPath, only: opts.only });
+            const covered = new Set(Object.values(map.map).flatMap((e) => e.files)).size;
+            console.log(`✓ wrote ${opts.map ?? DEFAULT_IMPACT_MAP}: ${Object.keys(map.map).length} tests → ${covered} files @ ${map.commit.slice(0, 12) || "(no HEAD)"}`);
+            if (failed.length)
+                console.log(`  ${failed.length} test file(s) failed (partial coverage recorded, not trusted): ${failed.join(", ")}`);
+            return;
+        }
+        const note = [];
+        let sel;
+        let hasMap = false;
+        if (opts.full || opts.ci) {
+            sel = { mode: "full", tests: allTests, reasons: {}, fullReason: opts.ci ? "--ci" : "--full", unattributed: [], mapUsed: [] };
+        }
+        else {
+            const mode = opts.base ? { kind: "base", ref: opts.base } : opts.staged ? { kind: "staged" } : { kind: "worktree" };
+            let impactMap;
+            try {
+                impactMap = loadImpactMap(mapPath) ?? undefined;
+            }
+            catch (e) {
+                note.push(`${e.message}; ignoring it`);
+            }
+            if (!impactMap && !note.length)
+                note.push(`no impact map at ${opts.map ?? DEFAULT_IMPACT_MAP}; using the import graph (build one: hunch verify --refresh-map)`);
+            const model = testDependencyModel(root, files, buildImportGraph(root, files));
+            // The map itself is a derived cache; a not-yet-ignored copy is never a code change.
+            const mapRel = relative(root, mapPath).replace(/\\/g, "/");
+            const changed = changedFiles(root, mode).filter((f) => f !== mapRel);
+            sel = selectTests({
+                changedFiles: changed, allTests, impactMap, importGraph: model.dependencies,
+                testText: model.testText, spawning: model.spawning, closureHash: model.closureHash,
+                wholeProgram: [...model.wholeProgram, ...changed.filter((f) => f.startsWith("src/"))], testNamers: model.testNamers,
+            });
+            hasMap = !!impactMap;
+            if (impactMap) {
+                const head = headSha(root);
+                const stale = sel.mapUsed.filter((t) => impactMap.map[t].commit !== head);
+                if (stale.length)
+                    note.push(`${stale.length} impact-map entr${stale.length === 1 ? "y" : "ies"} used were recorded at another commit than HEAD ${head.slice(0, 12)} (${stale.join(", ")}); the map only adds tests`);
+                if (Object.values(impactMap.map).some((e) => e.closureHash !== model.closureHash)) {
+                    note.push("CLI/MCP/tooling import closure changed since some entries were recorded; those spawning tests use the whole program");
+                }
+            }
+        }
+        if (opts.json) {
+            console.log(JSON.stringify({ ...sel, total: allTests.length }, null, 2));
+            return;
+        }
+        printSelection(sel, allTests.length, note, hasMap);
+        if (opts.list || sel.mode === "none")
+            return;
+        let argv;
+        try {
+            argv = runnerArgv(root, template, sel.tests, runnerArgs, sel.mode === "full");
+        }
+        catch (e) {
+            console.error(e.message);
+            process.exitCode = 1;
+            return;
+        }
+        console.log(`▶ running: ${display(argv)}\n`);
+        const run = spawnSync(argv[0], argv.slice(1), { cwd: root, stdio: "inherit", windowsHide: true });
+        if (run.error) {
+            console.error(run.error.message);
+            process.exitCode = 1;
+            return;
+        }
+        process.exitCode = run.status ?? 1;
+    });
+}
+//# sourceMappingURL=verify.js.map

package/dist/constitution/delta.js

@@ -27,10 +27,10 @@ function view(file, source) {
 }
 function viewOfParsed(parsed) {
     const symbols = new Map(parsed.symbols.map((s) => [symbolKey(s), s]));
-    const byIndex = new Map(parsed.symbols.map((s, i) => [i, s]));
+    const symbolAt = new Map(parsed.symbols.map((s, i) => [i, s]));
     const calls = new Map();
     for (const [index, callees] of attributeCalls(parsed)) {
-        const caller = byIndex.get(index);
+        const caller = symbolAt.get(index);
         if (!caller)
             continue;
         for (const [callee, member] of callees) {

package/dist/constitution/experiment.d.ts

@@ -237,8 +237,8 @@ export declare const ExperimentOutcomeSchema: z.ZodObject<{
         decision: z.ZodEnum<{
             rejected: "rejected";
             abandoned: "abandoned";
-            uncompilable: "uncompilable";
             timeout: "timeout";
+            uncompilable: "uncompilable";
             cannot_decide: "cannot_decide";
             accepted_precise: "accepted_precise";
             accepted_edited: "accepted_edited";

package/dist/constitution/sourceMutation.js

@@ -93,21 +93,23 @@ function parsedSymbolFor(graphSymbol, parsed) {
     const base = symbolId(graphSymbol.file, graphSymbol.name, graphSymbol.kind);
     return matches.find((_symbol, index) => (index === 0 ? base : `${base}_${index}`) === graphSymbol.id) ?? null;
 }
-/** `start`/`end` are JS string (UTF-16 code unit) indices. Despite their
- *  names, parse.ts's startByte/endByte/atByte carry the same units — native
- *  tree-sitter indexes the JS string it was handed, not its UTF-8 encoding —
- *  so every scan and splice against them must be string-based, never Buffer-
- *  based. */
-function spliceChars(source, replacements) {
+/** Apply `{ start, end, text }` replacements to `source`. Offsets are JavaScript
+ *  string (UTF-16 code unit) indices: the parser's `startByte`/`endByte`/`atByte`
+ *  fields, despite their names, carry the same units (tree-sitter indexes the JS
+ *  string it was given, not its UTF-8 bytes), so every scan and splice against
+ *  them must be string-based, never Buffer/byte-based. */
+function applyReplacements(source, replacements) {
     let result = source;
     for (const replacement of [...replacements].sort((a, b) => b.start - a.start)) {
         result = result.slice(0, replacement.start) + replacement.text + result.slice(replacement.end);
     }
     return result;
 }
-/** Where a new top-level statement (an import) can be inserted without splitting a shebang line. */
-function insertionPoint(source) {
-    return source.startsWith("#!") ? Math.max(0, source.indexOf("\n") + 1) : 0;
+/** Offset where a new top-level import may go: 0, or just past a leading shebang line. */
+function importInsertionOffset(source) {
+    if (!source.startsWith("#!"))
+        return 0;
+    return Math.max(0, source.indexOf("\n") + 1);
 }
 function mutateSource(policy, base, sourceFile, source) {
     const assertion = policy.assertion;
@@ -150,10 +152,14 @@ function mutateSource(policy, base, sourceFile, source) {
         const specifier = relativeSpecifier(sourceFile, targetFile);
         if (parsed.imports.some((candidate) => candidate === specifier))
             return { error: "mutation-component-import-already-present" };
-        const insertion = insertionPoint(source);
+        const insertion = importInsertionOffset(source);
         return {
             file: sourceFile,
-            source: spliceChars(source, [{ start: insertion, end: insertion, text: `import ${JSON.stringify(specifier)}; // hunch deterministic component mutation\n` }]),
+            source: applyReplacements(source, [{
+                    start: insertion,
+                    end: insertion,
+                    text: `import ${JSON.stringify(specifier)}; // hunch deterministic component mutation\n`,
+                }]),
         };
     }
     const subject = symbolForSelector(base, assertion.subject);
@@ -166,7 +172,7 @@ function mutateSource(policy, base, sourceFile, source) {
     if (!definition)
         return { error: "mutation-subject-definition-unresolved" };
     if (assertion.kind === "exists") {
-        return { file: subject.file, source: spliceChars(source, [{ start: definition.startByte, end: definition.endByte, text: "" }]) };
+        return { file: subject.file, source: applyReplacements(source, [{ start: definition.startByte, end: definition.endByte, text: "" }]) };
     }
     if (assertion.kind === "not-reaches"
         && assertion.relation.edges.length === 1
@@ -178,10 +184,14 @@ function mutateSource(policy, base, sourceFile, source) {
         if (parsed.imports.some((specifier) => externalPackage(specifier) === dependency)) {
             return { error: "mutation-forbidden-import-already-present" };
         }
-        const insertion = insertionPoint(source);
+        const insertion = importInsertionOffset(source);
         return {
             file: subject.file,
-            source: spliceChars(source, [{ start: insertion, end: insertion, text: `import ${JSON.stringify(dependency)}; // hunch deterministic source mutation\n` }]),
+            source: applyReplacements(source, [{
+                    start: insertion,
+                    end: insertion,
+                    text: `import ${JSON.stringify(dependency)}; // hunch deterministic source mutation\n`,
+                }]),
         };
     }
     const object = symbolForSelector(base, assertion.object);
@@ -198,11 +208,11 @@ function mutateSource(policy, base, sourceFile, source) {
             .map((call) => ({ start: call.atByte, end: call.endByte, text: "hunchMutationRemovedCall" }));
         if (!replacements.length)
             return { error: "mutation-required-call-unresolved" };
-        return { file: subject.file, source: spliceChars(source, replacements) };
+        return { file: subject.file, source: applyReplacements(source, replacements) };
     }
     if (!assertion.relation.edges.includes("calls"))
         return { error: "mutation-call-edge-not-supported" };
-    // String search, matching definition.startByte/endByte's actual units -- see spliceChars' doc comment.
+    // String search: offsets are string indices (see applyReplacements), not bytes.
     const open = source.indexOf("{", definition.startByte);
     if (open < 0 || open >= definition.endByte)
         return { error: "mutation-subject-body-unsupported" };
@@ -210,7 +220,7 @@ function mutateSource(policy, base, sourceFile, source) {
     if (object.file !== subject.file) {
         const specifier = relativeSpecifier(subject.file, object.file);
         if (!parsed.imports.includes(specifier)) {
-            const insertion = insertionPoint(source);
+            const insertion = importInsertionOffset(source);
             replacements.push({
                 start: insertion,
                 end: insertion,
@@ -220,7 +230,7 @@ function mutateSource(policy, base, sourceFile, source) {
     }
     return {
         file: subject.file,
-        source: spliceChars(source, replacements),
+        source: applyReplacements(source, replacements),
     };
 }
 function removeWorktree(root, hooks, env, checkout) {