@davesheffer/hunch 1.7.0 → 1.7.1

package/dist/constitution/shadow.js

@@ -0,0 +1,235 @@
+import { shortHash } from "../core/ids.js";
+import { canonicalHash } from "./canonical.js";
+import { assessHistoryDispositions } from "./disposition.js";
+import { HistoryDispositionClassificationSchema, ShadowDispositionSchema, ShadowEvaluationRecordSchema, } from "./schema.js";
+export function policyEvaluationContentHash(evaluation) {
+    const { deterministic_hash: _hash, ...body } = evaluation;
+    return canonicalHash(body);
+}
+export function shadowEvaluationContentHash(record) {
+    const { id: _id, content_hash: _contentHash, ...body } = record;
+    return canonicalHash(body);
+}
+export function shadowEvaluationIdentityHash(record) {
+    return canonicalHash({
+        policy_id: record.policy_id,
+        proof_id: record.proof_id,
+        policy_hash: record.policy_hash,
+        plan_hash: record.plan_hash,
+        repository_head: record.evaluation.repository.head,
+        graph_hash: record.evaluation.repository.graph_hash,
+    });
+}
+export function shadowDispositionContentHash(record) {
+    const { id: _id, content_hash: _contentHash, ...body } = record;
+    return canonicalHash(body);
+}
+export function shadowDispositionJudgmentHash(record) {
+    const { id: _id, content_hash: _contentHash, created_at: _createdAt, ...body } = record;
+    return canonicalHash(body);
+}
+export function compileShadowEvaluation(policy, proof, expectedPolicyHash, evaluation, alsoDetectedBy, latencyMs, now = new Date().toISOString()) {
+    if (policy.proof !== proof.id)
+        throw new Error(`policy ${policy.id} does not link proof ${proof.id}`);
+    if (proof.policy_hash !== expectedPolicyHash)
+        throw new Error(`proof ${proof.id} does not match current policy semantics`);
+    if (proof.data_class !== policy.data_class)
+        throw new Error(`proof ${proof.id} does not match policy ${policy.id} data class`);
+    if (evaluation.policy_id !== policy.id)
+        throw new Error(`shadow evaluation does not belong to policy ${policy.id}`);
+    if (evaluation.evaluator.name !== proof.evaluator.name || evaluation.evaluator.version !== proof.evaluator.version) {
+        throw new Error(`shadow evaluation does not use proof ${proof.id} evaluator`);
+    }
+    if (evaluation.deterministic_hash !== policyEvaluationContentHash(evaluation))
+        throw new Error("shadow evaluation deterministic hash mismatch");
+    if (!Number.isFinite(latencyMs) || latencyMs < 0)
+        throw new Error("shadow evaluation latency must be a non-negative finite number");
+    const body = {
+        record_type: "evaluation",
+        policy_id: policy.id,
+        proof_id: proof.id,
+        policy_hash: proof.policy_hash,
+        plan_hash: proof.plan_hash,
+        evaluation,
+        also_detected_by: [...new Set(alsoDetectedBy.filter((id) => id !== policy.id))].sort(),
+        latency_ms: latencyMs,
+        data_class: policy.data_class,
+        observed_at: now,
+    };
+    const contentHash = canonicalHash(body);
+    return ShadowEvaluationRecordSchema.parse({
+        id: `shadow_${shortHash(contentHash)}`,
+        content_hash: contentHash,
+        ...body,
+    });
+}
+export function compileShadowDisposition(evaluation, classification, actor, reason, opts = {}) {
+    if (evaluation.evaluation.result !== "violated")
+        throw new Error("shadow dispositions apply only to violated shadow evaluations");
+    const body = {
+        record_type: "disposition",
+        shadow_id: evaluation.id,
+        policy_id: evaluation.policy_id,
+        proof_id: evaluation.proof_id,
+        policy_hash: evaluation.policy_hash,
+        evaluation_hash: evaluation.evaluation.deterministic_hash,
+        classification: HistoryDispositionClassificationSchema.parse(classification),
+        actor,
+        reason: reason.trim(),
+        supersedes: opts.supersedes ?? null,
+        data_class: evaluation.data_class,
+        created_at: opts.now ?? new Date().toISOString(),
+    };
+    const contentHash = canonicalHash(body);
+    return ShadowDispositionSchema.parse({
+        id: `sdisp_${shortHash(contentHash)}`,
+        content_hash: contentHash,
+        ...body,
+    });
+}
+/** Resolve append-only correction chains without trusting timestamps. */
+export function currentShadowDispositions(records) {
+    const byId = new Map(records.map((record) => [record.id, record]));
+    if (byId.size !== records.length)
+        throw new Error("duplicate shadow disposition id");
+    const childCount = new Map();
+    for (const record of records) {
+        if (!record.supersedes)
+            continue;
+        const parent = byId.get(record.supersedes);
+        if (!parent)
+            throw new Error(`shadow disposition ${record.id} supersedes missing ${record.supersedes}`);
+        if (parent.policy_id !== record.policy_id || parent.proof_id !== record.proof_id || parent.shadow_id !== record.shadow_id) {
+            throw new Error(`shadow disposition ${record.id} supersedes a different policy/proof/evaluation`);
+        }
+        childCount.set(parent.id, (childCount.get(parent.id) ?? 0) + 1);
+        if (childCount.get(parent.id) > 1)
+            throw new Error(`shadow disposition ${parent.id} has a branched supersession chain`);
+    }
+    for (const record of records) {
+        const visited = new Set();
+        let cursor = record;
+        while (cursor?.supersedes) {
+            if (visited.has(cursor.id))
+                throw new Error(`shadow disposition chain contains a cycle at ${cursor.id}`);
+            visited.add(cursor.id);
+            cursor = byId.get(cursor.supersedes);
+        }
+    }
+    const current = records
+        .filter((record) => !childCount.has(record.id))
+        .sort((left, right) => left.policy_id.localeCompare(right.policy_id) || left.shadow_id.localeCompare(right.shadow_id));
+    const currentByEvaluation = new Set();
+    for (const record of current) {
+        const key = `${record.policy_id}:${record.proof_id}:${record.shadow_id}`;
+        if (currentByEvaluation.has(key))
+            throw new Error(`shadow evaluation ${record.shadow_id} has multiple current dispositions`);
+        currentByEvaluation.add(key);
+    }
+    return current;
+}
+export const DEFAULT_SHADOW_THRESHOLDS = {
+    minApplicable: 20,
+    recentApplicable: 100,
+    maxUnknownErrorRate: 0.01,
+    minMutationSensitivity: 0.95,
+};
+const proofRank = { P0: 0, P1: 1, P2: 2, P3: 3, P4: 4, P5: 5 };
+export function scoreShadowPrecision(policy, proof, evaluations, dispositions, historyDispositions, thresholdOverrides = {}) {
+    const thresholds = { ...DEFAULT_SHADOW_THRESHOLDS, ...thresholdOverrides };
+    if (!Number.isInteger(thresholds.minApplicable) || thresholds.minApplicable < 0)
+        throw new Error("shadow minApplicable must be a non-negative integer");
+    if (!Number.isInteger(thresholds.recentApplicable) || thresholds.recentApplicable < 1)
+        throw new Error("shadow recentApplicable must be a positive integer");
+    if (thresholds.maxUnknownErrorRate < 0 || thresholds.maxUnknownErrorRate > 1)
+        throw new Error("shadow maxUnknownErrorRate must be between 0 and 1");
+    if (thresholds.minMutationSensitivity < 0 || thresholds.minMutationSensitivity > 1)
+        throw new Error("shadow minMutationSensitivity must be between 0 and 1");
+    const exact = evaluations.filter((record) => record.proof_id === proof.id && record.policy_hash === proof.policy_hash);
+    const allApplicable = exact.filter((record) => record.evaluation.result !== "not_applicable");
+    const applicable = allApplicable
+        .sort((left, right) => right.observed_at.localeCompare(left.observed_at) || right.id.localeCompare(left.id))
+        .slice(0, thresholds.recentApplicable);
+    const currentDispositions = currentShadowDispositions(dispositions);
+    const classificationCounts = {
+        true_positive_actionable: 0,
+        true_positive_accepted_exception: 0,
+        false_positive_selector: 0,
+        false_positive_semantics: 0,
+        false_positive_stale: 0,
+        unknown_insufficient_parser: 0,
+        unclassified: 0,
+    };
+    for (const record of applicable.filter((candidate) => candidate.evaluation.result === "violated")) {
+        const disposition = currentDispositions.find((candidate) => candidate.shadow_id === record.id
+            && candidate.proof_id === proof.id
+            && candidate.policy_hash === proof.policy_hash
+            && candidate.evaluation_hash === record.evaluation.deterministic_hash);
+        if (disposition)
+            classificationCounts[disposition.classification] += 1;
+        else
+            classificationCounts.unclassified += 1;
+    }
+    const truePositives = classificationCounts.true_positive_actionable + classificationCounts.true_positive_accepted_exception;
+    const falsePositives = classificationCounts.false_positive_selector + classificationCounts.false_positive_semantics + classificationCounts.false_positive_stale;
+    const confirmedDenominator = truePositives + falsePositives;
+    const violationCount = applicable.filter((record) => record.evaluation.result === "violated").length;
+    const unknownErrors = applicable.filter((record) => record.evaluation.result === "unknown" || record.evaluation.result === "error").length;
+    const unknownErrorRate = applicable.length ? unknownErrors / applicable.length : 0;
+    const requiredMutations = proof.mutation_receipts.filter((receipt) => receipt.required);
+    const mutationSensitivity = requiredMutations.length
+        ? requiredMutations.filter((receipt) => receipt.passed).length / requiredMutations.length
+        : 0;
+    const historyAssessment = assessHistoryDispositions(proof, historyDispositions);
+    const reasons = [];
+    if (proofRank[proof.proof_class] < proofRank.P3)
+        reasons.push(`Proof ${proof.id} is ${proof.proof_class}; P3+ is required.`);
+    if (proof.current.satisfied !== 1 || proof.current.unknown || proof.current.error)
+        reasons.push("Proof has no clean satisfied baseline.");
+    if (historyAssessment.blocking_error)
+        reasons.push(historyAssessment.blocking_error);
+    if (mutationSensitivity < thresholds.minMutationSensitivity)
+        reasons.push(`Required mutation sensitivity ${mutationSensitivity.toFixed(3)} is below ${thresholds.minMutationSensitivity.toFixed(3)}.`);
+    if (applicable.length < thresholds.minApplicable)
+        reasons.push(`Shadow window has ${applicable.length} applicable change(s); ${thresholds.minApplicable} required.`);
+    if (falsePositives)
+        reasons.push(`Shadow window has ${falsePositives} confirmed false positive(s).`);
+    if (classificationCounts.unclassified)
+        reasons.push(`Shadow window has ${classificationCounts.unclassified} unclassified violation(s).`);
+    if (classificationCounts.unknown_insufficient_parser)
+        reasons.push(`Shadow window has ${classificationCounts.unknown_insufficient_parser} disposition(s) unresolved for parser support.`);
+    if (classificationCounts.true_positive_accepted_exception)
+        reasons.push(`Shadow window has ${classificationCounts.true_positive_accepted_exception} accepted exception(s) requiring policy composition repair and re-proof.`);
+    if (unknownErrorRate >= thresholds.maxUnknownErrorRate && unknownErrors)
+        reasons.push(`Shadow unknown/error rate ${unknownErrorRate.toFixed(3)} is not below ${thresholds.maxUnknownErrorRate.toFixed(3)}.`);
+    return {
+        policy_id: policy.id,
+        proof_id: proof.id,
+        policy_hash: proof.policy_hash,
+        thresholds,
+        counts: {
+            total: exact.length,
+            applicable: allApplicable.length,
+            satisfied: exact.filter((record) => record.evaluation.result === "satisfied").length,
+            violated: exact.filter((record) => record.evaluation.result === "violated").length,
+            not_applicable: exact.filter((record) => record.evaluation.result === "not_applicable").length,
+            unknown: exact.filter((record) => record.evaluation.result === "unknown").length,
+            error: exact.filter((record) => record.evaluation.result === "error").length,
+            stale_excluded: evaluations.length - exact.length,
+        },
+        window: { recent_limit: thresholds.recentApplicable, applicable: applicable.length, violated: violationCount },
+        dispositions: classificationCounts,
+        precision: {
+            true_positives: truePositives,
+            false_positives: falsePositives,
+            confirmed_denominator: confirmedDenominator,
+            confirmed: confirmedDenominator ? truePositives / confirmedDenominator : null,
+            lower_bound: violationCount ? truePositives / violationCount : null,
+        },
+        unknown_error_rate: unknownErrorRate,
+        mutation_sensitivity: mutationSensitivity,
+        recommendation: reasons.length ? "not_ready" : "eligible_for_p4_review",
+        reasons,
+    };
+}
+//# sourceMappingURL=shadow.js.map

package/dist/constitution/sourceMutation.js

@@ -0,0 +1,316 @@
+import { execFileSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join, posix, relative } from "node:path";
+import { hunchPathsForDir } from "../core/paths.js";
+import { symbolId } from "../core/ids.js";
+import { externalPackage } from "../core/externalImports.js";
+import { pathMatchesGlob } from "../core/glob.js";
+import { resolveRelativeImport } from "../core/relativeImports.js";
+import { indexRepo } from "../extractors/indexer.js";
+import { parseSource } from "../extractors/parse.js";
+import { HunchStore } from "../store/hunchStore.js";
+import { canonicalHash } from "./canonical.js";
+import { evaluatePolicyOnSnapshot, graphSnapshot } from "./evaluator.js";
+function safeEnvironment(home, gitConfig) {
+    const env = {};
+    for (const key of ["PATH", "SystemRoot", "WINDIR", "TMPDIR", "TMP", "TEMP"]) {
+        if (process.env[key])
+            env[key] = process.env[key];
+    }
+    return {
+        ...env,
+        HOME: home,
+        GIT_CONFIG_GLOBAL: gitConfig,
+        GIT_CONFIG_NOSYSTEM: "1",
+        GIT_TERMINAL_PROMPT: "0",
+        GIT_LFS_SKIP_SMUDGE: "1",
+        HUNCH_PRIVATE_DIR: "",
+        HUNCH_SYNTH_PROVIDER: "deterministic",
+    };
+}
+function gitArgs(root, hooks, args) {
+    return [
+        "-C", root,
+        "-c", `core.hooksPath=${hooks}`,
+        "-c", "core.fsmonitor=false",
+        "-c", "credential.helper=",
+        "-c", "filter.lfs.required=false",
+        "-c", "filter.lfs.smudge=",
+        "-c", "filter.lfs.process=",
+        ...args,
+    ];
+}
+function unsafeLocalFilter(root, env) {
+    try {
+        const raw = execFileSync("git", ["-C", root, "config", "--local", "--name-only", "--get-regexp", "^filter\\."], {
+            env,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        return raw.trim().split("\n").some((key) => key && !key.startsWith("filter.lfs."));
+    }
+    catch {
+        return false;
+    }
+}
+function symbolForSelector(snapshot, selector) {
+    const raw = selector.selector;
+    if (raw.startsWith("symbol-id:"))
+        return snapshot.symbols.find((symbol) => symbol.id === raw.slice("symbol-id:".length)) ?? null;
+    if (!raw.startsWith("symbol:"))
+        return null;
+    const target = raw.slice("symbol:".length);
+    const split = target.lastIndexOf(":");
+    const matches = split > 0
+        ? snapshot.symbols.filter((symbol) => symbol.name === target.slice(split + 1) && (symbol.file === target.slice(0, split) || symbol.file.endsWith(`/${target.slice(0, split)}`)))
+        : snapshot.symbols.filter((symbol) => symbol.name === target);
+    return matches.length === 1 ? matches[0] : null;
+}
+function componentForSelector(snapshot, selector) {
+    const raw = selector.selector;
+    if (raw.startsWith("component-id:"))
+        return snapshot.components.find((component) => component.id === raw.slice("component-id:".length)) ?? null;
+    if (!raw.startsWith("component:"))
+        return null;
+    const name = raw.slice("component:".length);
+    const matches = snapshot.components.filter((component) => component.name === name);
+    return matches.length === 1 ? matches[0] : null;
+}
+function componentFiles(snapshot, component) {
+    return [...new Set(snapshot.symbols
+            .map((symbol) => symbol.file)
+            .filter((file) => component.paths.some((glob) => pathMatchesGlob(file, glob))))].sort();
+}
+function relativeSpecifier(fromFile, toFile) {
+    let specifier = relative(dirname(fromFile), toFile).split(/[\\/]/).join(posix.sep);
+    specifier = specifier.replace(/\.(?:tsx?|jsx?)$/, ".js");
+    return specifier.startsWith(".") ? specifier : `./${specifier}`;
+}
+function parsedSymbolFor(graphSymbol, parsed) {
+    const matches = parsed.symbols.filter((symbol) => symbol.name === graphSymbol.name && symbol.kind === graphSymbol.kind);
+    const base = symbolId(graphSymbol.file, graphSymbol.name, graphSymbol.kind);
+    return matches.find((_symbol, index) => (index === 0 ? base : `${base}_${index}`) === graphSymbol.id) ?? null;
+}
+function spliceBytes(source, replacements) {
+    let bytes = Buffer.from(source, "utf8");
+    for (const replacement of [...replacements].sort((a, b) => b.start - a.start)) {
+        bytes = Buffer.concat([
+            bytes.subarray(0, replacement.start),
+            Buffer.from(replacement.text, "utf8"),
+            bytes.subarray(replacement.end),
+        ]);
+    }
+    return bytes.toString("utf8");
+}
+function mutateSource(policy, base, sourceFile, source) {
+    const assertion = policy.assertion;
+    if (assertion.kind === "executable-behavior")
+        return { error: "mutation-executable-behavior-unsupported" };
+    if (assertion.kind !== "exists"
+        && assertion.relation.edges.length === 1
+        && assertion.relation.edges[0] === "depends_on") {
+        const subjectComponent = componentForSelector(base, assertion.subject);
+        const objectComponent = componentForSelector(base, assertion.object);
+        if (!subjectComponent)
+            return { error: "mutation-subject-component-unresolved" };
+        if (!objectComponent)
+            return { error: "mutation-object-component-unresolved" };
+        const targetFile = componentFiles(base, objectComponent)[0];
+        if (!targetFile)
+            return { error: "mutation-object-component-empty" };
+        const parsed = parseSource(sourceFile, source);
+        if (!parsed?.parseable)
+            return { error: "mutation-source-unparseable" };
+        if (assertion.kind === "reaches") {
+            const available = base.symbols.map((symbol) => symbol.file);
+            const targets = new Set(componentFiles(base, objectComponent));
+            const matching = new Set(parsed.imports.filter((specifier) => {
+                const resolved = resolveRelativeImport(sourceFile, specifier, available).path;
+                return !!resolved && targets.has(resolved);
+            }));
+            if (!matching.size)
+                return { error: "mutation-required-component-import-unresolved" };
+            const lines = source.split(/(?<=\n)/);
+            const next = lines.filter((line) => {
+                if (!/^\s*(?:import|export)\b/.test(line))
+                    return true;
+                return ![...matching].some((specifier) => line.includes(JSON.stringify(specifier)) || line.includes(`'${specifier}'`));
+            }).join("");
+            if (next === source)
+                return { error: "mutation-required-component-import-unresolved" };
+            return { file: sourceFile, source: next };
+        }
+        const specifier = relativeSpecifier(sourceFile, targetFile);
+        if (parsed.imports.some((candidate) => candidate === specifier))
+            return { error: "mutation-component-import-already-present" };
+        const insertion = source.startsWith("#!") ? Math.max(0, source.indexOf("\n") + 1) : 0;
+        return {
+            file: sourceFile,
+            source: spliceBytes(source, [{ start: insertion, end: insertion, text: `import ${JSON.stringify(specifier)}; // hunch deterministic component mutation\n` }]),
+        };
+    }
+    const subject = symbolForSelector(base, assertion.subject);
+    if (!subject)
+        return { error: "mutation-subject-unresolved" };
+    const parsed = parseSource(subject.file, source);
+    if (!parsed?.parseable)
+        return { error: "mutation-source-unparseable" };
+    const definition = parsedSymbolFor(subject, parsed);
+    if (!definition)
+        return { error: "mutation-subject-definition-unresolved" };
+    if (assertion.kind === "exists") {
+        return { file: subject.file, source: spliceBytes(source, [{ start: definition.startByte, end: definition.endByte, text: "" }]) };
+    }
+    if (assertion.kind === "not-reaches"
+        && assertion.relation.edges.length === 1
+        && assertion.relation.edges[0] === "imports"
+        && assertion.object.selector.startsWith("external:")) {
+        const dependency = externalPackage(assertion.object.selector.slice("external:".length));
+        if (!dependency)
+            return { error: "mutation-external-import-unsupported" };
+        if (parsed.imports.some((specifier) => externalPackage(specifier) === dependency)) {
+            return { error: "mutation-forbidden-import-already-present" };
+        }
+        const insertion = source.startsWith("#!") ? Math.max(0, source.indexOf("\n") + 1) : 0;
+        return {
+            file: subject.file,
+            source: spliceBytes(source, [{ start: insertion, end: insertion, text: `import ${JSON.stringify(dependency)}; // hunch deterministic source mutation\n` }]),
+        };
+    }
+    const object = symbolForSelector(base, assertion.object);
+    if (!object)
+        return { error: "mutation-object-unresolved" };
+    if (assertion.kind === "reaches") {
+        const allowed = new Set(assertion.relation.edges);
+        const targetNames = new Set(base.edges
+            .filter((edge) => edge.from === subject.id && allowed.has(edge.type))
+            .map((edge) => base.symbols.find((symbol) => symbol.id === edge.to)?.name)
+            .filter((name) => !!name));
+        const replacements = parsed.calls
+            .filter((call) => call.atByte >= definition.startByte && call.atByte < definition.endByte && targetNames.has(call.callee))
+            .map((call) => ({ start: call.atByte, end: call.endByte, text: "hunchMutationRemovedCall" }));
+        if (!replacements.length)
+            return { error: "mutation-required-call-unresolved" };
+        return { file: subject.file, source: spliceBytes(source, replacements) };
+    }
+    if (!assertion.relation.edges.includes("calls"))
+        return { error: "mutation-call-edge-not-supported" };
+    const bytes = Buffer.from(source, "utf8");
+    const open = bytes.indexOf("{".charCodeAt(0), definition.startByte);
+    if (open < 0 || open >= definition.endByte)
+        return { error: "mutation-subject-body-unsupported" };
+    const replacements = [{ start: open + 1, end: open + 1, text: `\n  ${object.name}(); // hunch deterministic source mutation\n` }];
+    if (object.file !== subject.file) {
+        const specifier = relativeSpecifier(subject.file, object.file);
+        if (!parsed.imports.includes(specifier)) {
+            const insertion = source.startsWith("#!") ? Math.max(0, source.indexOf("\n") + 1) : 0;
+            replacements.push({
+                start: insertion,
+                end: insertion,
+                text: `import { ${object.name} } from ${JSON.stringify(specifier)}; // hunch deterministic source mutation\n`,
+            });
+        }
+    }
+    return {
+        file: subject.file,
+        source: spliceBytes(source, replacements),
+    };
+}
+function removeWorktree(root, hooks, env, checkout) {
+    try {
+        execFileSync("git", gitArgs(root, hooks, ["worktree", "remove", "--force", checkout]), { env, timeout: 10_000, stdio: "ignore" });
+        return true;
+    }
+    catch {
+        rmSync(checkout, { recursive: true, force: true });
+        try {
+            execFileSync("git", gitArgs(root, hooks, ["worktree", "remove", "--force", checkout]), { env, timeout: 10_000, stdio: "ignore" });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+/** Apply one primary mutation to an immutable disposable source checkout. No
+ * project script, build, test, provider, model, or repository hook executes. */
+export function runSourceMutation(root, policy, base) {
+    if (policy.assertion.kind === "executable-behavior")
+        return { error_code: "mutation-executable-behavior-unsupported" };
+    if (!/^[a-f0-9]{40}$/.test(base.head))
+        return { error_code: "mutation-base-not-immutable" };
+    const cacheBase = join(root, ".hunch-cache", "mutations");
+    mkdirSync(cacheBase, { recursive: true });
+    const session = mkdtempSync(join(cacheBase, "mutation-"));
+    const hooks = join(session, "hooks-disabled");
+    const gitConfig = join(session, "global.gitconfig");
+    const checkout = join(session, "checkout");
+    const graph = join(session, "graph");
+    mkdirSync(hooks, { recursive: true });
+    writeFileSync(gitConfig, "");
+    const env = safeEnvironment(session, gitConfig);
+    let added = false;
+    let store;
+    let outcome = { error_code: "source-mutation-failed" };
+    try {
+        if (unsafeLocalFilter(root, env))
+            throw new Error("unsafe-local-filter-config");
+        execFileSync("git", gitArgs(root, hooks, ["worktree", "add", "--detach", "--force", checkout, base.head]), {
+            env,
+            timeout: 30_000,
+            stdio: "ignore",
+        });
+        added = true;
+        const subject = symbolForSelector(base, policy.assertion.subject);
+        const subjectComponent = componentForSelector(base, policy.assertion.subject);
+        const sourceFile = subject?.file ?? (subjectComponent ? componentFiles(base, subjectComponent)[0] : undefined);
+        if (!sourceFile)
+            throw new Error("mutation-subject-unresolved");
+        const file = join(checkout, sourceFile);
+        const mutation = mutateSource(policy, base, sourceFile, readFileSync(file, "utf8"));
+        if ("error" in mutation)
+            throw new Error(mutation.error);
+        const parsed = parseSource(mutation.file, mutation.source);
+        if (!parsed?.parseable)
+            throw new Error("mutation-source-unparseable");
+        writeFileSync(file, mutation.source);
+        const diff = execFileSync("git", gitArgs(checkout, hooks, ["diff", "--no-ext-diff", "--", mutation.file]), {
+            env,
+            encoding: "utf8",
+            timeout: 10_000,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        if (!diff.trim())
+            throw new Error("mutation-source-diff-empty");
+        if (Buffer.byteLength(diff, "utf8") > 65_536)
+            throw new Error("mutation-source-diff-too-large");
+        store = new HunchStore(hunchPathsForDir(graph));
+        store.json.ensureDirs();
+        indexRepo(store, checkout, { churn: false });
+        const snapshot = graphSnapshot(store, root, { publicOnly: true, head: base.head });
+        outcome = {
+            snapshot,
+            evaluation: evaluatePolicyOnSnapshot(policy, snapshot),
+            source_patch: { files: [mutation.file], diff, diff_hash: canonicalHash(diff) },
+        };
+    }
+    catch (error) {
+        const message = error.message;
+        outcome = {
+            error_code: /^[a-z0-9-]+$/.test(message)
+                ? message
+                : added ? "source-mutation-index-failed" : "source-mutation-worktree-failed",
+        };
+    }
+    finally {
+        try {
+            store?.close();
+        }
+        catch { /* cleanup continues */ }
+        if (added && !removeWorktree(root, hooks, env, checkout))
+            outcome = { error_code: "worktree-cleanup-failed" };
+        rmSync(session, { recursive: true, force: true });
+    }
+    return outcome;
+}
+//# sourceMappingURL=sourceMutation.js.map