@deeeed/metamask-harness 0.13.0 → 0.14.1

package/dist/adapters/extension/surface.js

@@ -43,6 +43,7 @@ const extensionSurface = {
     }
   },
   devServer: {
+    label: "webpack",
     describe: () => "webpack watcher",
     stop(target) {
       const signalled = stopExtensionWatcher(target);

package/dist/adapters/mobile/provision.js

@@ -457,11 +457,13 @@ function preapproveDeepLinkScheme(device, bundleId, options) {
 function ensureSimulator(name, runtime, deviceType) {
   const existing = findSimulator(name);
   if (existing) return { name, udid: existing, created: false, runtime, deviceType };
-  if (!runtime || !deviceType) {
-    throw new Error(`simulator ${name} is missing and runtime/device type could not be resolved. Pass --runtime and --device-type, or write them to agentic-runtime.json.`);
+  const resolvedRuntime = runtime || latestIosRuntime();
+  const resolvedDeviceType = deviceType || preferredIphoneDeviceType();
+  if (!resolvedRuntime || !resolvedDeviceType) {
+    throw new Error(`simulator ${name} is missing and no available iOS simulator runtime/device type could be resolved from xcrun simctl.`);
   }
-  const udid = execFileSync("xcrun", ["simctl", "create", name, deviceType, runtime], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
-  return { name, udid: udid || name, created: true, runtime, deviceType };
+  const udid = execFileSync("xcrun", ["simctl", "create", name, resolvedDeviceType, resolvedRuntime], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  return { name, udid: udid || name, created: true, runtime: resolvedRuntime, deviceType: resolvedDeviceType };
 }
 function findSimulator(name) {
   const data = execJson("xcrun", ["simctl", "list", "devices", "--json"]);
@@ -471,6 +473,49 @@ function findSimulator(name) {
   }
   return void 0;
 }
+function latestIosRuntime() {
+  const data = execJson(
+    "xcrun",
+    ["simctl", "list", "runtimes", "--json"]
+  );
+  const runtimes = (data.runtimes ?? []).filter((runtime) => runtime.isAvailable !== false && runtime.identifier && (runtime.platform === "iOS" || /(^|[.-])iOS([.-]|$)/u.test(runtime.identifier) || /^iOS\b/u.test(runtime.name ?? ""))).sort((a, b) => compareVersions(runtimeVersion(b), runtimeVersion(a)));
+  return runtimes[0]?.identifier;
+}
+function preferredIphoneDeviceType() {
+  const data = execJson("xcrun", ["simctl", "list", "devicetypes", "--json"]);
+  const devices = (data.devicetypes ?? []).filter((device) => device.identifier && /^iPhone\b/u.test(device.name ?? "")).sort((a, b) => {
+    const generation = iphoneGeneration(b) - iphoneGeneration(a);
+    if (generation !== 0) return generation;
+    const proScore = iphoneProScore(b) - iphoneProScore(a);
+    if (proScore !== 0) return proScore;
+    return String(b.name ?? "").localeCompare(String(a.name ?? ""));
+  });
+  return devices[0]?.identifier;
+}
+function runtimeVersion(runtime) {
+  const raw = runtime.version || /iOS[-. ]([0-9][0-9A-Za-z_.-]*)/u.exec(runtime.identifier ?? "")?.[1] || runtime.name || "";
+  const parts = raw.match(/\d+/gu)?.map((part) => Number(part)) ?? [];
+  return parts.length ? parts : [0];
+}
+function compareVersions(a, b) {
+  const length = Math.max(a.length, b.length);
+  for (let i = 0; i < length; i += 1) {
+    const diff = (a[i] ?? 0) - (b[i] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+function iphoneGeneration(device) {
+  const match = /^iPhone\s+(\d+)/u.exec(device.name ?? "");
+  return match ? Number(match[1]) : 0;
+}
+function iphoneProScore(device) {
+  const name = device.name ?? "";
+  if (/\bPro Max\b/u.test(name)) return 3;
+  if (/\bPro\b/u.test(name)) return 2;
+  if (/\bPlus\b/u.test(name)) return 1;
+  return 0;
+}
 function baselineSimulatorCandidates(data, current) {
   const candidates = [];
   if (current.simulator) candidates.push(current.simulator);

package/dist/adapters/mobile/surface.js

@@ -29,6 +29,7 @@ const mobileSurface = {
     }
   },
   devServer: {
+    label: "metro",
     describe: () => "Metro dev server",
     stop(target) {
       const leaf = path.join(runnerDir, "adapters", "mobile", "stop-metro.sh");

package/dist/adapters/slot-ports.js

@@ -10,10 +10,8 @@ import {
   resolveMobileSlotDefaults
 } from "./resolve-slot-ports.js";
 function applyKVLines(output, overwrite) {
-  for (const line of output.split("\n")) {
-    const m = /^([A-Z_]+)=(.+)$/u.exec(line.trim());
-    if (!m) continue;
-    const [, key, val] = m;
+  const entries = output.split("\n").map((line) => /^([A-Z_]+)=(.+)$/u.exec(line.trim())).filter((match) => match !== null).map((match) => ({ key: match[1], val: match[2] }));
+  for (const { key, val } of entries) {
     if (val === "null" || val === "undefined" || val === "") continue;
     switch (key) {
       case "WATCHER_PORT":
@@ -26,6 +24,15 @@ function applyKVLines(output, overwrite) {
       case "IOS_SIMULATOR":
         if (overwrite || !process.env["IOS_SIMULATOR"]) process.env["IOS_SIMULATOR"] = val;
         break;
+      case "ADB_SERIAL":
+        if (overwrite || !process.env["ADB_SERIAL"]) {
+          process.env["ADB_SERIAL"] = val;
+          process.env["ANDROID_SERIAL"] = val;
+        }
+        break;
+      case "ANDROID_DEVICE":
+        if (overwrite || !process.env["ANDROID_DEVICE"]) process.env["ANDROID_DEVICE"] = val;
+        break;
       case "SLOT_ID":
         if (overwrite || !process.env["RECIPE_SLOT_ID"]) process.env["RECIPE_SLOT_ID"] = val;
         break;

package/dist/cli-commands.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { listRecipeFiles } from "./recipe-files.js";
 const SPEC = {
   shim: [
     { name: "sync", desc: "Copy fixture, write slot context, install harness", flags: ["--dry-run", "--no-install"] },
@@ -16,7 +17,7 @@ const SPEC = {
     { name: "fixtures", desc: "Manage the canonical wallet fixture (sync/set/generate)", args: ["sync", "set", "generate"], flags: ["--fixture", "--out", "--adapter", "--target", "--device", "--json"] },
     { name: "actions", desc: "List runnable recipe actions", flags: ["--json"] },
     { name: "doctor", desc: "Check harness/orchestration health", flags: ["--json", "--target", "--adapter", "--runtime-dir", "--expect-live", "--cdp-port", "--device"] },
-    { name: "run", desc: "Execute a proof recipe (path or library name, e.g. run smoke)", args: ["recipe.json|name"], flags: ["--list", "--device"] },
+    { name: "run", desc: "Execute a proof recipe (path or library name, e.g. run perps.smoke)", args: ["recipe.json|name"], flags: ["--list", "--device"] },
     { name: "recipe-quality", desc: "Build the recipe-quality artifact from compact JSON", args: ["build"], flags: ["--input", "--output", "--json"] },
     { name: "interactive", aliases: ["menu"], desc: "Interactive command menu" },
     { name: "prepare", desc: "Install harness (+ optional validate)", flags: ["--target", "--runtime-dir", "--json"] },
@@ -124,9 +125,9 @@ function listRunRecipes(adapter, root, cwd = process.cwd()) {
   for (const resolveDir of RUN_RECIPE_DIRS) {
     const dir = resolveDir(adapter, root);
     if (!fs.existsSync(dir)) continue;
-    for (const name of fs.readdirSync(dir)) {
-      if (!name.endsWith(".recipe.json") || byBase.has(name)) continue;
-      byBase.set(name, path.join(dir, name));
+    for (const rel of listRecipeFiles(dir)) {
+      if (byBase.has(rel)) continue;
+      byBase.set(rel, path.join(dir, rel));
     }
   }
   return [...byBase.values()].map((abs) => path.relative(cwd, abs)).sort();

package/dist/cli.js

@@ -19,6 +19,7 @@ import { handleDebug } from "./commands/debug.js";
 import { handleFixtures } from "./commands/fixtures.js";
 import { handleRecipeQuality } from "./commands/recipe-quality.js";
 import { handleStatus } from "./commands/status.js";
+import { handleCheck } from "./commands/check.js";
 import { parseArgs, targetPath } from "./commands/parse-args.js";
 import { runOneNode } from "./commands/run-engine.js";
 const COMMANDS = {
@@ -56,6 +57,8 @@ PROVE \u2014 run recipes and inspect capabilities:
                mm-harness flows list
   doctor     Readiness check for a checkout (no app launch).
                mm-harness doctor
+  check      Run bounded repo-local checks for an active diff.
+               mm-harness check diff --profile fast --artifacts-dir artifacts/validation
   actions    Describe the actions a manifest declares.
                mm-harness actions --adapter mobile
   manifest   Print/validate the action manifest for an adapter.
@@ -127,6 +130,7 @@ async function main(argv) {
   if (command === "debug") return handleDebug(argv.slice(1));
   if (command === "fixtures") return handleFixtures(argv.slice(1), { runOneNode });
   if (command === "recipe-quality") return handleRecipeQuality(argv.slice(1));
+  if (command === "check") return handleCheck(argv.slice(1));
   const handler = COMMANDS[command];
   if (!handler) throw new Error(`Unknown command: ${command}`);
   return handler(parseArgs(argv.slice(1), command));

package/dist/commands/call.js

@@ -5,6 +5,7 @@ import path from "node:path";
 import { loadActionManifest } from "../manifest.js";
 import { importRecipeProtocol } from "../paths.js";
 import { recipeRunning } from "../heal-bounds.js";
+import { color } from "../cli-color.js";
 import { EXIT } from "./shared.js";
 import { describeManifestActions, fuzzyResolveActions } from "./manifest.js";
 import {
@@ -16,8 +17,10 @@ import {
   runtimeOptionsFromCli,
   usageError
 } from "./parse-args.js";
+import { getAdapterSurface } from "../adapters/surface.js";
 import { handleListExecutables } from "./list-executables.js";
 import { applyDeviceTargeting } from "./device-target.js";
+import { coreDependencyBlock } from "./core-readiness.js";
 import {
   emitHealViolation,
   executeWithHealBounds,
@@ -33,7 +36,7 @@ async function handleCall(argv) {
     return handleListExecutables("call", options2);
   }
   if (argv.length > 0 && argv[0].startsWith("--")) {
-    const message = "call requires <action> first: mm-harness call <action> [--arg k=v ...] [flags]";
+    const message = "call requires <action> first: mm-harness call <action> [key=value ...] [--arg k=v ...] [flags]";
     console.error(message);
     return EXIT.usage;
   }
@@ -60,6 +63,7 @@ async function handleCall(argv) {
     return EXIT.usage;
   }
   const { adapter, target } = resolveAdapter(options);
+  getAdapterSurface(adapter).resolveSlotPorts(target);
   const dtResult = applyDeviceTargeting("call", adapter, options, { gate: true, rerun: "" });
   if ("code" in dtResult) {
     if (json) console.log(JSON.stringify({ schemaVersion: 1, command: "call", adapter, error: { code: dtResult.code, message: dtResult.message } }, null, 2));
@@ -94,6 +98,16 @@ async function handleCall(argv) {
     return EXIT.usage;
   }
   const resolvedAction = resolution.resolved;
+  const depsBlock = adapter === "core" && resolvedAction.startsWith("metamask.perps.") ? coreDependencyBlock(target) : null;
+  if (depsBlock) {
+    if (json) {
+      console.log(JSON.stringify({ schemaVersion: 1, command: "call", adapter, status: "fail", exitCode: EXIT.usage, error: depsBlock }, null, 2));
+    } else {
+      console.error(`\u2717 call: ${depsBlock.message}`);
+      console.error(`  Next: ${depsBlock.userAction}`);
+    }
+    return EXIT.usage;
+  }
   const recipe = synthesizeOneNodeRecipe(resolvedAction, args);
   const validation = await validateRecipeAdapterAware(recipe, manifest);
   if (validation.status === "invalid") {
@@ -127,6 +141,7 @@ async function handleCall(argv) {
     state
   );
   if (violation !== null) return emitHealViolation(json, "call", result, violation, state, adapter);
+  const callOutput = readCallOutput(result.tracePath);
   if (json) {
     console.log(
       JSON.stringify(
@@ -141,6 +156,7 @@ async function handleCall(argv) {
           summaryPath: result.summaryPath,
           tracePath: result.tracePath,
           artifactManifestPath: result.artifactManifestPath,
+          ...callOutput !== void 0 ? { output: callOutput } : {},
           recovered: state.recovered,
           mutations: state.mutations,
           exitCode: result.status === "pass" ? EXIT.ok : EXIT.runtime
@@ -150,11 +166,34 @@ async function handleCall(argv) {
       )
     );
   } else {
-    console.log(`call ${resolvedAction}: ${result.status}
-Artifacts: ${result.artifactManifestPath}`);
+    const rendered = callOutput !== void 0 ? `
+Result:
+${formatCallOutput(callOutput)}` : "";
+    const out = (style, text) => color(style, text, { stream: process.stdout });
+    console.log(
+      `${out("label", "call")} ${out("cmd", resolvedAction)}: ${out(result.status === "pass" ? "ok" : "err", result.status)}${rendered ? `
+${out("label", "Result:")}
+${formatCallOutput(callOutput)}` : ""}
+${out("label", "Artifacts:")} ${out("path", result.artifactManifestPath)}`
+    );
   }
   return result.status === "pass" ? EXIT.ok : EXIT.runtime;
 }
+function readCallOutput(tracePath) {
+  try {
+    const trace = JSON.parse(fs.readFileSync(tracePath, "utf8"));
+    const entries = Array.isArray(trace) ? trace : isRecord(trace) && Array.isArray(trace.entries) ? trace.entries : [];
+    const entry = entries.find((item) => isRecord(item) && item.nodeId === "call");
+    return isRecord(entry) && Object.prototype.hasOwnProperty.call(entry, "output") ? entry.output : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function formatCallOutput(value) {
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean" || value === null) return String(value);
+  return JSON.stringify(value, null, 2);
+}
 async function handleCallHelp(argv, genericHelp) {
   const { action: shortName, rest } = parseCallArgs(argv.filter((arg) => arg !== "--help" && arg !== "-h"));
   const { options } = parseArgs(rest, "call");
@@ -194,13 +233,13 @@ function renderCallActionHelp(entry) {
   const required = new Set(
     Array.isArray(schema.required) ? schema.required.filter((r) => typeof r === "string") : []
   );
-  const lines = [`mm-harness call ${entry.name} [--arg k=v ...] [flags]`, ""];
+  const lines = [`mm-harness call ${entry.name} [key=value ...] [--arg k=v ...] [flags]`, ""];
   if (entry.description) lines.push(`  ${entry.description}`, "");
   const names = Object.keys(properties).sort();
   if (names.length === 0) {
     lines.push("  Fields: (none)");
   } else {
-    lines.push("  Fields (pass with --arg <name>=<value>):");
+    lines.push("  Fields (pass as <name>=<value> or --arg <name>=<value>):");
     const width = Math.max(...names.map((name) => name.length));
     for (const name of names) {
       const prop = isRecord(properties[name]) ? properties[name] : {};
@@ -226,7 +265,7 @@ function renderCallExamples(short, examples) {
   for (const example of examples.slice(0, 2)) {
     const node = isRecord(example) && isRecord(example.node) ? example.node : void 0;
     if (!node) continue;
-    const tokens = Object.entries(node).filter(([key]) => key !== "action" && key !== "intent").map(([key, value]) => `--arg ${key}=${typeof value === "string" ? value : JSON.stringify(value)}`);
+    const tokens = Object.entries(node).filter(([key]) => key !== "action" && key !== "intent").map(([key, value]) => `${key}=${typeof value === "string" ? value : JSON.stringify(value)}`);
     out.push(`mm-harness call ${short} ${tokens.join(" ")}`.trim());
   }
   return out;
@@ -249,10 +288,44 @@ function parseCallArgs(argv) {
       action = arg;
       continue;
     }
+    if (action !== void 0 && !isForwardedOptionValue(argv, i) && isArgPair(arg)) {
+      const eq = arg.indexOf("=");
+      args[arg.slice(0, eq)] = arg.slice(eq + 1);
+      continue;
+    }
     rest.push(arg);
   }
   return { action, args, rest };
 }
+function isArgPair(value) {
+  const eq = value.indexOf("=");
+  return eq > 0;
+}
+function isForwardedOptionValue(argv, index) {
+  if (index === 0) return false;
+  const previous = argv[index - 1];
+  if (!previous.startsWith("--") || previous.includes("=")) return false;
+  return VALUE_TAKING_CALL_FLAGS.has(normalizeFlagName(previous));
+}
+const VALUE_TAKING_CALL_FLAGS = /* @__PURE__ */ new Set([
+  "action-manifest",
+  "adapter",
+  "artifacts-dir",
+  "cdp-port",
+  "device",
+  "heal",
+  "library",
+  "metro-port",
+  "platform",
+  "project-root",
+  "slot",
+  "target",
+  "validation-runtime-dir",
+  "watcher-port"
+]);
+function normalizeFlagName(flag) {
+  return flag.replace(/^--/u, "");
+}
 function resolveActionName(shortName, names) {
   if (names.includes(shortName)) return { status: "ok", resolved: shortName, candidates: [shortName] };
   const finalSegment = (name) => name.split(".").pop() ?? name;

package/dist/commands/check.js

@@ -0,0 +1,326 @@
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { detectAdapter } from "../harness.js";
+import { EXIT, usageOut } from "./shared.js";
+import { optionFlag, optionString, parseArgs } from "./parse-args.js";
+const USAGE = "mm-harness check diff [--target <repo>] [--adapter mobile|extension|core] [--base <ref>] [--profile fast|full] [--artifacts-dir <dir>] [--json]";
+const JS_TS_EXT_RE = /\.(?:c|m)?jsx?$|\.tsx?$/u;
+const FORMAT_EXT_RE = /\.(?:c|m)?jsx?$|\.tsx?$|\.json$|\.md$|\.css$|\.scss$|\.ya?ml$/u;
+const TEST_FILE_RE = /(?:^|[./_-])(?:test|spec)\.(?:c|m)?jsx?$|(?:^|[./_-])(?:test|spec)\.tsx?$/u;
+async function handleCheck(argv) {
+  const { positional, options } = parseArgs(argv, "check");
+  const action = positional[0];
+  const json = optionFlag(options, "json");
+  if (action !== "diff") {
+    const message = action ? `unknown action '${action}'` : "missing action";
+    return usageOut(json, "check", message, USAGE);
+  }
+  const target = path.resolve(optionString(options, "target") ?? optionString(options, "projectRoot") ?? process.cwd());
+  const explicitAdapter = optionString(options, "adapter") ?? optionString(options, "platform");
+  const detected = explicitAdapter ?? detectAdapter(target);
+  if (detected && !["mobile", "extension", "core"].includes(detected)) {
+    return usageOut(json, "check", `unsupported adapter '${detected}'`, USAGE);
+  }
+  const adapter = detected;
+  const profileInput = optionString(options, "profile");
+  if (profileInput && profileInput !== "fast" && profileInput !== "full") {
+    return usageOut(json, "check", "--profile must be fast or full", USAGE);
+  }
+  const profile = profileInput || "fast";
+  const explicitBaseRef = optionString(options, "base");
+  const base = explicitBaseRef ? { ref: explicitBaseRef, source: "flag" } : defaultBaseRef(target);
+  const baseRef = base.ref;
+  const artifactsDir = path.resolve(
+    optionString(options, "artifactsDir") ?? path.join(target, "temp", "recipe", "check-diff", timestampSlug())
+  );
+  fs.mkdirSync(artifactsDir, { recursive: true });
+  if (!isGitRepo(target)) {
+    return failEnvelope({
+      json,
+      adapter,
+      target,
+      profile,
+      baseRef,
+      artifactsDir,
+      message: `${target} is not a git checkout`,
+      code: "CHECK_DIFF_NOT_GIT"
+    });
+  }
+  const packageJson = readPackageJson(target);
+  const mergeBase = resolveMergeBase(target, baseRef);
+  const changedFiles = listChangedFiles(target, mergeBase, artifactsDir);
+  const existingChangedFiles = changedFiles.filter((file) => fs.existsSync(path.join(target, file)));
+  const checks = [];
+  checks.push(
+    runToolCheck({
+      id: "eslint",
+      label: "Changed-file ESLint",
+      target,
+      artifactsDir,
+      files: existingChangedFiles.filter((file) => JS_TS_EXT_RE.test(file)),
+      command: executable(target, "eslint"),
+      args: ["--cache", "--cache-location", path.join(artifactsDir, "eslintcache"), "--max-warnings=0", "--no-warn-ignored"]
+    })
+  );
+  checks.push(
+    runToolCheck({
+      id: "prettier",
+      label: "Changed-file Prettier",
+      target,
+      artifactsDir,
+      files: existingChangedFiles.filter((file) => FORMAT_EXT_RE.test(file)),
+      command: executable(target, "prettier"),
+      args: ["--check"]
+    })
+  );
+  checks.push(
+    runToolCheck({
+      id: "jest",
+      label: "Changed test files",
+      target,
+      artifactsDir,
+      files: existingChangedFiles.filter((file) => TEST_FILE_RE.test(file)),
+      command: executable(target, "jest"),
+      args: ["--no-coverage"]
+    })
+  );
+  if (profile === "full") {
+    checks.push(runTypecheck({ target, artifactsDir, packageJson }));
+  } else {
+    checks.push({
+      id: "typecheck",
+      label: "TypeScript project check",
+      status: "skip",
+      reason: "profile=fast; run with --profile full for repo-wide typecheck"
+    });
+  }
+  const status = checks.some((check) => check.status === "fail") ? "fail" : "pass";
+  const exitCode = status === "pass" ? EXIT.ok : EXIT.validation;
+  const summary = {
+    schemaVersion: 1,
+    command: "check",
+    action: "diff",
+    status,
+    exitCode,
+    adapter: adapter ?? null,
+    target,
+    profile,
+    baseRef,
+    baseSource: base.source,
+    baseLabel: base.label ?? null,
+    mergeBase,
+    changedFiles,
+    checks,
+    artifacts: {
+      dir: artifactsDir,
+      summaryJson: path.join(artifactsDir, "validation-summary.json"),
+      summaryMarkdown: path.join(artifactsDir, "validation-summary.md")
+    }
+  };
+  writeSummaryArtifacts(summary);
+  if (json) console.log(JSON.stringify(summary, null, 2));
+  else renderHuman(summary);
+  return exitCode;
+}
+function timestampSlug() {
+  return (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/gu, "").replace(/\.\d{3}Z$/u, "Z");
+}
+function isGitRepo(target) {
+  return runCommand("git", ["rev-parse", "--is-inside-work-tree"], target).status === 0;
+}
+function defaultBaseRef(target) {
+  const prBase = githubPullRequestBase(target);
+  if (prBase) return prBase;
+  const remoteHead = runCommand("git", ["symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"], target).stdout.trim();
+  if (remoteHead && verifyRef(target, remoteHead)) return { ref: remoteHead, source: "remote-head" };
+  for (const ref of ["origin/develop", "origin/main", "develop", "main", "HEAD"]) {
+    if (verifyRef(target, ref)) return { ref, source: "fallback" };
+  }
+  return { ref: "", source: "fallback" };
+}
+function githubPullRequestBase(target) {
+  const result = runCommand("gh", ["pr", "view", "--json", "baseRefName", "--jq", ".baseRefName"], target);
+  if (result.status !== 0) return null;
+  const baseName = result.stdout.trim();
+  if (!baseName) return null;
+  for (const ref of [`origin/${baseName}`, `upstream/${baseName}`, baseName]) {
+    if (verifyRef(target, ref)) return { ref, source: "github-pr", label: baseName };
+  }
+  return null;
+}
+function verifyRef(target, ref) {
+  return runCommand("git", ["rev-parse", "--verify", ref], target).status === 0;
+}
+function resolveMergeBase(target, baseRef) {
+  if (!baseRef) return null;
+  const result = runCommand("git", ["merge-base", "HEAD", baseRef], target);
+  if (result.status === 0) return result.stdout.trim() || null;
+  const verify = runCommand("git", ["rev-parse", "--verify", baseRef], target);
+  return verify.status === 0 ? verify.stdout.trim() || null : null;
+}
+function listChangedFiles(target, mergeBase, artifactsDir) {
+  const files = /* @__PURE__ */ new Set();
+  const addLines = (output) => {
+    for (const line of output.split("\n")) {
+      const file = line.trim();
+      if (file) files.add(file);
+    }
+  };
+  if (mergeBase) {
+    addLines(runCommand("git", ["diff", "--name-only", "--diff-filter=ACMR", `${mergeBase}...HEAD`], target).stdout);
+  }
+  addLines(runCommand("git", ["diff", "--name-only", "--diff-filter=ACMR", "HEAD"], target).stdout);
+  addLines(runCommand("git", ["diff", "--cached", "--name-only", "--diff-filter=ACMR"], target).stdout);
+  addLines(runCommand("git", ["ls-files", "--others", "--exclude-standard"], target).stdout);
+  return [...files].filter((file) => !isUnderArtifactsDir(target, artifactsDir, file)).sort();
+}
+function isUnderArtifactsDir(target, artifactsDir, file) {
+  const artifactRel = normalizeRelativePath(path.relative(path.resolve(target), path.resolve(artifactsDir)));
+  if (!artifactRel || artifactRel.startsWith("../") || artifactRel === "..") return false;
+  const normalized = normalizeRelativePath(file);
+  return normalized === artifactRel || normalized.startsWith(`${artifactRel}/`);
+}
+function normalizeRelativePath(value) {
+  return value.split(path.sep).join("/");
+}
+function executable(target, name) {
+  const local = path.join(target, "node_modules", ".bin", name);
+  return fs.existsSync(local) ? local : null;
+}
+function runToolCheck(input) {
+  if (input.files.length === 0) {
+    return { id: input.id, label: input.label, status: "skip", reason: "no changed matching files" };
+  }
+  if (!input.command) {
+    return { id: input.id, label: input.label, status: "skip", reason: `${input.id} binary not found in node_modules/.bin` };
+  }
+  return runCheckCommand(input.id, input.label, input.target, input.artifactsDir, input.command, [...input.args, ...input.files]);
+}
+function runTypecheck(input) {
+  const scripts = input.packageJson?.scripts && typeof input.packageJson.scripts === "object" ? input.packageJson.scripts : {};
+  if (typeof scripts["lint:tsc"] === "string") {
+    return runCheckCommand("typecheck", "TypeScript project check", input.target, input.artifactsDir, "yarn", ["lint:tsc"]);
+  }
+  const tsc = executable(input.target, "tsc");
+  if (tsc) {
+    return runCheckCommand("typecheck", "TypeScript project check", input.target, input.artifactsDir, tsc, ["--noEmit"]);
+  }
+  return { id: "typecheck", label: "TypeScript project check", status: "skip", reason: "no lint:tsc script or tsc binary found" };
+}
+function runCheckCommand(id, label, target, artifactsDir, command, args) {
+  const result = runCommand(command, args, target);
+  const logPath = path.join(artifactsDir, `${id}.log`);
+  fs.writeFileSync(logPath, renderCommandLog(command, args, result));
+  return {
+    id,
+    label,
+    status: result.status === 0 ? "pass" : "fail",
+    command: [command, ...args].join(" "),
+    exitCode: result.status,
+    logPath,
+    durationMs: result.durationMs
+  };
+}
+function runCommand(command, args, cwd) {
+  const started = Date.now();
+  const result = spawnSync(command, args, {
+    cwd,
+    encoding: "utf8",
+    env: process.env,
+    maxBuffer: 64 * 1024 * 1024
+  });
+  const status = result.error ? 127 : result.status ?? 1;
+  return {
+    status,
+    stdout: result.stdout ?? "",
+    stderr: result.error ? String(result.error) : result.stderr ?? "",
+    durationMs: Date.now() - started
+  };
+}
+function renderCommandLog(command, args, result) {
+  return [
+    `$ ${[command, ...args].join(" ")}`,
+    `exit: ${result.status}`,
+    `duration_ms: ${result.durationMs}`,
+    "",
+    "--- stdout ---",
+    result.stdout.trimEnd(),
+    "",
+    "--- stderr ---",
+    result.stderr.trimEnd(),
+    ""
+  ].join("\n");
+}
+function readPackageJson(target) {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(target, "package.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeSummaryArtifacts(summary) {
+  fs.writeFileSync(summary.artifacts.summaryJson, `${JSON.stringify(summary, null, 2)}
+`);
+  fs.writeFileSync(summary.artifacts.summaryMarkdown, renderMarkdown(summary));
+}
+function renderMarkdown(summary) {
+  const lines = [
+    "# mm-harness check diff",
+    "",
+    `Verdict: ${summary.status}`,
+    `Profile: ${summary.profile}`,
+    `Base: ${summary.baseRef || "(none)"} (${summary.baseSource || "unknown"}${summary.baseLabel ? `: ${summary.baseLabel}` : ""})`,
+    `Changed files: ${summary.changedFiles.length}`,
+    "",
+    "## Checks",
+    ""
+  ];
+  for (const check of summary.checks) {
+    lines.push(`- ${check.status.toUpperCase()} ${check.id}${check.reason ? ` \u2014 ${check.reason}` : ""}${check.logPath ? ` (${check.logPath})` : ""}`);
+  }
+  lines.push("", "## Changed Files", "");
+  for (const file of summary.changedFiles) lines.push(`- ${file}`);
+  return `${lines.join("\n")}
+`;
+}
+function renderHuman(summary) {
+  const mark = summary.status === "pass" ? "\u2713" : "\u2717";
+  const baseText = `${summary.baseRef || "(none)"}${summary.baseSource ? ` [${summary.baseSource}]` : ""}`;
+  console.log(`${mark} check diff: ${summary.status} \xB7 ${summary.changedFiles.length} changed file(s) \xB7 profile=${summary.profile} \xB7 base=${baseText}`);
+  if (summary.changedFiles.length > 0) {
+    console.log("Changed files:");
+    for (const file of summary.changedFiles.slice(0, 100)) console.log(`  - ${file}`);
+    if (summary.changedFiles.length > 100) console.log(`  ... ${summary.changedFiles.length - 100} more; full list in validation-summary.json`);
+  }
+  for (const check of summary.checks) {
+    const prefix = check.status === "pass" ? "\u2713" : check.status === "fail" ? "\u2717" : "-";
+    console.log(`  ${prefix} ${check.id}: ${check.status}${check.reason ? ` (${check.reason})` : ""}`);
+    if (check.status === "fail" && check.logPath) console.log(`    log: ${check.logPath}`);
+  }
+  console.log(`Artifacts: ${summary.artifacts.summaryJson}`);
+}
+function failEnvelope(input) {
+  const exitCode = EXIT.usage;
+  const body = {
+    schemaVersion: 1,
+    command: "check",
+    action: "diff",
+    status: "fail",
+    exitCode,
+    adapter: input.adapter ?? null,
+    target: input.target,
+    profile: input.profile,
+    baseRef: input.baseRef,
+    baseSource: "unknown",
+    artifacts: { dir: input.artifactsDir },
+    error: { code: input.code, message: input.message }
+  };
+  if (input.json) console.log(JSON.stringify(body, null, 2));
+  else console.error(`\u2717 check diff: ${input.message}
+  Next: ${USAGE}`);
+  return exitCode;
+}
+export {
+  handleCheck
+};