@deftai/directive-core 0.105.0 → 0.106.0

package/dist/lifecycle-visible/evaluate.js

@@ -0,0 +1,710 @@
+/**
+ * verify:lifecycle-visible — detect ignore/index flags that hide lifecycle roots (#3505).
+ *
+ * Warn-only by default (exit 0). Pass --enforce to fail closed.
+ * Not a task-check gate: this is a per-clone environment property.
+ */
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+import { defaultGitRunner } from "../session/git.js";
+const EXIT_OK = 0;
+const EXIT_ENFORCE_FINDINGS = 1;
+const EXIT_CONFIG = 2;
+export const LIFECYCLE_ROOT_PREFIXES = ["xbrief", "vbrief"];
+export const LIFECYCLE_STAGE_DIRS = [
+    "proposed",
+    "pending",
+    "active",
+    "completed",
+    "cancelled",
+];
+/** Canonical lifecycle root pathspecs (`xbrief/active/`, `vbrief/pending/`, …). */
+export function lifecycleRootRelPaths() {
+    const paths = [];
+    for (const prefix of LIFECYCLE_ROOT_PREFIXES) {
+        for (const stage of LIFECYCLE_STAGE_DIRS) {
+            paths.push(`${prefix}/${stage}/`);
+        }
+    }
+    return paths;
+}
+/** Fills `*` in ignore globs so a derived probe still matches the rule. */
+export const LIFECYCLE_PROBE_STEM = "lifecycle-visible";
+/**
+ * Date-prefixed brief-shaped fallback when no ignore-rule date glob exists.
+ * Date globs emit their own matching names (`2026-07-*` → a July file, `2025-*` → 2025).
+ */
+export const LIFECYCLE_PROBE_SENTINEL = "2026-01-01-lifecycle-visible.xbrief.json";
+/** Legacy vbrief filename so `*.vbrief.json` / `2026-*.vbrief.json` cannot report clean. */
+export const LIFECYCLE_PROBE_SENTINEL_VBRIEF = "2026-01-01-lifecycle-visible.vbrief.json";
+/** Windows CreateProcess argv budget; chunks check-ignore, never drops probes. */
+const CHECK_IGNORE_ARGV_CHAR_BUDGET = 24_000;
+function sentinelForRoot(root) {
+    return root.startsWith("vbrief/") ? LIFECYCLE_PROBE_SENTINEL_VBRIEF : LIFECYCLE_PROBE_SENTINEL;
+}
+/** Stage dirs plus one matching-extension sentinel under each. */
+export function lifecycleIgnoreProbeRelPaths() {
+    const probes = [];
+    for (const root of lifecycleRootRelPaths()) {
+        probes.push(root);
+        probes.push(`${root}${sentinelForRoot(root)}`);
+    }
+    return probes;
+}
+/** True when an ignore glob could hide a convention-valid brief. */
+export function ignorePatternLooksLifecycleRelevant(pattern) {
+    const p = pattern.replace(/\\/g, "/").replace(/\/+$/, "");
+    if (p.includes(".triage-cache"))
+        return false;
+    if (/(^|\/)(xbrief|vbrief)(\/|$)/.test(p))
+        return true;
+    if (p.includes(".xbrief.json") || p.includes(".vbrief.json"))
+        return true;
+    if (/(^|\/)\*\.json$/.test(p) || p.endsWith("/*.json"))
+        return true;
+    if (/\d{4}-/.test(p) || /\[[0-9]/.test(p))
+        return true;
+    return false;
+}
+/** True when `ch` is listed in a gitignore class body (`0-5`, `abc`). Linear scan. */
+function gitignoreClassContains(inner, ch) {
+    const code = ch.charCodeAt(0);
+    let i = 0;
+    while (i < inner.length) {
+        const a = inner[i] ?? "";
+        if (i + 2 < inner.length && inner[i + 1] === "-") {
+            const b = inner[i + 2] ?? "";
+            if (a.charCodeAt(0) <= code && code <= b.charCodeAt(0))
+                return true;
+            i += 3;
+            continue;
+        }
+        if (a === ch)
+            return true;
+        i += 1;
+    }
+    return false;
+}
+/** One concrete char that still matches a gitignore class. Negated classes skip `0`. */
+function pickGitignoreClassChar(inner, negated) {
+    const unescaped = inner.replace(/\\/g, "");
+    if (!negated)
+        return unescaped[0] ?? "0";
+    if (unescaped.length === 0)
+        return "0";
+    const candidates = "6789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01";
+    for (const c of candidates) {
+        if (!gitignoreClassContains(unescaped, c))
+            return c;
+    }
+    return "z";
+}
+/** Linear `[abc]` expansion — avoid nested regex quantifiers (CodeQL js/polynomial-redos). */
+export function expandGitignoreCharClasses(body) {
+    let out = "";
+    let i = 0;
+    while (i < body.length) {
+        const ch = body[i];
+        if (ch !== "[") {
+            out += ch;
+            i += 1;
+            continue;
+        }
+        const close = body.indexOf("]", i + 1);
+        if (close < 0) {
+            out += ch;
+            i += 1;
+            continue;
+        }
+        let inner = body.slice(i + 1, close);
+        const negated = inner.startsWith("!") || inner.startsWith("^");
+        if (negated)
+            inner = inner.slice(1);
+        out += pickGitignoreClassChar(inner, negated);
+        i = close + 1;
+    }
+    return out;
+}
+/**
+ * Expand one gitignore glob into a single concrete pathname that still matches it.
+ * `*` becomes {@link LIFECYCLE_PROBE_STEM}; `**` collapses; `?` becomes `0`.
+ */
+export function expandGitignoreGlobToConcrete(pattern) {
+    let body = pattern.replace(/\\/g, "/").trim();
+    if (body.startsWith("!"))
+        return null;
+    if (body.endsWith("/"))
+        body = body.slice(0, -1);
+    if (body.startsWith("/"))
+        body = body.slice(1);
+    if (body.length === 0)
+        return null;
+    body = expandGitignoreCharClasses(body);
+    body = body.replace(/\*\*/g, "");
+    body = body.replace(/\*/g, LIFECYCLE_PROBE_STEM);
+    body = body.replace(/\?/g, "0");
+    body = body.replace(/\/{2,}/g, "/").replace(/^\/+/, "");
+    return body.length > 0 ? body : null;
+}
+function lifecycleRootsForBasenameProbe(name) {
+    const roots = lifecycleRootRelPaths();
+    if (name.endsWith(".vbrief.json"))
+        return roots.filter((r) => r.startsWith("vbrief/"));
+    if (name.endsWith(".xbrief.json"))
+        return roots.filter((r) => r.startsWith("xbrief/"));
+    return roots;
+}
+function posixTrimDir(dir) {
+    return dir.replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
+}
+/** Join a glob-expanded probe to the ignore file's directory (Git's match root). */
+export function joinIgnoreFileBase(baseDir, concrete) {
+    const base = posixTrimDir(baseDir);
+    if (base.length === 0)
+        return concrete;
+    if (concrete === base || concrete.startsWith(`${base}/`))
+        return concrete;
+    return `${base}/${concrete}`;
+}
+function lifecycleRootsUnderIgnoreBase(name, baseDir) {
+    const roots = lifecycleRootsForBasenameProbe(name);
+    const base = posixTrimDir(baseDir);
+    if (base.length === 0)
+        return roots;
+    return roots.filter((root) => {
+        const r = root.replace(/\/+$/, "");
+        return r === base || r.startsWith(`${base}/`);
+    });
+}
+function isLifecycleStageName(name) {
+    return LIFECYCLE_STAGE_DIRS.includes(name);
+}
+/**
+ * Map a glob-expanded pathname onto real stage roots.
+ * A stage-wildcard glob expands `*` to the stem, which is not a stage —
+ * rewrite that slot to each canonical stage so nested globs cannot evade.
+ */
+function candidateLifecycleProbePaths(concrete, baseDir) {
+    const rebased = joinIgnoreFileBase(baseDir, concrete);
+    const out = [];
+    const seen = new Set();
+    const push = (relPosix) => {
+        const posix = relPosix.replace(/\\/g, "/").replace(/^\/+/, "");
+        if (posix.length === 0 || seen.has(posix))
+            return;
+        if (lifecycleRootForRelPath(posix) === null)
+            return;
+        seen.add(posix);
+        out.push(posix);
+    };
+    push(rebased);
+    const parts = rebased.split("/").filter((p) => p.length > 0);
+    const prefix = parts[0] ?? "";
+    if (prefix === "xbrief" || prefix === "vbrief") {
+        if (parts.length === 2) {
+            const name = parts[1] ?? "";
+            for (const stage of LIFECYCLE_STAGE_DIRS)
+                push(`${prefix}/${stage}/${name}`);
+        }
+        else if (parts.length >= 3 && !isLifecycleStageName(parts[1] ?? "")) {
+            const rest = parts.slice(2).join("/");
+            for (const stage of LIFECYCLE_STAGE_DIRS)
+                push(`${prefix}/${stage}/${rest}`);
+        }
+    }
+    else if (isLifecycleStageName(prefix)) {
+        const name = parts[parts.length - 1] ?? "";
+        const remainder = parts.slice(1).join("/");
+        for (const root of lifecycleRootsForBasenameProbe(name)) {
+            const stage = root.replace(/\/+$/, "").split("/")[1] ?? "";
+            if (stage === prefix)
+                push(`${root.replace(/\/+$/, "")}/${remainder}`);
+        }
+    }
+    return out;
+}
+function ignoreFileBaseDir(projectRoot, file) {
+    try {
+        const rel = relative(resolve(projectRoot), resolve(file)).replace(/\\/g, "/");
+        if (rel.length === 0 || rel.startsWith("..") || isAbsolute(rel))
+            return "";
+        if (rel === ".gitignore" || rel === ".git/info/exclude")
+            return "";
+        if (rel.endsWith("/.gitignore"))
+            return rel.slice(0, -"/.gitignore".length);
+    }
+    catch {
+        return "";
+    }
+    return "";
+}
+/**
+ * One derived probe per relevant ignore-rule line (bounded by ignore-file size, not a numeric cap).
+ * Date globs keep their year/month so `2026-07-*` probes a July name, not the January fallback.
+ * Slash patterns keep the ignore-file directory; stage wildcards expand onto real stages.
+ */
+export function derivedLifecycleIgnoreProbesFromSources(sources) {
+    const out = [];
+    const seen = new Set();
+    const add = (relPosix) => {
+        const posix = relPosix.replace(/\\/g, "/").replace(/^\/+/, "");
+        if (posix.length === 0 || seen.has(posix))
+            return;
+        if (lifecycleRootForRelPath(posix) === null)
+            return;
+        seen.add(posix);
+        out.push(posix);
+    };
+    for (const source of sources) {
+        const baseDir = posixTrimDir(source.baseDir);
+        for (const pattern of source.patterns) {
+            if (!ignorePatternLooksLifecycleRelevant(pattern))
+                continue;
+            const concrete = expandGitignoreGlobToConcrete(pattern);
+            if (concrete === null)
+                continue;
+            for (const candidate of candidateLifecycleProbePaths(concrete, baseDir)) {
+                add(candidate);
+            }
+            if (!concrete.includes("/")) {
+                for (const root of lifecycleRootsUnderIgnoreBase(concrete, baseDir)) {
+                    add(`${root}${concrete}`);
+                }
+            }
+        }
+    }
+    return out;
+}
+function collectNestedLifecycleGitignoreFiles(projectRoot) {
+    const files = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const ent of entries) {
+            if (ent.name === ".gitignore" && (ent.isFile() || ent.isSymbolicLink())) {
+                files.push(resolve(dir, ent.name));
+                continue;
+            }
+            if (!ent.isDirectory() || ent.name.startsWith("."))
+                continue;
+            walk(resolve(dir, ent.name));
+        }
+    };
+    for (const prefix of LIFECYCLE_ROOT_PREFIXES) {
+        walk(joinPath(projectRoot, prefix));
+    }
+    return files;
+}
+function readIgnorePatternSources(projectRoot, runGit) {
+    const files = new Set([
+        joinPath(projectRoot, ".gitignore"),
+        joinPath(projectRoot, ".git/info/exclude"),
+    ]);
+    for (const prefix of LIFECYCLE_ROOT_PREFIXES) {
+        files.add(joinPath(projectRoot, `${prefix}/.gitignore`));
+        for (const stage of LIFECYCLE_STAGE_DIRS) {
+            files.add(joinPath(projectRoot, `${prefix}/${stage}/.gitignore`));
+        }
+    }
+    for (const nested of collectNestedLifecycleGitignoreFiles(projectRoot)) {
+        files.add(nested);
+    }
+    const cfg = runGit(projectRoot, ["config", "--get", "core.excludesFile"]);
+    if (cfg.code === 0 && cfg.stdout.trim().length > 0) {
+        const raw = cfg.stdout.trim();
+        files.add(isAbsolute(raw) ? raw : resolve(projectRoot, raw));
+    }
+    const sources = [];
+    for (const file of files) {
+        if (!existsSync(file))
+            continue;
+        let text;
+        try {
+            text = readFileSync(file, "utf8");
+        }
+        catch {
+            continue;
+        }
+        const patterns = [];
+        for (const raw of text.split(/\r?\n/)) {
+            const line = raw.trim();
+            if (line.length === 0 || line.startsWith("#") || line.startsWith("!"))
+                continue;
+            patterns.push(line.replace(/\\ /g, " "));
+        }
+        if (patterns.length === 0)
+            continue;
+        sources.push({ baseDir: ignoreFileBaseDir(projectRoot, file), patterns });
+    }
+    return sources;
+}
+/** Ignore-file globs → check-ignore pathspecs (one per relevant rule line). */
+export function derivedLifecycleIgnoreProbes(projectRoot, runGit) {
+    return derivedLifecycleIgnoreProbesFromSources(readIgnorePatternSources(projectRoot, runGit));
+}
+/** Map a check-ignore pathname back to its canonical stage root, or null if outside. */
+export function lifecycleRootForRelPath(relPosix) {
+    const posix = relPosix.replace(/\\/g, "/").replace(/\/+$/, "");
+    for (const root of lifecycleRootRelPaths()) {
+        const prefix = root.replace(/\/+$/, "");
+        if (posix === prefix || posix.startsWith(`${prefix}/`))
+            return root;
+    }
+    return null;
+}
+/** Deliberate hybrid ignores under a visible root must not trip the check (#1144). */
+export function isSelectiveLifecyclePath(relPosix) {
+    const posix = relPosix.replace(/\\/g, "/");
+    return posix.includes("/.triage-cache/") || posix.includes(".triage-cache/");
+}
+/** Map git check-ignore source paths to the actionable display form. */
+export function displayIgnoreSource(source, projectRoot) {
+    const posix = source.replace(/\\/g, "/");
+    if (posix.endsWith("/info/exclude") || posix.endsWith(".git/info/exclude")) {
+        return ".git/info/exclude";
+    }
+    try {
+        const rel = relative(resolve(projectRoot), resolve(source)).replace(/\\/g, "/");
+        if (rel.length > 0 && !rel.startsWith("..") && !isAbsolute(rel)) {
+            return rel;
+        }
+    }
+    catch {
+        // keep original
+    }
+    return source;
+}
+/**
+ * Parse one `git check-ignore -v` line: `<source>:<linenum>:<pattern>\\t<pathname>`.
+ * Source may be a Windows absolute path with a drive colon.
+ */
+export function parseCheckIgnoreVerboseLine(line) {
+    const tab = line.lastIndexOf("\t");
+    if (tab < 0)
+        return null;
+    const meta = line.slice(0, tab);
+    const pathname = line.slice(tab + 1).replace(/\\/g, "/");
+    const match = /^(.*):(\d+):(.*)$/.exec(meta);
+    if (match === null)
+        return null;
+    const source = match[1] ?? "";
+    const lineNo = Number.parseInt(match[2] ?? "", 10);
+    const pattern = match[3] ?? "";
+    if (source.length === 0 || Number.isNaN(lineNo))
+        return null;
+    return { source, line: lineNo, pattern, path: pathname };
+}
+/** Parse one `git ls-files -v` record (`S path` / `h path`). */
+export function parseLsFilesVerboseRecord(record) {
+    if (record.length < 3 || record[1] !== " ")
+        return null;
+    const tag = record[0];
+    if (tag === undefined)
+        return null;
+    return { tag, path: record.slice(2).replace(/\\/g, "/") };
+}
+/** Index flag encoded by the `ls-files -v` status tag. */
+export function indexFlagKind(tag) {
+    if (tag === "S" || tag === "s")
+        return "skip-worktree";
+    if (tag.length === 1 && tag >= "a" && tag <= "z")
+        return "assume-unchanged";
+    return null;
+}
+/** Git top-level so a nested cwd cannot miss repo-root lifecycle dirs. */
+function resolveScanRoot(projectRoot, runGit) {
+    const { code, stdout } = runGit(projectRoot, ["rev-parse", "--show-toplevel"]);
+    if (code === 0 && stdout.trim().length > 0) {
+        return resolve(stdout.trim());
+    }
+    return resolve(projectRoot);
+}
+function formatFinding(finding) {
+    if (finding.kind === "ignored") {
+        const loc = finding.line === null
+            ? `${finding.source}:${finding.rule}`
+            : `${finding.source}:${finding.line}:${finding.rule}`;
+        return `  ${finding.path}  ignored by ${loc}`;
+    }
+    return `  ${finding.path}  ${finding.kind} (${finding.source})`;
+}
+function resultFor(findings, enforce) {
+    if (findings.length === 0) {
+        return {
+            code: EXIT_OK,
+            message: `OK: verify:lifecycle-visible — lifecycle roots are not hidden by ignore rules ` +
+                `or index flags (enforce=${enforce}).`,
+            stream: "stdout",
+            findings: [],
+            enforce,
+            failOpen: !enforce,
+        };
+    }
+    const lines = [
+        `verify:lifecycle-visible: ${findings.length} hidden lifecycle path(s):`,
+        ...findings.map(formatFinding),
+    ];
+    if (enforce) {
+        lines.push("FAIL: --enforce is set; remove the matching ignore rule or index flag so lifecycle roots stay visible to git (#3505).");
+        return {
+            code: EXIT_ENFORCE_FINDINGS,
+            message: lines.join("\n"),
+            stream: "stderr",
+            findings,
+            enforce: true,
+            failOpen: false,
+        };
+    }
+    lines.push("ADVISORY (warn-only): exit 0. Pass --enforce to fail closed (#3505).");
+    return {
+        code: EXIT_OK,
+        message: lines.join("\n"),
+        stream: "stdout",
+        findings,
+        enforce: false,
+        failOpen: true,
+    };
+}
+function joinPath(root, relPosix) {
+    return resolve(root, ...relPosix
+        .replace(/\/+$/, "")
+        .split("/")
+        .filter((p) => p.length > 0));
+}
+/** Existing non-dot files under present stage dirs (skip .triage-cache / .gitkeep). */
+function presentLifecycleFileRelPaths(projectRoot) {
+    const out = [];
+    for (const root of lifecycleRootRelPaths()) {
+        let entries;
+        try {
+            entries = readdirSync(joinPath(projectRoot, root), { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const ent of entries) {
+            if (!ent.isFile() || ent.name.startsWith("."))
+                continue;
+            const rel = `${root.replace(/\/+$/, "")}/${ent.name}`;
+            if (isSelectiveLifecyclePath(rel))
+                continue;
+            out.push(rel);
+        }
+    }
+    return out;
+}
+/** January file sentinel only on roots that have no date-shaped derived probe. */
+function emptyStageFallbackProbes(derived) {
+    const rootsWithDateProbe = new Set();
+    for (const probe of derived) {
+        const root = lifecycleRootForRelPath(probe);
+        const base = probe.split("/").pop() ?? "";
+        if (root !== null && /\d{4}-/.test(base))
+            rootsWithDateProbe.add(root);
+    }
+    if (rootsWithDateProbe.size === 0)
+        return lifecycleIgnoreProbeRelPaths();
+    const probes = [];
+    for (const root of lifecycleRootRelPaths()) {
+        probes.push(root);
+        if (!rootsWithDateProbe.has(root)) {
+            probes.push(`${root}${sentinelForRoot(root)}`);
+        }
+    }
+    return probes;
+}
+function chunkCheckIgnorePathspecs(probes) {
+    const overhead = "check-ignore -v --no-index --".length;
+    const budget = CHECK_IGNORE_ARGV_CHAR_BUDGET - overhead;
+    const chunks = [];
+    let current = [];
+    let used = 0;
+    for (const probe of probes) {
+        const cost = probe.length + 1;
+        if (current.length > 0 && used + cost > budget) {
+            chunks.push(current);
+            current = [];
+            used = 0;
+        }
+        current.push(probe);
+        used += cost;
+    }
+    if (current.length > 0)
+        chunks.push(current);
+    return chunks;
+}
+function checkIgnoreVerboseStdout(projectRoot, runGit, probes) {
+    const parts = [];
+    for (const chunk of chunkCheckIgnorePathspecs(probes)) {
+        const { code, stdout, stderr } = runGit(projectRoot, [
+            "check-ignore",
+            "-v",
+            "--no-index",
+            "--",
+            ...chunk,
+        ]);
+        if (code === 1)
+            continue;
+        if (code !== 0) {
+            throw new GitProbeError(code, stderr || "git check-ignore failed");
+        }
+        if (stdout.length > 0)
+            parts.push(stdout);
+    }
+    return parts.join("\n");
+}
+function collectIgnoredRoots(projectRoot, runGit) {
+    // Probe every canonical stage even when the directory is absent so an ignore
+    // rule cannot hide a missing xbrief/active/ before it is created (#3505).
+    // Directory pathspecs miss file-only globs (`xbrief/active/*.json`); a
+    // brief-shaped sentinel plus present files close that hole. Date-range globs
+    // such as `2026-07-*.xbrief.json` miss the January fallback, so emit one
+    // matching derived probe per ignore-rule line (no numeric cap).
+    const derived = derivedLifecycleIgnoreProbes(projectRoot, runGit);
+    const probes = [
+        ...new Set([
+            ...emptyStageFallbackProbes(derived),
+            ...presentLifecycleFileRelPaths(projectRoot),
+            ...derived,
+        ]),
+    ];
+    // --no-index: report the matching rule even when some files under the root
+    // are already tracked (the #3504 hide is untracked new briefs).
+    const stdout = checkIgnoreVerboseStdout(projectRoot, runGit, probes);
+    if (stdout.length === 0)
+        return [];
+    const findings = [];
+    const seen = new Set();
+    for (const rawLine of stdout.split(/\r?\n/)) {
+        if (rawLine.length === 0)
+            continue;
+        const negatedLine = rawLine.startsWith("!");
+        const line = negatedLine ? rawLine.slice(1) : rawLine;
+        const parsed = parseCheckIgnoreVerboseLine(line);
+        if (parsed === null)
+            continue;
+        if (negatedLine || parsed.pattern.startsWith("!"))
+            continue;
+        if (isSelectiveLifecyclePath(parsed.path))
+            continue;
+        const displayPath = lifecycleRootForRelPath(parsed.path);
+        if (displayPath === null)
+            continue;
+        const source = displayIgnoreSource(parsed.source, projectRoot);
+        const key = `${displayPath}|ignored|${source}|${parsed.line}|${parsed.pattern}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        findings.push({
+            path: displayPath,
+            kind: "ignored",
+            source,
+            line: parsed.line,
+            rule: parsed.pattern,
+            raw: rawLine,
+        });
+    }
+    return findings;
+}
+function collectIndexFlags(projectRoot, runGit) {
+    const pathspecs = lifecycleRootRelPaths().map((rel) => rel.replace(/\/+$/, ""));
+    const { code, stdout, stderr } = runGit(projectRoot, ["ls-files", "-v", "--", ...pathspecs]);
+    if (code !== 0) {
+        if (code === 1 && stdout.length === 0)
+            return [];
+        throw new GitProbeError(code, stderr || "git ls-files -v failed");
+    }
+    const findings = [];
+    for (const record of stdout.split(/\r?\n/)) {
+        if (record.length === 0)
+            continue;
+        const parsed = parseLsFilesVerboseRecord(record);
+        if (parsed === null)
+            continue;
+        if (isSelectiveLifecyclePath(parsed.path))
+            continue;
+        const kind = indexFlagKind(parsed.tag);
+        if (kind === null)
+            continue;
+        findings.push({
+            path: parsed.path,
+            kind,
+            source: "index",
+            line: null,
+            rule: kind,
+            raw: record,
+        });
+    }
+    return findings;
+}
+class GitProbeError extends Error {
+    exitCode;
+    constructor(exitCode, message) {
+        super(message);
+        this.exitCode = exitCode;
+    }
+}
+/** Session:start advisory lines — silent when clean. */
+export function formatLifecycleVisibleSessionLines(result) {
+    if (result.findings.length === 0)
+        return [];
+    const lines = result.findings.map((finding) => {
+        if (finding.kind === "ignored") {
+            const loc = finding.line === null
+                ? `${finding.source}:${finding.rule}`
+                : `${finding.source}:${finding.line}:${finding.rule}`;
+            return `[deft lifecycle-visible] hidden ${finding.path}  (${loc})`;
+        }
+        return `[deft lifecycle-visible] ${finding.kind} on ${finding.path}`;
+    });
+    lines.push("[deft lifecycle-visible] ADVISORY: lifecycle roots must stay visible to git " +
+        "(warn-only; task verify:lifecycle-visible -- --enforce to fail closed).");
+    return lines;
+}
+/** Evaluate whether lifecycle roots are hidden by ignore rules or index flags (#3505). */
+export function evaluateLifecycleVisible(options) {
+    const root = resolve(options.projectRoot);
+    const enforce = options.enforce === true;
+    if (!existsSync(root)) {
+        return {
+            code: EXIT_CONFIG,
+            message: `verify:lifecycle-visible: project root not found: ${root}`,
+            stream: "stderr",
+            findings: [],
+            enforce,
+            failOpen: !enforce,
+        };
+    }
+    const runGit = options.runGit ?? defaultGitRunner;
+    try {
+        const scanRoot = resolveScanRoot(root, runGit);
+        const findings = [
+            ...collectIgnoredRoots(scanRoot, runGit),
+            ...collectIndexFlags(scanRoot, runGit),
+        ];
+        return resultFor(findings, enforce);
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        const gitCode = err instanceof GitProbeError ? err.exitCode : undefined;
+        const hint = gitCode === 127
+            ? "git executable not found on PATH"
+            : gitCode === 128
+                ? "not a git repository"
+                : detail;
+        return {
+            code: EXIT_CONFIG,
+            message: `verify:lifecycle-visible: ${hint}`,
+            stream: "stderr",
+            findings: [],
+            enforce,
+            failOpen: !enforce,
+        };
+    }
+}
+//# sourceMappingURL=evaluate.js.map