@deftai/directive-core 0.105.0 → 0.107.0

package/dist/forward-coverage/diff-lines.js

@@ -0,0 +1,173 @@
+/**
+ * Parse unified diffs into added/modified new-file line numbers (#3514).
+ */
+const HUNK_RE = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/;
+/** Git `core.quotePath` C-style escapes (quote.c). */
+const GIT_C_ESCAPES = {
+    a: "\u0007",
+    b: "\b",
+    t: "\t",
+    n: "\n",
+    v: "\v",
+    f: "\f",
+    r: "\r",
+    '"': '"',
+    "\\": "\\",
+};
+function isOctalDigit(ch) {
+    return ch !== undefined && ch >= "0" && ch <= "7";
+}
+/** Read one 1-3 digit octal byte at `index` (first digit). */
+function readOctalByte(inner, index) {
+    if (!isOctalDigit(inner[index])) {
+        return null;
+    }
+    let oct = inner[index] ?? "";
+    let next = index + 1;
+    if (isOctalDigit(inner[next])) {
+        oct += inner[next] ?? "";
+        next += 1;
+        if (isOctalDigit(inner[next])) {
+            oct += inner[next] ?? "";
+            next += 1;
+        }
+    }
+    return { value: Number.parseInt(oct, 8), next };
+}
+/** Decode a Git C-quoted path (`"foo\\tbar"` → `foo\tbar`). */
+export function unescapeGitQuotedPath(raw) {
+    const s = raw.trim();
+    if (!(s.startsWith('"') && s.endsWith('"') && s.length >= 2)) {
+        return s;
+    }
+    const inner = s.slice(1, -1);
+    let out = "";
+    const utf8 = new TextDecoder("utf-8");
+    for (let i = 0; i < inner.length; i += 1) {
+        const ch = inner[i];
+        if (ch !== "\\") {
+            out += ch;
+            continue;
+        }
+        const next = inner[i + 1];
+        if (next === undefined) {
+            out += "\\";
+            break;
+        }
+        i += 1;
+        const simple = GIT_C_ESCAPES[next];
+        if (simple !== undefined) {
+            out += simple;
+            continue;
+        }
+        const first = readOctalByte(inner, i);
+        if (first !== null) {
+            const bytes = [first.value];
+            i = first.next;
+            while (inner[i] === "\\" && isOctalDigit(inner[i + 1])) {
+                const more = readOctalByte(inner, i + 1);
+                if (more === null) {
+                    break;
+                }
+                bytes.push(more.value);
+                i = more.next;
+            }
+            i -= 1;
+            out += utf8.decode(Uint8Array.from(bytes));
+            continue;
+        }
+        out += next;
+    }
+    return out;
+}
+/** Strip git `a/` `b/` prefixes and quotes from a `+++` path. */
+export function stripGitDiffPath(raw) {
+    let s = unescapeGitQuotedPath(raw.trim());
+    if (s.startsWith("'") && s.endsWith("'") && s.length >= 2) {
+        s = s.slice(1, -1);
+    }
+    const prefixed = /^[abiwc]\/(.*)$/.exec(s);
+    if (prefixed?.[1] !== undefined) {
+        return prefixed[1].replace(/\\/g, "/");
+    }
+    return s.replace(/\\/g, "/");
+}
+/**
+ * Collect 1-indexed lines added on the new side of a unified diff (`-U0` ok).
+ * Deletions-only hunks contribute nothing. `/dev/null` destinations are skipped.
+ */
+export function parseUnifiedDiffAddedLines(diffText) {
+    const result = new Map();
+    let current = null;
+    let newLine = 0;
+    let inHunk = false;
+    for (const raw of diffText.split("\n")) {
+        const line = raw.replace(/\r$/, "");
+        if (line.startsWith("diff --git ")) {
+            current = null;
+            inHunk = false;
+            continue;
+        }
+        if (line.startsWith("+++ ")) {
+            const rest = line.slice(4).trim();
+            if (rest === "/dev/null") {
+                current = null;
+                inHunk = false;
+                continue;
+            }
+            current = stripGitDiffPath(rest);
+            if (!result.has(current)) {
+                result.set(current, new Set());
+            }
+            inHunk = false;
+            continue;
+        }
+        const hunk = HUNK_RE.exec(line);
+        if (hunk) {
+            newLine = Number(hunk[1]);
+            inHunk = current !== null;
+            continue;
+        }
+        if (!inHunk || current === null) {
+            continue;
+        }
+        if (line.startsWith("\\")) {
+            continue;
+        }
+        const lines = result.get(current);
+        if (lines === undefined) {
+            continue;
+        }
+        if (line.startsWith("+")) {
+            lines.add(newLine);
+            newLine += 1;
+        }
+        else if (line.startsWith("-")) {
+            // old-file deletion; new-file cursor stays
+        }
+        else {
+            newLine += 1;
+        }
+    }
+    return result;
+}
+/** Count physical lines in file content (no trailing empty split artifact). */
+export function countFileLines(content) {
+    if (content.length === 0) {
+        return 0;
+    }
+    const parts = content.split(/\r\n|\n/);
+    if (parts[parts.length - 1] === "") {
+        parts.pop();
+    }
+    return parts.length;
+}
+/** Treat every line of an untracked file as added. */
+export function allLinesChanged(lineCount) {
+    const lines = new Set();
+    for (let i = 1; i <= lineCount; i += 1) {
+        lines.add(i);
+    }
+    return lines;
+}
+//# sourceMappingURL=diff-lines.js.map

package/dist/forward-coverage/evaluate.d.ts

@@ -1,16 +1,24 @@
 /**
- * forward-coverage/evaluate.ts -- deterministic forward-coverage gate (#1310).
+ * forward-coverage/evaluate.ts -- deterministic forward-coverage gate
+ * (#1310 / #3514).
  *
- * Migrates the prose-tier "new source files MUST include corresponding test
- * files in the same PR" rule (AGENTS.md) to deterministic enforcement,
- * mirroring `verify:encoding` (#798) and `verify:branch` (#747).
+ * Two halves:
+ *  1. Fail-closed new-file existence (#1310): each NEW source file
+ *     (`*.py` / `*.go` / `*.ts` / `*.tsx`, excluding tests and `*.d.ts`)
+ *     must ship a corresponding test file in the same diff.
+ *  2. Warn-first diff coverage (#3514): intersect `coverage-final.json`
+ *     with added/modified lines and report uncovered changed branches.
+ *     Default threshold is 90% of those branches. That 90% is per-change
+ *     coverage of new code; the project vitest floor (75) is a collapse
+ *     detector for the aggregate -- they are not interchangeable.
  *
- * Behaviour (v1 = NEW-file granularity only, to keep false positives near
- * zero): read the staged (`--staged`) or HEAD-relative diff; for each NEW
- * source file (`*.py` / `*.go` / `*.ts` / `*.tsx`, excluding test files and
- * `*.d.ts`), assert a corresponding test file was added in the SAME diff.
- * Three-state exit: 0 clean / 1 missing forward coverage / 2 config error.
+ * Missing coverage reports skip the diff half (existence still runs).
+ * Pass `enforceDiffCoverage` / `--enforce` to fail closed on uncovered
+ * changed branches. Three-state exit: 0 clean or warn / 1 missing
+ * existence (or enforced diff findings) / 2 config error.
  */
+import { type DiffCoverageReport } from "./diff-coverage.js";
+export { DEFAULT_DIFF_COVERAGE_THRESHOLD, type DiffCoverageReport, type UncoveredChangedBranch, } from "./diff-coverage.js";
 /** Diff scope: `staged` = index vs HEAD; `head` = working tree + index vs HEAD. */
 export type ForwardCoverageMode = "head" | "staged";
 /** A new source file that has no corresponding test file in the same diff. */
@@ -25,10 +33,17 @@ export interface ForwardCoverageResult {
     readonly exitCode: 0 | 1 | 2;
     readonly missing: MissingCoverage[];
     readonly message: string;
+    readonly diffCoverage: DiffCoverageReport | null;
 }
 export interface ForwardCoverageOptions {
     readonly mode?: ForwardCoverageMode;
     readonly allowListPath?: string | null;
+    /** Fail closed on uncovered changed branches. Default warn-only. */
+    readonly enforceDiffCoverage?: boolean;
+    /** Override coverage-final.json path. Default `<root>/coverage/coverage-final.json`. */
+    readonly coverageReportPath?: string | null;
+    /** Per-diff branch threshold. Default 90 -- not the 75 global floor. */
+    readonly diffThreshold?: number;
 }
 /**
  * True when `relPath` is a test file (excluded from the "needs coverage" set

package/dist/forward-coverage/evaluate.js

@@ -1,21 +1,31 @@
 /**
- * forward-coverage/evaluate.ts -- deterministic forward-coverage gate (#1310).
+ * forward-coverage/evaluate.ts -- deterministic forward-coverage gate
+ * (#1310 / #3514).
  *
- * Migrates the prose-tier "new source files MUST include corresponding test
- * files in the same PR" rule (AGENTS.md) to deterministic enforcement,
- * mirroring `verify:encoding` (#798) and `verify:branch` (#747).
+ * Two halves:
+ *  1. Fail-closed new-file existence (#1310): each NEW source file
+ *     (`*.py` / `*.go` / `*.ts` / `*.tsx`, excluding tests and `*.d.ts`)
+ *     must ship a corresponding test file in the same diff.
+ *  2. Warn-first diff coverage (#3514): intersect `coverage-final.json`
+ *     with added/modified lines and report uncovered changed branches.
+ *     Default threshold is 90% of those branches. That 90% is per-change
+ *     coverage of new code; the project vitest floor (75) is a collapse
+ *     detector for the aggregate -- they are not interchangeable.
  *
- * Behaviour (v1 = NEW-file granularity only, to keep false positives near
- * zero): read the staged (`--staged`) or HEAD-relative diff; for each NEW
- * source file (`*.py` / `*.go` / `*.ts` / `*.tsx`, excluding test files and
- * `*.d.ts`), assert a corresponding test file was added in the SAME diff.
- * Three-state exit: 0 clean / 1 missing forward coverage / 2 config error.
+ * Missing coverage reports skip the diff half (existence still runs).
+ * Pass `enforceDiffCoverage` / `--enforce` to fail closed on uncovered
+ * changed branches. Three-state exit: 0 clean or warn / 1 missing
+ * existence (or enforced diff findings) / 2 config error.
  */
 import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
-import { basename } from "node:path";
+import { basename, join } from "node:path";
 import { GitCommandError, GitNotFoundError } from "../encoding/git.js";
 import { fnmatchCase } from "../encoding/text.js";
+import { SUBPROCESS_MAX_BUFFER } from "../subprocess/max-buffer.js";
+import { evaluateDiffCoverage, hasDiffCoverageFindings, } from "./diff-coverage.js";
+import { allLinesChanged, countFileLines, parseUnifiedDiffAddedLines, } from "./diff-lines.js";
+export { DEFAULT_DIFF_COVERAGE_THRESHOLD, } from "./diff-coverage.js";
 /** Source-file extensions in scope for v1. */
 const SOURCE_EXTENSIONS = new Set([".py", ".go", ".ts", ".tsx"]);
 /** Raised by `loadAllowList` when the path does not exist. */
@@ -117,6 +127,7 @@ function git(args, projectRoot) {
         cwd: projectRoot,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"],
+        maxBuffer: SUBPROCESS_MAX_BUFFER,
     });
     if (result.error !== undefined) {
         const e = result.error;
@@ -176,7 +187,83 @@ function addedFiles(projectRoot, mode) {
     return [...added];
 }
 function configError(message) {
-    return { exitCode: 2, missing: [], message };
+    return { exitCode: 2, missing: [], message, diffCoverage: null };
+}
+function mergeChangedLines(into, from) {
+    for (const [path, lines] of from) {
+        const posix = path.replace(/\\/g, "/");
+        const set = into.get(posix) ?? new Set();
+        for (const n of lines) {
+            set.add(n);
+        }
+        into.set(posix, set);
+    }
+}
+/**
+ * Added, modified, and renamed new-file line numbers in the diff scope.
+ * Untracked files in head mode count as fully added. Rename-classified
+ * edits (`--diff-filter=AMR`) still contribute their added lines.
+ */
+function changedLinesByFile(projectRoot, mode) {
+    const maps = new Map();
+    if (mode === "staged") {
+        const diff = git(["diff", "--cached", "-U0", "--diff-filter=AMR", "--no-color"], projectRoot);
+        if (diff.status === 0) {
+            mergeChangedLines(maps, parseUnifiedDiffAddedLines(diff.stdout));
+        }
+        return maps;
+    }
+    const hasHead = git(["rev-parse", "--verify", "-q", "HEAD"], projectRoot).status === 0;
+    if (hasHead) {
+        const diff = git(["diff", "-U0", "--diff-filter=AMR", "--no-color", "HEAD"], projectRoot);
+        if (diff.status === 0) {
+            mergeChangedLines(maps, parseUnifiedDiffAddedLines(diff.stdout));
+        }
+    }
+    for (const rel of toLines(gitOrThrow(["ls-files", "--others", "--exclude-standard"], projectRoot))) {
+        const posix = rel.replace(/\\/g, "/");
+        let content;
+        try {
+            content = readFileSync(join(projectRoot, posix), "utf8");
+        }
+        catch {
+            continue;
+        }
+        const set = maps.get(posix) ?? new Set();
+        for (const n of allLinesChanged(countFileLines(content))) {
+            set.add(n);
+        }
+        maps.set(posix, set);
+    }
+    return maps;
+}
+function formatDiffCoverage(report, enforce) {
+    if (!report.reportPresent) {
+        return "";
+    }
+    const findings = hasDiffCoverageFindings(report);
+    if (!findings && report.changedBranchTotal === 0) {
+        return "";
+    }
+    const pct = report.percent.toFixed(2);
+    const roles = `  The ${report.threshold}% per-diff threshold covers added/modified branches; the 75 global ` +
+        "floor is a collapse detector for the aggregate -- they are not interchangeable (#3514 / #3512).";
+    if (!findings) {
+        return (`verify_forward_coverage: diff coverage ${pct}% of ${report.changedBranchTotal} ` +
+            `changed branch(es) (threshold ${report.threshold}%).\n${roles}`);
+    }
+    const header = `verify_forward_coverage: ${report.uncovered.length} uncovered changed branch(es) ` +
+        `(diff ${pct}% vs ${report.threshold}% threshold).\n${roles}`;
+    const body = report.uncovered
+        .slice(0, 20)
+        .map((u) => `  ${u.path}:${u.line} (${u.type} #${u.branchId}[${u.pathIndex}])`)
+        .join("\n");
+    const more = report.uncovered.length > 20 ? `\n  ... ${report.uncovered.length - 20} more` : "";
+    const posture = enforce
+        ? "FAIL: --enforce is set; cover the changed branches or raise the tests (#3514)."
+        : "ADVISORY (warn-only): exit 0 for the diff half. Pass --enforce to fail closed (#3514). " +
+            "New-file existence remains fail-closed.";
+    return `${header}\n${body}${more}\n${posture}`;
 }
 /**
  * Pure evaluation returning `{ exitCode, missing, message }`. Three-state exit
@@ -201,8 +288,10 @@ export function evaluateForwardCoverage(projectRoot, options = {}) {
             "  Recovery: check file permissions.");
     }
     let added;
+    let changedLines;
     try {
         added = addedFiles(projectRoot, mode);
+        changedLines = changedLinesByFile(projectRoot, mode);
     }
     catch (err) {
         if (err instanceof GitNotFoundError) {
@@ -233,6 +322,22 @@ export function evaluateForwardCoverage(projectRoot, options = {}) {
             missing.push({ path: rel, expectedTests: expected });
         }
     }
+    const sourceChanged = new Map();
+    for (const [rel, lines] of changedLines) {
+        if (!isSourceFile(rel) || isAllowListed(rel, allowGlobs)) {
+            continue;
+        }
+        sourceChanged.set(rel, lines);
+    }
+    const coverageReportPath = options.coverageReportPath ?? join(projectRoot, "coverage", "coverage-final.json");
+    const enforce = options.enforceDiffCoverage === true;
+    const diffCoverage = evaluateDiffCoverage({
+        projectRoot,
+        coverageReportPath,
+        changedLinesByFile: sourceChanged,
+        threshold: options.diffThreshold,
+    });
+    const diffSection = formatDiffCoverage(diffCoverage, enforce);
     if (missing.length > 0) {
         const header = `verify_forward_coverage: ${missing.length} new source file(s) added without a ` +
             "corresponding test in the same diff (#1310).\n" +
@@ -242,13 +347,14 @@ export function evaluateForwardCoverage(projectRoot, options = {}) {
         const body = missing
             .map((m) => `  ${m.path}\n    expected one of: ${m.expectedTests.join(", ")}`)
             .join("\n");
-        return { exitCode: 1, missing, message: `${header}\n${body}` };
-    }
-    return {
-        exitCode: 0,
-        missing,
-        message: `verify_forward_coverage: ${checked} new source file(s) checked -- ` +
-            "all have forward coverage in the diff (#1310).",
-    };
+        const message = diffSection === "" ? `${header}\n${body}` : `${header}\n${body}\n${diffSection}`;
+        return { exitCode: 1, missing, message, diffCoverage };
+    }
+    const existence = `verify_forward_coverage: ${checked} new source file(s) checked -- ` +
+        "all have forward coverage in the diff (#1310).";
+    const findings = hasDiffCoverageFindings(diffCoverage);
+    const exitCode = enforce && findings ? 1 : 0;
+    const message = diffSection === "" ? existence : `${existence}\n${diffSection}`;
+    return { exitCode, missing, message, diffCoverage };
 }
 //# sourceMappingURL=evaluate.js.map

package/dist/hooks/dest-form.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Product dest-form classifier for in-repo Shell mutations (#3438).
+ *
+ * NEW harvest — do not reuse `classifyShellAuthzOps` / `listShellOps` as-is.
+ * Those return [] for `git checkout --` / `rm` of ordinary product paths.
+ *
+ * ! Resolves a target for ONE shape only: a single simple command. Everything
+ * else is recognized and fail-closed. Reconstructing a target from shell state
+ * was implemented and withdrawn — cwd depends on operator precedence, on exit
+ * status, on subshell boundaries, and on git config, and every resolution rule
+ * added produced its own fence bypass. Do not add it back; widen the recognized
+ * *forms* instead, and see `content/contracts/path-write-fence.md`.
+ *
+ * Residual known-open (recognition, not resolution): `python -c`,
+ * `cmd /c copy`, obfuscated `bash -c`.
+ *
+ * Commit-time active-scope is out of this slice (#3438), and ⊗ do not weaken
+ * Edit to match Shell. Keep this sentence on ONE line: acceptance clause 4 is
+ * verified by a literal token search, so wrapping it silently fails the gate.
+ */
+export type ProductDestFormKind = "git-checkout" | "git-restore" | "rm" | "rmdir";
+export interface ProductDestForm {
+    readonly kind: ProductDestFormKind;
+    readonly path: string;
+    /**
+     * True when the target is not provable — a glob/variable or leading `~` dest,
+     * a git context option, or any command that is not a single simple one. The
+     * dispatcher denies these outright; `path` is then only for the message, and
+     * is `SHELL_DEST_EXPANSION_SENTINEL` when no token can be named.
+     */
+    readonly expansion?: boolean;
+}
+/** Injected write target for expansion dests so the fence cannot match a literal glob. */
+export declare const SHELL_DEST_EXPANSION_SENTINEL = "__shell_dest_expansion__";
+/**
+ * Inject a dest path so `inspectMutationGates` sees the same write target as Edit/Write.
+ * Preserves original payload fields (command, posture markers).
+ */
+export declare function payloadWithInjectedWriteTarget(payload: unknown, destPath: string): Record<string, unknown>;
+/**
+ * Classify recognized product dest-forms in a shell command (#3438 v1 list).
+ * Empty when the command is not `git checkout -- <paths>`, `git restore`, or `rm`/`rmdir`.
+ */
+export declare function destFormHasExpansion(path: string): boolean;
+export declare function classifyProductDestForms(command: string): ProductDestForm[];
+//# sourceMappingURL=dest-form.d.ts.map