@descryy/core 0.1.1 → 0.2.0

package/dist/sources/confirmed/incidents.js

@@ -0,0 +1,173 @@
+/**
+ * The `IRSource` that projects developer-confirmed incidents into the graph.
+ *
+ * ## Why a source, and not a direct write
+ *
+ * A `ConfirmedIncident` lives in `.descry/config.json` because it is testimony
+ * — a developer fixed something and said so, and no commit records that they
+ * said it (see the type's own doc). But a store is derived data: DEC-017 drops
+ * every derived table on a schema change and rebuilds from source. So a
+ * confirmed incident written *only* into the graph would survive until the next
+ * IR-version bump and then vanish, which is the failure the EARNED partition
+ * exists to prevent — arriving through a writer that simply did not think about
+ * it.
+ *
+ * Making this a source solves it by construction. The file is the record; the
+ * graph is a projection of the record; every `analyze` re-projects. There is no
+ * migration to write and no earned table to extend, and the same discipline
+ * every other producer in this system already follows applies unchanged: a
+ * batch in, `writeBatch` out, invalidation by producer id.
+ *
+ * ## Identity
+ *
+ * The `INCIDENT` node keys on `confirmed:<confirmedAt>:<summary>` — the moment
+ * the developer said it, plus what they said. Deliberately **not** the file set:
+ * node ids never contain a path (renames churn them and silently destroy
+ * incident links), and a developer correcting the file list of an incident they
+ * already recorded is editing one incident rather than creating a second.
+ *
+ * ## What it does not do
+ *
+ * It mints no `FIX_PATTERN` unless the record names a fixing commit, and it
+ * never infers one from HEAD. "The developer confirmed an incident" and "the
+ * developer confirmed which commit fixed it" are separate claims, and only the
+ * second one licenses a `FIXED_BY` edge.
+ */
+import { fileQsp, nodeId, } from "@descryy/ir";
+export const CONFIRMED_INCIDENT_SOURCE_ID = "confirmed-incidents";
+export const CONFIRMED_INCIDENT_SOURCE_VERSION = "0.1.0";
+const PRODUCED_BY = `${CONFIRMED_INCIDENT_SOURCE_ID}@${CONFIRMED_INCIDENT_SOURCE_VERSION}`;
+/** The `INCIDENT` node id for one record. Stable across re-projections. */
+export function confirmedIncidentId(scope, incident) {
+    return nodeId(scope, "INCIDENT", `confirmed:${incident.confirmedAt}:${incident.summary}`, null);
+}
+export function createConfirmedIncidentSource(options) {
+    return {
+        id: CONFIRMED_INCIDENT_SOURCE_ID,
+        version: CONFIRMED_INCIDENT_SOURCE_VERSION,
+        emit(ctx) {
+            const repo = options.repo || ctx.root.repo;
+            // INCIDENT and FIX_PATTERN are workspace-scoped (DEC-054), FILE is
+            // repo-scoped, and `scopeOf` picks between them per type.
+            const scope = { repo, workspace: ctx.root.workspace };
+            // A record for another repository is not this batch's business. The
+            // structural refusal `applyConfirmedFacts` makes for the same reason:
+            // never an inference about a second case.
+            const mine = options.incidents.filter((i) => i.repo === repo);
+            const nodes = [];
+            const edges = [];
+            const unresolved = [];
+            const touched = new Set();
+            for (const incident of mine)
+                for (const path of incident.files)
+                    touched.add(path);
+            const sourceFiles = [...touched].sort();
+            for (const path of sourceFiles) {
+                nodes.push({
+                    id: nodeId(scope, "FILE", fileQsp(path), null),
+                    type: "FILE",
+                    name: path.split("/").pop() ?? path,
+                    file: path,
+                    range: null,
+                    // A developer naming a path says nothing about what language it is
+                    // written in, and guessing from the extension would be a language
+                    // decision made where none may be made (DEC-026).
+                    language: null,
+                    producedBy: PRODUCED_BY,
+                    resolution: 0,
+                    attrs: {},
+                });
+            }
+            for (const incident of mine) {
+                const incidentId = confirmedIncidentId(scope, incident);
+                nodes.push({
+                    id: incidentId,
+                    type: "INCIDENT",
+                    name: incident.summary.slice(0, 120),
+                    file: null,
+                    range: null,
+                    language: null,
+                    producedBy: PRODUCED_BY,
+                    resolution: 0,
+                    attrs: {
+                        // The record's own shape decides this, never the caller: a run id
+                        // is present exactly when a run witnessed the failure, and absent
+                        // exactly when a person asserted it.
+                        detectedVia: incident.observedInRun === undefined ? "developer-confirmed" : "runtime-observed",
+                        ...(incident.observedInRun === undefined ? {} : { observedInRun: incident.observedInRun }),
+                        confirmedBy: incident.confirmedBy,
+                        confirmedAt: incident.confirmedAt,
+                        // The message-similarity signal's real input, which until now had
+                        // only a commit subject line to work with.
+                        ...(incident.errorText === undefined ? {} : { errorText: incident.errorText }),
+                        ...(incident.fixedAtCommit === undefined ? {} : { fixedAtCommit: incident.fixedAtCommit }),
+                    },
+                });
+                for (const path of [...new Set(incident.files)].sort()) {
+                    edges.push({
+                        from: incidentId,
+                        to: nodeId(scope, "FILE", fileQsp(path), null),
+                        type: "INCIDENT_CORRELATED",
+                        resolution: 0,
+                        confidence: 1,
+                        producedBy: PRODUCED_BY,
+                        attrs: {
+                            detectedVia: incident.observedInRun === undefined ? "developer-confirmed" : "runtime-observed",
+                        },
+                    });
+                }
+                // Only when the record names one. "A defect existed" and "this commit
+                // fixed it" are separate claims and only the second licenses this edge.
+                if (incident.fixedAtCommit === undefined)
+                    continue;
+                const fixId = nodeId(scope, "FIX_PATTERN", incident.fixedAtCommit, null);
+                nodes.push({
+                    id: fixId,
+                    type: "FIX_PATTERN",
+                    name: `fix for: ${incident.summary}`.slice(0, 120),
+                    file: null,
+                    range: null,
+                    language: null,
+                    producedBy: PRODUCED_BY,
+                    resolution: 0,
+                    attrs: {
+                        commitSha: incident.fixedAtCommit,
+                        detectedVia: incident.observedInRun === undefined ? "developer-confirmed" : "runtime-observed",
+                    },
+                });
+                edges.push({
+                    from: incidentId,
+                    to: fixId,
+                    type: "FIXED_BY",
+                    resolution: 0,
+                    confidence: 1,
+                    producedBy: PRODUCED_BY,
+                    attrs: {
+                        detectedVia: incident.observedInRun === undefined ? "developer-confirmed" : "runtime-observed",
+                    },
+                });
+            }
+            // Deterministic: two projections of the same records must produce a
+            // byte-identical batch, or the store's content hash moves for no reason.
+            nodes.sort((a, b) => a.id.localeCompare(b.id));
+            edges.sort((a, b) => `${a.from}${a.to}${a.type}`.localeCompare(`${b.from}${b.to}${b.type}`));
+            return Promise.resolve({
+                repo,
+                ...(scope.workspace === undefined ? {} : { workspace: scope.workspace }),
+                commitSha: ctx.root.commitSha,
+                producedBy: PRODUCED_BY,
+                sourceFiles,
+                skippedFiles: [],
+                // R0. A person's sentence is not a resolution level at all — the
+                // reliability consequence lives in `humanAsserted` (DEC-223), a second
+                // and independent ceiling, and slotting testimony into the R0–R4 ladder
+                // to express it would be the overclaim that ladder exists to prevent.
+                reachedResolution: 0,
+                nodes,
+                edges,
+                unresolved,
+            });
+        },
+    };
+}
+//# sourceMappingURL=incidents.js.map

package/dist/sources/confirmed/incidents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"incidents.js","sourceRoot":"","sources":["../../../src/sources/confirmed/incidents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACL,OAAO,EACP,MAAM,GASP,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,4BAA4B,GAAG,qBAAqB,CAAC;AAClE,MAAM,CAAC,MAAM,iCAAiC,GAAG,OAAO,CAAC;AACzD,MAAM,WAAW,GAAG,GAAG,4BAA4B,IAAI,iCAAiC,EAAE,CAAC;AAQ3F,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,KAAoB,EAAE,QAA2B;IACnF,OAAO,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAuC;IACnF,OAAO;QACL,EAAE,EAAE,4BAA4B;QAChC,OAAO,EAAE,iCAAiC;QAE1C,IAAI,CAAC,GAAoB;YACvB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3C,mEAAmE;YACnE,0DAA0D;YAC1D,MAAM,KAAK,GAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAErE,oEAAoE;YACpE,sEAAsE;YACtE,0CAA0C;YAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAE9D,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAoB,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;YAElC,KAAK,MAAM,QAAQ,IAAI,IAAI;gBAAE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClF,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAExC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;oBAC9C,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI;oBACnC,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI;oBACX,mEAAmE;oBACnE,kEAAkE;oBAClE,kDAAkD;oBAClD,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,WAAW;oBACvB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;YACL,CAAC;YAED,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBACxD,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,UAAU;oBACd,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACpC,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI;oBACX,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,WAAW;oBACvB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE;wBACL,kEAAkE;wBAClE,kEAAkE;wBAClE,qCAAqC;wBACrC,WAAW,EAAE,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,kBAAkB;wBAC9F,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;wBAC1F,WAAW,EAAE,QAAQ,CAAC,WAAW;wBACjC,WAAW,EAAE,QAAQ,CAAC,WAAW;wBACjC,kEAAkE;wBAClE,2CAA2C;wBAC3C,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;wBAC9E,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;qBAC3F;iBACF,CAAC,CAAC;gBAEH,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;oBACvD,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,UAAU;wBAChB,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;wBAC9C,IAAI,EAAE,qBAAqB;wBAC3B,UAAU,EAAE,CAAC;wBACb,UAAU,EAAE,CAAC;wBACb,UAAU,EAAE,WAAW;wBACvB,KAAK,EAAE;4BACL,WAAW,EACT,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,kBAAkB;yBACpF;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,sEAAsE;gBACtE,wEAAwE;gBACxE,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS;oBAAE,SAAS;gBACnD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;gBACzE,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,YAAY,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBAClD,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI;oBACX,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,WAAW;oBACvB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE;wBACL,SAAS,EAAE,QAAQ,CAAC,aAAa;wBACjC,WAAW,EACT,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,kBAAkB;qBACpF;iBACF,CAAC,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,UAAU;oBAChB,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,UAAU;oBAChB,UAAU,EAAE,CAAC;oBACb,UAAU,EAAE,CAAC;oBACb,UAAU,EAAE,WAAW;oBACvB,KAAK,EAAE;wBACL,WAAW,EACT,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,kBAAkB;qBACpF;iBACF,CAAC,CAAC;YACL,CAAC;YAED,oEAAoE;YACpE,yEAAyE;YACzE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAE7F,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,IAAI;gBACJ,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBACxE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS;gBAC7B,UAAU,EAAE,WAAW;gBACvB,WAAW;gBACX,YAAY,EAAE,EAAE;gBAChB,iEAAiE;gBACjE,uEAAuE;gBACvE,wEAAwE;gBACxE,sEAAsE;gBACtE,iBAAiB,EAAE,CAAC;gBACpB,KAAK;gBACL,KAAK;gBACL,UAAU;aACX,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/sources/confirmed/index.d.ts

@@ -0,0 +1,3 @@
+export { createConfirmedIncidentSource, confirmedIncidentId, CONFIRMED_INCIDENT_SOURCE_ID, CONFIRMED_INCIDENT_SOURCE_VERSION, } from "./incidents.ts";
+export type { ConfirmedIncidentSourceOptions } from "./incidents.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/sources/confirmed/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sources/confirmed/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACnB,4BAA4B,EAC5B,iCAAiC,GAClC,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/sources/confirmed/index.js

@@ -0,0 +1,2 @@
+export { createConfirmedIncidentSource, confirmedIncidentId, CONFIRMED_INCIDENT_SOURCE_ID, CONFIRMED_INCIDENT_SOURCE_VERSION, } from "./incidents.js";
+//# sourceMappingURL=index.js.map

package/dist/sources/confirmed/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/sources/confirmed/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACnB,4BAA4B,EAC5B,iCAAiC,GAClC,MAAM,gBAAgB,CAAC"}

package/dist/sources/git/diff.d.ts

@@ -12,6 +12,13 @@
  * rather than silently shrinking the reply — the empty-denominator rule
  * applies to a dropped patch exactly as it does to a dropped finding.
  *
+ * Two size caps, because one of them bounds nothing on its own:
+ * `maxPatchBytes` per file, and `maxTotalPatchBytes` across the whole reply.
+ * The second exists because a real 48-file branch diff, with 44 patches each
+ * *under* the per-file cap, summed to 229KB and hard-failed the call — the
+ * reply never reached the caller at all, which is the one failure mode a
+ * disclosure cannot repair after the fact.
+ *
  * One `git diff` invocation for every file at once, not one per file — a
  * PR touching fifty files would otherwise spawn fifty processes. The output
  * is a concatenation of per-file blocks, each beginning with a line
@@ -23,6 +30,12 @@
  * own regex — an accepted, narrow gap, not a silent one, since every other
  * line used here does not share it).
  */
+/**
+ * The stable prefix of `patchOmittedReason` when the *total* budget, not the
+ * per-file cap, is what withheld a patch. Exported so a caller can tell the
+ * two apart without matching on prose it does not own.
+ */
+export declare const TOTAL_PATCH_BUDGET_REASON_PREFIX = "the reply's total patch budget";
 export interface GitDiffFile {
     /** Path as it is known after the change (the only path for A/M/D). */
     readonly path: string;
@@ -43,6 +56,11 @@ export interface GitDiffOptions {
     readonly files?: readonly string[];
     /** A file's patch is omitted (stats are still reported) above this many bytes. Default 20,000. */
     readonly maxPatchBytes?: number;
+    /**
+     * The cap on the sum of all returned patches. Files past it keep their
+     * stats and name the budget as the reason. Default 80,000.
+     */
+    readonly maxTotalPatchBytes?: number;
 }
 /**
  * `base...head` (three dots), matching `changedFiles`'s own reasoning: two

package/dist/sources/git/diff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../../src/sources/git/diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAwBH,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iFAAiF;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,kGAAkG;IAClG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AA8GD;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,SAAS,EACb,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAEjC;AAED,MAAM,WAAW,yBAA0B,SAAQ,cAAc;IAC/D;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,KAAK,CAAC;CAChD;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAIjC"}
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../../src/sources/git/diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAkCH;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,mCAAmC,CAAC;AAEjF,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iFAAiF;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,kGAAkG;IAClG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AA6HD;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,SAAS,EACb,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAEjC;AAED,MAAM,WAAW,yBAA0B,SAAQ,cAAc;IAC/D;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,KAAK,CAAC;CAChD;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAIjC"}

package/dist/sources/git/diff.js

@@ -12,6 +12,13 @@
  * rather than silently shrinking the reply — the empty-denominator rule
  * applies to a dropped patch exactly as it does to a dropped finding.
  *
+ * Two size caps, because one of them bounds nothing on its own:
+ * `maxPatchBytes` per file, and `maxTotalPatchBytes` across the whole reply.
+ * The second exists because a real 48-file branch diff, with 44 patches each
+ * *under* the per-file cap, summed to 229KB and hard-failed the call — the
+ * reply never reached the caller at all, which is the one failure mode a
+ * disclosure cannot repair after the fact.
+ *
  * One `git diff` invocation for every file at once, not one per file — a
  * PR touching fifty files would otherwise spawn fifty processes. The output
  * is a concatenation of per-file blocks, each beginning with a line
@@ -25,6 +32,7 @@
  */
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { applySerializedSizeBudget } from "../../budget/index.js";
 import { cleanGitEnv } from "./env.js";
 const execFileAsync = promisify(execFile);
 // Always strips GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE/GIT_COMMON_DIR — see env.ts.
@@ -36,6 +44,20 @@ function run(command, args, options) {
     });
 }
 const DEFAULT_MAX_PATCH_BYTES = 20_000;
+/**
+ * The cap on the sum of every returned patch. A per-file cap bounds no total:
+ * 44 files each under the 20,000-byte per-file cap summed to 229KB and
+ * hard-failed an ordinary 48-file branch diff before the reply was ever
+ * returned. A starting value, not a measurement — roughly 20k tokens of
+ * patch text, leaving a caller's context room for the answer built on it.
+ */
+const DEFAULT_MAX_TOTAL_PATCH_BYTES = 80_000;
+/**
+ * The stable prefix of `patchOmittedReason` when the *total* budget, not the
+ * per-file cap, is what withheld a patch. Exported so a caller can tell the
+ * two apart without matching on prose it does not own.
+ */
+export const TOTAL_PATCH_BUDGET_REASON_PREFIX = "the reply's total patch budget";
 function stripPrefix(path, prefix) {
     return path.startsWith(prefix) ? path.slice(prefix.length) : path;
 }
@@ -98,6 +120,7 @@ function parseDiffBlock(block) {
 }
 async function runGitDiff(cwd, revisionArgs, options) {
     const maxPatchBytes = options.maxPatchBytes ?? DEFAULT_MAX_PATCH_BYTES;
+    const maxTotalPatchBytes = options.maxTotalPatchBytes ?? DEFAULT_MAX_TOTAL_PATCH_BYTES;
     const args = ["diff", "-M", ...revisionArgs];
     if (options.files !== undefined && options.files.length > 0)
         args.push("--", ...options.files);
@@ -130,7 +153,20 @@ async function runGitDiff(cwd, revisionArgs, options) {
                     : null,
         });
     }
-    return files;
+    // The aggregate cap, applied after every per-file decision: a file whose
+    // patch was already withheld (binary, or over its own cap) costs nothing
+    // here and keeps the reason it already has.
+    return applySerializedSizeBudget(files, {
+        maxTotalBytes: maxTotalPatchBytes,
+        sizeOf: (f) => (f.patch === null ? 0 : Buffer.byteLength(f.patch, "utf8")),
+        withhold: (f, spentBytes) => ({
+            ...f,
+            patch: null,
+            patchOmittedReason: `${TOTAL_PATCH_BUDGET_REASON_PREFIX} of ${maxTotalPatchBytes} bytes was already spent ` +
+                `(${spentBytes} bytes on earlier files) — narrow "files" to this one, or raise ` +
+                '"maxTotalPatchBytes"',
+        }),
+    }).items;
 }
 /**
  * `base...head` (three dots), matching `changedFiles`'s own reasoning: two

package/dist/sources/git/diff.js.map

@@ -1 +1 @@
-{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../../src/sources/git/diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,kFAAkF;AAClF,SAAS,GAAG,CACV,OAAe,EACf,IAAuB,EACvB,OAA4C;IAE5C,OAAO,aAAa,CAAC,OAAO,EAAE,IAAgB,EAAE;QAC9C,GAAG,OAAO;QACV,QAAQ,EAAE,MAAe;QACzB,GAAG,EAAE,WAAW,EAAE;KACnB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAkCvC,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEnE,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC;aAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC;aAC3D,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACzC,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACzC,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,QAAQ;gBAAE,QAAQ,GAAG,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,WAAW;gBAAE,MAAM,GAAG,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC/D,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAErD,MAAM,MAAM,GAA0B,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAE3F,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;QAC1C,MAAM;QACN,MAAM;QACN,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACjC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KAClC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAW,EACX,YAA+B,EAC/B,OAAuB;IAEvB,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;IACvE,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAE/F,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IACjF,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACjD,MAAM,KAAK,GAAkB,EAAE,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,SAAS;QAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAE9B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,GAAG,aAAa,CAAC;QAExD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS;YAClD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS;YAClD,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;YAC9C,kBAAkB,EAAE,MAAM,CAAC,MAAM;gBAC/B,CAAC,CAAC,gCAAgC;gBAClC,CAAC,CAAC,OAAO;oBACP,CAAC,CAAC,yBAAyB,KAAK,oBAAoB,aAAa,qBAAqB;wBACpF,0DAA0D;oBAC5D,CAAC,CAAC,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,IAAY,EACZ,IAAI,GAAG,MAAM,EACb,UAA0B,EAAE;IAE5B,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,MAAM,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,UAAqC,EAAE;IAEvC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC;IAC1C,MAAM,YAAY,GAAG,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,OAAO,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../../src/sources/git/diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,kFAAkF;AAClF,SAAS,GAAG,CACV,OAAe,EACf,IAAuB,EACvB,OAA4C;IAE5C,OAAO,aAAa,CAAC,OAAO,EAAE,IAAgB,EAAE;QAC9C,GAAG,OAAO;QACV,QAAQ,EAAE,MAAe;QACzB,GAAG,EAAE,WAAW,EAAE;KACnB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,gCAAgC,CAAC;AAuCjF,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEnE,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC;aAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC;aAC3D,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACzC,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACzC,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,QAAQ;gBAAE,QAAQ,GAAG,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,WAAW;gBAAE,MAAM,GAAG,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC/D,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAErD,MAAM,MAAM,GAA0B,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAE3F,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;QAC1C,MAAM;QACN,MAAM;QACN,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACjC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KAClC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAW,EACX,YAA+B,EAC/B,OAAuB;IAEvB,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;IACvE,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,6BAA6B,CAAC;IACvF,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAE/F,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IACjF,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACjD,MAAM,KAAK,GAAkB,EAAE,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,SAAS;QAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAE9B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,GAAG,aAAa,CAAC;QAExD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS;YAClD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS;YAClD,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;YAC9C,kBAAkB,EAAE,MAAM,CAAC,MAAM;gBAC/B,CAAC,CAAC,gCAAgC;gBAClC,CAAC,CAAC,OAAO;oBACP,CAAC,CAAC,yBAAyB,KAAK,oBAAoB,aAAa,qBAAqB;wBACpF,0DAA0D;oBAC5D,CAAC,CAAC,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,4CAA4C;IAC5C,OAAO,yBAAyB,CAAC,KAAK,EAAE;QACtC,aAAa,EAAE,kBAAkB;QACjC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1E,QAAQ,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;YAC5B,GAAG,CAAC;YACJ,KAAK,EAAE,IAAI;YACX,kBAAkB,EAChB,GAAG,gCAAgC,OAAO,kBAAkB,2BAA2B;gBACvF,IAAI,UAAU,kEAAkE;gBAChF,sBAAsB;SACzB,CAAC;KACH,CAAC,CAAC,KAAK,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,IAAY,EACZ,IAAI,GAAG,MAAM,EACb,UAA0B,EAAE;IAE5B,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,MAAM,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,UAAqC,EAAE;IAEvC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC;IAC1C,MAAM,YAAY,GAAG,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,OAAO,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC"}

package/dist/sources/git/incidents.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Which commits in a history describe a failure, and how we know.
+ *
+ * Split out of `source.ts` when the answer stopped being one regex. The git
+ * source minted an `INCIDENT` for exactly one thing — a commit body carrying
+ * `This reverts commit <40 hex>` — and that produced **zero** incidents across
+ * three measured repositories (734/459/203 commits) and two in a real product
+ * repository. `similarIncidents` was therefore built, tested, correct and
+ * starved: its recall is not 0%, it is not computable, because it has never
+ * been given a real incident to find.
+ *
+ * ## The rule every mechanism here answers to
+ *
+ * `INCIDENT` is an EARNED node (DEC-017). It is never dropped, it survives
+ * every rebuild, and `INCIDENT_CORRELATED` biases diff-scoping traversal toward
+ * the files it names for as long as the store exists. A wrong incident is not a
+ * bad answer that a later run corrects — it is unrecoverable pollution in the
+ * one table that cannot be recomputed away. So:
+ *
+ * **Every mechanism rests on something a person declared. None rests on
+ * something Descry inferred.**
+ *
+ * A revert trailer is written by `git revert`. A `Revert "…"` subject is typed
+ * by a person or by GitHub's own button on their behalf. `Fixes #123` is a
+ * developer stating that something was broken and this commit fixed it. What is
+ * deliberately *not* here is any reading of "fix", "hotfix" or "bug" in prose —
+ * the original mechanism's own comment says why, and it applies unchanged to
+ * every mechanism added since: matching on the word "fix" would classify
+ * ordinary work as an incident.
+ *
+ * ## Refusals, not guesses
+ *
+ * A `Revert "X"` naming a subject this history does not contain, or containing
+ * twice, produces a `DetectedRefusal` rather than a ranked guess. Two candidates
+ * is a genuine ambiguity and picking the nearer one would be recency standing in
+ * for evidence — the same discipline every resolver in this project follows.
+ *
+ * See `DEC-NEXT-incident-minting-beyond-explicit-reverts`.
+ */
+import type { Commit } from "./history.ts";
+/**
+ * How an incident was established. Written to `attrs.detectedVia` on the
+ * `INCIDENT` node and on its `FIXED_BY` edge, so a consumer can tell a
+ * machine-written trailer from a developer's typed sentence.
+ */
+export type IncidentMechanism = "explicit-revert" | "manual-revert" | "issue-reference";
+export interface DetectedIncident {
+    readonly mechanism: IncidentMechanism;
+    /** The commit that resolved it. Always a real commit in the history read. */
+    readonly fix: Commit;
+    /**
+     * The commit that broke it, for the mechanisms that name one.
+     *
+     * `null` for `issue-reference`, where no bad commit is named at all — the
+     * incident is the issue, and that is a different shape rather than a missing
+     * field.
+     */
+    readonly incidentCommit: Commit | null;
+    /** `#123`, for `issue-reference`. `null` for the revert mechanisms. */
+    readonly issueRef: string | null;
+    /**
+     * The files to correlate the incident with, already deduplicated and sorted.
+     *
+     * For a revert these are the files the *reverted* commit touched — where the
+     * defect was. For an issue reference there is no such commit, so they are the
+     * files the *fix* touched, which is the same claim reached from the other
+     * side: this is where the broken code lived.
+     */
+    readonly correlatedPaths: readonly string[];
+}
+/** A revert whose target could not be established. Disclosed, never dropped. */
+export interface DetectedRefusal {
+    readonly fixSha: string;
+    /** The subject the revert quoted. */
+    readonly rawTarget: string;
+    readonly reason: string;
+}
+/**
+ * A revert trailer naming a sha this history does not contain.
+ *
+ * Not a refusal yet, and the distinction is load-bearing: `readHistory` reads
+ * HEAD-reachable, non-merge commits within a window, and a squash-merged or
+ * branch-deleted target is genuinely absent from that view while still being
+ * present in the object database. The caller holds the git process and can go
+ * look; this function is synchronous and cannot. Resolved out of band by
+ * `source.ts`, and only *then* refused if the object is really gone.
+ */
+export interface UnresolvedTrailer {
+    readonly fix: Commit;
+    readonly revertedSha: string;
+}
+export interface IncidentDetection {
+    readonly incidents: readonly DetectedIncident[];
+    readonly refusals: readonly DetectedRefusal[];
+    readonly unresolvedTrailers: readonly UnresolvedTrailer[];
+}
+/** `git revert` writes this. Machine-generated, and the strongest signal available. */
+declare const REVERT_TRAILER: RegExp;
+/**
+ * Every incident this history declares, plus every revert whose target it does
+ * not contain.
+ *
+ * `commits` is the history as `readHistory` returns it — newest first. Order is
+ * not relied on for correctness: a revert's target is found by timestamp, so
+ * the result is identical for any permutation of the same commits.
+ */
+export declare function detectIncidents(commits: readonly Commit[]): IncidentDetection;
+export { REVERT_TRAILER };
+//# sourceMappingURL=incidents.d.ts.map

package/dist/sources/git/incidents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"incidents.d.ts","sourceRoot":"","sources":["../../../src/sources/git/incidents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAExF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC3D;AAED,uFAAuF;AACvF,QAAA,MAAM,cAAc,QAAuC,CAAC;AAkD5D;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CAgG7E;AAED,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/sources/git/incidents.js

@@ -0,0 +1,187 @@
+/**
+ * Which commits in a history describe a failure, and how we know.
+ *
+ * Split out of `source.ts` when the answer stopped being one regex. The git
+ * source minted an `INCIDENT` for exactly one thing — a commit body carrying
+ * `This reverts commit <40 hex>` — and that produced **zero** incidents across
+ * three measured repositories (734/459/203 commits) and two in a real product
+ * repository. `similarIncidents` was therefore built, tested, correct and
+ * starved: its recall is not 0%, it is not computable, because it has never
+ * been given a real incident to find.
+ *
+ * ## The rule every mechanism here answers to
+ *
+ * `INCIDENT` is an EARNED node (DEC-017). It is never dropped, it survives
+ * every rebuild, and `INCIDENT_CORRELATED` biases diff-scoping traversal toward
+ * the files it names for as long as the store exists. A wrong incident is not a
+ * bad answer that a later run corrects — it is unrecoverable pollution in the
+ * one table that cannot be recomputed away. So:
+ *
+ * **Every mechanism rests on something a person declared. None rests on
+ * something Descry inferred.**
+ *
+ * A revert trailer is written by `git revert`. A `Revert "…"` subject is typed
+ * by a person or by GitHub's own button on their behalf. `Fixes #123` is a
+ * developer stating that something was broken and this commit fixed it. What is
+ * deliberately *not* here is any reading of "fix", "hotfix" or "bug" in prose —
+ * the original mechanism's own comment says why, and it applies unchanged to
+ * every mechanism added since: matching on the word "fix" would classify
+ * ordinary work as an incident.
+ *
+ * ## Refusals, not guesses
+ *
+ * A `Revert "X"` naming a subject this history does not contain, or containing
+ * twice, produces a `DetectedRefusal` rather than a ranked guess. Two candidates
+ * is a genuine ambiguity and picking the nearer one would be recency standing in
+ * for evidence — the same discipline every resolver in this project follows.
+ *
+ * See `DEC-NEXT-incident-minting-beyond-explicit-reverts`.
+ */
+/** `git revert` writes this. Machine-generated, and the strongest signal available. */
+const REVERT_TRAILER = /This reverts commit ([0-9a-f]{40})/;
+/**
+ * `Revert "the original subject"` — the subject form, written by a person or by
+ * GitHub's Revert button, often with no sha anywhere in the commit.
+ *
+ * Anchored at the start and requiring the quotes: `Revert the auth change` is
+ * prose about what the commit does, not a reference to a specific commit, and
+ * reading it as one would be exactly the inference this module refuses to make.
+ */
+const REVERT_SUBJECT = /^Revert\s+"(.+)"\s*$/;
+/**
+ * A closed list of fix-shaped verbs, and only immediately before the reference.
+ *
+ * `Fixes #123` is a developer stating that something was broken. `See #123` and
+ * `Part of #124` are not — they relate a commit to an issue and say nothing
+ * about a defect. The verb is what carries the claim, so the verb is what is
+ * matched; a bare `#123` mints nothing.
+ *
+ * `GH-123` is GitHub's own cross-reference form and means the same thing.
+ */
+const ISSUE_VERBS = "fix|fixes|fixed|close|closes|closed|resolve|resolves|resolved";
+/** In the subject, anywhere: a subject is a claim about the commit itself. */
+const SUBJECT_ISSUE = new RegExp(`\\b(?:${ISSUE_VERBS})\\s+(?:#|GH-)(\\d+)\\b`, "gi");
+/**
+ * In the body, **only in trailer position** — the start of a line, with nothing
+ * but whitespace before it.
+ *
+ * Measured, not supposed. Run over this repository's own history, the
+ * anywhere-in-the-body form matched three commits, and all three were prose
+ * *about* the convention rather than uses of it: a sentence quoting
+ * `"Fixes #123"` as an example, and a bullet reading
+ * `- issue-reference: \`Fixes #123\` and its closed list…`. A commit message
+ * discussing the convention is not a commit message using it, and an EARNED
+ * node minted from one is permanent.
+ *
+ * The trailer position is where the convention actually lives — it is what
+ * GitHub's own tooling emits and what a template puts there — so this costs
+ * almost no real recall and removes a whole class of false positive. Rule 2:
+ * when in doubt, omit.
+ */
+const BODY_ISSUE = new RegExp(`^[ \\t]*(?:${ISSUE_VERBS})\\s+(?:#|GH-)(\\d+)\\b`, "gim");
+function pathsOf(commit) {
+    return [...new Set(commit.changes.map((c) => c.path))].sort();
+}
+/**
+ * Every incident this history declares, plus every revert whose target it does
+ * not contain.
+ *
+ * `commits` is the history as `readHistory` returns it — newest first. Order is
+ * not relied on for correctness: a revert's target is found by timestamp, so
+ * the result is identical for any permutation of the same commits.
+ */
+export function detectIncidents(commits) {
+    const incidents = [];
+    const refusals = [];
+    const unresolvedTrailers = [];
+    const bySha = new Map(commits.map((c) => [c.sha, c]));
+    const bySubject = new Map();
+    for (const commit of commits) {
+        const existing = bySubject.get(commit.subject);
+        if (existing === undefined)
+            bySubject.set(commit.subject, [commit]);
+        else
+            existing.push(commit);
+    }
+    for (const commit of commits) {
+        // The trailer first, and exclusively: `git revert` writes both the trailer
+        // and the `Revert "…"` subject, so reading the subject as an independent
+        // mechanism would mint one incident twice under two different names.
+        const revertedSha = REVERT_TRAILER.exec(commit.body)?.[1];
+        if (revertedSha !== undefined) {
+            const target = bySha.get(revertedSha);
+            if (target === undefined)
+                unresolvedTrailers.push({ fix: commit, revertedSha });
+            else {
+                incidents.push({
+                    mechanism: "explicit-revert",
+                    fix: commit,
+                    incidentCommit: target,
+                    issueRef: null,
+                    correlatedPaths: pathsOf(target),
+                });
+            }
+            continue;
+        }
+        const quoted = REVERT_SUBJECT.exec(commit.subject)?.[1];
+        if (quoted !== undefined) {
+            // Backwards only. A commit cannot revert something that had not happened
+            // when it was written, and a same-subject commit landing afterwards is a
+            // different commit that happens to share a name.
+            const candidates = (bySubject.get(quoted) ?? []).filter((c) => c.timestamp < commit.timestamp);
+            if (candidates.length === 1) {
+                const target = candidates[0];
+                incidents.push({
+                    mechanism: "manual-revert",
+                    fix: commit,
+                    incidentCommit: target,
+                    issueRef: null,
+                    correlatedPaths: pathsOf(target),
+                });
+            }
+            else if (candidates.length === 0) {
+                refusals.push({
+                    fixSha: commit.sha,
+                    rawTarget: quoted,
+                    reason: 'the commit quotes a subject it reverts, but no commit in the history read here has ' +
+                        "that subject — it may predate the read window, or live on a branch this read cannot see",
+                });
+            }
+            else {
+                refusals.push({
+                    fixSha: commit.sha,
+                    rawTarget: quoted,
+                    reason: `${candidates.length} commits share that subject, so the revert does not identify one. ` +
+                        "Choosing the nearest would be recency standing in for evidence",
+                });
+            }
+            continue;
+        }
+        // An issue reference is a claim about a *defect*, made by the person who
+        // fixed it. Read from the subject anywhere and from the body only in
+        // trailer position — see `BODY_ISSUE` for the three false positives that
+        // distinction was measured against.
+        const refs = new Set();
+        for (const match of commit.subject.matchAll(SUBJECT_ISSUE))
+            refs.add(`#${match[1]}`);
+        for (const match of commit.body.matchAll(BODY_ISSUE))
+            refs.add(`#${match[1]}`);
+        for (const issueRef of [...refs].sort()) {
+            incidents.push({
+                mechanism: "issue-reference",
+                fix: commit,
+                incidentCommit: null,
+                issueRef,
+                correlatedPaths: pathsOf(commit),
+            });
+        }
+    }
+    // Deterministic: two runs over the same history must produce a byte-identical
+    // batch, or the store's content hash moves for no reason.
+    incidents.sort((a, b) => a.fix.sha.localeCompare(b.fix.sha) || (a.issueRef ?? "").localeCompare(b.issueRef ?? ""));
+    refusals.sort((a, b) => a.fixSha.localeCompare(b.fixSha) || a.rawTarget.localeCompare(b.rawTarget));
+    unresolvedTrailers.sort((a, b) => a.fix.sha.localeCompare(b.fix.sha));
+    return { incidents, refusals, unresolvedTrailers };
+}
+export { REVERT_TRAILER };
+//# sourceMappingURL=incidents.js.map