@descryy/core 0.4.0 → 0.5.1

package/dist/sources/confirmed/incidents.js

@@ -1,38 +1,8 @@
-/**
- * The `IRSource` that projects developer-confirmed incidents into the graph.
- *
- * ## Why a source, and not a direct write
- *
- * A `ConfirmedIncident` lives in `.descry/config.json` because it is testimony
- * — a developer fixed something and said so, and no commit records that they
- * said it (see the type's own doc). But a store is derived data: DEC-017 drops
- * every derived table on a schema change and rebuilds from source. So a
- * confirmed incident written *only* into the graph would survive until the next
- * IR-version bump and then vanish, which is the failure the EARNED partition
- * exists to prevent — arriving through a writer that simply did not think about
- * it.
- *
- * Making this a source solves it by construction. The file is the record; the
- * graph is a projection of the record; every `analyze` re-projects. There is no
- * migration to write and no earned table to extend, and the same discipline
- * every other producer in this system already follows applies unchanged: a
- * batch in, `writeBatch` out, invalidation by producer id.
- *
- * ## Identity
- *
- * The `INCIDENT` node keys on `confirmed:<confirmedAt>:<summary>` — the moment
- * the developer said it, plus what they said. Deliberately **not** the file set:
- * node ids never contain a path (renames churn them and silently destroy
- * incident links), and a developer correcting the file list of an incident they
- * already recorded is editing one incident rather than creating a second.
- *
- * ## What it does not do
- *
- * It mints no `FIX_PATTERN` unless the record names a fixing commit, and it
- * never infers one from HEAD. "The developer confirmed an incident" and "the
- * developer confirmed which commit fixed it" are separate claims, and only the
- * second one licenses a `FIXED_BY` edge.
- */
+/** IRSource projecting developer-confirmed incidents (`.descry/config.json`)
+ *  into the graph. A source, not a direct write: a store is derived data
+ *  (DEC-017 drops it on schema bump), so a direct write would silently
+ *  vanish. `INCIDENT` keys on `confirmed:<at>:<summary>`, never the file
+ *  set (no paths in node ids). Mints `FIX_PATTERN` only when a commit is named — never inferred from HEAD. */
 import { fileQsp, nodeId, } from "@descryy/ir";
 export const CONFIRMED_INCIDENT_SOURCE_ID = "confirmed-incidents";
 export const CONFIRMED_INCIDENT_SOURCE_VERSION = "0.1.0";
@@ -50,9 +20,8 @@ export function createConfirmedIncidentSource(options) {
             // INCIDENT and FIX_PATTERN are workspace-scoped (DEC-054), FILE is
             // repo-scoped, and `scopeOf` picks between them per type.
             const scope = { repo, workspace: ctx.root.workspace };
-            // A record for another repository is not this batch's business. The
-            // structural refusal `applyConfirmedFacts` makes for the same reason:
-            // never an inference about a second case.
+            // A record for another repo is not this batch's business — same
+            // structural refusal `applyConfirmedFacts` makes: never infer across cases.
             const mine = options.incidents.filter((i) => i.repo === repo);
             const nodes = [];
             const edges = [];
@@ -69,9 +38,8 @@ export function createConfirmedIncidentSource(options) {
                     name: path.split("/").pop() ?? path,
                     file: path,
                     range: null,
-                    // A developer naming a path says nothing about what language it is
-                    // written in, and guessing from the extension would be a language
-                    // decision made where none may be made (DEC-026).
+                    // A path says nothing about language; guessing from extension would
+                    // be a language decision made where none may be made (DEC-026).
                     language: null,
                     producedBy: PRODUCED_BY,
                     resolution: 0,
@@ -90,9 +58,8 @@ export function createConfirmedIncidentSource(options) {
                     producedBy: PRODUCED_BY,
                     resolution: 0,
                     attrs: {
-                        // The record's own shape decides this, never the caller: a run id
-                        // is present exactly when a run witnessed the failure, and absent
-                        // exactly when a person asserted it.
+                        // The record's own shape decides this: a run id present means a
+                        // run witnessed it, absent means a person asserted it.
                         detectedVia: incident.observedInRun === undefined ? "developer-confirmed" : "runtime-observed",
                         ...(incident.observedInRun === undefined ? {} : { observedInRun: incident.observedInRun }),
                         confirmedBy: incident.confirmedBy,
@@ -158,10 +125,9 @@ export function createConfirmedIncidentSource(options) {
                 producedBy: PRODUCED_BY,
                 sourceFiles,
                 skippedFiles: [],
-                // R0. A person's sentence is not a resolution level at all — the
-                // reliability consequence lives in `humanAsserted` (DEC-223), a second
-                // and independent ceiling, and slotting testimony into the R0–R4 ladder
-                // to express it would be the overclaim that ladder exists to prevent.
+                // R0: a person's sentence isn't a resolution level. The reliability
+                // consequence lives in `humanAsserted` (DEC-223), a separate ceiling —
+                // slotting testimony into R0-R4 would be the overclaim the ladder prevents.
                 reachedResolution: 0,
                 nodes,
                 edges,

package/dist/sources/confirmed/incidents.js.map

@@ -1 +1 @@
-{"version":3,"file":"incidents.js","sourceRoot":"","sources":["../../../src/sources/confirmed/incidents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACL,OAAO,EACP,MAAM,GASP,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,4BAA4B,GAAG,qBAAqB,CAAC;AAClE,MAAM,CAAC,MAAM,iCAAiC,GAAG,OAAO,CAAC;AACzD,MAAM,WAAW,GAAG,GAAG,4BAA4B,IAAI,iCAAiC,EAAE,CAAC;AAQ3F,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,KAAoB,EAAE,QAA2B;IACnF,OAAO,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAuC;IACnF,OAAO;QACL,EAAE,EAAE,4BAA4B;QAChC,OAAO,EAAE,iCAAiC;QAE1C,IAAI,CAAC,GAAoB;YACvB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3C,mEAAmE;YACnE,0DAA0D;YAC1D,MAAM,KAAK,GAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAErE,oEAAoE;YACpE,sEAAsE;YACtE,0CAA0C;YAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAE9D,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAoB,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;YAElC,KAAK,MAAM,QAAQ,IAAI,IAAI;gBAAE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClF,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAExC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;oBAC9C,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI;oBACnC,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI;oBACX,mEAAmE;oBACnE,kEAAkE;oBAClE,kDAAkD;oBAClD,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,WAAW;oBACvB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;YACL,CAAC;YAED,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBACxD,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,UAAU;oBACd,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACpC,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI;oBACX,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,WAAW;oBACvB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE;wBACL,kEAAkE;wBAClE,kEAAkE;wBAClE,qCAAqC;wBACrC,WAAW,EAAE,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,kBAAkB;wBAC9F,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;wBAC1F,WAAW,EAAE,QAAQ,CAAC,WAAW;wBACjC,WAAW,EAAE,QAAQ,CAAC,WAAW;wBACjC,kEAAkE;wBAClE,2CAA2C;wBAC3C,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;wBAC9E,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;qBAC3F;iBACF,CAAC,CAAC;gBAEH,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;oBACvD,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,UAAU;wBAChB,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;wBAC9C,IAAI,EAAE,qBAAqB;wBAC3B,UAAU,EAAE,CAAC;wBACb,UAAU,EAAE,CAAC;wBACb,UAAU,EAAE,WAAW;wBACvB,KAAK,EAAE;4BACL,WAAW,EACT,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,kBAAkB;yBACpF;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,sEAAsE;gBACtE,wEAAwE;gBACxE,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS;oBAAE,SAAS;gBACnD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;gBACzE,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,YAAY,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBAClD,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI;oBACX,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,WAAW;oBACvB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE;wBACL,SAAS,EAAE,QAAQ,CAAC,aAAa;wBACjC,WAAW,EACT,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,kBAAkB;qBACpF;iBACF,CAAC,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,UAAU;oBAChB,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,UAAU;oBAChB,UAAU,EAAE,CAAC;oBACb,UAAU,EAAE,CAAC;oBACb,UAAU,EAAE,WAAW;oBACvB,KAAK,EAAE;wBACL,WAAW,EACT,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,kBAAkB;qBACpF;iBACF,CAAC,CAAC;YACL,CAAC;YAED,oEAAoE;YACpE,yEAAyE;YACzE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAE7F,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,IAAI;gBACJ,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBACxE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS;gBAC7B,UAAU,EAAE,WAAW;gBACvB,WAAW;gBACX,YAAY,EAAE,EAAE;gBAChB,iEAAiE;gBACjE,uEAAuE;gBACvE,wEAAwE;gBACxE,sEAAsE;gBACtE,iBAAiB,EAAE,CAAC;gBACpB,KAAK;gBACL,KAAK;gBACL,UAAU;aACX,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"incidents.js","sourceRoot":"","sources":["../../../src/sources/confirmed/incidents.ts"],"names":[],"mappings":"AAAA;;;;8GAI8G;AAE9G,OAAO,EACL,OAAO,EACP,MAAM,GASP,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,4BAA4B,GAAG,qBAAqB,CAAC;AAClE,MAAM,CAAC,MAAM,iCAAiC,GAAG,OAAO,CAAC;AACzD,MAAM,WAAW,GAAG,GAAG,4BAA4B,IAAI,iCAAiC,EAAE,CAAC;AAQ3F,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,KAAoB,EAAE,QAA2B;IACnF,OAAO,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAuC;IACnF,OAAO;QACL,EAAE,EAAE,4BAA4B;QAChC,OAAO,EAAE,iCAAiC;QAE1C,IAAI,CAAC,GAAoB;YACvB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3C,mEAAmE;YACnE,0DAA0D;YAC1D,MAAM,KAAK,GAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAErE,gEAAgE;YAChE,4EAA4E;YAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAE9D,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAoB,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;YAElC,KAAK,MAAM,QAAQ,IAAI,IAAI;gBAAE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClF,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAExC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;oBAC9C,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI;oBACnC,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI;oBACX,oEAAoE;oBACpE,gEAAgE;oBAChE,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,WAAW;oBACvB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;YACL,CAAC;YAED,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBACxD,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,UAAU;oBACd,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACpC,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI;oBACX,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,WAAW;oBACvB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE;wBACL,gEAAgE;wBAChE,uDAAuD;wBACvD,WAAW,EAAE,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,kBAAkB;wBAC9F,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;wBAC1F,WAAW,EAAE,QAAQ,CAAC,WAAW;wBACjC,WAAW,EAAE,QAAQ,CAAC,WAAW;wBACjC,kEAAkE;wBAClE,2CAA2C;wBAC3C,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;wBAC9E,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;qBAC3F;iBACF,CAAC,CAAC;gBAEH,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;oBACvD,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,UAAU;wBAChB,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;wBAC9C,IAAI,EAAE,qBAAqB;wBAC3B,UAAU,EAAE,CAAC;wBACb,UAAU,EAAE,CAAC;wBACb,UAAU,EAAE,WAAW;wBACvB,KAAK,EAAE;4BACL,WAAW,EACT,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,kBAAkB;yBACpF;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,sEAAsE;gBACtE,wEAAwE;gBACxE,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS;oBAAE,SAAS;gBACnD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;gBACzE,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,YAAY,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBAClD,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI;oBACX,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,WAAW;oBACvB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE;wBACL,SAAS,EAAE,QAAQ,CAAC,aAAa;wBACjC,WAAW,EACT,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,kBAAkB;qBACpF;iBACF,CAAC,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,UAAU;oBAChB,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,UAAU;oBAChB,UAAU,EAAE,CAAC;oBACb,UAAU,EAAE,CAAC;oBACb,UAAU,EAAE,WAAW;oBACvB,KAAK,EAAE;wBACL,WAAW,EACT,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,kBAAkB;qBACpF;iBACF,CAAC,CAAC;YACL,CAAC;YAED,oEAAoE;YACpE,yEAAyE;YACzE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAE7F,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,IAAI;gBACJ,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBACxE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS;gBAC7B,UAAU,EAAE,WAAW;gBACvB,WAAW;gBACX,YAAY,EAAE,EAAE;gBAChB,oEAAoE;gBACpE,uEAAuE;gBACvE,4EAA4E;gBAC5E,iBAAiB,EAAE,CAAC;gBACpB,KAAK;gBACL,KAAK;gBACL,UAAU;aACX,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/sources/git/diff.d.ts

@@ -1,48 +1,9 @@
 /**
- * `gitDiff` — a live textual diff between two refs. §18's `get_git_diff`.
- *
- * `changedFiles` (`history.ts`) already answers "which files changed" — a
- * bare path list. This answers "what changed in them" — per-file status and
- * line counts always, plus the actual unified-diff patch text when it is
- * cheap enough to hand to a model. §4's own worry ("the client's context
- * window is not yours to spend") is the reason a patch is never returned
- * unconditionally: a single large file rewrite can be tens of thousands of
- * tokens, and a caller that wanted only "did this file change and how much"
- * pays that cost with no way to decline it. `patchOmittedReason` names why,
- * rather than silently shrinking the reply — the empty-denominator rule
- * applies to a dropped patch exactly as it does to a dropped finding.
- *
- * Two size caps here, because one of them bounds nothing on its own:
- * `maxPatchBytes` per file, and `maxTotalPatchBytes` across every patch in the
- * reply. The second exists because a real 48-file branch diff, with 44 patches
- * each *under* the per-file cap, summed to 229KB and hard-failed the call —
- * the reply never reached the caller at all, which is the one failure mode a
- * disclosure cannot repair after the fact.
- *
- * And a third above this file, for the same reason one level out: the same
- * diff re-run with `maxTotalPatchBytes` correctly enforced still failed, at
- * 84,516 characters, because these two caps bound patch text and a reply is
- * not only patch text. `MAX_REPLY_BYTES` and `ToolAnswer.fitToBudget` in the
- * MCP layer bound the serialized reply itself. Nothing here needs to know
- * about that; it is noted because "the aggregate cap is enforced" was once
- * mistaken for "the call now succeeds," and they are different claims.
- *
- * One `git diff` invocation for every file at once, not one per file — a
- * PR touching fifty files would otherwise spawn fifty processes. The output
- * is a concatenation of per-file blocks, each beginning with a line
- * `diff --git a/<path> b/<path>`; parsing splits on that boundary and reads
- * the more specific `rename from`/`rename to`/`new file mode`/
- * `deleted file mode`/`Binary files … differ`/`---`/`+++` lines within each
- * block, which are unambiguous where the `diff --git` header line alone is
- * not (a path containing the literal substring `" b/"` defeats that header's
- * own regex — an accepted, narrow gap, not a silent one, since every other
- * line used here does not share it).
- */
-/**
- * The stable prefix of `patchOmittedReason` when the *total* budget, not the
- * per-file cap, is what withheld a patch. Exported so a caller can tell the
- * two apart without matching on prose it does not own.
+ * §18's `get_git_diff`: live diff, patch text only when cheap — `patchOmittedReason` names why otherwise.
+ * Two caps here (`maxPatchBytes` per file, `maxTotalPatchBytes` total) plus a third in the MCP layer
+ * (`MAX_REPLY_BYTES`) — measured real failures at 229KB and 84,516 chars before these existed.
  */
+/** Stable prefix of `patchOmittedReason` when the total budget, not the per-file cap, withheld a patch. */
 export declare const TOTAL_PATCH_BUDGET_REASON_PREFIX = "the reply's total patch budget";
 export interface GitDiffFile {
     /** Path as it is known after the change (the only path for A/M/D). */
@@ -64,35 +25,104 @@ export interface GitDiffOptions {
     readonly files?: readonly string[];
     /** A file's patch is omitted (stats are still reported) above this many bytes. Default 20,000. */
     readonly maxPatchBytes?: number;
-    /**
-     * The cap on the sum of all returned patches. Files past it keep their
-     * stats and name the budget as the reason. Default 40,000.
-     */
+    /** Cap on the sum of all returned patches; files past it keep their stats. Default 40,000. */
     readonly maxTotalPatchBytes?: number;
 }
+/** One contiguous run of added lines, in the new (head-side) file. 1-based, inclusive on both ends. */
+export interface LineRange {
+    readonly start: number;
+    readonly end: number;
+}
 /**
- * `base...head` (three dots), matching `changedFiles`'s own reasoning: two
- * dots would include everything changed on `base` since the branch point,
- * misattributing someone else's history to this diff.
+ * Which lines a unified-diff patch actually *added*, in new-file line numbers.
+ *
+ * C2 (UAT phase 4): `checkEnvironment`'s `NEW_READ_UNDECLARED` used to call any
+ * undeclared read in a `files`-scoped file "new", even a pre-existing read the
+ * diff never touched — this is what lets a caller ask the narrower, true
+ * question instead: is this line one the diff actually added?
+ *
+ * Parses the hunk headers (`@@ -a,b +c,d @@`) and walks each hunk counting the
+ * new-file line pointer: a `+` line claims the current pointer and advances it,
+ * a context line (or blank) advances the pointer without claiming a line, and a
+ * `-` line does neither — it consumes no new-file line — but does end any run
+ * of consecutive additions in progress, so an added block interrupted by a
+ * removed line reports as two ranges, not one spanning the gap. Takes the raw
+ * `patch` text `GitDiffFile` already carries; a `null` patch (binary, or
+ * withheld by a size budget) has nothing to parse and is the caller's problem
+ * to ask for separately — this function only ever sees text that exists.
  */
+export declare function addedLineRanges(patch: string): readonly LineRange[];
+/** `base...head` (three dots) — two dots would include everything changed on `base` since the branch point. */
 export declare function gitDiff(cwd: string, base: string, head?: string, options?: GitDiffOptions): Promise<readonly GitDiffFile[]>;
 export interface GitWorkingTreeDiffOptions extends GitDiffOptions {
-    /**
-     * `"unstaged"` (default) — the working tree against the index (`git diff -M`),
-     * i.e. edits not yet `git add`-ed.
-     * `"staged"` — the index against `HEAD` (`git diff -M --cached`), i.e. what
-     * a commit right now would contain.
-     * `"all"` — the working tree against `HEAD` (`git diff -M HEAD`), staged and
-     * unstaged combined — everything not yet committed.
-     */
+    /** `"unstaged"` (default): tree vs. index. `"staged"`: index vs. HEAD. `"all"`: tree vs. HEAD (both). */
     readonly scope?: "unstaged" | "staged" | "all";
 }
 /**
- * The working-tree counterpart to {@link gitDiff}: a live diff against
- * uncommitted state, which no two-revision form of `git diff` can express
- * (`HEAD...HEAD` is empty by construction). Reuses the exact same block
- * parser, rename detection and patch cap `gitDiff` does — see
- * `DEC-NEXT-working-tree-diff-in-core` for why a second parser was rejected.
+ * Working-tree counterpart to {@link gitDiff}: a live diff against uncommitted state, which no
+ * two-revision `git diff` form can express. Reuses the same parser (`DEC-NEXT-working-tree-diff-in-core`).
  */
 export declare function gitWorkingTreeDiff(cwd: string, options?: GitWorkingTreeDiffOptions): Promise<readonly GitDiffFile[]>;
+export interface GitWorkingTreeChangeOptions extends GitWorkingTreeDiffOptions {
+    /**
+     * Include files git has never seen, as new-file patches.
+     *
+     * **Off by default**, so no existing caller changes behaviour by upgrading,
+     * and because it is a different question: the three scopes above all ask
+     * about files git already tracks.
+     */
+    readonly includeUntracked?: boolean;
+    /** Cap on untracked files diffed. The real count is reported regardless. */
+    readonly maxUntracked?: number;
+    /**
+     * Directory prefixes whose contents are not the change under review.
+     *
+     * The same argument as `--exclude-standard`, for state a `.gitignore` does not
+     * happen to cover. Descry writes its own graph database inside the repository
+     * and nothing gitignores it, so the first working-tree answer on a fresh
+     * checkout listed that database and its two SQLite sidecars as the
+     * developer's uncommitted change — three files they did not write, at the top
+     * of an answer about what they did.
+     *
+     * Matched as a path prefix at a segment boundary, so `.descry` excludes
+     * `.descry/graph.db` and not `src/.descryfile.ts`.
+     */
+    readonly exclude?: readonly string[];
+}
+export interface GitWorkingTreeChange {
+    readonly files: readonly GitDiffFile[];
+    /** Untracked files found, before any cap. */
+    readonly untrackedTotal: number;
+    /** True when the cap kept some of them out of `files`. */
+    readonly untrackedTruncated: boolean;
+}
+/**
+ * The working tree as a change set, including files git has never seen.
+ *
+ * ## Why untracked needs its own mechanism
+ *
+ * No form of `git diff` reports an untracked file. `git diff HEAD` compares
+ * against what the index and `HEAD` hold, and a file git has never seen is in
+ * neither — so a working-tree mode built on the scopes above alone still misses
+ * the most common shape of work in progress: a new file, written, not yet
+ * added. That is exactly the case this was built for.
+ *
+ * ## `--no-index` rather than `add -N`
+ *
+ * The usual trick is `git add -N` to give the file an intent-to-add entry, then
+ * diff normally. **It writes to the index**, and a read tool that mutates the
+ * caller's repository to answer a question is not a read tool — it would also
+ * race any real `git add` the developer runs while it works.
+ *
+ * `git diff --no-index -- /dev/null <path>` needs no index and emits exactly the
+ * `new file mode` block the shared parser already handles, with the real path.
+ * It exits non-zero when the files differ, which for this call is always, so a
+ * non-zero exit here is the success case and is read for its stdout.
+ *
+ * ## `--exclude-standard` is load-bearing
+ *
+ * Without it the first answer on any real repository is a dependency directory
+ * reported as the developer's uncommitted work.
+ */
+export declare function gitWorkingTreeChange(cwd: string, options?: GitWorkingTreeChangeOptions): Promise<GitWorkingTreeChange>;
 //# sourceMappingURL=diff.d.ts.map

package/dist/sources/git/diff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../../src/sources/git/diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AA2CH;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,mCAAmC,CAAC;AAEjF,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iFAAiF;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,kGAAkG;IAClG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAmID;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,SAAS,EACb,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAEjC;AAED,MAAM,WAAW,yBAA0B,SAAQ,cAAc;IAC/D;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,KAAK,CAAC;CAChD;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAIjC"}
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../../src/sources/git/diff.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA4BH,2GAA2G;AAC3G,eAAO,MAAM,gCAAgC,mCAAmC,CAAC;AAEjF,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iFAAiF;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,kGAAkG;IAClG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AA+HD,uGAAuG;AACvG,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,SAAS,EAAE,CA4CnE;AAED,+GAA+G;AAC/G,wBAAsB,OAAO,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,SAAS,EACb,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAEjC;AAED,MAAM,WAAW,yBAA0B,SAAQ,cAAc;IAC/D,yGAAyG;IACzG,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,KAAK,CAAC;CAChD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAIjC;AAKD,MAAM,WAAW,2BAA4B,SAAQ,yBAAyB;IAC5E;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,6CAA6C;IAC7C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,0DAA0D;IAC1D,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,oBAAoB,CAAC,CA6C/B"}

package/dist/sources/git/diff.js

@@ -1,79 +1,25 @@
 /**
- * `gitDiff` — a live textual diff between two refs. §18's `get_git_diff`.
- *
- * `changedFiles` (`history.ts`) already answers "which files changed" — a
- * bare path list. This answers "what changed in them" — per-file status and
- * line counts always, plus the actual unified-diff patch text when it is
- * cheap enough to hand to a model. §4's own worry ("the client's context
- * window is not yours to spend") is the reason a patch is never returned
- * unconditionally: a single large file rewrite can be tens of thousands of
- * tokens, and a caller that wanted only "did this file change and how much"
- * pays that cost with no way to decline it. `patchOmittedReason` names why,
- * rather than silently shrinking the reply — the empty-denominator rule
- * applies to a dropped patch exactly as it does to a dropped finding.
- *
- * Two size caps here, because one of them bounds nothing on its own:
- * `maxPatchBytes` per file, and `maxTotalPatchBytes` across every patch in the
- * reply. The second exists because a real 48-file branch diff, with 44 patches
- * each *under* the per-file cap, summed to 229KB and hard-failed the call —
- * the reply never reached the caller at all, which is the one failure mode a
- * disclosure cannot repair after the fact.
- *
- * And a third above this file, for the same reason one level out: the same
- * diff re-run with `maxTotalPatchBytes` correctly enforced still failed, at
- * 84,516 characters, because these two caps bound patch text and a reply is
- * not only patch text. `MAX_REPLY_BYTES` and `ToolAnswer.fitToBudget` in the
- * MCP layer bound the serialized reply itself. Nothing here needs to know
- * about that; it is noted because "the aggregate cap is enforced" was once
- * mistaken for "the call now succeeds," and they are different claims.
- *
- * One `git diff` invocation for every file at once, not one per file — a
- * PR touching fifty files would otherwise spawn fifty processes. The output
- * is a concatenation of per-file blocks, each beginning with a line
- * `diff --git a/<path> b/<path>`; parsing splits on that boundary and reads
- * the more specific `rename from`/`rename to`/`new file mode`/
- * `deleted file mode`/`Binary files … differ`/`---`/`+++` lines within each
- * block, which are unambiguous where the `diff --git` header line alone is
- * not (a path containing the literal substring `" b/"` defeats that header's
- * own regex — an accepted, narrow gap, not a silent one, since every other
- * line used here does not share it).
+ * §18's `get_git_diff`: live diff, patch text only when cheap — `patchOmittedReason` names why otherwise.
+ * Two caps here (`maxPatchBytes` per file, `maxTotalPatchBytes` total) plus a third in the MCP layer
+ * (`MAX_REPLY_BYTES`) — measured real failures at 229KB and 84,516 chars before these existed.
  */
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { applySerializedSizeBudget } from "../../budget/index.js";
-import { cleanGitEnv } from "./env.js";
+import { cleanGitEnv, HARDENED_GIT_CONFIG_ARGS } from "./env.js";
 const execFileAsync = promisify(execFile);
-// Always strips GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE/GIT_COMMON_DIR — see env.ts.
+// Strips GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE/GIT_COMMON_DIR, applies HARDENED_GIT_CONFIG_ARGS (env.ts, B-11).
 function run(command, args, options) {
-    return execFileAsync(command, args, {
+    return execFileAsync(command, [...HARDENED_GIT_CONFIG_ARGS, ...args], {
         ...options,
         encoding: "utf8",
         env: cleanGitEnv(),
     });
 }
 const DEFAULT_MAX_PATCH_BYTES = 20_000;
-/**
- * The cap on the sum of every returned patch. A per-file cap bounds no total:
- * 44 files each under the 20,000-byte per-file cap summed to 229KB and
- * hard-failed an ordinary 48-file branch diff before the reply was ever
- * returned.
- *
- * Was 80,000, lowered after the same diff was re-run against that value and
- * the call *still* failed, at 84,516 characters: 80,000 bytes of patch text
- * leaves nothing for the 48 per-file rows, the disclosures and the envelope
- * that surround them, so a budget that large is one the reply can never
- * actually afford to spend. 40,000 leaves the reply's own size ceiling
- * (`MAX_REPLY_BYTES`, in the MCP layer) room to be a backstop rather than the
- * thing that fires on every ordinary wide diff — which matters because this
- * budget's reason names an action the caller can take and that ceiling's does
- * not. A starting value, as before, not a measurement.
- */
+/** Cap on the sum of every returned patch — a per-file cap alone let 44 files summed to 229KB hard-fail a real diff. Was 80,000, lowered after 84,516 chars still failed. Starting value. */
 const DEFAULT_MAX_TOTAL_PATCH_BYTES = 40_000;
-/**
- * The stable prefix of `patchOmittedReason` when the *total* budget, not the
- * per-file cap, is what withheld a patch. Exported so a caller can tell the
- * two apart without matching on prose it does not own.
- */
+/** Stable prefix of `patchOmittedReason` when the total budget, not the per-file cap, withheld a patch. */
 export const TOTAL_PATCH_BUDGET_REASON_PREFIX = "the reply's total patch budget";
 function stripPrefix(path, prefix) {
     return path.startsWith(prefix) ? path.slice(prefix.length) : path;
@@ -138,7 +84,9 @@ function parseDiffBlock(block) {
 async function runGitDiff(cwd, revisionArgs, options) {
     const maxPatchBytes = options.maxPatchBytes ?? DEFAULT_MAX_PATCH_BYTES;
     const maxTotalPatchBytes = options.maxTotalPatchBytes ?? DEFAULT_MAX_TOTAL_PATCH_BYTES;
-    const args = ["diff", "-M", ...revisionArgs];
+    // --no-ext-diff (B-11): renders real patch text, so a repo-local
+    // `diff.external` would actually run here otherwise.
+    const args = ["diff", "--no-ext-diff", "-M", ...revisionArgs];
     if (options.files !== undefined && options.files.length > 0)
         args.push("--", ...options.files);
     const { stdout } = await run("git", args, { cwd, maxBuffer: 256 * 1024 * 1024 });
@@ -170,19 +118,13 @@ async function runGitDiff(cwd, revisionArgs, options) {
                     : null,
         });
     }
-    // The aggregate cap, applied after every per-file decision: a file whose
-    // patch was already withheld (binary, or over its own cap) costs nothing
-    // here and keeps the reason it already has.
+    // Aggregate cap, applied after per-file decisions — a file already withheld
+    // (binary or over its own cap) costs nothing here.
     return applySerializedSizeBudget(files, {
         maxTotalBytes: maxTotalPatchBytes,
         sizeOf: (f) => (f.patch === null ? 0 : Buffer.byteLength(f.patch, "utf8")),
-        // Short on purpose. This reason lands on *every* file past the boundary —
-        // 187 of 200 on a wide diff — so the advice tail it used to carry ("narrow
-        // files, or raise maxTotalPatchBytes") was paid for once per file to say
-        // the same thing each time, and measured at ~30KB on that diff: more than
-        // the patches it was explaining the absence of. The caller is told what to
-        // do once, in the reply's own note, which is where advice that is identical
-        // for every file belongs.
+        // Short on purpose: this reason repeats per file (187 of 200 on one wide
+        // diff), so a longer advice tail measured ~30KB — bigger than the patches it explained.
         withhold: (f, spentBytes) => ({
             ...f,
             patch: null,
@@ -191,24 +133,201 @@ async function runGitDiff(cwd, revisionArgs, options) {
         }),
     }).items;
 }
+const HUNK_HEADER = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/;
 /**
- * `base...head` (three dots), matching `changedFiles`'s own reasoning: two
- * dots would include everything changed on `base` since the branch point,
- * misattributing someone else's history to this diff.
+ * Which lines a unified-diff patch actually *added*, in new-file line numbers.
+ *
+ * C2 (UAT phase 4): `checkEnvironment`'s `NEW_READ_UNDECLARED` used to call any
+ * undeclared read in a `files`-scoped file "new", even a pre-existing read the
+ * diff never touched — this is what lets a caller ask the narrower, true
+ * question instead: is this line one the diff actually added?
+ *
+ * Parses the hunk headers (`@@ -a,b +c,d @@`) and walks each hunk counting the
+ * new-file line pointer: a `+` line claims the current pointer and advances it,
+ * a context line (or blank) advances the pointer without claiming a line, and a
+ * `-` line does neither — it consumes no new-file line — but does end any run
+ * of consecutive additions in progress, so an added block interrupted by a
+ * removed line reports as two ranges, not one spanning the gap. Takes the raw
+ * `patch` text `GitDiffFile` already carries; a `null` patch (binary, or
+ * withheld by a size budget) has nothing to parse and is the caller's problem
+ * to ask for separately — this function only ever sees text that exists.
  */
+export function addedLineRanges(patch) {
+    const ranges = [];
+    let newLine = 0;
+    let inHunk = false;
+    let start = null;
+    let end = null;
+    const flush = () => {
+        if (start !== null && end !== null)
+            ranges.push({ start, end });
+        start = null;
+        end = null;
+    };
+    for (const line of patch.split("\n")) {
+        const header = HUNK_HEADER.exec(line);
+        if (header !== null) {
+            flush();
+            newLine = Number(header[1]);
+            inHunk = true;
+            continue;
+        }
+        if (!inHunk)
+            continue;
+        if (line.startsWith("+") && !line.startsWith("+++")) {
+            if (start === null)
+                start = newLine;
+            end = newLine;
+            newLine += 1;
+        }
+        else if (line.startsWith("-") && !line.startsWith("---")) {
+            // A deletion consumes no new-file line, but it does break a run of
+            // consecutive additions — the two sides of it are not contiguous.
+            flush();
+        }
+        else if (line.startsWith("\\")) {
+            // "" — not a line, claims no pointer.
+            continue;
+        }
+        else {
+            // Context line (or the trailing empty split element): advances the
+            // pointer, claims nothing.
+            flush();
+            newLine += 1;
+        }
+    }
+    flush();
+    return ranges;
+}
+/** `base...head` (three dots) — two dots would include everything changed on `base` since the branch point. */
 export async function gitDiff(cwd, base, head = "HEAD", options = {}) {
     return runGitDiff(cwd, [`${base}...${head}`], options);
 }
 /**
- * The working-tree counterpart to {@link gitDiff}: a live diff against
- * uncommitted state, which no two-revision form of `git diff` can express
- * (`HEAD...HEAD` is empty by construction). Reuses the exact same block
- * parser, rename detection and patch cap `gitDiff` does — see
- * `DEC-NEXT-working-tree-diff-in-core` for why a second parser was rejected.
+ * Working-tree counterpart to {@link gitDiff}: a live diff against uncommitted state, which no
+ * two-revision `git diff` form can express. Reuses the same parser (`DEC-NEXT-working-tree-diff-in-core`).
  */
 export async function gitWorkingTreeDiff(cwd, options = {}) {
     const scope = options.scope ?? "unstaged";
     const revisionArgs = scope === "staged" ? ["--cached"] : scope === "all" ? ["HEAD"] : [];
     return runGitDiff(cwd, revisionArgs, options);
 }
+/** Untracked files past this many are counted and not diffed. */
+const DEFAULT_MAX_UNTRACKED = 200;
+/**
+ * The working tree as a change set, including files git has never seen.
+ *
+ * ## Why untracked needs its own mechanism
+ *
+ * No form of `git diff` reports an untracked file. `git diff HEAD` compares
+ * against what the index and `HEAD` hold, and a file git has never seen is in
+ * neither — so a working-tree mode built on the scopes above alone still misses
+ * the most common shape of work in progress: a new file, written, not yet
+ * added. That is exactly the case this was built for.
+ *
+ * ## `--no-index` rather than `add -N`
+ *
+ * The usual trick is `git add -N` to give the file an intent-to-add entry, then
+ * diff normally. **It writes to the index**, and a read tool that mutates the
+ * caller's repository to answer a question is not a read tool — it would also
+ * race any real `git add` the developer runs while it works.
+ *
+ * `git diff --no-index -- /dev/null <path>` needs no index and emits exactly the
+ * `new file mode` block the shared parser already handles, with the real path.
+ * It exits non-zero when the files differ, which for this call is always, so a
+ * non-zero exit here is the success case and is read for its stdout.
+ *
+ * ## `--exclude-standard` is load-bearing
+ *
+ * Without it the first answer on any real repository is a dependency directory
+ * reported as the developer's uncommitted work.
+ */
+export async function gitWorkingTreeChange(cwd, options = {}) {
+    const all = await gitWorkingTreeDiff(cwd, options);
+    const tracked = all.filter((file) => !isExcluded(file.path, options.exclude));
+    if (options.includeUntracked !== true) {
+        return { files: tracked, untrackedTotal: 0, untrackedTruncated: false };
+    }
+    const maxUntracked = options.maxUntracked ?? DEFAULT_MAX_UNTRACKED;
+    const listArgs = ["ls-files", "--others", "--exclude-standard"];
+    if (options.files !== undefined && options.files.length > 0) {
+        listArgs.push("--", ...options.files);
+    }
+    const { stdout } = await run("git", listArgs, { cwd, maxBuffer: 64 * 1024 * 1024 });
+    const untracked = stdout
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line !== "" && !isExcluded(line, options.exclude))
+        .sort();
+    const diffed = untracked.slice(0, maxUntracked);
+    const added = [];
+    for (const path of diffed) {
+        let text;
+        try {
+            const result = await run("git", ["diff", "--no-index", "--", "/dev/null", path], {
+                cwd,
+                maxBuffer: 256 * 1024 * 1024,
+            });
+            text = result.stdout;
+        }
+        catch (error) {
+            // Non-zero exit is the ordinary outcome here: `--no-index` reports a
+            // difference the way `diff(1)` does. The patch is on the error.
+            const stdout = error.stdout;
+            if (typeof stdout !== "string" || stdout.trim() === "")
+                continue;
+            text = stdout;
+        }
+        const parsed = parseUntrackedBlock(text, path, options);
+        if (parsed !== null)
+            added.push(parsed);
+    }
+    return {
+        files: [...tracked, ...added].sort((a, b) => a.path.localeCompare(b.path)),
+        untrackedTotal: untracked.length,
+        untrackedTruncated: untracked.length > diffed.length,
+    };
+}
+/**
+ * Is this path inside an excluded directory?
+ *
+ * A segment-boundary prefix match rather than `startsWith`: `.descry` must
+ * exclude `.descry/graph.db` and leave `src/.descryfile.ts` alone.
+ */
+function isExcluded(path, exclude) {
+    if (exclude === undefined)
+        return false;
+    return exclude.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+}
+/** One `--no-index` block, through the same cap rules every other patch gets. */
+function parseUntrackedBlock(text, path, options) {
+    const block = text.split(/\n(?=diff --git )/).find((b) => b.startsWith("diff --git "));
+    if (block === undefined)
+        return null;
+    const parsed = parseDiffBlock(block);
+    if (parsed === null)
+        return null;
+    const maxPatchBytes = options.maxPatchBytes ?? DEFAULT_MAX_PATCH_BYTES;
+    const bytes = Buffer.byteLength(block, "utf8");
+    const overCap = !parsed.binary && bytes > maxPatchBytes;
+    return {
+        // `--no-index` was given a path relative to `cwd` and echoes it back, but
+        // the finding is reported under the path the caller asked about.
+        path,
+        fromPath: null,
+        // A file git has never seen is an addition, whatever the block header says
+        // about `/dev/null` on the left.
+        status: "A",
+        binary: parsed.binary,
+        additions: parsed.binary ? null : parsed.additions,
+        deletions: parsed.binary ? null : 0,
+        patch: parsed.binary || overCap ? null : block,
+        patchOmittedReason: parsed.binary
+            ? "binary file — no textual patch"
+            : overCap
+                ? `diff for this file is ${bytes} bytes, over the ${maxPatchBytes}-byte cap — narrow ` +
+                    '"files" to fetch it on its own, or raise "maxPatchBytes"'
+                : null,
+    };
+}
 //# sourceMappingURL=diff.js.map