@duckmind/dm-linux-x64 0.65.4 → 0.65.6

package/extensions/dm-lens/dist/clients/git-guard.js

@@ -0,0 +1,770 @@
+import * as nodeFs from "node:fs";
+import * as path from "node:path";
+import { isPathIgnoredByProject } from "./file-utils.js";
+import { tokenizeShellCommand } from "./bash-file-access.js";
+import { logLatency } from "./latency-logger.js";
+import { resolveLensToolName } from "./tool-config.js";
+import { advisoryFileHash, advisoryPathKey, MAX_ADVISORY_AFFECTED_FILES, snapshotAdvisoryProvenance } from "./advisory-provenance.js";
+function resolveGuardPath(filePath, cwd) {
+  return path.resolve(cwd, filePath);
+}
+function guardPathKey(filePath, cwd) {
+  return advisoryPathKey(filePath, cwd);
+}
+function fileFingerprint(filePath) {
+  return advisoryFileHash(filePath);
+}
+function currentFileFingerprint(filePath) {
+  try {
+    nodeFs.statSync(filePath);
+    return fileFingerprint(filePath);
+  } catch (err) {
+    return err.code === "ENOENT" ? "missing" : `unreadable:${err.code ?? "unknown"}`;
+  }
+}
+function capAffectedFiles(files, cwd) {
+  const unique = [...new Set(files.map((file) => resolveGuardPath(file, cwd)))];
+  return {
+    files: unique.slice(0, MAX_ADVISORY_AFFECTED_FILES),
+    truncated: unique.length > MAX_ADVISORY_AFFECTED_FILES
+  };
+}
+const TURN_END_BLOCKER_SECTION = /^Unresolved from this turn — ([^\s].*?)(?: \(suppressed by disposition: \d+ finding\(s\)\))?:$/;
+function blockerSectionFile(line) {
+  const turnEndSection = TURN_END_BLOCKER_SECTION.exec(line);
+  if (turnEndSection)
+    return turnEndSection[1];
+  if (/^\s/.test(line))
+    return;
+  const separator = line.indexOf(": ");
+  if (separator <= 0)
+    return;
+  return line.slice(0, separator);
+}
+function blockingProvenance(blockerContent, blockingFiles, cwd) {
+  if (typeof blockerContent !== "string" || blockerContent.length === 0)
+    return;
+  if (!Array.isArray(blockingFiles))
+    return;
+  if (blockingFiles.some((file) => typeof file !== "string" || file.trim().length === 0)) {
+    return;
+  }
+  const provenanceKeys = blockingFiles.map((file) => guardPathKey(file, cwd));
+  const sectionKeys = [];
+  let inSection = false;
+  for (const line of blockerContent.split(`
+`)) {
+    if (line.length === 0) {
+      inSection = false;
+      continue;
+    }
+    const file = blockerSectionFile(line);
+    if (file === undefined) {
+      if (!inSection)
+        return;
+      continue;
+    }
+    sectionKeys.push(guardPathKey(file, cwd));
+    inSection = true;
+  }
+  if (sectionKeys.length === 0)
+    return;
+  return sectionKeys.every((key) => provenanceKeys.includes(key)) ? sectionKeys : undefined;
+}
+function getShellCommand(input) {
+  if (!input || typeof input !== "object")
+    return "";
+  const raw = input;
+  if (typeof raw.command === "string" && raw.command.trim())
+    return raw.command;
+  if (typeof raw.cmd === "string" && raw.cmd.trim())
+    return raw.cmd;
+  if (typeof raw.command === "string")
+    return raw.command;
+  return "";
+}
+function executableName(value) {
+  const normalized = value.replace(/\\/g, "/");
+  let name = (normalized.slice(normalized.lastIndexOf("/") + 1) ?? "").toLowerCase();
+  return name.replace(/\.(?:exe|com|bat|cmd)$/i, "");
+}
+function isShellWrapper(value) {
+  return new Set([
+    "sh",
+    "bash",
+    "dash",
+    "zsh",
+    "ash",
+    "cmd",
+    "pwsh",
+    "powershell"
+  ]).has(executableName(value));
+}
+function isGitExecutable(value) {
+  return new Set(["git", "git.exe", "git.cmd", "git.bat"]).has(executableName(value));
+}
+const COMMAND_STRING_WRAPPERS = new Set(["busybox", "toybox", "nix-shell"]);
+function isCommandStringWrapper(value) {
+  return COMMAND_STRING_WRAPPERS.has(executableName(value));
+}
+function canonicalizeGuardCommand(command) {
+  let result = "";
+  let quote;
+  let escaped = false;
+  for (let i = 0;i < command.length; i++) {
+    const ch = command[i];
+    if (quote === "single") {
+      result += ch;
+      if (ch === "'")
+        quote = undefined;
+      continue;
+    }
+    if (quote === "double") {
+      result += ch;
+      if (escaped)
+        escaped = false;
+      else if (ch === "\\")
+        escaped = true;
+      else if (ch === '"')
+        quote = undefined;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch === "'" ? "single" : "double";
+      result += ch;
+      continue;
+    }
+    const parameter = command.slice(i).match(/^\$\{IFS[^}]*\}/)?.[0];
+    const positional = command.slice(i).match(/^\$IFS(?:\$[0-9]+)?/)?.[0];
+    if (parameter || positional) {
+      result += " ";
+      i += (parameter ?? positional ?? "").length - 1;
+      continue;
+    }
+    result += ch;
+  }
+  let collapsed = "";
+  let pendingSpace = false;
+  quote = undefined;
+  for (const ch of result) {
+    if (!quote && ch === `
+`) {
+      collapsed += ch;
+      pendingSpace = false;
+      continue;
+    }
+    if (!quote && /\s/.test(ch)) {
+      pendingSpace = collapsed.length > 0;
+      continue;
+    }
+    if (pendingSpace)
+      collapsed += " ";
+    pendingSpace = false;
+    collapsed += ch;
+    if (!quote && (ch === "'" || ch === '"')) {
+      quote = ch === "'" ? "single" : "double";
+    } else if (quote === "single" && ch === "'" || quote === "double" && ch === '"') {
+      quote = undefined;
+    }
+  }
+  return collapsed.trim();
+}
+function normalizeGuardVerbToken(value) {
+  return value.replace(/\\(?=[A-Za-z0-9_])/g, "").replace(/`(?=.)/g, "").replace(/\^(?=.)/g, "");
+}
+function expandGuardVerbToken(value) {
+  return normalizeGuardVerbToken(value).trim().split(/\s+/).filter(Boolean);
+}
+function delimitedSubstitutionBody(command, start, opener, closer) {
+  let depth = 1;
+  let quote;
+  let escaped = false;
+  for (let i = start + opener.length;i < command.length; i++) {
+    const ch = command[i];
+    if (quote === "single") {
+      if (ch === "'")
+        quote = undefined;
+      continue;
+    }
+    if (quote === "double" && ch === '"') {
+      quote = undefined;
+      continue;
+    }
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (ch === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch === "'" ? "single" : "double";
+      continue;
+    }
+    if (command.startsWith(opener, i)) {
+      depth += 1;
+      i += opener.length - 1;
+      continue;
+    }
+    if (command.startsWith(closer, i) && --depth === 0) {
+      return { body: command.slice(start + opener.length, i), end: i };
+    }
+  }
+  return;
+}
+const COMMIT_PUSH_MATCHER = {
+  id: "commit-push",
+  matchesVerb: (verb) => verb === "commit" || verb === "push",
+  indirectAlwaysMatches: true,
+  suppressPostVerbHelp: false
+};
+function containsGuardedSubstitution(command, depth, matcher) {
+  if (depth > 3)
+    return false;
+  let quote;
+  let escaped = false;
+  for (let i = 0;i < command.length; i++) {
+    const ch = command[i];
+    if (quote === "single") {
+      if (ch === "'")
+        quote = undefined;
+      continue;
+    }
+    if (quote === "double" && ch === '"') {
+      quote = undefined;
+      continue;
+    }
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (ch === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch === "'" ? "single" : "double";
+      continue;
+    }
+    const substitution = command.startsWith("$(", i) ? delimitedSubstitutionBody(command, i, "$(", ")") : command.startsWith("<(", i) ? delimitedSubstitutionBody(command, i, "<(", ")") : command.startsWith(">(", i) ? delimitedSubstitutionBody(command, i, ">(", ")") : ch === "`" ? {
+      body: command.slice(i + 1, command.indexOf("`", i + 1)),
+      end: command.indexOf("`", i + 1)
+    } : undefined;
+    if (substitution && substitution.end >= 0) {
+      const nested = canonicalizeGuardCommand(substitution.body);
+      if (containsGuardedSubstitution(nested, depth + 1, matcher) || tokenizeShellCommand(nested).some((segment) => containsGuardedGitVerb(segment.tokens, depth + 1, matcher))) {
+        return true;
+      }
+      i = substitution.end;
+    }
+  }
+  return false;
+}
+const GIT_GLOBAL_OPTIONS_WITH_VALUE = new Set([
+  "-C",
+  "-c",
+  "--config-env",
+  "--git-dir",
+  "--work-tree",
+  "--exec-path",
+  "--namespace"
+]);
+const GIT_GLOBAL_OPTIONS_WITH_INLINE_VALUE = [
+  "--config-env",
+  "--git-dir",
+  "--work-tree",
+  "--exec-path",
+  "--namespace"
+];
+function gitVerbIndex(gitTokens) {
+  let i = 1;
+  while (i < gitTokens.length && gitTokens[i].startsWith("-")) {
+    const option = gitTokens[i];
+    if (["--help", "-h", "--version", "-v", "-V"].includes(option)) {
+      return;
+    }
+    if (option === "--")
+      return i + 1 < gitTokens.length ? i + 1 : undefined;
+    if (["-C", "-c"].some((prefix) => option.startsWith(prefix) && option.length > prefix.length)) {
+      i += 1;
+      continue;
+    }
+    if (GIT_GLOBAL_OPTIONS_WITH_INLINE_VALUE.some((prefix) => option.startsWith(`${prefix}=`))) {
+      i += 1;
+      continue;
+    }
+    i += GIT_GLOBAL_OPTIONS_WITH_VALUE.has(option) ? 2 : 1;
+  }
+  return i < gitTokens.length ? i : undefined;
+}
+export function matchGitVerbAtCommandPosition(gitTokens, matcher) {
+  const index = gitVerbIndex(gitTokens);
+  if (index === undefined)
+    return false;
+  const argsAfterVerb = gitTokens.slice(index + 1);
+  if (matcher.suppressPostVerbHelp && (argsAfterVerb[0] === "--help" || argsAfterVerb[0] === "-h")) {
+    return false;
+  }
+  const verbs = expandGuardVerbToken(gitTokens[index] ?? "");
+  return verbs.length === 1 && matcher.matchesVerb(verbs[0], argsAfterVerb);
+}
+function unquoteGuardValue(value) {
+  const trimmed = value.trim();
+  if (trimmed.length >= 2) {
+    const first = trimmed[0];
+    const last = trimmed[trimmed.length - 1];
+    if ((first === '"' || first === "'") && first === last) {
+      return trimmed.slice(1, -1);
+    }
+  }
+  return trimmed;
+}
+export function resolveGitTargetDirectory(gitTokens, cwd) {
+  let base = cwd;
+  let workTree;
+  let i = 1;
+  while (i < gitTokens.length && gitTokens[i].startsWith("-")) {
+    const option = gitTokens[i];
+    if (["--help", "-h", "--version", "-v", "-V"].includes(option))
+      break;
+    if (option === "--")
+      break;
+    if (option === "-C" && i + 1 < gitTokens.length) {
+      base = path.resolve(base, unquoteGuardValue(gitTokens[i + 1]));
+      i += 2;
+      continue;
+    }
+    if (option.startsWith("-C") && option.length > 2) {
+      base = path.resolve(base, unquoteGuardValue(option.slice(2)));
+      i += 1;
+      continue;
+    }
+    if (option === "--work-tree" && i + 1 < gitTokens.length) {
+      workTree = unquoteGuardValue(gitTokens[i + 1]);
+      i += 2;
+      continue;
+    }
+    if (option.startsWith("--work-tree=")) {
+      workTree = unquoteGuardValue(option.slice("--work-tree=".length));
+      i += 1;
+      continue;
+    }
+    if (option.startsWith("-c") && option.length > 2 && !option.startsWith("--")) {
+      i += 1;
+      continue;
+    }
+    if (GIT_GLOBAL_OPTIONS_WITH_INLINE_VALUE.some((prefix) => option.startsWith(`${prefix}=`))) {
+      i += 1;
+      continue;
+    }
+    i += GIT_GLOBAL_OPTIONS_WITH_VALUE.has(option) ? 2 : 1;
+  }
+  return workTree === undefined ? base : path.resolve(base, workTree);
+}
+export function collectGitInvocations(toolName, input) {
+  if (toolName !== "bash")
+    return [];
+  const command = getShellCommand(input);
+  if (!command)
+    return [];
+  const invocations = [];
+  for (const segment of tokenizeShellCommand(canonicalizeGuardCommand(command))) {
+    const gitIndex = segment.tokens.findIndex((token) => isGitExecutable(token));
+    if (gitIndex >= 0)
+      invocations.push(segment.tokens.slice(gitIndex));
+  }
+  return invocations;
+}
+function containsGuardedGitVerb(tokens, depth, matcher) {
+  if (depth > 3 || tokens.length === 0)
+    return false;
+  let commandTokens = tokens;
+  while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(commandTokens[0] ?? "")) {
+    commandTokens = commandTokens.slice(1);
+  }
+  if (commandTokens.length === 0)
+    return false;
+  const expandedHead = expandGuardVerbToken(commandTokens[0] ?? "");
+  if (expandedHead.length > 1) {
+    commandTokens = [...expandedHead, ...commandTokens.slice(1)];
+  }
+  if (isCommandStringWrapper(commandTokens[0] ?? "")) {
+    const lower = commandTokens.slice(1).map((token) => token.toLowerCase());
+    const runIndex = lower.findIndex((token) => token === "--run");
+    if (runIndex >= 0 && runIndex + 1 < commandTokens.length) {
+      const nestedCommand = commandTokens.slice(runIndex + 2).join(" ");
+      return tokenizeShellCommand(canonicalizeGuardCommand(nestedCommand)).some((segment) => containsGuardedGitVerb(segment.tokens, depth + 1, matcher));
+    }
+  }
+  if (["echo", "printf", "grep"].includes(executableName(commandTokens[0] ?? ""))) {
+    return false;
+  }
+  const gitIndex = commandTokens.findIndex((token) => isGitExecutable(token));
+  if (gitIndex >= 0) {
+    if (gitIndex > 0 && matcher.indirectAlwaysMatches)
+      return true;
+    return matchGitVerbAtCommandPosition(commandTokens.slice(gitIndex), matcher);
+  }
+  const leadingExecutable = commandTokens[0] ?? "";
+  const knownCommandStringWrapper = isShellWrapper(leadingExecutable) || isCommandStringWrapper(leadingExecutable);
+  if (!knownCommandStringWrapper) {
+    const unknownSwitchIndex = commandTokens.slice(1).findIndex((token) => (token.startsWith("-") || token.startsWith("/")) && token.length > 1);
+    if (unknownSwitchIndex < 0)
+      return false;
+    const commandIndex = unknownSwitchIndex + 2;
+    if (commandIndex >= commandTokens.length)
+      return false;
+    const nestedCommand = commandTokens.slice(commandIndex).join(" ");
+    return tokenizeShellCommand(canonicalizeGuardCommand(nestedCommand)).some((segment) => containsGuardedGitVerb(segment.tokens, depth + 1, matcher));
+  }
+  const lower = commandTokens.slice(1).map((token) => token.toLowerCase());
+  const switchIndex = lower.findIndex((token) => token === "-c" || token === "--run" || token === "-lc" || /^-[^-]*c$/.test(token) && !token.startsWith("--") || token === "/c" || token === "-command" || token === "-command:" || token === "-encodedcommand");
+  if (switchIndex < 0 || switchIndex + 1 >= commandTokens.length)
+    return false;
+  if (lower[switchIndex] === "-encodedcommand")
+    return false;
+  let commandIndex = switchIndex + 2;
+  if (commandTokens[commandIndex] === "--")
+    commandIndex += 1;
+  const nestedCommand = commandTokens.slice(commandIndex).join(" ");
+  return tokenizeShellCommand(canonicalizeGuardCommand(nestedCommand)).some((segment) => containsGuardedGitVerb(segment.tokens, depth + 1, matcher));
+}
+export function detectGuardedGitVerb(toolName, input, matcher) {
+  if (toolName !== "bash")
+    return false;
+  const command = getShellCommand(input);
+  if (!command)
+    return false;
+  const canonical = canonicalizeGuardCommand(command);
+  if (containsGuardedSubstitution(canonical, 0, matcher))
+    return true;
+  return tokenizeShellCommand(canonical).some((segment) => containsGuardedGitVerb(segment.tokens, 0, matcher));
+}
+export function isGitCommitOrPushAttempt(toolName, input) {
+  return detectGuardedGitVerb(toolName, input, COMMIT_PUSH_MATCHER);
+}
+function isTurnEndFindingsCache(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const record = value;
+  return typeof record.content === "string" && typeof record.hasBlockers === "boolean" && Array.isArray(record.affectedFiles) && record.affectedFiles.every((file) => typeof file === "string") && typeof record.sessionId === "string" && typeof record.projectSeqStart === "number" && typeof record.projectSeqEnd === "number" && Number.isFinite(record.projectSeqStart) && Number.isFinite(record.projectSeqEnd) && !!record.fileSeqByPath && typeof record.fileSeqByPath === "object" && Object.values(record.fileSeqByPath).every((seq) => typeof seq === "number" && Number.isFinite(seq)) && !!record.fileContentHashes && typeof record.fileContentHashes === "object" && Object.values(record.fileContentHashes).every((hash) => typeof hash === "string") && (record.affectedFilesTruncated === undefined || typeof record.affectedFilesTruncated === "boolean") && (record.blockingFiles === undefined || Array.isArray(record.blockingFiles));
+}
+function cacheRecord(cacheManager, cwd) {
+  const entry = cacheManager.readCache("turn-end-findings", cwd);
+  return entry && isTurnEndFindingsCache(entry.data) ? entry.data : undefined;
+}
+function markCacheUnknown(runtime, reason) {
+  runtime.markGitGuardCacheUnknown(reason);
+}
+export function writeGitGuardRecord(cacheManager, runtime, cwd, record) {
+  const capped = capAffectedFiles(Array.isArray(record.affectedFiles) ? record.affectedFiles : [], cwd);
+  const fileSeqByPath = { ...record.fileSeqByPath };
+  for (const file of capped.files) {
+    const key = guardPathKey(file, cwd);
+    if (fileSeqByPath[key] === undefined) {
+      fileSeqByPath[key] = runtime.getFileSeq(resolveGuardPath(file, cwd));
+    }
+  }
+  const currentProvenance = snapshotAdvisoryProvenance({
+    cwd,
+    runtime,
+    generation: 0,
+    files: capped.files.map((file) => ({
+      path: file,
+      role: "affected"
+    })),
+    truncated: capped.truncated
+  });
+  const fileContentHashes = Object.fromEntries(currentProvenance.files.map((file) => [
+    guardPathKey(file.path, cwd),
+    file.sha256
+  ]));
+  const data = {
+    ...record,
+    affectedFiles: capped.files,
+    affectedFilesTruncated: capped.truncated,
+    fileSeqByPath,
+    blockingFiles: Array.isArray(record.blockingFiles) ? capAffectedFiles(record.blockingFiles, cwd).files : undefined,
+    fileContentHashes,
+    provenance: record.provenance ?? currentProvenance
+  };
+  try {
+    cacheManager.writeCache("turn-end-findings", data, cwd);
+    runtime.clearGitGuardCacheUnknown();
+    return true;
+  } catch {
+    markCacheUnknown(runtime, "cache_write_failed");
+    return false;
+  }
+}
+function logDecision(cwd, decision, reasonCategory, metadata = {}) {
+  logLatency({
+    type: "phase",
+    toolName: "git-guard",
+    filePath: cwd,
+    phase: "decision",
+    durationMs: 0,
+    result: decision,
+    metadata: { decision, reasonCategory, ...metadata }
+  });
+}
+function unknown(cwd, reasonCategory, metadata = {}) {
+  logDecision(cwd, "unknown", reasonCategory, metadata);
+  return {
+    block: true,
+    unknown: true,
+    reason: `\uD83D\uDD34 COMMIT BLOCKED (--lens-guard): blocker state is unknown (${reasonCategory}). Re-run dm-lens checks or start a fresh session, then retry.`
+  };
+}
+export function retireInlineBlockerAndResyncGuard(args) {
+  const retired = args.runtime.retireInlineBlockerOnConfirmedClean(args.filePath, args.writeIndex, args.coveredSources);
+  if (!retired)
+    return false;
+  args.runtime.updateGitGuardStatus(false, "");
+  if (args.lensGuardEnabled) {
+    syncGitGuardRecord(args.runtime, args.cacheManager, args.cwd, args.filePath);
+  }
+  return true;
+}
+export function resyncGitGuardAfterInlinePolicy(args) {
+  const changed = args.runtime.applyInlineBlockerPolicyVerdicts(args.suppressedFilePaths);
+  if (args.suppressedFilePaths.length === 0 && changed === 0)
+    return;
+  args.runtime.updateGitGuardStatus(false, "");
+}
+export function syncGitGuardRecord(runtime, cacheManager, cwd, editedFilePath) {
+  const entries = (runtime.getInlineBlockersSnapshot?.() ?? []).filter((entry) => !entry.policySuppressed);
+  const inspection = cacheManager.inspectCache("turn-end-findings", cwd);
+  const existing = cacheRecord(cacheManager, cwd);
+  if (existing && existing.sessionId !== runtime.telemetrySessionId && entries.length === 0) {
+    markCacheUnknown(runtime, "session_mismatch");
+    return;
+  }
+  if (!existing && inspection !== "missing" && entries.length === 0) {
+    markCacheUnknown(runtime, `cache_${inspection}`);
+    return;
+  }
+  const fileSeqByPath = {};
+  for (const [filePath, seq] of runtime.getFileSeqEntries?.() ?? []) {
+    fileSeqByPath[guardPathKey(filePath, cwd)] = seq;
+  }
+  const inlineFiles = entries.map((entry) => resolveGuardPath(entry.filePath, cwd));
+  const existingBlockingFiles = existing?.blockingFiles ?? [];
+  const blockerSections = existing?.blockerContent ? blockingProvenance(existing.blockerContent, existingBlockingFiles, cwd) : undefined;
+  if (existing?.blockerContent && !blockerSections) {
+    markCacheUnknown(runtime, "blocking_provenance_untrusted");
+    return;
+  }
+  const editedKey = editedFilePath ? guardPathKey(editedFilePath, cwd) : undefined;
+  const testFiles = existing?.testFailureFiles ?? [];
+  const remainingBlockingFiles = editedKey && existingBlockingFiles.length > 0 ? existingBlockingFiles.filter((file) => guardPathKey(file, cwd) !== editedKey) : existingBlockingFiles;
+  let affectedFiles = [...existing?.affectedFiles ?? [], ...inlineFiles];
+  if (!entries.length && editedKey && existing) {
+    const isStillTestFailure = testFiles.some((file) => guardPathKey(file, cwd) === editedKey);
+    const isUnknownBlockingPath = existingBlockingFiles.length === 0 && !!existing.blockerContent;
+    if (!isStillTestFailure && !isUnknownBlockingPath) {
+      affectedFiles = affectedFiles.filter((file) => guardPathKey(file, cwd) !== editedKey);
+    }
+  }
+  const clearedLastKnownBlocker = !entries.length && !!editedKey && !!blockerSections && blockerSections.every((key) => key === editedKey);
+  const blockerContent = entries.length > 0 ? entries.map((entry) => `${entry.filePath}: ${entry.summary}`).join(`
+`) : clearedLastKnownBlocker ? undefined : existing?.blockerContent;
+  const hasTestFailures = existing?.testFailures === true;
+  const hasBlockers = !!blockerContent || hasTestFailures;
+  const content = [
+    blockerContent,
+    hasTestFailures ? existing?.testFailureContent : undefined
+  ].filter((value) => !!value).join(`
+
+`);
+  if (!hasBlockers && !content) {
+    cacheManager.clearCache("turn-end-findings", cwd);
+    runtime.clearGitGuardCacheUnknown();
+    return;
+  }
+  writeGitGuardRecord(cacheManager, runtime, cwd, {
+    content: content || existing?.content || "",
+    blockerContent,
+    blockingFiles: entries.length > 0 ? inlineFiles : remainingBlockingFiles,
+    hasBlockers,
+    affectedFiles,
+    sessionId: runtime.telemetrySessionId,
+    projectSeqStart: runtime.turnStartProjectSeq,
+    projectSeqEnd: runtime.projectSeq,
+    fileSeqByPath,
+    fileContentHashes: {},
+    consumed: false,
+    testFailures: existing?.testFailures,
+    testFailureContent: existing?.testFailureContent,
+    testFailureFiles: existing?.testFailureFiles
+  });
+}
+export function mergeGitGuardTestFailure(cacheManager, cwd, runtime, content, files) {
+  const existing = cacheRecord(cacheManager, cwd);
+  const fileSeqByPath = {};
+  for (const [filePath, seq] of runtime.getFileSeqEntries?.() ?? []) {
+    fileSeqByPath[guardPathKey(filePath, cwd)] = seq;
+  }
+  const failedFiles = files.map((file) => resolveGuardPath(file, cwd));
+  const blockerContent = existing?.blockerContent;
+  const testFailureFiles = [
+    ...existing?.testFailureFiles ?? [],
+    ...failedFiles
+  ].filter((file, index, all) => all.findIndex((candidate) => guardPathKey(candidate, cwd) === guardPathKey(file, cwd)) === index);
+  writeGitGuardRecord(cacheManager, runtime, cwd, {
+    content: [blockerContent, content].filter(Boolean).join(`
+
+`),
+    blockerContent,
+    blockingFiles: existing?.blockingFiles ?? [],
+    testFailureContent: content,
+    testFailureFiles,
+    hasBlockers: true,
+    affectedFiles: [...existing?.affectedFiles ?? [], ...failedFiles],
+    sessionId: runtime.telemetrySessionId,
+    projectSeqStart: runtime.turnStartProjectSeq,
+    projectSeqEnd: runtime.projectSeq,
+    fileSeqByPath,
+    fileContentHashes: {},
+    consumed: false,
+    testFailures: true
+  });
+}
+export function clearGitGuardTestFailure(cacheManager, cwd, runtime, passedFiles = []) {
+  const existing = cacheRecord(cacheManager, cwd);
+  if (!existing?.testFailures)
+    return;
+  const passedKeys = new Set((passedFiles.length > 0 ? passedFiles : existing.testFailureFiles ?? []).map((file) => guardPathKey(file, cwd)));
+  const remainingFiles = (existing.testFailureFiles ?? []).filter((file) => !passedKeys.has(guardPathKey(file, cwd)));
+  const blockerContent = existing.blockerContent ?? "";
+  if (!blockerContent && remainingFiles.length === 0) {
+    cacheManager.clearCache("turn-end-findings", cwd);
+    return;
+  }
+  const blockingKeys = new Set((existing.blockingFiles ?? []).map((file) => guardPathKey(file, cwd)));
+  const affectedFiles = existing.affectedFiles.filter((file) => blockingKeys.has(guardPathKey(file, cwd)) || remainingFiles.some((testFile) => guardPathKey(testFile, cwd) === guardPathKey(file, cwd)));
+  writeGitGuardRecord(cacheManager, runtime, cwd, {
+    ...existing,
+    content: blockerContent,
+    blockerContent,
+    affectedFiles,
+    testFailures: remainingFiles.length > 0,
+    testFailureContent: remainingFiles.length > 0 ? existing.testFailureContent : undefined,
+    testFailureFiles: remainingFiles.length > 0 ? remainingFiles : undefined,
+    hasBlockers: !!blockerContent || remainingFiles.length > 0,
+    sessionId: runtime.telemetrySessionId,
+    projectSeqStart: runtime.turnStartProjectSeq,
+    projectSeqEnd: runtime.projectSeq,
+    fileSeqByPath: Object.fromEntries(runtime.getFileSeqEntries().map(([filePath, seq]) => [guardPathKey(filePath, cwd), seq])),
+    fileContentHashes: {}
+  });
+}
+function firstExpiredSuppressionVerdict(runtime) {
+  for (const entry of runtime.getInlineBlockersSnapshot?.() ?? []) {
+    if (!entry.policySuppressed)
+      continue;
+    if (entry.recordedHash === undefined) {
+      return { filePath: entry.filePath, tier: "no_baseline" };
+    }
+    if (fileFingerprint(entry.filePath) !== entry.recordedHash) {
+      return { filePath: entry.filePath, tier: "content" };
+    }
+  }
+  return;
+}
+export function evaluateGitGuard(runtime, cacheManager, cwd, host = "pi") {
+  const diagnosticsTool = resolveLensToolName("lens_diagnostics", host);
+  const inspectLine = diagnosticsTool ? `Run ${diagnosticsTool} mode=all for full details, then commit again.` : "Inspect the full diagnostics, then commit again.";
+  if (runtime.gitGuardHasBlockers) {
+    logDecision(cwd, "blocked", "runtime_blockers", {
+      projectSeq: runtime.projectSeq
+    });
+    const detail = runtime.gitGuardSummary ? `
+${runtime.gitGuardSummary}` : "";
+    return {
+      block: true,
+      reason: `\uD83D\uDD34 COMMIT BLOCKED (--lens-guard): unresolved blockers must be fixed before commit/push.${detail}
+${inspectLine}`
+    };
+  }
+  const expired = firstExpiredSuppressionVerdict(runtime);
+  if (expired) {
+    return unknown(cwd, "inline_policy_stale", {
+      file: expired.filePath,
+      tier: expired.tier
+    });
+  }
+  if (runtime.gitGuardCacheUnknownReason) {
+    return unknown(cwd, runtime.gitGuardCacheUnknownReason);
+  }
+  const inspection = cacheManager.inspectCache("turn-end-findings", cwd);
+  if (inspection === "missing") {
+    logDecision(cwd, "allowed", "no_record");
+    return { block: false };
+  }
+  if (inspection !== "fresh")
+    return unknown(cwd, `cache_${inspection}`);
+  const pending = cacheManager.readCache("turn-end-findings", cwd);
+  if (!pending || !isTurnEndFindingsCache(pending.data)) {
+    return unknown(cwd, "cache_malformed");
+  }
+  const record = pending.data;
+  if (!record.hasBlockers) {
+    logDecision(cwd, "allowed", "advisory_only");
+    return { block: false };
+  }
+  if (record.affectedFilesTruncated) {
+    return unknown(cwd, "affected_files_truncated");
+  }
+  if (record.sessionId !== runtime.telemetrySessionId) {
+    return unknown(cwd, "session_mismatch");
+  }
+  if (record.projectSeqEnd !== runtime.projectSeq) {
+    return unknown(cwd, "project_sequence_mismatch", {
+      recordedProjectSeq: record.projectSeqEnd,
+      currentProjectSeq: runtime.projectSeq
+    });
+  }
+  const liveFiles = [];
+  for (const file of record.affectedFiles) {
+    const resolved = resolveGuardPath(file, cwd);
+    const key = guardPathKey(resolved, cwd);
+    const recordedSeq = record.fileSeqByPath[key];
+    if (recordedSeq === undefined || recordedSeq !== (runtime.getFileSeq?.(resolved) ?? 0)) {
+      return unknown(cwd, "file_sequence_mismatch", { file: resolved });
+    }
+    try {
+      if (!isPathIgnoredByProject(resolved, runtime.projectRoot || cwd, false)) {
+        const currentHash = currentFileFingerprint(resolved);
+        if (currentHash !== "missing") {
+          liveFiles.push(resolved);
+          const expectedHash = record.fileContentHashes[key];
+          if (!expectedHash || expectedHash.startsWith("unreadable:") || currentHash.startsWith("unreadable:") || expectedHash !== currentHash) {
+            return unknown(cwd, "file_content_changed", { file: resolved });
+          }
+        }
+      }
+    } catch {
+      return unknown(cwd, "file_unreadable", { file: resolved });
+    }
+  }
+  if (record.hasBlockers && record.affectedFiles.length === 0) {
+    return unknown(cwd, "blocker_without_affected_file");
+  }
+  if (record.hasBlockers && liveFiles.length === 0 && record.affectedFiles.length > 0) {
+    logDecision(cwd, "allowed", "affected_files_resolved", {
+      projectSeq: record.projectSeqEnd
+    });
+    return { block: false };
+  }
+  logDecision(cwd, "blocked", "cache_blockers", {
+    projectSeq: record.projectSeqEnd,
+    affectedFileCount: record.affectedFiles.length
+  });
+  return {
+    block: true,
+    reason: `\uD83D\uDD34 COMMIT BLOCKED (--lens-guard): unresolved blockers must be fixed before commit/push.
+${inspectLine}`
+  };
+}