@fourshore/graft-core 0.0.8 → 0.0.10

package/dist/index.js

@@ -1,6 +1,11 @@
-export { Graft, GraftError, buildCommitMessage } from "./graft.js";
+export { Graft, GraftError, buildCommitMessage, recordBlock, runShell } from "./graft.js";
 export * from "./policy.js";
 export * from "./record.js";
 export * from "./redact.js";
 export * from "./agents.js";
+export * from "./capture.js";
+export * from "./claude-code.js";
+export * from "./hooks.js";
+export * from "./context.js";
+export * from "./ci.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEnE,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE1F,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC"}

package/dist/policy.d.ts

@@ -1,3 +1,11 @@
+import type { Evidence } from "./record.js";
+/** Which named commands a change that touches these paths must carry as passing evidence. */
+export interface CoverageRule {
+    /** Globs relative to the repo root, same rules as secretFiles. */
+    paths: string[];
+    /** Names from `commands`. */
+    require: string[];
+}
 /**
  * Repo policy, read from .graft/policy.json at the working tree root.
  * Version 1 has one rule. More arrive with the review view and the server.
@@ -23,7 +31,74 @@ export interface Policy {
      * "specs/**"). Same glob rules as secretFiles.
      */
     behaviorFiles?: string[];
+    /**
+     * Trailers added to every landed commit, each "Key: value", so the ones you
+     * pass on every land (a session link, a Co-Authored-By) cannot be forgotten.
+     * `$NAME` and `${NAME}` expand from the environment; a trailer that names a
+     * variable which is not set is left out of that commit rather than written
+     * with a hole in it.
+     */
+    trailers?: string[];
+    /**
+     * Extra regular expressions (as strings) for commands the capture hooks
+     * record as evidence, on top of the built-in test, build, lint and
+     * type-check patterns: for example "^\\./scripts/verify".
+     */
+    captureCommands?: string[];
+    /**
+     * When `graft check --rerun` re-runs recorded commands, only commands
+     * matching one of these regular expressions (as strings) are run. Unset
+     * means every recorded passing command. Set it where a PR from a stranger
+     * could record a command you would not want CI to execute.
+     */
+    checkCommands?: string[];
+    /**
+     * The repo's checks, named once: `{ "test": "go test ./...", "vet386":
+     * "env GOOS=windows GOARCH=386 go vet ./..." }`. `graft evidence <name>`
+     * runs one; the capture hooks record a typed command that matches one
+     * under its name; `graft check --rerun` runs the current definition of a
+     * name, so a command can change without invalidating history. Names are
+     * what `rules` refer to.
+     */
+    commands?: Record<string, string>;
+    /**
+     * The repo's definition of done, by path: a change that touches a file
+     * matching a rule's `paths` must carry a passing run (by Graft or a
+     * harness, not attested) of every command the rule names. `land` refuses
+     * otherwise, and `graft check` fails the commit.
+     */
+    rules?: CoverageRule[];
 }
 export declare const DEFAULT_POLICY: Policy;
 export declare const POLICY_PATH = ".graft/policy.json";
 export declare function readPolicy(topLevel: string): Promise<Policy>;
+/** Whitespace-insensitive form of a command, for matching what was typed against the catalog. */
+export declare function normalizeCommand(command: string): string;
+/** The catalog name whose command is what was typed, or null. */
+export declare function matchCatalog(policy: Policy, command: string): string | null;
+/** A named command that is not met by the evidence, with the files that asked for it. */
+export interface UnmetRule {
+    name: string;
+    command: string;
+    files: string[];
+}
+/**
+ * Which named commands the rules demand for these files that the evidence
+ * does not cover. A run covers a name when it exited 0, was run by Graft or
+ * a harness (not attested), and carries the name, or the name as its label
+ * (a record rebuilt from a commit message keeps only the label), or the
+ * catalog's command for that name.
+ */
+export declare function evaluateRules(policy: Policy, files: string[], evidence: Evidence[]): UnmetRule[];
+/**
+ * Expand `$NAME` / `${NAME}` in policy trailers from `env`. Returns the
+ * trailers to write and the ones skipped because a variable was unset, with
+ * the variable's name, so the caller can say so.
+ */
+export declare function expandTrailers(trailers: string[], env?: Record<string, string | undefined>): {
+    trailers: string[];
+    skipped: {
+        trailer: string;
+        missing: string;
+    }[];
+};

package/dist/policy.js

@@ -1,5 +1,6 @@
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
+import { globToRegExp } from "./redact.js";
 export const DEFAULT_POLICY = { version: 1, requireEvidence: true };
 export const POLICY_PATH = ".graft/policy.json";
 export async function readPolicy(topLevel) {
@@ -9,7 +10,9 @@ export async function readPolicy(topLevel) {
         if (parsed.version !== undefined && parsed.version !== 1) {
             throw new Error(`Unsupported policy version ${String(parsed.version)} in ${POLICY_PATH}`);
         }
-        return { ...DEFAULT_POLICY, ...parsed, version: 1 };
+        const policy = { ...DEFAULT_POLICY, ...parsed, version: 1 };
+        validatePolicy(policy);
+        return policy;
     }
     catch (err) {
         if (err.code === "ENOENT")
@@ -17,4 +20,99 @@ export async function readPolicy(topLevel) {
         throw err;
     }
 }
+const COMMAND_NAME = /^[A-Za-z0-9][A-Za-z0-9_.:-]*$/;
+function validatePolicy(policy) {
+    for (const [name, command] of Object.entries(policy.commands ?? {})) {
+        if (!COMMAND_NAME.test(name))
+            throw new Error(`${POLICY_PATH}: command name "${name}" must be a word (letters, digits, _ . : -).`);
+        if (typeof command !== "string" || !command.trim())
+            throw new Error(`${POLICY_PATH}: command "${name}" must be a non-empty string.`);
+    }
+    for (const rule of policy.rules ?? []) {
+        if (!Array.isArray(rule.paths) || !rule.paths.length)
+            throw new Error(`${POLICY_PATH}: every rule needs a non-empty "paths" list.`);
+        if (!Array.isArray(rule.require) || !rule.require.length)
+            throw new Error(`${POLICY_PATH}: every rule needs a non-empty "require" list.`);
+        for (const name of rule.require) {
+            if (!policy.commands?.[name]) {
+                throw new Error(`${POLICY_PATH}: rule for ${rule.paths.join(", ")} requires "${name}", which "commands" does not define.`);
+            }
+        }
+    }
+}
+/** Whitespace-insensitive form of a command, for matching what was typed against the catalog. */
+export function normalizeCommand(command) {
+    return command.replace(/\s+/g, " ").trim();
+}
+/** The catalog name whose command is what was typed, or null. */
+export function matchCatalog(policy, command) {
+    const typed = normalizeCommand(command);
+    for (const [name, c] of Object.entries(policy.commands ?? {}))
+        if (normalizeCommand(c) === typed)
+            return name;
+    return null;
+}
+/**
+ * Which named commands the rules demand for these files that the evidence
+ * does not cover. A run covers a name when it exited 0, was run by Graft or
+ * a harness (not attested), and carries the name, or the name as its label
+ * (a record rebuilt from a commit message keeps only the label), or the
+ * catalog's command for that name.
+ */
+export function evaluateRules(policy, files, evidence) {
+    const commands = policy.commands ?? {};
+    const unmet = new Map();
+    for (const rule of policy.rules ?? []) {
+        const hit = files.filter((f) => rule.paths.some((g) => globToRegExp(g).test(f.replace(/\\/g, "/"))));
+        if (!hit.length)
+            continue;
+        for (const name of rule.require) {
+            if (commands[name] && covers(evidence, name, commands[name]))
+                continue;
+            const set = unmet.get(name) ?? new Set();
+            for (const f of hit)
+                set.add(f);
+            unmet.set(name, set);
+        }
+    }
+    return [...unmet].map(([name, set]) => ({ name, command: commands[name] ?? "", files: [...set] }));
+}
+function covers(evidence, name, command) {
+    const want = normalizeCommand(command);
+    return evidence.some((e) => e.kind === "command" &&
+        e.exitCode === 0 &&
+        !e.attested &&
+        (e.name === name || e.label === name || normalizeCommand(e.command) === want));
+}
+/**
+ * Expand `$NAME` / `${NAME}` in policy trailers from `env`. Returns the
+ * trailers to write and the ones skipped because a variable was unset, with
+ * the variable's name, so the caller can say so.
+ */
+export function expandTrailers(trailers, env = process.env) {
+    const out = [];
+    const skipped = [];
+    for (const t of trailers) {
+        let missing;
+        const expanded = t.replace(/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)(?:([#%])([^}]*))?\}|([A-Za-z_][A-Za-z0-9_]*))/g, (_, braced, op, affix, bare) => {
+            const name = braced ?? bare;
+            let v = env[name];
+            if (v === undefined || v === "") {
+                missing ??= name;
+                return "";
+            }
+            // `${NAME#prefix}` and `${NAME%suffix}` strip a literal affix, as in sh.
+            if (op === "#" && affix && v.startsWith(affix))
+                v = v.slice(affix.length);
+            if (op === "%" && affix && v.endsWith(affix))
+                v = v.slice(0, -affix.length);
+            return v;
+        });
+        if (missing)
+            skipped.push({ trailer: t, missing });
+        else
+            out.push(expanded);
+    }
+    return { trailers: out, skipped };
+}
 //# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA6BjC,MAAM,CAAC,MAAM,cAAc,GAAW,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;AAE5E,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;QAClD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,WAAW,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,cAAc,CAAC;QAC5E,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA2E3C,MAAM,CAAC,MAAM,cAAc,GAAW,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;AAE5E,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;QAClD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,WAAW,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,MAAM,GAAW,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACpE,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,cAAc,CAAC;QAC5E,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAG,+BAA+B,CAAC;AAErD,SAAS,cAAc,CAAC,MAAc;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,mBAAmB,IAAI,8CAA8C,CAAC,CAAC;QACnI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,cAAc,IAAI,+BAA+B,CAAC,CAAC;IACvI,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,8CAA8C,CAAC,CAAC;QACpI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,gDAAgD,CAAC,CAAC;QAC1I,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,sCAAsC,CAAC,CAAC;YAC7H,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAAe;IAC1D,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;QAAE,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;IAC9G,OAAO,IAAI,CAAC;AACd,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,KAAe,EAAE,QAAoB;IACjF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,SAAS;QAC1B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACvE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YACjD,KAAK,MAAM,CAAC,IAAI,GAAG;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAChC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,MAAM,CAAC,QAAoB,EAAE,IAAY,EAAE,OAAe;IACjE,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,CAAC,EAAwB,EAAE,CAC1B,CAAC,CAAC,IAAI,KAAK,SAAS;QACpB,CAAC,CAAC,QAAQ,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC,QAAQ;QACX,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAChF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,OAAO,GAA2C,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,OAA2B,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CACxB,gFAAgF,EAChF,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,IAAI,CAAC;YAC5B,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;gBAChC,OAAO,KAAK,IAAI,CAAC;gBACjB,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,yEAAyE;YACzE,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1E,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5E,OAAO,CAAC,CAAC;QACX,CAAC,CACF,CAAC;QACF,IAAI,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;;YAC9C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC"}

package/dist/record.d.ts

@@ -11,6 +11,8 @@ export interface ChangeRecord {
     task: string;
     /** How they intended to do it. Optional while a change is open. */
     plan?: string;
+    /** Where the task came from: the thread, issue or ticket that asked for it, as a URL or id. */
+    ref?: string;
     /** Who did the work. */
     author: ChangeAuthor;
     /** ISO 8601 timestamps. */
@@ -24,14 +26,19 @@ export interface ChangeRecord {
      * original SHA, not the one the note is now attached to.
      */
     commit?: string;
+    /**
+     * Set when a capture hook opened the change from the harness's own event
+     * (the prompt, or a recorded run with nothing open) rather than an explicit
+     * `graft start`. A later `graft start` adopts such a change, naming the
+     * task and keeping the evidence, instead of refusing.
+     */
+    capturedBy?: string;
 }
 export interface ChangeAuthor {
     /** "agent" or "human". */
     kind: "agent" | "human";
     /** e.g. "claude-code", "cursor", or a person's handle. */
     name: string;
-    /** Model identifier when the author is an agent. */
-    model?: string;
 }
 export type Evidence = CommandEvidence | NoteEvidence;
 export interface CommandEvidence {
@@ -43,8 +50,22 @@ export interface CommandEvidence {
     durationMs: number;
     /** Trimmed tail of combined stdout/stderr, capped at EVIDENCE_OUTPUT_CAP bytes. */
     output: string;
-    /** Optional label, e.g. "unit tests". */
+    /** Optional label, e.g. "unit tests". Kept in the note; the message line carries `name` when there is one. */
     label?: string;
+    /** The policy catalog name this run satisfies, when it was run or matched by name. */
+    name?: string;
+    /**
+     * Set when a harness reported the run through a hook ("claude-code")
+     * instead of Graft running it. The exit code and output are the harness's
+     * own, so this is still a pass or a fail, not a claim.
+     */
+    via?: string;
+    /**
+     * True when the author attached a run they made themselves instead of
+     * letting Graft run the command. The exit code and output are their claim;
+     * readers show it as "attested", not "pass".
+     */
+    attested?: true;
 }
 export interface NoteEvidence {
     kind: "note";
@@ -62,8 +83,8 @@ export declare function evidenceSummary(evidence: Evidence[]): string;
 export declare const TRAILER_KEYS: {
     readonly change: "Graft-Change";
     readonly task: "Graft-Task";
+    readonly ref: "Graft-Task-Ref";
     readonly author: "Graft-Author";
-    readonly model: "Graft-Model";
     readonly evidence: "Graft-Evidence";
 };
 export declare function trailersFor(record: ChangeRecord): Array<[string, string]>;
@@ -82,6 +103,8 @@ export declare const EVIDENCE_HEADER = "Evidence:";
  *
  *   [pass unit tests] npm test (12.3s)
  *   [fail 1] npm run lint (0.4s)
+ *   [attested go tests] go test ./...
+ *   [attested fail 2 build] yarn build
  *   [note] manually verified in browser
  */
 export declare function evidenceLines(evidence: Evidence[]): string[];
@@ -93,9 +116,13 @@ export declare function evidenceLines(evidence: Evidence[]): string[];
  */
 export declare function parseMessageRecord(message: string, authoredAt: string): ChangeRecord | null;
 /**
- * Turn an argv into one POSIX shell command string. Every element is quoted
- * unless it is plainly safe, so `node -e 'console.log("a b")'` survives the
- * trip through /bin/sh. A single element is returned as written, so
+ * Turn an argv into one shell command string for the platform's shell.
+ * Every element is quoted unless it is plainly safe, so
+ * `node -e 'console.log("a b")'` survives the trip through /bin/sh, or
+ * through cmd.exe on Windows, where the quoting follows the rules the C
+ * runtime uses to split a command line and cmd's own metacharacters are
+ * escaped with `^`. A single element is returned as written, so
  * `graft evidence -- "npm test && npm run lint"` still runs through the shell.
+ * A redirect or pipe given as its own element is therefore a literal argument.
  */
-export declare function shellJoin(argv: string[]): string;
+export declare function shellJoin(argv: string[], platform?: NodeJS.Platform): string;

package/dist/record.js

@@ -33,25 +33,25 @@ export function evidenceSummary(evidence) {
 export const TRAILER_KEYS = {
     change: "Graft-Change",
     task: "Graft-Task",
+    ref: "Graft-Task-Ref",
     author: "Graft-Author",
-    model: "Graft-Model",
     evidence: "Graft-Evidence",
 };
 export function trailersFor(record) {
     const t = [
         [TRAILER_KEYS.change, record.id],
         [TRAILER_KEYS.task, oneLine(record.task)],
-        [TRAILER_KEYS.author, `${record.author.kind}:${record.author.name}`],
     ];
-    if (record.author.model)
-        t.push([TRAILER_KEYS.model, record.author.model]);
+    if (record.ref)
+        t.push([TRAILER_KEYS.ref, oneLine(record.ref)]);
+    t.push([TRAILER_KEYS.author, `${record.author.kind}:${record.author.name}`]);
     t.push([TRAILER_KEYS.evidence, evidenceSummary(record.evidence)]);
     return t;
 }
 export function parseTrailers(message) {
     const out = {};
     for (const line of message.split("\n")) {
-        const m = /^(Graft-[A-Za-z]+):\s*(.*)$/.exec(line);
+        const m = /^(Graft-[A-Za-z-]+):\s*(.*)$/.exec(line);
         if (m)
             out[m[1]] = m[2].trim();
     }
@@ -74,13 +74,20 @@ const MESSAGE_LINE_CAP = 200;
  *
  *   [pass unit tests] npm test (12.3s)
  *   [fail 1] npm run lint (0.4s)
+ *   [attested go tests] go test ./...
+ *   [attested fail 2 build] yarn build
  *   [note] manually verified in browser
  */
 export function evidenceLines(evidence) {
     return evidence.map((ev) => {
-        const label = ev.label ? ` ${bracketSafe(ev.label)}` : "";
+        // A catalog name is the run's identity, so it is what the message keeps; a free label rides in the note.
+        const shown = ev.kind === "command" && ev.name ? ev.name : ev.label;
+        const label = shown ? ` ${bracketSafe(shown)}` : "";
         if (ev.kind === "note")
             return `  [note${label}] ${clip(oneLine(ev.text))}`;
+        const failed = ev.exitCode === 0 ? "" : ` fail ${ev.exitCode}`;
+        if (ev.attested)
+            return `  [attested${failed}${label}] ${clip(oneLine(ev.command))}`;
         const status = ev.exitCode === 0 ? "pass" : `fail ${ev.exitCode}`;
         return `  [${status}${label}] ${clip(oneLine(ev.command))} (${(ev.durationMs / 1000).toFixed(1)}s)`;
     });
@@ -89,7 +96,7 @@ export function evidenceLines(evidence) {
 function bracketSafe(label) {
     return oneLine(label).replace(/[[\]]/g, "").slice(0, 60);
 }
-const EVIDENCE_LINE = /^\s*\[(pass|fail (-?\d+)|note)(?: ([^\]]*))?\] (.*)$/;
+const EVIDENCE_LINE = /^\s*\[(pass|fail (-?\d+)|note|attested(?: fail (-?\d+))?)(?: ([^\]]*))?\] (.*)$/;
 const DURATION = /^(.*) \((\d+(?:\.\d+)?)s\)$/;
 /**
  * Rebuild a record from a commit message alone: trailers, the Plan: block and
@@ -109,31 +116,36 @@ export function parseMessageRecord(message, authoredAt) {
         const m = EVIDENCE_LINE.exec(line);
         if (!m)
             continue;
-        const label = m[3] || undefined;
-        let rest = m[4];
+        const [, status, failCode, attestedFailCode, rawLabel, tail] = m;
+        const label = rawLabel || undefined;
+        if (status === "note") {
+            evidence.push({ kind: "note", at: authoredAt, text: tail, label });
+            continue;
+        }
+        if (status.startsWith("attested")) {
+            const exitCode = attestedFailCode ? Number(attestedFailCode) : 0;
+            evidence.push({ kind: "command", at: authoredAt, command: tail, exitCode, durationMs: 0, output: "", label, attested: true });
+            continue;
+        }
+        let rest = tail;
         let durationMs = 0;
-        if (m[1] !== "note") {
-            const d = DURATION.exec(rest);
-            if (d) {
-                rest = d[1];
-                durationMs = Math.round(Number(d[2]) * 1000);
-            }
+        const d = DURATION.exec(rest);
+        if (d) {
+            rest = d[1];
+            durationMs = Math.round(Number(d[2]) * 1000);
         }
-        if (m[1] === "note")
-            evidence.push({ kind: "note", at: authoredAt, text: rest, label });
-        else
-            evidence.push({ kind: "command", at: authoredAt, command: rest, exitCode: m[2] ? Number(m[2]) : 0, durationMs, output: "", label });
+        evidence.push({ kind: "command", at: authoredAt, command: rest, exitCode: failCode ? Number(failCode) : 0, durationMs, output: "", label });
     }
     const [kind, ...name] = (trailers[TRAILER_KEYS.author] ?? "human:unknown").split(":");
     return {
         version: 1,
         id,
         task: trailers[TRAILER_KEYS.task] ?? lines[0],
+        ref: trailers[TRAILER_KEYS.ref] || undefined,
         plan: plan || undefined,
         author: {
             kind: kind === "agent" ? "agent" : "human",
             name: name.join(":") || "unknown",
-            model: trailers[TRAILER_KEYS.model] || undefined,
         },
         startedAt: authoredAt,
         landedAt: authoredAt,
@@ -170,15 +182,35 @@ function clip(s) {
     return s.length > MESSAGE_LINE_CAP ? s.slice(0, MESSAGE_LINE_CAP - 1) + "…" : s;
 }
 const SAFE_ARG = /^[A-Za-z0-9_@%+=:,./-]+$/;
+const WIN_SAFE_ARG = /^[A-Za-z0-9_@+=:,./\\-]+$/;
+const WIN_META = /[()%!^"<>&|]/g;
 /**
- * Turn an argv into one POSIX shell command string. Every element is quoted
- * unless it is plainly safe, so `node -e 'console.log("a b")'` survives the
- * trip through /bin/sh. A single element is returned as written, so
+ * Turn an argv into one shell command string for the platform's shell.
+ * Every element is quoted unless it is plainly safe, so
+ * `node -e 'console.log("a b")'` survives the trip through /bin/sh, or
+ * through cmd.exe on Windows, where the quoting follows the rules the C
+ * runtime uses to split a command line and cmd's own metacharacters are
+ * escaped with `^`. A single element is returned as written, so
  * `graft evidence -- "npm test && npm run lint"` still runs through the shell.
+ * A redirect or pipe given as its own element is therefore a literal argument.
  */
-export function shellJoin(argv) {
+export function shellJoin(argv, platform = process.platform) {
     if (argv.length === 1)
         return argv[0];
-    return argv.map((a) => (SAFE_ARG.test(a) ? a : `'${a.replace(/'/g, `'\\''`)}'`)).join(" ");
+    const quote = platform === "win32" ? winQuote : posixQuote;
+    return argv.map(quote).join(" ");
+}
+function posixQuote(a) {
+    return SAFE_ARG.test(a) ? a : `'${a.replace(/'/g, `'\\''`)}'`;
+}
+function winQuote(a) {
+    if (WIN_SAFE_ARG.test(a))
+        return a;
+    // Backslashes only escape when they precede a quote, so double those runs
+    // and the trailing run, then escape quotes, then wrap in double quotes.
+    const inner = a.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/, "$1$1");
+    // cmd.exe reads the line before the program does; `^` makes it pass the
+    // metacharacters, including the quotes, through untouched.
+    return `"${inner}"`.replace(WIN_META, "^$&");
 }
 //# sourceMappingURL=record.js.map

package/dist/record.js.map

@@ -1 +1 @@
-{"version":3,"file":"record.js","sourceRoot":"","sources":["../src/record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA8D1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAExC,MAAM,WAAW,GAAG,kCAAkC,CAAC,CAAC,8BAA8B;AAEtF,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC1C,IAAI,CAAC,GAAG,GAAG,CAAC;IACZ,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,EAAE,GAAG,WAAW,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,OAAO,EAAE,GAAG,IAAI,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAoB;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,SAAS,CAAC,CAAC;IACvG,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAClD,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,MAAM,EAAE,cAAc;IACtB,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,cAAc;IACtB,KAAK,EAAE,aAAa;IACpB,QAAQ,EAAE,gBAAgB;CAClB,CAAC;AAEX,MAAM,UAAU,WAAW,CAAC,MAAoB;IAC9C,MAAM,CAAC,GAA4B;QACjC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAChC,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;KACrE,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK;QAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAE5C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAC3C,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,QAAoB;IAChD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,UAAU,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;QAClE,OAAO,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACtG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uGAAuG;AACvG,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,aAAa,GAAG,sDAAsD,CAAC;AAC7E,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,UAAkB;IACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAe,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACxE,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;QAChC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,EAAE,CAAC;gBACN,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACZ,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;;YACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3I,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtF,OAAO;QACL,OAAO,EAAE,CAAC;QACV,EAAE;QACF,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,EAAE,IAAI,IAAI,SAAS;QACvB,MAAM,EAAE;YACN,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;YAC1C,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS;YACjC,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,SAAS;SACjD;QACD,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,UAAU;QACpB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAe,EAAE,MAAc;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM;YAC3C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM;QAClC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CAAC,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7F,CAAC"}
+{"version":3,"file":"record.js","sourceRoot":"","sources":["../src/record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAmF1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAExC,MAAM,WAAW,GAAG,kCAAkC,CAAC,CAAC,8BAA8B;AAEtF,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC1C,IAAI,CAAC,GAAG,GAAG,CAAC;IACZ,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,EAAE,GAAG,WAAW,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,OAAO,EAAE,GAAG,IAAI,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAoB;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,SAAS,CAAC,CAAC;IACvG,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAClD,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,MAAM,EAAE,cAAc;IACtB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,gBAAgB;IACrB,MAAM,EAAE,cAAc;IACtB,QAAQ,EAAE,gBAAgB;CAClB,CAAC;AAEX,MAAM,UAAU,WAAW,CAAC,MAAoB;IAC9C,MAAM,CAAC,GAA4B;QACjC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAChC,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;KAC1C,CAAC;IACF,IAAI,MAAM,CAAC,GAAG;QAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAE5C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAC3C,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,QAAoB;IAChD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACzB,yGAAyG;QACzG,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,UAAU,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC/D,IAAI,EAAE,CAAC,QAAQ;YAAE,OAAO,cAAc,MAAM,GAAG,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;QAClE,OAAO,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACtG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uGAAuG;AACvG,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,aAAa,GAAG,iFAAiF,CAAC;AACxG,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,UAAkB;IACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAe,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACxE,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,QAAQ,IAAI,SAAS,CAAC;QACpC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnE,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9H,SAAS;QACX,CAAC;QACD,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,CAAC;YACN,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACZ,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/C,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9I,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtF,OAAO;QACL,OAAO,EAAE,CAAC;QACV,EAAE;QACF,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;QAC7C,GAAG,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,SAAS;QAC5C,IAAI,EAAE,IAAI,IAAI,SAAS;QACvB,MAAM,EAAE;YACN,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;YAC1C,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS;SAClC;QACD,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,UAAU;QACpB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAe,EAAE,MAAc;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM;YAC3C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM;QAClC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CAAC,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAC5C,MAAM,YAAY,GAAG,2BAA2B,CAAC;AACjD,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,IAAc,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACpF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;IAC3D,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAChE,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACnC,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxE,wEAAwE;IACxE,2DAA2D;IAC3D,OAAO,IAAI,KAAK,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC"}

package/dist/redact.d.ts

@@ -22,5 +22,12 @@ export declare function redact(text: string, env?: NodeJS.ProcessEnv): string;
  * file name anywhere in the tree, one with a slash is anchored at the root.
  */
 export declare function looksLikeSecretFile(path: string, extra?: string[]): boolean;
-/** Minimal glob: `**` spans directories, `*` and `?` stay within one segment. */
+/**
+ * The words of a shell command that name a credential file, so the output of
+ * `cat nova.json && go test ./...` is withheld from the record instead of
+ * copying the key into history. Quotes and `--flag=` prefixes are stripped;
+ * the split is on whitespace and shell operators, not a real parse.
+ */
+export declare function secretFilesNamed(command: string, extra?: string[]): string[];
+/** Minimal glob: `**` spans directories (`a/**` is everything under a), `*` and `?` stay within one segment. */
 export declare function globToRegExp(glob: string): RegExp;

package/dist/redact.js

@@ -51,14 +51,29 @@ export function looksLikeSecretFile(path, extra = []) {
         return false;
     return SECRET_FILE_PATTERNS.some((re) => re.test(p)) || extra.some((g) => globToRegExp(g).test(p));
 }
-/** Minimal glob: `**` spans directories, `*` and `?` stay within one segment. */
+/**
+ * The words of a shell command that name a credential file, so the output of
+ * `cat nova.json && go test ./...` is withheld from the record instead of
+ * copying the key into history. Quotes and `--flag=` prefixes are stripped;
+ * the split is on whitespace and shell operators, not a real parse.
+ */
+export function secretFilesNamed(command, extra = []) {
+    const words = command
+        .split(/[\s;&|<>()`=]+/)
+        .map((w) => w.replace(/^["']+|["']+$/g, ""))
+        .filter((w) => w && !w.startsWith("-"));
+    return [...new Set(words.filter((w) => looksLikeSecretFile(w, extra)))];
+}
+/** Minimal glob: `**` spans directories (`a/**` is everything under a), `*` and `?` stay within one segment. */
 export function globToRegExp(glob) {
     const body = glob
         .replace(/[.+^${}()|[\]\\]/g, "\\$&")
-        .replace(/\*\*\/?/g, "\u0000")
+        .replace(/\*\*\//g, "\u0000")
+        .replace(/\*\*/g, "\u0001")
         .replace(/\*/g, "[^/]*")
         .replace(/\?/g, "[^/]")
-        .replace(/\u0000/g, "(?:.*/)?");
+        .replace(/\u0000/g, "(?:.*/)?")
+        .replace(/\u0001/g, ".*");
     return new RegExp(glob.includes("/") ? `^${body}$` : `(^|/)${body}$`);
 }
 //# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -1 +1 @@
-{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,gFAAgF;AAChF,sDAAsD;AACtD,MAAM,eAAe,GAAG,4GAA4G,CAAC;AACrI,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,KAAK,GAAsC,EAAE,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB;YAAE,SAAS;QACzD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,MAAyB,OAAO,CAAC,GAAG;IACvE,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,oBAAoB,GAAa;IACrC,wBAAwB,EAAE,oCAAoC;IAC9D,oCAAoC;IACpC,2CAA2C;IAC3C,kDAAkD;IAClD,+BAA+B;CAChC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAkB,EAAE;IACpE,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,yCAAyC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,IAAI,GAAG,IAAI;SACd,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACpC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC;SAC7B,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAClC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;AACxE,CAAC"}
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,gFAAgF;AAChF,sDAAsD;AACtD,MAAM,eAAe,GAAG,4GAA4G,CAAC;AACrI,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,KAAK,GAAsC,EAAE,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB;YAAE,SAAS;QACzD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,MAAyB,OAAO,CAAC,GAAG;IACvE,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,oBAAoB,GAAa;IACrC,wBAAwB,EAAE,oCAAoC;IAC9D,oCAAoC;IACpC,2CAA2C;IAC3C,kDAAkD;IAClD,+BAA+B;CAChC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAkB,EAAE;IACpE,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,yCAAyC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACrG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,QAAkB,EAAE;IACpE,MAAM,KAAK,GAAG,OAAO;SAClB,KAAK,CAAC,gBAAgB,CAAC;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;SAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,IAAI,GAAG,IAAI;SACd,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACpC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC;SAC5B,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC;SAC1B,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC;SAC9B,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;AACxE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourshore/graft-core",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "description": "Graft change records on plain git: the record model, git plumbing, start/evidence/land/log.",
   "license": "MIT",
   "type": "module",