@gobing-ai/spur 0.4.2 → 0.4.4

package/plugins/sp/scripts/residual-scan.mjs

@@ -15,6 +15,32 @@ function getEnvVars() {
 // plugins/sp/lib/residual-scan.generated.mjs
 import { join } from "node:path";
 import { createHash } from "node:crypto";
+var CLAIM_MARKERS = [
+  /@[a-z0-9._-]+\/[a-z0-9._-]+/i,
+  /\bnode_modules\//,
+  /\b\d+\.\d+\.\d+\b/,
+  /`[A-Za-z_$][\w.$]*\s*\([^`]*\)`/
+];
+var CITATION_FORMS = [
+  /`[^`\s]+:\d+(?:-\d+)?`/,
+  /`[^`]+`\s+lines?\s+\d+/i,
+  /\b[\w./-]+\.[A-Za-z0-9]+:\d+(?:-\d+)?\b/,
+  /https?:\/\/\S+/i
+];
+function hasClaimMarker(evidence) {
+  return CLAIM_MARKERS.some((re) => re.test(evidence));
+}
+function hasCitationForm(evidence) {
+  return CITATION_FORMS.some((re) => re.test(evidence));
+}
+var CONFIDENCE_LEVELS = ["HIGH", "MEDIUM", "LOW"];
+function extractAnswerConfidence(text) {
+  const matches = [...text.matchAll(/^\s*Confidence:\s*(\S+)\s*$/gim)];
+  if (matches.length !== 1)
+    return;
+  const value = (matches[0]?.[1] ?? "").toUpperCase();
+  return CONFIDENCE_LEVELS.includes(value) ? value : undefined;
+}
 var MARKER_PATTERN = /TODO|FIXME|XXX|HACK/;
 var PRIORITY_PATTERN = /^P[1-4]/;
 var RANGE_PRIORITY = /^P[1-4]\s*[\u2013\u2014-]\s*P?[1-4]/;
@@ -41,11 +67,15 @@ function locationOf(locationCell, finding) {
   const backtick = finding.match(/`([^`]+)`/)?.[1];
   return backtick === undefined ? "" : normalizeAnchor(backtick);
 }
-function parseReviewFindings(taskContent) {
+function reviewBody(taskContent) {
   const section = taskContent.split(/^### Review\b/m)[1];
-  if (section === undefined)
+  return section === undefined ? null : section.split(/^### /m)[0] ?? "";
+}
+function parseReviewFindings(taskContent) {
+  const section = reviewBody(taskContent);
+  if (section === null)
     return [];
-  const body = section.split(/^### /m)[0] ?? "";
+  const body = section;
   const out = [];
   const lines = body.split(`
 `);
@@ -158,7 +188,8 @@ function scanResiduals(inputs) {
       "review-finding": true,
       "diff-marker": base !== null,
       "unchecked-box": true,
-      "staging-residue": true
+      "staging-residue": true,
+      "review-contract": false
     },
     items,
     counts
@@ -179,8 +210,61 @@ function blockingReviewFindings(taskContent, deferrals) {
   }));
   return classify(items, [...tableDeferrals, ...deferrals]);
 }
-function buildReviewGateArtifact(wbs, taskContent, deferrals) {
-  const items = blockingReviewFindings(taskContent, deferrals);
+function reviewContractViolations(taskContent) {
+  const violations = [];
+  const body = reviewBody(taskContent);
+  if (body !== null && extractAnswerConfidence(body.replace(/\*\*/g, "")) === undefined) {
+    violations.push({
+      location: "task-file:Review",
+      text: "Review report carries no single valid `**Confidence:** HIGH | MEDIUM | LOW` line — " + "state the level the report can defend (HIGH: every requirement row MET, every finding " + "dispositioned, evidence cited; MEDIUM/LOW: name the gap)."
+    });
+  }
+  for (const row of parseReviewFindings(taskContent)) {
+    if (hasClaimMarker(row.text) && !hasCitationForm(row.text)) {
+      violations.push({
+        location: row.location.length > 0 ? row.location : "task-file:Review",
+        text: `${row.priority} finding asserts an external API/library/version claim without a ` + "same-cell citation (add a repo `path:line`, an external named-origin form, or a URL " + `to the Finding cell): ${row.text.slice(0, 80)}`
+      });
+    }
+  }
+  return violations;
+}
+function reviewConfidenceViolation(reviewAnswer, ackLowConfidence) {
+  if (ackLowConfidence === "true")
+    return null;
+  const level = extractAnswerConfidence(reviewAnswer.replace(/\*\*/g, ""));
+  if (level === "HIGH" || level === "MEDIUM")
+    return null;
+  return {
+    location: "review-answer:Confidence",
+    text: level === undefined ? "The review answer carries no valid `**Confidence:** HIGH | MEDIUM | LOW` line — a " + "PASS must be graded, or the operator must set ackLowConfidence" : `The review answer graded its PASS ${level} — HIGH/MEDIUM cross unadorned, ` + "LOW/absent needs the operator’s ackLowConfidence"
+  };
+}
+function reviewGradingInput(root, reviewAnswer, ackLowConfidence, fs) {
+  if (reviewAnswer === undefined)
+    return;
+  const path = join(root, reviewAnswer);
+  let isFile = false;
+  try {
+    isFile = fs.statSync(path).isFile();
+  } catch {
+    isFile = false;
+  }
+  return { answer: isFile ? fs.readFileSync(path, "utf8") : "", ackLowConfidence };
+}
+function buildReviewGateArtifact(wbs, taskContent, deferrals, review) {
+  const confidence = review === undefined ? null : reviewConfidenceViolation(review.answer, review.ackLowConfidence);
+  const contractViolations = [...reviewContractViolations(taskContent), ...confidence === null ? [] : [confidence]];
+  const items = [
+    ...blockingReviewFindings(taskContent, deferrals),
+    ...contractViolations.map((v) => ({
+      id: makeItemId("review-contract", v.location, v.text),
+      category: "review-contract",
+      class: "blocking",
+      location: v.location,
+      text: v.text
+    }))
+  ];
   const blocking = items.filter((i) => i.class === "blocking");
   const counts = { blocking: 0, deferrable: 0, advisory: 0, housekeeping: 0 };
   for (const item of items)
@@ -192,7 +276,8 @@ function buildReviewGateArtifact(wbs, taskContent, deferrals) {
       "review-finding": true,
       "diff-marker": false,
       "unchecked-box": false,
-      "staging-residue": false
+      "staging-residue": false,
+      "review-contract": true
     },
     items,
     counts
@@ -305,6 +390,7 @@ function parseScanArgs(argv, cwd, defaultTmpDir) {
   let spurBin;
   let root = cwd;
   let tmpDir = defaultTmpDir;
+  let reviewAnswer;
   for (let i = 0;i < argv.length; i++) {
     const a = argv[i];
     if (a === undefined)
@@ -315,6 +401,8 @@ function parseScanArgs(argv, cwd, defaultTmpDir) {
       root = argv[++i] ?? root;
     else if (a === "--tmp-dir")
       tmpDir = argv[++i] ?? tmpDir;
+    else if (a === "--review-answer")
+      reviewAnswer = argv[++i];
     else if (a === "--help" || a === "-h")
       return null;
     else if (mode === "")
@@ -322,7 +410,7 @@ function parseScanArgs(argv, cwd, defaultTmpDir) {
     else if (wbs === "")
       wbs = a;
   }
-  return mode === "" || wbs === "" ? null : { mode, wbs, spurBin, root, tmpDir };
+  return mode === "" || wbs === "" ? null : { mode, wbs, spurBin, root, tmpDir, reviewAnswer };
 }
 
 // plugins/sp/lib/spur-bin.ts
@@ -332,7 +420,7 @@ function spurCommand(spurBin) {
 }
 
 // plugins/sp/scripts/residual-scan.ts
-var RESIDUAL_SCAN_USAGE = "usage: residual-scan.ts <scan|fold|settle|report|review-gate> <wbs> [--spur-bin <bin>] [--root <dir>] [--tmp-dir <dir>]";
+var RESIDUAL_SCAN_USAGE = "usage: residual-scan.ts <scan|fold|settle|report|review-gate> <wbs> [--spur-bin <bin>] [--root <dir>] [--tmp-dir <dir>] [--review-answer <path>]";
 function run(cmd, args, cwd) {
   const result = spawnSync(cmd, args, { cwd, encoding: "utf8" });
   if (result.error !== undefined)
@@ -427,7 +515,8 @@ function reviewGateMode(opts, env, io) {
   const runDir = join2(opts.root, ".spur", "run");
   fs.mkdirSync(runDir, { recursive: true });
   const { content } = loadTask(env, opts.spurBin, opts.wbs, opts.root);
-  const gate = buildReviewGateArtifact(opts.wbs, content, readDeferrals(runDir, opts.wbs));
+  const grading = reviewGradingInput(opts.root, opts.reviewAnswer, env.ackLowConfidence, fs);
+  const gate = buildReviewGateArtifact(opts.wbs, content, readDeferrals(runDir, opts.wbs), grading);
   fs.writeFileSync(join2(runDir, `${opts.wbs}-residuals.json`), `${JSON.stringify(gate.artifact, null, 2)}
 `);
   io.out(gate.note);
@@ -518,6 +607,12 @@ function settleMode(opts, env, io) {
 }
 function reportMode(opts, env, io) {
   const runDir = join2(opts.root, ".spur", "run");
+  const verdictPath = recordedVerdictPath(runDir, opts.wbs, fs);
+  if (!fs.existsSync(verdictPath)) {
+    io.err(`residual-report: no verdict at ${verdictPath}; nothing to report for ${opts.wbs}
+`);
+    return 0;
+  }
   const sweep = loadVerdict(runDir, opts.wbs).checks.find((c) => c.name === "residual-sweep");
   if (sweep === undefined || sweep.status !== "fail")
     return 0;
@@ -556,26 +651,29 @@ function main(argv, env = getEnvVars(), options = {}) {
 }
 process.exit(main(process.argv.slice(2)));
 export {
-  verdictDisagreementNote,
-  scanResiduals2 as scanResiduals,
-  renderReport,
-  recordedVerdictPath,
-  parseScanArgs,
-  parseReviewFindings,
-  parseDiffMarkers,
-  parseDeferralEntries,
-  normalizeAnchor,
-  makeItemId,
-  main,
-  locationOf,
-  listStagingResidue,
-  foldVerdict,
-  findUncheckedBoxes,
-  collectAddedLines,
-  classify,
-  buildReviewGateArtifact,
-  blockingReviewFindings,
-  blockingAnchors,
+  ALLOW_PRAGMA,
   RESIDUAL_SCAN_USAGE,
-  ALLOW_PRAGMA
+  blockingAnchors,
+  blockingReviewFindings,
+  buildReviewGateArtifact,
+  classify,
+  collectAddedLines,
+  findUncheckedBoxes,
+  foldVerdict,
+  listStagingResidue,
+  locationOf,
+  main,
+  makeItemId,
+  normalizeAnchor,
+  parseDeferralEntries,
+  parseDiffMarkers,
+  parseReviewFindings,
+  parseScanArgs,
+  recordedVerdictPath,
+  renderReport,
+  reviewConfidenceViolation,
+  reviewContractViolations,
+  reviewGradingInput,
+  scanResiduals2 as scanResiduals,
+  verdictDisagreementNote
 };

package/plugins/sp/scripts/residual-scan.ts

@@ -10,7 +10,7 @@ import { spurCommand } from '../lib/spur-bin';
 
 export * from '../lib/residual-scan.generated.mjs';
 export const RESIDUAL_SCAN_USAGE =
-    'usage: residual-scan.ts <scan|fold|settle|report|review-gate> <wbs> [--spur-bin <bin>] [--root <dir>] [--tmp-dir <dir>]';
+    'usage: residual-scan.ts <scan|fold|settle|report|review-gate> <wbs> [--spur-bin <bin>] [--root <dir>] [--tmp-dir <dir>] [--review-answer <path>]';
 export type ScanEnv = { spurBin?: string } & Record<string, string | undefined>;
 export type ScanIo = { out: (line: string) => void; err: (line: string) => void };
 export type ScanOptions = { cwd?: string; io?: ScanIo };
@@ -104,18 +104,18 @@ function scanMode(opts: ParsedArgs, env: ScanEnv, io: ScanIo): number {
     return 0;
 }
 /**
- * Task 1122 R2: the review-time gate — the record sweep's review-finding slice with the same
- * parse/classify/deferrals (core.buildReviewGateArtifact), applied at the review PASS edges
- * before verify spends the cycle. Writes the same `<wbs>-residuals.json` artifact the test-fix
- * hop already appends to the gate log (its remediation input); the record sweep stays the final
- * authority and overwrites it. Exit 1 on an open P1-P3 finding fails the review PASS edge closed
- * into review-fail-triage.
+ * Task 1122 R2: the review-time gate — the record sweep's review-finding slice
+ * (core.buildReviewGateArtifact) at the review PASS edges; writes the same `<wbs>-residuals.json`
+ * the test-fix hop reads. Exit 1 on an open P1-P3 finding, or on a review answer graded LOW or left
+ * ungraded without `env.ackLowConfidence` (task 1204, graded via `core.reviewGradingInput` — it
+ * cannot sit inline in the edge because ADR-115 caps a guard at 5 logical commands).
  */
 function reviewGateMode(opts: ParsedArgs, env: ScanEnv, io: ScanIo): number {
     const runDir = join(opts.root, '.spur', 'run');
     fs.mkdirSync(runDir, { recursive: true });
     const { content } = loadTask(env, opts.spurBin, opts.wbs, opts.root);
-    const gate = core.buildReviewGateArtifact(opts.wbs, content, readDeferrals(runDir, opts.wbs));
+    const grading = core.reviewGradingInput(opts.root, opts.reviewAnswer, env.ackLowConfidence, fs);
+    const gate = core.buildReviewGateArtifact(opts.wbs, content, readDeferrals(runDir, opts.wbs), grading);
     fs.writeFileSync(join(runDir, `${opts.wbs}-residuals.json`), `${JSON.stringify(gate.artifact, null, 2)}\n`);
     io.out(gate.note);
     return gate.artifact.counts.blocking > 0 ? 1 : 0;
@@ -162,11 +162,8 @@ function settleMode(opts: ParsedArgs, env: ScanEnv, io: ScanIo): number {
     if (fs.existsSync(residualsPath)) prior = JSON.parse(fs.readFileSync(residualsPath, 'utf8'));
     const deferred = scan.items.filter((i) => i.class === 'deferrable');
     if (deferred.length > 0 && prior.followUp === undefined) {
-        // The follow-up is filed UNLINKED: carrying a feature edge to the feature whose run produced
-        // it made that feature's done-gate fail with `L4.verifying-incomplete-tasks` the moment a
-        // residual was deferred (2026-10-04 session, E72/1086→1087), so a deferral must not be able
-        // to block the completing feature. The source task and its feature stay named in the
-        // Background, which keeps the traceability without the lifecycle coupling.
+        // Filed UNLINKED: a feature edge failed that feature's done-gate (`L4.verifying-incomplete-tasks`,
+        // E72/1086→1087); the Background still names the source task and feature for traceability.
         const args = ['task', 'create', `Residuals from ${wbs}`, '--skip-ready', '--json'];
         const created = spur(env, opts.spurBin, args, opts.root);
         let wbsNew = '';
@@ -206,6 +203,12 @@ function settleMode(opts: ParsedArgs, env: ScanEnv, io: ScanIo): number {
 }
 function reportMode(opts: ParsedArgs, env: ScanEnv, io: ScanIo): number {
     const runDir = join(opts.root, '.spur', 'run');
+    // A fix-budget-exhausted run never reaches verify: no verdict is a no-op, not ENOENT (1178 run 1).
+    const verdictPath = core.recordedVerdictPath(runDir, opts.wbs, fs);
+    if (!fs.existsSync(verdictPath)) {
+        io.err(`residual-report: no verdict at ${verdictPath}; nothing to report for ${opts.wbs}\n`);
+        return 0;
+    }
     const sweep = loadVerdict(runDir, opts.wbs).checks.find((c) => c.name === 'residual-sweep');
     if (sweep === undefined || sweep.status !== 'fail') return 0;
     const { content } = loadTask(env, opts.spurBin, opts.wbs, opts.root);

package/plugins/sp/scripts/run-summary.mjs

@@ -13,13 +13,16 @@ function getEnvVars() {
 import { existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join as join2 } from "node:path";
 
-// plugins/sp/lib/transcript.ts
-import { existsSync, readdirSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-var SESSION_ID = /^[A-Za-z0-9_-]+$/;
-var OPERATOR_TOOLS = new Set(["AskUserQuestion", "ask_user_question"]);
-var PI_ROLES = new Set(["user", "assistant", "toolResult"]);
+// plugins/sp/lib/env.ts
+function getEnvVars2() {
+  return process.env;
+}
+
+// plugins/sp/lib/plan-projection.generated.mjs
+var NON_ABORTING_PREFLIGHT_CODES = new Set([
+  "L4.scenario-unverified",
+  "L4.verifying-incomplete-tasks"
+]);
 var zeroTokens = () => ({ input: 0, cacheCreate: 0, cacheRead: 0, output: 0 });
 function formatDuration(ms) {
   const s = Math.round(ms / 1000);
@@ -39,6 +42,26 @@ function formatTokenSplit(t) {
   const nonCached = t.input + t.cacheCreate + t.output;
   return `${formatTokens(nonCached + t.cacheRead)} / ${formatTokens(nonCached)}`;
 }
+var OPERATOR_TOOLS = new Set(["AskUserQuestion", "ask_user_question"]);
+function isCompaction(row) {
+  return row.type === "compaction" || row.type === "system" && row.subtype === "compact_boundary";
+}
+function firstTextContent(row) {
+  const content = row.message?.content;
+  if (typeof content === "string")
+    return content;
+  if (!Array.isArray(content))
+    return;
+  return content.find((b) => b.type === "text")?.text;
+}
+function skillInvocationPrompt(text) {
+  const name = /^\s*<skill name="([^"]+)"/.exec(text)?.[1];
+  if (name === undefined)
+    return;
+  const close = text.lastIndexOf("</skill>");
+  const args = close < 0 ? "" : text.slice(close + "</skill>".length).trim();
+  return args === "" ? `/${name}` : `/${name} ${args}`;
+}
 function promptText(row) {
   if (row.type === "custom_message") {
     if (row.display === false)
@@ -63,22 +86,6 @@ function promptText(row) {
     return;
   return content.find((b) => b.type === "text")?.text;
 }
-function firstTextContent(row) {
-  const content = row.message?.content;
-  if (typeof content === "string")
-    return content;
-  if (!Array.isArray(content))
-    return;
-  return content.find((b) => b.type === "text")?.text;
-}
-function skillInvocationPrompt(text) {
-  const name = /^\s*<skill name="([^"]+)"/.exec(text)?.[1];
-  if (name === undefined)
-    return;
-  const close = text.lastIndexOf("</skill>");
-  const args = close < 0 ? "" : text.slice(close + "</skill>".length).trim();
-  return args === "" ? `/${name}` : `/${name} ${args}`;
-}
 function sumTokens(all) {
   const total = zeroTokens();
   for (const t of all)
@@ -107,21 +114,21 @@ function accumulate(acc, row, ts) {
   if (row.type === "message") {
     const m = row.message;
     if (m?.role === "assistant") {
-      const blocks2 = Array.isArray(m.content) ? m.content : [];
-      for (const b of blocks2) {
+      const blocks = Array.isArray(m.content) ? m.content : [];
+      for (const b of blocks) {
         if (b.type === "toolCall" && b.id) {
           acc.toolIds.add(b.id);
           if (b.name && OPERATOR_TOOLS.has(b.name))
             acc.asks.set(b.id, ts);
         }
       }
-      const u2 = m.usage;
-      if (u2 && row.id)
+      const u = m.usage;
+      if (u && row.id)
         acc.messages.set(row.id, {
-          input: u2.input ?? 0,
-          cacheCreate: u2.cacheWrite ?? 0,
-          cacheRead: u2.cacheRead ?? 0,
-          output: u2.output ?? 0
+          input: u.input ?? 0,
+          cacheCreate: u.cacheWrite ?? 0,
+          cacheRead: u.cacheRead ?? 0,
+          output: u.output ?? 0
         });
     } else if (m?.role === "toolResult" && m.toolCallId && acc.asks.has(m.toolCallId)) {
       acc.askMs += ts - (acc.asks.get(m.toolCallId) ?? ts);
@@ -150,77 +157,14 @@ function accumulate(acc, row, ts) {
     });
   }
 }
-function isCompaction(row) {
-  return row.type === "compaction" || row.type === "system" && row.subtype === "compact_boundary";
-}
-function sniffFormat(rows) {
-  for (const row of rows) {
-    if (row.type === "message" && PI_ROLES.has(row.message?.role ?? ""))
-      return "pi";
-    if (row.type === "user" || row.type === "assistant")
-      return "claude";
-  }
-  return "unknown";
-}
-function parseRows(lines) {
-  const rows = [];
-  let skippedLines = 0;
-  for (const line of lines) {
-    if (!line.trim())
-      continue;
-    let row;
-    try {
-      row = JSON.parse(line);
-    } catch {
-      skippedLines++;
-      continue;
-    }
-    const ts = row.timestamp ? Date.parse(row.timestamp) : Number.NaN;
-    if (!Number.isNaN(ts))
-      rows.push([row, ts]);
-  }
-  return { rows, skippedLines, format: sniffFormat(rows.map(([r]) => r)) };
-}
-function resolveTranscript(env, projectsRoot = join(homedir(), ".claude", "projects"), override) {
-  if (override)
-    return existsSync(override) ? { ok: true, path: override } : { ok: false, reason: "no transcript" };
-  const id = env.CLAUDE_CODE_SESSION_ID;
-  if (!id) {
-    const piFile = env.PI_SESSION_FILE;
-    if (piFile !== undefined && piFile !== "") {
-      return existsSync(piFile) ? { ok: true, path: piFile } : { ok: false, reason: `PI_SESSION_FILE ${piFile} does not exist` };
-    }
-    return {
-      ok: false,
-      reason: "no host session id; pass --transcript <path> (pi: ~/.pi/agent/sessions/<cwd-slug>/<file>.jsonl, " + "or set PI_SESSION_FILE)"
-    };
-  }
-  if (!SESSION_ID.test(id))
-    return { ok: false, reason: "refusing a session id with path characters" };
-  if (!existsSync(projectsRoot))
-    return { ok: false, reason: `no transcript root ${projectsRoot}` };
-  for (const dir of readdirSync(projectsRoot)) {
-    const path = join(projectsRoot, dir, `${id}.jsonl`);
-    if (existsSync(path))
-      return { ok: true, path };
-  }
-  return { ok: false, reason: `no transcript for session ${id}` };
-}
-
-// plugins/sp/lib/env.ts
-function getEnvVars2() {
-  return process.env;
-}
-
-// plugins/sp/lib/run-summary-core.ts
 var IDLE_GAP_MS = 300000;
 var SHELL_TOOLS = new Set(["bash", "shell", "exec", "exec_command", "run_command", "command"]);
 var SUBAGENT_TOOLS = new Set(["agent", "task", "invoke_subagent", "subagent", "dispatch_agent"]);
-var OPERATOR_TOOLS2 = new Set(["askuserquestion", "ask_user_question"]);
+var LOWERCASE_OPERATOR_TOOLS = new Set(["askuserquestion", "ask_user_question"]);
 var ACTOR_PRECEDENCE = ["operator", "subagent", "shell", "other"];
 function actorOf(tool) {
   const t = tool.toLowerCase().replace(/[^a-z_]/g, "");
-  if (OPERATOR_TOOLS2.has(t))
+  if (LOWERCASE_OPERATOR_TOOLS.has(t))
     return "operator";
   if (SUBAGENT_TOOLS.has(t))
     return "subagent";
@@ -370,7 +314,8 @@ function summaryRow(stage, status, span, measured) {
     token: formatTokenSplit(measured ? span.tokens : null)
   };
 }
-function buildRunSummary(lines, inputs, since, until) {
+function buildRunSummary(rows, inputs, opts = {}) {
+  const { since, until } = opts;
   const windows = [];
   for (const { label, progress } of inputs) {
     const states = (progress.states ?? []).flatMap((s) => {
@@ -396,7 +341,6 @@ function buildRunSummary(lines, inputs, since, until) {
     }
   }
   windows.sort((a, b) => a.start - b.start);
-  const { rows, skippedLines } = parseRows(lines);
   const measure = (start, end) => {
     const acc = newAcc(start);
     for (const [row, ts] of rows)
@@ -444,9 +388,87 @@ function buildRunSummary(lines, inputs, since, until) {
     total,
     actors: actorSplit(rows, totalStart, totalEnd),
     gate: { ms: null, reason: "no matching check receipt" },
-    skippedLines
+    skippedLines: opts.skippedLines ?? 0
   };
 }
+var SENSITIVE_PREFIXES = ["drizzle/", "packages/config/", ".github/", "plugins/sp/hooks/"];
+var SENSITIVE_GLOBS = ["apps/server/src/**/auth*", "**/*secret*", "**/*.sql"];
+function globToRegex(glob) {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replaceAll("**/", "\x00").replaceAll("**", "\x01").replaceAll("*", "[^/]*").replaceAll("\x00", "(?:.*/)?").replaceAll("\x01", ".*");
+  return new RegExp(`^${escaped}$`, "s");
+}
+var SENSITIVE_MATCHERS = [
+  ...SENSITIVE_PREFIXES.map((prefix) => ({
+    label: prefix,
+    test: (path) => path.startsWith(prefix)
+  })),
+  ...SENSITIVE_GLOBS.map((glob) => {
+    const regex = globToRegex(glob);
+    return { label: glob, test: (path) => regex.test(path) };
+  })
+];
+
+// plugins/sp/lib/transcript.ts
+import { existsSync, readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var SESSION_ID = /^[A-Za-z0-9_-]+$/;
+var PI_ROLES = new Set(["user", "assistant", "toolResult"]);
+function sniffFormat(rows) {
+  for (const row of rows) {
+    if (row.type === "message" && PI_ROLES.has(row.message?.role ?? ""))
+      return "pi";
+    if (row.type === "user" || row.type === "assistant")
+      return "claude";
+  }
+  return "unknown";
+}
+function parseRows(lines) {
+  const rows = [];
+  let skippedLines = 0;
+  for (const line of lines) {
+    if (!line.trim())
+      continue;
+    let row;
+    try {
+      row = JSON.parse(line);
+    } catch {
+      skippedLines++;
+      continue;
+    }
+    const ts = row.timestamp ? Date.parse(row.timestamp) : Number.NaN;
+    if (!Number.isNaN(ts))
+      rows.push([row, ts]);
+  }
+  return { rows, skippedLines, format: sniffFormat(rows.map(([r]) => r)) };
+}
+function resolveTranscript(env, projectsRoot = join(homedir(), ".claude", "projects"), override) {
+  if (override)
+    return existsSync(override) ? { ok: true, path: override } : { ok: false, reason: "no transcript" };
+  const id = env.CLAUDE_CODE_SESSION_ID;
+  if (!id) {
+    const piFile = env.PI_SESSION_FILE;
+    if (piFile !== undefined && piFile !== "") {
+      return existsSync(piFile) ? { ok: true, path: piFile } : { ok: false, reason: `PI_SESSION_FILE ${piFile} does not exist` };
+    }
+    return {
+      ok: false,
+      reason: "no host session id; pass --transcript <path> (pi: ~/.pi/agent/sessions/<cwd-slug>/<file>.jsonl, " + "or set PI_SESSION_FILE)"
+    };
+  }
+  if (!SESSION_ID.test(id))
+    return { ok: false, reason: "refusing a session id with path characters" };
+  if (!existsSync(projectsRoot))
+    return { ok: false, reason: `no transcript root ${projectsRoot}` };
+  for (const dir of readdirSync(projectsRoot)) {
+    const path = join(projectsRoot, dir, `${id}.jsonl`);
+    if (existsSync(path))
+      return { ok: true, path };
+  }
+  return { ok: false, reason: `no transcript for session ${id}` };
+}
+
+// plugins/sp/lib/run-summary-core.ts
 function renderSummaryMarkdown(summary) {
   const line = (r, bold = false) => {
     const stage = bold ? `**${r.stage}**` : r.stage;
@@ -547,9 +569,13 @@ function writeCloseSummary(run, opts = {}) {
     const resolved = resolveTranscript(opts.env ?? getEnvVars2(), opts.projectsRoot);
     if (!resolved.ok)
       return na(resolved.reason);
-    const lines = readFileSync(resolved.path, "utf8").split(`
-`);
-    const summary = buildRunSummary(lines, [{ progress: run.progress }], run.startedAt, run.completedAt);
+    const { rows, skippedLines } = parseRows(readFileSync(resolved.path, "utf8").split(`
+`));
+    const summary = buildRunSummary(rows, [{ progress: run.progress }], {
+      since: run.startedAt,
+      until: run.completedAt,
+      skippedLines
+    });
     if (summary.rows.length === 0)
       return na("no timed attempts");
     mkdirSync(runDir, { recursive: true });
@@ -583,8 +609,35 @@ import { existsSync as existsSync3, readdirSync as readdirSync2 } from "node:fs"
 import { homedir as homedir2 } from "node:os";
 import { join as join3 } from "node:path";
 var SESSION_ID2 = /^[A-Za-z0-9_-]+$/;
-var OPERATOR_TOOLS3 = new Set(["AskUserQuestion", "ask_user_question"]);
 var PI_ROLES2 = new Set(["user", "assistant", "toolResult"]);
+function sniffFormat2(rows) {
+  for (const row of rows) {
+    if (row.type === "message" && PI_ROLES2.has(row.message?.role ?? ""))
+      return "pi";
+    if (row.type === "user" || row.type === "assistant")
+      return "claude";
+  }
+  return "unknown";
+}
+function parseRows2(lines) {
+  const rows = [];
+  let skippedLines = 0;
+  for (const line of lines) {
+    if (!line.trim())
+      continue;
+    let row;
+    try {
+      row = JSON.parse(line);
+    } catch {
+      skippedLines++;
+      continue;
+    }
+    const ts = row.timestamp ? Date.parse(row.timestamp) : Number.NaN;
+    if (!Number.isNaN(ts))
+      rows.push([row, ts]);
+  }
+  return { rows, skippedLines, format: sniffFormat2(rows.map(([r]) => r)) };
+}
 function resolveTranscript2(env, projectsRoot = join3(homedir2(), ".claude", "projects"), override) {
   if (override)
     return existsSync3(override) ? { ok: true, path: override } : { ok: false, reason: "no transcript" };
@@ -679,8 +732,9 @@ function main(argv, env = getEnvVars(), write = (s) => process.stdout.write(s),
       const [label, file] = eq > 0 ? [arg.slice(0, eq), arg.slice(eq + 1)] : [undefined, arg];
       return { label, progress: JSON.parse(readFileSync2(file, "utf8")) };
     });
-    const summary = buildRunSummary(readFileSync2(resolved.path, "utf8").split(`
-`), inputs, since);
+    const { rows, skippedLines } = parseRows2(readFileSync2(resolved.path, "utf8").split(`
+`));
+    const summary = buildRunSummary(rows, inputs, { since, skippedLines });
     summary.gate = gateFromReceipt(process.cwd(), inputs[0]?.progress.runId ?? "");
     write(`${markdown ? renderSummaryMarkdown(summary) : JSON.stringify({ ...summary, transcript: resolved.path })}
 `);
@@ -693,12 +747,12 @@ function main(argv, env = getEnvVars(), write = (s) => process.stdout.write(s),
 }
 process.exit(main(process.argv.slice(2)));
 export {
-  writeCloseSummary,
-  renderSummaryMarkdown,
-  renderRollupMarkdown,
-  main,
-  gateFromReceipt,
-  buildRunSummary,
+  RUN_SUMMARY_USAGE,
   actorSplit,
-  RUN_SUMMARY_USAGE
+  buildRunSummary,
+  gateFromReceipt,
+  main,
+  renderRollupMarkdown,
+  renderSummaryMarkdown,
+  writeCloseSummary
 };