@haystackeditor/cli 0.25.1 → 0.26.0

package/dist/commands/prepare-universe-review.js

@@ -1,1092 +0,0 @@
-import { createHash } from 'node:crypto';
-import { chmodSync, mkdirSync, mkdtempSync, realpathSync, writeFileSync, } from 'node:fs';
-import { execFileSync } from 'node:child_process';
-import { tmpdir } from 'node:os';
-import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from 'node:path';
-import { CUSTOMER_REPLICA_PRODUCTION_SOURCE_DENY_POLICY, isCustomerReplicaProductionSourceDeniedPath, } from './production-source-deny-policy.js';
-import { findGitRoot } from '../utils/hooks.js';
-const MANIFEST_NAME = 'manifest.json';
-const MAX_INLINE_SCAN_BYTES = CUSTOMER_REPLICA_PRODUCTION_SOURCE_DENY_POLICY.inlineTestScan
-    .maximumTextFileBytes;
-const COMPACT_RECEIPT_SAMPLE_LIMIT = 20;
-const MAX_SNAPSHOT_ENTRY_COUNT = 100_000;
-const MAX_SNAPSHOT_OUTPUT_BYTES = 1024 * 1024 * 1024;
-const MAX_GIT_BLOB_BATCH_BYTES = 32 * 1024 * 1024;
-const MAX_GIT_BLOB_BATCH_ENTRIES = 512;
-const GIT_NO_LAZY_FETCH_ENV = { ...process.env, GIT_NO_LAZY_FETCH: '1' };
-const DENIED_COMPONENTS = [
-    '.git',
-    '.haystack',
-    '.nyc_output',
-    '.pytest_cache',
-    '__tests__',
-    'acceptance-test',
-    'acceptance-tests',
-    'acceptance_test',
-    'acceptance_tests',
-    'cypress',
-    'e2e',
-    'integration-test',
-    'integration-tests',
-    'integration_test',
-    'integration_tests',
-    'playwright',
-    'playwright-report',
-    'system-test',
-    'system-tests',
-    'system_test',
-    'system_tests',
-    'test',
-    'test-data',
-    'test-results',
-    'testdata',
-    'tests',
-];
-const DENIED_COMPONENT_SET = new Set(DENIED_COMPONENTS);
-const CONDITIONAL_COMPONENTS = [
-    'spec',
-    'specs',
-    'fixtures',
-    '__fixtures__',
-    'mocks',
-    '__mocks__',
-    'snapshots',
-    '__snapshots__',
-];
-const DENIED_BASENAME_GLOBS = [
-    '*.test.{js,jsx,ts,tsx,mjs,cjs}',
-    '*.spec.{js,jsx,ts,tsx,mjs,cjs,rb}',
-    '*.e2e.{js,jsx,ts,tsx}',
-    '*.e2e-spec.{js,jsx,ts,tsx}',
-    'test-*.{js,jsx,ts,tsx,py,rb,go,rs}',
-    '*-test.{js,jsx,ts,tsx,py,rb,go,rs}',
-    '*_test.{py,go,rs,cc,cpp}',
-    '*_tests.{py,rb}',
-    'test_*.py',
-    '*_unittest.{cc,cpp,py}',
-    '*Test.{java,kt,kts,scala,groovy,cs,php,swift}',
-    '*Tests.{java,kt,kts,scala,groovy,cs,php,swift}',
-    '*ITCase.{java,kt,kts,scala,groovy,cs,php,swift}',
-    '*.{snap,golden,approved}',
-    '{jest,vitest,playwright,cypress}.config.*',
-    'karma.conf.*',
-    'mocha.config.*',
-    'pytest.ini',
-    'tox.ini',
-    '.coveragerc',
-    'junit*.xml',
-];
-const JS_EXTENSIONS = new Set(['js', 'jsx', 'ts', 'tsx', 'mjs', 'cjs']);
-const TEST_PREFIX_EXTENSIONS = new Set([...JS_EXTENSIONS, 'py', 'rb', 'go', 'rs']);
-const JVM_TEST_EXTENSIONS = new Set([
-    'java',
-    'kt',
-    'kts',
-    'scala',
-    'groovy',
-    'cs',
-    'php',
-    'swift',
-]);
-const EXACT_TEST_FILE_NAMES = new Set([
-    '.coveragerc',
-    'pytest.ini',
-    'tox.ini',
-]);
-function splitStemAndExtension(name) {
-    const dot = name.lastIndexOf('.');
-    if (dot <= 0 || dot === name.length - 1)
-        return { stem: name, extension: '' };
-    return { stem: name.slice(0, dot), extension: name.slice(dot + 1).toLowerCase() };
-}
-function isTypedTestBasename(path) {
-    const name = basename(path);
-    const lowerName = name.toLowerCase();
-    const { stem, extension } = splitStemAndExtension(name);
-    const lowerStem = stem.toLowerCase();
-    if (JS_EXTENSIONS.has(extension) && /\.(?:test|e2e|e2e-spec)$/i.test(stem))
-        return true;
-    if ((JS_EXTENSIONS.has(extension) || extension === 'rb') && /\.spec$/i.test(stem))
-        return true;
-    if (TEST_PREFIX_EXTENSIONS.has(extension) &&
-        (lowerStem.startsWith('test-') || lowerStem.endsWith('-test')))
-        return true;
-    if (new Set(['py', 'go', 'rs', 'cc', 'cpp']).has(extension) &&
-        lowerStem.endsWith('_test'))
-        return true;
-    if (new Set(['py', 'rb']).has(extension) && lowerStem.endsWith('_tests'))
-        return true;
-    if (extension === 'py' && lowerStem.startsWith('test_'))
-        return true;
-    if (new Set(['cc', 'cpp', 'py']).has(extension) && lowerStem.endsWith('_unittest'))
-        return true;
-    if (JVM_TEST_EXTENSIONS.has(extension) &&
-        (stem.endsWith('Test') || stem.endsWith('Tests') || stem.endsWith('ITCase')))
-        return true;
-    if (new Set(['snap', 'golden', 'approved']).has(extension))
-        return true;
-    if (/^(?:jest|vitest|playwright|cypress)\.config\..+$/i.test(name))
-        return true;
-    if (/^karma\.conf\..+$/i.test(name) || /^mocha\.config\..+$/i.test(name))
-        return true;
-    if (EXACT_TEST_FILE_NAMES.has(lowerName))
-        return true;
-    return /^junit.*\.xml$/i.test(name);
-}
-/**
- * These rules intentionally match conventional path components and filename
- * shapes. They never apply a broad `*test*` substring match: names such as
- * latest.ts, contest.ts, and attestation.py remain visible.
- */
-const EXCLUSION_RULES = [
-    {
-        id: CUSTOMER_REPLICA_PRODUCTION_SOURCE_DENY_POLICY.policyId,
-        description: 'exclude paths selected by the canonical reviewed production-source policy',
-        matches: isCustomerReplicaProductionSourceDeniedPath,
-    },
-];
-const APPROVED_INACTIVE_SUBMODULE_RULE = {
-    id: 'approved-inactive-submodule-omission',
-    description: 'omit only exact normalized tracked gitlink paths explicitly approved as inactive',
-};
-const INLINE_MARKER_RULES = [
-    {
-        id: 'rust-cfg-test',
-        description: 'Rust cfg(test) module',
-        expression: /^[ \t]*#[ \t]*\[[ \t]*cfg[ \t]*\([ \t]*test[ \t]*\)[ \t]*\]/m,
-    },
-    {
-        id: 'zig-inline-test',
-        description: 'Zig inline test declaration',
-        expression: /^[ \t]*test[ \t]+"[^"]+"[ \t]*\{/m,
-    },
-    {
-        id: 'vitest-import-meta',
-        description: 'Vitest import.meta.vitest inline-test hook',
-        expression: /\bimport\.meta\.vitest\b/,
-    },
-    {
-        id: 'deno-inline-test',
-        description: 'Deno.test inline-test registration',
-        expression: /\bDeno\.test\s*\(/,
-    },
-    {
-        id: 'bun-inline-test',
-        description: 'Bun.test inline-test registration',
-        expression: /\bBun\.test\s*\(/,
-    },
-    {
-        id: 'c-unit-test-conditional',
-        description: 'C/C++ UNIT_TEST preprocessor block',
-        expression: /^[ \t]*#[ \t]*ifn?def[ \t]+UNIT_TESTS?\b/m,
-    },
-    {
-        id: 'rust-test-attribute',
-        description: 'Rust test function attribute',
-        expression: /^[ \t]*#[ \t]*\[[ \t]*(?:[A-Za-z_][A-Za-z0-9_]*::)*test[ \t]*\]/m,
-        extensions: new Set(['rs']),
-    },
-    {
-        id: 'jvm-test-annotation',
-        description: 'JVM @Test method annotation',
-        expression: /^[ \t]*@(?:org\.junit(?:\.jupiter\.api)?\.)?Test\b/m,
-        extensions: new Set(['java', 'kt', 'kts', 'scala', 'groovy']),
-    },
-    {
-        id: 'dotnet-test-attribute',
-        description: '.NET xUnit Fact or Theory attribute',
-        expression: /^[ \t]*\[[ \t]*(?:Fact|Theory)[ \t]*(?:\([^\]\r\n]*\))?[ \t]*\]/m,
-        extensions: new Set(['cs']),
-    },
-    {
-        id: 'xctest-case',
-        description: 'XCTestCase subclass declaration',
-        expression: /^[ \t]*(?:final[ \t]+)?(?:class|@interface)[^\r\n:{]*:[ \t]*XCTestCase\b/m,
-        extensions: new Set(['swift', 'm', 'mm']),
-    },
-    {
-        id: 'python-unittest-case',
-        description: 'Python unittest.TestCase subclass',
-        expression: /^[ \t]*class[ \t]+[A-Za-z_][A-Za-z0-9_]*[ \t]*\([^\r\n)]*\bunittest\.TestCase\b[^\r\n)]*\)[ \t]*:/m,
-        extensions: new Set(['py']),
-    },
-    {
-        id: 'python-test-function',
-        description: 'Python unittest or pytest test function registration',
-        expression: /^[ \t]*(?:async[ \t]+)?def[ \t]+test_[A-Za-z0-9_]*[ \t]*\(/m,
-        extensions: new Set(['py']),
-    },
-];
-/**
- * Symlink outcomes that must stop the review.
- *
- * A link that resolves outside the repository, into an excluded path, to an
- * absolute location, ambiguously, or in a cycle is a containment question and
- * blocks. A link whose target simply is not a retained tracked file is not: the
- * resolver already declines to materialize it, so the snapshot never contains
- * it. Blocking on that as well made the reviewer unreachable on ordinary
- * monorepos — one holdout repository had 74 such links, all build-tree
- * conveniences pointing at generated or untracked paths.
- */
-const BLOCKING_SYMLINK_REASONS = new Set([
-    'absolute-target',
-    'target-escapes-repository',
-    'target-is-excluded',
-    'target-cycle',
-    'ambiguous-target',
-    'unreadable-link',
-]);
-function parseHeadTreeEntries(raw) {
-    return raw
-        .toString('utf8')
-        .split('\0')
-        .filter(Boolean)
-        .map((record) => {
-        const tab = record.indexOf('\t');
-        const metadata = tab >= 0 ? record.slice(0, tab) : '';
-        const path = tab >= 0 ? record.slice(tab + 1) : '';
-        const [mode = '', , objectId = ''] = metadata.split(' ');
-        return { mode, objectId, stage: '0', path };
-    });
-}
-function readTrackedWorktreeChanges(root, revision) {
-    const output = execFileSync('git', [
-        'diff-index',
-        '--raw',
-        '-z',
-        '--no-ext-diff',
-        '--no-renames',
-        '--ignore-submodules=all',
-        revision,
-        '--',
-    ], {
-        cwd: root,
-        encoding: 'buffer',
-        env: GIT_NO_LAZY_FETCH_ENV,
-        stdio: ['ignore', 'pipe', 'pipe'],
-        maxBuffer: 64 * 1024 * 1024,
-    });
-    const fields = output.toString('utf8').split('\0');
-    const changes = [];
-    for (let index = 0; index < fields.length - 1; index += 2) {
-        const metadata = fields[index] ?? '';
-        const path = fields[index + 1] ?? '';
-        const match = /^:(\d{6}) (\d{6}) [0-9a-f]+ [0-9a-f]+ ([A-Z])$/.exec(metadata);
-        if (!match || path.length === 0)
-            continue;
-        const [, headMode, worktreeMode, status] = match;
-        let reason;
-        if (status === 'D' || worktreeMode === '000000') {
-            reason = 'tracked file is missing from the working tree';
-        }
-        else if (headMode !== worktreeMode || status === 'T') {
-            reason = `tracked working-tree type or executable mode differs from Git HEAD (${headMode} -> ${worktreeMode})`;
-        }
-        else if (headMode === '120000') {
-            reason = 'tracked symlink target differs from Git HEAD';
-        }
-        else {
-            reason = 'tracked working-tree content differs from Git HEAD';
-        }
-        changes.push({ path, reason });
-    }
-    return changes;
-}
-function createLocalGitBlobReader(root, entries, recordUnavailable) {
-    const blobEntries = entries.filter((entry) => entry.mode === '100644' || entry.mode === '100755' || entry.mode === '120000');
-    const objectIds = [...new Set(blobEntries.map((entry) => entry.objectId))];
-    const blobInfo = new Map();
-    const unavailableReason = (objectId) => `Git HEAD blob ${objectId} is unavailable locally while lazy fetching is disabled`;
-    if (objectIds.length > 0) {
-        try {
-            const output = execFileSync('git', ['cat-file', '--batch-check'], {
-                cwd: root,
-                encoding: 'utf8',
-                env: GIT_NO_LAZY_FETCH_ENV,
-                input: `${objectIds.join('\n')}\n`,
-                stdio: ['pipe', 'pipe', 'pipe'],
-                maxBuffer: Math.max(1024 * 1024, objectIds.length * 160),
-            });
-            const lines = output.trimEnd().split('\n');
-            for (const [index, objectId] of objectIds.entries()) {
-                const line = lines[index] ?? '';
-                const match = /^([0-9a-f]+) blob ([0-9]+)$/.exec(line);
-                const size = match ? Number(match[2]) : Number.NaN;
-                if (!match ||
-                    match[1] !== objectId ||
-                    !Number.isSafeInteger(size) ||
-                    size < 0) {
-                    blobInfo.set(objectId, {
-                        kind: 'unavailable',
-                        reason: unavailableReason(objectId),
-                    });
-                    continue;
-                }
-                blobInfo.set(objectId, { kind: 'available', size });
-            }
-        }
-        catch {
-            for (const objectId of objectIds) {
-                blobInfo.set(objectId, {
-                    kind: 'unavailable',
-                    reason: unavailableReason(objectId),
-                });
-            }
-        }
-    }
-    const batches = [];
-    let pendingObjectIds = [];
-    let pendingBytes = 0;
-    const flushBatch = () => {
-        if (pendingObjectIds.length === 0)
-            return;
-        batches.push({ objectIds: pendingObjectIds, payloadBytes: pendingBytes });
-        pendingObjectIds = [];
-        pendingBytes = 0;
-    };
-    for (const objectId of objectIds) {
-        const info = blobInfo.get(objectId);
-        if (!info || info.kind !== 'available')
-            continue;
-        if (pendingObjectIds.length > 0 &&
-            (pendingObjectIds.length >= MAX_GIT_BLOB_BATCH_ENTRIES ||
-                pendingBytes + info.size > MAX_GIT_BLOB_BATCH_BYTES)) {
-            flushBatch();
-        }
-        pendingObjectIds.push(objectId);
-        pendingBytes += info.size;
-    }
-    flushBatch();
-    const batchIndexByObjectId = new Map();
-    for (const [batchIndex, batch] of batches.entries()) {
-        for (const objectId of batch.objectIds)
-            batchIndexByObjectId.set(objectId, batchIndex);
-    }
-    const cachedBatches = new Map();
-    const failedBatches = new Set();
-    const loadBatch = (batchIndex) => {
-        const cached = cachedBatches.get(batchIndex);
-        if (cached) {
-            cachedBatches.delete(batchIndex);
-            cachedBatches.set(batchIndex, cached);
-            return cached;
-        }
-        if (failedBatches.has(batchIndex))
-            return null;
-        const batch = batches[batchIndex];
-        if (!batch)
-            return null;
-        try {
-            const output = execFileSync('git', ['cat-file', '--batch'], {
-                cwd: root,
-                encoding: 'buffer',
-                env: GIT_NO_LAZY_FETCH_ENV,
-                input: Buffer.from(`${batch.objectIds.join('\n')}\n`, 'utf8'),
-                stdio: ['pipe', 'pipe', 'pipe'],
-                maxBuffer: batch.payloadBytes + batch.objectIds.length * 160 + 1024,
-            });
-            const contentsByObjectId = new Map();
-            let cursor = 0;
-            for (const expectedObjectId of batch.objectIds) {
-                const headerEnd = output.indexOf(0x0a, cursor);
-                if (headerEnd < 0)
-                    throw new Error('truncated Git cat-file header');
-                const header = output.toString('utf8', cursor, headerEnd);
-                const match = /^([0-9a-f]+) blob ([0-9]+)$/.exec(header);
-                const size = match ? Number(match[2]) : Number.NaN;
-                if (!match ||
-                    match[1] !== expectedObjectId ||
-                    !Number.isSafeInteger(size) ||
-                    size < 0) {
-                    throw new Error('unexpected Git cat-file response');
-                }
-                const contentsStart = headerEnd + 1;
-                const contentsEnd = contentsStart + size;
-                if (contentsEnd >= output.length || output[contentsEnd] !== 0x0a) {
-                    throw new Error('truncated Git cat-file payload');
-                }
-                contentsByObjectId.set(expectedObjectId, output.subarray(contentsStart, contentsEnd));
-                cursor = contentsEnd + 1;
-            }
-            if (cursor !== output.length)
-                throw new Error('unexpected trailing Git cat-file output');
-            cachedBatches.set(batchIndex, contentsByObjectId);
-            while (cachedBatches.size > 2) {
-                const oldest = cachedBatches.keys().next().value;
-                if (oldest === undefined)
-                    break;
-                cachedBatches.delete(oldest);
-            }
-            return contentsByObjectId;
-        }
-        catch {
-            failedBatches.add(batchIndex);
-            return null;
-        }
-    };
-    const inspect = (path, entry) => {
-        const info = blobInfo.get(entry.objectId);
-        const batchIndex = batchIndexByObjectId.get(entry.objectId);
-        if (!info || info.kind !== 'available' || batchIndex === undefined) {
-            recordUnavailable(path, info?.kind === 'unavailable' ? info.reason : unavailableReason(entry.objectId));
-            return null;
-        }
-        return { size: info.size, batchIndex };
-    };
-    return {
-        size(path, entry) {
-            return inspect(path, entry)?.size ?? null;
-        },
-        read(path, entry) {
-            const inspected = inspect(path, entry);
-            if (!inspected)
-                return null;
-            const contents = loadBatch(inspected.batchIndex)?.get(entry.objectId);
-            if (!contents) {
-                recordUnavailable(path, unavailableReason(entry.objectId));
-                return null;
-            }
-            return contents;
-        },
-    };
-}
-function constrainedLimit(value, hardLimit, label) {
-    if (value === undefined)
-        return hardLimit;
-    if (!Number.isSafeInteger(value) || value <= 0 || value > hardLimit) {
-        throw new Error(`${label} must be a positive safe integer no greater than ${hardLimit}`);
-    }
-    return value;
-}
-const CONDITIONAL_EXCLUSION_RULE = {
-    id: 'detected-framework-roots',
-    description: 'when a test framework is detected, exclude repository-root spec/specs and fixture/mock/snapshot components below a detected test root',
-    matches: (path) => {
-        const components = path.split('/').map((component) => component.toLowerCase());
-        if (components[0] === 'spec' || components[0] === 'specs')
-            return true;
-        const testRootIndex = components.findIndex((component) => DENIED_COMPONENT_SET.has(component));
-        return (testRootIndex >= 0 &&
-            components.some((component, index) => index > testRootIndex &&
-                CONDITIONAL_COMPONENTS.includes(component)));
-    },
-};
-function exclusionFor(path, conditionalFrameworkRootsActive) {
-    const direct = EXCLUSION_RULES.find((rule) => rule.matches(path));
-    if (direct)
-        return direct;
-    return conditionalFrameworkRootsActive && CONDITIONAL_EXCLUSION_RULE.matches(path)
-        ? CONDITIONAL_EXCLUSION_RULE
-        : undefined;
-}
-function detectsTestFramework(entries, readVerifiedContents) {
-    if (entries.some((entry) => basename(entry.path).toLowerCase() === '.rspec')) {
-        return true;
-    }
-    const rootSpecTestBasename = /(?:[_.](?:spec|test)|^spec_helper)\.(?:rb|js|jsx|ts|tsx|mjs|cjs)$/i;
-    if (entries.some((entry) => {
-        const components = entry.path.split('/');
-        return ((components[0]?.toLowerCase() === 'spec' ||
-            components[0]?.toLowerCase() === 'specs') &&
-            (isTypedTestBasename(entry.path) || rootSpecTestBasename.test(basename(entry.path))));
-    })) {
-        return true;
-    }
-    const frameworkFiles = new Map([
-        ['package.json', /\b(?:jest|mocha)\b/i],
-        ['gemfile', /\brspec\b/i],
-        ['gemfile.lock', /\brspec\b/i],
-        ['pyproject.toml', /\bpytest\b/i],
-    ]);
-    return entries.some((entry) => {
-        const marker = frameworkFiles.get(basename(entry.path).toLowerCase());
-        if (!marker || (entry.mode !== '100644' && entry.mode !== '100755'))
-            return false;
-        const contents = readVerifiedContents(entry.path, entry);
-        return contents !== null &&
-            contents.length <= MAX_INLINE_SCAN_BYTES &&
-            marker.test(contents.toString('utf8'));
-    });
-}
-function isInside(root, candidate) {
-    const rel = relative(root, candidate);
-    return rel === '' || (!rel.startsWith(`..${sep}`) && rel !== '..' && !isAbsolute(rel));
-}
-function fileSystemPath(root, gitPath) {
-    return resolve(root, ...gitPath.split('/'));
-}
-function representativeSample(values, fullReceipt) {
-    if (fullReceipt || values.length <= COMPACT_RECEIPT_SAMPLE_LIMIT)
-        return [...values];
-    const headCount = Math.ceil(COMPACT_RECEIPT_SAMPLE_LIMIT / 2);
-    const tailCount = COMPACT_RECEIPT_SAMPLE_LIMIT - headCount;
-    return [...values.slice(0, headCount), ...values.slice(-tailCount)];
-}
-function collectionSummary(total, returned) {
-    return { total, returned, truncated: total - returned };
-}
-function inlineCandidates(path, contents) {
-    if (contents.includes(0) || contents.length > MAX_INLINE_SCAN_BYTES)
-        return [];
-    const text = contents.toString('utf8');
-    const extension = splitStemAndExtension(basename(path)).extension;
-    const found = INLINE_MARKER_RULES.some((rule) => {
-        if (rule.extensions && !rule.extensions.has(extension))
-            return false;
-        rule.expression.lastIndex = 0;
-        return rule.expression.test(text);
-    });
-    return found ? [{ path }] : [];
-}
-function readTrackedEntries(root, revision) {
-    const output = execFileSync('git', ['ls-tree', '-r', '-z', '--full-tree', revision], {
-        cwd: root,
-        encoding: 'buffer',
-        env: GIT_NO_LAZY_FETCH_ENV,
-        stdio: ['ignore', 'pipe', 'pipe'],
-        maxBuffer: 256 * 1024 * 1024,
-    });
-    return parseHeadTreeEntries(output);
-}
-function approvedInactiveSubmodulePaths(requestedPaths, trackedEntries) {
-    const gitlinks = new Set(trackedEntries
-        .filter((entry) => entry.stage === '0' && entry.mode === '160000')
-        .map((entry) => entry.path));
-    const approved = new Set();
-    for (const requestedPath of requestedPaths) {
-        const normalized = posix.normalize(requestedPath);
-        const unsafe = requestedPath.length === 0 ||
-            requestedPath.includes('\0') ||
-            requestedPath.includes('\\') ||
-            requestedPath.endsWith('/') ||
-            normalized !== requestedPath ||
-            normalized === '.' ||
-            normalized === '..' ||
-            normalized.startsWith('../') ||
-            posix.isAbsolute(requestedPath) ||
-            isAbsolute(requestedPath) ||
-            /^[A-Za-z]:/.test(requestedPath);
-        if (unsafe) {
-            throw new Error(`inactive submodule approval must be an exact normalized repository-relative POSIX path: ${JSON.stringify(requestedPath)}`);
-        }
-        if (!gitlinks.has(requestedPath)) {
-            throw new Error(`inactive submodule approval is not a tracked Git submodule: ${JSON.stringify(requestedPath)}`);
-        }
-        approved.add(requestedPath);
-    }
-    return [...approved].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
-}
-function resolveMaterializedSymlink(root, sourcePath, outputPath, retainedEntries, conditionalFrameworkRootsActive, symlinkIssues, readRegularEntry, readSymlinkTarget) {
-    const seen = new Set();
-    let currentPath = sourcePath;
-    let firstTarget = '';
-    for (;;) {
-        if (seen.has(currentPath)) {
-            symlinkIssues.push({
-                path: sourcePath,
-                target: firstTarget,
-                reason: 'target-cycle',
-            });
-            return null;
-        }
-        seen.add(currentPath);
-        const currentEntry = retainedEntries.get(currentPath);
-        if (!currentEntry) {
-            const prefix = currentPath === '' ? '' : `${currentPath}/`;
-            const descendants = [...retainedEntries.entries()]
-                .filter(([path]) => prefix === '' || path.startsWith(prefix))
-                .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
-            if (descendants.length === 0) {
-                symlinkIssues.push({
-                    path: sourcePath,
-                    target: firstTarget,
-                    reason: 'target-is-not-retained-file',
-                });
-                return null;
-            }
-            if (prefix === '' || sourcePath === currentPath || sourcePath.startsWith(prefix)) {
-                symlinkIssues.push({
-                    path: sourcePath,
-                    target: firstTarget,
-                    reason: 'target-cycle',
-                });
-                return null;
-            }
-            return {
-                kind: 'directory',
-                targetPath: currentPath,
-                descendants,
-                firstTarget,
-            };
-        }
-        if (currentEntry.mode !== '120000') {
-            if (currentEntry.mode !== '100644' && currentEntry.mode !== '100755') {
-                symlinkIssues.push({
-                    path: sourcePath,
-                    target: firstTarget,
-                    reason: 'target-is-not-retained-file',
-                });
-                return null;
-            }
-            const regular = readRegularEntry(currentPath, currentEntry, outputPath);
-            if (!regular)
-                return null;
-            return {
-                kind: 'file',
-                contents: regular.contents,
-                targetPath: currentPath,
-                targetMode: regular.mode,
-                firstTarget,
-            };
-        }
-        const target = readSymlinkTarget(currentPath, currentEntry);
-        if (target === null)
-            return null;
-        if (currentPath === sourcePath)
-            firstTarget = target;
-        if (isAbsolute(target)) {
-            symlinkIssues.push({ path: sourcePath, target: firstTarget, reason: 'absolute-target' });
-            return null;
-        }
-        const resolvedTarget = resolve(root, dirname(currentPath), target);
-        if (!isInside(root, resolvedTarget)) {
-            symlinkIssues.push({
-                path: sourcePath,
-                target: firstTarget,
-                reason: 'target-escapes-repository',
-            });
-            return null;
-        }
-        const relativeTarget = relative(root, resolvedTarget).split(sep).join('/');
-        if (exclusionFor(relativeTarget, conditionalFrameworkRootsActive)) {
-            symlinkIssues.push({
-                path: sourcePath,
-                target: firstTarget,
-                reason: 'target-is-excluded',
-            });
-            return null;
-        }
-        currentPath = relativeTarget;
-    }
-}
-export function prepareUniverseReview(root, options = {}) {
-    const omitUnscannable = options.omitUnscannableFiles === true;
-    const repositoryRoot = realpathSync(root);
-    const sourceCommit = execFileSync('git', ['rev-parse', '--verify', 'HEAD^{commit}'], {
-        cwd: repositoryRoot,
-        encoding: 'utf8',
-        env: GIT_NO_LAZY_FETCH_ENV,
-        stdio: ['ignore', 'pipe', 'pipe'],
-    }).trim();
-    const trackedEntries = readTrackedEntries(repositoryRoot, sourceCommit);
-    const maxSnapshotEntries = constrainedLimit(options.limits?.maxSnapshotEntries, MAX_SNAPSHOT_ENTRY_COUNT, 'limits.maxSnapshotEntries');
-    const maxSnapshotOutputBytes = constrainedLimit(options.limits?.maxSnapshotOutputBytes, MAX_SNAPSHOT_OUTPUT_BYTES, 'limits.maxSnapshotOutputBytes');
-    const approvedSubmodulePaths = approvedInactiveSubmodulePaths(options.excludeInactiveSubmodules ?? [], trackedEntries);
-    const approvedSubmodulePathSet = new Set(approvedSubmodulePaths);
-    const exclusions = [];
-    const submodules = [];
-    const approvedSubmodules = [];
-    const missingOrChangedType = [];
-    const changedPathKeys = new Set();
-    const recordTrackedChange = (path, reason) => {
-        const key = `${path}\0${reason}`;
-        if (changedPathKeys.has(key))
-            return;
-        changedPathKeys.add(key);
-        missingOrChangedType.push({ path, reason });
-    };
-    const dirtyTrackedPaths = new Set();
-    const recordWorktreeChanges = () => {
-        for (const change of readTrackedWorktreeChanges(repositoryRoot, sourceCommit)) {
-            dirtyTrackedPaths.add(change.path);
-            recordTrackedChange(change.path, change.reason);
-        }
-    };
-    recordWorktreeChanges();
-    const localHeadBlobs = createLocalGitBlobReader(repositoryRoot, trackedEntries, recordTrackedChange);
-    const readHeadRegularContents = (path, entry) => {
-        if (dirtyTrackedPaths.has(path))
-            return null;
-        if (entry.mode !== '100644' && entry.mode !== '100755') {
-            recordTrackedChange(path, `unsupported Git mode ${entry.mode}`);
-            return null;
-        }
-        return localHeadBlobs.read(path, entry);
-    };
-    const readHeadSymlinkTarget = (path, entry) => {
-        if (dirtyTrackedPaths.has(path))
-            return null;
-        if (entry.mode !== '120000') {
-            recordTrackedChange(path, `unsupported Git mode ${entry.mode}`);
-            return null;
-        }
-        const contents = localHeadBlobs.read(path, entry);
-        return contents?.toString('utf8') ?? null;
-    };
-    const conditionalFrameworkRootsActive = detectsTestFramework(trackedEntries, readHeadRegularContents);
-    const scratchRoot = mkdtempSync(join(tmpdir(), 'haystack-universe-review-'));
-    chmodSync(scratchRoot, 0o700);
-    const snapshotRoot = join(scratchRoot, 'repository');
-    mkdirSync(snapshotRoot, { mode: 0o700 });
-    const symlinkIssues = [];
-    const candidates = [];
-    const inlineScanSkipped = [];
-    const retainedEntries = new Map();
-    for (const entry of trackedEntries) {
-        if (entry.mode === '160000') {
-            if (approvedSubmodulePathSet.has(entry.path)) {
-                approvedSubmodules.push(entry);
-                exclusions.push({
-                    path: entry.path,
-                    rule_id: APPROVED_INACTIVE_SUBMODULE_RULE.id,
-                });
-            }
-            else {
-                submodules.push(entry);
-            }
-            continue;
-        }
-        const rule = exclusionFor(entry.path, conditionalFrameworkRootsActive);
-        if (rule) {
-            exclusions.push({ path: entry.path, rule_id: rule.id });
-        }
-        else if (entry.stage !== '0') {
-            missingOrChangedType.push({
-                path: entry.path,
-                reason: `unmerged Git index stage ${entry.stage}`,
-            });
-        }
-        else {
-            retainedEntries.set(entry.path, entry);
-        }
-    }
-    const manifestEntries = [];
-    const materializedPaths = new Set();
-    const omittedUnscannable = [];
-    const snapshotLimitBlockers = [];
-    const snapshotLimitKinds = new Set();
-    let copiedBytes = 0;
-    let symlinksMaterialized = 0;
-    const recordSnapshotLimit = (kind, path, limit, attempted, reason) => {
-        if (snapshotLimitKinds.has(kind))
-            return;
-        snapshotLimitKinds.add(kind);
-        snapshotLimitBlockers.push({ kind, path, limit, attempted, reason });
-    };
-    if (retainedEntries.size > maxSnapshotEntries) {
-        const firstBlockedPath = [...retainedEntries.keys()].sort()[maxSnapshotEntries] ?? '(snapshot)';
-        recordSnapshotLimit('entry-count', firstBlockedPath, maxSnapshotEntries, retainedEntries.size, 'retained HEAD entries exceed the deterministic snapshot entry ceiling');
-    }
-    const canMaterialize = (outputPath, size) => {
-        if (snapshotLimitBlockers.length > 0)
-            return false;
-        const attemptedEntries = manifestEntries.length + 1;
-        if (attemptedEntries > maxSnapshotEntries) {
-            recordSnapshotLimit('entry-count', outputPath, maxSnapshotEntries, attemptedEntries, 'materialized snapshot entries exceed the deterministic entry ceiling');
-            return false;
-        }
-        const attemptedBytes = copiedBytes + size;
-        if (attemptedBytes > maxSnapshotOutputBytes) {
-            recordSnapshotLimit('total-output-bytes', outputPath, maxSnapshotOutputBytes, attemptedBytes, 'materialized snapshot bytes exceed the deterministic output ceiling');
-            return false;
-        }
-        return true;
-    };
-    const materializeFile = (outputPath, mode, contents, kind, linkTarget) => {
-        const destination = fileSystemPath(snapshotRoot, outputPath);
-        if (!isInside(snapshotRoot, destination) || materializedPaths.has(outputPath)) {
-            missingOrChangedType.push({
-                path: outputPath,
-                reason: materializedPaths.has(outputPath)
-                    ? 'ambiguous materialized destination'
-                    : 'unsafe tracked path',
-            });
-            return;
-        }
-        if (!canMaterialize(outputPath, contents.length))
-            return;
-        materializedPaths.add(outputPath);
-        // Decide before writing. A file whose test content cannot be ruled out is
-        // omitted from the snapshot rather than blocking the whole review: omitting
-        // it satisfies the same guarantee — the reviewer never sees a test — and it
-        // is recorded, so the omission is visible rather than silent. Blocking
-        // instead made the reviewer unreachable on most real repositories.
-        //
-        // Binary detection stays ahead of the size guard: large binary assets are
-        // safe to retain and do not make inline-test isolation unknown.
-        const isBinary = contents.includes(0);
-        if (!isBinary && omitUnscannable) {
-            if (contents.length > MAX_INLINE_SCAN_BYTES) {
-                inlineScanSkipped.push({
-                    path: outputPath,
-                    reason: 'file exceeds inline scan size limit',
-                });
-                omittedUnscannable.push({
-                    path: outputPath,
-                    reason: 'text file too large to rule out inline tests',
-                });
-                return;
-            }
-            const found = inlineCandidates(outputPath, contents);
-            if (found.length > 0) {
-                candidates.push(...found);
-                omittedUnscannable.push({
-                    path: outputPath,
-                    reason: 'inline test declaration detected',
-                });
-                return;
-            }
-        }
-        mkdirSync(dirname(destination), { recursive: true, mode: 0o700 });
-        writeFileSync(destination, contents, { mode: mode === '100755' ? 0o700 : 0o600 });
-        manifestEntries.push({
-            path: outputPath,
-            mode,
-            kind,
-            size: contents.length,
-            sha256: createHash('sha256').update(contents).digest('hex'),
-            ...(linkTarget === undefined ? {} : { link_target: linkTarget }),
-        });
-        copiedBytes += contents.length;
-        if (isBinary) {
-            inlineScanSkipped.push({ path: outputPath, reason: 'binary file' });
-        }
-        else if (!omitUnscannable) {
-            if (contents.length > MAX_INLINE_SCAN_BYTES) {
-                inlineScanSkipped.push({
-                    path: outputPath,
-                    reason: 'file exceeds inline scan size limit',
-                });
-            }
-            else {
-                candidates.push(...inlineCandidates(outputPath, contents));
-            }
-        }
-    };
-    const readRegularEntry = (path, entry, outputPath = path) => {
-        if (entry.mode !== '100644' && entry.mode !== '100755') {
-            missingOrChangedType.push({ path, reason: `unsupported Git mode ${entry.mode}` });
-            return null;
-        }
-        const size = localHeadBlobs.size(path, entry);
-        if (size === null || !canMaterialize(outputPath, size))
-            return null;
-        const contents = readHeadRegularContents(path, entry);
-        return contents === null ? null : { contents, mode: entry.mode };
-    };
-    for (const [gitPath, entry] of [...retainedEntries.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
-        if (dirtyTrackedPaths.has(gitPath) || snapshotLimitBlockers.length > 0)
-            continue;
-        if (entry.mode === '120000') {
-            const resolved = resolveMaterializedSymlink(repositoryRoot, gitPath, gitPath, retainedEntries, conditionalFrameworkRootsActive, symlinkIssues, readRegularEntry, readHeadSymlinkTarget);
-            if (!resolved)
-                continue;
-            symlinksMaterialized += 1;
-            if (resolved.kind === 'file') {
-                materializeFile(gitPath, resolved.targetMode, resolved.contents, 'materialized-symlink', resolved.firstTarget);
-                continue;
-            }
-            const aliasEntries = resolved.descendants.map(([targetPath, targetEntry]) => {
-                const suffix = targetPath.slice(resolved.targetPath === '' ? 0 : resolved.targetPath.length + 1);
-                return {
-                    outputPath: `${gitPath}/${suffix}`,
-                    targetPath,
-                    targetEntry,
-                };
-            });
-            const excludedAlias = aliasEntries.find(({ outputPath }) => exclusionFor(outputPath, conditionalFrameworkRootsActive));
-            if (excludedAlias) {
-                symlinkIssues.push({
-                    path: gitPath,
-                    target: resolved.firstTarget,
-                    reason: 'target-is-excluded',
-                });
-                continue;
-            }
-            for (const alias of aliasEntries) {
-                if (alias.targetEntry.mode === '120000') {
-                    const nested = resolveMaterializedSymlink(repositoryRoot, alias.targetPath, alias.outputPath, retainedEntries, conditionalFrameworkRootsActive, symlinkIssues, readRegularEntry, readHeadSymlinkTarget);
-                    if (!nested)
-                        continue;
-                    if (nested.kind === 'directory') {
-                        symlinkIssues.push({
-                            path: alias.targetPath,
-                            target: nested.firstTarget,
-                            reason: 'ambiguous-target',
-                        });
-                        continue;
-                    }
-                    materializeFile(alias.outputPath, nested.targetMode, nested.contents, 'materialized-symlink', nested.firstTarget);
-                    continue;
-                }
-                const regular = readRegularEntry(alias.targetPath, alias.targetEntry, alias.outputPath);
-                if (regular) {
-                    materializeFile(alias.outputPath, regular.mode, regular.contents, 'materialized-symlink', resolved.firstTarget);
-                }
-            }
-            continue;
-        }
-        const regular = readRegularEntry(gitPath, entry);
-        if (regular)
-            materializeFile(gitPath, regular.mode, regular.contents, 'file');
-    }
-    // Catch tracked changes that raced the initial status check. Snapshot payloads
-    // come only from sourceCommit's local Git blobs, never from working-tree bytes.
-    recordWorktreeChanges();
-    const finalHead = execFileSync('git', ['rev-parse', '--verify', 'HEAD^{commit}'], {
-        cwd: repositoryRoot,
-        encoding: 'utf8',
-        env: GIT_NO_LAZY_FETCH_ENV,
-        stdio: ['ignore', 'pipe', 'pipe'],
-    }).trim();
-    if (finalHead !== sourceCommit) {
-        recordTrackedChange('(repository HEAD)', `repository HEAD changed during snapshot (${sourceCommit} -> ${finalHead})`);
-    }
-    const compareText = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
-    exclusions.sort((a, b) => compareText(a.path, b.path));
-    symlinkIssues.sort((a, b) => compareText(a.path, b.path));
-    candidates.sort((a, b) => compareText(a.path, b.path));
-    inlineScanSkipped.sort((a, b) => compareText(a.path, b.path));
-    missingOrChangedType.sort((a, b) => compareText(a.path, b.path));
-    snapshotLimitBlockers.sort((a, b) => compareText(a.path, b.path));
-    const binaryInlineScanSkips = inlineScanSkipped.filter((entry) => entry.reason === 'binary file');
-    const blockingInlineScanSkips = inlineScanSkipped.filter((entry) => entry.reason !== 'binary file');
-    const returnedExclusions = representativeSample(exclusions, options.fullReceipt === true);
-    const returnedApprovedSubmodulePaths = representativeSample(approvedSubmodulePaths, options.fullReceipt === true);
-    const returnedBinaryInlineScanSkips = representativeSample(binaryInlineScanSkips, options.fullReceipt === true);
-    const returnedInlineScanSkips = [
-        ...returnedBinaryInlineScanSkips,
-        ...blockingInlineScanSkips,
-    ].sort((a, b) => compareText(a.path, b.path));
-    const activeRules = [
-        ...EXCLUSION_RULES,
-        ...(conditionalFrameworkRootsActive ? [CONDITIONAL_EXCLUSION_RULE] : []),
-        ...(approvedSubmodulePaths.length > 0 ? [APPROVED_INACTIVE_SUBMODULE_RULE] : []),
-    ].map(({ id, description }) => ({ id, description }));
-    const activatedConditionalRuleIds = conditionalFrameworkRootsActive
-        ? [CONDITIONAL_EXCLUSION_RULE.id]
-        : [];
-    const blockingSymlinkIssues = symlinkIssues.filter((issue) => BLOCKING_SYMLINK_REASONS.has(issue.reason));
-    const omittedSymlinks = symlinkIssues.filter((issue) => !BLOCKING_SYMLINK_REASONS.has(issue.reason));
-    const manifestDocument = {
-        version: 1,
-        source_commit: sourceCommit,
-        policy: {
-            rules: activeRules,
-            denied_components: DENIED_COMPONENTS,
-            denied_basename_globs: DENIED_BASENAME_GLOBS,
-            conditional_components: CONDITIONAL_COMPONENTS,
-            activated_conditional_rule_ids: activatedConditionalRuleIds,
-            approved_inactive_submodule_omissions: {
-                rule: APPROVED_INACTIVE_SUBMODULE_RULE,
-                paths: approvedSubmodulePaths,
-            },
-            substring_test_matching: false,
-            snapshot_limits: {
-                max_entries: maxSnapshotEntries,
-                max_output_bytes: maxSnapshotOutputBytes,
-            },
-        },
-        audit_receipt: {
-            exclusions,
-            submodules_omitted: submodules.map((entry) => entry.path).sort(compareText),
-            approved_inactive_submodule_omissions: approvedSubmodulePaths,
-            symlink_issues: blockingSymlinkIssues,
-            omitted_symlinks: omittedSymlinks,
-            omitted_unscannable: omittedUnscannable,
-            missing_or_changed_type: missingOrChangedType,
-            inline_test_candidates: candidates,
-            inline_scan_skipped: inlineScanSkipped,
-            snapshot_limit_blockers: snapshotLimitBlockers,
-        },
-        entries: manifestEntries,
-    };
-    const manifestBytes = Buffer.from(`${JSON.stringify(manifestDocument, null, 2)}\n`, 'utf8');
-    const manifestPath = join(scratchRoot, MANIFEST_NAME);
-    writeFileSync(manifestPath, manifestBytes, { mode: 0o600 });
-    const blocked = (!omitUnscannable && candidates.length > 0) ||
-        (!omitUnscannable && blockingInlineScanSkips.length > 0) ||
-        blockingSymlinkIssues.length > 0 ||
-        missingOrChangedType.length > 0 ||
-        submodules.length > 0 ||
-        snapshotLimitBlockers.length > 0;
-    return {
-        status: blocked ? 'blocked' : 'ready-for-confinement',
-        path: snapshotRoot,
-        process_confinement_required: true,
-        counts: {
-            tracked: trackedEntries.length,
-            retained: retainedEntries.size,
-            copied: manifestEntries.length,
-            excluded: exclusions.length,
-            submodules_omitted: submodules.length,
-            approved_inactive_submodules_omitted: approvedSubmodules.length,
-            symlinks_materialized: symlinksMaterialized,
-            symlink_issues: blockingSymlinkIssues.length,
-            symlinks_omitted_target_not_retained: omittedSymlinks.length,
-            omitted_unscannable: omittedUnscannable.length,
-            missing_or_changed_type: missingOrChangedType.length,
-            inline_test_candidates: candidates.length,
-            inline_scan_skipped: inlineScanSkipped.length,
-            binary_inline_scan_skipped: binaryInlineScanSkips.length,
-            oversized_text_inline_scan_blockers: blockingInlineScanSkips.length,
-            snapshot_limit_blockers: snapshotLimitBlockers.length,
-            copied_bytes: copiedBytes,
-        },
-        exclusions: returnedExclusions,
-        submodules_omitted: submodules.map((entry) => entry.path).sort(compareText),
-        approved_inactive_submodule_omissions: {
-            rule: APPROVED_INACTIVE_SUBMODULE_RULE,
-            paths: returnedApprovedSubmodulePaths,
-        },
-        rules: activeRules,
-        activated_conditional_rule_ids: activatedConditionalRuleIds,
-        inline_marker_rules: INLINE_MARKER_RULES.map(({ id, description }) => ({
-            id,
-            description,
-        })),
-        symlink_issues: blockingSymlinkIssues,
-        omitted_symlinks: omittedSymlinks,
-        omitted_unscannable: omittedUnscannable,
-        missing_or_changed_type: missingOrChangedType,
-        inline_test_candidates: candidates,
-        inline_scan_skipped: returnedInlineScanSkips,
-        snapshot_limit_blockers: snapshotLimitBlockers,
-        receipt: {
-            detail: options.fullReceipt === true ? 'full' : 'compact',
-            sample_limit: COMPACT_RECEIPT_SAMPLE_LIMIT,
-            complete_blocking_details: true,
-            collections: {
-                exclusions: collectionSummary(exclusions.length, returnedExclusions.length),
-                approved_inactive_submodule_omissions: collectionSummary(approvedSubmodulePaths.length, returnedApprovedSubmodulePaths.length),
-                binary_inline_scan_skips: collectionSummary(binaryInlineScanSkips.length, returnedBinaryInlineScanSkips.length),
-            },
-        },
-        manifest: {
-            path: manifestPath,
-            sha256: `sha256:${createHash('sha256').update(manifestBytes).digest('hex')}`,
-            entries: manifestEntries.length,
-        },
-    };
-}
-export async function prepareUniverseReviewCommand(options) {
-    const root = findGitRoot();
-    if (!root)
-        throw new Error('prepare-universe-review must be run inside a Git repository');
-    const result = prepareUniverseReview(root, {
-        excludeInactiveSubmodules: options.excludeInactiveSubmodule,
-        omitUnscannableFiles: options.omitUnscannableFiles,
-        fullReceipt: options.fullReceipt,
-    });
-    if (options.json) {
-        console.log(JSON.stringify(result, null, 2));
-    }
-    else {
-        console.log(`Review snapshot: ${result.path}`);
-        console.log(`Isolation status: ${result.status}`);
-        console.log(`Copied ${result.counts.copied} of ${result.counts.tracked} tracked entries.`);
-        console.log('The reviewer process still requires OS-level network and filesystem confinement.');
-    }
-    if (result.status === 'blocked')
-        process.exitCode = 1;
-}