@humanbased/crosscheck 1.3.1-beta.7 → 1.5.0

package/README.md

@@ -17,7 +17,17 @@
 </p>
 
 <p align="center">
-  <img src="./assets/screenshot-watch.png" alt="crosscheck watch — live pipeline view" width="860" />
+  <img src="./assets/demo-block-to-approve.gif" alt="crosscheck reviewing a PR: a BLOCK on a dropped ownership filter, an auto-fix, and the verdict on the repair" width="900" />
+</p>
+
+<p align="center">
+  <strong>The run above is real</strong> — a public fixture PR, every comment permanently linked:<br />
+  <a href="https://github.com/humanbased-ai/crosscheck-proof-fixture/pull/2">the whole thread</a>
+  &nbsp;·&nbsp; <a href="./demo/README.md">how the recording was made</a>
+</p>
+
+<p align="center">
+  <sub>A pagination change that passed CI and dropped <code>ownerId</code> from the transaction query — any caller could read another user's transactions. Reviewed by Codex, repaired by Claude, and re-judged against the repair.</sub>
 </p>
 
 ---
@@ -173,6 +183,7 @@ Full walkthrough: **[docs/linear-identity.md](./docs/linear-identity.md)**.
 | `crosscheck review <pr>` | One-shot review, posts a comment |
 | `crosscheck run <pr>` | Full pipeline for a PR — review, fix, recheck |
 | `crosscheck recheck` / `fix` / `resolve` | Run one step in isolation |
+| `crosscheck merge <pr>` | Merge a PR once the verdict allows it — `--loose` / `--tight` / `--force` |
 | `crosscheck watch` | Listen for PR events and run the pipeline automatically |
 | `crosscheck scan` | Show open PRs with stale crosscheck state |
 | `crosscheck kickass` | Pick a stale PR and drive it to its next step |
@@ -304,6 +315,10 @@ Every option, annotated: **[crosscheck.config.example.yml](./crosscheck.config.e
 crosscheck onboard && crosscheck watch
 ```
 
+<p align="center">
+  <img src="./assets/screenshot-watch.png" alt="crosscheck watch — live pipeline view" width="860" />
+</p>
+
 **On a server** — one always-on watcher for a team, with per-repo depth where it matters.
 
 ```bash

package/dist/__tests__/base-ref-recovery.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=base-ref-recovery.test.d.ts.map

package/dist/__tests__/base-ref-recovery.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-ref-recovery.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/base-ref-recovery.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/base-ref-recovery.test.js

@@ -0,0 +1,102 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { execFileSync } from 'child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { resolveBaseRef, BaseRefUnavailableError, isBaseRefUnavailableError } from '../lib/clone.js';
+// Exercised against a real local origin rather than a mock: the whole point of the
+// recovery chain is which git invocations actually put a ref in place, and a mock
+// that answers "fetched" proves nothing about git.
+describe('resolveBaseRef', () => {
+    let originDir;
+    let workDir;
+    let baseSha;
+    const git = (dir, ...args) => execFileSync('git', args, { cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+    const commit = (dir, file, message) => {
+        writeFileSync(join(dir, file), `${message}\n`);
+        git(dir, 'add', '-A');
+        git(dir, '-c', 'user.email=t@t.t', '-c', 'user.name=t', 'commit', '-m', message);
+        return git(dir, 'rev-parse', 'HEAD');
+    };
+    beforeEach(() => {
+        // origin: a normal repo with a `main` and a `feature-base` the PR targets.
+        originDir = mkdtempSync(join(tmpdir(), 'crosscheck-origin-'));
+        git(originDir, 'init', '--initial-branch=main', '.');
+        commit(originDir, 'a.txt', 'root');
+        git(originDir, 'checkout', '-b', 'feature-base');
+        baseSha = commit(originDir, 'b.txt', 'base work');
+        git(originDir, 'checkout', '-b', 'pr-head');
+        commit(originDir, 'c.txt', 'pr work');
+        git(originDir, 'checkout', 'main');
+        // The consumer clone, with the PR head checked out — never the base branch.
+        workDir = mkdtempSync(join(tmpdir(), 'crosscheck-work-'));
+        git(workDir, 'clone', originDir, '.');
+        git(workDir, 'checkout', '-b', 'pr-1', 'origin/pr-head');
+        // Drop the tracking ref the clone created, so each case starts from "absent".
+        git(workDir, 'update-ref', '-d', 'refs/remotes/origin/feature-base');
+    });
+    afterEach(() => {
+        rmSync(originDir, { force: true, recursive: true });
+        rmSync(workDir, { force: true, recursive: true });
+    });
+    it('fetches the base by name when the branch exists', async () => {
+        const status = await resolveBaseRef({ tmpDir: workDir, baseRef: 'feature-base', prNumber: 1 });
+        expect(status).toBe('fetched');
+        expect(git(workDir, 'rev-parse', 'refs/remotes/origin/feature-base')).toBe(baseSha);
+    });
+    it('recovers by commit when the base branch has been deleted', async () => {
+        // The incident: PR #3649's base branch was gone by the time the review ran.
+        git(originDir, 'branch', '-D', 'feature-base');
+        const recovered = [];
+        const status = await resolveBaseRef({
+            tmpDir: workDir, baseRef: 'feature-base', prNumber: 1, baseSha,
+            onBaseRefRecovered: s => recovered.push(s),
+        });
+        expect(status).toBe('recovered_by_sha');
+        expect(recovered).toEqual(['recovered_by_sha']);
+        // The ref must actually resolve — the whole failure was trusting an exit code.
+        expect(git(workDir, 'rev-parse', 'refs/remotes/origin/feature-base')).toBe(baseSha);
+    });
+    it("recovers via the PR's merge ref when the base commit is not fetchable by name", async () => {
+        // GitHub keeps refs/pull/<n>/merge for an open PR; its first parent is the base.
+        const mergeSha = git(originDir, 'commit-tree', `${baseSha}^{tree}`, '-p', baseSha, '-p', git(originDir, 'rev-parse', 'pr-head'), '-m', 'merge');
+        git(originDir, 'update-ref', 'refs/pull/1/merge', mergeSha);
+        git(originDir, 'branch', '-D', 'feature-base');
+        const status = await resolveBaseRef({
+            tmpDir: workDir, baseRef: 'feature-base', prNumber: 1,
+            // No baseSha, so recovery 1 cannot run and recovery 2 must carry it.
+        });
+        expect(status).toBe('recovered_by_merge_ref');
+        expect(git(workDir, 'rev-parse', 'refs/remotes/origin/feature-base')).toBe(baseSha);
+    });
+    it('reports unavailable when no recovery path exists', async () => {
+        git(originDir, 'branch', '-D', 'feature-base');
+        const failed = [];
+        const status = await resolveBaseRef({
+            tmpDir: workDir, baseRef: 'feature-base', prNumber: 1,
+            onBaseFetchFailed: () => failed.push(1),
+        });
+        expect(status).toBe('unavailable');
+        expect(failed.length).toBeGreaterThan(0);
+    });
+    it('reports unavailable when a stale base sha no longer resolves', async () => {
+        git(originDir, 'branch', '-D', 'feature-base');
+        const status = await resolveBaseRef({
+            tmpDir: workDir, baseRef: 'feature-base', prNumber: 1,
+            baseSha: '0'.repeat(40),
+        });
+        expect(status).toBe('unavailable');
+    });
+});
+describe('BaseRefUnavailableError', () => {
+    it('names the ref and says what to do', () => {
+        const err = new BaseRefUnavailableError('chore/in-4439-registry-machine-ownership');
+        expect(err.message).toContain('origin/chore/in-4439-registry-machine-ownership');
+        expect(err.message).toContain('Retarget the PR');
+    });
+    it('is identifiable through the guard', () => {
+        expect(isBaseRefUnavailableError(new BaseRefUnavailableError('x'))).toBe(true);
+        expect(isBaseRefUnavailableError(new Error('x'))).toBe(false);
+    });
+});
+//# sourceMappingURL=base-ref-recovery.test.js.map

package/dist/__tests__/base-ref-recovery.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-ref-recovery.test.js","sourceRoot":"","sources":["../../src/__tests__/base-ref-recovery.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,CAAA;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAC3B,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAEpG,mFAAmF;AACnF,kFAAkF;AAClF,mDAAmD;AACnD,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,IAAI,SAAiB,CAAA;IACrB,IAAI,OAAe,CAAA;IACnB,IAAI,OAAe,CAAA;IAEnB,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,GAAG,IAAc,EAAU,EAAE,CACrD,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAErG,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,IAAY,EAAE,OAAe,EAAU,EAAE;QACpE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,OAAO,IAAI,CAAC,CAAA;QAC9C,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QACrB,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAChF,OAAO,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;IACtC,CAAC,CAAA;IAED,UAAU,CAAC,GAAG,EAAE;QACd,2EAA2E;QAC3E,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAA;QAC7D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAA;QACpD,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAClC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;QAChD,OAAO,GAAG,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;QACjD,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;QAC3C,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;QACrC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;QAElC,4EAA4E;QAC5E,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;QACzD,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;QACrC,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAA;QACxD,8EAA8E;QAC9E,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,kCAAkC,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;QAC9F,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,4EAA4E;QAC5E,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;QAC9C,MAAM,SAAS,GAAa,EAAE,CAAA;QAE9B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO;YAC9D,kBAAkB,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;SAC3C,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACvC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAA;QAC/C,+EAA+E;QAC/E,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,iFAAiF;QACjF,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,OAAO,SAAS,EAChE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAC7E,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAA;QAC3D,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;QAE9C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;YACrD,qEAAqE;SACtE,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QAC7C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAa,EAAE,CAAA;QAE3B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;YACrD,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;SACxC,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;YACrD,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;SACxB,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,GAAG,GAAG,IAAI,uBAAuB,CAAC,0CAA0C,CAAC,CAAA;QACnF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAA;QAChF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,yBAAyB,CAAC,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9E,MAAM,CAAC,yBAAyB,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/codex-env.test.js

@@ -13,6 +13,8 @@ describe('buildCodexEnv', () => {
         LC_ALL: 'en_US.UTF-8',
         HTTPS_PROXY: 'http://proxy:8080',
         OPENAI_API_KEY: 'sk-real',
+        GIT_CONFIG_NOSYSTEM: '1',
+        GIT_CONFIG_GLOBAL: '/dev/null',
         // None of these may survive.
         GITHUB_TOKEN: 'ghp_secret',
         GH_TOKEN: 'gho_secret',
@@ -29,6 +31,8 @@ describe('buildCodexEnv', () => {
         expect(env.OPENAI_API_KEY).toBe('sk-real');
         expect(env.HTTPS_PROXY).toBe('http://proxy:8080');
         expect(env.LC_ALL).toBe('en_US.UTF-8');
+        expect(env.GIT_CONFIG_NOSYSTEM).toBe('1');
+        expect(env.GIT_CONFIG_GLOBAL).toBe('/dev/null');
     });
     it('drops every credential that is not codex\'s own', () => {
         const env = buildCodexEnv({}, source);

package/dist/__tests__/codex-env.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-env.test.js","sourceRoot":"","sources":["../../src/__tests__/codex-env.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAE/E,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,sBAAsB;AACtB,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,aAAa;QACrB,WAAW,EAAE,mBAAmB;QAChC,cAAc,EAAE,SAAS;QACzB,6BAA6B;QAC7B,YAAY,EAAE,YAAY;QAC1B,QAAQ,EAAE,YAAY;QACtB,iBAAiB,EAAE,eAAe;QAClC,cAAc,EAAE,YAAY;QAC5B,yBAAyB,EAAE,OAAO;QAClC,qBAAqB,EAAE,YAAY;QACnC,SAAS,EAAE,YAAY;KACxB,CAAA;IAED,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAClC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC1C,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACjD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrC,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,mBAAmB,EAAE,gBAAgB;YAClF,2BAA2B,EAAE,uBAAuB,EAAE,WAAW,CAAC,EAAE,CAAC;YACrE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,+EAA+E;IAC/E,+DAA+D;IAC/D,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,6BAA6B,EAAE,MAAM,EAAE,CAAC,CAAA;QAC1F,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,+BAA+B,CAAC,CAAA;QAC/D,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,kCAAkC,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAA;QACtG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;QACzD,yEAAyE;QACzE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;QACnD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClD,MAAM,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,oBAAoB,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrE,MAAM,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1D,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"codex-env.test.js","sourceRoot":"","sources":["../../src/__tests__/codex-env.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAE/E,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,sBAAsB;AACtB,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,aAAa;QACrB,WAAW,EAAE,mBAAmB;QAChC,cAAc,EAAE,SAAS;QACzB,mBAAmB,EAAE,GAAG;QACxB,iBAAiB,EAAE,WAAW;QAC9B,6BAA6B;QAC7B,YAAY,EAAE,YAAY;QAC1B,QAAQ,EAAE,YAAY;QACtB,iBAAiB,EAAE,eAAe;QAClC,cAAc,EAAE,YAAY;QAC5B,yBAAyB,EAAE,OAAO;QAClC,qBAAqB,EAAE,YAAY;QACnC,SAAS,EAAE,YAAY;KACxB,CAAA;IAED,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAClC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC1C,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACjD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACtC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACzC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrC,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,mBAAmB,EAAE,gBAAgB;YAClF,2BAA2B,EAAE,uBAAuB,EAAE,WAAW,CAAC,EAAE,CAAC;YACrE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,+EAA+E;IAC/E,+DAA+D;IAC/D,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,6BAA6B,EAAE,MAAM,EAAE,CAAC,CAAA;QAC1F,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,+BAA+B,CAAC,CAAA;QAC/D,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,kCAAkC,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAA;QACtG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;QACzD,yEAAyE;QACzE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;QACnD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClD,MAAM,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,oBAAoB,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrE,MAAM,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1D,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/credential-free-origin.test.js

@@ -1,9 +1,9 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import { execFileSync } from 'child_process';
-import { mkdtempSync, rmSync } from 'fs';
+import { appendFileSync, chmodSync, existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'fs';
 import { tmpdir } from 'os';
 import { join } from 'path';
-import { withCredentialFreeOrigin } from '../lib/clone.js';
+import { CompromisedCloneError, isolateGitConfig, withCredentialFreeOrigin } from '../lib/clone.js';
 // An HTTPS clone stores https://x-access-token:<token>@github.com/... in
 // .git/config, so the checkout carries a writable GitHub token as a plain file.
 // Once a vendor agent runs shell commands in that checkout — which is what
@@ -50,10 +50,142 @@ describe('withCredentialFreeOrigin', () => {
         expect(seen).toBe(ssh);
         expect(originUrl()).toBe(ssh);
     });
+    // A hook planted by the agent would otherwise fire on the runner's own commit
+    // and push in this same clone — after the credential is restored, and with
+    // crosscheck's environment, which carries GITHUB_TOKEN. Flagged by review on #313.
+    describe('hooks planted by the agent', () => {
+        const withToken = 'https://x-access-token:ghs_secret@github.com/o/r.git';
+        const effectiveHooksPath = () => {
+            try {
+                return execFileSync('git', ['config', '--get', 'core.hooksPath'], { cwd: dir, encoding: 'utf8' }).trim();
+            }
+            catch {
+                return '';
+            }
+        };
+        it('disables hooks for the body, so a dropped .git/hooks script never runs', async () => {
+            setOrigin(withToken);
+            let seen = '';
+            await withCredentialFreeOrigin(dir, async () => { seen = effectiveHooksPath(); });
+            expect(seen).toBe('/dev/null');
+        });
+        // The trusted config snapshot removes the re-point after the agent exits.
+        it('neutralises a plain core.hooksPath re-point and restores the credential', async () => {
+            setOrigin(withToken);
+            await withCredentialFreeOrigin(dir, async () => {
+                execFileSync('git', ['config', 'core.hooksPath', '.git/hooks'], { cwd: dir });
+            });
+            expect(effectiveHooksPath()).toBe('/dev/null');
+            expect(originUrl()).toBe(withToken);
+        });
+        it('neutralises a core.hooksPath re-point for an SSH remote', async () => {
+            const ssh = 'git@github.com:o/r.git';
+            setOrigin(ssh);
+            await withCredentialFreeOrigin(dir, async () => {
+                execFileSync('git', ['config', 'core.hooksPath', '.git/hooks'], { cwd: dir });
+            });
+            expect(effectiveHooksPath()).toBe('/dev/null');
+            expect(originUrl()).toBe(ssh);
+        });
+        it('neutralises a core.hooksPath re-point without an origin', async () => {
+            await withCredentialFreeOrigin(dir, async () => {
+                execFileSync('git', ['config', 'core.hooksPath', '.git/hooks'], { cwd: dir });
+            });
+            expect(effectiveHooksPath()).toBe('/dev/null');
+        });
+        it('removes a re-point hidden behind an include', async () => {
+            setOrigin(withToken);
+            await withCredentialFreeOrigin(dir, async () => {
+                writeFileSync(join(dir, 'evil.cfg'), '[core]\n\thooksPath = .git/hooks\n');
+                appendFileSync(join(dir, '.git', 'config'), '[include]\n\tpath = ../evil.cfg\n');
+            });
+            expect(effectiveHooksPath()).toBe('/dev/null');
+            expect(originUrl()).toBe(withToken);
+        });
+        it('restores non-hook config that could execute during later Git commands', async () => {
+            const monitor = join(dir, 'fsmonitor.sh');
+            const marker = join(dir, 'fsmonitor-ran');
+            writeFileSync(monitor, '#!/bin/sh\nprintf ran > fsmonitor-ran\n');
+            chmodSync(monitor, 0o755);
+            await withCredentialFreeOrigin(dir, async () => {
+                execFileSync('git', ['config', 'core.fsmonitor', monitor], { cwd: dir });
+                execFileSync('git', ['status', '--short'], { cwd: dir, stdio: 'pipe' });
+                expect(existsSync(marker)).toBe(true);
+                rmSync(marker);
+            });
+            execFileSync('git', ['status', '--short'], { cwd: dir, stdio: 'pipe' });
+            expect(existsSync(marker)).toBe(false);
+            expect(() => execFileSync('git', ['config', '--get', 'core.fsmonitor'], { cwd: dir, stdio: 'pipe' })).toThrow();
+        });
+        it('leaves the origin scrubbed when a pre-existing include is changed', async () => {
+            const included = join(dir, 'trusted.cfg');
+            writeFileSync(included, '[user]\n\tname = trusted\n');
+            appendFileSync(join(dir, '.git', 'config'), `[include]\n\tpath = ${included}\n`);
+            setOrigin(withToken);
+            await expect(withCredentialFreeOrigin(dir, async () => {
+                writeFileSync(included, '[user]\n\tname = changed\n');
+            })).rejects.toBeInstanceOf(CompromisedCloneError);
+            expect(originUrl()).toBe('https://github.com/o/r.git');
+        });
+        it('still restores the credential on the honest path', async () => {
+            setOrigin(withToken);
+            await withCredentialFreeOrigin(dir, async () => { });
+            expect(originUrl()).toBe(withToken);
+        });
+    });
     it('runs the body when there is no origin at all', async () => {
         let ran = false;
         await withCredentialFreeOrigin(dir, async () => { ran = true; });
         expect(ran).toBe(true);
     });
 });
+describe('isolated Git config', () => {
+    const envKeys = [
+        'GIT_CONFIG_NOSYSTEM', 'GIT_CONFIG_GLOBAL',
+        'GIT_AUTHOR_NAME', 'GIT_AUTHOR_EMAIL', 'GIT_COMMITTER_NAME', 'GIT_COMMITTER_EMAIL',
+    ];
+    let root;
+    let savedEnv;
+    beforeEach(() => {
+        root = mkdtempSync(join(tmpdir(), 'crosscheck-git-config-'));
+        savedEnv = {};
+        for (const key of envKeys) {
+            if (process.env[key] !== undefined)
+                savedEnv[key] = process.env[key];
+        }
+    });
+    afterEach(() => {
+        for (const key of envKeys) {
+            const value = savedEnv[key];
+            if (value === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = value;
+        }
+        rmSync(root, { force: true, recursive: true });
+    });
+    it('prevents a poisoned global hooksPath from reaching a later clone', () => {
+        const source = join(root, 'source');
+        const hooks = join(root, 'hooks');
+        const marker = join(root, 'hook-ran');
+        const poisonedConfig = join(root, 'global.gitconfig');
+        execFileSync('git', ['init', '-q', source]);
+        writeFileSync(join(source, 'file.txt'), 'content\n');
+        execFileSync('git', ['-C', source, 'add', 'file.txt']);
+        execFileSync('git', ['-C', source, '-c', 'user.name=Test', '-c', 'user.email=test@example.com', 'commit', '-qm', 'initial']);
+        mkdirSync(hooks);
+        writeFileSync(join(hooks, 'post-checkout'), `#!/bin/sh\nprintf ran > ${JSON.stringify(marker)}\n`);
+        chmodSync(join(hooks, 'post-checkout'), 0o755);
+        execFileSync('git', ['config', '--file', poisonedConfig, 'core.hooksPath', hooks]);
+        const poisonedEnv = { ...process.env, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: poisonedConfig };
+        execFileSync('git', ['clone', '-q', source, join(root, 'control')], { env: poisonedEnv });
+        expect(existsSync(marker)).toBe(true);
+        rmSync(marker);
+        process.env.GIT_CONFIG_GLOBAL = poisonedConfig;
+        isolateGitConfig();
+        execFileSync('git', ['clone', '-q', source, join(root, 'isolated')]);
+        expect(process.env.GIT_CONFIG_GLOBAL).toBe(process.platform === 'win32' ? 'NUL' : '/dev/null');
+        expect(existsSync(marker)).toBe(false);
+    });
+});
 //# sourceMappingURL=credential-free-origin.test.js.map

package/dist/__tests__/credential-free-origin.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-free-origin.test.js","sourceRoot":"","sources":["../../src/__tests__/credential-free-origin.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAE1D,yEAAyE;AACzE,gFAAgF;AAChF,2EAA2E;AAC3E,+EAA+E;AAC/E,iEAAiE;AACjE,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,IAAI,GAAW,CAAA;IACf,MAAM,SAAS,GAAG,GAAW,EAAE,CAC7B,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAE7F,UAAU,CAAC,GAAG,EAAE;QACd,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAA;QACvD,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IACF,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAE9D,MAAM,SAAS,GAAG,CAAC,GAAW,EAAQ,EAAE;QACtC,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;IACrE,CAAC,CAAA;IAED,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,SAAS,GAAG,sDAAsD,CAAA;QACxE,SAAS,CAAC,SAAS,CAAC,CAAA;QAEpB,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,MAAM,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,IAAI,GAAG,SAAS,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QAEvE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;QAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QACxC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,SAAS,GAAG,sDAAsD,CAAA;QACxE,SAAS,CAAC,SAAS,CAAC,CAAA;QAEpB,MAAM,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA,CAAC,CAAC,CAAC,CAAC;aAC1F,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;QACnC,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,SAAS,CAAC,sDAAsD,CAAC,CAAA;QACjE,MAAM,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,GAAG,GAAG,wBAAwB,CAAA;QACpC,SAAS,CAAC,GAAG,CAAC,CAAA;QAEd,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,MAAM,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,IAAI,GAAG,SAAS,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QAEvE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACtB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,IAAI,GAAG,GAAG,KAAK,CAAA;QACf,MAAM,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,GAAG,GAAG,IAAI,CAAA,CAAC,CAAC,CAAC,CAAA;QAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"credential-free-origin.test.js","sourceRoot":"","sources":["../../src/__tests__/credential-free-origin.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,CAAA;AACzG,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAEnG,yEAAyE;AACzE,gFAAgF;AAChF,2EAA2E;AAC3E,+EAA+E;AAC/E,iEAAiE;AACjE,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,IAAI,GAAW,CAAA;IACf,MAAM,SAAS,GAAG,GAAW,EAAE,CAC7B,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAE7F,UAAU,CAAC,GAAG,EAAE;QACd,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAA;QACvD,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IACF,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAE9D,MAAM,SAAS,GAAG,CAAC,GAAW,EAAQ,EAAE;QACtC,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;IACrE,CAAC,CAAA;IAED,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,SAAS,GAAG,sDAAsD,CAAA;QACxE,SAAS,CAAC,SAAS,CAAC,CAAA;QAEpB,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,MAAM,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,IAAI,GAAG,SAAS,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QAEvE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;QAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QACxC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,SAAS,GAAG,sDAAsD,CAAA;QACxE,SAAS,CAAC,SAAS,CAAC,CAAA;QAEpB,MAAM,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA,CAAC,CAAC,CAAC,CAAC;aAC1F,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;QACnC,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,SAAS,CAAC,sDAAsD,CAAC,CAAA;QACjE,MAAM,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,GAAG,GAAG,wBAAwB,CAAA;QACpC,SAAS,CAAC,GAAG,CAAC,CAAA;QAEd,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,MAAM,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,IAAI,GAAG,SAAS,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QAEvE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACtB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,8EAA8E;IAC9E,2EAA2E;IAC3E,mFAAmF;IACnF,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,MAAM,SAAS,GAAG,sDAAsD,CAAA;QACxE,MAAM,kBAAkB,GAAG,GAAW,EAAE;YACtC,IAAI,CAAC;gBACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YAC1G,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,CAAA;YAAC,CAAC;QACvB,CAAC,CAAA;QAED,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;YACtF,SAAS,CAAC,SAAS,CAAC,CAAA;YACpB,IAAI,IAAI,GAAG,EAAE,CAAA;YACb,MAAM,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,IAAI,GAAG,kBAAkB,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;YAChF,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAChC,CAAC,CAAC,CAAA;QAEF,0EAA0E;QAC1E,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;YACvF,SAAS,CAAC,SAAS,CAAC,CAAA;YAEpB,MAAM,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAC7C,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/E,CAAC,CAAC,CAAA;YAEF,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YAC9C,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;YACvE,MAAM,GAAG,GAAG,wBAAwB,CAAA;YACpC,SAAS,CAAC,GAAG,CAAC,CAAA;YAEd,MAAM,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAC7C,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/E,CAAC,CAAC,CAAA;YAEF,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YAC9C,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC/B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;YACvE,MAAM,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAC7C,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/E,CAAC,CAAC,CAAA;YAEF,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAChD,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,SAAS,CAAC,SAAS,CAAC,CAAA;YAEpB,MAAM,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAC7C,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,oCAAoC,CAAC,CAAA;gBAC1E,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,mCAAmC,CAAC,CAAA;YAClF,CAAC,CAAC,CAAA;YAEF,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YAC9C,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;YACrF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;YACzC,aAAa,CAAC,OAAO,EAAE,yCAAyC,CAAC,CAAA;YACjE,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAEzB,MAAM,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAC7C,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;gBACxE,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;gBACvE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACrC,MAAM,CAAC,MAAM,CAAC,CAAA;YAChB,CAAC,CAAC,CAAA;YAEF,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YACvE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACtC,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;QACjH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;YACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YACzC,aAAa,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAA;YACrD,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,uBAAuB,QAAQ,IAAI,CAAC,CAAA;YAChF,SAAS,CAAC,SAAS,CAAC,CAAA;YAEpB,MAAM,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBACpD,aAAa,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAA;YACvD,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAA;YAEjD,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;YAChE,SAAS,CAAC,SAAS,CAAC,CAAA;YACpB,MAAM,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,GAA4B,CAAC,CAAC,CAAA;YAC7E,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,IAAI,GAAG,GAAG,KAAK,CAAA;QACf,MAAM,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,GAAG,GAAG,IAAI,CAAA,CAAC,CAAC,CAAC,CAAA;QAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,MAAM,OAAO,GAAG;QACd,qBAAqB,EAAE,mBAAmB;QAC1C,iBAAiB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,qBAAqB;KAC1E,CAAA;IACV,IAAI,IAAY,CAAA;IAChB,IAAI,QAA2D,CAAA;IAE/D,UAAU,CAAC,GAAG,EAAE;QACd,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAA;QAC5D,QAAQ,GAAG,EAAE,CAAA;QACb,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACtE,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;YAC3B,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;;gBAC3C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QAC/B,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QACrC,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;QACrD,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;QAC3C,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,CAAA;QACpD,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAA;QACtD,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,6BAA6B,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;QAC5H,SAAS,CAAC,KAAK,CAAC,CAAA;QAChB,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAClG,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9C,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAA;QAElF,MAAM,WAAW,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAA;QACnG,YAAY,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;QACzF,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,CAAC,CAAA;QAEd,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,cAAc,CAAA;QAC9C,gBAAgB,EAAE,CAAA;QAClB,YAAY,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAA;QAEpE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;QAC9F,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/demo-arc.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=demo-arc.test.d.ts.map

package/dist/__tests__/demo-arc.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demo-arc.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/demo-arc.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/demo-arc.test.js

@@ -0,0 +1,73 @@
+import { describe, it, expect } from 'vitest';
+import { readFileSync, existsSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+// The demo's whole claim is that what it shows happened. These guard the two ways
+// that claim rots silently: arc.json drifting away from a real captured run, and a
+// scene file the replay reads going missing so a beat renders empty.
+//
+// `npm run demo:play -- --fast` in CI covers the rendering; this covers the data.
+const demoDir = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'demo');
+function arc() {
+    return JSON.parse(readFileSync(join(demoDir, 'arc.json'), 'utf8'));
+}
+describe('demo/arc.json', () => {
+    it('names the public run it was captured from', () => {
+        const a = arc();
+        // The provenance note in demo/README.md and the README caption both promise a
+        // checkable source. A capture that lost it makes both of them lies.
+        expect(a.capturedFrom.repo).toBe('humanbased-ai/crosscheck-proof-fixture');
+        expect(a.capturedFrom.url).toBe(`https://github.com/${a.capturedFrom.repo}/pull/${a.capturedFrom.pr}`);
+        expect(a.capturedAt).toMatch(/^\d{4}-\d{2}-\d{2}$/);
+    });
+    it('carries the beats the replay narrates', () => {
+        const a = arc();
+        expect(a.steps.some(s => s.event === 'review_complete')).toBe(true);
+        expect(a.steps.some(s => s.event === 'fix_complete')).toBe(true);
+        // A demo with no blocking finding has no story; this is the beat everything
+        // else hangs off.
+        expect(a.comments.some(c => c.verdict === 'BLOCK')).toBe(true);
+    });
+    it('keeps step timings monotonic, so the replay never waits backwards', () => {
+        const times = arc().steps.map(s => s.atMs);
+        expect(times).toEqual([...times].sort((x, y) => x - y));
+        expect(times[0]).toBeGreaterThanOrEqual(0);
+    });
+    it('carries a real review body for every verdict it claims', () => {
+        for (const c of arc().comments.filter(x => x.verdict !== undefined)) {
+            // Verbatim bodies only — a placeholder here would put words in the
+            // reviewer's mouth on camera.
+            expect(c.body).toMatch(/Code Review by|Recheck by/);
+            expect(c.body.length).toBeGreaterThan(200);
+            expect(c.id).toBeGreaterThan(0);
+        }
+    });
+    it('has the Critical Issues section the replay quotes from', () => {
+        const blocking = arc().comments.find(c => c.verdict === 'BLOCK');
+        expect(blocking?.body).toContain('## Critical Issues');
+    });
+});
+describe('demo/scenes', () => {
+    // Kept in step with the scene() calls in replay.ts. A missing file throws at
+    // record time, which is a bad moment to find out.
+    it.each(['01-diff.txt', '02-tests-pass.txt', '02-tests-pass-short.txt'])('%s exists and is not empty', name => {
+        const path = join(demoDir, 'scenes', name);
+        expect(existsSync(path)).toBe(true);
+        expect(readFileSync(path, 'utf8').trim().length).toBeGreaterThan(0);
+    });
+    it('the diff scene still shows the ownership filter being removed', () => {
+        // This single removed line is the defect the whole demo is about. If a
+        // re-capture loses it, the recording no longer demonstrates anything.
+        // The capture keeps git's colour codes, so the leading `-` is preceded by an
+        // ANSI escape rather than sitting at the start of the line.
+        // eslint-disable-next-line no-control-regex -- matching the ESC byte is the point
+        const diff = readFileSync(join(demoDir, 'scenes', '01-diff.txt'), 'utf8').replace(/\x1B\[[0-9;]*m/g, '');
+        expect(diff).toMatch(/^-\s+ownerId/m);
+    });
+    it('the passing-test scene shows a green suite', () => {
+        const tests = readFileSync(join(demoDir, 'scenes', '02-tests-pass.txt'), 'utf8');
+        expect(tests).toMatch(/Tests\s+2 passed/);
+        expect(tests).not.toMatch(/failed/);
+    });
+});
+//# sourceMappingURL=demo-arc.test.js.map

package/dist/__tests__/demo-arc.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demo-arc.test.js","sourceRoot":"","sources":["../../src/__tests__/demo-arc.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,kFAAkF;AAClF,mFAAmF;AACnF,qEAAqE;AACrE,EAAE;AACF,kFAAkF;AAElF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAUjF,SAAS,GAAG;IACV,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAQ,CAAA;AAC3E,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,GAAG,EAAE,CAAA;QACf,8EAA8E;QAC9E,oEAAoE;QACpE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAA;QAC1E,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAA;QACtG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,GAAG,GAAG,EAAE,CAAA;QACf,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChE,4EAA4E;QAC5E,kBAAkB;QAClB,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACvD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;YACpE,mEAAmE;YACnE,8BAA8B;YAC9B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;YACnD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QACjC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAA;QAChE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,6EAA6E;IAC7E,kDAAkD;IAClD,EAAE,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,mBAAmB,EAAE,yBAAyB,CAAC,CAAC,CAAC,4BAA4B,EAAE,IAAI,CAAC,EAAE;QAC5G,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC1C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,6EAA6E;QAC7E,4DAA4D;QAC5D,kFAAkF;QAClF,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAA;QACxG,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAA;QAChF,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;QACzC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/doc-only-verdict.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=doc-only-verdict.test.d.ts.map

package/dist/__tests__/doc-only-verdict.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doc-only-verdict.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/doc-only-verdict.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/doc-only-verdict.test.js

@@ -0,0 +1,79 @@
+import { describe, it, expect } from 'vitest';
+import { applySeverityGate, DOC_ONLY_GATE_NOTE, SEVERITY_GATE_NOTE } from '../lib/verdict.js';
+import { isDocOnlyChange } from '../lib/review-strategy.js';
+// A doc-only PR is never blocked. A finding about a sentence cannot break a build
+// or a caller, and the `docs` class runs `review` with no fix or recheck step — so
+// a BLOCK there had no path to ever clear, it just sat on the PR.
+const BLOCKING_REVIEW = '## Critical Issues\n\n- [P1] The install command is wrong.\n';
+describe('isDocOnlyChange', () => {
+    it.each([
+        [['README.md'], true],
+        [['docs/trust.md', 'docs/metrics.md'], true],
+        [['guide.mdx', 'notes.rst', 'manual.adoc'], true],
+        [['README.md', 'src/index.ts'], false],
+        [['src/index.ts'], false],
+        // An empty list is "unknown", not "doc-only": an unreadable diff must not
+        // suppress a verdict.
+        [[], false],
+    ])('%j → %s', (files, expected) => {
+        expect(isDocOnlyChange(files)).toBe(expected);
+    });
+    it('is not fooled by a doc extension inside a source path', () => {
+        expect(isDocOnlyChange(['src/md/parser.ts'])).toBe(false);
+    });
+    it('requires every file to be prose, not merely most of them', () => {
+        // Stricter than the `docs` PR class, which matches on a *fraction* of doc
+        // churn. One source file in the diff means a finding could describe shipping
+        // code, so the verdict must stay free to block.
+        expect(isDocOnlyChange(['a.md', 'b.md', 'c.md', 'd.md', 'src/one.ts'])).toBe(false);
+    });
+});
+describe('a doc-only PR is never blocked', () => {
+    it('turns BLOCK into APPROVE', () => {
+        const gate = applySeverityGate('BLOCK', BLOCKING_REVIEW, { docOnly: true });
+        expect(gate).toEqual({ verdict: 'APPROVE', downgraded: true, reason: 'doc_only' });
+    });
+    it('turns NEEDS WORK into APPROVE even with a blocking finding', () => {
+        const gate = applySeverityGate('NEEDS WORK', BLOCKING_REVIEW, { docOnly: true });
+        expect(gate.verdict).toBe('APPROVE');
+        expect(gate.reason).toBe('doc_only');
+    });
+    it('leaves an APPROVE alone', () => {
+        expect(applySeverityGate('APPROVE', BLOCKING_REVIEW, { docOnly: true }))
+            .toEqual({ verdict: 'APPROVE', downgraded: false });
+    });
+    it('leaves a null verdict alone — nothing to cap', () => {
+        expect(applySeverityGate(null, BLOCKING_REVIEW, { docOnly: true }))
+            .toEqual({ verdict: null, downgraded: false });
+    });
+});
+describe('the cap applies only to doc-only PRs', () => {
+    it('a BLOCK on code still blocks', () => {
+        const gate = applySeverityGate('BLOCK', BLOCKING_REVIEW, { docOnly: false });
+        expect(gate).toEqual({ verdict: 'BLOCK', downgraded: false });
+    });
+    it('a BLOCK on code still blocks when docOnly is unset', () => {
+        expect(applySeverityGate('BLOCK', BLOCKING_REVIEW).verdict).toBe('BLOCK');
+    });
+    it('the existing severity rule is unchanged for code', () => {
+        // P3-only NEEDS WORK still downgrades, and reports the older reason so the
+        // caller picks the older note.
+        const gate = applySeverityGate('NEEDS WORK', '- [P3] Rename `x`.', { docOnly: false });
+        expect(gate).toEqual({ verdict: 'APPROVE', downgraded: true, reason: 'no_blocking_findings' });
+    });
+});
+describe('the two downgrades are distinguishable', () => {
+    it('reports a reason the caller can branch on for the note', () => {
+        // The notes say different things, and picking the wrong one tells the author
+        // there were no blocking findings when in fact there were and they were capped.
+        const docs = applySeverityGate('BLOCK', BLOCKING_REVIEW, { docOnly: true });
+        const nits = applySeverityGate('NEEDS WORK', '- [P3] nit', {});
+        expect(docs.reason).not.toBe(nits.reason);
+    });
+    it('the doc note reclassifies rather than dismisses the findings', () => {
+        expect(DOC_ONLY_GATE_NOTE).toMatch(/advisory/);
+        expect(DOC_ONLY_GATE_NOTE).toMatch(/worth reading/);
+        expect(DOC_ONLY_GATE_NOTE).not.toBe(SEVERITY_GATE_NOTE);
+    });
+});
+//# sourceMappingURL=doc-only-verdict.test.js.map

package/dist/__tests__/doc-only-verdict.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doc-only-verdict.test.js","sourceRoot":"","sources":["../../src/__tests__/doc-only-verdict.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAE3D,kFAAkF;AAClF,mFAAmF;AACnF,kEAAkE;AAElE,MAAM,eAAe,GAAG,8DAA8D,CAAA;AAEtF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;QACrB,CAAC,CAAC,eAAe,EAAE,iBAAiB,CAAC,EAAE,IAAI,CAAC;QAC5C,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC;QACjD,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,KAAK,CAAC;QACtC,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC;QACzB,0EAA0E;QAC1E,sBAAsB;QACtB,CAAC,EAAE,EAAE,KAAK,CAAC;KACZ,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QAChC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,eAAe,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,0EAA0E;QAC1E,6EAA6E;QAC7E,gDAAgD;QAChD,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3E,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;IACpF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,IAAI,GAAG,iBAAiB,CAAC,YAAY,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAChF,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACpC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;aACrE,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;aAChE,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5E,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,2EAA2E;QAC3E,+BAA+B;QAC/B,MAAM,IAAI,GAAG,iBAAiB,CAAC,YAAY,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;QACtF,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAChG,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,6EAA6E;QAC7E,gFAAgF;QAChF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,EAAE,CAAC,CAAA;QAC9D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAC9C,MAAM,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;QACnD,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/error-classification.test.js

@@ -81,4 +81,18 @@ describe('classifyError — a failing clone is classified by its cause, not its
         expect(classifyError(`${cloneCommand}\n\nremote: Repository not found.\nfatal: 403 Forbidden`)).toBe('permission');
     });
 });
+describe('crosscheck fail-closed categories', () => {
+    it('classifies an unresolvable base ref', () => {
+        expect(classifyError('base ref origin/chore/in-4439-registry-machine-ownership could not be resolved — the branch is deleted or renamed, '
+            + 'so the PR diff cannot be computed. Retarget the PR to a live base branch and re-run.')).toBe('base_ref');
+    });
+    it('classifies a reviewer that reported it could not review', () => {
+        expect(classifyError('codex review inconclusive — reviewer reported it could not perform the review')).toBe('inconclusive');
+    });
+    it('does not let the base-ref message fall through to auth', () => {
+        // The message contains no credential words, but the auth pattern is broad
+        // enough that ordering matters — assert the outcome, not the intent.
+        expect(classifyError('base ref origin/main could not be resolved')).not.toBe('auth');
+    });
+});
 //# sourceMappingURL=error-classification.test.js.map

package/dist/__tests__/error-classification.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-classification.test.js","sourceRoot":"","sources":["../../src/__tests__/error-classification.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhD,gFAAgF;AAChF,iFAAiF;AACjF,oEAAoE;AACpE,QAAQ,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC/E,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,CAAC,aAAa,CAAC,6DAA6D,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACzG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,aAAa,CAAC,0DAA0D,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACtG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,aAAa,CAAC,mDAAmD,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC3F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,sFAAsF;QACtF,MAAM,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvE,MAAM,CAAC,aAAa,CAAC,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACzE,MAAM,CAAC,aAAa,CAAC,gDAAgD,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC5F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,aAAa,CAAC,gDAAgD,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACpF,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,aAAa,CAAC,+CAA+C,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACzF,MAAM,CAAC,aAAa,CAAC,2CAA2C,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAClF,MAAM,CAAC,aAAa,CAAC,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACzE,MAAM,CAAC,aAAa,CAAC,oCAAoC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAChF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAChF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,aAAa,CAClB,yEAAyE,CAC1E,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,aAAa,CAAC,uDAAuD,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,aAAa,CAAC,2EAA2E,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,aAAa,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,kFAAkF;AAClF,gFAAgF;AAChF,mFAAmF;AACnF,mFAAmF;AACnF,mFAAmF;AACnF,+DAA+D;AAC/D,QAAQ,CAAC,yEAAyE,EAAE,GAAG,EAAE;IACvF,MAAM,YAAY,GAChB,qGAAqG;QACrG,sDAAsD;QACtD,yFAAyF,CAAA;IAE3F,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,aAAa,CAClB,GAAG,YAAY,kEAAkE;YACjF,yEAAyE,CAC1E,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,aAAa,CAAC,GAAG,YAAY,2DAA2D,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACnH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,aAAa,CAAC,GAAG,YAAY,2DAA2D,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/G,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,aAAa,CAClB,GAAG,YAAY,yEAAyE,CACzF,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,aAAa,CAAC,GAAG,YAAY,wFAAwF,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7I,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,aAAa,CAClB,gFAAgF;YAChF,+FAA+F,CAChG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,aAAa,CAClB,GAAG,YAAY,yDAAyD,CACzE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"error-classification.test.js","sourceRoot":"","sources":["../../src/__tests__/error-classification.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhD,gFAAgF;AAChF,iFAAiF;AACjF,oEAAoE;AACpE,QAAQ,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC/E,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,CAAC,aAAa,CAAC,6DAA6D,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACzG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,aAAa,CAAC,0DAA0D,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACtG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,aAAa,CAAC,mDAAmD,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC3F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,sFAAsF;QACtF,MAAM,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvE,MAAM,CAAC,aAAa,CAAC,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACzE,MAAM,CAAC,aAAa,CAAC,gDAAgD,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC5F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,aAAa,CAAC,gDAAgD,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACpF,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,aAAa,CAAC,+CAA+C,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACzF,MAAM,CAAC,aAAa,CAAC,2CAA2C,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAClF,MAAM,CAAC,aAAa,CAAC,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACzE,MAAM,CAAC,aAAa,CAAC,oCAAoC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAChF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAChF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,aAAa,CAClB,yEAAyE,CAC1E,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,aAAa,CAAC,uDAAuD,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,aAAa,CAAC,2EAA2E,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,aAAa,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,kFAAkF;AAClF,gFAAgF;AAChF,mFAAmF;AACnF,mFAAmF;AACnF,mFAAmF;AACnF,+DAA+D;AAC/D,QAAQ,CAAC,yEAAyE,EAAE,GAAG,EAAE;IACvF,MAAM,YAAY,GAChB,qGAAqG;QACrG,sDAAsD;QACtD,yFAAyF,CAAA;IAE3F,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,aAAa,CAClB,GAAG,YAAY,kEAAkE;YACjF,yEAAyE,CAC1E,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,aAAa,CAAC,GAAG,YAAY,2DAA2D,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACnH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,aAAa,CAAC,GAAG,YAAY,2DAA2D,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/G,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,aAAa,CAClB,GAAG,YAAY,yEAAyE,CACzF,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,aAAa,CAAC,GAAG,YAAY,wFAAwF,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7I,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,aAAa,CAClB,gFAAgF;YAChF,+FAA+F,CAChG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,aAAa,CAClB,GAAG,YAAY,yDAAyD,CACzE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,aAAa,CAClB,qHAAqH;cACnH,sFAAsF,CACzF,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,aAAa,CAAC,+EAA+E,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IAC7H,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,CAAC,aAAa,CAAC,4CAA4C,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/fix-requires-recheck.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=fix-requires-recheck.test.d.ts.map