@kaydash9999/banker-plugins 0.26.0 → 0.27.0

package/skills/make-evidence/scripts/me-check.mjs

@@ -0,0 +1,125 @@
+// make-evidence: checks the numbers in the evidence documents against the run logs, and counts trace statuses.
+// Pure Node, no network.
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { join, relative } from "node:path";
+import { EVIDENCE, gitOut, lines, topOf } from "./me-git.mjs";
+
+// A cited value: `<name>=<value>` in backticks, the name with at least one dot (scale.x5.median_s), so plain
+// code such as `exit=0` is not taken for one.
+const TOKEN = /`([A-Za-z][\w-]*(?:\.[\w-]+)+)=([^`\s]+)`/g;
+const LOGREF = /(?<=^|[\s|(\[`'"])(?:docs\/evidence\/)?logs\/[^\s`|)\]>"',]+/g;
+const CHECK_LINE = /^수치 대조: (?:docs\/evidence\/)?logs\/\S+$/;
+const WRITER = /^\$ (?:echo|printf|cat|type|tee|Write-Output|Set-Content|Out-File|Add-Content)\b/i;
+const SKIP_DOCS = new Set(["owner-facts.md"]);
+
+const logPath = (top, ref) => join(top, ref.startsWith("logs/") ? join(EVIDENCE, ref) : ref);
+
+// A .log the helper wrote: `$ <command>` then `# head=`. The METRIC lines in it, or why it is not one. Other files
+// under logs/ (patches, saved prompts) are checked for being there, and hold no citable numbers.
+function readLog(cache, file) {
+  if (!cache.has(file)) {
+    let entry;
+    if (!existsSync(file)) entry = { missing: true };
+    else if (!file.endsWith(".log")) entry = { metrics: new Set(), other: true }; // a patch or a saved prompt: it only has to exist
+    else {
+      const all = readFileSync(file, "utf8").split(/\r?\n/);
+      if (!all[0]?.startsWith("$ ") || !all[1]?.startsWith("# head=")) entry = { bad: "run 이 만든 로그가 아님(첫 두 줄)" };
+      else if (WRITER.test(all[0])) entry = { bad: `글을 찍기만 하는 명령의 로그: ${all[0].slice(0, 60)}` };
+      else if (all[0].includes("METRIC ")) entry = { bad: "명령 줄에 METRIC 글이 들어 있음(상수를 찍는 명령)" };
+      else entry = { metrics: new Set(all.filter((l) => l.startsWith("METRIC ")).map((l) => l.trim())) };
+    }
+    cache.set(file, entry);
+  }
+  return cache.get(file);
+}
+
+// Numbers that are not measurements: inline code, paths and file:line (a name with an extension), hashes (with a
+// letter), dates, versions, ids (R1, F2, M-3, c1), the multiples the skill uses (1배, 5배, 10배, x5), line counts
+// (10줄), steps (3단계), section and list numbers, a row number cell. Quoted text only where requirements are
+// quoted (quotes: true, trace.md). Everything else with a digit is reported.
+export function bareNumbers(line, { quotes = false } = {}) {
+  if (/^\s*\|[\s:|-]+\|\s*$/.test(line)) return false;
+  let rest = line.replace(/^\s*#+\s*(?:\d+(?:\.\d+)*\.\s+)?/, " ").replace(/`[^`]*`/g, " ").replace(LOGREF, " ");
+  if (quotes) rest = rest.replace(/"[^"]*"|“[^”]*”|「[^」]*」/g, " ");
+  rest = rest
+    .replace(/\b[a-z][\w+.-]*:\/\/\S+/gi, " ").replace(/(?<!\S)(?:\.{0,2}\/|~\/)\S*/g, " ")
+    .replace(/(?<!\S)[\w.-]+(?:[/\\][\w.-]+)+\.[A-Za-z][\w]*(?::\d+(?:-\d+)?)?(?=$|[\s,);])/g, " ")
+    .replace(/(?<!\S)[\w.-]+\.(?:[cm]?[jt]sx?|py|java|kt|go|rs|rb|php|cs|sql|md|json|ya?ml|toml|sh|ps1|html|css|vue|svelte):\d+(?:-\d+)?/g, " ")
+    .replace(/\b(?=[0-9a-f]*[a-f])[0-9a-f]{7,40}\b/g, " ")
+    .replace(/\b\d{4}-\d{2}-\d{2}(?:[T ][\d:.]+Z?)?\b/g, " ").replace(/\bv\d+(?:\.\d+)*\b|\b\d+\.\d+\.\d+(?:\.\d+)?\b/g, " ")
+    .replace(/\b[A-Z]{1,3}-?\d+\b|\b(?!x\d)[a-z_]+\d+\b/g, " ").replace(/(?<![\d.])(?:1|5|10)배(?=\s*(?:데이터|입력|사례))|\bx(?:1|5|10)\b/g, " ")
+    .replace(/(?<!\d)10줄|\d\s*(?:단계|번째)/g, " ").replace(/^\s*\|\s*(?:\d{1,3}|(?:1|5|10)배)\s*\|/, "|").replace(/^\s*(?:\d+\.|[-*])\s+/, " ");
+  return /\d/.test(rest);
+}
+
+function checkRefs(ctx, at, refs) {
+  for (const ref of refs) {
+    const p = logPath(ctx.top, ref);
+    const log = readLog(ctx.cache, p);
+    if (log.missing) ctx.errors.push(`${at} 로그가 없음: ${ref}`);
+    else if (log.bad) ctx.errors.push(`${at} ${log.bad}: ${ref}`);
+    else if (ctx.tracked && !ctx.tracked.has(relative(ctx.top, p).split("\\").join("/"))) ctx.errors.push(`${at} 로그가 git 에 없음: ${ref}`);
+  }
+}
+
+function checkTokens(ctx, at, refs, line) {
+  for (const m of line.matchAll(TOKEN)) {
+    ctx.tokens++;
+    const want = `METRIC ${m[1]}=${m[2]}`;
+    if (!refs.length) ctx.errors.push(`${at} \`${m[1]}=${m[2]}\` 줄에 로그 경로가 없음`);
+    else if (!refs.some((r) => readLog(ctx.cache, logPath(ctx.top, r)).metrics?.has(want))) ctx.errors.push(`${at} 가리킨 로그에 \`${want}\` 줄이 없음`);
+  }
+}
+
+function checkDoc(ctx, name) {
+  let fenced = false;
+  readFileSync(join(ctx.top, EVIDENCE, name), "utf8").split(/\r?\n/).forEach((line, i) => {
+    const at = `${EVIDENCE}/${name}:${i + 1}`;
+    if (/^\s*(```|~~~)/.test(line)) { fenced = !fenced; return; }
+    if (fenced) return;
+    const all = line.match(LOGREF) || [];
+    if (CHECK_LINE.test(line.trim())) {
+      if (all.some((r) => /\{ts\}|@TS@|[<*]/.test(r))) ctx.errors.push(`${at} 수치 대조 줄이 실제 로그가 아니라 이름 꼴을 가리킴`);
+      checkRefs(ctx, at, all);
+      return;
+    }
+    const refs = all.filter((r) => !/\{ts\}|@TS@|[<*]/.test(r)); // a name pattern in a command, not a log
+    checkRefs(ctx, at, refs);
+    checkTokens(ctx, at, refs, line);
+    if (bareNumbers(line, { quotes: name === "trace.md" })) ctx.warnings.push(`${at} \`이름=값\` 밖의 숫자: ${line.trim().slice(0, 120)}`);
+  });
+}
+
+export function checkDocs(repo, { tracked = false } = {}) {
+  const top = topOf(repo);
+  const dir = join(top, EVIDENCE);
+  const ctx = { top, cache: new Map(), errors: [], warnings: [], tokens: 0, docs: 0 };
+  if (tracked) ctx.tracked = new Set(lines(gitOut(top, ["ls-files", "--", EVIDENCE])));
+  const names = existsSync(dir) ? readdirSync(dir).filter((f) => f.endsWith(".md") && !SKIP_DOCS.has(f)).sort() : [];
+  for (const name of names) { ctx.docs++; checkDoc(ctx, name); }
+  return ctx;
+}
+
+// ---- trace counts ---------------------------------------------------------------------------------------------
+
+const STATUS = [["완료", "done"], ["부분", "partial"], ["미구현", "notdone"], ["미검증", "unverified"]];
+const cellsOf = (line) => line.trim().replace(/^\||\|$/g, "").split(/(?<!\\)\|/).map((s) => s.trim());
+
+// Counts the 상태 column, found by its heading. No heading with 상태 is an error; rows whose status is none of
+// the four are listed.
+export function countTrace(text) {
+  const c = { rows: 0, done: 0, partial: 0, notdone: 0, unverified: 0, unknown: 0, unknownRows: [] };
+  let col = -1;
+  text.split(/\r?\n/).forEach((line, i) => {
+    if (!line.trimStart().startsWith("|") || /^\s*\|[\s:|-]+\|\s*$/.test(line)) return;
+    const cells = cellsOf(line);
+    if (col < 0) { col = cells.indexOf("상태"); return; }
+    if (cells.includes("상태")) return; // a second table's heading
+    c.rows++;
+    const hit = STATUS.find(([k]) => (cells[col] || "").startsWith(k));
+    if (hit) c[hit[1]]++;
+    else { c.unknown++; c.unknownRows.push(i + 1); }
+  });
+  if (col < 0) throw new Error("trace 표에 `상태` 칸이 있는 머리 줄이 없음");
+  return c;
+}

package/skills/make-evidence/scripts/me-commit.mjs

@@ -0,0 +1,48 @@
+// make-evidence: commits only the evidence paths. Ignored files are forced in only for the run logs and patches
+// under docs/evidence/logs; .env files, big files and text that still looks like a secret stop the commit.
+// Commit hooks run. Pure Node, no network.
+import { readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { EVIDENCE, OWN, git, gitOut, headOf, lines, topOf } from "./me-git.mjs";
+import { secretLines } from "./me-run.mjs";
+
+const MAX_FILE = 5 * 1024 * 1024;
+const FORCE = new RegExp(`^${EVIDENCE}/logs/[^/]+\\.(log|patch|md)$`);
+const NEVER = /(^|\/)(\.env[^/]*|node_modules|__pycache__|\.venv)(\/|$)/;
+const under = (f, paths) => paths.some((p) => f === p || f.startsWith(`${p}/`));
+
+function candidates(top, paths) {
+  const normal = lines(gitOut(top, ["ls-files", "--modified", "--others", "--deleted", "--exclude-standard", "--", ...paths]));
+  const ignored = lines(gitOut(top, ["ls-files", "--others", "--ignored", "--exclude-standard", "--", ...paths]));
+  return { normal: [...new Set(normal)], forced: ignored.filter((f) => FORCE.test(f)) };
+}
+
+// accept: exact file:line places the user confirmed are not secrets.
+function refusals(top, files, accept = []) {
+  const out = [];
+  for (const f of files) {
+    if (NEVER.test(f)) { out.push(`넣지 않는 파일: ${f}`); continue; }
+    let st;
+    try { st = statSync(join(top, f)); } catch { continue; } // a deletion
+    if (st.size > MAX_FILE) { out.push(`5MB 넘는 파일: ${f}`); continue; }
+    const hits = secretLines(readFileSync(join(top, f), "utf8")).filter((n) => !accept.includes(`${f}:${n}`));
+    for (const n of hits.slice(0, 5)) out.push(`비밀값 꼴이 남음: ${f}:${n} (값을 가리거나, 비밀값이 아니면 --accept ${f}:${n})`);
+  }
+  return out;
+}
+
+export function commitEvidence(repo, message, paths = OWN, accept = []) {
+  const top = topOf(repo);
+  const foreign = lines(gitOut(top, ["diff", "--cached", "--name-only"])).filter((f) => !under(f, paths));
+  if (foreign.length) return { refused: [`증거 밖의 스테이징된 변경이 있음: ${foreign.join(", ")}`] };
+  const { normal, forced } = candidates(top, paths);
+  if (!normal.length && !forced.length) return { refused: [`커밋할 것이 없음: ${paths.join(", ")}`] };
+  const refused = refusals(top, [...normal, ...forced], accept);
+  if (refused.length) return { refused };
+  if (normal.length) gitOut(top, ["add", "-A", "--", ...normal]);
+  if (forced.length) gitOut(top, ["add", "-f", "--", ...forced]);
+  const r = git(top, ["commit", "-m", message, "--", ...new Set([...normal, ...forced])]);
+  if (r.status !== 0) return { refused: [`git commit 실패(훅은 우회하지 않음): ${String(r.stdout + r.stderr).trim().split("\n").slice(-3).join(" / ")}`] };
+  const files = lines(gitOut(top, ["show", "--name-only", "--format=", "HEAD"]));
+  return { sha: headOf(top), files, outside: files.filter((f) => !under(f, paths)) };
+}

package/skills/make-evidence/scripts/me-git.mjs

@@ -0,0 +1,63 @@
+// make-evidence: git calls, the evidence paths and a fingerprint of the user's work tree. Pure Node, no network.
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, readFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+export const EVIDENCE = "docs/evidence";
+export const ORACLE = "tests/oracle";
+export const OWN = [EVIDENCE, ORACLE];
+export const EXCLUDE = OWN.map((p) => `:(exclude)${p}`);
+export const KINDS = ["constraint", "objective", "permission"];
+export const MAX_TEXT = 4 * 1024 * 1024;
+
+export class Usage extends Error {}
+
+// Programs start from the home folder (Windows looks for a program in the working folder first); git gets the
+// folder through -C.
+export const runDir = () => (existsSync(homedir()) ? homedir() : tmpdir());
+
+export function git(cwd, args, extra = {}) {
+  const r = spawnSync("git", ["-C", resolve(cwd), ...args], { cwd: runDir(), encoding: "utf8", maxBuffer: 256 * 1024 * 1024, windowsHide: true, ...extra });
+  if (r.error) throw new Error(`git 을 실행하지 못함: ${r.error.message}`);
+  return r;
+}
+
+export function gitOut(cwd, args) {
+  const r = git(cwd, args);
+  if (r.status !== 0) throw new Error(`git ${args.filter((a) => !a.startsWith(":(")).join(" ")} 실패: ${String(r.stderr).trim().split("\n").pop()}`);
+  return r.stdout;
+}
+
+export const lines = (s) => String(s).split(/\r?\n/).filter(Boolean);
+export const topOf = (dir) => gitOut(dir, ["rev-parse", "--show-toplevel"]).trim();
+export const headOf = (dir) => gitOut(dir, ["rev-parse", "HEAD"]).trim();
+
+// What git sees changed outside the evidence paths (tracked and untracked).
+export const otherStatus = (repo) => gitOut(repo, ["--no-optional-locks", "status", "--porcelain", "--untracked-files=all", "--", ".", ...EXCLUDE]);
+
+export const sha256 = (data) => createHash("sha256").update(data).digest("hex");
+
+function fileHash(file) {
+  try {
+    const st = lstatSync(file);
+    return st.isFile() ? sha256(readFileSync(file)) : `${st.isSymbolicLink() ? "link" : "other"}`;
+  } catch {
+    return "gone";
+  }
+}
+
+// The user's work tree outside the evidence paths: the status lines, the content of tracked changes and of every
+// untracked file. Two equal prints mean nothing there changed (ignored files are not covered).
+export function treePrint(top) {
+  const status = otherStatus(top);
+  const diff = gitOut(top, ["--no-optional-locks", "diff", "HEAD", "--binary", "--", ".", ...EXCLUDE]);
+  const untracked = lines(gitOut(top, ["ls-files", "--others", "--exclude-standard", "--", ".", ...EXCLUDE]));
+  return sha256(`${status}\0${diff}\0${untracked.map((f) => `${f}:${fileHash(join(top, f))}`).join("\n")}`);
+}
+
+export function stamp(d = new Date()) {
+  const p = (n, w = 2) => String(n).padStart(w, "0");
+  return `${d.getUTCFullYear()}${p(d.getUTCMonth() + 1)}${p(d.getUTCDate())}-${p(d.getUTCHours())}${p(d.getUTCMinutes())}${p(d.getUTCSeconds())}-${p(d.getUTCMilliseconds(), 3)}Z`;
+}

package/skills/make-evidence/scripts/me-oracle.mjs

@@ -0,0 +1,244 @@
+// make-evidence: the oracle writer's room, and the seeded bugs run in a separate worktree of HEAD. The user's work
+// tree is never written. Pure Node, no network.
+import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { EVIDENCE, EXCLUDE, KINDS, ORACLE, Usage, git, gitOut, headOf, lines, sha256, topOf, treePrint } from "./me-git.mjs";
+import { claimLog, runLogged } from "./me-run.mjs";
+
+// Inside means below, not equal; a path on another Windows drive is outside (relative() returns it absolute).
+export const inside = (top, p) => { const r = relative(top, p); return r !== "" && !r.startsWith("..") && !isAbsolute(r); };
+const slash = (p) => p.split("\\").join("/");
+
+function walk(dir, base = dir) {
+  const out = [];
+  for (const e of readdirSync(dir, { withFileTypes: true })) {
+    const p = join(dir, e.name);
+    if (e.isDirectory()) out.push(...walk(p, base));
+    else out.push(slash(relative(base, p)));
+  }
+  return out;
+}
+
+// ---- room -----------------------------------------------------------------------------------------------------
+
+// The room is <base>/room; its note (the repository path and the input list) is <base>/room.json, outside the
+// room, so the oracle writer does not learn where the repository is.
+const noteOf = (roomDir) => join(dirname(roomDir), "room.json");
+
+export function makeRoom(repo, req = ["README.md"]) {
+  const top = topOf(repo);
+  const files = [...req, `${EVIDENCE}/owner-facts.md`];
+  const dir = join(mkdtempSync(join(tmpdir(), "make-evidence-room-")), "room");
+  if (inside(top, dir)) throw new Error(`임시 폴더가 저장소 안에 있음: ${dir}`);
+  mkdirSync(dir);
+  for (const f of files) {
+    const src = join(top, f);
+    if (!existsSync(src) || !lstatSync(src).isFile()) throw new Error(`방에 넣을 파일이 없음: ${f}`);
+    mkdirSync(dirname(join(dir, f)), { recursive: true });
+    cpSync(src, join(dir, f));
+  }
+  mkdirSync(join(dir, ORACLE), { recursive: true });
+  writeFileSync(noteOf(dir), JSON.stringify({ repo: top, files }, null, 2));
+  return { dir, files };
+}
+
+// What the room holds beside the oracle: only the input files, unchanged.
+function roomProblems(roomDir, top, files) {
+  const problems = [];
+  for (const f of walk(roomDir)) {
+    if (f.startsWith(`${ORACLE}/`)) continue;
+    if (!files.includes(f)) problems.push(`방에 허용하지 않은 파일: ${f}`);
+    else if (!readFileSync(join(roomDir, f)).equals(readFileSync(join(top, f)))) problems.push(`입력 파일이 바뀜: ${f}`);
+  }
+  return problems;
+}
+
+const isFilled = (dir) => existsSync(dir) && readdirSync(dir).length > 0;
+
+export function collectRoom(roomDir, repo, { replace = false } = {}) {
+  const note = JSON.parse(readFileSync(noteOf(roomDir), "utf8"));
+  const top = repo ? topOf(repo) : note.repo;
+  const problems = roomProblems(roomDir, top, note.files);
+  const made = existsSync(join(roomDir, ORACLE)) ? walk(join(roomDir, ORACLE)) : [];
+  if (!made.length) problems.push(`${ORACLE}/ 에 파일이 없음`);
+  const dest = join(top, ORACLE);
+  if (!replace && isFilled(dest)) problems.push(`${ORACLE}/ 가 이미 있음(판정기 빈틈을 고친 새 판정기일 때만 --replace)`);
+  const previous = lines(gitOut(top, ["log", "-1", "--format=%h %ad %s", "--date=iso", "--", ORACLE]))[0] || null;
+  if (problems.length) return { problems, made, previous };
+  rmSync(dest, { recursive: true, force: true });
+  cpSync(join(roomDir, ORACLE), dest, { recursive: true });
+  return { problems, made, previous };
+}
+
+// ---- worktree and links ---------------------------------------------------------------------------------------
+
+const META = "meta.json";
+const BUILD_DIR = /^(dist|build|out|target|\.next|\.nuxt|\.output|bin|obj|coverage|lib)$/i;
+const metaOf = (wt) => JSON.parse(readFileSync(join(dirname(wt), META), "utf8"));
+
+function checkLink(top, p) {
+  const src = resolve(top, p);
+  const rel = relative(top, src);
+  if (!inside(top, src)) throw new Usage(`--link 는 저장소 안의 경로만: ${p}`);
+  if (!existsSync(src)) throw new Usage(`--link 경로가 없음: ${p}`);
+  if (BUILD_DIR.test(basename(src))) throw new Usage(`--link 로 빌드 결과를 잇지 않음(버그를 넣은 빌드가 사용자 폴더에 써짐): ${p}. 작업 트리 안에서 새로 빌드함`);
+  if (/^\.env/i.test(basename(src))) throw new Usage(`--link 로 .env 를 잇지 않음: ${p}`);
+  if (lines(gitOut(top, ["ls-files", "--", rel])).length) throw new Usage(`--link 는 추적되지 않는 폴더만(추적되는 파일은 작업 트리에 이미 있음): ${p}`);
+  return rel;
+}
+
+// A linked folder's print (files, bytes, latest change) and the links in it that lead back into the main tree:
+// symbolic links resolving there (workspace packages), .pth and egg-link files naming it (editable installs).
+export function scanLinked(top, root) {
+  const s = { files: 0, bytes: 0, mtime: 0, toRepo: [] };
+  const real = realpathSync(top);
+  const visit = (dir) => {
+    for (const e of readdirSync(dir, { withFileTypes: true })) {
+      const p = join(dir, e.name);
+      const st = lstatSync(p);
+      s.files++; s.bytes += st.size; s.mtime = Math.max(s.mtime, st.mtimeMs);
+      if (e.isSymbolicLink()) {
+        let to; try { to = realpathSync(p); } catch { to = resolve(dir, readlinkSync(p)); }
+        if (inside(real, to) && !inside(realpathSync(root), to)) s.toRepo.push(slash(relative(top, p)));
+      } else if (e.isDirectory()) visit(p);
+      else if (/\.(pth|egg-link)$|^__editable__/.test(e.name) && st.size < 65536 && readFileSync(p, "utf8").includes(real)) s.toRepo.push(slash(relative(top, p)));
+    }
+  };
+  visit(root);
+  return s;
+}
+
+export function addWorktree(repo, links = []) {
+  const top = topOf(repo);
+  const rels = links.map((p) => checkLink(top, p));
+  const base = mkdtempSync(join(tmpdir(), "make-evidence-wt-"));
+  const wt = join(base, "wt");
+  gitOut(top, ["worktree", "add", "--detach", wt, "HEAD"]);
+  writeFileSync(join(base, META), JSON.stringify({ repo: top, links: rels }));
+  // The oracle and the evidence scripts as they are now, committed or not, so the run uses them.
+  for (const p of [ORACLE, `${EVIDENCE}/scripts`]) {
+    if (!existsSync(join(top, p))) continue;
+    rmSync(join(wt, p), { recursive: true, force: true });
+    cpSync(join(top, p), join(wt, p), { recursive: true });
+  }
+  for (const rel of rels) {
+    mkdirSync(dirname(join(wt, rel)), { recursive: true });
+    symlinkSync(join(top, rel), join(wt, rel), "junction");
+  }
+  return wt;
+}
+
+export function removeWorktree(wt) {
+  const { repo, links } = metaOf(wt);
+  for (const rel of links) {
+    const at = join(wt, rel);
+    try { if (lstatSync(at).isSymbolicLink()) rmSync(at); } catch { /* not there */ } // the link, never its target
+  }
+  git(repo, ["worktree", "remove", "--force", wt]);
+  git(repo, ["worktree", "prune"]);
+  rmSync(dirname(wt), { recursive: true, force: true });
+}
+
+// ---- oracle lines and the verdict -----------------------------------------------------------------------------
+
+const ORACLE_LINE = /^ORACLE (constraint|objective|permission) (PASS|FAIL|ERROR)\s+(\S+)/;
+
+export function oracleResults(text) {
+  const r = Object.fromEntries(KINDS.map((k) => [k, { pass: new Set(), fail: new Set(), error: new Set() }]));
+  for (const line of text.split(/\r?\n/)) {
+    const m = line.trim().match(ORACLE_LINE);
+    if (m) r[m[1]][m[2].toLowerCase()].add(m[3]);
+  }
+  return r;
+}
+
+const casesOf = (r) => new Set(KINDS.flatMap((k) => [...r[k].pass, ...r[k].fail, ...r[k].error].map((c) => `${k}:${c}`)));
+const sameSet = (a, b) => a.size === b.size && [...a].every((x) => b.has(x));
+
+// caught: a FAIL of the bug's kind the baseline did not have, in a run that judged the same cases as the baseline
+// and gave no ERROR. Anything that does not show the oracle judging the implementation is undecidable.
+export function judge(text, kind, baseText, timedOut) {
+  const cur = oracleResults(text), base = oracleResults(baseText);
+  const collateral = KINDS.filter((k) => k !== kind).reduce((n, k) => n + [...cur[k].fail].filter((c) => !base[k].fail.has(c)).length, 0);
+  const undecided = (reason) => ({ result: "undecidable", reason, collateral });
+  if (timedOut) return undecided("timeout");
+  if (KINDS.some((k) => cur[k].error.size)) return undecided("oracle-error");
+  if (!base[kind].pass.size) return undecided("baseline-no-pass");
+  if (!sameSet(casesOf(cur), casesOf(base))) return undecided("cases-differ");
+  const caught = [...cur[kind].fail].some((c) => !base[kind].fail.has(c));
+  return { result: caught ? "caught" : "missed", reason: caught ? "new-fail" : "no-new-fail", collateral };
+}
+
+export function oracleSha(wt) {
+  const dir = join(wt, ORACLE);
+  return existsSync(dir) ? sha256(walk(dir).sort().map((f) => `${f}:${sha256(readFileSync(join(dir, f)))}`).join("\n")).slice(0, 16) : "none";
+}
+
+// ---- the bug run ----------------------------------------------------------------------------------------------
+
+const metricOf = (text, name) => (text.match(new RegExp(`^METRIC ${name.replace(/\./g, "\\.")}=(\\S+)$`, "m")) || [])[1];
+
+function checkBugArgs(name, kind, baseline) {
+  if (!/^[\w-]+$/.test(name || "")) throw new Usage("--name 은 영문, 숫자, - 와 _ 만");
+  if (name === "baseline") return;
+  if (!KINDS.includes(kind)) throw new Usage(`--kind 는 ${KINDS.join(", ")} 가운데 하나`);
+  if (!baseline || !existsSync(baseline)) throw new Usage("--baseline <기준선 로그> 가 필요함(먼저 --name baseline 으로 돌림)");
+}
+
+// The baseline must be of this HEAD and this oracle.
+function checkBaseline(wt, baseText) {
+  const head = (baseText.match(/^# head=(\S+)/m) || [])[1];
+  if (head !== headOf(wt)) throw new Usage(`기준선의 HEAD(${head})가 지금 HEAD 와 다름. 기준선을 다시 돌림`);
+  const sha = metricOf(baseText, "bug.baseline.oracle_sha");
+  if (sha !== oracleSha(wt)) throw new Usage("기준선의 판정기가 지금 판정기와 다름. 기준선을 다시 돌림");
+}
+
+function verdictMetrics(name, kind, run, text, baseText, linked) {
+  const m = [`bug.${name}.exit=${run.exit}`];
+  if (name === "baseline") {
+    const r = oracleResults(text);
+    for (const k of KINDS) m.push(`baseline.${k}.pass=${r[k].pass.size}`, `baseline.${k}.fail=${r[k].fail.size}`, `baseline.${k}.error=${r[k].error.size}`);
+    return m;
+  }
+  let v = judge(text, kind, baseText, run.code === 124);
+  if (linked.toRepo.length) v = { ...v, result: "undecidable", reason: "link-to-main" };
+  m.push(`bug.${name}.kind=${kind}`, `bug.${name}.result=${v.result}`, `bug.${name}.reason=${v.reason}`, `bug.${name}.collateral=${v.collateral}`);
+  return m;
+}
+
+function linkedPrints(top, links) {
+  const all = links.map((rel) => scanLinked(top, join(top, rel)));
+  return { key: JSON.stringify(all.map((s) => [s.files, s.bytes, s.mtime])), toRepo: all.flatMap((s) => s.toRepo) };
+}
+
+async function bugBody({ wt, name, kind, baseText, timeoutS, argv, shell }) {
+  const { repo: top, links } = metaOf(wt);
+  const logs = join(top, EVIDENCE, "logs");
+  const diff = gitOut(wt, ["diff", "--", ".", ...EXCLUDE]);
+  if (name === "baseline" ? diff.trim() : !diff.trim()) throw new Error(name === "baseline" ? "기준선인데 작업 트리에 바뀐 것이 있음" : "작업 트리에 넣은 버그가 없음(추적되는 파일을 고침)");
+  if (name !== "baseline") checkBaseline(wt, baseText);
+  const before = { tree: treePrint(top), linked: linkedPrints(top, links) };
+  const patch = name === "baseline" ? null : claimLog(join(logs, `verify-bug-${name}-{ts}.patch`));
+  if (patch) writeFileSync(patch, diff);
+  const run = await runLogged({ log: join(logs, `verify-bug-${name}-{ts}.log`), argv, cwd: wt, timeoutS, shell });
+  const metrics = verdictMetrics(name, kind, run, readFileSync(run.file, "utf8"), baseText, before.linked);
+  metrics.push(`bug.${name}.oracle_sha=${oracleSha(wt)}`, `bug.${name}.links_to_repo=${before.linked.toRepo.length}`);
+  return { top, links, run, patch, metrics, before };
+}
+
+export async function runBug({ wt, name, kind, baseline, timeoutS = 300, argv, shell = false }) {
+  checkBugArgs(name, kind, baseline);
+  if (!argv.length) throw new Usage("판정기 명령이 없음(-- 뒤에 씀)");
+  let r;
+  try {
+    r = await bugBody({ wt, name, kind, baseText: baseline ? readFileSync(baseline, "utf8") : "", timeoutS, argv, shell });
+  } finally {
+    removeWorktree(wt);
+  }
+  const treeSame = treePrint(r.top) === r.before.tree;
+  const linkedSame = linkedPrints(r.top, r.links).key === r.before.linked.key;
+  r.metrics.push(`bug.${name}.tree_unchanged=${treeSame ? "yes" : "no"}`, `bug.${name}.links_unchanged=${linkedSame ? "yes" : "no"}`);
+  writeFileSync(r.run.file, `${readFileSync(r.run.file, "utf8")}${r.metrics.map((m) => `METRIC ${m}`).join("\n")}\n`);
+  return { log: r.run.file, patch: r.patch, metrics: r.metrics, unchanged: treeSame && linkedSame, toRepo: r.before.linked.toRepo };
+}

package/skills/make-evidence/scripts/me-precheck.mjs

@@ -0,0 +1,122 @@
+// make-evidence: what the user must decide before anything runs. Staged changes, changes outside the evidence
+// paths, and hosts that are not this machine in config files and in this process's environment. Only names,
+// places and hosts are shown, never a value. Pure Node, no network.
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
+import { EVIDENCE, EXCLUDE, MAX_TEXT, git, gitOut, headOf, lines, otherStatus, topOf } from "./me-git.mjs";
+
+
+const CONFIG_NAME = /^(\.env(\..+)?|.+\.env|(docker-)?compose.*\.ya?ml|application.*\.(ya?ml|properties)|appsettings.*\.json|database\.ya?ml|settings.*\.(py|json|ya?ml|toml)|config.*\.(json|ya?ml|toml|ini|js|mjs|cjs|ts)|.*\.properties|knexfile\..+|ormconfig\..+|schema\.prisma|alembic\.ini)$/i;
+const SKIP_DIR = new Set([".git", "node_modules", ".venv", "venv", "vendor", "dist", "build", "target", ".next", "__pycache__", ".tox", ".mypy_cache"]);
+const URL_HOST = /\b[a-z][\w+.-]*:\/\/(?:[^\s@/]+@)?(\[[^\]]+\]|[^\s/:'"?#,;)]+)/gi;
+const KEY_HOST = /\b[\w.-]*(?:host|hostname|server|addr|address|endpoint|data source)\b["']?\s*[=:]\s*["']?([^\s"',;)]+)/gi;
+const ENV_KEY = /(?:URL|URI|DSN|HOST|HOSTS|ADDR|ADDRESS|ENDPOINT|SERVER|SERVERS|BROKERS|NODES)$/i;
+// Values that name a host without a URL: connection strings (Server=..., Host=..., Data Source=...).
+const VALUE_HOST = /(?:^|;)\s*(?:server|host|data source|address|addr)\s*=/i;
+// A secret's value is never read for a host: it could be printed.
+const ENV_SECRET = /PASS|PWD|SECRET|TOKEN|CREDENTIAL|PRIVATE|_KEY$/i;
+const ENV_SKIP = /^(HOSTNAME|HOST|HOSTTYPE|DISPLAY|.*_?PROXY|NO_PROXY|NODE_EXTRA_CA_CERTS|BANKER_.*|DBUS_.*|XDG_.*)$/i;
+// Names that database and messaging libraries read from the environment without the project naming them.
+// Spring Boot and Quarkus take any setting from the environment, ASP.NET Core takes ConnectionStrings__*, Azure App
+// Service sets *CONNSTR_*.
+const ENV_DATA = /^(PG[A-Z]*|MYSQL_.*|POSTGRES.*|SPRING_.*|QUARKUS_.*|ConnectionStrings__.*|(?:SQL|SQLAZURE|MYSQL|POSTGRESQL|CUSTOM)CONNSTR_.*|DATABASE_.*|DB_.*|.*_DATABASE_URL|MONGO.*|REDIS.*|AMQP_.*|RABBITMQ_.*|KAFKA_.*|CELERY_.*|ELASTIC.*|OPENSEARCH_.*|SMTP_.*|MAIL_.*|AWS_ENDPOINT.*|S3_.*)$/i;
+const PLACEHOLDER = /^(\$|\{|<|%|\*|example\.|.*\.example$|.*\.invalid$|your[-_])/i;
+const MAX_DEPTH = 4;
+
+// Files that commonly hold where a service connects, up to four folders down; a linked file is read through.
+function configFiles(top) {
+  const out = [];
+  const descend = (p, name, depth) => depth < MAX_DEPTH && !SKIP_DIR.has(name) && relative(top, p) !== EVIDENCE;
+  const keep = (p) => { try { const st = statSync(p); return st.isFile() && st.size <= MAX_TEXT; } catch { return false; } }; // a broken link
+  const walk = (dir, depth) => {
+    let entries;
+    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      const p = join(dir, e.name);
+      if (e.isDirectory()) { if (descend(p, e.name, depth)) walk(p, depth + 1); }
+      else if (CONFIG_NAME.test(e.name) && keep(p)) out.push(p);
+    }
+  };
+  walk(top, 0);
+  return out;
+}
+
+// Service names in compose files: those name containers on this machine.
+function composeServices(files) {
+  const names = new Set();
+  for (const f of files.filter((p) => /compose.*\.ya?ml$/i.test(p))) {
+    let inServices = false;
+    for (const line of readFileSync(f, "utf8").split(/\r?\n/)) {
+      if (/^services:\s*$/.test(line)) { inServices = true; continue; }
+      if (/^\S/.test(line)) inServices = false;
+      const m = inServices && line.match(/^ {2}([\w.-]+):\s*$/);
+      if (m) names.add(m[1]);
+    }
+  }
+  return names;
+}
+
+export function isLocalHost(h, services = new Set()) {
+  const host = h.toLowerCase().replace(/^\[|\]$/g, "");
+  if (["localhost", "::1", "0.0.0.0", "host.docker.internal"].includes(host) || host.startsWith("127.")) return true;
+  return services.has(host);
+}
+
+function hostsIn(text, services) {
+  const found = [];
+  for (const re of [URL_HOST, KEY_HOST]) {
+    for (const m of text.matchAll(re)) {
+      const host = m[1].replace(/^\[|\]$/g, "").replace(/:\d+$/, "");
+      if (host && !PLACEHOLDER.test(host) && !/^\d+$|[/=]/.test(host) && !isLocalHost(host, services)) found.push(host);
+    }
+  }
+  return found;
+}
+
+// Environment variables that may say where the service connects. Asked about: those the project's tracked files
+// name (one git grep for all), and those database and messaging libraries read on their own (PGHOST,
+// SPRING_DATASOURCE_URL, REDIS_URL...). The rest are only noted: the shell's settings for other tools.
+function envCandidates(top, env) {
+  const candidate = (k) => ENV_KEY.test(k) || ENV_DATA.test(k) || /:\/\//.test(env[k]) || VALUE_HOST.test(env[k]);
+  const keys = Object.keys(env).filter((k) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(k) && env[k] && !ENV_SKIP.test(k) && !ENV_SECRET.test(k) && candidate(k));
+  if (!keys.length) return [];
+  // the evidence paths are left out: an earlier precheck log names these variables itself
+  const named = new Set(lines(git(top, ["grep", "-I", "-o", "-h", "-w", "-F", ...keys.flatMap((k) => ["-e", k]), "--", ".", ...EXCLUDE]).stdout));
+  return keys.map((k) => ({ k, ask: named.has(k) || ENV_DATA.test(k) }));
+}
+
+export function foreignHosts(top, env = process.env) {
+  const files = configFiles(top);
+  const services = composeServices(files);
+  const found = [];
+  for (const f of files) {
+    readFileSync(f, "utf8").split(/\r?\n/).forEach((line, i) => {
+      if (/^\s*(#|\/\/)/.test(line)) return;
+      for (const host of hostsIn(line, services)) found.push({ where: `${relative(top, f).split("\\").join("/")}:${i + 1}`, host });
+    });
+  }
+  for (const { k, ask } of envCandidates(top, env)) {
+    const v = env[k];
+    const text = /:\/\//.test(v) || VALUE_HOST.test(v) ? v : /HOST|SERVER|ADDR|BROKER|NODE/i.test(k) ? v.split(",").map((h) => `host=${h}`).join(" ") : `${k}=${v}`;
+    for (const host of hostsIn(text, services)) found.push({ where: `env ${k}`, host, note: !ask });
+  }
+  return found;
+}
+
+export function precheck(repo, env = process.env) {
+  const top = topOf(repo);
+  const staged = lines(gitOut(top, ["diff", "--cached", "--name-only"]));
+  const dirty = lines(otherStatus(top));
+  const ignored = ["logs/x.log", "logs/x.patch"].filter((p) => git(top, ["check-ignore", "-q", `${EVIDENCE}/${p}`]).status === 0);
+  const all = foreignHosts(top, env);
+  const hosts = all.filter((h) => !h.note);
+  const out = [`head ${headOf(top)}`];
+  for (const f of staged) out.push(`STOP staged ${f}`);
+  for (const l of dirty) out.push(`ASK dirty ${l}`);
+  // an environment variable's host is not printed: this output goes into a log that is committed
+  for (const h of hosts) out.push(h.where.startsWith("env ") ? `ASK host ${h.where} (이 컴퓨터 밖 주소)` : `ASK host ${h.where} ${h.host}`);
+  for (const k of new Set(all.filter((x) => x.note).map((x) => x.where))) out.push(`NOTE host ${k} (이 컴퓨터 밖 주소, 저장소가 부르지 않는 환경 변수. 서비스가 읽는다면 묻기)`);
+  for (const p of ignored) out.push(`NOTE ignored ${EVIDENCE}/${p} (commit 이 logs 아래의 .log 와 .patch 만 강제로 넣음)`);
+  out.push("NOTE precheck 는 흔한 설정 꼴만 봄. 시작 스크립트와 설정 로더가 읽는 곳도 직접 확인");
+  return { out, decide: staged.length + dirty.length + hosts.length > 0 };
+}