@kenkaiiii/ggcoder 5.67.1 → 5.68.1

package/dist/core/shell-threats.js

@@ -0,0 +1,186 @@
+/**
+ * Local, deterministic shell-threat rules. Run against every command the
+ * agent is about to execute (bash tool, task_send input) and refuse the
+ * clearly-dangerous shapes: pipe-to-shell installers, reverse shells, secret
+ * exfiltration, lookalike (IDN/punycode) hosts and terminal-escape tricks.
+ *
+ * These are regexes over the full command text, not a shell parser. Known
+ * trade-off: quoted text inside `echo`/`printf` (e.g. `echo "curl x | sh"`)
+ * may be flagged too. That false positive is acceptable — the agent can write
+ * such text to a file with the write tool instead.
+ */
+import { extractCommandHosts, hostFromUrl } from "./network-guard.js";
+const SHELLS = "(?:sudo\\s+)?(?:[\\w./-]*/)?(?:sh|bash|zsh|dash|ksh|python[\\d.]*|node|perl|ruby)\\b";
+const FETCHERS = "\\b(?:curl|wget)\\b";
+const PIPE_TO_SHELL = [
+    // curl … | sh  (any number of intermediate pipeline stages)
+    // An interpreter given an inline script (-c/-e/-m/-p) or a script file reads
+    // stdin as data (`curl … | python -m json.tool`), so that is not flagged.
+    new RegExp(`${FETCHERS}[^;&\\n]*\\|\\s*${SHELLS}(?!\\s+(?:-[cmepE]\\b|--eval\\b|--print\\b|[^-\\s|;&]))`, "i"),
+    // bash <(curl …)
+    new RegExp(`${SHELLS}\\s+<\\(\\s*(?:curl|wget)\\b`, "i"),
+    // sh -c "$(curl …)"  /  $(wget …) / `curl …` executed
+    new RegExp(`${SHELLS}\\s+(?:-\\w+\\s+)*["']?\\$\\(\\s*(?:curl|wget)\\b`, "i"),
+    new RegExp(`${SHELLS}\\s+(?:-\\w+\\s+)*["']?\`\\s*(?:curl|wget)\\b`, "i"),
+    // eval "$(curl …)"
+    /\beval\s+["']?\$\(\s*(?:curl|wget)\b/i,
+    // PowerShell: iex (iwr …) / irm … | iex / Invoke-Expression
+    /\b(?:iex|invoke-expression)\b[\s(]*(?:\(?\s*)(?:iwr|irm|invoke-webrequest|invoke-restmethod|\(?new-object\s+net\.webclient)/i,
+    /\b(?:iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n]*\|\s*(?:iex|invoke-expression)\b/i,
+    /\binvoke-expression\b/i,
+];
+const REVERSE_SHELL = [
+    /\/dev\/(?:tcp|udp)\//i,
+    // Case-sensitive: nc flags are case-significant (`-C` is CRLF, not `-c`).
+    /\b(?:nc|ncat|netcat)\b[^|;&\n]*\s(?:-[a-zA-Z]*[ec]\b|--exec\b|--sh-exec\b|-e\S|-c\S)/,
+    /\bsocat\b[^\n]*\b(?:exec|system):/i,
+    /\bbash\s+-i\s*>&/i,
+];
+/** python -c / perl -e one-liners that open a socket and connect/spawn. */
+function isScriptReverseShell(command) {
+    if (!/\b(?:python[\d.]*\s+-c|perl\s+-e)\b/i.test(command))
+        return false;
+    return /\bsocket\b/i.test(command) && /\b(?:connect|subprocess|exec)\b/i.test(command);
+}
+const SECRET_SOURCES = [
+    /~\/\.ssh\//,
+    /\.ssh\//,
+    /\bid_(?:rsa|ed25519|ecdsa|dsa)\b/,
+    /\.aws\/credentials\b/,
+    /\.gg\/auth\.json\b/,
+    /\.netrc\b/,
+    /\.npmrc\b/,
+    // `.env` / `.env.local` as a path component, but not `.env.example`/`.env.sample`.
+    /(?:^|[\s/'"=@<])\.env(?!\.(?:example|sample|template|dist)\b)(?:\.[\w-]+)?(?=$|[\s'"|;&)>])/,
+    /\bsecurity\s+find-(?:generic|internet)-password\b/,
+    /(?:^|[;&|(]\s*)(?:printenv|env)\s*(?:\||$)/m,
+];
+const NETWORK_SINKS = [
+    // Case-sensitive: `-f`/`-t`/`-D` are not upload flags. A short cluster such
+    // as `-sd` counts only when the data flag is last (it takes the value).
+    /\bcurl\b[^\n]*\s(?:-[a-zA-Z]*[dFT]|--data(?:-\w+)?|--form(?:-string)?|--upload-file)(?=[\s=@'"]|$)/,
+    /\bcurl\b[^\n]*\s@\S/i,
+    /\bwget\b[^\n]*--post-(?:data|file)\b/i,
+    /\b(?:nc|ncat|netcat)\s/i,
+    /\b(?:scp|rsync)\b[^\n]*\s[\w.@-]+:/i,
+    /\bxargs\b[^\n]*\b(?:curl|wget)\b/i,
+    /\bfind\b[^\n]*-exec\s+(?:curl|wget)\b/i,
+];
+// eslint-disable-next-line no-control-regex -- matching ESC is the point
+const TERMINAL_TRICK = /[\u001b\u202a-\u202e\u2066-\u2069\u200b-\u200d\u2060\ufeff]/u;
+function codepoint(ch) {
+    return `U+${(ch.codePointAt(0) ?? 0).toString(16).toUpperCase().padStart(4, "0")}`;
+}
+/** Programs whose bare dotted operands are hostnames (`ping аpple.com`). */
+const NETWORK_PROGRAMS = new Set([
+    "curl",
+    "wget",
+    "ping",
+    "ssh",
+    "scp",
+    "sftp",
+    "rsync",
+    "git",
+    "nc",
+    "ncat",
+    "netcat",
+    "telnet",
+    "ftp",
+    "dig",
+    "nslookup",
+    "host",
+    "http",
+    "https",
+]);
+/**
+ * Candidate hostnames: URL authorities anywhere, plus bare dotted operands of
+ * network programs only — so non-ASCII file names (`cat résumé.pdf`) pass.
+ */
+function candidateHosts(command) {
+    const out = new Set();
+    for (const m of command.matchAll(/[a-z][a-z0-9+.-]*:\/\/(?:[^@\s/'"]*@)?([^\s/:'"?#]+)/giu)) {
+        if (m[1])
+            out.add(m[1].toLowerCase());
+    }
+    for (const segment of command.split(/(?:&&|\|\||[;|\n])/)) {
+        const tokens = segment.split(/[\s'"()<>]+/).filter((t) => t.length > 0);
+        if (tokens[0] === "sudo")
+            tokens.shift();
+        const program = (tokens[0] ?? "").split("/").pop() ?? "";
+        if (!NETWORK_PROGRAMS.has(program))
+            continue;
+        for (const token of tokens.slice(1)) {
+            const bare = token.replace(/^[\w.-]*@/, "").split(/[/:?#]/)[0] ?? "";
+            if (/^[\p{L}\p{N}-]+(?:\.[\p{L}\p{N}-]+)+$/u.test(bare) && /\p{L}/u.test(bare)) {
+                out.add(bare.toLowerCase());
+            }
+        }
+    }
+    for (const host of extractCommandHosts(command))
+        out.add(host);
+    return [...out];
+}
+function lookalikeThreats(command) {
+    const threats = [];
+    const seen = new Set();
+    for (const host of candidateHosts(command)) {
+        const nonAscii = /[^\p{ASCII}]/u.test(host);
+        const punycodeLabel = host.split(".").some((label) => label.startsWith("xn--"));
+        if (!nonAscii && !punycodeLabel)
+            continue;
+        const ascii = nonAscii ? (hostFromUrl(`http://${host}`) ?? host) : host;
+        if (seen.has(ascii))
+            continue;
+        seen.add(ascii);
+        threats.push({
+            rule: "lookalike-host",
+            severity: "block",
+            detail: nonAscii
+                ? `host "${host}" contains non-ASCII characters (resolves as ${ascii}) — likely a lookalike of a real domain`
+                : `host "${host}" uses a punycode (xn--) label — likely a lookalike of a real domain`,
+        });
+    }
+    return threats;
+}
+export function checkShellThreats(command) {
+    const threats = [];
+    const trick = TERMINAL_TRICK.exec(command);
+    if (trick) {
+        threats.push({
+            rule: "terminal-tricks",
+            severity: "block",
+            detail: `command contains invisible/control character ${codepoint(trick[0])} (ANSI escape, bidi override or zero-width) that can hide what actually runs`,
+        });
+    }
+    if (PIPE_TO_SHELL.some((re) => re.test(command))) {
+        threats.push({
+            rule: "pipe-to-shell",
+            severity: "block",
+            detail: "remote content is executed directly by a shell/interpreter. Download it to a file first " +
+                "(e.g. `curl -fsSL -o install.sh <url>`), read it, then run it.",
+        });
+    }
+    if (REVERSE_SHELL.some((re) => re.test(command)) || isScriptReverseShell(command)) {
+        threats.push({
+            rule: "reverse-shell",
+            severity: "block",
+            detail: "command matches a reverse-shell pattern (remote shell access over a socket)",
+        });
+    }
+    if (SECRET_SOURCES.some((re) => re.test(command)) &&
+        NETWORK_SINKS.some((re) => re.test(command))) {
+        threats.push({
+            rule: "secret-exfil",
+            severity: "block",
+            detail: "command reads secret material (keys, credentials, .env, environment) and sends data over the network",
+        });
+    }
+    threats.push(...lookalikeThreats(command));
+    return threats;
+}
+/** First blocking threat as a refusal message, or null when the command may run. */
+export function shellThreatBlockMessage(command) {
+    const threat = checkShellThreats(command).find((t) => t.severity === "block");
+    return threat ? `Blocked by shell safety check (${threat.rule}): ${threat.detail}` : null;
+}
+//# sourceMappingURL=shell-threats.js.map

package/dist/core/shell-threats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-threats.js","sourceRoot":"","sources":["../../src/core/shell-threats.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAQtE,MAAM,MAAM,GACV,sFAAsF,CAAC;AACzF,MAAM,QAAQ,GAAG,qBAAqB,CAAC;AAEvC,MAAM,aAAa,GAAsB;IACvC,4DAA4D;IAC5D,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,MAAM,CACR,GAAG,QAAQ,mBAAmB,MAAM,yDAAyD,EAC7F,GAAG,CACJ;IACD,iBAAiB;IACjB,IAAI,MAAM,CAAC,GAAG,MAAM,8BAA8B,EAAE,GAAG,CAAC;IACxD,sDAAsD;IACtD,IAAI,MAAM,CAAC,GAAG,MAAM,mDAAmD,EAAE,GAAG,CAAC;IAC7E,IAAI,MAAM,CAAC,GAAG,MAAM,+CAA+C,EAAE,GAAG,CAAC;IACzE,mBAAmB;IACnB,uCAAuC;IACvC,4DAA4D;IAC5D,8HAA8H;IAC9H,4FAA4F;IAC5F,wBAAwB;CACzB,CAAC;AAEF,MAAM,aAAa,GAAsB;IACvC,uBAAuB;IACvB,0EAA0E;IAC1E,sFAAsF;IACtF,oCAAoC;IACpC,mBAAmB;CACpB,CAAC;AAEF,2EAA2E;AAC3E,SAAS,oBAAoB,CAAC,OAAe;IAC3C,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,cAAc,GAAsB;IACxC,YAAY;IACZ,SAAS;IACT,kCAAkC;IAClC,sBAAsB;IACtB,oBAAoB;IACpB,WAAW;IACX,WAAW;IACX,mFAAmF;IACnF,6FAA6F;IAC7F,mDAAmD;IACnD,6CAA6C;CAC9C,CAAC;AAEF,MAAM,aAAa,GAAsB;IACvC,4EAA4E;IAC5E,wEAAwE;IACxE,oGAAoG;IACpG,sBAAsB;IACtB,uCAAuC;IACvC,yBAAyB;IACzB,qCAAqC;IACrC,mCAAmC;IACnC,wCAAwC;CACzC,CAAC;AAEF,yEAAyE;AACzE,MAAM,cAAc,GAAG,8DAA8D,CAAC;AAEtF,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,KAAK;IACL,IAAI;IACJ,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,KAAK;IACL,UAAU;IACV,MAAM;IACN,MAAM;IACN,OAAO;CACR,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,yDAAyD,CAAC,EAAE,CAAC;QAC5F,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM;YAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACrE,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,mBAAmB,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa;YAAE,SAAS;QAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,QAAQ;gBACd,CAAC,CAAC,SAAS,IAAI,gDAAgD,KAAK,yCAAyC;gBAC7G,CAAC,CAAC,SAAS,IAAI,sEAAsE;SACxF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,gDAAgD,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,8EAA8E;SAC1J,CAAC,CAAC;IACL,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,OAAO;YACjB,MAAM,EACJ,0FAA0F;gBAC1F,gEAAgE;SACnE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QAClF,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,6EAA6E;SACtF,CAAC,CAAC;IACL,CAAC;IAED,IACE,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAC5C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,OAAO;YACjB,MAAM,EACJ,sGAAsG;SACzG,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC,CAAC,CAAC,kCAAkC,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5F,CAAC"}

package/dist/core/stream-rules.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Loads stream rules (regex guards matched against the model's streaming
+ * output — see gg-agent `stream-rules.ts`) from markdown files:
+ *
+ *   ~/.gg/rules/*.md          user rules (trusted)
+ *   <cwd>/.gg/rules/*.md      project rules (untrusted; override user rules by name)
+ *
+ * No rules ship built in. Example `.gg/rules/no-console-log.md`:
+ *
+ *   ---
+ *   name: no-console-log
+ *   trigger: console\.log\(
+ *   scope: tool            # text | tool | both (default both)
+ *   tools: [edit, write]   # optional; restricts tool-scope matching
+ *   ---
+ *   Do not add console.log calls. Use the project logger (`log()` from
+ *   core/logger.ts) instead.
+ *
+ * `trigger` is a JavaScript regex source; `/source/flags` form is accepted
+ * with flags from `imsu`. The body is the reminder shown to the model when the
+ * rule fires (trimmed, capped at 1,000 chars). Project triggers longer than
+ * 300 chars or with nested quantifiers (catastrophic-backtracking risk) are
+ * skipped. Invalid files are skipped with a WARN log; loading never throws.
+ */
+import type { StreamRule } from "@kenkaiiii/gg-agent";
+export declare const MAX_STREAM_RULES = 50;
+export declare const MAX_STREAM_RULE_REMINDER_CHARS = 1000;
+export declare const MAX_PROJECT_TRIGGER_CHARS = 300;
+/** Load user + project stream rules. Project rules override user rules with the same name. */
+export declare function loadStreamRules(cwd: string, home?: string): Promise<StreamRule[]>;

package/dist/core/stream-rules.js

@@ -0,0 +1,151 @@
+/**
+ * Loads stream rules (regex guards matched against the model's streaming
+ * output — see gg-agent `stream-rules.ts`) from markdown files:
+ *
+ *   ~/.gg/rules/*.md          user rules (trusted)
+ *   <cwd>/.gg/rules/*.md      project rules (untrusted; override user rules by name)
+ *
+ * No rules ship built in. Example `.gg/rules/no-console-log.md`:
+ *
+ *   ---
+ *   name: no-console-log
+ *   trigger: console\.log\(
+ *   scope: tool            # text | tool | both (default both)
+ *   tools: [edit, write]   # optional; restricts tool-scope matching
+ *   ---
+ *   Do not add console.log calls. Use the project logger (`log()` from
+ *   core/logger.ts) instead.
+ *
+ * `trigger` is a JavaScript regex source; `/source/flags` form is accepted
+ * with flags from `imsu`. The body is the reminder shown to the model when the
+ * rule fires (trimmed, capped at 1,000 chars). Project triggers longer than
+ * 300 chars or with nested quantifiers (catastrophic-backtracking risk) are
+ * skipped. Invalid files are skipped with a WARN log; loading never throws.
+ */
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { parseFrontmatter } from "./frontmatter.js";
+import { log } from "./logger.js";
+export const MAX_STREAM_RULES = 50;
+export const MAX_STREAM_RULE_REMINDER_CHARS = 1000;
+export const MAX_PROJECT_TRIGGER_CHARS = 300;
+/** Heuristic for nested quantifiers like `(a+)+`, `(\w*)*`, `(x+){2,}`. */
+const NESTED_QUANTIFIER = /\([^)]*[+*][^)]*\)[+*{]/;
+const REGEX_LITERAL = /^\/(.+)\/([imsu]*)$/s;
+async function listRuleFiles(dir) {
+    try {
+        const entries = await fs.readdir(dir, { withFileTypes: true });
+        return entries
+            .filter((e) => e.isFile() && e.name.toLowerCase().endsWith(".md"))
+            .map((e) => path.join(dir, e.name))
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+function parseTools(raw) {
+    if (raw === undefined)
+        return undefined;
+    const tools = raw
+        .replace(/^\[|\]$/g, "")
+        .split(/[\s,]+/)
+        .map((t) => t
+        .replace(/^-+$/, "")
+        .replace(/^["']|["']$/g, "")
+        .trim())
+        .filter(Boolean);
+    return tools.length > 0 ? tools : undefined;
+}
+function parseScope(raw) {
+    if (raw === undefined || raw.trim() === "")
+        return "both";
+    const scope = raw.trim().toLowerCase();
+    return scope === "text" || scope === "tool" || scope === "both" ? scope : null;
+}
+function compileTrigger(trigger, origin) {
+    if (origin === "project") {
+        if (trigger.length > MAX_PROJECT_TRIGGER_CHARS) {
+            return `trigger exceeds ${MAX_PROJECT_TRIGGER_CHARS} chars`;
+        }
+        if (NESTED_QUANTIFIER.test(trigger))
+            return "trigger has nested quantifiers";
+    }
+    const literal = REGEX_LITERAL.exec(trigger);
+    try {
+        return literal ? new RegExp(literal[1], literal[2]) : new RegExp(trigger);
+    }
+    catch (err) {
+        return `invalid regex: ${err instanceof Error ? err.message : String(err)}`;
+    }
+}
+async function readRule(file, origin) {
+    const skip = (reason) => {
+        log("WARN", "stream-rules", `Skipping stream rule ${file}: ${reason}`);
+        return null;
+    };
+    let raw;
+    try {
+        raw = await fs.readFile(file, "utf8");
+    }
+    catch (err) {
+        return skip(`unreadable (${err instanceof Error ? err.message : String(err)})`);
+    }
+    const { fields, body, hasFrontmatter } = parseFrontmatter(raw);
+    if (!hasFrontmatter)
+        return skip("missing frontmatter");
+    const name = fields.name?.trim();
+    if (!name)
+        return skip("missing name");
+    const trigger = fields.trigger?.trim();
+    if (!trigger)
+        return skip("missing trigger");
+    const scope = parseScope(fields.scope);
+    if (!scope)
+        return skip(`invalid scope "${fields.scope ?? ""}"`);
+    const pattern = compileTrigger(trigger, origin);
+    if (typeof pattern === "string")
+        return skip(pattern);
+    const reminder = body.trim().slice(0, MAX_STREAM_RULE_REMINDER_CHARS);
+    if (!reminder)
+        return skip("empty reminder body");
+    const tools = parseTools(fields.tools);
+    return { name, pattern, scope, reminder, ...(tools ? { tools } : {}) };
+}
+async function loadDir(dir, origin) {
+    const rules = [];
+    for (const file of await listRuleFiles(dir)) {
+        const rule = await readRule(file, origin);
+        if (rule)
+            rules.push(rule);
+    }
+    return rules;
+}
+/** Load user + project stream rules. Project rules override user rules with the same name. */
+export async function loadStreamRules(cwd, home = os.homedir()) {
+    try {
+        const byName = new Map();
+        for (const rule of await loadDir(path.join(home, ".gg", "rules"), "user")) {
+            byName.set(rule.name, rule);
+        }
+        const projectDir = path.join(cwd, ".gg", "rules");
+        // cwd === home would load the same dir twice and apply untrusted limits to user rules.
+        if (path.resolve(projectDir) !== path.resolve(home, ".gg", "rules")) {
+            for (const rule of await loadDir(projectDir, "project")) {
+                byName.delete(rule.name);
+                byName.set(rule.name, rule);
+            }
+        }
+        const rules = [...byName.values()];
+        if (rules.length > MAX_STREAM_RULES) {
+            log("WARN", "stream-rules", `Only the first ${MAX_STREAM_RULES} of ${rules.length} stream rules are used`);
+        }
+        return rules.slice(0, MAX_STREAM_RULES);
+    }
+    catch (err) {
+        log("WARN", "stream-rules", `Failed to load stream rules: ${err instanceof Error ? err.message : String(err)}`);
+        return [];
+    }
+}
+//# sourceMappingURL=stream-rules.js.map

package/dist/core/stream-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-rules.js","sourceRoot":"","sources":["../../src/core/stream-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AACnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAE7C,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AACpD,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAI7C,KAAK,UAAU,aAAa,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO,OAAO;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;aACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;aAClC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAuB;IACzC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG;SACd,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,CAAC;SACE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,IAAI,EAAE,CACV;SACA,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,GAAuB;IACzC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC;IAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,MAAkB;IACzD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YAC/C,OAAO,mBAAmB,yBAAyB,QAAQ,CAAC;QAC9D,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,gCAAgC,CAAC;IAC/E,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,MAAkB;IACtD,MAAM,IAAI,GAAG,CAAC,MAAc,EAAQ,EAAE;QACpC,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,wBAAwB,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,eAAe,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,IAAI,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,MAAkB;IACpD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,OAAe,EAAE,CAAC,OAAO,EAAE;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;YAC1E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAClD,uFAAuF;QACvF,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACpE,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;gBACxD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACpC,GAAG,CACD,MAAM,EACN,cAAc,EACd,kBAAkB,gBAAgB,OAAO,KAAK,CAAC,MAAM,wBAAwB,CAC9E,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CACD,MAAM,EACN,cAAc,EACd,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnF,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/motion-agent/motion-check-tool.d.ts

@@ -27,6 +27,13 @@ export declare function spotSampleTimes(windows: readonly {
     start: number;
     end: number;
 }[], fps: number, duration: number): number[];
+/**
+ * Browser pages `hf check` audits sample times on at once. Each seek mostly waits on a fixed
+ * settle, so pages overlap almost perfectly: on a 25 s reel, 4 pages took the audit from 90 s
+ * to 29 s for ~1.1 GB more memory (each page holds its own copy of the composition), with the
+ * same report. Capped at 4 so a render running alongside keeps its cores.
+ */
+export declare function auditPages(cpus: number, memoryBytes: number): number;
 /** One explicit check; the working agent sees the frames, with no separate model or approval loop. */
 export declare function createMotionCheckTool(cwd: string, bundle: MotionBundle, limits?: {
     sourceCheckMs?: number;

package/dist/motion-agent/motion-check-tool.js

@@ -124,16 +124,71 @@ function summarizeFlashes(output) {
         "most three in any second, shrinking the flashing area below about 3% of the frame, or " +
         "reducing the brightness difference between the alternating states.");
 }
-/** Source fingerprint for reusing a passing audit; a project it cannot fingerprint is re-audited. */
-async function sourceFingerprint(project, output, signal) {
+/**
+ * Source fingerprint for reusing a passing audit; a project it cannot fingerprint is re-audited.
+ * The hold plan is excluded: the composition never reads it, and the pixel check re-reads it.
+ */
+async function sourceFingerprint(project, output, holds, signal) {
     try {
-        return await motionSourceHash(project, output, signal);
+        return await motionSourceHash(project, output, signal, holds ? [holds] : []);
     }
     catch {
         signal.throwIfAborted();
         return undefined;
     }
 }
+/**
+ * Browser pages `hf check` audits sample times on at once. Each seek mostly waits on a fixed
+ * settle, so pages overlap almost perfectly: on a 25 s reel, 4 pages took the audit from 90 s
+ * to 29 s for ~1.1 GB more memory (each page holds its own copy of the composition), with the
+ * same report. Capped at 4 so a render running alongside keeps its cores.
+ */
+export function auditPages(cpus, memoryBytes) {
+    const byCpu = Math.floor(cpus / 2);
+    const byMemory = Math.floor(memoryBytes / 4 / 1024 ** 3);
+    return Math.max(1, Math.min(4, byCpu, byMemory));
+}
+/** Frame rate and duration of the export, or undefined when they are missing or out of range. */
+async function probeVideo(ffprobe, output, signal) {
+    let stdout;
+    try {
+        ({ stdout } = await exec(ffprobe, [
+            "-v",
+            "error",
+            "-protocol_whitelist",
+            "file,pipe",
+            "-select_streams",
+            "v:0",
+            "-show_entries",
+            "stream=avg_frame_rate:format=duration",
+            "-of",
+            "json",
+            output,
+        ], {
+            signal: AbortSignal.any([signal, AbortSignal.timeout(STEP_MS)]),
+            maxBuffer: 64 * 1024,
+            windowsHide: true,
+        }));
+    }
+    catch {
+        signal.throwIfAborted();
+        return undefined;
+    }
+    let json;
+    try {
+        json = JSON.parse(stdout);
+    }
+    catch {
+        return undefined;
+    }
+    const video = videoSchema.safeParse(json);
+    if (!video.success)
+        return undefined;
+    const [num, den] = video.data.streams[0].avg_frame_rate.split("/").map(Number);
+    const fps = Number(num) / Number(den);
+    const duration = Number(video.data.format.duration);
+    return fps >= 1 && fps <= 120 && duration > 0 && duration <= 3600 ? { fps, duration } : undefined;
+}
 /**
  * `hf check --json` prints ~100 KB for a busy video. Give the agent what it acts on:
  * per-section counts, every error with where and when, warning types, and
@@ -303,32 +358,17 @@ export function createMotionCheckTool(cwd, bundle, limits = {}) {
                     windowsHide: true,
                 });
                 const { ffmpeg, ffprobe } = binariesSchema.parse(JSON.parse(binaries.stdout));
-                let sampling = ["--at-transitions"];
+                const video = await probeVideo(ffprobe, output, signal);
+                // Tween boundaries and midpoints land between frames: on a cut-heavy video most are
+                // instants no viewer sees. Moving each onto its nearest rendered frame (and merging
+                // duplicates) audits only what the export shows: ~460 → ~300 seeks on a 10 s reel.
+                // Unreadable metadata keeps the unsnapped audit rather than skipping the check.
+                let sampling = ["--at-transitions", ...(video ? [`--frame-rate=${video.fps}`] : [])];
                 let spotFrames;
                 if (input.spot) {
-                    const probe = await exec(ffprobe, [
-                        "-v",
-                        "error",
-                        "-protocol_whitelist",
-                        "file,pipe",
-                        "-select_streams",
-                        "v:0",
-                        "-show_entries",
-                        "stream=avg_frame_rate:format=duration",
-                        "-of",
-                        "json",
-                        output,
-                    ], {
-                        signal: AbortSignal.any([signal, AbortSignal.timeout(STEP_MS)]),
-                        maxBuffer: 64 * 1024,
-                        windowsHide: true,
-                    });
-                    const video = videoSchema.parse(JSON.parse(probe.stdout));
-                    const [num, den] = video.streams[0].avg_frame_rate.split("/").map(Number);
-                    const fps = Number(num) / Number(den);
-                    const duration = Number(video.format.duration);
-                    if (!(fps >= 1 && fps <= 120 && duration > 0 && duration <= 3600))
+                    if (!video)
                         throw new Error("Unsupported video metadata for a spot check");
+                    const { fps, duration } = video;
                     const times = spotSampleTimes(input.windows, fps, duration);
                     if (!times.length)
                         throw new Error("Spot windows contain no rendered frames");
@@ -339,9 +379,11 @@ export function createMotionCheckTool(cwd, bundle, limits = {}) {
                     spotFrames = times.length;
                     sampling = ["--at", times.join(",")];
                 }
-                const fingerprint = input.spot
+                // The frame rate decides which instants are audited, so a pass holds only for it.
+                const source = input.spot
                     ? undefined
-                    : await sourceFingerprint(project, output, signal);
+                    : await sourceFingerprint(project, output, holds, signal);
+                const fingerprint = source === undefined ? undefined : `${source}@${video?.fps ?? 0}`;
                 const passed = passedSources.get(project);
                 let runtime;
                 if (fingerprint !== undefined && passed?.fingerprint === fingerprint) {
@@ -354,12 +396,20 @@ export function createMotionCheckTool(cwd, bundle, limits = {}) {
                 }
                 else {
                     // HyperFrames check includes lint; running `hf lint` separately duplicates that work.
-                    runtime = await run(SOURCE_CHECK, process.execPath, [bundle.launcher, "check", project, "--json", "--contrast", ...sampling], { timeoutMs: sourceCheckMs, describe: summarizeSourceCheck });
+                    runtime = await run(SOURCE_CHECK, process.execPath, [
+                        bundle.launcher,
+                        "check",
+                        project,
+                        "--json",
+                        "--contrast",
+                        ...sampling,
+                        `--workers=${auditPages(os.availableParallelism(), os.totalmem())}`,
+                    ], { timeoutMs: sourceCheckMs, describe: summarizeSourceCheck });
                     // Keep a pass only if the source did not change while it was being audited.
                     if (fingerprint !== undefined &&
                         runtime !== null &&
                         isMotionTechnicalReport(runtime.stdout) &&
-                        (await sourceFingerprint(project, output, signal)) === fingerprint)
+                        (await sourceFingerprint(project, output, holds, signal)) === source)
                         passedSources.set(project, { fingerprint, result: runtime });
                 }
                 validate("Structured runtime report", runtime !== null && isMotionTechnicalReport(runtime.stdout));