@kya-os/cli 1.8.1 → 1.8.3

package/dist/utils/dco/dispatch.js

@@ -0,0 +1,399 @@
+import { execFile } from "child_process";
+import { existsSync, lstatSync, readFileSync, rmSync } from "fs";
+import { basename, join } from "path";
+import { promisify } from "util";
+import { writeFileAtomicSafe } from "../cli-kit/index.js";
+import { getPullRequestBody } from "./github.js";
+import { signingKeyPath } from "./paths.js";
+import { resolveAgentIdentity } from "./resolve-agent.js";
+import { RESOLVE_TIMEOUT_MS, didWebToHttpsUrl, hasAgentDidClaim, verifyPrAttribution, } from "./verify.js";
+const execFileAsync = promisify(execFile);
+async function run(cmd, args, cwd) {
+    const { stdout } = await execFileAsync(cmd, args, {
+        cwd,
+        encoding: "utf8",
+        maxBuffer: 10 * 1024 * 1024,
+    });
+    return stdout.trim();
+}
+async function gitSucceeds(args, cwd) {
+    try {
+        await run("git", args, cwd);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function errorMessage(error) {
+    if (error && typeof error === "object" && "stderr" in error) {
+        const stderr = String(error.stderr ?? "").trim();
+        if (stderr) {
+            return stderr;
+        }
+    }
+    return error instanceof Error ? error.message : String(error);
+}
+// commitlint's default subject-max-length is 100; ~72 for the PR title
+// mirrors GitHub's own soft wrap, and ~60 after the "docs: " prefix keeps the
+// full commit subject comfortably inside that even in stricter repos.
+const MAX_TITLE_LENGTH = 72;
+const MAX_COMMIT_SUBJECT_LENGTH = 60;
+function truncate(value, maxLength) {
+    return value.length > maxLength ? value.slice(0, maxLength).trimEnd() : value;
+}
+/**
+ * Resolve the PR title: the explicit `--title`, or the description's first
+ * NON-EMPTY line when omitted (a description that opens with a blank line,
+ * e.g. "\n\nActual title", must not yield an empty title). Either way it's
+ * truncated to a safe length, since the title also seeds the commit subject
+ * and a raw description can run long.
+ */
+export function deriveDispatchTitle(description, explicitTitle) {
+    if (explicitTitle && explicitTitle.trim().length > 0) {
+        return truncate(explicitTitle.trim(), MAX_TITLE_LENGTH);
+    }
+    const firstNonEmptyLine = description
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .find((line) => line.length > 0);
+    return truncate(firstNonEmptyLine ?? "", MAX_TITLE_LENGTH);
+}
+/**
+ * Lowercase subject on purpose: commitlint `subject-case` hooks reject an
+ * uppercase one, and lowercase passes everywhere. Truncated separately from
+ * the title (after the "docs: " prefix) so a title near MAX_TITLE_LENGTH
+ * still yields a commit subject well inside commitlint's own length rule.
+ */
+export function buildDispatchCommitSubject(title) {
+    return `docs: ${truncate(title.toLowerCase(), MAX_COMMIT_SUBJECT_LENGTH)}`;
+}
+/**
+ * Extra `git -c` config prepended to the commit so it signs with the exact
+ * key belonging to the agent this run is attributing the PR to, regardless
+ * of what the repo's ambient config says (and so agent-slug mode works from
+ * any repo, with no `.mcpi/` state there at all).
+ */
+function buildSigningConfig(keyPath) {
+    return [
+        "-c",
+        "gpg.format=ssh",
+        "-c",
+        "commit.gpgsign=true",
+        "-c",
+        `user.signingkey=${keyPath}`,
+    ];
+}
+/**
+ * Whether `rawCommit` (the raw `git cat-file commit HEAD` output) carries a
+ * `gpgsig` header — the reliable signed-commit check (`git log
+ * --show-signature` needs `gpg.ssh.allowedSignersFile` locally and
+ * misreports otherwise). Exported so `dispatch.ts` and `fix.ts` share the
+ * exact same check rather than each re-deriving it: a raw commit object is
+ * headers, then ONE blank line, then the free-text commit message, and a
+ * naive `/^gpgsig /m.test(rawCommit)` over the WHOLE string false-positives
+ * on an unsigned commit whose message body happens to contain a line
+ * starting with "gpgsig " (an agent-composed `-m`/`--message` value is
+ * exactly that kind of free text). Splitting off the header section before
+ * testing closes that gap: git's object format guarantees no blank line
+ * appears within the headers themselves, including a multi-line `gpgsig`
+ * value's space-prefixed continuation lines, so the first `\n\n` reliably
+ * marks the header/message boundary.
+ */
+export function isCommitSigned(rawCommit) {
+    const headers = rawCommit.split("\n\n")[0] ?? "";
+    return /^gpgsig /m.test(headers);
+}
+/** Fail fast when the DID isn't claimed/resolvable, BEFORE any git or GitHub
+ * side effects: an unclaimed agent otherwise only surfaces as a verification
+ * failure after a junk repo, branch, and PR already exist. */
+async function resolveDidPreflight(did) {
+    const documentUrl = didWebToHttpsUrl(did);
+    if (!documentUrl) {
+        return `could not derive a document URL from ${did}`;
+    }
+    try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), RESOLVE_TIMEOUT_MS);
+        let response;
+        try {
+            response = await fetch(documentUrl, {
+                signal: controller.signal,
+                redirect: "manual",
+            });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (!response.ok) {
+            return `HTTP ${response.status} from ${documentUrl}`;
+        }
+        const doc = (await response.json());
+        if (doc?.id !== did) {
+            return `${documentUrl} describes ${String(doc?.id)}, not ${did}`;
+        }
+        return null;
+    }
+    catch (error) {
+        return `${documentUrl} unreachable: ${errorMessage(error)}`;
+    }
+}
+/**
+ * Resolve the agent identity, slug-derived DID, and per-invocation git
+ * signing config for a dispatch-style operation: either an explicit
+ * `--agent <slug>` (signs with `~/.mcpi/keys/<slug>`, works from any repo
+ * and ignores conflicting repo signing config) or the checkout's own
+ * `.mcpi/` identity. Fails closed, in order, BEFORE any git or GitHub side
+ * effects: invalid/missing slug, missing signing key, then DID preflight
+ * (`resolveDidPreflight`) so an unclaimed agent never reaches a git or `gh`
+ * call.
+ *
+ * `runDcoDispatch` below and `runDcoFix` (`fix.ts`) both call this instead
+ * of re-deriving the same agent/DID/signing-key logic: a second
+ * implementation that drifted from this one could sign a commit with a
+ * different key than the one an `Agent DID:`/attestation line claims.
+ */
+export async function resolveSigningIdentity(cwd, agentSlug) {
+    let agent;
+    let signingConfig;
+    let keyPath;
+    if (agentSlug) {
+        try {
+            keyPath = signingKeyPath(agentSlug);
+        }
+        catch (error) {
+            return { ok: false, failure: errorMessage(error) };
+        }
+        if (!existsSync(keyPath)) {
+            return {
+                ok: false,
+                failure: `No signing key for agent "${agentSlug}" at ${keyPath}. Run \`dco setup ${agentSlug}\` once, or check the slug.`,
+            };
+        }
+        agent = {
+            name: agentSlug,
+            slug: agentSlug,
+            url: `https://knowthat.ai/agents/${agentSlug}`,
+        };
+        signingConfig = buildSigningConfig(keyPath);
+    }
+    else {
+        const resolved = await resolveAgentIdentity(cwd);
+        if (!resolved) {
+            return {
+                ok: false,
+                failure: 
+                // Command-agnostic on purpose: `dco fix` takes the slug via
+                // `--agent <slug>`, `dco dispatch` takes it as a leading
+                // positional (`dco dispatch <slug> <description>`) with no
+                // --agent option at all, and this failure is shared by both.
+                "No agent identity configured in this checkout. Run `kya-os register` + `dco setup` here, or specify an existing claimed agent's slug (see this command's --help for the syntax).",
+            };
+        }
+        agent = { name: resolved.name, slug: resolved.slug, url: resolved.url };
+        // Sign with the SAME agent's key the PR/commit is attributed to, exactly
+        // like agent-slug mode, instead of silently relying on whatever ambient
+        // repo git config happens to be configured: without this, a checkout
+        // signed by a different key (or unsigned) than the one named in the
+        // Agent DID line would produce a commit whose signature and attribution
+        // disagree.
+        try {
+            keyPath = signingKeyPath(resolved.slug);
+        }
+        catch (error) {
+            return { ok: false, failure: errorMessage(error) };
+        }
+        if (!existsSync(keyPath)) {
+            return {
+                ok: false,
+                failure: `No signing key for agent "${resolved.slug}" at ${keyPath}. Run \`dco setup\` in this checkout, then try again.`,
+            };
+        }
+        signingConfig = buildSigningConfig(keyPath);
+    }
+    // Built from the slug instead of trusting identity.json's `did`, which can
+    // still hold the unresolvable pre-claim placeholder (known bug; see the
+    // quickstart runbook). The slug is what registration actually persisted.
+    const did = `did:web:knowthat.ai:agents:${agent.slug}`;
+    const unresolvable = await resolveDidPreflight(did);
+    if (unresolvable) {
+        return {
+            ok: false,
+            failure: `Agent DID ${did} does not resolve (${unresolvable}). ` +
+                // Same command-agnostic wording as the "no agent identity" failure
+                // above — see its comment.
+                "Only a claimed registry agent can sign a verifiable PR. Specify the slug of a claimed agent instead (see this command's --help for the syntax), or claim this one first.",
+            agent: { name: agent.name, slug: agent.slug },
+            did,
+        };
+    }
+    return { ok: true, identity: { agent, did, signingConfig, keyPath } };
+}
+/**
+ * The cold-start self-heal `runDcoDispatch` performs on `cwd` before its own
+ * demo commit: `git init` if `cwd` isn't a work tree yet, a signed initial
+ * commit if there's no `HEAD` yet, and a fresh private GitHub repo if there's
+ * no `origin` remote yet. Factored out so `kya-os agent task`
+ * (`utils/agent/task.ts`) reuses the exact same self-heal instead of a
+ * second copy that could drift on ordering or on which commit ends up
+ * signed — see this feature's design doc ("create or reuse a scratch repo
+ * the way `runDcoDispatch` cold-start does"). `agent task` runs this
+ * against a throwaway temp directory it creates itself, not the caller's own
+ * cwd, unlike `runDcoDispatch`'s in-place self-heal.
+ */
+export async function ensureColdStartRepo(cwd, signingConfig) {
+    const result = {};
+    if (!(await gitSucceeds(["rev-parse", "--is-inside-work-tree"], cwd))) {
+        await run("git", ["init", "-q"], cwd);
+    }
+    if (!(await gitSucceeds(["rev-parse", "HEAD"], cwd))) {
+        // Symlink-safe: a planted `.gitkeep` symlink in an untrusted cwd must
+        // not make this follow it and clobber an arbitrary file.
+        writeFileAtomicSafe(join(cwd, ".gitkeep"), "# demo repo\n");
+        await run("git", ["add", ".gitkeep"], cwd);
+        // Signed like the demo commit below: without this, agent-slug mode's
+        // cold-start init commit would fall back to ambient repo signing
+        // config (or none at all), landing an unsigned or wrong-key commit
+        // before the attributed one even exists. `-- .gitkeep` restricts the
+        // commit to that one file so nothing else already in the index rides
+        // along, and hooks are disabled so a stale prepare-commit-msg hook
+        // can't stamp this boilerplate commit with the wrong agent.
+        await run("git", [
+            "-c",
+            "core.hooksPath=/dev/null",
+            ...signingConfig,
+            "commit",
+            "-q",
+            "-m",
+            "chore: init",
+            "--",
+            ".gitkeep",
+        ], cwd);
+    }
+    if (!(await gitSucceeds(["remote", "get-url", "origin"], cwd))) {
+        const repoName = `${basename(cwd)}-${Math.floor(Date.now() / 1000)}`;
+        await run("gh", ["repo", "create", repoName, "--private", "--source=.", "--remote=origin", "--push"], cwd);
+        result.createdRemote = repoName;
+    }
+    return result;
+}
+export async function runDcoDispatch(cwd, description, options = {}) {
+    if (!description || description.trim().length === 0) {
+        return { ok: false, failure: "A PR description is required." };
+    }
+    // Dispatch always appends its own authoritative `Agent DID:` line. A
+    // description that already carries one would put two DIDs in the PR body,
+    // and `extractAgentDid` treats a multi-DID body as unverifiable, so the PR
+    // would be created and then fail its own verification. `hasAgentDidClaim`
+    // uses the exact same line pattern the verifier does, so it catches the
+    // backticked, mid-line form the managed CLAUDE.md block emits, not just a
+    // line-start one. Reject before any side effects.
+    if (hasAgentDidClaim(description)) {
+        return {
+            ok: false,
+            failure: "The description already contains an `Agent DID:` line. Dispatch adds the attribution automatically; pass only your prose so the PR body has exactly one Agent DID line.",
+        };
+    }
+    const title = deriveDispatchTitle(description, options.title);
+    const identityResult = await resolveSigningIdentity(cwd, options.agent);
+    if (!identityResult.ok) {
+        return {
+            ok: false,
+            failure: identityResult.failure,
+            ...(identityResult.agent ? { agent: identityResult.agent } : {}),
+            ...(identityResult.did ? { did: identityResult.did } : {}),
+            title,
+        };
+    }
+    const { agent, did, signingConfig } = identityResult.identity;
+    const result = {
+        ok: false,
+        agent: { name: agent.name, slug: agent.slug },
+        did,
+        title,
+    };
+    try {
+        const coldStart = await ensureColdStartRepo(cwd, signingConfig);
+        result.createdRemote = coldStart.createdRemote;
+        const branch = `dco-demo-${Math.floor(Date.now() / 1000)}`;
+        await run("git", ["checkout", "-b", branch], cwd);
+        result.branch = branch;
+        // Symlink-safe append. Two vectors, both closed here:
+        //  - Read: if a planted DCO-DEMO.md is a symlink, remove it (lstatSync
+        //    does not follow the link) rather than readFileSync through it, so
+        //    another file's contents can never be read into the committed demo
+        //    file. A regular file is read and appended to as normal.
+        //  - Write: writeFileAtomicSafe creates its temp sibling with O_EXCL and
+        //    renameSync-replaces the destination inode without following it, so
+        //    the write never lands outside the working tree.
+        const dcoDemoPath = join(cwd, "DCO-DEMO.md");
+        if (existsSync(dcoDemoPath) && lstatSync(dcoDemoPath).isSymbolicLink()) {
+            rmSync(dcoDemoPath);
+        }
+        const existingDcoDemo = existsSync(dcoDemoPath)
+            ? readFileSync(dcoDemoPath, "utf-8")
+            : "";
+        writeFileAtomicSafe(dcoDemoPath, `${existingDcoDemo}${new Date().toISOString()} - ${title} - signed by ${agent.name} (${did})\n`);
+        await run("git", ["add", "DCO-DEMO.md"], cwd);
+        const commitSubject = buildDispatchCommitSubject(title);
+        // Own the trailers explicitly instead of relying on the setup-installed
+        // prepare-commit-msg hook: that hook is baked to whichever agent ran
+        // `dco setup`, which for a dispatch as a different slug (or in a fresh
+        // directory with no hook at all) would attribute the commit to the wrong
+        // agent, or to no agent. Disabling hooks and adding the sign-off (`-s`,
+        // the human committer) plus a Co-authored-by for THIS dispatch's agent
+        // keeps the commit trailer, the signing key, and the PR `Agent DID:` line
+        // all pointing at the same identity. `-- DCO-DEMO.md` restricts the
+        // commit to the demo file so unrelated staged changes never ride along.
+        const coAuthoredTrailer = `Co-authored-by: ${agent.name} <${agent.slug}@agents.knowthat.ai>`;
+        await run("git", [
+            "-c",
+            "core.hooksPath=/dev/null",
+            ...signingConfig,
+            "commit",
+            "-s",
+            "--trailer",
+            coAuthoredTrailer,
+            "-m",
+            commitSubject,
+            "--",
+            "DCO-DEMO.md",
+        ], cwd);
+        result.commitSha = await run("git", ["rev-parse", "HEAD"], cwd);
+        const rawCommit = await run("git", ["cat-file", "commit", "HEAD"], cwd);
+        result.signed = isCommitSigned(rawCommit);
+        if (!result.signed) {
+            result.failure =
+                "The commit was created but is NOT signed. Run `dco setup` in this repo, then dispatch again.";
+            return result;
+        }
+        await run("git", ["push", "-u", "origin", "HEAD"], cwd);
+        const body = [
+            description,
+            "",
+            `Agent: [${agent.name}](${agent.url})`,
+            `Agent DID: ${did}`,
+        ].join("\n");
+        const prOutput = await run("gh", ["pr", "create", "--title", title, "--body", body], cwd);
+        const urlMatch = prOutput.match(/https:\/\/github\.com\/\S+\/pull\/\d+/);
+        if (!urlMatch) {
+            result.failure = `Could not find a PR URL in \`gh pr create\` output: ${prOutput}`;
+            return result;
+        }
+        result.prUrl = urlMatch[0];
+        const prBody = await getPullRequestBody(result.prUrl);
+        const verification = await verifyPrAttribution(prBody);
+        result.verified = verification.ok;
+        if (!verification.ok) {
+            result.failure = `PR created (${result.prUrl}) but attribution verification failed: ${verification.detail ?? verification.reason ?? "unknown"}`;
+            return result;
+        }
+        result.ok = true;
+        return result;
+    }
+    catch (error) {
+        result.failure = errorMessage(error);
+        return result;
+    }
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/utils/dco/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../../src/utils/dco/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AA6B1C,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,GAAW;IACzD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE;QAChD,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAc,EAAE,GAAW;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,CAAE,KAA8B,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAgBD,uEAAuE;AACvE,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,SAAS,QAAQ,CAAC,KAAa,EAAE,SAAiB;IAChD,OAAO,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAChF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAmB,EACnB,aAAsB;IAEtB,IAAI,aAAa,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,OAAO,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,iBAAiB,GAAG,WAAW;SAClC,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC,iBAAiB,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO,SAAS,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,yBAAyB,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO;QACL,IAAI;QACJ,gBAAgB;QAChB,IAAI;QACJ,qBAAqB;QACrB,IAAI;QACJ,mBAAmB,OAAO,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC;AAED;;8DAE8D;AAC9D,KAAK,UAAU,mBAAmB,CAAC,GAAW;IAC5C,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,wCAAwC,GAAG,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACvE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;gBAClC,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,QAAQ,QAAQ,CAAC,MAAM,SAAS,WAAW,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAC;QACxD,IAAI,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,GAAG,WAAW,cAAc,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,GAAG,EAAE,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,WAAW,iBAAiB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC;AAqBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,SAA6B;IAE7B,IAAI,KAAkD,CAAC;IACvD,IAAI,aAAuB,CAAC;IAC5B,IAAI,OAAe,CAAC;IAEpB,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,6BAA6B,SAAS,QAAQ,OAAO,qBAAqB,SAAS,6BAA6B;aAC1H,CAAC;QACJ,CAAC;QACD,KAAK,GAAG;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,8BAA8B,SAAS,EAAE;SAC/C,CAAC;QACF,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO;gBACL,4DAA4D;gBAC5D,yDAAyD;gBACzD,2DAA2D;gBAC3D,6DAA6D;gBAC7D,kLAAkL;aACrL,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QAExE,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,oEAAoE;QACpE,wEAAwE;QACxE,YAAY;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,6BAA6B,QAAQ,CAAC,IAAI,QAAQ,OAAO,uDAAuD;aAC1H,CAAC;QACJ,CAAC;QACD,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,GAAG,GAAG,8BAA8B,KAAK,CAAC,IAAI,EAAE,CAAC;IAEvD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EACL,aAAa,GAAG,sBAAsB,YAAY,KAAK;gBACvD,mEAAmE;gBACnE,2BAA2B;gBAC3B,0KAA0K;YAC5K,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;YAC7C,GAAG;SACJ,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,CAAC;AACxE,CAAC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAW,EAAE,aAAuB;IAC5E,MAAM,MAAM,GAAoB,EAAE,CAAC;IAEnC,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACrD,sEAAsE;QACtE,yDAAyD;QACzD,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3C,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,mEAAmE;QACnE,4DAA4D;QAC5D,MAAM,GAAG,CACP,KAAK,EACL;YACE,IAAI;YACJ,0BAA0B;YAC1B,GAAG,aAAa;YAChB,QAAQ;YACR,IAAI;YACJ,IAAI;YACJ,aAAa;YACb,IAAI;YACJ,UAAU;SACX,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,GAAG,CACP,IAAI,EACJ,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EACpF,GAAG,CACJ,CAAC;QACF,MAAM,CAAC,aAAa,GAAG,QAAQ,CAAC;IAClC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,WAAmB,EACnB,UAA8B,EAAE;IAEhC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;IACjE,CAAC;IACD,qEAAqE;IACrE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,kDAAkD;IAClD,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EACL,yKAAyK;SAC5K,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAE9D,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,cAAc,CAAC,OAAO;YAC/B,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,KAAK;SACN,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC;IAE9D,MAAM,MAAM,GAAsB;QAChC,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;QAC7C,GAAG;QACH,KAAK;KACN,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAChE,MAAM,CAAC,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;QAE/C,MAAM,MAAM,GAAG,YAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QAEvB,sDAAsD;QACtD,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,6DAA6D;QAC7D,yEAAyE;QACzE,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YACvE,MAAM,CAAC,WAAW,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,eAAe,GAAG,UAAU,CAAC,WAAW,CAAC;YAC7C,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC;YACpC,CAAC,CAAC,EAAE,CAAC;QACP,mBAAmB,CACjB,WAAW,EACX,GAAG,eAAe,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,gBAAgB,KAAK,CAAC,IAAI,KAAK,GAAG,KAAK,CAChG,CAAC;QACF,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;QACxD,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,0EAA0E;QAC1E,oEAAoE;QACpE,wEAAwE;QACxE,MAAM,iBAAiB,GAAG,mBAAmB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,sBAAsB,CAAC;QAC7F,MAAM,GAAG,CACP,KAAK,EACL;YACE,IAAI;YACJ,0BAA0B;YAC1B,GAAG,aAAa;YAChB,QAAQ;YACR,IAAI;YACJ,WAAW;YACX,iBAAiB;YACjB,IAAI;YACJ,aAAa;YACb,IAAI;YACJ,aAAa;SACd,EACD,GAAG,CACJ,CAAC;QAEF,MAAM,CAAC,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO;gBACZ,8FAA8F,CAAC;YACjG,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAExD,MAAM,IAAI,GAAG;YACX,WAAW;YACX,EAAE;YACF,WAAW,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,GAAG;YACtC,cAAc,GAAG,EAAE;SACpB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,QAAQ,GAAG,MAAM,GAAG,CACxB,IAAI,EACJ,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,EAClD,GAAG,CACJ,CAAC;QACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,OAAO,GAAG,uDAAuD,QAAQ,EAAE,CAAC;YACnF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,MAAM,CAAC,OAAO,GAAG,eAAe,MAAM,CAAC,KAAK,0CAC1C,YAAY,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,IAAI,SAChD,EAAE,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC;QACjB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/utils/dco/fix.d.ts

@@ -0,0 +1,122 @@
+import { type FixAttestation } from "@kya-os/contracts/review";
+/**
+ * `dco fix` — push a signed, attributed fix commit to an EXISTING PR's head
+ * branch, in response to a review that requested changes.
+ *
+ * `dco dispatch` (`dispatch.ts`) is a demo flow by construction: it always
+ * creates a fresh branch and a NEW PR, and its commit is path-scoped to one
+ * hardcoded demo file. Neither is safe or even possible for "land a real fix
+ * on a PR someone already opened." This command reuses dispatch's signing
+ * half in full (`resolveSigningIdentity`) but replaces its branch/commit/PR
+ * flow with one that: checks out the PR's actual head branch, commits
+ * exactly whatever the caller staged (no path scoping — see the commit step
+ * below for why that's the right guard here), pushes to that SAME branch
+ * (never a new one, never force), and optionally posts a signed attestation
+ * answering the review that requested the fix.
+ *
+ * Every step fails closed with a named `failure` BEFORE the step that would
+ * have side effects, and nothing is ever pushed after a failed verification
+ * step (see the signed-commit check before the push call below).
+ */
+export interface DcoFixOptions {
+    /** PR number, or a full PR URL. */
+    pr: string;
+    /** owner/name; when omitted, derived from `git remote get-url origin`. */
+    repo?: string;
+    /** Existing agent slug; same resolution rules as `dco dispatch`. */
+    agent?: string;
+    /** `git add -A` before committing. Default false: the caller stages. */
+    stageAll?: boolean;
+    /** Post the signed fix attestation as a PR comment. Default true. */
+    attest?: boolean;
+    /** The reviewed headSha this fix answers (40-hex). Required for attestation. */
+    respondsTo?: string;
+    /** The DIDComm fix task this run was dispatched for, when applicable. */
+    taskId?: string;
+    /** Commit subject. Default "fix: address signed review findings". */
+    message?: string;
+}
+export interface DcoFixResult {
+    ok: boolean;
+    /** Named, human-readable description of the step that failed, when !ok. */
+    failure?: string;
+    agent?: string;
+    did?: string;
+    branch?: string;
+    commitSha?: string;
+    signed?: boolean;
+    pushed?: boolean;
+    attested?: boolean;
+    prUrl?: string;
+}
+export declare function parseOwnerRepoFromRemoteUrl(url: string): string | null;
+/**
+ * Parse "owner/repo" out of a full PR URL (`https://github.com/owner/repo/pull/123`).
+ * Returns null for a bare PR number (or anything else): a bare number carries
+ * no repo of its own, so there is nothing to cross-check it against — every
+ * gh call below is scoped to `targetRepo` explicitly regardless.
+ *
+ * Shares PR_URL_PATTERN with extractPrNumber on purpose, rather than each
+ * using its own regex: an input recognized by ONE as URL-shaped but not the
+ * OTHER used to let a same-numbered-PR mismatch slip through silently — an
+ * uppercase scheme, a missing scheme, or a URL embedded in surrounding text
+ * would fail this function's narrower original pattern (skipping the
+ * wrong-remote check below, since it only runs when this returns non-null)
+ * while still matching extractPrNumber's looser unanchored `/pull/(\d+)`
+ * search, so the flow proceeded against this checkout's same-numbered PR
+ * with no cross-repo check ever having run. One shared pattern means
+ * whatever extractPrNumber accepts as URL-shaped, this function recognizes
+ * too, so the check it guards can never be bypassed that way.
+ */
+export declare function parseOwnerRepoFromPrUrl(pr: string): string | null;
+/**
+ * Normalize `pr` (a bare number or a full PR URL) down to just the number,
+ * so every `gh pr` call below can be pinned with an explicit `-R targetRepo`
+ * instead of a heterogeneous target that sometimes carries its own repo and
+ * sometimes relies on ambient resolution. Ambient resolution is NOT
+ * guaranteed to agree with `cwd`'s git remote — `GH_REPO` or a `gh repo
+ * set-default` override takes precedence over it — so a bare number handed
+ * to `gh` unpinned could read a different repo's PR even after step 2's
+ * origin check. Returns null for anything that isn't a plain integer or a
+ * `.../pull/<number>` URL matching PR_URL_PATTERN.
+ */
+export declare function extractPrNumber(pr: string): string | null;
+/**
+ * Strip characters that could break out of the marker-bounded structure
+ * `buildFixAttestationCommentBody` builds around a value: a backtick would
+ * prematurely close/reopen an adjacent code span; `-->` would prematurely
+ * close this function's own HTML comment marker, letting whatever follows
+ * render as visible PR-comment content instead of staying hidden inside
+ * it; and, the other direction, a bare `<!--` would OPEN a new comment
+ * mid-line, hiding everything after it in GitHub's rendered view —
+ * including the fenced attestation block that's supposed to stay publicly
+ * visible and verifiable. Defense in depth alongside
+ * `FixAttestationSubjectSchema.repo`'s tighter character-class validation:
+ * this also covers `agentName`, a free-text display name with no schema of
+ * its own (an agent's `.mcpi/agent.json` name, sourced from a checkout —
+ * see resolve-agent.ts's threat model for the same class of hostile-repo
+ * risk applied to CLAUDE.md). Exported so `agent/markers.ts`'s review-verdict
+ * marker (the same breakout risk, applied to a reviewer DID/repo instead of
+ * an agent name/DID) reuses this exact sanitizer rather than a second copy
+ * that could drift on which characters it strips.
+ */
+export declare function sanitizeForMarkdownBlock(value: string): string;
+/**
+ * Build the PR comment body posted for a fix attestation: an HTML-comment
+ * marker (so a future `dco` run can find and dedupe on it), a one-line
+ * human summary, and a fenced `kya-os-fix-attestation` JSON block that
+ * round-trips `FixAttestationSchema`. The marker's fields are duplicated
+ * from `attestation` in a stable, greppable form so tooling never has to
+ * parse the fenced block just to know which commit/PR a comment is about.
+ * The fenced JSON block itself carries the RAW, unsanitized values (it's
+ * the actual signed data — sanitizing it would make it not round-trip);
+ * only the marker and summary lines, which render as live markdown, are
+ * sanitized. That includes `agentDid`: `DidStringSchema` only requires a
+ * `did:<method>:` prefix followed by any non-whitespace method-specific
+ * id, so it's exactly as free-form (and exactly as hostile-repo-sourced,
+ * for a locally-registered agent whose name/DID this command reads off
+ * disk) as `agentName` is — same breakout risk, same fix.
+ */
+export declare function buildFixAttestationCommentBody(attestation: FixAttestation, agentName: string): string;
+export declare function runDcoFix(cwd: string, options: DcoFixOptions): Promise<DcoFixResult>;
+//# sourceMappingURL=fix.d.ts.map

package/dist/utils/dco/fix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fix.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/fix.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,0BAA0B,CAAC;AAOlC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qEAAqE;IACrE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAkDD,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWtE;AAaD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGjE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOzD;AA8BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,cAAc,EAC3B,SAAS,EAAE,MAAM,GAChB,MAAM,CAaR;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAmY1F"}