@kya-os/cli 1.8.1 → 1.8.3

package/dist/utils/dco/fix.js

@@ -0,0 +1,560 @@
+import { execFile } from "child_process";
+import { readFileSync } from "fs";
+import { promisify } from "util";
+import { FixAttestationSchema, getFixAttestationSigningString, } from "@kya-os/contracts/review";
+import { isGhAuthenticated, isGhInstalled } from "./github.js";
+import { isCommitSigned, resolveSigningIdentity } from "./dispatch.js";
+import { parseEd25519SshPrivateKeyPem, signWithEd25519Seed } from "./ssh-key.js";
+const execFileAsync = promisify(execFile);
+const DEFAULT_COMMIT_MESSAGE = "fix: address signed review findings";
+async function run(cmd, args, cwd) {
+    const { stdout } = await execFileAsync(cmd, args, {
+        cwd,
+        encoding: "utf8",
+        maxBuffer: 10 * 1024 * 1024,
+    });
+    return stdout.trim();
+}
+async function gitSucceeds(args, cwd) {
+    try {
+        await run("git", args, cwd);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function errorMessage(error) {
+    if (error && typeof error === "object" && "stderr" in error) {
+        const stderr = String(error.stderr ?? "").trim();
+        if (stderr) {
+            return stderr;
+        }
+    }
+    return error instanceof Error ? error.message : String(error);
+}
+/**
+ * Parse "owner/repo" out of a git remote URL, accepting the two shapes a
+ * GitHub `origin` remote actually takes: SSH (`git@github.com:owner/repo.git`)
+ * and HTTPS (`https://github.com/owner/repo(.git)`). Returns null for
+ * anything else rather than guessing.
+ */
+/**
+ * GitHub owner/repo names are case-insensitive (`Acme/Demo` and `acme/demo`
+ * name the same repo), but a git remote's casing and a browser-copied PR
+ * URL's casing routinely differ from each other and from what a user types
+ * for `--repo`. A strict `===` between any two of `originRepo`/`--repo`/a
+ * PR URL's repo would then refuse a legitimate same-repo `dco fix` as
+ * `wrong-remote`.
+ */
+function repoNamesEqual(a, b) {
+    return a.toLowerCase() === b.toLowerCase();
+}
+export function parseOwnerRepoFromRemoteUrl(url) {
+    const trimmed = url.trim().replace(/\.git$/, "");
+    const sshMatch = /^[\w-]+@[^:/]+:([^/]+\/[^/]+)$/.exec(trimmed);
+    if (sshMatch) {
+        return sshMatch[1];
+    }
+    const httpsMatch = /^https?:\/\/[^/]+\/([^/]+\/[^/]+)$/.exec(trimmed);
+    if (httpsMatch) {
+        return httpsMatch[1];
+    }
+    return null;
+}
+/**
+ * The one pattern both `parseOwnerRepoFromPrUrl` and `extractPrNumber` parse
+ * a PR URL with. Anchored at both ends (`^`...`$`) and requiring a lowercase
+ * `http(s)://` scheme, so the two functions can never disagree on what
+ * counts as a "PR URL" — see parseOwnerRepoFromPrUrl's doc comment for why
+ * that agreement is the whole point. Trailing content after the number
+ * (`/files`, `#issuecomment-1`, `?diff=split`) is tolerated, since a
+ * browser-copied PR link routinely carries one of those.
+ */
+const PR_URL_PATTERN = /^https?:\/\/[^/]+\/([^/]+\/[^/]+)\/pull\/(\d+)(?:[/?#].*)?$/;
+/**
+ * Parse "owner/repo" out of a full PR URL (`https://github.com/owner/repo/pull/123`).
+ * Returns null for a bare PR number (or anything else): a bare number carries
+ * no repo of its own, so there is nothing to cross-check it against — every
+ * gh call below is scoped to `targetRepo` explicitly regardless.
+ *
+ * Shares PR_URL_PATTERN with extractPrNumber on purpose, rather than each
+ * using its own regex: an input recognized by ONE as URL-shaped but not the
+ * OTHER used to let a same-numbered-PR mismatch slip through silently — an
+ * uppercase scheme, a missing scheme, or a URL embedded in surrounding text
+ * would fail this function's narrower original pattern (skipping the
+ * wrong-remote check below, since it only runs when this returns non-null)
+ * while still matching extractPrNumber's looser unanchored `/pull/(\d+)`
+ * search, so the flow proceeded against this checkout's same-numbered PR
+ * with no cross-repo check ever having run. One shared pattern means
+ * whatever extractPrNumber accepts as URL-shaped, this function recognizes
+ * too, so the check it guards can never be bypassed that way.
+ */
+export function parseOwnerRepoFromPrUrl(pr) {
+    const match = PR_URL_PATTERN.exec(pr.trim());
+    return match ? match[1] : null;
+}
+/**
+ * Normalize `pr` (a bare number or a full PR URL) down to just the number,
+ * so every `gh pr` call below can be pinned with an explicit `-R targetRepo`
+ * instead of a heterogeneous target that sometimes carries its own repo and
+ * sometimes relies on ambient resolution. Ambient resolution is NOT
+ * guaranteed to agree with `cwd`'s git remote — `GH_REPO` or a `gh repo
+ * set-default` override takes precedence over it — so a bare number handed
+ * to `gh` unpinned could read a different repo's PR even after step 2's
+ * origin check. Returns null for anything that isn't a plain integer or a
+ * `.../pull/<number>` URL matching PR_URL_PATTERN.
+ */
+export function extractPrNumber(pr) {
+    const trimmed = pr.trim();
+    if (/^\d+$/.test(trimmed)) {
+        return trimmed;
+    }
+    const match = PR_URL_PATTERN.exec(trimmed);
+    return match ? match[2] : null;
+}
+function parseGhPrView(stdout) {
+    const parsed = JSON.parse(stdout);
+    if (typeof parsed.number !== "number" ||
+        typeof parsed.headRefName !== "string" ||
+        typeof parsed.state !== "string" ||
+        typeof parsed.url !== "string" ||
+        typeof parsed.isCrossRepository !== "boolean") {
+        throw new Error("Unexpected response from `gh pr view --json`");
+    }
+    return {
+        number: parsed.number,
+        headRefName: parsed.headRefName,
+        state: parsed.state,
+        url: parsed.url,
+        isCrossRepository: parsed.isCrossRepository,
+    };
+}
+/**
+ * Strip characters that could break out of the marker-bounded structure
+ * `buildFixAttestationCommentBody` builds around a value: a backtick would
+ * prematurely close/reopen an adjacent code span; `-->` would prematurely
+ * close this function's own HTML comment marker, letting whatever follows
+ * render as visible PR-comment content instead of staying hidden inside
+ * it; and, the other direction, a bare `<!--` would OPEN a new comment
+ * mid-line, hiding everything after it in GitHub's rendered view —
+ * including the fenced attestation block that's supposed to stay publicly
+ * visible and verifiable. Defense in depth alongside
+ * `FixAttestationSubjectSchema.repo`'s tighter character-class validation:
+ * this also covers `agentName`, a free-text display name with no schema of
+ * its own (an agent's `.mcpi/agent.json` name, sourced from a checkout —
+ * see resolve-agent.ts's threat model for the same class of hostile-repo
+ * risk applied to CLAUDE.md). Exported so `agent/markers.ts`'s review-verdict
+ * marker (the same breakout risk, applied to a reviewer DID/repo instead of
+ * an agent name/DID) reuses this exact sanitizer rather than a second copy
+ * that could drift on which characters it strips.
+ */
+export function sanitizeForMarkdownBlock(value) {
+    return value.replace(/`/g, "'").replace(/-->/g, "- >").replace(/<!--/g, "< !--");
+}
+/**
+ * Build the PR comment body posted for a fix attestation: an HTML-comment
+ * marker (so a future `dco` run can find and dedupe on it), a one-line
+ * human summary, and a fenced `kya-os-fix-attestation` JSON block that
+ * round-trips `FixAttestationSchema`. The marker's fields are duplicated
+ * from `attestation` in a stable, greppable form so tooling never has to
+ * parse the fenced block just to know which commit/PR a comment is about.
+ * The fenced JSON block itself carries the RAW, unsanitized values (it's
+ * the actual signed data — sanitizing it would make it not round-trip);
+ * only the marker and summary lines, which render as live markdown, are
+ * sanitized. That includes `agentDid`: `DidStringSchema` only requires a
+ * `did:<method>:` prefix followed by any non-whitespace method-specific
+ * id, so it's exactly as free-form (and exactly as hostile-repo-sourced,
+ * for a locally-registered agent whose name/DID this command reads off
+ * disk) as `agentName` is — same breakout risk, same fix.
+ */
+export function buildFixAttestationCommentBody(attestation, agentName) {
+    const { subject } = attestation;
+    const safeRepo = sanitizeForMarkdownBlock(subject.repo);
+    const safeAgentName = sanitizeForMarkdownBlock(agentName);
+    const safeAgentDid = sanitizeForMarkdownBlock(attestation.agentDid);
+    const marker = `<!-- kya-os-fix:v1 repo=${safeRepo} pr=${subject.prNumber} fixed=${subject.fixedHeadSha} -->`;
+    const summary = `Fix pushed by ${safeAgentName} (${safeAgentDid}): commit \`${subject.fixedHeadSha}\` ` +
+        `responds to the review of \`${attestation.respondsToHeadSha}\`.`;
+    const block = ["```kya-os-fix-attestation", JSON.stringify(attestation, null, 2), "```"].join("\n");
+    return [marker, "", summary, "", block, ""].join("\n");
+}
+export async function runDcoFix(cwd, options) {
+    const result = { ok: false };
+    // Validate --responds-to's shape BEFORE any side effect, including agent
+    // resolution: FixAttestationSchema itself only runs at step 8, after
+    // checkout/commit/push, and a malformed value (a truncated or
+    // uppercase SHA — an easy paste mistake from some git UIs) would
+    // otherwise still push the fix and only then report an
+    // attestation-failed follow-up action. Same 40-hex-lowercase shape as
+    // FixAttestationSubjectSchema.respondsToHeadSha; only checked when an
+    // attestation will actually be attempted (the same gate step 8 uses).
+    if (options.attest !== false && options.respondsTo && !/^[0-9a-f]{40}$/.test(options.respondsTo)) {
+        result.failure = `invalid-responds-to: "${options.respondsTo}" is not a 40-character lowercase hex commit SHA`;
+        return result;
+    }
+    // Step 1: resolve agent identity, slug-derived DID, and signing config
+    // exactly as `dco dispatch` does — see resolveSigningIdentity's doc
+    // comment for why this is shared rather than re-derived.
+    const identityResult = await resolveSigningIdentity(cwd, options.agent);
+    if (!identityResult.ok) {
+        result.failure = identityResult.failure;
+        if (identityResult.agent)
+            result.agent = identityResult.agent.slug;
+        if (identityResult.did)
+            result.did = identityResult.did;
+        return result;
+    }
+    const identity = identityResult.identity;
+    result.agent = identity.agent.slug;
+    result.did = identity.did;
+    if (!(await isGhInstalled())) {
+        result.failure =
+            "gh-not-installed: GitHub CLI (gh) is not installed. Install it from https://cli.github.com and run `gh auth login`.";
+        return result;
+    }
+    try {
+        if (!(await isGhAuthenticated())) {
+            result.failure = "gh-not-authenticated: run `gh auth login` first.";
+            return result;
+        }
+    }
+    catch (error) {
+        result.failure = `gh-not-authenticated: ${errorMessage(error)}`;
+        return result;
+    }
+    // gh pr checkout (step 3) switches cwd's checked-out branch — a real side
+    // effect on the caller's own working directory. Capture what they were on
+    // BEFORE steps 2-7 run (below) and reuse the SAME restore in every
+    // pre-commit failure path, including the outer catch: a failure that
+    // reaches the outer catch (an unexpected error from one of the "should
+    // never fail" calls — the post-checkout branch read, `git add -A`, the
+    // post-commit sha/signature reads) must restore just as reliably as a
+    // named one, or the caller can be left stranded on the PR branch with
+    // nothing accomplished. Best-effort only: a failed restore doesn't change
+    // the outcome or need reporting. Detached HEAD falls back to the exact
+    // commit rather than a branch name; calling this before checkout ever ran
+    // is a harmless no-op (checking out the branch already checked out).
+    //
+    // The capture itself gets its own try/catch, separate from the steps 2-7
+    // block below: it runs BEFORE that block starts, so it isn't covered by
+    // it, and these two `git rev-parse` calls are the first real git commands
+    // this function issues — nothing yet confirms cwd is even a git checkout.
+    // If cwd isn't a git repo (or HEAD is somehow unreadable), fail closed
+    // with a named result here instead of letting the rejection escape
+    // runDcoFix uncaught: there's no branch to restore in that case anyway,
+    // since nothing has switched it yet.
+    let originalCheckoutTarget;
+    try {
+        const originalRef = await run("git", ["rev-parse", "--abbrev-ref", "HEAD"], cwd);
+        originalCheckoutTarget =
+            originalRef === "HEAD" ? await run("git", ["rev-parse", "HEAD"], cwd) : originalRef;
+    }
+    catch (error) {
+        result.failure = `not-a-git-repo: could not determine the current branch in ${cwd} (${errorMessage(error)})`;
+        return result;
+    }
+    const restoreOriginalBranch = async () => {
+        try {
+            await run("git", ["checkout", originalCheckoutTarget], cwd);
+        }
+        catch {
+            // Courtesy only — see comment above.
+        }
+    };
+    // Steps 2-7 all run inside one try/catch, matching dispatch.ts's own
+    // belt-and-braces pattern: each step already returns its own NAMED
+    // failure for the outcomes worth naming (wrong-remote, pr-not-open,
+    // fork-pr-unsupported, checkout-failed, branch-mismatch,
+    // nothing-to-commit, commit-failed, unsigned-commit, push-rejected), but
+    // a handful of calls here (the post-checkout branch read, `git add -A`,
+    // and the post-commit sha/signature reads) are "should never fail once
+    // we got this far" operations with no named-failure story of their own.
+    // Without this outer catch, an unexpected failure in one of those would
+    // reject the whole function instead of degrading to a clean
+    // `{ok:false, failure}` — breaking the "every step fails closed" promise
+    // this module's doc comment makes.
+    let prView;
+    let commitSha;
+    let targetRepo;
+    try {
+        // Step 2: cwd must already be a clone of the target repo. Never clone
+        // implicitly — the caller (a human or an executor) owns workspace
+        // placement, unlike dispatch's cold-start self-heal.
+        let originUrl;
+        try {
+            originUrl = await run("git", ["remote", "get-url", "origin"], cwd);
+        }
+        catch (error) {
+            result.failure = `wrong-remote: could not read git remote "origin" in ${cwd} (${errorMessage(error)})`;
+            return result;
+        }
+        const originRepo = parseOwnerRepoFromRemoteUrl(originUrl);
+        if (!originRepo) {
+            result.failure = `wrong-remote: could not parse an owner/repo from origin "${originUrl}"`;
+            return result;
+        }
+        if (options.repo && !repoNamesEqual(options.repo, originRepo)) {
+            result.failure = `wrong-remote: origin is "${originRepo}" but --repo expects "${options.repo}"`;
+            return result;
+        }
+        // Always the git-derived casing, even when --repo was given: the
+        // equality check above only ever confirms --repo names the SAME repo
+        // as origin (never redirects to a different one), so origin's casing
+        // is the canonical one. Using options.repo's as-typed casing here
+        // would let the same PR sign a different subject.repo string on every
+        // invocation depending on how --repo happened to be capitalized.
+        targetRepo = originRepo;
+        // `options.pr` may be a full URL to a repo OTHER than targetRepo (`gh pr
+        // view <url>` happily reads any repo's PR data, independent of cwd —
+        // that is how `dco verify` supports running from anywhere): reject that
+        // mismatch up front. Then normalize to a bare number and pin EVERY gh
+        // call below — view included — with an explicit `-R targetRepo`, never
+        // ambient resolution: `gh`'s own repo resolution prefers `GH_REPO` (or a
+        // `gh repo set-default` override) over cwd's git remote, so even after
+        // step 2 confirms cwd's origin matches targetRepo, an unpinned call
+        // could still read (and, without the pin, act on) a different repo's
+        // same-numbered PR.
+        const prUrlRepo = parseOwnerRepoFromPrUrl(options.pr);
+        if (prUrlRepo && !repoNamesEqual(prUrlRepo, targetRepo)) {
+            result.failure = `wrong-remote: the PR URL points at "${prUrlRepo}" but this checkout targets "${targetRepo}"`;
+            return result;
+        }
+        const prNumberArg = extractPrNumber(options.pr);
+        if (!prNumberArg) {
+            result.failure = `pr-not-found: could not parse a PR number from "${options.pr}"`;
+            return result;
+        }
+        // Step 3: land on the PR's actual head branch and refuse a merged/closed
+        // PR. One `gh pr view --json` call serves the state gate, the fork
+        // check, and the headRefName confirmation after checkout, so there's no
+        // second call to drift out of sync with the first.
+        try {
+            const stdout = await run("gh", [
+                "pr",
+                "view",
+                prNumberArg,
+                "-R",
+                targetRepo,
+                "--json",
+                "number,headRefName,state,url,isCrossRepository",
+            ], cwd);
+            prView = parseGhPrView(stdout);
+        }
+        catch (error) {
+            result.failure = `pr-not-found: could not read PR "${options.pr}" (${errorMessage(error)})`;
+            return result;
+        }
+        if (prView.state !== "OPEN") {
+            result.failure = `pr-not-open: PR #${prView.number} is ${prView.state.toLowerCase()}, not open`;
+            return result;
+        }
+        // Refuse a fork PR BEFORE checkout: `gh pr checkout` names the local
+        // branch after the fork's `headRefName` verbatim (no owner prefix
+        // unless it collides with the base repo's default branch), while
+        // `origin` still points at THIS repo. `git push origin
+        // HEAD:<headRefName>` further down would then push the fork's content
+        // to that name on origin — a ref-creation push if the name doesn't
+        // already exist there, which git allows unconditionally regardless of
+        // write-access scope. That plants PR-author-controlled content on the
+        // trusted repo under a name the fork author picked, not the caller.
+        // Refusing here removes the vulnerability rather than trying to
+        // sanitize an attacker-chosen name.
+        if (prView.isCrossRepository) {
+            result.failure = `fork-pr-unsupported: PR #${prView.number} is from a fork; dco fix only pushes fixes to same-repo PRs`;
+            return result;
+        }
+        try {
+            // `-R targetRepo` makes this explicit rather than relying on gh's
+            // ambient cwd-derived repo resolution: targetRepo is the value this
+            // whole flow has already validated (against `--repo` and, above,
+            // against a URL-form `options.pr`), so every write from here on is
+            // pinned to it directly instead of trusting an implicit lookup to
+            // agree with it a second time.
+            await run("gh", ["pr", "checkout", String(prView.number), "-R", targetRepo], cwd);
+        }
+        catch (error) {
+            await restoreOriginalBranch();
+            result.failure = `checkout-failed: ${errorMessage(error)}`;
+            return result;
+        }
+        const currentBranch = await run("git", ["rev-parse", "--abbrev-ref", "HEAD"], cwd);
+        if (currentBranch !== prView.headRefName) {
+            await restoreOriginalBranch();
+            result.failure = `branch-mismatch: checked out "${currentBranch}" but PR #${prView.number}'s head branch is "${prView.headRefName}"`;
+            return result;
+        }
+        result.branch = currentBranch;
+        // Step 4: require staged changes. This command never invents content to
+        // commit — the staged set IS the fix, so an empty stage is refused
+        // rather than silently producing an empty commit. A failure here still
+        // leaves the caller back on their original branch (see
+        // restoreOriginalBranch above): nothing was accomplished, so nothing
+        // should look different when they check `git branch`.
+        if (options.stageAll) {
+            await run("git", ["add", "-A"], cwd);
+        }
+        const hasStagedChanges = !(await gitSucceeds(["diff", "--cached", "--quiet"], cwd));
+        if (!hasStagedChanges) {
+            await restoreOriginalBranch();
+            // Undo the `result.branch = currentBranch` assignment above too: cwd
+            // is back on the caller's original branch now, so reporting the PR's
+            // branch here would misstate where they actually ended up.
+            result.branch = undefined;
+            result.failure =
+                "nothing-to-commit: no staged changes to commit (pass --all to stage everything, or stage changes yourself first)";
+            return result;
+        }
+        // Step 5: commit exactly the staged set. Reuses the same signing
+        // config, sign-off, and Co-authored-by trailer discipline `dispatch.ts`
+        // uses, but DELIBERATELY with NO path scoping (dispatch's
+        // `-- DCO-DEMO.md` guard exists because dispatch invents its own demo
+        // content; here the staged set IS the boundary — the command commits
+        // what the caller staged, never more, so there's nothing left to scope
+        // a pathspec against).
+        const message = options.message ?? DEFAULT_COMMIT_MESSAGE;
+        const coAuthoredTrailer = `Co-authored-by: ${identity.agent.name} <${identity.agent.slug}@agents.knowthat.ai>`;
+        // Captured so an unsigned commit (step 6) can be undone back to exactly
+        // this point — staged, not yet committed — rather than left dangling.
+        const preCommitSha = await run("git", ["rev-parse", "HEAD"], cwd);
+        try {
+            await run("git", [
+                "-c",
+                "core.hooksPath=/dev/null",
+                ...identity.signingConfig,
+                "commit",
+                "-s",
+                "--trailer",
+                coAuthoredTrailer,
+                "-m",
+                message,
+            ], cwd);
+        }
+        catch (error) {
+            // Nothing was actually committed — this is a pre-commit failure like
+            // checkout-failed/branch-mismatch/nothing-to-commit above, not a
+            // post-commit one (unsigned-commit, push-rejected) where a real commit
+            // now exists on the PR branch and staying put to let the caller
+            // inspect it is the right call. Restore for the same reason those
+            // three do: leaving the caller on the PR branch with nothing
+            // accomplished misstates what happened.
+            await restoreOriginalBranch();
+            result.branch = undefined;
+            result.failure = `commit-failed: ${errorMessage(error)}`;
+            return result;
+        }
+        // Step 6: verify the commit is signed BEFORE pushing anything.
+        commitSha = await run("git", ["rev-parse", "HEAD"], cwd);
+        result.commitSha = commitSha;
+        const rawCommit = await run("git", ["cat-file", "commit", "HEAD"], cwd);
+        result.signed = isCommitSigned(rawCommit);
+        if (!result.signed) {
+            // Telling the caller to fix signing and "try again" is only true if a
+            // retry actually can: undo the unsigned commit back to staged changes
+            // (step 4's post-condition) rather than leaving it landed with the
+            // staged set already consumed, which would make a retry hit
+            // nothing-to-commit instead of re-signing anything.
+            let undone = false;
+            try {
+                await run("git", ["reset", "--soft", preCommitSha], cwd);
+                undone = true;
+            }
+            catch {
+                // Leave result.commitSha pointing at the unsigned commit that's
+                // still there, since the undo didn't happen — same as any other
+                // post-commit failure (push-rejected) where a real commit remains
+                // on the PR branch for the caller to inspect.
+            }
+            if (undone) {
+                // Nothing is left on the PR branch — the same "nothing was
+                // accomplished" case checkout-failed/branch-mismatch/
+                // nothing-to-commit/commit-failed already restore for, so this one
+                // does too instead of stranding the caller on a branch holding
+                // none of their work.
+                result.commitSha = undefined;
+                await restoreOriginalBranch();
+                result.branch = undefined;
+                result.failure =
+                    "unsigned-commit: the commit was NOT signed and has been undone (your changes are still staged). Run `dco setup` in this repo, then try again.";
+            }
+            else {
+                // The undo itself failed, so the unsigned commit is still sitting
+                // on the PR branch — staying put (not restoring) matches how
+                // push-rejected leaves a real commit in place for the caller to
+                // inspect, and the message says so honestly instead of claiming an
+                // undo that didn't happen.
+                result.failure =
+                    "unsigned-commit: the commit was created but is NOT signed, and could not be undone automatically. Run `dco setup` in this repo, then `git reset --soft HEAD~1` (or amend the commit) and try again.";
+            }
+            return result;
+        }
+        // Step 7: push to the EXISTING branch. Never force, never `-u` a new
+        // branch, never `gh pr create`. Hooks disabled here for the same reason
+        // the commit step above disables them: `cwd` may be a clone a headless
+        // agent pass with full file-system write access just ran in (the
+        // `kya-os agent task --watch` fix-round caller of this function — see
+        // its own doc comment on `writeCapable` in spawn-agent.ts), and a planted
+        // `.git/hooks/pre-push` would otherwise execute with this process's own
+        // credentials at push time regardless of what Bash commands were denied
+        // during that pass.
+        try {
+            await run("git", ["-c", "core.hooksPath=/dev/null", "push", "origin", `HEAD:${prView.headRefName}`], cwd);
+        }
+        catch (error) {
+            result.failure = `push-rejected: ${errorMessage(error)}`;
+            return result;
+        }
+        result.pushed = true;
+        result.prUrl = prView.url;
+    }
+    catch (error) {
+        await restoreOriginalBranch();
+        result.branch = undefined;
+        result.failure = errorMessage(error);
+        return result;
+    }
+    // Step 8: sign and post a fix attestation, when requested and there's a
+    // reviewed head to answer. Skipped (not failed) when `respondsTo` is
+    // absent — signing an attestation that answers nothing would be worse
+    // than not posting one. Signing stays entirely inside this function: the
+    // seed is recovered from the SAME converted SSH key file
+    // `resolveSigningIdentity` already validated exists, never a second copy
+    // of key material, and it never leaves this scope.
+    result.attested = false;
+    if (options.attest !== false && options.respondsTo) {
+        try {
+            const pem = readFileSync(identity.keyPath, "utf-8");
+            const { seed } = parseEd25519SshPrivateKeyPem(pem);
+            const subject = {
+                repo: targetRepo,
+                prNumber: prView.number,
+                fixedHeadSha: commitSha,
+            };
+            const signingString = getFixAttestationSigningString(subject, options.respondsTo);
+            const signature = signWithEd25519Seed(seed, Buffer.from(signingString, "utf8")).toString("base64url");
+            const attestation = FixAttestationSchema.parse({
+                subject,
+                respondsToHeadSha: options.respondsTo,
+                taskId: options.taskId,
+                agentDid: identity.did,
+                proof: { alg: "Ed25519", signature },
+            });
+            const body = buildFixAttestationCommentBody(attestation, identity.agent.name);
+            // `-R targetRepo`, same reasoning as the checkout call above: pin the
+            // write to the already-validated repo explicitly.
+            await run("gh", ["pr", "comment", String(prView.number), "--body", body, "-R", targetRepo], cwd);
+            result.attested = true;
+        }
+        catch (error) {
+            // The commit already landed and pushed successfully by this point —
+            // an attestation-posting failure is a follow-up action pending, not a
+            // reason to report the whole fix as failed.
+            result.failure = `attestation-failed: ${errorMessage(error)}`;
+            result.ok = true;
+            return result;
+        }
+    }
+    result.ok = true;
+    return result;
+}
+//# sourceMappingURL=fix.js.map

package/dist/utils/dco/fix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fix.js","sourceRoot":"","sources":["../../../src/utils/dco/fix.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,8BAA8B,GAG/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEjF,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAsD1C,MAAM,sBAAsB,GAAG,qCAAqC,CAAC;AAErE,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,GAAW;IACzD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE;QAChD,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAc,EAAE,GAAW;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,CAAE,KAA8B,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,CAAS,EAAE,CAAS;IAC1C,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAW;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,UAAU,GAAG,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG,6DAA6D,CAAC;AAErF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAU;IAChD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAUD,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAsB,CAAC;IACvD,IACE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,OAAO,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,8BAA8B,CAC5C,WAA2B,EAC3B,SAAiB;IAEjB,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;IAChC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,wBAAwB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,2BAA2B,QAAQ,OAAO,OAAO,CAAC,QAAQ,UAAU,OAAO,CAAC,YAAY,MAAM,CAAC;IAC9G,MAAM,OAAO,GACX,iBAAiB,aAAa,KAAK,YAAY,eAAe,OAAO,CAAC,YAAY,KAAK;QACvF,+BAA+B,WAAW,CAAC,iBAAiB,KAAK,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAC3F,IAAI,CACL,CAAC;IACF,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,OAAsB;IACjE,MAAM,MAAM,GAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAE3C,yEAAyE;IACzE,qEAAqE;IACrE,8DAA8D;IAC9D,iEAAiE;IACjE,uDAAuD;IACvD,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACjG,MAAM,CAAC,OAAO,GAAG,yBAAyB,OAAO,CAAC,UAAU,kDAAkD,CAAC;QAC/G,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,uEAAuE;IACvE,oEAAoE;IACpE,yDAAyD;IACzD,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,CAAC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC;QACxC,IAAI,cAAc,CAAC,KAAK;YAAE,MAAM,CAAC,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QACnE,IAAI,cAAc,CAAC,GAAG;YAAE,MAAM,CAAC,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;IACzC,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;IACnC,MAAM,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IAE1B,IAAI,CAAC,CAAC,MAAM,aAAa,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,OAAO;YACZ,qHAAqH,CAAC;QACxH,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,iBAAiB,EAAE,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,OAAO,GAAG,kDAAkD,CAAC;YACpE,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,OAAO,GAAG,yBAAyB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,qEAAqE;IACrE,uEAAuE;IACvE,uEAAuE;IACvE,sEAAsE;IACtE,sEAAsE;IACtE,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,qEAAqE;IACrE,EAAE;IACF,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,mEAAmE;IACnE,wEAAwE;IACxE,qCAAqC;IACrC,IAAI,sBAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACjF,sBAAsB;YACpB,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IACxF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,OAAO,GAAG,6DAA6D,GAAG,KAAK,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;QAC7G,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,qBAAqB,GAAG,KAAK,IAAmB,EAAE;QACtD,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,sBAAsB,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC,CAAC;IAEF,qEAAqE;IACrE,mEAAmE;IACnE,oEAAoE;IACpE,yDAAyD;IACzD,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,4DAA4D;IAC5D,yEAAyE;IACzE,mCAAmC;IACnC,IAAI,MAAgB,CAAC;IACrB,IAAI,SAAiB,CAAC;IACtB,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,sEAAsE;QACtE,kEAAkE;QAClE,qDAAqD;QACrD,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,GAAG,uDAAuD,GAAG,KAAK,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;YACvG,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,UAAU,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,OAAO,GAAG,4DAA4D,SAAS,GAAG,CAAC;YAC1F,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,OAAO,GAAG,4BAA4B,UAAU,yBAAyB,OAAO,CAAC,IAAI,GAAG,CAAC;YAChG,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,iEAAiE;QACjE,qEAAqE;QACrE,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,iEAAiE;QACjE,UAAU,GAAG,UAAU,CAAC;QAExB,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,qEAAqE;QACrE,oBAAoB;QACpB,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,SAAS,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,OAAO,GAAG,uCAAuC,SAAS,gCAAgC,UAAU,GAAG,CAAC;YAC/G,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,OAAO,GAAG,mDAAmD,OAAO,CAAC,EAAE,GAAG,CAAC;YAClF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,yEAAyE;QACzE,mEAAmE;QACnE,wEAAwE;QACxE,mDAAmD;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,IAAI,EACJ;gBACE,IAAI;gBACJ,MAAM;gBACN,WAAW;gBACX,IAAI;gBACJ,UAAU;gBACV,QAAQ;gBACR,gDAAgD;aACjD,EACD,GAAG,CACJ,CAAC;YACF,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,GAAG,oCAAoC,OAAO,CAAC,EAAE,MAAM,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;YAC5F,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,CAAC,OAAO,GAAG,oBAAoB,MAAM,CAAC,MAAM,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,YAAY,CAAC;YAChG,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,qEAAqE;QACrE,kEAAkE;QAClE,iEAAiE;QACjE,uDAAuD;QACvD,sEAAsE;QACtE,mEAAmE;QACnE,sEAAsE;QACtE,sEAAsE;QACtE,oEAAoE;QACpE,gEAAgE;QAChE,oCAAoC;QACpC,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7B,MAAM,CAAC,OAAO,GAAG,4BAA4B,MAAM,CAAC,MAAM,6DAA6D,CAAC;YACxH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,CAAC;YACH,kEAAkE;YAClE,oEAAoE;YACpE,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,+BAA+B;YAC/B,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,qBAAqB,EAAE,CAAC;YAC9B,MAAM,CAAC,OAAO,GAAG,oBAAoB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACnF,IAAI,aAAa,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,qBAAqB,EAAE,CAAC;YAC9B,MAAM,CAAC,OAAO,GAAG,iCAAiC,aAAa,aAAa,MAAM,CAAC,MAAM,sBAAsB,MAAM,CAAC,WAAW,GAAG,CAAC;YACrI,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,CAAC,MAAM,GAAG,aAAa,CAAC;QAE9B,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,uDAAuD;QACvD,qEAAqE;QACrE,sDAAsD;QACtD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,qBAAqB,EAAE,CAAC;YAC9B,qEAAqE;YACrE,qEAAqE;YACrE,2DAA2D;YAC3D,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;YAC1B,MAAM,CAAC,OAAO;gBACZ,kHAAkH,CAAC;YACrH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,iEAAiE;QACjE,wEAAwE;QACxE,0DAA0D;QAC1D,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC;QAC1D,MAAM,iBAAiB,GAAG,mBAAmB,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,IAAI,sBAAsB,CAAC;QAC/G,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,GAAG,CACP,KAAK,EACL;gBACE,IAAI;gBACJ,0BAA0B;gBAC1B,GAAG,QAAQ,CAAC,aAAa;gBACzB,QAAQ;gBACR,IAAI;gBACJ,WAAW;gBACX,iBAAiB;gBACjB,IAAI;gBACJ,OAAO;aACR,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,iEAAiE;YACjE,uEAAuE;YACvE,gEAAgE;YAChE,kEAAkE;YAClE,6DAA6D;YAC7D,wCAAwC;YACxC,MAAM,qBAAqB,EAAE,CAAC;YAC9B,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;YAC1B,MAAM,CAAC,OAAO,GAAG,kBAAkB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,+DAA+D;QAC/D,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,sEAAsE;YACtE,sEAAsE;YACtE,mEAAmE;YACnE,4DAA4D;YAC5D,oDAAoD;YACpD,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC;gBACzD,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;gBAChE,gEAAgE;gBAChE,kEAAkE;gBAClE,8CAA8C;YAChD,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,2DAA2D;gBAC3D,sDAAsD;gBACtD,mEAAmE;gBACnE,+DAA+D;gBAC/D,sBAAsB;gBACtB,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;gBAC7B,MAAM,qBAAqB,EAAE,CAAC;gBAC9B,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;gBAC1B,MAAM,CAAC,OAAO;oBACZ,+IAA+I,CAAC;YACpJ,CAAC;iBAAM,CAAC;gBACN,kEAAkE;gBAClE,6DAA6D;gBAC7D,gEAAgE;gBAChE,mEAAmE;gBACnE,2BAA2B;gBAC3B,MAAM,CAAC,OAAO;oBACZ,qMAAqM,CAAC;YAC1M,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,iEAAiE;QACjE,sEAAsE;QACtE,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,GAAG,kBAAkB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,qBAAqB,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;QAC1B,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wEAAwE;IACxE,qEAAqE;IACrE,sEAAsE;IACtE,yEAAyE;IACzE,yDAAyD;IACzD,yEAAyE;IACzE,mDAAmD;IACnD,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;IACxB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,EAAE,IAAI,EAAE,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,OAAO,GAA0B;gBACrC,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,MAAM,CAAC,MAAM;gBACvB,YAAY,EAAE,SAAS;aACxB,CAAC;YACF,MAAM,aAAa,GAAG,8BAA8B,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAClF,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CACtF,WAAW,CACZ,CAAC;YACF,MAAM,WAAW,GAAmB,oBAAoB,CAAC,KAAK,CAAC;gBAC7D,OAAO;gBACP,iBAAiB,EAAE,OAAO,CAAC,UAAU;gBACrC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,QAAQ,CAAC,GAAG;gBACtB,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE;aACrC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,8BAA8B,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9E,sEAAsE;YACtE,kDAAkD;YAClD,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;YACjG,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oEAAoE;YACpE,sEAAsE;YACtE,4CAA4C;YAC5C,MAAM,CAAC,OAAO,GAAG,uBAAuB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/dco/git-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-config.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/git-config.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAUD,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAM7D;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,OAAO,GAAG,QAAQ,GACzB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GACzC,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,KAAK,CAAC,EAAE,OAAO,GAAG,QAAQ,GACzB,OAAO,CAAC,eAAe,EAAE,CAAC,CAS5B;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACtC;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBpE;AAMD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,WAAW,GACjB,MAAM,CAwBR;AAED,MAAM,MAAM,iBAAiB,GACzB,WAAW,GACX,SAAS,GACT,WAAW,GACX,cAAc,GACd,mBAAmB,GACnB,cAAc,CAAC;AAEnB;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA8CtD"}
+{"version":3,"file":"git-config.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/git-config.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAUD,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAM7D;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,OAAO,GAAG,QAAQ,GACzB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GACzC,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,KAAK,CAAC,EAAE,OAAO,GAAG,QAAQ,GACzB,OAAO,CAAC,eAAe,EAAE,CAAC,CAS5B;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACtC;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAqBpE;AAMD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,WAAW,GACjB,MAAM,CAwBR;AAED,MAAM,MAAM,iBAAiB,GACzB,WAAW,GACX,SAAS,GACT,WAAW,GACX,cAAc,GACd,mBAAmB,GACnB,cAAc,CAAC;AAEnB;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA8CtD"}

package/dist/utils/dco/git-config.js

@@ -2,7 +2,7 @@ import { execFile } from "child_process";
 import { promisify } from "util";
 import { existsSync, mkdirSync, readFileSync, realpathSync } from "fs";
 import { isAbsolute, join, resolve, sep } from "path";
-import { writeFileAtomicSafe } from "./fs-safe.js";
+import { writeFileAtomicSafe } from "../cli-kit/index.js";
 const execFileAsync = promisify(execFile);
 /** Resolve symlinks when the path exists; fall back to the input otherwise. */
 function realpathIfExists(path) {
@@ -72,7 +72,9 @@ export async function getHooksDir(cwd) {
     if (hooksPath) {
         // core.hooksPath is relative to the working-tree root, not cwd.
         const topLevel = await git(["rev-parse", "--show-toplevel"], cwd);
-        const dir = isAbsolute(hooksPath) ? hooksPath : resolve(topLevel, hooksPath);
+        const dir = isAbsolute(hooksPath)
+            ? hooksPath
+            : resolve(topLevel, hooksPath);
         return { dir, source: "core.hooksPath" };
     }
     // --git-path resolves "hooks" against the COMMON git dir (where git actually
@@ -92,7 +94,7 @@ export function buildTrailerHook(human, agent) {
     const coAuthoredBy = shQuote(`Co-authored-by: ${agent.name} <${agent.email}>`);
     return `#!/bin/sh
 ${HOOK_MARKER} v1
-# Managed by \`mcpi dco setup\`. Appends the DCO sign-off and agent
+# Managed by \`dco setup\`. Appends the DCO sign-off and agent
 # attribution trailers to commit messages when they are missing.
 
 COMMIT_MSG_FILE="$1"

package/dist/utils/dco/git-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-config.js","sourceRoot":"","sources":["../../../src/utils/dco/git-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,+EAA+E;AAC/E,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAO7C,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAW;IAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;QAClD,GAAG;QACH,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,GAAW,EACX,KAA0B;IAE1B,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA+B,EAC/B,OAA0C;IAE1C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAQD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,OAA+B,EAC/B,KAA0B;IAE1B,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YACjD,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACjE,IAAI,SAAS,EAAE,CAAC;QACd,gEAAgE;QAChE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7E,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3C,CAAC;IACD,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,6EAA6E;IAC7E,qDAAqD;IACrD,MAAM,QAAQ,GAAG,MAAM,GAAG,CACxB,CAAC,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,OAAO,CAAC,EAC9D,GAAG,CACJ,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAkB,EAClB,KAAkB;IAElB,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,OAAO,CAC1B,mBAAmB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,GAAG,CACjD,CAAC;IACF,OAAO;EACP,WAAW;;;;;;;;;;;;;;cAcC,WAAW;cACX,YAAY;;CAEzB,CAAC;AACF,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,KAAkB,EAClB,KAAkB,EAClB,UAAgC,EAAE;IAElC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAEjD,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,CACjD,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAC7B,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAAE,GAAG,CAAC,CACpD,CAAC;QACF,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAChC,WAAW,KAAK,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE/C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpD,CAAC;QACD,sEAAsE;QACtE,qEAAqE;QACrE,oBAAoB;QACpB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC"}
+{"version":3,"file":"git-config.js","sourceRoot":"","sources":["../../../src/utils/dco/git-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,+EAA+E;AAC/E,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAO7C,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAW;IAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;QAClD,GAAG;QACH,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,GAAW,EACX,KAA0B;IAE1B,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA+B,EAC/B,OAA0C;IAE1C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAQD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,OAA+B,EAC/B,KAA0B;IAE1B,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YACjD,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACjE,IAAI,SAAS,EAAE,CAAC;QACd,gEAAgE;QAChE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC;YAC/B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3C,CAAC;IACD,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,6EAA6E;IAC7E,qDAAqD;IACrD,MAAM,QAAQ,GAAG,MAAM,GAAG,CACxB,CAAC,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,OAAO,CAAC,EAC9D,GAAG,CACJ,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAkB,EAClB,KAAkB;IAElB,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,OAAO,CAC1B,mBAAmB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,GAAG,CACjD,CAAC;IACF,OAAO;EACP,WAAW;;;;;;;;;;;;;;cAcC,WAAW;cACX,YAAY;;CAEzB,CAAC;AACF,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,KAAkB,EAClB,KAAkB,EAClB,UAAgC,EAAE;IAElC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAEjD,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,CACjD,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAC7B,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAAE,GAAG,CAAC,CACpD,CAAC;QACF,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAChC,WAAW,KAAK,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE/C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpD,CAAC;QACD,sEAAsE;QACtE,qEAAqE;QACrE,oBAAoB;QACpB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC"}