@kya-os/cli 1.8.3 → 2.0.2

package/dist/utils/dco/fix.js

@@ -1,560 +0,0 @@
-import { execFile } from "child_process";
-import { readFileSync } from "fs";
-import { promisify } from "util";
-import { FixAttestationSchema, getFixAttestationSigningString, } from "@kya-os/contracts/review";
-import { isGhAuthenticated, isGhInstalled } from "./github.js";
-import { isCommitSigned, resolveSigningIdentity } from "./dispatch.js";
-import { parseEd25519SshPrivateKeyPem, signWithEd25519Seed } from "./ssh-key.js";
-const execFileAsync = promisify(execFile);
-const DEFAULT_COMMIT_MESSAGE = "fix: address signed review findings";
-async function run(cmd, args, cwd) {
-    const { stdout } = await execFileAsync(cmd, args, {
-        cwd,
-        encoding: "utf8",
-        maxBuffer: 10 * 1024 * 1024,
-    });
-    return stdout.trim();
-}
-async function gitSucceeds(args, cwd) {
-    try {
-        await run("git", args, cwd);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function errorMessage(error) {
-    if (error && typeof error === "object" && "stderr" in error) {
-        const stderr = String(error.stderr ?? "").trim();
-        if (stderr) {
-            return stderr;
-        }
-    }
-    return error instanceof Error ? error.message : String(error);
-}
-/**
- * Parse "owner/repo" out of a git remote URL, accepting the two shapes a
- * GitHub `origin` remote actually takes: SSH (`git@github.com:owner/repo.git`)
- * and HTTPS (`https://github.com/owner/repo(.git)`). Returns null for
- * anything else rather than guessing.
- */
-/**
- * GitHub owner/repo names are case-insensitive (`Acme/Demo` and `acme/demo`
- * name the same repo), but a git remote's casing and a browser-copied PR
- * URL's casing routinely differ from each other and from what a user types
- * for `--repo`. A strict `===` between any two of `originRepo`/`--repo`/a
- * PR URL's repo would then refuse a legitimate same-repo `dco fix` as
- * `wrong-remote`.
- */
-function repoNamesEqual(a, b) {
-    return a.toLowerCase() === b.toLowerCase();
-}
-export function parseOwnerRepoFromRemoteUrl(url) {
-    const trimmed = url.trim().replace(/\.git$/, "");
-    const sshMatch = /^[\w-]+@[^:/]+:([^/]+\/[^/]+)$/.exec(trimmed);
-    if (sshMatch) {
-        return sshMatch[1];
-    }
-    const httpsMatch = /^https?:\/\/[^/]+\/([^/]+\/[^/]+)$/.exec(trimmed);
-    if (httpsMatch) {
-        return httpsMatch[1];
-    }
-    return null;
-}
-/**
- * The one pattern both `parseOwnerRepoFromPrUrl` and `extractPrNumber` parse
- * a PR URL with. Anchored at both ends (`^`...`$`) and requiring a lowercase
- * `http(s)://` scheme, so the two functions can never disagree on what
- * counts as a "PR URL" — see parseOwnerRepoFromPrUrl's doc comment for why
- * that agreement is the whole point. Trailing content after the number
- * (`/files`, `#issuecomment-1`, `?diff=split`) is tolerated, since a
- * browser-copied PR link routinely carries one of those.
- */
-const PR_URL_PATTERN = /^https?:\/\/[^/]+\/([^/]+\/[^/]+)\/pull\/(\d+)(?:[/?#].*)?$/;
-/**
- * Parse "owner/repo" out of a full PR URL (`https://github.com/owner/repo/pull/123`).
- * Returns null for a bare PR number (or anything else): a bare number carries
- * no repo of its own, so there is nothing to cross-check it against — every
- * gh call below is scoped to `targetRepo` explicitly regardless.
- *
- * Shares PR_URL_PATTERN with extractPrNumber on purpose, rather than each
- * using its own regex: an input recognized by ONE as URL-shaped but not the
- * OTHER used to let a same-numbered-PR mismatch slip through silently — an
- * uppercase scheme, a missing scheme, or a URL embedded in surrounding text
- * would fail this function's narrower original pattern (skipping the
- * wrong-remote check below, since it only runs when this returns non-null)
- * while still matching extractPrNumber's looser unanchored `/pull/(\d+)`
- * search, so the flow proceeded against this checkout's same-numbered PR
- * with no cross-repo check ever having run. One shared pattern means
- * whatever extractPrNumber accepts as URL-shaped, this function recognizes
- * too, so the check it guards can never be bypassed that way.
- */
-export function parseOwnerRepoFromPrUrl(pr) {
-    const match = PR_URL_PATTERN.exec(pr.trim());
-    return match ? match[1] : null;
-}
-/**
- * Normalize `pr` (a bare number or a full PR URL) down to just the number,
- * so every `gh pr` call below can be pinned with an explicit `-R targetRepo`
- * instead of a heterogeneous target that sometimes carries its own repo and
- * sometimes relies on ambient resolution. Ambient resolution is NOT
- * guaranteed to agree with `cwd`'s git remote — `GH_REPO` or a `gh repo
- * set-default` override takes precedence over it — so a bare number handed
- * to `gh` unpinned could read a different repo's PR even after step 2's
- * origin check. Returns null for anything that isn't a plain integer or a
- * `.../pull/<number>` URL matching PR_URL_PATTERN.
- */
-export function extractPrNumber(pr) {
-    const trimmed = pr.trim();
-    if (/^\d+$/.test(trimmed)) {
-        return trimmed;
-    }
-    const match = PR_URL_PATTERN.exec(trimmed);
-    return match ? match[2] : null;
-}
-function parseGhPrView(stdout) {
-    const parsed = JSON.parse(stdout);
-    if (typeof parsed.number !== "number" ||
-        typeof parsed.headRefName !== "string" ||
-        typeof parsed.state !== "string" ||
-        typeof parsed.url !== "string" ||
-        typeof parsed.isCrossRepository !== "boolean") {
-        throw new Error("Unexpected response from `gh pr view --json`");
-    }
-    return {
-        number: parsed.number,
-        headRefName: parsed.headRefName,
-        state: parsed.state,
-        url: parsed.url,
-        isCrossRepository: parsed.isCrossRepository,
-    };
-}
-/**
- * Strip characters that could break out of the marker-bounded structure
- * `buildFixAttestationCommentBody` builds around a value: a backtick would
- * prematurely close/reopen an adjacent code span; `-->` would prematurely
- * close this function's own HTML comment marker, letting whatever follows
- * render as visible PR-comment content instead of staying hidden inside
- * it; and, the other direction, a bare `<!--` would OPEN a new comment
- * mid-line, hiding everything after it in GitHub's rendered view —
- * including the fenced attestation block that's supposed to stay publicly
- * visible and verifiable. Defense in depth alongside
- * `FixAttestationSubjectSchema.repo`'s tighter character-class validation:
- * this also covers `agentName`, a free-text display name with no schema of
- * its own (an agent's `.mcpi/agent.json` name, sourced from a checkout —
- * see resolve-agent.ts's threat model for the same class of hostile-repo
- * risk applied to CLAUDE.md). Exported so `agent/markers.ts`'s review-verdict
- * marker (the same breakout risk, applied to a reviewer DID/repo instead of
- * an agent name/DID) reuses this exact sanitizer rather than a second copy
- * that could drift on which characters it strips.
- */
-export function sanitizeForMarkdownBlock(value) {
-    return value.replace(/`/g, "'").replace(/-->/g, "- >").replace(/<!--/g, "< !--");
-}
-/**
- * Build the PR comment body posted for a fix attestation: an HTML-comment
- * marker (so a future `dco` run can find and dedupe on it), a one-line
- * human summary, and a fenced `kya-os-fix-attestation` JSON block that
- * round-trips `FixAttestationSchema`. The marker's fields are duplicated
- * from `attestation` in a stable, greppable form so tooling never has to
- * parse the fenced block just to know which commit/PR a comment is about.
- * The fenced JSON block itself carries the RAW, unsanitized values (it's
- * the actual signed data — sanitizing it would make it not round-trip);
- * only the marker and summary lines, which render as live markdown, are
- * sanitized. That includes `agentDid`: `DidStringSchema` only requires a
- * `did:<method>:` prefix followed by any non-whitespace method-specific
- * id, so it's exactly as free-form (and exactly as hostile-repo-sourced,
- * for a locally-registered agent whose name/DID this command reads off
- * disk) as `agentName` is — same breakout risk, same fix.
- */
-export function buildFixAttestationCommentBody(attestation, agentName) {
-    const { subject } = attestation;
-    const safeRepo = sanitizeForMarkdownBlock(subject.repo);
-    const safeAgentName = sanitizeForMarkdownBlock(agentName);
-    const safeAgentDid = sanitizeForMarkdownBlock(attestation.agentDid);
-    const marker = `<!-- kya-os-fix:v1 repo=${safeRepo} pr=${subject.prNumber} fixed=${subject.fixedHeadSha} -->`;
-    const summary = `Fix pushed by ${safeAgentName} (${safeAgentDid}): commit \`${subject.fixedHeadSha}\` ` +
-        `responds to the review of \`${attestation.respondsToHeadSha}\`.`;
-    const block = ["```kya-os-fix-attestation", JSON.stringify(attestation, null, 2), "```"].join("\n");
-    return [marker, "", summary, "", block, ""].join("\n");
-}
-export async function runDcoFix(cwd, options) {
-    const result = { ok: false };
-    // Validate --responds-to's shape BEFORE any side effect, including agent
-    // resolution: FixAttestationSchema itself only runs at step 8, after
-    // checkout/commit/push, and a malformed value (a truncated or
-    // uppercase SHA — an easy paste mistake from some git UIs) would
-    // otherwise still push the fix and only then report an
-    // attestation-failed follow-up action. Same 40-hex-lowercase shape as
-    // FixAttestationSubjectSchema.respondsToHeadSha; only checked when an
-    // attestation will actually be attempted (the same gate step 8 uses).
-    if (options.attest !== false && options.respondsTo && !/^[0-9a-f]{40}$/.test(options.respondsTo)) {
-        result.failure = `invalid-responds-to: "${options.respondsTo}" is not a 40-character lowercase hex commit SHA`;
-        return result;
-    }
-    // Step 1: resolve agent identity, slug-derived DID, and signing config
-    // exactly as `dco dispatch` does — see resolveSigningIdentity's doc
-    // comment for why this is shared rather than re-derived.
-    const identityResult = await resolveSigningIdentity(cwd, options.agent);
-    if (!identityResult.ok) {
-        result.failure = identityResult.failure;
-        if (identityResult.agent)
-            result.agent = identityResult.agent.slug;
-        if (identityResult.did)
-            result.did = identityResult.did;
-        return result;
-    }
-    const identity = identityResult.identity;
-    result.agent = identity.agent.slug;
-    result.did = identity.did;
-    if (!(await isGhInstalled())) {
-        result.failure =
-            "gh-not-installed: GitHub CLI (gh) is not installed. Install it from https://cli.github.com and run `gh auth login`.";
-        return result;
-    }
-    try {
-        if (!(await isGhAuthenticated())) {
-            result.failure = "gh-not-authenticated: run `gh auth login` first.";
-            return result;
-        }
-    }
-    catch (error) {
-        result.failure = `gh-not-authenticated: ${errorMessage(error)}`;
-        return result;
-    }
-    // gh pr checkout (step 3) switches cwd's checked-out branch — a real side
-    // effect on the caller's own working directory. Capture what they were on
-    // BEFORE steps 2-7 run (below) and reuse the SAME restore in every
-    // pre-commit failure path, including the outer catch: a failure that
-    // reaches the outer catch (an unexpected error from one of the "should
-    // never fail" calls — the post-checkout branch read, `git add -A`, the
-    // post-commit sha/signature reads) must restore just as reliably as a
-    // named one, or the caller can be left stranded on the PR branch with
-    // nothing accomplished. Best-effort only: a failed restore doesn't change
-    // the outcome or need reporting. Detached HEAD falls back to the exact
-    // commit rather than a branch name; calling this before checkout ever ran
-    // is a harmless no-op (checking out the branch already checked out).
-    //
-    // The capture itself gets its own try/catch, separate from the steps 2-7
-    // block below: it runs BEFORE that block starts, so it isn't covered by
-    // it, and these two `git rev-parse` calls are the first real git commands
-    // this function issues — nothing yet confirms cwd is even a git checkout.
-    // If cwd isn't a git repo (or HEAD is somehow unreadable), fail closed
-    // with a named result here instead of letting the rejection escape
-    // runDcoFix uncaught: there's no branch to restore in that case anyway,
-    // since nothing has switched it yet.
-    let originalCheckoutTarget;
-    try {
-        const originalRef = await run("git", ["rev-parse", "--abbrev-ref", "HEAD"], cwd);
-        originalCheckoutTarget =
-            originalRef === "HEAD" ? await run("git", ["rev-parse", "HEAD"], cwd) : originalRef;
-    }
-    catch (error) {
-        result.failure = `not-a-git-repo: could not determine the current branch in ${cwd} (${errorMessage(error)})`;
-        return result;
-    }
-    const restoreOriginalBranch = async () => {
-        try {
-            await run("git", ["checkout", originalCheckoutTarget], cwd);
-        }
-        catch {
-            // Courtesy only — see comment above.
-        }
-    };
-    // Steps 2-7 all run inside one try/catch, matching dispatch.ts's own
-    // belt-and-braces pattern: each step already returns its own NAMED
-    // failure for the outcomes worth naming (wrong-remote, pr-not-open,
-    // fork-pr-unsupported, checkout-failed, branch-mismatch,
-    // nothing-to-commit, commit-failed, unsigned-commit, push-rejected), but
-    // a handful of calls here (the post-checkout branch read, `git add -A`,
-    // and the post-commit sha/signature reads) are "should never fail once
-    // we got this far" operations with no named-failure story of their own.
-    // Without this outer catch, an unexpected failure in one of those would
-    // reject the whole function instead of degrading to a clean
-    // `{ok:false, failure}` — breaking the "every step fails closed" promise
-    // this module's doc comment makes.
-    let prView;
-    let commitSha;
-    let targetRepo;
-    try {
-        // Step 2: cwd must already be a clone of the target repo. Never clone
-        // implicitly — the caller (a human or an executor) owns workspace
-        // placement, unlike dispatch's cold-start self-heal.
-        let originUrl;
-        try {
-            originUrl = await run("git", ["remote", "get-url", "origin"], cwd);
-        }
-        catch (error) {
-            result.failure = `wrong-remote: could not read git remote "origin" in ${cwd} (${errorMessage(error)})`;
-            return result;
-        }
-        const originRepo = parseOwnerRepoFromRemoteUrl(originUrl);
-        if (!originRepo) {
-            result.failure = `wrong-remote: could not parse an owner/repo from origin "${originUrl}"`;
-            return result;
-        }
-        if (options.repo && !repoNamesEqual(options.repo, originRepo)) {
-            result.failure = `wrong-remote: origin is "${originRepo}" but --repo expects "${options.repo}"`;
-            return result;
-        }
-        // Always the git-derived casing, even when --repo was given: the
-        // equality check above only ever confirms --repo names the SAME repo
-        // as origin (never redirects to a different one), so origin's casing
-        // is the canonical one. Using options.repo's as-typed casing here
-        // would let the same PR sign a different subject.repo string on every
-        // invocation depending on how --repo happened to be capitalized.
-        targetRepo = originRepo;
-        // `options.pr` may be a full URL to a repo OTHER than targetRepo (`gh pr
-        // view <url>` happily reads any repo's PR data, independent of cwd —
-        // that is how `dco verify` supports running from anywhere): reject that
-        // mismatch up front. Then normalize to a bare number and pin EVERY gh
-        // call below — view included — with an explicit `-R targetRepo`, never
-        // ambient resolution: `gh`'s own repo resolution prefers `GH_REPO` (or a
-        // `gh repo set-default` override) over cwd's git remote, so even after
-        // step 2 confirms cwd's origin matches targetRepo, an unpinned call
-        // could still read (and, without the pin, act on) a different repo's
-        // same-numbered PR.
-        const prUrlRepo = parseOwnerRepoFromPrUrl(options.pr);
-        if (prUrlRepo && !repoNamesEqual(prUrlRepo, targetRepo)) {
-            result.failure = `wrong-remote: the PR URL points at "${prUrlRepo}" but this checkout targets "${targetRepo}"`;
-            return result;
-        }
-        const prNumberArg = extractPrNumber(options.pr);
-        if (!prNumberArg) {
-            result.failure = `pr-not-found: could not parse a PR number from "${options.pr}"`;
-            return result;
-        }
-        // Step 3: land on the PR's actual head branch and refuse a merged/closed
-        // PR. One `gh pr view --json` call serves the state gate, the fork
-        // check, and the headRefName confirmation after checkout, so there's no
-        // second call to drift out of sync with the first.
-        try {
-            const stdout = await run("gh", [
-                "pr",
-                "view",
-                prNumberArg,
-                "-R",
-                targetRepo,
-                "--json",
-                "number,headRefName,state,url,isCrossRepository",
-            ], cwd);
-            prView = parseGhPrView(stdout);
-        }
-        catch (error) {
-            result.failure = `pr-not-found: could not read PR "${options.pr}" (${errorMessage(error)})`;
-            return result;
-        }
-        if (prView.state !== "OPEN") {
-            result.failure = `pr-not-open: PR #${prView.number} is ${prView.state.toLowerCase()}, not open`;
-            return result;
-        }
-        // Refuse a fork PR BEFORE checkout: `gh pr checkout` names the local
-        // branch after the fork's `headRefName` verbatim (no owner prefix
-        // unless it collides with the base repo's default branch), while
-        // `origin` still points at THIS repo. `git push origin
-        // HEAD:<headRefName>` further down would then push the fork's content
-        // to that name on origin — a ref-creation push if the name doesn't
-        // already exist there, which git allows unconditionally regardless of
-        // write-access scope. That plants PR-author-controlled content on the
-        // trusted repo under a name the fork author picked, not the caller.
-        // Refusing here removes the vulnerability rather than trying to
-        // sanitize an attacker-chosen name.
-        if (prView.isCrossRepository) {
-            result.failure = `fork-pr-unsupported: PR #${prView.number} is from a fork; dco fix only pushes fixes to same-repo PRs`;
-            return result;
-        }
-        try {
-            // `-R targetRepo` makes this explicit rather than relying on gh's
-            // ambient cwd-derived repo resolution: targetRepo is the value this
-            // whole flow has already validated (against `--repo` and, above,
-            // against a URL-form `options.pr`), so every write from here on is
-            // pinned to it directly instead of trusting an implicit lookup to
-            // agree with it a second time.
-            await run("gh", ["pr", "checkout", String(prView.number), "-R", targetRepo], cwd);
-        }
-        catch (error) {
-            await restoreOriginalBranch();
-            result.failure = `checkout-failed: ${errorMessage(error)}`;
-            return result;
-        }
-        const currentBranch = await run("git", ["rev-parse", "--abbrev-ref", "HEAD"], cwd);
-        if (currentBranch !== prView.headRefName) {
-            await restoreOriginalBranch();
-            result.failure = `branch-mismatch: checked out "${currentBranch}" but PR #${prView.number}'s head branch is "${prView.headRefName}"`;
-            return result;
-        }
-        result.branch = currentBranch;
-        // Step 4: require staged changes. This command never invents content to
-        // commit — the staged set IS the fix, so an empty stage is refused
-        // rather than silently producing an empty commit. A failure here still
-        // leaves the caller back on their original branch (see
-        // restoreOriginalBranch above): nothing was accomplished, so nothing
-        // should look different when they check `git branch`.
-        if (options.stageAll) {
-            await run("git", ["add", "-A"], cwd);
-        }
-        const hasStagedChanges = !(await gitSucceeds(["diff", "--cached", "--quiet"], cwd));
-        if (!hasStagedChanges) {
-            await restoreOriginalBranch();
-            // Undo the `result.branch = currentBranch` assignment above too: cwd
-            // is back on the caller's original branch now, so reporting the PR's
-            // branch here would misstate where they actually ended up.
-            result.branch = undefined;
-            result.failure =
-                "nothing-to-commit: no staged changes to commit (pass --all to stage everything, or stage changes yourself first)";
-            return result;
-        }
-        // Step 5: commit exactly the staged set. Reuses the same signing
-        // config, sign-off, and Co-authored-by trailer discipline `dispatch.ts`
-        // uses, but DELIBERATELY with NO path scoping (dispatch's
-        // `-- DCO-DEMO.md` guard exists because dispatch invents its own demo
-        // content; here the staged set IS the boundary — the command commits
-        // what the caller staged, never more, so there's nothing left to scope
-        // a pathspec against).
-        const message = options.message ?? DEFAULT_COMMIT_MESSAGE;
-        const coAuthoredTrailer = `Co-authored-by: ${identity.agent.name} <${identity.agent.slug}@agents.knowthat.ai>`;
-        // Captured so an unsigned commit (step 6) can be undone back to exactly
-        // this point — staged, not yet committed — rather than left dangling.
-        const preCommitSha = await run("git", ["rev-parse", "HEAD"], cwd);
-        try {
-            await run("git", [
-                "-c",
-                "core.hooksPath=/dev/null",
-                ...identity.signingConfig,
-                "commit",
-                "-s",
-                "--trailer",
-                coAuthoredTrailer,
-                "-m",
-                message,
-            ], cwd);
-        }
-        catch (error) {
-            // Nothing was actually committed — this is a pre-commit failure like
-            // checkout-failed/branch-mismatch/nothing-to-commit above, not a
-            // post-commit one (unsigned-commit, push-rejected) where a real commit
-            // now exists on the PR branch and staying put to let the caller
-            // inspect it is the right call. Restore for the same reason those
-            // three do: leaving the caller on the PR branch with nothing
-            // accomplished misstates what happened.
-            await restoreOriginalBranch();
-            result.branch = undefined;
-            result.failure = `commit-failed: ${errorMessage(error)}`;
-            return result;
-        }
-        // Step 6: verify the commit is signed BEFORE pushing anything.
-        commitSha = await run("git", ["rev-parse", "HEAD"], cwd);
-        result.commitSha = commitSha;
-        const rawCommit = await run("git", ["cat-file", "commit", "HEAD"], cwd);
-        result.signed = isCommitSigned(rawCommit);
-        if (!result.signed) {
-            // Telling the caller to fix signing and "try again" is only true if a
-            // retry actually can: undo the unsigned commit back to staged changes
-            // (step 4's post-condition) rather than leaving it landed with the
-            // staged set already consumed, which would make a retry hit
-            // nothing-to-commit instead of re-signing anything.
-            let undone = false;
-            try {
-                await run("git", ["reset", "--soft", preCommitSha], cwd);
-                undone = true;
-            }
-            catch {
-                // Leave result.commitSha pointing at the unsigned commit that's
-                // still there, since the undo didn't happen — same as any other
-                // post-commit failure (push-rejected) where a real commit remains
-                // on the PR branch for the caller to inspect.
-            }
-            if (undone) {
-                // Nothing is left on the PR branch — the same "nothing was
-                // accomplished" case checkout-failed/branch-mismatch/
-                // nothing-to-commit/commit-failed already restore for, so this one
-                // does too instead of stranding the caller on a branch holding
-                // none of their work.
-                result.commitSha = undefined;
-                await restoreOriginalBranch();
-                result.branch = undefined;
-                result.failure =
-                    "unsigned-commit: the commit was NOT signed and has been undone (your changes are still staged). Run `dco setup` in this repo, then try again.";
-            }
-            else {
-                // The undo itself failed, so the unsigned commit is still sitting
-                // on the PR branch — staying put (not restoring) matches how
-                // push-rejected leaves a real commit in place for the caller to
-                // inspect, and the message says so honestly instead of claiming an
-                // undo that didn't happen.
-                result.failure =
-                    "unsigned-commit: the commit was created but is NOT signed, and could not be undone automatically. Run `dco setup` in this repo, then `git reset --soft HEAD~1` (or amend the commit) and try again.";
-            }
-            return result;
-        }
-        // Step 7: push to the EXISTING branch. Never force, never `-u` a new
-        // branch, never `gh pr create`. Hooks disabled here for the same reason
-        // the commit step above disables them: `cwd` may be a clone a headless
-        // agent pass with full file-system write access just ran in (the
-        // `kya-os agent task --watch` fix-round caller of this function — see
-        // its own doc comment on `writeCapable` in spawn-agent.ts), and a planted
-        // `.git/hooks/pre-push` would otherwise execute with this process's own
-        // credentials at push time regardless of what Bash commands were denied
-        // during that pass.
-        try {
-            await run("git", ["-c", "core.hooksPath=/dev/null", "push", "origin", `HEAD:${prView.headRefName}`], cwd);
-        }
-        catch (error) {
-            result.failure = `push-rejected: ${errorMessage(error)}`;
-            return result;
-        }
-        result.pushed = true;
-        result.prUrl = prView.url;
-    }
-    catch (error) {
-        await restoreOriginalBranch();
-        result.branch = undefined;
-        result.failure = errorMessage(error);
-        return result;
-    }
-    // Step 8: sign and post a fix attestation, when requested and there's a
-    // reviewed head to answer. Skipped (not failed) when `respondsTo` is
-    // absent — signing an attestation that answers nothing would be worse
-    // than not posting one. Signing stays entirely inside this function: the
-    // seed is recovered from the SAME converted SSH key file
-    // `resolveSigningIdentity` already validated exists, never a second copy
-    // of key material, and it never leaves this scope.
-    result.attested = false;
-    if (options.attest !== false && options.respondsTo) {
-        try {
-            const pem = readFileSync(identity.keyPath, "utf-8");
-            const { seed } = parseEd25519SshPrivateKeyPem(pem);
-            const subject = {
-                repo: targetRepo,
-                prNumber: prView.number,
-                fixedHeadSha: commitSha,
-            };
-            const signingString = getFixAttestationSigningString(subject, options.respondsTo);
-            const signature = signWithEd25519Seed(seed, Buffer.from(signingString, "utf8")).toString("base64url");
-            const attestation = FixAttestationSchema.parse({
-                subject,
-                respondsToHeadSha: options.respondsTo,
-                taskId: options.taskId,
-                agentDid: identity.did,
-                proof: { alg: "Ed25519", signature },
-            });
-            const body = buildFixAttestationCommentBody(attestation, identity.agent.name);
-            // `-R targetRepo`, same reasoning as the checkout call above: pin the
-            // write to the already-validated repo explicitly.
-            await run("gh", ["pr", "comment", String(prView.number), "--body", body, "-R", targetRepo], cwd);
-            result.attested = true;
-        }
-        catch (error) {
-            // The commit already landed and pushed successfully by this point —
-            // an attestation-posting failure is a follow-up action pending, not a
-            // reason to report the whole fix as failed.
-            result.failure = `attestation-failed: ${errorMessage(error)}`;
-            result.ok = true;
-            return result;
-        }
-    }
-    result.ok = true;
-    return result;
-}
-//# sourceMappingURL=fix.js.map

package/dist/utils/dco/fix.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fix.js","sourceRoot":"","sources":["../../../src/utils/dco/fix.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,8BAA8B,GAG/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEjF,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAsD1C,MAAM,sBAAsB,GAAG,qCAAqC,CAAC;AAErE,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,GAAW;IACzD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE;QAChD,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAc,EAAE,GAAW;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,CAAE,KAA8B,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,CAAS,EAAE,CAAS;IAC1C,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAW;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,UAAU,GAAG,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG,6DAA6D,CAAC;AAErF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAU;IAChD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAUD,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAsB,CAAC;IACvD,IACE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,OAAO,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,8BAA8B,CAC5C,WAA2B,EAC3B,SAAiB;IAEjB,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;IAChC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,wBAAwB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,2BAA2B,QAAQ,OAAO,OAAO,CAAC,QAAQ,UAAU,OAAO,CAAC,YAAY,MAAM,CAAC;IAC9G,MAAM,OAAO,GACX,iBAAiB,aAAa,KAAK,YAAY,eAAe,OAAO,CAAC,YAAY,KAAK;QACvF,+BAA+B,WAAW,CAAC,iBAAiB,KAAK,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAC3F,IAAI,CACL,CAAC;IACF,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,OAAsB;IACjE,MAAM,MAAM,GAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAE3C,yEAAyE;IACzE,qEAAqE;IACrE,8DAA8D;IAC9D,iEAAiE;IACjE,uDAAuD;IACvD,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACjG,MAAM,CAAC,OAAO,GAAG,yBAAyB,OAAO,CAAC,UAAU,kDAAkD,CAAC;QAC/G,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,uEAAuE;IACvE,oEAAoE;IACpE,yDAAyD;IACzD,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,CAAC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC;QACxC,IAAI,cAAc,CAAC,KAAK;YAAE,MAAM,CAAC,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QACnE,IAAI,cAAc,CAAC,GAAG;YAAE,MAAM,CAAC,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;IACzC,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;IACnC,MAAM,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IAE1B,IAAI,CAAC,CAAC,MAAM,aAAa,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,OAAO;YACZ,qHAAqH,CAAC;QACxH,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,iBAAiB,EAAE,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,OAAO,GAAG,kDAAkD,CAAC;YACpE,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,OAAO,GAAG,yBAAyB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,qEAAqE;IACrE,uEAAuE;IACvE,uEAAuE;IACvE,sEAAsE;IACtE,sEAAsE;IACtE,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,qEAAqE;IACrE,EAAE;IACF,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,mEAAmE;IACnE,wEAAwE;IACxE,qCAAqC;IACrC,IAAI,sBAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACjF,sBAAsB;YACpB,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IACxF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,OAAO,GAAG,6DAA6D,GAAG,KAAK,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;QAC7G,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,qBAAqB,GAAG,KAAK,IAAmB,EAAE;QACtD,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,sBAAsB,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC,CAAC;IAEF,qEAAqE;IACrE,mEAAmE;IACnE,oEAAoE;IACpE,yDAAyD;IACzD,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,4DAA4D;IAC5D,yEAAyE;IACzE,mCAAmC;IACnC,IAAI,MAAgB,CAAC;IACrB,IAAI,SAAiB,CAAC;IACtB,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,sEAAsE;QACtE,kEAAkE;QAClE,qDAAqD;QACrD,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,GAAG,uDAAuD,GAAG,KAAK,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;YACvG,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,UAAU,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,OAAO,GAAG,4DAA4D,SAAS,GAAG,CAAC;YAC1F,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,OAAO,GAAG,4BAA4B,UAAU,yBAAyB,OAAO,CAAC,IAAI,GAAG,CAAC;YAChG,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,iEAAiE;QACjE,qEAAqE;QACrE,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,iEAAiE;QACjE,UAAU,GAAG,UAAU,CAAC;QAExB,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,qEAAqE;QACrE,oBAAoB;QACpB,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,SAAS,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,OAAO,GAAG,uCAAuC,SAAS,gCAAgC,UAAU,GAAG,CAAC;YAC/G,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,OAAO,GAAG,mDAAmD,OAAO,CAAC,EAAE,GAAG,CAAC;YAClF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,yEAAyE;QACzE,mEAAmE;QACnE,wEAAwE;QACxE,mDAAmD;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,IAAI,EACJ;gBACE,IAAI;gBACJ,MAAM;gBACN,WAAW;gBACX,IAAI;gBACJ,UAAU;gBACV,QAAQ;gBACR,gDAAgD;aACjD,EACD,GAAG,CACJ,CAAC;YACF,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,GAAG,oCAAoC,OAAO,CAAC,EAAE,MAAM,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;YAC5F,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,CAAC,OAAO,GAAG,oBAAoB,MAAM,CAAC,MAAM,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,YAAY,CAAC;YAChG,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,qEAAqE;QACrE,kEAAkE;QAClE,iEAAiE;QACjE,uDAAuD;QACvD,sEAAsE;QACtE,mEAAmE;QACnE,sEAAsE;QACtE,sEAAsE;QACtE,oEAAoE;QACpE,gEAAgE;QAChE,oCAAoC;QACpC,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7B,MAAM,CAAC,OAAO,GAAG,4BAA4B,MAAM,CAAC,MAAM,6DAA6D,CAAC;YACxH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,CAAC;YACH,kEAAkE;YAClE,oEAAoE;YACpE,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,+BAA+B;YAC/B,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,qBAAqB,EAAE,CAAC;YAC9B,MAAM,CAAC,OAAO,GAAG,oBAAoB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACnF,IAAI,aAAa,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,qBAAqB,EAAE,CAAC;YAC9B,MAAM,CAAC,OAAO,GAAG,iCAAiC,aAAa,aAAa,MAAM,CAAC,MAAM,sBAAsB,MAAM,CAAC,WAAW,GAAG,CAAC;YACrI,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,CAAC,MAAM,GAAG,aAAa,CAAC;QAE9B,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,uDAAuD;QACvD,qEAAqE;QACrE,sDAAsD;QACtD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,qBAAqB,EAAE,CAAC;YAC9B,qEAAqE;YACrE,qEAAqE;YACrE,2DAA2D;YAC3D,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;YAC1B,MAAM,CAAC,OAAO;gBACZ,kHAAkH,CAAC;YACrH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,iEAAiE;QACjE,wEAAwE;QACxE,0DAA0D;QAC1D,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC;QAC1D,MAAM,iBAAiB,GAAG,mBAAmB,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,IAAI,sBAAsB,CAAC;QAC/G,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,GAAG,CACP,KAAK,EACL;gBACE,IAAI;gBACJ,0BAA0B;gBAC1B,GAAG,QAAQ,CAAC,aAAa;gBACzB,QAAQ;gBACR,IAAI;gBACJ,WAAW;gBACX,iBAAiB;gBACjB,IAAI;gBACJ,OAAO;aACR,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,iEAAiE;YACjE,uEAAuE;YACvE,gEAAgE;YAChE,kEAAkE;YAClE,6DAA6D;YAC7D,wCAAwC;YACxC,MAAM,qBAAqB,EAAE,CAAC;YAC9B,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;YAC1B,MAAM,CAAC,OAAO,GAAG,kBAAkB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,+DAA+D;QAC/D,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,sEAAsE;YACtE,sEAAsE;YACtE,mEAAmE;YACnE,4DAA4D;YAC5D,oDAAoD;YACpD,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC;gBACzD,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;gBAChE,gEAAgE;gBAChE,kEAAkE;gBAClE,8CAA8C;YAChD,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,2DAA2D;gBAC3D,sDAAsD;gBACtD,mEAAmE;gBACnE,+DAA+D;gBAC/D,sBAAsB;gBACtB,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;gBAC7B,MAAM,qBAAqB,EAAE,CAAC;gBAC9B,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;gBAC1B,MAAM,CAAC,OAAO;oBACZ,+IAA+I,CAAC;YACpJ,CAAC;iBAAM,CAAC;gBACN,kEAAkE;gBAClE,6DAA6D;gBAC7D,gEAAgE;gBAChE,mEAAmE;gBACnE,2BAA2B;gBAC3B,MAAM,CAAC,OAAO;oBACZ,qMAAqM,CAAC;YAC1M,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,iEAAiE;QACjE,sEAAsE;QACtE,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,GAAG,kBAAkB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,qBAAqB,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;QAC1B,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wEAAwE;IACxE,qEAAqE;IACrE,sEAAsE;IACtE,yEAAyE;IACzE,yDAAyD;IACzD,yEAAyE;IACzE,mDAAmD;IACnD,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;IACxB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,EAAE,IAAI,EAAE,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,OAAO,GAA0B;gBACrC,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,MAAM,CAAC,MAAM;gBACvB,YAAY,EAAE,SAAS;aACxB,CAAC;YACF,MAAM,aAAa,GAAG,8BAA8B,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAClF,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CACtF,WAAW,CACZ,CAAC;YACF,MAAM,WAAW,GAAmB,oBAAoB,CAAC,KAAK,CAAC;gBAC7D,OAAO;gBACP,iBAAiB,EAAE,OAAO,CAAC,UAAU;gBACrC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,QAAQ,CAAC,GAAG;gBACtB,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE;aACrC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,8BAA8B,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9E,sEAAsE;YACtE,kDAAkD;YAClD,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;YACjG,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oEAAoE;YACpE,sEAAsE;YACtE,4CAA4C;YAC5C,MAAM,CAAC,OAAO,GAAG,uBAAuB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/dco/git-config.d.ts

@@ -1,47 +0,0 @@
-export declare const HOOK_MARKER = "# mcpi-dco-hook";
-export interface GitIdentity {
-    name: string;
-    email: string;
-}
-export declare function isGitRepo(cwd: string): Promise<boolean>;
-export declare function getGitConfigValue(key: string, cwd: string, scope?: "local" | "global"): Promise<string | null>;
-export declare function setGitConfig(entries: Record<string, string>, options: {
-    cwd: string;
-    global?: boolean;
-}): Promise<void>;
-export interface SigningConflict {
-    key: string;
-    current: string;
-    desired: string;
-}
-/**
- * Detect pre-existing signing configuration that our setup would silently
- * override, e.g. a user who already GPG-signs commits. Only differing values
- * count; matching values mean a previous run and are fine to reapply.
- *
- * `scope` selects which config layer to read: the default (undefined) reads
- * the effective value; "local" reads only repo-local entries, which is how a
- * `--global` write detects repo-local values that would still shadow it.
- */
-export declare function detectSigningConflicts(cwd: string, desired: Record<string, string>, scope?: "local" | "global"): Promise<SigningConflict[]>;
-export interface HooksDirInfo {
-    dir: string;
-    source: "core.hooksPath" | "default";
-}
-export declare function getHooksDir(cwd: string): Promise<HooksDirInfo>;
-export declare function buildTrailerHook(human: GitIdentity, agent: GitIdentity): string;
-export type HookInstallResult = "installed" | "updated" | "unchanged" | "foreign-hook" | "unsafe-hooks-path" | "would-change";
-/**
- * Install (or refresh) the prepare-commit-msg trailer hook. A hook we did not
- * write is never modified, and a core.hooksPath pointing outside the repo is
- * never written to (a crafted repo config must not make us create files at
- * arbitrary locations); the caller falls back to instruction-based trailers
- * in both cases.
- */
-export declare function installTrailerHook(cwd: string, human: GitIdentity, agent: GitIdentity, options?: {
-    dryRun?: boolean;
-}): Promise<{
-    result: HookInstallResult;
-    path: string;
-}>;
-//# sourceMappingURL=git-config.d.ts.map

package/dist/utils/dco/git-config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"git-config.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/git-config.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAUD,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAM7D;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,OAAO,GAAG,QAAQ,GACzB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GACzC,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,KAAK,CAAC,EAAE,OAAO,GAAG,QAAQ,GACzB,OAAO,CAAC,eAAe,EAAE,CAAC,CAS5B;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACtC;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAqBpE;AAMD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,WAAW,GACjB,MAAM,CAwBR;AAED,MAAM,MAAM,iBAAiB,GACzB,WAAW,GACX,SAAS,GACT,WAAW,GACX,cAAc,GACd,mBAAmB,GACnB,cAAc,CAAC;AAEnB;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA8CtD"}