@martinloop/mcp 0.8.6 → 0.8.7

package/dist/vendor/core/rollback.js

@@ -1,6 +1,15 @@
 import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { dirname, relative, resolve } from "node:path";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { DEPENDENCY_AND_BUILD_DIRECTORIES, isInsideDependencyOrBuildDirectory } from "./output-directories.js";
+/** Past this many ignored files, further ignored directories stay collapsed. */
+const MAX_EXPANDED_IGNORED_FILES = 20_000;
+const MAX_IGNORED_SNAPSHOT_BYTES = 64 * 1024 * 1024;
+const ignoredContentSnapshots = new WeakMap();
+/** Git listings of large untracked or ignored trees exceed spawnSync's 1 MiB default. */
+const GIT_LIST_MAX_BUFFER_BYTES = 64 * 1024 * 1024;
 export class RollbackStateUnavailableError extends Error {
     constructor(message) {
         super(message);
@@ -11,7 +20,9 @@ export function listAttemptChangedFilesSinceBoundary(input) {
     if (!input.repoRoot) {
         return [];
     }
-    const repoState = readRepoState(input.repoRoot);
+    // Diff against the boundary commit (not the live HEAD) so that changes an
+    // attempt commits are still reported as attempt changes.
+    const repoState = readRepoState(input.repoRoot, input.boundary?.headRef);
     if (!input.boundary) {
         return uniqueSorted([...repoState.trackedDirtyFiles, ...repoState.untrackedFiles]);
     }
@@ -19,7 +30,10 @@ export function listAttemptChangedFilesSinceBoundary(input) {
     const baselineUntracked = new Set(input.boundary.untrackedFiles);
     return uniqueSorted([
         ...repoState.trackedDirtyFiles.filter((filePath) => !baselineTracked.has(filePath)),
-        ...repoState.untrackedFiles.filter((filePath) => !baselineUntracked.has(filePath))
+        ...repoState.untrackedFiles.filter((filePath) => !baselineUntracked.has(filePath)),
+        ...(input.includeBaselineSnapshotChanges
+            ? snapshotChangedPaths(input.repoRoot, input.boundary.snapshots)
+            : [])
     ]);
 }
 export async function captureRollbackBoundary(input) {
@@ -27,23 +41,70 @@ export async function captureRollbackBoundary(input) {
         return undefined;
     }
     const repoState = readRepoState(input.repoRoot);
+    // Links are recorded by path only: their targets are never read or restored.
     const snapshotPaths = uniqueSorted([
         ...repoState.trackedDirtyFiles,
         ...repoState.untrackedFiles
-    ]);
+    ]).filter((filePath) => !isLinkPath(input.repoRoot, filePath));
     const snapshots = [];
     for (const filePath of snapshotPaths) {
         snapshots.push(await readRollbackSnapshot(input.repoRoot, filePath));
     }
+    const ignoredFiles = readIgnoredInventory(input.repoRoot);
     const headRef = readGitScalar(input.repoRoot, ["rev-parse", "HEAD"]);
-    return {
+    const headBranch = readHeadBranch(input.repoRoot);
+    const boundary = {
         strategy: "git_head_plus_snapshot",
         capturedAt: input.capturedAt,
         ...(headRef ? { headRef } : {}),
+        ...(headBranch ? { headBranch } : {}),
         trackedDirtyFiles: repoState.trackedDirtyFiles,
         untrackedFiles: repoState.untrackedFiles,
-        snapshots
+        snapshots,
+        ignoredFiles
     };
+    ignoredContentSnapshots.set(boundary, captureIgnoredContent(input.repoRoot, ignoredFiles));
+    return boundary;
+}
+/**
+ * Git-ignored files the attempt created or modified since the boundary.
+ * Boundaries recorded before the ignored inventory existed report nothing.
+ */
+export function listIgnoredFileChangesSinceBoundary(input) {
+    if (!input.repoRoot || !input.boundary?.ignoredFiles) {
+        return makeIgnoredFileChanges([], [], []);
+    }
+    const baseline = new Map(input.boundary.ignoredFiles.map((entry) => [entry.path, entry]));
+    const created = [];
+    const modified = [];
+    const currentEntries = readIgnoredInventory(input.repoRoot);
+    const current = new Map(currentEntries.map((entry) => [entry.path, entry]));
+    const deleted = input.boundary.ignoredFiles
+        .filter((entry) => !current.has(entry.path))
+        .map((entry) => entry.path);
+    for (const entry of currentEntries) {
+        const previous = baseline.get(entry.path);
+        if (!previous) {
+            created.push(entry.path);
+        }
+        else if (!entry.path.endsWith("/") &&
+            (previous.sha256 !== undefined && entry.sha256 !== undefined
+                ? previous.sha256 !== entry.sha256
+                : previous.size !== entry.size || previous.mtimeMs !== entry.mtimeMs)) {
+            modified.push(entry.path);
+        }
+    }
+    return makeIgnoredFileChanges(created.sort(), modified.sort(), deleted.sort());
+}
+function makeIgnoredFileChanges(created, modified, deleted) {
+    const changes = { created, modified };
+    // Preserve the historical enumerable shape when there are no deletions while
+    // still exposing deletion evidence to current callers.
+    Object.defineProperty(changes, "deleted", {
+        value: deleted,
+        enumerable: deleted.length > 0
+    });
+    return changes;
 }
 export async function restoreRollbackBoundary(input) {
     if (!input.repoRoot) {
@@ -62,8 +123,17 @@ export async function restoreRollbackBoundary(input) {
             error: "Rollback boundary was unavailable for this attempt."
         };
     }
-    const before = readRepoState(input.repoRoot);
-    if (repoStateMatchesBoundary(before, input.boundary)) {
+    const before = readRepoState(input.repoRoot, input.boundary.headRef);
+    const currentHead = readGitScalar(input.repoRoot, ["rev-parse", "HEAD"]);
+    const headMoved = input.boundary.headRef !== undefined && currentHead !== input.boundary.headRef;
+    const removePaths = uniqueSorted(input.removePaths ?? []);
+    const restoreIgnoredPaths = uniqueSorted(input.restoreIgnoredPaths ?? []);
+    const snapshotsUnchanged = await rollbackSnapshotsMatch(input.repoRoot, input.boundary.snapshots);
+    if (!headMoved &&
+        removePaths.length === 0 &&
+        restoreIgnoredPaths.length === 0 &&
+        repoStateMatchesBoundary(before, input.boundary) &&
+        snapshotsUnchanged) {
         return {
             attempted: false,
             status: "not_required",
@@ -77,13 +147,25 @@ export async function restoreRollbackBoundary(input) {
     }
     const restoredFiles = new Set();
     const deletedFiles = new Set();
+    let rewoundHead;
     try {
+        if (headMoved && input.boundary.headRef && currentHead) {
+            rewindAttemptCommits(input.repoRoot, input.boundary, currentHead);
+            rewoundHead = { from: currentHead, to: input.boundary.headRef };
+        }
         const baselineTracked = new Set(input.boundary.trackedDirtyFiles);
         const baselineUntracked = new Set(input.boundary.untrackedFiles);
         for (const filePath of before.trackedDirtyFiles) {
             if (!baselineTracked.has(filePath)) {
-                restoreTrackedFileFromHead(input.repoRoot, filePath);
-                restoredFiles.add(filePath);
+                if (existsInHead(input.repoRoot, filePath)) {
+                    restoreTrackedFileFromHead(input.repoRoot, filePath);
+                    restoredFiles.add(filePath);
+                }
+                else {
+                    unstagePath(input.repoRoot, filePath);
+                    await removeRepoPath(input.repoRoot, filePath);
+                    deletedFiles.add(filePath);
+                }
             }
         }
         for (const filePath of before.untrackedFiles) {
@@ -101,8 +183,26 @@ export async function restoreRollbackBoundary(input) {
                 deletedFiles.add(snapshot.path);
             }
         }
-        const after = readRepoState(input.repoRoot);
-        const restored = repoStateMatchesBoundary(after, input.boundary);
+        for (const filePath of removePaths) {
+            await removeRepoPath(input.repoRoot, filePath);
+            deletedFiles.add(filePath);
+        }
+        const ignoredSnapshots = ignoredContentSnapshots.get(input.boundary);
+        for (const filePath of restoreIgnoredPaths) {
+            const contents = ignoredSnapshots?.get(filePath);
+            if (!contents) {
+                throw new Error(`Ignored-file rollback snapshot is unavailable for ${filePath}`);
+            }
+            const absolutePath = resolveRepoPath(input.repoRoot, filePath);
+            await mkdir(dirname(absolutePath), { recursive: true });
+            resolveRepoPath(input.repoRoot, filePath);
+            await writeFile(absolutePath, contents);
+            restoredFiles.add(filePath);
+        }
+        const after = readRepoState(input.repoRoot, input.boundary.headRef);
+        const restored = repoStateMatchesBoundary(after, input.boundary) &&
+            (input.boundary.headRef === undefined ||
+                readGitScalar(input.repoRoot, ["rev-parse", "HEAD"]) === input.boundary.headRef);
         return {
             attempted: true,
             status: restored ? "restored" : "failed",
@@ -112,13 +212,14 @@ export async function restoreRollbackBoundary(input) {
             after,
             restoredFiles: [...restoredFiles].sort(),
             deletedFiles: [...deletedFiles].sort(),
+            ...(rewoundHead ? { rewoundHead } : {}),
             ...(restored
                 ? {}
                 : { error: "Repo state still diverged from the recorded rollback boundary after restore." })
         };
     }
     catch (error) {
-        const after = readRepoState(input.repoRoot);
+        const after = readRepoState(input.repoRoot, input.boundary.headRef);
         return {
             attempted: true,
             status: "failed",
@@ -132,18 +233,225 @@ export async function restoreRollbackBoundary(input) {
         };
     }
 }
-function readRepoState(repoRoot) {
+function readRepoState(repoRoot, baseRef = "HEAD") {
     return {
-        trackedDirtyFiles: readGitLines(repoRoot, ["diff", "--name-only", "HEAD", "--", "."]),
-        untrackedFiles: readGitLines(repoRoot, ["ls-files", "--others", "--exclude-standard", "--", "."])
+        trackedDirtyFiles: readGitLines(repoRoot, ["diff", "--name-only", baseRef, "--", "."]),
+        // Git for Windows lists untracked files *through* junctions, so a link to a
+        // directory outside the repo would otherwise surface that directory's files as
+        // repo paths. Collapse every such path to the link itself.
+        untrackedFiles: collapsePathsThroughLinks(repoRoot, readGitLines(repoRoot, ["ls-files", "--others", "--exclude-standard", "--", "."]))
     };
 }
+/**
+ * Repo-relative links (symlinks or junctions) among `paths` whose target
+ * resolves outside the repository. Paths are first collapsed to the link.
+ */
+export function findEscapingLinks(repoRoot, paths) {
+    const realRoot = realpathSync.native(resolve(repoRoot));
+    return collapsePathsThroughLinks(repoRoot, paths).filter((filePath) => {
+        if (!isLinkPath(repoRoot, filePath)) {
+            return false;
+        }
+        try {
+            const target = realpathSync.native(resolve(repoRoot, filePath));
+            const fromRoot = relative(realRoot, target);
+            return fromRoot === ".." || fromRoot.startsWith("../") || fromRoot.startsWith("..\\") || isAbsolute(fromRoot);
+        }
+        catch {
+            // A dangling link cannot be proven to stay inside the repository.
+            return true;
+        }
+    });
+}
+function collapsePathsThroughLinks(repoRoot, paths) {
+    const linkCache = new Map();
+    const collapsed = paths.map((filePath) => {
+        const segments = normalizeRepoPath(filePath).replace(/\/$/u, "").split("/").filter(Boolean);
+        for (let index = 1; index <= segments.length; index++) {
+            const prefix = segments.slice(0, index).join("/");
+            let isLink = linkCache.get(prefix);
+            if (isLink === undefined) {
+                isLink = isLinkPath(repoRoot, prefix);
+                linkCache.set(prefix, isLink);
+            }
+            if (isLink) {
+                return prefix;
+            }
+        }
+        return filePath;
+    });
+    return uniqueSorted(collapsed);
+}
+function isLinkPath(repoRoot, filePath) {
+    try {
+        return lstatSync(resolve(repoRoot, filePath)).isSymbolicLink();
+    }
+    catch (error) {
+        if (isFileNotFoundError(error))
+            return false;
+        throw new RollbackStateUnavailableError(`Unable to authenticate rollback path ${normalizeRepoPath(filePath)}: ${toErrorMessage(error)}`);
+    }
+}
+/** Throws when any directory between the repo root and `filePath` is a link. */
+function assertNoIntermediateLink(repoRoot, filePath) {
+    const segments = normalizeRepoPath(filePath).split("/").filter(Boolean);
+    for (let index = 1; index < segments.length; index++) {
+        const prefix = segments.slice(0, index).join("/");
+        if (isLinkPath(repoRoot, prefix)) {
+            throw new Error(`Refusing to access a rollback path through a link: ${filePath} (via ${prefix})`);
+        }
+    }
+}
+/**
+ * Moves the boundary branch back to the boundary commit, keeping the attempt's
+ * committed content in the index so the normal restore pass can undo it.
+ */
+function rewindAttemptCommits(repoRoot, boundary, currentHead) {
+    const currentBranch = readHeadBranch(repoRoot);
+    if (currentBranch !== boundary.headBranch) {
+        throw new Error(`Attempt switched HEAD from ${boundary.headBranch ?? "a detached HEAD"} to ` +
+            `${currentBranch ?? "a detached HEAD"} (now ${currentHead}); restore ${String(boundary.headRef)} manually.`);
+    }
+    const result = spawnSync("git", ["reset", "--soft", String(boundary.headRef)], {
+        cwd: repoRoot,
+        encoding: "utf8"
+    });
+    if (result.status !== 0) {
+        throw new Error(`git reset --soft ${String(boundary.headRef)} failed: ${gitFailureMessage(result)}`);
+    }
+}
+function readHeadBranch(repoRoot) {
+    const result = spawnSync("git", ["symbolic-ref", "-q", "HEAD"], {
+        cwd: repoRoot,
+        encoding: "utf8"
+    });
+    const value = result.status === 0 && typeof result.stdout === "string" ? result.stdout.trim() : "";
+    return value.length > 0 ? value : undefined;
+}
+function existsInHead(repoRoot, filePath) {
+    resolveRepoPath(repoRoot, filePath, { allowLeafLink: true });
+    return spawnSync("git", ["cat-file", "-e", `HEAD:${filePath}`], { cwd: repoRoot }).status === 0;
+}
+function unstagePath(repoRoot, filePath) {
+    resolveRepoPath(repoRoot, filePath, { allowLeafLink: true });
+    const result = spawnSync("git", ["rm", "--cached", "-r", "-q", "-f", "--ignore-unmatch", "--", filePath], { cwd: repoRoot, encoding: "utf8" });
+    if (result.status !== 0) {
+        throw new Error(`git rm --cached failed for ${filePath}: ${gitFailureMessage(result)}`);
+    }
+}
+function readIgnoredInventory(repoRoot) {
+    const collapsed = collapsePathsThroughLinks(repoRoot, readGitLines(repoRoot, [
+        "ls-files", "--others", "--ignored", "--exclude-standard", "--directory", "--", "."
+    ]));
+    const inventory = [];
+    let expanded = 0;
+    for (const entry of collapsed) {
+        const isDirectory = entry.endsWith("/");
+        const leaf = entry.replace(/\/$/u, "").split("/").at(-1) ?? entry;
+        if (isDirectory &&
+            (DEPENDENCY_AND_BUILD_DIRECTORIES.has(leaf) || expanded >= MAX_EXPANDED_IGNORED_FILES)) {
+            inventory.push({ path: entry, size: 0, mtimeMs: 0 });
+            continue;
+        }
+        const files = isDirectory
+            ? collapsePathsThroughLinks(repoRoot, readGitLines(repoRoot, ["ls-files", "--others", "--ignored", "--exclude-standard", "--", entry]))
+            : [entry];
+        for (const filePath of files) {
+            inventory.push(stampIgnoredFile(repoRoot, filePath));
+            expanded += 1;
+        }
+    }
+    return inventory.sort((left, right) => left.path.localeCompare(right.path));
+}
+function stampIgnoredFile(repoRoot, filePath) {
+    try {
+        const absolutePath = resolveRepoPath(repoRoot, filePath, { allowLeafLink: true });
+        const link = isLinkPath(repoRoot, filePath);
+        const stats = link ? lstatSync(absolutePath) : statSync(absolutePath);
+        const stamp = {
+            path: normalizeRepoPath(filePath),
+            size: stats.size,
+            mtimeMs: Math.trunc(stats.mtimeMs)
+        };
+        if (!link && stats.isFile() && !isInsideDependencyOrBuildDirectory(filePath)) {
+            stamp.sha256 = createHash("sha256").update(readFileSync(absolutePath)).digest("hex");
+        }
+        return stamp;
+    }
+    catch (error) {
+        if (!isFileNotFoundError(error)) {
+            throw new RollbackStateUnavailableError(`Unable to authenticate ignored rollback path ${normalizeRepoPath(filePath)}: ${toErrorMessage(error)}`);
+        }
+        // Vanished between listing and stat; record presence only so later comparison fails closed.
+        return { path: normalizeRepoPath(filePath), size: -1, mtimeMs: -1 };
+    }
+}
+function captureIgnoredContent(repoRoot, ignoredFiles) {
+    const snapshots = new Map();
+    let capturedBytes = 0;
+    for (const entry of ignoredFiles) {
+        if (entry.path.endsWith("/") ||
+            isInsideDependencyOrBuildDirectory(entry.path) ||
+            isLinkPath(repoRoot, entry.path)) {
+            continue;
+        }
+        const absolutePath = resolveRepoPath(repoRoot, entry.path);
+        if (entry.size < 0 || capturedBytes + entry.size > MAX_IGNORED_SNAPSHOT_BYTES) {
+            continue;
+        }
+        try {
+            const contents = readFileSync(absolutePath);
+            capturedBytes += contents.byteLength;
+            snapshots.set(entry.path, contents);
+        }
+        catch (error) {
+            if (!isFileNotFoundError(error)) {
+                throw new RollbackStateUnavailableError(`Ignored rollback snapshot unavailable for ${entry.path}: ${toErrorMessage(error)}`);
+            }
+        }
+    }
+    return snapshots;
+}
+function snapshotChangedPaths(repoRoot, snapshots) {
+    const changed = [];
+    for (const snapshot of snapshots) {
+        try {
+            const absolutePath = resolveRepoPath(repoRoot, snapshot.path);
+            if (!snapshot.existed || !snapshot.contentBase64) {
+                try {
+                    readFileSync(absolutePath);
+                    changed.push(snapshot.path);
+                }
+                catch (error) {
+                    if (!isFileNotFoundError(error))
+                        throw error;
+                }
+                continue;
+            }
+            const current = readFileSync(absolutePath);
+            if (!current.equals(Buffer.from(snapshot.contentBase64, "base64"))) {
+                changed.push(snapshot.path);
+            }
+        }
+        catch (error) {
+            // A missing file or link swap is still an attempt change. It must flow to
+            // the leash and rollback path, which will authenticate before mutation.
+            if (isFileNotFoundError(error) || error instanceof RollbackStateUnavailableError || error instanceof Error) {
+                changed.push(snapshot.path);
+                continue;
+            }
+            throw error;
+        }
+    }
+    return uniqueSorted(changed);
+}
 function readGitLines(repoRoot, args) {
     let lastFailure = "unknown Git failure";
     for (let attempt = 0; attempt < 2; attempt++) {
         const result = spawnSync("git", args, {
             cwd: repoRoot,
-            encoding: "utf8"
+            encoding: "utf8",
+            maxBuffer: GIT_LIST_MAX_BUFFER_BYTES
         });
         if (result.status === 0 && typeof result.stdout === "string") {
             return uniqueSorted(result.stdout
@@ -193,16 +501,50 @@ async function readRollbackSnapshot(repoRoot, filePath) {
         };
     }
 }
+async function rollbackSnapshotsMatch(repoRoot, snapshots) {
+    for (const snapshot of snapshots) {
+        try {
+            const absolutePath = resolveRepoPath(repoRoot, snapshot.path);
+            if (!snapshot.existed) {
+                try {
+                    await readFile(absolutePath);
+                    return false;
+                }
+                catch (error) {
+                    if (!isFileNotFoundError(error))
+                        return false;
+                }
+                continue;
+            }
+            if (!snapshot.contentBase64)
+                return false;
+            const current = await readFile(absolutePath);
+            if (!current.equals(Buffer.from(snapshot.contentBase64, "base64")))
+                return false;
+        }
+        catch {
+            // A link swap, inaccessible path, or vanished baseline means the boundary
+            // cannot be declared unchanged; the restore path will fail closed.
+            return false;
+        }
+    }
+    return true;
+}
 async function restoreRollbackSnapshot(repoRoot, snapshot) {
     const absolutePath = resolveRepoPath(repoRoot, snapshot.path);
     if (!snapshot.existed || !snapshot.contentBase64) {
+        resolveRepoPath(repoRoot, snapshot.path);
         await rm(absolutePath, { recursive: true, force: true });
         return;
     }
     await mkdir(dirname(absolutePath), { recursive: true });
+    resolveRepoPath(repoRoot, snapshot.path);
     await writeFile(absolutePath, Buffer.from(snapshot.contentBase64, "base64"));
 }
 function restoreTrackedFileFromHead(repoRoot, filePath) {
+    // Git must never receive a path that crosses a link. A tracked symlink may
+    // itself be the leaf, because Git replaces the link rather than traversing it.
+    resolveRepoPath(repoRoot, filePath, { allowLeafLink: true });
     const result = spawnSync("git", ["restore", "--staged", "--worktree", "--source=HEAD", "--", filePath], {
         cwd: repoRoot,
         encoding: "utf8"
@@ -225,15 +567,26 @@ function restoreTrackedFileFromHead(repoRoot, filePath) {
         `git restore failed for ${filePath} (retry and checkout fallback also failed)`);
 }
 async function removeRepoPath(repoRoot, filePath) {
-    await rm(resolveRepoPath(repoRoot, filePath), { recursive: true, force: true });
+    const absolutePath = resolveRepoPath(repoRoot, filePath, { allowLeafLink: true });
+    if (isLinkPath(repoRoot, filePath)) {
+        // Remove the link itself; never descend into whatever it points at.
+        await rm(absolutePath, { force: true });
+        return;
+    }
+    resolveRepoPath(repoRoot, filePath);
+    await rm(absolutePath, { recursive: true, force: true });
 }
-function resolveRepoPath(repoRoot, filePath) {
+function resolveRepoPath(repoRoot, filePath, options = {}) {
     const resolvedRoot = resolve(repoRoot);
     const resolvedPath = resolve(resolvedRoot, filePath);
     const relativePath = relative(resolvedRoot, resolvedPath);
     if (relativePath.startsWith("..") || relativePath === "") {
         throw new Error(`Refusing to access a rollback path outside repo root: ${filePath}`);
     }
+    assertNoIntermediateLink(resolvedRoot, relativePath);
+    if (!options.allowLeafLink && isLinkPath(resolvedRoot, relativePath)) {
+        throw new Error(`Refusing to access a rollback path that is a link: ${filePath}`);
+    }
     return resolvedPath;
 }
 function repoStateMatchesBoundary(state, boundary) {

package/dist/vendor/core/test-integrity.d.ts

@@ -62,3 +62,21 @@ export declare function importsPreExistingCode(testContent: string, preRunSource
  * Validate the integrity of tests created during a governed run.
  */
 export declare function validateTestIntegrity(rootDir: string, preRunTestSnapshot: Set<string>, preRunSourceFiles: Set<string>): TestIntegrityReport;
+/**
+ * Repo-relative path check for test sources, covering JS/TS naming, test
+ * directories at any depth (including the repo root), Python, and Go.
+ */
+export declare function isTestPath(filePath: string): boolean;
+/**
+ * Existing test files whose assertions the attempt removed or altered, whose cases it
+ * dropped or skipped, or which it deleted, compared with the boundary commit. New test
+ * files, appended cases, and edits to imports, setup or formatting are not reported.
+ * Files with no recognizable test surface (data, golden and snapshot files, unknown
+ * frameworks) fall back to the strict rule: any removed line counts. Changes committed
+ * by the attempt are included because the comparison is against `baseRef`, not HEAD.
+ */
+export declare function findWeakenedTestFiles(input: {
+    repoRoot: string;
+    baseRef: string;
+    changedFiles: string[];
+}): string[];

package/dist/vendor/core/test-integrity.js

@@ -16,8 +16,10 @@
  * This module provides the analysis primitives. The verification pipeline
  * calls these during the post-run verification step.
  */
-import { readFileSync, readdirSync, existsSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { lstatSync, readFileSync, readdirSync, existsSync } from "node:fs";
 import { join, relative } from "node:path";
+import { extractTestSurface, hasTestSurface, testSurfaceWeakened } from "./test-surface.js";
 const TEST_FILE_PATTERNS = [
     /\.test\.[tj]sx?$/,
     /\.spec\.[tj]sx?$/,
@@ -195,3 +197,91 @@ export function validateTestIntegrity(rootDir, preRunTestSnapshot, preRunSourceF
         summary
     };
 }
+const TEST_PATH_PATTERNS = [
+    /\.(?:test|spec)\.[cm]?[jt]sx?$/u,
+    /(?:^|\/)(?:__tests__|tests?)\//u,
+    /(?:^|\/)test_[^/]+\.py$/u,
+    /_test\.(?:py|go)$/u
+];
+/**
+ * Repo-relative path check for test sources, covering JS/TS naming, test
+ * directories at any depth (including the repo root), Python, and Go.
+ */
+export function isTestPath(filePath) {
+    const normalized = filePath.replace(/\\/gu, "/").replace(/^\.\//u, "");
+    return TEST_PATH_PATTERNS.some((pattern) => pattern.test(normalized));
+}
+/**
+ * Existing test files whose assertions the attempt removed or altered, whose cases it
+ * dropped or skipped, or which it deleted, compared with the boundary commit. New test
+ * files, appended cases, and edits to imports, setup or formatting are not reported.
+ * Files with no recognizable test surface (data, golden and snapshot files, unknown
+ * frameworks) fall back to the strict rule: any removed line counts. Changes committed
+ * by the attempt are included because the comparison is against `baseRef`, not HEAD.
+ */
+export function findWeakenedTestFiles(input) {
+    const candidates = [...new Set(input.changedFiles.map((file) => file.replace(/\\/gu, "/")))]
+        .filter(isTestPath)
+        .sort();
+    if (candidates.length === 0) {
+        return [];
+    }
+    const removedLines = listFilesWithRemovedLines(input.repoRoot, input.baseRef, candidates);
+    return [...removedLines].filter((filePath) => isWeakened(input, filePath)).sort();
+}
+/** Files among `candidates` that lost at least one line (or are binary) since `baseRef`. */
+function listFilesWithRemovedLines(repoRoot, baseRef, candidates) {
+    const result = spawnSync("git", ["diff", "--numstat", "--no-renames", "-z", baseRef, "--", ...candidates], { cwd: repoRoot, encoding: "utf8", maxBuffer: 16 * 1024 * 1024 });
+    if (result.status !== 0 || typeof result.stdout !== "string") {
+        const detail = typeof result.stderr === "string" ? result.stderr.trim() : "";
+        throw new Error(`Test-change inspection failed: ${detail || `git exited with ${String(result.status)}`}`);
+    }
+    const removed = new Set();
+    for (const record of result.stdout.split("\0")) {
+        const [, deletions, filePath] = record.split("\t");
+        if (filePath && deletions !== undefined && (deletions === "-" || Number(deletions) > 0)) {
+            removed.add(filePath.trim());
+        }
+    }
+    return removed;
+}
+/** Cap on file size the surface analysis reads; larger files use the strict rule. */
+const MAX_SURFACE_BYTES = 2 * 1024 * 1024;
+function isWeakened(input, filePath) {
+    const before = readBaseContent(input.repoRoot, input.baseRef, filePath);
+    if (before === undefined) {
+        return true;
+    }
+    const after = readWorkingContent(input.repoRoot, filePath);
+    if (after === undefined) {
+        // Deleted, replaced by a link, unreadable or oversized: cannot prove it still asserts.
+        return true;
+    }
+    if (!hasTestSurface(extractTestSurface(before, filePath))) {
+        return true;
+    }
+    return testSurfaceWeakened(before, after, filePath);
+}
+function readBaseContent(repoRoot, baseRef, filePath) {
+    const result = spawnSync("git", ["show", `${baseRef}:${filePath}`], {
+        cwd: repoRoot,
+        encoding: "utf8",
+        maxBuffer: MAX_SURFACE_BYTES * 2
+    });
+    return result.status === 0 && typeof result.stdout === "string" && result.stdout.length <= MAX_SURFACE_BYTES
+        ? result.stdout
+        : undefined;
+}
+function readWorkingContent(repoRoot, filePath) {
+    const absolutePath = join(repoRoot, filePath);
+    try {
+        const stats = lstatSync(absolutePath);
+        if (!stats.isFile() || stats.size > MAX_SURFACE_BYTES) {
+            return undefined;
+        }
+        return readFileSync(absolutePath, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/vendor/core/test-surface.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Test surface: what a test file asserts, how many cases it declares and how many it skips.
+ *
+ * Weakening is judged on this surface rather than on raw removed lines, so ordinary edits
+ * (growing an import list, reformatting, appending cases) are allowed while a removed or
+ * altered assertion, a dropped case or a newly skipped case is not.
+ *
+ * The extractor is language-agnostic and heuristic. It is comment- and string-aware so a
+ * commented-out assertion does not count as present. Files with no recognizable surface
+ * (data, golden and snapshot files, unknown frameworks) are reported as empty so callers
+ * can fall back to a stricter rule.
+ */
+export interface TestSurface {
+    /** Whitespace-normalized assertion expressions, in source order. */
+    assertions: string[];
+    /** Declared test cases. */
+    cases: number;
+    /** Skip, todo or disable markers. */
+    skips: number;
+}
+export declare function hasTestSurface(surface: TestSurface): boolean;
+export declare function extractTestSurface(content: string, path?: string): TestSurface;
+/**
+ * True when `after` removes or alters an assertion, declares fewer cases, or skips more
+ * cases than `before`. Added assertions and cases never count as weakening.
+ */
+export declare function testSurfaceWeakened(before: string, after: string, path?: string): boolean;