@miller-tech/uap 2.1.6 → 2.11.0

package/dist/review/prepass.js

@@ -0,0 +1,428 @@
+/**
+ * DETERMINISTIC REVIEW PRE-PASS (uplift 0.2)
+ *
+ * A ruleset scanner that runs BEFORE the LLM reviewers in the parallel
+ * review protocol (open-code-review precedent: deterministic pipelines first,
+ * LLM second). Reviewers receive pre-filtered, line-anchored findings so
+ * their tokens go to judgment, not pattern-matching.
+ *
+ * Design stance: precision over recall. Every rule here fires on a pattern
+ * that is almost always worth a human/reviewer glance; ambiguous heuristics
+ * belong to the LLM reviewers, not to this pass. Findings are advisory input
+ * to review — the blocking behavior stays in the expert-review enforcer,
+ * which is unchanged.
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'fs';
+import { execFileSync } from 'child_process';
+import { join } from 'path';
+/** git invocation without a shell — this module must pass its own scanner. */
+function git(dir, args) {
+    try {
+        return execFileSync('git', args, { cwd: dir, encoding: 'utf-8', timeout: 10_000 }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+const CODE_EXTENSIONS = new Set(['.ts', '.tsx', '.mts', '.js', '.mjs', '.cjs', '.jsx', '.py']);
+/**
+ * Line-anchored rules. Keep each one boringly precise — a finding that cries
+ * wolf trains reviewers to ignore the whole pass.
+ */
+export const LINE_RULES = [
+    {
+        name: 'aws-access-key',
+        category: 'secrets',
+        severity: 'high',
+        pattern: /\bAKIA[0-9A-Z]{16}\b/,
+        message: 'hardcoded AWS access key id',
+    },
+    {
+        name: 'github-token',
+        category: 'secrets',
+        severity: 'high',
+        pattern: /\b(?:gh[posur]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{22,})\b/,
+        message: 'hardcoded GitHub token',
+    },
+    {
+        name: 'slack-token',
+        category: 'secrets',
+        severity: 'high',
+        pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/,
+        message: 'hardcoded Slack token',
+    },
+    {
+        name: 'llm-api-key',
+        category: 'secrets',
+        severity: 'high',
+        pattern: /\bsk-(?:ant-)?[A-Za-z0-9_-]{20,}\b/,
+        message: 'hardcoded LLM provider API key',
+    },
+    {
+        name: 'npm-token',
+        category: 'secrets',
+        severity: 'high',
+        pattern: /\bnpm_[A-Za-z0-9]{20,}\b/,
+        message: 'hardcoded npm token',
+    },
+    {
+        name: 'jwt-token',
+        category: 'secrets',
+        severity: 'high',
+        pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}\b/,
+        message: 'hardcoded JWT',
+    },
+    {
+        name: 'private-key-block',
+        category: 'secrets',
+        severity: 'high',
+        pattern: /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/,
+        message: 'private key material committed to source',
+    },
+    {
+        name: 'hardcoded-secret',
+        category: 'secrets',
+        severity: 'high',
+        // assignment of a quoted literal (>=8 chars) to a secret-named variable
+        pattern: /\b(?:password|passwd|secret|api[_-]?key|auth[_-]?token)\b\s*[:=]\s*['"][^'"\n]{8,}['"]/i,
+        message: 'secret-looking value assigned as a string literal',
+    },
+    {
+        name: 'eval-call',
+        category: 'injection',
+        severity: 'high',
+        pattern: /(?<![\w.])eval\s*\(/,
+        // Message deliberately avoids the literal trigger text so this scanner's
+        // own source survives its own dogfood scan.
+        message: 'dynamic string execution (eval-family) — injection surface',
+        codeOnly: true,
+    },
+    {
+        name: 'new-function',
+        category: 'injection',
+        severity: 'high',
+        pattern: /new\s+Function\s*\(/,
+        message: 'dynamic code construction via the Function constructor',
+        codeOnly: true,
+    },
+    {
+        name: 'exec-interpolated',
+        category: 'injection',
+        severity: 'high',
+        pattern: /\bexec(?:Sync)?\s*\(\s*`[^`]*\$\{/,
+        message: 'child_process exec with an interpolated template string (shell injection)',
+        codeOnly: true,
+    },
+    {
+        name: 'exec-concat',
+        category: 'injection',
+        severity: 'high',
+        pattern: /\bexec(?:Sync)?\s*\(\s*['"][^'"]*['"]\s*\+/,
+        message: 'child_process exec with string concatenation (shell injection)',
+        codeOnly: true,
+    },
+    {
+        name: 'shell-true',
+        category: 'injection',
+        severity: 'medium',
+        pattern: /\bshell\s*[:=]\s*(?:True|true)\b/,
+        message: 'command routed through a shell (shell flag) — injection surface',
+        codeOnly: true,
+    },
+    {
+        name: 'sql-template-interpolation',
+        category: 'sql',
+        severity: 'high',
+        pattern: /`\s*(?:SELECT|INSERT\s+INTO|UPDATE\s|DELETE\s+FROM)\b[^`]*\$\{/i,
+        message: 'SQL built by template interpolation — use parameterized queries',
+        codeOnly: true,
+    },
+    {
+        name: 'sql-string-concat',
+        category: 'sql',
+        severity: 'medium',
+        pattern: /['"]\s*(?:SELECT|INSERT\s+INTO|UPDATE\s|DELETE\s+FROM)\b[^'"\n]*['"]\s*\+/i,
+        message: 'SQL built by string concatenation — use parameterized queries',
+        codeOnly: true,
+    },
+    {
+        name: 'innerhtml-assign',
+        category: 'injection',
+        severity: 'medium',
+        pattern: /\.innerHTML\s*=(?!=)/,
+        message: 'innerHTML assignment — XSS surface unless the value is sanitized',
+        codeOnly: true,
+    },
+    {
+        // \w* so this rule's own definition line does not match itself
+        name: 'dangerously-set-innerhtml',
+        category: 'injection',
+        severity: 'medium',
+        pattern: /dangerously\w*InnerHTML/,
+        message: 'React raw-HTML injection prop — XSS surface unless sanitized',
+        codeOnly: true,
+    },
+    {
+        name: 'document-write',
+        category: 'injection',
+        severity: 'medium',
+        pattern: /\bdocument\.write\s*\(/,
+        message: 'document.write — XSS and parser-blocking surface',
+        codeOnly: true,
+    },
+    {
+        name: 'insert-adjacent-html',
+        category: 'injection',
+        severity: 'medium',
+        pattern: /\.insertAdjacentHTML\s*\(/,
+        message: 'insertAdjacentHTML — XSS surface unless the value is sanitized',
+        codeOnly: true,
+    },
+    {
+        name: 'cors-wildcard',
+        category: 'injection',
+        severity: 'medium',
+        pattern: /Access-Control-Allow-Origin['"]?\s*[:,]\s*['"]?\*/,
+        message: 'CORS wildcard origin — verify this endpoint serves no private data',
+    },
+    {
+        name: 'cors-origin-wildcard',
+        category: 'injection',
+        severity: 'medium',
+        pattern: /\borigin\s*:\s*['"]\*['"]/,
+        // Message avoids the literal trigger text (dogfood-clean, like the others)
+        message: 'CORS wildcard via middleware options — verify no private data is served',
+        codeOnly: true,
+    },
+];
+const MAX_SNIPPET_LEN = 120;
+/**
+ * Redact secret material from a finding snippet. The artifact's purpose is to
+ * be pasted into LLM reviewer prompts — a secrets scanner must not multiply
+ * copies of what it detects. The file:line anchor is enough for a reviewer
+ * to inspect the secret in place.
+ */
+export function redactSecrets(snippet) {
+    return snippet
+        .replace(/(['"])[^'"\n]{4,}\1/g, '$1***redacted***$1')
+        .replace(/\b(?:AKIA[0-9A-Z]{4}[0-9A-Z]{12}|gh[posur]_[A-Za-z0-9]{8,}|github_pat_[A-Za-z0-9_]{8,}|xox[baprs]-[A-Za-z0-9-]{4,}|sk-(?:ant-)?[A-Za-z0-9_-]{8,}|npm_[A-Za-z0-9]{8,}|eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{3,})\b/g, '***redacted***');
+}
+function fileExtension(file) {
+    const base = file.split('/').pop() ?? '';
+    const dot = base.lastIndexOf('.');
+    return dot >= 0 ? base.slice(dot) : '';
+}
+/** Scan one file's content. `file` is the repo-relative path used in findings. */
+export function scanFileContent(file, content) {
+    const ext = fileExtension(file);
+    const isCode = CODE_EXTENSIONS.has(ext);
+    const findings = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const text = lines[i];
+        for (const rule of LINE_RULES) {
+            if (rule.codeOnly && !isCode)
+                continue;
+            if (rule.pattern.test(text)) {
+                const snippet = text.trim().slice(0, MAX_SNIPPET_LEN);
+                findings.push({
+                    rule: rule.name,
+                    category: rule.category,
+                    severity: rule.severity,
+                    file,
+                    line: i + 1,
+                    snippet: rule.category === 'secrets' ? redactSecrets(snippet) : snippet,
+                    message: rule.message,
+                });
+            }
+        }
+    }
+    findings.push(...scanEmptyCatches(file, content, isCode));
+    findings.push(...scanPythonErrorSwallowing(file, lines, isCode));
+    findings.push(...scanConcurrencySmells(file, content, isCode));
+    return findings;
+}
+/**
+ * Whole-content pass for empty catch blocks — a per-line rule can never see
+ * the idiomatic multi-line form (`} catch (e) {` newline `}`), which is also
+ * the easiest way to deliberately evade the gate.
+ */
+function scanEmptyCatches(file, content, isCode) {
+    if (!isCode || file.endsWith('.py'))
+        return [];
+    const findings = [];
+    const pattern = /\bcatch\s*(?:\([^)]*\))?\s*\{\s*\}/g;
+    for (let match = pattern.exec(content); match !== null; match = pattern.exec(content)) {
+        const line = content.slice(0, match.index).split('\n').length;
+        findings.push({
+            rule: 'empty-catch',
+            category: 'error-handling',
+            severity: 'medium',
+            file,
+            line,
+            snippet: match[0].replace(/\s+/g, ' ').slice(0, MAX_SNIPPET_LEN),
+            message: 'empty catch swallows the error with no trace',
+        });
+    }
+    return findings;
+}
+/** Python `except: ... pass` pairs — a two-line pattern the line rules can't see. */
+function scanPythonErrorSwallowing(file, lines, isCode) {
+    if (!isCode || !file.endsWith('.py'))
+        return [];
+    const findings = [];
+    for (let i = 0; i < lines.length; i++) {
+        // single-line form: except ...: pass
+        if (/^\s*except\b[^:\n]*:\s*(?:pass|\.\.\.)\s*(?:#.*)?$/.test(lines[i])) {
+            findings.push({
+                rule: 'except-pass',
+                category: 'error-handling',
+                severity: 'medium',
+                file,
+                line: i + 1,
+                snippet: lines[i].trim().slice(0, MAX_SNIPPET_LEN),
+                message: 'except block whose entire body is pass — error swallowed silently',
+            });
+            continue;
+        }
+        if (i >= lines.length - 1)
+            break;
+        if (!/^\s*except\b[^:]*:\s*(?:#.*)?$/.test(lines[i]))
+            continue;
+        const next = lines[i + 1].trim();
+        if (next === 'pass' || next === '...') {
+            findings.push({
+                rule: 'except-pass',
+                category: 'error-handling',
+                severity: 'medium',
+                file,
+                line: i + 1,
+                snippet: lines[i].trim().slice(0, MAX_SNIPPET_LEN),
+                message: 'except block whose entire body is pass — error swallowed silently',
+            });
+        }
+    }
+    return findings;
+}
+/** File-level: Python threads without any lock in the same file. */
+function scanConcurrencySmells(file, content, isCode) {
+    if (!isCode || !file.endsWith('.py'))
+        return [];
+    if (!/\bthreading\.Thread\s*\(/.test(content))
+        return [];
+    if (/\b(?:threading\.)?Lock\s*\(/.test(content))
+        return [];
+    return [
+        {
+            rule: 'threading-no-lock',
+            category: 'concurrency',
+            severity: 'medium',
+            file,
+            line: 1,
+            snippet: 'threading.Thread without any Lock in file',
+            message: 'threads spawned but no Lock in this file — check shared-state access',
+        },
+    ];
+}
+/** Resolve the target file list for a pre-pass run. */
+export function collectPrePassTargets(options) {
+    const dir = options.projectDir ?? process.cwd();
+    if (options.files && options.files.length > 0)
+        return options.files;
+    // Default: everything the branch touched, plus uncommitted/untracked work —
+    // the same surface the reviewers are about to read.
+    const found = new Set();
+    const collect = (args) => {
+        const out = git(dir, args);
+        if (out === null)
+            return;
+        for (const line of out.split('\n')) {
+            const f = line.trim();
+            if (f && !f.includes('node_modules/'))
+                found.add(f);
+        }
+    };
+    let baseResolved = false;
+    for (const base of ['origin/master', 'origin/main', 'master', 'main']) {
+        if (git(dir, ['rev-parse', '--verify', base]) !== null) {
+            collect(['diff', '--name-only', `${base}...HEAD`]);
+            baseResolved = true;
+            break;
+        }
+    }
+    if (!baseResolved)
+        collect(['diff', '--name-only', 'HEAD~1..HEAD']);
+    collect(['diff', '--name-only', '--cached']);
+    collect(['diff', '--name-only']);
+    collect(['ls-files', '--others', '--exclude-standard']);
+    return [...found].filter((f) => existsSync(join(dir, f)));
+}
+/** Scan a resolved target list. */
+export function runPrePass(options) {
+    const dir = options.projectDir ?? process.cwd();
+    const targets = collectPrePassTargets(options);
+    const findings = [];
+    const filesScanned = [];
+    for (const file of targets) {
+        let content;
+        try {
+            content = readFileSync(join(dir, file), 'utf-8');
+        }
+        catch {
+            continue; // binary or unreadable — not this pass's job
+        }
+        filesScanned.push(file);
+        findings.push(...scanFileContent(file, content));
+    }
+    return { findings, filesScanned };
+}
+/** Percent-encode branch to a filename slug — mirrors slug_for() in the
+ * expert_review_required enforcer exactly (the artifact must land where the
+ * enforcer looks). */
+export function branchSlug(branch) {
+    return branch.replace(/%/g, '%25').replace(/\//g, '%2F');
+}
+/**
+ * Write the pre-pass artifact to .uap/reviews/<branch-slug>.pre-pass.json.
+ *
+ * Deliberately a SIBLING of the review artifact (<slug>.json), not a block
+ * inside it: the expert-review enforcer treats the existence of <slug>.json
+ * as "a review happened", and every substantive check in it is conditional on
+ * keys the pre-pass never writes. A pre-pass-only <slug>.json would satisfy
+ * the blocking gate with zero reviewers — so this advisory pass must never
+ * create that file. Consolidation reads this sibling and merges its findings
+ * into the real artifact along with the verdict.
+ */
+export function writePrePassArtifact(projectDir, findings, filesScanned) {
+    const branch = git(projectDir, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    if (!branch || branch === 'HEAD')
+        return null; // detached/non-git: nowhere to write
+    const head = git(projectDir, ['rev-parse', 'HEAD']);
+    const dir = join(projectDir, '.uap', 'reviews');
+    mkdirSync(dir, { recursive: true });
+    const path = join(dir, `${branchSlug(branch)}.pre-pass.json`);
+    let existing = {};
+    if (existsSync(path)) {
+        try {
+            existing = JSON.parse(readFileSync(path, 'utf-8'));
+        }
+        catch {
+            existing = {}; // corrupt artifact: overwrite, don't crash the review
+        }
+    }
+    const artifact = {
+        ran_at: new Date().toISOString(),
+        head,
+        files_scanned: filesScanned,
+        finding_count: findings.length,
+        findings,
+    };
+    const merged = { ...existing, pre_pass: artifact };
+    // Atomic write: a crash mid-write must not destroy reviewer-written keys —
+    // a torn artifact would be reset to {} on next read, erasing a review.
+    const tmpPath = `${path}.tmp`;
+    writeFileSync(tmpPath, JSON.stringify(merged, null, 2) + '\n');
+    renameSync(tmpPath, path);
+    return { path, artifact };
+}
+//# sourceMappingURL=prepass.js.map

package/dist/review/prepass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepass.js","sourceRoot":"","sources":["../../src/review/prepass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,8EAA8E;AAC9E,SAAS,GAAG,CAAC,GAAW,EAAE,IAAc;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAyBD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAE/F;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,sBAAsB;QAC/B,OAAO,EAAE,6BAA6B;KACvC;IACD;QACE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,iEAAiE;QAC1E,OAAO,EAAE,wBAAwB;KAClC;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,kCAAkC;QAC3C,OAAO,EAAE,uBAAuB;KACjC;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,oCAAoC;QAC7C,OAAO,EAAE,gCAAgC;KAC1C;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,0BAA0B;QACnC,OAAO,EAAE,qBAAqB;KAC/B;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,kEAAkE;QAC3E,OAAO,EAAE,eAAe;KACzB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,mEAAmE;QAC5E,OAAO,EAAE,0CAA0C;KACpD;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;QAChB,wEAAwE;QACxE,OAAO,EAAE,yFAAyF;QAClG,OAAO,EAAE,mDAAmD;KAC7D;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,qBAAqB;QAC9B,yEAAyE;QACzE,4CAA4C;QAC5C,OAAO,EAAE,4DAA4D;QACrE,QAAQ,EAAE,IAAI;KACf;IACD;QACE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,qBAAqB;QAC9B,OAAO,EAAE,wDAAwD;QACjE,QAAQ,EAAE,IAAI;KACf;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,mCAAmC;QAC5C,OAAO,EAAE,2EAA2E;QACpF,QAAQ,EAAE,IAAI;KACf;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,4CAA4C;QACrD,OAAO,EAAE,gEAAgE;QACzE,QAAQ,EAAE,IAAI;KACf;IACD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,kCAAkC;QAC3C,OAAO,EAAE,iEAAiE;QAC1E,QAAQ,EAAE,IAAI;KACf;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,iEAAiE;QAC1E,OAAO,EAAE,iEAAiE;QAC1E,QAAQ,EAAE,IAAI;KACf;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,4EAA4E;QACrF,OAAO,EAAE,+DAA+D;QACxE,QAAQ,EAAE,IAAI;KACf;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,sBAAsB;QAC/B,OAAO,EAAE,kEAAkE;QAC3E,QAAQ,EAAE,IAAI;KACf;IACD;QACE,+DAA+D;QAC/D,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,yBAAyB;QAClC,OAAO,EAAE,8DAA8D;QACvE,QAAQ,EAAE,IAAI;KACf;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,kDAAkD;QAC3D,QAAQ,EAAE,IAAI;KACf;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,2BAA2B;QACpC,OAAO,EAAE,gEAAgE;QACzE,QAAQ,EAAE,IAAI;KACf;IACD;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,mDAAmD;QAC5D,OAAO,EAAE,oEAAoE;KAC9E;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,2BAA2B;QACpC,2EAA2E;QAC3E,OAAO,EAAE,yEAAyE;QAClF,QAAQ,EAAE,IAAI;KACf;CACF,CAAC;AAEF,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,OAAO;SACX,OAAO,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;SACrD,OAAO,CACN,qOAAqO,EACrO,gBAAgB,CACjB,CAAC;AACN,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAe;IAC3D,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;gBAAE,SAAS;YACvC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;gBACtD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI;oBACJ,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,OAAO,EAAE,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO;oBACvE,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe,EAAE,MAAe;IACtE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,qCAAqC,CAAC;IACtD,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAC9D,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,gBAAgB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,IAAI;YACJ,IAAI;YACJ,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;YAChE,OAAO,EAAE,8CAA8C;SACxD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,qFAAqF;AACrF,SAAS,yBAAyB,CAChC,IAAY,EACZ,KAAe,EACf,MAAe;IAEf,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,qCAAqC;QACrC,IAAI,oDAAoD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,QAAQ;gBAClB,IAAI;gBACJ,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;gBAClD,OAAO,EAAE,mEAAmE;aAC7E,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM;QACjC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,QAAQ;gBAClB,IAAI;gBACJ,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;gBAClD,OAAO,EAAE,mEAAmE;aAC7E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oEAAoE;AACpE,SAAS,qBAAqB,CAC5B,IAAY,EACZ,OAAe,EACf,MAAe;IAEf,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACzD,IAAI,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3D,OAAO;QACL;YACE,IAAI,EAAE,mBAAmB;YACzB,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,QAAQ;YAClB,IAAI;YACJ,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,2CAA2C;YACpD,OAAO,EAAE,sEAAsE;SAChF;KACF,CAAC;AACJ,CAAC;AAQD,uDAAuD;AACvD,MAAM,UAAU,qBAAqB,CAAC,OAAuB;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAChD,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACpE,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,OAAO,GAAG,CAAC,IAAc,EAAQ,EAAE;QACvC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO;QACzB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;IACF,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QACtE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACvD,OAAO,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC;YACnD,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,YAAY;QAAE,OAAO,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,UAAU,CAAC,OAAuB;IAIhD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,6CAA6C;QACzD,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAED;;sBAEsB;AACtB,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAUD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,QAA0B,EAC1B,YAAoB;IAEpB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,qCAAqC;IACpF,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAEpD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAChD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAE9D,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAA4B,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,EAAE,CAAC,CAAC,sDAAsD;QACvE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAoB;QAChC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAChC,IAAI;QACJ,aAAa,EAAE,YAAY;QAC3B,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,QAAQ;KACT,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACnD,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,OAAO,GAAG,GAAG,IAAI,MAAM,CAAC;IAC9B,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/D,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC"}

package/dist/review/visual-captures.d.ts

@@ -0,0 +1,60 @@
+/** UI surface definition — mirrored (with matching case handling) by
+ * UI_EXT/UI_DIR_PREFIXES in src/policies/enforcers/expert_review_required.py
+ * and visual_verification.py. Keep all three in sync; the parity test in
+ * test/visual-captures.test.ts pins the intended surface. */
+export declare const UI_EXT: Set<string>;
+export declare const UI_DIR_PREFIXES: string[];
+export interface CaptureEntry {
+    /** Capture tool: agent-browser | tuistory | pty-capture | playwright | ... */
+    tool: string;
+    /** Pre-change capture path (stored project-relative). */
+    before: string;
+    /** Post-change capture path (stored project-relative). */
+    after: string;
+    note?: string;
+    /** ISO timestamp when the pair was registered. */
+    at: string;
+}
+export interface CapturesArtifact {
+    branch: string;
+    head: string | null;
+    ui_files: string[];
+    captures: CaptureEntry[];
+    at: string;
+}
+export interface CapturesValidation {
+    /** True when the diff vs base touches UI files and captures are mandatory. */
+    required: boolean;
+    ok: boolean;
+    reasons: string[];
+    uiFiles: string[];
+    artifactPath: string;
+    captures: CaptureEntry[];
+}
+export declare function isUiFile(file: string): boolean;
+/** Files changed vs the upstream base (origin/master, origin/main, master,
+ * main — first that resolves), or null when no base exists (fail-open). */
+export declare function changedFilesVsBase(projectDir: string): string[] | null;
+export declare function capturesArtifactPath(projectDir: string, branch: string): string;
+/**
+ * Register one before/after capture pair for the current branch.
+ * Returns the artifact path, or an error string when the pair is unusable.
+ */
+export declare function recordCapture(projectDir: string, entry: {
+    tool: string;
+    before: string;
+    after: string;
+    note?: string;
+}): {
+    path: string;
+    artifact: CapturesArtifact;
+} | {
+    error: string;
+};
+/**
+ * Validate that a UI diff is covered by complete, fresh capture pairs.
+ * Fail-open only when no base is resolvable (non-git/detached), matching the
+ * expert-review enforcer's posture.
+ */
+export declare function validateCaptures(projectDir: string): CapturesValidation;
+//# sourceMappingURL=visual-captures.d.ts.map

package/dist/review/visual-captures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visual-captures.d.ts","sourceRoot":"","sources":["../../src/review/visual-captures.ts"],"names":[],"mappings":"AA+BA;;;6DAG6D;AAC7D,eAAO,MAAM,MAAM,aAGjB,CAAC;AACH,eAAO,MAAM,eAAe,UAAwC,CAAC;AAErE,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,QAAQ,EAAE,OAAO,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAeD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK9C;AAED;2EAC2E;AAC3E,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAMtE;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE/E;AA6BD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CA0ClE;AAID;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CAqFvE"}