@mnemonik/scanner 5.151.0 → 5.151.2

package/dist/discovery.js

@@ -0,0 +1,107 @@
+import { readFile, readdir } from 'fs/promises';
+import { join, resolve } from 'path';
+/** Directories to skip during discovery walk */
+const SKIP_DIRS = new Set([
+    'node_modules',
+    '.git',
+    'dist',
+    'build',
+    '.next',
+    '.nuxt',
+    '.output',
+    '__pycache__',
+    '.venv',
+    'venv',
+    '.tox',
+    'target',
+    '.cache',
+    'coverage',
+    '.turbo',
+    '.vercel',
+    '.svelte-kit',
+]);
+export class ProjectDiscovery {
+    roots;
+    maxDepth;
+    timeoutMs;
+    constructor(roots, options) {
+        this.roots = roots;
+        this.maxDepth = options?.maxDepth ?? 3;
+        this.timeoutMs = options?.timeoutMs ?? 30_000;
+    }
+    /**
+     * Discover all projects with .mnemonik.json files under the configured roots.
+     * Deduplicates by projectId (same project found at multiple paths = first wins).
+     */
+    async discover() {
+        const seen = new Map();
+        for (const root of this.roots) {
+            const absRoot = resolve(root.replace(/^~/, process.env.HOME || ''));
+            try {
+                await this.walkWithTimeout(absRoot, 0, seen);
+            }
+            catch (err) {
+                if (err instanceof DiscoveryTimeoutError) {
+                    console.warn(`[scanner] Discovery timeout for root: ${absRoot} (>${this.timeoutMs}ms)`);
+                }
+                else {
+                    console.warn(`[scanner] Error scanning root ${absRoot}:`, err.message);
+                }
+            }
+        }
+        return Array.from(seen.values());
+    }
+    async walkWithTimeout(dir, depth, seen) {
+        const deadline = Date.now() + this.timeoutMs;
+        await this.walk(dir, depth, seen, deadline);
+    }
+    async walk(dir, depth, seen, deadline) {
+        if (depth > this.maxDepth)
+            return;
+        if (Date.now() > deadline)
+            throw new DiscoveryTimeoutError();
+        // Check for .mnemonik.json in this directory
+        const configPath = join(dir, '.mnemonik.json');
+        try {
+            const raw = await readFile(configPath, 'utf-8');
+            const parsed = JSON.parse(raw);
+            if (typeof parsed.projectId === 'string' && parsed.projectId.length > 0) {
+                if (!seen.has(parsed.projectId)) {
+                    seen.set(parsed.projectId, {
+                        projectId: parsed.projectId,
+                        path: dir,
+                        projectName: typeof parsed.projectName === 'string' ? parsed.projectName : undefined,
+                    });
+                }
+            }
+            // Don't recurse into subdirectories of a project — the project owns this tree
+            return;
+        }
+        catch {
+            // No .mnemonik.json here, continue walking
+        }
+        // Recurse into subdirectories
+        try {
+            const entries = await readdir(dir, { withFileTypes: true });
+            for (const entry of entries) {
+                if (!entry.isDirectory())
+                    continue;
+                if (SKIP_DIRS.has(entry.name))
+                    continue;
+                if (entry.name.startsWith('.') && entry.name !== '.mnemonik')
+                    continue;
+                await this.walk(join(dir, entry.name), depth + 1, seen, deadline);
+            }
+        }
+        catch {
+            // Permission denied or inaccessible directory
+        }
+    }
+}
+class DiscoveryTimeoutError extends Error {
+    constructor() {
+        super('Discovery walk timed out');
+        this.name = 'DiscoveryTimeoutError';
+    }
+}
+//# sourceMappingURL=discovery.js.map

package/dist/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAQ,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAErC,gDAAgD;AAChD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,SAAS;IACT,aAAa;IACb,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,SAAS;IACT,aAAa;CACd,CAAC,CAAC;AAQH,MAAM,OAAO,gBAAgB;IAKjB;IAJF,QAAQ,CAAS;IACjB,SAAS,CAAS;IAE1B,YACU,KAAe,EACvB,OAAmD;QAD3C,UAAK,GAAL,KAAK,CAAU;QAGvB,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;oBACzC,OAAO,CAAC,IAAI,CAAC,yCAAyC,OAAO,MAAM,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC;gBAC1F,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,iCAAiC,OAAO,GAAG,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,GAAW,EACX,KAAa,EACb,IAAoC;QAEpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7C,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,GAAW,EACX,KAAa,EACb,IAAoC,EACpC,QAAgB;QAEhB,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ;YAAE,OAAO;QAClC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YAAE,MAAM,IAAI,qBAAqB,EAAE,CAAC;QAE7D,6CAA6C;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;YAC1D,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;oBAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE;wBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,IAAI,EAAE,GAAG;wBACT,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;qBACrF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,8EAA8E;YAC9E,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;QAC7C,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;oBAAE,SAAS;gBACnC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACxC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;oBAAE,SAAS;gBACvE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;IACH,CAAC;CACF;AAED,MAAM,qBAAsB,SAAQ,KAAK;IACvC;QACE,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF"}

package/dist/doctor.d.ts

@@ -0,0 +1 @@
+export declare function runDoctor(): Promise<void>;

package/dist/doctor.js

@@ -0,0 +1,233 @@
+import { execFileSync } from 'child_process';
+import { existsSync, readFileSync, readdirSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import { fileURLToPath } from 'url';
+import { pidIsScanner } from './pid.js';
+/**
+ * `mnemonik-scanner doctor` — the guard that turns the prose upgrade procedure
+ * into an executable check. It asserts the invariants that every past botched
+ * reinstall violated, and prints the one blessed remediation. Any single ✗
+ * exits non-zero so a wrapper (or a human) can react.
+ *
+ * Invariants:
+ *  1. Exactly one `mnemonik-scanner` on PATH, inside the user npm prefix
+ *     (a second copy under /usr is the classic PATH-shadow version skew).
+ *  2. If a systemd user unit exists, it is active and its ExecStart points at
+ *     that same binary.
+ *  3. Exactly one live daemon, and under systemd its PID == the unit MainPID
+ *     (a stray `node …/scanner/dist/index.js` is a duplicate local-build daemon).
+ *  4. No leftover legacy per-project daemons.
+ *  5. Installed version is not behind npm latest (warning, not failure).
+ */
+const HOME = homedir();
+const MNEMONIK_DIR = join(HOME, '.mnemonik');
+const PID_FILE = join(MNEMONIK_DIR, 'daemon.pid');
+const LEGACY_DAEMONS_DIR = join(MNEMONIK_DIR, 'daemons');
+const UNIT_FILE = join(HOME, '.config/systemd/user/mnemonik-scanner.service');
+function sh(cmd, args, timeoutMs = 5000) {
+    try {
+        return execFileSync(cmd, args, {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: timeoutMs,
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+    }
+    catch {
+        return false;
+    }
+    // Existence alone is not identity — after PID reuse the recorded number can
+    // belong to an unrelated process. A live-but-foreign PID is dead to us.
+    return pidIsScanner(pid);
+}
+function installedVersion() {
+    try {
+        const here = fileURLToPath(new URL('.', import.meta.url));
+        const pkg = JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf-8'));
+        return pkg.version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function runDoctor() {
+    const checks = [];
+    // 1. Binary uniqueness + location.
+    const prefix = sh('npm', ['config', 'get', 'prefix']);
+    const whichOut = sh('which', ['-a', 'mnemonik-scanner']);
+    const binPaths = whichOut
+        ? whichOut
+            .split('\n')
+            .map((s) => s.trim())
+            .filter(Boolean)
+        : [];
+    if (binPaths.length === 0) {
+        checks.push({
+            level: 'fail',
+            label: 'binary on PATH',
+            detail: 'mnemonik-scanner not found on PATH',
+        });
+    }
+    else if (binPaths.length > 1) {
+        checks.push({
+            level: 'fail',
+            label: 'single binary on PATH',
+            detail: `found ${binPaths.length} copies (PATH shadow → version skew):\n    ${binPaths.join('\n    ')}`,
+        });
+    }
+    else if (prefix && !binPaths[0].startsWith(prefix)) {
+        checks.push({
+            level: 'warn',
+            label: 'binary in user npm prefix',
+            detail: `${binPaths[0]} is not under npm prefix ${prefix}`,
+        });
+    }
+    else {
+        checks.push({ level: 'ok', label: 'single binary on PATH', detail: binPaths[0] });
+    }
+    const binPath = binPaths.length === 1 ? binPaths[0] : null;
+    // 2. systemd unit health + ExecStart match.
+    let unitMainPid = null;
+    const hasUnit = existsSync(UNIT_FILE);
+    if (hasUnit) {
+        const show = sh('systemctl', [
+            '--user',
+            'show',
+            'mnemonik-scanner',
+            '-p',
+            'ActiveState',
+            '-p',
+            'MainPID',
+            '-p',
+            'ExecStart',
+        ]);
+        const active = /ActiveState=active/.test(show ?? '');
+        const mainPidMatch = /MainPID=(\d+)/.exec(show ?? '');
+        unitMainPid = mainPidMatch ? parseInt(mainPidMatch[1], 10) : null;
+        const execMatch = /path=([^\s;]+)/.exec(show ?? '');
+        const execPath = execMatch ? execMatch[1] : null;
+        if (!active) {
+            checks.push({ level: 'fail', label: 'systemd unit active', detail: 'unit is not active' });
+        }
+        else if (binPath && execPath && execPath !== binPath) {
+            checks.push({
+                level: 'fail',
+                label: 'ExecStart matches binary',
+                detail: `unit runs ${execPath} but PATH resolves ${binPath}`,
+            });
+        }
+        else {
+            checks.push({
+                level: 'ok',
+                label: 'systemd unit active',
+                detail: `MainPID ${unitMainPid ?? '?'}`,
+            });
+        }
+    }
+    else {
+        checks.push({
+            level: 'warn',
+            label: 'systemd unit',
+            detail: 'no user unit — daemon must be supervised another way',
+        });
+    }
+    // 3. Single live daemon; under systemd it must equal MainPID.
+    let filePid = null;
+    try {
+        filePid = parseInt(readFileSync(PID_FILE, 'utf-8').trim(), 10);
+        if (Number.isNaN(filePid))
+            filePid = null;
+    }
+    catch {
+        filePid = null;
+    }
+    const psOut = sh('ps', ['-eo', 'pid,cmd']);
+    const daemonPids = (psOut ?? '')
+        .split('\n')
+        // Only the long-running `start` daemon counts — never a `doctor`/`status`/
+        // `log`/`stop` invocation (which also runs …/scanner/dist/index.js), and
+        // never this doctor process itself.
+        .filter((l) => /(mnemonik-scanner|scanner\/dist\/index\.js)/.test(l) && /\bstart\b/.test(l))
+        .map((l) => parseInt(l.trim().split(/\s+/)[0], 10))
+        .filter((n) => !Number.isNaN(n) && n !== process.pid);
+    if (daemonPids.length === 0) {
+        checks.push({ level: 'fail', label: 'daemon running', detail: 'no daemon process found' });
+    }
+    else if (daemonPids.length > 1) {
+        checks.push({
+            level: 'fail',
+            label: 'single daemon',
+            detail: `${daemonPids.length} daemon processes (duplicate) — PIDs ${daemonPids.join(', ')}`,
+        });
+    }
+    else if (hasUnit && unitMainPid && daemonPids[0] !== unitMainPid) {
+        checks.push({
+            level: 'fail',
+            label: 'daemon is the systemd one',
+            detail: `running PID ${daemonPids[0]} != unit MainPID ${unitMainPid} (stray local-build daemon)`,
+        });
+    }
+    else if (filePid && !pidAlive(filePid)) {
+        checks.push({
+            level: 'warn',
+            label: 'PID file fresh',
+            detail: `stale ${PID_FILE} (PID ${filePid} dead)`,
+        });
+    }
+    else {
+        checks.push({ level: 'ok', label: 'single daemon', detail: `PID ${daemonPids[0]}` });
+    }
+    // 4. Legacy per-project daemons.
+    try {
+        const legacy = readdirSync(LEGACY_DAEMONS_DIR)
+            .filter((f) => f.endsWith('.pid'))
+            .map((f) => parseInt(readFileSync(join(LEGACY_DAEMONS_DIR, f), 'utf-8').trim(), 10))
+            .filter((n) => !Number.isNaN(n) && pidAlive(n));
+        if (legacy.length > 0) {
+            checks.push({
+                level: 'fail',
+                label: 'no legacy daemons',
+                detail: `legacy per-project daemons alive: ${legacy.join(', ')}`,
+            });
+        }
+    }
+    catch {
+        // dir absent — nothing to check
+    }
+    // 5. Version vs npm latest (informational).
+    const local = installedVersion();
+    const latest = sh('npm', ['view', '@mnemonik/scanner', 'version'], 15000);
+    if (local && latest && local !== latest) {
+        checks.push({
+            level: 'warn',
+            label: 'up to date',
+            detail: `installed ${local}, npm latest ${latest} — run: make scanner-deploy`,
+        });
+    }
+    else if (local) {
+        checks.push({ level: 'ok', label: 'up to date', detail: `v${local}` });
+    }
+    // Report.
+    const icon = { ok: '✓', warn: '⚠', fail: '✗' };
+    console.log('mnemonik-scanner doctor\n');
+    for (const c of checks) {
+        console.log(`  ${icon[c.level]} ${c.label}${c.detail ? `: ${c.detail}` : ''}`);
+    }
+    const failed = checks.filter((c) => c.level === 'fail');
+    if (failed.length > 0) {
+        console.log(`\n${failed.length} problem(s). Canonical fix: \`make scanner-deploy\` (build → publish shared-first → npm i -g → systemctl restart → re-verify).\n` +
+            'Do NOT hand-copy dist/ or run `make daemon-*` on a systemd host — those are what cause this.');
+        process.exit(1);
+    }
+    console.log('\nAll invariants hold.');
+    process.exit(0);
+}
+//# sourceMappingURL=doctor.js.map

package/dist/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;AACvB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAClD,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,+CAA+C,CAAC,CAAC;AAS9E,SAAS,EAAE,CAAC,GAAW,EAAE,IAAc,EAAE,SAAS,GAAG,IAAI;IACvD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,4EAA4E;IAC5E,wEAAwE;IACxE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAE7E,CAAC;QACF,OAAO,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,mCAAmC;IACnC,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,QAAQ;QACvB,CAAC,CAAC,QAAQ;aACL,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,oCAAoC;SAC7C,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,SAAS,QAAQ,CAAC,MAAM,8CAA8C,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;SACxG,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,2BAA2B;YAClC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,4BAA4B,MAAM,EAAE;SAC3D,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAE5D,4CAA4C;IAC5C,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE;YAC3B,QAAQ;YACR,MAAM;YACN,kBAAkB;YAClB,IAAI;YACJ,aAAa;YACb,IAAI;YACJ,SAAS;YACT,IAAI;YACJ,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACtD,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAElD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC7F,CAAC;aAAM,IAAI,OAAO,IAAI,QAAQ,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,0BAA0B;gBACjC,MAAM,EAAE,aAAa,QAAQ,sBAAsB,OAAO,EAAE;aAC7D,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,qBAAqB;gBAC5B,MAAM,EAAE,WAAW,WAAW,IAAI,GAAG,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,sDAAsD;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,8DAA8D;IAC9D,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;SAC7B,KAAK,CAAC,IAAI,CAAC;QACZ,2EAA2E;QAC3E,yEAAyE;QACzE,oCAAoC;SACnC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,6CAA6C,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAC3F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;SACnD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC7F,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,wCAAwC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC5F,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,IAAI,WAAW,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,2BAA2B;YAClC,MAAM,EAAE,eAAe,UAAU,CAAC,CAAC,CAAC,oBAAoB,WAAW,6BAA6B;SACjG,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,SAAS,QAAQ,SAAS,OAAO,QAAQ;SAClD,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,iCAAiC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,kBAAkB,CAAC;aAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;aACnF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,mBAAmB;gBAC1B,MAAM,EAAE,qCAAqC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IAED,4CAA4C;IAC5C,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,mBAAmB,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1E,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,aAAa,KAAK,gBAAgB,MAAM,6BAA6B;SAC9E,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,UAAU;IACV,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAW,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CACT,KAAK,MAAM,CAAC,MAAM,kIAAkI;YAClJ,8FAA8F,CACjG,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/fileLog.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Append-only sink that mirrors the daemon's console output to a file the
+ * `mnemonik-scanner log` command can tail. Rotates to `<file>.old` once the
+ * file would pass `maxSize`, so a daemon that runs for weeks can't grow it
+ * without bound. Every operation is best-effort: a logging failure must never
+ * crash the daemon, so all filesystem errors are swallowed.
+ */
+export declare function createRotatingFileSink(logFile: string, maxSize: number): (chunk: string) => void;
+/**
+ * Tee `process.stdout`/`process.stderr` into `logFile` on top of their normal
+ * destination. This is what makes `mnemonik-scanner log` reflect live activity
+ * regardless of how the daemon is supervised: under systemd stdout is wired to
+ * the journal (a socket), under a bare shell to the terminal — either way the
+ * file now receives the same lines. Call once at daemon start, before the
+ * daemon writes anything worth capturing.
+ */
+export declare function installFileLogging(logFile: string, maxSize: number): void;

package/dist/fileLog.js

@@ -0,0 +1,70 @@
+import { appendFileSync, renameSync, statSync } from 'fs';
+/**
+ * Append-only sink that mirrors the daemon's console output to a file the
+ * `mnemonik-scanner log` command can tail. Rotates to `<file>.old` once the
+ * file would pass `maxSize`, so a daemon that runs for weeks can't grow it
+ * without bound. Every operation is best-effort: a logging failure must never
+ * crash the daemon, so all filesystem errors are swallowed.
+ */
+export function createRotatingFileSink(logFile, maxSize) {
+    let size = 0;
+    try {
+        size = statSync(logFile).size;
+    }
+    catch {
+        size = 0;
+    }
+    return (chunk) => {
+        if (!chunk)
+            return;
+        try {
+            const bytes = Buffer.byteLength(chunk);
+            if (size > 0 && size + bytes > maxSize) {
+                try {
+                    renameSync(logFile, logFile + '.old');
+                }
+                catch {
+                    // Rotation failed (e.g. cross-device) — keep appending to the
+                    // current file rather than losing the line.
+                }
+                size = 0;
+            }
+            appendFileSync(logFile, chunk);
+            size += bytes;
+        }
+        catch {
+            // Never let logging break the daemon.
+        }
+    };
+}
+/**
+ * Tee `process.stdout`/`process.stderr` into `logFile` on top of their normal
+ * destination. This is what makes `mnemonik-scanner log` reflect live activity
+ * regardless of how the daemon is supervised: under systemd stdout is wired to
+ * the journal (a socket), under a bare shell to the terminal — either way the
+ * file now receives the same lines. Call once at daemon start, before the
+ * daemon writes anything worth capturing.
+ */
+export function installFileLogging(logFile, maxSize) {
+    const sink = createRotatingFileSink(logFile, maxSize);
+    for (const stream of [process.stdout, process.stderr]) {
+        const original = stream.write.bind(stream);
+        stream.write = ((chunk, encoding, cb) => {
+            try {
+                if (typeof chunk === 'string') {
+                    sink(chunk);
+                }
+                else if (Buffer.isBuffer(chunk)) {
+                    const enc = typeof encoding === 'string' ? encoding : 'utf8';
+                    sink(chunk.toString(enc));
+                }
+            }
+            catch {
+                // ignore — mirroring is best-effort
+            }
+            // Preserve the real stream's overloads (chunk, cb) / (chunk, enc, cb).
+            return original(chunk, encoding, cb);
+        });
+    }
+}
+//# sourceMappingURL=fileLog.js.map

package/dist/fileLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileLog.js","sourceRoot":"","sources":["../src/fileLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,OAAe;IACrE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,KAAa,EAAQ,EAAE;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,GAAG,OAAO,EAAE,CAAC;gBACvC,IAAI,CAAC;oBACH,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,8DAA8D;oBAC9D,4CAA4C;gBAC9C,CAAC;gBACD,IAAI,GAAG,CAAC,CAAC;YACX,CAAC;YACD,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,OAAe;IACjE,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEtD,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAoC,CAAC;QAC9E,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAc,EAAE,QAAkB,EAAE,EAAY,EAAW,EAAE;YAC5E,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,IAAI,CAAC,KAAK,CAAC,CAAC;gBACd,CAAC;qBAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClC,MAAM,GAAG,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAE,QAA2B,CAAC,CAAC,CAAC,MAAM,CAAC;oBACjF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oCAAoC;YACtC,CAAC;YACD,uEAAuE;YACvE,OAAO,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC,CAAwB,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/git.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Git commit extraction on the scanner daemon side.
+ *
+ * The production server runs in ECS and cannot `git log` the user's repo —
+ * the repo lives on the user's machine, next to the daemon. We run `git log`
+ * here and push the parsed commits alongside scan results. Server-side
+ * `GitMiner.mineCommits` consumes them without touching the filesystem.
+ */
+export interface ParsedCommit {
+    sha: string;
+    author: string;
+    date: string;
+    message: string;
+    files: string[];
+}
+/**
+ * True when `repoRoot/.git` exists and `git log -1` returns a commit.
+ * Non-git projects, `git init` with no commits, and corrupted repos all
+ * return false without throwing.
+ */
+export declare function probeGit(repoRoot: string): Promise<boolean>;
+/**
+ * Fetch commits between `sinceCommit` and HEAD (or the last MAX_COMMITS on
+ * first run). Returns [] on failure — caller omits the field from the push.
+ *
+ * Uses `-z` NUL-separated output so `--name-only` file entries cannot collide
+ * with commit metadata. Parser mirrors the server-side token-walking parser
+ * in GitMiner.parseLogOutput.
+ */
+export declare function fetchCommits(repoRoot: string, sinceCommit: string | null): Promise<ParsedCommit[]>;
+export declare function parseLogOutput(raw: string): ParsedCommit[];

package/dist/git.js

@@ -0,0 +1,111 @@
+/**
+ * Git commit extraction on the scanner daemon side.
+ *
+ * The production server runs in ECS and cannot `git log` the user's repo —
+ * the repo lives on the user's machine, next to the daemon. We run `git log`
+ * here and push the parsed commits alongside scan results. Server-side
+ * `GitMiner.mineCommits` consumes them without touching the filesystem.
+ */
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import { access } from 'fs/promises';
+import { join } from 'path';
+const execFileAsync = promisify(execFile);
+// Keep in sync with server-side MAX_COMMITS_PER_RUN in GitMiner.ts and the
+// `commits` array cap in scanPushSchema.
+const MAX_COMMITS = 100;
+const GIT_TIMEOUT_MS = 20_000;
+/**
+ * True when `repoRoot/.git` exists and `git log -1` returns a commit.
+ * Non-git projects, `git init` with no commits, and corrupted repos all
+ * return false without throwing.
+ */
+export async function probeGit(repoRoot) {
+    try {
+        await access(join(repoRoot, '.git'));
+    }
+    catch {
+        return false;
+    }
+    try {
+        const { stdout } = await execFileAsync('git', ['log', '-1', '--format=%H'], {
+            cwd: repoRoot,
+            encoding: 'utf-8',
+            timeout: GIT_TIMEOUT_MS,
+        });
+        return /^[0-9a-f]{40}/m.test(stdout);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Fetch commits between `sinceCommit` and HEAD (or the last MAX_COMMITS on
+ * first run). Returns [] on failure — caller omits the field from the push.
+ *
+ * Uses `-z` NUL-separated output so `--name-only` file entries cannot collide
+ * with commit metadata. Parser mirrors the server-side token-walking parser
+ * in GitMiner.parseLogOutput.
+ */
+export async function fetchCommits(repoRoot, sinceCommit) {
+    const args = [
+        'log',
+        '-z',
+        '--format=%H%n%an%n%aI%n%B',
+        '--name-only',
+        `--max-count=${MAX_COMMITS}`,
+    ];
+    if (sinceCommit)
+        args.push(`${sinceCommit}..HEAD`);
+    let raw;
+    try {
+        const result = await execFileAsync('git', args, {
+            cwd: repoRoot,
+            encoding: 'utf-8',
+            timeout: GIT_TIMEOUT_MS,
+            maxBuffer: 50 * 1024 * 1024,
+        });
+        raw = result.stdout;
+    }
+    catch (err) {
+        const msg = err.message;
+        // "fatal: Invalid revision range <sha>..HEAD" — the daemon's cached
+        // last_mined_commit is stale (e.g. history was rewritten or the server
+        // was reseeded). Fall back to a fresh full-history scan.
+        if (sinceCommit && /Invalid (?:revision range|symmetric difference expression)/i.test(msg)) {
+            return fetchCommits(repoRoot, null);
+        }
+        return [];
+    }
+    return parseLogOutput(raw);
+}
+export function parseLogOutput(raw) {
+    const commits = [];
+    const tokens = raw.split('\0').filter((t) => t.length > 0);
+    let current = null;
+    for (const token of tokens) {
+        if (token.includes('\n')) {
+            if (current)
+                commits.push(current);
+            const lines = token.split('\n');
+            const sha = lines[0]?.trim() ?? '';
+            const author = lines[1]?.trim() ?? '';
+            const date = lines[2]?.trim() ?? '';
+            const message = lines.slice(3).join('\n').trim();
+            if (!sha || !author || !date || !message) {
+                current = null;
+                continue;
+            }
+            current = { sha, author, date, message, files: [] };
+        }
+        else if (current) {
+            const file = token.trim();
+            if (file.length > 0)
+                current.files.push(file);
+        }
+    }
+    if (current)
+        commits.push(current);
+    return commits;
+}
+//# sourceMappingURL=git.js.map

package/dist/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAU1C,2EAA2E;AAC3E,yCAAyC;AACzC,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,EAAE;YAC1E,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,WAA0B;IAE1B,MAAM,IAAI,GAAG;QACX,KAAK;QACL,IAAI;QACJ,2BAA2B;QAC3B,aAAa;QACb,eAAe,WAAW,EAAE;KAC7B,CAAC;IACF,IAAI,WAAW;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,WAAW,QAAQ,CAAC,CAAC;IAEnD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;YAC9C,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;QACnC,oEAAoE;QACpE,uEAAuE;QACvE,yDAAyD;QACzD,IAAI,WAAW,IAAI,6DAA6D,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3F,OAAO,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3D,IAAI,OAAO,GAAwB,IAAI,CAAC;IAExC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACzC,OAAO,GAAG,IAAI,CAAC;gBACf,SAAS;YACX,CAAC;YACD,OAAO,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACtD,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+/**
+ * Reject plaintext http:// server URLs except when talking to a local
+ * daemon on the same machine (localhost/127.0.0.1/[::1]) — e.g. during
+ * development against a locally-run server. Everything else must be https://
+ * since the scanner pushes full file content (see O2/O8b,
+ * codebase-indexing-audit-2026-07-02.md §5) and a plaintext channel would
+ * expose that content (and the API key) to network eavesdropping.
+ * Extracted as a pure function so the guard is unit-testable without
+ * spinning up the CLI.
+ */
+export declare function validateServerUrl(url: string): {
+    valid: boolean;
+    error?: string;
+};