@nanonets/graft 0.23.0 → 0.24.0

package/dist/skills/never-save.js

@@ -0,0 +1,158 @@
+/**
+ * Never save (design 4.11, spec 10): a command a skill may never hold, so a
+ * run with one gives no skill at all (sudo, a download piped into a shell,
+ * `rm -rf` on a variable or a home path, a force push to a shared branch, a
+ * credential file, destructive SQL off this machine, anything that messages
+ * people, Trail itself), and the 4.10 password backstop. Split from risk.ts,
+ * whose gated list and agent guard the PreToolUse fast path loads; this file
+ * is for the save side only.
+ */
+import { isTrailCommand } from '../trace/shell.js';
+import { argsAfter, pushes, unknownDst, word, written } from './risk.js';
+const LOCAL_HOSTS = /^(?:localhost|127\.0\.0\.1|::1|\[::1\])$/i;
+const escapeRe = (t) => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+/** Hosts a database command names: `-h x`, `--host=x`, `host=x`, `scheme://user@x:port`. */
+function namedHosts(cmd) {
+    const hosts = [];
+    for (const m of cmd.matchAll(/(?:^|\s)(?:-h|--host)(?:=|\s+)['"]?([^\s'"/;]+)/g))
+        hosts.push(m[1]);
+    for (const m of cmd.matchAll(/\bhost=['"]?([^\s'";]+)/gi))
+        hosts.push(m[1]);
+    for (const m of cmd.matchAll(/\b[a-z][a-z0-9+.-]*:\/\/(?:[^\s/@'"]*@)?(\[[^\]]+\]|[^\s/:'"?]+)/gi))
+        hosts.push(m[1]);
+    return hosts;
+}
+/** A target `rm -r` or `find -delete` must never get: a variable, a {param}, home, an absolute path, the whole folder. */
+const wildTarget = (t) => t !== '{}' && (/^[$~/]|^\.\.(?:\/|$)/.test(t) || /\$|`|\{[A-Za-z_]\w*\}/.test(t) || /^(?:\.\/?|(?:\.\/)?\*)$/.test(t));
+function rmWild(text) {
+    const rms = [...text.matchAll(word('rm'))];
+    for (const [i, m] of rms.entries()) {
+        let recursive = false;
+        let opts = true;
+        const targets = [];
+        for (const w of argsAfter(text, m.index + m[0].length, rms[i + 1]?.index)) {
+            if (opts && w === '--')
+                opts = false;
+            else if (opts && /^-[a-zA-Z]+$/.test(w))
+                recursive ||= /[rR]/.test(w);
+            else if (opts && /^--[\w-]+$/.test(w))
+                recursive ||= w === '--recursive';
+            else
+                targets.push(w);
+        }
+        if (!recursive)
+            continue;
+        // `xargs rm -rf`: the targets come from elsewhere.
+        if (!targets.length ? /\bxargs\b[^;&|\n]*$/.test(text.slice(0, m.index)) : targets.some(wildTarget))
+            return true;
+    }
+    const finds = [...text.matchAll(word('find'))];
+    for (const [i, m] of finds.entries()) {
+        const w = argsAfter(text, m.index + m[0].length, finds[i + 1]?.index);
+        const roots = w.slice(0, Math.max(0, w.findIndex((x) => /^[-(!]/.test(x))));
+        const deletes = w.includes('-delete') || w.some((x, i) => /^-(?:exec|execdir|ok|okdir)$/.test(x) && /(?:^|\/)rm$/.test(w[i + 1] ?? ''));
+        // `find . -name x -exec rm {} +` is fine; a root the skill can't know is not.
+        if (deletes && roots.some((t) => /^[$~/{]/.test(t) || /\$|`/.test(t)))
+            return true;
+    }
+    return false;
+}
+const SHARED = new Set(['main', 'master', 'prod', 'production', 'beta', 'dev', 'develop', 'staging', 'trunk']);
+const forcePushShared = (c) => pushes(c).some((p) => p.force && p.dsts.some((d) => SHARED.has(d.toLowerCase()) || unknownDst(d)));
+const SUDO = /(?:^|[^\w./-])(?:[\w./-]*\/)?(?:sudo|doas|pkexec)(?![\w-])/i;
+const SHELL_WORD = String.raw `(?:sudo\s+(?:-\S+\s+)*)?(?:env\s+(?:\S+=\S*\s+)*)?(?:[\w./-]*\/)?`;
+const DOWNLOAD = [
+    new RegExp(String.raw `\b(?:curl|wget)\b[^\n]*?(?<!\|)\|(?!\|)\s*${SHELL_WORD}(?:ba|z|da|k|fi)?sh\b`, 'i'),
+    new RegExp(String.raw `\b(?:curl|wget)\b[^\n]*?(?<!\|)\|(?!\|)\s*${SHELL_WORD}(?:python[\d.]*|node|perl|ruby|php)(?:\s+-)?\s*(?=$|[;&|)\n])`, 'i'),
+    /(?:\b(?:ba|z|da|k)?sh|\bsource|(?:^|[\s;&|(])\.)\s+<\(\s*(?:curl|wget)\b/i,
+    /\b(?:(?:ba|z|da|k)?sh\s+-\w*c|eval)\s+["']?(?:\$\(|`)\s*(?:curl|wget)\b/i,
+];
+/** `curl -o x.sh URL && sh x.sh`, `wget URL -O s.sh; chmod +x s.sh; ./s.sh`: a download saved to a file, then run. */
+function downloadThenRun(text) {
+    for (const m of text.matchAll(/\b(curl|wget)\b([^;&|\n]*)/gi)) {
+        const [, tool, args] = m;
+        const files = new Set();
+        const named = /(?:\s-[a-zA-Z]*o\s*|\s--output[= ]\s*|\s-O\s*(?=[^\s-])|\s--output-document[= ]\s*)['"]?([^\s'";&|]+)/.exec(args)?.[1];
+        if (named && named !== '-' && named !== '/dev/null')
+            files.add(named);
+        // `wget URL` and `curl -O URL` save under the link's own name.
+        const remote = /^wget$/i.test(tool) ? !/\s-[a-zA-Z]*O\b|--output-document/.test(args) : /\s-[a-zA-Z]*O\b|--remote-name\b/.test(args);
+        if (remote)
+            for (const u of args.matchAll(/https?:\/\/\S*\/([^\s/'"?#]+)/g))
+                files.add(u[1]);
+        const after = text.slice(m.index + m[0].length);
+        for (const f of files) {
+            const e = escapeRe(f.replace(/^\.\//, '').split('/').pop());
+            // Run as a program, or handed to a shell, `source`, `.` or `chmod +x`: at the start of a command.
+            const run = new RegExp(String.raw `(?:^|[;&|(\n]|&&|\|\|)\s*(?:(?:(?:ba|z|da|k)?sh|source|\.|chmod\s+\S*x)\s+)?['"]?(?:\.?\.?\/[^\s'"]*\/|\.\/)?${e}['"]?(?=\s|$|[;&|)])`);
+            const plainName = new RegExp(String.raw `(?:^|[;&|(\n]|&&|\|\|)\s*(?:(?:ba|z|da|k)?sh|source|\.|chmod\s+\S*x)\s+['"]?${e}['"]?(?=\s|$|[;&|)])`);
+            if (plainName.test(after) || (run.test(after) && new RegExp(String.raw `(?:^|[\s;&|(])\.{0,2}\/(?:[^\s'"]*\/)?${e}(?=\s|$|[;&|)'"])`).test(after)))
+                return true;
+        }
+    }
+    return false;
+}
+const CREDENTIAL = /(?:\.npmrc|\.netrc|\.aws\/(?:credentials|sso\/cache|cli\/cache)|(?<![\w.])\.ssh\/|\.git-credentials|\.docker\/config\.json|gh\/hosts\.yml|com\.vercel\.cli\/auth\.json|\.config\/gcloud|Library\/Keychains|\.kube\/config|\.pypirc|\.gem\/credentials|\.cargo\/credentials|\.pgpass|\.my\.cnf|credentials\.tfrc\.json|\.terraformrc|\.config\/hub\b|\.azure\/|\.password-store|\.vault-token)/i;
+/**
+ * Commands that store a credential they were handed where every later command picks it up. Logging in at
+ * the browser (`npm login`, `gh auth login`) needs the person there, holds no secret in the step, and is how
+ * a release gets past an expired token: not on this list, but gated (D93, `login`), so it is never run unasked.
+ */
+const CREDENTIAL_WRITE = /\bnpm\s+config\s+set\s+\S*_(?:auth|password)|\b(?:docker|podman|helm\s+registry)\s+login\b[^;&|\n]*\s(?:-p|--password(?:-stdin)?)\b|\baws\s+configure\s+set\b|\bgit\s+credential\s+(?:approve|store)\b|\bgit\s+config\b[^;&|\n]*\bcredential\.helper\b|\bsecurity\s+add-(?:generic|internet)-password\b/i;
+/** Commands that print a stored credential. */
+const CREDENTIAL_READ = /\bgh\s+auth\s+token\b|\bgit\s+credential\s+fill\b|\bsecurity\s+(?:find|delete)-(?:generic|internet)-password\b|\bsecurity\s+dump-keychain\b|\bop\s+(?:read|item\s+get)\b|\bgcloud\s+auth\s+print-(?:access|identity)-token\b|\bheroku\s+auth:token\b|\bpass\s+show\b|\bvault\s+(?:read|kv\s+get)\b/i;
+const DESTRUCTIVE_SQL = /\b(?:drop\s+(?:table|database|schema|view|materialized\s+view|index|owned|role|user|function|type|sequence|extension)|truncate(?!\s+-)|delete\s+from|alter\s+table\b[^;]*?\bdrop)\b|\bdropdb\b|\bflush(?:all|db)\b|\bdropDatabase\s*\(|\.drop(?:Collection)?\s*\(\s*\)|\bdeleteMany\s*\(\s*\{\s*\}\s*\)|\bsupabase\s+db\s+reset\b[^;&|\n]*--(?:linked|db-url)|\bprisma\s+(?:migrate\s+reset|db\s+push\b[^;&|\n]*--(?:force-reset|accept-data-loss))|\brails\s+db:(?:drop|reset)\b/i;
+const MESSAGES = /\b(?:sendmail|mail\s+-s|mailx|mutt|msmtp|swaks|twilio)\b|\bgit\s+send-email\b|hooks\.slack\.com|\bslack\s+chat\b|graph\.facebook\.com|discord(?:app)?\.com\/api\/webhooks|api\.telegram\.org\/bot|api\.(?:sendgrid\.com|mailgun\.net|postmarkapp\.com|resend\.com)|\bgh\s+(?:issue\s+(?:create|comment)|pr\s+(?:comment|review))\b/i;
+/** `gh api` that writes: a POST/PATCH/PUT, or fields (`-f`, `-F`, `--input`) without `-X GET`. */
+function ghApiWrite(c) {
+    if (!/\bgh\s+api\b/i.test(c))
+        return false;
+    if (/\bgh\s+api\s+graphql\b/i.test(c))
+        return /\bmutation\b[\s\S]*?\b(?:add|create|submit|update)\w*(?:Comment|Review|Issue|Discussion)\w*\b/i.test(c);
+    const method = /(?:-X|--method)[\s=]+([A-Z]+)/i.exec(c)?.[1]?.toUpperCase();
+    const writes = method ? method !== 'GET' : /(?:^|\s)(?:-f|-F|--field|--raw-field|--input)(?=[\s=])/.test(c);
+    return writes && /\/(?:comments|reviews|issues|messages|replies)\b/i.test(c);
+}
+/** Trail run by a wrapper `isTrailCommand` doesn't open: `eval "trail …"`, `xargs trail`, `find -exec trail`. */
+const TRAIL_VIA = /(?:\beval|\bxargs(?:\s+-\S+(?:\s+[^\s-]\S*)?)*|(?<!\S)-(?:exec|execdir|ok|okdir))\s+["']?(?:trail|graft|trail-code)\b/i;
+const NEVER = [
+    ['runs sudo', (c) => SUDO.test(c)],
+    ['pipes a download into a shell', (c) => DOWNLOAD.some((re) => re.test(c)) || downloadThenRun(c)],
+    ['runs rm -rf on a variable or a home path', rmWild],
+    ['force-pushes a shared branch', forcePushShared],
+    ['touches a credential file', (c) => CREDENTIAL.test(c) || CREDENTIAL_WRITE.test(c) || CREDENTIAL_READ.test(c)],
+    ['runs destructive SQL off this machine', (c) => DESTRUCTIVE_SQL.test(c)
+            && (namedHosts(c).some((h) => !LOCAL_HOSTS.test(h)) || !/(?:^|[;&|(]\s*)docker\s+exec\b/i.test(c))],
+    ['messages people or submits to an outside service', (c) => MESSAGES.test(c) || ghApiWrite(c)],
+    ['runs Trail itself', (c) => isTrailCommand(c) || TRAIL_VIA.test(c)],
+];
+/** Reason a command can never be in a skill (4.11), or null. */
+export function neverSave(cmd) {
+    const c = String(cmd ?? '');
+    for (const [why, hit] of NEVER) {
+        if (!hit(c))
+            continue;
+        if (why === 'touches a credential file') {
+            const writes = CREDENTIAL_WRITE.test(c) || />>?\s*\S*(?:\.npmrc|\.netrc|credentials|\.ssh\/|config\.json|hosts\.yml|auth\.json|\.kube\/config|\.pypirc|\.pgpass)|\b(?:cp|mv|tee|ln)\b|security\s+add-/i.test(c);
+            return writes ? 'writes a credential file' : 'reads a credential file';
+        }
+        return why;
+    }
+    return null;
+}
+const PASSWORD_AT = [
+    /\b(?:mysql|mysqldump|mysqladmin|mariadb|mariadb-dump)\b[^;&|\n]*?\s-p(?=\S)(\S+)/i,
+    /\b(?:mysql|mysqldump|mysqladmin|mariadb)\b[^;&|\n]*?\s--password=(\S+)/i,
+    /\b(?:docker|podman|nerdctl|buildah|skopeo|oras)\s+login\b[^;&|\n]*?\s(?:-p|--password)(?:=|\s+)(\S+)/i,
+    /\bhelm\s+registry\s+login\b[^;&|\n]*?\s(?:-p|--password)(?:=|\s+)(\S+)/i,
+    /\bsshpass\s+-p\s*(\S+)/i,
+    /\bredis-cli\b[^;&|\n]*?\s(?:-a|--pass)\s+(\S+)/i,
+    /\b(?:echo|printf)\s+(?:-n\s+)?(\S+)\s*\|[^;&\n]*--password-stdin\b/i,
+    /\b(?:PGPASSWORD|MYSQL_PWD|REDISCLI_AUTH|SSHPASS)=(\S+)/,
+];
+/** 4.10 backstop: a password written out after a flag that takes one. The fold names most secrets; these it can't tell from a word. */
+export function literalPassword(cmd) {
+    const c = String(cmd ?? '');
+    return PASSWORD_AT.some((re) => { const v = re.exec(c)?.[1]; return v !== undefined && written(v); });
+}
+//# sourceMappingURL=never-save.js.map

package/dist/skills/never-save.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"never-save.js","sourceRoot":"","sources":["../../src/skills/never-save.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzE,MAAM,WAAW,GAAG,2CAA2C,CAAC;AAChE,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAEzE,4FAA4F;AAC5F,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,kDAAkD,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IACpG,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,oEAAoE,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IACtH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzJ,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACnC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YAC3E,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI;gBAAE,IAAI,GAAG,KAAK,CAAC;iBAChC,IAAI,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;iBACjE,IAAI,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS,KAAK,CAAC,KAAK,aAAa,CAAC;;gBACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,mDAAmD;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;IACnH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxI,8EAA8E;QAC9E,IAAI,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAC/G,MAAM,eAAe,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1I,MAAM,IAAI,GAAG,6DAA6D,CAAC;AAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAA,mEAAmE,CAAC;AACjG,MAAM,QAAQ,GAAG;IACf,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,6CAA6C,UAAU,uBAAuB,EAAE,GAAG,CAAC;IACzG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,6CAA6C,UAAU,+DAA+D,EAAE,GAAG,CAAC;IACjJ,2EAA2E;IAC3E,0EAA0E;CAC3E,CAAC;AACF,sHAAsH;AACtH,SAAS,eAAe,CAAC,IAAY;IACnC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAwC,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,KAAK,GAAG,uGAAuG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtI,IAAI,KAAK,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,WAAW;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtE,+DAA+D;QAC/D,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrI,IAAI,MAAM;YAAE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gCAAgC,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QAC9F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC;YAC7D,kGAAkG;YAClG,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,gHAAgH,CAAC,sBAAsB,CAAC,CAAC;YAC1K,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,+EAA+E,CAAC,sBAAsB,CAAC,CAAC;YAC/I,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,yCAAyC,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjK,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,GAAG,gYAAgY,CAAC;AACpZ;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,0SAA0S,CAAC;AACpU,+CAA+C;AAC/C,MAAM,eAAe,GAAG,qSAAqS,CAAC;AAE9T,MAAM,eAAe,GAAG,odAAod,CAAC;AAE7e,MAAM,QAAQ,GAAG,qUAAqU,CAAC;AACvV,kGAAkG;AAClG,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,gGAAgG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvJ,MAAM,MAAM,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,wDAAwD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5G,OAAO,MAAM,IAAI,mDAAmD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,iHAAiH;AACjH,MAAM,SAAS,GAAG,wHAAwH,CAAC;AAE3I,MAAM,KAAK,GAA8C;IACvD,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,+BAA+B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC,0CAA0C,EAAE,MAAM,CAAC;IACpD,CAAC,8BAA8B,EAAE,eAAe,CAAC;IACjD,CAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/G,CAAC,uCAAuC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;eACnE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC,kDAAkD,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9F,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;CACrE,CAAC;AAEF,gEAAgE;AAChE,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QACtB,IAAI,GAAG,KAAK,2BAA2B,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,4JAA4J,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChN,OAAO,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACzE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAa;IAC5B,mFAAmF;IACnF,yEAAyE;IACzE,uGAAuG;IACvG,yEAAyE;IACzE,yBAAyB;IACzB,iDAAiD;IACjD,qEAAqE;IACrE,wDAAwD;CACzD,CAAC;AAEF,uIAAuI;AACvI,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC"}

package/dist/skills/params.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Parameters in a skill's steps (design 4.5 step 10).
+ *
+ * A step copied from a run carries last time's values: the version it
+ * published, the commit it pushed, the PR it merged, the port the server ran
+ * on. Replayed as they are, they would publish the old version again or push
+ * an old commit. So values of a known shape become `{name}`, every occurrence
+ * of one value under one name, in this order: version, sha, pr, port, branch,
+ * date. A sha defaults to `$(git rev-parse HEAD)` (when it is the only one) and a date to today; a port
+ * or a branch defaults to the value seen; a version and a PR come from the ask.
+ * With the last run of the same job beside this one, a token that differed
+ * between the two (the package a test run named) becomes a parameter too.
+ *
+ * Pure: no files, no clock.
+ */
+import type { PromptParams } from '../trace/types.js';
+import type { ParamDef } from './types.js';
+export declare const STABLE_BRANCHES: ReadonlySet<string>;
+/** Finds shape and varied tokens in kept commands, replaces them with {name}, returns defs (4.5 step 10). */
+export declare function findParams(cmds: string[], ctx: {
+    prompt: PromptParams;
+    prior?: string[] | null;
+    check?: string;
+}): {
+    cmds: string[];
+    check?: string;
+    params: ParamDef[];
+};
+/** Unknown {x} left as is. */
+export declare function fillParams(text: string, values: Record<string, string>): string;
+/** Values for a run block: prompt shapes first, then defaults, then last seen (with a note). */
+export declare function resolveParams(defs: ParamDef[], prompt: PromptParams): {
+    values: Record<string, string>;
+    notes: string[];
+};
+/** 'version, sha=$(git rev-parse HEAD), pkg=workflow'. */
+export declare function paramsToMeta(defs: ParamDef[]): string;
+export declare function metaToParams(s: string | undefined): ParamDef[];
+//# sourceMappingURL=params.d.ts.map

package/dist/skills/params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.d.ts","sourceRoot":"","sources":["../../src/skills/params.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAAmG,CAAC;AAkMpJ,6GAA6G;AAC7G,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,EAAE,CAAA;CAAE,CAYzK;AAED,8BAA8B;AAC9B,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAE/E;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,YAAY,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAkBzH;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,CAErD;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,EAAE,CAY9D"}

package/dist/skills/params.js

@@ -0,0 +1,275 @@
+import { programOf } from '../trace/shell.js';
+import { secretReason } from '../notes/secrets.js';
+export const STABLE_BRANCHES = new Set(['main', 'master', 'beta', 'prod', 'production', 'dev', 'develop', 'staging', 'trunk']);
+const SHA_TOKEN = /^[0-9a-f]{7,40}$/;
+const isSha = (t) => SHA_TOKEN.test(t) && /\d/.test(t) && /[a-f]/.test(t);
+const escapeRe = (t) => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const NAME = /^[A-Za-z_]\w*$/;
+/** Every match of `re`, as the span of its last group. */
+function groupHits(text, re, keep = () => true) {
+    const out = [];
+    for (const m of text.matchAll(re)) {
+        const v = m[m.length - 1];
+        if (v === undefined)
+            continue;
+        const s = m.index + m[0].length - v.length;
+        if (keep(v, s))
+            out.push({ s, e: s + v.length, v });
+    }
+    return out;
+}
+const VERSION = /(?<![\w.])v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.(?!tgz\b)[0-9A-Za-z-]+)*)?)(?![\w-]|\.\d)/g;
+const INSTALL = /^\s*(?:[A-Za-z_]\w*=\S*\s+)*(?:npm\s+(?:i|install|add)|pnpm\s+(?:add|i|install)|yarn\s+(?:global\s+)?add|bun\s+add)\b/;
+function versionHits(text) {
+    return groupHits(text, VERSION, (_v, s) => {
+        const before = text.slice(0, s).replace(/v$/, '');
+        if (/(?:^|[^\w-])(?:node|python|go)@$/.test(before) || /\bnvm\s+(?:use|install)\s+$/.test(before))
+            return false;
+        if (!before.endsWith('@'))
+            return true;
+        const simple = before.split(/&&|\|\||[;|\n(]/).pop() ?? '';
+        return !INSTALL.test(simple);
+    });
+}
+function shaHits(text) {
+    const out = [];
+    const add = (v, s) => { if (isSha(v))
+        out.push({ s, e: s + v.length, v }); };
+    for (const h of groupHits(text, /(?<![0-9A-Za-z])([0-9a-f]{7,40}):refs\//g))
+        add(h.v, h.s);
+    for (const h of groupHits(text, /\bgit\s+push\b[^;&|\n]*?\s\+?([0-9a-f]{7,40}):/g))
+        add(h.v, h.s);
+    for (const h of groupHits(text, /\bcommits\/([0-9a-f]{7,40})(?![0-9A-Za-z])/g))
+        add(h.v, h.s);
+    for (const m of text.matchAll(/\bmerge-base\s+--is-ancestor\s+(\S+)\s+(\S+)/dg)) {
+        add(m[1], m.indices[1][0]);
+        add(m[2], m.indices[2][0]);
+    }
+    const verbs = /\bgit(?:\s+-[Cc]\s+\S+|\s+--[\w-]+=\S+)*\s+(?:checkout|switch|reset|show|revert|cherry-pick|tag|merge|rebase|branch|worktree\s+add|update-ref|format-patch|bisect\s+(?:start|good|bad)|restore)\b([^;&|\n]*)/g;
+    for (const m of text.matchAll(verbs)) {
+        const base = m.index + m[0].length - m[1].length;
+        for (const t of m[1].matchAll(/(?<![0-9A-Za-z])[0-9a-f]{7,40}(?![0-9A-Za-z])/g))
+            add(t[0], base + t.index);
+    }
+    // A full 40-hex commit anywhere (a CI link, an API query) is a commit.
+    for (const t of text.matchAll(/(?<![0-9A-Za-z])[0-9a-f]{40}(?![0-9A-Za-z])/g))
+        add(t[0], t.index);
+    return out.filter((h, i) => out.findIndex((x) => x.s === h.s) === i);
+}
+const PR_CONTEXTS = [/(\bgh\s+pr\s+(?:view|checks|merge|diff|ready|edit|close|checkout|reopen|comment|review|update-branch|lock|unlock)\s+#?)(\d+)\b/g, /(\/pulls?\/)(\d+)\b/g];
+const PORT_CONTEXTS = [
+    /(\b(?:localhost|127\.0\.0\.1|0\.0\.0\.0):)(\d{2,5})\b/g,
+    /(--port[= ])(\d{2,5})\b/g,
+    /(\bPORT=)(\d{2,5})\b/g,
+    /(\b(?:next\s+(?:dev|start)|vite(?:\s+preview)?|serve|http-server)\b[^;&|\n]*?\s-p\s?)(\d{2,5})\b/g,
+    /(\blsof\b[^;&|\n]*?:)(\d{2,5})\b/g,
+    /(\bhttp\.server\s+)(\d{2,5})\b/g,
+];
+const BRANCH_CONTEXTS = [/(refs\/heads\/)([\w./-]+)/g, /(\bgit\s+(?:checkout|switch)\s+-[bcB]\s+)([\w./-]+)/g, /(\bgit\s+push\s+-u\s+\S+\s+)([\w./-]+)/g];
+const DATE = /\b(20\d\d-\d\d-\d\d)\b/g;
+const contextHits = (text, res, keep) => res.flatMap((re) => groupHits(text, re, keep ? (v) => keep(v) : undefined));
+const SHAPES = [
+    // A version the run named elsewhere is the same param in an install pin too (the release, installed to try it).
+    { shape: 'version', hits: versionHits, everywhere: (v) => new RegExp(`(?<=@)${escapeRe(v)}(?![\\w-]|\\.\\d)`, 'g') },
+    { shape: 'sha', hits: shaHits, everywhere: (v) => new RegExp(`(?<![0-9A-Za-z])${v}(?![0-9A-Za-z])`, 'g'), def: () => '$(git rev-parse HEAD)' },
+    { shape: 'pr', hits: (t) => contextHits(t, PR_CONTEXTS) },
+    { shape: 'port', hits: (t) => contextHits(t, PORT_CONTEXTS), def: (v) => v },
+    {
+        shape: 'branch',
+        hits: (t) => contextHits(t, BRANCH_CONTEXTS, (v) => !STABLE_BRANCHES.has(v) && !isSha(v) && /[A-Za-z]/.test(v)),
+        everywhere: (v) => (/[/_-]/.test(v) ? new RegExp(`(?<![\\w./-])${escapeRe(v)}(?![\\w./-])`, 'g') : null),
+        def: (v) => v,
+    },
+    { shape: 'date', hits: (t) => groupHits(t, DATE), everywhere: (v) => new RegExp(`\\b${escapeRe(v)}\\b`, 'g'), def: () => '$(date +%F)' },
+];
+const nextName = (base, used) => {
+    if (!used.has(base))
+        return base;
+    for (let n = 2;; n++)
+        if (!used.has(`${base}_${n}`))
+            return `${base}_${n}`;
+};
+/** Replace spans (no overlaps kept, earliest wins) with their placeholders. */
+function replaceSpans(text, spans) {
+    const sorted = [...spans].sort((a, b) => a.s - b.s || b.e - a.e);
+    let out = '';
+    let at = 0;
+    for (const sp of sorted) {
+        if (sp.s < at)
+            continue;
+        out += text.slice(at, sp.s) + sp.to;
+        at = sp.e;
+    }
+    return out + text.slice(at);
+}
+/** One shape over every text: names by first appearance, then every hit (and, where safe, every occurrence) replaced. */
+function applyShape(texts, spec, prompt, used, defs) {
+    const hits = texts.map((t) => spec.hits(t).filter((h) => !h.v.includes('{')));
+    const values = [];
+    for (const list of hits)
+        for (const h of [...list].sort((a, b) => a.s - b.s))
+            if (!values.includes(h.v))
+                values.push(h.v);
+    if (!values.length)
+        return texts;
+    const names = new Map();
+    const typed = spec.shape === 'version' ? prompt.version : undefined;
+    const order = typed && values.includes(typed) ? [typed, ...values.filter((v) => v !== typed)] : values;
+    for (const v of order) {
+        const n = nextName(spec.shape, used);
+        used.add(n);
+        names.set(v, n);
+    }
+    for (const v of order) {
+        const d = { name: names.get(v), shape: spec.shape, seen: [v] };
+        // Two different commits can't both be HEAD: then no sha has a default, and the agent fills each from the ask.
+        const def = spec.shape === 'sha' && order.length > 1 ? undefined : spec.def?.(v);
+        defs.push(def === undefined ? d : { name: d.name, shape: d.shape, default: def, seen: d.seen });
+    }
+    return texts.map((t, i) => {
+        const spans = hits[i].map((h) => ({ s: h.s, e: h.e, to: `{${names.get(h.v)}}` }));
+        for (const v of values) {
+            const re = spec.everywhere?.(v);
+            if (!re)
+                continue;
+            for (const m of t.matchAll(re))
+                spans.push({ s: m.index, e: m.index + m[0].length, to: `{${names.get(v)}}` });
+        }
+        return replaceSpans(t, spans);
+    });
+}
+const SEP = new Set(['/', '=', ':', '@', ',', '.', '-', '_', '"', "'"]);
+const SHAPE_NAMES = new Set(['version', 'sha', 'pr', 'port', 'branch', 'date']);
+const tokensOf = (cmd) => cmd.split(/(\s+)/);
+/** The differing middle of two tokens, cut at separators: `./internal/workflow/...` vs `./internal/quickbooks/...` -> workflow. */
+function middle(a, b) {
+    let p = 0;
+    while (p < a.length && p < b.length && a[p] === b[p])
+        p++;
+    while (p > 0 && !SEP.has(a[p - 1]))
+        p--;
+    let s = 0;
+    while (s < a.length - p && s < b.length - p && a[a.length - 1 - s] === b[b.length - 1 - s])
+        s++;
+    while (s > 0 && !SEP.has(a[a.length - s]))
+        s--;
+    if (p + s >= a.length || p + s >= b.length)
+        return { pre: '', mid: a, post: '', other: b };
+    return { pre: a.slice(0, p), mid: a.slice(p, a.length - s), post: a.slice(a.length - s), other: b.slice(p, b.length - s) };
+}
+/** 4.5 step 10, `varied`: align by program and order; a pair that differs in 1 or 2 tokens (not already params) gives params. */
+function applyVaried(cmds, check, prior, used, defs) {
+    const swaps = new Map();
+    let args = 0;
+    let j = 0;
+    for (const cmd of cmds) {
+        const prog = programOf(cmd);
+        let k = j;
+        while (k < prior.length && programOf(prior[k]) !== prog)
+            k++;
+        if (k >= prior.length)
+            continue;
+        j = k + 1;
+        const a = tokensOf(cmd);
+        const b = tokensOf(prior[k]);
+        if (a.length !== b.length)
+            continue;
+        const diff = [];
+        for (let t = 0; t < a.length; t += 2)
+            if (a[t] !== b[t] && !a[t].includes('{') && !b[t].includes('{'))
+                diff.push(t);
+        if (diff.length < 1 || diff.length > 2)
+            continue;
+        for (const t of diff) {
+            if (swaps.has(a[t]))
+                continue;
+            // A different flag is a different command, not a value.
+            if (/^-/.test(a[t]) && !a[t].includes('='))
+                continue;
+            // The shell around a word (a subshell's `)`, quotes, a `;`) stays outside the param.
+            const wa = /^([("']*)([\s\S]*?)([)"';]*)$/.exec(a[t]);
+            const wb = /^([("']*)([\s\S]*?)([)"';]*)$/.exec(b[t]);
+            if (wa[1] !== wb[1] || wa[3] !== wb[3])
+                continue;
+            const m = middle(wa[2], wb[2]);
+            const [pre, mid, post, other] = [wa[1] + m.pre, m.mid, m.post + wa[3], m.other];
+            if (!mid || /[()`$;|&<>"']/.test(mid) || secretReason(mid) !== null)
+                continue;
+            const prev = t >= 2 ? a[t - 2] : '';
+            const inToken = /^-{1,2}([A-Za-z][\w-]*)=$/.exec(pre)?.[1];
+            const flag = !pre.replace(/["']/g, '') && /^-{1,2}[A-Za-z][\w-]*$/.test(prev) ? prev.replace(/^-+/, '') : undefined;
+            let base = inToken ?? (/(?:^|\/)(?:internal|packages|apps|services|cmd)\/$/.test(pre) ? 'pkg' : flag);
+            base = base?.toLowerCase().replace(/-/g, '_');
+            if (!base || !NAME.test(base) || SHAPE_NAMES.has(base))
+                base = `arg${++args}`;
+            const name = nextName(base, used);
+            used.add(name);
+            defs.push({ name, shape: 'varied', default: mid, seen: [mid, other] });
+            swaps.set(a[t], `${pre}{${name}}${post}`);
+        }
+    }
+    const swap = (text) => tokensOf(text).map((tok, i) => (i % 2 === 0 && swaps.has(tok) ? swaps.get(tok) : tok)).join('');
+    return { cmds: cmds.map(swap), check: check === undefined ? undefined : swap(check) };
+}
+/** Finds shape and varied tokens in kept commands, replaces them with {name}, returns defs (4.5 step 10). */
+export function findParams(cmds, ctx) {
+    const hasCheck = ctx.check !== undefined;
+    let texts = [...cmds.map(String), ...(hasCheck ? [String(ctx.check)] : [])];
+    const used = new Set();
+    const defs = [];
+    for (const spec of SHAPES)
+        texts = applyShape(texts, spec, ctx.prompt ?? {}, used, defs);
+    let out = { cmds: texts.slice(0, cmds.length), check: hasCheck ? texts[cmds.length] : undefined };
+    if (ctx.prior?.length) {
+        const prior = findParams(ctx.prior, { prompt: ctx.prompt ?? {} }).cmds;
+        out = applyVaried(out.cmds, out.check, prior, used, defs);
+    }
+    return hasCheck ? { cmds: out.cmds, check: out.check, params: defs } : { cmds: out.cmds, params: defs };
+}
+/** Unknown {x} left as is. */
+export function fillParams(text, values) {
+    return String(text ?? '').replace(/\{([A-Za-z_]\w*)\}/g, (m, k) => (Object.hasOwn(values, k) ? values[k] : m));
+}
+/** Values for a run block: prompt shapes first, then defaults, then last seen (with a note). */
+export function resolveParams(defs, prompt) {
+    const values = {};
+    const notes = [];
+    for (const d of defs) {
+        const typed = prompt[d.name];
+        if (d.shape !== 'varied' && d.name === d.shape && typed) {
+            values[d.name] = typed;
+            notes.push(`{${d.name}} is ${typed}, from the ask.`);
+        }
+        else if (d.default !== undefined && d.default.startsWith('$(')) {
+            values[d.name] = d.default;
+        }
+        else {
+            const v = d.default ?? d.seen[0];
+            if (v === undefined || v === '')
+                continue;
+            values[d.name] = v;
+            notes.push(`{${d.name}} is ${v}, as last time; change it if the ask names another.`);
+        }
+    }
+    return { values, notes };
+}
+/** 'version, sha=$(git rev-parse HEAD), pkg=workflow'. */
+export function paramsToMeta(defs) {
+    return defs.map((d) => (d.default === undefined ? d.name : `${d.name}=${d.default}`)).join(', ');
+}
+export function metaToParams(s) {
+    if (typeof s !== 'string' || !s.trim())
+        return [];
+    const out = [];
+    for (const part of s.split(/,\s+/)) {
+        const eq = part.indexOf('=');
+        const name = (eq < 0 ? part : part.slice(0, eq)).trim();
+        if (!NAME.test(name) || out.some((d) => d.name === name))
+            continue;
+        const base = name.replace(/_\d+$/, '');
+        const shape = SHAPE_NAMES.has(base) ? base : 'varied';
+        out.push(eq < 0 ? { name, shape, seen: [] } : { name, shape, default: part.slice(eq + 1).trim(), seen: [] });
+    }
+    return out;
+}
+//# sourceMappingURL=params.js.map

package/dist/skills/params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.js","sourceRoot":"","sources":["../../src/skills/params.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAKpJ,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClF,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACzE,MAAM,IAAI,GAAG,gBAAgB,CAAC;AAE9B,0DAA0D;AAC1D,SAAS,SAAS,CAAC,IAAY,EAAE,EAAU,EAAE,OAA2C,GAAG,EAAE,CAAC,IAAI;IAChG,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAC5C,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,GAAG,4FAA4F,CAAC;AAC7G,MAAM,OAAO,GAAG,uHAAuH,CAAC;AAExI,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAChH,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,0CAA0C,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,iDAAiD,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,6CAA6C,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gDAAgD,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,OAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,OAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,KAAK,GAAG,+MAA+M,CAAC;IAC9N,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,KAAM,CAAC,CAAC;IAC/G,CAAC;IACD,uEAAuE;IACvE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,8CAA8C,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAM,CAAC,CAAC;IACnG,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,iIAAiI,EAAE,sBAAsB,CAAC,CAAC;AAChL,MAAM,aAAa,GAAG;IACpB,wDAAwD;IACxD,0BAA0B;IAC1B,uBAAuB;IACvB,mGAAmG;IACnG,mCAAmC;IACnC,iCAAiC;CAClC,CAAC;AACF,MAAM,eAAe,GAAG,CAAC,4BAA4B,EAAE,sDAAsD,EAAE,yCAAyC,CAAC,CAAC;AAC1J,MAAM,IAAI,GAAG,yBAAyB,CAAC;AAEvC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,GAAa,EAAE,IAA6B,EAAE,EAAE,CACjF,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAE9E,MAAM,MAAM,GAAgI;IAC1I,gHAAgH;IAChH,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,mBAAmB,EAAE,GAAG,CAAC,EAAE;IACpH,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,uBAAuB,EAAE;IAC9I,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE;IACzD,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE;IAC5E;QACE,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/G,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,gBAAgB,QAAQ,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxG,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACd;IACD,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;CACzI,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,IAAiB,EAAE,EAAE;IACnD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAI,CAAC,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AAC9E,CAAC,CAAC;AAEF,+EAA+E;AAC/E,SAAS,YAAY,CAAC,IAAY,EAAE,KAAkD;IACpF,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE;YAAE,SAAS;QACxB,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACpC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,yHAAyH;AACzH,SAAS,UAAU,CAAC,KAAe,EAAE,IAA6B,EAAE,MAAoB,EAAE,IAAiB,EAAE,IAAgB;IAC3H,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,IAAI;QAAE,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1H,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,KAAK,GAAG,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvG,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAa,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,8GAA8G;QAC9G,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACpF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,EAAE;gBAAE,SAAS;YAClB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAM,EAAE,CAAC,EAAE,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAE,GAAG,EAAE,CAAC,CAAC;QACnH,CAAC;QACD,OAAO,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACxE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAChF,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAErD,mIAAmI;AACnI,SAAS,MAAM,CAAC,CAAS,EAAE,CAAS;IAClC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,CAAC,EAAE,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;QAAE,CAAC,EAAE,CAAC;IAChG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC3F,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AAC7H,CAAC;AAED,iIAAiI;AACjI,SAAS,WAAW,CAAC,IAAc,EAAE,KAAyB,EAAE,KAAe,EAAE,IAAiB,EAAE,IAAgB;IAClH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,IAAI;YAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM;YAAE,SAAS;QAChC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,SAAS;QACpC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACjD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;gBAAE,SAAS;YAC/B,wDAAwD;YACxD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,SAAS;YACvD,qFAAqF;YACrF,MAAM,EAAE,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAE,CAAC;YACxD,MAAM,EAAE,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAE,CAAC;YACxD,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAAE,SAAS;YACjD,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC;YACjC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAChF,IAAI,CAAC,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,IAAI;gBAAE,SAAS;YAC9E,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpH,IAAI,IAAI,GAAG,OAAO,IAAI,CAAC,oDAAoD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACtG,IAAI,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,IAAI,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;YAC9E,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACvE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,UAAU,CAAC,IAAc,EAAE,GAAsE;IAC/G,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC;IACzC,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM;QAAE,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzF,IAAI,GAAG,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAClG,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;QACvE,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1G,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,MAA8B;IACrE,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,IAAgB,EAAE,MAAoB;IAClE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,KAAK,GAAI,MAA6C,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC;YACxD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,QAAQ,KAAK,iBAAiB,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;gBAAE,SAAS;YAC1C,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,qDAAqD,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAqB;IAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAClD,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,SAAS;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvC,MAAM,KAAK,GAAsB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;QACpF,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/skills/ran-less.d.ts

@@ -0,0 +1,5 @@
+/** Whether `ran` did less than `step`: see the header. Reads only the simple commands running the step's own (program and verb). */
+export declare function doesLess(step: string, ran: string): boolean;
+/** A call that can't be a step of its own for a fold: it hides its failure, or only rehearsed (`--dry-run`, `-n`). */
+export declare function onlyRehearsed(ran: string): boolean;
+//# sourceMappingURL=ran-less.d.ts.map

package/dist/skills/ran-less.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ran-less.d.ts","sourceRoot":"","sources":["../../src/skills/ran-less.ts"],"names":[],"mappings":"AA4BA,oIAAoI;AACpI,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAY3D;AAED,sHAAsH;AACtH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOlD"}

package/dist/skills/ran-less.js

@@ -0,0 +1,51 @@
+/**
+ * D138 (2): a call that ran a skill's step but made it do less is not that step for credit: it added a flag that
+ * stops the work (`--dry-run`, `-n`, a `-qn` bundle, `--no-...`) the step lacked, or a trailing `; exit 0`,
+ * `|| true`, `|| :` (or `|| exit 0`) that hides the step's failure. Output-only `--no-` flags (colour, progress,
+ * pager, fund, audit, update notices) change nothing the step does, so they still count. Pure.
+ */
+import { simpleCommands } from '../trace/shell.js';
+import { unquote, words } from '../trace/shell-scan.js';
+const LESS = /^(?:--dry-?run|-n|--no-[\w-]+)$/i;
+const OUTPUT_ONLY = /^--no-(?:colou?rs?|progress|pager|fund|audit|update-notifier|emoji|spin(?:ner)?|banner)$/i;
+const HIDES_FAILURE = /(?:;\s*exit\s+0|\|\|\s*(?:true|:|exit\s+0))\s*;?\s*$/;
+/** The do-less flags in one simple command: `--x=y` as `--x`, a short bundle letter by letter. */
+function lessIn(simple) {
+    return words(simple).map((w) => unquote(w)).flatMap((w) => {
+        const f = /^-[A-Za-z]{2,}$/.test(w) ? [...w.slice(1)].map((c) => `-${c}`) : w.startsWith('-') ? [w.split('=')[0]] : [];
+        return f.filter((x) => LESS.test(x) && !OUTPUT_ONLY.test(x));
+    });
+}
+/** What a simple command runs: its program and first word that isn't a flag (`npm run`, `git push`), env assignments off. */
+function head(simple) {
+    const ws = words(simple).map((w) => unquote(w)).filter((w) => !/^[A-Za-z_]\w*=/.test(w));
+    const verb = ws.slice(1).find((w) => !w.startsWith('-'));
+    return ws.length ? `${ws[0]} ${verb ?? ''}` : '';
+}
+/** Whether `ran` did less than `step`: see the header. Reads only the simple commands running the step's own (program and verb). */
+export function doesLess(step, ran) {
+    try {
+        const s = String(step ?? '').trim();
+        const r = String(ran ?? '').trim();
+        if (HIDES_FAILURE.test(r) && !HIDES_FAILURE.test(s))
+            return true;
+        const stepParts = simpleCommands(s);
+        const progs = new Set(stepParts.map(head).filter(Boolean));
+        const had = new Set(stepParts.flatMap(lessIn));
+        return simpleCommands(r).filter((x) => progs.has(head(x))).flatMap(lessIn).some((f) => !had.has(f));
+    }
+    catch {
+        return false;
+    }
+}
+/** A call that can't be a step of its own for a fold: it hides its failure, or only rehearsed (`--dry-run`, `-n`). */
+export function onlyRehearsed(ran) {
+    try {
+        const r = String(ran ?? '').trim();
+        return HIDES_FAILURE.test(r) || simpleCommands(r).flatMap(lessIn).some((f) => !/^--no-/i.test(f));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=ran-less.js.map

package/dist/skills/ran-less.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ran-less.js","sourceRoot":"","sources":["../../src/skills/ran-less.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAExD,MAAM,IAAI,GAAG,kCAAkC,CAAC;AAChD,MAAM,WAAW,GAAG,2FAA2F,CAAC;AAChH,MAAM,aAAa,GAAG,sDAAsD,CAAC;AAE7E,kGAAkG;AAClG,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QACxD,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxH,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6HAA6H;AAC7H,SAAS,IAAI,CAAC,MAAc;IAC1B,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,oIAAoI;AACpI,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,GAAW;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjE,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/skills/risk-delta.d.ts

@@ -0,0 +1,32 @@
+/**
+ * What a fix may not teach (b2 review, D104): the lists a repair's delta is
+ * held to, beside 1a's `neverSave` and `gatedKind` (`risk.ts`). A delta, or
+ * moment 4's fix command, becomes a lesson an agent reads as "what fixed
+ * it", and an agent chose the command, so it may not carry a way around a
+ * check: no flag that skips a hook, forces, widens what may run, points at
+ * another registry or makes the command do less; no env var that carries a
+ * credential, runs code or turns off a check; no step that logs in, changes
+ * config for good or turns off a safety check; nothing that names Trail's,
+ * the host's or the shell's own files; nothing the reader can't see.
+ *
+ * Moved here from `trace/repairs.ts` so moment 4 (offer-lesson.ts) reads the
+ * same lists instead of a copy (D104). Not in `risk.ts`: that file is at its
+ * size limit and on the PreToolUse fast path, which needs none of this.
+ */
+import type { FixDelta } from '../trace/types.js';
+export declare const RISKY_FLAG: RegExp;
+export declare const RISKY_ENV: RegExp;
+export declare const RISKY_STEP: RegExp;
+/** Git config set for one command (`git -c core.hooksPath=/dev/null push`). Case-sensitive: `git -C dir` is a directory. */
+export declare const GIT_INLINE_CONFIG: RegExp;
+export declare const OWN_FILES: RegExp;
+export declare const UNSEEN: RegExp;
+/** A delta that can't be a lesson, beyond `neverSave` and `gatedKind` (b2 review). A short-flag bundle (`-fq`) is read letter by letter. */
+export declare function riskyDelta(d: Pick<FixDelta, 'kind' | 'name' | 'text'>): boolean;
+/**
+ * Moment 4's fix command (4.14 step 3, D104): the whole command read as an enabling step, and each of its env
+ * assignments and flags read as a delta of its own, so `git push --no-verify origin v1.4.3` or `HUSKY=0 git push`
+ * never becomes "what fixed it". True: don't use it (the lesson is the phrase alone).
+ */
+export declare function riskyCommand(cmd: string): boolean;
+//# sourceMappingURL=risk-delta.d.ts.map