@nanonets/graft 0.23.1 → 0.24.0

package/dist/notes/team-check.js

@@ -0,0 +1,130 @@
+/**
+ * Whether something `trail init` found is fit to offer as a team learning:
+ * it is tied to code that exists now, and the repo doesn't already say it.
+ *
+ * A learning a teammate's Claude acts on names the file or function it is
+ * about; that is also what lets trail hand it to Claude when Claude opens
+ * that file. One that names no code is a habit or a status line, and stays
+ * the person's own. One that CLAUDE.md, AGENTS.md or an existing learning
+ * already says adds nothing but noise.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { contextDirFor } from "../context/node-file.js";
+import { loadGraphCached } from "../graph/load.js";
+import { listNotes, mentionedFiles } from "./notes.js";
+const TOUCH_LIMIT = 10;
+/** `foo_test.go`, `foo.test.ts`, `test/…`, `__tests__/…`, `spec/…`. */
+const TEST_PATH = /(?:^|\/)(?:tests?|__tests__|spec)\/|[._-](?:test|spec)\.[A-Za-z]+$|_test\.go$/;
+/** `Foo`, `Foo.bar`, `foo_bar()` in backticks: names a note can give a symbol by. */
+const TICKED = /`([A-Za-z_$][\w$]*(?:(?:\.|::|#)[A-Za-z_$][\w$]*)*)(?:\(\))?`/g;
+/**
+ * The code `text` is about, as `touches:` entries: files it names that exist
+ * in the checkout, `paths` that exist (an inline review comment's file), and
+ * `file#Symbol` for a backticked name the graph knows in one to three places.
+ * Empty when it names no code that exists now.
+ */
+export function codeAnchors(repo, text, paths = []) {
+    const out = [];
+    const add = (t) => {
+        if (out.length < TOUCH_LIMIT && !out.includes(t))
+            out.push(t);
+    };
+    for (const f of mentionedFiles(repo, text))
+        add(f);
+    for (const p of paths)
+        if (p && !p.startsWith("..") && existsSync(join(repo, p)))
+            add(p);
+    const graph = loadGraphCached(contextDirFor(repo));
+    if (!graph)
+        return out;
+    const names = new Set();
+    for (const m of text.matchAll(TICKED)) {
+        const last = m[1].split(/\.|::|#/).pop();
+        // Short or generic words (`id`, `run`) match too much to mean anything.
+        if (last.length >= 4)
+            names.add(last);
+    }
+    if (!names.size)
+        return out;
+    const byName = new Map();
+    for (const n of graph.nodes) {
+        if (n.kind === "file" || !names.has(n.name))
+            continue;
+        const list = byName.get(n.name) ?? [];
+        list.push(n.id);
+        byName.set(n.name, list);
+    }
+    for (const ids of byName.values()) {
+        // A test's fake of a function isn't what the note is about, when the real one is there.
+        const real = ids.filter((id) => !TEST_PATH.test(id.split("#")[0]));
+        const pick = real.length ? real : ids;
+        if (pick.length <= 3)
+            for (const id of pick)
+                add(id);
+    }
+    return out;
+}
+const STOP = new Set("the and for with from that this what when where which into does have has had been being they them their there then than also only just more most some such very will would should could must about after before over under using used make makes made keep keeps kept your yours ours here every each other".split(" "));
+/** The words that carry meaning: four letters or more, not filler. */
+export function contentWords(s) {
+    return new Set(s
+        .toLowerCase()
+        .split(/[^a-z0-9_]+/)
+        .filter((w) => w.length >= 4 && !STOP.has(w)));
+}
+/** Paragraphs and list items of a markdown text, each as its content words. */
+function chunks(text) {
+    return text
+        .split(/\n\s*\n|\n(?=\s*(?:[-*+]|\d+\.)\s)/)
+        .map(contentWords)
+        .filter((w) => w.size >= 3);
+}
+function readText(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return "";
+    }
+}
+export function knownText(repo) {
+    const docs = ["CLAUDE.md", "AGENTS.md", ".claude/CLAUDE.md"].map((f) => readText(join(repo, f)));
+    let notes = [];
+    try {
+        notes = listNotes(repo, { branches: false });
+    }
+    catch {
+        /* no learnings yet */
+    }
+    return {
+        chunks: [...docs.flatMap(chunks), ...notes.flatMap((n) => chunks(n.body))],
+        titles: notes.map((n) => contentWords(n.title)).filter((w) => w.size > 0),
+    };
+}
+/**
+ * Whether the repo already says what a candidate says: most of its title's
+ * and lead's words in one paragraph of CLAUDE.md, AGENTS.md or a learning, or
+ * a learning with nearly the same title.
+ */
+export function alreadySaid(known, title, body) {
+    const t = contentWords(title);
+    if (t.size && known.titles.some((k) => overlap(t, k) >= 0.8 && overlap(k, t) >= 0.8))
+        return true;
+    const lead = body.replace(/^#+ .*$/gm, "").trim().slice(0, 400);
+    const words = contentWords(`${title} ${lead}`);
+    if (words.size < 5)
+        return false;
+    return known.chunks.some((c) => overlap(words, c) >= 0.6);
+}
+/** The share of `a`'s words that are in `b`. */
+function overlap(a, b) {
+    if (!a.size)
+        return 0;
+    let n = 0;
+    for (const w of a)
+        if (b.has(w))
+            n++;
+    return n / a.size;
+}
+//# sourceMappingURL=team-check.js.map

package/dist/notes/team-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-check.js","sourceRoot":"","sources":["../../src/notes/team-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,uEAAuE;AACvE,MAAM,SAAS,GAAG,+EAA+E,CAAC;AAElG,qFAAqF;AACrF,MAAM,MAAM,GAAG,gEAAgE,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,QAAkB,EAAE;IAC1E,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE;QACxB,IAAI,GAAG,CAAC,MAAM,GAAG,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,EAAG,CAAC;QAC3C,wEAAwE;QACxE,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QACtD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,wFAAwF;QACxF,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QACtC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;YAAE,KAAK,MAAM,EAAE,IAAI,IAAI;gBAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,6SAA6S,CAAC,KAAK,CAAC,GAAG,CAAC,CACzT,CAAC;AAEF,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,OAAO,IAAI,GAAG,CACZ,CAAC;SACE,WAAW,EAAE;SACb,KAAK,CAAC,aAAa,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI;SACR,KAAK,CAAC,oCAAoC,CAAC;SAC3C,GAAG,CAAC,YAAY,CAAC;SACjB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,IAAI,KAAK,GAAsC,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgB,EAAE,KAAa,EAAE,IAAY;IACvE,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClG,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,gDAAgD;AAChD,SAAS,OAAO,CAAC,CAAc,EAAE,CAAc;IAC7C,IAAI,CAAC,CAAC,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AACpB,CAAC"}

package/dist/notes/trail-home.d.ts

@@ -0,0 +1,3 @@
+/** `~/.trail`, or `$TRAIL_HOME`. */
+export declare function trailHome(env?: NodeJS.ProcessEnv, home?: string): string;
+//# sourceMappingURL=trail-home.d.ts.map

package/dist/notes/trail-home.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trail-home.d.ts","sourceRoot":"","sources":["../../src/notes/trail-home.ts"],"names":[],"mappings":"AAQA,oCAAoC;AACpC,wBAAgB,SAAS,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEhG"}

package/dist/notes/trail-home.js

@@ -0,0 +1,12 @@
+/**
+ * `~/.trail` on its own, so a hook's fast path (the trace layer, `trail keep`'s
+ * check before a shell command) can find it without loading notes/home.ts and
+ * the front-matter parser that file needs to count learnings.
+ */
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+/** `~/.trail`, or `$TRAIL_HOME`. */
+export function trailHome(env = process.env, home = homedir()) {
+    return env.TRAIL_HOME ? resolve(env.TRAIL_HOME) : join(home, ".trail");
+}
+//# sourceMappingURL=trail-home.js.map

package/dist/notes/trail-home.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trail-home.js","sourceRoot":"","sources":["../../src/notes/trail-home.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,oCAAoC;AACpC,MAAM,UAAU,SAAS,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,OAAe,OAAO,EAAE;IACtF,OAAO,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACzE,CAAC"}

package/dist/skills/answers-prompt.d.ts

@@ -0,0 +1,13 @@
+/** The command, a whole Bash call, answers a login or confirmation prompt for the person. */
+export declare function answersPrompt(cmd: string): boolean;
+/**
+ * D116 item 5: the whole call only feeds keystrokes into a login (`(sleep 15; printf '\n'; sleep 300) | script -q
+ * /dev/null npm login`, `yes | npx vercel login`, `npm login <<< ...`): the login and its service, else null. Such a
+ * step is dropped from a skill and the login becomes a "Before you start" line for the person; what was fed is never
+ * kept. A feed into a publish, `expect`, or a login inside a longer call is not one (still `answersPrompt`).
+ */
+export declare function loginFeed(cmd: string): {
+    service: string;
+    login: string;
+} | null;
+//# sourceMappingURL=answers-prompt.d.ts.map

package/dist/skills/answers-prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"answers-prompt.d.ts","sourceRoot":"","sources":["../../src/skills/answers-prompt.ts"],"names":[],"mappings":"AAwBA,6FAA6F;AAC7F,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAElD;AAgCD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAWhF"}

package/dist/skills/answers-prompt.js

@@ -0,0 +1,83 @@
+/**
+ * A step that answers a login or confirmation prompt for the person (D101
+ * item 4): keystrokes piped or fed into `script`, `expect` or a login or
+ * publish (`(sleep 15; printf '\n'; sleep 300) | script -q /dev/null npm
+ * login`, `yes | npm publish`, `printf 'y\n' | npm login`, `npm login <<<
+ * ...`), or `expect` run at all. Such a step is never kept: the prompt it
+ * answers is the person's, and an agent rightly reads a kept one as a way
+ * round their confirmation.
+ *
+ * Linear: one top-level split per level, groups `( … )` and `{ …; }` read
+ * at most 3 levels deep, and patterns with no nested repetition.
+ */
+import { bareCommand, splitTop } from '../trace/shell.js';
+import { gatedKind, loginOf } from './risk.js';
+const MAX_DEPTH = 3;
+/** A program that writes keystrokes: `printf`, `echo` or `yes` at a command's start. */
+const FEEDER = /(?:^|[;&|({]\s*)(?:printf|echo|yes)(?![\w.-])/;
+/** Programs that drive another program's terminal prompt. */
+const PROMPT_DRIVER = /^(?:script|expect|unbuffer)(?![\w.-])/;
+const EXPECT = /^expect(?![\w.-])/;
+const HERE_STRING = /<<</;
+const STDIN_FLAG = /\s--(?:password-stdin|with-token|stdin)(?![\w-])/;
+/** The command, a whole Bash call, answers a login or confirmation prompt for the person. */
+export function answersPrompt(cmd) {
+    return within(String(cmd ?? ''), 0);
+}
+function within(text, depth) {
+    const segs = splitTop(text);
+    for (let i = 0; i < segs.length; i++) {
+        const seg = segs[i];
+        const t = seg.text.trim();
+        if (EXPECT.test(bareCommand(t)))
+            return true;
+        if (depth < MAX_DEPTH && (t.startsWith('(') || t.startsWith('{'))) {
+            const inner = t.replace(/^[({]/, '').replace(/[)}]$/, '');
+            if (within(inner, depth + 1))
+                return true;
+        }
+        if (HERE_STRING.test(t) && promptTarget(t))
+            return true;
+        const next = segs[i + 1];
+        if (seg.sep === '|' && next && FEEDER.test(t) && promptTarget(next.text))
+            return true;
+    }
+    return false;
+}
+/** What a fed keystroke would answer: a prompt driver, or a login or publish (through its wrappers, risk.ts). */
+function promptTarget(text) {
+    const t = text.trim();
+    if (PROMPT_DRIVER.test(bareCommand(t)))
+        return true;
+    // A flag made to read stdin (`docker login --password-stdin`, `gh auth login --with-token`) is input, not a prompt.
+    if (STDIN_FLAG.test(t))
+        return false;
+    const kind = gatedKind(t);
+    return kind === 'login' || kind === 'publish';
+}
+/** A group or a command that only waits and types: `(sleep 15; printf '\n'; sleep 300)`, `printf 'y\n'`, `yes`. */
+const KEYSTROKES = /^(?:[({]\s*)?(?:(?:sleep\s+[\d.]+|printf\s+(?:'[^']*'|"[^"]*"|[^\s;&|()'"])+|echo(?:\s+(?:'[^']*'|"[^"]*"|[^\s;&|()'"])+)*|yes)\s*(?:;\s*|$|(?=[)}])))+(?:[)}]\s*)?$/;
+/**
+ * D116 item 5: the whole call only feeds keystrokes into a login (`(sleep 15; printf '\n'; sleep 300) | script -q
+ * /dev/null npm login`, `yes | npx vercel login`, `npm login <<< ...`): the login and its service, else null. Such a
+ * step is dropped from a skill and the login becomes a "Before you start" line for the person; what was fed is never
+ * kept. A feed into a publish, `expect`, or a login inside a longer call is not one (still `answersPrompt`).
+ */
+export function loginFeed(cmd) {
+    const text = String(cmd ?? '').trim();
+    if (!answersPrompt(text))
+        return null;
+    const segs = splitTop(text);
+    let target;
+    if (segs.length === 1 && HERE_STRING.test(text))
+        target = text.slice(0, text.search(HERE_STRING));
+    else if (segs.length === 2 && segs[0].sep === '|' && segs[0].text.length <= 4096 && KEYSTROKES.test(segs[0].text.trim()))
+        target = segs[1].text;
+    else
+        return null;
+    const bare = bareCommand(target.trim());
+    if (EXPECT.test(bare) || gatedKind(bare) !== 'login')
+        return null;
+    return loginOf(bare);
+}
+//# sourceMappingURL=answers-prompt.js.map

package/dist/skills/answers-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"answers-prompt.js","sourceRoot":"","sources":["../../src/skills/answers-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE/C,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,wFAAwF;AACxF,MAAM,MAAM,GAAG,+CAA+C,CAAC;AAC/D,6DAA6D;AAC7D,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAC9D,MAAM,MAAM,GAAG,mBAAmB,CAAC;AACnC,MAAM,WAAW,GAAG,KAAK,CAAC;AAC1B,MAAM,UAAU,GAAG,kDAAkD,CAAC;AAEtE,6FAA6F;AAC7F,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,KAAa;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,KAAK,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5C,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iHAAiH;AACjH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,oHAAoH;IACpH,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,CAAC;AAChD,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,GAAG,sKAAsK,CAAC;AAE1L;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,MAAc,CAAC;IACnB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;SAC7F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAE,CAAC,GAAG,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC;;QAC/I,OAAO,IAAI,CAAC;IACjB,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC"}

package/dist/skills/never-save.d.ts

@@ -0,0 +1,5 @@
+/** Reason a command can never be in a skill (4.11), or null. */
+export declare function neverSave(cmd: string): string | null;
+/** 4.10 backstop: a password written out after a flag that takes one. The fold names most secrets; these it can't tell from a word. */
+export declare function literalPassword(cmd: string): boolean;
+//# sourceMappingURL=never-save.d.ts.map

package/dist/skills/never-save.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"never-save.d.ts","sourceRoot":"","sources":["../../src/skills/never-save.ts"],"names":[],"mappings":"AA2HA,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWpD;AAaD,uIAAuI;AACvI,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGpD"}

package/dist/skills/never-save.js

@@ -0,0 +1,158 @@
+/**
+ * Never save (design 4.11, spec 10): a command a skill may never hold, so a
+ * run with one gives no skill at all (sudo, a download piped into a shell,
+ * `rm -rf` on a variable or a home path, a force push to a shared branch, a
+ * credential file, destructive SQL off this machine, anything that messages
+ * people, Trail itself), and the 4.10 password backstop. Split from risk.ts,
+ * whose gated list and agent guard the PreToolUse fast path loads; this file
+ * is for the save side only.
+ */
+import { isTrailCommand } from '../trace/shell.js';
+import { argsAfter, pushes, unknownDst, word, written } from './risk.js';
+const LOCAL_HOSTS = /^(?:localhost|127\.0\.0\.1|::1|\[::1\])$/i;
+const escapeRe = (t) => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+/** Hosts a database command names: `-h x`, `--host=x`, `host=x`, `scheme://user@x:port`. */
+function namedHosts(cmd) {
+    const hosts = [];
+    for (const m of cmd.matchAll(/(?:^|\s)(?:-h|--host)(?:=|\s+)['"]?([^\s'"/;]+)/g))
+        hosts.push(m[1]);
+    for (const m of cmd.matchAll(/\bhost=['"]?([^\s'";]+)/gi))
+        hosts.push(m[1]);
+    for (const m of cmd.matchAll(/\b[a-z][a-z0-9+.-]*:\/\/(?:[^\s/@'"]*@)?(\[[^\]]+\]|[^\s/:'"?]+)/gi))
+        hosts.push(m[1]);
+    return hosts;
+}
+/** A target `rm -r` or `find -delete` must never get: a variable, a {param}, home, an absolute path, the whole folder. */
+const wildTarget = (t) => t !== '{}' && (/^[$~/]|^\.\.(?:\/|$)/.test(t) || /\$|`|\{[A-Za-z_]\w*\}/.test(t) || /^(?:\.\/?|(?:\.\/)?\*)$/.test(t));
+function rmWild(text) {
+    const rms = [...text.matchAll(word('rm'))];
+    for (const [i, m] of rms.entries()) {
+        let recursive = false;
+        let opts = true;
+        const targets = [];
+        for (const w of argsAfter(text, m.index + m[0].length, rms[i + 1]?.index)) {
+            if (opts && w === '--')
+                opts = false;
+            else if (opts && /^-[a-zA-Z]+$/.test(w))
+                recursive ||= /[rR]/.test(w);
+            else if (opts && /^--[\w-]+$/.test(w))
+                recursive ||= w === '--recursive';
+            else
+                targets.push(w);
+        }
+        if (!recursive)
+            continue;
+        // `xargs rm -rf`: the targets come from elsewhere.
+        if (!targets.length ? /\bxargs\b[^;&|\n]*$/.test(text.slice(0, m.index)) : targets.some(wildTarget))
+            return true;
+    }
+    const finds = [...text.matchAll(word('find'))];
+    for (const [i, m] of finds.entries()) {
+        const w = argsAfter(text, m.index + m[0].length, finds[i + 1]?.index);
+        const roots = w.slice(0, Math.max(0, w.findIndex((x) => /^[-(!]/.test(x))));
+        const deletes = w.includes('-delete') || w.some((x, i) => /^-(?:exec|execdir|ok|okdir)$/.test(x) && /(?:^|\/)rm$/.test(w[i + 1] ?? ''));
+        // `find . -name x -exec rm {} +` is fine; a root the skill can't know is not.
+        if (deletes && roots.some((t) => /^[$~/{]/.test(t) || /\$|`/.test(t)))
+            return true;
+    }
+    return false;
+}
+const SHARED = new Set(['main', 'master', 'prod', 'production', 'beta', 'dev', 'develop', 'staging', 'trunk']);
+const forcePushShared = (c) => pushes(c).some((p) => p.force && p.dsts.some((d) => SHARED.has(d.toLowerCase()) || unknownDst(d)));
+const SUDO = /(?:^|[^\w./-])(?:[\w./-]*\/)?(?:sudo|doas|pkexec)(?![\w-])/i;
+const SHELL_WORD = String.raw `(?:sudo\s+(?:-\S+\s+)*)?(?:env\s+(?:\S+=\S*\s+)*)?(?:[\w./-]*\/)?`;
+const DOWNLOAD = [
+    new RegExp(String.raw `\b(?:curl|wget)\b[^\n]*?(?<!\|)\|(?!\|)\s*${SHELL_WORD}(?:ba|z|da|k|fi)?sh\b`, 'i'),
+    new RegExp(String.raw `\b(?:curl|wget)\b[^\n]*?(?<!\|)\|(?!\|)\s*${SHELL_WORD}(?:python[\d.]*|node|perl|ruby|php)(?:\s+-)?\s*(?=$|[;&|)\n])`, 'i'),
+    /(?:\b(?:ba|z|da|k)?sh|\bsource|(?:^|[\s;&|(])\.)\s+<\(\s*(?:curl|wget)\b/i,
+    /\b(?:(?:ba|z|da|k)?sh\s+-\w*c|eval)\s+["']?(?:\$\(|`)\s*(?:curl|wget)\b/i,
+];
+/** `curl -o x.sh URL && sh x.sh`, `wget URL -O s.sh; chmod +x s.sh; ./s.sh`: a download saved to a file, then run. */
+function downloadThenRun(text) {
+    for (const m of text.matchAll(/\b(curl|wget)\b([^;&|\n]*)/gi)) {
+        const [, tool, args] = m;
+        const files = new Set();
+        const named = /(?:\s-[a-zA-Z]*o\s*|\s--output[= ]\s*|\s-O\s*(?=[^\s-])|\s--output-document[= ]\s*)['"]?([^\s'";&|]+)/.exec(args)?.[1];
+        if (named && named !== '-' && named !== '/dev/null')
+            files.add(named);
+        // `wget URL` and `curl -O URL` save under the link's own name.
+        const remote = /^wget$/i.test(tool) ? !/\s-[a-zA-Z]*O\b|--output-document/.test(args) : /\s-[a-zA-Z]*O\b|--remote-name\b/.test(args);
+        if (remote)
+            for (const u of args.matchAll(/https?:\/\/\S*\/([^\s/'"?#]+)/g))
+                files.add(u[1]);
+        const after = text.slice(m.index + m[0].length);
+        for (const f of files) {
+            const e = escapeRe(f.replace(/^\.\//, '').split('/').pop());
+            // Run as a program, or handed to a shell, `source`, `.` or `chmod +x`: at the start of a command.
+            const run = new RegExp(String.raw `(?:^|[;&|(\n]|&&|\|\|)\s*(?:(?:(?:ba|z|da|k)?sh|source|\.|chmod\s+\S*x)\s+)?['"]?(?:\.?\.?\/[^\s'"]*\/|\.\/)?${e}['"]?(?=\s|$|[;&|)])`);
+            const plainName = new RegExp(String.raw `(?:^|[;&|(\n]|&&|\|\|)\s*(?:(?:ba|z|da|k)?sh|source|\.|chmod\s+\S*x)\s+['"]?${e}['"]?(?=\s|$|[;&|)])`);
+            if (plainName.test(after) || (run.test(after) && new RegExp(String.raw `(?:^|[\s;&|(])\.{0,2}\/(?:[^\s'"]*\/)?${e}(?=\s|$|[;&|)'"])`).test(after)))
+                return true;
+        }
+    }
+    return false;
+}
+const CREDENTIAL = /(?:\.npmrc|\.netrc|\.aws\/(?:credentials|sso\/cache|cli\/cache)|(?<![\w.])\.ssh\/|\.git-credentials|\.docker\/config\.json|gh\/hosts\.yml|com\.vercel\.cli\/auth\.json|\.config\/gcloud|Library\/Keychains|\.kube\/config|\.pypirc|\.gem\/credentials|\.cargo\/credentials|\.pgpass|\.my\.cnf|credentials\.tfrc\.json|\.terraformrc|\.config\/hub\b|\.azure\/|\.password-store|\.vault-token)/i;
+/**
+ * Commands that store a credential they were handed where every later command picks it up. Logging in at
+ * the browser (`npm login`, `gh auth login`) needs the person there, holds no secret in the step, and is how
+ * a release gets past an expired token: not on this list, but gated (D93, `login`), so it is never run unasked.
+ */
+const CREDENTIAL_WRITE = /\bnpm\s+config\s+set\s+\S*_(?:auth|password)|\b(?:docker|podman|helm\s+registry)\s+login\b[^;&|\n]*\s(?:-p|--password(?:-stdin)?)\b|\baws\s+configure\s+set\b|\bgit\s+credential\s+(?:approve|store)\b|\bgit\s+config\b[^;&|\n]*\bcredential\.helper\b|\bsecurity\s+add-(?:generic|internet)-password\b/i;
+/** Commands that print a stored credential. */
+const CREDENTIAL_READ = /\bgh\s+auth\s+token\b|\bgit\s+credential\s+fill\b|\bsecurity\s+(?:find|delete)-(?:generic|internet)-password\b|\bsecurity\s+dump-keychain\b|\bop\s+(?:read|item\s+get)\b|\bgcloud\s+auth\s+print-(?:access|identity)-token\b|\bheroku\s+auth:token\b|\bpass\s+show\b|\bvault\s+(?:read|kv\s+get)\b/i;
+const DESTRUCTIVE_SQL = /\b(?:drop\s+(?:table|database|schema|view|materialized\s+view|index|owned|role|user|function|type|sequence|extension)|truncate(?!\s+-)|delete\s+from|alter\s+table\b[^;]*?\bdrop)\b|\bdropdb\b|\bflush(?:all|db)\b|\bdropDatabase\s*\(|\.drop(?:Collection)?\s*\(\s*\)|\bdeleteMany\s*\(\s*\{\s*\}\s*\)|\bsupabase\s+db\s+reset\b[^;&|\n]*--(?:linked|db-url)|\bprisma\s+(?:migrate\s+reset|db\s+push\b[^;&|\n]*--(?:force-reset|accept-data-loss))|\brails\s+db:(?:drop|reset)\b/i;
+const MESSAGES = /\b(?:sendmail|mail\s+-s|mailx|mutt|msmtp|swaks|twilio)\b|\bgit\s+send-email\b|hooks\.slack\.com|\bslack\s+chat\b|graph\.facebook\.com|discord(?:app)?\.com\/api\/webhooks|api\.telegram\.org\/bot|api\.(?:sendgrid\.com|mailgun\.net|postmarkapp\.com|resend\.com)|\bgh\s+(?:issue\s+(?:create|comment)|pr\s+(?:comment|review))\b/i;
+/** `gh api` that writes: a POST/PATCH/PUT, or fields (`-f`, `-F`, `--input`) without `-X GET`. */
+function ghApiWrite(c) {
+    if (!/\bgh\s+api\b/i.test(c))
+        return false;
+    if (/\bgh\s+api\s+graphql\b/i.test(c))
+        return /\bmutation\b[\s\S]*?\b(?:add|create|submit|update)\w*(?:Comment|Review|Issue|Discussion)\w*\b/i.test(c);
+    const method = /(?:-X|--method)[\s=]+([A-Z]+)/i.exec(c)?.[1]?.toUpperCase();
+    const writes = method ? method !== 'GET' : /(?:^|\s)(?:-f|-F|--field|--raw-field|--input)(?=[\s=])/.test(c);
+    return writes && /\/(?:comments|reviews|issues|messages|replies)\b/i.test(c);
+}
+/** Trail run by a wrapper `isTrailCommand` doesn't open: `eval "trail …"`, `xargs trail`, `find -exec trail`. */
+const TRAIL_VIA = /(?:\beval|\bxargs(?:\s+-\S+(?:\s+[^\s-]\S*)?)*|(?<!\S)-(?:exec|execdir|ok|okdir))\s+["']?(?:trail|graft|trail-code)\b/i;
+const NEVER = [
+    ['runs sudo', (c) => SUDO.test(c)],
+    ['pipes a download into a shell', (c) => DOWNLOAD.some((re) => re.test(c)) || downloadThenRun(c)],
+    ['runs rm -rf on a variable or a home path', rmWild],
+    ['force-pushes a shared branch', forcePushShared],
+    ['touches a credential file', (c) => CREDENTIAL.test(c) || CREDENTIAL_WRITE.test(c) || CREDENTIAL_READ.test(c)],
+    ['runs destructive SQL off this machine', (c) => DESTRUCTIVE_SQL.test(c)
+            && (namedHosts(c).some((h) => !LOCAL_HOSTS.test(h)) || !/(?:^|[;&|(]\s*)docker\s+exec\b/i.test(c))],
+    ['messages people or submits to an outside service', (c) => MESSAGES.test(c) || ghApiWrite(c)],
+    ['runs Trail itself', (c) => isTrailCommand(c) || TRAIL_VIA.test(c)],
+];
+/** Reason a command can never be in a skill (4.11), or null. */
+export function neverSave(cmd) {
+    const c = String(cmd ?? '');
+    for (const [why, hit] of NEVER) {
+        if (!hit(c))
+            continue;
+        if (why === 'touches a credential file') {
+            const writes = CREDENTIAL_WRITE.test(c) || />>?\s*\S*(?:\.npmrc|\.netrc|credentials|\.ssh\/|config\.json|hosts\.yml|auth\.json|\.kube\/config|\.pypirc|\.pgpass)|\b(?:cp|mv|tee|ln)\b|security\s+add-/i.test(c);
+            return writes ? 'writes a credential file' : 'reads a credential file';
+        }
+        return why;
+    }
+    return null;
+}
+const PASSWORD_AT = [
+    /\b(?:mysql|mysqldump|mysqladmin|mariadb|mariadb-dump)\b[^;&|\n]*?\s-p(?=\S)(\S+)/i,
+    /\b(?:mysql|mysqldump|mysqladmin|mariadb)\b[^;&|\n]*?\s--password=(\S+)/i,
+    /\b(?:docker|podman|nerdctl|buildah|skopeo|oras)\s+login\b[^;&|\n]*?\s(?:-p|--password)(?:=|\s+)(\S+)/i,
+    /\bhelm\s+registry\s+login\b[^;&|\n]*?\s(?:-p|--password)(?:=|\s+)(\S+)/i,
+    /\bsshpass\s+-p\s*(\S+)/i,
+    /\bredis-cli\b[^;&|\n]*?\s(?:-a|--pass)\s+(\S+)/i,
+    /\b(?:echo|printf)\s+(?:-n\s+)?(\S+)\s*\|[^;&\n]*--password-stdin\b/i,
+    /\b(?:PGPASSWORD|MYSQL_PWD|REDISCLI_AUTH|SSHPASS)=(\S+)/,
+];
+/** 4.10 backstop: a password written out after a flag that takes one. The fold names most secrets; these it can't tell from a word. */
+export function literalPassword(cmd) {
+    const c = String(cmd ?? '');
+    return PASSWORD_AT.some((re) => { const v = re.exec(c)?.[1]; return v !== undefined && written(v); });
+}
+//# sourceMappingURL=never-save.js.map

package/dist/skills/never-save.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"never-save.js","sourceRoot":"","sources":["../../src/skills/never-save.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzE,MAAM,WAAW,GAAG,2CAA2C,CAAC;AAChE,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAEzE,4FAA4F;AAC5F,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,kDAAkD,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IACpG,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,oEAAoE,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IACtH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzJ,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACnC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YAC3E,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI;gBAAE,IAAI,GAAG,KAAK,CAAC;iBAChC,IAAI,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;iBACjE,IAAI,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS,KAAK,CAAC,KAAK,aAAa,CAAC;;gBACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,mDAAmD;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;IACnH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxI,8EAA8E;QAC9E,IAAI,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAC/G,MAAM,eAAe,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1I,MAAM,IAAI,GAAG,6DAA6D,CAAC;AAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAA,mEAAmE,CAAC;AACjG,MAAM,QAAQ,GAAG;IACf,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,6CAA6C,UAAU,uBAAuB,EAAE,GAAG,CAAC;IACzG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,6CAA6C,UAAU,+DAA+D,EAAE,GAAG,CAAC;IACjJ,2EAA2E;IAC3E,0EAA0E;CAC3E,CAAC;AACF,sHAAsH;AACtH,SAAS,eAAe,CAAC,IAAY;IACnC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAwC,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,KAAK,GAAG,uGAAuG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtI,IAAI,KAAK,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,WAAW;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtE,+DAA+D;QAC/D,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrI,IAAI,MAAM;YAAE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gCAAgC,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QAC9F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC;YAC7D,kGAAkG;YAClG,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,gHAAgH,CAAC,sBAAsB,CAAC,CAAC;YAC1K,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,+EAA+E,CAAC,sBAAsB,CAAC,CAAC;YAC/I,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,yCAAyC,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjK,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,GAAG,gYAAgY,CAAC;AACpZ;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,0SAA0S,CAAC;AACpU,+CAA+C;AAC/C,MAAM,eAAe,GAAG,qSAAqS,CAAC;AAE9T,MAAM,eAAe,GAAG,odAAod,CAAC;AAE7e,MAAM,QAAQ,GAAG,qUAAqU,CAAC;AACvV,kGAAkG;AAClG,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,gGAAgG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvJ,MAAM,MAAM,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,wDAAwD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5G,OAAO,MAAM,IAAI,mDAAmD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,iHAAiH;AACjH,MAAM,SAAS,GAAG,wHAAwH,CAAC;AAE3I,MAAM,KAAK,GAA8C;IACvD,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,+BAA+B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC,0CAA0C,EAAE,MAAM,CAAC;IACpD,CAAC,8BAA8B,EAAE,eAAe,CAAC;IACjD,CAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/G,CAAC,uCAAuC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;eACnE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC,kDAAkD,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9F,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;CACrE,CAAC;AAEF,gEAAgE;AAChE,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QACtB,IAAI,GAAG,KAAK,2BAA2B,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,4JAA4J,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChN,OAAO,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACzE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAa;IAC5B,mFAAmF;IACnF,yEAAyE;IACzE,uGAAuG;IACvG,yEAAyE;IACzE,yBAAyB;IACzB,iDAAiD;IACjD,qEAAqE;IACrE,wDAAwD;CACzD,CAAC;AAEF,uIAAuI;AACvI,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC"}

package/dist/skills/params.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Parameters in a skill's steps (design 4.5 step 10).
+ *
+ * A step copied from a run carries last time's values: the version it
+ * published, the commit it pushed, the PR it merged, the port the server ran
+ * on. Replayed as they are, they would publish the old version again or push
+ * an old commit. So values of a known shape become `{name}`, every occurrence
+ * of one value under one name, in this order: version, sha, pr, port, branch,
+ * date. A sha defaults to `$(git rev-parse HEAD)` (when it is the only one) and a date to today; a port
+ * or a branch defaults to the value seen; a version and a PR come from the ask.
+ * With the last run of the same job beside this one, a token that differed
+ * between the two (the package a test run named) becomes a parameter too.
+ *
+ * Pure: no files, no clock.
+ */
+import type { PromptParams } from '../trace/types.js';
+import type { ParamDef } from './types.js';
+export declare const STABLE_BRANCHES: ReadonlySet<string>;
+/** Finds shape and varied tokens in kept commands, replaces them with {name}, returns defs (4.5 step 10). */
+export declare function findParams(cmds: string[], ctx: {
+    prompt: PromptParams;
+    prior?: string[] | null;
+    check?: string;
+}): {
+    cmds: string[];
+    check?: string;
+    params: ParamDef[];
+};
+/** Unknown {x} left as is. */
+export declare function fillParams(text: string, values: Record<string, string>): string;
+/** Values for a run block: prompt shapes first, then defaults, then last seen (with a note). */
+export declare function resolveParams(defs: ParamDef[], prompt: PromptParams): {
+    values: Record<string, string>;
+    notes: string[];
+};
+/** 'version, sha=$(git rev-parse HEAD), pkg=workflow'. */
+export declare function paramsToMeta(defs: ParamDef[]): string;
+export declare function metaToParams(s: string | undefined): ParamDef[];
+//# sourceMappingURL=params.d.ts.map

package/dist/skills/params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.d.ts","sourceRoot":"","sources":["../../src/skills/params.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAAmG,CAAC;AAkMpJ,6GAA6G;AAC7G,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,EAAE,CAAA;CAAE,CAYzK;AAED,8BAA8B;AAC9B,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAE/E;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,YAAY,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAkBzH;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,CAErD;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,EAAE,CAY9D"}