@nathapp/nax 0.80.1 → 0.81.0-canary.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nathapp/nax",
-  "version": "0.80.1",
+  "version": "0.81.0-canary.2",
   "description": "AI Coding Agent Orchestrator — loops until done",
   "type": "module",
   "bin": {
@@ -11,10 +11,9 @@
     "dev": "bun run bin/nax.ts",
     "build": "bun build bin/nax.ts --outdir dist --target bun --define \"GIT_COMMIT=\\\"$(git rev-parse --short HEAD)\\\"\"",
     "typecheck": "bun x tsc --noEmit && bun x tsc --noEmit -p tsconfig.contracts.json",
-    "lint": "bun x biome check src/ bin/ flows/ && bun run check:flows-no-bun && bun run check:no-real-global-nax && bun run check:feature-dir-ssot && bun run check:alias-internals && bun run check:deep-relatives && bun run check:nax-error && bun run check:logger-storyid && bun run check:log-format-layering && bun run check:file-sizes && bun run check:no-control-bytes",
-    "lint:json": "bun x biome check src/ bin/ flows/ --reporter json && bun run check:nax-error 1>&2 && bun run check:logger-storyid 1>&2",
-    "lint:fix": "bun x biome check --write src/ bin/ flows/",
-    "check:flows-no-bun": "bun run scripts/check-flows-no-bun.ts",
+    "lint": "bun x biome check src/ bin/ && bun run check:no-real-global-nax && bun run check:feature-dir-ssot && bun run check:alias-internals && bun run check:deep-relatives && bun run check:nax-error && bun run check:logger-storyid && bun run check:log-format-layering && bun run check:file-sizes && bun run check:no-control-bytes && bun run check:review-prompts",
+    "lint:json": "bun x biome check src/ bin/ --reporter json && bun run check:nax-error 1>&2 && bun run check:logger-storyid 1>&2",
+    "lint:fix": "bun x biome check --write src/ bin/",
     "check:no-real-global-nax": "bun run scripts/check-no-real-global-nax.ts",
     "check:feature-dir-ssot": "bun run scripts/check-feature-dir-ssot.ts",
     "check:alias-internals": "bun run scripts/check-alias-internals.ts",
@@ -28,6 +27,8 @@
     "check:file-sizes": "bun run scripts/check-file-sizes.ts",
     "check:file-sizes:update": "bun run scripts/check-file-sizes.ts --update-baseline",
     "check:no-control-bytes": "bun run scripts/check-no-control-bytes.ts",
+    "check:review-prompts": "bun run scripts/check-review-prompts-generated.ts",
+    "gen:review-prompts": "bun run scripts/generate-review-prompts.ts",
     "release": "bun scripts/release.ts",
     "test": "AGENT=1 bun run scripts/run-tests.ts",
     "test:verbose": "bun run scripts/run-tests.ts",
@@ -88,7 +89,6 @@
   ],
   "files": [
     "dist/",
-    "flows/",
     "README.md",
     "CHANGELOG.md"
   ],

package/flows/nax-finish/commit-message.ts

@@ -1,239 +0,0 @@
-/**
- * Commit messages for the flow's `commit_<phase>` checkpoints.
- *
- * These commits are shipped history — they land on the feature branch and a
- * human reviews them in the PR. Every one of them used to read
- * `fix(<feature>): nax-finish <phase> fixes` with an empty body, so a reviewer
- * looking at six such commits could not tell which one re-enabled a disabled
- * market gate and which one renamed a variable. The reviewer already produced
- * exactly the material needed to say so — severity, title, problem, fix — and
- * it was being discarded at the one moment it could have been recorded.
- *
- * Subject lines follow the repo's conventional-commit rule and the 72-column
- * git summary convention; the findings go in the body, one bullet each.
- */
-import type { Finding, FindingDisposition, FinishPhase } from "./types";
-
-/** Git's conventional soft cap for a commit summary line. */
-const MAX_SUBJECT_LEN = 72;
-
-/** Worst-first, so the subject of a mixed batch reports the severity that matters. */
-const SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW"] as const;
-
-/** How much gate output to quote in the body before it stops being a commit message. */
-const MAX_GATE_OUTPUT_LINES = 20;
-
-/**
- * Markers a test runner uses to introduce a failing case, worst-supported-first.
- *
- * A heuristic, deliberately: nax orchestrates polyglot repos, so this cannot be
- * one runner's format. Each entry is the literal token that precedes the test's
- * name — bun/jest `(fail)`, go `--- FAIL:`, pytest `FAILED`, and the tick-style
- * reporters. Nothing downstream depends on a match; a miss just falls back to
- * the output tail, which is what shipped before.
- */
-const FAILURE_MARKERS = ["(fail)", "--- FAIL:", "FAILED ", "FAIL ", "✗ ", "× "];
-
-/** How many failing test names to name before the message stops being a commit message. */
-const MAX_NAMED_FAILURES = 10;
-
-/**
- * Strip machine-local filesystem layout out of text bound for shipped history.
- *
- * Two passes, because the two cases differ: a path under the repo is meaningful
- * once made relative, while a path outside it is noise no reader of the commit
- * can act on. The home-directory pattern catches what remains — runner output
- * routinely quotes absolute paths from outside the repo (caches, toolchains).
- */
-function redactPaths(text: string, workdir?: string): string {
-  const withoutRepo = workdir ? text.split(`${workdir}/`).join("") : text;
-  return withoutRepo.replace(/(?:\/Users\/|\/home\/)[^/\s)]+\//g, "~/");
-}
-
-/**
- * The names of the tests that actually failed, in output order.
- *
- * This is the whole point of the change: the body used to be the last 20 lines
- * of runner stdout, and a suite whose *passing* tests write to stderr pushes the
- * real failure out of that window — so the commit named a stack trace from a
- * test that passed (#1506).
- */
-function failingTestNames(output: string): string[] {
-  const names: string[] = [];
-  for (const line of output.split("\n")) {
-    const trimmed = line.trim();
-    const marker = FAILURE_MARKERS.find((m) => trimmed.startsWith(m));
-    if (!marker) continue;
-    // Drop bun's trailing `[0.12ms]` timing — it is noise in a commit message
-    // and makes otherwise-identical messages differ between runs.
-    const name = trimmed
-      .slice(marker.length)
-      .replace(/\s*\[[\d.]+m?s\]$/, "")
-      .trim();
-    if (name) names.push(name);
-  }
-  // Say so when the list is cut short. A bare list of ten reads as "ten tests
-  // failed", and a reader who acts on that count is acting on a truncation.
-  if (names.length > MAX_NAMED_FAILURES) {
-    const dropped = names.length - MAX_NAMED_FAILURES;
-    return [...names.slice(0, MAX_NAMED_FAILURES), `...and ${dropped} more failing test(s)`];
-  }
-  return names;
-}
-
-interface MessageCtx {
-  outputs: Record<string, unknown>;
-}
-
-/** Options carrying what the message builder cannot read off `ctx.outputs`. */
-interface MessageOptions {
-  /** Absolute repo root, used to rewrite quoted paths as repo-relative. */
-  workdir?: string;
-  /**
-   * What `fix_<phase>` did with each finding it was handed, by 1-based index.
-   *
-   * Only `commit_<phase>` callers have this — `gate`/`acceptance` commits, and
-   * any caller that has not run a fix node yet, pass nothing, and every finding
-   * renders as before (`Fix: <text>`).
-   */
-  dispositions?: FindingDisposition[];
-}
-
-interface PhaseOutputs {
-  findings?: Finding[];
-  failing?: string[];
-  output?: string;
-}
-
-function outputsFor(ctx: MessageCtx, nodeId: string): PhaseOutputs {
-  return (ctx.outputs[nodeId] ?? {}) as PhaseOutputs;
-}
-
-function findingsFor(ctx: MessageCtx, phase: FinishPhase): Finding[] {
-  const raw = outputsFor(ctx, `review_${phase}`).findings;
-  return Array.isArray(raw) ? raw.filter((f): f is Finding => Boolean(f?.title)) : [];
-}
-
-function worstSeverity(findings: Finding[]): string {
-  const present = new Set(findings.map((f) => f.severity));
-  return SEVERITY_ORDER.find((s) => present.has(s)) ?? findings[0]?.severity ?? "LOW";
-}
-
-/**
- * Lowercase a finding title's leading word for the subject line.
- *
- * Reviewers write titles as sentences ("Market gate skip branch is
- * unreachable"); conventional-commit subjects read better in lower case. Only
- * the first character is touched — an all-caps leading token is an acronym
- * (`SSRF guard …`) and must survive intact.
- */
-function subjectCase(title: string): string {
-  const [first = "", ...rest] = title.split(" ");
-  const isAcronym = first.length > 1 && first === first.toUpperCase();
-  return isAcronym
-    ? title
-    : `${first.charAt(0).toLowerCase()}${first.slice(1)}${rest.length ? ` ${rest.join(" ")}` : ""}`;
-}
-
-function truncate(s: string): string {
-  return s.length <= MAX_SUBJECT_LEN ? s : `${s.slice(0, MAX_SUBJECT_LEN - 3)}...`;
-}
-
-/** "lint and test", "lint, test and typecheck" — a readable list for the subject. */
-function humanList(items: string[]): string {
-  if (items.length <= 1) return items[0] ?? "";
-  return `${items.slice(0, -1).join(", ")} and ${items[items.length - 1]}`;
-}
-
-function reviewSubject(phase: FinishPhase, findings: Finding[]): string {
-  if (findings.length === 1) return subjectCase(findings[0].title);
-  return `address ${findings.length} ${phase} review findings (worst: ${worstSeverity(findings)})`;
-}
-
-function subjectFor(phase: FinishPhase, ctx: MessageCtx): string {
-  if (phase === "gate") {
-    const failing = outputsFor(ctx, "quality_gates").failing ?? [];
-    return failing.length > 0 ? `repair failing ${humanList(failing)} gates` : "repair failing quality gates";
-  }
-  if (phase === "acceptance") return "repair failing acceptance tests";
-  const findings = findingsFor(ctx, phase);
-  return findings.length > 0 ? reviewSubject(phase, findings) : `apply ${phase} review fixes`;
-}
-
-/**
- * What to quote from a runner's output: the failing test names if they can be
- * identified, otherwise the tail, as before.
- *
- * Never both. Naming the failures *and* pasting the tail reproduces the noise
- * this replaces, and the tail is the weaker signal whenever the names exist.
- */
-function runnerEvidence(output: string, opts: MessageOptions): string {
-  const clean = redactPaths(output, opts.workdir).trim();
-  const names = failingTestNames(clean);
-  if (names.length > 0) return ["Failed tests:", ...names.map((n) => `- ${n}`)].join("\n");
-  return clean.split("\n").slice(-MAX_GATE_OUTPUT_LINES).join("\n");
-}
-
-function bodyFor(phase: FinishPhase, ctx: MessageCtx, opts: MessageOptions): string[] {
-  if (phase === "gate") {
-    const gate = outputsFor(ctx, "quality_gates");
-    const failing = gate.failing ?? [];
-    const evidence = runnerEvidence(gate.output ?? "", opts);
-    return [...(failing.length > 0 ? [`Failing: ${failing.join(", ")}`] : []), ...(evidence ? [evidence] : [])];
-  }
-  if (phase === "acceptance") {
-    const evidence = runnerEvidence(outputsFor(ctx, "acceptance").output ?? "", opts);
-    return evidence ? [evidence] : [];
-  }
-  const findings = findingsFor(ctx, phase);
-  if (findings.length === 0) return [];
-  const dispositions = opts.dispositions ?? [];
-  return [findings.map((f, i) => findingBody(f, i, dispositions)).join("\n")];
-}
-
-/**
- * Render one finding's line(s) in the commit body, honouring `fix_<phase>`'s
- * disposition when one exists.
- *
- * A rejected finding must not read `Fix: <the fix text>` — nothing was applied
- * — so it renders the same way `pr-body.ts`'s `renderRejected` does: as
- * rejected, with its evidence citation, so shipped git history and the PR body
- * agree on what happened to the finding.
- */
-function findingBody(f: Finding, index: number, dispositions: FindingDisposition[]): string {
-  const d = dispositions.find((x) => x.index === index + 1);
-  if (d?.disposition === "rejected") {
-    const evidence = d.evidence ? `\`${d.evidence}\`` : "no evidence cited";
-    const caveat = d.evidenceMissing ? " (evidence path not found)" : "";
-    return [`- [${f.severity}] ${f.title} — rejected: ${evidence}${caveat}`, f.problem ? `  ${f.problem}` : ""]
-      .filter(Boolean)
-      .join("\n");
-  }
-  return [`- [${f.severity}] ${f.title}`, f.problem ? `  ${f.problem}` : "", f.fix ? `  Fix: ${f.fix}` : ""]
-    .filter(Boolean)
-    .join("\n");
-}
-
-/** Human-readable phase label for the attribution trailer. */
-function phaseLabel(phase: FinishPhase): string {
-  return phase === "gate" ? "quality gate" : phase === "acceptance" ? "acceptance" : `${phase} review`;
-}
-
-/**
- * Build the commit message for a `commit_<phase>` checkpoint.
- *
- * Never throws and never returns an empty subject: a missing or malformed
- * reviewer output degrades to the phase label. A commit that cannot be
- * described is still a commit that must happen — failing here would strand the
- * fix uncommitted and reintroduce the stale-diff bug (#1397).
- */
-export function buildFixCommitMessage(
-  phase: FinishPhase,
-  feature: string,
-  ctx: MessageCtx,
-  opts: MessageOptions = {},
-): string {
-  const subject = truncate(`fix(${feature}): ${subjectFor(phase, ctx)}`);
-  const body = bodyFor(phase, ctx, opts);
-  return [subject, ...body, `nax-finish: ${phaseLabel(phase)} fixes`].join("\n\n");
-}

package/flows/nax-finish/errors.ts

@@ -1,23 +0,0 @@
-/**
- * Self-contained error type for the nax-finish flow.
- *
- * The flow module is loaded by `acpx flow run` from wherever `flows/` happens
- * to be installed, in acpx's own process, with the *user's* repo as cwd. It
- * therefore cannot import from nax's `src/` — neither via the `@/*` path alias
- * (which only resolves through nax's own tsconfig) nor via a relative path
- * (only `flows/` is published, not `src/`). `FinishError` mirrors `NaxError`'s
- * shape (message + machine-readable code + structured context) so escalation
- * output and logs stay consistent with the rest of nax.
- */
-export class FinishError extends Error {
-  readonly code: string;
-  readonly context: Record<string, unknown>;
-
-  constructor(message: string, code: string, context: Record<string, unknown> = {}) {
-    const { cause, ...rest } = context;
-    super(message, cause === undefined ? undefined : { cause });
-    this.name = "FinishError";
-    this.code = code;
-    this.context = rest;
-  }
-}

package/flows/nax-finish/exec.ts

@@ -1,135 +0,0 @@
-/**
- * Subprocess execution for the nax-finish flow.
- *
- * Two distinct entry points, deliberately:
- *
- * - `runArgv` — for commands *this flow* constructs (`git`, `gh`, `glab`). An
- *   argv array is spawned directly: no shell, so no quoting or injection
- *   surface for branch names and review text.
- * - `runShell` — for command *strings the user configured* (`quality.commands`,
- *   `acceptance.command`). These are run through `/bin/sh -c`, matching
- *   `src/quality/runner.ts`, which is the only way to preserve `&&`, quoting,
- *   globs and env prefixes. Splitting such a string on whitespace and spawning
- *   argv (the previous behaviour) silently mis-ran every non-trivial command.
- *
- * Both cap wall-clock time: an unbounded gate would hang `acpx flow run`, and
- * the post-run plugin awaits that subprocess.
- *
- * ## Why `node:child_process` and not `Bun.spawn`
- *
- * The rest of nax is Bun-native (see `.claude/rules/project-conventions.md`),
- * but this module is **not** loaded by nax. `acpx flow run` loads it, in acpx's
- * own process, and the published `acpx` binary is a Node program
- * (`#!/usr/bin/env node`). Under Node the `Bun` global does not exist, so
- * `Bun.spawn` threw `ReferenceError: Bun is not defined` on the flow's very
- * first git call — aborting the flow before any node completed and before the
- * result file was written. Everything under `flows/` must therefore stay on
- * Node built-ins; `Bun.*` is banned here and only here, enforced by
- * `scripts/check-flows-no-bun.ts`.
- */
-import { spawn } from "node:child_process";
-import type { RunResult } from "./types";
-
-/** Fallbacks used when the plugin passes no explicit budget in the flow input. */
-export const DEFAULT_ACCEPTANCE_TIMEOUT_MS = 600_000;
-export const DEFAULT_GATE_TIMEOUT_MS = 900_000;
-/** Short budget for the flow's own git/forge plumbing — these are never long-running. */
-export const DEFAULT_ARGV_TIMEOUT_MS = 120_000;
-
-export interface ExecOptions {
-  cwd: string;
-  timeoutMs?: number;
-}
-
-/** Exit code reported when the wall-clock cap kills the process, matching `timeout(1)`. */
-const TIMEOUT_EXIT_CODE = 124;
-/** Exit code reported when the binary is missing, matching a shell's "command not found". */
-const NOT_FOUND_EXIT_CODE = 127;
-
-function spawnCapture(cmd: string[], opts: ExecOptions): Promise<RunResult> {
-  return new Promise<RunResult>((resolve) => {
-    const [file, ...args] = cmd;
-    // `detached: true` puts the child in its own process group so we can
-    // SIGKILL the whole tree when the timer fires — otherwise a SIGTERM on
-    // `sh` only kills the shell, and any inherited pipes from a still-running
-    // child (e.g. `sleep 30`) keep `close` from firing until the child exits.
-    const proc = spawn(file as string, args, {
-      cwd: opts.cwd,
-      stdio: ["ignore", "pipe", "pipe"],
-      detached: true,
-    });
-    let stdout = "";
-    let stderr = "";
-    let timedOut = false;
-    let settled = false;
-
-    proc.stdout.setEncoding("utf8");
-    proc.stderr.setEncoding("utf8");
-    proc.stdout.on("data", (chunk: string) => {
-      stdout += chunk;
-    });
-    proc.stderr.on("data", (chunk: string) => {
-      stderr += chunk;
-    });
-
-    // setTimeout (not a sleep) because the handle must be cancellable the moment
-    // the process exits — the documented exception in forbidden-patterns.md.
-    const timer =
-      opts.timeoutMs && opts.timeoutMs > 0
-        ? setTimeout(() => {
-            timedOut = true;
-            if (proc.pid !== undefined) {
-              // Negative pid = process group. SIGKILL cannot be ignored,
-              // guarantees the child tree (and inherited pipes) actually close.
-              try {
-                process.kill(-proc.pid, "SIGKILL");
-              } catch {
-                // Group already gone.
-              }
-            }
-          }, opts.timeoutMs)
-        : undefined;
-
-    const settle = (result: RunResult): void => {
-      if (settled) return;
-      settled = true;
-      if (timer) clearTimeout(timer);
-      resolve(result);
-    };
-
-    // A missing binary (`gh`/`glab` not installed) surfaces as an `error` event
-    // under Node, where `Bun.spawn` used to throw. Resolving with 127 instead of
-    // rejecting keeps it a readable gate failure the flow can route on, rather
-    // than an exception that kills `acpx flow run` with no result file.
-    proc.on("error", (err: Error) => {
-      settle({ exitCode: NOT_FOUND_EXIT_CODE, stdout, stderr: `${stderr}${err.message}`, timedOut });
-    });
-
-    // `close` (not `exit`) so both pipes are fully drained before we read them.
-    // `code` is null when the process died from a signal — including our own
-    // timeout kill — so it maps to a non-zero code rather than a false green.
-    proc.on("close", (code: number | null) => {
-      const exitCode = code ?? (timedOut ? TIMEOUT_EXIT_CODE : 1);
-      settle(
-        timedOut
-          ? {
-              exitCode: exitCode === 0 ? TIMEOUT_EXIT_CODE : exitCode,
-              stdout,
-              stderr: `${stderr}\n[nax-finish] killed after ${opts.timeoutMs}ms timeout`,
-              timedOut: true,
-            }
-          : { exitCode, stdout, stderr },
-      );
-    });
-  });
-}
-
-/** Spawn an argv array directly — no shell. For flow-constructed commands. */
-export function runArgv(cmd: string[], opts: ExecOptions): Promise<RunResult> {
-  return spawnCapture(cmd, { ...opts, timeoutMs: opts.timeoutMs ?? DEFAULT_ARGV_TIMEOUT_MS });
-}
-
-/** Run a configured command string through `/bin/sh -c`, preserving shell semantics. */
-export function runShell(command: string, opts: ExecOptions): Promise<RunResult> {
-  return spawnCapture(["/bin/sh", "-c", command], opts);
-}

package/flows/nax-finish/findings-parse.ts

@@ -1,150 +0,0 @@
-/**
- * Turning a reviewer's free-form reply into structured findings.
- *
- * The reviewer's contract is text, not JSON, for two reasons. The dimension
- * references both hinge on an enumeration — a per-AC walk and a per-changed-
- * function walk — and a reply constrained to one JSON object has nowhere to put
- * one. And a text reply has no cliff: a malformed line costs that line, where an
- * unparseable JSON object used to cost the entire review (#1614).
- *
- * Every function here is pure and non-throwing. `verdict.ts` documents why that
- * is load-bearing: a throw inside an acpx `parse` fails the whole flow.
- */
-import type { Finding, FindingDisposition, ReviewReport, Severity, Touchpoint } from "./types";
-
-type Section = "touchpoints" | "walk" | "findings";
-
-/** Headings are matched loosely — any level, any case, optional trailing colon. */
-const HEADING = /^\s*#{1,6}\s*(TOUCHPOINTS|WALK|FINDINGS|DISPOSITIONS)\s*:?\s*$/i;
-const BLOCK = /^\s*\[(CRITICAL|HIGH|MEDIUM|LOW)\]\s+(.+?)\s*$/;
-const FIELD = /^\s*(Problem|Fix|Judgment)\s*:\s*(.*)$/i;
-const NO_FINDINGS = /^\s*no findings\.?\s*$/i;
-const BULLET = /^\s*[-*]\s+(.+?)\s*$/;
-const DISPOSITION = /^\s*\[?(\d+)\]?\s*[.:)]?\s*(fixed|rejected)\b\s*(.*)$/i;
-const EVIDENCE = /evidence\s*:\s*(\S+)/i;
-
-/** `- path/to/file.ts:symbol — why`, tolerant of backticks and of `-` for `—`. */
-function parseTouchpoint(text: string): Touchpoint | null {
-  const m = /^(\S+)\s*(?:[—–-]\s*)?(.*)$/.exec(text);
-  if (!m) return null;
-  const locator = m[1].replace(/[`,]/g, "");
-  const note = m[2].trim();
-  if (/^none$/i.test(locator)) return { path: "none", note };
-  const cut = locator.lastIndexOf(":");
-  return cut > 0 ? { path: locator.slice(0, cut), symbol: locator.slice(cut + 1), note } : { path: locator, note };
-}
-
-function parseJudgment(value: string): { judgment: boolean; judgmentReason?: string } {
-  const m = /^\s*(yes|true)\b\s*(?:[—–-]\s*)?(.*)$/i.exec(value);
-  if (!m) return { judgment: false };
-  const reason = m[2].trim();
-  return reason ? { judgment: true, judgmentReason: reason } : { judgment: true };
-}
-
-/**
- * Parse a reviewer reply.
- *
- * Section state starts at `findings`, not "none": a reviewer that emits blocks
- * and no headings at all is a partial failure of the contract, and its findings
- * are still worth keeping — losing them is the exact failure this replaces. The
- * `saw*Section` flags stay false in that case, which is what the audit gate in
- * `steps/review-audit.ts` keys off.
- */
-export function parseReviewReport(text: string): ReviewReport {
-  const report: ReviewReport = {
-    findings: [],
-    touchpoints: [],
-    walk: [],
-    sawNoFindings: false,
-    sawTouchpointsSection: false,
-    sawWalkSection: false,
-  };
-  let section: Section = "findings";
-  let current: Finding | null = null;
-  let lastField: "problem" | "fix" | null = null;
-
-  const flush = () => {
-    if (current) report.findings.push(current);
-    current = null;
-    lastField = null;
-  };
-
-  for (const line of text.split("\n")) {
-    const heading = HEADING.exec(line);
-    if (heading) {
-      flush();
-      const name = heading[1].toLowerCase();
-      if (name === "touchpoints") {
-        section = "touchpoints";
-        report.sawTouchpointsSection = true;
-      } else if (name === "walk") {
-        section = "walk";
-        report.sawWalkSection = true;
-      } else {
-        section = "findings";
-      }
-      continue;
-    }
-
-    if (section === "touchpoints") {
-      const bullet = BULLET.exec(line);
-      const tp = bullet ? parseTouchpoint(bullet[1]) : null;
-      if (tp) report.touchpoints.push(tp);
-      continue;
-    }
-    if (section === "walk") {
-      if (line.trim().length > 0) report.walk.push(line.trim());
-      continue;
-    }
-
-    const block = BLOCK.exec(line);
-    if (block) {
-      flush();
-      current = { severity: block[1] as Severity, title: block[2], problem: "", fix: "" };
-      continue;
-    }
-    if (NO_FINDINGS.test(line)) {
-      report.sawNoFindings = true;
-      continue;
-    }
-    if (!current) continue;
-    const field = FIELD.exec(line);
-    if (field) {
-      const key = field[1].toLowerCase();
-      if (key === "problem") {
-        current.problem = field[2].trim();
-        lastField = "problem";
-      } else if (key === "fix") {
-        current.fix = field[2].trim();
-        lastField = "fix";
-      } else {
-        Object.assign(current, parseJudgment(field[2]));
-        lastField = null;
-      }
-      continue;
-    }
-    // A continuation line for the field above it — the reviewer wraps prose, and
-    // a wrapped Problem read as nothing is how detail silently disappears.
-    if (lastField && line.trim().length > 0) {
-      current[lastField] = `${current[lastField]} ${line.trim()}`.trim();
-    }
-  }
-  flush();
-  return report;
-}
-
-/** Parse the `## DISPOSITIONS` section of a fix node's reply. */
-export function parseDispositions(text: string): FindingDisposition[] {
-  const out: FindingDisposition[] = [];
-  for (const line of text.split("\n")) {
-    const m = DISPOSITION.exec(line);
-    if (!m) continue;
-    const evidence = EVIDENCE.exec(m[3])?.[1];
-    out.push({
-      index: Number(m[1]),
-      disposition: m[2].toLowerCase() as "fixed" | "rejected",
-      ...(evidence ? { evidence } : {}),
-    });
-  }
-  return out;
-}