@neurcode-ai/cli 0.14.0 → 0.15.0

package/dist/utils/git-coverage.js

@@ -0,0 +1,302 @@
+"use strict";
+/**
+ * Runtime Admission — git capture (Phase A, CLI side).
+ *
+ * Produces RawDeltaInput[] for the pure governance-runtime core. Two modes:
+ *
+ *   1. captureWorktreeCoverage  — governed-session finish. Post-image object
+ *      ids are computed with `git hash-object` (Git-native, applies .gitattributes
+ *      clean filters) so they equal the blobs that will later be committed.
+ *      We do NOT trust `git diff --raw` new-side ids for unstaged files.
+ *
+ *   2. captureCommittedDelta    — base..head over committed trees (reliable old
+ *      AND new object ids straight from `git diff --raw`). For future Action use.
+ *
+ * Source-free: only paths, modes, and content-addressed object ids leave git.
+ * No file bytes, no diff hunks.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAdmissionSupportArtifactPath = isAdmissionSupportArtifactPath;
+exports.detectGitObjectFormat = detectGitObjectFormat;
+exports.computeWorktreeObject = computeWorktreeObject;
+exports.captureWorktreeCoverage = captureWorktreeCoverage;
+exports.captureCommittedDelta = captureCommittedDelta;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const path_1 = require("path");
+/**
+ * Local runtime state and public admission records are provenance support
+ * artifacts, never governed source effects. Repo-authored policy files such as
+ * `.neurcode/governance.json` remain visible to capture; session/profile/cache
+ * state does not pollute admission coverage.
+ */
+function isAdmissionSupportArtifactPath(path) {
+    const normalized = path.replace(/\\/g, '/').replace(/^\.\//, '');
+    return normalized.startsWith('.neurcode-admission/')
+        || normalized.startsWith('.neurcode/admission/')
+        || normalized.startsWith('.neurcode/sessions/')
+        || normalized.startsWith('.neurcode/evidence/')
+        || normalized.startsWith('.neurcode/executions/')
+        || normalized.startsWith('.neurcode/runtime-events/')
+        || normalized.startsWith('.neurcode/brain/cache/')
+        || normalized === '.neurcode/profile.json'
+        || normalized === '.neurcode/active-session.json'
+        || normalized === '.neurcode/runtime-connection.json'
+        || normalized === '.neurcode/runtime-outbox.json'
+        || normalized === '.neurcode/runtime-outbox.lock'
+        || normalized === '.neurcode/pilot-validation.latest.json'
+        || normalized === '.claude/settings.json'
+        || normalized === '.claude/settings.local.json';
+}
+const NEURCODE_GITIGNORE_HYGIENE_BLOCK = [
+    '# Neurcode runtime vs source separation',
+    '# Ignore all top-level runtime state by default.',
+    '.neurcode/*',
+    '# Allow source-controlled policy + template directories.',
+    '!.neurcode/policies/',
+    '!.neurcode/templates/',
+    '# Keep only canonical policy source JSON files.',
+    '.neurcode/policies/*',
+    '!.neurcode/policies/*.json',
+    '# Runtime-only policy activation snapshots are never committed.',
+    '.neurcode/policies/*.active.json',
+    '# Allow template sources.',
+    '.neurcode/templates/*',
+    '!.neurcode/templates/**',
+    '# Runtime-only files/directories are never committed.',
+    '.neurcode/intent-state.json',
+    '.neurcode/session.json',
+    '.neurcode/cache/',
+    '.neurcode/cache/**',
+];
+function stripNeurcodeGitignoreHygieneBlock(text) {
+    const lines = text.replace(/\r\n/g, '\n').split('\n');
+    for (let i = 0; i <= lines.length - NEURCODE_GITIGNORE_HYGIENE_BLOCK.length; i++) {
+        const matches = NEURCODE_GITIGNORE_HYGIENE_BLOCK.every((line, offset) => lines[i + offset]?.trim() === line);
+        if (!matches)
+            continue;
+        const next = lines[i + NEURCODE_GITIGNORE_HYGIENE_BLOCK.length];
+        const removeCount = next?.trim() === ''
+            ? NEURCODE_GITIGNORE_HYGIENE_BLOCK.length + 1
+            : NEURCODE_GITIGNORE_HYGIENE_BLOCK.length;
+        lines.splice(i, removeCount);
+        break;
+    }
+    return lines.join('\n').trim();
+}
+function isNeurcodeOnlyGitignoreHygieneChange(repoRoot, relPath, baseRef) {
+    if (relPath !== '.gitignore')
+        return false;
+    let currentText = '';
+    try {
+        currentText = (0, fs_1.readFileSync)((0, path_1.join)(repoRoot, relPath), 'utf8');
+    }
+    catch {
+        return false;
+    }
+    const baseText = baseRef ? gitTry(repoRoot, ['show', `${baseRef}:${relPath}`]) ?? '' : '';
+    return stripNeurcodeGitignoreHygieneBlock(currentText) === stripNeurcodeGitignoreHygieneBlock(baseText);
+}
+function gitText(repoRoot, args, input) {
+    return (0, child_process_1.execFileSync)('git', args, {
+        cwd: repoRoot,
+        encoding: 'utf8',
+        stdio: ['pipe', 'pipe', 'ignore'],
+        ...(input !== undefined ? { input } : {}),
+        maxBuffer: 64 * 1024 * 1024,
+    });
+}
+function gitTry(repoRoot, args, input) {
+    try {
+        return gitText(repoRoot, args, input);
+    }
+    catch {
+        return null;
+    }
+}
+function detectGitObjectFormat(repoRoot) {
+    const value = gitTry(repoRoot, ['rev-parse', '--show-object-format']);
+    return value && value.trim() === 'sha256' ? 'sha256' : 'sha1';
+}
+function headExists(repoRoot) {
+    return gitTry(repoRoot, ['rev-parse', '--verify', '--quiet', 'HEAD']) !== null;
+}
+/**
+ * Split `git ... -z` NUL-delimited output into tokens. Trailing empty token from
+ * the final NUL is dropped.
+ */
+function splitZ(output) {
+    if (!output)
+        return [];
+    const parts = output.split('\0');
+    if (parts.length && parts[parts.length - 1] === '')
+        parts.pop();
+    return parts;
+}
+/**
+ * Parse `git diff --raw -z` records. With --no-renames there is exactly one path
+ * per record; R/C are still parsed defensively (src + dst).
+ */
+function parseRawDiff(tokens) {
+    const records = [];
+    let i = 0;
+    while (i < tokens.length) {
+        const meta = tokens[i];
+        if (!meta.startsWith(':')) {
+            i += 1;
+            continue;
+        }
+        // ":<oldmode> <newmode> <oldsha> <newsha> <status>"
+        const fields = meta.slice(1).split(' ').filter(Boolean);
+        const [oldMode, newMode, oldObjectId, newObjectId, status] = fields;
+        const statusLetter = (status || '').charAt(0).toUpperCase();
+        if (statusLetter === 'R' || statusLetter === 'C') {
+            const oldPath = tokens[i + 1];
+            const path = tokens[i + 2];
+            records.push({ oldMode, newMode, oldObjectId, newObjectId, status, path, oldPath });
+            i += 3;
+        }
+        else {
+            const path = tokens[i + 1];
+            records.push({ oldMode, newMode, oldObjectId, newObjectId, status, path });
+            i += 2;
+        }
+    }
+    return records;
+}
+/**
+ * Compute the would-be-committed object id + git mode for a worktree path.
+ * Returns null if the path no longer exists (handled as a delete elsewhere).
+ */
+function computeWorktreeObject(repoRoot, relPath) {
+    const abs = (0, path_1.join)(repoRoot, relPath);
+    let stat;
+    try {
+        stat = (0, fs_1.lstatSync)(abs);
+    }
+    catch {
+        return null;
+    }
+    if (stat.isSymbolicLink()) {
+        const target = (0, fs_1.readlinkSync)(abs);
+        // Git stores a symlink as a blob whose content is the target string (no newline).
+        const objectId = gitTry(repoRoot, ['hash-object', '--stdin', '--no-filters'], target);
+        if (!objectId)
+            return null;
+        return { mode: '120000', objectId: objectId.trim() };
+    }
+    if (stat.isDirectory()) {
+        // A directory is only relevant as a submodule (gitlink): it has its own .git.
+        if ((0, fs_1.existsSync)((0, path_1.join)(abs, '.git'))) {
+            const commit = gitTry(repoRoot, ['-C', relPath, 'rev-parse', 'HEAD']);
+            if (!commit)
+                return null;
+            return { mode: '160000', objectId: commit.trim() };
+        }
+        return null;
+    }
+    // Regular file. `git hash-object` applies .gitattributes clean filters, so the
+    // id matches what will be committed.
+    const objectId = gitTry(repoRoot, ['hash-object', '--', relPath]);
+    if (!objectId)
+        return null;
+    const executable = (stat.mode & 0o111) !== 0;
+    return { mode: executable ? '100755' : '100644', objectId: objectId.trim() };
+}
+/**
+ * Capture the worktree effect set at session finish. Old-side ids come from the
+ * committed base (reliable); new-side ids are recomputed with git hash-object.
+ */
+function captureWorktreeCoverage(repoRoot, options = {}) {
+    const objectFormat = detectGitObjectFormat(repoRoot);
+    const headRef = gitTry(repoRoot, ['rev-parse', '--short=12', 'HEAD'])?.trim() ?? null;
+    const raw = [];
+    const seen = new Set();
+    const hasHead = headExists(repoRoot);
+    const baseRef = hasHead ? options.baseRef || 'HEAD' : null;
+    if (baseRef) {
+        // --abbrev=64 prints full object ids (40 for sha1, 64 for sha256); --raw
+        // abbreviates by default and --full-index does not affect --raw output.
+        const tokens = splitZ(gitTry(repoRoot, ['diff', '--no-renames', '--raw', '--abbrev=64', '-z', baseRef]));
+        for (const rec of parseRawDiff(tokens)) {
+            if (isAdmissionSupportArtifactPath(rec.path))
+                continue;
+            if (isNeurcodeOnlyGitignoreHygieneChange(repoRoot, rec.path, baseRef))
+                continue;
+            seen.add(rec.path);
+            const deleted = rec.status.charAt(0).toUpperCase() === 'D';
+            if (deleted) {
+                raw.push({
+                    path: rec.path,
+                    oldMode: rec.oldMode,
+                    oldObjectId: rec.oldObjectId,
+                    newMode: '000000',
+                    newObjectId: null,
+                });
+                continue;
+            }
+            const worktreeObject = computeWorktreeObject(repoRoot, rec.path);
+            if (!worktreeObject) {
+                // Vanished between diff and stat — treat as a delete against base.
+                raw.push({ path: rec.path, oldMode: rec.oldMode, oldObjectId: rec.oldObjectId, newMode: '000000', newObjectId: null });
+                continue;
+            }
+            const oldPresent = rec.oldMode && rec.oldMode !== '000000' && !/^0+$/.test(rec.oldObjectId);
+            raw.push({
+                path: rec.path,
+                oldMode: oldPresent ? rec.oldMode : '000000',
+                oldObjectId: oldPresent ? rec.oldObjectId : null,
+                newMode: worktreeObject.mode,
+                newObjectId: worktreeObject.objectId,
+            });
+        }
+    }
+    // Untracked (new) files — added.
+    for (const path of splitZ(gitTry(repoRoot, ['ls-files', '--others', '--exclude-standard', '-z']))) {
+        if (isAdmissionSupportArtifactPath(path))
+            continue;
+        if (isNeurcodeOnlyGitignoreHygieneChange(repoRoot, path, baseRef))
+            continue;
+        if (seen.has(path))
+            continue;
+        seen.add(path);
+        const worktreeObject = computeWorktreeObject(repoRoot, path);
+        if (!worktreeObject)
+            continue;
+        raw.push({
+            path,
+            oldMode: '000000',
+            oldObjectId: null,
+            newMode: worktreeObject.mode,
+            newObjectId: worktreeObject.objectId,
+        });
+    }
+    return { objectFormat, raw, baseRef, headRef };
+}
+/**
+ * Capture a committed tree delta (base..head). Both old and new object ids are
+ * read directly from git (reliable for committed trees). --no-renames so renames
+ * arrive as delete + add (the pure core also normalizes any R/C defensively).
+ */
+function captureCommittedDelta(repoRoot, baseRef, headRef) {
+    const objectFormat = detectGitObjectFormat(repoRoot);
+    const tokens = splitZ(gitTry(repoRoot, ['diff', '--no-renames', '--raw', '--abbrev=64', '-z', baseRef, headRef]));
+    const raw = parseRawDiff(tokens)
+        .filter((rec) => !isAdmissionSupportArtifactPath(rec.path))
+        .map((rec) => ({
+        path: rec.path,
+        oldMode: rec.oldMode,
+        oldObjectId: rec.oldObjectId,
+        newMode: rec.newMode,
+        newObjectId: rec.newObjectId,
+        status: rec.status,
+        oldPath: rec.oldPath,
+    }));
+    return {
+        objectFormat,
+        raw,
+        baseRef,
+        headRef: gitTry(repoRoot, ['rev-parse', '--short=12', headRef])?.trim() ?? headRef,
+    };
+}
+//# sourceMappingURL=git-coverage.js.map

package/dist/utils/git-coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-coverage.js","sourceRoot":"","sources":["../../src/utils/git-coverage.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;AAsBH,wEAiBC;AAuED,sDAGC;AA8DD,sDAoCC;AAWD,0DAiEC;AAOD,sDAwBC;AA5TD,iDAA6C;AAC7C,2BAAuE;AACvE,+BAA4B;AAY5B;;;;;GAKG;AACH,SAAgB,8BAA8B,CAAC,IAAY;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,OAAO,UAAU,CAAC,UAAU,CAAC,sBAAsB,CAAC;WAC/C,UAAU,CAAC,UAAU,CAAC,sBAAsB,CAAC;WAC7C,UAAU,CAAC,UAAU,CAAC,qBAAqB,CAAC;WAC5C,UAAU,CAAC,UAAU,CAAC,qBAAqB,CAAC;WAC5C,UAAU,CAAC,UAAU,CAAC,uBAAuB,CAAC;WAC9C,UAAU,CAAC,UAAU,CAAC,2BAA2B,CAAC;WAClD,UAAU,CAAC,UAAU,CAAC,wBAAwB,CAAC;WAC/C,UAAU,KAAK,wBAAwB;WACvC,UAAU,KAAK,+BAA+B;WAC9C,UAAU,KAAK,mCAAmC;WAClD,UAAU,KAAK,+BAA+B;WAC9C,UAAU,KAAK,+BAA+B;WAC9C,UAAU,KAAK,wCAAwC;WACvD,UAAU,KAAK,uBAAuB;WACtC,UAAU,KAAK,6BAA6B,CAAC;AACpD,CAAC;AAED,MAAM,gCAAgC,GAAG;IACvC,yCAAyC;IACzC,kDAAkD;IAClD,aAAa;IACb,0DAA0D;IAC1D,sBAAsB;IACtB,uBAAuB;IACvB,iDAAiD;IACjD,sBAAsB;IACtB,4BAA4B;IAC5B,iEAAiE;IACjE,kCAAkC;IAClC,2BAA2B;IAC3B,uBAAuB;IACvB,yBAAyB;IACzB,uDAAuD;IACvD,6BAA6B;IAC7B,wBAAwB;IACxB,kBAAkB;IAClB,oBAAoB;CACrB,CAAC;AAEF,SAAS,kCAAkC,CAAC,IAAY;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,gCAAgC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACjF,MAAM,OAAO,GAAG,gCAAgC,CAAC,KAAK,CACpD,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,IAAI,CACrD,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,WAAW,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;YACrC,CAAC,CAAC,gCAAgC,CAAC,MAAM,GAAG,CAAC;YAC7C,CAAC,CAAC,gCAAgC,CAAC,MAAM,CAAC;QAC5C,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAC7B,MAAM;IACR,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,oCAAoC,CAAC,QAAgB,EAAE,OAAe,EAAE,OAAsB;IACrG,IAAI,OAAO,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,OAAO,kCAAkC,CAAC,WAAW,CAAC,KAAK,kCAAkC,CAAC,QAAQ,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,OAAO,CAAC,QAAgB,EAAE,IAAc,EAAE,KAAc;IAC/D,OAAO,IAAA,4BAAY,EAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB,EAAE,IAAc,EAAE,KAAc;IAC9D,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CAAC,QAAgB;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACtE,OAAO,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,SAAS,MAAM,CAAC,MAAqB;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAYD;;;GAGG;AACH,SAAS,YAAY,CAAC,MAAgB;IACpC,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,oDAAoD;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;QACpE,MAAM,YAAY,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5D,IAAI,YAAY,KAAK,GAAG,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CACnC,QAAgB,EAChB,OAAe;IAEf,MAAM,GAAG,GAAG,IAAA,WAAI,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,cAAS,EAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QACjC,kFAAkF;QAClF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,8EAA8E;QAC9E,IAAI,IAAA,eAAU,EAAC,IAAA,WAAI,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAC/E,qCAAqC;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;AAC/E,CAAC;AAOD;;;GAGG;AACH,SAAgB,uBAAuB,CACrC,QAAgB,EAChB,UAAkC,EAAE;IAEpC,MAAM,YAAY,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACtF,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3D,IAAI,OAAO,EAAE,CAAC;QACZ,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACzG,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,IAAI,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACvD,IAAI,oCAAoC,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;gBAAE,SAAS;YAChF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC;YAC3D,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,CAAC,IAAI,CAAC;oBACP,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,OAAO,EAAE,QAAQ;oBACjB,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACjE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,mEAAmE;gBACnE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvH,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;gBAC5C,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;gBAChD,OAAO,EAAE,cAAc,CAAC,IAAI;gBAC5B,WAAW,EAAE,cAAc,CAAC,QAAQ;aACrC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,IAAI,8BAA8B,CAAC,IAAI,CAAC;YAAE,SAAS;QACnD,IAAI,oCAAoC,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC;YAAE,SAAS;QAC5E,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,cAAc,GAAG,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,cAAc;YAAE,SAAS;QAC9B,GAAG,CAAC,IAAI,CAAC;YACP,IAAI;YACJ,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,cAAc,CAAC,IAAI;YAC5B,WAAW,EAAE,cAAc,CAAC,QAAQ;SACrC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CACnC,QAAgB,EAChB,OAAe,EACf,OAAe;IAEf,MAAM,YAAY,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAClH,MAAM,GAAG,GAAoB,YAAY,CAAC,MAAM,CAAC;SAC9C,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC,CAAC,CAAC;IACN,OAAO;QACL,YAAY;QACZ,GAAG;QACH,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO;KACnF,CAAC;AACJ,CAAC"}

package/dist/utils/gitignore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gitignore.d.ts","sourceRoot":"","sources":["../../src/utils/gitignore.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA4BH;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAsB,GAAG,IAAI,CAsB3E"}
+{"version":3,"file":"gitignore.d.ts","sourceRoot":"","sources":["../../src/utils/gitignore.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA4BH;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAsB,GAAG,IAAI,CAuB3E"}

package/dist/utils/gitignore.js

@@ -49,7 +49,8 @@ function ensureNeurcodeInGitignore(cwd = process.cwd()) {
         return;
     }
     const block = NEURCODE_HYGIENE_BLOCK.join('\n');
-    const newContent = content.trimEnd() + (content.endsWith('\n') ? '' : '\n') + block + '\n';
+    const existing = content.trimEnd();
+    const newContent = `${existing}${existing.length > 0 ? '\n\n' : ''}${block}\n`;
     (0, fs_1.writeFileSync)(gitignorePath, newContent, 'utf-8');
 }
 //# sourceMappingURL=gitignore.js.map

package/dist/utils/gitignore.js.map

@@ -1 +1 @@
-{"version":3,"file":"gitignore.js","sourceRoot":"","sources":["../../src/utils/gitignore.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AA+BH,8DAsBC;AAnDD,2BAA6D;AAC7D,+BAA4B;AAE5B,MAAM,cAAc,GAAG,YAAY,CAAC;AACpC,MAAM,sBAAsB,GAAG;IAC7B,yCAAyC;IACzC,kDAAkD;IAClD,aAAa;IACb,0DAA0D;IAC1D,sBAAsB;IACtB,uBAAuB;IACvB,iDAAiD;IACjD,sBAAsB;IACtB,4BAA4B;IAC5B,iEAAiE;IACjE,kCAAkC;IAClC,2BAA2B;IAC3B,uBAAuB;IACvB,yBAAyB;IACzB,uDAAuD;IACvD,6BAA6B;IAC7B,wBAAwB;IACxB,kBAAkB;IAClB,oBAAoB;CACrB,CAAC;AAEF;;GAEG;AACH,SAAgB,yBAAyB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACnE,MAAM,aAAa,GAAG,IAAA,WAAI,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAEhD,yCAAyC;IACzC,IAAI,CAAC,IAAA,eAAU,EAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,CAAC,GAAG,sBAAsB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAA,kBAAa,EAAC,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,2BAA2B;IAC3B,MAAM,OAAO,GAAG,IAAA,iBAAY,EAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAE3D,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5G,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;IAC3F,IAAA,kBAAa,EAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"gitignore.js","sourceRoot":"","sources":["../../src/utils/gitignore.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AA+BH,8DAuBC;AApDD,2BAA6D;AAC7D,+BAA4B;AAE5B,MAAM,cAAc,GAAG,YAAY,CAAC;AACpC,MAAM,sBAAsB,GAAG;IAC7B,yCAAyC;IACzC,kDAAkD;IAClD,aAAa;IACb,0DAA0D;IAC1D,sBAAsB;IACtB,uBAAuB;IACvB,iDAAiD;IACjD,sBAAsB;IACtB,4BAA4B;IAC5B,iEAAiE;IACjE,kCAAkC;IAClC,2BAA2B;IAC3B,uBAAuB;IACvB,yBAAyB;IACzB,uDAAuD;IACvD,6BAA6B;IAC7B,wBAAwB;IACxB,kBAAkB;IAClB,oBAAoB;CACrB,CAAC;AAEF;;GAEG;AACH,SAAgB,yBAAyB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACnE,MAAM,aAAa,GAAG,IAAA,WAAI,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAEhD,yCAAyC;IACzC,IAAI,CAAC,IAAA,eAAU,EAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,CAAC,GAAG,sBAAsB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAA,kBAAa,EAAC,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,2BAA2B;IAC3B,MAAM,OAAO,GAAG,IAAA,iBAAY,EAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAE3D,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5G,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG,GAAG,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC;IAC/E,IAAA,kBAAa,EAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC"}

package/dist/utils/governed-intent.d.ts

@@ -0,0 +1,10 @@
+export type GovernedIntentSource = 'prompt' | 'labeled_goal';
+export interface GovernedIntentSelection {
+    goal: string;
+    source: GovernedIntentSource;
+    operatorPrompt: boolean;
+    warnings: string[];
+}
+export declare function selectGovernedIntent(prompt: string): GovernedIntentSelection;
+export declare function shouldStartGovernedSession(selection: GovernedIntentSelection): boolean;
+//# sourceMappingURL=governed-intent.d.ts.map

package/dist/utils/governed-intent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"governed-intent.d.ts","sourceRoot":"","sources":["../../src/utils/governed-intent.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,cAAc,CAAC;AAE7D,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,oBAAoB,CAAC;IAC7B,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA4ED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,uBAAuB,CA8B5E;AAED,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,uBAAuB,GAAG,OAAO,CAEtF"}

package/dist/utils/governed-intent.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.selectGovernedIntent = selectGovernedIntent;
+exports.shouldStartGovernedSession = shouldStartGovernedSession;
+const GOAL_LABEL = /^\s*(?:(?:new|fresh|next)\s+)?(?:governed|implementation|demo|task)\s+(?:goal|intent)\s*:\s*(.*)$/i;
+const OPERATOR_PROMPT_MARKERS = [
+    /\bfounder-demo rehearsal\b/i,
+    /\bdo not (?:refactor|implement|push|change product code)\b/i,
+    /^\s*steps\s*:/im,
+    /^\s*deliver\s*:/im,
+    /^\s*deliverables?\s*:/im,
+    /\buse the real claude code\b/i,
+    /\bonly rehearse\b/i,
+    /\bi (?:can'?t|cannot) approve\b/i,
+    /\bno approval request\b/i,
+    /\bapproval request (?:is )?(?:not )?(?:visible|available)\b/i,
+    /\bdashboard approval\b/i,
+    /\bapprove via dashboard\b/i,
+    /\bfinish (?:the )?(?:report|session)\b/i,
+    /\bmark .* as (?:blocked|blocker)\b/i,
+];
+function cleanGoal(value) {
+    return value
+        .replace(/^```(?:text|md|markdown)?\s*/i, '')
+        .replace(/```\s*$/i, '')
+        .trim();
+}
+function readFencedBlock(lines, startIndex) {
+    const opener = lines[startIndex]?.trim();
+    if (!opener || !/^```/.test(opener))
+        return null;
+    const out = [];
+    for (let i = startIndex + 1; i < lines.length; i++) {
+        if (/^```/.test(lines[i].trim()))
+            break;
+        out.push(lines[i]);
+    }
+    return cleanGoal(out.join('\n'));
+}
+function readNextGoalBlock(lines, startIndex) {
+    for (let i = startIndex; i < lines.length; i++) {
+        const line = lines[i];
+        if (!line.trim())
+            continue;
+        const fenced = readFencedBlock(lines, i);
+        if (fenced)
+            return fenced;
+        if (/^\s*(?:\d+[.)]|[-*+]|\w[\w -]{0,32}:)\s/.test(line))
+            return null;
+        return cleanGoal(line);
+    }
+    return null;
+}
+function extractLabeledGoal(prompt) {
+    const lines = prompt.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const match = lines[i].match(GOAL_LABEL);
+        if (!match)
+            continue;
+        const inline = cleanGoal(match[1] || '');
+        if (inline && !/^```/.test(inline))
+            return inline;
+        const fencedSameLine = inline ? cleanGoal(inline) : null;
+        if (fencedSameLine && !/^```/.test(fencedSameLine))
+            return fencedSameLine;
+        const next = readNextGoalBlock(lines, i + 1);
+        if (next)
+            return next;
+    }
+    return null;
+}
+function isOperatorPrompt(prompt) {
+    if (prompt.length > 900)
+        return true;
+    if (prompt.split(/\r?\n/).length > 12)
+        return true;
+    return OPERATOR_PROMPT_MARKERS.some((marker) => marker.test(prompt));
+}
+function selectGovernedIntent(prompt) {
+    const trimmed = prompt.trim();
+    const operatorPrompt = isOperatorPrompt(trimmed);
+    const labeled = extractLabeledGoal(trimmed);
+    const warnings = [];
+    if (labeled) {
+        if (operatorPrompt) {
+            warnings.push('operator prompt detected; using labeled governed goal for session scope');
+        }
+        return {
+            goal: labeled,
+            source: 'labeled_goal',
+            operatorPrompt,
+            warnings,
+        };
+    }
+    if (operatorPrompt) {
+        warnings.push('prompt looks like operator instructions, not a crisp implementation intent; add `Governed goal:` or `Demo goal:` to avoid noisy scope');
+    }
+    return {
+        goal: trimmed,
+        source: 'prompt',
+        operatorPrompt,
+        warnings,
+    };
+}
+function shouldStartGovernedSession(selection) {
+    return selection.source === 'labeled_goal' || !selection.operatorPrompt;
+}
+//# sourceMappingURL=governed-intent.js.map

package/dist/utils/governed-intent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governed-intent.js","sourceRoot":"","sources":["../../src/utils/governed-intent.ts"],"names":[],"mappings":";;AAmFA,oDA8BC;AAED,gEAEC;AA5GD,MAAM,UAAU,GACd,oGAAoG,CAAC;AAEvG,MAAM,uBAAuB,GAAG;IAC9B,6BAA6B;IAC7B,6DAA6D;IAC7D,iBAAiB;IACjB,mBAAmB;IACnB,yBAAyB;IACzB,+BAA+B;IAC/B,oBAAoB;IACpB,kCAAkC;IAClC,0BAA0B;IAC1B,8DAA8D;IAC9D,yBAAyB;IACzB,4BAA4B;IAC5B,yCAAyC;IACzC,qCAAqC;CACtC,CAAC;AAEF,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC;SAC5C,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,KAAe,EAAE,UAAkB;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,MAAM;QACxC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAe,EAAE,UAAkB;IAC5D,KAAK,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,IAAI,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QAElD,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,IAAI,cAAc,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;YAAE,OAAO,cAAc,CAAC;QAE1E,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAgB,oBAAoB,CAAC,MAAc;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,cAAc,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,cAAc;YACtB,cAAc;YACd,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CACX,uIAAuI,CACxI,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,QAAQ;QAChB,cAAc;QACd,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAgB,0BAA0B,CAAC,SAAkC;IAC3E,OAAO,SAAS,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;AAC1E,CAAC"}

package/dist/utils/hook-heartbeat.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Hook heartbeat — source-free liveness evidence for Claude Code governance hooks.
+ *
+ * Every time a `session-hook start|check|finish` runs, the *currently loaded* hook
+ * records a small, source-free heartbeat under `.neurcode/runtime/`. doctor uses it to
+ * tell whether the running Claude Code session is executing the hooks that are
+ * installed on disk right now — the only reliable signal that activation actually
+ * reached the live agent (hooks load at Claude Code startup and do not hot-reload).
+ *
+ * SOURCE-FREE CONTRACT: the heartbeat contains only the hook entrypoint path, CLI
+ * version, repo root, event type, timestamp, and the (opaque) session id. It never
+ * contains source code, diffs, or prompt/goal text.
+ */
+export declare const HOOK_HEARTBEAT_SCHEMA_VERSION = "neurcode.hook-heartbeat.v1";
+export type HookEventType = 'start' | 'check' | 'finish';
+export interface HookHeartbeatEvent {
+    type: HookEventType;
+    ts: string;
+    /** Source-free session id (opaque hex), when a session is active. */
+    sessionId?: string;
+}
+export interface HookHeartbeat {
+    schemaVersion: typeof HOOK_HEARTBEAT_SCHEMA_VERSION;
+    /** CLI version of the hook that is actually running in the live Claude session. */
+    cliVersion: string;
+    /** Realpath of the entrypoint the live hook is executing (process.argv[1]). */
+    entrypoint: string;
+    /** Short fingerprint of the running entrypoint (source-free). */
+    entrypointFingerprint: string;
+    repoRoot: string;
+    /** Most recent hook event. */
+    lastEvent: HookHeartbeatEvent;
+    /** Last-seen timestamp per event type. */
+    events: Partial<Record<HookEventType, string>>;
+}
+export declare function runtimeDir(repoRoot: string): string;
+export declare function hookHeartbeatPath(repoRoot: string): string;
+/** Short, stable, source-free fingerprint of an entrypoint path. */
+export declare function fingerprintEntrypoint(entrypoint: string): string;
+/** Read the CLI version from the package.json shipped alongside dist/. Best-effort. */
+export declare function readCliVersion(): string;
+/** Realpath of the entrypoint the current process is executing. */
+export declare function runningEntrypoint(): string;
+/**
+ * Record a source-free heartbeat for the hook that is currently running.
+ * Best-effort: any failure is swallowed so the governance hook is never broken.
+ */
+export declare function recordHookHeartbeat(input: {
+    repoRoot: string;
+    eventType: HookEventType;
+    sessionId?: string;
+}): void;
+/** Read the heartbeat, or null when absent/unreadable/invalid. */
+export declare function readHookHeartbeat(repoRoot: string): HookHeartbeat | null;
+//# sourceMappingURL=hook-heartbeat.d.ts.map

package/dist/utils/hook-heartbeat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-heartbeat.d.ts","sourceRoot":"","sources":["../../src/utils/hook-heartbeat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,eAAO,MAAM,6BAA6B,+BAA+B,CAAC;AAE1E,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,OAAO,6BAA6B,CAAC;IACpD,mFAAmF;IACnF,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,8BAA8B;IAC9B,SAAS,EAAE,kBAAkB,CAAC;IAC9B,0CAA0C;IAC1C,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,oEAAoE;AACpE,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,uFAAuF;AACvF,wBAAgB,cAAc,IAAI,MAAM,CAcvC;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,IAAI,MAAM,CAO1C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,aAAa,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,IAAI,CA4BP;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAaxE"}

package/dist/utils/hook-heartbeat.js

@@ -0,0 +1,116 @@
+"use strict";
+/**
+ * Hook heartbeat — source-free liveness evidence for Claude Code governance hooks.
+ *
+ * Every time a `session-hook start|check|finish` runs, the *currently loaded* hook
+ * records a small, source-free heartbeat under `.neurcode/runtime/`. doctor uses it to
+ * tell whether the running Claude Code session is executing the hooks that are
+ * installed on disk right now — the only reliable signal that activation actually
+ * reached the live agent (hooks load at Claude Code startup and do not hot-reload).
+ *
+ * SOURCE-FREE CONTRACT: the heartbeat contains only the hook entrypoint path, CLI
+ * version, repo root, event type, timestamp, and the (opaque) session id. It never
+ * contains source code, diffs, or prompt/goal text.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HOOK_HEARTBEAT_SCHEMA_VERSION = void 0;
+exports.runtimeDir = runtimeDir;
+exports.hookHeartbeatPath = hookHeartbeatPath;
+exports.fingerprintEntrypoint = fingerprintEntrypoint;
+exports.readCliVersion = readCliVersion;
+exports.runningEntrypoint = runningEntrypoint;
+exports.recordHookHeartbeat = recordHookHeartbeat;
+exports.readHookHeartbeat = readHookHeartbeat;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const path_1 = require("path");
+exports.HOOK_HEARTBEAT_SCHEMA_VERSION = 'neurcode.hook-heartbeat.v1';
+function runtimeDir(repoRoot) {
+    return (0, path_1.join)(repoRoot, '.neurcode', 'runtime');
+}
+function hookHeartbeatPath(repoRoot) {
+    return (0, path_1.join)(runtimeDir(repoRoot), 'hook-heartbeat.json');
+}
+/** Short, stable, source-free fingerprint of an entrypoint path. */
+function fingerprintEntrypoint(entrypoint) {
+    return (0, crypto_1.createHash)('sha256').update(entrypoint).digest('hex').slice(0, 16);
+}
+/** Read the CLI version from the package.json shipped alongside dist/. Best-effort. */
+function readCliVersion() {
+    const candidates = [
+        (0, path_1.resolve)(__dirname, '..', '..', 'package.json'),
+        (0, path_1.resolve)(__dirname, '..', 'package.json'),
+    ];
+    for (const candidate of candidates) {
+        try {
+            const pkg = JSON.parse((0, fs_1.readFileSync)(candidate, 'utf8'));
+            if (pkg.version)
+                return pkg.version;
+        }
+        catch {
+            // try next candidate
+        }
+    }
+    return 'unknown';
+}
+/** Realpath of the entrypoint the current process is executing. */
+function runningEntrypoint() {
+    const raw = process.argv[1] ?? '';
+    try {
+        return (0, fs_1.realpathSync)(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+/**
+ * Record a source-free heartbeat for the hook that is currently running.
+ * Best-effort: any failure is swallowed so the governance hook is never broken.
+ */
+function recordHookHeartbeat(input) {
+    try {
+        const entrypoint = runningEntrypoint();
+        const now = new Date().toISOString();
+        const previous = readHookHeartbeat(input.repoRoot);
+        const events = { ...(previous?.events ?? {}) };
+        events[input.eventType] = now;
+        const heartbeat = {
+            schemaVersion: exports.HOOK_HEARTBEAT_SCHEMA_VERSION,
+            cliVersion: readCliVersion(),
+            entrypoint,
+            entrypointFingerprint: fingerprintEntrypoint(entrypoint),
+            repoRoot: input.repoRoot,
+            lastEvent: {
+                type: input.eventType,
+                ts: now,
+                ...(input.sessionId ? { sessionId: input.sessionId } : {}),
+            },
+            events,
+        };
+        const path = hookHeartbeatPath(input.repoRoot);
+        (0, fs_1.mkdirSync)((0, path_1.dirname)(path), { recursive: true });
+        (0, fs_1.writeFileSync)(path, JSON.stringify(heartbeat, null, 2) + '\n', 'utf8');
+    }
+    catch {
+        // Heartbeat is best-effort liveness evidence; never break the hook.
+    }
+}
+/** Read the heartbeat, or null when absent/unreadable/invalid. */
+function readHookHeartbeat(repoRoot) {
+    const path = hookHeartbeatPath(repoRoot);
+    if (!(0, fs_1.existsSync)(path))
+        return null;
+    try {
+        const data = JSON.parse((0, fs_1.readFileSync)(path, 'utf8'));
+        if (!data || data.schemaVersion !== exports.HOOK_HEARTBEAT_SCHEMA_VERSION)
+            return null;
+        if (typeof data.entrypoint !== 'string' || !data.lastEvent || typeof data.lastEvent.ts !== 'string') {
+            return null;
+        }
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=hook-heartbeat.js.map