@open-agent-toolkit/cli 0.2.66 → 0.2.67

package/dist/commands/project/log/append.js

@@ -12,7 +12,8 @@ import { resolveAssetsRoot } from '../../../fs/assets.js';
 import { dirExists, fileExists } from '../../../fs/io.js';
 import { resolveProjectRoot } from '../../../fs/paths.js';
 import { Command } from 'commander';
-import { composeJudgmentHeading, composeStructuralHeading, isProjectLogEntryMarker, isProjectLogSectionMarker, PROJECT_LOG_AREA_MAX_LENGTH, PROJECT_LOG_HEADING_DELIMITER, PROJECT_LOG_SCOPES, PROJECT_LOG_TYPES, } from './grammar.js';
+import { findProjectLogAmbiguity, findProjectLogSeal, unreachableProjectLogSealError, } from './check.js';
+import { composeJudgmentHeading, composeStructuralHeading, containsAmbiguousProjectLogMarker, isProjectLogEntryMarker, findProjectLogSealHeadingLine, isProjectLogSealHeading, isProjectLogSectionMarker, PROJECT_LOG_AREA_MAX_LENGTH, PROJECT_LOG_HEADING_DELIMITER, PROJECT_LOG_LINE_TERMINATOR_RE, PROJECT_LOG_LONE_TERMINATOR_RE, PROJECT_LOG_SCOPES, PROJECT_LOG_TYPES, normalizeProjectLogLineEndings, splitProjectLogLines, } from './grammar.js';
 export const PROJECT_LOG_FILENAME = 'project-log.md';
 const SYNTHESIS_HEADING_PREFIX = '\n## End-of-run synthesis';
 /**
@@ -331,8 +332,13 @@ function releaseProjectLogLock(handle) {
  * `best-effort` is for work that cannot lose an entry — committing does not
  * rewrite the log — where holding the lock only keeps this process from racing
  * its own sibling into `.git/index.lock`.
+ *
+ * Exported so `synthesize` enters the same critical section rather than a
+ * second one of its own: its whole-file rewrite races an overlapping append
+ * exactly as two appends race each other, and two locks would serialize
+ * neither.
  */
-async function withProjectLogLock(logPath, overrides, policy, mutate) {
+export async function withProjectLogLock(logPath, overrides, policy, mutate) {
     const handle = await acquireProjectLogLock(logPath, overrides);
     if (!handle.held && policy === 'required') {
         throw new Error(`Timed out waiting for the project log lock at ${handle.path}. Another writer is holding it; retry once it finishes.`);
@@ -794,6 +800,33 @@ export function findProjectLogEntryByIdempotencyKey(content, key, body) {
     }
     return undefined;
 }
+/**
+ * Raised when an append that is not the completion seal targets a sealed log.
+ *
+ * This is a throw rather than a fourth `ProjectLogAppendResult` variant because
+ * every in-tree caller of `appendProjectLog` runs *before* the seal: the gate's
+ * partial-finalization receipt narrows the result's `status` into its own
+ * `'appended' | 'already-appended'` field, so widening the union would force a
+ * change on a caller that can never legitimately reach this state. Throwing
+ * refuses that caller too — the command layer maps this to
+ * `status: 'sealed'` with a non-zero exit, and any other caller fails loudly
+ * instead of silently appending past the seal.
+ */
+export class ProjectLogSealedError extends Error {
+    logPath;
+    seal;
+    /**
+     * `action` names the refused mutation so `synthesize`, which rewrites rather
+     * than appends, reports what it actually declined. It defaults to `append`,
+     * which is the wording every existing caller and its pinned control expect.
+     */
+    constructor(logPath, seal, action = 'append') {
+        super(`No project-log ${action} may follow the completion seal (${seal.heading}) in ${logPath}.`);
+        this.name = 'ProjectLogSealedError';
+        this.logPath = logPath;
+        this.seal = seal;
+    }
+}
 const DEFAULT_APPEND_DEPENDENCIES = {
     resolveActiveProject,
     resolveEffectiveConfig,
@@ -825,7 +858,7 @@ function validateSingleLine(value, option, maxLength = PROJECT_LOG_AREA_MAX_LENG
     if (!normalized) {
         throw new Error(`${option} is required and must be a non-empty single line.`);
     }
-    if (/[\r\n]/.test(value ?? '')) {
+    if (PROJECT_LOG_LINE_TERMINATOR_RE.test(value ?? '')) {
         throw new Error(`${option} must be a single line without newline characters.`);
     }
     if (normalized.length > maxLength) {
@@ -846,16 +879,43 @@ function validateVersionNote(value) {
     }
     return validateSingleLine(value, '--version-note', Number.MAX_SAFE_INTEGER);
 }
+/**
+ * Whether any line of `body` is a `## ` or `### ` marker the command owns.
+ *
+ * The split is `splitProjectLogLines` rather than `/\r?\n/` so validation
+ * enumerates exactly the LineTerminators a regular expression's multiline `^`
+ * anchors after. Splitting on fewer of them was the injection: a body reading
+ * `carrier<CR>## Injected` was one unbroken line here and so passed, while the
+ * section parser saw a real `## ` boundary and truncated the entries region,
+ * voiding an already-written completion seal.
+ */
 function containsCommandOwnedMarker(body) {
-    return body
-        .split(/\r?\n/)
-        .some((line) => isProjectLogSectionMarker(line) || isProjectLogEntryMarker(line));
+    return splitProjectLogLines(body).some((line) => isProjectLogSectionMarker(line) || isProjectLogEntryMarker(line));
 }
 function validateEntry(input, date) {
-    const body = input.body?.trim();
-    if (!body) {
+    // The lone-terminator rule is tested against the *raw* body, before trimming.
+    // `String.prototype.trim` strips CR, LF, U+2028 and U+2029 as whitespace, so a
+    // body edge-terminated by one of them — `'ab\r'`, `'\rabc'` — never reached
+    // the test and appended with the terminator silently removed, while the error
+    // text said such a body is not accepted. Refusing it narrows what is accepted,
+    // which is the safe direction, and makes the message true.
+    const raw = input.body ?? '';
+    const supplied = raw.trim();
+    if (!supplied) {
         throw new Error('--body is required and must contain non-whitespace text.');
     }
+    // Parse leniently, write strictly: CRLF is accepted from the caller and stored
+    // as LF, so no log this command writes ever carries a terminator other than
+    // LF.
+    //
+    // The lone-terminator rule below is deliberately applied to `raw`: before
+    // trimming, and before normalization. Normalizing first would launder `\r\r\n` — a lone CR
+    // followed by a CRLF — into `\r\n`, which passes the rule and leaves a CR in
+    // the stored bytes, because one `replaceAll` pass cannot re-examine the CR it
+    // just exposed. Refusing at the door means every CR that reaches
+    // normalization is already part of a CRLF, and one pass is then exact.
+    const normalized = supplied.includes('\r\n');
+    const body = normalizeProjectLogLineEndings(supplied);
     const versionNote = validateVersionNote(input.versionNote);
     if (input.structural) {
         if (input.type !== undefined ||
@@ -863,7 +923,7 @@ function validateEntry(input, date) {
             input.area !== undefined) {
             throw new Error('--structural cannot be combined with judgment flags --type, --scope, or --area.');
         }
-        if (/[\r\n]/.test(body)) {
+        if (PROJECT_LOG_LINE_TERMINATOR_RE.test(body)) {
             throw new Error('--body for structural entries must be one line without newline characters.');
         }
         if (containsCommandOwnedMarker(body)) {
@@ -875,6 +935,7 @@ function validateEntry(input, date) {
             heading: composeStructuralHeading({ date, producer, ref }),
             body,
             versionNote,
+            normalized,
         };
     }
     if (input.producer !== undefined || input.ref !== undefined) {
@@ -892,6 +953,12 @@ function validateEntry(input, date) {
     if (!PROJECT_LOG_SCOPES.includes(input.scope)) {
         throw new Error(`Invalid --scope '${input.scope}'; accepted values: ${PROJECT_LOG_SCOPES.join(' | ')}.`);
     }
+    // Tested against `raw`: before trimming, and before normalization. Trimming
+    // hides an edge terminator; normalizing first launders `\r\r\n` into
+    // `\r\n`, which passes this rule and leaves a carriage return in the bytes.
+    if (PROJECT_LOG_LONE_TERMINATOR_RE.test(raw)) {
+        throw new Error('--body for judgment entries must break lines with line feeds or CRLF; a lone carriage return and the U+2028 and U+2029 separators are not accepted.');
+    }
     if (containsCommandOwnedMarker(body)) {
         throw new Error('--body for judgment entries must not contain command-owned level-two or level-three Markdown headings.');
     }
@@ -905,6 +972,7 @@ function validateEntry(input, date) {
         }),
         body,
         versionNote,
+        normalized,
     };
 }
 /**
@@ -1000,30 +1068,114 @@ async function appendLockedProjectLog(input, dependencies, logPath) {
         }
     }
     const date = dependencies.now().toISOString().slice(0, 10);
-    const { heading, body, versionNote } = validateEntry(input, date);
+    const { heading, body, versionNote, normalized } = validateEntry(input, date);
     const idempotencyKey = validateIdempotencyKey(input.idempotencyKey, body);
     let created = false;
-    if (logExists && idempotencyKey !== undefined) {
-        const existing = findProjectLogEntryByIdempotencyKey(await dependencies.readLog(logPath), idempotencyKey, body);
-        if (existing !== undefined) {
-            // Append-only order is preserved (DR-260714): a replay observes the
-            // entry it already wrote instead of writing a second one.
-            return {
-                status: 'already-appended',
-                logPath,
-                heading: existing,
-                created: false,
-            };
+    if (logExists) {
+        const content = await dependencies.readLog(logPath);
+        // A log whose markers two readers resolve differently cannot answer
+        // "is this sealed?", so nothing may be written onto it until a human
+        // resolves it. This refusal is what keeps the LF-only section parser from
+        // widening such a log: without it, a pre-existing `preamble<U+2028>##
+        // Entries` stops parsing, reports unsealed, and accepts a second seal.
+        const ambiguity = findProjectLogAmbiguity(content, logPath);
+        if (ambiguity !== undefined) {
+            throw new Error(ambiguity);
+        }
+        const seal = findProjectLogSeal(content);
+        // The parser found no seal, but the raw text may still hold a seal heading
+        // it cannot reach — a log with no `## Entries` section, or a seal below
+        // another `## ` section. Writing onto such a log is the outcome that must
+        // never happen, and reporting it unsealed would contradict what is plainly
+        // in the file, so both branches below fail closed on it.
+        //
+        // Refusing is never weaker than the reading it replaces: the pre-fix code
+        // answered these logs `already-appended` and wrote nothing when a key
+        // happened to match, and appended past the seal when it did not.
+        const unreachableSeal = seal === null ? findProjectLogSealHeadingLine(content) : undefined;
+        // Read the requested identity back out of the composed heading, so the
+        // comparison runs on the same normalized producer/ref the parser reads out
+        // of the log.
+        const requestsSeal = isProjectLogSealHeading(heading);
+        // The seal routes on structure before the generic keyed short-circuit, and
+        // is never suppressed by it. `idempotencyToken` matches any whole word
+        // equal to the key *anywhere* in the log, so with the keyed scan first a
+        // single ordinary entry whose prose happened to mention `oat-seal:<project>`
+        // answered the completion seal with `already-appended` naming that entry —
+        // no seal was written, the log stayed open to every later append, and the
+        // completing agent saw success. Structural recognition cannot collide that
+        // way, and the keyed fallback below is admitted only when it names a seal,
+        // so an `already-appended` seal always reports a seal heading.
+        if (requestsSeal) {
+            if (seal !== null) {
+                // The seal is idempotent by structure, not only by key: a log sealed
+                // before the keyed convention carries no token to match, and a resumed
+                // completion must still observe the existing seal rather than write a
+                // second one.
+                return {
+                    status: 'already-appended',
+                    logPath,
+                    heading: seal.heading,
+                    created: false,
+                };
+            }
+            if (unreachableSeal !== undefined) {
+                throw unreachableProjectLogSealError(logPath, content, unreachableSeal);
+            }
+        }
+        else {
+            // Recognizing an entry this key already wrote comes before the sealed
+            // guard, and deliberately so: it appends nothing, and the entry it finds
+            // necessarily predates any later seal. Refusing it would turn the gate's
+            // idempotent recovery replay into a hard failure on every project that
+            // has since been completed.
+            if (idempotencyKey !== undefined) {
+                const existing = findProjectLogEntryByIdempotencyKey(content, idempotencyKey, body);
+                if (existing !== undefined) {
+                    // Append-only order is preserved (DR-260714): a replay observes the
+                    // entry it already wrote instead of writing a second one.
+                    return {
+                        status: 'already-appended',
+                        logPath,
+                        heading: existing,
+                        created: false,
+                    };
+                }
+            }
+            if (seal !== null) {
+                throw new ProjectLogSealedError(logPath, seal);
+            }
+            // The same refusal the seal path makes, on the same file. Leaving it out
+            // of this branch is what let a log whose seal the parser could not reach
+            // hard-fail the completion seal while still accepting ordinary content
+            // past that seal — the two writers disagreeing about one file.
+            if (unreachableSeal !== undefined) {
+                throw unreachableProjectLogSealError(logPath, content, unreachableSeal);
+            }
         }
     }
     if (!logExists) {
         const assetsRoot = await dependencies.resolveAssetsRoot();
         const template = await readFile(join(assetsRoot, 'templates', PROJECT_LOG_FILENAME), 'utf8');
-        await dependencies.writeLog(logPath, instantiateProjectLogTemplate(template, basename(dirname(logPath)), date));
+        const instantiated = instantiateProjectLogTemplate(template, basename(dirname(logPath)), date);
+        // The project directory's basename lands in the template's title line, so a
+        // directory named `demo<U+2028>## Notes` would create a log this command
+        // then refuses on its next append. A mutator must never write content it
+        // would decline to read.
+        if (containsAmbiguousProjectLogMarker(instantiated)) {
+            throw new Error(`Project name ${basename(dirname(logPath))} would put a '## ' heading after a carriage return, U+2028, or U+2029 in the new log's title, leaving a file with two readings. Rename the project directory using line feeds only.`);
+        }
+        await dependencies.writeLog(logPath, instantiated);
         created = true;
     }
     await appendEntry(logPath, heading, body, versionNote, dependencies);
-    return { status: 'appended', logPath, heading, created };
+    return {
+        status: 'appended',
+        logPath,
+        heading,
+        created,
+        ...(normalized ? { normalizedLineEndings: true } : {}),
+    };
 }
 async function samePath(left, right) {
     if (resolve(left) === resolve(right)) {
@@ -1169,12 +1321,35 @@ async function runAppendCommand(options, context, dependencies) {
                 receiptPath = candidate;
             }
         }
-        const result = await appendProjectLog({
-            repoRoot,
-            home: context.home,
-            ...options,
-            body,
-        }, dependencies);
+        let result;
+        try {
+            result = await appendProjectLog({
+                repoRoot,
+                home: context.home,
+                ...options,
+                body,
+            }, dependencies);
+        }
+        catch (error) {
+            if (!(error instanceof ProjectLogSealedError)) {
+                throw error;
+            }
+            // A terminal refusal, reported in the same shape as the error path below
+            // so a caller reading JSON can tell a sealed log from a malformed append.
+            if (context.json) {
+                context.logger.json({
+                    status: 'sealed',
+                    logPath: error.logPath,
+                    heading: error.seal.heading,
+                    message: error.message,
+                });
+            }
+            else {
+                context.logger.error(error.message);
+            }
+            process.exitCode = 1;
+            return;
+        }
         let commit;
         let receiptRemoved = false;
         if (options.commit && result.status !== 'skipped') {
@@ -1249,7 +1424,9 @@ Entry contract:
   High-value judgments may use Observation:, Impact:, and Recommendation: fields.
   Structural bodies are one line and reference artifacts by path instead of inlining them.
   Add --version-note for tool-related observations.
-  Pass --idempotency-key with --commit to finalize a gate partial-finalization receipt; a replay reports already-appended instead of duplicating the entry.
+  Pass --idempotency-key so a replay reports already-appended instead of duplicating the entry; the key must appear in --body as its own word. Adding --commit also finalizes a gate partial-finalization receipt.
+  The completion seal (--structural --producer oat-project-complete --ref seal) dedupes on its own, and every append carrying new content onto a sealed log is refused.
+  A replay recognized by its own --idempotency-key still reports already-appended on a sealed log and writes nothing.
   Never record secret values (tokens, keys, signed URLs, or credentials); reference secrets by name or source.
   Prior entries are never edited or struck through. Append a new judgment entry that references and explains a correction.
 

package/dist/commands/project/log/check.d.ts

@@ -5,8 +5,39 @@ import { type ProjectLogSection, type ProjectLogScope, type ProjectLogType } fro
 export declare const PROJECT_LOG_FILENAME = "project-log.md";
 export declare const SYNTHESIS_PENDING_HEADING = "## End-of-run synthesis (pending \u2014 do not skip at project completion)";
 export declare const SYNTHESIS_COMPLETE_HEADING = "## End-of-run synthesis";
+/**
+ * The completion seal a project log already carries.
+ *
+ * `count` is reported rather than collapsed so a log double-sealed before the
+ * seal append became idempotent stays legible instead of looking like a normal
+ * single-sealed log; `heading` is always the **first** seal, which is the one
+ * that actually closed the log.
+ */
+export interface ProjectLogSeal {
+    heading: string;
+    date: string;
+    keyed: boolean;
+    count: number;
+}
 export interface ProjectLogCheckResult {
-    status: 'ok' | 'absent' | 'synthesis_pending';
+    /**
+     * A *sealed* log deliberately keeps its ordinary status and carries `sealed`
+     * alongside it, because it is a healthy log that must keep routing normally —
+     * a distinct value there would break every `status: "ok"` route in
+     * `oat-project-complete/SKILL.md` and `oat-project-summary/SKILL.md`.
+     *
+     * `ambiguous` is the opposite case and is the one value that may join them.
+     * The log's markers have two readings, so no verdict below can be computed
+     * honestly: every other field is zeroed and must be treated as unknown, not as
+     * a finding. Breaking the routing is the point — both mutators already refuse
+     * this file, and `check` answering `ok` while they refuse is what let the
+     * completion gate trust a reader that disagreed with every writer.
+     */
+    status: 'ok' | 'absent' | 'synthesis_pending' | 'ambiguous';
+    /** Why the log has two readings, or null when it has one. */
+    ambiguity: string | null;
+    sealed: boolean;
+    seal: ProjectLogSeal | null;
     logPath: string | null;
     entryCounts: {
         structural: number;
@@ -60,7 +91,62 @@ export interface ProjectLogCheckCommandDependencies extends CheckProjectLogDepen
     resolveProjectRoot: (cwd: string) => Promise<string>;
 }
 export declare function findCanonicalProjectLogSynthesisSection(content: string): ProjectLogSynthesisSection;
+/**
+ * Parses the entries region into typed entries.
+ *
+ * The split is `/\r?\n/`, not `'\n'`. With a bare LF split every line of a
+ * CRLF log keeps a trailing `\r`, which no heading pattern can match — their
+ * `$` sits after a `[^·\r\n]+` run — so a CRLF log parsed to zero entries and
+ * an existing completion seal was invisible to `check` and to the append guard.
+ * A *lone* CR is still not a boundary, which is what keeps a body from forging
+ * a heading; only the CRLF pair is folded in.
+ */
 export declare function parseProjectLogEntries(content: string): ParsedProjectLog;
+/**
+ * Summarizes the completion seal carried by already-parsed entries.
+ *
+ * Seal identity is `isProjectLogSealEntry` and nothing else, so `check` and
+ * `append` cannot drift apart on what "sealed" means.
+ */
+export declare function summarizeProjectLogSeal(entries: readonly ParsedProjectLogEntry[]): ProjectLogSeal | null;
+/**
+ * Finds the completion seal in raw project-log content.
+ *
+ * `append` uses this so its refusal and `check`'s report are the same reading
+ * of the same file.
+ */
+/**
+ * The reason this log has two readings, or undefined when it has one.
+ *
+ * The single question `check`, `rollup`, both append paths and `synthesize` all
+ * ask before trusting a parse. It is one function rather than one call each,
+ * because a surface that asked a slightly different question is exactly how
+ * `rollup` came to rewrite `summary.md` from a log the other three refused,
+ * reporting output byte-identical to an empty log.
+ *
+ * Two shapes qualify. A heading that a `^…$/m` reader starts a line at and the
+ * line-feed-only parser does not; and a completion seal that is physically in
+ * the file but outside the region the parser reads, where "is this sealed?" has
+ * one answer to a human and another to the parser.
+ */
+export declare function findProjectLogAmbiguity(content: string, logPath: string): string | undefined;
+/**
+ * Explains a refusal caused by a seal the entries parser cannot reach, naming
+ * the actual obstruction.
+ *
+ * The first version of this message assumed the only way to hide a seal was to
+ * place it outside `## Entries`, and offered that remedy for a CRLF log whose
+ * seal sat exactly where it belonged — a remedy that did not apply and could
+ * not be followed, on the one path a completion run cannot get past.
+ *
+ * Shared by both mutators so one file cannot produce two different accounts of
+ * why it was refused.
+ */
+export declare function unreachableProjectLogSealError(logPath: string, content: string, seal: {
+    line: string;
+    index: number;
+}): Error;
+export declare function findProjectLogSeal(content: string): ProjectLogSeal | null;
 export declare function checkProjectLog(input: CheckProjectLogInput, overrides?: Partial<CheckProjectLogDependencies>): Promise<ProjectLogCheckResult>;
 export declare function createProjectLogCheckCommand(overrides?: Partial<ProjectLogCheckCommandDependencies>): Command;
 //# sourceMappingURL=check.d.ts.map

package/dist/commands/project/log/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/log/check.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AAEnB,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AACrD,eAAO,MAAM,yBAAyB,+EACmC,CAAC;AAC1E,eAAO,MAAM,0BAA0B,4BAA4B,CAAC;AAEpE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,mBAAmB,CAAC;IAC9C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;KAC1C,CAAC;IACF,WAAW,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC7C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IACE,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,GACD;IACE,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,iBAAiB,CAAC;CAC5B,GACD;IACE,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,iBAAiB,CAAC;CAC5B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;CACnB,GACD;IACE,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEN,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC9E;AAED,MAAM,WAAW,kCAAmC,SAAQ,2BAA2B;IACrF,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AAwCD,wBAAgB,uCAAuC,CACrD,OAAO,EAAE,MAAM,GACd,0BAA0B,CAkB5B;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAsDxE;AA8BD,wBAAsB,eAAe,CACnC,KAAK,EAAE,oBAAoB,EAC3B,SAAS,GAAE,OAAO,CAAC,2BAA2B,CAAM,GACnD,OAAO,CAAC,qBAAqB,CAAC,CAsChC;AA8CD,wBAAgB,4BAA4B,CAC1C,SAAS,GAAE,OAAO,CAAC,kCAAkC,CAAM,GAC1D,OAAO,CAkBT"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/log/check.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAUL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AAEnB,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AACrD,eAAO,MAAM,yBAAyB,+EACmC,CAAC;AAC1E,eAAO,MAAM,0BAA0B,4BAA4B,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;;OAYG;IACH,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,mBAAmB,GAAG,WAAW,CAAC;IAC5D,6DAA6D;IAC7D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;KAC1C,CAAC;IACF,WAAW,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC7C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IACE,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,GACD;IACE,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,iBAAiB,CAAC;CAC5B,GACD;IACE,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,iBAAiB,CAAC;CAC5B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;CACnB,GACD;IACE,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEN,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC9E;AAED,MAAM,WAAW,kCAAmC,SAAQ,2BAA2B;IACrF,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AA2CD,wBAAgB,uCAAuC,CACrD,OAAO,EAAE,MAAM,GACd,0BAA0B,CAkB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAsDxE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,SAAS,qBAAqB,EAAE,GACxC,cAAc,GAAG,IAAI,CAcvB;AAED;;;;;GAKG;AACH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAgBpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpC,KAAK,CAmBP;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAEzE;AA8BD,wBAAsB,eAAe,CACnC,KAAK,EAAE,oBAAoB,EAC3B,SAAS,GAAE,OAAO,CAAC,2BAA2B,CAAM,GACnD,OAAO,CAAC,qBAAqB,CAAC,CAkEhC;AA8DD,wBAAgB,4BAA4B,CAC1C,SAAS,GAAE,OAAO,CAAC,kCAAkC,CAAM,GAC1D,OAAO,CAkBT"}

package/dist/commands/project/log/check.js

@@ -6,7 +6,7 @@ import { resolveActiveProject, } from '../../../config/oat-config.js';
 import { dirExists, fileExists } from '../../../fs/io.js';
 import { resolveProjectRoot } from '../../../fs/paths.js';
 import { Command } from 'commander';
-import { findProjectLogSections, isProjectLogEntryMarker, JUDGMENT_HEADING_RE, PROJECT_LOG_TYPES, STRUCTURAL_HEADING_RE, } from './grammar.js';
+import { carriesProjectLogSealKey, containsAmbiguousProjectLogMarker, findProjectLogSealHeadingLine, findProjectLogSections, isProjectLogEntryMarker, isProjectLogSealEntry, JUDGMENT_HEADING_RE, PROJECT_LOG_TYPES, STRUCTURAL_HEADING_RE, } from './grammar.js';
 export const PROJECT_LOG_FILENAME = 'project-log.md';
 export const SYNTHESIS_PENDING_HEADING = '## End-of-run synthesis (pending — do not skip at project completion)';
 export const SYNTHESIS_COMPLETE_HEADING = '## End-of-run synthesis';
@@ -32,8 +32,10 @@ function emptyCounts() {
         scopeCounts: { project: 0, general: 0 },
     };
 }
+/** The heading that opens the region entries are parsed from. */
+const ENTRIES_HEADING = '## Entries';
 function entriesSection(content) {
-    const section = findProjectLogSections(content).find(({ heading }) => heading === '## Entries');
+    const section = findProjectLogSections(content).find(({ heading }) => heading === ENTRIES_HEADING);
     if (!section) {
         return '';
     }
@@ -54,8 +56,18 @@ export function findCanonicalProjectLogSynthesisSection(content) {
         section,
     };
 }
+/**
+ * Parses the entries region into typed entries.
+ *
+ * The split is `/\r?\n/`, not `'\n'`. With a bare LF split every line of a
+ * CRLF log keeps a trailing `\r`, which no heading pattern can match — their
+ * `$` sits after a `[^·\r\n]+` run — so a CRLF log parsed to zero entries and
+ * an existing completion seal was invisible to `check` and to the append guard.
+ * A *lone* CR is still not a boundary, which is what keeps a body from forging
+ * a heading; only the CRLF pair is folded in.
+ */
 export function parseProjectLogEntries(content) {
-    const lines = entriesSection(content).split('\n');
+    const lines = entriesSection(content).split(/\r?\n/);
     const entries = [];
     const grammarViolations = [];
     for (let index = 0; index < lines.length; index += 1) {
@@ -101,6 +113,90 @@ export function parseProjectLogEntries(content) {
     }
     return { entries, grammarViolations };
 }
+/**
+ * Summarizes the completion seal carried by already-parsed entries.
+ *
+ * Seal identity is `isProjectLogSealEntry` and nothing else, so `check` and
+ * `append` cannot drift apart on what "sealed" means.
+ */
+export function summarizeProjectLogSeal(entries) {
+    const seals = entries.filter((entry) => entry.class === 'structural' && isProjectLogSealEntry(entry));
+    const first = seals[0];
+    if (first === undefined) {
+        return null;
+    }
+    return {
+        heading: first.heading,
+        date: first.date,
+        keyed: carriesProjectLogSealKey(first.body),
+        count: seals.length,
+    };
+}
+/**
+ * Finds the completion seal in raw project-log content.
+ *
+ * `append` uses this so its refusal and `check`'s report are the same reading
+ * of the same file.
+ */
+/**
+ * The reason this log has two readings, or undefined when it has one.
+ *
+ * The single question `check`, `rollup`, both append paths and `synthesize` all
+ * ask before trusting a parse. It is one function rather than one call each,
+ * because a surface that asked a slightly different question is exactly how
+ * `rollup` came to rewrite `summary.md` from a log the other three refused,
+ * reporting output byte-identical to an empty log.
+ *
+ * Two shapes qualify. A heading that a `^…$/m` reader starts a line at and the
+ * line-feed-only parser does not; and a completion seal that is physically in
+ * the file but outside the region the parser reads, where "is this sealed?" has
+ * one answer to a human and another to the parser.
+ */
+export function findProjectLogAmbiguity(content, logPath) {
+    if (containsAmbiguousProjectLogMarker(content)) {
+        return `Project log ${logPath} has a '## ' heading, or a dated '### ' entry heading, starting a line after a carriage return, U+2028, or U+2029 rather than a line feed, so its structure has two readings and no seal or count can be reported honestly. Replace those line terminators with line feeds.`;
+    }
+    if (findProjectLogSeal(content) === null) {
+        const unreachableSeal = findProjectLogSealHeadingLine(content);
+        if (unreachableSeal !== undefined) {
+            // Delegated so the precise diagnosis — which of the two obstructions this
+            // is — survives being reached through the shared predicate. Collapsing
+            // both causes into one sentence here would undo the round that made the
+            // remedy actionable.
+            return unreachableProjectLogSealError(logPath, content, unreachableSeal)
+                .message;
+        }
+    }
+    return undefined;
+}
+/**
+ * Explains a refusal caused by a seal the entries parser cannot reach, naming
+ * the actual obstruction.
+ *
+ * The first version of this message assumed the only way to hide a seal was to
+ * place it outside `## Entries`, and offered that remedy for a CRLF log whose
+ * seal sat exactly where it belonged — a remedy that did not apply and could
+ * not be followed, on the one path a completion run cannot get past.
+ *
+ * Shared by both mutators so one file cannot produce two different accounts of
+ * why it was refused.
+ */
+export function unreachableProjectLogSealError(logPath, content, seal) {
+    // Compared by offset, not by substring membership: prose inside `## Entries`
+    // can quote a seal heading verbatim, and a membership test would then report a
+    // seal that really sits under a later section as correctly placed, sending the
+    // operator to rewrite line terminators that were never the obstruction.
+    const entries = findProjectLogSections(content).find(({ heading }) => heading === ENTRIES_HEADING);
+    const outsideEntries = entries === undefined ||
+        seal.index < entries.start ||
+        seal.index >= entries.end;
+    return new Error(`Project log ${logPath} already carries the completion-seal heading '${seal.line.trim()}', but the entries parser cannot reach it, so whether the log is sealed has two answers and nothing may be read from it or written to it with confidence. ${outsideEntries
+        ? `The seal sits outside the '${ENTRIES_HEADING}' section; move it under that heading, then retry.`
+        : 'The seal is under the correct heading, so the obstruction is its line terminators; rewrite the log with line feeds, then retry.'}`);
+}
+export function findProjectLogSeal(content) {
+    return summarizeProjectLogSeal(parseProjectLogEntries(content).entries);
+}
 async function resolveTargetProject(input, dependencies) {
     if (input.project) {
         const projectPath = isAbsolute(input.project)
@@ -125,6 +221,9 @@ export async function checkProjectLog(input, overrides = {}) {
     if (!(await fileExists(logPath))) {
         return {
             status: 'absent',
+            ambiguity: null,
+            sealed: false,
+            seal: null,
             logPath: null,
             ...emptyCounts(),
             lastEntryDate: null,
@@ -133,6 +232,24 @@ export async function checkProjectLog(input, overrides = {}) {
         };
     }
     const content = await readFile(logPath, 'utf8');
+    // Fail closed, exactly as every other surface does on this same file. `check`
+    // used to be the one reader that always produced a confident verdict: on a
+    // `preamble<U+2028>## Entries` log it answered `sealed` and count fields the
+    // writers refused to act on, and the completion gate keys on those fields.
+    const ambiguity = findProjectLogAmbiguity(content, logPath);
+    if (ambiguity !== undefined) {
+        return {
+            status: 'ambiguous',
+            ambiguity,
+            sealed: false,
+            seal: null,
+            logPath,
+            ...emptyCounts(),
+            lastEntryDate: null,
+            synthesisPending: false,
+            grammarViolations: [],
+        };
+    }
     const parsed = parseProjectLogEntries(content);
     const counts = emptyCounts();
     for (const entry of parsed.entries) {
@@ -145,8 +262,12 @@ export async function checkProjectLog(input, overrides = {}) {
         }
     }
     const synthesisPending = findProjectLogSections(content).some(({ heading }) => heading === SYNTHESIS_PENDING_HEADING);
+    const seal = summarizeProjectLogSeal(parsed.entries);
     return {
         status: synthesisPending ? 'synthesis_pending' : 'ok',
+        ambiguity: null,
+        sealed: seal !== null,
+        seal,
         logPath,
         ...counts,
         lastEntryDate: parsed.entries.at(-1)?.date ?? null,
@@ -161,14 +282,27 @@ async function runCheckCommand(options, context, dependencies) {
         if (context.json) {
             context.logger.json(result);
         }
+        else if (result.status === 'ambiguous') {
+            context.logger.error(result.ambiguity ?? 'Project log has two readings.');
+        }
         else {
             context.logger.info(result.status === 'absent'
                 ? 'Project log: absent'
                 : `Project log: ${result.status}; entries: ${result.entryCounts.structural +
-                    PROJECT_LOG_TYPES.reduce((total, type) => total + result.entryCounts.judgment[type], 0)}`);
+                    PROJECT_LOG_TYPES.reduce((total, type) => total + result.entryCounts.judgment[type], 0)}${result.seal
+                    ? `; sealed${result.seal.count > 1
+                        ? ` (${result.seal.count} seal entries)`
+                        : ''}`
+                    : ''}`);
         }
+        // An ambiguous log exits non-zero whether or not synthesis was required: a
+        // caller that only checks the exit status must not read this as a clean log,
+        // and both mutators refuse the same file.
         process.exitCode =
-            options.requireSynthesis && result.synthesisPending ? 1 : 0;
+            result.status === 'ambiguous' ||
+                (options.requireSynthesis === true && result.synthesisPending)
+                ? 1
+                : 0;
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);