@opengsd/gsd-core 1.15.0 → 1.16.0

package/gsd-core/bin/lib/config.cjs

@@ -128,6 +128,19 @@ const SCHEMA_DEFAULTS = {
     // WARNING_THRESHOLD/CRITICAL_THRESHOLD so the copies cannot drift.
     'hooks.context_warning_threshold': 35,
     'hooks.context_critical_threshold': 25,
+    // #4974: gates.* confirmation toggles — an absent key must resolve to the
+    // documented default (true) rather than "Key not found", matching
+    // config-defaults.manifest.json's `gates` block. Literal here (like
+    // git.create_tag above) rather than derived from config-loader.cjs's flat
+    // CONFIG_DEFAULTS: that flat projection is enumerated 1:1 against
+    // gsd-core/references/planning-config.md by
+    // tests/config-field-docs.test.cjs, and these 3 keys are internal workflow
+    // wiring, not part of that public flat-key surface. Only the 3 keys
+    // actually read by workflow conditions are registered — see
+    // gsd-core/bin/shared/config-schema.manifest.json.
+    'gates.execute_next_plan': true,
+    'gates.confirm_transition': true,
+    'gates.confirm_milestone_scope': true,
 };
 /**
  * Resolve a schema-level default for an absent key (#2256). Checks the legacy
@@ -264,7 +277,8 @@ function validateShipPrBodySections(value) {
  *
  * Merges (increasing priority):
  *   1. Hardcoded defaults — every key that loadConfig() resolves, plus mode/granularity
- *   2. User-level defaults from ~/.gsd/defaults.json (if present)
+ *   2. User-level defaults from $GSD_HOME/.gsd/defaults.json (if present;
+ *      GSD_HOME defaults to the home directory, as in the config loader)
  *   3. userChoices — the settings the user explicitly selected during /gsd:new-project
  *
  * Uses the canonical `git` namespace for branching keys (consistent with VALID_CONFIG_KEYS
@@ -275,24 +289,27 @@ function validateShipPrBodySections(value) {
  */
 function buildNewProjectConfig(userChoices) {
     const choices = userChoices || {};
-    const homedir = node_os_1.default.homedir();
+    // #4976: the GSD-owned store resolves exactly as the config loader resolves
+    // it (`GSD_HOME || homedir()`), so the defaults.json seeding this project is
+    // the one the loader and its #3532 shadow warning read in the same run.
+    const gsdHome = process.env['GSD_HOME'] || node_os_1.default.homedir();
     // Detect API key availability
-    const braveKeyFile = node_path_1.default.join(homedir, '.gsd', 'brave_api_key');
+    const braveKeyFile = node_path_1.default.join(gsdHome, '.gsd', 'brave_api_key');
     const hasBraveSearch = !!(process.env['BRAVE_API_KEY'] || node_fs_1.default.existsSync(braveKeyFile));
-    const firecrawlKeyFile = node_path_1.default.join(homedir, '.gsd', 'firecrawl_api_key');
+    const firecrawlKeyFile = node_path_1.default.join(gsdHome, '.gsd', 'firecrawl_api_key');
     const hasFirecrawl = !!(process.env['FIRECRAWL_API_KEY'] || node_fs_1.default.existsSync(firecrawlKeyFile));
-    const exaKeyFile = node_path_1.default.join(homedir, '.gsd', 'exa_api_key');
+    const exaKeyFile = node_path_1.default.join(gsdHome, '.gsd', 'exa_api_key');
     const hasExaSearch = !!(process.env['EXA_API_KEY'] || node_fs_1.default.existsSync(exaKeyFile));
-    const tavilyKeyFile = node_path_1.default.join(homedir, '.gsd', 'tavily_api_key');
+    const tavilyKeyFile = node_path_1.default.join(gsdHome, '.gsd', 'tavily_api_key');
     const hasTavilySearch = !!(process.env['TAVILY_API_KEY'] || node_fs_1.default.existsSync(tavilyKeyFile));
-    const refKeyFile = node_path_1.default.join(homedir, '.gsd', 'ref_api_key');
+    const refKeyFile = node_path_1.default.join(gsdHome, '.gsd', 'ref_api_key');
     const hasRefSearch = !!(process.env['REF_API_KEY'] || node_fs_1.default.existsSync(refKeyFile));
-    const perplexityKeyFile = node_path_1.default.join(homedir, '.gsd', 'perplexity_api_key');
+    const perplexityKeyFile = node_path_1.default.join(gsdHome, '.gsd', 'perplexity_api_key');
     const hasPerplexity = !!(process.env['PERPLEXITY_API_KEY'] || node_fs_1.default.existsSync(perplexityKeyFile));
-    const jinaKeyFile = node_path_1.default.join(homedir, '.gsd', 'jina_api_key');
+    const jinaKeyFile = node_path_1.default.join(gsdHome, '.gsd', 'jina_api_key');
     const hasJina = !!(process.env['JINA_API_KEY'] || node_fs_1.default.existsSync(jinaKeyFile));
-    // Load user-level defaults from ~/.gsd/defaults.json if available
-    const globalDefaultsPath = node_path_1.default.join(homedir, '.gsd', 'defaults.json');
+    // Load user-level defaults from $GSD_HOME/.gsd/defaults.json if available
+    const globalDefaultsPath = node_path_1.default.join(gsdHome, '.gsd', 'defaults.json');
     let userDefaults = {};
     try {
         if (node_fs_1.default.existsSync(globalDefaultsPath)) {
@@ -434,7 +451,7 @@ function buildNewProjectConfig(userChoices) {
  *
  * Accepts user-chosen settings as a JSON string (the keys the user explicitly
  * configured during /gsd:new-project). All remaining keys are filled from
- * hardcoded defaults and optional ~/.gsd/defaults.json.
+ * hardcoded defaults and optional $GSD_HOME/.gsd/defaults.json.
  *
  * Idempotent: if config.json already exists, returns { created: false }.
  */
@@ -818,6 +835,13 @@ function cmdConfigSet(cwd, keyPath, value, raw, options = {}) {
     const VALID_CONTEXT_VALUES = ['dev', 'research', 'review'];
     if (kp === 'context')
         assertEnumValue(parsedValue, val, VALID_CONTEXT_VALUES, 'context value');
+    // #4974: `mode` was never enum-validated — `config-set mode custom` (or any
+    // other string) silently succeeded, even though only "interactive" and
+    // "yolo" are documented/read values (gsd-core/references/planning-config.md,
+    // docs/CONFIGURATION.md, pinned by tests/config-field-docs.test.cjs).
+    const VALID_MODE_VALUES = ['interactive', 'yolo'];
+    if (kp === 'mode')
+        assertEnumValue(parsedValue, val, VALID_MODE_VALUES, 'mode');
     if (kp === 'phase_id_convention') {
         assertEnumValue(parsedValue, val, VALID_PHASE_ID_CONVENTIONS, 'phase_id_convention');
     }
@@ -875,6 +899,13 @@ function cmdConfigSet(cwd, keyPath, value, raw, options = {}) {
             error(`Invalid planner.stall_detection_enabled '${val}'. Must be a boolean (true or false).`);
         }
     }
+    // Dispatch audit-trail opt-in (#4975) — boolean only. The live seams honour
+    // only a real `true`, so any other stored value would be silently ignored.
+    if (kp === 'audit.enabled') {
+        if (typeof parsedValue !== 'boolean') {
+            error(`Invalid audit.enabled '${val}'. Must be a boolean (true or false).`);
+        }
+    }
     // #3086 — git.create_tag: boolean only
     if (kp === 'git.create_tag') {
         if (typeof parsedValue !== 'boolean') {

package/gsd-core/bin/lib/core-utils.cjs

@@ -15,6 +15,7 @@
  *   - node:fs / node:path (stdlib)
  *   - ./phase-id.cjs       (comparePhaseNum, used by readSubdirectories)
  *   - ./planning-workspace.cjs (findContextMdIn, used by getPhaseFileStats)
+ *   - ./frontmatter-fence.cjs (locateFrontmatterFence, used by extractOneLinerFromBody)
  *
  * #3883 (ADR-3473 §8.3): two of this module's cyclic partners require
  * generateSlugInternal, the canonical slug formula:
@@ -37,6 +38,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+// frontmatter-fence.cjs is a leaf module (no imports), so this adds no cycle.
+const frontmatter_fence_cjs_1 = require("./frontmatter-fence.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseIdModule = require("./phase-id.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -139,7 +142,9 @@ function extractOneLinerFromBody(content) {
     if (!content)
         return null;
     const normalized = content.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
-    const body = normalized.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n*/, '');
+    // The body starts after the block the one fence owner finds, and the blank lines after it.
+    const fence = (0, frontmatter_fence_cjs_1.locateFrontmatterFence)(normalized);
+    const body = fence?.closed ? normalized.slice(fence.closingFenceEnd).replace(/^\n+/, '') : normalized;
     // #3170: anchor to a summary-shaped heading (Summary / Overview /
     // Accomplishments) so an incidental first heading (a rule list, task
     // breakdown, deviation note) does not contribute its first bold run as the

package/gsd-core/bin/lib/coverage.cjs

@@ -34,6 +34,7 @@ const { output, error } = io;
 const coreUtils = require("./core-utils.cjs");
 const { toPosixPath } = coreUtils;
 const security_cjs_1 = require("./security.cjs");
+const frontmatter_fence_cjs_1 = require("./frontmatter-fence.cjs");
 // ─── Frozen typed-IR surface ────────────────────────────────────────────────
 const MODE = Object.freeze({
     COVERAGE: 'coverage',
@@ -186,15 +187,10 @@ function setKey(obj, key, value) {
     obj[key] = value;
 }
 // ─── Frontmatter region helpers ──────────────────────────────────────────────
+/** The closed frontmatter block's YAML text, as the one fence owner finds it, or null. */
 function getFrontmatterYaml(content) {
-    const headerEnd = content.startsWith('---\r\n') ? 5 : content.startsWith('---\n') ? 4 : -1;
-    if (headerEnd === -1)
-        return null;
-    const closingLineStart = content.indexOf('\n---', headerEnd);
-    if (closingLineStart === -1)
-        return null;
-    const yamlEnd = content[closingLineStart - 1] === '\r' ? closingLineStart - 1 : closingLineStart;
-    return content.slice(headerEnd, yamlEnd);
+    const fence = (0, frontmatter_fence_cjs_1.locateFrontmatterFence)(content);
+    return fence?.closed ? content.slice(fence.openEnd, fence.bodyEnd) : null;
 }
 /**
  * Locate and parse the top-level `coverage:` block from a SUMMARY document.

package/gsd-core/bin/lib/decision-coverage-support.cjs

@@ -0,0 +1,259 @@
+"use strict";
+/**
+ * Decision-coverage support — the shared reading/matching helpers of the two decision-coverage
+ * gates (#5139, epic #5056, ADR-5057 §4 first bullet, design D3/D4).
+ *
+ * Moved verbatim (behaviour preserved) from `check-command-router.cts`, with the raw-content
+ * parsers replaced by their owning seams:
+ *   - the frontmatter `must_haves` / `truths` / `objective` blocks are read through the
+ *     Frontmatter Module (`frontmatterKeyBlockText`, the moved `extractYamlBlock`: raw text off
+ *     the one fence owner's block, so frontmatter the YAML parser refuses is still scanned), and
+ *     the SUMMARY `files_modified` list through its parsed reader (`rawFrontmatterField`), not a
+ *     `files_modified:` regex;
+ *   - the XML-tag body extraction lives in `markdown-sectionizer.cts` (`extractXmlTagBodies`).
+ *
+ * The router-facing gate modules (`gate-decision-coverage-plan.cts`,
+ * `gate-decision-coverage-verify.cts`) import from here. This module imports no io module and
+ * performs no direct console/stdout/stderr write (ESLint-enforced).
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decisionMentioned = decisionMentioned;
+exports.loadPlanContents = loadPlanContents;
+exports.loadSummaryContents = loadSummaryContents;
+exports.loadDecisionExtraction = loadDecisionExtraction;
+exports.extractPlanDesignatedSections = extractPlanDesignatedSections;
+exports.buildPlanMessage = buildPlanMessage;
+exports.buildVerifyMessage = buildVerifyMessage;
+exports.phaseCommitMessages = phaseCommitMessages;
+exports.readModifiedFilesContent = readModifiedFilesContent;
+const node_path_1 = __importDefault(require("node:path"));
+const decisions_cjs_1 = require("./decisions.cjs");
+const frontmatter_fence_cjs_1 = require("./frontmatter-fence.cjs");
+const markdown_sectionizer_cjs_1 = require("./markdown-sectionizer.cjs");
+const security_cjs_1 = require("./security.cjs");
+const gate_evidence_cjs_1 = require("./gate-evidence.cjs");
+const gate_evaluation_scope_cjs_1 = require("./gate-evaluation-scope.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const frontmatterMod = require("./frontmatter.cjs");
+const { rawFrontmatterField, frontmatterKeyBlockText } = frontmatterMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const planScanMod = require("./plan-scan.cjs");
+const { scanPhasePlans } = planScanMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const planningScopeMod = require("./planning-scope.cjs");
+const { SCOPE } = planningScopeMod;
+// ─── Decision matching ────────────────────────────────────────────────────────
+function normalizePhrase(text) {
+    // eslint-disable-next-line @typescript-eslint/no-base-to-string
+    return String(text || '')
+        .toLowerCase()
+        .replace(/[^a-z0-9\s]/g, ' ')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+const SOFT_PHRASE_MIN_WORDS = 6;
+function softPhrase(text) {
+    const words = normalizePhrase(text).split(' ').filter(Boolean);
+    if (words.length < SOFT_PHRASE_MIN_WORDS)
+        return '';
+    return words.slice(0, SOFT_PHRASE_MIN_WORDS).join(' ');
+}
+function decisionMentioned(haystack, decision) {
+    if (!haystack)
+        return false;
+    if (new RegExp(`\\b${decision.id}\\b`).test(haystack))
+        return true;
+    const phrase = softPhrase(decision.text);
+    return phrase ? normalizePhrase(haystack).includes(phrase) : false;
+}
+// ─── File reading ─────────────────────────────────────────────────────────────
+/**
+ * The contents of the phase files `pick` selects (#5170, ADR-5057 §4). An ABSENT phase directory
+ * is "no files" (`found []`); a directory or file that exists but cannot be read is `unreadable` —
+ * a gate must not take "could not read the plan" for "the plan does not cite the decision".
+ */
+function readPhaseFiles(phaseDir, pick) {
+    const entries = (0, gate_evidence_cjs_1.readDirEvidence)(phaseDir);
+    if (entries.kind === 'none')
+        return (0, gate_evidence_cjs_1.evidenceFound)([]);
+    if (entries.kind === 'unreadable')
+        return entries;
+    const contents = [];
+    // #3183 (lint-plan-count-drift): source live plan/summary files from the single
+    // owner (scanPhasePlans) instead of a local readdirSync filter — picks up bare PLAN.md and
+    // nested plans/, and excludes plans marked `status: superseded`.
+    // Only SCOPE.COMPLETE is a real answer: an existing nested plans/ that could not be read (TRUNCATED)
+    // would otherwise hand the gate a short plan set and let it conclude "no plan cites the decision".
+    const scan = scanPhasePlans(phaseDir);
+    if (scan.scope !== SCOPE.COMPLETE) {
+        return { kind: 'unreadable', reason: `plan scan ${scan.scope}`, span: phaseDir };
+    }
+    for (const entry of pick(scan)) {
+        const read = (0, gate_evidence_cjs_1.readTextEvidence)(node_path_1.default.join(phaseDir, entry));
+        if (read.kind === 'unreadable')
+            return read;
+        if (read.kind === 'found')
+            contents.push(read.value);
+    }
+    return (0, gate_evidence_cjs_1.evidenceFound)(contents);
+}
+function loadPlanContents(phaseDir) {
+    return readPhaseFiles(phaseDir, (scan) => scan.planFiles);
+}
+/**
+ * #3183 (lint-plan-count-drift): same single-owner sourcing as `loadPlanContents` —
+ * scanPhasePlans's summaryFiles instead of a local `-SUMMARY.md` readdirSync filter.
+ */
+function loadSummaryContents(phaseDir) {
+    return readPhaseFiles(phaseDir, (scan) => scan.summaryFiles);
+}
+/**
+ * The decisions of `CONTEXT.md`. `none` is an absent file (the caller's legitimate "nothing to
+ * check"); `unreadable` is a file that exists but could not be read — it must never be extracted as
+ * empty text, which would certify "no trackable decisions".
+ */
+function loadDecisionExtraction(contextPath) {
+    const read = (0, gate_evidence_cjs_1.readTextEvidence)(contextPath);
+    if (read.kind !== 'found')
+        return read;
+    const extraction = (0, decisions_cjs_1.extractDecisions)(read.value);
+    return (0, gate_evidence_cjs_1.evidenceFound)({
+        trackable: extraction.decisions.filter((d) => d.trackable),
+        outcome: extraction.outcome,
+        unreadableIds: extraction.unreadableIds ?? [],
+    });
+}
+// ─── Plan surfaces scanned for a decision citation ────────────────────────────
+const DESIGNATED_HEADINGS_RE = /^#{1,6}\s+(?:must[_ ]haves?|truths?|tasks?|objective)\b/i;
+function stripCommentsAndFences(text) {
+    // HTML-comment stripping stays caller-side (the seam does not strip HTML comments).
+    // Stop-at-next-open body (ReDoS-safe, #2128); an UNCLOSED `<!--` does not match,
+    // so downstream tags are preserved (unlike a `(?:-->|$)` fallback, which would
+    // wipe to EOF and fail-close the decision-coverage gate).
+    const htmlStripped = text.replace(/<!--(?:(?!<!--)[\s\S])*?-->/g, ' ');
+    // Fenced-code stripping: delegate to the canonical CommonMark-correct seam.
+    // replaces the prior independent regex copy (```` ``` ``` ````  + `~~~ ~~~`).
+    return (0, markdown_sectionizer_cjs_1.stripFencedCode)(htmlStripped).text;
+}
+function extractPlanDesignatedSections(planContent) {
+    if (!planContent)
+        return '';
+    const cleaned = stripCommentsAndFences(planContent);
+    // The block is the one the one fence owner finds; the body starts after the closing fence
+    // line's line ending.
+    const fence = (0, frontmatter_fence_cjs_1.locateFrontmatterFence)(cleaned);
+    const body = fence?.closed ? cleaned.slice(fence.closingFenceEnd).replace(/^\r?\n/, '') : cleaned;
+    const parts = [];
+    for (const key of ['must_haves', 'truths', 'objective']) {
+        const block = frontmatterKeyBlockText(cleaned, key);
+        if (block)
+            parts.push(block);
+    }
+    // Replace hand-rolled split(/\r?\n/) + heading walk with the seam's collectSections.
+    // stopPredicate fires on EVERY heading (collectSections needs to start a section at
+    // each heading), then we filter to designated ones — same semantics as the prior
+    // inDesignated flag: emit the heading line + body only when DESIGNATED_HEADINGS_RE matches.
+    const sections = (0, markdown_sectionizer_cjs_1.collectSections)(body, () => true);
+    const bodyParts = [];
+    for (const section of sections) {
+        const headingLine = '#'.repeat(section.heading.level) + ' ' + section.heading.text;
+        if (DESIGNATED_HEADINGS_RE.test(headingLine)) {
+            bodyParts.push(headingLine);
+            if (section.body)
+                bodyParts.push(section.body);
+        }
+    }
+    parts.push(bodyParts.join('\n'));
+    parts.push((0, markdown_sectionizer_cjs_1.extractXmlTagBodies)(cleaned));
+    return parts.join('\n\n');
+}
+function buildPlanMessage(uncovered) {
+    if (uncovered.length === 0)
+        return 'All trackable CONTEXT.md decisions are covered by plans.';
+    return [
+        '## Decision Coverage Gap',
+        '',
+        `${uncovered.length} CONTEXT.md decision(s) are not covered by any plan:`,
+        '',
+        ...uncovered.map((item) => `- **${item.id}** (${item.category || 'uncategorized'}): ${item.text}`),
+        '',
+        'Resolve by citing `D-NN:` in any of the scanned plan surfaces: front-matter',
+        '`must_haves`/`truths`/`objective`, a `## must_haves`/`truths`/`tasks`/`objective`',
+        'heading, or an `<objective>`/`<tasks>`/`<task>`/`<action>`/`<read_first>`/`<behavior>`/`<verify>`/`<acceptance_criteria>`/`<done>`',
+        'tag body. Other locations (prose outside those headings, comments, other XML tags) are not scanned.',
+        'OR move the decision to `### Claude\'s Discretion` / tag it `[informational]` if it should not be tracked.',
+    ].join('\n');
+}
+function buildVerifyMessage(notHonored) {
+    if (notHonored.length === 0)
+        return 'All trackable CONTEXT.md decisions are honored by shipped artifacts.';
+    return [
+        '### Decision Coverage (warning)',
+        '',
+        `${notHonored.length} decision(s) not found in shipped artifacts:`,
+        '',
+        ...notHonored.map((item) => `- **${item.id}** (${item.category || 'uncategorized'}): ${item.text}`),
+        '',
+        'This is a soft warning - verification status is unchanged.',
+    ].join('\n');
+}
+// ─── Shipped-artifact haystack (verify gate) ──────────────────────────────────
+/**
+ * The subjects and bodies of the PHASE'S OWN commits (#5164, ADR-5057 §4) — the evaluation-scope
+ * resolver's commit set for `phaseDir`, not the last 200 commits of whatever branch is checked
+ * out. A phase with no recorded task commits widens to the commits in its directory range (the
+ * resolver says so); an unreadable phase or repository yields '' ("could not look"), and a git
+ * failure on a non-git project dir writes nothing to the terminal.
+ */
+function phaseCommitMessages(projectDir, phaseDir) {
+    const scope = (0, gate_evaluation_scope_cjs_1.resolveEvaluationScope)(projectDir, { kind: 'phase', phase: '', phaseDir }, { includeBody: true, includeFiles: false });
+    return scope.commits.map((c) => `${c.subject}\n${c.body ?? ''}`).join('\n');
+}
+/** Cap on files read across all SUMMARYs, and on bytes read per file. */
+const MODIFIED_FILES_MAX_COUNT = 50;
+const MODIFIED_FILES_MAX_BYTES = 256 * 1024;
+/**
+ * The contents of every file the SUMMARYs list under frontmatter `files_modified`, contained to
+ * `projectDir` and capped at `MODIFIED_FILES_MAX_COUNT` files / `MODIFIED_FILES_MAX_BYTES` each.
+ */
+function readModifiedFilesContent(projectDir, summaries) {
+    const out = [];
+    let total = 0;
+    for (const summary of summaries) {
+        if (!summary)
+            continue;
+        if (total >= MODIFIED_FILES_MAX_COUNT)
+            break;
+        const field = rawFrontmatterField(summary, 'files_modified');
+        const listed = field && Array.isArray(field.value) ? field.value : [];
+        for (const entry of listed) {
+            if (total >= MODIFIED_FILES_MAX_COUNT)
+                break;
+            if (typeof entry !== 'string')
+                continue;
+            const file = entry.trim();
+            if (!file)
+                continue;
+            // Migrated off the hand-rolled prefix check (ADR-4650): resolve+contain in one
+            // step via the canonical realpath predicate — the eventual read below follows
+            // symlinks, so containment must be decided on the resolved target, not a lexical
+            // prefix. Read the value the predicate RETURNED; do not re-derive the path.
+            const candidate = node_path_1.default.isAbsolute(file) ? file : node_path_1.default.join(projectDir, file);
+            const contained = (0, security_cjs_1.tryWithinRoot)(candidate, projectDir, security_cjs_1.PathAcceptance.AbsoluteInsideRoot);
+            if (contained === null)
+                continue;
+            // An absent listed file contributes nothing readable (`''`); one that exists but cannot be
+            // read is `unreadable` — the decision it may cite was never seen (#5170).
+            const read = (0, gate_evidence_cjs_1.readTextEvidence)(contained);
+            if (read.kind === 'unreadable')
+                return read;
+            const content = read.kind === 'found' ? read.value : '';
+            out.push(content.length > MODIFIED_FILES_MAX_BYTES ? content.slice(0, MODIFIED_FILES_MAX_BYTES) : content);
+            total++;
+        }
+    }
+    return (0, gate_evidence_cjs_1.evidenceFound)(out.join('\n\n'));
+}