@ornexus/neocortex 4.60.73 → 4.60.74

package/packages/client/dist/private-execution/property-test-runtime.js

@@ -1,372 +1,9 @@
-/** Root-owned, opt-in runtime proof for admitted TypeScript property tests. */
-import { spawnSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
-import { homedir, tmpdir } from 'node:os';
-import { dirname, join, posix, resolve } from 'node:path';
-import { parse } from '@babel/parser';
-import { parseDocument } from 'yaml';
-import { mutationQaGit } from '../commands/mutation-qa-git.js';
-import { loadPropertyTestCandidatePlan } from './property-test-choices.js';
-import { inspectPropertyTestCandidate } from './property-test-candidate.js';
-const CANARY = 'P222_PROPERTY_CAUSAL_CANARY';
-const MAX_SOURCE_FILES = 512;
-const MAX_SOURCE_BYTES = 16 * 1024 * 1024;
-const MAX_TEST_BYTES = 256 * 1024;
-class RuntimeFailure extends Error {
-    reason;
-    constructor(reason) {
-        super(reason);
-        this.reason = reason;
-    }
-}
-function fail(reason) { throw new RuntimeFailure(reason); }
-function record(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
-function receipt(reason, head, candidate, files, passed = 0, causal = 0) {
-    const proven = reason === 'tests-passed';
-    return Object.freeze({ schemaVersion: 1, kind: 'property-test-runtime',
-        outcome: proven ? 'execution-proven' : 'unverified', reasonCode: reason,
-        sourceHead: head, candidateSha256: candidate, testFileCount: files,
-        passedTests: passed, causalFailedTests: causal,
-        executionVerified: proven, qaAccepted: false, publicSafe: true });
-}
-function safeBytes(root, relative, max) {
-    if (!/^[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)*$/.test(relative)
-        || relative.split('/').some((part) => part === '.' || part === '..'))
-        fail('source-unsupported');
-    let current = root;
-    const parts = relative.split('/');
-    for (const [index, part] of parts.entries()) {
-        current = join(current, part);
-        const stat = lstatSync(current);
-        if (stat.isSymbolicLink() || (index === parts.length - 1
-            ? !stat.isFile() || stat.size < 1 || stat.size > max : !stat.isDirectory())) {
-            fail('source-unsupported');
-        }
-    }
-    return readFileSync(current);
-}
-function strictJson(bytes) {
-    try {
-        const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
-        const document = parseDocument(text, { strict: true, uniqueKeys: true,
-            schema: 'core', customTags: [] });
-        if (document.errors.length || document.warnings.length)
-            return null;
-        const parsed = JSON.parse(text);
-        return record(parsed) ? parsed : null;
-    }
-    catch {
-        return null;
-    }
-}
-function safeNpmToolchain(manifestBytes, lockBytes) {
-    const manifest = strictJson(manifestBytes);
-    const lock = strictJson(lockBytes);
-    if (!manifest || !lock || manifest.workspaces !== undefined
-        || ![2, 3].includes(Number(lock.lockfileVersion))
-        || !record(lock.packages) || !record(lock.packages[''])
-        || Object.keys(lock.packages).length > 10_000)
-        return false;
-    const specs = /^(?:\^|~)?[0-9]+\.[0-9]+\.[0-9]+$/;
-    for (const section of ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']) {
-        if (manifest[section] !== undefined && (!record(manifest[section])
-            || Object.values(manifest[section]).some((value) => typeof value !== 'string' || !specs.test(value))))
-            return false;
-    }
-    const deps = { ...(record(manifest.dependencies) ? manifest.dependencies : {}),
-        ...(record(manifest.devDependencies) ? manifest.devDependencies : {}) };
-    const lockedRoot = lock.packages[''];
-    const lockedDeps = record(lockedRoot) ? { ...(record(lockedRoot.dependencies)
-            ? lockedRoot.dependencies : {}), ...(record(lockedRoot.devDependencies)
-            ? lockedRoot.devDependencies : {}) } : {};
-    if (typeof deps.vitest !== 'string' || typeof deps['fast-check'] !== 'string'
-        || lockedDeps.vitest !== deps.vitest
-        || lockedDeps['fast-check'] !== deps['fast-check'])
-        return false;
-    for (const [packagePath, value] of Object.entries(lock.packages)) {
-        if (!record(value) || value.link === true)
-            return false;
-        if (packagePath === '')
-            continue;
-        if (!/^node_modules\/(?:@[^/]+\/)?[^/]+(?:\/node_modules\/(?:@[^/]+\/)?[^/]+)*$/.test(packagePath)
-            || value.resolved === undefined)
-            return false;
-        if (typeof value.resolved !== 'string' || typeof value.integrity !== 'string'
-            || !/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(value.integrity))
-            return false;
-        try {
-            const url = new URL(value.resolved);
-            if (url.protocol !== 'https:' || url.hostname !== 'registry.npmjs.org'
-                || url.port || url.username || url.password || url.search || url.hash
-                || !url.pathname.startsWith('/') || url.pathname.includes('..'))
-                return false;
-        }
-        catch {
-            return false;
-        }
-    }
-    return true;
-}
-/** Resolve the host npm executable without allowing a project-owned PATH shadow. */
-function trustedNpmCli() {
-    for (const directory of (process.env.PATH ?? '').split(':')) {
-        if (!directory.startsWith('/'))
-            continue;
-        const candidate = join(directory, 'npm');
-        if (!existsSync(candidate))
-            continue;
-        try {
-            const real = realpathSync(candidate);
-            return ((real.startsWith('/usr/') || real.startsWith('/home/linuxbrew/.linuxbrew/'))
-                && real.endsWith('.js') && lstatSync(real).isFile()) ? real : null;
-        }
-        catch {
-            return null;
-        }
-    }
-    return null;
-}
-function importedBindings(testPath, source, implementation) {
-    const ast = parse(source, { sourceType: 'module', plugins: ['typescript'] });
-    const names = new Set();
-    for (const item of ast.program.body) {
-        if (item.type !== 'ImportDeclaration' || item.importKind === 'type'
-            || !item.source.value.startsWith('.'))
-            continue;
-        const resolved = posix.normalize(posix.join(posix.dirname(testPath), item.source.value))
-            .replace(/\.(?:ts|js)$/, '');
-        if (resolved !== implementation.replace(/\.ts$/, ''))
-            continue;
-        for (const specifier of item.specifiers) {
-            if (specifier.type === 'ImportNamespaceSpecifier')
-                fail('source-unsupported');
-            const name = specifier.type === 'ImportDefaultSpecifier' ? 'default'
-                : specifier.imported.type === 'Identifier' ? specifier.imported.name : specifier.imported.value;
-            if (!/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name))
-                fail('source-unsupported');
-            names.add(name);
-        }
-    }
-    if (!names.size)
-        fail('source-unsupported');
-    return names;
-}
-function sandboxArgs(scratch, reportDir, paths, node) {
-    const args = ['--die-with-parent', '--new-session', '--unshare-all', '--clearenv',
-        '--setenv', 'HOME', '/tmp', '--setenv', 'TMPDIR', '/tmp',
-        '--setenv', 'PATH', '/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin',
-        '--setenv', 'CI', 'true', '--setenv', 'NODE_ENV', 'test',
-        '--ro-bind', '/usr', '/usr'];
-    for (const path of ['/lib', '/lib64', '/bin']) {
-        if (existsSync(path))
-            args.push('--ro-bind', path, path);
-    }
-    if (existsSync('/home/linuxbrew/.linuxbrew')) {
-        args.push('--ro-bind', '/home/linuxbrew/.linuxbrew', '/home/linuxbrew/.linuxbrew');
-    }
-    args.push('--dir', '/etc');
-    for (const file of ['passwd', 'group', 'hosts', 'nsswitch.conf']) {
-        args.push('--ro-bind', join(scratch, '.sandbox-etc', file), `/etc/${file}`);
-    }
-    return [...args, '--dev', '/dev', '--proc', '/proc', '--tmpfs', '/tmp',
-        '--ro-bind', scratch, '/work', '--bind', reportDir, '/results',
-        '--chdir', '/work', '--', node,
-        'node_modules/vitest/vitest.mjs', 'run', '--maxWorkers=1',
-        ...paths, '--reporter=json', '--outputFile=/results/report.json'];
-}
-/** Dependency preparation has the same no-network boundary as test execution. */
-function sandboxInstallArgs(scratch, npmCache, node, npmCli) {
-    const args = ['--die-with-parent', '--new-session', '--unshare-all', '--clearenv',
-        '--setenv', 'HOME', '/tmp', '--setenv', 'TMPDIR', '/tmp',
-        '--setenv', 'PATH', '/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin',
-        '--setenv', 'CI', 'true', '--setenv', 'NO_UPDATE_NOTIFIER', '1',
-        '--setenv', 'npm_config_cache', '/npm-cache',
-        '--setenv', 'npm_config_userconfig', '/dev/null',
-        '--setenv', 'npm_config_globalconfig', '/tmp/npm-global.npmrc',
-        '--ro-bind', '/usr', '/usr'];
-    for (const path of ['/lib', '/lib64', '/bin']) {
-        if (existsSync(path))
-            args.push('--ro-bind', path, path);
-    }
-    if (existsSync('/home/linuxbrew/.linuxbrew')) {
-        args.push('--ro-bind', '/home/linuxbrew/.linuxbrew', '/home/linuxbrew/.linuxbrew');
-    }
-    args.push('--dir', '/etc');
-    for (const file of ['passwd', 'group', 'hosts', 'nsswitch.conf']) {
-        args.push('--ro-bind', join(scratch, '.sandbox-etc', file), `/etc/${file}`);
-    }
-    return [...args, '--dev', '/dev', '--proc', '/proc', '--tmpfs', '/tmp',
-        '--ro-bind', npmCache, '/npm-cache', '--bind', scratch, '/work',
-        '--chdir', '/work', '--', node, npmCli, 'ci', '--offline', '--ignore-scripts',
-        '--no-audit', '--no-fund'];
-}
-function runSandbox(scratch, reportDir, paths, node) {
-    const command = spawnSync('/usr/bin/bwrap', sandboxArgs(scratch, reportDir, paths, node), {
-        env: { PATH: '/usr/bin:/bin' }, timeout: 180_000, stdio: 'ignore',
-    });
-    if (command.error || command.signal || command.status === null)
-        fail('sandbox-unavailable');
-    return command.status;
-}
-function assertions(reportDir, paths) {
-    if (!existsSync(join(reportDir, 'report.json')))
-        fail('sandbox-unavailable');
-    const parsed = strictJson(safeBytes(reportDir, 'report.json', 2 * 1024 * 1024));
-    if (!parsed || !Array.isArray(parsed.testResults)
-        || parsed.testResults.length !== paths.length)
-        fail('tests-failed');
-    const results = new Map();
-    for (const value of parsed.testResults) {
-        if (!record(value) || typeof value.name !== 'string'
-            || !paths.some((path) => value.name === `/work/${path}`)
-            || results.has(value.name) || !Array.isArray(value.assertionResults))
-            fail('tests-failed');
-        results.set(value.name, value.assertionResults);
-    }
-    return paths.flatMap((path) => results.get(`/work/${path}`));
-}
-/** An unavailable host or toolchain yields no verdict; only positive + causal runs prove execution. */
-export function verifyPropertyTestRuntime(projectRoot) {
-    let head = null;
-    let candidate = null;
-    let testFileCount = 0;
-    let passed = 0;
-    let causal = 0;
-    let scratch;
-    const reports = [];
-    try {
-        const node = realpathSync(process.execPath);
-        if (process.platform !== 'linux' || !existsSync('/usr/bin/bwrap')
-            || !(node.startsWith('/usr/') || node.startsWith('/home/linuxbrew/.linuxbrew/'))
-            || !lstatSync('/usr/bin/bwrap').isFile())
-            fail('sandbox-unavailable');
-        const npmCli = trustedNpmCli();
-        if (!npmCli)
-            fail('toolchain-unavailable');
-        const npmCache = join(homedir(), '.npm');
-        if (!existsSync(npmCache) || realpathSync(npmCache) !== npmCache
-            || !lstatSync(npmCache).isDirectory()
-            || lstatSync(npmCache).uid !== process.getuid?.())
-            fail('toolchain-unavailable');
-        const root = resolve(projectRoot);
-        if (realpathSync(root) !== root || !lstatSync(root).isDirectory())
-            fail('source-unsupported');
-        const inspected = inspectPropertyTestCandidate(root);
-        head = inspected.sourceHead;
-        candidate = inspected.artifactSha256;
-        const { plan } = loadPropertyTestCandidatePlan(root);
-        testFileCount = plan.writeSet.length;
-        if (plan.language !== 'typescript')
-            fail('toolchain-unavailable');
-        for (const alternate of ['.npmrc', 'npm-shrinkwrap.json', 'pnpm-lock.yaml',
-            'yarn.lock', 'bun.lock', 'bun.lockb']) {
-            if (existsSync(join(root, alternate)))
-                fail('toolchain-unavailable');
-        }
-        if (!existsSync(join(root, 'package.json')) || !existsSync(join(root, 'package-lock.json'))) {
-            fail('toolchain-unavailable');
-        }
-        const manifest = safeBytes(root, 'package.json', 1024 * 1024);
-        const lock = safeBytes(root, 'package-lock.json', 8 * 1024 * 1024);
-        if (!safeNpmToolchain(manifest, lock))
-            fail('toolchain-unavailable');
-        const tracked = mutationQaGit(root, ['ls-files', '-z', '--', 'src', 'app', 'lib', 'packages', 'clients'])
-            .toString('utf8').split('\0').filter(Boolean);
-        const sourcePaths = tracked.filter((path) => /^(?:src|app|lib|packages|clients)\//.test(path)
-            && /\.(?:ts|tsx|js|jsx|mjs|cjs|json)$/.test(path));
-        if (sourcePaths.length > MAX_SOURCE_FILES)
-            fail('source-unsupported');
-        const files = new Map([
-            ['package.json', manifest], ['package-lock.json', lock],
-        ]);
-        for (const path of sourcePaths)
-            files.set(path, safeBytes(root, path, 1024 * 1024));
-        const mutations = new Map();
-        for (const item of plan.aggregates) {
-            const bytes = safeBytes(root, item.testFile, MAX_TEST_BYTES);
-            const source = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
-            const names = importedBindings(item.testFile, source, item.implementationFile);
-            const selected = mutations.get(item.implementationFile) ?? new Set();
-            for (const name of names)
-                selected.add(name);
-            mutations.set(item.implementationFile, selected);
-            files.set(item.testFile, bytes);
-        }
-        if ([...files.values()].reduce((sum, bytes) => sum + bytes.length, 0) > MAX_SOURCE_BYTES) {
-            fail('source-unsupported');
-        }
-        scratch = mkdtempSync(join(tmpdir(), 'p222-property-runtime-'));
-        mkdirSync(join(scratch, '.sandbox-etc'), { mode: 0o700 });
-        const uid = process.getuid?.() ?? 1000;
-        const gid = process.getgid?.() ?? 1000;
-        for (const [file, contents] of Object.entries({
-            passwd: `sandbox:x:${uid}:${gid}:Sandbox:/work:/bin/sh\n`,
-            group: `sandbox:x:${gid}:\n`,
-            hosts: '127.0.0.1 localhost\n',
-            'nsswitch.conf': 'passwd: files\ngroup: files\nhosts: files\n',
-        }))
-            writeFileSync(join(scratch, '.sandbox-etc', file), contents, { mode: 0o600 });
-        writeFileSync(join(scratch, 'package.json'), manifest, { mode: 0o600 });
-        writeFileSync(join(scratch, 'package-lock.json'), lock, { mode: 0o600 });
-        const installed = spawnSync('/usr/bin/bwrap', sandboxInstallArgs(scratch, npmCache, node, npmCli), {
-            cwd: scratch, env: { PATH: '/usr/bin:/bin' }, timeout: 180_000, stdio: 'ignore',
-        });
-        if (installed.error || installed.signal || installed.status !== 0)
-            fail('install-failed');
-        for (const [path, bytes] of files) {
-            if (path === 'package.json' || path === 'package-lock.json')
-                continue;
-            mkdirSync(join(scratch, dirname(path)), { recursive: true, mode: 0o700 });
-            writeFileSync(join(scratch, path), bytes, { mode: 0o600 });
-        }
-        const positiveDir = mkdtempSync(join(tmpdir(), 'p222-property-report-'));
-        reports.push(positiveDir);
-        const positive = runSandbox(scratch, positiveDir, plan.writeSet, node);
-        if (positive !== 0)
-            fail(existsSync(join(positiveDir, 'report.json'))
-                ? 'tests-failed' : 'sandbox-unavailable');
-        const first = assertions(positiveDir, plan.writeSet);
-        if (first.length < plan.aggregates.reduce((sum, item) => sum + item.invariantCount, 0)
-            || first.some((row) => row.status !== 'passed'))
-            fail('tests-failed');
-        passed = first.length;
-        for (const [path, names] of mutations) {
-            const stub = [...names].map((name) => name === 'default'
-                ? `export default function(){throw new Error('${CANARY}')}`
-                : `export const ${name}=function(){throw new Error('${CANARY}')}`).join('\n');
-            writeFileSync(join(scratch, path), `${stub}\n`, { mode: 0o600 });
-        }
-        const negativeDir = mkdtempSync(join(tmpdir(), 'p222-property-report-'));
-        reports.push(negativeDir);
-        const negative = runSandbox(scratch, negativeDir, plan.writeSet, node);
-        if (negative === 0 || !existsSync(join(negativeDir, 'report.json')))
-            fail('mutation-not-causal');
-        const second = assertions(negativeDir, plan.writeSet);
-        if (second.length !== first.length || second.some((row) => row.status !== 'failed'
-            || !Array.isArray(row.failureMessages)
-            || !row.failureMessages.some((message) => typeof message === 'string' && message.includes(CANARY))))
-            fail('mutation-not-causal');
-        causal = second.length;
-        const after = inspectPropertyTestCandidate(root);
-        if (after.sourceHead !== head || after.artifactSha256 !== candidate
-            || createHash('sha256').update(manifest).digest('hex')
-                !== createHash('sha256').update(safeBytes(root, 'package.json', 1024 * 1024)).digest('hex')
-            || createHash('sha256').update(lock).digest('hex')
-                !== createHash('sha256').update(safeBytes(root, 'package-lock.json', 8 * 1024 * 1024)).digest('hex')) {
-            fail('source-unsupported');
-        }
-        return receipt('tests-passed', head, candidate, testFileCount, passed, causal);
-    }
-    catch (error) {
-        return receipt(error instanceof RuntimeFailure ? error.reason : 'source-unsupported', head, candidate, testFileCount, passed, causal);
-    }
-    finally {
-        for (const reportDir of reports)
-            rmSync(reportDir, { recursive: true, force: true });
-        if (scratch)
-            rmSync(scratch, { recursive: true, force: true });
-    }
-}
+import{spawnSync as Z}from"node:child_process";import{createHash as $}from"node:crypto";import{existsSync as b,lstatSync as y,mkdirSync as L,mkdtempSync as O,readFileSync as te,realpathSync as F,rmSync as V,writeFileSync as x}from"node:fs";import{homedir as se,tmpdir as M}from"node:os";import{dirname as ne,join as u,posix as I,resolve as oe}from"node:path";import{parse as re}from"@babel/parser";import{parseDocument as ie}from"yaml";import{mutationQaGit as ae}from"../commands/mutation-qa-git.js";import{loadPropertyTestCandidatePlan as ce}from"./property-test-choices.js";import{inspectPropertyTestCandidate as X}from"./property-test-candidate.js";const z="P222_PROPERTY_CAUSAL_CANARY",ue=512,le=16*1024*1024,pe=256*1024;class q extends Error{reason;constructor(o){super(o),this.reason=o}}function c(n){throw new q(n)}function g(n){return n!==null&&typeof n=="object"&&!Array.isArray(n)}function J(n,o,t,r,e=0,s=0){const a=n==="tests-passed";return Object.freeze({schemaVersion:1,kind:"property-test-runtime",outcome:a?"execution-proven":"unverified",reasonCode:n,sourceHead:o,candidateSha256:t,testFileCount:r,passedTests:e,causalFailedTests:s,executionVerified:a,qaAccepted:!1,publicSafe:!0})}function v(n,o,t){(!/^[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)*$/.test(o)||o.split("/").some(s=>s==="."||s===".."))&&c("source-unsupported");let r=n;const e=o.split("/");for(const[s,a]of e.entries()){r=u(r,a);const p=y(r);(p.isSymbolicLink()||(s===e.length-1?!p.isFile()||p.size<1||p.size>t:!p.isDirectory()))&&c("source-unsupported")}return te(r)}function H(n){try{const o=new TextDecoder("utf-8",{fatal:!0}).decode(n),t=ie(o,{strict:!0,uniqueKeys:!0,schema:"core",customTags:[]});if(t.errors.length||t.warnings.length)return null;const r=JSON.parse(o);return g(r)?r:null}catch{return null}}function de(n,o){const t=H(n),r=H(o);if(!t||!r||t.workspaces!==void 0||![2,3].includes(Number(r.lockfileVersion))||!g(r.packages)||!g(r.packages[""])||Object.keys(r.packages).length>1e4)return!1;const e=/^(?:\^|~)?[0-9]+\.[0-9]+\.[0-9]+$/;for(const l of["dependencies","devDependencies","optionalDependencies","peerDependencies"])if(t[l]!==void 0&&(!g(t[l])||Object.values(t[l]).some(h=>typeof h!="string"||!e.test(h))))return!1;const s={...g(t.dependencies)?t.dependencies:{},...g(t.devDependencies)?t.devDependencies:{}},a=r.packages[""],p=g(a)?{...g(a.dependencies)?a.dependencies:{},...g(a.devDependencies)?a.devDependencies:{}}:{};if(typeof s.vitest!="string"||typeof s["fast-check"]!="string"||p.vitest!==s.vitest||p["fast-check"]!==s["fast-check"])return!1;for(const[l,h]of Object.entries(r.packages)){if(!g(h)||h.link===!0)return!1;if(l!==""){if(!/^node_modules\/(?:@[^/]+\/)?[^/]+(?:\/node_modules\/(?:@[^/]+\/)?[^/]+)*$/.test(l)||h.resolved===void 0||typeof h.resolved!="string"||typeof h.integrity!="string"||!/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(h.integrity))return!1;try{const d=new URL(h.resolved);if(d.protocol!=="https:"||d.hostname!=="registry.npmjs.org"||d.port||d.username||d.password||d.search||d.hash||!d.pathname.startsWith("/")||d.pathname.includes(".."))return!1}catch{return!1}}}return!0}function fe(){for(const n of(process.env.PATH??"").split(":")){if(!n.startsWith("/"))continue;const o=u(n,"npm");if(b(o))try{const t=F(o);return(t.startsWith("/usr/")||t.startsWith("/home/linuxbrew/.linuxbrew/"))&&t.endsWith(".js")&&y(t).isFile()?t:null}catch{return null}}return null}function me(n,o,t){const r=re(o,{sourceType:"module",plugins:["typescript"]}),e=new Set;for(const s of r.program.body)if(!(s.type!=="ImportDeclaration"||s.importKind==="type"||!s.source.value.startsWith(".")||I.normalize(I.join(I.dirname(n),s.source.value)).replace(/\.(?:ts|js)$/,"")!==t.replace(/\.ts$/,"")))for(const p of s.specifiers){p.type==="ImportNamespaceSpecifier"&&c("source-unsupported");const l=p.type==="ImportDefaultSpecifier"?"default":p.imported.type==="Identifier"?p.imported.name:p.imported.value;/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(l)||c("source-unsupported"),e.add(l)}return e.size||c("source-unsupported"),e}function he(n,o,t,r){const e=["--die-with-parent","--new-session","--unshare-all","--clearenv","--setenv","HOME","/tmp","--setenv","TMPDIR","/tmp","--setenv","PATH","/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin","--setenv","CI","true","--setenv","NODE_ENV","test","--ro-bind","/usr","/usr"];for(const s of["/lib","/lib64","/bin"])b(s)&&e.push("--ro-bind",s,s);b("/home/linuxbrew/.linuxbrew")&&e.push("--ro-bind","/home/linuxbrew/.linuxbrew","/home/linuxbrew/.linuxbrew"),e.push("--dir","/etc");for(const s of["passwd","group","hosts","nsswitch.conf"])e.push("--ro-bind",u(n,".sandbox-etc",s),`/etc/${s}`);return[...e,"--dev","/dev","--proc","/proc","--tmpfs","/tmp","--ro-bind",n,"/work","--bind",o,"/results","--chdir","/work","--",r,"node_modules/vitest/vitest.mjs","run","--maxWorkers=1",...t,"--reporter=json","--outputFile=/results/report.json"]}function be(n,o,t,r){const e=["--die-with-parent","--new-session","--unshare-all","--clearenv","--setenv","HOME","/tmp","--setenv","TMPDIR","/tmp","--setenv","PATH","/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin","--setenv","CI","true","--setenv","NO_UPDATE_NOTIFIER","1","--setenv","npm_config_cache","/npm-cache","--setenv","npm_config_userconfig","/dev/null","--setenv","npm_config_globalconfig","/tmp/npm-global.npmrc","--ro-bind","/usr","/usr"];for(const s of["/lib","/lib64","/bin"])b(s)&&e.push("--ro-bind",s,s);b("/home/linuxbrew/.linuxbrew")&&e.push("--ro-bind","/home/linuxbrew/.linuxbrew","/home/linuxbrew/.linuxbrew"),e.push("--dir","/etc");for(const s of["passwd","group","hosts","nsswitch.conf"])e.push("--ro-bind",u(n,".sandbox-etc",s),`/etc/${s}`);return[...e,"--dev","/dev","--proc","/proc","--tmpfs","/tmp","--ro-bind",o,"/npm-cache","--bind",n,"/work","--chdir","/work","--",t,r,"ci","--offline","--ignore-scripts","--no-audit","--no-fund"]}function K(n,o,t,r){const e=Z("/usr/bin/bwrap",he(n,o,t,r),{env:{PATH:"/usr/bin:/bin"},timeout:18e4,stdio:"ignore"});return(e.error||e.signal||e.status===null)&&c("sandbox-unavailable"),e.status}function G(n,o){b(u(n,"report.json"))||c("sandbox-unavailable");const t=H(v(n,"report.json",2*1024*1024));(!t||!Array.isArray(t.testResults)||t.testResults.length!==o.length)&&c("tests-failed");const r=new Map;for(const e of t.testResults)(!g(e)||typeof e.name!="string"||!o.some(s=>e.name===`/work/${s}`)||r.has(e.name)||!Array.isArray(e.assertionResults))&&c("tests-failed"),r.set(e.name,e.assertionResults);return o.flatMap(e=>r.get(`/work/${e}`))}function Fe(n){let o=null,t=null,r=0,e=0,s=0,a;const p=[];try{const l=F(process.execPath);(process.platform!=="linux"||!b("/usr/bin/bwrap")||!(l.startsWith("/usr/")||l.startsWith("/home/linuxbrew/.linuxbrew/"))||!y("/usr/bin/bwrap").isFile())&&c("sandbox-unavailable");const h=fe();h||c("toolchain-unavailable");const d=u(se(),".npm");(!b(d)||F(d)!==d||!y(d).isDirectory()||y(d).uid!==process.getuid?.())&&c("toolchain-unavailable");const f=oe(n);(F(f)!==f||!y(f).isDirectory())&&c("source-unsupported");const N=X(f);o=N.sourceHead,t=N.artifactSha256;const{plan:w}=ce(f);r=w.writeSet.length,w.language!=="typescript"&&c("toolchain-unavailable");for(const i of[".npmrc","npm-shrinkwrap.json","pnpm-lock.yaml","yarn.lock","bun.lock","bun.lockb"])b(u(f,i))&&c("toolchain-unavailable");(!b(u(f,"package.json"))||!b(u(f,"package-lock.json")))&&c("toolchain-unavailable");const k=v(f,"package.json",1024*1024),j=v(f,"package-lock.json",8*1024*1024);de(k,j)||c("toolchain-unavailable");const W=ae(f,["ls-files","-z","--","src","app","lib","packages","clients"]).toString("utf8").split("\0").filter(Boolean).filter(i=>/^(?:src|app|lib|packages|clients)\//.test(i)&&/\.(?:ts|tsx|js|jsx|mjs|cjs|json)$/.test(i));W.length>ue&&c("source-unsupported");const S=new Map([["package.json",k],["package-lock.json",j]]);for(const i of W)S.set(i,v(f,i,1024*1024));const P=new Map;for(const i of w.aggregates){const m=v(f,i.testFile,pe),E=new TextDecoder("utf-8",{fatal:!0}).decode(m),D=me(i.testFile,E,i.implementationFile),Y=P.get(i.implementationFile)??new Set;for(const ee of D)Y.add(ee);P.set(i.implementationFile,Y),S.set(i.testFile,m)}[...S.values()].reduce((i,m)=>i+m.length,0)>le&&c("source-unsupported"),a=O(u(M(),"p222-property-runtime-")),L(u(a,".sandbox-etc"),{mode:448});const Q=process.getuid?.()??1e3,B=process.getgid?.()??1e3;for(const[i,m]of Object.entries({passwd:`sandbox:x:${Q}:${B}:Sandbox:/work:/bin/sh
+`,group:`sandbox:x:${B}:
+`,hosts:`127.0.0.1 localhost
+`,"nsswitch.conf":`passwd: files
+group: files
+hosts: files
+`}))x(u(a,".sandbox-etc",i),m,{mode:384});x(u(a,"package.json"),k,{mode:384}),x(u(a,"package-lock.json"),j,{mode:384});const R=Z("/usr/bin/bwrap",be(a,d,l,h),{cwd:a,env:{PATH:"/usr/bin:/bin"},timeout:18e4,stdio:"ignore"});(R.error||R.signal||R.status!==0)&&c("install-failed");for(const[i,m]of S)i==="package.json"||i==="package-lock.json"||(L(u(a,ne(i)),{recursive:!0,mode:448}),x(u(a,i),m,{mode:384}));const A=O(u(M(),"p222-property-report-"));p.push(A),K(a,A,w.writeSet,l)!==0&&c(b(u(A,"report.json"))?"tests-failed":"sandbox-unavailable");const _=G(A,w.writeSet);(_.length<w.aggregates.reduce((i,m)=>i+m.invariantCount,0)||_.some(i=>i.status!=="passed"))&&c("tests-failed"),e=_.length;for(const[i,m]of P){const E=[...m].map(D=>D==="default"?`export default function(){throw new Error('${z}')}`:`export const ${D}=function(){throw new Error('${z}')}`).join(`
+`);x(u(a,i),`${E}
+`,{mode:384})}const T=O(u(M(),"p222-property-report-"));p.push(T),(K(a,T,w.writeSet,l)===0||!b(u(T,"report.json")))&&c("mutation-not-causal");const C=G(T,w.writeSet);(C.length!==_.length||C.some(i=>i.status!=="failed"||!Array.isArray(i.failureMessages)||!i.failureMessages.some(m=>typeof m=="string"&&m.includes(z))))&&c("mutation-not-causal"),s=C.length;const U=X(f);return(U.sourceHead!==o||U.artifactSha256!==t||$("sha256").update(k).digest("hex")!==$("sha256").update(v(f,"package.json",1024*1024)).digest("hex")||$("sha256").update(j).digest("hex")!==$("sha256").update(v(f,"package-lock.json",8*1024*1024)).digest("hex"))&&c("source-unsupported"),J("tests-passed",o,t,r,e,s)}catch(l){return J(l instanceof q?l.reason:"source-unsupported",o,t,r,e,s)}finally{for(const l of p)V(l,{recursive:!0,force:!0});a&&V(a,{recursive:!0,force:!0})}}export{Fe as verifyPropertyTestRuntime};

package/packages/client/dist/private-execution/property-test-source.js

@@ -1,139 +1 @@
-/** Static candidate check only: parsing a property test never grants a QA verdict. */
-import { parse } from '@babel/parser';
-import { posix } from 'node:path';
-const MAX_NODES = 100_000;
-function object(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
-function identifier(value, name) {
-    return object(value) && value.type === 'Identifier' && value.name === name;
-}
-function member(value, owner, name) {
-    return object(value) && value.type === 'MemberExpression' && value.computed === false
-        && identifier(value.object, owner) && identifier(value.property, name);
-}
-function propertyAssertion(value, fastCheckName, numRuns) {
-    if (!object(value) || value.type !== 'CallExpression' || !member(value.callee, fastCheckName, 'assert')
-        || !Array.isArray(value.arguments) || value.arguments.length !== 2)
-        return false;
-    const property = value.arguments[0];
-    const options = value.arguments[1];
-    if (!object(property) || property.type !== 'CallExpression'
-        || !(member(property.callee, fastCheckName, 'property')
-            || member(property.callee, fastCheckName, 'asyncProperty'))
-        || !Array.isArray(property.arguments) || property.arguments.length < 2
-        || !object(property.arguments[property.arguments.length - 1])
-        || !['ArrowFunctionExpression', 'FunctionExpression'].includes(String(property.arguments[property.arguments.length - 1].type))
-        || !object(options) || options.type !== 'ObjectExpression' || !Array.isArray(options.properties))
-        return false;
-    const runEntries = options.properties.filter((entry) => object(entry) && entry.type === 'ObjectProperty'
-        && entry.computed === false && (identifier(entry.key, 'numRuns')
-        || object(entry.key) && entry.key.type === 'StringLiteral' && entry.key.value === 'numRuns'));
-    return runEntries.length === 1 && object(runEntries[0]) && object(runEntries[0].value)
-        && runEntries[0].value.type === 'NumericLiteral' && runEntries[0].value.value === numRuns
-        && options.properties.every((entry) => object(entry)
-            && entry.type === 'ObjectProperty' && entry.computed === false);
-}
-function hasPropertyAssertion(callback, fastCheckName, numRuns) {
-    const stack = [callback];
-    let visited = 0;
-    while (stack.length) {
-        const node = stack.pop();
-        if (!object(node))
-            continue;
-        if (++visited > MAX_NODES)
-            throw new Error('property-test-source-invalid');
-        if (propertyAssertion(node, fastCheckName, numRuns))
-            return true;
-        for (const [key, value] of Object.entries(node)) {
-            if (key === 'loc' || key === 'extra' || key === 'comments'
-                || key === 'leadingComments' || key === 'trailingComments')
-                continue;
-            if (Array.isArray(value))
-                stack.push(...value);
-            else if (object(value))
-                stack.push(value);
-        }
-    }
-    return false;
-}
-/** Require direct Vitest cases with real fast-check calls and a value import from the mapped module. */
-export function validatePropertyTestTypeScriptSource(input) {
-    let ast;
-    try {
-        ast = parse(input.source, { sourceType: 'module', plugins: ['typescript'] });
-    }
-    catch {
-        throw new Error('property-test-source-invalid');
-    }
-    const implementation = input.implementationFile.replace(/\.ts$/, '');
-    let fastCheckName;
-    const vitestNames = new Set();
-    let implementationImported = false;
-    for (const node of ast.program.body) {
-        if (node.type !== 'ImportDeclaration' || node.importKind === 'type')
-            continue;
-        if (node.source.value === 'fast-check') {
-            if (fastCheckName || node.specifiers.length !== 1
-                || !['ImportDefaultSpecifier', 'ImportNamespaceSpecifier'].includes(node.specifiers[0].type)) {
-                throw new Error('property-test-source-invalid');
-            }
-            fastCheckName = node.specifiers[0].local.name;
-        }
-        else if (node.source.value === 'vitest') {
-            for (const specifier of node.specifiers) {
-                if (specifier.type === 'ImportSpecifier'
-                    && specifier.importKind !== 'type'
-                    && specifier.imported.type === 'Identifier'
-                    && ['it', 'test'].includes(specifier.imported.name))
-                    vitestNames.add(specifier.local.name);
-            }
-        }
-        else if (node.source.value.startsWith('.')) {
-            const resolved = posix.normalize(posix.join(posix.dirname(input.testFile), node.source.value))
-                .replace(/\.(?:ts|js)$/, '');
-            if (resolved === implementation && node.specifiers.some((specifier) => specifier.type !== 'ImportSpecifier' || specifier.importKind !== 'type'))
-                implementationImported = true;
-        }
-    }
-    if (!fastCheckName || vitestNames.size === 0 || !implementationImported) {
-        throw new Error('property-test-source-invalid');
-    }
-    const stack = [ast.program];
-    let visited = 0;
-    let verifiedCases = 0;
-    while (stack.length) {
-        const node = stack.pop();
-        if (!object(node))
-            continue;
-        if (++visited > MAX_NODES)
-            throw new Error('property-test-source-invalid');
-        if (node.type === 'CallExpression') {
-            const callee = node.callee;
-            if (object(callee) && callee.type === 'MemberExpression'
-                && object(callee.object) && callee.object.type === 'Identifier'
-                && (vitestNames.has(String(callee.object.name)) || callee.object.name === 'describe')
-                && object(callee.property) && ['skip', 'todo', 'only'].includes(String(callee.property.name))) {
-                throw new Error('property-test-source-invalid');
-            }
-            if (object(callee) && callee.type === 'Identifier' && vitestNames.has(String(callee.name))) {
-                const args = node.arguments;
-                if (!Array.isArray(args) || args.length < 2 || !hasPropertyAssertion(args[1], fastCheckName, input.numRuns)) {
-                    throw new Error('property-test-source-invalid');
-                }
-                verifiedCases++;
-            }
-        }
-        for (const [key, value] of Object.entries(node)) {
-            if (key === 'loc' || key === 'extra' || key === 'comments'
-                || key === 'leadingComments' || key === 'trailingComments')
-                continue;
-            if (Array.isArray(value))
-                stack.push(...value);
-            else if (object(value))
-                stack.push(value);
-        }
-    }
-    if (verifiedCases < input.invariantCount)
-        throw new Error('property-test-source-invalid');
-}
+import{parse as h}from"@babel/parser";import{posix as f}from"node:path";const g=1e5;function o(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function u(e,n){return o(e)&&e.type==="Identifier"&&e.name===n}function y(e,n,l){return o(e)&&e.type==="MemberExpression"&&e.computed===!1&&u(e.object,n)&&u(e.property,l)}function w(e,n,l){if(!o(e)||e.type!=="CallExpression"||!y(e.callee,n,"assert")||!Array.isArray(e.arguments)||e.arguments.length!==2)return!1;const i=e.arguments[0],p=e.arguments[1];if(!o(i)||i.type!=="CallExpression"||!(y(i.callee,n,"property")||y(i.callee,n,"asyncProperty"))||!Array.isArray(i.arguments)||i.arguments.length<2||!o(i.arguments[i.arguments.length-1])||!["ArrowFunctionExpression","FunctionExpression"].includes(String(i.arguments[i.arguments.length-1].type))||!o(p)||p.type!=="ObjectExpression"||!Array.isArray(p.properties))return!1;const c=p.properties.filter(t=>o(t)&&t.type==="ObjectProperty"&&t.computed===!1&&(u(t.key,"numRuns")||o(t.key)&&t.key.type==="StringLiteral"&&t.key.value==="numRuns"));return c.length===1&&o(c[0])&&o(c[0].value)&&c[0].value.type==="NumericLiteral"&&c[0].value.value===l&&p.properties.every(t=>o(t)&&t.type==="ObjectProperty"&&t.computed===!1)}function A(e,n,l){const i=[e];let p=0;for(;i.length;){const c=i.pop();if(o(c)){if(++p>g)throw new Error("property-test-source-invalid");if(w(c,n,l))return!0;for(const[t,m]of Object.entries(c))t==="loc"||t==="extra"||t==="comments"||t==="leadingComments"||t==="trailingComments"||(Array.isArray(m)?i.push(...m):o(m)&&i.push(m))}}return!1}function v(e){let n;try{n=h(e.source,{sourceType:"module",plugins:["typescript"]})}catch{throw new Error("property-test-source-invalid")}const l=e.implementationFile.replace(/\.ts$/,"");let i;const p=new Set;let c=!1;for(const s of n.program.body)if(!(s.type!=="ImportDeclaration"||s.importKind==="type"))if(s.source.value==="fast-check"){if(i||s.specifiers.length!==1||!["ImportDefaultSpecifier","ImportNamespaceSpecifier"].includes(s.specifiers[0].type))throw new Error("property-test-source-invalid");i=s.specifiers[0].local.name}else if(s.source.value==="vitest")for(const r of s.specifiers)r.type==="ImportSpecifier"&&r.importKind!=="type"&&r.imported.type==="Identifier"&&["it","test"].includes(r.imported.name)&&p.add(r.local.name);else s.source.value.startsWith(".")&&f.normalize(f.join(f.dirname(e.testFile),s.source.value)).replace(/\.(?:ts|js)$/,"")===l&&s.specifiers.some(a=>a.type!=="ImportSpecifier"||a.importKind!=="type")&&(c=!0);if(!i||p.size===0||!c)throw new Error("property-test-source-invalid");const t=[n.program];let m=0,d=0;for(;t.length;){const s=t.pop();if(o(s)){if(++m>g)throw new Error("property-test-source-invalid");if(s.type==="CallExpression"){const r=s.callee;if(o(r)&&r.type==="MemberExpression"&&o(r.object)&&r.object.type==="Identifier"&&(p.has(String(r.object.name))||r.object.name==="describe")&&o(r.property)&&["skip","todo","only"].includes(String(r.property.name)))throw new Error("property-test-source-invalid");if(o(r)&&r.type==="Identifier"&&p.has(String(r.name))){const a=s.arguments;if(!Array.isArray(a)||a.length<2||!A(a[1],i,e.numRuns))throw new Error("property-test-source-invalid");d++}}for(const[r,a]of Object.entries(s))r==="loc"||r==="extra"||r==="comments"||r==="leadingComments"||r==="trailingComments"||(Array.isArray(a)?t.push(...a):o(a)&&t.push(a))}}if(d<e.invariantCount)throw new Error("property-test-source-invalid")}export{v as validatePropertyTestTypeScriptSource};

package/packages/client/dist/private-execution/root-checkpoint.js

@@ -1,80 +1 @@
-/** Root-only C08 adapter for the P222.16 private Codex beta. */
-import { execFileSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { resolve } from 'node:path';
-import { beginDirectYoloStoryCommit, finalizeDirectYoloStoryCheckpoint, issueDirectYoloSetupLeaseHandoff, } from '../git/direct-yolo-checkpoint.js';
-import { verifyPrivateYoloCleanBaseline } from './clean-baseline.js';
-import { stagePrivateYoloIsolatedSessionBundle } from './isolated-session.js';
-// Public projection of the checkpoint step. Keep the server-owned step name
-// out of the npm client while requiring this exact opaque action binding.
-const ROOT_CHECKPOINT_PUBLIC_STEP_ID = 'step-5ce2a8c7';
-function git(root, args) {
-    const environment = { ...process.env };
-    for (const key of [
-        'GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_OBJECT_DIRECTORY',
-        'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_COMMON_DIR', 'GIT_NAMESPACE', 'GIT_CEILING_DIRECTORIES',
-    ])
-        delete environment[key];
-    return execFileSync('git', [...args], {
-        cwd: root, env: environment, stdio: ['ignore', 'pipe', 'pipe'],
-        timeout: 30_000, maxBuffer: 16 * 1024 * 1024,
-    });
-}
-/**
- * The agent cannot write `.git`. The root stages only the exact frozen C01
- * claim admitted from the pinned clone, then uses the existing two-phase
- * physical checkpoint authority. A failed post-commit checkpoint is never
- * silently recovered.
- */
-export async function runPrivateYoloRootCheckpoint(projectRoot, action) {
-    const root = resolve(projectRoot);
-    if (action.schemaVersion !== 1 || action.action !== 'checkpoint-epic-story'
-        || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(action.storyId)
-        || !/^[a-f0-9]{64}$/.test(action.graphRevision)
-        || action.stepId !== ROOT_CHECKPOINT_PUBLIC_STEP_ID
-        || !/^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$/.test(action.executionBranch)
-        || action.executionBranch.includes('..')
-        || action.publicSafe !== true)
-        throw new Error('private-execution-root-checkpoint-invalid');
-    await verifyPrivateYoloCleanBaseline(root, action.storyId, action.executionBranch, action.graphRevision);
-    const staged = await stagePrivateYoloIsolatedSessionBundle(root, action.storyId, action.graphRevision);
-    const handoff = await issueDirectYoloSetupLeaseHandoff({ projectRoot: root, storyId: action.storyId });
-    if (!handoff.ok || handoff.value.bundleDigest !== staged.bundleSha256) {
-        throw new Error('private-execution-root-checkpoint-handoff-denied', {
-            cause: new Error(handoff.ok ? 'private-execution-root-checkpoint-handoff-bundle-mismatch' : handoff.reasonCode),
-        });
-    }
-    const begun = await beginDirectYoloStoryCommit({ projectRoot: root, storyId: action.storyId });
-    if (!begun.ok)
-        throw new Error('private-execution-root-checkpoint-begin-denied');
-    if (begun.value.graphRevision !== action.graphRevision
-        || begun.value.executionBranch !== action.executionBranch) {
-        throw new Error('private-execution-root-checkpoint-authority-drift');
-    }
-    try {
-        const physicalHead = git(root, ['rev-parse', 'HEAD']).toString('utf8').trim();
-        const physicalBranch = git(root, ['symbolic-ref', '--quiet', '--short', 'HEAD']).toString('utf8').trim();
-        const stagedBundle = git(root, ['diff', '--cached', '--binary', '--full-index']);
-        const stagedDigest = createHash('sha256').update(stagedBundle).digest('hex');
-        if (physicalHead !== begun.value.baseSha || physicalBranch !== begun.value.executionBranch
-            || stagedDigest !== begun.value.bundleDigest || stagedDigest !== staged.bundleSha256) {
-            throw new Error('private-execution-root-checkpoint-bundle-drift');
-        }
-        git(root, [
-            'commit', '-m', `fix(${action.storyId}): checkpoint direct yolo`,
-            ...begun.value.trailers.flatMap((trailer) => ['-m', trailer]),
-        ]);
-    }
-    catch (error) {
-        if (error instanceof Error && error.message === 'private-execution-root-checkpoint-bundle-drift')
-            throw error;
-        throw new Error('private-execution-root-checkpoint-commit-failed');
-    }
-    const finalized = await finalizeDirectYoloStoryCheckpoint({ projectRoot: root, storyId: action.storyId, push: true });
-    if (!finalized.ok)
-        throw new Error('private-execution-root-checkpoint-finalize-denied');
-    return Object.freeze({
-        schemaVersion: 1, outcome: 'checkpoint-validated', storyId: action.storyId,
-        headSha: finalized.value.headSha, publicSafe: true,
-    });
-}
+import{execFileSync as f}from"node:child_process";import{createHash as l}from"node:crypto";import{resolve as I}from"node:path";import{beginDirectYoloStoryCommit as v,finalizeDirectYoloStoryCheckpoint as m,issueDirectYoloSetupLeaseHandoff as E}from"../git/direct-yolo-checkpoint.js";import{verifyPrivateYoloCleanBaseline as y}from"./clean-baseline.js";import{stagePrivateYoloIsolatedSessionBundle as g}from"./isolated-session.js";const w="step-5ce2a8c7";function a(c,e){const o={...process.env};for(const i of["GIT_DIR","GIT_WORK_TREE","GIT_INDEX_FILE","GIT_OBJECT_DIRECTORY","GIT_ALTERNATE_OBJECT_DIRECTORIES","GIT_COMMON_DIR","GIT_NAMESPACE","GIT_CEILING_DIRECTORIES"])delete o[i];return f("git",[...e],{cwd:c,env:o,stdio:["ignore","pipe","pipe"],timeout:3e4,maxBuffer:16*1024*1024})}async function b(c,e){const o=I(c);if(e.schemaVersion!==1||e.action!=="checkpoint-epic-story"||!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(e.storyId)||!/^[a-f0-9]{64}$/.test(e.graphRevision)||e.stepId!==w||!/^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$/.test(e.executionBranch)||e.executionBranch.includes("..")||e.publicSafe!==!0)throw new Error("private-execution-root-checkpoint-invalid");await y(o,e.storyId,e.executionBranch,e.graphRevision);const i=await g(o,e.storyId,e.graphRevision),n=await E({projectRoot:o,storyId:e.storyId});if(!n.ok||n.value.bundleDigest!==i.bundleSha256)throw new Error("private-execution-root-checkpoint-handoff-denied",{cause:new Error(n.ok?"private-execution-root-checkpoint-handoff-bundle-mismatch":n.reasonCode)});const t=await v({projectRoot:o,storyId:e.storyId});if(!t.ok)throw new Error("private-execution-root-checkpoint-begin-denied");if(t.value.graphRevision!==e.graphRevision||t.value.executionBranch!==e.executionBranch)throw new Error("private-execution-root-checkpoint-authority-drift");try{const r=a(o,["rev-parse","HEAD"]).toString("utf8").trim(),h=a(o,["symbolic-ref","--quiet","--short","HEAD"]).toString("utf8").trim(),u=a(o,["diff","--cached","--binary","--full-index"]),d=l("sha256").update(u).digest("hex");if(r!==t.value.baseSha||h!==t.value.executionBranch||d!==t.value.bundleDigest||d!==i.bundleSha256)throw new Error("private-execution-root-checkpoint-bundle-drift");a(o,["commit","-m",`fix(${e.storyId}): checkpoint direct yolo`,...t.value.trailers.flatMap(p=>["-m",p])])}catch(r){throw r instanceof Error&&r.message==="private-execution-root-checkpoint-bundle-drift"?r:new Error("private-execution-root-checkpoint-commit-failed")}const s=await m({projectRoot:o,storyId:e.storyId,push:!0});if(!s.ok)throw new Error("private-execution-root-checkpoint-finalize-denied");return Object.freeze({schemaVersion:1,outcome:"checkpoint-validated",storyId:e.storyId,headSha:s.value.headSha,publicSafe:!0})}export{b as runPrivateYoloRootCheckpoint};