@oscharko-dev/keiko 0.2.0-beta.3 → 0.2.0-beta.4

package/node_modules/@oscharko-dev/keiko-workspace/dist/ignore.js

@@ -67,11 +67,30 @@ export const DEFAULT_DENY_PATTERNS = Object.freeze([
     ".node_repl_history",
     ".irb_history",
     "service-account*.json",
+    // Epic #177 post-closure audit: additional pure-credential FILES denied outright. These filenames
+    // hold secrets by convention (cloud storage keys, OAuth tokens, VCS/registry/shell credentials,
+    // IaC variables); secret-shaped content in otherwise-allowed files is still scrubbed by the
+    // redaction layer as defence-in-depth.
+    ".s3cfg",
+    ".boto",
+    ".dockercfg",
+    ".gitconfig",
+    ".envrc",
+    "*.tfvars",
+    "*.tfvars.json",
+    ".terraformrc",
     // deps
     "node_modules",
     // Keiko runtime/evidence state. These files are internal product artifacts, not repository
     // source, and must never be discoverable through connected repository grounding.
     ".keiko",
+    "keiko.config.json",
+    // Local tool and IDE runtime state. These directories can contain prompts, transcripts,
+    // worktrees, extension caches, shelves, and machine-local metadata; they are not source context.
+    ".codex",
+    ".claude",
+    ".playwright-mcp",
+    ".idea",
     // build
     "dist",
     "build",

package/node_modules/@oscharko-dev/keiko-workspace/dist/importGraph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"importGraph.d.ts","sourceRoot":"","sources":["../src/importGraph.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,iBAAiB,EAAyB,MAAM,yBAAyB,CAAC;AA4HxF,eAAO,MAAM,kBAAkB,EAAE,iBAkChC,CAAC"}
+{"version":3,"file":"importGraph.d.ts","sourceRoot":"","sources":["../src/importGraph.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,iBAAiB,EAAyB,MAAM,yBAAyB,CAAC;AA+HxF,eAAO,MAAM,kBAAkB,EAAE,iBAkChC,CAAC"}

package/node_modules/@oscharko-dev/keiko-workspace/dist/importGraph.js

@@ -85,9 +85,12 @@ function elapsedOver(ctx) {
 }
 async function scanFileForImports(ctx, relativePath, atoms) {
     const abs = resolveWithinWorkspace(ctx.scope.workspace.root, relativePath);
-    assertContainedRealPath(ctx.fs, ctx.scope.workspace.root, abs, "scope");
-    const stat = ctx.fs.stat(abs);
-    if (await probeBinary(ctx.fs, abs, stat.size)) {
+    const containedAbs = assertContainedRealPath(ctx.fs, ctx.scope.workspace.root, abs, "scope");
+    const stat = ctx.fs.stat(containedAbs);
+    if (stat.hardLinkCount !== undefined && stat.hardLinkCount > 1) {
+        return;
+    }
+    if (await probeBinary(ctx.fs, containedAbs, stat.size)) {
         return;
     }
     const content = readWorkspaceFile(ctx.scope.workspace, relativePath, { maxBytes: ctx.limits.maxBytesPerFileScanned }, ctx.fs);

package/node_modules/@oscharko-dev/keiko-workspace/dist/repoSearch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repoSearch.d.ts","sourceRoot":"","sources":["../src/repoSearch.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,aAAa,EACb,YAAY,EACZ,cAAc,EACf,MAAM,iDAAiD,CAAC;AAWzD,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAiB5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIhD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,qBAAqB,EAAE,YAK1B,CAAC;AAWX,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,UAAU,UAAU;IAClB,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AAgCD,wBAAsB,UAAU,CAC9B,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,cAAc,EACrB,MAAM,GAAE,YAAoC,EAC5C,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,YAAY,CAAC,CA6CvB;AAiED,wBAAsB,SAAS,CAC7B,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,cAAc,EACrB,MAAM,GAAE,YAAoC,EAC5C,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,YAAY,CAAC,CASvB;AAwDD,wBAAsB,WAAW,CAC/B,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,kBAAkB,EAC3B,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,iBAAiB,CAAC,CAgD5B"}
+{"version":3,"file":"repoSearch.d.ts","sourceRoot":"","sources":["../src/repoSearch.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,aAAa,EACb,YAAY,EACZ,cAAc,EACf,MAAM,iDAAiD,CAAC;AAWzD,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAmB5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIhD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,qBAAqB,EAAE,YAK1B,CAAC;AAWX,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,UAAU,UAAU;IAClB,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AA4DD,wBAAsB,UAAU,CAC9B,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,cAAc,EACrB,MAAM,GAAE,YAAoC,EAC5C,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,YAAY,CAAC,CAuCvB;AA+DD,wBAAsB,SAAS,CAC7B,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,cAAc,EACrB,MAAM,GAAE,YAAoC,EAC5C,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,YAAY,CAAC,CASvB;AAmHD,wBAAsB,WAAW,CAC/B,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,kBAAkB,EAC3B,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,iBAAiB,CAAC,CAyC5B"}

package/node_modules/@oscharko-dev/keiko-workspace/dist/repoSearch.js

@@ -1,5 +1,5 @@
 // Governed, deterministic, audit-friendly repository search facade (Epic #177, Issue #179).
-// Composes the existing workspace primitives — discovery, ignore/deny, realpath gate,
+// Composes the existing workspace primitives — discovery, deny policy, realpath gate,
 // readWorkspaceFile, plus the new binaryDetect and stableId modules — into three public
 // APIs that emit normalized EvidenceAtom output: searchText, findFiles, readExcerpt.
 // Pure JS (no subprocess, no ripgrep — deferred). Every fs touch goes through the
@@ -8,11 +8,11 @@ import { isValidScopePath, validateRetrievalQuery, } from "@oscharko-dev/keiko-c
 import { readWorkspaceFile } from "./discovery.js";
 import { RepoSearchInvalidQueryError, RepoSearchInvalidRangeError, RepoSearchUnsupportedFileError, } from "./errors.js";
 import { nodeWorkspaceFs } from "./fs.js";
-import { compileIgnore, isDenied, isIgnored } from "./ignore.js";
+import { isDenied } from "./ignore.js";
 import { resolveWithinWorkspace } from "./paths.js";
-import { assertContainedRealPath } from "./realpath.js";
+import { containedRealPathInfo } from "./realpath.js";
 import { buildMatcher, compileGlob, fingerprintFor } from "./repoSearchMatchers.js";
-import { buildAtom, buildCandidate, elapsed, gatherCandidates, hitLimit, probeBinary, scanFile, } from "./repoSearchScan.js";
+import { buildAtom, buildCandidate, elapsed, gatherCandidates, hitLimit, isImageScopePath, isIoError, probeBinary, scanFile, } from "./repoSearchScan.js";
 export const DEFAULT_SEARCH_LIMITS = {
     maxFilesScanned: 2_000,
     maxMatchesReturned: 200,
@@ -52,6 +52,26 @@ function assertWorkspaceRoot(workspace) {
     }
 }
 // ─── Public API ───────────────────────────────────────────────────────────────
+// Yields to the event loop every SCAN_YIELD_INTERVAL files so a large cold NFS/SMB workspace
+// cannot block the event loop for multiple seconds. discoverFiles() itself remains synchronous
+// (sync walk is load-bearing for importGraph/testSourcePairing callers); the yield here covers
+// the already-async per-file scan pass where the loop overhead is measurable.
+const SCAN_YIELD_INTERVAL = 64;
+async function runScanLoop(runner, candidateSet, state, atoms, candidates) {
+    let loopIndex = 0;
+    for (const file of candidateSet.files) {
+        if (hitLimit(runner, state)) {
+            break;
+        }
+        loopIndex += 1;
+        if (loopIndex % SCAN_YIELD_INTERVAL === 0) {
+            await new Promise((resolve) => {
+                setImmediate(resolve);
+            });
+        }
+        await scanFile(runner, file, state, atoms, candidates);
+    }
+}
 export async function searchText(scope, query, limits = DEFAULT_SEARCH_LIMITS, deps = {}) {
     assertWorkspaceRoot(scope.workspace);
     assertQuery(query);
@@ -72,7 +92,6 @@ export async function searchText(scope, query, limits = DEFAULT_SEARCH_LIMITS, d
         nowMs,
         startMs: nowMs(),
         matcher: buildMatcher(query),
-        ignoreMatcher: compileIgnore(scope.workspace.ignoreLines),
         fingerprint: fingerprintFor(query),
     };
     const candidateSet = gatherCandidates(scope, limits, fs);
@@ -84,12 +103,7 @@ export async function searchText(scope, query, limits = DEFAULT_SEARCH_LIMITS, d
         matchesReturned: 0,
         truncated: candidateSet.truncated,
     };
-    for (const file of candidateSet.files) {
-        if (hitLimit(runner, state)) {
-            break;
-        }
-        await scanFile(runner, file, state, atoms, candidates);
-    }
+    await runScanLoop(runner, candidateSet, state, atoms, candidates);
     return {
         atoms,
         candidates,
@@ -117,7 +131,6 @@ function findFilesSync(scope, query, limits, fs, nowMs) {
     const ctx = {
         scope,
         regex: compileGlob(query.text),
-        ignoreMatcher: compileIgnore(scope.workspace.ignoreLines),
         fingerprint: fingerprintFor(query),
         nowMs,
     };
@@ -132,7 +145,7 @@ function findFilesSync(scope, query, limits, fs, nowMs) {
             truncated = true;
             break;
         }
-        if (isDenied(file.relativePath) || isIgnored(ctx.ignoreMatcher, file.relativePath, false)) {
+        if (isDenied(file.relativePath)) {
             candidates.push(buildCandidate(file.relativePath, "ignored"));
             continue;
         }
@@ -168,12 +181,29 @@ function isWithinSelectedScope(scope, scopePath) {
     }
     return scope.relativePaths.some((selectedPath) => scopePath === selectedPath || scopePath.startsWith(`${selectedPath}/`));
 }
+function normalizeScopePath(scopePath) {
+    return scopePath.split("\\").join("/");
+}
 function assertExcerptWithinSelectedScope(scope, scopePath) {
     if (isWithinSelectedScope(scope, scopePath)) {
         return;
     }
     throw new RepoSearchUnsupportedFileError(`cannot read excerpt outside selected scope: ${scopePath}`, "outside-scope");
 }
+function resolveExcerptTarget(scope, scopePath, fs) {
+    const abs = resolveWithinWorkspace(scope.workspace.root, scopePath);
+    const contained = containedRealPathInfo(fs, scope.workspace.root, abs);
+    const realScopePath = normalizeScopePath(contained.realRelative);
+    return { path: contained.path, realScopePath };
+}
+function assertExcerptReadableByPolicy(requestPath, realScopePath) {
+    // Deny gates must fire BEFORE any byte read (incl. the binary probe) so that a denied path such
+    // as .env is never read at all, including through an in-workspace symlink. .gitignore is not a
+    // context policy boundary; safe ignored/dot files remain readable when the user scopes them in.
+    if (isDenied(requestPath) || isDenied(realScopePath)) {
+        throw new RepoSearchUnsupportedFileError(`cannot read excerpt of denied path: ${requestPath}`, "denied");
+    }
+}
 function assertExcerptRange(request) {
     if (!Number.isInteger(request.startLine) ||
         !Number.isInteger(request.endLine) ||
@@ -190,24 +220,41 @@ function assertExcerptRange(request) {
         throw new RepoSearchInvalidRangeError(`invalid scopePath: ${request.scopePath}`);
     }
 }
+// Probes for binary content and throws RepoSearchUnsupportedFileError on both binary detection
+// and IO errors (EACCES, ENOENT, …) so the caller can treat both as a graceful skip.
+async function assertExcerptNotBinary(fs, absolutePath, size, scopePath) {
+    let isBinary;
+    try {
+        isBinary = await probeBinary(fs, absolutePath, size);
+    }
+    catch (err) {
+        // TOCTOU: permissions or availability may change between stat and probe (EACCES, ENOENT, …).
+        // Re-classify as an unsupported-file skip so readKeptExcerpts degrades gracefully instead
+        // of crashing the whole grounded answer (the comment at grounded-orchestrator readKeptExcerpts
+        // explicitly promises this invariant).
+        if (isIoError(err)) {
+            throw new RepoSearchUnsupportedFileError(`cannot read excerpt of unreadable file: ${scopePath}`, "io-error");
+        }
+        throw err;
+    }
+    if (isBinary) {
+        throw new RepoSearchUnsupportedFileError(`cannot read excerpt of binary file: ${scopePath}`, "binary");
+    }
+}
 export async function readExcerpt(scope, request, deps = {}) {
     assertExcerptRange(request);
     assertWorkspaceRoot(scope.workspace);
     assertExcerptWithinSelectedScope(scope, request.scopePath);
+    if (isImageScopePath(request.scopePath)) {
+        throw new RepoSearchUnsupportedFileError(`cannot read excerpt of image file: ${request.scopePath}`, "binary");
+    }
     const fs = deps.fs ?? nodeWorkspaceFs;
     const nowMs = deps.nowMs ?? Date.now;
-    const abs = resolveWithinWorkspace(scope.workspace.root, request.scopePath);
-    assertContainedRealPath(fs, scope.workspace.root, abs, "scope");
-    // Deny/ignore gates must fire BEFORE any byte read (incl. the binary probe) so that a
-    // denied path such as .env is never read at all (Finding 4).
-    const ignoreMatcher = compileIgnore(scope.workspace.ignoreLines);
-    if (isDenied(request.scopePath) || isIgnored(ignoreMatcher, request.scopePath, false)) {
-        throw new RepoSearchUnsupportedFileError(`cannot read excerpt of denied or ignored path: ${request.scopePath}`, "denied");
-    }
-    const stat = fs.stat(abs);
-    if (await probeBinary(fs, abs, stat.size)) {
-        throw new RepoSearchUnsupportedFileError(`cannot read excerpt of binary file: ${request.scopePath}`, "binary");
-    }
+    const target = resolveExcerptTarget(scope, request.scopePath, fs);
+    assertExcerptReadableByPolicy(request.scopePath, target.realScopePath);
+    assertExcerptWithinSelectedScope(scope, target.realScopePath);
+    const stat = fs.stat(target.path);
+    await assertExcerptNotBinary(fs, target.path, stat.size, request.scopePath);
     // Read enough of the file to reach the requested line window (bounded by MAX_EXCERPT_FILE_BYTES),
     // then clamp the returned content to the caller's request.maxBytes budget. The read cap is
     // intentionally larger than request.maxBytes so a window deep in a multi-kibibyte file is still

package/node_modules/@oscharko-dev/keiko-workspace/dist/repoSearchEntries.d.ts

@@ -0,0 +1,15 @@
+import type { WorkspaceFs } from "./fs.js";
+import type { DiscoveredFile, WorkspaceInfo } from "./types.js";
+interface ScopeShape {
+    readonly workspace: WorkspaceInfo;
+    readonly relativePaths: readonly string[];
+}
+interface LimitsShape {
+    readonly maxFilesScanned: number;
+}
+export declare function collectFromEntries(scope: ScopeShape, limits: LimitsShape, fs: WorkspaceFs): {
+    files: readonly DiscoveredFile[];
+    truncated: boolean;
+};
+export {};
+//# sourceMappingURL=repoSearchEntries.d.ts.map

package/node_modules/@oscharko-dev/keiko-workspace/dist/repoSearchEntries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repoSearchEntries.d.ts","sourceRoot":"","sources":["../src/repoSearchEntries.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAqB,WAAW,EAAE,MAAM,SAAS,CAAC;AAI9D,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhE,UAAU,UAAU;IAClB,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,UAAU,WAAW;IACnB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAoHD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,WAAW,EACnB,EAAE,EAAE,WAAW,GACd;IAAE,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAgB1D"}

package/node_modules/@oscharko-dev/keiko-workspace/dist/repoSearchEntries.js

@@ -0,0 +1,107 @@
+import { isDenied } from "./ignore.js";
+import { resolveWithinWorkspace } from "./paths.js";
+import { containedRealPathInfo } from "./realpath.js";
+import { RepoSearchInvalidQueryError } from "./errors.js";
+function normalizeScopePath(scopePath) {
+    return scopePath.split("\\").join("/");
+}
+function readDirSorted(fs, absoluteDir) {
+    try {
+        return [...fs.readDir(absoluteDir)].sort((a, b) => (a.name < b.name ? -1 : 1));
+    }
+    catch {
+        return [];
+    }
+}
+function pushAllowedFile(walk, relPath, absPath) {
+    if (walk.files.length > walk.limits.maxFilesScanned) {
+        return;
+    }
+    const stat = walk.fs.stat(absPath);
+    if (!stat.isFile) {
+        return;
+    }
+    walk.files.push({ relativePath: relPath, sizeBytes: stat.size });
+    if (walk.files.length > walk.limits.maxFilesScanned) {
+        walk.truncated = true;
+    }
+}
+function allowedByFilters(relPath) {
+    return !isDenied(relPath);
+}
+function handleDirectoryEntry(walk, absoluteDir, dirRel, entry, depth) {
+    if (entry.isSymbolicLink) {
+        return;
+    }
+    const root = walk.scope.workspace.root;
+    const childRel = dirRel.length === 0 ? entry.name : `${dirRel}/${entry.name}`;
+    if (!allowedByFilters(childRel)) {
+        return;
+    }
+    const childAbs = resolveWithinWorkspace(root, childRel);
+    const contained = containedRealPathInfo(walk.fs, root, childAbs);
+    const realRel = normalizeScopePath(contained.realRelative);
+    if (!allowedByFilters(realRel)) {
+        return;
+    }
+    if (entry.isDirectory) {
+        walkEntryDirectory(walk, contained.path, realRel, depth + 1);
+        return;
+    }
+    pushAllowedFile(walk, realRel, contained.path);
+}
+function walkEntryDirectory(walk, absoluteDir, dirRel, depth) {
+    if (depth > 12 || walk.truncated) {
+        return;
+    }
+    for (const entry of readDirSorted(walk.fs, absoluteDir)) {
+        if (walk.files.length > walk.limits.maxFilesScanned) {
+            walk.truncated = true;
+            return;
+        }
+        handleDirectoryEntry(walk, absoluteDir, dirRel, entry, depth);
+    }
+}
+function handleScopeEntry(walk, entry) {
+    const root = walk.scope.workspace.root;
+    const abs = resolveWithinWorkspace(root, entry);
+    const contained = containedRealPathInfo(walk.fs, root, abs);
+    const entryRel = normalizeScopePath(entry);
+    const realRel = normalizeScopePath(contained.realRelative);
+    if (isDenied(entryRel) || isDenied(realRel)) {
+        return;
+    }
+    let stat;
+    try {
+        stat = walk.fs.stat(contained.path);
+    }
+    catch {
+        throw new RepoSearchInvalidQueryError("Connected scope path is not accessible from the selected project.");
+    }
+    if (!allowedByFilters(entryRel) ||
+        !allowedByFilters(realRel)) {
+        return;
+    }
+    if (stat.isDirectory) {
+        walkEntryDirectory(walk, contained.path, realRel, 1);
+        return;
+    }
+    pushAllowedFile(walk, realRel, contained.path);
+}
+export function collectFromEntries(scope, limits, fs) {
+    const out = [];
+    const walk = {
+        scope,
+        limits,
+        fs,
+        files: out,
+        truncated: false,
+    };
+    for (const entry of scope.relativePaths) {
+        if (walk.truncated) {
+            break;
+        }
+        handleScopeEntry(walk, entry);
+    }
+    return { files: out.slice(0, limits.maxFilesScanned), truncated: walk.truncated };
+}

package/node_modules/@oscharko-dev/keiko-workspace/dist/repoSearchLineSelection.d.ts

@@ -0,0 +1,18 @@
+import type { LineMatcher } from "./repoSearchMatchers.js";
+export interface LineSelectionRunner {
+    readonly limits: {
+        readonly elapsedMsMax: number;
+    };
+    readonly matcher: LineMatcher;
+    readonly nowMs: () => number;
+    readonly startMs: number;
+}
+export interface LineSelectionState {
+    truncated: boolean;
+}
+export interface ScoredLine {
+    readonly line: number;
+    readonly score: number;
+}
+export declare function collectBestLines(runner: LineSelectionRunner, text: string, state: LineSelectionState): readonly ScoredLine[];
+//# sourceMappingURL=repoSearchLineSelection.d.ts.map

package/node_modules/@oscharko-dev/keiko-workspace/dist/repoSearchLineSelection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repoSearchLineSelection.d.ts","sourceRoot":"","sources":["../src/repoSearchLineSelection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAQ3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAsBD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,mBAAmB,EAC3B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,kBAAkB,GACxB,SAAS,UAAU,EAAE,CAmBvB"}

package/node_modules/@oscharko-dev/keiko-workspace/dist/repoSearchLineSelection.js

@@ -0,0 +1,42 @@
+// Per-file cap on emitted lexical matches (Epic #177 retrieval fix). A connected-scope question
+// carries several content tokens, so a prose-heavy file can match many low-signal lines. Keeping
+// only each file's best lines makes the evidence diverse across the scope.
+const MAX_MATCHES_PER_FILE = 3;
+const LINE_TIMEOUT_CHECK_INTERVAL = 256;
+function elapsed(runner) {
+    return runner.nowMs() - runner.startMs;
+}
+function timedOut(runner, state, lineIndex) {
+    if (lineIndex % LINE_TIMEOUT_CHECK_INTERVAL !== 0 || elapsed(runner) <= runner.limits.elapsedMsMax) {
+        return false;
+    }
+    state.truncated = true;
+    return true;
+}
+function insertBestLine(best, candidate) {
+    best.push(candidate);
+    best.sort((a, b) => (b.score !== a.score ? b.score - a.score : a.line - b.line));
+    if (best.length > MAX_MATCHES_PER_FILE) {
+        best.pop();
+    }
+}
+export function collectBestLines(runner, text, state) {
+    const best = [];
+    let lineStart = 0;
+    let lineNumber = 1;
+    for (let i = 0; i <= text.length; i += 1) {
+        if (i < text.length && text.charCodeAt(i) !== 10 /* \n */) {
+            continue;
+        }
+        if (timedOut(runner, state, lineNumber - 1)) {
+            break;
+        }
+        const score = runner.matcher.match(text.slice(lineStart, i));
+        if (score > 0) {
+            insertBestLine(best, { line: lineNumber, score });
+        }
+        lineStart = i + 1;
+        lineNumber += 1;
+    }
+    return best.sort((a, b) => a.line - b.line);
+}

package/node_modules/@oscharko-dev/keiko-workspace/dist/repoSearchMatchers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repoSearchMatchers.d.ts","sourceRoot":"","sources":["../src/repoSearchMatchers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAGtF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC1C;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAQ5D;AAkVD,wBAAgB,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,WAAW,CAW/D;AAID,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAsBnD"}
+{"version":3,"file":"repoSearchMatchers.d.ts","sourceRoot":"","sources":["../src/repoSearchMatchers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAItF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC1C;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAQ5D;AAqUD,wBAAgB,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,WAAW,CAW/D;AAID,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAsBnD"}

package/node_modules/@oscharko-dev/keiko-workspace/dist/repoSearchMatchers.js

@@ -3,6 +3,7 @@
 // independently testable.
 import { createHash } from "node:crypto";
 import { RepoSearchInvalidQueryError } from "./errors.js";
+import { regexSafetyIssue } from "./repoSearchRegexSafety.js";
 export function fingerprintFor(query) {
     const canonical = JSON.stringify({
         kind: query.kind,
@@ -251,18 +252,10 @@ function buildExactSymbolMatcher(query) {
         },
     };
 }
-// Cap regex source length and refuse the classical catastrophic-backtracking shapes - any
-// group `(...)` or character class `[...]` followed by a `+` / `*` / `{n,}` quantifier. The
-// per-call elapsedMsMax cannot interrupt a synchronous `RegExp.exec` once it has entered a
-// pathological backtrack, so the only safe defense is to refuse the pattern at compile time.
-const MAX_REGEX_LENGTH = 200;
-const DANGEROUS_REGEX_STRUCTURE = /\([^)]*\)[+*{]|\[[^\]]*\][+*{]/;
 function buildRegexMatcher(query) {
-    if (query.text.length > MAX_REGEX_LENGTH) {
-        throw new RepoSearchInvalidQueryError(`regex too long: ${String(query.text.length)} > ${String(MAX_REGEX_LENGTH)}`);
-    }
-    if (DANGEROUS_REGEX_STRUCTURE.test(query.text)) {
-        throw new RepoSearchInvalidQueryError("regex contains repetition over a group or character class (potential catastrophic backtracking)");
+    const issue = regexSafetyIssue(query.text);
+    if (issue !== undefined) {
+        throw new RepoSearchInvalidQueryError(issue);
     }
     let regex;
     try {

package/node_modules/@oscharko-dev/keiko-workspace/dist/repoSearchRegexSafety.d.ts

@@ -0,0 +1,2 @@
+export declare function regexSafetyIssue(source: string): string | undefined;
+//# sourceMappingURL=repoSearchRegexSafety.d.ts.map

package/node_modules/@oscharko-dev/keiko-workspace/dist/repoSearchRegexSafety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repoSearchRegexSafety.d.ts","sourceRoot":"","sources":["../src/repoSearchRegexSafety.ts"],"names":[],"mappings":"AAIA,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWnE"}

package/node_modules/@oscharko-dev/keiko-workspace/dist/repoSearchRegexSafety.js

@@ -0,0 +1,15 @@
+const MAX_REGEX_LENGTH = 200;
+const DANGEROUS_GROUP_OR_CLASS_REPETITION = /\([^)]*\)[+*{]|\[[^\]]*\][+*{]/;
+const ADJACENT_QUANTIFIED_ATOMS = /(?:\\.|[^\\()[\]{}+*?|])(?:[+*]|\{\d+(?:,\d*)?\})(?:\\.|[^\\()[\]{}+*?|])(?:[+*]|\{\d+(?:,\d*)?\})/;
+export function regexSafetyIssue(source) {
+    if (source.length > MAX_REGEX_LENGTH) {
+        return `regex too long: ${String(source.length)} > ${String(MAX_REGEX_LENGTH)}`;
+    }
+    if (DANGEROUS_GROUP_OR_CLASS_REPETITION.test(source)) {
+        return "regex contains repetition over a group or character class (potential catastrophic backtracking)";
+    }
+    if (ADJACENT_QUANTIFIED_ATOMS.test(source)) {
+        return "regex contains adjacent quantified atoms (potential catastrophic backtracking)";
+    }
+    return undefined;
+}

package/node_modules/@oscharko-dev/keiko-workspace/dist/repoSearchScan.d.ts

@@ -1,8 +1,8 @@
 import type { CandidateFile, CandidateOmissionReason, EvidenceAtom, EvidenceAtomProvenanceKind } from "@oscharko-dev/keiko-contracts/connected-context";
 import type { WorkspaceFs } from "./fs.js";
-import { type IgnoreMatcher } from "./ignore.js";
 import type { LineMatcher } from "./repoSearchMatchers.js";
 import type { DiscoveredFile, WorkspaceInfo } from "./types.js";
+export declare function isImageScopePath(scopePath: string): boolean;
 export interface ScopeShape {
     readonly workspace: WorkspaceInfo;
     readonly scopeId: string;
@@ -42,7 +42,6 @@ export interface SearchTextRunner {
     readonly nowMs: () => number;
     readonly startMs: number;
     readonly matcher: LineMatcher;
-    readonly ignoreMatcher: IgnoreMatcher;
     readonly fingerprint: string;
 }
 export interface RunState {
@@ -52,5 +51,6 @@ export interface RunState {
 }
 export declare function elapsed(runner: SearchTextRunner): number;
 export declare function hitLimit(runner: SearchTextRunner, state: RunState): boolean;
+export declare function isIoError(err: unknown): boolean;
 export declare function scanFile(runner: SearchTextRunner, file: DiscoveredFile, state: RunState, atoms: EvidenceAtom[], candidates: CandidateFile[]): Promise<void>;
 //# sourceMappingURL=repoSearchScan.d.ts.map

package/node_modules/@oscharko-dev/keiko-workspace/dist/repoSearchScan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repoSearchScan.d.ts","sourceRoot":"","sources":["../src/repoSearchScan.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,YAAY,EACZ,0BAA0B,EAC3B,MAAM,iDAAiD,CAAC;AAOzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAKtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAgBhE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACzF,QAAQ,CAAC,cAAc,EAAE,0BAA0B,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,YAAY,CAwBxD;AAED,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,uBAAuB,GAAG,SAAS,GAC3C,aAAa,CAEf;AAgED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,WAAW,EACnB,EAAE,EAAE,WAAW,GACd,YAAY,CAuBd;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU9F;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAExD;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAc3E;AA+DD,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,QAAQ,EACf,KAAK,EAAE,YAAY,EAAE,EACrB,UAAU,EAAE,aAAa,EAAE,GAC1B,OAAO,CAAC,IAAI,CAAC,CAiBf"}
+{"version":3,"file":"repoSearchScan.d.ts","sourceRoot":"","sources":["../src/repoSearchScan.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,YAAY,EACZ,0BAA0B,EAC3B,MAAM,iDAAiD,CAAC;AAOzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAQ3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAsBhE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAK3D;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACzF,QAAQ,CAAC,cAAc,EAAE,0BAA0B,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,YAAY,CAwBxD;AAED,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,uBAAuB,GAAG,SAAS,GAC3C,aAAa,CAEf;AAkBD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,WAAW,EACnB,EAAE,EAAE,WAAW,GACd,YAAY,CAuBd;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU9F;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAExD;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAc3E;AAgBD,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAM/C;AAkED,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,QAAQ,EACf,KAAK,EAAE,YAAY,EAAE,EACrB,UAAU,EAAE,aAAa,EAAE,GAC1B,OAAO,CAAC,IAAI,CAAC,CAqCf"}