@oscharko-dev/keiko 0.2.0-beta.3 → 0.2.0-beta.4

package/node_modules/@oscharko-dev/keiko-workspace/dist/repoSearchScan.js

@@ -2,25 +2,39 @@
 // Kept separate from the public API surface so repoSearch.ts stays inside the 400-LOC cap.
 // Every file system touch goes through the injected WorkspaceFs port; nothing here calls
 // node:fs directly.
-import { relative } from "node:path";
 import { CONNECTED_CONTEXT_SCHEMA_VERSION, isValidScopePath, } from "@oscharko-dev/keiko-contracts/connected-context";
 import { discoverFiles, readWorkspaceFile } from "./discovery.js";
 import { FileTooLargeError, RepoSearchInvalidQueryError } from "./errors.js";
-import { isDenied, isIgnored } from "./ignore.js";
+import { isDenied } from "./ignore.js";
 import { resolveWithinWorkspace } from "./paths.js";
-import { assertContainedRealPath } from "./realpath.js";
+import { containedRealPathInfo } from "./realpath.js";
 import { looksBinary } from "./binaryDetect.js";
+import { collectFromEntries } from "./repoSearchEntries.js";
+import { collectBestLines } from "./repoSearchLineSelection.js";
 import { evidenceAtomStableId } from "./stableId.js";
 const BINARY_PROBE_BYTES = 512;
-// Per-file cap on emitted lexical matches (Epic #177 retrieval fix). A connected-scope question
-// carries several content tokens, so a prose-heavy file can match many low-signal lines. Emitting
-// all of them let one alphabetically-early file exhaust the global match budget before the scan
-// ever reached the file the question was actually about. Keeping only each file's best lines makes
-// the evidence diverse across the scope while still surfacing every file's strongest signal for the
-// downstream ranker.
-const MAX_MATCHES_PER_FILE = 3;
-function toRelative(root, absolutePath) {
-    return relative(root, absolutePath).split("\\").join("/");
+const IMAGE_EXTENSIONS = new Set([
+    ".avif",
+    ".bmp",
+    ".gif",
+    ".heic",
+    ".heif",
+    ".ico",
+    ".jpeg",
+    ".jpg",
+    ".png",
+    ".tif",
+    ".tiff",
+    ".webp",
+]);
+function normalizeScopePath(scopePath) {
+    return scopePath.split("\\").join("/");
+}
+export function isImageScopePath(scopePath) {
+    const lastSlash = Math.max(scopePath.lastIndexOf("/"), scopePath.lastIndexOf("\\"));
+    const basename = scopePath.slice(lastSlash + 1).toLowerCase();
+    const dot = basename.lastIndexOf(".");
+    return dot >= 0 && IMAGE_EXTENSIONS.has(basename.slice(dot));
 }
 export function buildAtom(shape) {
     const stableId = evidenceAtomStableId({
@@ -51,48 +65,11 @@ export function buildCandidate(scopePath, omitted) {
     return { scopePath, score: 0, signals: [], omitted };
 }
 function collectFromDirectory(scope, limits, fs) {
-    return discoverFiles(scope.workspace, { maxDepth: 12, maxFiles: limits.maxFilesScanned, applyGitignore: true }, fs);
-}
-function collectFromEntries(scope, limits, fs) {
-    const out = [];
-    const root = scope.workspace.root;
-    let scannedSoFar = 0;
-    let truncated = false;
-    for (const entry of scope.relativePaths) {
-        if (scannedSoFar >= limits.maxFilesScanned) {
-            truncated = true;
-            break;
-        }
-        const abs = resolveWithinWorkspace(root, entry);
-        assertContainedRealPath(fs, root, abs, "scope");
-        const entryRel = toRelative(root, abs);
-        // Deny the directory entry itself before recursing so that a denied dir (e.g.
-        // node_modules) listed explicitly in scope.relativePaths is never expanded (Finding 5).
-        if (isDenied(entryRel)) {
-            continue;
-        }
-        const stat = fs.stat(abs);
-        if (stat.isDirectory) {
-            const remaining = limits.maxFilesScanned - scannedSoFar;
-            const nested = discoverFiles({ ...scope.workspace, root: abs }, { maxDepth: 12, maxFiles: remaining, applyGitignore: true }, fs);
-            for (const file of nested) {
-                out.push({
-                    relativePath: toRelative(root, resolveWithinWorkspace(abs, file.relativePath)),
-                    sizeBytes: file.sizeBytes,
-                });
-                scannedSoFar += 1;
-            }
-            if (nested.length >= remaining) {
-                truncated = true;
-            }
-            continue;
-        }
-        if (stat.isFile) {
-            out.push({ relativePath: entryRel, sizeBytes: stat.size });
-            scannedSoFar += 1;
-        }
-    }
-    return { files: out, truncated };
+    const files = discoverFiles(scope.workspace, { maxDepth: 12, maxFiles: limits.maxFilesScanned + 1, applyGitignore: false }, fs);
+    return {
+        files: files.slice(0, limits.maxFilesScanned),
+        truncated: files.length > limits.maxFilesScanned,
+    };
 }
 export function gatherCandidates(scope, limits, fs) {
     // Defense in depth alongside the realpath gate: validate scope.relativePaths against the
@@ -106,10 +83,10 @@ export function gatherCandidates(scope, limits, fs) {
         }
     }
     if (scope.relativePaths.length === 0) {
-        const files = collectFromDirectory(scope, limits, fs);
+        const result = collectFromDirectory(scope, limits, fs);
         return {
-            files: [...files].sort((a, b) => (a.relativePath < b.relativePath ? -1 : 1)),
-            truncated: false,
+            files: [...result.files].sort((a, b) => (a.relativePath < b.relativePath ? -1 : 1)),
+            truncated: result.truncated,
         };
     }
     const result = collectFromEntries(scope, limits, fs);
@@ -147,6 +124,26 @@ export function hitLimit(runner, state) {
     }
     return false;
 }
+function hitEmissionLimit(runner, state) {
+    if (state.matchesReturned >= runner.limits.maxMatchesReturned) {
+        state.truncated = true;
+        return true;
+    }
+    if (elapsed(runner) > runner.limits.elapsedMsMax) {
+        state.truncated = true;
+        return true;
+    }
+    return false;
+}
+// Returns true for NodeJS.ErrnoException (EACCES, ENOENT, EIO, …). Checked by the presence of a
+// string `code` property so TypeError and other programmer errors are NOT swallowed.
+export function isIoError(err) {
+    if (err === null || typeof err !== "object" || !("code" in err)) {
+        return false;
+    }
+    const { code } = err;
+    return typeof code === "string";
+}
 function readForScan(runner, relativePath, candidates) {
     try {
         return readWorkspaceFile(runner.scope.workspace, relativePath, { maxBytes: runner.limits.maxBytesPerFileScanned }, runner.fs).text;
@@ -156,25 +153,18 @@ function readForScan(runner, relativePath, candidates) {
             candidates.push(buildCandidate(relativePath, "size-exceeded"));
             return undefined;
         }
+        // TOCTOU: permissions or availability may change between discovery and read.
+        // A single unreadable file must degrade to a skip, not crash the whole scan.
+        if (isIoError(err)) {
+            candidates.push(buildCandidate(relativePath, "tool-unavailable"));
+            return undefined;
+        }
         throw err;
     }
 }
-function scanLines(runner, relativePath, text, state, atoms) {
-    const lines = text.split("\n");
-    // Score every line, then keep only this file's best-scoring lines (ties broken by earliest
-    // line). This bounds each file's contribution to MAX_MATCHES_PER_FILE and surfaces the file's
-    // strongest evidence rather than whichever lines happen to appear first.
-    const scored = [];
-    for (let i = 0; i < lines.length; i += 1) {
-        const score = runner.matcher.match(lines[i] ?? "");
-        if (score > 0) {
-            scored.push({ line: i + 1, score });
-        }
-    }
-    scored.sort((a, b) => (b.score !== a.score ? b.score - a.score : a.line - b.line));
-    const best = scored.slice(0, MAX_MATCHES_PER_FILE).sort((a, b) => a.line - b.line);
+function emitBestLines(runner, relativePath, state, atoms, best) {
     for (const match of best) {
-        if (hitLimit(runner, state)) {
+        if (hitEmissionLimit(runner, state)) {
             return;
         }
         atoms.push(buildAtom({
@@ -190,14 +180,38 @@ function scanLines(runner, relativePath, text, state, atoms) {
         state.matchesReturned += 1;
     }
 }
+function scanLines(runner, relativePath, text, state, atoms) {
+    emitBestLines(runner, relativePath, state, atoms, collectBestLines(runner, text, state));
+}
 export async function scanFile(runner, file, state, atoms, candidates) {
-    if (isDenied(file.relativePath) || isIgnored(runner.ignoreMatcher, file.relativePath, false)) {
+    if (isImageScopePath(file.relativePath)) {
+        candidates.push(buildCandidate(file.relativePath, "binary"));
+        return;
+    }
+    if (isDenied(file.relativePath)) {
         candidates.push(buildCandidate(file.relativePath, "ignored"));
         return;
     }
     const abs = resolveWithinWorkspace(runner.scope.workspace.root, file.relativePath);
-    assertContainedRealPath(runner.fs, runner.scope.workspace.root, abs, "scope");
-    if (await probeBinary(runner.fs, abs, file.sizeBytes)) {
+    const contained = containedRealPathInfo(runner.fs, runner.scope.workspace.root, abs);
+    const realRel = normalizeScopePath(contained.realRelative);
+    if (isDenied(realRel)) {
+        candidates.push(buildCandidate(file.relativePath, "ignored"));
+        return;
+    }
+    let isBinary;
+    try {
+        isBinary = await probeBinary(runner.fs, contained.path, file.sizeBytes);
+    }
+    catch (err) {
+        // TOCTOU: file may have become unreadable (EACCES, ENOENT, …) between discovery and probe.
+        if (isIoError(err)) {
+            candidates.push(buildCandidate(file.relativePath, "tool-unavailable"));
+            return;
+        }
+        throw err;
+    }
+    if (isBinary) {
         candidates.push(buildCandidate(file.relativePath, "binary"));
         return;
     }

package/node_modules/@oscharko-dev/keiko-workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oscharko-dev/keiko-workspace",
-  "version": "0.2.0-beta.3",
+  "version": "0.2.0-beta.4",
   "private": true,
   "type": "module",
   "license": "Apache-2.0",
@@ -19,7 +19,7 @@
   },
   "scripts": {
     "build": "tsc -b tsconfig.json",
-    "typecheck": "tsc -b tsconfig.json --noEmit",
+    "typecheck": "tsc -b tsconfig.json",
     "test": "vitest run"
   },
   "files": [

package/node_modules/@types/node/README.md

@@ -8,7 +8,7 @@ This package contains type definitions for node (https://nodejs.org/).
 Files were exported from https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node.
 
 ### Additional Details
- * Last updated: Fri, 05 Jun 2026 22:33:07 GMT
+ * Last updated: Wed, 10 Jun 2026 22:15:09 GMT
  * Dependencies: [undici-types](https://npmjs.com/package/undici-types)
 
 # Credits

package/node_modules/@types/node/http2.d.ts

@@ -20,6 +20,7 @@ declare module "node:http2" {
         ":method"?: string | undefined;
         ":authority"?: string | undefined;
         ":scheme"?: string | undefined;
+        ":protocol"?: string | undefined;
     }
     // Http2Stream
     interface StreamState {

package/node_modules/@types/node/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@types/node",
-    "version": "25.9.2",
+    "version": "25.9.3",
     "description": "TypeScript definitions for node",
     "homepage": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node",
     "license": "MIT",
@@ -150,6 +150,6 @@
         "undici-types": ">=7.24.0 <7.24.7"
     },
     "peerDependencies": {},
-    "typesPublisherContentHash": "a4b1508fd78227ea41216c90a2f88a2fa4eeaefffb6c5d6334a18215ad38d681",
+    "typesPublisherContentHash": "b651099f0be23911446e6a283ee816760ef628511df23064b85b949a9ca68cf5",
     "typeScriptVersion": "5.3"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oscharko-dev/keiko",
-  "version": "0.2.0-beta.3",
+  "version": "0.2.0-beta.4",
   "description": "Enterprise model-agnostic developer-assist coding agent for regulated engineering workflows.",
   "type": "module",
   "license": "Apache-2.0",
@@ -38,6 +38,8 @@
     "format:check": "prettier --check .",
     "test": "npm run build:packages && vitest run",
     "test:coverage": "npm run build:packages && vitest run --coverage",
+    "dev:start": "node scripts/dev-start.mjs",
+    "dev:stop": "node scripts/dev-stop.mjs",
     "prepare:bin": "node scripts/ensure-bin-mode.mjs",
     "build:ui": "node scripts/build-ui.mjs",
     "prune:package-native-optionals": "node scripts/prune-package-native-optionals.mjs",

package/dist/ui/static/_next/static/RAzN8WLtYaktD-ZePowXl/_buildManifest.js

@@ -1 +0,0 @@
-self.__BUILD_MANIFEST=function(e,r,t){return{__rewrites:{afterFiles:[],beforeFiles:[],fallback:[]},__routerFilterStatic:{numItems:9,errorRate:1e-4,numBits:173,numHashes:14,bitArray:[0,0,r,1,1,r,e,r,e,e,e,e,r,e,r,e,e,r,e,r,e,r,e,r,r,r,r,e,e,r,e,r,r,r,e,r,e,e,r,e,e,e,e,e,e,e,r,e,r,e,r,r,r,r,r,r,e,e,r,e,e,r,e,r,r,r,r,e,r,e,e,e,r,r,r,e,e,e,e,e,e,r,r,r,r,r,r,r,r,e,e,r,e,e,r,r,e,e,r,r,r,r,e,e,r,r,r,e,r,e,r,r,e,e,e,e,e,r,e,r,e,e,e,r,e,e,r,e,r,e,e,e,e,e,r,e,e,e,e,r,r,r,e,r,r,e,r,e,r,r,e,r,e,r,e,e,r,e,r,e,e,r,e,e,e,e,r,e,e,r,r,e,r]},__routerFilterDynamic:{numItems:r,errorRate:1e-4,numBits:r,numHashes:null,bitArray:[]},"/_error":["static/chunks/pages/_error-bda15e7831eec981.js"],sortedPages:["/_app","/_error"]}}(1,0,1e-4),self.__BUILD_MANIFEST_CB&&self.__BUILD_MANIFEST_CB();