@pablozrrrr/jevguard 0.1.0

package/skills/jevguard-rules/validate-rules.js

@@ -0,0 +1,991 @@
+// @bun
+// packages/plugin/src/skills/jevguard-rules/validate-rules.ts
+import { readFileSync, statSync } from "fs";
+import { resolve } from "path";
+
+// packages/core/src/ports/types.ts
+var SCOPE_CREEP_ANSWER = "scopeCreep";
+var COMPLEXITY_ANSWER = "complexity";
+// packages/core/src/evaluation/build-request.ts
+var NOUL_INSTRUCTIONS = "Answer true when the attributed change violates the rule's Violation, excluding behavior described by the rule's Allowed exception. Answer false when the change does not violate the rule, including allowed behavior. Return the probability from 0 to 1 that the change violates the rule.";
+function buildJevRequest(task, rule, evidence) {
+  return {
+    kind: "RULE",
+    task,
+    question: {
+      type: "noul",
+      instructions: NOUL_INSTRUCTIONS,
+      criteria: {
+        id: rule.id,
+        description: rule.description,
+        violation: rule.violation,
+        ...rule.allowed === null ? {} : { allowed: rule.allowed }
+      }
+    },
+    change: { files: evidence.files, diff: evidence.diff }
+  };
+}
+// packages/core/src/evaluation/build-context.ts
+function buildReviewContext(turn, rule, scopedPaths) {
+  return {
+    kind: "RULE",
+    turnId: turn.id,
+    ruleId: rule.id,
+    severity: rule.severity,
+    scopedPaths
+  };
+}
+// packages/core/src/evidence/defaults.ts
+var DEFAULT_MAX_DIFF_LENGTH = 1e5;
+var DEFAULT_EVIDENCE_POLICY = {
+  maxDiffLength: DEFAULT_MAX_DIFF_LENGTH,
+  allowedExtensions: [
+    ".ts",
+    ".tsx",
+    ".mts",
+    ".cts",
+    ".js",
+    ".jsx",
+    ".mjs",
+    ".cjs",
+    ".json",
+    ".jsonc",
+    ".md",
+    ".mdx",
+    ".txt",
+    ".yaml",
+    ".yml",
+    ".toml",
+    ".css",
+    ".scss",
+    ".sass",
+    ".less",
+    ".html",
+    ".htm",
+    ".vue",
+    ".svelte",
+    ".py",
+    ".rb",
+    ".go",
+    ".rs",
+    ".java",
+    ".kt",
+    ".kts",
+    ".scala",
+    ".cs",
+    ".php",
+    ".c",
+    ".h",
+    ".cc",
+    ".cpp",
+    ".hpp",
+    ".cxx",
+    ".hh",
+    ".swift",
+    ".dart",
+    ".lua",
+    ".r",
+    ".ex",
+    ".exs",
+    ".erl",
+    ".sh",
+    ".bash",
+    ".zsh",
+    ".fish",
+    ".ps1",
+    ".bat",
+    ".cmd",
+    ".sql",
+    ".graphql",
+    ".gql",
+    ".proto",
+    ".tf",
+    ".hcl",
+    ".xml",
+    ".svg",
+    ".csv",
+    ".tsv",
+    ".diff",
+    ".patch"
+  ],
+  deniedFileNames: [
+    ".env",
+    ".envrc",
+    ".netrc",
+    "_netrc",
+    ".npmrc",
+    ".pypirc",
+    ".pgpass",
+    ".git-credentials",
+    ".htpasswd",
+    ".dockercfg",
+    "id_rsa",
+    "id_dsa",
+    "id_ecdsa",
+    "id_ed25519",
+    "credentials",
+    "credentials.json",
+    "credentials.yaml",
+    "credentials.yml",
+    "secrets",
+    "secrets.json",
+    "secrets.yaml",
+    "secrets.yml",
+    "shadow",
+    "master.key"
+  ],
+  deniedExtensions: [
+    ".pem",
+    ".key",
+    ".p12",
+    ".pfx",
+    ".pkcs12",
+    ".jks",
+    ".keystore",
+    ".ppk",
+    ".p8",
+    ".der"
+  ],
+  deniedDirectoryNames: [".ssh", ".aws", ".gnupg", ".gpg", ".azure", ".kube", ".docker"]
+};
+
+// packages/core/src/evidence/paths.ts
+function normalizePath(path) {
+  return path.replace(/\\/g, "/");
+}
+function pathSegments(path) {
+  return normalizePath(path).split("/").filter((segment) => segment !== "");
+}
+function pathBasename(path) {
+  const segments = pathSegments(path);
+  return segments[segments.length - 1] ?? "";
+}
+function fileExtension(path) {
+  const basename = pathBasename(path).toLowerCase();
+  const dot = basename.lastIndexOf(".");
+  return dot <= 0 ? "" : basename.slice(dot);
+}
+
+// packages/core/src/evidence/safety.ts
+var DENIED_SENSITIVE = { allowed: false, reason: "DENIED_SENSITIVE_PATH" };
+var DENIED_EXTENSION = { allowed: false, reason: "EXTENSION_NOT_ALLOWED" };
+function checkFilePath(path, policy) {
+  const basename = pathBasename(path).toLowerCase();
+  if (matchesDeniedFileName(basename, policy)) {
+    return DENIED_SENSITIVE;
+  }
+  const segments = pathSegments(path).map((segment) => segment.toLowerCase());
+  if (segments.some((segment) => policy.deniedDirectoryNames.includes(segment))) {
+    return DENIED_SENSITIVE;
+  }
+  const extension = fileExtension(path);
+  if (policy.deniedExtensions.includes(extension)) {
+    return DENIED_SENSITIVE;
+  }
+  if (!policy.allowedExtensions.includes(extension)) {
+    return DENIED_EXTENSION;
+  }
+  return { allowed: true };
+}
+function matchesDeniedFileName(basename, policy) {
+  return policy.deniedFileNames.some((name) => name.startsWith(".") ? basename === name || basename.startsWith(`${name}.`) : basename === name);
+}
+
+// packages/core/src/evidence/scope.ts
+function matchesScope(path, scope) {
+  return globToRegExp(scope).test(normalizePath(path));
+}
+function globToRegExp(glob) {
+  const source = glob.replace(/\\/g, "/");
+  let pattern = "";
+  for (let index = 0;index < source.length; index += 1) {
+    const char = source[index] ?? "";
+    if (char === "*") {
+      if (source[index + 1] === "*") {
+        const followedBySlash = source[index + 2] === "/";
+        pattern += followedBySlash ? "(?:.*/)?" : ".*";
+        index += followedBySlash ? 2 : 1;
+      } else {
+        pattern += "[^/]*";
+      }
+      continue;
+    }
+    if (char === "?") {
+      pattern += "[^/]";
+      continue;
+    }
+    pattern += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${pattern}$`);
+}
+
+// packages/core/src/evidence/select-evidence.ts
+function selectRuleEvidence(turn, rule, policy = DEFAULT_EVIDENCE_POLICY) {
+  if (hasNoAttributedPatch(turn)) {
+    return { status: "SKIPPED", reason: "NO_ATTRIBUTED_PATCH" };
+  }
+  const applicableFiles = selectApplicableFiles(turn.files, rule.scope);
+  if (applicableFiles.length === 0) {
+    return { status: "SKIPPED", reason: "NO_SCOPE_MATCH" };
+  }
+  return mountEvidence(applicableFiles, policy);
+}
+function selectTurnEvidence(turn, policy = DEFAULT_EVIDENCE_POLICY) {
+  if (hasNoAttributedPatch(turn)) {
+    return { status: "SKIPPED", reason: "NO_ATTRIBUTED_PATCH" };
+  }
+  const attributedFiles = turn.files.filter((file) => file.patch.trim() !== "");
+  return mountEvidence(attributedFiles, policy);
+}
+function mountEvidence(files, policy) {
+  const diff = assembleDiff(files);
+  if (diff.trim() === "") {
+    return { status: "SKIPPED", reason: "NO_ATTRIBUTED_PATCH" };
+  }
+  if (diff.length > policy.maxDiffLength) {
+    return { status: "UNAVAILABLE", reason: "OVERSIZED_DIFF" };
+  }
+  if (files.some((file) => !checkFilePath(file.path, policy).allowed)) {
+    return { status: "UNAVAILABLE", reason: "BLOCKED_EVIDENCE" };
+  }
+  return {
+    status: "SELECTED",
+    evidence: { files: files.map((file) => file.path), diff }
+  };
+}
+function hasNoAttributedPatch(turn) {
+  return turn.files.every((file) => file.patch.trim() === "");
+}
+function selectApplicableFiles(files, scope) {
+  if (scope === null) {
+    return files;
+  }
+  return files.filter((file) => matchesScope(file.path, scope));
+}
+function assembleDiff(files) {
+  return files.map((file) => file.patch).join(`
+`);
+}
+
+// packages/core/src/gate/probability.ts
+function isProbability(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1;
+}
+
+// packages/core/src/gate/evaluate-gate.ts
+function evaluateGate(severity, violationProbability, config) {
+  if (!isProbability(violationProbability)) {
+    return { outcome: "UNAVAILABLE", reason: "JEV_FAILURE" };
+  }
+  switch (severity) {
+    case "error":
+      return evaluateErrorGate(violationProbability, config.thresholds.error);
+    case "warning":
+      return evaluateWarningGate(violationProbability, config.thresholds.warning);
+  }
+}
+function evaluateErrorGate(probability, thresholds) {
+  if (probability < thresholds.warn) {
+    return { outcome: "PASS", violationProbability: probability };
+  }
+  if (probability < thresholds.fail) {
+    return { outcome: "WARN", violationProbability: probability };
+  }
+  return { outcome: "FAIL", violationProbability: probability };
+}
+function evaluateWarningGate(probability, thresholds) {
+  if (probability < thresholds.warn) {
+    return { outcome: "PASS", violationProbability: probability };
+  }
+  return { outcome: "WARN", violationProbability: probability };
+}
+
+// packages/core/src/evaluation/evaluate-with-port.ts
+async function evaluateWithPort(port, request) {
+  try {
+    const result = await port.evaluate(request);
+    return result.kind === "RULE" ? result : { kind: "RULE", status: "FAILED", reason: "INVALID_RESPONSE" };
+  } catch {
+    return { kind: "RULE", status: "FAILED", reason: "API_ERROR" };
+  }
+}
+async function evaluateBuiltInBatchWithPort(port, request) {
+  try {
+    const result = await port.evaluate(request);
+    return result.kind === "BUILT_IN_BATCH" ? result : { kind: "BUILT_IN_BATCH", status: "FAILED", reason: "INVALID_RESPONSE" };
+  } catch {
+    return { kind: "BUILT_IN_BATCH", status: "FAILED", reason: "API_ERROR" };
+  }
+}
+
+// packages/core/src/evaluation/evaluate-rule.ts
+async function evaluateRule(input, dependencies) {
+  const selection = selectRuleEvidence(input.turn, input.rule, input.evidencePolicy);
+  if (selection.status === "SKIPPED") {
+    const context = buildReviewContext(input.turn, input.rule, []);
+    return { ...context, outcome: "SKIPPED", reason: selection.reason };
+  }
+  if (selection.status === "UNAVAILABLE") {
+    const context = buildReviewContext(input.turn, input.rule, []);
+    return { ...context, outcome: "UNAVAILABLE", reason: selection.reason };
+  }
+  const context = buildReviewContext(input.turn, input.rule, selection.evidence.files);
+  const request = buildJevRequest(input.turn.task, input.rule, selection.evidence);
+  const evaluation = await evaluateWithPort(dependencies.jev, request);
+  if (evaluation.status === "FAILED") {
+    return { ...context, outcome: "UNAVAILABLE", reason: "JEV_FAILURE" };
+  }
+  const gate = evaluateGate(input.rule.severity, evaluation.noul.violationProbability, input.gateConfig);
+  return { ...context, ...gate };
+}
+// packages/core/src/review/aggregate.ts
+var VERDICT_RANK = { PASS: 0, WARN: 1, FAIL: 2 };
+function aggregateReview(turnId, results) {
+  const snapshot = [...results];
+  return { turnId, results: snapshot, summary: summarize(snapshot) };
+}
+function summarize(results) {
+  const counts = countOutcomes(results);
+  return {
+    verdict: highestVerdict(results),
+    hasUnavailable: counts.unavailable > 0,
+    counts
+  };
+}
+function countOutcomes(results) {
+  const counts = { pass: 0, warn: 0, fail: 0, skipped: 0, unavailable: 0 };
+  for (const result of results) {
+    switch (result.outcome) {
+      case "PASS":
+        counts.pass += 1;
+        break;
+      case "WARN":
+        counts.warn += 1;
+        break;
+      case "FAIL":
+        counts.fail += 1;
+        break;
+      case "SKIPPED":
+        counts.skipped += 1;
+        break;
+      case "UNAVAILABLE":
+        counts.unavailable += 1;
+        break;
+    }
+  }
+  return counts;
+}
+function highestVerdict(results) {
+  let highest = null;
+  for (const result of results) {
+    if (!isSemanticVerdict(result.outcome)) {
+      continue;
+    }
+    if (highest === null || VERDICT_RANK[result.outcome] > VERDICT_RANK[highest]) {
+      highest = result.outcome;
+    }
+  }
+  return highest;
+}
+function isSemanticVerdict(outcome) {
+  return outcome === "PASS" || outcome === "WARN" || outcome === "FAIL";
+}
+
+// packages/core/src/evaluation/evaluate-rules.ts
+async function evaluateRules(input, dependencies) {
+  const results = [];
+  for (const rule of input.rules) {
+    results.push(await evaluateRuleResult(input, rule, dependencies));
+  }
+  return aggregateReview(input.turn.id, results);
+}
+async function evaluateRuleResult(input, rule, dependencies) {
+  if (rule.status === "INVALID") {
+    return invalidRuleResult(input.turn.id, rule);
+  }
+  if (input.gateConfig.status === "INVALID") {
+    return invalidConfigResult(input.turn, rule.rule);
+  }
+  const ruleInput = {
+    turn: input.turn,
+    rule: rule.rule,
+    gateConfig: input.gateConfig.config,
+    evidencePolicy: input.evidencePolicy
+  };
+  return evaluateRule(ruleInput, dependencies);
+}
+function invalidRuleResult(turnId, failure) {
+  return {
+    kind: "RULE",
+    turnId,
+    ruleId: failure.ruleId,
+    severity: null,
+    scopedPaths: [],
+    outcome: "UNAVAILABLE",
+    reason: "INVALID_RULE"
+  };
+}
+function invalidConfigResult(turn, rule) {
+  return {
+    ...buildReviewContext(turn, rule, []),
+    outcome: "UNAVAILABLE",
+    reason: "INVALID_CONFIG"
+  };
+}
+// packages/core/src/rules/headings.ts
+var RULE_HEADING = /^##\s+(.*)$/;
+var SECTION_HEADING = /^###\s+(.*)$/;
+function matchRuleHeading(line) {
+  const match = RULE_HEADING.exec(line);
+  if (match === null) {
+    return null;
+  }
+  return (match[1] ?? "").trim();
+}
+function matchSectionHeading(line) {
+  const match = SECTION_HEADING.exec(line);
+  if (match === null) {
+    return null;
+  }
+  return (match[1] ?? "").trim();
+}
+
+// packages/core/src/rules/metadata.ts
+var METADATA_ENTRY = /^([A-Za-z][A-Za-z0-9_-]*)\s*:\s*(.*)$/;
+function parseRuleMetadata(lines) {
+  let severity = null;
+  let scope = null;
+  const seenKeys = new Set;
+  for (const line of collectMetadataLines(lines)) {
+    const entry = parseMetadataEntry(line);
+    if (entry === null) {
+      return { ok: false, code: "MALFORMED_METADATA" };
+    }
+    if (seenKeys.has(entry.key)) {
+      return { ok: false, code: "DUPLICATE_METADATA" };
+    }
+    seenKeys.add(entry.key);
+    if (entry.key === "severity") {
+      const parsed = parseSeverity(entry.value);
+      if (parsed === null) {
+        return { ok: false, code: "INVALID_SEVERITY" };
+      }
+      severity = parsed;
+      continue;
+    }
+    if (entry.key === "scope") {
+      if (entry.value === "") {
+        return { ok: false, code: "MALFORMED_METADATA" };
+      }
+      scope = entry.value;
+      continue;
+    }
+    return { ok: false, code: "MALFORMED_METADATA" };
+  }
+  if (severity === null) {
+    return { ok: false, code: "MISSING_SEVERITY" };
+  }
+  return { ok: true, value: { severity, scope } };
+}
+function collectMetadataLines(lines) {
+  const collected = [];
+  for (const line of lines) {
+    if (matchSectionHeading(line) !== null) {
+      break;
+    }
+    if (line.trim() !== "") {
+      collected.push(line);
+    }
+  }
+  return collected;
+}
+function parseMetadataEntry(line) {
+  const match = METADATA_ENTRY.exec(line);
+  if (match === null) {
+    return null;
+  }
+  return { key: match[1] ?? "", value: (match[2] ?? "").trim() };
+}
+function parseSeverity(value) {
+  switch (value) {
+    case "error":
+    case "warning":
+      return value;
+    default:
+      return null;
+  }
+}
+
+// packages/core/src/rules/sections.ts
+var SECTION_NAMES = ["Rule", "Violation", "Allowed"];
+function parseRuleSections(lines) {
+  const collected = collectSections(lines);
+  if (!collected.ok) {
+    return collected;
+  }
+  return validateSections(collected.value);
+}
+function collectSections(lines) {
+  const sections = new Map;
+  let current = null;
+  let content = [];
+  for (const line of lines) {
+    const heading = matchSectionHeading(line);
+    if (heading === null) {
+      if (current !== null) {
+        content.push(line);
+      }
+      continue;
+    }
+    if (current !== null) {
+      sections.set(current, joinContent(content));
+    }
+    if (!SECTION_NAMES.includes(heading)) {
+      return { ok: false, code: "UNKNOWN_SECTION" };
+    }
+    if (sections.has(heading)) {
+      return { ok: false, code: "DUPLICATE_SECTION" };
+    }
+    current = heading;
+    content = [];
+  }
+  if (current !== null) {
+    sections.set(current, joinContent(content));
+  }
+  return { ok: true, value: sections };
+}
+function validateSections(sections) {
+  const rule = sections.get("Rule");
+  const violation = sections.get("Violation");
+  const allowed = sections.get("Allowed") ?? null;
+  if (rule === undefined) {
+    return { ok: false, code: "MISSING_RULE" };
+  }
+  if (violation === undefined) {
+    return { ok: false, code: "MISSING_VIOLATION" };
+  }
+  if (rule === "") {
+    return { ok: false, code: "EMPTY_SECTION" };
+  }
+  if (violation === "") {
+    return { ok: false, code: "EMPTY_SECTION" };
+  }
+  if (allowed === "") {
+    return { ok: false, code: "EMPTY_ALLOWED" };
+  }
+  if (allowed !== null && allowed === violation) {
+    return { ok: false, code: "ALLOWED_EQUALS_VIOLATION" };
+  }
+  return { ok: true, value: { rule, violation, allowed } };
+}
+function joinContent(lines) {
+  return lines.join(`
+`).trim();
+}
+
+// packages/core/src/rules/blocks.ts
+var RULE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function isValidRuleId(id) {
+  return RULE_ID.test(id);
+}
+function collectRuleBlocks(text) {
+  const blocks = [];
+  let current = null;
+  for (const line of splitLines(text)) {
+    const id = matchRuleHeading(line);
+    if (id !== null) {
+      current = { id, body: [] };
+      blocks.push(current);
+      continue;
+    }
+    if (current !== null) {
+      current.body.push(line);
+    }
+  }
+  return blocks;
+}
+function parseRuleBlock(block, duplicate) {
+  if (!isValidRuleId(block.id)) {
+    return ruleCandidateFailure("INVALID_ID", null);
+  }
+  if (duplicate) {
+    return ruleCandidateFailure("DUPLICATE_ID", block.id);
+  }
+  const metadata = parseRuleMetadata(block.body);
+  if (!metadata.ok) {
+    return ruleCandidateFailure(metadata.code, block.id);
+  }
+  const sections = parseRuleSections(block.body);
+  if (!sections.ok) {
+    return ruleCandidateFailure(sections.code, block.id);
+  }
+  return {
+    status: "PARSED",
+    rule: buildParsedRule(block.id, metadata.value, sections.value)
+  };
+}
+function ruleCandidateFailure(code, ruleId) {
+  return { status: "INVALID", reason: "INVALID_RULE", code, ruleId };
+}
+function splitLines(text) {
+  return text.replace(/\r\n?/g, `
+`).split(`
+`);
+}
+function buildParsedRule(id, metadata, sections) {
+  return {
+    id,
+    severity: metadata.severity,
+    scope: metadata.scope,
+    description: sections.rule,
+    violation: sections.violation,
+    allowed: sections.allowed
+  };
+}
+// packages/core/src/rules/parse-rules.ts
+function parseRules(text) {
+  const blocks = collectRuleBlocks(text);
+  if (blocks.length === 0) {
+    return [ruleCandidateFailure("MISSING_ID", null)];
+  }
+  const duplicates = findDuplicateIds(blocks.map((block) => block.id));
+  return blocks.map((block) => parseRuleBlock(block, duplicates.has(block.id)));
+}
+function findDuplicateIds(ids) {
+  const counts = new Map;
+  for (const id of ids) {
+    if (!isValidRuleId(id)) {
+      continue;
+    }
+    counts.set(id, (counts.get(id) ?? 0) + 1);
+  }
+  const duplicates = new Set;
+  for (const [id, count] of counts) {
+    if (count > 1) {
+      duplicates.add(id);
+    }
+  }
+  return duplicates;
+}
+// packages/core/src/builtins/complexity.ts
+var COMPLEXITY_CHECK_ID = "COMPLEXITY";
+var COMPLEXITY_GATE_CONFIG = {
+  version: 1,
+  thresholds: {
+    error: { warn: 0.4, fail: 0.7 },
+    warning: { warn: 0.5 }
+  }
+};
+var COMPLEXITY_INSTRUCTIONS = "Does this attributed change introduce material complexity that is disproportionate to, or not reasonably necessary for, completing the user's task? Necessary supporting changes, tests, validation, error handling, and complexity explicitly required by the task should not count as unnecessary complexity. Return the probability from 0 to 1 that the change introduces disproportionate or unnecessary complexity.";
+var COMPLEXITY_DESCRIPTION = "Material complexity introduced by the attributed change that is disproportionate to the problem and not reasonably necessary for completing the task.";
+var COMPLEXITY_VIOLATION = "The change adds unnecessary abstractions, layers or indirections without proportional gain, new dependencies without clear need, excessive configuration, premature generalization, or structure materially larger than the problem requires.";
+var COMPLEXITY_ALLOWED = "Complexity explicitly required by the task, and necessary supporting changes, tests, validation, error handling, auxiliary changes, or following an existing codebase abstraction to avoid breaking its pattern.";
+function buildComplexityQuestion() {
+  return {
+    type: "noul",
+    instructions: COMPLEXITY_INSTRUCTIONS,
+    criteria: {
+      id: COMPLEXITY_CHECK_ID,
+      description: COMPLEXITY_DESCRIPTION,
+      violation: COMPLEXITY_VIOLATION,
+      allowed: COMPLEXITY_ALLOWED
+    }
+  };
+}
+function buildComplexityContext(turn, scopedPaths) {
+  return {
+    kind: "BUILT_IN",
+    turnId: turn.id,
+    ruleId: null,
+    checkId: COMPLEXITY_CHECK_ID,
+    severity: "warning",
+    scopedPaths
+  };
+}
+
+// packages/core/src/builtins/scope-creep.ts
+var SCOPE_CREEP_CHECK_ID = "SCOPE-CREEP";
+var SCOPE_CREEP_GATE_CONFIG = {
+  version: 1,
+  thresholds: {
+    error: { warn: 0.65, fail: 0.9 },
+    warning: { warn: 0.6 }
+  }
+};
+var SCOPE_CREEP_INSTRUCTIONS = "Answer true when the attributed change contains scope creep: material functional, behavioral, architectural, dependency, configuration, documentation, or refactoring work that the task did not request and that is not reasonably necessary to complete the task. Answer false when every change is requested work, or supporting, testing, or documentation work reasonably necessary to complete the requested work, including immaterial incidental edits. Return the probability from 0 to 1 that the change is scope creep.";
+var SCOPE_CREEP_DESCRIPTION = "A change is scope creep when it introduces material functional, behavioral, architectural, dependency, configuration, documentation, or refactoring work that the task did not request and that is not reasonably necessary to complete it.";
+var SCOPE_CREEP_VIOLATION = "The change adds material functional, behavioral, architectural, dependency, configuration, documentation, or refactoring work that the task did not request and that is not reasonably necessary to complete the task.";
+var SCOPE_CREEP_ALLOWED = "Changes the task requested, and supporting, testing, and documentation changes reasonably necessary to complete the requested work, including immaterial incidental edits.";
+function buildScopeCreepQuestion() {
+  return {
+    type: "noul",
+    instructions: SCOPE_CREEP_INSTRUCTIONS,
+    criteria: {
+      id: SCOPE_CREEP_CHECK_ID,
+      description: SCOPE_CREEP_DESCRIPTION,
+      violation: SCOPE_CREEP_VIOLATION,
+      allowed: SCOPE_CREEP_ALLOWED
+    }
+  };
+}
+function buildScopeCreepContext(turn, scopedPaths) {
+  return {
+    kind: "BUILT_IN",
+    turnId: turn.id,
+    ruleId: null,
+    checkId: SCOPE_CREEP_CHECK_ID,
+    severity: "error",
+    scopedPaths
+  };
+}
+
+// packages/core/src/builtins/evaluate-builtins.ts
+function buildBuiltInBatchRequest(task, evidence) {
+  return {
+    kind: "BUILT_IN_BATCH",
+    task,
+    questions: {
+      [SCOPE_CREEP_ANSWER]: buildScopeCreepQuestion(),
+      [COMPLEXITY_ANSWER]: buildComplexityQuestion()
+    },
+    change: { files: evidence.files, diff: evidence.diff }
+  };
+}
+async function evaluateBuiltIns(input, dependencies) {
+  const selection = selectTurnEvidence(input.turn, input.evidencePolicy);
+  if (selection.status === "SKIPPED") {
+    return {
+      scopeCreep: {
+        ...buildScopeCreepContext(input.turn, []),
+        outcome: "SKIPPED",
+        reason: selection.reason
+      },
+      complexity: {
+        ...buildComplexityContext(input.turn, []),
+        outcome: "SKIPPED",
+        reason: selection.reason
+      }
+    };
+  }
+  if (selection.status === "UNAVAILABLE") {
+    return {
+      scopeCreep: {
+        ...buildScopeCreepContext(input.turn, []),
+        outcome: "UNAVAILABLE",
+        reason: selection.reason
+      },
+      complexity: {
+        ...buildComplexityContext(input.turn, []),
+        outcome: "UNAVAILABLE",
+        reason: selection.reason
+      }
+    };
+  }
+  const evidence = selection.evidence;
+  const request = buildBuiltInBatchRequest(input.turn.task, evidence);
+  const evaluation = await evaluateBuiltInBatchWithPort(dependencies.jev, request);
+  const scopeCreepContext = buildScopeCreepContext(input.turn, evidence.files);
+  const complexityContext = buildComplexityContext(input.turn, evidence.files);
+  if (evaluation.status === "FAILED") {
+    return {
+      scopeCreep: { ...scopeCreepContext, outcome: "UNAVAILABLE", reason: "JEV_FAILURE" },
+      complexity: { ...complexityContext, outcome: "UNAVAILABLE", reason: "JEV_FAILURE" }
+    };
+  }
+  return {
+    scopeCreep: gateScopeCreep(evaluation.answers.scopeCreep, scopeCreepContext),
+    complexity: gateComplexity(evaluation.answers.complexity, complexityContext)
+  };
+}
+function gateScopeCreep(answer, context) {
+  if (answer.status === "FAILED") {
+    return { ...context, outcome: "UNAVAILABLE", reason: "JEV_FAILURE" };
+  }
+  return {
+    ...context,
+    ...evaluateGate("error", answer.noul.violationProbability, SCOPE_CREEP_GATE_CONFIG)
+  };
+}
+function gateComplexity(answer, context) {
+  if (answer.status === "FAILED") {
+    return { ...context, outcome: "UNAVAILABLE", reason: "JEV_FAILURE" };
+  }
+  return {
+    ...context,
+    ...evaluateGate("warning", answer.noul.violationProbability, COMPLEXITY_GATE_CONFIG)
+  };
+}
+// packages/core/src/concurrency/fifo-port.ts
+function createFifoJevPort(port, config) {
+  const maxConcurrency = config.maxConcurrency;
+  if (!Number.isInteger(maxConcurrency) || maxConcurrency < 1) {
+    throw new RangeError("maxConcurrency must be a positive integer");
+  }
+  const queue = [];
+  let active = 0;
+  function drain() {
+    while (active < maxConcurrency && queue.length > 0) {
+      const pending = queue.shift();
+      if (pending === undefined) {
+        return;
+      }
+      active += 1;
+      start(pending);
+    }
+  }
+  function start(pending) {
+    Promise.resolve().then(() => port.evaluate(pending.request)).then((result) => {
+      active -= 1;
+      pending.settle(result);
+      drain();
+    }, (error) => {
+      active -= 1;
+      pending.fail(error);
+      drain();
+    });
+  }
+  return {
+    evaluate(request) {
+      return new Promise((settle, fail) => {
+        queue.push({ request, settle, fail });
+        drain();
+      });
+    }
+  };
+}
+// packages/core/src/gate/defaults.ts
+var DEFAULT_GATE_CONFIG = {
+  version: 1,
+  thresholds: {
+    error: { warn: 0.4, fail: 0.7 },
+    warning: { warn: 0.6 }
+  }
+};
+// packages/core/src/gate/config.ts
+function resolveGateConfig(value) {
+  if (value === null || value === undefined) {
+    return { status: "VALID", config: DEFAULT_GATE_CONFIG };
+  }
+  if (!isRecord(value) || value.version !== 1) {
+    return invalid();
+  }
+  const thresholds = value.thresholds;
+  if (!isRecord(thresholds)) {
+    return invalid();
+  }
+  const error = thresholds.error;
+  const warning = thresholds.warning;
+  if (!isRecord(error) || !isRecord(warning)) {
+    return invalid();
+  }
+  const errorWarn = error.warn;
+  const errorFail = error.fail;
+  const warningWarn = warning.warn;
+  if (!isProbability(errorWarn) || !isProbability(errorFail) || !isProbability(warningWarn)) {
+    return invalid();
+  }
+  if (errorWarn >= errorFail) {
+    return invalid();
+  }
+  return {
+    status: "VALID",
+    config: {
+      version: 1,
+      thresholds: {
+        error: { warn: errorWarn, fail: errorFail },
+        warning: { warn: warningWarn }
+      }
+    }
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function invalid() {
+  return { status: "INVALID", reason: "INVALID_CONFIG" };
+}
+// packages/plugin/src/skills/jevguard-rules/rules-summary.ts
+function summarizeRules(text) {
+  const results = parseRules(text);
+  const ruleIds = [];
+  const invalidRuleIds = [];
+  const errorCodes = [];
+  for (const result of results) {
+    if (result.status === "PARSED") {
+      ruleIds.push(result.rule.id);
+      continue;
+    }
+    invalidRuleIds.push(result.ruleId);
+    errorCodes.push(result.code);
+  }
+  return {
+    status: invalidRuleIds.length === 0 ? "valid" : "invalid",
+    ruleCount: results.length,
+    ruleIds,
+    invalidCount: invalidRuleIds.length,
+    invalidRuleIds,
+    errorCodes: [...new Set(errorCodes)]
+  };
+}
+
+// packages/plugin/src/skills/jevguard-rules/validate-rules.ts
+var MAX_DOCUMENT_BYTES = 1048576;
+var EXIT_VALID = 0;
+var EXIT_INVALID = 1;
+var EXIT_ERROR = 2;
+var EXPECTED_ARGUMENT_COUNT = 1;
+function print(report, exitCode) {
+  process.stdout.write(`${JSON.stringify(report)}
+`);
+  return exitCode;
+}
+function fail(errorCode) {
+  return print({ status: "error", errorCode }, EXIT_ERROR);
+}
+function resolvePath(requested) {
+  try {
+    return resolve(requested);
+  } catch {
+    return null;
+  }
+}
+function readDocument(path) {
+  let size;
+  try {
+    const stats = statSync(path);
+    if (!stats.isFile()) {
+      return { ok: false, code: "NOT_A_FILE" };
+    }
+    size = stats.size;
+  } catch {
+    return { ok: false, code: "NOT_A_FILE" };
+  }
+  if (size > MAX_DOCUMENT_BYTES) {
+    return { ok: false, code: "FILE_TOO_LARGE" };
+  }
+  try {
+    return { ok: true, text: readFileSync(path, "utf8") };
+  } catch {
+    return { ok: false, code: "READ_FAILURE" };
+  }
+}
+function main(argv) {
+  if (argv.length !== EXPECTED_ARGUMENT_COUNT) {
+    return fail("EXPECTED_ONE_PATH_ARGUMENT");
+  }
+  const requested = argv[0];
+  if (requested === undefined || requested.length === 0) {
+    return fail("EXPECTED_ONE_PATH_ARGUMENT");
+  }
+  const path = resolvePath(requested);
+  if (path === null) {
+    return fail("INVALID_PATH");
+  }
+  const document = readDocument(path);
+  if (!document.ok) {
+    return fail(document.code);
+  }
+  const summary = summarizeRules(document.text);
+  return print(summary, summary.status === "valid" ? EXIT_VALID : EXIT_INVALID);
+}
+process.exitCode = main(process.argv.slice(2));