@poetic-ai/poetic 1.42.1-bootstrap.0

package/dist/chunk-ZDTGECTN.js

@@ -0,0 +1,235 @@
+import {
+  readCanonicalPoeticConfig,
+  selectedPoeticConfigCandidate
+} from "./chunk-G36W2T2S.js";
+import {
+  readDataMigrationMarker,
+  shouldUseGlobalTelemetry
+} from "./chunk-CD7ISXA4.js";
+import {
+  LabPathResolver
+} from "./chunk-7GDRQBQC.js";
+import {
+  getConfigPaths
+} from "./chunk-L6OM4A22.js";
+import {
+  getDataDir,
+  getGlobalTelemetryDir,
+  getProjectDataDir,
+  getStableRepoIdentity
+} from "./chunk-UUH2RVKS.js";
+import {
+  isPathWithin
+} from "./chunk-XZE4XARH.js";
+import {
+  POETIC_TELEMETRY_DB,
+  readEnv
+} from "./chunk-5DLKYTQX.js";
+
+// src/telemetry/telemetry-path-resolver.ts
+import { execSync } from "child_process";
+import fs2 from "fs";
+import path2 from "path";
+
+// src/utils/project-registry.ts
+import fs from "fs";
+import path from "path";
+import Database from "better-sqlite3";
+function getRegistryDbPath(dataDir = getDataDir()) {
+  return path.join(dataDir, "registry.db");
+}
+function openRegistryDb(dataDir = getDataDir()) {
+  fs.mkdirSync(dataDir, { recursive: true, mode: 448 });
+  const db = new Database(getRegistryDbPath(dataDir));
+  db.pragma("journal_mode = WAL");
+  db.pragma("synchronous = NORMAL");
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS projects (
+      project_id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      git_common_dir TEXT NOT NULL,
+      first_seen TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      last_seen TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+    );
+  `);
+  return db;
+}
+function upsertProjectRegistryEntry(entry, dataDir = getDataDir()) {
+  const db = openRegistryDb(dataDir);
+  try {
+    db.prepare(
+      `
+      INSERT INTO projects (project_id, name, git_common_dir)
+      VALUES (?, ?, ?)
+      ON CONFLICT(project_id) DO UPDATE SET
+        last_seen = CURRENT_TIMESTAMP,
+        name = excluded.name,
+        git_common_dir = excluded.git_common_dir
+    `
+    ).run(entry.projectId, entry.name, entry.gitCommonDir);
+  } finally {
+    db.close();
+  }
+}
+
+// src/telemetry/telemetry-path-resolver.ts
+function isSameDirectory(left, right) {
+  const resolvedLeft = path2.resolve(left);
+  const resolvedRight = path2.resolve(right);
+  if (resolvedLeft === resolvedRight) {
+    return true;
+  }
+  try {
+    return fs2.realpathSync(resolvedLeft) === fs2.realpathSync(resolvedRight);
+  } catch {
+    return false;
+  }
+}
+function resolveRepoRootFromPoeticDir(poeticDir) {
+  const normalized = path2.resolve(poeticDir);
+  return path2.basename(normalized) === ".poetic" ? path2.dirname(normalized) : normalized;
+}
+var TelemetryPathResolver = class _TelemetryPathResolver {
+  static instance = null;
+  projectIdByRepoRoot = /* @__PURE__ */ new Map();
+  registryUpsertAttempted = /* @__PURE__ */ new Set();
+  static getInstance() {
+    if (!_TelemetryPathResolver.instance) {
+      _TelemetryPathResolver.instance = new _TelemetryPathResolver();
+    }
+    return _TelemetryPathResolver.instance;
+  }
+  resolveDbDir(poeticDir) {
+    const absolutePoeticDir = path2.resolve(poeticDir);
+    const telemetryDbOverride = readEnv(POETIC_TELEMETRY_DB).value;
+    if (telemetryDbOverride) {
+      const overridePath = path2.resolve(telemetryDbOverride);
+      return overridePath.endsWith(".db") ? path2.dirname(overridePath) : overridePath;
+    }
+    const configuredTelemetryDb = this.resolveConfiguredTelemetryDb(absolutePoeticDir);
+    if (configuredTelemetryDb) {
+      if (this.migrationSupersedesConfiguredDb(absolutePoeticDir, configuredTelemetryDb)) {
+        return path2.join(getGlobalTelemetryDir(), "db");
+      }
+      return configuredTelemetryDb.endsWith(".db") ? path2.dirname(configuredTelemetryDb) : configuredTelemetryDb;
+    }
+    if (shouldUseGlobalTelemetry(absolutePoeticDir)) {
+      return path2.join(getGlobalTelemetryDir(), "db");
+    }
+    const labResolver = LabPathResolver.getInstance();
+    return path2.join(labResolver.getTelemetryDir(absolutePoeticDir), "db");
+  }
+  resolveProjectDataDir(poeticDir) {
+    const repoRoot = this.resolveRepoRootFromPoeticDir(poeticDir);
+    return getProjectDataDir(repoRoot);
+  }
+  getProjectId(poeticDir, options = {}) {
+    const { register = true } = options;
+    const repoRoot = this.resolveRepoRootFromPoeticDir(poeticDir);
+    const cacheKey = path2.resolve(repoRoot);
+    const cached = this.projectIdByRepoRoot.get(cacheKey);
+    const projectId = cached ?? getStableRepoIdentity(repoRoot);
+    if (!cached) {
+      this.projectIdByRepoRoot.set(cacheKey, projectId);
+    }
+    if (register && !this.registryUpsertAttempted.has(projectId)) {
+      this.registryUpsertAttempted.add(projectId);
+      const gitCommonDir = this.resolveGitCommonDir(repoRoot);
+      try {
+        upsertProjectRegistryEntry({
+          projectId,
+          name: path2.basename(repoRoot),
+          gitCommonDir
+        });
+      } catch {
+      }
+    }
+    return projectId;
+  }
+  getDbContext() {
+    const labContext = LabPathResolver.getInstance().getContext();
+    if (!labContext) {
+      return { labId: null, labRunId: null };
+    }
+    return {
+      labId: labContext.labId,
+      labRunId: labContext.runId
+    };
+  }
+  resolveRepoRootFromPoeticDir(poeticDir) {
+    return resolveRepoRootFromPoeticDir(poeticDir);
+  }
+  /**
+   * True when a completed data migration should outrank a configured telemetry DB path.
+   *
+   * `poetic init` writes the repo-local default `.poetic/telemetry/db/variants.db` into
+   * generated configs, and `resolveConfiguredTelemetryDb` only ever returns repo-local
+   * paths. Honouring that after the migration has run would recreate the database inside
+   * the checkout and silently resume the repo-local/external divergence the migration
+   * just merged away -- while the completion marker suppresses any further advisory.
+   *
+   * Both conditions below are load-bearing, and neither may be relaxed to a bare
+   * "marker exists" check:
+   *
+   * 1. The configured path must be the directory the migration actually moved. A config
+   *    pointing anywhere else (say `.poetic/custom/telemetry.db`) is not a migration
+   *    target, so its database still holds the only copy of its rows; overriding it would
+   *    abandon that data silently.
+   * 2. The marker must have been written against the currently resolved external root. If
+   *    `POETIC_HOME`/`POETIC_DATA_DIR` changed, or the repo was moved with its marker,
+   *    routing to today's root would write into an empty location while the migrated
+   *    history stayed behind at the recorded one.
+   */
+  migrationSupersedesConfiguredDb(poeticDir, configuredTelemetryDb) {
+    const marker = readDataMigrationMarker(poeticDir);
+    if (!marker) {
+      return false;
+    }
+    const repoRoot = this.resolveRepoRootFromPoeticDir(poeticDir);
+    const migratedDbDir = path2.join(repoRoot, ".poetic", "telemetry", "db");
+    const configuredDbDir = configuredTelemetryDb.endsWith(".db") ? path2.dirname(configuredTelemetryDb) : configuredTelemetryDb;
+    if (path2.resolve(configuredDbDir) !== path2.resolve(migratedDbDir)) {
+      return false;
+    }
+    return isSameDirectory(marker.globalTelemetryDir, getGlobalTelemetryDir());
+  }
+  resolveConfiguredTelemetryDb(poeticDir) {
+    const repoRoot = this.resolveRepoRootFromPoeticDir(poeticDir);
+    const paths = getConfigPaths(repoRoot);
+    for (const configuredPath of [paths.projectConfigFile, paths.userConfigFile]) {
+      const configPath = selectedPoeticConfigCandidate(configuredPath);
+      const read = readCanonicalPoeticConfig(configPath);
+      if (read.status === "invalid") continue;
+      if (read.status === "missing") continue;
+      const database = read.config.telemetry?.database;
+      if (typeof database === "string" && database.trim() !== "") {
+        const resolved = path2.resolve(repoRoot, database);
+        if (isPathWithin(resolved, repoRoot)) {
+          return resolved;
+        }
+      }
+    }
+    return null;
+  }
+  resolveGitCommonDir(repoRoot) {
+    try {
+      const stdout = execSync("git rev-parse --git-common-dir", {
+        cwd: repoRoot,
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 1500
+      }).toString().trim();
+      if (!stdout) {
+        return path2.join(repoRoot, ".git");
+      }
+      return path2.isAbsolute(stdout) ? stdout : path2.resolve(repoRoot, stdout);
+    } catch {
+      return path2.join(repoRoot, ".git");
+    }
+  }
+};
+
+export {
+  resolveRepoRootFromPoeticDir,
+  TelemetryPathResolver
+};
+//# sourceMappingURL=chunk-ZDTGECTN.js.map

package/dist/chunk-ZDTMICNY.js

@@ -0,0 +1,316 @@
+import {
+  classifyDirtyEntriesForGuard,
+  formatDirtyGuardRefusal,
+  getGitStatusPorcelainZ,
+  parsePorcelainEntriesZ,
+  readInitCreatedRootFiles
+} from "./chunk-HQLGXODD.js";
+import {
+  SETUP_CHECK_READINESS_OPTIONS,
+  collectProviderReadinessGate
+} from "./chunk-25QL3M3L.js";
+import {
+  QUICK_START_GUIDE_URL
+} from "./chunk-5EERLVZB.js";
+import {
+  branchRoleLabel,
+  classifyBranchRole,
+  isProtectedPipelineBranch
+} from "./chunk-XQD2B6BB.js";
+import {
+  execGit
+} from "./chunk-KNDYMVWN.js";
+import {
+  sanitizeBranchSegment
+} from "./chunk-TRSVUPCX.js";
+import {
+  resolveCliRepoRoot
+} from "./chunk-L7JZLXQL.js";
+
+// src/cli/commands/quickstart.ts
+import fs from "fs/promises";
+import path from "path";
+import chalk from "chalk";
+import { Command } from "commander";
+var DEFAULT_MARKER_FILE = "poetic-quickstart.md";
+function optionEnabled(value) {
+  return value === true;
+}
+function writeStdout(line = "") {
+  process.stdout.write(`${line}
+`);
+}
+function writeStderr(line = "") {
+  process.stderr.write(`${line}
+`);
+}
+function taskLabel(parts) {
+  const joined = parts.join(" ").trim();
+  return joined.length > 0 ? joined : "poetic init quickstart";
+}
+function normalizeBranchName(input) {
+  const trimmed = input.trim();
+  if (!trimmed) return "fix/poetic-quickstart";
+  if (trimmed.includes("/")) {
+    return trimmed.split("/").map((segment) => sanitizeBranchSegment(segment) || "branch").join("/");
+  }
+  return `fix/${sanitizeBranchSegment(trimmed) || "poetic-quickstart"}`;
+}
+function branchNameFromTask(parts, explicitName) {
+  return normalizeBranchName(explicitName ?? taskLabel(parts));
+}
+async function git(args, repoRoot) {
+  const result = await execGit(args, { cwd: repoRoot });
+  return { exitCode: result.exitCode, stdout: result.stdout.trim() };
+}
+async function getCurrentBranch(repoRoot) {
+  const result = await git(["rev-parse", "--abbrev-ref", "HEAD"], repoRoot);
+  if (result.exitCode === 0 && result.stdout) {
+    return result.stdout;
+  }
+  const symbolic = await git(["symbolic-ref", "--short", "HEAD"], repoRoot);
+  if (symbolic.exitCode === 0 && symbolic.stdout) {
+    return symbolic.stdout;
+  }
+  return "HEAD";
+}
+async function branchExists(repoRoot, branch) {
+  const result = await git(["rev-parse", "--verify", `refs/heads/${branch}`], repoRoot);
+  return result.exitCode === 0;
+}
+async function validateBranchName(repoRoot, branch) {
+  if (isProtectedPipelineBranch(branch)) {
+    throw new Error(`Refusing to create protected branch '${branch}'.`);
+  }
+  const result = await git(["check-ref-format", "--branch", branch], repoRoot);
+  if (result.exitCode !== 0) {
+    throw new Error(`Invalid branch name '${branch}'. Try --branch-name fix/my-first-change.`);
+  }
+}
+async function allocateBranchName(repoRoot, preferredBranch) {
+  await validateBranchName(repoRoot, preferredBranch);
+  if (!await branchExists(repoRoot, preferredBranch)) {
+    return preferredBranch;
+  }
+  for (let index = 2; index <= 99; index += 1) {
+    const candidate = `${preferredBranch}-${index}`;
+    await validateBranchName(repoRoot, candidate);
+    if (!await branchExists(repoRoot, candidate)) {
+      return candidate;
+    }
+  }
+  throw new Error(`Unable to allocate a unique branch name from '${preferredBranch}'.`);
+}
+async function inspectGit(repoRoot) {
+  const insideWorkTree = await git(["rev-parse", "--is-inside-work-tree"], repoRoot);
+  const initialized = insideWorkTree.exitCode === 0 && insideWorkTree.stdout === "true";
+  const currentBranch = initialized ? await getCurrentBranch(repoRoot) : "HEAD";
+  if (!initialized) {
+    return {
+      currentBranch,
+      branchRole: classifyBranchRole(currentBranch),
+      clean: true,
+      initialized,
+      blocking: [],
+      ignoredResidue: []
+    };
+  }
+  const porcelainZ = await getGitStatusPorcelainZ(repoRoot);
+  const classification = classifyDirtyEntriesForGuard(
+    parsePorcelainEntriesZ(porcelainZ),
+    await readInitCreatedRootFiles(repoRoot)
+  );
+  return {
+    currentBranch,
+    branchRole: classifyBranchRole(currentBranch),
+    clean: classification.blocking.length === 0,
+    initialized,
+    blocking: classification.blocking,
+    ignoredResidue: classification.ignoredResidue
+  };
+}
+async function writeMarkerFile(repoRoot, branch, dryRun) {
+  const markerPath = path.join(repoRoot, DEFAULT_MARKER_FILE);
+  const relative = DEFAULT_MARKER_FILE;
+  const body = [
+    "# Poetic quickstart marker",
+    "",
+    `Branch: ${branch}`,
+    "This file was created by `poetic init quickstart --marker-file`.",
+    "It is not meant to be committed. Delete it after confirming local file edits work as expected.",
+    ""
+  ].join("\n");
+  try {
+    await fs.access(markerPath);
+    throw new Error(`${relative} already exists. Delete it first or choose a clean repository.`);
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw error;
+    }
+  }
+  if (!dryRun) {
+    await fs.writeFile(markerPath, body, "utf8");
+  }
+}
+function printReadiness(snapshot, repoRoot, branch, gate) {
+  writeStdout(chalk.bold("Poetic quickstart"));
+  writeStdout(`Repo: ${repoRoot}`);
+  writeStdout(`Current branch: ${snapshot.currentBranch}`);
+  writeStdout(`Branch role: ${branchRoleLabel(snapshot.branchRole)}`);
+  writeStdout(`Working tree: ${snapshot.clean ? "clean" : "has local changes"}`);
+  writeStdout(`Suggested working branch: ${branch}`);
+  writeStdout();
+  writeStdout("Provider readiness:");
+  writeStdout(
+    `  Gate: ${gate.gateLabel} (${gate.readyCount} ready of ${gate.providers.length} checked)`
+  );
+  for (const entry of gate.providers) {
+    const r = entry.readiness;
+    writeStdout(
+      `  ${r.displayName}: ${entry.parityLabel}` + (r.installCommand && entry.parityLabel === "missing" ? ` (install: ${r.installCommand})` : "")
+    );
+  }
+  if (gate.remediations.length > 0 && gate.readyCount === 0) {
+    writeStdout();
+    writeStdout("Remediation (no automatic installs):");
+    for (const line of gate.remediations.slice(0, 8)) {
+      writeStdout(`  ${line}`);
+    }
+  }
+}
+function printGuidance(options) {
+  const branchCommand = options.createdBranch ? void 0 : `poetic init quickstart --branch --branch-name ${options.branch}`;
+  writeStdout();
+  writeStdout("Next steps:");
+  if (branchCommand) {
+    writeStdout(`  ${branchCommand}`);
+  }
+  if (options.gate.readyCount === 0) {
+    writeStdout("  poetic provider setup --first-run");
+  } else {
+    writeStdout("  poetic provider list");
+  }
+  writeStdout('  poetic run task "<small task>"');
+  writeStdout(
+    '  poetic run competition "<small task>" --variant <provider>:conservative  (judge scores / multi-variant)'
+  );
+  writeStdout("  poetic run competition apply <competition-id>  (after competition)");
+  writeStdout(`Guide: ${QUICK_START_GUIDE_URL}`);
+  writeStdout();
+  if (options.dryRun) {
+    writeStdout("Dry run: no files or branches were changed.");
+    return;
+  }
+  if (options.createdBranch) {
+    writeStdout(`Created branch: ${options.branch}`);
+  }
+  if (options.markerFile) {
+    writeStdout(
+      options.wroteMarker ? `Created marker file: ${DEFAULT_MARKER_FILE}` : `Marker file planned: ${DEFAULT_MARKER_FILE}`
+    );
+  }
+}
+async function runQuickstart(taskParts, rawOptions) {
+  const repoRoot = resolveCliRepoRoot(process.cwd());
+  const wantsBranch = optionEnabled(rawOptions.branch);
+  const wantsMarkerFile = optionEnabled(rawOptions.markerFile);
+  const dryRun = optionEnabled(rawOptions.dryRun);
+  const snapshot = await inspectGit(repoRoot);
+  if (!snapshot.initialized) {
+    writeStdout(chalk.bold("Poetic quickstart"));
+    writeStdout(`Directory: ${repoRoot}`);
+    writeStdout("Git repository: not detected");
+    writeStdout();
+    writeStdout("Next steps:");
+    writeStdout("  cd /path/to/target-git-repo");
+    writeStdout("  poetic provider setup --first-run");
+    writeStdout("  poetic init quickstart");
+    writeStdout(`Guide: ${QUICK_START_GUIDE_URL}`);
+    writeStdout();
+    writeStdout("Poetic init quickstart runs from the git repository you want Poetic to change.");
+    process.exitCode = 1;
+    return;
+  }
+  const preferredBranch = branchNameFromTask(taskParts, rawOptions.branchName);
+  const branch = await allocateBranchName(repoRoot, preferredBranch);
+  const gate = await collectProviderReadinessGate({
+    readinessOptions: {
+      ...SETUP_CHECK_READINESS_OPTIONS,
+      // Keep the onboarding handoff identical to provider setup/context.
+      cliProbeMode: "execute",
+      authProbeMode: "passive"
+    },
+    requireAtLeastOneReady: true
+  });
+  printReadiness(snapshot, repoRoot, branch, gate);
+  if ((wantsBranch || wantsMarkerFile) && !snapshot.clean && !rawOptions.allowDirty) {
+    throw new Error(
+      formatDirtyGuardRefusal({
+        title: "Working tree has local changes.",
+        blocking: snapshot.blocking ?? [],
+        ignoredResidue: snapshot.ignoredResidue,
+        guidance: [
+          "Commit or stash blocking user changes first.",
+          "Pass --allow-dirty if you understand the risk.",
+          "Generated/runtime residue is ignored by this guard and is not deleted automatically."
+        ]
+      })
+    );
+  }
+  if (wantsMarkerFile && snapshot.branchRole === "protected" && !wantsBranch) {
+    throw new Error(
+      `Refusing to write ${DEFAULT_MARKER_FILE} on protected branch '${snapshot.currentBranch}'. Run with --branch --marker-file to create a safe working branch first.`
+    );
+  }
+  if (wantsMarkerFile && snapshot.branchRole === "detached" && !wantsBranch) {
+    throw new Error(
+      `Refusing to write ${DEFAULT_MARKER_FILE} in detached HEAD state. Run with --branch --marker-file to create a safe working branch first.`
+    );
+  }
+  let activeBranch = snapshot.currentBranch;
+  if (wantsBranch && !dryRun) {
+    const checkout = await git(["checkout", "-b", branch], repoRoot);
+    if (checkout.exitCode !== 0) {
+      throw new Error(`Failed to create branch '${branch}'.`);
+    }
+    activeBranch = branch;
+  } else if (wantsBranch) {
+    activeBranch = branch;
+  }
+  if (wantsMarkerFile) {
+    await writeMarkerFile(repoRoot, activeBranch, dryRun);
+  }
+  printGuidance({
+    branch,
+    createdBranch: wantsBranch && !dryRun,
+    markerFile: wantsMarkerFile,
+    wroteMarker: wantsMarkerFile && !dryRun,
+    dryRun,
+    gate
+  });
+}
+function createQuickstartCommand() {
+  const command = new Command("quickstart").description(
+    "Check readiness and guide a first safe local Poetic flow without running providers."
+  ).argument("[task...]", "Optional task text used to suggest a branch name").option("--dry-run", "Show the branch/file plan without changing the checkout").option("--branch", "Create and check out the suggested safe working branch").option(
+    "--branch-name <name>",
+    "Use a specific safe branch name; bare names are prefixed with fix/"
+  ).option(
+    "--marker-file",
+    `Create ${DEFAULT_MARKER_FILE} as a local marker file. Requires an explicit flag and never runs providers.`
+  ).option("--allow-dirty", "Allow branch/marker actions when local changes already exist").action(async (task, options) => {
+    try {
+      await runQuickstart(task, options);
+    } catch (error) {
+      writeStderr(`Error: ${error instanceof Error ? error.message : String(error)}`);
+      process.exitCode = 1;
+    }
+  });
+  return command;
+}
+
+export {
+  runQuickstart,
+  createQuickstartCommand
+};
+//# sourceMappingURL=chunk-ZDTMICNY.js.map

package/dist/chunk-ZIPWI2LY.js

@@ -0,0 +1,151 @@
+import {
+  SYSTEM_WRITE_PATH_PREFIXES,
+  isSystemWritePath
+} from "./chunk-H2AYQIHW.js";
+import {
+  companionTestCandidatePaths
+} from "./chunk-UDMS5AD3.js";
+
+// src/automation/allowlist-utils.ts
+import { existsSync, readdirSync } from "fs";
+import path from "path";
+var adjacentAllowlistExpansionCache = /* @__PURE__ */ new Map();
+function isPathAllowed(changedPath, allowlist) {
+  const normalizedChanged = normalizePath(changedPath);
+  for (const allowed of allowlist) {
+    const normalizedAllowed = normalizePath(allowed);
+    if (normalizedChanged === normalizedAllowed) {
+      return true;
+    }
+    if (normalizedAllowed.endsWith("/") && normalizedChanged.startsWith(normalizedAllowed)) {
+      return true;
+    }
+    if (normalizedChanged.endsWith("/") && normalizedAllowed.startsWith(normalizedChanged)) {
+      return true;
+    }
+    const parentDir = normalizedAllowed.includes("/") ? `${normalizedAllowed.slice(0, normalizedAllowed.lastIndexOf("/") + 1)}` : "";
+    if (parentDir.length > 0 && normalizedChanged === parentDir) {
+      return true;
+    }
+  }
+  return false;
+}
+function isPathDenied(changedPath, denylist) {
+  const normalizedChanged = normalizePath(changedPath);
+  for (const denied of denylist) {
+    const normalizedDenied = normalizePath(denied);
+    if (normalizedChanged === normalizedDenied) {
+      return true;
+    }
+    if (normalizedDenied.endsWith("/") && normalizedChanged.startsWith(normalizedDenied)) {
+      return true;
+    }
+  }
+  return false;
+}
+function normalizePath(filePath) {
+  const cleaned = filePath.replace(/^\.\//, "");
+  return path.normalize(cleaned).replace(/\\/g, "/");
+}
+function filterAllowedFiles(changedFiles, allowlist) {
+  return changedFiles.filter((file) => isPathAllowed(file, allowlist));
+}
+function findAllowlistViolations(changedFiles, allowlist) {
+  return changedFiles.filter((file) => !isPathAllowed(file, allowlist));
+}
+function expandAllowlistWithAdjacentTests(allowlist, repoRoot = process.cwd()) {
+  const cacheKey = `${path.resolve(repoRoot)}\0${allowlist.join("\0")}`;
+  const cached = adjacentAllowlistExpansionCache.get(cacheKey);
+  if (cached) {
+    return [...cached];
+  }
+  const expanded = [...allowlist];
+  const seen = new Set(allowlist);
+  for (const entry of allowlist) {
+    if (!entry.endsWith(".ts")) {
+      for (const candidate of companionTestCandidatePaths(entry)) {
+        if (!seen.has(candidate) && existsSync(path.resolve(repoRoot, candidate))) {
+          seen.add(candidate);
+          expanded.push(candidate);
+        }
+      }
+      continue;
+    }
+    if (!entry.startsWith("src/")) continue;
+    const basename = entry.replace(/\.ts$/, "").split("/").pop();
+    if (!basename) continue;
+    const relPath = entry.slice(4).replace(/\.ts$/, "");
+    const dir = entry.slice(0, entry.lastIndexOf("/") + 1);
+    const candidates = [];
+    const siblingTest = `${entry.replace(/\.ts$/, ".test.ts")}`;
+    if (existsSync(path.resolve(repoRoot, siblingTest))) {
+      candidates.push(siblingTest);
+    }
+    const dunderTest = `${dir}__tests__/${basename}.test.ts`;
+    if (existsSync(path.resolve(repoRoot, dunderTest))) {
+      candidates.push(dunderTest);
+    }
+    if (relPath.startsWith("cli/commands/")) {
+      candidates.push(`tests/cli/${basename}-command.test.ts`);
+      candidates.push(`tests/unit/cli/commands/${basename}-command-help.test.ts`);
+    }
+    if (relPath.startsWith("cli/")) {
+      candidates.push(`tests/unit/cli/${basename}.test.ts`);
+    }
+    candidates.push(`tests/unit/${relPath}.test.ts`);
+    const unitDir = path.resolve(repoRoot, "tests", "unit", path.dirname(relPath));
+    if (existsSync(unitDir)) {
+      try {
+        const entries = readdirSync(unitDir);
+        for (const candidate of entries) {
+          if (candidate.startsWith(`${basename}-`) && candidate.endsWith(".test.ts")) {
+            candidates.push(path.posix.join("tests", "unit", path.dirname(relPath), candidate));
+          }
+        }
+      } catch {
+      }
+    }
+    const companionCandidates = [
+      `${dir}types.ts`,
+      `${dir}interfaces.ts`,
+      `${dir}i-${basename}.ts`
+    ].filter((candidate) => candidate !== entry);
+    for (const candidate of companionCandidates) {
+      if (existsSync(path.resolve(repoRoot, candidate))) {
+        candidates.push(candidate);
+      }
+    }
+    for (const candidate of candidates) {
+      if (!seen.has(candidate)) {
+        seen.add(candidate);
+        expanded.push(candidate);
+      }
+    }
+  }
+  adjacentAllowlistExpansionCache.set(cacheKey, expanded);
+  return [...expanded];
+}
+function findDenylistViolations(changedFiles, denylist) {
+  return changedFiles.filter((file) => isPathDenied(file, denylist));
+}
+function isAllowlistEmpty(allowlist) {
+  return !allowlist || allowlist.length === 0;
+}
+var SYSTEM_WRITE_PATHS = SYSTEM_WRITE_PATH_PREFIXES;
+function isSystemWritePath2(filePath) {
+  return isSystemWritePath(filePath);
+}
+
+export {
+  isPathAllowed,
+  isPathDenied,
+  normalizePath,
+  filterAllowedFiles,
+  findAllowlistViolations,
+  expandAllowlistWithAdjacentTests,
+  findDenylistViolations,
+  isAllowlistEmpty,
+  SYSTEM_WRITE_PATHS,
+  isSystemWritePath2 as isSystemWritePath
+};
+//# sourceMappingURL=chunk-ZIPWI2LY.js.map