@prism-d1/cli 1.1.2 → 1.2.0

package/dist/src/codewatch/hooks.js

@@ -0,0 +1,176 @@
+/**
+ * Git hook install/uninstall for `prism-cli enable codewatch`.
+ *
+ * Backup convention matches the old install-git-hooks: a foreign hook at
+ * `<hook>` is moved aside to `<hook>.pre-prism`. Unlike the old installer, the
+ * PRISM hook then CALLS the backed-up hook first, so installing does not turn
+ * off a team's existing hook, and uninstall moves the backup back.
+ */
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { isAbsolute, resolve } from 'node:path';
+import { run } from '../utils/exec.js';
+export const HOOK_MARKER = '# prism-cli enable codewatch';
+/**
+ * Markers of earlier hook generations that are still OURS: hook files written
+ * before the rename to codewatch carry the old marker and call the removed
+ * `prism-cli git pre-commit` / `git pre-push`. Recognising them means install
+ * overwrites them in place (rather than backing them up and chaining a hook
+ * that can no longer run) and uninstall removes them.
+ */
+const OWN_MARKERS = [HOOK_MARKER, '# prism-cli enable security'];
+/** The retired trailer hook is identified the way install-git-hooks identified it. */
+const LEGACY_MARKER = 'AI-Origin';
+export const BACKUP_SUFFIX = '.pre-prism';
+export const MANAGED_HOOKS = ['pre-commit', 'pre-push'];
+/**
+ * pre-commit: blocks on a gitleaks finding.
+ *
+ * Prefers `prism-cli codewatch pre-commit` (writes a result file). Without prism-cli
+ * on PATH it still runs gitleaks directly, so the block does not depend on the
+ * CLI being installed globally.
+ */
+export const PRE_COMMIT_SCRIPT = `#!/bin/sh
+${HOOK_MARKER} -- pre-commit secret scan (blocks on a finding).
+# Managed file. Remove with: prism-cli enable codewatch --uninstall
+HOOK_DIR=$(dirname "$0")
+if [ -x "$HOOK_DIR/pre-commit${BACKUP_SUFFIX}" ]; then
+  "$HOOK_DIR/pre-commit${BACKUP_SUFFIX}" "$@" || exit $?
+fi
+# Probe first: an older prism-cli on PATH has no "codewatch pre-commit" and would
+# fail every commit with "unknown command". Its --help exits 0 with the root help,
+# so the probe checks that the subcommand's own usage line is printed.
+if command -v prism-cli >/dev/null 2>&1 && prism-cli codewatch pre-commit --help 2>/dev/null | grep -q 'codewatch pre-commit'; then
+  exec prism-cli codewatch pre-commit
+fi
+if command -v gitleaks >/dev/null 2>&1; then
+  set -- protect --staged --redact --no-banner --exit-code=1
+  [ -f .gitleaks.toml ] && set -- "$@" --config=.gitleaks.toml
+  [ -f .prism/gitleaks-baseline.json ] && set -- "$@" --baseline-path=.prism/gitleaks-baseline.json
+  if ! gitleaks "$@"; then
+    echo "prism: gitleaks flagged the staged changes; commit blocked." >&2
+    echo "prism: fix it, allowlist a false positive in .gitleaks.toml, or bypass once with --no-verify." >&2
+    exit 1
+  fi
+  exit 0
+fi
+echo "prism: neither prism-cli nor gitleaks is on PATH; secret scan skipped." >&2
+exit 0
+`;
+/**
+ * pre-push: report-only review. Exits 0 no matter what the review does.
+ * stdin (the pushed refs) is buffered so both a chained hook and prism-cli see it.
+ */
+export const PRE_PUSH_SCRIPT = `#!/bin/sh
+${HOOK_MARKER} -- pre-push local eval review (report only, never blocks).
+# Managed file. Remove with: prism-cli enable codewatch --uninstall
+HOOK_DIR=$(dirname "$0")
+PRISM_PUSH_INPUT=$(cat)
+if [ -x "$HOOK_DIR/pre-push${BACKUP_SUFFIX}" ]; then
+  printf '%s\\n' "$PRISM_PUSH_INPUT" | "$HOOK_DIR/pre-push${BACKUP_SUFFIX}" "$@" || exit $?
+fi
+if command -v prism-cli >/dev/null 2>&1 && prism-cli codewatch pre-push --help 2>/dev/null | grep -q 'codewatch pre-push'; then
+  printf '%s\\n' "$PRISM_PUSH_INPUT" | prism-cli codewatch pre-push --remote "\${1:-}" || true
+else
+  echo "prism: prism-cli (with 'codewatch pre-push') is not on PATH; local review skipped (report only)." >&2
+fi
+exit 0
+`;
+export const HOOK_SCRIPTS = {
+    'pre-commit': PRE_COMMIT_SCRIPT,
+    'pre-push': PRE_PUSH_SCRIPT,
+};
+/**
+ * Hooks directory as git resolves it: honours core.hooksPath and works in a
+ * linked worktree, where `.git` is a file and `.git/hooks` does not exist.
+ */
+export function resolveHooksDir(gitRoot) {
+    const abs = run('git', ['rev-parse', '--path-format=absolute', '--git-path', 'hooks']);
+    if (abs.ok && abs.stdout && isAbsolute(abs.stdout))
+        return abs.stdout;
+    const rel = run('git', ['rev-parse', '--git-path', 'hooks']);
+    return rel.ok && rel.stdout ? resolve(process.cwd(), rel.stdout) : resolve(gitRoot, '.git/hooks');
+}
+function isOurs(path, markers = OWN_MARKERS) {
+    try {
+        const text = readFileSync(path, 'utf8');
+        return markers.some((m) => text.includes(m));
+    }
+    catch {
+        return false;
+    }
+}
+export function installHooks(hooksDir) {
+    mkdirSync(hooksDir, { recursive: true });
+    const changes = [];
+    for (const hook of MANAGED_HOOKS) {
+        const target = resolve(hooksDir, hook);
+        const backup = target + BACKUP_SUFFIX;
+        if (existsSync(target) && !isOurs(target)) {
+            if (existsSync(backup)) {
+                // Never overwrite an earlier backup: that would destroy the original.
+                const stamped = `${backup}.${Date.now()}`;
+                renameSync(target, stamped);
+                changes.push({ hook, action: `existing hook moved to ${stamped} (a ${hook}${BACKUP_SUFFIX} backup already existed)` });
+            }
+            else {
+                renameSync(target, backup);
+                changes.push({ hook, action: `existing hook backed up to ${hook}${BACKUP_SUFFIX} and chained` });
+            }
+        }
+        writeFileSync(target, HOOK_SCRIPTS[hook]);
+        chmodSync(target, 0o755);
+        changes.push({ hook, action: 'installed' });
+    }
+    return changes;
+}
+export function uninstallHooks(hooksDir) {
+    const changes = [];
+    for (const hook of MANAGED_HOOKS) {
+        const target = resolve(hooksDir, hook);
+        const backup = target + BACKUP_SUFFIX;
+        if (!existsSync(target) || !isOurs(target)) {
+            changes.push({ hook, action: existsSync(target) ? 'left alone (not installed by prism-cli)' : 'not installed' });
+            continue;
+        }
+        rmSync(target, { force: true });
+        if (existsSync(backup)) {
+            renameSync(backup, target);
+            changes.push({ hook, action: `removed; restored previous hook from ${hook}${BACKUP_SUFFIX}` });
+        }
+        else {
+            changes.push({ hook, action: 'removed' });
+        }
+    }
+    return changes;
+}
+/**
+ * Removes the retired prepare-commit-msg trailer hook (commit trailers and the
+ * token tracker are no longer used) and restores whatever it had backed up.
+ * Returns a description, or null when there was nothing to retire.
+ */
+export function retireLegacyCommitMsgHook(hooksDir) {
+    const target = resolve(hooksDir, 'prepare-commit-msg');
+    if (!existsSync(target) || !isOurs(target, [LEGACY_MARKER]))
+        return null;
+    const backup = target + BACKUP_SUFFIX;
+    rmSync(target, { force: true });
+    if (existsSync(backup)) {
+        copyFileSync(backup, target);
+        chmodSync(target, 0o755);
+        rmSync(backup, { force: true });
+        return 'removed retired prepare-commit-msg trailer hook; restored the hook it had backed up';
+    }
+    return 'removed retired prepare-commit-msg trailer hook';
+}
+/** Adds `.prism/results/` to .gitignore unless an entry already covers it. */
+export function ensureResultsIgnored(gitRoot) {
+    const gi = resolve(gitRoot, '.gitignore');
+    const content = existsSync(gi) ? readFileSync(gi, 'utf8') : '';
+    const lines = content.split('\n').map((l) => l.trim());
+    if (lines.some((l) => ['.prism', '.prism/', '/.prism', '/.prism/', '.prism/results', '.prism/results/', '/.prism/results/'].includes(l)))
+        return false;
+    const prefix = content && !content.endsWith('\n') ? '\n' : '';
+    writeFileSync(gi, `${content}${prefix}# prism-cli local gate results (per developer, not shared)\n.prism/results/\n`);
+    return true;
+}
+//# sourceMappingURL=hooks.js.map

package/dist/src/codewatch/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../../src/codewatch/hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEvC,MAAM,CAAC,MAAM,WAAW,GAAG,8BAA8B,CAAC;AAC1D;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;AACjE,sFAAsF;AACtF,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAC1C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,YAAY,EAAE,UAAU,CAAU,CAAC;AAGjE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;EAC/B,WAAW;;;+BAGkB,aAAa;yBACnB,aAAa;;;;;;;;;;;;;;;;;;;;;CAqBrC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;EAC7B,WAAW;;;;6BAIgB,aAAa;4DACkB,aAAa;;;;;;;;CAQxE,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAgC;IACvD,YAAY,EAAE,iBAAiB;IAC/B,UAAU,EAAE,eAAe;CAC5B,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IACvF,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IACtE,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,UAAoB,WAAW;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAID,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC;QACtC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,sEAAsE;gBACtE,MAAM,OAAO,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC1C,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,OAAO,OAAO,IAAI,GAAG,aAAa,0BAA0B,EAAE,CAAC,CAAC;YACzH,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,IAAI,GAAG,aAAa,cAAc,EAAE,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;QACD,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC;QACtC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YACjH,SAAS;QACX,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,wCAAwC,IAAI,GAAG,aAAa,EAAE,EAAE,CAAC,CAAC;QACjG,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC;IACtC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7B,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,OAAO,qFAAqF,CAAC;IAC/F,CAAC;IACD,OAAO,iDAAiD,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvJ,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,aAAa,CAAC,EAAE,EAAE,GAAG,OAAO,GAAG,MAAM,+EAA+E,CAAC,CAAC;IACtH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/codewatch/prepush.d.ts

@@ -0,0 +1,37 @@
+/** Larger diffs are truncated before review; the result notes it. */
+export declare const MAX_DIFF_CHARS = 200000;
+export interface PushRef {
+    localRef: string;
+    localSha: string;
+    remoteRef: string;
+    remoteSha: string;
+}
+/** Parses git's pre-push stdin: `<local ref> <local sha> <remote ref> <remote sha>` per line. */
+export declare function parsePushInput(stdin: string): PushRef[];
+/**
+ * Base for the review range. The branch's upstream if it has one, else what
+ * the remote already has for this ref, else the remote's default branch (a
+ * first push of a new branch). The diff is merge-base based (`base...sha`).
+ */
+export declare function resolveBase(ref: PushRef, remote: string | null): {
+    base: string | null;
+    upstream: string | null;
+};
+/**
+ * Commits in the range whose tree has no pre-commit secrets result: committed
+ * with `--no-verify`, or produced without a commit hook (rebase, cherry-pick,
+ * merge). Recorded as `skipped` results; this is a heuristic, and the reason
+ * says so.
+ */
+export declare function recordUnscannedCommits(repoRoot: string, base: string | null, sha: string, branch: string | null, upstream: string | null): number;
+export interface PrePushOptions {
+    repoRoot: string;
+    stdin: string;
+    remote: string | null;
+    /** Injected for tests. */
+    pathEnv?: string;
+    log?: (line: string) => void;
+}
+/** Entry point for the hook. Always returns 0. */
+export declare function runPrePush(opts: PrePushOptions): number;
+//# sourceMappingURL=prepush.d.ts.map

package/dist/src/codewatch/prepush.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepush.d.ts","sourceRoot":"","sources":["../../../src/codewatch/prepush.ts"],"names":[],"mappings":"AAoBA,qEAAqE;AACrE,eAAO,MAAM,cAAc,SAAU,CAAC;AAMtC,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,EAAE,CAUvD;AAOD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAoBjH;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAiCjJ;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAkGD,kDAAkD;AAClD,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAmBvD"}

package/dist/src/codewatch/prepush.js

@@ -0,0 +1,231 @@
+/**
+ * pre-push local eval gate: REPORT ONLY.
+ *
+ * Reviews each pushed branch's diff against its upstream with the configured
+ * reviewer, writes a result file, prints a short summary, and returns 0 in
+ * every case -- reviewer missing, reviewer crashing, unparseable output, or a
+ * bug in this file. The push is never blocked by this gate.
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { run } from '../utils/exec.js';
+import { getAssetPath } from '../utils/root.js';
+import { DEFAULT_REVIEW_TIMEOUT_SECONDS, readEvalConfig, REVIEWER_GIT_CONFIG_KEY, RULES_PATH } from './config.js';
+import { safeWrite } from './gitleaks.js';
+import { countBySeverity, makeResult, readResults } from './results.js';
+import { ADAPTERS, detectReviewers, findOnPath, resolveReviewer, runReview, toolVersion } from './reviewers/index.js';
+const ZERO_SHA = /^0+$/;
+/** Larger diffs are truncated before review; the result notes it. */
+export const MAX_DIFF_CHARS = 200_000;
+/** Upper bound on commits checked for a missing pre-commit scan per push. */
+const MAX_SKIP_CHECK_COMMITS = 50;
+/** Lock files are noise to a reviewer and can be megabytes. */
+const DIFF_EXCLUDES = [':(exclude,glob)**/package-lock.json', ':(exclude,glob)**/yarn.lock', ':(exclude,glob)**/pnpm-lock.yaml', ':(exclude,glob)**/poetry.lock', ':(exclude,glob)**/Cargo.lock'];
+/** Parses git's pre-push stdin: `<local ref> <local sha> <remote ref> <remote sha>` per line. */
+export function parsePushInput(stdin) {
+    const refs = [];
+    for (const line of stdin.split('\n')) {
+        const p = line.trim().split(/\s+/);
+        if (p.length !== 4)
+            continue;
+        const [localRef, localSha, remoteRef, remoteSha] = p;
+        if (ZERO_SHA.test(localSha))
+            continue; // branch deletion: nothing to review
+        refs.push({ localRef, localSha, remoteRef, remoteSha });
+    }
+    return refs;
+}
+function git(args) {
+    const r = run('git', args);
+    return r.ok ? r.stdout : null;
+}
+/**
+ * Base for the review range. The branch's upstream if it has one, else what
+ * the remote already has for this ref, else the remote's default branch (a
+ * first push of a new branch). The diff is merge-base based (`base...sha`).
+ */
+export function resolveBase(ref, remote) {
+    const branch = ref.localRef.startsWith('refs/heads/') ? ref.localRef.slice('refs/heads/'.length) : null;
+    if (branch) {
+        const up = git(['rev-parse', '--abbrev-ref', '--symbolic-full-name', `${branch}@{upstream}`]);
+        if (up) {
+            const sha = git(['rev-parse', '--verify', '--quiet', `${up}^{commit}`]);
+            if (sha)
+                return { base: sha, upstream: up };
+        }
+    }
+    if (!ZERO_SHA.test(ref.remoteSha) && git(['cat-file', '-e', `${ref.remoteSha}^{commit}`]) !== null) {
+        return { base: ref.remoteSha, upstream: remote ? `${remote}/${ref.remoteRef.replace(/^refs\/heads\//, '')}` : ref.remoteRef };
+    }
+    if (remote) {
+        const head = git(['symbolic-ref', '--quiet', `refs/remotes/${remote}/HEAD`]);
+        if (head) {
+            const sha = git(['rev-parse', '--verify', '--quiet', head]);
+            if (sha)
+                return { base: sha, upstream: head.replace(/^refs\/remotes\//, '') };
+        }
+    }
+    return { base: null, upstream: null };
+}
+/**
+ * Commits in the range whose tree has no pre-commit secrets result: committed
+ * with `--no-verify`, or produced without a commit hook (rebase, cherry-pick,
+ * merge). Recorded as `skipped` results; this is a heuristic, and the reason
+ * says so.
+ */
+export function recordUnscannedCommits(repoRoot, base, sha, branch, upstream) {
+    const range = base ? `${base}..${sha}` : sha;
+    const list = git(['rev-list', `--max-count=${MAX_SKIP_CHECK_COMMITS}`, range]);
+    if (!list)
+        return 0;
+    const scanned = new Set(readResults(repoRoot)
+        .filter((r) => r.kind === 'secrets' && r.hook === 'pre-commit' && r.status !== 'skipped' && r.tree)
+        .map((r) => r.tree));
+    // Trees committed while gitleaks was missing already have their own skipped
+    // record (reason gitleaks-missing); do not report them a second time as --no-verify.
+    const knownSkips = new Set(readResults(repoRoot)
+        .filter((r) => r.kind === 'secrets' && r.hook === 'pre-commit' && r.status === 'skipped' && r.tree)
+        .map((r) => r.tree));
+    const already = new Set(readResults(repoRoot).filter((r) => r.kind === 'secrets' && r.status === 'skipped' && r.commit).map((r) => r.commit));
+    let n = 0;
+    for (const c of list.split('\n').filter(Boolean)) {
+        if (already.has(c))
+            continue;
+        const tree = git(['rev-parse', `${c}^{tree}`]);
+        if (!tree || scanned.has(tree) || knownSkips.has(tree))
+            continue;
+        const now = new Date().toISOString();
+        safeWrite(repoRoot, makeResult({
+            kind: 'secrets', hook: 'pre-push', status: 'skipped', tool: 'gitleaks', commit: c, tree, branch, upstream, base,
+            started_at: now, finished_at: now,
+            reason: 'no pre-commit secret scan recorded for this commit (git commit --no-verify, or a rebase/cherry-pick/merge that runs no commit hook)',
+        }));
+        n++;
+    }
+    return n;
+}
+/** Reviews one pushed ref. Never throws. */
+function reviewRef(opts, ref, log) {
+    const { repoRoot } = opts;
+    const started = new Date().toISOString();
+    const branch = ref.localRef.startsWith('refs/heads/') ? ref.localRef.slice(11) : ref.localRef;
+    const { base, upstream } = resolveBase(ref, opts.remote);
+    const unscanned = recordUnscannedCommits(repoRoot, base, ref.localSha, branch, upstream);
+    if (unscanned > 0)
+        log(`prism: ${unscanned} pushed commit(s) have no pre-commit secret scan (recorded in .prism/results/)`);
+    const common = { kind: 'review', hook: 'pre-push', commit: ref.localSha, branch, upstream, base, started_at: started };
+    const evalCfg = readEvalConfig(repoRoot);
+    const choice = resolveReviewer({
+        gitConfigValue: git(['config', '--get', REVIEWER_GIT_CONFIG_KEY]),
+        prismConfigValue: evalCfg.reviewer,
+        available: detectReviewers(opts.pathEnv),
+    });
+    if (choice.note)
+        log(`prism: ${choice.note}`);
+    if (!choice.id) {
+        return makeResult({ ...common, tool: 'none', status: 'error', finished_at: new Date().toISOString(), reason: `no reviewer available: ${choice.note}` });
+    }
+    const adapter = ADAPTERS[choice.id];
+    const bin = findOnPath(adapter.binary, opts.pathEnv) || adapter.binary;
+    const model = evalCfg.model || null;
+    if (!base) {
+        return makeResult({ ...common, tool: adapter.id, status: 'skipped', finished_at: new Date().toISOString(), reason: 'no upstream or remote default branch to diff against' });
+    }
+    // spawnSync rather than run(): run() inherits execFileSync's 1 MB buffer,
+    // which a large branch diff exceeds.
+    const d = spawnSync('git', ['diff', '--no-color', '--no-ext-diff', `${base}...${ref.localSha}`, '--', '.', ...DIFF_EXCLUDES], { cwd: repoRoot, encoding: 'utf8', maxBuffer: 256 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] });
+    let diff = d.status === 0 ? d.stdout : null;
+    if (diff === null) {
+        return makeResult({ ...common, tool: adapter.id, status: 'error', finished_at: new Date().toISOString(), reason: 'git diff failed' });
+    }
+    if (!diff.trim()) {
+        return makeResult({ ...common, tool: adapter.id, status: 'skipped', finished_at: new Date().toISOString(), reason: 'no changes against upstream' });
+    }
+    let truncated = false;
+    if (diff.length > MAX_DIFF_CHARS) {
+        diff = diff.slice(0, MAX_DIFF_CHARS);
+        truncated = true;
+    }
+    // A repo covered only by the global hooks has no rules file of its own:
+    // fall back to the bundled default, the same rules enable codewatch installs.
+    let rulesPath = RULES_PATH;
+    let rulesText = existsSync(resolve(repoRoot, RULES_PATH)) ? readFileSync(resolve(repoRoot, RULES_PATH), 'utf8') : '';
+    if (!rulesText) {
+        try {
+            rulesPath = getAssetPath(import.meta.url, 'bootstrapper/eval-harness/steering/code-review.md');
+            rulesText = readFileSync(rulesPath, 'utf8');
+        }
+        catch {
+            rulesPath = RULES_PATH;
+            log(`prism: ${RULES_PATH} not found; reviewing without the shared rules`);
+        }
+    }
+    const tmp = mkdtempSync(join(tmpdir(), 'prism-review-'));
+    try {
+        const diffPath = join(tmp, 'branch.diff');
+        writeFileSync(diffPath, diff, { mode: 0o600 });
+        const timeoutS = Number(evalCfg.timeout_seconds) > 0 ? Number(evalCfg.timeout_seconds) : DEFAULT_REVIEW_TIMEOUT_SECONDS;
+        log(`prism: reviewing ${branch} against ${upstream} with ${adapter.displayName} (report only, up to ${timeoutS}s)...`);
+        const res = runReview(adapter, { repoRoot, rulesPath, rulesText, diffPath, diff, model: model || undefined }, timeoutS * 1000, bin);
+        const finished = new Date().toISOString();
+        const version = toolVersion(bin);
+        if (!res.ok || !res.review) {
+            return makeResult({ ...common, tool: adapter.id, tool_version: version, model, status: 'error', finished_at: finished, reason: res.error });
+        }
+        const r = res.review;
+        return makeResult({
+            ...common, tool: adapter.id, tool_version: version, model: r.model || model,
+            status: r.findings.length ? 'findings' : 'ok', findings: r.findings, summary: r.summary, score: r.score,
+            finished_at: finished, reason: truncated ? `diff truncated to ${MAX_DIFF_CHARS} characters` : null,
+        });
+    }
+    finally {
+        rmSync(tmp, { recursive: true, force: true });
+    }
+}
+function summarize(r, path) {
+    const where = path ? ` -> ${path}` : '';
+    if (r.status === 'error')
+        return `prism: review did not run (${r.reason}). Push continues.${where}`;
+    if (r.status === 'skipped')
+        return `prism: review skipped (${r.reason}).${where}`;
+    const c = countBySeverity(r.findings);
+    const top = r.findings
+        .filter((f) => f.severity === 'high')
+        .slice(0, 3)
+        .map((f) => `\n  [high/${f.category}] ${f.file}${f.line ? `:${f.line}` : ''} ${f.message.slice(0, 120)}`)
+        .join('');
+    return `prism: ${r.tool} review: ${r.findings.length} finding(s) (${c.high} high, ${c.medium} medium, ${c.low} low)` +
+        `${r.score !== null ? `, score ${r.score}` : ''}. Report only; push continues.${top}${where}`;
+}
+/** Entry point for the hook. Always returns 0. */
+export function runPrePush(opts) {
+    const log = opts.log || ((l) => process.stderr.write(l + '\n'));
+    try {
+        const refs = parsePushInput(opts.stdin);
+        if (refs.length === 0)
+            return 0;
+        for (const ref of refs) {
+            let result = null;
+            try {
+                result = reviewRef(opts, ref, log);
+            }
+            catch (e) {
+                const now = new Date().toISOString();
+                result = makeResult({ kind: 'review', hook: 'pre-push', tool: 'none', status: 'error', commit: ref.localSha, started_at: now, finished_at: now, reason: `internal error: ${e?.message || e}` });
+            }
+            if (result)
+                log(summarize(result, safeWrite(opts.repoRoot, result)));
+        }
+    }
+    catch (e) {
+        try {
+            log(`prism: pre-push review failed (${e?.message || e}). Push continues.`);
+        }
+        catch { /* ignore */ }
+    }
+    return 0;
+}
+//# sourceMappingURL=prepush.js.map

package/dist/src/codewatch/prepush.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepush.js","sourceRoot":"","sources":["../../../src/codewatch/prepush.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,8BAA8B,EAAE,cAAc,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAoB,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAwB,MAAM,sBAAsB,CAAC;AAE5I,MAAM,QAAQ,GAAG,MAAM,CAAC;AACxB,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AACtC,6EAA6E;AAC7E,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,+DAA+D;AAC/D,MAAM,aAAa,GAAG,CAAC,qCAAqC,EAAE,6BAA6B,EAAE,kCAAkC,EAAE,+BAA+B,EAAE,8BAA8B,CAAC,CAAC;AASlM,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC7B,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS,CAAC,qCAAqC;QAC5E,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,GAAG,CAAC,IAAc;IACzB,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,MAAqB;IAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxG,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,sBAAsB,EAAE,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC;QAC9F,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;YACxE,IAAI,GAAG;gBAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,SAAS,WAAW,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnG,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;IAChI,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,gBAAgB,MAAM,OAAO,CAAC,CAAC,CAAC;QAC7E,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YAC5D,IAAI,GAAG;gBAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,IAAmB,EAAE,GAAW,EAAE,MAAqB,EAAE,QAAuB;IACvI,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,UAAU,EAAE,eAAe,sBAAsB,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC;IACpB,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,WAAW,CAAC,QAAQ,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC;SAClG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAChC,CAAC;IACF,4EAA4E;IAC5E,qFAAqF;IACrF,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,WAAW,CAAC,QAAQ,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC;SAClG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAChC,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAC/H,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACjE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC;YAC7B,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI;YAC/G,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG;YACjC,MAAM,EAAE,qIAAqI;SAC9I,CAAC,CAAC,CAAC;QACJ,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAWD,4CAA4C;AAC5C,SAAS,SAAS,CAAC,IAAoB,EAAE,GAAY,EAAE,GAAwB;IAC7E,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC9F,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAEzD,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzF,IAAI,SAAS,GAAG,CAAC;QAAE,GAAG,CAAC,UAAU,SAAS,gFAAgF,CAAC,CAAC;IAE5H,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,QAAiB,EAAE,IAAI,EAAE,UAAmB,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAEzI,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,eAAe,CAAC;QAC7B,cAAc,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;QACjE,gBAAgB,EAAE,OAAO,CAAC,QAAQ;QAClC,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI;QAAE,GAAG,CAAC,UAAU,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAE9C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,0BAA0B,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1J,CAAC;IACD,MAAM,OAAO,GAAoB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC;IAEpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC,CAAC;IAC/K,CAAC;IAED,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,EAC1H,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACxG,IAAI,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxI,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACjB,OAAO,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC;IACtJ,CAAC;IACD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAAC,SAAS,GAAG,IAAI,CAAC;IAAC,CAAC;IAE7F,wEAAwE;IACxE,8EAA8E;IAC9E,IAAI,SAAS,GAAG,UAAU,CAAC;IAC3B,IAAI,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrH,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC;YACH,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,mDAAmD,CAAC,CAAC;YAC/F,SAAS,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,UAAU,CAAC;YACvB,GAAG,CAAC,UAAU,UAAU,gDAAgD,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC1C,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC;QACxH,GAAG,CAAC,oBAAoB,MAAM,YAAY,QAAQ,SAAS,OAAO,CAAC,WAAW,wBAAwB,QAAQ,OAAO,CAAC,CAAC;QACvH,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,EAAE,QAAQ,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;QACpI,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAC3B,OAAO,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9I,CAAC;QACD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;QACrB,OAAO,UAAU,CAAC;YAChB,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,KAAK;YAC3E,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;YACvG,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,qBAAqB,cAAc,aAAa,CAAC,CAAC,CAAC,IAAI;SACnG,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAc,EAAE,IAAmB;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,8BAA8B,CAAC,CAAC,MAAM,qBAAqB,KAAK,EAAE,CAAC;IACpG,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,0BAA0B,CAAC,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;IAClF,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;SACpC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;SACxG,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,UAAU,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO;QAClH,GAAG,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,iCAAiC,GAAG,GAAG,KAAK,EAAE,CAAC;AAClG,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,UAAU,CAAC,IAAoB;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,MAAM,GAAuB,IAAI,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAClM,CAAC;YACD,IAAI,MAAM;gBAAE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,CAAC;YAAC,GAAG,CAAC,kCAAkC,CAAC,EAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/src/codewatch/results.d.ts

@@ -0,0 +1,90 @@
+export declare const RESULT_SCHEMA_VERSION = 1;
+export declare const RESULTS_DIR = ".prism/results";
+/** Pre-commit ran with no gitleaks on PATH: the commit was allowed but not secret-scanned. */
+export declare const REASON_GITLEAKS_MISSING = "gitleaks-missing";
+export type Severity = 'high' | 'medium' | 'low';
+export type FindingCategory = 'quality' | 'security';
+export interface Finding {
+    severity: Severity;
+    category: FindingCategory;
+    /** Rule that fired: a gitleaks RuleID, or the review rule the reviewer named. */
+    rule: string;
+    file: string;
+    line: number | null;
+    message: string;
+}
+/** `secrets` = gitleaks; `review` = the reviewer (kiro-cli / Claude Code). */
+export type ResultKind = 'secrets' | 'review';
+export type ResultHook = 'pre-commit' | 'pre-push' | 'ci' | 'manual';
+/**
+ * ok        ran, nothing found
+ * findings  ran, found something
+ * error     could not produce a verdict (tool missing, crashed, unparseable output)
+ * skipped   did not run: no changes to review, or the hook was bypassed (`--no-verify`)
+ */
+export type ResultStatus = 'ok' | 'findings' | 'error' | 'skipped';
+export interface PrismResult {
+    schema_version: typeof RESULT_SCHEMA_VERSION;
+    kind: ResultKind;
+    hook: ResultHook;
+    status: ResultStatus;
+    /** Tool that produced the verdict: 'gitleaks', 'kiro', 'claude', or 'none'. */
+    tool: string;
+    tool_version: string | null;
+    /** Model the reviewer reported, or the one requested if it reported none. null when unknown. */
+    model: string | null;
+    /** Commit reviewed. null for pre-commit, where the commit does not exist yet. */
+    commit: string | null;
+    /**
+     * Tree object of the change. For pre-commit this is the staged tree, which
+     * equals the tree of the commit that follows -- how a later pre-push links a
+     * pushed commit back to its secret scan, and so detects `--no-verify`.
+     */
+    tree: string | null;
+    branch: string | null;
+    upstream: string | null;
+    /** Base commit of the reviewed range (pre-push). */
+    base: string | null;
+    started_at: string;
+    finished_at: string;
+    findings: Finding[];
+    summary: string | null;
+    score: number | null;
+    /**
+     * Why the run errored or was skipped. Free text, except these codes, which
+     * consumers (the dashboard, CI) match on exactly: see REASON_*.
+     */
+    reason: string | null;
+}
+export type ResultInit = Omit<PrismResult, 'schema_version' | 'tool_version' | 'model' | 'commit' | 'tree' | 'branch' | 'upstream' | 'base' | 'summary' | 'score' | 'reason' | 'findings'> & Partial<Pick<PrismResult, 'tool_version' | 'model' | 'commit' | 'tree' | 'branch' | 'upstream' | 'base' | 'summary' | 'score' | 'reason' | 'findings'>>;
+export declare function makeResult(init: ResultInit): PrismResult;
+/** `20261104T202000123Z` -- sortable, colon-free. */
+export declare function compactTimestamp(iso: string): string;
+/**
+ * `<commit12>-<time>-<hook>-<kind>.json`, or `tree-<tree12>-...` when there is
+ * no commit yet (pre-commit).
+ */
+export declare function resultFileName(r: PrismResult): string;
+/**
+ * Writes a result atomically (temp file + rename), so a dashboard reading the
+ * directory never sees a half-written file. Returns the absolute path.
+ */
+/**
+ * Makes sure `.prism/results/` is ignored in this clone. Under the global
+ * hooks a repo may never have had codewatch installed, so it has no .gitignore
+ * entry; `.git/info/exclude` is local to the clone and keeps the working tree
+ * clean without touching any tracked file. Outside a git repo it does nothing.
+ */
+export declare function ensureResultsExcluded(repoRoot: string): boolean;
+export declare function writeResult(repoRoot: string, r: PrismResult): string;
+export interface ResultEntry {
+    /** File name without `.json`: the result's stable id (used by report links). */
+    id: string;
+    result: PrismResult;
+}
+/** Every parseable result with its id. Ids come from the directory listing, never from input. */
+export declare function readResultEntries(repoRoot: string): ResultEntry[];
+/** Reads every parseable result file. Unparseable files are ignored, not fatal. */
+export declare function readResults(repoRoot: string): PrismResult[];
+export declare function countBySeverity(findings: Finding[]): Record<Severity, number>;
+//# sourceMappingURL=results.d.ts.map

package/dist/src/codewatch/results.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"results.d.ts","sourceRoot":"","sources":["../../../src/codewatch/results.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAE5C,8FAA8F;AAC9F,eAAO,MAAM,uBAAuB,qBAAqB,CAAC;AAE1D,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AACjD,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,eAAe,CAAC;IAC1B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC9C,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,UAAU,GAAG,IAAI,GAAG,QAAQ,CAAC;AACrE;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,OAAO,qBAAqB,CAAC;IAC7C,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gGAAgG;IAChG,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,iFAAiF;IACjF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;OAIG;IACH,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,oDAAoD;IACpD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;OAGG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,GAAG,cAAc,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC,GACtL,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC;AAE5J,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAgBxD;AAOD,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAGrD;AAED;;;GAGG;AACH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAS/D;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,GAAG,MAAM,CAWpE;AAED,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAgBjE;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAE3D;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAI7E"}