@prism-d1/cli 1.10.1 → 1.11.0

package/dist/src/codewatch/harness/diff.js

@@ -0,0 +1,227 @@
+/**
+ * Git plumbing for the harness loop: working-tree snapshots, tree-to-tree
+ * diffs, and a small unified-diff parser.
+ *
+ * A snapshot is `git add -A` into a COPY of the index followed by
+ * `git write-tree`, so the user's index, stash and working tree are never
+ * touched (docs/DESIGN-harness-loop.md section 4.1). It writes blob and tree
+ * objects only; nothing references them, so `git gc` prunes them later.
+ */
+import { spawnSync } from 'node:child_process';
+import { copyFileSync, existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { DIFF_EXCLUDES } from '../prepush.js';
+import { RESULTS_DIR } from '../results.js';
+export const HARNESS_DIR = '.prism/harness';
+/** PRISM's own local output never counts as a change. */
+const OWN_OUTPUT = [`:(exclude,glob)${RESULTS_DIR}/**`, `:(exclude,glob)${HARNESS_DIR}/**`];
+const GIT_HOOK_ENV = ['GIT_DIR', 'GIT_INDEX_FILE', 'GIT_WORK_TREE', 'GIT_PREFIX', 'GIT_OBJECT_DIRECTORY', 'GIT_ALTERNATE_OBJECT_DIRECTORIES'];
+const MAX_BUFFER = 256 * 1024 * 1024;
+export function gitIn(repoRoot, args, extraEnv = {}, input) {
+    const env = { ...process.env };
+    for (const k of GIT_HOOK_ENV)
+        delete env[k];
+    Object.assign(env, extraEnv);
+    const r = spawnSync('git', ['-C', repoRoot, ...args], { encoding: 'utf8', env, input, maxBuffer: MAX_BUFFER, stdio: ['pipe', 'pipe', 'pipe'] });
+    return { ok: r.status === 0 && !r.error, stdout: (r.stdout || '').replace(/\n$/, ''), stderr: r.stderr || '' };
+}
+/**
+ * Tree object of the whole working tree (tracked plus untracked, honoring
+ * .gitignore), or null. A partial snapshot (a file git could not read) still
+ * returns a tree and says what was left out in `warnings`.
+ */
+export function snapshotTree(repoRoot, warnings = []) {
+    const idx = gitIn(repoRoot, ['rev-parse', '--path-format=absolute', '--git-path', 'index']);
+    const dir = mkdtempSync(join(tmpdir(), 'prism-harness-idx-'));
+    const firstLine = (s) => s.trim().split('\n')[0].slice(0, 200);
+    try {
+        const tmpIndex = join(dir, 'index');
+        if (idx.ok && idx.stdout && existsSync(idx.stdout))
+            copyFileSync(idx.stdout, tmpIndex);
+        const env = { GIT_INDEX_FILE: tmpIndex };
+        // --ignore-errors: an unreadable file is left out rather than failing the snapshot.
+        const add = gitIn(repoRoot, ['add', '-A', '--ignore-errors', '--', '.'], env);
+        if (!add.ok)
+            warnings.push(`the working-tree snapshot left out files git could not add (${firstLine(add.stderr)}); changes in them are not reviewed`);
+        // PRISM's own output never counts, even where git does not ignore it. (An exclude
+        // pathspec on `git add` errors when the path is also ignored, so remove it after.)
+        // The diff excludes these paths too, so a failure here only costs a warning.
+        const rm = gitIn(repoRoot, ['rm', '-r', '-q', '--cached', '--ignore-unmatch', '--', RESULTS_DIR, HARNESS_DIR], env);
+        if (!rm.ok)
+            warnings.push(`could not drop PRISM's own output from the snapshot (${firstLine(rm.stderr)})`);
+        const t = gitIn(repoRoot, ['write-tree'], env);
+        return t.ok && /^[0-9a-f]{40,64}$/.test(t.stdout) ? t.stdout : null;
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+export function objectExists(repoRoot, rev) {
+    return gitIn(repoRoot, ['cat-file', '-e', rev]).ok;
+}
+export function revParse(repoRoot, rev) {
+    const r = gitIn(repoRoot, ['rev-parse', '--verify', '--quiet', rev]);
+    return r.ok && r.stdout ? r.stdout : null;
+}
+/** Unified diff between two trees (or commits), lock files and PRISM's own output excluded. */
+export function diffTrees(repoRoot, from, to) {
+    const r = gitIn(repoRoot, ['-c', 'core.quotePath=false', 'diff', '--no-color', '--no-ext-diff', '--unified=3', '-M',
+        '--src-prefix=a/', '--dst-prefix=b/', from, to, '--', '.', ...DIFF_EXCLUDES, ...OWN_OUTPUT]);
+    return r.ok ? r.stdout : null;
+}
+function unquote(p) {
+    if (!p.startsWith('"'))
+        return p;
+    try {
+        return JSON.parse(p);
+    }
+    catch {
+        return p.slice(1, -1);
+    }
+}
+const stripPrefix = (p, pre) => (p.startsWith(pre) ? p.slice(pre.length) : p);
+/** Parses `git diff` output (a/ b/ prefixes). Tolerant: unknown lines are skipped. */
+export function parseDiff(text) {
+    const files = [];
+    const allowMarkers = [];
+    let cur = null;
+    let inHunk = false;
+    let newLine = 0;
+    let addedLines = 0;
+    for (const line of text.split('\n')) {
+        if (line.startsWith('diff --git ')) {
+            const m = /^diff --git (.+?) (b\/.+|"b\/.+")$/.exec(line);
+            const b = m ? stripPrefix(unquote(m[2]), 'b/') : '';
+            const a = m ? stripPrefix(unquote(m[1]), 'a/') : '';
+            cur = { path: b, oldPath: a && a !== b ? a : null, deleted: false, added: new Set() };
+            files.push(cur);
+            inHunk = false;
+            continue;
+        }
+        if (!cur)
+            continue;
+        if (!inHunk) {
+            if (line.startsWith('+++ ')) {
+                const p = line.slice(4);
+                if (p === '/dev/null') {
+                    cur.deleted = true;
+                    cur.oldPath = cur.oldPath ?? cur.path;
+                }
+                else
+                    cur.path = stripPrefix(unquote(p), 'b/');
+            }
+            else if (line.startsWith('--- ')) {
+                const p = line.slice(4);
+                if (p !== '/dev/null') {
+                    const old = stripPrefix(unquote(p), 'a/');
+                    if (old !== cur.path)
+                        cur.oldPath = old;
+                }
+            }
+            else if (line.startsWith('rename from '))
+                cur.oldPath = unquote(line.slice(12));
+            else if (line.startsWith('rename to '))
+                cur.path = unquote(line.slice(10));
+            else if (line.startsWith('deleted file mode'))
+                cur.deleted = true;
+        }
+        const h = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+        if (h) {
+            inHunk = true;
+            newLine = Number(h[1]);
+            continue;
+        }
+        if (!inHunk)
+            continue;
+        if (line.startsWith('+')) {
+            cur.added.add(newLine);
+            addedLines++;
+            if (line.includes('gitleaks:allow'))
+                allowMarkers.push({ file: cur.path, line: newLine });
+            newLine++;
+        }
+        else if (line.startsWith(' '))
+            newLine++;
+    }
+    return { files, addedLines, allowMarkers };
+}
+/** Every path a diff touches, old and new. */
+export function touchedPaths(d) {
+    const out = new Set();
+    for (const f of d.files) {
+        out.add(f.path);
+        if (f.oldPath)
+            out.add(f.oldPath);
+    }
+    return [...out].filter(Boolean);
+}
+/**
+ * Contents of `<rev>:<path>` for each path, through one `git cat-file --batch`.
+ * Missing paths are absent from the map. A path holding a newline cannot be
+ * sent on the batch protocol's one-line-per-object input (it would desync
+ * every object after it; `-z` needs git 2.43), so it is left out and pushed
+ * onto `unreadable` for the caller to report.
+ */
+export function readBlobs(repoRoot, rev, paths, unreadable = []) {
+    const out = new Map();
+    const ok = paths.filter((p) => !/[\n\r]/.test(p));
+    unreadable.push(...paths.filter((p) => /[\n\r]/.test(p)));
+    paths = ok;
+    if (!paths.length)
+        return out;
+    const env = { ...process.env };
+    for (const k of GIT_HOOK_ENV)
+        delete env[k];
+    const r = spawnSync('git', ['-C', repoRoot, 'cat-file', '--batch'], {
+        input: paths.map((p) => `${rev}:${p}`).join('\n') + '\n', env, maxBuffer: MAX_BUFFER, stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    if (r.status !== 0 || !r.stdout)
+        return out;
+    const buf = r.stdout;
+    let pos = 0;
+    for (const p of paths) {
+        const nl = buf.indexOf(0x0a, pos);
+        if (nl < 0)
+            break;
+        const header = buf.subarray(pos, nl).toString('utf8');
+        pos = nl + 1;
+        const m = /^[0-9a-f]+ (\w+) (\d+)$/.exec(header);
+        if (!m)
+            continue; // "<obj> missing"
+        const size = Number(m[2]);
+        if (m[1] === 'blob')
+            out.set(p, buf.subarray(pos, pos + size));
+        pos += size + 1;
+    }
+    return out;
+}
+/** Converts a glob (`*`, `**`, `?`) to a regex. A pattern without `/` matches the base name. */
+export function globToRegExp(glob) {
+    let re = '';
+    for (let i = 0; i < glob.length; i++) {
+        const c = glob[i];
+        if (c === '*') {
+            if (glob[i + 1] === '*') {
+                i++;
+                if (glob[i + 1] === '/') {
+                    re += '(.*/)?';
+                    i++;
+                }
+                else
+                    re += '.*';
+            }
+            else
+                re += '[^/]*';
+        }
+        else if (c === '?')
+            re += '[^/]';
+        else
+            re += c.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+    }
+    return new RegExp(glob.includes('/') ? `^${re}$` : `(^|/)${re}$`);
+}
+export function matchesAny(path, globs) {
+    return globs.some((g) => globToRegExp(g).test(path));
+}
+//# sourceMappingURL=diff.js.map

package/dist/src/codewatch/harness/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../../../src/codewatch/harness/diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAC5C,yDAAyD;AACzD,MAAM,UAAU,GAAG,CAAC,kBAAkB,WAAW,KAAK,EAAE,kBAAkB,WAAW,KAAK,CAAC,CAAC;AAC5F,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,YAAY,EAAE,sBAAsB,EAAE,kCAAkC,CAAC,CAAC;AAC9I,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAIrC,MAAM,UAAU,KAAK,CAAC,QAAgB,EAAE,IAAc,EAAE,WAAmC,EAAE,EAAE,KAAc;IAC3G,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,YAAY;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAChJ,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;AACjH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,WAAqB,EAAE;IACpE,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5F,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvF,MAAM,GAAG,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;QACzC,oFAAoF;QACpF,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,+DAA+D,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;QACtJ,kFAAkF;QAClF,mFAAmF;QACnF,6EAA6E;QAC7E,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;QACpH,IAAI,CAAC,EAAE,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,wDAAwD,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3G,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,GAAW;IACxD,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,GAAW;IACpD,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IACrE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,IAAY,EAAE,EAAU;IAClE,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,IAAI;QACjH,iBAAiB,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;IAC/F,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAmBD,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAChE,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F,sFAAsF;AACtF,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,YAAY,GAA+B,EAAE,CAAC;IACpD,IAAI,GAAG,GAAoB,IAAI,CAAC;IAChC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YACtF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,MAAM,GAAG,KAAK,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACxB,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;oBAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;oBAAC,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC;gBAAC,CAAC;;oBAAM,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACtI,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACxB,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;oBAAC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;oBAAC,IAAI,GAAG,KAAK,GAAG,CAAC,IAAI;wBAAE,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;gBAAC,CAAC;YAChH,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;gBAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;iBAC7E,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;gBAAE,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;iBACtE,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,GAAG,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;YAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvB,UAAU,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAAE,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1F,OAAO,EAAE,CAAC;QACZ,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AAC7C,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,YAAY,CAAC,CAAa;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC,CAAC,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAChF,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,GAAW,EAAE,KAAe,EAAE,aAAuB,EAAE;IACjG,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,KAAK,GAAG,EAAE,CAAC;IACX,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IAC9B,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,YAAY;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE;QAClE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KACtH,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IAC5C,MAAM,GAAG,GAAG,CAAC,CAAC,MAAgB,CAAC;IAC/B,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,EAAE,GAAG,CAAC;YAAE,MAAM;QAClB,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtD,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;QACb,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,CAAC;YAAE,SAAS,CAAC,kBAAkB;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;QAC/D,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,CAAC,EAAE,CAAC;gBACJ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAAC,EAAE,IAAI,QAAQ,CAAC;oBAAC,CAAC,EAAE,CAAC;gBAAC,CAAC;;oBAAM,EAAE,IAAI,IAAI,CAAC;YACpE,CAAC;;gBAAM,EAAE,IAAI,OAAO,CAAC;QACvB,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG;YAAE,EAAE,IAAI,MAAM,CAAC;;YAC9B,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,KAAe;IACtD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/src/codewatch/harness/engine.d.ts

@@ -0,0 +1,127 @@
+import { type BlockOn } from '../config.js';
+import { type CommitSecret } from '../gitleaks.js';
+import { type Finding } from '../results.js';
+import { type Verdict } from './state.js';
+export declare const VERDICT_SCHEMA = "prism.harness.verdict";
+export declare const VERDICT_VERSION = 1;
+/** The harness reviews a smaller diff than the pre-push gate (200,000), because a person waits on it. */
+export declare const MAX_HARNESS_DIFF_CHARS = 60000;
+/** Set in the reviewer's environment, so a reviewer that loads the same plugin does not re-enter the hook. */
+export declare const HARNESS_CHILD_ENV = "PRISM_HARNESS_CHILD";
+export declare const RETRY_NOTE = "Your previous reply was not valid JSON. Return exactly one JSON object matching that schema and nothing else: no prose, no code fences.";
+export type Scope = 'new-lines' | 'files' | 'branch';
+export declare const SCOPES: Scope[];
+export type HumanWhy = 'secret-committed' | 'tamper' | 'max-rounds' | 'reviewer-failed' | 'no-progress' | 'secrets-scan-failed' | 'push-unknown';
+export type HarnessEvent = 'stop' | 'pre-push' | 'manual' | 'mcp';
+/** One `git push` as the adapter read it from the command line. */
+export interface PushTarget {
+    /** The remote named on the command line, or null for the default. */
+    remote: string | null;
+    /** The source of the refspec (`HEAD`, a branch, a sha), or null for the current branch. */
+    src: string | null;
+    /** The branch it writes to on the remote, or null when not given. */
+    dst: string | null;
+    /** Set when the command's push target cannot be determined (`--all`, several refspecs, a glob): the push is held. */
+    unknown: string | null;
+}
+/** Paths whose change during a session ends the loop (section 6.2). `.prism/results/**` and
+ * `.prism/harness/**` are on the design's list but never appear here: every diff and snapshot
+ * excludes PRISM's own output, so an edit to them is never seen (the section 6.2 non-goal). */
+export declare const TAMPER_GLOBS: string[];
+export declare const isTamperPath: (p: string) => boolean;
+export interface VerdictSecret {
+    file: string;
+    line: number | null;
+    rule: string;
+    committed: boolean;
+}
+export interface VerdictFinding extends Finding {
+    introduced_in_session: boolean;
+    blocking: boolean;
+}
+export interface HarnessVerdict {
+    schema: typeof VERDICT_SCHEMA;
+    version: typeof VERDICT_VERSION;
+    verdict: Verdict;
+    round: number;
+    max_rounds: number;
+    session: string | null;
+    scope: Scope;
+    diff: {
+        files: number;
+        added_lines: number;
+        hash: string | null;
+        cached: boolean;
+    };
+    secrets_scanned: boolean;
+    secrets: VerdictSecret[];
+    /**
+     * Branch scope: secrets gitleaks found in a commit of the reviewed range,
+     * even if a later commit removed them. Any entry makes the verdict `stop`
+     * (`secret-committed`): the commit itself would leave with the push.
+     */
+    commit_secrets: CommitSecret[];
+    block_on: BlockOn[];
+    findings: VerdictFinding[];
+    dropped: {
+        out_of_scope: number;
+        unknown_file: number;
+    };
+    reasons: string[];
+    next_action: string;
+    human_needed: boolean;
+    human_why: HumanWhy | null;
+    warnings: string[];
+    reviewer: {
+        tool: string;
+        model: string | null;
+        attempts: number;
+        wall_s: number;
+        cost_usd: number | null;
+    } | null;
+    result_path: string | null;
+    fail_open: boolean;
+}
+export interface HarnessOptions {
+    repoRoot: string;
+    /** working (default) | staged (index vs HEAD) | since (<ref>...HEAD plus uncommitted). */
+    mode?: 'working' | 'staged' | 'since';
+    since?: string;
+    session?: string | null;
+    client?: string | null;
+    scope?: Scope;
+    maxRounds?: number;
+    timeoutSeconds?: number;
+    /** --no-review: gitleaks and the tamper check only. */
+    noReview?: boolean;
+    /** false when the push gate is off: the AI review is skipped, gitleaks still runs. */
+    aiReview?: boolean;
+    event?: HarnessEvent;
+    /**
+     * Absolute time (epoch ms) the whole run must finish by: every gitleaks scan
+     * and reviewer attempt gets only what is left, minus a reserve for writing
+     * the result. Hooks set it below the client's kill time. Unset: no deadline.
+     */
+    deadlineMs?: number;
+    /**
+     * Returns true the first time a notice with this key may be shown in the
+     * current session, false after. Unset: every notice shows.
+     */
+    noticeOnce?: (key: string) => boolean;
+    /** pre-push: what the agent's `git push` command writes (parsed by the adapter). */
+    push?: PushTarget;
+    /** PATH for reviewer detection (tests). */
+    pathEnv?: string;
+    gitleaksBin?: string;
+    now?: () => Date;
+}
+/** Time kept back from the deadline for writing the state and the result and printing the answer. */
+export declare const DEADLINE_RESERVE_MS = 5000;
+/**
+ * Runs one review. Throws only on an internal error (the CLI turns that into
+ * exit 1, adapters into "no decision").
+ */
+export declare function runHarnessReview(opts: HarnessOptions): HarnessVerdict;
+/** CLI exit code for a verdict: 0 pass, 3 fix, 4 stop (exit 2 is avoided on purpose, section 3). */
+export declare function exitCodeFor(v: HarnessVerdict): number;
+//# sourceMappingURL=engine.d.ts.map

package/dist/src/codewatch/harness/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../../src/codewatch/harness/engine.ts"],"names":[],"mappings":"AAsBA,OAAO,EAA6I,KAAK,OAAO,EAAsB,MAAM,cAAc,CAAC;AAC3M,OAAO,EAAqG,KAAK,YAAY,EAA6C,MAAM,gBAAgB,CAAC;AACjM,OAAO,EAAqC,KAAK,OAAO,EAAiB,MAAM,eAAe,CAAC;AAK/F,OAAO,EAAiH,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAEzJ,eAAO,MAAM,cAAc,0BAA0B,CAAC;AACtD,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,yGAAyG;AACzG,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,8GAA8G;AAC9G,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AACvD,eAAO,MAAM,UAAU,4IAA4I,CAAC;AAEpK,MAAM,MAAM,KAAK,GAAG,WAAW,GAAG,OAAO,GAAG,QAAQ,CAAC;AACrD,eAAO,MAAM,MAAM,EAAE,KAAK,EAAqC,CAAC;AAChE,MAAM,MAAM,QAAQ,GAAG,kBAAkB,GAAG,QAAQ,GAAG,YAAY,GAAG,iBAAiB,GAAG,aAAa,GAAG,qBAAqB,GAAG,cAAc,CAAC;AACjJ,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,KAAK,CAAC;AAElE,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,2FAA2F;IAC3F,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,qEAAqE;IACrE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,qHAAqH;IACrH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;+FAE+F;AAC/F,eAAO,MAAM,YAAY,UAKxB,CAAC;AAGF,eAAO,MAAM,YAAY,GAAI,GAAG,MAAM,YAAwC,CAAC;AAK/E,MAAM,WAAW,aAAa;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE;AACtG,MAAM,WAAW,cAAe,SAAQ,OAAO;IAAG,qBAAqB,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE;AAErG,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,cAAc,CAAC;IAC9B,OAAO,EAAE,OAAO,eAAe,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,KAAK,CAAC;IACb,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IACnF,eAAe,EAAE,OAAO,CAAC;IACzB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB;;;;OAIG;IACH,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACnH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,IAAI,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sFAAsF;IACtF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACtC,oFAAoF;IACpF,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AA0UD,qGAAqG;AACrG,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAgNxC;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAmErE;AAED,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAErD"}