@quikit/quikpilot-runner 8.2.7 → 9.0.0

package/dist/index.js

@@ -73,12 +73,14 @@ async function describeQuikTrackFailure(res) {
 
 // src/callback.ts
 async function reportBack(params) {
-  const { callbackUrl, runToken, status, branch, warnings, targeting, baselineFindings } = params;
+  const { callbackUrl, runToken, status, branch, warnings, targeting, baselineFindings, vanishedTests, unresolved } = params;
   const body = { status };
   if (branch) body.branch = branch;
   if (warnings && warnings.length > 0) body.warnings = warnings;
+  if (unresolved && unresolved.length > 0) body.unresolved = unresolved;
   if (targeting) body.targeting = targeting;
   if (baselineFindings) body.baselineFindings = baselineFindings;
+  if (vanishedTests) body.vanishedTests = vanishedTests;
   const res = await fetch(callbackUrl, {
     method: "POST",
     headers: { Authorization: `Bearer ${runToken}`, "Content-Type": "application/json" },
@@ -110,20 +112,20 @@ function runTestCommand(command) {
 }
 function runTestCommandAsync(command) {
   if (!command) return Promise.resolve("success");
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const child = (0, import_node_child_process.spawn)(command, { shell: "/bin/bash", stdio: "inherit" });
-    child.on("exit", (code) => resolve4(code === 0 ? "success" : "failure"));
-    child.on("error", () => resolve4("failure"));
+    child.on("exit", (code) => resolve5(code === 0 ? "success" : "failure"));
+    child.on("error", () => resolve5("failure"));
   });
 }
 function runCommandWithTimeout(command, timeoutMs) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let settled = false;
     const finish = (outcome) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve4(outcome);
+      resolve5(outcome);
     };
     const child = (0, import_node_child_process.spawn)(command, { shell: "/bin/bash", stdio: "inherit", detached: true });
     const timer = setTimeout(() => {
@@ -250,6 +252,106 @@ function findDeniedContextPath(contextPaths, patterns) {
   return null;
 }
 
+// src/editsApply.ts
+function detectLineEnding(text) {
+  const crlf = text.split("\r\n").length - 1;
+  const bareLf = text.split("\n").length - 1 - crlf;
+  if (crlf > 0 && bareLf > 0) return "mixed";
+  return crlf > 0 ? "CRLF" : "LF";
+}
+function toLf(text) {
+  return text.replace(/\r\n/g, "\n");
+}
+function fromLf(text, ending) {
+  return ending === "CRLF" ? text.replace(/\n/g, "\r\n") : text;
+}
+function occurrences(haystack, needle) {
+  const found = [];
+  let index = haystack.indexOf(needle);
+  while (index !== -1) {
+    found.push(index);
+    index = haystack.indexOf(needle, index + 1);
+  }
+  return found;
+}
+function applyEdits(originalLf, edits) {
+  if (!Array.isArray(edits) || edits.length === 0) {
+    return {
+      ok: false,
+      editCount: 0,
+      refusals: [{ kind: "no_edits", edits: [], matchCount: null, message: "the response carried no edits" }]
+    };
+  }
+  const refusals = [];
+  const ranges = [];
+  edits.forEach((edit, index) => {
+    const number = index + 1;
+    const record = edit !== null && typeof edit === "object" ? edit : null;
+    const find = record?.find;
+    const replace = record?.replace;
+    if (typeof find !== "string" || typeof replace !== "string") {
+      refusals.push({
+        kind: "empty",
+        edits: [number],
+        matchCount: null,
+        message: `edit ${number} is missing a string find or replace`
+      });
+      return;
+    }
+    if (find === "") {
+      refusals.push({ kind: "empty", edits: [number], matchCount: null, message: `edit ${number} has an empty anchor` });
+      return;
+    }
+    const starts = occurrences(originalLf, find);
+    if (starts.length === 0) {
+      refusals.push({ kind: "no_match", edits: [number], matchCount: 0, message: `edit ${number}: the anchor matched nothing` });
+    } else if (starts.length > 1) {
+      refusals.push({
+        kind: "ambiguous",
+        edits: [number],
+        matchCount: starts.length,
+        message: `edit ${number}: the anchor matched ${starts.length} times`
+      });
+    } else {
+      ranges.push({ start: starts[0], end: starts[0] + find.length, number, replace });
+    }
+  });
+  for (let i = 0; i < ranges.length; i++) {
+    for (let j = i + 1; j < ranges.length; j++) {
+      const a = ranges[i];
+      const b = ranges[j];
+      if (a.start < b.end && b.start < a.end) {
+        const [first, second] = a.number < b.number ? [a.number, b.number] : [b.number, a.number];
+        refusals.push({
+          kind: "overlap",
+          edits: [first, second],
+          matchCount: null,
+          message: `edits ${first} and ${second} overlap`
+        });
+      }
+    }
+  }
+  if (refusals.length > 0) return { ok: false, refusals, editCount: edits.length };
+  const pieces = [];
+  let cursor = 0;
+  for (const range of [...ranges].sort((x, y) => x.start - y.start)) {
+    pieces.push(originalLf.slice(cursor, range.start), range.replace);
+    cursor = range.end;
+  }
+  pieces.push(originalLf.slice(cursor));
+  return { ok: true, content: pieces.join(""), editCount: edits.length };
+}
+
+// src/runtimeReplyError.ts
+var RuntimeReplyError = class extends Error {
+  summary;
+  constructor(message, summary) {
+    super(message);
+    this.name = "RuntimeReplyError";
+    this.summary = summary;
+  }
+};
+
 // src/envelope.ts
 var HARD_FAILURE_CODES = /* @__PURE__ */ new Set(["SEMANTIC_MISMATCH", "CONTRACT_REJECTED"]);
 function checkHardFailure(envelope, useCase, target) {
@@ -257,17 +359,25 @@ function checkHardFailure(envelope, useCase, target) {
   if (typeof code === "string" && HARD_FAILURE_CODES.has(code)) {
     const detail = envelope.error ?? envelope.normalizedText ?? "no detail";
     const where = target ? ` for ${target}` : "";
-    throw new Error(`${useCase} failed${where} (${code}, not retried): ${detail}`);
+    throw new RuntimeReplyError(
+      `${useCase} failed${where} (${code}, not retried): ${detail}`,
+      `${useCase} failed${where} (${code}, not retried)`
+    );
   }
 }
 function unwrapExecute(envelope, useCase) {
   if (envelope?.success === false) {
-    throw new Error(
-      `${useCase} failed: ${envelope.errorCode ?? "UNKNOWN"} \u2014 ${envelope.error ?? envelope.normalizedText ?? "no message"}`
+    const code = envelope.errorCode ?? "UNKNOWN";
+    throw new RuntimeReplyError(
+      `${useCase} failed: ${code} \u2014 ${envelope.error ?? envelope.normalizedText ?? "no message"}`,
+      `${useCase} failed: ${code}`
     );
   }
   if (!envelope?.structuredJson || typeof envelope.structuredJson !== "object") {
-    throw new Error(`${useCase} returned no structuredJson: ${JSON.stringify(envelope)}`);
+    throw new RuntimeReplyError(
+      `${useCase} returned no structuredJson: ${JSON.stringify(envelope)}`,
+      `${useCase} returned no structuredJson`
+    );
   }
   return envelope.structuredJson;
 }
@@ -394,6 +504,58 @@ function looksLikeTruncatedRewrite(target, currentContent, newContent) {
   return null;
 }
 var CONTRACT_VERSION = "test-targets-1";
+var CONTRACT_VERSION_EDITS = "edits-1";
+var ANCHOR_REFUSED_CODE = "CODEGEN_ANCHOR_REFUSED";
+function summariseLocalRefusals(refusals) {
+  const parts = [];
+  const matchCounts = [];
+  for (const r of refusals) {
+    if (r.kind === "ambiguous") {
+      parts.push(`an anchor matched ${r.matchCount} times`);
+      if (r.matchCount !== null) matchCounts.push(r.matchCount);
+    } else if (r.kind === "no_match") {
+      parts.push("an anchor matched nothing");
+    } else if (r.kind === "overlap") {
+      parts.push(`edits ${r.edits.join(" and ")} overlap`);
+    } else if (r.kind === "no_edits") {
+      parts.push("the reply had no edits");
+    } else {
+      parts.push("an edit was missing its anchor or replacement");
+    }
+  }
+  return { text: [...new Set(parts)].join("; "), matchCounts };
+}
+function summariseRuntimeRefusal(error) {
+  const text = typeof error === "string" ? error : "";
+  const matchCounts = [...text.matchAll(/anchor matched (\d+) times/g)].map((m) => Number(m[1]));
+  const parts = matchCounts.map((n) => `an anchor matched ${n} times`);
+  if (/no match/i.test(text)) parts.push("an anchor matched nothing");
+  if (/overlap/i.test(text)) parts.push("edits overlapped");
+  if (/empty anchor|missing a string/i.test(text)) parts.push("an edit was missing its anchor or replacement");
+  return { text: parts.length > 0 ? [...new Set(parts)].join("; ") : "the runtime could not place the edits", matchCounts };
+}
+function throwOnTerminalRefusal(envelope, targetPath) {
+  if (typeof envelope?.errorCode === "string" && NOT_RETRIED_CODES.has(envelope.errorCode)) {
+    const detail = envelope.error ? `: ${envelope.error}` : "";
+    throw new RuntimeReplyError(
+      `Codegen refused ${targetPath}: ${envelope.errorCode} (not retried)${detail}`,
+      `Codegen refused ${targetPath}: ${envelope.errorCode} (not retried)`
+    );
+  }
+  if (envelope?.errorCode === JUDGED_BY_TOO_LARGE_CODE) {
+    const detail = envelope.error ? `: ${envelope.error}` : "";
+    throw new RuntimeReplyError(
+      `Codegen refused ${targetPath}: ${envelope.errorCode} (after narrowing)${detail}`,
+      `Codegen refused ${targetPath}: ${envelope.errorCode} (after narrowing)`
+    );
+  }
+}
+function codegenRefusedError(targetPath, body) {
+  return new RuntimeReplyError(
+    `Codegen refused ${targetPath}${body.refusalReason ? `: ${body.refusalReason}` : ""}`,
+    `Codegen refused ${targetPath}`
+  );
+}
 function buildJudgedByPool(requiredTests, targets, skippedCases) {
   const claimedIds = /* @__PURE__ */ new Set();
   for (const t of targets) {
@@ -419,12 +581,14 @@ function narrowJudgedByForTarget(pool, targets, codeTargetPath) {
 function toWireJudgedBy(pool) {
   return pool.map(({ automationId: _automationId, ...rest }) => rest);
 }
-async function runCodegen(gateway, targets, workspaceListing, requiredTests, deniedPaths, judgedByPool, warnings, contextLog) {
+async function runCodegen(gateway, targets, workspaceListing, requiredTests, deniedPaths, judgedByPool, warnings, contextLog, outOfScope = []) {
   const results = [];
   const listing = new Set(workspaceListing);
   for (const target of targets) {
     const isNewFile = target.kind === "NEW_FILE";
     const currentContent = isNewFile ? "" : (0, import_node_fs.readFileSync)(target.path, "utf8");
+    const lineEnding = isNewFile ? "LF" : detectLineEnding(currentContent);
+    const wantsEdits = !isNewFile && lineEnding !== "mixed";
     const contextPaths = target.contextPaths ?? [];
     const deniedContext = findDeniedContextPath(contextPaths, deniedPaths);
     if (deniedContext) {
@@ -439,7 +603,7 @@ async function runCodegen(gateway, targets, workspaceListing, requiredTests, den
         );
       }
     }
-    const namedContents = contextPaths.map((path) => ({ path, content: (0, import_node_fs.readFileSync)(path, "utf8") }));
+    const namedContents = contextPaths.map((path2) => ({ path: path2, content: (0, import_node_fs.readFileSync)(path2, "utf8") }));
     const added = collectRunContext(target, targets, new Set(contextPaths), deniedPaths);
     const contextContents = [...namedContents, ...added.entries];
     for (const s of added.skipped) {
@@ -455,12 +619,13 @@ async function runCodegen(gateway, targets, workspaceListing, requiredTests, den
     contextLog?.push(contextRecord);
     const contextData = {
       targetPath: target.path,
-      currentContent,
+      // Every anchor and replacement is LF, always (Doc 62 §2), so the file is sent as LF.
+      currentContent: wantsEdits ? toLf(currentContent) : currentContent,
       planSteps: target.planStepsImplemented,
       kind: target.kind,
       contextContents,
       // QUIKTR-1083 (§15.6) — required on every call on the versioned path.
-      contractVersion: CONTRACT_VERSION
+      contractVersion: wantsEdits ? CONTRACT_VERSION_EDITS : CONTRACT_VERSION
     };
     if (isNewFile) {
       contextData.workspaceListing = workspaceListing;
@@ -468,6 +633,9 @@ async function runCodegen(gateway, targets, workspaceListing, requiredTests, den
     if (deniedPaths.length > 0) {
       contextData.deniedPaths = deniedPaths;
     }
+    if (outOfScope.length > 0) {
+      contextData.outOfScope = outOfScope;
+    }
     if (target.automationIds && target.automationIds.length > 0) {
       const wanted = new Set(target.automationIds);
       contextData.requiredTests = requiredTests.filter((tc) => wanted.has(tc.automationId));
@@ -519,22 +687,91 @@ async function runCodegen(gateway, targets, workspaceListing, requiredTests, den
       envelope = await res.json();
       checkHardFailure(envelope, "pilot.codegen", target.path);
     }
-    if (typeof envelope?.errorCode === "string" && NOT_RETRIED_CODES.has(envelope.errorCode)) {
-      const detail = envelope.error ? `: ${envelope.error}` : "";
-      throw new Error(`Codegen refused ${target.path}: ${envelope.errorCode} (not retried)${detail}`);
+    throwOnTerminalRefusal(envelope, target.path);
+    let newContent = null;
+    let failedEdits = null;
+    let editCount;
+    let path = "whole_file";
+    let reason = isNewFile ? "new_file" : wantsEdits ? void 0 : "mixed_line_endings";
+    if (wantsEdits && envelope?.errorCode === ANCHOR_REFUSED_CODE) {
+      failedEdits = { reason: "anchor_refused", summary: summariseRuntimeRefusal(envelope.error) };
+    } else {
+      const body = unwrapExecute(envelope, "pilot.codegen");
+      if (wantsEdits) {
+        if (body.outcome === "REFUSED") throw codegenRefusedError(target.path, body);
+        if (body.outcome !== "GENERATED" || typeof body.newContent === "string") {
+          throw new RuntimeReplyError(
+            `Codegen reply for ${target.path} was not in the edits-1 shape and was not applied`,
+            `Codegen reply for ${target.path} was not in the edits-1 shape`
+          );
+        }
+        const applied = applyEdits(toLf(currentContent), body.edits);
+        if (applied.ok) {
+          newContent = fromLf(applied.content, lineEnding);
+          path = "edits";
+          editCount = applied.editCount;
+        } else if (applied.refusals.some((r) => r.kind === "no_edits")) {
+          throw new RuntimeReplyError(
+            `Codegen reply for ${target.path} carried no edits (not retried)`,
+            `Codegen reply for ${target.path} carried no edits`
+          );
+        } else {
+          failedEdits = { reason: "local_refusal", summary: summariseLocalRefusals(applied.refusals) };
+        }
+      } else {
+        if (body.outcome !== "GENERATED" || typeof body.newContent !== "string") {
+          throw codegenRefusedError(target.path, body);
+        }
+        newContent = body.newContent;
+      }
     }
-    if (envelope?.errorCode === JUDGED_BY_TOO_LARGE_CODE) {
-      const detail = envelope.error ? `: ${envelope.error}` : "";
-      throw new Error(`Codegen refused ${target.path}: ${envelope.errorCode} (after narrowing)${detail}`);
+    if (failedEdits) {
+      warnings.push(
+        `edits for ${target.path} could not be placed (${failedEdits.summary.text}); asked again for the whole file`
+      );
+      contextData.currentContent = currentContent;
+      contextData.contractVersion = CONTRACT_VERSION;
+      try {
+        res = await callCodegen();
+        if (!res.ok) {
+          throw new Error(`Codegen call failed for ${target.path}: ${res.status} ${res.statusText}`);
+        }
+        envelope = await res.json();
+        checkHardFailure(envelope, "pilot.codegen", target.path);
+        throwOnTerminalRefusal(envelope, target.path);
+        const whole = unwrapExecute(envelope, "pilot.codegen");
+        if (whole.outcome !== "GENERATED" || typeof whole.newContent !== "string") {
+          throw codegenRefusedError(target.path, whole);
+        }
+        newContent = whole.newContent;
+      } catch (error) {
+        if (error instanceof RuntimeReplyError) {
+          throw new RuntimeReplyError(
+            `${error.message} (this was the whole-file request made after the edits for ${target.path} were refused: ${failedEdits.summary.text})`,
+            `${error.summary} (the whole-file request, made after the edits were refused)`
+          );
+        }
+        throw error;
+      }
+      path = "fallback";
+      reason = failedEdits.reason;
     }
-    const body = unwrapExecute(envelope, "pilot.codegen");
-    if (body.outcome !== "GENERATED" || typeof body.newContent !== "string") {
-      throw new Error(
-        `Codegen refused ${target.path}${body.refusalReason ? `: ${body.refusalReason}` : ""}`
+    if (newContent === null) throw new Error(`Codegen produced no content for ${target.path}`);
+    if (!isNewFile) {
+      console.log(
+        JSON.stringify({
+          event: "codegen.edits_path",
+          targetPath: target.path,
+          path,
+          ...reason ? { reason } : {},
+          ...editCount !== void 0 ? { editCount } : {},
+          ...failedEdits && failedEdits.summary.matchCounts.length > 0 ? { matchCounts: failedEdits.summary.matchCounts } : {},
+          lineEnding
+        })
       );
     }
     if (!isNewFile) {
-      const suspectReason = looksLikeTruncatedRewrite(target, currentContent, body.newContent);
+      const suspectReason = looksLikeTruncatedRewrite(target, currentContent, newContent);
       if (suspectReason) {
         throw new Error(
           `Codegen output for ${target.path} looks like a truncated/abbreviated rewrite (${suspectReason}) \u2014 refusing to apply it. Interim guard per \xA716.7; the AI Runtime's own output-cap check is not live yet.`
@@ -547,11 +784,11 @@ async function runCodegen(gateway, targets, workspaceListing, requiredTests, den
         targetPath: target.path,
         kind: target.kind,
         inputLength: currentContent.length,
-        outputLength: body.newContent.length,
-        removedLines: isNewFile ? null : countRemovedLines(currentContent, body.newContent)
+        outputLength: newContent.length,
+        removedLines: isNewFile ? null : countRemovedLines(currentContent, newContent)
       })
     );
-    results.push({ targetPath: target.path, newContent: body.newContent });
+    results.push({ targetPath: target.path, newContent });
   }
   return results;
 }
@@ -961,6 +1198,14 @@ function firstXmlIn(dir, namePattern) {
   const match = entries.find((e) => namePattern.test(e));
   return match ? (0, import_node_path3.join)(dir, match) : null;
 }
+function readTestReportBytes(cwd = process.cwd()) {
+  try {
+    const report = findJUnitReport(cwd);
+    return report ? (0, import_node_fs4.readFileSync)(report) : null;
+  } catch {
+    return null;
+  }
+}
 function findJUnitReport(cwd = process.cwd()) {
   return walkForJUnitByName(cwd) ?? firstXmlIn((0, import_node_path3.join)(cwd, "test-results"), /\.xml$/) ?? firstXmlIn((0, import_node_path3.join)(cwd, "reports"), /^junit.*\.xml$/) ?? firstXmlIn((0, import_node_path3.join)(cwd, "target", "surefire-reports"), /\.xml$/);
 }
@@ -986,8 +1231,8 @@ async function reportToQuikTest(params) {
   try {
     console.log(`reporting ${report}`);
     const ciUrl = buildCiUrl(githubServerUrl, githubRepository, githubRunId);
-    const { readFileSync: readFileSync6 } = await import("node:fs");
-    const body = readFileSync6(report);
+    const { readFileSync: readFileSync7 } = await import("node:fs");
+    const body = readFileSync7(report);
     let url = `${resultsUrl}?ciUrl=${encodeURIComponent(ciUrl)}&automationIdFormat=bracket`;
     if (generatedFiles) {
       url += `&generatedFiles=${encodeURIComponent(generatedFiles.join(","))}`;
@@ -1077,9 +1322,11 @@ function parseJUnitOutcomes(xml) {
   TESTCASE_RE.lastIndex = 0;
   while (match = TESTCASE_RE.exec(xml)) {
     const [, attrs, body = ""] = match;
-    const name = NAME_ATTR_RE.exec(attrs)?.[1];
-    if (!name) continue;
-    const classname = CLASSNAME_ATTR_RE.exec(attrs)?.[1];
+    const rawName = NAME_ATTR_RE.exec(attrs)?.[1];
+    if (!rawName) continue;
+    const name = unescapeXmlEntities(rawName);
+    const rawClassname = CLASSNAME_ATTR_RE.exec(attrs)?.[1];
+    const classname = rawClassname === void 0 ? void 0 : unescapeXmlEntities(rawClassname);
     const id = classname ? `${classname}::${name}` : name;
     const failed = FAILURE_CHILD_RE.test(body);
     outcomes.set(id, !failed);
@@ -1360,8 +1607,110 @@ async function runBaselineCheck(params) {
   }
 }
 
-// src/scopeCheck.ts
+// src/failureArtifact.ts
 var import_node_fs7 = require("node:fs");
+var import_node_path5 = require("node:path");
+
+// src/failureReason.ts
+var MAX_FAILURE_REASON = 1e3;
+var MIN_SECRET_LENGTH = 8;
+var CREDENTIAL_PATTERNS = [
+  /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g,
+  /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+  /x-access-token:[^@\s'"]+/gi,
+  // Only the header form ("Authorization: basic <token>"), or a bearer value that contains a digit: a bare
+  // "basic authentication" or "bearer of the news" is prose, not a credential.
+  /\bauthorization:\s*(?:basic|bearer|token)\s+[^\s'"]{8,}/gi,
+  /\bbearer\s+(?=[A-Za-z0-9._~+/=-]*\d)[A-Za-z0-9._~+/=-]{12,}/gi,
+  // A signed JWT is three dot-separated segments; QuikPilot's own run token is an encrypted JWT (alg dir) of five, the
+  // second one empty. The run token is also matched by exact value, but one that has expired or rotated is not the
+  // current value, so its shape has to catch it.
+  /\beyJ[A-Za-z0-9_-]{8,}(?:\.[A-Za-z0-9_-]*){2,4}/g
+];
+function failureSummary(err) {
+  if (err instanceof RuntimeReplyError) return err.summary;
+  return err instanceof Error ? err.message : String(err);
+}
+function scrubSecrets(message, secrets = []) {
+  let text = message;
+  for (const secret of secrets) {
+    if (secret.length >= MIN_SECRET_LENGTH) text = text.split(secret).join("***");
+  }
+  for (const pattern of CREDENTIAL_PATTERNS) text = text.replace(pattern, "***");
+  return text;
+}
+function describeFailureReason(message, secrets = []) {
+  let text = scrubSecrets(message, secrets);
+  text = text.replace(/\s*\n\s*/g, " | ").trim();
+  return text.length > MAX_FAILURE_REASON ? `${text.slice(0, MAX_FAILURE_REASON)}\u2026` : text;
+}
+
+// src/failureArtifact.ts
+var FAILURE_ARTIFACT_DIR = "quikpilot-failure";
+var REPORT_COPY = "final-test-report.xml";
+var MAX_REPORT_BYTES = 5 * 1024 * 1024;
+var MAX_FILES = 200;
+var RUNNER_VERSION = true ? "9.0.0" : "dev";
+function safeDestination(base, repoPath) {
+  if (!repoPath || (0, import_node_path5.isAbsolute)(repoPath)) return null;
+  const destination = (0, import_node_path5.resolve)(base, repoPath);
+  const rel = (0, import_node_path5.relative)(base, destination);
+  if (!rel || rel.startsWith("..") || (0, import_node_path5.isAbsolute)(rel)) return null;
+  return destination;
+}
+function writeFailureArtifact(input) {
+  if (input.results.length === 0) return { written: false };
+  try {
+    const base = (0, import_node_path5.resolve)(input.cwd, FAILURE_ARTIFACT_DIR);
+    (0, import_node_fs7.rmSync)(base, { recursive: true, force: true });
+    (0, import_node_fs7.mkdirSync)(base, { recursive: true });
+    const files = [];
+    const skipped = [];
+    for (const result of input.results) {
+      const destination = files.length < MAX_FILES ? safeDestination(base, result.targetPath) : null;
+      if (!destination) {
+        skipped.push(result.targetPath);
+        continue;
+      }
+      (0, import_node_fs7.mkdirSync)((0, import_node_path5.dirname)(destination), { recursive: true });
+      (0, import_node_fs7.writeFileSync)(destination, result.newContent);
+      files.push({ path: result.targetPath, bytes: Buffer.byteLength(result.newContent) });
+    }
+    let testReport = "none";
+    if (input.testReport) {
+      if (input.testReport.byteLength > MAX_REPORT_BYTES) {
+        testReport = "too-large";
+      } else {
+        (0, import_node_fs7.writeFileSync)((0, import_node_path5.join)(base, REPORT_COPY), input.testReport);
+        testReport = "included";
+      }
+    }
+    const manifest = {
+      runId: input.runId,
+      issueKey: input.issueKey,
+      runnerVersion: RUNNER_VERSION,
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      targets: input.targets.map((t) => ({
+        path: t.path,
+        kind: t.kind,
+        ...t.automationIds && t.automationIds.length > 0 ? { automationIds: t.automationIds } : {}
+      })),
+      files,
+      skipped,
+      testReport,
+      failureReasons: input.failureReasons
+    };
+    const text = JSON.stringify(manifest, (_key, value) => typeof value === "string" ? scrubSecrets(value, input.secrets) : value, 2);
+    (0, import_node_fs7.writeFileSync)((0, import_node_path5.join)(base, "manifest.json"), text);
+    return { written: (0, import_node_fs7.existsSync)((0, import_node_path5.join)(base, "manifest.json")) };
+  } catch (err) {
+    console.warn(`::warning::Could not keep the failed run's files: ${err instanceof Error ? err.message : String(err)}`);
+    return { written: false };
+  }
+}
+
+// src/scopeCheck.ts
+var import_node_fs8 = require("node:fs");
 var ROUTE_METHOD_RE = /\b(GET|POST|PUT|PATCH|DELETE)\b/i;
 var ROUTE_PATH_RE = /\/[A-Za-z0-9_\-{}[\]]+(?:\/[A-Za-z0-9_\-:{}[\]]+)+/;
 var ROUTE_EXPORT_RE = /\bexport\s+(?:async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE)\s*\(/;
@@ -1418,7 +1767,7 @@ function checkApiScope(results, targets, apiChanges) {
     } else {
       let currentContent;
       try {
-        currentContent = (0, import_node_fs7.readFileSync)(targetPath, "utf8");
+        currentContent = (0, import_node_fs8.readFileSync)(targetPath, "utf8");
       } catch {
         currentContent = "";
       }
@@ -1437,7 +1786,7 @@ function describeScopeViolations(check) {
 }
 
 // src/targeting.ts
-var import_node_path5 = require("node:path");
+var import_node_path6 = require("node:path");
 var CONTRACT_VERSION2 = "test-targets-1";
 function listWorkspaceFiles(workspaceRoot) {
   return listFiles(workspaceRoot ?? ".");
@@ -1466,15 +1815,15 @@ function validateTarget(target, workspaceRoot, workspaceListing, deniedPaths) {
     }
     return;
   }
-  const root = (0, import_node_path5.resolve)(workspaceRoot ?? ".");
-  const rel = (0, import_node_path5.relative)(root, (0, import_node_path5.resolve)(target.path));
-  if (rel.startsWith("..") || (0, import_node_path5.isAbsolute)(rel)) {
+  const root = (0, import_node_path6.resolve)(workspaceRoot ?? ".");
+  const rel = (0, import_node_path6.relative)(root, (0, import_node_path6.resolve)(target.path));
+  if (rel.startsWith("..") || (0, import_node_path6.isAbsolute)(rel)) {
     throw new Error(
       `pilot.targeting named a NEW_FILE path that escapes the workspace root: ${target.path}`
     );
   }
 }
-async function runTargeting(gateway, design, workspaceRoot, workspaceListing, requiredTests, deniedPaths, testDiscovery) {
+async function runTargeting(gateway, design, workspaceRoot, workspaceListing, requiredTests, deniedPaths, testDiscovery, outOfScope = []) {
   const contextData = {
     // NESTED, NOT FLATTENED — a second vocabulary for the design shape is exactly what
     // QUIKTR-1034 cost.
@@ -1489,6 +1838,9 @@ async function runTargeting(gateway, design, workspaceRoot, workspaceListing, re
   if (deniedPaths.length > 0) {
     contextData.deniedPaths = deniedPaths;
   }
+  if (outOfScope.length > 0) {
+    contextData.outOfScope = outOfScope;
+  }
   contextData.testDiscovery = testDiscovery;
   const res = await fetchWithRetry(`${gateway.baseUrl}/ai/execute`, {
     method: "POST",
@@ -1511,16 +1863,28 @@ async function runTargeting(gateway, design, workspaceRoot, workspaceListing, re
     return { outcome: "NO_TARGET", reason: body.noTargetReason ?? null };
   }
   if (body.outcome !== "TARGETED" || !Array.isArray(body.targets)) {
-    throw new Error(`pilot.targeting returned an unexpected shape: ${JSON.stringify(body)}`);
+    throw new RuntimeReplyError(
+      `pilot.targeting returned an unexpected shape: ${JSON.stringify(body)}`,
+      "pilot.targeting returned an unexpected shape"
+    );
   }
   const listing = new Set(workspaceListing);
   for (const target of body.targets) {
     validateTarget(target, workspaceRoot, listing, deniedPaths);
   }
+  const correctedKinds = [];
+  const targets = body.targets.map((target) => {
+    if (target.kind === "NEW_FILE" && listing.has(target.path)) {
+      correctedKinds.push(target.path);
+      return { ...target, kind: "EXISTING" };
+    }
+    return target;
+  });
   return {
     outcome: "TARGETED",
-    targets: body.targets,
-    skippedCases: body.skippedCases ?? []
+    targets,
+    skippedCases: body.skippedCases ?? [],
+    ...correctedKinds.length > 0 ? { correctedKinds } : {}
   };
 }
 
@@ -1683,6 +2047,19 @@ async function exchangeForRunToken(tokenUrl, oidcToken) {
   return body.data.runToken;
 }
 
+// src/vanishedTests.ts
+var MAX_VANISHED_NAMES = 50;
+function findVanishedTests(baseline, after) {
+  if (!baseline.results || !after.results) return null;
+  const missing = [...baseline.results.keys()].filter((id) => !after.results.has(id));
+  if (missing.length === 0) return null;
+  return { names: missing.slice(0, MAX_VANISHED_NAMES), total: missing.length };
+}
+function describeVanishedTests(vanished) {
+  const noun = vanished.total === 1 ? "1 test" : `${vanished.total} tests`;
+  return `${noun} that ran before this change ${vanished.total === 1 ? "is" : "are"} missing from the final test report; the pull request lists ${vanished.total === 1 ? "it" : "them"}.`;
+}
+
 // src/run.ts
 async function run(env2) {
   let hardFailure = false;
@@ -1690,16 +2067,27 @@ async function run(env2) {
   let branch;
   let runToken;
   const warnings = [];
+  const failureReasons = [];
+  const recordFailure = (err) => {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(message);
+    const reason = describeFailureReason(failureSummary(err), runToken ? [runToken] : []);
+    if (reason) failureReasons.push(reason);
+  };
   let targeted = false;
   let generatedFilePaths = [];
+  let generatedResults = [];
+  let finalTestReport = null;
   let targetingResult;
   let baselineFindings;
+  let vanishedTests;
   const contextLog = [];
   try {
     runToken = await exchangeForRunToken(env2.tokenUrl, await fetchGithubOidcToken());
     packet = await fetchPacket(env2.packetUrl, runToken, env2.githubRunId);
     checkoutTargetBranch(packet.targetBranch);
     const workspaceListing = listWorkspaceFiles(packet.workspaceRoot);
+    const outOfScope = (packet.outOfScope ?? []).map((entry) => entry.trim()).filter((entry) => entry.length > 0);
     const targeting = await runTargeting(
       packet.gateway,
       packet.design,
@@ -1707,9 +2095,18 @@ async function run(env2) {
       workspaceListing,
       packet.requiredTests,
       packet.guardrails.deniedPaths,
-      packet.testDiscovery
+      packet.testDiscovery,
+      outOfScope
     );
     targetingResult = targeting;
+    if (targeting.outcome === "TARGETED") {
+      for (const path of targeting.correctedKinds ?? []) {
+        const w = `QuikPilot named ${path} as a new file, but it already exists in the repository. It was treated as an existing file so its current content was kept in view.`;
+        warnings.push(w);
+        console.warn(`QuikPilot targeting warning (not blocking): ${w}`);
+        console.log(JSON.stringify({ event: "targeting.kind_corrected", path }));
+      }
+    }
     if (targeting.outcome === "NO_TARGET") {
       writePhase0Marker(env2.runId);
       runCommand(packet.commands.setup, "Setup");
@@ -1755,9 +2152,11 @@ async function run(env2) {
           packet.guardrails.deniedPaths,
           judgedByPool,
           warnings,
-          contextLog
+          contextLog,
+          outOfScope
         )
       ]);
+      generatedResults = results;
       const depCheck = checkImportDependencies(
         results,
         readDeclaredDependencies(results, packet.workspaceRoot),
@@ -1803,6 +2202,13 @@ async function run(env2) {
       }
       runCommand(packet.commands.lint, "Lint");
       const after = captureTestSnapshot(packet.commands.test);
+      finalTestReport = readTestReportBytes();
+      vanishedTests = findVanishedTests(baseline, after) ?? void 0;
+      if (vanishedTests) {
+        const w = describeVanishedTests(vanishedTests);
+        warnings.push(w);
+        console.warn(`QuikPilot test warning (not blocking): ${w}`);
+      }
       const check = checkForRegressions(baseline, after);
       if (check.blocked) {
         throw new Error(
@@ -1818,7 +2224,7 @@ async function run(env2) {
     }
   } catch (err) {
     hardFailure = true;
-    console.error(err instanceof Error ? err.message : String(err));
+    recordFailure(err);
   }
   if (!runToken) {
     console.error("No run token \u2014 the OIDC exchange failed before QuikTrack could be reached.");
@@ -1855,7 +2261,23 @@ async function run(env2) {
       branch = result.branch;
     } catch (err) {
       hardFailure = true;
-      console.error(err instanceof Error ? err.message : String(err));
+      recordFailure(err);
+    }
+  }
+  if (hardFailure && generatedResults.length > 0) {
+    try {
+      writeFailureArtifact({
+        cwd: process.cwd(),
+        runId: env2.runId,
+        issueKey: packet?.issueKey ?? null,
+        targets: targetingResult?.outcome === "TARGETED" ? targetingResult.targets : [],
+        results: generatedResults,
+        testReport: finalTestReport,
+        failureReasons,
+        secrets: runToken ? [runToken] : []
+      });
+    } catch (err) {
+      console.warn(`::warning::Could not keep the failed run's files: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   await reportBack({
@@ -1866,7 +2288,9 @@ async function run(env2) {
     warnings,
     // Omitted when targeting itself never produced a result (nothing exists to record).
     targeting: targetingResult ? buildTargetingRecord(targetingResult, contextLog) : void 0,
-    baselineFindings
+    baselineFindings,
+    vanishedTests,
+    unresolved: failureReasons.length > 0 ? failureReasons : void 0
   });
   return { hardFailure };
 }