@ricsam/r5d-worker 0.0.136 → 0.0.138

package/dist/mjs/control-command-policy.mjs

@@ -1,146 +0,0 @@
-const CONTROL_COMMAND_PROGRAM = "r5dctl";
-const CONTROL_COMMAND_RUNTIME_MS = 12e4;
-const CONTROL_COMMAND_MAX_ARGV = 64;
-const CONTROL_COMMAND_MAX_LENGTH = 4096;
-const CONTROL_GLOBAL_FLAGS_WITH_VALUE = /* @__PURE__ */ new Set(["-p", "--project", "-s", "--session", "-b", "--branch"]);
-const CONTROL_GLOBAL_FLAGS = /* @__PURE__ */ new Set(["--json", "-h", "--help", "-v", "--version"]);
-const REFUSED_ANYWHERE = /* @__PURE__ */ new Set(["-f", "--follow", "--watch", "--base-url", "--config", "--token", "--api-key"]);
-const CONTROL_VERBS = {
-  session: /* @__PURE__ */ new Set(["status", "stop", "prompt", "claim", "claims", "process-log"]),
-  sessions: /* @__PURE__ */ new Set(["recent"]),
-  describe: /* @__PURE__ */ new Set(["project", "branch", "session", "branch-operation", "branch-deletion"]),
-  get: /* @__PURE__ */ new Set(["projects", "branches", "sessions", "envs", "env"]),
-  conversation: /* @__PURE__ */ new Set(["overview", "inspect-node", "inspect-work"]),
-  ps: /* @__PURE__ */ new Set(["list", "history", "inspect", "stop"]),
-  workspace: /* @__PURE__ */ new Set(["status"]),
-  auth: /* @__PURE__ */ new Set(["status"]),
-  create: /* @__PURE__ */ new Set(["session"]),
-  update: /* @__PURE__ */ new Set(["session"]),
-  delete: /* @__PURE__ */ new Set(["session"]),
-  "answer-questions": null,
-  "answer-env-request": null
-};
-const CODE_LOADING_ENV_PATTERN = /^(NODE_OPTIONS|NODE_PATH|NODE_REPL_EXTERNAL_MODULE|BUN_OPTIONS|BUN_CONFIG_[A-Z_]+|LD_PRELOAD|LD_LIBRARY_PATH|LD_AUDIT|DYLD_[A-Z_]+|PATH|PATHEXT|PYTHONPATH|PERL5OPT|RUBYOPT|SHELL|ENV|BASH_ENV)$/i;
-const BARE_WORD = /^[A-Za-z0-9_@%+=:,./-]+$/;
-const DOUBLE_QUOTED_FORBIDDEN = /[$`\\!]/;
-function tokenizePlainInvocation(command) {
-  if (command.length > CONTROL_COMMAND_MAX_LENGTH) return { reason: "command is longer than the control lane allows" };
-  if (/[\r\n]/.test(command)) return { reason: "multi-line commands are shell scripts" };
-  const argv = [];
-  let index = 0;
-  while (index < command.length) {
-    const char = command[index];
-    if (char === " " || char === "	") {
-      index += 1;
-      continue;
-    }
-    let word = "";
-    let quotedParts = 0;
-    let bareParts = 0;
-    while (index < command.length && command[index] !== " " && command[index] !== "	") {
-      const current = command[index];
-      if (current === "'") {
-        const end = command.indexOf("'", index + 1);
-        if (end < 0) return { reason: "unterminated single quote" };
-        word += command.slice(index + 1, end);
-        quotedParts += 1;
-        index = end + 1;
-        continue;
-      }
-      if (current === '"') {
-        const end = command.indexOf('"', index + 1);
-        if (end < 0) return { reason: "unterminated double quote" };
-        const inner = command.slice(index + 1, end);
-        if (DOUBLE_QUOTED_FORBIDDEN.test(inner)) return { reason: "double-quoted text would be expanded by the shell" };
-        word += inner;
-        quotedParts += 1;
-        index = end + 1;
-        continue;
-      }
-      let bare = "";
-      while (index < command.length && !/[\s'"]/.test(command[index])) {
-        bare += command[index];
-        index += 1;
-      }
-      if (!BARE_WORD.test(bare)) return { reason: `shell syntax in "${bare}" is not part of a plain invocation` };
-      word += bare;
-      bareParts += 1;
-    }
-    if (quotedParts + bareParts > 1) return { reason: "adjacent quoted and bare text is shell concatenation" };
-    argv.push(word);
-    if (argv.length > CONTROL_COMMAND_MAX_ARGV) return { reason: "too many arguments for a control command" };
-  }
-  if (argv.length === 0) return { reason: "empty command" };
-  return { argv };
-}
-function assertControlCommandArgv(argv) {
-  if (argv.length === 0 || argv.length > CONTROL_COMMAND_MAX_ARGV) throw new Error("Control commands are a single r5dctl invocation");
-  if (argv[0] !== CONTROL_COMMAND_PROGRAM) throw new Error(`Control commands must start with ${CONTROL_COMMAND_PROGRAM}`);
-  if (argv.reduce((length, argument) => length + (typeof argument === "string" ? argument.length : 0) + 1, 0) > CONTROL_COMMAND_MAX_LENGTH)
-    throw new Error("Control command arguments exceed the length limit");
-  for (const argument of argv) {
-    if (typeof argument !== "string" || argument.includes("\0") || /[\r\n]/.test(argument)) throw new Error("Control command arguments must be plain text");
-    if (REFUSED_ANYWHERE.has(argument.split("=", 1)[0])) throw new Error(`Control command option is not allowed (${argument.split("=", 1)[0]})`);
-    if (argument === "--") throw new Error("Control commands cannot use `--`");
-  }
-  let position = 1;
-  while (position < argv.length) {
-    const argument = argv[position];
-    if (CONTROL_GLOBAL_FLAGS.has(argument)) {
-      position += 1;
-      continue;
-    }
-    if (CONTROL_GLOBAL_FLAGS_WITH_VALUE.has(argument)) {
-      if (position + 1 >= argv.length) throw new Error(`Missing value for ${argument}`);
-      position += 2;
-      continue;
-    }
-    if (argument.startsWith("-")) throw new Error(`Global flag ${argument} is not allowed in a control command`);
-    break;
-  }
-  const verb = argv[position];
-  if (verb === void 0) throw new Error("Control commands need a coordination verb (for example `r5dctl ps list`)");
-  const allowed = Object.hasOwn(CONTROL_VERBS, verb) ? CONTROL_VERBS[verb] : void 0;
-  if (allowed === void 0) throw new Error(`r5dctl ${verb} is not a coordination command`);
-  if (allowed === null) return;
-  const subject = argv[position + 1];
-  if (subject === void 0 || !allowed.has(subject)) {
-    throw new Error(`r5dctl ${verb}${subject ? ` ${subject}` : ""} is not a coordination command`);
-  }
-}
-function resolveControlCommandExecutable(trustedPath, which, program = CONTROL_COMMAND_PROGRAM) {
-  const resolved = trustedPath ? which(program, { PATH: trustedPath }) : null;
-  if (!resolved) throw new Error(`${program} is not installed on the worker's trusted PATH; control commands are unavailable until it is`);
-  return resolved;
-}
-function controlCommandEnvironment(environment, trustedPath) {
-  const result = {};
-  for (const [key, value] of Object.entries(environment)) {
-    if (value === void 0 || CODE_LOADING_ENV_PATTERN.test(key)) continue;
-    result[key] = value;
-  }
-  if (trustedPath !== void 0) result.PATH = trustedPath;
-  return result;
-}
-function classifyControlCommand(command) {
-  const tokenized = tokenizePlainInvocation(command.trim());
-  if ("reason" in tokenized) return { control: false, reason: tokenized.reason };
-  const { argv } = tokenized;
-  if (argv[0] !== CONTROL_COMMAND_PROGRAM) return { control: false, reason: "not an r5dctl invocation" };
-  try {
-    assertControlCommandArgv(argv);
-  } catch (error) {
-    return { control: false, reason: error instanceof Error ? error.message : String(error) };
-  }
-  return { control: true, argv };
-}
-export {
-  CONTROL_COMMAND_MAX_ARGV,
-  CONTROL_COMMAND_MAX_LENGTH,
-  CONTROL_COMMAND_PROGRAM,
-  CONTROL_COMMAND_RUNTIME_MS,
-  assertControlCommandArgv,
-  classifyControlCommand,
-  controlCommandEnvironment,
-  resolveControlCommandExecutable
-};

package/dist/mjs/git-blob-hash.mjs

@@ -1,16 +0,0 @@
-import { createHash } from "node:crypto";
-function gitObjectHashAlgorithmFor(objectId) {
-  if (/^[0-9a-f]{40}$/u.test(objectId)) return "sha1";
-  if (/^[0-9a-f]{64}$/u.test(objectId)) return "sha256";
-  return null;
-}
-function gitBlobHash(content, algorithm) {
-  const hash = createHash(algorithm);
-  hash.update(`blob ${content.length}\0`);
-  hash.update(content);
-  return hash.digest("hex");
-}
-export {
-  gitBlobHash,
-  gitObjectHashAlgorithmFor
-};

package/dist/mjs/git-identity.mjs

@@ -1,15 +0,0 @@
-function configureVisibleGitIdentity(branchPath, identity, runGit) {
-  if (!identity) {
-    return;
-  }
-  const name = identity.name.trim();
-  const email = identity.email.trim();
-  if (!name || !email) {
-    throw new Error("Git identity must include name and email");
-  }
-  runGit(["config", "user.name", name], { cwd: branchPath });
-  runGit(["config", "user.email", email], { cwd: branchPath });
-}
-export {
-  configureVisibleGitIdentity
-};

package/dist/mjs/git-process-environment.mjs

@@ -1,105 +0,0 @@
-import { devNull } from "node:os";
-const ALLOWED_GIT_ENVIRONMENT_KEYS = [
-  "PATH",
-  "USER",
-  "LOGNAME",
-  "SHELL",
-  "TMPDIR",
-  "TMP",
-  "TEMP",
-  "TZ",
-  "LANG",
-  "LANGUAGE",
-  "LC_ALL",
-  "LC_CTYPE",
-  "LC_COLLATE",
-  "LC_MESSAGES",
-  "LC_MONETARY",
-  "LC_NUMERIC",
-  "LC_TIME",
-  "LC_ADDRESS",
-  "LC_IDENTIFICATION",
-  "LC_MEASUREMENT",
-  "LC_NAME",
-  "LC_PAPER",
-  "LC_TELEPHONE",
-  "SystemRoot",
-  "SYSTEMROOT",
-  "WINDIR",
-  "COMSPEC",
-  "PATHEXT",
-  "SSL_CERT_FILE",
-  "SSL_CERT_DIR",
-  "CURL_CA_BUNDLE",
-  "GIT_SSL_CAINFO",
-  "GIT_SSL_CAPATH",
-  "GIT_EXEC_PATH",
-  "GIT_OPTIONAL_LOCKS"
-];
-function workerGitProcessEnvironment(source = process.env) {
-  const environment = {
-    GIT_TERMINAL_PROMPT: "0",
-    GIT_CONFIG_GLOBAL: devNull,
-    GIT_CONFIG_NOSYSTEM: "1",
-    GIT_ATTR_NOSYSTEM: "1"
-  };
-  for (const key of ALLOWED_GIT_ENVIRONMENT_KEYS) {
-    if (source[key] !== void 0) environment[key] = source[key];
-  }
-  return environment;
-}
-function gitHttpAuthorizationClearArgs(remoteUrl) {
-  let remote;
-  try {
-    remote = new URL(remoteUrl);
-  } catch {
-    return ["-c", "http.extraHeader="];
-  }
-  if ((remote.protocol === "https:" || remote.protocol === "http:") && (remote.username || remote.password)) {
-    throw new Error("Git credentials must not be embedded in a remote URL");
-  }
-  if (remote.protocol !== "https:" && remote.protocol !== "http:") return ["-c", "http.extraHeader="];
-  remote.hash = "";
-  remote.search = "";
-  return ["-c", "http.extraHeader=", "-c", `http.${remote.origin}/.extraHeader=`, "-c", `http.${remote.href}.extraHeader=`];
-}
-function gitCredentialHelperConfigArgs(credentialHelper) {
-  return [
-    "-c",
-    "credential.helper=",
-    ...credentialHelper ? ["-c", `credential.helper=${credentialHelper}`] : [],
-    "-c",
-    "credential.useHttpPath=false"
-  ];
-}
-function gitCredentialUsernameConfigKey(remoteUrl) {
-  const remote = new URL(remoteUrl);
-  if ((remote.protocol === "https:" || remote.protocol === "http:") && (remote.username || remote.password)) {
-    throw new Error("Git credentials must not be embedded in a remote URL");
-  }
-  if (remote.protocol !== "https:" && remote.protocol !== "http:") {
-    throw new Error("Git credential usernames require an HTTP remote URL");
-  }
-  remote.hash = "";
-  remote.search = "";
-  return `credential.${remote.href}.username`;
-}
-function gitCredentialUsernameConfigArgs(remoteUrl, credentialUsername) {
-  if (!credentialUsername) return [];
-  if (/[\0\r\n]/.test(credentialUsername)) throw new Error("Invalid Git credential username");
-  return ["-c", `${gitCredentialUsernameConfigKey(remoteUrl)}=${credentialUsername}`];
-}
-function gitTransportSecurityArgs(remoteUrl, credentialHelper, credentialUsername) {
-  return [
-    ...gitHttpAuthorizationClearArgs(remoteUrl),
-    ...gitCredentialHelperConfigArgs(credentialHelper),
-    ...gitCredentialUsernameConfigArgs(remoteUrl, credentialUsername)
-  ];
-}
-export {
-  gitCredentialHelperConfigArgs,
-  gitCredentialUsernameConfigKey,
-  gitHttpAuthorizationClearArgs,
-  gitTransportSecurityArgs,
-  workerGitProcessEnvironment
-};

package/dist/mjs/inline-output.mjs

@@ -1,37 +0,0 @@
-const WORKER_INLINE_OUTPUT_MAX_BYTES = 8 * 1024 * 1024;
-async function collectWorkerInlineOutput(stream, maxBytes = WORKER_INLINE_OUTPUT_MAX_BYTES, signal) {
-  if (!stream) return "";
-  signal?.throwIfAborted();
-  const reader = stream.getReader();
-  const abort = () => {
-    void reader.cancel().catch(() => {
-    });
-  };
-  signal?.addEventListener("abort", abort, { once: true });
-  const decoder = new TextDecoder();
-  const parts = [];
-  let bytes = 0;
-  try {
-    while (true) {
-      const next = await reader.read();
-      signal?.throwIfAborted();
-      if (next.done) break;
-      bytes += next.value.byteLength;
-      if (bytes > maxBytes) {
-        void reader.cancel().catch(() => {
-        });
-        throw new Error(`Inline command output exceeded ${maxBytes} bytes. Use streaming execution for large output.`);
-      }
-      parts.push(decoder.decode(next.value, { stream: true }));
-    }
-    parts.push(decoder.decode());
-    return parts.join("");
-  } finally {
-    signal?.removeEventListener("abort", abort);
-    reader.releaseLock();
-  }
-}
-export {
-  WORKER_INLINE_OUTPUT_MAX_BYTES,
-  collectWorkerInlineOutput
-};

package/dist/mjs/managed-paths.mjs

@@ -1,174 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-const BRANCH_NAME_MAX_LENGTH = 45;
-const BRANCH_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*(?:\/[a-z0-9]+(?:-[a-z0-9]+)*)*$/;
-const PROJECT_SEGMENT_PATTERN = /^[a-z0-9._-]+$/;
-const WINDOWS_RESERVED_PATH_SEGMENT = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?$/i;
-const INTERNAL_PROJECT_PATH_SEGMENTS = /* @__PURE__ */ new Set([".r5d-retired-checkouts"]);
-function lstatIfExists(targetPath) {
-  try {
-    return fs.lstatSync(targetPath);
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-function fsyncDirectory(directoryPath) {
-  const descriptor = fs.openSync(directoryPath, "r");
-  try {
-    fs.fsyncSync(descriptor);
-  } finally {
-    fs.closeSync(descriptor);
-  }
-}
-function fsyncCreatedDirectoryChain(directoryPath, preexistingAncestorPath) {
-  let current = path.resolve(directoryPath);
-  const ancestor = path.resolve(preexistingAncestorPath);
-  const relative = path.relative(ancestor, current);
-  if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
-    throw new Error(`Managed root escaped its durability ancestor: ${current}`);
-  }
-  while (true) {
-    fsyncDirectory(current);
-    if (current === ancestor) return;
-    current = path.dirname(current);
-  }
-}
-function canonicalizeManagedRoot(root) {
-  const resolvedRoot = path.resolve(root.rootPath);
-  let preexistingAncestor = resolvedRoot;
-  while (!lstatIfExists(preexistingAncestor)) {
-    const parent = path.dirname(preexistingAncestor);
-    if (parent === preexistingAncestor) {
-      throw new Error(`Could not find an existing ancestor for ${root.label} (${resolvedRoot})`);
-    }
-    preexistingAncestor = parent;
-  }
-  let canonicalPreexistingAncestor;
-  try {
-    canonicalPreexistingAncestor = fs.realpathSync(preexistingAncestor);
-    if (!fs.statSync(canonicalPreexistingAncestor).isDirectory()) {
-      throw new Error("the nearest existing ancestor is not a directory");
-    }
-  } catch (error) {
-    throw new Error(`Could not validate the existing ancestor of ${root.label} (${resolvedRoot})`, { cause: error });
-  }
-  try {
-    fs.mkdirSync(resolvedRoot, { recursive: true });
-  } catch (error) {
-    throw new Error(`Could not prepare ${root.label} (${resolvedRoot}) for overlap validation`, { cause: error });
-  }
-  const rootStats = fs.statSync(resolvedRoot, { bigint: true });
-  if (!rootStats.isDirectory()) {
-    throw new Error(`Managed root is not a directory: ${root.label} (${resolvedRoot})`);
-  }
-  const canonicalRoot = fs.realpathSync(resolvedRoot);
-  fsyncCreatedDirectoryChain(canonicalRoot, canonicalPreexistingAncestor);
-  return {
-    ...root,
-    rootPath: canonicalRoot,
-    identity: { device: rootStats.dev, inode: rootStats.ino }
-  };
-}
-function pathContains(root, candidate) {
-  const relative = path.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative);
-}
-function identitiesMatch(left, right) {
-  return left.device === right.device && left.inode === right.inode;
-}
-function pathOrFilesystemContains(root, candidate) {
-  if (pathContains(root.rootPath, candidate.rootPath) || identitiesMatch(root.identity, candidate.identity)) {
-    return true;
-  }
-  let ancestor = path.dirname(candidate.rootPath);
-  while (true) {
-    const stats = fs.statSync(ancestor, { bigint: true });
-    if (identitiesMatch(root.identity, { device: stats.dev, inode: stats.ino })) return true;
-    const parent = path.dirname(ancestor);
-    if (parent === ancestor) return false;
-    ancestor = parent;
-  }
-}
-function assertDisjointManagedRoots(roots) {
-  const canonical = roots.map(canonicalizeManagedRoot);
-  for (let leftIndex = 0; leftIndex < canonical.length; leftIndex += 1) {
-    const left = canonical[leftIndex];
-    for (let rightIndex = leftIndex + 1; rightIndex < canonical.length; rightIndex += 1) {
-      const right = canonical[rightIndex];
-      if (pathOrFilesystemContains(left, right) || pathOrFilesystemContains(right, left)) {
-        throw new Error(`Managed roots overlap: ${left.label} (${left.rootPath}) and ${right.label} (${right.rootPath}) must be disjoint`);
-      }
-    }
-  }
-}
-function validateManagedBranchName(branchName) {
-  if (typeof branchName !== "string" || branchName.length === 0) {
-    throw new Error("Branch name is required");
-  }
-  if (branchName.length > BRANCH_NAME_MAX_LENGTH) {
-    throw new Error(`Branch name must be ${BRANCH_NAME_MAX_LENGTH} characters or fewer`);
-  }
-  if (!BRANCH_NAME_PATTERN.test(branchName)) {
-    throw new Error(`Invalid branch name from server: ${branchName}`);
-  }
-  const reserved = branchName.split("/").find((segment) => WINDOWS_RESERVED_PATH_SEGMENT.test(segment));
-  if (reserved) {
-    throw new Error(`Invalid branch name from server: reserved path segment '${reserved}'`);
-  }
-}
-function validateCheckoutPathSegments(value) {
-  if (!Array.isArray(value) || value.length !== 2) {
-    throw new Error("Invalid checkout path from server: expected namespace and project segments");
-  }
-  const segments = value;
-  for (const segment of segments) {
-    if (typeof segment !== "string" || !PROJECT_SEGMENT_PATTERN.test(segment) || segment !== segment.toLowerCase() || segment === "." || segment === ".." || segment === ".git" || INTERNAL_PROJECT_PATH_SEGMENTS.has(segment) || segment.endsWith(".") || WINDOWS_RESERVED_PATH_SEGMENT.test(segment)) {
-      throw new Error(`Invalid checkout path segment from server: ${String(segment)}`);
-    }
-  }
-  return [segments[0], segments[1]];
-}
-function assertPathInside(root, candidate, label) {
-  const resolvedRoot = path.resolve(root);
-  const resolvedCandidate = path.resolve(candidate);
-  const relative = path.relative(resolvedRoot, resolvedCandidate);
-  if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
-    throw new Error(`${label} escapes its managed root: ${candidate}`);
-  }
-}
-function assertNoSymlinkComponents(root, candidate) {
-  assertPathInside(root, candidate, "Checkout path");
-  const relative = path.relative(path.resolve(root), path.resolve(candidate));
-  let current = path.resolve(root);
-  for (const component of relative.split(path.sep).filter(Boolean)) {
-    current = path.join(current, component);
-    if (!fs.existsSync(current)) break;
-    if (fs.lstatSync(current).isSymbolicLink()) {
-      throw new Error(`Checkout path contains a symbolic link: ${current}`);
-    }
-  }
-}
-function managedProjectRoot(projectsRoot, checkoutPathSegments) {
-  const segments = validateCheckoutPathSegments(checkoutPathSegments);
-  const result = path.join(projectsRoot, ...segments);
-  assertNoSymlinkComponents(projectsRoot, result);
-  return result;
-}
-function managedBranchPath(projectsRoot, checkoutPathSegments, branchName) {
-  validateManagedBranchName(branchName);
-  const projectRoot = managedProjectRoot(projectsRoot, checkoutPathSegments);
-  const result = path.join(projectRoot, ...branchName.split("/"));
-  assertNoSymlinkComponents(projectRoot, result);
-  return result;
-}
-export {
-  BRANCH_NAME_MAX_LENGTH,
-  BRANCH_NAME_PATTERN,
-  assertDisjointManagedRoots,
-  assertPathInside,
-  managedBranchPath,
-  managedProjectRoot,
-  validateCheckoutPathSegments,
-  validateManagedBranchName
-};

package/dist/mjs/plan-lint.mjs

@@ -1,129 +0,0 @@
-import fs from "node:fs/promises";
-import path from "node:path";
-import picomatch from "picomatch";
-import { getTasksSectionRange, PLAN_TASK_LINE_REGEX } from "./plan-parser.mjs";
-import { PLAN_EXTENSION } from "./plan-paths.mjs";
-import { PLAN_TASK_ID_REGEX } from "./plan-parser.mjs";
-const LEGACY_SCHEMA_FIELD_REGEX = /^\s*(type|status|parent|phase|discovered_problem)\s*:/m;
-function lintPlanContent(planId, content) {
-  const errors = [];
-  const lines = content.split(/\r?\n/);
-  if (/^---(?:\r?\n|$)/.test(content)) {
-    errors.push({
-      planId,
-      severity: "error",
-      message: "YAML frontmatter is not supported. Use plain Markdown with a ## Tasks checklist.",
-      line: 1
-    });
-  }
-  if (LEGACY_SCHEMA_FIELD_REGEX.test(content)) {
-    errors.push({
-      planId,
-      severity: "error",
-      message: "Legacy plan schema fields are not supported. Remove type/status/parent/phase/discovered_problem metadata."
-    });
-  }
-  const titleLineIndex = lines.findIndex((line) => /^# .+\S\s*$/.test(line));
-  if (titleLineIndex === -1) {
-    errors.push({
-      planId,
-      severity: "error",
-      message: "Plan must start with or contain an H1 title, for example '# Implementation Plan'."
-    });
-  }
-  const range = getTasksSectionRange(content);
-  if (!range) {
-    errors.push({
-      planId,
-      severity: "error",
-      message: "Plan is missing a ## Tasks section."
-    });
-    return errors;
-  }
-  const taskIds = /* @__PURE__ */ new Set();
-  let taskCount = 0;
-  for (let index = range.startIndex + 1; index < range.endIndex; index += 1) {
-    const line = lines[index] ?? "";
-    if (line.trim() === "") continue;
-    const match = line.match(PLAN_TASK_LINE_REGEX);
-    if (!match || !match[3].trim()) {
-      errors.push({
-        planId,
-        severity: "error",
-        line: index + 1,
-        message: 'Malformed task line. Use "- [ ] task-id: Description" or "- [x] task-id: Description".'
-      });
-      continue;
-    }
-    taskCount += 1;
-    const taskId = match[2];
-    if (taskIds.has(taskId)) {
-      errors.push({
-        planId,
-        severity: "error",
-        line: index + 1,
-        message: `Duplicate task id "${taskId}".`
-      });
-    }
-    taskIds.add(taskId);
-  }
-  if (taskCount === 0) {
-    errors.push({
-      planId,
-      severity: "error",
-      message: "Plan must include at least one task in the ## Tasks section.",
-      line: range.startIndex + 1
-    });
-  }
-  return errors;
-}
-async function lintPlans(plansDir, glob) {
-  const errors = [];
-  let entries;
-  try {
-    entries = await fs.readdir(plansDir, { withFileTypes: true });
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-    entries = [];
-  }
-  const matches = glob ? picomatch(glob) : null;
-  let lintedPlanCount = 0;
-  for (const entry of entries) {
-    if (!entry.isFile() || !entry.name.endsWith(PLAN_EXTENSION)) continue;
-    const planId = entry.name.slice(0, -PLAN_EXTENSION.length);
-    if (!PLAN_TASK_ID_REGEX.test(planId) || matches && !matches(entry.name) && !matches(planId)) continue;
-    const content = await fs.readFile(path.join(plansDir, entry.name), "utf8");
-    lintedPlanCount += 1;
-    errors.push(...lintPlanContent(planId, content));
-  }
-  return {
-    type: "plan_lint",
-    errors,
-    errorCount: errors.filter((error) => error.severity === "error").length,
-    warningCount: errors.filter((error) => error.severity === "warning").length,
-    lintedPlanCount
-  };
-}
-function formatPlanLintErrors(errors) {
-  if (errors.length === 0) return "";
-  const lines = ["## Plan Lint Errors", ""];
-  const byPlan = /* @__PURE__ */ new Map();
-  for (const error of errors) {
-    byPlan.set(error.planId, [...byPlan.get(error.planId) ?? [], error]);
-  }
-  for (const [planId, planErrors] of byPlan) {
-    lines.push(`### ${planId}.plan.md`);
-    for (const error of planErrors) {
-      const location = error.line ? ` line ${error.line}` : "";
-      lines.push(`- ${error.severity.toUpperCase()}${location}: ${error.message}`);
-    }
-    lines.push("");
-  }
-  lines.push("Fix these issues by editing the Markdown plan file.");
-  return lines.join("\n");
-}
-export {
-  formatPlanLintErrors,
-  lintPlanContent,
-  lintPlans
-};