@smartergpt/lexrunner 1.4.0 → 1.5.1

package/dist/{chunk-WSJEPY7T.js → chunk-TIMHM7VL.js}

@@ -2100,7 +2100,7 @@ function validateGateInput(gateName, input) {
   const schema = loadGateSchema(gateName);
   if (!schema) {
     console.warn(
-      "[lex-pr] validator: missing schema for gate; validation skipped (will be required in v1.0.0)"
+      "[lexrunner] validator: missing schema for gate; validation skipped (will be required in v1.0.0)"
     );
     return;
   }
@@ -2956,10 +2956,10 @@ function prompt(question) {
     input: process.stdin,
     output: process.stdout
   });
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve5(answer.trim());
+      resolve6(answer.trim());
     });
   });
 }
@@ -3160,7 +3160,7 @@ async function terminateProcessTree(child, options = {}) {
     return { method: "taskkill", forceKilled: true, descendantsReaped: reaped };
   }
   const killGroup = options.killGroup ?? process.kill.bind(process);
-  const wait = options.wait ?? ((durationMs) => new Promise((resolve5) => setTimeout(resolve5, durationMs)));
+  const wait = options.wait ?? ((durationMs) => new Promise((resolve6) => setTimeout(resolve6, durationMs)));
   const graceMs = options.graceMs ?? 500;
   let method = "process-group";
   try {
@@ -3193,17 +3193,178 @@ function groupExists(pid, killGroup) {
   }
 }
 function runTaskkill(pid) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const killer = spawn("taskkill", ["/PID", String(pid), "/T", "/F"], {
       stdio: "ignore",
       windowsHide: true
     });
-    killer.once("error", () => resolve5(false));
-    killer.once("close", (code) => resolve5(code === 0 || code === 128));
+    killer.once("error", () => resolve6(false));
+    killer.once("close", (code) => resolve6(code === 0 || code === 128));
   });
 }
 
+// src/gates/execution-receipt.ts
+import { randomUUID } from "crypto";
+import {
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync10,
+  realpathSync,
+  renameSync as renameSync2,
+  statSync as statSync2,
+  writeFileSync as writeFileSync5
+} from "fs";
+import { basename as basename2, delimiter, dirname, extname, isAbsolute as isAbsolute2, join as join9, resolve as resolve5 } from "path";
+var GATE_EXECUTION_RECEIPT_SCHEMA_VERSION = "lexrunner-gate-execution-receipt/v1";
+var MAX_GATE_RECEIPT_OUTPUT_BYTES = 64 * 1024;
+function resolveSpawnExecutable(command, environment, workingDirectory, platform2 = process.platform) {
+  if (isAbsolute2(command) || /[\\/]/u.test(command)) {
+    return requireExecutable(resolve5(workingDirectory, command));
+  }
+  const pathValue = environmentValue(environment, "PATH", platform2) ?? "";
+  const extensions = platform2 === "win32" ? executableExtensions(command, environmentValue(environment, "PATHEXT", platform2)) : [""];
+  for (const directory of pathValue.split(delimiter).filter(Boolean)) {
+    for (const extension of extensions) {
+      const candidate = resolve5(directory, `${command}${extension}`);
+      if (isExecutableFile(candidate)) return realpathSync(candidate);
+    }
+  }
+  throw new Error(`Unable to resolve local gate shell executable '${command}'.`);
+}
+function fileIdentity(filePath) {
+  try {
+    const stats = statSync2(filePath);
+    if (!stats.isFile()) return null;
+    const realPath = realpathSync(filePath);
+    const content = readFileSync10(realPath);
+    return {
+      path: resolve5(filePath),
+      realPath,
+      bytes: content.byteLength,
+      mtimeMs: stats.mtimeMs,
+      sha256: `sha256:${sha256(content)}`
+    };
+  } catch {
+    return null;
+  }
+}
+function captureDeclaredArtifactBaselines(declaredPaths, workingDirectory) {
+  return declaredPaths.map((declaredPath) => {
+    const resolvedPath = resolve5(workingDirectory, declaredPath);
+    return { declaredPath, resolvedPath, before: fileIdentity(resolvedPath) };
+  });
+}
+function collectFreshGateArtifacts(baselines, gateArtifactDirectory) {
+  mkdirSync5(gateArtifactDirectory, { recursive: true });
+  const paths = [];
+  const usedNames = /* @__PURE__ */ new Set();
+  const identities = baselines.map((baseline, index) => {
+    const source = fileIdentity(baseline.resolvedPath);
+    if (!existsSync9(baseline.resolvedPath)) {
+      return { ...baseline, status: "missing", source: null };
+    }
+    if (!source) {
+      return { ...baseline, status: "unsupported", source: null };
+    }
+    if (baseline.before?.sha256 === source.sha256) {
+      return { ...baseline, status: "stale", source };
+    }
+    let retainedName = basename2(baseline.resolvedPath);
+    if (usedNames.has(retainedName)) retainedName = `${index + 1}-${retainedName}`;
+    usedNames.add(retainedName);
+    const retainedPath = join9(gateArtifactDirectory, retainedName);
+    try {
+      copyFileSync2(baseline.resolvedPath, retainedPath);
+      const retained = fileIdentity(retainedPath);
+      if (!retained || retained.sha256 !== source.sha256 || retained.bytes !== source.bytes) {
+        return {
+          ...baseline,
+          status: "collection_error",
+          source,
+          retainedPath,
+          error: "Retained artifact identity does not match its source."
+        };
+      }
+      paths.push(retainedPath);
+      return { ...baseline, status: "collected", source, retainedPath, retained };
+    } catch (error) {
+      return {
+        ...baseline,
+        status: "collection_error",
+        source,
+        retainedPath,
+        error: boundedError(error)
+      };
+    }
+  });
+  return {
+    paths,
+    identities,
+    complete: identities.every(({ status }) => status === "collected")
+  };
+}
+function gateOutputEvidence(value) {
+  const bytes = Buffer.isBuffer(value) ? value : Buffer.from(value, "utf8");
+  return {
+    bytes: bytes.byteLength,
+    sha256: `sha256:${sha256(bytes)}`,
+    truncated: bytes.byteLength > MAX_GATE_RECEIPT_OUTPUT_BYTES,
+    content: utf8Prefix(bytes, MAX_GATE_RECEIPT_OUTPUT_BYTES)
+  };
+}
+function writeLocalGateExecutionReceipt(artifactDirectory, receipt) {
+  mkdirSync5(artifactDirectory, { recursive: true });
+  const receiptPath = join9(
+    artifactDirectory,
+    `gate-execution-receipt.attempt-${receipt.attempt}.json`
+  );
+  const temporaryPath = join9(
+    dirname(receiptPath),
+    `.${basename2(receiptPath)}.${process.pid}.${randomUUID()}.tmp`
+  );
+  writeFileSync5(temporaryPath, canonicalJSONStringify(receipt), "utf8");
+  renameSync2(temporaryPath, receiptPath);
+  return receiptPath;
+}
+function requireExecutable(candidate) {
+  if (!isExecutableFile(candidate)) {
+    throw new Error(`Local gate shell executable does not exist at '${candidate}'.`);
+  }
+  return realpathSync(candidate);
+}
+function isExecutableFile(candidate) {
+  try {
+    return statSync2(candidate).isFile();
+  } catch {
+    return false;
+  }
+}
+function environmentValue(environment, name, platform2) {
+  if (platform2 !== "win32") return environment[name];
+  const match = Object.keys(environment).find((key) => key.toUpperCase() === name);
+  return match ? environment[match] : void 0;
+}
+function executableExtensions(command, pathExt) {
+  if (extname(command)) return [""];
+  return (pathExt || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean).map((extension) => extension.toLowerCase());
+}
+function utf8Prefix(value, maxBytes) {
+  if (value.byteLength <= maxBytes) return value.toString("utf8");
+  return value.subarray(0, maxBytes).toString("utf8");
+}
+function boundedError(error) {
+  const value = error instanceof Error ? error.message : String(error);
+  return value.length <= 1024 ? value : `${value.slice(0, 1024)}\u2026`;
+}
+
 // src/gates.ts
+function resolveLocalGateShell(command, platform2 = process.platform) {
+  return platform2 === "win32" ? {
+    command: "pwsh",
+    arguments: ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", command]
+  } : { command: "bash", arguments: ["-c", command] };
+}
 async function executeGate(gate, policy, artifactDir, timeoutMs = 3e4, itemName, skipValidation = false, repoRoot, turnCostTracker, suppressStdout = false) {
   if (!skipValidation && gate.input) {
     try {
@@ -3234,7 +3395,7 @@ async function executeGate(gate, policy, artifactDir, timeoutMs = 3e4, itemName,
           `\u23F3 Retrying gate '${gate.name}' (attempt ${attempt}/${retryConfig.maxAttempts}) after ${retryConfig.backoffSeconds}s delay...`
         );
       }
-      await new Promise((resolve5) => setTimeout(resolve5, delayMs));
+      await new Promise((resolve6) => setTimeout(resolve6, delayMs));
     }
     const result = await executeGateAttempt(gate, artifactDir, attempt, timeoutMs, repoRoot);
     lastResult = result;
@@ -3375,6 +3536,55 @@ async function executeGateAttempt(gate, artifactDir, attempt, timeoutMs, repoRoo
   }
 }
 async function executeLocalGate(gate, artifactDir, attempt, startedAt, startTime, timeoutMs, repoRoot) {
+  const workingDirectory = path9.resolve(gate.cwd || repoRoot || process.cwd());
+  const gateArtifactDirectory = path9.join(artifactDir, gate.name);
+  const environment = { ...process.env, ...gate.env };
+  const shell = resolveLocalGateShell(gate.run);
+  const artifactBaselines = captureDeclaredArtifactBaselines(
+    gate.artifacts ?? [],
+    workingDirectory
+  );
+  let shellExecutable;
+  let shellIdentityBefore = null;
+  try {
+    shellExecutable = resolveSpawnExecutable(
+      shell.command,
+      environment,
+      workingDirectory,
+      process.platform
+    );
+    shellIdentityBefore = fileIdentity(shellExecutable);
+    if (!shellIdentityBefore) throw new Error("Resolved shell is not an evidence-bindable file.");
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : String(error);
+    return finalizeLocalGateAttempt({
+      gate,
+      artifactBaselines,
+      gateArtifactDirectory,
+      workingDirectory,
+      attempt,
+      startedAt,
+      startTime,
+      shell,
+      shellExecutable: null,
+      shellIdentityBefore: null,
+      spawned: false,
+      stdout: Buffer.alloc(0),
+      stderr: Buffer.from(errorMessage, "utf8"),
+      result: {
+        gate: gate.name,
+        status: "fail",
+        exitCode: 1,
+        duration: Date.now() - startTime,
+        stdout: "",
+        stderr: errorMessage,
+        failureKind: "spawn_error",
+        artifacts: [],
+        attempts: attempt,
+        lastAttempt: startedAt
+      }
+    });
+  }
   try {
     const { getCommandValidator } = await import("./commandValidator-LVEMJTZP.js");
     const validator = getCommandValidator();
@@ -3382,34 +3592,50 @@ async function executeLocalGate(gate, artifactDir, attempt, startedAt, startTime
   } catch (validationError) {
     const duration = Date.now() - startTime;
     const errorMessage = validationError instanceof Error ? validationError.message : String(validationError);
-    return {
-      gate: gate.name,
-      status: "fail",
-      exitCode: 1,
-      duration,
-      stdout: "",
-      stderr: `Command validation failed: ${errorMessage}`,
-      artifacts: [],
-      attempts: attempt,
-      lastAttempt: startedAt
-    };
+    return finalizeLocalGateAttempt({
+      gate,
+      artifactBaselines,
+      gateArtifactDirectory,
+      workingDirectory,
+      attempt,
+      startedAt,
+      startTime,
+      shell,
+      shellExecutable,
+      shellIdentityBefore,
+      spawned: false,
+      stdout: Buffer.alloc(0),
+      stderr: Buffer.from(`Command validation failed: ${errorMessage}`, "utf8"),
+      result: {
+        gate: gate.name,
+        status: "fail",
+        exitCode: 1,
+        duration,
+        stdout: "",
+        stderr: `Command validation failed: ${errorMessage}`,
+        artifacts: [],
+        attempts: attempt,
+        lastAttempt: startedAt
+      }
+    });
   }
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     let timedOut = false;
-    const workingDirectory = gate.cwd || repoRoot || process.cwd();
-    const childProcess = spawn2("bash", ["-c", gate.run], {
+    let settled = false;
+    const childProcess = spawn2(shellExecutable, shell.arguments, {
       cwd: workingDirectory,
-      env: { ...process.env, ...gate.env },
+      env: environment,
       stdio: ["pipe", "pipe", "pipe"],
-      detached: process.platform !== "win32"
+      detached: process.platform !== "win32",
+      windowsHide: true
     });
-    let stdout = "";
-    let stderr = "";
+    const stdoutChunks = [];
+    const stderrChunks = [];
     childProcess.stdout?.on("data", (data) => {
-      stdout += data.toString();
+      stdoutChunks.push(Buffer.isBuffer(data) ? data : Buffer.from(data));
     });
     childProcess.stderr?.on("data", (data) => {
-      stderr += data.toString();
+      stderrChunks.push(Buffer.isBuffer(data) ? data : Buffer.from(data));
     });
     let timeoutCleanup;
     const timeout = setTimeout(() => {
@@ -3417,44 +3643,146 @@ async function executeLocalGate(gate, artifactDir, attempt, startedAt, startTime
       timeoutCleanup = terminateProcessTree(childProcess);
     }, timeoutMs);
     childProcess.on("close", async (exitCode) => {
+      if (settled) return;
+      settled = true;
       clearTimeout(timeout);
       const cleanup = timeoutCleanup ? await timeoutCleanup : void 0;
       const duration = Date.now() - startTime;
-      const artifacts = collectArtifacts(gate, artifactDir);
-      resolve5({
-        gate: gate.name,
-        status: exitCode === 0 && !timedOut ? "pass" : "fail",
-        exitCode: timedOut ? 124 : exitCode ?? 1,
-        duration,
-        stdout: stdout.trim(),
-        stderr: timedOut ? `GATE_TIMEOUT: exceeded ${timeoutMs}ms; descendantsReaped=${cleanup?.descendantsReaped ?? false}` : stderr.trim(),
-        failureKind: timedOut ? "timeout" : exitCode === 0 ? void 0 : "nonzero_exit",
-        ...cleanup ? { timeoutCleanup: cleanup } : {},
-        artifacts,
-        attempts: attempt,
-        lastAttempt: startedAt
-      });
+      const stdout = Buffer.concat(stdoutChunks);
+      const stderr = Buffer.concat(stderrChunks);
+      const stdoutText = stdout.toString("utf8");
+      const stderrText = stderr.toString("utf8");
+      const projectedStderr = timedOut ? `GATE_TIMEOUT: exceeded ${timeoutMs}ms; descendantsReaped=${cleanup?.descendantsReaped ?? false}` : stderrText.trim();
+      resolve6(
+        finalizeLocalGateAttempt({
+          gate,
+          artifactBaselines,
+          gateArtifactDirectory,
+          workingDirectory,
+          attempt,
+          startedAt,
+          startTime,
+          shell,
+          shellExecutable,
+          shellIdentityBefore,
+          spawned: true,
+          stdout,
+          stderr,
+          result: {
+            gate: gate.name,
+            status: exitCode === 0 && !timedOut ? "pass" : "fail",
+            exitCode: timedOut ? 124 : exitCode ?? 1,
+            duration,
+            stdout: stdoutText.trim(),
+            stderr: projectedStderr,
+            failureKind: timedOut ? "timeout" : exitCode === 0 ? void 0 : "nonzero_exit",
+            ...cleanup ? { timeoutCleanup: cleanup } : {},
+            artifacts: [],
+            attempts: attempt,
+            lastAttempt: startedAt
+          }
+        })
+      );
     });
     childProcess.on("error", (error) => {
+      if (settled) return;
+      settled = true;
       clearTimeout(timeout);
       const duration = Date.now() - startTime;
+      const stdout = Buffer.concat(stdoutChunks);
       const classified = classifyError(error, `Gate '${gate.name}' process error`);
       console.error(formatErrorForUser(classified));
-      resolve5({
-        gate: gate.name,
-        status: "fail",
-        exitCode: 1,
-        duration,
-        stdout: stdout.trim(),
-        stderr: `${classified.context}: ${error.message}`,
-        failureKind: "spawn_error",
-        artifacts: [],
-        attempts: attempt,
-        lastAttempt: startedAt
-      });
+      const projectedStderr = `${classified.context}: ${error.message}`;
+      resolve6(
+        finalizeLocalGateAttempt({
+          gate,
+          artifactBaselines,
+          gateArtifactDirectory,
+          workingDirectory,
+          attempt,
+          startedAt,
+          startTime,
+          shell,
+          shellExecutable,
+          shellIdentityBefore,
+          spawned: false,
+          stdout,
+          stderr: Buffer.from(projectedStderr, "utf8"),
+          result: {
+            gate: gate.name,
+            status: "fail",
+            exitCode: 1,
+            duration,
+            stdout: stdout.toString("utf8").trim(),
+            stderr: projectedStderr,
+            failureKind: "spawn_error",
+            artifacts: [],
+            attempts: attempt,
+            lastAttempt: startedAt
+          }
+        })
+      );
     });
   });
 }
+function finalizeLocalGateAttempt(input) {
+  const collected = collectFreshGateArtifacts(input.artifactBaselines, input.gateArtifactDirectory);
+  const shellIdentityAfter = input.shellExecutable ? fileIdentity(input.shellExecutable) : null;
+  const shellUnchanged = input.shellIdentityBefore !== null && shellIdentityAfter !== null && input.shellIdentityBefore.sha256 === shellIdentityAfter.sha256 && input.shellIdentityBefore.bytes === shellIdentityAfter.bytes;
+  const evidenceComplete = collected.complete && (!input.spawned || input.shellIdentityBefore !== null && shellUnchanged);
+  const result = { ...input.result };
+  if (result.status === "pass" && !evidenceComplete) {
+    result.status = "fail";
+    result.exitCode = 1;
+    result.failureKind = "evidence_error";
+    result.stderr = [
+      result.stderr,
+      "GATE_EVIDENCE_INVALID: declared output or shell identity failed"
+    ].filter(Boolean).join("\n");
+  }
+  const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const duration = Date.now() - input.startTime;
+  result.duration = duration;
+  const receiptPath = writeLocalGateExecutionReceipt(input.gateArtifactDirectory, {
+    schemaVersion: GATE_EXECUTION_RECEIPT_SCHEMA_VERSION,
+    attempt: input.attempt,
+    declaredGate: {
+      name: input.gate.name,
+      run: input.gate.run,
+      cwd: input.gate.cwd ?? null,
+      runtime: input.gate.runtime,
+      artifacts: [...input.gate.artifacts ?? []]
+    },
+    execution: {
+      cwd: input.workingDirectory,
+      startedAt: input.startedAt,
+      finishedAt,
+      durationMs: duration,
+      shell: {
+        command: input.shell.command,
+        executable: input.shellIdentityBefore,
+        argv: [...input.shell.arguments],
+        identityAfter: shellIdentityAfter,
+        unchanged: shellUnchanged,
+        spawned: input.spawned
+      }
+    },
+    outcome: {
+      status: result.status,
+      exitCode: result.exitCode ?? null,
+      failureKind: result.failureKind ?? null,
+      timeoutCleanup: result.timeoutCleanup ?? null,
+      evidenceComplete
+    },
+    output: {
+      stdout: gateOutputEvidence(input.stdout),
+      stderr: gateOutputEvidence(input.stderr)
+    },
+    artifacts: collected.identities
+  });
+  result.artifacts = [...collected.paths, receiptPath];
+  return result;
+}
 async function executeContainerGate(gate, artifactDir, attempt, startedAt, startTime, timeoutMs, repoRoot) {
   console.warn(
     `\u26A0\uFE0F  Container runtime for gate '${gate.name}' not yet implemented, falling back to local execution`
@@ -3476,28 +3804,6 @@ async function executeCiServiceGate(gate, artifactDir, attempt, startedAt, start
     lastAttempt: startedAt
   };
 }
-function collectArtifacts(gate, artifactDir) {
-  if (!gate.artifacts || gate.artifacts.length === 0) {
-    return [];
-  }
-  const collected = [];
-  const gateArtifactDir = path9.join(artifactDir, gate.name);
-  if (!fs9.existsSync(gateArtifactDir)) {
-    fs9.mkdirSync(gateArtifactDir, { recursive: true });
-  }
-  for (const artifactPath of gate.artifacts) {
-    try {
-      if (fs9.existsSync(artifactPath)) {
-        const destPath = path9.join(gateArtifactDir, path9.basename(artifactPath));
-        fs9.copyFileSync(artifactPath, destPath);
-        collected.push(destPath);
-      }
-    } catch (error) {
-      console.warn(`Failed to collect artifact ${artifactPath}:`, error);
-    }
-  }
-  return collected;
-}
 function checkVulnGate(artifactDir, policy) {
   const startTime = Date.now();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -3823,13 +4129,13 @@ async function executeGatesWithPolicy(plan, executionState, artifactDir, timeout
     if (promises.length > 0) {
       await Promise.race(promises);
     } else if (executing.size > 0) {
-      await new Promise((resolve5) => setTimeout(resolve5, 50));
+      await new Promise((resolve6) => setTimeout(resolve6, 50));
     } else {
       break;
     }
   }
   while (executing.size > 0) {
-    await new Promise((resolve5) => setTimeout(resolve5, 50));
+    await new Promise((resolve6) => setTimeout(resolve6, 50));
   }
 }
 function buildExecutionOrder(plan) {
@@ -4642,8 +4948,8 @@ var FileAnalyzer = class {
    * Extract module name from test file
    */
   getTestedModule(testFilename) {
-    const basename2 = testFilename.split("/").pop() || "";
-    return basename2.replace(/\.(test|spec)\.(ts|js|tsx|jsx)$/, "");
+    const basename3 = testFilename.split("/").pop() || "";
+    return basename3.replace(/\.(test|spec)\.(ts|js|tsx|jsx)$/, "");
   }
   /**
    * Perform complete file analysis on a set of PRs