@stigmer/runner 3.0.9-dev.20260615153829 → 3.1.0

package/dist/shared/filereview/git-substrate.js

@@ -0,0 +1,439 @@
+/**
+ * Git snapshot/restore substrate for the apply-then-review HITL "capture mode".
+ *
+ * THE MODEL
+ * ---------
+ * Edits are applied to the working tree and reviewed AFTER the fact; rejecting a
+ * file snaps it back exactly. We use git as a NO-COMMIT snapshot/restore
+ * substrate at the turn boundary:
+ *
+ *  1. snapshotBaseline() at turn start — record the exact pre-turn working tree
+ *     and pin it behind a ref so it survives a multi-day approval wait.
+ *  2. The agent edits files freely (the gate allows git-tracked write/edit/delete).
+ *  3. captureChangeSet() at turn end — diff the post-turn tree against the
+ *     baseline into a per-file change set, and pin the post-turn ("after") tree
+ *     behind a ref. The working tree is LEFT in its "after" state: the user
+ *     reviews the real, applied change and the workspace browser shows it.
+ *  4. On resume, reconcile the working tree to the per-file decisions, sourced
+ *     ENTIRELY from the two pinned refs (not the live tree, not the persisted
+ *     bodies — the refs are the single source of truth):
+ *       - approved           -> applyApprovedPaths() ensures the "after" bytes.
+ *       - rejected/undecided -> restoreToBaseline() snaps the file back to its
+ *         exact pre-turn bytes.
+ *     This is symmetric and idempotent: it converges to the correct end state
+ *     regardless of the tree's current contents, so a Temporal retry or a tree
+ *     reset is harmless.
+ *  5. dropCaptureRefs() releases the pinned objects.
+ *
+ * HARNESS-AGNOSTIC
+ * ----------------
+ * This is pure git plumbing keyed by `executionId`. It carries no Cursor- or
+ * deep-agent-specific knowledge: the runner-owned files a harness writes into the
+ * workspace (e.g. the Cursor gate's `.cursor/hooks.json`) are passed in as
+ * `excludePaths` so they never pollute the captured diff, rather than being
+ * hard-coded here. Both harnesses author IDENTICAL ledger entries through the
+ * shared producer (events.ts) on top of this substrate. A future CAS substrate
+ * (for ignored / non-git paths) sits beside this module.
+ *
+ * NOTHING IS PERMANENT UNTIL APPROVAL
+ * -----------------------------------
+ * Edits are visible during review, but nothing is committed and the next turn is
+ * blocked until the user decides; a reject snaps the file back byte-for-byte from
+ * the baseline ref. Shell/MCP and gitignored writes/deletes are NOT reversible by
+ * this substrate, so they stay on the approve-before-run gate (see each harness's
+ * gate: the Cursor hook and the deep-agent approval-gate middleware).
+ *
+ * WHY GIT, NO COMMITS
+ * -------------------
+ * Git is used ONLY as an exact, reversible capture/restore mechanism. We never
+ * move HEAD, never touch a branch, never push. Approved work stays uncommitted;
+ * a harness's own writeback path (if any) commits the reconciled tree afterwards.
+ *
+ * HARD INVARIANTS
+ * ---------------
+ * - NEVER `git clean -x`/`-a` or `git stash -a`: the git-excluded `.stigmer/`
+ *   directory holds SDK resume state and MUST survive. `git clean -fd` (no `-x`)
+ *   leaves ignored paths alone, so `.stigmer`/`lost+found` are safe.
+ * - Runner-owned files written into the workspace are EXCLUDED (via `excludePaths`)
+ *   from both the baseline and the after tree, so they never pollute the captured
+ *   diff regardless of gate-teardown ordering.
+ * - All staging uses a TEMP index (GIT_INDEX_FILE) so the repo's real index is
+ *   never disturbed.
+ */
+import { execFile } from "node:child_process";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { promisify } from "node:util";
+import { FileChangeType } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { bytesLookBinary } from "../file-change.js";
+import { sha256Bytes } from "./digest.js";
+const execFileAsync = promisify(execFile);
+/** Build `:(exclude)` pathspecs for the runner-owned files a harness passes in. */
+function excludePathspecs(excludePaths) {
+    return excludePaths.map((p) => `:(exclude)${p}`);
+}
+/**
+ * Refs that pin the per-execution baseline and after trees against GC. Exported
+ * so the file-review producer can stamp them onto the ledger's SnapshotRef
+ * (GitTreeRef.ref) without re-deriving the format. Keyed by executionId only:
+ * the unified gate guarantees at most one un-reconciled change set per execution
+ * at a time, and the reconcile drops these refs before the next turn re-pins.
+ */
+export function baselineRef(executionId) {
+    return `refs/stigmer/baseline/${executionId}`;
+}
+export function captureRef(executionId) {
+    return `refs/stigmer/capture/${executionId}`;
+}
+/**
+ * A non-interactive identity for the snapshot commit objects. These commits are
+ * never on a branch, never pushed, and exist only to anchor a tree against
+ * garbage collection — but `git commit-tree` still requires an author/committer,
+ * and the repo may have no user.name/email configured. Supplied via env so we
+ * never mutate the repo's config.
+ */
+const SNAPSHOT_IDENTITY_ENV = {
+    GIT_AUTHOR_NAME: "stigmer-runner",
+    GIT_AUTHOR_EMAIL: "runner@stigmer.local",
+    GIT_COMMITTER_NAME: "stigmer-runner",
+    GIT_COMMITTER_EMAIL: "runner@stigmer.local",
+};
+/**
+ * Run a git command in `gitRoot`. Returns stdout as a UTF-8 string. Binary
+ * output (file bodies) must use {@link gitBuffer} instead so bytes are exact.
+ */
+async function git(gitRoot, args, env) {
+    const { stdout } = await execFileAsync("git", args, {
+        cwd: gitRoot,
+        env: env ? { ...process.env, ...env } : process.env,
+        maxBuffer: 256 * 1024 * 1024,
+        encoding: "utf-8",
+    });
+    return stdout;
+}
+/** Run a git command returning raw stdout BYTES (for exact file-body reads). */
+async function gitBuffer(gitRoot, args) {
+    const { stdout } = await execFileAsync("git", args, {
+        cwd: gitRoot,
+        maxBuffer: 256 * 1024 * 1024,
+        encoding: "buffer",
+    });
+    return stdout;
+}
+/**
+ * Whether `dir` is inside a git work tree (the capability switch: a real git
+ * workspace gets capture mode, anything else keeps the deny-gate fallback).
+ */
+export async function isGitWorkTree(dir) {
+    try {
+        const out = await git(dir, ["rev-parse", "--is-inside-work-tree"]);
+        return out.trim() === "true";
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether a repo-relative path is capturable by this substrate — i.e. it would
+ * appear in the `git add -A` snapshot. A gitignored path is NOT capturable: the
+ * snapshot cannot see it, so it can be neither reviewed nor reverted, and a
+ * capture-mode gate must keep gating it. Mirrors the Cursor hook's
+ * `__stigmer_is_gitignored` check: `git check-ignore -q` exits 0 when the path IS
+ * ignored, non-zero otherwise; a non-git context / error is treated as
+ * not-ignored (capturable), matching the hook's allow-on-error behavior.
+ */
+export async function isPathCapturable(gitRoot, path) {
+    if (!path)
+        return false;
+    try {
+        await git(gitRoot, ["check-ignore", "-q", "--", path]);
+        return false; // exit 0 -> ignored -> not capturable
+    }
+    catch {
+        return true; // exit 1 (not ignored) or error -> capturable
+    }
+}
+/** Whether the repo has a resolvable HEAD (false for a brand-new empty repo). */
+async function headExists(gitRoot) {
+    try {
+        await git(gitRoot, ["rev-parse", "--verify", "--quiet", "HEAD"]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Absolute path of the repo's `.git` dir (for temp index placement). */
+async function resolveGitDir(gitRoot) {
+    const out = (await git(gitRoot, ["rev-parse", "--absolute-git-dir"])).trim();
+    return out;
+}
+/**
+ * Stage the entire working tree (tracked + untracked, honoring `.gitignore` /
+ * `.git/info/exclude`, EXCLUDING the passed runner-owned paths) into a TEMP index
+ * and write it out as a tree object. The real index is never touched.
+ *
+ * Using a temp index with `git add -A` records every present file as the tree's
+ * content; files absent from the working tree are simply absent from the tree,
+ * so the result is an exact snapshot of "what files exist right now and their
+ * bytes". `.stigmer` and other ignored paths are never staged.
+ */
+async function writeWorkingTree(gitRoot, gitDir, label, executionId, excludePaths) {
+    const tmpIndex = join(gitDir, `stigmer-index-${label}-${executionId}`);
+    try {
+        await rm(tmpIndex, { force: true });
+        const env = { GIT_INDEX_FILE: tmpIndex };
+        await git(gitRoot, ["add", "-A", "--", ".", ...excludePathspecs(excludePaths)], env);
+        return (await git(gitRoot, ["write-tree"], env)).trim();
+    }
+    finally {
+        await rm(tmpIndex, { force: true });
+    }
+}
+/** Pin `tree` behind `ref` as a parent-less-or-HEAD-parented commit (anti-GC). */
+async function pinTree(gitRoot, ref, tree, message) {
+    const args = ["commit-tree", tree, "-m", message];
+    if (await headExists(gitRoot)) {
+        args.push("-p", "HEAD");
+    }
+    const commit = (await git(gitRoot, args, SNAPSHOT_IDENTITY_ENV)).trim();
+    await git(gitRoot, ["update-ref", ref, commit]);
+}
+/**
+ * Snapshot the working tree at turn start and pin it behind the baseline ref.
+ * Returns the baseline tree sha (used by {@link captureChangeSet} and
+ * {@link restoreToBaseline} later in the SAME activity invocation). `excludePaths`
+ * are the runner-owned files the harness writes into the workspace (omit for none).
+ */
+export async function snapshotBaseline(gitRoot, executionId, excludePaths = []) {
+    const gitDir = await resolveGitDir(gitRoot);
+    const tree = await writeWorkingTree(gitRoot, gitDir, "baseline", executionId, excludePaths);
+    await pinTree(gitRoot, baselineRef(executionId), tree, `stigmer baseline ${executionId}`);
+    return tree;
+}
+/**
+ * Capture the change set the turn produced: write the post-turn working tree,
+ * pin it behind the capture ref (so it survives the approval wait), and diff it
+ * against `baselineTree` into a per-file {@link GitSubstrateChange} list.
+ *
+ * Renames are intentionally NOT detected (`--no-renames`): a rename surfaces as
+ * a delete + create, which restores and applies exactly and matches the per-file
+ * review model.
+ */
+export async function captureChangeSet(gitRoot, executionId, baselineTree, excludePaths = []) {
+    const gitDir = await resolveGitDir(gitRoot);
+    const afterTree = await writeWorkingTree(gitRoot, gitDir, "capture", executionId, excludePaths);
+    await pinTree(gitRoot, captureRef(executionId), afterTree, `stigmer capture ${executionId}`);
+    const raw = await git(gitRoot, [
+        "diff",
+        "--no-renames",
+        "--name-status",
+        "-z",
+        baselineTree,
+        afterTree,
+    ]);
+    const changes = [];
+    for (const { status, path } of parseNameStatusZ(raw)) {
+        const change = await buildCapturedChange(gitRoot, baselineTree, afterTree, status, path);
+        if (change)
+            changes.push(change);
+    }
+    return { baselineTree, afterTree, changes };
+}
+/**
+ * Restore the given files to their `baselineTree` (pre-turn) bytes. On resume
+ * this reverts the REJECTED/undecided subset so a discarded change snaps back
+ * exactly; it is the generic "ensure baseline bytes" primitive. Surgical
+ * (bounded by the passed change set): an agent-created file is removed; an
+ * agent-modified or agent-deleted file is rewritten with its baseline bytes.
+ * `.stigmer` and other ignored paths are never touched (they are not in the
+ * change set). Idempotent — safe to re-run (e.g. on a Temporal retry).
+ */
+export async function restoreToBaseline(gitRoot, baselineTree, changes) {
+    for (const change of changes) {
+        const abs = join(gitRoot, change.path);
+        if (change.changeType === FileChangeType.CREATE) {
+            await rm(abs, { force: true });
+        }
+        else {
+            // MODIFY or DELETE: the baseline holds the file — restore its exact bytes.
+            await writeBlobToDisk(gitRoot, baselineTree, change.path, abs);
+        }
+    }
+}
+/**
+ * Ensure the APPROVED files hold their captured "after" bytes, as uncommitted
+ * working-tree changes (no commit). In capture mode the agent's edits are left
+ * applied through the review window, so on resume this is normally an idempotent
+ * re-assert of bytes already on disk; sourcing from the pinned "after" tree also
+ * makes it self-healing if the tree was reset (Temporal retry / sandbox
+ * recycle). An approved CREATE/MODIFY writes the after bytes; an approved DELETE
+ * removes the file. Rejected/undecided paths are not passed in (they go to
+ * {@link restoreToBaseline}).
+ */
+export async function applyApprovedPaths(gitRoot, afterTree, approved) {
+    for (const change of approved) {
+        const abs = join(gitRoot, change.path);
+        if (change.changeType === FileChangeType.DELETE) {
+            await rm(abs, { force: true });
+        }
+        else {
+            // CREATE or MODIFY: write the agent's approved bytes from the after tree.
+            await writeBlobToDisk(gitRoot, afterTree, change.path, abs);
+        }
+    }
+}
+/**
+ * Recompute the captured change set on a RESUME, from the pinned baseline and
+ * capture refs — the authoritative source that survived the approval wait,
+ * independent of any persisted fidelity. Returns `undefined` when this was not a
+ * capture turn (the capture ref is absent), so the caller can fall through to the
+ * non-capture path.
+ */
+export async function recomputeChangeSet(gitRoot, executionId) {
+    const baselineTree = await resolveRefTree(gitRoot, baselineRef(executionId));
+    const afterTree = await resolveRefTree(gitRoot, captureRef(executionId));
+    if (!baselineTree || !afterTree)
+        return undefined;
+    const raw = await git(gitRoot, [
+        "diff",
+        "--no-renames",
+        "--name-status",
+        "-z",
+        baselineTree,
+        afterTree,
+    ]);
+    const changes = [];
+    for (const { status, path } of parseNameStatusZ(raw)) {
+        const change = await buildCapturedChange(gitRoot, baselineTree, afterTree, status, path);
+        if (change)
+            changes.push(change);
+    }
+    return { baselineTree, afterTree, changes };
+}
+/** Resolve a ref to its tree sha, or `undefined` when the ref does not exist. */
+async function resolveRefTree(gitRoot, ref) {
+    try {
+        return (await git(gitRoot, ["rev-parse", "--verify", "--quiet", `${ref}^{tree}`])).trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The ref pinning the post-reconcile (approved) tree for the RECONCILED event. */
+function approvedRef(executionId) {
+    return `refs/stigmer/approved/${executionId}`;
+}
+/**
+ * Snapshot the post-reconcile working tree (after approved bytes were applied and
+ * rejected files were reverted) and pin it behind the approved ref. Returns the
+ * approved tree sha for the RECONCILED event's `approved_snapshot`, plus the ref
+ * so the producer can stamp the SnapshotRef. Idempotent under a Temporal retry.
+ */
+export async function snapshotApproved(gitRoot, executionId, excludePaths = []) {
+    const gitDir = await resolveGitDir(gitRoot);
+    const tree = await writeWorkingTree(gitRoot, gitDir, "approved", executionId, excludePaths);
+    const ref = approvedRef(executionId);
+    await pinTree(gitRoot, ref, tree, `stigmer approved ${executionId}`);
+    return { treeOid: tree, ref };
+}
+/** Release the per-execution baseline, capture, and approved refs (idempotent). */
+export async function dropCaptureRefs(gitRoot, executionId) {
+    for (const ref of [baselineRef(executionId), captureRef(executionId), approvedRef(executionId)]) {
+        try {
+            await git(gitRoot, ["update-ref", "-d", ref]);
+        }
+        catch {
+            // Already gone — nothing to release.
+        }
+    }
+}
+/**
+ * Parse `git diff --name-status -z` output: a flat NUL-delimited stream of
+ * `STATUS\0PATH\0` pairs. NUL-delimiting avoids every quoting/escaping concern
+ * for paths with spaces, quotes, or unicode.
+ */
+function parseNameStatusZ(raw) {
+    const parts = raw.split("\u0000");
+    const entries = [];
+    for (let i = 0; i + 1 < parts.length; i += 2) {
+        const status = parts[i];
+        const path = parts[i + 1];
+        if (!status || !path)
+            continue;
+        entries.push({ status: status[0], path });
+    }
+    return entries;
+}
+/** Read a blob's exact BYTES from a tree, or `undefined` when absent. */
+async function readBlobBytes(gitRoot, tree, path) {
+    try {
+        return await gitBuffer(gitRoot, ["cat-file", "-p", `${tree}:${path}`]);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Read one side of a change as {@link CapturedContent}, computing its identity
+ * from the RAW bytes (never a lossy UTF-8 decode): a binary blob carries only its
+ * byte-true content address (no body — it reconciles from the git ref), while a
+ * text blob is carried inline. Returns `undefined` only when the blob is absent
+ * from the tree (the side does not exist for this changeType).
+ */
+async function readSide(gitRoot, tree, path) {
+    const bytes = await readBlobBytes(gitRoot, tree, path);
+    if (bytes === undefined)
+        return undefined;
+    // Identity is always computed over the RAW bytes at the source — never a lossy
+    // UTF-8 re-encode — so the enforcement digest is byte-true for binary and text
+    // alike. A binary blob carries no body (it reconciles from the git ref); a text
+    // blob carries its inline body for the review diff.
+    const sha256 = sha256Bytes(bytes);
+    if (bytesLookBinary(bytes)) {
+        return { kind: "binary", sha256 };
+    }
+    return { kind: "inline", text: bytes.toString("utf8"), sha256 };
+}
+/** Write a blob's exact bytes from a tree to `abs` (creating parent dirs). */
+async function writeBlobToDisk(gitRoot, tree, path, abs) {
+    const buf = await gitBuffer(gitRoot, ["cat-file", "-p", `${tree}:${path}`]);
+    await mkdir(dirname(abs), { recursive: true });
+    await writeFile(abs, buf);
+}
+/** An empty inline side — the default when a MODIFY blob is unexpectedly absent. */
+const EMPTY_INLINE = { kind: "inline", text: "" };
+/**
+ * Build a {@link GitSubstrateChange} from a diff entry. WHOLE_FILE capture: the
+ * before/after content comes from the two trees, with identity computed over the
+ * exact bytes git holds (see {@link readSide}) — so the review shows the file's
+ * true net change and the enforcement digest is byte-true, binary or text alike.
+ * A binary side is carried as a content address only (no body); large text bodies
+ * are offloaded later at the persist chokepoint.
+ */
+async function buildCapturedChange(gitRoot, baselineTree, afterTree, status, path) {
+    if (status === "A") {
+        const after = await readSide(gitRoot, afterTree, path);
+        if (after === undefined)
+            return undefined;
+        return { path, changeType: FileChangeType.CREATE, after };
+    }
+    if (status === "D") {
+        const before = await readSide(gitRoot, baselineTree, path);
+        if (before === undefined)
+            return undefined;
+        return { path, changeType: FileChangeType.DELETE, before };
+    }
+    // Modified (M) — and any other status (T type-change, etc.) treated as MODIFY.
+    const before = await readSide(gitRoot, baselineTree, path);
+    const after = await readSide(gitRoot, afterTree, path);
+    if (before === undefined && after === undefined)
+        return undefined;
+    return {
+        path,
+        changeType: FileChangeType.MODIFY,
+        before: before ?? EMPTY_INLINE,
+        after: after ?? EMPTY_INLINE,
+    };
+}
+//# sourceMappingURL=git-substrate.js.map

package/dist/shared/filereview/git-substrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-substrate.js","sourceRoot":"","sources":["../../../src/shared/filereview/git-substrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,8DAA8D,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,YAA+B;IACvD,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,WAAmB;IAC7C,OAAO,yBAAyB,WAAW,EAAE,CAAC;AAChD,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC5C,OAAO,wBAAwB,WAAW,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,qBAAqB,GAA2B;IACpD,eAAe,EAAE,gBAAgB;IACjC,gBAAgB,EAAE,sBAAsB;IACxC,kBAAkB,EAAE,gBAAgB;IACpC,mBAAmB,EAAE,sBAAsB;CAC5C,CAAC;AAiCF;;;GAGG;AACH,KAAK,UAAU,GAAG,CAChB,OAAe,EACf,IAAc,EACd,GAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;QAClD,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;QACnD,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;QAC5B,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,SAAS,CAAC,OAAe,EAAE,IAAc;IACtD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;QAClD,GAAG,EAAE,OAAO;QACZ,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;QAC5B,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,OAAO,MAA2B,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC;QACnE,OAAO,GAAG,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,IAAY;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC,CAAC,sCAAsC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,8CAA8C;IAC7D,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,UAAU,CAAC,OAAe;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,aAAa,CAAC,OAAe;IAC1C,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,gBAAgB,CAC7B,OAAe,EACf,MAAc,EACd,KAAa,EACb,WAAmB,EACnB,YAA+B;IAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,WAAW,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;QACzC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACrF,OAAO,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,OAAO,CACpB,OAAe,EACf,GAAW,EACX,IAAY,EACZ,OAAe;IAEf,MAAM,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,WAAmB,EACnB,eAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAC5F,MAAM,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,oBAAoB,WAAW,EAAE,CAAC,CAAC;IAC1F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,WAAmB,EACnB,YAAoB,EACpB,eAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAChG,MAAM,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,mBAAmB,WAAW,EAAE,CAAC,CAAC;IAE7F,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE;QAC7B,MAAM;QACN,cAAc;QACd,eAAe;QACf,IAAI;QACJ,YAAY;QACZ,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACzF,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,YAAoB,EACpB,OAAsC;IAEtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;YAChD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,2EAA2E;YAC3E,MAAM,eAAe,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,SAAiB,EACjB,QAAuC;IAEvC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;YAChD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,0EAA0E;YAC1E,MAAM,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,WAAmB;IAEnB,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAElD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE;QAC7B,MAAM;QACN,cAAc;QACd,eAAe;QACf,IAAI;QACJ,YAAY;QACZ,SAAS;KACV,CAAC,CAAC;IACH,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACzF,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,GAAW;IACxD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,WAAmB;IACtC,OAAO,yBAAyB,WAAW,EAAE,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,WAAmB,EACnB,eAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAC5F,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,WAAW,EAAE,CAAC,CAAC;IACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAChC,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,WAAmB;IAEnB,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAChG,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;AACH,CAAC;AAWD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;YAAE,SAAS;QAC/B,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,aAAa,CAC1B,OAAe,EACf,IAAY,EACZ,IAAY;IAEZ,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,QAAQ,CACrB,OAAe,EACf,IAAY,EACZ,IAAY;IAEZ,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,oDAAoD;IACpD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,eAAe,CAC5B,OAAe,EACf,IAAY,EACZ,IAAY,EACZ,GAAW;IAEX,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5E,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,oFAAoF;AACpF,MAAM,YAAY,GAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAEnE;;;;;;;GAOG;AACH,KAAK,UAAU,mBAAmB,CAChC,OAAe,EACf,YAAoB,EACpB,SAAiB,EACjB,MAAc,EACd,IAAY;IAEZ,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QAC3D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC7D,CAAC;IAED,+EAA+E;IAC/E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO;QACL,IAAI;QACJ,UAAU,EAAE,cAAc,CAAC,MAAM;QACjC,MAAM,EAAE,MAAM,IAAI,YAAY;QAC9B,KAAK,EAAE,KAAK,IAAI,YAAY;KAC7B,CAAC;AACJ,CAAC"}

package/dist/shared/filereview/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The runner's file-review producer: harness-agnostic digest + event authoring
+ * for the apply-then-review HITL subsystem. Consumed by both the Cursor and
+ * deep-agent harnesses to author identical ledger entries.
+ */
+export { aggregateDigest, fileChangeKindName, fileDigest, sha256Bytes, sha256Hex, type FileDigestInput, } from "./digest.js";
+export { appendFileReviewEvents, buildBaselineCapturedEvent, buildCandidateCapturedEvent, buildCapturedFileChange, buildFailedEvent, buildReconciledEvent, eventId, hasCandidateCaptured, type CapturedChangeInput, type ChangeSetContext, } from "./events.js";
+export { applyCaptureDecisions, captureBaselineToLedger, captureCandidateToLedger, type CaptureResumeResult, } from "./capture.js";
+export { isGitWorkTree } from "./git-substrate.js";
+export { applyCasApproved, casBlobKey, casBlobReader, casManifestKey, loadCasManifest, restoreCasToBaseline, snapshotCasChangeSet, type BlobReader, type CasBlobRef, type CasCapturedFile, type CasManifest, type CasPathCapture, type CasSnapshotRef, } from "./cas-substrate.js";
+export { isSecretLikePath, partitionIgnoredPathsBySecret, SECRET_BASENAME_PATTERNS, SECRET_PATH_PATTERNS, type CasSecretPartition, } from "./secret-paths.js";

package/dist/shared/filereview/index.js

@@ -0,0 +1,12 @@
+/**
+ * The runner's file-review producer: harness-agnostic digest + event authoring
+ * for the apply-then-review HITL subsystem. Consumed by both the Cursor and
+ * deep-agent harnesses to author identical ledger entries.
+ */
+export { aggregateDigest, fileChangeKindName, fileDigest, sha256Bytes, sha256Hex, } from "./digest.js";
+export { appendFileReviewEvents, buildBaselineCapturedEvent, buildCandidateCapturedEvent, buildCapturedFileChange, buildFailedEvent, buildReconciledEvent, eventId, hasCandidateCaptured, } from "./events.js";
+export { applyCaptureDecisions, captureBaselineToLedger, captureCandidateToLedger, } from "./capture.js";
+export { isGitWorkTree } from "./git-substrate.js";
+export { applyCasApproved, casBlobKey, casBlobReader, casManifestKey, loadCasManifest, restoreCasToBaseline, snapshotCasChangeSet, } from "./cas-substrate.js";
+export { isSecretLikePath, partitionIgnoredPathsBySecret, SECRET_BASENAME_PATTERNS, SECRET_PATH_PATTERNS, } from "./secret-paths.js";
+//# sourceMappingURL=index.js.map

package/dist/shared/filereview/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/shared/filereview/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,WAAW,EACX,SAAS,GAEV,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,gBAAgB,EAChB,oBAAoB,EACpB,OAAO,EACP,oBAAoB,GAGrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,GAEzB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,oBAAoB,GAOrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,wBAAwB,EACxB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC"}

package/dist/shared/filereview/secret-paths.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The secret-safety gate for CAS capture (design doc 12).
+ *
+ * The git substrate never captures gitignored paths, which was an accidental
+ * safety property: `.gitignore` is where projects keep secrets (`.env`, private
+ * keys, credentials). The CAS substrate's whole purpose is to start capturing
+ * ignored / non-git paths — so, done naively, it would write secret bytes into
+ * durable artifact storage. This module is the fail-closed gate that prevents
+ * that: a path classified secret-like is BLOCKED from capture (authored as
+ * DIFF_UNREVIEWABLE instead) and its bytes never leave the workspace.
+ *
+ * Scope discipline (design doc 12 D2): this is deliberately a small, explicit,
+ * deterministic matcher — NOT the Phase-4 `sensitivity` taxonomy, NOT ML. It is
+ * a pure function over the path, so the cross-edition corpus can lock it (a path
+ * either blocks or captures, identically everywhere). The matcher errs toward
+ * blocking: a path only needs to LOOK secret-like to be withheld, because the
+ * cost of withholding a non-secret (it stays on the deny-gate, as today) is far
+ * lower than the cost of persisting a real secret.
+ *
+ * @since File-Change HITL Redesign (Phase 3 — CAS / DD-E)
+ */
+/**
+ * Basename patterns that mark a file secret-like. Matched case-insensitively
+ * against the final path segment. Kept as an explicit, reviewable list — adding
+ * a pattern is a deliberate, corpus-locked change, never a heuristic guess.
+ */
+export declare const SECRET_BASENAME_PATTERNS: readonly RegExp[];
+/**
+ * Path-fragment patterns that mark a file secret-like by WHERE it lives, matched
+ * against the normalized (forward-slash) full path. Covers credential stores
+ * whose basenames alone are ambiguous.
+ */
+export declare const SECRET_PATH_PATTERNS: readonly RegExp[];
+/**
+ * Whether a path is secret-like and must NOT be captured into the durable CAS
+ * store. Fail-closed: an empty/unknown path is treated as secret-like (withheld)
+ * rather than captured.
+ */
+export declare function isSecretLikePath(path: string): boolean;
+/** How the turn's observed gitignored paths split under the secret gate. */
+export interface CasSecretPartition {
+    /** Paths safe to capture into durable CAS (their bytes may be persisted). */
+    readonly capturablePaths: readonly string[];
+    /**
+     * Paths withheld from capture — authored as content-less DIFF_UNREVIEWABLE.
+     * The union of the gate's up-front blocks and any observed secret-like path.
+     */
+    readonly unreviewablePaths: readonly string[];
+}
+/**
+ * Split a turn's observed gitignored paths into capturable vs withheld — the
+ * single source of truth for "which ignored bytes may reach durable storage".
+ *
+ * `unreviewablePaths = gateBlockedPaths ∪ { p ∈ observed : isSecretLikePath(p) }`
+ * and `capturablePaths = { p ∈ observed : ¬isSecretLikePath(p) }`. The
+ * `isSecretLikePath` re-check over `observed` is the fail-closed backstop that
+ * holds **even under the global bypass** (`spec.auto_approve_all`): there the
+ * approval gate is not installed, so `gateBlockedPaths` is empty and this
+ * re-check is the only thing keeping a secret's bytes out of CAS. Order is
+ * preserved (gate blocks first, then observed order) and duplicates are folded,
+ * so the result is deterministic for the cross-edition corpus.
+ */
+export declare function partitionIgnoredPathsBySecret(observedPaths: Iterable<string>, gateBlockedPaths: ReadonlySet<string>): CasSecretPartition;

package/dist/shared/filereview/secret-paths.js

@@ -0,0 +1,105 @@
+/**
+ * The secret-safety gate for CAS capture (design doc 12).
+ *
+ * The git substrate never captures gitignored paths, which was an accidental
+ * safety property: `.gitignore` is where projects keep secrets (`.env`, private
+ * keys, credentials). The CAS substrate's whole purpose is to start capturing
+ * ignored / non-git paths — so, done naively, it would write secret bytes into
+ * durable artifact storage. This module is the fail-closed gate that prevents
+ * that: a path classified secret-like is BLOCKED from capture (authored as
+ * DIFF_UNREVIEWABLE instead) and its bytes never leave the workspace.
+ *
+ * Scope discipline (design doc 12 D2): this is deliberately a small, explicit,
+ * deterministic matcher — NOT the Phase-4 `sensitivity` taxonomy, NOT ML. It is
+ * a pure function over the path, so the cross-edition corpus can lock it (a path
+ * either blocks or captures, identically everywhere). The matcher errs toward
+ * blocking: a path only needs to LOOK secret-like to be withheld, because the
+ * cost of withholding a non-secret (it stays on the deny-gate, as today) is far
+ * lower than the cost of persisting a real secret.
+ *
+ * @since File-Change HITL Redesign (Phase 3 — CAS / DD-E)
+ */
+/**
+ * Basename patterns that mark a file secret-like. Matched case-insensitively
+ * against the final path segment. Kept as an explicit, reviewable list — adding
+ * a pattern is a deliberate, corpus-locked change, never a heuristic guess.
+ */
+export const SECRET_BASENAME_PATTERNS = [
+    /^\.env(\..+)?$/, // .env, .env.local, .env.production, ...
+    /^\.npmrc$/,
+    /^\.netrc$/,
+    /^\.pgpass$/,
+    /^\.htpasswd$/,
+    /^credentials(\.[A-Za-z0-9]+)?$/, // credentials, credentials.json, ...
+    /^secrets?(\.[A-Za-z0-9]+)?$/, // secret / secrets / secrets.yaml, ...
+    /^id_(rsa|dsa|ecdsa|ed25519)$/, // private SSH keys (no .pub)
+    /.*\.(pem|key|pfx|p12|keystore|jks|asc|ppk)$/,
+    /.*\.tfstate(\.backup)?$/, // terraform state embeds secrets
+    /.*\.tfvars$/,
+    /.*\.(kdbx)$/, // password databases
+];
+/**
+ * Path-fragment patterns that mark a file secret-like by WHERE it lives, matched
+ * against the normalized (forward-slash) full path. Covers credential stores
+ * whose basenames alone are ambiguous.
+ */
+export const SECRET_PATH_PATTERNS = [
+    /(^|\/)\.ssh\//, // ~/.ssh/* and repo-local .ssh/*
+    /(^|\/)\.aws\/credentials$/,
+    /(^|\/)\.gnupg\//,
+    /(^|\/)\.docker\/config\.json$/,
+    /(^|\/)\.kube\/config$/,
+];
+/** The final path segment (basename), for both `/` and `\` separators. */
+function basename(path) {
+    const normalized = path.replace(/\\/g, "/");
+    const idx = normalized.lastIndexOf("/");
+    return idx >= 0 ? normalized.slice(idx + 1) : normalized;
+}
+/**
+ * Whether a path is secret-like and must NOT be captured into the durable CAS
+ * store. Fail-closed: an empty/unknown path is treated as secret-like (withheld)
+ * rather than captured.
+ */
+export function isSecretLikePath(path) {
+    if (!path)
+        return true;
+    const normalized = path.replace(/\\/g, "/");
+    const base = basename(normalized).toLowerCase();
+    for (const re of SECRET_BASENAME_PATTERNS) {
+        if (re.test(base))
+            return true;
+    }
+    const lowerPath = normalized.toLowerCase();
+    for (const re of SECRET_PATH_PATTERNS) {
+        if (re.test(lowerPath))
+            return true;
+    }
+    return false;
+}
+/**
+ * Split a turn's observed gitignored paths into capturable vs withheld — the
+ * single source of truth for "which ignored bytes may reach durable storage".
+ *
+ * `unreviewablePaths = gateBlockedPaths ∪ { p ∈ observed : isSecretLikePath(p) }`
+ * and `capturablePaths = { p ∈ observed : ¬isSecretLikePath(p) }`. The
+ * `isSecretLikePath` re-check over `observed` is the fail-closed backstop that
+ * holds **even under the global bypass** (`spec.auto_approve_all`): there the
+ * approval gate is not installed, so `gateBlockedPaths` is empty and this
+ * re-check is the only thing keeping a secret's bytes out of CAS. Order is
+ * preserved (gate blocks first, then observed order) and duplicates are folded,
+ * so the result is deterministic for the cross-edition corpus.
+ */
+export function partitionIgnoredPathsBySecret(observedPaths, gateBlockedPaths) {
+    const unreviewable = new Set(gateBlockedPaths);
+    const capturablePaths = [];
+    for (const path of observedPaths) {
+        if (isSecretLikePath(path)) {
+            unreviewable.add(path);
+            continue;
+        }
+        capturablePaths.push(path);
+    }
+    return { capturablePaths, unreviewablePaths: [...unreviewable] };
+}
+//# sourceMappingURL=secret-paths.js.map

package/dist/shared/filereview/secret-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-paths.js","sourceRoot":"","sources":["../../../src/shared/filereview/secret-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,gBAAgB,EAAE,yCAAyC;IAC3D,WAAW;IACX,WAAW;IACX,YAAY;IACZ,cAAc;IACd,gCAAgC,EAAE,qCAAqC;IACvE,6BAA6B,EAAE,uCAAuC;IACtE,8BAA8B,EAAE,6BAA6B;IAC7D,6CAA6C;IAC7C,yBAAyB,EAAE,iCAAiC;IAC5D,aAAa;IACb,aAAa,EAAE,qBAAqB;CACrC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,eAAe,EAAE,iCAAiC;IAClD,2BAA2B;IAC3B,iBAAiB;IACjB,+BAA+B;IAC/B,uBAAuB;CACxB,CAAC;AAEF,0EAA0E;AAC1E,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAEhD,KAAK,MAAM,EAAE,IAAI,wBAAwB,EAAE,CAAC;QAC1C,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACjC,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IAC3C,KAAK,MAAM,EAAE,IAAI,oBAAoB,EAAE,CAAC;QACtC,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAaD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAC3C,aAA+B,EAC/B,gBAAqC;IAErC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,gBAAgB,CAAC,CAAC;IACvD,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC;AACnE,CAAC"}