@sun-asterisk/sungen 3.3.0-alpha.1 → 3.3.0-alpha.10

package/dist/harness/provenance.js

@@ -33,20 +33,115 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUDIT_RULES_VERSION = void 0;
+exports.bundledDriverRulesInputs = bundledDriverRulesInputs;
+exports.rulesHashOf = rulesHashOf;
 exports.getProvenance = getProvenance;
 /**
- * Provenance stamp for deterministic reports (score-determinism D1).
+ * Provenance stamp for deterministic reports (score-determinism D1), and the RULES the audit's
+ * verdict was judged by (#933, owner decision W4).
  *
- * The audit score is a pure function of the project files + the bundled catalog.
- * Stamping the sungen version + a catalog hash into the report lets two users who
- * get different scores see IMMEDIATELY whether the cause is a version/catalog
- * mismatch (the main residual source of cross-user variance) rather than a real
- * difference in their test design.
+ * The audit score is a pure function of the project files + the bundled catalogs + the scoring
+ * code. Stamping them into the report lets two users who get different scores see IMMEDIATELY
+ * whether the cause is a rules mismatch rather than a real difference in their test design — and
+ * lets `verifyAuditReport` tell a report judged by today's rules from one judged by other rules:
+ *
+ *   sungenVersion   which package wrote it — informational: a newer sungen with the same rules
+ *                   gives the same verdict, so the version alone never makes a report stale
+ *   catalogHash     sha256(universal-viewpoints.yaml), first 12 hex — the viewpoint catalog
+ *   rulesHash       sha256(AUDIT_RULES_VERSION + every catalog file under harness/catalog/ + each
+ *                   bundled driver's sources/catalogs), first 12 hex — everything the verdict
+ *                   depends on that is not the project's own files. No package VERSION is hashed:
+ *                   packages are lockstep-versioned, so a release would stale every report
  */
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const crypto = __importStar(require("crypto"));
+/**
+ * The version of the audit's SCORING CODE. Bump it (by one) in the same change whenever what
+ * `runAudit` computes for the same project can change: a sensor, a threshold, a gate term
+ * (audit-gate-terms.ts), the score model or weights, a finding that feeds the verdict, or the
+ * audit sensor of a bundled driver. Every report scored before the bump then reads stale and asks
+ * for one `sungen audit`. Catalog edits (harness/catalog/*.yaml) and bundled-driver changes (their
+ * sources and catalogs are hashed) need no bump.
+ * A release that changes none of these keeps every report trusted across the upgrade.
+ * Enforced by tests/audit/run.ts: its rules lock (tests/audit/audit-rules.lock.json) fails when the
+ * fixtures' audit output changes under an unchanged rules hash. After the bump, re-record it:
+ *   npx tsx tests/audit/run.ts --record-rules-lock
+ */
+exports.AUDIT_RULES_VERSION = 1;
+/** What is not a driver's rule: dependencies, build output, tests, docs, editor and lock files. */
+const SKIP_DIR = new Set(['node_modules', 'dist', 'tests', 'test', 'coverage']);
+const SKIP_FILE = /^(?:\.|package(?:-lock)?\.json$|tsconfig.*\.json$|.*\.(?:md|tsbuildinfo)$)/;
+function driverFiles(root, rel = '') {
+    const out = [];
+    for (const e of fs.readdirSync(path.join(root, rel), { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name, 'en'))) {
+        if (e.name.startsWith('.'))
+            continue;
+        const r = rel ? `${rel}/${e.name}` : e.name;
+        if (e.isDirectory()) {
+            if (!SKIP_DIR.has(e.name))
+                out.push(...driverFiles(root, r));
+        }
+        else if (e.isFile() && !SKIP_FILE.test(e.name))
+            out.push(r);
+    }
+    return out;
+}
+/** The package root above a driver's resolved entry file (the dir whose package.json names it). */
+function packageRootOf(entry, name) {
+    let dir = path.dirname(entry);
+    for (let i = 0; i < 8; i++) {
+        try {
+            if (JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'))?.name === name)
+                return dir;
+        }
+        catch { /* keep walking */ }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+/** Each bundled driver as discovery would load it (project anchor, then core's), or `absent`. */
+function bundledDriverRulesInputs() {
+    // Lazy: discovery pulls the capability registry, which nothing else here needs.
+    const { bundledDriverNames, resolveDriverCopy } = require('../capabilities/discover');
+    return bundledDriverNames().map((name) => {
+        const copy = resolveDriverCopy(name);
+        const dir = copy ? packageRootOf(copy.resolved, name) : null;
+        return { name, version: copy?.version, dir };
+    });
+}
+const CATALOG_DIR = path.join(__dirname, 'catalog');
+const sha12 = (s) => crypto.createHash('sha256').update(s).digest('hex').slice(0, 12);
+/**
+ * The rules hash: the scoring version, every *.yaml of the catalog dir (by name), and each bundled
+ * driver — every source / catalog file of its package (by relative path; build output, tests and
+ * dependencies excluded), or a stable `absent` marker when it is not installed. A driver's version is
+ * deliberately left out: releases bump every package in lockstep, and only content changes the rules.
+ */
+function rulesHashOf(rulesVersion, catalogDir = CATALOG_DIR, drivers = bundledDriverRulesInputs()) {
+    const files = fs.readdirSync(catalogDir).filter((f) => f.endsWith('.yaml')).sort();
+    const h = crypto.createHash('sha256').update(`audit-rules:${rulesVersion}\n`);
+    for (const f of files)
+        h.update(`${f}\n`).update(fs.readFileSync(path.join(catalogDir, f))).update('\n');
+    for (const d of [...drivers].sort((a, b) => a.name.localeCompare(b.name, 'en'))) {
+        h.update(`driver:${d.name}\n`);
+        if (!d.dir) {
+            h.update('absent\n');
+            continue;
+        }
+        for (const f of driverFiles(d.dir))
+            h.update(`${f}\n`).update(fs.readFileSync(path.join(d.dir, f))).update('\n');
+    }
+    return h.digest('hex').slice(0, 12);
+}
+let cached = null;
 function getProvenance() {
+    if (cached)
+        return cached;
     let sungenVersion = 'unknown';
     try {
         const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'package.json'), 'utf-8'));
@@ -56,10 +151,15 @@ function getProvenance() {
     catch { /* version stays 'unknown' */ }
     let catalogHash = 'unknown';
     try {
-        const cat = fs.readFileSync(path.join(__dirname, 'catalog', 'universal-viewpoints.yaml'), 'utf-8');
-        catalogHash = crypto.createHash('sha256').update(cat).digest('hex').slice(0, 12);
+        catalogHash = sha12(fs.readFileSync(path.join(CATALOG_DIR, 'universal-viewpoints.yaml'), 'utf-8'));
+    }
+    catch { /* hash stays 'unknown' */ }
+    let rulesHash = 'unknown';
+    try {
+        rulesHash = rulesHashOf(exports.AUDIT_RULES_VERSION);
     }
     catch { /* hash stays 'unknown' */ }
-    return { sungenVersion, catalogHash };
+    cached = { sungenVersion, catalogHash, rulesHash };
+    return cached;
 }
 //# sourceMappingURL=provenance.js.map

package/dist/harness/provenance.js.map

@@ -1 +1 @@
-{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../src/harness/provenance.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,sCAcC;AAhCD;;;;;;;;GAQG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,+CAAiC;AAOjC,SAAgB,aAAa;IAC3B,IAAI,aAAa,GAAG,SAAS,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACnG,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;IAEzC,IAAI,WAAW,GAAG,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,2BAA2B,CAAC,EAAE,OAAO,CAAC,CAAC;QACnG,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;IAEtC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AACxC,CAAC"}
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../src/harness/provenance.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwEA,4DAQC;AAWD,kCAUC;AAID,sCAeC;AAxHD;;;;;;;;;;;;;;;;GAgBG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,+CAAiC;AAEjC;;;;;;;;;;;GAWG;AACU,QAAA,mBAAmB,GAAG,CAAC,CAAC;AAWrC,mGAAmG;AACnG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAChF,MAAM,SAAS,GAAG,4EAA4E,CAAC;AAE/F,SAAS,WAAW,CAAC,IAAY,EAAE,GAAG,GAAG,EAAE;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACjI,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACrC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;aACjF,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mGAAmG;AACnG,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC;YAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,KAAK,IAAI;gBAAE,OAAO,GAAG,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACxI,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iGAAiG;AACjG,SAAgB,wBAAwB;IACtC,gFAAgF;IAChF,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,0BAA0B,CAA8C,CAAC;IACnI,OAAO,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACpD,MAAM,KAAK,GAAG,CAAC,CAAkB,EAAU,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAE/G;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,YAAoB,EAAE,aAAqB,WAAW,EAAE,UAA8B,wBAAwB,EAAE;IAC1I,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnF,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,YAAY,IAAI,CAAC,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzG,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAChF,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,IAAI,MAAM,GAAsB,IAAI,CAAC;AAErC,SAAgB,aAAa;IAC3B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,aAAa,GAAG,SAAS,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACnG,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;IAEzC,IAAI,WAAW,GAAG,SAAS,CAAC;IAC5B,IAAI,CAAC;QAAC,WAAW,GAAG,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,2BAA2B,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;IAChJ,IAAI,SAAS,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC;QAAC,SAAS,GAAG,WAAW,CAAC,2BAAmB,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;IAE1F,MAAM,GAAG,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACnD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/harness/triage-manual-classification.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `sungen triage --screen <u> --case <id> --as product|test-defect|environment --reason "…"` (#928):
+ * classify one red by hand — the one `sungen triage` left unclassified, or one it got wrong — as a
+ * `triage-classification` decision in the unit's `decisions/` (read back by graph/manual-triage-decisions.ts).
+ *
+ *   validated first   the class, a reason, a case that exists, is red and is not exempt — before any
+ *                     prompt, so a human never confirms something that is then rejected
+ *   product           stricter than any automatic class (it leads to a QA decision): anyone may record it
+ *   test-defect,      can hide a product defect behind "fix the test" / "re-run": a human types a
+ *   environment       confirmation on a terminal (DOS-13.4); without one it is refused, nothing is
+ *                     written and the exact command is printed. Only after the typed phrase does the
+ *                     entry carry `humanConfirmed: true`, and a reader ignores one without it
+ *   bound             evidence_hash = the case's red as it reads now; a re-run voids the classification
+ */
+import type { AppendResult } from '../decisions/append-decision';
+import { ConfirmationIO } from '../decisions/human-confirmation';
+import { ManualTriageClass } from '../graph/manual-triage-decisions';
+export interface ClassifyRedCaseInput {
+    projectRoot: string;
+    unit: string;
+    caseId: string;
+    /** product | test-defect | environment */
+    as: string;
+    reason?: string;
+    io: ConfirmationIO;
+}
+export interface ClassifyRedCaseResult extends AppendResult {
+    caseId: string;
+    class: ManualTriageClass;
+}
+export declare function classifyRedCase(i: ClassifyRedCaseInput): Promise<ClassifyRedCaseResult>;
+//# sourceMappingURL=triage-manual-classification.d.ts.map

package/dist/harness/triage-manual-classification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-manual-classification.d.ts","sourceRoot":"","sources":["../../src/harness/triage-manual-classification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAIjE,OAAO,EAAE,cAAc,EAA2C,MAAM,iCAAiC,CAAC;AAE1G,OAAO,EAAuC,iBAAiB,EAAwB,MAAM,kCAAkC,CAAC;AAKhI,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,cAAc,CAAC;CACpB;AAED,MAAM,WAAW,qBAAsB,SAAQ,YAAY;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE;AAExG,wBAAsB,eAAe,CAAC,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAsC7F"}

package/dist/harness/triage-manual-classification.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyRedCase = classifyRedCase;
+const append_decision_1 = require("../decisions/append-decision");
+const decision_source_1 = require("../decisions/decision-source");
+const human_confirmation_1 = require("../decisions/human-confirmation");
+const resolve_unit_1 = require("../cli/resolve-unit");
+const manual_triage_decisions_1 = require("../graph/manual-triage-decisions");
+const test_case_satisfied_1 = require("../graph/test-case-satisfied");
+const test_case_states_1 = require("../graph/test-case-states");
+const unit_gate_overrides_1 = require("./gates/unit-gate-overrides");
+async function classifyRedCase(i) {
+    const cls = Object.prototype.hasOwnProperty.call(manual_triage_decisions_1.MANUAL_TRIAGE_AS, i.as) ? manual_triage_decisions_1.MANUAL_TRIAGE_AS[i.as] : undefined;
+    if (!cls)
+        throw new Error(`--as must be one of ${Object.keys(manual_triage_decisions_1.MANUAL_TRIAGE_AS).join(', ')} (got "${i.as}")`);
+    const reason = (i.reason ?? '').trim();
+    if (!reason)
+        throw new Error('--reason is required: a classification records WHY this red is what you say it is');
+    const found = (0, resolve_unit_1.resolveUnitCandidates)(i.unit, i.projectRoot);
+    if (found.length !== 1)
+        throw new Error(`"${i.unit}" does not name exactly one unit under qa/screens, qa/flows or qa/api`);
+    const unitDir = found[0].dir;
+    const scope = (0, unit_gate_overrides_1.unitScopeOfDir)(i.projectRoot, unitDir);
+    if (!scope)
+        throw new Error(`"${i.unit}" has no decisions scope`);
+    const cases = (0, test_case_states_1.testCaseStates)(i.projectRoot, i.unit, { unitDir, auditFindings: [] });
+    const tc = cases.find((c) => c.id === i.caseId);
+    if (!tc) {
+        const known = cases.slice(0, 8).map((c) => c.id).join(', ');
+        throw new Error(`no test case "${i.caseId}" in ${i.unit}${known ? ` — known: ${known}${cases.length > 8 ? ', …' : ''}` : ''}`);
+    }
+    if (tc.result !== 'failed' || !tc.evidence)
+        throw new Error(`${tc.id} has no red result to classify (result: ${tc.result})`);
+    const exempt = (0, test_case_satisfied_1.exemptionOf)(tc);
+    if (exempt)
+        throw new Error(`${tc.id} is exempt (${exempt}) — it needs no classification`);
+    const human = manual_triage_decisions_1.HUMAN_ONLY_TRIAGE.has(cls);
+    if (human) {
+        await (0, human_confirmation_1.requireTypedConfirmation)({
+            what: `classify the red ${tc.id} of ${i.unit} as ${cls}`,
+            phrase: tc.id,
+            command: (0, human_confirmation_1.formatCommand)(['sungen', 'triage', found[0].kind === 'api' ? '--api' : '--screen', i.unit, '--case', tc.id, '--as', i.as, '--reason', reason]),
+            summary: [`case: ${tc.title}`, `automatic triage: ${tc.triage ? `${tc.triage.class} (${tc.triage.ruleId})` : 'none current'}`, `reason: ${reason}`,
+                `recorded by: ${(0, decision_source_1.gitUserName)(i.projectRoot)}`, `as ${cls} it leaves the product-defect path — confirm only after reading its evidence (trace, error)`,
+                'it stops counting as soon as the case runs again'],
+            io: i.io,
+        });
+    }
+    const draft = {
+        kind: manual_triage_decisions_1.TRIAGE_DECISION_KIND, anchors: [], text: `${tc.id} is ${cls}: ${tc.title}`, reason,
+        payload: { case: tc.id, class: cls, ...(human ? { humanConfirmed: true } : {}) },
+        source: { by: (0, decision_source_1.gitUserName)(i.projectRoot), where: 'cli' }, valid_from: new Date().toISOString(), visibility: 'internal', evidence_hash: tc.evidence,
+    };
+    return { ...(0, append_decision_1.appendDecision)(i.projectRoot, scope, draft), caseId: tc.id, class: cls };
+}
+//# sourceMappingURL=triage-manual-classification.js.map

package/dist/harness/triage-manual-classification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-manual-classification.js","sourceRoot":"","sources":["../../src/harness/triage-manual-classification.ts"],"names":[],"mappings":";;AAqCA,0CAsCC;AA5DD,kEAA8D;AAE9D,kEAA2D;AAC3D,wEAA0G;AAC1G,sDAA4D;AAC5D,8EAAgI;AAChI,sEAA2D;AAC3D,gEAA2D;AAC3D,qEAA6D;AActD,KAAK,UAAU,eAAe,CAAC,CAAuB;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,0CAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,0CAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,0CAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IAClH,MAAM,KAAK,GAAG,IAAA,oCAAqB,EAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,uEAAuE,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAA,oCAAc,EAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,0BAA0B,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,IAAA,iCAAc,EAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;IACpF,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,2CAA2C,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7H,MAAM,MAAM,GAAG,IAAA,iCAAW,EAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,eAAe,MAAM,gCAAgC,CAAC,CAAC;IAE3F,MAAM,KAAK,GAAG,2CAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAA,6CAAwB,EAAC;YAC7B,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,OAAO,GAAG,EAAE;YACxD,MAAM,EAAE,EAAE,CAAC,EAAE;YACb,OAAO,EAAE,IAAA,kCAAa,EAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACvJ,OAAO,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,qBAAqB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,EAAE,WAAW,MAAM,EAAE;gBAChJ,gBAAgB,IAAA,6BAAW,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,6FAA6F;gBACpJ,kDAAkD,CAAC;YACrD,EAAE,EAAE,CAAC,CAAC,EAAE;SACT,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAkB;QAC3B,IAAI,EAAE,8CAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,GAAG,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,MAAM;QACxF,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAChF,MAAM,EAAE,EAAE,EAAE,EAAE,IAAA,6BAAW,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,CAAC,QAAQ;KACnJ,CAAC;IACF,OAAO,EAAE,GAAG,IAAA,gCAAc,EAAC,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACvF,CAAC"}

package/dist/harness/unit-paths.d.ts

@@ -16,4 +16,12 @@ export declare const reportSlug: (unit: string) => string;
  * behaviour (and error text) they already have.
  */
 export declare function featureFilesFor(unitDir: string, unit: string): string[];
+/**
+ * The catalog-resolution id for a unit dir (relative to qa/): screen · flows/<flow> · api/<area> ·
+ * api/flows/<flow>; a bare screen is its basename. Shared by the audit, which scores and links the
+ * unit under this id, and its inputsHash, which reads what the audit reads under the same id.
+ */
+export declare function catalogIdFromScreenDir(screenDir: string): string;
+/** A screen unit — the only kind a sibling flow credits (TQ-4); flows and api units are not. */
+export declare const isScreenUnitId: (catalogId: string) => boolean;
 //# sourceMappingURL=unit-paths.d.ts.map

package/dist/harness/unit-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unit-paths.d.ts","sourceRoot":"","sources":["../../src/harness/unit-paths.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,MAA6B,CAAC;AAC7E,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG,MAAsC,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkBvE"}
+{"version":3,"file":"unit-paths.d.ts","sourceRoot":"","sources":["../../src/harness/unit-paths.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,MAA6B,CAAC;AAC7E,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG,MAAsC,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkBvE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAShE;AAED,gGAAgG;AAChG,eAAO,MAAM,cAAc,GAAI,WAAW,MAAM,KAAG,OAA4C,CAAC"}

package/dist/harness/unit-paths.js

@@ -33,8 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.reportSlug = exports.featureBasename = void 0;
+exports.isScreenUnitId = exports.reportSlug = exports.featureBasename = void 0;
 exports.featureFilesFor = featureFilesFor;
+exports.catalogIdFromScreenDir = catalogIdFromScreenDir;
 /**
  * Unit-path helpers (api-flow fix). A unit id may be a bare name (`orders`, `login`) or a nested
  * api-flow id (`flows/<flow>`). Three derivations the harness/CLI need:
@@ -86,4 +87,25 @@ function featureFilesFor(unitDir, unit) {
         ...names.filter((n) => n !== canonicalName),
     ].map((n) => path.join(dir, n));
 }
+/**
+ * The catalog-resolution id for a unit dir (relative to qa/): screen · flows/<flow> · api/<area> ·
+ * api/flows/<flow>; a bare screen is its basename. Shared by the audit, which scores and links the
+ * unit under this id, and its inputsHash, which reads what the audit reads under the same id.
+ */
+function catalogIdFromScreenDir(screenDir) {
+    const parts = screenDir.split(path.sep);
+    const qa = parts.lastIndexOf('qa');
+    if (qa >= 0) {
+        if (parts[qa + 1] === 'api' && parts[qa + 2] === 'flows' && parts[qa + 3])
+            return `api/flows/${parts[qa + 3]}`;
+        if (parts[qa + 1] === 'api' && parts[qa + 2])
+            return `api/${parts[qa + 2]}`;
+        if (parts[qa + 1] === 'flows' && parts[qa + 2])
+            return `flows/${parts[qa + 2]}`;
+    }
+    return path.basename(screenDir);
+}
+/** A screen unit — the only kind a sibling flow credits (TQ-4); flows and api units are not. */
+const isScreenUnitId = (catalogId) => !/^(flows|api)\//.test(catalogId);
+exports.isScreenUnitId = isScreenUnitId;
 //# sourceMappingURL=unit-paths.js.map

package/dist/harness/unit-paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"unit-paths.js","sourceRoot":"","sources":["../../src/harness/unit-paths.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,0CAkBC;AAlDD;;;;;;;;;;GAUG;AACH,uCAAyB;AACzB,2CAA6B;AAEtB,MAAM,eAAe,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAAhE,QAAA,eAAe,mBAAiD;AACtE,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAApE,QAAA,UAAU,cAA0D;AAEjF;;;;;;;;;;;;;;GAcG;AACH,SAAgB,eAAe,CAAC,OAAe,EAAE,IAAY;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,GAAG,IAAA,uBAAe,EAAC,IAAI,CAAC,UAAU,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAEhD,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,4DAA4D;IAClF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAE3C,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/C,OAAO;QACL,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC;QAC3C,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC;KAC5C,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"unit-paths.js","sourceRoot":"","sources":["../../src/harness/unit-paths.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,0CAkBC;AAOD,wDASC;AAlED;;;;;;;;;;GAUG;AACH,uCAAyB;AACzB,2CAA6B;AAEtB,MAAM,eAAe,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAAhE,QAAA,eAAe,mBAAiD;AACtE,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAApE,QAAA,UAAU,cAA0D;AAEjF;;;;;;;;;;;;;;GAcG;AACH,SAAgB,eAAe,CAAC,OAAe,EAAE,IAAY;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,GAAG,IAAA,uBAAe,EAAC,IAAI,CAAC,UAAU,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAEhD,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,4DAA4D;IAClF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAE3C,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/C,OAAO;QACL,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC;QAC3C,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC;KAC5C,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,SAAiB;IACtD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACZ,IAAI,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,OAAO,IAAI,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,aAAa,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/G,IAAI,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,OAAO,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5E,IAAI,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,OAAO,IAAI,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,SAAS,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,gGAAgG;AACzF,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAW,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAAnF,QAAA,cAAc,kBAAqE"}

package/dist/hooks/bash-read-only-segment.d.ts

@@ -0,0 +1,9 @@
+import type { BashSegment } from './bash-write-targets';
+/** May any read-only segment of this line keep its exemption? */
+export declare function lineKeepsReadOnlyExemption(command: string, segs: BashSegment[]): boolean;
+export declare function isReadOnlyNodeEval(args: string[]): boolean;
+/** Does this segment only read? (`words` holds its arguments and redirection targets.) */
+export declare function isReadOnlySegment(seg: BashSegment): boolean;
+/** Does everything downstream of segment `i` in its pipeline only read / filter? */
+export declare function pipelineStaysReadOnly(segs: BashSegment[], i: number): boolean;
+//# sourceMappingURL=bash-read-only-segment.d.ts.map

package/dist/hooks/bash-read-only-segment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash-read-only-segment.d.ts","sourceRoot":"","sources":["../../src/hooks/bash-read-only-segment.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAwCxD,iEAAiE;AACjE,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,OAAO,CAGxF;AAaD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAI1D;AASD,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAO3D;AAYD,oFAAoF;AACpF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAM7E"}

package/dist/hooks/bash-read-only-segment.js

@@ -0,0 +1,168 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lineKeepsReadOnlyExemption = lineKeepsReadOnlyExemption;
+exports.isReadOnlyNodeEval = isReadOnlyNodeEval;
+exports.isReadOnlySegment = isReadOnlySegment;
+exports.pipelineStaysReadOnly = pipelineStaysReadOnly;
+/**
+ * Which Bash segments only READ, so they may name a protected path freely (bash-protected-mention).
+ *
+ * An allowlist, fail-closed (#968): a command is read-only only in the forms listed here. It drops
+ * back to "the guard cannot tell" when
+ *   - the command word has a `/` outside the system bin dirs (`./cat`, `/tmp/evil/jq`),
+ *   - a word holds `$`, `{`, `*`, `?` or `[` (`$'--output'`, `${…}`, `--{output=…,stat}`, a `q*` glob can
+ *     hide an option name or a path),
+ *   - an option runs a program or writes a file, also abbreviated where the tool accepts that
+ *     (`rg --pre`, `git diff --output` / `--outp`, ugrep's `grep --filter` / `--save-config` / `--pager`
+ *     / `--config`, `sort -o` / `--o…` / `--c…`),
+ *   - git has any global option before its subcommand except `--no-pager` / `-P` / `--no-optional-locks`
+ *     (`-c`, `--config-env`, `--exec-path`, `-C`, `--git-dir`… can point it at another program),
+ *   - its output is piped into anything that is not a read-only command or filter (`| xargs rm`, `| sh`).
+ * And the whole LINE loses the exemption (lineKeepsReadOnlyExemption) when it uses command
+ * substitution or changes shell state that a later command obeys: any `NAME=value`, `export`,
+ * `declare`, `typeset`, `set`, `setopt`, `shopt`, `alias`, `unalias`, `hash`, `unset`, `read`,
+ * `enable`, `builtin`, `trap`, `source` / `.`, `eval`, or a function definition.
+ * `git grep` is not read-only at all: `-O` runs a program, also inside a flag cluster (`-nOrm`) and
+ * as an abbreviation (`--open=`). `node -e|-p` counts only when its script can do nothing but read
+ * (isReadOnlyNodeEval).
+ *
+ * Accepted floor, not closed here: `sungen` is listed read-only (it writes approval records only
+ * through its own human gates); a path built at runtime (`$VAR` away from a protected name), a
+ * symlink, or a script that writes without naming the path is out of reach; a bare directory
+ * (`rm -rf qa/decisions`, `cd qa && rm -rf decisions/`) is not a protected-path mention (#970);
+ * `git -C <dir> …` is not followed; a same-line `D=qa/decisions; … $D` is not tracked; pathless
+ * destructive git (`clean -fdx`, `stash`, `reset --hard`, `checkout .`, `apply`, `am`) is not seen;
+ * and a quoting trick the tokenizer reads differently from the shell can turn a deny into an ask.
+ * The backstop is release-time decision integrity: the git HEAD comparison and the in-run rule.
+ */
+const path = __importStar(require("path"));
+const READ_ONLY = new Set(['cat', 'ls', 'head', 'tail', 'grep', 'rg', 'wc', 'diff', 'stat', 'jq', 'sungen', 'sungen.js']);
+const GIT_READ_ONLY = new Set(['diff', 'log', 'show', 'status', 'check-ignore', 'ls-files', 'ls-tree', 'blame', 'rev-parse', 'cat-file']);
+/** The only git global options allowed before a read-only subcommand. */
+const GIT_SAFE_GLOBALS = new Set(['--no-pager', '-P', '--no-optional-locks']);
+/** Filters that write only to stdout — safe as a pipe sink, in the forms isPipeFilter allows. */
+const FILTERS = new Set(['sort', 'uniq', 'cut', 'tr']);
+/** A command word with a `/` counts only from these dirs: `./cat` or `/tmp/evil/jq` is not `cat` / `jq`. */
+const SYSTEM_BIN = new Set(['/usr/bin', '/bin', '/usr/local/bin', '/opt/homebrew/bin']);
+/** Characters that let the shell build a word the guard cannot read: expansions, braces, globs. */
+const OPAQUE_WORD = /[$*?[{]/;
+/** Is `word` the long option `--<one of names>`, or an abbreviation of one at least `min` chars long? */
+const longOpt = (names, min) => (word) => {
+    const m = /^--([^=]+)/.exec(word);
+    return !!m && names.some((n) => n === m[1] || (m[1].length >= min && n.startsWith(m[1])));
+};
+/** Options that make an otherwise read-only command run a program or write a file. */
+const UNSAFE_OPT = {
+    rg: (w) => /^--(?:pre|hostname-bin)(?:=|$)/.test(w),
+    git: longOpt(['output', 'ext-diff', 'textconv'], 2),
+    // `grep` may be ugrep: --filter runs programs, --save-config writes, --pager / --view run one, --config / ---FILE load those
+    grep: (w) => w.startsWith('---') || longOpt(['filter', 'save-config', 'pager', 'view', 'config'], 3)(w),
+};
+const trustedWords = (seg) => !seg.assigns.length && !seg.words.some((w) => OPAQUE_WORD.test(w))
+    && (!seg.cmdPath.includes('/') || SYSTEM_BIN.has(path.posix.dirname(seg.cmdPath)));
+/** `$(…)`, backticks, `<(…)`, `>(…)`: a command's output becomes another command's words. */
+const SUBSTITUTION = /\$\(|`|[<>]\(/;
+/** Commands that change shell state a later command on the line obeys. */
+const SHELL_STATE = new Set([
+    'export', 'declare', 'typeset', 'local', 'readonly', 'set', 'setopt', 'shopt', 'alias', 'unalias', 'hash', 'unset',
+    'read', 'enable', 'builtin', 'trap', 'source', '.', 'eval', 'function',
+]);
+/** `name() {` / `name() (` — a function definition (`function name` is caught by SHELL_STATE). */
+const FUNCTION_DEF = /(?:^|[\s;&|])[\w.:-]+\s*\(\s*\)\s*[{(]/;
+/** May any read-only segment of this line keep its exemption? */
+function lineKeepsReadOnlyExemption(command, segs) {
+    return !SUBSTITUTION.test(command) && !FUNCTION_DEF.test(command)
+        && !segs.some((s) => s.assigns.length || SHELL_STATE.has(s.cmd));
+}
+/** `node -e` / `node -p` whose script can only read: no write/exec API, no computed access, no escapes. */
+const NODE_EVAL_FLAGS = new Set(['-e', '-p', '--eval', '--print']);
+const NODE_UNSAFE = new RegExp([
+    '[`\\[\\\\]', // template literals, computed property access, string escapes
+    'flag', // `readFileSync(p, { flag: 'w' })` truncates p
+    'write', 'append', '\\brm', 'unlink', 'rename', 'copy', '\\bcp', 'mkd', 'truncate', 'stream', 'open', 'link',
+    'chmod', 'chown', 'utime', 'exec', 'spawn', 'fork', 'child', 'eval', 'function', 'import', 'constructor',
+    'proto', 'reflect', 'proxy', 'global', 'process', 'module', 'object', 'concat', '\\bvm\\b', 'worker', 'binding',
+].join('|'), 'i');
+const SAFE_REQUIRE = /\brequire\(\s*(['"])(?:(?:node:)?(?:fs|path)|[./][^'"]*\.json)\1\s*\)/g;
+function isReadOnlyNodeEval(args) {
+    if (args.length !== 2 || !NODE_EVAL_FLAGS.has(args[0]))
+        return false;
+    const script = args[1];
+    return !NODE_UNSAFE.test(script) && !/\brequire\b/.test(script.replace(SAFE_REQUIRE, ''));
+}
+/** `git [--no-pager|-P|--no-optional-locks]… <read-only subcommand> …` — anchored, no other global option. */
+function isReadOnlyGit(words) {
+    let k = 0;
+    while (GIT_SAFE_GLOBALS.has(words[k]))
+        k++;
+    return GIT_READ_ONLY.has(words[k] ?? '');
+}
+/** Does this segment only read? (`words` holds its arguments and redirection targets.) */
+function isReadOnlySegment(seg) {
+    if (!seg.cmd || !trustedWords(seg))
+        return false;
+    const unsafe = UNSAFE_OPT[seg.cmd];
+    if (unsafe && seg.words.some(unsafe))
+        return false;
+    if (seg.cmd === 'git')
+        return isReadOnlyGit(seg.words);
+    if (seg.cmd === 'node')
+        return isReadOnlyNodeEval(seg.words);
+    return READ_ONLY.has(seg.cmd);
+}
+/** A pipe sink that cannot act on what it reads: a read-only command, or a stdout-only filter. */
+function isPipeFilter(seg) {
+    if (isReadOnlySegment(seg))
+        return true;
+    if (!FILTERS.has(seg.cmd) || !trustedWords(seg))
+        return false;
+    // `sort -o out` / `--compress-program=…` (any `--o…` / `--c…` abbreviation) write or run; `uniq in out` writes its second operand.
+    if (seg.cmd === 'sort')
+        return !seg.words.some((w) => /^(?:-[^-]*o|--[oc])/.test(w));
+    if (seg.cmd === 'uniq')
+        return seg.words.every((w) => w.startsWith('-'));
+    return true; // cut, tr: operands are inputs or character sets
+}
+/** Does everything downstream of segment `i` in its pipeline only read / filter? */
+function pipelineStaysReadOnly(segs, i) {
+    for (let j = i; segs[j]?.pipesTo; j++) {
+        const next = segs[j + 1];
+        if (!next || !isPipeFilter(next))
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=bash-read-only-segment.js.map

package/dist/hooks/bash-read-only-segment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash-read-only-segment.js","sourceRoot":"","sources":["../../src/hooks/bash-read-only-segment.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyEA,gEAGC;AAaD,gDAIC;AAUD,8CAOC;AAaD,sDAMC;AAjID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,2CAA6B;AAG7B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1H,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAC1I,yEAAyE;AACzE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAC9E,iGAAiG;AACjG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAEvD,4GAA4G;AAC5G,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AACxF,mGAAmG;AACnG,MAAM,WAAW,GAAG,SAAS,CAAC;AAE9B,yGAAyG;AACzG,MAAM,OAAO,GAAG,CAAC,KAAe,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,IAAY,EAAW,EAAE;IAC1E,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC,CAAC;AACF,sFAAsF;AACtF,MAAM,UAAU,GAA8C;IAC5D,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,GAAG,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;IACnD,6HAA6H;IAC7H,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;CACxG,CAAC;AACF,MAAM,YAAY,GAAG,CAAC,GAAgB,EAAW,EAAE,CACjD,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;OAC/D,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAErF,6FAA6F;AAC7F,MAAM,YAAY,GAAG,eAAe,CAAC;AACrC,0EAA0E;AAC1E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO;IAClH,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU;CACvE,CAAC,CAAC;AACH,kGAAkG;AAClG,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAE9D,iEAAiE;AACjE,SAAgB,0BAA0B,CAAC,OAAe,EAAE,IAAmB;IAC7E,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;WAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,2GAA2G;AAC3G,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AACnE,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC;IAC7B,YAAY,EAAE,8DAA8D;IAC5E,MAAM,EAAE,+CAA+C;IACvD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM;IAC5G,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa;IACxG,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS;CAChH,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AAClB,MAAM,YAAY,GAAG,wEAAwE,CAAC;AAE9F,SAAgB,kBAAkB,CAAC,IAAc;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,8GAA8G;AAC9G,SAAS,aAAa,CAAC,KAAe;IACpC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,CAAC,EAAE,CAAC;IAC3C,OAAO,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,0FAA0F;AAC1F,SAAgB,iBAAiB,CAAC,GAAgB;IAChD,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM;QAAE,OAAO,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7D,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,kGAAkG;AAClG,SAAS,YAAY,CAAC,GAAgB;IACpC,IAAI,iBAAiB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,mIAAmI;IACnI,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,CAAG,iDAAiD;AAClE,CAAC;AAED,oFAAoF;AACpF,SAAgB,qBAAqB,CAAC,IAAmB,EAAE,CAAS;IAClE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/hooks/bash-write-targets.d.ts

@@ -2,14 +2,24 @@
 export interface BashSegment {
     /** The command name (basename, after env assignments and wrappers like `sudo`), or ''. */
     cmd: string;
+    /** The command word as written (`./cat`, `/usr/bin/grep`, `cat`). */
+    cmdPath: string;
     /** Its arguments, and every redirection target, as written. */
     words: string[];
     /** The directory it runs in — a preceding `cd` in the same line is followed. */
     dir: string;
-    /** Absolute paths it writes via redirection, `tee` or `sed -i`. */
+    /** Absolute paths it writes via redirection, `tee`, `sed -i` or `git … --output`. */
     writes: string[];
+    /** False once a `cd` / `pushd` / `popd` on the line went somewhere the guard cannot resolve. */
+    dirKnown: boolean;
+    /** It writes a relative path while `dirKnown` is false — the guard cannot tell where. */
+    writesInUnknownDir: boolean;
+    /** Leading `NAME=value` assignments (a lone `X=…` is a segment too, with cmd ''). */
+    assigns: string[];
+    /** Its stdout feeds the next segment through `|`. */
+    pipesTo: boolean;
 }
 export declare function bashSegments(command: string, cwd: string): BashSegment[];
-/** Absolute paths the command writes via redirection, `tee` or `sed -i`, resolved against `cwd`. */
+/** Absolute paths the command writes via redirection, `tee`, `sed -i` or `git --output`, resolved against `cwd`. */
 export declare function bashWriteTargets(command: string, cwd: string): string[];
 //# sourceMappingURL=bash-write-targets.d.ts.map

package/dist/hooks/bash-write-targets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bash-write-targets.d.ts","sourceRoot":"","sources":["../../src/hooks/bash-write-targets.ts"],"names":[],"mappings":"AAwDA,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,0FAA0F;IAC1F,GAAG,EAAE,MAAM,CAAC;IACZ,+DAA+D;IAC/D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,EAAE,CAmCxE;AAED,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvE"}
+{"version":3,"file":"bash-write-targets.d.ts","sourceRoot":"","sources":["../../src/hooks/bash-write-targets.ts"],"names":[],"mappings":"AAmGA,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,0FAA0F;IAC1F,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,gGAAgG;IAChG,QAAQ,EAAE,OAAO,CAAC;IAClB,yFAAyF;IACzF,kBAAkB,EAAE,OAAO,CAAC;IAC5B,qFAAqF;IACrF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAC;CAClB;AAsBD,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,EAAE,CAgDxE;AAED,oHAAoH;AACpH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvE"}