@tokenfactory/acc-runner 0.12.0 → 0.16.0

package/dist/github-client.js

@@ -0,0 +1,234 @@
+/**
+ * v0.53 T-53-4 — runner-side, budget-aware GitHub REST client.
+ *
+ * A port of the api/ side's `api/_lib/github-client.ts` (T-52-4) into the
+ * runner package. The runner CANNOT import api/ code (separate build, no
+ * shared module graph), so the pattern is reproduced here. The three
+ * behaviours match the server client 1:1:
+ *
+ *   1. Quota tracking — x-ratelimit-remaining / x-ratelimit-reset per
+ *      resource (core, search, graphql, …) from every response, surfaced
+ *      via getQuotaSnapshot() for `acc-runner doctor`.
+ *
+ *   2. Secondary-limit backoff — a 429, or a 403 carrying retry-after /
+ *      x-ratelimit-remaining: 0, is a rate-limit response, not an answer.
+ *      The client sleeps once (retry-after if given, else an exponential
+ *      base, both jittered, capped at MAX_BACKOFF_MS) and retries once. A
+ *      second rate-limit response — or a retry-after beyond the cap —
+ *      surfaces as a typed RateLimitedError.
+ *
+ *   3. Per-task-execution soft budget — runTask arms a budget at the top
+ *      of a task (startTaskGithubBudget) and disarms it in its finally
+ *      (endTaskGithubBudget). Once the budget is spent, every further
+ *      githubFetch throws GithubBudgetExceededError WITHOUT hitting the
+ *      network. The caller treats this as a CLEAN, RETRYABLE infra failure
+ *      — NOT a code failure: it never reaches classifyClaudeExit, so the
+ *      runner is never quarantined for exhausting its GitHub budget.
+ *
+ * ── Coverage note (READ THIS) ──────────────────────────────────────────
+ * As of v0.53 the runner makes ALL of its GitHub calls through the `gh`
+ * CLI (see gh.ts, runtime/conflict-resolver.ts, runtime/rework.ts,
+ * runtime/reviewer.ts). Those `gh`/`gh api` invocations are SEPARATE
+ * processes with their own rate-limit handling and are out of scope for
+ * this client — they remain UNCOVERED by the budget/backoff here. This
+ * module is the sanctioned wrapper for any future *direct* REST call the
+ * runner adds (`fetch` against api.github.com); routing such calls through
+ * githubFetch is what keeps them budget- and rate-limit-aware.
+ *
+ * Reference: api/_lib/github-client.ts, planning/ACC_WORKFLOW_GAP_ANALYSIS.md §G13.
+ */
+/** Soft per-task-execution call budget. */
+export const DEFAULT_TASK_GITHUB_BUDGET = 50;
+/**
+ * Longest single backoff sleep. A secondary-limit retry-after can be 60s+;
+ * sleeping that long inside a task run wastes wall-clock the operator is
+ * paying for, so anything above the cap skips the retry and throws
+ * RateLimitedError instead.
+ */
+export const MAX_BACKOFF_MS = 15_000;
+/** Base for the exponential backoff when GitHub sends no retry-after. */
+export const BASE_BACKOFF_MS = 2_000;
+/**
+ * Typed rate-limit failure: GitHub said "back off" twice in a row (or
+ * asked for a longer wait than we can afford). A rate-limit storm is then
+ * diagnosable instead of looking like random github_http_403 noise. This
+ * is a RETRYABLE INFRA failure — see isRetryableGithubError.
+ */
+export class RateLimitedError extends Error {
+    status;
+    resource;
+    /** ISO timestamp the quota window resets at, when GitHub said. */
+    reset_at;
+    retry_after_s;
+    constructor(opts) {
+        super(`github rate limited (${opts.status})` +
+            (opts.resource ? ` on ${opts.resource}` : "") +
+            (opts.reset_at ? `, resets ${opts.reset_at}` : ""));
+        this.name = "RateLimitedError";
+        this.status = opts.status;
+        this.resource = opts.resource;
+        this.reset_at = opts.reset_at;
+        this.retry_after_s = opts.retry_after_s;
+    }
+}
+/**
+ * Soft-budget exhaustion. NOT a code failure: the task simply did as much
+ * direct GitHub work as one task execution is allowed. The caller should
+ * surface it as a clean, RETRYABLE infra failure and NEVER feed it to the
+ * claude-exit classifier (which would quarantine the runner).
+ */
+export class GithubBudgetExceededError extends Error {
+    used;
+    budget;
+    constructor(used, budget) {
+        super(`github task budget exhausted (${used}/${budget} calls)`);
+        this.name = "GithubBudgetExceededError";
+        this.used = used;
+        this.budget = budget;
+    }
+}
+/**
+ * v0.53 T-53-4: both client failure modes are retryable infra conditions,
+ * not task/code failures. The contract the runner relies on: an error for
+ * which this returns true must surface as `phase: "github"` / retryable and
+ * MUST NOT set `quarantine_cause` — i.e. it is classifier-neutral and never
+ * benches the runner.
+ */
+export function isRetryableGithubError(err) {
+    return err instanceof RateLimitedError || err instanceof GithubBudgetExceededError;
+}
+// ── Module state (per process) ───────────────────────────────────────────────
+const quotaByResource = new Map();
+let usedThisTask = 0;
+let taskBudget = null;
+/**
+ * Begin a budgeted task execution: resets the per-task counter and arms the
+ * soft budget. runTask calls this at the top of a task; the explicit reset
+ * also re-baselines a long-lived watch process between tasks.
+ */
+export function startTaskGithubBudget(budget = DEFAULT_TASK_GITHUB_BUDGET) {
+    usedThisTask = 0;
+    taskBudget = budget;
+}
+/**
+ * End a budgeted task execution: disarms the soft budget so any direct REST
+ * call made OUTSIDE a task run (e.g. doctor) is unbudgeted. Idempotent.
+ */
+export function endTaskGithubBudget() {
+    taskBudget = null;
+}
+export function getQuotaSnapshot() {
+    let min = null;
+    const resources = {};
+    for (const [name, q] of quotaByResource) {
+        resources[name] = { ...q };
+        if (q.remaining !== null &&
+            (min === null || min.remaining === null || q.remaining < min.remaining)) {
+            min = q;
+        }
+    }
+    return {
+        remaining: min?.remaining ?? null,
+        reset_at: min?.reset_at ?? null,
+        used_this_task: usedThisTask,
+        resources,
+    };
+}
+/** Test seam: wipe quota/budget state between unit tests. */
+export function resetGithubClientStateForTests() {
+    quotaByResource.clear();
+    usedThisTask = 0;
+    taskBudget = null;
+}
+function recordRateLimitHeaders(res) {
+    const remainingRaw = res.headers.get("x-ratelimit-remaining");
+    const resetRaw = res.headers.get("x-ratelimit-reset");
+    if (remainingRaw === null && resetRaw === null)
+        return;
+    const resource = res.headers.get("x-ratelimit-resource") ?? "core";
+    const remaining = remainingRaw !== null && remainingRaw !== "" ? Number(remainingRaw) : NaN;
+    const resetEpochS = resetRaw !== null && resetRaw !== "" ? Number(resetRaw) : NaN;
+    quotaByResource.set(resource, {
+        remaining: Number.isFinite(remaining) ? remaining : null,
+        reset_at: Number.isFinite(resetEpochS)
+            ? new Date(resetEpochS * 1000).toISOString()
+            : null,
+    });
+}
+/**
+ * A 429 is always "back off". A 403 is only a rate limit when it carries
+ * retry-after (secondary limit) or x-ratelimit-remaining: 0 (primary limit
+ * exhausted) — a plain 403 is a permissions error and passes through.
+ */
+function isRateLimitResponse(res) {
+    if (res.status === 429)
+        return true;
+    if (res.status !== 403)
+        return false;
+    if (res.headers.get("retry-after") !== null)
+        return true;
+    return res.headers.get("x-ratelimit-remaining") === "0";
+}
+function toRateLimitedError(res) {
+    const retryAfterRaw = res.headers.get("retry-after");
+    const retryAfter = retryAfterRaw !== null ? Number(retryAfterRaw) : NaN;
+    const resetRaw = res.headers.get("x-ratelimit-reset");
+    const resetEpochS = resetRaw !== null ? Number(resetRaw) : NaN;
+    return new RateLimitedError({
+        status: res.status,
+        resource: res.headers.get("x-ratelimit-resource"),
+        reset_at: Number.isFinite(resetEpochS)
+            ? new Date(resetEpochS * 1000).toISOString()
+            : null,
+        retry_after_s: Number.isFinite(retryAfter) ? retryAfter : null,
+    });
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Authenticated GitHub REST fetch. The caller supplies whatever token is
+ * appropriate (the runner uses the operator's own gh/git credentials for
+ * CLI calls; a direct REST consumer would pass a token it already holds).
+ * An empty token sends an anonymous request rather than `Bearer <empty>`.
+ */
+export async function githubFetch(url, token, init = {}, deps = {}) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const sleep = deps.sleep ?? defaultSleep;
+    const random = deps.random ?? Math.random;
+    const headers = new Headers(init.headers);
+    if (token)
+        headers.set("Authorization", `Bearer ${token}`);
+    if (!headers.has("Accept")) {
+        headers.set("Accept", "application/vnd.github+json");
+    }
+    headers.set("X-GitHub-Api-Version", "2022-11-28");
+    headers.set("User-Agent", "acc-runner");
+    const doFetch = async () => {
+        if (taskBudget !== null && usedThisTask >= taskBudget) {
+            throw new GithubBudgetExceededError(usedThisTask, taskBudget);
+        }
+        usedThisTask++;
+        const res = await fetchImpl(url, { ...init, headers });
+        recordRateLimitHeaders(res);
+        return res;
+    };
+    const first = await doFetch();
+    if (!isRateLimitResponse(first))
+        return first;
+    // Rate limited: sleep jittered-exponential once, retry once.
+    const retryAfterRaw = first.headers.get("retry-after");
+    const retryAfterS = retryAfterRaw !== null ? Number(retryAfterRaw) : NaN;
+    const baseMs = Number.isFinite(retryAfterS) ? retryAfterS * 1000 : BASE_BACKOFF_MS;
+    if (baseMs > MAX_BACKOFF_MS) {
+        // GitHub asked for a longer pause than we want to burn mid-task —
+        // surface the typed error now instead of sleeping into the run.
+        throw toRateLimitedError(first);
+    }
+    await sleep(Math.round(baseMs * (1 + random() * 0.5)));
+    const second = await doFetch();
+    if (!isRateLimitResponse(second))
+        return second;
+    throw toRateLimitedError(second);
+}
+//# sourceMappingURL=github-client.js.map

package/dist/github-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-client.js","sourceRoot":"","sources":["../src/github-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,2CAA2C;AAC3C,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AAErC;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,MAAM,CAAS;IACf,QAAQ,CAAgB;IACjC,kEAAkE;IACzD,QAAQ,CAAgB;IACxB,aAAa,CAAgB;IAEtC,YAAY,IAKX;QACC,KAAK,CACH,wBAAwB,IAAI,CAAC,MAAM,GAAG;YACpC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACrD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,CAAS;IACb,MAAM,CAAS;IAExB,YAAY,IAAY,EAAE,MAAc;QACtC,KAAK,CAAC,iCAAiC,IAAI,IAAI,MAAM,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,OAAO,GAAG,YAAY,gBAAgB,IAAI,GAAG,YAAY,yBAAyB,CAAC;AACrF,CAAC;AAmBD,gFAAgF;AAChF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAyB,CAAC;AACzD,IAAI,YAAY,GAAG,CAAC,CAAC;AACrB,IAAI,UAAU,GAAkB,IAAI,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB,0BAA0B;IAC/E,YAAY,GAAG,CAAC,CAAC;IACjB,UAAU,GAAG,MAAM,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,GAAG,GAAyB,IAAI,CAAC;IACrC,MAAM,SAAS,GAAkC,EAAE,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;QACxC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAC3B,IACE,CAAC,CAAC,SAAS,KAAK,IAAI;YACpB,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,EACvE,CAAC;YACD,GAAG,GAAG,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO;QACL,SAAS,EAAE,GAAG,EAAE,SAAS,IAAI,IAAI;QACjC,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,IAAI;QAC/B,cAAc,EAAE,YAAY;QAC5B,SAAS;KACV,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,8BAA8B;IAC5C,eAAe,CAAC,KAAK,EAAE,CAAC;IACxB,YAAY,GAAG,CAAC,CAAC;IACjB,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAa;IAC3C,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACtD,IAAI,YAAY,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO;IACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,MAAM,CAAC;IACnE,MAAM,SAAS,GACb,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5E,MAAM,WAAW,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAClF,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC5B,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QACxD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YACpC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YAC5C,CAAC,CAAC,IAAI;KACT,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAa;IACxC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAa;IACvC,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/D,OAAO,IAAI,gBAAgB,CAAC;QAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YACpC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YAC5C,CAAC,CAAC,IAAI;QACR,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;KAC/D,CAAC,CAAC;AACL,CAAC;AAUD,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAW,EACX,KAAa,EACb,OAAoB,EAAE,EACtB,OAAwB,EAAE;IAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IAE1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAExC,MAAM,OAAO,GAAG,KAAK,IAAuB,EAAE;QAC5C,IAAI,UAAU,KAAK,IAAI,IAAI,YAAY,IAAI,UAAU,EAAE,CAAC;YACtD,MAAM,IAAI,yBAAyB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAChE,CAAC;QACD,YAAY,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;IAC9B,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE9C,6DAA6D;IAC7D,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;IACnF,IAAI,MAAM,GAAG,cAAc,EAAE,CAAC;QAC5B,kEAAkE;QAClE,gEAAgE;QAChE,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IAEvD,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;IAC/B,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAChD,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC"}

package/dist/runtime/cache-dir.d.ts

@@ -0,0 +1,2 @@
+export declare function cacheDir(): string;
+//# sourceMappingURL=cache-dir.d.ts.map

package/dist/runtime/cache-dir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-dir.d.ts","sourceRoot":"","sources":["../../src/runtime/cache-dir.ts"],"names":[],"mappings":"AAWA,wBAAgB,QAAQ,IAAI,MAAM,CAKjC"}

package/dist/runtime/cache-dir.js

@@ -0,0 +1,15 @@
+/**
+ * v0.14.0 (T-54-2): single source of truth for the runner cache root.
+ *
+ * `quarantine.ts` already honoured ACC_RUNNER_CACHE_DIR inline; the
+ * singleton-lock and last-task-env modules added in this release reuse the
+ * same resolution so tests can point all cache state at a tmpdir with one
+ * env var. Defaults to ~/.cache/acc-runner (unchanged from prior releases).
+ */
+import os from "node:os";
+import path from "node:path";
+export function cacheDir() {
+    return (process.env.ACC_RUNNER_CACHE_DIR?.trim() ||
+        path.join(os.homedir(), ".cache", "acc-runner"));
+}
+//# sourceMappingURL=cache-dir.js.map

package/dist/runtime/cache-dir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-dir.js","sourceRoot":"","sources":["../../src/runtime/cache-dir.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,UAAU,QAAQ;IACtB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE;QACxC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,CAChD,CAAC;AACJ,CAAC"}

package/dist/runtime/quarantine.d.ts

@@ -4,6 +4,16 @@ export interface QuarantineState {
     classifiedAt: string;
     taskId: string;
     detail: string;
+    /**
+     * v0.53 T-53-4: how many consecutive instant-empty (heuristic) claude
+     * exits triggered the quarantine. Cache-schema additive — older readers
+     * ignore it; the keychain entry schema and the runner protocol message
+     * shapes are untouched. Definitive machine failures (dyld, exit 127,
+     * usage/auth patterns) record 1; a heuristic env_broken records 2 (the
+     * task-runner only quarantines after the retry also exits instantly).
+     * Optional so a state written by a pre-0.53 runner still parses.
+     */
+    consecutive?: number;
 }
 /** Path to the quarantine sentinel file. Configurable via ACC_RUNNER_CACHE_DIR for tests. */
 export declare function quarantineFile(): string;

package/dist/runtime/quarantine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quarantine.d.ts","sourceRoot":"","sources":["../../src/runtime/quarantine.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,6FAA6F;AAC7F,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,0EAA0E;AAC1E,wBAAsB,aAAa,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAQrE;AAED,oEAAoE;AACpE,wBAAsB,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzE;AAED,yEAAyE;AACzE,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD"}
+{"version":3,"file":"quarantine.d.ts","sourceRoot":"","sources":["../../src/runtime/quarantine.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,6FAA6F;AAC7F,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,0EAA0E;AAC1E,wBAAsB,aAAa,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAQrE;AAED,oEAAoE;AACpE,wBAAsB,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzE;AAED,yEAAyE;AACzE,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD"}

package/dist/runtime/quarantine.js.map

@@ -1 +1 @@
-{"version":3,"file":"quarantine.js","sourceRoot":"","sources":["../../src/runtime/quarantine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAU7B,6FAA6F;AAC7F,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE;QACtC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,EACjD,iBAAiB,CAClB,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAsB;IACxD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC"}
+{"version":3,"file":"quarantine.js","sourceRoot":"","sources":["../../src/runtime/quarantine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAoB7B,6FAA6F;AAC7F,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE;QACtC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,EACjD,iBAAiB,CAClB,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAsB;IACxD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC"}

package/dist/runtime/resolution-integrity.d.ts

@@ -0,0 +1,86 @@
+export type IntegrityAssertion = "conflict_markers" | "typecheck" | "version_regression" | "changelog_missing";
+export interface IntegrityFailure {
+    assertion: IntegrityAssertion;
+    /** Human-readable, log-safe (no secrets) explanation of the failure. */
+    detail: string;
+    /** Offending tracked files, when the assertion is file-scoped. */
+    files?: string[];
+}
+export interface ResolutionIntegrityResult {
+    ok: boolean;
+    /** Assertions that actually ran (version checks skip when nothing changed). */
+    checked: IntegrityAssertion[];
+    failures: IntegrityFailure[];
+}
+/** A package.json / CHANGELOG.md pair to version-check, relative to workdir. */
+export interface VersionTarget {
+    packageJsonPath: string;
+    changelogPath: string;
+}
+export interface AssertResolutionOptions {
+    /**
+     * Base ref the resolution should not regress against (e.g. the integration
+     * branch). When omitted, or when the base file can't be read, the version
+     * assertion is skipped — never false-failed.
+     */
+    baseRef?: string;
+    /** Typecheck command (defaults to `pnpm typecheck`). */
+    typecheckCmd?: string;
+    /**
+     * package.json / CHANGELOG.md pairs to version-check. Defaults to the repo
+     * root pair. The runner passes the acc-runner package pair (the #496 site).
+     */
+    versionTargets?: VersionTarget[];
+}
+export interface ResolutionIntegrityDeps {
+    /** Tracked files still carrying a conflict marker. Default: `git grep`. */
+    findConflictMarkers?: (workdir: string) => Promise<string[]>;
+    /** Run the typecheck command. Default: spawn `pnpm typecheck` in workdir. */
+    runTypecheck?: (workdir: string, cmd: string) => Promise<{
+        ok: boolean;
+        output: string;
+    }>;
+    /** Resolved (post-resolution, on-disk) version for a target, or null. */
+    readResolvedVersion?: (workdir: string, target: VersionTarget) => Promise<string | null>;
+    /** Base-ref version for a target, or null when unreadable (→ skip check). */
+    readBaseVersion?: (workdir: string, baseRef: string, target: VersionTarget) => Promise<string | null>;
+    /** CHANGELOG.md text for a target, or null when absent. */
+    readChangelog?: (workdir: string, target: VersionTarget) => Promise<string | null>;
+}
+/**
+ * Conflict-marker line shape: 7 of the same marker char at the start of a
+ * line. `<<<<<<<` and `>>>>>>>` are unambiguous; the `=======` divider is
+ * matched only as a whole line so a 7-equals markdown rule plus trailing text
+ * does not trip it.
+ */
+export declare const CONFLICT_MARKER_RE: RegExp;
+export declare function textHasConflictMarker(text: string): boolean;
+/** Semver compare (a-b sign); tolerant of pre-release/build suffixes. */
+export declare function cmpSemver(a: string, b: string): number;
+/**
+ * True when `changelog` carries an entry for `version`. The version must
+ * appear bounded by non-version characters so 0.14.0 does not match inside
+ * 0.14.00 or 10.14.0.
+ */
+export declare function changelogMentionsVersion(changelog: string, version: string): boolean;
+export declare const DEFAULT_VERSION_TARGET: VersionTarget;
+/**
+ * Assert that a conflict resolution in `workdir` is shippable. Returns a
+ * structured result; `ok === false` means the caller MUST reject the
+ * resolution (do not push, do not mark resolved).
+ */
+export declare function assertResolutionIntegrity(workdir: string, opts?: AssertResolutionOptions, deps?: ResolutionIntegrityDeps): Promise<ResolutionIntegrityResult>;
+/**
+ * True when a task that reaches the worktree/push path is a conflict
+ * resolution and must clear the integrity guardrail. `conflict_resolution`
+ * task types are handled mechanically upstream and never reach the push path,
+ * so the live signal here is the title an operator/manager files when the
+ * mechanical resolver bails and a Claude session takes over the merge.
+ */
+export declare function isConflictResolutionTask(task: {
+    type?: string | null;
+    title?: string | null;
+}): boolean;
+/** One-line, log-safe summary of which assertions failed. */
+export declare function summariseFailures(failures: IntegrityFailure[]): string;
+//# sourceMappingURL=resolution-integrity.d.ts.map

package/dist/runtime/resolution-integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolution-integrity.d.ts","sourceRoot":"","sources":["../../src/runtime/resolution-integrity.ts"],"names":[],"mappings":"AAsCA,MAAM,MAAM,kBAAkB,GAC1B,kBAAkB,GAClB,WAAW,GACX,oBAAoB,GACpB,mBAAmB,CAAC;AAExB,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,kBAAkB,CAAC;IAC9B,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,+EAA+E;IAC/E,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7D,6EAA6E;IAC7E,YAAY,CAAC,EAAE,CACb,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,KACR,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,CACpB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,aAAa,KAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,CAChB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,aAAa,KAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,aAAa,CAAC,EAAE,CACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,aAAa,KAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC7B;AAMD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAsC,CAAC;AAEtE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,yEAAyE;AACzE,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQtD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAGT;AAED,eAAO,MAAM,sBAAsB,EAAE,aAGpC,CAAC;AAqGF;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,uBAA4B,EAClC,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,yBAAyB,CAAC,CAgFpC;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAIV;AAED,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAEtE"}

package/dist/runtime/resolution-integrity.js

@@ -0,0 +1,248 @@
+/**
+ * v0.57 T-57-2: Conflict-resolution integrity guardrail.
+ *
+ * A reusable post-resolution assertion the conflict-resolution path MUST pass
+ * before a resolution is declared complete / pushed. It exists because agent
+ * conflict resolutions in v0.55–v0.56 repeatedly shipped broken merges that
+ * were still marked "resolved":
+ *   - spliced blocks left stale variable names (task-runner.ts) → CI typecheck
+ *     failure that the runner never re-checked;
+ *   - duplicate declarations (health.ts) → same;
+ *   - a silently dropped version bump (#496 reverted package.json
+ *     0.14.0 → 0.13.0) → a version REGRESSION nobody noticed.
+ *
+ * The guardrail re-verifies the resolution from the runner's own vantage point
+ * (it never trusts the agent's self-reported gate results):
+ *   1. ZERO git conflict markers remain in any tracked file
+ *      (<<<<<<< / ======= / >>>>>>>).
+ *   2. `pnpm typecheck` passes.
+ *   3. If a package.json "version" changed in the resolution, it only moved
+ *      FORWARD (semver-greater than the base, never a regression) AND
+ *      CHANGELOG.md carries a matching entry for the new version.
+ *
+ * On ANY failure the caller MUST reject the resolution: do not push, do not
+ * mark the task resolved; keep it actionable and emit a diagnostic naming the
+ * failed assertion. The default implementations shell out to `git` / `pnpm`,
+ * but every I/O boundary is an injectable dep so the three incident replays
+ * (version regression, stale-var typecheck fail, marker-left-behind) can be
+ * driven without a real worktree.
+ */
+import path from "node:path";
+import fs from "node:fs/promises";
+import { execa } from "execa";
+import { buildEnv } from "../bin-resolve.js";
+// ─────────────────────────────────────────────────────────────────────────────
+// Pure helpers (exported for direct unit coverage)
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Conflict-marker line shape: 7 of the same marker char at the start of a
+ * line. `<<<<<<<` and `>>>>>>>` are unambiguous; the `=======` divider is
+ * matched only as a whole line so a 7-equals markdown rule plus trailing text
+ * does not trip it.
+ */
+export const CONFLICT_MARKER_RE = /^(?:<{7}|>{7})(?:$|\s)|^={7}\s*$/m;
+export function textHasConflictMarker(text) {
+    return CONFLICT_MARKER_RE.test(text);
+}
+/** Semver compare (a-b sign); tolerant of pre-release/build suffixes. */
+export function cmpSemver(a, b) {
+    const parts = (s) => s.split(/[.+-]/).map((x) => Number(x) || 0);
+    const [pa, pb] = [parts(a), parts(b)];
+    const len = Math.max(pa.length, pb.length);
+    for (let i = 0; i < len; i++) {
+        if ((pa[i] ?? 0) !== (pb[i] ?? 0))
+            return (pa[i] ?? 0) - (pb[i] ?? 0);
+    }
+    return 0;
+}
+/**
+ * True when `changelog` carries an entry for `version`. The version must
+ * appear bounded by non-version characters so 0.14.0 does not match inside
+ * 0.14.00 or 10.14.0.
+ */
+export function changelogMentionsVersion(changelog, version) {
+    const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`(^|[^0-9.])${escaped}([^0-9.]|$)`, "m").test(changelog);
+}
+export const DEFAULT_VERSION_TARGET = {
+    packageJsonPath: "package.json",
+    changelogPath: "CHANGELOG.md",
+};
+// ─────────────────────────────────────────────────────────────────────────────
+// Default I/O implementations
+// ─────────────────────────────────────────────────────────────────────────────
+async function defaultFindConflictMarkers(workdir) {
+    // `git grep` only scans tracked files. -I skips binaries, -l lists names.
+    // -E with the three marker forms; `=======` constrained to a lone line via
+    // the `\$` anchors git's POSIX-ERE understands.
+    const patterns = ["^<<<<<<<", "^>>>>>>>", "^=======$"];
+    const args = ["grep", "-I", "-l", "-E"];
+    for (let i = 0; i < patterns.length; i++) {
+        args.push(i === 0 ? "-e" : "-e", patterns[i]);
+    }
+    // `--` guards against a pattern being read as a pathspec.
+    args.push("--");
+    const { stdout, exitCode } = await execa("git", args, {
+        cwd: workdir,
+        env: buildEnv(),
+        reject: false,
+    });
+    // git grep exits 1 when there are no matches — that's the clean case.
+    if (exitCode === 1)
+        return [];
+    return stdout
+        .split(/\r?\n/)
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0);
+}
+async function defaultRunTypecheck(workdir, cmd) {
+    const result = await execa(cmd, {
+        cwd: workdir,
+        env: buildEnv(),
+        shell: true,
+        reject: false,
+    });
+    const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`.trim();
+    return { ok: result.exitCode === 0, output };
+}
+async function readJsonVersion(text) {
+    if (text === null)
+        return null;
+    try {
+        const v = JSON.parse(text).version;
+        return typeof v === "string" ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function defaultReadResolvedVersion(workdir, target) {
+    try {
+        const text = await fs.readFile(path.join(workdir, target.packageJsonPath), "utf8");
+        return readJsonVersion(text);
+    }
+    catch {
+        return null;
+    }
+}
+async function defaultReadBaseVersion(workdir, baseRef, target) {
+    try {
+        const { stdout, exitCode } = await execa("git", ["show", `${baseRef}:${target.packageJsonPath}`], { cwd: workdir, env: buildEnv(), reject: false });
+        if (exitCode !== 0)
+            return null;
+        return readJsonVersion(stdout);
+    }
+    catch {
+        return null;
+    }
+}
+async function defaultReadChangelog(workdir, target) {
+    try {
+        return await fs.readFile(path.join(workdir, target.changelogPath), "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// The guardrail
+// ─────────────────────────────────────────────────────────────────────────────
+const OUTPUT_TAIL = 2000;
+/**
+ * Assert that a conflict resolution in `workdir` is shippable. Returns a
+ * structured result; `ok === false` means the caller MUST reject the
+ * resolution (do not push, do not mark resolved).
+ */
+export async function assertResolutionIntegrity(workdir, opts = {}, deps = {}) {
+    const findConflictMarkers = deps.findConflictMarkers ?? defaultFindConflictMarkers;
+    const runTypecheck = deps.runTypecheck ?? defaultRunTypecheck;
+    const readResolvedVersion = deps.readResolvedVersion ?? defaultReadResolvedVersion;
+    const readBaseVersion = deps.readBaseVersion ?? defaultReadBaseVersion;
+    const readChangelog = deps.readChangelog ?? defaultReadChangelog;
+    const typecheckCmd = opts.typecheckCmd?.trim() || "pnpm typecheck";
+    const targets = opts.versionTargets?.length
+        ? opts.versionTargets
+        : [DEFAULT_VERSION_TARGET];
+    const checked = [];
+    const failures = [];
+    // ── 1. Conflict markers ────────────────────────────────────────────────────
+    checked.push("conflict_markers");
+    const markerFiles = await findConflictMarkers(workdir);
+    if (markerFiles.length > 0) {
+        failures.push({
+            assertion: "conflict_markers",
+            detail: `unresolved conflict markers remain in ${markerFiles.length} file(s): ${markerFiles.join(", ")}`,
+            files: markerFiles,
+        });
+    }
+    // ── 2. Typecheck ────────────────────────────────────────────────────────────
+    checked.push("typecheck");
+    const tc = await runTypecheck(workdir, typecheckCmd);
+    if (!tc.ok) {
+        failures.push({
+            assertion: "typecheck",
+            detail: `\`${typecheckCmd}\` failed:\n${tc.output.slice(-OUTPUT_TAIL)}`,
+        });
+    }
+    // ── 3. Version-forward + CHANGELOG ──────────────────────────────────────────
+    // Only meaningful when we have a base to compare against.
+    if (opts.baseRef) {
+        let ranVersionCheck = false;
+        let ranChangelogCheck = false;
+        for (const target of targets) {
+            const baseVersion = await readBaseVersion(workdir, opts.baseRef, target);
+            const resolvedVersion = await readResolvedVersion(workdir, target);
+            // Skip silently when either side is unreadable or the file is new on
+            // this side — there is nothing to regress.
+            if (baseVersion === null || resolvedVersion === null)
+                continue;
+            if (baseVersion === resolvedVersion)
+                continue; // no version change → no checks
+            ranVersionCheck = true;
+            if (cmpSemver(resolvedVersion, baseVersion) <= 0) {
+                failures.push({
+                    assertion: "version_regression",
+                    detail: `${target.packageJsonPath} version regressed ${baseVersion} → ${resolvedVersion} ` +
+                        `(must move forward, never backward)`,
+                    files: [target.packageJsonPath],
+                });
+                // A regressed version can't have a forward CHANGELOG entry to require.
+                continue;
+            }
+            // Version moved forward → a matching CHANGELOG entry is mandatory.
+            ranChangelogCheck = true;
+            const changelog = await readChangelog(workdir, target);
+            if (changelog === null || !changelogMentionsVersion(changelog, resolvedVersion)) {
+                failures.push({
+                    assertion: "changelog_missing",
+                    detail: `${target.packageJsonPath} bumped to ${resolvedVersion} but ` +
+                        `${target.changelogPath} has no entry for it`,
+                    files: [target.changelogPath],
+                });
+            }
+        }
+        if (ranVersionCheck)
+            checked.push("version_regression");
+        if (ranChangelogCheck)
+            checked.push("changelog_missing");
+    }
+    return { ok: failures.length === 0, checked, failures };
+}
+/**
+ * True when a task that reaches the worktree/push path is a conflict
+ * resolution and must clear the integrity guardrail. `conflict_resolution`
+ * task types are handled mechanically upstream and never reach the push path,
+ * so the live signal here is the title an operator/manager files when the
+ * mechanical resolver bails and a Claude session takes over the merge.
+ */
+export function isConflictResolutionTask(task) {
+    if (task.type === "conflict_resolution")
+        return true;
+    const title = (task.title ?? "").toLowerCase();
+    return /merge conflict|resolve\s+conflict|conflict\s+resolution/.test(title);
+}
+/** One-line, log-safe summary of which assertions failed. */
+export function summariseFailures(failures) {
+    return failures.map((f) => f.assertion).join(", ");
+}
+//# sourceMappingURL=resolution-integrity.js.map