@vantageos/backend-doctor 0.1.14 → 0.3.0

package/dist/detectors/source/refusal.d.ts

@@ -1,5 +1,19 @@
 import type { Detector } from "../../engine-types.js";
 import { type Scan, type SourceDetectorEntry, type SrcFile } from "./_scan.js";
+/**
+ * The text of every comment in `src`, read by a LEXER rather than by line shape
+ * (Argus REVISE, PR #32 @6b2b6ad). A trailing `// …` after code and a bare line
+ * inside a block comment are comments; a line inside a string or a template
+ * literal is data, even when it starts with `//`. Five states: code, line
+ * comment, block comment, a `'`/`"` string, a template literal.
+ *
+ * Declared limit: a regex literal containing a quote or a backtick (`/"/`,
+ * `` /`/ ``) is read as opening a string. A `'`/`"` state closes at the end of
+ * its line, so the damage stays on that line; a backtick state does not close
+ * at a newline, so a regex literal holding a backtick hides every comment up to
+ * the next backtick. Rare in a handler body; named here, not hidden.
+ */
+export declare function commentsOf(src: string): string;
 export declare function scanR47(files: SrcFile[]): Scan;
 export declare const R47: Detector;
 /** In the form the orchestrator spreads into REGISTRY. */

package/dist/detectors/source/refusal.js

@@ -1,3 +1,4 @@
+import { hasJustificationTokenInText } from "../oracle-axis2.js";
 import { code, emptyScan, isJudgeable, SOURCE_STANDARD_PIN, srcDetector, } from "./_scan.js";
 // a read-only query opener — the function class R-47 governs.
 const QUERY_OPEN = /\b(?:internalQuery|query)\s*\(/;
@@ -55,6 +56,62 @@ function queryBlock(lines, i) {
     }
     return { lines: body, unterminated: seenOpen };
 }
+/**
+ * The text of every comment in `src`, read by a LEXER rather than by line shape
+ * (Argus REVISE, PR #32 @6b2b6ad). A trailing `// …` after code and a bare line
+ * inside a block comment are comments; a line inside a string or a template
+ * literal is data, even when it starts with `//`. Five states: code, line
+ * comment, block comment, a `'`/`"` string, a template literal.
+ *
+ * Declared limit: a regex literal containing a quote or a backtick (`/"/`,
+ * `` /`/ ``) is read as opening a string. A `'`/`"` state closes at the end of
+ * its line, so the damage stays on that line; a backtick state does not close
+ * at a newline, so a regex literal holding a backtick hides every comment up to
+ * the next backtick. Rare in a handler body; named here, not hidden.
+ */
+export function commentsOf(src) {
+    let out = "";
+    let state = "code";
+    for (let i = 0; i < src.length; i++) {
+        const c = src[i];
+        const next = src[i + 1];
+        if (state === "code") {
+            if (c === "/" && next === "/") {
+                state = "line";
+                i++;
+            }
+            else if (c === "/" && next === "*") {
+                state = "block";
+                i++;
+            }
+            else if (c === "'" || c === '"' || c === "`") {
+                state = c;
+            }
+        }
+        else if (state === "line") {
+            out += c;
+            if (c === "\n")
+                state = "code";
+        }
+        else if (state === "block") {
+            if (c === "*" && next === "/") {
+                state = "code";
+                i++;
+                out += "\n";
+            }
+            else {
+                out += c;
+            }
+        }
+        else if (c === "\\") {
+            i++;
+        }
+        else if (c === state || (c === "\n" && state !== "`")) {
+            state = "code";
+        }
+    }
+    return out;
+}
 export function scanR47(files) {
     const scan = emptyScan();
     for (const f of files) {
@@ -86,6 +143,11 @@ export function scanR47(files) {
                 .map((l) => l.raw)
                 .join("\n");
             const hasRefusal = REFUSAL.test(blockText);
+            // The justification token is a WRITTEN RECORD, so it is read from the
+            // handler's COMMENTS only, found by a lexer (`commentsOf`), never by line
+            // shape. A string or template literal is executing data and never
+            // justifies (Argus REVISE, PR #32 @515ca1f and @6b2b6ad).
+            const commentText = commentsOf(block.lines.map((l) => l.raw).join("\n"));
             for (const st of statements(block.lines)) {
                 const isUnbounded = COLLECT.test(st.text) && !BOUNDED.test(st.text);
                 if (!isUnbounded)
@@ -106,11 +168,22 @@ export function scanR47(files) {
                         note: `${fn}: wide non-index-bounded scan on "${table}" but the handler carries a REFUSAL path (R-16 error contract naming the narrowing args) — the correct R-47 behaviour (the tasks.list SCAN_CAP_EXCEEDED shape)`,
                     });
                 }
+                else if (hasJustificationTokenInText(commentText)) {
+                    // judgement retired (task k179jnhx, §23): flagged — no refusal path;
+                    // the enclosing handler's written JUSTIFIÉ:/JUSTIFIED: token IS the
+                    // accepted remedy record (refuse / tighter index / declared bound),
+                    // decided by presence, never a person's opinion of which is right.
+                    scan.conform.push({
+                        rel: f.rel,
+                        n: st.n,
+                        note: `${fn}: wide, non-index-bounded \`.query("${table}").collect()\` with NO refusal path, but the handler carries a written JUSTIFIÉ:/JUSTIFIED: token — accepted, not silently passed`,
+                    });
+                }
                 else {
-                    scan.cnj.push({
+                    scan.violate.push({
                         rel: f.rel,
                         n: st.n,
-                        note: `${fn}: wide, non-index-bounded \`.query("${table}").collect()\` in a query with NO refusal path — the read cap can truncate it BEFORE any filter runs, returning a fraction indistinguishable from a full match. The human half is owed: refuse (R-16), add a tighter index, or declare a bound (R-30)? Never a silent green`,
+                        note: `${fn}: wide, non-index-bounded \`.query("${table}").collect()\` in a query with NO refusal path and no written JUSTIFIÉ:/JUSTIFIED: token — the read cap can truncate it BEFORE any filter runs, returning a fraction indistinguishable from a full match. Owes a fix (refuse (R-16) / tighter index / declared bound (R-30)) or a recorded justification`,
                     });
                 }
             }

package/dist/detectors/source/security.d.ts

@@ -25,6 +25,22 @@ export declare function scanR22(files: SrcFile[]): Scan;
 export declare function scanR33(files: SrcFile[]): Scan;
 export declare function scanR34(files: SrcFile[]): Scan;
 export declare function scanR35(files: SrcFile[]): Scan;
+/**
+ * The directories R-36 searches, nearest first: the scanned root, then each
+ * ancestor up to and INCLUDING the git root (the first ancestor holding `.git`).
+ *
+ * The misread this closes: the documented invocation points the doctor at
+ * `<repo>/convex`, while the lockfile and `.github/workflows` are REPOSITORY
+ * artifacts living at the repo root. Reading only `tree.root` reported "no lockfile
+ * — dependencies are not pinned" on a repository with a committed `bun.lock`.
+ *
+ * The walk stops at the git root and never goes above it: a lockfile in some
+ * unrelated parent directory (a home directory, a monorepo host that is not this
+ * repository) does not pin this repository's dependencies. With no `.git` ancestor
+ * at all, only the scanned root itself is read (the pre-fix behaviour) — the walk
+ * is never widened on a guess.
+ */
+export declare function r36SearchDirs(root: string): string[];
 export declare function evalR36(root: string): Scan;
 export declare const R21: Detector;
 export declare const R22: Detector;