@vibe-validate/core 0.14.3 → 0.15.0-rc.1

package/README.md

@@ -41,6 +41,30 @@ const result = await runner.run();
 
 See [TypeScript types](./src/index.ts) for complete API documentation.
 
+## JSON Schema
+
+This package publishes `validate-result.schema.json` for IDE autocomplete and validation of validation result files:
+
+```yaml
+# Version-pinned (recommended)
+$schema: https://unpkg.com/@vibe-validate/core@0.15.0/validate-result.schema.json
+
+# Latest version
+$schema: https://unpkg.com/@vibe-validate/core/validate-result.schema.json
+```
+
+**Use for:**
+- Validation state files stored in git notes
+- History records (`vibe-validate history show`)
+- Custom validation result processing
+
+**Features:**
+- ✅ IDE autocomplete for all ValidationResult properties
+- ✅ Inline validation errors
+- ✅ Type checking for YAML validation results
+
+See [Schema Documentation](../../docs/schemas.md) for complete details.
+
 ## License
 
 MIT © Jeff Dutton

package/dist/index.d.ts

@@ -44,9 +44,15 @@
  *
  * @packageDocumentation
  */
-export type { ValidationStep, ValidationPhase, ValidationConfig, ValidationResult, StepResult, PhaseResult, ExtractionQuality, } from './types.js';
+export type { ValidationStep, ValidationPhase, } from '@vibe-validate/config';
+export type { ValidationResult, StepResult, PhaseResult, OutputFiles, } from './result-schema.js';
+export type { ValidationConfig, } from './runner.js';
 export { runValidation, runStepsInParallel, parseFailures, setupSignalHandlers, } from './runner.js';
-export { stopProcessGroup, } from './process-utils.js';
-export { ValidationResultSchema, StepResultSchema, PhaseResultSchema, safeValidateResult, validateResult, } from './result-schema.js';
+export { stopProcessGroup, spawnCommand, captureCommandOutput, type CaptureCommandOptions, } from './process-utils.js';
+export { ValidationResultSchema, StepResultSchema, PhaseResultSchema, CommandExecutionSchema, OperationMetadataSchema, OutputFilesSchema, safeValidateResult, validateResult, } from './result-schema.js';
+export { createSafeValidator, createStrictValidator, } from './schema-utils.js';
 export { validationResultJsonSchema, generateValidationResultJsonSchema, } from './result-schema-export.js';
+export { parseVibeValidateOutput, type ParsedVibeValidateOutput, } from './run-output-parser.js';
+export type { OutputLine, CapturedOutput, } from './output-capture-schema.js';
+export { OutputLineSchema, CapturedOutputSchema, } from './output-capture-schema.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAGH,YAAY,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAGH,YAAY,EACV,cAAc,EACd,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,WAAW,GACZ,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EACV,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACpB,KAAK,qBAAqB,GAC3B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,GAC9B,MAAM,wBAAwB,CAAC;AAGhC,YAAY,EACV,UAAU,EACV,cAAc,GACf,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -47,9 +47,14 @@
 // Export core runner functions
 export { runValidation, runStepsInParallel, parseFailures, setupSignalHandlers, } from './runner.js';
 // Export process utilities
-export { stopProcessGroup, } from './process-utils.js';
+export { stopProcessGroup, spawnCommand, captureCommandOutput, } from './process-utils.js';
 // Export validation result schema and validators
-export { ValidationResultSchema, StepResultSchema, PhaseResultSchema, safeValidateResult, validateResult, } from './result-schema.js';
+export { ValidationResultSchema, StepResultSchema, PhaseResultSchema, CommandExecutionSchema, OperationMetadataSchema, OutputFilesSchema, safeValidateResult, validateResult, } from './result-schema.js';
+// Export shared schema utilities
+export { createSafeValidator, createStrictValidator, } from './schema-utils.js';
 // Export JSON Schema generation
 export { validationResultJsonSchema, generateValidationResultJsonSchema, } from './result-schema-export.js';
+// Export run output parser (shared by run command and phase runner)
+export { parseVibeValidateOutput, } from './run-output-parser.js';
+export { OutputLineSchema, CapturedOutputSchema, } from './output-capture-schema.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAaH,+BAA+B;AAC/B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,2BAA2B;AAC3B,OAAO,EACL,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAE5B,iDAAiD;AACjD,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B,gCAAgC;AAChC,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAqBH,+BAA+B;AAC/B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,2BAA2B;AAC3B,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAE5B,iDAAiD;AACjD,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B,iCAAiC;AACjC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAE3B,gCAAgC;AAChC,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,2BAA2B,CAAC;AAEnC,oEAAoE;AACpE,OAAO,EACL,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC"}

package/dist/output-capture-schema.d.ts

@@ -0,0 +1,144 @@
+/**
+ * Output capture schemas for command execution
+ *
+ * These schemas define the structure for capturing and organizing
+ * command output (stdout/stderr) with timestamps and proper separation.
+ *
+ * All types are derived from Zod schemas (not manual interfaces) to ensure
+ * consistency between runtime validation and TypeScript types.
+ */
+import { z } from 'zod';
+/**
+ * A single line of output with timestamp and stream identification
+ */
+export declare const OutputLineSchema: z.ZodObject<{
+    /** ISO8601 timestamp: "2025-11-05T17:30:45.123Z" */
+    ts: z.ZodString;
+    /** Output stream (stdout or stderr) */
+    stream: z.ZodEnum<["stdout", "stderr"]>;
+    /** Line content (ANSI codes stripped) */
+    line: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    ts: string;
+    stream: "stdout" | "stderr";
+    line: string;
+}, {
+    ts: string;
+    stream: "stdout" | "stderr";
+    line: string;
+}>;
+/**
+ * Complete captured output from command execution
+ */
+export declare const CapturedOutputSchema: z.ZodObject<{
+    /** Standard output */
+    stdout: z.ZodObject<{
+        /** Raw stdout with ANSI codes */
+        raw: z.ZodString;
+        /** Path to stdout.log file (omitted if empty) */
+        file: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        raw: string;
+        file?: string | undefined;
+    }, {
+        raw: string;
+        file?: string | undefined;
+    }>;
+    /** Standard error */
+    stderr: z.ZodObject<{
+        /** Raw stderr with ANSI codes */
+        raw: z.ZodString;
+        /** Path to stderr.log file (omitted if empty) */
+        file: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        raw: string;
+        file?: string | undefined;
+    }, {
+        raw: string;
+        file?: string | undefined;
+    }>;
+    /** Combined chronological output */
+    combined: z.ZodObject<{
+        /** Chronologically ordered lines (ANSI-stripped) */
+        lines: z.ZodArray<z.ZodObject<{
+            /** ISO8601 timestamp: "2025-11-05T17:30:45.123Z" */
+            ts: z.ZodString;
+            /** Output stream (stdout or stderr) */
+            stream: z.ZodEnum<["stdout", "stderr"]>;
+            /** Line content (ANSI codes stripped) */
+            line: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            ts: string;
+            stream: "stdout" | "stderr";
+            line: string;
+        }, {
+            ts: string;
+            stream: "stdout" | "stderr";
+            line: string;
+        }>, "many">;
+        /** Path to combined.jsonl file */
+        file: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        file: string;
+        lines: {
+            ts: string;
+            stream: "stdout" | "stderr";
+            line: string;
+        }[];
+    }, {
+        file: string;
+        lines: {
+            ts: string;
+            stream: "stdout" | "stderr";
+            line: string;
+        }[];
+    }>;
+    /** Command exit code */
+    exitCode: z.ZodNumber;
+    /** Execution duration in seconds */
+    durationSecs: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    exitCode: number;
+    durationSecs: number;
+    stdout: {
+        raw: string;
+        file?: string | undefined;
+    };
+    stderr: {
+        raw: string;
+        file?: string | undefined;
+    };
+    combined: {
+        file: string;
+        lines: {
+            ts: string;
+            stream: "stdout" | "stderr";
+            line: string;
+        }[];
+    };
+}, {
+    exitCode: number;
+    durationSecs: number;
+    stdout: {
+        raw: string;
+        file?: string | undefined;
+    };
+    stderr: {
+        raw: string;
+        file?: string | undefined;
+    };
+    combined: {
+        file: string;
+        lines: {
+            ts: string;
+            stream: "stdout" | "stderr";
+            line: string;
+        }[];
+    };
+}>;
+/**
+ * TypeScript types derived from Zod schemas
+ */
+export type OutputLine = z.infer<typeof OutputLineSchema>;
+export type CapturedOutput = z.infer<typeof CapturedOutputSchema>;
+//# sourceMappingURL=output-capture-schema.d.ts.map

package/dist/output-capture-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-capture-schema.d.ts","sourceRoot":"","sources":["../src/output-capture-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,eAAO,MAAM,gBAAgB;IAC3B,oDAAoD;;IAEpD,uCAAuC;;IAEvC,yCAAyC;;;;;;;;;;EAEzC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,oBAAoB;IAC/B,sBAAsB;;QAEpB,iCAAiC;;QAEjC,iDAAiD;;;;;;;;;IAGnD,qBAAqB;;QAEnB,iCAAiC;;QAEjC,iDAAiD;;;;;;;;;IAGnD,oCAAoC;;QAElC,oDAAoD;;YA5BtD,oDAAoD;;YAEpD,uCAAuC;;YAEvC,yCAAyC;;;;;;;;;;;QA0BvC,kCAAkC;;;;;;;;;;;;;;;;;IAGpC,wBAAwB;;IAExB,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEpC,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/output-capture-schema.js

@@ -0,0 +1,52 @@
+/**
+ * Output capture schemas for command execution
+ *
+ * These schemas define the structure for capturing and organizing
+ * command output (stdout/stderr) with timestamps and proper separation.
+ *
+ * All types are derived from Zod schemas (not manual interfaces) to ensure
+ * consistency between runtime validation and TypeScript types.
+ */
+import { z } from 'zod';
+/**
+ * A single line of output with timestamp and stream identification
+ */
+export const OutputLineSchema = z.object({
+    /** ISO8601 timestamp: "2025-11-05T17:30:45.123Z" */
+    ts: z.string(),
+    /** Output stream (stdout or stderr) */
+    stream: z.enum(['stdout', 'stderr']),
+    /** Line content (ANSI codes stripped) */
+    line: z.string(),
+});
+/**
+ * Complete captured output from command execution
+ */
+export const CapturedOutputSchema = z.object({
+    /** Standard output */
+    stdout: z.object({
+        /** Raw stdout with ANSI codes */
+        raw: z.string(),
+        /** Path to stdout.log file (omitted if empty) */
+        file: z.string().optional(),
+    }),
+    /** Standard error */
+    stderr: z.object({
+        /** Raw stderr with ANSI codes */
+        raw: z.string(),
+        /** Path to stderr.log file (omitted if empty) */
+        file: z.string().optional(),
+    }),
+    /** Combined chronological output */
+    combined: z.object({
+        /** Chronologically ordered lines (ANSI-stripped) */
+        lines: z.array(OutputLineSchema),
+        /** Path to combined.jsonl file */
+        file: z.string(),
+    }),
+    /** Command exit code */
+    exitCode: z.number(),
+    /** Execution duration in seconds */
+    durationSecs: z.number(),
+});
+//# sourceMappingURL=output-capture-schema.js.map

package/dist/output-capture-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-capture-schema.js","sourceRoot":"","sources":["../src/output-capture-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,oDAAoD;IACpD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,uCAAuC;IACvC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpC,yCAAyC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,sBAAsB;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,iCAAiC;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,iDAAiD;QACjD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC;IACF,qBAAqB;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,iCAAiC;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,iDAAiD;QACjD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC;IACF,oCAAoC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,oDAAoD;QACpD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAChC,kCAAkC;QAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;IACF,wBAAwB;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,oCAAoC;IACpC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC"}

package/dist/process-utils.d.ts

@@ -5,6 +5,7 @@
  * Used by validation runner for signal handling and fail-fast behavior.
  */
 import { ChildProcess } from 'node:child_process';
+import type { CapturedOutput } from './output-capture-schema.js';
 /**
  * Stop a child process and its entire process group (cross-platform)
  *
@@ -29,4 +30,87 @@ import { ChildProcess } from 'node:child_process';
  * ```
  */
 export declare function stopProcessGroup(childProcess: ChildProcess, processName?: string): Promise<void>;
+/**
+ * Spawn a command with consistent, secure defaults for validation
+ *
+ * **Key Features:**
+ * - **No stdin**: Commands cannot block waiting for user input
+ * - **Shell mode**: Supports operators (&&, ||, |) and cross-platform compatibility
+ * - **Process groups**: Proper cleanup on Unix (detached mode)
+ * - **Captured output**: stdout/stderr piped for extraction
+ *
+ * **Security:**
+ * - Commands from user config files only (same trust as npm scripts)
+ * - See SECURITY.md for full threat model
+ *
+ * @param command - Command string to execute (e.g., "npm test", "tsc --noEmit")
+ * @param options - Optional spawn configuration
+ * @returns ChildProcess instance for monitoring/cleanup
+ *
+ * @example
+ * ```typescript
+ * // Simple command
+ * const proc = spawnCommand('npm test');
+ *
+ * // With custom environment
+ * const proc = spawnCommand('npm run build', {
+ *   env: { NODE_ENV: 'production' }
+ * });
+ *
+ * // Git command with timeout
+ * const proc = spawnCommand('git', {
+ *   args: ['fetch', 'origin'],
+ *   timeout: 30000
+ * });
+ * ```
+ */
+export declare function spawnCommand(command: string, options?: {
+    /** Command arguments (when command is executable name, not shell string) */
+    args?: string[];
+    /** Timeout in milliseconds */
+    timeout?: number;
+    /** Run detached (defaults to true on Unix, false on Windows) */
+    detached?: boolean;
+    /** Environment variables (merged with process.env) */
+    env?: Record<string, string>;
+}): ChildProcess;
+/**
+ * Options for capturing command output
+ */
+export interface CaptureCommandOptions {
+    /** Command to execute */
+    command: string;
+    /** Output directory for log files */
+    outputDir: string;
+    /** Command arguments (optional) */
+    args?: string[];
+    /** Timeout in milliseconds (optional) */
+    timeout?: number;
+    /** Environment variables (optional) */
+    env?: Record<string, string>;
+}
+/**
+ * Capture command output with organized file structure
+ *
+ * Executes a command and captures stdout/stderr with proper separation:
+ * - stdout.log: Raw stdout with ANSI codes (omitted if empty)
+ * - stderr.log: Raw stderr with ANSI codes (omitted if empty)
+ * - combined.jsonl: Chronological output with ANSI codes stripped
+ *
+ * @param options - Capture options
+ * @returns Captured output with file paths
+ *
+ * @example
+ * ```typescript
+ * const output = await captureCommandOutput({
+ *   command: 'npm test',
+ *   outputDir: '/tmp/vibe-validate/runs/2025-11-05/abc123-17-30-45'
+ * });
+ *
+ * console.log(output.exitCode); // 0 or 1
+ * console.log(output.stdout.file); // Path to stdout.log (if non-empty)
+ * console.log(output.combined.file); // Path to combined.jsonl
+ * ```
+ */
+export declare function captureCommandOutput(options: CaptureCommandOptions): Promise<CapturedOutput>;
 //# sourceMappingURL=process-utils.d.ts.map

package/dist/process-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-utils.d.ts","sourceRoot":"","sources":["../src/process-utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAY,MAAM,oBAAoB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,YAAY,EAC1B,WAAW,GAAE,MAAkB,GAC9B,OAAO,CAAC,IAAI,CAAC,CA+Cf"}
+{"version":3,"file":"process-utils.d.ts","sourceRoot":"","sources":["../src/process-utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAmB,MAAM,oBAAoB,CAAC;AAGnE,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,4BAA4B,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,YAAY,EAC1B,WAAW,GAAE,MAAkB,GAC9B,OAAO,CAAC,IAAI,CAAC,CA+Cf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IACR,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,GACA,YAAY,CAYd;AAcD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,cAAc,CAAC,CA2GzB"}

package/dist/process-utils.js

@@ -4,7 +4,9 @@
  * Provides reliable process group cleanup for spawned child processes.
  * Used by validation runner for signal handling and fail-fast behavior.
  */
-import { execSync } from 'node:child_process';
+import { execSync, spawn } from 'node:child_process';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
 /**
  * Stop a child process and its entire process group (cross-platform)
  *
@@ -77,4 +79,177 @@ export async function stopProcessGroup(childProcess, processName = 'Process') {
         }
     });
 }
+/**
+ * Spawn a command with consistent, secure defaults for validation
+ *
+ * **Key Features:**
+ * - **No stdin**: Commands cannot block waiting for user input
+ * - **Shell mode**: Supports operators (&&, ||, |) and cross-platform compatibility
+ * - **Process groups**: Proper cleanup on Unix (detached mode)
+ * - **Captured output**: stdout/stderr piped for extraction
+ *
+ * **Security:**
+ * - Commands from user config files only (same trust as npm scripts)
+ * - See SECURITY.md for full threat model
+ *
+ * @param command - Command string to execute (e.g., "npm test", "tsc --noEmit")
+ * @param options - Optional spawn configuration
+ * @returns ChildProcess instance for monitoring/cleanup
+ *
+ * @example
+ * ```typescript
+ * // Simple command
+ * const proc = spawnCommand('npm test');
+ *
+ * // With custom environment
+ * const proc = spawnCommand('npm run build', {
+ *   env: { NODE_ENV: 'production' }
+ * });
+ *
+ * // Git command with timeout
+ * const proc = spawnCommand('git', {
+ *   args: ['fetch', 'origin'],
+ *   timeout: 30000
+ * });
+ * ```
+ */
+export function spawnCommand(command, options) {
+    // SECURITY: shell: true required for shell operators (&&, ||, |) and cross-platform compatibility.
+    // Commands from user config files only (same trust as npm scripts). See SECURITY.md for full threat model.
+    // NOSONAR - Intentional shell execution of user-defined commands
+    return spawn(command, options?.args ?? [], {
+        shell: true,
+        stdio: ['ignore', 'pipe', 'pipe'], // No stdin (prevent hangs), capture stdout/stderr
+        timeout: options?.timeout,
+        // detached: true only on Unix - Windows doesn't pipe stdio correctly when detached
+        detached: options?.detached ?? (process.platform !== 'win32'),
+        env: options?.env ? { ...process.env, ...options.env } : process.env,
+    });
+}
+/**
+ * Strip ANSI escape codes from text
+ *
+ * @param text - Text with ANSI codes
+ * @returns Clean text without ANSI codes
+ */
+function stripAnsiCodes(text) {
+    // Control character \x1b is intentionally used to match ANSI escape codes
+    // eslint-disable-next-line no-control-regex, sonarjs/no-control-regex
+    return text.replace(/\x1b\[[0-9;]*m/g, '');
+}
+/**
+ * Capture command output with organized file structure
+ *
+ * Executes a command and captures stdout/stderr with proper separation:
+ * - stdout.log: Raw stdout with ANSI codes (omitted if empty)
+ * - stderr.log: Raw stderr with ANSI codes (omitted if empty)
+ * - combined.jsonl: Chronological output with ANSI codes stripped
+ *
+ * @param options - Capture options
+ * @returns Captured output with file paths
+ *
+ * @example
+ * ```typescript
+ * const output = await captureCommandOutput({
+ *   command: 'npm test',
+ *   outputDir: '/tmp/vibe-validate/runs/2025-11-05/abc123-17-30-45'
+ * });
+ *
+ * console.log(output.exitCode); // 0 or 1
+ * console.log(output.stdout.file); // Path to stdout.log (if non-empty)
+ * console.log(output.combined.file); // Path to combined.jsonl
+ * ```
+ */
+export async function captureCommandOutput(options) {
+    const { command, outputDir, args, timeout, env } = options;
+    const startTime = Date.now();
+    const combinedLines = [];
+    let stdoutRaw = '';
+    let stderrRaw = '';
+    // Spawn the command
+    const proc = spawnCommand(command, { args, timeout, env });
+    // Capture stdout
+    proc.stdout?.on('data', (data) => {
+        const chunk = data.toString();
+        stdoutRaw += chunk;
+        // Add to combined output (ANSI-stripped)
+        const lines = chunk.split('\n');
+        for (const line of lines) {
+            if (line) {
+                combinedLines.push({
+                    ts: new Date().toISOString(),
+                    stream: 'stdout',
+                    line: stripAnsiCodes(line),
+                });
+            }
+        }
+    });
+    // Capture stderr
+    proc.stderr?.on('data', (data) => {
+        const chunk = data.toString();
+        stderrRaw += chunk;
+        // Add to combined output (ANSI-stripped)
+        const lines = chunk.split('\n');
+        for (const line of lines) {
+            if (line) {
+                combinedLines.push({
+                    ts: new Date().toISOString(),
+                    stream: 'stderr',
+                    line: stripAnsiCodes(line),
+                });
+            }
+        }
+    });
+    // Wait for process to complete
+    const exitCode = await new Promise((resolve) => {
+        proc.on('close', (code) => {
+            resolve(code ?? 1);
+        });
+        proc.on('error', () => {
+            resolve(1);
+        });
+    });
+    const endTime = Date.now();
+    const durationSecs = (endTime - startTime) / 1000;
+    // Ensure output directory exists
+    await mkdir(outputDir, { recursive: true });
+    // Write output files
+    const writePromises = [];
+    // Write stdout.log (only if non-empty)
+    let stdoutFile;
+    if (stdoutRaw.trim()) {
+        stdoutFile = join(outputDir, 'stdout.log');
+        writePromises.push(writeFile(stdoutFile, stdoutRaw, 'utf-8'));
+    }
+    // Write stderr.log (only if non-empty)
+    let stderrFile;
+    if (stderrRaw.trim()) {
+        stderrFile = join(outputDir, 'stderr.log');
+        writePromises.push(writeFile(stderrFile, stderrRaw, 'utf-8'));
+    }
+    // Write combined.jsonl (always)
+    const combinedFile = join(outputDir, 'combined.jsonl');
+    const combinedContent = combinedLines
+        .map(line => JSON.stringify(line))
+        .join('\n');
+    writePromises.push(writeFile(combinedFile, combinedContent, 'utf-8'));
+    // Wait for all writes to complete
+    await Promise.all(writePromises);
+    return {
+        stdout: {
+            raw: stdoutRaw,
+            file: stdoutFile,
+        },
+        stderr: {
+            raw: stderrRaw,
+            file: stderrFile,
+        },
+        combined: {
+            lines: combinedLines,
+            file: combinedFile,
+        },
+        exitCode,
+        durationSecs,
+    };
+}
 //# sourceMappingURL=process-utils.js.map

package/dist/process-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"process-utils.js","sourceRoot":"","sources":["../src/process-utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAgB,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,YAA0B,EAC1B,cAAsB,SAAS;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,CAAC,YAAY,CAAC,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC;YAE7B,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;gBAC3B,OAAO,CAAC,GAAG,CAAC,MAAM,WAAW,UAAU,CAAC,CAAC;gBACzC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YAEH,wCAAwC;YACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,kDAAkD;gBAClD,sCAAsC;gBACtC,yCAAyC;gBACzC,IAAI,CAAC;oBACH,QAAQ,CAAC,iBAAiB,GAAG,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,4CAA4C;gBAC9C,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,6CAA6C;gBAC7C,8CAA8C;gBAC9C,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAChC,CAAC;gBAAC,MAAM,CAAC;oBACP,4CAA4C;gBAC9C,CAAC;gBAED,gEAAgE;gBAChE,UAAU,CAAC,GAAG,EAAE;oBACd,IAAI,CAAC;wBACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBAChC,CAAC;oBAAC,MAAM,CAAC;wBACP,4CAA4C;oBAC9C,CAAC;gBACH,CAAC,EAAE,IAAI,CAAC,CAAC;YACX,CAAC;YAED,wDAAwD;YACxD,UAAU,CAAC,GAAG,EAAE;gBACd,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,IAAI,CAAC,CAAC;QACX,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"process-utils.js","sourceRoot":"","sources":["../src/process-utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAgB,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,YAA0B,EAC1B,cAAsB,SAAS;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,CAAC,YAAY,CAAC,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC;YAE7B,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;gBAC3B,OAAO,CAAC,GAAG,CAAC,MAAM,WAAW,UAAU,CAAC,CAAC;gBACzC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YAEH,wCAAwC;YACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,kDAAkD;gBAClD,sCAAsC;gBACtC,yCAAyC;gBACzC,IAAI,CAAC;oBACH,QAAQ,CAAC,iBAAiB,GAAG,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,4CAA4C;gBAC9C,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,6CAA6C;gBAC7C,8CAA8C;gBAC9C,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAChC,CAAC;gBAAC,MAAM,CAAC;oBACP,4CAA4C;gBAC9C,CAAC;gBAED,gEAAgE;gBAChE,UAAU,CAAC,GAAG,EAAE;oBACd,IAAI,CAAC;wBACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBAChC,CAAC;oBAAC,MAAM,CAAC;wBACP,4CAA4C;oBAC9C,CAAC;gBACH,CAAC,EAAE,IAAI,CAAC,CAAC;YACX,CAAC;YAED,wDAAwD;YACxD,UAAU,CAAC,GAAG,EAAE;gBACd,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,IAAI,CAAC,CAAC;QACX,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,OASC;IAED,mGAAmG;IACnG,2GAA2G;IAC3G,iEAAiE;IACjE,OAAO,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE;QACzC,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,kDAAkD;QACrF,OAAO,EAAE,OAAO,EAAE,OAAO;QACzB,mFAAmF;QACnF,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;QAC7D,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;KACrE,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,0EAA0E;IAC1E,sEAAsE;IACtE,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA8B;IAE9B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAE3D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,aAAa,GAAiB,EAAE,CAAC;IACvC,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,SAAS,GAAG,EAAE,CAAC;IAEnB,oBAAoB;IACpB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAE3D,iBAAiB;IACjB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,SAAS,IAAI,KAAK,CAAC;QAEnB,yCAAyC;QACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,EAAE,CAAC;gBACT,aAAa,CAAC,IAAI,CAAC;oBACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC5B,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,iBAAiB;IACjB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,SAAS,IAAI,KAAK,CAAC;QAEnB,yCAAyC;QACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,EAAE,CAAC;gBACT,aAAa,CAAC,IAAI,CAAC;oBACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC5B,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACrD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,YAAY,GAAG,CAAC,OAAO,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;IAElD,iCAAiC;IACjC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,qBAAqB;IACrB,MAAM,aAAa,GAAoB,EAAE,CAAC;IAE1C,uCAAuC;IACvC,IAAI,UAA8B,CAAC;IACnC,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QACrB,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC3C,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,uCAAuC;IACvC,IAAI,UAA8B,CAAC;IACnC,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QACrB,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC3C,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,gCAAgC;IAChC,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACvD,MAAM,eAAe,GAAG,aAAa;SAClC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;IAEtE,kCAAkC;IAClC,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAEjC,OAAO;QACL,MAAM,EAAE;YACN,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,UAAU;SACjB;QACD,MAAM,EAAE;YACN,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,UAAU;SACjB;QACD,QAAQ,EAAE;YACR,KAAK,EAAE,aAAa;YACpB,IAAI,EAAE,YAAY;SACnB;QACD,QAAQ;QACR,YAAY;KACb,CAAC;AACJ,CAAC"}