@webpresso/agent-kit 3.1.28 → 3.1.30

package/dist/esm/audit/test-scan-perf.js

@@ -0,0 +1,275 @@
+/**
+ * Guardrail: keep tests from silently growing multi-second / multi-ten-second
+ * full-repo filesystem scans, and from "fixing" that cost with elevated
+ * per-test timeouts.
+ *
+ * The private-UI cutover anti-regression suite originally walked the monorepo
+ * with readdirSync/statSync/readFileSync and needed a 30s timeout. Prefer
+ * `git grep` (tracked files) or a bounded fixture tree instead.
+ *
+ * Opt-out: `// test-scan-perf-allow` on the same line or previous line as the
+ * walk/timeout site, or `// test-scan-perf-allow-file` anywhere in the file.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
+const TITLE = "test-scan-perf";
+const TEST_FILE_PATTERN = /\.(?:test|spec)\.[cm]?[jt]sx?$/u;
+const E2E_FILE_PATTERN = /\.e2e\./u;
+const SKIP_DIRS = new Set([
+    ".git",
+    "node_modules",
+    "dist",
+    "coverage",
+    ".turbo",
+    ".webpresso",
+    ".agent",
+    ".agents",
+    ".claude",
+    ".codex",
+    ".cursor",
+    ".opencode",
+    ".omx",
+    "playwright-report",
+    "test-results",
+    "logs",
+    "_worktrees",
+]);
+const ALLOW_LINE_PATTERN = /test-scan-perf-allow(?:-timeout|-walk)?\b/iu;
+const ALLOW_FILE_PATTERN = /test-scan-perf-allow-file\b/iu;
+/** Recursive walk helper that also reads file contents (content scan). */
+const RECURSIVE_WALK_HINT = /(?:function\s+walk\b|const\s+walk\s*=|let\s+walk\s*=|var\s+walk\s*=)/u;
+const RECURSIVE_CALL_HINT = /\bwalk\s*\(\s*(?:full|dir|current|directory|entryPath|sub|next)\b/u;
+const READDIR_HINT = /\breaddirSync\b/u;
+const READ_FILE_HINT = /\breadFileSync\b/u;
+/**
+ * True when the file acquires the *workspace* root (not a mkdtemp fixture)
+ * and feeds that root into a recursive walk / file-finder helper.
+ */
+function hasWorkspaceRootScanStart(code) {
+    const assignsWorkspaceRoot = /\bfindRepoRoot\s*\(/u.test(code) ||
+        /(?:const|let|var)\s+(?:repoRoot|REPO_ROOT)\s*=\s*process\.cwd\s*\(/u.test(code) ||
+        /(?:const|let|var)\s+root\s*=\s*(?:findRepoRoot\s*\(|process\.cwd\s*\()/u.test(code);
+    if (!assignsWorkspaceRoot)
+        return false;
+    // Direct walk(repoRoot|REPO_ROOT) or helper(repoRoot|REPO_ROOT) that owns the walk.
+    if (/\b(?:walk|findFiles|list\w*|scan\w*|collect\w*)\s*\(\s*(?:repoRoot|REPO_ROOT)\b/u.test(code)) {
+        return true;
+    }
+    // walk(root) only when `root` itself is the workspace root assignment.
+    if (/(?:const|let|var)\s+root\s*=\s*(?:findRepoRoot\s*\(|process\.cwd\s*\()/u.test(code) &&
+        /\b(?:walk|findFiles|list\w*|scan\w*|collect\w*)\s*\(\s*root\b/u.test(code)) {
+        return true;
+    }
+    return false;
+}
+const MIN_ELEVATED_TIMEOUT_MS = 30_000;
+export function isTestScanPerfTargetPath(relativePath) {
+    const normalized = relativePath.replaceAll("\\", "/");
+    if (!TEST_FILE_PATTERN.test(normalized))
+        return false;
+    if (E2E_FILE_PATTERN.test(normalized))
+        return false;
+    // Audit self-tests and fixtures intentionally include positive examples.
+    if (normalized.includes("/__fixtures__/"))
+        return false;
+    if (normalized.endsWith("/test-scan-perf.test.ts"))
+        return false;
+    return true;
+}
+function stripComments(source) {
+    return source.replace(/\/\*[\s\S]*?\*\//gu, "").replace(/(^|[^:])\/\/[^\n]*/gu, "$1");
+}
+function stripAllowedLines(source) {
+    const lines = source.split(/\r?\n/u);
+    return lines.map((line, index) => (lineAllowed(lines, index) ? "" : line)).join("\n");
+}
+function lineAllowed(lines, index) {
+    const current = lines[index] ?? "";
+    if (ALLOW_LINE_PATTERN.test(current))
+        return true;
+    if (index > 0 && ALLOW_LINE_PATTERN.test(lines[index - 1] ?? ""))
+        return true;
+    return false;
+}
+function hasRepoRootContentWalk(code) {
+    if (!READDIR_HINT.test(code) || !READ_FILE_HINT.test(code))
+        return false;
+    if (!RECURSIVE_WALK_HINT.test(code))
+        return false;
+    const recursiveCall = RECURSIVE_CALL_HINT.test(code) || /\bwalk\s*\(\s*join\s*\(/u.test(code);
+    if (!recursiveCall)
+        return false;
+    return hasWorkspaceRootScanStart(code);
+}
+function parseTimeoutMs(raw) {
+    const digits = raw.replaceAll("_", "");
+    if (!/^\d+$/u.test(digits))
+        return null;
+    const value = Number(digits);
+    return Number.isFinite(value) ? value : null;
+}
+function findElevatedTimeoutLines(text) {
+    const hits = [];
+    const lines = text.split(/\r?\n/u);
+    // Line-oriented: `{ timeout: 30000 }`, trailing `, 30000)`, or a multi-line
+    // `it(\n  "…",\n  () => {…},\n  30_000,\n)` form.
+    for (let index = 0; index < lines.length; index += 1) {
+        const line = lines[index] ?? "";
+        if (lineAllowed(lines, index))
+            continue;
+        const optionMatch = line.match(/timeout\s*:\s*([0-9_]+)/u);
+        if (optionMatch?.[1]) {
+            const ms = parseTimeoutMs(optionMatch[1]);
+            if (ms !== null && ms >= MIN_ELEVATED_TIMEOUT_MS) {
+                hits.push({ line: index + 1, ms });
+                continue;
+            }
+        }
+        // Same-line trailing timeout: `}, 30_000)` / `, 30000)`
+        const trailingMatch = line.match(/,\s*([0-9_]+)\s*\)\s*;?\s*$/u);
+        // Own-line timeout before closing paren: `    30_000,` / `    30000`
+        const ownLineMatch = line.match(/^\s*([0-9_]+)\s*,?\s*$/u);
+        const raw = trailingMatch?.[1] ?? ownLineMatch?.[1];
+        if (!raw)
+            continue;
+        const ms = parseTimeoutMs(raw);
+        const windowStart = Math.max(0, index - 16);
+        const windowEnd = Math.min(lines.length, index + 3);
+        const window = lines.slice(windowStart, windowEnd).join("\n");
+        if (ms !== null &&
+            ms >= MIN_ELEVATED_TIMEOUT_MS &&
+            /\b(?:it|test)(?:\.only|\.each)?\s*\(/u.test(window)) {
+            hits.push({ line: index + 1, ms });
+        }
+    }
+    // Deduplicate by line.
+    const seen = new Set();
+    return hits.filter((hit) => {
+        if (seen.has(hit.line))
+            return false;
+        seen.add(hit.line);
+        return true;
+    });
+}
+export function findTestScanPerfViolationsInText(relativePath, text) {
+    if (!isTestScanPerfTargetPath(relativePath))
+        return [];
+    if (ALLOW_FILE_PATTERN.test(text))
+        return [];
+    const violations = [];
+    const code = stripComments(stripAllowedLines(text));
+    const hasSlowWalk = hasRepoRootContentWalk(code);
+    if (hasSlowWalk) {
+        violations.push({
+            file: relativePath,
+            ruleId: "repo-root-recursive-content-scan",
+            severity: "error",
+            message: `${relativePath}: recursive readdir/readFile content scan from the repo root. ` +
+                `Use \`git grep -l\` (tracked files) or a bounded fixture tree instead of walking ` +
+                `the whole workspace. Opt out with \`// test-scan-perf-allow\` on the walk site ` +
+                `or \`// test-scan-perf-allow-file\` once with justification.`,
+        });
+    }
+    // Elevated timeouts are only flagged when co-located with a repo-root FS walk —
+    // that is the "band-aid for a slow scan" pattern. Legitimate long e2e/subprocess
+    // timeouts without a root walk are out of scope.
+    if (hasSlowWalk) {
+        for (const hit of findElevatedTimeoutLines(text)) {
+            violations.push({
+                file: relativePath,
+                line: hit.line,
+                ruleId: "timeout-band-aid-for-scan",
+                severity: "error",
+                message: `${relativePath}:${hit.line}: per-test timeout ${hit.ms}ms co-located with a ` +
+                    `repo-root recursive FS scan. Fix the scan (git-grep / bounded tree) instead of ` +
+                    `raising the timeout. Opt out with \`// test-scan-perf-allow\` on that line.`,
+            });
+        }
+    }
+    return violations;
+}
+function listTestFilesViaGit(root) {
+    try {
+        const stdout = execFileSync("git", ["-C", root, "ls-files", "-z"], {
+            encoding: "utf8",
+            maxBuffer: 16 * 1024 * 1024,
+        });
+        return stdout
+            .split("\0")
+            .map((entry) => entry.trim())
+            .filter(Boolean)
+            .filter((entry) => isTestScanPerfTargetPath(entry));
+    }
+    catch {
+        return null;
+    }
+}
+function walkTestFiles(dir, root, out) {
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (SKIP_DIRS.has(entry))
+            continue;
+        const full = join(dir, entry);
+        let st;
+        try {
+            st = statSync(full);
+        }
+        catch {
+            continue;
+        }
+        if (st.isDirectory()) {
+            walkTestFiles(full, root, out);
+            continue;
+        }
+        if (!st.isFile())
+            continue;
+        const rel = relative(root, full).replaceAll("\\", "/");
+        if (isTestScanPerfTargetPath(rel))
+            out.push(rel);
+    }
+}
+function listTestFiles(root, affectedFiles) {
+    if (affectedFiles !== undefined) {
+        return affectedFiles
+            .map((file) => file.replaceAll("\\", "/"))
+            .filter((file) => isTestScanPerfTargetPath(file));
+    }
+    const fromGit = listTestFilesViaGit(root);
+    if (fromGit)
+        return fromGit;
+    const out = [];
+    walkTestFiles(root, root, out);
+    return out;
+}
+export function auditTestScanPerf(rootDirectory = process.cwd(), options = {}) {
+    const root = rootDirectory;
+    if (!existsSync(root)) {
+        return { ok: true, title: TITLE, checked: 0, violations: [] };
+    }
+    const files = listTestFiles(root, options.affectedFiles);
+    const violations = [];
+    for (const rel of files) {
+        const full = join(root, rel);
+        let text;
+        try {
+            text = readFileSync(full, "utf8");
+        }
+        catch {
+            continue;
+        }
+        violations.push(...findTestScanPerfViolationsInText(rel, text));
+    }
+    return {
+        ok: violations.length === 0,
+        title: TITLE,
+        checked: files.length,
+        violations,
+    };
+}

package/dist/esm/blueprint/lifecycle/engine.d.ts

@@ -35,5 +35,14 @@ export interface BlueprintLifecycleResult {
     progress: string;
     targetStatus: LifecycleBlueprintStatus;
 }
+/**
+ * Update only the named frontmatter keys, byte-preserving every other line.
+ * Review authority binds plan approvals to normalized blueprint bytes
+ * (`normalizePlanSubjectContent`), so lifecycle writers must never re-serialize
+ * fields they do not own — a whole-document YAML round-trip (quote-style or
+ * folding changes to an untouched `title:`) would strand committed approvals
+ * mid-lifecycle. Falls back to a gray-matter round-trip only when the document
+ * has no frontmatter block at all.
+ */
 export declare function setBlueprintFrontmatterFields(markdown: string, updates: Record<string, string | string[] | undefined>): string;
 export declare function applyBlueprintLifecycle(markdown: string, slug: string, intent: BlueprintLifecycleIntent): BlueprintLifecycleResult;

package/dist/esm/blueprint/lifecycle/engine.js

@@ -1,4 +1,5 @@
 import matter from "gray-matter";
+import { stringify as stringifyYaml } from "yaml";
 import { parseBlueprint } from "#core/parser";
 import { lifecycleBlueprintStatusSchema } from "#core/schema";
 import { updateBlockedReason, updateTaskStatus } from "#markdown/helpers";
@@ -6,17 +7,63 @@ import { applyVerification, assertAllTasksHaveCanonicalPassingEvidence } from "#
 function todayIsoDate() {
     return new Date().toISOString().split("T")[0] ?? new Date().toISOString();
 }
+function serializeFrontmatterEntry(key, value) {
+    // lineWidth: 0 disables folding so long scalars stay on one line. gray-matter
+    // parses frontmatter with js-yaml, which resolves plain date-like scalars
+    // ("2026-07-21") into Date objects — quote a string whenever gray-matter
+    // would not round-trip its plain form back to the same string.
+    const plain = stringifyYaml({ [key]: value }, { lineWidth: 0 }).trimEnd();
+    if (typeof value === "string" && matter(`---\n${plain}\n---\n`).data[key] !== value) {
+        return stringifyYaml({ [key]: value }, { defaultKeyType: "PLAIN", defaultStringType: "QUOTE_DOUBLE", lineWidth: 0 })
+            .trimEnd()
+            .split("\n");
+    }
+    return plain.split("\n");
+}
+/**
+ * Update only the named frontmatter keys, byte-preserving every other line.
+ * Review authority binds plan approvals to normalized blueprint bytes
+ * (`normalizePlanSubjectContent`), so lifecycle writers must never re-serialize
+ * fields they do not own — a whole-document YAML round-trip (quote-style or
+ * folding changes to an untouched `title:`) would strand committed approvals
+ * mid-lifecycle. Falls back to a gray-matter round-trip only when the document
+ * has no frontmatter block at all.
+ */
 export function setBlueprintFrontmatterFields(markdown, updates) {
-    const parsed = matter(markdown);
+    const match = /^(---\r?\n)([\s\S]*?)(\r?\n---(?:\r?\n|$))/u.exec(markdown);
+    if (!match) {
+        const parsed = matter(markdown);
+        for (const [key, value] of Object.entries(updates)) {
+            if (value === undefined || value === "") {
+                delete parsed.data[key];
+            }
+            else {
+                parsed.data[key] = value;
+            }
+        }
+        return matter.stringify(parsed.content, parsed.data);
+    }
+    const lines = (match[2] ?? "").split("\n");
     for (const [key, value] of Object.entries(updates)) {
-        if (value === undefined || value === "") {
-            delete parsed.data[key];
+        const keyPattern = new RegExp(String.raw `^${key}:`, "u");
+        const start = lines.findIndex((line) => keyPattern.test(line));
+        let removeCount = 0;
+        if (start !== -1) {
+            removeCount = 1;
+            while (start + removeCount < lines.length &&
+                /^[ \t]/u.test(lines[start + removeCount] ?? "")) {
+                removeCount += 1;
+            }
+        }
+        const replacement = value === undefined || value === "" ? [] : serializeFrontmatterEntry(key, value);
+        if (start !== -1) {
+            lines.splice(start, removeCount, ...replacement);
         }
-        else {
-            parsed.data[key] = value;
+        else if (replacement.length > 0) {
+            lines.push(...replacement);
         }
     }
-    return matter.stringify(parsed.content, parsed.data);
+    return `${match[1]}${lines.join("\n")}${match[3]}${markdown.slice(match[0].length)}`;
 }
 function assertExecutableStatus(status) {
     const parsed = lifecycleBlueprintStatusSchema.safeParse(status);

package/dist/esm/blueprint/lifecycle/review-provenance.d.ts

@@ -36,6 +36,12 @@ export interface TrackedReviewProvenanceOptions {
     readonly targetHash?: string;
 }
 export declare function normalizeTrackedReviewApprovals(approvals: unknown): TrackedReviewApproval[];
+/**
+ * Read `_overview.md` for a blueprint at `ref`. Prefer the working-tree path;
+ * if missing (lifecycle move draft→planned before the promote commit), resolve
+ * by stable slug under any lifecycle directory at that ref.
+ */
+export declare function readBlueprintOverviewAtRef(repoRoot: string, ref: string, file: string): Buffer | null;
 export declare function collectV2ReviewProvenance(file: string, purpose: ReviewEvent["purpose"], ref?: string, issues?: string[]): readonly ValidTrackedReview[];
 export declare function auditReviewEventAppendOnly(cwd: string, baseRef: string, targetRef?: string): readonly string[];
 export declare function parseTrackedReviewRecords(markdown: string): TrackedReviewRecord[];

package/dist/esm/blueprint/lifecycle/review-provenance.js

@@ -1,9 +1,9 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
-import { readReviewAuthorityAtRef } from "#review/authority.js";
-import { parseReviewEventLog } from "#review/events.js";
-import { normalizePlanSubjectContent } from "#review/subject.js";
+import { readReviewAuthorityAtRef, readWorkingReviewEvents } from "#review/authority.js";
+import { evaluateReviewEvents, parseReviewEventLog } from "#review/events.js";
+import { createPlanSubjectDigestForContent, normalizePlanSubjectContent } from "#review/subject.js";
 import { isPolicyApprovalVerdict } from "#review/verdict.js";
 const REVIEW_ENTRY_MARKER = "<!-- wp:review-entry ";
 function normalizePath(file) {
@@ -52,6 +52,53 @@ function stableSlugForBlueprintFile(file) {
     }
     return path.basename(path.dirname(file));
 }
+/**
+ * Read `_overview.md` for a blueprint at `ref`. Prefer the working-tree path;
+ * if missing (lifecycle move draft→planned before the promote commit), resolve
+ * by stable slug under any lifecycle directory at that ref.
+ */
+export function readBlueprintOverviewAtRef(repoRoot, ref, file) {
+    const relative = normalizePath(path.relative(repoRoot, file));
+    if (relative.startsWith("..") || path.isAbsolute(relative))
+        return null;
+    try {
+        return execFileSync("git", ["show", `${ref}:${relative}`], {
+            cwd: repoRoot,
+            encoding: "buffer",
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: 5_000,
+        });
+    }
+    catch {
+        // Path may have moved across lifecycle dirs (draft→planned) while the
+        // promote commit is still uncommitted. Stable slug is the authority key.
+        const slug = stableSlugForBlueprintFile(file);
+        if (!slug || slug.includes(".."))
+            return null;
+        try {
+            const names = execFileSync("git", ["ls-tree", "-r", "--name-only", ref], {
+                cwd: repoRoot,
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "pipe"],
+                timeout: 5_000,
+            });
+            const escaped = slug.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+            const pattern = new RegExp(`(?:^|/)(?:draft|planned|parked|in-progress|completed|archived)/${escaped}/_overview\\.md$`, "u");
+            const hits = names.split("\n").filter((name) => pattern.test(normalizePath(name)));
+            if (hits.length !== 1)
+                return null;
+            return execFileSync("git", ["show", `${ref}:${hits[0]}`], {
+                cwd: repoRoot,
+                encoding: "buffer",
+                stdio: ["ignore", "pipe", "pipe"],
+                timeout: 5_000,
+            });
+        }
+        catch {
+            return null;
+        }
+    }
+}
 function workingContentMatchesRef(repoRoot, file, purpose, ref) {
     const relative = path.relative(repoRoot, file);
     if (relative.startsWith("..") || path.isAbsolute(relative))
@@ -63,12 +110,11 @@ function workingContentMatchesRef(repoRoot, file, purpose, ref) {
             // in the working tree before the promotion commit exists, and that
             // window must not strip a legitimately promoted blueprint of its plan
             // authority. Substantive edits still differ after normalization.
-            const atRef = execFileSync("git", ["show", `${ref}:${normalizePath(relative)}`], {
-                cwd: repoRoot,
-                encoding: "buffer",
-                stdio: ["ignore", "pipe", "pipe"],
-                timeout: 5_000,
-            });
+            // Also resolve by stable slug when the lifecycle path changed (draft→planned)
+            // so pre-commit on a rename does not falsely drop plan authority.
+            const atRef = readBlueprintOverviewAtRef(repoRoot, ref, file);
+            if (!atRef)
+                return false;
             const working = readFileSync(file);
             return normalizePlanSubjectContent(working).equals(normalizePlanSubjectContent(atRef));
         }
@@ -84,27 +130,62 @@ function workingContentMatchesRef(repoRoot, file, purpose, ref) {
         return false;
     }
 }
+// Working-ledger acceptance: pre-commit validates a blueprint whose new review
+// events are staged alongside it and therefore not yet at any git ref. An
+// event still counts only when its subjectDigest matches the digest of the
+// exact working bytes being committed and its artifact hash-verifies on disk —
+// content-addressing keeps this sound before the commit exists.
+function collectWorkingV2ReviewProvenance(file, issues) {
+    try {
+        const slug = stableSlugForBlueprintFile(file);
+        const working = readWorkingReviewEvents(file, slug);
+        if (working.events.length === 0)
+            return [];
+        issues?.push(...working.issues);
+        const digest = createPlanSubjectDigestForContent(slug, readFileSync(file));
+        const evaluation = evaluateReviewEvents(working.events, {
+            purpose: "plan",
+            blueprintSlug: slug,
+            subjectScheme: "wp-blueprint-v1",
+            subjectDigest: digest,
+        }, working.compromisedIds);
+        return evaluation.approvals
+            .filter((event) => event.artifactPath)
+            .map((event) => ({
+            reviewer: event.reviewer,
+            artifact: event.artifactPath,
+            targetHash: event.subjectDigest,
+        }));
+    }
+    catch (error) {
+        issues?.push(`Working review authority unavailable for ${file}: ${error instanceof Error ? error.message : String(error)}`);
+        return [];
+    }
+}
 export function collectV2ReviewProvenance(file, purpose, ref = "HEAD", issues) {
     const repoRoot = findGitRoot(file);
     if (!repoRoot)
         return [];
+    const workingApprovals = purpose === "plan" ? collectWorkingV2ReviewProvenance(file, issues) : [];
     if (!workingContentMatchesRef(repoRoot, file, purpose, ref))
-        return [];
+        return workingApprovals;
     try {
         const authority = readReviewAuthorityAtRef(repoRoot, ref, stableSlugForBlueprintFile(file), purpose);
         issues?.push(...authority.issues);
-        return authority.approvals.map((event) => ({
+        const refApprovals = authority.approvals.map((event) => ({
             reviewer: event.reviewer,
             artifact: event.artifactPath,
             targetHash: event.subjectDigest,
         }));
+        const seen = new Set(refApprovals.map((approval) => approval.reviewer));
+        return [...refApprovals, ...workingApprovals.filter((entry) => !seen.has(entry.reviewer))];
     }
     catch (error) {
         // Container-level failure (unparseable ledger, duplicate ids, cross-slug
         // events, unresolved commit): fail closed for the whole file, but surface
         // the reason instead of silently reporting zero authority.
         issues?.push(`Review authority unavailable for ${file}: ${error instanceof Error ? error.message : String(error)}`);
-        return [];
+        return workingApprovals;
     }
 }
 function reviewEventLogsAtRef(cwd, ref) {

package/dist/esm/blueprint/markdown/helpers.js

@@ -67,10 +67,14 @@ export function updateBlockedReason(content, taskId, reason) {
         const trimmedReason = reason.trim();
         const blockedPattern = /\n?\*\*Blocked:\*\*\s*.*(?:\n+)?/i;
         if (!trimmedReason) {
-            return section
+            // Preserve the section's trailing whitespace: trimEnd on the whole
+            // section would also delete the blank line separating this task from the
+            // next heading, changing bytes the writer does not own.
+            const trailingWhitespace = section.slice(section.trimEnd().length);
+            return (section
                 .replace(blockedPattern, "\n")
                 .replace(/\n{3,}/g, "\n\n")
-                .trimEnd();
+                .trimEnd() + trailingWhitespace);
         }
         const blockedLine = `**Blocked:** ${trimmedReason}`;
         if (/\*\*Blocked:\*\*/i.test(section)) {

package/dist/esm/ci/act-replay.js

@@ -31,8 +31,105 @@ export function buildReplayWorkflowSource(sourceYaml, options) {
         : basename(options.workflowPath);
     workflow.name = `replay: ${originalName}`;
     workflow.on = normalizeWorkflowOnSection(workflow.on, options.eventName);
+    workflow.jobs = rewriteReplayJobs(workflow.jobs, options.eventName);
     return stringify(workflow);
 }
+function rewriteReplayJobs(jobs, eventName) {
+    if (typeof jobs !== "object" || jobs === null || Array.isArray(jobs)) {
+        return jobs;
+    }
+    return Object.fromEntries(Object.entries(jobs).map(([jobId, job]) => [
+        jobId,
+        rewriteReplayJob(job, eventName),
+    ]));
+}
+function rewriteReplayJob(job, eventName) {
+    if (typeof job !== "object" || job === null || Array.isArray(job)) {
+        return job;
+    }
+    const jobRecord = { ...job };
+    if (Array.isArray(jobRecord.steps)) {
+        jobRecord.steps = jobRecord.steps.map((step) => rewriteReplayStep(step, eventName));
+    }
+    return jobRecord;
+}
+function rewriteReplayStep(step, eventName) {
+    if (!isRecord(step) || !isSameRepoCheckoutStep(step, eventName)) {
+        return step;
+    }
+    const rewritten = {
+        name: typeof step.name === "string" ? step.name : "Use prepared local replay workspace",
+        run: [
+            'echo "wp ci act replay: using prepared local workspace instead of actions/checkout"',
+            "test -d .git",
+            "git rev-parse --is-inside-work-tree",
+            "git rev-parse --verify HEAD",
+        ].join("\n"),
+        "working-directory": "${{ github.workspace }}",
+    };
+    copyOptionalStepField(step, rewritten, "id");
+    copyOptionalStepField(step, rewritten, "if");
+    copyOptionalStepField(step, rewritten, "timeout-minutes");
+    copyOptionalStepField(step, rewritten, "continue-on-error");
+    return rewritten;
+}
+function isSameRepoCheckoutStep(step, eventName) {
+    if (typeof step.uses !== "string" || !/^actions\/checkout(?:@|$)/u.test(step.uses)) {
+        return false;
+    }
+    if (step.env !== undefined && step.env !== null) {
+        return false;
+    }
+    const withConfig = step.with;
+    if (withConfig === undefined || withConfig === null) {
+        return true;
+    }
+    if (!isRecord(withConfig)) {
+        return false;
+    }
+    if (hasAnyCheckoutInputExcept(withConfig, ["ref"])) {
+        return false;
+    }
+    return isCurrentReplayRef(withConfig.ref, eventName);
+}
+function isCurrentReplayRef(value, eventName) {
+    if (value === undefined || value === null || String(value).trim().length === 0) {
+        return true;
+    }
+    const normalized = normalizeGithubExpression(String(value));
+    if (normalized === null)
+        return false;
+    if (normalized === "github.sha") {
+        return true;
+    }
+    if (normalized ===
+        "github.event_name=='pull_request'&&github.event.pull_request.base.sha||github.sha") {
+        return eventName !== "pull_request";
+    }
+    return false;
+}
+function normalizeGithubExpression(value) {
+    const match = /^\$\{\{\s*([\s\S]*?)\s*\}\}$/u.exec(value.trim());
+    if (!match?.[1])
+        return null;
+    return match[1].replace(/"/gu, "'").replace(/\s+/gu, "");
+}
+function hasAnyCheckoutInputExcept(withConfig, allowedKeys) {
+    const allowed = new Set(allowedKeys);
+    return Object.entries(withConfig).some(([key, value]) => {
+        if (allowed.has(key))
+            return false;
+        return value !== undefined && value !== null && String(value).trim().length > 0;
+    });
+}
+function copyOptionalStepField(source, target, field) {
+    if (source[field] !== undefined) {
+        target[field] = source[field];
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 export function createReplayWorkflow(options) {
     const sourcePath = resolve(options.cwd, options.workflowPath);
     const sourceYaml = readFileSync(sourcePath, "utf8");
@@ -42,11 +139,17 @@ export function createReplayWorkflow(options) {
     });
     const dir = mkdtempSync(join(tmpdir(), "wp-ci-act-replay-"));
     const workflowPath = join(dir, "workflow.yml");
-    writeFileSync(workflowPath, generatedYaml, "utf8");
-    return {
-        workflowPath,
-        cleanup() {
-            rmSync(dir, { recursive: true, force: true });
-        },
-    };
+    try {
+        writeFileSync(workflowPath, generatedYaml, "utf8");
+        return {
+            workflowPath,
+            cleanup() {
+                rmSync(dir, { recursive: true, force: true });
+            },
+        };
+    }
+    catch (error) {
+        rmSync(dir, { recursive: true, force: true });
+        throw error;
+    }
 }