@yagni-app/code-staging 1.2.6-staging.1951.1 → 1.2.6-staging.1956.1

package/dist/extension/pipeline/verify.js

@@ -53,7 +53,7 @@ import { readFileSync } from "node:fs";
 // APIs accept forward-slash paths — while win32 join/dirname would emit
 // backslashed strings that no longer compare equal to the git-derived repoRoot
 // and would break the walk-up termination check.
-import { basename, dirname, join } from "node:path/posix";
+import { basename, dirname, join, relative } from "node:path/posix";
 import { readToolchainFile } from "../toolchain/spawnHook.js";
 import { killTreeSync, trackChild } from "./childRegistry.js";
 import { claimCovers } from "./fanout.js";
@@ -89,6 +89,23 @@ const MAX_LOCATED_FINDINGS = 25;
 const MAX_TAIL_CHARS = 1000;
 /** The verify lens reuses `does_it_hold` (does the change build/test) to avoid widening ReviewLens. */
 const VERIFY_LENS = "does_it_hold";
+/**
+ * Why a command threw instead of exiting, as its check record says it. `run`
+ * is the run's own signal (a /stop or the run's end); `capped` is the one
+ * the command ran under, which also carries its time cap.
+ */
+export function unexitedNote(err, run, capped) {
+    if (run?.aborted)
+        return "aborted";
+    if (capped?.aborted)
+        return "timed out";
+    const shape = err;
+    if (shape?.code === "ENOENT")
+        return "not found";
+    if (shape?.name === "AbortError" || shape?.name === "TimeoutError")
+        return "timed out";
+    return "could not run";
+}
 /**
  * The priority order of package.json scripts we treat as a verify command.
  * Deliberately a SECRET-INDEPENDENT build check (`typecheck`/`lint`), NEVER the
@@ -458,7 +475,7 @@ const FAILURE_SUMMARY = [
  * Callers scrub the output through {@link scrubSecrets} BEFORE classification
  * so findings/notes never carry secrets (§0.9).
  */
-export function classifyTestFailure(output, exitCode) {
+export function classifyTestFailure(output, exitCode, limit = MAX_LOCATED_FINDINGS) {
     if (exitCode === 0)
         return { kind: "clean" };
     const spawnInfra = classifyVerifyInfraFailure(output, exitCode);
@@ -521,7 +538,7 @@ export function classifyTestFailure(output, exitCode) {
         else if (!existing.file && parsed.file)
             byMessage.set(parsed.message, parsed);
     }
-    const failures = [...byMessage.values()].slice(0, MAX_LOCATED_FINDINGS);
+    const failures = [...byMessage.values()].slice(0, limit);
     if (failures.length > 0) {
         return {
             kind: "failures",
@@ -558,28 +575,45 @@ export function classifyTestFailure(output, exitCode) {
 const TS_DIAGNOSTIC = /^(.+?)\((\d+),\d+\):\s*error\s+TS\d+:\s*(.+)$/;
 /** Match a generic `path:line:col: error message` (eslint/tsc-pretty-ish). */
 const GENERIC_DIAGNOSTIC = /^(.+?):(\d+):\d+:?\s*(?:error\b[:\s]*)?(.+)$/;
+/** An ESLint stylish file header: one path with an extension, nothing else on the line. */
+const STYLISH_FILE = /^(?:\.{0,2}\/)?[^\s:]+\.[A-Za-z0-9]+$/;
+/** An ESLint stylish error row under that header: `12:5  error  message  rule`. */
+const STYLISH_ERROR = /^(\d+):\d+\s+(?:error|Error:)\s+(.+)$/;
 /**
  * Turn a failing verify run into `critical` Findings. A clean (exit 0) run yields
- * none. Located diagnostics (TypeScript first, then a generic file:line form) are
- * parsed into per-error findings; if none parse, a single capped finding carries
+ * none. Located diagnostics (TypeScript first, then a generic file:line form, then
+ * ESLint's stylish error rows under their file header) are parsed into per-error
+ * findings, at most `limit` of them; if none parse, a single capped finding carries
  * the tail of the output so the fix stage still gets actionable signal. Never
  * throws; always emits at least one finding on a non-zero exit.
  */
-export function parseVerifyFailures(output, exitCode, label) {
+export function parseVerifyFailures(output, exitCode, label, limit = MAX_LOCATED_FINDINGS) {
     if (exitCode === 0)
         return [];
     const located = [];
     const seen = new Set();
+    // ESLint's default (stylish) and `next lint` output name the file once, on
+    // its own line, above that file's `line:col  error  message  rule` rows.
+    let stylishFile;
     for (const raw of output.split("\n")) {
         const line = raw.trim();
         if (!line)
             continue;
         const m = line.match(TS_DIAGNOSTIC) ?? line.match(GENERIC_DIAGNOSTIC);
-        if (!m)
-            continue;
-        const file = m[1].trim();
-        const lineNo = Number(m[2]);
-        const message = m[3].trim();
+        let parts = m ? [m[1], m[2], m[3]] : null;
+        if (!parts) {
+            if (STYLISH_FILE.test(line)) {
+                stylishFile = line;
+                continue;
+            }
+            const row = stylishFile ? line.match(STYLISH_ERROR) : null;
+            if (!row || !stylishFile)
+                continue;
+            parts = [stylishFile, row[1], row[2].replace(/\s{2,}/g, " ")];
+        }
+        const file = parts[0].trim();
+        const lineNo = Number(parts[1]);
+        const message = parts[2].trim();
         // Guard the generic matcher against noise: require a plausible file token.
         if (!file || /\s/.test(file) || !Number.isFinite(lineNo))
             continue;
@@ -594,7 +628,7 @@ export function parseVerifyFailures(output, exitCode, label) {
             file,
             line: lineNo,
         });
-        if (located.length >= MAX_LOCATED_FINDINGS)
+        if (located.length >= limit)
             break;
     }
     if (located.length > 0)
@@ -651,6 +685,98 @@ function liftFinding(finding, repoRoot, commandCwd) {
     const file = toRepoRelativePath(finding.file, repoRoot, commandCwd);
     return file === finding.file ? finding : { ...finding, file };
 }
+/** One command's identity across the baseline run and the build's runs: where it runs and what it runs. */
+export function verifyCommandKey(command) {
+    return `${command.cwd}\u0000${command.argv.join(" ")}`;
+}
+/**
+ * One failure's key, the shape #2601's `failureKeyOf` gives a CI failure: the
+ * repo-relative file and the message, never the line, since a change above a
+ * failure moves it. A failure that is only the output's tail names nothing
+ * stable, so it has no key and is never excused. Pure.
+ */
+export function verifyFailureKey(finding) {
+    if (finding.message.includes("Output tail:"))
+        return null;
+    return `${finding.file ?? ""}\u0000${finding.message}`;
+}
+/** How many times each failure key occurs. Pure. */
+export function failureKeyCounts(findings) {
+    const counts = new Map();
+    for (const finding of findings) {
+        const key = verifyFailureKey(finding);
+        if (key !== null)
+            counts.set(key, (counts.get(key) ?? 0) + 1);
+    }
+    return counts;
+}
+/**
+ * The failures this change caused: each failure key is excused at most as many
+ * times as the clean tree had it, so a second copy of an old error is new. A
+ * failure in a file the build did not touch still counts when the baseline did
+ * not have it, since a change can break another file's types. No baseline for
+ * the command leaves every failure in place. Pure.
+ */
+export function subtractBaseline(findings, baseline) {
+    if (!baseline)
+        return { findings: [...findings], excused: 0 };
+    const left = new Map(baseline);
+    const fresh = [];
+    let excused = 0;
+    for (const finding of findings) {
+        const key = verifyFailureKey(finding);
+        const count = key === null ? 0 : (left.get(key) ?? 0);
+        if (key !== null && count > 0) {
+            left.set(key, count - 1);
+            excused += 1;
+        }
+        else {
+            fresh.push(finding);
+        }
+    }
+    return { findings: fresh, excused };
+}
+/** The note for failures the clean tree already had, by command label. Pure. */
+export function preexistingNote(byLabel) {
+    const total = [...byLabel.values()].reduce((sum, n) => sum + n, 0);
+    if (total === 0)
+        return null;
+    const parts = [...byLabel].filter(([, n]) => n > 0).map(([label, n]) => `${label} ${n}`);
+    return `already failed before this change: ${total} (${parts.join(", ")}); not findings`;
+}
+/** Cap on the paths read off a plan, and on the packages the baseline runs in. */
+const MAX_PLAN_PATHS = 200;
+const MAX_BASELINE_PACKAGES = 10;
+/** A path-shaped token in plan prose: at least one `/`, no scheme. */
+const PLAN_PATH = /(?:^|[\s`'"(<[])(\.?\/?[\w@.+-]+(?:\/[\w@.+[\]-]+)+\/?)/g;
+/**
+ * The repo-relative paths an approved plan names (`src/flows/a.tsx`,
+ * `packages/web/`), which say which packages the build will change before it
+ * has changed anything. URLs and paths that leave the tree are dropped. Pure.
+ */
+export function planPaths(plan) {
+    const paths = new Set();
+    for (const match of plan.matchAll(PLAN_PATH)) {
+        const raw = match[1].replace(/[.,:;]+$/, "").replace(/^\.\//, "");
+        if (!raw || raw.startsWith("/") || raw.startsWith("..") || raw.includes("://"))
+            continue;
+        paths.add(raw);
+        if (paths.size >= MAX_PLAN_PATHS)
+            break;
+    }
+    return [...paths];
+}
+/**
+ * The package dirs the baseline runs in: those the plan's paths fall in. The
+ * repo root drops out when a package below it was named, since its check is
+ * not one the build's gate would run then. Pure (the `readFile` seam).
+ */
+export function baselineDirs(repoRoot, paths, readFile) {
+    const dirs = resolveClaimDirs(repoRoot, paths, readFile);
+    const root = normDir(repoRoot);
+    const below = dirs.filter((dir) => normDir(dir) !== root);
+    return (below.length > 0 ? below : dirs).slice(0, MAX_BASELINE_PACKAGES);
+}
 const SAFE_ENV_KEYS = [
     "PATH",
     "HOME",
@@ -815,6 +941,13 @@ export function makeDefaultExec(opts = {}) {
     });
 }
 const defaultExec = makeDefaultExec();
+/** The gate's typecheck-half detection, shared by the build's runs and the baseline run. */
+const defaultDetect = (cwd, changedDirs) => detectVerifyCommands(cwd, {
+    allowRepoOverride: process.env.YAGNI_CODE_ALLOW_VERIFY_OVERRIDE === "1",
+    changedDirs,
+});
+/** The gate's test-half detection, shared the same way. */
+const defaultDetectTests = (cwd, changedDirs) => detectVerifyTestCommands(cwd, { changedDirs });
 /**
  * A workstream's claims resolved to package dirs. Claims are PREFIXES and a claim
  * is very often a directory (`packages/backend/src/routes`), while
@@ -921,7 +1054,7 @@ export function makeWorkstreamCheck(opts = {}) {
                 anyRan = true;
                 labels.push(command.label);
                 if (run.code !== 0) {
-                    const parsed = parseVerifyFailures(run.output, run.code, command.label).map((f) => liftFinding(f, cwd, command.cwd));
+                    const parsed = subtractBaseline(parseVerifyFailures(run.output, run.code, command.label, Number.POSITIVE_INFINITY).map((f) => liftFinding(f, cwd, command.cwd)), opts.baseline?.get(verifyCommandKey(command))).findings.slice(0, MAX_LOCATED_FINDINGS);
                     const covered = parsed.filter((f) => f.file != null && target.files.some((claim) => claimCovers(claim, f.file)));
                     findings.push(...covered.map((f) => tagFinding(f, target.name)));
                     if (!uncoveredEmitted.has(memoKey)) {
@@ -952,13 +1085,8 @@ export function makeWorkstreamCheck(opts = {}) {
  * blocks a real change on its own failure.
  */
 export function makeRunVerify(opts = {}) {
-    const detect = opts.detect ??
-        ((cwd, changedDirs) => detectVerifyCommands(cwd, {
-            allowRepoOverride: process.env.YAGNI_CODE_ALLOW_VERIFY_OVERRIDE === "1",
-            changedDirs,
-        }));
-    const detectTests = opts.detectTests ??
-        ((cwd, changedDirs) => detectVerifyTestCommands(cwd, { changedDirs }));
+    const detect = opts.detect ?? defaultDetect;
+    const detectTests = opts.detectTests ?? defaultDetectTests;
     const changedDirs = opts.changedDirs ??
         (async (cwd, signal, baselinePaths) => {
             const snapshot = await snapshotWorkspace(cwd, signal);
@@ -1057,12 +1185,12 @@ export function makeRunVerify(opts = {}) {
         const steps = jobs.flatMap((job) => job.steps.map((step) => ({ job, step })));
         if (approved.length === 0 && steps.length === 0) {
             report();
-            return { findings, reasons, labels };
+            return { findings, reasons, labels, checks: [] };
         }
         const buildLeft = (opts.repoChecksBuildBudgetMs ?? REPO_CHECKS_BUILD_BUDGET_MS) - repoChecksSpentMs;
         if (buildLeft < REPO_CHECK_MIN_START_MS) {
             reasons.push("approved checks and CI steps not run again: the build's check budget is spent; the host still runs the approved checks after the build");
-            return { findings, reasons, labels };
+            return { findings, reasons, labels, checks: [] };
         }
         const callBudget = Math.min(opts.repoChecksCallBudgetMs ?? REPO_CHECKS_CALL_BUDGET_MS, timeoutMs - (now() - input.callStartedAt), buildLeft);
         const halfStartedAt = now();
@@ -1077,6 +1205,7 @@ export function makeRunVerify(opts = {}) {
             notReached: 0,
             failedJobs,
             approvedFailed: new Set(),
+            checks: [],
         };
         const before = await treeStatus(cwd, signal).catch((err) => {
             const msg = err instanceof Error ? err.message : String(err);
@@ -1110,26 +1239,47 @@ export function makeRunVerify(opts = {}) {
         if (run.notReached > 0) {
             reasons.push(`${run.notReached} approved check(s) or CI step(s) not reached in the gate's time budget; the host still runs the approved checks after the build`);
         }
-        return { findings, reasons, labels };
+        return { findings, reasons, labels, checks: run.checks };
     }
     /** One repository command's verdict: passed, a note (it could not run), or a failure with its output. */
-    async function runRepoCommand(run, command, dir, stepEnv) {
+    async function runRepoCommand(run, command, dir, stepEnv, check) {
         const capMs = Math.min(opts.repoCheckTimeoutMs ?? REPO_CHECK_TIMEOUT_MS, run.left());
         const composed = composeAbortSignal(run.signal, AbortSignal.timeout(Math.max(1, capMs)));
         const env = opts.repoChecksEnv
             ? { ...opts.repoChecksEnv, ...(stepEnv ?? {}) }
             : buildRepoCheckEnv(process.env, run.toolchainFile, stepEnv);
+        const startedAt = now();
         try {
             const { code, output: rawOutput } = await exec(repoCheckArgv(command), dir, composed, env);
-            if (code === 0)
+            const record = (baseline) => run.checks.push({
+                name: check.name,
+                command,
+                cwd: relative(run.cwd, dir) || ".",
+                exitCode: code,
+                durationMs: now() - startedAt,
+                baseline,
+            });
+            if (code === 0) {
+                record(check.baseline);
                 return { kind: "passed" };
+            }
             const output = scrubSecrets(rawOutput);
             const cls = classifyTestFailure(output, code);
+            record(cls.kind === "infra" ? "cannot_run" : check.baseline);
             if (cls.kind === "infra")
                 return { kind: "note", reason: `could not run: ${cls.reason}` };
             return { kind: "failed", output, code };
         }
         catch (err) {
+            run.checks.push({
+                name: check.name,
+                command,
+                cwd: relative(run.cwd, dir) || ".",
+                exitCode: null,
+                durationMs: now() - startedAt,
+                baseline: check.baseline,
+                note: unexitedNote(err, run.signal, composed),
+            });
             const msg = err instanceof Error ? err.message : String(err);
             return { kind: "note", reason: `could not run: ${scrubSecrets(msg)}` };
         }
@@ -1160,7 +1310,10 @@ export function makeRunVerify(opts = {}) {
                 continue;
             }
             const label = check.command.length > 80 ? `${check.command.slice(0, 77)}...` : check.command;
-            const verdict = await runRepoCommand(run, check.command, run.cwd, undefined);
+            const verdict = await runRepoCommand(run, check.command, run.cwd, undefined, {
+                name: label,
+                baseline: check.status,
+            });
             if (verdict.kind === "failed")
                 run.approvedFailed.add(check.command.trim());
             if (verdict.kind === "note") {
@@ -1225,7 +1378,10 @@ export function makeRunVerify(opts = {}) {
             const dir = step.workingDirectory
                 ? join(run.cwd, step.workingDirectory.replace(/^\.\/+/, ""))
                 : run.cwd;
-            const verdict = await runRepoCommand(run, step.run, dir, step.env);
+            const verdict = await runRepoCommand(run, step.run, dir, step.env, {
+                name: `CI ${job.name}: ${step.name}`,
+                baseline: "runnable",
+            });
             if (verdict.kind === "passed") {
                 lastCiFailure.delete(key);
                 run.labels.push(`CI ${job.name}: ${step.name}`);
@@ -1263,7 +1419,7 @@ export function makeRunVerify(opts = {}) {
         // The approved checks carry the plan's approval, not the repository's own
         // choice of how to verify, so an override never takes them out of the loop.
         const repoFile = opts.repoChecks?.() ?? null;
-        if (commands.length === 0 && testCommands.length === 0 && !repoFile) {
+        if (commands.length === 0 && testCommands.length === 0 && !repoFile && !opts.scanChange) {
             return {
                 ran: false,
                 ok: true,
@@ -1274,6 +1430,27 @@ export function makeRunVerify(opts = {}) {
         const findings = [];
         const reasons = [];
         let anyRan = false;
+        // Failures the clean tree already had, by command label (YAG-1003).
+        const preexisting = new Map();
+        const countPreexisting = (label, n) => {
+            if (n > 0)
+                preexisting.set(label, (preexisting.get(label) ?? 0) + n);
+        };
+        const checks = [];
+        // A detected command's standing on the clean tree, from the baseline run.
+        const standing = (command) => {
+            const counts = opts.baseline?.get(verifyCommandKey(command));
+            return counts && [...counts.values()].some((n) => n > 0) ? "fails_on_base" : "runnable";
+        };
+        const recordCommand = (command, code, startedAt, baseline, note) => checks.push({
+            name: command.label,
+            command: command.argv.join(" "),
+            cwd: relative(cwd, command.cwd) || ".",
+            exitCode: code,
+            durationMs: now() - startedAt,
+            baseline,
+            ...(note ? { note } : {}),
+        });
         // TYPECHECK HALF (frozen behavior, §0.2): run every changed package's build
         // check; union the findings. One package that cannot spawn fails OPEN (a
         // recorded reason, no finding) without sinking the verdict for the packages
@@ -1281,6 +1458,7 @@ export function makeRunVerify(opts = {}) {
         const typecheckLabels = [];
         for (const command of commands) {
             const composed = composeAbortSignal(signal, AbortSignal.timeout(timeoutMs));
+            const startedAt = now();
             try {
                 const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed);
                 const output = scrubSecrets(rawOutput);
@@ -1292,16 +1470,22 @@ export function makeRunVerify(opts = {}) {
                     const infra = classifyVerifyInfraFailure(output, code);
                     if (infra) {
                         reasons.push(`verify (${command.label}) could not run: ${infra}`);
+                        recordCommand(command, code, startedAt, "cannot_run");
                         continue;
                     }
                 }
+                recordCommand(command, code, startedAt, standing(command));
                 anyRan = true;
                 typecheckLabels.push(command.label);
                 if (code !== 0) {
-                    findings.push(...parseVerifyFailures(output, code, command.label).map((f) => liftFinding(f, cwd, command.cwd)));
+                    const parsed = parseVerifyFailures(output, code, command.label, Number.POSITIVE_INFINITY).map((f) => liftFinding(f, cwd, command.cwd));
+                    const fresh = subtractBaseline(parsed, opts.baseline?.get(verifyCommandKey(command)));
+                    countPreexisting(command.label, fresh.excused);
+                    findings.push(...fresh.findings.slice(0, MAX_LOCATED_FINDINGS));
                 }
             }
             catch (err) {
+                recordCommand(command, null, startedAt, standing(command), unexitedNote(err, signal, composed));
                 const msg = err instanceof Error ? err.message : String(err);
                 reasons.push(`verify (${command.label}) could not run: ${scrubSecrets(msg)}`);
             }
@@ -1325,10 +1509,12 @@ export function makeRunVerify(opts = {}) {
                 for (const command of testCommands) {
                     const where = basename(command.cwd) || command.cwd;
                     const composed = composeAbortSignal(signal, AbortSignal.timeout(testTimeoutMs));
+                    const startedAt = now();
                     try {
                         const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed, testEnv);
                         const output = scrubSecrets(rawOutput);
-                        const cls = classifyTestFailure(output, code);
+                        const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY);
+                        recordCommand(command, code, startedAt, cls.kind === "infra" ? "cannot_run" : standing(command));
                         if (cls.kind === "infra") {
                             reasons.push(`tests (${where}) could not run: ${cls.reason}; 'clean' reflects typecheck + review only`);
                             continue;
@@ -1343,12 +1529,15 @@ export function makeRunVerify(opts = {}) {
                         testLabels.push(command.label);
                         if (cls.kind === "failures") {
                             const room = Math.max(0, MAX_LOCATED_FINDINGS - testFindingCount);
-                            const take = cls.findings.slice(0, room).map((f) => liftFinding(f, cwd, command.cwd));
+                            const fresh = subtractBaseline(cls.findings.map((f) => liftFinding(f, cwd, command.cwd)), opts.baseline?.get(verifyCommandKey(command)));
+                            countPreexisting(command.label, fresh.excused);
+                            const take = fresh.findings.slice(0, room);
                             testFindingCount += take.length;
                             findings.push(...take);
                         }
                     }
                     catch (err) {
+                        recordCommand(command, null, startedAt, standing(command), unexitedNote(err, signal, composed));
                         const msg = err instanceof Error ? err.message : String(err);
                         reasons.push(`tests (${where}) could not run: ${scrubSecrets(msg)}`);
                     }
@@ -1373,11 +1562,37 @@ export function makeRunVerify(opts = {}) {
                 });
                 reasons.push(...repo.reasons);
                 repoLabels.push(...repo.labels);
+                checks.push(...repo.checks);
                 if (repo.labels.length > 0)
                     anyRan = true;
                 findings.push(...repo.findings);
             }
         }
+        // SCAN HALF (YAG-1000): what this run added, against the host's own stop
+        // rules, whatever the other halves found: a credential is never the
+        // compile error's root cause, and it must not reach the host.
+        const scanLabels = [];
+        if (opts.scanChange) {
+            try {
+                const hits = await opts.scanChange(cwd, signal, baselinePaths);
+                if (hits === null) {
+                    reasons.push("the secret and binary scan could not read the change; the host still scans it");
+                }
+                else {
+                    anyRan = true;
+                    scanLabels.push("secret and binary scan");
+                    findings.push(...hits.slice(0, MAX_LOCATED_FINDINGS));
+                }
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                reasons.push(`the secret and binary scan could not run: ${scrubSecrets(msg)}; the host still scans the change`);
+            }
+        }
+        const note = preexistingNote(preexisting);
+        if (note)
+            reasons.push(note);
+        const preexistingTotal = [...preexisting.values()].reduce((sum, n) => sum + n, 0);
         // The command labels list only what produced a verdict — on every half —
         // so the FINISH trailer's `passed (<cmds>)` never claims a check that was
         // infra-skipped or threw (invariant §0.1).
@@ -1385,6 +1600,7 @@ export function makeRunVerify(opts = {}) {
             ...new Set(typecheckLabels),
             ...new Set(testLabels),
             ...new Set(repoLabels),
+            ...scanLabels,
         ].join(", ");
         if (!anyRan) {
             return {
@@ -1393,6 +1609,7 @@ export function makeRunVerify(opts = {}) {
                 command,
                 reason: reasons.join("; ") || "verify skipped",
                 findings: [],
+                checks,
             };
         }
         return {
@@ -1401,7 +1618,115 @@ export function makeRunVerify(opts = {}) {
             command,
             findings,
             ...(reasons.length ? { reason: reasons.join("; ") } : {}),
+            ...(preexistingTotal > 0 ? { preexisting: preexistingTotal } : {}),
+            checks,
         };
     };
 }
+/** The whole baseline run's cap, before the build starts: it costs minutes at most. */
+export const VERIFY_BASELINE_BUDGET_MS = 10 * 60_000;
+/**
+ * Run the gate's own typecheck and test commands ONCE on the clean tree,
+ * before the build changes anything (YAG-1003), in the package dirs the
+ * approved plan names, and keep each command's failure keys. The build's gate
+ * then counts only the failures this change added ({@link subtractBaseline}).
+ *
+ * The same detection, exec seam and environments as {@link makeRunVerify}, so
+ * a command's key and its failures' keys match the build's runs. Fail-open per
+ * command: one that cannot run, times out, or is not reached in the budget
+ * has no baseline, and its failures all count, as before. What the commands
+ * write into the tree is undone, so none of it reaches the candidate.
+ */
+export function makeTakeVerifyBaseline(opts = {}) {
+    const detect = opts.detect ?? defaultDetect;
+    const detectTests = opts.detectTests ?? defaultDetectTests;
+    const exec = opts.exec ?? defaultExec;
+    const now = opts.now ?? Date.now;
+    const treeStatus = opts.treeStatus ??
+        (async (cwd, signal) => (await snapshotWorkspace(cwd, signal)).status);
+    const undoTreeWrites = opts.undoTreeWrites ?? defaultUndoTreeWrites;
+    return async function takeVerifyBaseline(cwd, dirs, signal, budgetOverrideMs) {
+        const baseline = new Map();
+        const result = { baseline, ran: [], failures: 0, notes: [] };
+        if (dirs.length === 0)
+            return result;
+        const commands = detect(cwd, dirs);
+        const overridden = commands.some((c) => c.source === "override");
+        const tests = overridden ? [] : detectTests(cwd, dirs);
+        if (commands.length === 0 && tests.length === 0)
+            return result;
+        const startedAt = now();
+        const budgetMs = Math.min(opts.budgetMs ?? VERIFY_BASELINE_BUDGET_MS, budgetOverrideMs ?? Number.POSITIVE_INFINITY);
+        const before = await treeStatus(cwd, signal).catch((err) => {
+            const msg = err instanceof Error ? err.message : String(err);
+            result.notes.push(`could not read the tree before the baseline, so what it writes is not undone: ${scrubSecrets(msg)}`);
+            return null;
+        });
+        const runs = [
+            ...commands.map((command) => ({ command, test: false })),
+            ...tests.map((command) => ({ command, test: true })),
+        ];
+        try {
+            for (const { command, test } of runs) {
+                if (signal?.aborted)
+                    break;
+                const left = budgetMs - (now() - startedAt);
+                if (left < REPO_CHECK_MIN_START_MS) {
+                    result.notes.push(`${command.label} (${command.cwd}): not reached in the baseline budget`);
+                    continue;
+                }
+                const cap = Math.min(test
+                    ? (opts.testTimeoutMs ?? VERIFY_TEST_TIMEOUT_MS)
+                    : (opts.timeoutMs ?? VERIFY_TIMEOUT_MS), left);
+                const composed = composeAbortSignal(signal, AbortSignal.timeout(cap));
+                try {
+                    const { code, output: rawOutput } = test
+                        ? await exec(command.argv, command.cwd, composed, opts.testEnv ?? buildTestEnv())
+                        : await exec(command.argv, command.cwd, composed);
+                    const output = scrubSecrets(rawOutput);
+                    let failed;
+                    if (test) {
+                        const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY);
+                        if (cls.kind === "infra" || cls.kind === "uncertain") {
+                            result.notes.push(`${command.label} (${command.cwd}): ${cls.kind === "infra" ? cls.reason : "output not interpretable"}`);
+                            continue;
+                        }
+                        failed = cls.kind === "failures" ? cls.findings : [];
+                    }
+                    else {
+                        const infra = code === 0 ? null : classifyVerifyInfraFailure(output, code);
+                        if (infra) {
+                            result.notes.push(`${command.label} (${command.cwd}): ${infra}`);
+                            continue;
+                        }
+                        failed = parseVerifyFailures(output, code, command.label, Number.POSITIVE_INFINITY);
+                    }
+                    const counts = failureKeyCounts(failed.map((f) => liftFinding(f, cwd, command.cwd)));
+                    baseline.set(verifyCommandKey(command), counts);
+                    result.ran.push(command.label);
+                    for (const n of counts.values())
+                        result.failures += n;
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    result.notes.push(`${command.label} (${command.cwd}): could not run: ${scrubSecrets(msg)}`);
+                }
+            }
+        }
+        finally {
+            if (before !== null) {
+                try {
+                    const written = newTreeEntries(before, await treeStatus(cwd));
+                    if (written.length > 0)
+                        await undoTreeWrites(cwd, written);
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    result.notes.push(`could not undo what the baseline wrote into the tree: ${scrubSecrets(msg)}`);
+                }
+            }
+        }
+        return result;
+    };
+}
 //# sourceMappingURL=verify.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.6-staging.1951.1",
+  "version": "1.2.6-staging.1956.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "0985f34f33f3c59e0fb7ed50af520abbcbb2466c"
+  "yagniSourceSha": "bb058b7c375b03862aa2899c11e3c00b40d0b4f4"
 }