@yagni-app/code-staging 1.2.6-staging.1952.1 → 1.2.6-staging.1956.1

package/dist/extension/branding.d.ts

@@ -96,6 +96,21 @@ export declare const SANDBOX_ABSENT_COMMANDS: readonly string[];
  * contain the standalone word "pi", no `- ` bullet lines, no emojis.
  */
 export declare const SANDBOX_SECTION: string;
+/**
+ * The "Your sandbox" section for a cloud session (`yagni go --headless
+ * --cloud`, the one-attempt lane), in place of {@link SANDBOX_SECTION}: `gh`
+ * works through YAGNI's forwarder (the run token stands in for a GitHub
+ * token, and the forwarder holds the real one), ticket images are files, and
+ * sibling repositories clone on demand. The only absolute paths it names are
+ * the browser's, which {@link SANDBOX_SECTION} names too, so the pi image
+ * smoke's check of that section covers them; the input folder and the clone
+ * folder are named relative to the ticket and the home directory, since the
+ * host creates them per session and they are not on the image.
+ *
+ * Content constraints (parity with {@link TICKET_IMAGE_RULE}): must not
+ * contain the standalone word "pi", no `- ` bullet lines, no emojis.
+ */
+export declare const SANDBOX_CLOUD_SECTION: string;
 /**
  * File-tool steering: prefer the first-class write/edit tools over bash file
  * writes, one write call per file instead of a heredoc batch, and never create
@@ -200,6 +215,11 @@ export interface BrandSystemPromptOptions {
      * operations section. Absent or false, the prompt is exactly the laptop's.
      */
     sandbox?: boolean;
+    /**
+     * With `sandbox`, the session is a cloud session (`--cloud`): it gets
+     * {@link SANDBOX_CLOUD_SECTION} instead of {@link SANDBOX_SECTION}.
+     */
+    cloud?: boolean;
 }
 /**
  * Rebrand pi's assembled system prompt as YAGNI Code's, and optionally inject a

package/dist/extension/branding.js

@@ -145,7 +145,7 @@ export const GITHUB_OPERATIONS = "## GitHub Operations\n" +
     "quoting surface. Use the session scratchpad for the file.\n" +
     "\n" +
     "Write the body with the `write` tool, then:\n" +
-    "  gh pr create --title \"…\" --body-file <path>\n" +
+    '  gh pr create --title "…" --body-file <path>\n' +
     "  gh pr comment <n> --body-file <path>\n" +
     "  gh api repos/{owner}/{repo}/pulls/{number}/comments/{comment_id}/replies -F body=@<path>\n" +
     "  git commit -F <path>\n" +
@@ -196,7 +196,7 @@ export const SANDBOX_SECTION = `${SANDBOX_SECTION_HEADER}\n` +
     "\n" +
     "Ticket images: the ticket's screenshots are not on disk here. Each one is " +
     "described in words in the ticket's evidence pack, the \"Evidence behind the " +
-    "ticket\" section of the ticket you were given. Trust that description; a " +
+    'ticket" section of the ticket you were given. Trust that description; a ' +
     "screenshot named there as not read could not be described.\n" +
     "\n" +
     `A browser: Chrome is at \`${SANDBOX_CHROME_PATH}\` and Playwright is installed ` +
@@ -207,6 +207,49 @@ export const SANDBOX_SECTION = `${SANDBOX_SECTION_HEADER}\n` +
     "\n" +
     "Installs: the network is open, and you may install what the work needs. The " +
     "mission file says what to install.";
+/**
+ * The "Your sandbox" section for a cloud session (`yagni go --headless
+ * --cloud`, the one-attempt lane), in place of {@link SANDBOX_SECTION}: `gh`
+ * works through YAGNI's forwarder (the run token stands in for a GitHub
+ * token, and the forwarder holds the real one), ticket images are files, and
+ * sibling repositories clone on demand. The only absolute paths it names are
+ * the browser's, which {@link SANDBOX_SECTION} names too, so the pi image
+ * smoke's check of that section covers them; the input folder and the clone
+ * folder are named relative to the ticket and the home directory, since the
+ * host creates them per session and they are not on the image.
+ *
+ * Content constraints (parity with {@link TICKET_IMAGE_RULE}): must not
+ * contain the standalone word "pi", no `- ` bullet lines, no emojis.
+ */
+export const SANDBOX_CLOUD_SECTION = `${SANDBOX_SECTION_HEADER}\n` +
+    "\n" +
+    "This session runs in a YAGNI sandbox, not on a developer's laptop. Five things " +
+    "are true here.\n" +
+    "\n" +
+    "GitHub: `gh` works. It talks to YAGNI's forwarder, which makes each call as " +
+    "this Team's GitHub App, so no token you could write with is in this " +
+    "sandbox. It reads the repositories the installation can see, and it writes " +
+    "only to this attempt's branch and pull request; merging and approving a " +
+    "review are refused. Commit your work and do not push: YAGNI pushes the " +
+    "branch and opens the pull request after you finish.\n" +
+    "\n" +
+    "Ticket images: every image the ticket carries is a file in the `images` " +
+    "folder beside the ticket file, and the ticket names each one. Open each " +
+    "with the read tool before you rely on what the ticket says.\n" +
+    "\n" +
+    `A browser: Chrome is at \`${SANDBOX_CHROME_PATH}\` and Playwright is installed ` +
+    `at \`${SANDBOX_PLAYWRIGHT_DIR}\`. Load Playwright from ` +
+    `\`${SANDBOX_PLAYWRIGHT_DIR}/node_modules/playwright\` and launch Chrome with ` +
+    `\`executablePath: "${SANDBOX_CHROME_PATH}"\` to open a page, click through it, ` +
+    "or take a screenshot.\n" +
+    "\n" +
+    "Installs: the network is open, and you may install what the work needs.\n" +
+    "\n" +
+    "Other repositories: the ticket lists this account's other repositories. When " +
+    "the work depends on one, clone it read-only on demand with " +
+    "`git clone --filter=blob:none --depth 1` into `~/context/<repo>`: file " +
+    "contents arrive as you read them, so a clone takes seconds. Nothing there is " +
+    "part of your change.";
 /**
  * File-tool steering: prefer the first-class write/edit tools over bash file
  * writes, one write call per file instead of a heredoc batch, and never create
@@ -322,10 +365,10 @@ const PI_IDENTITY_LOOSE_RE = /You are [^\n.]*operating inside pi[^\n.]*\.(?:\s*Y
 const PI_DOCS_BLOCK_RE = /\n*Pi documentation \(read only[^\n]*(?:\n- [^\n]*)*/gi;
 /** Neutralize residual pi/Earendil brand tokens in pi-owned text. */
 function scrubPiHarness(text) {
-    return text
+    return (text
         .replace(/\bEarendil(?:\s+Works)?\b/gi, "YAGNI")
         // Whole-word "pi" only, so "api", "pip", "pipeline" are untouched.
-        .replace(/\bpi\b/gi, BRAND_NAME);
+        .replace(/\bpi\b/gi, BRAND_NAME));
 }
 /**
  * Scrub pi-brand tokens everywhere EXCEPT inside the user's <project_context>.
@@ -335,9 +378,7 @@ function scrubPiHarness(text) {
  */
 function scrubOutsideProjectContext(s) {
     const parts = s.split(/(<project_context>[\s\S]*?<\/project_context>)/);
-    return parts
-        .map((p) => (p.startsWith("<project_context>") ? p : scrubPiHarness(p)))
-        .join("");
+    return parts.map((p) => (p.startsWith("<project_context>") ? p : scrubPiHarness(p))).join("");
 }
 /**
  * Env switch that bypasses the system-prompt rewrite entirely, so pi's
@@ -425,7 +466,7 @@ export function brandSystemPrompt(original, opts = {}) {
             .replace(`\n\n${TICKET_IMAGE_RULE_HEADER}\n${TICKET_IMAGE_RULE}`, "")
             .replace(`\n\n${GITHUB_OPERATIONS}`, "");
         if (!s.includes(SANDBOX_SECTION_HEADER)) {
-            s = `${s}\n\n${SANDBOX_SECTION}`;
+            s = `${s}\n\n${opts.cloud ? SANDBOX_CLOUD_SECTION : SANDBOX_SECTION}`;
         }
     }
     else if (!s.includes(TICKET_IMAGE_RULE_HEADER)) {

package/dist/extension/index.js

@@ -46,6 +46,7 @@ import { sandboxFailureKey } from "./permission/approvedPrefixes.js";
 import { createEscapeTally } from "./sandbox/escapeTally.js";
 import { createGrantCensus } from "./permission/grantCensus.js";
 import { runsInSandboxHarness, toolchainSpawnHookFromEnv, toolchainUserBashOperations } from "./toolchain/spawnHook.js";
+import { CLOUD_SESSION_ENV } from "./pipeline/cloud.js";
 import { registerTelemetry as defaultRegisterTelemetry } from "./telemetry/register.js";
 import { loadHooksConfig, makeHookRunner, registerHooks } from "./hooks.js";
 import { loadPermissionRules } from "./permissionRules/loadConfig.js";
@@ -1584,6 +1585,9 @@ export async function registerYagni(pi, deps = {}) {
     // tool the section sends GitHub reads to) is registered. A local eval
     // compare sets eval mode without the harness, so it keeps the laptop's.
     const sandboxSession = evalMode && runsInSandboxHarness(env);
+    // A stage child of `yagni go --headless --cloud`: headlessGo sets the env
+    // where it parses the flag, and the session is told the cloud sandbox.
+    const cloudSession = sandboxSession && env[CLOUD_SESSION_ENV] === "1";
     pi.on("before_agent_start", (event) => noBranding
         ? undefined
         : {
@@ -1608,6 +1612,7 @@ export async function registerYagni(pi, deps = {}) {
                 attributionSection: attributionPromptSection(attribution()),
                 fileToolSteering: condensedToolsRegistered,
                 ...(sandboxSession ? { sandbox: true } : {}),
+                ...(cloudSession ? { cloud: true } : {}),
             }),
         });
     // Turn-lifecycle WAL: a `turn_start` with no matching `turn_end` is the

package/dist/extension/pipeline/changeScan.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The secret and binary scans the host runs when it stores and publishes a
+ * build's change, run inside the build's own verify (YAG-1000) so a hit comes
+ * back as a finding the fix turn removes, instead of a stop a person answers
+ * after the session has ended.
+ *
+ * Only the host's STOP rules are here, with its patterns, kept in step by hand
+ * (this package does not depend on the backend): the credential formats and
+ * live authorization headers of `PROVIDER_SECRET_PATTERNS` and
+ * `scanSecretSurface` in agent/runs/mission/codeCandidateMaterializer.ts; a
+ * random value assigned to a credential's name in code that ships (its
+ * `high_entropy_secret`); a credential of this session's own in the change
+ * (`assertDiffSafeForStorage` in integrations/e2b/candidatePersistence.ts);
+ * and a binary file other than an image (`binaryDiffPaths`). The host's
+ * note-only guesses (a random-looking string with no credential's name) stay
+ * on the host, where they are notes. The host's scans stay the backstop.
+ *
+ * Only what this run added is scanned: added lines of tracked files, and new
+ * files whole, never the tree's pre-run dirt.
+ */
+import type { Finding } from "./types.js";
+/** A test, fixture, doc or example file: its credentials are fakes written to be read. */
+export declare function isSamplePath(path: string): boolean;
+/** Text a file gained, with the line number each added line has in the file. */
+export interface AddedText {
+    path: string;
+    lines: Array<{
+        line: number;
+        text: string;
+    }>;
+}
+/**
+ * The stop-class secret findings in what this run added, one per kind and
+ * line. `sessionSecrets` are this session's own credentials (the run token),
+ * matched by value and never echoed.
+ */
+export declare function scanAddedText(files: readonly AddedText[], sessionSecrets?: readonly string[]): Finding[];
+/** A binary file this run added or changed, other than an image: the host never stores one. */
+export declare function binaryFindings(paths: readonly string[]): Finding[];
+/**
+ * A unified diff (`-U0`) as the text each file gained: its `+` lines with
+ * their new line numbers. Deleted files and binary sections gain nothing.
+ */
+export declare function addedTextOfDiff(diff: string): AddedText[];
+/** The git seam: argv run in `cwd`, resolving its exit code and output. */
+export type ScanExec = (argv: string[], cwd: string, signal?: AbortSignal) => Promise<{
+    code: number;
+    output: string;
+}>;
+export interface ChangeScanOpts {
+    exec: ScanExec;
+    /** This session's own credentials, matched by value. */
+    sessionSecrets?: readonly string[];
+    readFile?: (path: string) => Buffer;
+}
+/**
+ * Scan what this run added on top of HEAD: tracked files' added lines, new
+ * files whole, minus `skip` (the tree's pre-run dirt). Null when git could
+ * not say what changed: the gate then notes the scan did not run.
+ */
+export declare function scanChange(cwd: string, opts: ChangeScanOpts, skip?: readonly string[], signal?: AbortSignal): Promise<Finding[] | null>;
+//# sourceMappingURL=changeScan.d.ts.map

package/dist/extension/pipeline/changeScan.js

@@ -0,0 +1,307 @@
+/**
+ * The secret and binary scans the host runs when it stores and publishes a
+ * build's change, run inside the build's own verify (YAG-1000) so a hit comes
+ * back as a finding the fix turn removes, instead of a stop a person answers
+ * after the session has ended.
+ *
+ * Only the host's STOP rules are here, with its patterns, kept in step by hand
+ * (this package does not depend on the backend): the credential formats and
+ * live authorization headers of `PROVIDER_SECRET_PATTERNS` and
+ * `scanSecretSurface` in agent/runs/mission/codeCandidateMaterializer.ts; a
+ * random value assigned to a credential's name in code that ships (its
+ * `high_entropy_secret`); a credential of this session's own in the change
+ * (`assertDiffSafeForStorage` in integrations/e2b/candidatePersistence.ts);
+ * and a binary file other than an image (`binaryDiffPaths`). The host's
+ * note-only guesses (a random-looking string with no credential's name) stay
+ * on the host, where they are notes. The host's scans stay the backstop.
+ *
+ * Only what this run added is scanned: added lines of tracked files, and new
+ * files whole, never the tree's pre-run dirt.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+/** Credential formats: each stops publication in every file. */
+const PROVIDER_SECRET_PATTERNS = [
+    [
+        "private_key",
+        /-----BEGIN (?:(?:RSA|EC|DSA|OPENSSH|ENCRYPTED) )?PRIVATE KEY-----|-----BEGIN PGP PRIVATE KEY BLOCK-----/i,
+    ],
+    ["github_token", /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/],
+    ["aws_access_key", /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/],
+    ["slack_token", /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/],
+    ["anthropic_key", /\bsk-ant-(?:api\d{2}-)?[A-Za-z0-9_-]{20,}\b/],
+    ["openai_key", /\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}\b/],
+    ["stripe_secret", /\b(?:(?:sk|rk)_live_[A-Za-z0-9]{16,}|whsec_[A-Za-z0-9]{16,})\b/],
+    ["google_api_key", /\bAIza[0-9A-Za-z_-]{20,}\b/],
+    ["gitlab_token", /\bglpat-[A-Za-z0-9_-]{20,}\b/],
+    ["npm_token", /\bnpm_[A-Za-z0-9]{20,}\b/],
+    ["sendgrid_key", /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/],
+    ["yagni_code_token", /\byagnicode_[A-Za-z0-9_-]{20,}\b/],
+    [
+        "credentialed_url",
+        /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis):\/\/[^:\s/@]+:[^@\s/]{8,}@/i,
+    ],
+];
+/** A name that says its value is a credential (`API_SECRET`, `aws_secret_access_key`, `DB_PASSWORD`). */
+const SENSITIVE_NAME = "(?:[A-Za-z0-9]+_)*(?:api[_-]?key|client[_-]?secret|access[_-]?token|access[_-]?key|private[_-]?key|secret[_-]?key|auth[_-]?token|authorization|credentials?|password|passwd|secret|token)";
+/** A name whose value people choose from words, so words are no sign it is not one. */
+const PASSWORD_NAME = /pass(?:word|wd)|pwd/i;
+const QUOTED_ASSIGNMENT = new RegExp(`\\b${SENSITIVE_NAME}\\b[\\s\\]}'".-]{0,40}[:=]\\s*["'\\x60]([^"'\\x60\\r\\n]{12,512})["'\\x60]`, "gi");
+const UNQUOTED_ASSIGNMENT = new RegExp(`\\b${SENSITIVE_NAME}\\b[\\s\\]}'".-]{0,40}[:=]\\s*([A-Za-z0-9_+./=-]{16,512})(?=[\\s,;}#]|$)`, "gim");
+const AUTHORIZATION = /\bauthorization\b[\s\]}'".-]{0,40}[:=]\s*["'`](?:bearer|basic)\s+([^\s"'`]{12,512})["'`]/gi;
+const IMAGE_EXTENSIONS = [".png", ".jpg", ".jpeg", ".gif", ".webp", ".avif", ".ico"];
+function shannonEntropy(value) {
+    const frequencies = new Map();
+    for (const character of value)
+        frequencies.set(character, (frequencies.get(character) ?? 0) + 1);
+    let entropy = 0;
+    for (const count of frequencies.values()) {
+        const probability = count / value.length;
+        entropy -= probability * Math.log2(probability);
+    }
+    return entropy;
+}
+function looksLikePlaceholder(value) {
+    return (/(?:example|placeholder|change[-_ ]?me|not[-_ ]?a[-_ ]?real|dummy|sample|redacted|your[-_ ]?(?:key|secret|token)|<[^>]+>|\$\{)/.test(value.toLowerCase()) || /^(.)\1{11,}$/.test(value));
+}
+function looksLikeHighEntropySecret(value) {
+    const trimmed = value.trim();
+    if (trimmed.length < 16 ||
+        trimmed.length > 512 ||
+        looksLikePlaceholder(trimmed) ||
+        /^[0-9a-f]{40}$|^[0-9a-f]{64}$|^[0-9a-f]{128}$/i.test(trimmed) ||
+        /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(trimmed) ||
+        /^-----BEGIN (?:PUBLIC KEY|CERTIFICATE)-----$/i.test(trimmed) ||
+        /^(?:https?:\/\/|process\.env\.|env\.)/i.test(trimmed)) {
+        return false;
+    }
+    const compact = trimmed.replace(/\s/g, "");
+    if (compact.length < 16)
+        return false;
+    const classes = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^A-Za-z0-9]/].filter((pattern) => pattern.test(compact)).length;
+    const entropy = shannonEntropy(compact);
+    return entropy >= 3.8 || (entropy >= 3.25 && classes >= 3);
+}
+/** A name a program gives something (`verifyWorkerAuthorization`, `NMT-DISCOVERY-FLATLINE-KEY`), not a value it keeps. */
+function identifierShaped(value) {
+    if (!/^[A-Za-z0-9_./:#@-]+$/.test(value))
+        return false;
+    if ((value.match(/\d/g)?.length ?? 0) > 3)
+        return false;
+    const words = value
+        .split(/[^A-Za-z0-9]+/)
+        .flatMap((part) => part.split(/(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/))
+        .filter(Boolean);
+    if (words.length < 2)
+        return false;
+    const characters = words.reduce((sum, word) => sum + word.length, 0);
+    return (characters >= words.length * 4 &&
+        words.every((word) => /^(?:[A-Z]?[a-z]+|[A-Z]+)\d{0,3}$|^[a-z]*\d{1,3}[a-z]*$/.test(word) &&
+            (word.length >= 2 || /^\d$/.test(word)) &&
+            (word.length < 5 || /[aeiouy]/i.test(word))));
+}
+/** A test, fixture, doc or example file: its credentials are fakes written to be read. */
+export function isSamplePath(path) {
+    return (/(?:^|\/)(?:tests?|__tests__|specs?|e2e|fixtures?|__fixtures__|testdata)\//.test(path) ||
+        /\.(?:test|spec)\.[A-Za-z0-9]+$|_(?:test|spec)\.[A-Za-z0-9]+$|(?:^|\/)test_[^/]*\.py$/.test(path) ||
+        /[a-z0-9]Tests?\.(?:php|java|kt|cs|swift|scala|groovy)$/.test(path) ||
+        /(?:^|\/)(?:docs?|examples?|samples?)\//.test(path) ||
+        /\.(?:md|mdx|markdown|rst|adoc)$/i.test(path));
+}
+function isImagePath(path) {
+    const lower = path.toLowerCase();
+    return IMAGE_EXTENSIONS.some((extension) => lower.endsWith(extension));
+}
+const WORDS = {
+    private_key: "a private key",
+    github_token: "a GitHub token",
+    aws_access_key: "an AWS access key",
+    slack_token: "a Slack token",
+    anthropic_key: "an Anthropic key",
+    openai_key: "an OpenAI key",
+    stripe_secret: "a Stripe secret",
+    google_api_key: "a Google API key",
+    gitlab_token: "a GitLab token",
+    npm_token: "an npm token",
+    sendgrid_key: "a SendGrid key",
+    yagni_code_token: "a YAGNI Code token",
+    credentialed_url: "a database URL with its password",
+    authorization_token: "a live authorization header",
+    high_entropy_secret: "a random value assigned to a credential's name",
+    session_credential: "a credential from this session",
+};
+function finding(path, line, kind) {
+    return {
+        severity: "critical",
+        lens: "does_it_hold",
+        file: path,
+        line,
+        message: `secret scan: this adds ${WORDS[kind] ?? kind.replace(/_/g, " ")}, and YAGNI will not publish a change that holds one. ` +
+            "Take it out (read it from the environment or a secret store instead). A test value must not look like a real credential: use an obvious fake such as `test-token`.",
+    };
+}
+/**
+ * The stop-class secret findings in what this run added, one per kind and
+ * line. `sessionSecrets` are this session's own credentials (the run token),
+ * matched by value and never echoed.
+ */
+export function scanAddedText(files, sessionSecrets = []) {
+    const out = [];
+    const seen = new Set();
+    const secrets = sessionSecrets.filter((secret) => secret.length >= 16);
+    for (const file of files) {
+        const text = file.lines.map((entry) => entry.text).join("\n");
+        const starts = [];
+        let offset = 0;
+        for (const entry of file.lines) {
+            starts.push(offset);
+            offset += entry.text.length + 1;
+        }
+        const lineAt = (index) => {
+            let at = 0;
+            while (at + 1 < starts.length && starts[at + 1] <= index)
+                at += 1;
+            return file.lines[at]?.line ?? 1;
+        };
+        const add = (kind, index) => {
+            const line = lineAt(index);
+            const key = `${file.path}\u0000${line}\u0000${kind}`;
+            if (seen.has(key))
+                return;
+            seen.add(key);
+            out.push(finding(file.path, line, kind));
+        };
+        for (const [kind, pattern] of PROVIDER_SECRET_PATTERNS) {
+            const index = text.search(pattern);
+            if (index >= 0)
+                add(kind, index);
+        }
+        for (const match of text.matchAll(AUTHORIZATION)) {
+            if (!looksLikePlaceholder(match[1] ?? ""))
+                add("authorization_token", match.index ?? 0);
+        }
+        if (!isSamplePath(file.path)) {
+            const named = (index, value, assignment) => {
+                if (!looksLikeHighEntropySecret(value))
+                    return;
+                if (identifierShaped(value) && !PASSWORD_NAME.test(assignment.slice(0, -value.length)))
+                    return;
+                add("high_entropy_secret", index);
+            };
+            for (const match of text.matchAll(QUOTED_ASSIGNMENT)) {
+                named(match.index ?? 0, match[1] ?? "", match[0].slice(0, -1));
+            }
+            for (const match of text.matchAll(UNQUOTED_ASSIGNMENT))
+                named(match.index ?? 0, match[1] ?? "", match[0]);
+        }
+        for (const secret of secrets) {
+            const index = text.indexOf(secret);
+            if (index >= 0)
+                add("session_credential", index);
+        }
+    }
+    return out;
+}
+/** A binary file this run added or changed, other than an image: the host never stores one. */
+export function binaryFindings(paths) {
+    return paths
+        .filter((path) => !isImagePath(path))
+        .map((path) => ({
+        severity: "critical",
+        lens: "does_it_hold",
+        file: path,
+        message: "binary scan: this adds or changes a binary file, and YAGNI will not publish a change that holds one (images are the exception). " +
+            "Remove it, or produce it from source in the build instead of committing it.",
+    }));
+}
+/**
+ * A unified diff (`-U0`) as the text each file gained: its `+` lines with
+ * their new line numbers. Deleted files and binary sections gain nothing.
+ */
+export function addedTextOfDiff(diff) {
+    const files = [];
+    let current;
+    let next = 0;
+    for (const raw of diff.split("\n")) {
+        if (raw.startsWith("diff --git ")) {
+            current = undefined;
+            continue;
+        }
+        if (raw.startsWith("+++ ")) {
+            const path = raw.slice(4).replace(/\t.*$/, "");
+            current = path === "/dev/null" ? undefined : { path: path.replace(/^b\//, ""), lines: [] };
+            if (current)
+                files.push(current);
+            continue;
+        }
+        const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(raw);
+        if (hunk) {
+            next = Number(hunk[1]);
+            continue;
+        }
+        if (current && raw.startsWith("+")) {
+            current.lines.push({ line: next, text: raw.slice(1) });
+            next += 1;
+        }
+    }
+    return files.filter((file) => file.lines.length > 0);
+}
+/** A new file's bytes hold a NUL in their first 8000: git's own test for binary. */
+function bytesAreBinary(bytes) {
+    return bytes.subarray(0, 8000).includes(0);
+}
+/** How much of one new file is scanned: a credential sits in source, not past the first megabyte. */
+const MAX_SCANNED_FILE_BYTES = 1024 * 1024;
+/**
+ * Scan what this run added on top of HEAD: tracked files' added lines, new
+ * files whole, minus `skip` (the tree's pre-run dirt). Null when git could
+ * not say what changed: the gate then notes the scan did not run.
+ */
+export async function scanChange(cwd, opts, skip = [], signal) {
+    // `git status --porcelain` lists an untracked folder as `dir/`, so a skip
+    // entry ending in `/` covers every file under it (FINISH leaves it out of
+    // the commit the same way).
+    const skipFiles = new Set(skip.filter((path) => !path.endsWith("/")));
+    const skipDirs = skip.filter((path) => path.endsWith("/"));
+    const skipped = {
+        has: (path) => skipFiles.has(path) || skipDirs.some((dir) => path.startsWith(dir)),
+    };
+    const git = (args) => opts.exec(["git", "-c", "core.quotepath=off", ...args], cwd, signal);
+    // A deleted binary is no binary in the change: the host lets it through.
+    const [numstat, diff, others] = await Promise.all([
+        git(["diff", "HEAD", "--numstat", "--no-renames", "--no-ext-diff", "--diff-filter=d"]),
+        git(["diff", "HEAD", "-U0", "--no-color", "--no-renames", "--no-ext-diff"]),
+        git(["ls-files", "--others", "--exclude-standard"]),
+    ]);
+    if (numstat.code !== 0 || diff.code !== 0 || others.code !== 0)
+        return null;
+    const binary = numstat.output
+        .split("\n")
+        .map((line) => /^-\t-\t(.+)$/.exec(line)?.[1])
+        .filter((path) => Boolean(path) && !skipped.has(path));
+    const added = addedTextOfDiff(diff.output).filter((file) => !skipped.has(file.path));
+    const read = opts.readFile ?? ((path) => readFileSync(path));
+    for (const path of others.output.split("\n").map((line) => line.trim())) {
+        if (!path || skipped.has(path))
+            continue;
+        let bytes;
+        try {
+            bytes = read(join(cwd, path));
+        }
+        catch {
+            continue;
+        }
+        if (bytesAreBinary(bytes)) {
+            binary.push(path);
+            continue;
+        }
+        const lines = bytes
+            .subarray(0, MAX_SCANNED_FILE_BYTES)
+            .toString("utf8")
+            .split("\n")
+            .map((text, index) => ({ line: index + 1, text }));
+        added.push({ path, lines });
+    }
+    return [...binaryFindings(binary), ...scanAddedText(added, opts.sessionSecrets ?? [])];
+}
+//# sourceMappingURL=changeScan.js.map