@yagni-app/code 0.3.2 → 0.3.3

package/dist/extension/{permission.d.ts → permission/gate.d.ts}

@@ -28,7 +28,8 @@
  */
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { type ApprovedPrefixGrant } from "./approvedPrefixes.js";
-import { type BlessStore } from "./bless.js";
+import type { HookRunner } from "../hooks.js";
+import { type BlessStore } from "../bless.js";
 import { type ExecPolicy } from "./execPolicy.js";
 import { type GuardianError, type GuardianRiskLevel } from "./guardian.js";
 export type PermissionMode = "auto" | "plan" | "review";
@@ -179,6 +180,12 @@ export interface RegisterPermissionDeps {
      * Fail-soft; never blocks.
      */
     onGuardianEvent?: (event: GuardianGateEvent) => void;
+    /**
+     * User-configurable lifecycle hooks (YAG-506). When present, PreToolUse
+     * hooks run before decideGate and can short-circuit (allow/deny/ask),
+     * and PermissionRequest hooks run before the confirm dialog.
+     */
+    hookRunner?: HookRunner;
 }
 /** The customType tag on injected mode-context messages (filterable later). */
 export declare const MODE_CONTEXT_TYPE = "yagni-mode-context";
@@ -202,4 +209,4 @@ export declare const filterStalePlanContext: typeof filterStaleModeContext;
  * auto, so absent any /mode this is a no-op over today's behavior.
  */
 export declare function registerPermissionGate(pi: ExtensionAPI, deps?: RegisterPermissionDeps): void;
-//# sourceMappingURL=permission.d.ts.map
+//# sourceMappingURL=gate.d.ts.map

package/dist/extension/{permission.js → permission/gate.js}

@@ -27,9 +27,9 @@
  * the context so the model doesn't keep believing it is restricted.
  */
 import { describePrefix, matchesGrant, validateGrant, } from "./approvedPrefixes.js";
-import { makeBlessStore as defaultMakeBlessStore } from "./bless.js";
+import { makeBlessStore as defaultMakeBlessStore } from "../bless.js";
 import { classifyCommand, DEFAULT_EXEC_POLICY } from "./execPolicy.js";
-import { isDebug } from "./diagnostics.js";
+import { isDebug } from "../diagnostics.js";
 import { buildDiagnosticEvent, checkCircuitBreaker, DEFAULT_GUARDIAN_LIMITS, } from "./guardian.js";
 export function createModeHolder(initial = "auto") {
     let current = initial;
@@ -296,6 +296,7 @@ export function registerPermissionGate(pi, deps = {}) {
     const basePolicy = deps.policy ?? DEFAULT_PERMISSION_POLICY;
     let mode = deps.mode ?? "auto";
     const makeStore = deps.makeBlessStore ?? defaultMakeBlessStore;
+    const hookRunner = deps.hookRunner;
     deps.modeHolder?.onSet((m) => {
         if (m !== mode)
             approvedCommands.clear();
@@ -422,7 +423,48 @@ export function registerPermissionGate(pi, deps = {}) {
         const modeAtEntry = mode;
         try {
             const input = event.input ?? {};
-            const decision = decideGate(event.toolName, input, modeAtEntry, effectivePolicy);
+            // YAG-506: PreToolUse hooks run BEFORE decideGate. They can short-circuit
+            // (allow/deny/ask) or fall through to the normal gate logic. The result
+            // is cached in preToolUseResult so the "ask" check below does NOT
+            // re-invoke the hook (hooks have side effects — notifications etc.).
+            let preToolUseResult;
+            if (hookRunner) {
+                const cwd = ctx?.cwd ?? ".";
+                try {
+                    preToolUseResult = await hookRunner.preToolUse(event.toolName, input, cwd, ctx?.isProjectTrusted()) ?? undefined;
+                    if (preToolUseResult) {
+                        if (preToolUseResult.decision === "deny") {
+                            return { block: true, reason: preToolUseResult.reason };
+                        }
+                        if (preToolUseResult.decision === "allow") {
+                            // Allow bypasses Guardian/confirm, but the exec policy's forbidden
+                            // band still runs as a hard safety floor (deliberate deviation
+                            // from Claude Code: we don't let a hook auto-allow a forbidden cmd).
+                            if (event.toolName === "bash") {
+                                const cmdRaw = input.command;
+                                const command = typeof cmdRaw === "string" ? cmdRaw.trim() : "";
+                                if (command) {
+                                    const execPolicy = effectivePolicy.execPolicy ?? DEFAULT_EXEC_POLICY;
+                                    const classification = classifyCommand(command, execPolicy);
+                                    if (classification.decision === "forbidden") {
+                                        return {
+                                            block: true,
+                                            reason: `${classification.justification}. Do not attempt the same outcome via a workaround or indirect execution — use a materially safer alternative, or ask the user.`,
+                                        };
+                                    }
+                                }
+                            }
+                            return {};
+                        }
+                        // "ask" → force confirm by overriding the gate decision
+                        // Falls through to decision.confirm logic below
+                    }
+                }
+                catch {
+                    // Fail-soft: a hook error never blocks or allows; fall through to gate
+                }
+            }
+            let decision = decideGate(event.toolName, input, modeAtEntry, effectivePolicy);
             if (decision.block)
                 return { block: true, reason: decision.reason };
             // Prompt band (YAG-510 order): grants → exact-command cache → cap/
@@ -587,6 +629,41 @@ export function registerPermissionGate(pi, deps = {}) {
                                 reason: `Guardian needs user approval: ${verdict.rationale} No UI available — the command was held. Find a safer alternative or leave this step for the user.`,
                             };
                         }
+                        // YAG-506: PermissionRequest hooks fire before the confirm dialog.
+                        // Only when a UI is present (headless path already failed closed above).
+                        if (hookRunner && ctx?.hasUI) {
+                            try {
+                                const hookResult = await hookRunner.permissionRequest(event.toolName, input, cwd, ctx?.isProjectTrusted());
+                                if (hookResult) {
+                                    if (hookResult.decision === "allow") {
+                                        rememberApproved(cwd, command);
+                                        emitGateEvent({
+                                            ...eventBase,
+                                            outcome: "ask_approved",
+                                            riskLevel: verdict.riskLevel,
+                                            rationale: verdict.rationale,
+                                            durationMs,
+                                            consulted: true,
+                                        });
+                                        return {};
+                                    }
+                                    if (hookResult.decision === "deny") {
+                                        emitGateEvent({
+                                            ...eventBase,
+                                            outcome: "ask_denied",
+                                            riskLevel: verdict.riskLevel,
+                                            rationale: verdict.rationale,
+                                            durationMs,
+                                            consulted: true,
+                                        });
+                                        return { block: true, reason: hookResult.reason };
+                                    }
+                                }
+                            }
+                            catch {
+                                // Fail-soft: hook error → dialog proceeds normally
+                            }
+                        }
                         // Offer "don't ask again" only when the grant would actually
                         // cover this command (grant-time validation).
                         const grantCandidate = validateGrant(command, effectivePolicy.execPolicy ?? DEFAULT_EXEC_POLICY, resolveRepoKeyFor(cwd));
@@ -725,7 +802,29 @@ export function registerPermissionGate(pi, deps = {}) {
                 }
                 // review mode with Guardian disabled/capped: fall through to confirm.
             }
+            // YAG-506: PreToolUse "ask" forces confirmation even in auto mode.
+            // Uses the cached result from the top of the handler — no re-invocation.
+            if (preToolUseResult?.decision === "ask") {
+                decision = { block: false, confirm: true };
+            }
             if (decision.confirm) {
+                // YAG-506: PermissionRequest hooks run before the confirm dialog.
+                if (hookRunner) {
+                    try {
+                        const cwd = ctx?.cwd ?? ".";
+                        const hookResult = await hookRunner.permissionRequest(event.toolName, input, cwd, ctx?.isProjectTrusted());
+                        if (hookResult) {
+                            if (hookResult.decision === "allow")
+                                return {};
+                            if (hookResult.decision === "deny") {
+                                return { block: true, reason: hookResult.reason };
+                            }
+                        }
+                    }
+                    catch {
+                        // Fail-soft: hook error → dialog proceeds normally
+                    }
+                }
                 // Review mode needs a confirmation. With no dialog-capable UI (headless),
                 // fail CLOSED: the user explicitly chose a stricter mode, so a write we
                 // cannot get consent for is held rather than silently auto-applied (this
@@ -832,4 +931,4 @@ export function registerPermissionGate(pi, deps = {}) {
         },
     });
 }
-//# sourceMappingURL=permission.js.map
+//# sourceMappingURL=gate.js.map

package/dist/extension/{guardian.d.ts → permission/guardian.d.ts}

@@ -27,8 +27,8 @@
  * exoneration — so an ask-preferring model cannot disarm the breaker by
  * alternating deny/ask.
  */
-import { runStage as defaultRunStage } from "./pipeline/runner.js";
-import type { PipelineStage } from "./pipeline/types.js";
+import { runStage as defaultRunStage } from "../pipeline/runner.js";
+import type { PipelineStage } from "../pipeline/types.js";
 export type GuardianOutcome = "allow" | "ask" | "deny";
 export type GuardianRiskLevel = "low" | "medium" | "high" | "critical";
 export interface GuardianVerdict {

package/dist/extension/{guardian.js → permission/guardian.js}

@@ -27,7 +27,7 @@
  * exoneration — so an ask-preferring model cannot disarm the breaker by
  * alternating deny/ask.
  */
-import { runStage as defaultRunStage } from "./pipeline/runner.js";
+import { runStage as defaultRunStage } from "../pipeline/runner.js";
 export const DEFAULT_GUARDIAN_LIMITS = {
     maxReviews: 120,
     maxConsecutiveDenials: 3,

package/dist/extension/permission/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Permission domain barrel.
+ *
+ * This file is the *public* re-export surface ONLY. Internal modules import
+ * each other directly (gate.ts → ./execPolicy.js), never through this barrel,
+ * to keep the dependency graph grep-able and avoid circular imports.
+ *
+ * See AGENTS.md alongside this directory for the seam map and how to extend.
+ */
+export * from "./execPolicy.js";
+export * from "./guardian.js";
+export * from "./approvedPrefixes.js";
+export * from "./gate.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/extension/permission/index.js

@@ -0,0 +1,14 @@
+/**
+ * Permission domain barrel.
+ *
+ * This file is the *public* re-export surface ONLY. Internal modules import
+ * each other directly (gate.ts → ./execPolicy.js), never through this barrel,
+ * to keep the dependency graph grep-able and avoid circular imports.
+ *
+ * See AGENTS.md alongside this directory for the seam map and how to extend.
+ */
+export * from "./execPolicy.js";
+export * from "./guardian.js";
+export * from "./approvedPrefixes.js";
+export * from "./gate.js";
+//# sourceMappingURL=index.js.map

package/dist/extension/permission/packageManagerPolicy.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Package-manager and dev-loop auto-allow policy (YAG-561).
+ *
+ * Companion to execPolicy.ts: this file owns the *data* and *parsing* for the
+ * package-manager / dev-loop band, while execPolicy.ts owns the core classifier
+ * (rule matching, construct floor, danger scan) and wires these helpers in.
+ *
+ * Two independent mechanisms live here:
+ *
+ * 1. Workspace-selector normalization — `pnpm --filter <pkg> test:file` should
+ *    match the same rules as `pnpm test:file`. We strip ONLY the value-bearing
+ *    "which workspace" options (never arbitrary flags), because an option we
+ *    do NOT recognize must degrade to `prompt`, never to `allow`.
+ *
+ * 2. Exec/dlx forwarders — `npx`, `pnpm exec`, `npm exec`, `yarn exec`,
+ *    `pnpm dlx`, `yarn dlx`, and `xargs` all forward to their argv tail. The
+ *    tail is classified as its own segment so `pnpm exec rm -rf` inherits rm's
+ *    forbidden floor and `npx tsc --noEmit` inherits tsc's allow.
+ *
+ * The allow rules themselves (`PACKAGE_MANAGER_ALLOW_RULES`) cover:
+ *   - dev-loop binaries reachable through a forwarder (and directly):
+ *     tsc (requires --noEmit), tsx (requires --test), vitest, jest;
+ *   - script namespaces `test:*` / `build:*` / `lint:*` across pnpm/npm/yarn.
+ *
+ * Deliberately NOT auto-allowed here: arbitrary `pnpm exec <binary>`, any
+ * `run <script>` outside the three namespaces (`pnpm run deploy` is prompt),
+ * and `pnpm install/add/remove` (they mutate node_modules). Those stay in the
+ * prompt band and go to the Guardian.
+ *
+ * See AGENTS.md alongside this directory for the "add a new spelling" recipe.
+ */
+import type { PrefixRule } from "./execPolicy.js";
+/**
+ * Strip value-bearing "which workspace" options so they don't break prefix
+ * matching. Matching-only: the returned tokens are used to CLASSIFY, never to
+ * run. Only the handlers below are stripped; anything unrecognized falls
+ * through untouched and degrades to `prompt` (fail closed).
+ *
+ *   pnpm: --filter <pkg> / -F <pkg>   (+ --filter=<pkg> glue)
+ *   npm : --workspace <pkg> / -w <pkg> (+ --workspace=<pkg> glue)
+ *   yarn: (none handled yet — `yarn workspace <name>` is left alone on purpose)
+ */
+export declare function normalizePackageManagerTokens(tokens: string[]): string[];
+/**
+ * If `tokens[0]` names a forwarder (xargs / npx / <mgr> exec / <mgr> dlx),
+ * return the index at which the forwarded command's argv begins. Return null
+ * otherwise. Forwarders exercise `require`d escape hatch: they match only when
+ * the manager word is a bare, path-unprefixed, unwrapped token (callers already
+ * forced `neverAllow` for wrappers/paths before this runs).
+ */
+export declare function forwarderTailStart(tokens: string[]): number | null;
+/** Human label for a forwarder, used in justification strings. */
+export declare function forwarderLabel(tokens: string[]): string;
+export declare const PACKAGE_MANAGER_ALLOW_RULES: PrefixRule[];
+//# sourceMappingURL=packageManagerPolicy.d.ts.map

package/dist/extension/permission/packageManagerPolicy.js

@@ -0,0 +1,170 @@
+/**
+ * Package-manager and dev-loop auto-allow policy (YAG-561).
+ *
+ * Companion to execPolicy.ts: this file owns the *data* and *parsing* for the
+ * package-manager / dev-loop band, while execPolicy.ts owns the core classifier
+ * (rule matching, construct floor, danger scan) and wires these helpers in.
+ *
+ * Two independent mechanisms live here:
+ *
+ * 1. Workspace-selector normalization — `pnpm --filter <pkg> test:file` should
+ *    match the same rules as `pnpm test:file`. We strip ONLY the value-bearing
+ *    "which workspace" options (never arbitrary flags), because an option we
+ *    do NOT recognize must degrade to `prompt`, never to `allow`.
+ *
+ * 2. Exec/dlx forwarders — `npx`, `pnpm exec`, `npm exec`, `yarn exec`,
+ *    `pnpm dlx`, `yarn dlx`, and `xargs` all forward to their argv tail. The
+ *    tail is classified as its own segment so `pnpm exec rm -rf` inherits rm's
+ *    forbidden floor and `npx tsc --noEmit` inherits tsc's allow.
+ *
+ * The allow rules themselves (`PACKAGE_MANAGER_ALLOW_RULES`) cover:
+ *   - dev-loop binaries reachable through a forwarder (and directly):
+ *     tsc (requires --noEmit), tsx (requires --test), vitest, jest;
+ *   - script namespaces `test:*` / `build:*` / `lint:*` across pnpm/npm/yarn.
+ *
+ * Deliberately NOT auto-allowed here: arbitrary `pnpm exec <binary>`, any
+ * `run <script>` outside the three namespaces (`pnpm run deploy` is prompt),
+ * and `pnpm install/add/remove` (they mutate node_modules). Those stay in the
+ * prompt band and go to the Guardian.
+ *
+ * See AGENTS.md alongside this directory for the "add a new spelling" recipe.
+ */
+// --- Workspace-selector normalization ---
+/**
+ * Strip value-bearing "which workspace" options so they don't break prefix
+ * matching. Matching-only: the returned tokens are used to CLASSIFY, never to
+ * run. Only the handlers below are stripped; anything unrecognized falls
+ * through untouched and degrades to `prompt` (fail closed).
+ *
+ *   pnpm: --filter <pkg> / -F <pkg>   (+ --filter=<pkg> glue)
+ *   npm : --workspace <pkg> / -w <pkg> (+ --workspace=<pkg> glue)
+ *   yarn: (none handled yet — `yarn workspace <name>` is left alone on purpose)
+ */
+export function normalizePackageManagerTokens(tokens) {
+    const cmd = tokens[0];
+    if (cmd !== "pnpm" && cmd !== "npm" && cmd !== "yarn")
+        return tokens;
+    const out = [cmd];
+    let i = 1;
+    while (i < tokens.length) {
+        const t = tokens[i];
+        if (cmd === "pnpm") {
+            // `--filter pkg` / `-F pkg` → skip option + its value
+            if (t === "--filter" || t === "-F") {
+                i += 2;
+                continue;
+            }
+            // glued `--filter=pkg` / `-F=pkg` → skip the single token
+            if (t.startsWith("--filter=") || t.startsWith("-F=")) {
+                i += 1;
+                continue;
+            }
+        }
+        else if (cmd === "npm") {
+            // `--workspace pkg` / `-w pkg` → skip option + its value
+            if (t === "--workspace" || t === "-w") {
+                i += 2;
+                continue;
+            }
+            if (t.startsWith("--workspace=") || t.startsWith("-w=")) {
+                i += 1;
+                continue;
+            }
+        }
+        // First non-selector token (yarn has none we handle) — stop stripping.
+        break;
+    }
+    out.push(...tokens.slice(i));
+    return out;
+}
+// --- Exec/dlx forwarders ---
+/**
+ * If `tokens[0]` names a forwarder (xargs / npx / <mgr> exec / <mgr> dlx),
+ * return the index at which the forwarded command's argv begins. Return null
+ * otherwise. Forwarders exercise `require`d escape hatch: they match only when
+ * the manager word is a bare, path-unprefixed, unwrapped token (callers already
+ * forced `neverAllow` for wrappers/paths before this runs).
+ */
+export function forwarderTailStart(tokens) {
+    const cmd = tokens[0];
+    if (cmd === "xargs" || cmd === "npx")
+        return 1;
+    if (tokens.length < 2)
+        return null;
+    const sub = tokens[1];
+    if (sub === "exec" && (cmd === "pnpm" || cmd === "npm" || cmd === "yarn"))
+        return 2;
+    if (sub === "dlx" && (cmd === "pnpm" || cmd === "yarn"))
+        return 2;
+    return null;
+}
+/** Human label for a forwarder, used in justification strings. */
+export function forwarderLabel(tokens) {
+    const cmd = tokens[0];
+    if (cmd === "npx" || cmd === "xargs")
+        return cmd;
+    return tokens.slice(0, 2).join(" ");
+}
+// --- Allow rules ---
+/**
+ * The auto-allow rules for the package-manager / dev-loop band. Appended to
+ * DEFAULT_EXEC_POLICY.rules by execPolicy.ts (first-match-wins ordering puts
+ * these specific rules ahead of the `npx`/`run`/`exec` prompt fallbacks).
+ *
+ * Safety invariants for every entry:
+ *   - tsc only allows with --noEmit (bare `tsc` would emit .js/.d.ts).
+ *   - tsx only allows with --test (bare `tsx file.ts` executes arbitrary TS).
+ *   - vitest / jest are pure test runners (no mutating flag to fence).
+ *   - script namespaces are read-only-by-convention test/build/lint and are
+ *     the ONLY `run` targets allowed; everything else (`run deploy`) is prompt.
+ */
+// The bare script name AND its `name:*` namespace (e.g. both `test` and
+// `test:backend`) — declared once so each manager rule reuses the same set.
+const SCRIPT_NAMESPACES = ["test", "test:*", "build", "build:*", "lint", "lint:*"];
+export const PACKAGE_MANAGER_ALLOW_RULES = [
+    // dev-loop binaries (reachable directly or through a forwarder)
+    {
+        pattern: ["tsc"],
+        flagsAnywhere: ["--noEmit"],
+        decision: "allow",
+        justification: "typecheck only (--noEmit writes no files)",
+    },
+    {
+        pattern: ["tsx"],
+        flagsAnywhere: ["--test"],
+        decision: "allow",
+        justification: "run tests via tsx (--test only, no script execution)",
+    },
+    { pattern: ["vitest"], decision: "allow", justification: "run vitest tests (routine dev-loop operation)" },
+    { pattern: ["vitest", "run"], decision: "allow", justification: "run vitest tests (routine dev-loop operation)" },
+    { pattern: ["jest"], decision: "allow", justification: "run jest tests (routine dev-loop operation)" },
+    // script namespaces — direct form (pnpm/yarn support `mgr <script>`) and
+    // universal `run <script>` form. npm direct form is omitted: npm requires
+    // `run` for colon-namespaced scripts.
+    {
+        pattern: ["pnpm", SCRIPT_NAMESPACES],
+        decision: "allow",
+        justification: "run a test/build/lint script (routine dev-loop operation)",
+    },
+    {
+        pattern: ["pnpm", "run", SCRIPT_NAMESPACES],
+        decision: "allow",
+        justification: "run a test/build/lint script (routine dev-loop operation)",
+    },
+    {
+        pattern: ["yarn", SCRIPT_NAMESPACES],
+        decision: "allow",
+        justification: "run a test/build/lint script (routine dev-loop operation)",
+    },
+    {
+        pattern: ["yarn", "run", SCRIPT_NAMESPACES],
+        decision: "allow",
+        justification: "run a test/build/lint script (routine dev-loop operation)",
+    },
+    {
+        pattern: ["npm", "run", SCRIPT_NAMESPACES],
+        decision: "allow",
+        justification: "run a test/build/lint script (routine dev-loop operation)",
+    },
+];
+//# sourceMappingURL=packageManagerPolicy.js.map

package/dist/extension/pipeline/activityFeed.js

@@ -92,9 +92,10 @@ export class ActivityFeed {
     }
     /** Fold a structured progress signal into stage transitions + the header tally. */
     applyProgress(p) {
-        // A per-lens signal is a desktop concern: it must not steal the buffer from
-        // the review stage that owns it, nor reset it mid fan-out.
-        if (p.kind === "stage_start" && !p.lens && p.stageId !== this.bufferStageId) {
+        // A per-lens or per-workstream signal is a desktop concern: it must not steal
+        // the buffer from the stage that owns it, nor reset it mid fan-out. The
+        // implement diamond's builders get exactly the review lenses' treatment.
+        if (p.kind === "stage_start" && !p.lens && !p.workstream && p.stageId !== this.bufferStageId) {
             this.bufferStageId = p.stageId;
             this.actions = [];
         }
@@ -129,6 +130,10 @@ export class ActivityFeed {
             headerParts.push(elapsed);
         const header = theme.bold(clipRow(headerParts.join(" · "), ROW_MAX));
         const lines = [header];
+        // The implement diamond collapses to ONE row plus a compact summary, the same
+        // way the review fan-out collapses to one review row: per-child rows are the
+        // desktop's business and would break the 10-line cap here.
+        const fan = this.run.fanoutRow();
         // Only the lens-less stage rows: the review fan-out's per-lens children are
         // the desktop's business, and surfacing them here would break the 10-line cap.
         for (const s of this.run.stageAgents()) {
@@ -138,8 +143,17 @@ export class ActivityFeed {
             if (s.id === "finish" && s.status === "pending")
                 continue;
             const glyph = glyphForStatus(s.status, spinnerFrame);
-            const label = s.stageId.padEnd(9);
-            const row = clipRow(`${glyph} ${label}${s.summary}`.trimEnd(), ROW_MAX);
+            // Padded past the longest stage name ("implement", 9) so every row keeps a
+            // separator between the label and its note; at 9 the implement row ran its
+            // name straight into its own summary.
+            const label = s.stageId.padEnd(10);
+            // While the fan is live the implement row's note IS the fan summary; once
+            // the stage settles its own narration takes the row back (and the summary
+            // stands in when there is no narration to show).
+            const fanNote = s.stageId === "implement" && fan?.mode === "fan" && (s.status === "active" || !s.summary)
+                ? `fanned ${fan.total} ways · ${fan.done}/${fan.total} done`
+                : undefined;
+            const row = clipRow(`${glyph} ${label}${fanNote ?? s.summary}`.trimEnd(), ROW_MAX);
             lines.push(theme.fg(themeColorForStatus[s.status], row));
             // The ring buffer renders under its OWNING stage (see RunState), so a
             // just-finished stage's resolved actions stay briefly visible beneath its ✔

package/dist/extension/pipeline/checker.d.ts

@@ -0,0 +1,99 @@
+/**
+ * PURE checker-side helpers for the implement diamond (spec decisions 5-7).
+ *
+ * The checker itself is deterministic and lives in `verify.ts` (the per-workstream
+ * scoped typecheck plus the one full `makeRunVerify` on the merged tree). What is
+ * left is the reading of its verdict, and that is all pure text math:
+ *
+ *  - {@link checkerFindings} unions the scoped + full findings into one deduped list.
+ *  - {@link composeSynthesizerInput} turns the fan handoff plus the checker's
+ *    verdict into the synthesizer's `{previous}`.
+ *  - {@link attributeFindings} routes each finding to the workstream whose claims
+ *    cover its file; anything unattributable is the synthesizer's (or, on the
+ *    single-writer path, the one builder's).
+ *  - {@link parseOpenFindings} reads the synthesizer's own "## Open findings"
+ *    section, because decision 7 lets the summary report defects the deterministic
+ *    checker cannot see.
+ *  - {@link composeResidue} names what is still open when the fix cap is reached,
+ *    so `reviewInput` hands the review loop the truth rather than a clean-looking
+ *    summary.
+ *
+ * No I/O, no model calls: the orchestrator owns the children, this module owns the
+ * reading, exactly the split `findings.ts` and `fanout.ts` already use.
+ */
+import { type PartitionWorkstream } from "./fanout.js";
+import type { Finding } from "./types.js";
+import type { VerifyOutcome, WorkstreamCheckResult } from "./verify.js";
+/** Everything the deterministic checker produced for one pass over the tree. */
+export interface CheckerReport {
+    /** Per-workstream scoped typecheck verdicts (empty on the single-writer path). */
+    scoped: WorkstreamCheckResult[];
+    /** The one full verify on the merged tree; null when it could not be consulted. */
+    verify: VerifyOutcome | null;
+}
+/** Findings routed to one workstream's builder for a fix turn. */
+export interface FindingAssignment {
+    workstream: PartitionWorkstream;
+    findings: Finding[];
+}
+/** How the fix loop splits a checker verdict across the children that can fix it. */
+export interface FindingAttribution {
+    assigned: FindingAssignment[];
+    /** Findings no workstream's claims cover: the synthesizer's seam work. */
+    unassigned: Finding[];
+}
+/** Union findings in first-seen order, deduped by file + line + message. */
+export declare function mergeFindings(...groups: Finding[][]): Finding[];
+/** Every defect this checker pass found: the scoped typechecks plus the full verify. */
+export declare function checkerFindings(report: CheckerReport): Finding[];
+/** One finding as a line a builder can act on (mirrors the review loop's handoff shape). */
+export declare function renderFindings(findings: Finding[]): string;
+/**
+ * The synthesizer's `{previous}`: the fan's own handoff (which already names each
+ * workstream, its claims, and any out-of-claim edits) plus the checker's verdict,
+ * with a broken workstream attributed BY NAME so the reconciler knows where to look.
+ */
+export declare function composeSynthesizerInput(handoff: string, report: CheckerReport): string;
+/**
+ * Route findings to the builders that can fix them: a finding whose file sits under
+ * a workstream's claims goes to that workstream (at its original tier), and anything
+ * else - no file, a file outside every claim, a seam between two workstreams - is
+ * unattributable and belongs to the synthesizer. With no workstreams (the
+ * single-writer path) everything is unassigned, which is exactly right: there is one
+ * builder and it owns the whole tree.
+ */
+export declare function attributeFindings(findings: Finding[], workstreams: PartitionWorkstream[]): FindingAttribution;
+/**
+ * The synthesizer's own "## Open findings" section (its persona output contract),
+ * as findings the fix loop can act on. "none" is a real answer and returns nothing;
+ * an absent section returns nothing too, because a summary that never claimed a
+ * defect is not evidence of one. Deliberately forgiving about the prose: what the
+ * loop needs is the line and, where the synthesizer named one, the file.
+ */
+export declare function parseOpenFindings(summary: string): Finding[];
+/**
+ * The same "## Open findings" section {@link parseOpenFindings} reads, REMOVED
+ * from a summary (heading and body, up to the next heading of any depth).
+ *
+ * A fix turn that only re-engaged builders never re-runs the synthesizer, so its
+ * summary stays the handoff verbatim. Once those defects are answered and the
+ * re-check is clean, leaving the section in place would hand the review loop a
+ * document that names open defects in one paragraph and calls the final check
+ * clean in the next. Everything else the synthesizer wrote is untouched: this
+ * drops only the section the fix loop has since resolved.
+ */
+export declare function stripOpenFindings(summary: string): string;
+/**
+ * What `reviewInput` says when the fix loop ran and then came back clean: the
+ * reviewers should know the candidate was repaired inside the implement stage, not
+ * that it was right first time. Absent when no fix turn ran, which keeps a
+ * clean-on-the-first-check run byte-identical to today's handoff.
+ */
+export declare function composeFixNote(turns: number): string;
+/**
+ * What `reviewInput` says when the fix cap is reached with defects still open
+ * (spec decision 7): named, not hidden, so the review loop picks them up knowing
+ * the implement stage already spent its turns on them.
+ */
+export declare function composeResidue(findings: Finding[], turns: number): string;
+//# sourceMappingURL=checker.d.ts.map