agentic-engineering-harness 0.8.3 → 0.8.4

package/dist/utils/process.js

@@ -6,6 +6,20 @@ export function clearToolchainEnvCache() { toolchainPathCache.clear(); }
 export async function runProcess(command, options) {
     const started = Date.now();
     const inherited = { ...process.env, ...(options.env ?? {}) };
+    // Controller identity is authoritative only inside the controller/AEH
+    // process itself. Never leak it into arbitrary shell commands such as
+    // npm test, whose explicit repository root must remain authoritative.
+    // The managed-agent envelope is authoritative only inside the process that
+    // owns it. Repository commands and tools must not inherit it: otherwise a
+    // bounded child can be mistaken for an AEH participant and re-enter the
+    // controller, or observe another operation's routing state.
+    for (const name of [
+        "AEH_OPERATION_ID", "AEH_OPERATION_KIND", "AEH_CONTROL_ROOT", "AEH_OPERATION_STATE_REDIRECT", "AEH_OPERATION_WORKSPACE_ID",
+        "AEH_MANAGED_AGENT", "AEH_LOGICAL_AGENT", "AEH_AGENT_ROLE", "AEH_PARENT_OPERATION_ID", "AEH_PARENT_OPERATION_KIND", "AEH_AGENT_PHASE",
+        "AEH_INTERACTIVE_LEAD", "AEH_ORCHESTRATION_ALLOWED", "AEH_ALLOW_NESTED_OPERATION", "AEH_OPERATION_SUPERVISOR", "AEH_PARENT_AGENT_ID",
+        "AEH_SUPERVISOR_GENERATION", "AEH_CONTEXT_OPERATION_ID", "AEH_CONTEXT_PHASE", "AEH_CONTEXT_ROOT", "AEH_ENTRY_FILE"
+    ])
+        delete inherited[name];
     if (options.toolchain !== false) {
         const prefix = await toolchainPathPrefix(options.cwd);
         if (prefix)
@@ -16,6 +30,7 @@ export async function runProcess(command, options) {
             cwd: options.cwd,
             shell: options.shell ?? true,
             env: inherited,
+            detached: process.platform !== "win32",
             stdio: [options.stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"]
         });
         let stdout = "";
@@ -27,17 +42,167 @@ export async function runProcess(command, options) {
                 reject(error); });
             child.stdin?.end(options.stdin);
         }
-        const timer = options.timeoutMs
-            ? setTimeout(() => child.kill("SIGTERM"), options.timeoutMs)
-            : undefined;
-        child.on("error", reject);
-        child.on("close", (code) => {
+        let settled = false;
+        let timer;
+        let killTimer;
+        let forceSettleTimer;
+        let terminated = false;
+        let timedOut = false;
+        let exited = false;
+        let exitCode = null;
+        let exitSignal = null;
+        let unregister = async () => undefined;
+        const registered = registerManagedProcessHandle(child.pid);
+        void registered.then((cleanup) => {
+            unregister = cleanup;
+            if (settled)
+                void unregister();
+        });
+        const kill = (signal) => {
+            try {
+                if (process.platform !== "win32" && child.pid)
+                    process.kill(-child.pid, signal);
+                else
+                    child.kill(signal);
+            }
+            catch { /* process already exited */ }
+        };
+        const terminate = () => {
+            if (terminated)
+                return;
+            terminated = true;
+            kill("SIGTERM");
+            killTimer = setTimeout(() => kill("SIGKILL"), 250);
+            killTimer.unref();
+            forceSettleTimer = setTimeout(() => finish(exitCode ?? 124, exitSignal ?? "SIGKILL", true), 1_000);
+            forceSettleTimer.unref();
+        };
+        if (options.timeoutMs)
+            timer = setTimeout(() => { timedOut = true; terminate(); }, options.timeoutMs);
+        const onAbort = () => terminate();
+        if (options.signal?.aborted)
+            onAbort();
+        else
+            options.signal?.addEventListener("abort", onAbort, { once: true });
+        child.on("error", (error) => {
+            if (settled)
+                return;
+            settled = true;
             if (timer)
                 clearTimeout(timer);
-            resolve({ exitCode: code ?? 1, stdout, stderr, durationMs: Date.now() - started });
+            if (killTimer)
+                clearTimeout(killTimer);
+            if (forceSettleTimer)
+                clearTimeout(forceSettleTimer);
+            options.signal?.removeEventListener("abort", onAbort);
+            void unregister().finally(() => reject(error));
+        });
+        child.on("exit", (code, signal) => {
+            exited = true;
+            exitCode = code;
+            exitSignal = signal;
+            if (!settled && !forceSettleTimer) {
+                forceSettleTimer = setTimeout(() => finish(code ?? 1, signal, false), 1_000);
+                forceSettleTimer.unref();
+            }
+        });
+        child.on("close", (code) => {
+            finish(code ?? exitCode ?? 1, exitSignal, false);
         });
+        function finish(code, signal, forced) {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            if (killTimer)
+                clearTimeout(killTimer);
+            if (forceSettleTimer)
+                clearTimeout(forceSettleTimer);
+            options.signal?.removeEventListener("abort", onAbort);
+            if (forced || !exited) {
+                child.stdout?.destroy();
+                child.stderr?.destroy();
+                child.stdin?.destroy();
+            }
+            void unregister().finally(() => resolve({
+                exitCode: code,
+                stdout,
+                stderr,
+                durationMs: Date.now() - started,
+                timedOut
+            }));
+        }
     });
 }
+export async function listManagedProcessHandles(root, operationId) {
+    const directory = managedProcessDirectory(root, operationId);
+    let entries;
+    try {
+        entries = await fs.readdir(directory);
+    }
+    catch {
+        return [];
+    }
+    const handles = [];
+    for (const entry of entries) {
+        if (!entry.endsWith(".json"))
+            continue;
+        try {
+            const value = JSON.parse(await fs.readFile(path.join(directory, entry), "utf8"));
+            if (Number.isInteger(value.pid) && Number(value.pid) > 0) {
+                handles.push({ pid: Number(value.pid), processGroupId: Number.isInteger(value.processGroupId) && Number(value.processGroupId) > 0 ? Number(value.processGroupId) : Number(value.pid) });
+            }
+        }
+        catch { /* stale or partially-written handle */ }
+    }
+    return handles;
+}
+export async function clearManagedProcessHandles(root, operationId) {
+    await fs.rm(managedProcessDirectory(root, operationId), { recursive: true, force: true }).catch(() => undefined);
+}
+export async function terminateManagedProcessGroup(pid, graceMs = 250) {
+    if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid)
+        return;
+    const signal = (value) => {
+        try {
+            if (process.platform !== "win32") {
+                try {
+                    process.kill(-pid, value);
+                }
+                catch {
+                    process.kill(pid, value);
+                }
+            }
+            else
+                process.kill(pid, value);
+        }
+        catch { /* process already exited */ }
+    };
+    signal("SIGTERM");
+    await new Promise((resolve) => setTimeout(resolve, graceMs));
+    signal("SIGKILL");
+}
+export async function registerManagedProcessHandle(pid) {
+    const operationId = process.env.AEH_OPERATION_ID?.trim();
+    const controlRoot = process.env.AEH_CONTROL_ROOT?.trim();
+    if (!pid || !operationId || !controlRoot || process.env.AEH_OPERATION_STATE_REDIRECT !== "1")
+        return async () => undefined;
+    const directory = managedProcessDirectory(controlRoot, operationId);
+    const file = path.join(directory, `${pid}.json`);
+    try {
+        await fs.mkdir(directory, { recursive: true });
+        await fs.writeFile(file, `${JSON.stringify({ pid, processGroupId: pid, startedAt: new Date().toISOString() })}\n`, { flag: "wx" });
+        return async () => { await fs.rm(file, { force: true }).catch(() => undefined); };
+    }
+    catch {
+        return async () => undefined;
+    }
+}
+function managedProcessDirectory(root, operationId) {
+    const safeOperationId = operationId.replace(/[^A-Za-z0-9._-]/g, "_");
+    return path.resolve(root, ".harness", "operations", `${safeOperationId}.processes`);
+}
 export async function commandExists(command, cwd) {
     const result = await runProcess(`command -v ${shell(command)}`, { cwd });
     return result.exitCode === 0;

package/dist/utils/process.js.map

@@ -1 +1 @@
-{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/utils/process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAS7B,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA8B,CAAC;AACjE,MAAM,UAAU,sBAAsB,KAAW,kBAAkB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAE9E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,OAAqJ;IAErJ,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7D,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,MAAM;YAAE,SAAS,CAAC,IAAI,GAAG,GAAG,MAAM,GAAG,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE;YAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;YAC5B,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SACzE,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAA6B,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAA6B,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3G,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS;YAC7B,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC;YAC5D,CAAC,CAAC,SAAS,CAAC;QAEd,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;YACxC,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,GAAW;IAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,cAAc,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,GAAW;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAC;YACpI,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;YAAC,CAAC;YACtI,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAC,OAAO,MAAM,CAAC;QAC3H,CAAC;QAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACpC,CAAC;IACD,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAAC,OAAO,SAAS,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAa;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAAC,IAAI,OAAO,GAAG,KAAK,CAAC;IAChD,OAAO,IAAI,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAAC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC1G,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBAAC,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC;oBAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACxJ,IAAI,KAAK,IAAI,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,MAAM,KAAK,OAAO;YAAE,MAAM;QAAC,OAAO,GAAG,MAAM,CAAC;IACxF,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AACD,SAAS,KAAK,CAAC,KAAa,IAAY,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC"}
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/utils/process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAe7B,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA8B,CAAC;AACjE,MAAM,UAAU,sBAAsB,KAAW,kBAAkB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAE9E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,OAA2K;IAE3K,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7D,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,4DAA4D;IAC5D,KAAK,MAAM,IAAI,IAAI;QACjB,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,4BAA4B;QAC1H,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,iBAAiB;QACrI,sBAAsB,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,qBAAqB;QACpI,2BAA2B,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB;KACnH;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,MAAM;YAAE,SAAS,CAAC,IAAI,GAAG,GAAG,MAAM,GAAG,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE;YAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;YAC5B,GAAG,EAAE,SAAS;YACd,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;YACtC,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SACzE,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAA6B,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAA6B,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3G,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,KAAiC,CAAC;QACtC,IAAI,SAAqC,CAAC;QAC1C,IAAI,gBAA4C,CAAC;QACjD,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,UAAU,GAA0B,IAAI,CAAC;QAC7C,IAAI,UAAU,GAAwB,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;QAC5D,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3D,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC/B,UAAU,GAAG,OAAO,CAAC;YACrB,IAAI,OAAO;gBAAE,KAAK,UAAU,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAsB,EAAQ,EAAE;YAC5C,IAAI,CAAC;gBACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;;oBAC3E,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;QAC1C,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,GAAS,EAAE;YAC3B,IAAI,UAAU;gBAAE,OAAO;YACvB,UAAU,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC,SAAS,CAAC,CAAC;YAChB,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;YACnD,SAAS,CAAC,KAAK,EAAE,CAAC;YAClB,gBAAgB,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG,EAAE,UAAU,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YACnG,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC;QACF,IAAI,OAAO,CAAC,SAAS;YAAE,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACtG,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,EAAE,CAAC;;YAClC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,gBAAgB;gBAAE,YAAY,CAAC,gBAAgB,CAAC,CAAC;YACrD,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtD,KAAK,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,MAAM,GAAG,IAAI,CAAC;YACd,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,GAAG,MAAM,CAAC;YACpB,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAClC,gBAAgB,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC7E,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;YACxC,MAAM,CAAC,IAAI,IAAI,QAAQ,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,SAAS,MAAM,CAAC,IAAY,EAAE,MAA6B,EAAE,MAAe;YAC1E,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,gBAAgB;gBAAE,YAAY,CAAC,gBAAgB,CAAC,CAAC;YACrD,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtD,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;gBACtB,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBACxB,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBACxB,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;YACzB,CAAC;YACD,KAAK,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;gBACtC,QAAQ,EAAE,IAAI;gBACd,MAAM;gBACN,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,QAAQ;aACT,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAAY,EAAE,WAAmB;IAC/E,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC7D,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IACnE,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,CAAkC,CAAC;YAClH,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1L,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,uCAAuC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAAY,EAAE,WAAmB;IAChF,MAAM,EAAE,CAAC,EAAE,CAAC,uBAAuB,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,GAAW,EAAE,OAAO,GAAG,GAAG;IAC3E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG;QAAE,OAAO;IACtE,MAAM,MAAM,GAAG,CAAC,KAAqB,EAAQ,EAAE;QAC7C,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,IAAI,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAAC,CAAC;gBAClC,MAAM,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAAC,CAAC;YACrC,CAAC;;gBAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,MAAM,CAAC,SAAS,CAAC,CAAC;IAClB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,SAAS,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,GAAuB;IACxE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,GAAG;QAAE,OAAO,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;IAC3H,MAAM,SAAS,GAAG,uBAAuB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnI,OAAO,KAAK,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAE,WAAmB;IAChE,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,eAAe,YAAY,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,GAAW;IAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,cAAc,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,GAAW;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAC;YACpI,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;YAAC,CAAC;YACtI,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAC,OAAO,MAAM,CAAC;QAC3H,CAAC;QAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACpC,CAAC;IACD,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAAC,OAAO,SAAS,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAa;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAAC,IAAI,OAAO,GAAG,KAAK,CAAC;IAChD,OAAO,IAAI,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAAC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC1G,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBAAC,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC;oBAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACxJ,IAAI,KAAK,IAAI,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,MAAM,KAAK,OAAO;YAAE,MAAM;QAAC,OAAO,GAAG,MAAM,CAAC;IACxF,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AACD,SAAS,KAAK,CAAC,KAAa,IAAY,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC"}

package/dist/utils/repositoryPath.d.ts

@@ -0,0 +1,4 @@
+/** Resolve a repository-relative artifact without permitting lexical escapes. */
+export declare function repositoryPath(root: string, relative: string): string;
+/** Resolve an existing repository artifact and reject symlink escapes. */
+export declare function existingRepositoryPath(root: string, relative: string): Promise<string>;

package/dist/utils/repositoryPath.js

@@ -0,0 +1,23 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+/** Resolve a repository-relative artifact without permitting lexical escapes. */
+export function repositoryPath(root, relative) {
+    if (!relative.trim() || path.isAbsolute(relative))
+        throw new Error(`Repository artifact path must be relative: ${relative}`);
+    const absoluteRoot = path.resolve(root);
+    const absolute = path.resolve(absoluteRoot, relative);
+    const within = path.relative(absoluteRoot, absolute);
+    if (within.startsWith("..") || path.isAbsolute(within))
+        throw new Error(`Repository artifact path escapes the project root: ${relative}`);
+    return absolute;
+}
+/** Resolve an existing repository artifact and reject symlink escapes. */
+export async function existingRepositoryPath(root, relative) {
+    const absoluteRoot = await fs.realpath(path.resolve(root));
+    const candidate = await fs.realpath(repositoryPath(absoluteRoot, relative));
+    const within = path.relative(absoluteRoot, candidate);
+    if (within.startsWith("..") || path.isAbsolute(within))
+        throw new Error(`Repository artifact path escapes the project root: ${relative}`);
+    return candidate;
+}
+//# sourceMappingURL=repositoryPath.js.map

package/dist/utils/repositoryPath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repositoryPath.js","sourceRoot":"","sources":["../../src/utils/repositoryPath.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,QAAgB;IAC3D,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,QAAQ,EAAE,CAAC,CAAC;IAC7H,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,QAAQ,EAAE,CAAC,CAAC;IAC1I,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAE,QAAgB;IACzE,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,QAAQ,EAAE,CAAC,CAAC;IAC1I,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/validators/opa.js

@@ -8,10 +8,10 @@ export async function runOpaPolicies(root, config, contract, changedFiles, froze
     if (!config.validation?.opa?.enabled)
         return { id: "policy.opa", category: "policy", status: "SKIP", message: "OPA policy evaluation disabled." };
     if (!(await commandExists("opa", root)))
-        return { id: "policy.opa", category: "policy", status: "WARN", message: "OPA is enabled but the opa executable is not installed." };
+        return { id: "policy.opa", category: "policy", status: "FAIL", message: "OPA is enabled but the opa executable is not installed." };
     const policyDirs = config.validation.opa.policyDirs ?? [];
     if (!policyDirs.length)
-        return { id: "policy.opa", category: "policy", status: "WARN", message: "OPA is enabled but no policyDirs are configured." };
+        return { id: "policy.opa", category: "policy", status: "FAIL", message: "OPA is enabled but no policyDirs are configured." };
     const args = policyDirs.map((dir) => `--data ${quote(path.resolve(policyRoot, dir))}`).join(" ");
     const input = buildOpaInput(contract, changedFiles, frozenChangedFiles, evidence, executionIdentity);
     const command = `printf %s ${quote(JSON.stringify(input))} | opa eval --format=json ${args} --stdin-input data`;

package/dist/validators/quickAcceptance.d.ts

@@ -0,0 +1,7 @@
+import type { TaskContract, ValidationCheck } from "../core/types.js";
+/**
+ * QUICK acceptance is deliberately small and deterministic. Unsupported
+ * natural-language acceptance fails closed instead of being treated as worker
+ * testimony, which keeps strict evidence meaningful.
+ */
+export declare function validateQuickAcceptance(root: string, contract: TaskContract, changedFiles: string[], scopeChecks: ValidationCheck[]): Promise<ValidationCheck[]>;

package/dist/validators/quickAcceptance.js

@@ -0,0 +1,40 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+/**
+ * QUICK acceptance is deliberately small and deterministic. Unsupported
+ * natural-language acceptance fails closed instead of being treated as worker
+ * testimony, which keeps strict evidence meaningful.
+ */
+export async function validateQuickAcceptance(root, contract, changedFiles, scopeChecks) {
+    const acceptance = contract.quick?.acceptance ?? [];
+    const scopePass = scopeChecks.find((check) => check.id === "diff.allowed-scope")?.status === "PASS";
+    return Promise.all(acceptance.map(async (statement, index) => {
+        const id = `quick.acceptance.${index + 1}`;
+        const text = statement.trim();
+        const content = text.match(/^(.+?)\s+contains exactly\s+[\u0060'\"]([\s\S]*?)[\u0060'\"]\.?$/i);
+        if (content) {
+            const relative = stripQuotes(content[1].trim());
+            const target = path.resolve(root, relative);
+            const boundary = path.relative(root, target);
+            if (!relative || boundary.startsWith("..") || path.isAbsolute(boundary))
+                return fail(id, `QUICK acceptance path escapes the workspace: ${relative}`);
+            const actual = await fs.readFile(target, "utf8").catch(() => undefined);
+            const expected = content[2];
+            const normalizedActual = actual === undefined ? undefined : normalizeText(actual);
+            const normalizedExpected = normalizeText(expected);
+            return normalizedActual === normalizedExpected
+                ? { id, category: "acceptance", status: "PASS", message: `${relative} contains the requested exact content.`, details: { path: relative, bytes: Buffer.byteLength(actual, "utf8") } }
+                : fail(id, `${relative} does not contain the requested exact content.`, { path: relative, expected: normalizedExpected, actual: normalizedActual });
+        }
+        if (/^(?:do not|don't|no)\s+(?:modify|change|touch)\s+any other\s+(?:product\s+)?files?\.?$/i.test(text) || /^no other\s+(?:product\s+)?files?\s+(?:is|are)\s+modified\.?$/i.test(text)) {
+            return scopePass
+                ? { id, category: "acceptance", status: "PASS", message: "No file outside the declared QUICK scope changed.", details: { changedFiles } }
+                : fail(id, "A file outside the declared QUICK scope changed.", { changedFiles });
+        }
+        return fail(id, "QUICK acceptance has no deterministic evaluator; rewrite it as exact file content or explicit no-other-file scope.", { statement: text });
+    }));
+}
+function stripQuotes(value) { return value.replace(/^[\u0060'\"]|[\u0060'\"]$/g, ""); }
+function normalizeText(value) { return value.replaceAll("\r\n", "\n").replace(/\n$/, ""); }
+function fail(id, message, details) { return { id, category: "acceptance", status: "FAIL", message, details }; }
+//# sourceMappingURL=quickAcceptance.js.map

package/dist/validators/quickAcceptance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quickAcceptance.js","sourceRoot":"","sources":["../../src/validators/quickAcceptance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAE,QAAsB,EAAE,YAAsB,EAAE,WAA8B;IACxI,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,oBAAoB,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACpG,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAA4B,EAAE;QACrF,MAAM,EAAE,GAAG,oBAAoB,KAAK,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;QAChG,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC,EAAE,EAAE,gDAAgD,QAAQ,EAAE,CAAC,CAAC;YACrJ,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,gBAAgB,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAClF,MAAM,kBAAkB,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YACnD,OAAO,gBAAgB,KAAK,kBAAkB;gBAC5C,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,wCAAwC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,MAAO,EAAE,MAAM,CAAC,EAAE,EAAE;gBACtL,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,QAAQ,gDAAgD,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxJ,CAAC;QACD,IAAI,yFAAyF,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gEAAgE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxL,OAAO,SAAS;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,mDAAmD,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE;gBACzI,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,kDAAkD,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC,EAAE,EAAE,oHAAoH,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7J,CAAC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,IAAY,OAAO,KAAK,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACvG,SAAS,aAAa,CAAC,KAAa,IAAY,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3G,SAAS,IAAI,CAAC,EAAU,EAAE,OAAe,EAAE,OAAiC,IAAqB,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC"}