ai-foreman 1.7.19 → 1.7.21

package/dist/installOwnership.js

@@ -0,0 +1,440 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { dirname, isAbsolute, join, normalize, relative, resolve } from "node:path";
+import { execFileSync } from "node:child_process";
+export const INSTALL_MANIFEST = ".rafi/install-manifest.json";
+export const OWNERSHIP_BACKUPS = ".rafi/ownership-backups";
+export function initializeInstallManifest(projectDir, dirtyChoice) {
+    const existing = readInstallManifest(projectDir);
+    if (existing)
+        return existing;
+    const manifest = emptyManifest(projectDir);
+    manifest.repository.dirtyChoice = dirtyChoice;
+    return writeManifest(projectDir, manifest);
+}
+export function readInstallManifest(projectDir) {
+    const path = join(resolve(projectDir), INSTALL_MANIFEST);
+    if (!existsSync(path))
+        return undefined;
+    const value = JSON.parse(readFileSync(path, "utf8"));
+    validateInstallManifest(projectDir, value);
+    return upgradeManifest(projectDir, value);
+}
+export function registerOwnedFile(projectDir, relativePath, input) {
+    const root = resolve(projectDir);
+    const safe = validateOwnedPath(root, relativePath);
+    const current = readInstallManifest(root) ?? emptyManifest(root);
+    const sha256 = input.sha256 ?? fingerprint(join(root, safe));
+    const prior = current.files.find((item) => item.path === safe);
+    const entry = {
+        ...prior, path: safe, sha256, ...input,
+        category: input.category ?? categorizeOwnedPath(safe, input.mode),
+        installedSha256: sha256,
+        lastRafiWriteAt: new Date().toISOString(),
+    };
+    const files = [...current.files.filter((item) => item.path !== safe), entry].sort((a, b) => a.path.localeCompare(b.path));
+    return writeManifest(root, { ...current, files, updatedAt: new Date().toISOString() });
+}
+export function prepareOwnedWrite(projectDir, relativePath, origin, category) {
+    const entry = capturePreimage(projectDir, relativePath, origin, category);
+    return registerOwnedFile(projectDir, entry.path, entry);
+}
+export function finalizePreparedOwnedWrite(projectDir, relativePath, origin, category) {
+    const existing = readInstallManifest(projectDir)?.files.find((entry) => entry.path === relativePath);
+    if (existing)
+        return finalizeOwnedWrite(projectDir, { ...existing, origin, category });
+    return registerOwnedFile(projectDir, relativePath, { mode: "generated", origin, category });
+}
+/** Capture an exact pre-Rafi file before a managed write. */
+export function capturePreimage(projectDir, relativePath, origin, category) {
+    const root = resolve(projectDir);
+    const safe = validateOwnedPath(root, relativePath);
+    const recorded = readInstallManifest(root)?.files.find((entry) => entry.path === safe);
+    if (recorded?.mode === "created" || recorded?.mode === "generated")
+        return { ...recorded };
+    const absolute = join(root, safe);
+    if (!existsSync(absolute))
+        return { path: safe, sha256: null, mode: "created", origin, category: category ?? categorizeOwnedPath(safe, "created"), preimageSha256: null };
+    if (!lstatSync(absolute).isFile())
+        throw new Error(`ownership target is not a regular file: ${safe}`);
+    const backupDir = join(root, OWNERSHIP_BACKUPS);
+    mkdirSync(backupDir, { recursive: true, mode: 0o700 });
+    chmodSync(backupDir, 0o700);
+    const backup = `${createHash("sha256").update(safe).digest("hex")}.original`;
+    const backupPath = join(backupDir, backup);
+    if (!existsSync(backupPath))
+        copyFileSync(absolute, backupPath);
+    const preimageSha256 = fingerprint(absolute);
+    return { path: safe, sha256: preimageSha256, mode: "modified", origin, backup: `${OWNERSHIP_BACKUPS}/${backup}`, category: category ?? categorizeOwnedPath(safe, "modified"), preimageSha256 };
+}
+export function finalizeOwnedWrite(projectDir, entry) {
+    return registerOwnedFile(projectDir, entry.path, { ...entry, sha256: fingerprint(join(resolve(projectDir), entry.path)) });
+}
+export function registerDependency(projectDir, dependency) {
+    const current = readInstallManifest(projectDir) ?? emptyManifest(projectDir);
+    const dependencies = [...current.dependencies.filter((item) => !(item.manager === dependency.manager && item.package === dependency.package)), dependency];
+    return writeManifest(projectDir, { ...current, dependencies, updatedAt: new Date().toISOString() });
+}
+export function validateInstallManifest(projectDir, manifest) {
+    if (![1, 2].includes(manifest.version) || !Array.isArray(manifest.files) || !Array.isArray(manifest.dependencies))
+        throw new Error("invalid install manifest");
+    const seen = new Set();
+    for (const entry of manifest.files) {
+        const path = validateOwnedPath(projectDir, entry.path);
+        if (seen.has(path))
+            throw new Error(`duplicate ownership path: ${path}`);
+        seen.add(path);
+        if (entry.backup)
+            validateOwnedPath(projectDir, entry.backup);
+    }
+    for (const dependency of manifest.dependencies) {
+        if (!dependency.package || /[\s;&|`$]/.test(dependency.package))
+            throw new Error(`unsafe dependency name: ${dependency.package}`);
+        dependency.manifests.forEach((path) => validateOwnedPath(projectDir, path));
+    }
+}
+export function validateOwnedPath(projectDir, value) {
+    if (!value || isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.includes("\0"))
+        throw new Error(`ownership path must be repository-relative: ${value}`);
+    const safe = normalize(value.replace(/\\/g, "/")).replace(/\\/g, "/").replace(/^\.\//, "");
+    if (safe === "." || safe === ".." || safe.startsWith("../") || safe.split("/").includes(".."))
+        throw new Error(`ownership path escapes project: ${value}`);
+    if (safe === ".git" || safe.startsWith(".git/"))
+        throw new Error(`ordinary ownership may not target Git metadata: ${value}`);
+    const root = resolve(projectDir);
+    const absolute = resolve(root, safe);
+    const rel = relative(root, absolute);
+    if (!rel || rel.startsWith("..") || isAbsolute(rel))
+        throw new Error(`ownership path escapes project: ${value}`);
+    assertNoSymlinkEscape(root, safe);
+    return safe;
+}
+function assertNoSymlinkEscape(root, safe) {
+    const rootReal = realpathSync(root);
+    let current = root;
+    for (const part of safe.split("/")) {
+        current = join(current, part);
+        if (!existsSync(current))
+            break;
+        const real = realpathSync(current);
+        const rel = relative(rootReal, real);
+        if (rel.startsWith("..") || isAbsolute(rel))
+            throw new Error(`ownership path resolves outside project: ${safe}`);
+    }
+}
+function emptyManifest(projectDir, now = new Date()) {
+    const stamp = now.toISOString();
+    const root = resolve(projectDir);
+    const status = gitValue(root, ["status", "--porcelain=v1", "-z"]);
+    return {
+        version: 2, createdAt: stamp, updatedAt: stamp,
+        repository: {
+            rootIdentity: createHash("sha256").update(realpathSync(root)).digest("hex"),
+            preInstallHead: gitValue(root, ["rev-parse", "HEAD"]),
+            initialBranch: gitValue(root, ["branch", "--show-current"]),
+            initialDirtyDigest: status ? createHash("sha256").update(status).digest("hex") : undefined,
+            dirtyChoice: status ? "snapshot-and-continue" : "clean",
+            baselineComplete: Boolean(gitValue(root, ["rev-parse", "HEAD"])),
+        },
+        files: [], dependencies: [],
+    };
+}
+function writeManifest(projectDir, manifest) {
+    validateInstallManifest(projectDir, manifest);
+    const path = join(resolve(projectDir), INSTALL_MANIFEST);
+    mkdirSync(dirname(path), { recursive: true });
+    const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    writeFileSync(temp, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+    renameSync(temp, path);
+    return manifest;
+}
+function fingerprint(path) {
+    if (!existsSync(path) || !statSync(path).isFile())
+        return null;
+    return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+export function listOwnedTree(projectDir, relativeDirectory) {
+    const root = resolve(projectDir);
+    const safe = validateOwnedPath(root, relativeDirectory);
+    const start = join(root, safe);
+    if (!existsSync(start))
+        return [];
+    const output = [];
+    const visit = (directory) => {
+        for (const entry of readdirSync(directory, { withFileTypes: true })) {
+            const path = join(directory, entry.name);
+            if (entry.isSymbolicLink())
+                throw new Error(`refusing recursive ownership through symlink: ${relative(root, path)}`);
+            if (entry.isDirectory())
+                visit(path);
+            else if (entry.isFile())
+                output.push(relative(root, path).replace(/\\/g, "/"));
+        }
+    };
+    if (lstatSync(start).isDirectory())
+        visit(start);
+    else
+        output.push(safe);
+    return output.sort();
+}
+export function removeOwnedPathsTransaction(projectDir, paths) {
+    const root = resolve(projectDir);
+    const safePaths = [...new Set(paths.map((path) => validateOwnedPath(root, path)))].sort((a, b) => b.length - a.length);
+    const runId = randomUUID();
+    const transactionRoot = join(root, ".rafi-uninstall", runId);
+    const payload = join(transactionRoot, "payload");
+    mkdirSync(payload, { recursive: true, mode: 0o700 });
+    const manifest = readInstallManifest(root);
+    const journal = { version: 2, runId, recoveryId: runId, startedAt: new Date().toISOString(), status: "in_progress", manifest, operations: [] };
+    writeFileSync(join(transactionRoot, "journal.json"), `${JSON.stringify(journal, null, 2)}\n`, "utf8");
+    const moved = [];
+    try {
+        for (const safe of safePaths) {
+            const source = join(root, safe);
+            if (!existsSync(source))
+                continue;
+            const destination = join(payload, safe);
+            mkdirSync(dirname(destination), { recursive: true });
+            renameSync(source, destination);
+            moved.push({ source, destination });
+            journal.operations.push({ path: safe, status: "preserved", sha256: fingerprint(destination) });
+            writeFileSync(join(transactionRoot, "journal.json"), `${JSON.stringify(journal, null, 2)}\n`, "utf8");
+        }
+        journal.status = "complete";
+        writeFileSync(join(transactionRoot, "journal.json"), `${JSON.stringify(journal, null, 2)}\n`, "utf8");
+        return { runId, recoveryId: runId, removed: journal.operations.map((operation) => operation.path) };
+    }
+    catch (error) {
+        for (const item of moved.reverse()) {
+            if (existsSync(item.destination) && !existsSync(item.source)) {
+                mkdirSync(dirname(item.source), { recursive: true });
+                renameSync(item.destination, item.source);
+            }
+        }
+        throw new Error(`uninstall transaction ${runId} rolled back: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+export function restoreOwnedPreimagesTransaction(projectDir, entries) {
+    const root = resolve(projectDir);
+    const runId = randomUUID();
+    const transactionRoot = join(root, ".rafi-uninstall", runId);
+    const payload = join(transactionRoot, "payload");
+    mkdirSync(payload, { recursive: true, mode: 0o700 });
+    const journal = { version: 2, runId, recoveryId: runId, startedAt: new Date().toISOString(), status: "in_progress", kind: "preimage-restore", operations: [] };
+    writeFileSync(join(transactionRoot, "journal.json"), `${JSON.stringify(journal, null, 2)}\n`, "utf8");
+    const restored = [];
+    try {
+        for (const entry of entries) {
+            const safe = validateOwnedPath(root, entry.path);
+            if (!entry.backup)
+                throw new Error(`no pre-Rafi backup is recorded for ${safe}`);
+            const preimage = join(root, validateOwnedPath(root, entry.backup));
+            if (!existsSync(preimage))
+                throw new Error(`pre-Rafi backup is missing for ${safe}`);
+            const current = join(root, safe);
+            const displaced = join(payload, "displaced-current", safe);
+            if (existsSync(current)) {
+                mkdirSync(dirname(displaced), { recursive: true });
+                renameSync(current, displaced);
+            }
+            mkdirSync(dirname(current), { recursive: true });
+            copyFileSync(preimage, current);
+            restored.push(safe);
+            journal.operations.push({ path: safe, backup: relative(root, displaced).replace(/\\/g, "/"), preimage: entry.backup, status: "restored" });
+            writeFileSync(join(transactionRoot, "journal.json"), `${JSON.stringify(journal, null, 2)}\n`, "utf8");
+        }
+        journal.status = "complete";
+        writeFileSync(join(transactionRoot, "journal.json"), `${JSON.stringify(journal, null, 2)}\n`, "utf8");
+        return { runId, recoveryId: runId, restored };
+    }
+    catch (error) {
+        for (const entry of entries.slice(0, restored.length).reverse()) {
+            const current = join(root, entry.path);
+            const displaced = join(payload, "displaced-current", entry.path);
+            if (existsSync(current))
+                rmSync(current, { force: true });
+            if (existsSync(displaced)) {
+                mkdirSync(dirname(current), { recursive: true });
+                renameSync(displaced, current);
+            }
+        }
+        throw new Error(`preimage restore ${runId} rolled back: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/** Preserve recorded pre-Rafi bytes for a file the user chose to keep today. */
+export function preservePreimagesForLaterRestore(projectDir, entries) {
+    const root = resolve(projectDir);
+    const restorable = entries.filter((entry) => entry.backup && existsSync(join(root, validateOwnedPath(root, entry.backup))));
+    if (!restorable.length)
+        return undefined;
+    const recoveryId = randomUUID();
+    const transactionRoot = join(root, ".rafi-uninstall", recoveryId);
+    const payload = join(transactionRoot, "payload");
+    mkdirSync(payload, { recursive: true, mode: 0o700 });
+    const operations = [];
+    for (const entry of restorable) {
+        const safe = validateOwnedPath(root, entry.path);
+        const source = join(root, validateOwnedPath(root, entry.backup));
+        const destination = join(payload, safe);
+        mkdirSync(dirname(destination), { recursive: true });
+        copyFileSync(source, destination);
+        operations.push({ path: safe, status: "preimage-preserved-for-later-restore", sha256: fingerprint(destination) });
+    }
+    const journal = { version: 2, recoveryId, runId: recoveryId, kind: "kept-preimage", status: "complete", createdAt: new Date().toISOString(), operations };
+    writeFileSync(join(transactionRoot, "journal.json"), `${JSON.stringify(journal, null, 2)}\n`, "utf8");
+    return { recoveryId, preserved: operations.map((operation) => operation.path) };
+}
+export function removeManagedBlocksTransaction(projectDir, entries) {
+    const root = resolve(projectDir);
+    const runId = randomUUID();
+    const transactionRoot = join(root, ".rafi-uninstall", runId);
+    const payload = join(transactionRoot, "payload");
+    mkdirSync(payload, { recursive: true, mode: 0o700 });
+    const edited = [];
+    const journal = { version: 2, runId, recoveryId: runId, status: "in_progress", kind: "managed-block-removal", operations: [] };
+    writeFileSync(join(transactionRoot, "journal.json"), `${JSON.stringify(journal, null, 2)}\n`, "utf8");
+    try {
+        for (const entry of entries) {
+            const safe = validateOwnedPath(root, entry.path);
+            const current = join(root, safe);
+            if (!existsSync(current) || !entry.marker)
+                continue;
+            const [start, end] = entry.marker.split("..");
+            if (!start || !end)
+                throw new Error(`invalid managed block marker for ${safe}`);
+            const original = readFileSync(current, "utf8");
+            const pattern = new RegExp(`${escapeRegExp(start)}\\r?\\n[\\s\\S]*?${escapeRegExp(end)}\\r?\\n?`, "g");
+            if (!pattern.test(original))
+                throw new Error(`managed block markers are missing from ${safe}; choose keep or full preimage restore`);
+            const backup = join(payload, safe);
+            mkdirSync(dirname(backup), { recursive: true });
+            copyFileSync(current, backup);
+            journal.operations.push({ path: safe, status: "intent-recorded", sha256: fingerprint(backup) });
+            writeFileSync(join(transactionRoot, "journal.json"), `${JSON.stringify(journal, null, 2)}\n`, "utf8");
+            writeFileSync(current, original.replace(pattern, "").replace(/^\s+$/, ""), "utf8");
+            edited.push(safe);
+            journal.operations[journal.operations.length - 1].status = "managed-block-removed";
+            writeFileSync(join(transactionRoot, "journal.json"), `${JSON.stringify(journal, null, 2)}\n`, "utf8");
+        }
+        journal.status = "complete";
+        writeFileSync(join(transactionRoot, "journal.json"), `${JSON.stringify(journal, null, 2)}\n`, "utf8");
+        return { runId, recoveryId: runId, edited };
+    }
+    catch (error) {
+        for (const safe of edited.reverse()) {
+            const backup = join(payload, safe);
+            const current = join(root, safe);
+            if (existsSync(backup)) {
+                mkdirSync(dirname(current), { recursive: true });
+                copyFileSync(backup, current);
+            }
+        }
+        journal.status = "rolled_back";
+        writeFileSync(join(transactionRoot, "journal.json"), `${JSON.stringify(journal, null, 2)}\n`, "utf8");
+        throw new Error(`managed-block removal ${runId} rolled back: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+export function restoreUninstallRecovery(projectDir, recoveryId, selectedPaths, overwrite = false) {
+    const root = resolve(projectDir);
+    const recoveryRoot = join(root, ".rafi-uninstall", validateRecoveryId(recoveryId));
+    const journalPath = join(recoveryRoot, "journal.json");
+    if (!existsSync(journalPath))
+        throw new Error(`uninstall recovery not found: ${recoveryId}`);
+    const journal = JSON.parse(readFileSync(journalPath, "utf8"));
+    const allowed = new Set((journal.operations ?? []).map((operation) => operation.path));
+    const wanted = selectedPaths?.length ? selectedPaths.map((path) => validateOwnedPath(root, path)) : [...allowed];
+    const unknown = wanted.filter((path) => !allowed.has(path));
+    if (unknown.length)
+        throw new Error(`paths are not in recovery ${recoveryId}: ${unknown.join(", ")}`);
+    const collisions = wanted.filter((path) => existsSync(join(root, path)));
+    if (collisions.length && !overwrite)
+        return { restored: [], collisions };
+    const backupId = collisions.length ? `restore-backup-${randomUUID()}` : undefined;
+    if (backupId) {
+        const backupOperations = [];
+        for (const safe of collisions) {
+            const backup = join(root, ".rafi-uninstall", backupId, "payload", safe);
+            mkdirSync(dirname(backup), { recursive: true });
+            renameSync(join(root, safe), backup);
+            backupOperations.push({ path: safe, status: "displaced-before-restore", sha256: fingerprint(backup) });
+        }
+        const backupJournal = { version: 2, recoveryId: backupId, runId: backupId, kind: "restore-collision-backup", status: "complete", createdAt: new Date().toISOString(), operations: backupOperations };
+        writeFileSync(join(root, ".rafi-uninstall", backupId, "journal.json"), `${JSON.stringify(backupJournal, null, 2)}\n`, "utf8");
+    }
+    const restored = [];
+    for (const safe of wanted) {
+        const source = join(recoveryRoot, "payload", safe);
+        if (!existsSync(source))
+            continue;
+        const destination = join(root, safe);
+        mkdirSync(dirname(destination), { recursive: true });
+        cpSync(source, destination, { recursive: true, errorOnExist: true });
+        restored.push(safe);
+    }
+    return { restored, collisions: [], backupId };
+}
+export function cleanupUninstallRecovery(projectDir, recoveryIds) {
+    const root = resolve(projectDir);
+    const removed = [];
+    for (const id of recoveryIds.map(validateRecoveryId)) {
+        const target = join(root, ".rafi-uninstall", id);
+        if (!existsSync(target))
+            continue;
+        rmSync(target, { recursive: true, force: true });
+        removed.push(id);
+    }
+    return removed;
+}
+export function listUninstallRecoveries(projectDir) {
+    const directory = join(resolve(projectDir), ".rafi-uninstall");
+    if (!existsSync(directory))
+        return [];
+    return readdirSync(directory, { withFileTypes: true }).filter((entry) => entry.isDirectory() && /^[A-Za-z0-9-]+$/.test(entry.name)).map((entry) => entry.name).sort();
+}
+function upgradeManifest(projectDir, manifest) {
+    if (manifest.version === 2)
+        return manifest;
+    const legacy = manifest;
+    const root = resolve(projectDir);
+    return {
+        version: 2, createdAt: legacy.createdAt, updatedAt: legacy.updatedAt,
+        repository: { rootIdentity: createHash("sha256").update(realpathSync(root)).digest("hex"), dirtyChoice: "legacy-unknown", baselineComplete: false },
+        files: legacy.files.map((entry) => ({ ...entry, category: categorizeOwnedPath(entry.path, entry.mode), installedSha256: entry.sha256 })),
+        dependencies: legacy.dependencies,
+    };
+}
+export function categorizeOwnedPath(path, mode) {
+    if (path.startsWith(".tickets/"))
+        return "tickets";
+    if (/rafi-plan|plans?\//i.test(path))
+        return "plans";
+    if (/\/(?:skills)\//.test(`/${path}`))
+        return "skills";
+    if (/\/(?:agents)\//.test(`/${path}`))
+        return "agents";
+    if (/rules/i.test(path) || ["AGENTS.md", "CLAUDE.md"].includes(path))
+        return "rules";
+    if (path === ".gitignore")
+        return "managed-gitignore";
+    if (path === "rafi-config.yaml" || path.endsWith("config.yaml"))
+        return "config";
+    if (path.startsWith(".rafi/") || path.startsWith(".foreman/"))
+        return "runtime-state";
+    if (/\.(?:md|mdx)$/i.test(path))
+        return mode === "modified" ? "documentation-modified" : "documentation-created";
+    return "generated-other";
+}
+function gitValue(cwd, args) {
+    try {
+        return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function validateRecoveryId(value) {
+    if (!/^[A-Za-z0-9-]+$/.test(value))
+        throw new Error(`invalid recovery ID: ${value}`);
+    return value;
+}
+function escapeRegExp(value) { return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); }

package/dist/linuxProbeInventory.d.ts

@@ -0,0 +1,12 @@
+export interface LinuxProbeProcess {
+    pid: number;
+    group: number;
+    state: string;
+    start: string;
+    tagged: boolean;
+}
+/** procfs avoids ps dialects, PATH, output limits and environment truncation.
+ * Probe descendants inherit our uid; unreadable same-user environments fail closed.
+ * Privilege changes and deliberately scrubbed tags are outside tagged containment.
+ */
+export declare function linuxProbeInventory(tag?: string, timeoutMs?: number, root?: string, uid?: number | undefined, self?: number): LinuxProbeProcess[] | undefined;

package/dist/linuxProbeInventory.js

@@ -0,0 +1,48 @@
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+/** procfs avoids ps dialects, PATH, output limits and environment truncation.
+ * Probe descendants inherit our uid; unreadable same-user environments fail closed.
+ * Privilege changes and deliberately scrubbed tags are outside tagged containment.
+ */
+export function linuxProbeInventory(tag, timeoutMs = 1000, root = "/proc", uid = process.getuid?.(), self = process.pid) {
+    const deadline = Date.now() + Math.max(1, timeoutMs);
+    try {
+        const rows = [];
+        for (const entry of readdirSync(root)) {
+            if (!/^\d+$/.test(entry))
+                continue;
+            if (Date.now() >= deadline)
+                return undefined;
+            const directory = join(root, entry);
+            try {
+                const stat = readFileSync(join(directory, "stat"), "utf8");
+                const end = stat.lastIndexOf(")");
+                const fields = stat.slice(end + 1).trim().split(/\s+/);
+                if (end < 0 || !/^\d+$/.test(fields[19] ?? "") || !/^\d+$/.test(fields[2] ?? ""))
+                    return undefined;
+                let tagged = false;
+                if (tag && fields[0] !== "Z" && fields[0] !== "X" && statSync(directory).uid === uid) {
+                    const environment = readFileSync(join(directory, "environ"));
+                    tagged = environment.toString("utf8").split("\0").includes(`RAFI_PROBE_OWNER=${tag}`);
+                }
+                rows.push({ pid: Number(entry), group: Number(fields[2]), state: fields[0], start: fields[19], tagged });
+            }
+            catch (error) {
+                if (error.code === "ENOENT") {
+                    try {
+                        readFileSync(join(directory, "stat"));
+                    }
+                    catch (gone) {
+                        if (gone.code === "ENOENT")
+                            continue; // process exited during enumeration
+                    }
+                }
+                return undefined;
+            }
+        }
+        return rows.some(row => row.pid === self) ? rows : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/log.d.ts

@@ -1,7 +1,7 @@
 /** A single structured log record. */
 export interface LogRecord {
     ts: string;
-    event: "batch-start" | "batch-end" | "branch-plan" | "branch-start" | "branch-session" | "branch-resume" | "branch-issue" | "branch-complete" | "branch-push" | "github-readiness-failed" | "gitlab-readiness-failed" | "pr-created" | "pr-existing" | "pr-failed" | "pr-auto-merge-enabled" | "pr-auto-merge-failed" | "mr-created" | "mr-existing" | "mr-failed" | "mr-auto-merge-enabled" | "mr-auto-merge-failed" | "branch-auto-merge-wait" | "branch-direct-merge" | "step" | "question-round-trip" | "provider-lifecycle" | "runtime-readiness" | "permission" | "escalation" | "needs_input" | "blocked-recovery" | "preflight" | "rafi-plan" | "ticket-populate" | "uninstall-proposal" | "qa" | "qa-fix" | "qa-protected-files-changed" | "qa-evidence" | "agent-status" | "context-lifecycle" | "handoff-transfer" | "recovery-handoff-accepted" | "guided-recovery-required" | "safe-boundary-paused" | "session-unavailable" | "error";
+    event: "graph-maintenance" | "graph-evidence" | "batch-start" | "batch-end" | "branch-plan" | "branch-start" | "branch-session" | "branch-resume" | "branch-issue" | "branch-complete" | "branch-push" | "github-readiness-failed" | "gitlab-readiness-failed" | "pr-created" | "pr-existing" | "pr-failed" | "pr-auto-merge-enabled" | "pr-auto-merge-failed" | "mr-created" | "mr-existing" | "mr-failed" | "mr-auto-merge-enabled" | "mr-auto-merge-failed" | "branch-auto-merge-wait" | "branch-direct-merge" | "step" | "question-round-trip" | "provider-lifecycle" | "runtime-readiness" | "permission" | "escalation" | "needs_input" | "blocked-recovery" | "preflight" | "rafi-plan" | "ticket-populate" | "uninstall-proposal" | "qa" | "qa-fix" | "qa-protected-files-changed" | "qa-evidence" | "agent-status" | "context-lifecycle" | "handoff-transfer" | "recovery-handoff-accepted" | "guided-recovery-required" | "safe-boundary-paused" | "session-unavailable" | "error";
     [key: string]: unknown;
 }
 /** Append-only JSONL logger. One line per record, plus an echo to the console. */

package/dist/log.js

@@ -1,3 +1,5 @@
+import { currentGraphDerivedAccess } from "./graph/derived.js";
+import { bytesDigest } from "./graph/util.js";
 import { appendFileSync, mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 /** Append-only JSONL logger. One line per record, plus an echo to the console. */
@@ -14,7 +16,11 @@ export class Log {
         const record = {
             ts: new Date().toISOString(),
             event,
-            ...fields,
+            ...(currentGraphDerivedAccess() ? {
+                graphDerived: true,
+                fieldsDigest: bytesDigest(JSON.stringify(fields)),
+                limitation: "Graph-derived details are retained only in access-checked evidence storage",
+            } : fields),
         };
         appendFileSync(this.path, JSON.stringify(record) + "\n");
     }

package/dist/managerEvidence.d.ts

@@ -0,0 +1,25 @@
+import { type ManagerEvidencePageV2, type ManagerEvidenceRequestV2 } from "rafi-spec";
+import { ManagerEvidenceArtifacts } from "./managerEvidenceArtifacts.js";
+/** Per-host immutable snapshots and opaque continuations are independent of model lookup budgets. */
+export declare class ManagerEvidenceService {
+    readonly projectDir: string;
+    private readonly now;
+    private readonly lifetimeMs;
+    readonly artifacts: ManagerEvidenceArtifacts;
+    private graphPermitted;
+    private readonly snapshots;
+    private readonly cursors;
+    private readonly hostMetadata;
+    constructor(projectDir: string, now?: () => number, lifetimeMs?: number);
+    close(): void;
+    execute(request: ManagerEvidenceRequestV2): ManagerEvidencePageV2;
+    more(cursor: string, expectedScope?: string): ManagerEvidencePageV2;
+    /** Full disclosure for host rendering; never substituted into a model packet. */
+    hostRedactions(snapshotId: string): ManagerEvidencePageV2["redactions"];
+    /** Preserve the already-sanitized structure; rendered report text need not be valid JSON. */
+    hostMetadataItem(handle: string): unknown;
+    private page;
+    private failure;
+    private populate;
+}
+export declare function parseManagerEvidenceRequestV2(text: string): ManagerEvidenceRequestV2 | undefined;