altimate-receipts 0.6.2 → 0.8.0

package/dist/chunk-5R6W4W4R.js

@@ -1,607 +0,0 @@
-#!/usr/bin/env node
-import {
-  agentIds,
-  buildReceipt,
-  commandOf,
-  cwdAtFirstGit,
-  deriveEvidence,
-  deriveFindings,
-  deriveSpans,
-  destroysGitData,
-  destructiveMatch,
-  estimateCost,
-  filePathOf,
-  gradeLetter,
-  isEditTool,
-  isNoVerify,
-  loadById,
-  parseGitInvocations,
-  redact,
-  redactReceipt,
-  rewritesHistory,
-  touchedPaths
-} from "./chunk-72Y2GS7I.js";
-
-// src/receipt/canonical.ts
-function canonicalize(value) {
-  return serialize(value);
-}
-function serialize(value) {
-  if (value === null || typeof value === "number" || typeof value === "boolean") {
-    return JSON.stringify(value);
-  }
-  if (typeof value === "string") {
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map(serialize).join(",")}]`;
-  }
-  if (typeof value === "object") {
-    const obj = value;
-    const keys = Object.keys(obj).filter((k) => obj[k] !== void 0).sort();
-    const body = keys.map((k) => `${JSON.stringify(k)}:${serialize(obj[k])}`).join(",");
-    return `{${body}}`;
-  }
-  return "null";
-}
-
-// src/share/clipboard.ts
-import { spawnSync } from "child_process";
-function candidates() {
-  if (process.platform === "darwin") {
-    return [{ cmd: "pbcopy", args: [] }];
-  }
-  if (process.platform === "win32") {
-    return [{ cmd: "clip", args: [] }];
-  }
-  return [
-    { cmd: "wl-copy", args: [] },
-    { cmd: "xclip", args: ["-selection", "clipboard"] },
-    { cmd: "xsel", args: ["--clipboard", "--input"] }
-  ];
-}
-function copyToClipboard(text) {
-  for (const { cmd, args } of candidates()) {
-    try {
-      const res = spawnSync(cmd, args, { input: text, stdio: ["pipe", "ignore", "ignore"] });
-      if (!res.error && res.status === 0) {
-        return true;
-      }
-    } catch {
-    }
-  }
-  return false;
-}
-
-// src/share/markdown.ts
-var VERDICT = {
-  F: "DO NOT MERGE WITHOUT REVIEW",
-  C: "NEEDS A CLOSE REVIEW",
-  B: "MINOR THINGS TO CHECK",
-  A: "LOOKS CLEAN"
-};
-var ICON = {
-  critical: "\u26D4",
-  high: "\u26A0\uFE0F",
-  medium: "\u{1F50D}",
-  low: "\xB7"
-};
-var base = (p) => p.split("/").pop() ?? p;
-function renderShareMarkdown(args) {
-  const { summary, session, derived, findings } = args;
-  const { main, minor } = findings;
-  const g = gradeLetter(main);
-  const ev = deriveEvidence(session, derived);
-  const counts = ["critical", "high", "medium"].map((s) => {
-    const n = main.filter((f) => f.severity === s).length;
-    return n ? `${n} ${s}` : null;
-  }).filter(Boolean).join(" \xB7 ") || "no findings";
-  const title = redact(summary.title || "untitled session");
-  const out = [];
-  out.push(`## \u{1F9FE} Receipt \u2014 ${title}  \xB7  Grade ${g}`);
-  out.push("");
-  out.push(`**${VERDICT[g]}**  \xB7  ${counts}  \xB7  _${summary.source}_`);
-  out.push("");
-  if (main.length) {
-    out.push("### Findings");
-    const order = { critical: 0, high: 1, medium: 2, low: 3 };
-    const sorted = [...main].sort(
-      (a, b) => order[a.severity] - order[b.severity] || b.score - a.score
-    );
-    for (const f of sorted.slice(0, 12)) {
-      const tag = f.impactLabel ? ` \u2014 ${redact(f.impactLabel)}` : "";
-      const loc = f.filePath ? ` (\`${redact(base(f.filePath))}\`)` : "";
-      out.push(`- ${ICON[f.severity]} **${redact(f.title)}**${tag}${loc}`);
-    }
-    if (minor.length) {
-      out.push(`- _+${minor.length} minor (collapsed)_`);
-    }
-    out.push("");
-  }
-  out.push("### Evidence");
-  out.push(
-    `${ev.filesChanged} files \xB7 ${ev.edits} edits \xB7 ${ev.commands} commands \xB7 ${ev.testsRan ? "tests ran \u2713" : "no test run detected"} \xB7 ${ev.destructiveOps} destructive ops`
-  );
-  out.push("");
-  out.push("_Verified by Receipts \xB7 deterministic \xB7 0 model calls \xB7 evidence, not judgement_");
-  return `${out.join("\n")}
-`;
-}
-
-// src/sign/envelope.ts
-var DSSE_PAYLOAD_TYPE = "application/vnd.in-toto+json";
-function pae(payloadType, payload) {
-  const typeBytes = Buffer.from(payloadType, "utf8");
-  const bodyBytes = Buffer.from(payload, "utf8");
-  const header = `DSSEv1 ${typeBytes.length} ${payloadType} ${bodyBytes.length} `;
-  return Buffer.concat([Buffer.from(header, "utf8"), bodyBytes]);
-}
-function toDsseEnvelope(receipt) {
-  const canonical = canonicalize(receipt);
-  return {
-    payloadType: DSSE_PAYLOAD_TYPE,
-    payload: Buffer.from(canonical, "utf8").toString("base64"),
-    signatures: []
-  };
-}
-function envelopePae(env) {
-  const raw = Buffer.from(env.payload, "base64").toString("utf8");
-  return pae(env.payloadType, raw);
-}
-
-// src/trace/diffScope.ts
-import { spawnSync as spawnSync2 } from "child_process";
-
-// src/findings/surface.ts
-var OPERATOR_KINDS = /* @__PURE__ */ new Set([
-  "loop",
-  "bottleneck",
-  "cost-concentration",
-  "cache-opportunity",
-  "model-downgrade"
-]);
-function findingSurface(id) {
-  if (OPERATOR_KINDS.has(id) || id.startsWith("errcluster-")) {
-    return "operator";
-  }
-  return "merge";
-}
-function destructiveOutsideRepo(title) {
-  const clause = title.replace(/^Destructive op:\s*/i, "").replace(/\s*×\d+\s*$/, "");
-  const m = clause.match(/^\s*(rm|rmdir)\b(.*)$/i);
-  if (!m) {
-    return false;
-  }
-  const operands = m[2].split(/\s+/).filter((t) => t && !t.startsWith("-"));
-  if (operands.length === 0) {
-    return false;
-  }
-  const scratch = (t) => {
-    const p = t.replace(/^["']|["']$/g, "");
-    return /\$/.test(p) || p.startsWith("/tmp") || p.startsWith("/var/folders") || p.startsWith("/private/var/folders") || p.startsWith("~");
-  };
-  return operands.every(scratch);
-}
-function regenerableReceiptRm(title) {
-  const clause = title.replace(/^Destructive op:\s*/i, "").replace(/\s*×\d+\s*$/, "");
-  const m = clause.match(/^\s*(rm|rmdir)\b(.*)$/i);
-  if (!m) {
-    return false;
-  }
-  const operands = m[2].split(/\s+/).filter((t) => t && !t.startsWith("-"));
-  if (operands.length === 0) {
-    return false;
-  }
-  const receiptJson = (t) => /(?:^|\/)\.receipts\/[^/]+\.json$/.test(t.replace(/^["']|["']$/g, ""));
-  return operands.every(receiptJson);
-}
-
-// src/trace/diffScope.ts
-function git(args, cwd) {
-  const r = spawnSync2("git", args, { encoding: "utf8", cwd });
-  return r.status === 0 ? r.stdout : null;
-}
-var RECEIPTS_DIR_RE = /(?:^|\/)\.receipts\//;
-function changedFiles(baseOverride, opts) {
-  const root = git(["rev-parse", "--show-toplevel"])?.trim();
-  if (!root) {
-    return null;
-  }
-  let base2 = baseOverride;
-  if (!base2) {
-    const sym = git(["symbolic-ref", "refs/remotes/origin/HEAD"], root)?.trim();
-    if (sym) {
-      base2 = sym.replace("refs/remotes/", "");
-    } else if (git(["rev-parse", "--verify", "--quiet", "origin/main"], root) !== null) {
-      base2 = "origin/main";
-    } else {
-      base2 = "main";
-    }
-  }
-  let out = git(["diff", "--name-only", `${base2}...HEAD`], root);
-  if (out === null && !baseOverride) {
-    out = git(["diff", "--name-only", "main...HEAD"], root);
-    if (out !== null) {
-      base2 = "main";
-    }
-  }
-  const pending = opts?.includeWorkingTree ? workingTreeFiles(root) : [];
-  if (out === null && pending.length === 0) {
-    return null;
-  }
-  const files = [.../* @__PURE__ */ new Set([...(out ?? "").split("\n").map((s) => s.trim()), ...pending])].filter(Boolean).filter((f) => !RECEIPTS_DIR_RE.test(f)).sort();
-  if (files.length === 0) {
-    return null;
-  }
-  return { base: base2, files, repoRoot: root };
-}
-function workingTreeFiles(root) {
-  const out = git(["status", "--porcelain", "-z", "--untracked-files=all"], root);
-  if (!out) {
-    return [];
-  }
-  const toks = out.split("\0");
-  const files = [];
-  for (let i = 0; i < toks.length; i++) {
-    const t = toks[i];
-    if (!t || t.length < 4 || t[2] !== " ") {
-      continue;
-    }
-    files.push(t.slice(3));
-    if (t[0] === "R" || t[0] === "C") {
-      i++;
-    }
-  }
-  return files;
-}
-function inDiff(filePath, files) {
-  const base2 = filePath.split("/").pop();
-  for (const d of files) {
-    if (d === filePath || d.endsWith(`/${filePath}`) || filePath.endsWith(`/${d}`)) {
-      return true;
-    }
-    if (base2 && d.split("/").pop() === base2) {
-      return true;
-    }
-  }
-  return false;
-}
-var PROCESS_PREFIXES = ["pipe-sh", "tool-fabricated", "tool-malformed-args"];
-var isProcessFinding = (id) => PROCESS_PREFIXES.some((p) => id === p || id.startsWith(`${p}-`));
-var isDestructive = (id) => id.startsWith("destructive-");
-var isGitProcess = (id) => id.startsWith("force-push") || id.startsWith("destructive-git");
-function hookBypassIsPushOnly(command) {
-  const noVerify = parseGitInvocations(command).filter(isNoVerify);
-  return noVerify.length > 0 && noVerify.every((inv) => inv.subcommand === "push");
-}
-function gitTouchesDiff(command, files) {
-  for (const inv of parseGitInvocations(command)) {
-    if (!destroysGitData(inv) && !rewritesHistory(inv)) {
-      continue;
-    }
-    if (touchedPaths(inv).some((p) => inDiff(p, files))) {
-      return true;
-    }
-  }
-  return false;
-}
-function keepUnderDiff(f, files, commandFor, locusFor) {
-  if (locusFor?.(f) === "elsewhere") {
-    return false;
-  }
-  if (isProcessFinding(f.id)) {
-    return true;
-  }
-  if (f.id === "hook-bypass" || f.id.startsWith("hook-bypass-")) {
-    const cmd = commandFor?.(f);
-    return cmd ? !hookBypassIsPushOnly(cmd) : true;
-  }
-  if (isGitProcess(f.id)) {
-    const cmd = commandFor?.(f);
-    return cmd ? gitTouchesDiff(cmd, files) : false;
-  }
-  if (isDestructive(f.id)) {
-    if (destructiveOutsideRepo(f.title) || regenerableReceiptRm(f.title)) {
-      return false;
-    }
-    const cmd = commandFor?.(f) ?? f.title.replace(/^Destructive op:\s*/i, "").replace(/\s*×\d+\s*$/, "");
-    if (/(^|[\s;&|])git\s/.test(cmd)) {
-      return gitTouchesDiff(cmd, files);
-    }
-    return true;
-  }
-  return f.filePath ? inDiff(f.filePath, files) : false;
-}
-function diffEffort(derived, files) {
-  const editedGens = /* @__PURE__ */ new Set();
-  for (const s of derived.spans) {
-    if (s.kind !== "tool" || !s.parentSpanId || !isEditTool(s.name)) {
-      continue;
-    }
-    const fp = filePathOf(s.input);
-    if (fp && inDiff(fp, files)) {
-      editedGens.add(s.parentSpanId);
-    }
-  }
-  let cost = 0;
-  let tokens = 0;
-  for (const s of derived.spans) {
-    if (s.kind === "generation" && editedGens.has(s.spanId)) {
-      cost += s.cost || estimateCost(s.tokens, s.name);
-      tokens += s.tokens?.total ?? 0;
-    }
-  }
-  return { cost, tokens, turns: editedGens.size };
-}
-function narrowEffort(sliceDerived, files) {
-  if (!sliceDerived) {
-    return null;
-  }
-  const eff = diffEffort(sliceDerived, files);
-  return eff.turns > 0 ? eff : null;
-}
-function applyDiffScope(derived, findings, files, projectPath) {
-  const spanCmd = /* @__PURE__ */ new Map();
-  const spanCwd = /* @__PURE__ */ new Map();
-  for (const s of derived.spans) {
-    if (s.spanId) {
-      spanCmd.set(s.spanId, commandOf(s.input));
-      if (s.cwd) {
-        spanCwd.set(s.spanId, s.cwd);
-      }
-    }
-  }
-  const cmdOf = (f) => f.evidenceSpanId ? spanCmd.get(f.evidenceSpanId) : void 0;
-  const locusOf = (f) => {
-    if (!projectPath || !f.evidenceSpanId) {
-      return void 0;
-    }
-    const base2 = spanCwd.get(f.evidenceSpanId);
-    const state = cwdAtFirstGit(spanCmd.get(f.evidenceSpanId) ?? "", base2);
-    if (state.kind === "unknown") {
-      return "elsewhere";
-    }
-    const at = state.kind === "known" ? state.path : base2;
-    if (!at) {
-      return void 0;
-    }
-    return at === projectPath || at.startsWith(`${projectPath}/`) ? "here" : "elsewhere";
-  };
-  const keep = (f) => keepUnderDiff(f, files, cmdOf, locusOf);
-  const scopedFindings = {
-    main: findings.main.filter(keep),
-    minor: findings.minor.filter(keep)
-  };
-  const filesChanged = derived.filesChanged.filter((fc) => inDiff(fc.path, files));
-  const destructiveCount = derived.spans.filter((s) => s.destructive).filter((s) => {
-    const cmd = commandOf(s.input);
-    const clause = destructiveMatch(cmd) ?? cmd;
-    if (destructiveOutsideRepo(clause) || regenerableReceiptRm(clause)) {
-      return false;
-    }
-    if (/(^|[\s;&|])git\s/.test(cmd)) {
-      return gitTouchesDiff(cmd, files);
-    }
-    return true;
-  }).length;
-  const eff = diffEffort(derived, files);
-  return {
-    derived: {
-      ...derived,
-      filesChanged,
-      destructiveCount,
-      diffCostUsd: eff.cost,
-      diffTokens: eff.tokens,
-      diffTurns: eff.turns
-    },
-    findings: scopedFindings
-  };
-}
-
-// src/trace/slice.ts
-function branchesIn(session) {
-  const seen = [];
-  for (const m of session.messages) {
-    if (m.gitBranch && !seen.includes(m.gitBranch)) {
-      seen.push(m.gitBranch);
-    }
-  }
-  return seen;
-}
-function effectiveBranches(messages) {
-  const firstTagged = messages.find((m) => m.gitBranch)?.gitBranch;
-  let current = firstTagged;
-  return messages.map((m) => {
-    if (m.gitBranch) {
-      current = m.gitBranch;
-    }
-    return current;
-  });
-}
-function sliceByBranch(session, branch) {
-  if (!branchesIn(session).includes(branch)) {
-    return null;
-  }
-  const eff = effectiveBranches(session.messages);
-  const messages = session.messages.filter((_, i) => eff[i] === branch);
-  if (messages.length === 0) {
-    return null;
-  }
-  const timestamps = messages.map((m) => m.timestamp).filter((t) => typeof t === "number");
-  const startedAt = timestamps.length ? Math.min(...timestamps) : session.startedAt;
-  const endedAt = timestamps.length ? Math.max(...timestamps) : session.endedAt;
-  return {
-    ...session,
-    id: `${session.id}#${branch}`,
-    gitBranch: branch,
-    startedAt,
-    endedAt,
-    messages,
-    // Scope the subject digest to this branch's slice (reproducible by re-slicing).
-    digestSource: JSON.stringify({ id: session.id, branch, messages })
-  };
-}
-
-// src/sign/rederive.ts
-function sourceFromReceipt(receipt) {
-  const prefix = receipt.subject?.[0]?.name?.split("/")[0];
-  return agentIds().find((id) => id === prefix);
-}
-async function rederiveFromTranscript(path, opts = {}) {
-  const loaded = await loadById(opts.source ?? "claude-code", path);
-  if (!loaded) {
-    return null;
-  }
-  const scope = opts.scope;
-  const branch = scope?.kind === "branch" ? scope.branch : opts.branch;
-  const session = branch ? sliceByBranch(loaded, branch) ?? loaded : loaded;
-  let derived = deriveSpans(session);
-  let findings = deriveFindings(derived);
-  if (scope?.kind === "diff" && scope.files) {
-    const scoped = applyDiffScope(derived, findings, scope.files, session.projectPath);
-    derived = scoped.derived;
-    findings = scoped.findings;
-    if (scope.branch) {
-      const slice = sliceByBranch(loaded, scope.branch);
-      const eff = narrowEffort(slice ? deriveSpans(slice) : null, scope.files);
-      if (eff) {
-        derived = {
-          ...derived,
-          diffCostUsd: eff.cost,
-          diffTokens: eff.tokens,
-          diffTurns: eff.turns
-        };
-      }
-    }
-  }
-  const receipt = await buildReceipt(session, derived, findings, { scope });
-  return opts.redact ? redactReceipt(receipt) : receipt;
-}
-async function compareToTranscript(committed, transcriptPath, opts = {}) {
-  const fresh = await rederiveFromTranscript(transcriptPath, {
-    redact: true,
-    ...opts,
-    // Re-derive through the adapter the receipt names (its subject prefix), so a
-    // codex/cursor receipt isn't re-run through the Claude adapter. An explicit
-    // opts.source still wins.
-    source: opts.source ?? sourceFromReceipt(committed),
-    scope: committed.predicate.scope
-  });
-  if (!fresh) {
-    return { rederived: false, matches: false };
-  }
-  return { rederived: true, matches: canonicalize(committed) === canonicalize(fresh) };
-}
-
-// src/report/checks.ts
-var CHECK_CATALOG = [
-  {
-    key: "destructive",
-    icon: "\u{1F6E1}\uFE0F",
-    label: "destructive ops",
-    prefixes: ["destructive", "file-shrink"]
-  },
-  {
-    key: "git-history",
-    icon: "\u{1F33F}",
-    label: "git-history safety",
-    prefixes: ["force-push", "history-rewrite"]
-  },
-  { key: "secrets", icon: "\u{1F511}", label: "secret leaks", prefixes: ["secret"] },
-  { key: "cicd", icon: "\u2699\uFE0F", label: "CI/CD tampering", prefixes: ["ci-cd-touch"] },
-  { key: "lockfile", icon: "\u{1F4E6}", label: "lockfile integrity", prefixes: ["lockfile-edit"] },
-  {
-    key: "tests",
-    icon: "\u{1F9EA}",
-    label: "test integrity",
-    prefixes: [
-      "fake-green",
-      "test-focus",
-      "test-skipped",
-      "test-trivialised",
-      "grader-edit",
-      "eval-override"
-    ]
-  },
-  {
-    key: "weakening",
-    icon: "\u{1F513}",
-    label: "config/safety weakening",
-    prefixes: ["config-weaken", "hook-bypass", "pipe-sh"]
-  },
-  {
-    key: "blind-edits",
-    icon: "\u{1F441}\uFE0F",
-    label: "blind / unverified edits",
-    prefixes: ["blind-edit", "unverified-change", "edit-reversion"]
-  },
-  { key: "injection", icon: "\u{1F489}", label: "prompt-injection", prefixes: ["prompt-injection"] },
-  { key: "trojan", icon: "\u{1F575}\uFE0F", label: "hidden unicode", prefixes: ["trojan-source"] },
-  {
-    key: "duplication",
-    icon: "\u{1F4CB}",
-    label: "duplicated code",
-    prefixes: ["dup-file", "duplicated-code"]
-  },
-  { key: "swallowed", icon: "\u{1F92B}", label: "swallowed errors", prefixes: ["error-swallowed"] },
-  { key: "stubbed", icon: "\u{1F6A7}", label: "stubbed implementation", prefixes: ["impl-stubbed"] },
-  { key: "malformed", icon: "\u{1F9F1}", label: "malformed artifacts", prefixes: ["malformed-artifact"] },
-  { key: "truncated", icon: "\u2702\uFE0F", label: "truncated turns", prefixes: ["truncated-turn"] },
-  {
-    key: "promises",
-    icon: "\u{1F91D}",
-    label: "unfulfilled claims",
-    prefixes: ["claimed-commit-none", "unfulfilled-promise"]
-  },
-  {
-    key: "tool-calls",
-    icon: "\u{1F9EC}",
-    label: "tool-call integrity",
-    prefixes: ["tool-fabricated", "tool-malformed-args"]
-  }
-];
-function matches(id, check) {
-  return check.prefixes.some((p) => id === p || id.startsWith(`${p}-`));
-}
-function checkForId(id) {
-  return CHECK_CATALOG.find((c) => matches(id, c));
-}
-var SEV_RANK = { critical: 0, high: 1, medium: 2, low: 3 };
-function categorize(findings) {
-  const flagged = [];
-  const cleared = [];
-  for (const check of CHECK_CATALOG) {
-    const hits = findings.filter((f) => matches(f.id, check));
-    if (hits.length > 0) {
-      const severity = hits.map((f) => f.severity ?? "high").sort((a, b) => SEV_RANK[a] - SEV_RANK[b])[0];
-      flagged.push({ check, count: hits.length, severity });
-    } else {
-      cleared.push(check);
-    }
-  }
-  return { flagged, cleared, total: CHECK_CATALOG.length };
-}
-
-export {
-  canonicalize,
-  CHECK_CATALOG,
-  checkForId,
-  categorize,
-  copyToClipboard,
-  renderShareMarkdown,
-  DSSE_PAYLOAD_TYPE,
-  pae,
-  toDsseEnvelope,
-  envelopePae,
-  findingSurface,
-  destructiveOutsideRepo,
-  changedFiles,
-  inDiff,
-  narrowEffort,
-  applyDiffScope,
-  branchesIn,
-  sliceByBranch,
-  rederiveFromTranscript,
-  compareToTranscript
-};
-//# sourceMappingURL=chunk-5R6W4W4R.js.map