altimate-receipts 0.7.0 → 0.9.0

package/dist/{chunk-ZORGM2DA.js → chunk-TUWJRD7H.js}

@@ -2746,6 +2746,296 @@ function gradeLetter(main) {
   return "A";
 }
 
+// src/trace/diffScope.ts
+import { spawnSync } from "child_process";
+
+// src/findings/surface.ts
+var OPERATOR_KINDS = /* @__PURE__ */ new Set([
+  "loop",
+  "bottleneck",
+  "cost-concentration",
+  "cache-opportunity",
+  "model-downgrade"
+]);
+var PRIVILEGED_PREFIXES = [
+  "ci-cd-touch",
+  "lockfile-edit",
+  "hook-bypass",
+  "config-weaken",
+  "grader-edit",
+  "eval-override",
+  "test-focus",
+  "test-skipped",
+  "test-trivialised",
+  "history-rewrite",
+  "force-push"
+];
+var TEST_PATH2 = /(?:^|\/)(?:tests?|specs?|__tests__)(?:\/|$)|\.(?:test|spec)\.|_test\./;
+function privileged(id, filePath) {
+  if (PRIVILEGED_PREFIXES.some((p) => id.startsWith(p))) {
+    return true;
+  }
+  return id.startsWith("file-shrink") && !!filePath && TEST_PATH2.test(filePath);
+}
+function findingSurface(id) {
+  if (OPERATOR_KINDS.has(id) || id.startsWith("errcluster-")) {
+    return "operator";
+  }
+  return "merge";
+}
+function destructiveOutsideRepo(title) {
+  const clause = title.replace(/^Destructive op:\s*/i, "").replace(/\s*×\d+\s*$/, "");
+  const m = clause.match(/^\s*(rm|rmdir)\b(.*)$/i);
+  if (!m) {
+    return false;
+  }
+  const operands = m[2].split(/\s+/).filter((t) => t && !t.startsWith("-"));
+  if (operands.length === 0) {
+    return false;
+  }
+  const scratch = (t) => {
+    const p = t.replace(/^["']|["']$/g, "");
+    return /\$/.test(p) || p.startsWith("/tmp") || p.startsWith("/var/folders") || p.startsWith("/private/var/folders") || p.startsWith("~");
+  };
+  return operands.every(scratch);
+}
+function regenerableReceiptRm(title) {
+  const clause = title.replace(/^Destructive op:\s*/i, "").replace(/\s*×\d+\s*$/, "");
+  const m = clause.match(/^\s*(rm|rmdir)\b(.*)$/i);
+  if (!m) {
+    return false;
+  }
+  const operands = m[2].split(/\s+/).filter((t) => t && !t.startsWith("-"));
+  if (operands.length === 0) {
+    return false;
+  }
+  const receiptJson = (t) => /(?:^|\/)\.receipts\/[^/]+\.json$/.test(t.replace(/^["']|["']$/g, ""));
+  return operands.every(receiptJson);
+}
+
+// src/trace/diffScope.ts
+function git(args, cwd) {
+  const r = spawnSync("git", args, { encoding: "utf8", cwd });
+  return r.status === 0 ? r.stdout : null;
+}
+var RECEIPTS_DIR_RE = /(?:^|\/)\.receipts\//;
+function changedFiles(baseOverride, opts) {
+  const root = git(["rev-parse", "--show-toplevel"])?.trim();
+  if (!root) {
+    return null;
+  }
+  let base4 = baseOverride;
+  if (!base4) {
+    const sym = git(["symbolic-ref", "refs/remotes/origin/HEAD"], root)?.trim();
+    if (sym) {
+      base4 = sym.replace("refs/remotes/", "");
+    } else if (git(["rev-parse", "--verify", "--quiet", "origin/main"], root) !== null) {
+      base4 = "origin/main";
+    } else {
+      base4 = "main";
+    }
+  }
+  let out = git(["diff", "--name-only", `${base4}...HEAD`], root);
+  if (out === null && !baseOverride) {
+    out = git(["diff", "--name-only", "main...HEAD"], root);
+    if (out !== null) {
+      base4 = "main";
+    }
+  }
+  const pending = opts?.includeWorkingTree ? workingTreeFiles(root) : [];
+  if (out === null && pending.length === 0) {
+    return null;
+  }
+  const files = [.../* @__PURE__ */ new Set([...(out ?? "").split("\n").map((s) => s.trim()), ...pending])].filter(Boolean).filter((f) => !RECEIPTS_DIR_RE.test(f)).sort();
+  if (files.length === 0) {
+    return null;
+  }
+  return { base: base4, files, repoRoot: root };
+}
+function workingTreeFiles(root) {
+  const out = git(["status", "--porcelain", "-z", "--untracked-files=all"], root);
+  if (!out) {
+    return [];
+  }
+  const toks = out.split("\0");
+  const files = [];
+  for (let i = 0; i < toks.length; i++) {
+    const t = toks[i];
+    if (!t || t.length < 4 || t[2] !== " ") {
+      continue;
+    }
+    files.push(t.slice(3));
+    if (t[0] === "R" || t[0] === "C") {
+      i++;
+    }
+  }
+  return files;
+}
+function inDiff(filePath, files) {
+  const base4 = filePath.split("/").pop();
+  for (const d of files) {
+    if (d === filePath || d.endsWith(`/${filePath}`) || filePath.endsWith(`/${d}`)) {
+      return true;
+    }
+    if (base4 && d.split("/").pop() === base4) {
+      return true;
+    }
+  }
+  return false;
+}
+var PROCESS_PREFIXES = ["pipe-sh", "tool-fabricated", "tool-malformed-args"];
+var isProcessFinding = (id) => PROCESS_PREFIXES.some((p) => id === p || id.startsWith(`${p}-`));
+var isDestructive = (id) => id.startsWith("destructive-");
+var isGitProcess = (id) => id.startsWith("force-push") || id.startsWith("destructive-git");
+function hookBypassIsPushOnly(command) {
+  const noVerify = parseGitInvocations(command).filter(isNoVerify);
+  return noVerify.length > 0 && noVerify.every((inv) => inv.subcommand === "push");
+}
+function gitTouchesDiff(command, files) {
+  for (const inv of parseGitInvocations(command)) {
+    if (!destroysGitData(inv) && !rewritesHistory(inv)) {
+      continue;
+    }
+    if (touchedPaths(inv).some((p) => inDiff(p, files))) {
+      return true;
+    }
+  }
+  return false;
+}
+function keepUnderDiff(f, files, commandFor, locusFor) {
+  if (locusFor?.(f) === "elsewhere") {
+    return false;
+  }
+  if (isProcessFinding(f.id)) {
+    return true;
+  }
+  if (f.id === "hook-bypass" || f.id.startsWith("hook-bypass-")) {
+    const cmd = commandFor?.(f);
+    return cmd ? !hookBypassIsPushOnly(cmd) : true;
+  }
+  if (isGitProcess(f.id)) {
+    const cmd = commandFor?.(f);
+    return cmd ? gitTouchesDiff(cmd, files) : false;
+  }
+  if (isDestructive(f.id)) {
+    if (destructiveOutsideRepo(f.title) || regenerableReceiptRm(f.title)) {
+      return false;
+    }
+    const cmd = commandFor?.(f) ?? f.title.replace(/^Destructive op:\s*/i, "").replace(/\s*×\d+\s*$/, "");
+    if (/(^|[\s;&|])git\s/.test(cmd)) {
+      return gitTouchesDiff(cmd, files);
+    }
+    return true;
+  }
+  return f.filePath ? inDiff(f.filePath, files) : false;
+}
+function commandMentionsFile(cmd, files) {
+  if (!cmd) {
+    return false;
+  }
+  return files.some(
+    (f) => f.includes("/") ? cmd.includes(f) : new RegExp(`(?:^|[\\s'"\`=/])${f.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`).test(cmd)
+  );
+}
+function diffEffort(derived, files, window) {
+  const editedGens = /* @__PURE__ */ new Set();
+  derived.spans.forEach((s, i) => {
+    if (s.kind !== "tool" || !s.parentSpanId) {
+      return;
+    }
+    if (window && (i < window.start || i > window.end)) {
+      return;
+    }
+    if (isEditTool(s.name)) {
+      const fp = filePathOf(s.input);
+      if (fp && inDiff(fp, files)) {
+        editedGens.add(s.parentSpanId);
+      }
+      return;
+    }
+    if (isCommandTool(s.name) && commandMentionsFile(commandOf(s.input), files)) {
+      editedGens.add(s.parentSpanId);
+    }
+  });
+  let cost = 0;
+  let tokens = 0;
+  for (const s of derived.spans) {
+    if (s.kind === "generation" && editedGens.has(s.spanId)) {
+      cost += s.cost || estimateCost(s.tokens, s.name);
+      tokens += s.tokens?.total ?? 0;
+    }
+  }
+  return { cost, tokens, turns: editedGens.size };
+}
+function narrowEffort(sliceDerived, files) {
+  if (!sliceDerived) {
+    return null;
+  }
+  const eff = diffEffort(sliceDerived, files);
+  return eff.turns > 0 ? eff : null;
+}
+function windowedEffort(derived, files, window) {
+  const eff = diffEffort(derived, files, window);
+  return eff.turns > 0 ? eff : null;
+}
+function applyDiffScope(derived, findings, files, projectPath) {
+  const spanCmd = /* @__PURE__ */ new Map();
+  const spanCwd = /* @__PURE__ */ new Map();
+  for (const s of derived.spans) {
+    if (s.spanId) {
+      spanCmd.set(s.spanId, commandOf(s.input));
+      if (s.cwd) {
+        spanCwd.set(s.spanId, s.cwd);
+      }
+    }
+  }
+  const cmdOf = (f) => f.evidenceSpanId ? spanCmd.get(f.evidenceSpanId) : void 0;
+  const locusOf = (f) => {
+    if (!projectPath || !f.evidenceSpanId) {
+      return void 0;
+    }
+    const base4 = spanCwd.get(f.evidenceSpanId);
+    const state = cwdAtFirstGit(spanCmd.get(f.evidenceSpanId) ?? "", base4);
+    if (state.kind === "unknown") {
+      return "elsewhere";
+    }
+    const at = state.kind === "known" ? state.path : base4;
+    if (!at) {
+      return void 0;
+    }
+    return at === projectPath || at.startsWith(`${projectPath}/`) ? "here" : "elsewhere";
+  };
+  const keep = (f) => keepUnderDiff(f, files, cmdOf, locusOf);
+  const scopedFindings = {
+    main: findings.main.filter(keep),
+    minor: findings.minor.filter(keep)
+  };
+  const filesChanged = derived.filesChanged.filter((fc) => inDiff(fc.path, files));
+  const destructiveCount = derived.spans.filter((s) => s.destructive).filter((s) => {
+    const cmd = commandOf(s.input);
+    const clause = destructiveMatch(cmd) ?? cmd;
+    if (destructiveOutsideRepo(clause) || regenerableReceiptRm(clause)) {
+      return false;
+    }
+    if (/(^|[\s;&|])git\s/.test(cmd)) {
+      return gitTouchesDiff(cmd, files);
+    }
+    return true;
+  }).length;
+  const eff = diffEffort(derived, files);
+  return {
+    derived: {
+      ...derived,
+      filesChanged,
+      destructiveCount,
+      diffCostUsd: eff.cost,
+      diffTokens: eff.tokens,
+      diffTurns: eff.turns
+    },
+    findings: scopedFindings
+  };
+}
+
 // src/version.ts
 import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
@@ -2935,7 +3225,14 @@ function finalAssistantText(sum) {
   const gens = sum.spans.filter((s) => s.kind !== "session").sort((a, b) => a.startTime - b.startTime || a.spanId.localeCompare(b.spanId)).filter((s) => s.kind === "generation");
   return gens[gens.length - 1]?.input || "";
 }
-function deriveEvidence(session, sum) {
+function samePath(touched, scopeFile) {
+  if (touched === scopeFile || touched.endsWith(`/${scopeFile}`) || scopeFile.endsWith(`/${touched}`)) {
+    return true;
+  }
+  const tb = touched.split("/").pop();
+  return !!tb && tb === scopeFile.split("/").pop();
+}
+function deriveEvidence(session, sum, scope) {
   const tools = sum.spans.filter((s) => s.kind === "tool");
   const edits = tools.filter((s) => isEditTool(s.name)).length;
   const commandSpans = tools.filter((s) => isCommandTool(s.name));
@@ -2972,6 +3269,14 @@ function deriveEvidence(session, sum) {
       finishReasons[s.finishReason] = (finishReasons[s.finishReason] ?? 0) + 1;
     }
   }
+  let coveredFiles;
+  if (scope?.kind === "diff" && scope.files?.length) {
+    const touched = tools.filter((s) => isEditTool(s.name) || isReadTool(s.name)).map((s) => filePathOf(s.input)).filter((f) => !!f);
+    const cmdTexts = commandSpans.map((s) => commandOf(s.input)).filter(Boolean);
+    coveredFiles = scope.files.filter(
+      (f) => touched.some((t) => samePath(t, f)) || cmdTexts.some((c) => commandMentionsFile(c, [f]))
+    ).length;
+  }
   const tk = session.totals.tokens;
   return {
     filesChanged: sum.filesChanged.length,
@@ -2979,9 +3284,12 @@ function deriveEvidence(session, sum) {
     commands: commandSpans.length,
     reads,
     destructiveOps: sum.destructiveCount,
+    ...coveredFiles != null ? { coveredFiles } : {},
     testsRan,
     ...sum.diffCostUsd != null ? {
-      diffCostUsd: round(sum.diffCostUsd, 2),
+      // sub-cent costs keep 4dp — 2dp rounding recorded $0.004 work as $0.00
+      // (field: every release receipt showed "$0.00 (this change)")
+      diffCostUsd: round(sum.diffCostUsd, 2) || round(sum.diffCostUsd, 4),
       diffTokens: sum.diffTokens ?? 0,
       diffTurns: sum.diffTurns ?? 0
     } : {},
@@ -2997,7 +3305,8 @@ function deriveEvidence(session, sum) {
       reasoning: tk.reasoning,
       total: tk.total
     },
-    costUsd: round(sum.totalCost, 2),
+    // same sub-cent fallback as diffCostUsd, so diff ≤ session always holds
+    costUsd: round(sum.totalCost, 2) || round(sum.totalCost, 4),
     cacheHitRatio: round(sum.cacheHitRatio, 4),
     cacheWriteRatio: round(tk.cacheWrite / Math.max(1, tk.cacheRead), 4)
   };
@@ -3015,7 +3324,7 @@ async function buildReceipt(session, derived, findings, opts = {}) {
       durationMs: session.totals.durationMs
     },
     grade: gradeLetter(findings.main),
-    evidence: deriveEvidence(session, derived),
+    evidence: deriveEvidence(session, derived, opts.scope),
     findings: [...findings.main, ...findings.minor].map(toReceiptFinding),
     generator: {
       name: "altimate-receipts",
@@ -3095,16 +3404,6 @@ var dur = (ms) => {
   const h = Math.floor(m / 60);
   return h ? `${h}h ${m % 60}m` : `${m}m`;
 };
-function grade(c, main) {
-  const meta = {
-    F: { col: c.bgRed + c.white, verdict: "DO NOT MERGE WITHOUT REVIEW", icon: "\u26D4" },
-    C: { col: c.bgYel + c.black, verdict: "NEEDS A CLOSE REVIEW", icon: "\u26A0\uFE0F " },
-    B: { col: c.bgGrn + c.black, verdict: "MINOR THINGS TO CHECK", icon: "\u{1F50D}" },
-    A: { col: c.bgGrn + c.white, verdict: "LOOKS CLEAN", icon: "\u2705" }
-  };
-  const g = gradeLetter(main);
-  return { g, ...meta[g] };
-}
 var sevIcon = (s) => ({ critical: "\u26D4", high: "\u26A0\uFE0F ", medium: "\u{1F50D}", low: "\xB7" })[s] ?? "\xB7";
 var sevColOf = (c, s) => ({ critical: c.red, high: c.yel, medium: c.cyn, low: c.gray })[s] ?? c.gray;
 var TEST_CMD2 = /\b(pytest|jest|vitest|npm (run )?test|yarn test|go test|cargo test|tsc|eslint|dbt (test|build)|mocha|rspec|phpunit|gradle test|mvn test)\b/i;
@@ -3117,10 +3416,9 @@ function renderCard(args, opts = {}) {
   const line = (s = "") => `  ${s}`;
   const rule = (ch = "\u2500") => line(c.gray + ch.repeat(W) + c.reset);
   const tools = sum.spans.filter((s) => s.kind === "tool");
-  const gd = grade(c, main);
   const out = [];
   out.push(`${c.cyn}  \u2554${"\u2550".repeat(W)}\u2557${c.reset}`);
-  const hdrLeft = ` ${c.bold}\u{1F9FE}  RECEIPTS${c.reset}${c.dim} \u2014 Agent Report Card${c.reset}`;
+  const hdrLeft = ` ${c.bold}\u{1F9FE}  RECEIPTS${c.reset}${c.dim} \u2014 Agent Work Record${c.reset}`;
   const hdrRight = `${c.mag}${c.bold}proof, not vibes ${c.reset}`;
   out.push(
     `  ${c.cyn}\u2551${c.reset}${pad(hdrLeft, W - vlen(hdrRight))}${hdrRight}${c.cyn}\u2551${c.reset}`
@@ -3146,13 +3444,11 @@ function renderCard(args, opts = {}) {
     )
   );
   out.push("");
-  out.push(line(`${c.gray}\u250C\u2500 VERDICT ${"\u2500".repeat(W - 10)}\u2510${c.reset}`));
-  const gradeInner = `${c.gray} ${c.reset}${gd.col}${c.bold}  ${gd.g}  ${c.reset}   ${gd.icon} ${c.bold}${gd.verdict}${c.reset}`;
-  out.push(line(`${c.gray}\u2502${c.reset}${pad(gradeInner, W)}${c.gray}\u2502${c.reset}`));
+  out.push(line(`${c.gray}\u250C\u2500 RECORD ${"\u2500".repeat(W - 9)}\u2510${c.reset}`));
   const counts = ["critical", "high", "medium"].map((s) => {
     const n = main.filter((f) => f.severity === s).length;
     return n ? `${sevColOf(c, s)}${n} ${s}${c.reset}` : null;
-  }).filter(Boolean).join(`${c.gray} \xB7 ${c.reset}`) || `${c.grn}no findings${c.reset}`;
+  }).filter(Boolean).join(`${c.gray} \xB7 ${c.reset}`) || `${c.gray}nothing detected${c.reset}`;
   out.push(
     line(`${c.gray}\u2502${c.reset} ${counts}${pad("", W - 1 - vlen(counts))}${c.gray}\u2502${c.reset}`)
   );
@@ -3182,7 +3478,11 @@ function renderCard(args, opts = {}) {
     out.push(line(`${c.gray}   \u25B8 ${minor.length} minor (collapsed)${c.reset}`));
   }
   if (!sorted.length && !minor.length) {
-    out.push(line(`${c.grn} \u2705 no findings \u2014 nothing mechanical to flag${c.reset}`));
+    out.push(
+      tools.length === 0 ? line(`${c.gray} no tool activity parsed for this session \u2014 nothing to report${c.reset}`) : line(
+        `${c.gray} nothing detected ${c.dim}("not detected" means no flag \u2014 not that nothing exists)${c.reset}`
+      )
+    );
   }
   out.push("");
   const cmds = tools.filter((s) => /bash|shell|exec|run|terminal/i.test(s.name));
@@ -4112,7 +4412,7 @@ import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
 
 // src/trace/sqlite.ts
-import { spawnSync } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 async function tryNodeSqlite(dbPath2) {
   try {
     const { DatabaseSync } = await import("sqlite");
@@ -4126,13 +4426,13 @@ async function tryNodeSqlite(dbPath2) {
   }
 }
 function trySqlite3Cli(dbPath2) {
-  const probe = spawnSync("sqlite3", ["-version"], { encoding: "utf8" });
+  const probe = spawnSync2("sqlite3", ["-version"], { encoding: "utf8" });
   if (probe.error || probe.status !== 0) {
     return null;
   }
   return {
     all: (sql) => {
-      const r = spawnSync("sqlite3", ["-readonly", "-json", dbPath2, sql], {
+      const r = spawnSync2("sqlite3", ["-readonly", "-json", dbPath2, sql], {
         encoding: "utf8",
         maxBuffer: 1 << 29
         // bubbles can be large
@@ -4684,23 +4984,21 @@ function redactReceipt(receipt) {
 }
 
 export {
-  estimateCost,
-  isEditTool,
-  filePathOf,
-  commandOf,
-  destructiveMatch,
   deriveSpans,
   cwdAtFirstGit,
-  parseGitInvocations,
-  isNoVerify,
-  rewritesHistory,
-  destroysGitData,
-  touchedPaths,
   formatTokens,
   formatCostAlways,
   deriveFindings,
   gradeLetter,
   renderLedger,
+  privileged,
+  findingSurface,
+  destructiveOutsideRepo,
+  changedFiles,
+  inDiff,
+  narrowEffort,
+  windowedEffort,
+  applyDiffScope,
   getVersion,
   hashTranscriptFile,
   sha256Hex,
@@ -4730,4 +5028,4 @@ export {
   redact,
   redactReceipt
 };
-//# sourceMappingURL=chunk-ZORGM2DA.js.map
+//# sourceMappingURL=chunk-TUWJRD7H.js.map