arkgate 3.6.1 → 3.8.0

package/bin/lib/architecture-scan.mjs

@@ -2,320 +2,86 @@
  * Architecture check pipeline: content scan → import graph → layer edges → cycles.
  * Extracted from ark-check entry (R3). Entry remains orchestration + presentation.
  */
-import fs from 'node:fs';
 import path from 'node:path';
+import { summarizeParseHealth } from './parse-health.mjs';
 import {
-  layerForFile,
-  looksLikeIntent,
-} from '../ark-shared.mjs';
-import {
-  isArkPublishCandidate,
-  isPublishCall,
-  lineOf,
-  namedModuleBindings,
-  objectHasProperty,
-  publishHasSource,
-  publishSourceLiteral,
-  sourceFileExportsOnlyTypes,
-  sourceFileHasTopLevelSideEffects,
-  stringLiteralText,
-  typeOnlyExportNames,
-} from './ast-scan.mjs';
-import { provePortProofInject } from './port-proof.mjs';
-import {
-  intentLayersFromManifest,
-  layerForIntent,
-  isBlocked,
-  collectConfigWarnings,
-} from './config-warnings.mjs';
-import {
-  ambientCoveredByForbiddenGlobals,
-  collectCapabilityUses,
-  collectForbiddenCapabilityUses,
-  effectiveCapabilityDeny,
-  evaluateArchitectureGraph,
-  extractSemanticDependencies,
+  analyzeTrustedResolvedProject,
+  loadContract,
 } from './analysis-engine.mjs';
-import { normalize } from './scan-files.mjs';
-import { collectSafetyDiagnostics } from './safety-diagnostics.mjs';
-import { classifyPublishFacts } from './source-policy.mjs';
-import {
-  createCompilerOptionsLookup,
-  createModuleResolutionHost,
-  loadScanCache,
-  resolveImport,
-  saveScanCache,
-  scanCacheKey,
-} from './ts-resolve.mjs';
-
-/**
- * Parse one governed source file into content violations + module edges.
- */
-export function scanSourceFile(ts, root, config, rules, manifestIntentLayers, file, sourceLayer) {
-  const source = fs.readFileSync(file, 'utf8');
-  const sourceFile = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true);
-  const violations = [];
-  const edges = [];
-
-  const layerConfig = config.layers.find((layer) => layer.name === sourceLayer);
-  const forbiddenGlobals = Array.isArray(layerConfig?.forbiddenGlobals)
-    ? layerConfig.forbiddenGlobals.filter((entry) => typeof entry === 'string')
-    : [];
-  for (const use of collectForbiddenCapabilityUses(ts, sourceFile, forbiddenGlobals)) {
-    violations.push({
-      ruleId: 'FORBIDDEN_GLOBAL',
-      file: normalize(path.relative(root, file)),
-      line: use.line,
-      fromLayer: sourceLayer,
-      target: use.name,
-      message: `${sourceLayer} must not use the ambient global "${use.name}".`,
-    });
-  }
-
-  // U04 — opted-in capability walls (ADR 0009). One violation, one voice: an
-  // ambient use already covered by this layer's forbiddenGlobals reports only
-  // FORBIDDEN_GLOBAL (D7 dedup); absence of the surface adds nothing.
-  const capabilityDeny = new Set(effectiveCapabilityDeny(layerConfig ?? {}));
-  if (capabilityDeny.size > 0) {
-    for (const use of collectCapabilityUses(ts, sourceFile)) {
-      if (!capabilityDeny.has(use.capability)) continue;
-      if (
-        use.source === 'ambient-global' &&
-        ambientCoveredByForbiddenGlobals(use.symbol, forbiddenGlobals)
-      ) {
-        continue;
-      }
-      violations.push({
-        ruleId: 'CAPABILITY_VIOLATION',
-        file: normalize(path.relative(root, file)),
-        line: use.line,
-        fromLayer: sourceLayer,
-        target: use.symbol,
-        capability: use.capability,
-        message:
-          use.source === 'import-based'
-            ? `${sourceLayer} denies the ${use.capability} capability; found import of "${use.symbol}".`
-            : `${sourceLayer} denies the ${use.capability} capability; found ambient "${use.symbol}".`,
-      });
-    }
-  }
-
-  const checkModuleEdge = (specifier, node, kind, typeOnly = false) => {
-    const namedBindings = namedModuleBindings(ts, node);
-    edges.push({
-      specifier,
-      line: lineOf(sourceFile, node.getStart(sourceFile)),
-      kind,
-      typeOnly,
-      ...(namedBindings ? { namedBindings } : {}),
-    });
-  };
-
-  for (const dependency of extractSemanticDependencies(ts, sourceFile)) {
-    if (!dependency.specifier) continue;
-    checkModuleEdge(
-      dependency.specifier,
-      dependency.node,
-      dependency.kind,
-      dependency.typeOnly
-    );
-  }
+import { effectiveAnalysisConfig } from './analysis-policy.mjs';
+import { resolveCandidateFacts } from './resolved-candidate-facts.mjs';
 
-  const needsPolicyWalk =
-    /\bpublish\s*\(|\bintent\b/.test(source) ||
-    /['"`]\s*[A-Z][A-Za-z0-9_]*\./.test(source);
-  const visit = (node) => {
-    if (ts.isCallExpression(node)) {
-      if (isPublishCall(ts, node)) {
-        const firstArg = node.arguments[0];
-        const rawIntent = stringLiteralText(ts, firstArg);
-        for (const finding of classifyPublishFacts({
-          publishCall: true,
-          rawIntentName: rawIntent,
-          objectHasIntent: objectHasProperty(ts, firstArg, 'intent'),
-          arkPublishCandidate: isArkPublishCandidate(ts, node),
-          hasSource: publishHasSource(ts, node),
-        })) {
-          violations.push({
-            ruleId: finding.ruleId,
-            file: normalize(path.relative(root, file)),
-            line: lineOf(sourceFile, node.getStart(sourceFile)),
-            ...(finding.ruleId === 'PUBLISH_MISSING_SOURCE' ? { fromLayer: sourceLayer } : {}),
-            message: finding.message,
-          });
-        }
-
-        const sourceIntent = publishSourceLiteral(ts, node);
-        if (sourceIntent && looksLikeIntent(sourceIntent)) {
-          const sourceIntentLayer = layerForIntent(
-            sourceIntent,
-            config.layers,
-            manifestIntentLayers
-          );
-          if (sourceIntentLayer && sourceIntentLayer !== sourceLayer) {
-            violations.push({
-              ruleId: 'PUBLISH_SOURCE_LAYER_MISMATCH',
-              file: normalize(path.relative(root, file)),
-              line: lineOf(sourceFile, node.getStart(sourceFile)),
-              fromLayer: sourceLayer,
-              toLayer: sourceIntentLayer,
-              target: sourceIntent,
-              message:
-                `Publish source "${sourceIntent}" resolves to ${sourceIntentLayer}, but the publishing file is classified as ${sourceLayer}.`,
-            });
-          }
-        }
-      }
-    }
-
-    if (ts.isStringLiteralLike(node) && looksLikeIntent(node.text)) {
-      const targetLayer = layerForIntent(node.text, config.layers, manifestIntentLayers);
-      const rule = targetLayer ? isBlocked(rules, sourceLayer, targetLayer) : undefined;
-      if (rule) {
-        violations.push({
-          ruleId: 'LAYER_INTENT_REFERENCE_VIOLATION',
-          file: normalize(path.relative(root, file)),
-          line: lineOf(sourceFile, node.getStart(sourceFile)),
-          fromLayer: sourceLayer,
-          toLayer: targetLayer,
-          target: node.text,
-          message:
-            rule.message ??
-            `${sourceLayer} must not reference ${targetLayer} intent ${node.text}.`,
-        });
+/** Resolve canonical facts and optionally retain filesystem probes for resident invalidation. */
+export function resolveArchitectureSnapshot({
+  root,
+  config,
+  manifest,
+  rules,
+  files,
+  ts,
+  args,
+  captureInputs = true,
+}) {
+  const observedInputs = captureInputs ? new Map() : undefined;
+  const observeInput = observedInputs
+    ? (inputPath, kind) => {
+        const absolute = path.resolve(inputPath);
+        const kinds = observedInputs.get(absolute) ?? new Set();
+        kinds.add(kind);
+        observedInputs.set(absolute, kinds);
       }
-    }
-
-    ts.forEachChild(node, visit);
-  };
-  if (needsPolicyWalk) visit(sourceFile);
-  return {
-    contentViolations: violations,
-    edges,
-    exportsOnlyTypes: sourceFileExportsOnlyTypes(ts, sourceFile),
-    typeOnlyExportNames: typeOnlyExportNames(ts, sourceFile),
-    hasTopLevelSideEffects: sourceFileHasTopLevelSideEffects(ts, sourceFile),
+    : undefined;
+  const configPath = args?.config
+    ? path.resolve(root, args.config)
+    : path.join(root, 'ark.config.json');
+  observeInput?.(configPath, 'ark-config');
+  if (args?.manifest) observeInput?.(path.resolve(root, args.manifest), 'manifest');
+  const effectiveConfig = effectiveAnalysisConfig(
+    { ...config, rules: rules ?? config.rules },
+    manifest
+  );
+  const facts = resolveCandidateFacts({
+    root,
+    config: effectiveConfig,
+    ts,
+    ...(args?.tsconfig ? { tsconfig: args.tsconfig } : {}),
+    observeInput,
+  });
+  const loadedContract = loadContract(effectiveConfig, configPath);
+  const analyzed = analyzeTrustedResolvedProject({ contract: loadedContract, facts });
+  const parseHealth = summarizeParseHealth(
+    facts.files.map((file) => ({
+      relFile: file.path,
+      entry: { parseDiagnosticCount: file.parseDiagnosticCount },
+    }))
+  );
+  const result = {
+    violations: analyzed.ir.violations,
+    warnings: analyzed.ir.warnings,
+    safety: analyzed.safety,
+    parseHealth,
+    completeness: analyzed.completeness,
+    completenessReasons: analyzed.completenessReasons,
+    valid: analyzed.valid,
+    strictValid: analyzed.strictValid,
+    mode: analyzed.mode,
+    policyHash: analyzed.policyHash,
+    resolverIdentity: analyzed.resolverIdentity,
+    factsHash: analyzed.factsHash,
+    candidateTreeHash: analyzed.candidateTreeHash,
   };
+  const inputs = observedInputs
+    ? [...observedInputs]
+        .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+        .map(([inputPath, kinds]) => ({ path: inputPath, kinds: [...kinds].sort() }))
+    : [];
+  return { facts, result, inputs };
 }
 
 /**
  * Full architecture scan for governed files.
  * @returns {{ violations: object[], warnings: object[] }}
  */
-export function runArchitectureScan({ root, config, manifest, rules, files, ts, args }) {
-  const manifestIntentLayers = intentLayersFromManifest(manifest);
-  const compilerOptionsFor = createCompilerOptionsLookup(ts, root, args.tsconfig);
-  const moduleHost = createModuleResolutionHost(ts);
-
-  const warnings = collectConfigWarnings(root, config, files, rules, manifest);
-  const safety = collectSafetyDiagnostics(ts, root, config, files);
-  warnings.push(...safety.warnings);
-  const cacheKey = args.noCache ? undefined : scanCacheKey(root, args);
-  const cachedFiles = cacheKey ? loadScanCache(root, cacheKey) : undefined;
-  const nextCacheFiles = {};
-
-  const scanned = [];
-  for (const file of files) {
-    const sourceLayer = layerForFile(root, file, config.layers);
-    if (!sourceLayer) continue;
-    const relFile = normalize(path.relative(root, file));
-    const stat = fs.statSync(file);
-    const fileKey = `${stat.mtimeMs}:${stat.size}`;
-    const cached = cachedFiles?.[relFile];
-    const entry =
-      cached && cached.fileKey === fileKey
-        ? cached
-        : {
-            fileKey,
-            ...scanSourceFile(
-              ts,
-              root,
-              config,
-              rules,
-              manifestIntentLayers,
-              file,
-              sourceLayer
-            ),
-          };
-    nextCacheFiles[relFile] = entry;
-    scanned.push({ file, sourceLayer, relFile, entry });
-  }
-
-  const engineEdges = [];
-  for (const { file, sourceLayer, relFile, entry } of scanned) {
-    for (const edge of entry.edges) {
-      const target = resolveImport(
-        ts,
-        edge.specifier,
-        file,
-        compilerOptionsFor(file),
-        moduleHost,
-        root
-      );
-      const targetLayer = target ? layerForFile(root, target, config.layers) : undefined;
-      const relTarget = target ? normalize(path.relative(root, target)) : undefined;
-      const targetCached = relTarget ? nextCacheFiles[relTarget] : undefined;
-      const staticEdge = edge.kind === 'import' || edge.kind === 'export';
-      const targetTypeOnlyExports =
-        staticEdge && Boolean(targetCached?.exportsOnlyTypes) && !edge.typeOnly;
-      const sourcePureTypeModule = Boolean(entry.exportsOnlyTypes);
-      const targetTypeNames = new Set(targetCached?.typeOnlyExportNames || []);
-      const named = edge.namedBindings;
-      const namedBindingsTypeOnly =
-        staticEdge &&
-        Array.isArray(named) &&
-        named.length > 0 &&
-        targetTypeNames.size > 0 &&
-        !targetCached?.hasTopLevelSideEffects &&
-        named.every((name) => targetTypeNames.has(name));
-      const deniedRule = targetLayer
-        ? isBlocked(rules, sourceLayer, targetLayer, {
-            fromPath: relFile,
-            toPath: relTarget,
-            layers: config.layers,
-          })
-        : undefined;
-      let portProofEligible = false;
-      if (
-        deniedRule &&
-        !deniedRule.peerIsolation &&
-        !edge.typeOnly &&
-        edge.kind === 'import' &&
-        !targetTypeOnlyExports &&
-        !namedBindingsTypeOnly
-      ) {
-        try {
-          const source = fs.readFileSync(file, 'utf8');
-          portProofEligible = Boolean(provePortProofInject(ts, source, { filePath: file }).eligible);
-        } catch {
-          portProofEligible = false;
-        }
-      }
-      engineEdges.push({
-        from: relFile,
-        fromLayer: sourceLayer,
-        to: relTarget,
-        toLayer: targetLayer,
-        line: edge.line,
-        kind: edge.kind,
-        typeOnly: edge.typeOnly,
-        targetTypeOnlyExports,
-        sourcePureTypeModule,
-        namedBindingsTypeOnly,
-        portProofEligible,
-      });
-    }
-  }
-
-  if (cacheKey) saveScanCache(root, cacheKey, nextCacheFiles);
-
-  return evaluateArchitectureGraph({
-    config,
-    rules,
-    files: scanned.map(({ relFile }) => relFile),
-    contentViolations: scanned.flatMap(({ entry }) => entry.contentViolations),
-    edges: engineEdges,
-    warnings,
-    safety: safety.report,
-  });
+export function runArchitectureScan(options) {
+  return resolveArchitectureSnapshot({ ...options, captureInputs: false }).result;
 }

package/bin/lib/auto-patch.mjs

@@ -194,15 +194,35 @@ export function applyImportTypeAutoPatch(ts, source, opts = {}) {
  *   filePath?: string,
  *   root: string,
  *   ts: object,
- *   validate: (source: string) => { valid: boolean, violations?: any[] },
+ *   validate: (source: string) => { valid: boolean, completeness?: string, violations?: any[] },
  *   resolveTargetAbs?: Function,
  * }} opts
  */
 export function validateWithAutoPatch(opts) {
   const { source, filePath, root, ts, validate, resolveTargetAbs } = opts;
   const result = validate(source);
+  const completeness = result.completeness === 'unavailable' ? 'unavailable' : 'partial';
+  const completenessReasons =
+    Array.isArray(result.completenessReasons) && result.completenessReasons.length > 0
+      ? result.completenessReasons
+      : [
+          {
+            code:
+              completeness === 'unavailable'
+                ? 'ANALYSIS_UNAVAILABLE'
+                : 'LEXICAL_EVIDENCE_INCOMPLETE',
+            message:
+              completeness === 'unavailable'
+                ? 'Single-file analysis is unavailable.'
+                : 'Single-file validation cannot prove complete candidate resolver evidence.',
+          },
+        ];
   const base = {
-    valid: Boolean(result.valid),
+    mode: 'lexical-compatibility',
+    valid: false,
+    lexicalValid: Boolean(result.lexicalValid ?? result.valid),
+    completeness,
+    completenessReasons,
     violations: Array.isArray(result.violations) ? result.violations : [],
   };
 
@@ -229,8 +249,16 @@ export function validateWithAutoPatch(opts) {
     };
   });
 
-  if (base.valid) {
-    return { valid: true, violations: [], autoPatch: null };
+  if (base.lexicalValid) {
+    return {
+      mode: base.mode,
+      valid: false,
+      lexicalValid: true,
+      completeness: base.completeness,
+      completenessReasons: base.completenessReasons,
+      violations: [],
+      autoPatch: null,
+    };
   }
 
   // Write-path autoPatch: import-type mechanical-safe only (W1).
@@ -242,23 +270,63 @@ export function validateWithAutoPatch(opts) {
   });
 
   if (!attempt) {
-    return { valid: false, violations, autoPatch: null };
+    return {
+      mode: base.mode,
+      valid: false,
+      lexicalValid: false,
+      completeness: base.completeness,
+      completenessReasons: base.completenessReasons,
+      violations,
+      autoPatch: null,
+    };
   }
 
   const after = validate(attempt.source);
-  if (!after.valid) {
+  if (!(after.lexicalValid ?? after.valid)) {
     // Discard — never return an unvalidated patch
-    return { valid: false, violations, autoPatch: null };
+    return {
+      mode: base.mode,
+      valid: false,
+      lexicalValid: false,
+      completeness: base.completeness,
+      completenessReasons: base.completenessReasons,
+      violations,
+      autoPatch: null,
+    };
   }
 
+  const afterCompleteness = after.completeness === 'unavailable' ? 'unavailable' : 'partial';
+  const afterCompletenessReasons =
+    Array.isArray(after.completenessReasons) && after.completenessReasons.length > 0
+      ? after.completenessReasons
+      : [
+          {
+            code:
+              afterCompleteness === 'unavailable'
+                ? 'ANALYSIS_UNAVAILABLE'
+                : 'LEXICAL_EVIDENCE_INCOMPLETE',
+            message:
+              afterCompleteness === 'unavailable'
+                ? 'Single-file analysis is unavailable.'
+                : 'Single-file validation cannot prove complete candidate resolver evidence.',
+          },
+        ];
   return {
+    mode: base.mode,
     valid: false,
+    lexicalValid: false,
+    completeness: base.completeness,
+    completenessReasons: base.completenessReasons,
     violations,
     autoPatch: {
+      mode: 'lexical-compatibility',
       source: attempt.source,
       remediationKind: attempt.remediationKind,
       confidence: attempt.confidence,
-      valid: true,
+      valid: false,
+      lexicalValid: true,
+      completeness: afterCompleteness,
+      completenessReasons: afterCompletenessReasons,
     },
   };
 }

package/bin/lib/ci-and-commands.mjs

@@ -426,6 +426,6 @@ ${nodeSetup}
 ${qualityBlock ? `${qualityBlock}\n` : ''}      - name: Ark architecture check
         env:
           ARK_POLICY_BASE_REF: \${{ github.event.pull_request.base.sha || github.event.before }}
-        run: ${pm.run}
+        run: ${pm.run} --fail-on-new-smells --base-ref "\${{ github.event.pull_request.base.sha || github.event.before }}"
 `;
 }

package/bin/lib/codex-home.mjs

@@ -68,11 +68,32 @@ export function codexProjectSlug(absRoot) {
   return `${base}_${hash}`;
 }
 
+/** Parse the one generated-style TOML args array from an MCP table body. */
+export function extractCodexArgsFromBlock(block) {
+  if (!block || typeof block !== 'string') return null;
+  const matches = [
+    ...block.matchAll(/^[ \t]*args[ \t]*=[ \t]*\[([^\]\r\n]*)\][ \t]*(?:#.*)?$/gm),
+  ];
+  if (matches.length !== 1) return null;
+  const tokens = [...matches[0][1].matchAll(/"(?:\\.|[^"\\])*"|'[^']*'/g)];
+  const shape = matches[0][1].replace(/"(?:\\.|[^"\\])*"|'[^']*'/g, '__ARK_STRING__');
+  if (!/^[ \t]*(?:__ARK_STRING__(?:[ \t]*,[ \t]*__ARK_STRING__)*[ \t]*,?)?[ \t]*$/.test(shape)) {
+    return null;
+  }
+  try {
+    return tokens.map((match) =>
+      match[0].startsWith('"') ? JSON.parse(match[0]) : match[0].slice(1, -1)
+    );
+  } catch {
+    return null;
+  }
+}
+
 /** Extract `--root` from one TOML mcp_servers table body. */
 export function extractCodexRootFromBlock(block) {
-  if (!block || typeof block !== 'string') return null;
-  const m = block.match(/"--root"\s*,\s*"([^"]+)"/);
-  return m ? m[1] : null;
+  const args = extractCodexArgsFromBlock(block);
+  const index = args?.indexOf('--root') ?? -1;
+  return index >= 0 && typeof args[index + 1] === 'string' ? args[index + 1] : null;
 }
 
 /**
@@ -82,20 +103,19 @@ export function extractCodexRootFromBlock(block) {
 export function listCodexArkServerTables(tomlText) {
   if (!tomlText || typeof tomlText !== 'string') return [];
   const out = [];
-  const headerRe = /\[mcp_servers\.(ark(?:_[a-zA-Z0-9_-]*)?)\]/g;
+  const headerRe =
+    /^[ \t]*\[[ \t]*(?:"mcp_servers"|'mcp_servers'|mcp_servers)[ \t]*\.[ \t]*(?:"(ark(?:_[a-zA-Z0-9_-]*)?)"|'(ark(?:_[a-zA-Z0-9_-]*)?)'|(ark(?:_[a-zA-Z0-9_-]*)?))[ \t]*\][ \t]*(?:#.*)?$/gm;
   const headers = [];
   let hm;
   while ((hm = headerRe.exec(tomlText)) !== null) {
-    headers.push({ table: hm[1], index: hm.index });
+    headers.push({ table: hm[1] ?? hm[2] ?? hm[3], index: hm.index });
   }
   for (let i = 0; i < headers.length; i++) {
     const start = headers[i].index;
-    let end = i + 1 < headers.length ? headers[i + 1].index : tomlText.length;
-    if (i + 1 >= headers.length) {
-      const rest = tomlText.slice(start + 1);
-      const other = rest.search(/\n\[/);
-      if (other >= 0) end = start + 1 + other;
-    }
+    let end = tomlText.length;
+    const rest = tomlText.slice(start + 1);
+    const other = rest.search(/\n(?=[ \t]*\[)/);
+    if (other >= 0) end = start + 1 + other;
     const block = tomlText.slice(start, end).replace(/\s+$/, '\n');
     out.push({
       table: headers[i].table,
@@ -148,9 +168,14 @@ export function codexScopedTableForRoot(tomlText, absRoot) {
 /** True when project TOML owns the primary Ark MCP binding for that project. */
 export function codexProjectMcpIsValid(tomlText, projectRoot) {
   const resolvedRoot = path.resolve(projectRoot);
+  if (listCodexArkServerTables(tomlText).filter((entry) => entry.table === 'ark').length !== 1) {
+    return false;
+  }
   const primary = codexPrimaryTable(tomlText);
-  if (!primary?.root || !/\b(ark|arkgate)-mcp\b/.test(primary.block)) return false;
-  const config = primary.block.match(/"--config"\s*,\s*"([^"]+)"/)?.[1];
+  const args = extractCodexArgsFromBlock(primary?.block);
+  if (!primary?.root || !args?.some((value) => /^(ark|arkgate)-mcp$/.test(value))) return false;
+  const configIndex = args.indexOf('--config');
+  const config = configIndex >= 0 ? args[configIndex + 1] : null;
   if (!config) return false;
   try {
     return (
@@ -170,7 +195,9 @@ export function extractCodexArkRootFromToml(tomlText) {
 export function codexArkBlockHasPreferredBin(tomlText) {
   const primary = codexPrimaryTable(tomlText);
   if (!primary) return false;
-  const bins = [...primary.block.matchAll(/"(arkgate-mcp|ark-mcp)"/g)].map((m) => m[1]);
+  const bins = (extractCodexArgsFromBlock(primary.block) ?? []).filter((value) =>
+    /^(arkgate-mcp|ark-mcp)$/.test(value)
+  );
   if (bins.length > 1) return false;
   return bins.length === 1 && bins[0] === PREFERRED_CODEX_MCP_BIN;
 }
@@ -180,7 +207,7 @@ export function codexArkBlockHasPreferredBin(tomlText) {
  * Permanent different project roots are NOT broken — multi-project uses a secondary table.
  */
 export function codexArkBlockNeedsRewrite(tomlText, absRoot) {
-  if (!tomlText || !tomlText.includes('[mcp_servers.ark]')) return true;
+  if (!codexPrimaryTable(tomlText)) return true;
   const rootArg = extractCodexArkRootFromToml(tomlText);
   if (!rootArg || isTempOrUpgradeRoot(rootArg)) return true;
   try {
@@ -210,7 +237,7 @@ export function codexArkBlockNeedsRewrite(tomlText, absRoot) {
  */
 export function assessCodexHomeMcp(tomlText, absRoot) {
   const resolvedRoot = path.resolve(absRoot);
-  if (!tomlText || !tomlText.includes('[mcp_servers.ark]')) {
+  if (!codexPrimaryTable(tomlText)) {
     return {
       root: null,
       tempPath: false,

package/bin/lib/design-delta.mjs

@@ -0,0 +1,4 @@
+// Generated from design-delta.source.mjs — run npm run generate:packaged-tooling.
+import{spawnSync as R}from"node:child_process";import M from"node:crypto";import N from"node:fs";import b from"node:path";import{layerForFile as E}from"../ark-shared.mjs";import{loadGoldenPattern as C}from"./golden-pattern.mjs";import{collectGovernedFiles as O}from"./scan-files.mjs";const K="1.0",A=Object.freeze(["domain-logic-in-ui"]),x=/\.[cm]?[jt]sx?$/i,j=/(?:^|\/)(?:components?|pages|hooks|ui|views|screens)(?:\/|$)|(?:^|\/)app\/(?!api\/)/i,q=/^(can|should|calculate|compute)[A-Z_]|policy/i,W=/^(can|should)[A-Z_]|policy/i,U=/^(calculate|compute)[A-Z_]/i,I=/(?:route|routing|path|label|className|style|render|display|view|modal|dialog|tooltip|navigate|navigation|href|tab|menu|component|toast|breadcrumb|sidebar|drawer|popover|layout|theme|icon)/i,z=/^(?:use[A-Z_]|render|navigate|redirect|push|replace|open|close|show|hide|setState|set[A-Z_]|toast|alert|confirm)/,B=new Set(["includes","some","every","has"]);function m(e){return String(e||"").replace(/\\/g,"/").replace(/^\.\//,"")}function w(e){return`sha256:${M.createHash("sha256").update(e,"utf8").digest("hex")}`}function k(e,t){const i=[...t].map(n=>[m(n.path),w(n.content)]).sort(([n],[r])=>n.localeCompare(r));return w(JSON.stringify({config:e,files:i}))}function H(e,t){const i=t.toLowerCase();return i.endsWith(".tsx")?e.ScriptKind.TSX:i.endsWith(".jsx")?e.ScriptKind.JSX:i.endsWith(".js")||i.endsWith(".mjs")||i.endsWith(".cjs")?e.ScriptKind.JS:e.ScriptKind.TS}function G(e,t,i){const n=E(e,i,t?.layers??[]);return j.test(i)||/presentation|ui|view/i.test(n??"")}function J(e,t){const i=[],n=r=>{if(e.isFunctionDeclaration(r)&&r.name&&r.body)i.push({name:r.name.text,body:r.body,node:r});else if(e.isVariableDeclaration(r)&&e.isIdentifier(r.name)){const s=r.initializer;s&&(e.isArrowFunction(s)||e.isFunctionExpression(s))&&i.push({name:r.name.text,body:s.body,node:r})}else e.isMethodDeclaration(r)&&r.name&&e.isIdentifier(r.name)&&r.body&&i.push({name:r.name.text,body:r.body,node:r});e.forEachChild(r,n)};return n(t),i}function V(e,t){if(!q.test(t.name)||I.test(t.name))return null;let i=0,n=0,r=0,s=0,o=!1,a=!1;const d=new Set([e.SyntaxKind.EqualsEqualsToken,e.SyntaxKind.EqualsEqualsEqualsToken,e.SyntaxKind.ExclamationEqualsToken,e.SyntaxKind.ExclamationEqualsEqualsToken,e.SyntaxKind.LessThanToken,e.SyntaxKind.LessThanEqualsToken,e.SyntaxKind.GreaterThanToken,e.SyntaxKind.GreaterThanEqualsToken,e.SyntaxKind.InKeyword,e.SyntaxKind.InstanceOfKeyword]),u=new Set([e.SyntaxKind.AmpersandAmpersandToken,e.SyntaxKind.BarBarToken,e.SyntaxKind.QuestionQuestionToken]),f=new Set([e.SyntaxKind.PlusToken,e.SyntaxKind.MinusToken,e.SyntaxKind.AsteriskToken,e.SyntaxKind.SlashToken,e.SyntaxKind.PercentToken,e.SyntaxKind.AsteriskAsteriskToken]),c=l=>{if(e.isJsxElement(l)||e.isJsxSelfClosingElement(l)||e.isJsxFragment(l)){a=!0;return}if(e.isBinaryExpression(l)&&(d.has(l.operatorToken.kind)&&(i+=1),u.has(l.operatorToken.kind)&&(n+=1),f.has(l.operatorToken.kind)&&(r+=1)),e.isCallExpression(l)){let S="";e.isIdentifier(l.expression)?S=l.expression.text:e.isPropertyAccessExpression(l.expression)&&(S=l.expression.name.text),B.has(S)&&(s+=1),(z.test(S)||I.test(S))&&(o=!0)}e.forEachChild(l,c)};if(c(t.body),a||o)return null;const p=i+n+s,g=r;let h,y;if(U.test(t.name)&&g>0)h="calculation-rule",y=g;else if(W.test(t.name)&&p>0)h="authorization-policy-rule",y=p;else return null;return{kind:h,magnitude:y,detail:`comparisons:${i};logical:${n};predicates:${s};arithmetic:${r}`}}function Z(e,t){return e?.present&&e.golden?.newCodeHome?`Move ${t} to ${e.golden.newCodeHome} following golden pattern "${e.golden.name}", then import the pure rule from the UI.`:`Move ${t} into the project's Domain/shared pure-rules home and import it from the UI; do not weaken ark.config.json.`}function v({root:e,config:t,records:i,ts:n,goldenPattern:r}){if(!n?.createSourceFile)throw new Error("TypeScript parser is required for design-delta analysis.");const s=[];for(const o of[...i].sort((a,d)=>m(a.path).localeCompare(m(d.path)))){const a=m(o.path);if(!x.test(a)||a.endsWith(".d.ts")||!G(e,t,a))continue;const d=n.createSourceFile(a,String(o.content),n.ScriptTarget.Latest,!0,H(n,a));for(const u of J(n,d)){const f=V(n,u);if(!f)continue;const c=`domain-logic-in-ui|${a}|${u.name}|${f.kind}`,p=d.getLineAndCharacterOfPosition(u.node.getStart(d)).line+1;s.push({smellId:"domain-logic-in-ui",fingerprint:w(c),identity:c,evidence:{kind:f.kind,path:a,line:p,symbol:u.name,detail:f.detail,magnitude:f.magnitude},repairHint:Z(r,u.name)})}}return s.sort((o,a)=>o.identity.localeCompare(a.identity))}function _({mode:e,baseIdentity:t,candidateIdentity:i,touchedPaths:n,baseFindings:r,candidateFindings:s}){const o=new Set([...n].map(m)),a=new Map(r.map(c=>[c.identity,c])),d=new Set(r),u=[];let f=0;for(const c of s){let p=a.get(c.identity);if(!p){const y=[...d].filter(l=>l.smellId===c.smellId&&l.evidence.symbol===c.evidence.symbol&&l.evidence.kind===c.evidence.kind);y.length===1&&([p]=y)}p&&d.delete(p);const g=p?.evidence?.magnitude??0,h=c.evidence.magnitude;if(!o.has(c.evidence.path)){p&&(f+=1);continue}p?h>g?u.push({...c,classification:"worsened",baseMagnitude:g,candidateMagnitude:h}):f+=1:u.push({...c,classification:"new",baseMagnitude:0,candidateMagnitude:h})}return{schemaVersion:K,mode:e,complete:!0,valid:u.length===0,base:t,candidate:i,supportedSmellIds:[...A],touchedPaths:[...o].sort(),changes:u,baseFindingCount:r.length,candidateFindingCount:s.length,historicalResidualCount:f}}function D(e,t){const i=[];for(const n of O(e,t)){const r=m(b.relative(e,n));!x.test(r)||r.endsWith(".d.ts")||i.push({path:r,content:N.readFileSync(n,"utf8")})}return i}function Q(e,t,i,n){const r=new Map(i.map(s=>[m(s.path),s.content]));for(const s of n){const o=m(s.path);!x.test(o)||o.endsWith(".d.ts")||!E(e,o,t?.layers??[])||(s.delete===!0?r.delete(o):typeof s.content=="string"&&r.set(o,s.content))}return[...r].map(([s,o])=>({path:s,content:o}))}function oe({root:e,config:t,changes:i,ts:n}){const r=D(e,t),s=Q(e,t,r,i??[]),o=C(e),a=v({root:e,config:t,records:r,ts:n,goldenPattern:o}),d=v({root:e,config:t,records:s,ts:n,goldenPattern:o});return _({mode:"write-candidate",baseIdentity:{kind:"candidate-tree",value:k(t,r)},candidateIdentity:{kind:"candidate-tree",value:k(t,s)},touchedPaths:(i??[]).map(u=>u.path),baseFindings:a,candidateFindings:d})}function T(e,t,i={}){return R("git",t,{cwd:e,encoding:i.encoding??"utf8",maxBuffer:64*1024*1024,input:i.input})}function P(e,t,i){const n=T(e,t);if(n.status!==0)throw new Error(`${i}: ${(n.stderr||n.stdout||"git command failed").trim()}`);return n.stdout.trim()}function $(e,t,i){const n=T(e,t,{encoding:"buffer"});if(n.status!==0)throw new Error(`${i}: ${String(n.stderr||n.stdout||"git command failed").trim()}`);return n.stdout.toString("utf8").split("\0").map(m).filter(Boolean)}function L(e,t,i){const n=T(e,["show",`${t}:${i}`]);if(n.status!==0)throw new Error(`base file unavailable (${i}): ${(n.stderr||"").trim()}`);return n.stdout}function F(e,t){return{schemaVersion:K,mode:"git-base",complete:!1,valid:!1,base:{kind:"git-tree",value:String(e||"<missing>")},candidate:{kind:"candidate-tree",value:"<unavailable>"},supportedSmellIds:[...A],touchedPaths:[],changes:[],baseFindingCount:0,candidateFindingCount:0,historicalResidualCount:0,error:t}}function X({root:e,config:t,configPath:i="ark.config.json",baseRef:n,ts:r}){if(typeof n!="string"||!n.trim())return F(n,"--fail-on-new-smells requires --base-ref <git-ref>.");try{if(n.startsWith("-"))throw new Error('base ref must not start with "-".');const s=P(e,["rev-parse","--verify",`${n}^{commit}`],"base ref is unresolvable"),o=P(e,["rev-parse","--verify",`${s}^{tree}`],"base tree is unresolvable"),a=m(b.isAbsolute(i)?b.relative(e,i):i);if(!a||a.startsWith("../"))throw new Error("base config path must be inside the project root.");const d=JSON.parse(L(e,s,a)),f=$(e,["ls-tree","-r","--name-only","-z",s],"base tree listing failed").filter(l=>x.test(l)&&!l.endsWith(".d.ts")).filter(l=>E(e,l,d?.layers??[])).map(l=>({path:l,content:L(e,s,l)})),c=D(e,t),p=[...$(e,["diff","--name-only","-z",s,"--"],"candidate diff failed"),...$(e,["ls-files","--others","--exclude-standard","-z"],"untracked-file scan failed")],g=C(e),h=v({root:e,config:d,records:f,ts:r,goldenPattern:g}),y=v({root:e,config:t,records:c,ts:r,goldenPattern:g});return _({mode:"git-base",baseIdentity:{kind:"git-tree",value:o,commit:s},candidateIdentity:{kind:"candidate-tree",value:k(t,c)},touchedPaths:p,baseFindings:h,candidateFindings:y})}catch(s){return F(n,s instanceof Error?s.message:String(s))}}function Y(e){return e?.complete?e.valid?`Design delta passed: 0 new/worsened supported smells across ${e.touchedPaths.length} touched path(s).`:[`Design delta blocked ${e.changes.length} new/worsened supported smell(s):`,...e.changes.map(t=>`- [${t.smellId}] ${t.evidence.path}:${t.evidence.line??1} ${t.evidence.symbol??""} (${t.classification})
+  Next action: ${t.repairHint}`)].join(`
+`):`Design delta unavailable: ${e?.error||"unknown error"}`}function le({enabled:e,...t}){const i=e?X(t):null;return{result:i,combineEdges:({activeViolationCount:n,strictConfig:r,strictWarningCount:s,policyValid:o})=>{const a=n===0&&(!r||s===0)&&o;return{edgeValid:a,observedOk:a&&(i?.valid??!0)}},exitCode:n=>i&&!i.complete?2:n,failureText:()=>i&&!i.valid?Y(i):null}}function ce(e){return e?e.complete?e.valid?[{level:"ok",text:`0 new/worsened supported smells across ${e.touchedPaths.length} touched path(s)`}]:[{level:"bad",text:`${e.changes.length} new/worsened supported smell(s) block this candidate`},...e.changes.slice(0,5).flatMap(t=>[{level:"plain",text:`[${t.smellId}] ${t.evidence.path}:${t.evidence.line??1} ${t.evidence.symbol??""}`},{level:"dim",text:`fix: ${t.repairHint}`}])]:[{level:"bad",text:`Unavailable \u2014 ${e.error||"base/candidate evidence incomplete"}`}]:[]}export{K as DESIGN_DELTA_SCHEMA_VERSION,A as DESIGN_DELTA_SUPPORTED_SMELLS,v as analyzeDesignFindings,le as createDesignDeltaCheck,ce as designDeltaDoctorLines,X as evaluateGitDesignDelta,oe as evaluateWriteDesignDelta,Y as formatDesignDeltaBlock};