audit-tools 0.32.15 → 0.32.16

package/dist/remediate/steps/dispatch.js

@@ -6,10 +6,9 @@ import { routeAmendmentRequest } from "../dispatch/amendmentClaim.js";
 import { toBlockId, fromBlockId } from "../contractPipeline/idRegistry.js";
 import { readContractArtifact } from "../contractPipeline/artifactStore.js";
 import { verifyPairingForFinding } from "../contractPipeline/changeClassification.js";
-import { spawnSync } from "node:child_process";
 import { StateStore } from "../state/store.js";
 import { REMEDIATION_STEP, isClarificationCategory, } from "../state/types.js";
-import { computeDispatchAdmission, createReservationLedger, tierRank } from "audit-tools/shared";
+import { computeDispatchAdmission, createReservationLedger, tierRank, spawnSyncHidden } from "audit-tools/shared";
 import { deriveCostRank, lookupConfirmedPosition, readConfirmedCostPositions } from "audit-tools/shared";
 import { scheduleWave as computePoolWaveSchedule } from "audit-tools/shared";
 import { withFileLock } from "audit-tools/shared";
@@ -412,7 +411,7 @@ function getCachedConventions(root) {
  * --show-toplevel` emits a forward-slash absolute path on every platform.
  */
 export function gitTopLevel(cwd) {
-    const result = spawnSync("git", ["rev-parse", "--show-toplevel"], {
+    const result = spawnSyncHidden("git", ["rev-parse", "--show-toplevel"], {
         cwd,
         encoding: "utf8",
         shell: false,
@@ -456,7 +455,7 @@ export function createWorktree(root, worktreePath, branchName) {
             `itself, so 'git worktree add' would escape to an ancestor repo. Initialize a git repo at the ` +
             `target root before rolling dispatch.`);
     }
-    const result = spawnSync("git", ["worktree", "add", "-b", branchName, worktreePath, "HEAD"], { cwd: root, encoding: "utf8", shell: false });
+    const result = spawnSyncHidden("git", ["worktree", "add", "-b", branchName, worktreePath, "HEAD"], { cwd: root, encoding: "utf8", shell: false });
     if (result.status !== 0) {
         const stderr = (result.stderr ?? "").trim();
         const stdout = (result.stdout ?? "").trim();
@@ -509,7 +508,7 @@ export function removeWorktree(root, worktreePath) {
     // exactly as before. We do NOT match on the 'not a working tree' stderr text.
     if (!existsSync(worktreePath))
         return;
-    const result = spawnSync("git", ["worktree", "remove", "--force", worktreePath], { cwd: root, encoding: "utf8", shell: false });
+    const result = spawnSyncHidden("git", ["worktree", "remove", "--force", worktreePath], { cwd: root, encoding: "utf8", shell: false });
     if (result.status !== 0) {
         const stderr = (result.stderr ?? "").trim();
         process.stderr.write(`[remediate-code] worktree remove failed (exit ${result.status ?? "unknown"}): ${stderr}\n`);
@@ -532,9 +531,9 @@ export function resetNodeWorktreeAndBranch(root, worktreePath, branchName) {
     removeWorktree(root, worktreePath);
     // Prune stale worktree admin entries (e.g. a dir deleted out from under git),
     // otherwise `git worktree add` can refuse a path it still thinks is registered.
-    spawnSync("git", ["worktree", "prune"], { cwd: root, shell: false });
+    spawnSyncHidden("git", ["worktree", "prune"], { cwd: root, shell: false });
     // Force-delete the leftover branch from a prior attempt so `-b` recreates it.
-    spawnSync("git", ["branch", "-D", branchName], { cwd: root, shell: false });
+    spawnSyncHidden("git", ["branch", "-D", branchName], { cwd: root, shell: false });
     // Force-remove a leftover worktree DIRECTORY: when a prior attempt's worktree
     // became an orphaned dir (registered admin entry gone but files remain),
     // `git worktree remove` no-ops ("is not a working tree") and `git worktree add`
@@ -584,7 +583,7 @@ export function verifyNodeInWorktree(worktreePath, targetedCommands) {
 /** Merge the worktree branch into the current HEAD via cherry-pick. On failure, removes the worktree and returns the error. */
 export function mergeWorktree(root, worktreePath, branchName) {
     // Get the tip commit of the worktree branch
-    const revResult = spawnSync("git", ["rev-parse", branchName], {
+    const revResult = spawnSyncHidden("git", ["rev-parse", branchName], {
         cwd: root,
         encoding: "utf8",
         shell: false,
@@ -595,7 +594,7 @@ export function mergeWorktree(root, worktreePath, branchName) {
         return { success: false, error: `Failed to resolve worktree branch ${branchName}: ${errMsg}` };
     }
     const worktreeTip = revResult.stdout.trim();
-    const mergeResult = spawnSync("git", ["cherry-pick", worktreeTip], {
+    const mergeResult = spawnSyncHidden("git", ["cherry-pick", worktreeTip], {
         cwd: root,
         encoding: "utf8",
         shell: false,
@@ -603,7 +602,7 @@ export function mergeWorktree(root, worktreePath, branchName) {
     if (mergeResult.status !== 0) {
         const stderr = (mergeResult.stderr ?? "").trim();
         // Abort the cherry-pick so the main tree stays clean
-        spawnSync("git", ["cherry-pick", "--abort"], { cwd: root, shell: false });
+        spawnSyncHidden("git", ["cherry-pick", "--abort"], { cwd: root, shell: false });
         removeWorktree(root, worktreePath);
         return { success: false, error: `cherry-pick failed: ${stderr}` };
     }
@@ -626,7 +625,7 @@ export function dirtyMainTreeCollisions(root, branch) {
     const edited = gitEditedFilesForBranch(root, branch);
     if (!edited.available || edited.files.size === 0)
         return [];
-    const status = spawnSync("git", ["status", "--porcelain", "--", ...edited.files], { cwd: root, encoding: "utf8", shell: false });
+    const status = spawnSyncHidden("git", ["status", "--porcelain", "--", ...edited.files], { cwd: root, encoding: "utf8", shell: false });
     if (status.error || status.status !== 0)
         return [];
     const dirty = [];
@@ -655,13 +654,13 @@ export function dirtyMainTreeCollisions(root, branch) {
  * node's work can still be quarantined).
  */
 export function rebaseBranchOntoHead(root, worktreePath, branch) {
-    const head = spawnSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8", shell: false });
+    const head = spawnSyncHidden("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8", shell: false });
     if (head.error || head.status !== 0) {
         const detail = (head.stderr ?? head.error?.message ?? "git rev-parse failed").toString().trim();
         return { ok: false, error: `could not resolve remediation HEAD for rebase: ${detail}` };
     }
     const target = head.stdout.trim();
-    const rebase = spawnSync("git", ["rebase", target], {
+    const rebase = spawnSyncHidden("git", ["rebase", target], {
         cwd: worktreePath,
         encoding: "utf8",
         shell: false,
@@ -672,7 +671,7 @@ export function rebaseBranchOntoHead(root, worktreePath, branch) {
             .join("\n")
             .trim();
         // Leave a clean tree: abort the in-progress rebase before the worktree is dropped.
-        spawnSync("git", ["rebase", "--abort"], { cwd: worktreePath, shell: false });
+        spawnSyncHidden("git", ["rebase", "--abort"], { cwd: worktreePath, shell: false });
         return {
             ok: false,
             error: `rebase onto the current remediation HEAD conflicted (a real seam — two ` +
@@ -729,7 +728,7 @@ export function quarantineRef(runId, blockId) {
  * a manual `git cherry-pick`. Best-effort; returns the ref + commit, or null.
  */
 export function quarantineFailedNodeCommit(root, branch, runId, blockId) {
-    const rev = spawnSync("git", ["rev-parse", "--verify", "--quiet", `${branch}^{commit}`], {
+    const rev = spawnSyncHidden("git", ["rev-parse", "--verify", "--quiet", `${branch}^{commit}`], {
         cwd: root,
         encoding: "utf8",
         shell: false,
@@ -738,7 +737,7 @@ export function quarantineFailedNodeCommit(root, branch, runId, blockId) {
         return null;
     const commit = (rev.stdout ?? "").trim();
     const ref = quarantineRef(runId, blockId);
-    const upd = spawnSync("git", ["update-ref", ref, commit], {
+    const upd = spawnSyncHidden("git", ["update-ref", ref, commit], {
         cwd: root,
         encoding: "utf8",
         shell: false,
@@ -768,7 +767,7 @@ export function quarantineUncommittedWorktreeEdits(root, worktreeRoot, branch, r
     // honours .gitignore, so the incidental ignored churn (node_modules/dist) and
     // the offending generated artifact stay out — what we preserve is the worker's
     // real source work.
-    const add = spawnSync("git", ["add", "-A"], {
+    const add = spawnSyncHidden("git", ["add", "-A"], {
         cwd: worktreeRoot,
         encoding: "utf8",
         shell: false,
@@ -776,13 +775,13 @@ export function quarantineUncommittedWorktreeEdits(root, worktreeRoot, branch, r
     if (add.status !== 0)
         return null;
     // Nothing staged → no uncommitted edits to preserve.
-    const staged = spawnSync("git", ["diff", "--cached", "--quiet"], {
+    const staged = spawnSyncHidden("git", ["diff", "--cached", "--quiet"], {
         cwd: worktreeRoot,
         shell: false,
     });
     if (staged.status === 0)
         return null;
-    const commit = spawnSync("git", ["commit", "-m", `remediate-quarantine ${blockId} (${runId}) — fail-loud preserve`], { cwd: worktreeRoot, encoding: "utf8", shell: false });
+    const commit = spawnSyncHidden("git", ["commit", "-m", `remediate-quarantine ${blockId} (${runId}) — fail-loud preserve`], { cwd: worktreeRoot, encoding: "utf8", shell: false });
     if (commit.status !== 0) {
         process.stderr.write(`[remediate-code] could not preserve uncommitted edits for ${blockId}: ${(commit.stderr ?? "").trim()}\n`);
         return null;
@@ -791,7 +790,7 @@ export function quarantineUncommittedWorktreeEdits(root, worktreeRoot, branch, r
 }
 /** Clear a node's quarantine ref (e.g. once a later re-dispatch landed successfully). Best-effort. */
 export function clearQuarantinedCommit(root, runId, blockId) {
-    spawnSync("git", ["update-ref", "-d", quarantineRef(runId, blockId)], {
+    spawnSyncHidden("git", ["update-ref", "-d", quarantineRef(runId, blockId)], {
         cwd: root,
         encoding: "utf8",
         shell: false,
@@ -800,7 +799,7 @@ export function clearQuarantinedCommit(root, runId, blockId) {
 /** Quarantined failed-node commits still preserved for a run, for recovery surfacing in the report. */
 export function listQuarantinedCommits(root, runId) {
     const prefix = `refs/remediation-quarantine/${refSafeSegment(runId, "run")}/`;
-    const res = spawnSync("git", ["for-each-ref", "--format=%(refname) %(objectname)", prefix], {
+    const res = spawnSyncHidden("git", ["for-each-ref", "--format=%(refname) %(objectname)", prefix], {
         cwd: root,
         encoding: "utf8",
         shell: false,
@@ -851,7 +850,7 @@ export function ensureRemediationBranchCheckedOut(root, runId, artifactsDir) {
     if (top === null || canonicalPathKey(top) !== canonicalPathKey(root))
         return null;
     const branch = remediationBranchName(runId);
-    const current = spawnSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    const current = spawnSyncHidden("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
         cwd: root,
         encoding: "utf8",
         shell: false,
@@ -860,7 +859,7 @@ export function ensureRemediationBranchCheckedOut(root, runId, artifactsDir) {
         return branch;
     const branchExisted = gitBranchExists(root, branch);
     const args = branchExisted ? ["checkout", branch] : ["checkout", "-b", branch];
-    const co = spawnSync("git", args, { cwd: root, encoding: "utf8", shell: false });
+    const co = spawnSyncHidden("git", args, { cwd: root, encoding: "utf8", shell: false });
     if (co.status !== 0) {
         process.stderr.write(`[remediate-code] could not switch to remediation branch ${branch}: ${(co.stderr ?? "").trim()}\n`);
         return null;
@@ -980,7 +979,7 @@ function isUnderWritePaths(rel, declaredWritePaths, root) {
 function forceAddNewSourceFiles(worktreeRoot, declaredWritePaths) {
     if (declaredWritePaths === undefined)
         return { ok: true };
-    const ls = spawnSync("git", ["ls-files", "--others", "--ignored", "--exclude-standard"], { cwd: worktreeRoot, encoding: "utf8", shell: false });
+    const ls = spawnSyncHidden("git", ["ls-files", "--others", "--ignored", "--exclude-standard"], { cwd: worktreeRoot, encoding: "utf8", shell: false });
     if (ls.error || ls.status !== 0) {
         return {
             ok: false,
@@ -1018,7 +1017,7 @@ function forceAddNewSourceFiles(worktreeRoot, declaredWritePaths) {
         };
     }
     for (const rel of toForceAdd) {
-        const add = spawnSync("git", ["add", "-f", "--", rel], {
+        const add = spawnSyncHidden("git", ["add", "-f", "--", rel], {
             cwd: worktreeRoot,
             encoding: "utf8",
             shell: false,
@@ -1037,7 +1036,7 @@ export function commitWorktree(worktreeRoot, message, declaredWritePaths) {
     if (!forced.ok) {
         return { committed: false, error: forced.error };
     }
-    const add = spawnSync("git", ["add", "-A"], {
+    const add = spawnSyncHidden("git", ["add", "-A"], {
         cwd: worktreeRoot,
         encoding: "utf8",
         shell: false,
@@ -1046,14 +1045,14 @@ export function commitWorktree(worktreeRoot, message, declaredWritePaths) {
         return { committed: false, error: `git add failed: ${(add.stderr ?? "").trim()}` };
     }
     // `git diff --cached --quiet` exits 0 when nothing is staged → no worker edits.
-    const staged = spawnSync("git", ["diff", "--cached", "--quiet"], {
+    const staged = spawnSyncHidden("git", ["diff", "--cached", "--quiet"], {
         cwd: worktreeRoot,
         shell: false,
     });
     if (staged.status === 0) {
         return { committed: false };
     }
-    const commit = spawnSync("git", ["commit", "-m", message], {
+    const commit = spawnSyncHidden("git", ["commit", "-m", message], {
         cwd: worktreeRoot,
         encoding: "utf8",
         shell: false,
@@ -1253,7 +1252,7 @@ export async function acceptNodeWorktree(params) {
         }
         // Capture the base HEAD OID BEFORE the cherry-pick so a RED merged-base check can
         // roll the base back to a bit-identical state.
-        const baseHeadBefore = spawnSync("git", ["rev-parse", "HEAD"], {
+        const baseHeadBefore = spawnSyncHidden("git", ["rev-parse", "HEAD"], {
             cwd: root,
             encoding: "utf8",
             shell: false,
@@ -1301,12 +1300,12 @@ export async function acceptNodeWorktree(params) {
                     ? check.error.message
                     : [check.stdout ?? "", check.stderr ?? ""].filter(Boolean).join("\n");
                 // Roll the base back to its pre-pick OID, bit-identical.
-                spawnSync("git", ["reset", "--hard", baseOid], { cwd: root, shell: false });
+                spawnSyncHidden("git", ["reset", "--hard", baseOid], { cwd: root, shell: false });
                 // Scoped clean: remove only the cherry-pick / check-emitted untracked files
                 // under the paths the pick touched — never a blanket `git clean` that could
                 // nuke unrelated untracked state.
                 if (pickedFiles.available && pickedFiles.files.size > 0) {
-                    spawnSync("git", ["clean", "-fdq", "--", ...[...pickedFiles.files]], { cwd: root, shell: false });
+                    spawnSyncHidden("git", ["clean", "-fdq", "--", ...[...pickedFiles.files]], { cwd: root, shell: false });
                 }
                 quarantineFailedNodeCommit(root, branch, runId, blockId);
                 return {
@@ -2447,12 +2446,12 @@ function assertImplementWorkerResult(value, path) {
 }
 /** True when `root` is inside a git work tree (the git tool is present and it's a repo). */
 function isGitWorkTree(root) {
-    const probe = spawnSync("git", ["rev-parse", "--is-inside-work-tree"], { cwd: root, encoding: "utf8", shell: false });
+    const probe = spawnSyncHidden("git", ["rev-parse", "--is-inside-work-tree"], { cwd: root, encoding: "utf8", shell: false });
     return !probe.error && probe.status === 0 && /true/.test(probe.stdout ?? "");
 }
 /** True when `branch` resolves to a commit in the repo at `root`. */
 function gitBranchExists(root, branch) {
-    const probe = spawnSync("git", ["rev-parse", "--verify", "--quiet", `${branch}^{commit}`], { cwd: root, encoding: "utf8", shell: false });
+    const probe = spawnSyncHidden("git", ["rev-parse", "--verify", "--quiet", `${branch}^{commit}`], { cwd: root, encoding: "utf8", shell: false });
     return !probe.error && probe.status === 0;
 }
 /** Normalize a declared path (absolute, repo-relative, or back-slashed) to a repo-relative forward-slash string. */
@@ -2499,7 +2498,7 @@ export function gitEditedFilesForBranch(root, branch) {
     if (!isGitWorkTree(root)) {
         return { available: false, reason: "not_a_repo", error: "root is not a git work tree" };
     }
-    const diff = spawnSync("git", ["diff", "--name-only", `HEAD...${branch}`], { cwd: root, encoding: "utf8", shell: false });
+    const diff = spawnSyncHidden("git", ["diff", "--name-only", `HEAD...${branch}`], { cwd: root, encoding: "utf8", shell: false });
     if (diff.error || typeof diff.status !== "number" || diff.status !== 0) {
         const detail = (diff.stderr ?? diff.error?.message ?? "git diff failed").toString().trim();
         return { available: false, reason: "probe_failed", error: detail };
@@ -2527,7 +2526,7 @@ export function gitHunksForBranch(root, branch) {
     if (!isGitWorkTree(root)) {
         return { available: false, reason: "not_a_repo", error: "root is not a git work tree" };
     }
-    const diff = spawnSync("git", 
+    const diff = spawnSyncHidden("git", 
     // No rename detection / context noise beyond what we parse; a plain unified
     // diff carries the `+++ b/<path>` and `@@ … +start,count @@` headers we need.
     ["diff", `HEAD...${branch}`], { cwd: root, encoding: "utf8", shell: false });