audit-tools 0.32.44 → 0.32.46

package/dist/shared/quota/claimRegistry.d.ts

@@ -88,6 +88,15 @@ export declare class ClaimRegistry {
     reclaimStale(): Promise<string[]>;
     /** Snapshot of all current claims, keyed by nodeId. Read under the lock. */
     listClaims(): Promise<ClaimMap>;
+    /**
+     * Snapshot of only the LIVE (non-stale) claims, keyed by nodeId. A stale
+     * record reads as absent — the same staleness rule as `isClaimed`, applied
+     * against THIS registry's configured `staleMs` window — so a consumer probing
+     * for peer possession (e.g. the merge-time ownership gate) never mistakes an
+     * abandoned claim, which the next `claim()` would grant over, for a live
+     * peer's. Read under the lock.
+     */
+    listLiveClaims(): Promise<ClaimMap>;
     /**
      * Whether `nodeId` currently has a LIVE (non-stale) claim. A stale claim reads
      * as not-claimed, since the next `claim()` would grant over it.

package/dist/shared/quota/claimRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claimRegistry.d.ts","sourceRoot":"","sources":["../../../src/shared/quota/claimRegistry.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAmD5C;;;;;;;;;;;GAWG;AACH,qBAAa,aAAa;IAKtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAGd,YAAY,EAAE,MAAM,EACpB,GAAG,GAAE,MAAM,MAAyB,EACrD,OAAO,GAAE,MAAsB;IAMjC,OAAO,CAAC,OAAO;IAIf;;;;;OAKG;IACG,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAejE;;;;;;;;;;;;;OAaG;IACG,SAAS,CACb,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IAuB3E;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAexD;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWrE;;;;OAIG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWnE;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBvC,4EAA4E;IACtE,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC;IAIrC;;;OAGG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAOlD"}
+{"version":3,"file":"claimRegistry.d.ts","sourceRoot":"","sources":["../../../src/shared/quota/claimRegistry.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAmD5C;;;;;;;;;;;GAWG;AACH,qBAAa,aAAa;IAKtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAGd,YAAY,EAAE,MAAM,EACpB,GAAG,GAAE,MAAM,MAAyB,EACrD,OAAO,GAAE,MAAsB;IAMjC,OAAO,CAAC,OAAO;IAIf;;;;;OAKG;IACG,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAejE;;;;;;;;;;;;;OAaG;IACG,SAAS,CACb,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IAuB3E;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAexD;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWrE;;;;OAIG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWnE;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBvC,4EAA4E;IACtE,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC;IAIrC;;;;;;;OAOG;IACG,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC;IAYzC;;;OAGG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAOlD"}

package/dist/shared/quota/claimRegistry.js

@@ -213,6 +213,26 @@ export class ClaimRegistry {
     async listClaims() {
         return withFileLock(this.lockPath, async () => readClaimMap(this.registryPath));
     }
+    /**
+     * Snapshot of only the LIVE (non-stale) claims, keyed by nodeId. A stale
+     * record reads as absent — the same staleness rule as `isClaimed`, applied
+     * against THIS registry's configured `staleMs` window — so a consumer probing
+     * for peer possession (e.g. the merge-time ownership gate) never mistakes an
+     * abandoned claim, which the next `claim()` would grant over, for a live
+     * peer's. Read under the lock.
+     */
+    async listLiveClaims() {
+        return withFileLock(this.lockPath, async () => {
+            const claims = await readClaimMap(this.registryPath);
+            const now = this.now();
+            const live = {};
+            for (const [nodeId, record] of Object.entries(claims)) {
+                if (!this.isStale(record, now))
+                    live[nodeId] = record;
+            }
+            return live;
+        });
+    }
     /**
      * Whether `nodeId` currently has a LIVE (non-stale) claim. A stale claim reads
      * as not-claimed, since the next `claim()` would grant over it.

package/dist/shared/quota/claimRegistry.js.map

@@ -1 +1 @@
-{"version":3,"file":"claimRegistry.js","sourceRoot":"","sources":["../../../src/shared/quota/claimRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAgC9C,SAAS,cAAc;IACrB,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAClC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC9B,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QACnC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,iFAAiF;AACjF,gFAAgF;AAChF,kFAAkF;AAClF,KAAK,UAAU,YAAY,CAAC,YAAoB;IAC9C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;QACjF,IAAI,aAAa,CAAC,MAAM,CAAC;YAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,YAAoB,EAAE,MAAgB;IACjE,MAAM,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,aAAa;IAKL;IACA;IALF,QAAQ,CAAS;IACjB,OAAO,CAAS;IAEjC,YACmB,YAAoB,EACpB,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EACrD,UAAkB,aAAa;QAFd,iBAAY,GAAZ,YAAY,CAAQ;QACpB,QAAG,GAAH,GAAG,CAAiC;QAGrD,IAAI,CAAC,QAAQ,GAAG,GAAG,YAAY,OAAO,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAEO,OAAO,CAAC,MAAmB,EAAE,GAAW;QAC9C,OAAO,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,MAAc,EAAE,MAAc;QACxC,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC1D,CAAC;YACD,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;YACpC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;YAC1D,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAC/C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,SAAS,CACb,OAA0B,EAC1B,MAAc;QAEd,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,gBAAgB,GAA2B,EAAE,CAAC;YACpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChC,sEAAsE;gBACtE,0CAA0C;gBAC1C,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC3E,SAAS;gBACX,CAAC;gBACD,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;gBACpC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;gBAC1D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,gBAAgB,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC;YACxC,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACvE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,OAA0B;QACpC,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;oBACtB,OAAO,IAAI,CAAC,CAAC;gBACf,CAAC;YACH,CAAC;YACD,IAAI,OAAO,GAAG,CAAC;gBAAE,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAChE,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,UAAkB;QAChD,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAClE,QAAQ,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,UAAkB;QAC9C,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAClE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY;QAChB,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;oBACtB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACzE,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,UAAU;QACd,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAClF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAChC,OAAO,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"claimRegistry.js","sourceRoot":"","sources":["../../../src/shared/quota/claimRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAoC9C,SAAS,cAAc;IACrB,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAClC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC9B,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QACnC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,iFAAiF;AACjF,gFAAgF;AAChF,kFAAkF;AAClF,KAAK,UAAU,YAAY,CAAC,YAAoB;IAC9C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;QACjF,IAAI,aAAa,CAAC,MAAM,CAAC;YAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,YAAoB,EAAE,MAAgB;IACjE,MAAM,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,aAAa;IAKL;IACA;IALF,QAAQ,CAAS;IACjB,OAAO,CAAS;IAEjC,YACmB,YAAoB,EACpB,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EACrD,UAAkB,aAAa;QAFd,iBAAY,GAAZ,YAAY,CAAQ;QACpB,QAAG,GAAH,GAAG,CAAiC;QAGrD,IAAI,CAAC,QAAQ,GAAG,GAAG,YAAY,OAAO,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAEO,OAAO,CAAC,MAAmB,EAAE,GAAW;QAC9C,OAAO,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,MAAc,EAAE,MAAc;QACxC,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC1D,CAAC;YACD,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;YACpC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;YAC1D,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAC/C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,SAAS,CACb,OAA0B,EAC1B,MAAc;QAEd,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,gBAAgB,GAA2B,EAAE,CAAC;YACpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChC,sEAAsE;gBACtE,0CAA0C;gBAC1C,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC3E,SAAS;gBACX,CAAC;gBACD,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;gBACpC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;gBAC1D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,gBAAgB,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC;YACxC,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACvE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,OAA0B;QACpC,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;oBACtB,OAAO,IAAI,CAAC,CAAC;gBACf,CAAC;YACH,CAAC;YACD,IAAI,OAAO,GAAG,CAAC;gBAAE,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAChE,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,UAAkB;QAChD,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAClE,QAAQ,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,UAAkB;QAC9C,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAClE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY;QAChB,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;oBACtB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACzE,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,UAAU;QACd,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAClF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc;QAClB,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;oBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;YACxD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAChC,OAAO,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/shared/reporting/auditDeliverable.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auditDeliverable.d.ts","sourceRoot":"","sources":["../../../src/shared/reporting/auditDeliverable.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,mBAAmB,EAEnB,OAAO,EAER,MAAM,qBAAqB,CAAC;AAmB7B;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,SAAS,OAAO,EAAE,GAC3B,mBAAmB,CAgBrB;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/C,MAAM,CAcR;AAED,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,eAAe,EAAE,mBAAmB,CAAC;IACrC,kDAAkD;IAClD,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/C,oBAAoB,CAKtB"}
+{"version":3,"file":"auditDeliverable.d.ts","sourceRoot":"","sources":["../../../src/shared/reporting/auditDeliverable.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,mBAAmB,EAEnB,OAAO,EAER,MAAM,qBAAqB,CAAC;AA0B7B;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,SAAS,OAAO,EAAE,GAC3B,mBAAmB,CAgBrB;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/C,MAAM,CAcR;AAED,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,eAAe,EAAE,mBAAmB,CAAC;IACrC,kDAAkD;IAClD,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/C,oBAAoB,CAKtB"}

package/dist/shared/reporting/auditDeliverable.js

@@ -10,20 +10,25 @@
 // durable rejection state.
 import { AUDIT_FINDINGS_CONTRACT_VERSION } from "../validation/findingsReport.js";
 import { renderFindingBlockLines } from "./findingDisplay.js";
+import { countBy } from "../countBy.js";
 const SEVERITY_KEYS = ["critical", "high", "medium", "low", "info"];
+/**
+ * Every severity key is present (zero-filled) even when no finding carries
+ * it — unlike the plain `countBy` result, which only has keys for severities
+ * that actually occur. Insertion order is SEVERITY_KEYS' order: spreading
+ * `counts` over the zero-filled base only overwrites existing keys' values,
+ * it never reorders or appends (severity is a closed enum, so `counts` can
+ * never introduce a key absent from SEVERITY_KEYS).
+ */
 function severityBreakdown(findings) {
-    const out = {};
+    const zeroed = {};
     for (const key of SEVERITY_KEYS)
-        out[key] = 0;
-    for (const f of findings)
-        out[f.severity] = (out[f.severity] ?? 0) + 1;
-    return out;
+        zeroed[key] = 0;
+    const counts = countBy(findings, (f) => f.severity);
+    return { ...zeroed, ...counts };
 }
 function lensBreakdown(findings) {
-    const out = {};
-    for (const f of findings)
-        out[f.lens] = (out[f.lens] ?? 0) + 1;
-    return out;
+    return countBy(findings, (f) => f.lens);
 }
 /**
  * Build the canonical `audit-findings.json` machine contract over `findings`.

package/dist/shared/reporting/auditDeliverable.js.map

@@ -1 +1 @@
-{"version":3,"file":"auditDeliverable.js","sourceRoot":"","sources":["../../../src/shared/reporting/auditDeliverable.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,2BAA2B;AAQ3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,MAAM,aAAa,GAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEvF,SAAS,iBAAiB,CAAC,QAA4B;IACrD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,aAAa;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,QAA4B;IACjD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAA4B;IAE5B,MAAM,OAAO,GAAyB;QACpC,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,gBAAgB,EAAE,CAAC;QACnB,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QAC/C,kBAAkB,EAAE,CAAC;QACrB,mBAAmB,EAAE,CAAC;QACtB,mCAAmC,EAAE,EAAE;QACvC,cAAc,EAAE,aAAa,CAAC,QAAQ,CAAC;KACxC,CAAC;IACF,OAAO;QACL,gBAAgB,EAAE,+BAA+B;QACjD,OAAO;QACP,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC;QACvB,WAAW,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAA4B,EAC5B,UAA8C,EAAE;IAEhD,MAAM,KAAK,GAAa,CAAC,KAAK,OAAO,CAAC,KAAK,IAAI,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,gBAAgB,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA4B,EAC5B,UAA8C,EAAE;IAEhD,OAAO;QACL,eAAe,EAAE,6BAA6B,CAAC,QAAQ,CAAC;QACxD,eAAe,EAAE,8BAA8B,CAAC,QAAQ,EAAE,OAAO,CAAC;KACnE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auditDeliverable.js","sourceRoot":"","sources":["../../../src/shared/reporting/auditDeliverable.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,2BAA2B;AAQ3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,aAAa,GAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEvF;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,QAA4B;IACrD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,aAAa;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpD,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,QAA4B;IACjD,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAA4B;IAE5B,MAAM,OAAO,GAAyB;QACpC,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,gBAAgB,EAAE,CAAC;QACnB,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QAC/C,kBAAkB,EAAE,CAAC;QACrB,mBAAmB,EAAE,CAAC;QACtB,mCAAmC,EAAE,EAAE;QACvC,cAAc,EAAE,aAAa,CAAC,QAAQ,CAAC;KACxC,CAAC;IACF,OAAO;QACL,gBAAgB,EAAE,+BAA+B;QACjD,OAAO;QACP,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC;QACvB,WAAW,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAA4B,EAC5B,UAA8C,EAAE;IAEhD,MAAM,KAAK,GAAa,CAAC,KAAK,OAAO,CAAC,KAAK,IAAI,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,gBAAgB,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA4B,EAC5B,UAA8C,EAAE;IAEhD,OAAO;QACL,eAAe,EAAE,6BAA6B,CAAC,QAAQ,CAAC;QACxD,eAAe,EAAE,8BAA8B,CAAC,QAAQ,EAAE,OAAO,CAAC;KACnE,CAAC;AACJ,CAAC"}

package/dist/shared/tooling/exec.d.ts

@@ -27,10 +27,28 @@ export interface RunTrackedResult {
  * Quote a single argv token for embedding into the `cmd.exe /d /s /c "..."`
  * command line used by `wrapForWindowsBatch`.
  *
- * In this context cmd.exe's own argv parser processes the resulting quoted
- * string, which treats doubled double-quotes as a literal `"` — so the
- * correct strategy is to wrap the token in double-quotes and replace every
- * internal `"` with `""`.
+ * Two layers of neutralization apply — both are required; this is the
+ * CVE-2024-27980 lesson (see the block comment above):
+ *
+ *  1. **argv-parser layer**: wrap the token in double-quotes and double any
+ *     embedded `"` — this is what makes the eventual `.cmd`/`.bat` process
+ *     see the intended single argv value (doubled double-quotes are a
+ *     literal `"` under that parser's rules).
+ *  2. **cmd.exe line-scan layer**: caret-escape `& | < > ^` wherever they
+ *     appear (even inside the double-quoted region from step 1) — cmd.exe
+ *     applies its own metacharacter scan to the *entire* `/d /s /c` line
+ *     before the argv-parser layer ever runs, and quotes do not block that
+ *     scan (the root cause of CVE-2024-27980).
+ *
+ * `%` cannot be neutralized this way: cmd.exe's percent-expansion of
+ * `%VAR%` runs at yet another stage that caret-escaping does not reliably
+ * suppress across cmd.exe's quirky invocation-shape-dependent rules (a
+ * documented residual gap in Node core's own upstream fix for the same CVE
+ * class). Rather than emit an escape that looks safe but can still be
+ * defeated, this throws a clear error for any argument containing `%`
+ * destined for a `.cmd`/`.bat` shim — callers must avoid routing a raw `%`
+ * through this path (e.g. resolve/expand it before calling, or avoid the
+ * shim).
  *
  * **Do not use this for shell-interpreter command strings.**  For that context
  * (where the entire command is a shell string interpreted by cmd.exe before any
@@ -45,7 +63,27 @@ export declare function quoteForCmd(arg: string): string;
  */
 export declare function shellQuote(arg: string, platform?: NodeJS.Platform): string;
 export declare function toPromptPathToken(value: string): string;
+/**
+ * Quote a single argv token for a *rendered command line* that this tool
+ * hands a host agent to run verbatim — the host may paste it into posix sh,
+ * PowerShell, or cmd.exe, and this function does not know which. Double
+ * quotes protect a token containing a space or shell metacharacter in all
+ * three dialects, provided embedded double quotes are escaped, so: quote
+ * whenever any character falls outside `PROMPT_COMMAND_SAFE_CHARS`, escaping
+ * embedded `"` as `\"`.
+ *
+ * Target: safe to paste into posix sh, PowerShell, and cmd.
+ */
 export declare function quotePromptCommandArg(value: string): string;
+/**
+ * Render an argv array into a single command-line string safe to paste into
+ * posix sh, PowerShell, or cmd.exe — for step prompts and `allowed_commands`
+ * a host agent is told to run verbatim, never for actually spawning a
+ * process (that path is `runTracked`/`resolveExecArgv`, argv-only).
+ * Normalizes path-like Windows tokens to forward slashes first
+ * (`toPromptPathToken`) since `\` is an escape character in some of those
+ * dialects, then quotes each token per `quotePromptCommandArg`.
+ */
 export declare function renderPromptCommand(argv: readonly string[]): string;
 export declare function coerceJsonObjectArg<T extends Record<string, unknown>>(value: T | string | undefined, label: string): T;
 /**

package/dist/shared/tooling/exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../../src/shared/tooling/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AASzE,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,mGAAmG;IACnG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AA0BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAGR;AAWD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI3D;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEnE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnE,KAAK,EAAE,CAAC,GAAG,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,MAAM,GACZ,CAAC,CAeH;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAKR;AAkBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAAO,GAC3C,MAAM,EAAE,CAOV;AAOD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,CAAC,EAAE,MAAM,CAAC,UAAU,GACvB,MAAM,CAAC,UAAU,CAQnB;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,iBAAsB,GAC9B,gBAAgB,CAoClB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAQnB,OAAO,SAAS,CAAC;AAE1B;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,EAQf,OAAO,KAAK,CAAC"}
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../../src/shared/tooling/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AASzE,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,mGAAmG;IACnG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAiDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgB/C;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAGR;AAWD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAWD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEnE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnE,KAAK,EAAE,CAAC,GAAG,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,MAAM,GACZ,CAAC,CAeH;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAKR;AAkBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAAO,GAC3C,MAAM,EAAE,CAOV;AAOD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,CAAC,EAAE,MAAM,CAAC,UAAU,GACvB,MAAM,CAAC,UAAU,CAQnB;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,iBAAsB,GAC9B,gBAAgB,CAoClB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAQnB,OAAO,SAAS,CAAC;AAE1B;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,EAQf,OAAO,KAAK,CAAC"}

package/dist/shared/tooling/exec.js

@@ -7,8 +7,19 @@ const SHELL_SHIM_COMMANDS = new Set(["npm", "npx", "pnpm", "yarn"]);
 //
 //   • `quoteForCmd`          — for `wrapForWindowsBatch`: each argv token is
 //     embedded into the single-string argument passed to `cmd.exe /d /s /c`.
-//     In this context cmd.exe's own *argv parser* processes the resulting
-//     quoted string, so doubling double-quotes (`"` → `""`) is correct.
+//     This doc used to claim cmd.exe's own *argv parser* alone processed the
+//     resulting quoted string, so quote-doubling (`"` → `""`) was "enough".
+//     That claim was the exact premise behind CVE-2024-27980 (Node.js
+//     improper neutralization of argv when spawning a `.bat`/`.cmd` on
+//     Windows): CreateProcess can't launch a batch file directly, so Windows
+//     routes it through `cmd.exe`, and cmd.exe scans the *entire* `/c` line
+//     for its own metacharacters (`& | < > ^`) as a command-line
+//     interpreter — a scan that runs *before* any argv-parser and is NOT
+//     blocked by a token's surrounding double quotes. So both layers apply:
+//     quote-doubling for the eventual argv split the child sees, *and*
+//     caret-escaping the metacharacters so cmd.exe's own line scan can't
+//     reinterpret them as `&&`/`|`/redirection/etc. `%` is a separate,
+//     effectively unsolved case — see the function doc.
 //     Use this when constructing the argv array for `wrapForWindowsBatch`.
 //
 //   • `quoteForShellInterpreterCmd` — for the opencode launcher
@@ -17,18 +28,47 @@ const SHELL_SHIM_COMMANDS = new Set(["npm", "npx", "pnpm", "yarn"]);
 //     In this context the cmd.exe *command interpreter* sees metacharacters
 //     (`^&|<>%"`) before any argv parser, so caret-escaping them is the correct
 //     strategy.  Use this when building the inline string argument for any
-//     `cmd.exe /c "<full-command-string>"`.
+//     `cmd.exe /c "<full-command-string>"`. Verified while hardening
+//     `quoteForCmd` above: this helper already wraps-then-caret-escapes
+//     `" ^ & | < > %` together (including `%`), which is the standard
+//     shell-interpreter-string mitigation — it is a different threat model
+//     from `quoteForCmd`'s argv-emulation path (the caller here already wants
+//     full shell semantics for the rendered string), so it needed no change.
 //
 // Do NOT mix them up: `quoteForShellInterpreterCmd` is not a substitute for
 // `quoteForCmd` in the batch-wrapping path, and vice versa.
+// cmd.exe metacharacters that its own line-scan (not the eventual child's
+// argv parser) recognizes even inside a double-quoted region, for the
+// `quoteForCmd` / `wrapForWindowsBatch` argv-emulation context. `%` is
+// deliberately excluded — see `quoteForCmd`'s doc for why it is rejected
+// instead of escaped.
+const CMD_ARGV_METACHARS = /[&|<>^]/u;
 /**
  * Quote a single argv token for embedding into the `cmd.exe /d /s /c "..."`
  * command line used by `wrapForWindowsBatch`.
  *
- * In this context cmd.exe's own argv parser processes the resulting quoted
- * string, which treats doubled double-quotes as a literal `"` — so the
- * correct strategy is to wrap the token in double-quotes and replace every
- * internal `"` with `""`.
+ * Two layers of neutralization apply — both are required; this is the
+ * CVE-2024-27980 lesson (see the block comment above):
+ *
+ *  1. **argv-parser layer**: wrap the token in double-quotes and double any
+ *     embedded `"` — this is what makes the eventual `.cmd`/`.bat` process
+ *     see the intended single argv value (doubled double-quotes are a
+ *     literal `"` under that parser's rules).
+ *  2. **cmd.exe line-scan layer**: caret-escape `& | < > ^` wherever they
+ *     appear (even inside the double-quoted region from step 1) — cmd.exe
+ *     applies its own metacharacter scan to the *entire* `/d /s /c` line
+ *     before the argv-parser layer ever runs, and quotes do not block that
+ *     scan (the root cause of CVE-2024-27980).
+ *
+ * `%` cannot be neutralized this way: cmd.exe's percent-expansion of
+ * `%VAR%` runs at yet another stage that caret-escaping does not reliably
+ * suppress across cmd.exe's quirky invocation-shape-dependent rules (a
+ * documented residual gap in Node core's own upstream fix for the same CVE
+ * class). Rather than emit an escape that looks safe but can still be
+ * defeated, this throws a clear error for any argument containing `%`
+ * destined for a `.cmd`/`.bat` shim — callers must avoid routing a raw `%`
+ * through this path (e.g. resolve/expand it before calling, or avoid the
+ * shim).
  *
  * **Do not use this for shell-interpreter command strings.**  For that context
  * (where the entire command is a shell string interpreted by cmd.exe before any
@@ -37,9 +77,19 @@ const SHELL_SHIM_COMMANDS = new Set(["npm", "npx", "pnpm", "yarn"]);
 export function quoteForCmd(arg) {
     if (arg.length === 0)
         return '""';
-    if (!/[\s"]/u.test(arg))
+    if (arg.includes("%")) {
+        throw new Error(`quoteForCmd: refusing to quote an argument containing "%" for a ` +
+            `.cmd/.bat shim invocation through cmd.exe — cmd.exe's ` +
+            `percent-expansion cannot be reliably neutralized by caret-escaping ` +
+            `(see CVE-2024-27980 and its documented residual gap). Argument: ` +
+            `${JSON.stringify(arg)}`);
+    }
+    const needsQuoting = /[\s"]/u.test(arg);
+    const needsMetaEscape = CMD_ARGV_METACHARS.test(arg);
+    if (!needsQuoting && !needsMetaEscape)
         return arg;
-    return `"${arg.replace(/"/g, '""')}"`;
+    const quoted = needsQuoting ? `"${arg.replace(/"/g, '""')}"` : arg;
+    return needsMetaEscape ? quoted.replace(/([&|<>^])/g, "^$1") : quoted;
 }
 /**
  * Quote a single argv token for embedding inside a shell command line that is
@@ -61,11 +111,39 @@ function isPromptPathToken(value) {
 export function toPromptPathToken(value) {
     return isPromptPathToken(value) ? value.replace(/\\/g, "/") : value;
 }
+// Tokens matching this charset need no quoting in any of the three dialects
+// `renderPromptCommand` targets (posix sh, PowerShell, cmd.exe). Anything
+// outside it — spaces, quotes, and shell metacharacters such as `& | < > ^ %
+// ; $ ( ) { } * ? ! ~` — is quoted rather than special-cased per dialect: a
+// host-facing rendered command string has no single "current shell" to tailor
+// escaping to, so the conservative allowlist-then-quote approach is the one
+// that can't silently miss a metacharacter for whichever reader executes it.
+const PROMPT_COMMAND_SAFE_CHARS = /^[A-Za-z0-9_\-./:\\=@,+]*$/u;
+/**
+ * Quote a single argv token for a *rendered command line* that this tool
+ * hands a host agent to run verbatim — the host may paste it into posix sh,
+ * PowerShell, or cmd.exe, and this function does not know which. Double
+ * quotes protect a token containing a space or shell metacharacter in all
+ * three dialects, provided embedded double quotes are escaped, so: quote
+ * whenever any character falls outside `PROMPT_COMMAND_SAFE_CHARS`, escaping
+ * embedded `"` as `\"`.
+ *
+ * Target: safe to paste into posix sh, PowerShell, and cmd.
+ */
 export function quotePromptCommandArg(value) {
-    return /[\s"]/u.test(value)
-        ? `"${value.replace(/"/g, '\\"')}"`
-        : value;
+    return PROMPT_COMMAND_SAFE_CHARS.test(value)
+        ? value
+        : `"${value.replace(/"/g, '\\"')}"`;
 }
+/**
+ * Render an argv array into a single command-line string safe to paste into
+ * posix sh, PowerShell, or cmd.exe — for step prompts and `allowed_commands`
+ * a host agent is told to run verbatim, never for actually spawning a
+ * process (that path is `runTracked`/`resolveExecArgv`, argv-only).
+ * Normalizes path-like Windows tokens to forward slashes first
+ * (`toPromptPathToken`) since `\` is an escape character in some of those
+ * dialects, then quotes each token per `quotePromptCommandArg`.
+ */
 export function renderPromptCommand(argv) {
     return argv.map((item) => quotePromptCommandArg(toPromptPathToken(item))).join(" ");
 }

package/dist/shared/tooling/exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../src/shared/tooling/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAqB,MAAM,oBAAoB,CAAC;AAmCzE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpE,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,yDAAyD;AACzD,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,0EAA0E;AAC1E,wEAAwE;AACxE,2EAA2E;AAC3E,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,6EAA6E;AAC7E,4EAA4E;AAC5E,gFAAgF;AAChF,2EAA2E;AAC3E,4CAA4C;AAC5C,EAAE;AACF,4EAA4E;AAC5E,4DAA4D;AAE5D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACpC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,GAAW,EACX,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC;AAChD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,CACL,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QACzB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,6CAA6C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACpF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG;QACnC,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAA6B,EAC7B,KAAa;IAEb,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAO,CAAC;IACxC,IAAI,MAAM,GAAY,KAAK,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,6CAA6C,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,2CAA2C,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAW,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACzC,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7D,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,OAAO,MAAM,CAAC;IAC9D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,QAAyB;IAChE,OAAO,QAAQ,KAAK,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAe,EACf,IAAc,EACd,QAAyB;IAEzB,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjE,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS;QACzC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAc,EACd,UAA0C,EAAE;IAE5C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7D,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,MAAM,CAAC,KAAyC;IACvD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC;IAChC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,YAAY,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,SAAS;QAC5D,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CACxB,IAAc,EACd,UAA6B,EAAE;IAE/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,IAAI,EAAE,EAAE;YACR,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,CAAC;YACd,KAAK,EAAE,IAAI,KAAK,CAAC,sCAAsC,CAAC;SACzD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE;QACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QACvD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC;QACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,MAAM;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAC9B,OAAe,EACf,IAAwB,EACxB,OAAyC,EACzC,EAAE,CACF,SAAS,CAAC,OAAO,EAAE,IAAgB,EAAE;IACnC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClB,WAAW,EAAE,IAAI;CAClB,CAAC,CAAqB,CAAC;AAE1B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAC1B,OAAe,EACf,IAAwB,EACxB,OAAqC,EACrC,EAAE,CACF,KAAK,CAAC,OAAO,EAAE,IAAgB,EAAE;IAC/B,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClB,WAAW,EAAE,IAAI;CAClB,CAAC,CAAiB,CAAC"}
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../src/shared/tooling/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAqB,MAAM,oBAAoB,CAAC;AAmCzE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpE,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,yDAAyD;AACzD,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,sEAAsE;AACtE,uEAAuE;AACvE,6EAA6E;AAC7E,4EAA4E;AAC5E,iEAAiE;AACjE,yEAAyE;AACzE,4EAA4E;AAC5E,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,wDAAwD;AACxD,2EAA2E;AAC3E,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,6EAA6E;AAC7E,4EAA4E;AAC5E,gFAAgF;AAChF,2EAA2E;AAC3E,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,EAAE;AACF,4EAA4E;AAC5E,4DAA4D;AAE5D,0EAA0E;AAC1E,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,sBAAsB;AACtB,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,wDAAwD;YACxD,qEAAqE;YACrE,kEAAkE;YAClE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAC3B,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe;QAAE,OAAO,GAAG,CAAC;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,OAAO,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,GAAW,EACX,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC;AAChD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,CACL,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QACzB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,6CAA6C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACpF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACtE,CAAC;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC1C,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAA6B,EAC7B,KAAa;IAEb,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAO,CAAC;IACxC,IAAI,MAAM,GAAY,KAAK,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,6CAA6C,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,2CAA2C,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAW,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACzC,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7D,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,OAAO,MAAM,CAAC;IAC9D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,QAAyB;IAChE,OAAO,QAAQ,KAAK,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAe,EACf,IAAc,EACd,QAAyB;IAEzB,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjE,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS;QACzC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAc,EACd,UAA0C,EAAE;IAE5C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7D,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,MAAM,CAAC,KAAyC;IACvD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC;IAChC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,YAAY,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,SAAS;QAC5D,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CACxB,IAAc,EACd,UAA6B,EAAE;IAE/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,IAAI,EAAE,EAAE;YACR,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,CAAC;YACd,KAAK,EAAE,IAAI,KAAK,CAAC,sCAAsC,CAAC;SACzD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE;QACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QACvD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC;QACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,MAAM;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAC9B,OAAe,EACf,IAAwB,EACxB,OAAyC,EACzC,EAAE,CACF,SAAS,CAAC,OAAO,EAAE,IAAgB,EAAE;IACnC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClB,WAAW,EAAE,IAAI;CAClB,CAAC,CAAqB,CAAC;AAE1B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAC1B,OAAe,EACf,IAAwB,EACxB,OAAqC,EACrC,EAAE,CACF,KAAK,CAAC,OAAO,EAAE,IAAgB,EAAE;IAC/B,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClB,WAAW,EAAE,IAAI;CAClB,CAAC,CAAiB,CAAC"}

package/dist/shared/types/contractPipeline/verification.d.ts

@@ -14,18 +14,32 @@ export interface VerificationTraceEntry {
     evidence: string[];
     status: "passed" | "failed";
 }
-/** Per-finding verification trace. */
+/**
+ * Per-finding verification trace.
+ *
+ * `overall_status` is `"skipped"` for findings whose item was settled by user
+ * decision (ignored / deemed inappropriate) rather than verified — these are
+ * honest, first-class outcomes, not failures and not passes.
+ */
 export interface FindingVerificationTrace {
     finding_id: string;
     traces: VerificationTraceEntry[];
-    overall_status: "passed" | "failed";
+    overall_status: "passed" | "failed" | "skipped";
 }
+/**
+ * Report-level `overall_status` stays a strict `"passed" | "failed"` — it is
+ * a run verdict, not a per-finding trace, so it never itself carries
+ * `"skipped"`. Per-finding `"skipped"` results are excluded from the verdict
+ * computation entirely (neither pass nor fail it): the report is `"passed"`
+ * when every non-skipped finding passed (including the all-skipped case,
+ * where the verdict reduces to the combined test/closing-action outcome).
+ */
 export interface VerificationReport {
     contract_version: typeof CONTRACT_PIPELINE_VERIFICATION_REPORT_VERSION;
     goal_id?: string;
     /** Per-finding verification traces. */
     findings: FindingVerificationTrace[];
-    /** Overall report verdict. */
+    /** Overall report verdict — never "skipped"; see per-finding doc above. */
     overall_status: "passed" | "failed";
     /** ISO-8601 timestamp when this report was created. */
     created_at: string;

package/dist/shared/types/contractPipeline/verification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../../../src/shared/types/contractPipeline/verification.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,eAAO,MAAM,6CAA6C,EACxD,6CAAsD,CAAC;AAEzD,eAAO,MAAM,0CAA0C,EACrD,4DAAqE,CAAC;AAIxE,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EACA,aAAa,GACb,WAAW,GACX,gBAAgB,GAChB,MAAM,GACN,MAAM,GACN,SAAS,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC7B;AAED,sCAAsC;AACtC,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACjC,cAAc,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,OAAO,6CAA6C,CAAC;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,QAAQ,EAAE,wBAAwB,EAAE,CAAC;IACrC,8BAA8B;IAC9B,cAAc,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACpC,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,0DAA0D;AAC1D,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;AAEpE,kEAAkE;AAClE,MAAM,WAAW,SAAS;IACxB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,IAAI,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,qDAAqD;IACrD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,mFAAmF;IACnF,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,OAAO,0CAA0C,CAAC;IACpE,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../../../src/shared/types/contractPipeline/verification.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,eAAO,MAAM,6CAA6C,EACxD,6CAAsD,CAAC;AAEzD,eAAO,MAAM,0CAA0C,EACrD,4DAAqE,CAAC;AAIxE,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EACA,aAAa,GACb,WAAW,GACX,gBAAgB,GAChB,MAAM,GACN,MAAM,GACN,SAAS,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACjC,cAAc,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;CACjD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,OAAO,6CAA6C,CAAC;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,QAAQ,EAAE,wBAAwB,EAAE,CAAC;IACrC,2EAA2E;IAC3E,cAAc,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACpC,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,0DAA0D;AAC1D,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;AAEpE,kEAAkE;AAClE,MAAM,WAAW,SAAS;IACxB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,IAAI,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,qDAAqD;IACrD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,mFAAmF;IACnF,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,OAAO,0CAA0C,CAAC;IACpE,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/shared/types/sessionConfig.d.ts

@@ -3,6 +3,14 @@ import type { DispatchModelTier } from "./stepContract.js";
 export declare const PROVIDER_NAMES: readonly ["auto", "worker-command", "subprocess-template", "claude-code", "codex", "opencode", "openai-compatible", "vscode-task", "antigravity"];
 export type ProviderName = (typeof PROVIDER_NAMES)[number];
 export type ResolvedProviderName = Exclude<ProviderName, "auto">;
+/**
+ * Validate a `--host-provider` CLI value against {@link PROVIDER_NAMES}, throwing
+ * the same message both orchestrators surface on a typo (host_provider is a
+ * quota-ATTRIBUTION key — a silently-wrong value would mis-charge dispatch fan-out
+ * to the wrong account). Single-sourced so audit's `getHostProvider` and
+ * remediate's `parseHostProviderOption` cannot drift.
+ */
+export declare function assertHostProviderName(value: string): asserts value is ProviderName;
 /**
  * The attended-vs-headless discriminator for dispatch (defect-1). TRUE (default,
  * conversation-first) means an attended conversation host is driving THIS invocation
@@ -24,6 +32,26 @@ export declare function resolveHostDispatchCapability(options: {
     envVarName: string;
     env?: NodeJS.ProcessEnv;
 }): boolean;
+/**
+ * Whether the in-process rolling dispatch engine drives an orchestrator's
+ * dispatch phase. Single-sourced resolution order (identical for both
+ * orchestrators, differing only in the env var name each passes as
+ * `envVarName`): explicit per-invocation value → `sessionConfig.dispatch.rolling_engine`
+ * → the tool-specific env var (`AUDIT_CODE_ROLLING_ENGINE` /
+ * `REMEDIATE_ROLLING_ENGINE`) → default TRUE (the rolling drivers are validated
+ * end-to-end; the legacy host-fanned wave path is the explicit opt-OUT). Mirrors
+ * the {@link resolveHostDispatchCapability} pattern above.
+ */
+export declare function resolveRollingEngineFlag(options: {
+    explicit?: boolean;
+    sessionConfig?: {
+        dispatch?: {
+            rolling_engine?: boolean;
+        };
+    } | null;
+    envVarName: string;
+    env?: NodeJS.ProcessEnv;
+}): boolean;
 export declare const SESSION_UI_MODES: readonly ["visible", "headless"];
 export type SessionUiMode = (typeof SESSION_UI_MODES)[number];
 export interface SubprocessTemplateConfig {

package/dist/shared/types/sessionConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionConfig.d.ts","sourceRoot":"","sources":["../../../src/shared/types/sessionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,eAAO,MAAM,cAAc,mJAUjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3D,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACrD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE;QAAE,2BAA2B,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAQV;AAED,eAAO,MAAM,gBAAgB,kCAAmC,CAAC;AACjE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,WAAW,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;IACtE,sJAAsJ;IACtJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,8FAA8F;IAC9F,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iFAAiF;IACjF,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,gFAAgF;IAChF,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,eAAO,MAAM,qBAAqB;;;;;;;;CAQxB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,8FAMhC,CAAC;AACX,MAAM,MAAM,0BAA0B,GACpC,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,QAAQ,EAAE,0BAA0B,CAAC;IACrC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,uEAAuE;IACvE,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,6DAMpB,CAAC;AACX,eAAO,MAAM,qBAAqB,+DAA4B,CAAC;AAC/D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IACtC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,eAAe,EAAE,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;IAC/C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,yBAAyB,CAAC;IACjD,kEAAkE;IAClE,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,wBAAwB,CAAC;CACpD"}
+{"version":3,"file":"sessionConfig.d.ts","sourceRoot":"","sources":["../../../src/shared/types/sessionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,eAAO,MAAM,cAAc,mJAUjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3D,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,IAAI,YAAY,CAM/B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACrD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE;QAAE,2BAA2B,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAQV;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAQV;AAED,eAAO,MAAM,gBAAgB,kCAAmC,CAAC;AACjE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,WAAW,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;IACtE,sJAAsJ;IACtJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,8FAA8F;IAC9F,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iFAAiF;IACjF,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,gFAAgF;IAChF,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,eAAO,MAAM,qBAAqB;;;;;;;;CAQxB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,8FAMhC,CAAC;AACX,MAAM,MAAM,0BAA0B,GACpC,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,QAAQ,EAAE,0BAA0B,CAAC;IACrC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,uEAAuE;IACvE,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,6DAMpB,CAAC;AACX,eAAO,MAAM,qBAAqB,+DAA4B,CAAC;AAC/D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IACtC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,eAAe,EAAE,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;IAC/C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,yBAAyB,CAAC;IACjD,kEAAkE;IAClE,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,wBAAwB,CAAC;CACpD"}

package/dist/shared/types/sessionConfig.js

@@ -10,6 +10,18 @@ export const PROVIDER_NAMES = [
     "vscode-task",
     "antigravity",
 ];
+/**
+ * Validate a `--host-provider` CLI value against {@link PROVIDER_NAMES}, throwing
+ * the same message both orchestrators surface on a typo (host_provider is a
+ * quota-ATTRIBUTION key — a silently-wrong value would mis-charge dispatch fan-out
+ * to the wrong account). Single-sourced so audit's `getHostProvider` and
+ * remediate's `parseHostProviderOption` cannot drift.
+ */
+export function assertHostProviderName(value) {
+    if (!PROVIDER_NAMES.includes(value)) {
+        throw new Error(`--host-provider must be one of: ${PROVIDER_NAMES.join(", ")} (got "${value}")`);
+    }
+}
 /**
  * The attended-vs-headless discriminator for dispatch (defect-1). TRUE (default,
  * conversation-first) means an attended conversation host is driving THIS invocation
@@ -36,6 +48,29 @@ export function resolveHostDispatchCapability(options) {
         return false;
     return true;
 }
+/**
+ * Whether the in-process rolling dispatch engine drives an orchestrator's
+ * dispatch phase. Single-sourced resolution order (identical for both
+ * orchestrators, differing only in the env var name each passes as
+ * `envVarName`): explicit per-invocation value → `sessionConfig.dispatch.rolling_engine`
+ * → the tool-specific env var (`AUDIT_CODE_ROLLING_ENGINE` /
+ * `REMEDIATE_ROLLING_ENGINE`) → default TRUE (the rolling drivers are validated
+ * end-to-end; the legacy host-fanned wave path is the explicit opt-OUT). Mirrors
+ * the {@link resolveHostDispatchCapability} pattern above.
+ */
+export function resolveRollingEngineFlag(options) {
+    if (options.explicit !== undefined)
+        return options.explicit;
+    const cfg = options.sessionConfig?.dispatch?.rolling_engine;
+    if (cfg !== undefined)
+        return cfg;
+    const envValue = (options.env ?? process.env)[options.envVarName];
+    if (envValue === "true")
+        return true;
+    if (envValue === "false")
+        return false;
+    return true;
+}
 export const SESSION_UI_MODES = ["visible", "headless"];
 export const PROVIDER_SECTION_KEYS = {
     "subprocess-template": "subprocess_template",

package/dist/shared/types/sessionConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessionConfig.js","sourceRoot":"","sources":["../../../src/shared/types/sessionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM;IACN,gBAAgB;IAChB,qBAAqB;IACrB,aAAa;IACb,OAAO;IACP,UAAU;IACV,mBAAmB;IACnB,aAAa;IACb,aAAa;CACL,CAAC;AAIX;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAK7C;IACC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,EAAE,2BAA2B,CAAC;IAC/D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAU,CAAC;AAgIjE,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,qBAAqB,EAAE,qBAAqB;IAC5C,aAAa,EAAE,aAAa;IAC5B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,mBAAmB,EAAE,mBAAmB;IACxC,aAAa,EAAE,aAAa;IAC5B,WAAW,EAAE,aAAa;CAClB,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,mBAAmB;IACnB,OAAO;IACP,UAAU;IACV,gBAAgB;IAChB,qBAAqB;CACb,CAAC;AA8MX;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM;IACN,WAAW;IACX,WAAW;IACX,MAAM;IACN,MAAM;CACE,CAAC;AACX,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"sessionConfig.js","sourceRoot":"","sources":["../../../src/shared/types/sessionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM;IACN,gBAAgB;IAChB,qBAAqB;IACrB,aAAa;IACb,OAAO;IACP,UAAU;IACV,mBAAmB;IACnB,aAAa;IACb,aAAa;CACL,CAAC;AAIX;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAa;IAEb,IAAI,CAAE,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,mCAAmC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,CAChF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAK7C;IACC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,EAAE,2BAA2B,CAAC;IAC/D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAKxC;IACC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,cAAc,CAAC;IAC5D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAU,CAAC;AAgIjE,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,qBAAqB,EAAE,qBAAqB;IAC5C,aAAa,EAAE,aAAa;IAC5B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,mBAAmB,EAAE,mBAAmB;IACxC,aAAa,EAAE,aAAa;IAC5B,WAAW,EAAE,aAAa;CAClB,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,mBAAmB;IACnB,OAAO;IACP,UAAU;IACV,gBAAgB;IAChB,qBAAqB;CACb,CAAC;AA8MX;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM;IACN,WAAW;IACX,WAAW;IACX,MAAM;IACN,MAAM;CACE,CAAC;AACX,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC"}

package/opencode.json

@@ -6,9 +6,6 @@
     "read": "allow",
     "glob": "allow",
     "grep": "allow",
-    "external_directory": {
-      "*": "allow"
-    },
     "edit": {
       "*": "ask",
       ".remediate-code/**": "allow",
@@ -18,7 +15,7 @@
       "audit-report.md": "allow"
     },
     "bash": {
-      "*": "allow",
+      "*": "ask",
       "*audit-code.mjs": "allow",
       "*audit-code.mjs* cleanup*": "deny",
       "*audit-code.mjs* ensure*": "allow",
@@ -80,9 +77,6 @@
         "read": "allow",
         "glob": "allow",
         "grep": "allow",
-        "external_directory": {
-          "*": "allow"
-        },
         "edit": {
           "*": "ask",
           ".audit-code/**": "allow",
@@ -91,7 +85,7 @@
           "audit-report.md": "allow"
         },
         "bash": {
-          "*": "allow",
+          "*": "ask",
           "audit-code synthesize*": "deny",
           "*dist*index.js* synthesize*": "deny",
           "*audit-code.mjs* synthesize*": "deny",
@@ -136,9 +130,6 @@
         "read": "allow",
         "glob": "allow",
         "grep": "allow",
-        "external_directory": {
-          "*": "allow"
-        },
         "edit": {
           "*": "ask",
           ".remediate-code/**": "allow",