audit-tools 0.41.0 → 0.42.0

package/dist/remediate/steps/dispatch/common.js

@@ -1,204 +0,0 @@
-import { realpathSync } from "node:fs";
-import { resolve } from "node:path";
-import { spawnSyncHidden } from "audit-tools/shared";
-import { AGENT_FEEDBACK_FILENAME, normalizeRepoPath, } from "audit-tools/shared";
-// ---------------------------------------------------------------------------
-// Path + set primitives
-// ---------------------------------------------------------------------------
-/** Normalize a declared path (absolute, repo-relative, or back-slashed) to a repo-relative forward-slash string. */
-export function toRepoRelative(p, root) {
-    const normalizedRoot = root.replace(/\\/g, "/").replace(/\/$/, "");
-    let s = p.replace(/\\/g, "/");
-    if (s.startsWith(normalizedRoot + "/")) {
-        s = s.slice(normalizedRoot.length + 1);
-    }
-    return s;
-}
-/**
- * Canonical comparison key for a filesystem path. `realpathSync` resolves
- * symlinks and platform short-names so it matches git's `--show-toplevel`
- * output (macOS TMPDIR `/var`→`/private/var`, Windows 8.3 names); falls back to
- * `resolve` for paths that don't exist on disk (e.g. mocked unit tests).
- */
-export function canonicalPathKey(p) {
-    try {
-        return normalizeRepoPath(realpathSync(p));
-    }
-    catch {
-        return normalizeRepoPath(resolve(p));
-    }
-}
-// ---------------------------------------------------------------------------
-// Git primitives
-// ---------------------------------------------------------------------------
-/**
- * The git top-level directory containing `cwd`, or `null` when `cwd` is not
- * inside a git working tree (or git is unavailable). `git rev-parse
- * --show-toplevel` emits a forward-slash absolute path on every platform.
- */
-export function gitTopLevel(cwd) {
-    const result = spawnSyncHidden("git", ["rev-parse", "--show-toplevel"], {
-        cwd,
-        encoding: "utf8",
-        shell: false,
-    });
-    if (result.status !== 0)
-        return null;
-    const top = (result.stdout ?? "").trim();
-    return top.length > 0 ? top : null;
-}
-/**
- * True when `dir` is ITS OWN git top-level — i.e. a real (registered) worktree
- * or repo root, not an orphan plain directory whose git calls resolve UP to an
- * enclosing checkout. The accept/reverify cluster's defects 4/7/11 all shared
- * one mechanism: a node worktree de-registered mid-recovery leaves a plain dir,
- * and any git call with that cwd silently operates on the MAIN checkout
- * (committing its dirt onto the run branch, or reading its dirty status as the
- * node's un-landed work). Every worktree-cwd git WRITE and every
- * worktree-state READ that feeds a reuse decision must pass this first.
- */
-export function isOwnGitTopLevel(dir) {
-    const top = gitTopLevel(dir);
-    return top !== null && canonicalPathKey(top) === canonicalPathKey(dir);
-}
-/** True when `root` is inside a git work tree (the git tool is present and it's a repo). */
-export function isGitWorkTree(root) {
-    const probe = spawnSyncHidden("git", ["rev-parse", "--is-inside-work-tree"], { cwd: root, encoding: "utf8", shell: false });
-    return !probe.error && probe.status === 0 && /true/.test(probe.stdout ?? "");
-}
-/**
- * True when `commitOid` is reachable from `ref` (default HEAD) — the node-identity
- * ancestry probe (INV-WTS-3). `git merge-base --is-ancestor <commit> <ref>` exits 0
- * when the commit IS an ancestor, 1 when it is not, and >1 on a bad object. A
- * landed node's cherry-pick commit stays an ancestor of HEAD as later siblings pile
- * on top; a node whose landing was rolled back / clobbered is NOT an ancestor, so
- * this distinguishes a genuinely-landed node from a false-close (a sibling or
- * pre-existing file at the same path can never make it pass). Fail-closed: a git
- * error / missing object returns false (treated as not-landed → re-block).
- */
-export function gitCommitIsAncestor(root, commitOid, ref = "HEAD") {
-    if (!commitOid)
-        return false;
-    const probe = spawnSyncHidden("git", ["merge-base", "--is-ancestor", commitOid, ref], { cwd: root, encoding: "utf8", shell: false });
-    return !probe.error && probe.status === 0;
-}
-/** True when `branch` resolves to a commit in the repo at `root`. */
-export function gitBranchExists(root, branch) {
-    const probe = spawnSyncHidden("git", ["rev-parse", "--verify", "--quiet", `${branch}^{commit}`], { cwd: root, encoding: "utf8", shell: false });
-    return !probe.error && probe.status === 0;
-}
-/** Branch name a block's isolated worktree is created on (mirrors `worktreePath`). */
-export function worktreeBranchForBlock(blockId, runId) {
-    return `remediate-${blockId}-${runId}`;
-}
-/**
- * The files a worker's worktree branch changed relative to HEAD — the ground
- * truth for write-scope enforcement. Diffs `HEAD...<branch>` (the branch's own
- * commits). Fail-closed / not-a-repo semantics mirror `gitEditedFiles`.
- */
-export function gitEditedFilesForBranch(root, branch) {
-    if (!isGitWorkTree(root)) {
-        return { available: false, reason: "not_a_repo", error: "root is not a git work tree" };
-    }
-    const diff = spawnSyncHidden("git", ["diff", "--name-only", `HEAD...${branch}`], { cwd: root, encoding: "utf8", shell: false });
-    if (diff.error || typeof diff.status !== "number" || diff.status !== 0) {
-        const detail = (diff.stderr ?? diff.error?.message ?? "git diff failed").toString().trim();
-        return { available: false, reason: "probe_failed", error: detail };
-    }
-    const files = new Set();
-    for (const line of (diff.stdout ?? "").split(/\r?\n/)) {
-        const p = line.trim();
-        if (p.length > 0)
-            files.add(p.replace(/\\/g, "/"));
-    }
-    return { available: true, files };
-}
-/**
- * Parse `git diff HEAD...<branch>` into per-hunk NEW-side line ranges — the
- * ground truth for whether two same-file edits actually touch disjoint regions.
- * Mirrors {@link gitEditedFilesForBranch}'s fail-closed / not-a-repo semantics:
- * never throws; on a non-repo / failed probe / malformed diff returns a
- * discriminated result marking hunks unavailable so the caller can fail closed.
- *
- * Paths are normalised to repo-relative forward-slash (the same scheme
- * {@link gitEditedFilesForBranch} emits) so hunk files compare like-for-like
- * with the file set.
- */
-export function gitHunksForBranch(root, branch) {
-    if (!isGitWorkTree(root)) {
-        return { available: false, reason: "not_a_repo", error: "root is not a git work tree" };
-    }
-    const diff = spawnSyncHidden("git", 
-    // No rename detection / context noise beyond what we parse; a plain unified
-    // diff carries the `+++ b/<path>` and `@@ … +start,count @@` headers we need.
-    ["diff", `HEAD...${branch}`], { cwd: root, encoding: "utf8", shell: false });
-    if (diff.error || typeof diff.status !== "number" || diff.status !== 0) {
-        const detail = (diff.stderr ?? diff.error?.message ?? "git diff failed").toString().trim();
-        return { available: false, reason: "probe_failed", error: detail };
-    }
-    return parseUnifiedDiffHunks(diff.stdout ?? "");
-}
-/**
- * Parse a unified-diff body into NEW-side hunk ranges. Extracted for testability
- * (no git spawn). Recognises `+++ b/<path>` file headers and
- * `@@ -a,b +c,d @@` hunk headers; a header we cannot parse fails the whole probe
- * closed (returns `probe_failed`) rather than silently producing partial hunks
- * that would let a real overlap slip through.
- */
-export function parseUnifiedDiffHunks(diffText) {
-    const hunks = [];
-    let currentFile = null;
-    for (const rawLine of diffText.split(/\r?\n/)) {
-        if (rawLine.startsWith("+++ ")) {
-            // `+++ b/path` — or `+++ /dev/null` for a pure deletion (no new side).
-            const target = rawLine.slice(4).trim();
-            if (target === "/dev/null") {
-                currentFile = null;
-                continue;
-            }
-            // Strip the conventional `b/` prefix; leave already-bare paths intact.
-            const bare = target.startsWith("b/") ? target.slice(2) : target;
-            currentFile = bare.replace(/\\/g, "/");
-            continue;
-        }
-        if (rawLine.startsWith("@@")) {
-            const match = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(rawLine);
-            if (!match) {
-                return {
-                    available: false,
-                    reason: "probe_failed",
-                    error: `unparseable hunk header: ${rawLine}`,
-                };
-            }
-            if (currentFile === null)
-                continue; // deletion-only target: no new-side hunk.
-            const startLine = Number(match[1]);
-            const lineCount = match[2] === undefined ? 1 : Number(match[2]);
-            hunks.push({ file: currentFile, startLine, lineCount });
-        }
-    }
-    return { available: true, hunks };
-}
-/**
- * Files the worker edited (from git) that fall OUTSIDE the block's declared
- * write scope. Result-file artifacts and the agent-feedback file are excluded
- * (they are sanctioned side outputs, never source edits). Returns the offending
- * repo-relative paths (empty when the edits are fully within scope).
- */
-export function writeScopeViolations(declaredWritePaths, editedFiles, root) {
-    const declared = new Set(declaredWritePaths.map((p) => toRepoRelative(p, root)));
-    const violations = [];
-    for (const edited of editedFiles) {
-        const rel = toRepoRelative(edited, root);
-        if (declared.has(rel))
-            continue;
-        // Sanctioned non-source outputs: result JSON files and the reflection file.
-        if (rel.endsWith(".result.json"))
-            continue;
-        if (rel.endsWith(AGENT_FEEDBACK_FILENAME))
-            continue;
-        violations.push(rel);
-    }
-    return violations;
-}
-//# sourceMappingURL=common.js.map

package/dist/remediate/steps/dispatch/common.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAO5B,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,oHAAoH;AACpH,MAAM,UAAU,cAAc,CAAC,CAAS,EAAE,IAAY;IACpD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,EAAE,CAAC;QACvC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE;QACtE,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,KAAK,IAAI,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACzE,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,eAAe,CAC3B,KAAK,EACL,CAAC,WAAW,EAAE,uBAAuB,CAAC,EACtC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAC9C,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,SAAiB,EAAE,GAAG,GAAG,MAAM;IAC/E,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAG,eAAe,CAC3B,KAAK,EACL,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,CAAC,EAC/C,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAC9C,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAAc;IAC1D,MAAM,KAAK,GAAG,eAAe,CAC3B,KAAK,EACL,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,EAC1D,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAC9C,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,KAAa;IACnE,OAAO,aAAa,OAAO,IAAI,KAAK,EAAE,CAAC;AACzC,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,MAAc;IAClE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAC1B,KAAK,EACL,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,CAAC,EAC3C,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAC9C,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3F,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACrE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAwBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAc;IAC5D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAC1B,KAAK;IACL,4EAA4E;IAC5E,8EAA8E;IAC9E,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE,CAAC,EAC5B,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAC9C,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3F,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,qBAAqB,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,uEAAuE;YACvE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC3B,WAAW,GAAG,IAAI,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,uEAAuE;YACvE,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAChE,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACvC,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,yCAAyC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,cAAc;oBACtB,KAAK,EAAE,4BAA4B,OAAO,EAAE;iBAC7C,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,KAAK,IAAI;gBAAE,SAAS,CAAC,0CAA0C;YAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,kBAA4B,EAC5B,WAAwB,EACxB,IAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,4EAA4E;QAC5E,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,SAAS;QAC3C,IAAI,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAAE,SAAS;QACpD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/remediate/steps/dispatch/dagNodeFields.d.ts

@@ -1,25 +0,0 @@
-/**
- * The implementation-DAG node fields `promoteImplementationDagToExtractedPlan`
- * writes onto each Finding (one node ↔ one finding ↔ one block in the contract
- * pipeline). The shared `Finding` type does not declare these overlay fields, so
- * they are read through this structural view rather than added to the shared
- * contract. Every field is optional: a finding sourced from a plain
- * `audit-findings.json` (not the contract pipeline) carries none of them and the
- * seam degrades to the block-level behavior.
- */
-export interface DagNodeFields {
-    /** Upstream contracts' declared outputs this node builds on. */
-    preconditions?: string[];
-    /** Human-readable description of the concrete changes the node is expected to produce. */
-    expected_changes?: string;
-    /** Human-readable verification checks beyond `targeted_commands`. */
-    verification?: string[];
-    /**
-     * Reconciliation expectations carried from seam reconciliation: what an
-     * upstream/neighbor contract agreed to provide this node, expressed either as
-     * a list of strings or, when richer, as the precondition list. Read tolerantly
-     * because the promotion shape can vary across pipeline versions.
-     */
-    reconciliation_expectations?: string[];
-}
-//# sourceMappingURL=dagNodeFields.d.ts.map

package/dist/remediate/steps/dispatch/dagNodeFields.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dagNodeFields.d.ts","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/dagNodeFields.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;CACxC"}

package/dist/remediate/steps/dispatch/dagNodeFields.js

@@ -1,5 +0,0 @@
-// ---------------------------------------------------------------------------
-// DAG-node metadata overlay shape
-// ---------------------------------------------------------------------------
-export {};
-//# sourceMappingURL=dagNodeFields.js.map

package/dist/remediate/steps/dispatch/dagNodeFields.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dagNodeFields.js","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/dagNodeFields.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E"}

package/dist/remediate/steps/dispatch/implementPrompt.d.ts

@@ -1,47 +0,0 @@
-/**
- * Best-effort: repo-relative test files that reference any of `sourceFiles` (by
- * module basename). Pulling them into a block's access lets the worker that
- * changes or removes a symbol also fix the tests that assert it, instead of
- * leaving orphaned test breakage for a separate central mop-up. Matching is
- * deliberately loose (a false positive only grants slightly broader, harmless
- * write access; a false negative is the failure mode we want to avoid).
- */
-export interface TestFileEntry {
-    rel: string;
-    content: string;
-}
-/**
- * Walk the repo ONCE and read every test file's content (bounded). Built once per
- * dispatch and shared across all blocks so the filesystem walk + reads are not
- * repeated per block.
- */
-export declare function buildTestFileIndex(root: string): TestFileEntry[];
-/**
- * Collect test files from `index` that reference any of `sourceFiles` by
- * module basename. When `packageRoot` is supplied (repo-relative prefix, e.g.
- * `packages/foo`), only test files under that package are considered —
- * otherwise all test files in the index are matched (existing behavior).
- */
-export declare function collectReferencingTests(index: TestFileEntry[], sourceFiles: string[], packageRoot?: string): string[];
-/**
- * Returns true when any path in `writePaths` is one of the live infra modules.
- * Paths are normalised to forward-slash form (win32 backslash → `/`) and matched
- * by trailing repo-relative segment so absolute/worktree/relative spellings all
- * resolve identically. Used to gate the live-surface verification section in the
- * implement prompt.
- */
-export declare function isInfraModifyingBlock(writePaths: string[]): boolean;
-/**
- * INV-B3-5: resolve a cited source path to the token the worker should open.
- *
- * A bare basename (`advance.ts`) that uniquely resolves to one tracked path
- * (`src/audit/orchestrator/advance.ts`) is rewritten to that tracked path FIRST,
- * so it never surfaces as a broken `<worktreeRoot>/advance.ts` prefix that
- * misdirects the worker to a non-existent top-level file. Full / dotfile-dir /
- * already-absolute / drive-letter paths pass through unchanged; when a worktree
- * root is present, a relative path is prefixed onto it (unchanged behaviour). An
- * ambiguous or unresolvable basename is left as-is (monotonic — never a
- * regression on paths that already resolved).
- */
-export declare function resolveCitationPathForPrompt(rel: string, worktreeRoot: string | undefined, trackedPaths: ReadonlySet<string>): string;
-//# sourceMappingURL=implementPrompt.d.ts.map

package/dist/remediate/steps/dispatch/implementPrompt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"implementPrompt.d.ts","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/implementPrompt.ts"],"names":[],"mappings":"AAyCA;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAYhE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,aAAa,EAAE,EACtB,WAAW,EAAE,MAAM,EAAE,EACrB,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,EAAE,CAsBV;AAsCD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAUnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAChC,MAAM,CASR"}

package/dist/remediate/steps/dispatch/implementPrompt.js

@@ -1,165 +0,0 @@
-import { readFileSync, readdirSync } from "node:fs";
-import { join, relative } from "node:path";
-import { toPromptPathToken, isBareBasename, resolveBasenameToTrackedPath, } from "audit-tools/shared";
-const TEST_FILE_RE = /\.(test|spec)\.[cm]?[jt]sx?$/;
-const WALK_SKIP_DIRS = new Set([
-    "node_modules", ".git", "dist", "build", "coverage", "out",
-    ".next", ".turbo", ".audit-tools",
-]);
-/** Bounded recursive scan for test files under `root` (skips vendor/build dirs). */
-function walkTestFiles(root, max = 400) {
-    const out = [];
-    const stack = [root];
-    let visited = 0;
-    while (stack.length > 0 && out.length < max) {
-        const dir = stack.pop();
-        let entries;
-        try {
-            entries = readdirSync(dir, { withFileTypes: true });
-        }
-        catch {
-            continue;
-        }
-        for (const entry of entries) {
-            if (++visited > 20000)
-                return out;
-            if (entry.isDirectory()) {
-                if (WALK_SKIP_DIRS.has(entry.name) || entry.name.startsWith(".test-"))
-                    continue;
-                stack.push(join(dir, entry.name));
-            }
-            else if (TEST_FILE_RE.test(entry.name)) {
-                out.push(join(dir, entry.name));
-                if (out.length >= max)
-                    break;
-            }
-        }
-    }
-    return out;
-}
-/**
- * Walk the repo ONCE and read every test file's content (bounded). Built once per
- * dispatch and shared across all blocks so the filesystem walk + reads are not
- * repeated per block.
- */
-export function buildTestFileIndex(root) {
-    const index = [];
-    for (const testPath of walkTestFiles(root)) {
-        let content;
-        try {
-            content = readFileSync(testPath, "utf8");
-        }
-        catch {
-            continue;
-        }
-        index.push({ rel: relative(root, testPath).replace(/\\/g, "/"), content });
-    }
-    return index;
-}
-/**
- * Collect test files from `index` that reference any of `sourceFiles` by
- * module basename. When `packageRoot` is supplied (repo-relative prefix, e.g.
- * `packages/foo`), only test files under that package are considered —
- * otherwise all test files in the index are matched (existing behavior).
- */
-export function collectReferencingTests(index, sourceFiles, packageRoot) {
-    if (sourceFiles.length === 0 || index.length === 0)
-        return [];
-    const basenames = sourceFiles
-        .map((f) => (f.split(/[/\\]/).pop() ?? f).replace(/\.[cm]?[jt]sx?$/, ""))
-        .filter((b) => b.length > 1);
-    if (basenames.length === 0)
-        return [];
-    const needles = basenames.map((b) => new RegExp(`\\b${b.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`));
-    const sourceSet = new Set(sourceFiles.map((f) => f.replace(/\\/g, "/")));
-    // Normalize packageRoot to forward slashes and ensure it ends without trailing slash
-    const pkgPrefix = packageRoot
-        ? packageRoot.replace(/\\/g, "/").replace(/\/$/, "") + "/"
-        : null;
-    const result = [];
-    for (const { rel, content } of index) {
-        if (sourceSet.has(rel))
-            continue;
-        // If a package scope is set, skip files outside that package
-        if (pkgPrefix && !rel.startsWith(pkgPrefix))
-            continue;
-        if (needles.some((re) => re.test(content)))
-            result.push(rel);
-    }
-    return result;
-}
-// ---------------------------------------------------------------------------
-// Infra-modifying block detection
-// ---------------------------------------------------------------------------
-/**
- * The live dispatch/orchestration modules whose modification can break the
- * running engine mid-run. Derived from the REAL post-A12 source layout
- * (`src/remediate/...`) — this module IS one of them (`steps/dispatch.ts`), so
- * the list is anchored to the actual files on disk, not a hand-typed monorepo
- * path that drifts when the tree is reorganised (the pre-A12
- * `packages/remediate-code/...` list silently matched NOTHING after the
- * collapse, so every infra block rendered as non-infra). Each entry is the
- * module's path relative to the `src/remediate` area, forward-slash form.
- */
-const INFRA_MODULE_SUBPATHS = [
-    "steps/nextStep.ts",
-    "steps/dispatch.ts",
-    "state/store.ts",
-    "steps/contractPipeline.ts",
-    "steps/stepWriter.ts",
-];
-/**
- * The infra module sub-paths anchored under `src/remediate/` — the canonical
- * repo-relative form for the current (post-A12) single-package layout. A write
- * path matches when its normalised (forward-slash) form ends with one of these
- * segments, so an absolute worktree path
- * (`.../worktrees/foo/src/remediate/steps/dispatch.ts`), a repo-relative path
- * (`src/remediate/steps/dispatch.ts`), or a Windows backslash path all match,
- * while a same-basename file in another area (`src/audit/steps/dispatch.ts`)
- * does not.
- */
-const INFRA_FILE_SEGMENTS = INFRA_MODULE_SUBPATHS.map((sub) => `src/remediate/${sub}`);
-/**
- * Returns true when any path in `writePaths` is one of the live infra modules.
- * Paths are normalised to forward-slash form (win32 backslash → `/`) and matched
- * by trailing repo-relative segment so absolute/worktree/relative spellings all
- * resolve identically. Used to gate the live-surface verification section in the
- * implement prompt.
- */
-export function isInfraModifyingBlock(writePaths) {
-    for (const p of writePaths) {
-        const normalized = p.replace(/\\/g, "/");
-        for (const segment of INFRA_FILE_SEGMENTS) {
-            if (normalized === segment || normalized.endsWith("/" + segment)) {
-                return true;
-            }
-        }
-    }
-    return false;
-}
-/**
- * INV-B3-5: resolve a cited source path to the token the worker should open.
- *
- * A bare basename (`advance.ts`) that uniquely resolves to one tracked path
- * (`src/audit/orchestrator/advance.ts`) is rewritten to that tracked path FIRST,
- * so it never surfaces as a broken `<worktreeRoot>/advance.ts` prefix that
- * misdirects the worker to a non-existent top-level file. Full / dotfile-dir /
- * already-absolute / drive-letter paths pass through unchanged; when a worktree
- * root is present, a relative path is prefixed onto it (unchanged behaviour). An
- * ambiguous or unresolvable basename is left as-is (monotonic — never a
- * regression on paths that already resolved).
- */
-export function resolveCitationPathForPrompt(rel, worktreeRoot, trackedPaths) {
-    let target = rel;
-    if (isBareBasename(rel)) {
-        const resolved = resolveBasenameToTrackedPath(rel, trackedPaths);
-        if (resolved)
-            target = resolved;
-    }
-    if (!worktreeRoot)
-        return target;
-    if (target.startsWith("/") || /^[A-Za-z]:[/\\]/.test(target))
-        return target;
-    return toPromptPathToken(join(worktreeRoot, target));
-}
-//# sourceMappingURL=implementPrompt.js.map

package/dist/remediate/steps/dispatch/implementPrompt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"implementPrompt.js","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/implementPrompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,YAAY,GAAG,8BAA8B,CAAC;AACpD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK;IAC1D,OAAO,EAAE,QAAQ,EAAE,cAAc;CAClC,CAAC,CAAC;AAEH,oFAAoF;AACpF,SAAS,aAAa,CAAC,IAAY,EAAE,GAAG,GAAG,GAAG;IAC5C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACzB,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,EAAE,OAAO,GAAG,KAAK;gBAAE,OAAO,GAAG,CAAC;YAClC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBAChF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,CAAC;iBAAM,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAChC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;oBAAE,MAAM;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,KAAK,MAAM,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAsB,EACtB,WAAqB,EACrB,WAAoB;IAEpB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAG,WAAW;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;SACxE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,CACvE,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACzE,qFAAqF;IACrF,MAAM,SAAS,GAAG,WAAW;QAC3B,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG;QAC1D,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,KAAK,EAAE,CAAC;QACrC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,6DAA6D;QAC7D,IAAI,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QACtD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,qBAAqB,GAAG;IAC5B,mBAAmB;IACnB,mBAAmB;IACnB,gBAAgB;IAChB,2BAA2B;IAC3B,qBAAqB;CACb,CAAC;AAEX;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAsB,qBAAqB,CAAC,GAAG,CACtE,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,GAAG,EAAE,CAChC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAoB;IACxD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzC,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;YAC1C,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAC1C,GAAW,EACX,YAAgC,EAChC,YAAiC;IAEjC,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,4BAA4B,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACjE,IAAI,QAAQ;YAAE,MAAM,GAAG,QAAQ,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC;IACjC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5E,OAAO,iBAAiB,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/remediate/steps/dispatch/verifyCommands.d.ts

@@ -1,144 +0,0 @@
-import type { RemediationState } from "../../state/store.js";
-/**
- * The host manages the build centrally; a per-node verify command that runs
- * `npm run build` (or a `npm test` whose package script prepends a build) races
- * the central build's dist/ and is therefore forbidden. A command is build-free
- * only when it neither builds nor invokes a build-prepending test script.
- *
- * Forbidden (return false):
- *  - `npm run build` / `npm run build -w ...` / `tsc` emit (`tsc -b`, `tsc --build`)
- *  - bare `npm test` / `npm t` / `npm run test` (the package script prepends build)
- *
- * Allowed (return true):
- *  - `npm run check` (no emit)
- *  - `npx vitest run <path>` / `vitest run <path>`
- *  - `node --test <path>`
- */
-export declare function isBuildFreeVerifyCommand(cmd: string): boolean;
-/**
- * Inject the tsx ESM loader into a bare `node --test <file>` command so the `.mjs`
- * node:test suites (which import `audit-tools/shared` via tsconfig `paths`, honored
- * only by tsx) resolve in a per-node worktree with no built `dist/`. A host- or
- * DAG-authored `node --test tests/audit/x.test.mjs` would otherwise fail module
- * resolution; the tool normalizes it so correctness can't depend on the host
- * remembering to add the loader. Idempotent: a command already carrying
- * `--import tsx/esm` or a `--loader` is left untouched. Mirrors the runner the
- * derived verify uses ({@link verifyCommandsForEdits}), so the displayed per-node
- * command and the in-process verify match.
- */
-export declare function normalizeNodeTestCommand(cmd: string): string;
-/**
- * True when `cmd` is a test-runner invocation whose target is a whole directory
- * or the entire suite rather than specific test files — e.g. `npx vitest run
- * tests/remediate`, `vitest run` (no path), `node --test tests/audit/`. Such a
- * command, run as an *additional* per-node verify alongside the scoped derive,
- * re-enters the FULL suite inside a per-node worktree. That is the structural
- * deadlock proven 2026-06-30: a source node's whole-suite verify fails on a
- * stale test owned by a DIFFERENT node, and concurrent worktrees race shared
- * test temp dirs. The derived verify already runs this node's OWN touched
- * tests, so a host/DAG-authored whole-suite command adds only risk — the tool
- * drops it rather than relying on the author to scope it (enforce-in-tooling,
- * never host discretion). A command naming at least one concrete `.test.<ext>`
- * file is scoped and kept.
- */
-export declare function isWholeSuiteTestCommand(cmd: string): boolean;
-/**
- * True when a verify command DEPENDS ON A BUILT `dist/` — either the command
- * string itself references a dist path (spawning the built CLI), or, when
- * `treeRoot` is supplied, a test FILE the command names imports/spawns dist in
- * its content. A per-node worktree has NO dist at all (`dist/` is gitignored
- * and only `node_modules` is junction-linked), so such a command false-reds
- * DETERMINISTICALLY under the by-design build-free accept gate — three accepts
- * in a row failed exactly this way (2026-07-23 dogfood, backlog "build-free
- * accept verify false-reds dist-importing targeted commands"). A central build
- * cannot fix it (it materializes MAIN's dist, not the worktree's), so the
- * remedy is the same as the whole-suite / cross-node families: drop from
- * per-node verify and defer to the central close gate, which runs on the
- * merged tree with a fresh build.
- *
- * Detection is deliberately conservative-toward-deferral: a false positive
- * (e.g. a comment mentioning `dist/`) only moves that command to the close
- * gate — never a lost signal, never a false-red.
- */
-export declare function isDistDependentVerifyCommand(cmd: string, treeRoot?: string): boolean;
-/**
- * True when a verify command names a test FILE that is WORKTREE-HOSTILE: its
- * content spawns the `audit-code` / `remediate-code` driver CLIs, which the
- * worker-context guard (v0.34.19, cwd-discriminated) mechanically refuses from
- * inside a node worktree — so the test deterministically fails there and the
- * node can NEVER accept (accept/reverify cluster defect 8). Same
- * conservative-toward-deferral contract as the dist probe: a false positive
- * only moves the command to the close gate (root cwd, where it runs fine).
- */
-export declare function isWorktreeHostileVerifyCommand(cmd: string, treeRoot: string): boolean;
-/**
- * Partition verify commands into the per-node-runnable set and the DEFERRED set
- * (dist-dependent OR worktree-hostile — both deterministically false-red inside
- * a build-free node worktree; the central close gate runs them on the merged
- * tree at the repo root). Content-level detection: `treeRoot` should be the
- * WORKTREE the verify would run in, so the scanned test files are the node's
- * own post-edit versions. The deferred list is DEDUPLICATED — the close gate's
- * replay drains it verbatim, so a doubled entry would run twice there.
- */
-export declare function partitionDeferredVerifyCommands(commands: string[], treeRoot: string): {
-    kept: string[];
-    deferred: string[];
-};
-/**
- * cg-1: collapse the per-node DEFERRED verify commands into the close gate's
- * single residual run. Exact-duplicate commands collapse to one (first-seen
- * order); when the close phase's own full-suite leg ran green
- * (`fullSuiteCovers`), any command that leg already covers is SUBSUMED and
- * dropped — a whole-suite runner invocation, or a vitest run whose path tokens
- * are all test files (the full vitest sweep runs every test file). Everything
- * else (e.g. `npm run check`, dist-spawning scripts) survives as the residual
- * the close gate must run exactly once. The 2026-08-06 run drained the raw
- * per-node lists verbatim — duplicate full `tests/audit` passes, a 2h close.
- */
-export declare function dedupeDeferredVerifyCommands(deferred: Iterable<string>, opts: {
-    fullSuiteCovers: boolean;
-}): {
-    residual: string[];
-    subsumed: string[];
-};
-/**
- * Repo-relative path-like tokens in a shell command — tokens containing a `/` and a
- * file extension (e.g. `scripts/remediate/verify-hosts.mjs`, `tests/x.test.ts`).
- * Used to decide whether a targeted verify command is self-contained.
- */
-export declare function pathTokensInCommand(cmd: string): string[];
-/**
- * Keep only the targeted verify commands that are SELF-CONTAINED for this node:
- * every path-like token they reference is either one of the node's own paths (its
- * declared write set ∪ the files it actually edited on its branch) or already
- * present in the tree. A command referencing a path this node doesn't own and that
- * isn't in the tree depends on a SIBLING node's not-yet-created deliverable —
- * running it in per-node verify is a guaranteed-fail deadlock (proven 2026-07-03: a
- * node's `targeted_command` was `node scripts/remediate/verify-hosts.mjs`, another
- * node's pending output). Per-node verify must be self-contained; such a cross-node
- * command is dropped here and deferred to the integration/close gate. A command with
- * no path tokens (e.g. `npm run check`) is always kept.
- */
-export declare function selfContainedVerifyCommands(commands: string[], ownPaths: Iterable<string>, treeRoot: string): string[];
-/**
- * Derive a node's per-node verify commands from the test files it ACTUALLY touched
- * on its worktree branch (the git ground truth), instead of trusting host-authored
- * `targeted_commands` whose paths/runner can drift from where the worker put the
- * test. Always typechecks (`npm run check`, no emit), then runs ONLY this node's
- * own touched test files with the repo's runners — never the whole suite (which
- * would re-enter worktree-spawning tests inside a nested worktree). Build-free: the
- * host owns the central build; a node's own test imports the source it changed via
- * the tsx loader. Returns `[]` when there is no git ground truth so the caller can
- * skip the gate rather than fabricate a command.
- */
-/** Pure assembly (git-free) of the verify commands for a set of edited paths —
- *  the testable core of {@link deriveVerifyCommandsFromBranch}. */
-export declare function verifyCommandsForEdits(editedFiles: Iterable<string>): string[];
-export declare function deriveVerifyCommandsFromBranch(root: string, branch: string): string[];
-/**
- * A node's own `targeted_commands` for the per-node verify (task_7d35176d) — the union
- * of the block's `targeted_commands` and its findings' `targeted_commands` (the
- * auditor-specified, fix-specific verification) bound into the host workload.
- */
-export declare function targetedCommandsForBlock(state: RemediationState, blockId: string): string[];
-//# sourceMappingURL=verifyCommands.d.ts.map

package/dist/remediate/steps/dispatch/verifyCommands.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifyCommands.d.ts","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/verifyCommands.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAO7D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CA4B7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM5D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAU5D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAkBpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAgBrF;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,MAAM,EAAE,EAClB,QAAQ,EAAE,MAAM,GACf;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAWxC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAC1B,IAAI,EAAE;IAAE,eAAe,EAAE,OAAO,CAAA;CAAE,GACjC;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAe5C;AAaD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAGzD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAAE,EAClB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAC1B,QAAQ,EAAE,MAAM,GACf,MAAM,EAAE,CAUV;AAaD;;;;;;;;;;GAUG;AACH;mEACmE;AACnE,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAW9E;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAIrF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAS3F"}