audit-tools 0.41.1 → 0.42.1

package/skills/audit-code/SKILL.md

@@ -27,13 +27,6 @@ current conversation, write its required result artifact, ingest it, and stop
 so the user can resume from fresh context. Do not invent a smaller task or an
 alternate execution path.
 
-## Scope confirmation
-
-After intake, echo the repository root, auditable file count, and git
-availability from `scope_summary.json`. If `mis_scope_smells` is non-empty,
-show them and require confirmation before continuing. Otherwise the scope echo
-is informational and the workflow continues.
-
 ## Loader protocol
 
 Bootstrap once, then request one step at a time:
@@ -50,6 +43,9 @@ node audit-code.mjs ensure --quiet
 node audit-code.mjs next-step
 ```
 
+Pass a user-supplied target directory with `--root <path>` on every command. Do
+not add provider, model, quota, routing, or launch flags.
+
 Read the returned JSON only far enough to find `prompt_path`, then read and
 follow only that prompt. Do not inspect workload, result, schema, or state files
 unless the current prompt directs you to them. When it says to continue, call

package/skills/audit-code/audit-code.prompt.md

@@ -19,6 +19,11 @@ audit-code ensure --quiet
 When developing audit-tools itself, use `node audit-code.mjs` from the
 repository root.
 
+Preserve user arguments:
+
+- pass a typed target directory with `--root <path>` on every `audit-code`
+  command (`ensure` and each `next-step`)
+
 Ask for exactly one step:
 
 ```bash
@@ -35,14 +40,5 @@ context-window, routing, or launch configuration to audit-tools. Write the
 prompt-bound result artifacts exactly where requested and let the next backend
 step validate and ingest them.
 
-After intake, read `.audit-tools/audit/scope_summary.json` and echo:
-
-```text
-Auditing <repo_root>, <auditable_file_count> files, git: <yes|no>
-```
-
-If `mis_scope_smells` is non-empty, show each warning and wait for explicit
-confirmation. Otherwise continue without interrupting the workflow.
-
 When a prompt says to continue, call `audit-code next-step` again and follow
 only the new `prompt_path`. Stop when the current prompt says to stop.

package/skills/remediate-code/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: remediate-code
 description: Conversation-first remediation of audit findings or feedback through provider-neutral host work items.
-version: 0.3.0
 ---
 
 # remediate-code skill

package/dist/remediate/steps/dispatch/common.d.ts

@@ -1,126 +0,0 @@
-export interface DispatchOptions {
-    root: string;
-    artifactsDir: string;
-}
-/** Normalize a declared path (absolute, repo-relative, or back-slashed) to a repo-relative forward-slash string. */
-export declare function toRepoRelative(p: string, root: string): string;
-/**
- * Canonical comparison key for a filesystem path. `realpathSync` resolves
- * symlinks and platform short-names so it matches git's `--show-toplevel`
- * output (macOS TMPDIR `/var`→`/private/var`, Windows 8.3 names); falls back to
- * `resolve` for paths that don't exist on disk (e.g. mocked unit tests).
- */
-export declare function canonicalPathKey(p: string): string;
-/**
- * The git top-level directory containing `cwd`, or `null` when `cwd` is not
- * inside a git working tree (or git is unavailable). `git rev-parse
- * --show-toplevel` emits a forward-slash absolute path on every platform.
- */
-export declare function gitTopLevel(cwd: string): string | null;
-/**
- * True when `dir` is ITS OWN git top-level — i.e. a real (registered) worktree
- * or repo root, not an orphan plain directory whose git calls resolve UP to an
- * enclosing checkout. The accept/reverify cluster's defects 4/7/11 all shared
- * one mechanism: a node worktree de-registered mid-recovery leaves a plain dir,
- * and any git call with that cwd silently operates on the MAIN checkout
- * (committing its dirt onto the run branch, or reading its dirty status as the
- * node's un-landed work). Every worktree-cwd git WRITE and every
- * worktree-state READ that feeds a reuse decision must pass this first.
- */
-export declare function isOwnGitTopLevel(dir: string): boolean;
-/** True when `root` is inside a git work tree (the git tool is present and it's a repo). */
-export declare function isGitWorkTree(root: string): boolean;
-/**
- * True when `commitOid` is reachable from `ref` (default HEAD) — the node-identity
- * ancestry probe (INV-WTS-3). `git merge-base --is-ancestor <commit> <ref>` exits 0
- * when the commit IS an ancestor, 1 when it is not, and >1 on a bad object. A
- * landed node's cherry-pick commit stays an ancestor of HEAD as later siblings pile
- * on top; a node whose landing was rolled back / clobbered is NOT an ancestor, so
- * this distinguishes a genuinely-landed node from a false-close (a sibling or
- * pre-existing file at the same path can never make it pass). Fail-closed: a git
- * error / missing object returns false (treated as not-landed → re-block).
- */
-export declare function gitCommitIsAncestor(root: string, commitOid: string, ref?: string): boolean;
-/** True when `branch` resolves to a commit in the repo at `root`. */
-export declare function gitBranchExists(root: string, branch: string): boolean;
-/** Branch name a block's isolated worktree is created on (mirrors `worktreePath`). */
-export declare function worktreeBranchForBlock(blockId: string, runId: string): string;
-/** Outcome of resolving the worker's ACTUAL edited files from git. */
-export type GitEditedFiles = {
-    available: true;
-    files: Set<string>;
-}
-/** git is present but a probe failed against a real repo → fail closed. */
- | {
-    available: false;
-    reason: "probe_failed";
-    error: string;
-}
-/** root is not under version control at all → no ground truth, gate is skipped. */
- | {
-    available: false;
-    reason: "not_a_repo";
-    error: string;
-};
-/**
- * The files a worker's worktree branch changed relative to HEAD — the ground
- * truth for write-scope enforcement. Diffs `HEAD...<branch>` (the branch's own
- * commits). Fail-closed / not-a-repo semantics mirror `gitEditedFiles`.
- */
-export declare function gitEditedFilesForBranch(root: string, branch: string): GitEditedFiles;
-/** A single edited hunk on the NEW side of a branch diff (repo-relative path). */
-export interface GitBranchHunk {
-    /** Repo-relative forward-slash path the hunk belongs to. */
-    file: string;
-    /** 1-based first line of the hunk on the new side. */
-    startLine: number;
-    /** Number of new-side lines the hunk spans (a pure deletion has 0). */
-    lineCount: number;
-}
-/**
- * Outcome of resolving a branch's ACTUAL edited HUNKS from git. Fail-closed like
- * {@link gitEditedFilesForBranch}: on a non-repo, a failed probe, or a diff we
- * cannot parse, `available` is false and callers MUST treat hunk info as absent
- * (conservatively assume same-file blocks overlap — never silently drop a
- * collision).
- */
-export type GitBranchHunks = {
-    available: true;
-    hunks: GitBranchHunk[];
-} | {
-    available: false;
-    reason: "not_a_repo";
-    error: string;
-} | {
-    available: false;
-    reason: "probe_failed";
-    error: string;
-};
-/**
- * Parse `git diff HEAD...<branch>` into per-hunk NEW-side line ranges — the
- * ground truth for whether two same-file edits actually touch disjoint regions.
- * Mirrors {@link gitEditedFilesForBranch}'s fail-closed / not-a-repo semantics:
- * never throws; on a non-repo / failed probe / malformed diff returns a
- * discriminated result marking hunks unavailable so the caller can fail closed.
- *
- * Paths are normalised to repo-relative forward-slash (the same scheme
- * {@link gitEditedFilesForBranch} emits) so hunk files compare like-for-like
- * with the file set.
- */
-export declare function gitHunksForBranch(root: string, branch: string): GitBranchHunks;
-/**
- * Parse a unified-diff body into NEW-side hunk ranges. Extracted for testability
- * (no git spawn). Recognises `+++ b/<path>` file headers and
- * `@@ -a,b +c,d @@` hunk headers; a header we cannot parse fails the whole probe
- * closed (returns `probe_failed`) rather than silently producing partial hunks
- * that would let a real overlap slip through.
- */
-export declare function parseUnifiedDiffHunks(diffText: string): GitBranchHunks;
-/**
- * Files the worker edited (from git) that fall OUTSIDE the block's declared
- * write scope. Result-file artifacts and the agent-feedback file are excluded
- * (they are sanctioned side outputs, never source edits). Returns the offending
- * repo-relative paths (empty when the edits are fully within scope).
- */
-export declare function writeScopeViolations(declaredWritePaths: string[], editedFiles: Set<string>, root: string): string[];
-//# sourceMappingURL=common.d.ts.map

package/dist/remediate/steps/dispatch/common.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/common.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAMD,oHAAoH;AACpH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAO9D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAMlD;AAMD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAStD;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGrD;AAED,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAQ1F;AAED,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAOrE;AAED,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7E;AAMD,sEAAsE;AACtE,MAAM,MAAM,cAAc,GACtB;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE;AACzC,2EAA2E;GACzE;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAC7D,mFAAmF;GACjF;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAmBpF;AAED,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAA;CAAE,GAC3C;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAgB9E;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CAgCtE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,kBAAkB,EAAE,MAAM,EAAE,EAC5B,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,IAAI,EAAE,MAAM,GACX,MAAM,EAAE,CAYV"}

package/dist/remediate/steps/dispatch/common.js

@@ -1,204 +0,0 @@
-import { realpathSync } from "node:fs";
-import { resolve } from "node:path";
-import { spawnSyncHidden } from "audit-tools/shared";
-import { AGENT_FEEDBACK_FILENAME, normalizeRepoPath, } from "audit-tools/shared";
-// ---------------------------------------------------------------------------
-// Path + set primitives
-// ---------------------------------------------------------------------------
-/** Normalize a declared path (absolute, repo-relative, or back-slashed) to a repo-relative forward-slash string. */
-export function toRepoRelative(p, root) {
-    const normalizedRoot = root.replace(/\\/g, "/").replace(/\/$/, "");
-    let s = p.replace(/\\/g, "/");
-    if (s.startsWith(normalizedRoot + "/")) {
-        s = s.slice(normalizedRoot.length + 1);
-    }
-    return s;
-}
-/**
- * Canonical comparison key for a filesystem path. `realpathSync` resolves
- * symlinks and platform short-names so it matches git's `--show-toplevel`
- * output (macOS TMPDIR `/var`→`/private/var`, Windows 8.3 names); falls back to
- * `resolve` for paths that don't exist on disk (e.g. mocked unit tests).
- */
-export function canonicalPathKey(p) {
-    try {
-        return normalizeRepoPath(realpathSync(p));
-    }
-    catch {
-        return normalizeRepoPath(resolve(p));
-    }
-}
-// ---------------------------------------------------------------------------
-// Git primitives
-// ---------------------------------------------------------------------------
-/**
- * The git top-level directory containing `cwd`, or `null` when `cwd` is not
- * inside a git working tree (or git is unavailable). `git rev-parse
- * --show-toplevel` emits a forward-slash absolute path on every platform.
- */
-export function gitTopLevel(cwd) {
-    const result = spawnSyncHidden("git", ["rev-parse", "--show-toplevel"], {
-        cwd,
-        encoding: "utf8",
-        shell: false,
-    });
-    if (result.status !== 0)
-        return null;
-    const top = (result.stdout ?? "").trim();
-    return top.length > 0 ? top : null;
-}
-/**
- * True when `dir` is ITS OWN git top-level — i.e. a real (registered) worktree
- * or repo root, not an orphan plain directory whose git calls resolve UP to an
- * enclosing checkout. The accept/reverify cluster's defects 4/7/11 all shared
- * one mechanism: a node worktree de-registered mid-recovery leaves a plain dir,
- * and any git call with that cwd silently operates on the MAIN checkout
- * (committing its dirt onto the run branch, or reading its dirty status as the
- * node's un-landed work). Every worktree-cwd git WRITE and every
- * worktree-state READ that feeds a reuse decision must pass this first.
- */
-export function isOwnGitTopLevel(dir) {
-    const top = gitTopLevel(dir);
-    return top !== null && canonicalPathKey(top) === canonicalPathKey(dir);
-}
-/** True when `root` is inside a git work tree (the git tool is present and it's a repo). */
-export function isGitWorkTree(root) {
-    const probe = spawnSyncHidden("git", ["rev-parse", "--is-inside-work-tree"], { cwd: root, encoding: "utf8", shell: false });
-    return !probe.error && probe.status === 0 && /true/.test(probe.stdout ?? "");
-}
-/**
- * True when `commitOid` is reachable from `ref` (default HEAD) — the node-identity
- * ancestry probe (INV-WTS-3). `git merge-base --is-ancestor <commit> <ref>` exits 0
- * when the commit IS an ancestor, 1 when it is not, and >1 on a bad object. A
- * landed node's cherry-pick commit stays an ancestor of HEAD as later siblings pile
- * on top; a node whose landing was rolled back / clobbered is NOT an ancestor, so
- * this distinguishes a genuinely-landed node from a false-close (a sibling or
- * pre-existing file at the same path can never make it pass). Fail-closed: a git
- * error / missing object returns false (treated as not-landed → re-block).
- */
-export function gitCommitIsAncestor(root, commitOid, ref = "HEAD") {
-    if (!commitOid)
-        return false;
-    const probe = spawnSyncHidden("git", ["merge-base", "--is-ancestor", commitOid, ref], { cwd: root, encoding: "utf8", shell: false });
-    return !probe.error && probe.status === 0;
-}
-/** True when `branch` resolves to a commit in the repo at `root`. */
-export function gitBranchExists(root, branch) {
-    const probe = spawnSyncHidden("git", ["rev-parse", "--verify", "--quiet", `${branch}^{commit}`], { cwd: root, encoding: "utf8", shell: false });
-    return !probe.error && probe.status === 0;
-}
-/** Branch name a block's isolated worktree is created on (mirrors `worktreePath`). */
-export function worktreeBranchForBlock(blockId, runId) {
-    return `remediate-${blockId}-${runId}`;
-}
-/**
- * The files a worker's worktree branch changed relative to HEAD — the ground
- * truth for write-scope enforcement. Diffs `HEAD...<branch>` (the branch's own
- * commits). Fail-closed / not-a-repo semantics mirror `gitEditedFiles`.
- */
-export function gitEditedFilesForBranch(root, branch) {
-    if (!isGitWorkTree(root)) {
-        return { available: false, reason: "not_a_repo", error: "root is not a git work tree" };
-    }
-    const diff = spawnSyncHidden("git", ["diff", "--name-only", `HEAD...${branch}`], { cwd: root, encoding: "utf8", shell: false });
-    if (diff.error || typeof diff.status !== "number" || diff.status !== 0) {
-        const detail = (diff.stderr ?? diff.error?.message ?? "git diff failed").toString().trim();
-        return { available: false, reason: "probe_failed", error: detail };
-    }
-    const files = new Set();
-    for (const line of (diff.stdout ?? "").split(/\r?\n/)) {
-        const p = line.trim();
-        if (p.length > 0)
-            files.add(p.replace(/\\/g, "/"));
-    }
-    return { available: true, files };
-}
-/**
- * Parse `git diff HEAD...<branch>` into per-hunk NEW-side line ranges — the
- * ground truth for whether two same-file edits actually touch disjoint regions.
- * Mirrors {@link gitEditedFilesForBranch}'s fail-closed / not-a-repo semantics:
- * never throws; on a non-repo / failed probe / malformed diff returns a
- * discriminated result marking hunks unavailable so the caller can fail closed.
- *
- * Paths are normalised to repo-relative forward-slash (the same scheme
- * {@link gitEditedFilesForBranch} emits) so hunk files compare like-for-like
- * with the file set.
- */
-export function gitHunksForBranch(root, branch) {
-    if (!isGitWorkTree(root)) {
-        return { available: false, reason: "not_a_repo", error: "root is not a git work tree" };
-    }
-    const diff = spawnSyncHidden("git", 
-    // No rename detection / context noise beyond what we parse; a plain unified
-    // diff carries the `+++ b/<path>` and `@@ … +start,count @@` headers we need.
-    ["diff", `HEAD...${branch}`], { cwd: root, encoding: "utf8", shell: false });
-    if (diff.error || typeof diff.status !== "number" || diff.status !== 0) {
-        const detail = (diff.stderr ?? diff.error?.message ?? "git diff failed").toString().trim();
-        return { available: false, reason: "probe_failed", error: detail };
-    }
-    return parseUnifiedDiffHunks(diff.stdout ?? "");
-}
-/**
- * Parse a unified-diff body into NEW-side hunk ranges. Extracted for testability
- * (no git spawn). Recognises `+++ b/<path>` file headers and
- * `@@ -a,b +c,d @@` hunk headers; a header we cannot parse fails the whole probe
- * closed (returns `probe_failed`) rather than silently producing partial hunks
- * that would let a real overlap slip through.
- */
-export function parseUnifiedDiffHunks(diffText) {
-    const hunks = [];
-    let currentFile = null;
-    for (const rawLine of diffText.split(/\r?\n/)) {
-        if (rawLine.startsWith("+++ ")) {
-            // `+++ b/path` — or `+++ /dev/null` for a pure deletion (no new side).
-            const target = rawLine.slice(4).trim();
-            if (target === "/dev/null") {
-                currentFile = null;
-                continue;
-            }
-            // Strip the conventional `b/` prefix; leave already-bare paths intact.
-            const bare = target.startsWith("b/") ? target.slice(2) : target;
-            currentFile = bare.replace(/\\/g, "/");
-            continue;
-        }
-        if (rawLine.startsWith("@@")) {
-            const match = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(rawLine);
-            if (!match) {
-                return {
-                    available: false,
-                    reason: "probe_failed",
-                    error: `unparseable hunk header: ${rawLine}`,
-                };
-            }
-            if (currentFile === null)
-                continue; // deletion-only target: no new-side hunk.
-            const startLine = Number(match[1]);
-            const lineCount = match[2] === undefined ? 1 : Number(match[2]);
-            hunks.push({ file: currentFile, startLine, lineCount });
-        }
-    }
-    return { available: true, hunks };
-}
-/**
- * Files the worker edited (from git) that fall OUTSIDE the block's declared
- * write scope. Result-file artifacts and the agent-feedback file are excluded
- * (they are sanctioned side outputs, never source edits). Returns the offending
- * repo-relative paths (empty when the edits are fully within scope).
- */
-export function writeScopeViolations(declaredWritePaths, editedFiles, root) {
-    const declared = new Set(declaredWritePaths.map((p) => toRepoRelative(p, root)));
-    const violations = [];
-    for (const edited of editedFiles) {
-        const rel = toRepoRelative(edited, root);
-        if (declared.has(rel))
-            continue;
-        // Sanctioned non-source outputs: result JSON files and the reflection file.
-        if (rel.endsWith(".result.json"))
-            continue;
-        if (rel.endsWith(AGENT_FEEDBACK_FILENAME))
-            continue;
-        violations.push(rel);
-    }
-    return violations;
-}
-//# sourceMappingURL=common.js.map

package/dist/remediate/steps/dispatch/common.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAO5B,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,oHAAoH;AACpH,MAAM,UAAU,cAAc,CAAC,CAAS,EAAE,IAAY;IACpD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,EAAE,CAAC;QACvC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE;QACtE,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,KAAK,IAAI,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACzE,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,eAAe,CAC3B,KAAK,EACL,CAAC,WAAW,EAAE,uBAAuB,CAAC,EACtC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAC9C,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,SAAiB,EAAE,GAAG,GAAG,MAAM;IAC/E,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAG,eAAe,CAC3B,KAAK,EACL,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,CAAC,EAC/C,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAC9C,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAAc;IAC1D,MAAM,KAAK,GAAG,eAAe,CAC3B,KAAK,EACL,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,EAC1D,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAC9C,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,KAAa;IACnE,OAAO,aAAa,OAAO,IAAI,KAAK,EAAE,CAAC;AACzC,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,MAAc;IAClE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAC1B,KAAK,EACL,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,CAAC,EAC3C,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAC9C,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3F,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACrE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAwBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAc;IAC5D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAC1B,KAAK;IACL,4EAA4E;IAC5E,8EAA8E;IAC9E,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE,CAAC,EAC5B,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAC9C,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3F,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,qBAAqB,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,uEAAuE;YACvE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC3B,WAAW,GAAG,IAAI,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,uEAAuE;YACvE,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAChE,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACvC,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,yCAAyC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,cAAc;oBACtB,KAAK,EAAE,4BAA4B,OAAO,EAAE;iBAC7C,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,KAAK,IAAI;gBAAE,SAAS,CAAC,0CAA0C;YAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,kBAA4B,EAC5B,WAAwB,EACxB,IAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,4EAA4E;QAC5E,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,SAAS;QAC3C,IAAI,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAAE,SAAS;QACpD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/remediate/steps/dispatch/dagNodeFields.d.ts

@@ -1,25 +0,0 @@
-/**
- * The implementation-DAG node fields `promoteImplementationDagToExtractedPlan`
- * writes onto each Finding (one node ↔ one finding ↔ one block in the contract
- * pipeline). The shared `Finding` type does not declare these overlay fields, so
- * they are read through this structural view rather than added to the shared
- * contract. Every field is optional: a finding sourced from a plain
- * `audit-findings.json` (not the contract pipeline) carries none of them and the
- * seam degrades to the block-level behavior.
- */
-export interface DagNodeFields {
-    /** Upstream contracts' declared outputs this node builds on. */
-    preconditions?: string[];
-    /** Human-readable description of the concrete changes the node is expected to produce. */
-    expected_changes?: string;
-    /** Human-readable verification checks beyond `targeted_commands`. */
-    verification?: string[];
-    /**
-     * Reconciliation expectations carried from seam reconciliation: what an
-     * upstream/neighbor contract agreed to provide this node, expressed either as
-     * a list of strings or, when richer, as the precondition list. Read tolerantly
-     * because the promotion shape can vary across pipeline versions.
-     */
-    reconciliation_expectations?: string[];
-}
-//# sourceMappingURL=dagNodeFields.d.ts.map

package/dist/remediate/steps/dispatch/dagNodeFields.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dagNodeFields.d.ts","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/dagNodeFields.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;CACxC"}

package/dist/remediate/steps/dispatch/dagNodeFields.js

@@ -1,5 +0,0 @@
-// ---------------------------------------------------------------------------
-// DAG-node metadata overlay shape
-// ---------------------------------------------------------------------------
-export {};
-//# sourceMappingURL=dagNodeFields.js.map

package/dist/remediate/steps/dispatch/dagNodeFields.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dagNodeFields.js","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/dagNodeFields.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E"}

package/dist/remediate/steps/dispatch/implementPrompt.d.ts

@@ -1,47 +0,0 @@
-/**
- * Best-effort: repo-relative test files that reference any of `sourceFiles` (by
- * module basename). Pulling them into a block's access lets the worker that
- * changes or removes a symbol also fix the tests that assert it, instead of
- * leaving orphaned test breakage for a separate central mop-up. Matching is
- * deliberately loose (a false positive only grants slightly broader, harmless
- * write access; a false negative is the failure mode we want to avoid).
- */
-export interface TestFileEntry {
-    rel: string;
-    content: string;
-}
-/**
- * Walk the repo ONCE and read every test file's content (bounded). Built once per
- * dispatch and shared across all blocks so the filesystem walk + reads are not
- * repeated per block.
- */
-export declare function buildTestFileIndex(root: string): TestFileEntry[];
-/**
- * Collect test files from `index` that reference any of `sourceFiles` by
- * module basename. When `packageRoot` is supplied (repo-relative prefix, e.g.
- * `packages/foo`), only test files under that package are considered —
- * otherwise all test files in the index are matched (existing behavior).
- */
-export declare function collectReferencingTests(index: TestFileEntry[], sourceFiles: string[], packageRoot?: string): string[];
-/**
- * Returns true when any path in `writePaths` is one of the live infra modules.
- * Paths are normalised to forward-slash form (win32 backslash → `/`) and matched
- * by trailing repo-relative segment so absolute/worktree/relative spellings all
- * resolve identically. Used to gate the live-surface verification section in the
- * implement prompt.
- */
-export declare function isInfraModifyingBlock(writePaths: string[]): boolean;
-/**
- * INV-B3-5: resolve a cited source path to the token the worker should open.
- *
- * A bare basename (`advance.ts`) that uniquely resolves to one tracked path
- * (`src/audit/orchestrator/advance.ts`) is rewritten to that tracked path FIRST,
- * so it never surfaces as a broken `<worktreeRoot>/advance.ts` prefix that
- * misdirects the worker to a non-existent top-level file. Full / dotfile-dir /
- * already-absolute / drive-letter paths pass through unchanged; when a worktree
- * root is present, a relative path is prefixed onto it (unchanged behaviour). An
- * ambiguous or unresolvable basename is left as-is (monotonic — never a
- * regression on paths that already resolved).
- */
-export declare function resolveCitationPathForPrompt(rel: string, worktreeRoot: string | undefined, trackedPaths: ReadonlySet<string>): string;
-//# sourceMappingURL=implementPrompt.d.ts.map

package/dist/remediate/steps/dispatch/implementPrompt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"implementPrompt.d.ts","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/implementPrompt.ts"],"names":[],"mappings":"AAyCA;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAYhE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,aAAa,EAAE,EACtB,WAAW,EAAE,MAAM,EAAE,EACrB,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,EAAE,CAsBV;AAsCD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAUnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAChC,MAAM,CASR"}